@m8t-stack/cli 0.2.23 → 0.2.25

package/dist/cli.js

@@ -604,6 +604,22 @@ async function authedJsonResult(args) {
 async function authedJson(args) {
   return (await authedJsonResult(args)).data;
 }
+async function authedJsonPagedValues(args) {
+  const maxPages = args.maxPages ?? 100;
+  const items = [];
+  let url = args.url;
+  for (let page = 0; url && page < maxPages; page++) {
+    const body = await authedJson({
+      credential: args.credential,
+      scope: args.scope,
+      method: "GET",
+      url
+    });
+    items.push(...body?.value ?? []);
+    url = body?.nextLink;
+  }
+  return items;
+}
 var init_http = __esm({
   "src/lib/http.ts"() {
     "use strict";
@@ -1231,7 +1247,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.23";
+var CLI_VERSION = "0.2.25";
 
 // src/lib/render-error.ts
 init_errors();
@@ -13663,23 +13679,22 @@ var ACCOUNTS_API = "2024-10-01";
 var PROJECTS_API = "2025-04-01-preview";
 async function listProjectsForAccount(credential2, accountId) {
   const url = `${ARM}${accountId}/projects?api-version=${PROJECTS_API}`;
-  return await authedJson({ credential: credential2, scope: ARM_SCOPE2, method: "GET", url }) ?? {};
+  return await authedJsonPagedValues({ credential: credential2, scope: ARM_SCOPE2, url });
 }
 function formatProjectCandidate(c) {
   return `${c.projectName} (account=${c.accountName}, ${c.region})`;
 }
 async function resolveFoundryProject(opts) {
   const candidates = [];
-  const accounts = await authedJson({
+  const accounts = await authedJsonPagedValues({
     credential: opts.credential,
     scope: ARM_SCOPE2,
-    method: "GET",
     url: `${ARM}/subscriptions/${opts.subscriptionId}/providers/Microsoft.CognitiveServices/accounts?api-version=${ACCOUNTS_API}`
-  }) ?? {};
-  for (const acc of accounts.value ?? []) {
+  });
+  for (const acc of accounts) {
     if (acc.kind !== "AIServices" || !acc.name || !acc.id) continue;
     const projects = await listProjectsForAccount(opts.credential, acc.id);
-    for (const proj of projects.value ?? []) {
+    for (const proj of projects) {
       if (!proj.name) continue;
       const projectName = proj.name.includes("/") ? proj.name.slice(proj.name.lastIndexOf("/") + 1) : proj.name;
       candidates.push({
@@ -14297,6 +14312,14 @@ function run(cmd, cmdArgs, cwd, env) {
     c.stderr.on("data", (d) => {
       err += d.toString();
     });
+    c.on("error", (e) => {
+      reject(
+        new LocalCliError({
+          code: "GH_APP_PUSH_FAILED",
+          message: `${cmd} ${cmdArgs.join(" ")} could not run: ${e.message}`
+        })
+      );
+    });
     c.on("close", (code) => {
       if (code === 0) {
         resolve3();
@@ -14627,6 +14650,19 @@ async function promptCollision(ctx, info) {
     rl.close();
   }
 }
+function resolveScaffoldCommit(repoRoot, env) {
+  const baked = env.M8T_BUILD_SHA?.trim();
+  if (baked) return baked;
+  try {
+    return execFileSync("git", ["rev-parse", "HEAD"], {
+      cwd: repoRoot,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim() || "(scaffold)";
+  } catch {
+    return "(scaffold)";
+  }
+}
 function stageAsGitRepo(dir) {
   const steps = [
     { args: ["init", "-b", "main"], label: "git init" },
@@ -14770,7 +14806,7 @@ var BrainCreateCommand = class extends M8tCommand {
       if (needsPush) {
         materializeBrainTree({ templateSrc, destDir: tmpDir, seedDir });
         if (seedName && seedDir) {
-          const headSha = execFileSync("git", ["rev-parse", "HEAD"], { cwd: repoRoot, encoding: "utf8" }).trim();
+          const headSha = resolveScaffoldCommit(repoRoot, env);
           writeSeedMarker({ destDir: tmpDir, seedName, seedDir, refreshedToCommit: headSha, version: "(scaffold)" });
         }
         this.context.stdout.write(
@@ -24397,13 +24433,12 @@ var STORAGE_API2 = "2023-05-01";
 var LA_API = "2023-09-01";
 async function discoverLedgerResources(opts) {
   const { credential: credential2, subscriptionId, resourceGroup } = opts;
-  const storage = await authedJson({
+  const storage = await authedJsonPagedValues({
     credential: credential2,
     scope: ARM_SCOPE8,
-    method: "GET",
     url: `${ARM4}/subscriptions/${subscriptionId}/resourceGroups/${resourceGroup}/providers/Microsoft.Storage/storageAccounts?api-version=${STORAGE_API2}`
-  }) ?? {};
-  const accounts = (storage.value ?? []).filter((a) => a.properties?.primaryEndpoints?.table);
+  });
+  const accounts = storage.filter((a) => a.properties?.primaryEndpoints?.table);
   const ledgerAcct = accounts.find((a) => (a.tags?.["m8t-stack:role"] ?? a.properties?.tags?.["m8t-stack:role"]) === "ledger") ?? (accounts.length === 1 ? accounts[0] : void 0);
   const ledgerTableEndpoint = ledgerAcct?.properties?.primaryEndpoints?.table?.replace(/\/$/, "");
   if (!ledgerTableEndpoint) {
@@ -24413,13 +24448,11 @@ async function discoverLedgerResources(opts) {
       hint: `Found: ${accounts.map((a) => a.name).join(", ") || "(none)"}. Tag the ledger account 'm8t-stack:role=ledger'.`
     });
   }
-  const laList = await authedJson({
+  const ws = await authedJsonPagedValues({
     credential: credential2,
     scope: ARM_SCOPE8,
-    method: "GET",
     url: `${ARM4}/subscriptions/${subscriptionId}/resourceGroups/${resourceGroup}/providers/Microsoft.OperationalInsights/workspaces?api-version=${LA_API}`
-  }) ?? {};
-  const ws = laList.value ?? [];
+  });
   const workspaceId = (ws.length === 1 ? ws[0] : ws.find((w) => w.properties?.customerId))?.properties?.customerId;
   if (!workspaceId) {
     throw new LocalCliError({
@@ -25388,6 +25421,7 @@ init_errors();
 
 // src/lib/bootstrap-mi.ts
 var INSTALLER_GRANT_DESCRIPTION = "m8t-installer auto-reap (bootstrap)";
+var GATEWAY_SUBSCOPE_GRANT_DESCRIPTION = "m8t-gateway auto-reap (bootstrap)";
 async function ensureResourceGroup2(opts) {
   const existing = (await runAz(["group", "show", "--name", opts.name, "--subscription", opts.subscriptionId, "-o", "json"]).catch(() => "")).trim();
   if (existing) return;
@@ -25631,7 +25665,7 @@ async function writeBootstrapState(state, home = os13.homedir()) {
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.30";
+var DEFAULT_INSTALLER_TAG = "v0.1.32";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
@@ -25642,8 +25676,8 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     examples: [
       ["Launch in eastus2", "$0 bootstrap launch --location eastus2"],
       ["BYO app registration", "$0 bootstrap launch --location eastus2 --client-id <appId>"],
-      ["Pin a specific installer tag", "$0 bootstrap launch --location eastus2 --installer-tag v0.1.30"],
-      ["Override the full installer image ref", "$0 bootstrap launch --location eastus2 --installer-image ghcr.io/m8t-labs/m8t-installer:v0.1.30"]
+      ["Pin a specific installer tag", "$0 bootstrap launch --location eastus2 --installer-tag v0.1.32"],
+      ["Override the full installer image ref", "$0 bootstrap launch --location eastus2 --installer-image ghcr.io/m8t-labs/m8t-installer:v0.1.32"]
     ]
   });
   location = Option46.String("--location");
@@ -25869,35 +25903,53 @@ init_errors();
 
 // src/lib/bootstrap-reap.ts
 var ROLE_ASSIGNMENT_API = "2022-04-01";
-async function sweepOrphanOwnerAssignments(opts) {
-  const subScope = `/subscriptions/${opts.subscriptionId}`;
-  const all = JSON.parse(
+var GATEWAY_SUBSCOPE_ROLES = ["Cost Management Reader", "Monitoring Reader"];
+async function listSubscriptionAssignments(subscriptionId) {
+  return JSON.parse(
     await runAz([
       "role",
       "assignment",
       "list",
       "--all",
       "--subscription",
-      opts.subscriptionId,
+      subscriptionId,
       "-o",
       "json"
     ]).catch(() => "[]") || "[]"
   );
+}
+async function deleteAssignmentsById(ids) {
+  for (const id of ids) {
+    await runAz([
+      "rest",
+      "--method",
+      "delete",
+      "--url",
+      `https://management.azure.com${id}?api-version=${ROLE_ASSIGNMENT_API}`
+    ]).catch(() => void 0);
+  }
+}
+async function sweepOrphanGatewaySubRoles(opts) {
+  const subScope = `/subscriptions/${opts.subscriptionId}`;
+  const all = await listSubscriptionAssignments(opts.subscriptionId);
+  const matched = all.filter((r) => {
+    if (r.principalName) return false;
+    if (r.principalType !== "ServicePrincipal") return false;
+    if (r.scope !== subScope) return false;
+    if (r.description === GATEWAY_SUBSCOPE_GRANT_DESCRIPTION) return true;
+    return GATEWAY_SUBSCOPE_ROLES.includes(r.roleDefinitionName ?? "");
+  });
+  if (opts.execute) await deleteAssignmentsById(matched.map((r) => r.id));
+  return matched.map((r) => ({ id: r.id, description: r.description, roleDefinitionName: r.roleDefinitionName, createdOn: r.createdOn }));
+}
+async function sweepOrphanOwnerAssignments(opts) {
+  const subScope = `/subscriptions/${opts.subscriptionId}`;
+  const all = await listSubscriptionAssignments(opts.subscriptionId);
   const matched = all.filter((r) => {
     if (r.description === INSTALLER_GRANT_DESCRIPTION) return true;
     return !r.principalName && r.principalType === "ServicePrincipal" && r.roleDefinitionName === "Owner" && r.scope === subScope;
   });
-  if (opts.execute) {
-    for (const r of matched) {
-      await runAz([
-        "rest",
-        "--method",
-        "delete",
-        "--url",
-        `https://management.azure.com${r.id}?api-version=${ROLE_ASSIGNMENT_API}`
-      ]).catch(() => void 0);
-    }
-  }
+  if (opts.execute) await deleteAssignmentsById(matched.map((r) => r.id));
   return matched.map((r) => ({ id: r.id, description: r.description, createdOn: r.createdOn }));
 }
 async function reapInstaller(opts) {
@@ -25954,22 +26006,30 @@ var BootstrapReapCommand = class extends M8tCommand {
       if (!sub) {
         throw new LocalCliError({ code: "BOOTSTRAP_SWEEP_NO_SUB", message: "No active subscription.", hint: "Run 'az account set --subscription <id>'." });
       }
-      const found = await sweepOrphanOwnerAssignments({ subscriptionId: sub, execute: this.yes === true });
-      if (found.length === 0) {
-        this.context.stdout.write(`${colors.success("\u2713")} No orphaned installer Owner@sub assignments found.
+      const execute = this.yes === true;
+      const owner = await sweepOrphanOwnerAssignments({ subscriptionId: sub, execute });
+      const gateway = await sweepOrphanGatewaySubRoles({ subscriptionId: sub, execute });
+      const total = owner.length + gateway.length;
+      if (total === 0) {
+        this.context.stdout.write(`${colors.success("\u2713")} No orphaned installer Owner@sub or gateway sub-scope assignments found.
 `);
         return 0;
       }
-      for (const f of found) {
-        this.context.stdout.write(`  ${f.id}${f.createdOn ? colors.dim(` (created ${f.createdOn})`) : ""}${f.description ? colors.dim(" [tagged]") : ""}
+      for (const f of owner) {
+        this.context.stdout.write(`  ${colors.dim("Owner@sub")}  ${f.id}${f.createdOn ? colors.dim(` (created ${f.createdOn})`) : ""}${f.description ? colors.dim(" [tagged]") : ""}
+`);
+      }
+      for (const f of gateway) {
+        this.context.stdout.write(`  ${colors.dim(f.roleDefinitionName ?? "gateway sub-scope")}  ${f.id}${f.createdOn ? colors.dim(` (created ${f.createdOn})`) : ""}${f.description ? colors.dim(" [tagged]") : ""}
 `);
       }
-      if (this.yes === true) {
-        this.context.stdout.write(`${colors.success("\u2713")} Removed ${String(found.length)} orphaned Owner@sub assignment(s).
+      const breakdown = `${String(owner.length)} Owner@sub, ${String(gateway.length)} gateway sub-scope`;
+      if (execute) {
+        this.context.stdout.write(`${colors.success("\u2713")} Removed ${String(total)} orphaned assignment(s) (${breakdown}).
 `);
       } else {
         this.context.stdout.write(`
-Found ${String(found.length)} orphaned Owner@sub assignment(s) (dry-run). ${colors.hint("Re-run with --sweep-orphans --yes to delete them.")}
+Found ${String(total)} orphaned assignment(s) (${breakdown}) (dry-run). ${colors.hint("Re-run with --sweep-orphans --yes to delete them.")}
 `);
       }
       return 0;
@@ -25981,10 +26041,12 @@ Found ${String(found.length)} orphaned Owner@sub assignment(s) (dry-run). ${colo
         if (!sub) {
           throw new LocalCliError({ code: "BOOTSTRAP_SWEEP_NO_SUB", message: "No active subscription.", hint: "Run 'az account set --subscription <id>'." });
         }
-        const found = await sweepOrphanOwnerAssignments({ subscriptionId: sub, execute: true });
+        const owner = await sweepOrphanOwnerAssignments({ subscriptionId: sub, execute: true });
+        const gateway = await sweepOrphanGatewaySubRoles({ subscriptionId: sub, execute: true });
+        const total = owner.length + gateway.length;
         this.context.stdout.write(
-          found.length === 0 ? `${colors.success("\u2713")} No bootstrap state and no orphaned installer Owner@sub assignments. Nothing to reap.
-` : `${colors.success("\u2713")} No bootstrap state found; swept ${String(found.length)} orphaned installer Owner@sub assignment(s).
+          total === 0 ? `${colors.success("\u2713")} No bootstrap state and no orphaned installer Owner@sub or gateway sub-scope assignments. Nothing to reap.
+` : `${colors.success("\u2713")} No bootstrap state found; swept ${String(total)} orphaned assignment(s) (${String(owner.length)} Owner@sub, ${String(gateway.length)} gateway sub-scope).
 `
         );
         return 0;
@@ -25992,7 +26054,7 @@ Found ${String(found.length)} orphaned Owner@sub assignment(s) (dry-run). ${colo
       throw new LocalCliError({
         code: "BOOTSTRAP_NO_STATE",
         message: "No bootstrap state to reap.",
-        hint: "Nothing to do. If a launch failed early it may have orphaned an installer Owner@sub grant \u2014 run 'm8t bootstrap reap --force' (or 'm8t bootstrap reap --sweep-orphans --yes') to clean it."
+        hint: "Nothing to do. If a launch failed and its RG was deleted it may have orphaned an installer Owner@sub grant or the gateway's sub-scope reader roles \u2014 run 'm8t bootstrap reap --force' (or 'm8t bootstrap reap --sweep-orphans --yes') to clean them."
       });
     }
     if (this.force !== true) {