@m8t-stack/cli 0.2.27 → 0.2.29

package/dist/cli.js

@@ -931,7 +931,7 @@ var init_foundry_agents = __esm({
     "use strict";
     init_http();
     init_errors();
-    METADATA_SOURCE = "m8t-stack-POC";
+    METADATA_SOURCE = "m8t";
     FOUNDRY_SCOPE2 = "https://ai.azure.com/.default";
     API = "v1";
   }
@@ -1177,7 +1177,7 @@ async function enableHostedBrain(args) {
       // survive the relink version; the managed fields are re-asserted over the
       // spread, and createCoderVersion applies the `brain` arg last.
       ...current.metadata,
-      source: "m8t-stack-POC",
+      source: "m8t",
       kind: "hosted",
       persona: current.metadata?.persona ?? "coding-agent",
       personaVersion: current.metadata?.personaVersion ?? null
@@ -1247,7 +1247,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.27";
+var CLI_VERSION = "0.2.29";
 
 // src/lib/render-error.ts
 init_errors();
@@ -1412,7 +1412,7 @@ var BACKEND_RULES = [
   {
     code: "UPSTREAM_FAILED",
     reason: "kv_secret_malformed",
-    hint: () => "the Key Vault secret for this binding is in an unexpected shape. Manual cleanup may be required \u2014 contact your m8t-stack admin."
+    hint: () => "the Key Vault secret for this binding is in an unexpected shape. Manual cleanup may be required \u2014 contact your m8t admin."
   },
   // NOTE: cascade_partial_failure is handled INLINE in the bind remove +
   // bind cleanup command files (the rendering needs the structured
@@ -1442,50 +1442,32 @@ var BACKEND_RULES = [
   }
 ];
 var LOCAL_RULES = {
-  // Task 12 — foundry-agent-get
   AGENT_CREATE_VERSION_FAILED: "Re-run with `--verbose` for the full response body.",
   AGENT_CREATE_VERSION_NO_VERSION: "Foundry returned 2xx but no version \u2014 likely an API regression. Re-try; if it persists, file an issue.",
   AGENT_GET_FAILED: "Re-run with `--verbose` for the full response body.",
   AGENT_NOT_FOUND: "Use `m8t brain create <name>` to create the worker first, OR run `m8t deploy <name>` to register an existing agent.",
-  // Task 14 — brain-unlink
   AGENT_REDEPLOY_FAILED: "Re-run with `--verbose` for the full response body.",
   AGENT_REDEPLOY_NO_VERSION: "Foundry returned 2xx but no version. Re-try; if it persists, file an issue.",
-  // Task 10/13/14
   AGENT_YAML_NOT_FOUND: "Deploy the worker via `m8t deploy <name>` or the architect first.",
-  // Task 16 — brain link command
   APP_HEALTH_FAILED: "Run `m8t brain check-app` for details, then re-run this command.",
-  // Task 14 — brain-unlink
   APP_UNINSTALL_FAILED: "GitHub App-uninstall DELETE failed. Re-run with `--keep-app-install` if you want to skip this step.",
-  // Task 13 — brain-link
   ARM_AUTH: "Run `az login` and retry.",
   // F2 smoke fix — m8t brain create: stageAsGitRepo step
   BRAIN_GIT_INIT_FAILED: "If git is not installed, install it. Otherwise re-run with --verbose.",
-  // Task 14 — brain-unlink
   BRAIN_NOT_LINKED: "The worker has no brain link. Use `m8t brain link` or `m8t brain create` first.",
-  // Task 13 — brain-link
   BRAIN_YAML_MIRROR_FAILED: "GitHub Contents API PUT failed. Verify the App has `contents: write` permission on the repo.",
-  // Task 13 — brain-link
   CONN_CREATE_FAILED: "Foundry connection PUT failed. Verify Cognitive Services Contributor role on the project.",
-  // Task 14 — brain-unlink
   CONN_DELETE_FAILED: "Foundry connection DELETE failed. Verify your ARM subscription has Contributor on the project.",
-  // Task 13 — brain-link
   CONN_GET_FAILED: "Foundry connection GET failed. Verify your ARM subscription has access to the project.",
-  // Task 13 — brain-link.ts (rename pending: should be FOUNDRY_AUTH_FAILED)
+  // rename pending: should be FOUNDRY_AUTH_FAILED
   FOUNDRY_AUTH: "Run `az login` and retry.",
-  // Task 12 — foundry-agent-get
   FOUNDRY_AUTH_FAILED: "Run `az login` and retry.",
-  // Task 15+16
   KV_URI_NOT_FOUND: "Pass `--kv-uri` or set `AZURE_KEYVAULT_URI` / `KEYVAULT_URI`.",
-  // Task 13 — brain-link
-  LINK_NO_INSTALLATION_ID: "Internal error \u2014 the CLI command must poll for the installation id before calling linkBrain. Report at https://github.com/m8t-stack/m8t-stack-poc/issues.",
-  // Task 16 — brain link command
-  M8T_REPO_ROOT_MISSING: "Re-run `m8t install` from a fresh m8t-stack checkout \u2014 the post-install hook writes ~/.m8t-stack/repo-root.",
-  // Task 14 — persona-render
-  PERSONA_PATH_NOT_ABSOLUTE: "The persona path in ~/.m8t-stack/foundry/<worker>.yaml must be absolute. Re-deploy the worker via the architect.",
-  // Task 9 — persona-render
-  PERSONA_PLACEHOLDER_UNSATISFIED: "Re-deploy the worker via the architect to repopulate fillableFieldValues, OR edit ~/.m8t-stack/foundry/<worker>.yaml manually.",
-  // Task 9 — persona-render
-  PERSONA_READ_FAILED: "Verify the persona path in ~/.m8t-stack/foundry/<worker>.yaml; the architect should have populated it at deploy time.",
+  LINK_NO_INSTALLATION_ID: "Internal error \u2014 the CLI command must poll for the installation id before calling linkBrain. Report at https://github.com/m8t/m8t/issues.",
+  M8T_REPO_ROOT_MISSING: "Re-run `m8t install` from a fresh m8t checkout \u2014 the post-install hook writes ~/.m8t/repo-root.",
+  PERSONA_PATH_NOT_ABSOLUTE: "The persona path in ~/.m8t/foundry/<worker>.yaml must be absolute. Re-deploy the worker via the architect.",
+  PERSONA_PLACEHOLDER_UNSATISFIED: "Re-deploy the worker via the architect to repopulate fillableFieldValues, OR edit ~/.m8t/foundry/<worker>.yaml manually.",
+  PERSONA_READ_FAILED: "Verify the persona path in ~/.m8t/foundry/<worker>.yaml; the architect should have populated it at deploy time.",
   // ── pre-existing entries ──────────────────────────────────────────────────
   AUTH_NOT_SIGNED_IN: "you are not signed in to Azure \u2014 run 'az login' first.",
   AUTH_EXPIRED: "your Azure login expired \u2014 run 'az login' to re-authenticate.",
@@ -11524,7 +11506,7 @@ function redactAzArgs(args) {
 }
 function runAz(args) {
   return new Promise((resolve3, reject) => {
-    const proc = spawn("az", args, { stdio: ["ignore", "pipe", "pipe"] });
+    const proc = spawn("az", args, { stdio: ["ignore", "pipe", "pipe"], shell: process.platform === "win32" });
     const out = [];
     const err = [];
     proc.stdout.on("data", (d) => out.push(d));
@@ -11747,7 +11729,7 @@ import * as path2 from "path";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 function configDir() {
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return path2.join(home, ".m8t-stack");
+  return path2.join(home, ".m8t");
 }
 function getConfigPath() {
   return path2.join(configDir(), "cli-config.yaml");
@@ -11810,7 +11792,7 @@ async function discoverGateway(opts) {
   const candidates = [];
   try {
     for await (const app of client.containerApps.listBySubscription()) {
-      if (app.tags?.["m8t-stack"] !== "gateway") continue;
+      if (app.tags?.m8t !== "gateway") continue;
       const fqdn2 = app.configuration?.ingress?.fqdn;
       const envs = app.template?.containers?.[0]?.env ?? [];
       const envMap = /* @__PURE__ */ new Map();
@@ -11839,7 +11821,7 @@ async function discoverGateway(opts) {
   if (candidates.length === 0) {
     throw new LocalCliError({
       code: "GATEWAY_DISCOVERY_ZERO",
-      message: `No m8t-stack deployment found in subscription ${subscriptionId}.`,
+      message: `No m8t deployment found in subscription ${subscriptionId}.`,
       hint: "If the deployment is in another subscription, run 'az account set --subscription <name>'."
     });
   }
@@ -11850,8 +11832,8 @@ async function discoverGateway(opts) {
     if (pool.length === 0) {
       throw new LocalCliError({
         code: "GATEWAY_DISCOVERY_RG_NOT_FOUND",
-        message: `No m8t-stack gateway found in resource group '${opts.resourceGroup}' (subscription ${subscriptionId}).`,
-        hint: `m8t-stack gateways in this subscription: ${candidates.map((c) => c.resourceGroup).join(", ")}.`
+        message: `No m8t gateway found in resource group '${opts.resourceGroup}' (subscription ${subscriptionId}).`,
+        hint: `m8t gateways in this subscription: ${candidates.map((c) => c.resourceGroup).join(", ")}.`
       });
     }
   }
@@ -11860,7 +11842,7 @@ async function discoverGateway(opts) {
     chosen = pool[0];
   } else if (opts.interactive) {
     const resourceId = await select({
-      message: `Multiple m8t-stack deployments found in subscription ${subscriptionId}. Choose one:`,
+      message: `Multiple m8t deployments found in subscription ${subscriptionId}. Choose one:`,
       choices: pool.map((c) => ({
         name: `${c.name}  (rg=${c.resourceGroup}, ${c.location})`,
         value: c.resourceId
@@ -11877,7 +11859,7 @@ async function discoverGateway(opts) {
   } else {
     throw new LocalCliError({
       code: "GATEWAY_DISCOVERY_MULTIPLE",
-      message: `Multiple m8t-stack gateways found in subscription ${subscriptionId}: ${pool.map((c) => `${c.name} (rg=${c.resourceGroup}, ${c.location})`).join("; ")}.`,
+      message: `Multiple m8t gateways found in subscription ${subscriptionId}: ${pool.map((c) => `${c.name} (rg=${c.resourceGroup}, ${c.location})`).join("; ")}.`,
       hint: `Re-run with --resource-group <rg> to pick one (e.g. --resource-group ${pool[0].resourceGroup}).`
     });
   }
@@ -11965,7 +11947,7 @@ var BindAddCommand = class extends M8tCommand {
     description: "Azure subscription ID to discover gateway in (defaults to active az subscription)."
   });
   resourceGroup = Option.String("--resource-group", {
-    description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
+    description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
     if (!this.worker) {
@@ -12048,7 +12030,7 @@ var BindCleanupCommand = class extends M8tCommand {
     description: "Azure subscription ID to discover gateway in (defaults to active az subscription)."
   });
   resourceGroup = Option2.String("--resource-group", {
-    description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
+    description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
     if (this.bindingId && this.allOrphaned) {
@@ -12189,7 +12171,7 @@ var BindListCommand = class extends M8tCommand {
     description: "Azure subscription ID to discover gateway in (defaults to active az subscription)."
   });
   resourceGroup = Option3.String("--resource-group", {
-    description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
+    description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
     const mode = resolveOutputMode(
@@ -12269,7 +12251,7 @@ var BindRemoveCommand = class extends M8tCommand {
     description: "Azure subscription ID to discover gateway in (defaults to active az subscription)."
   });
   resourceGroup = Option4.String("--resource-group", {
-    description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
+    description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
     const mode = resolveOutputMode(
@@ -12348,7 +12330,7 @@ var BindShowCommand = class extends M8tCommand {
     description: "Azure subscription ID to discover gateway in (defaults to active az subscription)."
   });
   resourceGroup = Option5.String("--resource-group", {
-    description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
+    description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
     const mode = resolveOutputMode(
@@ -12422,7 +12404,7 @@ var FOUNDRY_CONFIG_KEYS = ["tenantId", "clientId", "projectEndpoint"];
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function configDir2() {
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return path3.join(home, ".m8t-stack");
+  return path3.join(home, ".m8t");
 }
 function getFoundryConfigPath() {
   return path3.join(configDir2(), "config.yaml");
@@ -12539,7 +12521,7 @@ init_errors();
 var ConfigSetCommand = class extends M8tCommand {
   static paths = [["config", "set"]];
   static usage = Command8.Usage({
-    description: "Set a value in ~/.m8t-stack/config.yaml (tenantId | clientId | projectEndpoint)."
+    description: "Set a value in ~/.m8t/config.yaml (tenantId | clientId | projectEndpoint)."
   });
   key = Option7.String();
   value = Option7.String();
@@ -12574,7 +12556,7 @@ import { Command as Command9, Option as Option8 } from "clipanion";
 var ConfigShowCommand = class extends M8tCommand {
   static paths = [["config", "show"]];
   static usage = Command9.Usage({
-    description: "Show ~/.m8t-stack/config.yaml (tenant/client/project) + the cached gateway.",
+    description: "Show ~/.m8t/config.yaml (tenant/client/project) + the cached gateway.",
     details: "Displays the Foundry config (config.yaml) and the gateway discovery cache (cli-config.yaml)."
   });
   output = Option8.String("--output");
@@ -12648,7 +12630,7 @@ var TeamAddCommand = class extends M8tCommand {
     description: "Azure subscription ID to discover gateway in (defaults to active az subscription)."
   });
   resourceGroup = Option9.String("--resource-group", {
-    description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
+    description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
     const identities = {};
@@ -12741,7 +12723,7 @@ var TeamAddIdentityCommand = class extends M8tCommand {
     description: "Azure subscription ID to discover gateway in (defaults to active az subscription)."
   });
   resourceGroup = Option10.String("--resource-group", {
-    description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
+    description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
     const identities = {};
@@ -12801,7 +12783,7 @@ var TeamListCommand = class extends M8tCommand {
     description: "Azure subscription ID to discover gateway in (defaults to active az subscription)."
   });
   resourceGroup = Option11.String("--resource-group", {
-    description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
+    description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
     const mode = resolveOutputMode(
@@ -12870,7 +12852,7 @@ var TeamRemoveCommand = class extends M8tCommand {
     description: "Azure subscription ID to discover gateway in (defaults to active az subscription)."
   });
   resourceGroup = Option12.String("--resource-group", {
-    description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
+    description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
     const mode = resolveOutputMode(
@@ -12934,7 +12916,7 @@ var TeamRemoveIdentityCommand = class extends M8tCommand {
     description: "Azure subscription ID to discover gateway in (defaults to active az subscription)."
   });
   resourceGroup = Option13.String("--resource-group", {
-    description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
+    description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
     const channels = [];
@@ -12997,7 +12979,7 @@ var TeamShowCommand = class extends M8tCommand {
     description: "Azure subscription ID to discover gateway in (defaults to active az subscription)."
   });
   resourceGroup = Option14.String("--resource-group", {
-    description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
+    description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
     const mode = resolveOutputMode(
@@ -13391,9 +13373,9 @@ async function probeAppInstallation(args) {
 ${body.slice(0, 300)}`);
 }
 async function tryOpenUrl(url, exec = defaultGhExec) {
-  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
   try {
-    await exec(cmd, [url]);
+    await exec(cmd, args);
   } catch {
   }
 }
@@ -13492,8 +13474,8 @@ var BrainAppCreateCommand = class extends M8tCommand {
       });
     }
     const org = this.org;
-    const pemOut = typeof this.pemOut === "string" ? this.pemOut : path4.join(os.homedir(), ".m8t-stack", "github-app.pem");
-    const credsOut = typeof this.credsOut === "string" ? this.credsOut : path4.join(os.homedir(), ".m8t-stack", "github-app.json");
+    const pemOut = typeof this.pemOut === "string" ? this.pemOut : path4.join(os.homedir(), ".m8t", "github-app.pem");
+    const credsOut = typeof this.credsOut === "string" ? this.credsOut : path4.join(os.homedir(), ".m8t", "github-app.json");
     const port = Number(this.port);
     const onProgress = (m) => this.context.stderr.write(`  ${colors.dim(m)}
 `);
@@ -13591,7 +13573,7 @@ function discoverKvUri(env, override) {
   });
 }
 function tryResolveRepoRoot() {
-  const marker = path5.join(os2.homedir(), ".m8t-stack", "repo-root");
+  const marker = path5.join(os2.homedir(), ".m8t", "repo-root");
   if (!fs5.existsSync(marker)) return null;
   const root = fs5.readFileSync(marker, "utf8").trim();
   return root.length > 0 ? root : null;
@@ -13601,7 +13583,7 @@ function resolveRepoRoot() {
   if (root === null) {
     throw new LocalCliError({
       code: "M8T_REPO_ROOT_MISSING",
-      message: "~/.m8t-stack/repo-root marker missing \u2014 m8t install never completed."
+      message: "~/.m8t/repo-root marker missing \u2014 m8t install never completed."
     });
   }
   return root;
@@ -13756,7 +13738,7 @@ import * as path6 from "path";
 import * as os3 from "os";
 import { parse as parseYaml3, stringify as stringifyYaml3 } from "yaml";
 function agentYamlPath(agentName, home = os3.homedir()) {
-  return path6.join(home, ".m8t-stack", "foundry", `${agentName}.yaml`);
+  return path6.join(home, ".m8t", "foundry", `${agentName}.yaml`);
 }
 function readAgentYaml(agentName, home) {
   const file = agentYamlPath(agentName, home);
@@ -13825,7 +13807,7 @@ function renderPersonaBody(personaPath, fillableFieldValues, instanceName) {
       message: `Could not read persona file '${personaPath}': ${e.message}`
     });
   }
-  const fmMatch = /^---\n[\s\S]*?\n---\n+/.exec(raw);
+  const fmMatch = /^---\r?\n[\s\S]*?\r?\n---(?:\r?\n)+/.exec(raw);
   const body = fmMatch ? raw.slice(fmMatch[0].length) : raw;
   let rendered = body;
   for (const [name, value] of Object.entries(fillableFieldValues)) {
@@ -13837,7 +13819,7 @@ function renderPersonaBody(personaPath, fillableFieldValues, instanceName) {
     throw new LocalCliError({
       code: "PERSONA_PLACEHOLDER_UNSATISFIED",
       message: `Persona '${personaPath}' has un-substituted placeholders: ${names.join(", ")}`,
-      hint: `Add these to fillableFieldValues in ~/.m8t-stack/foundry/<agent>.yaml, or re-deploy the agent via the architect to repopulate.`
+      hint: `Add these to fillableFieldValues in ~/.m8t/foundry/<agent>.yaml, or re-deploy the agent via the architect to repopulate.`
     });
   }
   const out = rendered.replace(/\s+$/, "");
@@ -14685,7 +14667,7 @@ var BrainCreateCommand = class extends M8tCommand {
   static paths = [["brain", "create"]];
   static usage = Command18.Usage({
     description: "Create a new brain repo from brain-template/ (optionally seeded) and link it to <worker>.",
-    details: "Copies ~/.m8t-stack/repo-root/brain-template/ to a tmp dir, optionally overlays brain-seeds/<name>/ (via --seed), stages it as a git repo, runs gh repo create --source --push, then the link cascade. Default --repo-name: <worker>-brain. Default visibility: private.",
+    details: "Copies ~/.m8t/repo-root/brain-template/ to a tmp dir, optionally overlays brain-seeds/<name>/ (via --seed), stages it as a git repo, runs gh repo create --source --push, then the link cascade. Default --repo-name: <worker>-brain. Default visibility: private.",
     examples: [
       ["Create + link with defaults", "$0 brain create cmo --owner orkeren21"],
       ["Custom name + public", "$0 brain create cmo --owner orkeren21 --repo-name cmo-second-brain --public"],
@@ -15110,7 +15092,7 @@ async function listM8tAgents(args) {
     if (!raw.name && !raw.id) continue;
     const name = String(raw.name ?? raw.id);
     const md = raw.metadata ?? raw.versions?.latest?.metadata ?? {};
-    if (md.source === "m8t-stack-POC") {
+    if (md.source === "m8t") {
       result.push({ name, metadata: md });
     }
   }
@@ -15270,12 +15252,12 @@ async function unlinkBrain(args) {
   if (yaml?.personaPath) {
     let personaPath = yaml.personaPath;
     if (!personaPath.startsWith("/")) {
-      const marker = path11.join(args.home ?? os5.homedir(), ".m8t-stack", "repo-root");
+      const marker = path11.join(args.home ?? os5.homedir(), ".m8t", "repo-root");
       if (!fs12.existsSync(marker)) {
         throw new LocalCliError({
           code: "PERSONA_PATH_NOT_ABSOLUTE",
           message: `personaPath '${personaPath}' is relative and the repo-root marker is missing.`,
-          hint: "Re-run 'm8t install' from a fresh m8t-stack checkout (writes ~/.m8t-stack/repo-root) \u2014 or edit the personaPath to absolute."
+          hint: "Re-run 'm8t install' from a fresh m8t checkout (writes ~/.m8t/repo-root) \u2014 or edit the personaPath to absolute."
         });
       }
       personaPath = path11.join(fs12.readFileSync(marker, "utf8").trim(), personaPath);
@@ -15547,7 +15529,7 @@ async function deployPromptAdvisor(args) {
       cause: e
     });
   }
-  const fmMatch = /^---\n([\s\S]*?)\n---/.exec(raw);
+  const fmMatch = /^---\r?\n([\s\S]*?)\r?\n---/.exec(raw);
   const fm = fmMatch ? parseYaml6(fmMatch[1]) : {};
   const model = args.model ?? fm.targets?.foundry?.model;
   if (!model) {
@@ -15629,7 +15611,7 @@ var AgentDeployAdvisorCommand = class extends M8tCommand {
     description: "Azure subscription ID. Defaults to the current az account."
   });
   repoRootFlag = Option22.String("--repo-root", {
-    description: "Path to the m8t-stack repo checkout. Defaults to the ~/.m8t-stack/repo-root marker."
+    description: "Path to the m8t repo checkout. Defaults to the ~/.m8t/repo-root marker."
   });
   output = Option22.String("--output", {
     description: "Output format: pretty (default) or json."
@@ -15641,7 +15623,7 @@ var AgentDeployAdvisorCommand = class extends M8tCommand {
       throw new LocalCliError({
         code: "USAGE",
         message: "--persona is required (e.g. --persona startup-advisor).",
-        hint: "Pass the persona directory name under personas/ in your m8t-stack checkout."
+        hint: "Pass the persona directory name under personas/ in your m8t checkout."
       });
     }
     if (!agentName) {
@@ -15823,7 +15805,7 @@ function readPersonaA2aCard(personaPath) {
   } catch (e) {
     throw new LocalCliError({ code: "PERSONA_READ_FAILED", message: `Could not read persona '${personaPath}': ${e.message}` });
   }
-  const fm = /^---\n([\s\S]*?)\n---/.exec(raw);
+  const fm = /^---\r?\n([\s\S]*?)\r?\n---/.exec(raw);
   if (!fm) throw new LocalCliError({ code: "PERSONA_NO_FRONTMATTER", message: `Persona '${personaPath}' has no frontmatter.` });
   const front = parseYaml7(fm[1]);
   const role = typeof front.role === "string" ? front.role : "";
@@ -16170,7 +16152,7 @@ var AgentRemoveCommand = class extends M8tCommand {
   subscription = Option23.String("--subscription");
   kvUri = Option23.String("--kv-uri");
   resourceGroup = Option23.String("--resource-group", {
-    description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
+    description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   output = Option23.String("--output");
   async executeCommand() {
@@ -16305,7 +16287,7 @@ function resolveBridgeUrl(opts) {
     throw new LocalCliError({
       code: "A2A_NO_GATEWAY_URL",
       message: "Could not resolve the gateway URL for the A2A bridge.",
-      hint: "Pass --gateway-url https://<gateway-fqdn>, set M8T_GATEWAY_URL, or add a gatewayUrl key to ~/.m8t-stack/config.yaml."
+      hint: "Pass --gateway-url https://<gateway-fqdn>, set M8T_GATEWAY_URL, or add a gatewayUrl key to ~/.m8t/config.yaml."
     });
   }
   return `${base}${A2A_PATH}`;
@@ -16317,7 +16299,7 @@ function clean(v) {
   return t.length ? t : void 0;
 }
 function readConfigGatewayUrl(home) {
-  const cfg = path13.join(home ?? os6.homedir(), ".m8t-stack", "config.yaml");
+  const cfg = path13.join(home ?? os6.homedir(), ".m8t", "config.yaml");
   if (!fs16.existsSync(cfg)) return void 0;
   try {
     const o = parseYaml8(fs16.readFileSync(cfg, "utf8"));
@@ -16538,7 +16520,7 @@ function checkArchitectDrift() {
       match: false,
       sourceVersion: "",
       installedVersion: "",
-      advice: `Source persona not found at ${sourcePath}. Check ~/.m8t-stack/repo-root points at a valid checkout.`
+      advice: `Source persona not found at ${sourcePath}. Check ~/.m8t/repo-root points at a valid checkout.`
     };
   }
   const sourceVersion = readVersionFrontmatter(sourcePath);
@@ -16899,7 +16881,7 @@ function resolvePersona(persona, cwd = process.cwd()) {
   } catch {
     return { persona, personaVersion: null };
   }
-  const match = /^---\n([\s\S]*?)\n---/.exec(raw);
+  const match = /^---\r?\n([\s\S]*?)\r?\n---/.exec(raw);
   if (!match) return { persona, personaVersion: null };
   let fm = null;
   try {
@@ -16980,7 +16962,7 @@ async function assertPlatformLive(opts) {
       if (e.code === "GATEWAY_DISCOVERY_ZERO") {
         throw new LocalCliError({
           code: "PLATFORM_NOT_LIVE",
-          message: "The m8t-stack platform isn't deployed yet \u2014 there is no gateway in this subscription.",
+          message: "The m8t platform isn't deployed yet \u2014 there is no gateway in this subscription.",
           hint: "Deploy it first: run the local bootstrap (`m8t bootstrap launch \u2026`) and wait for `m8t bootstrap status` to reach done. If it's in another subscription, run `az account set --subscription <id>`.",
           cause: e
         });
@@ -17154,7 +17136,7 @@ var CoderDeployCommand = class extends M8tCommand {
       cpu: preset.cpu,
       memory: preset.memory,
       env,
-      metadata: { ...currentMetadata, source: "m8t-stack-POC", kind: "hosted", persona: personaName, personaVersion },
+      metadata: { ...currentMetadata, source: "m8t", kind: "hosted", persona: personaName, personaVersion },
       onProgress
     });
     if (typeof this.brain === "string") {
@@ -17267,7 +17249,7 @@ var CoderDeployCommand = class extends M8tCommand {
     this.context.stdout.write(`  project: ${project.projectName} (${project.region})
 `);
     this.context.stdout.write(
-      `  ${colors.hint("next:")} it now appears on MCP (/m8t-stack:workers), the web app, and (when --gateway-url was passed) as an a2a target.
+      `  ${colors.hint("next:")} it now appears on MCP (/m8t:workers), the web app, and (when --gateway-url was passed) as an a2a target.
 `
     );
     return 0;
@@ -17601,7 +17583,7 @@ var AzureExecDeployCommand = class extends M8tCommand {
       cpu: preset.cpu,
       memory: preset.memory,
       env,
-      metadata: { source: "m8t-stack-POC", kind: "hosted", persona: personaName, personaVersion },
+      metadata: { source: "m8t", kind: "hosted", persona: personaName, personaVersion },
       onProgress
     });
     onProgress?.(`granting Contributor at ${grantScope}\u2026`);
@@ -18061,7 +18043,7 @@ async function resolveReleaseContent(manifest, opts = {}) {
     return opts.contentDir;
   }
   const commit = manifest.platform.commit;
-  const cacheRoot = opts.cacheRoot ?? path19.join(os8.homedir(), ".m8t-stack", "cache");
+  const cacheRoot = opts.cacheRoot ?? path19.join(os8.homedir(), ".m8t", "cache");
   const dest = path19.join(cacheRoot, `release-${commit}`);
   if (fs20.existsSync(path19.join(dest, "personas"))) return dest;
   const fetchImpl = opts.fetchImpl ?? fetch;
@@ -18125,7 +18107,7 @@ async function discoverStampStorage(opts) {
     url: `${ARM3}/subscriptions/${opts.subscriptionId}/resourceGroups/${opts.resourceGroup}/providers/Microsoft.Storage/storageAccounts?api-version=${STORAGE_API}`
   }) ?? {};
   const accounts = (list.value ?? []).filter((a) => a.properties?.primaryEndpoints?.table);
-  const chosen = accounts.find((a) => a.tags?.["m8t-stack"] === "storage") ?? accounts.find((a) => a.tags?.["m8t-stack:role"] === "gateway" || a.tags?.["m8t-stack:role"] === "ledger") ?? (accounts.length === 1 ? accounts[0] : void 0);
+  const chosen = accounts.find((a) => a.tags?.m8t === "storage") ?? accounts.find((a) => a.tags?.["m8t:role"] === "gateway" || a.tags?.["m8t:role"] === "ledger") ?? (accounts.length === 1 ? accounts[0] : void 0);
   const tableEndpoint = chosen?.properties?.primaryEndpoints?.table?.replace(/\/$/, "");
   if (!tableEndpoint || !chosen?.id || !chosen.name) {
     throw new LocalCliError({
@@ -18280,7 +18262,7 @@ function buildBicepParams(p) {
   return params;
 }
 async function resolveRepoRoot2(home = os9.homedir()) {
-  const marker = path20.join(home, ".m8t-stack", "repo-root");
+  const marker = path20.join(home, ".m8t", "repo-root");
   try {
     const root = (await fs21.readFile(marker, "utf8")).trim();
     if (!root) throw new Error("empty");
@@ -18288,8 +18270,8 @@ async function resolveRepoRoot2(home = os9.homedir()) {
   } catch {
     throw new LocalCliError({
       code: "DEPLOY_NO_REPO_ROOT",
-      message: "~/.m8t-stack/repo-root marker is missing or empty.",
-      hint: "Run 'm8t install' from an m8t-stack checkout (it writes the marker), or run 'm8t deploy' from the repo."
+      message: "~/.m8t/repo-root marker is missing or empty.",
+      hint: "Run 'm8t install' from an m8t checkout (it writes the marker), or run 'm8t deploy' from the repo."
     });
   }
 }
@@ -18353,7 +18335,7 @@ async function ensureResourceGroup(name, location) {
     await runAz(["group", "show", "--name", name, "--output", "json"]).catch(() => "") || "null"
   );
   if (existing) return;
-  await runAz(["group", "create", "--name", name, "--location", location, "--tags", "m8t-stack=deployment"]);
+  await runAz(["group", "create", "--name", name, "--location", location, "--tags", "m8t=deployment"]);
 }
 function resolveAcrPullIdentity(opts) {
   return opts.explicit ?? "";
@@ -18727,7 +18709,7 @@ function declaredFillableFields(personaPath) {
   } catch {
     return [];
   }
-  const fmMatch = /^---\n([\s\S]*?)\n---/.exec(raw);
+  const fmMatch = /^---\r?\n([\s\S]*?)\r?\n---/.exec(raw);
   if (!fmMatch) return [];
   try {
     const fm = parseYaml10(fmMatch[1]);
@@ -18825,13 +18807,13 @@ var PlatformStatusCommand = class extends M8tCommand {
   });
   subscription = Option29.String("--subscription");
   resourceGroup = Option29.String("--resource-group", {
-    description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
+    description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   to = Option29.String("--to", {
     description: "Check status against a pinned platform version (defaults to the current release channel)."
   });
   contentDir = Option29.String("--content-dir", {
-    description: "Path to a local m8t-stack repo checkout (skips the tarball tree-SHA fetch)."
+    description: "Path to a local m8t repo checkout (skips the tarball tree-SHA fetch)."
   });
   manifestUrl = Option29.String("--manifest-url", {
     description: "Fetch the release manifest from this URL instead of the release channel."
@@ -19559,7 +19541,7 @@ var PlatformUpdateCommand = class extends M8tCommand {
   });
   subscription = Option30.String("--subscription");
   resourceGroup = Option30.String("--resource-group", {
-    description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
+    description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   to = Option30.String("--to", {
     description: "Pin the platform version to converge to (defaults to the current release channel)."
@@ -19575,7 +19557,7 @@ var PlatformUpdateCommand = class extends M8tCommand {
     description: "Required with --force-infra \u2014 the existing deployment's resource-name suffix (avoids provisioning duplicates)."
   });
   contentDir = Option30.String("--content-dir", {
-    description: "Path to a local m8t-stack repo checkout (skips the tarball fetch + tree-drift check)."
+    description: "Path to a local m8t repo checkout (skips the tarball fetch + tree-drift check)."
   });
   manifestUrl = Option30.String("--manifest-url", {
     description: "Fetch the release manifest from this URL instead of the release channel."
@@ -20249,7 +20231,7 @@ var PlatformEnableCostReportCommand = class extends M8tCommand {
   });
   subscription = Option31.String("--subscription");
   resourceGroup = Option31.String("--resource-group", {
-    description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
+    description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   acsEndpoint = Option31.String("--acs-endpoint", { required: true, description: "ACS data-plane endpoint, e.g. https://acs-<name>.communication.azure.com/" });
   acsSender = Option31.String("--acs-sender", { required: true, description: "Managed-domain sender address, e.g. DoNotReply@<guid>.azurecomm.net" });
@@ -20341,7 +20323,7 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
   });
   subscription = Option32.String("--subscription");
   resourceGroup = Option32.String("--resource-group", {
-    description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
+    description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   suffix = Option32.String("--suffix", {
     description: "The existing deployment's resource-name suffix. Required when it cannot be recovered from system/infra-params or the live gateway."
@@ -20485,7 +20467,7 @@ import { Command as Command36, Option as Option33 } from "clipanion";
 
 // src/lib/app-reg.ts
 init_errors();
-var APP_NAME = "m8t-stack-webapp";
+var APP_NAME = "m8t-webapp";
 var AZURE_CLI_FIRST_PARTY_APP_ID = "04b07795-8ddb-461a-bbee-02f9e1bf7b46";
 var FOUNDRY_SP_APP_ID = "18a66f5f-dbdf-4c17-9dd7-1634712a9cbe";
 var USER_IMPERSONATION_SCOPE_ID = "1a7925b5-f871-417a-9b8b-303f9f29fa10";
@@ -20525,10 +20507,10 @@ async function ensureExposeAnApi(appId, appObjectId) {
         id: scopeId,
         value: "user_impersonation",
         type: "User",
-        adminConsentDescription: "Allow the application to access m8t-stack on behalf of the signed-in user.",
-        adminConsentDisplayName: "Access m8t-stack",
-        userConsentDescription: "Allow the application to access m8t-stack on your behalf.",
-        userConsentDisplayName: "Access m8t-stack",
+        adminConsentDescription: "Allow the application to access m8t on behalf of the signed-in user.",
+        adminConsentDisplayName: "Access m8t",
+        userConsentDescription: "Allow the application to access m8t on your behalf.",
+        userConsentDisplayName: "Access m8t",
         isEnabled: true
       }
     ];
@@ -20885,7 +20867,7 @@ var DeployCommand = class extends M8tCommand {
   static paths = [["deploy"]];
   static usage = Command36.Usage({
     description: "Deploy (or update) the m8t gateway/webapp stack via Bicep.",
-    details: "Ensures the Entra app reg (or pass --client-id to reuse an existing one \u2014 required if you can't create app regs), writes ~/.m8t-stack/config.yaml, ensures the resource group, and runs deploy/main.bicep. The repo is located via ~/.m8t-stack/repo-root."
+    details: "Ensures the Entra app reg (or pass --client-id to reuse an existing one \u2014 required if you can't create app regs), writes ~/.m8t/config.yaml, ensures the resource group, and runs deploy/main.bicep. The repo is located via ~/.m8t/repo-root."
   });
   subscription = Option33.String("--subscription");
   resourceGroup = Option33.String("--resource-group", "rg-m8t-stack");
@@ -20934,7 +20916,7 @@ var DeployCommand = class extends M8tCommand {
       throw new LocalCliError({
         code: "DEPLOY_NO_FOUNDRY_ENDPOINT",
         message: "No Foundry endpoint provided.",
-        hint: "Pass --foundry-endpoint <url> or set projectEndpoint in ~/.m8t-stack/config.yaml (m8t config set / m8t switch)."
+        hint: "Pass --foundry-endpoint <url> or set projectEndpoint in ~/.m8t/config.yaml (m8t config set / m8t switch)."
       });
     }
     if (this.whatIf) {
@@ -20943,7 +20925,7 @@ var DeployCommand = class extends M8tCommand {
         throw new LocalCliError({
           code: "DEPLOY_WHATIF_NO_CLIENT",
           message: "--what-if needs a client id but none was provided or configured.",
-          hint: "Pass --client-id <appId>, or run from a host with ~/.m8t-stack/config.yaml."
+          hint: "Pass --client-id <appId>, or run from a host with ~/.m8t/config.yaml."
         });
       }
       const foundryResourceId2 = await resolveFoundryResourceId(foundryEndpoint, this.foundryResourceId);
@@ -21564,7 +21546,7 @@ var WhoamiCommand = class extends M8tCommand {
     description: "Azure subscription ID to discover gateway in (defaults to active az subscription)."
   });
   resourceGroup = Option37.String("--resource-group", {
-    description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
+    description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
     const mode = resolveOutputMode(
@@ -21635,7 +21617,7 @@ init_errors();
 import { spawn as spawn4 } from "child_process";
 function runAzd(args) {
   return new Promise((resolve3, reject) => {
-    const proc = spawn4("azd", args, { stdio: ["ignore", "pipe", "pipe"] });
+    const proc = spawn4("azd", args, { stdio: ["ignore", "pipe", "pipe"], shell: process.platform === "win32" });
     const out = [];
     const err = [];
     proc.stdout.on("data", (d) => out.push(d));
@@ -21752,7 +21734,7 @@ function checkFoundryConfig(cfg) {
     return {
       name: "config.yaml",
       status: "FAIL",
-      detail: "missing or invalid ~/.m8t-stack/config.yaml",
+      detail: "missing or invalid ~/.m8t/config.yaml",
       remediation: "m8t switch   (or  m8t config set tenantId|clientId|projectEndpoint <value>)"
     };
   }
@@ -21876,27 +21858,46 @@ function checkRepoRoot(probe) {
     return {
       name: "brain repo-root",
       status: "FAIL",
-      detail: "~/.m8t-stack/repo-root marker missing \u2014 m8t install never completed",
-      remediation: 're-run the m8t-stack install (writes ~/.m8t-stack/repo-root), or: printf %s "$(git -C <m8t-stack-poc-checkout> rev-parse --show-toplevel)" > ~/.m8t-stack/repo-root'
+      detail: "~/.m8t/repo-root marker missing \u2014 m8t install never completed",
+      remediation: 're-run the m8t install (writes ~/.m8t/repo-root), or: printf %s "$(git -C <m8t-checkout> rev-parse --show-toplevel)" > ~/.m8t/repo-root'
     };
   }
   if (!probe.isDir) {
     return {
       name: "brain repo-root",
       status: "FAIL",
-      detail: `~/.m8t-stack/repo-root \u2192 ${probe.path} \u2014 that path does not exist or is not a directory`,
-      remediation: 'the m8t-stack checkout moved or was deleted; point the marker at the current checkout: printf %s "$(git -C <m8t-stack-poc-checkout> rev-parse --show-toplevel)" > ~/.m8t-stack/repo-root'
+      detail: `~/.m8t/repo-root \u2192 ${probe.path} \u2014 that path does not exist or is not a directory`,
+      remediation: 'the m8t checkout moved or was deleted; point the marker at the current checkout: printf %s "$(git -C <m8t-checkout> rev-parse --show-toplevel)" > ~/.m8t/repo-root'
     };
   }
   if (!probe.isGitCheckout) {
     return {
       name: "brain repo-root",
       status: "WARN",
-      detail: `~/.m8t-stack/repo-root \u2192 ${probe.path} exists but is not a git checkout (no .git) \u2014 brain-loader template + persona paths may be stale`,
-      remediation: "point the marker at the m8t-stack-poc git checkout (it reads targets/foundry/brain-loader.md from there)"
+      detail: `~/.m8t/repo-root \u2192 ${probe.path} exists but is not a git checkout (no .git) \u2014 brain-loader template + persona paths may be stale`,
+      remediation: "point the marker at the m8t git checkout (it reads targets/foundry/brain-loader.md from there)"
+    };
+  }
+  return { name: "brain repo-root", status: "PASS", detail: `~/.m8t/repo-root \u2192 ${probe.path}` };
+}
+function checkLegacyStateDir(probe) {
+  if (!probe.legacyExists) {
+    return { name: "state dir", status: "PASS", detail: "no legacy ~/.m8t-stack folder" };
+  }
+  if (!probe.currentExists) {
+    return {
+      name: "state dir",
+      status: "WARN",
+      detail: "found legacy ~/.m8t-stack but no ~/.m8t \u2014 the state folder was renamed to ~/.m8t",
+      remediation: "mv ~/.m8t-stack ~/.m8t"
     };
   }
-  return { name: "brain repo-root", status: "PASS", detail: `~/.m8t-stack/repo-root \u2192 ${probe.path}` };
+  return {
+    name: "state dir",
+    status: "WARN",
+    detail: "legacy ~/.m8t-stack exists alongside ~/.m8t \u2014 only ~/.m8t is read",
+    remediation: "review ~/.m8t-stack for anything you still need, then remove it"
+  };
 }
 
 // src/commands/doctor.ts
@@ -21963,7 +21964,7 @@ async function resolveAccountLocation(accountId) {
   }
 }
 function probeRepoRoot() {
-  const marker = path28.join(os11.homedir(), ".m8t-stack", "repo-root");
+  const marker = path28.join(os11.homedir(), ".m8t", "repo-root");
   if (!fs26.existsSync(marker)) {
     return { markerExists: false, path: null, isDir: false, isGitCheckout: false };
   }
@@ -21983,6 +21984,12 @@ function probeRepoRoot() {
   const isGitCheckout = isDir && fs26.existsSync(path28.join(repoPath, ".git"));
   return { markerExists: true, path: repoPath, isDir, isGitCheckout };
 }
+function probeLegacyStateDir() {
+  return {
+    legacyExists: fs26.existsSync(path28.join(os11.homedir(), ".m8t-stack")),
+    currentExists: fs26.existsSync(path28.join(os11.homedir(), ".m8t"))
+  };
+}
 var DoctorCommand = class extends M8tCommand {
   static paths = [["doctor"]];
   static usage = Command42.Usage({
@@ -21991,7 +21998,7 @@ var DoctorCommand = class extends M8tCommand {
   output = Option39.String("--output");
   agent = Option39.String("--agent");
   resourceGroup = Option39.String("--resource-group", {
-    description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
+    description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
     const mode = resolveOutputMode(
@@ -22025,6 +22032,7 @@ var DoctorCommand = class extends M8tCommand {
     emit(checkFoundryConfig(foundry));
     emit(checkTenantAlignment(az, foundry));
     emit(checkRepoRoot(probeRepoRoot()));
+    emit(checkLegacyStateDir(probeLegacyStateDir()));
     checking("gateway");
     let gw = { ok: false, detail: "not probed" };
     try {
@@ -22114,7 +22122,7 @@ import * as path29 from "path";
 import { parse as parseYaml11, stringify as stringifyYaml4 } from "yaml";
 function profilesDir() {
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return path29.join(home, ".m8t-stack", "profiles");
+  return path29.join(home, ".m8t", "profiles");
 }
 function getProfilePath(name) {
   return path29.join(profilesDir(), `${path29.basename(name)}.yaml`);
@@ -22364,7 +22372,7 @@ var OpenCommand = class extends M8tCommand {
   print = Option41.Boolean("--print", false);
   output = Option41.String("--output");
   resourceGroup = Option41.String("--resource-group", {
-    description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
+    description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
     const mode = resolveOutputMode(
@@ -23173,7 +23181,7 @@ async function runPipeline(args) {
         ({ items, fetchError } = await fetchItems(sources.conversations, recoveredId));
         if (g.source === "a2a" && !fetchError && items.length > 0 && sources.conversations.retrieveApp) {
           const app = await sources.conversations.retrieveApp(recoveredId);
-          if (app !== "m8t-stack-a2a") {
+          if (app !== "m8t-a2a") {
             didRecover = false;
             items = [];
             conversationId = void 0;
@@ -24508,13 +24516,13 @@ async function discoverLedgerResources(opts) {
     url: `${ARM4}/subscriptions/${subscriptionId}/resourceGroups/${resourceGroup}/providers/Microsoft.Storage/storageAccounts?api-version=${STORAGE_API2}`
   });
   const accounts = storage.filter((a) => a.properties?.primaryEndpoints?.table);
-  const ledgerAcct = accounts.find((a) => (a.tags?.["m8t-stack:role"] ?? a.properties?.tags?.["m8t-stack:role"]) === "ledger") ?? (accounts.length === 1 ? accounts[0] : void 0);
+  const ledgerAcct = accounts.find((a) => (a.tags?.["m8t:role"] ?? a.properties?.tags?.["m8t:role"]) === "ledger") ?? (accounts.length === 1 ? accounts[0] : void 0);
   const ledgerTableEndpoint = ledgerAcct?.properties?.primaryEndpoints?.table?.replace(/\/$/, "");
   if (!ledgerTableEndpoint) {
     throw new LocalCliError({
       code: "DREAM_LEDGER_STORAGE_NOT_FOUND",
       message: `No AgentLedger storage account found in resource group ${resourceGroup}.`,
-      hint: `Found: ${accounts.map((a) => a.name).join(", ") || "(none)"}. Tag the ledger account 'm8t-stack:role=ledger'.`
+      hint: `Found: ${accounts.map((a) => a.name).join(", ") || "(none)"}. Tag the ledger account 'm8t:role=ledger'.`
     });
   }
   const ws = await authedJsonPagedValues({
@@ -25344,6 +25352,32 @@ var FoundryAwaitReadyCommand = class extends M8tCommand {
 
 // src/commands/bootstrap/preflight.ts
 import { Command as Command48, Option as Option45 } from "clipanion";
+
+// ../../packages/telemetry-contract/artifact/tier-map.ts
+var EVENT_TIERS = {
+  "enrolled": 1,
+  "install-started": 1,
+  "install-succeeded": 1,
+  "install-failed": 1,
+  "heartbeat": 1,
+  "update-applied": 1,
+  "update-failed": 1,
+  "consent-changed": 1
+  // extended additively for tier-2 usage events: "usage-rollup": 2
+};
+var EVENT_ENUM = Object.keys(EVENT_TIERS);
+
+// ../../packages/telemetry-contract/src/disclosure.ts
+var DISCLOSURE_TIER1 = "Operational data. To support your installation, m8t receives limited operational data linked to it \u2014 installation and update events, installed versions, and service health signals, along with the company name and contact email you provide. This is service data used only to operate and support the platform; it contains none of your content. Details: TELEMETRY.md.";
+
+// ../../packages/telemetry-contract/src/endpoints.ts
+var INGEST_BASE_URL = (process.env.M8T_INGEST_BASE_URL ?? "").trim() || "https://m8t-admin.wonderfuldesert-721e332f.eastus2.azurecontainerapps.io";
+function ingestUrl(path37) {
+  const base = INGEST_BASE_URL.replace(/\/+$/, "");
+  return `${base}${path37.startsWith("/") ? path37 : `/${path37}`}`;
+}
+
+// src/commands/bootstrap/preflight.ts
 init_errors();
 
 // src/lib/bootstrap-preflight.ts
@@ -25394,7 +25428,7 @@ function buildPreflightBanner(who) {
     "\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557",
     "\u2551  \u26D4  STOP \u2014 READ THIS BEFORE CONTINUING                                 \u2551",
     "\u2551                                                                        \u2551",
-    "\u2551  Installing m8t-stack creates real Azure resources in YOUR            \u2551",
+    "\u2551  Installing m8t creates real Azure resources in YOUR            \u2551",
     "\u2551  subscription and assigns roles. To do that, the account you just     \u2551",
     "\u2551  signed in with MUST be:                                              \u2551",
     "\u2551                                                                        \u2551",
@@ -25418,7 +25452,7 @@ function buildPreflightBanner(who) {
 var BootstrapPreflightCommand = class extends M8tCommand {
   static paths = [["bootstrap", "preflight"]];
   static usage = Command48.Usage({
-    description: "Loudly verify you can install m8t-stack (Owner/UAA + directory admin) and hard-stop if not.",
+    description: "Loudly verify you can install m8t (Owner/UAA + directory admin) and hard-stop if not.",
     details: "Step 1 of `m8t bootstrap`. Prints an unmissable admin-credentials notice, then checks: Owner or User Access Administrator at subscription scope (hard requirement), directory-admin capability to register the app (or pass --client-id), and registers Microsoft.ContainerInstance. Exits non-zero with the exact failing check + remedy.",
     examples: [
       ["Run the preflight", "$0 bootstrap preflight"],
@@ -25433,6 +25467,9 @@ var BootstrapPreflightCommand = class extends M8tCommand {
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
     const oid = await getCallerObjectId();
     this.context.stdout.write(buildPreflightBanner({ upn: account.upn, tenantId: account.tenantId, subscriptionId }) + "\n");
+    this.context.stdout.write(`
+${colors.dim(DISCLOSURE_TIER1)}
+`);
     this.context.stdout.write("Checking your access\u2026\n");
     const sub = await checkSubScopeAdmin(oid, subscriptionId);
     this.context.stdout.write(line(sub.ok, `${sub.role ?? "Owner/UAA"} at subscription scope`, "resource + role-assignment rights"));
@@ -25442,7 +25479,7 @@ var BootstrapPreflightCommand = class extends M8tCommand {
     }
     if (!clientId) {
       const appReg = await checkAppRegCapability(oid);
-      this.context.stdout.write(line(appReg.ok, "Directory admin \u2014 can register the m8t-stack app", "first-run app registration"));
+      this.context.stdout.write(line(appReg.ok, "Directory admin \u2014 can register the m8t app", "first-run app registration"));
       if (!appReg.ok) {
         this.context.stderr.write(failBlock(
           appReg.inconclusive ? "Couldn't verify your directory admin role (Microsoft Graph denied the read \u2014 common for guest accounts)." : "You don't hold a directory admin role (Application / Cloud Application / Global Administrator).",
@@ -25504,7 +25541,7 @@ async function ensureResourceGroup2(opts) {
     "--subscription",
     opts.subscriptionId,
     "--tags",
-    "m8t-stack=deployment",
+    "m8t=deployment",
     "--only-show-errors"
   ]);
 }
@@ -25584,6 +25621,7 @@ function buildAciCreateArgs(s) {
   ];
   if (s.gatewayImageRef) env.push(`GATEWAY_IMAGE_REF=${s.gatewayImageRef}`);
   if (s.foundryTracing) env.push(`FOUNDRY_TRACING=${s.foundryTracing}`);
+  if (s.enrollContactEmail) env.push(`M8T_ENROLL_CONTACT_EMAIL=${s.enrollContactEmail}`);
   if (s.githubApp) {
     const g = s.githubApp;
     env.push(
@@ -25710,7 +25748,7 @@ import * as fs29 from "fs/promises";
 import * as os13 from "os";
 import * as path31 from "path";
 function stateDir(home) {
-  return path31.join(home, ".m8t-stack");
+  return path31.join(home, ".m8t");
 }
 function statePath(home) {
   return path31.join(stateDir(home), "bootstrap.json");
@@ -25734,19 +25772,19 @@ async function writeBootstrapState(state, home = os13.homedir()) {
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.32";
+var DEFAULT_INSTALLER_TAG = "v0.1.34";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
   static paths = [["bootstrap", "launch"]];
   static usage = Command49.Usage({
     description: "Create + authorize the installer managed identity, then kick the cloud installer.",
-    details: "Step 2 of `m8t bootstrap` (run after `preflight`). Ensures the resource group, creates the m8t-stack app registration (or uses --client-id), creates a user-assigned managed identity granted Owner at subscription scope, and launches the published m8t-installer image as an ACI run-to-completion job under that identity. Writes ~/.m8t-stack/bootstrap.json for `status`/`reap`/`finish`.",
+    details: "Step 2 of `m8t bootstrap` (run after `preflight`). Ensures the resource group, creates the m8t app registration (or uses --client-id), creates a user-assigned managed identity granted Owner at subscription scope, and launches the published m8t-installer image as an ACI run-to-completion job under that identity. Writes ~/.m8t/bootstrap.json for `status`/`reap`/`finish`.",
     examples: [
       ["Launch in eastus2", "$0 bootstrap launch --location eastus2"],
       ["BYO app registration", "$0 bootstrap launch --location eastus2 --client-id <appId>"],
-      ["Pin a specific installer tag", "$0 bootstrap launch --location eastus2 --installer-tag v0.1.32"],
-      ["Override the full installer image ref", "$0 bootstrap launch --location eastus2 --installer-image ghcr.io/m8t-labs/m8t-installer:v0.1.32"]
+      ["Pin a specific installer tag", "$0 bootstrap launch --location eastus2 --installer-tag v0.1.33"],
+      ["Override the full installer image ref", "$0 bootstrap launch --location eastus2 --installer-image ghcr.io/m8t-labs/m8t-installer:v0.1.33"]
     ]
   });
   location = Option46.String("--location");
@@ -25775,7 +25813,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
     const out = (m) => this.context.stderr.write(`  ${colors.dim(m)}
 `);
-    const credsPath = typeof this.githubAppCreds === "string" ? this.githubAppCreds : path32.join(os14.homedir(), ".m8t-stack", "github-app.json");
+    const credsPath = typeof this.githubAppCreds === "string" ? this.githubAppCreds : path32.join(os14.homedir(), ".m8t", "github-app.json");
     let githubApp;
     if (fs30.existsSync(credsPath)) {
       let parsed;
@@ -25811,7 +25849,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     }
     out("registering Microsoft.ContainerInstance\u2026");
     await registerContainerInstance(subscriptionId);
-    out("resolving the m8t-stack app registration\u2026");
+    out("resolving the m8t app registration\u2026");
     const appReg = await ensureAppReg({ tenantId: account.tenantId, clientId: clientIdOpt });
     out(`ensuring resource group ${resourceGroup}\u2026`);
     await ensureResourceGroup2({ name: resourceGroup, location, subscriptionId });
@@ -25850,7 +25888,8 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       image: installerImage,
       gatewayImageRef,
       foundryTracing: "skip",
-      githubApp
+      githubApp,
+      enrollContactEmail: account.upn
     });
     this.context.stdout.write(
       `${colors.success("\u2713")} installer launched in ${colors.field(resourceGroup)} (${location}).
@@ -25902,7 +25941,7 @@ var BootstrapStatusCommand = class extends M8tCommand {
     if (!state) {
       throw new LocalCliError({
         code: "BOOTSTRAP_NO_STATE",
-        message: "No bootstrap is in flight (no ~/.m8t-stack/bootstrap.json).",
+        message: "No bootstrap is in flight (no ~/.m8t/bootstrap.json).",
         hint: "Run 'm8t bootstrap launch --location <region>' first."
       });
     }
@@ -26353,7 +26392,7 @@ function composeFounderIdentityNote(id) {
 
 // src/lib/company-profile-seed.ts
 function readGithubAppCreds(credsPath) {
-  const p = credsPath ?? path33.join(os15.homedir(), ".m8t-stack", "github-app.json");
+  const p = credsPath ?? path33.join(os15.homedir(), ".m8t", "github-app.json");
   try {
     return JSON.parse(readFileSync20(p, "utf8"));
   } catch {
@@ -26418,7 +26457,7 @@ async function applyProfileToBrain(args) {
   });
 }
 function spawnDetachedSeedWatch() {
-  const logPath = path33.join(os15.homedir(), ".m8t-stack", "seed-profile.log");
+  const logPath = path33.join(os15.homedir(), ".m8t", "seed-profile.log");
   const fd = openSync(logPath, "a");
   try {
     const child = spawn6(process.execPath, [process.argv[1] ?? "", "bootstrap", "seed-profile", "--watch"], {
@@ -26497,7 +26536,7 @@ var BootstrapFinishCommand = class extends M8tCommand {
   static paths = [["bootstrap", "finish"]];
   static usage = Command52.Usage({
     description: "Point your local tools at the now-live platform (repo-root marker, discovery cache, next steps).",
-    details: "Final step of `m8t bootstrap` (after the install reaches done). Writes ~/.m8t-stack/repo-root, points your local tools at the live gateway, and \u2014 if you completed the onboarding questionnaire \u2014 seeds your brain-backed advisor's brain with your company profile (best-effort; never blocks finish). Run `m8t bootstrap seed-profile` to seed manually later.",
+    details: "Final step of `m8t bootstrap` (after the install reaches done). Writes ~/.m8t/repo-root, points your local tools at the live gateway, and \u2014 if you completed the onboarding questionnaire \u2014 seeds your brain-backed advisor's brain with your company profile (best-effort; never blocks finish). Run `m8t bootstrap seed-profile` to seed manually later.",
     examples: [["Finish local", "$0 bootstrap finish --repo-root /path/to/m8t"]]
   });
   repoRoot = Option49.String("--repo-root");
@@ -26517,7 +26556,7 @@ var BootstrapFinishCommand = class extends M8tCommand {
       });
     }
     const repoRoot = (typeof this.repoRoot === "string" ? this.repoRoot : void 0) ?? process.cwd();
-    const markerDir = path34.join(os16.homedir(), ".m8t-stack");
+    const markerDir = path34.join(os16.homedir(), ".m8t");
     await fs31.mkdir(markerDir, { recursive: true });
     await fs31.writeFile(path34.join(markerDir, "repo-root"), `${repoRoot}
 `, "utf8");
@@ -26577,7 +26616,7 @@ var BootstrapFinishCommand = class extends M8tCommand {
     this.context.stdout.write(renderInstallSummary({ webappUrl, brainOrg }) + "\n");
     this.context.stdout.write(
       `${colors.field("Optional local tooling for your coding agent:")}
-  \u2022 Talk to your deployed workers from agent sessions (e.g. /stacey) \u2014 install the m8t-stack plugin: guides/install/m8t-stack.md.
+  \u2022 Talk to your deployed workers from agent sessions (e.g. /stacey) \u2014 install the m8t plugin: guides/install/m8t-plugin.md.
   \u2022 Azure-capable MCP servers (microsoft/azure-skills, Microsoft Learn) \u2014 see the optional steps in guides/install.md.
   \u2022 Deploy workers conversationally with the opt-in persona skills \u2014 see guides/workers.md.
   \u2022 Make sure your m8t CLI is current: npm i -g @m8t-stack/cli@latest
@@ -26614,7 +26653,7 @@ import * as fs32 from "fs";
 import * as net from "net";
 import * as os17 from "os";
 import * as path35 from "path";
-import { spawn as spawn7 } from "child_process";
+import { spawn as spawn7, spawnSync as spawnSync6 } from "child_process";
 init_errors();
 init_rbac();
 
@@ -26836,14 +26875,14 @@ async function installWebDeps(repoRoot) {
   await runInherit("pnpm", ["install"], repoRoot, "BOOTSTRAP_UI_INSTALL_FAILED");
 }
 function onboardingUiPaths(home = os17.homedir()) {
-  const dir = path35.join(home, ".m8t-stack");
+  const dir = path35.join(home, ".m8t");
   return {
     logPath: path35.join(dir, "onboarding-ui.log"),
     pidPath: path35.join(dir, "onboarding-ui.pid")
   };
 }
 function onboardingRelayPaths(home = os17.homedir()) {
-  const dir = path35.join(home, ".m8t-stack");
+  const dir = path35.join(home, ".m8t");
   return {
     logPath: path35.join(dir, "onboarding-relay.log"),
     pidPath: path35.join(dir, "onboarding-relay.pid")
@@ -26880,7 +26919,8 @@ async function serveOnboardingUiDetached(args) {
     detached: true,
     stdio: ["ignore", fd, fd],
     env: { ...process.env, PORT: args.port },
-    shell: false
+    // pnpm resolves to pnpm.cmd on Windows, which needs a shell to launch.
+    shell: process.platform === "win32"
   });
   fs32.closeSync(fd);
   if (child.pid == null) {
@@ -26920,7 +26960,8 @@ async function serveOnboardingRelayDetached(args) {
       RELAY_ALLOWED_ORIGINS: "http://localhost:3000",
       RELAY_PORT: "8790"
     },
-    shell: false
+    // pnpm resolves to pnpm.cmd on Windows, which needs a shell to launch.
+    shell: process.platform === "win32"
   });
   fs32.closeSync(fd);
   if (child.pid == null) {
@@ -26959,10 +27000,14 @@ function stopPidFile(pidPath) {
   }
   const pid = Number(pidStr);
   if (!Number.isNaN(pid) && pid > 0) {
-    try {
-      process.kill(-pid, "SIGTERM");
-    } catch (e) {
-      if (e.code !== "ESRCH") throw e;
+    if (process.platform === "win32") {
+      spawnSync6("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore" });
+    } else {
+      try {
+        process.kill(-pid, "SIGTERM");
+      } catch (e) {
+        if (e.code !== "ESRCH") throw e;
+      }
     }
   }
   try {
@@ -27037,7 +27082,7 @@ var BootstrapUiCommand = class extends M8tCommand {
     if (!state) {
       throw new LocalCliError({
         code: "BOOTSTRAP_NO_STATE",
-        message: "No bootstrap is in flight (no ~/.m8t-stack/bootstrap.json).",
+        message: "No bootstrap is in flight (no ~/.m8t/bootstrap.json).",
         hint: "Run 'm8t bootstrap launch --location <region>' first."
       });
     }
@@ -27053,8 +27098,8 @@ var BootstrapUiCommand = class extends M8tCommand {
       this.context.stderr.write(`  ${colors.dim(m)}
 `);
     };
-    if (fs33.existsSync(path36.join(os18.homedir(), ".m8t-stack", "config.yaml"))) {
-      out(colors.error("\u26A0 an existing ~/.m8t-stack/config.yaml will override the onboarding app registration in apps/web \u2014 if Microsoft sign-in fails, move it aside and retry."));
+    if (fs33.existsSync(path36.join(os18.homedir(), ".m8t", "config.yaml"))) {
+      out(colors.error("\u26A0 an existing ~/.m8t/config.yaml will override the onboarding app registration in apps/web \u2014 if Microsoft sign-in fails, move it aside and retry."));
     }
     const credential2 = new DefaultAzureCredential20();
     const account = await getAzAccount();
@@ -27177,7 +27222,7 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
       credsPath: typeof this.githubAppCreds === "string" ? this.githubAppCreds : void 0
     });
     if (!ctx) {
-      this.context.stderr.write(`  ${colors.dim("no GitHub App creds (~/.m8t-stack/github-app.json) \u2014 no brain to seed; skipping.")}
+      this.context.stderr.write(`  ${colors.dim("no GitHub App creds (~/.m8t/github-app.json) \u2014 no brain to seed; skipping.")}
 `);
       return 0;
     }
@@ -27214,10 +27259,116 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
   }
 };
 
+// src/commands/telemetry/enroll.ts
+import { Command as Command55, Option as Option52 } from "clipanion";
+init_errors();
+
+// src/lib/telemetry-enroll.ts
+init_errors();
+async function enroll(args) {
+  const f = args.fetchImpl ?? fetch;
+  const url = args.baseUrl ? `${args.baseUrl.replace(/\/+$/, "")}/api/ingest/enroll` : ingestUrl("/api/ingest/enroll");
+  let res;
+  try {
+    res = await f(url, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ schemaVersion: 1, company: args.company, contactEmail: args.contactEmail, subscriptionId: args.subscriptionId, proof: null })
+    });
+  } catch (e) {
+    throw new LocalCliError({ code: "TELEMETRY_ENROLL_UNREACHABLE", message: `Could not reach the telemetry ingest to enroll: ${e instanceof Error ? e.message : String(e)}` });
+  }
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw new LocalCliError({ code: "TELEMETRY_ENROLL_FAILED", message: `Enroll failed (HTTP ${res.status.toString()}): ${body}` });
+  }
+  const json = await res.json();
+  if (!json.instanceId || !json.ingestKey) {
+    throw new LocalCliError({ code: "TELEMETRY_ENROLL_BAD_RESPONSE", message: "Enroll response missing instanceId/ingestKey." });
+  }
+  return { instanceId: json.instanceId, ingestKey: json.ingestKey };
+}
+
+// src/commands/telemetry/enroll.ts
+var INGEST_KEY_SECRET = "m8t-ingest-key";
+async function resolveKeyVaultName(containerAppResourceId) {
+  const kvUri = (await runAz([
+    "containerapp",
+    "show",
+    "--ids",
+    containerAppResourceId,
+    "--query",
+    "properties.template.containers[0].env[?name=='KEY_VAULT_URI'].value | [0]",
+    "-o",
+    "tsv"
+  ])).trim();
+  if (!kvUri) {
+    throw new LocalCliError({
+      code: "TELEMETRY_ENROLL_NO_KV",
+      message: "Could not resolve the platform Key Vault: the gateway Container App has no KEY_VAULT_URI env var.",
+      hint: "Verify the deployment via 'az containerapp show --ids <id> --query properties.template.containers[0].env'."
+    });
+  }
+  const host = new URL(kvUri).hostname;
+  const name = host.split(".")[0];
+  if (!name) {
+    throw new LocalCliError({ code: "TELEMETRY_ENROLL_BAD_KV_URI", message: `Could not parse a Key Vault name from KEY_VAULT_URI '${kvUri}'.` });
+  }
+  return name;
+}
+var TelemetryEnrollCommand = class extends M8tCommand {
+  static paths = [["telemetry", "enroll"]];
+  static usage = Command55.Usage({
+    description: "Enroll this installation for operational telemetry (pre-existing installs).",
+    details: "Mints an instance id + ingest key from the m8t telemetry ingest and stores the key in your platform Key Vault, the same place the installer writes it on a fresh install. Idempotent: refuses if a key already exists unless --force.",
+    examples: [["Enroll", "$0 telemetry enroll"]]
+  });
+  company = Option52.String("--company", { description: "Your company name (optional)." });
+  contactEmail = Option52.String("--contact-email", { description: "Contact email (default: your signed-in az UPN)." });
+  subscription = Option52.String("--subscription", { description: "Azure subscription id (default: your active az subscription)." });
+  resourceGroup = Option52.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
+  force = Option52.Boolean("--force", false, { description: "Re-enroll even if a key is already stored (mints a new instance id)." });
+  async executeCommand() {
+    const account = await getAzAccount();
+    const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
+    const contactEmail = (typeof this.contactEmail === "string" ? this.contactEmail : void 0) ?? account.upn;
+    const company = (typeof this.company === "string" ? this.company : void 0) ?? "";
+    const d = await discoverGateway({
+      subscriptionId,
+      interactive: false,
+      resourceGroup: typeof this.resourceGroup === "string" ? this.resourceGroup : void 0
+    });
+    const kvName = await resolveKeyVaultName(d.containerAppResourceId);
+    if (this.force !== true) {
+      let existing = "";
+      try {
+        existing = await runAz(["keyvault", "secret", "show", "--vault-name", kvName, "--name", INGEST_KEY_SECRET, "--query", "value", "-o", "tsv"]);
+      } catch (e) {
+        rethrowIfAzUnavailable(e);
+        existing = "";
+      }
+      if (existing.trim()) {
+        throw new LocalCliError({
+          code: "TELEMETRY_ALREADY_ENROLLED",
+          message: "This installation is already enrolled.",
+          hint: "Pass --force to re-enroll (mints a new instance id)."
+        });
+      }
+    }
+    const { instanceId, ingestKey } = await enroll({ company, contactEmail, subscriptionId });
+    await runAz(["keyvault", "secret", "set", "--vault-name", kvName, "--name", INGEST_KEY_SECRET, "--value", ingestKey, "--only-show-errors"]);
+    this.context.stdout.write(
+      `${colors.success("\u2713")} enrolled (instance ${instanceId}); ingest key stored in Key Vault ${kvName}. The gateway picks it up on its next cycle.
+`
+    );
+    return 0;
+  }
+};
+
 // src/cli.ts
 var cli = new Cli({
   binaryName: "m8t",
-  binaryLabel: "m8t CLI \u2014 manage m8t-stack deployments",
+  binaryLabel: "m8t CLI \u2014 manage m8t deployments",
   binaryVersion: CLI_VERSION
 });
 cli.register(Builtins.HelpCommand);
@@ -27274,6 +27425,7 @@ cli.register(BootstrapReapCommand);
 cli.register(BootstrapFinishCommand);
 cli.register(BootstrapUiCommand);
 cli.register(BootstrapSeedProfileCommand);
+cli.register(TelemetryEnrollCommand);
 async function main() {
   try {
     return await cli.run(process.argv.slice(2));