@m8t-stack/cli 0.2.28 → 0.2.30

package/dist/cli.js

@@ -1247,7 +1247,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.28";
+var CLI_VERSION = "0.2.30";
 
 // src/lib/render-error.ts
 init_errors();
@@ -1335,7 +1335,7 @@ var BACKEND_RULES = [
     reason: "unknown_channel",
     hint: () => "channel must be one of: telegram, slack, teams."
   },
-  // BAD_REQUEST — F4 binding-validation reasons
+  // BAD_REQUEST — binding-validation reasons
   {
     code: "BAD_REQUEST",
     reason: "no_adapter_registered",
@@ -1391,13 +1391,13 @@ var BACKEND_RULES = [
       return `no binding '${bindingId}' found. Run 'm8t bind list' to see all bindings.`;
     }
   },
-  // BAD_REQUEST — F6 webhook-registration rejection
+  // BAD_REQUEST — webhook-registration rejection
   {
     code: "BAD_REQUEST",
     reason: "webhook_registration_rejected",
     hint: () => "Telegram rejected the bot token. Double-check the token from BotFather and that it isn't revoked."
   },
-  // UPSTREAM_FAILED — F6 webhook-registration transient failure
+  // UPSTREAM_FAILED — webhook-registration transient failure
   {
     code: "UPSTREAM_FAILED",
     reason: "webhook_registration_failed",
@@ -1442,51 +1442,32 @@ var BACKEND_RULES = [
   }
 ];
 var LOCAL_RULES = {
-  // Task 12 — foundry-agent-get
   AGENT_CREATE_VERSION_FAILED: "Re-run with `--verbose` for the full response body.",
   AGENT_CREATE_VERSION_NO_VERSION: "Foundry returned 2xx but no version \u2014 likely an API regression. Re-try; if it persists, file an issue.",
   AGENT_GET_FAILED: "Re-run with `--verbose` for the full response body.",
   AGENT_NOT_FOUND: "Use `m8t brain create <name>` to create the worker first, OR run `m8t deploy <name>` to register an existing agent.",
-  // Task 14 — brain-unlink
   AGENT_REDEPLOY_FAILED: "Re-run with `--verbose` for the full response body.",
   AGENT_REDEPLOY_NO_VERSION: "Foundry returned 2xx but no version. Re-try; if it persists, file an issue.",
-  // Task 10/13/14
   AGENT_YAML_NOT_FOUND: "Deploy the worker via `m8t deploy <name>` or the architect first.",
-  // Task 16 — brain link command
   APP_HEALTH_FAILED: "Run `m8t brain check-app` for details, then re-run this command.",
-  // Task 14 — brain-unlink
   APP_UNINSTALL_FAILED: "GitHub App-uninstall DELETE failed. Re-run with `--keep-app-install` if you want to skip this step.",
-  // Task 13 — brain-link
   ARM_AUTH: "Run `az login` and retry.",
-  // F2 smoke fix — m8t brain create: stageAsGitRepo step
+  // m8t brain create: stageAsGitRepo step
   BRAIN_GIT_INIT_FAILED: "If git is not installed, install it. Otherwise re-run with --verbose.",
-  // Task 14 — brain-unlink
   BRAIN_NOT_LINKED: "The worker has no brain link. Use `m8t brain link` or `m8t brain create` first.",
-  // Task 13 — brain-link
   BRAIN_YAML_MIRROR_FAILED: "GitHub Contents API PUT failed. Verify the App has `contents: write` permission on the repo.",
-  // Task 13 — brain-link
   CONN_CREATE_FAILED: "Foundry connection PUT failed. Verify Cognitive Services Contributor role on the project.",
-  // Task 14 — brain-unlink
   CONN_DELETE_FAILED: "Foundry connection DELETE failed. Verify your ARM subscription has Contributor on the project.",
-  // Task 13 — brain-link
   CONN_GET_FAILED: "Foundry connection GET failed. Verify your ARM subscription has access to the project.",
-  // Task 13 — brain-link.ts (rename pending: should be FOUNDRY_AUTH_FAILED)
+  // rename pending: should be FOUNDRY_AUTH_FAILED
   FOUNDRY_AUTH: "Run `az login` and retry.",
-  // Task 12 — foundry-agent-get
   FOUNDRY_AUTH_FAILED: "Run `az login` and retry.",
-  // Task 15+16
   KV_URI_NOT_FOUND: "Pass `--kv-uri` or set `AZURE_KEYVAULT_URI` / `KEYVAULT_URI`.",
-  // Task 13 — brain-link
   LINK_NO_INSTALLATION_ID: "Internal error \u2014 the CLI command must poll for the installation id before calling linkBrain. Report at https://github.com/m8t/m8t/issues.",
-  // Task 16 — brain link command
   M8T_REPO_ROOT_MISSING: "Re-run `m8t install` from a fresh m8t checkout \u2014 the post-install hook writes ~/.m8t/repo-root.",
-  // Task 14 — persona-render
   PERSONA_PATH_NOT_ABSOLUTE: "The persona path in ~/.m8t/foundry/<worker>.yaml must be absolute. Re-deploy the worker via the architect.",
-  // Task 9 — persona-render
   PERSONA_PLACEHOLDER_UNSATISFIED: "Re-deploy the worker via the architect to repopulate fillableFieldValues, OR edit ~/.m8t/foundry/<worker>.yaml manually.",
-  // Task 9 — persona-render
   PERSONA_READ_FAILED: "Verify the persona path in ~/.m8t/foundry/<worker>.yaml; the architect should have populated it at deploy time.",
-  // ── pre-existing entries ──────────────────────────────────────────────────
   AUTH_NOT_SIGNED_IN: "you are not signed in to Azure \u2014 run 'az login' first.",
   AUTH_EXPIRED: "your Azure login expired \u2014 run 'az login' to re-authenticate.",
   AUTH_WRONG_TENANT: "your active Azure session may be in a different tenant \u2014 run 'az login --tenant <id>'.",
@@ -11524,7 +11505,7 @@ function redactAzArgs(args) {
 }
 function runAz(args) {
   return new Promise((resolve3, reject) => {
-    const proc = spawn("az", args, { stdio: ["ignore", "pipe", "pipe"] });
+    const proc = spawn("az", args, { stdio: ["ignore", "pipe", "pipe"], shell: process.platform === "win32" });
     const out = [];
     const err = [];
     proc.stdout.on("data", (d) => out.push(d));
@@ -13391,9 +13372,9 @@ async function probeAppInstallation(args) {
 ${body.slice(0, 300)}`);
 }
 async function tryOpenUrl(url, exec = defaultGhExec) {
-  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
   try {
-    await exec(cmd, [url]);
+    await exec(cmd, args);
   } catch {
   }
 }
@@ -13825,7 +13806,7 @@ function renderPersonaBody(personaPath, fillableFieldValues, instanceName) {
       message: `Could not read persona file '${personaPath}': ${e.message}`
     });
   }
-  const fmMatch = /^---\n[\s\S]*?\n---\n+/.exec(raw);
+  const fmMatch = /^---\r?\n[\s\S]*?\r?\n---(?:\r?\n)+/.exec(raw);
   const body = fmMatch ? raw.slice(fmMatch[0].length) : raw;
   let rendered = body;
   for (const [name, value] of Object.entries(fillableFieldValues)) {
@@ -14280,8 +14261,8 @@ function isM8tBrainMarker(yamlText) {
   }
   if (!parsed || typeof parsed !== "object") return false;
   const root = parsed;
-  const isObj3 = (v) => typeof v === "object" && v !== null;
-  return isObj3(root.engine) || isObj3(root.processes) || isObj3(root.link);
+  const isObj4 = (v) => typeof v === "object" && v !== null;
+  return isObj4(root.engine) || isObj4(root.processes) || isObj4(root.link);
 }
 async function createBlankRepo(args) {
   const res = await fetch(`https://api.github.com/orgs/${args.org}/repos`, {
@@ -15547,7 +15528,7 @@ async function deployPromptAdvisor(args) {
       cause: e
     });
   }
-  const fmMatch = /^---\n([\s\S]*?)\n---/.exec(raw);
+  const fmMatch = /^---\r?\n([\s\S]*?)\r?\n---/.exec(raw);
   const fm = fmMatch ? parseYaml6(fmMatch[1]) : {};
   const model = args.model ?? fm.targets?.foundry?.model;
   if (!model) {
@@ -15823,7 +15804,7 @@ function readPersonaA2aCard(personaPath) {
   } catch (e) {
     throw new LocalCliError({ code: "PERSONA_READ_FAILED", message: `Could not read persona '${personaPath}': ${e.message}` });
   }
-  const fm = /^---\n([\s\S]*?)\n---/.exec(raw);
+  const fm = /^---\r?\n([\s\S]*?)\r?\n---/.exec(raw);
   if (!fm) throw new LocalCliError({ code: "PERSONA_NO_FRONTMATTER", message: `Persona '${personaPath}' has no frontmatter.` });
   const front = parseYaml7(fm[1]);
   const role = typeof front.role === "string" ? front.role : "";
@@ -16899,7 +16880,7 @@ function resolvePersona(persona, cwd = process.cwd()) {
   } catch {
     return { persona, personaVersion: null };
   }
-  const match = /^---\n([\s\S]*?)\n---/.exec(raw);
+  const match = /^---\r?\n([\s\S]*?)\r?\n---/.exec(raw);
   if (!match) return { persona, personaVersion: null };
   let fm = null;
   try {
@@ -18727,7 +18708,7 @@ function declaredFillableFields(personaPath) {
   } catch {
     return [];
   }
-  const fmMatch = /^---\n([\s\S]*?)\n---/.exec(raw);
+  const fmMatch = /^---\r?\n([\s\S]*?)\r?\n---/.exec(raw);
   if (!fmMatch) return [];
   try {
     const fm = parseYaml10(fmMatch[1]);
@@ -20202,8 +20183,181 @@ function targetManifestSource(ctx, target) {
   return manifestSourceForVersionTag(ctx.channelUrl, target);
 }
 
-// src/commands/platform/enable-cost-report.ts
+// src/commands/platform/seed-stamp.ts
+import { readFileSync as readFileSync17 } from "fs";
 import { Command as Command34, Option as Option31 } from "clipanion";
+import { DefaultAzureCredential as DefaultAzureCredential18, ManagedIdentityCredential as ManagedIdentityCredential2 } from "@azure/identity";
+init_errors();
+
+// src/lib/platform-stamp-seed.ts
+var IMAGE_COMPONENTS = ["gateway", "codingAgent", "azureExecutor"];
+var BARE_SEMVER = /^\d+\.\d+\.\d+$/;
+function isObj3(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function validateDescriptor(raw) {
+  const errors = [];
+  if (!isObj3(raw)) return ["descriptor is not an object"];
+  if (raw.schemaVersion !== 1) errors.push("schemaVersion must be the integer 1");
+  if (typeof raw.platformVersion !== "string" || !BARE_SEMVER.test(raw.platformVersion)) {
+    errors.push(`platformVersion must be a bare X.Y.Z release version, got ${JSON.stringify(raw.platformVersion)}`);
+  }
+  if (!isObj3(raw.generatedFrom)) {
+    errors.push("generatedFrom is required");
+  } else {
+    if (typeof raw.generatedFrom.commit !== "string") {
+      errors.push("generatedFrom.commit is required");
+    }
+    if (typeof raw.generatedFrom.generatedAt !== "string") {
+      errors.push("generatedFrom.generatedAt is required");
+    }
+  }
+  const images = raw.images;
+  if (!isObj3(images)) {
+    errors.push("images is required");
+  } else {
+    for (const key2 of IMAGE_COMPONENTS) {
+      const img = images[key2];
+      if (!isObj3(img)) {
+        errors.push(`images.${key2} is required`);
+        continue;
+      }
+      if (typeof img.ref !== "string" || img.ref.length === 0) errors.push(`images.${key2}.ref is required`);
+      if (typeof img.tag !== "string" || img.tag.length === 0) errors.push(`images.${key2}.tag is required`);
+      if (typeof img.digest !== "string") errors.push(`images.${key2}.digest must be a string (may be empty)`);
+    }
+  }
+  const content = raw.content;
+  if (content !== void 0) {
+    if (!isObj3(content)) {
+      errors.push("content must be an object when present");
+    } else {
+      if (!isObj3(content.personas)) errors.push("content.personas must be an object");
+      if (typeof content.infra !== "string") errors.push("content.infra must be a string");
+      if (typeof content.brainSeedsRev !== "string") errors.push("content.brainSeedsRev must be a string");
+    }
+  }
+  return errors;
+}
+function buildSeedStamp(d, cliVersion, nowIso) {
+  const img = (k) => ({
+    tag: d.images[k].tag,
+    digest: d.images[k].digest,
+    state: "managed"
+  });
+  const personas = {};
+  for (const [name, treeSha] of Object.entries(d.content?.personas ?? {})) {
+    personas[name] = { treeSha, foundryVersion: "" };
+  }
+  const stamp = {
+    schemaVersion: 1,
+    platformVersion: platformTag(d.platformVersion),
+    previousPlatformVersion: null,
+    updatedAt: nowIso,
+    lastResult: "success",
+    cli: cliVersion,
+    origin: "install-seed",
+    components: {
+      gateway: img("gateway"),
+      codingAgent: img("codingAgent"),
+      azureExecutor: img("azureExecutor"),
+      personas,
+      infra: { treeSha: d.content?.infra ?? "" }
+    }
+  };
+  if (d.content?.brainSeedsRev) stamp.components.brainSeeds = { seedRev: d.content.brainSeedsRev };
+  return stamp;
+}
+
+// src/commands/platform/seed-stamp.ts
+async function seedStamp2(args) {
+  const readFileImpl = args.readFileImpl ?? ((p) => readFileSync17(p, "utf8"));
+  const readStampImpl = args.readStampImpl ?? readStamp;
+  const writeStampImpl = args.writeStampImpl ?? ((stamp2, o) => writeStamp({ ...o, stamp: stamp2 }));
+  const discoverImpl = args.discoverImpl ?? discoverStampStorage;
+  const ctx = { credential: args.credential, subscriptionId: args.subscriptionId, resourceGroup: args.resourceGroup };
+  let raw;
+  try {
+    raw = JSON.parse(readFileImpl(args.descriptorPath));
+  } catch (e) {
+    throw new LocalCliError({
+      code: "PLATFORM_SEED_DESCRIPTOR_UNREADABLE",
+      message: `Cannot read the install descriptor at ${args.descriptorPath}.`,
+      hint: "The descriptor is generated at installer-image build time (scripts/install-descriptor-gen.mjs). An image built without that step cannot seed a stamp.",
+      cause: e
+    });
+  }
+  const errors = validateDescriptor(raw);
+  if (errors.length > 0) {
+    throw new LocalCliError({
+      code: "PLATFORM_SEED_DESCRIPTOR_INVALID",
+      message: `The install descriptor at ${args.descriptorPath} is not valid: ${errors.join("; ")}.`,
+      hint: "Regenerate it with scripts/install-descriptor-gen.mjs."
+    });
+  }
+  const descriptor = raw;
+  const { accountName } = await discoverImpl(ctx);
+  const existing = await readStampImpl(ctx);
+  if (existing) {
+    args.onProgress?.(`platform stamp already present (${existing.platformVersion}) \u2014 leaving it untouched.`);
+    return { outcome: "already-stamped", platformVersion: existing.platformVersion, storageAccount: accountName };
+  }
+  const stamp = buildSeedStamp(descriptor, CLI_VERSION, args.nowIso ?? (/* @__PURE__ */ new Date()).toISOString());
+  await writeStampImpl(stamp, { ...ctx, onProgress: args.onProgress });
+  return {
+    outcome: descriptor.content ? "seeded" : "seeded-partial",
+    platformVersion: stamp.platformVersion,
+    storageAccount: accountName,
+    components: {
+      gateway: stamp.components.gateway.tag,
+      codingAgent: stamp.components.codingAgent.tag,
+      azureExecutor: stamp.components.azureExecutor.tag
+    }
+  };
+}
+var PlatformSeedStampCommand = class extends M8tCommand {
+  static paths = [["platform", "seed-stamp"]];
+  static usage = Command34.Usage({
+    description: "INTERNAL: write the initial installed-state stamp from a build-time install descriptor.",
+    details: "Used by the cloud installer at the end of a from-zero install so the platform records which release it is running. Writes the stamp ONLY IF ABSENT \u2014 it never overwrites a stamp written by the converge engine, so a re-run or a container restart is harmless. Not a founder-facing command: to change what is installed, use 'm8t platform update'."
+  });
+  descriptor = Option31.String("--descriptor", { description: "Path to install-descriptor.json (baked into the installer image)." });
+  subscription = Option31.String("--subscription");
+  resourceGroup = Option31.String("--resource-group");
+  miClientId = Option31.String("--mi-client-id", { description: "Authenticate as this user-assigned managed identity instead of the ambient credential." });
+  output = Option31.String("--output");
+  async executeCommand() {
+    const mode = resolveOutputMode(this.output, this.context.stdout);
+    const need = (v, flag) => {
+      if (typeof v !== "string" || v.trim().length === 0) {
+        throw new LocalCliError({ code: "PLATFORM_SEED_ARG_MISSING", message: `${flag} is required.` });
+      }
+      return v.trim();
+    };
+    const onProgress = (m) => {
+      this.context.stderr.write(`${m}
+`);
+    };
+    const credential2 = typeof this.miClientId === "string" && this.miClientId.trim().length > 0 ? new ManagedIdentityCredential2({ clientId: this.miClientId.trim() }) : new DefaultAzureCredential18();
+    const result = await seedStamp2({
+      descriptorPath: need(this.descriptor, "--descriptor"),
+      credential: credential2,
+      subscriptionId: need(this.subscription, "--subscription"),
+      resourceGroup: need(this.resourceGroup, "--resource-group"),
+      onProgress
+    });
+    if (mode === "json") {
+      this.context.stdout.write(renderJson(result) + "\n");
+    } else {
+      this.context.stdout.write(`${result.outcome}: ${result.platformVersion} (storage ${result.storageAccount})
+`);
+    }
+    return 0;
+  }
+};
+
+// src/commands/platform/enable-cost-report.ts
+import { Command as Command35, Option as Option32 } from "clipanion";
 
 // src/lib/wire-gateway-acs.ts
 init_rbac();
@@ -20243,18 +20397,18 @@ async function wireGatewayForAcs(args) {
 init_errors();
 var PlatformEnableCostReportCommand = class extends M8tCommand {
   static paths = [["platform", "enable-cost-report"]];
-  static usage = Command34.Usage({
+  static usage = Command35.Usage({
     description: "Wire the deployed gateway to send the bi-weekly cost report via ACS Email.",
     details: "Discovers the live gateway Container App, grants its managed identity Contributor at the ACS resource scope (authorising the ACS Email send), and sets M8T_ACS_ENDPOINT / M8T_ACS_SENDER / M8T_ENABLE_COST_REPORTER=1 on the gateway. Idempotent \u2014 safely re-runnable. ACS is created during the executor deploy; pass its endpoint, sender, and resource id (from that deploy or 'az communication list')."
   });
-  subscription = Option31.String("--subscription");
-  resourceGroup = Option31.String("--resource-group", {
+  subscription = Option32.String("--subscription");
+  resourceGroup = Option32.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
-  acsEndpoint = Option31.String("--acs-endpoint", { required: true, description: "ACS data-plane endpoint, e.g. https://acs-<name>.communication.azure.com/" });
-  acsSender = Option31.String("--acs-sender", { required: true, description: "Managed-domain sender address, e.g. DoNotReply@<guid>.azurecomm.net" });
-  acsResourceId = Option31.String("--acs-resource-id", { required: true, description: "ARM resource id of the acs-<name> Communication Service \u2014 the role-grant scope." });
-  output = Option31.String("--output");
+  acsEndpoint = Option32.String("--acs-endpoint", { required: true, description: "ACS data-plane endpoint, e.g. https://acs-<name>.communication.azure.com/" });
+  acsSender = Option32.String("--acs-sender", { required: true, description: "Managed-domain sender address, e.g. DoNotReply@<guid>.azurecomm.net" });
+  acsResourceId = Option32.String("--acs-resource-id", { required: true, description: "ARM resource id of the acs-<name> Communication Service \u2014 the role-grant scope." });
+  output = Option32.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -20328,39 +20482,39 @@ var PlatformEnableCostReportCommand = class extends M8tCommand {
 };
 
 // src/commands/platform/enable-auto-update.ts
-import { Command as Command35, Option as Option32 } from "clipanion";
+import { Command as Command36, Option as Option33 } from "clipanion";
 import { confirm as confirm6 } from "@inquirer/prompts";
-import { DefaultAzureCredential as DefaultAzureCredential18 } from "@azure/identity";
+import { DefaultAzureCredential as DefaultAzureCredential19 } from "@azure/identity";
 init_errors();
 var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
   static paths = [["platform", "enable-auto-update"]];
-  static usage = Command35.Usage({
+  static usage = Command36.Usage({
     category: "Platform",
     description: "Retrofit the auto-updater (MI + cron job + role assignments) onto an existing install.",
     details: "For an install that predates the Platform Update Framework: recovers the deployment's resource-name suffix (from the stamped system/infra-params row, or by verified derivation from the live gateway), recovers the other bicep params from live state (WITHOUT changing the deployed gateway image), and re-runs deploy/main.bicep with provisionUpdater=true \u2014 which provisions the updater managed identity, the cron Container Apps Job, and every role assignment (Owner@RG + Foundry User@account + Storage Table + Storage Blob + AcrPull), all scoped to the resource group. On success, backfills system/infra-params so future converges never have to re-derive the suffix. Idempotent \u2014 safe to re-run."
   });
-  subscription = Option32.String("--subscription");
-  resourceGroup = Option32.String("--resource-group", {
+  subscription = Option33.String("--subscription");
+  resourceGroup = Option33.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
-  suffix = Option32.String("--suffix", {
+  suffix = Option33.String("--suffix", {
     description: "The existing deployment's resource-name suffix. Required when it cannot be recovered from system/infra-params or the live gateway."
   });
-  installerImage = Option32.String("--installer-image", {
+  installerImage = Option33.String("--installer-image", {
     required: true,
     description: "Updater CA-Job image ref (the converge engine at the current release). Required \u2014 an empty image would skip provisioning."
   });
-  updateCron = Option32.String("--update-cron", {
+  updateCron = Option33.String("--update-cron", {
     description: "Cron schedule for the updater job (bicep default applies when omitted)."
   });
-  channelUrl = Option32.String("--channel-url", {
+  channelUrl = Option33.String("--channel-url", {
     description: "Release-channel URL the updater job polls (bicep default applies when omitted)."
   });
-  endpoint = Option32.String("--endpoint", {
+  endpoint = Option33.String("--endpoint", {
     description: "Foundry project endpoint URL. Disambiguates the project in a multi-project subscription."
   });
-  yes = Option32.Boolean("--yes", false);
-  output = Option32.String("--output");
+  yes = Option33.Boolean("--yes", false);
+  output = Option33.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -20379,7 +20533,7 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
       resourceGroup: this.resourceGroup
     });
     const { resourceGroup, name: gatewayName } = parseContainerAppResourceId(gw.containerAppResourceId);
-    const credential2 = new DefaultAzureCredential18();
+    const credential2 = new DefaultAzureCredential19();
     const account = await getAzAccount();
     const subscriptionId = this.subscription ?? account.subscriptionId;
     const explicitSuffix = typeof this.suffix === "string" && this.suffix.length > 0 ? this.suffix : void 0;
@@ -20481,7 +20635,7 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
 };
 
 // src/commands/deploy.ts
-import { Command as Command36, Option as Option33 } from "clipanion";
+import { Command as Command37, Option as Option34 } from "clipanion";
 
 // src/lib/app-reg.ts
 init_errors();
@@ -20883,40 +21037,40 @@ function classifyWhatIf(changes) {
 var DEFAULT_IMAGE_REF = "ghcr.io/m8t-labs/m8t:latest";
 var DeployCommand = class extends M8tCommand {
   static paths = [["deploy"]];
-  static usage = Command36.Usage({
+  static usage = Command37.Usage({
     description: "Deploy (or update) the m8t gateway/webapp stack via Bicep.",
     details: "Ensures the Entra app reg (or pass --client-id to reuse an existing one \u2014 required if you can't create app regs), writes ~/.m8t/config.yaml, ensures the resource group, and runs deploy/main.bicep. The repo is located via ~/.m8t/repo-root."
   });
-  subscription = Option33.String("--subscription");
-  resourceGroup = Option33.String("--resource-group", "rg-m8t-stack");
-  location = Option33.String("--location", "eastus");
-  suffix = Option33.String("--suffix", "");
-  imageRef = Option33.String("--image-ref", DEFAULT_IMAGE_REF);
-  acrPullIdentity = Option33.String("--acrpull-identity");
-  acrResourceId = Option33.String("--acr-resource-id");
-  foundryEndpoint = Option33.String("--foundry-endpoint");
-  foundryResourceId = Option33.String("--foundry-resource-id");
-  foundryTracing = Option33.String("--foundry-tracing");
+  subscription = Option34.String("--subscription");
+  resourceGroup = Option34.String("--resource-group", "rg-m8t-stack");
+  location = Option34.String("--location", "eastus");
+  suffix = Option34.String("--suffix", "");
+  imageRef = Option34.String("--image-ref", DEFAULT_IMAGE_REF);
+  acrPullIdentity = Option34.String("--acrpull-identity");
+  acrResourceId = Option34.String("--acr-resource-id");
+  foundryEndpoint = Option34.String("--foundry-endpoint");
+  foundryResourceId = Option34.String("--foundry-resource-id");
+  foundryTracing = Option34.String("--foundry-tracing");
   // project | account | skip (bicep default: project)
-  clientId = Option33.String("--client-id");
-  whatIf = Option33.Boolean("--what-if", false);
-  output = Option33.String("--output");
-  // Referee (E2-F5) — all optional, undefined by default ⇒ the bicep defaults
+  clientId = Option34.String("--client-id");
+  whatIf = Option34.Boolean("--what-if", false);
+  output = Option34.String("--output");
+  // Referee — all optional, undefined by default ⇒ the bicep defaults
   // apply (dormant: gatewayCpu=0.25, gatewayMemory=0.5Gi, every referee/exam var
   // empty). Only pass these when explicitly enabling the referee exam stack.
-  gatewayCpu = Option33.String("--gateway-cpu");
-  gatewayMemory = Option33.String("--gateway-memory");
-  refereeEnabled = Option33.String("--referee-enabled");
-  refereeBrainRepos = Option33.String("--referee-brain-repos");
-  refereeFeedRepo = Option33.String("--referee-feed-repo");
-  refereeInstallationId = Option33.String("--referee-installation-id");
-  refereeWebhookHmacKvUri = Option33.String("--referee-webhook-hmac-kv-uri");
-  examKvUri = Option33.String("--exam-kv-uri");
-  examLaWorkspaceId = Option33.String("--exam-la-workspace-id");
-  brainEvalDeployment = Option33.String("--brain-eval-deployment");
-  brainAppLogin = Option33.String("--brain-app-login");
-  refereeCheckpointDir = Option33.String("--referee-checkpoint-dir");
-  examApiBase = Option33.String("--exam-api-base");
+  gatewayCpu = Option34.String("--gateway-cpu");
+  gatewayMemory = Option34.String("--gateway-memory");
+  refereeEnabled = Option34.String("--referee-enabled");
+  refereeBrainRepos = Option34.String("--referee-brain-repos");
+  refereeFeedRepo = Option34.String("--referee-feed-repo");
+  refereeInstallationId = Option34.String("--referee-installation-id");
+  refereeWebhookHmacKvUri = Option34.String("--referee-webhook-hmac-kv-uri");
+  examKvUri = Option34.String("--exam-kv-uri");
+  examLaWorkspaceId = Option34.String("--exam-la-workspace-id");
+  brainEvalDeployment = Option34.String("--brain-eval-deployment");
+  brainAppLogin = Option34.String("--brain-app-login");
+  refereeCheckpointDir = Option34.String("--referee-checkpoint-dir");
+  examApiBase = Option34.String("--exam-api-base");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -21056,7 +21210,7 @@ var DeployCommand = class extends M8tCommand {
 
 // src/commands/eval/skill.ts
 import { spawnSync as spawnSync4 } from "child_process";
-import { Command as Command37, Option as Option34 } from "clipanion";
+import { Command as Command38, Option as Option35 } from "clipanion";
 init_errors();
 var DECISIONS = /* @__PURE__ */ new Set(["promote", "reject", "needs_review"]);
 var JUDGE_STATUSES = /* @__PURE__ */ new Set(["ok", "skipped", "unavailable"]);
@@ -21081,14 +21235,14 @@ function parseVerdict(stdout) {
 }
 var EvalSkillCommand = class extends M8tCommand {
   static paths = [["eval", "skill"]];
-  static usage = Command37.Usage({
+  static usage = Command38.Usage({
     description: "Vet one inbox skill candidate (Brain Faculties Eval F1): promote / reject / needs_review. Shells out to the Python `brain-eval` core (override its path with $BRAIN_EVAL_BIN)."
   });
-  candidate = Option34.String();
-  skillsDir = Option34.String("--skills-dir");
-  noJudge = Option34.Boolean("--no-judge", false);
-  deployment = Option34.String("--deployment");
-  output = Option34.String("--output");
+  candidate = Option35.String();
+  skillsDir = Option35.String("--skills-dir");
+  noJudge = Option35.Boolean("--no-judge", false);
+  deployment = Option35.String("--deployment");
+  output = Option35.String("--output");
   executeCommand() {
     return Promise.resolve(this._runCommand());
   }
@@ -21145,9 +21299,9 @@ var EvalSkillCommand = class extends M8tCommand {
 
 // src/commands/eval/exam.ts
 import { spawnSync as spawnSync5 } from "child_process";
-import { writeFileSync as writeFileSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync17, existsSync as existsSync15, readdirSync as readdirSync2 } from "fs";
+import { writeFileSync as writeFileSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync18, existsSync as existsSync15, readdirSync as readdirSync2 } from "fs";
 import { join as join27 } from "path";
-import { Command as Command38, Option as Option35 } from "clipanion";
+import { Command as Command39, Option as Option36 } from "clipanion";
 init_errors();
 init_esm();
 function parseArmToken(tok, opts) {
@@ -21350,7 +21504,7 @@ function readSealedTaskIds(taskSetVersion, refereeHomeOut, env = process.env) {
   const manifestPath = join27(home, "tasksets", worker, versionDir, "manifest.yaml");
   let text;
   try {
-    text = readFileSync17(manifestPath, "utf-8");
+    text = readFileSync18(manifestPath, "utf-8");
   } catch (e) {
     throw new LocalCliError({
       code: "EXAM_REDACTION_UNSAFE",
@@ -21377,24 +21531,24 @@ function buildPlan(args) {
 }
 var EvalExamCommand = class extends M8tCommand {
   static paths = [["eval", "exam"]];
-  static usage = Command38.Usage({
+  static usage = Command39.Usage({
     description: "Run a brain exam (Brain Referee E2-F2): impact A/B + dream-delta. Resolves the plan, then shells out to the Python `brain-exam` orchestrator (override its path with $BRAIN_EXAM_BIN). Renders an ExamVerdict: three-valued verdict + power note + per-task flips."
   });
-  worker = Option35.String();
-  arms = Option35.String("--arms");
-  taskSet = Option35.String("--task-set");
-  examType = Option35.String("--exam-type");
-  skill = Option35.String("--skill");
-  reps = Option35.String("-n,--reps");
-  probes = Option35.String("--probes");
-  pool = Option35.String("--pool");
-  out = Option35.String("--out");
-  dryRun = Option35.Boolean("--dry-run", false);
-  keepArms = Option35.Boolean("--keep-arms", false);
-  allowStub = Option35.Boolean("--allow-stub", false);
-  deployment = Option35.String("--deployment");
-  output = Option35.String("--output");
-  observeWaitS = Option35.String("--observe-wait-s");
+  worker = Option36.String();
+  arms = Option36.String("--arms");
+  taskSet = Option36.String("--task-set");
+  examType = Option36.String("--exam-type");
+  skill = Option36.String("--skill");
+  reps = Option36.String("-n,--reps");
+  probes = Option36.String("--probes");
+  pool = Option36.String("--pool");
+  out = Option36.String("--out");
+  dryRun = Option36.Boolean("--dry-run", false);
+  keepArms = Option36.Boolean("--keep-arms", false);
+  allowStub = Option36.Boolean("--allow-stub", false);
+  deployment = Option36.String("--deployment");
+  output = Option36.String("--output");
+  observeWaitS = Option36.String("--observe-wait-s");
   async executeCommand() {
     await Promise.resolve();
     const worker = typeof this.worker === "string" ? this.worker : void 0;
@@ -21509,10 +21663,10 @@ var EvalExamCommand = class extends M8tCommand {
 };
 
 // src/commands/version.ts
-import { Command as Command39, Option as Option36 } from "clipanion";
+import { Command as Command40, Option as Option37 } from "clipanion";
 var VersionCommand = class extends M8tCommand {
   static paths = [["version"], ["--version"], ["-v"]];
-  static usage = Command39.Usage({
+  static usage = Command40.Usage({
     description: "Print the CLI version.",
     details: "Prints the m8t CLI version. With --verbose, also prints Node version and platform.",
     examples: [
@@ -21520,8 +21674,8 @@ var VersionCommand = class extends M8tCommand {
       ["Print as JSON", "$0 version --output json"]
     ]
   });
-  output = Option36.String("--output", { description: "pretty | json | auto (default)" });
-  verbose = Option36.Boolean("--verbose", false);
+  output = Option37.String("--output", { description: "pretty | json | auto (default)" });
+  verbose = Option37.Boolean("--verbose", false);
   executeCommand() {
     const mode = resolveOutputMode(
       this.output ?? "auto",
@@ -21552,18 +21706,18 @@ var VersionCommand = class extends M8tCommand {
 };
 
 // src/commands/whoami.ts
-import { Command as Command40, Option as Option37 } from "clipanion";
+import { Command as Command41, Option as Option38 } from "clipanion";
 var WhoamiCommand = class extends M8tCommand {
   static paths = [["whoami"]];
-  static usage = Command40.Usage({
+  static usage = Command41.Usage({
     description: "Show your identity + the gateway you'll talk to. Probes the backend."
   });
-  output = Option37.String("--output");
-  verbose = Option37.Boolean("--verbose", false);
-  subscription = Option37.String("--subscription", {
+  output = Option38.String("--output");
+  verbose = Option38.Boolean("--verbose", false);
+  subscription = Option38.String("--subscription", {
     description: "Azure subscription ID to discover gateway in (defaults to active az subscription)."
   });
-  resourceGroup = Option37.String("--resource-group", {
+  resourceGroup = Option38.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -21628,14 +21782,14 @@ var WhoamiCommand = class extends M8tCommand {
 };
 
 // src/commands/status.ts
-import { Command as Command41, Option as Option38 } from "clipanion";
+import { Command as Command42, Option as Option39 } from "clipanion";
 
 // src/lib/azd.ts
 init_errors();
 import { spawn as spawn4 } from "child_process";
 function runAzd(args) {
   return new Promise((resolve3, reject) => {
-    const proc = spawn4("azd", args, { stdio: ["ignore", "pipe", "pipe"] });
+    const proc = spawn4("azd", args, { stdio: ["ignore", "pipe", "pipe"], shell: process.platform === "win32" });
     const out = [];
     const err = [];
     proc.stdout.on("data", (d) => out.push(d));
@@ -21693,10 +21847,10 @@ async function resolveLocalContext() {
 // src/commands/status.ts
 var StatusCommand = class extends M8tCommand {
   static paths = [["status"]];
-  static usage = Command41.Usage({
+  static usage = Command42.Usage({
     description: "Show the local m8t context: identity, config.yaml, gateway cache, azd mode."
   });
-  output = Option38.String("--output");
+  output = Option39.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -21734,8 +21888,8 @@ var StatusCommand = class extends M8tCommand {
 };
 
 // src/commands/doctor.ts
-import { Command as Command42, Option as Option39 } from "clipanion";
-import { DefaultAzureCredential as DefaultAzureCredential19 } from "@azure/identity";
+import { Command as Command43, Option as Option40 } from "clipanion";
+import { DefaultAzureCredential as DefaultAzureCredential20 } from "@azure/identity";
 import * as fs26 from "fs";
 import * as os11 from "os";
 import * as path28 from "path";
@@ -22010,12 +22164,12 @@ function probeLegacyStateDir() {
 }
 var DoctorCommand = class extends M8tCommand {
   static paths = [["doctor"]];
-  static usage = Command42.Usage({
+  static usage = Command43.Usage({
     description: "Diagnose the local m8t setup: az login, config.yaml, gateway, Foundry data-plane."
   });
-  output = Option39.String("--output");
-  agent = Option39.String("--agent");
-  resourceGroup = Option39.String("--resource-group", {
+  output = Option40.String("--output");
+  agent = Option40.String("--agent");
+  resourceGroup = Option40.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -22089,7 +22243,7 @@ var DoctorCommand = class extends M8tCommand {
       if (typeof this.agent === "string" && this.agent) {
         checking(`delivery grant for ${this.agent}`);
         try {
-          const credential2 = new DefaultAzureCredential19();
+          const credential2 = new DefaultAzureCredential20();
           const cur = await getAgentVersion({
             credential: credential2,
             projectEndpoint: foundry.projectEndpoint,
@@ -22132,7 +22286,7 @@ var DoctorCommand = class extends M8tCommand {
 };
 
 // src/commands/switch.ts
-import { Command as Command43, Option as Option40 } from "clipanion";
+import { Command as Command44, Option as Option41 } from "clipanion";
 
 // src/lib/profiles.ts
 import * as fs27 from "fs/promises";
@@ -22272,14 +22426,14 @@ async function profileSwitch(name, asName) {
 init_errors();
 var SwitchCommand = class extends M8tCommand {
   static paths = [["switch"]];
-  static usage = Command43.Usage({
+  static usage = Command44.Usage({
     description: "Re-point local config at another deployment: --subscription <id|name> (discovery) or <profile>."
   });
-  profile = Option40.String({ required: false });
-  subscription = Option40.String("--subscription");
-  list = Option40.Boolean("--list", false);
-  as = Option40.String("--as");
-  output = Option40.String("--output");
+  profile = Option41.String({ required: false });
+  subscription = Option41.String("--subscription");
+  list = Option41.Boolean("--list", false);
+  as = Option41.String("--as");
+  output = Option41.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -22336,7 +22490,7 @@ var SwitchCommand = class extends M8tCommand {
 
 // src/commands/open.ts
 import { spawn as spawn5 } from "child_process";
-import { Command as Command44, Option as Option41 } from "clipanion";
+import { Command as Command45, Option as Option42 } from "clipanion";
 
 // src/lib/open-targets.ts
 init_errors();
@@ -22382,14 +22536,14 @@ function openUrl(url) {
 }
 var OpenCommand = class extends M8tCommand {
   static paths = [["open"]];
-  static usage = Command44.Usage({
+  static usage = Command45.Usage({
     description: "Open the deployed webapp (default), the Foundry portal, or the resource group.",
     details: "Targets: webapp (deployed app, default) | foundry (ai.azure.com) | portal (resource group in the Azure portal). Pass --print to emit the URL instead of launching a browser (also the default when stdout isn't a TTY)."
   });
-  target = Option41.String({ required: false });
-  print = Option41.Boolean("--print", false);
-  output = Option41.String("--output");
-  resourceGroup = Option41.String("--resource-group", {
+  target = Option42.String({ required: false });
+  print = Option42.Boolean("--print", false);
+  output = Option42.String("--output");
+  resourceGroup = Option42.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -22433,7 +22587,7 @@ var OpenCommand = class extends M8tCommand {
 };
 
 // src/commands/dream/run.ts
-import { Command as Command45, Option as Option42 } from "clipanion";
+import { Command as Command46, Option as Option43 } from "clipanion";
 import { AzureCliCredential } from "@azure/identity";
 import { TableClient as TableClient5 } from "@azure/data-tables";
 import { AIProjectClient as AIProjectClient3 } from "@azure/ai-projects";
@@ -22778,7 +22932,7 @@ var TableCursor = class {
    * Point-read the canonical worker's cursor row. Catches BOTH the
    * missing-table (TableNotFound) and missing-row (ResourceNotFound) 404s and
    * returns an absent (from-the-beginning) cursor WITHOUT creating the table or
-   * writing anything (DESIGN §3 — "createTable is bound only to advance()").
+   * writing anything.
    * Any other error (e.g. 403 RBAC) propagates raw.
    */
   async read(worker) {
@@ -22804,9 +22958,9 @@ var TableCursor = class {
   }
   /**
    * Persist the cursor for the canonical worker. This is the ONLY place that
-   * creates the BrainDreamCursor table (DESIGN §3 — read() never does DDL); a
-   * TableAlreadyExists race is benign. The non-dry F3 path calls this; F2 ships
-   * it wired + unit-tested. The per-PK watermark map is serialized to JSON
+   * creates the BrainDreamCursor table; a
+   * TableAlreadyExists race is benign. The non-dry path calls this, already
+   * wired and unit-tested. The per-PK watermark map is serialized to JSON
    * (Table cells are scalar — same rationale as agent-ledger's `artifacts`).
    */
   async advance(worker, cursor) {
@@ -22939,6 +23093,35 @@ function makeLedgerSource(read) {
 // ../../packages/brain/engine/dist/esm/conversation-source.js
 var TRANSIENT = 500;
 var MAX_ATTEMPTS = 5;
+var VOICE_PREFIX = "[[m8t:voice-transcript]] ";
+var MAX_VOICE_HEADER_BYTES = 4096;
+function isVoiceEnvelope(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const item = value;
+  return item.v === 1 && typeof item.callId === "string" && item.callId.length > 0 && typeof item.startedAt === "string" && item.startedAt.length > 0 && typeof item.endedAt === "string" && item.endedAt.length > 0 && typeof item.turnAt === "string" && item.turnAt.length > 0;
+}
+function stripVoiceEnvelope(value) {
+  if (!value.startsWith(VOICE_PREFIX))
+    return value;
+  const newline = value.indexOf("\n");
+  if (newline < VOICE_PREFIX.length)
+    return value;
+  const header = value.slice(VOICE_PREFIX.length, newline);
+  if (new TextEncoder().encode(header).byteLength > MAX_VOICE_HEADER_BYTES || header.length % 4 === 1 || !/^[A-Za-z0-9_-]+$/.test(header))
+    return value;
+  try {
+    const padded = header.replaceAll("-", "+").replaceAll("_", "/") + "=".repeat((4 - header.length % 4) % 4);
+    const bytes = Uint8Array.from(Buffer.from(padded, "base64"));
+    if (Buffer.from(bytes).toString("base64url") !== header)
+      return value;
+    const json = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    const parsed = JSON.parse(json);
+    return isVoiceEnvelope(parsed) ? value.slice(newline + 1) : value;
+  } catch {
+    return value;
+  }
+}
 function statusOf(e) {
   const err = e;
   return err?.statusCode ?? err?.status;
@@ -22954,7 +23137,7 @@ function mapItems(raw) {
       continue;
     if (item.role !== "user" && item.role !== "assistant")
       continue;
-    const text = Array.isArray(item.content) ? item.content.map((c) => typeof c.text === "string" ? c.text : "").filter(Boolean).join("\n\n") : "";
+    const text = Array.isArray(item.content) ? stripVoiceEnvelope(item.content.map((c) => typeof c.text === "string" && c.text.length > 0 ? c.text : typeof c.transcript === "string" && c.transcript.length > 0 ? c.transcript : "").filter(Boolean).join("\n\n")) : "";
     const at = typeof item.created_at === "number" ? new Date(item.created_at * 1e3).toISOString() : void 0;
     acc.push(at ? { role: item.role, text, at } : { role: item.role, text });
   }
@@ -22988,7 +23171,7 @@ function makeConversationSource(client, opts = {}) {
       throw new ConvFetchError("terminal", `exhausted retries reading ${conversationId}`);
     },
     /**
-     * The a2a recovery gate's data source (DESIGN §2.3, Option A). Reads the
+     * The a2a recovery gate's data source (Option A). Reads the
      * conversation's own `metadata.app` so the recovery path can HARD-gate on the
      * real app tag rather than emit-time ledger tagging. Degrades to null on any
      * error → the caller treats an un-provable a2a conv as ungated (skipped).
@@ -23272,7 +23455,7 @@ async function runPipeline(args) {
     consumed,
     recovered,
     skipped,
-    // Wall-clock elapsed around the awaited live I/O (FIX 4) — measured from the
+    // Wall-clock elapsed around the awaited live I/O — measured from the
     // real/injected monotonic clock, NOT the pure `now` (which never moves within a run).
     latencyMs: Math.round(monotonicNow() - t0)
   };
@@ -23393,11 +23576,11 @@ var WRITER_ALLOWED_PREFIX = /^(memory|inbox|quarantine|artifacts)\//;
 var isAllowedWritePath = (path37, allowedPrefix) => allowedPrefix.test(path37) && !path37.split("/").includes("..");
 var unquote = (s) => s.trim().replace(/^["']|["']$/g, "");
 function parseFrontmatter(content) {
-  const m = /^---\n([\s\S]*?)\n---/.exec(content);
+  const m = /^---\r?\n([\s\S]*?)\r?\n---/.exec(content);
   if (!m)
     return {};
   const fm = {};
-  const lines = m[1].split("\n");
+  const lines = m[1].split(/\r?\n/);
   let pendingKey = null;
   for (const line2 of lines) {
     const item = /^\s+-\s+(.*)$/.exec(line2);
@@ -24075,7 +24258,7 @@ function frontmatter(fields) {
   return lines.join("\n");
 }
 function injectFrontmatter(body, fields) {
-  const m = /^---\n([\s\S]*?)\n---\n?/.exec(body);
+  const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/.exec(body);
   const inject = Object.entries(fields).map(([k, v]) => Array.isArray(v) ? `${k}:
 ${v.map((i) => `  - ${i}`).join("\n")}` : `${k}: ${v}`).join("\n");
   if (!m)
@@ -24084,11 +24267,11 @@ ${inject}
 ---
 ${body}`;
   const block = m[1].replace(/\s*$/, "");
-  return body.replace(m[0], `---
+  return `---
 ${block}
 ${inject}
 ---
-`);
+` + body.slice(m[0].length);
 }
 var indexLine = (path37, title, date, tags) => `- \`${path37}\` \u2014 **${title}**: ${title}. (${date} \xB7 ${tags.join(", ")})`;
 function splitIndex(index) {
@@ -24248,7 +24431,7 @@ function defaultDreamSeams(opts = {}) {
       const user = buildUserPrompt(input, mem.files);
       const res = await propose(deps.model, system, user, {
         ...opts.sleep ? { sleep: opts.sleep } : {},
-        // The configured model NAME for the cost digest (DESIGN §4.1/§9). Without
+        // The configured model NAME for the cost digest. Without
         // this, propose falls back to its default and every cost line mis-reports
         // the model an operator actually configured (e.g. gpt-5-mini → "gpt-5.4").
         ...deps.modelName ? { model: deps.modelName } : {}
@@ -24631,20 +24814,20 @@ function redactTranscripts(input) {
 }
 var DreamRunCommand = class extends M8tCommand {
   static paths = [["dream", "run"]];
-  static usage = Command45.Usage({
+  static usage = Command46.Usage({
     description: "Dry-run the brain consumption pipeline for one worker (no model call, no writes).",
     details: "Builds AzureCliCredential + resolves the Foundry project, ledger table, and Log Analytics workspace, runs the consumption pipeline, and prints the skip-ledger, the partition invariant, and harvest stats. Transcripts are metadata-only unless --show-transcripts is passed."
   });
-  worker = Option42.String("--worker", { description: "Worker (canonical name) to harvest. Required." });
-  dryRun = Option42.Boolean("--dry-run", false, { description: "Read-only harvest; no model call, no writes." });
-  since = Option42.String("--since", { description: "ISO-8601 start override (rejected if malformed or future)." });
-  reset = Option42.Boolean("--reset", false, { description: "Ignore the stored cursor; read from the beginning." });
-  showTranscripts = Option42.Boolean("--show-transcripts", false, {
+  worker = Option43.String("--worker", { description: "Worker (canonical name) to harvest. Required." });
+  dryRun = Option43.Boolean("--dry-run", false, { description: "Read-only harvest; no model call, no writes." });
+  since = Option43.String("--since", { description: "ISO-8601 start override (rejected if malformed or future)." });
+  reset = Option43.Boolean("--reset", false, { description: "Ignore the stored cursor; read from the beginning." });
+  showTranscripts = Option43.Boolean("--show-transcripts", false, {
     description: "Print transcript bodies (default: metadata only)."
   });
-  subscription = Option42.String("--subscription");
-  endpoint = Option42.String("--endpoint");
-  output = Option42.String("--output");
+  subscription = Option43.String("--subscription");
+  endpoint = Option43.String("--endpoint");
+  output = Option43.String("--output");
   // Resolution seam — overridden by tests; built lazily at runtime otherwise.
   deps;
   async executeCommand() {
@@ -24900,7 +25083,7 @@ async function buildWriteDeps(context, credential2, cursor) {
   return {
     model: makeFoundryModelClient(openai, model),
     modelName: model,
-    // surface the resolved name for the cost digest (DESIGN §4.1/§9)
+    // surface the resolved name for the cost digest
     brain,
     cursor,
     clock: () => /* @__PURE__ */ new Date(),
@@ -24992,7 +25175,7 @@ function defaultDeps(overrides) {
 }
 
 // src/commands/foundry/create.ts
-import { Command as Command46, Option as Option43 } from "clipanion";
+import { Command as Command47, Option as Option44 } from "clipanion";
 
 // src/lib/foundry-create.ts
 init_errors();
@@ -25230,7 +25413,7 @@ async function createFoundryProject(args) {
 init_errors();
 var FoundryCreateCommand = class extends M8tCommand {
   static paths = [["foundry", "create"]];
-  static usage = Command46.Usage({
+  static usage = Command47.Usage({
     description: "Create an AI Foundry (AIServices) account + project + model deployment from scratch.",
     details: "Non-interactive and idempotent. Creates the AIServices account (custom subdomain + project management), a project, and a model deployment (default gpt-4.1-mini @ capacity 50). Region must be hosted-agent-eligible. Emits the project endpoint as structured output. Re-run is a clean no-op (account/project skipped if present; deployment capacity converges UP, never down).",
     examples: [
@@ -25239,16 +25422,16 @@ var FoundryCreateCommand = class extends M8tCommand {
       ["Higher capacity for a reasoning model", "$0 foundry create --resource-group rg-m8t-stack --location eastus2 --model gpt-5-mini --capacity 250"]
     ]
   });
-  resourceGroup = Option43.String("--resource-group");
-  location = Option43.String("--location");
-  account = Option43.String("--account");
-  project = Option43.String("--project", "m8t");
-  model = Option43.String("--model", "gpt-4.1-mini");
-  modelVersion = Option43.String("--model-version", "2025-04-14");
-  capacity = Option43.String("--capacity", "50");
-  subscription = Option43.String("--subscription");
-  skipQuotaCheck = Option43.Boolean("--skip-quota-check", false);
-  output = Option43.String("--output");
+  resourceGroup = Option44.String("--resource-group");
+  location = Option44.String("--location");
+  account = Option44.String("--account");
+  project = Option44.String("--project", "m8t");
+  model = Option44.String("--model", "gpt-4.1-mini");
+  modelVersion = Option44.String("--model-version", "2025-04-14");
+  capacity = Option44.String("--capacity", "50");
+  subscription = Option44.String("--subscription");
+  skipQuotaCheck = Option44.Boolean("--skip-quota-check", false);
+  output = Option44.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -25320,22 +25503,22 @@ var FoundryCreateCommand = class extends M8tCommand {
 };
 
 // src/commands/foundry/await-ready.ts
-import { Command as Command47, Option as Option44 } from "clipanion";
+import { Command as Command48, Option as Option45 } from "clipanion";
 import { AzureCliCredential as AzureCliCredential2 } from "@azure/identity";
 init_errors();
 var FoundryAwaitReadyCommand = class extends M8tCommand {
   static paths = [["foundry", "await-ready"]];
-  static usage = Command47.Usage({
+  static usage = Command48.Usage({
     description: "Wait until a freshly-created Foundry project's data plane reliably serves it.",
     details: "Probes the project (GET /agents) until it returns 200 on a few consecutive tries, or fails clearly after a bounded budget. A newly-created account can serve intermittent 404 'Project not found' for minutes; run this after 'foundry create' and before deploying agents so the worker phase doesn't catch the unstable window.",
     examples: [["Wait for a project to be ready", "$0 foundry await-ready --endpoint https://acc.services.ai.azure.com/api/projects/m8t"]]
   });
-  endpoint = Option44.String("--endpoint");
-  consecutive = Option44.String("--consecutive", "3");
-  attempts = Option44.String("--attempts", "60");
-  interval = Option44.String("--interval", "5");
-  subscription = Option44.String("--subscription");
-  output = Option44.String("--output");
+  endpoint = Option45.String("--endpoint");
+  consecutive = Option45.String("--consecutive", "3");
+  attempts = Option45.String("--attempts", "60");
+  interval = Option45.String("--interval", "5");
+  subscription = Option45.String("--subscription");
+  output = Option45.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const endpoint = typeof this.endpoint === "string" ? this.endpoint : void 0;
@@ -25369,7 +25552,33 @@ var FoundryAwaitReadyCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/preflight.ts
-import { Command as Command48, Option as Option45 } from "clipanion";
+import { Command as Command49, Option as Option46 } from "clipanion";
+
+// ../../packages/telemetry-contract/artifact/tier-map.ts
+var EVENT_TIERS = {
+  "enrolled": 1,
+  "install-started": 1,
+  "install-succeeded": 1,
+  "install-failed": 1,
+  "heartbeat": 1,
+  "update-applied": 1,
+  "update-failed": 1,
+  "consent-changed": 1
+  // extended additively for tier-2 usage events: "usage-rollup": 2
+};
+var EVENT_ENUM = Object.keys(EVENT_TIERS);
+
+// ../../packages/telemetry-contract/src/disclosure.ts
+var DISCLOSURE_TIER1 = "Operational data. To support your installation, m8t receives limited operational data linked to it \u2014 installation and update events, installed versions, and service health signals, along with the company name and contact email you provide. This is service data used only to operate and support the platform; it contains none of your content. Details: TELEMETRY.md.";
+
+// ../../packages/telemetry-contract/src/endpoints.ts
+var INGEST_BASE_URL = (process.env.M8T_INGEST_BASE_URL ?? "").trim() || "https://m8t-admin.wonderfuldesert-721e332f.eastus2.azurecontainerapps.io";
+function ingestUrl(path37) {
+  const base = INGEST_BASE_URL.replace(/\/+$/, "");
+  return `${base}${path37.startsWith("/") ? path37 : `/${path37}`}`;
+}
+
+// src/commands/bootstrap/preflight.ts
 init_errors();
 
 // src/lib/bootstrap-preflight.ts
@@ -25443,7 +25652,7 @@ function buildPreflightBanner(who) {
 // src/commands/bootstrap/preflight.ts
 var BootstrapPreflightCommand = class extends M8tCommand {
   static paths = [["bootstrap", "preflight"]];
-  static usage = Command48.Usage({
+  static usage = Command49.Usage({
     description: "Loudly verify you can install m8t (Owner/UAA + directory admin) and hard-stop if not.",
     details: "Step 1 of `m8t bootstrap`. Prints an unmissable admin-credentials notice, then checks: Owner or User Access Administrator at subscription scope (hard requirement), directory-admin capability to register the app (or pass --client-id), and registers Microsoft.ContainerInstance. Exits non-zero with the exact failing check + remedy.",
     examples: [
@@ -25451,14 +25660,17 @@ var BootstrapPreflightCommand = class extends M8tCommand {
       ["BYO app registration (directory guests)", "$0 bootstrap preflight --client-id <appId>"]
     ]
   });
-  clientId = Option45.String("--client-id");
-  subscription = Option45.String("--subscription");
+  clientId = Option46.String("--client-id");
+  subscription = Option46.String("--subscription");
   async executeCommand() {
     const clientId = typeof this.clientId === "string" ? this.clientId : void 0;
     const account = await getAzAccount();
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
     const oid = await getCallerObjectId();
     this.context.stdout.write(buildPreflightBanner({ upn: account.upn, tenantId: account.tenantId, subscriptionId }) + "\n");
+    this.context.stdout.write(`
+${colors.dim(DISCLOSURE_TIER1)}
+`);
     this.context.stdout.write("Checking your access\u2026\n");
     const sub = await checkSubScopeAdmin(oid, subscriptionId);
     this.context.stdout.write(line(sub.ok, `${sub.role ?? "Owner/UAA"} at subscription scope`, "resource + role-assignment rights"));
@@ -25511,7 +25723,7 @@ ${colors.error("  " + why)}
 import * as fs30 from "fs";
 import * as os14 from "os";
 import * as path32 from "path";
-import { Command as Command49, Option as Option46 } from "clipanion";
+import { Command as Command50, Option as Option47 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-mi.ts
@@ -25610,6 +25822,7 @@ function buildAciCreateArgs(s) {
   ];
   if (s.gatewayImageRef) env.push(`GATEWAY_IMAGE_REF=${s.gatewayImageRef}`);
   if (s.foundryTracing) env.push(`FOUNDRY_TRACING=${s.foundryTracing}`);
+  if (s.enrollContactEmail) env.push(`M8T_ENROLL_CONTACT_EMAIL=${s.enrollContactEmail}`);
   if (s.githubApp) {
     const g = s.githubApp;
     env.push(
@@ -25760,12 +25973,12 @@ async function writeBootstrapState(state, home = os13.homedir()) {
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.33";
+var DEFAULT_INSTALLER_TAG = "v0.1.36";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
   static paths = [["bootstrap", "launch"]];
-  static usage = Command49.Usage({
+  static usage = Command50.Usage({
     description: "Create + authorize the installer managed identity, then kick the cloud installer.",
     details: "Step 2 of `m8t bootstrap` (run after `preflight`). Ensures the resource group, creates the m8t app registration (or uses --client-id), creates a user-assigned managed identity granted Owner at subscription scope, and launches the published m8t-installer image as an ACI run-to-completion job under that identity. Writes ~/.m8t/bootstrap.json for `status`/`reap`/`finish`.",
     examples: [
@@ -25775,17 +25988,17 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       ["Override the full installer image ref", "$0 bootstrap launch --location eastus2 --installer-image ghcr.io/m8t-labs/m8t-installer:v0.1.33"]
     ]
   });
-  location = Option46.String("--location");
-  resourceGroup = Option46.String("--resource-group");
-  clientId = Option46.String("--client-id");
-  subscription = Option46.String("--subscription");
-  installerTag = Option46.String("--installer-tag");
+  location = Option47.String("--location");
+  resourceGroup = Option47.String("--resource-group");
+  clientId = Option47.String("--client-id");
+  subscription = Option47.String("--subscription");
+  installerTag = Option47.String("--installer-tag");
   // Full image ref override (registry + repo + tag) — an escape hatch when the
   // default org/tag is wrong for the current CLI (e.g. a stale published build).
   // Wins over --installer-tag / the pinned default.
-  installerImage = Option46.String("--installer-image");
-  gatewayImageRef = Option46.String("--gateway-image-ref");
-  githubAppCreds = Option46.String("--github-app-creds");
+  installerImage = Option47.String("--installer-image");
+  gatewayImageRef = Option47.String("--gateway-image-ref");
+  githubAppCreds = Option47.String("--github-app-creds");
   async executeCommand() {
     const location = typeof this.location === "string" ? this.location : void 0;
     if (!location) {
@@ -25876,7 +26089,8 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       image: installerImage,
       gatewayImageRef,
       foundryTracing: "skip",
-      githubApp
+      githubApp,
+      enrollContactEmail: account.upn
     });
     this.context.stdout.write(
       `${colors.success("\u2713")} installer launched in ${colors.field(resourceGroup)} (${location}).
@@ -25888,7 +26102,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/status.ts
-import { Command as Command50, Option as Option47 } from "clipanion";
+import { Command as Command51, Option as Option48 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-aci-state.ts
@@ -25916,13 +26130,13 @@ async function getAciState(opts) {
 // src/commands/bootstrap/status.ts
 var BootstrapStatusCommand = class extends M8tCommand {
   static paths = [["bootstrap", "status"]];
-  static usage = Command50.Usage({
+  static usage = Command51.Usage({
     description: "Show the cloud installer's live status (phase, progress, result).",
     details: "Reads the durable status blob written by the installer. --watch polls until the install reaches done or failed.",
     examples: [["One read", "$0 bootstrap status"], ["Watch to completion", "$0 bootstrap status --watch"]]
   });
-  watch = Option47.Boolean("--watch", false);
-  output = Option47.String("--output");
+  watch = Option48.Boolean("--watch", false);
+  output = Option48.String("--output");
   async executeCommand() {
     const state = await readBootstrapState();
     if (!state) {
@@ -25993,7 +26207,7 @@ function formatStatus(d) {
 }
 
 // src/commands/bootstrap/reap.ts
-import { Command as Command51, Option as Option48 } from "clipanion";
+import { Command as Command52, Option as Option49 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-reap.ts
@@ -26087,14 +26301,14 @@ async function reapInstaller(opts) {
 // src/commands/bootstrap/reap.ts
 var BootstrapReapCommand = class extends M8tCommand {
   static paths = [["bootstrap", "reap"]];
-  static usage = Command51.Usage({
+  static usage = Command52.Usage({
     description: "Tear down the installer scaffolding (ACI \u2192 MI \u2192 its role assignments) after a successful install.",
     details: "Runs locally on the 'done' signal (the installer can't delete its own identity). The platform RG and the gateway's own assignments persist. A failed install is left intact for diagnosis unless --force.",
     examples: [["Reap after done", "$0 bootstrap reap"]]
   });
-  force = Option48.Boolean("--force", false);
-  sweepOrphans = Option48.Boolean("--sweep-orphans", false);
-  yes = Option48.Boolean("--yes", false);
+  force = Option49.Boolean("--force", false);
+  sweepOrphans = Option49.Boolean("--sweep-orphans", false);
+  yes = Option49.Boolean("--yes", false);
   async executeCommand() {
     if (this.sweepOrphans === true) {
       const { subscriptionId: sub } = await getAzAccount();
@@ -26191,12 +26405,12 @@ Found ${String(total)} orphaned assignment(s) (${breakdown}) (dry-run). ${colors
 import * as fs31 from "fs/promises";
 import * as os16 from "os";
 import * as path34 from "path";
-import { Command as Command52, Option as Option49 } from "clipanion";
+import { Command as Command53, Option as Option50 } from "clipanion";
 init_errors();
 
 // src/lib/company-profile-seed.ts
 import { spawn as spawn6 } from "child_process";
-import { closeSync, openSync, readFileSync as readFileSync20 } from "fs";
+import { closeSync, openSync, readFileSync as readFileSync21 } from "fs";
 import * as os15 from "os";
 import * as path33 from "path";
 init_errors();
@@ -26381,7 +26595,7 @@ function composeFounderIdentityNote(id) {
 function readGithubAppCreds(credsPath) {
   const p = credsPath ?? path33.join(os15.homedir(), ".m8t", "github-app.json");
   try {
-    return JSON.parse(readFileSync20(p, "utf8"));
+    return JSON.parse(readFileSync21(p, "utf8"));
   } catch {
     return null;
   }
@@ -26409,7 +26623,7 @@ async function resolveSeedContext(opts) {
 async function applyProfileToBrain(args) {
   const token = await mintInstallationTokenFromPem({
     appId: args.appCreds.appId,
-    privateKeyPem: readFileSync20(args.appCreds.pemPath, "utf8"),
+    privateKeyPem: readFileSync21(args.appCreds.pemPath, "utf8"),
     installationId: args.appCreds.installationId,
     fetchImpl: args.fetchImpl
   });
@@ -26521,14 +26735,14 @@ function renderInstallSummary(args) {
 // src/commands/bootstrap/finish.ts
 var BootstrapFinishCommand = class extends M8tCommand {
   static paths = [["bootstrap", "finish"]];
-  static usage = Command52.Usage({
+  static usage = Command53.Usage({
     description: "Point your local tools at the now-live platform (repo-root marker, discovery cache, next steps).",
     details: "Final step of `m8t bootstrap` (after the install reaches done). Writes ~/.m8t/repo-root, points your local tools at the live gateway, and \u2014 if you completed the onboarding questionnaire \u2014 seeds your brain-backed advisor's brain with your company profile (best-effort; never blocks finish). Run `m8t bootstrap seed-profile` to seed manually later.",
     examples: [["Finish local", "$0 bootstrap finish --repo-root /path/to/m8t"]]
   });
-  repoRoot = Option49.String("--repo-root");
-  subscription = Option49.String("--subscription");
-  resourceGroup = Option49.String("--resource-group");
+  repoRoot = Option50.String("--repo-root");
+  subscription = Option50.String("--subscription");
+  resourceGroup = Option50.String("--resource-group");
   async executeCommand() {
     const state = await readBootstrapState();
     if (!state) {
@@ -26631,8 +26845,8 @@ ${colors.field("Then open a brand new chat/session")} \u2014 new skills + MCP se
 import * as fs33 from "fs";
 import * as os18 from "os";
 import * as path36 from "path";
-import { Command as Command53, Option as Option50 } from "clipanion";
-import { DefaultAzureCredential as DefaultAzureCredential20 } from "@azure/identity";
+import { Command as Command54, Option as Option51 } from "clipanion";
+import { DefaultAzureCredential as DefaultAzureCredential21 } from "@azure/identity";
 init_errors();
 
 // src/lib/bootstrap-ui.ts
@@ -26640,7 +26854,7 @@ import * as fs32 from "fs";
 import * as net from "net";
 import * as os17 from "os";
 import * as path35 from "path";
-import { spawn as spawn7 } from "child_process";
+import { spawn as spawn7, spawnSync as spawnSync6 } from "child_process";
 init_errors();
 init_rbac();
 
@@ -26906,7 +27120,8 @@ async function serveOnboardingUiDetached(args) {
     detached: true,
     stdio: ["ignore", fd, fd],
     env: { ...process.env, PORT: args.port },
-    shell: false
+    // pnpm resolves to pnpm.cmd on Windows, which needs a shell to launch.
+    shell: process.platform === "win32"
   });
   fs32.closeSync(fd);
   if (child.pid == null) {
@@ -26946,7 +27161,8 @@ async function serveOnboardingRelayDetached(args) {
       RELAY_ALLOWED_ORIGINS: "http://localhost:3000",
       RELAY_PORT: "8790"
     },
-    shell: false
+    // pnpm resolves to pnpm.cmd on Windows, which needs a shell to launch.
+    shell: process.platform === "win32"
   });
   fs32.closeSync(fd);
   if (child.pid == null) {
@@ -26985,10 +27201,14 @@ function stopPidFile(pidPath) {
   }
   const pid = Number(pidStr);
   if (!Number.isNaN(pid) && pid > 0) {
-    try {
-      process.kill(-pid, "SIGTERM");
-    } catch (e) {
-      if (e.code !== "ESRCH") throw e;
+    if (process.platform === "win32") {
+      spawnSync6("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore" });
+    } else {
+      try {
+        process.kill(-pid, "SIGTERM");
+      } catch (e) {
+        if (e.code !== "ESRCH") throw e;
+      }
     }
   }
   try {
@@ -27020,7 +27240,7 @@ function renderDeployFailure(error) {
 }
 var BootstrapUiCommand = class extends M8tCommand {
   static paths = [["bootstrap", "ui"]];
-  static usage = Command53.Usage({
+  static usage = Command54.Usage({
     description: "Deploy Simple Stacey + start the local onboarding chat UI in the background (returns immediately).",
     details: [
       "Run after `m8t bootstrap launch`, in parallel with `status --watch`. Waits for the cloud",
@@ -27038,15 +27258,15 @@ var BootstrapUiCommand = class extends M8tCommand {
       ["Foreground (blocking, old behaviour)", "$0 bootstrap ui --repo-root /path/to/m8t --foreground"]
     ]
   });
-  repoRoot = Option50.String("--repo-root");
-  port = Option50.String("--port", "3000");
-  endpoint = Option50.String("--endpoint", {
+  repoRoot = Option51.String("--repo-root");
+  port = Option51.String("--port", "3000");
+  endpoint = Option51.String("--endpoint", {
     description: "Foundry project endpoint to target \u2014 disambiguates when the subscription has multiple projects."
   });
-  prepOnly = Option50.Boolean("--prep-only", false);
-  skipInstall = Option50.Boolean("--skip-install", false);
-  stop = Option50.Boolean("--stop", false);
-  foreground = Option50.Boolean("--foreground", false);
+  prepOnly = Option51.Boolean("--prep-only", false);
+  skipInstall = Option51.Boolean("--skip-install", false);
+  stop = Option51.Boolean("--stop", false);
+  foreground = Option51.Boolean("--foreground", false);
   async executeCommand() {
     if (this.stop === true) {
       const stopped = stopOnboardingUi();
@@ -27082,7 +27302,7 @@ var BootstrapUiCommand = class extends M8tCommand {
     if (fs33.existsSync(path36.join(os18.homedir(), ".m8t", "config.yaml"))) {
       out(colors.error("\u26A0 an existing ~/.m8t/config.yaml will override the onboarding app registration in apps/web \u2014 if Microsoft sign-in fails, move it aside and retry."));
     }
-    const credential2 = new DefaultAzureCredential20();
+    const credential2 = new DefaultAzureCredential21();
     const account = await getAzAccount();
     assertNodeVersion();
     out("waiting for Foundry (the installer's foundry-create phase)\u2026");
@@ -27180,10 +27400,10 @@ var BootstrapUiCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/seed-profile.ts
-import { Command as Command54, Option as Option51 } from "clipanion";
+import { Command as Command55, Option as Option52 } from "clipanion";
 var BootstrapSeedProfileCommand = class extends M8tCommand {
   static paths = [["bootstrap", "seed-profile"]];
-  static usage = Command54.Usage({
+  static usage = Command55.Usage({
     description: "Seed your advisors' brains with the founder + company profile from the onboarding questionnaire.",
     details: "Reads the latest stacey-intake conversation, renders memory/founder.md + memory/company-profile.md (+ their MEMORY.md index lines), and commits them to both <org>/stacey-brain and <org>/azzy-brain via the GitHub App. Idempotent. --watch polls until the founder completes the questionnaire.",
     examples: [
@@ -27191,11 +27411,11 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
       ["Wait for the founder to finish", "$0 bootstrap seed-profile --watch"]
     ]
   });
-  endpoint = Option51.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
-  brain = Option51.String("--brain", { description: "Override the brain repo (default <org>/stacey-brain)." });
-  watch = Option51.Boolean("--watch", false, { description: "Poll until the questionnaire completes (or --timeout)." });
-  timeout = Option51.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
-  githubAppCreds = Option51.String("--github-app-creds");
+  endpoint = Option52.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
+  brain = Option52.String("--brain", { description: "Override the brain repo (default <org>/stacey-brain)." });
+  watch = Option52.Boolean("--watch", false, { description: "Poll until the questionnaire completes (or --timeout)." });
+  timeout = Option52.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
+  githubAppCreds = Option52.String("--github-app-creds");
   async executeCommand() {
     const ctx = await resolveSeedContext({
       endpointOverride: typeof this.endpoint === "string" ? this.endpoint : void 0,
@@ -27240,6 +27460,112 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
   }
 };
 
+// src/commands/telemetry/enroll.ts
+import { Command as Command56, Option as Option53 } from "clipanion";
+init_errors();
+
+// src/lib/telemetry-enroll.ts
+init_errors();
+async function enroll(args) {
+  const f = args.fetchImpl ?? fetch;
+  const url = args.baseUrl ? `${args.baseUrl.replace(/\/+$/, "")}/api/ingest/enroll` : ingestUrl("/api/ingest/enroll");
+  let res;
+  try {
+    res = await f(url, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ schemaVersion: 1, company: args.company, contactEmail: args.contactEmail, subscriptionId: args.subscriptionId, proof: null })
+    });
+  } catch (e) {
+    throw new LocalCliError({ code: "TELEMETRY_ENROLL_UNREACHABLE", message: `Could not reach the telemetry ingest to enroll: ${e instanceof Error ? e.message : String(e)}` });
+  }
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw new LocalCliError({ code: "TELEMETRY_ENROLL_FAILED", message: `Enroll failed (HTTP ${res.status.toString()}): ${body}` });
+  }
+  const json = await res.json();
+  if (!json.instanceId || !json.ingestKey) {
+    throw new LocalCliError({ code: "TELEMETRY_ENROLL_BAD_RESPONSE", message: "Enroll response missing instanceId/ingestKey." });
+  }
+  return { instanceId: json.instanceId, ingestKey: json.ingestKey };
+}
+
+// src/commands/telemetry/enroll.ts
+var INGEST_KEY_SECRET = "m8t-ingest-key";
+async function resolveKeyVaultName(containerAppResourceId) {
+  const kvUri = (await runAz([
+    "containerapp",
+    "show",
+    "--ids",
+    containerAppResourceId,
+    "--query",
+    "properties.template.containers[0].env[?name=='KEY_VAULT_URI'].value | [0]",
+    "-o",
+    "tsv"
+  ])).trim();
+  if (!kvUri) {
+    throw new LocalCliError({
+      code: "TELEMETRY_ENROLL_NO_KV",
+      message: "Could not resolve the platform Key Vault: the gateway Container App has no KEY_VAULT_URI env var.",
+      hint: "Verify the deployment via 'az containerapp show --ids <id> --query properties.template.containers[0].env'."
+    });
+  }
+  const host = new URL(kvUri).hostname;
+  const name = host.split(".")[0];
+  if (!name) {
+    throw new LocalCliError({ code: "TELEMETRY_ENROLL_BAD_KV_URI", message: `Could not parse a Key Vault name from KEY_VAULT_URI '${kvUri}'.` });
+  }
+  return name;
+}
+var TelemetryEnrollCommand = class extends M8tCommand {
+  static paths = [["telemetry", "enroll"]];
+  static usage = Command56.Usage({
+    description: "Enroll this installation for operational telemetry (pre-existing installs).",
+    details: "Mints an instance id + ingest key from the m8t telemetry ingest and stores the key in your platform Key Vault, the same place the installer writes it on a fresh install. Idempotent: refuses if a key already exists unless --force.",
+    examples: [["Enroll", "$0 telemetry enroll"]]
+  });
+  company = Option53.String("--company", { description: "Your company name (optional)." });
+  contactEmail = Option53.String("--contact-email", { description: "Contact email (default: your signed-in az UPN)." });
+  subscription = Option53.String("--subscription", { description: "Azure subscription id (default: your active az subscription)." });
+  resourceGroup = Option53.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
+  force = Option53.Boolean("--force", false, { description: "Re-enroll even if a key is already stored (mints a new instance id)." });
+  async executeCommand() {
+    const account = await getAzAccount();
+    const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
+    const contactEmail = (typeof this.contactEmail === "string" ? this.contactEmail : void 0) ?? account.upn;
+    const company = (typeof this.company === "string" ? this.company : void 0) ?? "";
+    const d = await discoverGateway({
+      subscriptionId,
+      interactive: false,
+      resourceGroup: typeof this.resourceGroup === "string" ? this.resourceGroup : void 0
+    });
+    const kvName = await resolveKeyVaultName(d.containerAppResourceId);
+    if (this.force !== true) {
+      let existing = "";
+      try {
+        existing = await runAz(["keyvault", "secret", "show", "--vault-name", kvName, "--name", INGEST_KEY_SECRET, "--query", "value", "-o", "tsv"]);
+      } catch (e) {
+        rethrowIfAzUnavailable(e);
+        existing = "";
+      }
+      if (existing.trim()) {
+        throw new LocalCliError({
+          code: "TELEMETRY_ALREADY_ENROLLED",
+          message: "This installation is already enrolled.",
+          hint: "Pass --force to re-enroll (mints a new instance id)."
+        });
+      }
+    }
+    const { instanceId, ingestKey } = await enroll({ company, contactEmail, subscriptionId });
+    await runAz(["keyvault", "secret", "set", "--vault-name", kvName, "--name", INGEST_KEY_SECRET, "--value", ingestKey, "--only-show-errors"]);
+    this.context.stdout.write(
+      `${colors.success("\u2713")} enrolled (instance ${instanceId}); ingest key stored in Key Vault ${kvName}. The gateway picks it up on its next cycle.
+`
+    );
+    return 0;
+  }
+};
+
 // src/cli.ts
 var cli = new Cli({
   binaryName: "m8t",
@@ -27281,6 +27607,7 @@ cli.register(AzureExecDeployCommand);
 cli.register(PlatformStatusCommand);
 cli.register(PlatformUpdateCommand);
 cli.register(PlatformConvergeCommand);
+cli.register(PlatformSeedStampCommand);
 cli.register(PlatformEnableCostReportCommand);
 cli.register(PlatformEnableAutoUpdateCommand);
 cli.register(DeployCommand);
@@ -27300,6 +27627,7 @@ cli.register(BootstrapReapCommand);
 cli.register(BootstrapFinishCommand);
 cli.register(BootstrapUiCommand);
 cli.register(BootstrapSeedProfileCommand);
+cli.register(TelemetryEnrollCommand);
 async function main() {
   try {
     return await cli.run(process.argv.slice(2));