@m8t-stack/cli 0.2.33 → 0.2.34

package/dist/cli.js

@@ -1247,7 +1247,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.33";
+var CLI_VERSION = "0.2.34";
 
 // src/lib/render-error.ts
 init_errors();
@@ -3327,12 +3327,12 @@ function encodeURIPath(str4) {
   return str4.replace(/[^A-Za-z0-9\-._~!$&'()*+,;=:@]+/g, encodeURIComponent);
 }
 var EMPTY = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.create(null));
-var createPathTagFunction = (pathEncoder = encodeURIPath) => function path37(statics, ...params) {
+var createPathTagFunction = (pathEncoder = encodeURIPath) => function path38(statics, ...params) {
   if (statics.length === 1)
     return statics[0];
   let postPath = false;
   const invalidSegments = [];
-  const path38 = statics.reduce((previousValue, currentValue, index) => {
+  const path39 = statics.reduce((previousValue, currentValue, index) => {
     if (/[?#]/.test(currentValue)) {
       postPath = true;
     }
@@ -3349,7 +3349,7 @@ var createPathTagFunction = (pathEncoder = encodeURIPath) => function path37(sta
     }
     return previousValue + currentValue + (index === params.length ? "" : encoded);
   }, "");
-  const pathOnly = path38.split(/[?#]/, 1)[0];
+  const pathOnly = path39.split(/[?#]/, 1)[0];
   const invalidSegmentPattern = /(?<=^|\/)(?:\.|%2e){1,2}(?=\/|$)/gi;
   let match;
   while ((match = invalidSegmentPattern.exec(pathOnly)) !== null) {
@@ -3370,10 +3370,10 @@ var createPathTagFunction = (pathEncoder = encodeURIPath) => function path37(sta
     }, "");
     throw new OpenAIError(`Path parameters result in path with invalid segments:
 ${invalidSegments.map((e) => e.error).join("\n")}
-${path38}
+${path39}
 ${underline}`);
   }
-  return path38;
+  return path39;
 };
 var path = /* @__PURE__ */ createPathTagFunction(encodeURIPath);
 
@@ -10890,9 +10890,9 @@ var OpenAI = class {
     this.apiKey = token;
     return true;
   }
-  buildURL(path37, query, defaultBaseURL) {
+  buildURL(path38, query, defaultBaseURL) {
     const baseURL = !__classPrivateFieldGet(this, _OpenAI_instances, "m", _OpenAI_baseURLOverridden).call(this) && defaultBaseURL || this.baseURL;
-    const url = isAbsoluteURL(path37) ? new URL(path37) : new URL(baseURL + (baseURL.endsWith("/") && path37.startsWith("/") ? path37.slice(1) : path37));
+    const url = isAbsoluteURL(path38) ? new URL(path38) : new URL(baseURL + (baseURL.endsWith("/") && path38.startsWith("/") ? path38.slice(1) : path38));
     const defaultQuery = this.defaultQuery();
     const pathQuery = Object.fromEntries(url.searchParams);
     if (!isEmptyObj(defaultQuery) || !isEmptyObj(pathQuery)) {
@@ -10920,24 +10920,24 @@ var OpenAI = class {
    */
   async prepareRequest(request, { url, options }) {
   }
-  get(path37, opts) {
-    return this.methodRequest("get", path37, opts);
+  get(path38, opts) {
+    return this.methodRequest("get", path38, opts);
   }
-  post(path37, opts) {
-    return this.methodRequest("post", path37, opts);
+  post(path38, opts) {
+    return this.methodRequest("post", path38, opts);
   }
-  patch(path37, opts) {
-    return this.methodRequest("patch", path37, opts);
+  patch(path38, opts) {
+    return this.methodRequest("patch", path38, opts);
   }
-  put(path37, opts) {
-    return this.methodRequest("put", path37, opts);
+  put(path38, opts) {
+    return this.methodRequest("put", path38, opts);
   }
-  delete(path37, opts) {
-    return this.methodRequest("delete", path37, opts);
+  delete(path38, opts) {
+    return this.methodRequest("delete", path38, opts);
   }
-  methodRequest(method, path37, opts) {
+  methodRequest(method, path38, opts) {
     return this.request(Promise.resolve(opts).then((opts2) => {
-      return { method, path: path37, ...opts2 };
+      return { method, path: path38, ...opts2 };
     }));
   }
   request(options, remainingRetries = null) {
@@ -11059,8 +11059,8 @@ var OpenAI = class {
     }));
     return { response, options, controller, requestLogID, retryOfRequestLogID, startTime };
   }
-  getAPIList(path37, Page2, opts) {
-    return this.requestAPIList(Page2, opts && "then" in opts ? opts.then((opts2) => ({ method: "get", path: path37, ...opts2 })) : { method: "get", path: path37, ...opts });
+  getAPIList(path38, Page2, opts) {
+    return this.requestAPIList(Page2, opts && "then" in opts ? opts.then((opts2) => ({ method: "get", path: path38, ...opts2 })) : { method: "get", path: path38, ...opts });
   }
   requestAPIList(Page2, options) {
     const request = this.makeRequest(options, null, void 0);
@@ -11154,8 +11154,8 @@ var OpenAI = class {
   }
   async buildRequest(inputOptions, { retryCount = 0 } = {}) {
     const options = { ...inputOptions };
-    const { method, path: path37, query, defaultBaseURL } = options;
-    const url = this.buildURL(path37, query, defaultBaseURL);
+    const { method, path: path38, query, defaultBaseURL } = options;
+    const url = this.buildURL(path38, query, defaultBaseURL);
     if ("timeout" in options)
       validatePositiveInteger("timeout", options.timeout);
     options.timeout = options.timeout ?? this.timeout;
@@ -12182,10 +12182,10 @@ var BindListCommand = class extends M8tCommand {
     const qs = new URLSearchParams();
     if (this.channel) qs.set("channel", this.channel);
     if (this.status) qs.set("status", this.status);
-    const path37 = qs.toString().length > 0 ? `/api/bindings?${qs.toString()}` : "/api/bindings";
+    const path38 = qs.toString().length > 0 ? `/api/bindings?${qs.toString()}` : "/api/bindings";
     const data = await apiCall(
       { gatewayUrl: ctx.gatewayUrl, gatewayClientId: ctx.gatewayClientId },
-      { method: "GET", path: path37 },
+      { method: "GET", path: path38 },
       (msg) => this.context.stderr.write(msg + "\n")
     );
     if (mode === "json") {
@@ -13396,8 +13396,8 @@ ${r.stderr}`;
         message: `gh api /repos/${slug} failed (exit ${r.exitCode.toString()}): ${(r.stderr || r.stdout).slice(0, 200)}`
       });
     },
-    getFile: async (path37) => {
-      const r = await exec("gh", ["api", "-H", "Accept: application/vnd.github.raw+json", `/repos/${slug}/contents/${path37}`]);
+    getFile: async (path38) => {
+      const r = await exec("gh", ["api", "-H", "Accept: application/vnd.github.raw+json", `/repos/${slug}/contents/${path38}`]);
       return r.exitCode === 0 ? r.stdout : null;
     },
     isEmpty: async () => {
@@ -14487,7 +14487,7 @@ function appRepoProbe(args) {
       const res = await doFetch(`${GH_API}/repos/${args.repo}`, { headers: H, signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS) });
       return res.status;
     },
-    getFile: (path37) => readRepoFileViaApp({ token: args.token, repo: args.repo, path: path37, fetchImpl: args.fetchImpl }),
+    getFile: (path38) => readRepoFileViaApp({ token: args.token, repo: args.repo, path: path38, fetchImpl: args.fetchImpl }),
     isEmpty: async () => {
       const res = await doFetch(`${GH_API}/repos/${args.repo}/contents`, { headers: H, signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS) });
       return res.status === 404;
@@ -15695,7 +15695,7 @@ async function awaitDataPlaneReady(opts) {
   const consecutive = opts.consecutive ?? 3;
   const attempts = opts.attempts ?? 60;
   const intervalMs = opts.intervalMs ?? 5e3;
-  const sleep4 = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep5 = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   let streak = 0;
   for (let i = 1; i <= attempts; i++) {
     const r = await opts.probe();
@@ -15717,7 +15717,7 @@ async function awaitDataPlaneReady(opts) {
       streak = 0;
       opts.onProgress?.(`data-plane not ready (${forcedRetryable ? `status ${(r.status ?? 0).toString()}` : cls.category}), waiting\u2026`);
     }
-    if (i < attempts) await sleep4(intervalMs);
+    if (i < attempts) await sleep5(intervalMs);
   }
   return { ready: false, attempts };
 }
@@ -16801,7 +16801,7 @@ init_errors();
 async function deployHostedWorker(args) {
   const onProgress = args.onProgress ?? ((_m) => {
   });
-  const sleep4 = args.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep5 = args.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const now = args.now ?? (() => Date.now());
   const timeout = args.pollTimeoutMs ?? 8 * 60 * 1e3;
   const interval = args.pollIntervalMs ?? 1e4;
@@ -16853,7 +16853,7 @@ async function deployHostedWorker(args) {
         hint: "Provisioning can take 2\u20135 min; re-run with the same name to resume, or check the version status in the Foundry portal."
       });
     }
-    await sleep4(interval);
+    await sleep5(interval);
   }
 }
 
@@ -17751,8 +17751,8 @@ async function fetchPublicTags(repo, fetchImpl = fetch) {
       hint: "Pass a ghcr.io/<owner>/<name> repo, or use the BYOC private-ACR deploy flow."
     });
   }
-  const path37 = repo.replace(/^ghcr\.io\//, "");
-  const tokenRes = await fetchImpl(`https://ghcr.io/token?scope=repository:${path37}:pull`);
+  const path38 = repo.replace(/^ghcr\.io\//, "");
+  const tokenRes = await fetchImpl(`https://ghcr.io/token?scope=repository:${path38}:pull`);
   if (!tokenRes.ok) {
     throw new LocalCliError({
       code: "PLATFORM_GHCR_TOKEN_FAILED",
@@ -17768,7 +17768,7 @@ async function fetchPublicTags(repo, fetchImpl = fetch) {
       hint: "Make the package public (deploy/ghcr-package-visibility.md), then retry."
     });
   }
-  const tagsRes = await fetchImpl(`https://ghcr.io/v2/${path37}/tags/list`, {
+  const tagsRes = await fetchImpl(`https://ghcr.io/v2/${path38}/tags/list`, {
     headers: { Authorization: `Bearer ${token}` }
   });
   if (!tagsRes.ok) {
@@ -19101,25 +19101,25 @@ function mergeThreeWay(ours, base, theirs) {
     fs23.rmSync(dir, { recursive: true, force: true });
   }
 }
-var skip = (path37, skipReason) => ({ path: path37, kind: "skip", skipReason });
+var skip = (path38, skipReason) => ({ path: path38, kind: "skip", skipReason });
 function classifyCandidate(c) {
-  const { path: path37, base, ours, theirs } = c;
-  if (theirs === base) return { path: path37, kind: "noop" };
+  const { path: path38, base, ours, theirs } = c;
+  if (theirs === base) return { path: path38, kind: "noop" };
   if (base === null) {
-    if (theirs === null) return { path: path37, kind: "noop" };
-    if (ours === null) return { path: path37, kind: "add", content: theirs };
-    if (ours === theirs) return { path: path37, kind: "noop" };
-    return skip(path37, "you already have a file at this path");
+    if (theirs === null) return { path: path38, kind: "noop" };
+    if (ours === null) return { path: path38, kind: "add", content: theirs };
+    if (ours === theirs) return { path: path38, kind: "noop" };
+    return skip(path38, "you already have a file at this path");
   }
   if (ours === null) {
-    return theirs === null ? { path: path37, kind: "noop" } : skip(path37, "you removed this file; upstream changed it");
+    return theirs === null ? { path: path38, kind: "noop" } : skip(path38, "you removed this file; upstream changed it");
   }
   if (theirs === null) {
-    return ours === base ? { path: path37, kind: "delete" } : skip(path37, "you edited this file; upstream removed it");
+    return ours === base ? { path: path38, kind: "delete" } : skip(path38, "you edited this file; upstream removed it");
   }
-  if (ours === base) return { path: path37, kind: "update", content: theirs };
+  if (ours === base) return { path: path38, kind: "update", content: theirs };
   const m = mergeThreeWay(ours, base, theirs);
-  return m.ok ? { path: path37, kind: "update", content: m.merged } : skip(path37, "your edits conflict with the update");
+  return m.ok ? { path: path38, kind: "update", content: m.merged } : skip(path38, "your edits conflict with the update");
 }
 
 // src/lib/seed-pr-body.ts
@@ -19304,7 +19304,7 @@ function bindRepoApi(token, repo) {
     openPr: (head, base, title, body) => openPullRequestViaApp({ token, repo, base, head, title, body }),
     updatePr: (n, title, body) => updatePullRequestViaApp({ token, repo, number: n, title, body }),
     closePr: (n, comment) => closePullRequestViaApp({ token, repo, number: n, comment }),
-    readFileAtRef: (path37, ref) => readRepoFileViaApp({ token, repo, path: path37, ref })
+    readFileAtRef: (path38, ref) => readRepoFileViaApp({ token, repo, path: path38, ref })
   };
 }
 async function runSeedRefresh(args) {
@@ -21084,9 +21084,9 @@ function flattenDelta(delta, prefix = "") {
   const out = [];
   for (const d of delta) {
     const segment = /^[0-9]+$/.test(d.path) ? `[${d.path}]` : prefix ? `.${d.path}` : d.path;
-    const path37 = prefix ? `${prefix}${segment}` : d.path;
-    if (d.children && d.children.length > 0) out.push(...flattenDelta(d.children, path37));
-    else out.push({ ...d, path: path37 });
+    const path38 = prefix ? `${prefix}${segment}` : d.path;
+    if (d.children && d.children.length > 0) out.push(...flattenDelta(d.children, path38));
+    else out.push({ ...d, path: path38 });
   }
   return out;
 }
@@ -23243,7 +23243,7 @@ function mapItems(raw) {
   return acc.reverse();
 }
 function makeConversationSource(client, opts = {}) {
-  const sleep4 = opts.sleep ?? defaultSleep;
+  const sleep5 = opts.sleep ?? defaultSleep;
   return {
     async items(conversationId) {
       for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
@@ -23261,7 +23261,7 @@ function makeConversationSource(client, opts = {}) {
             throw new ConvFetchError("auth", `auth failed reading ${conversationId}`);
           const retryable = status === void 0 || status === TRANSIENT;
           if (retryable && attempt < MAX_ATTEMPTS - 1) {
-            await sleep4(attempt);
+            await sleep5(attempt);
             continue;
           }
           throw new ConvFetchError("terminal", `exhausted ${String(MAX_ATTEMPTS)} retries reading ${conversationId}: ${e?.message ?? String(e)}`);
@@ -23672,7 +23672,7 @@ function buildAdvancePlan(worker, cursor, physicalPks, consumedRowsByPk, failedT
 // ../../packages/brain/engine/dist/esm/dream/writer.js
 var API2 = "https://api.github.com";
 var WRITER_ALLOWED_PREFIX = /^(memory|inbox|quarantine|artifacts)\//;
-var isAllowedWritePath = (path37, allowedPrefix) => allowedPrefix.test(path37) && !path37.split("/").includes("..");
+var isAllowedWritePath = (path38, allowedPrefix) => allowedPrefix.test(path38) && !path38.split("/").includes("..");
 var unquote = (s) => s.trim().replace(/^["']|["']$/g, "");
 function parseFrontmatter(content) {
   const m = /^---\r?\n([\s\S]*?)\r?\n---/.exec(content);
@@ -23715,8 +23715,8 @@ function makeGitDataWriter(args) {
   if (args.allowedPathPrefix && !args.allowedPathPrefix.source.startsWith("^")) {
     throw new Error(`makeGitDataWriter: allowedPathPrefix must be anchored with "^" (got /${args.allowedPathPrefix.source}/) \u2014 an unanchored regex would widen the B1 write-path allowlist`);
   }
-  async function gh(token, method, path37, body) {
-    const res = await doFetch(`${API2}/repos/${repoPath}${path37}`, {
+  async function gh(token, method, path38, body) {
+    const res = await doFetch(`${API2}/repos/${repoPath}${path38}`, {
       method,
       headers: {
         Authorization: `Bearer ${token}`,
@@ -23729,8 +23729,8 @@ function makeGitDataWriter(args) {
     const text = await res.text();
     return { status: res.status, ok: res.ok, json: text ? JSON.parse(text) : {} };
   }
-  async function readFileWith(token, path37) {
-    const encodedPath = path37.split("/").map(encodeURIComponent).join("/");
+  async function readFileWith(token, path38) {
+    const encodedPath = path38.split("/").map(encodeURIComponent).join("/");
     const r = await gh(token, "GET", `/contents/${encodedPath}?ref=${args.branch}`);
     if (r.status === 404)
       return null;
@@ -23746,9 +23746,9 @@ function makeGitDataWriter(args) {
         throw new Error(`fetchTip: HTTP ${String(r.status)}`);
       return r.json.object.sha;
     },
-    async readFile(path37) {
+    async readFile(path38) {
       const token = await args.mintToken();
-      return readFileWith(token, path37);
+      return readFileWith(token, path38);
     },
     async listMemory() {
       const token = await args.mintToken();
@@ -23757,9 +23757,9 @@ function makeGitDataWriter(args) {
         return [];
       const paths = r.json.tree.filter((e) => e.type === "blob" && e.path.startsWith("memory/") && e.path.endsWith(".md")).map((e) => e.path);
       const out = [];
-      for (const path37 of paths) {
-        const content = await readFileWith(token, path37);
-        out.push({ path: path37, frontmatter: content ? parseFrontmatter(content) : {} });
+      for (const path38 of paths) {
+        const content = await readFileWith(token, path38);
+        out.push({ path: path38, frontmatter: content ? parseFrontmatter(content) : {} });
       }
       return out;
     },
@@ -24063,7 +24063,7 @@ function extractJson(text) {
   return JSON.parse(candidate2.slice(start, end + 1));
 }
 async function propose(model, system, user, opts = {}) {
-  const sleep4 = opts.sleep ?? defaultSleep2;
+  const sleep5 = opts.sleep ?? defaultSleep2;
   const modelName = opts.model ?? MODEL_NAME_FALLBACK;
   let inputTokens = 0;
   let outputTokens = 0;
@@ -24079,7 +24079,7 @@ async function propose(model, system, user, opts = {}) {
     } catch (e) {
       lastErr = `parse: ${e.message}`;
       if (attempt < MAX_MODEL_ATTEMPTS - 1) {
-        await sleep4(attempt);
+        await sleep5(attempt);
         continue;
       }
       break;
@@ -24088,7 +24088,7 @@ async function propose(model, system, user, opts = {}) {
     if (!Array.isArray(rawDeltas)) {
       lastErr = "schema: top-level { deltas: [] } missing";
       if (attempt < MAX_MODEL_ATTEMPTS - 1) {
-        await sleep4(attempt);
+        await sleep5(attempt);
         continue;
       }
       break;
@@ -24198,7 +24198,7 @@ async function loadMemoryContext(brain) {
   return {
     files,
     indexEntries,
-    originOf: (path37) => originByPath.get(path37) ?? "worker"
+    originOf: (path38) => originByPath.get(path38) ?? "worker"
   };
 }
 
@@ -24219,14 +24219,14 @@ function checkEvidenceMembership(delta, harvested) {
 }
 var BatchAbort = class extends Error {
   path;
-  constructor(path37, message) {
+  constructor(path38, message) {
     super(message);
-    this.path = path37;
+    this.path = path38;
     this.name = "BatchAbort";
   }
 };
-var isIndexFile = (path37) => /(^|\/)[^/]*_index\.md$/.test(path37);
-var isMemoryIndex = (path37) => path37 === "memory/MEMORY.md";
+var isIndexFile = (path38) => /(^|\/)[^/]*_index\.md$/.test(path38);
+var isMemoryIndex = (path38) => path38 === "memory/MEMORY.md";
 function targetPath(delta) {
   switch (delta.verb) {
     case "new":
@@ -24243,29 +24243,29 @@ function targetPath(delta) {
 }
 async function checkOriginTier(delta, lookup) {
   const evidence = evidenceOf(delta) ?? [];
-  const path37 = targetPath(delta);
-  if (path37 === null)
+  const path38 = targetPath(delta);
+  if (path38 === null)
     return { ok: true };
-  if (isIndexFile(path37) && !isMemoryIndex(path37)) {
-    return { ok: false, flagged: { kind: "flagged", path: path37, tension: `refused: ${path37} is an index file (only memory/MEMORY.md is editable)`, evidence } };
+  if (isIndexFile(path38) && !isMemoryIndex(path38)) {
+    return { ok: false, flagged: { kind: "flagged", path: path38, tension: `refused: ${path38} is an index file (only memory/MEMORY.md is editable)`, evidence } };
   }
-  const target = await lookup(path37);
-  const isStructural = path37.startsWith("references/");
+  const target = await lookup(path38);
+  const isStructural = path38.startsWith("references/");
   const origin = target?.frontmatter.origin ?? (isStructural ? "operator" : "worker");
   const editable = origin === "worker" || origin === "dream";
   if (editable)
     return { ok: true };
   const removesOperatorTarget = delta.verb === "retract" || delta.verb === "supersede" && delta.oldPath !== delta.newPath;
   if (removesOperatorTarget) {
-    throw new BatchAbort(path37, `supersede/retract OLD target ${path37} is origin: ${origin} \u2014 aborting batch (never half-apply)`);
+    throw new BatchAbort(path38, `supersede/retract OLD target ${path38} is origin: ${origin} \u2014 aborting batch (never half-apply)`);
   }
-  return { ok: false, flagged: { kind: "flagged", path: path37, tension: `operator-origin (${origin}); flag-only`, evidence } };
+  return { ok: false, flagged: { kind: "flagged", path: path38, tension: `operator-origin (${origin}); flag-only`, evidence } };
 }
 var ALLOWED_MEMORY = /^memory\/.+\.md$/;
 var ALLOWED_INBOX = /^inbox\//;
 var ALLOWED_QUARANTINE = /^quarantine\//;
 var ALLOWED_FLAG = /^memory\//;
-var hasTraversal = (path37) => path37.split("/").includes("..");
+var hasTraversal = (path38) => path38.split("/").includes("..");
 function checkPathAllowed(delta) {
   const evidence = evidenceOf(delta) ?? [];
   const reject = (detail) => ({ ok: false, rejected: { kind: "rejected", detail, evidence } });
@@ -24372,7 +24372,7 @@ ${inject}
 ---
 ` + body.slice(m[0].length);
 }
-var indexLine = (path37, title, date, tags) => `- \`${path37}\` \u2014 **${title}**: ${title}. (${date} \xB7 ${tags.join(", ")})`;
+var indexLine = (path38, title, date, tags) => `- \`${path38}\` \u2014 **${title}**: ${title}. (${date} \xB7 ${tags.join(", ")})`;
 function splitIndex(index) {
   const all = index.split("\n");
   const firstLineIdx = all.findIndex((l) => l.startsWith("- `memory/"));
@@ -24545,16 +24545,16 @@ function defaultDreamSeams(opts = {}) {
       const mem = await memory(deps.brain);
       const harvested = harvestedIds(input);
       const ctx = { readFile: (p) => deps.brain.readFile(p), at: deps.clock() };
-      const lookup = (path37) => Promise.resolve(mem.files.find((f) => f.path === path37) ?? null);
+      const lookup = (path38) => Promise.resolve(mem.files.find((f) => f.path === path38) ?? null);
       const digest = [...pendingRejected];
       let changes = [];
       let indexEdit;
       try {
         for (const raw of deltas) {
           const delta = forcePolicyQuarantine(raw);
-          const path37 = checkPathAllowed(delta);
-          if (!path37.ok) {
-            digest.push(path37.rejected);
+          const path38 = checkPathAllowed(delta);
+          if (!path38.ok) {
+            digest.push(path38.rejected);
             continue;
           }
           const ev = checkEvidenceMembership(delta, harvested);
@@ -25668,13 +25668,13 @@ var EVENT_TIERS = {
 var EVENT_ENUM = Object.keys(EVENT_TIERS);
 
 // ../../packages/telemetry-contract/src/disclosure.ts
-var DISCLOSURE_TIER1 = "Operational data. To support your installation, m8t receives limited operational data linked to it \u2014 installation and update events, installed versions, and service health signals, along with the company name and contact email you provide. This is service data used only to operate and support the platform; it contains none of your content. Details: TELEMETRY.md.";
+var DISCLOSURE_TIER1 = "Operational data. To support your installation, m8t receives limited operational data linked to it \u2014 installation and update events, installed versions, and service health signals, along with the company name and contact email you provide. At enrollment, we also verify a cloud identity token to confirm the request comes from a real cloud account; the token is discarded immediately and never stored. This is service data used only to operate and support the platform; it contains none of your content. Details: TELEMETRY.md.";
 
 // ../../packages/telemetry-contract/src/endpoints.ts
 var INGEST_BASE_URL = (process.env.M8T_INGEST_BASE_URL ?? "").trim() || "https://m8t-admin.wonderfuldesert-721e332f.eastus2.azurecontainerapps.io";
-function ingestUrl(path37) {
+function ingestUrl(path38) {
   const base = INGEST_BASE_URL.replace(/\/+$/, "");
-  return `${base}${path37.startsWith("/") ? path37 : `/${path37}`}`;
+  return `${base}${path38.startsWith("/") ? path38 : `/${path38}`}`;
 }
 
 // src/commands/bootstrap/preflight.ts
@@ -26078,7 +26078,7 @@ async function writeBootstrapState(state, home = os13.homedir()) {
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.39";
+var DEFAULT_INSTALLER_TAG = "v0.1.40";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
@@ -26256,7 +26256,7 @@ var BootstrapStatusCommand = class extends M8tCommand {
       typeof this.output === "string" ? this.output : void 0,
       this.context.stdout
     );
-    const sleep4 = (ms) => new Promise((r) => setTimeout(r, ms));
+    const sleep5 = (ms) => new Promise((r) => setTimeout(r, ms));
     const watch = this.watch === true;
     for (; ; ) {
       let doc;
@@ -26266,7 +26266,7 @@ var BootstrapStatusCommand = class extends M8tCommand {
         if (watch && e instanceof LocalCliError && e.code === "BOOTSTRAP_STATUS_UNREADABLE") {
           if (mode === "pretty") this.context.stderr.write(`  ${colors.dim("waiting for the installer to start\u2026")}
 `);
-          await sleep4(1e4);
+          await sleep5(1e4);
           continue;
         }
         throw e;
@@ -26291,7 +26291,7 @@ var BootstrapStatusCommand = class extends M8tCommand {
         );
         return 1;
       }
-      await sleep4(1e4);
+      await sleep5(1e4);
     }
   }
 };
@@ -27659,9 +27659,9 @@ async function serveOnboardingUiDetached(args) {
   child.unref();
   fs32.writeFileSync(pidPath, String(child.pid), "utf8");
   const deadline = Date.now() + 45e3;
-  const sleep4 = (ms) => new Promise((r) => setTimeout(r, ms));
+  const sleep5 = (ms) => new Promise((r) => setTimeout(r, ms));
   while (Date.now() < deadline) {
-    await sleep4(500);
+    await sleep5(500);
     if (await isPortOpen()) break;
   }
   return { alreadyRunning: false, logPath };
@@ -27719,9 +27719,9 @@ async function serveOnboardingRelayDetached(args) {
   child.unref();
   fs32.writeFileSync(pidPath, String(child.pid), "utf8");
   const deadline = Date.now() + 45e3;
-  const sleep4 = (ms) => new Promise((r) => setTimeout(r, ms));
+  const sleep5 = (ms) => new Promise((r) => setTimeout(r, ms));
   while (Date.now() < deadline) {
-    await sleep4(500);
+    await sleep5(500);
     if (await isLocalPortOpen(portNum)) break;
   }
   return { alreadyRunning: false, logPath };
@@ -27978,7 +27978,7 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
     const parsedTimeout = Number(rawTimeout);
     const timeoutMin = rawTimeout !== "" && Number.isFinite(parsedTimeout) ? parsedTimeout : 20;
     const deadline = Date.now() + timeoutMin * 6e4;
-    const sleep4 = (ms) => new Promise((r) => setTimeout(r, ms));
+    const sleep5 = (ms) => new Promise((r) => setTimeout(r, ms));
     for (; ; ) {
       const token = await getFoundryToken();
       const { hadIntake, block } = await findOnboardingProfile({ endpoint: ctx.endpoint, token });
@@ -28006,33 +28006,60 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
       }
       this.context.stderr.write(`  ${colors.dim("waiting for the questionnaire to complete\u2026")}
 `);
-      await sleep4(2e4);
+      await sleep5(2e4);
     }
   }
 };
 
 // src/commands/telemetry/enroll.ts
+import * as fs34 from "fs";
+import * as os19 from "os";
+import * as path37 from "path";
 import { Command as Command56, Option as Option53 } from "clipanion";
 init_errors();
 
 // src/lib/telemetry-enroll.ts
 init_errors();
+async function defaultToken() {
+  const out = await runAz([
+    "account",
+    "get-access-token",
+    "--resource",
+    "https://management.azure.com/",
+    "--query",
+    "accessToken",
+    "-o",
+    "tsv"
+  ]);
+  const token = out.trim();
+  return token.length > 0 ? token : null;
+}
+var sleep4 = (ms) => new Promise((r) => setTimeout(r, ms));
 async function enroll(args) {
   const f = args.fetchImpl ?? fetch;
   const url = args.baseUrl ? `${args.baseUrl.replace(/\/+$/, "")}/api/ingest/enroll` : ingestUrl("/api/ingest/enroll");
+  const retryDelayMs = args.retryDelayMs ?? 1e3;
+  const token = await (args.tokenImpl ?? defaultToken)().catch(() => null);
+  const body = JSON.stringify({
+    schemaVersion: 1,
+    company: args.company,
+    contactEmail: args.contactEmail,
+    subscriptionId: args.subscriptionId,
+    proof: token ? { type: "entra-jwt", token } : null
+  });
   let res;
-  try {
-    res = await f(url, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ schemaVersion: 1, company: args.company, contactEmail: args.contactEmail, subscriptionId: args.subscriptionId, proof: null })
-    });
-  } catch (e) {
-    throw new LocalCliError({ code: "TELEMETRY_ENROLL_UNREACHABLE", message: `Could not reach the telemetry ingest to enroll: ${e instanceof Error ? e.message : String(e)}` });
+  for (let attempt = 1; attempt <= 3; attempt++) {
+    try {
+      res = await f(url, { method: "POST", headers: { "content-type": "application/json" }, body });
+    } catch (e) {
+      throw new LocalCliError({ code: "TELEMETRY_ENROLL_UNREACHABLE", message: `Could not reach the telemetry ingest to enroll: ${e instanceof Error ? e.message : String(e)}` });
+    }
+    if (res.status !== 503 || attempt === 3) break;
+    await sleep4(retryDelayMs * attempt);
   }
-  if (!res.ok) {
-    const body = await res.text().catch(() => "");
-    throw new LocalCliError({ code: "TELEMETRY_ENROLL_FAILED", message: `Enroll failed (HTTP ${res.status.toString()}): ${body}` });
+  if (!res?.ok) {
+    const detail = res ? await res.text().catch(() => "") : "";
+    throw new LocalCliError({ code: "TELEMETRY_ENROLL_FAILED", message: `Enroll failed (HTTP ${res ? res.status.toString() : "?"}): ${detail}` });
   }
   const json = await res.json();
   if (!json.instanceId || !json.ingestKey) {
@@ -28108,7 +28135,14 @@ var TelemetryEnrollCommand = class extends M8tCommand {
       }
     }
     const { instanceId, ingestKey } = await enroll({ company, contactEmail, subscriptionId });
-    await runAz(["keyvault", "secret", "set", "--vault-name", kvName, "--name", INGEST_KEY_SECRET, "--value", ingestKey, "--only-show-errors"]);
+    const keyDir = fs34.mkdtempSync(path37.join(os19.tmpdir(), "m8t-ingest-key-"));
+    const keyFile = path37.join(keyDir, "key");
+    try {
+      fs34.writeFileSync(keyFile, ingestKey, { mode: 384 });
+      await runAz(["keyvault", "secret", "set", "--vault-name", kvName, "--name", INGEST_KEY_SECRET, "--file", keyFile, "--only-show-errors"]);
+    } finally {
+      fs34.rmSync(keyDir, { recursive: true, force: true });
+    }
     this.context.stdout.write(
       `${colors.success("\u2713")} enrolled (instance ${instanceId}); ingest key stored in Key Vault ${kvName}. The gateway picks it up on its next cycle.
 `