@m8t-stack/cli 0.2.33 → 0.2.35

package/dist/cli.js

@@ -1247,7 +1247,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.33";
+var CLI_VERSION = "0.2.35";
 
 // src/lib/render-error.ts
 init_errors();
@@ -1444,6 +1444,7 @@ var BACKEND_RULES = [
 var LOCAL_RULES = {
   AGENT_CREATE_VERSION_FAILED: "Re-run with `--verbose` for the full response body.",
   AGENT_CREATE_VERSION_NO_VERSION: "Foundry returned 2xx but no version \u2014 likely an API regression. Re-try; if it persists, file an issue.",
+  AGENT_ENDPOINT_AUTH_PATCH_FAILED: "Re-run with `--verbose` for the full response body.",
   AGENT_GET_FAILED: "Re-run with `--verbose` for the full response body.",
   AGENT_NOT_FOUND: "Use `m8t brain create <name>` to create the worker first, OR run `m8t deploy <name>` to register an existing agent.",
   AGENT_REDEPLOY_FAILED: "Re-run with `--verbose` for the full response body.",
@@ -3327,12 +3328,12 @@ function encodeURIPath(str4) {
   return str4.replace(/[^A-Za-z0-9\-._~!$&'()*+,;=:@]+/g, encodeURIComponent);
 }
 var EMPTY = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.create(null));
-var createPathTagFunction = (pathEncoder = encodeURIPath) => function path37(statics, ...params) {
+var createPathTagFunction = (pathEncoder = encodeURIPath) => function path38(statics, ...params) {
   if (statics.length === 1)
     return statics[0];
   let postPath = false;
   const invalidSegments = [];
-  const path38 = statics.reduce((previousValue, currentValue, index) => {
+  const path39 = statics.reduce((previousValue, currentValue, index) => {
     if (/[?#]/.test(currentValue)) {
       postPath = true;
     }
@@ -3349,7 +3350,7 @@ var createPathTagFunction = (pathEncoder = encodeURIPath) => function path37(sta
     }
     return previousValue + currentValue + (index === params.length ? "" : encoded);
   }, "");
-  const pathOnly = path38.split(/[?#]/, 1)[0];
+  const pathOnly = path39.split(/[?#]/, 1)[0];
   const invalidSegmentPattern = /(?<=^|\/)(?:\.|%2e){1,2}(?=\/|$)/gi;
   let match;
   while ((match = invalidSegmentPattern.exec(pathOnly)) !== null) {
@@ -3370,10 +3371,10 @@ var createPathTagFunction = (pathEncoder = encodeURIPath) => function path37(sta
     }, "");
     throw new OpenAIError(`Path parameters result in path with invalid segments:
 ${invalidSegments.map((e) => e.error).join("\n")}
-${path38}
+${path39}
 ${underline}`);
   }
-  return path38;
+  return path39;
 };
 var path = /* @__PURE__ */ createPathTagFunction(encodeURIPath);
 
@@ -10890,9 +10891,9 @@ var OpenAI = class {
     this.apiKey = token;
     return true;
   }
-  buildURL(path37, query, defaultBaseURL) {
+  buildURL(path38, query, defaultBaseURL) {
     const baseURL = !__classPrivateFieldGet(this, _OpenAI_instances, "m", _OpenAI_baseURLOverridden).call(this) && defaultBaseURL || this.baseURL;
-    const url = isAbsoluteURL(path37) ? new URL(path37) : new URL(baseURL + (baseURL.endsWith("/") && path37.startsWith("/") ? path37.slice(1) : path37));
+    const url = isAbsoluteURL(path38) ? new URL(path38) : new URL(baseURL + (baseURL.endsWith("/") && path38.startsWith("/") ? path38.slice(1) : path38));
     const defaultQuery = this.defaultQuery();
     const pathQuery = Object.fromEntries(url.searchParams);
     if (!isEmptyObj(defaultQuery) || !isEmptyObj(pathQuery)) {
@@ -10920,24 +10921,24 @@ var OpenAI = class {
    */
   async prepareRequest(request, { url, options }) {
   }
-  get(path37, opts) {
-    return this.methodRequest("get", path37, opts);
+  get(path38, opts) {
+    return this.methodRequest("get", path38, opts);
   }
-  post(path37, opts) {
-    return this.methodRequest("post", path37, opts);
+  post(path38, opts) {
+    return this.methodRequest("post", path38, opts);
   }
-  patch(path37, opts) {
-    return this.methodRequest("patch", path37, opts);
+  patch(path38, opts) {
+    return this.methodRequest("patch", path38, opts);
   }
-  put(path37, opts) {
-    return this.methodRequest("put", path37, opts);
+  put(path38, opts) {
+    return this.methodRequest("put", path38, opts);
   }
-  delete(path37, opts) {
-    return this.methodRequest("delete", path37, opts);
+  delete(path38, opts) {
+    return this.methodRequest("delete", path38, opts);
   }
-  methodRequest(method, path37, opts) {
+  methodRequest(method, path38, opts) {
     return this.request(Promise.resolve(opts).then((opts2) => {
-      return { method, path: path37, ...opts2 };
+      return { method, path: path38, ...opts2 };
     }));
   }
   request(options, remainingRetries = null) {
@@ -11059,8 +11060,8 @@ var OpenAI = class {
     }));
     return { response, options, controller, requestLogID, retryOfRequestLogID, startTime };
   }
-  getAPIList(path37, Page2, opts) {
-    return this.requestAPIList(Page2, opts && "then" in opts ? opts.then((opts2) => ({ method: "get", path: path37, ...opts2 })) : { method: "get", path: path37, ...opts });
+  getAPIList(path38, Page2, opts) {
+    return this.requestAPIList(Page2, opts && "then" in opts ? opts.then((opts2) => ({ method: "get", path: path38, ...opts2 })) : { method: "get", path: path38, ...opts });
   }
   requestAPIList(Page2, options) {
     const request = this.makeRequest(options, null, void 0);
@@ -11154,8 +11155,8 @@ var OpenAI = class {
   }
   async buildRequest(inputOptions, { retryCount = 0 } = {}) {
     const options = { ...inputOptions };
-    const { method, path: path37, query, defaultBaseURL } = options;
-    const url = this.buildURL(path37, query, defaultBaseURL);
+    const { method, path: path38, query, defaultBaseURL } = options;
+    const url = this.buildURL(path38, query, defaultBaseURL);
     if ("timeout" in options)
       validatePositiveInteger("timeout", options.timeout);
     options.timeout = options.timeout ?? this.timeout;
@@ -12182,10 +12183,10 @@ var BindListCommand = class extends M8tCommand {
     const qs = new URLSearchParams();
     if (this.channel) qs.set("channel", this.channel);
     if (this.status) qs.set("status", this.status);
-    const path37 = qs.toString().length > 0 ? `/api/bindings?${qs.toString()}` : "/api/bindings";
+    const path38 = qs.toString().length > 0 ? `/api/bindings?${qs.toString()}` : "/api/bindings";
     const data = await apiCall(
       { gatewayUrl: ctx.gatewayUrl, gatewayClientId: ctx.gatewayClientId },
-      { method: "GET", path: path37 },
+      { method: "GET", path: path38 },
       (msg) => this.context.stderr.write(msg + "\n")
     );
     if (mode === "json") {
@@ -13396,8 +13397,8 @@ ${r.stderr}`;
         message: `gh api /repos/${slug} failed (exit ${r.exitCode.toString()}): ${(r.stderr || r.stdout).slice(0, 200)}`
       });
     },
-    getFile: async (path37) => {
-      const r = await exec("gh", ["api", "-H", "Accept: application/vnd.github.raw+json", `/repos/${slug}/contents/${path37}`]);
+    getFile: async (path38) => {
+      const r = await exec("gh", ["api", "-H", "Accept: application/vnd.github.raw+json", `/repos/${slug}/contents/${path38}`]);
       return r.exitCode === 0 ? r.stdout : null;
     },
     isEmpty: async () => {
@@ -13917,8 +13918,27 @@ ${text.slice(0, 500)}` });
   }
   const data = await res.json();
   if (!data.version) throw new LocalCliError({ code: "AGENT_CREATE_VERSION_NO_VERSION", message: "createVersion returned no version" });
+  await ensureAgentEndpointEntraIsolation(
+    { credential: args.credential, projectEndpoint: args.projectEndpoint, agentName: args.agentName, extraHeaders: args.extraHeaders },
+    fetchImpl
+  );
   return data.version;
 }
+async function ensureAgentEndpointEntraIsolation(args, fetchImpl = fetch) {
+  const token = await args.credential.getToken(FOUNDRY_DATA_SCOPE);
+  if (!token?.token) throw new LocalCliError({ code: "FOUNDRY_AUTH", message: "Could not acquire Foundry data-plane token" });
+  const url = `${args.projectEndpoint}/agents/${args.agentName}?api-version=v1`;
+  const res = await fetchImpl(url, {
+    method: "PATCH",
+    headers: { Authorization: `Bearer ${token.token}`, "Content-Type": "application/json", ...args.extraHeaders ?? {} },
+    body: JSON.stringify({ agent_endpoint: { authorization_schemes: [{ type: "Entra", isolation_key_source: { kind: "Entra" } }] } })
+  });
+  if (!res.ok) {
+    const text = await res.text();
+    throw new LocalCliError({ code: "AGENT_ENDPOINT_AUTH_PATCH_FAILED", message: `PATCH ${url}: HTTP ${res.status.toString()}
+${text.slice(0, 500)}` });
+  }
+}
 
 // src/lib/brain-link.ts
 init_brain_yaml_mirror();
@@ -14487,7 +14507,7 @@ function appRepoProbe(args) {
       const res = await doFetch(`${GH_API}/repos/${args.repo}`, { headers: H, signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS) });
       return res.status;
     },
-    getFile: (path37) => readRepoFileViaApp({ token: args.token, repo: args.repo, path: path37, fetchImpl: args.fetchImpl }),
+    getFile: (path38) => readRepoFileViaApp({ token: args.token, repo: args.repo, path: path38, fetchImpl: args.fetchImpl }),
     isEmpty: async () => {
       const res = await doFetch(`${GH_API}/repos/${args.repo}/contents`, { headers: H, signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS) });
       return res.status === 404;
@@ -15223,7 +15243,6 @@ import * as os5 from "os";
 import * as path11 from "path";
 init_foundry_agent_get();
 var FOUNDRY_ARM_API2 = "2025-04-01-preview";
-var FOUNDRY_DATA_SCOPE2 = "https://ai.azure.com/.default";
 var ARM_SCOPE5 = "https://management.azure.com/.default";
 var GITHUB_APP_API = "https://api.github.com";
 async function unlinkBrain(args) {
@@ -15309,10 +15328,6 @@ function parseBrainMeta(raw) {
   }
 }
 async function createBrainStrippedVersion(args) {
-  const fndToken = await args.credential.getToken(FOUNDRY_DATA_SCOPE2);
-  if (!fndToken?.token) {
-    throw new LocalCliError({ code: "FOUNDRY_AUTH", message: "Could not acquire Foundry data-plane token" });
-  }
   const otherTools = (args.currentDefinition.tools ?? []).filter(
     (t) => !(t.type === "mcp" && t.server_label === "brain")
   );
@@ -15325,28 +15340,13 @@ async function createBrainStrippedVersion(args) {
     ...args.currentMetadata,
     brain: ""
   };
-  const url = `${args.projectEndpoint}/agents/${args.agentName}/versions?api-version=v1`;
-  const res = await fetch(url, {
-    method: "POST",
-    headers: { Authorization: `Bearer ${fndToken.token}`, "Content-Type": "application/json" },
-    body: JSON.stringify({ definition, metadata })
+  return createAgentVersion({
+    credential: args.credential,
+    projectEndpoint: args.projectEndpoint,
+    agentName: args.agentName,
+    definition,
+    metadata
   });
-  if (!res.ok) {
-    const text = await res.text();
-    throw new LocalCliError({
-      code: "AGENT_CREATE_VERSION_FAILED",
-      message: `POST ${url}: HTTP ${res.status.toString()}
-${text.slice(0, 500)}`
-    });
-  }
-  const data = await res.json();
-  if (!data.version) {
-    throw new LocalCliError({
-      code: "AGENT_REDEPLOY_NO_VERSION",
-      message: "createVersion returned no version"
-    });
-  }
-  return data.version;
 }
 async function deleteConnection(args) {
   const armToken = await args.credential.getToken(ARM_SCOPE5);
@@ -15695,7 +15695,7 @@ async function awaitDataPlaneReady(opts) {
   const consecutive = opts.consecutive ?? 3;
   const attempts = opts.attempts ?? 60;
   const intervalMs = opts.intervalMs ?? 5e3;
-  const sleep4 = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep5 = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   let streak = 0;
   for (let i = 1; i <= attempts; i++) {
     const r = await opts.probe();
@@ -15717,7 +15717,7 @@ async function awaitDataPlaneReady(opts) {
       streak = 0;
       opts.onProgress?.(`data-plane not ready (${forcedRetryable ? `status ${(r.status ?? 0).toString()}` : cls.category}), waiting\u2026`);
     }
-    if (i < attempts) await sleep4(intervalMs);
+    if (i < attempts) await sleep5(intervalMs);
   }
   return { ready: false, attempts };
 }
@@ -16801,7 +16801,7 @@ init_errors();
 async function deployHostedWorker(args) {
   const onProgress = args.onProgress ?? ((_m) => {
   });
-  const sleep4 = args.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep5 = args.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const now = args.now ?? (() => Date.now());
   const timeout = args.pollTimeoutMs ?? 8 * 60 * 1e3;
   const interval = args.pollIntervalMs ?? 1e4;
@@ -16853,7 +16853,7 @@ async function deployHostedWorker(args) {
         hint: "Provisioning can take 2\u20135 min; re-run with the same name to resume, or check the version status in the Foundry portal."
       });
     }
-    await sleep4(interval);
+    await sleep5(interval);
   }
 }
 
@@ -17751,8 +17751,8 @@ async function fetchPublicTags(repo, fetchImpl = fetch) {
       hint: "Pass a ghcr.io/<owner>/<name> repo, or use the BYOC private-ACR deploy flow."
     });
   }
-  const path37 = repo.replace(/^ghcr\.io\//, "");
-  const tokenRes = await fetchImpl(`https://ghcr.io/token?scope=repository:${path37}:pull`);
+  const path38 = repo.replace(/^ghcr\.io\//, "");
+  const tokenRes = await fetchImpl(`https://ghcr.io/token?scope=repository:${path38}:pull`);
   if (!tokenRes.ok) {
     throw new LocalCliError({
       code: "PLATFORM_GHCR_TOKEN_FAILED",
@@ -17768,7 +17768,7 @@ async function fetchPublicTags(repo, fetchImpl = fetch) {
       hint: "Make the package public (deploy/ghcr-package-visibility.md), then retry."
     });
   }
-  const tagsRes = await fetchImpl(`https://ghcr.io/v2/${path37}/tags/list`, {
+  const tagsRes = await fetchImpl(`https://ghcr.io/v2/${path38}/tags/list`, {
     headers: { Authorization: `Bearer ${token}` }
   });
   if (!tagsRes.ok) {
@@ -19101,25 +19101,25 @@ function mergeThreeWay(ours, base, theirs) {
     fs23.rmSync(dir, { recursive: true, force: true });
   }
 }
-var skip = (path37, skipReason) => ({ path: path37, kind: "skip", skipReason });
+var skip = (path38, skipReason) => ({ path: path38, kind: "skip", skipReason });
 function classifyCandidate(c) {
-  const { path: path37, base, ours, theirs } = c;
-  if (theirs === base) return { path: path37, kind: "noop" };
+  const { path: path38, base, ours, theirs } = c;
+  if (theirs === base) return { path: path38, kind: "noop" };
   if (base === null) {
-    if (theirs === null) return { path: path37, kind: "noop" };
-    if (ours === null) return { path: path37, kind: "add", content: theirs };
-    if (ours === theirs) return { path: path37, kind: "noop" };
-    return skip(path37, "you already have a file at this path");
+    if (theirs === null) return { path: path38, kind: "noop" };
+    if (ours === null) return { path: path38, kind: "add", content: theirs };
+    if (ours === theirs) return { path: path38, kind: "noop" };
+    return skip(path38, "you already have a file at this path");
   }
   if (ours === null) {
-    return theirs === null ? { path: path37, kind: "noop" } : skip(path37, "you removed this file; upstream changed it");
+    return theirs === null ? { path: path38, kind: "noop" } : skip(path38, "you removed this file; upstream changed it");
   }
   if (theirs === null) {
-    return ours === base ? { path: path37, kind: "delete" } : skip(path37, "you edited this file; upstream removed it");
+    return ours === base ? { path: path38, kind: "delete" } : skip(path38, "you edited this file; upstream removed it");
   }
-  if (ours === base) return { path: path37, kind: "update", content: theirs };
+  if (ours === base) return { path: path38, kind: "update", content: theirs };
   const m = mergeThreeWay(ours, base, theirs);
-  return m.ok ? { path: path37, kind: "update", content: m.merged } : skip(path37, "your edits conflict with the update");
+  return m.ok ? { path: path38, kind: "update", content: m.merged } : skip(path38, "your edits conflict with the update");
 }
 
 // src/lib/seed-pr-body.ts
@@ -19304,7 +19304,7 @@ function bindRepoApi(token, repo) {
     openPr: (head, base, title, body) => openPullRequestViaApp({ token, repo, base, head, title, body }),
     updatePr: (n, title, body) => updatePullRequestViaApp({ token, repo, number: n, title, body }),
     closePr: (n, comment) => closePullRequestViaApp({ token, repo, number: n, comment }),
-    readFileAtRef: (path37, ref) => readRepoFileViaApp({ token, repo, path: path37, ref })
+    readFileAtRef: (path38, ref) => readRepoFileViaApp({ token, repo, path: path38, ref })
   };
 }
 async function runSeedRefresh(args) {
@@ -21084,9 +21084,9 @@ function flattenDelta(delta, prefix = "") {
   const out = [];
   for (const d of delta) {
     const segment = /^[0-9]+$/.test(d.path) ? `[${d.path}]` : prefix ? `.${d.path}` : d.path;
-    const path37 = prefix ? `${prefix}${segment}` : d.path;
-    if (d.children && d.children.length > 0) out.push(...flattenDelta(d.children, path37));
-    else out.push({ ...d, path: path37 });
+    const path38 = prefix ? `${prefix}${segment}` : d.path;
+    if (d.children && d.children.length > 0) out.push(...flattenDelta(d.children, path38));
+    else out.push({ ...d, path: path38 });
   }
   return out;
 }
@@ -23243,7 +23243,7 @@ function mapItems(raw) {
   return acc.reverse();
 }
 function makeConversationSource(client, opts = {}) {
-  const sleep4 = opts.sleep ?? defaultSleep;
+  const sleep5 = opts.sleep ?? defaultSleep;
   return {
     async items(conversationId) {
       for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
@@ -23261,7 +23261,7 @@ function makeConversationSource(client, opts = {}) {
             throw new ConvFetchError("auth", `auth failed reading ${conversationId}`);
           const retryable = status === void 0 || status === TRANSIENT;
           if (retryable && attempt < MAX_ATTEMPTS - 1) {
-            await sleep4(attempt);
+            await sleep5(attempt);
             continue;
           }
           throw new ConvFetchError("terminal", `exhausted ${String(MAX_ATTEMPTS)} retries reading ${conversationId}: ${e?.message ?? String(e)}`);
@@ -23672,7 +23672,7 @@ function buildAdvancePlan(worker, cursor, physicalPks, consumedRowsByPk, failedT
 // ../../packages/brain/engine/dist/esm/dream/writer.js
 var API2 = "https://api.github.com";
 var WRITER_ALLOWED_PREFIX = /^(memory|inbox|quarantine|artifacts)\//;
-var isAllowedWritePath = (path37, allowedPrefix) => allowedPrefix.test(path37) && !path37.split("/").includes("..");
+var isAllowedWritePath = (path38, allowedPrefix) => allowedPrefix.test(path38) && !path38.split("/").includes("..");
 var unquote = (s) => s.trim().replace(/^["']|["']$/g, "");
 function parseFrontmatter(content) {
   const m = /^---\r?\n([\s\S]*?)\r?\n---/.exec(content);
@@ -23715,8 +23715,8 @@ function makeGitDataWriter(args) {
   if (args.allowedPathPrefix && !args.allowedPathPrefix.source.startsWith("^")) {
     throw new Error(`makeGitDataWriter: allowedPathPrefix must be anchored with "^" (got /${args.allowedPathPrefix.source}/) \u2014 an unanchored regex would widen the B1 write-path allowlist`);
   }
-  async function gh(token, method, path37, body) {
-    const res = await doFetch(`${API2}/repos/${repoPath}${path37}`, {
+  async function gh(token, method, path38, body) {
+    const res = await doFetch(`${API2}/repos/${repoPath}${path38}`, {
       method,
       headers: {
         Authorization: `Bearer ${token}`,
@@ -23729,8 +23729,8 @@ function makeGitDataWriter(args) {
     const text = await res.text();
     return { status: res.status, ok: res.ok, json: text ? JSON.parse(text) : {} };
   }
-  async function readFileWith(token, path37) {
-    const encodedPath = path37.split("/").map(encodeURIComponent).join("/");
+  async function readFileWith(token, path38) {
+    const encodedPath = path38.split("/").map(encodeURIComponent).join("/");
     const r = await gh(token, "GET", `/contents/${encodedPath}?ref=${args.branch}`);
     if (r.status === 404)
       return null;
@@ -23746,9 +23746,9 @@ function makeGitDataWriter(args) {
         throw new Error(`fetchTip: HTTP ${String(r.status)}`);
       return r.json.object.sha;
     },
-    async readFile(path37) {
+    async readFile(path38) {
       const token = await args.mintToken();
-      return readFileWith(token, path37);
+      return readFileWith(token, path38);
     },
     async listMemory() {
       const token = await args.mintToken();
@@ -23757,9 +23757,9 @@ function makeGitDataWriter(args) {
         return [];
       const paths = r.json.tree.filter((e) => e.type === "blob" && e.path.startsWith("memory/") && e.path.endsWith(".md")).map((e) => e.path);
       const out = [];
-      for (const path37 of paths) {
-        const content = await readFileWith(token, path37);
-        out.push({ path: path37, frontmatter: content ? parseFrontmatter(content) : {} });
+      for (const path38 of paths) {
+        const content = await readFileWith(token, path38);
+        out.push({ path: path38, frontmatter: content ? parseFrontmatter(content) : {} });
       }
       return out;
     },
@@ -24063,7 +24063,7 @@ function extractJson(text) {
   return JSON.parse(candidate2.slice(start, end + 1));
 }
 async function propose(model, system, user, opts = {}) {
-  const sleep4 = opts.sleep ?? defaultSleep2;
+  const sleep5 = opts.sleep ?? defaultSleep2;
   const modelName = opts.model ?? MODEL_NAME_FALLBACK;
   let inputTokens = 0;
   let outputTokens = 0;
@@ -24079,7 +24079,7 @@ async function propose(model, system, user, opts = {}) {
     } catch (e) {
       lastErr = `parse: ${e.message}`;
       if (attempt < MAX_MODEL_ATTEMPTS - 1) {
-        await sleep4(attempt);
+        await sleep5(attempt);
         continue;
       }
       break;
@@ -24088,7 +24088,7 @@ async function propose(model, system, user, opts = {}) {
     if (!Array.isArray(rawDeltas)) {
       lastErr = "schema: top-level { deltas: [] } missing";
       if (attempt < MAX_MODEL_ATTEMPTS - 1) {
-        await sleep4(attempt);
+        await sleep5(attempt);
         continue;
       }
       break;
@@ -24198,7 +24198,7 @@ async function loadMemoryContext(brain) {
   return {
     files,
     indexEntries,
-    originOf: (path37) => originByPath.get(path37) ?? "worker"
+    originOf: (path38) => originByPath.get(path38) ?? "worker"
   };
 }
 
@@ -24219,14 +24219,14 @@ function checkEvidenceMembership(delta, harvested) {
 }
 var BatchAbort = class extends Error {
   path;
-  constructor(path37, message) {
+  constructor(path38, message) {
     super(message);
-    this.path = path37;
+    this.path = path38;
     this.name = "BatchAbort";
   }
 };
-var isIndexFile = (path37) => /(^|\/)[^/]*_index\.md$/.test(path37);
-var isMemoryIndex = (path37) => path37 === "memory/MEMORY.md";
+var isIndexFile = (path38) => /(^|\/)[^/]*_index\.md$/.test(path38);
+var isMemoryIndex = (path38) => path38 === "memory/MEMORY.md";
 function targetPath(delta) {
   switch (delta.verb) {
     case "new":
@@ -24243,29 +24243,29 @@ function targetPath(delta) {
 }
 async function checkOriginTier(delta, lookup) {
   const evidence = evidenceOf(delta) ?? [];
-  const path37 = targetPath(delta);
-  if (path37 === null)
+  const path38 = targetPath(delta);
+  if (path38 === null)
     return { ok: true };
-  if (isIndexFile(path37) && !isMemoryIndex(path37)) {
-    return { ok: false, flagged: { kind: "flagged", path: path37, tension: `refused: ${path37} is an index file (only memory/MEMORY.md is editable)`, evidence } };
+  if (isIndexFile(path38) && !isMemoryIndex(path38)) {
+    return { ok: false, flagged: { kind: "flagged", path: path38, tension: `refused: ${path38} is an index file (only memory/MEMORY.md is editable)`, evidence } };
   }
-  const target = await lookup(path37);
-  const isStructural = path37.startsWith("references/");
+  const target = await lookup(path38);
+  const isStructural = path38.startsWith("references/");
   const origin = target?.frontmatter.origin ?? (isStructural ? "operator" : "worker");
   const editable = origin === "worker" || origin === "dream";
   if (editable)
     return { ok: true };
   const removesOperatorTarget = delta.verb === "retract" || delta.verb === "supersede" && delta.oldPath !== delta.newPath;
   if (removesOperatorTarget) {
-    throw new BatchAbort(path37, `supersede/retract OLD target ${path37} is origin: ${origin} \u2014 aborting batch (never half-apply)`);
+    throw new BatchAbort(path38, `supersede/retract OLD target ${path38} is origin: ${origin} \u2014 aborting batch (never half-apply)`);
   }
-  return { ok: false, flagged: { kind: "flagged", path: path37, tension: `operator-origin (${origin}); flag-only`, evidence } };
+  return { ok: false, flagged: { kind: "flagged", path: path38, tension: `operator-origin (${origin}); flag-only`, evidence } };
 }
 var ALLOWED_MEMORY = /^memory\/.+\.md$/;
 var ALLOWED_INBOX = /^inbox\//;
 var ALLOWED_QUARANTINE = /^quarantine\//;
 var ALLOWED_FLAG = /^memory\//;
-var hasTraversal = (path37) => path37.split("/").includes("..");
+var hasTraversal = (path38) => path38.split("/").includes("..");
 function checkPathAllowed(delta) {
   const evidence = evidenceOf(delta) ?? [];
   const reject = (detail) => ({ ok: false, rejected: { kind: "rejected", detail, evidence } });
@@ -24372,7 +24372,7 @@ ${inject}
 ---
 ` + body.slice(m[0].length);
 }
-var indexLine = (path37, title, date, tags) => `- \`${path37}\` \u2014 **${title}**: ${title}. (${date} \xB7 ${tags.join(", ")})`;
+var indexLine = (path38, title, date, tags) => `- \`${path38}\` \u2014 **${title}**: ${title}. (${date} \xB7 ${tags.join(", ")})`;
 function splitIndex(index) {
   const all = index.split("\n");
   const firstLineIdx = all.findIndex((l) => l.startsWith("- `memory/"));
@@ -24545,16 +24545,16 @@ function defaultDreamSeams(opts = {}) {
       const mem = await memory(deps.brain);
       const harvested = harvestedIds(input);
       const ctx = { readFile: (p) => deps.brain.readFile(p), at: deps.clock() };
-      const lookup = (path37) => Promise.resolve(mem.files.find((f) => f.path === path37) ?? null);
+      const lookup = (path38) => Promise.resolve(mem.files.find((f) => f.path === path38) ?? null);
       const digest = [...pendingRejected];
       let changes = [];
       let indexEdit;
       try {
         for (const raw of deltas) {
           const delta = forcePolicyQuarantine(raw);
-          const path37 = checkPathAllowed(delta);
-          if (!path37.ok) {
-            digest.push(path37.rejected);
+          const path38 = checkPathAllowed(delta);
+          if (!path38.ok) {
+            digest.push(path38.rejected);
             continue;
           }
           const ev = checkEvidenceMembership(delta, harvested);
@@ -25668,13 +25668,13 @@ var EVENT_TIERS = {
 var EVENT_ENUM = Object.keys(EVENT_TIERS);
 
 // ../../packages/telemetry-contract/src/disclosure.ts
-var DISCLOSURE_TIER1 = "Operational data. To support your installation, m8t receives limited operational data linked to it \u2014 installation and update events, installed versions, and service health signals, along with the company name and contact email you provide. This is service data used only to operate and support the platform; it contains none of your content. Details: TELEMETRY.md.";
+var DISCLOSURE_TIER1 = "Operational data. To support your installation, m8t receives limited operational data linked to it \u2014 installation and update events, installed versions, and service health signals. Your installation is identified only by a random installation ID we generate at setup \u2014 an opaque value with no information encoded in it. No name, email, company, or subscription information is sent in the enrollment record unless you explicitly choose to share contact details for support. At enrollment, we also verify a cloud identity token to confirm the request comes from a real cloud account; that token names the account making the request, and is otherwise discarded immediately and never stored. This is service data used only to operate and support the platform; it contains none of your content. Details: TELEMETRY.md.";
 
 // ../../packages/telemetry-contract/src/endpoints.ts
 var INGEST_BASE_URL = (process.env.M8T_INGEST_BASE_URL ?? "").trim() || "https://m8t-admin.wonderfuldesert-721e332f.eastus2.azurecontainerapps.io";
-function ingestUrl(path37) {
+function ingestUrl(path38) {
   const base = INGEST_BASE_URL.replace(/\/+$/, "");
-  return `${base}${path37.startsWith("/") ? path37 : `/${path37}`}`;
+  return `${base}${path38.startsWith("/") ? path38 : `/${path38}`}`;
 }
 
 // src/commands/bootstrap/preflight.ts
@@ -25928,6 +25928,7 @@ function buildAciCreateArgs(s) {
   if (s.foundryTracing) env.push(`FOUNDRY_TRACING=${s.foundryTracing}`);
   if (s.updateChannelUrl) env.push(`M8T_UPDATE_CHANNEL_URL=${s.updateChannelUrl}`);
   if (s.enrollContactEmail) env.push(`M8T_ENROLL_CONTACT_EMAIL=${s.enrollContactEmail}`);
+  if (s.enrollCompany) env.push(`M8T_ENROLL_COMPANY=${s.enrollCompany}`);
   if (s.githubApp) {
     const g = s.githubApp;
     env.push(
@@ -26078,7 +26079,7 @@ async function writeBootstrapState(state, home = os13.homedir()) {
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.39";
+var DEFAULT_INSTALLER_TAG = "v0.1.41";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
@@ -26090,7 +26091,8 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       ["Launch in eastus2", "$0 bootstrap launch --location eastus2"],
       ["BYO app registration", "$0 bootstrap launch --location eastus2 --client-id <appId>"],
       ["Pin a specific installer tag", "$0 bootstrap launch --location eastus2 --installer-tag v0.1.33"],
-      ["Override the full installer image ref", "$0 bootstrap launch --location eastus2 --installer-image ghcr.io/m8t-labs/m8t-installer:v0.1.33"]
+      ["Override the full installer image ref", "$0 bootstrap launch --location eastus2 --installer-image ghcr.io/m8t-labs/m8t-installer:v0.1.33"],
+      ["Share a support contact", "$0 bootstrap launch --location eastus2 --contact-email you@example.com --company 'Acme'"]
     ]
   });
   location = Option47.String("--location");
@@ -26104,6 +26106,8 @@ var BootstrapLaunchCommand = class extends M8tCommand {
   installerImage = Option47.String("--installer-image");
   gatewayImageRef = Option47.String("--gateway-image-ref");
   githubAppCreds = Option47.String("--github-app-creds");
+  contactEmail = Option47.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  company = Option47.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
   async executeCommand() {
     const location = typeof this.location === "string" ? this.location : void 0;
     if (!location) {
@@ -26195,7 +26199,11 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       gatewayImageRef,
       foundryTracing: "skip",
       githubApp,
-      enrollContactEmail: account.upn,
+      // Opt-in only. The signed-in UPN was previously seeded here automatically;
+      // an installation is identified by its random instance id, and contact
+      // details are sent only when the operator asks for them.
+      ...typeof this.contactEmail === "string" ? { enrollContactEmail: this.contactEmail } : {},
+      ...typeof this.company === "string" ? { enrollCompany: this.company } : {},
       ...process.env.M8T_UPDATE_CHANNEL_URL ? { updateChannelUrl: process.env.M8T_UPDATE_CHANNEL_URL } : {}
     });
     this.context.stdout.write(
@@ -26256,7 +26264,7 @@ var BootstrapStatusCommand = class extends M8tCommand {
       typeof this.output === "string" ? this.output : void 0,
       this.context.stdout
     );
-    const sleep4 = (ms) => new Promise((r) => setTimeout(r, ms));
+    const sleep5 = (ms) => new Promise((r) => setTimeout(r, ms));
     const watch = this.watch === true;
     for (; ; ) {
       let doc;
@@ -26266,7 +26274,7 @@ var BootstrapStatusCommand = class extends M8tCommand {
         if (watch && e instanceof LocalCliError && e.code === "BOOTSTRAP_STATUS_UNREADABLE") {
           if (mode === "pretty") this.context.stderr.write(`  ${colors.dim("waiting for the installer to start\u2026")}
 `);
-          await sleep4(1e4);
+          await sleep5(1e4);
           continue;
         }
         throw e;
@@ -26291,7 +26299,7 @@ var BootstrapStatusCommand = class extends M8tCommand {
         );
         return 1;
       }
-      await sleep4(1e4);
+      await sleep5(1e4);
     }
   }
 };
@@ -27659,9 +27667,9 @@ async function serveOnboardingUiDetached(args) {
   child.unref();
   fs32.writeFileSync(pidPath, String(child.pid), "utf8");
   const deadline = Date.now() + 45e3;
-  const sleep4 = (ms) => new Promise((r) => setTimeout(r, ms));
+  const sleep5 = (ms) => new Promise((r) => setTimeout(r, ms));
   while (Date.now() < deadline) {
-    await sleep4(500);
+    await sleep5(500);
     if (await isPortOpen()) break;
   }
   return { alreadyRunning: false, logPath };
@@ -27719,9 +27727,9 @@ async function serveOnboardingRelayDetached(args) {
   child.unref();
   fs32.writeFileSync(pidPath, String(child.pid), "utf8");
   const deadline = Date.now() + 45e3;
-  const sleep4 = (ms) => new Promise((r) => setTimeout(r, ms));
+  const sleep5 = (ms) => new Promise((r) => setTimeout(r, ms));
   while (Date.now() < deadline) {
-    await sleep4(500);
+    await sleep5(500);
     if (await isLocalPortOpen(portNum)) break;
   }
   return { alreadyRunning: false, logPath };
@@ -27978,7 +27986,7 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
     const parsedTimeout = Number(rawTimeout);
     const timeoutMin = rawTimeout !== "" && Number.isFinite(parsedTimeout) ? parsedTimeout : 20;
     const deadline = Date.now() + timeoutMin * 6e4;
-    const sleep4 = (ms) => new Promise((r) => setTimeout(r, ms));
+    const sleep5 = (ms) => new Promise((r) => setTimeout(r, ms));
     for (; ; ) {
       const token = await getFoundryToken();
       const { hadIntake, block } = await findOnboardingProfile({ endpoint: ctx.endpoint, token });
@@ -28006,33 +28014,60 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
       }
       this.context.stderr.write(`  ${colors.dim("waiting for the questionnaire to complete\u2026")}
 `);
-      await sleep4(2e4);
+      await sleep5(2e4);
     }
   }
 };
 
 // src/commands/telemetry/enroll.ts
+import * as fs34 from "fs";
+import * as os19 from "os";
+import * as path37 from "path";
 import { Command as Command56, Option as Option53 } from "clipanion";
 init_errors();
 
 // src/lib/telemetry-enroll.ts
 init_errors();
+async function defaultToken() {
+  const out = await runAz([
+    "account",
+    "get-access-token",
+    "--resource",
+    "https://management.azure.com/",
+    "--query",
+    "accessToken",
+    "-o",
+    "tsv"
+  ]);
+  const token = out.trim();
+  return token.length > 0 ? token : null;
+}
+var sleep4 = (ms) => new Promise((r) => setTimeout(r, ms));
 async function enroll(args) {
   const f = args.fetchImpl ?? fetch;
   const url = args.baseUrl ? `${args.baseUrl.replace(/\/+$/, "")}/api/ingest/enroll` : ingestUrl("/api/ingest/enroll");
+  const retryDelayMs = args.retryDelayMs ?? 1e3;
+  const token = await (args.tokenImpl ?? defaultToken)().catch(() => null);
+  const payload = { schemaVersion: 1 };
+  const company = args.company?.trim();
+  if (company) payload.company = company;
+  const contactEmail = args.contactEmail?.trim();
+  if (contactEmail) payload.contactEmail = contactEmail;
+  payload.proof = token ? { type: "entra-jwt", token } : null;
+  const body = JSON.stringify(payload);
   let res;
-  try {
-    res = await f(url, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ schemaVersion: 1, company: args.company, contactEmail: args.contactEmail, subscriptionId: args.subscriptionId, proof: null })
-    });
-  } catch (e) {
-    throw new LocalCliError({ code: "TELEMETRY_ENROLL_UNREACHABLE", message: `Could not reach the telemetry ingest to enroll: ${e instanceof Error ? e.message : String(e)}` });
+  for (let attempt = 1; attempt <= 3; attempt++) {
+    try {
+      res = await f(url, { method: "POST", headers: { "content-type": "application/json" }, body });
+    } catch (e) {
+      throw new LocalCliError({ code: "TELEMETRY_ENROLL_UNREACHABLE", message: `Could not reach the telemetry ingest to enroll: ${e instanceof Error ? e.message : String(e)}` });
+    }
+    if (res.status !== 503 || attempt === 3) break;
+    await sleep4(retryDelayMs * attempt);
   }
-  if (!res.ok) {
-    const body = await res.text().catch(() => "");
-    throw new LocalCliError({ code: "TELEMETRY_ENROLL_FAILED", message: `Enroll failed (HTTP ${res.status.toString()}): ${body}` });
+  if (!res?.ok) {
+    const detail = res ? await res.text().catch(() => "") : "";
+    throw new LocalCliError({ code: "TELEMETRY_ENROLL_FAILED", message: `Enroll failed (HTTP ${res ? res.status.toString() : "?"}): ${detail}` });
   }
   const json = await res.json();
   if (!json.instanceId || !json.ingestKey) {
@@ -28072,19 +28107,22 @@ var TelemetryEnrollCommand = class extends M8tCommand {
   static paths = [["telemetry", "enroll"]];
   static usage = Command56.Usage({
     description: "Enroll this installation for operational telemetry (pre-existing installs).",
-    details: "Mints an instance id + ingest key from the m8t telemetry ingest and stores the key in your platform Key Vault, the same place the installer writes it on a fresh install. Idempotent: refuses if a key already exists unless --force.",
-    examples: [["Enroll", "$0 telemetry enroll"]]
+    details: "Generates an instance id + ingest key from the m8t telemetry ingest and stores the key in your platform Key Vault, the same place the installer writes it on a fresh install. Your installation is identified only by that random instance id \u2014 no contact, company, or subscription details are sent unless you pass them explicitly. Idempotent: refuses if a key already exists.",
+    examples: [
+      ["Enroll", "$0 telemetry enroll"],
+      ["Enroll and share a support contact", "$0 telemetry enroll --contact-email you@example.com --company 'Acme'"]
+    ]
   });
-  company = Option53.String("--company", { description: "Your company name (optional)." });
-  contactEmail = Option53.String("--contact-email", { description: "Contact email (default: your signed-in az UPN)." });
-  subscription = Option53.String("--subscription", { description: "Azure subscription id (default: your active az subscription)." });
+  company = Option53.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
+  contactEmail = Option53.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  subscription = Option53.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
   resourceGroup = Option53.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
-  force = Option53.Boolean("--force", false, { description: "Re-enroll even if a key is already stored (mints a new instance id)." });
+  force = Option53.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
   async executeCommand() {
     const account = await getAzAccount();
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
-    const contactEmail = (typeof this.contactEmail === "string" ? this.contactEmail : void 0) ?? account.upn;
-    const company = (typeof this.company === "string" ? this.company : void 0) ?? "";
+    const contactEmail = typeof this.contactEmail === "string" ? this.contactEmail : void 0;
+    const company = typeof this.company === "string" ? this.company : void 0;
     const d = await discoverGateway({
       subscriptionId,
       interactive: false,
@@ -28100,15 +28138,26 @@ var TelemetryEnrollCommand = class extends M8tCommand {
         existing = "";
       }
       if (existing.trim()) {
+        const wantedContact = contactEmail !== void 0 || company !== void 0;
         throw new LocalCliError({
           code: "TELEMETRY_ALREADY_ENROLLED",
-          message: "This installation is already enrolled.",
-          hint: "Pass --force to re-enroll (mints a new instance id)."
+          message: wantedContact ? "This installation is already enrolled, so contact details can't be attached from here." : "This installation is already enrolled.",
+          hint: "To add or change the contact details on your record, reach out through the channels in SUPPORT.md and we'll update it for you."
         });
       }
     }
-    const { instanceId, ingestKey } = await enroll({ company, contactEmail, subscriptionId });
-    await runAz(["keyvault", "secret", "set", "--vault-name", kvName, "--name", INGEST_KEY_SECRET, "--value", ingestKey, "--only-show-errors"]);
+    const { instanceId, ingestKey } = await enroll({
+      ...company ? { company } : {},
+      ...contactEmail ? { contactEmail } : {}
+    });
+    const keyDir = fs34.mkdtempSync(path37.join(os19.tmpdir(), "m8t-ingest-key-"));
+    const keyFile = path37.join(keyDir, "key");
+    try {
+      fs34.writeFileSync(keyFile, ingestKey, { mode: 384 });
+      await runAz(["keyvault", "secret", "set", "--vault-name", kvName, "--name", INGEST_KEY_SECRET, "--file", keyFile, "--only-show-errors"]);
+    } finally {
+      fs34.rmSync(keyDir, { recursive: true, force: true });
+    }
     this.context.stdout.write(
       `${colors.success("\u2713")} enrolled (instance ${instanceId}); ingest key stored in Key Vault ${kvName}. The gateway picks it up on its next cycle.
 `