@m8t-stack/cli 0.2.34 → 0.2.36

package/dist/cli.js

@@ -293,19 +293,9 @@ var init_secrets = __esm({
 });
 
 // ../../packages/github-app-auth/dist/esm/cache.js
-var cache_exports = {};
-__export(cache_exports, {
-  EXPIRY_SAFETY_MS: () => EXPIRY_SAFETY_MS,
-  _resetTokenCache: () => _resetTokenCache,
-  getCachedToken: () => getCachedToken,
-  putCachedToken: () => putCachedToken
-});
 function key(installationId, repository) {
   return `${installationId}:${repository}`;
 }
-function _resetTokenCache() {
-  cache2.clear();
-}
 function getCachedToken(installationId, repository) {
   const e = cache2.get(key(installationId, repository));
   if (!e)
@@ -384,17 +374,18 @@ var init_mint = __esm({
 });
 
 // ../../packages/github-app-auth/dist/esm/rotate.js
+function connectionStateKey(projectArmId, connectionName) {
+  return `${projectArmId}/connections/${connectionName}`;
+}
 async function rotateConnectionAuth(args) {
-  const { getCachedToken: getCachedToken2, putCachedToken: putCachedToken2 } = await Promise.resolve().then(() => (init_cache(), cache_exports));
-  const before = getCachedToken2(args.installationId, args.repository);
   const minted = await mintInstallationToken({
     credential: args.credential,
     kvUri: args.kvUri,
     installationId: args.installationId,
     repository: args.repository
   });
-  const cacheHit = before !== null && before.token === minted.token;
-  if (!cacheHit) {
+  const stateKey = connectionStateKey(args.projectArmId, args.connectionName);
+  if (connectionPatchState.get(stateKey) !== minted.token) {
     const armTokenResp = await args.credential.getToken(ARM_SCOPE);
     if (!armTokenResp?.token) {
       throw new Error("rotateConnectionAuth: failed to acquire ARM management token");
@@ -423,17 +414,18 @@ async function rotateConnectionAuth(args) {
       throw new Error(`rotateConnectionAuth: HTTP ${String(res.status)} on PATCH ${url}
 ${text.slice(0, 500)}`);
     }
-    putCachedToken2(args.installationId, args.repository, minted.token, minted.expiresAt);
+    connectionPatchState.set(stateKey, minted.token);
   }
   return { rotatedAt: /* @__PURE__ */ new Date(), expiresAt: minted.expiresAt };
 }
-var ARM_SCOPE, FOUNDRY_API;
+var ARM_SCOPE, FOUNDRY_API, connectionPatchState;
 var init_rotate = __esm({
   "../../packages/github-app-auth/dist/esm/rotate.js"() {
     "use strict";
     init_mint();
     ARM_SCOPE = "https://management.azure.com/.default";
     FOUNDRY_API = "2025-04-01-preview";
+    connectionPatchState = /* @__PURE__ */ new Map();
   }
 });
 
@@ -673,6 +665,53 @@ var init_foundry_agent_get = __esm({
   }
 });
 
+// src/lib/foundry-agent-version.ts
+async function createAgentVersion(args, fetchImpl = fetch) {
+  const token = await args.credential.getToken(FOUNDRY_DATA_SCOPE);
+  if (!token?.token) throw new LocalCliError({ code: "FOUNDRY_AUTH", message: "Could not acquire Foundry data-plane token" });
+  const url = `${args.projectEndpoint}/agents/${args.agentName}/versions?api-version=v1`;
+  const res = await fetchImpl(url, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token.token}`, "Content-Type": "application/json", ...args.extraHeaders ?? {} },
+    body: JSON.stringify({ definition: args.definition, metadata: args.metadata })
+  });
+  if (!res.ok) {
+    const text = await res.text();
+    throw new LocalCliError({ code: "AGENT_CREATE_VERSION_FAILED", message: `POST ${url}: HTTP ${res.status.toString()}
+${text.slice(0, 500)}` });
+  }
+  await ensureAgentEndpointEntraIsolation(
+    { credential: args.credential, projectEndpoint: args.projectEndpoint, agentName: args.agentName, extraHeaders: args.extraHeaders },
+    fetchImpl
+  );
+  const data = await res.json();
+  if (!data.version) throw new LocalCliError({ code: "AGENT_CREATE_VERSION_NO_VERSION", message: "createVersion returned no version" });
+  return data.version;
+}
+async function ensureAgentEndpointEntraIsolation(args, fetchImpl = fetch) {
+  const token = await args.credential.getToken(FOUNDRY_DATA_SCOPE);
+  if (!token?.token) throw new LocalCliError({ code: "FOUNDRY_AUTH", message: "Could not acquire Foundry data-plane token" });
+  const url = `${args.projectEndpoint}/agents/${args.agentName}?api-version=v1`;
+  const res = await fetchImpl(url, {
+    method: "PATCH",
+    headers: { Authorization: `Bearer ${token.token}`, "Content-Type": "application/json", ...args.extraHeaders ?? {} },
+    body: JSON.stringify({ agent_endpoint: { authorization_schemes: [{ type: "Entra", isolation_key_source: { kind: "Entra" } }] } })
+  });
+  if (!res.ok) {
+    const text = await res.text();
+    throw new LocalCliError({ code: "AGENT_ENDPOINT_AUTH_PATCH_FAILED", message: `PATCH ${url}: HTTP ${res.status.toString()}
+${text.slice(0, 500)}` });
+  }
+}
+var FOUNDRY_DATA_SCOPE;
+var init_foundry_agent_version = __esm({
+  "src/lib/foundry-agent-version.ts"() {
+    "use strict";
+    init_errors();
+    FOUNDRY_DATA_SCOPE = "https://ai.azure.com/.default";
+  }
+});
+
 // src/lib/brain-yaml-mirror.ts
 import { parse as parseYaml4 } from "yaml";
 function linkSection(args) {
@@ -841,6 +880,12 @@ async function createCoderVersion(args) {
     foundryFeatures: "HostedAgents=V1Preview",
     metadata
   });
+  await ensureAgentEndpointEntraIsolation({
+    credential: args.credential,
+    projectEndpoint: args.endpoint,
+    agentName: args.name,
+    extraHeaders: { "Foundry-Features": "HostedAgents=V1Preview" }
+  });
   const v = version.version;
   if (v === void 0) {
     throw new LocalCliError({
@@ -905,6 +950,11 @@ async function createPromptVersion(args) {
   if (args.metadata.personaVersion !== null) metadata.personaVersion = args.metadata.personaVersion;
   if (args.metadata.fillableFieldValues !== void 0) metadata.fillableFieldValues = args.metadata.fillableFieldValues;
   const version = await project.agents.createVersion(args.name, definition, { metadata });
+  await ensureAgentEndpointEntraIsolation({
+    credential: args.credential,
+    projectEndpoint: args.endpoint,
+    agentName: args.name
+  });
   const v = version.version;
   if (v === void 0) {
     throw new LocalCliError({
@@ -931,6 +981,7 @@ var init_foundry_agents = __esm({
     "use strict";
     init_http();
     init_errors();
+    init_foundry_agent_version();
     METADATA_SOURCE = "m8t";
     FOUNDRY_SCOPE2 = "https://ai.azure.com/.default";
     API = "v1";
@@ -1247,7 +1298,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.34";
+var CLI_VERSION = "0.2.36";
 
 // src/lib/render-error.ts
 init_errors();
@@ -1341,7 +1392,7 @@ var BACKEND_RULES = [
     reason: "no_adapter_registered",
     hint: (e) => {
       const channel = getDetailField(e, "channel") ?? "<channel>";
-      return `no adapter for channel '${channel}'. This is expected for F4 alone; the channel-specific adapter ships in a later feature.`;
+      return `no adapter for channel '${channel}'. The channel-specific adapter is not registered in this build.`;
     }
   },
   {
@@ -1444,6 +1495,7 @@ var BACKEND_RULES = [
 var LOCAL_RULES = {
   AGENT_CREATE_VERSION_FAILED: "Re-run with `--verbose` for the full response body.",
   AGENT_CREATE_VERSION_NO_VERSION: "Foundry returned 2xx but no version \u2014 likely an API regression. Re-try; if it persists, file an issue.",
+  AGENT_ENDPOINT_AUTH_PATCH_FAILED: "Re-run with `--verbose` for the full response body.",
   AGENT_GET_FAILED: "Re-run with `--verbose` for the full response body.",
   AGENT_NOT_FOUND: "Use `m8t brain create <name>` to create the worker first, OR run `m8t deploy <name>` to register an existing agent.",
   AGENT_REDEPLOY_FAILED: "Re-run with `--verbose` for the full response body.",
@@ -1452,6 +1504,14 @@ var LOCAL_RULES = {
   APP_HEALTH_FAILED: "Run `m8t brain check-app` for details, then re-run this command.",
   APP_UNINSTALL_FAILED: "GitHub App-uninstall DELETE failed. Re-run with `--keep-app-install` if you want to skip this step.",
   ARM_AUTH: "Run `az login` and retry.",
+  // BOOTSTRAP_OCCUPANCY_UNVERIFIED and BOOTSTRAP_REINSTALL_TARGET_MISMATCH are
+  // deliberately absent here: both are always thrown with an inline `hint`
+  // (see bootstrap-occupancy.ts / commands/bootstrap/launch.ts), and
+  // render-error.ts prefers that inline hint over this table — so a table
+  // entry for either code would be dead text that could drift from what
+  // actually prints. BOOTSTRAP_TARGET_OCCUPIED has no inline hint, so its
+  // entry below is the live one.
+  BOOTSTRAP_TARGET_OCCUPIED: "Pick an empty resource group with `--resource-group <new-rg>`, or run with both `--resource-group <rg>` and `--reinstall-into <rg>` (same group name) to install into the existing one anyway.",
   // m8t brain create: stageAsGitRepo step
   BRAIN_GIT_INIT_FAILED: "If git is not installed, install it. Otherwise re-run with --verbose.",
   BRAIN_NOT_LINKED: "The worker has no brain link. Use `m8t brain link` or `m8t brain create` first.",
@@ -11302,6 +11362,14 @@ function isUndiciDispatcherVersionMismatchError(error) {
   return false;
 }
 
+// ../../packages/foundry-invoke/dist/esm/openai-error.js
+function openAIErrorStatus(err) {
+  if (typeof err !== "object" || err === null)
+    return void 0;
+  const status = err.status;
+  return typeof status === "number" ? status : void 0;
+}
+
 // ../../packages/foundry-invoke/dist/esm/invoke-cli-core.js
 function isBrainConnPropagation(err) {
   const e = err;
@@ -11328,9 +11396,10 @@ function errText(err) {
   return `${e.code ?? ""} ${e.error?.code ?? ""} ${e.error?.message ?? ""} ${e.message ?? ""}`.trim();
 }
 function errStatus(err) {
+  const direct = openAIErrorStatus(err);
+  if (direct !== void 0)
+    return direct;
   const e = err;
-  if (typeof e.status === "number")
-    return e.status;
   if (typeof e.upstreamStatus === "number")
     return e.upstreamStatus;
   const m = /\b(4\d\d|5\d\d)\b/.exec(e.message ?? "");
@@ -11928,7 +11997,7 @@ var BindAddCommand = class extends M8tCommand {
   static paths = [["bind", "add"]];
   static usage = Command2.Usage({
     description: "Create a channel\u2192worker binding with bot token storage.",
-    details: "Stores the bot token in Key Vault and writes a Bindings table row. Returns the webhook URL the channel platform should call. F4-alone smoke fails with 'no_adapter_registered' until F6 (Telegram adapter) ships.",
+    details: "Stores the bot token in Key Vault and writes a Bindings table row. Returns the webhook URL the channel platform should call. Channels without a registered adapter (Slack, Teams) fail with 'no_adapter_registered'.",
     examples: [
       [
         "Add a Telegram binding for the cmo worker",
@@ -13897,30 +13966,7 @@ function hasA2aSnippet(instructions) {
 
 // src/lib/brain-link.ts
 init_foundry_agent_get();
-
-// src/lib/foundry-agent-version.ts
-init_errors();
-var FOUNDRY_DATA_SCOPE = "https://ai.azure.com/.default";
-async function createAgentVersion(args, fetchImpl = fetch) {
-  const token = await args.credential.getToken(FOUNDRY_DATA_SCOPE);
-  if (!token?.token) throw new LocalCliError({ code: "FOUNDRY_AUTH", message: "Could not acquire Foundry data-plane token" });
-  const url = `${args.projectEndpoint}/agents/${args.agentName}/versions?api-version=v1`;
-  const res = await fetchImpl(url, {
-    method: "POST",
-    headers: { Authorization: `Bearer ${token.token}`, "Content-Type": "application/json", ...args.extraHeaders ?? {} },
-    body: JSON.stringify({ definition: args.definition, metadata: args.metadata })
-  });
-  if (!res.ok) {
-    const text = await res.text();
-    throw new LocalCliError({ code: "AGENT_CREATE_VERSION_FAILED", message: `POST ${url}: HTTP ${res.status.toString()}
-${text.slice(0, 500)}` });
-  }
-  const data = await res.json();
-  if (!data.version) throw new LocalCliError({ code: "AGENT_CREATE_VERSION_NO_VERSION", message: "createVersion returned no version" });
-  return data.version;
-}
-
-// src/lib/brain-link.ts
+init_foundry_agent_version();
 init_brain_yaml_mirror();
 var FOUNDRY_ARM_API = "2025-04-01-preview";
 var ARM_SCOPE4 = "https://management.azure.com/.default";
@@ -14111,7 +14157,7 @@ ${text.slice(0, 300)}`
       target: MCP_SERVER_URL,
       isSharedToAll: false,
       credentials: { keys: { Authorization: "Bearer placeholder-will-be-rotated" } },
-      metadata: { managedBy: "m8t-brain-f02" }
+      metadata: { managedBy: "m8t-brain-link" }
     }
   });
   const putRes = await fetch(url, {
@@ -14947,7 +14993,7 @@ var BrainLinkCommand = class extends M8tCommand {
   static paths = [["brain", "link"]];
   static usage = Command19.Usage({
     description: "Link a worker to an existing brain repo. Idempotent.",
-    details: "Installs the GitHub App on <repo> (browser click + poll), mints an installation token + PATCHes the Foundry connection, deploys a new agent version with the brain loader + tools[type:mcp] + metadata.brain JSON string, and pushes .m8t/brain.yaml to the repo. F1's PAT mode keeps working untouched. --force re-runs the full link cascade (loader re-render + createVersion + brain.yaml mirror) even when metadata.brain already matches \u2014 the F1 rescue path.",
+    details: "Installs the GitHub App on <repo> (browser click + poll), mints an installation token + PATCHes the Foundry connection, deploys a new agent version with the brain loader + tools[type:mcp] + metadata.brain JSON string, and pushes .m8t/brain.yaml to the repo. PAT mode keeps working untouched. --force re-runs the full link cascade (loader re-render + createVersion + brain.yaml mirror) even when metadata.brain already matches \u2014 useful to rescue a stuck or stale link.",
     examples: [
       ["Link cmo to orkeren21/cmo-brain", "$0 brain link cmo --repo orkeren21/cmo-brain"],
       ["Force a re-link (re-render brain loader + new agent version, even if already linked)", "$0 brain link cmo --repo orkeren21/cmo-brain --force"]
@@ -15222,8 +15268,8 @@ import * as fs12 from "fs";
 import * as os5 from "os";
 import * as path11 from "path";
 init_foundry_agent_get();
+init_foundry_agent_version();
 var FOUNDRY_ARM_API2 = "2025-04-01-preview";
-var FOUNDRY_DATA_SCOPE2 = "https://ai.azure.com/.default";
 var ARM_SCOPE5 = "https://management.azure.com/.default";
 var GITHUB_APP_API = "https://api.github.com";
 async function unlinkBrain(args) {
@@ -15309,10 +15355,6 @@ function parseBrainMeta(raw) {
   }
 }
 async function createBrainStrippedVersion(args) {
-  const fndToken = await args.credential.getToken(FOUNDRY_DATA_SCOPE2);
-  if (!fndToken?.token) {
-    throw new LocalCliError({ code: "FOUNDRY_AUTH", message: "Could not acquire Foundry data-plane token" });
-  }
   const otherTools = (args.currentDefinition.tools ?? []).filter(
     (t) => !(t.type === "mcp" && t.server_label === "brain")
   );
@@ -15325,28 +15367,13 @@ async function createBrainStrippedVersion(args) {
     ...args.currentMetadata,
     brain: ""
   };
-  const url = `${args.projectEndpoint}/agents/${args.agentName}/versions?api-version=v1`;
-  const res = await fetch(url, {
-    method: "POST",
-    headers: { Authorization: `Bearer ${fndToken.token}`, "Content-Type": "application/json" },
-    body: JSON.stringify({ definition, metadata })
+  return createAgentVersion({
+    credential: args.credential,
+    projectEndpoint: args.projectEndpoint,
+    agentName: args.agentName,
+    definition,
+    metadata
   });
-  if (!res.ok) {
-    const text = await res.text();
-    throw new LocalCliError({
-      code: "AGENT_CREATE_VERSION_FAILED",
-      message: `POST ${url}: HTTP ${res.status.toString()}
-${text.slice(0, 500)}`
-    });
-  }
-  const data = await res.json();
-  if (!data.version) {
-    throw new LocalCliError({
-      code: "AGENT_REDEPLOY_NO_VERSION",
-      message: "createVersion returned no version"
-    });
-  }
-  return data.version;
 }
 async function deleteConnection(args) {
   const armToken = await args.credential.getToken(ARM_SCOPE5);
@@ -15687,6 +15714,7 @@ import { spawnSync as spawnSync2 } from "child_process";
 // src/lib/a2a-enable.ts
 init_errors();
 init_foundry_agent_get();
+init_foundry_agent_version();
 import { randomBytes as randomBytes2, createHash } from "crypto";
 
 // src/lib/data-plane-ready.ts
@@ -18399,6 +18427,7 @@ async function runBicepDeployment(opts) {
 
 // src/lib/platform-converge.ts
 init_foundry_agent_get();
+init_foundry_agent_version();
 init_errors();
 
 // src/lib/persona-compose.ts
@@ -20049,7 +20078,7 @@ var PlatformConvergeCommand = class extends M8tCommand {
   static usage = Command33.Usage({
     category: "Platform",
     description: "Headless updater-job driver: claim a pending apply-request and converge the platform to it.",
-    details: "The Managed-Identity-authenticated entry point run by the updater Container Apps job. One invocation is one tick: it claims the pending apply-request row (if any), refuses a downgrade against the installed stamp, self-fetches and validates the target manifest, self-updates its own engine image when the manifest requires a newer CLI, then drives the F02 converge engine behind the T15 health-gate + auto-rollback. Reads its subscription/RG/endpoint/channel from env (MI_CLIENT_ID, SUBSCRIPTION_ID, RESOURCE_GROUP, FOUNDRY_ENDPOINT, M8T_UPDATE_CHANNEL_URL). Not intended for interactive use \u2014 the founder-facing path is 'm8t platform update'."
+    details: "The Managed-Identity-authenticated entry point run by the updater Container Apps job. One invocation is one tick: it claims the pending apply-request row (if any), refuses a downgrade against the installed stamp, self-fetches and validates the target manifest, self-updates its own engine image when the manifest requires a newer CLI, then drives the converge engine behind the health-gate + auto-rollback. Reads its subscription/RG/endpoint/channel from env (MI_CLIENT_ID, SUBSCRIPTION_ID, RESOURCE_GROUP, FOUNDRY_ENDPOINT, M8T_UPDATE_CHANNEL_URL). Not intended for interactive use \u2014 the founder-facing path is 'm8t platform update'."
   });
   async executeCommand() {
     const ctx = resolveHeadlessContextFromEnv(process.env);
@@ -21335,7 +21364,7 @@ function parseVerdict(stdout) {
 var EvalSkillCommand = class extends M8tCommand {
   static paths = [["eval", "skill"]];
   static usage = Command38.Usage({
-    description: "Vet one inbox skill candidate (Brain Faculties Eval F1): promote / reject / needs_review. Shells out to the Python `brain-eval` core (override its path with $BRAIN_EVAL_BIN)."
+    description: "Vet one inbox skill candidate: promote / reject / needs_review. Shells out to the Python `brain-eval` core (override its path with $BRAIN_EVAL_BIN)."
   });
   candidate = Option35.String();
   skillsDir = Option35.String("--skills-dir");
@@ -21423,7 +21452,7 @@ function parseArmToken(tok, opts) {
     if (!opts.allowStub) {
       throw new LocalCliError({
         code: "USAGE",
-        message: `imported: arms are stub-only in F2 (a one-file placeholder) \u2014 pass --allow-stub to run one anyway, or use live/off/pinned for a real scored run (got '${tok}')`
+        message: `imported arms are stub-only (a one-file placeholder) \u2014 pass --allow-stub to run one anyway, or use live/off/pinned for a real scored run (got '${tok}')`
       });
     }
     return { state: { imported: ref }, profile };
@@ -21531,7 +21560,7 @@ function resolveJudgeDeployment(flag, env) {
   if (typeof fromEnv === "string" && fromEnv.length > 0) return { deployment: fromEnv };
   return {
     deployment: "gpt-5-mini",
-    warning: "no --deployment and no $EXAM_JUDGE_DEPLOYMENT \u2014 falling back to gpt-5-mini as the judge. Name the DISTINCT judge deployment before any blessing/calibration run (DESIGN \xA75.5)."
+    warning: "no --deployment and no $EXAM_JUDGE_DEPLOYMENT \u2014 falling back to gpt-5-mini as the judge. Name the DISTINCT judge deployment before any blessing/calibration run."
   };
 }
 var BRAIN_REPO_MARKERS = ["m8t-labs/", "/azure-advisor-brain", "/stacey-brain", "exam-arm-"];
@@ -21539,7 +21568,7 @@ function assertOutNotInBrainRepo(out) {
   if (BRAIN_REPO_MARKERS.some((m) => out.includes(m))) {
     throw new LocalCliError({
       code: "USAGE",
-      message: `--out '${out}' is under a brain repo \u2014 reports MUST live in the referee home (Law-1 guard, DESIGN \xA77.6)`
+      message: `--out '${out}' is under a brain repo \u2014 reports MUST live in the referee home (Law-1 guard)`
     });
   }
 }
@@ -21631,7 +21660,7 @@ function buildPlan(args) {
 var EvalExamCommand = class extends M8tCommand {
   static paths = [["eval", "exam"]];
   static usage = Command39.Usage({
-    description: "Run a brain exam (Brain Referee E2-F2): impact A/B + dream-delta. Resolves the plan, then shells out to the Python `brain-exam` orchestrator (override its path with $BRAIN_EXAM_BIN). Renders an ExamVerdict: three-valued verdict + power note + per-task flips."
+    description: "Run a brain exam: impact A/B + dream-delta. Resolves the plan, then shells out to the Python `brain-exam` orchestrator (override its path with $BRAIN_EXAM_BIN). Renders an ExamVerdict: three-valued verdict + power note + per-task flips."
   });
   worker = Option36.String();
   arms = Option36.String("--arms");
@@ -21704,7 +21733,7 @@ var EvalExamCommand = class extends M8tCommand {
       this.context.stdout.write(renderJson(plan) + "\n");
       this.context.stdout.write(
         `
-(dry-run) ~${String(arms.length)} arms x n=${String(reps)}; judge grading fan-out is the cost driver \u2014 confirm the run sits inside the ~150-550 judge-call band before driving workers (DESIGN \xA710).
+(dry-run) ~${String(arms.length)} arms x n=${String(reps)}; judge grading fan-out is the cost driver \u2014 confirm the run sits inside the ~150-550 judge-call band before driving workers.
 `
       );
       return 0;
@@ -24307,7 +24336,7 @@ function forcePolicyQuarantine(delta) {
     return {
       verb: "quarantine",
       slug: slugify(delta.title),
-      reason: "code-side standing-policy/auto-approval/privilege assertion (F16)",
+      reason: "code-side standing-policy/auto-approval/privilege assertion",
       body: delta.body,
       evidence: delta.evidence
     };
@@ -25668,7 +25697,7 @@ var EVENT_TIERS = {
 var EVENT_ENUM = Object.keys(EVENT_TIERS);
 
 // ../../packages/telemetry-contract/src/disclosure.ts
-var DISCLOSURE_TIER1 = "Operational data. To support your installation, m8t receives limited operational data linked to it \u2014 installation and update events, installed versions, and service health signals, along with the company name and contact email you provide. At enrollment, we also verify a cloud identity token to confirm the request comes from a real cloud account; the token is discarded immediately and never stored. This is service data used only to operate and support the platform; it contains none of your content. Details: TELEMETRY.md.";
+var DISCLOSURE_TIER1 = "Operational data. To support your installation, m8t receives limited operational data linked to it \u2014 installation and update events, installed versions, and service health signals. Your installation is identified only by a random installation ID we generate at setup \u2014 an opaque value with no information encoded in it. No name, email, company, or subscription information is sent in the enrollment record unless you explicitly choose to share contact details for support. At enrollment, we also verify a cloud identity token to confirm the request comes from a real cloud account; that token names the account making the request, and is otherwise discarded immediately and never stored. This is service data used only to operate and support the platform; it contains none of your content. Details: TELEMETRY.md.";
 
 // ../../packages/telemetry-contract/src/endpoints.ts
 var INGEST_BASE_URL = (process.env.M8T_INGEST_BASE_URL ?? "").trim() || "https://m8t-admin.wonderfuldesert-721e332f.eastus2.azurecontainerapps.io";
@@ -25680,6 +25709,17 @@ function ingestUrl(path38) {
 // src/commands/bootstrap/preflight.ts
 init_errors();
 
+// src/lib/spend-disclosure.ts
+var SPEND_DISCLOSURE = [
+  "You are about to install the m8t platform.",
+  "",
+  "  - It installs into YOUR Azure subscription and YOUR GitHub account or organization.",
+  "  - The Azure resources it creates bill to your Azure account - this uses your budget.",
+  "  - With your workers installed, you can ask Azzy what you're spending at any time,",
+  "    and you can turn on a cost report by email every two weeks.",
+  "  - You can remove it later - see guides/uninstall.md."
+].join("\n");
+
 // src/lib/bootstrap-preflight.ts
 var ADMIN_DIRECTORY_ROLES = ["Global Administrator", "Application Administrator", "Cloud Application Administrator"];
 async function checkSubScopeAdmin(callerObjectId, subscriptionId) {
@@ -25766,6 +25806,7 @@ var BootstrapPreflightCommand = class extends M8tCommand {
     const account = await getAzAccount();
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
     const oid = await getCallerObjectId();
+    this.context.stdout.write(SPEND_DISCLOSURE + "\n\n");
     this.context.stdout.write(buildPreflightBanner({ upn: account.upn, tenantId: account.tenantId, subscriptionId }) + "\n");
     this.context.stdout.write(`
 ${colors.dim(DISCLOSURE_TIER1)}
@@ -25928,6 +25969,7 @@ function buildAciCreateArgs(s) {
   if (s.foundryTracing) env.push(`FOUNDRY_TRACING=${s.foundryTracing}`);
   if (s.updateChannelUrl) env.push(`M8T_UPDATE_CHANNEL_URL=${s.updateChannelUrl}`);
   if (s.enrollContactEmail) env.push(`M8T_ENROLL_CONTACT_EMAIL=${s.enrollContactEmail}`);
+  if (s.enrollCompany) env.push(`M8T_ENROLL_COMPANY=${s.enrollCompany}`);
   if (s.githubApp) {
     const g = s.githubApp;
     env.push(
@@ -26075,10 +26117,95 @@ async function writeBootstrapState(state, home = os13.homedir()) {
   await fs29.rename(tmp, statePath(home));
 }
 
+// src/lib/bootstrap-occupancy.ts
+init_errors();
+var SAMPLE_LIMIT = 3;
+var M8T_NAME_RE = /^m8t/i;
+async function checkTargetRgOccupancy(opts) {
+  let existsRaw;
+  try {
+    existsRaw = await runAz([
+      "group",
+      "exists",
+      "--name",
+      opts.resourceGroup,
+      "--subscription",
+      opts.subscriptionId,
+      "-o",
+      "tsv"
+    ]);
+  } catch (cause) {
+    throw unverified(opts.resourceGroup, cause);
+  }
+  const exists2 = existsRaw.trim().toLowerCase();
+  if (exists2 === "false") return { state: "absent", found: [], total: 0, m8tShaped: false };
+  if (exists2 !== "true") {
+    throw unverified(opts.resourceGroup, new Error(`unexpected 'az group exists' output: ${exists2}`));
+  }
+  let names;
+  try {
+    const listRaw = await runAz([
+      "resource",
+      "list",
+      "--resource-group",
+      opts.resourceGroup,
+      "--subscription",
+      opts.subscriptionId,
+      "--query",
+      "[].name",
+      "-o",
+      "json"
+    ]);
+    names = JSON.parse(listRaw);
+  } catch (cause) {
+    throw unverified(opts.resourceGroup, cause);
+  }
+  if (!Array.isArray(names)) {
+    throw unverified(opts.resourceGroup, new Error("resource listing was not an array"));
+  }
+  if (names.length === 0) return { state: "empty", found: [], total: 0, m8tShaped: false };
+  return {
+    state: "occupied",
+    found: names.slice(0, SAMPLE_LIMIT),
+    total: names.length,
+    // Computed BEFORE the cap: an m8t-named resource sorting past the sample
+    // must still escalate the wording.
+    m8tShaped: names.some((n) => M8T_NAME_RE.test(n))
+  };
+}
+function unverified(resourceGroup, cause) {
+  return new LocalCliError({
+    code: "BOOTSTRAP_OCCUPANCY_UNVERIFIED",
+    message: `Could not verify whether resource group '${resourceGroup}' is empty.`,
+    hint: "Check your connection and 'az login', then retry.",
+    cause
+  });
+}
+function buildOccupiedRefusal(args) {
+  const { resourceGroup: rg, subscriptionId, location, occupancy: o } = args;
+  const hidden = o.total - o.found.length;
+  const more = hidden > 0 ? ` (+${String(hidden)} more)` : "";
+  const risk = o.m8tShaped ? "Installing into a non-empty resource group risks overwriting what's already there.\n  This looks like an existing m8t deployment; installing here would overwrite its identity." : "Installing into a non-empty resource group risks overwriting what's already there.";
+  return [
+    "",
+    "\u26D4 CANNOT PROCEED",
+    `  Resource group '${rg}' in subscription ${subscriptionId} is not empty \u2014 it holds`,
+    `  ${String(o.total)} resources, including: ${o.found.join(", ")}${more}.`,
+    `  ${risk}`,
+    "  remedy: pick an empty resource group \u2014",
+    `          m8t bootstrap launch --location ${location} --resource-group <new-rg>`,
+    "          or, if you really mean to install into this one:",
+    `          m8t bootstrap launch --location ${location} --resource-group ${rg} --reinstall-into ${rg}`,
+    "  Nothing has been created.",
+    "",
+    ""
+  ].join("\n");
+}
+
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.40";
+var DEFAULT_INSTALLER_TAG = "v0.1.42";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
@@ -26090,7 +26217,8 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       ["Launch in eastus2", "$0 bootstrap launch --location eastus2"],
       ["BYO app registration", "$0 bootstrap launch --location eastus2 --client-id <appId>"],
       ["Pin a specific installer tag", "$0 bootstrap launch --location eastus2 --installer-tag v0.1.33"],
-      ["Override the full installer image ref", "$0 bootstrap launch --location eastus2 --installer-image ghcr.io/m8t-labs/m8t-installer:v0.1.33"]
+      ["Override the full installer image ref", "$0 bootstrap launch --location eastus2 --installer-image ghcr.io/m8t-labs/m8t-installer:v0.1.33"],
+      ["Share a support contact", "$0 bootstrap launch --location eastus2 --contact-email you@example.com --company 'Acme'"]
     ]
   });
   location = Option47.String("--location");
@@ -26104,12 +26232,20 @@ var BootstrapLaunchCommand = class extends M8tCommand {
   installerImage = Option47.String("--installer-image");
   gatewayImageRef = Option47.String("--gateway-image-ref");
   githubAppCreds = Option47.String("--github-app-creds");
+  contactEmail = Option47.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  company = Option47.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
+  // Value-carrying on purpose: a bare --force would be cargo-culted into
+  // runbooks and harness prompts and erode the protection, whereas a faithful
+  // paste can never accidentally carry the victim group's name. It AUTHORIZES
+  // the target; --resource-group is what CHOOSES it.
+  reinstallInto = Option47.String("--reinstall-into", { description: "Consent to installing into --resource-group even though it already holds resources. Must match the target group's name." });
   async executeCommand() {
     const location = typeof this.location === "string" ? this.location : void 0;
     if (!location) {
       throw new LocalCliError({ code: "USAGE", message: "--location is required.", hint: "Example: m8t bootstrap launch --location eastus2" });
     }
-    const resourceGroup = (typeof this.resourceGroup === "string" ? this.resourceGroup : void 0) ?? DEFAULT_RG;
+    const resourceGroupOpt = typeof this.resourceGroup === "string" ? this.resourceGroup : void 0;
+    const resourceGroup = resourceGroupOpt ?? DEFAULT_RG;
     const clientIdOpt = typeof this.clientId === "string" ? this.clientId : void 0;
     const installerTag = (typeof this.installerTag === "string" ? this.installerTag : void 0) ?? DEFAULT_INSTALLER_TAG;
     const installerImageOverride = typeof this.installerImage === "string" ? this.installerImage : void 0;
@@ -26119,6 +26255,28 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
     const out = (m) => this.context.stderr.write(`  ${colors.dim(m)}
 `);
+    const reinstallInto = typeof this.reinstallInto === "string" ? this.reinstallInto : void 0;
+    if (reinstallInto !== void 0 && reinstallInto.toLowerCase() !== resourceGroup.toLowerCase()) {
+      const targetExplanation = resourceGroupOpt === void 0 ? `you did not pass --resource-group, so the target is the default '${DEFAULT_RG}'` : `the target resource group is '${resourceGroup}'`;
+      throw new LocalCliError({
+        code: "BOOTSTRAP_REINSTALL_TARGET_MISMATCH",
+        message: `--reinstall-into '${reinstallInto}' does not match \u2014 ${targetExplanation}.`,
+        hint: `--reinstall-into authorizes the target; it does not choose it. Re-run with --resource-group ${reinstallInto} on its own first \u2014 the guard will show you what that group holds.`
+      });
+    }
+    const occupancy = await checkTargetRgOccupancy({ resourceGroup, subscriptionId });
+    if (occupancy.state === "occupied" && reinstallInto === void 0) {
+      this.context.stderr.write(buildOccupiedRefusal({ resourceGroup, subscriptionId, location, occupancy }));
+      throw new LocalCliError({
+        code: "BOOTSTRAP_TARGET_OCCUPIED",
+        message: `Resource group '${resourceGroup}' already holds ${String(occupancy.total)} resources.`
+      });
+    }
+    if (this.context.env.M8T_HALT_AFTER_OCCUPANCY === "1") {
+      this.context.stdout.write(`halt: occupancy check passed (${occupancy.state}) for ${resourceGroup}
+`);
+      return 0;
+    }
     const credsPath = typeof this.githubAppCreds === "string" ? this.githubAppCreds : path32.join(os14.homedir(), ".m8t", "github-app.json");
     let githubApp;
     if (fs30.existsSync(credsPath)) {
@@ -26195,7 +26353,11 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       gatewayImageRef,
       foundryTracing: "skip",
       githubApp,
-      enrollContactEmail: account.upn,
+      // Opt-in only. The signed-in UPN was previously seeded here automatically;
+      // an installation is identified by its random instance id, and contact
+      // details are sent only when the operator asks for them.
+      ...typeof this.contactEmail === "string" ? { enrollContactEmail: this.contactEmail } : {},
+      ...typeof this.company === "string" ? { enrollCompany: this.company } : {},
       ...process.env.M8T_UPDATE_CHANNEL_URL ? { updateChannelUrl: process.env.M8T_UPDATE_CHANNEL_URL } : {}
     });
     this.context.stdout.write(
@@ -28040,13 +28202,13 @@ async function enroll(args) {
   const url = args.baseUrl ? `${args.baseUrl.replace(/\/+$/, "")}/api/ingest/enroll` : ingestUrl("/api/ingest/enroll");
   const retryDelayMs = args.retryDelayMs ?? 1e3;
   const token = await (args.tokenImpl ?? defaultToken)().catch(() => null);
-  const body = JSON.stringify({
-    schemaVersion: 1,
-    company: args.company,
-    contactEmail: args.contactEmail,
-    subscriptionId: args.subscriptionId,
-    proof: token ? { type: "entra-jwt", token } : null
-  });
+  const payload = { schemaVersion: 1 };
+  const company = args.company?.trim();
+  if (company) payload.company = company;
+  const contactEmail = args.contactEmail?.trim();
+  if (contactEmail) payload.contactEmail = contactEmail;
+  payload.proof = token ? { type: "entra-jwt", token } : null;
+  const body = JSON.stringify(payload);
   let res;
   for (let attempt = 1; attempt <= 3; attempt++) {
     try {
@@ -28099,19 +28261,22 @@ var TelemetryEnrollCommand = class extends M8tCommand {
   static paths = [["telemetry", "enroll"]];
   static usage = Command56.Usage({
     description: "Enroll this installation for operational telemetry (pre-existing installs).",
-    details: "Mints an instance id + ingest key from the m8t telemetry ingest and stores the key in your platform Key Vault, the same place the installer writes it on a fresh install. Idempotent: refuses if a key already exists unless --force.",
-    examples: [["Enroll", "$0 telemetry enroll"]]
+    details: "Generates an instance id + ingest key from the m8t telemetry ingest and stores the key in your platform Key Vault, the same place the installer writes it on a fresh install. Your installation is identified only by that random instance id \u2014 no contact, company, or subscription details are sent unless you pass them explicitly. Idempotent: refuses if a key already exists.",
+    examples: [
+      ["Enroll", "$0 telemetry enroll"],
+      ["Enroll and share a support contact", "$0 telemetry enroll --contact-email you@example.com --company 'Acme'"]
+    ]
   });
-  company = Option53.String("--company", { description: "Your company name (optional)." });
-  contactEmail = Option53.String("--contact-email", { description: "Contact email (default: your signed-in az UPN)." });
-  subscription = Option53.String("--subscription", { description: "Azure subscription id (default: your active az subscription)." });
+  company = Option53.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
+  contactEmail = Option53.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  subscription = Option53.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
   resourceGroup = Option53.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
-  force = Option53.Boolean("--force", false, { description: "Re-enroll even if a key is already stored (mints a new instance id)." });
+  force = Option53.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
   async executeCommand() {
     const account = await getAzAccount();
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
-    const contactEmail = (typeof this.contactEmail === "string" ? this.contactEmail : void 0) ?? account.upn;
-    const company = (typeof this.company === "string" ? this.company : void 0) ?? "";
+    const contactEmail = typeof this.contactEmail === "string" ? this.contactEmail : void 0;
+    const company = typeof this.company === "string" ? this.company : void 0;
     const d = await discoverGateway({
       subscriptionId,
       interactive: false,
@@ -28127,14 +28292,18 @@ var TelemetryEnrollCommand = class extends M8tCommand {
         existing = "";
       }
       if (existing.trim()) {
+        const wantedContact = contactEmail !== void 0 || company !== void 0;
         throw new LocalCliError({
           code: "TELEMETRY_ALREADY_ENROLLED",
-          message: "This installation is already enrolled.",
-          hint: "Pass --force to re-enroll (mints a new instance id)."
+          message: wantedContact ? "This installation is already enrolled, so contact details can't be attached from here." : "This installation is already enrolled.",
+          hint: "To add or change the contact details on your record, reach out through the channels in SUPPORT.md and we'll update it for you."
         });
       }
     }
-    const { instanceId, ingestKey } = await enroll({ company, contactEmail, subscriptionId });
+    const { instanceId, ingestKey } = await enroll({
+      ...company ? { company } : {},
+      ...contactEmail ? { contactEmail } : {}
+    });
     const keyDir = fs34.mkdtempSync(path37.join(os19.tmpdir(), "m8t-ingest-key-"));
     const keyFile = path37.join(keyDir, "key");
     try {