@m8t-stack/cli 0.2.40 → 0.2.42

package/dist/cli.js

@@ -1298,7 +1298,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.40";
+var CLI_VERSION = "0.2.42";
 
 // src/lib/render-error.ts
 init_errors();
@@ -17955,6 +17955,21 @@ function entityToApplyRequest(e) {
   return JSON.parse(e.value);
 }
 
+// ../../packages/platform-release/dist/esm/update-policy.js
+var DEFAULT_POLICY_MODE = "auto-critical";
+var UPDATE_POLICY_PK = "system";
+var UPDATE_POLICY_RK = "update-policy";
+var MODES = ["notify-only", "auto-critical", "auto-all"];
+function isPolicyMode(x) {
+  return typeof x === "string" && MODES.includes(x);
+}
+function updatePolicyToEntity(p) {
+  return { partitionKey: UPDATE_POLICY_PK, rowKey: UPDATE_POLICY_RK, value: JSON.stringify(p) };
+}
+function entityToUpdatePolicy(e) {
+  return JSON.parse(e.value);
+}
+
 // ../../packages/platform-release/dist/esm/infra-params.js
 var INFRA_PARAMS_PK = "system";
 var INFRA_PARAMS_RK = "infra-params";
@@ -18236,25 +18251,31 @@ async function writeStamp(opts) {
     ...opts.onProgress ? { onProgress: opts.onProgress } : {}
   });
 }
-async function readStamp(opts) {
+async function readStampOutcome(opts) {
   const { tableEndpoint, accountResourceId, accountName } = await discoverStampStorage(opts);
   const aad = new TableClient2(tableEndpoint, TABLE, opts.credential);
   try {
     const row = await aad.getEntity(PK, RK);
-    return entityToStamp(row);
+    const stamp = entityToStamp(row);
+    return stamp ? { source: "explicit", stamp } : { source: "unreadable" };
   } catch (e) {
-    if (is404(e)) return null;
-    if (!is403(e)) return null;
+    if (is404(e)) return { source: "absent" };
+    if (!is403(e)) return { source: "unreadable" };
   }
   try {
     const shared = await makeSharedKeyClient({ tableEndpoint, accountResourceId, accountName });
-    if (!shared) return null;
+    if (!shared) return { source: "unreadable" };
     const row = await shared.getEntity(PK, RK);
-    return entityToStamp(row);
+    const stamp = entityToStamp(row);
+    return stamp ? { source: "explicit", stamp } : { source: "unreadable" };
   } catch {
-    return null;
+    return { source: "unreadable" };
   }
 }
+async function readStamp(opts) {
+  const result = await readStampOutcome(opts);
+  return result.source === "explicit" ? result.stamp : null;
+}
 
 // src/lib/platform-converge.ts
 import * as fs22 from "fs";
@@ -18278,6 +18299,16 @@ function parseFoundryTracingMode(v) {
   }
   return v;
 }
+function parseAssignSubscriptionRoles(v) {
+  if (v === void 0) return void 0;
+  if (v === "true") return true;
+  if (v === "false") return false;
+  throw new LocalCliError({
+    code: "DEPLOY_INVALID_ASSIGN_SUBSCRIPTION_ROLES",
+    message: `Invalid --assign-subscription-roles value: '${v}'.`,
+    hint: "Use one of: true, false."
+  });
+}
 function buildBicepParams(p) {
   const params = [
     `location=${p.location}`,
@@ -20462,8 +20493,215 @@ var PlatformSeedStampCommand = class extends M8tCommand {
   }
 };
 
-// src/commands/platform/enable-cost-report.ts
+// src/commands/platform/stamp-build.ts
 import { Command as Command35, Option as Option32 } from "clipanion";
+import { DefaultAzureCredential as DefaultAzureCredential19, ManagedIdentityCredential as ManagedIdentityCredential3 } from "@azure/identity";
+init_errors();
+
+// src/lib/platform-stamp-build.ts
+var BARE_SEMVER2 = /^\d+\.\d+\.\d+$/;
+function buildRunningBuildStamp(input) {
+  if (!BARE_SEMVER2.test(input.version)) {
+    throw new Error(
+      `platform version must be bare X.Y.Z, got "${input.version}" \u2014 a build tag cannot be represented as a version.`
+    );
+  }
+  return {
+    schemaVersion: 1,
+    platformVersion: platformTag(input.version),
+    previousPlatformVersion: input.previousPlatformVersion,
+    updatedAt: input.nowIso,
+    lastResult: "success",
+    cli: input.cliVersion,
+    origin: "cd",
+    components: {
+      gateway: { tag: input.gatewayTag, digest: input.gatewayDigest, state: "managed" },
+      codingAgent: { tag: "", digest: "", state: "external" },
+      azureExecutor: { tag: "", digest: "", state: "external" },
+      personas: input.personas,
+      infra: { treeSha: input.infraTreeSha },
+      ...input.brainSeeds ? { brainSeeds: input.brainSeeds } : {}
+    }
+  };
+}
+
+// src/commands/platform/stamp-build.ts
+var PlatformStampBuildCommand = class extends M8tCommand {
+  static paths = [["platform", "stamp-build"]];
+  static usage = Command35.Usage({
+    description: "Record the currently running build as this install's platform version.",
+    details: "For installs that are deployed continuously rather than from a published release. Unlike the install-time record, this overwrites on every run \u2014 the running build is the truth. Only components this writer deploys are reported; the rest are marked as managed elsewhere."
+  });
+  version = Option32.String("--version", { description: "The running build's own version, bare X.Y.Z." });
+  gatewayTag = Option32.String("--gateway-tag", { description: "The tag of the gateway image this build deployed." });
+  gatewayDigest = Option32.String("--gateway-digest", { description: "The digest of the gateway image this build deployed." });
+  subscription = Option32.String("--subscription");
+  resourceGroup = Option32.String("--resource-group");
+  miClientId = Option32.String("--mi-client-id", { description: "Authenticate as this user-assigned managed identity instead of the ambient credential." });
+  output = Option32.String("--output");
+  async executeCommand() {
+    const mode = resolveOutputMode(this.output, this.context.stdout);
+    const need = (v, flag) => {
+      if (typeof v !== "string" || v.trim().length === 0) {
+        throw new LocalCliError({ code: "PLATFORM_STAMP_BUILD_ARG_MISSING", message: `${flag} is required.` });
+      }
+      return v.trim();
+    };
+    const onProgress = (m) => {
+      this.context.stderr.write(`${m}
+`);
+    };
+    const credential2 = typeof this.miClientId === "string" && this.miClientId.trim().length > 0 ? new ManagedIdentityCredential3({ clientId: this.miClientId.trim() }) : new DefaultAzureCredential19();
+    const ctx = {
+      credential: credential2,
+      subscriptionId: need(this.subscription, "--subscription"),
+      resourceGroup: need(this.resourceGroup, "--resource-group")
+    };
+    const { accountName } = await discoverStampStorage(ctx);
+    const existing = await readStampOutcome(ctx);
+    if (existing.source === "unreadable") {
+      throw new LocalCliError({
+        code: "PLATFORM_STAMP_BUILD_PRIOR_UNREADABLE",
+        message: "Could not read the existing platform stamp; refusing to overwrite it blind.",
+        hint: "The running build is the truth about the CURRENT version, not about whether a previous one existed \u2014 retry once the prior record can be read."
+      });
+    }
+    const previousPlatformVersion = existing.source === "explicit" ? existing.stamp.platformVersion : null;
+    const priorComponents = existing.source === "explicit" ? existing.stamp.components : void 0;
+    const stamp = buildRunningBuildStamp({
+      version: need(this.version, "--version"),
+      gatewayTag: need(this.gatewayTag, "--gateway-tag"),
+      gatewayDigest: this.gatewayDigest ?? "",
+      previousPlatformVersion,
+      cliVersion: CLI_VERSION,
+      nowIso: (/* @__PURE__ */ new Date()).toISOString(),
+      personas: priorComponents?.personas ?? {},
+      infraTreeSha: priorComponents?.infra.treeSha ?? "",
+      ...priorComponents?.brainSeeds ? { brainSeeds: priorComponents.brainSeeds } : {}
+    });
+    await writeStamp({ ...ctx, stamp, onProgress });
+    const result = { platformVersion: stamp.platformVersion, previous: previousPlatformVersion, storageAccount: accountName };
+    this.context.stdout.write(
+      mode === "json" ? renderJson(result) + "\n" : `platform stamp: ${result.platformVersion} (previous ${result.previous ?? "none"}, storage ${result.storageAccount})
+`
+    );
+    return 0;
+  }
+};
+
+// src/commands/platform/policy.ts
+import { Command as Command36, Option as Option33 } from "clipanion";
+import { DefaultAzureCredential as DefaultAzureCredential20, ManagedIdentityCredential as ManagedIdentityCredential4 } from "@azure/identity";
+init_errors();
+
+// src/lib/platform-policy.ts
+import { TableClient as TableClient5 } from "@azure/data-tables";
+init_errors();
+function buildPolicy(mode, nowIso, updatedBy) {
+  if (!isPolicyMode(mode)) {
+    throw new LocalCliError({
+      code: "PLATFORM_POLICY_MODE_INVALID",
+      message: `Unrecognized update mode "${String(mode)}".`,
+      hint: "Use one of: notify-only, auto-critical, auto-all."
+    });
+  }
+  return { schemaVersion: 1, mode, updatedAt: nowIso, updatedBy };
+}
+async function writePolicy(opts) {
+  const entity = updatePolicyToEntity(opts.policy);
+  await upsertMetadataEntity({
+    credential: opts.credential,
+    subscriptionId: opts.subscriptionId,
+    resourceGroup: opts.resourceGroup,
+    entity,
+    label: "update policy",
+    errorCode: "PLATFORM_POLICY_NO_ACCESS",
+    retryHint: "The role assignment persists \u2014 retry in a few minutes.",
+    ...opts.onProgress ? { onProgress: opts.onProgress } : {}
+  });
+}
+async function readPolicy(opts) {
+  const discover = opts.discoverImpl ?? discoverStampStorage;
+  const makeAad = opts.aadClientImpl ?? ((endpoint, credential2) => new TableClient5(endpoint, TABLE, credential2));
+  const makeShared = opts.sharedClientImpl ?? makeSharedKeyClient;
+  const { tableEndpoint, accountResourceId, accountName } = await discover(opts);
+  const aad = makeAad(tableEndpoint, opts.credential);
+  try {
+    const row = await aad.getEntity(UPDATE_POLICY_PK, UPDATE_POLICY_RK);
+    return { source: "explicit", policy: entityToUpdatePolicy(row) };
+  } catch (e) {
+    if (is404(e)) return { source: "absent" };
+    if (!is403(e)) return { source: "unreadable" };
+  }
+  try {
+    const shared = await makeShared({ tableEndpoint, accountResourceId, accountName });
+    if (!shared) return { source: "unreadable" };
+    const row = await shared.getEntity(UPDATE_POLICY_PK, UPDATE_POLICY_RK);
+    return { source: "explicit", policy: entityToUpdatePolicy(row) };
+  } catch {
+    return { source: "unreadable" };
+  }
+}
+
+// src/commands/platform/policy.ts
+var PlatformPolicyCommand = class extends M8tCommand {
+  static paths = [["platform", "policy"]];
+  static usage = Command36.Usage({
+    description: "Show or set how this install handles available platform updates.",
+    details: "Modes: 'notify-only' shows updates but never applies them; 'auto-critical' (the default when unset) applies critical releases without asking; 'auto-all' applies every release. Use 'notify-only' where something else already controls what is deployed.",
+    examples: [["Show the current mode", "m8t platform policy"], ["Never apply automatically", "m8t platform policy --set notify-only"]]
+  });
+  set = Option33.String("--set", { description: "notify-only | auto-critical | auto-all" });
+  subscription = Option33.String("--subscription");
+  resourceGroup = Option33.String("--resource-group");
+  miClientId = Option33.String("--mi-client-id");
+  output = Option33.String("--output");
+  async executeCommand() {
+    const mode = resolveOutputMode(this.output, this.context.stdout);
+    const need = (v, flag) => {
+      if (typeof v !== "string" || v.trim().length === 0) {
+        throw new LocalCliError({ code: "PLATFORM_POLICY_ARG_MISSING", message: `${flag} is required.` });
+      }
+      return v.trim();
+    };
+    const onProgress = (m) => {
+      this.context.stderr.write(`${m}
+`);
+    };
+    const credential2 = typeof this.miClientId === "string" && this.miClientId.trim().length > 0 ? new ManagedIdentityCredential4({ clientId: this.miClientId.trim() }) : new DefaultAzureCredential20();
+    const ctx = {
+      credential: credential2,
+      subscriptionId: need(this.subscription, "--subscription"),
+      resourceGroup: need(this.resourceGroup, "--resource-group")
+    };
+    if (typeof this.set === "string" && this.set.length > 0) {
+      const policy = buildPolicy(this.set, (/* @__PURE__ */ new Date()).toISOString(), "cli");
+      await writePolicy({ ...ctx, policy, onProgress });
+      const result2 = { mode: policy.mode, updatedAt: policy.updatedAt };
+      this.context.stdout.write(mode === "json" ? renderJson(result2) + "\n" : `update policy: ${policy.mode}
+`);
+      return 0;
+    }
+    const current = await readPolicy(ctx);
+    if (current.source === "unreadable") {
+      const result2 = { outcome: "unreadable" };
+      this.context.stdout.write(
+        mode === "json" ? renderJson(result2) + "\n" : `update policy: could not be read \u2014 the current setting is unknown; do not assume it is on the default (${DEFAULT_POLICY_MODE}).
+`
+      );
+      return 0;
+    }
+    const result = current.source === "explicit" ? { mode: current.policy.mode, outcome: "explicit" } : { mode: DEFAULT_POLICY_MODE, outcome: "absent" };
+    this.context.stdout.write(
+      mode === "json" ? renderJson(result) + "\n" : `update policy: ${result.mode}${result.outcome === "absent" ? " (default \u2014 never set)" : ""}
+`
+    );
+    return 0;
+  }
+};
+
+// src/commands/platform/enable-cost-report.ts
+import { Command as Command37, Option as Option34 } from "clipanion";
 
 // src/lib/wire-gateway-acs.ts
 init_rbac();
@@ -20503,18 +20741,18 @@ async function wireGatewayForAcs(args) {
 init_errors();
 var PlatformEnableCostReportCommand = class extends M8tCommand {
   static paths = [["platform", "enable-cost-report"]];
-  static usage = Command35.Usage({
+  static usage = Command37.Usage({
     description: "Wire the deployed gateway to send the bi-weekly cost report via ACS Email.",
     details: "Discovers the live gateway Container App, grants its managed identity Contributor at the ACS resource scope (authorising the ACS Email send), and sets M8T_ACS_ENDPOINT / M8T_ACS_SENDER / M8T_ENABLE_COST_REPORTER=1 on the gateway. Idempotent \u2014 safely re-runnable. ACS is created during the executor deploy; pass its endpoint, sender, and resource id (from that deploy or 'az communication list')."
   });
-  subscription = Option32.String("--subscription");
-  resourceGroup = Option32.String("--resource-group", {
+  subscription = Option34.String("--subscription");
+  resourceGroup = Option34.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
-  acsEndpoint = Option32.String("--acs-endpoint", { required: true, description: "ACS data-plane endpoint, e.g. https://acs-<name>.communication.azure.com/" });
-  acsSender = Option32.String("--acs-sender", { required: true, description: "Managed-domain sender address, e.g. DoNotReply@<guid>.azurecomm.net" });
-  acsResourceId = Option32.String("--acs-resource-id", { required: true, description: "ARM resource id of the acs-<name> Communication Service \u2014 the role-grant scope." });
-  output = Option32.String("--output");
+  acsEndpoint = Option34.String("--acs-endpoint", { required: true, description: "ACS data-plane endpoint, e.g. https://acs-<name>.communication.azure.com/" });
+  acsSender = Option34.String("--acs-sender", { required: true, description: "Managed-domain sender address, e.g. DoNotReply@<guid>.azurecomm.net" });
+  acsResourceId = Option34.String("--acs-resource-id", { required: true, description: "ARM resource id of the acs-<name> Communication Service \u2014 the role-grant scope." });
+  output = Option34.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -20588,45 +20826,45 @@ var PlatformEnableCostReportCommand = class extends M8tCommand {
 };
 
 // src/commands/platform/enable-auto-update.ts
-import { Command as Command36, Option as Option33 } from "clipanion";
+import { Command as Command38, Option as Option35 } from "clipanion";
 import { confirm as confirm6 } from "@inquirer/prompts";
-import { DefaultAzureCredential as DefaultAzureCredential19 } from "@azure/identity";
+import { DefaultAzureCredential as DefaultAzureCredential21 } from "@azure/identity";
 init_errors();
 var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
   static paths = [["platform", "enable-auto-update"]];
-  static usage = Command36.Usage({
+  static usage = Command38.Usage({
     category: "Platform",
     description: "Retrofit the auto-updater (MI + cron job + role assignments) onto an existing install.",
     details: "For an install that predates the Platform Update Framework: recovers the deployment's resource-name suffix (from the stamped system/infra-params row, or by verified derivation from the live gateway), recovers the other bicep params from live state (WITHOUT changing the deployed gateway image), and re-runs deploy/main.bicep with provisionUpdater=true \u2014 which provisions the updater managed identity, the cron Container Apps Job, and every role assignment (Owner@RG + Foundry User@account + Storage Table + Storage Blob + AcrPull), all scoped to the resource group. On success, backfills system/infra-params so future converges never have to re-derive the suffix. Idempotent \u2014 safe to re-run."
   });
-  subscription = Option33.String("--subscription");
-  resourceGroup = Option33.String("--resource-group", {
+  subscription = Option35.String("--subscription");
+  resourceGroup = Option35.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
-  suffix = Option33.String("--suffix", {
+  suffix = Option35.String("--suffix", {
     description: "The existing deployment's resource-name suffix. Required when it cannot be recovered from system/infra-params or the live gateway."
   });
-  installerImage = Option33.String("--installer-image", {
+  installerImage = Option35.String("--installer-image", {
     required: true,
     description: "Updater CA-Job image ref (the converge engine at the current release). Required \u2014 an empty image would skip provisioning."
   });
-  updateCron = Option33.String("--update-cron", {
+  updateCron = Option35.String("--update-cron", {
     description: "Cron schedule for the updater job (bicep default applies when omitted)."
   });
-  channelUrl = Option33.String("--channel-url", {
+  channelUrl = Option35.String("--channel-url", {
     description: "Release-channel URL the updater job polls (bicep default applies when omitted)."
   });
-  location = Option33.String("--location", {
+  location = Option35.String("--location", {
     description: "Region for the updater identity + job. Defaults to the resource group's existing resources."
   });
-  foundryTracing = Option33.String("--foundry-tracing", {
+  foundryTracing = Option35.String("--foundry-tracing", {
     description: "project | account | skip. Pass the value the install was deployed with \u2014 omitting it lets the bicep default (project) switch tracing on."
   });
-  endpoint = Option33.String("--endpoint", {
+  endpoint = Option35.String("--endpoint", {
     description: "Foundry project endpoint URL. Disambiguates the project in a multi-project subscription."
   });
-  yes = Option33.Boolean("--yes", false);
-  output = Option33.String("--output");
+  yes = Option35.Boolean("--yes", false);
+  output = Option35.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -20645,7 +20883,7 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
       resourceGroup: this.resourceGroup
     });
     const { resourceGroup, name: gatewayName } = parseContainerAppResourceId(gw.containerAppResourceId);
-    const credential2 = new DefaultAzureCredential19();
+    const credential2 = new DefaultAzureCredential21();
     const account = await getAzAccount();
     const subscriptionId = this.subscription ?? account.subscriptionId;
     const explicitSuffix = typeof this.suffix === "string" && this.suffix.length > 0 ? this.suffix : void 0;
@@ -20763,7 +21001,7 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
 };
 
 // src/commands/deploy.ts
-import { Command as Command37, Option as Option34 } from "clipanion";
+import { Command as Command39, Option as Option36 } from "clipanion";
 
 // src/lib/app-reg.ts
 init_errors();
@@ -21038,6 +21276,51 @@ init_errors();
 
 // src/lib/whatif.ts
 import * as path27 from "path";
+
+// src/lib/identifier-patterns.ts
+var IDENTIFIER_PATTERNS = [
+  /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi,
+  // any GUID (tenant/client/subscription id)
+  /\bsha256:[0-9a-f]{8,}/gi,
+  // image digests
+  /\.azurecr\.io/gi,
+  // registry hosts
+  /\bsubscriptions\/[^\s'"]+/gi,
+  // ARM ids (subscription path)
+  /\bresourceGroups\/[^\s'"]+/gi
+];
+function scrubIdentifiers(text) {
+  let out = text;
+  for (const pattern of IDENTIFIER_PATTERNS) out = out.replace(pattern, "[redacted]");
+  return out;
+}
+
+// src/lib/whatif-redact.ts
+function redactForLog(r) {
+  const lines = [];
+  const section = (title, items) => {
+    if (items.length === 0) return;
+    lines.push(`${title} (${items.length.toString()}):`);
+    for (const c of items) {
+      const reason = c.reason ? `   [${c.reason}]` : "";
+      lines.push(`  \u2022 ${c.resourceType} ${c.resourceName} ${c.path}${reason}`);
+    }
+  };
+  section("Unexpected", r.unexpected);
+  section("Known pending", r.pending);
+  lines.push(`Noise suppressed: ${r.noise.length.toString()}`);
+  return lines.join("\n");
+}
+function redactForReport(r) {
+  return { unexpected: r.unexpected.length, pending: r.pending.length, noise: r.noise.length };
+}
+function redactWhatIfFailure(message) {
+  const commandLineFailure = /^'.*?' failed: ([\s\S]*)$/.exec(message);
+  const tail = commandLineFailure ? commandLineFailure[1] : message;
+  return `the underlying comparison command failed (command line withheld): ${scrubIdentifiers(tail)}`;
+}
+
+// src/lib/whatif.ts
 function deriveResourceType(resourceId) {
   if (resourceId.startsWith("[")) return "";
   const afterProviders = resourceId.split("/providers/")[1];
@@ -21069,6 +21352,10 @@ async function runWhatIf(opts) {
 var fmt = (c) => `  \u2022 ${c.resourceType} ${c.path}: ${JSON.stringify(c.before ?? null)} \u2192 ${JSON.stringify(c.after ?? null)}${c.reason ? `   [${c.reason}]` : ""}`;
 function reportWhatIf(r, opts) {
   const exitCode = r.unexpected.length === 0 ? 0 : 1;
+  if (opts.redact) {
+    const output = opts.json ? JSON.stringify({ summary: redactForReport(r), exitCode }, null, 2) : redactForLog(r);
+    return { output, exitCode };
+  }
   if (opts.json) {
     return { output: JSON.stringify({ summary: { noise: r.noise.length, pending: r.pending.length, unexpected: r.unexpected.length }, pending: r.pending, unexpected: r.unexpected, exitCode }, null, 2), exitCode };
   }
@@ -21088,6 +21375,16 @@ function reportWhatIf(r, opts) {
   }
   return { output: lines.join("\n"), exitCode };
 }
+var WHATIF_RUN_FAILED_EXIT_CODE = 3;
+function reportWhatIfFailure(err, opts) {
+  const raw = err instanceof Error ? err.message : String(err);
+  const message = opts.redact ? redactWhatIfFailure(raw) : raw;
+  const exitCode = WHATIF_RUN_FAILED_EXIT_CODE;
+  if (opts.json) {
+    return { output: JSON.stringify({ ranToCompletion: false, error: message, exitCode }, null, 2), exitCode };
+  }
+  return { output: `comparison did not run to completion \u2014 NOT a drift finding: ${message}`, exitCode };
+}
 
 // src/lib/whatif-noise.ts
 var KNOWN_PENDING = [
@@ -21100,10 +21397,29 @@ var KNOWN_NOISE = [
   { resourceType: "Microsoft.App/containerApps", pathPattern: /(^|\.)runningStatus$/, reason: "RP runtime status" },
   { resourceType: "Microsoft.App/managedEnvironments", pathPattern: /(^|\.)peerAuthentication$/, reason: "RP default" },
   { resourceType: "Microsoft.App/managedEnvironments", pathPattern: /(^|\.)peerTrafficConfiguration$/, reason: "RP default" },
+  // Connections can be account-scoped or project-scoped depending on the deployment's tracing mode.
+  // Rules below match both resource type variants to ensure consistent noise classification.
   { resourceType: "Microsoft.CognitiveServices/accounts/connections", pathPattern: /(^|\.)credentials$/, reason: "write-only credential \u2014 always re-shows" },
   { resourceType: "Microsoft.CognitiveServices/accounts/connections", pathPattern: /(^|\.)(group|isDefault|peRequirement|peStatus|useWorkspaceManagedIdentity)$/, reason: "RP connection metadata" },
+  { resourceType: "Microsoft.CognitiveServices/accounts/projects/connections", pathPattern: /(^|\.)credentials$/, reason: "write-only credential \u2014 always re-shows" },
+  { resourceType: "Microsoft.CognitiveServices/accounts/projects/connections", pathPattern: /(^|\.)(group|isDefault|peRequirement|peStatus|useWorkspaceManagedIdentity)$/, reason: "RP connection metadata" },
   { resourceType: "Microsoft.Insights/components", pathPattern: /(^|\.)(Flow_Type|Request_Source)$/, reason: "RP-stamped" },
-  { resourceType: "Microsoft.ServiceBus/namespaces/queues", pathPattern: /(^|\.)(autoDeleteOnIdle|duplicateDetectionHistoryTimeWindow|maxMessageSizeInKilobytes|maxSizeInMegabytes)$/, reason: "RP default the bicep doesn't declare" }
+  { resourceType: "Microsoft.ServiceBus/namespaces/queues", pathPattern: /(^|\.)(autoDeleteOnIdle|duplicateDetectionHistoryTimeWindow|maxMessageSizeInKilobytes|maxSizeInMegabytes)$/, reason: "RP default the bicep doesn't declare" },
+  // The template regenerates the relay's shared secret on every deployment unless the
+  // current value is passed through, so a comparison that omits it reports a fresh
+  // difference every run. Ownership of that parameter sits with the voice work, not
+  // here — this comparison neither reads it nor asserts on it.
+  //
+  // The indexed rule is deliberately end-anchored to `.value` ONLY: an unanchored
+  // pattern would also swallow `configuration.secrets[N].name`,
+  // `.keyVaultUrl`/vault reference, and `.identity` — a repointed vault reference or a
+  // swapped backing identity on ANY container app would then be invisible to the very
+  // check meant to catch it, not just the regenerated secret's own value.
+  //
+  // REMOVE THESE TWO RULES when the deployment path stops regenerating the value.
+  // Their presence is the marker that it still does.
+  { resourceType: "Microsoft.App/containerApps", pathPattern: /(^|\.)configuration\.secrets$/, reason: "shared relay secret is regenerated on every deployment \u2014 owned elsewhere" },
+  { resourceType: "Microsoft.App/containerApps", pathPattern: /(^|\.)configuration\.secrets\[\d+\]\.value$/, reason: "shared relay secret is regenerated on every deployment \u2014 owned elsewhere" }
 ];
 var shortName = (resourceId) => resourceId.startsWith("[") ? "(role assignment)" : resourceId.split("/").pop() ?? resourceId;
 function isArmExpression(v) {
@@ -21165,40 +21481,52 @@ function classifyWhatIf(changes) {
 var DEFAULT_IMAGE_REF = "ghcr.io/m8t-labs/m8t:latest";
 var DeployCommand = class extends M8tCommand {
   static paths = [["deploy"]];
-  static usage = Command37.Usage({
+  static usage = Command39.Usage({
     description: "Deploy (or update) the m8t gateway/webapp stack via Bicep.",
     details: "Ensures the Entra app reg (or pass --client-id to reuse an existing one \u2014 required if you can't create app regs), writes ~/.m8t/config.yaml, ensures the resource group, and runs deploy/main.bicep. The repo is located via ~/.m8t/repo-root."
   });
-  subscription = Option34.String("--subscription");
-  resourceGroup = Option34.String("--resource-group", "rg-m8t-stack");
-  location = Option34.String("--location", "eastus");
-  suffix = Option34.String("--suffix", "");
-  imageRef = Option34.String("--image-ref", DEFAULT_IMAGE_REF);
-  acrPullIdentity = Option34.String("--acrpull-identity");
-  acrResourceId = Option34.String("--acr-resource-id");
-  foundryEndpoint = Option34.String("--foundry-endpoint");
-  foundryResourceId = Option34.String("--foundry-resource-id");
-  foundryTracing = Option34.String("--foundry-tracing");
+  subscription = Option36.String("--subscription");
+  resourceGroup = Option36.String("--resource-group", "rg-m8t-stack");
+  location = Option36.String("--location", "eastus");
+  suffix = Option36.String("--suffix", "");
+  imageRef = Option36.String("--image-ref", DEFAULT_IMAGE_REF);
+  acrPullIdentity = Option36.String("--acrpull-identity");
+  acrResourceId = Option36.String("--acr-resource-id");
+  foundryEndpoint = Option36.String("--foundry-endpoint");
+  foundryResourceId = Option36.String("--foundry-resource-id");
+  foundryTracing = Option36.String("--foundry-tracing");
   // project | account | skip (bicep default: project)
-  clientId = Option34.String("--client-id");
-  whatIf = Option34.Boolean("--what-if", false);
-  output = Option34.String("--output");
+  clientId = Option36.String("--client-id");
+  whatIf = Option36.Boolean("--what-if", false);
+  // Only meaningful with --what-if. Routes the comparison through the
+  // value-free renderers (see ./lib/whatif-redact.js) instead of the default
+  // before/after renderer. Defaults false so a local, interactive run keeps
+  // showing values — that is the whole diagnostic point of --what-if.
+  // Automation that forwards this output anywhere non-private (a CI log, an
+  // issue) MUST pass --redact.
+  redact = Option36.Boolean("--redact", false);
+  output = Option36.String("--output");
+  // Subscription-scoped role assignments. Omitted ⇒ the template default (true).
+  // Pass false when deploying as a principal scoped to the resource group only:
+  // it cannot deploy at subscription scope, and those assignments persist
+  // idempotently from the initial deployment anyway.
+  assignSubscriptionRoles = Option36.String("--assign-subscription-roles");
   // Referee — all optional, undefined by default ⇒ the bicep defaults
   // apply (dormant: gatewayCpu=0.25, gatewayMemory=0.5Gi, every referee/exam var
   // empty). Only pass these when explicitly enabling the referee exam stack.
-  gatewayCpu = Option34.String("--gateway-cpu");
-  gatewayMemory = Option34.String("--gateway-memory");
-  refereeEnabled = Option34.String("--referee-enabled");
-  refereeBrainRepos = Option34.String("--referee-brain-repos");
-  refereeFeedRepo = Option34.String("--referee-feed-repo");
-  refereeInstallationId = Option34.String("--referee-installation-id");
-  refereeWebhookHmacKvUri = Option34.String("--referee-webhook-hmac-kv-uri");
-  examKvUri = Option34.String("--exam-kv-uri");
-  examLaWorkspaceId = Option34.String("--exam-la-workspace-id");
-  brainEvalDeployment = Option34.String("--brain-eval-deployment");
-  brainAppLogin = Option34.String("--brain-app-login");
-  refereeCheckpointDir = Option34.String("--referee-checkpoint-dir");
-  examApiBase = Option34.String("--exam-api-base");
+  gatewayCpu = Option36.String("--gateway-cpu");
+  gatewayMemory = Option36.String("--gateway-memory");
+  refereeEnabled = Option36.String("--referee-enabled");
+  refereeBrainRepos = Option36.String("--referee-brain-repos");
+  refereeFeedRepo = Option36.String("--referee-feed-repo");
+  refereeInstallationId = Option36.String("--referee-installation-id");
+  refereeWebhookHmacKvUri = Option36.String("--referee-webhook-hmac-kv-uri");
+  examKvUri = Option36.String("--exam-kv-uri");
+  examLaWorkspaceId = Option36.String("--exam-la-workspace-id");
+  brainEvalDeployment = Option36.String("--brain-eval-deployment");
+  brainAppLogin = Option36.String("--brain-app-login");
+  refereeCheckpointDir = Option36.String("--referee-checkpoint-dir");
+  examApiBase = Option36.String("--exam-api-base");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -21207,6 +21535,69 @@ var DeployCommand = class extends M8tCommand {
     const log = (msg) => {
       if (mode !== "json") this.context.stdout.write(msg + "\n");
     };
+    if (this.whatIf) {
+      try {
+        if (this.subscription) {
+          await runAz(["account", "set", "--subscription", this.subscription]);
+        }
+        const account2 = await getAzAccount();
+        const foundryEndpoint2 = this.foundryEndpoint ?? (await readFoundryConfig())?.projectEndpoint;
+        if (!foundryEndpoint2) {
+          throw new LocalCliError({
+            code: "DEPLOY_NO_FOUNDRY_ENDPOINT",
+            message: "No Foundry endpoint provided.",
+            hint: "Pass --foundry-endpoint <url> or set projectEndpoint in ~/.m8t/config.yaml (m8t config set / m8t switch)."
+          });
+        }
+        const clientId = this.clientId ?? (await readFoundryConfig())?.clientId;
+        if (!clientId) {
+          throw new LocalCliError({
+            code: "DEPLOY_WHATIF_NO_CLIENT",
+            message: "--what-if needs a client id but none was provided or configured.",
+            hint: "Pass --client-id <appId>, or run from a host with ~/.m8t/config.yaml."
+          });
+        }
+        const foundryResourceId2 = await resolveFoundryResourceId(foundryEndpoint2, this.foundryResourceId);
+        const repoRoot2 = await resolveRepoRoot2();
+        const acrPullIdentityResourceId2 = resolveAcrPullIdentity({ explicit: this.acrPullIdentity });
+        const acrResourceId2 = acrPullIdentityResourceId2 ? "" : await resolveAcrResourceId({ imageRef: this.imageRef, explicit: this.acrResourceId });
+        const params2 = buildBicepParams({
+          location: this.location,
+          suffix: this.suffix,
+          imageRef: this.imageRef,
+          tenantId: account2.tenantId,
+          clientId,
+          foundryResourceId: foundryResourceId2,
+          foundryProjectEndpoint: foundryEndpoint2,
+          acrPullIdentityResourceId: acrPullIdentityResourceId2,
+          acrResourceId: acrResourceId2,
+          foundryTracingMode: parseFoundryTracingMode(this.foundryTracing),
+          gatewayCpu: this.gatewayCpu,
+          gatewayMemory: this.gatewayMemory,
+          refereeEnabled: this.refereeEnabled,
+          refereeBrainRepos: this.refereeBrainRepos,
+          refereeFeedRepo: this.refereeFeedRepo,
+          refereeInstallationId: this.refereeInstallationId,
+          refereeWebhookHmacKvUri: this.refereeWebhookHmacKvUri,
+          examKvUri: this.examKvUri,
+          examLaWorkspaceId: this.examLaWorkspaceId,
+          brainEvalDeployment: this.brainEvalDeployment,
+          brainAppLogin: this.brainAppLogin,
+          refereeCheckpointDir: this.refereeCheckpointDir,
+          examApiBase: this.examApiBase,
+          ...parseAssignSubscriptionRoles(this.assignSubscriptionRoles) === void 0 ? {} : { assignSubscriptionRoles: parseAssignSubscriptionRoles(this.assignSubscriptionRoles) }
+        });
+        const changes = await runWhatIf({ resourceGroup: this.resourceGroup, repoRoot: repoRoot2, params: params2 });
+        const classified = classifyWhatIf(changes);
+        const { output, exitCode } = reportWhatIf(classified, { json: mode === "json", redact: this.redact });
+        this.context.stdout.write(output + "\n");
+        return exitCode;
+      } catch (e) {
+        const { output, exitCode } = reportWhatIfFailure(e, { json: mode === "json", redact: this.redact });
+        this.context.stdout.write(output + "\n");
+        return exitCode;
+      }
+    }
     if (this.subscription) {
       await runAz(["account", "set", "--subscription", this.subscription]);
     }
@@ -21219,50 +21610,6 @@ var DeployCommand = class extends M8tCommand {
         hint: "Pass --foundry-endpoint <url> or set projectEndpoint in ~/.m8t/config.yaml (m8t config set / m8t switch)."
       });
     }
-    if (this.whatIf) {
-      const clientId = this.clientId ?? (await readFoundryConfig())?.clientId;
-      if (!clientId) {
-        throw new LocalCliError({
-          code: "DEPLOY_WHATIF_NO_CLIENT",
-          message: "--what-if needs a client id but none was provided or configured.",
-          hint: "Pass --client-id <appId>, or run from a host with ~/.m8t/config.yaml."
-        });
-      }
-      const foundryResourceId2 = await resolveFoundryResourceId(foundryEndpoint, this.foundryResourceId);
-      const repoRoot2 = await resolveRepoRoot2();
-      const acrPullIdentityResourceId2 = resolveAcrPullIdentity({ explicit: this.acrPullIdentity });
-      const acrResourceId2 = acrPullIdentityResourceId2 ? "" : await resolveAcrResourceId({ imageRef: this.imageRef, explicit: this.acrResourceId });
-      const params2 = buildBicepParams({
-        location: this.location,
-        suffix: this.suffix,
-        imageRef: this.imageRef,
-        tenantId: account.tenantId,
-        clientId,
-        foundryResourceId: foundryResourceId2,
-        foundryProjectEndpoint: foundryEndpoint,
-        acrPullIdentityResourceId: acrPullIdentityResourceId2,
-        acrResourceId: acrResourceId2,
-        foundryTracingMode: parseFoundryTracingMode(this.foundryTracing),
-        gatewayCpu: this.gatewayCpu,
-        gatewayMemory: this.gatewayMemory,
-        refereeEnabled: this.refereeEnabled,
-        refereeBrainRepos: this.refereeBrainRepos,
-        refereeFeedRepo: this.refereeFeedRepo,
-        refereeInstallationId: this.refereeInstallationId,
-        refereeWebhookHmacKvUri: this.refereeWebhookHmacKvUri,
-        examKvUri: this.examKvUri,
-        examLaWorkspaceId: this.examLaWorkspaceId,
-        brainEvalDeployment: this.brainEvalDeployment,
-        brainAppLogin: this.brainAppLogin,
-        refereeCheckpointDir: this.refereeCheckpointDir,
-        examApiBase: this.examApiBase
-      });
-      const changes = await runWhatIf({ resourceGroup: this.resourceGroup, repoRoot: repoRoot2, params: params2 });
-      const classified = classifyWhatIf(changes);
-      const { output, exitCode } = reportWhatIf(classified, { json: mode === "json" });
-      this.context.stdout.write(output + "\n");
-      return exitCode;
-    }
     log(this.clientId ? `using existing app reg ${this.clientId}` : "ensuring Entra app reg\u2026");
     const app = await ensureAppReg({ tenantId: account.tenantId, clientId: this.clientId });
     if (app.appObjectId === null && this.clientId) {
@@ -21303,7 +21650,8 @@ var DeployCommand = class extends M8tCommand {
       brainEvalDeployment: this.brainEvalDeployment,
       brainAppLogin: this.brainAppLogin,
       refereeCheckpointDir: this.refereeCheckpointDir,
-      examApiBase: this.examApiBase
+      examApiBase: this.examApiBase,
+      ...parseAssignSubscriptionRoles(this.assignSubscriptionRoles) === void 0 ? {} : { assignSubscriptionRoles: parseAssignSubscriptionRoles(this.assignSubscriptionRoles) }
     });
     log("running Bicep deployment (~3-5 min)\u2026");
     const outputs = await runBicepDeployment({
@@ -21338,7 +21686,7 @@ var DeployCommand = class extends M8tCommand {
 
 // src/commands/eval/skill.ts
 import { spawnSync as spawnSync4 } from "child_process";
-import { Command as Command38, Option as Option35 } from "clipanion";
+import { Command as Command40, Option as Option37 } from "clipanion";
 init_errors();
 var DECISIONS = /* @__PURE__ */ new Set(["promote", "reject", "needs_review"]);
 var JUDGE_STATUSES = /* @__PURE__ */ new Set(["ok", "skipped", "unavailable"]);
@@ -21363,14 +21711,14 @@ function parseVerdict(stdout) {
 }
 var EvalSkillCommand = class extends M8tCommand {
   static paths = [["eval", "skill"]];
-  static usage = Command38.Usage({
+  static usage = Command40.Usage({
     description: "Vet one inbox skill candidate: promote / reject / needs_review. Shells out to the Python `brain-eval` core (override its path with $BRAIN_EVAL_BIN)."
   });
-  candidate = Option35.String();
-  skillsDir = Option35.String("--skills-dir");
-  noJudge = Option35.Boolean("--no-judge", false);
-  deployment = Option35.String("--deployment");
-  output = Option35.String("--output");
+  candidate = Option37.String();
+  skillsDir = Option37.String("--skills-dir");
+  noJudge = Option37.Boolean("--no-judge", false);
+  deployment = Option37.String("--deployment");
+  output = Option37.String("--output");
   executeCommand() {
     return Promise.resolve(this._runCommand());
   }
@@ -21429,7 +21777,7 @@ var EvalSkillCommand = class extends M8tCommand {
 import { spawnSync as spawnSync5 } from "child_process";
 import { writeFileSync as writeFileSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync18, existsSync as existsSync15, readdirSync as readdirSync2 } from "fs";
 import { join as join27 } from "path";
-import { Command as Command39, Option as Option36 } from "clipanion";
+import { Command as Command41, Option as Option38 } from "clipanion";
 init_errors();
 init_esm();
 function parseArmToken(tok, opts) {
@@ -21659,24 +22007,24 @@ function buildPlan(args) {
 }
 var EvalExamCommand = class extends M8tCommand {
   static paths = [["eval", "exam"]];
-  static usage = Command39.Usage({
+  static usage = Command41.Usage({
     description: "Run a brain exam: impact A/B + dream-delta. Resolves the plan, then shells out to the Python `brain-exam` orchestrator (override its path with $BRAIN_EXAM_BIN). Renders an ExamVerdict: three-valued verdict + power note + per-task flips."
   });
-  worker = Option36.String();
-  arms = Option36.String("--arms");
-  taskSet = Option36.String("--task-set");
-  examType = Option36.String("--exam-type");
-  skill = Option36.String("--skill");
-  reps = Option36.String("-n,--reps");
-  probes = Option36.String("--probes");
-  pool = Option36.String("--pool");
-  out = Option36.String("--out");
-  dryRun = Option36.Boolean("--dry-run", false);
-  keepArms = Option36.Boolean("--keep-arms", false);
-  allowStub = Option36.Boolean("--allow-stub", false);
-  deployment = Option36.String("--deployment");
-  output = Option36.String("--output");
-  observeWaitS = Option36.String("--observe-wait-s");
+  worker = Option38.String();
+  arms = Option38.String("--arms");
+  taskSet = Option38.String("--task-set");
+  examType = Option38.String("--exam-type");
+  skill = Option38.String("--skill");
+  reps = Option38.String("-n,--reps");
+  probes = Option38.String("--probes");
+  pool = Option38.String("--pool");
+  out = Option38.String("--out");
+  dryRun = Option38.Boolean("--dry-run", false);
+  keepArms = Option38.Boolean("--keep-arms", false);
+  allowStub = Option38.Boolean("--allow-stub", false);
+  deployment = Option38.String("--deployment");
+  output = Option38.String("--output");
+  observeWaitS = Option38.String("--observe-wait-s");
   async executeCommand() {
     await Promise.resolve();
     const worker = typeof this.worker === "string" ? this.worker : void 0;
@@ -21791,10 +22139,10 @@ var EvalExamCommand = class extends M8tCommand {
 };
 
 // src/commands/version.ts
-import { Command as Command40, Option as Option37 } from "clipanion";
+import { Command as Command42, Option as Option39 } from "clipanion";
 var VersionCommand = class extends M8tCommand {
   static paths = [["version"], ["--version"], ["-v"]];
-  static usage = Command40.Usage({
+  static usage = Command42.Usage({
     description: "Print the CLI version.",
     details: "Prints the m8t CLI version. With --verbose, also prints Node version and platform.",
     examples: [
@@ -21802,8 +22150,8 @@ var VersionCommand = class extends M8tCommand {
       ["Print as JSON", "$0 version --output json"]
     ]
   });
-  output = Option37.String("--output", { description: "pretty | json | auto (default)" });
-  verbose = Option37.Boolean("--verbose", false);
+  output = Option39.String("--output", { description: "pretty | json | auto (default)" });
+  verbose = Option39.Boolean("--verbose", false);
   executeCommand() {
     const mode = resolveOutputMode(
       this.output ?? "auto",
@@ -21834,18 +22182,18 @@ var VersionCommand = class extends M8tCommand {
 };
 
 // src/commands/whoami.ts
-import { Command as Command41, Option as Option38 } from "clipanion";
+import { Command as Command43, Option as Option40 } from "clipanion";
 var WhoamiCommand = class extends M8tCommand {
   static paths = [["whoami"]];
-  static usage = Command41.Usage({
+  static usage = Command43.Usage({
     description: "Show your identity + the gateway you'll talk to. Probes the backend."
   });
-  output = Option38.String("--output");
-  verbose = Option38.Boolean("--verbose", false);
-  subscription = Option38.String("--subscription", {
+  output = Option40.String("--output");
+  verbose = Option40.Boolean("--verbose", false);
+  subscription = Option40.String("--subscription", {
     description: "Azure subscription ID to discover gateway in (defaults to active az subscription)."
   });
-  resourceGroup = Option38.String("--resource-group", {
+  resourceGroup = Option40.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -21910,7 +22258,7 @@ var WhoamiCommand = class extends M8tCommand {
 };
 
 // src/commands/status.ts
-import { Command as Command42, Option as Option39 } from "clipanion";
+import { Command as Command44, Option as Option41 } from "clipanion";
 
 // src/lib/azd.ts
 init_errors();
@@ -21975,10 +22323,10 @@ async function resolveLocalContext() {
 // src/commands/status.ts
 var StatusCommand = class extends M8tCommand {
   static paths = [["status"]];
-  static usage = Command42.Usage({
+  static usage = Command44.Usage({
     description: "Show the local m8t context: identity, config.yaml, gateway cache, azd mode."
   });
-  output = Option39.String("--output");
+  output = Option41.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -22016,8 +22364,8 @@ var StatusCommand = class extends M8tCommand {
 };
 
 // src/commands/doctor.ts
-import { Command as Command43, Option as Option40 } from "clipanion";
-import { DefaultAzureCredential as DefaultAzureCredential20 } from "@azure/identity";
+import { Command as Command45, Option as Option42 } from "clipanion";
+import { DefaultAzureCredential as DefaultAzureCredential22 } from "@azure/identity";
 import * as fs26 from "fs";
 import * as os11 from "os";
 import * as path28 from "path";
@@ -22292,12 +22640,12 @@ function probeLegacyStateDir() {
 }
 var DoctorCommand = class extends M8tCommand {
   static paths = [["doctor"]];
-  static usage = Command43.Usage({
+  static usage = Command45.Usage({
     description: "Diagnose the local m8t setup: az login, config.yaml, gateway, Foundry data-plane."
   });
-  output = Option40.String("--output");
-  agent = Option40.String("--agent");
-  resourceGroup = Option40.String("--resource-group", {
+  output = Option42.String("--output");
+  agent = Option42.String("--agent");
+  resourceGroup = Option42.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -22371,7 +22719,7 @@ var DoctorCommand = class extends M8tCommand {
       if (typeof this.agent === "string" && this.agent) {
         checking(`delivery grant for ${this.agent}`);
         try {
-          const credential2 = new DefaultAzureCredential20();
+          const credential2 = new DefaultAzureCredential22();
           const cur = await getAgentVersion({
             credential: credential2,
             projectEndpoint: foundry.projectEndpoint,
@@ -22414,7 +22762,7 @@ var DoctorCommand = class extends M8tCommand {
 };
 
 // src/commands/switch.ts
-import { Command as Command44, Option as Option41 } from "clipanion";
+import { Command as Command46, Option as Option43 } from "clipanion";
 
 // src/lib/profiles.ts
 import * as fs27 from "fs/promises";
@@ -22554,14 +22902,14 @@ async function profileSwitch(name, asName) {
 init_errors();
 var SwitchCommand = class extends M8tCommand {
   static paths = [["switch"]];
-  static usage = Command44.Usage({
+  static usage = Command46.Usage({
     description: "Re-point local config at another deployment: --subscription <id|name> (discovery) or <profile>."
   });
-  profile = Option41.String({ required: false });
-  subscription = Option41.String("--subscription");
-  list = Option41.Boolean("--list", false);
-  as = Option41.String("--as");
-  output = Option41.String("--output");
+  profile = Option43.String({ required: false });
+  subscription = Option43.String("--subscription");
+  list = Option43.Boolean("--list", false);
+  as = Option43.String("--as");
+  output = Option43.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -22618,7 +22966,7 @@ var SwitchCommand = class extends M8tCommand {
 
 // src/commands/open.ts
 import { spawn as spawn5 } from "child_process";
-import { Command as Command45, Option as Option42 } from "clipanion";
+import { Command as Command47, Option as Option44 } from "clipanion";
 
 // src/lib/open-targets.ts
 init_errors();
@@ -22664,14 +23012,14 @@ function openUrl(url) {
 }
 var OpenCommand = class extends M8tCommand {
   static paths = [["open"]];
-  static usage = Command45.Usage({
+  static usage = Command47.Usage({
     description: "Open the deployed webapp (default), the Foundry portal, or the resource group.",
     details: "Targets: webapp (deployed app, default) | foundry (ai.azure.com) | portal (resource group in the Azure portal). Pass --print to emit the URL instead of launching a browser (also the default when stdout isn't a TTY)."
   });
-  target = Option42.String({ required: false });
-  print = Option42.Boolean("--print", false);
-  output = Option42.String("--output");
-  resourceGroup = Option42.String("--resource-group", {
+  target = Option44.String({ required: false });
+  print = Option44.Boolean("--print", false);
+  output = Option44.String("--output");
+  resourceGroup = Option44.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -22715,9 +23063,9 @@ var OpenCommand = class extends M8tCommand {
 };
 
 // src/commands/dream/run.ts
-import { Command as Command46, Option as Option43 } from "clipanion";
+import { Command as Command48, Option as Option45 } from "clipanion";
 import { AzureCliCredential } from "@azure/identity";
-import { TableClient as TableClient6 } from "@azure/data-tables";
+import { TableClient as TableClient7 } from "@azure/data-tables";
 import { AIProjectClient as AIProjectClient3 } from "@azure/ai-projects";
 import { LogsQueryClient as LogsQueryClient3, LogsQueryResultStatus as LogsQueryResultStatus3 } from "@azure/monitor-query";
 
@@ -23026,7 +23374,7 @@ var ConvFetchError = class extends Error {
 };
 
 // ../../packages/brain/engine/dist/esm/cursor.js
-import { TableClient as TableClient5 } from "@azure/data-tables";
+import { TableClient as TableClient6 } from "@azure/data-tables";
 
 // ../../packages/agent-ledger/dist/esm/row-key.js
 var MAX_MS = 864e13;
@@ -23166,7 +23514,7 @@ async function commitCursorAdvance(plan, cursor) {
 }
 var CURSOR_TABLE_NAME = "BrainDreamCursor";
 function makeTableCursor(credential2, tableEndpoint) {
-  const client = new TableClient5(tableEndpoint, CURSOR_TABLE_NAME, credential2);
+  const client = new TableClient6(tableEndpoint, CURSOR_TABLE_NAME, credential2);
   return new TableCursor(client);
 }
 function formatCursorPreview(cursor) {
@@ -24942,20 +25290,20 @@ function redactTranscripts(input) {
 }
 var DreamRunCommand = class extends M8tCommand {
   static paths = [["dream", "run"]];
-  static usage = Command46.Usage({
+  static usage = Command48.Usage({
     description: "Dry-run the brain consumption pipeline for one worker (no model call, no writes).",
     details: "Builds AzureCliCredential + resolves the Foundry project, ledger table, and Log Analytics workspace, runs the consumption pipeline, and prints the skip-ledger, the partition invariant, and harvest stats. Transcripts are metadata-only unless --show-transcripts is passed."
   });
-  worker = Option43.String("--worker", { description: "Worker (canonical name) to harvest. Required." });
-  dryRun = Option43.Boolean("--dry-run", false, { description: "Read-only harvest; no model call, no writes." });
-  since = Option43.String("--since", { description: "ISO-8601 start override (rejected if malformed or future)." });
-  reset = Option43.Boolean("--reset", false, { description: "Ignore the stored cursor; read from the beginning." });
-  showTranscripts = Option43.Boolean("--show-transcripts", false, {
+  worker = Option45.String("--worker", { description: "Worker (canonical name) to harvest. Required." });
+  dryRun = Option45.Boolean("--dry-run", false, { description: "Read-only harvest; no model call, no writes." });
+  since = Option45.String("--since", { description: "ISO-8601 start override (rejected if malformed or future)." });
+  reset = Option45.Boolean("--reset", false, { description: "Ignore the stored cursor; read from the beginning." });
+  showTranscripts = Option45.Boolean("--show-transcripts", false, {
     description: "Print transcript bodies (default: metadata only)."
   });
-  subscription = Option43.String("--subscription");
-  endpoint = Option43.String("--endpoint");
-  output = Option43.String("--output");
+  subscription = Option45.String("--subscription");
+  endpoint = Option45.String("--endpoint");
+  output = Option45.String("--output");
   // Resolution seam — overridden by tests; built lazily at runtime otherwise.
   deps;
   async executeCommand() {
@@ -25150,7 +25498,7 @@ AppDependencies
   };
 }
 function buildLiveSources(context, credential2) {
-  const ledgerClient = new TableClient6(context.ledgerTableEndpoint, LEDGER_TABLE_NAME, credential2);
+  const ledgerClient = new TableClient7(context.ledgerTableEndpoint, LEDGER_TABLE_NAME, credential2);
   const ledger = makeLedgerSource(
     async (pk, sinceTs) => fetchLedgerRows(
       { workers: [pk], source: "all", from: sinceTs, to: "9999-12-31T23:59:59.999Z" },
@@ -25303,7 +25651,7 @@ function defaultDeps(overrides) {
 }
 
 // src/commands/foundry/create.ts
-import { Command as Command47, Option as Option44 } from "clipanion";
+import { Command as Command49, Option as Option46 } from "clipanion";
 
 // src/lib/foundry-create.ts
 init_errors();
@@ -25541,7 +25889,7 @@ async function createFoundryProject(args) {
 init_errors();
 var FoundryCreateCommand = class extends M8tCommand {
   static paths = [["foundry", "create"]];
-  static usage = Command47.Usage({
+  static usage = Command49.Usage({
     description: "Create an AI Foundry (AIServices) account + project + model deployment from scratch.",
     details: "Non-interactive and idempotent. Creates the AIServices account (custom subdomain + project management), a project, and a model deployment (default gpt-4.1-mini @ capacity 50). Region must be hosted-agent-eligible. Emits the project endpoint as structured output. Re-run is a clean no-op (account/project skipped if present; deployment capacity converges UP, never down).",
     examples: [
@@ -25550,16 +25898,16 @@ var FoundryCreateCommand = class extends M8tCommand {
       ["Higher capacity for a reasoning model", "$0 foundry create --resource-group rg-m8t-stack --location eastus2 --model gpt-5-mini --capacity 250"]
     ]
   });
-  resourceGroup = Option44.String("--resource-group");
-  location = Option44.String("--location");
-  account = Option44.String("--account");
-  project = Option44.String("--project", "m8t");
-  model = Option44.String("--model", "gpt-4.1-mini");
-  modelVersion = Option44.String("--model-version", "2025-04-14");
-  capacity = Option44.String("--capacity", "50");
-  subscription = Option44.String("--subscription");
-  skipQuotaCheck = Option44.Boolean("--skip-quota-check", false);
-  output = Option44.String("--output");
+  resourceGroup = Option46.String("--resource-group");
+  location = Option46.String("--location");
+  account = Option46.String("--account");
+  project = Option46.String("--project", "m8t");
+  model = Option46.String("--model", "gpt-4.1-mini");
+  modelVersion = Option46.String("--model-version", "2025-04-14");
+  capacity = Option46.String("--capacity", "50");
+  subscription = Option46.String("--subscription");
+  skipQuotaCheck = Option46.Boolean("--skip-quota-check", false);
+  output = Option46.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -25631,22 +25979,22 @@ var FoundryCreateCommand = class extends M8tCommand {
 };
 
 // src/commands/foundry/await-ready.ts
-import { Command as Command48, Option as Option45 } from "clipanion";
+import { Command as Command50, Option as Option47 } from "clipanion";
 import { AzureCliCredential as AzureCliCredential2 } from "@azure/identity";
 init_errors();
 var FoundryAwaitReadyCommand = class extends M8tCommand {
   static paths = [["foundry", "await-ready"]];
-  static usage = Command48.Usage({
+  static usage = Command50.Usage({
     description: "Wait until a freshly-created Foundry project's data plane reliably serves it.",
     details: "Probes the project (GET /agents) until it returns 200 on a few consecutive tries, or fails clearly after a bounded budget. A newly-created account can serve intermittent 404 'Project not found' for minutes; run this after 'foundry create' and before deploying agents so the worker phase doesn't catch the unstable window.",
     examples: [["Wait for a project to be ready", "$0 foundry await-ready --endpoint https://acc.services.ai.azure.com/api/projects/m8t"]]
   });
-  endpoint = Option45.String("--endpoint");
-  consecutive = Option45.String("--consecutive", "3");
-  attempts = Option45.String("--attempts", "60");
-  interval = Option45.String("--interval", "5");
-  subscription = Option45.String("--subscription");
-  output = Option45.String("--output");
+  endpoint = Option47.String("--endpoint");
+  consecutive = Option47.String("--consecutive", "3");
+  attempts = Option47.String("--attempts", "60");
+  interval = Option47.String("--interval", "5");
+  subscription = Option47.String("--subscription");
+  output = Option47.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const endpoint = typeof this.endpoint === "string" ? this.endpoint : void 0;
@@ -25680,7 +26028,7 @@ var FoundryAwaitReadyCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/preflight.ts
-import { Command as Command49, Option as Option46 } from "clipanion";
+import { Command as Command51, Option as Option48 } from "clipanion";
 
 // ../../packages/telemetry-contract/artifact/tier-map.ts
 var EVENT_TIERS = {
@@ -25791,7 +26139,7 @@ function buildPreflightBanner(who) {
 // src/commands/bootstrap/preflight.ts
 var BootstrapPreflightCommand = class extends M8tCommand {
   static paths = [["bootstrap", "preflight"]];
-  static usage = Command49.Usage({
+  static usage = Command51.Usage({
     description: "Loudly verify you can install m8t (Owner/UAA + directory admin) and hard-stop if not.",
     details: "Step 1 of `m8t bootstrap`. Prints an unmissable admin-credentials notice, then checks: Owner or User Access Administrator at subscription scope (hard requirement), directory-admin capability to register the app (or pass --client-id), and registers Microsoft.ContainerInstance. Exits non-zero with the exact failing check + remedy.",
     examples: [
@@ -25799,8 +26147,8 @@ var BootstrapPreflightCommand = class extends M8tCommand {
       ["BYO app registration (directory guests)", "$0 bootstrap preflight --client-id <appId>"]
     ]
   });
-  clientId = Option46.String("--client-id");
-  subscription = Option46.String("--subscription");
+  clientId = Option48.String("--client-id");
+  subscription = Option48.String("--subscription");
   async executeCommand() {
     const clientId = typeof this.clientId === "string" ? this.clientId : void 0;
     const account = await getAzAccount();
@@ -25863,7 +26211,7 @@ ${colors.error("  " + why)}
 import * as fs30 from "fs";
 import * as os14 from "os";
 import * as path32 from "path";
-import { Command as Command50, Option as Option47 } from "clipanion";
+import { Command as Command52, Option as Option49 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-mi.ts
@@ -26210,7 +26558,7 @@ var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
   static paths = [["bootstrap", "launch"]];
-  static usage = Command50.Usage({
+  static usage = Command52.Usage({
     description: "Create + authorize the installer managed identity, then kick the cloud installer.",
     details: "Step 2 of `m8t bootstrap` (run after `preflight`). Ensures the resource group, creates the m8t app registration (or uses --client-id), creates a user-assigned managed identity granted Owner at subscription scope, and launches the published m8t-installer image as an ACI run-to-completion job under that identity. Writes ~/.m8t/bootstrap.json for `status`/`reap`/`finish`.",
     examples: [
@@ -26221,24 +26569,24 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       ["Share a support contact", "$0 bootstrap launch --location eastus2 --contact-email you@example.com --company 'Acme'"]
     ]
   });
-  location = Option47.String("--location");
-  resourceGroup = Option47.String("--resource-group");
-  clientId = Option47.String("--client-id");
-  subscription = Option47.String("--subscription");
-  installerTag = Option47.String("--installer-tag");
+  location = Option49.String("--location");
+  resourceGroup = Option49.String("--resource-group");
+  clientId = Option49.String("--client-id");
+  subscription = Option49.String("--subscription");
+  installerTag = Option49.String("--installer-tag");
   // Full image ref override (registry + repo + tag) — an escape hatch when the
   // default org/tag is wrong for the current CLI (e.g. a stale published build).
   // Wins over --installer-tag / the pinned default.
-  installerImage = Option47.String("--installer-image");
-  gatewayImageRef = Option47.String("--gateway-image-ref");
-  githubAppCreds = Option47.String("--github-app-creds");
-  contactEmail = Option47.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
-  company = Option47.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
+  installerImage = Option49.String("--installer-image");
+  gatewayImageRef = Option49.String("--gateway-image-ref");
+  githubAppCreds = Option49.String("--github-app-creds");
+  contactEmail = Option49.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  company = Option49.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
   // Value-carrying on purpose: a bare --force would be cargo-culted into
   // runbooks and harness prompts and erode the protection, whereas a faithful
   // paste can never accidentally carry the victim group's name. It AUTHORIZES
   // the target; --resource-group is what CHOOSES it.
-  reinstallInto = Option47.String("--reinstall-into", { description: "Consent to installing into --resource-group even though it already holds resources. Must match the target group's name." });
+  reinstallInto = Option49.String("--reinstall-into", { description: "Consent to installing into --resource-group even though it already holds resources. Must match the target group's name." });
   async executeCommand() {
     const location = typeof this.location === "string" ? this.location : void 0;
     if (!location) {
@@ -26370,7 +26718,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/status.ts
-import { Command as Command51, Option as Option48 } from "clipanion";
+import { Command as Command53, Option as Option50 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-aci-state.ts
@@ -26398,13 +26746,13 @@ async function getAciState(opts) {
 // src/commands/bootstrap/status.ts
 var BootstrapStatusCommand = class extends M8tCommand {
   static paths = [["bootstrap", "status"]];
-  static usage = Command51.Usage({
+  static usage = Command53.Usage({
     description: "Show the cloud installer's live status (phase, progress, result).",
     details: "Reads the durable status blob written by the installer. --watch polls until the install reaches done or failed.",
     examples: [["One read", "$0 bootstrap status"], ["Watch to completion", "$0 bootstrap status --watch"]]
   });
-  watch = Option48.Boolean("--watch", false);
-  output = Option48.String("--output");
+  watch = Option50.Boolean("--watch", false);
+  output = Option50.String("--output");
   async executeCommand() {
     const state = await readBootstrapState();
     if (!state) {
@@ -26475,7 +26823,7 @@ function formatStatus(d) {
 }
 
 // src/commands/bootstrap/reap.ts
-import { Command as Command52, Option as Option49 } from "clipanion";
+import { Command as Command54, Option as Option51 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-reap.ts
@@ -26569,14 +26917,14 @@ async function reapInstaller(opts) {
 // src/commands/bootstrap/reap.ts
 var BootstrapReapCommand = class extends M8tCommand {
   static paths = [["bootstrap", "reap"]];
-  static usage = Command52.Usage({
+  static usage = Command54.Usage({
     description: "Tear down the installer scaffolding (ACI \u2192 MI \u2192 its role assignments) after a successful install.",
     details: "Runs locally on the 'done' signal (the installer can't delete its own identity). The platform RG and the gateway's own assignments persist. A failed install is left intact for diagnosis unless --force.",
     examples: [["Reap after done", "$0 bootstrap reap"]]
   });
-  force = Option49.Boolean("--force", false);
-  sweepOrphans = Option49.Boolean("--sweep-orphans", false);
-  yes = Option49.Boolean("--yes", false);
+  force = Option51.Boolean("--force", false);
+  sweepOrphans = Option51.Boolean("--sweep-orphans", false);
+  yes = Option51.Boolean("--yes", false);
   async executeCommand() {
     if (this.sweepOrphans === true) {
       const { subscriptionId: sub } = await getAzAccount();
@@ -26673,7 +27021,7 @@ Found ${String(total)} orphaned assignment(s) (${breakdown}) (dry-run). ${colors
 import * as fs31 from "fs/promises";
 import * as os16 from "os";
 import * as path34 from "path";
-import { Command as Command53, Option as Option50 } from "clipanion";
+import { Command as Command55, Option as Option52 } from "clipanion";
 init_errors();
 
 // src/lib/company-profile-seed.ts
@@ -27330,14 +27678,14 @@ function renderInstallSummary(args) {
 // src/commands/bootstrap/finish.ts
 var BootstrapFinishCommand = class extends M8tCommand {
   static paths = [["bootstrap", "finish"]];
-  static usage = Command53.Usage({
+  static usage = Command55.Usage({
     description: "Point your local tools at the now-live platform (repo-root marker, discovery cache, next steps).",
     details: "Final step of `m8t bootstrap` (after the install reaches done). Writes ~/.m8t/repo-root, points your local tools at the live gateway, and \u2014 if you completed the onboarding questionnaire \u2014 seeds your brain-backed advisor's brain with your company profile (best-effort; never blocks finish). Run `m8t bootstrap seed-profile` to seed manually later.",
     examples: [["Finish local", "$0 bootstrap finish --repo-root /path/to/m8t"]]
   });
-  repoRoot = Option50.String("--repo-root");
-  subscription = Option50.String("--subscription");
-  resourceGroup = Option50.String("--resource-group");
+  repoRoot = Option52.String("--repo-root");
+  subscription = Option52.String("--subscription");
+  resourceGroup = Option52.String("--resource-group");
   async executeCommand() {
     const state = await readBootstrapState();
     if (!state) {
@@ -27440,8 +27788,8 @@ ${colors.field("Then open a brand new chat/session")} \u2014 new skills + MCP se
 import * as fs33 from "fs";
 import * as os18 from "os";
 import * as path36 from "path";
-import { Command as Command54, Option as Option51 } from "clipanion";
-import { DefaultAzureCredential as DefaultAzureCredential21 } from "@azure/identity";
+import { Command as Command56, Option as Option53 } from "clipanion";
+import { DefaultAzureCredential as DefaultAzureCredential23 } from "@azure/identity";
 init_errors();
 
 // src/lib/bootstrap-ui.ts
@@ -28199,7 +28547,7 @@ function renderDeployFailure(error) {
 }
 var BootstrapUiCommand = class extends M8tCommand {
   static paths = [["bootstrap", "ui"]];
-  static usage = Command54.Usage({
+  static usage = Command56.Usage({
     description: "Deploy Simple Stacey + start the local onboarding chat UI in the background (returns immediately).",
     details: [
       "Run after `m8t bootstrap launch`, in parallel with `status --watch`. Waits for the cloud",
@@ -28219,16 +28567,16 @@ var BootstrapUiCommand = class extends M8tCommand {
       ["Experimental: enable the intake voice call", "$0 bootstrap ui --repo-root /path/to/m8t --voice"]
     ]
   });
-  repoRoot = Option51.String("--repo-root");
-  port = Option51.String("--port", "3000");
-  endpoint = Option51.String("--endpoint", {
+  repoRoot = Option53.String("--repo-root");
+  port = Option53.String("--port", "3000");
+  endpoint = Option53.String("--endpoint", {
     description: "Foundry project endpoint to target \u2014 disambiguates when the subscription has multiple projects."
   });
-  prepOnly = Option51.Boolean("--prep-only", false);
-  skipInstall = Option51.Boolean("--skip-install", false);
-  stop = Option51.Boolean("--stop", false);
-  foreground = Option51.Boolean("--foreground", false);
-  voice = Option51.Boolean("--voice", false, {
+  prepOnly = Option53.Boolean("--prep-only", false);
+  skipInstall = Option53.Boolean("--skip-install", false);
+  stop = Option53.Boolean("--stop", false);
+  foreground = Option53.Boolean("--foreground", false);
+  voice = Option53.Boolean("--voice", false, {
     description: "Experimental/preview: enable the intake voice call and start the voice relay on :8790. Not a supported founder path \u2014 the intake is text-only by default."
   });
   async executeCommand() {
@@ -28266,7 +28614,7 @@ var BootstrapUiCommand = class extends M8tCommand {
     if (fs33.existsSync(path36.join(os18.homedir(), ".m8t", "config.yaml"))) {
       out(colors.error("\u26A0 an existing ~/.m8t/config.yaml will override the onboarding app registration in apps/web \u2014 if Microsoft sign-in fails, move it aside and retry."));
     }
-    const credential2 = new DefaultAzureCredential21();
+    const credential2 = new DefaultAzureCredential23();
     const account = await getAzAccount();
     assertNodeVersion();
     out("waiting for Foundry (the installer's foundry-create phase)\u2026");
@@ -28382,10 +28730,10 @@ var BootstrapUiCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/seed-profile.ts
-import { Command as Command55, Option as Option52 } from "clipanion";
+import { Command as Command57, Option as Option54 } from "clipanion";
 var BootstrapSeedProfileCommand = class extends M8tCommand {
   static paths = [["bootstrap", "seed-profile"]];
-  static usage = Command55.Usage({
+  static usage = Command57.Usage({
     description: "Seed your advisors' brains with the founder + company profile from the onboarding questionnaire.",
     details: "Reads the latest stacey-intake conversation, renders memory/founder.md + memory/company-profile.md (+ their MEMORY.md index lines), and commits them to both <org>/stacey-brain and <org>/azzy-brain via the GitHub App. Idempotent. --watch polls until the founder completes the questionnaire.",
     examples: [
@@ -28393,11 +28741,11 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
       ["Wait for the founder to finish", "$0 bootstrap seed-profile --watch"]
     ]
   });
-  endpoint = Option52.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
-  brain = Option52.String("--brain", { description: "Override the brain repo (default <org>/stacey-brain)." });
-  watch = Option52.Boolean("--watch", false, { description: "Poll until the questionnaire completes (or --timeout)." });
-  timeout = Option52.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
-  githubAppCreds = Option52.String("--github-app-creds");
+  endpoint = Option54.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
+  brain = Option54.String("--brain", { description: "Override the brain repo (default <org>/stacey-brain)." });
+  watch = Option54.Boolean("--watch", false, { description: "Poll until the questionnaire completes (or --timeout)." });
+  timeout = Option54.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
+  githubAppCreds = Option54.String("--github-app-creds");
   async executeCommand() {
     const ctx = await resolveSeedContext({
       endpointOverride: typeof this.endpoint === "string" ? this.endpoint : void 0,
@@ -28451,7 +28799,7 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
 import * as fs34 from "fs";
 import * as os19 from "os";
 import * as path37 from "path";
-import { Command as Command56, Option as Option53 } from "clipanion";
+import { Command as Command58, Option as Option55 } from "clipanion";
 init_errors();
 
 // src/lib/telemetry-enroll.ts
@@ -28533,7 +28881,7 @@ async function resolveKeyVaultName(containerAppResourceId) {
 }
 var TelemetryEnrollCommand = class extends M8tCommand {
   static paths = [["telemetry", "enroll"]];
-  static usage = Command56.Usage({
+  static usage = Command58.Usage({
     description: "Enroll this installation for operational telemetry (pre-existing installs).",
     details: "Generates an instance id + ingest key from the m8t telemetry ingest and stores the key in your platform Key Vault, the same place the installer writes it on a fresh install. Your installation is identified only by that random instance id \u2014 no contact, company, or subscription details are sent unless you pass them explicitly. Idempotent: refuses if a key already exists.",
     examples: [
@@ -28541,11 +28889,11 @@ var TelemetryEnrollCommand = class extends M8tCommand {
       ["Enroll and share a support contact", "$0 telemetry enroll --contact-email you@example.com --company 'Acme'"]
     ]
   });
-  company = Option53.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
-  contactEmail = Option53.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
-  subscription = Option53.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
-  resourceGroup = Option53.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
-  force = Option53.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
+  company = Option55.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
+  contactEmail = Option55.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  subscription = Option55.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
+  resourceGroup = Option55.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
+  force = Option55.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
   async executeCommand() {
     const account = await getAzAccount();
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
@@ -28636,6 +28984,8 @@ cli.register(PlatformStatusCommand);
 cli.register(PlatformUpdateCommand);
 cli.register(PlatformConvergeCommand);
 cli.register(PlatformSeedStampCommand);
+cli.register(PlatformStampBuildCommand);
+cli.register(PlatformPolicyCommand);
 cli.register(PlatformEnableCostReportCommand);
 cli.register(PlatformEnableAutoUpdateCommand);
 cli.register(DeployCommand);