@m8t-stack/cli 0.2.47 → 0.2.48

package/dist/cli.js

@@ -1329,7 +1329,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.47";
+var CLI_VERSION = "0.2.48";
 
 // src/lib/render-error.ts
 init_errors();
@@ -22437,6 +22437,17 @@ async function ensureGatewayRedirectUri(gatewayClientId, fqdn) {
   }
   await patchRedirectUris(appObjectId, fqdn);
 }
+async function resolveAppObjectIdForWrite(opts) {
+  if (opts.appObjectId) return opts.appObjectId;
+  if (!opts.clientId) return null;
+  try {
+    return await azJson(
+      ["ad", "app", "show", "--id", opts.clientId, "--query", "id", "--output", "json"]
+    ) ?? null;
+  } catch {
+    return null;
+  }
+}
 async function patchRedirectUris(appObjectId, fqdn) {
   const targetUri = `https://${fqdn}`;
   const existing = await azJson(
@@ -22800,9 +22811,6 @@ var DeployCommand = class extends M8tCommand {
     }
     log(this.clientId ? `using existing app reg ${this.clientId}` : "ensuring Entra app reg\u2026");
     const app = await ensureAppReg({ tenantId: account.tenantId, clientId: this.clientId });
-    if (app.appObjectId === null && this.clientId) {
-      log(colors.dim("  (BYO app reg \u2014 skipping Graph writes; ensure it has http://localhost:3000 + the deployed FQDN as SPA redirect URIs and Expose-an-API)"));
-    }
     await writeFoundryConfig({ tenantId: app.tenantId, clientId: app.clientId, projectEndpoint: foundryEndpoint });
     log(`ensuring resource group ${this.resourceGroup}\u2026`);
     await ensureResourceGroup(this.resourceGroup, this.location);
@@ -22848,8 +22856,16 @@ var DeployCommand = class extends M8tCommand {
       params,
       deploymentName: `m8t-deploy-${account.subscriptionId.slice(0, 8)}`
     });
-    if (app.appObjectId) {
-      await patchRedirectUris(app.appObjectId, outputs.containerAppFqdn);
+    const writableAppObjectId = await resolveAppObjectIdForWrite({
+      appObjectId: app.appObjectId,
+      clientId: this.clientId
+    });
+    if (writableAppObjectId) {
+      await patchRedirectUris(writableAppObjectId, outputs.containerAppFqdn);
+    } else {
+      log(colors.dim(
+        `  (could not register the sign-in redirect URI automatically \u2014 add https://${outputs.containerAppFqdn} as an SPA redirect URI on app registration ${app.clientId}, or sign-in will fail with AADSTS50011)`
+      ));
     }
     const webappUrl = `https://${outputs.containerAppFqdn}`;
     if (mode === "json") {
@@ -27232,8 +27248,12 @@ var EVENT_TIERS = {
 };
 var EVENT_ENUM = Object.keys(EVENT_TIERS);
 
+// ../../packages/telemetry-contract/artifact/cadence.ts
+var HEARTBEAT_CADENCE_MS = 3 * 60 * 60 * 1e3;
+var HEARTBEAT_CADENCE_HOURS = HEARTBEAT_CADENCE_MS / (60 * 60 * 1e3);
+
 // ../../packages/telemetry-contract/src/disclosure.ts
-var DISCLOSURE_TIER1 = "Operational data. To support your installation, m8t receives limited operational data linked to it \u2014 installation and update events, installed versions, and service health signals. Your installation is identified only by a random installation ID we generate at setup \u2014 an opaque value with no information encoded in it. No name, email, company, or subscription information is sent in the enrollment record unless you explicitly choose to share contact details for support. At enrollment, we also verify a cloud identity token to confirm the request comes from a real cloud account; that token names the account making the request, and is otherwise discarded immediately and never stored. This is service data used only to operate and support the platform; it contains none of your content. Details: TELEMETRY.md.";
+var DISCLOSURE_TIER1 = "Operational data. To support your installation, m8t receives limited operational data linked to it \u2014 installation and update events, installed versions, and service health signals. Your installation is identified only by a random installation ID we generate at setup \u2014 an opaque value with no information encoded in it. No name, email, company, or subscription information is sent in the enrollment record unless you explicitly choose to share contact details for support. At enrollment, we also verify a cloud identity token to confirm the request comes from a real cloud account; that token names the account making the request, and is otherwise discarded immediately and never stored. This is service data used only to operate and support the platform; it contains none of your content. After setup, you can turn this off in the web app's Settings, under Privacy; update checks keep working. Details: TELEMETRY.md.";
 
 // ../../packages/telemetry-contract/src/endpoints.ts
 var INGEST_BASE_URL = (process.env.M8T_INGEST_BASE_URL ?? "").trim() || "https://m8t-admin.wonderfuldesert-721e332f.eastus2.azurecontainerapps.io";