@m8t-stack/cli 0.2.48 → 0.2.52

package/dist/cli.js

@@ -453,7 +453,13 @@ function emptyChecks() {
     installationsListable: { ok: false }
   };
 }
+function isPermanentKvRbacDenial(e) {
+  const msg = e.message ?? "";
+  return /assignment:\s*\(not found\)/i.test(msg);
+}
 function isTransientErr(e) {
+  if (isPermanentKvRbacDenial(e))
+    return false;
   const any = e;
   const code = any.statusCode ?? any.status;
   if (typeof code === "number" && (code === 429 || code === 403 || code >= 500))
@@ -474,7 +480,12 @@ async function runChecksOnce(args) {
     checks.kvSecretsReadable = { ok: true };
   } catch (e) {
     checks.kvSecretsReadable = { ok: false, error: e.message };
-    return { ok: false, transient: isTransientErr(e), checks };
+    return {
+      ok: false,
+      transient: isTransientErr(e),
+      ...isPermanentKvRbacDenial(e) ? { permanentReason: "kv_rbac_denied" } : {},
+      checks
+    };
   }
   const appIdNum = Number(appId);
   if (Number.isInteger(appIdNum) && appIdNum > 0) {
@@ -556,6 +567,30 @@ async function checkAppHealth(args) {
   }
   return last;
 }
+function appHealthFailureCopy(health) {
+  if (health.permanentReason === "kv_rbac_denied") {
+    return {
+      message: "You do not have access to this platform's Key Vault, so the GitHub App secrets could not be read.",
+      hint: "This is a permanent permission gap, not a blip \u2014 retrying will not fix it. Run `m8t prereqs --fix` to grant yourself Key Vault secrets access (or ask whoever administers the subscription to run it for you), then re-run this command.",
+      category: "unknown",
+      retryable: false
+    };
+  }
+  if (health.transient === true) {
+    return {
+      message: "GitHub App health check failed transiently (Key Vault / GitHub API blip).",
+      hint: "This is usually a transient Azure/GitHub blip \u2014 retrying. If it persists, run `m8t brain check-app`.",
+      category: "transient",
+      retryable: true
+    };
+  }
+  return {
+    message: "GitHub App is not configured correctly.",
+    hint: "Run `m8t brain check-app` for details.",
+    category: "unknown",
+    retryable: false
+  };
+}
 var init_check = __esm({
   "../../packages/github-app-auth/dist/esm/check.js"() {
     "use strict";
@@ -1110,7 +1145,7 @@ async function grantKeyVaultSecretsUser(args) {
       properties: {
         roleDefinitionId: `/subscriptions/${args.subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/${KV_SECRETS_USER_ROLE_ID}`,
         principalId: args.principalId,
-        principalType: "ServicePrincipal"
+        principalType: args.principalType ?? "ServicePrincipal"
       }
     },
     okStatuses: [409]
@@ -1329,7 +1364,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.48";
+var CLI_VERSION = "0.2.52";
 
 // src/lib/render-error.ts
 init_errors();
@@ -2054,10 +2089,10 @@ function ReadableStreamToAsyncIterable(stream) {
   return {
     async next() {
       try {
-        const result = await reader.read();
-        if (result?.done)
+        const result2 = await reader.read();
+        if (result2?.done)
           reader.releaseLock();
-        return result;
+        return result2;
       } catch (e) {
         reader.releaseLock();
         throw e;
@@ -2799,9 +2834,9 @@ var Stream = class _Stream {
       return {
         next: () => {
           if (queue.length === 0) {
-            const result = iterator.next();
-            left.push(result);
-            right.push(result);
+            const result2 = iterator.next();
+            left.push(result2);
+            right.push(result2);
           }
           return queue.shift();
         }
@@ -4384,23 +4419,23 @@ var AbstractChatCompletionRunner = class extends EventStream {
       }
       if (singleFunctionToCall || params.parallel_tool_calls === false) {
         for (const toolCall of message.tool_calls) {
-          const result = await runToolCall(toolCall);
-          if (result.message)
-            this._addMessage(result.message);
-          if (singleFunctionToCall && result.functionCalled) {
+          const result2 = await runToolCall(toolCall);
+          if (result2.message)
+            this._addMessage(result2.message);
+          if (singleFunctionToCall && result2.functionCalled) {
             await afterCompletion?.(chatCompletion, runner);
             return;
           }
         }
       } else {
         const results = await Promise.allSettled(message.tool_calls.map(runToolCall));
-        for (const result of results) {
-          if (result.status === "rejected")
-            throw result.reason;
+        for (const result2 of results) {
+          if (result2.status === "rejected")
+            throw result2.reason;
         }
-        for (const result of results) {
-          if (result.status === "fulfilled" && result.value.message) {
-            this._addMessage(result.value.message);
+        for (const result2 of results) {
+          if (result2.status === "fulfilled" && result2.value.message) {
+            this._addMessage(result2.value.message);
           }
         }
       }
@@ -11213,17 +11248,17 @@ Uploads.Parts = Parts;
 // ../../node_modules/.pnpm/openai@6.48.0_ws@8.21.1_zod@4.4.3/node_modules/openai/lib/Util.mjs
 var allSettledWithThrow = async (promises) => {
   const results = await Promise.allSettled(promises);
-  const rejected = results.filter((result) => result.status === "rejected");
+  const rejected = results.filter((result2) => result2.status === "rejected");
   if (rejected.length) {
-    for (const result of rejected) {
-      console.error(result.reason);
+    for (const result2 of rejected) {
+      console.error(result2.reason);
     }
     throw new Error(`${rejected.length} promise(s) failed - see the above errors`);
   }
   const values = [];
-  for (const result of results) {
-    if (result.status === "fulfilled") {
-      values.push(result.value);
+  for (const result2 of results) {
+    if (result2.status === "fulfilled") {
+      values.push(result2.value);
     }
   }
   return values;
@@ -13985,17 +14020,17 @@ var TeamRemoveCommand = class extends M8tCommand {
       }
     }
     const ctx = await resolveGatewayContext({ interactive, subscriptionId: this.subscription, resourceGroup: this.resourceGroup });
-    const result = await apiCall(
+    const result2 = await apiCall(
       { gatewayUrl: ctx.gatewayUrl, gatewayClientId: ctx.gatewayClientId },
       { method: "DELETE", path: `/api/team/${encodeURIComponent(this.handle)}` },
       (msg) => this.context.stderr.write(msg + "\n")
     );
     if (mode === "json") {
-      this.context.stdout.write(renderJson(result) + "\n");
+      this.context.stdout.write(renderJson(result2) + "\n");
       return 0;
     }
     this.context.stdout.write(
-      `${colors.success("\u2713")} removed ${colors.field(result.deleted.handle)} (${result.deleted.rows.toString()} row${result.deleted.rows === 1 ? "" : "s"}).
+      `${colors.success("\u2713")} removed ${colors.field(result2.deleted.handle)} (${result2.deleted.rows.toString()} row${result2.deleted.rows === 1 ? "" : "s"}).
 `
     );
     return 0;
@@ -14717,10 +14752,10 @@ var BrainCheckAppCommand = class extends M8tCommand {
     );
     const kvUri = discoverKvUri(process.env, typeof this.kvUri === "string" ? this.kvUri : void 0);
     const credential2 = new DefaultAzureCredential3();
-    const result = await checkAppHealth({ credential: credential2, kvUri });
+    const result2 = await checkAppHealth({ credential: credential2, kvUri });
     if (mode === "json") {
-      this.context.stdout.write(renderJson(result) + "\n");
-      return result.ok ? 0 : 1;
+      this.context.stdout.write(renderJson(result2) + "\n");
+      return result2.ok ? 0 : 1;
     }
     this.context.stdout.write(`${colors.field("GitHub App health check")} (${kvUri})
 
@@ -14731,18 +14766,18 @@ var BrainCheckAppCommand = class extends M8tCommand {
       this.context.stdout.write(`  ${status} ${label.padEnd(28)} ${colors.dim(detail)}
 `);
     };
-    row("KV secrets readable", result.checks.kvSecretsReadable);
-    row("App ID numeric", result.checks.appIdNumeric);
-    row("Private key valid", result.checks.privateKeyValid);
-    row("App JWT accepted", result.checks.appJwtAccepted);
-    row("Installations listable", result.checks.installationsListable);
+    row("KV secrets readable", result2.checks.kvSecretsReadable);
+    row("App ID numeric", result2.checks.appIdNumeric);
+    row("Private key valid", result2.checks.privateKeyValid);
+    row("App JWT accepted", result2.checks.appJwtAccepted);
+    row("Installations listable", result2.checks.installationsListable);
     this.context.stdout.write("\n");
     this.context.stdout.write(
-      result.ok ? `${colors.success("\u2713")} all checks passed.
+      result2.ok ? `${colors.success("\u2713")} all checks passed.
 ` : `${colors.error("\u2717")} one or more checks failed \u2014 see above.
 `
     );
-    return result.ok ? 0 : 1;
+    return result2.ok ? 0 : 1;
   }
 };
 
@@ -15810,8 +15845,7 @@ var BrainCreateCommand = class extends M8tCommand {
       if (!health.ok) {
         throw new LocalCliError({
           code: "APP_HEALTH_FAILED",
-          message: "GitHub App is not configured correctly.",
-          hint: "Run `m8t brain check-app` for details, then re-run this command."
+          ...appHealthFailureCopy(health)
         });
       }
     }
@@ -15835,7 +15869,7 @@ var BrainCreateCommand = class extends M8tCommand {
       });
     }
     const tmpDir = fs11.mkdtempSync(path10.join(os4.tmpdir(), `m8t-brain-create-${worker}-`));
-    let result;
+    let result2;
     let resolvedInstallationId = null;
     const force = this.reuse === true ? "reuse" : this.newName === true ? "new" : void 0;
     const interactive = !useAppPath && this.context.stdout.isTTY === true;
@@ -15950,7 +15984,7 @@ var BrainCreateCommand = class extends M8tCommand {
 `);
         }
       }
-      result = await linkBrain({
+      result2 = await linkBrain({
         credential: credential2,
         kvUri,
         projectEndpoint: project.endpoint,
@@ -15975,14 +16009,14 @@ var BrainCreateCommand = class extends M8tCommand {
           repo: `${owner}/${finalName}`,
           branch,
           installationId: resolvedInstallationId,
-          connectionName: result.connectionName,
-          foundryVersion: result.foundryVersion
+          connectionName: result2.connectionName,
+          foundryVersion: result2.foundryVersion
         }) + "\n"
       );
       return 0;
     }
     this.context.stdout.write(
-      `${colors.success("\u2713")} created + linked ${colors.field(worker)} \u2194 ${colors.field(`${owner}/${finalName}`)} (agent version ${result.foundryVersion ?? ""}).
+      `${colors.success("\u2713")} created + linked ${colors.field(worker)} \u2194 ${colors.field(`${owner}/${finalName}`)} (agent version ${result2.foundryVersion ?? ""}).
 `
     );
     this.context.stdout.write(`  ${colors.hint("brain repo:")} https://github.com/${owner}/${finalName}
@@ -16070,8 +16104,7 @@ var BrainLinkCommand = class extends M8tCommand {
     if (!health.ok) {
       throw new LocalCliError({
         code: "APP_HEALTH_FAILED",
-        message: "GitHub App is not configured correctly.",
-        hint: "Run `m8t brain check-app` for details, then re-run this command."
+        ...appHealthFailureCopy(health)
       });
     }
     const account = await getAzAccount();
@@ -16112,7 +16145,7 @@ var BrainLinkCommand = class extends M8tCommand {
       this.context.stdout.write(`  ${colors.success("\u2713")} installation detected (id: ${installationId})
 `);
     }
-    const result = await linkBrain({
+    const result2 = await linkBrain({
       credential: credential2,
       kvUri,
       projectEndpoint: project.endpoint,
@@ -16140,18 +16173,18 @@ var BrainLinkCommand = class extends M8tCommand {
         worker: this.worker,
         repo,
         branch,
-        installationId: result.installationId,
-        connectionName: result.connectionName,
-        foundryVersion: result.foundryVersion,
-        alreadyLinked: result.alreadyLinked
+        installationId: result2.installationId,
+        connectionName: result2.connectionName,
+        foundryVersion: result2.foundryVersion,
+        alreadyLinked: result2.alreadyLinked
       }) + "\n");
       return 0;
     }
-    if (result.alreadyLinked) {
+    if (result2.alreadyLinked) {
       this.context.stdout.write(`${colors.success("\u2713")} ${colors.field(this.worker)} already linked to ${colors.field(repo)} (token rotated). No-op.
 `);
     } else {
-      this.context.stdout.write(`${colors.success("\u2713")} linked ${colors.field(this.worker)} \u2194 ${colors.field(repo)} via App-mode (install ${installationId}, agent version ${result.foundryVersion ?? "unknown"}).
+      this.context.stdout.write(`${colors.success("\u2713")} linked ${colors.field(this.worker)} \u2194 ${colors.field(repo)} via App-mode (install ${installationId}, agent version ${result2.foundryVersion ?? "unknown"}).
 `);
       this.context.stdout.write(`  ${colors.hint("brain doctrine:")} https://github.com/${repo}/blob/${branch}/AGENTS.md
 `);
@@ -16171,16 +16204,16 @@ import { AIProjectClient as AIProjectClient2 } from "@azure/ai-projects";
 async function listM8tAgents(args) {
   const project = new AIProjectClient2(args.projectEndpoint, args.credential);
   const iter = project.agents.list();
-  const result = [];
+  const result2 = [];
   for await (const raw of iter) {
     if (!raw.name && !raw.id) continue;
     const name = String(raw.name ?? raw.id);
     const md = raw.metadata ?? raw.versions?.latest?.metadata ?? {};
     if (md.source === "m8t") {
-      result.push({ name, metadata: md });
+      result2.push({ name, metadata: md });
     }
   }
-  return result;
+  return result2;
 }
 
 // src/commands/brain/list.ts
@@ -16230,9 +16263,9 @@ import { Command as Command21, Option as Option20 } from "clipanion";
 
 // src/lib/github-orgs.ts
 var ORG_QUERY = "{ viewer { organizations(first:50) { nodes { login viewerCanAdminister enterpriseOwners(first:1) { totalCount } } } } }";
-function classifyOrgs(result) {
-  if (!result.ok) return { verdict: "undetermined", candidates: [], orgs: [] };
-  const orgs = result.orgs;
+function classifyOrgs(result2) {
+  if (!result2.ok) return { verdict: "undetermined", candidates: [], orgs: [] };
+  const orgs = result2.orgs;
   if (orgs.length === 0) return { verdict: "no-orgs", candidates: [], orgs };
   const enterprise = orgs.filter((o) => o.enterprise);
   if (enterprise.length === 1) {
@@ -16635,7 +16668,7 @@ var BrainUnlinkCommand = class extends M8tCommand {
       endpoint: typeof this.endpoint === "string" ? this.endpoint : void 0,
       agentEndpoint
     });
-    const result = await unlinkBrain({
+    const result2 = await unlinkBrain({
       credential: credential2,
       kvUri,
       projectEndpoint: project.endpoint,
@@ -16649,9 +16682,9 @@ var BrainUnlinkCommand = class extends M8tCommand {
         renderJson({
           worker,
           repo,
-          foundryVersion: result.foundryVersion,
-          connectionDeleted: result.connectionDeleted,
-          appUninstalled: result.appUninstalled
+          foundryVersion: result2.foundryVersion,
+          connectionDeleted: result2.connectionDeleted,
+          appUninstalled: result2.appUninstalled
         }) + "\n"
       );
       return 0;
@@ -16660,7 +16693,7 @@ var BrainUnlinkCommand = class extends M8tCommand {
       `${colors.success("\u2713")} unlinked ${colors.field(worker)} from ${colors.field(repo)}. Repo intact \u2014 run ${colors.field(`gh repo delete ${repo}`)} to remove it.
 `
     );
-    if (!keepAppInstall && result.appUninstalled) {
+    if (!keepAppInstall && result2.appUninstalled) {
       this.context.stdout.write(
         `  ${colors.hint("app install removed:")} re-link anytime with \`m8t brain link ${worker} --repo ${repo}\` \u2014 no re-registration needed.
 `
@@ -17063,10 +17096,10 @@ async function enableA2a(args) {
       message: `Agent '${args.agentName}' is kind '${current.definition.kind}'. Agent-to-agent enablement supports prompt agents (callers) and hosted agents (callees); '${current.definition.kind}' is neither.`
     });
   }
-  const bearer = `a2a_${randomBytes2(32).toString("base64url")}`;
-  const bearerHash = createHash("sha256").update(bearer).digest("hex");
+  const bearer2 = `a2a_${randomBytes2(32).toString("base64url")}`;
+  const bearerHash = createHash("sha256").update(bearer2).digest("hex");
   progress("Provisioning the A2A connection\u2026");
-  await putA2aConnection({ credential: args.credential, projectArmId: args.projectArmId, connectionName, target: args.bridgeUrl, bearer });
+  await putA2aConnection({ credential: args.credential, projectArmId: args.projectArmId, connectionName, target: args.bridgeUrl, bearer: bearer2 });
   progress("Deploying the a2a-enabled agent version\u2026");
   const definition = {
     ...current.definition,
@@ -17313,9 +17346,9 @@ function defaultRemoveAgentDeps(args) {
       await deleteAgent({ credential: credential2, endpoint: projectEndpoint, name: agentName });
     },
     deleteBrainRepo(repo) {
-      const result = spawnSync2("gh", ["repo", "delete", repo, "--yes"], { encoding: "utf8" });
-      if (result.status !== 0) {
-        return Promise.reject(new Error(result.stderr?.trim() || `gh repo delete exited with code ${String(result.status)}`));
+      const result2 = spawnSync2("gh", ["repo", "delete", repo, "--yes"], { encoding: "utf8" });
+      if (result2.status !== 0) {
+        return Promise.reject(new Error(result2.stderr?.trim() || `gh repo delete exited with code ${String(result2.status)}`));
       }
       return Promise.resolve();
     },
@@ -17537,7 +17570,7 @@ var A2aEnableCommand = class extends M8tCommand {
     });
     const personaPath = this.resolvePersonaPath();
     const bridgeUrl = resolveBridgeUrl({ flag: typeof this.gatewayUrl === "string" ? this.gatewayUrl : void 0, env });
-    const result = await enableA2a({
+    const result2 = await enableA2a({
       credential: credential2,
       projectEndpoint: project.endpoint,
       projectArmId: `${project.accountScope}/projects/${project.projectName}`,
@@ -17547,17 +17580,17 @@ var A2aEnableCommand = class extends M8tCommand {
       onProgress: progress
     });
     if (mode === "json") {
-      this.context.stdout.write(renderJson({ worker: this.worker, mode: result.mode, connectionName: result.connectionName, foundryVersion: result.foundryVersion, bridgeUrl }) + "\n");
+      this.context.stdout.write(renderJson({ worker: this.worker, mode: result2.mode, connectionName: result2.connectionName, foundryVersion: result2.foundryVersion, bridgeUrl }) + "\n");
       return 0;
     }
-    if (result.mode === "target") {
-      this.context.stdout.write(`${colors.success("\u2713")} ${colors.field(this.worker)} is a discoverable a2a target (agent version ${result.foundryVersion}).
+    if (result2.mode === "target") {
+      this.context.stdout.write(`${colors.success("\u2713")} ${colors.field(this.worker)} is a discoverable a2a target (agent version ${result2.foundryVersion}).
 `);
       this.context.stdout.write(`  ${colors.hint("directory:")} it now appears in every a2a caller's discover_workers as a callee. Hosted agents are callees only \u2014 no caller connection.
 `);
       return 0;
     }
-    this.context.stdout.write(`${colors.success("\u2713")} ${colors.field(this.worker)} is a2a-enabled (connection ${colors.field(result.connectionName ?? "")}, agent version ${result.foundryVersion}).
+    this.context.stdout.write(`${colors.success("\u2713")} ${colors.field(this.worker)} is a2a-enabled (connection ${colors.field(result2.connectionName ?? "")}, agent version ${result2.foundryVersion}).
 `);
     this.context.stdout.write(`  ${colors.hint("directory:")} it now appears in every a2a worker's discover_workers, and can delegate via invoke_worker.
 `);
@@ -17604,7 +17637,7 @@ var A2aDisableCommand = class extends M8tCommand {
       endpoint: typeof this.endpoint === "string" ? this.endpoint : void 0,
       agentEndpoint: readAgentYaml(this.worker)?.projectEndpoint
     });
-    const result = await disableA2a({
+    const result2 = await disableA2a({
       credential: credential2,
       projectEndpoint: project.endpoint,
       projectArmId: `${project.accountScope}/projects/${project.projectName}`,
@@ -17612,10 +17645,10 @@ var A2aDisableCommand = class extends M8tCommand {
       onProgress: progress
     });
     if (mode === "json") {
-      this.context.stdout.write(renderJson({ worker: this.worker, ...result }) + "\n");
+      this.context.stdout.write(renderJson({ worker: this.worker, ...result2 }) + "\n");
       return 0;
     }
-    this.context.stdout.write(`${colors.success("\u2713")} ${colors.field(this.worker)} a2a-disabled (connection ${colors.field(result.connectionName)} removed, agent version ${result.foundryVersion ?? ""}).
+    this.context.stdout.write(`${colors.success("\u2713")} ${colors.field(this.worker)} a2a-disabled (connection ${colors.field(result2.connectionName)} removed, agent version ${result2.foundryVersion ?? ""}).
 `);
     return 0;
   }
@@ -18188,6 +18221,20 @@ async function stagePublicImageIfNeeded(args) {
   return { image: acrRef, staged: true, notes };
 }
 
+// src/lib/warnings.ts
+function makeWarningSink(echo) {
+  const items = [];
+  return {
+    add(msg) {
+      items.push(msg);
+      echo?.(msg);
+    },
+    list() {
+      return items.slice();
+    }
+  };
+}
+
 // src/commands/coder/deploy.ts
 init_esm();
 var SIZE_PRESETS = {
@@ -18253,6 +18300,10 @@ var CoderDeployCommand = class extends M8tCommand {
       this.context.stdout
     );
     const interactive = this.context.stdout.isTTY === true;
+    const warnings = makeWarningSink((m) => {
+      if (mode !== "json") this.context.stdout.write(`${colors.hint("note:")} ${m}
+`);
+    });
     const credential2 = new DefaultAzureCredential13();
     const account = await getAzAccount();
     const subscriptionId = this.subscription ?? account.subscriptionId;
@@ -18290,20 +18341,18 @@ var CoderDeployCommand = class extends M8tCommand {
     }
     const staged = await stagePublicImageIfNeeded({ image: requestedImage, project });
     for (const n of staged.notes) {
-      this.context.stderr.write(`${colors.hint("note:")} ${n}
-`);
+      warnings.add(n);
     }
     const image = staged.image;
-    const { warnings } = await checkPreconditions({
+    const { warnings: preconditionWarnings } = await checkPreconditions({
       credential: credential2,
       subscriptionId,
       project,
       image,
       callerObjectId
     });
-    for (const w of warnings) {
-      this.context.stderr.write(`${colors.hint("note:")} ${w}
-`);
+    for (const w of preconditionWarnings) {
+      warnings.add(w);
     }
     if (this.skipQuotaCheck !== true) {
       const usages = await listModelQuota(project.region);
@@ -18316,14 +18365,13 @@ var CoderDeployCommand = class extends M8tCommand {
         });
       }
       if (verdict === "unknown") {
-        this.context.stderr.write(`${colors.hint("note:")} could not confirm quota for '${env.MODEL_DEPLOYMENT_NAME}' in ${project.region}; proceeding.
-`);
+        warnings.add(`could not confirm quota for '${env.MODEL_DEPLOYMENT_NAME}' in ${project.region}; proceeding.`);
       }
     }
     const { persona: personaName, personaVersion } = resolvePersona(persona);
     const onProgress = mode === "pretty" ? (m) => this.context.stderr.write(`  ${colors.dim(m)}
 `) : void 0;
-    const result = await deployHostedWorker({
+    const result2 = await deployHostedWorker({
       credential: credential2,
       subscriptionId,
       project,
@@ -18354,10 +18402,7 @@ var CoderDeployCommand = class extends M8tCommand {
       if (!health.ok) {
         throw new LocalCliError({
           code: "APP_HEALTH_FAILED",
-          message: health.transient ? "GitHub App health check failed transiently (Key Vault / GitHub API blip)." : "GitHub App is not configured correctly.",
-          hint: health.transient ? "This is usually a transient Azure/GitHub blip \u2014 retrying. If it persists, run `m8t brain check-app`." : "Run `m8t brain check-app` for details.",
-          category: health.transient ? "transient" : "unknown",
-          retryable: health.transient === true
+          ...appHealthFailureCopy(health)
         });
       }
       const { slug, appId, privateKeyPem } = await readAppSecrets({ credential: credential2, kvUri });
@@ -18397,7 +18442,7 @@ var CoderDeployCommand = class extends M8tCommand {
         await ensureDeliveryGrant({
           credential: credential2,
           subscriptionId,
-          principalId: result.principalId,
+          principalId: result2.principalId,
           kvUri
         });
         this.context.stdout.write(
@@ -18432,19 +18477,20 @@ var CoderDeployCommand = class extends M8tCommand {
       this.context.stdout.write(
         renderJson({
           name: this.name,
-          version: result.version,
-          status: result.status,
+          version: result2.version,
+          status: result2.status,
           persona: personaName,
           image,
           size,
           endpoint: project.endpoint,
-          agentPrincipalId: result.principalId
+          agentPrincipalId: result2.principalId,
+          warnings: warnings.list()
         }) + "\n"
       );
       return 0;
     }
     this.context.stdout.write(
-      `${colors.success("\u2713")} deployed hosted coder ${colors.field(this.name)} (version ${result.version}, ${result.status}, ${size}, persona ${personaName}).
+      `${colors.success("\u2713")} deployed hosted coder ${colors.field(this.name)} (version ${result2.version}, ${result2.status}, ${size}, persona ${personaName}).
 `
     );
     this.context.stdout.write(`  image: ${image}
@@ -18662,6 +18708,10 @@ var AzureExecDeployCommand = class extends M8tCommand {
     const interactive = this.context.stdout.isTTY === true;
     const onProgress = mode === "pretty" ? (m) => this.context.stderr.write(`  ${colors.dim(m)}
 `) : void 0;
+    const warnings = makeWarningSink((m) => {
+      if (mode !== "json") this.context.stdout.write(`${colors.hint("note:")} ${m}
+`);
+    });
     const credential2 = new DefaultAzureCredential15();
     const account = await getAzAccount();
     const subscriptionId = this.subscription ?? account.subscriptionId;
@@ -18702,8 +18752,7 @@ var AzureExecDeployCommand = class extends M8tCommand {
     }
     const staged = await stagePublicImageIfNeeded({ image: requestedImage, project });
     for (const n of staged.notes) {
-      this.context.stderr.write(`${colors.hint("note:")} ${n}
-`);
+      warnings.add(n);
     }
     const image = staged.image;
     const processEnv = this.context.env;
@@ -18713,10 +18762,7 @@ var AzureExecDeployCommand = class extends M8tCommand {
     if (!health.ok) {
       throw new LocalCliError({
         code: "APP_HEALTH_FAILED",
-        message: health.transient ? "GitHub App health check failed transiently (Key Vault / GitHub API blip)." : "GitHub App is not configured correctly.",
-        hint: health.transient ? "This is usually a transient Azure/GitHub blip \u2014 retrying. If it persists, run `m8t brain check-app`." : "Run `m8t brain check-app` for details.",
-        category: health.transient ? "transient" : "unknown",
-        retryable: health.transient === true
+        ...appHealthFailureCopy(health)
       });
     }
     const { slug, appId, privateKeyPem } = await readAppSecrets({ credential: credential2, kvUri });
@@ -18761,16 +18807,15 @@ var AzureExecDeployCommand = class extends M8tCommand {
       }
       env[pair.slice(0, eq)] = pair.slice(eq + 1);
     }
-    const { warnings } = await checkPreconditions({
+    const { warnings: preconditionWarnings } = await checkPreconditions({
       credential: credential2,
       subscriptionId,
       project,
       image,
       callerObjectId
     });
-    for (const w of warnings) {
-      this.context.stderr.write(`${colors.hint("note:")} ${w}
-`);
+    for (const w of preconditionWarnings) {
+      warnings.add(w);
     }
     if (this.skipQuotaCheck !== true) {
       const usages = await listModelQuota(project.region);
@@ -18784,7 +18829,7 @@ var AzureExecDeployCommand = class extends M8tCommand {
       }
     }
     const { persona: personaName, personaVersion } = resolvePersona("azure-executor");
-    const result = await deployHostedWorker({
+    const result2 = await deployHostedWorker({
       credential: credential2,
       subscriptionId,
       project,
@@ -18801,7 +18846,7 @@ var AzureExecDeployCommand = class extends M8tCommand {
       credential: credential2,
       subscriptionId,
       scope: grantScope,
-      principalId: result.principalId
+      principalId: result2.principalId
     });
     if (this.grantAccessAdmin === true) {
       onProgress?.(`granting User Access Administrator at ${grantScope}\u2026`);
@@ -18809,14 +18854,14 @@ var AzureExecDeployCommand = class extends M8tCommand {
         credential: credential2,
         subscriptionId,
         scope: grantScope,
-        principalId: result.principalId
+        principalId: result2.principalId
       });
     }
     onProgress?.("granting Key Vault Secrets User for delivery\u2026");
     await ensureDeliveryGrant({
       credential: credential2,
       subscriptionId,
-      principalId: result.principalId,
+      principalId: result2.principalId,
       kvUri
     });
     onProgress?.("a2a-enabling as a target\u2026");
@@ -18838,19 +18883,20 @@ var AzureExecDeployCommand = class extends M8tCommand {
       this.context.stdout.write(
         renderJson({
           name: this.name,
-          version: result.version,
-          status: result.status,
+          version: result2.version,
+          status: result2.status,
           persona: personaName,
           image,
           scope: grantScope,
           endpoint: project.endpoint,
-          agentPrincipalId: result.principalId
+          agentPrincipalId: result2.principalId,
+          warnings: warnings.list()
         }) + "\n"
       );
       return 0;
     }
     this.context.stdout.write(
-      `${colors.success("\u2713")} deployed Azure executor ${colors.field(this.name)} (version ${result.version}, ${result.status}, ${size}).
+      `${colors.success("\u2713")} deployed Azure executor ${colors.field(this.name)} (version ${result2.version}, ${result2.status}, ${size}).
 `
     );
     this.context.stdout.write(`  scope: ${grantScope}
@@ -19456,8 +19502,8 @@ async function readStampOutcome(opts) {
   }
 }
 async function readStamp(opts) {
-  const result = await readStampOutcome(opts);
-  return result.source === "explicit" ? result.stamp : null;
+  const result2 = await readStampOutcome(opts);
+  return result2.source === "explicit" ? result2.stamp : null;
 }
 
 // src/lib/platform-converge.ts
@@ -19606,9 +19652,18 @@ async function ensureResourceGroup(name, location) {
 function resolveAcrPullIdentity(opts) {
   return opts.explicit ?? "";
 }
+function buildDeployResult(args) {
+  return {
+    webapp: args.webappUrl,
+    resourceGroup: args.resourceGroup,
+    clientId: args.clientId,
+    resources: args.resourceNames,
+    warnings: args.warnings
+  };
+}
 async function runBicepDeployment(opts) {
   const bicepPath = path20.join(opts.repoRoot, "deploy", "main.bicep");
-  const result = JSON.parse(
+  const result2 = JSON.parse(
     await runAz([
       "deployment",
       "group",
@@ -19625,7 +19680,7 @@ async function runBicepDeployment(opts) {
       "json"
     ])
   );
-  const outputs = result.properties?.outputs ?? {};
+  const outputs = result2.properties?.outputs ?? {};
   const fqdn = outputs.containerAppFqdn?.value;
   if (typeof fqdn !== "string" || !fqdn) {
     throw new LocalCliError({
@@ -21154,8 +21209,8 @@ async function runHealthGateWithRollback(args) {
   const target = args.plan.targetVersion;
   let applied = [];
   try {
-    const result = await applyPlan(args.plan, args.deps, args.ctx);
-    applied = result.applied;
+    const result2 = await applyPlan(args.plan, args.deps, args.ctx);
+    applied = result2.applied;
     const outcomes = await runGate(args, applied, budgetMs);
     if (!gatePassed(outcomes)) {
       const detail = outcomes.find((o) => !o.ok)?.detail ?? "a post-apply health probe failed";
@@ -21664,7 +21719,7 @@ var PlatformSeedStampCommand = class extends M8tCommand {
 `);
     };
     const credential2 = typeof this.miClientId === "string" && this.miClientId.trim().length > 0 ? new ManagedIdentityCredential2({ clientId: this.miClientId.trim() }) : new DefaultAzureCredential18();
-    const result = await seedStamp2({
+    const result2 = await seedStamp2({
       descriptorPath: need(this.descriptor, "--descriptor"),
       credential: credential2,
       subscriptionId: need(this.subscription, "--subscription"),
@@ -21672,9 +21727,9 @@ var PlatformSeedStampCommand = class extends M8tCommand {
       onProgress
     });
     if (mode === "json") {
-      this.context.stdout.write(renderJson(result) + "\n");
+      this.context.stdout.write(renderJson(result2) + "\n");
     } else {
-      this.context.stdout.write(`${result.outcome}: ${result.platformVersion} (storage ${result.storageAccount})
+      this.context.stdout.write(`${result2.outcome}: ${result2.platformVersion} (storage ${result2.storageAccount})
 `);
     }
     return 0;
@@ -21768,9 +21823,9 @@ var PlatformStampBuildCommand = class extends M8tCommand {
       ...priorComponents?.brainSeeds ? { brainSeeds: priorComponents.brainSeeds } : {}
     });
     await writeStamp({ ...ctx, stamp, onProgress });
-    const result = { platformVersion: stamp.platformVersion, previous: previousPlatformVersion, storageAccount: accountName };
+    const result2 = { platformVersion: stamp.platformVersion, previous: previousPlatformVersion, storageAccount: accountName };
     this.context.stdout.write(
-      mode === "json" ? renderJson(result) + "\n" : `platform stamp: ${result.platformVersion} (previous ${result.previous ?? "none"}, storage ${result.storageAccount})
+      mode === "json" ? renderJson(result2) + "\n" : `platform stamp: ${result2.platformVersion} (previous ${result2.previous ?? "none"}, storage ${result2.storageAccount})
 `
     );
     return 0;
@@ -21865,23 +21920,23 @@ var PlatformPolicyCommand = class extends M8tCommand {
     if (typeof this.set === "string" && this.set.length > 0) {
       const policy = buildPolicy(this.set, (/* @__PURE__ */ new Date()).toISOString(), "cli");
       await writePolicy({ ...ctx, policy, onProgress });
-      const result2 = { mode: policy.mode, updatedAt: policy.updatedAt };
-      this.context.stdout.write(mode === "json" ? renderJson(result2) + "\n" : `update policy: ${policy.mode}
+      const result3 = { mode: policy.mode, updatedAt: policy.updatedAt };
+      this.context.stdout.write(mode === "json" ? renderJson(result3) + "\n" : `update policy: ${policy.mode}
 `);
       return 0;
     }
     const current = await readPolicy(ctx);
     if (current.source === "unreadable") {
-      const result2 = { outcome: "unreadable" };
+      const result3 = { outcome: "unreadable" };
       this.context.stdout.write(
-        mode === "json" ? renderJson(result2) + "\n" : `update policy: could not be read \u2014 the current setting is unknown; do not assume it is on the default (${DEFAULT_POLICY_MODE}).
+        mode === "json" ? renderJson(result3) + "\n" : `update policy: could not be read \u2014 the current setting is unknown; do not assume it is on the default (${DEFAULT_POLICY_MODE}).
 `
       );
       return 0;
     }
-    const result = current.source === "explicit" ? { mode: current.policy.mode, outcome: "explicit" } : { mode: DEFAULT_POLICY_MODE, outcome: "absent" };
+    const result2 = current.source === "explicit" ? { mode: current.policy.mode, outcome: "explicit" } : { mode: DEFAULT_POLICY_MODE, outcome: "absent" };
     this.context.stdout.write(
-      mode === "json" ? renderJson(result) + "\n" : `update policy: ${result.mode}${result.outcome === "absent" ? " (default \u2014 never set)" : ""}
+      mode === "json" ? renderJson(result2) + "\n" : `update policy: ${result2.mode}${result2.outcome === "absent" ? " (default \u2014 never set)" : ""}
 `
     );
     return 0;
@@ -22545,8 +22600,8 @@ async function runWhatIf(opts) {
     "--output",
     "json"
   ]);
-  const result = JSON.parse(out);
-  return result.changes ?? [];
+  const result2 = JSON.parse(out);
+  return result2.changes ?? [];
 }
 var fmt = (c) => `  \u2022 ${c.resourceType} ${c.path}: ${JSON.stringify(c.before ?? null)} \u2192 ${JSON.stringify(c.after ?? null)}${c.reason ? `   [${c.reason}]` : ""}`;
 function reportWhatIf(r, opts) {
@@ -22734,6 +22789,9 @@ var DeployCommand = class extends M8tCommand {
     const log = (msg) => {
       if (mode !== "json") this.context.stdout.write(msg + "\n");
     };
+    const warnings = makeWarningSink((m) => {
+      log(colors.dim(m));
+    });
     if (this.whatIf) {
       try {
         if (this.subscription) {
@@ -22811,6 +22869,11 @@ var DeployCommand = class extends M8tCommand {
     }
     log(this.clientId ? `using existing app reg ${this.clientId}` : "ensuring Entra app reg\u2026");
     const app = await ensureAppReg({ tenantId: account.tenantId, clientId: this.clientId });
+    if (app.appObjectId === null && this.clientId) {
+      warnings.add(
+        "BYO app reg - Expose-an-API was not verified or configured (Graph writes are skipped for a supplied --client-id); if sign-in fails, configure identifierUris + a user_impersonation scope + Azure CLI pre-authorization per deploy/operator-app-registration-setup.md."
+      );
+    }
     await writeFoundryConfig({ tenantId: app.tenantId, clientId: app.clientId, projectEndpoint: foundryEndpoint });
     log(`ensuring resource group ${this.resourceGroup}\u2026`);
     await ensureResourceGroup(this.resourceGroup, this.location);
@@ -22863,14 +22926,20 @@ var DeployCommand = class extends M8tCommand {
     if (writableAppObjectId) {
       await patchRedirectUris(writableAppObjectId, outputs.containerAppFqdn);
     } else {
-      log(colors.dim(
-        `  (could not register the sign-in redirect URI automatically \u2014 add https://${outputs.containerAppFqdn} as an SPA redirect URI on app registration ${app.clientId}, or sign-in will fail with AADSTS50011)`
-      ));
+      warnings.add(
+        `could not register the sign-in redirect URI automatically \u2014 add https://${outputs.containerAppFqdn} as an SPA redirect URI on app registration ${app.clientId}, or sign-in will fail with AADSTS50011`
+      );
     }
     const webappUrl = `https://${outputs.containerAppFqdn}`;
     if (mode === "json") {
       this.context.stdout.write(
-        renderJson({ webapp: webappUrl, resourceGroup: this.resourceGroup, clientId: app.clientId, resources: outputs.resourceNames }) + "\n"
+        renderJson(buildDeployResult({
+          webappUrl,
+          resourceGroup: this.resourceGroup,
+          clientId: app.clientId,
+          resourceNames: outputs.resourceNames,
+          warnings: warnings.list()
+        })) + "\n"
       );
       return 0;
     }
@@ -23624,8 +23693,12 @@ function checkDataPlane(probe) {
     return {
       name: "foundry data-plane",
       status: "FAIL",
-      detail: `HTTP ${probe.status.toString()} \u2014 your identity lacks a data-plane role on the Foundry account`,
-      remediation: `az role assignment create --assignee-object-id ${oid} --assignee-principal-type User --role "Cognitive Services User" --scope ${scope}`
+      // Subscription Owner is the natural assumption and it is wrong: reading and
+      // invoking agents are dataActions, and control-plane roles carry none.
+      detail: `HTTP ${probe.status.toString()} \u2014 your identity lacks a data-plane role on the Foundry account (subscription Owner does not grant one)`,
+      // "Foundry User", not a Cognitive Services role: Microsoft's guidance is that
+      // Cognitive Services roles are for AI Services resources, not Foundry projects.
+      remediation: `m8t prereqs --fix   (or by hand: az role assignment create --assignee-object-id ${oid} --assignee-principal-type User --role "Foundry User" --scope ${scope})`
     };
   }
   return {
@@ -23634,6 +23707,24 @@ function checkDataPlane(probe) {
     detail: `HTTP ${probe.status !== 0 ? probe.status.toString() : "(unreachable)"} \u2014 unexpected; re-run with --verbose`
   };
 }
+function checkKeyVaultSecrets(probe) {
+  if (probe.status >= 200 && probe.status < 300) {
+    return { name: "key vault secrets", status: "PASS", detail: `HTTP ${probe.status.toString()}` };
+  }
+  if (probe.status === 401 || probe.status === 403) {
+    return {
+      name: "key vault secrets",
+      status: "FAIL",
+      detail: `HTTP ${probe.status.toString()} \u2014 you cannot read the platform Key Vault, so worker deploys will fail. This is a permanent permission gap, not a transient blip.`,
+      remediation: `m8t prereqs --fix   (or by hand: az role assignment create --assignee-object-id ${probe.oid ?? "<your-object-id>"} --assignee-principal-type User --role "Key Vault Secrets User" --scope ${probe.kvScope ?? "<key-vault-resource-id>"})`
+    };
+  }
+  return {
+    name: "key vault secrets",
+    status: "INFO",
+    detail: probe.status === 0 ? "skipped \u2014 could not reach the platform Key Vault" : `HTTP ${probe.status.toString()} \u2014 unexpected`
+  };
+}
 function checkDeliveryGrant(probes) {
   const withDelivery = probes.filter((p) => p.hasDeliveryEnv);
   if (withDelivery.length === 0) {
@@ -23756,7 +23847,180 @@ function checkLegacyStateDir(probe) {
 init_foundry_agent_get();
 init_foundry_agents();
 init_rbac();
-async function resolveFoundryAccountId(endpoint) {
+
+// src/lib/prereq-probes.ts
+init_rbac();
+var FOUNDRY_SCOPE4 = "https://ai.azure.com/.default";
+var KV_SCOPE = "https://vault.azure.net/.default";
+var AGENTS_API = "v1";
+var COGNITIVE_SERVICES_USER_ROLE_ID = "a97b65f3-24c7-4388-baec-2e87135dc908";
+var FOUNDRY_DATA_PLANE_ROLE_IDS = [FOUNDRY_USER_ROLE_ID, COGNITIVE_SERVICES_USER_ROLE_ID];
+async function probeProviders(namespaces, subscriptionId) {
+  return Promise.all(
+    namespaces.map(async (namespace) => {
+      try {
+        const args = ["provider", "show", "--namespace", namespace, "--query", "registrationState", "-o", "tsv"];
+        if (subscriptionId) args.push("--subscription", subscriptionId);
+        const out = (await runAz(args)).trim();
+        return { namespace, state: out && out !== "None" ? out : null };
+      } catch {
+        return { namespace, state: null };
+      }
+    })
+  );
+}
+async function registerProviders(namespaces, opts = {}) {
+  const attempts = opts.attempts ?? 20;
+  const sleepMs = opts.sleepMs ?? 5e3;
+  for (const namespace of namespaces) {
+    try {
+      const args = ["provider", "register", "--namespace", namespace, "--only-show-errors"];
+      if (opts.subscriptionId) args.push("--subscription", opts.subscriptionId);
+      await runAz(args);
+    } catch {
+      continue;
+    }
+    for (let i = 1; i <= attempts; i++) {
+      const [state] = await probeProviders([namespace], opts.subscriptionId);
+      if (state.state?.toLowerCase() === "registered") break;
+      opts.onProgress?.(`registering ${namespace} (${i.toString()}/${attempts.toString()})\u2026`);
+      if (sleepMs > 0) await new Promise((r) => setTimeout(r, sleepMs));
+    }
+  }
+}
+async function probeModelQuota(region, model) {
+  const usages = await listModelQuota(region);
+  const { verdict, quotad } = modelQuotaVerdict(usages, model);
+  return { verdict, quotad, model, region, usagesReadable: usages.length > 0 };
+}
+async function bearer(credential2, scope) {
+  try {
+    const t = await credential2.getToken(scope);
+    return t?.token ?? null;
+  } catch {
+    return null;
+  }
+}
+async function hasRoleAtScope(credential2, scope, principalId, roleIds) {
+  try {
+    const token = await bearer(credential2, "https://management.azure.com/.default");
+    if (!token) return null;
+    const url = `https://management.azure.com${scope}/providers/Microsoft.Authorization/roleAssignments?api-version=2022-04-01&$filter=${encodeURIComponent(`principalId eq '${principalId}'`)}`;
+    const res = await fetch(url, { headers: { Authorization: `Bearer ${token}` } });
+    if (!res.ok) return null;
+    const body = await res.json();
+    return (body.value ?? []).some(
+      (a) => roleIds.some((id) => (a.properties?.roleDefinitionId ?? "").toLowerCase().endsWith(id.toLowerCase()))
+    );
+  } catch {
+    return null;
+  }
+}
+async function probeFoundryAccess(args) {
+  const base = {
+    scope: args.accountId,
+    principalId: args.principalId,
+    isSelf: args.isSelf
+  };
+  if (args.isSelf) {
+    const token = await bearer(args.credential, FOUNDRY_SCOPE4);
+    if (!token) return { ...base, evidence: "unavailable" };
+    try {
+      const res = await fetch(`${args.projectEndpoint}/agents?api-version=${AGENTS_API}`, {
+        headers: { Authorization: `Bearer ${token}` }
+      });
+      return { ...base, evidence: "probe", status: res.status };
+    } catch {
+      return { ...base, evidence: "unavailable" };
+    }
+  }
+  if (!args.accountId || !args.principalId) return { ...base, evidence: "unavailable" };
+  const granted = await hasRoleAtScope(args.credential, args.accountId, args.principalId, FOUNDRY_DATA_PLANE_ROLE_IDS);
+  if (granted === null) return { ...base, evidence: "unavailable" };
+  return { ...base, evidence: "assignment", granted };
+}
+async function probeKeyVaultAccess(args) {
+  const base = {
+    scope: args.kvResourceId ?? args.kvUri,
+    principalId: args.principalId,
+    isSelf: args.isSelf
+  };
+  if (args.isSelf) {
+    if (!args.kvUri) return { ...base, evidence: "unavailable" };
+    const token = await bearer(args.credential, KV_SCOPE);
+    if (!token) return { ...base, evidence: "unavailable" };
+    try {
+      const url = `${args.kvUri.replace(/\/$/, "")}/secrets?api-version=7.4&maxresults=1`;
+      const res = await fetch(url, { headers: { Authorization: `Bearer ${token}` } });
+      return { ...base, evidence: "probe", status: res.status };
+    } catch {
+      return { ...base, evidence: "unavailable" };
+    }
+  }
+  if (!args.kvResourceId || !args.principalId) return { ...base, evidence: "unavailable" };
+  const granted = await hasRoleAtScope(args.credential, args.kvResourceId, args.principalId, [KV_SECRETS_USER_ROLE_ID]);
+  if (granted === null) return { ...base, evidence: "unavailable" };
+  return { ...base, evidence: "assignment", granted };
+}
+async function probeRedirectUri(clientId, gatewayUrl) {
+  if (!clientId) return { registeredUris: null, gatewayUrl, clientId };
+  try {
+    const out = await runAz(["ad", "app", "show", "--id", clientId, "--query", "spa.redirectUris", "-o", "json"]);
+    return { registeredUris: JSON.parse(out), gatewayUrl, clientId };
+  } catch {
+    return { registeredUris: null, gatewayUrl, clientId };
+  }
+}
+async function resolveFoundryAccountId(projectEndpoint) {
+  const m = /^https:\/\/([^.]+)\./.exec(projectEndpoint);
+  if (!m) return null;
+  try {
+    const out = await runAz(["cognitiveservices", "account", "list", "--query", `[?name=='${m[1]}'].id`, "-o", "json"]);
+    return JSON.parse(out)[0] ?? null;
+  } catch {
+    return null;
+  }
+}
+async function resolvePlatformKeyVault(resourceGroup, subscriptionId) {
+  try {
+    const args = ["keyvault", "list", "-g", resourceGroup, "--query", "[0].{uri:properties.vaultUri,id:id}", "-o", "json"];
+    if (subscriptionId) args.push("--subscription", subscriptionId);
+    const parsed = JSON.parse(await runAz(args));
+    return parsed?.uri && parsed.id ? { uri: parsed.uri, id: parsed.id } : null;
+  } catch {
+    return null;
+  }
+}
+async function resolvePrincipalObjectId(who) {
+  if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(who)) {
+    const asUser = await runAz(["ad", "user", "show", "--id", who, "--query", "id", "-o", "tsv"]).catch(() => "");
+    if (asUser.trim()) return asUser.trim();
+    return who;
+  }
+  const out = await runAz(["ad", "user", "show", "--id", who, "--query", "id", "-o", "tsv"]).catch(() => "");
+  return out.trim() || null;
+}
+async function fixFoundryAccess(args) {
+  await grantFoundryUser({
+    credential: args.credential,
+    subscriptionId: args.subscriptionId,
+    accountScope: args.accountId,
+    principalId: args.principalId,
+    principalType: "User"
+  });
+}
+async function fixKeyVaultAccess(args) {
+  await grantKeyVaultSecretsUser({
+    credential: args.credential,
+    subscriptionId: args.subscriptionId,
+    kvScope: args.kvResourceId,
+    principalId: args.principalId,
+    principalType: "User"
+  });
+}
+
+// src/commands/doctor.ts
+async function resolveFoundryAccountId2(endpoint) {
   const m = /^https:\/\/([^.]+)\.services\.ai\.azure\.com/.exec(endpoint);
   if (!m) return null;
   try {
@@ -23887,8 +24151,12 @@ var DoctorCommand = class extends M8tCommand {
     emit(checkLegacyStateDir(probeLegacyStateDir()));
     checking("gateway");
     let gw = { ok: false, detail: "not probed" };
+    let platformRg = null;
+    let platformSub = null;
     try {
       const ctx = await resolveGatewayContext({ interactive: false, resourceGroup: this.resourceGroup });
+      platformRg = ctx.containerAppResourceId.split("/resourceGroups/")[1]?.split("/")[0] ?? null;
+      platformSub = ctx.subscriptionId;
       const token = await getBearerToken(ctx.gatewayClientId);
       const res = await fetch(`${ctx.gatewayUrl}/api/me`, {
         headers: { Authorization: `Bearer ${token}` }
@@ -23910,9 +24178,24 @@ var DoctorCommand = class extends M8tCommand {
       } catch {
         status = 0;
       }
-      const foundryAccountId = await resolveFoundryAccountId(foundry.projectEndpoint);
+      const foundryAccountId = await resolveFoundryAccountId2(foundry.projectEndpoint);
       const oid = await getCallerObjectId().catch(() => null);
       emit(checkDataPlane({ status, foundryAccountId, oid }));
+      checking("key vault secrets");
+      const kv = platformRg ? await resolvePlatformKeyVault(platformRg, platformSub ?? void 0) : null;
+      let kvStatus = 0;
+      if (kv) {
+        try {
+          const token = await new DefaultAzureCredential22().getToken("https://vault.azure.net/.default");
+          const res = await fetch(`${kv.uri.replace(/\/$/, "")}/secrets?api-version=7.4&maxresults=1`, {
+            headers: { Authorization: `Bearer ${token.token}` }
+          });
+          kvStatus = res.status;
+        } catch {
+          kvStatus = 0;
+        }
+      }
+      emit(checkKeyVaultSecrets({ status: kvStatus, kvScope: kv?.id ?? null, oid }));
       checking("model capacity");
       const deployments = foundryAccountId ? await listModelDeployments(foundryAccountId) : [];
       emit(checkReasoningCapacity(deployments));
@@ -23965,66 +24248,773 @@ var DoctorCommand = class extends M8tCommand {
   }
 };
 
-// src/commands/switch.ts
+// src/commands/prereqs.ts
 import { Command as Command47, Option as Option44 } from "clipanion";
+init_errors();
 
-// src/lib/profiles.ts
-import * as fs27 from "fs/promises";
-import * as path29 from "path";
-import { parse as parseYaml11, stringify as stringifyYaml4 } from "yaml";
-function profilesDir() {
-  const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return path29.join(home, ".m8t", "profiles");
-}
-function getProfilePath(name) {
-  return path29.join(profilesDir(), `${path29.basename(name)}.yaml`);
-}
-function slugifyTenant(domainOrId) {
-  const base = domainOrId.split(".")[0].toLowerCase();
-  const slug = base.replace(/[^a-z0-9-]/g, "");
-  return slug.length > 0 ? slug : "profile";
-}
-async function listProfiles() {
-  try {
-    const entries = await fs27.readdir(profilesDir());
-    return entries.filter((e) => e.endsWith(".yaml")).map((e) => e.replace(/\.yaml$/, "")).sort();
-  } catch (e) {
-    if (e.code === "ENOENT") return [];
-    throw e;
-  }
-}
-async function readProfile(name) {
-  try {
-    const raw = await fs27.readFile(getProfilePath(name), "utf8");
-    const parsed = parseYaml11(raw);
-    if (!parsed || typeof parsed !== "object") return null;
-    return parsed;
-  } catch (e) {
-    if (e.code === "ENOENT") return null;
-    throw e;
-  }
+// src/lib/prereq-deps.ts
+import { DefaultAzureCredential as DefaultAzureCredential23 } from "@azure/identity";
+
+// src/lib/bootstrap-preflight.ts
+var ADMIN_DIRECTORY_ROLES = ["Global Administrator", "Application Administrator", "Cloud Application Administrator"];
+async function checkSubScopeAdmin(callerObjectId, subscriptionId) {
+  const rows = JSON.parse(await runAz([
+    "role",
+    "assignment",
+    "list",
+    "--assignee",
+    callerObjectId,
+    "--scope",
+    `/subscriptions/${subscriptionId}`,
+    "--include-inherited",
+    "--query",
+    "[].{roleDefinitionName: roleDefinitionName}",
+    "-o",
+    "json"
+  ]));
+  const hit = rows.find((r) => r.roleDefinitionName === "Owner" || r.roleDefinitionName === "User Access Administrator");
+  return { ok: Boolean(hit), role: hit?.roleDefinitionName };
 }
-async function exists(p) {
+async function checkAppRegCapability(callerObjectId) {
+  let roles;
   try {
-    await fs27.stat(p);
-    return true;
+    roles = JSON.parse(await runAz([
+      "rest",
+      "--method",
+      "GET",
+      "--url",
+      `https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments?$filter=principalId eq '${callerObjectId}'&$expand=roleDefinition`,
+      "--query",
+      "value[].roleDefinition.displayName",
+      "-o",
+      "json"
+    ]));
   } catch {
-    return false;
+    roles = null;
   }
+  if (roles === null) return { ok: false, inconclusive: true };
+  return { ok: roles.some((r) => ADMIN_DIRECTORY_ROLES.includes(r)), inconclusive: false };
 }
-async function saveProfile(p) {
-  await fs27.mkdir(profilesDir(), { recursive: true });
-  let name = p.name;
-  let n = 2;
-  while (await exists(getProfilePath(name))) {
-    name = `${p.name}-${n.toString()}`;
-    n++;
-  }
-  const target = getProfilePath(name);
-  const tmp = `${target}.tmp`;
-  await fs27.writeFile(tmp, stringifyYaml4({ ...p, name }, { indent: 2 }), "utf8");
-  await fs27.rename(tmp, target);
-  return name;
+async function registerContainerInstance(subscriptionId) {
+  await runAz(["provider", "register", "--namespace", "Microsoft.ContainerInstance", "--subscription", subscriptionId, "--only-show-errors"]);
+}
+function buildPreflightBanner(who) {
+  return [
+    "\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557",
+    "\u2551  \u26D4  STOP \u2014 READ THIS BEFORE CONTINUING                                 \u2551",
+    "\u2551                                                                        \u2551",
+    "\u2551  Installing m8t creates real Azure resources in YOUR            \u2551",
+    "\u2551  subscription and assigns roles. To do that, the account you just     \u2551",
+    "\u2551  signed in with MUST be:                                              \u2551",
+    "\u2551                                                                        \u2551",
+    "\u2551    \u2022 OWNER or USER ACCESS ADMINISTRATOR at the subscription scope     \u2551",
+    "\u2551      (it has to create a managed identity and assign it roles), AND   \u2551",
+    "\u2551    \u2022 a directory admin able to register one Entra app                 \u2551",
+    "\u2551      (Application / Cloud Application / Global Administrator)          \u2551",
+    "\u2551      \u2014 OR you supply a ready app registration with --client-id.       \u2551",
+    "\u2551                                                                        \u2551",
+    "\u2551  If you are NOT this, this install CANNOT proceed and will STOP NOW.  \u2551",
+    "\u2551  Nothing has been created yet. Get an admin to run this, or ask one   \u2551",
+    "\u2551  for an app registration id (--client-id <appId>) and try again.      \u2551",
+    "\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D",
+    "",
+    `Signed in as:  ${who.upn}   (tenant ${who.tenantId}, sub ${who.subscriptionId})`,
+    ""
+  ].join("\n");
+}
+
+// src/lib/prereq-deps.ts
+var INSTALL_REASONING_MODEL = "gpt-5.4";
+function buildPrereqDeps(opts = {}) {
+  let credentialSingleton2 = null;
+  return {
+    getAzAccount: () => getAzAccount().catch(() => null),
+    getCallerObjectId: () => getCallerObjectId().catch(() => null),
+    checkSubScopeAdmin,
+    checkAppRegCapability,
+    probeProviders,
+    registerProviders,
+    probeModelQuota,
+    discoverPlatform: async () => {
+      const cfg = await readFoundryConfig();
+      const d = await discoverGateway({
+        interactive: false,
+        ...opts.resourceGroup ? { resourceGroup: opts.resourceGroup } : {},
+        ...opts.subscription ? { subscriptionId: opts.subscription } : {}
+      });
+      return {
+        gatewayUrl: d.gatewayUrl,
+        gatewayClientId: d.gatewayClientId,
+        subscriptionId: d.subscriptionId,
+        resourceGroup: d.containerAppResourceId.split("/resourceGroups/")[1]?.split("/")[0] ?? "",
+        // The DEPLOYMENT is the authority, local config only a fallback. A
+        // teammate joining a platform someone else installed has no
+        // ~/.m8t/config.yaml at all — reading it first left the single most
+        // important check reporting "could not determine" for exactly the person
+        // this feature exists to serve.
+        projectEndpoint: d.projectEndpoint ?? cfg?.projectEndpoint ?? null
+      };
+    },
+    isNoPlatformError: (e) => e.code === "GATEWAY_DISCOVERY_ZERO",
+    resolveFoundryAccountId,
+    resolvePlatformKeyVault,
+    resolvePrincipalObjectId,
+    probeFoundryAccess,
+    probeKeyVaultAccess,
+    probeRedirectUri,
+    fixFoundryAccess,
+    fixKeyVaultAccess,
+    credential: () => credentialSingleton2 ??= new DefaultAzureCredential23()
+  };
+}
+
+// src/lib/prereqs.ts
+var PREREQS = [
+  // ── install phase ────────────────────────────────────────────────────────
+  {
+    slug: "local-tooling",
+    phase: "install",
+    title: "git, Azure CLI, Node 20+, and the m8t CLI on your machine",
+    breaks: "Nothing can run at all.",
+    coverage: "auto",
+    checkedBy: "runbook",
+    fixable: false
+  },
+  {
+    slug: "az-signed-in",
+    phase: "install",
+    title: "Signed in to Azure with an active subscription",
+    breaks: "Every Azure call fails immediately.",
+    coverage: "refuses",
+    checkedBy: "prereqs",
+    fixable: false
+  },
+  {
+    slug: "subscription-admin",
+    phase: "install",
+    title: "Owner or User Access Administrator at subscription scope",
+    breaks: "The install cannot create its managed identity or assign it roles.",
+    coverage: "refuses",
+    checkedBy: "prereqs",
+    fixable: false
+  },
+  {
+    slug: "app-registration",
+    phase: "install",
+    title: "Directory rights to register one Entra app (or a ready --client-id)",
+    breaks: "There is no app registration, so nobody can ever sign in to the webapp.",
+    coverage: "refuses",
+    checkedBy: "prereqs",
+    fixable: false
+  },
+  {
+    slug: "resource-providers",
+    phase: "install",
+    title: "Every Azure resource provider the install uses is registered",
+    breaks: "The installer dies partway through creating resources, with an error that names a provider rather than anything actionable.",
+    coverage: "refuses",
+    checkedBy: "prereqs",
+    fixable: true
+  },
+  {
+    slug: "model-quota",
+    phase: "install",
+    title: "Model quota for the reasoning model in the target region",
+    breaks: "The install spends money creating resources and then cannot deploy the model the workers need.",
+    coverage: "refuses",
+    checkedBy: "prereqs",
+    fixable: false
+  },
+  {
+    slug: "github-org",
+    phase: "install",
+    title: "A GitHub organization and the rights to install an App on it",
+    breaks: "The brain-backed workers have nowhere to keep their memory.",
+    coverage: "refuses",
+    checkedBy: "runbook",
+    fixable: false
+  },
+  {
+    slug: "azure-policy",
+    phase: "install",
+    title: "No Azure Policy or deny assignment blocking resource creation",
+    breaks: "The installer is refused by governance partway through, with a policy error.",
+    coverage: "unhandled",
+    checkedBy: "none",
+    fixable: false
+  },
+  {
+    slug: "region-eligibility",
+    phase: "install",
+    title: "The target region can host every service the platform uses",
+    breaks: "A resource fails to create in that region partway through the install.",
+    coverage: "unhandled",
+    checkedBy: "none",
+    fixable: false
+  },
+  {
+    slug: "soft-deleted-account",
+    phase: "install",
+    title: "No soft-deleted Cognitive Services account still holding the model quota",
+    breaks: "Quota looks free but the model deployment fails; the quota is held by an account you already deleted.",
+    coverage: "unhandled",
+    checkedBy: "none",
+    fixable: false
+  },
+  {
+    slug: "subscription-billing",
+    phase: "install",
+    title: "The subscription is active and can be billed",
+    breaks: "Resource creation is refused for billing reasons.",
+    coverage: "unhandled",
+    checkedBy: "none",
+    fixable: false
+  },
+  // ── usage phase ──────────────────────────────────────────────────────────
+  {
+    slug: "platform-discoverable",
+    phase: "usage",
+    title: "The m8t CLI can find the platform you are pointed at",
+    breaks: "Every CLI command that talks to the platform fails to find it.",
+    coverage: "refuses",
+    checkedBy: "prereqs",
+    fixable: false
+  },
+  {
+    slug: "signin-redirect-uri",
+    phase: "usage",
+    title: "The webapp's sign-in redirect URI is registered on the app",
+    breaks: "Sign-in fails with AADSTS50011 on a platform that is otherwise perfectly healthy.",
+    coverage: "auto",
+    checkedBy: "prereqs",
+    // Reported, not repaired. The app registration is shared across every
+    // deployment in the tenant; writing it belongs to the install.
+    fixable: false
+  },
+  {
+    slug: "foundry-data-plane",
+    phase: "usage",
+    title: "Your account can reach the Foundry data plane",
+    breaks: "Your AI team will not load, chat does not work, and the CLI and coding-agent plugin cannot reach your workers. Subscription Owner does NOT cover this \u2014 it is a data action, and control-plane roles carry none.",
+    coverage: "auto",
+    checkedBy: "prereqs",
+    fixable: true
+  },
+  {
+    slug: "keyvault-secrets",
+    phase: "usage",
+    title: "Your account can read the platform's Key Vault secrets",
+    breaks: "Deploying a worker fails \u2014 the coding agent and the Azure executor both read the vault as you.",
+    coverage: "auto",
+    checkedBy: "prereqs",
+    fixable: true
+  },
+  {
+    slug: "local-state",
+    phase: "usage",
+    title: "Local state the coding-agent plugin needs (~/.m8t/repo-root, config)",
+    breaks: "The m8t plugin cannot list or reach your workers from an agent session.",
+    coverage: "warns",
+    checkedBy: "doctor",
+    fixable: false
+  }
+];
+function prereqsForPhase(phase) {
+  return PREREQS.filter((p) => p.phase === phase);
+}
+function prereqBySlug(slug) {
+  return PREREQS.find((p) => p.slug === slug);
+}
+function spec(slug) {
+  const s = prereqBySlug(slug);
+  if (!s) throw new Error(`unknown prereq slug: ${slug}`);
+  return s;
+}
+function result(slug, status, detail, remedy) {
+  const s = spec(slug);
+  return { slug: s.slug, phase: s.phase, title: s.title, status, detail, ...remedy ? { remedy } : {} };
+}
+var REQUIRED_PROVIDERS = [
+  "Microsoft.ContainerInstance",
+  // the installer job itself
+  "Microsoft.ManagedIdentity",
+  // installer MI + gateway user-assigned identity
+  "Microsoft.CognitiveServices",
+  // Foundry account, project, model deployments
+  "Microsoft.App",
+  // Container Apps environment, gateway, updater job
+  "Microsoft.OperationalInsights",
+  // Log Analytics workspace
+  "Microsoft.Storage",
+  // status blob + platform tables/blobs
+  "Microsoft.KeyVault",
+  // platform secrets
+  "Microsoft.ServiceBus",
+  // gateway queues
+  "Microsoft.Insights",
+  // Application Insights
+  "Microsoft.ContainerRegistry"
+  // hosted-agent image staging
+];
+function evaluateProviders(states) {
+  if (states.length === 0) {
+    return result("resource-providers", "skipped", "no provider registration state could be read \u2014 proceeding unverified");
+  }
+  const unreadable = states.filter((s) => s.state === null).map((s) => s.namespace);
+  const unregistered = states.filter((s) => s.state !== null && s.state.toLowerCase() !== "registered" && s.state.toLowerCase() !== "registering").map((s) => s.namespace);
+  const registering = states.filter((s) => s.state?.toLowerCase() === "registering").map((s) => s.namespace);
+  if (unregistered.length > 0) {
+    return result(
+      "resource-providers",
+      "fail",
+      `not registered on this subscription: ${unregistered.join(", ")}`,
+      unregistered.map((ns) => `az provider register --namespace ${ns}`).join("\n        ")
+    );
+  }
+  if (registering.length > 0) {
+    return result("resource-providers", "warn", `still registering: ${registering.join(", ")} \u2014 this resolves on its own, usually within a minute`);
+  }
+  if (unreadable.length > 0) {
+    return result("resource-providers", "skipped", `could not read registration state for: ${unreadable.join(", ")} \u2014 proceeding unverified`);
+  }
+  return result("resource-providers", "pass", `all ${states.length.toString()} required providers registered`);
+}
+function evaluateModelQuota(e) {
+  if (!e.usagesReadable) {
+    return result("model-quota", "skipped", `could not read model quota in ${e.region} \u2014 proceeding unverified`);
+  }
+  if (e.verdict === "no_quota") {
+    const alt = e.quotad.length > 0 ? ` Models with quota there: ${e.quotad.join(", ")}.` : "";
+    return result(
+      "model-quota",
+      "fail",
+      `${e.model} has zero quota in ${e.region}.${alt}`,
+      `Request quota for ${e.model} in ${e.region} in the Azure portal (Foundry \u2192 Quotas), or install into a region that already has it.`
+    );
+  }
+  if (e.verdict === "unknown") {
+    return result("model-quota", "warn", `no quota entry for ${e.model} in ${e.region} \u2014 cannot confirm; the install will report honestly if it is missing`);
+  }
+  return result("model-quota", "pass", `${e.model} has quota in ${e.region}`);
+}
+function evaluateAzSignedIn(account) {
+  if (!account) return result("az-signed-in", "fail", "not signed in to Azure", "az login");
+  return result("az-signed-in", "pass", `${account.upn} (tenant ${account.tenantId}, subscription ${account.subscriptionId})`);
+}
+function evaluateSubscriptionAdmin(probe) {
+  if (!probe.ok) {
+    return result(
+      "subscription-admin",
+      "fail",
+      "you are not Owner or User Access Administrator at subscription scope",
+      "Ask a subscription Owner to run the install \u2014 creating and granting the installer's managed identity is unavoidable."
+    );
+  }
+  return result("subscription-admin", "pass", `${probe.role ?? "Owner/User Access Administrator"} at subscription scope`);
+}
+function evaluateAppRegistration(probe, clientId) {
+  if (clientId) return result("app-registration", "pass", `using your app registration ${clientId}`);
+  if (probe.inconclusive) {
+    return result(
+      "app-registration",
+      "fail",
+      "could not verify your directory admin role (Microsoft Graph denied the read \u2014 common for guest accounts)",
+      "Re-run with --client-id <appId> using an app registration an admin prepared for you."
+    );
+  }
+  if (!probe.ok) {
+    return result(
+      "app-registration",
+      "fail",
+      "you do not hold a directory admin role (Application / Cloud Application / Global Administrator)",
+      "Re-run with --client-id <appId> using an app registration an admin prepared for you."
+    );
+  }
+  return result("app-registration", "pass", "you can register the m8t app in this directory");
+}
+function grantRemedy(slug, p) {
+  const target = p.isSelf ? "m8t prereqs --fix" : `m8t prereqs --fix --for ${p.principalId ?? "<user>"}`;
+  const role = slug === "foundry-data-plane" ? "Foundry User" : "Key Vault Secrets User";
+  const scope = p.scope ?? `<${slug === "foundry-data-plane" ? "foundry-account" : "key-vault"}-resource-id>`;
+  return `${target}
+        or by hand: az role assignment create --assignee-object-id ${p.principalId ?? "<object-id>"} --assignee-principal-type User --role "${role}" --scope ${scope}`;
+}
+function evaluateFoundryAccess(p) {
+  const who = p.isSelf ? "your account" : "that account";
+  if (p.evidence === "unavailable") {
+    return result("foundry-data-plane", "skipped", `could not determine whether ${who} can reach the Foundry data plane`);
+  }
+  if (p.evidence === "probe") {
+    if (p.status !== void 0 && p.status >= 200 && p.status < 300) {
+      return result("foundry-data-plane", "pass", `${who} can reach the Foundry data plane (HTTP ${p.status.toString()})`);
+    }
+    if (p.status === 401 || p.status === 403) {
+      return result(
+        "foundry-data-plane",
+        "fail",
+        `${who} is missing a Foundry data-plane role on ${p.scope ?? "the Foundry account"} (HTTP ${p.status.toString()}). Subscription Owner does not cover this \u2014 reading and invoking agents are data actions, and control-plane roles carry none.`,
+        grantRemedy("foundry-data-plane", p)
+      );
+    }
+    return result("foundry-data-plane", "warn", `unexpected response from the Foundry data plane (HTTP ${(p.status ?? 0).toString()})`);
+  }
+  if (p.granted === true) {
+    return result("foundry-data-plane", "pass", `${who} holds a Foundry data-plane role on ${p.scope ?? "the Foundry account"}`);
+  }
+  return result(
+    "foundry-data-plane",
+    "fail",
+    `${who} holds no known Foundry data-plane role on ${p.scope ?? "the Foundry account"}. (Checked by role assignment, not by calling as them \u2014 a custom role granting the same data action would not be recognised here.)`,
+    grantRemedy("foundry-data-plane", p)
+  );
+}
+function evaluateKeyVaultAccess(p) {
+  const who = p.isSelf ? "your account" : "that account";
+  if (p.evidence === "unavailable") {
+    return result("keyvault-secrets", "skipped", `could not determine whether ${who} can read the platform Key Vault`);
+  }
+  if (p.evidence === "probe") {
+    if (p.status !== void 0 && p.status >= 200 && p.status < 300) {
+      return result("keyvault-secrets", "pass", `${who} can read secrets from ${p.scope ?? "the platform Key Vault"}`);
+    }
+    if (p.status === 401 || p.status === 403) {
+      return result(
+        "keyvault-secrets",
+        "fail",
+        `${who} cannot read secrets from ${p.scope ?? "the platform Key Vault"} (HTTP ${p.status.toString()}). Deploying a worker will fail \u2014 this is a permanent permission gap, not a transient blip.`,
+        grantRemedy("keyvault-secrets", p)
+      );
+    }
+    return result("keyvault-secrets", "warn", `unexpected response from the platform Key Vault (HTTP ${(p.status ?? 0).toString()})`);
+  }
+  if (p.granted === true) {
+    return result("keyvault-secrets", "pass", `${who} holds Key Vault Secrets User on ${p.scope ?? "the platform Key Vault"}`);
+  }
+  return result(
+    "keyvault-secrets",
+    "fail",
+    `${who} holds no secrets-read role on ${p.scope ?? "the platform Key Vault"}. (Checked by role assignment, not by calling as them.)`,
+    grantRemedy("keyvault-secrets", p)
+  );
+}
+function evaluateRedirectUri(p) {
+  if (!p.gatewayUrl) return result("signin-redirect-uri", "skipped", "no gateway URL resolved");
+  if (p.registeredUris === null) {
+    return result("signin-redirect-uri", "skipped", `could not read app registration ${p.clientId ?? "(unknown)"} \u2014 needs directory rights`);
+  }
+  const want = p.gatewayUrl.replace(/\/$/, "");
+  if (p.registeredUris.some((u) => u.replace(/\/$/, "") === want)) {
+    return result("signin-redirect-uri", "pass", `${want} is registered on the sign-in app`);
+  }
+  return result(
+    "signin-redirect-uri",
+    "fail",
+    `${want} is not a registered redirect URI \u2014 sign-in will fail with AADSTS50011`,
+    // Deliberately NOT "m8t prereqs --fix": this command reports it and does not
+    // write it. The app registration is shared across every deployment in the
+    // tenant, so the write belongs to the install, not to whoever is diagnosing.
+    `Re-run 'm8t bootstrap finish' (it registers this), or ask a directory admin to add it \u2014 MERGE, never overwrite:
+        az ad app update --id ${p.clientId ?? "<clientId>"} --set spa.redirectUris="['${want}']"`
+  );
+}
+function evaluatePlatformDiscoverable(p) {
+  if (p.gatewayUrl) return result("platform-discoverable", "pass", p.gatewayUrl);
+  return result(
+    "platform-discoverable",
+    "fail",
+    p.detail,
+    "m8t switch   (point this machine at the right tenant/subscription), or pass --resource-group if the subscription holds several deployments"
+  );
+}
+function summarize(phase, results) {
+  return {
+    phase,
+    ok: !results.some((r) => r.status === "fail"),
+    results,
+    unchecked: prereqsForPhase(phase).filter((p) => p.checkedBy === "none").map((p) => p.slug)
+  };
+}
+
+// src/lib/prereq-run.ts
+async function detectPhase(deps) {
+  try {
+    return await deps.discoverPlatform() ? "usage" : "install";
+  } catch (e) {
+    if (deps.isNoPlatformError(e)) return "install";
+    throw e;
+  }
+}
+async function runInstallPhase(deps, opts) {
+  const results = [];
+  const account = await deps.getAzAccount().catch(() => null);
+  results.push(evaluateAzSignedIn(account));
+  if (!account) return summarize("install", results);
+  const subscriptionId = opts.subscription ?? account.subscriptionId;
+  const oid = await deps.getCallerObjectId().catch(() => null);
+  if (oid) {
+    results.push(evaluateSubscriptionAdmin(await deps.checkSubScopeAdmin(oid, subscriptionId).catch(() => ({ ok: false }))));
+    results.push(
+      opts.clientId ? evaluateAppRegistration({ ok: true, inconclusive: false }, opts.clientId) : evaluateAppRegistration(await deps.checkAppRegCapability(oid).catch(() => ({ ok: false, inconclusive: true })))
+    );
+  }
+  if (opts.fix) {
+    const before = await deps.probeProviders(REQUIRED_PROVIDERS, subscriptionId);
+    const missing = before.filter((s) => s.state !== null && s.state.toLowerCase() !== "registered").map((s) => s.namespace);
+    if (missing.length > 0) {
+      opts.onProgress?.(`registering ${missing.length.toString()} resource provider(s)\u2026`);
+      await deps.registerProviders(missing, { subscriptionId, onProgress: opts.onProgress });
+    }
+  }
+  results.push(evaluateProviders(await deps.probeProviders(REQUIRED_PROVIDERS, subscriptionId)));
+  if (opts.region && opts.model) {
+    results.push(evaluateModelQuota(await deps.probeModelQuota(opts.region, opts.model)));
+  }
+  return summarize("install", results);
+}
+async function runUsagePhase(deps, opts) {
+  const results = [];
+  let platform = null;
+  try {
+    platform = await deps.discoverPlatform();
+  } catch (e) {
+    if (!deps.isNoPlatformError(e)) throw e;
+  }
+  results.push(
+    evaluatePlatformDiscoverable({
+      gatewayUrl: platform?.gatewayUrl ?? null,
+      detail: platform ? "" : "no m8t deployment found for this Azure session"
+    })
+  );
+  if (!platform) return summarize("usage", results);
+  const credential2 = deps.credential();
+  const selfOid = await deps.getCallerObjectId().catch(() => null);
+  const isSelf = !opts.forPrincipal;
+  const principalId = isSelf ? selfOid : await deps.resolvePrincipalObjectId(opts.forPrincipal ?? "").catch(() => null);
+  if (!isSelf && !principalId) {
+    throw new UnknownPrincipalError(opts.forPrincipal ?? "");
+  }
+  if (isSelf) {
+    results.push(evaluateRedirectUri(await deps.probeRedirectUri(platform.gatewayClientId, platform.gatewayUrl)));
+  }
+  const accountId = platform.projectEndpoint ? await deps.resolveFoundryAccountId(platform.projectEndpoint).catch(() => null) : null;
+  const kv = await deps.resolvePlatformKeyVault(platform.resourceGroup, platform.subscriptionId).catch(() => null);
+  const foundryProbe = async () => platform.projectEndpoint ? deps.probeFoundryAccess({ credential: credential2, projectEndpoint: platform.projectEndpoint, accountId, principalId, isSelf }) : null;
+  if (!platform.projectEndpoint) {
+    results.push(
+      evaluateFoundryAccess({ evidence: "unavailable", scope: null, principalId, isSelf })
+    );
+  }
+  let foundry = await foundryProbe();
+  if (opts.fix && foundry && needsGrant(foundry) && accountId && principalId) {
+    opts.onProgress?.("granting Foundry data-plane access\u2026");
+    await deps.fixFoundryAccess({ credential: credential2, subscriptionId: platform.subscriptionId, accountId, principalId });
+    results.push({ ...evaluateFoundryAccess(foundry), status: "fixed", detail: "granted Foundry User \u2014 allow up to a minute to take effect" });
+    foundry = null;
+  }
+  if (foundry) results.push(evaluateFoundryAccess(foundry));
+  let keyvault = await deps.probeKeyVaultAccess({
+    credential: credential2,
+    kvUri: kv?.uri ?? null,
+    kvResourceId: kv?.id ?? null,
+    principalId,
+    isSelf
+  });
+  if (opts.fix && needsGrant(keyvault) && kv && principalId) {
+    opts.onProgress?.("granting Key Vault secrets access\u2026");
+    await deps.fixKeyVaultAccess({ credential: credential2, subscriptionId: platform.subscriptionId, kvResourceId: kv.id, principalId });
+    results.push({ ...evaluateKeyVaultAccess(keyvault), status: "fixed", detail: "granted Key Vault Secrets User \u2014 allow up to a minute to take effect" });
+    keyvault = null;
+  }
+  if (keyvault) results.push(evaluateKeyVaultAccess(keyvault));
+  return summarize("usage", results);
+}
+var UnknownPrincipalError = class extends Error {
+  constructor(who) {
+    super(
+      `Could not find '${who}' in this directory. Pass the exact user principal name (e.g. alice@contoso.com) or their object id.`
+    );
+    this.who = who;
+    this.name = "UnknownPrincipalError";
+  }
+  who;
+};
+function needsGrant(p) {
+  if (p.evidence === "probe") return p.status === 401 || p.status === 403;
+  if (p.evidence === "assignment") return p.granted === false;
+  return false;
+}
+async function runPrereqs(deps, opts) {
+  const phase = opts.phase ?? await detectPhase(deps);
+  return phase === "install" ? runInstallPhase(deps, opts) : runUsagePhase(deps, opts);
+}
+
+// src/commands/prereqs.ts
+var GLYPH = {
+  pass: colors.success("PASS"),
+  fixed: colors.success("FIXED"),
+  warn: colors.hint("WARN"),
+  fail: colors.error("FAIL"),
+  skipped: colors.dim("SKIP")
+};
+function renderVerdict(v) {
+  const lines = [];
+  lines.push(
+    v.phase === "install" ? colors.field("Checking whether this subscription can install m8t.") : colors.field("Checking whether you can use this m8t platform.")
+  );
+  lines.push("");
+  for (const r of v.results) {
+    lines.push(`[${GLYPH[r.status]}] ${r.title}`);
+    lines.push(`        ${colors.dim(r.detail)}`);
+    if (r.remedy) lines.push(colors.hint(`        fix: ${r.remedy}`));
+  }
+  if (v.unchecked.length > 0) {
+    lines.push("");
+    lines.push(
+      colors.dim(
+        `Not checked by this command (you may still hit them): ${v.unchecked.join(", ")}. See guides/prerequisites.md.`
+      )
+    );
+  }
+  lines.push("");
+  lines.push(v.ok ? colors.success("\u2705 Nothing is blocking you.") : colors.error("\u26D4 Blocked \u2014 fix the FAIL rows above, then re-run."));
+  return lines.join("\n");
+}
+var PrereqsCommand = class extends M8tCommand {
+  static paths = [["prereqs"]];
+  static usage = Command47.Usage({
+    description: "Check (and optionally fix) everything m8t needs \u2014 to install, or for you to use it.",
+    details: "Runs one of two phases. With no platform discoverable it checks INSTALL prerequisites: your Azure sign-in, subscription and directory rights, resource-provider registrations, and model quota. With a platform live it checks USAGE prerequisites for the signed-in account: the sign-in redirect URI, Foundry data-plane access, and Key Vault secrets access. Pass --fix to repair what is repairable, and --fix --for <upn> to set a teammate up (usage phase only). Read-only without --fix.",
+    examples: [
+      ["Before installing", "$0 prereqs"],
+      ["Register anything missing, then install", "$0 prereqs --fix"],
+      ["After joining a platform someone else installed", "$0 prereqs"],
+      ["Grant yourself what you are missing", "$0 prereqs --fix"],
+      ["Set a teammate up (needs role-assignment rights)", "$0 prereqs --fix --for alice@contoso.com"]
+    ]
+  });
+  fix = Option44.Boolean("--fix", false, { description: "Repair what is repairable. Without it the command only reports." });
+  for_ = Option44.String("--for", { description: "UPN or object id of another person. Usage phase only." });
+  phase = Option44.String("--phase", { description: "Force 'install' or 'usage' instead of auto-detecting." });
+  region = Option44.String("--region", { description: "Target region for the install-phase quota check." });
+  model = Option44.String("--model", { description: `Model whose quota the install needs (default ${INSTALL_REASONING_MODEL}).` });
+  clientId = Option44.String("--client-id", { description: "A ready app registration, in place of directory-admin rights." });
+  subscription = Option44.String("--subscription");
+  resourceGroup = Option44.String("--resource-group");
+  output = Option44.String("--output");
+  async executeCommand() {
+    const mode = resolveOutputMode(this.output, this.context.stdout);
+    const json = mode === "json";
+    const phase = this.resolvePhase();
+    const forPrincipal = typeof this.for_ === "string" ? this.for_ : void 0;
+    if (forPrincipal && phase === "install") {
+      throw new LocalCliError({
+        code: "PREREQS_FOR_INSTALL_PHASE",
+        message: "--for applies to the usage phase only.",
+        hint: "Install prerequisites belong to the subscription and the person running the install, not to a named teammate. Run 'm8t prereqs --fix --for <upn>' once the platform is live."
+      });
+    }
+    if (forPrincipal && !this.fix) {
+      this.context.stderr.write(
+        colors.dim("  (checking by role assignment \u2014 we cannot call the data plane as someone else)\n")
+      );
+    }
+    const deps = buildPrereqDeps({
+      resourceGroup: typeof this.resourceGroup === "string" ? this.resourceGroup : void 0,
+      subscription: typeof this.subscription === "string" ? this.subscription : void 0
+    });
+    const opts = {
+      fix: this.fix === true,
+      ...forPrincipal ? { forPrincipal } : {},
+      ...phase ? { phase } : {},
+      region: typeof this.region === "string" ? this.region : void 0,
+      model: typeof this.model === "string" ? this.model : INSTALL_REASONING_MODEL,
+      clientId: typeof this.clientId === "string" ? this.clientId : void 0,
+      subscription: typeof this.subscription === "string" ? this.subscription : void 0,
+      resourceGroup: typeof this.resourceGroup === "string" ? this.resourceGroup : void 0,
+      onProgress: json ? void 0 : (m) => this.context.stderr.write(colors.dim(`  ${m}
+`))
+    };
+    const verdict = await runPrereqs(deps, opts);
+    if (json) {
+      this.context.stdout.write(renderJson(verdict) + "\n");
+    } else {
+      this.context.stdout.write(renderVerdict(verdict) + "\n");
+    }
+    return verdict.ok ? 0 : 1;
+  }
+  resolvePhase() {
+    if (typeof this.phase !== "string") return void 0;
+    if (this.phase !== "install" && this.phase !== "usage") {
+      throw new LocalCliError({
+        code: "PREREQS_BAD_PHASE",
+        message: `Unknown phase '${this.phase}'.`,
+        hint: `Valid phases: install, usage. Omit --phase to auto-detect (install prerequisites are ${prereqsForPhase("install").length.toString()} checks; usage are ${prereqsForPhase("usage").length.toString()}).`
+      });
+    }
+    return this.phase;
+  }
+};
+
+// src/commands/switch.ts
+import { Command as Command48, Option as Option45 } from "clipanion";
+
+// src/lib/profiles.ts
+import * as fs27 from "fs/promises";
+import * as path29 from "path";
+import { parse as parseYaml11, stringify as stringifyYaml4 } from "yaml";
+function profilesDir() {
+  const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
+  return path29.join(home, ".m8t", "profiles");
+}
+function getProfilePath(name) {
+  return path29.join(profilesDir(), `${path29.basename(name)}.yaml`);
+}
+function slugifyTenant(domainOrId) {
+  const base = domainOrId.split(".")[0].toLowerCase();
+  const slug = base.replace(/[^a-z0-9-]/g, "");
+  return slug.length > 0 ? slug : "profile";
+}
+async function listProfiles() {
+  try {
+    const entries = await fs27.readdir(profilesDir());
+    return entries.filter((e) => e.endsWith(".yaml")).map((e) => e.replace(/\.yaml$/, "")).sort();
+  } catch (e) {
+    if (e.code === "ENOENT") return [];
+    throw e;
+  }
+}
+async function readProfile(name) {
+  try {
+    const raw = await fs27.readFile(getProfilePath(name), "utf8");
+    const parsed = parseYaml11(raw);
+    if (!parsed || typeof parsed !== "object") return null;
+    return parsed;
+  } catch (e) {
+    if (e.code === "ENOENT") return null;
+    throw e;
+  }
+}
+async function exists(p) {
+  try {
+    await fs27.stat(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function saveProfile(p) {
+  await fs27.mkdir(profilesDir(), { recursive: true });
+  let name = p.name;
+  let n = 2;
+  while (await exists(getProfilePath(name))) {
+    name = `${p.name}-${n.toString()}`;
+    n++;
+  }
+  const target = getProfilePath(name);
+  const tmp = `${target}.tmp`;
+  await fs27.writeFile(tmp, stringifyYaml4({ ...p, name }, { indent: 2 }), "utf8");
+  await fs27.rename(tmp, target);
+  return name;
 }
 
 // src/lib/switch.ts
@@ -24106,14 +25096,14 @@ async function profileSwitch(name, asName) {
 init_errors();
 var SwitchCommand = class extends M8tCommand {
   static paths = [["switch"]];
-  static usage = Command47.Usage({
+  static usage = Command48.Usage({
     description: "Re-point local config at another deployment: --subscription <id|name> (discovery) or <profile>."
   });
-  profile = Option44.String({ required: false });
-  subscription = Option44.String("--subscription");
-  list = Option44.Boolean("--list", false);
-  as = Option44.String("--as");
-  output = Option44.String("--output");
+  profile = Option45.String({ required: false });
+  subscription = Option45.String("--subscription");
+  list = Option45.Boolean("--list", false);
+  as = Option45.String("--as");
+  output = Option45.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -24136,11 +25126,11 @@ var SwitchCommand = class extends M8tCommand {
       }
       return 0;
     }
-    let result;
+    let result2;
     if (this.subscription) {
-      result = await discoverySwitch(this.subscription, this.as);
+      result2 = await discoverySwitch(this.subscription, this.as);
     } else if (this.profile) {
-      result = await profileSwitch(this.profile, this.as);
+      result2 = await profileSwitch(this.profile, this.as);
     } else {
       throw new LocalCliError({
         code: "SWITCH_NO_TARGET",
@@ -24149,16 +25139,16 @@ var SwitchCommand = class extends M8tCommand {
       });
     }
     if (mode === "json") {
-      this.context.stdout.write(renderJson(result) + "\n");
+      this.context.stdout.write(renderJson(result2) + "\n");
       return 0;
     }
     this.context.stdout.write(
       renderKeyValueBlock([
-        { key: "tenant", value: result.tenantId },
-        { key: "clientId", value: result.clientId },
-        { key: "endpoint", value: result.projectEndpoint },
-        { key: "subscription", value: result.subscriptionId },
-        { key: "saved profile", value: result.snapshot ?? colors.dim("(nothing to snapshot)") }
+        { key: "tenant", value: result2.tenantId },
+        { key: "clientId", value: result2.clientId },
+        { key: "endpoint", value: result2.projectEndpoint },
+        { key: "subscription", value: result2.subscriptionId },
+        { key: "saved profile", value: result2.snapshot ?? colors.dim("(nothing to snapshot)") }
       ]) + "\n"
     );
     this.context.stdout.write(
@@ -24170,7 +25160,7 @@ var SwitchCommand = class extends M8tCommand {
 
 // src/commands/open.ts
 import { spawn as spawn5 } from "child_process";
-import { Command as Command48, Option as Option45 } from "clipanion";
+import { Command as Command49, Option as Option46 } from "clipanion";
 
 // src/lib/open-targets.ts
 init_errors();
@@ -24216,14 +25206,14 @@ function openUrl(url) {
 }
 var OpenCommand = class extends M8tCommand {
   static paths = [["open"]];
-  static usage = Command48.Usage({
+  static usage = Command49.Usage({
     description: "Open the deployed webapp (default), the Foundry portal, or the resource group.",
     details: "Targets: webapp (deployed app, default) | foundry (ai.azure.com) | portal (resource group in the Azure portal). Pass --print to emit the URL instead of launching a browser (also the default when stdout isn't a TTY)."
   });
-  target = Option45.String({ required: false });
-  print = Option45.Boolean("--print", false);
-  output = Option45.String("--output");
-  resourceGroup = Option45.String("--resource-group", {
+  target = Option46.String({ required: false });
+  print = Option46.Boolean("--print", false);
+  output = Option46.String("--output");
+  resourceGroup = Option46.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -24267,7 +25257,7 @@ var OpenCommand = class extends M8tCommand {
 };
 
 // src/commands/dream/run.ts
-import { Command as Command49, Option as Option46 } from "clipanion";
+import { Command as Command50, Option as Option47 } from "clipanion";
 import { AzureCliCredential } from "@azure/identity";
 import { TableClient as TableClient7 } from "@azure/data-tables";
 import { AIProjectClient as AIProjectClient3 } from "@azure/ai-projects";
@@ -24472,11 +25462,11 @@ function extractQuery(args) {
     return null;
   }
 }
-function extractSources(result) {
+function extractSources(result2) {
   const out = [];
   const re = /\[\d+\]\s*([^\n[]+)/g;
   let m;
-  while ((m = re.exec(result)) !== null) {
+  while ((m = re.exec(result2)) !== null) {
     const t = m[1].trim();
     if (t)
       out.push(t);
@@ -24547,10 +25537,10 @@ async function fetchEnrichment(credential2, workspaceId, respIds, from, to) {
   if (ids.length === 0)
     return /* @__PURE__ */ new Map();
   const client = new LogsQueryClient(credential2);
-  const result = await client.queryWorkspace(workspaceId, buildEnrichKql(ids), { startTime: new Date(from), endTime: new Date(to) });
-  if (result.status !== LogsQueryResultStatus.Success || result.tables.length === 0)
+  const result2 = await client.queryWorkspace(workspaceId, buildEnrichKql(ids), { startTime: new Date(from), endTime: new Date(to) });
+  if (result2.status !== LogsQueryResultStatus.Success || result2.tables.length === 0)
     return /* @__PURE__ */ new Map();
-  return parseEnrichment(tableToSpans(result.tables[0]));
+  return parseEnrichment(tableToSpans(result2.tables[0]));
 }
 
 // ../../packages/agent-ledger/dist/esm/read/brain-reads-client.js
@@ -26310,7 +27300,7 @@ async function runDream(input, deps, seams = defaultDreamSeams()) {
     return { worker: input.worker, applied: [], digest, advanced: true };
   }
   const message = applied.digest.length ? `dream: ${input.worker} consolidation` : `dream: ${input.worker}`;
-  const result = await commitWithRebase({
+  const result2 = await commitWithRebase({
     writer: deps.brain,
     message,
     changes: applied.changes,
@@ -26318,13 +27308,13 @@ async function runDream(input, deps, seams = defaultDreamSeams()) {
     maxAttempts: MAX_WRITE_ATTEMPTS,
     verify: async () => verifyEndState(deps.brain, applied.changes)
   });
-  if (result.outcome !== "committed") {
-    deps.logger.error({ at: "runDream", worker: input.worker, terminal: result.outcome, attempts: result.attempts });
-    digest.push({ kind: "failure", detail: `write ${result.outcome} after ${String(result.attempts)} attempt(s)`, evidence: [] });
+  if (result2.outcome !== "committed") {
+    deps.logger.error({ at: "runDream", worker: input.worker, terminal: result2.outcome, attempts: result2.attempts });
+    digest.push({ kind: "failure", detail: `write ${result2.outcome} after ${String(result2.attempts)} attempt(s)`, evidence: [] });
     return { worker: input.worker, applied: [], digest, advanced: false };
   }
   await commitCursorAdvance(input.advance, deps.cursor);
-  deps.logger.info({ at: "runDream", worker: input.worker, committed: result.newSha, advanced: true });
+  deps.logger.info({ at: "runDream", worker: input.worker, committed: result2.newSha, advanced: true });
   await emitDigest(input, deps, digest);
   const appliedChanges = applied.digest.filter((e) => e.kind === "changed");
   return { worker: input.worker, applied: appliedChanges, digest, advanced: true };
@@ -26494,20 +27484,20 @@ function redactTranscripts(input) {
 }
 var DreamRunCommand = class extends M8tCommand {
   static paths = [["dream", "run"]];
-  static usage = Command49.Usage({
+  static usage = Command50.Usage({
     description: "Dry-run the brain consumption pipeline for one worker (no model call, no writes).",
     details: "Builds AzureCliCredential + resolves the Foundry project, ledger table, and Log Analytics workspace, runs the consumption pipeline, and prints the skip-ledger, the partition invariant, and harvest stats. Transcripts are metadata-only unless --show-transcripts is passed."
   });
-  worker = Option46.String("--worker", { description: "Worker (canonical name) to harvest. Required." });
-  dryRun = Option46.Boolean("--dry-run", false, { description: "Read-only harvest; no model call, no writes." });
-  since = Option46.String("--since", { description: "ISO-8601 start override (rejected if malformed or future)." });
-  reset = Option46.Boolean("--reset", false, { description: "Ignore the stored cursor; read from the beginning." });
-  showTranscripts = Option46.Boolean("--show-transcripts", false, {
+  worker = Option47.String("--worker", { description: "Worker (canonical name) to harvest. Required." });
+  dryRun = Option47.Boolean("--dry-run", false, { description: "Read-only harvest; no model call, no writes." });
+  since = Option47.String("--since", { description: "ISO-8601 start override (rejected if malformed or future)." });
+  reset = Option47.Boolean("--reset", false, { description: "Ignore the stored cursor; read from the beginning." });
+  showTranscripts = Option47.Boolean("--show-transcripts", false, {
     description: "Print transcript bodies (default: metadata only)."
   });
-  subscription = Option46.String("--subscription");
-  endpoint = Option46.String("--endpoint");
-  output = Option46.String("--output");
+  subscription = Option47.String("--subscription");
+  endpoint = Option47.String("--endpoint");
+  output = Option47.String("--output");
   // Resolution seam — overridden by tests; built lazily at runtime otherwise.
   deps;
   async executeCommand() {
@@ -26527,7 +27517,7 @@ var DreamRunCommand = class extends M8tCommand {
         endpoint: typeof this.endpoint === "string" ? this.endpoint : void 0
       });
       const liveCursor = await liveDeps.readCursor(liveContext.worker);
-      const result = await liveDeps.runDream({
+      const result2 = await liveDeps.runDream({
         worker: liveContext.worker,
         physicalPks: liveContext.physicalPks,
         since,
@@ -26537,10 +27527,10 @@ var DreamRunCommand = class extends M8tCommand {
         ...buildSources(liveContext, liveDeps)
       });
       this.context.stdout.write(
-        `${colors.field("dream run (live)")} worker=${result.worker}  applied ${String(result.applied.length)}  ${result.advanced ? colors.success("advanced") : colors.dim("not advanced")}
+        `${colors.field("dream run (live)")} worker=${result2.worker}  applied ${String(result2.applied.length)}  ${result2.advanced ? colors.success("advanced") : colors.dim("not advanced")}
 `
       );
-      const changed = result.applied.filter(
+      const changed = result2.applied.filter(
         (e) => e.kind === "changed"
       );
       for (const e of changed) {
@@ -26549,7 +27539,7 @@ var DreamRunCommand = class extends M8tCommand {
 `
         );
       }
-      const cost = result.digest.find(
+      const cost = result2.digest.find(
         (d) => d.kind === "cost"
       );
       if (cost) {
@@ -26558,7 +27548,7 @@ var DreamRunCommand = class extends M8tCommand {
 `
         );
       }
-      const failures = result.digest.filter(
+      const failures = result2.digest.filter(
         (d) => d.kind === "failure"
       );
       for (const f of failures) {
@@ -26687,12 +27677,12 @@ AppDependencies
 | where isnotempty(conv)
 | project conv
 | take 1`;
-    const result = await client.queryWorkspace(workspaceId, kql, {
+    const result2 = await client.queryWorkspace(workspaceId, kql, {
       startTime: new Date(from),
       endTime: new Date(to)
     });
-    if (result.status !== LogsQueryResultStatus3.Success || result.tables.length === 0) return null;
-    const table = result.tables[0];
+    if (result2.status !== LogsQueryResultStatus3.Success || result2.tables.length === 0) return null;
+    const table = result2.tables[0];
     if (table.rows.length === 0) return null;
     const row = table.rows[0];
     const idx = table.columnDescriptors.findIndex((c) => c.name === "conv");
@@ -26855,7 +27845,7 @@ function defaultDeps(overrides) {
 }
 
 // src/commands/foundry/create.ts
-import { Command as Command50, Option as Option47 } from "clipanion";
+import { Command as Command51, Option as Option48 } from "clipanion";
 
 // src/lib/foundry-create.ts
 init_errors();
@@ -27093,7 +28083,7 @@ async function createFoundryProject(args) {
 init_errors();
 var FoundryCreateCommand = class extends M8tCommand {
   static paths = [["foundry", "create"]];
-  static usage = Command50.Usage({
+  static usage = Command51.Usage({
     description: "Create an AI Foundry (AIServices) account + project + model deployment from scratch.",
     details: "Non-interactive and idempotent. Creates the AIServices account (custom subdomain + project management), a project, and a model deployment (default gpt-4.1-mini @ capacity 50). Region must be hosted-agent-eligible. Emits the project endpoint as structured output. Re-run is a clean no-op (account/project skipped if present; deployment capacity converges UP, never down).",
     examples: [
@@ -27102,16 +28092,16 @@ var FoundryCreateCommand = class extends M8tCommand {
       ["Higher capacity for a reasoning model", "$0 foundry create --resource-group rg-m8t-stack --location eastus2 --model gpt-5-mini --capacity 250"]
     ]
   });
-  resourceGroup = Option47.String("--resource-group");
-  location = Option47.String("--location");
-  account = Option47.String("--account");
-  project = Option47.String("--project", "m8t");
-  model = Option47.String("--model", "gpt-4.1-mini");
-  modelVersion = Option47.String("--model-version", "2025-04-14");
-  capacity = Option47.String("--capacity", "50");
-  subscription = Option47.String("--subscription");
-  skipQuotaCheck = Option47.Boolean("--skip-quota-check", false);
-  output = Option47.String("--output");
+  resourceGroup = Option48.String("--resource-group");
+  location = Option48.String("--location");
+  account = Option48.String("--account");
+  project = Option48.String("--project", "m8t");
+  model = Option48.String("--model", "gpt-4.1-mini");
+  modelVersion = Option48.String("--model-version", "2025-04-14");
+  capacity = Option48.String("--capacity", "50");
+  subscription = Option48.String("--subscription");
+  skipQuotaCheck = Option48.Boolean("--skip-quota-check", false);
+  output = Option48.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -27136,7 +28126,7 @@ var FoundryCreateCommand = class extends M8tCommand {
     const capacity = typeof this.capacity === "string" ? Number(this.capacity) : 50;
     const onProgress = mode === "pretty" ? (m) => this.context.stderr.write(`  ${colors.dim(m)}
 `) : void 0;
-    const result = await createFoundryProject({
+    const result2 = await createFoundryProject({
       resourceGroup,
       location,
       account: accountName,
@@ -27152,53 +28142,53 @@ var FoundryCreateCommand = class extends M8tCommand {
     if (mode === "json") {
       this.context.stdout.write(
         renderJson({
-          endpoint: result.endpoint,
-          accountName: result.accountName,
-          accountResourceId: result.accountScope,
-          projectName: result.projectName,
-          region: result.region,
-          model: result.model,
-          capacity: result.capacity,
-          created: result.created
+          endpoint: result2.endpoint,
+          accountName: result2.accountName,
+          accountResourceId: result2.accountScope,
+          projectName: result2.projectName,
+          region: result2.region,
+          model: result2.model,
+          capacity: result2.capacity,
+          created: result2.created
         }) + "\n"
       );
       return 0;
     }
     this.context.stdout.write(
       renderKeyValueBlock([
-        { key: "endpoint", value: result.endpoint },
-        { key: "account", value: result.accountName },
-        { key: "project", value: result.projectName },
-        { key: "region", value: result.region },
-        { key: "model", value: `${result.model} (capacity ${String(result.capacity)})` }
+        { key: "endpoint", value: result2.endpoint },
+        { key: "account", value: result2.accountName },
+        { key: "project", value: result2.projectName },
+        { key: "region", value: result2.region },
+        { key: "model", value: `${result2.model} (capacity ${String(result2.capacity)})` }
       ]) + "\n"
     );
-    const made = Object.entries(result.created).filter(([, v]) => v).map(([k]) => k);
+    const made = Object.entries(result2.created).filter(([, v]) => v).map(([k]) => k);
     this.context.stdout.write(colors.dim(`created: ${made.length ? made.join(", ") : "nothing (all present)"}
 `));
-    this.context.stdout.write(colors.dim(`next: 'm8t deploy --foundry-endpoint ${result.endpoint}' to deploy the gateway.
+    this.context.stdout.write(colors.dim(`next: 'm8t deploy --foundry-endpoint ${result2.endpoint}' to deploy the gateway.
 `));
     return 0;
   }
 };
 
 // src/commands/foundry/await-ready.ts
-import { Command as Command51, Option as Option48 } from "clipanion";
+import { Command as Command52, Option as Option49 } from "clipanion";
 import { AzureCliCredential as AzureCliCredential2 } from "@azure/identity";
 init_errors();
 var FoundryAwaitReadyCommand = class extends M8tCommand {
   static paths = [["foundry", "await-ready"]];
-  static usage = Command51.Usage({
+  static usage = Command52.Usage({
     description: "Wait until a freshly-created Foundry project's data plane reliably serves it.",
     details: "Probes the project (GET /agents) until it returns 200 on a few consecutive tries, or fails clearly after a bounded budget. A newly-created account can serve intermittent 404 'Project not found' for minutes; run this after 'foundry create' and before deploying agents so the worker phase doesn't catch the unstable window.",
     examples: [["Wait for a project to be ready", "$0 foundry await-ready --endpoint https://acc.services.ai.azure.com/api/projects/m8t"]]
   });
-  endpoint = Option48.String("--endpoint");
-  consecutive = Option48.String("--consecutive", "3");
-  attempts = Option48.String("--attempts", "60");
-  interval = Option48.String("--interval", "5");
-  subscription = Option48.String("--subscription");
-  output = Option48.String("--output");
+  endpoint = Option49.String("--endpoint");
+  consecutive = Option49.String("--consecutive", "3");
+  attempts = Option49.String("--attempts", "60");
+  interval = Option49.String("--interval", "5");
+  subscription = Option49.String("--subscription");
+  output = Option49.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const endpoint = typeof this.endpoint === "string" ? this.endpoint : void 0;
@@ -27232,7 +28222,7 @@ var FoundryAwaitReadyCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/preflight.ts
-import { Command as Command52, Option as Option49 } from "clipanion";
+import { Command as Command53, Option as Option50 } from "clipanion";
 
 // ../../packages/telemetry-contract/artifact/tier-map.ts
 var EVENT_TIERS = {
@@ -27243,7 +28233,8 @@ var EVENT_TIERS = {
   "heartbeat": 1,
   "update-applied": 1,
   "update-failed": 1,
-  "consent-changed": 1
+  "consent-changed": 1,
+  "identity-mismatch": 1
   // extended additively for tier-2 usage events: "usage-rollup": 2
 };
 var EVENT_ENUM = Object.keys(EVENT_TIERS);
@@ -27276,87 +28267,23 @@ var SPEND_DISCLOSURE = [
   "  - You can remove it later - see guides/uninstall.md."
 ].join("\n");
 
-// src/lib/bootstrap-preflight.ts
-var ADMIN_DIRECTORY_ROLES = ["Global Administrator", "Application Administrator", "Cloud Application Administrator"];
-async function checkSubScopeAdmin(callerObjectId, subscriptionId) {
-  const rows = JSON.parse(await runAz([
-    "role",
-    "assignment",
-    "list",
-    "--assignee",
-    callerObjectId,
-    "--scope",
-    `/subscriptions/${subscriptionId}`,
-    "--include-inherited",
-    "--query",
-    "[].{roleDefinitionName: roleDefinitionName}",
-    "-o",
-    "json"
-  ]));
-  const hit = rows.find((r) => r.roleDefinitionName === "Owner" || r.roleDefinitionName === "User Access Administrator");
-  return { ok: Boolean(hit), role: hit?.roleDefinitionName };
-}
-async function checkAppRegCapability(callerObjectId) {
-  let roles;
-  try {
-    roles = JSON.parse(await runAz([
-      "rest",
-      "--method",
-      "GET",
-      "--url",
-      `https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments?$filter=principalId eq '${callerObjectId}'&$expand=roleDefinition`,
-      "--query",
-      "value[].roleDefinition.displayName",
-      "-o",
-      "json"
-    ]));
-  } catch {
-    roles = null;
-  }
-  if (roles === null) return { ok: false, inconclusive: true };
-  return { ok: roles.some((r) => ADMIN_DIRECTORY_ROLES.includes(r)), inconclusive: false };
-}
-async function registerContainerInstance(subscriptionId) {
-  await runAz(["provider", "register", "--namespace", "Microsoft.ContainerInstance", "--subscription", subscriptionId, "--only-show-errors"]);
-}
-function buildPreflightBanner(who) {
-  return [
-    "\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557",
-    "\u2551  \u26D4  STOP \u2014 READ THIS BEFORE CONTINUING                                 \u2551",
-    "\u2551                                                                        \u2551",
-    "\u2551  Installing m8t creates real Azure resources in YOUR            \u2551",
-    "\u2551  subscription and assigns roles. To do that, the account you just     \u2551",
-    "\u2551  signed in with MUST be:                                              \u2551",
-    "\u2551                                                                        \u2551",
-    "\u2551    \u2022 OWNER or USER ACCESS ADMINISTRATOR at the subscription scope     \u2551",
-    "\u2551      (it has to create a managed identity and assign it roles), AND   \u2551",
-    "\u2551    \u2022 a directory admin able to register one Entra app                 \u2551",
-    "\u2551      (Application / Cloud Application / Global Administrator)          \u2551",
-    "\u2551      \u2014 OR you supply a ready app registration with --client-id.       \u2551",
-    "\u2551                                                                        \u2551",
-    "\u2551  If you are NOT this, this install CANNOT proceed and will STOP NOW.  \u2551",
-    "\u2551  Nothing has been created yet. Get an admin to run this, or ask one   \u2551",
-    "\u2551  for an app registration id (--client-id <appId>) and try again.      \u2551",
-    "\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D",
-    "",
-    `Signed in as:  ${who.upn}   (tenant ${who.tenantId}, sub ${who.subscriptionId})`,
-    ""
-  ].join("\n");
-}
-
 // src/commands/bootstrap/preflight.ts
 var BootstrapPreflightCommand = class extends M8tCommand {
   static paths = [["bootstrap", "preflight"]];
-  static usage = Command52.Usage({
+  static usage = Command53.Usage({
     description: "Loudly verify you can install m8t (Owner/UAA + directory admin) and hard-stop if not.",
-    details: "Step 1 of `m8t bootstrap`. Prints an unmissable admin-credentials notice, then checks: Owner or User Access Administrator at subscription scope (hard requirement), directory-admin capability to register the app (or pass --client-id), and registers Microsoft.ContainerInstance. Exits non-zero with the exact failing check + remedy.",
+    details: "Step 1 of `m8t bootstrap`. Prints an unmissable admin-credentials notice, then checks: Owner or User Access Administrator at subscription scope (hard requirement), directory-admin capability to register the app (or pass --client-id), every Azure resource provider the install uses (registering any that are missing), and \u2014 with --location \u2014 model quota in the target region. Exits non-zero with the exact failing check + remedy. `m8t prereqs` runs the same substrate checks on their own.",
     examples: [
       ["Run the preflight", "$0 bootstrap preflight"],
+      ["Check quota for the region you will install into", "$0 bootstrap preflight --location eastus2"],
       ["BYO app registration (directory guests)", "$0 bootstrap preflight --client-id <appId>"]
     ]
   });
-  clientId = Option49.String("--client-id");
-  subscription = Option49.String("--subscription");
+  clientId = Option50.String("--client-id");
+  subscription = Option50.String("--subscription");
+  location = Option50.String("--location", {
+    description: "Target region. Enables the model-quota check \u2014 without it, quota is not verified."
+  });
   async executeCommand() {
     const clientId = typeof this.clientId === "string" ? this.clientId : void 0;
     const account = await getAzAccount();
@@ -27387,8 +28314,33 @@ ${colors.dim(DISCLOSURE_TIER1)}
     } else {
       this.context.stdout.write(line(true, `Using your app registration ${clientId}`, "--client-id supplied; skipping the directory-admin check"));
     }
-    await registerContainerInstance(subscriptionId);
-    this.context.stdout.write(line(true, "Microsoft.ContainerInstance registered", "installer substrate"));
+    const region = typeof this.location === "string" ? this.location : void 0;
+    const verdict = await runInstallPhase(buildPrereqDeps({ subscription: subscriptionId }), {
+      fix: true,
+      subscription: subscriptionId,
+      // BOTH region and model are required for the quota check to run at all.
+      // Passing only the region silently skipped it while --location implied it
+      // had happened.
+      ...region ? { region, model: INSTALL_REASONING_MODEL } : {},
+      ...clientId ? { clientId } : {},
+      onProgress: (m) => {
+        this.context.stderr.write(colors.dim(`  ${m}
+`));
+      }
+    });
+    for (const r of verdict.results.filter((x) => x.slug === "resource-providers" || x.slug === "model-quota")) {
+      this.context.stdout.write(line(r.status !== "fail", r.title, r.detail));
+      if (r.status === "fail") {
+        this.context.stderr.write(failBlock(r.detail, r.remedy ?? "See guides/prerequisites.md."));
+        throw new LocalCliError({ code: `BOOTSTRAP_PREREQ_${r.slug.toUpperCase().replace(/-/g, "_")}`, message: r.detail, hint: r.remedy });
+      }
+    }
+    if (verdict.unchecked.length > 0) {
+      this.context.stdout.write(
+        colors.dim(`  Not checked (you may still hit them): ${verdict.unchecked.join(", ")} \u2014 see guides/prerequisites.md
+`)
+      );
+    }
     this.context.stdout.write(
       `
 ${colors.success("\u2705 Preflight passed.")} Here is the ONE consent step you'll clear, then walk away:
@@ -27419,7 +28371,7 @@ ${colors.error("  " + why)}
 import * as fs30 from "fs";
 import * as os14 from "os";
 import * as path32 from "path";
-import { Command as Command53, Option as Option50 } from "clipanion";
+import { Command as Command54, Option as Option51 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-mi.ts
@@ -27783,12 +28735,12 @@ ${colors.error("\u2717")} The GitHub App on disk is installed on ${colors.field(
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.44";
+var DEFAULT_INSTALLER_TAG = "v0.1.46";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
   static paths = [["bootstrap", "launch"]];
-  static usage = Command53.Usage({
+  static usage = Command54.Usage({
     description: "Create + authorize the installer managed identity, then kick the cloud installer.",
     details: "Step 2 of `m8t bootstrap` (run after `preflight`). Ensures the resource group, creates the m8t app registration (or uses --client-id), creates a user-assigned managed identity granted Owner at subscription scope, and launches the published m8t-installer image as an ACI run-to-completion job under that identity. Writes ~/.m8t/bootstrap.json for `status`/`reap`/`finish`.",
     examples: [
@@ -27799,26 +28751,26 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       ["Share a support contact", "$0 bootstrap launch --location eastus2 --contact-email you@example.com --company 'Acme'"]
     ]
   });
-  location = Option50.String("--location");
-  resourceGroup = Option50.String("--resource-group");
-  clientId = Option50.String("--client-id");
-  subscription = Option50.String("--subscription");
-  installerTag = Option50.String("--installer-tag");
+  location = Option51.String("--location");
+  resourceGroup = Option51.String("--resource-group");
+  clientId = Option51.String("--client-id");
+  subscription = Option51.String("--subscription");
+  installerTag = Option51.String("--installer-tag");
   // Full image ref override (registry + repo + tag) — an escape hatch when the
   // default org/tag is wrong for the current CLI (e.g. a stale published build).
   // Wins over --installer-tag / the pinned default.
-  installerImage = Option50.String("--installer-image");
-  gatewayImageRef = Option50.String("--gateway-image-ref");
-  githubAppCreds = Option50.String("--github-app-creds");
-  contactEmail = Option50.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
-  company = Option50.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
+  installerImage = Option51.String("--installer-image");
+  gatewayImageRef = Option51.String("--gateway-image-ref");
+  githubAppCreds = Option51.String("--github-app-creds");
+  contactEmail = Option51.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  company = Option51.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
   // Value-carrying on purpose: a bare --force would be cargo-culted into
   // runbooks and harness prompts and erode the protection, whereas a faithful
   // paste can never accidentally carry the victim group's name. It AUTHORIZES
   // the target; --resource-group is what CHOOSES it.
-  reinstallInto = Option50.String("--reinstall-into", { description: "Consent to installing into --resource-group even though it already holds resources. Must match the target group's name." });
-  org = Option50.String("--org", { description: "Assert the GitHub App on disk is installed on this org; refuses on a mismatch." });
-  noBrains = Option50.Boolean("--no-brains", false, { description: "Install without brain-backed workers. For test and CI rigs; the supported install creates brains." });
+  reinstallInto = Option51.String("--reinstall-into", { description: "Consent to installing into --resource-group even though it already holds resources. Must match the target group's name." });
+  org = Option51.String("--org", { description: "Assert the GitHub App on disk is installed on this org; refuses on a mismatch." });
+  noBrains = Option51.Boolean("--no-brains", false, { description: "Install without brain-backed workers. For test and CI rigs; the supported install creates brains." });
   async executeCommand() {
     const location = typeof this.location === "string" ? this.location : void 0;
     if (!location) {
@@ -27972,7 +28924,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/status.ts
-import { Command as Command54, Option as Option51 } from "clipanion";
+import { Command as Command55, Option as Option52 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-aci-state.ts
@@ -28000,13 +28952,13 @@ async function getAciState(opts) {
 // src/commands/bootstrap/status.ts
 var BootstrapStatusCommand = class extends M8tCommand {
   static paths = [["bootstrap", "status"]];
-  static usage = Command54.Usage({
+  static usage = Command55.Usage({
     description: "Show the cloud installer's live status (phase, progress, result).",
     details: "Reads the durable status blob written by the installer. --watch polls until the install reaches done or failed.",
     examples: [["One read", "$0 bootstrap status"], ["Watch to completion", "$0 bootstrap status --watch"]]
   });
-  watch = Option51.Boolean("--watch", false);
-  output = Option51.String("--output");
+  watch = Option52.Boolean("--watch", false);
+  output = Option52.String("--output");
   async executeCommand() {
     const state = await readBootstrapState();
     if (!state) {
@@ -28091,7 +29043,7 @@ function formatStatus(d) {
 }
 
 // src/commands/bootstrap/reap.ts
-import { Command as Command55, Option as Option52 } from "clipanion";
+import { Command as Command56, Option as Option53 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-reap.ts
@@ -28185,14 +29137,14 @@ async function reapInstaller(opts) {
 // src/commands/bootstrap/reap.ts
 var BootstrapReapCommand = class extends M8tCommand {
   static paths = [["bootstrap", "reap"]];
-  static usage = Command55.Usage({
+  static usage = Command56.Usage({
     description: "Tear down the installer scaffolding (ACI \u2192 MI \u2192 its role assignments) after a successful install.",
     details: "Runs locally on the 'done' signal (the installer can't delete its own identity). The platform RG and the gateway's own assignments persist. A failed install is left intact for diagnosis unless --force.",
     examples: [["Reap after done", "$0 bootstrap reap"]]
   });
-  force = Option52.Boolean("--force", false);
-  sweepOrphans = Option52.Boolean("--sweep-orphans", false);
-  yes = Option52.Boolean("--yes", false);
+  force = Option53.Boolean("--force", false);
+  sweepOrphans = Option53.Boolean("--sweep-orphans", false);
+  yes = Option53.Boolean("--yes", false);
   async executeCommand() {
     if (this.sweepOrphans === true) {
       const { subscriptionId: sub } = await getAzAccount();
@@ -28289,7 +29241,7 @@ Found ${String(total)} orphaned assignment(s) (${breakdown}) (dry-run). ${colors
 import * as fs31 from "fs/promises";
 import * as os16 from "os";
 import * as path34 from "path";
-import { Command as Command56, Option as Option53 } from "clipanion";
+import { Command as Command57, Option as Option54 } from "clipanion";
 init_errors();
 
 // src/lib/company-profile-seed.ts
@@ -28693,9 +29645,9 @@ async function findOnboardingProfile(args) {
       if (typeof part.transcript === "string") return [part.transcript];
       return [];
     }).join("\n");
-    const result = parseOnboardingArtifactResult(machineText);
-    if (result.ok) artifacts.push(result.artifact);
-    else if (machineText.includes("m8t_onboarding")) rejection ??= result.reason;
+    const result2 = parseOnboardingArtifactResult(machineText);
+    if (result2.ok) artifacts.push(result2.artifact);
+    else if (machineText.includes("m8t_onboarding")) rejection ??= result2.reason;
   }
   if (artifacts.length === 0) {
     return {
@@ -28922,10 +29874,10 @@ var CERTAIN_UNAVAILABLE = /* @__PURE__ */ new Set([
   "deploy-rejected-region"
 ]);
 var QUOTA_BLOCKED = /* @__PURE__ */ new Set(["no-quota", "deploy-rejected-quota"]);
-function decideNote(whitelist, result) {
-  const chosenIdx = result.chosen ? whitelist.findIndex((r) => r.model === result.chosen?.model) : whitelist.length;
-  const better = result.trace.slice(0, Math.max(chosenIdx, 0));
-  const runningModel = result.chosen?.model ?? null;
+function decideNote(whitelist, result2) {
+  const chosenIdx = result2.chosen ? whitelist.findIndex((r) => r.model === result2.chosen?.model) : whitelist.length;
+  const better = result2.trace.slice(0, Math.max(chosenIdx, 0));
+  const runningModel = result2.chosen?.model ?? null;
   if (chosenIdx === 0) {
     return { status: "top", runningModel, pitchModel: null, unavailableAbovePitch: [] };
   }
@@ -29160,13 +30112,13 @@ async function applyProfileToBrains(args) {
   const verified = [];
   const failed = [];
   const causes = [];
-  settled.forEach((result, index) => {
+  settled.forEach((result2, index) => {
     const brainRepo = brainRepos[index];
-    if (result.status === "fulfilled") {
+    if (result2.status === "fulfilled") {
       verified.push(brainRepo);
     } else {
       failed.push(brainRepo);
-      causes.push(result.reason);
+      causes.push(result2.reason);
     }
   });
   if (failed.length > 0 || verified.length !== brainRepos.length) {
@@ -29254,14 +30206,14 @@ function renderInstallSummary(args) {
 // src/commands/bootstrap/finish.ts
 var BootstrapFinishCommand = class extends M8tCommand {
   static paths = [["bootstrap", "finish"]];
-  static usage = Command56.Usage({
+  static usage = Command57.Usage({
     description: "Point your local tools at the now-live platform (repo-root marker, discovery cache, next steps).",
     details: "Final step of `m8t bootstrap` (after the install reaches done). Writes ~/.m8t/repo-root, points your local tools at the live gateway, and \u2014 if you completed the onboarding intake \u2014 seeds your brain-backed advisor's brain with your company profile (best-effort; never blocks finish). Run `m8t bootstrap seed-profile` to seed manually later.",
     examples: [["Finish local", "$0 bootstrap finish --repo-root /path/to/m8t"]]
   });
-  repoRoot = Option53.String("--repo-root");
-  subscription = Option53.String("--subscription");
-  resourceGroup = Option53.String("--resource-group");
+  repoRoot = Option54.String("--repo-root");
+  subscription = Option54.String("--subscription");
+  resourceGroup = Option54.String("--resource-group");
   async executeCommand() {
     const state = await readBootstrapState();
     if (!state) {
@@ -29312,6 +30264,36 @@ var BootstrapFinishCommand = class extends M8tCommand {
   ${colors.hint(`    m8t bootstrap finish --repo-root ${repoRoot}   # (as an admin), or by hand:`)}
   ${colors.hint(`    az ad app update --id ${d.gatewayClientId} --set spa.redirectUris="['${d.gatewayUrl}']"  # (merge, do not overwrite)`)}
 
+`
+        );
+      }
+      try {
+        const verdict = await runUsagePhase(
+          buildPrereqDeps({ subscription: subscriptionId, resourceGroup }),
+          { fix: true, onProgress: (m) => {
+            this.context.stdout.write(colors.dim(`  ${m}
+`));
+          } }
+        );
+        const rows = verdict.results.filter((r) => r.slug !== "signin-redirect-uri");
+        const unresolved = rows.filter((r) => r.status === "fail");
+        if (unresolved.length === 0) {
+          this.context.stdout.write(`  ${colors.success("\u2713 your account can reach Foundry and read the platform Key Vault")}
+
+`);
+        }
+        for (const r of unresolved) {
+          this.context.stderr.write(
+            `  ${colors.error("\u26A0 could not grant you access:")} ${r.detail}
+` + (r.remedy ? `  ${colors.hint(`Fix it with: ${r.remedy}`)}
+` : "") + "\n"
+          );
+        }
+      } catch (e) {
+        this.context.stderr.write(
+          `  ${colors.error("\u26A0 could not check or grant your platform access:")} ${e.message}
+  ${colors.hint("Run 'm8t prereqs --fix' when you can \u2014 until then your AI team will not load and worker deploys will fail.")}
+
 `
         );
       }
@@ -29364,8 +30346,8 @@ ${colors.field("Then open a brand new chat/session")} \u2014 new skills + MCP se
 import * as fs33 from "fs";
 import * as os18 from "os";
 import * as path36 from "path";
-import { Command as Command57, Option as Option54 } from "clipanion";
-import { DefaultAzureCredential as DefaultAzureCredential23 } from "@azure/identity";
+import { Command as Command58, Option as Option55 } from "clipanion";
+import { DefaultAzureCredential as DefaultAzureCredential24 } from "@azure/identity";
 init_errors();
 
 // src/lib/bootstrap-ui.ts
@@ -29817,9 +30799,9 @@ async function serveOnboardingRelayDetached(args) {
 }
 function autoOpenOnboardingUi(url, open = tryOpenUrl) {
   try {
-    const result = open(url);
-    if (result instanceof Promise) {
-      result.catch(() => {
+    const result2 = open(url);
+    if (result2 instanceof Promise) {
+      result2.catch(() => {
       });
     }
   } catch {
@@ -29951,15 +30933,15 @@ async function resolveIntakeModel(args) {
       });
     };
     const start = Date.now();
-    const result = await walkCascade(WHITELIST, plan, deploy, {
+    const result2 = await walkCascade(WHITELIST, plan, deploy, {
       now: () => Date.now(),
       deadlineAt: start + (args.deadlineMs ?? DEFAULT_DEADLINE_MS),
       onRung: (model, outcome) => args.onNarrate?.(narrate(model, outcome, region))
     });
     return {
-      model: result.chosen?.model,
-      note: renderChosenModelNote(decideNote(WHITELIST, result)),
-      trace: result.trace
+      model: result2.chosen?.model,
+      note: renderChosenModelNote(decideNote(WHITELIST, result2)),
+      trace: result2.trace
     };
   } catch (e) {
     return degradeToFloor(e instanceof Error ? e.message : String(e));
@@ -30172,7 +31154,7 @@ function renderDeployFailure(error) {
 }
 var BootstrapUiCommand = class extends M8tCommand {
   static paths = [["bootstrap", "ui"]];
-  static usage = Command57.Usage({
+  static usage = Command58.Usage({
     description: "Deploy Azzy + start the local onboarding chat UI in the background (returns immediately).",
     details: [
       "Run after `m8t bootstrap launch`, in parallel with `status --watch`. Waits for the cloud",
@@ -30193,16 +31175,16 @@ var BootstrapUiCommand = class extends M8tCommand {
       ["Experimental: start the voice relay (no effect on the text-only intake)", "$0 bootstrap ui --repo-root /path/to/m8t --voice"]
     ]
   });
-  repoRoot = Option54.String("--repo-root");
-  port = Option54.String("--port", "3000");
-  endpoint = Option54.String("--endpoint", {
+  repoRoot = Option55.String("--repo-root");
+  port = Option55.String("--port", "3000");
+  endpoint = Option55.String("--endpoint", {
     description: "Foundry project endpoint to target \u2014 disambiguates when the subscription has multiple projects."
   });
-  prepOnly = Option54.Boolean("--prep-only", false);
-  skipInstall = Option54.Boolean("--skip-install", false);
-  stop = Option54.Boolean("--stop", false);
-  foreground = Option54.Boolean("--foreground", false);
-  voice = Option54.Boolean("--voice", false, {
+  prepOnly = Option55.Boolean("--prep-only", false);
+  skipInstall = Option55.Boolean("--skip-install", false);
+  stop = Option55.Boolean("--stop", false);
+  foreground = Option55.Boolean("--foreground", false);
+  voice = Option55.Boolean("--voice", false, {
     description: "Experimental: when serving, starts the voice relay and writes the intake voice env var. The onboarding intake is text-only and is unaffected by this flag \u2014 no voice worker is registered for it."
   });
   async executeCommand() {
@@ -30240,7 +31222,7 @@ var BootstrapUiCommand = class extends M8tCommand {
     if (fs33.existsSync(path36.join(os18.homedir(), ".m8t", "config.yaml"))) {
       out(colors.error("\u26A0 an existing ~/.m8t/config.yaml will override the onboarding app registration in apps/web \u2014 if Microsoft sign-in fails, move it aside and retry."));
     }
-    const credential2 = new DefaultAzureCredential23();
+    const credential2 = new DefaultAzureCredential24();
     const account = await getAzAccount();
     assertNodeVersion();
     out("waiting for Foundry (the installer's foundry-create phase)\u2026");
@@ -30364,10 +31346,10 @@ var BootstrapUiCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/seed-profile.ts
-import { Command as Command58, Option as Option55 } from "clipanion";
+import { Command as Command59, Option as Option56 } from "clipanion";
 var BootstrapSeedProfileCommand = class extends M8tCommand {
   static paths = [["bootstrap", "seed-profile"]];
-  static usage = Command58.Usage({
+  static usage = Command59.Usage({
     description: "Seed your advisors' brains with the founder + company profile from the onboarding intake.",
     details: "Reads the latest onboarding conversation, renders memory/founder.md + memory/company-profile.md (+ their MEMORY.md index lines), and commits them to both <org>/stacey-brain and <org>/azzy-brain via the GitHub App. Idempotent. --watch polls until the founder finishes the intake.",
     examples: [
@@ -30375,11 +31357,11 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
       ["Wait for the founder to finish", "$0 bootstrap seed-profile --watch"]
     ]
   });
-  endpoint = Option55.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
-  brain = Option55.String("--brain", { description: "Seed only this one brain repo, instead of both <org>/stacey-brain and <org>/azzy-brain." });
-  watch = Option55.Boolean("--watch", false, { description: "Poll until the intake completes (or --timeout)." });
-  timeout = Option55.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
-  githubAppCreds = Option55.String("--github-app-creds");
+  endpoint = Option56.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
+  brain = Option56.String("--brain", { description: "Seed only this one brain repo, instead of both <org>/stacey-brain and <org>/azzy-brain." });
+  watch = Option56.Boolean("--watch", false, { description: "Poll until the intake completes (or --timeout)." });
+  timeout = Option56.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
+  githubAppCreds = Option56.String("--github-app-creds");
   async executeCommand() {
     const ctx = await resolveSeedContext({
       endpointOverride: typeof this.endpoint === "string" ? this.endpoint : void 0,
@@ -30442,7 +31424,7 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
 import * as fs34 from "fs";
 import * as os19 from "os";
 import * as path37 from "path";
-import { Command as Command59, Option as Option56 } from "clipanion";
+import { Command as Command60, Option as Option57 } from "clipanion";
 init_errors();
 
 // src/lib/telemetry-enroll.ts
@@ -30524,7 +31506,7 @@ async function resolveKeyVaultName(containerAppResourceId) {
 }
 var TelemetryEnrollCommand = class extends M8tCommand {
   static paths = [["telemetry", "enroll"]];
-  static usage = Command59.Usage({
+  static usage = Command60.Usage({
     description: "Enroll this installation for operational telemetry (pre-existing installs).",
     details: "Generates an instance id + ingest key from the m8t telemetry ingest and stores the key in your platform Key Vault, the same place the installer writes it on a fresh install. Your installation is identified only by that random instance id \u2014 no contact, company, or subscription details are sent unless you pass them explicitly. Idempotent: refuses if a key already exists.",
     examples: [
@@ -30532,11 +31514,11 @@ var TelemetryEnrollCommand = class extends M8tCommand {
       ["Enroll and share a support contact", "$0 telemetry enroll --contact-email you@example.com --company 'Acme'"]
     ]
   });
-  company = Option56.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
-  contactEmail = Option56.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
-  subscription = Option56.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
-  resourceGroup = Option56.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
-  force = Option56.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
+  company = Option57.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
+  contactEmail = Option57.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  subscription = Option57.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
+  resourceGroup = Option57.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
+  force = Option57.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
   async executeCommand() {
     const account = await getAzAccount();
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
@@ -30596,6 +31578,7 @@ cli.register(VersionCommand);
 cli.register(WhoamiCommand);
 cli.register(StatusCommand);
 cli.register(DoctorCommand);
+cli.register(PrereqsCommand);
 cli.register(SwitchCommand);
 cli.register(OpenCommand);
 cli.register(ConfigShowCommand);