@m8t-stack/cli 0.2.62 → 0.2.64

package/dist/cli.js

@@ -1364,7 +1364,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.62";
+var CLI_VERSION = "0.2.64";
 
 // src/lib/render-error.ts
 init_errors();
@@ -19006,15 +19006,35 @@ import { DefaultAzureCredential as DefaultAzureCredential16 } from "@azure/ident
 init_errors();
 var DEFAULT_IMAGE_REPO = "ghcr.io/m8t-labs/m8t";
 function parseImageRef2(ref) {
-  const lastColon = ref.lastIndexOf(":");
-  const lastSlash = ref.lastIndexOf("/");
-  let name = ref;
+  let rest = ref;
+  let digest;
+  const at = rest.lastIndexOf("@");
+  if (at !== -1) {
+    digest = rest.slice(at + 1) || void 0;
+    rest = rest.slice(0, at);
+  }
+  const lastColon = rest.lastIndexOf(":");
+  const lastSlash = rest.lastIndexOf("/");
+  let name = rest;
   let tag;
   if (lastColon > lastSlash) {
-    name = ref.slice(0, lastColon);
-    tag = ref.slice(lastColon + 1) || void 0;
+    name = rest.slice(0, lastColon);
+    tag = rest.slice(lastColon + 1) || void 0;
   }
-  return { registry: name.split("/")[0], repo: name, tag };
+  return { registry: name.split("/")[0], repo: name, tag, digest };
+}
+function assertGatewayDigest(c) {
+  if (!c.digest?.startsWith("sha256:")) {
+    throw new LocalCliError({
+      code: "PLATFORM_GATEWAY_DIGEST_MISSING",
+      message: `The release manifest's gateway pin (${c.ref}:${c.tag}) carries no usable image digest.`,
+      hint: "Re-fetch the release channel, or target a release whose manifest pins a gateway digest. Deploying by tag instead is not offered: a mutable tag cannot establish which bytes run."
+    });
+  }
+  return c.digest;
+}
+function gatewayRefFromComponent(c) {
+  return `${c.ref}@${assertGatewayDigest(c)}`;
 }
 var SEMVER_TAG = /^v(\d+)\.(\d+)\.(\d+)$/;
 function isSemverTag(tag) {
@@ -19058,7 +19078,7 @@ function parseContainerAppResourceId(id) {
 }
 function planUpdate(opts) {
   const cur = parseImageRef2(opts.currentImage);
-  const currentTag = cur.tag ?? "(none)";
+  const currentTag = cur.tag ?? cur.digest ?? "(none)";
   if (cur.repo !== opts.imageRepo) {
     return { kind: "refuse-byoc", current: currentTag, currentRepo: cur.repo, trackedRepo: opts.imageRepo };
   }
@@ -19067,6 +19087,9 @@ function planUpdate(opts) {
   }
   const available = opts.to ?? pickNewestSemver(opts.availableTags);
   if (!available) return { kind: "no-versions", current: currentTag };
+  if (cur.digest && opts.toDigest && cur.digest === opts.toDigest) {
+    return { kind: "noop", current: currentTag, available };
+  }
   if (cur.tag === available) return { kind: "noop", current: currentTag, available };
   if (!opts.to) {
     const currentIsSemver = cur.tag ? isSemverTag(cur.tag) : false;
@@ -20057,14 +20080,14 @@ async function applyGatewayImage(a, ctx, gatewayResourceId) {
   const { resourceGroup, name } = parseContainerAppResourceId(gatewayResourceId);
   const current = (await runAz(["containerapp", "show", "-g", resourceGroup, "-n", name, "--query", "properties.template.containers[0].image", "-o", "tsv"])).trim();
   const tags = await fetchPublicTags(DEFAULT_IMAGE_REPO);
-  const plan = planUpdate({ currentImage: current, availableTags: tags, imageRepo: DEFAULT_IMAGE_REPO, to: a.to });
   const digest = ctx.manifest.components.gateway.digest;
+  const plan = planUpdate({ currentImage: current, availableTags: tags, imageRepo: DEFAULT_IMAGE_REPO, to: a.to, toDigest: digest });
   switch (plan.kind) {
     case "refuse-byoc":
       ctx.onProgress?.(`gateway is BYOC (${plan.currentRepo}) \u2014 marking externally managed.`);
       return { tag: a.to, digest, state: "external" };
     case "roll":
-      await runAz(["containerapp", "update", "-n", name, "-g", resourceGroup, "--image", `${plan.repo}:${plan.target}`]);
+      await runAz(["containerapp", "update", "-n", name, "-g", resourceGroup, "--image", `${plan.repo}@${assertGatewayDigest(ctx.manifest.components.gateway)}`]);
       return { tag: a.to, digest, state: "managed" };
     case "noop":
       return { tag: a.to, digest, state: "managed" };
@@ -20107,7 +20130,7 @@ async function resolveBicepParamsForConverge(ctx, opts = {}) {
   const location = opts.location ?? (await runAz(["resource", "list", "-g", ctx.resourceGroup, "--query", "[0].location", "-o", "tsv"])).trim();
   const foundryResourceId = await resolveFoundryResourceId(opts.foundryEndpoint ?? "", opts.foundryResourceId);
   const acrPullIdentityResourceId = resolveAcrPullIdentity({ explicit: opts.acrPullIdentity });
-  const imageRef = `${ctx.manifest.components.gateway.ref}:${ctx.manifest.components.gateway.tag}`;
+  const imageRef = gatewayRefFromComponent(ctx.manifest.components.gateway);
   const acrResourceId = await resolveAcrResourceId({ imageRef, explicit: opts.acrResourceId });
   return {
     location,
@@ -20243,6 +20266,57 @@ async function applyPersona(a, ctx, opts) {
   return { treeSha: a.to, foundryVersion };
 }
 
+// src/lib/gateway-verify.ts
+function compareGatewayBinding(args) {
+  const base = { stampTag: args.stampTag, stampDigest: args.stampDigest };
+  if (!args.liveImage) {
+    return { ...base, live: { kind: "unread" }, comparedBy: "none", match: "unknown" };
+  }
+  const parsed = parseImageRef2(args.liveImage);
+  if (parsed.digest) {
+    const comparable = Boolean(args.stampDigest);
+    return {
+      ...base,
+      live: { kind: "digest", digest: parsed.digest },
+      comparedBy: comparable ? "digest" : "none",
+      match: comparable ? parsed.digest === args.stampDigest : "unknown"
+    };
+  }
+  if (parsed.tag) {
+    const comparable = args.stampTag !== "unknown" && args.stampTag !== "";
+    return {
+      ...base,
+      live: { kind: "tag", tag: parsed.tag },
+      comparedBy: comparable ? "tag" : "none",
+      match: comparable ? parsed.tag === args.stampTag : "unknown"
+    };
+  }
+  return { ...base, live: { kind: "unread" }, comparedBy: "none", match: "unknown" };
+}
+var LABEL = (s) => `  ${s}`.padEnd(22, " ");
+function renderLiveVerify(v, apiVersion, fmt2 = { ok: (s) => s, warn: (s) => s }) {
+  const stamp = v.stampDigest ? `${v.stampTag} \xB7 ${v.stampDigest}` : v.stampTag;
+  let live;
+  switch (v.live.kind) {
+    case "digest":
+      live = v.live.digest;
+      break;
+    case "tag":
+      live = `${v.live.tag}  (tag-pinned \u2014 bytes not verified)`;
+      break;
+    default:
+      live = "unknown";
+  }
+  const verdict = v.match === "unknown" ? fmt2.warn("unknown") : v.match ? fmt2.ok("yes") : fmt2.warn("no");
+  const how = v.comparedBy === "none" ? "" : `  (compared by ${v.comparedBy})`;
+  return [
+    `${LABEL("stamp gateway:")}${stamp}`,
+    `${LABEL("live gateway:")}${live}`,
+    `${LABEL("match:")}${verdict}${how}`,
+    `${LABEL("/api/version:")}${apiVersion}`
+  ];
+}
+
 // src/commands/platform/status.ts
 var PlatformStatusCommand = class extends M8tCommand {
   static paths = [["platform", "status"]];
@@ -20298,7 +20372,12 @@ var PlatformStatusCommand = class extends M8tCommand {
     const rows = statusRows(manifest, stamp, tree);
     let verify;
     if (this.verify) {
-      verify = await this.probeLive(gw.containerAppResourceId, gw.gatewayUrl, stamp?.components.gateway.tag);
+      verify = await this.probeLive(
+        gw.containerAppResourceId,
+        gw.gatewayUrl,
+        stamp?.components.gateway.tag,
+        stamp?.components.gateway.digest
+      );
     }
     if (mode === "json") {
       this.context.stdout.write(
@@ -20318,12 +20397,7 @@ var PlatformStatusCommand = class extends M8tCommand {
     if (verify) {
       log("");
       log(colors.field("live verify:"));
-      log(`  stamp gateway tag:  ${verify.stampGatewayTag}`);
-      log(`  live gateway tag:   ${verify.liveGatewayTag}`);
-      log(
-        `  match:               ${verify.gatewayTagMatch === "unknown" ? colors.warn("unknown") : verify.gatewayTagMatch ? colors.success("yes") : colors.warn("no")}`
-      );
-      log(`  /api/version:        ${verify.apiVersion}`);
+      for (const line2 of renderLiveVerify(verify.gateway, verify.apiVersion, { ok: colors.success, warn: colors.warn })) log(line2);
     }
     return 0;
   }
@@ -20347,11 +20421,11 @@ var PlatformStatusCommand = class extends M8tCommand {
    * error, etc.) degrades the affected field to "unknown" rather than
    * throwing — a verify probe must never crash the read-only status command.
    */
-  async probeLive(gatewayResourceId, gatewayUrl, stampGatewayTag) {
-    let liveGatewayTag = "unknown";
+  async probeLive(gatewayResourceId, gatewayUrl, stampGatewayTag, stampGatewayDigest) {
+    let liveImage;
     try {
       const { resourceGroup, name } = parseContainerAppResourceId(gatewayResourceId);
-      const image = (await runAz([
+      liveImage = (await runAz([
         "containerapp",
         "show",
         "-g",
@@ -20362,11 +20436,9 @@ var PlatformStatusCommand = class extends M8tCommand {
         "properties.template.containers[0].image",
         "-o",
         "tsv"
-      ])).trim();
-      const tag = image.split(":").pop();
-      if (tag) liveGatewayTag = tag;
+      ])).trim() || void 0;
     } catch {
-      liveGatewayTag = "unknown";
+      liveImage = void 0;
     }
     let apiVersion = "unknown";
     try {
@@ -20380,9 +20452,17 @@ var PlatformStatusCommand = class extends M8tCommand {
     } catch {
       apiVersion = "unknown";
     }
-    const stampTag = stampGatewayTag ?? "unknown";
-    const gatewayTagMatch = liveGatewayTag === "unknown" || stampTag === "unknown" ? "unknown" : liveGatewayTag === stampTag;
-    return { liveGatewayTag, stampGatewayTag: stampTag, gatewayTagMatch, apiVersion };
+    return {
+      gateway: compareGatewayBinding({
+        stampTag: stampGatewayTag ?? "unknown",
+        // A stamp records "" for a component whose digest it never established, so
+        // empty and absent are the SAME claim here. `??` would preserve "" and let a
+        // caller treat it as a recorded value.
+        stampDigest: stampGatewayDigest === "" ? void 0 : stampGatewayDigest,
+        liveImage
+      }),
+      apiVersion
+    };
   }
 };
 
@@ -20973,7 +21053,7 @@ async function buildConvergeDeps(args) {
           ...existing,
           bicep: {
             ...existing.bicep,
-            imageRef: `${ctx.manifest.components.gateway.ref}:${ctx.manifest.components.gateway.tag}`
+            imageRef: gatewayRefFromComponent(ctx.manifest.components.gateway)
           },
           updatedAt: (/* @__PURE__ */ new Date()).toISOString()
         }
@@ -24010,6 +24090,46 @@ async function probeModelQuota(region, model) {
   const { verdict, quotad } = modelQuotaVerdict(usages, model);
   return { verdict, quotad, model, region, usagesReadable: usages.length > 0 };
 }
+function failureReason(e) {
+  const raw = e instanceof Error ? e.message : String(e);
+  const line2 = raw.split("\n").find((l) => l.trim().length > 0)?.trim() ?? "unknown error";
+  return line2.length > 300 ? `${line2.slice(0, 297)}\u2026` : line2;
+}
+async function probeSoftDeletedAccounts(subscriptionId) {
+  const args = ["cognitiveservices", "account", "list-deleted", "-o", "json"];
+  if (subscriptionId) args.push("--subscription", subscriptionId);
+  let out;
+  try {
+    out = await runAz(args);
+  } catch (e) {
+    return { readable: false, accounts: [], reason: failureReason(e) };
+  }
+  try {
+    const raw = JSON.parse(out);
+    const fromId = (id, segment) => new RegExp(`/${segment}/([^/]+)`, "i").exec(id)?.[1] ?? null;
+    const accounts = [];
+    for (const a of raw) {
+      const id = a.id ?? "";
+      const name = a.name ?? fromId(id, "deletedAccounts");
+      const location = a.location ?? fromId(id, "locations");
+      if (!name || !location) {
+        return { readable: false, accounts: [], reason: `a deleted-account entry carried no usable name or location (id: ${id || "absent"})` };
+      }
+      accounts.push({
+        name,
+        location,
+        // Kind decides whether the account can hold MODEL quota at all. A
+        // soft-deleted SpeechServices account holds none; refusing on it would
+        // block the install and point a purge command at an unrelated resource.
+        kind: a.kind ?? "",
+        resourceGroup: a.resourceGroup ?? fromId(id, "resourceGroups")
+      });
+    }
+    return { readable: true, accounts };
+  } catch (e) {
+    return { readable: false, accounts: [], reason: failureReason(e) };
+  }
+}
 async function bearer(credential2, scope) {
   try {
     const t = await credential2.getToken(scope);
@@ -24452,6 +24572,7 @@ function buildPrereqDeps(opts = {}) {
     probeProviders,
     registerProviders,
     probeModelQuota,
+    probeSoftDeletedAccounts,
     discoverPlatform: async () => {
       const cfg = await readFoundryConfig();
       const d = await discoverGateway({
@@ -24574,8 +24695,10 @@ var PREREQS = [
     phase: "install",
     title: "No soft-deleted Cognitive Services account still holding the model quota",
     breaks: "Quota looks free but the model deployment fails; the quota is held by an account you already deleted.",
-    coverage: "unhandled",
-    checkedBy: "none",
+    coverage: "refuses",
+    checkedBy: "prereqs",
+    // Reported, never repaired. Purging is irreversible and the account may be
+    // one the founder means to recover — `--fix` names the command instead.
     fixable: false
   },
   {
@@ -24696,6 +24819,72 @@ function evaluateProviders(states) {
   }
   return result("resource-providers", "pass", `all ${states.length.toString()} required providers registered`);
 }
+var MODEL_HOSTING_KINDS = /* @__PURE__ */ new Set(["aiservices", "openai", "cognitiveservices"]);
+function holdsModelQuota(a) {
+  return MODEL_HOSTING_KINDS.has(a.kind.trim().toLowerCase());
+}
+function sameRegion(a, b) {
+  const norm = (s) => s.replace(/\s+/g, "").toLowerCase();
+  return norm(a) === norm(b);
+}
+function softDeletedRemedy(accounts) {
+  const purge = accounts.map((a) => `az cognitiveservices account purge -n ${a.name} -g ${a.resourceGroup ?? "<resource-group-it-was-in>"} -l ${a.location}`).join("\n        ");
+  const it = accounts.length === 1 ? "it" : "them";
+  return `Purge ${it} \u2014 permanent, the account and its model deployments cannot be recovered afterwards:
+        ${purge}
+        Meant to keep one? 'az cognitiveservices account recover' takes the same -n/-g/-l and restores it (its quota then reads honestly again).
+        Or install into a region with no soft-deleted account.`;
+}
+function asideNote(others, where) {
+  if (others.length === 0) return "";
+  const kinds = [...new Set(others.map((a) => a.kind || "unknown kind"))].join(", ");
+  return ` (${others.length.toString()} other soft-deleted ${others.length === 1 ? "account" : "accounts"} ${where} \u2014 ${kinds} \u2014 ${others.length === 1 ? "cannot hold" : "cannot hold"} model quota, so ${others.length === 1 ? "it is" : "they are"} not judged here)`;
+}
+function evaluateSoftDeletedAccounts(e) {
+  if (!e.readable) {
+    return result(
+      "soft-deleted-account",
+      "skipped",
+      `could not list this subscription's soft-deleted Cognitive Services accounts \u2014 proceeding unverified (${e.reason ?? "no reason reported"})`
+    );
+  }
+  const mechanism = "A soft-deleted account keeps its model quota until it is purged";
+  const quotaBearing = e.accounts.filter(holdsModelQuota);
+  const others = e.accounts.filter((a) => !holdsModelQuota(a));
+  if (e.region) {
+    const region = e.region;
+    const here = quotaBearing.filter((a) => sameRegion(a.location, region));
+    if (here.length === 0) {
+      return result(
+        "soft-deleted-account",
+        "pass",
+        `no soft-deleted model-hosting accounts in ${region}` + asideNote(others.filter((a) => sameRegion(a.location, region)), "there")
+      );
+    }
+    const noun2 = here.length === 1 ? "account" : "accounts";
+    return result(
+      "soft-deleted-account",
+      "fail",
+      `${here.length.toString()} soft-deleted Cognitive Services ${noun2} in ${region}: ${here.map((a) => `${a.name} (${a.kind || "unknown kind"})`).join(", ")}. ${mechanism}, so quota can read free here and the model deployment still fail.`,
+      softDeletedRemedy(here)
+    );
+  }
+  if (quotaBearing.length === 0) {
+    return result(
+      "soft-deleted-account",
+      "pass",
+      "no soft-deleted model-hosting accounts anywhere in this subscription" + asideNote(others, "in this subscription")
+    );
+  }
+  const regions = [...new Set(quotaBearing.map((a) => a.location.replace(/\s+/g, "").toLowerCase()))];
+  const noun = quotaBearing.length === 1 ? "account" : "accounts";
+  return result(
+    "soft-deleted-account",
+    "warn",
+    `no region given, so this cannot be judged against your target. This subscription has ${quotaBearing.length.toString()} soft-deleted Cognitive Services ${noun}: ${quotaBearing.map((a) => `${a.name} (${a.location})`).join(", ")}. ${mechanism} \u2014 installing into ${regions.length === 1 ? regions[0] : "one of those regions"} would let quota read free while the model deployment still fails.`,
+    softDeletedRemedy(quotaBearing)
+  );
+}
 function evaluateModelQuota(e) {
   if (!e.usagesReadable) {
     return result("model-quota", "skipped", `could not read model quota in ${e.region} \u2014 proceeding unverified`);
@@ -24883,6 +25072,11 @@ async function runInstallPhase(deps, opts) {
     }
   }
   results.push(evaluateProviders(await deps.probeProviders(REQUIRED_PROVIDERS, subscriptionId)));
+  const softDeleted = await deps.probeSoftDeletedAccounts(subscriptionId).catch((e) => {
+    const raw = e instanceof Error ? e.message : String(e);
+    return { readable: false, accounts: [], reason: raw.length > 300 ? `${raw.slice(0, 297)}\u2026` : raw };
+  });
+  results.push(evaluateSoftDeletedAccounts({ ...softDeleted, ...opts.region ? { region: opts.region } : {} }));
   if (opts.region && opts.model) {
     results.push(evaluateModelQuota(await deps.probeModelQuota(opts.region, opts.model)));
   }
@@ -25000,7 +25194,7 @@ var PrereqsCommand = class extends M8tCommand {
   static paths = [["prereqs"]];
   static usage = Command47.Usage({
     description: "Check (and optionally fix) everything m8t needs \u2014 to install, or for you to use it.",
-    details: "Runs one of two phases. With no platform discoverable it checks INSTALL prerequisites: your Azure sign-in, subscription and directory rights, resource-provider registrations, and model quota. With a platform live it checks USAGE prerequisites for the signed-in account: the sign-in redirect URI, Foundry data-plane access, and Key Vault secrets access. Pass --fix to repair what is repairable, and --fix --for <upn> to set a teammate up (usage phase only). Read-only without --fix.",
+    details: "Runs one of two phases. With no platform discoverable it checks INSTALL prerequisites: your Azure sign-in, subscription and directory rights, resource-provider registrations, soft-deleted Cognitive Services accounts (they hold their model quota until purged), and model quota. With a platform live it checks USAGE prerequisites for the signed-in account: the sign-in redirect URI, Foundry data-plane access, and Key Vault secrets access. Pass --fix to repair what is repairable, and --fix --for <upn> to set a teammate up (usage phase only). Read-only without --fix.",
     examples: [
       ["Before installing", "$0 prereqs"],
       ["Register anything missing, then install", "$0 prereqs --fix"],
@@ -25012,7 +25206,7 @@ var PrereqsCommand = class extends M8tCommand {
   fix = Option44.Boolean("--fix", false, { description: "Repair what is repairable. Without it the command only reports." });
   for_ = Option44.String("--for", { description: "UPN or object id of another person. Usage phase only." });
   phase = Option44.String("--phase", { description: "Force 'install' or 'usage' instead of auto-detecting." });
-  region = Option44.String("--region", { description: "Target region for the install-phase quota check." });
+  region = Option44.String("--region", { description: "Target region. Enables the install-phase quota check, and judges soft-deleted accounts against the region you will install into (without it, they only warn)." });
   model = Option44.String("--model", { description: `Model whose quota the install needs (default ${INSTALL_REASONING_MODEL}).` });
   clientId = Option44.String("--client-id", { description: "A ready app registration, in place of directory-admin rights." });
   subscription = Option44.String("--subscription");
@@ -28390,11 +28584,15 @@ var SPEND_DISCLOSURE = [
 ].join("\n");
 
 // src/commands/bootstrap/preflight.ts
+var PREFLIGHT_SELF_REPORTED = ["az-signed-in", "subscription-admin", "app-registration"];
+function preflightRenderable(results) {
+  return results.filter((r) => !PREFLIGHT_SELF_REPORTED.includes(r.slug));
+}
 var BootstrapPreflightCommand = class extends M8tCommand {
   static paths = [["bootstrap", "preflight"]];
   static usage = Command53.Usage({
     description: "Loudly verify you can install m8t (Owner/UAA + directory admin) and hard-stop if not.",
-    details: "Step 1 of `m8t bootstrap`. Prints an unmissable admin-credentials notice, then checks: Owner or User Access Administrator at subscription scope (hard requirement), directory-admin capability to register the app (or pass --client-id), every Azure resource provider the install uses (registering any that are missing), and \u2014 with --location \u2014 model quota in the target region. Exits non-zero with the exact failing check + remedy. `m8t prereqs` runs the same substrate checks on their own.",
+    details: "Step 1 of `m8t bootstrap`. Prints an unmissable admin-credentials notice, then checks: Owner or User Access Administrator at subscription scope (hard requirement), directory-admin capability to register the app (or pass --client-id), every Azure resource provider the install uses (registering any that are missing), soft-deleted Cognitive Services accounts (they keep their model quota until purged, so quota can read free and the model deployment still fail), and \u2014 with --location \u2014 model quota in the target region. Exits non-zero with the exact failing check + remedy. `m8t prereqs` runs the same substrate checks on their own.",
     examples: [
       ["Run the preflight", "$0 bootstrap preflight"],
       ["Check quota for the region you will install into", "$0 bootstrap preflight --location eastus2"],
@@ -28450,8 +28648,12 @@ ${colors.dim(DISCLOSURE_TIER1)}
 `));
       }
     });
-    for (const r of verdict.results.filter((x) => x.slug === "resource-providers" || x.slug === "model-quota")) {
-      this.context.stdout.write(line(r.status !== "fail", r.title, r.detail));
+    for (const r of preflightRenderable(verdict.results)) {
+      this.context.stdout.write(statusLine(r.status, r.title, r.detail));
+      if ((r.status === "warn" || r.status === "skipped") && r.remedy) {
+        this.context.stdout.write(`      ${colors.hint("if this is your region:")} ${r.remedy}
+`);
+      }
       if (r.status === "fail") {
         this.context.stderr.write(failBlock(r.detail, r.remedy ?? "See guides/prerequisites.md."));
         throw new LocalCliError({ code: `BOOTSTRAP_PREREQ_${r.slug.toUpperCase().replace(/-/g, "_")}`, message: r.detail, hint: r.remedy });
@@ -28479,6 +28681,12 @@ function line(ok, label, note) {
   return `  ${mark} ${label.padEnd(50)} ${colors.dim(`(${note})`)}
 `;
 }
+function statusLine(status, label, note) {
+  if (status === "fail") return line(false, label, note);
+  if (status === "pass" || status === "fixed") return line(true, label, note);
+  return `  ${colors.hint("!")} ${label.padEnd(50)} ${colors.dim(`(${note})`)}
+`;
+}
 function failBlock(why, remedy) {
   return `
 ${colors.error("\u26D4 CANNOT PROCEED")}
@@ -28858,7 +29066,7 @@ ${colors.error("\u2717")} The GitHub App on disk is installed on ${colors.field(
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.53";
+var DEFAULT_INSTALLER_TAG = "v0.1.55";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {