@m8t-stack/cli 0.2.82 → 0.2.83

package/dist/cli.js

@@ -1467,7 +1467,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.82";
+var CLI_VERSION = "0.2.83";
 
 // src/lib/render-error.ts
 init_errors();
@@ -28892,21 +28892,28 @@ var ARM4 = "https://management.azure.com";
 var ARM_SCOPE8 = "https://management.azure.com/.default";
 var STORAGE_API2 = "2023-05-01";
 var LA_API = "2023-09-01";
+var tagOf = (a, key2) => a.tags?.[key2] ?? a.properties?.tags?.[key2];
+function selectLedgerAccount(accounts, storageAccount) {
+  if (storageAccount) return accounts.find((a) => a.name === storageAccount);
+  const managed = accounts.filter((a) => tagOf(a, "managedBy") === "m8t");
+  return managed.find((a) => tagOf(a, "m8t") === "storage") ?? managed.at(0) ?? accounts.find((a) => tagOf(a, "m8t:role") === "ledger") ?? (accounts.length === 1 ? accounts[0] : void 0);
+}
 async function discoverLedgerResources(opts) {
-  const { credential: credential2, subscriptionId, resourceGroup } = opts;
+  const { credential: credential2, subscriptionId, resourceGroup, storageAccount } = opts;
   const storage = await authedJsonPagedValues({
     credential: credential2,
     scope: ARM_SCOPE8,
     url: `${ARM4}/subscriptions/${subscriptionId}/resourceGroups/${resourceGroup}/providers/Microsoft.Storage/storageAccounts?api-version=${STORAGE_API2}`
   });
   const accounts = storage.filter((a) => a.properties?.primaryEndpoints?.table);
-  const ledgerAcct = accounts.find((a) => (a.tags?.["m8t:role"] ?? a.properties?.tags?.["m8t:role"]) === "ledger") ?? (accounts.length === 1 ? accounts[0] : void 0);
+  const ledgerAcct = selectLedgerAccount(accounts, storageAccount);
   const ledgerTableEndpoint = ledgerAcct?.properties?.primaryEndpoints?.table?.replace(/\/$/, "");
   if (!ledgerTableEndpoint) {
+    const found = accounts.map((a) => a.name).join(", ") || "(none)";
     throw new LocalCliError({
       code: "DREAM_LEDGER_STORAGE_NOT_FOUND",
-      message: `No AgentLedger storage account found in resource group ${resourceGroup}.`,
-      hint: `Found: ${accounts.map((a) => a.name).join(", ") || "(none)"}. Tag the ledger account 'm8t:role=ledger'.`
+      message: storageAccount ? `Storage account '${storageAccount}' was not found in resource group ${resourceGroup}, or has no table endpoint.` : `No AgentLedger storage account found in resource group ${resourceGroup}.`,
+      hint: `Found: ${found}. Pass --storage-account <name> to select one explicitly.`
     });
   }
   const ws = await authedJsonPagedValues({
@@ -28948,6 +28955,7 @@ async function resolveDreamContext(opts) {
   });
   const resourceGroup = rgFromScope(project.accountScope);
   const { ledgerTableEndpoint, workspaceId } = await discoverLedgerResources({
+    storageAccount: opts.storageAccount,
     credential: credential2,
     subscriptionId,
     resourceGroup
@@ -29015,6 +29023,9 @@ var DreamRunCommand = class extends M8tCommand {
   });
   subscription = Option49.String("--subscription");
   endpoint = Option49.String("--endpoint");
+  storageAccount = Option49.String("--storage-account", {
+    description: "Ledger storage account name (skips tag-based discovery)"
+  });
   output = Option49.String("--output");
   // Resolution seam — overridden by tests; built lazily at runtime otherwise.
   deps;
@@ -29032,7 +29043,8 @@ var DreamRunCommand = class extends M8tCommand {
       const liveContext = await liveDeps.resolveContext({
         worker,
         subscription: typeof this.subscription === "string" ? this.subscription : void 0,
-        endpoint: typeof this.endpoint === "string" ? this.endpoint : void 0
+        endpoint: typeof this.endpoint === "string" ? this.endpoint : void 0,
+        storageAccount: typeof this.storageAccount === "string" ? this.storageAccount : void 0
       });
       const liveCursor = await liveDeps.readCursor(liveContext.worker);
       const result2 = await liveDeps.runDream({
@@ -29079,7 +29091,8 @@ var DreamRunCommand = class extends M8tCommand {
     const context = await deps.resolveContext({
       worker,
       subscription: typeof this.subscription === "string" ? this.subscription : void 0,
-      endpoint: typeof this.endpoint === "string" ? this.endpoint : void 0
+      endpoint: typeof this.endpoint === "string" ? this.endpoint : void 0,
+      storageAccount: typeof this.storageAccount === "string" ? this.storageAccount : void 0
     });
     const now = /* @__PURE__ */ new Date();
     const cursor = await deps.readCursor(context.worker);
@@ -29429,13 +29442,28 @@ function defaultDeps2() {
       const { ledgerTableEndpoint } = await discoverLedgerResources({
         credential: credential2,
         subscriptionId,
-        resourceGroup: m[1]
+        resourceGroup: m[1],
+        storageAccount: opts.storageAccount
       });
       return { projectEndpoint: project.endpoint, ledgerTableEndpoint };
     },
     async fetchRows(ctx, fromIso, toIso) {
       const client = new TableClient8(ctx.ledgerTableEndpoint, LEDGER_TABLE_NAME2, credential2);
-      return fetchLedgerRows({ workers: [], source: "all", from: fromIso, to: toIso }, client);
+      try {
+        return await fetchLedgerRows({ workers: [], source: "all", from: fromIso, to: toIso }, client);
+      } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        if (statusOf2(e) === 403 || msg.includes("AuthorizationPermissionMismatch")) {
+          const account = /https:\/\/([^.]+)\./.exec(ctx.ledgerTableEndpoint)?.[1] ?? "the ledger account";
+          throw new LocalCliError({
+            code: "sweep_ledger_forbidden",
+            message: `Not authorized to read the ledger table on '${account}'.`,
+            hint: `Reading table rows needs a data-plane role: grant 'Storage Table Data Reader' on that storage account to the signed-in identity (owning the account is not enough).`,
+            cause: e
+          });
+        }
+        throw e;
+      }
     },
     async retrieveMetadata(ctx, conversationId) {
       try {
@@ -29506,6 +29534,9 @@ var ConversationsSweepCommand = class extends M8tCommand {
   });
   subscription = Option50.String("--subscription", { description: "Azure subscription id override" });
   endpoint = Option50.String("--endpoint", { description: "Foundry project endpoint override" });
+  storageAccount = Option50.String("--storage-account", {
+    description: "Ledger storage account name (skips tag-based discovery)"
+  });
   deps = defaultDeps2();
   async executeCommand() {
     const out = this.context.stdout;
@@ -29522,7 +29553,11 @@ var ConversationsSweepCommand = class extends M8tCommand {
     const cutoffIso = new Date(now - retentionDays * DAY_MS).toISOString();
     const fromIso = new Date(now - lookback * DAY_MS).toISOString();
     const toIso = new Date(now).toISOString();
-    const ctx = await this.deps.resolveContext({ subscription: this.subscription, endpoint: this.endpoint });
+    const ctx = await this.deps.resolveContext({
+      subscription: this.subscription,
+      endpoint: this.endpoint,
+      storageAccount: this.storageAccount
+    });
     out.write(`Scanning ledger activity ${fromIso} \u2192 ${toIso}; retention cutoff ${cutoffIso}.
 `);
     const rows = await this.deps.fetchRows(ctx, fromIso, toIso);