sofia-cli 0.1.1

package/infra/deploy.sh

@@ -0,0 +1,193 @@
+#!/usr/bin/env bash
+# ──────────────────────────────────────────────────────────────────────────────
+# deploy.sh — One-command Azure AI Foundry deployment for sofIA
+#
+# Provisions:
+#   - Resource group (auto-created)
+#   - AI Services account with Foundry project
+#   - Model deployment (gpt-4.1-mini by default)
+#   - Agent Service capability hosts
+#
+# Usage:
+#   ./infra/deploy.sh --resource-group <name> [options]
+#
+# Exit codes:
+#   0 — Deployment succeeded
+#   1 — Prerequisite check failed
+#   2 — Deployment failed
+# ──────────────────────────────────────────────────────────────────────────────
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# ── Defaults ──────────────────────────────────────────────────────────────────
+
+SUBSCRIPTION=""
+RESOURCE_GROUP=""
+LOCATION="swedencentral"
+ACCOUNT_NAME="sofia-foundry"
+MODEL="gpt-4.1-mini"
+
+# ── Parameter parsing ─────────────────────────────────────────────────────────
+
+usage() {
+  cat <<EOF
+Usage: $(basename "$0") [options]
+
+Required:
+  -g, --resource-group <name>   Resource group name (created if missing)
+
+Optional:
+  -s, --subscription <id>       Azure subscription ID (default: current az CLI subscription)
+  -l, --location <region>       Azure region (default: swedencentral)
+  -n, --account-name <name>     Foundry account name (default: sofia-foundry)
+  -m, --model <name>            Model deployment name (default: gpt-4.1-mini)
+  -h, --help                    Show this help message
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    -s|--subscription)
+      SUBSCRIPTION="$2"; shift 2 ;;
+    -g|--resource-group)
+      RESOURCE_GROUP="$2"; shift 2 ;;
+    -l|--location)
+      LOCATION="$2"; shift 2 ;;
+    -n|--account-name)
+      ACCOUNT_NAME="$2"; shift 2 ;;
+    -m|--model)
+      MODEL="$2"; shift 2 ;;
+    -h|--help)
+      usage; exit 0 ;;
+    *)
+      echo "❌ Unknown option: $1" >&2
+      usage >&2
+      exit 1 ;;
+  esac
+done
+
+# ── Validate required parameters ─────────────────────────────────────────────
+
+if [[ -z "$RESOURCE_GROUP" ]]; then
+  echo "❌ Missing required parameter: --resource-group (-g)" >&2
+  usage >&2
+  exit 1
+fi
+
+# ── Prerequisite checks ──────────────────────────────────────────────────────
+
+echo "🔍 Checking prerequisites..."
+
+# Check az CLI is installed
+if ! command -v az &>/dev/null; then
+  echo "❌ Azure CLI (az) is not installed." >&2
+  echo "   Install: https://learn.microsoft.com/en-us/cli/azure/install-azure-cli" >&2
+  exit 1
+fi
+
+# Check user is logged in
+if ! az account show &>/dev/null; then
+  echo "❌ Not logged in to Azure. Run 'az login' first." >&2
+  exit 1
+fi
+
+# Optionally set subscription
+if [[ -n "$SUBSCRIPTION" ]]; then
+  echo "📋 Setting subscription to: $SUBSCRIPTION"
+  if ! az account set --subscription "$SUBSCRIPTION" 2>/dev/null; then
+    echo "❌ Could not set subscription '$SUBSCRIPTION'." >&2
+    echo "   Check the subscription ID and your permissions." >&2
+    exit 1
+  fi
+fi
+
+echo "✅ Prerequisites passed"
+
+# ── Resolve current user's principal (object) ID for RBAC ─────────────────────
+
+echo "🔑 Resolving current user's principal ID..."
+USER_PRINCIPAL_ID=$(az ad signed-in-user show --query id -o tsv 2>/dev/null || true)
+if [[ -z "$USER_PRINCIPAL_ID" ]]; then
+  echo "⚠️  Could not resolve user principal ID. Role assignment will be skipped." >&2
+  echo "   You may need to manually assign the 'Azure AI Developer' role." >&2
+else
+  echo "   Principal ID: $USER_PRINCIPAL_ID"
+fi
+
+# ── Deploy ────────────────────────────────────────────────────────────────────
+
+echo ""
+echo "🚀 Deploying Azure AI Foundry infrastructure..."
+echo "   Resource Group: $RESOURCE_GROUP"
+echo "   Location:       $LOCATION"
+echo "   Account:        $ACCOUNT_NAME"
+echo "   Model:          $MODEL"
+echo ""
+
+DEPLOYMENT_NAME="sofia-foundry-$(date +%Y%m%d%H%M%S)"
+
+if ! az deployment sub create \
+  --location "$LOCATION" \
+  --name "$DEPLOYMENT_NAME" \
+  --template-file "$SCRIPT_DIR/main.bicep" \
+  --parameters "$SCRIPT_DIR/main.bicepparam" \
+  --parameters \
+    resourceGroupName="$RESOURCE_GROUP" \
+    location="$LOCATION" \
+    accountName="$ACCOUNT_NAME" \
+    modelDeploymentName="$MODEL" \
+    modelName="$MODEL" \
+    userPrincipalId="$USER_PRINCIPAL_ID" \
+  --output json; then
+  echo "" >&2
+  echo "❌ Deployment failed." >&2
+  echo "   Check the error above for details." >&2
+  echo "   Common issues:" >&2
+  echo "   - Insufficient permissions (need Owner or Contributor)" >&2
+  echo "   - Region doesn't support AI Foundry Agent Service" >&2
+  echo "   - Resource name conflict (try a different --account-name)" >&2
+  exit 2
+fi
+
+# ── Query outputs ─────────────────────────────────────────────────────────────
+
+PROJECT_ENDPOINT=$(az deployment sub show \
+  --name "$DEPLOYMENT_NAME" \
+  --query "properties.outputs.projectEndpoint.value" \
+  --output tsv 2>/dev/null || echo "")
+
+MODEL_DEPLOYMENT_NAME=$(az deployment sub show \
+  --name "$DEPLOYMENT_NAME" \
+  --query "properties.outputs.modelDeploymentName.value" \
+  --output tsv 2>/dev/null || echo "$MODEL")
+
+# ── Write .env file ───────────────────────────────────────────────────────────
+
+ENV_FILE="$SCRIPT_DIR/../.env"
+
+# Helper: set or update a KEY=VALUE in the .env file
+set_env_var() {
+  local key="$1" value="$2"
+  if [[ -f "$ENV_FILE" ]] && grep -q "^${key}=" "$ENV_FILE"; then
+    # Update existing entry (portable sed -i)
+    sed -i "s|^${key}=.*|${key}=\"${value}\"|" "$ENV_FILE"
+  else
+    echo "${key}=\"${value}\"" >> "$ENV_FILE"
+  fi
+}
+
+set_env_var "FOUNDRY_PROJECT_ENDPOINT" "$PROJECT_ENDPOINT"
+set_env_var "FOUNDRY_MODEL_DEPLOYMENT_NAME" "$MODEL_DEPLOYMENT_NAME"
+
+# ── Output ────────────────────────────────────────────────────────────────────
+
+echo ""
+echo "✅ Deployment complete!"
+echo ""
+echo "Environment variables written to $(realpath "$ENV_FILE"):"
+echo ""
+echo "  FOUNDRY_PROJECT_ENDPOINT=\"$PROJECT_ENDPOINT\""
+echo "  FOUNDRY_MODEL_DEPLOYMENT_NAME=\"$MODEL_DEPLOYMENT_NAME\""
+echo ""
+echo "To tear down: ./infra/teardown.sh --resource-group $RESOURCE_GROUP"

package/infra/gather-env.sh

@@ -0,0 +1,211 @@
+#!/usr/bin/env bash
+# ──────────────────────────────────────────────────────────────────────────────
+# gather-env.sh — Fetch environment values from an existing Azure AI Foundry
+#                 resource group without redeploying.
+#
+# Queries the AI Services account and project already provisioned by deploy.sh,
+# then writes (or updates) the .env file with the same variables.
+#
+# Usage:
+#   ./infra/gather-env.sh --resource-group <name> [options]
+#
+# Exit codes:
+#   0 — Values gathered and written successfully
+#   1 — Prerequisite / parameter check failed
+#   2 — Resource query failed
+# ──────────────────────────────────────────────────────────────────────────────
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# ── Defaults ──────────────────────────────────────────────────────────────────
+
+SUBSCRIPTION=""
+RESOURCE_GROUP=""
+ACCOUNT_NAME="sofia-foundry"
+MODEL=""
+
+# ── Parameter parsing ─────────────────────────────────────────────────────────
+
+usage() {
+  cat <<EOF
+Usage: $(basename "$0") [options]
+
+Required:
+  -g, --resource-group <name>   Resource group containing the Foundry resources
+
+Optional:
+  -s, --subscription <id>       Azure subscription ID (default: current az CLI subscription)
+  -n, --account-name <name>     AI Services account name (default: sofia-foundry)
+  -m, --model <name>            Override model deployment name (default: auto-detected)
+  -h, --help                    Show this help message
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    -s|--subscription)
+      SUBSCRIPTION="$2"; shift 2 ;;
+    -g|--resource-group)
+      RESOURCE_GROUP="$2"; shift 2 ;;
+    -n|--account-name)
+      ACCOUNT_NAME="$2"; shift 2 ;;
+    -m|--model)
+      MODEL="$2"; shift 2 ;;
+    -h|--help)
+      usage; exit 0 ;;
+    *)
+      echo "❌ Unknown option: $1" >&2
+      usage >&2
+      exit 1 ;;
+  esac
+done
+
+# ── Validate required parameters ─────────────────────────────────────────────
+
+if [[ -z "$RESOURCE_GROUP" ]]; then
+  echo "❌ Missing required parameter: --resource-group (-g)" >&2
+  usage >&2
+  exit 1
+fi
+
+# ── Prerequisite checks ──────────────────────────────────────────────────────
+
+echo "🔍 Checking prerequisites..."
+
+if ! command -v az &>/dev/null; then
+  echo "❌ Azure CLI (az) is not installed." >&2
+  echo "   Install: https://learn.microsoft.com/en-us/cli/azure/install-azure-cli" >&2
+  exit 1
+fi
+
+if ! az account show &>/dev/null; then
+  echo "❌ Not logged in to Azure. Run 'az login' first." >&2
+  exit 1
+fi
+
+if [[ -n "$SUBSCRIPTION" ]]; then
+  echo "📋 Setting subscription to: $SUBSCRIPTION"
+  if ! az account set --subscription "$SUBSCRIPTION" 2>/dev/null; then
+    echo "❌ Could not set subscription '$SUBSCRIPTION'." >&2
+    exit 1
+  fi
+fi
+
+echo "✅ Prerequisites passed"
+
+# ── Verify resource group exists ──────────────────────────────────────────────
+
+echo ""
+echo "🔍 Verifying resource group: $RESOURCE_GROUP"
+
+if ! az group show --name "$RESOURCE_GROUP" &>/dev/null; then
+  echo "❌ Resource group '$RESOURCE_GROUP' not found." >&2
+  echo "   Run deploy.sh first to create the infrastructure." >&2
+  exit 2
+fi
+
+# ── Find the AI Services account ─────────────────────────────────────────────
+
+echo "🔍 Looking up AI Services account: $ACCOUNT_NAME"
+
+if ! az cognitiveservices account show \
+       --resource-group "$RESOURCE_GROUP" \
+       --name "$ACCOUNT_NAME" &>/dev/null; then
+  echo "⚠️  Account '$ACCOUNT_NAME' not found. Searching for AI Services accounts in the resource group..."
+  ACCOUNT_NAME=$(az cognitiveservices account list \
+    --resource-group "$RESOURCE_GROUP" \
+    --query "[?kind=='AIServices'].name | [0]" \
+    --output tsv 2>/dev/null || true)
+
+  if [[ -z "$ACCOUNT_NAME" ]]; then
+    echo "❌ No AI Services account found in resource group '$RESOURCE_GROUP'." >&2
+    exit 2
+  fi
+  echo "   Found account: $ACCOUNT_NAME"
+fi
+
+# ── Find the project and its endpoint ────────────────────────────────────────
+
+echo "🔍 Looking up Foundry project..."
+
+PROJECT_ENDPOINT=$(az cognitiveservices account show \
+  --resource-group "$RESOURCE_GROUP" \
+  --name "$ACCOUNT_NAME" \
+  --query "properties.endpoints.\"AI Foundry API\"" \
+  --output tsv 2>/dev/null || true)
+
+# If the account-level endpoint isn't what we need, try querying the project
+if [[ -z "$PROJECT_ENDPOINT" ]]; then
+  # List projects under the account
+  PROJECT_NAME=$(az resource list \
+    --resource-group "$RESOURCE_GROUP" \
+    --resource-type "Microsoft.CognitiveServices/accounts/projects" \
+    --query "[0].name" \
+    --output tsv 2>/dev/null || true)
+
+  if [[ -n "$PROJECT_NAME" ]]; then
+    # The resource name is "account/project", extract just the project part
+    LOCAL_PROJECT="${PROJECT_NAME##*/}"
+    echo "   Found project: $LOCAL_PROJECT"
+
+    PROJECT_ENDPOINT=$(az rest \
+      --method GET \
+      --uri "https://management.azure.com/subscriptions/$(az account show --query id -o tsv)/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.CognitiveServices/accounts/$ACCOUNT_NAME/projects/$LOCAL_PROJECT?api-version=2025-06-01" \
+      --query "properties.endpoints.\"AI Foundry API\"" \
+      --output tsv 2>/dev/null || true)
+  fi
+fi
+
+if [[ -z "$PROJECT_ENDPOINT" ]]; then
+  echo "❌ Could not determine the Foundry project endpoint." >&2
+  echo "   Ensure a project exists under account '$ACCOUNT_NAME'." >&2
+  exit 2
+fi
+
+echo "   Endpoint: $PROJECT_ENDPOINT"
+
+# ── Find the model deployment name ───────────────────────────────────────────
+
+if [[ -z "$MODEL" ]]; then
+  echo "🔍 Looking up model deployment..."
+  MODEL=$(az cognitiveservices account deployment list \
+    --resource-group "$RESOURCE_GROUP" \
+    --name "$ACCOUNT_NAME" \
+    --query "[0].name" \
+    --output tsv 2>/dev/null || true)
+
+  if [[ -z "$MODEL" ]]; then
+    echo "⚠️  No model deployment found. Using default: gpt-4.1-mini"
+    MODEL="gpt-4.1-mini"
+  fi
+fi
+
+echo "   Model deployment: $MODEL"
+
+# ── Write .env file ───────────────────────────────────────────────────────────
+
+ENV_FILE="$SCRIPT_DIR/../.env"
+
+set_env_var() {
+  local key="$1" value="$2"
+  if [[ -f "$ENV_FILE" ]] && grep -q "^${key}=" "$ENV_FILE"; then
+    sed -i "s|^${key}=.*|${key}=\"${value}\"|" "$ENV_FILE"
+  else
+    echo "${key}=\"${value}\"" >> "$ENV_FILE"
+  fi
+}
+
+set_env_var "FOUNDRY_PROJECT_ENDPOINT" "$PROJECT_ENDPOINT"
+set_env_var "FOUNDRY_MODEL_DEPLOYMENT_NAME" "$MODEL"
+
+# ── Output ────────────────────────────────────────────────────────────────────
+
+echo ""
+echo "✅ Environment values gathered successfully!"
+echo ""
+echo "Written to $(realpath "$ENV_FILE"):"
+echo ""
+echo "  FOUNDRY_PROJECT_ENDPOINT=\"$PROJECT_ENDPOINT\""
+echo "  FOUNDRY_MODEL_DEPLOYMENT_NAME=\"$MODEL\""
+echo ""

package/infra/main.bicep

@@ -0,0 +1,90 @@
+// ──────────────────────────────────────────────────────────────────────────────
+// Azure AI Foundry — Basic Agent Setup with Web Search
+//
+// Provisions:
+//   1. Resource Group (auto-created)
+//   2. AI Services account (Foundry) with project management enabled
+//   3. Model deployment (default: gpt-4.1-mini, GlobalStandard SKU)
+//   4. Foundry project (provides the endpoint URL)
+//   5. Account-level capability host (Agents)
+//   6. Project-level capability host (Agents, basic/Microsoft-managed)
+//
+// Usage:
+//   az deployment sub create --location <region> --template-file main.bicep \
+//     --parameters main.bicepparam
+//
+// See: specs/005-ai-search-deploy/research.md (R1, R2)
+// ──────────────────────────────────────────────────────────────────────────────
+
+targetScope = 'subscription'
+
+// ── Parameters ───────────────────────────────────────────────────────────────
+
+@description('Azure region for all resources. Must support Azure AI Foundry Agent Service.')
+param location string = 'swedencentral'
+
+@description('Name of the resource group to create or use.')
+param resourceGroupName string
+
+@description('Name of the Azure AI Services (Foundry) account. Used to derive the custom subdomain.')
+param accountName string = 'sofia-foundry'
+
+@description('Name of the Foundry project. Provides the endpoint URL for the sofIA CLI.')
+param projectName string = 'sofia-project'
+
+@description('Name of the model deployment. Used as FOUNDRY_MODEL_DEPLOYMENT_NAME env var.')
+param modelDeploymentName string = 'gpt-4.1-mini'
+
+@description('Model name to deploy. Must support web_search_preview tool type.')
+param modelName string = 'gpt-4.1-mini'
+
+@description('Model version to deploy. Pinned for reproducibility.')
+param modelVersion string = '2025-04-14'
+
+@description('SKU name for the model deployment. GlobalStandard provides broadest region availability.')
+param modelSkuName string = 'GlobalStandard'
+
+@description('SKU capacity (TPM in thousands). Default value=5000.')
+param modelSkuCapacity int = 5000
+
+@description('Object ID of the user principal to grant Azure AI Developer access. Obtain with: az ad signed-in-user show --query id -o tsv')
+param userPrincipalId string
+
+// ── Unique suffix for globally unique names ──────────────────────────────────
+
+var uniqueSuffix = uniqueString(subscription().subscriptionId, resourceGroupName)
+
+// ── Resource Group ───────────────────────────────────────────────────────────
+
+// Auto-create the resource group if it doesn't exist (FR-002)
+resource rg 'Microsoft.Resources/resourceGroups@2024-03-01' = {
+  name: resourceGroupName
+  location: location
+}
+
+// ── Module: all resources deployed into the resource group ───────────────────
+
+module resources 'resources.bicep' = {
+  name: 'foundry-resources'
+  scope: rg
+  params: {
+    location: location
+    accountName: accountName
+    projectName: projectName
+    modelDeploymentName: modelDeploymentName
+    modelName: modelName
+    modelVersion: modelVersion
+    modelSkuName: modelSkuName
+    modelSkuCapacity: modelSkuCapacity
+    uniqueSuffix: uniqueSuffix
+    userPrincipalId: userPrincipalId
+  }
+}
+
+// ── Outputs ──────────────────────────────────────────────────────────────────
+
+@description('Foundry project endpoint URL — set as FOUNDRY_PROJECT_ENDPOINT')
+output projectEndpoint string = resources.outputs.projectEndpoint
+
+@description('Model deployment name — set as FOUNDRY_MODEL_DEPLOYMENT_NAME')
+output modelDeploymentName string = modelDeploymentName

package/infra/main.bicepparam

@@ -0,0 +1,18 @@
+using 'main.bicep'
+
+// ── Default parameters for workshop/PoC deployment ───────────────────────────
+// Override at deploy time via:
+//   az deployment sub create --parameters resourceGroupName='my-rg' location='eastus'
+
+param resourceGroupName = 'sofia-rg'
+param location = 'swedencentral'
+param accountName = 'sofia-foundry'
+param projectName = 'sofia-project'
+param modelDeploymentName = 'gpt-4.1-mini'
+param modelName = 'gpt-4.1-mini'
+param modelVersion = '2025-04-14'
+param modelSkuName = 'GlobalStandard'
+param modelSkuCapacity = 1
+
+// Resolved at deploy time by deploy.sh via: az ad signed-in-user show --query id -o tsv
+param userPrincipalId = ''

package/infra/resources.bicep

@@ -0,0 +1,134 @@
+// ──────────────────────────────────────────────────────────────────────────────
+// Resource-group-scoped resources for Azure AI Foundry
+//
+// Deployed as a module from main.bicep (subscription-scoped).
+// ──────────────────────────────────────────────────────────────────────────────
+
+// ── Parameters (passed from main.bicep) ──────────────────────────────────────
+
+param location string
+param accountName string
+param projectName string
+param modelDeploymentName string
+param modelName string
+param modelVersion string
+param modelSkuName string
+param modelSkuCapacity int
+param uniqueSuffix string
+
+@description('Object ID of the user principal to grant Azure AI Developer access. Obtain with: az ad signed-in-user show --query id -o tsv')
+param userPrincipalId string
+
+// ── Derived values ───────────────────────────────────────────────────────────
+
+var customSubDomainName = '${accountName}-${uniqueSuffix}'
+
+// Azure AI Developer — allows creating/managing agents and using models
+// https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#azure-ai-developer
+var azureAIDeveloperRoleId = subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '64702f94-c441-49e6-a78b-ef80e0188fee')
+
+// ── Resource 1: AI Services Account (Foundry) ────────────────────────────────
+// Top-level Foundry account with project management enabled.
+// kind: AIServices provides access to Foundry Agent Service capabilities.
+
+resource aiAccount 'Microsoft.CognitiveServices/accounts@2025-06-01' = {
+  name: accountName
+  location: location
+  kind: 'AIServices'
+  identity: {
+    type: 'SystemAssigned'
+  }
+  sku: {
+    name: 'S0'
+  }
+  properties: {
+    customSubDomainName: customSubDomainName
+    allowProjectManagement: true
+    publicNetworkAccess: 'Enabled'
+  }
+}
+
+// ── Resource 2: Model Deployment ─────────────────────────────────────────────
+// Deploys the language model that will process web search queries.
+// Default: gpt-4.1-mini with GlobalStandard SKU for broadest availability.
+
+resource modelDeploy 'Microsoft.CognitiveServices/accounts/deployments@2025-06-01' = {
+  parent: aiAccount
+  name: modelDeploymentName
+  sku: {
+    name: modelSkuName
+    capacity: modelSkuCapacity
+  }
+  properties: {
+    model: {
+      format: 'OpenAI'
+      name: modelName
+      version: modelVersion
+    }
+  }
+}
+
+// ── Resource 3: Foundry Project ──────────────────────────────────────────────
+// Provides the endpoint URL used by the sofIA CLI (FOUNDRY_PROJECT_ENDPOINT).
+
+resource project 'Microsoft.CognitiveServices/accounts/projects@2025-06-01' = {
+  parent: aiAccount
+  name: projectName
+  location: location
+  identity: {
+    type: 'SystemAssigned'
+  }
+  properties: {}
+  dependsOn: [
+    modelDeploy
+  ]
+}
+
+// ── Resource 4: Account Capability Host (Agents) ─────────────────────────────
+// Enables the Agent Service at the account level.
+// Must be created before the project capability host.
+
+resource accountCapabilityHost 'Microsoft.CognitiveServices/accounts/capabilityHosts@2025-06-01' = {
+  parent: aiAccount
+  name: 'default'
+  properties: {
+    capabilityHostKind: 'Agents'
+  }
+  dependsOn: [
+    project
+    modelDeploy
+  ]
+}
+
+// ── Resource 5: Project Capability Host (Agents) ─────────────────────────────
+// Enables the Agent Service at the project level.
+// Basic (Microsoft-managed) setup — empty connections array.
+
+resource projectCapabilityHost 'Microsoft.CognitiveServices/accounts/projects/capabilityHosts@2025-06-01' = {
+  parent: project
+  name: 'default'
+  properties: {
+    capabilityHostKind: 'Agents'
+  }
+  dependsOn: [
+    accountCapabilityHost
+  ]
+}
+
+// ── Resource 6: Role Assignment — Azure AI Developer for the deploying user ──
+// Grants the deploying user permission to create ephemeral agents, use models,
+// and invoke web_search_preview through the Foundry Agent Service.
+
+resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
+  name: guid(aiAccount.id, userPrincipalId, azureAIDeveloperRoleId)
+  scope: aiAccount
+  properties: {
+    principalId: userPrincipalId
+    roleDefinitionId: azureAIDeveloperRoleId
+    principalType: 'User'
+  }
+}
+
+// ── Outputs ──────────────────────────────────────────────────────────────────
+
+output projectEndpoint string = project.properties.endpoints['AI Foundry API']