@mutmutco/cli 3.99.0 → 3.101.0

package/dist/main.cjs

@@ -12168,6 +12168,16 @@ async function auditRepoCi(repo, deps) {
       });
     }
   }
+  if (repoClass === "deployable") {
+    const exemptReason = meta?.ciExemptReason?.trim();
+    const declaredExempt = statusChecks.size === 0 && !!exemptReason;
+    checks.push({
+      ok: statusChecks.size > 0 || declaredExempt,
+      label: declaredExempt ? "deployable repo declared CI-exempt, not required to gate (#4265)" : "deployable repo requires at least one status check (#4260)",
+      detail: declaredExempt ? `declared-exempt: ${exemptReason}` : statusChecks.size === 0 ? "zero required contexts on an active branch ruleset \u2014 any PR, including an automation seed PR, merges on an empty gate" : void 0,
+      remediation: declaredExempt || statusChecks.size > 0 ? void 0 : `Determine this repo's correct gate context from its own PR-triggered workflow, set it via mmi-cli org project set ${repo} --var requiredChecks=[...], then mmi-cli ci reconcile --repo ${repo} --apply, or, if this repo genuinely has no CI surface, declare it via mmi-cli org project set ${repo} --var ciExemptReason="<why>" (#4265)`
+    });
+  }
   if (deployableGated || repoClass === "hub") {
     const gate = await readDefaultBranchGate(repo, deps.client, baseBranch, Date.now(), gateWorkflowFiles(prWorkflowPaths));
     checks.push({
@@ -13865,6 +13875,12 @@ async function postSchedulesMode(slug, mode, deps) {
 async function postSchedulesRun(id, deps) {
   return postJson("/schedules/run", { id }, deps, "POST", { noRetry: true });
 }
+async function postSchedulesPark(id, reason, deps) {
+  return postJson("/schedules/park", { id, reason }, deps);
+}
+async function postSchedulesUnpark(id, deps) {
+  return postJson("/schedules/unpark", { id }, deps);
+}
 async function tenantControl(payload, deps) {
   return postJson("/tenant-control", payload, deps, "POST", { noRetry: true });
 }
@@ -20923,7 +20939,7 @@ function authorizeBodyHasMismatch(body) {
 }
 
 // src/project-set.ts
-var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "dsManifestPath", "fofuEnabled", "consumesDesignSystem", "ci", "requiredChecks", "gate"];
+var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "dsManifestPath", "fofuEnabled", "consumesDesignSystem", "ci", "requiredChecks", "ciExemptReason", "gate", "seedCanary"];
 var UNSET_KEY_SET = new Set(UNSET_KEYS);
 var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
 var SECRET_CONSUMERS = ["runtime", "build", "lambda", "actions", "agent", "box"];
@@ -21177,6 +21193,11 @@ function parseRuntimeVaultOnlyVar(raw) {
   if (raw === "false") return false;
   throw new Error("org project set: runtimeVaultOnly must be true or false");
 }
+function parseSeedCanaryVar(raw) {
+  if (raw === "true") return true;
+  if (raw === "false") return false;
+  throw new Error("org project set: seedCanary must be true or false");
+}
 function parseConsumesDesignSystemVar(raw) {
   if (raw === "fofu") return raw;
   throw new Error('org project set: consumesDesignSystem must be "fofu"');
@@ -21213,6 +21234,11 @@ function parseRequiredChecksVar(raw) {
   }
   return parsed.map((c) => c.trim());
 }
+function parseCiExemptReasonVar(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed) throw new Error("org project set: ciExemptReason must be a non-empty reason (or use --unset ciExemptReason to clear it)");
+  return trimmed;
+}
 function parseGateVar(raw) {
   let parsed;
   try {
@@ -21265,8 +21291,10 @@ var SETTABLE_VAR_KEYS = [
   "portRange",
   "ci",
   "requiredChecks",
+  "ciExemptReason",
   "gate",
-  "secrets"
+  "secrets",
+  "seedCanary"
 ];
 var SETTABLE_VAR_KEY_SET = new Set(SETTABLE_VAR_KEYS);
 var SETTABLE_VAR_HINTS = {
@@ -21277,6 +21305,7 @@ var SETTABLE_VAR_HINTS = {
   fofuEnabled: "true|false",
   consumesDesignSystem: '"fofu"',
   runtimeVaultOnly: "true|false",
+  seedCanary: "true|false",
   repos: 'JSON array, e.g. ["mutmutco/mm-foo"]',
   oauth: "JSON {subdomains,domains,callbackPath,fofuSubdomain}",
   requiredGcpApis: "comma-string",
@@ -21289,6 +21318,7 @@ var SETTABLE_VAR_HINTS = {
   portRange: "JSON {start,end} or [start,end]",
   ci: "none \u2014 declare intentional no-ci",
   requiredChecks: 'JSON array, e.g. ["gate"] or [] for no-ci',
+  ciExemptReason: "non-empty string \u2014 declares this deployable repo has no CI surface (#4265)",
   gate: "JSON {runtime,cmd,workdir,cacheDepPath,pyVersion}"
 };
 function settableVarHelp() {
@@ -21373,6 +21403,8 @@ function buildProjectSetPatch(input) {
       patch[key] = parseFofuEnabledVar(raw);
     } else if (key === "runtimeVaultOnly") {
       patch[key] = parseRuntimeVaultOnlyVar(raw);
+    } else if (key === "seedCanary") {
+      patch[key] = parseSeedCanaryVar(raw);
     } else if (key === "consumesDesignSystem") {
       patch[key] = parseConsumesDesignSystemVar(raw);
     } else if (key === "publishDir") {
@@ -21384,6 +21416,8 @@ function buildProjectSetPatch(input) {
       patch[key] = raw;
     } else if (key === "requiredChecks") {
       patch[key] = parseRequiredChecksVar(raw);
+    } else if (key === "ciExemptReason") {
+      patch[key] = parseCiExemptReasonVar(raw);
     } else if (key === "gate") {
       patch[key] = parseGateVar(raw);
     } else {
@@ -22721,6 +22755,7 @@ function reconcileGithubActions(liveGithub, registry2, readRepos, activeWorkflow
   const liveByName = new Map(liveGithub.map((e) => [e.name, e]));
   const registryById = new Map(registryGithub.map((r) => [r.id, r]));
   const drifts = [];
+  const parked = [];
   for (const e of liveGithub) {
     if (!registryById.has(e.name)) {
       drifts.push({
@@ -22733,6 +22768,10 @@ function reconcileGithubActions(liveGithub, registry2, readRepos, activeWorkflow
     }
   }
   for (const r of registryGithub) {
+    if (r.parkedReason) {
+      parked.push({ id: r.id, executor: r.executor, repo: r.repo, reason: r.parkedReason });
+      continue;
+    }
     const live = liveByName.get(r.id);
     if (live) {
       if (cadenceStale(r.cadence, live.cadence)) {
@@ -22754,7 +22793,7 @@ function reconcileGithubActions(liveGithub, registry2, readRepos, activeWorkflow
           name: r.id,
           executor: r.executor || "github-actions",
           detail: "workflow file present but DISABLED in GitHub Actions \u2014 the dispatcher cannot run it",
-          remedy: `\`gh workflow enable\` it in ${r.repo} to re-arm (or, if it was retired on purpose, re-run schedules register so the replace prunes the SCHEDULE# row) \u2014 never prune a lane parked on purpose`
+          remedy: `\`gh workflow enable\` it in ${r.repo} to re-arm, or if this is a deliberate hold run \`mmi-cli org schedules park ${r.id} --reason <ref>\` (#4257) so it stops reading as drift \u2014 never prune a lane parked on purpose`
         });
       }
       continue;
@@ -22769,7 +22808,10 @@ function reconcileGithubActions(liveGithub, registry2, readRepos, activeWorkflow
       });
     }
   }
-  return drifts.sort((a, b) => a.class.localeCompare(b.class) || a.name.localeCompare(b.name));
+  return {
+    drifts: drifts.sort((a, b) => a.class.localeCompare(b.class) || a.name.localeCompare(b.name)),
+    parked: parked.sort((a, b) => a.id.localeCompare(b.id))
+  };
 }
 function suppressSelfManagedDrifts(drifts, selfManagedRepos) {
   return drifts.filter((d) => {
@@ -22780,6 +22822,9 @@ function suppressSelfManagedDrifts(drifts, selfManagedRepos) {
 function renderDrift(d) {
   return `${d.class}: ${d.name} (${d.executor}) \u2014 ${d.detail}; remedy: ${d.remedy}`;
 }
+function renderParked(p) {
+  return `parked (${p.reason}): ${p.id}`;
+}
 function strayCronDrift(name) {
   return {
     class: "stray-cron",
@@ -22815,12 +22860,17 @@ function unlauncheredLlmDrifts(entries) {
 }
 var HARBOUR_ARM_GRACE_MS = 30 * 60 * 1e3;
 function registeredButUnarmedDrifts(registry2, liveEntries, opts) {
-  if (!opts.schedulerRead) return [];
+  if (!opts.schedulerRead) return { drifts: [], parked: [] };
   const now = opts.now ?? Date.now();
   const armed = new Set(liveEntries.map((e) => e.scheduleId).filter((id) => Boolean(id)));
   const drifts = [];
+  const parked = [];
   for (const row of registry2) {
     if (row.executor === "github-actions") continue;
+    if (row.parkedReason) {
+      parked.push({ id: row.id, executor: row.executor, repo: row.repo, reason: row.parkedReason });
+      continue;
+    }
     if (armed.has(row.id)) continue;
     const stamped = row.updatedAt ? Date.parse(row.updatedAt) : NaN;
     if (Number.isFinite(stamped) && now - stamped < HARBOUR_ARM_GRACE_MS) continue;
@@ -22832,25 +22882,36 @@ function registeredButUnarmedDrifts(registry2, liveEntries, opts) {
       remedy: "check the fleet-clock reconciler tick; re-run `mmi-cli org schedules register` for the repo and verify with `mmi-cli org schedules`"
     });
   }
-  return drifts.sort((a, b) => a.name.localeCompare(b.name));
+  return {
+    drifts: drifts.sort((a, b) => a.name.localeCompare(b.name)),
+    parked: parked.sort((a, b) => a.id.localeCompare(b.id))
+  };
 }
 function assembleReconciliation(githubEntries2, readRepos, registry2, activeWorkflowNames = /* @__PURE__ */ new Set(), harbour = {}, disabledWorkflowNames = /* @__PURE__ */ new Set()) {
   if (registry2 === null) {
     return {
       reconciliation: [],
       driftLines: [],
+      parked: [],
+      parkedLines: [],
       incomplete: ["registry: could not read GET /schedules/list \u2014 reconciliation skipped (Hub API unreachable or not authenticated)"]
     };
   }
   const live = githubEntries2.filter((e) => e.executor === "github-actions");
-  const drifts = [
-    ...reconcileGithubActions(live, registry2, readRepos, activeWorkflowNames, disabledWorkflowNames),
-    ...registeredButUnarmedDrifts(registry2, harbour.awsEntries ?? [], {
-      schedulerRead: Boolean(harbour.schedulerRead),
-      now: harbour.now
-    })
-  ];
-  return { reconciliation: drifts, driftLines: drifts.map(renderDrift), incomplete: [] };
+  const githubResult = reconcileGithubActions(live, registry2, readRepos, activeWorkflowNames, disabledWorkflowNames);
+  const harbourResult = registeredButUnarmedDrifts(registry2, harbour.awsEntries ?? [], {
+    schedulerRead: Boolean(harbour.schedulerRead),
+    now: harbour.now
+  });
+  const drifts = [...githubResult.drifts, ...harbourResult.drifts];
+  const parked = [...githubResult.parked, ...harbourResult.parked].sort((a, b) => a.id.localeCompare(b.id));
+  return {
+    reconciliation: drifts,
+    driftLines: drifts.map(renderDrift),
+    parked,
+    parkedLines: parked.map(renderParked),
+    incomplete: []
+  };
 }
 
 // src/schedules-commands.ts
@@ -23014,7 +23075,9 @@ async function fetchNotebook(client = defaultGitHubClient(), readRegistry = defa
     entries: sortEntries([...gh.entries, ...aws.entries, ...DECLARED_ENTRIES]),
     incomplete: [...gh.incomplete, ...aws.incomplete, ...recon.incomplete],
     drift: driftLines,
-    reconciliation
+    reconciliation,
+    parked: recon.parked,
+    parkedLines: recon.parkedLines
   };
 }
 async function defaultProjectsRead() {
@@ -23027,10 +23090,13 @@ function warnIncomplete2(incomplete) {
 function reportDrift(drift) {
   for (const d of drift) console.error(`org schedules: DRIFT \u2014 ${d}`);
 }
+function reportParked(parked) {
+  for (const p of parked) console.log(`org schedules: ${p}`);
+}
 function registerSchedulesCommands(program3) {
   const schedules = program3.command("schedules").description("the org schedules notebook \u2014 every armed cron, timer, and scheduled LLM lane, resolved live (jerv side lives in jerv-cli schedules)").option("--json", "machine-readable output (consumed by jerv-cli schedules --all)").option("--doc <path>", "optional snapshot only \u2014 splice inventory between schedules:inventory markers; live `org schedules` / --json remains SSOT (Hub#4120)").action(async (o) => {
     try {
-      const { entries, incomplete, drift, reconciliation } = await fetchNotebook();
+      const { entries, incomplete, drift, reconciliation, parked, parkedLines } = await fetchNotebook();
       if (o.doc) {
         if (incomplete.length) {
           warnIncomplete2(incomplete);
@@ -23046,9 +23112,10 @@ function registerSchedulesCommands(program3) {
       }
       if (o.json) {
         const now = /* @__PURE__ */ new Date();
-        console.log(JSON.stringify({ org: entries.map((e) => withTickState(e, now)), incomplete, drift, reconciliation }, null, 2));
+        console.log(JSON.stringify({ org: entries.map((e) => withTickState(e, now)), incomplete, drift, reconciliation, parked }, null, 2));
       } else {
         console.log(formatSchedulesTable(entries));
+        reportParked(parkedLines);
         reportDrift(drift);
         warnIncomplete2(incomplete);
       }
@@ -23069,6 +23136,30 @@ function registerSchedulesCommands(program3) {
       await failGraceful(e.message);
     }
   });
+  schedules.command("park <schedule-id>").description("record a deliberate hold on a SCHEDULE# row \u2014 the reconciler skips it and `org schedules` renders `parked (<reason>)` instead of DRIFT (#4257)").requiredOption("--reason <ref>", "why the lane is held, e.g. an issue ref (#1774)").action(async (scheduleId, o) => {
+    try {
+      const res = await postSchedulesPark(scheduleId, o.reason, registryClientDeps(await loadConfig()));
+      if (!res.ok) {
+        await failGraceful(`schedules park: HTTP ${res.status} \u2014 ${JSON.stringify(res.body ?? res.error ?? "failed")}`);
+        return;
+      }
+      console.log(JSON.stringify(res.body, null, 2));
+    } catch (e) {
+      await failGraceful(e.message);
+    }
+  });
+  schedules.command("unpark <schedule-id>").description("clear a deliberate hold on a SCHEDULE# row \u2014 reconciliation resumes normally (#4257)").action(async (scheduleId) => {
+    try {
+      const res = await postSchedulesUnpark(scheduleId, registryClientDeps(await loadConfig()));
+      if (!res.ok) {
+        await failGraceful(`schedules unpark: HTTP ${res.status} \u2014 ${JSON.stringify(res.body ?? res.error ?? "failed")}`);
+        return;
+      }
+      console.log(JSON.stringify(res.body, null, 2));
+    } catch (e) {
+      await failGraceful(e.message);
+    }
+  });
   schedules.command("mode <mode>").description("fleet schedules doctrine for a repo: 'managed' (default \u2014 Hub registry + drift enforcement) or 'self-managed' (opt out; the repo owns its crons). Project-admin self-serve (#3228).").option("--repo <name>", "bare repo name (defaults to the origin remote basename)").action(async (mode, o) => {
     try {
       if (mode !== "managed" && mode !== "self-managed") {
@@ -24017,6 +24108,62 @@ function renderPropagationReport(plan) {
   return lines.join("\n");
 }
 
+// src/bootstrap-rollback.ts
+function resolveRollbackRecord(records, repo, target) {
+  const candidates = records.filter((r) => r.repo === repo && r.target === target && r.mergeSha);
+  if (candidates.length === 0) {
+    return { found: false, reason: `no propagation record resolves for ${repo} + ${target} \u2014 refusing to guess a commit to revert` };
+  }
+  const clean4 = candidates.filter((r) => r.files.length === 1 && r.files[0] === target);
+  if (clean4.length === 0) {
+    return {
+      found: false,
+      reason: `${candidates.length} merged seed-propagate PR(s) found for ${repo} + ${target}, but none is a clean single-file propagation of exactly this target \u2014 refusing to guess a commit to revert`
+    };
+  }
+  const latest = clean4.slice().sort((a, b) => a.mergedAt < b.mergedAt ? 1 : a.mergedAt > b.mergedAt ? -1 : 0)[0];
+  return { found: true, record: latest };
+}
+function planRollback(repo, target, slug, records) {
+  const resolution = resolveRollbackRecord(records, repo, target);
+  if (!resolution.found) return { repo, target, resolution };
+  const branch = `seed-rollback-${slug}`;
+  const title = `revert: rollback org-owned ${target} in ${repo} (seed PR #${resolution.record.number})`;
+  const body = renderRollbackPrBody(resolution.record);
+  return { repo, target, resolution, branch, title, body };
+}
+function renderRollbackPrBody(record) {
+  return [
+    `Per-repo emergency revert of \`${record.target}\`'s seed-propagate merge (\`mmi-cli bootstrap rollback\`, #4240).`,
+    "",
+    `Reverts ${record.url} (merge ${record.mergeSha}) \u2014 restores this repo's copy of \`${record.target}\` to its content immediately before that merge. Nothing else in this repo changes.`,
+    "",
+    "This is the emergency stop, not the fix: MMI-Hub is still the source of truth during a rollback. Closure is the Hub reverting (or fixing forward) the bad seed commit on `development` \u2014 once it does, this repo matches the Hub again and the drift alarm closes itself. A revert with no Hub-side follow-up re-alarms as drift within a week \u2014 deliberately, so an emergency divergence can never silently become permanent.",
+    "",
+    "Never re-run `bootstrap propagate` with the pre-revert bytes before the Hub itself is fixed \u2014 that reopens exactly what this PR closes."
+  ].join("\n");
+}
+function renderRollbackReport(plan) {
+  if (!plan.resolution.found) {
+    return `bootstrap rollback \u2014 ${plan.repo} / ${plan.target}: REFUSED \u2014 ${plan.resolution.reason}`;
+  }
+  const r = plan.resolution.record;
+  const opened = plan.prUrl ? ` \u2014 opened ${plan.prUrl}` : "";
+  return `bootstrap rollback \u2014 ${plan.repo} / ${plan.target}: reverting PR#${r.number} (merge ${r.mergeSha}${r.mergedAt ? `, merged ${r.mergedAt}` : ""}) on branch ${plan.branch}${opened}`;
+}
+function seedPrRecordFromPropagationRecord(record) {
+  if (!record.mergeSha || record.prNumber == null || !record.prUrl) return null;
+  return {
+    repo: record.repo,
+    target: record.target,
+    number: record.prNumber,
+    url: record.prUrl,
+    mergeSha: record.mergeSha,
+    mergedAt: "",
+    files: [record.target]
+  };
+}
+
 // src/bootstrap-verify.ts
 var TRAIN_BRANCHES2 = ["development", "rc", "main"];
 var requiredDocs = ["README.md", "architecture.md", "docs/decisions/README.md", "docs/index.md"];
@@ -25145,9 +25292,28 @@ LIVE apply to ${repo}:
     }
     const bySlugMeta = new Map(projects.flatMap((p) => (p.repos ?? []).map((r) => [(r.includes("/") ? r : `mutmutco/${r}`).toLowerCase(), p])));
     const classOf = (repo) => bySlugMeta.get(repo.toLowerCase())?.class ?? "deployable";
-    const canaryProject = projects.find((p) => p.seedCanary === true);
-    const canarySlug = canaryProject ? (canaryProject.repos ?? [])[0]?.split("/").pop()?.toLowerCase() ?? null : null;
-    const repos = rosterRepos2.map((repo) => {
+    const inClassRepos = rosterRepos2.filter((repo) => seed.classes.includes(classOf(repo)));
+    const classPriority = [.../* @__PURE__ */ new Set(["deployable", ...seed.classes])].filter((c) => seed.classes.includes(c));
+    let canaryProject = null;
+    for (const cls of classPriority) {
+      const inClass = projects.filter((p) => p.seedCanary === true && (p.class ?? "deployable") === cls);
+      if (inClass.length === 0) continue;
+      if (inClass.length > 1) {
+        const slugs = inClass.map((p) => (p.repos ?? [])[0]?.split("/").pop() ?? "?").join(", ");
+        return fail(
+          `bootstrap propagate: target '${seed.target}' (classes [${seed.classes.join(", ")}]) matches ${inClass.length} seedCanary:true repos in class '${cls}' (${slugs}) \u2014 exactly one seedCanary:true repo per class is required`
+        );
+      }
+      canaryProject = inClass[0];
+      break;
+    }
+    if (!canaryProject) {
+      return fail(
+        `bootstrap propagate: target '${seed.target}' needs classes [${seed.classes.join(", ")}] but no registry repo with seedCanary:true carries a matching class \u2014 set seedCanary:true on an in-class repo (mmi-cli org project set <slug> --var seedCanary=true)`
+      );
+    }
+    const canarySlug = (canaryProject.repos ?? [])[0]?.split("/").pop()?.toLowerCase() ?? null;
+    const repos = inClassRepos.map((repo) => {
       const slug = repo.split("/").pop().toLowerCase();
       const waiver = seed.waivers?.[slug];
       return { repo, slug, waiver };
@@ -25271,6 +25437,136 @@ Rollback: \`mmi-cli bootstrap rollback ${rec.repo} --target ${seed.target} --exe
     else console.log(renderPropagationReport(plan));
     if (plan.halted) process.exitCode = 1;
   });
+  bootstrap.command("rollback <repo>").description("#4240: open a per-repo revert PR of the recorded seed-propagate merge \u2014 never a fleet-wide overwrite; dry-run unless --execute").addOption(new Option("--class <class>", "deployable | content").default("deployable").choices(["deployable", "content"])).option("--target <path>", "the manifest target to roll back (an ownership:org + source:self seed, e.g. .github/workflows/agent-pr.yml)").option("--record <path>", "read propagation candidates from a persisted `bootstrap propagate --json` report instead of the live seed-propagate PR history").option("--execute", "LIVE revert via gh (master-gated) \u2014 opens/reuses the seed-rollback PR; dry-run prints the plan only").option("--json", "machine-readable output").action(async (repo) => {
+    const o = {
+      class: rawValue("--class", "deployable"),
+      target: rawValue("--target", ""),
+      record: rawValue("--record", ""),
+      execute: rawFlag("--execute"),
+      json: rawFlag("--json")
+    };
+    if (o.class !== "deployable" && o.class !== "content") return fail("bootstrap rollback: --class must be deployable or content");
+    let parsedRepo;
+    try {
+      parsedRepo = parseOwnerRepo(repo);
+    } catch (e) {
+      return fail(`bootstrap rollback: ${e.message}`);
+    }
+    const manifestPath = "skills/bootstrap/seeds/manifest.json";
+    if (!(0, import_node_fs31.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
+    const manifest = loadBootstrapSeeds((0, import_node_fs31.readFileSync)(manifestPath, "utf8"));
+    const propagatable = manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self");
+    if (!o.target) {
+      return fail(`bootstrap rollback: --target <path> is required \u2014 one of:
+  ${propagatable.map((s) => s.target).join("\n  ")}`);
+    }
+    const seed = propagatable.find((s) => s.target === o.target);
+    if (!seed) return fail(`bootstrap rollback: --target '${o.target}' names no ownership:org + source:self seed in ${manifestPath}. Propagatable (hence rollback-able) targets:
+  ${propagatable.map((s) => s.target).join("\n  ")}`);
+    const slug = parsedRepo.slug;
+    const baseBranch = o.class === "content" ? "main" : "development";
+    const branchPrefix = "seed-propagate";
+    const propagateBranch = `${branchPrefix}-${slug}`;
+    const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
+    const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
+    let candidates;
+    if (o.record) {
+      if (!(0, import_node_fs31.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
+      let parsed;
+      try {
+        parsed = JSON.parse((0, import_node_fs31.readFileSync)(o.record, "utf8"));
+      } catch (e) {
+        return fail(`bootstrap rollback: --record '${o.record}' is not valid JSON: ${e.message}`);
+      }
+      const recs = Array.isArray(parsed?.records) ? parsed.records : Array.isArray(parsed) ? parsed : [];
+      candidates = recs.map((r) => {
+        try {
+          return seedPrRecordFromPropagationRecord(r);
+        } catch {
+          return null;
+        }
+      }).filter((r) => r !== null);
+    } else {
+      candidates = [];
+      try {
+        const listed = await gh(["pr", "list", "--repo", repo, "--head", propagateBranch, "--base", baseBranch, "--state", "merged", "--json", "number,url,mergedAt,mergeCommit,files", "--limit", "20"]);
+        const arr = JSON.parse(listed.stdout || "[]");
+        for (const p of arr) {
+          if (!p.mergeCommit?.oid) continue;
+          candidates.push({
+            repo,
+            target: seed.target,
+            number: p.number,
+            url: p.url,
+            mergeSha: p.mergeCommit.oid,
+            mergedAt: p.mergedAt ?? "",
+            files: (p.files ?? []).map((f) => f.path)
+          });
+        }
+      } catch (e) {
+        return fail(`bootstrap rollback: could not read ${repo}'s merged ${propagateBranch} PR history: ${e.message}`);
+      }
+    }
+    const plan = planRollback(repo, seed.target, slug, candidates);
+    if (!plan.resolution.found) {
+      if (o.json) console.log(JSON.stringify(plan, null, 2));
+      else console.log(renderRollbackReport(plan));
+      return fail(`bootstrap rollback: ${plan.resolution.reason}`);
+    }
+    if (o.execute) {
+      const record = plan.resolution.record;
+      const parentResp = await gh(["api", `repos/${repo}/commits/${record.mergeSha}`, "--jq", ".parents[0].sha"]);
+      const parentSha = parentResp.stdout.trim();
+      if (!parentSha) return fail(`bootstrap rollback: could not resolve ${repo}@${record.mergeSha}'s parent commit \u2014 refusing to guess what to restore`);
+      let preSeedContent = null;
+      try {
+        const resp = await gh(["api", `repos/${repo}/contents/${enc(seed.target)}?ref=${parentSha}`]);
+        const parsed = JSON.parse(resp.stdout);
+        preSeedContent = parsed.encoding === "base64" && typeof parsed.content === "string" ? Buffer.from(parsed.content, "base64").toString("utf8") : null;
+      } catch {
+        preSeedContent = null;
+      }
+      if (preSeedContent == null) return fail(`bootstrap rollback: '${seed.target}' did not exist in ${repo} at ${parentSha} (the commit before the seed merge) \u2014 nothing to restore; refusing to guess`);
+      const baseRef = await gh(["api", `repos/${repo}/git/ref/heads/${baseBranch}`, "--jq", ".object.sha"]);
+      const baseSha = baseRef.stdout.trim();
+      let branchExists = true;
+      try {
+        await gh(["api", `repos/${repo}/git/ref/heads/${plan.branch}`]);
+      } catch {
+        branchExists = false;
+      }
+      if (!branchExists) await gh(["api", `repos/${repo}/git/refs`, "-f", `ref=refs/heads/${plan.branch}`, "-f", `sha=${baseSha}`]);
+      let existingSha;
+      try {
+        const cur = await gh(["api", `repos/${repo}/contents/${enc(seed.target)}?ref=${plan.branch}`]);
+        existingSha = JSON.parse(cur.stdout).sha;
+      } catch {
+        existingSha = void 0;
+      }
+      const tmp = (0, import_node_path29.join)((0, import_node_os11.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      (0, import_node_fs31.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
+      try {
+        await gh(contentPutInputArgs(repo, seed.target, tmp));
+      } finally {
+        try {
+          (0, import_node_fs31.unlinkSync)(tmp);
+        } catch {
+        }
+      }
+      const openPrs = await gh(["pr", "list", "--repo", repo, "--head", plan.branch, "--base", baseBranch, "--state", "open", "--json", "number,url"]);
+      const prDecision = decideSeedPrAction(JSON.parse(openPrs.stdout || "[]"));
+      let prUrl;
+      if (prDecision.action === "reuse") {
+        prUrl = prDecision.url;
+      } else {
+        const created = await ghCreate(["pr", "create", "--repo", repo, "--base", baseBranch, "--head", plan.branch, "--title", plan.title, "--body", plan.body]);
+        prUrl = created.url;
+      }
+      plan.prUrl = prUrl;
+    }
+    if (o.json) console.log(JSON.stringify(plan, null, 2));
+    else console.log(renderRollbackReport(plan));
+  });
 }
 
 // src/stage-commands.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.99.0",
+  "version": "3.101.0",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",