@mutmutco/cli 4.3.45 → 4.3.47

package/dist/main.cjs

@@ -5,6 +5,14 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
+};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -27,306 +35,1403 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// src/index.ts
-var index_exports = {};
-__export(index_exports, {
-  DEFAULT_PRIORITY: () => DEFAULT_PRIORITY,
-  argvWantsJson: () => argvWantsJson3,
-  awsCallerArn: () => awsCallerArn,
-  ciAuditDeps: () => ciAuditDeps2,
-  classifyParseError: () => classifyParseError,
-  commandOwnLongFlags: () => commandOwnLongFlags,
-  envHealLockPath: () => envHealLockPath,
-  isOrgRegisteredRepo: () => isOrgRegisteredRepo,
-  parseInvalidChoiceError: () => parseInvalidChoiceError,
-  positionalTargetForm: () => positionalTargetForm,
-  registryClientDeps: () => registryClientDeps,
-  repoSlug: () => repoSlug,
-  suggestCommandPath: () => suggestCommandPath,
-  unknownCommandCandidates: () => unknownCommandCandidates
-});
-module.exports = __toCommonJS(index_exports);
-
-// node_modules/commander/lib/error.js
-var CommanderError = class extends Error {
-  /**
-   * Constructs the CommanderError class
-   * @param {number} exitCode suggested exit code which could be used with process.exit
-   * @param {string} code an id string representing the error
-   * @param {string} message human-readable description of the error
-   */
-  constructor(exitCode, code, message2) {
-    super(message2);
-    Error.captureStackTrace(this, this.constructor);
-    this.name = this.constructor.name;
-    this.code = code;
-    this.exitCode = exitCode;
-    this.nestedError = void 0;
-  }
-};
-var InvalidArgumentError = class extends CommanderError {
-  /**
-   * Constructs the InvalidArgumentError class
-   * @param {string} [message] explanation of why argument is invalid
-   */
-  constructor(message2) {
-    super(1, "commander.invalidArgument", message2);
-    Error.captureStackTrace(this, this.constructor);
-    this.name = this.constructor.name;
-  }
-};
-
-// node_modules/commander/lib/argument.js
-var Argument = class {
-  /**
-   * Initialize a new command argument with the given name and description.
-   * The default is that the argument is required, and you can explicitly
-   * indicate this with <> around the name. Put [] around the name for an optional argument.
-   *
-   * @param {string} name
-   * @param {string} [description]
-   */
-  constructor(name, description) {
-    this.description = description || "";
-    this.variadic = false;
-    this.parseArg = void 0;
-    this.defaultValue = void 0;
-    this.defaultValueDescription = void 0;
-    this.argChoices = void 0;
-    switch (name[0]) {
-      case "<":
-        this.required = true;
-        this._name = name.slice(1, -1);
-        break;
-      case "[":
-        this.required = false;
-        this._name = name.slice(1, -1);
-        break;
-      default:
-        this.required = true;
-        this._name = name;
-        break;
-    }
-    if (this._name.endsWith("...")) {
-      this.variadic = true;
-      this._name = this._name.slice(0, -3);
+// src/clean-exit.ts
+function globalDispatcher() {
+  return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL];
+}
+function destroyHttpPool() {
+  try {
+    const dispatcher = globalDispatcher();
+    if (dispatcher?.destroy) {
+      void dispatcher.destroy();
+      return true;
     }
+  } catch {
   }
-  /**
-   * Return argument name.
-   *
-   * @return {string}
-   */
-  name() {
-    return this._name;
+  return false;
+}
+async function closeHttpPool() {
+  const dispatcher = globalDispatcher();
+  if (!dispatcher) return;
+  if (dispatcher === closingDispatcher && closingDispatcherPromise) {
+    await closingDispatcherPromise;
+    return;
   }
-  /**
-   * @package
-   */
-  _collectValue(value, previous) {
-    if (previous === this.defaultValue || !Array.isArray(previous)) {
-      return [value];
+  closingDispatcher = dispatcher;
+  closingDispatcherPromise = (async () => {
+    try {
+      if (dispatcher.close) await dispatcher.close();
+      else if (dispatcher.destroy) await dispatcher.destroy();
+    } catch {
+      try {
+        if (dispatcher.destroy) await dispatcher.destroy();
+      } catch {
+      }
     }
-    previous.push(value);
-    return previous;
+  })();
+  await closingDispatcherPromise;
+}
+function hardExit(code) {
+  destroyHttpPool();
+  process.exit(code);
+}
+function flushStream(stream) {
+  return new Promise((resolve7) => {
+    try {
+      stream.write("", () => resolve7());
+    } catch {
+      resolve7();
+    }
+  });
+}
+async function flushStdio(timeoutMs = STDIO_FLUSH_TIMEOUT_MS) {
+  await Promise.race([
+    Promise.all([flushStream(process.stdout), flushStream(process.stderr)]),
+    new Promise((resolve7) => {
+      setTimeout(resolve7, timeoutMs).unref?.();
+    })
+  ]);
+}
+async function cleanExit(code) {
+  process.exitCode = code;
+  await closeHttpPool();
+  await flushStdio();
+  await new Promise((resolve7) => setImmediate(resolve7));
+  return void 0;
+}
+async function finishCliRun(watchdogMs = CLI_EXIT_WATCHDOG_MS) {
+  const timer = setTimeout(() => {
+    console.error(
+      `mmi-cli: command finished but the process did not exit within ${watchdogMs}ms \u2014 a handle leaked (${describeActiveHandles()}); forcing exit (#2904). Please report this.`
+    );
+    void flushStdio().finally(() => process.exit(typeof process.exitCode === "number" ? process.exitCode : 0));
+  }, watchdogMs);
+  timer.unref?.();
+  await closeHttpPool();
+}
+function describeActiveHandles() {
+  let summary;
+  try {
+    const counts = /* @__PURE__ */ new Map();
+    for (const type of process.getActiveResourcesInfo()) counts.set(type, (counts.get(type) ?? 0) + 1);
+    summary = [...counts.entries()].sort().map(([type, n]) => n > 1 ? `${type}\xD7${n}` : type).join(", ") || "none reported";
+  } catch {
+    summary = "unavailable";
   }
-  /**
-   * Set the default value, and optionally supply the description to be displayed in the help.
-   *
-   * @param {*} value
-   * @param {string} [description]
-   * @return {Argument}
-   */
-  default(value, description) {
-    this.defaultValue = value;
-    this.defaultValueDescription = description;
-    return this;
+  try {
+    const children = (process._getActiveHandles?.() ?? []).filter((h) => h?.constructor?.name === "ChildProcess").map((h) => `${h.spawnfile ?? "?"}(pid=${h.pid ?? "?"})`);
+    if (children.length) summary += `; live children: ${children.join(", ")}`;
+  } catch {
   }
-  /**
-   * Set the custom handler for processing CLI command arguments into argument values.
-   *
-   * @param {Function} [fn]
-   * @return {Argument}
-   */
-  argParser(fn) {
-    this.parseArg = fn;
-    return this;
+  return summary;
+}
+async function failGraceful(msg) {
+  console.error(`mmi-cli ${msg}`);
+  return cleanExit(1);
+}
+var UNDICI_GLOBAL_DISPATCHER_SYMBOL, closingDispatcher, closingDispatcherPromise, STDIO_FLUSH_TIMEOUT_MS, CLI_EXIT_WATCHDOG_MS;
+var init_clean_exit = __esm({
+  "src/clean-exit.ts"() {
+    "use strict";
+    UNDICI_GLOBAL_DISPATCHER_SYMBOL = Object.getOwnPropertySymbols(globalThis).find(
+      (s) => s.description === "undici.globalDispatcher.1" || s.description?.startsWith("undici.globalDispatcher.")
+    ) ?? /* @__PURE__ */ Symbol.for("undici.globalDispatcher.1");
+    STDIO_FLUSH_TIMEOUT_MS = 2e3;
+    CLI_EXIT_WATCHDOG_MS = (() => {
+      const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS);
+      return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;
+    })();
   }
-  /**
-   * Only allow argument value to be one of choices.
-   *
-   * @param {string[]} values
-   * @return {Argument}
-   */
-  choices(values) {
-    this.argChoices = values.slice();
-    this.parseArg = (arg, previous) => {
-      if (!this.argChoices.includes(arg)) {
-        throw new InvalidArgumentError(
-          `Allowed choices are ${this.argChoices.join(", ")}.`
-        );
-      }
-      if (this.variadic) {
-        return this._collectValue(arg, previous);
-      }
-      return arg;
-    };
-    return this;
+});
+
+// src/hub-url.ts
+function defaultHubUrl() {
+  return process.env.MMI_HUB_URL || DEFAULT_HUB_URL;
+}
+var DEFAULT_HUB_URL;
+var init_hub_url = __esm({
+  "src/hub-url.ts"() {
+    "use strict";
+    DEFAULT_HUB_URL = "https://tqxxwzftic.execute-api.eu-central-1.amazonaws.com";
   }
-  /**
-   * Make argument required.
-   *
-   * @returns {Argument}
-   */
-  argRequired() {
-    this.required = true;
-    return this;
+});
+
+// ../infra/compat.mjs
+function parseSemver(s) {
+  if (typeof s !== "string") return null;
+  const m = /^(\d+)\.(\d+)\.(\d+)(?:[-+]|$)/.exec(s.trim());
+  if (!m) return null;
+  return { major: Number(m[1]), minor: Number(m[2]), patch: Number(m[3]) };
+}
+function versionAtLeast(v, min) {
+  const a = parseSemver(v);
+  const b = parseSemver(min);
+  if (!a || !b) return false;
+  if (a.major !== b.major) return a.major > b.major;
+  if (a.minor !== b.minor) return a.minor > b.minor;
+  return a.patch >= b.patch;
+}
+var CLIENT_VERSION_HEADER;
+var init_compat = __esm({
+  "../infra/compat.mjs"() {
+    "use strict";
+    CLIENT_VERSION_HEADER = "x-client-version";
   }
-  /**
-   * Make argument optional.
-   *
-   * @returns {Argument}
-   */
-  argOptional() {
-    this.required = false;
-    return this;
+});
+
+// src/client-version.ts
+function resolveClientVersionManifestCandidates(distDir = __dirname) {
+  return [
+    (0, import_node_path2.join)(distDir, "..", "..", ".claude-plugin", "plugin.json"),
+    (0, import_node_path2.join)(distDir, "..", "package.json")
+  ];
+}
+function readVersionFromManifest(path2) {
+  try {
+    const version = JSON.parse((0, import_node_fs2.readFileSync)(path2, "utf8")).version;
+    return typeof version === "string" && version.trim() ? version.trim() : null;
+  } catch {
+    return null;
   }
-};
-function humanReadableArgName(arg) {
-  const nameOutput = arg.name() + (arg.variadic === true ? "..." : "");
-  return arg.required ? "<" + nameOutput + ">" : "[" + nameOutput + "]";
 }
-
-// node_modules/commander/lib/command.js
-var import_node_events = require("node:events");
-var import_node_child_process = __toESM(require("node:child_process"), 1);
-var import_node_path = __toESM(require("node:path"), 1);
-var import_node_fs = __toESM(require("node:fs"), 1);
-var import_node_process = __toESM(require("node:process"), 1);
-var import_node_util2 = require("node:util");
-
-// node_modules/commander/lib/help.js
-var import_node_util = require("node:util");
-var Help = class {
-  constructor() {
-    this.helpWidth = void 0;
-    this.minWidthToWrap = 40;
-    this.sortSubcommands = false;
-    this.sortOptions = false;
-    this.showGlobalOptions = false;
+function resolveClientVersion() {
+  for (const manifest of resolveClientVersionManifestCandidates()) {
+    const version = readVersionFromManifest(manifest);
+    if (version) return version;
   }
-  /**
-   * prepareContext is called by Commander after applying overrides from `Command.configureHelp()`
-   * and just before calling `formatHelp()`.
-   *
-   * Commander just uses the helpWidth and the rest is provided for optional use by more complex subclasses.
-   *
-   * @param {{ error?: boolean, helpWidth?: number, outputHasColors?: boolean }} contextOptions
-   */
-  prepareContext(contextOptions) {
-    this.helpWidth = this.helpWidth ?? contextOptions.helpWidth ?? 80;
+  return "0.0.0";
+}
+function clientVersionHeaders() {
+  return { [CLIENT_VERSION_HEADER]: resolveClientVersion() };
+}
+function upgradeRequiredError(res, body) {
+  const minVersion = body && typeof body === "object" && typeof body.minVersion === "string" ? body.minVersion : "a newer version";
+  return `Hub requires mmi-cli >= ${minVersion} \u2014 run mmi-cli doctor (installed ${resolveClientVersion()})`;
+}
+var import_node_fs2, import_node_path2;
+var init_client_version = __esm({
+  "src/client-version.ts"() {
+    "use strict";
+    import_node_fs2 = require("node:fs");
+    import_node_path2 = require("node:path");
+    init_compat();
   }
-  /**
-   * Get an array of the visible subcommands. Includes a placeholder for the implicit help command, if there is one.
-   *
-   * @param {Command} cmd
-   * @returns {Command[]}
-   */
-  visibleCommands(cmd) {
-    const visibleCommands = cmd.commands.filter((cmd2) => !cmd2._hidden);
-    const helpCommand = cmd._getHelpCommand();
-    if (helpCommand && !helpCommand._hidden) {
-      visibleCommands.push(helpCommand);
-    }
-    if (this.sortSubcommands) {
-      visibleCommands.sort((a, b) => {
-        return a.name().localeCompare(b.name());
-      });
+});
+
+// src/error-codes.ts
+function buildErrorEnvelope(message2, payload) {
+  const env = { error_code: payload.code, message: message2 };
+  if (payload.offending_flag !== void 0) env.offending_flag = payload.offending_flag;
+  if (payload.expected !== void 0) env.expected = payload.expected;
+  if (payload.did_you_mean !== void 0) env.did_you_mean = payload.did_you_mean;
+  if (payload.corrected_command !== void 0) env.corrected_command = payload.corrected_command;
+  if (payload.current_parent !== void 0) env.current_parent = payload.current_parent;
+  if (payload.issue_ref !== void 0) env.issue_ref = payload.issue_ref;
+  if (payload.board_status !== void 0) env.board_status = payload.board_status;
+  return env;
+}
+function formatErrorEnvelope(message2, payload) {
+  return JSON.stringify(buildErrorEnvelope(message2, payload));
+}
+function levenshtein(a, b) {
+  if (a === b) return 0;
+  if (a.length === 0) return b.length;
+  if (b.length === 0) return a.length;
+  let prev = Array.from({ length: b.length + 1 }, (_, i) => i);
+  let curr = new Array(b.length + 1);
+  for (let i = 1; i <= a.length; i++) {
+    curr[0] = i;
+    for (let j = 1; j <= b.length; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      curr[j] = Math.min(curr[j - 1] + 1, prev[j] + 1, prev[j - 1] + cost);
     }
-    return visibleCommands;
+    [prev, curr] = [curr, prev];
   }
-  /**
-   * Compare options for sort.
-   *
-   * @param {Option} a
-   * @param {Option} b
-   * @returns {number}
-   */
-  compareOptions(a, b) {
-    const getSortKey = (option) => {
-      return option.short ? option.short.replace(/^-/, "") : option.long.replace(/^--/, "");
-    };
-    return getSortKey(a).localeCompare(getSortKey(b));
+  return prev[b.length];
+}
+function didYouMean(input, candidates) {
+  const strip = (s) => s.replace(/^-+/, "");
+  const target = strip(input);
+  if (!target) return void 0;
+  let best;
+  for (const candidate of candidates) {
+    const cand = strip(candidate);
+    if (!cand) continue;
+    if (cand === target) continue;
+    if (cand === `${target}-file` || target === `${cand}-file`) continue;
+    const distance = levenshtein(target, cand);
+    const prefix = cand.startsWith(target) || target.startsWith(cand);
+    const threshold = Math.max(2, Math.ceil(cand.length * 0.4));
+    if (!prefix && distance > threshold) continue;
+    const better = !best || distance < best.distance || distance === best.distance && prefix && !best.prefix;
+    if (better) best = { flag: candidate, distance, prefix };
   }
-  /**
-   * Get an array of the visible options. Includes a placeholder for the implicit help option, if there is one.
-   *
-   * @param {Command} cmd
-   * @returns {Option[]}
-   */
-  visibleOptions(cmd) {
-    const visibleOptions = cmd.options.filter((option) => !option.hidden);
-    const helpOption = cmd._getHelpOption();
-    if (helpOption && !helpOption.hidden) {
-      const removeShort = helpOption.short && cmd._findOption(helpOption.short);
-      const removeLong = helpOption.long && cmd._findOption(helpOption.long);
-      if (!removeShort && !removeLong) {
-        visibleOptions.push(helpOption);
-      } else if (helpOption.long && !removeLong) {
-        visibleOptions.push(
-          cmd.createOption(helpOption.long, helpOption.description)
-        );
-      } else if (helpOption.short && !removeShort) {
-        visibleOptions.push(
-          cmd.createOption(helpOption.short, helpOption.description)
-        );
+  return best?.flag;
+}
+var ERROR_CODES, ERROR_CODE_REFERENCE;
+var init_error_codes = __esm({
+  "src/error-codes.ts"() {
+    "use strict";
+    ERROR_CODES = {
+      /** A required flag was not supplied (e.g. `issue create` without `--priority`). */
+      ERR_MISSING_FLAG: "ERR_MISSING_FLAG",
+      /** Two mutually-exclusive flags were both supplied (e.g. `--title` with `--title-file`). */
+      ERR_CONFLICTING_FLAGS: "ERR_CONFLICTING_FLAGS",
+      /** A flag was supplied but its resolved value is empty (e.g. an empty `--title-file` or empty stdin). */
+      ERR_EMPTY_INPUT: "ERR_EMPTY_INPUT",
+      /** A supplied value has the right source but an invalid shape (e.g. a title with line breaks). */
+      ERR_INVALID_INPUT: "ERR_INVALID_INPUT",
+      /** A flag's value is outside its allowed set (e.g. `--priority nope`). */
+      ERR_BAD_ENUM: "ERR_BAD_ENUM",
+      /** An unknown flag or subcommand — usually a typo; carries a `did_you_mean`. */
+      ERR_UNKNOWN_FLAG: "ERR_UNKNOWN_FLAG",
+      /** A positional argument was passed to a command that does not take it (e.g. `oracle board read 496`,
+       *  a whole-board read given an issue number). Carries a `corrected_command` when exactly one sibling
+       *  answers the same verb positionally (#6354). */
+      ERR_EXCESS_ARGUMENT: "ERR_EXCESS_ARGUMENT",
+      /** A referenced resource (issue, repo, board item) does not exist. */
+      ERR_NOT_FOUND: "ERR_NOT_FOUND",
+      /** Missing / rejected credentials on a path that needs auth. */
+      ERR_NO_AUTH: "ERR_NO_AUTH",
+      /** The operation partially succeeded (some units done, some failed). */
+      ERR_PARTIAL: "ERR_PARTIAL",
+      /** The request was well-formed and every referent resolved, but the target's CURRENT STATE forbids the
+       *  mutation (HTTP 409 semantics) — e.g. reparenting an issue that already has a parent. Deliberately not
+       *  one code per API constraint: retry is futile until the named state is changed, and that is the fact a
+       *  caller has to act on, whichever rule produced it. */
+      ERR_STATE_CONFLICT: "ERR_STATE_CONFLICT"
+    };
+    ERROR_CODE_REFERENCE = [
+      {
+        code: ERROR_CODES.ERR_MISSING_FLAG,
+        meaning: "A required flag was not supplied.",
+        typical_fix: "Run `mmi-cli explain <command>` and retry with the required flag."
+      },
+      {
+        code: ERROR_CODES.ERR_CONFLICTING_FLAGS,
+        meaning: "Two mutually-exclusive flags were supplied together.",
+        typical_fix: "Pass only one of the conflicting flags (see `offending_flag`) and retry."
+      },
+      {
+        code: ERROR_CODES.ERR_EMPTY_INPUT,
+        meaning: "A flag was supplied but resolved to an empty value (e.g. an empty file or empty stdin).",
+        typical_fix: "Provide non-empty content for the flag in `offending_flag` (a file with text, or a real pipe/heredoc for stdin)."
+      },
+      {
+        code: ERROR_CODES.ERR_INVALID_INPUT,
+        meaning: "A supplied value has an invalid shape for the flag.",
+        typical_fix: "Correct the value named by `offending_flag` and retry."
+      },
+      {
+        code: ERROR_CODES.ERR_BAD_ENUM,
+        meaning: "A flag value is outside the allowed enum.",
+        typical_fix: "Use one of the values in `expected`; casing and separators are often normalized by the CLI when supported."
+      },
+      {
+        code: ERROR_CODES.ERR_UNKNOWN_FLAG,
+        meaning: "A flag or subcommand is not known to this CLI version.",
+        typical_fix: "Check `did_you_mean`, route with `mmi-cli commands --json`, then inspect exact detail with `mmi-cli explain <command> --json`; update the CLI if it should exist."
+      },
+      {
+        code: ERROR_CODES.ERR_EXCESS_ARGUMENT,
+        meaning: "A positional argument was supplied to a command that takes none (or fewer).",
+        typical_fix: "Run the command named by `corrected_command`; otherwise drop the extra argument and select the target with the flags in `mmi-cli explain <command> --json`."
+      },
+      {
+        code: ERROR_CODES.ERR_NOT_FOUND,
+        meaning: "The referenced issue, PR, repo, board item, or other resource was not found.",
+        typical_fix: "Verify the identifier and repo, then rerun with an explicit `--repo <owner/repo>` when local repo detection is ambiguous."
+      },
+      {
+        code: ERROR_CODES.ERR_NO_AUTH,
+        meaning: "The command needs credentials that are missing, expired, or rejected.",
+        typical_fix: "Run `mmi-cli doctor --self` or refresh the relevant GitHub/Hub session before retrying."
+      },
+      {
+        code: ERROR_CODES.ERR_PARTIAL,
+        meaning: "A batch operation completed some units and failed others.",
+        typical_fix: "Read the per-unit results, fix the failed inputs, and rerun only the failed units."
+      },
+      {
+        code: ERROR_CODES.ERR_STATE_CONFLICT,
+        meaning: "The request was valid and every referent resolved, but the target resource's current state forbids it.",
+        typical_fix: "A plain retry fails identically. Read the state field the envelope names (e.g. `current_parent`), change that state deliberately with the command that owns it, then retry."
       }
-    }
-    if (this.sortOptions) {
-      visibleOptions.sort(this.compareOptions);
-    }
-    return visibleOptions;
-  }
-  /**
-   * Get an array of the visible global options. (Not including help.)
-   *
-   * @param {Command} cmd
-   * @returns {Option[]}
-   */
-  visibleGlobalOptions(cmd) {
-    if (!this.showGlobalOptions) return [];
-    const globalOptions = [];
-    for (let ancestorCmd = cmd.parent; ancestorCmd; ancestorCmd = ancestorCmd.parent) {
-      const visibleOptions = ancestorCmd.options.filter(
-        (option) => !option.hidden
-      );
-      globalOptions.push(...visibleOptions);
-    }
-    if (this.sortOptions) {
-      globalOptions.sort(this.compareOptions);
-    }
-    return globalOptions;
+    ];
   }
-  /**
-   * Get an array of the arguments if any have a description.
-   *
-   * @param {Command} cmd
-   * @returns {Argument[]}
-   */
-  visibleArguments(cmd) {
-    if (cmd._argsDescription) {
-      cmd.registeredArguments.forEach((argument) => {
-        argument.description = argument.description || cmd._argsDescription[argument.name()] || "";
-      });
-    }
-    if (cmd.registeredArguments.find((argument) => argument.description)) {
-      return cmd.registeredArguments;
-    }
-    return [];
+});
+
+// src/github-client.ts
+function classifyGhTokenExecFailure(e) {
+  const err = e;
+  const stderr = typeof err?.stderr === "string" ? err.stderr.trim() : "";
+  const detail = (stderr || err?.message || String(e)).replace(/\s+/g, " ").slice(0, 200);
+  if (err?.code === "ENOENT") return { state: "absent", detail: "gh is not installed on PATH" };
+  if (err?.killed === true || (err?.signal ?? null) !== null) return { state: "failed", detail: `gh auth token did not complete (${detail})` };
+  if (/not logged (in|into)|no oauth token|authentication token not found|gh auth login/i.test(`${stderr} ${err?.message ?? ""}`)) {
+    return { state: "absent", detail: "gh is installed but not logged in" };
   }
-  /**
-   * Get the command term to show in the list of subcommands.
-   *
+  return { state: "failed", detail };
+}
+async function githubTokenRead() {
+  if (process.env.GH_TOKEN) return { state: "ok", token: process.env.GH_TOKEN };
+  if (process.env.GITHUB_TOKEN) return { state: "ok", token: process.env.GITHUB_TOKEN };
+  cachedGhCliTokenRead ??= execFileP("gh", ["auth", "token"]).then(({ stdout }) => {
+    const token = stdout.trim();
+    return token ? { state: "ok", token } : { state: "absent", detail: "`gh auth token` exited 0 without printing a token" };
+  }).catch((e) => classifyGhTokenExecFailure(e));
+  return cachedGhCliTokenRead;
+}
+async function githubToken() {
+  const read = await githubTokenRead();
+  if (read.state === "failed") {
+    throw new GitHubApiError(
+      `GitHub identity read FAILED: \`gh auth token\` ${read.detail} \u2014 this is NOT "no token", so the call is refused rather than sent anonymously (an anonymous 401/404 would read as a permission or missing-object answer). Retry, or set GH_TOKEN/GITHUB_TOKEN for this process.`,
+      { status: 0 }
+    );
+  }
+  return read.state === "ok" ? read.token : void 0;
+}
+function rateLimitResetNote(resetEpochSeconds, now = Date.now()) {
+  if (!resetEpochSeconds) return "rate limit exhausted; reset time unknown";
+  const resetMs = resetEpochSeconds * 1e3;
+  const minutes = Math.max(0, Math.ceil((resetMs - now) / 6e4));
+  return `rate limit exhausted; resets at ${new Date(resetMs).toISOString()} (~${minutes}m)`;
+}
+function rateLimitFromResponse(res, detail) {
+  const remaining = res.headers.get("x-ratelimit-remaining");
+  const resetHeader = res.headers.get("x-ratelimit-reset");
+  const reset = resetHeader && /^\d+$/.test(resetHeader) ? Number(resetHeader) : void 0;
+  const rateLimited = (res.status === 403 || res.status === 429) && remaining === "0" || /rate limit|secondary rate|abuse detection/i.test(detail);
+  return { rateLimited, ...rateLimited && reset !== void 0 ? { rateLimitReset: reset } : {} };
+}
+function joinUrl(base, path2) {
+  if (path2.startsWith("http://") || path2.startsWith("https://")) return path2;
+  return `${base.replace(/\/+$/, "")}/${path2.replace(/^\/+/, "")}`;
+}
+function withPerPage(url) {
+  if (/[?&]per_page=/.test(url)) return url;
+  return url.includes("?") ? `${url}&per_page=100` : `${url}?per_page=100`;
+}
+function apiOrigin(baseUrl) {
+  return new URL(baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`).origin;
+}
+function nextLink(linkHeader) {
+  if (!linkHeader) return void 0;
+  for (const part of linkHeader.split(",")) {
+    const match = part.match(/<([^>]+)>\s*;\s*rel="next"/);
+    if (match) return match[1];
+  }
+  return void 0;
+}
+function safeNextLink(linkHeader, allowedOrigin) {
+  const next = nextLink(linkHeader);
+  if (!next) return void 0;
+  let origin;
+  try {
+    origin = new URL(next).origin;
+  } catch {
+    throw new GitHubApiError(`pagination link rejected: invalid URL (${next})`, { status: 0 });
+  }
+  if (origin !== allowedOrigin) {
+    throw new GitHubApiError(`pagination link rejected: cross-origin ${origin} (expected ${allowedOrigin})`, { status: 0 });
+  }
+  return next;
+}
+async function errorFromResponse(res) {
+  let detail = "";
+  try {
+    const text = await res.text();
+    try {
+      const parsed = JSON.parse(text);
+      detail = parsed.message ?? text;
+    } catch {
+      detail = text;
+    }
+  } catch {
+    detail = "";
+  }
+  const suffix = detail ? `: ${detail.trim()}` : "";
+  const limit = rateLimitFromResponse(res, detail);
+  const budgetNote = limit.rateLimited ? ` \u2014 ${rateLimitResetNote(limit.rateLimitReset)}` : "";
+  return new GitHubApiError(`HTTP ${res.status}${suffix}${budgetNote} (${res.url})`, {
+    status: res.status,
+    ...limit.rateLimited ? { rateLimited: true, rateLimitReset: limit.rateLimitReset } : {}
+  });
+}
+function createGitHubClient(options = {}) {
+  const baseUrl = options.baseUrl ?? process.env.GITHUB_API_URL ?? "https://api.github.com";
+  const allowedOrigin = apiOrigin(baseUrl);
+  const token = options.token ?? githubToken;
+  const defaultTimeoutMs = options.defaultTimeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const externalSignal = options.signal;
+  async function request(method, url, init = {}) {
+    const t = await token();
+    const headers = {
+      Accept: "application/vnd.github+json",
+      "X-GitHub-Api-Version": "2022-11-28",
+      "User-Agent": "mmi-cli",
+      ...t ? { Authorization: `Bearer ${t}` } : {},
+      ...init.body !== void 0 ? { "Content-Type": "application/json" } : {},
+      ...init.headers
+    };
+    const timeoutSignal = AbortSignal.timeout(init.timeoutMs ?? defaultTimeoutMs);
+    const res = await fetchImpl(url, {
+      method,
+      headers,
+      body: init.body !== void 0 ? JSON.stringify(init.body) : void 0,
+      signal: externalSignal ? AbortSignal.any([externalSignal, timeoutSignal]) : timeoutSignal
+    });
+    if (!res.ok) throw await errorFromResponse(res);
+    return res;
+  }
+  async function parseJson2(res) {
+    if (res.status === 204) return void 0;
+    const text = await res.text();
+    if (!text) return void 0;
+    return JSON.parse(text);
+  }
+  return {
+    async rest(method, path2, init) {
+      const res = await request(method, joinUrl(baseUrl, path2), init);
+      return parseJson2(res);
+    },
+    async restPaginate(path2, init) {
+      const items = [];
+      let url = withPerPage(joinUrl(baseUrl, path2));
+      while (url) {
+        const res = await request("GET", url, init);
+        const page = await parseJson2(res);
+        if (!Array.isArray(page)) {
+          throw new GitHubApiError(
+            `pagination page was not a JSON array (got ${page === void 0 ? "an empty body" : typeof page}) \u2014 the list read is PARTIAL and must not be treated as complete: ${url}. Retry the call.`,
+            { status: res.status }
+          );
+        }
+        items.push(...page);
+        url = safeNextLink(res.headers.get("link"), allowedOrigin);
+      }
+      return items;
+    },
+    async graphql(query, variables, init) {
+      const res = await request("POST", joinUrl(baseUrl, "graphql"), {
+        ...init,
+        body: { query, ...variables ? { variables } : {} }
+      });
+      const parsed = await parseJson2(res);
+      if (parsed?.errors?.length) {
+        const message2 = parsed.errors.map((e) => e.message ?? e.type ?? "unknown GraphQL error").join("; ");
+        const rateLimited = parsed.errors.some((e) => e.type === "RATE_LIMITED" || /rate limit/i.test(e.message ?? ""));
+        if (rateLimited) {
+          const resetHeader = res.headers.get("x-ratelimit-reset");
+          const reset = resetHeader && /^\d+$/.test(resetHeader) ? Number(resetHeader) : void 0;
+          throw new GitHubApiError(`GraphQL: ${message2} \u2014 GraphQL ${rateLimitResetNote(reset)}; REST may still have headroom`, {
+            status: 200,
+            graphqlErrors: parsed.errors,
+            rateLimited: true,
+            rateLimitReset: reset
+          });
+        }
+        throw new GitHubApiError(`GraphQL: ${message2}`, { status: 200, graphqlErrors: parsed.errors });
+      }
+      if (!parsed || parsed.data === void 0 || parsed.data === null) {
+        throw new GitHubApiError("GraphQL response did not include data", { status: 200 });
+      }
+      return parsed.data;
+    }
+  };
+}
+function defaultGitHubClient() {
+  cachedDefaultClient ??= createGitHubClient();
+  return cachedDefaultClient;
+}
+var cachedGhCliTokenRead, GitHubApiError, DEFAULT_TIMEOUT_MS, cachedDefaultClient;
+var init_github_client = __esm({
+  "src/github-client.ts"() {
+    "use strict";
+    init_cli_shared();
+    GitHubApiError = class extends Error {
+      status;
+      stderr;
+      graphqlErrors;
+      /** #4588: true when GitHub refused THIS call for budget (primary or secondary rate limit),
+       *  read from the refusing response itself — never the rate_limit endpoint. */
+      rateLimited;
+      /** Epoch seconds when the exhausted pool resets (`X-Ratelimit-Reset` of the refusing response). */
+      rateLimitReset;
+      constructor(message2, opts = {}) {
+        super(message2);
+        this.name = "GitHubApiError";
+        this.status = opts.status ?? 0;
+        this.stderr = message2;
+        this.graphqlErrors = opts.graphqlErrors;
+        this.rateLimited = opts.rateLimited;
+        this.rateLimitReset = opts.rateLimitReset;
+      }
+    };
+    DEFAULT_TIMEOUT_MS = 2e4;
+  }
+});
+
+// src/fetch-retry.ts
+async function fetchWithRetry(fetchImpl, url, init, opts = {}) {
+  const attempts = opts.attempts ?? 3;
+  const baseDelayMs = opts.baseDelayMs ?? 250;
+  const retryOn = opts.retryOn ?? ((res) => res.status >= 500);
+  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  let lastErr;
+  for (let i = 0; i < attempts; i++) {
+    const isLast = i === attempts - 1;
+    const attemptInit = opts.timeoutMs ? { ...init, signal: AbortSignal.timeout(opts.timeoutMs) } : init;
+    try {
+      const res = await fetchImpl(url, attemptInit);
+      if (!isLast && retryOn(res)) {
+        await sleep2(baseDelayMs * 2 ** i);
+        continue;
+      }
+      return res;
+    } catch (e) {
+      lastErr = e;
+      if (isLast) throw e;
+      await sleep2(baseDelayMs * 2 ** i);
+    }
+  }
+  throw lastErr;
+}
+var init_fetch_retry = __esm({
+  "src/fetch-retry.ts"() {
+    "use strict";
+  }
+});
+
+// src/hub-auth.ts
+function normalizeBaseUrl(baseUrl) {
+  return baseUrl.replace(/\/$/, "");
+}
+function tokenFingerprint(token) {
+  return (0, import_node_crypto.createHash)("sha256").update(token).digest("hex");
+}
+function defaultHubSessionCachePath(env = process.env) {
+  if (env.MMI_HUB_SESSION_CACHE) return env.MMI_HUB_SESSION_CACHE;
+  if (process.platform === "win32") {
+    const base2 = env.LOCALAPPDATA || (0, import_node_path3.join)((0, import_node_os.homedir)(), "AppData", "Local");
+    return (0, import_node_path3.join)(base2, "MMI Future", "mmi-cli", "hub-session.json");
+  }
+  const base = env.XDG_STATE_HOME || (0, import_node_path3.join)((0, import_node_os.homedir)(), ".local", "state");
+  return (0, import_node_path3.join)(base, "mmi-cli", "hub-session.json");
+}
+function roleFromToken(token) {
+  const part = token?.split(".")[1];
+  if (!part) return void 0;
+  try {
+    const claims = JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
+    return claims.role === "owner" ? "owner" : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function readCache(path2, apiUrl, now, githubTokenFingerprint) {
+  try {
+    const session = JSON.parse((0, import_node_fs3.readFileSync)(path2, "utf8"));
+    if (!session.token || !session.expiresAt || session.apiUrl !== apiUrl) return null;
+    if (session.githubTokenFingerprint !== githubTokenFingerprint) return null;
+    if (new Date(session.expiresAt).getTime() <= now.getTime() + REFRESH_WINDOW_MS) return null;
+    return { ...session, role: roleFromToken(session.token) };
+  } catch {
+    return null;
+  }
+}
+function writeCache(path2, session) {
+  (0, import_node_fs3.mkdirSync)((0, import_node_path3.dirname)(path2), { recursive: true });
+  const tmp = `${path2}.${process.pid}.${Date.now()}.tmp`;
+  (0, import_node_fs3.writeFileSync)(tmp, JSON.stringify(session, null, 2) + "\n", { encoding: "utf8", mode: 384 });
+  try {
+    (0, import_node_fs3.chmodSync)(tmp, 384);
+  } catch {
+  }
+  (0, import_node_fs3.renameSync)(tmp, path2);
+  try {
+    (0, import_node_fs3.chmodSync)(path2, 384);
+  } catch {
+  }
+}
+async function hubAuthSession(deps) {
+  if (!deps.baseUrl) return void 0;
+  const apiUrl = normalizeBaseUrl(deps.baseUrl);
+  const envToken = process.env.MMI_HUB_TOKEN;
+  if (envToken) {
+    return { ...{ token: envToken }, expiresAt: new Date(Date.now() + 30 * 60 * 1e3).toISOString(), apiUrl, githubTokenFingerprint: "env-override" };
+  }
+  const now = deps.now?.() ?? /* @__PURE__ */ new Date();
+  const cachePath = deps.cachePath ?? defaultHubSessionCachePath();
+  const ghToken = await deps.githubToken();
+  if (!ghToken) return void 0;
+  const githubTokenFingerprint = tokenFingerprint(ghToken);
+  const cached = readCache(cachePath, apiUrl, now, githubTokenFingerprint);
+  if (cached) return cached;
+  try {
+    const res = await fetchWithRetry(
+      deps.fetch ?? fetch,
+      `${apiUrl}/auth/session`,
+      { method: "POST", headers: { ...clientVersionHeaders(), Authorization: `Bearer ${ghToken}` } },
+      { attempts: EXCHANGE_ATTEMPTS, timeoutMs: EXCHANGE_TIMEOUT_MS }
+    );
+    if (!res.ok) return void 0;
+    const body = await res.json();
+    if (!body.token || !body.expiresAt) return void 0;
+    const session = {
+      token: body.token,
+      expiresAt: body.expiresAt,
+      login: typeof body.login === "string" ? body.login : void 0,
+      // #3513: from the SIGNED token, not the response body — one rule at every hop, so the cache
+      // read and the network read cannot disagree about what counts as an assertion.
+      role: roleFromToken(body.token),
+      apiUrl,
+      githubTokenFingerprint
+    };
+    try {
+      writeCache(cachePath, session);
+    } catch {
+    }
+    return session;
+  } catch {
+    return void 0;
+  }
+}
+async function hubAuthToken(deps) {
+  return (await hubAuthSession(deps))?.token;
+}
+var import_node_crypto, import_node_fs3, import_node_path3, import_node_os, REFRESH_WINDOW_MS, EXCHANGE_TIMEOUT_MS, EXCHANGE_ATTEMPTS;
+var init_hub_auth = __esm({
+  "src/hub-auth.ts"() {
+    "use strict";
+    import_node_crypto = require("node:crypto");
+    import_node_fs3 = require("node:fs");
+    import_node_path3 = require("node:path");
+    import_node_os = require("node:os");
+    init_fetch_retry();
+    init_client_version();
+    REFRESH_WINDOW_MS = 10 * 60 * 1e3;
+    EXCHANGE_TIMEOUT_MS = 8e3;
+    EXCHANGE_ATTEMPTS = 2;
+  }
+});
+
+// src/house-map.ts
+function isHouseRoot(token) {
+  return HOUSE_ROOTS.includes(token);
+}
+function isDeclaredHouseAlias(houseToken, lookupPath) {
+  const segments = lookupPath.split(" ");
+  for (let end = segments.length; end > 0; end -= 1) {
+    const key = segments.slice(0, end).join(" ");
+    const aliases = HOUSE_ALIASES[key];
+    if (aliases) return aliases.includes(houseToken);
+  }
+  return false;
+}
+function houseForPath(path2) {
+  if (path2 === "") return "core";
+  const segments = path2.split(" ");
+  for (let end = segments.length; end > 0; end -= 1) {
+    const key = segments.slice(0, end).join(" ");
+    const house = HOUSE_MAP[key];
+    if (house) return house;
+  }
+  return void 0;
+}
+function canonicalPathFor(path2) {
+  const house = houseForPath(path2);
+  if (!house) return void 0;
+  return house === "core" ? path2 : `${house} ${path2}`;
+}
+function canonicalArgvFor(args) {
+  const lookup = args.filter((tok) => !tok.startsWith("-")).slice(0, 2).join(" ");
+  const house = houseForPath(lookup);
+  return house && house !== "core" ? [house, ...args] : args;
+}
+var HOUSE_ROOTS, COMPAT_SHIM_DEATH_WAVE, FLAT_ALIAS_CUT_NOTE, HOUSE_QUESTIONS, HOUSE_MAP, HOUSE_ALIASES;
+var init_house_map = __esm({
+  "src/house-map.ts"() {
+    "use strict";
+    HOUSE_ROOTS = ["oracle", "harbour", "devops", "vault", "learning"];
+    COMPAT_SHIM_DEATH_WAVE = "Wave 3";
+    FLAT_ALIAS_CUT_NOTE = `flat Wave 0 alias \u2014 removed in ${COMPAT_SHIM_DEATH_WAVE} (#4316, #4438); only the canonical house-prefixed path parses`;
+    HOUSE_QUESTIONS = {
+      oracle: "Is it live?",
+      harbour: "Is it bounded?",
+      devops: "Is it legal?",
+      vault: "Is it guarded?",
+      learning: "Did it learn?",
+      core: "Is it one door?"
+    };
+    HOUSE_MAP = {
+      // --- oracle — live truth ------------------------------------------------------------------------
+      board: "oracle",
+      // board management (read + the guarded mutations that keep it live)
+      issue: "oracle",
+      // issues are live org truth
+      wave: "oracle",
+      // read-side multi-worktree board visibility (`wave status`)
+      next: "oracle",
+      // read-side board: the next actionable item
+      docs: "oracle",
+      // generated docs surfaces — the live org knowledge routing index
+      org: "oracle",
+      // org projects/registry/access reads (subgroup overrides below)
+      "org project": "oracle",
+      // registry projections (declared + projected live truth)
+      "org access": "oracle",
+      // org access role/audit reads
+      "org config": "oracle",
+      // live org configuration read
+      // --- harbour — declared lanes -------------------------------------------------------------------
+      "org schedules": "harbour",
+      // register/run/park schedule rows under the one lane contract
+      // --- devops — shipping --------------------------------------------------------------------------
+      pr: "devops",
+      ci: "devops",
+      // the CI/gate audit
+      rcand: "devops",
+      release: "devops",
+      hotfix: "devops",
+      train: "devops",
+      "wave land": "devops",
+      // the write-side serial merge train is shipping, not board observation
+      bootstrap: "devops",
+      // repo provisioning + propagate
+      runtime: "devops",
+      // tenant/deploy/box/edge — shipping and central deploy
+      "org rules": "devops",
+      // org-managed repository rule delivery (.gitignore)
+      // --- vault — secrets ----------------------------------------------------------------------------
+      secrets: "vault",
+      "org oauth": "vault",
+      // OAuth credential planning/set/verify
+      // --- learning — self-improvement ----------------------------------------------------------------
+      report: "learning",
+      // friction reports
+      "skill-lesson": "learning",
+      "closure-rate": "learning",
+      // closure rate per loop kind, computed at read (#4440)
+      pickup: "learning",
+      // cloud-agent adoption gate (#5708)
+      // --- core — the front door itself ---------------------------------------------------------------
+      commands: "core",
+      whoami: "core",
+      spawn: "core",
+      // this repo's process-spawn contract
+      tests: "core",
+      // this repo's test-policy contract
+      dist: "core",
+      // this repo's committed dist/BOM drift receipt (#5576)
+      doctor: "core",
+      stage: "core",
+      plugin: "core",
+      // plugin lifecycle + guards (CLI house owns plugins)
+      explain: "core",
+      // command-surface help
+      status: "core",
+      // repo-orientation snapshot (front door — torn toward oracle, kept core)
+      onboard: "core"
+      // repo-readiness orientation (front door — torn toward oracle, kept core)
+    };
+    HOUSE_ALIASES = {
+      issue: ["devops"],
+      // filing/managing issues is oracle, but reads as shipping work
+      "issue create": ["devops"]
+    };
+  }
+});
+
+// src/stdin-inject.ts
+function stdinHasPipedInput(statFd = () => (0, import_node_fs4.fstatSync)(0), getIsTTY = () => process.stdin.isTTY) {
+  try {
+    const stat4 = statFd();
+    if (stat4.isFIFO() || stat4.isFile()) return true;
+    if (stat4.isCharacterDevice()) return false;
+    if (stat4.isSocket()) return false;
+    if (getIsTTY() === true) return false;
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function readStdin(opts = {}) {
+  if (injectedStdin !== void 0) return injectedStdin;
+  if (!stdinHasPipedInput()) return "";
+  const maxBytes = opts.maxBytes ?? STDIN_MAX_BYTES;
+  const timeoutMs = opts.timeoutMs ?? STDIN_DRAIN_TIMEOUT_MS;
+  const chunks = [];
+  let total = 0;
+  const drain = (async () => {
+    for await (const chunk of process.stdin) {
+      const buf = chunk;
+      const room = maxBytes - total;
+      if (buf.length >= room) {
+        chunks.push(buf.subarray(0, room));
+        total = maxBytes;
+        break;
+      }
+      chunks.push(buf);
+      total += buf.length;
+    }
+  })().catch(() => {
+  });
+  let timer;
+  const timeout = new Promise((resolve7) => {
+    timer = setTimeout(resolve7, timeoutMs);
+  });
+  try {
+    await Promise.race([drain, timeout]);
+  } finally {
+    if (timer) clearTimeout(timer);
+    try {
+      process.stdin.unref();
+    } catch {
+    }
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+var import_node_fs4, injectedStdin, STDIN_MAX_BYTES, STDIN_DRAIN_TIMEOUT_MS;
+var init_stdin_inject = __esm({
+  "src/stdin-inject.ts"() {
+    "use strict";
+    import_node_fs4 = require("node:fs");
+    STDIN_MAX_BYTES = 8 * 1024 * 1024;
+    STDIN_DRAIN_TIMEOUT_MS = 5e3;
+  }
+});
+
+// src/cli-shared.ts
+function killProcessTree(pid) {
+  try {
+    if (process.platform === "win32") {
+      (0, import_node_child_process2.execFileSync)("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true });
+    } else {
+      process.kill(pid, "SIGKILL");
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+function execFileHard(file, args, options) {
+  const { timeout, step, ...rest } = options;
+  const started = Date.now();
+  return new Promise((resolve7, reject) => {
+    const child2 = (0, import_node_child_process2.execFile)(file, args, { encoding: "utf8", windowsHide: true, ...rest, timeout: 0 }, (error, stdout, stderr) => {
+      clearTimeout(timer);
+      if (expired) return;
+      if (error) reject(error);
+      else resolve7({ stdout: String(stdout), stderr: String(stderr) });
+    });
+    let expired = false;
+    const timer = setTimeout(() => {
+      expired = true;
+      const killed = child2.pid ? killProcessTree(child2.pid) : false;
+      child2.stdout?.destroy();
+      child2.stderr?.destroy();
+      child2.unref();
+      reject(new ExecDeadlineError(step, timeout, Date.now() - started, killed));
+    }, timeout);
+    timer.unref?.();
+  });
+}
+async function githubLogin() {
+  cachedGithubLogin ??= execFileP("gh", ["api", "user", "--jq", ".login"]).then(({ stdout }) => stdout.trim() || void 0).catch(() => void 0);
+  return cachedGithubLogin;
+}
+async function hubHeaders(extra = {}) {
+  const cfg = await loadConfig();
+  const t = await hubAuthToken({ baseUrl: cfg.sagaApiUrl ?? defaultHubUrl(), githubToken });
+  const base = { ...clientVersionHeaders(), ...extra };
+  return t ? { ...base, Authorization: `Bearer ${t}` } : base;
+}
+async function loadConfig() {
+  return { sagaApiUrl: defaultHubUrl() };
+}
+async function originRemoteUrl() {
+  return gitOut(["config", "--get", "remote.origin.url"]);
+}
+async function isOrgRepoRoot(readOrigin = originRemoteUrl) {
+  return /[:/]mutmutco\//i.test(await readOrigin());
+}
+async function repoProject(cfg) {
+  const remote = await gitOut(["remote", "get-url", "origin"]);
+  const repo = remote.replace(/\.git$/, "").split("/").pop() || "-";
+  return cfg.project || repo;
+}
+function argvWantsJson() {
+  return process.argv.some((a) => a === "--json" || a.startsWith("--json="));
+}
+function argvWantsMachineFailure() {
+  return argvWantsJson() || process.argv.some((a) => a === "--validate-only" || a === "--dry-run");
+}
+function commandFromFailMessage(msg) {
+  const head = msg.split(":", 1)[0].trim();
+  if (!head || head.startsWith("-")) return "mmi-cli";
+  if (!/^[a-z][a-z0-9-]*(?: [a-z][a-z0-9-]*){0,5}$/.test(head)) return "mmi-cli";
+  return canonicalPathFor(head) ?? head;
+}
+function canonicalFailMessage(msg) {
+  const colon = msg.indexOf(":");
+  if (colon < 0) return msg;
+  const command = commandFromFailMessage(msg);
+  return command === "mmi-cli" ? msg : `${command}${msg.slice(colon)}`;
+}
+function fail(msg, payload) {
+  const json = argvWantsMachineFailure();
+  const canonicalMsg = canonicalFailMessage(msg);
+  if (payload && json) {
+    console.error(formatErrorEnvelope(canonicalMsg, payload));
+  } else {
+    if (!json) console.error(`run: mmi-cli explain ${commandFromFailMessage(msg)}`);
+    console.error(`mmi-cli ${canonicalMsg}`);
+  }
+  hardExit(1);
+}
+async function failGracefulEnvelope(msg, payload) {
+  if (payload && argvWantsMachineFailure()) {
+    console.error(formatErrorEnvelope(msg, payload));
+    return cleanExit(1);
+  }
+  return failGraceful(msg);
+}
+async function planMutation(opts, args, commandName, planFn) {
+  const validateOnly = opts.validateOnly === true;
+  const dryRun = opts.dryRun === true;
+  if (!validateOnly && !dryRun) return null;
+  const planned = planFn ? await planFn(opts, args) : { command: commandName, args };
+  return validateOnly ? { ok: true, planned } : { dry_run: true, planned };
+}
+function commandPath(cmd) {
+  const parts = [];
+  let node = cmd;
+  while (node && node.parent) {
+    parts.unshift(node.name());
+    node = node.parent;
+  }
+  return parts.join(" ") || cmd.name();
+}
+function jsonParity(cmd) {
+  if (!cmd.options.some((o) => o.long === "--json")) {
+    cmd.option("--json", "machine-readable output (default; accepted for parity)");
+  }
+  return cmd;
+}
+function mutating(cmd, planFn) {
+  const marker = cmd;
+  if (marker.__mmiMutating) return cmd;
+  marker.__mmiMutating = true;
+  if (!cmd.options.some((o) => o.long === "--json")) cmd.option("--json", "machine-readable output");
+  cmd.option("--dry-run", "resolve + validate, print the planned action as JSON, and exit without writing");
+  cmd.option("--validate-only", "validate flags/enums/refs, print {ok,planned} or the C2 error envelope, and exit without writing");
+  const registerAction = cmd.action.bind(cmd);
+  cmd.action = ((handler) => registerAction(async (...actionArgs) => {
+    const command = actionArgs[actionArgs.length - 1];
+    const opts = command.opts();
+    const positionals = actionArgs.slice(0, -2);
+    const out = await planMutation(opts, positionals, commandPath(command), planFn);
+    if (out) {
+      console.log(JSON.stringify(out));
+      return;
+    }
+    return handler(...actionArgs);
+  }));
+  return cmd;
+}
+function installProcessBackstop() {
+  process.on("unhandledRejection", (reason) => void failGraceful(reason instanceof Error ? reason.message : String(reason)));
+  process.on("uncaughtException", (err) => void failGraceful(err instanceof Error ? err.message : String(err)));
+}
+function rawFlag(flag) {
+  return process.argv.some((arg) => arg === flag || arg.startsWith(`${flag}=`));
+}
+function rawValue(flag, fallback) {
+  const index = process.argv.indexOf(flag);
+  if (index >= 0 && process.argv[index + 1]) return process.argv[index + 1];
+  const inline = process.argv.find((arg) => arg.startsWith(`${flag}=`));
+  return inline ? inline.slice(flag.length + 1) : fallback;
+}
+function printLine(value) {
+  (0, import_node_fs5.writeSync)(1, `${value}
+`);
+}
+var import_node_child_process2, import_node_fs5, import_node_util3, rawExecFileP, DEFAULT_EXEC_TIMEOUT_MS, execFileP, GIT_TIMEOUT_MS, ExecDeadlineError, cachedGithubLogin, gitOut, consoleIo;
+var init_cli_shared = __esm({
+  "src/cli-shared.ts"() {
+    "use strict";
+    import_node_child_process2 = require("node:child_process");
+    import_node_fs5 = require("node:fs");
+    import_node_util3 = require("node:util");
+    init_hub_url();
+    init_client_version();
+    init_clean_exit();
+    init_error_codes();
+    init_github_client();
+    init_hub_auth();
+    init_house_map();
+    init_stdin_inject();
+    rawExecFileP = (0, import_node_util3.promisify)(import_node_child_process2.execFile);
+    DEFAULT_EXEC_TIMEOUT_MS = 1e4;
+    execFileP = (file, args, options = {}) => (
+      // encoding 'utf8' guarantees string stdout/stderr at runtime; the cast pins the type because
+      // promisify(execFile)'s overloads widen to string|Buffer when options is spread in.
+      rawExecFileP(file, args, { encoding: "utf8", windowsHide: true, timeout: DEFAULT_EXEC_TIMEOUT_MS, killSignal: "SIGTERM", ...options })
+    );
+    GIT_TIMEOUT_MS = DEFAULT_EXEC_TIMEOUT_MS;
+    ExecDeadlineError = class extends Error {
+      constructor(step, timeoutMs, elapsedMs, killed) {
+        super(
+          `\`${step}\` did not finish within ${Math.round(timeoutMs / 1e3)}s (gave up after ${Math.round(elapsedMs / 1e3)}s). It stopped responding and did not exit when asked to, so the timeout alone could not end it; ${killed ? "its process tree was force-terminated" : "its process tree could NOT be terminated and may still be running"}.`
+        );
+        this.step = step;
+        this.timeoutMs = timeoutMs;
+        this.elapsedMs = elapsedMs;
+        this.killed = killed;
+        this.name = "ExecDeadlineError";
+      }
+      step;
+      timeoutMs;
+      elapsedMs;
+      killed;
+    };
+    gitOut = async (args) => {
+      try {
+        return (await execFileP("git", [...args])).stdout.trim();
+      } catch {
+        return "";
+      }
+    };
+    consoleIo = { log: (m) => console.log(m), err: (m) => console.error(m) };
+  }
+});
+
+// src/board-write.ts
+var board_write_exports = {};
+__export(board_write_exports, {
+  writeHubBoardField: () => writeHubBoardField
+});
+async function writeHubBoardField(request) {
+  const config = await loadConfig();
+  const res = await fetch(`${config.sagaApiUrl?.replace(/\/$/, "")}/board/field`, {
+    method: "POST",
+    headers: await hubHeaders({ "content-type": "application/json" }),
+    body: JSON.stringify(request),
+    signal: AbortSignal.timeout(25e3)
+  });
+  const body = await res.json().catch(() => null);
+  if (!res.ok || body?.updated !== true) throw new Error(`board field write HTTP ${res.status}: ${body?.error ?? "unconfirmed result"}`);
+}
+var init_board_write = __esm({
+  "src/board-write.ts"() {
+    "use strict";
+    init_cli_shared();
+  }
+});
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  DEFAULT_PRIORITY: () => DEFAULT_PRIORITY,
+  argvWantsJson: () => argvWantsJson3,
+  awsCallerArn: () => awsCallerArn,
+  ciAuditDeps: () => ciAuditDeps2,
+  classifyParseError: () => classifyParseError,
+  commandOwnLongFlags: () => commandOwnLongFlags,
+  envHealLockPath: () => envHealLockPath,
+  isOrgRegisteredRepo: () => isOrgRegisteredRepo,
+  parseInvalidChoiceError: () => parseInvalidChoiceError,
+  positionalTargetForm: () => positionalTargetForm,
+  registryClientDeps: () => registryClientDeps,
+  repoSlug: () => repoSlug,
+  suggestCommandPath: () => suggestCommandPath,
+  unknownCommandCandidates: () => unknownCommandCandidates
+});
+module.exports = __toCommonJS(index_exports);
+
+// node_modules/commander/lib/error.js
+var CommanderError = class extends Error {
+  /**
+   * Constructs the CommanderError class
+   * @param {number} exitCode suggested exit code which could be used with process.exit
+   * @param {string} code an id string representing the error
+   * @param {string} message human-readable description of the error
+   */
+  constructor(exitCode, code, message2) {
+    super(message2);
+    Error.captureStackTrace(this, this.constructor);
+    this.name = this.constructor.name;
+    this.code = code;
+    this.exitCode = exitCode;
+    this.nestedError = void 0;
+  }
+};
+var InvalidArgumentError = class extends CommanderError {
+  /**
+   * Constructs the InvalidArgumentError class
+   * @param {string} [message] explanation of why argument is invalid
+   */
+  constructor(message2) {
+    super(1, "commander.invalidArgument", message2);
+    Error.captureStackTrace(this, this.constructor);
+    this.name = this.constructor.name;
+  }
+};
+
+// node_modules/commander/lib/argument.js
+var Argument = class {
+  /**
+   * Initialize a new command argument with the given name and description.
+   * The default is that the argument is required, and you can explicitly
+   * indicate this with <> around the name. Put [] around the name for an optional argument.
+   *
+   * @param {string} name
+   * @param {string} [description]
+   */
+  constructor(name, description) {
+    this.description = description || "";
+    this.variadic = false;
+    this.parseArg = void 0;
+    this.defaultValue = void 0;
+    this.defaultValueDescription = void 0;
+    this.argChoices = void 0;
+    switch (name[0]) {
+      case "<":
+        this.required = true;
+        this._name = name.slice(1, -1);
+        break;
+      case "[":
+        this.required = false;
+        this._name = name.slice(1, -1);
+        break;
+      default:
+        this.required = true;
+        this._name = name;
+        break;
+    }
+    if (this._name.endsWith("...")) {
+      this.variadic = true;
+      this._name = this._name.slice(0, -3);
+    }
+  }
+  /**
+   * Return argument name.
+   *
+   * @return {string}
+   */
+  name() {
+    return this._name;
+  }
+  /**
+   * @package
+   */
+  _collectValue(value, previous) {
+    if (previous === this.defaultValue || !Array.isArray(previous)) {
+      return [value];
+    }
+    previous.push(value);
+    return previous;
+  }
+  /**
+   * Set the default value, and optionally supply the description to be displayed in the help.
+   *
+   * @param {*} value
+   * @param {string} [description]
+   * @return {Argument}
+   */
+  default(value, description) {
+    this.defaultValue = value;
+    this.defaultValueDescription = description;
+    return this;
+  }
+  /**
+   * Set the custom handler for processing CLI command arguments into argument values.
+   *
+   * @param {Function} [fn]
+   * @return {Argument}
+   */
+  argParser(fn) {
+    this.parseArg = fn;
+    return this;
+  }
+  /**
+   * Only allow argument value to be one of choices.
+   *
+   * @param {string[]} values
+   * @return {Argument}
+   */
+  choices(values) {
+    this.argChoices = values.slice();
+    this.parseArg = (arg, previous) => {
+      if (!this.argChoices.includes(arg)) {
+        throw new InvalidArgumentError(
+          `Allowed choices are ${this.argChoices.join(", ")}.`
+        );
+      }
+      if (this.variadic) {
+        return this._collectValue(arg, previous);
+      }
+      return arg;
+    };
+    return this;
+  }
+  /**
+   * Make argument required.
+   *
+   * @returns {Argument}
+   */
+  argRequired() {
+    this.required = true;
+    return this;
+  }
+  /**
+   * Make argument optional.
+   *
+   * @returns {Argument}
+   */
+  argOptional() {
+    this.required = false;
+    return this;
+  }
+};
+function humanReadableArgName(arg) {
+  const nameOutput = arg.name() + (arg.variadic === true ? "..." : "");
+  return arg.required ? "<" + nameOutput + ">" : "[" + nameOutput + "]";
+}
+
+// node_modules/commander/lib/command.js
+var import_node_events = require("node:events");
+var import_node_child_process = __toESM(require("node:child_process"), 1);
+var import_node_path = __toESM(require("node:path"), 1);
+var import_node_fs = __toESM(require("node:fs"), 1);
+var import_node_process = __toESM(require("node:process"), 1);
+var import_node_util2 = require("node:util");
+
+// node_modules/commander/lib/help.js
+var import_node_util = require("node:util");
+var Help = class {
+  constructor() {
+    this.helpWidth = void 0;
+    this.minWidthToWrap = 40;
+    this.sortSubcommands = false;
+    this.sortOptions = false;
+    this.showGlobalOptions = false;
+  }
+  /**
+   * prepareContext is called by Commander after applying overrides from `Command.configureHelp()`
+   * and just before calling `formatHelp()`.
+   *
+   * Commander just uses the helpWidth and the rest is provided for optional use by more complex subclasses.
+   *
+   * @param {{ error?: boolean, helpWidth?: number, outputHasColors?: boolean }} contextOptions
+   */
+  prepareContext(contextOptions) {
+    this.helpWidth = this.helpWidth ?? contextOptions.helpWidth ?? 80;
+  }
+  /**
+   * Get an array of the visible subcommands. Includes a placeholder for the implicit help command, if there is one.
+   *
+   * @param {Command} cmd
+   * @returns {Command[]}
+   */
+  visibleCommands(cmd) {
+    const visibleCommands = cmd.commands.filter((cmd2) => !cmd2._hidden);
+    const helpCommand = cmd._getHelpCommand();
+    if (helpCommand && !helpCommand._hidden) {
+      visibleCommands.push(helpCommand);
+    }
+    if (this.sortSubcommands) {
+      visibleCommands.sort((a, b) => {
+        return a.name().localeCompare(b.name());
+      });
+    }
+    return visibleCommands;
+  }
+  /**
+   * Compare options for sort.
+   *
+   * @param {Option} a
+   * @param {Option} b
+   * @returns {number}
+   */
+  compareOptions(a, b) {
+    const getSortKey = (option) => {
+      return option.short ? option.short.replace(/^-/, "") : option.long.replace(/^--/, "");
+    };
+    return getSortKey(a).localeCompare(getSortKey(b));
+  }
+  /**
+   * Get an array of the visible options. Includes a placeholder for the implicit help option, if there is one.
+   *
+   * @param {Command} cmd
+   * @returns {Option[]}
+   */
+  visibleOptions(cmd) {
+    const visibleOptions = cmd.options.filter((option) => !option.hidden);
+    const helpOption = cmd._getHelpOption();
+    if (helpOption && !helpOption.hidden) {
+      const removeShort = helpOption.short && cmd._findOption(helpOption.short);
+      const removeLong = helpOption.long && cmd._findOption(helpOption.long);
+      if (!removeShort && !removeLong) {
+        visibleOptions.push(helpOption);
+      } else if (helpOption.long && !removeLong) {
+        visibleOptions.push(
+          cmd.createOption(helpOption.long, helpOption.description)
+        );
+      } else if (helpOption.short && !removeShort) {
+        visibleOptions.push(
+          cmd.createOption(helpOption.short, helpOption.description)
+        );
+      }
+    }
+    if (this.sortOptions) {
+      visibleOptions.sort(this.compareOptions);
+    }
+    return visibleOptions;
+  }
+  /**
+   * Get an array of the visible global options. (Not including help.)
+   *
+   * @param {Command} cmd
+   * @returns {Option[]}
+   */
+  visibleGlobalOptions(cmd) {
+    if (!this.showGlobalOptions) return [];
+    const globalOptions = [];
+    for (let ancestorCmd = cmd.parent; ancestorCmd; ancestorCmd = ancestorCmd.parent) {
+      const visibleOptions = ancestorCmd.options.filter(
+        (option) => !option.hidden
+      );
+      globalOptions.push(...visibleOptions);
+    }
+    if (this.sortOptions) {
+      globalOptions.sort(this.compareOptions);
+    }
+    return globalOptions;
+  }
+  /**
+   * Get an array of the arguments if any have a description.
+   *
+   * @param {Command} cmd
+   * @returns {Argument[]}
+   */
+  visibleArguments(cmd) {
+    if (cmd._argsDescription) {
+      cmd.registeredArguments.forEach((argument) => {
+        argument.description = argument.description || cmd._argsDescription[argument.name()] || "";
+      });
+    }
+    if (cmd.registeredArguments.find((argument) => argument.description)) {
+      return cmd.registeredArguments;
+    }
+    return [];
+  }
+  /**
+   * Get the command term to show in the list of subcommands.
+   *
    * @param {Command} cmd
    * @returns {string}
    */
@@ -2772,1661 +3877,654 @@ Expecting one of '${allowedValues.join("', '")}'`);
     }
     const config = errorOptions || {};
     const exitCode = config.exitCode || 1;
-    const code = config.code || "commander.error";
-    this._exit(exitCode, code, message2);
-  }
-  /**
-   * Apply any option related environment variables, if option does
-   * not have a value from cli or client code.
-   *
-   * @private
-   */
-  _parseOptionsEnv() {
-    this.options.forEach((option) => {
-      if (option.envVar && option.envVar in import_node_process.default.env) {
-        const optionKey = option.attributeName();
-        if (this.getOptionValue(optionKey) === void 0 || ["default", "config", "env"].includes(
-          this.getOptionValueSource(optionKey)
-        )) {
-          if (option.required || option.optional) {
-            this.emit(`optionEnv:${option.name()}`, import_node_process.default.env[option.envVar]);
-          } else {
-            this.emit(`optionEnv:${option.name()}`);
-          }
-        }
-      }
-    });
-  }
-  /**
-   * Apply any implied option values, if option is undefined or default value.
-   *
-   * @private
-   */
-  _parseOptionsImplied() {
-    const dualHelper = new DualOptions(this.options);
-    const hasCustomOptionValue = (optionKey) => {
-      return this.getOptionValue(optionKey) !== void 0 && !["default", "implied"].includes(this.getOptionValueSource(optionKey));
-    };
-    this.options.filter(
-      (option) => option.implied !== void 0 && hasCustomOptionValue(option.attributeName()) && dualHelper.valueFromOption(
-        this.getOptionValue(option.attributeName()),
-        option
-      )
-    ).forEach((option) => {
-      Object.keys(option.implied).filter((impliedKey) => !hasCustomOptionValue(impliedKey)).forEach((impliedKey) => {
-        this.setOptionValueWithSource(
-          impliedKey,
-          option.implied[impliedKey],
-          "implied"
-        );
-      });
-    });
-  }
-  /**
-   * Argument `name` is missing.
-   *
-   * @param {string} name
-   * @private
-   */
-  missingArgument(name) {
-    const message2 = `error: missing required argument '${name}'`;
-    this.error(message2, { code: "commander.missingArgument" });
-  }
-  /**
-   * `Option` is missing an argument.
-   *
-   * @param {Option} option
-   * @private
-   */
-  optionMissingArgument(option) {
-    const message2 = `error: option '${option.flags}' argument missing`;
-    this.error(message2, { code: "commander.optionMissingArgument" });
-  }
-  /**
-   * `Option` does not have a value, and is a mandatory option.
-   *
-   * @param {Option} option
-   * @private
-   */
-  missingMandatoryOptionValue(option) {
-    const message2 = `error: required option '${option.flags}' not specified`;
-    this.error(message2, { code: "commander.missingMandatoryOptionValue" });
-  }
-  /**
-   * `Option` conflicts with another option.
-   *
-   * @param {Option} option
-   * @param {Option} conflictingOption
-   * @private
-   */
-  _conflictingOption(option, conflictingOption) {
-    const findBestOptionFromValue = (option2) => {
-      const optionKey = option2.attributeName();
-      const optionValue = this.getOptionValue(optionKey);
-      const negativeOption = this.options.find(
-        (target) => target.negate && optionKey === target.attributeName()
-      );
-      const positiveOption = this.options.find(
-        (target) => !target.negate && optionKey === target.attributeName()
-      );
-      if (negativeOption && (negativeOption.presetArg === void 0 && optionValue === false || negativeOption.presetArg !== void 0 && optionValue === negativeOption.presetArg)) {
-        return negativeOption;
-      }
-      return positiveOption || option2;
-    };
-    const getErrorMessage = (option2) => {
-      const bestOption = findBestOptionFromValue(option2);
-      const optionKey = bestOption.attributeName();
-      const source = this.getOptionValueSource(optionKey);
-      if (source === "env") {
-        return `environment variable '${bestOption.envVar}'`;
-      }
-      return `option '${bestOption.flags}'`;
-    };
-    const message2 = `error: ${getErrorMessage(option)} cannot be used with ${getErrorMessage(conflictingOption)}`;
-    this.error(message2, { code: "commander.conflictingOption" });
-  }
-  /**
-   * Unknown option `flag`.
-   *
-   * @param {string} flag
-   * @private
-   */
-  unknownOption(flag) {
-    if (this._allowUnknownOption) return;
-    let suggestion = "";
-    if (flag.startsWith("--") && this._showSuggestionAfterError) {
-      let candidateFlags = [];
-      let command = this;
-      do {
-        const moreFlags = command.createHelp().visibleOptions(command).filter((option) => option.long).map((option) => option.long);
-        candidateFlags = candidateFlags.concat(moreFlags);
-        command = command.parent;
-      } while (command && !command._enablePositionalOptions);
-      suggestion = suggestSimilar(flag, candidateFlags);
-    }
-    const message2 = `error: unknown option '${flag}'${suggestion}`;
-    this.error(message2, { code: "commander.unknownOption" });
-  }
-  /**
-   * Excess arguments, more than expected.
-   *
-   * @param {string[]} receivedArgs
-   * @private
-   */
-  _excessArguments(receivedArgs) {
-    if (this._allowExcessArguments) return;
-    const expected = this.registeredArguments.length;
-    const s = expected === 1 ? "" : "s";
-    const received = receivedArgs.length;
-    const forSubcommand = this.parent ? ` for '${this.name()}'` : "";
-    const details = receivedArgs.join(", ");
-    const message2 = `error: too many arguments${forSubcommand}. Expected ${expected} argument${s} but got ${received}: ${details}.`;
-    this.error(message2, { code: "commander.excessArguments" });
-  }
-  /**
-   * Unknown command.
-   *
-   * @private
-   */
-  unknownCommand() {
-    const unknownName = this.args[0];
-    let suggestion = "";
-    if (this._showSuggestionAfterError) {
-      const candidateNames = [];
-      this.createHelp().visibleCommands(this).forEach((command) => {
-        candidateNames.push(command.name());
-        if (command.alias()) candidateNames.push(command.alias());
-      });
-      suggestion = suggestSimilar(unknownName, candidateNames);
-    }
-    const message2 = `error: unknown command '${unknownName}'${suggestion}`;
-    this.error(message2, { code: "commander.unknownCommand" });
-  }
-  /**
-   * Get or set the program version.
-   *
-   * This method auto-registers the "-V, --version" option which will print the version number.
-   *
-   * You can optionally supply the flags and description to override the defaults.
-   *
-   * @param {string} [str]
-   * @param {string} [flags]
-   * @param {string} [description]
-   * @return {(this | string | undefined)} `this` command for chaining, or version string if no arguments
-   */
-  version(str, flags, description) {
-    if (str === void 0) return this._version;
-    this._version = str;
-    flags = flags || "-V, --version";
-    description = description || "output the version number";
-    const versionOption = this.createOption(flags, description);
-    this._versionOptionName = versionOption.attributeName();
-    this._registerOption(versionOption);
-    this.on("option:" + versionOption.name(), () => {
-      this._outputConfiguration.writeOut(`${str}
-`);
-      this._exit(0, "commander.version", str);
-    });
-    return this;
-  }
-  /**
-   * Set the description.
-   *
-   * @param {string} [str]
-   * @param {object} [argsDescription]
-   * @return {(string|Command)}
-   */
-  description(str, argsDescription) {
-    if (str === void 0 && argsDescription === void 0)
-      return this._description;
-    this._description = str;
-    if (argsDescription) {
-      this._argsDescription = argsDescription;
-    }
-    return this;
-  }
-  /**
-   * Set the summary. Used when listed as subcommand of parent.
-   *
-   * @param {string} [str]
-   * @return {(string|Command)}
-   */
-  summary(str) {
-    if (str === void 0) return this._summary;
-    this._summary = str;
-    return this;
-  }
-  /**
-   * Set an alias for the command.
-   *
-   * You may call more than once to add multiple aliases. Only the first alias is shown in the auto-generated help.
-   *
-   * @param {string} [alias]
-   * @return {(string|Command)}
-   */
-  alias(alias) {
-    if (alias === void 0) return this._aliases[0];
-    let command = this;
-    if (this.commands.length !== 0 && this.commands[this.commands.length - 1]._executableHandler) {
-      command = this.commands[this.commands.length - 1];
-    }
-    if (alias === command._name)
-      throw new Error("Command alias can't be the same as its name");
-    const matchingCommand = this.parent?._findCommand(alias);
-    if (matchingCommand) {
-      const existingCmd = [matchingCommand.name()].concat(matchingCommand.aliases()).join("|");
-      throw new Error(
-        `cannot add alias '${alias}' to command '${this.name()}' as already have command '${existingCmd}'`
-      );
-    }
-    command._aliases.push(alias);
-    return this;
-  }
-  /**
-   * Set aliases for the command.
-   *
-   * Only the first alias is shown in the auto-generated help.
-   *
-   * @param {string[]} [aliases]
-   * @return {(string[]|Command)}
-   */
-  aliases(aliases) {
-    if (aliases === void 0) return this._aliases;
-    aliases.forEach((alias) => this.alias(alias));
-    return this;
-  }
-  /**
-   * Set / get the command usage `str`.
-   *
-   * @param {string} [str]
-   * @return {(string|Command)}
-   */
-  usage(str) {
-    if (str === void 0) {
-      if (this._usage) return this._usage;
-      const args = this.registeredArguments.map((arg) => {
-        return humanReadableArgName(arg);
-      });
-      return [].concat(
-        this.options.length || this._helpOption !== null ? "[options]" : [],
-        this.commands.length ? "[command]" : [],
-        this.registeredArguments.length ? args : []
-      ).join(" ");
-    }
-    this._usage = str;
-    return this;
-  }
-  /**
-   * Get or set the name of the command.
-   *
-   * @param {string} [str]
-   * @return {(string|Command)}
-   */
-  name(str) {
-    if (str === void 0) return this._name;
-    this._name = str;
-    return this;
-  }
-  /**
-   * Set/get the help group heading for this subcommand in parent command's help.
-   *
-   * @param {string} [heading]
-   * @return {Command | string}
-   */
-  helpGroup(heading) {
-    if (heading === void 0) return this._helpGroupHeading ?? "";
-    this._helpGroupHeading = heading;
-    return this;
-  }
-  /**
-   * Set/get the default help group heading for subcommands added to this command.
-   * (This does not override a group set directly on the subcommand using .helpGroup().)
-   *
-   * @example
-   * program.commandsGroup('Development Commands:);
-   * program.command('watch')...
-   * program.command('lint')...
-   * ...
-   *
-   * @param {string} [heading]
-   * @returns {Command | string}
-   */
-  commandsGroup(heading) {
-    if (heading === void 0) return this._defaultCommandGroup ?? "";
-    this._defaultCommandGroup = heading;
-    return this;
-  }
-  /**
-   * Set/get the default help group heading for options added to this command.
-   * (This does not override a group set directly on the option using .helpGroup().)
-   *
-   * @example
-   * program
-   *   .optionsGroup('Development Options:')
-   *   .option('-d, --debug', 'output extra debugging')
-   *   .option('-p, --profile', 'output profiling information')
-   *
-   * @param {string} [heading]
-   * @returns {Command | string}
-   */
-  optionsGroup(heading) {
-    if (heading === void 0) return this._defaultOptionGroup ?? "";
-    this._defaultOptionGroup = heading;
-    return this;
-  }
-  /**
-   * @param {Option} option
-   * @private
-   */
-  _initOptionGroup(option) {
-    if (this._defaultOptionGroup && !option.helpGroupHeading)
-      option.helpGroup(this._defaultOptionGroup);
-  }
-  /**
-   * @param {Command} cmd
-   * @private
-   */
-  _initCommandGroup(cmd) {
-    if (this._defaultCommandGroup && !cmd.helpGroup())
-      cmd.helpGroup(this._defaultCommandGroup);
-  }
-  /**
-   * Set the name of the command from script filename, such as process.argv[1],
-   * or import.meta.filename.
-   *
-   * (Used internally and public although not documented in README.)
-   *
-   * @example
-   * program.nameFromFilename(import.meta.filename);
-   *
-   * @param {string} filename
-   * @return {Command}
-   */
-  nameFromFilename(filename) {
-    this._name = import_node_path.default.basename(filename, import_node_path.default.extname(filename));
-    return this;
-  }
-  /**
-   * Get or set the directory for searching for executable subcommands of this command.
-   *
-   * @example
-   * program.executableDir(import.meta.dirname);
-   * // or
-   * program.executableDir('subcommands');
-   *
-   * @param {string} [path]
-   * @return {(string|null|Command)}
-   */
-  executableDir(path2) {
-    if (path2 === void 0) return this._executableDir;
-    this._executableDir = path2;
-    return this;
-  }
-  /**
-   * Return program help documentation.
-   *
-   * @param {{ error: boolean }} [contextOptions] - pass {error:true} to wrap for stderr instead of stdout
-   * @return {string}
-   */
-  helpInformation(contextOptions) {
-    const helper = this.createHelp();
-    const context = this._getOutputContext(contextOptions);
-    helper.prepareContext({
-      error: context.error,
-      helpWidth: context.helpWidth,
-      outputHasColors: context.hasColors
-    });
-    const text = helper.formatHelp(this, helper);
-    if (context.hasColors) return text;
-    return this._outputConfiguration.stripColor(text);
-  }
-  /**
-   * @typedef HelpContext
-   * @type {object}
-   * @property {boolean} error
-   * @property {number} helpWidth
-   * @property {boolean} hasColors
-   * @property {function} write - includes stripColor if needed
-   *
-   * @returns {HelpContext}
-   * @private
-   */
-  _getOutputContext(contextOptions) {
-    contextOptions = contextOptions || {};
-    const error = !!contextOptions.error;
-    let baseWrite;
-    let hasColors;
-    let helpWidth;
-    if (error) {
-      baseWrite = (str) => this._outputConfiguration.writeErr(str);
-      hasColors = this._outputConfiguration.getErrHasColors();
-      helpWidth = this._outputConfiguration.getErrHelpWidth();
-    } else {
-      baseWrite = (str) => this._outputConfiguration.writeOut(str);
-      hasColors = this._outputConfiguration.getOutHasColors();
-      helpWidth = this._outputConfiguration.getOutHelpWidth();
-    }
-    const write = (str) => {
-      if (!hasColors) str = this._outputConfiguration.stripColor(str);
-      return baseWrite(str);
-    };
-    return { error, write, hasColors, helpWidth };
-  }
-  /**
-   * Output help information for this command.
-   *
-   * Outputs built-in help, and custom text added using `.addHelpText()`.
-   *
-   * @param {{ error: boolean } | Function} [contextOptions] - pass {error:true} to write to stderr instead of stdout
-   */
-  outputHelp(contextOptions) {
-    let deprecatedCallback;
-    if (typeof contextOptions === "function") {
-      deprecatedCallback = contextOptions;
-      contextOptions = void 0;
-    }
-    const outputContext = this._getOutputContext(contextOptions);
-    const eventContext = {
-      error: outputContext.error,
-      write: outputContext.write,
-      command: this
-    };
-    this._getCommandAndAncestors().reverse().forEach((command) => command.emit("beforeAllHelp", eventContext));
-    this.emit("beforeHelp", eventContext);
-    let helpInformation = this.helpInformation({ error: outputContext.error });
-    if (deprecatedCallback) {
-      helpInformation = deprecatedCallback(helpInformation);
-      if (typeof helpInformation !== "string" && !Buffer.isBuffer(helpInformation)) {
-        throw new Error("outputHelp callback must return a string or a Buffer");
-      }
-    }
-    outputContext.write(helpInformation);
-    if (this._getHelpOption()?.long) {
-      this.emit(this._getHelpOption().long);
-    }
-    this.emit("afterHelp", eventContext);
-    this._getCommandAndAncestors().forEach(
-      (command) => command.emit("afterAllHelp", eventContext)
-    );
+    const code = config.code || "commander.error";
+    this._exit(exitCode, code, message2);
   }
   /**
-   * You can pass in flags and a description to customise the built-in help option.
-   * Pass in false to disable the built-in help option.
-   *
-   * @example
-   * program.helpOption('-?, --help' 'show help'); // customise
-   * program.helpOption(false); // disable
+   * Apply any option related environment variables, if option does
+   * not have a value from cli or client code.
    *
-   * @param {(string | boolean)} flags
-   * @param {string} [description]
-   * @return {Command} `this` command for chaining
+   * @private
    */
-  helpOption(flags, description) {
-    if (typeof flags === "boolean") {
-      if (flags) {
-        if (this._helpOption === null) this._helpOption = void 0;
-        if (this._defaultOptionGroup) {
-          this._initOptionGroup(this._getHelpOption());
+  _parseOptionsEnv() {
+    this.options.forEach((option) => {
+      if (option.envVar && option.envVar in import_node_process.default.env) {
+        const optionKey = option.attributeName();
+        if (this.getOptionValue(optionKey) === void 0 || ["default", "config", "env"].includes(
+          this.getOptionValueSource(optionKey)
+        )) {
+          if (option.required || option.optional) {
+            this.emit(`optionEnv:${option.name()}`, import_node_process.default.env[option.envVar]);
+          } else {
+            this.emit(`optionEnv:${option.name()}`);
+          }
         }
-      } else {
-        this._helpOption = null;
       }
-      return this;
-    }
-    this._helpOption = this.createOption(
-      flags ?? "-h, --help",
-      description ?? "display help for command"
-    );
-    if (flags || description) this._initOptionGroup(this._helpOption);
-    return this;
+    });
   }
   /**
-   * Lazy create help option.
-   * Returns null if has been disabled with .helpOption(false).
+   * Apply any implied option values, if option is undefined or default value.
    *
-   * @returns {(Option | null)} the help option
-   * @package
+   * @private
    */
-  _getHelpOption() {
-    if (this._helpOption === void 0) {
-      this.helpOption(void 0, void 0);
-    }
-    return this._helpOption;
+  _parseOptionsImplied() {
+    const dualHelper = new DualOptions(this.options);
+    const hasCustomOptionValue = (optionKey) => {
+      return this.getOptionValue(optionKey) !== void 0 && !["default", "implied"].includes(this.getOptionValueSource(optionKey));
+    };
+    this.options.filter(
+      (option) => option.implied !== void 0 && hasCustomOptionValue(option.attributeName()) && dualHelper.valueFromOption(
+        this.getOptionValue(option.attributeName()),
+        option
+      )
+    ).forEach((option) => {
+      Object.keys(option.implied).filter((impliedKey) => !hasCustomOptionValue(impliedKey)).forEach((impliedKey) => {
+        this.setOptionValueWithSource(
+          impliedKey,
+          option.implied[impliedKey],
+          "implied"
+        );
+      });
+    });
   }
   /**
-   * Supply your own option to use for the built-in help option.
-   * This is an alternative to using helpOption() to customise the flags and description etc.
+   * Argument `name` is missing.
    *
-   * @param {Option} option
-   * @return {Command} `this` command for chaining
+   * @param {string} name
+   * @private
    */
-  addHelpOption(option) {
-    this._helpOption = option;
-    this._initOptionGroup(option);
-    return this;
+  missingArgument(name) {
+    const message2 = `error: missing required argument '${name}'`;
+    this.error(message2, { code: "commander.missingArgument" });
   }
   /**
-   * Output help information and exit.
-   *
-   * Outputs built-in help, and custom text added using `.addHelpText()`.
+   * `Option` is missing an argument.
    *
-   * @param {{ error: boolean }} [contextOptions] - pass {error:true} to write to stderr instead of stdout
+   * @param {Option} option
+   * @private
    */
-  help(contextOptions) {
-    this.outputHelp(contextOptions);
-    let exitCode = Number(import_node_process.default.exitCode ?? 0);
-    if (exitCode === 0 && contextOptions && typeof contextOptions !== "function" && contextOptions.error) {
-      exitCode = 1;
-    }
-    this._exit(exitCode, "commander.help", "(outputHelp)");
+  optionMissingArgument(option) {
+    const message2 = `error: option '${option.flags}' argument missing`;
+    this.error(message2, { code: "commander.optionMissingArgument" });
   }
   /**
-   * // Do a little typing to coordinate emit and listener for the help text events.
-   * @typedef HelpTextEventContext
-   * @type {object}
-   * @property {boolean} error
-   * @property {Command} command
-   * @property {function} write
-   */
-  /**
-   * Add additional text to be displayed with the built-in help.
-   *
-   * Position is 'before' or 'after' to affect just this command,
-   * and 'beforeAll' or 'afterAll' to affect this command and all its subcommands.
+   * `Option` does not have a value, and is a mandatory option.
    *
-   * @param {string} position - before or after built-in help
-   * @param {(string | Function)} text - string to add, or a function returning a string
-   * @return {Command} `this` command for chaining
+   * @param {Option} option
+   * @private
    */
-  addHelpText(position, text) {
-    const allowedValues = ["beforeAll", "before", "after", "afterAll"];
-    if (!allowedValues.includes(position)) {
-      throw new Error(`Unexpected value for position to addHelpText.
-Expecting one of '${allowedValues.join("', '")}'`);
-    }
-    const helpEvent = `${position}Help`;
-    this.on(helpEvent, (context) => {
-      let helpStr;
-      if (typeof text === "function") {
-        helpStr = text({ error: context.error, command: context.command });
-      } else {
-        helpStr = text;
-      }
-      if (helpStr) {
-        context.write(`${helpStr}
-`);
-      }
-    });
-    return this;
+  missingMandatoryOptionValue(option) {
+    const message2 = `error: required option '${option.flags}' not specified`;
+    this.error(message2, { code: "commander.missingMandatoryOptionValue" });
   }
   /**
-   * Output help information if help flags specified
+   * `Option` conflicts with another option.
    *
-   * @param {Array} args - array of options to search for help flags
+   * @param {Option} option
+   * @param {Option} conflictingOption
    * @private
    */
-  _outputHelpIfRequested(args) {
-    const helpOption = this._getHelpOption();
-    const helpRequested = helpOption && args.find((arg) => helpOption.is(arg));
-    if (helpRequested) {
-      this.outputHelp();
-      this._exit(0, "commander.helpDisplayed", "(outputHelp)");
-    }
-  }
-};
-function incrementNodeInspectorPort(args) {
-  return args.map((arg) => {
-    if (!arg.startsWith("--inspect")) {
-      return arg;
-    }
-    let debugOption;
-    let debugHost = "127.0.0.1";
-    let debugPort = "9229";
-    let match;
-    if ((match = arg.match(/^(--inspect(-brk)?)$/)) !== null) {
-      debugOption = match[1];
-    } else if ((match = arg.match(/^(--inspect(-brk|-port)?)=([^:]+)$/)) !== null) {
-      debugOption = match[1];
-      if (/^\d+$/.test(match[3])) {
-        debugPort = match[3];
-      } else {
-        debugHost = match[3];
+  _conflictingOption(option, conflictingOption) {
+    const findBestOptionFromValue = (option2) => {
+      const optionKey = option2.attributeName();
+      const optionValue = this.getOptionValue(optionKey);
+      const negativeOption = this.options.find(
+        (target) => target.negate && optionKey === target.attributeName()
+      );
+      const positiveOption = this.options.find(
+        (target) => !target.negate && optionKey === target.attributeName()
+      );
+      if (negativeOption && (negativeOption.presetArg === void 0 && optionValue === false || negativeOption.presetArg !== void 0 && optionValue === negativeOption.presetArg)) {
+        return negativeOption;
       }
-    } else if ((match = arg.match(/^(--inspect(-brk|-port)?)=([^:]+):(\d+)$/)) !== null) {
-      debugOption = match[1];
-      debugHost = match[3];
-      debugPort = match[4];
-    }
-    if (debugOption && debugPort !== "0") {
-      return `${debugOption}=${debugHost}:${parseInt(debugPort) + 1}`;
-    }
-    return arg;
-  });
-}
-function useColor() {
-  if (import_node_process.default.env.NO_COLOR || import_node_process.default.env.FORCE_COLOR === "0" || import_node_process.default.env.FORCE_COLOR === "false")
-    return false;
-  if (import_node_process.default.env.FORCE_COLOR || import_node_process.default.env.CLICOLOR_FORCE !== void 0)
-    return true;
-  return void 0;
-}
-
-// node_modules/commander/index.js
-var program = new Command();
-
-// src/command-composition.ts
-var import_node_fs48 = require("node:fs");
-
-// src/clean-exit.ts
-var UNDICI_GLOBAL_DISPATCHER_SYMBOL = Object.getOwnPropertySymbols(globalThis).find(
-  (s) => s.description === "undici.globalDispatcher.1" || s.description?.startsWith("undici.globalDispatcher.")
-) ?? /* @__PURE__ */ Symbol.for("undici.globalDispatcher.1");
-function globalDispatcher() {
-  return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL];
-}
-function destroyHttpPool() {
-  try {
-    const dispatcher = globalDispatcher();
-    if (dispatcher?.destroy) {
-      void dispatcher.destroy();
-      return true;
-    }
-  } catch {
-  }
-  return false;
-}
-var closingDispatcher;
-var closingDispatcherPromise;
-async function closeHttpPool() {
-  const dispatcher = globalDispatcher();
-  if (!dispatcher) return;
-  if (dispatcher === closingDispatcher && closingDispatcherPromise) {
-    await closingDispatcherPromise;
-    return;
-  }
-  closingDispatcher = dispatcher;
-  closingDispatcherPromise = (async () => {
-    try {
-      if (dispatcher.close) await dispatcher.close();
-      else if (dispatcher.destroy) await dispatcher.destroy();
-    } catch {
-      try {
-        if (dispatcher.destroy) await dispatcher.destroy();
-      } catch {
+      return positiveOption || option2;
+    };
+    const getErrorMessage = (option2) => {
+      const bestOption = findBestOptionFromValue(option2);
+      const optionKey = bestOption.attributeName();
+      const source = this.getOptionValueSource(optionKey);
+      if (source === "env") {
+        return `environment variable '${bestOption.envVar}'`;
       }
-    }
-  })();
-  await closingDispatcherPromise;
-}
-function hardExit(code) {
-  destroyHttpPool();
-  process.exit(code);
-}
-var STDIO_FLUSH_TIMEOUT_MS = 2e3;
-function flushStream(stream) {
-  return new Promise((resolve7) => {
-    try {
-      stream.write("", () => resolve7());
-    } catch {
-      resolve7();
-    }
-  });
-}
-async function flushStdio(timeoutMs = STDIO_FLUSH_TIMEOUT_MS) {
-  await Promise.race([
-    Promise.all([flushStream(process.stdout), flushStream(process.stderr)]),
-    new Promise((resolve7) => {
-      setTimeout(resolve7, timeoutMs).unref?.();
-    })
-  ]);
-}
-async function cleanExit(code) {
-  process.exitCode = code;
-  await closeHttpPool();
-  await flushStdio();
-  await new Promise((resolve7) => setImmediate(resolve7));
-  return void 0;
-}
-var CLI_EXIT_WATCHDOG_MS = (() => {
-  const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS);
-  return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;
-})();
-async function finishCliRun(watchdogMs = CLI_EXIT_WATCHDOG_MS) {
-  const timer = setTimeout(() => {
-    console.error(
-      `mmi-cli: command finished but the process did not exit within ${watchdogMs}ms \u2014 a handle leaked (${describeActiveHandles()}); forcing exit (#2904). Please report this.`
-    );
-    void flushStdio().finally(() => process.exit(typeof process.exitCode === "number" ? process.exitCode : 0));
-  }, watchdogMs);
-  timer.unref?.();
-  await closeHttpPool();
-}
-function describeActiveHandles() {
-  let summary;
-  try {
-    const counts = /* @__PURE__ */ new Map();
-    for (const type of process.getActiveResourcesInfo()) counts.set(type, (counts.get(type) ?? 0) + 1);
-    summary = [...counts.entries()].sort().map(([type, n]) => n > 1 ? `${type}\xD7${n}` : type).join(", ") || "none reported";
-  } catch {
-    summary = "unavailable";
-  }
-  try {
-    const children = (process._getActiveHandles?.() ?? []).filter((h) => h?.constructor?.name === "ChildProcess").map((h) => `${h.spawnfile ?? "?"}(pid=${h.pid ?? "?"})`);
-    if (children.length) summary += `; live children: ${children.join(", ")}`;
-  } catch {
-  }
-  return summary;
-}
-async function failGraceful(msg) {
-  console.error(`mmi-cli ${msg}`);
-  return cleanExit(1);
-}
-
-// src/cli-shared.ts
-var import_node_child_process2 = require("node:child_process");
-var import_node_fs5 = require("node:fs");
-var import_node_util3 = require("node:util");
-
-// src/hub-url.ts
-var DEFAULT_HUB_URL = "https://tqxxwzftic.execute-api.eu-central-1.amazonaws.com";
-function defaultHubUrl() {
-  return process.env.MMI_HUB_URL || DEFAULT_HUB_URL;
-}
-
-// src/client-version.ts
-var import_node_fs2 = require("node:fs");
-var import_node_path2 = require("node:path");
-
-// ../infra/compat.mjs
-var CLIENT_VERSION_HEADER = "x-client-version";
-function parseSemver(s) {
-  if (typeof s !== "string") return null;
-  const m = /^(\d+)\.(\d+)\.(\d+)(?:[-+]|$)/.exec(s.trim());
-  if (!m) return null;
-  return { major: Number(m[1]), minor: Number(m[2]), patch: Number(m[3]) };
-}
-function versionAtLeast(v, min) {
-  const a = parseSemver(v);
-  const b = parseSemver(min);
-  if (!a || !b) return false;
-  if (a.major !== b.major) return a.major > b.major;
-  if (a.minor !== b.minor) return a.minor > b.minor;
-  return a.patch >= b.patch;
-}
-
-// src/client-version.ts
-function resolveClientVersionManifestCandidates(distDir = __dirname) {
-  return [
-    (0, import_node_path2.join)(distDir, "..", "..", ".claude-plugin", "plugin.json"),
-    (0, import_node_path2.join)(distDir, "..", "package.json")
-  ];
-}
-function readVersionFromManifest(path2) {
-  try {
-    const version = JSON.parse((0, import_node_fs2.readFileSync)(path2, "utf8")).version;
-    return typeof version === "string" && version.trim() ? version.trim() : null;
-  } catch {
-    return null;
-  }
-}
-function resolveClientVersion() {
-  for (const manifest of resolveClientVersionManifestCandidates()) {
-    const version = readVersionFromManifest(manifest);
-    if (version) return version;
-  }
-  return "0.0.0";
-}
-function clientVersionHeaders() {
-  return { [CLIENT_VERSION_HEADER]: resolveClientVersion() };
-}
-function upgradeRequiredError(res, body) {
-  const minVersion = body && typeof body === "object" && typeof body.minVersion === "string" ? body.minVersion : "a newer version";
-  return `Hub requires mmi-cli >= ${minVersion} \u2014 run mmi-cli doctor (installed ${resolveClientVersion()})`;
-}
-
-// src/error-codes.ts
-var ERROR_CODES = {
-  /** A required flag was not supplied (e.g. `issue create` without `--priority`). */
-  ERR_MISSING_FLAG: "ERR_MISSING_FLAG",
-  /** Two mutually-exclusive flags were both supplied (e.g. `--title` with `--title-file`). */
-  ERR_CONFLICTING_FLAGS: "ERR_CONFLICTING_FLAGS",
-  /** A flag was supplied but its resolved value is empty (e.g. an empty `--title-file` or empty stdin). */
-  ERR_EMPTY_INPUT: "ERR_EMPTY_INPUT",
-  /** A supplied value has the right source but an invalid shape (e.g. a title with line breaks). */
-  ERR_INVALID_INPUT: "ERR_INVALID_INPUT",
-  /** A flag's value is outside its allowed set (e.g. `--priority nope`). */
-  ERR_BAD_ENUM: "ERR_BAD_ENUM",
-  /** An unknown flag or subcommand — usually a typo; carries a `did_you_mean`. */
-  ERR_UNKNOWN_FLAG: "ERR_UNKNOWN_FLAG",
-  /** A positional argument was passed to a command that does not take it (e.g. `oracle board read 496`,
-   *  a whole-board read given an issue number). Carries a `corrected_command` when exactly one sibling
-   *  answers the same verb positionally (#6354). */
-  ERR_EXCESS_ARGUMENT: "ERR_EXCESS_ARGUMENT",
-  /** A referenced resource (issue, repo, board item) does not exist. */
-  ERR_NOT_FOUND: "ERR_NOT_FOUND",
-  /** Missing / rejected credentials on a path that needs auth. */
-  ERR_NO_AUTH: "ERR_NO_AUTH",
-  /** The operation partially succeeded (some units done, some failed). */
-  ERR_PARTIAL: "ERR_PARTIAL",
-  /** The request was well-formed and every referent resolved, but the target's CURRENT STATE forbids the
-   *  mutation (HTTP 409 semantics) — e.g. reparenting an issue that already has a parent. Deliberately not
-   *  one code per API constraint: retry is futile until the named state is changed, and that is the fact a
-   *  caller has to act on, whichever rule produced it. */
-  ERR_STATE_CONFLICT: "ERR_STATE_CONFLICT"
-};
-var ERROR_CODE_REFERENCE = [
-  {
-    code: ERROR_CODES.ERR_MISSING_FLAG,
-    meaning: "A required flag was not supplied.",
-    typical_fix: "Run `mmi-cli explain <command>` and retry with the required flag."
-  },
-  {
-    code: ERROR_CODES.ERR_CONFLICTING_FLAGS,
-    meaning: "Two mutually-exclusive flags were supplied together.",
-    typical_fix: "Pass only one of the conflicting flags (see `offending_flag`) and retry."
-  },
-  {
-    code: ERROR_CODES.ERR_EMPTY_INPUT,
-    meaning: "A flag was supplied but resolved to an empty value (e.g. an empty file or empty stdin).",
-    typical_fix: "Provide non-empty content for the flag in `offending_flag` (a file with text, or a real pipe/heredoc for stdin)."
-  },
-  {
-    code: ERROR_CODES.ERR_INVALID_INPUT,
-    meaning: "A supplied value has an invalid shape for the flag.",
-    typical_fix: "Correct the value named by `offending_flag` and retry."
-  },
-  {
-    code: ERROR_CODES.ERR_BAD_ENUM,
-    meaning: "A flag value is outside the allowed enum.",
-    typical_fix: "Use one of the values in `expected`; casing and separators are often normalized by the CLI when supported."
-  },
-  {
-    code: ERROR_CODES.ERR_UNKNOWN_FLAG,
-    meaning: "A flag or subcommand is not known to this CLI version.",
-    typical_fix: "Check `did_you_mean`, route with `mmi-cli commands --json`, then inspect exact detail with `mmi-cli explain <command> --json`; update the CLI if it should exist."
-  },
-  {
-    code: ERROR_CODES.ERR_EXCESS_ARGUMENT,
-    meaning: "A positional argument was supplied to a command that takes none (or fewer).",
-    typical_fix: "Run the command named by `corrected_command`; otherwise drop the extra argument and select the target with the flags in `mmi-cli explain <command> --json`."
-  },
-  {
-    code: ERROR_CODES.ERR_NOT_FOUND,
-    meaning: "The referenced issue, PR, repo, board item, or other resource was not found.",
-    typical_fix: "Verify the identifier and repo, then rerun with an explicit `--repo <owner/repo>` when local repo detection is ambiguous."
-  },
-  {
-    code: ERROR_CODES.ERR_NO_AUTH,
-    meaning: "The command needs credentials that are missing, expired, or rejected.",
-    typical_fix: "Run `mmi-cli doctor --self` or refresh the relevant GitHub/Hub session before retrying."
-  },
-  {
-    code: ERROR_CODES.ERR_PARTIAL,
-    meaning: "A batch operation completed some units and failed others.",
-    typical_fix: "Read the per-unit results, fix the failed inputs, and rerun only the failed units."
-  },
-  {
-    code: ERROR_CODES.ERR_STATE_CONFLICT,
-    meaning: "The request was valid and every referent resolved, but the target resource's current state forbids it.",
-    typical_fix: "A plain retry fails identically. Read the state field the envelope names (e.g. `current_parent`), change that state deliberately with the command that owns it, then retry."
-  }
-];
-function buildErrorEnvelope(message2, payload) {
-  const env = { error_code: payload.code, message: message2 };
-  if (payload.offending_flag !== void 0) env.offending_flag = payload.offending_flag;
-  if (payload.expected !== void 0) env.expected = payload.expected;
-  if (payload.did_you_mean !== void 0) env.did_you_mean = payload.did_you_mean;
-  if (payload.corrected_command !== void 0) env.corrected_command = payload.corrected_command;
-  if (payload.current_parent !== void 0) env.current_parent = payload.current_parent;
-  if (payload.issue_ref !== void 0) env.issue_ref = payload.issue_ref;
-  if (payload.board_status !== void 0) env.board_status = payload.board_status;
-  return env;
-}
-function formatErrorEnvelope(message2, payload) {
-  return JSON.stringify(buildErrorEnvelope(message2, payload));
-}
-function levenshtein(a, b) {
-  if (a === b) return 0;
-  if (a.length === 0) return b.length;
-  if (b.length === 0) return a.length;
-  let prev = Array.from({ length: b.length + 1 }, (_, i) => i);
-  let curr = new Array(b.length + 1);
-  for (let i = 1; i <= a.length; i++) {
-    curr[0] = i;
-    for (let j = 1; j <= b.length; j++) {
-      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
-      curr[j] = Math.min(curr[j - 1] + 1, prev[j] + 1, prev[j - 1] + cost);
-    }
-    [prev, curr] = [curr, prev];
-  }
-  return prev[b.length];
-}
-function didYouMean(input, candidates) {
-  const strip = (s) => s.replace(/^-+/, "");
-  const target = strip(input);
-  if (!target) return void 0;
-  let best;
-  for (const candidate of candidates) {
-    const cand = strip(candidate);
-    if (!cand) continue;
-    if (cand === target) continue;
-    if (cand === `${target}-file` || target === `${cand}-file`) continue;
-    const distance = levenshtein(target, cand);
-    const prefix = cand.startsWith(target) || target.startsWith(cand);
-    const threshold = Math.max(2, Math.ceil(cand.length * 0.4));
-    if (!prefix && distance > threshold) continue;
-    const better = !best || distance < best.distance || distance === best.distance && prefix && !best.prefix;
-    if (better) best = { flag: candidate, distance, prefix };
-  }
-  return best?.flag;
-}
-
-// src/github-client.ts
-function classifyGhTokenExecFailure(e) {
-  const err = e;
-  const stderr = typeof err?.stderr === "string" ? err.stderr.trim() : "";
-  const detail = (stderr || err?.message || String(e)).replace(/\s+/g, " ").slice(0, 200);
-  if (err?.code === "ENOENT") return { state: "absent", detail: "gh is not installed on PATH" };
-  if (err?.killed === true || (err?.signal ?? null) !== null) return { state: "failed", detail: `gh auth token did not complete (${detail})` };
-  if (/not logged (in|into)|no oauth token|authentication token not found|gh auth login/i.test(`${stderr} ${err?.message ?? ""}`)) {
-    return { state: "absent", detail: "gh is installed but not logged in" };
-  }
-  return { state: "failed", detail };
-}
-var cachedGhCliTokenRead;
-async function githubTokenRead() {
-  if (process.env.GH_TOKEN) return { state: "ok", token: process.env.GH_TOKEN };
-  if (process.env.GITHUB_TOKEN) return { state: "ok", token: process.env.GITHUB_TOKEN };
-  cachedGhCliTokenRead ??= execFileP("gh", ["auth", "token"]).then(({ stdout }) => {
-    const token = stdout.trim();
-    return token ? { state: "ok", token } : { state: "absent", detail: "`gh auth token` exited 0 without printing a token" };
-  }).catch((e) => classifyGhTokenExecFailure(e));
-  return cachedGhCliTokenRead;
-}
-async function githubToken() {
-  const read = await githubTokenRead();
-  if (read.state === "failed") {
-    throw new GitHubApiError(
-      `GitHub identity read FAILED: \`gh auth token\` ${read.detail} \u2014 this is NOT "no token", so the call is refused rather than sent anonymously (an anonymous 401/404 would read as a permission or missing-object answer). Retry, or set GH_TOKEN/GITHUB_TOKEN for this process.`,
-      { status: 0 }
-    );
-  }
-  return read.state === "ok" ? read.token : void 0;
-}
-var GitHubApiError = class extends Error {
-  status;
-  stderr;
-  graphqlErrors;
-  /** #4588: true when GitHub refused THIS call for budget (primary or secondary rate limit),
-   *  read from the refusing response itself — never the rate_limit endpoint. */
-  rateLimited;
-  /** Epoch seconds when the exhausted pool resets (`X-Ratelimit-Reset` of the refusing response). */
-  rateLimitReset;
-  constructor(message2, opts = {}) {
-    super(message2);
-    this.name = "GitHubApiError";
-    this.status = opts.status ?? 0;
-    this.stderr = message2;
-    this.graphqlErrors = opts.graphqlErrors;
-    this.rateLimited = opts.rateLimited;
-    this.rateLimitReset = opts.rateLimitReset;
-  }
-};
-function rateLimitResetNote(resetEpochSeconds, now = Date.now()) {
-  if (!resetEpochSeconds) return "rate limit exhausted; reset time unknown";
-  const resetMs = resetEpochSeconds * 1e3;
-  const minutes = Math.max(0, Math.ceil((resetMs - now) / 6e4));
-  return `rate limit exhausted; resets at ${new Date(resetMs).toISOString()} (~${minutes}m)`;
-}
-function rateLimitFromResponse(res, detail) {
-  const remaining = res.headers.get("x-ratelimit-remaining");
-  const resetHeader = res.headers.get("x-ratelimit-reset");
-  const reset = resetHeader && /^\d+$/.test(resetHeader) ? Number(resetHeader) : void 0;
-  const rateLimited = (res.status === 403 || res.status === 429) && remaining === "0" || /rate limit|secondary rate|abuse detection/i.test(detail);
-  return { rateLimited, ...rateLimited && reset !== void 0 ? { rateLimitReset: reset } : {} };
-}
-var DEFAULT_TIMEOUT_MS = 2e4;
-function joinUrl(base, path2) {
-  if (path2.startsWith("http://") || path2.startsWith("https://")) return path2;
-  return `${base.replace(/\/+$/, "")}/${path2.replace(/^\/+/, "")}`;
-}
-function withPerPage(url) {
-  if (/[?&]per_page=/.test(url)) return url;
-  return url.includes("?") ? `${url}&per_page=100` : `${url}?per_page=100`;
-}
-function apiOrigin(baseUrl) {
-  return new URL(baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`).origin;
-}
-function nextLink(linkHeader) {
-  if (!linkHeader) return void 0;
-  for (const part of linkHeader.split(",")) {
-    const match = part.match(/<([^>]+)>\s*;\s*rel="next"/);
-    if (match) return match[1];
+      return `option '${bestOption.flags}'`;
+    };
+    const message2 = `error: ${getErrorMessage(option)} cannot be used with ${getErrorMessage(conflictingOption)}`;
+    this.error(message2, { code: "commander.conflictingOption" });
   }
-  return void 0;
-}
-function safeNextLink(linkHeader, allowedOrigin) {
-  const next = nextLink(linkHeader);
-  if (!next) return void 0;
-  let origin;
-  try {
-    origin = new URL(next).origin;
-  } catch {
-    throw new GitHubApiError(`pagination link rejected: invalid URL (${next})`, { status: 0 });
+  /**
+   * Unknown option `flag`.
+   *
+   * @param {string} flag
+   * @private
+   */
+  unknownOption(flag) {
+    if (this._allowUnknownOption) return;
+    let suggestion = "";
+    if (flag.startsWith("--") && this._showSuggestionAfterError) {
+      let candidateFlags = [];
+      let command = this;
+      do {
+        const moreFlags = command.createHelp().visibleOptions(command).filter((option) => option.long).map((option) => option.long);
+        candidateFlags = candidateFlags.concat(moreFlags);
+        command = command.parent;
+      } while (command && !command._enablePositionalOptions);
+      suggestion = suggestSimilar(flag, candidateFlags);
+    }
+    const message2 = `error: unknown option '${flag}'${suggestion}`;
+    this.error(message2, { code: "commander.unknownOption" });
   }
-  if (origin !== allowedOrigin) {
-    throw new GitHubApiError(`pagination link rejected: cross-origin ${origin} (expected ${allowedOrigin})`, { status: 0 });
+  /**
+   * Excess arguments, more than expected.
+   *
+   * @param {string[]} receivedArgs
+   * @private
+   */
+  _excessArguments(receivedArgs) {
+    if (this._allowExcessArguments) return;
+    const expected = this.registeredArguments.length;
+    const s = expected === 1 ? "" : "s";
+    const received = receivedArgs.length;
+    const forSubcommand = this.parent ? ` for '${this.name()}'` : "";
+    const details = receivedArgs.join(", ");
+    const message2 = `error: too many arguments${forSubcommand}. Expected ${expected} argument${s} but got ${received}: ${details}.`;
+    this.error(message2, { code: "commander.excessArguments" });
   }
-  return next;
-}
-async function errorFromResponse(res) {
-  let detail = "";
-  try {
-    const text = await res.text();
-    try {
-      const parsed = JSON.parse(text);
-      detail = parsed.message ?? text;
-    } catch {
-      detail = text;
+  /**
+   * Unknown command.
+   *
+   * @private
+   */
+  unknownCommand() {
+    const unknownName = this.args[0];
+    let suggestion = "";
+    if (this._showSuggestionAfterError) {
+      const candidateNames = [];
+      this.createHelp().visibleCommands(this).forEach((command) => {
+        candidateNames.push(command.name());
+        if (command.alias()) candidateNames.push(command.alias());
+      });
+      suggestion = suggestSimilar(unknownName, candidateNames);
     }
-  } catch {
-    detail = "";
+    const message2 = `error: unknown command '${unknownName}'${suggestion}`;
+    this.error(message2, { code: "commander.unknownCommand" });
   }
-  const suffix = detail ? `: ${detail.trim()}` : "";
-  const limit = rateLimitFromResponse(res, detail);
-  const budgetNote = limit.rateLimited ? ` \u2014 ${rateLimitResetNote(limit.rateLimitReset)}` : "";
-  return new GitHubApiError(`HTTP ${res.status}${suffix}${budgetNote} (${res.url})`, {
-    status: res.status,
-    ...limit.rateLimited ? { rateLimited: true, rateLimitReset: limit.rateLimitReset } : {}
-  });
-}
-function createGitHubClient(options = {}) {
-  const baseUrl = options.baseUrl ?? process.env.GITHUB_API_URL ?? "https://api.github.com";
-  const allowedOrigin = apiOrigin(baseUrl);
-  const token = options.token ?? githubToken;
-  const defaultTimeoutMs = options.defaultTimeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const fetchImpl = options.fetchImpl ?? fetch;
-  const externalSignal = options.signal;
-  async function request(method, url, init = {}) {
-    const t = await token();
-    const headers = {
-      Accept: "application/vnd.github+json",
-      "X-GitHub-Api-Version": "2022-11-28",
-      "User-Agent": "mmi-cli",
-      ...t ? { Authorization: `Bearer ${t}` } : {},
-      ...init.body !== void 0 ? { "Content-Type": "application/json" } : {},
-      ...init.headers
-    };
-    const timeoutSignal = AbortSignal.timeout(init.timeoutMs ?? defaultTimeoutMs);
-    const res = await fetchImpl(url, {
-      method,
-      headers,
-      body: init.body !== void 0 ? JSON.stringify(init.body) : void 0,
-      signal: externalSignal ? AbortSignal.any([externalSignal, timeoutSignal]) : timeoutSignal
+  /**
+   * Get or set the program version.
+   *
+   * This method auto-registers the "-V, --version" option which will print the version number.
+   *
+   * You can optionally supply the flags and description to override the defaults.
+   *
+   * @param {string} [str]
+   * @param {string} [flags]
+   * @param {string} [description]
+   * @return {(this | string | undefined)} `this` command for chaining, or version string if no arguments
+   */
+  version(str, flags, description) {
+    if (str === void 0) return this._version;
+    this._version = str;
+    flags = flags || "-V, --version";
+    description = description || "output the version number";
+    const versionOption = this.createOption(flags, description);
+    this._versionOptionName = versionOption.attributeName();
+    this._registerOption(versionOption);
+    this.on("option:" + versionOption.name(), () => {
+      this._outputConfiguration.writeOut(`${str}
+`);
+      this._exit(0, "commander.version", str);
     });
-    if (!res.ok) throw await errorFromResponse(res);
-    return res;
+    return this;
   }
-  async function parseJson2(res) {
-    if (res.status === 204) return void 0;
-    const text = await res.text();
-    if (!text) return void 0;
-    return JSON.parse(text);
+  /**
+   * Set the description.
+   *
+   * @param {string} [str]
+   * @param {object} [argsDescription]
+   * @return {(string|Command)}
+   */
+  description(str, argsDescription) {
+    if (str === void 0 && argsDescription === void 0)
+      return this._description;
+    this._description = str;
+    if (argsDescription) {
+      this._argsDescription = argsDescription;
+    }
+    return this;
   }
-  return {
-    async rest(method, path2, init) {
-      const res = await request(method, joinUrl(baseUrl, path2), init);
-      return parseJson2(res);
-    },
-    async restPaginate(path2, init) {
-      const items = [];
-      let url = withPerPage(joinUrl(baseUrl, path2));
-      while (url) {
-        const res = await request("GET", url, init);
-        const page = await parseJson2(res);
-        if (!Array.isArray(page)) {
-          throw new GitHubApiError(
-            `pagination page was not a JSON array (got ${page === void 0 ? "an empty body" : typeof page}) \u2014 the list read is PARTIAL and must not be treated as complete: ${url}. Retry the call.`,
-            { status: res.status }
-          );
-        }
-        items.push(...page);
-        url = safeNextLink(res.headers.get("link"), allowedOrigin);
-      }
-      return items;
-    },
-    async graphql(query, variables, init) {
-      const res = await request("POST", joinUrl(baseUrl, "graphql"), {
-        ...init,
-        body: { query, ...variables ? { variables } : {} }
-      });
-      const parsed = await parseJson2(res);
-      if (parsed?.errors?.length) {
-        const message2 = parsed.errors.map((e) => e.message ?? e.type ?? "unknown GraphQL error").join("; ");
-        const rateLimited = parsed.errors.some((e) => e.type === "RATE_LIMITED" || /rate limit/i.test(e.message ?? ""));
-        if (rateLimited) {
-          const resetHeader = res.headers.get("x-ratelimit-reset");
-          const reset = resetHeader && /^\d+$/.test(resetHeader) ? Number(resetHeader) : void 0;
-          throw new GitHubApiError(`GraphQL: ${message2} \u2014 GraphQL ${rateLimitResetNote(reset)}; REST may still have headroom`, {
-            status: 200,
-            graphqlErrors: parsed.errors,
-            rateLimited: true,
-            rateLimitReset: reset
-          });
-        }
-        throw new GitHubApiError(`GraphQL: ${message2}`, { status: 200, graphqlErrors: parsed.errors });
-      }
-      if (!parsed || parsed.data === void 0 || parsed.data === null) {
-        throw new GitHubApiError("GraphQL response did not include data", { status: 200 });
-      }
-      return parsed.data;
+  /**
+   * Set the summary. Used when listed as subcommand of parent.
+   *
+   * @param {string} [str]
+   * @return {(string|Command)}
+   */
+  summary(str) {
+    if (str === void 0) return this._summary;
+    this._summary = str;
+    return this;
+  }
+  /**
+   * Set an alias for the command.
+   *
+   * You may call more than once to add multiple aliases. Only the first alias is shown in the auto-generated help.
+   *
+   * @param {string} [alias]
+   * @return {(string|Command)}
+   */
+  alias(alias) {
+    if (alias === void 0) return this._aliases[0];
+    let command = this;
+    if (this.commands.length !== 0 && this.commands[this.commands.length - 1]._executableHandler) {
+      command = this.commands[this.commands.length - 1];
     }
-  };
-}
-var cachedDefaultClient;
-function defaultGitHubClient() {
-  cachedDefaultClient ??= createGitHubClient();
-  return cachedDefaultClient;
-}
-
-// src/hub-auth.ts
-var import_node_crypto = require("node:crypto");
-var import_node_fs3 = require("node:fs");
-var import_node_path3 = require("node:path");
-var import_node_os = require("node:os");
-
-// src/fetch-retry.ts
-async function fetchWithRetry(fetchImpl, url, init, opts = {}) {
-  const attempts = opts.attempts ?? 3;
-  const baseDelayMs = opts.baseDelayMs ?? 250;
-  const retryOn = opts.retryOn ?? ((res) => res.status >= 500);
-  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
-  let lastErr;
-  for (let i = 0; i < attempts; i++) {
-    const isLast = i === attempts - 1;
-    const attemptInit = opts.timeoutMs ? { ...init, signal: AbortSignal.timeout(opts.timeoutMs) } : init;
-    try {
-      const res = await fetchImpl(url, attemptInit);
-      if (!isLast && retryOn(res)) {
-        await sleep2(baseDelayMs * 2 ** i);
-        continue;
-      }
-      return res;
-    } catch (e) {
-      lastErr = e;
-      if (isLast) throw e;
-      await sleep2(baseDelayMs * 2 ** i);
+    if (alias === command._name)
+      throw new Error("Command alias can't be the same as its name");
+    const matchingCommand = this.parent?._findCommand(alias);
+    if (matchingCommand) {
+      const existingCmd = [matchingCommand.name()].concat(matchingCommand.aliases()).join("|");
+      throw new Error(
+        `cannot add alias '${alias}' to command '${this.name()}' as already have command '${existingCmd}'`
+      );
+    }
+    command._aliases.push(alias);
+    return this;
+  }
+  /**
+   * Set aliases for the command.
+   *
+   * Only the first alias is shown in the auto-generated help.
+   *
+   * @param {string[]} [aliases]
+   * @return {(string[]|Command)}
+   */
+  aliases(aliases) {
+    if (aliases === void 0) return this._aliases;
+    aliases.forEach((alias) => this.alias(alias));
+    return this;
+  }
+  /**
+   * Set / get the command usage `str`.
+   *
+   * @param {string} [str]
+   * @return {(string|Command)}
+   */
+  usage(str) {
+    if (str === void 0) {
+      if (this._usage) return this._usage;
+      const args = this.registeredArguments.map((arg) => {
+        return humanReadableArgName(arg);
+      });
+      return [].concat(
+        this.options.length || this._helpOption !== null ? "[options]" : [],
+        this.commands.length ? "[command]" : [],
+        this.registeredArguments.length ? args : []
+      ).join(" ");
     }
+    this._usage = str;
+    return this;
   }
-  throw lastErr;
-}
-
-// src/hub-auth.ts
-var REFRESH_WINDOW_MS = 10 * 60 * 1e3;
-var EXCHANGE_TIMEOUT_MS = 8e3;
-var EXCHANGE_ATTEMPTS = 2;
-function normalizeBaseUrl(baseUrl) {
-  return baseUrl.replace(/\/$/, "");
-}
-function tokenFingerprint(token) {
-  return (0, import_node_crypto.createHash)("sha256").update(token).digest("hex");
-}
-function defaultHubSessionCachePath(env = process.env) {
-  if (env.MMI_HUB_SESSION_CACHE) return env.MMI_HUB_SESSION_CACHE;
-  if (process.platform === "win32") {
-    const base2 = env.LOCALAPPDATA || (0, import_node_path3.join)((0, import_node_os.homedir)(), "AppData", "Local");
-    return (0, import_node_path3.join)(base2, "MMI Future", "mmi-cli", "hub-session.json");
+  /**
+   * Get or set the name of the command.
+   *
+   * @param {string} [str]
+   * @return {(string|Command)}
+   */
+  name(str) {
+    if (str === void 0) return this._name;
+    this._name = str;
+    return this;
   }
-  const base = env.XDG_STATE_HOME || (0, import_node_path3.join)((0, import_node_os.homedir)(), ".local", "state");
-  return (0, import_node_path3.join)(base, "mmi-cli", "hub-session.json");
-}
-function roleFromToken(token) {
-  const part = token?.split(".")[1];
-  if (!part) return void 0;
-  try {
-    const claims = JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
-    return claims.role === "owner" ? "owner" : void 0;
-  } catch {
-    return void 0;
+  /**
+   * Set/get the help group heading for this subcommand in parent command's help.
+   *
+   * @param {string} [heading]
+   * @return {Command | string}
+   */
+  helpGroup(heading) {
+    if (heading === void 0) return this._helpGroupHeading ?? "";
+    this._helpGroupHeading = heading;
+    return this;
   }
-}
-function readCache(path2, apiUrl, now, githubTokenFingerprint) {
-  try {
-    const session = JSON.parse((0, import_node_fs3.readFileSync)(path2, "utf8"));
-    if (!session.token || !session.expiresAt || session.apiUrl !== apiUrl) return null;
-    if (session.githubTokenFingerprint !== githubTokenFingerprint) return null;
-    if (new Date(session.expiresAt).getTime() <= now.getTime() + REFRESH_WINDOW_MS) return null;
-    return { ...session, role: roleFromToken(session.token) };
-  } catch {
-    return null;
+  /**
+   * Set/get the default help group heading for subcommands added to this command.
+   * (This does not override a group set directly on the subcommand using .helpGroup().)
+   *
+   * @example
+   * program.commandsGroup('Development Commands:);
+   * program.command('watch')...
+   * program.command('lint')...
+   * ...
+   *
+   * @param {string} [heading]
+   * @returns {Command | string}
+   */
+  commandsGroup(heading) {
+    if (heading === void 0) return this._defaultCommandGroup ?? "";
+    this._defaultCommandGroup = heading;
+    return this;
   }
-}
-function writeCache(path2, session) {
-  (0, import_node_fs3.mkdirSync)((0, import_node_path3.dirname)(path2), { recursive: true });
-  const tmp = `${path2}.${process.pid}.${Date.now()}.tmp`;
-  (0, import_node_fs3.writeFileSync)(tmp, JSON.stringify(session, null, 2) + "\n", { encoding: "utf8", mode: 384 });
-  try {
-    (0, import_node_fs3.chmodSync)(tmp, 384);
-  } catch {
+  /**
+   * Set/get the default help group heading for options added to this command.
+   * (This does not override a group set directly on the option using .helpGroup().)
+   *
+   * @example
+   * program
+   *   .optionsGroup('Development Options:')
+   *   .option('-d, --debug', 'output extra debugging')
+   *   .option('-p, --profile', 'output profiling information')
+   *
+   * @param {string} [heading]
+   * @returns {Command | string}
+   */
+  optionsGroup(heading) {
+    if (heading === void 0) return this._defaultOptionGroup ?? "";
+    this._defaultOptionGroup = heading;
+    return this;
   }
-  (0, import_node_fs3.renameSync)(tmp, path2);
-  try {
-    (0, import_node_fs3.chmodSync)(path2, 384);
-  } catch {
+  /**
+   * @param {Option} option
+   * @private
+   */
+  _initOptionGroup(option) {
+    if (this._defaultOptionGroup && !option.helpGroupHeading)
+      option.helpGroup(this._defaultOptionGroup);
   }
-}
-async function hubAuthSession(deps) {
-  if (!deps.baseUrl) return void 0;
-  const apiUrl = normalizeBaseUrl(deps.baseUrl);
-  const envToken = process.env.MMI_HUB_TOKEN;
-  if (envToken) {
-    return { ...{ token: envToken }, expiresAt: new Date(Date.now() + 30 * 60 * 1e3).toISOString(), apiUrl, githubTokenFingerprint: "env-override" };
+  /**
+   * @param {Command} cmd
+   * @private
+   */
+  _initCommandGroup(cmd) {
+    if (this._defaultCommandGroup && !cmd.helpGroup())
+      cmd.helpGroup(this._defaultCommandGroup);
   }
-  const now = deps.now?.() ?? /* @__PURE__ */ new Date();
-  const cachePath = deps.cachePath ?? defaultHubSessionCachePath();
-  const ghToken = await deps.githubToken();
-  if (!ghToken) return void 0;
-  const githubTokenFingerprint = tokenFingerprint(ghToken);
-  const cached = readCache(cachePath, apiUrl, now, githubTokenFingerprint);
-  if (cached) return cached;
-  try {
-    const res = await fetchWithRetry(
-      deps.fetch ?? fetch,
-      `${apiUrl}/auth/session`,
-      { method: "POST", headers: { ...clientVersionHeaders(), Authorization: `Bearer ${ghToken}` } },
-      { attempts: EXCHANGE_ATTEMPTS, timeoutMs: EXCHANGE_TIMEOUT_MS }
-    );
-    if (!res.ok) return void 0;
-    const body = await res.json();
-    if (!body.token || !body.expiresAt) return void 0;
-    const session = {
-      token: body.token,
-      expiresAt: body.expiresAt,
-      login: typeof body.login === "string" ? body.login : void 0,
-      // #3513: from the SIGNED token, not the response body — one rule at every hop, so the cache
-      // read and the network read cannot disagree about what counts as an assertion.
-      role: roleFromToken(body.token),
-      apiUrl,
-      githubTokenFingerprint
-    };
-    try {
-      writeCache(cachePath, session);
-    } catch {
-    }
-    return session;
-  } catch {
-    return void 0;
+  /**
+   * Set the name of the command from script filename, such as process.argv[1],
+   * or import.meta.filename.
+   *
+   * (Used internally and public although not documented in README.)
+   *
+   * @example
+   * program.nameFromFilename(import.meta.filename);
+   *
+   * @param {string} filename
+   * @return {Command}
+   */
+  nameFromFilename(filename) {
+    this._name = import_node_path.default.basename(filename, import_node_path.default.extname(filename));
+    return this;
   }
-}
-async function hubAuthToken(deps) {
-  return (await hubAuthSession(deps))?.token;
-}
-
-// src/house-map.ts
-var HOUSE_ROOTS = ["oracle", "harbour", "devops", "vault", "learning"];
-function isHouseRoot(token) {
-  return HOUSE_ROOTS.includes(token);
-}
-var COMPAT_SHIM_DEATH_WAVE = "Wave 3";
-var FLAT_ALIAS_CUT_NOTE = `flat Wave 0 alias \u2014 removed in ${COMPAT_SHIM_DEATH_WAVE} (#4316, #4438); only the canonical house-prefixed path parses`;
-var HOUSE_QUESTIONS = {
-  oracle: "Is it live?",
-  harbour: "Is it bounded?",
-  devops: "Is it legal?",
-  vault: "Is it guarded?",
-  learning: "Did it learn?",
-  core: "Is it one door?"
-};
-var HOUSE_MAP = {
-  // --- oracle — live truth ------------------------------------------------------------------------
-  board: "oracle",
-  // board management (read + the guarded mutations that keep it live)
-  issue: "oracle",
-  // issues are live org truth
-  wave: "oracle",
-  // read-side multi-worktree board visibility (`wave status`)
-  next: "oracle",
-  // read-side board: the next actionable item
-  docs: "oracle",
-  // generated docs surfaces — the live org knowledge routing index
-  org: "oracle",
-  // org projects/registry/access reads (subgroup overrides below)
-  "org project": "oracle",
-  // registry projections (declared + projected live truth)
-  "org access": "oracle",
-  // org access role/audit reads
-  "org config": "oracle",
-  // live org configuration read
-  // --- harbour — declared lanes -------------------------------------------------------------------
-  "org schedules": "harbour",
-  // register/run/park schedule rows under the one lane contract
-  // --- devops — shipping --------------------------------------------------------------------------
-  pr: "devops",
-  ci: "devops",
-  // the CI/gate audit
-  rcand: "devops",
-  release: "devops",
-  hotfix: "devops",
-  train: "devops",
-  "wave land": "devops",
-  // the write-side serial merge train is shipping, not board observation
-  bootstrap: "devops",
-  // repo provisioning + propagate
-  runtime: "devops",
-  // tenant/deploy/box/edge — shipping and central deploy
-  "org rules": "devops",
-  // org-managed repository rule delivery (.gitignore)
-  // --- vault — secrets ----------------------------------------------------------------------------
-  secrets: "vault",
-  "org oauth": "vault",
-  // OAuth credential planning/set/verify
-  // --- learning — self-improvement ----------------------------------------------------------------
-  report: "learning",
-  // friction reports
-  "skill-lesson": "learning",
-  "closure-rate": "learning",
-  // closure rate per loop kind, computed at read (#4440)
-  pickup: "learning",
-  // cloud-agent adoption gate (#5708)
-  // --- core — the front door itself ---------------------------------------------------------------
-  commands: "core",
-  whoami: "core",
-  spawn: "core",
-  // this repo's process-spawn contract
-  tests: "core",
-  // this repo's test-policy contract
-  dist: "core",
-  // this repo's committed dist/BOM drift receipt (#5576)
-  doctor: "core",
-  stage: "core",
-  plugin: "core",
-  // plugin lifecycle + guards (CLI house owns plugins)
-  explain: "core",
-  // command-surface help
-  status: "core",
-  // repo-orientation snapshot (front door — torn toward oracle, kept core)
-  onboard: "core"
-  // repo-readiness orientation (front door — torn toward oracle, kept core)
-};
-var HOUSE_ALIASES = {
-  issue: ["devops"],
-  // filing/managing issues is oracle, but reads as shipping work
-  "issue create": ["devops"]
-};
-function isDeclaredHouseAlias(houseToken, lookupPath) {
-  const segments = lookupPath.split(" ");
-  for (let end = segments.length; end > 0; end -= 1) {
-    const key = segments.slice(0, end).join(" ");
-    const aliases = HOUSE_ALIASES[key];
-    if (aliases) return aliases.includes(houseToken);
+  /**
+   * Get or set the directory for searching for executable subcommands of this command.
+   *
+   * @example
+   * program.executableDir(import.meta.dirname);
+   * // or
+   * program.executableDir('subcommands');
+   *
+   * @param {string} [path]
+   * @return {(string|null|Command)}
+   */
+  executableDir(path2) {
+    if (path2 === void 0) return this._executableDir;
+    this._executableDir = path2;
+    return this;
   }
-  return false;
-}
-function houseForPath(path2) {
-  if (path2 === "") return "core";
-  const segments = path2.split(" ");
-  for (let end = segments.length; end > 0; end -= 1) {
-    const key = segments.slice(0, end).join(" ");
-    const house = HOUSE_MAP[key];
-    if (house) return house;
+  /**
+   * Return program help documentation.
+   *
+   * @param {{ error: boolean }} [contextOptions] - pass {error:true} to wrap for stderr instead of stdout
+   * @return {string}
+   */
+  helpInformation(contextOptions) {
+    const helper = this.createHelp();
+    const context = this._getOutputContext(contextOptions);
+    helper.prepareContext({
+      error: context.error,
+      helpWidth: context.helpWidth,
+      outputHasColors: context.hasColors
+    });
+    const text = helper.formatHelp(this, helper);
+    if (context.hasColors) return text;
+    return this._outputConfiguration.stripColor(text);
   }
-  return void 0;
-}
-function canonicalPathFor(path2) {
-  const house = houseForPath(path2);
-  if (!house) return void 0;
-  return house === "core" ? path2 : `${house} ${path2}`;
-}
-function canonicalArgvFor(args) {
-  const lookup = args.filter((tok) => !tok.startsWith("-")).slice(0, 2).join(" ");
-  const house = houseForPath(lookup);
-  return house && house !== "core" ? [house, ...args] : args;
-}
-
-// src/stdin-inject.ts
-var import_node_fs4 = require("node:fs");
-var injectedStdin;
-function stdinHasPipedInput(statFd = () => (0, import_node_fs4.fstatSync)(0), getIsTTY = () => process.stdin.isTTY) {
-  try {
-    const stat4 = statFd();
-    if (stat4.isFIFO() || stat4.isFile()) return true;
-    if (stat4.isCharacterDevice()) return false;
-    if (stat4.isSocket()) return false;
-    if (getIsTTY() === true) return false;
-    return true;
-  } catch {
-    return false;
+  /**
+   * @typedef HelpContext
+   * @type {object}
+   * @property {boolean} error
+   * @property {number} helpWidth
+   * @property {boolean} hasColors
+   * @property {function} write - includes stripColor if needed
+   *
+   * @returns {HelpContext}
+   * @private
+   */
+  _getOutputContext(contextOptions) {
+    contextOptions = contextOptions || {};
+    const error = !!contextOptions.error;
+    let baseWrite;
+    let hasColors;
+    let helpWidth;
+    if (error) {
+      baseWrite = (str) => this._outputConfiguration.writeErr(str);
+      hasColors = this._outputConfiguration.getErrHasColors();
+      helpWidth = this._outputConfiguration.getErrHelpWidth();
+    } else {
+      baseWrite = (str) => this._outputConfiguration.writeOut(str);
+      hasColors = this._outputConfiguration.getOutHasColors();
+      helpWidth = this._outputConfiguration.getOutHelpWidth();
+    }
+    const write = (str) => {
+      if (!hasColors) str = this._outputConfiguration.stripColor(str);
+      return baseWrite(str);
+    };
+    return { error, write, hasColors, helpWidth };
   }
-}
-var STDIN_MAX_BYTES = 8 * 1024 * 1024;
-var STDIN_DRAIN_TIMEOUT_MS = 5e3;
-async function readStdin(opts = {}) {
-  if (injectedStdin !== void 0) return injectedStdin;
-  if (!stdinHasPipedInput()) return "";
-  const maxBytes = opts.maxBytes ?? STDIN_MAX_BYTES;
-  const timeoutMs = opts.timeoutMs ?? STDIN_DRAIN_TIMEOUT_MS;
-  const chunks = [];
-  let total = 0;
-  const drain = (async () => {
-    for await (const chunk of process.stdin) {
-      const buf = chunk;
-      const room = maxBytes - total;
-      if (buf.length >= room) {
-        chunks.push(buf.subarray(0, room));
-        total = maxBytes;
-        break;
+  /**
+   * Output help information for this command.
+   *
+   * Outputs built-in help, and custom text added using `.addHelpText()`.
+   *
+   * @param {{ error: boolean } | Function} [contextOptions] - pass {error:true} to write to stderr instead of stdout
+   */
+  outputHelp(contextOptions) {
+    let deprecatedCallback;
+    if (typeof contextOptions === "function") {
+      deprecatedCallback = contextOptions;
+      contextOptions = void 0;
+    }
+    const outputContext = this._getOutputContext(contextOptions);
+    const eventContext = {
+      error: outputContext.error,
+      write: outputContext.write,
+      command: this
+    };
+    this._getCommandAndAncestors().reverse().forEach((command) => command.emit("beforeAllHelp", eventContext));
+    this.emit("beforeHelp", eventContext);
+    let helpInformation = this.helpInformation({ error: outputContext.error });
+    if (deprecatedCallback) {
+      helpInformation = deprecatedCallback(helpInformation);
+      if (typeof helpInformation !== "string" && !Buffer.isBuffer(helpInformation)) {
+        throw new Error("outputHelp callback must return a string or a Buffer");
       }
-      chunks.push(buf);
-      total += buf.length;
     }
-  })().catch(() => {
-  });
-  let timer;
-  const timeout = new Promise((resolve7) => {
-    timer = setTimeout(resolve7, timeoutMs);
-  });
-  try {
-    await Promise.race([drain, timeout]);
-  } finally {
-    if (timer) clearTimeout(timer);
-    try {
-      process.stdin.unref();
-    } catch {
+    outputContext.write(helpInformation);
+    if (this._getHelpOption()?.long) {
+      this.emit(this._getHelpOption().long);
     }
-  }
-  return Buffer.concat(chunks).toString("utf8");
-}
-
-// src/cli-shared.ts
-var rawExecFileP = (0, import_node_util3.promisify)(import_node_child_process2.execFile);
-var DEFAULT_EXEC_TIMEOUT_MS = 1e4;
-var execFileP = (file, args, options = {}) => (
-  // encoding 'utf8' guarantees string stdout/stderr at runtime; the cast pins the type because
-  // promisify(execFile)'s overloads widen to string|Buffer when options is spread in.
-  rawExecFileP(file, args, { encoding: "utf8", windowsHide: true, timeout: DEFAULT_EXEC_TIMEOUT_MS, killSignal: "SIGTERM", ...options })
-);
-var GIT_TIMEOUT_MS = DEFAULT_EXEC_TIMEOUT_MS;
-var ExecDeadlineError = class extends Error {
-  constructor(step, timeoutMs, elapsedMs, killed) {
-    super(
-      `\`${step}\` did not finish within ${Math.round(timeoutMs / 1e3)}s (gave up after ${Math.round(elapsedMs / 1e3)}s). It stopped responding and did not exit when asked to, so the timeout alone could not end it; ${killed ? "its process tree was force-terminated" : "its process tree could NOT be terminated and may still be running"}.`
+    this.emit("afterHelp", eventContext);
+    this._getCommandAndAncestors().forEach(
+      (command) => command.emit("afterAllHelp", eventContext)
     );
-    this.step = step;
-    this.timeoutMs = timeoutMs;
-    this.elapsedMs = elapsedMs;
-    this.killed = killed;
-    this.name = "ExecDeadlineError";
-  }
-  step;
-  timeoutMs;
-  elapsedMs;
-  killed;
-};
-function killProcessTree(pid) {
-  try {
-    if (process.platform === "win32") {
-      (0, import_node_child_process2.execFileSync)("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true });
-    } else {
-      process.kill(pid, "SIGKILL");
+  }
+  /**
+   * You can pass in flags and a description to customise the built-in help option.
+   * Pass in false to disable the built-in help option.
+   *
+   * @example
+   * program.helpOption('-?, --help' 'show help'); // customise
+   * program.helpOption(false); // disable
+   *
+   * @param {(string | boolean)} flags
+   * @param {string} [description]
+   * @return {Command} `this` command for chaining
+   */
+  helpOption(flags, description) {
+    if (typeof flags === "boolean") {
+      if (flags) {
+        if (this._helpOption === null) this._helpOption = void 0;
+        if (this._defaultOptionGroup) {
+          this._initOptionGroup(this._getHelpOption());
+        }
+      } else {
+        this._helpOption = null;
+      }
+      return this;
     }
-    return true;
-  } catch {
-    return false;
+    this._helpOption = this.createOption(
+      flags ?? "-h, --help",
+      description ?? "display help for command"
+    );
+    if (flags || description) this._initOptionGroup(this._helpOption);
+    return this;
   }
-}
-function execFileHard(file, args, options) {
-  const { timeout, step, ...rest } = options;
-  const started = Date.now();
-  return new Promise((resolve7, reject) => {
-    const child2 = (0, import_node_child_process2.execFile)(file, args, { encoding: "utf8", windowsHide: true, ...rest, timeout: 0 }, (error, stdout, stderr) => {
-      clearTimeout(timer);
-      if (expired) return;
-      if (error) reject(error);
-      else resolve7({ stdout: String(stdout), stderr: String(stderr) });
-    });
-    let expired = false;
-    const timer = setTimeout(() => {
-      expired = true;
-      const killed = child2.pid ? killProcessTree(child2.pid) : false;
-      child2.stdout?.destroy();
-      child2.stderr?.destroy();
-      child2.unref();
-      reject(new ExecDeadlineError(step, timeout, Date.now() - started, killed));
-    }, timeout);
-    timer.unref?.();
-  });
-}
-var cachedGithubLogin;
-async function githubLogin() {
-  cachedGithubLogin ??= execFileP("gh", ["api", "user", "--jq", ".login"]).then(({ stdout }) => stdout.trim() || void 0).catch(() => void 0);
-  return cachedGithubLogin;
-}
-async function hubHeaders(extra = {}) {
-  const cfg = await loadConfig();
-  const t = await hubAuthToken({ baseUrl: cfg.sagaApiUrl ?? defaultHubUrl(), githubToken });
-  const base = { ...clientVersionHeaders(), ...extra };
-  return t ? { ...base, Authorization: `Bearer ${t}` } : base;
-}
-async function loadConfig() {
-  return { sagaApiUrl: defaultHubUrl() };
-}
-async function originRemoteUrl() {
-  return gitOut(["config", "--get", "remote.origin.url"]);
-}
-async function isOrgRepoRoot(readOrigin = originRemoteUrl) {
-  return /[:/]mutmutco\//i.test(await readOrigin());
-}
-var gitOut = async (args) => {
-  try {
-    return (await execFileP("git", [...args])).stdout.trim();
-  } catch {
-    return "";
+  /**
+   * Lazy create help option.
+   * Returns null if has been disabled with .helpOption(false).
+   *
+   * @returns {(Option | null)} the help option
+   * @package
+   */
+  _getHelpOption() {
+    if (this._helpOption === void 0) {
+      this.helpOption(void 0, void 0);
+    }
+    return this._helpOption;
   }
-};
-async function repoProject(cfg) {
-  const remote = await gitOut(["remote", "get-url", "origin"]);
-  const repo = remote.replace(/\.git$/, "").split("/").pop() || "-";
-  return cfg.project || repo;
-}
-var consoleIo = { log: (m) => console.log(m), err: (m) => console.error(m) };
-function argvWantsJson() {
-  return process.argv.some((a) => a === "--json" || a.startsWith("--json="));
-}
-function argvWantsMachineFailure() {
-  return argvWantsJson() || process.argv.some((a) => a === "--validate-only" || a === "--dry-run");
-}
-function commandFromFailMessage(msg) {
-  const head = msg.split(":", 1)[0].trim();
-  if (!head || head.startsWith("-")) return "mmi-cli";
-  if (!/^[a-z][a-z0-9-]*(?: [a-z][a-z0-9-]*){0,5}$/.test(head)) return "mmi-cli";
-  return canonicalPathFor(head) ?? head;
-}
-function canonicalFailMessage(msg) {
-  const colon = msg.indexOf(":");
-  if (colon < 0) return msg;
-  const command = commandFromFailMessage(msg);
-  return command === "mmi-cli" ? msg : `${command}${msg.slice(colon)}`;
-}
-function fail(msg, payload) {
-  const json = argvWantsMachineFailure();
-  const canonicalMsg = canonicalFailMessage(msg);
-  if (payload && json) {
-    console.error(formatErrorEnvelope(canonicalMsg, payload));
-  } else {
-    if (!json) console.error(`run: mmi-cli explain ${commandFromFailMessage(msg)}`);
-    console.error(`mmi-cli ${canonicalMsg}`);
+  /**
+   * Supply your own option to use for the built-in help option.
+   * This is an alternative to using helpOption() to customise the flags and description etc.
+   *
+   * @param {Option} option
+   * @return {Command} `this` command for chaining
+   */
+  addHelpOption(option) {
+    this._helpOption = option;
+    this._initOptionGroup(option);
+    return this;
   }
-  hardExit(1);
-}
-async function failGracefulEnvelope(msg, payload) {
-  if (payload && argvWantsMachineFailure()) {
-    console.error(formatErrorEnvelope(msg, payload));
-    return cleanExit(1);
+  /**
+   * Output help information and exit.
+   *
+   * Outputs built-in help, and custom text added using `.addHelpText()`.
+   *
+   * @param {{ error: boolean }} [contextOptions] - pass {error:true} to write to stderr instead of stdout
+   */
+  help(contextOptions) {
+    this.outputHelp(contextOptions);
+    let exitCode = Number(import_node_process.default.exitCode ?? 0);
+    if (exitCode === 0 && contextOptions && typeof contextOptions !== "function" && contextOptions.error) {
+      exitCode = 1;
+    }
+    this._exit(exitCode, "commander.help", "(outputHelp)");
   }
-  return failGraceful(msg);
-}
-async function planMutation(opts, args, commandName, planFn) {
-  const validateOnly = opts.validateOnly === true;
-  const dryRun = opts.dryRun === true;
-  if (!validateOnly && !dryRun) return null;
-  const planned = planFn ? await planFn(opts, args) : { command: commandName, args };
-  return validateOnly ? { ok: true, planned } : { dry_run: true, planned };
-}
-function commandPath(cmd) {
-  const parts = [];
-  let node = cmd;
-  while (node && node.parent) {
-    parts.unshift(node.name());
-    node = node.parent;
+  /**
+   * // Do a little typing to coordinate emit and listener for the help text events.
+   * @typedef HelpTextEventContext
+   * @type {object}
+   * @property {boolean} error
+   * @property {Command} command
+   * @property {function} write
+   */
+  /**
+   * Add additional text to be displayed with the built-in help.
+   *
+   * Position is 'before' or 'after' to affect just this command,
+   * and 'beforeAll' or 'afterAll' to affect this command and all its subcommands.
+   *
+   * @param {string} position - before or after built-in help
+   * @param {(string | Function)} text - string to add, or a function returning a string
+   * @return {Command} `this` command for chaining
+   */
+  addHelpText(position, text) {
+    const allowedValues = ["beforeAll", "before", "after", "afterAll"];
+    if (!allowedValues.includes(position)) {
+      throw new Error(`Unexpected value for position to addHelpText.
+Expecting one of '${allowedValues.join("', '")}'`);
+    }
+    const helpEvent = `${position}Help`;
+    this.on(helpEvent, (context) => {
+      let helpStr;
+      if (typeof text === "function") {
+        helpStr = text({ error: context.error, command: context.command });
+      } else {
+        helpStr = text;
+      }
+      if (helpStr) {
+        context.write(`${helpStr}
+`);
+      }
+    });
+    return this;
   }
-  return parts.join(" ") || cmd.name();
-}
-function jsonParity(cmd) {
-  if (!cmd.options.some((o) => o.long === "--json")) {
-    cmd.option("--json", "machine-readable output (default; accepted for parity)");
+  /**
+   * Output help information if help flags specified
+   *
+   * @param {Array} args - array of options to search for help flags
+   * @private
+   */
+  _outputHelpIfRequested(args) {
+    const helpOption = this._getHelpOption();
+    const helpRequested = helpOption && args.find((arg) => helpOption.is(arg));
+    if (helpRequested) {
+      this.outputHelp();
+      this._exit(0, "commander.helpDisplayed", "(outputHelp)");
+    }
   }
-  return cmd;
-}
-function mutating(cmd, planFn) {
-  const marker = cmd;
-  if (marker.__mmiMutating) return cmd;
-  marker.__mmiMutating = true;
-  if (!cmd.options.some((o) => o.long === "--json")) cmd.option("--json", "machine-readable output");
-  cmd.option("--dry-run", "resolve + validate, print the planned action as JSON, and exit without writing");
-  cmd.option("--validate-only", "validate flags/enums/refs, print {ok,planned} or the C2 error envelope, and exit without writing");
-  const registerAction = cmd.action.bind(cmd);
-  cmd.action = ((handler) => registerAction(async (...actionArgs) => {
-    const command = actionArgs[actionArgs.length - 1];
-    const opts = command.opts();
-    const positionals = actionArgs.slice(0, -2);
-    const out = await planMutation(opts, positionals, commandPath(command), planFn);
-    if (out) {
-      console.log(JSON.stringify(out));
-      return;
+};
+function incrementNodeInspectorPort(args) {
+  return args.map((arg) => {
+    if (!arg.startsWith("--inspect")) {
+      return arg;
     }
-    return handler(...actionArgs);
-  }));
-  return cmd;
-}
-function installProcessBackstop() {
-  process.on("unhandledRejection", (reason) => void failGraceful(reason instanceof Error ? reason.message : String(reason)));
-  process.on("uncaughtException", (err) => void failGraceful(err instanceof Error ? err.message : String(err)));
-}
-function rawFlag(flag) {
-  return process.argv.some((arg) => arg === flag || arg.startsWith(`${flag}=`));
-}
-function rawValue(flag, fallback) {
-  const index = process.argv.indexOf(flag);
-  if (index >= 0 && process.argv[index + 1]) return process.argv[index + 1];
-  const inline = process.argv.find((arg) => arg.startsWith(`${flag}=`));
-  return inline ? inline.slice(flag.length + 1) : fallback;
+    let debugOption;
+    let debugHost = "127.0.0.1";
+    let debugPort = "9229";
+    let match;
+    if ((match = arg.match(/^(--inspect(-brk)?)$/)) !== null) {
+      debugOption = match[1];
+    } else if ((match = arg.match(/^(--inspect(-brk|-port)?)=([^:]+)$/)) !== null) {
+      debugOption = match[1];
+      if (/^\d+$/.test(match[3])) {
+        debugPort = match[3];
+      } else {
+        debugHost = match[3];
+      }
+    } else if ((match = arg.match(/^(--inspect(-brk|-port)?)=([^:]+):(\d+)$/)) !== null) {
+      debugOption = match[1];
+      debugHost = match[3];
+      debugPort = match[4];
+    }
+    if (debugOption && debugPort !== "0") {
+      return `${debugOption}=${debugHost}:${parseInt(debugPort) + 1}`;
+    }
+    return arg;
+  });
 }
-function printLine(value) {
-  (0, import_node_fs5.writeSync)(1, `${value}
-`);
+function useColor() {
+  if (import_node_process.default.env.NO_COLOR || import_node_process.default.env.FORCE_COLOR === "0" || import_node_process.default.env.FORCE_COLOR === "false")
+    return false;
+  if (import_node_process.default.env.FORCE_COLOR || import_node_process.default.env.CLICOLOR_FORCE !== void 0)
+    return true;
+  return void 0;
 }
 
+// node_modules/commander/index.js
+var program = new Command();
+
+// src/command-composition.ts
+var import_node_fs48 = require("node:fs");
+init_clean_exit();
+init_cli_shared();
+
 // src/doctor-fleet-drift.ts
 var import_node_fs6 = require("node:fs");
 var import_node_os2 = require("node:os");
@@ -4599,6 +4697,9 @@ function readFleetDrift(env, activeSurfaces) {
   }
 }
 
+// src/command-composition.ts
+init_error_codes();
+
 // src/git-clean-tree.ts
 function isAgentScratchPath(path2) {
   const normalized = path2.replace(/\\/g, "/").trim();
@@ -4804,6 +4905,7 @@ function excessArgumentMessage(extra, corrected) {
 // src/released-version-cache.ts
 var import_node_fs7 = require("node:fs");
 var import_node_path5 = require("node:path");
+init_client_version();
 var RELEASED_VERSION_CACHE_MS = 24 * 36e5;
 function releasedVersionCachePath(runtimeRoot) {
   return (0, import_node_path5.join)(runtimeRoot, "head-ts", ".released-version");
@@ -5309,8 +5411,12 @@ var import_node_path46 = require("node:path");
 var import_node_fs13 = require("node:fs");
 var import_node_os9 = require("node:os");
 var import_node_path11 = require("node:path");
+init_cli_shared();
+init_github_client();
 
 // src/board-snapshot.ts
+init_fetch_retry();
+init_client_version();
 var BOARD_SNAPSHOT_TIMEOUT_MS = 25e3;
 function isSnapshotShape(body) {
   const b = body;
@@ -5358,6 +5464,7 @@ async function fetchHubBoardSnapshot(request, deps) {
 }
 
 // src/github-quota.ts
+init_github_client();
 var RATE_LIMIT_WAIT_CAP_MS = 12e4;
 var RateLimitedError = class extends Error {
   receipt;
@@ -5899,6 +6006,9 @@ async function withAlreadyClosedCommitTargets(input, fetchIssueState) {
   return alreadyClosed.length ? { ...input, alreadyClosed: [.../* @__PURE__ */ new Set([...input.alreadyClosed ?? [], ...alreadyClosed])] } : input;
 }
 
+// src/repo-resolve.ts
+init_cli_shared();
+
 // src/registry-degrade.ts
 function registryDegradeError(error) {
   return new Error(
@@ -5913,6 +6023,10 @@ var ORG_CONFIG_PATH = "/org/config";
 var PROJECTS_ENVELOPE_KEY = "projects";
 var REGISTRY_FETCH_TIMEOUT_MS = 8e3;
 
+// src/registry-client.ts
+init_fetch_retry();
+init_client_version();
+
 // src/workflow-context.ts
 function parseWorkflowJobs(yaml) {
   const lines2 = yaml.split(/\r?\n/);
@@ -6969,6 +7083,11 @@ function boardConfigFromProject(meta, floor = {}) {
   };
 }
 
+// src/cli-doctor-shared.ts
+init_cli_shared();
+init_hub_auth();
+init_github_client();
+
 // src/project-model.ts
 var PROJECT_TYPES = ["web-app", "hub-service", "content", "desktop-app", "desktop-game", "mobile-app", "non-deployable", "cli-tool", "worker"];
 var DEPLOY_MODELS = ["hub-serverless", "serverless", "tenant-container", "solo-container", "static-cdn", "registry-publish", "content", "none"];
@@ -7204,6 +7323,8 @@ ${lines2.join("\n")}`;
 }
 
 // src/issue-surface.ts
+init_cli_shared();
+init_error_codes();
 var SURFACE_PREFIX = "surface:";
 var SURFACE_READ_TIMEOUT_MS = 1e4;
 function labelsCarrySurface(labels) {
@@ -7342,6 +7463,7 @@ function shouldWithdrawSurfaceFlag(result) {
 }
 
 // src/secrets-transport.ts
+init_client_version();
 var OWNER = "mutmutco";
 var SSM_ROOT = "/mmi-future";
 var PROJECT_TIER_SEGMENT = "dev";
@@ -7959,6 +8081,7 @@ async function secretsPreflight(deps, opts) {
 // src/secrets-execution.ts
 var import_node_child_process4 = require("node:child_process");
 var import_node_os5 = require("node:os");
+init_clean_exit();
 
 // src/gh-create.ts
 var import_promises = require("node:fs/promises");
@@ -7994,6 +8117,8 @@ function isPriorityFieldConfigured(cfg) {
 }
 
 // src/gh-create.ts
+init_cli_shared();
+init_github_client();
 var ISSUE_TYPES = ["bug", "feature", "task"];
 var GH_MUTATION_TIMEOUT_MS = 12e4;
 function timeoutKillNote(err, timeoutMs) {
@@ -9790,6 +9915,9 @@ function readSettingsAutoUpdate(raw, name) {
 var CATALOG_CONTENT_REF = "main";
 var CATALOG_REF_PIN_STEPS = `add \`"ref": "${CATALOG_CONTENT_REF}"\` to this marketplace's \`source\` in ~/.claude/plugins/known_marketplaces.json, then restart Claude`;
 
+// src/plugin-guard-io.ts
+init_cli_shared();
+
 // src/plugin-guard.ts
 function buildPluginGuardDecision(i) {
   if (!i.isOrgRepo) return { state: "not-org" };
@@ -10663,6 +10791,9 @@ function describeSessionIdentity(env = process.env) {
   };
 }
 
+// src/board-doctor-config.ts
+init_github_client();
+
 // ../infra/board-vocab.mjs
 var BOARD_STATUSES = ["Todo", "In Progress", "In Review", "Done"];
 
@@ -10993,7 +11124,14 @@ mutation($projectId: ID!, $itemId: ID!) {
   }
 }`;
 async function updateItemSingleSelect(client, projectId, itemId, fieldId, optionId) {
-  await client.graphql(UPDATE_ITEM_FIELD_MUTATION, { projectId, itemId, fieldId, optionId });
+  try {
+    await client.graphql(UPDATE_ITEM_FIELD_MUTATION, { projectId, itemId, fieldId, optionId });
+  } catch (error) {
+    const errors = error.graphqlErrors;
+    if (!errors?.length || !errors.every((entry) => entry.type === "INSUFFICIENT_SCOPES")) throw error;
+    const { writeHubBoardField: writeHubBoardField2 } = await Promise.resolve().then(() => (init_board_write(), board_write_exports));
+    await writeHubBoardField2({ projectId, itemId, fieldId, optionId });
+  }
 }
 function parseIssueSelector(selector, defaultRepo, expectedRepo) {
   const parsed = parseIssueRef(selector, expectedRepo);
@@ -12014,7 +12152,11 @@ function ghError(e) {
   return (err.stderr || err.message || String(e)).trim();
 }
 
+// src/board-claim-move.ts
+init_github_client();
+
 // src/sub-issue.ts
+init_error_codes();
 function buildResolveIdArgs(ref) {
   const args = ["issue", "view", String(ref.number), "--json", "id", "--jq", ".id"];
   if (ref.repo) args.push("--repo", ref.repo);
@@ -12651,6 +12793,7 @@ async function postClaimMarkerComment(client, item, actor = describeSessionIdent
 }
 
 // src/board-cleanup.ts
+init_github_client();
 async function removeRepoBoardItems(options, deps = {}) {
   const cfg = resolveBoardConfig(options.config);
   const client = deps.client ?? defaultGitHubClient();
@@ -13041,6 +13184,7 @@ async function waitForPrChecks(deps) {
 }
 
 // src/bootstrap-ruleset.ts
+init_github_client();
 var PRODUCT_RULESET_NAME = "mmi-product-required-checks";
 var PRODUCT_GATE_CONTEXT = "gate";
 var PRODUCT_RULESET_PATH = ".github/rulesets/mmi-product-required-checks.json";
@@ -14951,6 +15095,9 @@ function isJervHubRepo(repo) {
 var import_node_fs18 = require("node:fs");
 var import_node_path16 = require("node:path");
 
+// src/fleet-lockstep-enforce.ts
+init_github_client();
+
 // src/bootstrap-org-ruleset.ts
 var ORG_NO_AGENT_FILES_RULESET_NAME = "mmi-no-agent-files-org";
 var ORG_LOGIN = "mutmutco";
@@ -15106,32 +15253,33 @@ function collaboratorRole(c) {
 async function auditRepoCollaborators(repo, owners, deps, projectAdmins = /* @__PURE__ */ new Set(), sanctionedAdmins = /* @__PURE__ */ new Set()) {
   const collabs = await restPagedJson(deps, `repos/${repo}/collaborators?affiliation=direct`, []);
   const findings = [];
-  const writeOrBetter = /* @__PURE__ */ new Set();
+  const adminLogins = /* @__PURE__ */ new Set();
+  const listed = (logins, login) => [...logins].some((entry) => entry.toLowerCase() === login.toLowerCase());
   for (const c of collabs) {
-    if (owners.has(c.login)) continue;
+    if (listed(owners, c.login)) continue;
     const role = collaboratorRole(c);
-    writeOrBetter.add(c.login);
-    if (OVERGRANT_ROLES.has(role) && sanctionedAdmins.has(c.login)) continue;
+    if (role === "admin") adminLogins.add(c.login.toLowerCase());
+    if (OVERGRANT_ROLES.has(role) && (listed(projectAdmins, c.login) || listed(sanctionedAdmins, c.login))) continue;
     if (OVERGRANT_ROLES.has(role)) {
       findings.push({
         repo,
         kind: "collaborator-overgrant",
         severity: "high",
         actor: c.login,
-        detail: `direct collaborator @${c.login} holds role '${role}'; a developer must be 'write' (admin/maintain is master-only)`,
+        detail: `direct collaborator @${c.login} holds role '${role}' without a project-admin registration or owner sanction`,
         remediation: `gh api -X PUT repos/${repo}/collaborators/${c.login} -f permission=push`
       });
     }
   }
   for (const login of projectAdmins) {
-    if (owners.has(login) || writeOrBetter.has(login)) continue;
+    if (listed(owners, login) || adminLogins.has(login.toLowerCase())) continue;
     findings.push({
       repo,
       kind: "collaborator-undergrant",
       severity: "medium",
       actor: login,
-      detail: `@${login} is a declared project-admin of ${repo} in the registry but holds no direct collaborator role; secrets self-serve and train authority fail closed for them`,
-      remediation: `gh api -X PUT repos/${repo}/collaborators/${login} -f permission=push`
+      detail: `@${login} is a declared project-admin of ${repo} but lacks the required repository admin role`,
+      remediation: `gh api -X PUT repos/${repo}/collaborators/${login} -f permission=admin`
     });
   }
   return findings;
@@ -15414,6 +15562,13 @@ function renderAccessReport(report) {
   return lines2.join("\n");
 }
 
+// src/fleet-lockstep-enforce.ts
+init_clean_exit();
+init_cli_shared();
+
+// ../infra/src/version-gate.ts
+init_compat();
+
 // ../infra/src/infra-constants.ts
 var HUB_REPO3 = "mutmutco/MMI-Hub";
 var STAGES = ["dev", "rc", "main"];
@@ -15703,10 +15858,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.3.45",
-    tag: "v4.3.45",
-    commit: "519cee3af091",
-    npm: "@mutmutco/cli@4.3.45"
+    version: "4.3.47",
+    tag: "v4.3.47",
+    commit: "9c81f5030532",
+    npm: "@mutmutco/cli@4.3.47"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15723,14 +15878,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.3.45"
+          v3Target: "v4.3.47"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.3.45 and redeploy the Hub Lambda from tag v4.3.45 (519cee3af091); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.3.45 (@mutmutco/cli@4.3.45, tag commit 519cee3af091 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.3.47 and redeploy the Hub Lambda from tag v4.3.47 (9c81f5030532); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.3.47 (@mutmutco/cli@4.3.47, tag commit 9c81f5030532 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -15888,6 +16043,13 @@ var rollout_plan_default = {
   ]
 };
 
+// src/fleet-lockstep-gate.ts
+init_clean_exit();
+
+// src/fleet-track-inventory.ts
+init_cli_shared();
+init_clean_exit();
+
 // src/train-status.ts
 function buildTrainStatusReport(input) {
   const bumpIntent = input.bumpIntent ?? process.env.MMI_BUMP_INTENT;
@@ -16036,6 +16198,10 @@ function formatOrgVersions(report) {
   return lines2.join("\n");
 }
 
+// src/query-commands.ts
+init_cli_shared();
+init_error_codes();
+
 // src/issue-view-json.ts
 var DEFAULT_ISSUE_VIEW_FIELDS = "number,title,state,url,labels,author,assignees,milestone,body";
 function normalizeIssueViewJsonFields(tokens2) {
@@ -19592,6 +19758,7 @@ var import_node_path19 = require("node:path");
 // src/jerv-cli-spawn.ts
 var import_node_os11 = require("node:os");
 var import_node_path18 = require("node:path");
+init_cli_shared();
 var JERV_CLI_ENTRY = (0, import_node_path18.join)("node_modules", "@jervaise", "jerv-cli", "dist", "index.cjs");
 function pathEnvEntries(pathEnv, platform2 = process.platform) {
   if (platform2 !== "win32") {
@@ -21335,8 +21502,12 @@ async function beginReleaseLedger(deps, cwd, targetTag) {
   });
 }
 
+// src/train-doctor.ts
+init_client_version();
+
 // src/train-self-converge.ts
 var import_node_child_process8 = require("node:child_process");
+init_cli_shared();
 var SELF_CONVERGE_INSTALL_TIMEOUT_MS = 12e4;
 var SELF_CONVERGE_VERSION_TIMEOUT_MS = 3e4;
 var isWin2 = process.platform === "win32";
@@ -21698,7 +21869,7 @@ async function runTrainDoctor(input) {
           const tip = await git3(["rev-parse", "--verify", "--quiet", `refs/remotes/origin/${startBranch}`]);
           const checkRuns = JSON.parse(await train.run("gh", ["api", `repos/${repo}/commits/${tip}/check-runs`, "--jq", TRAIN_CHECK_RUNS_JQ]));
           const statuses = JSON.parse(await train.run("gh", ["api", `repos/${repo}/commits/${tip}/status`, "--jq", TRAIN_COMMIT_STATUS_JQ]));
-          const observed = required.filter((c) => checkRuns.some((r) => r.name === c) || statuses.some((s) => s.context === c));
+          const observed = required.filter((c) => checkRuns.some((r) => r.name === c && !(r.status === "completed" && (r.conclusion === "skipped" || r.conclusion === "neutral"))) || statuses.some((s) => s.context === c));
           const red = observed.filter((c) => resolveContextState(c, checkRuns, statuses) === "failed");
           const inFlight = observed.filter((c) => resolveContextState(c, checkRuns, statuses) === "pending");
           const at = `${startBranch}@${tip.slice(0, 12)}`;
@@ -24804,6 +24975,9 @@ async function applyCiReconcileRepo(repo, deps) {
   return finalizeCiReconcile(repo, deps, result, report);
 }
 
+// src/command-composition.ts
+init_client_version();
+
 // src/command-consolidation.ts
 function child(parent, name) {
   const found = parent.commands.find((command) => command.name() === name);
@@ -24860,7 +25034,12 @@ function consolidateCommandNamespaces(program3) {
   move(program3, stage, "port-range");
 }
 
+// src/command-manifest.ts
+init_error_codes();
+init_house_map();
+
 // src/command-taxonomy.ts
+init_house_map();
 var COMMAND_METADATA = /* @__PURE__ */ Symbol.for("mmi.commandTaxonomy.metadata");
 var PRIMARY_GROUPS = [
   ["Orient", ["onboard", "status", "next", "doctor", "whoami", "commands", "explain"]],
@@ -25401,6 +25580,9 @@ function formatManifestHuman(manifest, options = {}) {
   return lines2.join("\n");
 }
 
+// src/command-composition.ts
+init_house_map();
+
 // src/plugin-cache-prune.ts
 var PLUGIN_CACHE_KEEP = 2;
 var VERSION_DIR = /^\d+\.\d+\.\d+(?:[-+].*)?$/;
@@ -25761,7 +25943,13 @@ async function activateAppActor(commandPath3, env, mint) {
   return "app";
 }
 
+// src/board-commands.ts
+init_cli_shared();
+init_clean_exit();
+init_error_codes();
+
 // src/config-load.ts
+init_cli_shared();
 var discoveredConfig = null;
 var lastDiscoverMiss = null;
 function lastBoardDiscoverMiss() {
@@ -26105,6 +26293,8 @@ function registerBoardCommands(program3) {
 var import_node_fs25 = require("node:fs");
 var import_node_os14 = require("node:os");
 var import_node_path25 = require("node:path");
+init_cli_shared();
+init_clean_exit();
 
 // src/command-plans.ts
 function parseTrainTag(tag) {
@@ -26268,6 +26458,13 @@ function renderSteps(title, steps) {
   ].join("\n");
 }
 
+// src/bootstrap-commands.ts
+init_house_map();
+init_github_client();
+
+// src/port-range-assign.ts
+init_cli_shared();
+
 // src/port-registry.ts
 var import_node_fs24 = require("node:fs");
 var import_node_path24 = require("node:path");
@@ -27350,10 +27547,10 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
   try {
     const owners = new Set(await resolveOwners(deps));
     const sanctioned = new Set(deps.sanctionedAdmins ?? []);
-    const overgrants = (await auditRepoCollaborators(repo, owners, deps, /* @__PURE__ */ new Set(), sanctioned)).filter((f) => f.kind === "collaborator-overgrant");
+    const overgrants = (await auditRepoCollaborators(repo, owners, deps, new Set(deps.projectAdmins ?? []), sanctioned)).filter((f) => f.kind === "collaborator-overgrant");
     checks.push({
       ok: overgrants.length === 0,
-      label: "collaborator roles are master-only (no admin/maintain over-grant)",
+      label: "repository admin roles match project admins and owner sanctions",
       detail: overgrants.length ? `over-granted: ${overgrants.map((f) => f.actor).join(", ")}` : sanctioned.size ? `sanctioned admin: ${[...sanctioned].join(", ")} (access-matrix.json, an owner decision)` : void 0
     });
   } catch {
@@ -27671,6 +27868,7 @@ function renderBootstrapVerifyReport(report) {
 
 // src/bootstrap-seed-delivery.ts
 var import_node_crypto9 = require("node:crypto");
+init_github_client();
 var SHA = /^[a-f0-9]{40}$/;
 async function readSeedFile(repo, target, ref, client) {
   try {
@@ -27802,6 +28000,7 @@ function registerBootstrapCommands(program3) {
     let report = await verifyBootstrap(repo, o.class, {
       client: defaultGitHubClient(),
       projectMeta: meta,
+      projectAdmins: meta?.projectAdmins,
       deployModel: typeof meta?.deployModel === "string" ? meta.deployModel : void 0,
       deployFacts,
       deployFactsRead: deployFacts !== null,
@@ -28926,6 +29125,8 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
 }
 
 // src/call-telemetry.ts
+init_client_version();
+init_hub_url();
 var TELEMETRY_TIMEOUT_MS = 2e3;
 var CI_MARKERS = [
   "CI",
@@ -28966,6 +29167,10 @@ function emitCliCallTelemetry(command) {
   }
 }
 
+// src/deploy-commands.ts
+init_cli_shared();
+init_clean_exit();
+
 // src/deploy-status.ts
 function buildDeployStatusReport(input) {
   const deploy = input.deployFacts?.stages[input.stage] ?? null;
@@ -29065,6 +29270,9 @@ function registerDeployCommands(program3) {
   });
 }
 
+// src/deploy-guards.ts
+init_cli_shared();
+
 // src/project-set.ts
 var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "dsManifestPath", "fofuEnabled", "consumesDesignSystem", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary"];
 var UNSET_KEY_SET = new Set(UNSET_KEYS);
@@ -29844,6 +30052,10 @@ Rollback only after independent verification: set-deploy --no-env-file false; pr
   return { ok: true };
 }
 
+// src/deploy-port-doctor.ts
+init_fetch_retry();
+init_client_version();
+
 // ../infra/src/deploy-port-collision.ts
 function formatDeployPortCollisionReportLine(collision) {
   const owners = collision.owners.map((o) => `${o.slug}/${o.stage}`).join(", ");
@@ -29914,6 +30126,9 @@ function renderDeployPortDoctor(report) {
   return lines2;
 }
 
+// src/discovery-commands.ts
+init_cli_shared();
+
 // src/wave-status.ts
 var import_node_fs28 = require("node:fs");
 
@@ -30790,6 +31005,8 @@ async function collectWaveStatus(deps) {
 }
 
 // src/discovery-commands.ts
+init_github_client();
+init_cli_shared();
 var import_node_fs29 = require("node:fs");
 var import_node_os15 = require("node:os");
 var import_node_path28 = require("node:path");
@@ -32620,6 +32837,9 @@ async function runDoctorClean(opts, io, deps) {
 }
 
 // src/explain-command.ts
+init_cli_shared();
+init_error_codes();
+init_house_map();
 var LOOP_PLAYBOOKS = {
   agent: {
     title: "Agent",
@@ -32935,12 +33155,20 @@ function parseOriginRepo(remoteUrl) {
   return `${match[1]}/${match[2]}`;
 }
 
+// src/command-composition.ts
+init_github_client();
+
 // src/issue-commands.ts
 var import_node_fs30 = require("node:fs");
 var import_node_crypto10 = require("node:crypto");
+init_cli_shared();
+init_clean_exit();
+init_error_codes();
+init_github_client();
 
 // src/issue-body.ts
 var import_node_os16 = require("node:os");
+init_error_codes();
 var TextArgError = class extends Error {
   constructor(message2, code, offendingFlag) {
     super(message2);
@@ -33003,6 +33231,8 @@ async function resolveIssueTitle(input, deps) {
 }
 
 // src/learning-closure-rate.ts
+init_cli_shared();
+init_error_codes();
 var CLOSURE_RATE_TIMEOUT_MS = 2e4;
 var LOOP_ITEM_CAP = 100;
 var EVIDENCE_CONCURRENCY = 4;
@@ -33919,6 +34149,8 @@ ${lines2}`, {
 }
 
 // src/learning-pickup.ts
+init_cli_shared();
+init_github_client();
 var LEARNING_PICKUP_CMD = ["mmi-cli", "learning", "pickup"].join(" ");
 var LEARNING_CLAIM_MARKER_LIVE_MS = 24 * 60 * 6e4;
 function isLearningChannelItem(labels) {
@@ -34179,6 +34411,7 @@ function registerOrgHealthQuery(program3, deps = defaultOrgHealthQueryDeps()) {
 }
 
 // src/pr-checks-rest.ts
+init_cli_shared();
 var REST_GH_TIMEOUT_MS = 2e4;
 var pollTokenProvider;
 var pollTokenOnce;
@@ -34609,6 +34842,8 @@ async function fetchRestCorePool(gh = defaultGhApi) {
 
 // src/pr-commands.ts
 var import_promises4 = require("node:fs/promises");
+init_cli_shared();
+init_error_codes();
 var GC_GH_TIMEOUT_MS2 = 2e4;
 var CHECKS_WATCH_POLL_MS = 15e3;
 var CHECKS_WATCH_TIMEOUT_MS = 10 * 6e4;
@@ -35179,6 +35414,9 @@ function writeError(res) {
 var import_promises5 = require("node:fs/promises");
 var import_node_child_process11 = require("node:child_process");
 var import_node_util6 = require("node:util");
+init_clean_exit();
+init_github_client();
+init_cli_shared();
 var execFileP4 = (0, import_node_util6.promisify)(import_node_child_process11.execFile);
 var AWS_REGION = "eu-central-1";
 var AWS_TIMEOUT_MS = 3e4;
@@ -35497,6 +35735,9 @@ function registerSchedulesCommands(program3) {
 var import_node_fs32 = require("node:fs");
 var import_node_path30 = require("node:path");
 var import_node_os17 = require("node:os");
+init_cli_shared();
+init_hub_auth();
+init_github_client();
 
 // src/secrets-diff.ts
 var TIMEOUT_MS2 = 8e3;
@@ -35876,6 +36117,7 @@ function registerSecretsCommands(program3) {
 }
 
 // src/session-report.ts
+init_cli_shared();
 var GC_GH_TIMEOUT_MS3 = 2e4;
 function shapeSessionIssues(report) {
   if (!report) return [];
@@ -35995,6 +36237,8 @@ function registerSessionReport(program3) {
 // src/stage-commands.ts
 var import_node_fs33 = require("node:fs");
 var import_node_path31 = require("node:path");
+init_cli_shared();
+init_clean_exit();
 
 // src/stage-default.ts
 function shellFor() {
@@ -36063,39 +36307,7 @@ function decideStage(inputs) {
 }
 
 // src/stage-live.ts
-var import_node_net2 = require("node:net");
 var STAGE_LIVE_HUB_REPO = "mutmutco/MMI-Hub";
-var IP_ECHO_URL = "https://api.ipify.org";
-var IP6_ECHO_URL = "https://api6.ipify.org";
-var IP_DETECT_TIMEOUT_MS = 1e4;
-function validStageLiveIp(ip) {
-  return (0, import_node_net2.isIP)(ip.trim()) !== 0;
-}
-async function detectPublicIp(fetchImpl = fetch) {
-  return detectPublicIpFrom(IP_ECHO_URL, fetchImpl);
-}
-async function detectCallerIps(fetchImpl = fetch) {
-  const [v4, v6] = await Promise.allSettled([
-    detectPublicIp(fetchImpl),
-    detectPublicIpFrom(IP6_ECHO_URL, fetchImpl)
-  ]);
-  if (v4.status === "rejected") throw v4.reason;
-  const ip = v4.value;
-  const candidate = v6.status === "fulfilled" ? v6.value : void 0;
-  return { ip, ip6: candidate && (0, import_node_net2.isIP)(candidate) === 6 ? candidate : void 0 };
-}
-async function detectPublicIpFrom(url, fetchImpl) {
-  let res;
-  try {
-    res = await fetchImpl(url, { signal: AbortSignal.timeout(IP_DETECT_TIMEOUT_MS) });
-  } catch (e) {
-    throw new Error(`public IP detection failed (${url}): ${e.message}`);
-  }
-  if (!res.ok) throw new Error(`public IP detection failed: HTTP ${res.status} from ${url}`);
-  const ip = (await res.text()).trim();
-  if (!validStageLiveIp(ip)) throw new Error(`public IP detection returned a non-IP body from ${url}: "${ip.slice(0, 80)}"`);
-  return ip;
-}
 function isStageLiveDeployModel(deployModel, projectType) {
   if (deployModel) return deployModel === "tenant-container";
   return projectType === "web-app";
@@ -36107,16 +36319,14 @@ function stageLiveUnsupportedReason(deployModel, projectType) {
 }
 function stageLiveUpSteps(t) {
   return [
-    { label: `detect your public IPv4 and IPv6 (${IP_ECHO_URL} + ${IP6_ECHO_URL}, bounded, in parallel)` },
+    { label: `clear legacy IP gates for ${t.host} via the Hub backend (tenant-control cf-gate-clear; no new rules)` },
     { label: `deploy ${t.ref ?? "<current branch>"} to the ${t.slug} dev stage via the Hub backend (tenant-deploy)` },
-    { label: `gate ${t.host} to your IPv4 and your IPv6 /64 at the Cloudflare edge via the Hub backend (tenant-control cf-gate-allow)` },
     { label: "tear down when done", command: "mmi-cli stage --live --down --apply" }
   ];
 }
 function stageLiveDownSteps(t) {
   return [
-    { label: `stop the ${t.slug} dev runtime via the Hub backend (tenant-control stop)` },
-    { label: `remove the Cloudflare edge gate for ${t.host} via the Hub backend (tenant-control cf-gate-clear)` }
+    { label: `stop the ${t.slug} dev runtime via the Hub backend (tenant-control stop)` }
   ];
 }
 function stageLiveDownNoop(t, reason) {
@@ -36131,39 +36341,28 @@ function stageLiveDownNoop(t, reason) {
 }
 async function runStageLiveUp(deps, t) {
   if (!t.ref?.trim()) throw new Error("stage --live: cannot resolve the current branch to deploy");
-  const detected = await deps.detectIp();
-  const ip = detected.ip.trim();
-  if (!validStageLiveIp(ip)) throw new Error(`stage --live: detected public IP is not a literal IPv4/IPv6 address: "${ip.slice(0, 80)}"`);
-  const ip6 = detected.ip6?.trim() || void 0;
   if (!t.host?.trim()) throw new Error("stage --live: cannot resolve the dev edge host (registry edgeDomains.dev)");
+  await deps.control({ repo: t.repo, action: "cf-gate-clear", host: t.host });
   await deps.deployDev({ repo: t.repo, ref: t.ref });
-  await deps.control({ repo: t.repo, action: "cf-gate-allow", host: t.host, ip, ip6 });
-  const allowed = ip6 ? `${ip} and your IPv6 /64 prefix (from ${ip6})` : `${ip} (IPv4 only \u2014 no public IPv6 detected)`;
   return {
     command: "stage --live",
     mode: "up",
     slug: t.slug,
     repo: t.repo,
     ref: t.ref,
-    ip,
-    ip6,
-    dispatched: ["tenant-deploy.yml", "tenant-control.yml"],
-    // #2656: the gate now writes a skip+block pair and self-verifies from the runner (a non-allowed vantage),
-    // so a gate that failed to close fails the run RED. The stage is private only once that gate run is green.
-    message: `dispatched the dev deploy of ${t.ref} and the Cloudflare edge gate for ${t.host} \u2192 ${allowed}; watch the runs in ${STAGE_LIVE_HUB_REPO} Actions and treat the stage as private ONLY once the cf-gate-allow run is green (it self-verifies the host is blocked) \u2014 tear down with: mmi-cli stage --live --down --apply`
+    dispatched: ["tenant-control.yml", "tenant-deploy.yml"],
+    message: `dispatched legacy gate cleanup and the dev deploy of ${t.ref}; ${t.host} has no stage IP restriction once both runs succeed in ${STAGE_LIVE_HUB_REPO} Actions. The app's own sign-in still applies. Tear down with: mmi-cli stage --live --down --apply`
   };
 }
 async function runStageLiveDown(deps, t) {
-  if (!t.host?.trim()) throw new Error("stage --live: cannot resolve the dev edge host (registry edgeDomains.dev)");
   await deps.control({ repo: t.repo, action: "stop" });
-  await deps.control({ repo: t.repo, action: "cf-gate-clear", host: t.host });
   return {
     command: "stage --live",
     mode: "down",
     slug: t.slug,
     repo: t.repo,
-    dispatched: ["tenant-control.yml", "tenant-control.yml"],
-    message: `dispatched the dev stop and the Cloudflare edge gate clear for ${t.host}; the dev stage is dark until the next mmi-cli stage --live --apply`
+    dispatched: ["tenant-control.yml"],
+    message: "dispatched the dev stop; verify the workflow succeeds before treating the stage as stopped"
   };
 }
 
@@ -36405,13 +36604,12 @@ function registerStageCommands(program3) {
     }
     const rcDeps = registryClientDeps(await loadConfig());
     const deps = {
-      detectIp: () => detectCallerIps(),
       deployDev: async ({ repo, ref }) => {
         const res = await tenantDeploy({ repo, stage: "dev", ref }, rcDeps);
         if (!res.ok) throw new Error(`dev deploy dispatch failed: ${res.body?.error ?? res.error ?? `HTTP ${res.status}`}`);
       },
-      control: async ({ repo, action, host, ip, ip6 }) => {
-        const res = await tenantControl({ repo, stage: "dev", action, host, ip, ip6 }, rcDeps);
+      control: async ({ repo, action, host }) => {
+        const res = await tenantControl({ repo, stage: "dev", action, host }, rcDeps);
         if (!res.ok) throw new Error(`runtime tenant control ${action} dispatch failed: ${res.body?.error ?? res.error ?? `HTTP ${res.status}`}`);
       }
     };
@@ -36422,7 +36620,7 @@ function registerStageCommands(program3) {
       return failGraceful(`stage --live: ${e.message}`);
     }
   }
-  const stage = program3.command("stage").description("plan or run the repo local stage environment; --live = personal IP-gated cloud dev stage; remote rc/live move only via the gated rcand/release/hotfix train").option("--json", "machine-readable output").option("--apply", "run the full local stage: stop previous in this worktree, build, start, health-check").option("--port <port>", "loopback port for this worktree stage (1024..65535; default picks a free port in the registry range)").option("--live", "personal cloud dev stage: deploy the current branch to the dev runtime, served only to your public IP").option("--down", "with --live: stop the dev runtime and clear the IP allowlist").option("--timeout-ms <ms>", "bounded build/health timeout", "60000").action(async (o) => {
+  const stage = program3.command("stage").description("plan or run the repo local stage environment; --live = on-demand cloud dev stage; remote rc/live move only via the gated rcand/release/hotfix train").option("--json", "machine-readable output").option("--apply", "run the full local stage: stop previous in this worktree, build, start, health-check").option("--port <port>", "loopback port for this worktree stage (1024..65535; default picks a free port in the registry range)").option("--live", "personal cloud dev stage: deploy the current branch to the dev runtime, without a stage IP restriction").option("--down", "with --live: stop the dev runtime").option("--timeout-ms <ms>", "bounded build/health timeout", "60000").action(async (o) => {
     if (o.down && !o.live) return fail("stage: --down applies to --live only (local teardown is `mmi-cli stage stop --apply`)");
     if (o.live) return runStageLiveCommand(o);
     const { resolution: res, project: project2, cfg: stageCfg } = await resolveStage();
@@ -36712,8 +36910,12 @@ function renderVerifySecrets(body) {
 var import_node_child_process16 = require("node:child_process");
 var import_node_fs41 = require("node:fs");
 var import_promises7 = require("node:fs/promises");
+init_clean_exit();
+init_cli_shared();
+init_error_codes();
 
 // src/session-runtime.ts
+init_house_map();
 var WIN32_TRAMPOLINE = "const{spawn}=require('node:child_process');const a=JSON.parse(process.argv[1]);const c=spawn(a.cmd,a.args,{stdio:'ignore',windowsHide:true,cwd:a.cwd});c.on('exit',x=>process.exit(x??0));c.on('error',()=>process.exit(1));";
 function spawnDetachedSelf(args, deps, opts = {}) {
   try {
@@ -36768,6 +36970,9 @@ async function resolveAutoAddBoardAttach(client, cfg, selector, priority, warn =
   return { projectItemId };
 }
 
+// src/command-register-collaboration.ts
+init_house_map();
+
 // src/issue-check.ts
 var CHECKLIST_RE = /^([ \t]*[-*+] \[)([ xX])(\] )(.*)$/gm;
 function findChecklistItems(body) {
@@ -36975,10 +37180,15 @@ async function runPrLand(prNumber, options, deps) {
   };
 }
 
+// src/command-register-collaboration.ts
+init_github_client();
+
 // src/merge-cleanup.ts
 var import_node_fs36 = require("node:fs");
 var import_node_path34 = require("node:path");
 var import_node_os18 = require("node:os");
+init_cli_shared();
+init_github_client();
 
 // src/board-advance.ts
 function repoOf2(ref) {
@@ -38263,6 +38473,7 @@ var import_node_fs37 = require("node:fs");
 var import_node_path35 = require("node:path");
 
 // src/cross-repo-filing-issue.ts
+init_github_client();
 function crossRepoFilingRetryCommand(prRepo, prNumber) {
   return `mmi-cli devops pr merge ${prNumber} --repo ${prRepo}`;
 }
@@ -38470,6 +38681,7 @@ var import_node_child_process14 = require("node:child_process");
 var import_node_fs38 = require("node:fs");
 var import_node_os19 = require("node:os");
 var import_node_path36 = require("node:path");
+init_cli_shared();
 var REVIEW_VERDICT_MARKER = "<!-- zeroci-review v1 -->";
 var REVIEW_VERDICTS = ["PROCEED", "CORRECT", "ESCALATE"];
 function isReviewVerdict(value) {
@@ -38649,6 +38861,7 @@ async function postPrCommentFromFile(number, repo, body) {
 
 // src/pr-create-docs-check.ts
 var import_node_child_process15 = require("node:child_process");
+init_cli_shared();
 var GIT_TIMEOUT_MS2 = 15e3;
 function catFileBatch(root, ref, paths) {
   if (paths.length === 0) return Promise.resolve([]);
@@ -38769,6 +38982,7 @@ async function checkDocsIndexAtHead(opts, deps) {
 }
 
 // src/pr-create-claim-guard.ts
+init_github_client();
 var CLAIM_GUARD_RATE_LIMIT_WAIT_CAP_MS = 3e4;
 function withRateLimitRetry(client, seams = {}) {
   const throttledPaths = /* @__PURE__ */ new Set();
@@ -38827,6 +39041,7 @@ async function prCreateClaimRefusal(body, repoOption, deps = {}) {
 // src/worktree-merge-cleanup.ts
 var import_node_fs40 = require("node:fs");
 var import_node_path38 = require("node:path");
+init_cli_shared();
 
 // src/worktree-evidence-archive.ts
 var import_node_fs39 = require("node:fs");
@@ -41208,6 +41423,9 @@ ${list}`);
 
 // src/command-register-developer.ts
 var import_node_fs46 = require("node:fs");
+init_clean_exit();
+init_cli_shared();
+init_error_codes();
 
 // src/whoami.ts
 async function resolveWhoami(deps) {
@@ -41238,6 +41456,8 @@ async function resolveWhoami(deps) {
 
 // src/command-register-developer.ts
 var import_node_path44 = require("node:path");
+init_house_map();
+init_hub_url();
 
 // src/wave-land.ts
 function planWaveLand(prs) {
@@ -41269,6 +41489,7 @@ async function executeWaveLand(plan, deps) {
 
 // src/box-commands.ts
 var import_node_fs42 = require("node:fs");
+init_clean_exit();
 
 // src/box.ts
 var BOX_KEYS = {
@@ -41676,6 +41897,9 @@ function runDistStatus(root) {
   }
 }
 
+// src/edge-commands.ts
+init_cli_shared();
+
 // src/edge-tunnel.ts
 var HOSTNAME_RE = /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/;
 var UPSTREAM_RE = /^https?:\/\/[^/\s]+(?::\d+)?(?:\/.*)?$/;
@@ -41742,9 +41966,15 @@ function registerEdgeCommands(program3) {
   });
 }
 
+// src/command-register-developer.ts
+init_github_client();
+init_hub_auth();
+
 // src/schedules-lift-command.ts
 var import_promises8 = require("node:fs/promises");
 var import_node_path42 = require("node:path");
+init_clean_exit();
+init_cli_shared();
 var DEFAULT_WORKFLOWS_DIR = ".github/workflows";
 var SCHEDULE_REPO_RE = /^[A-Za-z0-9_.-]+$/;
 var SchedulesLiftUsageError = class extends Error {
@@ -42222,6 +42452,10 @@ function registerDeveloperCommands(program3) {
 
 // src/command-register-train-operations.ts
 var import_promises10 = require("node:fs/promises");
+init_clean_exit();
+init_cli_shared();
+init_client_version();
+init_house_map();
 
 // src/hotfix-apply.ts
 var import_promises9 = require("node:fs/promises");
@@ -43633,6 +43867,9 @@ function checkHotfixCarries(options) {
 // src/train-commands.ts
 var import_node_fs47 = require("node:fs");
 var import_node_path45 = require("node:path");
+init_cli_shared();
+init_clean_exit();
+init_client_version();
 var INVOKED_ARGV = process.argv.slice(2);
 var RELEASE_BUMP_INTENTS = ["major", "minor", "patch"];
 function resolveReleaseBumpIntent(raw) {