@mutmutco/cli 4.5.102 → 4.5.104

package/dist/main.cjs

@@ -6053,6 +6053,16 @@ function isRetryableGitHubWaitReadError(e) {
   }
   return /Something went wrong while executing your query/.test(text) || /^\s*unexpected end of JSON input\s*$/m.test(text);
 }
+function refusalWaitMs(e, nowMs) {
+  const err = e;
+  const text = [err?.stdout, err?.stderr, e instanceof Error ? e.message : ""].filter((t) => typeof t === "string").join("\n");
+  const header = (name) => new RegExp(`^${name}:\\s*(\\d+)\\s*$`, "im").exec(text)?.[1];
+  const retryAfter = header("retry-after");
+  if (retryAfter !== void 0) return Number(retryAfter) * 1e3;
+  const reset = header("x-ratelimit-remaining") === "0" ? Number(header("x-ratelimit-reset")) : typeof err?.rateLimitReset === "number" ? err.rateLimitReset : NaN;
+  if (reset * 1e3 > nowMs) return reset * 1e3 - nowMs;
+  return /secondary rate|abuse detection/i.test(text) ? 6e4 : void 0;
+}
 function waitReadFailureMessage(e) {
   const err = e;
   const stderr = typeof err?.stderr === "string" ? err.stderr.trim() : "";
@@ -6180,9 +6190,21 @@ async function waitForPrChecks(deps) {
         return { policy, status: "failure", reason: waitReadFailureMessage(e), detail: "github-read-failed", waitedMs: now() - started };
       }
       lastDetail = `github-read-transient (${waitReadFailureMessage(e)})`;
-      deps.log?.(`transient GitHub read failure \u2014 retrying within the wait budget: ${lastDetail}`);
-      report("pending");
-      await deps.sleep(PR_CHECKS_POLL_MS);
+      const askedMs = refusalWaitMs(e, now());
+      const jitter = deps.jitterMs ?? (() => Math.floor(Math.random() * PR_CHECKS_RATELIMIT_JITTER_MAX_MS));
+      const waitMs = askedMs !== void 0 && askedMs > PR_CHECKS_POLL_MS ? askedMs + jitter() : PR_CHECKS_POLL_MS;
+      if (askedMs !== void 0 && now() + waitMs >= deadline) {
+        return {
+          policy,
+          status: "rate-limited",
+          reason: `GitHub refused the read for rate limit and asked for ${Math.round(askedMs / 1e3)}s, past the wait deadline (${lastDetail})`,
+          detail: "rate-limited",
+          waitedMs: now() - started
+        };
+      }
+      deps.log?.(`transient GitHub read failure \u2014 retrying in ${Math.round(waitMs / 1e3)}s within the wait budget: ${lastDetail}`);
+      report(askedMs !== void 0 ? "rate-limited" : "pending");
+      await deps.sleep(waitMs);
       continue;
     }
     report(state);
@@ -6300,6 +6322,7 @@ function setPollTokenProvider(provider) {
   pollTokenOnce = void 0;
   resetAppPollGuard();
   lastPollSource = void 0;
+  observedPool.clear();
 }
 async function pollToken() {
   if (!pollTokenProvider) return void 0;
@@ -6351,6 +6374,19 @@ function appPoolDetail() {
   const counts = guard.remaining !== void 0 && guard.limit !== void 0 ? `App pool at ${guard.remaining}/${guard.limit}` : "App pool headroom unverified";
   return guard.resetAtMs !== void 0 ? `${counts}, resets ${new Date(guard.resetAtMs).toISOString()}` : counts;
 }
+var observedPool = /* @__PURE__ */ new Map();
+var OBSERVED_POOL_MAX_AGE_MS = 3 * 6e4;
+function notePoolHeaders(source, out, nowMs) {
+  const { remaining, resetSec } = parseRateLimitHeaders(out);
+  const resource = /^x-ratelimit-resource:\s*(\S+)\s*$/im.exec(out)?.[1];
+  if (remaining !== void 0 && resetSec !== void 0 && (resource ?? "core") === "core") {
+    observedPool.set(source, { remaining, reset: resetSec, atMs: nowMs });
+  }
+}
+function observedCorePool(source, nowMs) {
+  const seen = source ? observedPool.get(source) : void 0;
+  return seen && nowMs - seen.atMs <= OBSERVED_POOL_MAX_AGE_MS && seen.reset * 1e3 > nowMs ? { remaining: seen.remaining, reset: seen.reset } : void 0;
+}
 async function defaultGhApi(args) {
   const appToken = await pollToken();
   let source = appToken && appPollAllowsApp(Date.now()) ? "app" : "user";
@@ -6372,6 +6408,7 @@ async function defaultGhApi(args) {
       const out = e.stdout;
       const errOut = typeof out === "string" ? out : void 0;
       const status = errOut !== void 0 ? parseIncludedOutput(errOut).status : void 0;
+      if (errOut !== void 0) notePoolHeaders(source, errOut, Date.now());
       if (cached && status === 304) {
         lastPollSource = source;
         return cached.body;
@@ -6386,6 +6423,7 @@ async function defaultGhApi(args) {
       throw e;
     }
     const { body, etag, pages } = parseIncludedOutput(stdout);
+    notePoolHeaders(source, stdout, Date.now());
     if (source === "app") noteAppPollResponse(parseRateLimitHeaders(stdout), false, Date.now());
     lastPollSource = source;
     if (etag && pages === 1) etagCache.set(key, { etag, body });
@@ -6858,7 +6896,9 @@ async function fetchRequiredCheckContexts(repo, branch, gh2 = defaultGhApi) {
   }
   return contexts;
 }
-async function fetchRestCorePool(gh2 = defaultGhApi) {
+async function fetchRestCorePool(gh2 = defaultGhApi, nowMs = Date.now()) {
+  const seen = gh2 === defaultGhApi ? observedCorePool(await pollToken() && appPollAllowsApp(nowMs) ? "app" : "user", nowMs) : void 0;
+  if (seen) return { state: "ok", ...seen };
   let core;
   try {
     core = JSON.parse(await gh2(["rate_limit"])).resources?.core;
@@ -14868,7 +14908,7 @@ async function readDefaultBranchGate(repo, client, baseBranch, now = Date.now(),
 async function gateIsProvenGreen(repo, client, baseBranch, gateFiles = DEFAULT_GATE_FILES) {
   return (await readDefaultBranchGate(repo, client, baseBranch, Date.now(), gateFiles)).state === "green";
 }
-async function activateProductRuleset(repo, rulesetBody, client, enforcement = "active") {
+async function activateProductRuleset(repo, rulesetBody, client, enforcement = "active", dryRun = false) {
   const want = new Set(rulesetRequiredContexts({ rules: rulesetBody.rules }));
   const wantStrict = rulesetStrictPolicy({ rules: rulesetBody.rules });
   const wantBranches = rulesetBranchIncludes(rulesetBody);
@@ -14887,10 +14927,10 @@ async function activateProductRuleset(repo, rulesetBody, client, enforcement = "
     if (detail.enforcement === effective && branchesMatch && strictMatch && have.size === want.size && [...want].every((c) => have.has(c))) {
       return { action: "skipped", enforcement: effective, detail: `${effective} ruleset already matches required contexts, branches and up-to-date policy${kept}` };
     }
-    await client.rest("PUT", `repos/${repo}/rulesets/${existing.id}`, { body: { ...rulesetBody, enforcement: effective }, timeoutMs: 2e4 });
+    if (!dryRun) await client.rest("PUT", `repos/${repo}/rulesets/${existing.id}`, { body: { ...rulesetBody, enforcement: effective }, timeoutMs: 2e4 });
     return { action: "updated", enforcement: effective, detail: `ruleset ${existing.id}${kept}` };
   }
-  await client.rest("POST", `repos/${repo}/rulesets`, { body: { ...rulesetBody, enforcement }, timeoutMs: 2e4 });
+  if (!dryRun) await client.rest("POST", `repos/${repo}/rulesets`, { body: { ...rulesetBody, enforcement }, timeoutMs: 2e4 });
   return { action: "created", enforcement };
 }
 async function gateContextEnforced(repo, rest) {
@@ -16126,6 +16166,39 @@ function gateConfigToVars(gate) {
   if (extras.steps?.length) out.GATE_EXTRA_STEPS_YAML = gateExtraStepsYaml(extras.steps);
   return out;
 }
+function suiteModuleSeeds(seeds, suite, deployModel) {
+  if (suite !== "mm-work" || deployModel !== "tenant-container") return seeds;
+  const replacements = {
+    Dockerfile: "suite-Dockerfile.template",
+    "docker-compose.yml": "suite-compose.template.yml",
+    ".github/workflows/gate.yml": "suite-gate.template.yml"
+  };
+  const additions = {
+    "src/index.ts": "suite-server.template.ts",
+    "package.json": "suite-package.template.json",
+    "package-lock.json": "suite-package-lock.template.json",
+    "tsconfig.json": "suite-tsconfig.template.json",
+    "module/package.json": "suite-module-package.template.json",
+    "module/package-lock.json": "suite-module-package-lock.template.json",
+    "module/.npmrc": "suite-npmrc.template",
+    "module/src/module.jsx": "suite-module.template.jsx",
+    "module/vite.config.mjs": "suite-vite.template.mjs",
+    "module/screens/screens.json": "suite-screens.template.json",
+    "module/screens/files.json": "suite-files.template.json",
+    ".github/workflows/screens.yml": "suite-screens.template.yml",
+    "docs/Guides/mm-work-module.md": "suite-guide.template.md"
+  };
+  return [
+    ...seeds.filter((s) => s.target !== "docs/Guides/google-login.md").map((s) => replacements[s.target] ? { ...s, source: `seed:${replacements[s.target]}` } : s),
+    ...Object.entries(additions).map(([target, source]) => ({
+      target,
+      source: `seed:${source}`,
+      ownership: "repo",
+      classes: ["deployable"],
+      deployModels: ["tenant-container"]
+    }))
+  ];
+}
 function seedMatchesDeployModel(seed, deployModel) {
   if (!seed.deployModels?.length) return true;
   return deployModel != null && seed.deployModels.includes(deployModel);
@@ -16307,7 +16380,11 @@ function buildRegisterPayload(repo, cls, vars, options = {}) {
     // Identity. name/division default off the repo name when the skill didn't pass them.
     name: vars.NAME || parsedRepo.name,
     division: vars.DIVISION || parsedRepo.name.split("-")[0] || void 0,
-    suite: vars.SUITE || void 0,
+    suite,
+    ...suite === "mm-work" && deployModel === "tenant-container" ? {
+      requiredBuildSecrets: ["NODE_AUTH_TOKEN=@github-packages-token"],
+      requiredChecks: options.existing?.requiredChecks ?? ["gate"]
+    } : {},
     repos: [`${parsedRepo.owner}/${slug}`],
     branch: vars.BRANCH || (cls === "content" ? "main" : "development"),
     class: cls,
@@ -17622,10 +17699,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.102",
-    tag: "v4.5.102",
-    commit: "69ad9c05771f",
-    npm: "@mutmutco/cli@4.5.102"
+    version: "4.5.104",
+    tag: "v4.5.104",
+    commit: "6bf765dc986c",
+    npm: "@mutmutco/cli@4.5.104"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17642,14 +17719,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.102"
+          v3Target: "v4.5.104"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.102 and redeploy the Hub Lambda from tag v4.5.102 (69ad9c05771f); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.102 (@mutmutco/cli@4.5.102, tag commit 69ad9c05771f \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.104 and redeploy the Hub Lambda from tag v4.5.104 (6bf765dc986c); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.104 (@mutmutco/cli@4.5.104, tag commit 6bf765dc986c \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -28267,7 +28344,7 @@ function planBranchRequiredContexts(input) {
   })).filter((entry) => entry.contexts.length > 0);
   return { common, pending, waiting };
 }
-async function branchContextPlan(deps, repo, authority, meta) {
+async function branchContextPlan(deps, repo, authority, meta, emittedBranchesOnly = false) {
   const branches = resolveRequiredCheckBranches(meta, repo);
   const emittedByBranch = {};
   const unreadable = [];
@@ -28277,7 +28354,10 @@ async function branchContextPlan(deps, repo, authority, meta) {
     emittedByBranch[branch] = await resolveEmittedPrContexts(deps, repo, branch);
     if (presence === void 0 || emittedByBranch[branch] === void 0) unreadable.push(branch);
   }
-  return { ...planBranchRequiredContexts({ contexts: authority.contexts, branches, emittedByBranch }), unreadable };
+  const bindingBranches = emittedBranchesOnly ? branches.filter((branch) => authority.contexts.some((context) => emittedByBranch[branch]?.includes(context))) : branches;
+  const plan = planBranchRequiredContexts({ contexts: authority.contexts, branches: bindingBranches, emittedByBranch });
+  const waiting = planBranchRequiredContexts({ contexts: authority.contexts, branches, emittedByBranch }).waiting;
+  return { ...plan, waiting, unreadable, bindingBranches };
 }
 function projectCommonAuthority(authority, common) {
   const apiPayload = patchRulesetRequiredContexts(authority.apiPayload, common);
@@ -28531,8 +28611,8 @@ async function auditRepoCi(repo, callerDeps) {
         checks.push({
           ok: pendingAligned,
           label: "branch-specific required checks match workflow emitters",
-          detail: pendingAligned ? void 0 : "pending ruleset contexts or branch conditions have not converged to the emitted registry requirements",
-          remediation: pendingAligned ? void 0 : `mmi-cli devops ci reconcile --repo ${repo} --apply`
+          detail: pendingAligned ? void 0 : `pending ruleset contexts or branch conditions have not converged to the emitted registry requirements \u2014 run mmi-cli devops bootstrap apply ${repo} --only product-ruleset --execute`,
+          remediation: pendingAligned ? void 0 : `mmi-cli devops bootstrap apply ${repo} --only product-ruleset --execute`
         });
       }
     }
@@ -28564,7 +28644,7 @@ async function auditRepoCi(repo, callerDeps) {
         checks.push({
           ok: aligned,
           label: RULESET_REFERENCE_MATCH_LABEL,
-          detail: aligned ? `contexts [${authoritativeRuleset.contexts.join(", ")}], branches [${authoritativeRuleset.branchIncludes.join(", ")}] and the up-to-date policy match declared authority` : `${authoritativeRuleset.source} requires contexts [${authoritativeRuleset.contexts.join(", ")}]; ${authoritativeRuleset.branchSource} requires branches [${authoritativeRuleset.branchIncludes.join(", ")}]; ${PRODUCT_RULESET_REF} declares contexts [${authoritativeRuleset.committedContexts.join(", ")}] / branches [${authoritativeRuleset.committedBranchIncludes.join(", ")}] and live ${PRODUCT_RULESET_NAME} has contexts [${liveContexts.join(", ")}] / branches [${liveBranchIncludes.join(", ")}]` + (strictAligned ? "" : `; strict_required_status_checks_policy differs from committed policy \u2014 ${PRODUCT_RULESET_REF} declares ${authoritativeRuleset.committedStrict}, live ${PRODUCT_RULESET_NAME} has ${liveStrict}`),
+          detail: aligned ? `contexts [${authoritativeRuleset.contexts.join(", ")}], branches [${authoritativeRuleset.branchIncludes.join(", ")}] and the up-to-date policy match declared authority` : `${authoritativeRuleset.source} requires contexts [${authoritativeRuleset.contexts.join(", ")}]; ${authoritativeRuleset.branchSource} requires branches [${authoritativeRuleset.branchIncludes.join(", ")}]; ${PRODUCT_RULESET_REF} declares contexts [${authoritativeRuleset.committedContexts.join(", ")}] / branches [${authoritativeRuleset.committedBranchIncludes.join(", ")}] and live ${PRODUCT_RULESET_NAME} has contexts [${liveContexts.join(", ")}] / branches [${liveBranchIncludes.join(", ")}]` + (strictAligned ? "" : `; strict_required_status_checks_policy differs from committed policy \u2014 ${PRODUCT_RULESET_REF} declares ${authoritativeRuleset.committedStrict}, live ${PRODUCT_RULESET_NAME} has ${liveStrict}`) + ` \u2014 live repair: mmi-cli devops bootstrap apply ${repo} --only product-ruleset --execute`,
           remediation: aligned ? void 0 : `mmi-cli devops ci reconcile --repo ${repo} --apply`
         });
       }
@@ -29107,9 +29187,14 @@ async function authoritativeSafetyHold(authority, deps, repo, baseBranch, meta)
   }
   return null;
 }
-async function applyCiReconcileRepo(repo, deps) {
+async function applyCiReconcileRepo(repo, deps, options = {}) {
+  if (options.dryRun && !options.productRulesetOnly) throw new Error("dry-run requires productRulesetOnly");
   const meta = await deps.getProjectMeta(slugFromRepo(repo));
+  if (options.productRulesetOnly && !meta?.requiredChecks?.length) {
+    return { repo, applied: [], skipped: [], errors: ["product-ruleset requires registry META requiredChecks"] };
+  }
   const report = await auditRepoCi(repo, deps);
+  const finish = (result2, pendingReason) => options.productRulesetOnly ? Promise.resolve(result2) : finalizeCiReconcile(repo, deps, result2, report, pendingReason);
   const baseBranch = "development";
   let raw = report.class === "deployable" && !report.explicitNoCi ? await fetchRulesetSeedBody(deps, repo) : null;
   let authority = null;
@@ -29119,12 +29204,12 @@ async function applyCiReconcileRepo(repo, deps) {
       authority = parseAuthoritativeRuleset(raw, meta, repo);
     } catch (e) {
       empty.errors.push(`${PRODUCT_RULESET_REF} is not parseable: ${e.message}`);
-      return finalizeCiReconcile(repo, deps, empty, report);
+      return finish(empty);
     }
     const hold = await authoritativeSafetyHold(authority, deps, repo, baseBranch, meta);
     if (hold) {
       empty.skipped.push(hold);
-      return finalizeCiReconcile(repo, deps, empty, report, hold);
+      return finish(empty, hold);
     }
   } else if (report.class === "deployable" && !report.explicitNoCi) {
     const registryAuthority = registryAuthorityWithoutReference(meta, repo);
@@ -29132,59 +29217,64 @@ async function applyCiReconcileRepo(repo, deps) {
       const hold = await authoritativeSafetyHold(registryAuthority, deps, repo, baseBranch, meta);
       if (hold) {
         empty.skipped.push(hold);
-        return finalizeCiReconcile(repo, deps, empty, report, hold);
+        return finish(empty, hold);
       }
     }
   }
-  const result = await applyCiReconcileMergeSettingsFromReport(repo, deps, report);
+  const result = options.productRulesetOnly ? empty : await applyCiReconcileMergeSettingsFromReport(repo, deps, report);
   if (report.class !== "deployable" || report.explicitNoCi) {
-    return finalizeCiReconcile(repo, deps, result, report);
+    return finish(result);
   }
-  const refDelivery = await seedGateYml(repo, deps, meta, result);
+  const refDelivery = options.productRulesetOnly ? void 0 : await seedGateYml(repo, deps, meta, result);
   if (refDelivery === "pending") {
     const reason = `${PRODUCT_RULESET_REF} is pending on its protected-base source PR; live ruleset convergence waits for that source to merge`;
     result.skipped.push(reason);
-    return finalizeCiReconcile(repo, deps, result, report, reason);
+    return finish(result, reason);
   }
   raw ??= await fetchRulesetSeedBody(deps, repo);
   if (!raw) {
     result.errors.push(`missing ${PRODUCT_RULESET_REF} on development \u2014 run bootstrap apply first`);
-    return finalizeCiReconcile(repo, deps, result, report);
+    return finish(result);
   }
   if (authority == null) {
     try {
       authority = parseAuthoritativeRuleset(raw, meta, repo);
     } catch (e) {
       result.errors.push(`${PRODUCT_RULESET_REF} is not parseable: ${e.message}`);
-      return finalizeCiReconcile(repo, deps, result, report);
+      return finish(result);
     }
     const hold = await authoritativeSafetyHold(authority, deps, repo, baseBranch, meta);
     if (hold) {
       result.skipped.push(hold);
-      return finalizeCiReconcile(repo, deps, result, report, hold);
+      return finish(result, hold);
     }
   }
   if (authority.contexts.length === 0) {
     result.errors.push(`${authority.source} declares no required contexts`);
-    return finalizeCiReconcile(repo, deps, result, report);
+    return finish(result);
   }
   let pendingPlan = null;
   const declaredContexts = authority.contexts;
   if (authority.source === "registry META requiredChecks") {
-    pendingPlan = await branchContextPlan(deps, repo, authority, meta);
+    pendingPlan = await branchContextPlan(deps, repo, authority, meta, options.productRulesetOnly);
     if (pendingPlan.unreadable.length) {
       const reason = `required branch workflow emitters unreadable on [${pendingPlan.unreadable.join(", ")}] \u2014 ruleset convergence deferred`;
       result.skipped.push(reason);
-      return finalizeCiReconcile(repo, deps, result, report, reason);
+      return finish(result, reason);
     }
     if (pendingPlan.common.length === 0) {
       result.errors.push("no common required context is emitted by every required branch \u2014 ruleset convergence deferred");
-      return finalizeCiReconcile(repo, deps, result, report);
+      return finish(result);
     }
     authority = projectCommonAuthority(authority, pendingPlan.common);
+    if (options.productRulesetOnly) {
+      const apiPayload = patchRulesetBranchIncludes(authority.apiPayload, pendingPlan.bindingBranches);
+      authority = { ...authority, apiPayload, branchIncludes: rulesetBranchIncludes(apiPayload) };
+      for (const entry of pendingPlan.waiting) result.skipped.push(`${entry.branch} waits for workflow emitter(s) [${entry.contexts.join(", ")}]`);
+    }
   }
   const sourceNeedsConvergence = !sameContexts(authority.committedContexts, authority.contexts) || !sameContexts(authority.committedBranchIncludes, authority.branchIncludes) || !authority.committedStrict;
-  if (sourceNeedsConvergence) {
+  if (sourceNeedsConvergence && !options.productRulesetOnly) {
     try {
       const delivery = await deliverSeedFile(
         deps,
@@ -29201,15 +29291,15 @@ async function applyCiReconcileRepo(repo, deps) {
           `${PRODUCT_RULESET_REF} authority \u2192 contexts [${authority.contexts.join(", ")}], branches [${authority.branchIncludes.join(", ")}] delivered on ${delivery.plan.branch} (${delivery.plan.reason})${delivery.prUrl ? `: ${delivery.prUrl}` : ""}`
         );
         const reason = `${PRODUCT_RULESET_REF} authority is pending on its protected-base source PR; live ruleset convergence waits for that source to merge`;
-        return finalizeCiReconcile(repo, deps, result, report, reason);
+        return finish(result, reason);
       } else {
         result.applied.push(`reconciled ${PRODUCT_RULESET_REF} authority \u2192 contexts [${authority.contexts.join(", ")}], branches [${authority.branchIncludes.join(", ")}]`);
       }
     } catch (e) {
       result.errors.push(`ruleset reference delivery failed: ${e.message}`);
-      return finalizeCiReconcile(repo, deps, result, report);
+      return finish(result);
     }
-  } else {
+  } else if (!options.productRulesetOnly) {
     result.skipped.push(`${PRODUCT_RULESET_REF} already matches declared context and branch authority`);
   }
   let live;
@@ -29217,7 +29307,7 @@ async function applyCiReconcileRepo(repo, deps) {
     live = await readLiveProductRuleset(deps, repo);
   } catch (e) {
     result.errors.push(`cannot read the live ${PRODUCT_RULESET_NAME} ruleset: ${e.message}`);
-    return finalizeCiReconcile(repo, deps, result, report);
+    return finish(result);
   }
   const liveContexts = live == null ? [] : sortedUnique(rulesetRequiredContexts(live));
   const liveBranchIncludes = live == null ? [] : rulesetBranchIncludes(live);
@@ -29235,7 +29325,7 @@ async function applyCiReconcileRepo(repo, deps) {
   if (pendingPlan?.pending.some((entry) => entry.contexts.some((context) => unsafe.includes(context)))) {
     const reason = `pending required-check rulesets left non-enforcing \u2014 [${unsafe.join(", ")}] emitted only by path-filtered workflows`;
     result.skipped.push(reason);
-    return finalizeCiReconcile(repo, deps, result, report, reason);
+    return finish(result, reason);
   }
   const gateProvenGreen = await gateIsProvenGreen(repo, deps.client, baseBranch, gateFiles);
   const plan = resolveProductRulesetReconcilePlan({
@@ -29252,25 +29342,25 @@ async function applyCiReconcileRepo(repo, deps) {
   if (!plan.shouldActivate) {
     if (plan.holdReason) {
       result.skipped.push(plan.holdReason);
-      return finalizeCiReconcile(repo, deps, result, report, plan.holdReason);
+      return finish(result, plan.holdReason);
     }
     result.skipped.push(`live ${PRODUCT_RULESET_NAME} contexts, branches and up-to-date policy already match declared authority`);
   }
   if (plan.shouldActivate) {
     try {
-      const activation = await activateProductRuleset(repo, authority.apiPayload, deps.client, plan.targetEnforcement);
+      const activation = await activateProductRuleset(repo, authority.apiPayload, deps.client, plan.targetEnforcement, options.dryRun);
       if (activation.action === "skipped") result.skipped.push(activation.detail ?? "product ruleset");
-      else result.applied.push(`product ruleset ${activation.action}${activation.detail ? `: ${activation.detail}` : ""}`);
+      else result.applied.push(`product ruleset ${activation.action} (${activation.enforcement}; contexts [${authority.contexts.join(", ")}], branches [${authority.branchIncludes.join(", ")}])${activation.detail ? `: ${activation.detail}` : ""}`);
     } catch (e) {
       result.errors.push(e.message);
-      return finalizeCiReconcile(repo, deps, result, report);
+      return finish(result);
     }
   }
   if (pendingPlan) {
     if (pendingPlan.pending.length > 0 && !gateProvenGreen) {
       const reason = "pending required-check rulesets left non-enforcing \u2014 the gate is not green on development";
       result.skipped.push(reason);
-      return finalizeCiReconcile(repo, deps, result, report, reason);
+      return finish(result, reason);
     }
     try {
       const desired = /* @__PURE__ */ new Set();
@@ -29286,20 +29376,20 @@ async function applyCiReconcileRepo(repo, deps) {
           patchRulesetRequiredContexts(statusOnly, entry.contexts),
           [entry.branch]
         );
-        const activation = await activateProductRuleset(repo, payload, deps.client);
-        (activation.action === "skipped" ? result.skipped : result.applied).push(`${name}: ${activation.action}`);
+        const activation = await activateProductRuleset(repo, payload, deps.client, "active", options.dryRun);
+        (activation.action === "skipped" ? result.skipped : result.applied).push(`${name}: ${activation.action} \u2014 contexts [${entry.contexts.join(", ")}]`);
       }
       const list = await deps.client.rest("GET", `repos/${repo}/rulesets`);
       for (const stale of list ?? []) {
         if (!stale.name?.startsWith(PRODUCT_PENDING_RULESET_PREFIX) || desired.has(stale.name) || stale.id == null) continue;
-        await deps.client.rest("DELETE", `repos/${repo}/rulesets/${stale.id}`);
+        if (!options.dryRun) await deps.client.rest("DELETE", `repos/${repo}/rulesets/${stale.id}`);
         result.applied.push(`deleted converged ${stale.name}`);
       }
     } catch (e) {
       result.errors.push(`pending ruleset convergence failed: ${e.message}`);
     }
   }
-  return finalizeCiReconcile(repo, deps, result, report);
+  return finish(result);
 }
 
 // src/command-composition.ts
@@ -33937,14 +34027,15 @@ function deployRowChecks(repo, deployModel, releaseTrack, facts, factsRead, suit
     };
   });
 }
-function edgeCertificateChecks(results) {
+function edgeCertificateChecks(results, repo) {
   return results.flatMap((result) => {
     if (!result) return [];
     const { stage, status, error } = result;
+    const fix = status?.missing && !status.pending ? ` \u2014 run: mmi-cli devops runtime edge cert ensure ${repo} ${stage}` : "";
     return [{
       ok: !error && (status?.required === false || status?.required === true && status.missing === false),
       label: `Cloudflare edge certificate: ${stage}`,
-      detail: error ? `certificate coverage unreadable (${error}); cannot verify TLS` : status?.hint
+      detail: error ? `certificate coverage unreadable (${error}); cannot verify TLS` : status?.hint && `${status.hint}${fix}`
     }];
   });
 }
@@ -34008,6 +34099,8 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
       detail: exactAllowlist ? void 0 : ownersUnverified ? "org owner baseline is unreadable or empty; the exact restriction is unverified" : deps.pushAllowlistOwnersRead === true ? "restriction must contain exactly the org owners + mmi-github-app and no teams" : "restrictions.users is empty or unset"
     });
   }
+  const packageAccess = suiteModulePackageAccessCheck(deps.projectMeta?.suite, deps.deployModel);
+  if (packageAccess) checks.push(packageAccess);
   let environmentDrift2 = [];
   try {
     environmentDrift2 = await verifyRepoEnvironments(repo, effectiveTrack, deps.client, deps.projectMeta?.suite);
@@ -34091,7 +34184,7 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
     const check = npmrcGitHubPackagesAuthCheck(path2, await contentText(deps, repo, baseBranch, path2));
     if (check) checks.push(check);
   }
-  checks.push(...edgeCertificateChecks(deps.edgeCertificates ?? []));
+  checks.push(...edgeCertificateChecks(deps.edgeCertificates ?? [], repo));
   checks.push(...edgeDnsChecks(deps.edgeDns ?? [], repo));
   const portRangeCheck = centralContainerPortRangeCheck(deps.deployModel, deps.projectMeta?.portRange, repo);
   if (portRangeCheck) checks.push(portRangeCheck);
@@ -34349,6 +34442,14 @@ function laneNotEvaluatedFromThisBranch(doctor) {
   const only = reasons.length === 1 ? reasons[0] : void 0;
   return only?.code === "branch-mismatch" ? only.title : void 0;
 }
+function suiteModulePackageAccessCheck(suite, deployModel) {
+  if (suite !== "mm-work" || deployModel !== "tenant-container") return void 0;
+  return {
+    ok: true,
+    label: "mmwork-ds + mmwork-screens package access (manual org-admin step; unverified)",
+    detail: `An org admin must add this repository with Read under BOTH @mutmutco/mmwork-ds and @mutmutco/mmwork-screens \u2192 Package settings \u2192 Manage Actions access (#7984). No GitHub REST API can verify or grant this; without it the image build or the screens job fails with 403 read_package. Once screens is green, require it: mmi-cli oracle org project set <owner/repo> --var 'requiredChecks=["gate","screens / screens"]'.`
+  };
+}
 function attachTrainDoctorVerdicts(report, trainDoctors) {
   const marked = trainDoctors.map((doctor) => {
     const notEvaluatedFromThisBranch = laneNotEvaluatedFromThisBranch(doctor);
@@ -34742,7 +34843,7 @@ function registerBootstrapCommands(program3) {
     }
     if (findings.some((f) => f.state !== "waived")) process.exitCode = 1;
   });
-  bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").addOption(new Option("--class <class>", "deployable | content").default("deployable").choices(["deployable", "content"])).addOption(new Option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).choices([...PROJECT_TYPES])).addOption(new Option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).choices([...DEPLOY_MODELS])).addOption(new Option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).choices([...RELEASE_TRACKS])).option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--box <name>", "resolve this live box and plan free registry DEPLOY# ports (container deploy models)").option("--domains <stages>", "optional comma-separated dev=host,rc=host,main=host deploy domains (requires --box)").option("--only <target>", "deliver ONLY this manifest target (#3818) \u2014 one file, no labels/ruleset/registry writes; or the special target environments (#5035) to run the deployment-environment reconcile alone (dry-run classifies, --execute writes)").option("--from-config", "with --only gate.yml: adopt an equal legacy gate with a render stamp, then update from registry config via review PR; refuse hand edits").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo, cmdOpts) => {
+  bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").addOption(new Option("--class <class>", "deployable | content").default("deployable").choices(["deployable", "content"])).addOption(new Option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).choices([...PROJECT_TYPES])).addOption(new Option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).choices([...DEPLOY_MODELS])).addOption(new Option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).choices([...RELEASE_TRACKS])).option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--box <name>", "resolve this live box and plan free registry DEPLOY# ports (container deploy models)").option("--domains <stages>", "optional comma-separated dev=host,rc=host,main=host deploy domains (requires --box)").option("--only <target>", "deliver ONLY this manifest target (#3818) \u2014 one file, no labels/ruleset/registry writes; or the special targets environments (#5035) / product-ruleset (#7986) to reconcile only that live surface (dry-run classifies, --execute writes)").option("--from-config", "with --only gate.yml: adopt an equal legacy gate with a render stamp, then update from registry config via review PR; refuse hand edits").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo, cmdOpts) => {
     const o = {
       class: rawValue("--class", "deployable"),
       projectType: rawValue("--project-type", ""),
@@ -34829,6 +34930,26 @@ function registerBootstrapCommands(program3) {
       }
       return;
     }
+    if (o.only.trim() === "product-ruleset") {
+      if (cmdOpts.var?.length) return fail("bootstrap apply: --only product-ruleset accepts no --var overrides; set registry META instead");
+      const read = await fetchProjectBySlugChecked(parsedRepo.slug, registryClientDeps(await loadConfig()));
+      if (!read.ok) return failGraceful(`bootstrap apply: registry META unreadable (${read.error}); refusing product ruleset reconciliation`);
+      if (!read.project?.requiredChecks?.length) return failGraceful("bootstrap apply: --only product-ruleset requires registry META requiredChecks");
+      const result = await applyCiReconcileRepo(repo, {
+        client: defaultGitHubClient(),
+        listProjects: async () => [],
+        getProjectMeta: async () => read.project
+      }, { productRulesetOnly: true, dryRun: !o.execute });
+      if (o.json) console.log(JSON.stringify(result, null, 2));
+      else {
+        console.log(`bootstrap apply --only product-ruleset \u2014 ${o.execute ? "LIVE" : "dry-run; no writes"} (${repo}):`);
+        result.applied.forEach((line) => console.log(`  ${o.execute ? "APPLY" : "PLAN"} ${line}`));
+        result.skipped.forEach((line) => console.log(`  SKIP ${line}`));
+        result.errors.forEach((line) => console.error(`  REFUSED ${line}`));
+      }
+      if (result.errors.length) return failGraceful("bootstrap apply: product ruleset reconciliation failed");
+      return;
+    }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
     if (!(0, import_node_fs28.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
@@ -34837,13 +34958,6 @@ function registerBootstrapCommands(program3) {
     const baseBranch = o.class === "content" ? "main" : "development";
     const slug = parsedRepo.slug;
     const onlyTarget = o.fromConfig && o.only.trim() === "gate.yml" ? ".github/workflows/gate.yml" : o.only.trim();
-    const seedsToApply = onlyTarget ? manifest.seeds.filter((s) => s.target === onlyTarget || s.target.replace("{{REPO_SLUG}}", slug) === onlyTarget) : manifest.seeds;
-    if (onlyTarget && !seedsToApply.length) {
-      const known = manifest.seeds.map((s) => s.target).join("\n  ");
-      return fail(`bootstrap apply: --only '${onlyTarget}' names no seed in ${manifestPath}. Declared targets:
-  ${known}`);
-    }
-    const onlyManagedBlock = onlyTarget ? seedsToApply[0]?.managedBlock != null : false;
     const gh2 = async (args) => execFileP("gh", args, { timeout: 2e4 });
     const readFile10 = (p) => (0, import_node_fs28.existsSync)(p) ? (0, import_node_fs28.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
@@ -34913,6 +35027,21 @@ function registerBootstrapCommands(program3) {
       applyProjectType = o.projectType || registryMeta?.projectType || payload.projectType;
     } catch {
     }
+    const availableSeeds = suiteModuleSeeds(manifest.seeds, vars.SUITE || registryMeta?.suite, applyDeployModel);
+    const seedsToApply = onlyTarget ? availableSeeds.filter((s) => s.target === onlyTarget || s.target.replace("{{REPO_SLUG}}", slug) === onlyTarget) : availableSeeds;
+    if (onlyTarget && !seedsToApply.length) {
+      return fail(`bootstrap apply: --only '${onlyTarget}' names no seed for this project. Declared targets:
+  ${availableSeeds.map((s) => s.target).join("\n  ")}`);
+    }
+    const onlyManagedBlock = onlyTarget ? seedsToApply[0]?.managedBlock != null : false;
+    if (vars.SUITE === "mm-work" || registryMeta?.suite === "mm-work") {
+      if (applyDeployModel === "tenant-container") {
+        const requiredChecks = registryMeta?.requiredChecks ?? ["gate"];
+        const moduleGate = withDerivedRepoVars({}, parsedRepo, o.class, effectiveTrack, registryRequiredCheckBranches, requiredChecks);
+        vars.GATE_RULESET_CONTEXTS_JSON = moduleGate.GATE_RULESET_CONTEXTS_JSON;
+        if (registryMeta) registryMeta = { ...registryMeta, requiredChecks };
+      }
+    }
     const controlClient = defaultGitHubClient();
     let controlOwners = [];
     let controlDeployFacts = null;
@@ -53292,6 +53421,17 @@ function registerEdgeCommands(program3) {
       fail(`runtime edge dns: ${e.message}`);
     }
   });
+  edge.command("cert <action> <owner/repo> <stage>").description("read (`status`) or order-when-missing (`ensure`, master-only) the Cloudflare advanced edge certificate pack (<x> + *.<x>) a dev/rc host needs").action(async (action, repo, stage) => {
+    if (action !== "status" && action !== "ensure") return fail("runtime edge cert: <action> must be status or ensure");
+    if (stage !== "dev" && stage !== "rc") return fail("runtime edge cert: <stage> must be dev or rc (main is covered by the zone certificate)");
+    try {
+      const result = await edgeCertificateForStage(slugOf(repo), stage, registryClientDeps(await loadConfig()), action === "ensure");
+      console.log(JSON.stringify(result, null, 2));
+      if (result.required && result.missing) process.exitCode = 1;
+    } catch (e) {
+      fail(`runtime edge cert: ${e.message}`);
+    }
+  });
 }
 
 // src/command-register-developer.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.102",
+  "version": "4.5.104",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",