@mutmutco/cli 4.5.24 → 4.5.26

package/dist/main.cjs

@@ -791,6 +791,8 @@ var init_house_map = __esm({
       // register/run/park schedule rows under the one lane contract
       // --- devops — shipping --------------------------------------------------------------------------
       pr: "devops",
+      api: "devops",
+      // allowlisted GitHub REST GET reads for automation (pull files, compare, contents)
       ci: "devops",
       // the CI/gate audit
       rcand: "devops",
@@ -1043,9 +1045,21 @@ function mutating(cmd, planFn) {
   return cmd;
 }
 function installProcessBackstop() {
+  installBrokenPipeGuard(process.stdout);
+  installBrokenPipeGuard(process.stderr);
   process.on("unhandledRejection", (reason) => void failGraceful(reason instanceof Error ? reason.message : String(reason)));
   process.on("uncaughtException", (err) => void failGraceful(err instanceof Error ? err.message : String(err)));
 }
+function installBrokenPipeGuard(stream) {
+  stream.on("error", (err) => {
+    if (err?.code !== "EPIPE") throw err;
+    stream.write = (_chunk, enc, cb) => {
+      const done = typeof enc === "function" ? enc : cb;
+      if (typeof done === "function") queueMicrotask(() => done());
+      return true;
+    };
+  });
+}
 function rawFlag(flag) {
   return process.argv.some((arg) => arg === flag || arg.startsWith(`${flag}=`));
 }
@@ -6537,6 +6551,10 @@ async function filterDependencyBlockedClaimables(items, client, opts = {}) {
       }
       let body = item.details?.body;
       if (body === void 0) {
+        if (item.detailsUnavailable) {
+          results[index] = { bucket: "claimable", item, warnings: [] };
+          continue;
+        }
         if (opts.requireBundledBody) {
           results[index] = { bucket: "claimable", item, warnings: [] };
           continue;
@@ -6544,7 +6562,7 @@ async function filterDependencyBlockedClaimables(items, client, opts = {}) {
         try {
           const data = await client.rest("GET", `repos/${item.repository}/issues/${item.number}`);
           body = data?.body ?? "";
-          item.details = { body, comments: item.details?.comments ?? [] };
+          item.details = { body, comments: item.details?.comments ?? [], ...item.details?.comments === void 0 ? { commentsUnread: true } : {} };
         } catch (e) {
           results[index] = {
             bucket: "claimable",
@@ -8026,7 +8044,7 @@ async function probeHttpBounded(url, timeoutMs = 5e3) {
 }
 async function probePublicHealth(publicUrl) {
   const root = await probeHttpBounded(publicUrl);
-  if (root.status !== 401 && root.status !== 403) return root;
+  if (root.status !== 401 && root.status !== 403 && root.status !== 404) return root;
   return probeHttpBounded(`${publicUrl.replace(/\/$/, "")}/health`);
 }
 var TENANT_DEPLOY_RUN_SCAN_LIMIT = 100;
@@ -8048,7 +8066,7 @@ function tenantRuntimeHints(stage, fact, probe, edgeCertificate) {
   if (!fact.sshHostPresent && fact.substrate === "hetzner-ssh") hints.push(`DEPLOY#${stage} has hetzner-ssh substrate but no sshHost presence; tenant-deploy cannot reach the box.`);
   if (!fact.domain) hints.push(`DEPLOY#${stage} has no edgeVhost.domain; Cloudflare/Caddy public URL cannot be derived.`);
   if (typeof fact.port !== "number") hints.push(`DEPLOY#${stage} has no edgeVhost.port; Caddy upstream/healthUrl hints cannot be checked.`);
-  if (probe?.url?.endsWith("/health") && probe.ok === false) hints.push(`Root is auth-walled (401/403) and ${probe.url} answered ${probe.status ?? probe.error}; expose a 2xx /health route or fix the app \u2014 the edge is fine.`);
+  if (probe?.url?.endsWith("/health") && probe.ok === false) hints.push(`Root answered 401/403/404 and ${probe.url} answered ${probe.status ?? probe.error}; the app is up and the edge is fine \u2014 expose a 2xx /health route to make this probe green.`);
   else if (edgeCertificate?.missing && edgeCertificate.hint) hints.push(edgeCertificate.hint);
   else if (probe?.ok === false || probe?.status != null && probe.status >= 500) hints.push("Public URL probe failed; for Cloudflare 525 check Caddy TLS/origin certificate and Cloudflare SSL mode before changing app code.");
   if (stage === "rc") hints.push("rc runtime is expected to be ephemeral: present between /rcand and /release, then retired after release.");
@@ -12447,6 +12465,7 @@ function renderBoardSource() {
   return "source: live";
 }
 async function collectBoardPreferringSnapshot(cfg, options, deps) {
+  if (options.snapshotOnly && !deps.snapshot) throw new Error("--snapshot-only needs the Hub snapshot transport (not with --direct)");
   const attempt = deps.snapshot ? await fetchHubBoardSnapshot(
     {
       owner: cfg.projectOwner,
@@ -12486,6 +12505,9 @@ async function collectBoardPreferringSnapshot(cfg, options, deps) {
       snapshot
     };
   }
+  if (options.snapshotOnly && attempt?.state === "unavailable") {
+    throw new Error(`Hub board snapshot unavailable (${attempt.reason}) \u2014 --snapshot-only refuses the direct user-auth fallback`);
+  }
   const collected = await collectBoardItems(cfg, { repo: options.repo, allowPartial: options.allowPartial, activeOnly: true }, deps);
   if (attempt?.state === "unavailable") {
     collected.warnings.push(`Hub board snapshot unavailable (${attempt.reason}) \u2014 served by the direct user-auth read (emergency fallback)`);
@@ -12768,7 +12790,13 @@ function nodeToItem(node, cfg) {
       priorityOptionId: fields.priority?.optionId,
       assignees,
       labels,
-      type: labels.find((label) => TYPE_LABELS.includes(label))
+      type: labels.find((label) => TYPE_LABELS.includes(label)),
+      ...content.__typename === "Issue" && content.claimEvidenceUnavailable ? { detailsUnavailable: "App-token claim evidence unread" } : {},
+      ...content.__typename === "Issue" && typeof content.body === "string" && Array.isArray(content.comments?.nodes) && typeof content.comments.totalCount === "number" && Number.isInteger(content.comments.totalCount) && content.comments.totalCount >= content.comments.nodes.length ? { details: {
+        body: content.body,
+        comments: content.comments.nodes.map((comment) => ({ author: comment.author?.login ?? "", body: comment.body ?? "" })),
+        ...content.comments.totalCount > content.comments.nodes.length ? { omittedComments: content.comments.totalCount - content.comments.nodes.length } : {}
+      } } : {}
     })
   };
 }
@@ -12783,7 +12811,8 @@ async function attachBundleDetails(report, client, allowPartial, options = {}) {
     while (next < candidates.length) {
       const item = candidates[next++];
       try {
-        item.details = await fetchIssueDetails(client, item.repository, item.number);
+        if (!item.details && !item.detailsUnavailable) item.details = await fetchIssueDetails(client, item.repository, item.number);
+        if (!item.details) continue;
         const claim = boardItemClaim(item);
         if (claim) item.claim = claim;
       } catch (e) {
@@ -13017,7 +13046,8 @@ async function demoteLiveClaimedClaimables(scope, client, actor = describeSessio
   const warnings = [];
   let partial = false;
   const fetchComments = deps.fetchComments ?? (async (item) => {
-    if (item.details) return item.details.comments;
+    if (item.detailsUnavailable) return void 0;
+    if (item.details && !item.details.commentsUnread && !item.details.omittedComments) return item.details.comments;
     const comments = await client.restPaginate(`repos/${item.repository}/issues/${item.number}/comments`);
     return comments.map((comment) => ({ body: comment.body ?? "" }));
   });
@@ -13600,11 +13630,6 @@ async function prepareClaimContext(options, selectors, deps, collected, snapshot
     warnings: collected.warnings,
     partial: collected.partial
   };
-  for (const scope of ["primary", "secondary"]) {
-    const filtered = await filterDependencyBlockedClaimables(report[scope].claimable, client);
-    report[scope].claimable = filtered.claimable;
-    report.warnings.push(...filtered.warnings);
-  }
   return {
     cfg,
     client,
@@ -14061,7 +14086,7 @@ init_github_client();
 var PRODUCT_RULESET_NAME = "mmi-product-required-checks";
 var PRODUCT_GATE_CONTEXT = "gate";
 var PRODUCT_RULESET_PATH = ".github/rulesets/mmi-product-required-checks.json";
-function reseedProductRulesetStrictness(current, seed) {
+function reseedProductRulesetStrictness(current, seed, declared = {}) {
   const parse = (raw) => {
     const policy2 = JSON.parse(raw);
     if (!policy2 || typeof policy2 !== "object" || Array.isArray(policy2) || policy2.name !== PRODUCT_RULESET_NAME || policy2.target !== "branch" || !Array.isArray(policy2.rules) || policy2.rules.some((r) => !r || typeof r !== "object" || Array.isArray(r) || typeof r.type !== "string")) {
@@ -14074,14 +14099,28 @@ function reseedProductRulesetStrictness(current, seed) {
     }
     return { policy: policy2, parameters: parameters2 };
   };
-  const strict = parse(seed).parameters.strict_required_status_checks_policy;
+  const canonical = parse(seed);
+  const strict = canonical.parameters.strict_required_status_checks_policy;
   if (typeof strict !== "boolean") throw new Error("canonical product ruleset must declare boolean strictness");
   if (current === null) return seed;
   const { policy, parameters } = parse(current);
-  if (parameters.strict_required_status_checks_policy === strict) return current;
+  let changed = parameters.strict_required_status_checks_policy !== strict;
   parameters.strict_required_status_checks_policy = strict;
-  return `${JSON.stringify(policy, null, 2)}
-`;
+  if (declared.requiredChecks) {
+    const checks = canonical.parameters.required_status_checks.map((check) => parameters.required_status_checks.find((old) => old.context === check.context) ?? check);
+    if (JSON.stringify(parameters.required_status_checks) !== JSON.stringify(checks)) changed = true;
+    parameters.required_status_checks = checks;
+  }
+  if (declared.requiredCheckBranches) {
+    const refs = canonical.policy.conditions?.ref_name?.include;
+    if (!Array.isArray(refs) || !refs.length) throw new Error("canonical product ruleset must declare branch includes");
+    const conditions = policy.conditions;
+    const refName = conditions?.ref_name;
+    if (JSON.stringify(refName?.include) !== JSON.stringify(refs)) changed = true;
+    policy.conditions = { ...conditions, ref_name: { ...refName, include: refs } };
+  }
+  return changed ? `${JSON.stringify(policy, null, 2)}
+` : current;
 }
 function stripRulesetComment(raw) {
   const parsed = JSON.parse(raw);
@@ -15398,6 +15437,20 @@ function labelsToPrune(orgLabelNames) {
   const org = new Set(orgLabelNames);
   return GITHUB_DEFAULT_LABELS.filter((name) => !org.has(name));
 }
+function planBootstrapLabels(labels, live) {
+  const existing = new Set(live.map((label) => label.name));
+  return [
+    ...labels.map((label) => ({ name: label.name, action: existing.has(label.name) ? "UPDATE" : "CREATE" })),
+    ...labelsToPrune(labels.map((label) => label.name)).filter((name) => existing.has(name)).map((name) => ({ name, action: "DELETE" }))
+  ];
+}
+function renderBootstrapAncillaryPlan(labels, environments) {
+  return [
+    "bootstrap apply \u2014 labels and environments (dry-run; no mutations):",
+    ...labels.map(({ action, name }) => `  ${action} label ${name}`),
+    ...environments.map(({ action, environment, reason }) => `  ${action} environment ${environment} (${reason})`)
+  ].join("\n");
+}
 function resolveSeedContent(seed, vars, readFile9) {
   if (seed.source === "self") return readFile9(seed.target);
   if (seed.source.startsWith("seed:")) {
@@ -15418,6 +15471,11 @@ function resolveSeedWriteContent(seed, vars, readFile9, remoteContent) {
   const result = upsertManagedSeedBlock(base, desired, seed.managedBlock.begin, seed.managedBlock.end);
   return result.ok ? { ok: true, content: result.content, managed: true } : { ok: false, reason: result.reason, managed: true };
 }
+function edgeCertificateStagesForBootstrap(track, domains) {
+  if (!domains || typeof domains !== "object" || Array.isArray(domains)) return [];
+  const stages = branchesForTrack(track);
+  return ["dev", "rc"].filter((stage) => stages.includes(stage === "dev" ? "development" : stage) && Boolean(domains[stage]));
+}
 function buildRegisterPayload(repo, cls, vars, options = {}) {
   const parsedRepo = parseOwnerRepo(repo);
   const slug = parsedRepo.slug;
@@ -15442,6 +15500,12 @@ function buildRegisterPayload(repo, cls, vars, options = {}) {
     );
   }
   const deployModel = inferDeployModelForWrite({ ...shape, projectType }, parsedRepo.fullName);
+  const releaseTrack = (isReleaseTrack(options.releaseTrack) ? options.releaseTrack : void 0) ?? (isReleaseTrack(options.existing?.releaseTrack) ? options.existing.releaseTrack : void 0) ?? resolveBootstrapReleaseTrack(cls, void 0);
+  const inferredDomains = inferEdgeDomainsForWrite(slug);
+  const derivedDomains = Object.fromEntries(branchesForTrack(releaseTrack).map((branch) => {
+    const stage = branch === "development" ? "dev" : branch;
+    return [stage, inferredDomains[stage]];
+  }));
   const num = (v) => {
     if (v == null || v === "") return void 0;
     const n = Number(v);
@@ -15471,10 +15535,9 @@ function buildRegisterPayload(repo, cls, vars, options = {}) {
     deployModel,
     // Persist the canonical stage hosts at the same write-time boundary as deployModel. Read paths never
     // infer from an absent edgeDomains field.
-    edgeDomains: options.existing?.edgeDomains ?? inferEdgeDomainsForWrite(slug),
+    edgeDomains: options.existing?.edgeDomains ?? derivedDomains,
     // #1359: always persist an explicit track so release tooling never guesses from absence alone.
-    // #7134: an explicit flag wins, then the registered track, then the class default (first bootstrap).
-    releaseTrack: options.releaseTrack ?? (isReleaseTrack(options.existing?.releaseTrack) ? options.existing.releaseTrack : void 0) ?? resolveBootstrapReleaseTrack(cls, void 0),
+    releaseTrack,
     // Board coords (from GraphQL at bootstrap, passed as --var by the skill).
     projectOwner: vars.PROJECT_OWNER || void 0,
     projectNumber: num(vars.PROJECT_NUMBER),
@@ -16753,10 +16816,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.24",
-    tag: "v4.5.24",
-    commit: "4d303073492a",
-    npm: "@mutmutco/cli@4.5.24"
+    version: "4.5.26",
+    tag: "v4.5.26",
+    commit: "f5ca4e782979",
+    npm: "@mutmutco/cli@4.5.26"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -16773,14 +16836,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.24"
+          v3Target: "v4.5.26"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.24 and redeploy the Hub Lambda from tag v4.5.24 (4d303073492a); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.24 (@mutmutco/cli@4.5.24, tag commit 4d303073492a \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.26 and redeploy the Hub Lambda from tag v4.5.26 (f5ca4e782979); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.26 (@mutmutco/cli@4.5.26, tag commit f5ca4e782979 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -17108,7 +17171,7 @@ function ensureField(fields, field) {
   return list.join(",");
 }
 function resolveIssueViewGhFields(normalized) {
-  const requested = normalized.split(",").map((f) => f.trim()).filter((f) => f && f !== "parent");
+  const requested = normalized.split(",").map((f) => f.trim()).filter((f) => f && f !== "parent" && f !== "closedBy");
   if (requested.length === 0) return { ghFields: "number", numberIsTransport: true };
   return { ghFields: requested.join(","), numberIsTransport: false };
 }
@@ -17144,11 +17207,11 @@ var QueryReadError = class extends Error {
     this.code = code;
   }
 };
-function clampLimit(n, dflt) {
+function clampLimit(n, dflt, max = MAX_LIMIT) {
   if (n === void 0 || !Number.isFinite(n)) return dflt;
   const v = Math.floor(n);
   if (v < 1) return 1;
-  if (v > MAX_LIMIT) return MAX_LIMIT;
+  if (v > max) return max;
   return v;
 }
 function isGhNotFound(e) {
@@ -17175,10 +17238,12 @@ function loginsOf(v) {
 function namesOf(v) {
   return Array.isArray(v) ? v.map((a) => String(a?.name ?? "")).filter(Boolean) : [];
 }
+var ISSUE_LIST_MAX_LIMIT = 1e3;
 function buildIssueListArgs(opts, repo) {
-  const limit = clampLimit(opts.limit, DEFAULT_LIMIT);
+  const limit = clampLimit(opts.limit, DEFAULT_LIMIT, ISSUE_LIST_MAX_LIMIT);
   const state = opts.state ?? "open";
-  const args = ["issue", "list", "--repo", repo, "--state", state, "--limit", String(limit), "--json", ISSUE_LIST_FIELDS];
+  const fields = opts.withBody ? `${ISSUE_LIST_FIELDS},body` : ISSUE_LIST_FIELDS;
+  const args = ["issue", "list", "--repo", repo, "--state", state, "--limit", String(limit), "--json", fields];
   if (opts.label) args.push("--label", opts.label);
   if (opts.assignee) args.push("--assignee", opts.assignee);
   if (opts.search) args.push("--search", opts.search);
@@ -17194,7 +17259,8 @@ function shapeIssueList(rows) {
       state: String(row.state ?? ""),
       url: String(row.url ?? ""),
       assignees: loginsOf(row.assignees),
-      labels: namesOf(row.labels)
+      labels: namesOf(row.labels),
+      ...typeof row.body === "string" ? { body: row.body } : {}
     };
   });
 }
@@ -17203,7 +17269,8 @@ async function runIssueList(deps, opts) {
   if (!repo) {
     throw new QueryReadError("BAD_INPUT", `could not resolve repo (pass --repo <owner/repo>)`);
   }
-  const rows = await deps.ghJson(buildIssueListArgs(opts, repo), GH_LIST_TIMEOUT_MS);
+  const timeout = (opts.limit ?? 0) > MAX_LIMIT ? GH_LIST_TIMEOUT_MS * 4 : GH_LIST_TIMEOUT_MS;
+  const rows = await deps.ghJson(buildIssueListArgs(opts, repo), timeout);
   return shapeIssueList(rows);
 }
 function childrenGraphqlArgs(owner, name, number) {
@@ -17597,6 +17664,45 @@ async function runPrForIssue(deps, issueRef, opts) {
   }
   return extractPrForIssueResponse(resp);
 }
+function closedByGraphqlArgs(owner, name, number) {
+  const query = "query($owner:String!,$name:String!){repository(owner:$owner,name:$name){issue(number:" + number + "){number closedByPullRequestsReferences(first:100){nodes{number merged mergedAt mergeCommit{oid} repository{owner{login} name}}}}}}";
+  return ["api", "graphql", "-f", `query=${query}`, "-f", `owner=${owner}`, "-f", `name=${name}`];
+}
+function extractClosedByResponse(resp) {
+  const r = resp ?? {};
+  if ((r.errors ?? []).some((e) => e?.type === "NOT_FOUND") || !r.data?.repository?.issue) {
+    throw new QueryReadError("NOT_FOUND", "issue not found");
+  }
+  const out = [];
+  for (const node of r.data.repository.issue.closedByPullRequestsReferences?.nodes ?? []) {
+    const pr = node;
+    if (typeof pr.number !== "number") continue;
+    out.push({
+      number: pr.number,
+      merged: pr.merged === true,
+      mergedAt: typeof pr.mergedAt === "string" ? pr.mergedAt : null,
+      mergeCommit: pr.mergeCommit && typeof pr.mergeCommit.oid === "string" ? { oid: pr.mergeCommit.oid } : null,
+      repository: {
+        owner: { login: String(pr.repository?.owner?.login ?? "") },
+        name: String(pr.repository?.name ?? "")
+      }
+    });
+  }
+  return out;
+}
+async function runClosedBy(deps, opts) {
+  const { owner, name } = splitRepo(opts.repo);
+  let resp;
+  try {
+    resp = await deps.ghJson(closedByGraphqlArgs(owner, name, opts.number), GH_LIST_TIMEOUT_MS);
+  } catch (e) {
+    if (isGhNotFound(e)) {
+      throw new QueryReadError("NOT_FOUND", `#${opts.number} not found in ${opts.repo}`);
+    }
+    throw e;
+  }
+  return extractClosedByResponse(resp);
+}
 async function runIssueViewContext(deps, opts) {
   const baseFields = opts.context ? opts.jsonFields.split(",").map((field) => field.trim()).filter((field) => field !== "linkedPrs" && field !== "children").join(",") : opts.jsonFields;
   const fields = opts.comments || opts.context ? ensureField(baseFields, "comments") : baseFields;
@@ -17772,10 +17878,10 @@ function registerQueryCommands(program3) {
   const project2 = program3.commands.find((c) => c.name() === "project");
   if (!issue || !pr) return;
   const deps = queryDeps();
-  issue.command("list").description("bounded issue read \u2014 filter by text, label, state, or assignee; always prints JSON").option("--label <label>", "filter by label").option("--search <query>", "free-text issue search").addOption(caseInsensitiveChoices(new Option("--state <state>", "open | closed | all").default("open"), ISSUE_STATES)).option("--assignee <login>", "filter by assignee login").option("--limit <n>", "max issues to return (capped at 100)", (v) => Number(v), DEFAULT_LIMIT).option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output (already the default \u2014 accepted for contract uniformity)").action(async (o) => {
+  issue.command("list").description("bounded issue read \u2014 filter by text, label, state, or assignee; always prints JSON").option("--label <label>", "filter by label").option("--search <query>", "free-text issue search").addOption(caseInsensitiveChoices(new Option("--state <state>", "open | closed | all").default("open"), ISSUE_STATES)).option("--assignee <login>", "filter by assignee login").option("--limit <n>", "max issues to return (capped at 1000; gh pages past 100)", (v) => Number(v), DEFAULT_LIMIT).option("--with-body", "include each issue's markdown body").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output (already the default \u2014 accepted for contract uniformity)").action(async (o) => {
     try {
       const state = validateEnum("--state", ISSUE_STATES, o.state, "issue list");
-      const rows = await runIssueList(deps, { label: o.label, search: o.search, state, assignee: o.assignee, limit: o.limit, repo: o.repo });
+      const rows = await runIssueList(deps, { label: o.label, search: o.search, state, assignee: o.assignee, limit: o.limit, repo: o.repo, withBody: o.withBody });
       console.log(JSON.stringify(rows));
     } catch (e) {
       queryFail("issue list", e);
@@ -26463,6 +26569,10 @@ var TAG_ADDRESSABLE_CONTEXTS_LABEL = "rc/main required contexts are tag-addressa
 var RELEASE_BRANCH_REACHABLE_LABEL = "rc/main required contexts are reachable from a release-base head (#5193)";
 var RULESET_TRACK_SCOPE_LABEL = "product ruleset branch scope covers the release track (#6327)";
 var RECONCILE_SEED_BRANCH_PREFIX = "bootstrap-seed-ruleset-ref";
+var NPM_PUBLISH_SAFE_FLOOR_SHA = "b5632c8b940d8025fdb5630e576502e1397c4552";
+var SHARED_ACTION_PINS = [
+  { path: "npm-publish", floor: NPM_PUBLISH_SAFE_FLOOR_SHA }
+];
 function slugFromRepo(repo) {
   return (repo.includes("/") ? repo.split("/")[1] : repo).toLowerCase();
 }
@@ -26486,6 +26596,43 @@ async function restJson2(deps, path2, fallback) {
     return fallback;
   }
 }
+var sharedPinComparisons = /* @__PURE__ */ new WeakMap();
+function pinContainsFloor(deps, floor, pin) {
+  let comparisons = sharedPinComparisons.get(deps);
+  if (!comparisons) {
+    comparisons = /* @__PURE__ */ new Map();
+    sharedPinComparisons.set(deps, comparisons);
+  }
+  const key = `${floor}...${pin}`;
+  let comparison = comparisons.get(key);
+  if (!comparison) {
+    comparison = deps.client.rest("GET", `repos/${HUB_REPO4}/compare/${key}`).then((result) => result?.status === "ahead" || result?.status === "identical" ? true : result?.status === "behind" || result?.status === "diverged" ? false : void 0).catch(() => void 0);
+    comparisons.set(key, comparison);
+  }
+  return comparison;
+}
+async function auditSharedActionPins(files, deps) {
+  const checks = [];
+  for (const { path: path2, body } of files) {
+    for (const [index, line] of body.split(/\r?\n/).entries()) {
+      const match = /^\s*-?\s*uses:\s*['"]?mutmutco\/MMI-Hub\/\.github\/actions\/([^@\s'"]+)@([0-9a-f]{40})['"]?(?:\s*(?:#.*)?)$/.exec(line);
+      if (!match) continue;
+      const action = SHARED_ACTION_PINS.find((item) => item.path === match[1]);
+      if (!action || match[2] === action.floor) continue;
+      const safe = await pinContainsFloor(deps, action.floor, match[2]);
+      if (safe === true) continue;
+      const location = `${path2}:${index + 1}`;
+      const replacement = `mutmutco/MMI-Hub/.github/actions/${action.path}@${action.floor}`;
+      checks.push({
+        ok: safe !== false,
+        label: `${action.path} shared action pin is current`,
+        detail: `${location}: ${action.path} pinned to ${match[2]} \u2014 ` + (safe === false ? `lacks the minimum safe floor ${action.floor}` : "could not verify ancestry against the safe floor; refresh the pin"),
+        remediation: safe === false ? `Replace the uses: pin at ${location} with ${replacement}` : void 0
+      });
+    }
+  }
+  return checks;
+}
 async function rulesetDetails(deps, repo, list) {
   const details = [];
   for (const ruleset of list) {
@@ -27022,6 +27169,10 @@ async function auditRepoCi(repo, deps) {
       }
     }
   }
+  if (repoClass !== "hub") {
+    const workflows = await getBranchWorkflows();
+    if (workflows) checks.push(...await auditSharedActionPins(workflows, deps));
+  }
   const ok = checks.every((c) => c.ok);
   return { repo, class: repoClass, mergePolicy: policy, ok, checks, explicitNoCi };
 }
@@ -27585,7 +27736,7 @@ var COMMAND_METADATA = /* @__PURE__ */ Symbol.for("mmi.commandTaxonomy.metadata"
 var PRIMARY_GROUPS = [
   ["Orient", ["onboard", "status", "next", "doctor", "whoami", "commands", "explain"]],
   ["Plan and work", ["board", "issue", "stage"]],
-  ["Review and ship", ["pr", "ci", "rcand", "release", "hotfix", "train"]],
+  ["Review and ship", ["pr", "ci", "rcand", "release", "hotfix", "train", "api"]],
   // `tests` sits beside `docs` deliberately: both are deterministic, repo-local gates a workflow
   // step invokes (`docs refs`, `tests policy`), not org-plane operations (#3605). `spawn policy`
   // joins them on the same footing (#3979); `dist status` does too (#5576) — the checkout's own
@@ -27633,6 +27784,7 @@ var COMMAND_OWNERSHIP = {
   issue: { module_owner: "cli/src/issue-commands.ts", consumer: "agent-workflow" },
   stage: { module_owner: "cli/src/stage-commands.ts", consumer: "agent-workflow" },
   pr: { module_owner: "cli/src/pr-commands.ts", consumer: "agent-workflow" },
+  api: { module_owner: "cli/src/api-read.ts", consumer: "agent-workflow" },
   ci: { module_owner: "cli/src/ci-audit.ts", consumer: "release-operator" },
   rcand: { module_owner: "cli/src/train-commands.ts", consumer: "release-operator" },
   release: { module_owner: "cli/src/train-commands.ts", consumer: "release-operator" },
@@ -28372,7 +28524,10 @@ var APP_VAULT_REPO = "mutmutco/MMI-Hub";
 var APP_VAULT_KEYS = ["GITHUB_APP_ID", "GITHUB_APP_INSTALLATION_ID", "GITHUB_APP_PRIVATE_KEY"];
 var APP_ELIGIBLE_COMMANDS = /* @__PURE__ */ new Set([
   "pr checks-wait",
-  "pr view"
+  "pr view",
+  "issue list",
+  "issue view",
+  "api get"
 ]);
 var APP_POLL_PERMISSIONS = {
   metadata: "read",
@@ -28602,8 +28757,8 @@ async function attachBoardIssues(selectors, repoOption, deps = {}) {
       ref = `${parsed.repo}#${parsed.number}`;
       const cfg = resolveBoardConfig(await (deps.config ?? loadConfigForBoardSelector2)(selector, repoOption));
       const issue = await client.rest("GET", `repos/${parsed.repo}/issues/${parsed.number}`);
-      if (!issue.id) throw new Error("issue node id could not be read");
-      const projectItemId = await (deps.attach ?? attachViaHubApp)(cfg, issue.id);
+      if (!issue.node_id) throw new Error("issue node id could not be read");
+      const projectItemId = await (deps.attach ?? attachViaHubApp)(cfg, issue.node_id);
       return { ref, attached: true, projectItemId, credential: "app_installation" };
     } catch (e) {
       return { ref, attached: false, reason: e.message };
@@ -28652,7 +28807,8 @@ function registerBoardCommands(program3) {
         repo: o.repo,
         includeBundleDetails: o.bundleDetails,
         includeAllBodies: o.bodies,
-        allowPartial: o.allowPartial
+        allowPartial: o.allowPartial,
+        snapshotOnly: o.snapshotOnly
       }, o.direct ? {} : { snapshot: registryClientDeps(config) });
       const output = o.json ? JSON.stringify(report) : renderBoardReport(report);
       if (!o.out) console.log(output);
@@ -28695,7 +28851,7 @@ function registerBoardCommands(program3) {
     return `Claimed ${ref} for ${holder} - In Progress${reclaimed}`;
   }
   const board = program3.command("board").description("read, claim, show, and move Project v2 work items for the current repo");
-  board.command("read", { isDefault: true }).alias("list").description("read the board and print user-owned, claimable, and taken items").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo (defaults to git origin)").option("--direct", "bypass the Hub snapshot and read the live board through direct GitHub GraphQL").option("--bundle-details", "fetch body/comments only for user-owned and claimable issues").option("--bodies", "fetch body/comments for EVERY scoped row, including taken and unowned in-flight ones \u2014 for consumers that scope by Status rather than ownership (#4861); implies --bundle-details and costs one extra read per row").option("--allow-partial", "return partial board results when later page/detail reads fail").option("--out <path>", "write the output to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5802)").addHelpText("after", "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--direct skips the Hub snapshot and uses the existing direct GitHub GraphQL read immediately.\n--allow-partial applies to the paginated path and detail reads.\n\nWhen using Windows PowerShell 5.1, avoid shell redirects: PowerShell 5.1's `> file.json` is Out-File,\nwhich writes UTF-16LE with a BOM, and Node reading it as 'utf8' then fails JSON.parse at position 1\n(#5802). Use --out instead \u2014 the CLI writes the file itself as UTF-8:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n").action((o) => runBoardRead(o));
+  board.command("read", { isDefault: true }).alias("list").description("read the board and print user-owned, claimable, and taken items").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo (defaults to git origin)").option("--direct", "bypass the Hub snapshot and read the live board through direct GitHub GraphQL").option("--snapshot-only", "fail instead of falling back to your personal GraphQL pool when the Hub snapshot is unavailable \u2014 for ambient readers such as sidebars (#7203)").option("--bundle-details", "fetch body/comments only for user-owned and claimable issues").option("--bodies", "fetch body/comments for EVERY scoped row, including taken and unowned in-flight ones \u2014 for consumers that scope by Status rather than ownership (#4861); implies --bundle-details and costs one extra read per row").option("--allow-partial", "return partial board results when later page/detail reads fail").option("--out <path>", "write the output to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5802)").addHelpText("after", "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--direct skips the Hub snapshot and uses the existing direct GitHub GraphQL read immediately.\n--allow-partial applies to the paginated path and detail reads.\n\nWhen using Windows PowerShell 5.1, avoid shell redirects: PowerShell 5.1's `> file.json` is Out-File,\nwhich writes UTF-16LE with a BOM, and Node reading it as 'utf8' then fails JSON.parse at position 1\n(#5802). Use --out instead \u2014 the CLI writes the file itself as UTF-8:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n").action((o) => runBoardRead(o));
   withExamples(mutating(
     board.command("claim <issues...>").description("claim issues: assign them and move their Project v2 Status to In Progress \u2014 idempotent, so an item already yours and In Progress succeeds unchanged (one or more refs); the board scan rides the Hub snapshot, same as board read").addHelpText("after", "\nclaim reads the board through the same Hub snapshot leg as `board read` (the App-installation\ncredential, never your personal GraphQL pool); the direct user-auth read is an emergency fallback\nand is named in a Warning line after the verdict (#6162).\n\nevery claim stamps a lane-identity marker comment on the issue (`<!-- mmi-claim: \u2026 -->`,\nsurface/session@host) so other agents can attribute the hold (#3727). The session is the\nhost-exported id when the surface provides one, otherwise a per-process `synth-` fallback \u2014\na claim is never anonymous (#5245). `board show`, doctor and unclaim read the latest marker.\n\nsame-owner resume (#6035): when the prior marker was posted by YOUR login on THIS host and its\nlocal session is verifiably dead (transcript probe), the claim proceeds as a resume without\n--force and names the evidence. A live, foreign-host, or unprobeable prior lane still refuses.\n\nreclaim from In Review (#6339): an In Review item with no holder, or one held by the claiming\nlogin, is claimable \u2014 it moves back to In Progress and the receipt names the status it came from.\nAn In Review item another login holds is refused (ask the holder, or wait for the review to land),\nand Done stays refused. The board status is the authority; no PR state is consulted.\n").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--for <login>", "assign to this login instead of @me \u2014 agent claims on behalf of the master").option("--force", "take an item already claimed by another lane that shows live evidence of active work (#3727)").option("--check", "read-only: run every claim gate and report the verdict, writing nothing \u2014 exits 1 with the same refusal a real claim would raise (#4511)").option("--allow-partial", "return success JSON if assignment succeeds but the status move fails"),
     (_opts, args) => ({ command: "oracle board claim", issues: args[0] ?? [] })
@@ -29618,6 +29774,43 @@ function parseGateVar(raw) {
   }
   return out;
 }
+var SECRET_OUTPUT_PATH_RE = /^\/[A-Za-z0-9._/-]+$/;
+var SECRET_OUTPUT_REPO_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*\/[A-Za-z0-9][A-Za-z0-9._-]*$/;
+var SECRET_OUTPUT_KEY_RE = /^[A-Z][A-Z0-9_]*$/;
+function parseTenantTaskSecretOutput(raw, label) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error(`org project set: ${label} must be an object {path,vault:{repo,key},overwrite?}`);
+  }
+  const value = raw;
+  if (Object.keys(value).some((key) => !["path", "vault", "overwrite"].includes(key))) {
+    throw new Error(`org project set: ${label} has an unknown field`);
+  }
+  if (typeof value.path !== "string" || value.path.length < 2 || value.path.length > 256 || !SECRET_OUTPUT_PATH_RE.test(value.path) || value.path.split("/").includes("..")) {
+    throw new Error(`org project set: ${label}.path must be an absolute container path (no ".." segment)`);
+  }
+  const vault = value.vault;
+  if (!vault || typeof vault !== "object" || Array.isArray(vault)) {
+    throw new Error(`org project set: ${label}.vault must be an object {repo,key}`);
+  }
+  const vaultMap = vault;
+  if (Object.keys(vaultMap).some((key) => !["repo", "key"].includes(key))) {
+    throw new Error(`org project set: ${label}.vault has an unknown field`);
+  }
+  if (typeof vaultMap.repo !== "string" || !SECRET_OUTPUT_REPO_RE.test(vaultMap.repo)) {
+    throw new Error(`org project set: ${label}.vault.repo must be owner/name`);
+  }
+  if (typeof vaultMap.key !== "string" || !SECRET_OUTPUT_KEY_RE.test(vaultMap.key)) {
+    throw new Error(`org project set: ${label}.vault.key must be UPPER_SNAKE`);
+  }
+  if (value.overwrite !== void 0 && typeof value.overwrite !== "boolean") {
+    throw new Error(`org project set: ${label}.overwrite must be true or false`);
+  }
+  return {
+    path: value.path,
+    vault: { repo: vaultMap.repo, key: vaultMap.key },
+    ...value.overwrite !== void 0 ? { overwrite: value.overwrite } : {}
+  };
+}
 function parseTenantTasksVar(raw) {
   let parsed;
   try {
@@ -29636,7 +29829,7 @@ function parseTenantTasksVar(raw) {
     if (!nameRe.test(name)) throw new Error(`org project set: tenantTasks name ${JSON.stringify(name)} must be lowercase kebab-case`);
     if (!rawTask || typeof rawTask !== "object" || Array.isArray(rawTask)) throw new Error(`org project set: tenantTasks.${name} must be an object`);
     const task = rawTask;
-    if (Object.keys(task).some((key) => !["service", "command", "stages", "timeoutSeconds", "artifact"].includes(key))) throw new Error(`org project set: tenantTasks.${name} has an unknown field`);
+    if (Object.keys(task).some((key) => !["service", "command", "stages", "timeoutSeconds", "artifact", "secretOutput"].includes(key))) throw new Error(`org project set: tenantTasks.${name} has an unknown field`);
     if (typeof task.service !== "string" || !serviceRe.test(task.service)) throw new Error(`org project set: tenantTasks.${name}.service has an unsafe shape`);
     if (!Array.isArray(task.command) || task.command.length < 1 || task.command.length > 32 || task.command.some((arg) => typeof arg !== "string" || arg.length < 1 || arg.length > 256 || /[\u0000\r\n]/.test(arg))) throw new Error(`org project set: tenantTasks.${name}.command must be 1-32 bounded argv strings`);
     if (!Array.isArray(task.stages) || task.stages.length < 1 || task.stages.length > 3 || task.stages.some((stage) => typeof stage !== "string" || !validStages.has(stage)) || new Set(task.stages).size !== task.stages.length) throw new Error(`org project set: tenantTasks.${name}.stages must be unique dev/rc/main values`);
@@ -29650,7 +29843,8 @@ function parseTenantTasksVar(raw) {
       command: task.command,
       stages: task.stages,
       ...task.timeoutSeconds !== void 0 ? { timeoutSeconds: task.timeoutSeconds } : {},
-      ...artifact !== "none" ? { artifact } : {}
+      ...artifact !== "none" ? { artifact } : {},
+      ...task.secretOutput !== void 0 ? { secretOutput: parseTenantTaskSecretOutput(task.secretOutput, `tenantTasks.${name}.secretOutput`) } : {}
     };
   }
   return out;
@@ -29708,7 +29902,7 @@ var SETTABLE_VAR_HINTS = {
   requiredGcpApis: "comma-string",
   requiredRuntimeSecrets: 'JSON stage map, e.g. {"dev":["KEY"],"rc":["KEY"],"main":["KEY"]}',
   requiredBuildSecrets: 'JSON flat array, e.g. ["NODE_AUTH_TOKEN=@github-packages-token"]',
-  tenantTasks: 'JSON map {name:{service,command[],stages[],timeoutSeconds?,artifact?:"required"}}; use {artifact} in argv when required',
+  tenantTasks: 'JSON map {name:{service,command[],stages[],timeoutSeconds?,artifact?:"required",secretOutput?:{path,vault:{repo,key},overwrite?}}}; use {artifact} in argv when required; a secretOutput is master-only',
   secrets: "JSON catalog map keyed by KEY {key,purpose,group,owner,stages[],consumers[]} \u2014 merged per entry; drop ONE entry with --unset-secret KEY; clear ALL with --unset secrets --confirm-clear-secrets; prefer --secrets-file",
   edgeDomains: "JSON {dev,rc,main} domain map",
   statusOptions: "JSON name\u2192id map",
@@ -32321,9 +32515,7 @@ function registerBootstrapCommands(program3) {
       deployModel: typeof meta?.deployModel === "string" ? meta.deployModel : void 0,
       deployFacts,
       deployFactsRead: deployFacts !== null,
-      edgeCertificates: await Promise.all(["dev", "rc"].map(async (stage) => {
-        const domain = meta?.edgeDomains?.[stage];
-        if (!domain) return null;
+      edgeCertificates: await Promise.all(edgeCertificateStagesForBootstrap(effectiveTrack, meta?.edgeDomains).map(async (stage) => {
         try {
           return { stage, status: await edgeCertificateForStage(slug, stage, reg) };
         } catch (e) {
@@ -32823,7 +33015,18 @@ function registerBootstrapCommands(program3) {
         if (isLegacyBlock) {
           content = upsertManagedGitignoreBlock(preservedContent).content;
         } else {
-          const writeContent = resolveSeedWriteContent(resolved, vars, readFile9, preservedContent);
+          const rulesetVars = preserveRuleset ? gateSeedVars(
+            o.class,
+            effectiveTrack,
+            "node",
+            registryMeta?.requiredCheckBranches,
+            registryMeta?.requiredChecks
+          ) : null;
+          const writeContent = resolveSeedWriteContent(resolved, preserveRuleset && rulesetVars ? {
+            ...vars,
+            ...registryMeta?.requiredChecks?.length ? { GATE_RULESET_CONTEXTS_JSON: rulesetVars.GATE_RULESET_CONTEXTS_JSON } : {},
+            ...registryMeta?.requiredCheckBranches?.length ? { GATE_RULESET_BRANCH_REFS_JSON: rulesetVars.GATE_RULESET_BRANCH_REFS_JSON } : {}
+          } : vars, readFile9, preservedContent);
           if (!writeContent.ok) {
             return fail(`bootstrap apply: ${resolved.target}: ${writeContent.reason} \u2014 refusing to overwrite repo-owned content`);
           }
@@ -32831,7 +33034,10 @@ function registerBootstrapCommands(program3) {
           if (preserveRuleset) {
             if (content === null) return fail("bootstrap apply: canonical product ruleset seed is unreadable");
             try {
-              content = reseedProductRulesetStrictness(baseContent, content);
+              content = reseedProductRulesetStrictness(baseContent, content, {
+                requiredChecks: !!registryMeta?.requiredChecks?.length,
+                requiredCheckBranches: !!registryMeta?.requiredCheckBranches?.length
+              });
             } catch (e) {
               return fail(`bootstrap apply: product ruleset preservation refused: ${e.message}`);
             }
@@ -33054,8 +33260,7 @@ ${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owne
       if (res.ok) {
         ddbWrites.push({ slug: registerPayload.slug, action: "register", record: registerPayload });
         applied.push(`ddb register ${registerPayload.slug}`);
-        for (const stage of ["dev", "rc"]) {
-          if (!registerPayload.edgeDomains?.[stage]) continue;
+        for (const stage of edgeCertificateStagesForBootstrap(registerPayload.releaseTrack, registerPayload.edgeDomains)) {
           try {
             const cert = await edgeCertificateForStage(slug, stage, reg, true);
             if (cert.required) applied.push(`edge certificate ${stage}: ${cert.action ?? "checked"}`);
@@ -33135,11 +33340,25 @@ ${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owne
         });
       }
     }
-    if (o.json) console.log(JSON.stringify({ repo, class: o.class, sourceSha: seedSource.sha, only: onlyTarget || null, execute: o.execute, seedDelivery: seedPlan.mode, seedBranch: seedPlan.branch, seedBaseSha: scopedPlan?.baseSha, seedPrUrl, actions, controlPlane: controlRows, applied, ddbWrites }, null, 2));
+    let ancillaryPlan;
+    let environmentPlan;
+    if (!o.execute && !onlyTarget) {
+      try {
+        const liveLabels = JSON.parse((await gh(["label", "list", "-R", repo, "--limit", "1000", "--json", "name"])).stdout);
+        if (!Array.isArray(liveLabels)) throw new Error("label list is not an array");
+        ancillaryPlan = planBootstrapLabels(manifest.labels, liveLabels);
+        environmentPlan = (await verifyRepoEnvironments(repo, effectiveTrack, controlClient)).map(classifyEnvironmentDrift);
+      } catch (e) {
+        return failGraceful(`bootstrap apply: cannot plan labels/environments; no writes made: ${e.message}`);
+      }
+    }
+    if (o.json) console.log(JSON.stringify({ repo, class: o.class, sourceSha: seedSource.sha, only: onlyTarget || null, execute: o.execute, seedDelivery: seedPlan.mode, seedBranch: seedPlan.branch, seedBaseSha: scopedPlan?.baseSha, seedPrUrl, actions, controlPlane: controlRows, labels: ancillaryPlan, environments: environmentPlan, applied, ddbWrites }, null, 2));
     else {
       console.log(renderSeedPlan(actions));
       if (controlRows.length) console.log(`
 ${renderBootstrapControlPlan(controlRows)}`);
+      if (ancillaryPlan && environmentPlan) console.log(`
+${renderBootstrapAncillaryPlan(ancillaryPlan, environmentPlan)}`);
       if (o.execute) console.log(`
 LIVE apply to ${repo}:
   ${applied.join("\n  ")}`);
@@ -33649,7 +33868,7 @@ function formatDeployStatus(r) {
 var STAGES2 = ["dev", "rc", "main"];
 function registerDeployCommands(program3) {
   const deploy = program3.command("deploy").description("per-stage deploy observability \u2014 last run, health, and running version (#2688)");
-  deploy.command("status <stage>").description("last deploy run + runtime health probe + running version for a stage (defaults to the current repo); an auth-walled root (401/403) is re-probed at /health and the `url` field names the endpoint that answered (#6137)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (stage, o) => {
+  deploy.command("status <stage>").description("last deploy run + runtime health probe + running version for a stage (defaults to the current repo); a root answering 401/403/404 is re-probed at /health and the `url` field names the endpoint that answered (#6137)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (stage, o) => {
     if (!STAGES2.includes(stage)) {
       return fail(`runtime deploy status: <stage> must be dev, rc, or main`);
     }
@@ -38035,6 +38254,70 @@ function registerOrgHealthQuery(program3, deps = defaultOrgHealthQueryDeps()) {
   });
 }
 
+// src/api-read.ts
+init_cli_shared();
+var API_ACCEPT_HEADERS = {
+  json: "application/vnd.github+json",
+  raw: "application/vnd.github.raw"
+};
+function acceptHeaderFor(accept) {
+  const v = (accept ?? "json").trim().toLowerCase();
+  const header = API_ACCEPT_HEADERS[v];
+  if (!header) {
+    throw new Error(`api get: --accept must be one of: json, raw (received '${accept}')`);
+  }
+  return header;
+}
+var NAME = "[A-Za-z0-9_.-]+";
+var FREE = "[^?#%\\\\\\s]+";
+var PULL_FILES_RE = new RegExp(`^repos/${NAME}/${NAME}/pulls/\\d+/files$`);
+var COMPARE_RE = new RegExp(`^repos/${NAME}/${NAME}/compare/${FREE}\\.\\.\\.${FREE}$`);
+var CONTENTS_BASE_RE = new RegExp(`^repos/${NAME}/${NAME}/contents/${FREE}$`);
+var CONTENTS_QUERY_RE = /^ref=[^&\s]+$/;
+var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>]";
+function parseApiGetPath(rawPath) {
+  const path2 = rawPath.trim();
+  const refuse = () => new Error(`api get: refusing '${rawPath}' \u2014 only these GET reads are allowed (#7219): ${API_GET_ALLOWED_SHAPES}`);
+  if (/[%#\\]/.test(path2) || path2.split("?")[0].split("/").some((seg) => seg === "." || seg === ".." || seg === "")) throw refuse();
+  if (PULL_FILES_RE.test(path2)) return { kind: "pull-files", path: path2, paginate: true };
+  if (COMPARE_RE.test(path2)) return { kind: "compare", path: path2, paginate: false };
+  const q = path2.indexOf("?");
+  const base = q === -1 ? path2 : path2.slice(0, q);
+  const query = q === -1 ? "" : path2.slice(q + 1);
+  if (CONTENTS_BASE_RE.test(base) && (query === "" || CONTENTS_QUERY_RE.test(query))) {
+    return { kind: "contents", path: path2, paginate: false };
+  }
+  throw new Error(`api get: refusing '${rawPath}' \u2014 only these GET reads are allowed (#7219): ${API_GET_ALLOWED_SHAPES}`);
+}
+function buildApiGetArgs(path2, accept) {
+  const req = parseApiGetPath(path2);
+  const args = ["api", req.path];
+  if (req.paginate) args.push("--paginate");
+  const header = acceptHeaderFor(accept);
+  if (header !== API_ACCEPT_HEADERS.json) args.push("-H", `Accept: ${header}`);
+  return args;
+}
+async function runApiGet(run, path2, accept) {
+  return run(buildApiGetArgs(path2, accept), GIT_TIMEOUT_MS);
+}
+function registerApiReadCommands(program3) {
+  const api = program3.command("api").description("bounded GitHub REST reads for automation \u2014 GET only, allowlisted paths (pull files, compare, contents)");
+  api.command("get <path>").description("GET one allowlisted REST path and print the response body to stdout (JSON, or raw file bytes with --accept raw); refuses everything outside the allowlist").option("--accept <type>", "response media type: json (default) or raw (file bytes)", "json").action(async (path2, o) => {
+    let body;
+    try {
+      body = await runApiGet(
+        async (args, timeoutMs) => (await execFileP("gh", args, { timeout: timeoutMs })).stdout,
+        path2,
+        o.accept
+      );
+    } catch (e) {
+      const err = e;
+      return fail(`api get: ${(err.stderr || err.message || String(e)).trim()}`);
+    }
+    process.stdout.write(body);
+  });
+}
+
 // src/pr-commands.ts
 var import_promises4 = require("node:fs/promises");
 init_cli_shared();
@@ -43515,6 +43798,14 @@ function registerCollaborationCommands(program3) {
     }
     return resolveParentField(payload);
   }
+  async function readClosedByField(number, repo) {
+    try {
+      return { closedBy: await runClosedBy(queryDeps(), { number, repo }) };
+    } catch (e) {
+      const err = e;
+      return { closedByReadError: (err.stderr || err.message || String(e)).trim() };
+    }
+  }
   function withoutTransportNumber(data) {
     const rest = { ...data };
     delete rest.number;
@@ -43533,7 +43824,7 @@ function registerCollaborationCommands(program3) {
       return void 0;
     }
   }
-  issue.command("view <ref>").aliases(["show", "get", "read"]).description('read an issue as structured JSON \u2014 the mmi-cli path for non-board issue reads (#2347). --comments folds in every comment; --context also adds linkedPrs + children (the one-shot "load the whole item" read, #2894). `show`, `get` and `read` alias view (#5483/#5706/#6078)').option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json [fields...]", 'gh --json field list (overrides the default field set). `parent` is synthetic: selectable here, composed by the wrapper via a REST parent read, never sent to gh (#5970). Accepts commas, spaces, or repeated --json flags \u2014 in PowerShell an unquoted comma list is an array literal, so QUOTE it: --json "number,title,body,url"').option("--comments", 'include every comment (body + comments in one call) \u2014 the agentic "read the whole item before working it" read (#2894)').option("--context", "full working context in one call: implies --comments and also adds linkedPrs and, for an epic, a children summary (#2894)").action(async (ref, o) => {
+  issue.command("view <ref>").aliases(["show", "get", "read"]).description('read an issue as structured JSON \u2014 the mmi-cli path for non-board issue reads (#2347). --comments folds in every comment; --context also adds linkedPrs + children (the one-shot "load the whole item" read, #2894). `show`, `get` and `read` alias view (#5483/#5706/#6078)').option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json [fields...]", 'gh --json field list (overrides the default field set). `parent` is synthetic: selectable here, composed by the wrapper via a REST parent read, never sent to gh (#5970). `closedBy` is synthetic too: the closing PRs with merged/mergedAt/mergeCommit.oid, composed via one fixed GraphQL read (#7219). Accepts commas, spaces, or repeated --json flags \u2014 in PowerShell an unquoted comma list is an array literal, so QUOTE it: --json "number,title,body,url"').option("--comments", 'include every comment (body + comments in one call) \u2014 the agentic "read the whole item before working it" read (#2894)').option("--context", "full working context in one call: implies --comments and also adds linkedPrs and, for an epic, a children summary (#2894)").action(async (ref, o) => {
     let parsed;
     try {
       parsed = parseIssueRef(ref, o.repo);
@@ -43544,6 +43835,7 @@ function registerCollaborationCommands(program3) {
     const repo = await resolveRepo(parsed.repo ?? o.repo);
     if (!repo) return fail("issue view: could not resolve repo (pass --repo <owner/repo>)");
     const fields = normalizeIssueViewJsonFields(o.json);
+    const wantsClosedBy = fields.split(",").map((f) => f.trim()).includes("closedBy");
     const gh = resolveIssueViewGhFields(fields);
     const emit = (data, parent) => console.log(JSON.stringify({ ...gh.numberIsTransport ? withoutTransportNumber(data) : data, ...parent }));
     const readIssue = async (targetRepo2, targetNumber) => {
@@ -43555,9 +43847,10 @@ function registerCollaborationCommands(program3) {
       const data = await ghJson(["issue", "view", String(targetNumber), "--repo", targetRepo2, "--json", gh.ghFields]);
       return { data, parent: await readParentField(targetNumber, targetRepo2) };
     };
+    const readClosedBy = async (targetRepo2, targetNumber) => wantsClosedBy ? readClosedByField(targetNumber, targetRepo2) : {};
     try {
       const { data, parent } = await readIssue(repo, n);
-      emit(data, parent);
+      emit(data, { ...parent, ...await readClosedBy(repo, n) });
     } catch (e) {
       const err = e;
       const raw = (err.stderr || err.message || String(e)).trim();
@@ -43566,7 +43859,7 @@ function registerCollaborationCommands(program3) {
       if (moved) {
         try {
           const { data, parent } = await readIssue(moved.repo, moved.number);
-          emit({ ...data, transferred: { from: `${repo}#${n}`, to: `${moved.repo}#${moved.number}`, url: moved.url } }, parent);
+          emit({ ...data, transferred: { from: `${repo}#${n}`, to: `${moved.repo}#${moved.number}`, url: moved.url } }, { ...parent, ...await readClosedBy(moved.repo, moved.number) });
           return;
         } catch (reRead) {
           const reErr = reRead;
@@ -48711,7 +49004,7 @@ tenant.command("reconcile <owner/repo> <stage>").description("re-render this ten
     return failGraceful(`runtime tenant reconcile: ${e.message}`);
   }
 });
-tenant.command("status <owner/repo> <stage>").description("read tenant runtime readiness without dispatching tenant-control: DEPLOY row, last deploy run, public URL probe, and TLS/Caddy/Cloudflare hints; an auth-walled root (401/403) is re-probed at /health and the `url` field names the endpoint that answered (#6137)").action(async (repo, stage) => {
+tenant.command("status <owner/repo> <stage>").description("read tenant runtime readiness without dispatching tenant-control: DEPLOY row, last deploy run, public URL probe, and TLS/Caddy/Cloudflare hints; a root answering 401/403/404 is re-probed at /health and the `url` field names the endpoint that answered (#6137)").action(async (repo, stage) => {
   if (!["dev", "rc", "main"].includes(stage)) return fail("runtime tenant status: <stage> must be dev, rc, or main");
   const cfg = await loadConfig();
   const result = await buildTenantRuntimeStatusFor(repo, stage, cfg);
@@ -49195,7 +49488,7 @@ ${filelessTransitionGuide(target, o.stage)}`
   return reportWrite("org project set-deploy", res);
 });
 var projectTenantTasks = project.command("tenant-tasks").description("project-admin self-declare of tenant tasks for every stage of your own repo \u2014 new-task-only; editing an existing task stays master-only (`org project set --var tenantTasks=...`)");
-projectTenantTasks.command("declare <name>").description("register a NEW tenant task \u2014 becomes runnable via `runtime tenant control \u2026 run-task` on its declared dev/rc/main stages. Body shape {service,command[],stages[],timeoutSeconds?,artifact?}; required artifact tasks must carry {artifact} in the command argv.").option("--service <name>", "service in the tenant runtime the task runs in (required unless --var carries it)").option("--command <argv...>", "task command as argv (repeatable; required unless --var carries it)").option("--stages <list>", "comma-separated dev,rc,main stages this task may run on (required unless --var carries it)").option("--timeout-seconds <n>", "optional wall-clock ceiling 1..3600").option("--artifact <none|required>", "artifact contract (default none; required tasks must contain {artifact} in argv)").option("--var <json>", "full task object {service,command[],stages[],timeoutSeconds?,artifact?} \u2014 use instead of the individual flags").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (name, o) => {
+projectTenantTasks.command("declare <name>").description("register a NEW tenant task \u2014 becomes runnable via `runtime tenant control \u2026 run-task` on its declared dev/rc/main stages. Body shape {service,command[],stages[],timeoutSeconds?,artifact?}; required artifact tasks must carry {artifact} in the command argv.").option("--service <name>", "service in the tenant runtime the task runs in (required unless --var carries it)").option("--command <argv...>", "task command as argv (repeatable; required unless --var carries it)").option("--stages <list>", "comma-separated dev,rc,main stages this task may run on (required unless --var carries it)").option("--timeout-seconds <n>", "optional wall-clock ceiling 1..3600").option("--artifact <none|required>", "artifact contract (default none; required tasks must contain {artifact} in argv)").option("--var <json>", "full task object {service,command[],stages[],timeoutSeconds?,artifact?} \u2014 use instead of the individual flags. A task carrying secretOutput:{path,vault:{repo,key},overwrite?} is master-only; declare that via `org project set --var tenantTasks=...`").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (name, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -49223,6 +49516,9 @@ projectTenantTasks.command("declare <name>").description("register a NEW tenant
       ...o.artifact !== void 0 ? { artifact: o.artifact } : {}
     };
   }
+  if (task && typeof task === "object" && task.secretOutput !== void 0) {
+    return fail("org project tenant-tasks declare: a task with secretOutput names a vault destination and is master-only (#7213) \u2014 declare it via `mmi-cli oracle org project set <owner/repo> --var 'tenantTasks=...'`");
+  }
   const res = await postJson(`/projects/${encodeURIComponent(slug)}/tenant-tasks`, { repo: target, tenantTasks: { [name]: task } }, registryClientDeps(cfg), "POST", { noRetry: true });
   if (o.json) {
     console.log(JSON.stringify(res, null, 2));
@@ -49370,6 +49666,7 @@ registerDeployCommands(program2);
 registerDiscoveryCommands(program2);
 registerExplainCommand(program2);
 registerPrLifecycleCommands(program2);
+registerApiReadCommands(program2);
 registerSessionReport(program2);
 registerLearningClosureRateCommand(program2);
 registerLearningPickupCommand(program2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.24",
+  "version": "4.5.26",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",