@mutmutco/cli 4.5.31 → 4.5.32

package/dist/main.cjs

@@ -362,6 +362,16 @@ var init_error_codes = __esm({
 });
 
 // src/github-client.ts
+var github_client_exports = {};
+__export(github_client_exports, {
+  GitHubApiError: () => GitHubApiError,
+  classifyGhTokenExecFailure: () => classifyGhTokenExecFailure,
+  createGitHubClient: () => createGitHubClient,
+  defaultGitHubClient: () => defaultGitHubClient,
+  githubToken: () => githubToken,
+  githubTokenRead: () => githubTokenRead,
+  rateLimitResetNote: () => rateLimitResetNote
+});
 function classifyGhTokenExecFailure(e) {
   const err = e;
   const stderr = typeof err?.stderr === "string" ? err.stderr.trim() : "";
@@ -403,7 +413,7 @@ function rateLimitFromResponse(res, detail) {
   const resetHeader = res.headers.get("x-ratelimit-reset");
   const reset = resetHeader && /^\d+$/.test(resetHeader) ? Number(resetHeader) : void 0;
   const rateLimited = (res.status === 403 || res.status === 429) && remaining === "0" || /rate limit|secondary rate|abuse detection/i.test(detail);
-  return { rateLimited, ...rateLimited && reset !== void 0 ? { rateLimitReset: reset } : {} };
+  return { rateLimited, ...remaining === "0" && !/secondary|abuse/i.test(detail) && res.headers.get("x-ratelimit-resource") ? { rateLimitResource: res.headers.get("x-ratelimit-resource") } : {}, ...rateLimited && reset !== void 0 ? { rateLimitReset: reset } : {} };
 }
 function joinUrl(base, path2) {
   if (path2.startsWith("http://") || path2.startsWith("https://")) return path2;
@@ -456,7 +466,7 @@ async function errorFromResponse(res) {
   const budgetNote = limit.rateLimited ? ` \u2014 ${rateLimitResetNote(limit.rateLimitReset)}` : "";
   return new GitHubApiError(`HTTP ${res.status}${suffix}${budgetNote} (${res.url})`, {
     status: res.status,
-    ...limit.rateLimited ? { rateLimited: true, rateLimitReset: limit.rateLimitReset } : {}
+    ...limit.rateLimited ? { rateLimited: true, rateLimitReset: limit.rateLimitReset, rateLimitResource: limit.rateLimitResource } : {}
   });
 }
 function createGitHubClient(options = {}) {
@@ -530,6 +540,7 @@ function createGitHubClient(options = {}) {
             status: 200,
             graphqlErrors: parsed.errors,
             rateLimited: true,
+            ...!/secondary|abuse/i.test(message2) && parsed.errors.some((e) => e.type === "RATE_LIMITED") && (!res.headers.get("x-ratelimit-resource") || res.headers.get("x-ratelimit-resource") === "graphql") ? { rateLimitResource: "graphql" } : {},
             rateLimitReset: reset
           });
         }
@@ -560,6 +571,7 @@ var init_github_client = __esm({
       rateLimited;
       /** Epoch seconds when the exhausted pool resets (`X-Ratelimit-Reset` of the refusing response). */
       rateLimitReset;
+      rateLimitResource;
       constructor(message2, opts = {}) {
         super(message2);
         this.name = "GitHubApiError";
@@ -568,6 +580,7 @@ var init_github_client = __esm({
         this.graphqlErrors = opts.graphqlErrors;
         this.rateLimited = opts.rateLimited;
         this.rateLimitReset = opts.rateLimitReset;
+        this.rateLimitResource = opts.rateLimitResource;
       }
     };
     DEFAULT_TIMEOUT_MS = 2e4;
@@ -5470,7 +5483,7 @@ function isSnapshotShape(body) {
   const b = body;
   const rate = b?.github?.rateLimit;
   const staleValid = b?.stale === void 0 || typeof b.stale === "object" && b.stale !== null && Number.isFinite(b.stale.ageMs) && b.stale.ageMs >= 0;
-  const githubValid = b?.github === void 0 || b.github.credential === "app_installation" && Number.isFinite(rate?.limit) && Number.isFinite(rate?.remaining) && Number.isFinite(rate?.cost) && typeof rate?.resetAt === "string";
+  const githubValid = b?.github === void 0 || b.github.credential === "app_installation" && (rate === void 0 || Number.isFinite(rate?.limit) && Number.isFinite(rate?.remaining) && Number.isFinite(rate?.cost) && typeof rate?.resetAt === "string");
   return Boolean(
     b && typeof b === "object" && typeof b.project?.id === "string" && typeof b.project?.title === "string" && typeof b.viewer === "string" && b.viewer.length > 0 && Array.isArray(b.nodes) && Array.isArray(b.writableRepos) && Array.isArray(b.unreadableRepos) && Array.isArray(b.pullRequests) && Array.isArray(b.warnings) && typeof b.partial === "boolean" && githubValid && staleValid
   );
@@ -5511,7 +5524,11 @@ async function fetchHubBoardSnapshot(request, deps) {
     const body2 = await res.json().catch(() => null);
     if (body2?.error === "rate_limited") {
       const reset = typeof body2.resetAt === "string" ? `; resets ${body2.resetAt}` : "; reset time unavailable";
-      return { state: "unavailable", reason: `GitHub App quota exhausted${reset}` };
+      return {
+        state: "unavailable",
+        reason: `GitHub App quota exhausted${reset}`,
+        ...body2.github?.credential === "app_installation" && body2.github.resource === "graphql" && /^github-app-v1:[a-f0-9]{64}$/.test(body2.github.quotaScope ?? "") ? { quota: { status: "rate_limited", ...typeof body2.resetAt === "string" ? { resetAt: body2.resetAt } : {}, github: { credential: "app_installation", resource: "graphql", quotaScope: body2.github.quotaScope } } } : {}
+      };
     }
   }
   if (!res.ok) return { state: "unavailable", reason: `board snapshot HTTP ${res.status}` };
@@ -12280,7 +12297,7 @@ function renderBoardItem(item) {
 }
 function renderBoardReport(report) {
   const lines2 = [`Board \xB7 ${report.project.title} \xB7 @${report.viewer}`, renderBoardSource()];
-  if (report.github) {
+  if (report.github?.rateLimit) {
     const { limit, remaining, cost, resetAt } = report.github.rateLimit;
     lines2.push(`github: app installation \xB7 GraphQL ${remaining}/${limit} remaining \xB7 cost ${cost} \xB7 resets ${resetAt}`);
   }
@@ -12510,7 +12527,7 @@ async function collectBoardPreferringSnapshot(cfg, options, deps) {
     };
   }
   if (options.snapshotOnly && attempt?.state === "unavailable") {
-    throw new Error(`Hub board snapshot unavailable (${attempt.reason}) \u2014 --snapshot-only refuses the direct user-auth fallback`);
+    throw Object.assign(new Error(`Hub board snapshot unavailable (${attempt.reason}) \u2014 --snapshot-only refuses the direct user-auth fallback`), { quota: attempt.quota });
   }
   const collected = await collectBoardItems(cfg, { repo: options.repo, allowPartial: options.allowPartial, activeOnly: true }, deps);
   if (attempt?.state === "unavailable") {
@@ -12535,7 +12552,7 @@ async function readBoard(options, deps = {}) {
       unknown: new Set(snapshot.unreadableRepos.map((entry) => entry.repo.toLowerCase()))
     };
     pullRequests = snapshot.pullRequests;
-    github = snapshot.github;
+    github = snapshot.github && { ...snapshot.github, ...snapshot.quotaResetAt ? { quotaResetAt: snapshot.quotaResetAt } : {} };
   } else {
     const probed = await resolveWritableReposForClaimables(collected.items, client);
     collected.warnings.push(...probed.warnings);
@@ -16820,10 +16837,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.31",
-    tag: "v4.5.31",
-    commit: "9e03ef1880b6",
-    npm: "@mutmutco/cli@4.5.31"
+    version: "4.5.32",
+    tag: "v4.5.32",
+    commit: "7c2492e36877",
+    npm: "@mutmutco/cli@4.5.32"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -16840,14 +16857,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.31"
+          v3Target: "v4.5.32"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.31 and redeploy the Hub Lambda from tag v4.5.31 (9e03ef1880b6); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.31 (@mutmutco/cli@4.5.31, tag commit 9e03ef1880b6 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.32 and redeploy the Hub Lambda from tag v4.5.32 (7c2492e36877); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.32 (@mutmutco/cli@4.5.32, tag commit 7c2492e36877 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -17946,6 +17963,51 @@ function registerQueryCommands(program3) {
     }
   });
 }
+async function readPrQuotaContext(repo, number, quotaScope, client) {
+  if (!quotaScope) throw new Error("PR quota context requires the verified App actor");
+  const [owner, name] = repo.split("/");
+  const github = { credential: "app_installation", quotaScope, resource: "graphql" };
+  try {
+    const issues = [];
+    const checks = [];
+    let issuesCursor;
+    let checksCursor;
+    let readIssues = true;
+    let readChecks = true;
+    for (let page = 0; page < 100; page++) {
+      const data = await client.graphql(`query($owner:String!,$name:String!,$number:Int!,$issuesCursor:String,$checksCursor:String,$readIssues:Boolean!,$readChecks:Boolean!) {
+        rateLimit { limit remaining resetAt }
+        repository(owner:$owner,name:$name) { pullRequest(number:$number) {
+          number closingIssuesReferences(first:100,after:$issuesCursor) @include(if:$readIssues) { nodes { number } pageInfo { hasNextPage endCursor } }
+          commits(last:1) @include(if:$readChecks) { nodes { commit { statusCheckRollup { contexts(first:100,after:$checksCursor) {
+            nodes { ... on CheckRun { status conclusion } ... on StatusContext { state } }
+            pageInfo { hasNextPage endCursor }
+          } } } } }
+        } }
+      }`, { owner, name, number, issuesCursor, checksCursor, readIssues, readChecks });
+      const pr = data.repository?.pullRequest;
+      if (!pr) throw new Error("PR quota context could not resolve the PR");
+      const issuePage = pr.closingIssuesReferences;
+      const checkPage = pr.commits?.nodes[0]?.commit.statusCheckRollup?.contexts;
+      if (readIssues && !issuePage) throw new Error("PR closing references unreadable");
+      if (readIssues) issues.push(...issuePage.nodes);
+      if (readChecks) checks.push(...checkPage?.nodes ?? []);
+      readIssues = readIssues && issuePage.pageInfo.hasNextPage;
+      readChecks = readChecks && (checkPage?.pageInfo.hasNextPage ?? false);
+      if (!readIssues && !readChecks) return { number: pr.number, closingIssuesReferences: issues, statusCheckRollup: checks, github: { ...github, rateLimit: data.rateLimit } };
+      const nextIssues = issuePage?.pageInfo.endCursor;
+      const nextChecks = checkPage?.pageInfo.endCursor;
+      if (readIssues && (!nextIssues || nextIssues === issuesCursor) || readChecks && (!nextChecks || nextChecks === checksCursor)) throw new Error("PR quota context pagination cursor did not advance");
+      issuesCursor = nextIssues;
+      checksCursor = nextChecks;
+    }
+    throw new Error("PR quota context pagination exceeded 100 pages");
+  } catch (error) {
+    const { GitHubApiError: GitHubApiError2 } = await Promise.resolve().then(() => (init_github_client(), github_client_exports));
+    if (!(error instanceof GitHubApiError2) || !error.rateLimited || error.rateLimitResource !== "graphql") throw error;
+    return { status: "rate_limited", github, ...error.rateLimitReset === void 0 ? {} : { resetAt: new Date(error.rateLimitReset * 1e3).toISOString() } };
+  }
+}
 
 // src/fleet-track-inventory.ts
 var NO_DEPLOY_SURFACE_MODELS = /* @__PURE__ */ new Set(["none", "content"]);
@@ -28647,8 +28709,14 @@ function renderPluginCachePlan(plan, applied) {
   return lines2.join("\n");
 }
 
-// src/app-actor.ts
+// ../shared/github-quota-scope.ts
 var import_node_crypto6 = require("node:crypto");
+function appQuotaScope(appId, installationId, origin = "https://api.github.com", resource = "graphql") {
+  return `github-app-v1:${(0, import_node_crypto6.createHash)("sha256").update(JSON.stringify([new URL(origin).origin, appId.trim(), installationId.trim(), resource])).digest("hex")}`;
+}
+
+// src/app-actor.ts
+var import_node_crypto7 = require("node:crypto");
 var APP_ACTOR_ENV = "MMI_ACTOR";
 var APP_VAULT_REPO = "mutmutco/MMI-Hub";
 var APP_VAULT_KEYS = ["GITHUB_APP_ID", "GITHUB_APP_INSTALLATION_ID", "GITHUB_APP_PRIVATE_KEY"];
@@ -28699,10 +28767,14 @@ function mintAppJwt(appId, privateKeyPem, nowSec) {
     exp: now + APP_JWT_TTL_S,
     iss: appId
   }));
-  const signer = (0, import_node_crypto6.createSign)("RSA-SHA256");
+  const signer = (0, import_node_crypto7.createSign)("RSA-SHA256");
   signer.update(`${header}.${payload}`);
   return `${header}.${payload}.${signer.sign(privateKeyPem, "base64url")}`;
 }
+var activeQuotaScope;
+function activeAppQuotaScope() {
+  return activeQuotaScope;
+}
 async function mintInstallationToken(deps) {
   const [appId, installationId, privateKey] = await Promise.all(APP_VAULT_KEYS.map((k) => deps.fetchSecret(k)));
   if (!appId || !installationId || !privateKey) {
@@ -28748,7 +28820,7 @@ async function mintInstallationToken(deps) {
   if (!body.token || !body.expires_at) {
     throw new AppActorError("app actor: mint response carried no token \u2014 automation fails closed");
   }
-  return { token: body.token, expiresAt: body.expires_at };
+  return { token: body.token, expiresAt: body.expires_at, quotaScope: appQuotaScope(appId, installationId, process.env.GITHUB_API_URL) };
 }
 async function pollTokenOrUndefined(deps) {
   try {
@@ -28760,6 +28832,7 @@ async function pollTokenOrUndefined(deps) {
 var notedIneligibleCommand = false;
 async function activateAppActor(commandPath3, env, mint, note = (line) => process.stderr.write(`${line}
 `)) {
+  activeQuotaScope = void 0;
   const requested = (env[APP_ACTOR_ENV] ?? "").trim();
   if (!requested) return "personal";
   if (requested !== "app") {
@@ -28776,6 +28849,7 @@ async function activateAppActor(commandPath3, env, mint, note = (line) => proces
   delete env.GITHUB_TOKEN;
   const minted = await mint();
   env.GH_TOKEN = minted.token;
+  activeQuotaScope = minted.quotaScope;
   return "app";
 }
 
@@ -28991,6 +29065,7 @@ function registerBoardCommands(program3) {
       if (!o.out) console.log(output);
       else console.log(`Wrote board read to ${o.out} (UTF-8, ${writeUtf8Receipt(o.out, output)} bytes)`);
     } catch (e) {
+      if (o.json && e && typeof e === "object" && "quota" in e && e.quota) console.log(JSON.stringify(e.quota));
       return failGraceful(`board read failed: ${withDiscoverMissDetail(e.message)}`);
     }
   }
@@ -31221,7 +31296,7 @@ function renderDeployPortDoctor(report) {
 }
 
 // src/bootstrap-drift.ts
-var import_node_crypto7 = require("node:crypto");
+var import_node_crypto8 = require("node:crypto");
 function byteComparableSeeds(manifest, cls) {
   return manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self" && s.classes.includes(cls));
 }
@@ -31241,7 +31316,7 @@ function compareSeedBytes(hubContent, repoContent) {
   return normalize(hubContent) === normalize(repoContent) ? "match" : "drift";
 }
 function seedContentHash(content) {
-  return (0, import_node_crypto7.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
+  return (0, import_node_crypto8.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
 }
 function auditRepoSeedDrift(repo, seeds, hubContents, repoReads) {
   const byTarget = new Map(repoReads.map((r) => [r.target, r.content]));
@@ -31403,7 +31478,7 @@ function renderPropagationReport(plan) {
 }
 
 // src/bootstrap-propagation-identity.ts
-var import_node_crypto8 = require("node:crypto");
+var import_node_crypto9 = require("node:crypto");
 var PROPAGATION_BRANCH_PREFIX = "seed-propagate-";
 var TARGET_MARKER_NAME = "mmi-bootstrap-propagation-target";
 function safeBranchPart(value, maxLength, fallback) {
@@ -31416,7 +31491,7 @@ function repoSlug2(repo) {
 function propagationBranch(repo, target) {
   const repoPart = safeBranchPart(repoSlug2(repo), 32, "repo");
   const targetPart = safeBranchPart(target, 48, "target");
-  const hash = (0, import_node_crypto8.createHash)("sha256").update(repo.trim().toLowerCase()).update("\0").update(target).digest("hex").slice(0, 12);
+  const hash = (0, import_node_crypto9.createHash)("sha256").update(repo.trim().toLowerCase()).update("\0").update(target).digest("hex").slice(0, 12);
   return `${PROPAGATION_BRANCH_PREFIX}${repoPart}-${targetPart}-${hash}`;
 }
 function legacyPropagationBranch(repo) {
@@ -32572,7 +32647,7 @@ function renderBootstrapVerifyReport(report) {
 }
 
 // src/bootstrap-seed-delivery.ts
-var import_node_crypto9 = require("node:crypto");
+var import_node_crypto10 = require("node:crypto");
 init_github_client();
 var SHA = /^[a-f0-9]{40}$/;
 async function readSeedFile(repo, target, ref, client) {
@@ -32605,7 +32680,7 @@ async function targetedSeedPlan(repo, slug, target, baseBranch, sourceSha, clien
   }
   const baseSha = base?.object?.sha;
   if (!baseSha || !SHA.test(baseSha) || !SHA.test(sourceSha)) throw new Error("bootstrap apply: seed identity is unreadable");
-  const identity = (0, import_node_crypto9.createHash)("sha256").update(JSON.stringify([repo.toLowerCase(), target, baseSha, sourceSha])).digest("hex").slice(0, 24);
+  const identity = (0, import_node_crypto10.createHash)("sha256").update(JSON.stringify([repo.toLowerCase(), target, baseSha, sourceSha])).digest("hex").slice(0, 24);
   return { ...planSeedDelivery(rules, slug, baseBranch, `bootstrap-seed-${identity}`), baseSha, baseBranch };
 }
 async function verifyTargetedSeedBranch(repo, plan, target, client, allowMissing = false) {
@@ -34173,12 +34248,13 @@ async function stageStatus(member, stage, deps) {
       }
     }
   }
+  const lag = commit && head !== "unknown" ? commit.toLowerCase() !== head.toLowerCase() : null;
   return {
     stage,
     head,
     served,
     source,
-    lag: commit && head !== "unknown" ? commit.toLowerCase() !== head.toLowerCase() : null,
+    lag: source === "registry-pin" && lag === false ? null : lag,
     ...deployStatus ? { deployStatus } : {}
   };
 }
@@ -34208,7 +34284,7 @@ function formatSuiteStatus(report) {
 // src/suite-train.ts
 var import_node_fs29 = require("node:fs");
 var import_node_path28 = require("node:path");
-var import_node_crypto10 = require("node:crypto");
+var import_node_crypto11 = require("node:crypto");
 var SCHEMA = "mmi-suite-cut/v1";
 var SHA2 = /^[a-f0-9]{40}$/i;
 var RC_TAG = /^v\d+\.\d+\.\d+-rc\.\d+$/;
@@ -34243,7 +34319,7 @@ function readSuiteCut(path2) {
 }
 function writeSuiteCut(path2, record) {
   (0, import_node_fs29.mkdirSync)((0, import_node_path28.dirname)(path2), { recursive: true });
-  const temp = `${path2}.${(0, import_node_crypto10.randomBytes)(8).toString("hex")}.tmp`;
+  const temp = `${path2}.${(0, import_node_crypto11.randomBytes)(8).toString("hex")}.tmp`;
   try {
     (0, import_node_fs29.writeFileSync)(temp, JSON.stringify(record, null, 2), { flag: "wx" });
     (0, import_node_fs29.renameSync)(temp, path2);
@@ -37866,7 +37942,7 @@ init_github_client();
 
 // src/issue-commands.ts
 var import_node_fs34 = require("node:fs");
-var import_node_crypto11 = require("node:crypto");
+var import_node_crypto12 = require("node:crypto");
 init_cli_shared();
 init_clean_exit();
 init_error_codes();
@@ -38339,7 +38415,7 @@ function rowIdempotencyKey(batchKey, spec) {
   const identity = `${spec.type}
 ${spec.title.trim()}
 ${spec.body ?? ""}`;
-  const hash = (0, import_node_crypto11.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
+  const hash = (0, import_node_crypto12.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
   return `${batchKey}:${hash}`;
 }
 var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "label", "parent", "repo", "surface"]);
@@ -42316,7 +42392,7 @@ ${list}`);
     'Keep closing keywords on a dedicated line ("Closes #N") \u2014 GitHub parses close/fix/resolve + #N even mid-sentence, so pr create rewrites such prose to "part of #N" (#6039).',
     'When acceptance is only provable AFTER deploy, link with "Part of #N", never "Closes" \u2014 a closing reference closes the issue and advances its board card to Done on merge, before the acceptance evidence exists. Close it on that evidence instead (#6407).'
   ]);
-  pr.command("view <ref>").description("read a PR as structured JSON (merged state, head/base, URL, merge commit) \u2014 the mmi-cli read path (#2347). --comments folds in every comment; --context also adds linkedIssues (the issues it closes/references, #2894)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json [fields...]", 'gh --json field list (overrides the default field set). Accepts commas, spaces, or repeated --json flags \u2014 in PowerShell an unquoted comma list is an array literal, so QUOTE it: --json "state,baseRefName,mergeCommit"').option("--comments", "include every comment (body + comments in one call) \u2014 read the whole PR before landing it (#2894)").option("--context", "full working context in one call: implies --comments and also adds linkedIssues (the issues the PR closes/references) (#2894)").action(async (ref, o) => {
+  pr.command("view <ref>").description("read a PR as structured JSON (merged state, head/base, URL, merge commit) \u2014 the mmi-cli read path (#2347). --comments folds in every comment; --context also adds linkedIssues (the issues it closes/references, #2894)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json [fields...]", 'gh --json field list (overrides the default field set). Accepts commas, spaces, or repeated --json flags \u2014 in PowerShell an unquoted comma list is an array literal, so QUOTE it: --json "state,baseRefName,mergeCommit"').option("--comments", "include every comment (body + comments in one call) \u2014 read the whole PR before landing it (#2894)").option("--context", "full working context in one call: implies --comments and also adds linkedIssues (the issues the PR closes/references) (#2894)").option("--quota-context", "fixed App-only PR check read with verified quota scope and reset for harnesses").action(async (ref, o) => {
     let parsed;
     try {
       parsed = parseIssueRef(ref, o.repo);
@@ -42329,6 +42405,13 @@ ${list}`);
     const defaultPrFields = "number,title,state,url,isDraft,mergeable,mergedAt,mergeCommit,headRefName,baseRefName,author,labels";
     const effective = resolvePrViewFields(o.json, defaultPrFields);
     try {
+      if (o.quotaContext) {
+        if (o.comments || o.context || o.json) return fail("pr view: --quota-context cannot be combined with --comments, --context or --json");
+        const data2 = await readPrQuotaContext(repo, n, activeAppQuotaScope(), defaultGitHubClient());
+        console.log(JSON.stringify(data2));
+        if (data2.status === "rate_limited") process.exitCode = 1;
+        return;
+      }
       if (o.comments || o.context) {
         const data2 = await runPrViewContext(queryDeps(), { number: n, repo, comments: Boolean(o.comments), context: Boolean(o.context), jsonFields: effective });
         console.log(JSON.stringify(data2));
@@ -43244,6 +43327,10 @@ var NODE_VERIFY_TIMEOUT_MS = 5 * 6e4;
 var NPM_TRAIN_TIMEOUT_MS = 6e4;
 var NPM_FOLD_TIMEOUT_MS = NODE_PREPARE_TIMEOUT_MS;
 var JERV_GATEWAY_DEPLOY_TIMEOUT_MS = 20 * 6e4;
+var GIT_COMMIT_TIMEOUT_MS = 6e4;
+function trainGitArgs(args) {
+  return ["-c", "gc.auto=0", "-c", "maintenance.auto=false", ...args];
+}
 async function announceSummaryRefusal(path2, isHub = false) {
   let lines2;
   try {
@@ -43283,10 +43370,10 @@ function trainApplyDeps() {
     // #7027: every mutating train verb holds this checkout's train writer lock for its whole run.
     trainWriter: (verb, cwd) => acquireTrainWriterLock(cwd, `mmi-cli devops ${verb}`),
     run: async (file, args) => {
-      const timeout = file === "node" && args[1] === "prepare" ? NODE_PREPARE_TIMEOUT_MS : file === "node" && args[1] === "verify" ? NODE_VERIFY_TIMEOUT_MS : file === "npm" && (args[0] === "version" || args[0] === "ci" || args[0] === "install") ? NPM_FOLD_TIMEOUT_MS : file === "npm" ? NPM_TRAIN_TIMEOUT_MS : file === "bash" && /jerv-gateway-release-deploy\.sh$/.test(args[0] ?? "") ? JERV_GATEWAY_DEPLOY_TIMEOUT_MS : file !== "gh" ? GIT_TIMEOUT_MS : args[0] === "run" && args[1] === "watch" ? GH_RUN_WATCH_TIMEOUT_MS : GH_TRAIN_TIMEOUT_MS;
+      const timeout = file === "node" && args[1] === "prepare" ? NODE_PREPARE_TIMEOUT_MS : file === "node" && args[1] === "verify" ? NODE_VERIFY_TIMEOUT_MS : file === "npm" && (args[0] === "version" || args[0] === "ci" || args[0] === "install") ? NPM_FOLD_TIMEOUT_MS : file === "npm" ? NPM_TRAIN_TIMEOUT_MS : file === "bash" && /jerv-gateway-release-deploy\.sh$/.test(args[0] ?? "") ? JERV_GATEWAY_DEPLOY_TIMEOUT_MS : file === "git" && args[0] === "commit" ? GIT_COMMIT_TIMEOUT_MS : file !== "gh" ? GIT_TIMEOUT_MS : args[0] === "run" && args[1] === "watch" ? GH_RUN_WATCH_TIMEOUT_MS : GH_TRAIN_TIMEOUT_MS;
       const watchToken = file === "gh" && args[0] === "run" && args[1] === "watch" ? await pollToken() : void 0;
       try {
-        return isWin3 && file === "npm" ? (await execFileP("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP(file, args, { timeout, ...watchToken ? { env: { ...process.env, GH_TOKEN: watchToken } } : {} })).stdout;
+        return isWin3 && file === "npm" ? (await execFileP("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP(file, file === "git" ? trainGitArgs(args) : args, { timeout, ...watchToken ? { env: { ...process.env, GH_TOKEN: watchToken } } : {} })).stdout;
       } catch (e) {
         throw surfaceTrainSubprocessFailure(e, file, args);
       }
@@ -48343,14 +48430,14 @@ vercel preview (${preview.branch}): ${d.state}${d.url ? ` \u2014 ${d.url}` : ""}
 }
 
 // src/tenant-artifact.ts
-var import_node_crypto12 = require("node:crypto");
+var import_node_crypto13 = require("node:crypto");
 var import_node_fs48 = require("node:fs");
 var import_promises10 = require("node:fs/promises");
 var import_node_path45 = require("node:path");
 var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var MAX_BYTES = 5 * 1024 * 1024 * 1024;
 async function sha256File(path2) {
-  const hash = (0, import_node_crypto12.createHash)("sha256");
+  const hash = (0, import_node_crypto13.createHash)("sha256");
   for await (const chunk of (0, import_node_fs48.createReadStream)(path2)) hash.update(chunk);
   return hash.digest("hex");
 }
@@ -48580,13 +48667,13 @@ async function executeWaveLand(plan, deps) {
 
 // src/dist-drift.ts
 var import_node_child_process17 = require("node:child_process");
-var import_node_crypto14 = require("node:crypto");
+var import_node_crypto15 = require("node:crypto");
 var import_node_fs50 = require("node:fs");
 var import_node_os21 = require("node:os");
 var import_node_path47 = require("node:path");
 
 // ../scripts/distribution-digest.mjs
-var import_node_crypto13 = require("node:crypto");
+var import_node_crypto14 = require("node:crypto");
 var import_node_fs49 = require("node:fs");
 var import_node_path46 = require("node:path");
 var slash = (value) => value.replaceAll("\\", "/");
@@ -48599,7 +48686,7 @@ function repoPath(root, declaredPath, label) {
   return target;
 }
 function digestFiles(files) {
-  const hash = (0, import_node_crypto13.createHash)("sha256");
+  const hash = (0, import_node_crypto14.createHash)("sha256");
   for (const file of [...files].sort((a, b) => a.relative.localeCompare(b.relative))) {
     const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs49.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs49.readFileSync)(file.absolute);
     hash.update(file.relative, "utf8");
@@ -48629,7 +48716,7 @@ var DIST_ARTIFACTS = [
 ];
 var BOM_DIST_TREE_ID = "mmi-cli-dist";
 var ABSENT = "absent";
-var sha256 = (bytes) => `sha256:${(0, import_node_crypto14.createHash)("sha256").update(bytes).digest("hex")}`;
+var sha256 = (bytes) => `sha256:${(0, import_node_crypto15.createHash)("sha256").update(bytes).digest("hex")}`;
 function artifactDrift(path2, committedBytes, rebuiltBytes) {
   const committed = committedBytes ? sha256(committedBytes) : ABSENT;
   const rebuiltExpected = rebuiltBytes ? sha256(rebuiltBytes) : ABSENT;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.31",
+  "version": "4.5.32",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",