@mutmutco/cli 4.5.57 → 4.5.59

package/dist/main.cjs

@@ -5825,11 +5825,14 @@ function waitReadFailureMessage(e) {
   return (stderr || err?.message || String(e)).replace(/\s+/g, " ").slice(0, 300);
 }
 var PR_CHECKS_POLL_MS = 3e4;
+function pollIntervalMs(elapsedMs) {
+  return Math.min(4 * PR_CHECKS_POLL_MS, PR_CHECKS_POLL_MS * 2 ** Math.floor(Math.max(0, elapsedMs) / 3e5));
+}
 var PR_CHECKS_TIMEOUT_MS = 30 * 6e4;
 var PR_CHECKS_SUCCESS_CONFIRMATIONS = 2;
 var PR_CHECKS_CONFIRM_MS = 5e3;
 var PR_CHECKS_FAILURE_CONFIRMATIONS = 2;
-var PR_CHECKS_RATELIMIT_FLOOR = 50;
+var PR_CHECKS_RATELIMIT_FLOOR = 1e3;
 var PR_CHECKS_RATELIMIT_JITTER_MAX_MS = 5e3;
 var NO_CI_LIVE_CHECKS_CONTRADICTION_REASON = "ci:none contradicted by live check runs on PR head";
 var PR_CHECKS_ZERO_RUNS_GRACE_MS = 2 * 6e4;
@@ -5965,7 +5968,7 @@ async function waitForPrChecks(deps) {
     }
     if (state === "failing") {
       lastDetail = "failing (a check failed; others still running)";
-      await deps.sleep(PR_CHECKS_POLL_MS);
+      await deps.sleep(pollIntervalMs(now() - started));
       continue;
     }
     if (state === "success") {
@@ -6003,11 +6006,11 @@ async function waitForPrChecks(deps) {
       } else {
         zeroRunsStreak = 0;
       }
-      await deps.sleep(PR_CHECKS_POLL_MS);
+      await deps.sleep(pollIntervalMs(now() - started));
       continue;
     }
     lastDetail = state;
-    await deps.sleep(PR_CHECKS_POLL_MS);
+    await deps.sleep(pollIntervalMs(now() - started));
   }
   return { policy, status: "timeout", reason, detail: lastDetail, waitedMs: now() - started };
 }
@@ -6044,15 +6047,38 @@ async function pollToken() {
   pollTokenOnce ??= pollTokenProvider().catch(() => void 0);
   return pollTokenOnce;
 }
-async function defaultGhApi(args) {
-  const token = await pollToken();
-  const { stdout } = await execFileP("gh", ["api", ...args], {
-    timeout: REST_GH_TIMEOUT_MS,
-    // Only when a token was actually minted: passing `env` at all would otherwise replace the
-    // inherited environment wholesale, and `gh` needs the rest of it (PATH, GH_HOST, config home).
-    ...token ? { env: { ...process.env, GH_TOKEN: token } } : {}
+var INCLUDED_HEADER_BLOCK = /^(?:\r?\n)?HTTP\/\d(?:\.\d)? (\d{3})[^\n]*\n(?:[^\n]+\n)*?\r?\n/gm;
+function parseIncludedOutput(out) {
+  let status;
+  let etag;
+  let pages = 0;
+  const body = out.replace(INCLUDED_HEADER_BLOCK, (block, code) => {
+    if (pages++ === 0) {
+      status = Number(code);
+      etag = /^etag:\s*(.+?)\s*$/im.exec(block)?.[1];
+    }
+    return "";
   });
-  return stdout;
+  return { body, status, etag, pages };
+}
+var etagCache = /* @__PURE__ */ new Map();
+async function defaultGhApi(args) {
+  const key = args.join("\0");
+  const cached = etagCache.get(key);
+  let stdout;
+  try {
+    ({ stdout } = await execFileP("gh", ["api", "--include", ...cached ? ["-H", `If-None-Match: ${cached.etag}`] : [], ...args], {
+      timeout: REST_GH_TIMEOUT_MS
+    }));
+  } catch (e) {
+    const out = e.stdout;
+    if (cached && typeof out === "string" && parseIncludedOutput(out).status === 304) return cached.body;
+    throw e;
+  }
+  const { body, etag, pages } = parseIncludedOutput(stdout);
+  if (etag && pages === 1) etagCache.set(key, { etag, body });
+  else etagCache.delete(key);
+  return body;
 }
 function classifyCheckRun(run) {
   if (run.status !== "completed") return "pending";
@@ -8475,6 +8501,9 @@ function isValidSecretKey(key) {
   if (key.includes("..") || key.startsWith("/") || key.includes("*")) return false;
   return KEY_RE.test(key);
 }
+function stripTrailingCRLF(value) {
+  return value.replace(/\r\n$|\r$|\n$/, "");
+}
 function classifyTier(_slug, key) {
   const slash2 = key.indexOf("/");
   if (slash2 === -1) return "project";
@@ -8637,7 +8666,7 @@ async function fetchSecretValue(deps, key, opts, diagnose = false) {
     if (!res.ok) {
       if (diagnose) {
         const body = await readJsonBody(res);
-        const reason = res.status === 403 ? "authority refused" : res.status === 429 ? "rate limited" : "Hub route refused";
+        const reason = res.status === 403 ? "authority refused" : res.status === 429 ? "rate limited" : body.code === "github-rate-limited" ? "Hub GitHub App allowance used up, not a denial" : "Hub route refused";
         throw new Error(`${reason} (HTTP ${res.status}${typeof body.error === "string" && /^(forbidden|unauthorized|rate limit|too many requests|master-admin only)$/i.test(body.error) ? `: ${body.error}` : ""})`);
       }
       return null;
@@ -9918,6 +9947,10 @@ async function secretsVerify(deps, key, opts) {
   }
   const hasProviderVerifier = Boolean(providerForSecretKey(key));
   const value = await fetchSecretValue(deps, key, opts);
+  if (value && value !== stripTrailingCRLF(value)) {
+    deps.err(`${key}: stored value ends in a CR or LF character \u2014 likely corrupted by a piped write; re-set it with \`mmi-cli vault secrets set ${key}\``);
+    return false;
+  }
   if (!hasProviderVerifier) {
     if (!value) {
       deps.err(`${key}: ABSENT or unreachable at this coordinate \u2014 no value could be read`);
@@ -10105,6 +10138,40 @@ async function secretsDeclare(deps, key, opts) {
   deps.log(`declared ${key} (project tier, ${slug}) \u2014 catalog metadata only; ask master (secrets request) to wire it into requiredRuntimeSecrets`);
   return true;
 }
+async function secretsUndeclare(deps, key, opts) {
+  if (!DECLARE_KEY_RE.test(key.split("@")[0] ?? "")) {
+    deps.err(`secrets undeclare: invalid key ${JSON.stringify(key)} \u2014 must be an env-style name (UPPER_SNAKE convention), optionally @dev|rc|main`);
+    return false;
+  }
+  const repo = await targetRepo(deps, opts);
+  const slug = await vaultSlug(deps, opts);
+  let res;
+  try {
+    res = await deps.fetch(`${deps.apiUrl}/projects/${slug}/secrets/undeclare`, {
+      method: "POST",
+      headers: await deps.headers({ "content-type": "application/json" }),
+      body: JSON.stringify({ repo, key }),
+      signal: AbortSignal.timeout(TIMEOUT_MS)
+    });
+  } catch (e) {
+    deps.err(`secrets undeclare: ${e.message}`);
+    return false;
+  }
+  const body = await readJsonBody(res);
+  if (!res.ok) {
+    deps.err(await upgradeMessage(res, body) ?? `secrets undeclare failed: HTTP ${res.status}${errorDetail(body)}`);
+    return false;
+  }
+  const undeclared = body?.undeclared !== false;
+  if (opts.json) {
+    deps.log(JSON.stringify({ ok: true, key, undeclared }));
+    return true;
+  }
+  deps.log(
+    undeclared ? `undeclared ${key} (project tier, ${slug}) \u2014 catalog entry removed; the vault value was already absent` : `${key} was not declared in ${slug}'s catalog \u2014 nothing to undeclare`
+  );
+  return true;
+}
 function parseRailsCredentialMapping(raw, stage) {
   const eq = raw.indexOf("=");
   if (eq <= 0 || eq === raw.length - 1) return null;
@@ -15697,11 +15764,12 @@ function planBootstrapLabels(labels, live) {
     ...labelsToPrune(labels.map((label) => label.name)).filter((name) => existing.has(name)).map((name) => ({ name, action: "DELETE" }))
   ];
 }
-function renderBootstrapAncillaryPlan(labels, environments) {
+function renderBootstrapAncillaryPlan(labels, environments, exceptions = []) {
   return [
     "bootstrap apply \u2014 labels and environments (dry-run; no mutations):",
     ...labels.map(({ action, name }) => `  ${action} label ${name}`),
-    ...environments.map(({ action, environment, reason }) => `  ${action} environment ${environment} (${reason})`)
+    ...environments.map(({ action, environment, reason }) => `  ${action} environment ${environment} (${reason})`),
+    ...exceptions.map(({ name, detail }) => `  OK environment ${name} (${detail})`)
   ].join("\n");
 }
 function resolveSeedContent(seed, vars, readFile9) {
@@ -16301,6 +16369,17 @@ function isHubControlRepo(repo) {
 function isJervHubRepo(repo) {
   return repo.toLowerCase() === JERV_HUB_REPO.toLowerCase();
 }
+var WINDOWS_GIT_BASH_MSYSTEM = /^(?:MINGW(?:32|64)|UCRT64|CLANG(?:64|ARM64))$/u;
+function isWindowsGitBash(msystem) {
+  return WINDOWS_GIT_BASH_MSYSTEM.test(msystem ?? "");
+}
+function assertGitBashOnWindowsForJervHubRelease(repo, platform2 = process.platform, env = process.env) {
+  if (platform2 !== "win32" || !isJervHubRepo(repo)) return;
+  if (isWindowsGitBash(env.MSYSTEM)) return;
+  throw new Error(
+    `${repo}: Windows Git Bash required \u2014 the release train's Jerv Gateway deploy leg refuses outside it, and the current shell is not Git Bash (MSYSTEM=${env.MSYSTEM ?? "(unset)"}). Run the release from Git Bash instead, e.g.: "C:/Program Files/Git/bin/bash.exe" -lc "mmi-cli devops release --apply"`
+  );
+}
 
 // src/train-apply-correlation.ts
 var import_node_fs18 = require("node:fs");
@@ -17069,10 +17148,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.57",
-    tag: "v4.5.57",
-    commit: "d8aff7ba4689",
-    npm: "@mutmutco/cli@4.5.57"
+    version: "4.5.59",
+    tag: "v4.5.59",
+    commit: "ea079366d96e",
+    npm: "@mutmutco/cli@4.5.59"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17089,14 +17168,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.57"
+          v3Target: "v4.5.59"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.57 and redeploy the Hub Lambda from tag v4.5.57 (d8aff7ba4689); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.57 (@mutmutco/cli@4.5.57, tag commit d8aff7ba4689 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.59 and redeploy the Hub Lambda from tag v4.5.59 (ea079366d96e); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.59 (@mutmutco/cli@4.5.59, tag commit ea079366d96e \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -20094,9 +20173,14 @@ function validSuiteCutContext(repo, context) {
 function authorisedSuiteCut(repo, meta, context) {
   return validSuiteCutContext(repo, context) && !!meta?.suite && context.lead.toLowerCase() === suiteLeadRepo(repo, meta.suite).toLowerCase();
 }
+var BUNDLE_ONLY_RC_EXCEPTION = "suite member: rc is bundle-only (no rc runtime)";
+function isBundleOnlySuiteMember(repo, suite) {
+  if (!suite) return false;
+  return repo.split("/")[1]?.toLowerCase() !== suite.toLowerCase();
+}
 function suiteMemberRefusal(repo, meta, lane, solo = false, cut) {
   const suite = meta?.suite;
-  if (!suite || repo.split("/")[1]?.toLowerCase() === suite.toLowerCase()) return null;
+  if (!suite || !isBundleOnlySuiteMember(repo, suite)) return null;
   if (authorisedSuiteCut(repo, meta, cut)) return null;
   if (lane !== "rcand" && solo) return null;
   return `${repo} is part of the ${suite} suite; run the suite cut/release from ${suiteLeadRepo(repo, suite)} (mmi-cli devops suite rcand|release). A solo backend release needs --suite-solo --owner-go.`;
@@ -20701,7 +20785,7 @@ async function appendServedChannelLegs(deps, input, dispatch) {
   const publishStatus = input.publish?.state === "complete" ? "success" : "failure";
   const prepared = await (input.prepared ?? prepareServedChannel(deps, input));
   if (!isHubControlRepo(input.repo)) {
-    const bundleOnly = validSuiteCutContext(input.repo, deps.suiteCut) && input.repo.split("/")[1]?.toLowerCase() !== "mmi-katip";
+    const bundleOnly = validSuiteCutContext(input.repo, deps.suiteCut);
     const [home2, proof2] = await Promise.all([
       appendInstallHomePublish(deps, { repo: input.repo, installer: input.installer, publishStatus, watch: input.watch }, dispatch),
       bundleOnly && servedChannelFor(input.repo, input.installer) ? Promise.resolve({ ...dispatch, note: `${dispatch.note}; served channel not probed: a suite bundle-only release does not deploy the backend that serves it (#7468)` }) : appendServedChannelProof(deps, { repo: input.repo, tag: input.tag, shipped: shipLegsGreen(input.deploy, input.publish), installer: input.installer }, dispatch)
@@ -20971,7 +21055,7 @@ async function discoverShaWorkflowRuns(deps, repo, headSha, seenRunIds) {
   return extra;
 }
 async function dispatchDeploy(deps, ctx, stage, ref, model, watch, autoRunSince, autoRunHeadSha, dispatchFailure = "throw", publishDir) {
-  if (validSuiteCutContext(ctx.repo, deps.suiteCut) && ctx.slug !== "mmi-katip" && stage !== "dev") {
+  if (validSuiteCutContext(ctx.repo, deps.suiteCut) && stage !== "dev") {
     return { note: "suite bundle-only: live backend not deployed", deployStatus: "success" };
   }
   if (isCentralDispatchModel(model)) {
@@ -21098,7 +21182,7 @@ async function attemptRetire(deps, ctx) {
   return { status: "failed", category: r.category ?? "transport-failed", note: r.note };
 }
 async function retireRcRuntime(deps, ctx, model, deployStatus, releasedRcSha) {
-  if (validSuiteCutContext(ctx.repo, deps.suiteCut) && ctx.slug !== "mmi-katip")
+  if (validSuiteCutContext(ctx.repo, deps.suiteCut))
     return { status: "not-applicable", note: "bundle-only suite member has no rc runtime to retire" };
   if (model !== "tenant-container") {
     return { status: "not-applicable", note: `${model} has no co-resident rc runtime to retire` };
@@ -24718,7 +24802,7 @@ async function runTrainDoctor(input) {
     }
   }
   let preflightTimeouts = 0;
-  if (!(repo.split("/")[1]?.toLowerCase() !== "mmi-katip" && authorisedSuiteCut(repo, meta, input.suiteCut))) for (; ; ) {
+  if (!authorisedSuiteCut(repo, meta, input.suiteCut)) for (; ; ) {
     try {
       await train.runSelf(["secrets", "preflight", "--stage", stage, "--repo", repo, ...lane === "hotfix" ? ["--lane", "hotfix"] : []]);
       break;
@@ -25151,6 +25235,7 @@ function enforceGateBudget(deps, repo) {
   }
 }
 async function preflight(deps, ctx, stage, meta, lane) {
+  assertGitBashOnWindowsForJervHubRelease(ctx.repo);
   deps.warn?.("Release: Checking release prerequisites");
   if (deps.suiteCut && !authorisedSuiteCut(ctx.repo, meta, deps.suiteCut))
     throw new Error(`${ctx.repo}: suite cut context does not match registry META; no deployment or tag was changed`);
@@ -25161,7 +25246,7 @@ async function preflight(deps, ctx, stage, meta, lane) {
   if (model === "none") {
     throw new Error(`${ctx.repo} is not Hub-deployed (deployModel=none) \u2014 the release train does not apply; use the project's own release path`);
   }
-  if (!(ctx.slug !== "mmi-katip" && authorisedSuiteCut(ctx.repo, meta, deps.suiteCut)))
+  if (!authorisedSuiteCut(ctx.repo, meta, deps.suiteCut))
     await deps.runSelf(["secrets", "preflight", "--stage", stage, "--repo", ctx.repo, ...lane === "hotfix" ? ["--lane", "hotfix"] : []]);
   await assertNpmMajorPreflightFromWorkflows(deps, ctx.repo);
   await assertActionsJobsCanStart(deps, ctx.repo);
@@ -25760,7 +25845,7 @@ async function recordRcandDeployLegs(ledger, deps, anchors, deployModel, d, opts
   );
   const dispatch = recovered.deployStatus === "failure" && !recovered.note.includes(RCAND_RETRY_DEPLOY_COMMAND) ? { ...recovered, note: `once the cause is fixed, retry this rc deploy with \`${RCAND_RETRY_DEPLOY_COMMAND}\` (same tag and SHA, never re-cut): ${recovered.note}` } : recovered;
   const unverifiable = !isCentralDispatchModel(deployModel) && dispatch.deployStatus === "pending" && dispatch.runId == null && !dispatch.workflowRuns?.length;
-  const deployEntry = validSuiteCutContext(anchors.repo, deps.suiteCut) && anchors.repo.split("/")[1]?.toLowerCase() !== "mmi-katip" ? { state: "skipped", sha, note: "suite bundle-only: rc backend not deployed (#7262)" } : unverifiable ? { state: "skipped", sha, note: `${dispatch.note} \u2014 no run to verify on rc; recorded skipped, never pending (#6068)` } : deployPhaseInput(deployModel, dispatch, { releaseSha: sha });
+  const deployEntry = validSuiteCutContext(anchors.repo, deps.suiteCut) ? { state: "skipped", sha, note: "suite bundle-only: rc backend not deployed (#7262)" } : unverifiable ? { state: "skipped", sha, note: `${dispatch.note} \u2014 no run to verify on rc; recorded skipped, never pending (#6068)` } : deployPhaseInput(deployModel, dispatch, { releaseSha: sha });
   await recordPhase(ledger, deps, anchors, "deploy", phaseEntry(deployEntry), { ...opts, landed: "the immutable rc tag, the green wall, and origin/rc" });
   await recordPhase(ledger, deps, anchors, "publish", phaseEntry({ state: "skipped", sha, note: "rcand publishes nothing \u2014 the publish leg rides the release" }), { ...opts, landed });
   await recordPhase(ledger, deps, anchors, "alignment", phaseEntry({ state: "skipped", sha, note: "rcand aligns no branch \u2014 alignment rides the release" }), { ...opts, landed });
@@ -25923,7 +26008,7 @@ ${recovery.note}`), recoveryInput);
     }
   );
   const deployDispatch = annotateVersionEnvDispatch(await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, releaseSha, recoveredDeployDispatch), versionEnv);
-  const deployLeg = phaseEntry(validSuiteCutContext(ctx.repo, deps.suiteCut) && ctx.slug !== "mmi-katip" ? { state: "skipped", sha: releaseSha, note: "suite bundle-only: live backend not deployed (#7263)" } : deployPhaseInput(deployModel, deployDispatch, { releaseSha }));
+  const deployLeg = phaseEntry(validSuiteCutContext(ctx.repo, deps.suiteCut) ? { state: "skipped", sha: releaseSha, note: "suite bundle-only: live backend not deployed (#7263)" } : deployPhaseInput(deployModel, deployDispatch, { releaseSha }));
   await recordPhase(ledger, deps, ledgerAnchors, "deploy", deployLeg, {
     landed: "the immutable tag, the green required-check wall, the origin/main fast-forward, and the verified GitHub Release"
   });
@@ -26346,7 +26431,7 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
       dispatch2.deployStatus = "success";
       dispatch2.note = `historical ${deployModel} deploy/publish status: success (re-verified by the recorded run)`;
     }
-    if (validSuiteCutContext(ctx.repo, deps.suiteCut) && ctx.slug !== "mmi-katip") {
+    if (validSuiteCutContext(ctx.repo, deps.suiteCut)) {
       phaseInputs.deploy = { state: "skipped", sha: tagSha, note: "suite bundle-only: live backend not deployed (#7263)" };
       if (dispatch2.deployStatus !== "failure" && (phaseInputs.publish.state === "complete" || phaseInputs.publish.state === "skipped")) {
         dispatch2.deployStatus = "success";
@@ -26481,7 +26566,7 @@ ${recovery.note}`), recoveryInput);
   );
   const deployDispatch = annotateVersionEnvDispatch(await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, tagSha, recoveredDeployDispatch), versionEnv);
   steps.push(`dispatched the ${deployModel} deploy path`);
-  const deployLeg = persisted?.phases.deploy.superseded === true ? persisted.phases.deploy : phaseEntry(validSuiteCutContext(ctx.repo, deps.suiteCut) && ctx.slug !== "mmi-katip" ? { state: "skipped", sha: tagSha, note: "suite bundle-only: live backend not deployed (#7263)" } : deployPhaseInput(deployModel, deployDispatch, { releaseSha: tagSha }));
+  const deployLeg = persisted?.phases.deploy.superseded === true ? persisted.phases.deploy : phaseEntry(validSuiteCutContext(ctx.repo, deps.suiteCut) ? { state: "skipped", sha: tagSha, note: "suite bundle-only: live backend not deployed (#7263)" } : deployPhaseInput(deployModel, deployDispatch, { releaseSha: tagSha }));
   if (persisted?.phases.deploy.superseded !== true) {
     await recordPhase(ledger, deps, anchors, "deploy", deployLeg, {
       strict: ledgerMode === "strict",
@@ -27461,15 +27546,16 @@ async function branchPresence(deps, repo, branch) {
   }
 }
 function collectRegistryRepos(projects) {
-  const seen = /* @__PURE__ */ new Set();
+  const seen = /* @__PURE__ */ new Map();
   for (const project2 of projects) {
     for (const raw of project2.repos ?? []) {
       const repo = raw.includes("/") ? raw : `mutmutco/${raw}`;
-      seen.add(repo);
+      const key = repo.toLowerCase();
+      if (!seen.has(key)) seen.set(key, repo);
     }
   }
-  if (![...seen].some((r) => r.toLowerCase() === HUB_REPO4.toLowerCase())) seen.add(HUB_REPO4);
-  return [...seen].sort((a, b) => a.localeCompare(b));
+  if (!seen.has(HUB_REPO4.toLowerCase())) seen.set(HUB_REPO4.toLowerCase(), HUB_REPO4);
+  return [...seen.values()].sort((a, b) => a.localeCompare(b));
 }
 async function prTriggeredWorkflowsOnRef(deps, repo, branch, repoClass) {
   const hasGate = repoClass === "hub" ? true : await contentExists(deps, repo, branch, PRODUCT_GATE_PATH);
@@ -27516,7 +27602,29 @@ async function filterPullRequestTriggered(deps, repo, branch, paths) {
   }
   return kept;
 }
-async function auditRepoCi(repo, deps) {
+function trackUnauditableReads(deps) {
+  let reason;
+  const record = (e) => {
+    if (reason) return;
+    const err = e;
+    if (err?.rateLimited) reason = `GitHub App rate-limited: ${err.message ?? "rate limit exceeded"}`;
+    else if (err?.status === 403 || err?.status === 429) reason = `HTTP ${err.status}${err.message ? `: ${err.message}` : ""}`;
+  };
+  const client = {
+    ...deps.client,
+    rest: async (method, path2, init) => {
+      try {
+        return await deps.client.rest(method, path2, init);
+      } catch (e) {
+        record(e);
+        throw e;
+      }
+    }
+  };
+  return { deps: { ...deps, client }, reason: () => reason };
+}
+async function auditRepoCi(repo, callerDeps) {
+  const { deps, reason: unauditedReason } = trackUnauditableReads(callerDeps);
   const meta = await deps.getProjectMeta(slugFromRepo(repo));
   const repoClass = classifyRepo(repo, meta);
   const checks = [];
@@ -27811,6 +27919,10 @@ async function auditRepoCi(repo, deps) {
     const workflows = await getBranchWorkflows();
     if (workflows) checks.push(...await auditSharedActionPins(workflows, deps));
   }
+  const failure = unauditedReason();
+  if (failure) {
+    return { repo, class: repoClass, mergePolicy: policy, ok: false, checks: [], explicitNoCi, unauditedReason: failure };
+  }
   const ok = checks.every((c) => c.ok);
   return { repo, class: repoClass, mergePolicy: policy, ok, checks, explicitNoCi };
 }
@@ -27852,8 +27964,8 @@ function renderCiAuditMarkdown(report) {
     "|------|-------|--------|----|---------|"
   ];
   for (const r of report.repos) {
-    const gap = r.checks.find((c) => !c.ok);
-    lines2.push(`| ${r.repo} | ${r.class} | ${r.mergePolicy} | ${r.ok ? "yes" : "no"} | ${gap?.label ?? "\u2014"} |`);
+    const gap = r.unauditedReason ? `CANNOT AUDIT \u2014 ${r.unauditedReason}` : r.checks.find((c) => !c.ok)?.label ?? "\u2014";
+    lines2.push(`| ${r.repo} | ${r.class} | ${r.mergePolicy} | ${r.ok ? "yes" : "no"} | ${gap} |`);
   }
   return lines2.join("\n");
 }
@@ -27863,8 +27975,13 @@ function renderCiAuditText(report) {
     renderCiAuditScopeLine(report)
   ];
   for (const r of report.repos) {
+    const verdict = r.unauditedReason ? "CANNOT AUDIT" : r.ok ? "OK" : "GAP";
     lines2.push(`
-${r.repo} (${r.class}, policy=${r.mergePolicy}) ${r.ok ? "OK" : "GAP"}`);
+${r.repo} (${r.class}, policy=${r.mergePolicy}) ${verdict}`);
+    if (r.unauditedReason) {
+      lines2.push(`  UNAUDITED \u2014 ${r.unauditedReason}`);
+      continue;
+    }
     for (const c of r.checks) {
       lines2.push(`  ${c.ok ? "OK" : "FAIL"} ${c.label}${c.detail ? ` \u2014 ${c.detail}` : ""}`);
     }
@@ -31350,7 +31467,7 @@ async function readSecretStdin() {
   }
   const chunks = [];
   for await (const chunk of process.stdin) chunks.push(chunk);
-  return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+  return stripTrailingCRLF(Buffer.concat(chunks).toString("utf8"));
 }
 function makeSecretsDeps(cfg) {
   return {
@@ -31502,6 +31619,10 @@ function registerSecretsCommands(program3) {
     });
     if (!ok) process.exitCode = 1;
   }));
+  secrets.command("undeclare <key>").description("project-admin self-undeclare: retire a secrets-catalog entry for your own repo (catalog metadata only \u2014 never a value); declare's exact inverse (MMI-Hub#7524). Refuses (409) while a live vault value still exists for the key at any declared stage \u2014 delete the value first (`secrets rm`), then undeclare. A key that is not declared is a no-op, not an error.").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((key, o) => withSecrets(async (d) => {
+    const ok = await secretsUndeclare(d, key, { repo: o.repo, json: o.json });
+    if (!ok) process.exitCode = 1;
+  }));
   secrets.command("verify <key>").description("validate a known provider secret without printing its value; a key with no configured provider verifier falls back to a value-free PRESENT/ABSENT reachability check (#3436)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--slug <slug>", "org-infra namespace (e.g. _org) for a granted org secret").action((key, o) => withSecrets(async (d) => {
     const ok = await secretsVerify(d, key, o);
     if (!ok) process.exitCode = 1;
@@ -32356,11 +32477,12 @@ function environmentNamesForTrack(track) {
   const branches = new Set(branchesForTrack(track));
   return REPO_ENVIRONMENTS.filter((environment) => branches.has(ENVIRONMENT_BRANCHES[environment]));
 }
-function repoEnvironmentSpecs(_repo, releaseTrack = "full") {
+function repoEnvironmentSpecs(repo, releaseTrack = "full", suite) {
   const included = new Set(environmentNamesForTrack(releaseTrack));
   const trackExceptions = releaseTrack === "full" ? void 0 : TRACK_ENVIRONMENT_EXCEPTIONS[releaseTrack];
+  const bundleOnlyRc = isBundleOnlySuiteMember(repo, suite);
   return REPO_ENVIRONMENTS.map((name) => {
-    const exception = name in included ? void 0 : trackExceptions?.[name];
+    const exception = !included.has(name) ? trackExceptions?.[name] : name === "rc" && bundleOnlyRc ? BUNDLE_ONLY_RC_EXCEPTION : void 0;
     return {
       name,
       branch: ENVIRONMENT_BRANCHES[name],
@@ -32371,8 +32493,8 @@ function repoEnvironmentSpecs(_repo, releaseTrack = "full") {
     };
   });
 }
-function provisionedEnvironmentSpecs(repo, releaseTrack = "full") {
-  return repoEnvironmentSpecs(repo, releaseTrack).filter((spec) => spec.exception == null);
+function provisionedEnvironmentSpecs(repo, releaseTrack = "full", suite) {
+  return repoEnvironmentSpecs(repo, releaseTrack, suite).filter((spec) => spec.exception == null);
 }
 function asEnvironmentList(value) {
   if (Array.isArray(value)) return value;
@@ -32412,10 +32534,10 @@ var PLAN_GATED_PROTECTION_RE = /billing plan/i;
 function isPlanGatedProtectionError(error) {
   return PLAN_GATED_PROTECTION_RE.test(String(error?.message ?? error));
 }
-async function reconcileRepoEnvironments(repo, releaseTrack, client) {
+async function reconcileRepoEnvironments(repo, releaseTrack, client, suite) {
   const raw = await client.rest("GET", `repos/${repo}/environments`);
   const live = new Map(asEnvironmentList(raw).flatMap((entry) => entry.name ? [[entry.name, entry]] : []));
-  const planned = provisionedEnvironmentSpecs(repo, releaseTrack);
+  const planned = provisionedEnvironmentSpecs(repo, releaseTrack, suite);
   const created = [];
   const updated = [];
   const skipped = [];
@@ -32448,10 +32570,10 @@ async function reconcileRepoEnvironments(repo, releaseTrack, client) {
   }
   return { repo, planned, created, updated, skipped, planGated };
 }
-async function verifyRepoEnvironments(repo, releaseTrack, client) {
+async function verifyRepoEnvironments(repo, releaseTrack, client, suite) {
   const raw = await client.rest("GET", `repos/${repo}/environments`);
   const live = new Map(asEnvironmentList(raw).flatMap((entry) => entry.name ? [[entry.name, entry]] : []));
-  return provisionedEnvironmentSpecs(repo, releaseTrack).map((spec) => {
+  return provisionedEnvironmentSpecs(repo, releaseTrack, suite).map((spec) => {
     const drift = environmentDrift(live.get(spec.name), spec);
     return { environment: spec.name, missing: !live.has(spec.name), problems: drift.problems, notes: drift.notes };
   });
@@ -32569,7 +32691,17 @@ function planBootstrapControlPlane(input) {
     }
   }
   const deployStages = deployStagesForBootstrap(input.deployModel, input.releaseTrack);
+  const bundleOnlyRc = isBundleOnlySuiteMember(input.repo, input.suite);
   for (const stage of deployStages) {
+    if (stage === "rc" && bundleOnlyRc) {
+      rows.push({
+        kind: "deploy-row",
+        target: "DEPLOY#rc",
+        action: "skip",
+        detail: BUNDLE_ONLY_RC_EXCEPTION
+      });
+      continue;
+    }
     const present = input.deployFacts?.stages?.[stage]?.present === true;
     const command = bootstrapSetDeployCommand(input.repo, stage, input.deployModel);
     rows.push(present && stage === "main" ? {
@@ -32959,10 +33091,13 @@ function centralContainerPortRangeCheck(deployModel, portRange, repo) {
     detail: ok ? void 0 : `${deployModel} needs PROJECT# META.portRange for mmi-cli stage \u2014 assign with: mmi-cli stage port-range ${repo}`
   };
 }
-function deployRowChecks(repo, deployModel, releaseTrack, facts, factsRead) {
+function deployRowChecks(repo, deployModel, releaseTrack, facts, factsRead, suite) {
   const stages = deployStagesForBootstrap(deployModel, releaseTrack);
   if (!stages.length) return [];
   return stages.map((stage) => {
+    if (stage === "rc" && isBundleOnlySuiteMember(repo, suite)) {
+      return { ok: true, label: "DEPLOY#rc row exception", detail: BUNDLE_ONLY_RC_EXCEPTION };
+    }
     const ok = factsRead && facts?.stages?.[stage]?.present === true;
     return {
       ok,
@@ -33023,7 +33158,7 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
   }
   let environmentDrift2 = [];
   try {
-    environmentDrift2 = await verifyRepoEnvironments(repo, effectiveTrack, deps.client);
+    environmentDrift2 = await verifyRepoEnvironments(repo, effectiveTrack, deps.client, deps.projectMeta?.suite);
   } catch (e) {
     checks.push({
       ok: false,
@@ -33038,7 +33173,7 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
       detail: drift.problems.length ? drift.problems.join("; ") : drift.notes.length ? `advisory: ${drift.notes.join("; ")}` : void 0
     });
   }
-  for (const spec of repoEnvironmentSpecs(repo, releaseTrack ?? (repoClass === "content" ? "trunk" : "full")).filter((entry) => entry.exception)) {
+  for (const spec of repoEnvironmentSpecs(repo, releaseTrack ?? (repoClass === "content" ? "trunk" : "full"), deps.projectMeta?.suite).filter((entry) => entry.exception)) {
     checks.push({ ok: true, label: `repository environment exception: ${spec.name}`, detail: spec.exception });
   }
   const strayTrainBranches = TRAIN_BRANCHES2.filter((b) => !branchesWanted.includes(b) && branchNames.has(b));
@@ -33112,7 +33247,8 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
     deps.deployModel,
     effectiveTrack,
     deps.deployFacts,
-    deps.deployFactsRead === true
+    deps.deployFactsRead === true,
+    deps.projectMeta?.suite
   ));
   const readme = await contentText(deps, repo, baseBranch, "README.md");
   checks.push({
@@ -33349,9 +33485,13 @@ function applyWaivers(checks, waivers) {
   const set = new Set(waivers);
   return checks.map((c) => !c.ok && set.has(c.label) ? { ...c, waived: true } : c);
 }
+var laneReasons = (doctor) => doctor.findings.filter((f) => (f.severity === "blocker" || f.code === "origin-unverified") && f.code !== SUITE_GUARD_CODE);
+function onlySuiteLeadOwned(doctor) {
+  return !doctor.ready && laneReasons(doctor).length === 0 && doctor.findings.some((f) => f.code === SUITE_GUARD_CODE);
+}
 function laneNotEvaluatedFromThisBranch(doctor) {
   if (doctor.ready) return void 0;
-  const reasons = doctor.findings.filter((f) => f.severity === "blocker" || f.code === "origin-unverified");
+  const reasons = laneReasons(doctor);
   const only = reasons.length === 1 ? reasons[0] : void 0;
   return only?.code === "branch-mismatch" ? only.title : void 0;
 }
@@ -33362,7 +33502,7 @@ function attachTrainDoctorVerdicts(report, trainDoctors) {
   });
   return {
     ...report,
-    ok: report.ok && marked.every((doctor) => doctor.ready || doctor.notEvaluatedFromThisBranch !== void 0),
+    ok: report.ok && marked.every((doctor) => doctor.ready || doctor.notEvaluatedFromThisBranch !== void 0 || onlySuiteLeadOwned(doctor)),
     ...marked.length ? { trainDoctors: marked } : {}
   };
 }
@@ -33376,6 +33516,8 @@ function renderBootstrapVerifyReport(report) {
     lines2.push("", formatTrainDoctor(doctor));
     if (doctor.notEvaluatedFromThisBranch) {
       lines2.push(`  NOT EVALUATED from this branch \u2014 ${doctor.notEvaluatedFromThisBranch}; one checkout stands on one branch, so this lane does not fail the verify (#6677). Run \`mmi-cli devops train doctor --lane ${doctor.lane}\` from that branch for its own verdict.`);
+    } else if (onlySuiteLeadOwned(doctor)) {
+      lines2.push("  SUITE MEMBER: this lane is run from the suite lead (mmi-cli devops suite rcand|release), so suite-member-solo does not fail the verify (#7511).");
     }
   }
   return lines2.join("\n");
@@ -33707,6 +33849,7 @@ function registerBootstrapCommands(program3) {
         requiredCheckBranches: resolveRequiredCheckBranches(metaWithDeclaredClass(meta, cls), repo),
         requiredChecks: meta?.requiredChecks ?? void 0,
         deployModel: meta?.deployModel,
+        suite: meta?.suite,
         owners: controlOwners,
         github,
         deployFacts,
@@ -33773,31 +33916,39 @@ function registerBootstrapCommands(program3) {
       return fail(`bootstrap apply: ${e.message}`);
     }
     let effectiveTrack = bootstrapReleaseTrack;
+    let suiteSlug;
     if (!o.releaseTrack) {
       const read = await fetchProjectBySlugChecked(parsedRepo.slug, registryClientDeps(await loadConfig()));
       if (read.ok) {
         effectiveTrack = resolveReleaseTrack(metaWithDeclaredClass(read.project, o.class), void 0, repo);
+        suiteSlug = read.project?.suite;
       } else if (o.execute) {
         return failGraceful(`bootstrap apply: registry META unreadable (${read.error}) and no --release-track given \u2014 refusing to assume the ${bootstrapReleaseTrack} track for live writes`);
       } else {
         console.error(`bootstrap apply: registry META unreadable (${read.error}) \u2014 release track ${bootstrapReleaseTrack} is ASSUMED from the class default for this dry-run; --execute will refuse`);
       }
+    } else {
+      const read = await fetchProjectBySlugChecked(parsedRepo.slug, registryClientDeps(await loadConfig()));
+      if (read.ok) suiteSlug = read.project?.suite;
     }
     if (o.only.trim() === "environments") {
       const client = defaultGitHubClient();
       const envJson = { repo, track: effectiveTrack };
       if (!o.execute) {
-        const drift = await verifyRepoEnvironments(repo, effectiveTrack, client);
+        const drift = await verifyRepoEnvironments(repo, effectiveTrack, client, suiteSlug);
         const classified = drift.map(classifyEnvironmentDrift);
         envJson.plan = classified;
         if (o.json) console.log(JSON.stringify(envJson, null, 2));
         else {
           console.log(`bootstrap apply --only environments \u2014 dry-run (${repo}, track ${effectiveTrack}); no writes:`);
           for (const c of classified) console.log(`  ${c.action} ${c.environment} \u2014 ${c.reason}`);
+          for (const spec of repoEnvironmentSpecs(repo, effectiveTrack, suiteSlug)) {
+            if (spec.exception) console.log(`  OK environment ${spec.name} (${spec.exception})`);
+          }
           console.log("  (plan-gated protections \u2014 wait_timer/reviewers the org plan rejects \u2014 are reported at --execute)");
         }
       } else {
-        const envResult = await reconcileRepoEnvironments(repo, effectiveTrack, client);
+        const envResult = await reconcileRepoEnvironments(repo, effectiveTrack, client, suiteSlug);
         const lines2 = [];
         if (envResult.created.length) lines2.push(`environments created: ${envResult.created.join(", ")}`);
         if (envResult.updated.length) lines2.push(`environments updated: ${envResult.updated.join(", ")}`);
@@ -33805,6 +33956,9 @@ function registerBootstrapCommands(program3) {
         for (const gated of envResult.planGated) {
           lines2.push(`environment ${gated.environment}: plan-gated protections (${gated.protections.join(", ")} not settable on this org plan \u2014 policy-only provisioned)`);
         }
+        for (const spec of repoEnvironmentSpecs(repo, effectiveTrack, suiteSlug)) {
+          if (spec.exception) lines2.push(`OK environment ${spec.name} (${spec.exception})`);
+        }
         envJson.result = { created: envResult.created, updated: envResult.updated, skipped: envResult.skipped, planGated: envResult.planGated };
         if (o.json) console.log(JSON.stringify(envJson, null, 2));
         else {
@@ -33926,6 +34080,7 @@ function registerBootstrapCommands(program3) {
         requiredCheckBranches: resolveRequiredCheckBranches(metaWithDeclaredClass(registryMeta, o.class), repo),
         requiredChecks: registryMeta?.requiredChecks ?? void 0,
         deployModel: applyDeployModel,
+        suite: suiteSlug,
         owners: controlOwners,
         github,
         deployFacts: controlDeployFacts,
@@ -34270,7 +34425,7 @@ ${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owne
     }
     if (o.execute && !onlyTarget) {
       try {
-        const envResult = await reconcileRepoEnvironments(repo, effectiveTrack, defaultGitHubClient());
+        const envResult = await reconcileRepoEnvironments(repo, effectiveTrack, defaultGitHubClient(), suiteSlug);
         if (envResult.created.length) applied.push(`environments created: ${envResult.created.join(", ")}`);
         if (envResult.updated.length) applied.push(`environments updated: ${envResult.updated.join(", ")}`);
         if (envResult.skipped.length) applied.push(`environments current: ${envResult.skipped.join(", ")}`);
@@ -34367,6 +34522,7 @@ ${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owne
         requiredCheckBranches: resolveRequiredCheckBranches(metaWithDeclaredClass(registryMeta, o.class), repo),
         requiredChecks: registryMeta?.requiredChecks ?? void 0,
         deployModel: applyDeployModel,
+        suite: suiteSlug,
         owners: controlOwners,
         github,
         deployFacts: controlDeployFacts,
@@ -34410,7 +34566,7 @@ ${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owne
         const liveLabels = JSON.parse((await gh2(["label", "list", "-R", repo, "--limit", "1000", "--json", "name"])).stdout);
         if (!Array.isArray(liveLabels)) throw new Error("label list is not an array");
         ancillaryPlan = planBootstrapLabels(manifest.labels, liveLabels);
-        environmentPlan = (await verifyRepoEnvironments(repo, effectiveTrack, controlClient)).map(classifyEnvironmentDrift);
+        environmentPlan = (await verifyRepoEnvironments(repo, effectiveTrack, controlClient, suiteSlug)).map(classifyEnvironmentDrift);
       } catch (e) {
         return failGraceful(`bootstrap apply: cannot plan labels/environments; no writes made: ${e.message}`);
       }
@@ -34421,7 +34577,7 @@ ${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owne
       if (controlRows.length) console.log(`
 ${renderBootstrapControlPlan(controlRows)}`);
       if (ancillaryPlan && environmentPlan) console.log(`
-${renderBootstrapAncillaryPlan(ancillaryPlan, environmentPlan)}`);
+${renderBootstrapAncillaryPlan(ancillaryPlan, environmentPlan, repoEnvironmentSpecs(repo, effectiveTrack, suiteSlug).filter((spec) => spec.exception).map((spec) => ({ name: spec.name, detail: spec.exception })))}`);
       if (o.execute) console.log(`
 LIVE apply to ${repo}:
   ${applied.join("\n  ")}`);
@@ -35086,13 +35242,15 @@ var RELEASE_TAG = /^v\d+\.\d+\.\d+$/;
 function suitePins(record, bundles) {
   return record.members.map((m) => m.carried ? { module: m.id, rc: m.rcPin, main: m.mainPin } : {
     module: m.id,
-    rc: `https://${m.id === "katip" ? m.rcHost ?? m.host : m.host}/${m.id === "katip" ? "" : "rc/"}module.js?v=${m.tag}`,
+    rc: `https://${m.host}/rc/module.js?v=${m.tag}`,
     main: mainPinFor(m.host, bundles[m.id], suiteReleaseTag(m.tag))
   });
 }
 function mainPinFor(host, bundles, tag) {
-  const path2 = [bundles?.dev, bundles?.main].map(pathOf).find(Boolean) ?? "/module.js";
-  return `https://${host}${path2}?v=${tag}`;
+  return `https://${host}${mainBundlePath(bundles)}?v=${tag}`;
+}
+function mainBundlePath(bundles) {
+  return [bundles?.dev, bundles?.main].map(pathOf).find(Boolean) ?? "/module.js";
 }
 function pathOf(url) {
   try {
@@ -35120,7 +35278,7 @@ function readSuiteCut(path2) {
   } catch {
     throw new Error(`suite cut record unreadable at ${path2}; repair it, never recut`);
   }
-  if (record.schema !== SCHEMA || record.lead !== SUITE_REPO || !SHA2.test(record.leadDevelopment) || !SHA2.test(record.leadPreviousRc) || !Array.isArray(record.members) || record.members.length === 0 || record.pinPr !== void 0 && (typeof record.pinPr !== "string" || !record.pinPr.startsWith("https://github.com/mutmutco/MM-Work/pull/")) || record.pinMerged !== void 0 && (record.pinMerged !== true && record.pinMerged !== false || !record.pinPr) || record.leadRcTag !== void 0 && (!RC_TAG.test(record.leadRcTag) || !SHA2.test(record.leadRcSha ?? "") || !record.pinMerged) || record.leadReleased !== void 0 && (record.leadReleased !== true || !record.leadRcTag) || record.announcement !== void 0 && (!["pending", "sent"].includes(record.announcement) || !record.leadReleased) || record.members.some((m) => !m.id || !m.repo || !m.backend || !m.host || !SHA2.test(m.development) || !SHA2.test(m.previousRc) || m.rcWasAbsent !== void 0 && m.rcWasAbsent !== true || m.tag !== void 0 && (!RC_TAG.test(m.tag) || !SHA2.test(m.sha ?? "")) || m.published !== void 0 && (m.published !== true || !m.tag) || m.released !== void 0 && (m.released !== true || !m.published) || m.backendAfterRelease !== void 0 && (!m.released || typeof m.backendAfterRelease !== "string") || m.carried !== void 0 && (m.carried !== true || m.tag !== void 0 || m.published !== void 0 || !isPin(m.rcPin) || !isPin(m.mainPin)) || m.carried === void 0 && (m.rcPin !== void 0 || m.mainPin !== void 0)))
+  if (record.schema !== SCHEMA || record.lead !== SUITE_REPO || !SHA2.test(record.leadDevelopment) || !SHA2.test(record.leadPreviousRc) || !Array.isArray(record.members) || record.members.length === 0 || record.pinPr !== void 0 && (typeof record.pinPr !== "string" || !record.pinPr.startsWith("https://github.com/mutmutco/MM-Work/pull/")) || record.pinMerged !== void 0 && (record.pinMerged !== true && record.pinMerged !== false || !record.pinPr) || record.leadRcTag !== void 0 && (!RC_TAG.test(record.leadRcTag) || !SHA2.test(record.leadRcSha ?? "") || !record.pinMerged) || record.leadReleased !== void 0 && (record.leadReleased !== true || !record.leadRcTag) || record.announcement !== void 0 && (!["pending", "sent", "skipped"].includes(record.announcement) || !record.leadReleased) || record.members.some((m) => !m.id || !m.repo || !m.backend || !m.host || !SHA2.test(m.development) || !SHA2.test(m.previousRc) || m.rcWasAbsent !== void 0 && m.rcWasAbsent !== true || m.tag !== void 0 && (!RC_TAG.test(m.tag) || !SHA2.test(m.sha ?? "")) || m.published !== void 0 && (m.published !== true || !m.tag) || m.released !== void 0 && (m.released !== true || !m.published) || m.mainPublished !== void 0 && (m.mainPublished !== true || !m.released || !!m.carried) || m.backendAfterRelease !== void 0 && (!m.released || typeof m.backendAfterRelease !== "string") || m.carried !== void 0 && (m.carried !== true || m.tag !== void 0 || m.published !== void 0 || !isPin(m.rcPin) || !isPin(m.mainPin)) || m.carried === void 0 && (m.rcPin !== void 0 || m.mainPin !== void 0)))
     throw new Error(`suite cut record has unknown or invalid state at ${path2}; repair it, never recut`);
   return record;
 }
@@ -35176,13 +35334,13 @@ async function suiteRcand(deps, opts) {
   const members = suiteMembers(await deps.registry());
   const modules = members.filter((m) => m.repo !== SUITE_REPO);
   const plan = [
-    ...modules.map((m) => `${m.repo}: normal rcand${m.id === "katip" ? " + rc server" : " + module-rc-publish.yml"} (once)`),
+    ...modules.map((m) => `${m.repo}: normal rcand + module-rc-publish.yml (once)`),
     `${SUITE_REPO}: one PR for both rc/main pins, wait for merge`,
     `${SUITE_REPO}: rcand`
   ];
   if (opts.dryRun) return { plan };
   let record = readSuiteCut(deps.recordPath);
-  if (record?.announcement === "sent" && record.leadReleased) {
+  if ((record?.announcement === "sent" || record?.announcement === "skipped") && record.leadReleased) {
     const archive = `${deps.recordPath}.${record.leadRcTag}.json`;
     if ((0, import_node_fs29.existsSync)(archive)) throw new Error(`suite cut archive already exists at ${archive}; inspect before a new cut`);
     (0, import_node_fs29.renameSync)(deps.recordPath, archive);
@@ -35200,7 +35358,7 @@ async function suiteRcand(deps, opts) {
         const [backend, development, rcHead] = await Promise.all([deps.backend(m), deps.head(m.repo, "development"), deps.head(m.repo, "rc")]);
         const previousRc = rcHead ?? await deps.head(m.repo, "main");
         if (!backend.version || !backend.host || !development || !SHA2.test(development) || !previousRc || !SHA2.test(previousRc)) throw new Error(`${m.repo}: live backend or branch snapshot is unproven; no cut started`);
-        return { repo: m.repo, id: m.id, backend: backend.version, host: backend.host, rcHost: backend.rcHost, development, previousRc, ...rcHead === null ? { rcWasAbsent: true } : {} };
+        return { repo: m.repo, id: m.id, backend: backend.version, host: backend.host, development, previousRc, ...rcHead === null ? { rcWasAbsent: true } : {} };
       }))
     ]);
     if (!leadDevelopment || !leadPreviousRc || !SHA2.test(leadDevelopment) || !SHA2.test(leadPreviousRc)) throw new Error("MM-Work development/rc SHA unproven; no cut started");
@@ -35233,7 +35391,7 @@ async function suiteRcand(deps, opts) {
   }
   const refusals = [];
   for (const member of record.members) {
-    if (member.published || member.id === "katip") continue;
+    if (member.published) continue;
     try {
       await deps.preflight(member.repo);
     } catch (e) {
@@ -35251,7 +35409,7 @@ Each module must ship a live release that bind-mounts <deployPath>/data read-onl
     if ((await deps.head(member.repo, "development"))?.toLowerCase() !== member.development.toLowerCase())
       throw new Error(`${member.repo}: development moved after the cut snapshot; refuse to add untested code`);
     if (member.carried) {
-      if (member.id !== "katip") await deps.publish(member.repo, pinVersion(member.rcPin));
+      await deps.publish(member.repo, pinVersion(member.rcPin));
       continue;
     }
     if (!member.tag) {
@@ -35264,7 +35422,7 @@ Each module must ship a live release that bind-mounts <deployPath>/data read-onl
     }
     if ((await deps.tagSha(member.repo, member.tag))?.toLowerCase() !== member.sha.toLowerCase()) throw new Error(`${member.repo}: rc tag ${member.tag} moved or is unreadable; stop`);
     if (!member.published) {
-      if (member.id !== "katip") await deps.publish(member.repo, member.tag);
+      await deps.publish(member.repo, member.tag);
       member.published = true;
       writeSuiteCut(deps.recordPath, record);
     }
@@ -35323,43 +35481,59 @@ async function suiteRelease(deps, ownerGo) {
       if (hotfix) member.hotfixedTo = hotfix;
     }
     if (member.hotfixedTo && !member.released) continue;
-    const katipReleaseSha = member.id === "katip" ? await deps.tagSha(member.repo, planned) : void 0;
-    const expectedBackend = member.id === "katip" && member.released ? member.backendAfterRelease ?? katipReleaseSha : member.backend;
-    if (live.version !== expectedBackend && !(member.id === "katip" && !member.released && katipReleaseSha && live.version === katipReleaseSha))
-      throw new Error(`${member.repo}: live backend changed after the cut (${expectedBackend} \u2192 ${live.version}); release refused`);
+    if (live.version !== member.backend && !(member.hotfixedTo && await deps.hotfixOver(member.repo, planned, live.version) === member.hotfixedTo))
+      throw new Error(`${member.repo}: live backend changed after the cut (${member.backend} \u2192 ${live.version}); release refused`);
   }
   if ((await deps.tagSha(SUITE_REPO, record.leadRcTag))?.toLowerCase() !== record.leadRcSha?.toLowerCase()) throw new Error("MM-Work rc tag changed after the cut; release refused");
+  const publishesMain = !record.leadReleased;
+  const refusals = [];
+  for (const member of record.members) {
+    if (!publishesMain || member.carried || member.released) continue;
+    try {
+      await deps.preflightMain(member.repo, mainBundlePath(members.find((m) => m.repo === member.repo)?.bundles));
+    } catch (e) {
+      refusals.push(`${member.repo}: ${e.message}`);
+    }
+  }
+  if (refusals.length) throw new Error(`module main serving is not ready; no member was released:
+${refusals.join("\n")}
+Each member's live release must serve <data>/main/module.js at its main pin path when <data>/main exists.`);
   for (const member of record.members) {
-    if (member.released || member.carried) continue;
-    if (member.hotfixedTo) {
-      console.warn(`${member.repo}: released as ${member.releasedAs ?? suiteReleaseTag(member.tag)} and hotfixed to ${member.hotfixedTo}, which is live; recorded as released (#7482)`);
-      member.backendAfterRelease = (await deps.backend({ repo: member.repo, id: member.id, bundles: {} })).version;
+    if (member.carried) continue;
+    if (!member.released) {
+      if (member.hotfixedTo) {
+        console.warn(`${member.repo}: released as ${member.releasedAs ?? suiteReleaseTag(member.tag)} and hotfixed to ${member.hotfixedTo}, which is live; recorded as released (#7482)`);
+      } else {
+        if (member.releasedAs && member.releasedAs !== suiteReleaseTag(member.tag)) console.warn(`${member.repo}: its rc already shipped as ${member.releasedAs}, not ${suiteReleaseTag(member.tag)}; finishing that release (#7464)`);
+        await deps.release(member.repo, member.releasedAs ?? suiteReleaseTag(member.tag), member.sha);
+      }
       member.released = true;
       writeSuiteCut(deps.recordPath, record);
-      continue;
     }
-    if (member.releasedAs && member.releasedAs !== suiteReleaseTag(member.tag)) console.warn(`${member.repo}: its rc already shipped as ${member.releasedAs}, not ${suiteReleaseTag(member.tag)}; finishing that release (#7464)`);
-    await deps.release(member.repo, member.releasedAs ?? suiteReleaseTag(member.tag), member.sha);
-    if (member.id === "katip") {
-      const expected = await deps.tagSha(member.repo, member.releasedAs ?? suiteReleaseTag(member.tag));
-      const live = await deps.backend({ repo: member.repo, id: member.id, bundles: {} });
-      if (!expected || live.version !== expected) throw new Error(`${member.repo}: normal main deploy not stamped at released tag SHA; resume after verifying live backend`);
-      member.backendAfterRelease = live.version;
+    if (publishesMain && !member.mainPublished) {
+      await deps.publishMain(member.repo, member.hotfixedTo ?? member.releasedAs ?? suiteReleaseTag(member.tag), mainBundlePath(members.find((m) => m.repo === member.repo)?.bundles));
+      member.mainPublished = true;
+      writeSuiteCut(deps.recordPath, record);
     }
-    member.released = true;
-    writeSuiteCut(deps.recordPath, record);
   }
   if (!record.leadReleased) {
     await deps.release(SUITE_REPO, suiteReleaseTag(record.leadRcTag), record.leadRcSha);
     record.leadReleased = true;
     writeSuiteCut(deps.recordPath, record);
   }
-  if (record.announcement === "pending") throw new Error("suite announcement outcome ambiguous; verify it before retrying (never post twice)");
+  if (record.announcement === "pending") {
+    const reason = await deps.announceSkipReason(record);
+    if (!reason) throw new Error("suite announcement outcome ambiguous; verify it before retrying (never post twice)");
+    record.announcement = "skipped";
+    record.announcementNote = reason;
+    writeSuiteCut(deps.recordPath, record);
+  }
   if (!record.announcement) {
     record.announcement = "pending";
     writeSuiteCut(deps.recordPath, record);
-    await deps.announce(record);
-    record.announcement = "sent";
+    const { skipped } = await deps.announce(record);
+    record.announcement = skipped ? "skipped" : "sent";
+    if (skipped) record.announcementNote = skipped;
     writeSuiteCut(deps.recordPath, record);
   }
   return record;
@@ -42059,6 +42233,7 @@ function unlinkEscapingReparsePoints(root, primaryRoot) {
     try {
       entries = (0, import_node_fs40.readdirSync)(dir, { withFileTypes: true });
     } catch (e) {
+      if (e.code === "ENOENT") continue;
       return { ok: false, error: `cannot scan ${normPath2(dir)} for reparse points: ${errorMessage(e)}` };
     }
     for (const entry of entries) {
@@ -43877,7 +44052,7 @@ ${list}`);
         console.error(line);
       }
     }
-    const credential = await pollToken().catch(() => void 0) ? "app_installation" : "user";
+    const credential = "user";
     if (o.json) printLine(JSON.stringify({ ...result, credential }));
     else printLine(
       `pr land: ${result.status}${result.error ? ` \u2014 ${result.error}` : ""} (credential: ${credential})` + (result.branchFinality ? ` \u2014 ${result.branchFinality}` : "")
@@ -44392,9 +44567,8 @@ function trainApplyDeps() {
     trainWriter: (verb, cwd) => acquireTrainWriterLock(cwd, `mmi-cli devops ${verb}`),
     run: async (file, args) => {
       const timeout = file === "node" && args[1] === "prepare" ? NODE_PREPARE_TIMEOUT_MS : file === "node" && args[1] === "verify" ? NODE_VERIFY_TIMEOUT_MS : file === "npm" && (args[0] === "version" || args[0] === "ci" || args[0] === "install") ? NPM_FOLD_TIMEOUT_MS : file === "npm" ? NPM_TRAIN_TIMEOUT_MS : file === "bash" && /jerv-gateway-release-deploy\.sh$/.test(args[0] ?? "") ? JERV_GATEWAY_DEPLOY_TIMEOUT_MS : file === "git" && args[0] === "commit" ? GIT_COMMIT_TIMEOUT_MS : file !== "gh" ? GIT_TIMEOUT_MS : args[0] === "run" && args[1] === "watch" ? GH_RUN_WATCH_TIMEOUT_MS : GH_TRAIN_TIMEOUT_MS;
-      const watchToken = file === "gh" && args[0] === "run" && args[1] === "watch" ? await pollToken() : void 0;
       try {
-        return isWin3 && file === "npm" ? (await execFileP("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP(file, file === "git" ? trainGitArgs(args) : args, { timeout, ...watchToken ? { env: { ...process.env, GH_TOKEN: watchToken } } : {} })).stdout;
+        return isWin3 && file === "npm" ? (await execFileP("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP(file, file === "git" ? trainGitArgs(args) : args, { timeout })).stdout;
       } catch (e) {
         throw surfaceTrainSubprocessFailure(e, file, args);
       }
@@ -45331,10 +45505,7 @@ function suiteTrainIo(root, summaryFile) {
       throw new Error(`${member.repo}: healthy live backend stamp and edgeDomains.main must agree with DEPLOY#main; stop`);
     const health = await probePublicHealth(url);
     if (!health.ok) throw new Error(`${member.repo}: live backend health could not be proved at ${url}; stop`);
-    const rcHost = edgeDomains?.rc;
-    if (member.id === "katip" && (!rcHost || facts?.stages.rc?.domain !== rcHost))
-      throw new Error(`${member.repo}: normal Katip rc host must agree with DEPLOY#rc; stop`);
-    return { version: live.deployedTag, host, ...rcHost ? { rcHost } : {} };
+    return { version: live.deployedTag, host };
   };
   const tagSha = async (repo, tag) => {
     try {
@@ -45449,10 +45620,22 @@ function suiteTrainIo(root, summaryFile) {
     const run = await watchRcRun(title, [`repo=${repo}`, `tag=${tag}`], existing[0]);
     if (run.conclusion !== "success") throw new Error(`${repo}: module rc publish run ${run.id} not green${await rcRunCause(run.id)}`);
   };
+  const publishMain = async (repo, tag, path2) => {
+    const title = `module-main-publish ${repo} @ ${tag}`;
+    const existing = (await rcRuns()).filter((r) => r.displayTitle === title).sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt));
+    if (existing[0]?.conclusion === "success") return;
+    if (existing[0]?.conclusion === "failure") throw new Error(`${repo}: prior module-main-publish ${tag} failed; inspect the run and retry it explicitly before continuing`);
+    const run = await watchRcRun(title, [`repo=${repo}`, `tag=${tag}`, "channel=main", `path=${path2}`], existing[0]);
+    if (run.conclusion !== "success") throw new Error(`${repo}: module main publish run ${run.id} not green${await rcRunCause(run.id)}`);
+  };
   const preflight2 = async (repo) => {
     const run = await watchRcRun(`module-rc-preflight ${repo}`, [`repo=${repo}`, "preflight=true"], void 0);
     if (run.conclusion !== "success") throw new Error(`rc serving preflight run ${run.id} failed${await rcRunCause(run.id)}`);
   };
+  const preflightMain = async (repo, path2) => {
+    const run = await watchRcRun(`module-main-preflight ${repo}`, [`repo=${repo}`, "channel=main", `path=${path2}`, "preflight=true"], void 0);
+    if (run.conclusion !== "success") throw new Error(`main serving preflight run ${run.id} failed${await rcRunCause(run.id)}`);
+  };
   const rcRunCause = async (id) => {
     try {
       return rcRunCauseFromLog(await exec("gh", ["run", "view", String(id), "--repo", "mutmutco/MMI-Hub", "--log-failed"]));
@@ -45493,6 +45676,8 @@ function suiteTrainIo(root, summaryFile) {
     rcand: runRcand,
     publish,
     preflight: preflight2,
+    publishMain,
+    preflightMain,
     pin: (input) => openSuiteCutPinPr({ root, run: (file, args, cwd) => exec(file, args, cwd, GIT_TIMEOUT_MS) }, input),
     verifyLeadCut: async (sha) => {
       const current = await gh(["api", `repos/${SUITE_REPO}/git/ref/heads/development`, "--jq", ".object.sha"]);
@@ -45516,7 +45701,15 @@ function suiteTrainIo(root, summaryFile) {
     announce: async (record) => {
       if (!summaryFile) throw new Error("suite announcement requires --announce-summary-file; outcome was not posted");
       const result = await trainApplyDeps().announce?.({ repo: SUITE_REPO, tag: record.leadRcTag.replace(/-rc\.\d+$/, ""), summaryFile });
+      if (result?.status === "skipped") return { skipped: result.note };
       if (result?.status !== "announced") throw new Error(`suite announcement unverified: ${result?.note ?? "no announcement seam"}`);
+      return {};
+    },
+    announceSkipReason: async () => {
+      const slug = slugOf(SUITE_REPO);
+      const read = await fetchProjectBySlugChecked(slug, registryClientDeps(await loadConfig()));
+      if (!read.ok) throw new Error(`suite announcement: registry read failed for ${slug} (${read.error}); outcome stays ambiguous`);
+      return read.project?.releaseChannel?.trim() ? null : `no releaseChannel configured for ${slug}; nothing could have been posted`;
     }
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.57",
+  "version": "4.5.59",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",