@mutmutco/cli 4.5.62 → 4.5.64

package/dist/main.cjs

@@ -587,7 +587,147 @@ var init_github_client = __esm({
   }
 });
 
+// src/github-quota.ts
+function hubQuotaResetWaitMs(resetAt, nowMs, capMs = RATE_LIMIT_WAIT_CAP_MS, jitterMs = 0) {
+  if (typeof resetAt !== "string" || !resetAt) return void 0;
+  const resetMs = Date.parse(resetAt);
+  if (!Number.isFinite(resetMs)) return void 0;
+  const wait = rateLimitWaitMs(resetMs / 1e3, nowMs, capMs);
+  if (wait === void 0) return void 0;
+  return wait + Math.max(0, jitterMs);
+}
+function isRateLimitedError(e) {
+  return e instanceof RateLimitedError;
+}
+function isRateLimitText(text) {
+  return /API rate limit already exceeded|rate limit already exceeded|RATE_LIMITED|secondary rate|abuse detection|HTTP\/?\d*(?:\.\d)?\s+429\b|\b429\b.*rate limit/i.test(text) || /rate limit/i.test(text) && !/not rate.?limit/i.test(text);
+}
+function isRateLimitRefusal(e) {
+  if (e instanceof GitHubApiError && e.rateLimited) return true;
+  if (e instanceof GitHubApiError && e.status === 403) {
+    return /rate limit|abuse detection|secondary rate/i.test(e.message);
+  }
+  if (e instanceof RateLimitedError) return true;
+  const text = e instanceof Error ? `${e.message}
+${e.stderr ?? ""}` : String(e ?? "");
+  return isRateLimitText(text);
+}
+function resetEpochFromError(e) {
+  if (e instanceof GitHubApiError && typeof e.rateLimitReset === "number") return e.rateLimitReset;
+  if (e instanceof RateLimitedError && typeof e.receipt.resetEpochSeconds === "number") {
+    return e.receipt.resetEpochSeconds;
+  }
+  return void 0;
+}
+function rateLimitWaitMs(resetEpochSeconds, nowMs, capMs = RATE_LIMIT_WAIT_CAP_MS) {
+  if (typeof resetEpochSeconds !== "number" || !Number.isFinite(resetEpochSeconds)) return void 0;
+  const wait = resetEpochSeconds * 1e3 - nowMs;
+  if (wait <= 0) return 0;
+  if (wait > capMs) return void 0;
+  return wait;
+}
+function rateLimitedReceipt(opts) {
+  const resetEpochSeconds = opts.resetEpochSeconds;
+  const resetAt = typeof resetEpochSeconds === "number" ? new Date(resetEpochSeconds * 1e3).toISOString() : void 0;
+  const note = rateLimitResetNote(resetEpochSeconds, opts.nowMs ?? Date.now());
+  const context = opts.context ?? "GitHub API";
+  const remaining = opts.remaining && (opts.remaining.graphql !== void 0 || opts.remaining.core !== void 0) ? opts.remaining : void 0;
+  return {
+    status: "rate_limited",
+    ...resetEpochSeconds !== void 0 ? { resetEpochSeconds } : {},
+    ...resetAt ? { resetAt } : {},
+    message: opts.message ?? `${context}: ${note}`,
+    retryCommand: opts.retryCommand,
+    ...remaining ? { remaining } : {}
+  };
+}
+async function runWithRateLimitBackoff(operation, opts) {
+  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const now = opts.now ?? Date.now;
+  const log = opts.log ?? ((message2) => console.warn(message2));
+  const capMs = opts.capMs ?? RATE_LIMIT_WAIT_CAP_MS;
+  const tryOnce = async () => {
+    try {
+      return await operation();
+    } catch (e) {
+      if (!isRateLimitRefusal(e) || !opts.fallback) throw e;
+      try {
+        return await opts.fallback();
+      } catch (e2) {
+        if (isRateLimitRefusal(e2)) throw e2;
+        throw e2;
+      }
+    }
+  };
+  try {
+    return await tryOnce();
+  } catch (e) {
+    if (!isRateLimitRefusal(e)) throw e;
+    const reset = resetEpochFromError(e);
+    const waitMs = rateLimitWaitMs(reset, now(), capMs);
+    if (waitMs === void 0) {
+      throw new RateLimitedError(rateLimitedReceipt({
+        resetEpochSeconds: reset,
+        retryCommand: opts.retryCommand,
+        context: opts.context,
+        nowMs: now()
+      }));
+    }
+    if (waitMs > 0) {
+      log(`${opts.context}: rate-limited \u2014 waiting ${Math.round(waitMs / 1e3)}s for pool reset`);
+      await sleep2(waitMs);
+    }
+    try {
+      return await tryOnce();
+    } catch (e2) {
+      if (!isRateLimitRefusal(e2)) throw e2;
+      throw new RateLimitedError(rateLimitedReceipt({
+        resetEpochSeconds: resetEpochFromError(e2) ?? reset,
+        retryCommand: opts.retryCommand,
+        context: opts.context,
+        nowMs: now()
+      }));
+    }
+  }
+}
+var RATE_LIMIT_WAIT_CAP_MS, RateLimitedError;
+var init_github_quota = __esm({
+  "src/github-quota.ts"() {
+    "use strict";
+    init_github_client();
+    RATE_LIMIT_WAIT_CAP_MS = 12e4;
+    RateLimitedError = class extends Error {
+      receipt;
+      constructor(receipt) {
+        super(receipt.message);
+        this.name = "RateLimitedError";
+        this.receipt = receipt;
+      }
+    };
+  }
+});
+
 // src/fetch-retry.ts
+async function hubQuota503(res, opts) {
+  if (res.status !== 503) return "pass";
+  let body;
+  try {
+    body = await res.clone().json();
+  } catch {
+    return "pass";
+  }
+  const code = body?.code;
+  if (code !== "github-rate-limited") return "pass";
+  const q = opts.hubQuotaWait;
+  const resetAt = body?.resetAt;
+  const wait = hubQuotaResetWaitMs(
+    typeof resetAt === "string" ? resetAt : void 0,
+    q?.now?.() ?? Date.now(),
+    q?.capMs ?? RATE_LIMIT_WAIT_CAP_MS,
+    (q?.jitterMs ?? (() => Math.floor(Math.random() * HUB_QUOTA_JITTER_MAX_MS)))()
+  );
+  return wait === void 0 ? "fail-fast" : { waitMs: wait };
+}
 async function fetchWithRetry(fetchImpl, url, init, opts = {}) {
   const attempts = opts.attempts ?? 3;
   const baseDelayMs = opts.baseDelayMs ?? 250;
@@ -599,9 +739,17 @@ async function fetchWithRetry(fetchImpl, url, init, opts = {}) {
     const attemptInit = opts.timeoutMs ? { ...init, signal: AbortSignal.timeout(opts.timeoutMs) } : init;
     try {
       const res = await fetchImpl(url, attemptInit);
-      if (!isLast && retryOn(res)) {
-        await sleep2(baseDelayMs * 2 ** i);
-        continue;
+      if (!isLast) {
+        const quota = await hubQuota503(res, opts);
+        if (typeof quota === "object") {
+          await sleep2(quota.waitMs);
+          continue;
+        }
+        if (quota === "fail-fast") return res;
+        if (retryOn(res)) {
+          await sleep2(baseDelayMs * 2 ** i);
+          continue;
+        }
       }
       return res;
     } catch (e) {
@@ -612,9 +760,12 @@ async function fetchWithRetry(fetchImpl, url, init, opts = {}) {
   }
   throw lastErr;
 }
+var HUB_QUOTA_JITTER_MAX_MS;
 var init_fetch_retry = __esm({
   "src/fetch-retry.ts"() {
     "use strict";
+    init_github_quota();
+    HUB_QUOTA_JITTER_MAX_MS = 5e3;
   }
 });
 
@@ -5568,114 +5719,12 @@ async function fetchHubBoardSnapshot(request, deps) {
   return { state: "ok", snapshot: body };
 }
 
-// src/github-quota.ts
-init_github_client();
-var RATE_LIMIT_WAIT_CAP_MS = 12e4;
-var RateLimitedError = class extends Error {
-  receipt;
-  constructor(receipt) {
-    super(receipt.message);
-    this.name = "RateLimitedError";
-    this.receipt = receipt;
-  }
-};
-function isRateLimitedError(e) {
-  return e instanceof RateLimitedError;
-}
-function isRateLimitText(text) {
-  return /API rate limit already exceeded|rate limit already exceeded|RATE_LIMITED|secondary rate|abuse detection|HTTP\/?\d*(?:\.\d)?\s+429\b|\b429\b.*rate limit/i.test(text) || /rate limit/i.test(text) && !/not rate.?limit/i.test(text);
-}
-function isRateLimitRefusal(e) {
-  if (e instanceof GitHubApiError && e.rateLimited) return true;
-  if (e instanceof GitHubApiError && e.status === 403) {
-    return /rate limit|abuse detection|secondary rate/i.test(e.message);
-  }
-  if (e instanceof RateLimitedError) return true;
-  const text = e instanceof Error ? `${e.message}
-${e.stderr ?? ""}` : String(e ?? "");
-  return isRateLimitText(text);
-}
-function resetEpochFromError(e) {
-  if (e instanceof GitHubApiError && typeof e.rateLimitReset === "number") return e.rateLimitReset;
-  if (e instanceof RateLimitedError && typeof e.receipt.resetEpochSeconds === "number") {
-    return e.receipt.resetEpochSeconds;
-  }
-  return void 0;
-}
-function rateLimitWaitMs(resetEpochSeconds, nowMs, capMs = RATE_LIMIT_WAIT_CAP_MS) {
-  if (typeof resetEpochSeconds !== "number" || !Number.isFinite(resetEpochSeconds)) return void 0;
-  const wait = resetEpochSeconds * 1e3 - nowMs;
-  if (wait <= 0) return 0;
-  if (wait > capMs) return void 0;
-  return wait;
-}
-function rateLimitedReceipt(opts) {
-  const resetEpochSeconds = opts.resetEpochSeconds;
-  const resetAt = typeof resetEpochSeconds === "number" ? new Date(resetEpochSeconds * 1e3).toISOString() : void 0;
-  const note = rateLimitResetNote(resetEpochSeconds, opts.nowMs ?? Date.now());
-  const context = opts.context ?? "GitHub API";
-  const remaining = opts.remaining && (opts.remaining.graphql !== void 0 || opts.remaining.core !== void 0) ? opts.remaining : void 0;
-  return {
-    status: "rate_limited",
-    ...resetEpochSeconds !== void 0 ? { resetEpochSeconds } : {},
-    ...resetAt ? { resetAt } : {},
-    message: opts.message ?? `${context}: ${note}`,
-    retryCommand: opts.retryCommand,
-    ...remaining ? { remaining } : {}
-  };
-}
-async function runWithRateLimitBackoff(operation, opts) {
-  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
-  const now = opts.now ?? Date.now;
-  const log = opts.log ?? ((message2) => console.warn(message2));
-  const capMs = opts.capMs ?? RATE_LIMIT_WAIT_CAP_MS;
-  const tryOnce = async () => {
-    try {
-      return await operation();
-    } catch (e) {
-      if (!isRateLimitRefusal(e) || !opts.fallback) throw e;
-      try {
-        return await opts.fallback();
-      } catch (e2) {
-        if (isRateLimitRefusal(e2)) throw e2;
-        throw e2;
-      }
-    }
-  };
-  try {
-    return await tryOnce();
-  } catch (e) {
-    if (!isRateLimitRefusal(e)) throw e;
-    const reset = resetEpochFromError(e);
-    const waitMs = rateLimitWaitMs(reset, now(), capMs);
-    if (waitMs === void 0) {
-      throw new RateLimitedError(rateLimitedReceipt({
-        resetEpochSeconds: reset,
-        retryCommand: opts.retryCommand,
-        context: opts.context,
-        nowMs: now()
-      }));
-    }
-    if (waitMs > 0) {
-      log(`${opts.context}: rate-limited \u2014 waiting ${Math.round(waitMs / 1e3)}s for pool reset`);
-      await sleep2(waitMs);
-    }
-    try {
-      return await tryOnce();
-    } catch (e2) {
-      if (!isRateLimitRefusal(e2)) throw e2;
-      throw new RateLimitedError(rateLimitedReceipt({
-        resetEpochSeconds: resetEpochFromError(e2) ?? reset,
-        retryCommand: opts.retryCommand,
-        context: opts.context,
-        nowMs: now()
-      }));
-    }
-  }
-}
+// src/board-read.ts
+init_github_quota();
 
 // src/claim-marker-client.ts
 init_github_client();
+init_github_quota();
 
 // src/pr-checks-rest.ts
 init_cli_shared();
@@ -6519,6 +6568,7 @@ function withAppClaimMarkerRead(client, appClient) {
 }
 
 // src/board-dependency.ts
+init_github_quota();
 var DEPENDS_ON_LINE = /^\s*[-*]?\s*\*\*Depends on:\*\*\s*(.+)$/im;
 var ISSUE_REF = /([a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+)#(\d+)/g;
 var DEPENDENCY_FETCH_CONCURRENCY = 8;
@@ -7209,6 +7259,9 @@ function jobNeeds(job) {
 function unquote(s) {
   return s.replace(/#.*$/, "").trim().replace(/^['"]|['"]$/g, "");
 }
+function contextMatchesJobId(jobId, context) {
+  return context === jobId || context.startsWith(`${jobId} / `);
+}
 function unblockingGateJobs(workflows, required) {
   const unblocking = /* @__PURE__ */ new Set();
   for (const wf of workflows) {
@@ -7216,7 +7269,7 @@ function unblockingGateJobs(workflows, required) {
     const jobs = parseWorkflowJobs(wf.body);
     const needs = new Map(jobs.map((job) => [job.id, jobNeeds(job)]));
     const covered = /* @__PURE__ */ new Set();
-    const stack = jobs.map((job) => job.id).filter((id) => required.has(id));
+    const stack = jobs.map((job) => job.id).filter((id) => [...required].some((context) => contextMatchesJobId(id, context)));
     while (stack.length) {
       const id = stack.pop();
       if (covered.has(id)) continue;
@@ -8489,6 +8542,22 @@ function shouldWithdrawSurfaceFlag(result) {
 
 // src/secrets-transport.ts
 init_client_version();
+
+// ../shared/quota-attribution.ts
+var ATTRIBUTION_MAX = 120;
+function sanitizeAttribution(value, max = ATTRIBUTION_MAX) {
+  if (typeof value !== "string" || !Number.isInteger(max) || max < 1) return void 0;
+  const cleaned = value.replace(/[^A-Za-z0-9 ._/@:-]/g, "").replace(/\s+/g, " ").trim().slice(0, max);
+  return cleaned.length > 0 ? cleaned : void 0;
+}
+function attributionFields(attr) {
+  if (!attr) return {};
+  const command = sanitizeAttribution(attr.command);
+  const via = sanitizeAttribution(attr.via);
+  return { ...command ? { for: command } : {}, ...via ? { via } : {} };
+}
+
+// src/secrets-transport.ts
 var OWNER = "mutmutco";
 var SSM_ROOT = "/mmi-future";
 var PROJECT_TIER_SEGMENT = "dev";
@@ -8664,7 +8733,7 @@ async function fetchSecretValue(deps, key, opts, diagnose = false) {
     const res = await fetchVaultRead(deps, `${deps.apiUrl}/secrets/get`, {
       method: "POST",
       headers: await deps.headers({ "content-type": "application/json" }),
-      body: JSON.stringify({ repo, key, use: true, ...slug ? { slug } : {} })
+      body: JSON.stringify({ repo, key, use: true, ...slug ? { slug } : {}, ...attributionFields(opts.attribution) })
     });
     if (!res.ok) {
       if (diagnose) {
@@ -9158,6 +9227,7 @@ function isPriorityFieldConfigured(cfg) {
 // src/gh-create.ts
 init_cli_shared();
 init_github_client();
+init_github_quota();
 var ISSUE_TYPES = ["bug", "feature", "task"];
 var GH_MUTATION_TIMEOUT_MS = 12e4;
 function timeoutKillNote(err, timeoutMs) {
@@ -13467,9 +13537,11 @@ function ghError(e) {
 
 // src/board-claim-move.ts
 init_github_client();
+init_github_quota();
 
 // src/sub-issue.ts
 init_error_codes();
+init_github_quota();
 function buildResolveIdArgs(ref) {
   const args = ["issue", "view", String(ref.number), "--json", "id", "--jq", ".id"];
   if (ref.repo) args.push("--repo", ref.repo);
@@ -17156,10 +17228,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.62",
-    tag: "v4.5.62",
-    commit: "5328997bb80a",
-    npm: "@mutmutco/cli@4.5.62"
+    version: "4.5.64",
+    tag: "v4.5.64",
+    commit: "f201a5b12b79",
+    npm: "@mutmutco/cli@4.5.64"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17176,14 +17248,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.62"
+          v3Target: "v4.5.64"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.62 and redeploy the Hub Lambda from tag v4.5.62 (5328997bb80a); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.62 (@mutmutco/cli@4.5.62, tag commit 5328997bb80a \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.64 and redeploy the Hub Lambda from tag v4.5.64 (f201a5b12b79); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.64 (@mutmutco/cli@4.5.64, tag commit f201a5b12b79 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -27966,7 +28038,7 @@ async function auditRepoCi(repo, callerDeps) {
       if (hasRequiredChecks) {
         const gateFiles = new Set(gateWorkflowFiles(prWorkflowPaths));
         const gateWorkflows = (await getBranchWorkflows() ?? []).filter((wf) => gateFiles.has(wf.path.slice(wf.path.lastIndexOf("/") + 1)));
-        const unblocking = unblockingGateJobs(gateWorkflows, new Set(liveContexts)).filter((job) => !AGENT_PR_BOOKKEEPING_CONTEXTS.has(job) && !branchPlan?.pending.some((entry) => entry.branch === baseBranch && entry.contexts.includes(job)));
+        const unblocking = unblockingGateJobs(gateWorkflows, new Set(liveContexts)).filter((job) => !AGENT_PR_BOOKKEEPING_CONTEXTS.has(job) && !branchPlan?.pending.some((entry) => entry.branch === baseBranch && entry.contexts.some((context) => contextMatchesJobId(job, context))));
         checks.push({
           ok: unblocking.length === 0,
           label: UNBLOCKING_GATE_JOBS_LABEL,
@@ -28051,7 +28123,7 @@ async function auditRepoCi(repo, callerDeps) {
       const body = await fetchFileContent(deps, repo, baseBranch, path2);
       if (body == null) continue;
       if (isGateWorkflowPath(path2)) gateBodies.push({ path: path2, body });
-      if (!/^\s*concurrency:/m.test(body) || !/cancel-in-progress:\s*true/.test(body)) {
+      if (!/^\s*concurrency:/m.test(body) || !/^\s*cancel-in-progress:[ \t]*(?:true|\$\{\{\s*github\.event_name\s*==\s*(['"])pull_request\1\s*\}\})[ \t]*(?:#.*)?$/m.test(body)) {
         if (NO_CANCEL_WAIVER.test(body)) waived.push(path2);
         else missing.push(path2);
       }
@@ -29667,6 +29739,7 @@ async function activateAppActor(commandPath3, env, mint, note = (line) => proces
 init_cli_shared();
 
 // src/attach-to-project.ts
+init_github_quota();
 async function attachViaHubApp(cfg, contentNodeId) {
   const { addIssueToProjectViaHub: addIssueToProjectViaHub2 } = await Promise.resolve().then(() => (init_board_write(), board_write_exports));
   return addIssueToProjectViaHub2(cfg, contentNodeId);
@@ -29827,6 +29900,7 @@ async function waitBoardEvents(since, waitS, deps) {
 }
 
 // src/board-commands.ts
+init_github_quota();
 function refuseRateLimited(e, json) {
   if (!isRateLimitedError(e)) return false;
   if (json) console.log(JSON.stringify(e.receipt));
@@ -35608,6 +35682,16 @@ async function suiteRcand(deps, opts) {
   ];
   if (opts.dryRun) return { plan };
   let record = readSuiteCut(deps.recordPath);
+  if (record?.leadReleased && record.announcement === "pending") {
+    const reason = await deps.announceSkipReason(record);
+    if (!reason) throw new Error(`the finished cut ${record.leadRcTag} has an unverified announcement (pending); verify whether it was posted, then finish it with suite release --owner-go before a new cut (never post twice)`);
+    record.announcement = "skipped";
+    record.announcementNote = reason;
+    writeSuiteCut(deps.recordPath, record);
+  }
+  if (record?.leadReleased && !record.announcement) {
+    throw new Error(`the cut ${record.leadRcTag} already released the lead but never announced; finish it with suite release --owner-go before a new cut`);
+  }
   if ((record?.announcement === "sent" || record?.announcement === "skipped") && record.leadReleased) {
     const archive = `${deps.recordPath}.${record.leadRcTag}.json`;
     if ((0, import_node_fs29.existsSync)(archive)) throw new Error(`suite cut archive already exists at ${archive}; inspect before a new cut`);
@@ -35649,6 +35733,17 @@ async function suiteRcand(deps, opts) {
       writeSuiteCut(deps.recordPath, record);
       continue;
     }
+    const onHead = [];
+    for (const tag of (await deps.rcTagsAt(member.repo, member.previousRc)).filter((t) => RC_TAG.test(t))) {
+      if (!await deps.tagSha(member.repo, suiteReleaseTag(tag))) onHead.push(tag);
+    }
+    if (onHead.length > 1) throw new Error(`${member.repo}: several unreleased rc tags sit on its rc head (${onHead.join(", ")}); pin the one to reuse before the suite cut`);
+    if (onHead.length === 1) {
+      member.tag = onHead[0];
+      member.sha = member.previousRc;
+      writeSuiteCut(deps.recordPath, record);
+      continue;
+    }
     quiet.push(member);
   }
   if (record.members.every((m) => m.carried || quiet.includes(m))) {
@@ -35811,6 +35906,194 @@ Each member's live release must serve <data>/main/module.js at its main pin path
   return record;
 }
 
+// src/suite-rc-data.ts
+var RC_DATA_VAULT_REPO = "mutmutco/MM-Work";
+var RC_DATA_VERCEL_PROJECT = "prj_2Q1UcZ6tscIxHr4lPEhSD3jU1ZGm";
+var RC_DATA_VERCEL_TEAM = "team_ntTdWEQ896Eh20RT5Ri5XJDB";
+var RC_DATA_ALIAS = "rc.mutmut.work";
+var RC_DATA_GIT_BRANCH = "rc";
+var RC_DATA_BOUND_KEYS = [
+  { envKey: "DATABASE_URL", liveVaultKey: "main/DATABASE_URL", rcVaultKey: "rc/DATABASE_URL" },
+  { envKey: "MIGRATION_DATABASE_URL", liveVaultKey: "main/MIGRATION_DATABASE_URL", rcVaultKey: "rc/MIGRATION_DATABASE_URL" },
+  { envKey: "MMW_DATA_KEY", liveVaultKey: "main/MMW_DATA_KEY", rcVaultKey: "rc/MMW_DATA_KEY" },
+  { envKey: "GOOGLE_CLIENT_ID", liveVaultKey: "GOOGLE_CLIENT_ID", rcVaultKey: null },
+  { envKey: "GOOGLE_CLIENT_SECRET", liveVaultKey: "GOOGLE_CLIENT_SECRET", rcVaultKey: null }
+];
+var POLL_ATTEMPTS = 60;
+var POLL_INTERVAL_MS = 5e3;
+function withTeam(path2) {
+  const url = new URL(`https://api.vercel.com${path2}`);
+  url.searchParams.set("teamId", RC_DATA_VERCEL_TEAM);
+  return url.toString();
+}
+function envCollectionUrl2() {
+  return withTeam(`/v10/projects/${encodeURIComponent(RC_DATA_VERCEL_PROJECT)}/env`);
+}
+function envItemUrl2(id) {
+  return withTeam(`/v9/projects/${encodeURIComponent(RC_DATA_VERCEL_PROJECT)}/env/${encodeURIComponent(id)}`);
+}
+function aliasUrl() {
+  return withTeam(`/v4/aliases/${RC_DATA_ALIAS}`);
+}
+function deploymentUrl(id) {
+  return withTeam(`/v13/deployments/${encodeURIComponent(id)}`);
+}
+function redeployUrl() {
+  const url = new URL("https://api.vercel.com/v13/deployments");
+  url.searchParams.set("forceNew", "1");
+  url.searchParams.set("teamId", RC_DATA_VERCEL_TEAM);
+  return url.toString();
+}
+function isRcBranchEnv(row, key) {
+  if (row.key !== key) return false;
+  if (row.gitBranch !== RC_DATA_GIT_BRANCH) return false;
+  const target = Array.isArray(row.target) ? row.target.filter((item) => typeof item === "string") : [];
+  return target.includes("preview");
+}
+function envsOf2(body) {
+  if (Array.isArray(body)) return body;
+  if (body && typeof body === "object" && Array.isArray(body.envs)) {
+    return body.envs;
+  }
+  return null;
+}
+function scrub(reason, secrets) {
+  let out = reason.replace(/\s+/g, " ").trim().slice(0, 300);
+  for (const secret of secrets) {
+    if (secret) out = out.split(secret).join("[redacted]");
+  }
+  return out || "unknown error";
+}
+async function readJson(deps, label, url, secrets, init) {
+  const token = secrets[0];
+  const headers = { ...init?.headers ?? {}, ...token ? { Authorization: `Bearer ${token}` } : {} };
+  const method = init?.method ?? "GET";
+  let res;
+  try {
+    res = await deps.fetch(url, { ...init, method, headers });
+  } catch (e) {
+    throw new Error(`${label} failed: ${scrub(e instanceof Error ? e.message : String(e), secrets)}`);
+  }
+  let raw = "";
+  try {
+    raw = await res.text();
+  } catch (e) {
+    throw new Error(`${label} failed: ${scrub(e instanceof Error ? e.message : String(e), secrets)}`);
+  }
+  if (!res.ok) throw new Error(`${label} failed: HTTP ${res.status}${raw ? `: ${scrub(raw, secrets)}` : ""}`);
+  if (!raw.trim()) return {};
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new Error(`${label} failed: response was not JSON`);
+  }
+}
+function deploymentReadyState(body) {
+  if (body && typeof body === "object") {
+    const row = body;
+    if (typeof row.status === "string") return row.status;
+    if (typeof row.readyState === "string") return row.readyState;
+  }
+  return null;
+}
+function deploymentName(body) {
+  if (body && typeof body === "object" && typeof body.name === "string") {
+    return body.name;
+  }
+  return null;
+}
+function aliasDeploymentId(body) {
+  if (body && typeof body === "object" && typeof body.deploymentId === "string") {
+    return body.deploymentId;
+  }
+  return null;
+}
+async function runRcDataSwitch(deps, opts) {
+  if (opts.to !== "live" && opts.to !== "rc") {
+    throw new Error(`--to must be live or rc (got ${String(opts.to ?? "nothing")}); nothing was written`);
+  }
+  if (opts.apply && !opts.ownerGo) {
+    throw new Error("--apply requires --owner-go (it touches the live data key); nothing was written");
+  }
+  const secrets = [];
+  const token = await deps.readToken();
+  secrets.push(token);
+  if (!token) throw new Error("no _org/vercel/API_TOKEN; nothing was written");
+  const listed = await readJson(deps, "GET envs", envCollectionUrl2(), secrets, { method: "GET" });
+  const rows = envsOf2(listed);
+  if (!rows) throw new Error("env list returned an unexpected shape; nothing was written");
+  const plan = RC_DATA_BOUND_KEYS.map((bound) => {
+    const source = opts.to === "live" ? bound.liveVaultKey : bound.rcVaultKey;
+    const existing = rows.find((row) => isRcBranchEnv(row, bound.envKey) && typeof row.id === "string" && row.id.length > 0);
+    const entryId = existing && typeof existing.id === "string" ? existing.id : null;
+    if (source === null) return { action: existing ? "delete" : "noop", key: bound.envKey, entryId, source };
+    return { action: entryId ? "patch" : "create", key: bound.envKey, entryId, source };
+  });
+  if (!opts.apply) {
+    return { command: "suite rc-data", direction: opts.to, dryRun: true, plan, changed: [] };
+  }
+  const values = /* @__PURE__ */ new Map();
+  for (const step of plan) {
+    if (step.action !== "patch" && step.action !== "create") continue;
+    const value = await deps.readVault(step.source);
+    secrets.push(value);
+    if (!value) throw new Error(`vault ${step.source} is missing or unreadable; nothing was written`);
+    values.set(step.key, value);
+  }
+  const changed = [];
+  for (const step of plan) {
+    try {
+      if (step.action === "patch") {
+        await readJson(deps, `PATCH ${step.key}`, envItemUrl2(step.entryId), secrets, {
+          method: "PATCH",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ value: values.get(step.key), type: "sensitive" })
+        });
+        changed.push(step.key);
+      } else if (step.action === "create") {
+        await readJson(deps, `POST ${step.key}`, envCollectionUrl2(), secrets, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ key: step.key, value: values.get(step.key), type: "sensitive", target: ["preview"], gitBranch: RC_DATA_GIT_BRANCH })
+        });
+        changed.push(step.key);
+      } else if (step.action === "delete") {
+        await readJson(deps, `DELETE ${step.key}`, envItemUrl2(step.entryId), secrets, { method: "DELETE" });
+        changed.push(step.key);
+      }
+    } catch (e) {
+      const changedLabel = changed.length ? changed.join(", ") : "none";
+      throw new Error(`${e.message}; changed: ${changedLabel}; no redeploy`);
+    }
+  }
+  const aliasBefore = aliasDeploymentId(await readJson(deps, "GET alias", aliasUrl(), secrets, { method: "GET" }));
+  if (!aliasBefore) throw new Error(`alias ${RC_DATA_ALIAS} has no deployment; envs changed: ${changed.join(", ")}; no redeploy`);
+  const name = deploymentName(await readJson(deps, "GET deployment", deploymentUrl(aliasBefore), secrets, { method: "GET" }));
+  if (!name) throw new Error(`deployment ${aliasBefore} has no name; envs changed: ${changed.join(", ")}; no redeploy`);
+  const created = await readJson(deps, "POST redeploy", redeployUrl(), secrets, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ name, deploymentId: aliasBefore, meta: { redeployReason: `MMI-Hub#7588 rc-data switch to ${opts.to}` } })
+  });
+  const newId = aliasDeploymentId({ deploymentId: created.id });
+  if (!newId) throw new Error(`redeploy answered without an id; envs changed: ${changed.join(", ")}`);
+  let state = null;
+  for (let attempt = 0; attempt < POLL_ATTEMPTS; attempt += 1) {
+    state = deploymentReadyState(await readJson(deps, "GET deployment", deploymentUrl(newId), secrets, { method: "GET" }));
+    if (state === "READY") break;
+    if (state === "ERROR" || state === "CANCELED" || state === "FAILED") {
+      throw new Error(`redeploy ${newId} ended ${state}; envs changed: ${changed.join(", ")}`);
+    }
+    await deps.sleep(POLL_INTERVAL_MS);
+  }
+  if (state !== "READY") throw new Error(`redeploy ${newId} never reached READY (last: ${state ?? "unknown"}); envs changed: ${changed.join(", ")}`);
+  const aliasAfter = aliasDeploymentId(await readJson(deps, "GET alias", aliasUrl(), secrets, { method: "GET" }));
+  if (aliasAfter !== newId) {
+    throw new Error(`alias ${RC_DATA_ALIAS} still points at ${aliasAfter ?? "nothing"} (expected ${newId}); envs changed: ${changed.join(", ")}`);
+  }
+  return { command: "suite rc-data", direction: opts.to, dryRun: false, plan, changed, deploymentId: newId, alias: RC_DATA_ALIAS };
+}
+
 // src/suite-train-io.ts
 var import_node_fs43 = require("node:fs");
 var import_node_path43 = require("node:path");
@@ -39400,6 +39683,7 @@ function applyChecklistCheck(body, query, checked) {
 
 // src/command-register-collaboration.ts
 init_github_client();
+init_github_quota();
 
 // src/issue-commands.ts
 var import_node_fs34 = require("node:fs");
@@ -40340,6 +40624,7 @@ var import_node_path35 = require("node:path");
 
 // src/cross-repo-filing-issue.ts
 init_github_client();
+init_github_quota();
 function crossRepoFilingRetryCommand(prRepo, prNumber) {
   return `mmi-cli devops pr merge ${prNumber} --repo ${prRepo}`;
 }
@@ -40442,6 +40727,7 @@ ${pr.body ?? ""}`;
 }
 
 // src/post-merge-recon.ts
+init_github_quota();
 var POST_MERGE_RECON_SCHEMA_VERSION = 1;
 function postMergeReconRetryCommand(repo, pr) {
   return crossRepoFilingRetryCommand(repo, Number(pr));
@@ -41244,6 +41530,7 @@ async function checkDocsIndexAtHead(opts, deps) {
 
 // src/pr-create-claim-guard.ts
 init_github_client();
+init_github_quota();
 var CLAIM_GUARD_RATE_LIMIT_WAIT_CAP_MS = 3e4;
 function withRateLimitRetry(client, seams = {}) {
   const throttledPaths = /* @__PURE__ */ new Set();
@@ -44768,6 +45055,16 @@ var GIT_COMMIT_TIMEOUT_MS = 6e4;
 function trainGitArgs(args) {
   return ["-c", "gc.auto=0", "-c", "maintenance.auto=false", ...args];
 }
+async function announceSummaryLineCountRefusal(path2) {
+  let content;
+  try {
+    content = await (0, import_promises9.readFile)(path2, "utf8");
+  } catch (e) {
+    return `release: could not read --announce-summary-file ${path2}: ${e.message} \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing`;
+  }
+  const lines2 = summaryFileLines(content);
+  return lines2.length < 3 || lines2.length > 6 ? `release: --announce-summary-file must contain 3-6 non-empty LLM-curated lines (found ${lines2.length}) \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing` : null;
+}
 async function announceSummaryRefusal(path2, isHub = false) {
   let lines2;
   try {
@@ -45221,6 +45518,10 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
     const retryDeploy = new Option("--retry-deploy", "re-dispatch the FAILED rc deploy of the promoted candidate in the active rcand ledger \u2014 same tag and SHA, never re-cut or re-pushed (#7053)");
     trainCmd.addOption(commandName === "rcand" ? retryDeploy : retryDeploy.hideHelp());
     trainCmd.option("--repo <owner/repo>", "dry-run plan for a target repo without relying on the current checkout; --apply still uses the current checkout").action(async (o) => {
+      if (commandName === "release" && o.announceSummaryFile) {
+        const refusal = await announceSummaryLineCountRefusal(o.announceSummaryFile);
+        if (refusal) return fail(refusal);
+      }
       try {
         await requireFreshTrainCli(commandName);
       } catch (e) {
@@ -45693,12 +45994,18 @@ async function withEnv(name, value, fn) {
   }
 }
 async function prepareRcCheckout(git3, repo) {
-  if ((await git3(["status", "--porcelain"])).trim()) throw new Error(`${repo}: checkout has uncommitted changes; refuse to switch it to rc for release`);
+  await prepareLaneCheckout(git3, repo, "rc", "release");
+}
+async function prepareDevelopmentCheckout(git3, repo) {
+  await prepareLaneCheckout(git3, repo, "development", "rcand");
+}
+async function prepareLaneCheckout(git3, repo, branch, lane) {
+  if ((await git3(["status", "--porcelain"])).trim()) throw new Error(`${repo}: checkout has uncommitted changes; refuse to switch it to ${branch} for ${lane}`);
   await git3(["fetch", "origin", "--tags"]);
-  await git3(["switch", "rc"]);
-  await git3(["merge", "--ff-only", "origin/rc"]);
-  const [head, origin] = (await git3(["rev-parse", "HEAD", "origin/rc"])).trim().split(/\s+/);
-  if (!head || head !== origin) throw new Error(`${repo}: local rc ${head?.slice(0, 12)} is not origin/rc ${origin?.slice(0, 12)}; stop`);
+  await git3(["switch", branch]);
+  await git3(["merge", "--ff-only", `origin/${branch}`]);
+  const [head, origin] = (await git3(["rev-parse", "HEAD", `origin/${branch}`])).trim().split(/\s+/);
+  if (!head || head !== origin) throw new Error(`${repo}: local ${branch} ${head?.slice(0, 12)} is not origin/${branch} ${origin?.slice(0, 12)}; stop`);
 }
 function rcRunCauseFromLog(log) {
   const causes = [...new Set([...log.matchAll(/##\[error\](?!Process completed with exit code)([^\r\n]+)/g)].map((m) => m[1].trim()).filter(Boolean))];
@@ -45775,6 +46082,7 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}) {
     }
   };
   const runRcand = async (repo, previousRc, rcWasAbsent) => inTrain(repo, async (deps) => {
+    if (repo !== SUITE_REPO) await prepareDevelopmentCheckout((args) => deps.run("git", args), repo);
     await deps.run("git", ["fetch", "origin", "--tags"]);
     let rcNow;
     try {
@@ -45924,6 +46232,12 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}) {
       }
     },
     tagSha,
+    rcTagsAt: async (repo, sha) => {
+      if (!/^[0-9a-f]{40}$/i.test(sha)) return [];
+      const target = await checkout(repo);
+      await exec("git", ["fetch", "--quiet", "origin", "--tags"], target, WATCH_TIMEOUT);
+      return (await exec("git", ["tag", "--points-at", sha, "--list", "v*-rc.*"], target)).split("\n").map((t) => t.trim()).filter(Boolean);
+    },
     contains: async (repo, ancestor, descendant) => {
       const target = await checkout(repo);
       await exec("git", ["fetch", "origin", "--tags"], target);
@@ -45987,6 +46301,17 @@ function parseMemberSummaryFiles(entries) {
   }
   return memberSummaryFiles;
 }
+function suiteRcDataProdDeps() {
+  return {
+    fetch: async (url, init) => {
+      const res = await fetch(url, { ...init, signal: AbortSignal.timeout(15e3) });
+      return { ok: res.ok, status: res.status, text: () => res.text() };
+    },
+    readToken: readOrgVercelApiToken,
+    readVault: async (vaultKey) => fetchSecretValue(makeSecretsDeps(await loadConfig()), vaultKey, { repo: RC_DATA_VAULT_REPO }),
+    sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms))
+  };
+}
 function registerSuiteCommands(program3) {
   const suite = program3.command("suite").description("MM-Work suite status, candidate cut and release (#7262/#7263)");
   const leadRoot = async () => {
@@ -46059,6 +46384,31 @@ function registerSuiteCommands(program3) {
       return fail(`suite release: ${e.message}`);
     }
   });
+  suite.command("rc-data").description("switch the rc Preview envs between the live and rc data sets as one bound switch (#7588)").option("--to <direction>", "switch source: live or rc").option("--apply", "write the switch (default is a dry-run plan)").option("--owner-go", "explicit approval: touches the live data key").option("--json", "structured receipt").action(async (o) => {
+    try {
+      if (o.to !== "live" && o.to !== "rc") throw new Error(`--to must be live or rc (got ${o.to ?? "nothing"}); nothing was written`);
+      const result = await runRcDataSwitch(suiteRcDataProdDeps(), { to: o.to, apply: o.apply === true, ownerGo: o.ownerGo === true });
+      if (o.json) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+      }
+      console.log([
+        `suite rc-data ${result.dryRun ? "dry-run" : "receipt"} (--to ${result.direction}):`,
+        ...result.plan.map((step) => {
+          if (step.action === "patch") return `  - patch ${step.key} rc entry ${step.entryId} <- vault ${step.source}`;
+          if (step.action === "create") return `  - create ${step.key} rc preview entry <- vault ${step.source}`;
+          if (step.action === "delete") return `  - delete ${step.key} rc entry ${step.entryId} (generic Preview applies again)`;
+          return `  - keep ${step.key} (no rc entry; generic Preview already applies)`;
+        }),
+        ...result.dryRun ? ["  rerun with --apply --owner-go to write, then redeploy rc.mutmut.work"] : [
+          `  - changed: ${result.changed.join(", ") || "none"}`,
+          `  - redeployed ${result.deploymentId}; alias ${result.alias} verified`
+        ]
+      ].join("\n"));
+    } catch (e) {
+      return fail(`suite rc-data: ${e.message}`);
+    }
+  });
   suite.command("status").description("compare served versions with development, rc and main branch heads across MM-Work modules").option("--suite <name>", "suite name (mm-work)", "mm-work").option("--json", "structured output").action(async (o) => {
     if (o.suite !== "mm-work") return fail("suite status: only mm-work is supported");
     const github = defaultGitHubClient();
@@ -51534,9 +51884,13 @@ program2.addHelpText(
   \`mmi-cli commands\` shows the agentic map; \`mmi-cli <house> --help\` lists one house.
 `
 );
+var appActorCommand = "poll";
 function appActorDeps() {
   return {
-    fetchSecret: async (key) => fetchSecretValue(makeSecretsDeps(await loadConfig()), key, { repo: APP_VAULT_REPO }),
+    fetchSecret: async (key) => fetchSecretValue(makeSecretsDeps(await loadConfig()), key, {
+      repo: APP_VAULT_REPO,
+      attribution: { command: appActorCommand, via: formatSessionIdentity(describeSessionIdentity()) }
+    }),
     fetch: (url, init) => fetch(url, init)
   };
 }
@@ -51544,6 +51898,7 @@ setPollTokenProvider(() => pollTokenOrUndefined(appActorDeps()));
 var registerPreAction = Reflect.get(program2, ["h", "ook"].join(""));
 registerPreAction.call(program2, "preAction", async (_thisCommand, actionCommand) => {
   const commandPath3 = commandPathOf(actionCommand);
+  appActorCommand = commandPath3;
   emitCliCallTelemetry(commandPath3);
   try {
     await activateAppActor(commandPath3, process.env, () => mintInstallationToken(appActorDeps()));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.62",
+  "version": "4.5.64",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",