@mutmutco/cli 4.5.76 → 4.5.77

package/dist/main.cjs

@@ -7435,6 +7435,9 @@ var DECLARED_ENTRIES = [
   // archived stage (including a stage whose containers are down) into scratch Postgres and compare
   // row counts, and read-verify every storage archive against its listing; per-stage PASS/FAIL.
   { name: "mmi-backup-restore-check (mm-central, mm-work, mmi-oguz)", cadence: "0 3 1 * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup-restore-check \u2192 /opt/mmi-control/nightly-backup-restore-check.sh; monthly restore proof for every archived stage (#7148; source scripts/nightly-backup-restore-check.sh); zuber (46.225.58.31) is gone: deleted 2026-09-18 by the owner-approved ZuberShade decommission (MMC-ZuberShade#1838, snapshot kept); Hetzner has since reassigned that IP to another machine (#7351)" },
+  // #7662 (MM-Work#1520): Vercel Cron's 15-minute central mail call, moved to the box with MM-Work. The app
+  // calls its own endpoint with its own CRON_SECRET via docker exec, so the secret stays in the container.
+  { name: "mm-work-mail-tick (mm-work)", cadence: "*/15 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mm-work-mail-tick \u2192 /opt/mmi-control/mm-work-mail-tick.sh; GET /api/internal/mail per stage listed in MM_WORK_MAIL_STAGES (source scripts/mm-work-mail-tick.sh; log /var/log/mm-work-mail-tick.log)" },
   // #3370/#6270: the one runner hygiene layer (runner-hygiene.yml was folded in and deleted). A workflow ran ON the runner and needed checkout +
   // setup-node before it can prune, so at 100% it dies at checkout and never prunes — the cleanup is
   // unavailable exactly when it is needed. This one is root cron on the box: no checkout, no node, and
@@ -8560,7 +8563,6 @@ function attributionFields(attr) {
 // src/secrets-transport.ts
 var OWNER = "mutmutco";
 var SSM_ROOT = "/mmi-future";
-var PROJECT_TIER_SEGMENT = "dev";
 var ORG_INFRA_SLUG = "_org";
 var MMI_VAULT_GUIDANCE = 'Check MMI access with `mmi-cli oracle org access capabilities`; a master can locate credentials with `mmi-cli vault secrets find "<what it is for>"`.';
 var KEY_MAX_PATH_SEGMENTS = 4;
@@ -8573,10 +8575,9 @@ function isValidSecretKey(key) {
 function stripTrailingCRLF(value) {
   return value.replace(/\r\n$|\r$|\n$/, "");
 }
-function classifyTier(_slug, key) {
-  const slash2 = key.indexOf("/");
-  if (slash2 === -1) return "project";
-  return key.slice(0, slash2) === PROJECT_TIER_SEGMENT ? "project" : "org";
+var ORG_WIDE_SLUGS = /* @__PURE__ */ new Set([ORG_INFRA_SLUG, "shared", "cloudflare", "docs", "mmi-hub"]);
+function classifyTier(slug, _key) {
+  return ORG_WIDE_SLUGS.has(slug) ? "org" : "project";
 }
 function secretParamName(slug, key) {
   return `${SSM_ROOT}/${slug}/${key}`;
@@ -17230,10 +17231,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.76",
-    tag: "v4.5.76",
-    commit: "9a7afd53566b",
-    npm: "@mutmutco/cli@4.5.76"
+    version: "4.5.77",
+    tag: "v4.5.77",
+    commit: "760ee9725625",
+    npm: "@mutmutco/cli@4.5.77"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17250,14 +17251,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.76"
+          v3Target: "v4.5.77"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.76 and redeploy the Hub Lambda from tag v4.5.76 (9a7afd53566b); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.76 (@mutmutco/cli@4.5.76, tag commit 9a7afd53566b \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.77 and redeploy the Hub Lambda from tag v4.5.77 (760ee9725625); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.77 (@mutmutco/cli@4.5.77, tag commit 760ee9725625 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -30683,7 +30684,7 @@ init_hub_auth();
 init_github_client();
 
 // src/project-set.ts
-var UNSET_KEYS = ["projectAdmins", "installer", "oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "dsManifestPath", "consumesDesignSystem", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary", "notifyOnDeploy", "vercelVersionEnv", "suiteHold"];
+var UNSET_KEYS = ["projectAdmins", "installer", "oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "dsManifestPath", "consumesDesignSystem", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary", "notifyOnDeploy", "vercelVersionEnv", "stageAllowlist", "suiteHold"];
 var UNSET_KEY_SET = new Set(UNSET_KEYS);
 var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
 var SECRET_CONSUMERS = ["runtime", "build", "lambda", "actions", "agent", "box"];
@@ -31063,6 +31064,27 @@ function parseVercelVersionEnvVar(raw) {
   }
   return { project: row.project, key: row.key, ...typeof row.team === "string" ? { team: row.team } : {} };
 }
+function parseStageAllowlistVar(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error('org project set: stageAllowlist must be JSON, e.g. {"key":"MMW_STAGE_ALLOWLIST","stages":["dev"]}');
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("org project set: stageAllowlist must be a JSON object { key, stages }");
+  }
+  const row = parsed;
+  const unknown = Object.keys(row).filter((key) => key !== "key" && key !== "stages");
+  if (unknown.length > 0) throw new Error(`org project set: stageAllowlist has unknown field(s): ${unknown.join(", ")}`);
+  if (typeof row.key !== "string" || !VERCEL_VERSION_ENV_NAME_RE.test(row.key)) {
+    throw new Error("org project set: stageAllowlist.key must be an env name (e.g. MMW_STAGE_ALLOWLIST)");
+  }
+  if (!Array.isArray(row.stages) || row.stages.length === 0 || new Set(row.stages).size !== row.stages.length || !row.stages.every((s) => s === "dev" || s === "rc" || s === "main")) {
+    throw new Error("org project set: stageAllowlist.stages must be a non-empty unique array of: dev, rc, main");
+  }
+  return { key: row.key, stages: row.stages };
+}
 function parseCiExemptReasonVar(raw) {
   const trimmed = raw.trim();
   if (!trimmed) throw new Error("org project set: ciExemptReason must be a non-empty reason (or use --unset ciExemptReason to clear it)");
@@ -31212,7 +31234,8 @@ var SETTABLE_VAR_KEYS = [
   "seedCanary",
   "installer",
   "notifyOnDeploy",
-  "vercelVersionEnv"
+  "vercelVersionEnv",
+  "stageAllowlist"
 ];
 var SETTABLE_VAR_KEY_SET = new Set(SETTABLE_VAR_KEYS);
 var SETTABLE_VAR_HINTS = {
@@ -31244,6 +31267,7 @@ var SETTABLE_VAR_HINTS = {
   requiredCheckBranches: "non-empty JSON branch-name array; exact product-ruleset scope (#5210)",
   notifyOnDeploy: 'JSON stage array, e.g. ["dev"] \u2014 successful tenant-deploy sends <stage>-deployed to the project repo (#7358)',
   vercelVersionEnv: "JSON {project,key,team?} \u2014 train sets this Vercel env to the release tag before the main/rc push (#7362)",
+  stageAllowlist: "JSON {key,stages[]} \u2014 `org access sync` writes the developer/admin company-email allowlist to <stage>/<key> for each listed stage (#7678)",
   ciExemptReason: "non-empty string \u2014 declares this deployable repo has no CI surface (#4265)",
   gate: "JSON {runtime,cmd,affectedCmd,workdir,cacheDepPath,pyVersion}"
 };
@@ -31407,6 +31431,8 @@ function buildProjectSetPatch(input) {
       patch[key] = parseNotifyOnDeployVar(raw);
     } else if (key === "vercelVersionEnv") {
       patch[key] = parseVercelVersionEnvVar(raw);
+    } else if (key === "stageAllowlist") {
+      patch[key] = parseStageAllowlistVar(raw);
     } else if (key === "ciExemptReason") {
       patch[key] = parseCiExemptReasonVar(raw);
     } else if (key === "gate") {
@@ -36017,6 +36043,12 @@ async function runRcDataSwitch(deps, opts) {
   if (opts.apply && !opts.ownerGo) {
     throw new Error("--apply requires --owner-go (it touches the live data key); nothing was written");
   }
+  const rcSubstrate = await deps.readLeadRcSubstrate();
+  if (rcSubstrate) {
+    throw new Error(
+      `suite rc-data applies only while rc is served by Vercel (the lead's DEPLOY#rc runs on ${rcSubstrate}); rc data now follows the tenant runtime, not Vercel Preview envs; nothing was written`
+    );
+  }
   const secrets = [];
   const token = await deps.readToken();
   secrets.push(token);
@@ -36342,9 +36374,49 @@ function parseCherryPickBlockingPaths(message2) {
   if (!m) return [];
   return m[1].split(",").map((s) => s.trim()).filter(Boolean);
 }
-function formatHotfixBatchPreflightRefusal(failures, fromSpecs) {
+async function classifyHotfixPortLanePicks(deps, failures) {
+  const exists = async (ref, path2) => {
+    try {
+      await deps.run("git", ["cat-file", "-e", `${ref}:${path2}`]);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  const portable = /* @__PURE__ */ new Map();
+  for (const f of failures) {
+    if (f.blocking.length === 0) continue;
+    let fits = false;
+    const bothSides = [];
+    for (const path2 of f.blocking) {
+      const onMain = await exists("origin/main", path2);
+      if (!onMain && await exists("origin/development", path2)) fits = true;
+      else if (onMain) bothSides.push(path2);
+    }
+    if (fits) portable.set(f.sha, bothSides);
+  }
+  return portable;
+}
+function bothSidesText(portFailures, portLaneShas) {
+  const rows = portFailures.map((f) => ({ label: f.label, paths: portLaneShas.get(f.sha) ?? [] })).filter((r) => r.paths.length > 0);
+  if (rows.length === 0) return "";
+  return `BEFORE that --ack: ${rows.map((r) => `${r.label} also conflicts on ${r.paths.join(", ")}`).join("; ")}, which exist on both branches \u2014 the port resolves them by hand for main, so land the SAME resolution on development first (the --ack covers the whole commit, and the next release would otherwise overwrite or clash with the main-only content). `;
+}
+function formatHotfixBatchPreflightRefusal(failures, fromSpecs, portLaneShas = /* @__PURE__ */ new Map()) {
   const lines2 = failures.map((f) => `  - ${f.label}: ${f.blocking.join(", ")}`);
+  const portFailures = failures.filter((f) => portLaneShas.has(f.sha));
+  const synthFailures = failures.filter((f) => !portLaneShas.has(f.sha));
+  const head = `hotfix start batch preflight refused: ${failures.length} pick(s) would hard-stop on origin/main:
+${lines2.join("\n")}
+`;
   const batchFrom = fromSpecs.join(",");
+  const guide = "https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#hotfix-pick-refused";
+  if (portFailures.length > 0) {
+    const originals = portFailures.map((f) => f.sha.slice(0, 7)).join(",");
+    const portText = `${portFailures.length === failures.length ? "Every failing pick" : `Pick(s) ${portFailures.map((f) => f.label).join(", ")}`} fail on path(s) ABSENT on origin/main but present on origin/development, so a development-based cite-only synthesis PR cannot carry them (a new development commit cannot add files development already has \u2014 its cherry-pick onto main carries nothing, #7669). Use the main-based PORT-COMMIT lane: cut a branch FROM origin/main, add ONE port commit that brings the listed path(s) and the fix onto main-lineage (e.g. \`git checkout origin/development -- <paths>\` then the fix), push it and keep it pushed until the release \u2014 never merge it into development \u2014 then run \`mmi-cli devops hotfix start --from <portSHA> --ack ${originals}\` (a bare SHA is accepted; the originals are the acked development fixes the port replaces), and record the port SHA in the hotfix PR body. The port commit never reaches development and will not patch-id match, so the NEXT rc\u2192main release must pass \`--ack <the hotfix's main commit>\` (hotfix-coverage). ` + bothSidesText(portFailures, portLaneShas);
+    if (synthFailures.length === 0) return `${head}${portText}Never hand-resolve onto main; see ${guide}`;
+    return `${head}Mixed batch \u2014 two lanes. ${portText}Pick(s) ${synthFailures.map((f) => f.label).join(", ")} fit the development-based cite-only synthesis lane instead: cut the branch FROM origin/development, regenerate the conflict content so it cherry-picks cleanly onto current origin/main, and land that development-parented PR with the cite-only marker (the #5096 flow). Then rerun \`mmi-cli devops hotfix start --from <synthesis merge SHA(s)>,<portSHA> --ack ${originals}\` (the original --from was ${batchFrom}) \u2014 never hand-resolve onto main; never a main-parented branch into development; see ${guide}`;
+  }
   return `hotfix start batch preflight refused: ${failures.length} pick(s) would hard-stop on origin/main:
 ${lines2.join("\n")}
 Land ONE development-based cite-only synthesis PR for the whole batch (#4643 supersedes the old cut-from-origin/main wording, which produced main-lineage PRs into development \u2014 the shape portFoldToDevelopment forbids, #4365/#4371): cut the branch FROM origin/development, regenerate the listed conflict content so it cherry-picks cleanly onto current origin/main, and land that development-parented PR with the cite-only marker (the proven #5096 flow), then rerun \`mmi-cli devops hotfix start --from ${batchFrom}\` with the port merge SHA(s) \u2014 never hand-resolve onto main; never a main-parented branch into development; never N serial ports (#3167) \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#hotfix-pick-refused`;
@@ -36608,7 +36680,8 @@ async function runHotfixStartLocked(deps, options, doctor) {
   } else {
     const preflight2 = await preflightHotfixBatchPicks(deps, sources, pickTolerated);
     if (preflight2.failures.length > 0) {
-      throw new Error(formatHotfixBatchPreflightRefusal(preflight2.failures, specs));
+      const portLaneShas = await classifyHotfixPortLanePicks(deps, preflight2.failures);
+      throw new Error(formatHotfixBatchPreflightRefusal(preflight2.failures, specs, portLaneShas));
     }
     if (preflight2.skipped.length > 0) {
       const skippedShas = new Set(preflight2.skipped.map((s) => s.sha));
@@ -41689,6 +41762,8 @@ function findEnvFiles(root) {
 // src/stage-runtime-env.ts
 var SERVICE_NAME_RE = /^[A-Za-z0-9_.-]+$/;
 var ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var EXCLUDE_KEY_RE = /^[A-Z_][A-Z0-9_]*$/;
+var EXCLUDE_LABEL = "mmi.runtime-env.exclude";
 var RUNTIME_ENV_OVERRIDE_RELPATH = "tmp/stage/runtime-env.override.yml";
 function labelsMarkRuntimeEnv(labels) {
   if (Array.isArray(labels)) {
@@ -41699,6 +41774,50 @@ function labelsMarkRuntimeEnv(labels) {
   }
   return false;
 }
+function labelValue(labels, name) {
+  if (Array.isArray(labels)) {
+    for (const l of labels) {
+      if (typeof l !== "string") continue;
+      const eq = l.indexOf("=");
+      if (eq < 0 || l.slice(0, eq).trim() !== name) continue;
+      const value = l.slice(eq + 1).trim();
+      const quote = value[0];
+      const quoted = value.length >= 2 && (quote === '"' || quote === "'") && value.endsWith(quote);
+      return quoted ? value.slice(1, -1) : value;
+    }
+    return "";
+  }
+  if (labels && typeof labels === "object") return String(labels[name] ?? "");
+  return "";
+}
+function parseRuntimeEnvExclude(value, service = "?") {
+  if (!value.trim()) return [];
+  return value.split(",").map((raw) => {
+    const key = raw.trim();
+    if (!EXCLUDE_KEY_RE.test(key)) {
+      throw new Error(`invalid ${EXCLUDE_LABEL} entry on service ${service}: '${key}' (comma-separated env-var names matching ^[A-Z_][A-Z0-9_]*$)`);
+    }
+    return key;
+  });
+}
+function runtimeEnvExcludes(composeConfigJson) {
+  let parsed;
+  try {
+    parsed = JSON.parse(composeConfigJson);
+  } catch {
+    return {};
+  }
+  const services = parsed?.services;
+  if (!services || typeof services !== "object" || Array.isArray(services)) return {};
+  const out = {};
+  for (const [name, svc] of Object.entries(services)) {
+    const labels = svc?.labels;
+    if (!SERVICE_NAME_RE.test(name) || !labelsMarkRuntimeEnv(labels)) continue;
+    const keys = parseRuntimeEnvExclude(labelValue(labels, EXCLUDE_LABEL), name);
+    if (keys.length) out[name] = keys;
+  }
+  return out;
+}
 function runtimeEnvMarkedServices(composeConfigJson) {
   let parsed;
   try {
@@ -41710,19 +41829,24 @@ function runtimeEnvMarkedServices(composeConfigJson) {
   if (!services || typeof services !== "object" || Array.isArray(services)) return [];
   return Object.entries(services).filter(([name, svc]) => SERVICE_NAME_RE.test(name) && labelsMarkRuntimeEnv(svc?.labels)).map(([name]) => name).sort();
 }
-function renderRuntimeEnvOverride(services, keys) {
+function renderRuntimeEnvOverride(services, keys, excludes = {}) {
   const safeServices = services.filter((s) => SERVICE_NAME_RE.test(s)).sort();
   const safeKeys = [...new Set(keys.filter((k) => ENV_KEY_RE.test(k)))].sort();
-  if (!safeServices.length || !safeKeys.length) return null;
+  const keysFor = (service) => {
+    const skip = new Set(excludes[service] ?? []);
+    return safeKeys.filter((k) => !skip.has(k));
+  };
+  const withKeys = safeServices.filter((s) => keysFor(s).length);
+  if (!withKeys.length) return null;
   const lines2 = [
     "# Generated by `mmi-cli stage` (#6345) \u2014 do not edit, do not commit.",
     '# Passes the vault-resolved runtime env through to every service labelled mmi.runtime-env: "true",',
     "# exactly as the box deploy does. KEY NAMES ONLY: the values live in the compose process env (#2655).",
     "services:"
   ];
-  for (const service of safeServices) {
+  for (const service of withKeys) {
     lines2.push(`  ${service}:`, "    environment:");
-    for (const key of safeKeys) lines2.push(`      ${key}: \${${key}:?}`);
+    for (const key of keysFor(service)) lines2.push(`      ${key}: \${${key}:?}`);
   }
   return `${lines2.join("\n")}
 `;
@@ -42124,7 +42248,7 @@ async function prepareRuntimeEnvPassthrough(cwd, composeEnv, vaultEnvMerge) {
   } catch {
     return {};
   }
-  const body = renderRuntimeEnvOverride(runtimeEnvMarkedServices(configJson), keys);
+  const body = renderRuntimeEnvOverride(runtimeEnvMarkedServices(configJson), keys, runtimeEnvExcludes(configJson));
   if (!body) return {};
   const overridePath = (0, import_node_path38.join)(cwd, RUNTIME_ENV_OVERRIDE_RELPATH);
   (0, import_node_fs38.mkdirSync)((0, import_node_path38.join)(cwd, "tmp", "stage"), { recursive: true });
@@ -46311,6 +46435,12 @@ function suiteRcDataProdDeps() {
     },
     readToken: readOrgVercelApiToken,
     readVault: async (vaultKey) => fetchSecretValue(makeSecretsDeps(await loadConfig()), vaultKey, { repo: RC_DATA_VAULT_REPO }),
+    readLeadRcSubstrate: async () => {
+      const facts = await fetchDeployFactsBySlug("mm-work", registryClientDeps(await loadConfig()));
+      if (!facts) throw new Error("MM-Work deploy facts unreadable; stop");
+      const rc = facts.stages.rc;
+      return rc?.present ? rc.substrate ?? "an unnamed substrate" : null;
+    },
     sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms))
   };
 }
@@ -49665,7 +49795,7 @@ function registerSchedulesCommands(program3) {
       await failGraceful(e.message);
     }
   });
-  schedules.command("park <schedule-id>").description("record a deliberate hold on a SCHEDULE# row \u2014 the reconciler skips it and `org schedules` renders `parked (<reason>)` instead of DRIFT (#4257)").requiredOption("--reason <ref>", "why the lane is held, e.g. an issue ref (#1774)").action(async (scheduleId, o) => {
+  schedules.command("park <schedule-id>").description("record a deliberate hold on a SCHEDULE# row \u2014 the reconciler skips it and `org schedules` renders `parked (<reason>)` instead of DRIFT (#4257). It does NOT stop an armed clock from dispatching: to stop a lane firing, disable its workflow (`gh workflow disable`) or remove its header and re-register (#7685)").requiredOption("--reason <ref>", "why the lane is held, e.g. an issue ref (#1774)").action(async (scheduleId, o) => {
     try {
       const res = await postSchedulesPark(scheduleId, o.reason, registryClientDeps(await loadConfig()));
       if (!res.ok) {
@@ -49673,6 +49803,7 @@ function registerSchedulesCommands(program3) {
         return;
       }
       console.log(JSON.stringify(res.body, null, 2));
+      console.error(`schedules park: ${scheduleId} is parked for drift reporting only \u2014 an armed clock still dispatches it. To stop it firing: gh workflow disable <workflow> -R <owner/repo>, or remove its schedule header and re-run \`mmi-cli harbour org schedules register\`.`);
     } catch (e) {
       await failGraceful(e.message);
     }
@@ -49717,6 +49848,96 @@ function registerSchedulesCommands(program3) {
   });
 }
 
+// ../company-emails.json
+var company_emails_default = {
+  _comment: "Org-level, NON-secret GitHub login -> company email map (#7678). `mmi-cli oracle org access sync <repo>` maps a repo's current developer/admin collaborators through it to rebuild the stage allowlist a project opts into with the registry field `stageAllowlist` (e.g. MM-Work's MMW_STAGE_ALLOWLIST). Bundled into mmi-cli at build time (cli/src/stage-allowlist.ts) \u2014 one source of truth, edited here in a PR. Keys are lowercase GitHub logins; a collaborator missing here is reported loudly by the sync, never silently dropped.",
+  emails: {
+    jervaise: "suphi@mutatismutandis.co",
+    sezenlerinadil: "adil@mutatismutandis.co"
+  }
+};
+
+// src/stage-allowlist.ts
+var ALLOWLIST_STAGES = ["dev", "rc", "main"];
+var ALLOWLIST_ROLES = /* @__PURE__ */ new Set(["write", "maintain", "admin"]);
+function bundledCompanyEmails() {
+  return normalizeEmailMap(company_emails_default.emails ?? {});
+}
+function normalizeEmailMap(raw) {
+  const out = {};
+  for (const [login, email] of Object.entries(raw)) {
+    if (typeof email === "string" && email.trim()) out[login.toLowerCase()] = email.trim().toLowerCase();
+  }
+  return out;
+}
+function stageAllowlistConfig(project2) {
+  const cfg = project2?.stageAllowlist;
+  if (!cfg || typeof cfg.key !== "string" || !Array.isArray(cfg.stages)) return null;
+  const stages = cfg.stages.filter((s) => ALLOWLIST_STAGES.includes(s));
+  return stages.length > 0 ? { key: cfg.key, stages } : null;
+}
+function developerAdminLogins(collaborators) {
+  const logins = /* @__PURE__ */ new Set();
+  for (const c of collaborators) {
+    const role = c.role_name ?? (c.permissions?.admin ? "admin" : c.permissions?.maintain ? "maintain" : c.permissions?.push ? "write" : "read");
+    if (ALLOWLIST_ROLES.has(role)) logins.add(c.login.toLowerCase());
+  }
+  return [...logins].sort();
+}
+function computeAllowlist(logins, emailMap) {
+  const emails = /* @__PURE__ */ new Set();
+  const unmapped = [];
+  for (const login of logins) {
+    const email = emailMap[login.toLowerCase()];
+    if (email) emails.add(email);
+    else unmapped.push(login);
+  }
+  return { emails: [...emails].sort(), unmapped };
+}
+function diffAllowlist(current, next) {
+  const before = new Set((current ?? "").split(",").map((e) => e.trim().toLowerCase()).filter(Boolean));
+  const after = new Set(next);
+  const added = [...after].filter((e) => !before.has(e)).sort();
+  const removed = [...before].filter((e) => !after.has(e)).sort();
+  return { added, removed, changed: added.length > 0 || removed.length > 0 };
+}
+async function syncStageAllowlist(deps, repo, config, emailMap, opts = {}) {
+  const logins = developerAdminLogins(await deps.listCollaborators(repo));
+  const { emails, unmapped } = computeAllowlist(logins, emailMap);
+  const stages = [];
+  for (const stage of config.stages) {
+    const coordinate = `${stage}/${config.key}`;
+    const diff = diffAllowlist(await deps.readValue(repo, coordinate), emails);
+    if (!diff.changed || opts.dryRun) {
+      stages.push({ stage, ...diff, written: false });
+      continue;
+    }
+    if (emails.length === 0) {
+      stages.push({ stage, ...diff, written: false, error: "no developer/admin collaborator has a mapped email \u2014 refusing to write an empty allowlist" });
+      continue;
+    }
+    const written = await deps.writeValue(repo, coordinate, emails.join(","));
+    stages.push({ stage, ...diff, written, ...written ? {} : { error: `vault write of ${coordinate} was refused` } });
+  }
+  return { repo, key: config.key, logins, unmapped, emails, stages, ok: unmapped.length === 0 && stages.every((s) => !s.error) };
+}
+function renderStageAllowlist(r, dryRun = false) {
+  const lines2 = [`${r.repo}: ${r.key} from ${r.logins.length} developer/admin collaborator(s): ${r.logins.map((l) => `@${l}`).join(", ") || "(none)"}`];
+  for (const s of r.stages) {
+    const change = !s.changed ? "unchanged" : `${s.added.length ? `+${s.added.join(" +")}` : ""}${s.added.length && s.removed.length ? " " : ""}${s.removed.length ? `-${s.removed.join(" -")}` : ""}`;
+    const verb = s.error ? "FAILED" : s.written ? "written" : s.changed && dryRun ? "would write" : "no write needed";
+    lines2.push(`  ${s.stage}/${r.key}: ${change} (${verb})${s.error ? ` \u2014 ${s.error}` : ""}`);
+  }
+  for (const login of r.unmapped) {
+    lines2.push(`  UNMAPPED: @${login} holds developer/admin on ${r.repo} but has NO company email in company-emails.json \u2014 they are NOT on the allowlist. Add "${login.toLowerCase()}" there, then re-run.`);
+  }
+  if (r.stages.some((s) => s.written)) lines2.push("  redeploy the stage for the runtime to pick the new value up: `mmi-cli devops runtime tenant redeploy <owner/repo> <stage>`");
+  return lines2.join("\n");
+}
+async function listRepoCollaborators(client, repo) {
+  return client.restPaginate(`repos/${repo}/collaborators`);
+}
+
 // src/session-report.ts
 init_cli_shared();
 var GC_GH_TIMEOUT_MS4 = 2e4;
@@ -52474,7 +52695,7 @@ ${filelessTransitionGuide(target, o.stage)}`
   return reportWrite("org project set-deploy", res);
 });
 var projectTenantTasks = project.command("tenant-tasks").description("project-admin self-declare of tenant tasks for every stage of your own repo \u2014 new-task-only; editing an existing task stays master-only (`org project set --var tenantTasks=...`)");
-projectTenantTasks.command("declare <name>").description("register a NEW tenant task \u2014 becomes runnable via `runtime tenant control \u2026 run-task` on its declared dev/rc/main stages. Body shape {service,command[],stages[],timeoutSeconds?,artifact?}; required artifact tasks must carry {artifact} in the command argv.").option("--service <name>", "service in the tenant runtime the task runs in (required unless --var carries it)").option("--command <argv...>", "task command as argv (repeatable; required unless --var carries it)").option("--stages <list>", "comma-separated dev,rc,main stages this task may run on (required unless --var carries it)").option("--timeout-seconds <n>", "optional wall-clock ceiling 1..3600").option("--artifact <none|required>", "artifact contract (default none; required tasks must contain {artifact} in argv)").option("--var <json>", "full task object {service,command[],stages[],timeoutSeconds?,artifact?} \u2014 use instead of the individual flags. A task carrying secretOutput:{path,vault:{repo,key},overwrite?} is master-only; declare that via `org project set --var tenantTasks=...`").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (name, o) => {
+projectTenantTasks.command("declare <name>").description("register a NEW tenant task \u2014 becomes runnable via `runtime tenant control \u2026 run-task` on its declared dev/rc/main stages. Body shape {service,command[],stages[],timeoutSeconds?,artifact?}; required artifact tasks must carry {artifact} in the command argv.").option("--service <name>", "service in the tenant runtime the task runs in (required unless --var carries it)").option("--command <argv...>", `task command as argv (repeatable; required unless --var carries it). An argv token that starts with "-" (python -m mod) is read as an option and the whole call fails to parse: declare such a command with --var '{"service":"<svc>","command":["python","-m","mod"],"stages":["dev"]}' instead (#7668)`).option("--stages <list>", "comma-separated dev,rc,main stages this task may run on (required unless --var carries it)").option("--timeout-seconds <n>", "optional wall-clock ceiling 1..3600").option("--artifact <none|required>", "artifact contract (default none; required tasks must contain {artifact} in argv)").option("--var <json>", "full task object {service,command[],stages[],timeoutSeconds?,artifact?} \u2014 use instead of the individual flags. A task carrying secretOutput:{path,vault:{repo,key},overwrite?} is master-only; declare that via `org project set --var tenantTasks=...`").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (name, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -52722,6 +52943,28 @@ access.command("role [repo]").description("D14 train authority for a repo (serve
   console.log(`${a.repo}: @${a.login} is ${a.role} \u2014 train ${a.train ? "AUTHORIZED" : "not authorized"}${a.hubTrainMasterOnly ? " (Hub train is master-only)" : ""}`);
   if (!a.train) process.exitCode = 1;
 });
+access.command("sync [repo]").description("rebuild the stage allowlist (e.g. MM-Work MMW_STAGE_ALLOWLIST) from the repo's developer/admin collaborators via company-emails.json and write it to the vault for each stage the project opted into (registry stageAllowlist); run it after every developer/admin change (#7678)").option("--dry-run", "print what would change without writing").option("--json", "machine-readable output").action(async (repoArg) => {
+  const o = { json: rawFlag("--json"), dryRun: rawFlag("--dry-run") };
+  const repo = repoArg ?? await resolveRepo();
+  if (!repo) return fail("org access sync: pass <owner/repo> or run inside a repo checkout");
+  const cfg = await loadConfig();
+  if (!cfg.sagaApiUrl) return fail("org access sync: Hub API URL not configured");
+  const projects = await fetchProjectsList(registryClientDeps(cfg));
+  if (!projects) return failGraceful("org access sync: could not read the org project registry \u2014 nothing written");
+  const project2 = projects.find((p) => (p.repos ?? []).some((r) => r.toLowerCase() === repo.toLowerCase())) ?? null;
+  const config = stageAllowlistConfig(project2);
+  if (!config) return failGraceful(`org access sync: ${repo} has no stageAllowlist opt-in \u2014 set it with \`mmi-cli oracle org project set ${repo} --var 'stageAllowlist={"key":"<KEY>","stages":["dev"]}'\``);
+  const secretsDeps = makeSecretsDeps(cfg);
+  const client = defaultGitHubClient();
+  const result = await syncStageAllowlist({
+    listCollaborators: (r) => listRepoCollaborators(client, r),
+    readValue: (r, coordinate) => fetchSecretValue(secretsDeps, coordinate, { repo: r }),
+    // The value is written in-process from here; putSecret confirms by NAME only.
+    writeValue: (r, coordinate, value) => putSecret(secretsDeps, coordinate, value, { repo: r })
+  }, repo, config, bundledCompanyEmails(), { dryRun: o.dryRun });
+  console.log(o.json ? JSON.stringify(result, null, 2) : renderStageAllowlist(result, o.dryRun));
+  if (!result.ok) process.exitCode = 1;
+});
 access.command("audit").description("audit collaborator roles + train-branch push allowlists vs the locked state; read-only, emits gh remediation, never applies").option("--json", "machine-readable output").option("--repo <owner/repo>", "audit a single repo instead of the whole org").option("--class <class>", "repo class for --repo (deployable | content)", "deployable").action(async () => {
   const o = { json: rawFlag("--json"), repo: rawValue("--repo", ""), class: rawValue("--class", "deployable") };
   const deps = { client: defaultGitHubClient() };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.76",
+  "version": "4.5.77",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",