@mutmutco/cli 4.6.21 → 4.6.23

package/dist/main.cjs

@@ -710,6 +710,10 @@ function createGitHubClient(options = {}) {
       }
       return read();
     },
+    async restWithStatus(method, path2, init) {
+      const res = await request(method, joinUrl(baseUrl, path2), init);
+      return { status: res.status, body: await parseJson(res) };
+    },
     async restPaginate(path2, init) {
       const items = [];
       let url = withPerPage(joinUrl(baseUrl, path2));
@@ -1237,6 +1241,10 @@ var init_house_map = __esm({
       // allowlisted GitHub REST GET reads for automation (pull files, compare, contents)
       run: "devops",
       // #9479: one named workflow run — the bounded `run cancel <id>` and `run rerun <id>` writes
+      vars: "devops",
+      // #9780: repository Actions variables — typed get/list/create/update/delete receipts
+      repo: "devops",
+      // #9779: canonical repository typed reads (archive status)
       ci: "devops",
       // the CI/gate audit
       jev: "devops",
@@ -1616,10 +1624,10 @@ var init_cli_shared = __esm({
       );
       const appEnv = options.env ? void 0 : await ghReadAppEnv(file, args) ?? await ghFilingAppEnv(file, args);
       const reportsCredential = !options.env && /(^|[\\/])gh(\.exe)?$/i.test(file) && isAppFilingWrite(args);
-      const tag = async (call, credential) => {
-        if (!reportsCredential) return call;
+      const tag = async (call3, credential) => {
+        if (!reportsCredential) return call3;
         try {
-          return { ...await call, credential };
+          return { ...await call3, credential };
         } catch (e) {
           if (e && typeof e === "object") e.credential = credential;
           throw e;
@@ -15415,6 +15423,15 @@ var APP_WRITE_COMMANDS = /* @__PURE__ */ new Map([
   ["run cancel", { metadata: "read", actions: "write" }],
   // #9587: one named run rerun (all or failed jobs) — same actions:write profile, nothing broader.
   ["run rerun", { metadata: "read", actions: "write" }],
+  // #9780: repository Actions variables — get/list mint only Variables:read; create/update/delete
+  // Variables:write. Repository scope only; no secret store, no rename, no workflow dispatch.
+  ["vars get", { metadata: "read", variables: "read" }],
+  ["vars list", { metadata: "read", variables: "read" }],
+  ["vars create", { metadata: "read", variables: "write" }],
+  ["vars update", { metadata: "read", variables: "write" }],
+  ["vars delete", { metadata: "read", variables: "write" }],
+  // #9779: the archive-status read is a metadata:read-only repository read — nothing broader.
+  ["repo archive-status", { metadata: "read" }],
   ["issue comment", { metadata: "read", issues: "write", pull_requests: "write" }],
   // #9614: closing an issue is an issue-state write — it rides the org App (mmi-github-app), so the close
   // is attributed to the App instead of the personal account. Nothing broader than issues.
@@ -17934,7 +17951,45 @@ function jobReportsPullRequestCheck(job) {
   });
   if (!directIf) return true;
   const expression = directIf.replace(/^\s*if:\s*/, "").trim().replace(/^\$\{\{\s*/, "").replace(/\s*\}\}$/, "").trim();
-  return !/^(?:github\.event_name\s*==\s*['"]push['"]|['"]push['"]\s*==\s*github\.event_name)$/.test(expression);
+  if (/pull_request/i.test(expression)) return true;
+  let rest = expression;
+  let valid = true;
+  const take = (pattern) => {
+    const match = rest.match(pattern);
+    if (!match) return void 0;
+    rest = rest.slice(match[0].length).trimStart();
+    return match[0];
+  };
+  const atom = () => {
+    if (take(/^\(/)) {
+      const possible2 = disjunction();
+      if (!take(/^\)/)) valid = false;
+      return possible2;
+    }
+    if (take(/^(?:github\.event_name\s*==\s*'[^']*'|github\.event_name\s*==\s*"[^"]*"|'[^']*'\s*==\s*github\.event_name|"[^"]*"\s*==\s*github\.event_name)/)) return false;
+    if (take(/^always\(\s*\)/)) return true;
+    if (take(/^needs\.[A-Za-z0-9_-]+\.outputs\.[A-Za-z0-9_-]+\s*(?:==|!=)\s*(?:'[^']*'|"[^"]*")/)) return true;
+    valid = false;
+    return true;
+  };
+  const conjunction = () => {
+    let possible2 = atom();
+    while (take(/^&&/)) {
+      const next = atom();
+      possible2 = possible2 && next;
+    }
+    return possible2;
+  };
+  const disjunction = () => {
+    let possible2 = conjunction();
+    while (take(/^\|\|/)) {
+      const next = conjunction();
+      possible2 = possible2 || next;
+    }
+    return possible2;
+  };
+  const possible = disjunction();
+  return !valid || rest.length > 0 || possible;
 }
 function workflowTriggersPullRequest(yaml) {
   const onBlock = extractOnBlock(yaml);
@@ -25428,7 +25483,9 @@ function checkRunbookClaims(root, docs, deps) {
           if (token === "--") break;
           const flag = token.split("=")[0];
           if (/^--[\w-]+$/.test(flag) && flag !== "--help" && !placeholder(flag) && !deps.commandOptions?.get(resolved)?.has(flag)) {
-            report("unknown-flag", `mmi-cli ${resolved}: ${flag}`);
+            const known = deps.commandOptions?.get(resolved);
+            const knownFlags = known?.size ? ` (known flags: ${[...known].sort().join(" ")})` : "";
+            report("unknown-flag", `mmi-cli ${resolved}: ${flag}${knownFlags} (source: ${deps.commandSource ?? "unspecified"})`);
           }
         }
       } else if (cmd === "npm") {
@@ -25667,7 +25724,7 @@ function runDocRefs(root, deps = {}) {
     findings.push(...checkCommands(docs, commandPaths).findings);
   }
   const runbooks = Object.fromEntries(Object.entries(docs).filter(([doc, body]) => isRunbook(doc, body)));
-  findings.push(...checkRunbookClaims(root, runbooks, { readFile: readFile10, exists, isIgnored, trackedFirstSegments, commandPaths, commandOptions: deps.commandOptions }));
+  findings.push(...checkRunbookClaims(root, runbooks, { readFile: readFile10, exists, isIgnored, trackedFirstSegments, commandPaths, commandOptions: deps.commandOptions, commandSource: deps.commandSource }));
   const warnings = [...refResult.warnings];
   if (deps.runbooksOnly && !Object.keys(runbooks).length) {
     warnings.push({ kind: "runbook-missing", doc: "docs/Guides/operator.md", line: 0, detail: "no operator runbook or <!-- runbook --> document exists" });
@@ -28089,10 +28146,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.21",
-    tag: "v4.6.21",
-    commit: "e142296c5904",
-    npm: "@mutmutco/cli@4.6.21"
+    version: "4.6.23",
+    tag: "v4.6.23",
+    commit: "27b8f434196b",
+    npm: "@mutmutco/cli@4.6.23"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -28109,14 +28166,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.21"
+          v3Target: "v4.6.23"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.21 and redeploy the Hub Lambda from tag v4.6.21 (e142296c5904); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.21 (@mutmutco/cli@4.6.21, tag commit e142296c5904 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.23 and redeploy the Hub Lambda from tag v4.6.23 (27b8f434196b); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.23 (@mutmutco/cli@4.6.23, tag commit 27b8f434196b \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -41185,7 +41242,7 @@ var PRIMARY_GROUPS = [
   ["Setup and support", ["bootstrap", "secrets", "docs", "tests", "spawn", "dist"]],
   ["Coordinate and improve", ["wave", "report", "skill-lesson", "closure-rate"]]
 ];
-var OPERATIONAL_TOP_LEVEL = /* @__PURE__ */ new Set(["oauth", "org", "runtime", "plugin", "packages", "github", "archive-prune", "intercom", "jev"]);
+var OPERATIONAL_TOP_LEVEL = /* @__PURE__ */ new Set(["oauth", "org", "runtime", "plugin", "packages", "github", "archive-prune", "intercom", "jev", "vars", "repo"]);
 var CAMPAIGN_ORCHESTRATOR_TOP_LEVEL = /* @__PURE__ */ new Set(["pickup", "read", "run"]);
 var SUPPORT_PRIMARY = /* @__PURE__ */ new Set(["doctor", "whoami", "commands", "explain", "docs", "tests", "spawn", "dist", "wave", "report", "skill-lesson", "closure-rate"]);
 var TOP_LEVEL_ORDER = /* @__PURE__ */ new Map();
@@ -41234,6 +41291,10 @@ var COMMAND_OWNERSHIP = {
   read: { module_owner: "cli/src/app-read-broker.ts", consumer: "agent-workflow" },
   run: { module_owner: "cli/src/merge-group-orphans.ts", consumer: "agent-workflow" },
   // #9479
+  vars: { module_owner: "cli/src/devops-vars.ts", consumer: "agent-workflow" },
+  // #9780 repository Actions variables
+  repo: { module_owner: "cli/src/repo-archive-status.ts", consumer: "agent-workflow" },
+  // #9779 archive-status read
   ci: { module_owner: "cli/src/ci-audit.ts", consumer: "release-operator" },
   rcand: { module_owner: "cli/src/train-commands.ts", consumer: "release-operator" },
   release: { module_owner: "cli/src/train-commands.ts", consumer: "release-operator" },
@@ -44436,6 +44497,573 @@ function registerRunRerun(run, writeToken, projects) {
   });
 }
 
+// src/devops-vars.ts
+var import_node_crypto13 = require("node:crypto");
+init_github_client();
+init_cli_shared();
+var VARS_RECEIPT_SCHEMA = "mmi-cli.devops-vars/1";
+function parseVarsName(raw) {
+  const name = raw.trim();
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) || name.length > 256) {
+    throw new Error(`<name> must match [A-Za-z_][A-Za-z0-9_]* (\u2264256 chars) \u2014 received '${raw.slice(0, 64)}'`);
+  }
+  return name;
+}
+function parseVarsValue(raw) {
+  if (typeof raw !== "string") throw new Error(`--value must be a string \u2014 received ${raw === null ? "null" : typeof raw}; values are preserved exactly, never coerced`);
+  if (raw.length > 49152) throw new Error(`--value exceeds GitHub's 48KB variable size limit (${raw.length} chars)`);
+  return raw;
+}
+function resolveCanonicalRepo(raw, projects) {
+  if (!Array.isArray(projects)) return { kind: "unavailable" };
+  const input = raw.trim();
+  if (!/^[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_.-]+)?$/.test(input) || input.split("/").some((part) => part === "." || part === "..")) {
+    return { kind: "unregistered" };
+  }
+  const key = registryRepoKey(qualifyRegistryRepo(input));
+  const byKey = /* @__PURE__ */ new Map();
+  const aliasRepos = [];
+  const lower = input.toLowerCase();
+  for (const project2 of projects) {
+    if (!project2 || typeof project2 !== "object" || Array.isArray(project2)) continue;
+    if (!input.includes("/")) {
+      const alias = typeof project2.slug === "string" ? project2.slug : typeof project2.name === "string" ? project2.name : void 0;
+      if (typeof alias === "string" && alias.trim() !== "" && alias.toLowerCase() === lower && Array.isArray(project2.repos)) {
+        for (const r of project2.repos) if (typeof r === "string" && r.trim() !== "") aliasRepos.push(qualifyRegistryRepo(r.trim()));
+      }
+    }
+    if (!Array.isArray(project2.repos)) continue;
+    for (const r of project2.repos) {
+      if (typeof r !== "string" || r.trim() === "") continue;
+      const qualified = qualifyRegistryRepo(r.trim());
+      if (registryRepoKey(qualified) === key) byKey.set(key, byKey.get(key) ?? qualified);
+    }
+  }
+  const distinct = /* @__PURE__ */ new Map();
+  if (byKey.has(key)) distinct.set(key, byKey.get(key));
+  for (const r of aliasRepos) {
+    const rk = registryRepoKey(r);
+    if (!distinct.has(rk)) distinct.set(rk, r);
+  }
+  const hits = [...distinct.entries()];
+  if (hits.length === 1) {
+    const [hitKey, repo] = hits[0];
+    return { kind: "resolved", repo, via: hitKey === key ? "repo-name" : "project-alias" };
+  }
+  if (hits.length > 1) return { kind: "conflict", candidates: hits.map(([, repo]) => repo) };
+  return { kind: "unregistered" };
+}
+function classifyUpstreamError(e) {
+  if (e instanceof GitHubApiError) {
+    if (e.status === 404) return { status: 404, reason: "bare-404" };
+    if (e.status === 403 || e.status === 401) return { status: e.status, reason: "denied" };
+    return { status: e.status, reason: "transport-error" };
+  }
+  const name = e?.name ?? "";
+  if (name === "TimeoutError" || name === "AbortError" || /timeout|abort/i.test(String(e?.message ?? ""))) {
+    return { status: 0, reason: "timeout" };
+  }
+  return { status: 0, reason: "transport-error" };
+}
+async function call(deps, log, method, path2, body) {
+  try {
+    const res = await deps.transport.restWithStatus(method, path2, body !== void 0 ? { body } : void 0);
+    log.push({ method, path: path2, status: res.status });
+    return res;
+  } catch (e) {
+    log.push({ method, path: path2, status: classifyUpstreamError(e).status });
+    throw e;
+  }
+}
+function beginOp() {
+  return { startedAt: /* @__PURE__ */ new Date(), log: [] };
+}
+function receiptBase(deps, operation, repo, ctx, now) {
+  return {
+    schema: VARS_RECEIPT_SCHEMA,
+    operation,
+    repo,
+    window: { startedAt: ctx.startedAt.toISOString(), endedAt: now().toISOString(), atomicSnapshot: false },
+    actor: deps.actor ?? { credential: "app_installation" },
+    correlationId: (deps.correlationId ?? import_node_crypto13.randomUUID)(),
+    upstream: ctx.log
+  };
+}
+var VARS_PER_PAGE = 100;
+var VARS_MAX_PAGES = 100;
+function parseVariableEntry(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) throw new Error("variable entry is not an object");
+  const e = raw;
+  if (typeof e.name !== "string" || e.name === "") throw new Error("variable entry has no name");
+  if (e.value !== void 0 && typeof e.value !== "string") throw new Error(`variable '${e.name}' value is ${typeof e.value}, not a string \u2014 refusing to coerce`);
+  if (e.created_at !== void 0 && typeof e.created_at !== "string") throw new Error(`variable '${e.name}' created_at is not a string`);
+  if (e.updated_at !== void 0 && typeof e.updated_at !== "string") throw new Error(`variable '${e.name}' updated_at is not a string`);
+  return {
+    name: e.name,
+    ...e.value !== void 0 ? { value: e.value } : {},
+    ...e.created_at !== void 0 ? { createdAt: e.created_at } : {},
+    ...e.updated_at !== void 0 ? { updatedAt: e.updated_at } : {}
+  };
+}
+async function enumerateRepositoryVariables(deps, repo, log = []) {
+  const entries = [];
+  let total = -1;
+  for (let page = 1; page <= VARS_MAX_PAGES; page++) {
+    const { body } = await call(deps, log, "GET", `repos/${repo}/actions/variables?per_page=${VARS_PER_PAGE}&page=${page}`);
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+      return { complete: false, reason: "malformed-page", entries, pages: page, detail: `page ${page} body is not a JSON object` };
+    }
+    const envelope = body;
+    if (typeof envelope.total_count !== "number" || !Number.isInteger(envelope.total_count) || envelope.total_count < 0 || !Array.isArray(envelope.variables)) {
+      return { complete: false, reason: "malformed-page", entries, pages: page, detail: `page ${page} envelope has no integer total_count / variables array` };
+    }
+    if (total >= 0 && envelope.total_count !== total) {
+      return { complete: false, reason: "incomplete-pagination", entries, pages: page, detail: `total_count moved between pages (${total} \u2192 ${envelope.total_count}); the enumeration is not a snapshot` };
+    }
+    total = envelope.total_count;
+    try {
+      for (const raw of envelope.variables) entries.push(parseVariableEntry(raw));
+    } catch (e) {
+      return { complete: false, reason: "malformed-page", entries, pages: page, detail: `page ${page}: ${e.message}` };
+    }
+    const expectedPages = Math.max(1, Math.ceil(total / VARS_PER_PAGE));
+    if (expectedPages > VARS_MAX_PAGES) {
+      return { complete: false, reason: "page-bound-exceeded", entries, pages: page, detail: `total_count ${total} needs ${expectedPages} pages; the bounded read stops at ${VARS_MAX_PAGES}` };
+    }
+    if (page >= expectedPages) break;
+  }
+  if (entries.length !== total) {
+    return { complete: false, reason: "incomplete-pagination", entries, pages: Math.max(1, Math.ceil(total / VARS_PER_PAGE)), detail: `accumulated ${entries.length} entries but total_count is ${total}` };
+  }
+  return { complete: true, entries, totalVariables: total, pages: Math.max(1, Math.ceil(total / VARS_PER_PAGE)) };
+}
+function findEntry(entries, name) {
+  const lower = name.toLowerCase();
+  return entries.find((e) => e.name.toLowerCase() === lower);
+}
+async function readVariable(deps, repo, name, log) {
+  let body;
+  try {
+    ({ body } = await call(deps, log, "GET", `repos/${repo}/actions/variables/${name}`));
+  } catch (e) {
+    const { status, reason } = classifyUpstreamError(e);
+    if (reason === "denied") return { presence: "unknown", unknownReason: "denied", detail: `HTTP ${status}: the App installation cannot read repository variables`, capability: { permission: "variables:read", outcome: "denied" } };
+    if (reason !== "bare-404") return { presence: "unknown", unknownReason: reason, detail: String(e.message).slice(0, 200) };
+    try {
+      const en = await enumerateRepositoryVariables(deps, repo, log);
+      if (!en.complete) return { presence: "unknown", unknownReason: en.reason, detail: `bare 404 on GET, and the absence proof failed: ${en.detail}` };
+      const hit = findEntry(en.entries, name);
+      if (hit) return { presence: "present", value: hit.value, observed: { ...hit.createdAt ? { createdAt: hit.createdAt } : {}, ...hit.updatedAt ? { updatedAt: hit.updatedAt } : {}, source: "enumeration" } };
+      return { presence: "absent", absenceProof: { provenBy: "complete-enumeration", pages: en.pages, perPage: VARS_PER_PAGE, totalVariables: en.totalVariables, nameExcluded: true } };
+    } catch (proofError) {
+      const proof = classifyUpstreamError(proofError);
+      return { presence: "unknown", unknownReason: proof.reason === "bare-404" ? "transport-error" : proof.reason, detail: `bare 404 on GET, and the absence proof failed: ${String(proofError.message).slice(0, 160)}` };
+    }
+  }
+  try {
+    const entry = parseVariableEntry(body);
+    return { presence: "present", value: entry.value, observed: { ...entry.createdAt ? { createdAt: entry.createdAt } : {}, ...entry.updatedAt ? { updatedAt: entry.updatedAt } : {}, source: "get" } };
+  } catch (e) {
+    return { presence: "unknown", unknownReason: "parser-refused", detail: `HTTP 200 but the body could not be parsed as a variable: ${e.message}` };
+  }
+}
+async function getVariableReceipt(deps, repo, name) {
+  const ctx = beginOp();
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  const read = await readVariable(deps, repo, name, ctx.log);
+  return {
+    ...receiptBase(deps, "get", repo, ctx, now),
+    name,
+    presence: read.presence,
+    ...read.value !== void 0 ? { value: read.value } : {},
+    ...read.observed ? { observed: read.observed } : {},
+    ...read.absenceProof ? { absenceProof: read.absenceProof } : {},
+    ...read.unknownReason ? { unknownReason: read.unknownReason } : {},
+    ...read.capability ? { capability: read.capability } : {}
+  };
+}
+async function listVariablesReceipt(deps, repo) {
+  const ctx = beginOp();
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  try {
+    const en = await enumerateRepositoryVariables(deps, repo, ctx.log);
+    if (en.complete) {
+      return {
+        ...receiptBase(deps, "list", repo, ctx, now),
+        pagination: { pages: en.pages, perPage: VARS_PER_PAGE, complete: true, totalVariables: en.totalVariables },
+        variables: en.entries.map(({ name, createdAt, updatedAt }) => ({ name, ...createdAt ? { createdAt } : {}, ...updatedAt ? { updatedAt } : {} }))
+      };
+    }
+    return {
+      ...receiptBase(deps, "list", repo, ctx, now),
+      pagination: { pages: en.pages, perPage: VARS_PER_PAGE, complete: false, reason: en.reason, detail: en.detail },
+      variables: en.entries.map(({ name, createdAt, updatedAt }) => ({ name, ...createdAt ? { createdAt } : {}, ...updatedAt ? { updatedAt } : {} })),
+      unknownReason: en.reason
+    };
+  } catch (e) {
+    const { status, reason } = classifyUpstreamError(e);
+    return {
+      ...receiptBase(deps, "list", repo, ctx, now),
+      pagination: { pages: 0, perPage: VARS_PER_PAGE, complete: false, reason },
+      variables: [],
+      unknownReason: reason,
+      ...reason === "denied" ? { capability: { permission: "variables:read", outcome: "denied" }, pagination: { pages: 0, perPage: VARS_PER_PAGE, complete: false, reason, detail: `HTTP ${status}: the App installation cannot list repository variables` } } : {}
+    };
+  }
+}
+async function readBaseline(deps, repo, name, log) {
+  const read = await readVariable(deps, repo, name, log);
+  if (read.presence === "present") return { presence: "present", value: read.value };
+  if (read.presence === "absent") return { presence: "absent" };
+  return { presence: "unknown", unknownReason: read.unknownReason, ...read.capability ? { capability: read.capability } : {} };
+}
+function rejectedWrite(base, baseline, reason, capability) {
+  return {
+    ...base,
+    outcome: "rejected",
+    casLimitation: "no-atomic-compare-and-swap",
+    baseline: { presence: "present", value: baseline.value, source: "get" },
+    reason,
+    ...capability ? { capability } : {}
+  };
+}
+function unknownWrite(base, baseline, reason, readback) {
+  return {
+    ...base,
+    outcome: "outcome-unknown",
+    casLimitation: "no-atomic-compare-and-swap",
+    baseline: baseline.presence === "present" ? { presence: "present", value: baseline.value, source: "get" } : baseline,
+    ...readback ? { readback } : {},
+    reason
+  };
+}
+async function createVariableReceipt(deps, repo, name, value) {
+  const ctx = beginOp();
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  let en;
+  try {
+    en = await enumerateRepositoryVariables(deps, repo, ctx.log);
+  } catch (e) {
+    const { status, reason } = classifyUpstreamError(e);
+    return {
+      ...receiptBase(deps, "create", repo, ctx, now),
+      operation: "create",
+      name,
+      outcome: "not-dispatched",
+      casLimitation: "no-atomic-compare-and-swap",
+      baseline: { presence: "unknown", source: "complete-enumeration" },
+      reason: `no observed absent baseline: ${reason === "denied" ? `HTTP ${status}: the App installation cannot list repository variables` : String(e.message).slice(0, 160)}`,
+      ...reason === "denied" ? { capability: { permission: "variables:read", outcome: "denied" } } : {}
+    };
+  }
+  const base = { ...receiptBase(deps, "create", repo, ctx, now), operation: "create", name, casLimitation: "no-atomic-compare-and-swap" };
+  if (!en.complete) {
+    return { ...base, outcome: "not-dispatched", baseline: { presence: "unknown", source: "complete-enumeration" }, reason: `no observed absent baseline: ${en.reason} (${en.detail})` };
+  }
+  const existing = findEntry(en.entries, name);
+  if (existing) {
+    return { ...base, outcome: "not-dispatched", baseline: { presence: "present", ...existing.value !== void 0 ? { value: existing.value } : {}, source: "complete-enumeration" }, reason: "variable already present \u2014 create only dispatches against an observed absent baseline (use update)" };
+  }
+  try {
+    await call(deps, ctx.log, "POST", `repos/${repo}/actions/variables`, { name, value });
+  } catch (e) {
+    const { status, reason } = classifyUpstreamError(e);
+    const absentBaseline = { presence: "absent", source: "complete-enumeration" };
+    if (reason === "denied") return { ...base, outcome: "rejected", baseline: absentBaseline, reason: `HTTP ${status}: the App installation lacks repository Variables write`, capability: { permission: "variables:write", outcome: "denied" } };
+    if (status === 404) return { ...base, outcome: "rejected", baseline: absentBaseline, reason: "HTTP 404: repository missing or not visible to the installation" };
+    if (status === 409 || status === 422) return { ...base, outcome: "rejected", baseline: absentBaseline, reason: `HTTP ${status}: ${String(e.message).slice(0, 160)}` };
+    return unknownWrite({ ...base, schema: VARS_RECEIPT_SCHEMA, operation: "create", repo }, { presence: "absent", source: "complete-enumeration" }, `${reason === "timeout" ? "dispatch timed out" : `HTTP ${status || "no response"}`}; the create MAY have applied \u2014 reconcile read-only, never replay`);
+  }
+  const rb = await readVariable(deps, repo, name, ctx.log);
+  if (rb.presence === "present") {
+    if (rb.value === value) {
+      return { ...base, outcome: "verified", baseline: { presence: "absent", source: "complete-enumeration" }, readback: { presence: "present", value: rb.value } };
+    }
+    return unknownWrite(base, { presence: "absent", source: "complete-enumeration" }, "read-back shows a different value than dispatched \u2014 a concurrent outside write is possible; reconcile read-only", { presence: "present", value: rb.value });
+  }
+  if (rb.presence === "absent") {
+    return unknownWrite(base, { presence: "absent", source: "complete-enumeration" }, "accepted but the read-back proves absence \u2014 reconcile read-only before any retry", { presence: "absent" });
+  }
+  return {
+    ...base,
+    outcome: "accepted-but-unverified",
+    baseline: { presence: "absent", source: "complete-enumeration" },
+    readback: { presence: "unknown" },
+    reason: `create accepted but the read-back could not verify: ${rb.unknownReason ?? "unknown"}`
+  };
+}
+async function updateVariableReceipt(deps, repo, name, value) {
+  const ctx = beginOp();
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  const base = { ...receiptBase(deps, "update", repo, ctx, now), operation: "update", name, casLimitation: "no-atomic-compare-and-swap" };
+  const baseline = await readBaseline(deps, repo, name, ctx.log);
+  if (baseline.presence !== "present") {
+    return {
+      ...base,
+      outcome: "not-dispatched",
+      baseline: { presence: baseline.presence, ...baseline.value !== void 0 ? { value: baseline.value } : {}, source: "get" },
+      reason: baseline.presence === "absent" ? "no present baseline \u2014 the enumeration proved absence (use create)" : `no retained present baseline (${baseline.unknownReason ?? "unknown"}); a bare 404 is never a present baseline`,
+      ...baseline.capability ? { capability: baseline.capability } : {}
+    };
+  }
+  const live = await readVariable(deps, repo, name, ctx.log);
+  if (live.presence !== "present" || live.value !== baseline.value) {
+    return {
+      ...base,
+      outcome: "not-dispatched",
+      baseline: { presence: "present", value: baseline.value, source: "get" },
+      ...live.presence === "present" ? { readback: { presence: "present", value: live.value } } : {},
+      reason: live.presence === "present" ? "concurrent change: the live value no longer matches the retained baseline \u2014 stopped for reconciliation" : `baseline unconfirmed before dispatch (${live.unknownReason ?? "unknown"}) \u2014 stopped`
+    };
+  }
+  try {
+    await call(deps, ctx.log, "PATCH", `repos/${repo}/actions/variables/${name}`, { value });
+  } catch (e) {
+    const { status, reason } = classifyUpstreamError(e);
+    if (reason === "denied") return rejectedWrite(base, { presence: "present", value: baseline.value }, `HTTP ${status}: the App installation lacks repository Variables write`, { permission: "variables:write", outcome: "denied" });
+    if (status === 404) return rejectedWrite(base, { presence: "present", value: baseline.value }, "HTTP 404 at write: the variable vanished after the baseline check (concurrent deletion suspected) \u2014 reconcile read-only, never create");
+    if (status === 409 || status === 422) return rejectedWrite(base, { presence: "present", value: baseline.value }, `HTTP ${status}: ${String(e.message).slice(0, 160)}`);
+    return unknownWrite(base, { presence: "present", value: baseline.value }, `${reason === "timeout" ? "dispatch timed out" : `HTTP ${status || "no response"}`}; the update MAY have applied \u2014 reconcile read-only, never replay`);
+  }
+  const rb = await readVariable(deps, repo, name, ctx.log);
+  if (rb.presence === "present") {
+    if (rb.value === value) return { ...base, outcome: "verified", baseline: { presence: "present", value: baseline.value, source: "get" }, readback: { presence: "present", value: rb.value } };
+    return unknownWrite(base, { presence: "present", value: baseline.value }, "read-back shows a different value than dispatched \u2014 a concurrent outside write is possible; reconcile read-only", { presence: "present", value: rb.value });
+  }
+  if (rb.presence === "absent") {
+    return unknownWrite(base, { presence: "present", value: baseline.value }, "accepted but the read-back proves absence \u2014 reconcile read-only before any retry", { presence: "absent" });
+  }
+  return {
+    ...base,
+    outcome: "accepted-but-unverified",
+    baseline: { presence: "present", value: baseline.value, source: "get" },
+    readback: { presence: "unknown" },
+    reason: `update accepted but the read-back could not verify: ${rb.unknownReason ?? "unknown"}`
+  };
+}
+async function deleteVariableReceipt(deps, repo, name) {
+  const ctx = beginOp();
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  const base = { ...receiptBase(deps, "delete", repo, ctx, now), operation: "delete", name, casLimitation: "no-atomic-compare-and-swap" };
+  const baseline = await readBaseline(deps, repo, name, ctx.log);
+  if (baseline.presence !== "present") {
+    return {
+      ...base,
+      outcome: "not-dispatched",
+      baseline: { presence: baseline.presence, ...baseline.value !== void 0 ? { value: baseline.value } : {}, source: "get" },
+      reason: baseline.presence === "absent" ? "no present baseline \u2014 the enumeration already proves absence; nothing to delete" : `no retained present baseline (${baseline.unknownReason ?? "unknown"}); a bare 404 never authorizes a delete`,
+      ...baseline.capability ? { capability: baseline.capability } : {}
+    };
+  }
+  const live = await readVariable(deps, repo, name, ctx.log);
+  if (live.presence !== "present" || live.value !== baseline.value) {
+    return {
+      ...base,
+      outcome: "not-dispatched",
+      baseline: { presence: "present", value: baseline.value, source: "get" },
+      ...live.presence === "present" ? { readback: { presence: "present", value: live.value } } : {},
+      reason: live.presence === "present" ? "concurrent change: the live value no longer matches the retained baseline \u2014 stopped for reconciliation" : `baseline unconfirmed before dispatch (${live.unknownReason ?? "unknown"}) \u2014 stopped`
+    };
+  }
+  try {
+    await call(deps, ctx.log, "DELETE", `repos/${repo}/actions/variables/${name}`);
+  } catch (e) {
+    const { status, reason } = classifyUpstreamError(e);
+    if (reason === "denied") return rejectedWrite(base, { presence: "present", value: baseline.value }, `HTTP ${status}: the App installation lacks repository Variables write`, { permission: "variables:write", outcome: "denied" });
+    if (status === 404) return rejectedWrite(base, { presence: "present", value: baseline.value }, "HTTP 404 at write: the variable vanished after the baseline check (concurrent deletion suspected) \u2014 reconcile read-only");
+    if (status === 409 || status === 422) return rejectedWrite(base, { presence: "present", value: baseline.value }, `HTTP ${status}: ${String(e.message).slice(0, 160)}`);
+    return unknownWrite(base, { presence: "present", value: baseline.value }, `${reason === "timeout" ? "dispatch timed out" : `HTTP ${status || "no response"}`}; the delete MAY have applied \u2014 reconcile read-only, never replay`);
+  }
+  try {
+    const en = await enumerateRepositoryVariables(deps, repo);
+    if (en.complete && !findEntry(en.entries, name)) {
+      return { ...base, outcome: "verified", baseline: { presence: "present", value: baseline.value, source: "get" }, readback: { presence: "absent" }, reason: `absence proven by complete enumeration (${en.pages} page(s), ${en.totalVariables} variable(s), name excluded)` };
+    }
+    if (en.complete) {
+      const still = findEntry(en.entries, name);
+      return unknownWrite(base, { presence: "present", value: baseline.value }, "delete accepted but the variable is still enumerated \u2014 reconcile read-only, never replay", { presence: "present", ...still.value !== void 0 ? { value: still.value } : {} });
+    }
+    return {
+      ...base,
+      outcome: "accepted-but-unverified",
+      baseline: { presence: "present", value: baseline.value, source: "get" },
+      reason: `delete accepted but absence is unproven: ${en.reason} (${en.detail})`
+    };
+  } catch (e) {
+    return {
+      ...base,
+      outcome: "accepted-but-unverified",
+      baseline: { presence: "present", value: baseline.value, source: "get" },
+      reason: `delete accepted but absence is unproven (${classifyUpstreamError(e).reason}): ${String(e.message).slice(0, 160)}`
+    };
+  }
+}
+var VARS_HELP_AFTER = [
+  "",
+  "Presence semantics (#9780): present | absent | unknown. A bare 404 is UNKNOWN, never absence \u2014",
+  "absence is claimed only from a complete bounded enumeration excluding the exact name, with",
+  "pagination evidence. Truncated pagination, malformed pages, denial, parser refusal or timeout is",
+  "unknown. Values are preserved exactly (including `off`) and never coerced.",
+  "Mutations verify by read-back (delete: complete enumeration) \u2014 an HTTP success alone is never",
+  "verified; an ambiguous result is reported unknown and reconciled READ-ONLY, never replayed.",
+  "The pre-write check is NOT atomic compare-and-swap: a concurrent outside write between the check",
+  "and the dispatch is not prevented. Repository scope only \u2014 no organization/environment scope, no",
+  "secret store, no rename, no workflow dispatch, no credential fallback."
+].join("\n");
+function resolveRepoOrFail(raw, projects, verb) {
+  const resolution = resolveCanonicalRepo(raw, projects);
+  if (resolution.kind === "resolved") return resolution.repo;
+  if (resolution.kind === "conflict") return fail(`vars ${verb}: '${raw}' resolves to MULTIPLE registered repositories (${resolution.candidates.join(", ")}) \u2014 pass the exact owner/repo; ambiguous aliases are refused (#9780)`);
+  if (resolution.kind === "unavailable") return fail(`vars ${verb}: the Hub project registry is unreadable; refusing to address a repo this command cannot prove registered`);
+  return fail(`vars ${verb}: '${raw}' is not a registered repository in the Hub registry; App variables access is limited to registered repos \u2014 pass the exact owner/repo`);
+}
+function registerDevopsVarsCommands(program3, deps) {
+  const vars = program3.command("vars").description("repository Actions variables \u2014 typed get/list/create/update/delete on the org App (Variables read/write), Hub-registered repos only (#9780)");
+  const runRead = async (commandPath4, verb, repoArg, name, o) => {
+    const projects = await deps.projects();
+    const repo = resolveRepoOrFail(repoArg, projects, verb);
+    const ops = { transport: await deps.appClient(commandPath4), ...deps.actor ? { actor: deps.actor() } : {} };
+    const receipt = verb === "get" && name !== void 0 ? await getVariableReceipt(ops, repo, name) : await listVariablesReceipt(ops, repo);
+    if (o.json) console.log(JSON.stringify(receipt, null, 2));
+    else printReadText(receipt);
+    const failed2 = receipt.operation === "get" ? receipt.presence === "unknown" : !receipt.pagination.complete;
+    if (failed2) process.exitCode = 1;
+  };
+  const runMutation = async (commandPath4, verb, nameArg, value, repoArg, o) => {
+    let name;
+    let exactValue;
+    try {
+      name = parseVarsName(nameArg);
+      if (verb !== "delete") exactValue = parseVarsValue(value);
+    } catch (e) {
+      return fail(`vars ${verb}: ${e.message}`);
+    }
+    const projects = await deps.projects();
+    const repo = resolveRepoOrFail(repoArg, projects, verb);
+    const ops = { transport: await deps.appClient(commandPath4), ...deps.actor ? { actor: deps.actor() } : {} };
+    const receipt = verb === "create" ? await createVariableReceipt(ops, repo, name, exactValue) : verb === "update" ? await updateVariableReceipt(ops, repo, name, exactValue) : await deleteVariableReceipt(ops, repo, name);
+    if (o.json) console.log(JSON.stringify(receipt, null, 2));
+    else printMutationText(receipt);
+    if (receipt.outcome !== "verified") process.exitCode = 1;
+  };
+  vars.command("get <name>").description("exact variable baseline or typed observed absence/unknown \u2014 a bare 404 is unknown; absence needs a complete enumeration (#9780)").requiredOption("--repo <owner/repo>", "registered repository (owner/repo, repo name, or one unambiguous project alias)").option("--json", "machine-readable receipt").addHelpText("after", VARS_HELP_AFTER).action(async (name, o) => runRead("vars get", "get", o.repo ?? "", name, o));
+  vars.command("list").description("exhaustive bounded enumeration: names + provider timestamps only (never values), with pagination/completeness evidence (#9780)").requiredOption("--repo <owner/repo>", "registered repository (owner/repo, repo name, or one unambiguous project alias)").option("--json", "machine-readable receipt").addHelpText("after", VARS_HELP_AFTER).action(async (o) => runRead("vars list", "list", o.repo ?? "", void 0, o));
+  vars.command("create <name>").description("create ONLY against an observed absent baseline (complete enumeration); value preserved exactly; verified by read-back (#9780)").requiredOption("--value <value>", "exact string value (never coerced; e.g. the literal `off`)").requiredOption("--repo <owner/repo>", "registered repository (owner/repo, repo name, or one unambiguous project alias)").option("--json", "machine-readable receipt").addHelpText("after", VARS_HELP_AFTER).action(async (name, o) => runMutation("vars create", "create", name, o.value, o.repo ?? "", o));
+  vars.command("update <name>").description("replace ONLY against a retained present baseline, re-checked just before dispatch; concurrent changes stop the write (#9780)").requiredOption("--value <value>", "exact string value (never coerced)").requiredOption("--repo <owner/repo>", "registered repository (owner/repo, repo name, or one unambiguous project alias)").option("--json", "machine-readable receipt").addHelpText("after", VARS_HELP_AFTER).action(async (name, o) => runMutation("vars update", "update", name, o.value, o.repo ?? "", o));
+  vars.command("delete <name>").description("delete ONLY against a retained present baseline; absence proven afterwards by a complete enumeration (#9780)").requiredOption("--repo <owner/repo>", "registered repository (owner/repo, repo name, or one unambiguous project alias)").option("--json", "machine-readable receipt").addHelpText("after", VARS_HELP_AFTER).action(async (name, o) => runMutation("vars delete", "delete", name, void 0, o.repo ?? "", o));
+}
+function printReadText(receipt) {
+  if (receipt.operation === "get") {
+    if (receipt.presence === "present") {
+      console.log(`vars get: ${receipt.repo} ${receipt.name} = ${JSON.stringify(receipt.value ?? "")} (presence: present, source: ${receipt.observed?.source ?? "get"})`);
+    } else if (receipt.presence === "absent") {
+      const p = receipt.absenceProof;
+      console.log(`vars get: ${receipt.repo} ${receipt.name} absent \u2014 proven by complete enumeration (${p.pages} page(s), ${p.totalVariables} variable(s), name excluded)`);
+    } else {
+      console.log(`vars get: ${receipt.repo} ${receipt.name} presence UNKNOWN (${receipt.unknownReason}${receipt.capability ? ", capability denied" : ""}) \u2014 absence is never claimed from this read`);
+    }
+    return;
+  }
+  if (receipt.pagination.complete) {
+    console.log(`vars list: ${receipt.repo} \u2014 ${receipt.pagination.totalVariables} variable(s), complete (${receipt.pagination.pages} page(s)): ${receipt.variables.map((v) => v.name).join(", ") || "(none)"}`);
+  } else {
+    console.log(`vars list: ${receipt.repo} \u2014 INCOMPLETE enumeration (${receipt.pagination.reason ?? "unknown"}); the names below are NOT the full set: ${receipt.variables.map((v) => v.name).join(", ") || "(none)"}`);
+  }
+}
+function printMutationText(receipt) {
+  const baseline = receipt.baseline.presence === "present" ? `baseline ${JSON.stringify(receipt.baseline.value ?? "")}` : `baseline ${receipt.baseline.presence}`;
+  const readback = receipt.readback ? `, read-back ${receipt.readback.presence}${receipt.readback.value !== void 0 ? ` ${JSON.stringify(receipt.readback.value)}` : ""}` : "";
+  console.log(`vars ${receipt.operation}: ${receipt.repo} ${receipt.name} \u2014 ${receipt.outcome} (${baseline}${readback})${receipt.reason ? ` \u2014 ${receipt.reason}` : ""} [no atomic compare-and-swap; writes are never replayed]`);
+}
+
+// src/repo-archive-status.ts
+var import_node_crypto14 = require("node:crypto");
+init_github_client();
+init_cli_shared();
+var ARCHIVE_STATUS_RECEIPT_SCHEMA = "mmi-cli.repo-archive-status/1";
+var ARCHIVE_SOURCE_TIME_NOTE = "GitHub exposes no archived_at; observedAt is this read's window end and the provider timestamps are the repository's own updated_at/pushed_at from the same response that carried the archived flag";
+async function call2(deps, log, method, path2) {
+  try {
+    const res = await deps.transport.restWithStatus(method, path2);
+    log.push({ method, path: path2, status: res.status });
+    return res;
+  } catch (e) {
+    const status = e instanceof GitHubApiError ? e.status : 0;
+    log.push({ method, path: path2, status });
+    throw e;
+  }
+}
+function classify2(e) {
+  if (e instanceof GitHubApiError) {
+    if (e.status === 404) return { status: 404, reason: "missing-or-invisible" };
+    if (e.status === 403 || e.status === 401) return { status: e.status, reason: "denied" };
+    return { status: e.status, reason: "transport-error" };
+  }
+  const name = e?.name ?? "";
+  if (name === "TimeoutError" || name === "AbortError" || /timeout|abort/i.test(String(e?.message ?? ""))) return { status: 0, reason: "timeout" };
+  return { status: 0, reason: "transport-error" };
+}
+async function readArchiveStatusReceipt(deps, repo) {
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  const startedAt = now();
+  const log = [];
+  const base = {
+    schema: ARCHIVE_STATUS_RECEIPT_SCHEMA,
+    repo,
+    sourceTime: { observedAt: "", note: ARCHIVE_SOURCE_TIME_NOTE },
+    window: { startedAt: startedAt.toISOString(), endedAt: "", atomicSnapshot: false },
+    actor: deps.actor ?? { credential: "app_installation" },
+    correlationId: (deps.correlationId ?? import_node_crypto14.randomUUID)(),
+    upstream: log
+  };
+  try {
+    const { body } = await call2(deps, log, "GET", `repos/${repo}`);
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+      return { ...base, archived: "unknown", unknownReason: "parser-refused", sourceTime: { ...base.sourceTime, observedAt: now().toISOString() }, window: { ...base.window, endedAt: now().toISOString() } };
+    }
+    const payload = body;
+    if (typeof payload.archived !== "boolean") {
+      return { ...base, archived: "unknown", unknownReason: "parser-refused", sourceTime: { ...base.sourceTime, observedAt: now().toISOString() }, window: { ...base.window, endedAt: now().toISOString() } };
+    }
+    if (payload.updated_at !== void 0 && typeof payload.updated_at !== "string") payload.updated_at = void 0;
+    if (payload.pushed_at !== void 0 && typeof payload.pushed_at !== "string") payload.pushed_at = void 0;
+    return {
+      ...base,
+      archived: payload.archived,
+      sourceTime: {
+        observedAt: now().toISOString(),
+        ...typeof payload.updated_at === "string" ? { providerUpdatedAt: payload.updated_at } : {},
+        ...typeof payload.pushed_at === "string" ? { providerPushedAt: payload.pushed_at } : {},
+        note: ARCHIVE_SOURCE_TIME_NOTE
+      },
+      window: { ...base.window, endedAt: now().toISOString() }
+    };
+  } catch (e) {
+    const { status, reason } = classify2(e);
+    return {
+      ...base,
+      archived: "unknown",
+      unknownReason: reason,
+      ...reason === "denied" ? { capability: { permission: "metadata:read", outcome: "denied" } } : {},
+      ...reason === "missing-or-invisible" ? { sourceTime: { ...base.sourceTime, observedAt: now().toISOString(), note: `${ARCHIVE_SOURCE_TIME_NOTE} \u2014 HTTP 404: the repository is missing or not visible to the installation, which is NOT archived:false` } } : { sourceTime: { ...base.sourceTime, observedAt: now().toISOString() } },
+      window: { ...base.window, endedAt: now().toISOString() }
+    };
+  }
+}
+function registerRepoArchiveStatusCommand(program3, deps) {
+  const repoRoot2 = program3.command("repo").description("canonical repository typed reads \u2014 archive status (#9779)");
+  repoRoot2.command("archive-status").description("typed archived-state read for one canonical repository: archived + source time, App metadata:read; a 404 is missing-or-invisible, never archived:false (#9779)").requiredOption("--repo <owner/repo>", "registered repository (owner/repo, repo name, or one unambiguous project alias)").option("--json", "machine-readable receipt").action(async (o) => {
+    const projects = await deps.projects();
+    const resolution = resolveCanonicalRepo(o.repo ?? "", projects);
+    const repo = resolution.kind === "resolved" ? resolution.repo : resolution.kind === "conflict" ? fail(`repo archive-status: '${o.repo ?? ""}' resolves to MULTIPLE registered repositories (${resolution.candidates.join(", ")}) \u2014 pass the exact owner/repo (#9779)`) : resolution.kind === "unavailable" ? fail("repo archive-status: the Hub project registry is unreadable; refusing to address a repo this command cannot prove registered") : fail(`repo archive-status: '${o.repo ?? ""}' is not a registered repository in the Hub registry \u2014 pass the exact owner/repo`);
+    const receipt = await readArchiveStatusReceipt({ transport: await deps.appClient("repo archive-status"), ...deps.actor ? { actor: deps.actor() } : {} }, repo);
+    if (o.json) console.log(JSON.stringify(receipt, null, 2));
+    else if (receipt.archived === "unknown") console.log(`repo archive-status: ${receipt.repo} \u2014 archived state UNKNOWN (${receipt.unknownReason}) \u2014 never reads as not-archived`);
+    else console.log(`repo archive-status: ${receipt.repo} \u2014 archived: ${receipt.archived} (observed ${receipt.sourceTime.observedAt}${receipt.sourceTime.providerUpdatedAt ? `, provider updated_at ${receipt.sourceTime.providerUpdatedAt}` : ""})`);
+    if (receipt.archived === "unknown") process.exitCode = 1;
+  });
+}
+
 // src/board-commands.ts
 init_cli_shared();
 
@@ -45384,7 +46012,7 @@ var import_node_os20 = require("node:os");
 var import_node_path34 = require("node:path");
 
 // src/box-control.ts
-var import_node_crypto13 = require("node:crypto");
+var import_node_crypto15 = require("node:crypto");
 var MANIFEST_PATH = "infra/box-control/manifest.json";
 var ALLOWED_POST = /* @__PURE__ */ new Set(["systemctl daemon-reload"]);
 var sshdPost = (dest) => `if sshd -t; then systemctl reload ssh; else rm -f ${dest}; echo 'sshd -t rejected ${dest}: removed, not reloaded' >&2; exit 1; fi`;
@@ -45488,7 +46116,7 @@ function laneCoverageAction(files, box, op) {
   return { notice: `LANE_COVERAGE: ${mismatch}` };
 }
 function md5(content) {
-  return (0, import_node_crypto13.createHash)("md5").update(content).digest("hex");
+  return (0, import_node_crypto15.createHash)("md5").update(content).digest("hex");
 }
 function planRemoteScript(dests) {
   const lines2 = ["set -u"];
@@ -47646,7 +48274,7 @@ function renderDeployPortDoctor(report) {
 }
 
 // src/bootstrap-drift.ts
-var import_node_crypto14 = require("node:crypto");
+var import_node_crypto16 = require("node:crypto");
 function byteComparableSeeds(manifest, cls) {
   return manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self" && s.classes.includes(cls));
 }
@@ -47666,7 +48294,7 @@ function compareSeedBytes(hubContent, repoContent) {
   return normalize(hubContent) === normalize(repoContent) ? "match" : "drift";
 }
 function seedContentHash(content) {
-  return (0, import_node_crypto14.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
+  return (0, import_node_crypto16.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
 }
 function auditRepoSeedDrift(repo, seeds, hubContents, repoReads) {
   const byTarget = new Map(repoReads.map((r) => [r.target, r.content]));
@@ -48916,7 +49544,7 @@ function renderBootstrapVerifyReport(report) {
 }
 
 // src/bootstrap-seed-delivery.ts
-var import_node_crypto15 = require("node:crypto");
+var import_node_crypto17 = require("node:crypto");
 init_github_client();
 var SHA = /^[a-f0-9]{40}$/;
 async function readSeedFile(repo, target, ref, client) {
@@ -48949,7 +49577,7 @@ async function targetedSeedPlan(repo, slug, target, baseBranch, sourceSha, clien
   }
   const baseSha = base?.object?.sha;
   if (!baseSha || !SHA.test(baseSha) || !SHA.test(sourceSha)) throw new Error("bootstrap apply: seed identity is unreadable");
-  const identity = (0, import_node_crypto15.createHash)("sha256").update(JSON.stringify([repo.toLowerCase(), target, baseSha, sourceSha])).digest("hex").slice(0, 24);
+  const identity = (0, import_node_crypto17.createHash)("sha256").update(JSON.stringify([repo.toLowerCase(), target, baseSha, sourceSha])).digest("hex").slice(0, 24);
   const delivery = planSeedDelivery(rules, slug, baseBranch, `bootstrap-seed-${identity}`);
   const scoped = forcePr && delivery.mode === "direct" ? { mode: "pr", ref: `bootstrap-seed-${identity}-${slug}`, branch: `bootstrap-seed-${identity}-${slug}`, reason: "registry gate render requires review" } : delivery;
   return { ...scoped, baseSha, baseBranch };
@@ -50834,7 +51462,7 @@ init_github_client();
 init_cli_shared();
 
 // src/suite-status.ts
-var import_node_crypto16 = require("node:crypto");
+var import_node_crypto18 = require("node:crypto");
 var SUITE_REPO = "mutmutco/MM-Work";
 var REPOS = {
   "mmi-scout": "mutmutco/MMI-Scout",
@@ -50862,7 +51490,7 @@ function parseSuiteMapping(body) {
     return void 0;
   }
 }
-var sha256 = (b) => (0, import_node_crypto16.createHash)("sha256").update(b).digest("hex");
+var sha256 = (b) => (0, import_node_crypto18.createHash)("sha256").update(b).digest("hex");
 async function proveBundle(url, tag, fetchUrl) {
   const get = async (u) => {
     try {
@@ -51119,7 +51747,7 @@ async function waitSuiteDev(deps, opts) {
 // src/suite-train.ts
 var import_node_fs39 = require("node:fs");
 var import_node_path36 = require("node:path");
-var import_node_crypto17 = require("node:crypto");
+var import_node_crypto19 = require("node:crypto");
 
 // src/kit-version.ts
 var parse = (v) => /^(\d+)\.(\d+)\.(\d+)(-.+)?$/.exec(typeof v === "string" ? v.trim() : "");
@@ -51221,7 +51849,7 @@ function readSuiteCut(path2) {
 }
 function writeSuiteCut(path2, record2) {
   (0, import_node_fs39.mkdirSync)((0, import_node_path36.dirname)(path2), { recursive: true });
-  const temp = `${path2}.${(0, import_node_crypto17.randomBytes)(8).toString("hex")}.tmp`;
+  const temp = `${path2}.${(0, import_node_crypto19.randomBytes)(8).toString("hex")}.tmp`;
   try {
     (0, import_node_fs39.writeFileSync)(temp, JSON.stringify(record2, null, 2), { flag: "wx" });
     (0, import_node_fs39.renameSync)(temp, path2);
@@ -53702,16 +54330,16 @@ async function ghWithAppOn401(label, args, options) {
 }
 function withAppOn401(client, label = "post-merge") {
   let app;
-  const run = async (call) => {
+  const run = async (call3) => {
     try {
-      return await call(app ?? client);
+      return await call3(app ?? client);
     } catch (e) {
       if (!isUnauthorized(e)) throw e;
       if (app) throw new PostMergeCredentialError(label, "still HTTP 401 with the App installation token (expired or revoked App credential)");
       const token = await appTokenFor(label, e);
       app = createGitHubClient({ token: async () => token });
       try {
-        return await call(app);
+        return await call3(app);
       } catch (e2) {
         if (isUnauthorized(e2)) throw new PostMergeCredentialError(label, "still HTTP 401 with the App installation token (expired or revoked App credential)");
         throw e2;
@@ -54322,7 +54950,7 @@ async function deleteMergedRemoteBranch(options) {
 init_github_client();
 
 // src/release-custody.ts
-var import_node_crypto18 = require("node:crypto");
+var import_node_crypto20 = require("node:crypto");
 var import_node_fs41 = require("node:fs");
 var import_node_path38 = require("node:path");
 init_github_client();
@@ -54545,7 +55173,7 @@ var ReleaseCustodyError = class extends Error {
     this.name = "ReleaseCustodyError";
   }
 };
-var custodyDigest = (value) => (0, import_node_crypto18.createHash)("sha256").update(value).digest("hex");
+var custodyDigest = (value) => (0, import_node_crypto20.createHash)("sha256").update(value).digest("hex");
 function parseCustody(raw, repo) {
   const s = JSON.parse(raw);
   if (s.schema !== "mmi-release-custody/v1" || s.repo !== repo || !s.precutId || !Number.isSafeInteger(s.revision) || s.revision < 1 || !s.controller || !Number.isSafeInteger(s.controller.runId) || s.controller.runId <= 0 || !Number.isSafeInteger(s.controller.runAttempt) || s.controller.runAttempt <= 0 || !s.controller.token || !(s.ledger === null || typeof s.ledger === "string") || !s.archives || !s.effects) {
@@ -54633,7 +55261,7 @@ var ReleaseCustodySession = class _ReleaseCustodySession {
       throw new ReleaseCustodyError(`previous controller run ${found.state.controller.runId} attempt ${found.state.controller.runAttempt} is not proven terminal`);
     }
     let state = {
-      ...found.state ?? { schema: "mmi-release-custody/v1", repo, precutId: (0, import_node_crypto18.randomUUID)(), effects: {}, ...await initialize() },
+      ...found.state ?? { schema: "mmi-release-custody/v1", repo, precutId: (0, import_node_crypto20.randomUUID)(), effects: {}, ...await initialize() },
       revision: (found.state?.revision ?? 0) + 1,
       controller
     };
@@ -54694,7 +55322,7 @@ var ReleaseCustodySession = class _ReleaseCustodySession {
           proof: { kind: "ledger-lifecycle", controller: state.controller }
         };
       }
-      return { ...state, ledger: raw, archives, precutId: state.ledger && !raw ? (0, import_node_crypto18.randomUUID)() : state.precutId };
+      return { ...state, ledger: raw, archives, precutId: state.ledger && !raw ? (0, import_node_crypto20.randomUUID)() : state.precutId };
     });
   }
   async preserveLocal(raw) {
@@ -54920,7 +55548,7 @@ function withHubReleaseCustody(deps) {
         if (!authority.ok || !authority.train || authority.authenticatedDelegation !== true) {
           throw new ReleaseCustodyError("repository custody requires the server-verified owner-triggered train session");
         }
-        const controller = { ...runIdentity, token: (0, import_node_crypto18.randomUUID)() };
+        const controller = { ...runIdentity, token: (0, import_node_crypto20.randomUUID)() };
         const raw = localRaw(path2);
         const requiredContexts = () => discoverRequiredCheckContexts(
           deps,
@@ -55632,7 +56260,7 @@ init_github_quota();
 
 // src/issue-commands.ts
 var import_node_fs44 = require("node:fs");
-var import_node_crypto19 = require("node:crypto");
+var import_node_crypto21 = require("node:crypto");
 init_cli_shared();
 init_clean_exit();
 init_error_codes();
@@ -56109,7 +56737,7 @@ function rowIdempotencyKey(batchKey, spec) {
   const identity = `${spec.type}
 ${spec.title.trim()}
 ${spec.body ?? ""}`;
-  const hash = (0, import_node_crypto19.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
+  const hash = (0, import_node_crypto21.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
   return `${batchKey}:${hash}`;
 }
 var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "label", "parent", "repo", "surface"]);
@@ -56903,9 +57531,15 @@ function orgScopedHint(path2) {
   if (!match) return "";
   const org = match[1];
   const runners = /^orgs\/[^/?#]+\/actions\/runners(?:\/|$)/.test(path2.split("?")[0]);
-  const surface = runners ? `For which lane is busy in a repo, use the App-token reads \`mmi-cli devops read run list --repo <owner>/<repo> --status in_progress --json databaseId,workflowName\` followed by \`mmi-cli devops read run view <id> --repo <owner>/<repo> --json jobs\` (runner-name/status per job); fleet-wide runner online/offline state has no App-token read and a human token holder answers it with \`gh api orgs/${org}/actions/runners\` (docs/Guides/gh-runner-runbook.md).` : "It needs a human token holder with an org-scoped token, or a dedicated mmi-cli verb when one exists for this resource.";
+  const surface = runners ? `For which lane is busy in a repo, use the App-token reads \`mmi-cli devops read run list --repo <owner>/<repo> --status in_progress --json databaseId,workflowName\` followed by \`MMI_ACTOR=app mmi-cli devops api get "repos/<owner>/<repo>/actions/runs/<id>/jobs?per_page=100"\` (runner_name/status per job); fleet-wide runner online/offline state has no App-token read and a human token holder answers it with \`gh api orgs/${org}/actions/runners\` (docs/Guides/gh-runner-runbook.md).` : "It needs a human token holder with an org-scoped token, or a dedicated mmi-cli verb when one exists for this resource.";
   return ` This route is ORG-SCOPED (\`orgs/${org}/...\`) and is deliberately outside the allowlist \u2014 no App-token read exists for org-level resources, so retrying path variants cannot work and no \`repos/{owner}/{repo}/...\` respelling of it will be accepted. ${surface} A refusal writes nothing to stdout: check the exit code and never merge stderr into the JSON pipe (2>&1).`;
 }
+function repoRunnersReadHint(path2) {
+  const match = new RegExp(`^repos/(${NAME})/(${NAME})/actions/runners(?:/\\d+)?$`).exec(path2.split("?")[0]);
+  if (!match) return "";
+  const slug = `${match[1]}/${match[2]}`;
+  return ` This route is a REPO-SCOPED runner read (\`repos/${slug}/actions/runners...\`) and is deliberately outside the allowlist \u2014 retrying path variants cannot work, and no new grant or allowlist growth is implied. The App-token reads prove only observed activity, never fleet inventory or idle capacity: \`MMI_ACTOR=app mmi-cli devops read run list --repo ${slug} --status in_progress --json databaseId,workflowName\` followed by \`MMI_ACTOR=app mmi-cli devops api get "repos/${slug}/actions/runs/<id>/jobs?per_page=100"\` (runner_name/status per job). Fleet inventory is a human admin read: \`gh api orgs/<org>/actions/runners\` (docs/Guides/gh-runner-runbook.md) \u2014 whether this repo also carries repo-level runners is unproved either way. A refusal writes nothing to stdout: check the exit code and never merge stderr into the JSON pipe (2>&1).`;
+}
 function tagsReadHint(path2) {
   const match = new RegExp(`^repos/(${NAME})/(${NAME})/(?:tags|git/(?:refs|matching-refs|tags|commits))(?:[/?#]|$)`).exec(path2);
   if (!match) return "";
@@ -56949,7 +57583,7 @@ function parseApiGetPath(rawPath) {
   const path2 = normalizeApiGetPath(rawPath);
   const refuse = () => {
     const hint = /^[A-Za-z]:[/\\]/.test(rawPath.trim()) ? " Git Bash/MSYS may have rewritten a leading-slash argument; retry with MSYS_NO_PATHCONV=1 and the slash-free repos/... path. The endpoint must still be allowlisted." : "";
-    const routeHints = `${typedReadHint(path2)}${runsReadHint(path2)}${orgScopedHint(path2)}${tagsReadHint(path2)}${branchRulesReadHint(path2)}${commitsReadHint(path2)}${checkRunsReadHint(path2)}${workflowRunsReadHint(path2)}${hint}`;
+    const routeHints = `${typedReadHint(path2)}${runsReadHint(path2)}${orgScopedHint(path2)}${repoRunnersReadHint(path2)}${tagsReadHint(path2)}${branchRulesReadHint(path2)}${commitsReadHint(path2)}${checkRunsReadHint(path2)}${workflowRunsReadHint(path2)}${hint}`;
     return new Error(`api get: refusing '${rawPath}' \u2014${routeHints}${API_GET_RECOVERY} Only these GET reads are allowed (#7219): ${API_GET_ALLOWED_SHAPES}.`);
   };
   if (/[%#\\]/.test(path2) || path2.split("?")[0].split("/").some((seg) => seg === "." || seg === ".." || seg === "")) throw refuse();
@@ -57141,6 +57775,8 @@ function registerApiReadCommands(program3, overrides) {
 // src/run-log-read.ts
 init_cli_shared();
 var FAILED2 = /* @__PURE__ */ new Set(["failure", "cancelled", "timed_out"]);
+var RUN_LOG_RANGE_LINE_CAP = 2e3;
+var RUN_LOG_RANGE_CHAR_CAP = 32 * 1024;
 function logRepo(raw) {
   const repo = parseBrokerRepo(raw, "--repo");
   if (repo.split("/").some((s) => s === "." || s === "..")) throw new Error("read run log: --repo refuses dot segments");
@@ -57159,6 +57795,78 @@ function sliceRunLog(text, tail) {
   });
   return { errorLines: lines2.filter((_, i) => context.has(i)), tail: lines2.slice(-tail) };
 }
+function parseLineRange(raw) {
+  const match = /^(\d+):(\d+)$/.exec(raw.trim());
+  if (!match) throw new Error(`read run log: --lines must be <start:end> line numbers, e.g. --lines 1:2000 (received '${raw}')`);
+  const start = Number(match[1]);
+  const end = Number(match[2]);
+  if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start < 1 || end < start) {
+    throw new Error(`read run log: --lines must be a 1-based start:end range with start <= end and safe-integer bounds (received '${raw}')`);
+  }
+  return { start, end };
+}
+async function readRunLogRange(id, o, runner, env = brokerChildEnv()) {
+  const { start, end: requestedEnd } = parseLineRange(o.lines);
+  if (o.tail !== void 0) throw new Error("read run log: --lines and --tail are mutually exclusive (the range already bounds the returned lines)");
+  if (o.failed) throw new Error("read run log: --lines and --failed are mutually exclusive (--lines reads exactly one named job)");
+  if (o.attempt === void 0) throw new Error("read run log: --lines requires an explicit --attempt <n> (1-1000) \u2014 Actions job ids are minted per attempt, so the id must name one attempt");
+  if (o.job === void 0 || !/^\d+$/.test(o.job.trim())) throw new Error("read run log: --lines requires a numeric --job <id> \u2014 job names are ambiguous across attempts; take the id from the attempt-pinned jobs read");
+  const runId = parseBrokerId(id, "run id");
+  const repo = logRepo(o.repo);
+  const attempt = parseBrokerInt(o.attempt, "--attempt", 1, 1e3);
+  const jobId = Number(parseBrokerId(o.job, "job id"));
+  if (!Number.isSafeInteger(jobId) || jobId < 1) throw new Error(`read run log: --lines requires a numeric --job id (received '${o.job}')`);
+  const pages = JSON.parse(await readAppApi(`repos/${repo}/actions/runs/${runId}/attempts/${attempt}/jobs`, runner));
+  const listed = pages.flatMap((page) => page.jobs);
+  const job = listed.find((candidate) => candidate.id === jobId);
+  if (!job) {
+    const shown = listed.slice(0, 30).map((j) => `${j.name} (${j.id})`).join(", ");
+    return {
+      result: { runId, repo, jobs: [] },
+      exitCode: 1,
+      message: `read run log: job ${jobId} is not in run ${runId} attempt ${attempt} \u2014 Actions job ids are minted per workflow run and per re-run attempt, so only an id from this attempt's listing matches; jobs in run ${runId} attempt ${attempt}: ${shown || "none"}${listed.length > 30 ? `, \u2026+${listed.length - 30} more` : ""}`
+    };
+  }
+  const text = await readAppApi(`repos/${repo}/actions/jobs/${job.id}/logs`, runner);
+  const redacted = redactPrivateCredential(text, env);
+  const all = redacted.replace(/\r\n/g, "\n").split("\n");
+  if (all.at(-1) === "") all.pop();
+  const total = all.length;
+  if (start > total) {
+    return {
+      result: { runId, repo, jobs: [] },
+      exitCode: 1,
+      message: `read run log: --lines ${start}:${requestedEnd} starts beyond the end of the log \u2014 job ${job.name} (${job.id}) attempt ${attempt} retains ${total} lines; nothing to return`
+    };
+  }
+  const requestedCount = requestedEnd - start + 1;
+  const selected = all.slice(start - 1, Math.min(requestedEnd, start - 1 + RUN_LOG_RANGE_LINE_CAP));
+  let truncated = requestedCount > selected.length;
+  let section = selected.join("\n");
+  let charCut = false;
+  if (section.length > RUN_LOG_RANGE_CHAR_CAP) {
+    section = section.slice(0, RUN_LOG_RANGE_CHAR_CAP);
+    charCut = true;
+    truncated = true;
+  }
+  const lines2 = section.split("\n");
+  if (charCut && lines2.at(-1) === "") lines2.pop();
+  return {
+    result: {
+      runId,
+      repo,
+      attempt,
+      job: { id: job.id, name: job.name, conclusion: job.conclusion },
+      lines: lines2,
+      start,
+      end: start + lines2.length - 1,
+      requestedEnd,
+      total,
+      truncated
+    },
+    exitCode: 0
+  };
+}
 async function readRunLog(id, o, runner) {
   const runId = parseBrokerId(id, "run id");
   const repo = logRepo(o.repo);
@@ -57184,14 +57892,17 @@ async function readRunLog(id, o, runner) {
   return { result, exitCode: 0 };
 }
 function registerRunLogRead(run, runner) {
-  run.command("log").description("read workflow job logs on the App pool: error lines with \xB13 context and bounded tail (#8136); defaults to failed jobs, never personal").requiredOption("--repo <owner/repo>", "target repo on github.com", logRepo).addOption(new Option("--failed", "select failure/cancelled/timed_out jobs (default)").conflicts("job")).addOption(new Option("--job <name>", "select jobs with this exact name or numeric job id").argParser(logJob).conflicts("failed")).option("--tail <n>", "last lines per job (1-2000; default 200)", (v) => String(parseBrokerInt(v, "--tail", 1, 2e3)), "200").option("--attempt <n>", "run attempt (1-1000; default latest)", (v) => String(parseBrokerInt(v, "--attempt", 1, 1e3))).option("--json", "emit runId, repo and jobs with failedStep/errorLines/tail").argument("<runId>", "workflow run number", (v) => parseBrokerId(v, "run id")).action(async (id, o) => {
+  run.command("log").description("read workflow job logs on the App pool: error lines with \xB13 context and bounded tail (#8136), or a bounded --lines range from one attempt-pinned job (#9773); defaults to failed jobs, never personal").requiredOption("--repo <owner/repo>", "target repo on github.com", logRepo).addOption(new Option("--failed", "select failure/cancelled/timed_out jobs (default)").conflicts("job")).addOption(new Option("--job <name>", "select jobs with this exact name or numeric job id").argParser(logJob).conflicts("failed")).option("--tail <n>", "last lines per job (1-2000; default 200)", (v) => String(parseBrokerInt(v, "--tail", 1, 2e3))).option("--attempt <n>", "run attempt (1-1000; default latest)", (v) => String(parseBrokerInt(v, "--attempt", 1, 1e3))).addOption(new Option("--lines <start:end>", "read lines start:end of one job (needs --attempt and a numeric --job id; capped at 2000 lines and 32KiB characters; conflicts with --tail/--failed)").conflicts("failed")).option("--json", "emit the read as JSON (jobs with failedStep/errorLines/tail, or the --lines selection)").argument("<runId>", "workflow run number", (v) => parseBrokerId(v, "run id")).action(async (id, o) => {
     requireBrokerApp("read run log");
     const env = brokerChildEnv();
     try {
-      const { result, message: message2, exitCode } = await readRunLog(id, o, runner);
-      if (message2 && (!o.json || exitCode !== 0)) printLine(message2);
+      const { result, message: message2, exitCode } = o.lines === void 0 ? await readRunLog(id, o, runner) : await readRunLogRange(id, o, runner, env);
+      if (message2 && (!o.json || exitCode !== 0)) printLine(redactPrivateCredential(message2, env));
       else if (o.json) printLine(redactPrivateCredential(JSON.stringify(result), env));
-      else for (const job of result.jobs) {
+      else if ("lines" in result) {
+        printLine(redactPrivateCredential(`== ${result.job.name} (${result.job.id}) ${result.job.conclusion}: lines ${result.start}-${result.end} of ${result.total} (attempt ${result.attempt}${result.truncated ? ", truncated" : ""})`, env));
+        for (const line of result.lines) printLine(redactPrivateCredential(line, env));
+      } else for (const job of result.jobs) {
         printLine(redactPrivateCredential(`== ${job.name} (${job.id}) ${job.conclusion}: failing step "${job.failedStep ?? "none"}"`, env));
         for (const line of [...job.errorLines, ...job.tail]) printLine(redactPrivateCredential(line, env));
       }
@@ -69280,14 +69991,14 @@ vercel preview (${preview.branch}): ${d.state}${d.url ? ` \u2014 ${d.url}` : ""}
 }
 
 // src/tenant-artifact.ts
-var import_node_crypto20 = require("node:crypto");
+var import_node_crypto22 = require("node:crypto");
 var import_node_fs59 = require("node:fs");
 var import_promises11 = require("node:fs/promises");
 var import_node_path54 = require("node:path");
 var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var MAX_BYTES2 = 5 * 1024 * 1024 * 1024;
 async function sha256File(path2) {
-  const hash = (0, import_node_crypto20.createHash)("sha256");
+  const hash = (0, import_node_crypto22.createHash)("sha256");
   for await (const chunk of (0, import_node_fs59.createReadStream)(path2)) hash.update(chunk);
   return hash.digest("hex");
 }
@@ -69879,13 +70590,13 @@ async function executeWaveLand(plan, deps) {
 
 // src/dist-drift.ts
 var import_node_child_process22 = require("node:child_process");
-var import_node_crypto22 = require("node:crypto");
+var import_node_crypto24 = require("node:crypto");
 var import_node_fs62 = require("node:fs");
 var import_node_os27 = require("node:os");
 var import_node_path57 = require("node:path");
 
 // ../scripts/distribution-digest.mjs
-var import_node_crypto21 = require("node:crypto");
+var import_node_crypto23 = require("node:crypto");
 var import_node_fs61 = require("node:fs");
 var import_node_path56 = require("node:path");
 var slash = (value) => value.replaceAll("\\", "/");
@@ -69898,7 +70609,7 @@ function repoPath(root, declaredPath, label) {
   return target;
 }
 function digestFiles(files) {
-  const hash = (0, import_node_crypto21.createHash)("sha256");
+  const hash = (0, import_node_crypto23.createHash)("sha256");
   for (const file of [...files].sort((a, b) => a.relative.localeCompare(b.relative))) {
     const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs61.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs61.readFileSync)(file.absolute);
     hash.update(file.relative, "utf8");
@@ -69929,7 +70640,7 @@ var DIST_ARTIFACTS = [
 ];
 var BOM_DIST_TREE_ID = "mmi-cli-dist";
 var ABSENT = "absent";
-var sha2562 = (bytes) => `sha256:${(0, import_node_crypto22.createHash)("sha256").update(bytes).digest("hex")}`;
+var sha2562 = (bytes) => `sha256:${(0, import_node_crypto24.createHash)("sha256").update(bytes).digest("hex")}`;
 function artifactDrift(path2, committedBytes, rebuiltBytes) {
   const committed = committedBytes ? sha2562(committedBytes) : ABSENT;
   const rebuiltExpected = rebuiltBytes ? sha2562(rebuiltBytes) : ABSENT;
@@ -70498,10 +71209,10 @@ function findViolationsInSource(raw) {
   if (imported.size === 0) return [];
   const rawLines = raw.split("\n");
   const src = stripComments(raw);
-  const call = new RegExp(CALL_SOURCE, "g");
+  const call3 = new RegExp(CALL_SOURCE, "g");
   const found = [];
   let m;
-  while (m = call.exec(src)) {
+  while (m = call3.exec(src)) {
     const callee = m[2];
     if (!imported.has(callee)) continue;
     const open2 = m.index + m[0].length - 1;
@@ -70773,8 +71484,8 @@ function registerDeveloperCommands(program3) {
         return { commandPaths: new Set(manifest.index.map((entry) => entry.path)), commandOptions: commandOptions2, source: "in-process" };
       };
       const resolved = resolveCommandInventory({ root, from: o.commandsFrom, inProcess });
-      const { commandPaths, commandOptions } = resolved.inventory;
-      const deps = { commandPaths, commandOptions, base: o.base, runbooksOnly: o.runbooksOnly };
+      const { commandPaths, commandOptions, source } = resolved.inventory;
+      const deps = { commandPaths, commandOptions, commandSource: source, base: o.base, runbooksOnly: o.runbooksOnly };
       const result = o.live ? await runLiveDocRefs(root, deps, createRunbookLiveDeps(process.argv[1])) : runDocRefs(root, deps);
       result.warnings.push(...resolved.warnings);
       if (o.json) {
@@ -71471,7 +72182,20 @@ registerPreAction.call(program2, "preAction", async (_thisCommand, actionCommand
   appActorCommand = commandPath4;
   setAuditCommand(commandPath4);
   if (commandPath4 !== "whoami diagnose-hub") emitCliCallTelemetry(commandPath4);
-  if (commandPath4 === "ci cancel-orphans" || commandPath4 === "run cancel" || commandPath4 === "run rerun") return;
+  const LAZY_APP_MINT_COMMANDS = /* @__PURE__ */ new Set([
+    "ci cancel-orphans",
+    "run cancel",
+    "run rerun",
+    // #9779/#9780: the vars verbs and archive-status validate --repo/name/value before the first
+    // dispatch, so their scoped App mint waits for the action handler like the run writes above.
+    "vars get",
+    "vars list",
+    "vars create",
+    "vars update",
+    "vars delete",
+    "repo archive-status"
+  ]);
+  if (LAZY_APP_MINT_COMMANDS.has(commandPath4)) return;
   try {
     await activateAppActor(commandPath4, process.env, () => APP_WRITE_COMMANDS.has(commandPath4) ? mintCommandWriteToken(appActorDeps(), commandPath4) : mintInstallationToken(appActorDeps()));
   } catch (e) {
@@ -72313,6 +73037,15 @@ registerRunRerun(
   async () => activeAppToken() ?? (await mintCommandWriteToken(appActorDeps(), "run rerun")).token,
   async () => fetchProjectsList(registryClientDeps(await loadConfig()))
 );
+var varsAppClient = (commandPath4) => async () => (
+  // The concrete client always provides restWithStatus (optional on the interface only so hand-built
+  // test stubs of GitHubClient keep compiling).
+  createGitHubClient({ token: async () => activeAppToken() ?? (await mintCommandWriteToken(appActorDeps(), commandPath4)).token })
+);
+var varsProjects = async () => fetchProjectsList(registryClientDeps(await loadConfig()));
+var varsActor = () => ({ credential: "app_installation", ...activeAppQuotaScope() ? { quotaScope: activeAppQuotaScope() } : {} });
+registerDevopsVarsCommands(program2, { appClient: (commandPath4) => varsAppClient(commandPath4)(), projects: varsProjects, actor: varsActor });
+registerRepoArchiveStatusCommand(program2, { appClient: (commandPath4) => varsAppClient(commandPath4)(), projects: varsProjects, actor: varsActor });
 ci.command("reconcile").description("audit + optionally apply merge settings and product ruleset activation (master-admin)").option("--json", "machine-readable output").option("--repo <owner/repo>", "reconcile one repo instead of the full registry").option("--apply", "PATCH merge settings + activate product ruleset when missing (master role required); activation is skipped while the repo's gate has never passed (#3694)").option("--park-ruleset", "stop the product ruleset enforcing without deleting it \u2014 keeps its required contexts (master role required)").action(async (o) => {
   if (o.apply && o.parkRuleset) {
     return fail("ci reconcile: --apply and --park-ruleset ask for opposite things; pass one");

package/dist/runbook-sweep.cjs

@@ -8155,7 +8155,9 @@ function checkRunbookClaims(root, docs, deps) {
           if (token === "--") break;
           const flag = token.split("=")[0];
           if (/^--[\w-]+$/.test(flag) && flag !== "--help" && !placeholder(flag) && !deps.commandOptions?.get(resolved)?.has(flag)) {
-            report("unknown-flag", `mmi-cli ${resolved}: ${flag}`);
+            const known = deps.commandOptions?.get(resolved);
+            const knownFlags = known?.size ? ` (known flags: ${[...known].sort().join(" ")})` : "";
+            report("unknown-flag", `mmi-cli ${resolved}: ${flag}${knownFlags} (source: ${deps.commandSource ?? "unspecified"})`);
           }
         }
       } else if (cmd === "npm") {
@@ -8391,7 +8393,7 @@ function runDocRefs(root, deps = {}) {
     findings.push(...checkCommands(docs, commandPaths).findings);
   }
   const runbooks = Object.fromEntries(Object.entries(docs).filter(([doc, body]) => isRunbook(doc, body)));
-  findings.push(...checkRunbookClaims(root, runbooks, { readFile: readFile2, exists, isIgnored, trackedFirstSegments, commandPaths, commandOptions: deps.commandOptions }));
+  findings.push(...checkRunbookClaims(root, runbooks, { readFile: readFile2, exists, isIgnored, trackedFirstSegments, commandPaths, commandOptions: deps.commandOptions, commandSource: deps.commandSource }));
   const warnings = [...refResult.warnings];
   if (deps.runbooksOnly && !Object.keys(runbooks).length) {
     warnings.push({ kind: "runbook-missing", doc: "docs/Guides/operator.md", line: 0, detail: "no operator runbook or <!-- runbook --> document exists" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.21",
+  "version": "4.6.23",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",