@mutmutco/cli 2.18.0 → 2.19.0

package/dist/index.cjs

@@ -5590,7 +5590,6 @@ function trainPlan(command, options = {}) {
       rcandVersionStep(options),
       { label: "verify registry META for this project", command: "mmi-cli project get <owner/repo>", gated: true },
       { label: "preflight required rc secret names", command: "mmi-cli secrets preflight --stage rc --repo <owner/repo>", gated: true },
-      { label: "for Hub distribution changes, verify the release bump is already landed before touching rc", command: "node scripts/release-distribution.mjs verify <release-tag> --skip-npm-view; if missing: mmi-cli train prep --apply", gated: true },
       { label: "merge development to rc", gated: true },
       { label: "trigger the deploy path for this repo model, returning Hub Actions run id/url data (and, with --watch, its outcome)", command: "tenant-container: gh workflow run tenant-deploy.yml ... then gh run list/watch; hub-serverless: no manual dispatch, deploy.yml auto-fires on rc push, correlate/watch that run", gated: true },
       { label: "after a failed deploy, retry the existing rc ref (no re-tag/merge)", command: "mmi-cli tenant redeploy <owner/repo> rc --watch", gated: true }
@@ -5603,8 +5602,8 @@ function trainPlan(command, options = {}) {
         { label: "verify current branch is development", gated: true },
         { label: "verify registry META for this project", command: "mmi-cli project get <owner/repo>", gated: true },
         { label: "preflight required main secret names", command: "mmi-cli secrets preflight --stage main --repo <owner/repo>", gated: true },
-        { label: "direct-track release skips rc; verify any distribution bump is already landed on development", command: "node scripts/release-distribution.mjs verify <release-tag> --skip-npm-view", gated: true },
         { label: "merge development to main", gated: true },
+        { label: "fold the version bump into the release commit (Hub: full distribution set; app repos: root package manifest) \u2014 runs inside the apply step, no separate bump PR", gated: true },
         { label: "tag release and publish GitHub Release", gated: true },
         { label: "trigger the repo deploy path from the release event", command: "hub-serverless: deploy.yml + publish.yml auto-fire on the release; other models deploy via their own workflow", gated: true },
         { label: "roll development forward", gated: true }
@@ -5617,7 +5616,7 @@ function trainPlan(command, options = {}) {
       { label: "preflight required main secret names", command: "mmi-cli secrets preflight --stage main --repo <owner/repo>", gated: true },
       { label: "verify every main-only hotfix commit is covered by the rc candidate (the guard runs automatically inside the apply step below; --ack <sha> overrides a verified, trailer-less port)", command: "mmi-cli release --apply [--ack <sha>]", gated: true },
       { label: "merge rc to main", gated: true },
-      { label: "for Hub distribution changes, verify the promoted SHA carries the release bump", command: "node scripts/release-distribution.mjs verify <release-tag> --skip-npm-view; if missing: mmi-cli train prep --apply", gated: true },
+      { label: "fold the version bump into the release commit (app repos: root package manifest) \u2014 runs inside the apply step, no separate bump PR", gated: true },
       { label: "tag release and publish GitHub Release", gated: true },
       { label: "trigger the deploy path for this repo model, returning Hub Actions run id/url data (and, with --watch, its outcome)", command: "tenant-container: gh workflow run tenant-deploy.yml ... then gh run list/watch; hub-serverless: no manual dispatch, deploy.yml + publish.yml auto-fire on the release, correlate/watch those runs", gated: true },
       { label: "roll development forward", gated: true }
@@ -5627,7 +5626,7 @@ function trainPlan(command, options = {}) {
     { label: "verify the fix is merged on development (the only hotfix origin)", gated: true },
     { label: "branch hotfix from main and cherry-pick the dev commits", command: "git cherry-pick -x <dev-sha>", gated: true },
     { label: "land on main via PR, tag, deploy prod", gated: true },
-    { label: "forward-bump development distribution manifests (Hub only; no back-merge)", gated: true }
+    { label: "no residue: development already has the fix; the next /release fold + back-merge re-aligns version manifests" }
   ];
 }
 function bootstrapPlan(repo, repoClass) {
@@ -5709,9 +5708,9 @@ function stalePosixFields(config, shell2) {
 }
 function sanitizeLocalStage(local, stale) {
   if (!stale.length) return local;
-  const clean4 = { ...local };
-  for (const field of stale) delete clean4[field];
-  return clean4;
+  const clean3 = { ...local };
+  for (const field of stale) delete clean3[field];
+  return clean3;
 }
 function staleNote(staleFields, outcome) {
   const list = staleFields.join(", ");
@@ -6516,9 +6515,35 @@ function requireValue(value, label) {
   if (!value) throw new Error(`${label} could not be resolved`);
   return value;
 }
-async function verifyHubDistributionVersion(deps, model, releaseTag) {
-  if (model !== "hub-serverless") return;
-  await deps.run("node", ["scripts/release-distribution.mjs", "verify", releaseTag, "--skip-npm-view"]);
+async function resolveFoldPaths(deps, model) {
+  if (model === "hub-serverless") {
+    return (await deps.run("node", ["scripts/release-distribution.mjs", "changed-files"])).split("\n").map((s) => s.trim()).filter(Boolean);
+  }
+  try {
+    await deps.run("git", ["cat-file", "-e", "origin/main:package.json"]);
+  } catch {
+    return [];
+  }
+  return ["package.json", "package-lock.json"];
+}
+async function foldReleaseVersion(deps, model, tag, foldPaths) {
+  if (foldPaths.length === 0) return "no version manifest to fold \u2014 the tag is the version";
+  const version = tag.replace(/^v/, "");
+  if (model === "hub-serverless") {
+    await deps.run("node", ["scripts/release-distribution.mjs", "prepare", version]);
+  } else {
+    await deps.run("npm", ["version", version, "--no-git-tag-version", "--allow-same-version"]);
+  }
+  for (const path2 of foldPaths) {
+    await deps.run("git", ["add", "--", path2]).catch(() => void 0);
+  }
+  const staged = (await deps.run("git", ["diff", "--cached", "--name-only"])).trim();
+  if (!staged) return `version fold: manifests already at ${version} \u2014 nothing committed`;
+  await deps.run("git", ["commit", "-m", `chore(release): bump distribution to ${tag}`]);
+  if (model === "hub-serverless") {
+    await deps.run("node", ["scripts/release-distribution.mjs", "verify", version, "--skip-npm-view"]);
+  }
+  return `version fold: distribution bumped to ${version} in the release commit`;
 }
 async function verifyPublishedRelease(deps, repo, tag, expectedTarget, expectedSha) {
   const out = await deps.run("gh", ["release", "view", tag, "--repo", repo, "--json", "tagName,targetCommitish"]);
@@ -6568,18 +6593,18 @@ async function predictMergeConflicts(deps, ours, theirs) {
     return files;
   }
 }
-async function mergeWithSpineResolution(deps, sourceRef, label, resolve) {
+async function mergeWithSpineResolution(deps, sourceRef, label, resolve, extraTolerated = []) {
   try {
     await deps.run("git", ["merge", sourceRef, "--no-edit"]);
     return;
   } catch {
   }
   const unmerged = (await deps.run("git", ["diff", "--name-only", "--diff-filter=U"])).split("\n").map((s) => s.trim()).filter(Boolean);
-  const nonSpine = unmerged.filter((f) => !isSpinePath(f));
-  if (unmerged.length === 0 || nonSpine.length > 0) {
+  const blocking = unmerged.filter((f) => !isSpinePath(f) && !extraTolerated.includes(f));
+  if (unmerged.length === 0 || blocking.length > 0) {
     await deps.run("git", ["merge", "--abort"]);
     throw new Error(
-      unmerged.length === 0 ? `${label} merge failed without conflicted paths \u2014 merge aborted; inspect the repo state and rerun` : `${label} merge conflicts on non-spine path(s): ${nonSpine.join(", ")} \u2014 merge aborted (the train is misaligned; reconcile the branches via an approved alignment PR, then rerun)`
+      unmerged.length === 0 ? `${label} merge failed without conflicted paths \u2014 merge aborted; inspect the repo state and rerun` : `${label} merge conflicts on non-spine path(s): ${blocking.join(", ")} \u2014 merge aborted (the train is misaligned; reconcile the branches via an approved alignment PR, then rerun)`
     );
   }
   await deps.run("git", ["checkout", `--${resolve}`, "--", ...unmerged]);
@@ -6934,7 +6959,6 @@ async function runTrainApply(command, deps, options = {}) {
     );
     const deployModel2 = await preflight(deps, ctx, "rc", meta);
     const releaseBase = requireValue(clean(await deps.run("node", ["scripts/next-version.mjs", "cycle"])), "release base");
-    await verifyHubDistributionVersion(deps, deployModel2, releaseBase);
     await deps.run("git", ["checkout", "rc"]);
     await deps.run("git", ["pull", "--ff-only", "origin", "rc"]);
     await deps.run("git", ["merge", "development", "--no-edit"]);
@@ -6959,12 +6983,12 @@ async function runTrainApply(command, deps, options = {}) {
     );
     const deployModel2 = await preflight(deps, ctx, "main", meta);
     const tag2 = requireValue(clean(await deps.run("node", ["scripts/next-version.mjs", "cycle"])), "release tag");
-    await verifyHubDistributionVersion(deps, deployModel2, tag2);
+    const foldPaths2 = await resolveFoldPaths(deps, deployModel2);
     const predicted2 = await predictMergeConflicts(deps, "origin/main", "origin/development");
-    const predictedNonSpine2 = predicted2.filter((f) => !isSpinePath(f));
-    if (predictedNonSpine2.length > 0) {
+    const predictedBlocking2 = predicted2.filter((f) => !isSpinePath(f) && !foldPaths2.includes(f));
+    if (predictedBlocking2.length > 0) {
       throw new Error(
-        `development -> main merge would conflict on non-spine path(s): ${predictedNonSpine2.join(", ")} \u2014 no merge was started. The train is misaligned: reconcile main and development via an approved alignment PR, then rerun release.`
+        `development -> main merge would conflict on non-spine path(s): ${predictedBlocking2.join(", ")} \u2014 no merge was started. The train is misaligned: reconcile main and development via an approved alignment PR, then rerun release.`
       );
     }
     await deps.run("git", ["checkout", "main"]);
@@ -6972,8 +6996,9 @@ async function runTrainApply(command, deps, options = {}) {
     if (predicted2.length === 0) {
       await deps.run("git", ["merge", "development", "--no-edit"]);
     } else {
-      await mergeWithSpineResolution(deps, "development", "development -> main", "theirs");
+      await mergeWithSpineResolution(deps, "development", "development -> main", "theirs", foldPaths2);
     }
+    const versionFold2 = await foldReleaseVersion(deps, deployModel2, tag2, foldPaths2);
     const releaseSha2 = requireValue(clean(await deps.run("git", ["rev-parse", "main"])), "release sha");
     await ensureTagPushed(deps, tag2, releaseSha2);
     const requiredChecks2 = await discoverRequiredCheckContexts(deps, ctx, "main");
@@ -6996,6 +7021,7 @@ async function runTrainApply(command, deps, options = {}) {
       deployModel: deployModel2,
       promoted: true,
       checks: checks2,
+      versionFold: versionFold2,
       dispatch: d2.note,
       runId: d2.runId,
       runUrl: d2.runUrl,
@@ -7013,11 +7039,12 @@ async function runTrainApply(command, deps, options = {}) {
     "nothing to release: origin/rc is not ahead of origin/main"
   );
   const deployModel = await preflight(deps, ctx, "main", meta);
+  const foldPaths = await resolveFoldPaths(deps, deployModel);
   const predicted = await predictMergeConflicts(deps, "origin/main", "origin/rc");
-  const predictedNonSpine = predicted.filter((f) => !isSpinePath(f));
-  if (predictedNonSpine.length > 0) {
+  const predictedBlocking = predicted.filter((f) => !isSpinePath(f) && !foldPaths.includes(f));
+  if (predictedBlocking.length > 0) {
     throw new Error(
-      `rc -> main merge would conflict on non-spine path(s): ${predictedNonSpine.join(", ")} \u2014 no merge was started. The train is misaligned: reconcile main and rc via an approved alignment PR (do not hand-resolve on main), then rerun release.`
+      `rc -> main merge would conflict on non-spine path(s): ${predictedBlocking.join(", ")} \u2014 no merge was started. The train is misaligned: reconcile main and rc via an approved alignment PR (do not hand-resolve on main), then rerun release.`
     );
   }
   const coverage = deps.hotfixCoverage({ mainRef: "origin/main", rcRef: "origin/rc", ack: options.ack ?? [] });
@@ -7033,10 +7060,10 @@ async function runTrainApply(command, deps, options = {}) {
   if (predicted.length === 0) {
     await deps.run("git", ["merge", "rc", "--no-edit"]);
   } else {
-    await mergeWithSpineResolution(deps, "rc", "rc -> main", "theirs");
+    await mergeWithSpineResolution(deps, "rc", "rc -> main", "theirs", foldPaths);
   }
   const tag = requireValue(clean(await deps.run("node", ["scripts/next-version.mjs", "release"])), "release tag");
-  await verifyHubDistributionVersion(deps, deployModel, tag);
+  const versionFold = await foldReleaseVersion(deps, deployModel, tag, foldPaths);
   const releaseSha = requireValue(clean(await deps.run("git", ["rev-parse", "main"])), "release sha");
   await ensureTagPushed(deps, tag, releaseSha);
   const requiredChecks = await discoverRequiredCheckContexts(deps, ctx, "main");
@@ -7062,6 +7089,7 @@ async function runTrainApply(command, deps, options = {}) {
     deployModel,
     promoted: true,
     checks,
+    versionFold,
     dispatch: d.note,
     runId: d.runId,
     runUrl: d.runUrl,
@@ -7288,34 +7316,6 @@ function checkHotfixCoverage(options = {}) {
   return { ok: uncovered.length === 0, mainRef, rcRef, commits, uncovered };
 }
 
-// src/train-prep.ts
-function clean2(text) {
-  return text.trim();
-}
-function normalizeVersion2(target) {
-  const version = target.replace(/^v/, "");
-  if (!/^\d+\.\d+\.\d+$/.test(version)) {
-    throw new Error(`invalid train prep target ${target || "(empty)"}`);
-  }
-  return version;
-}
-function parseChangedFiles(out) {
-  return out.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
-}
-async function runTrainPrep(deps, options = {}) {
-  const target = clean2(await deps.run("node", ["scripts/next-version.mjs", "cycle"]));
-  const version = normalizeVersion2(target);
-  if (!options.apply) {
-    return { target, version, applied: false, command: "mmi-cli train prep --apply", stagedFiles: [] };
-  }
-  await deps.run("node", ["scripts/release-distribution.mjs", "prepare", target]);
-  const stagedFiles = parseChangedFiles(await deps.run("node", ["scripts/release-distribution.mjs", "changed-files"]));
-  if (stagedFiles.length === 0) throw new Error("no locked distribution files returned by release-distribution changed-files");
-  await deps.run("git", ["add", "--", ...stagedFiles]);
-  await deps.run("node", ["scripts/release-distribution.mjs", "verify", target, "--skip-npm-view"]);
-  return { target, version, applied: true, command: "mmi-cli pr create --base development --head <current-branch>", stagedFiles };
-}
-
 // src/tenant-sweep.ts
 function isRcBearingTenant(p) {
   if ((p.deployModel ?? "") !== "tenant-container") return false;
@@ -7383,7 +7383,7 @@ function renderSweep(r) {
 var HOTFIX_RELEASE_WORKFLOWS = ["deploy.yml", "publish.yml"];
 var HOTFIX_RUN_FIND_ATTEMPTS = 10;
 var HOTFIX_RUN_FIND_DELAY_MS = 15e3;
-function clean3(out) {
+function clean2(out) {
   return out.trim();
 }
 function sleeper(deps) {
@@ -7437,7 +7437,7 @@ async function resolveHotfixSource(deps, ctx, from) {
     if (!sha2) throw new Error(`PR #${num} has no merge commit recorded \u2014 name the commit SHA explicitly`);
     return { sha: sha2, label: `PR #${num} (${sha2.slice(0, 7)})` };
   }
-  const sha = clean3(await deps.run("git", ["rev-parse", "--verify", `${from}^{commit}`]));
+  const sha = clean2(await deps.run("git", ["rev-parse", "--verify", `${from}^{commit}`]));
   if (!sha) throw new Error(`could not resolve commit ${from}`);
   return { sha, label: sha.slice(0, 7) };
 }
@@ -7464,7 +7464,7 @@ async function runHotfixStart(deps, options) {
     };
   }
   const { sha, label } = await resolveHotfixSource(deps, ctx, options.from);
-  const remoteBranch = clean3(await deps.run("git", ["ls-remote", "origin", `refs/heads/${branch}`]));
+  const remoteBranch = clean2(await deps.run("git", ["ls-remote", "origin", `refs/heads/${branch}`]));
   if (remoteBranch) {
     await deps.run("git", ["checkout", branch]);
     await deps.run("git", ["pull", "--ff-only", "origin", branch]);
@@ -7490,7 +7490,7 @@ async function runHotfixStart(deps, options) {
     }
     await deps.run("git", ["push", "-u", "origin", branch]);
   }
-  const prUrl = clean3(await deps.run("gh", [
+  const prUrl = clean2(await deps.run("gh", [
     "pr",
     "create",
     "--repo",
@@ -7573,7 +7573,7 @@ async function runHotfixRelease(deps, versionInput, options = {}) {
   if (releaseExists) {
     releaseNote = `Release ${tag} already exists \u2014 resumed without recreating`;
   } else {
-    const tagCommit = clean3(await deps.run("git", ["rev-parse", `${tag}^{commit}`]));
+    const tagCommit = clean2(await deps.run("git", ["rev-parse", `${tag}^{commit}`]));
     await deps.run("gh", ["release", "create", tag, "--repo", ctx.repo, "--target", tagCommit, "--generate-notes", "--latest"]);
     releaseNote = `Release ${tag} created (target ${tagCommit.slice(0, 7)})`;
     if (deps.announce) {
@@ -7584,7 +7584,7 @@ async function runHotfixRelease(deps, versionInput, options = {}) {
   for (const workflow of HOTFIX_RELEASE_WORKFLOWS) {
     runs.push(await watchReleaseRun(deps, ctx, workflow, mergedSha));
   }
-  const previousRef = clean3(await deps.run("git", ["rev-parse", "--abbrev-ref", "HEAD"]));
+  const previousRef = clean2(await deps.run("git", ["rev-parse", "--abbrev-ref", "HEAD"]));
   let verifyNote;
   const publishSucceeded = runs.find((r) => r.workflow === "publish.yml")?.conclusion === "success";
   try {
@@ -7597,15 +7597,6 @@ async function runHotfixRelease(deps, versionInput, options = {}) {
   }
   return { ...ctx, command: "hotfix-release", tag, mergedSha, checks, tagNote, releaseNote, runs, verifyNote, announceNote };
 }
-function versionAtLeast2(actual, wanted) {
-  const pa = actual.split(".").map(Number);
-  const pw = wanted.split(".").map(Number);
-  if (pa.length < 3 || pa.some(Number.isNaN) || pw.length < 3 || pw.some(Number.isNaN)) return false;
-  for (let i = 0; i < 3; i += 1) {
-    if (pa[i] !== pw[i]) return pa[i] > pw[i];
-  }
-  return true;
-}
 function deriveHotfixState(f) {
   if (!f.branchExists && !f.pr && !f.tagPushed && !f.releaseExists) {
     return { state: "not-started", next: `mmi-cli hotfix start --from <pr#|sha> (would mint ${f.tag})` };
@@ -7622,13 +7613,7 @@ function deriveHotfixState(f) {
   if (!f.tagPushed || !f.releaseExists) {
     return { state: "pr-merged (not released)", next: `mmi-cli hotfix release ${f.tag}` };
   }
-  if (!f.devDistribution.aligned) {
-    return {
-      state: `UNFINISHED \u2014 released but development distribution manifests behind (dev ${f.devDistribution.version} < ${f.version})`,
-      next: `forward-bump development (never a back-merge): branch from origin/development, node scripts/release-distribution.mjs prepare ${f.version}, land by PR (/hotfix Step 5)`
-    };
-  }
-  return { state: "complete", next: "nothing \u2014 pipeline complete (rc absorbs the fix at the next /rcand; /release guards coverage)" };
+  return { state: "complete", next: "nothing \u2014 pipeline complete (rc absorbs the fix at the next /rcand; /release guards coverage and re-aligns the version manifests via its fold + back-merge)" };
 }
 async function runHotfixStatus(deps, versionInput) {
   const ctx = await buildTrainApplyContext(deps);
@@ -7652,9 +7637,9 @@ async function runHotfixStatus(deps, versionInput) {
   return { ...ctx, command: "hotfix-status", ...facts, ...deriveHotfixState(facts) };
 }
 async function gatherHotfixFacts(deps, ctx, tag, version) {
-  const branchExists = Boolean(clean3(await deps.run("git", ["ls-remote", "origin", `refs/heads/${hotfixBranch(tag)}`])));
+  const branchExists = Boolean(clean2(await deps.run("git", ["ls-remote", "origin", `refs/heads/${hotfixBranch(tag)}`])));
   const pr2 = await findHotfixPr(deps, ctx, tag);
-  const remoteTag = clean3(await deps.run("git", ["ls-remote", "origin", `refs/tags/${tag}`]));
+  const remoteTag = clean2(await deps.run("git", ["ls-remote", "origin", `refs/tags/${tag}`]));
   const tagPushed = Boolean(remoteTag);
   const tagSha = remoteTag.split(/\s+/)[0] || "";
   let releaseExists = false;
@@ -7688,19 +7673,8 @@ async function gatherHotfixFacts(deps, ctx, tag, version) {
       }
     }
   }
-  const npmVersion = await deps.run("npm", ["view", "@mutmutco/cli", "version", "--silent"]).then(clean3, () => "unknown");
-  const devVersion = await deps.run("git", ["show", "origin/development:cli/package.json"]).then(
-    (out) => {
-      try {
-        return JSON.parse(out).version ?? "unknown";
-      } catch {
-        return "unknown";
-      }
-    },
-    () => "unknown"
-  );
-  const devDistribution = { version: devVersion, aligned: versionAtLeast2(devVersion, version) };
-  return { tag, version, branchExists, pr: pr2 ? { number: pr2.number, state: pr2.state, url: pr2.url } : null, tagPushed, releaseExists, runs, npmVersion, devDistribution };
+  const npmVersion = await deps.run("npm", ["view", "@mutmutco/cli", "version", "--silent"]).then(clean2, () => "unknown");
+  return { tag, version, branchExists, pr: pr2 ? { number: pr2.number, state: pr2.state, url: pr2.url } : null, tagPushed, releaseExists, runs, npmVersion };
 }
 
 // src/release-announce.ts
@@ -9601,8 +9575,8 @@ function resolveKbSource(rawBase) {
   return { owner: m[1], repo: m[2], ref: m[3] };
 }
 function buildKbGetArgs(src, path2) {
-  const clean4 = path2.replace(/^\/+/, "");
-  return ["api", `repos/${src.owner}/${src.repo}/contents/${clean4}?ref=${src.ref}`, "-H", "Accept: application/vnd.github.raw"];
+  const clean3 = path2.replace(/^\/+/, "");
+  return ["api", `repos/${src.owner}/${src.repo}/contents/${clean3}?ref=${src.ref}`, "-H", "Accept: application/vnd.github.raw"];
 }
 function buildKbTreeArgs(src) {
   return ["api", `repos/${src.owner}/${src.repo}/git/trees/${src.ref}?recursive=1`];
@@ -10690,12 +10664,10 @@ async function applyVersionAutoUpdate(report, log) {
 async function requireFreshTrainCli(commandName) {
   const report = buildVersionLagReport({
     currentVersion: resolveClientVersion(),
-    repoVersion: readRepoVersion(),
     releasedVersion: await fetchReleasedVersion()
   });
   if (report.ok) return;
-  const target = report.staleAgainst === "released" ? `released ${report.releasedVersion}` : `repo ${report.repoVersion}`;
-  throw new Error(`running mmi-cli ${report.currentVersion} is stale against ${target}; run doctor/update first so ${commandName} uses the current train path`);
+  throw new Error(`running mmi-cli ${report.currentVersion} is stale against released ${report.releasedVersion}; run doctor/update first so ${commandName} uses the current train path`);
 }
 var consoleIo = { log: (m) => console.log(m), err: (m) => console.error(m) };
 var CLAUDE_PLUGIN_TIMEOUT_MS = 12e4;
@@ -12163,11 +12135,12 @@ program2.command("stage-live").description("explain that remote rc/live environm
 var GH_TRAIN_TIMEOUT_MS = 3e4;
 var GH_RUN_WATCH_TIMEOUT_MS = 20 * 6e4;
 var NODE_PREPARE_TIMEOUT_MS = 10 * 6e4;
+var NPM_TRAIN_TIMEOUT_MS = 6e4;
 function trainApplyDeps() {
   return {
     run: async (file, args) => {
-      const timeout = file === "node" && args[1] === "prepare" ? NODE_PREPARE_TIMEOUT_MS : file !== "gh" ? GIT_TIMEOUT_MS : args[0] === "run" && args[1] === "watch" ? GH_RUN_WATCH_TIMEOUT_MS : GH_TRAIN_TIMEOUT_MS;
-      return (await execFileP4(file, args, { timeout })).stdout;
+      const timeout = file === "node" && args[1] === "prepare" ? NODE_PREPARE_TIMEOUT_MS : file === "npm" ? NPM_TRAIN_TIMEOUT_MS : file !== "gh" ? GIT_TIMEOUT_MS : args[0] === "run" && args[1] === "watch" ? GH_RUN_WATCH_TIMEOUT_MS : GH_TRAIN_TIMEOUT_MS;
+      return isWin && file === "npm" ? (await execFileP4("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP4(file, args, { timeout })).stdout;
     },
     runSelf: async (args) => (await execFileP4(process.execPath, [process.argv[1], ...args], { timeout: 3e4 })).stdout,
     trainAuthority: async (repo) => {
@@ -12183,10 +12156,11 @@ function trainApplyDeps() {
         throw new Error(`tenant deploy dispatch failed: ${detail}`);
       }
     },
-    // Hotfix-coverage guard (#958): runs against the local clone via real git. manifestPaths is empty —
-    // product repos carry no main-only distribution bump (that exemption is Hub-distribution-specific, and
-    // the Hub is direct-track, so it never reaches this guard).
-    hotfixCoverage: (input) => checkHotfixCoverage({ ...input, manifestPaths: [] }),
+    // Hotfix-coverage guard (#958): runs against the local clone via real git. manifestPaths exempts the
+    // release version fold (#976) — a main-only commit touching ONLY the root package manifest is the
+    // fold's version metadata, which the candidate replaces with its own. (The Hub's wider distribution
+    // set never reaches this guard: the Hub is direct-track.)
+    hotfixCoverage: (input) => checkHotfixCoverage({ ...input, manifestPaths: ["package.json", "package-lock.json"] }),
     // Slack release announcement (#883): Hub-only + best-effort inside announceRelease itself.
     announce: (args) => announceRelease({
       run: async (file, cmdArgs) => (await execFileP4(file, cmdArgs, { timeout: GH_TRAIN_TIMEOUT_MS })).stdout,
@@ -12201,14 +12175,6 @@ function trainApplyDeps() {
     }
   };
 }
-function trainPrepDeps() {
-  return {
-    run: async (file, args) => {
-      const timeout = file === "node" && args[1] === "prepare" ? NODE_PREPARE_TIMEOUT_MS : GIT_TIMEOUT_MS;
-      return (await execFileP4(file, args, { timeout })).stdout;
-    }
-  };
-}
 function formatWorkflowRun(r) {
   const ref = r.runUrl ?? (r.runId != null ? String(r.runId) : "unresolved");
   return `${r.workflow} ${ref} ${r.conclusion.toUpperCase()}`;
@@ -12224,6 +12190,7 @@ function renderDeployLine(d) {
 }
 function renderTrainApply(commandName, r) {
   let base = `mmi-cli ${commandName}: promoted ${r.repo} \u2192 ${r.stage} at ${r.tag} [${r.deployModel}]; ${renderDeployLine(r)}`;
+  if (r.versionFold) base = `${base}; ${r.versionFold}`;
   if (r.resumeNote) base = `${base}; ${r.resumeNote}`;
   if (r.rcRetirement) base = `${base}; rc retirement: ${r.rcRetirement.toUpperCase()} (${r.rcRetirementNote ?? ""})`;
   return r.announceNote ? `${base}; announce: ${r.announceNote}` : base;
@@ -12239,27 +12206,6 @@ async function resolveRcandPlanTargets() {
     return { plannedReleaseError: e.message, existingRcReleaseError: e.message };
   }
 }
-function renderTrainPrep(r) {
-  if (!r.applied) {
-    return `mmi-cli train prep: target ${r.target}; run ${r.command} to prepare and stage locked distribution files`;
-  }
-  return [
-    `mmi-cli train prep: prepared ${r.target}`,
-    `  - staged locked files: ${r.stagedFiles.join(", ")}`,
-    "  - stopped before promotion; no push, merge, tag, release, or deploy was run",
-    `  - next: ${r.command}`
-  ].join("\n");
-}
-var trainCmd = program2.command("train").description("release train helpers that stop before promotion");
-trainCmd.command("prep").description("prepare and stage the Hub distribution bump for the next release train").option("--json", "machine-readable output").option("--apply", "run release-distribution prepare, exact-file stage, verify, then stop").action(async (o) => {
-  try {
-    await requireFreshTrainCli("train prep");
-    const result = await runTrainPrep(trainPrepDeps(), { apply: o.apply });
-    printLine(o.json ? JSON.stringify(result, null, 2) : renderTrainPrep(result));
-  } catch (e) {
-    fail(`train prep: ${e.message}`);
-  }
-});
 for (const commandName of ["rcand", "release"]) {
   program2.command(commandName).description(`plan ${commandName} train operations; mutations require explicit master-admin approval`).option("--json", "machine-readable output").option("--watch", "block on the deploy/publish workflow runs and report their outcomes").option("--apply", "execute the guarded master-only train after explicit approval").option("--announce-summary-file <path>", "release only: agent-curated summary lines for the Hub Slack announcement (#883)").option("--ack <shas>", "release only: comma-separated dev shas a human verified are in the candidate, overriding the hotfix-coverage guard for a conflicted port whose -x trailer was lost (#958)").action(async (o) => {
     try {
@@ -12299,7 +12245,7 @@ function renderHotfixRelease(r) {
     ...r.runs.map((run) => `  - ${run.workflow}: ${run.conclusion}${run.url ? ` (${run.url})` : ""}`),
     `  - ${r.verifyNote}`,
     ...r.announceNote ? [`  - announce: ${r.announceNote}`] : [],
-    `  - next: mmi-cli hotfix status ${r.tag} (no back-merge \u2014 development already has the fix; align its distribution manifests by PR if status says behind)`
+    `  - next: mmi-cli hotfix status ${r.tag} (no back-merge \u2014 development already has the fix; the next /release back-merge aligns the version manifests)`
   ].join("\n");
 }
 function renderHotfixStatus(r) {
@@ -12307,7 +12253,7 @@ function renderHotfixStatus(r) {
     `mmi-cli hotfix status: ${r.tag} on ${r.repo} \u2014 ${r.state}`,
     `  - branch: ${r.branchExists ? "pushed" : "absent"} \xB7 PR: ${r.pr ? `#${r.pr.number} ${r.pr.state}` : "none"} \xB7 tag: ${r.tagPushed ? "pushed" : "absent"} \xB7 Release: ${r.releaseExists ? "exists" : "absent"}`,
     ...r.runs.map((run) => `  - ${run.workflow}: ${run.conclusion}${run.url ? ` (${run.url})` : ""}`),
-    `  - npm @mutmutco/cli: ${r.npmVersion} \xB7 development manifests: ${r.devDistribution.version}${r.devDistribution.aligned ? " (aligned)" : " (behind)"}`,
+    `  - npm @mutmutco/cli: ${r.npmVersion}`,
     `  - next: ${r.next}`
   ].join("\n");
 }
@@ -12971,7 +12917,7 @@ async function runDoctor(opts, io = consoleIo) {
   io.log(gaps.length ? `
 ${gaps.length} item(s) need attention.` : "\nAll set \u2014 you are ready.");
 }
-program2.command("doctor").description("check onboarding gates (GitHub auth, mmi-cli on PATH, Hub API default, plugin git clone, plugin install record, .gitignore managed block, plugin config drift, installed plugin version, Cursor Team Marketplace plugin install), print fixes, and report per-surface versions + update recipes").option("--banner", "one-line resume summary; silent when all gates pass").option("--guide", "print the MMI Agentic Onboarding guide URL").option("--json", "machine-readable output (read-only inspection \u2014 performs no repairs)").option("--apply", "perform the same auto-repairs as the interactive run (combine with --json for a machine-readable repair run)").option("--no-repo-writes", "env/plugin repairs only \u2014 never mutate the repo working tree; report pending managed .gitignore repairs with the follow-up command (for release-train prep)").action((opts) => (
+program2.command("doctor").description("check onboarding gates (GitHub auth, mmi-cli on PATH, Hub API default, plugin git clone, plugin install record, .gitignore managed block, plugin config drift, installed plugin version, Cursor Team Marketplace plugin install), print fixes, and report per-surface versions + update recipes").option("--banner", "one-line resume summary; silent when all gates pass").option("--guide", "print the MMI Agentic Onboarding guide URL").option("--json", "machine-readable output (read-only inspection \u2014 performs no repairs)").option("--apply", "perform the same auto-repairs as the interactive run (combine with --json for a machine-readable repair run)").option("--no-repo-writes", "env/plugin repairs only \u2014 never mutate the repo working tree; report pending managed .gitignore repairs with the follow-up command (for train preflights)").action((opts) => (
   // Commander maps `--no-repo-writes` to `repoWrites: false`; translate to the explicit `noRepoWrites` flag.
   runDoctor({ ...opts, noRepoWrites: opts.repoWrites === false })
 ));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "2.18.0",
+  "version": "2.19.0",
   "description": "MMI Future CLI — delivers the org rules (whole-file), plus saga and KB access. The cross-IDE engine the plugin's SessionStart hook drives.",
   "type": "module",
   "license": "UNLICENSED",