@mutmutco/cli 3.137.0 → 3.139.0

package/dist/main.cjs

@@ -14487,10 +14487,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "3.137.0",
-    tag: "v3.137.0",
-    commit: "48d8161cd121",
-    npm: "@mutmutco/cli@3.137.0"
+    version: "3.139.0",
+    tag: "v3.139.0",
+    commit: "b25f6dfd0b72",
+    npm: "@mutmutco/cli@3.139.0"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -14507,14 +14507,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v3.137.0"
+          v3Target: "v3.139.0"
         }
       ],
       rollbackTrigger: "Any red inside the post-cut soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a v3 client refused while the compat window must still admit it (SUPPORTED_MINOR_WINDOW=2, MIN_CLIENT_VERSION 0.0.0 \u2014 D6a), or npm consumer install/doctor failure on the v4 dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 3.137.0 and redeploy the Hub Lambda from tag v3.137.0 (48d8161cd121); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v3.137.0 (@mutmutco/cli@3.137.0, tag commit 48d8161cd121 \u2014 the preserved latest-v3 distribution, D6b)"
+        mechanism: "npm dist-tag latest -> 3.139.0 and redeploy the Hub Lambda from tag v3.139.0 (b25f6dfd0b72); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v3.139.0 (@mutmutco/cli@3.139.0, tag commit b25f6dfd0b72 \u2014 the preserved latest-v3 distribution, D6b)"
       }
     },
     {
@@ -16288,7 +16288,8 @@ async function disarmFleetLockstep(client, org = ORG_LOGIN) {
   const include = conditions?.repository_name?.include ?? [];
   return writeFleetLockstepRuleset(client, fleetLockstepRulesetDesired(include, "disabled"), id, "disarm", org);
 }
-async function computeFleetLockstepVerdict(gate = runFleetLockstepGate) {
+var HUB_POSTING_REPO = "mutmutco/mmi-hub";
+async function computeFleetLockstepVerdict(gate = runFleetLockstepGate, postingRepo) {
   let result;
   try {
     result = await gate();
@@ -16298,6 +16299,31 @@ async function computeFleetLockstepVerdict(gate = runFleetLockstepGate) {
       description: `fleet gate unreadable (fail-closed): ${e.message}`.slice(0, STATUS_DESCRIPTION_MAX)
     };
   }
+  if (postingRepo?.trim().toLowerCase() === HUB_POSTING_REPO) {
+    const structural = [];
+    if (result.repos.length === 0) structural.push("empty roster");
+    if (result.hubOnly) structural.push("hub-only coverage");
+    if (result.unclassifiedProjects.length) structural.push(`${result.unclassifiedProjects.length} registered project(s) with no valid repository`);
+    const hubRow = result.repos.find((r) => r.repo.trim().toLowerCase() === HUB_POSTING_REPO);
+    if (!hubRow) structural.push("Hub row missing from the roster");
+    if (structural.length || hubRow && hubRow.verdict !== "conforming") {
+      const hubLocal = hubRow && hubRow.verdict !== "conforming" ? `Hub row is ${hubRow.verdict}` : null;
+      return {
+        state: "failure",
+        description: `fleet lockstep FAIL: ${[...structural, hubLocal].filter(Boolean).join("; ")} (Hub train scope #5040)`.slice(0, STATUS_DESCRIPTION_MAX)
+      };
+    }
+    if (result.verdict === "pass") {
+      return {
+        state: "success",
+        description: `fleet lockstep ${result.conforming}/${result.denominator} PASS (evaluated ${result.evaluatedAt})`.slice(0, STATUS_DESCRIPTION_MAX)
+      };
+    }
+    return {
+      state: "success",
+      description: `fleet lockstep ${result.conforming}/${result.denominator} \u2014 ${result.drift.length} drift, ${result.unknowns.length} unknown (other repos; non-blocking for the Hub train #5040)`.slice(0, STATUS_DESCRIPTION_MAX)
+    };
+  }
   return result.verdict === "pass" ? {
     state: "success",
     description: `fleet lockstep ${result.conforming}/${result.denominator} PASS (evaluated ${result.evaluatedAt})`.slice(0, STATUS_DESCRIPTION_MAX)
@@ -16308,7 +16334,7 @@ async function computeFleetLockstepVerdict(gate = runFleetLockstepGate) {
 }
 async function satisfyFleetLockstepContext(run, repo, sha, required, gate) {
   if (!required.includes(FLEET_LOCKSTEP_CONTEXT)) return void 0;
-  const verdict = await computeFleetLockstepVerdict(gate);
+  const verdict = await computeFleetLockstepVerdict(gate, repo);
   let out;
   try {
     out = await run("gh", [
@@ -29012,6 +29038,11 @@ var ENVIRONMENT_BRANCHES = {
   rc: "rc",
   main: "main"
 };
+function classifyEnvironmentDrift(drift) {
+  if (drift.missing) return { environment: drift.environment, action: "CREATE", reason: "environment is missing" };
+  const why = [...drift.problems, ...drift.notes].join("; ");
+  return why ? { environment: drift.environment, action: "UPDATE", reason: why } : { environment: drift.environment, action: "SKIP", reason: "already current" };
+}
 var TRACK_ENVIRONMENT_EXCEPTIONS = {
   direct: { rc: "direct release track has no rc stage" },
   trunk: {
@@ -29050,9 +29081,9 @@ function reviewerKey(reviewer) {
   return `${reviewer.type ?? ""}:${reviewer.id ?? ""}`;
 }
 function environmentDrift(live, desired) {
-  if (!live) return ["environment is missing"];
+  if (!live) return { environment: desired.name, missing: true, problems: ["environment is missing"], notes: [] };
   const problems = [];
-  if (live.wait_timer !== desired.waitTimer) problems.push(`wait_timer=${live.wait_timer ?? "unset"} (want ${desired.waitTimer})`);
+  const notes = [];
   const policy = live.deployment_branch_policy;
   if (policy?.protected_branches !== desired.deploymentBranchPolicy.protectedBranches) {
     problems.push(`protected_branches=${String(policy?.protected_branches)} (want true)`);
@@ -29060,16 +29091,67 @@ function environmentDrift(live, desired) {
   if (policy?.custom_branch_policies !== desired.deploymentBranchPolicy.customBranchPolicies) {
     problems.push(`custom_branch_policies=${String(policy?.custom_branch_policies)} (want false)`);
   }
+  if (live.wait_timer !== desired.waitTimer) notes.push(`wait_timer=${live.wait_timer ?? "unset"} (want ${desired.waitTimer})`);
   const reviewers = (live.reviewers ?? []).map(reviewerKey).sort();
-  if (reviewers.length !== 0) problems.push(`reviewers=${reviewers.join(", ")} (want none)`);
-  return problems;
+  if (reviewers.length !== 0) notes.push(`reviewers=${reviewers.join(", ")} (want none)`);
+  return { environment: desired.name, missing: false, problems, notes };
+}
+function environmentBody(spec) {
+  return {
+    wait_timer: spec.waitTimer,
+    reviewers: spec.reviewers,
+    deployment_branch_policy: {
+      protected_branches: spec.deploymentBranchPolicy.protectedBranches,
+      custom_branch_policies: spec.deploymentBranchPolicy.customBranchPolicies
+    }
+  };
+}
+var PLAN_GATED_PROTECTION_RE = /billing plan/i;
+function isPlanGatedProtectionError(error) {
+  return PLAN_GATED_PROTECTION_RE.test(String(error?.message ?? error));
+}
+async function reconcileRepoEnvironments(repo, releaseTrack, client) {
+  const raw = await client.rest("GET", `repos/${repo}/environments`);
+  const live = new Map(asEnvironmentList(raw).flatMap((entry) => entry.name ? [[entry.name, entry]] : []));
+  const planned = provisionedEnvironmentSpecs(repo, releaseTrack);
+  const created = [];
+  const updated = [];
+  const skipped = [];
+  const planGated = [];
+  for (const spec of planned) {
+    const current = live.get(spec.name);
+    const drift = environmentDrift(current, spec);
+    if (drift.problems.length === 0 && drift.notes.length === 0) {
+      skipped.push(spec.name);
+      continue;
+    }
+    const path2 = `repos/${repo}/environments/${encodeURIComponent(spec.name)}`;
+    let gatedProtections = [];
+    try {
+      await client.rest("PUT", path2, { body: environmentBody(spec) });
+    } catch (error) {
+      if (!isPlanGatedProtectionError(error)) throw error;
+      await client.rest("PUT", path2, {
+        body: {
+          deployment_branch_policy: {
+            protected_branches: spec.deploymentBranchPolicy.protectedBranches,
+            custom_branch_policies: spec.deploymentBranchPolicy.customBranchPolicies
+          }
+        }
+      });
+      gatedProtections = ["wait_timer", "reviewers"];
+    }
+    if (gatedProtections.length) planGated.push({ environment: spec.name, protections: gatedProtections });
+    (current ? updated : created).push(spec.name);
+  }
+  return { repo, planned, created, updated, skipped, planGated };
 }
 async function verifyRepoEnvironments(repo, releaseTrack, client) {
   const raw = await client.rest("GET", `repos/${repo}/environments`);
   const live = new Map(asEnvironmentList(raw).flatMap((entry) => entry.name ? [[entry.name, entry]] : []));
   return provisionedEnvironmentSpecs(repo, releaseTrack).map((spec) => {
-    const problems = environmentDrift(live.get(spec.name), spec);
-    return { environment: spec.name, missing: !live.has(spec.name), problems };
+    const drift = environmentDrift(live.get(spec.name), spec);
+    return { environment: spec.name, missing: !live.has(spec.name), problems: drift.problems, notes: drift.notes };
   });
 }
 
@@ -29320,7 +29402,7 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
     checks.push({
       ok: drift.problems.length === 0,
       label: `repository environment protected: ${drift.environment}`,
-      detail: drift.problems.length ? drift.problems.join("; ") : void 0
+      detail: drift.problems.length ? drift.problems.join("; ") : drift.notes.length ? `advisory: ${drift.notes.join("; ")}` : void 0
     });
   }
   for (const spec of repoEnvironmentSpecs(repo, releaseTrack ?? (repoClass === "content" ? "trunk" : "full")).filter((entry) => entry.exception)) {
@@ -29767,7 +29849,7 @@ function registerBootstrapCommands(program3) {
     }
     if (findings.some((f) => f.state !== "waived")) process.exitCode = 1;
   });
-  bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").addOption(new Option("--class <class>", "deployable | content").default("deployable").choices(["deployable", "content"])).addOption(new Option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).choices([...PROJECT_TYPES])).addOption(new Option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).choices([...DEPLOY_MODELS])).addOption(new Option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).choices([...RELEASE_TRACKS])).option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--only <target>", "deliver ONLY this manifest target (#3818) \u2014 one file, no labels/ruleset/registry writes").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo, cmdOpts) => {
+  bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").addOption(new Option("--class <class>", "deployable | content").default("deployable").choices(["deployable", "content"])).addOption(new Option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).choices([...PROJECT_TYPES])).addOption(new Option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).choices([...DEPLOY_MODELS])).addOption(new Option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).choices([...RELEASE_TRACKS])).option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--only <target>", "deliver ONLY this manifest target (#3818) \u2014 one file, no labels/ruleset/registry writes; or the special target environments (#5035) to run the deployment-environment reconcile alone (dry-run classifies, --execute writes)").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo, cmdOpts) => {
     const o = {
       class: rawValue("--class", "deployable"),
       projectType: rawValue("--project-type", ""),
@@ -29788,6 +29870,45 @@ function registerBootstrapCommands(program3) {
     } catch (e) {
       return fail(`bootstrap apply: ${e.message}`);
     }
+    let effectiveTrack = bootstrapReleaseTrack;
+    if (!o.releaseTrack) {
+      try {
+        const meta = await fetchProjectBySlug(parsedRepo.slug, registryClientDeps(await loadConfig()));
+        effectiveTrack = resolveReleaseTrack(metaWithDeclaredClass(meta, o.class), void 0, repo);
+      } catch {
+      }
+    }
+    if (o.only.trim() === "environments") {
+      const client = defaultGitHubClient();
+      const envJson = { repo, track: effectiveTrack };
+      if (!o.execute) {
+        const drift = await verifyRepoEnvironments(repo, effectiveTrack, client);
+        const classified = drift.map(classifyEnvironmentDrift);
+        envJson.plan = classified;
+        if (o.json) console.log(JSON.stringify(envJson, null, 2));
+        else {
+          console.log(`bootstrap apply --only environments \u2014 dry-run (${repo}, track ${effectiveTrack}); no writes:`);
+          for (const c of classified) console.log(`  ${c.action} ${c.environment} \u2014 ${c.reason}`);
+          console.log("  (plan-gated protections \u2014 wait_timer/reviewers the org plan rejects \u2014 are reported at --execute)");
+        }
+      } else {
+        const envResult = await reconcileRepoEnvironments(repo, effectiveTrack, client);
+        const lines = [];
+        if (envResult.created.length) lines.push(`environments created: ${envResult.created.join(", ")}`);
+        if (envResult.updated.length) lines.push(`environments updated: ${envResult.updated.join(", ")}`);
+        if (envResult.skipped.length) lines.push(`environments current: ${envResult.skipped.join(", ")}`);
+        for (const gated of envResult.planGated) {
+          lines.push(`environment ${gated.environment}: plan-gated protections (${gated.protections.join(", ")} not settable on this org plan \u2014 policy-only provisioned)`);
+        }
+        envJson.result = { created: envResult.created, updated: envResult.updated, skipped: envResult.skipped, planGated: envResult.planGated };
+        if (o.json) console.log(JSON.stringify(envJson, null, 2));
+        else {
+          console.log(`LIVE environments apply to ${repo}:`);
+          lines.forEach((l) => console.log(`  ${l}`));
+        }
+      }
+      return;
+    }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
     if (!(0, import_node_fs38.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
@@ -30037,6 +30158,19 @@ ${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owne
         }
       }
     }
+    if (o.execute && !onlyTarget) {
+      try {
+        const envResult = await reconcileRepoEnvironments(repo, effectiveTrack, defaultGitHubClient());
+        if (envResult.created.length) applied.push(`environments created: ${envResult.created.join(", ")}`);
+        if (envResult.updated.length) applied.push(`environments updated: ${envResult.updated.join(", ")}`);
+        if (envResult.skipped.length) applied.push(`environments current: ${envResult.skipped.join(", ")}`);
+        for (const gated of envResult.planGated) {
+          applied.push(`environment ${gated.environment}: plan-gated protections (${gated.protections.join(", ")} not settable on this org plan \u2014 policy-only provisioned)`);
+        }
+      } catch (e) {
+        applied.push(`environments (failed: ${e.message})`);
+      }
+    }
     if (o.execute && !onlyTarget) {
       for (const l of manifest.labels) {
         try {
@@ -36730,34 +36864,6 @@ var surfaces_default = {
       },
       publishVisibility: "public"
     },
-    {
-      id: "mmi-updater-compat",
-      classification: "packaging",
-      kind: "cli",
-      ownerPath: "packages/updater-compat/package.json",
-      deliveryPath: "packages/updater-compat/package.json",
-      delivery: "npm",
-      applicability: "one-window deprecated @mutmutco/updater / mmi-updater wrapper delegating to the exact coordinated @mutmutco/hub version",
-      versionCoordinated: true,
-      versionPaths: [
-        {
-          path: "packages/updater-compat/package.json",
-          pointer: "version"
-        },
-        {
-          path: "packages/updater-compat/package.json",
-          pointer: "dependencies.@mutmutco/hub"
-        }
-      ],
-      additionalPaths: [
-        "packages/updater-compat/dist"
-      ],
-      artifactIdentity: {
-        kind: "npm-pack",
-        packagePath: "packages/updater-compat"
-      },
-      publishVisibility: "public"
-    },
     {
       id: "mmi-cli-lock",
       classification: "packaging",
@@ -39519,7 +39625,7 @@ withExamples(mutating(
       return fail("worktree create: --claim/--for need an issue-ref argument (e.g. worktree create 2687 --claim)");
     }
     const repoRoot2 = await primaryCheckoutRoot(process.cwd()) ?? process.cwd();
-    const wtPath = o.path ?? defaultWorktreePath(repoRoot2, branch);
+    const wtPath = o.path ? (0, import_node_path46.resolve)(o.path) : defaultWorktreePath(repoRoot2, branch);
     const { base: fallbackBase, fetchBranch, preferRemote } = resolveWorktreeBase(fromRef, o.remote);
     let base = fallbackBase;
     step = `fetch the base ref ${fromRef}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.137.0",
+  "version": "3.139.0",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",