@mutmutco/cli 4.0.14 → 4.0.16

package/dist/main.cjs

@@ -10832,10 +10832,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.0.14",
-    tag: "v4.0.14",
-    commit: "386f339f67c6",
-    npm: "@mutmutco/cli@4.0.14"
+    version: "4.0.16",
+    tag: "v4.0.16",
+    commit: "ac03c4999cb4",
+    npm: "@mutmutco/cli@4.0.16"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -10852,14 +10852,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.0.14"
+          v3Target: "v4.0.16"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.0.14 and redeploy the Hub Lambda from tag v4.0.14 (386f339f67c6); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.0.14 (@mutmutco/cli@4.0.14, tag commit 386f339f67c6 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.0.16 and redeploy the Hub Lambda from tag v4.0.16 (ac03c4999cb4); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.0.16 (@mutmutco/cli@4.0.16, tag commit ac03c4999cb4 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -13926,8 +13926,39 @@ async function isStrayUnreleasedTag(deps, tag, remoteSha, repo) {
   }
   return deps.run("gh", ["release", "view", tag, "--repo", repo, "--json", "tagName"]).then(() => false).catch((e) => /not found|HTTP 404/i.test(e instanceof Error ? e.message : String(e)));
 }
+function cmpReleaseTag(a, b) {
+  const parse = (t) => {
+    const m = /^v(\d+)\.(\d+)\.(\d+)$/.exec(t.trim());
+    return m ? { major: +m[1], minor: +m[2], patch: +m[3] } : null;
+  };
+  const left = parse(a);
+  const right = parse(b);
+  if (!left || !right) throw new Error(`cmpReleaseTag expects vX.Y.Z tags, got ${a} vs ${b}`);
+  return left.major - right.major || left.minor - right.minor || left.patch - right.patch;
+}
+async function listRemoteReleaseTags(deps) {
+  const out = await runGitRemoteRead(deps, ["ls-remote", "--tags", "origin", "refs/tags/v*"]);
+  const tags = /* @__PURE__ */ new Set();
+  for (const line of clean2(out).split("\n")) {
+    const ref = line.trim().split(/\s+/)[1] ?? "";
+    const tag = ref.replace(/^refs\/tags\//, "").replace(/\^\{\}$/, "");
+    if (/^v\d+\.\d+\.\d+$/.test(tag)) tags.add(tag);
+  }
+  return [...tags].sort(cmpReleaseTag);
+}
+async function assertComputedReleaseTagStillNext(deps, tag) {
+  if (!/^v\d+\.\d+\.\d+$/.test(tag)) return;
+  const remote = await listRemoteReleaseTags(deps);
+  const newer = remote.filter((t) => cmpReleaseTag(t, tag) > 0);
+  if (newer.length === 0) return;
+  const latest = newer[newer.length - 1];
+  throw new Error(
+    `origin already has release tag ${latest} ahead of this run's computed ${tag} \u2014 another /release landed mid-flight. Refusing to mint a skip-version or hole-fill tag. Stop; let the other train finish (or abort its stray tag/Release with the authorized human's go if verify failed), then rerun mmi-cli devops release --apply so next-version re-derives from the settled tags. Do not run two /release trains on the same repo concurrently.`
+  );
+}
 async function ensureTagPushed(deps, tag, sha, probed, releaseRepo) {
-  const remoteSha = probed ? probed.remoteSha : await probeRemoteTag(deps, tag);
+  const remoteSha = await probeRemoteTag(deps, tag);
+  const planRemoteSha = probed?.remoteSha ?? "";
   let localSha = "";
   try {
     localSha = clean2(await deps.run("git", ["rev-parse", "--verify", `refs/tags/${tag}^{commit}`]));
@@ -13936,6 +13967,11 @@ async function ensureTagPushed(deps, tag, sha, probed, releaseRepo) {
   if (remoteSha) {
     if (remoteSha !== sha) {
       const mismatch = `tag ${tag} already exists on origin at ${remoteSha}, but this run intends ${sha}`;
+      if (!planRemoteSha && releaseRepo) {
+        throw new Error(
+          `${mismatch}. The tag appeared on origin while this train was promoting \u2014 another /release claimed this version mid-flight. Refusing to mint a competing or skip-version tag. Stop; let the other train finish, or if its tag/Release is a stray (publish verify failed, tagged SHA lacks the fold commit), delete that stray tag and its GitHub Release with the authorized human's go, then rerun mmi-cli devops release --apply. Do not start a second /release while one is still folding or tagging.`
+        );
+      }
       if (releaseRepo && await isStrayUnreleasedTag(deps, tag, remoteSha, releaseRepo)) {
         throw new Error(
           `${mismatch}. The existing tag is not reachable from origin/main and has no GitHub Release \u2014 it was pushed outside the train, not by a completed release. Sanctioned recovery: delete the stray tag (git push origin --delete ${tag}; git tag -d ${tag} if it exists locally), check the repo's Actions for any workflow the stray tag already triggered, then rerun mmi-cli devops release --apply (if a publish already ran off the stray tag, mint the next version instead of reusing this one). Never complete the release by hand \u2014 a manual GitHub Release or branch push bypasses the train and leaves main behind.`
@@ -14610,6 +14646,7 @@ async function completeMainRelease(deps, ctx, meta, deployModel, watch, options,
   }
   let tagPush;
   try {
+    await assertComputedReleaseTagStillNext(deps, tag);
     tagPush = await ensureTagPushed(deps, tag, releaseSha, tagProbe, ctx.repo);
   } catch (e) {
     throw await recoverFailedFold(deps, e, startBranch, preFold.mainSha, resumeCommand);
@@ -17194,7 +17231,12 @@ async function runStage(config = {}, opts = {}) {
   const ranBuild = Boolean(build);
   try {
     await ensureStageRuntimeEnv(config, opts, cwd);
-    if (build) await shell(sub(build), cwd, timeoutMs, stageProcessEnv(stagePort, extraEnv));
+    if (build) {
+      await shell(sub(build), cwd, timeoutMs, {
+        ...stageProcessEnv(stagePort, extraEnv),
+        ...opts.buildEnvMerge ?? {}
+      });
+    }
   } catch (e) {
     (0, import_node_fs16.rmSync)(statePath2, { force: true });
     if (globalStatePath && globalStatePath !== statePath2) (0, import_node_fs16.rmSync)(globalStatePath, { force: true });
@@ -29221,6 +29263,85 @@ async function runStageLiveDown(deps, t) {
   };
 }
 
+// src/stage-build-secrets.ts
+var GITHUB_PACKAGES_TOKEN_REF = "@github-packages-token";
+var ENV_ID_RE = /^[A-Z_][A-Z0-9_]*$/;
+var BARE_VAULT_KEY_RE = /^[A-Z_][A-Z0-9_]*$/;
+var CROSS_SLUG_REF_RE = /^(?:mm-fofu|_org\/[a-z0-9][a-z0-9-]*):[A-Z_][A-Z0-9_]*$/;
+function parseStageBuildSecretEntry(entry) {
+  const trimmed = entry.trim();
+  if (!trimmed) return null;
+  const eq = trimmed.indexOf("=");
+  if (eq === -1) {
+    if (!BARE_VAULT_KEY_RE.test(trimmed) && !CROSS_SLUG_REF_RE.test(trimmed)) return null;
+    const envKey2 = trimmed.includes(":") ? trimmed.slice(trimmed.lastIndexOf(":") + 1) : trimmed;
+    return { envKey: envKey2, ref: trimmed };
+  }
+  const envKey = trimmed.slice(0, eq);
+  const ref = trimmed.slice(eq + 1);
+  if (!ENV_ID_RE.test(envKey) || !ref) return null;
+  if (ref === GITHUB_PACKAGES_TOKEN_REF) return { envKey, ref };
+  if (!BARE_VAULT_KEY_RE.test(ref) && !CROSS_SLUG_REF_RE.test(ref)) return null;
+  return { envKey, ref };
+}
+async function resolveStageBuildSecrets(input) {
+  const entries = input.requiredBuildSecrets;
+  if (!entries?.length) return {};
+  const env = input.env ?? process.env;
+  const out = {};
+  const missing = [];
+  for (const raw of entries) {
+    const parsed = parseStageBuildSecretEntry(raw);
+    if (!parsed) {
+      missing.push(`${raw} (malformed requiredBuildSecrets entry)`);
+      continue;
+    }
+    const { envKey, ref } = parsed;
+    const fromEnv = env[envKey];
+    if (typeof fromEnv === "string" && fromEnv.length > 0) {
+      out[envKey] = fromEnv;
+      continue;
+    }
+    if (ref === GITHUB_PACKAGES_TOKEN_REF) {
+      const fromVault = await input.fetchVault(envKey);
+      if (fromVault) {
+        out[envKey] = fromVault;
+        continue;
+      }
+      missing.push(
+        `${envKey}=${GITHUB_PACKAGES_TOKEN_REF} (central deploy mints this; local /stage needs process env ${envKey} or a stageless project vault secret ${envKey} \u2014 a GitHub PAT with read:packages for npm.pkg.github.com; declare+set via vault secrets, never commit the value)`
+      );
+      continue;
+    }
+    const vault = await fetchVaultRef(input.fetchVault, ref);
+    if (vault) {
+      out[envKey] = vault;
+      continue;
+    }
+    missing.push(
+      `${envKey}=${ref} (not in process env and vault read returned nothing \u2014 declare+set the stageless secret, or export ${envKey} before mmi-cli stage run --apply)`
+    );
+  }
+  if (missing.length) {
+    throw new Error(
+      `stage build secrets unresolved: ${missing.join("; ")}. Compose BuildKit mounts (e.g. NODE_AUTH_TOKEN) read the build process env only.`
+    );
+  }
+  return out;
+}
+async function fetchVaultRef(fetchVault, ref) {
+  const colon = ref.indexOf(":");
+  if (colon === -1) return fetchVault(ref);
+  const prefix = ref.slice(0, colon);
+  const key = ref.slice(colon + 1);
+  if (prefix === "mm-fofu") return fetchVault(key, { slug: "mm-fofu" });
+  if (prefix.startsWith("_org/")) {
+    const provider = prefix.slice("_org/".length);
+    return fetchVault(`${provider}/${key}`, { slug: "_org" });
+  }
+  return null;
+}
+
 // src/stage-commands.ts
 function registerStageCommands(program3) {
   function stagePortFromArgv() {
@@ -29270,6 +29391,30 @@ function registerStageCommands(program3) {
     }
     return Object.keys(merge).length ? merge : void 0;
   }
+  async function fetchStageBuildEnvMerge() {
+    const cfg = await loadConfig();
+    if (!cfg.sagaApiUrl) return void 0;
+    const read = await fetchProjectBySlugChecked(await repoSlug(), registryClientDeps(cfg)).catch(() => null);
+    if (!read?.ok || !read.project) return void 0;
+    const required = read.project.requiredBuildSecrets;
+    if (!required?.length) return void 0;
+    const d = makeSecretsDeps(cfg);
+    const merge = await resolveStageBuildSecrets({
+      requiredBuildSecrets: required,
+      fetchVault: (key, opts) => fetchSecretValue(d, key, opts ?? {})
+    });
+    return Object.keys(merge).length ? merge : void 0;
+  }
+  async function stageVaultOpts() {
+    const [vaultEnvMerge, buildEnvMerge] = await Promise.all([
+      fetchStageVaultEnvMerge(),
+      fetchStageBuildEnvMerge()
+    ]);
+    return {
+      ...vaultEnvMerge ? { vaultEnvMerge } : {},
+      ...buildEnvMerge ? { buildEnvMerge } : {}
+    };
+  }
   function stageStepsFor(res, stops = true) {
     if (res.source === "derived" && res.derived) return derivedStagePlan(res.derived, shellFor(), stops);
     return [{ label: `no local stage to run \u2014 ${res.gap ?? "stage config gap"}` }];
@@ -29367,7 +29512,8 @@ function registerStageCommands(program3) {
       const cfg = res.derived.config;
       const hold = stageKeepAlive();
       try {
-        const result = await runStage(cfg, stageScopedRunOpts({ timeoutMs: o.timeoutMs }));
+        const vaultOpts = await stageVaultOpts();
+        const result = await runStage(cfg, { ...stageScopedRunOpts({ timeoutMs: o.timeoutMs }), ...vaultOpts });
         const reportUrl = reportedStageUrl(res, result);
         const url = reportUrl ? ` \u2014 ${reportUrl}` : "";
         return printLine(o.json ? JSON.stringify({ ...result, source: res.source, url: reportUrl }) : `mmi-cli stage: ${result.message}${url}`);
@@ -29437,14 +29583,14 @@ function registerStageCommands(program3) {
     }
     if (res.source === "none") return failGraceful(`stage run: ${res.gap}`);
     const cfg = res.derived.config;
-    const vaultEnvMerge = await fetchStageVaultEnvMerge();
+    const vaultOpts = await stageVaultOpts();
     try {
       const hold = stageKeepAlive();
       let printed = false;
       try {
         const result = await runStage(cfg, {
           ...stageScopedRunOpts({ timeoutMs: o.timeoutMs, allowStaleEnv: o.allowStaleEnv }),
-          vaultEnvMerge,
+          ...vaultOpts,
           onReady: (ready) => {
             const reportUrl = reportedStageUrl(res, ready);
             const url = reportUrl ? ` \u2014 ${reportUrl}` : "";
@@ -29662,13 +29808,13 @@ async function resolveBoardAdvanceForPr(prNumber, repoOption) {
     },
     // #5317: after a successful move, re-read the board to verify Done actually holds — a move the API
     // reported but the board did not reflect is named as left behind, never silently dropped.
+    // #5358: verify against the item DIRECTLY (fetchIssueProjectItem, the same read `board show` uses),
+    // never the active-board view — a just-Done item has already left the buckets readBoard partitions,
+    // so a board-view lookup reports every successful advance as "not found".
     readIssueStatus: async (ref) => {
-      const number = Number(ref.replace(/^#/, ""));
-      if (!Number.isInteger(number) || number <= 0 || !repo) return { error: `unusable ref ${ref}` };
       try {
-        const board = await readBoard({ config: await loadConfigForBoardSelector2(ref, repoOption), repo: repoOption });
-        const buckets = [...board.primary.userOwned, ...board.primary.claimable, ...board.primary.taken, ...board.primary.unownedInFlight, ...board.secondary.userOwned, ...board.secondary.claimable, ...board.secondary.taken, ...board.secondary.unownedInFlight];
-        const item = buckets.find((candidate2) => candidate2.repository.toLowerCase() === repo.toLowerCase() && candidate2.number === number);
+        const cfg = resolveBoardConfig(await loadConfigForBoardSelector2(ref, repoOption));
+        const { item } = await fetchIssueProjectItem(defaultGitHubClient(), cfg, parseIssueSelector(ref, repo));
         return item ? { status: item.status } : { error: `issue ${ref} not found on the board after advance` };
       } catch (e) {
         return { error: e.message };
@@ -33854,7 +34000,27 @@ var surfaces_default = {
         kind: "npm-pack",
         packagePath: "updater"
       },
-      publishVisibility: "public"
+      publishVisibility: "public",
+      prepare: [
+        {
+          command: "npm",
+          args: [
+            "--prefix",
+            "updater",
+            "run",
+            "build"
+          ],
+          inputs: [
+            "updater/src",
+            "updater/build.mjs",
+            "updater/package.json",
+            "updater/tsconfig.json"
+          ],
+          outputs: [
+            "updater/dist/index.cjs"
+          ]
+        }
+      ]
     },
     {
       id: "mmi-cli-lock",
@@ -38297,11 +38463,12 @@ registerStageCommands(program2);
 var GH_TRAIN_TIMEOUT_MS = 3e4;
 var GH_RUN_WATCH_TIMEOUT_MS = 20 * 6e4;
 var NODE_PREPARE_TIMEOUT_MS = 10 * 6e4;
+var NODE_VERIFY_TIMEOUT_MS = 5 * 6e4;
 var NPM_TRAIN_TIMEOUT_MS = 6e4;
 function trainApplyDeps() {
   return {
     run: async (file, args) => {
-      const timeout = file === "node" && args[1] === "prepare" ? NODE_PREPARE_TIMEOUT_MS : file === "npm" ? NPM_TRAIN_TIMEOUT_MS : file !== "gh" ? GIT_TIMEOUT_MS : args[0] === "run" && args[1] === "watch" ? GH_RUN_WATCH_TIMEOUT_MS : GH_TRAIN_TIMEOUT_MS;
+      const timeout = file === "node" && args[1] === "prepare" ? NODE_PREPARE_TIMEOUT_MS : file === "node" && args[1] === "verify" ? NODE_VERIFY_TIMEOUT_MS : file === "npm" ? NPM_TRAIN_TIMEOUT_MS : file !== "gh" ? GIT_TIMEOUT_MS : args[0] === "run" && args[1] === "watch" ? GH_RUN_WATCH_TIMEOUT_MS : GH_TRAIN_TIMEOUT_MS;
       try {
         return isWin2 && file === "npm" ? (await execFileP2("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP2(file, args, { timeout })).stdout;
       } catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.0.14",
+  "version": "4.0.16",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",