@mutmutco/cli 4.3.35 → 4.3.37

package/dist/main.cjs

@@ -7648,7 +7648,7 @@ function whereLabel(v) {
 function formatFindHits(intent, hits) {
   if (!hits.length) return `no catalog match for "${intent}". Browse with \`mmi-cli vault secrets catalog\`, or run \`mmi-cli vault secrets doctor\` for drift.`;
   const blocks = hits.map((h) => [`${h.key}  (${whereLabel(h)})  \u2014 ${h.purpose}`, `    ${h.command}`].join("\n"));
-  return [`${hits.length} match(es) for "${intent}" (names + meaning only \u2014 consume keyless with \`secrets use\`):`, "", ...blocks].join("\n");
+  return [`${hits.length} match(es) for "${intent}" (names + meaning only \u2014 consume keyless with \`mmi-cli vault secrets use\`):`, "", ...blocks].join("\n");
 }
 function formatCatalog(r) {
   const lines2 = [`catalog \u2014 ${r.count} secret(s) across ${r.groups.length} group(s):`, ""];
@@ -15617,10 +15617,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.3.35",
-    tag: "v4.3.35",
-    commit: "837f809456ec",
-    npm: "@mutmutco/cli@4.3.35"
+    version: "4.3.37",
+    tag: "v4.3.37",
+    commit: "37821457da10",
+    npm: "@mutmutco/cli@4.3.37"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15637,14 +15637,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.3.35"
+          v3Target: "v4.3.37"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.3.35 and redeploy the Hub Lambda from tag v4.3.35 (837f809456ec); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.3.35 (@mutmutco/cli@4.3.35, tag commit 837f809456ec \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.3.37 and redeploy the Hub Lambda from tag v4.3.37 (37821457da10); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.3.37 (@mutmutco/cli@4.3.37, tag commit 37821457da10 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -18112,6 +18112,50 @@ async function enqueueAlignmentAutoMerge(deps, ctx, prNumber, prUrl, openedNote)
   }
   return { ...base, note: manual };
 }
+var ALIGNMENT_LAND_POLL_MS = 15e3;
+var ALIGNMENT_LAND_TIMEOUT_MS = 20 * 6e4;
+async function awaitAlignmentLanded(deps, ctx, leg, base, opts = {}) {
+  if (leg.status !== "pr-pending" || !leg.autoMergeEnqueued || leg.prNumber === void 0) return leg;
+  const sleep2 = resolveSleep(deps);
+  const now = deps.now ?? Date.now;
+  const startedAt = now();
+  const timeoutMs = opts.timeoutMs ?? ALIGNMENT_LAND_TIMEOUT_MS;
+  const n = leg.prNumber;
+  deps.warn?.(`watching alignment PR #${n} (${ctx.repo}) until it lands on ${base}`);
+  for (; ; ) {
+    let view;
+    try {
+      view = JSON.parse(await deps.run("gh", ["pr", "view", String(n), "--repo", ctx.repo, "--json", "state,mergeCommit"]));
+    } catch (e) {
+      deps.warn?.(`alignment PR #${n}: read failed (${describeReadError(e)}) \u2014 retrying`);
+    }
+    if (view?.state === "MERGED") {
+      const oid = typeof view.mergeCommit?.oid === "string" ? view.mergeCommit.oid : void 0;
+      let parents;
+      if (oid) {
+        try {
+          parents = Number(clean2(await deps.run("gh", ["api", `repos/${ctx.repo}/commits/${oid}`, "--jq", ".parents | length"])));
+        } catch {
+          parents = void 0;
+        }
+      }
+      if (parents === 1) {
+        const squashNote = `alignment PR #${n} landed as a SQUASH (${oid?.slice(0, 12)} has one parent), not the true merge the Merge floor requires \u2014 re-align ${base} by true merge before the next train`;
+        deps.warn?.(squashNote);
+        return { ...leg, note: `${leg.note} \u2014 ${squashNote}` };
+      }
+      return { status: "aligned", alignment: "already-merged", prNumber: n, ...leg.prUrl ? { prUrl: leg.prUrl } : {}, note: `alignment PR #${n} landed on ${base} by true merge (watched)` };
+    }
+    if (view?.state === "CLOSED") {
+      return { ...leg, note: `${leg.note} \u2014 alignment PR #${n} was CLOSED without merging; rerun the roll-forward` };
+    }
+    if (now() - startedAt >= timeoutMs) {
+      deps.warn?.(`alignment PR #${n} still open after ${Math.round(timeoutMs / 6e4)}m \u2014 leaving the alignment leg pending; fold it later with mmi-cli devops release --resume --watch`);
+      return leg;
+    }
+    await sleep2(ALIGNMENT_LAND_POLL_MS);
+  }
+}
 async function alignRcForward(deps, ctx, tag) {
   await runGitRemoteRead(deps, ["fetch", "origin", "main", "rc"]);
   const required = await discoverRequiredCheckContexts(deps, ctx, "rc");
@@ -21625,6 +21669,17 @@ async function runTrainDoctor(input) {
       } catch (e) {
         add({ code: "contexts-not-tag-addressable", severity: "blocker", source: "local", title: `required ${stage} check(s) cannot materialize on a tag push (#5428)`, remedy: message(e) });
       }
+      if (startBranch) {
+        const tip = await git3(["rev-parse", "--verify", "--quiet", `refs/remotes/origin/${startBranch}`]);
+        const checkRuns = JSON.parse(await train.run("gh", ["api", `repos/${repo}/commits/${tip}/check-runs`, "--jq", TRAIN_CHECK_RUNS_JQ]));
+        const statuses = JSON.parse(await train.run("gh", ["api", `repos/${repo}/commits/${tip}/status`, "--jq", TRAIN_COMMIT_STATUS_JQ]));
+        const observed = required.filter((c) => checkRuns.some((r) => r.name === c) || statuses.some((s) => s.context === c));
+        const red = observed.filter((c) => resolveContextState(c, checkRuns, statuses) === "failed");
+        const inFlight = observed.filter((c) => resolveContextState(c, checkRuns, statuses) === "pending");
+        const at = `${startBranch}@${tip.slice(0, 12)}`;
+        if (red.length) add({ code: "required-check-red", severity: "blocker", source: "origin", title: `required ${stage} check(s) failed on the lane's start branch tip: ${red.join(", ")} at ${at}`, remedy: `--heal never clears this one \u2014 a red trunk needs a fix, not a heal: land the failure's fix on ${startBranch} through a CI-gated PR, then rerun once its run is green (#6461)` });
+        else if (inFlight.length) add({ code: "required-check-red", severity: "warning", source: "origin", title: `required ${stage} check(s) still in flight on the lane's start branch tip: ${inFlight.join(", ")} at ${at}`, remedy: `wait for the run to conclude and rerun \u2014 the tip's verdict is not known yet, and the train would tag before it is` });
+      }
     }
   } catch (e) {
     unverified(`required status checks on ${stage}`, e);
@@ -22473,7 +22528,7 @@ async function recordRcandDeployLegs(ledger, deps, anchors, deployModel, d, opts
   await recordPhase(ledger, deps, anchors, "alignment", phaseEntry({ state: "skipped", sha, note: "rcand aligns no branch \u2014 alignment rides the release" }), { ...opts, landed });
   return dispatch;
 }
-async function completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha, startBranch, preFold, tagProbe, branchHints, ledger) {
+async function completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha, startBranch, preFold, tagProbe, branchHints, ledger, alignEarly) {
   const resumeCommand = options.dev ? "mmi-cli devops release --dev --apply" : "mmi-cli devops release --apply";
   const ledgerAnchors = { repo: ctx.repo, tag, tagSha: releaseSha };
   try {
@@ -22578,6 +22633,7 @@ ${recovery.note}`), recoveryInput);
   await verifyPublishedRelease(deps, ctx.repo, tag, "main", releaseSha);
   await recordPhase(ledger, deps, ledgerAnchors, "githubRelease", phaseEntry({ state: "complete", sha: releaseSha, runUrl: releaseUrl, note: `verified GitHub Release ${tag} against ${releaseSha.slice(0, 12)}` }), { landed: "the immutable tag, the green required-check wall, and the origin/main fast-forward" });
   const announceNote = deps.announce ? (await deps.announce({ repo: ctx.repo, tag, summaryFile: options.announceSummaryFile })).note : void 0;
+  let alignment = alignEarly ? await alignEarly() : void 0;
   const autoRunSince = (deps.now ?? Date.now)();
   const deployDispatch0 = await dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, releaseSha, "report", meta.publishDir);
   const deployRunRepo = releaseRunRepoFor(deployModel, ctx.repo);
@@ -22622,7 +22678,13 @@ ${recovery.note}`), recoveryInput);
   });
   let dispatch = appendPublishDispatch(deployDispatch, publishDispatch);
   if (publishSkipNote) dispatch = { ...dispatch, note: `${dispatch.note}; tenant-publish.yml skipped (${publishSkipNote})` };
-  return { checks, releaseUrl, announceNote, dispatch, ledgerAnchors };
+  if (watch && alignment) {
+    alignment = {
+      dev: await awaitAlignmentLanded(deps, ctx, alignment.dev, "development"),
+      ...alignment.rc ? { rc: await awaitAlignmentLanded(deps, ctx, alignment.rc, "rc") } : {}
+    };
+  }
+  return { checks, releaseUrl, announceNote, dispatch, ledgerAnchors, ...alignment ? { alignment } : {} };
 }
 function resumeStateOf(status) {
   return status === "complete" ? "aligned" : status;
@@ -23010,6 +23072,8 @@ ${recovery.note}`), recoveryInput);
   steps.push("verified the Release published against the tagged commit");
   await recordPhase(ledger, deps, anchors, "githubRelease", phaseEntry({ state: "complete", sha: tagSha, runUrl: releaseUrl, note: "verified the Release published against the tagged commit" }), { strict: ledgerMode === "strict", landed: "the immutable tag, the re-proven wall, and the origin/main push" });
   const announceNote = deps.announce ? (await deps.announce({ repo: ctx.repo, tag, summaryFile: options.announceSummaryFile })).note : void 0;
+  let devRollForward = await rollDevelopmentForward(deps, ctx, tag);
+  let rcAlignment = !directTrack && branchHints.hasRcBranch ? await alignRcForward(deps, ctx, tag) : void 0;
   const autoRunSince = (deps.now ?? Date.now)();
   const deployDispatch0 = await dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, tagSha, "report", meta.publishDir);
   const recoveredDeployDispatch = await recoverFailedDispatchPhase(
@@ -23045,9 +23109,11 @@ ${recovery.note}`), recoveryInput);
     landed: "the immutable tag, the re-proven wall, origin/main, the verified GitHub Release, and the dispatched deploy path"
   });
   const dispatch = appendPublishDispatch(deployDispatch, publishDispatch);
-  const devRollForward = await rollDevelopmentForward(deps, ctx, tag);
+  if (watch) {
+    devRollForward = await awaitAlignmentLanded(deps, ctx, devRollForward, "development");
+    if (rcAlignment) rcAlignment = await awaitAlignmentLanded(deps, ctx, rcAlignment, "rc");
+  }
   steps.push(`development roll-forward: ${devRollForward.status}`);
-  const rcAlignment = !directTrack && branchHints.hasRcBranch ? await alignRcForward(deps, ctx, tag) : void 0;
   if (rcAlignment) steps.push(`rc alignment: ${rcAlignment.status}`);
   const followUp = deriveTrainFollowUpStatus({
     projectInfo: "ok",
@@ -23388,9 +23454,25 @@ ${spent.note}`), rcandRecovery(tag2));
       const releaseSha3 = requireValue(clean2(await deps.run("git", ["rev-parse", "main"])), "release sha");
       return { versionFold: versionFold3, releaseSha: releaseSha3 };
     });
-    const { checks: checks2, releaseUrl: releaseUrl2, announceNote: announceNote2, dispatch: d2, ledgerAnchors: ledgerAnchors2 } = await completeMainRelease(deps, ctx, meta, deployModel2, watch, options, tag2, releaseSha2, "development", preFold2, tagProbe2, branchHints, ledger);
-    const devRollForward2 = await rollDevelopmentForward(deps, ctx, tag2);
-    await recordPhase(ledger, deps, ledgerAnchors2, "alignment", phaseEntry(alignmentPhaseEntry(devRollForward2)), { landed: "the immutable tag, the green wall, origin/main, the verified Release, and the deploy/publish path" });
+    const { checks: checks2, releaseUrl: releaseUrl2, announceNote: announceNote2, dispatch: d2, ledgerAnchors: ledgerAnchors2, alignment: alignment2 } = await completeMainRelease(
+      deps,
+      ctx,
+      meta,
+      deployModel2,
+      watch,
+      options,
+      tag2,
+      releaseSha2,
+      "development",
+      preFold2,
+      tagProbe2,
+      branchHints,
+      ledger,
+      // #6468: alignment PRs open before the publish wait; rc aligns only on the --dev lane of a repo that has one.
+      async () => ({ dev: await rollDevelopmentForward(deps, ctx, tag2), ...!directTrack && hasRcBranch ? { rc: await alignRcForward(deps, ctx, tag2) } : {} })
+    );
+    const devRollForward2 = alignment2?.dev ?? await rollDevelopmentForward(deps, ctx, tag2);
+    await recordPhase(ledger, deps, ledgerAnchors2, "alignment", phaseEntry(alignmentPhaseEntry(devRollForward2, alignment2?.rc)), { landed: "the immutable tag, the green wall, origin/main, the verified Release, and the deploy/publish path" });
     const ledgerReport2 = releaseLedgerReport(await ledger?.load(ledgerAnchors2).catch(() => void 0), ledger?.path ?? "(no ledger)");
     if (directTrack) {
       return {
@@ -23419,8 +23501,7 @@ ${spent.note}`), rcandRecovery(tag2));
       };
     }
     const retirement2 = hasRcBranch ? await retireRcRuntime(deps, ctx, deployModel2, d2.deployStatus, rcShaAtRelease) : { status: "not-applicable", note: "no origin/rc branch \u2014 rc runtime retirement skipped" };
-    const rcAlignment2 = hasRcBranch ? await alignRcForward(deps, ctx, tag2) : void 0;
-    await recordPhase(ledger, deps, ledgerAnchors2, "alignment", phaseEntry(alignmentPhaseEntry(devRollForward2, rcAlignment2)), { landed: "the immutable tag, the green wall, origin/main, the verified Release, and the deploy/publish path" });
+    const rcAlignment2 = alignment2?.rc;
     const fullLedgerReport = releaseLedgerReport(await ledger?.load(ledgerAnchors2).catch(() => void 0), ledger?.path ?? "(no ledger)");
     const environments2 = await buildEnvironments(deps, ctx, deployModel2, d2.deployStatus, retirement2);
     return {
@@ -23482,10 +23563,26 @@ ${spent.note}`), rcandRecovery(tag2));
     const releaseSha2 = requireValue(clean2(await deps.run("git", ["rev-parse", "main"])), "release sha");
     return { versionFold: versionFold2, releaseSha: releaseSha2 };
   });
-  const { checks, releaseUrl, announceNote, dispatch: d, ledgerAnchors } = await completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha, "rc", preFold, tagProbe, branchHints, ledger);
+  const { checks, releaseUrl, announceNote, dispatch: d, ledgerAnchors, alignment } = await completeMainRelease(
+    deps,
+    ctx,
+    meta,
+    deployModel,
+    watch,
+    options,
+    tag,
+    releaseSha,
+    "rc",
+    preFold,
+    tagProbe,
+    branchHints,
+    ledger,
+    // #6468: both alignment PRs open before the publish wait.
+    async () => ({ dev: await rollDevelopmentForward(deps, ctx, tag), rc: await alignRcForward(deps, ctx, tag) })
+  );
   const retirement = await retireRcRuntime(deps, ctx, deployModel, d.deployStatus, releasedRcSha);
-  const devRollForward = await rollDevelopmentForward(deps, ctx, tag);
-  const rcAlignment = await alignRcForward(deps, ctx, tag);
+  const devRollForward = alignment?.dev ?? await rollDevelopmentForward(deps, ctx, tag);
+  const rcAlignment = alignment?.rc ?? await alignRcForward(deps, ctx, tag);
   await recordPhase(ledger, deps, ledgerAnchors, "alignment", phaseEntry(alignmentPhaseEntry(devRollForward, rcAlignment)), { landed: "the immutable tag, the green wall, origin/main, the verified Release, and the deploy/publish path" });
   const ledgerReport = releaseLedgerReport(await ledger?.load(ledgerAnchors).catch(() => void 0), ledger?.path ?? "(no ledger)");
   const environments = await buildEnvironments(deps, ctx, deployModel, d.deployStatus, retirement);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.3.35",
+  "version": "4.3.37",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",