@mutmutco/cli 4.3.40 → 4.3.41

package/dist/main.cjs

@@ -14099,7 +14099,7 @@ function expectedHosts(cfg) {
   if (cfg.fofuSubdomain !== void 0) {
     out.push(cfg.fofuSubdomain ? `${cfg.fofuSubdomain}.fofu.ai` : "fofu.ai");
   }
-  return uniq(out);
+  return uniq([...out, ...cfg.edgeHosts ?? []]);
 }
 function expectedJsOrigins(cfg) {
   return uniq([...expectedHosts(cfg).map((h) => `https://${h}`), ...LOOPBACK]);
@@ -14166,7 +14166,7 @@ function parseOauthConfig(mmiConfig, slug) {
   const meta = mmiConfig ?? {};
   const rawFofuSub = raw.fofuSubdomain;
   const fofuSubdomain = meta.fofuEnabled === true ? typeof rawFofuSub === "string" ? rawFofuSub : defaultSubdomain(slug) : void 0;
-  return { subdomains, domains, callbackPath, extraCallbackPaths, fofuSubdomain };
+  return { subdomains, domains, callbackPath, extraCallbackPaths, fofuSubdomain, edgeHosts: Object.values(edgeDomainsByStage(mmiConfig)) };
 }
 function probeRedirectUri(callbackPath, port = 9123) {
   return `http://localhost:${port}${callbackPath}`;
@@ -14185,6 +14185,20 @@ function buildAuthorizeProbeUrl(clientId, redirectUri) {
 function authorizeBodyHasMismatch(body) {
   return /redirect_uri_mismatch/i.test(body);
 }
+async function probeOauthRedirects(cfg, clientId, request = fetch) {
+  const uris = uniq([probeRedirectUri(cfg.callbackPath), ...expectedRedirectUris(cfg)]);
+  const signal = AbortSignal.timeout(1e4);
+  const results = [];
+  for (let i = 0; i < uris.length; i += 4) {
+    results.push(...await Promise.all(uris.slice(i, i + 4).map(async (redirectUri) => {
+      const response = await request(buildAuthorizeProbeUrl(clientId, redirectUri), { redirect: "follow", signal });
+      const mismatch = authorizeBodyHasMismatch(await response.text());
+      if (!mismatch && !response.ok) throw new Error(`authorize probe returned HTTP ${response.status}`);
+      return { redirectUri, mismatch };
+    })));
+  }
+  return results;
+}
 
 // src/project-runtime.ts
 function hasRuntimeSecretContract(contract) {
@@ -15694,10 +15708,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.3.40",
-    tag: "v4.3.40",
-    commit: "487948fabf28",
-    npm: "@mutmutco/cli@4.3.40"
+    version: "4.3.41",
+    tag: "v4.3.41",
+    commit: "02cc438cfbf4",
+    npm: "@mutmutco/cli@4.3.41"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15714,14 +15728,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.3.40"
+          v3Target: "v4.3.41"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.3.40 and redeploy the Hub Lambda from tag v4.3.40 (487948fabf28); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.3.40 (@mutmutco/cli@4.3.40, tag commit 487948fabf28 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.3.41 and redeploy the Hub Lambda from tag v4.3.41 (02cc438cfbf4); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.3.41 (@mutmutco/cli@4.3.41, tag commit 02cc438cfbf4 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -45559,22 +45573,22 @@ oauth.command("verify").description("probe Google authorize with an arbitrary po
     return failGraceful("org oauth verify: no client_id (pass --client-id, or provision the repo so GOOGLE_CLIENT_ID exists)");
   }
   const redirectUri = probeRedirectUri(oc.callbackPath);
-  let body = "";
+  let probes;
   try {
-    const res = await fetch(buildAuthorizeProbeUrl(clientId, redirectUri), { redirect: "follow", signal: AbortSignal.timeout(1e4) });
-    body = await res.text();
+    probes = await probeOauthRedirects(oc, clientId);
   } catch (e) {
     return failGraceful(`org oauth verify: probe request failed: ${e.message}`);
   }
-  const mismatch = authorizeBodyHasMismatch(body);
+  const portAgnostic = !probes[0].mismatch;
+  const mismatches = probes.filter((probe) => probe.mismatch);
   if (o.json) {
-    console.log(JSON.stringify({ slug, redirectUri, portAgnostic: !mismatch }));
-  } else if (mismatch) {
-    console.error(`FAIL ${slug}: redirect_uri_mismatch for ${redirectUri} \u2014 client is not port-agnostic (run /oauth-provision)`);
+    console.log(JSON.stringify({ slug, redirectUri, portAgnostic, probes }));
+  } else if (mismatches.length) {
+    for (const probe of mismatches) console.error(`FAIL ${slug}: redirect_uri_mismatch for ${probe.redirectUri} \u2014 run /oauth-provision`);
   } else {
-    console.log(`PASS ${slug}: ${redirectUri} accepted \u2014 port-agnostic OAuth is live`);
+    console.log(`PASS ${slug}: no redirect_uri_mismatch across ${probes.length} callbacks, including the arbitrary-port loopback`);
   }
-  if (mismatch) process.exitCode = 1;
+  if (mismatches.length) process.exitCode = 1;
 });
 registerCollaborationCommands(program2);
 function ciAuditDeps2() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.3.40",
+  "version": "4.3.41",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",