@mutmutco/cli 4.3.42 → 4.3.43

package/dist/main.cjs

@@ -15710,10 +15710,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.3.42",
-    tag: "v4.3.42",
-    commit: "d890700b4096",
-    npm: "@mutmutco/cli@4.3.42"
+    version: "4.3.43",
+    tag: "v4.3.43",
+    commit: "120c58230cfc",
+    npm: "@mutmutco/cli@4.3.43"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15730,14 +15730,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.3.42"
+          v3Target: "v4.3.43"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.3.42 and redeploy the Hub Lambda from tag v4.3.42 (d890700b4096); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.3.42 (@mutmutco/cli@4.3.42, tag commit d890700b4096 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.3.43 and redeploy the Hub Lambda from tag v4.3.43 (120c58230cfc); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.3.43 (@mutmutco/cli@4.3.43, tag commit 120c58230cfc \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -42357,7 +42357,7 @@ var SSM_REGION = "eu-central-1";
 var SSM_TOKEN_PARAM = "/mmi-future/_org/slack/SLACK_BOT_TOKEN";
 var SSM_CHANNEL_PARAM = "/mmi-future/_org/slack/SLACK_ALERTS_CHANNEL";
 var SLACK_TIMEOUT_MS = 1e4;
-async function ssmParameter(deps, name, decrypt) {
+async function readSsmParameter(deps, name, decrypt) {
   const args = [
     "ssm",
     "get-parameter",
@@ -42375,23 +42375,30 @@ async function ssmParameter(deps, name, decrypt) {
   if (!value || value === "None") throw new Error(`SSM parameter ${name} is empty`);
   return value;
 }
-async function postToAlertsChannel(deps, text) {
-  const token = await ssmParameter(deps, SSM_TOKEN_PARAM, true);
-  const channel = await ssmParameter(deps, SSM_CHANNEL_PARAM, false);
+async function postToChannel(deps, channel, text) {
+  const resolved = channel.trim();
+  if (!resolved || resolved === "None") throw new Error("no Slack channel resolved");
+  const token = await readSsmParameter(deps, SSM_TOKEN_PARAM, true);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const res = await fetchImpl("https://slack.com/api/chat.postMessage", {
     method: "POST",
     headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json; charset=utf-8" },
-    body: JSON.stringify({ channel, text, unfurl_links: false }),
+    body: JSON.stringify({ channel: resolved, text, unfurl_links: false }),
     signal: AbortSignal.timeout(SLACK_TIMEOUT_MS)
   });
   const json = await res.json().catch(() => ({}));
   if (!json.ok) throw new Error(`slack postMessage failed: ${json.error ?? `http ${res.status}`}`);
+  return { status: "posted", note: "posted" };
+}
+async function postToAlertsChannel(deps, text) {
+  const channel = await readSsmParameter(deps, SSM_CHANNEL_PARAM, false);
+  await postToChannel(deps, channel, text);
   return { status: "posted", note: "posted to the alerts channel" };
 }
 
 // src/release-announce.ts
 var ANNOUNCE_REPO = "mutmutco/MMI-Hub";
+var RELEASE_CHANNEL_KEY = "SLACK_RELEASE_CHANNEL";
 var MAX_BULLETS = 6;
 var MAX_SUMMARY_LINES = 8;
 function neutralizeHubProductBrands(text) {
@@ -42399,10 +42406,17 @@ function neutralizeHubProductBrands(text) {
   s = s.replace(/\bdesign-system\s+design-system\b/gi, "design-system");
   return s.replace(/\s{2,}/g, " ").trim();
 }
+function releaseChannelParam(repo) {
+  return `/mmi-future/${slugOf(repo)}/${RELEASE_CHANNEL_KEY}`;
+}
+function isAbsentParameter(e) {
+  const message2 = e instanceof Error ? e.message : String(e);
+  return /ParameterNotFound/.test(message2) || /is empty$/.test(message2);
+}
 function escapeMrkdwn(text) {
   return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-function bulletToLine(raw) {
+function bulletToLine(raw, neutralize) {
   const m = /^[*-]\s+(.*)$/.exec(raw.trim());
   if (!m) return null;
   let text = m[1].trim();
@@ -42417,9 +42431,9 @@ function bulletToLine(raw) {
     text = text.slice(0, tail.index).trim();
   }
   if (!text) return null;
-  return `\u2022 ${escapeMrkdwn(neutralizeHubProductBrands(text))}${link}`;
+  return `\u2022 ${escapeMrkdwn(neutralize ? neutralizeHubProductBrands(text) : text)}${link}`;
 }
-function curateReleaseNotes(notesMd, maxBullets = MAX_BULLETS) {
+function curateReleaseNotes(notesMd, maxBullets = MAX_BULLETS, neutralize = true) {
   const lines2 = [];
   let bullets = 0;
   let dropped = 0;
@@ -42437,7 +42451,7 @@ function curateReleaseNotes(notesMd, maxBullets = MAX_BULLETS) {
       continue;
     }
     if (/new contributors/i.test(section)) continue;
-    const line = bulletToLine(raw);
+    const line = bulletToLine(raw, neutralize);
     if (!line) continue;
     if (bullets >= maxBullets) {
       dropped += 1;
@@ -42463,21 +42477,39 @@ function formatAnnouncement(args) {
     `<${args.releaseUrl}|Release notes>`
   ].join("\n");
 }
-function summaryFileLines(content) {
-  return content.split("\n").map((l) => l.trim()).filter(Boolean).slice(0, MAX_SUMMARY_LINES).map((l) => escapeMrkdwn(neutralizeHubProductBrands(l.replace(/^[•*-]\s*/, "")))).filter(Boolean).map((l) => `\u2022 ${l}`);
+function summaryFileLines(content, neutralize = true) {
+  return content.split("\n").map((l) => l.trim()).filter(Boolean).slice(0, MAX_SUMMARY_LINES).map((l) => {
+    const bare = l.replace(/^[•*-]\s*/, "");
+    return escapeMrkdwn(neutralize ? neutralizeHubProductBrands(bare) : bare);
+  }).filter(Boolean).map((l) => `\u2022 ${l}`);
 }
-async function announceRelease(deps, args) {
-  if (args.repo !== ANNOUNCE_REPO) {
-    return { status: "skipped", note: `announce is Hub-only \u2014 ${args.repo} skipped` };
+async function resolveAnnounceTarget(deps, repo) {
+  if (repo.toLowerCase() === ANNOUNCE_REPO.toLowerCase()) return { kind: "alerts" };
+  const param = releaseChannelParam(repo);
+  try {
+    const channel = await readSsmParameter(deps, param, false);
+    return { kind: "channel", channel };
+  } catch (e) {
+    if (isAbsentParameter(e)) return { kind: "none", param };
+    throw e;
   }
+}
+function missingChannelNote(repo) {
+  const slug = slugOf(repo);
+  return `no ${RELEASE_CHANNEL_KEY} declared for ${slug} \u2014 declare it with \`mmi-cli vault secrets declare ${RELEASE_CHANNEL_KEY} --group slack --consumers agent --purpose \u2026\` then \`mmi-cli vault secrets set ${RELEASE_CHANNEL_KEY}\``;
+}
+async function announceRelease(deps, args) {
+  const neutralize = args.repo.toLowerCase() === ANNOUNCE_REPO.toLowerCase();
   try {
+    const target = await resolveAnnounceTarget(deps, args.repo);
+    if (target.kind === "none") return { status: "skipped", note: missingChannelNote(args.repo) };
     const viewRaw = await deps.run("gh", ["release", "view", args.tag, "--repo", args.repo, "--json", "body,url"]);
     const view = JSON.parse(viewRaw);
     const releaseUrl = view.url ?? `https://github.com/${args.repo}/releases/tag/${args.tag}`;
     let lines2 = [];
     if (args.summaryFile) {
       if (!deps.readFile) throw new Error("summary file given but deps.readFile is missing");
-      lines2 = summaryFileLines(await deps.readFile(args.summaryFile));
+      lines2 = summaryFileLines(await deps.readFile(args.summaryFile), neutralize);
       if (deps.removeFile) {
         try {
           await deps.removeFile(args.summaryFile);
@@ -42485,11 +42517,15 @@ async function announceRelease(deps, args) {
         }
       }
     }
-    if (lines2.length === 0) lines2 = curateReleaseNotes(view.body ?? "");
+    if (lines2.length === 0) lines2 = curateReleaseNotes(view.body ?? "", MAX_BULLETS, neutralize);
     if (lines2.length === 0) lines2 = ["\u2022 maintenance release \u2014 see the notes for details"];
     const text = formatAnnouncement({ repo: args.repo, tag: args.tag, lines: lines2, releaseUrl });
-    await postToAlertsChannel(deps, text);
-    return { status: "announced", note: `announced ${args.tag} to the alerts channel` };
+    if (target.kind === "alerts") {
+      await postToAlertsChannel(deps, text);
+      return { status: "announced", note: `announced ${args.tag} to the alerts channel` };
+    }
+    await postToChannel(deps, target.channel, text);
+    return { status: "announced", note: `announced ${args.tag} to the project release channel` };
   } catch (e) {
     return { status: "failed", note: `announce failed (release unaffected): ${e.message}` };
   }
@@ -43904,7 +43940,8 @@ function trainApplyDeps() {
     // train lands the back-merge itself instead of leaving a manual step. Same enqueue path `pr land` uses,
     // but method `--merge` (NOT squash): the misalignment guard needs the merge parentage to survive.
     mergeAuto: (prNumber, repo) => ghMergeAutoEnqueue(prNumber, repo, "--merge"),
-    // Slack release announcement (#883): Hub-only + best-effort inside announceRelease itself.
+    // Slack release announcement (#883/#6517): the org alerts channel for the Hub, the project's own
+    // SLACK_RELEASE_CHANNEL for a product repo — best-effort inside announceRelease itself.
     announce: (args) => announceRelease({
       run: async (file, cmdArgs) => (await execFileP(file, cmdArgs, { timeout: GH_TRAIN_TIMEOUT_MS })).stdout,
       readFile: (path2) => (0, import_promises10.readFile)(path2, "utf8"),
@@ -44168,7 +44205,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
   for (const commandName of ["rcand", "release"]) {
     const trainCmd = program3.command(commandName).description(`plan ${commandName} train operations; mutations require explicit master-admin approval`).option("--json", "machine-readable output").option("--watch", "block on the deploy/publish workflow runs and report their outcomes").option("--apply", "execute the guarded master-only train after explicit approval").option("--resume", commandName === "rcand" ? "finish a candidate whose immutable public rc tag passed policy but origin/rc was not pushed (#3881)" : "finish a partial release or its protected post-release alignment without re-cutting, republishing, or redeploying (#3851/#3885)").option("--out <path>", "write the terminal result (--apply, --resume, --abort, --retry-publish) to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)");
     const RELEASE_ONLY_FLAGS = [
-      { flags: "--announce-summary-file <path>", description: "agent-curated 3-6 line Hub Slack summary; required for a new MMI-Hub --apply (#883/#3901)" },
+      { flags: "--announce-summary-file <path>", description: "agent-curated 3-6 line release Slack summary; required for a new MMI-Hub --apply (#883/#3901), optional for a product repo announcing to its project release channel (#6517)" },
       { flags: "--ack <shas>", description: "comma-separated dev shas a human verified are in the candidate, overriding the hotfix-coverage guard for a conflicted port whose -x trailer was lost (#958)" },
       { flags: "--dev", description: "full-track repos release development -> main directly, skipping rc (refuses if rc carries content not in development; no-op on direct-track repos) (#1062)" },
       { flags: "--abort", description: "with --apply, delete only a proven unpublished failed release candidate on any registered deploy model and restore local main for a same-version recut (#3944/#5650/#5657)" },
@@ -44194,7 +44231,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
         return fail(`${commandName}: --dev applies only to release \u2014 it ships development -> main skipping rc, which rcand cannot do. Run: mmi-cli devops release --dev`);
       }
       if (o.announceSummaryFile && commandName !== "release") {
-        return fail(`${commandName}: --announce-summary-file applies only to release \u2014 rcand posts no Hub Slack announcement. Run: mmi-cli devops release --announce-summary-file <path>`);
+        return fail(`${commandName}: --announce-summary-file applies only to release \u2014 rcand posts no release announcement. Run: mmi-cli devops release --announce-summary-file <path>`);
       }
       if (o.abort && commandName !== "release") {
         return fail(`${commandName}: --abort applies only to release \u2014 it rolls back a proven unpublished release tag. Run: mmi-cli devops release --abort --apply`);
@@ -44446,7 +44483,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
     console.log(o.json ? JSON.stringify({ command: "hotfix", steps }, null, 2) : renderSteps("mmi-cli devops hotfix: dry-run plan", steps));
   });
   hotfixCmd.command("start").description("cherry-pick one or more merged development PRs (or SHAs) onto hotfix/vX.Y.Z from origin/main, bump the distribution, open the main-base PR").requiredOption("--from <pr#|sha[,pr#|sha...]>", "merged development PR number(s) or commit SHA(s) to cherry-pick, in pick order \u2014 one hotfix cycle carries as many fixes as you name (#4411)").option("--json", "machine-readable output").option("--out <path>", "write the result to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)").action(async (o) => runHotfixSub("start", () => runHotfixStart(trainApplyDeps(), { from: o.from }), o, renderHotfixStart));
-  hotfixCmd.command("release <version>").description("after the hotfix PR is merged + checks green: tag, GitHub Release, watch deploy/publish, verify distribution (idempotent)").option("--json", "machine-readable output").option("--announce-summary-file <path>", "agent-curated 3-6 line Hub Slack summary; required for a NEW MMI-Hub hotfix Release (#883/#3901/#6068)").option("--carries <pr#|sha[,pr#|sha...]>", "declared fix target(s) this hotfix must carry; each must be proven present before tagging (#3056)").option("--out <path>", "write the result to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)").action(async (version, o) => runHotfixSub("release", async () => {
+  hotfixCmd.command("release <version>").description("after the hotfix PR is merged + checks green: tag, GitHub Release, watch deploy/publish, verify distribution (idempotent)").option("--json", "machine-readable output").option("--announce-summary-file <path>", "agent-curated 3-6 line release Slack summary; required for a NEW MMI-Hub hotfix Release (#883/#3901/#6068), optional for a product repo announcing to its project release channel (#6517)").option("--carries <pr#|sha[,pr#|sha...]>", "declared fix target(s) this hotfix must carry; each must be proven present before tagging (#3056)").option("--out <path>", "write the result to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)").action(async (version, o) => runHotfixSub("release", async () => {
     const result = await runHotfixRelease(trainApplyDeps(), version, { announceSummaryFile: o.announceSummaryFile, carries: o.carries ? [o.carries] : [] });
     const postReleaseJervDoctor = await runPostReleaseJervDoctor(result.repo);
     const projectInfoSync = await runProjectInfoSyncLeg(runProjectInfoSyncCallback, result.repo);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.3.42",
+  "version": "4.3.43",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",