@mutmutco/cli 4.3.56 → 4.3.57

package/dist/main.cjs

@@ -15877,10 +15877,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.3.56",
-    tag: "v4.3.56",
-    commit: "497a375fabfc",
-    npm: "@mutmutco/cli@4.3.56"
+    version: "4.3.57",
+    tag: "v4.3.57",
+    commit: "b988569fdfe3",
+    npm: "@mutmutco/cli@4.3.57"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15897,14 +15897,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.3.56"
+          v3Target: "v4.3.57"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.3.56 and redeploy the Hub Lambda from tag v4.3.56 (497a375fabfc); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.3.56 (@mutmutco/cli@4.3.56, tag commit 497a375fabfc \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.3.57 and redeploy the Hub Lambda from tag v4.3.57 (b988569fdfe3); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.3.57 (@mutmutco/cli@4.3.57, tag commit b988569fdfe3 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -26539,6 +26539,11 @@ function rcandVersionStep(targets) {
 function trainPlan(command, options = {}) {
   const isHub = options.repo?.toLowerCase() === "mutmutco/mmi-hub";
   const isDirect = options.releaseTrack === "direct" || options.releaseTrack === void 0 && isHub;
+  const authority = {
+    label: isHub ? "verify Hub master-admin train authority" : "verify project-admin or master train authority on this repo",
+    command: "mmi-cli oracle org access role <owner/repo> --json",
+    gated: true
+  };
   if (command === "rcand") {
     if (isDirect) {
       return [
@@ -26546,7 +26551,7 @@ function trainPlan(command, options = {}) {
       ];
     }
     return [
-      { label: "verify operator is a master-admin org owner", command: "gh api orgs/<owner>/memberships/<login> --jq .role", gated: true },
+      authority,
       { label: "verify current branch is development", gated: true },
       rcandVersionStep(options),
       { label: "verify registry META for this project", command: "mmi-cli oracle org project get <owner/repo>", gated: true },
@@ -26559,7 +26564,7 @@ function trainPlan(command, options = {}) {
   if (command === "release") {
     if (isDirect) {
       return [
-        { label: "verify operator is a master-admin org owner", command: "gh api orgs/<owner>/memberships/<login> --jq .role", gated: true },
+        authority,
         { label: "verify current branch is development", gated: true },
         { label: "verify registry META for this project", command: "mmi-cli oracle org project get <owner/repo>", gated: true },
         { label: "preflight required main secret names", command: "mmi-cli vault secrets preflight --stage main --repo <owner/repo>", gated: true },
@@ -26574,7 +26579,7 @@ function trainPlan(command, options = {}) {
     }
     if (options.dev) {
       return [
-        { label: "verify operator is a master-admin org owner", command: "gh api orgs/<owner>/memberships/<login> --jq .role", gated: true },
+        authority,
         { label: "verify current branch is development", gated: true },
         { label: "guard: refuse if origin/rc carries content not in development (a dev -> main release would drop it)", command: "git rev-list --count --right-only --cherry-pick --no-merges origin/development...origin/rc", gated: true },
         { label: "verify registry META for this project", command: "mmi-cli oracle org project get <owner/repo>", gated: true },
@@ -26590,7 +26595,7 @@ function trainPlan(command, options = {}) {
       ];
     }
     return [
-      { label: "verify operator is a master-admin org owner", command: "gh api orgs/<owner>/memberships/<login> --jq .role", gated: true },
+      authority,
       { label: "verify current branch is rc", gated: true },
       { label: "verify registry META for this project", command: "mmi-cli oracle org project get <owner/repo>", gated: true },
       { label: "preflight required main secret names", command: "mmi-cli vault secrets preflight --stage main --repo <owner/repo>", gated: true },
@@ -26605,6 +26610,7 @@ function trainPlan(command, options = {}) {
     ];
   }
   return [
+    authority,
     { label: "verify the fix is merged on development (the only hotfix origin)", gated: true },
     // #6068: hotfix start/release run the SAME shared preflight as release/rcand, before any git mutation.
     { label: "verify registry META for this project", command: "mmi-cli oracle org project get <owner/repo>", gated: true },
@@ -30114,7 +30120,7 @@ function buildSetDeployPatch(_slug, input) {
 }
 var DEPLOY_STAGE_BRANCH = { dev: "development", rc: "rc", main: "main" };
 function filelessTransitionGuide(repo, stage) {
-  const authority = stage === "main" ? "Authority: main is master-admin only." : "Authority: a project-admin may complete this for their own repo; master may also do it.";
+  const authority = "Authority: a project-admin may complete this for their own repo; master may also do it.";
   return [
     `Fileless transition for ${repo} (${stage}):`,
     `  ${authority}`,
@@ -44573,7 +44579,7 @@ function registerTrainCommandsAndInventory(program3) {
 }
 function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
   for (const commandName of ["rcand", "release"]) {
-    const trainCmd = program3.command(commandName).description(`plan ${commandName} train operations; mutations require explicit master-admin approval`).option("--json", "machine-readable output").option("--watch", "block on the deploy/publish workflow runs and report their outcomes").option("--apply", "execute the guarded master-only train after explicit approval").option("--resume", commandName === "rcand" ? "finish a candidate whose immutable public rc tag passed policy but origin/rc was not pushed (#3881)" : "finish a partial release or its protected post-release alignment without re-cutting, republishing, or redeploying (#3851/#3885)").option("--out <path>", "write the terminal result (--apply, --resume, --abort, --retry-publish) to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)");
+    const trainCmd = program3.command(commandName).description(`plan ${commandName} train operations; mutations require explicit project-admin or master approval`).option("--json", "machine-readable output").option("--watch", "block on the deploy/publish workflow runs and report their outcomes").option("--apply", "execute the guarded repo-authorized train after explicit approval (Hub: master only)").option("--resume", commandName === "rcand" ? "finish a candidate whose immutable public rc tag passed policy but origin/rc was not pushed (#3881)" : "finish a partial release or its protected post-release alignment without re-cutting, republishing, or redeploying (#3851/#3885)").option("--out <path>", "write the terminal result (--apply, --resume, --abort, --retry-publish) to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)");
     const RELEASE_ONLY_FLAGS = [
       { flags: "--announce-summary-file <path>", description: "agent-curated 3-6 line release Slack summary; required for a new MMI-Hub --apply (#883/#3901) and for a product repo whose registry META sets `releaseChannel` (#6523), in its `releaseLanguage`; nothing is posted to a project channel without it" },
       { flags: "--ack <shas>", description: "comma-separated dev shas a human verified are in the candidate, overriding the hotfix-coverage guard for a conflicted port whose -x trailer was lost (#958)" },
@@ -45914,8 +45920,8 @@ ${filelessTransitionGuide(target, o.stage)}`
   }
   return reportWrite("org project set-deploy", res);
 });
-var projectTenantTasks = project.command("tenant-tasks").description("project-admin self-declare of tenant tasks for your own repo's dev/rc stages (#5316, #5308) \u2014 new-task-only, dev/rc-only; editing an existing task or declaring a main-stage task stays master-only (`org project set --var tenantTasks=...`)");
-projectTenantTasks.command("declare <name>").description('register a NEW tenant task \u2014 becomes runnable via `runtime tenant control \u2026 run-task` on dev/rc. Body shape {service,command[],stages[],timeoutSeconds?,artifact?} \u2014 stages limited to dev/rc here; artifact "required" tasks must carry {artifact} in the command argv.').option("--service <name>", "service in the tenant runtime the task runs in (required unless --var carries it)").option("--command <argv...>", "task command as argv (repeatable; required unless --var carries it)").option("--stages <list>", "comma-separated dev,rc stages this task may run on (required unless --var carries it)").option("--timeout-seconds <n>", "optional wall-clock ceiling 1..3600").option("--artifact <none|required>", "artifact contract (default none; required tasks must contain {artifact} in argv)").option("--var <json>", "full task object {service,command[],stages[],timeoutSeconds?,artifact?} \u2014 use instead of the individual flags").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (name, o) => {
+var projectTenantTasks = project.command("tenant-tasks").description("project-admin self-declare of tenant tasks for every stage of your own repo \u2014 new-task-only; editing an existing task stays master-only (`org project set --var tenantTasks=...`)");
+projectTenantTasks.command("declare <name>").description("register a NEW tenant task \u2014 becomes runnable via `runtime tenant control \u2026 run-task` on its declared dev/rc/main stages. Body shape {service,command[],stages[],timeoutSeconds?,artifact?}; required artifact tasks must carry {artifact} in the command argv.").option("--service <name>", "service in the tenant runtime the task runs in (required unless --var carries it)").option("--command <argv...>", "task command as argv (repeatable; required unless --var carries it)").option("--stages <list>", "comma-separated dev,rc,main stages this task may run on (required unless --var carries it)").option("--timeout-seconds <n>", "optional wall-clock ceiling 1..3600").option("--artifact <none|required>", "artifact contract (default none; required tasks must contain {artifact} in argv)").option("--var <json>", "full task object {service,command[],stages[],timeoutSeconds?,artifact?} \u2014 use instead of the individual flags").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (name, o) => {
   const cfg = await loadConfig();
   let target;
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.3.56",
+  "version": "4.3.57",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",