@mutmutco/cli 4.3.67 → 4.3.68

package/dist/main.cjs

@@ -1741,8 +1741,8 @@ var Help = class {
    * @param {string} str
    * @returns {number}
    */
-  displayWidth(str) {
-    return (0, import_node_util.stripVTControlCharacters)(str).length;
+  displayWidth(str2) {
+    return (0, import_node_util.stripVTControlCharacters)(str2).length;
   }
   /**
    * Style the title for displaying in the help. Called with 'Usage:', 'Options:', etc.
@@ -1750,11 +1750,11 @@ var Help = class {
    * @param {string} str
    * @returns {string}
    */
-  styleTitle(str) {
-    return str;
+  styleTitle(str2) {
+    return str2;
   }
-  styleUsage(str) {
-    return str.split(" ").map((word) => {
+  styleUsage(str2) {
+    return str2.split(" ").map((word) => {
       if (word === "[options]") return this.styleOptionText(word);
       if (word === "[command]") return this.styleSubcommandText(word);
       if (word[0] === "[" || word[0] === "<")
@@ -1762,46 +1762,46 @@ var Help = class {
       return this.styleCommandText(word);
     }).join(" ");
   }
-  styleCommandDescription(str) {
-    return this.styleDescriptionText(str);
+  styleCommandDescription(str2) {
+    return this.styleDescriptionText(str2);
   }
-  styleOptionDescription(str) {
-    return this.styleDescriptionText(str);
+  styleOptionDescription(str2) {
+    return this.styleDescriptionText(str2);
   }
-  styleSubcommandDescription(str) {
-    return this.styleDescriptionText(str);
+  styleSubcommandDescription(str2) {
+    return this.styleDescriptionText(str2);
   }
-  styleArgumentDescription(str) {
-    return this.styleDescriptionText(str);
+  styleArgumentDescription(str2) {
+    return this.styleDescriptionText(str2);
   }
-  styleDescriptionText(str) {
-    return str;
+  styleDescriptionText(str2) {
+    return str2;
   }
-  styleOptionTerm(str) {
-    return this.styleOptionText(str);
+  styleOptionTerm(str2) {
+    return this.styleOptionText(str2);
   }
-  styleSubcommandTerm(str) {
-    return str.split(" ").map((word) => {
+  styleSubcommandTerm(str2) {
+    return str2.split(" ").map((word) => {
       if (word === "[options]") return this.styleOptionText(word);
       if (word[0] === "[" || word[0] === "<")
         return this.styleArgumentText(word);
       return this.styleSubcommandText(word);
     }).join(" ");
   }
-  styleArgumentTerm(str) {
-    return this.styleArgumentText(str);
+  styleArgumentTerm(str2) {
+    return this.styleArgumentText(str2);
   }
-  styleOptionText(str) {
-    return str;
+  styleOptionText(str2) {
+    return str2;
   }
-  styleArgumentText(str) {
-    return str;
+  styleArgumentText(str2) {
+    return str2;
   }
-  styleSubcommandText(str) {
-    return str;
+  styleSubcommandText(str2) {
+    return str2;
   }
-  styleCommandText(str) {
-    return str;
+  styleCommandText(str2) {
+    return str2;
   }
   /**
    * Calculate the pad width from the maximum term length.
@@ -1824,8 +1824,8 @@ var Help = class {
    * @param {string} str
    * @returns {boolean}
    */
-  preformatted(str) {
-    return /\n[^\S\r\n]/.test(str);
+  preformatted(str2) {
+    return /\n[^\S\r\n]/.test(str2);
   }
   /**
    * Format the "item", which consists of a term and description. Pad the term and wrap the description, indenting the following lines.
@@ -1871,9 +1871,9 @@ ${itemIndentStr}`);
    * @param {number} width
    * @returns {string}
    */
-  boxWrap(str, width) {
-    if (width < this.minWidthToWrap) return str;
-    const rawLines = str.split(/\r\n|\n/);
+  boxWrap(str2, width) {
+    if (width < this.minWidthToWrap) return str2;
+    const rawLines = str2.split(/\r\n|\n/);
     const chunkPattern = /[\s]*[^\s]+/g;
     const wrappedLines = [];
     rawLines.forEach((line) => {
@@ -2163,9 +2163,9 @@ var DualOptions = class {
     return option.negate === (negativeValue === value);
   }
 };
-function camelcase(str) {
-  return str.split("-").reduce((str2, word) => {
-    return str2 + word[0].toUpperCase() + word.slice(1);
+function camelcase(str2) {
+  return str2.split("-").reduce((str3, word) => {
+    return str3 + word[0].toUpperCase() + word.slice(1);
   });
 }
 function splitOptionFlags(flags) {
@@ -2325,14 +2325,14 @@ var Command = class _Command extends import_node_events.EventEmitter {
     this._showSuggestionAfterError = true;
     this._savedState = null;
     this._outputConfiguration = {
-      writeOut: (str) => import_node_process.default.stdout.write(str),
-      writeErr: (str) => import_node_process.default.stderr.write(str),
-      outputError: (str, write) => write(str),
+      writeOut: (str2) => import_node_process.default.stdout.write(str2),
+      writeErr: (str2) => import_node_process.default.stderr.write(str2),
+      outputError: (str2, write) => write(str2),
       getOutHelpWidth: () => import_node_process.default.stdout.isTTY ? import_node_process.default.stdout.columns : void 0,
       getErrHelpWidth: () => import_node_process.default.stderr.isTTY ? import_node_process.default.stderr.columns : void 0,
       getOutHasColors: () => useColor() ?? (import_node_process.default.stdout.isTTY && import_node_process.default.stdout.hasColors?.()),
       getErrHasColors: () => useColor() ?? (import_node_process.default.stderr.isTTY && import_node_process.default.stderr.hasColors?.()),
-      stripColor: (str) => (0, import_node_util2.stripVTControlCharacters)(str)
+      stripColor: (str2) => (0, import_node_util2.stripVTControlCharacters)(str2)
     };
     this._hidden = false;
     this._helpOption = void 0;
@@ -4060,18 +4060,18 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} [description]
    * @return {(this | string | undefined)} `this` command for chaining, or version string if no arguments
    */
-  version(str, flags, description) {
-    if (str === void 0) return this._version;
-    this._version = str;
+  version(str2, flags, description) {
+    if (str2 === void 0) return this._version;
+    this._version = str2;
     flags = flags || "-V, --version";
     description = description || "output the version number";
     const versionOption = this.createOption(flags, description);
     this._versionOptionName = versionOption.attributeName();
     this._registerOption(versionOption);
     this.on("option:" + versionOption.name(), () => {
-      this._outputConfiguration.writeOut(`${str}
+      this._outputConfiguration.writeOut(`${str2}
 `);
-      this._exit(0, "commander.version", str);
+      this._exit(0, "commander.version", str2);
     });
     return this;
   }
@@ -4082,10 +4082,10 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {object} [argsDescription]
    * @return {(string|Command)}
    */
-  description(str, argsDescription) {
-    if (str === void 0 && argsDescription === void 0)
+  description(str2, argsDescription) {
+    if (str2 === void 0 && argsDescription === void 0)
       return this._description;
-    this._description = str;
+    this._description = str2;
     if (argsDescription) {
       this._argsDescription = argsDescription;
     }
@@ -4097,9 +4097,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} [str]
    * @return {(string|Command)}
    */
-  summary(str) {
-    if (str === void 0) return this._summary;
-    this._summary = str;
+  summary(str2) {
+    if (str2 === void 0) return this._summary;
+    this._summary = str2;
     return this;
   }
   /**
@@ -4147,8 +4147,8 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} [str]
    * @return {(string|Command)}
    */
-  usage(str) {
-    if (str === void 0) {
+  usage(str2) {
+    if (str2 === void 0) {
       if (this._usage) return this._usage;
       const args = this.registeredArguments.map((arg) => {
         return humanReadableArgName(arg);
@@ -4159,7 +4159,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         this.registeredArguments.length ? args : []
       ).join(" ");
     }
-    this._usage = str;
+    this._usage = str2;
     return this;
   }
   /**
@@ -4168,9 +4168,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} [str]
    * @return {(string|Command)}
    */
-  name(str) {
-    if (str === void 0) return this._name;
-    this._name = str;
+  name(str2) {
+    if (str2 === void 0) return this._name;
+    this._name = str2;
     return this;
   }
   /**
@@ -4304,17 +4304,17 @@ Expecting one of '${allowedValues.join("', '")}'`);
     let hasColors;
     let helpWidth;
     if (error) {
-      baseWrite = (str) => this._outputConfiguration.writeErr(str);
+      baseWrite = (str2) => this._outputConfiguration.writeErr(str2);
       hasColors = this._outputConfiguration.getErrHasColors();
       helpWidth = this._outputConfiguration.getErrHelpWidth();
     } else {
-      baseWrite = (str) => this._outputConfiguration.writeOut(str);
+      baseWrite = (str2) => this._outputConfiguration.writeOut(str2);
       hasColors = this._outputConfiguration.getOutHasColors();
       helpWidth = this._outputConfiguration.getOutHelpWidth();
     }
-    const write = (str) => {
-      if (!hasColors) str = this._outputConfiguration.stripColor(str);
-      return baseWrite(str);
+    const write = (str2) => {
+      if (!hasColors) str2 = this._outputConfiguration.stripColor(str2);
+      return baseWrite(str2);
     };
     return { error, write, hasColors, helpWidth };
   }
@@ -7004,7 +7004,7 @@ init_github_client();
 
 // src/project-model.ts
 var PROJECT_TYPES = ["web-app", "hub-service", "content", "desktop-app", "desktop-game", "mobile-app", "non-deployable", "cli-tool", "worker"];
-var DEPLOY_MODELS = ["hub-serverless", "serverless", "tenant-container", "solo-container", "static-cdn", "registry-publish", "content", "none"];
+var DEPLOY_MODELS = ["hub-serverless", "serverless", "tenant-container", "solo-container", "static-cdn", "registry-publish", "content", "none", "vercel"];
 var RELEASE_TRACKS = ["full", "direct", "trunk"];
 var REQUIRED_CHECK_BRANCHES = ["development", "rc", "main"];
 var PROJECT_TYPE_SET = new Set(PROJECT_TYPES);
@@ -9209,6 +9209,66 @@ async function secretsCopy(deps, opts) {
   }
   return true;
 }
+function transferKey(leaf, stage) {
+  return stage ? `${stage}/${leaf}` : leaf;
+}
+async function secretsTransfer(deps, opts) {
+  const fromRepo = opts.fromRepo.trim();
+  const toRepo = opts.toRepo.trim();
+  if (!fromRepo || !toRepo) {
+    deps.err("secrets transfer: --from-repo and --to-repo are required (owner/repo)");
+    return false;
+  }
+  if (fromRepo.toLowerCase() === toRepo.toLowerCase() && opts.fromStage === opts.toStage) {
+    deps.err("secrets transfer: source and destination are the same coordinate \u2014 use `secrets copy` to move between stages of one project");
+    return false;
+  }
+  const report = await probeCapabilities(deps, fromRepo);
+  if (report?.role !== "master") {
+    deps.err(report === void 0 ? "secrets transfer: could not verify your role (capabilities probe unavailable) \u2014 cross-project transfer is master-only and refuses on an unverified role" : `secrets transfer: master-admin only \u2014 your role on ${fromRepo} is ${report.role}. Cross-project value movement is master-gated; ask the master to run the transfer.`);
+    return false;
+  }
+  const keys = [...new Set(opts.keys.flatMap((k) => k.split(/[,\s]+/)).filter(Boolean))];
+  if (!keys.length) {
+    deps.err("secrets transfer: --keys required (comma- or space-separated allowlist)");
+    return false;
+  }
+  for (const key of keys) {
+    if (!isValidSecretKey(key)) {
+      deps.err(`invalid secret key ${JSON.stringify(key)}`);
+      return false;
+    }
+    if (isSecretCopyBlocked(key)) {
+      deps.err(`secrets transfer: ${key} is not transferable \u2014 generate encryption/stage-distinct keys per project`);
+      return false;
+    }
+  }
+  for (const key of keys) {
+    const leaf = secretLeafName(key);
+    const srcKey = transferKey(leaf, opts.fromStage);
+    const dstKey = transferKey(leaf, opts.toStage);
+    const srcPath = `${fromRepo} ${srcKey}`;
+    const dstPath = `${toRepo} ${dstKey}`;
+    if (opts.dryRun) {
+      const probe = await fetchSecretValue(deps, srcKey, { repo: fromRepo });
+      if (!probe) {
+        deps.err(`secrets transfer: could not read source ${srcPath}`);
+        return false;
+      }
+      deps.log(`would transfer ${srcPath} \u2192 ${dstPath}`);
+      continue;
+    }
+    const value = await fetchSecretValue(deps, srcKey, { repo: fromRepo });
+    if (!value) {
+      deps.err(`secrets transfer: could not read source ${srcPath}`);
+      return false;
+    }
+    const ok = await putSecret(deps, dstKey, value, { repo: toRepo });
+    if (!ok) return false;
+    deps.log(`transferred ${srcPath} \u2192 ${dstPath}`);
+  }
+  return true;
+}
 var CMD_METACHAR_RE = /[&|^%<>()!"]/;
 var CMD_METACHAR_G = /[&|^%<>()!"]/g;
 function argvQuote(token, force) {
@@ -13772,7 +13832,7 @@ function walk(dir, root, out) {
   return out;
 }
 function defaultListDocs(root) {
-  const docs = ["docs", "skills/org-guide", "skills/mmi-help", "skills/brand"].flatMap((path2) => {
+  const docs = ["docs", "skills/org-guide", "skills/mmi-help"].flatMap((path2) => {
     const directory = (0, import_node_path12.join)(root, path2);
     return (0, import_node_fs14.existsSync)(directory) ? walk(directory, root, []) : [];
   }).filter(
@@ -14755,6 +14815,7 @@ function planTrainApplyRepoGuard(applyRepo, cwdRepo, rerun, what = "--apply") {
   };
 }
 async function resolveFoldPaths(deps, model) {
+  if (model === "vercel") return [];
   const helper = "scripts/release-distribution.mjs";
   if (model === "hub-serverless" || model === "registry-publish") {
     if ((0, import_node_fs16.existsSync)(helper)) {
@@ -15801,10 +15862,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.3.67",
-    tag: "v4.3.67",
-    commit: "61dc785d3abb",
-    npm: "@mutmutco/cli@4.3.67"
+    version: "4.3.68",
+    tag: "v4.3.68",
+    commit: "e9edc6e353ec",
+    npm: "@mutmutco/cli@4.3.68"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15821,14 +15882,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.3.67"
+          v3Target: "v4.3.68"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.3.67 and redeploy the Hub Lambda from tag v4.3.67 (61dc785d3abb); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.3.67 (@mutmutco/cli@4.3.67, tag commit 61dc785d3abb \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.3.68 and redeploy the Hub Lambda from tag v4.3.68 (e9edc6e353ec); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.3.68 (@mutmutco/cli@4.3.68, tag commit e9edc6e353ec \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -18670,6 +18731,56 @@ function isReleaseShaDeployEnumerationCandidate(row, nonDeployEvents) {
   return true;
 }
 
+// src/vercel-deployments.ts
+var TERMINAL = /* @__PURE__ */ new Set(["success", "failure", "error", "inactive"]);
+function isTerminalVercelState(state) {
+  return TERMINAL.has(state);
+}
+function str(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+async function readVercelDeployment(api, repo, target, environment) {
+  const query = target.sha ? `sha=${encodeURIComponent(target.sha)}` : `ref=${encodeURIComponent(target.ref ?? "")}`;
+  const listed = await api(`repos/${repo}/deployments?${query}&per_page=30`);
+  const rows = Array.isArray(listed) ? listed : [];
+  const prefix = environment.toLowerCase();
+  const hit = rows.find((d) => typeof d.id === "number" && (str(d.environment) ?? "").toLowerCase().startsWith(prefix));
+  if (!hit) return void 0;
+  const statuses = await api(`repos/${repo}/deployments/${hit.id}/statuses?per_page=1`);
+  const latest = Array.isArray(statuses) ? statuses[0] : void 0;
+  const state = str(latest?.state) ?? "none";
+  const url = str(latest?.environment_url) ?? str(latest?.target_url);
+  return {
+    id: hit.id,
+    environment: str(hit.environment) ?? environment,
+    sha: str(hit.sha) ?? target.sha ?? "",
+    ref: str(hit.ref) ?? target.ref ?? "",
+    state,
+    ...url ? { url } : {},
+    ...str(latest?.log_url) ? { logUrl: str(latest?.log_url) } : {}
+  };
+}
+var VERCEL_WATCH_ATTEMPTS = 120;
+var VERCEL_WATCH_DELAY_MS = 1e4;
+async function watchVercelProduction(api, repo, sha, sleep2, onTick) {
+  let last;
+  for (let attempt = 0; attempt < VERCEL_WATCH_ATTEMPTS; attempt++) {
+    if (attempt > 0) await sleep2(VERCEL_WATCH_DELAY_MS);
+    last = await readVercelDeployment(api, repo, { sha }, "Production");
+    onTick?.(attempt, last);
+    if (last && isTerminalVercelState(last.state)) return last;
+  }
+  return last;
+}
+async function probeVercelUrl(url, fetchImpl = fetch) {
+  try {
+    const res = await fetchImpl(url, { method: "GET", redirect: "follow", signal: AbortSignal.timeout(15e3) });
+    return { ok: res.status < 500, status: res.status };
+  } catch (e) {
+    return { ok: false, error: e instanceof Error ? e.message : String(e) };
+  }
+}
+
 // src/train-apply-deploy.ts
 var DISPATCH_ATTEMPTS = 3;
 var DISPATCH_RETRY_DELAY_MS = 2e3;
@@ -18841,7 +18952,45 @@ function prodReleaseTargets(model) {
   return [];
 }
 function trainObservesShipment(model) {
-  return isCentralDispatchModel(model) || prodReleaseTargets(model).length > 0;
+  return isCentralDispatchModel(model) || prodReleaseTargets(model).length > 0 || model === "vercel";
+}
+async function vercelDeployDispatch(deps, ctx, ref, watch, headSha) {
+  const note = "no dispatch: Vercel deploys main on push (Production) \u2014 observed via the Vercel GitHub app Deployment";
+  if (ref !== "main") return { note: "no dispatch on rc: a vercel repo is direct-track and has no rc stage", deployStatus: "pending" };
+  if (!headSha) return { note, deployStatus: "pending" };
+  const api = async (path2) => JSON.parse(await deps.run("gh", ["api", path2]));
+  const row = (d, conclusion) => ({
+    workflow: "vercel",
+    conclusion,
+    ...d?.logUrl ? { runUrl: d.logUrl } : { runUrlNote: "no Vercel Deployment posted for this SHA yet" },
+    event: "push"
+  });
+  const verdict = (d) => d?.state === "success" ? "success" : d && isTerminalVercelState(d.state) ? "failure" : "pending";
+  let read;
+  try {
+    if (!watch) {
+      deps.warn?.("Release: Checking Vercel deployment status");
+      read = await readVercelDeployment(api, ctx.repo, { sha: headSha }, "Production");
+    } else {
+      deps.warn?.("Release: Waiting for Vercel to deploy production");
+      read = await watchVercelProduction(api, ctx.repo, headSha, resolveSleep(deps), (attempt, d) => {
+        if (attempt > 0 && attempt % 6 === 0) deps.warn?.(`Vercel deployment ${d ? d.state : "not posted yet"} \u2014 ${attempt / 6}m elapsed`);
+      });
+    }
+  } catch (e) {
+    return { note: `${note}; the Deployment read FAILED (${describeReadError(e)}) \u2014 verify on Vercel; never re-tag`, workflowRuns: [row(void 0, "failure")], deployStatus: "failure" };
+  }
+  let deployStatus = verdict(read);
+  let detail = read ? `Vercel Production deployment ${read.state}${read.url ? ` at ${read.url}` : ""}` : "no Vercel Deployment posted for this SHA (is the Vercel GitHub app connected?)";
+  if (watch && deployStatus === "success" && read?.url) {
+    const probe = await (deps.probeUrl ?? probeVercelUrl)(read.url);
+    if (probe.ok) detail = `${detail}; URL answered HTTP ${probe.status}`;
+    else {
+      deployStatus = "failure";
+      detail = `${detail}; URL probe FAILED (${probe.error ?? `HTTP ${probe.status}`})`;
+    }
+  }
+  return { note: `${note}; ${detail}`, ...read?.logUrl ? { runUrl: read.logUrl } : {}, workflowRuns: [row(read, deployStatus)], deployStatus };
 }
 function shipLegsGreen(deploy, publish) {
   const green = (s) => s === "complete" || s === "skipped";
@@ -19023,6 +19172,7 @@ async function dispatchDeploy(deps, ctx, stage, ref, model, watch, autoRunSince,
       deployStatus: aggregateWorkflowRuns(workflowRuns)
     };
   }
+  if (model === "vercel") return vercelDeployDispatch(deps, ctx, ref, watch, autoRunHeadSha);
   return { note: `no manual dispatch: ${model} repo deploys via its own push-triggered workflow`, deployStatus: "pending" };
 }
 async function readEdgeDomains(deps, slug) {
@@ -36269,6 +36419,30 @@ function registerSecretsCommands(program3) {
     });
     if (!ok) process.exitCode = 1;
   }));
+  secrets.command("transfer").description("(master-only) copy secret VALUES from one project vault to another \u2014 the succession path `copy` cannot serve (#6687). Values never printed, never in argv; encryption/stage-distinct keys blocked; declare-first enforced on the destination").requiredOption("--from-repo <owner/repo>", "source repo whose vault holds the values").requiredOption("--to-repo <owner/repo>", "destination repo receiving the values").requiredOption("--keys <names>", "comma- or space-separated secret names (encryption keys blocked)").option("--from-stage <stage>", "source tier: dev, rc, or main (omit for the stageless canonical)").option("--to-stage <stage>", "destination tier: dev, rc, or main (omit for the stageless canonical)").option("--dry-run", "report the transfers, and verify each source is readable, without writing").action((o) => withSecrets(async (d) => {
+    const stages = ["dev", "rc", "main"];
+    const parseStage = (v, flag) => {
+      if (v === void 0) return void 0;
+      if (!stages.includes(v)) {
+        fail(`secrets transfer: ${flag} must be dev, rc, or main`);
+        return null;
+      }
+      return v;
+    };
+    const fromStage = parseStage(o.fromStage, "--from-stage");
+    if (fromStage === null) return;
+    const toStage = parseStage(o.toStage, "--to-stage");
+    if (toStage === null) return;
+    const ok = await secretsTransfer(d, {
+      fromRepo: o.fromRepo,
+      toRepo: o.toRepo,
+      keys: o.keys.split(","),
+      ...fromStage !== void 0 ? { fromStage } : {},
+      ...toStage !== void 0 ? { toStage } : {},
+      ...o.dryRun !== void 0 ? { dryRun: o.dryRun } : {}
+    });
+    if (!ok) process.exitCode = 1;
+  }));
   secrets.command("import-rails-credentials").description("decrypt Rails credentials and import explicit mappings into the vault (values never printed)").requiredOption("--stage <dev|rc|main>", "target vault stage").option("--map <credential.path=ENV_KEY>", "explicit credential-to-env mapping; repeat for each key", collectMap, []).option("--app-dir <path>", "Rails app directory (defaults to cwd)").option("--credentials-file <path>", `encrypted credentials path relative to --app-dir (default: ${DEFAULT_RAILS_CREDENTIALS_FILE})`).option("--master-key-file <path>", `master key path relative to --app-dir (default: ${DEFAULT_RAILS_MASTER_KEY_FILE})`).option("--dry-run", "decrypt and show mapped key names without writing values").option("--remove-files", "delete credentials/master key files after every mapped value imports successfully").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((o) => withSecrets(async (d) => {
     const stages = ["dev", "rc", "main"];
     if (!stages.includes(o.stage)) {
@@ -36699,6 +36873,28 @@ function registerStageCommands(program3) {
       cfg
     };
   }
+  async function stagePreview(project2) {
+    if (project2?.deployModel !== "vercel") return null;
+    const branch = await gitOut(["rev-parse", "--abbrev-ref", "HEAD"]);
+    const repo = Array.isArray(project2.repos) && typeof project2.repos[0] === "string" ? project2.repos[0] : await repoSlug();
+    try {
+      const gh = defaultGitHubClient();
+      const deployment = await readVercelDeployment((path2) => gh.rest("GET", path2), repo, { ref: branch }, "Preview");
+      return { branch, ...deployment ? { deployment } : {} };
+    } catch (e) {
+      return { branch, error: e.message };
+    }
+  }
+  function previewLine(preview) {
+    if (!preview) return "";
+    if (preview.error) return `
+vercel preview (${preview.branch}): read failed \u2014 ${preview.error}`;
+    const d = preview.deployment;
+    if (!d) return `
+vercel preview (${preview.branch}): no Preview deployment posted yet \u2014 push the branch, or connect the Vercel GitHub app`;
+    return `
+vercel preview (${preview.branch}): ${d.state}${d.url ? ` \u2014 ${d.url}` : ""}`;
+  }
   async function fetchStageVaultEnvMerge(project2, cfg) {
     if (!cfg.sagaApiUrl || !project2) return void 0;
     const names = requiredRuntimeSecretNames("dev", project2.requiredRuntimeSecrets, { includeGoogleOAuth: false });
@@ -36839,6 +37035,7 @@ function registerStageCommands(program3) {
     if (o.down && !o.live) return fail("stage: --down applies to --live only (local teardown is `mmi-cli stage stop --apply`)");
     if (o.live) return runStageLiveCommand(o);
     const { resolution: res, project: project2, cfg: stageCfg } = await resolveStage();
+    const preview = await stagePreview(project2);
     if (o.apply) {
       if (res.source === "none") return failGraceful(`stage: ${res.gap}`);
       const cfg = res.derived.config;
@@ -36848,7 +37045,7 @@ function registerStageCommands(program3) {
         const result = await runStage(cfg, { ...stageScopedRunOpts({ timeoutMs: o.timeoutMs }), ...vaultOpts });
         const reportUrl = reportedStageUrl(res, result);
         const url = reportUrl ? ` \u2014 ${reportUrl}` : "";
-        return printLine(o.json ? JSON.stringify({ ...result, source: res.source, url: reportUrl }) : `mmi-cli stage: ${result.message}${url}`);
+        return printLine(o.json ? JSON.stringify({ ...result, source: res.source, url: reportUrl, ...preview ? { preview } : {} }) : `mmi-cli stage: ${result.message}${url}${previewLine(preview)}`);
       } catch (e) {
         return failGraceful(`stage: ${e.message}`);
       } finally {
@@ -36856,8 +37053,8 @@ function registerStageCommands(program3) {
       }
     }
     const steps = stageStepsFor(res);
-    if (o.json) return console.log(JSON.stringify({ command: "stage", ...stageReceiptFields(res), steps }, null, 2));
-    console.log(renderSteps("mmi-cli stage: dry-run plan", steps));
+    if (o.json) return console.log(JSON.stringify({ command: "stage", ...stageReceiptFields(res), steps, ...preview ? { preview } : {} }, null, 2));
+    console.log(renderSteps("mmi-cli stage: dry-run plan", steps) + previewLine(preview));
   });
   stage.command("stop").description("stop the previous local stage process recorded in tmp/stage/state.json").option("--json", "machine-readable output").option("--apply", "kill the recorded process tree and remove the state file").action(async () => {
     const o = { json: rawFlag("--json"), apply: rawFlag("--apply") };
@@ -45464,17 +45661,17 @@ function excessArgumentCorrection(extra, argv) {
   return sibling ? correctedPositionalCommand(sibling, extra[0], argv) : void 0;
 }
 var pendingHumanParseError;
-function writeHumanParseError(str) {
-  pendingHumanParseError = str;
+function writeHumanParseError(str2) {
+  pendingHumanParseError = str2;
 }
-function envelopeAwareWriteErr(str) {
-  const plain = str.replace(/\[[0-9;]*m/g, "");
+function envelopeAwareWriteErr(str2) {
+  const plain = str2.replace(/\[[0-9;]*m/g, "");
   if (plain.includes(PARSE_HINT_SENTINEL)) {
     if (unknownFlagJsonHandled && argvWantsJson3()) {
       pendingHumanParseError = void 0;
       return;
     }
-    const hint = str.replace(PARSE_HINT_SENTINEL, resolveParseHint());
+    const hint = str2.replace(PARSE_HINT_SENTINEL, resolveParseHint());
     if (lastParseErrorKind === "bad-arguments") {
       process.stderr.write(hint);
       if (pendingHumanParseError) process.stderr.write(pendingHumanParseError);
@@ -45490,7 +45687,7 @@ function envelopeAwareWriteErr(str) {
   const badChoice = parseInvalidChoiceError(plain);
   if (badChoice) {
     if (!argvWantsJson3()) {
-      writeHumanParseError(str);
+      writeHumanParseError(str2);
       return;
     }
     process.stderr.write(
@@ -45518,7 +45715,7 @@ function envelopeAwareWriteErr(str) {
       unknownFlagJsonHandled = true;
       return;
     }
-    writeHumanParseError(str.replace(/error: too many arguments[^\n]*/, `error: ${message2}`));
+    writeHumanParseError(str2.replace(/error: too many arguments[^\n]*/, `error: ${message2}`));
     return;
   }
   const match = /unknown option '([^']+)'/.exec(plain);
@@ -45544,18 +45741,18 @@ function envelopeAwareWriteErr(str) {
       return;
     }
     if (positional) {
-      writeHumanParseError(str.replace(/unknown option '[^']+'/, unknownTargetFlagMessage(flag, positional)));
+      writeHumanParseError(str2.replace(/unknown option '[^']+'/, unknownTargetFlagMessage(flag, positional)));
       return;
     }
-    writeHumanParseError(str);
+    writeHumanParseError(str2);
     return;
   }
   if (unknownFlagJsonHandled && argvWantsJson3()) return;
   if (argvWantsJson3()) {
-    process.stderr.write(str);
+    process.stderr.write(str2);
     return;
   }
-  writeHumanParseError(str);
+  writeHumanParseError(str2);
 }
 var INVOKED_ARGV3 = process.argv.slice(2);
 var program2 = new Command();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.3.67",
+  "version": "4.3.68",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",