@mutmutco/cli 4.3.67 → 4.4.0

package/dist/main.cjs

@@ -1741,8 +1741,8 @@ var Help = class {
    * @param {string} str
    * @returns {number}
    */
-  displayWidth(str) {
-    return (0, import_node_util.stripVTControlCharacters)(str).length;
+  displayWidth(str2) {
+    return (0, import_node_util.stripVTControlCharacters)(str2).length;
   }
   /**
    * Style the title for displaying in the help. Called with 'Usage:', 'Options:', etc.
@@ -1750,11 +1750,11 @@ var Help = class {
    * @param {string} str
    * @returns {string}
    */
-  styleTitle(str) {
-    return str;
+  styleTitle(str2) {
+    return str2;
   }
-  styleUsage(str) {
-    return str.split(" ").map((word) => {
+  styleUsage(str2) {
+    return str2.split(" ").map((word) => {
       if (word === "[options]") return this.styleOptionText(word);
       if (word === "[command]") return this.styleSubcommandText(word);
       if (word[0] === "[" || word[0] === "<")
@@ -1762,46 +1762,46 @@ var Help = class {
       return this.styleCommandText(word);
     }).join(" ");
   }
-  styleCommandDescription(str) {
-    return this.styleDescriptionText(str);
+  styleCommandDescription(str2) {
+    return this.styleDescriptionText(str2);
   }
-  styleOptionDescription(str) {
-    return this.styleDescriptionText(str);
+  styleOptionDescription(str2) {
+    return this.styleDescriptionText(str2);
   }
-  styleSubcommandDescription(str) {
-    return this.styleDescriptionText(str);
+  styleSubcommandDescription(str2) {
+    return this.styleDescriptionText(str2);
   }
-  styleArgumentDescription(str) {
-    return this.styleDescriptionText(str);
+  styleArgumentDescription(str2) {
+    return this.styleDescriptionText(str2);
   }
-  styleDescriptionText(str) {
-    return str;
+  styleDescriptionText(str2) {
+    return str2;
   }
-  styleOptionTerm(str) {
-    return this.styleOptionText(str);
+  styleOptionTerm(str2) {
+    return this.styleOptionText(str2);
   }
-  styleSubcommandTerm(str) {
-    return str.split(" ").map((word) => {
+  styleSubcommandTerm(str2) {
+    return str2.split(" ").map((word) => {
       if (word === "[options]") return this.styleOptionText(word);
       if (word[0] === "[" || word[0] === "<")
         return this.styleArgumentText(word);
       return this.styleSubcommandText(word);
     }).join(" ");
   }
-  styleArgumentTerm(str) {
-    return this.styleArgumentText(str);
+  styleArgumentTerm(str2) {
+    return this.styleArgumentText(str2);
   }
-  styleOptionText(str) {
-    return str;
+  styleOptionText(str2) {
+    return str2;
   }
-  styleArgumentText(str) {
-    return str;
+  styleArgumentText(str2) {
+    return str2;
   }
-  styleSubcommandText(str) {
-    return str;
+  styleSubcommandText(str2) {
+    return str2;
   }
-  styleCommandText(str) {
-    return str;
+  styleCommandText(str2) {
+    return str2;
   }
   /**
    * Calculate the pad width from the maximum term length.
@@ -1824,8 +1824,8 @@ var Help = class {
    * @param {string} str
    * @returns {boolean}
    */
-  preformatted(str) {
-    return /\n[^\S\r\n]/.test(str);
+  preformatted(str2) {
+    return /\n[^\S\r\n]/.test(str2);
   }
   /**
    * Format the "item", which consists of a term and description. Pad the term and wrap the description, indenting the following lines.
@@ -1871,9 +1871,9 @@ ${itemIndentStr}`);
    * @param {number} width
    * @returns {string}
    */
-  boxWrap(str, width) {
-    if (width < this.minWidthToWrap) return str;
-    const rawLines = str.split(/\r\n|\n/);
+  boxWrap(str2, width) {
+    if (width < this.minWidthToWrap) return str2;
+    const rawLines = str2.split(/\r\n|\n/);
     const chunkPattern = /[\s]*[^\s]+/g;
     const wrappedLines = [];
     rawLines.forEach((line) => {
@@ -2163,9 +2163,9 @@ var DualOptions = class {
     return option.negate === (negativeValue === value);
   }
 };
-function camelcase(str) {
-  return str.split("-").reduce((str2, word) => {
-    return str2 + word[0].toUpperCase() + word.slice(1);
+function camelcase(str2) {
+  return str2.split("-").reduce((str3, word) => {
+    return str3 + word[0].toUpperCase() + word.slice(1);
   });
 }
 function splitOptionFlags(flags) {
@@ -2325,14 +2325,14 @@ var Command = class _Command extends import_node_events.EventEmitter {
     this._showSuggestionAfterError = true;
     this._savedState = null;
     this._outputConfiguration = {
-      writeOut: (str) => import_node_process.default.stdout.write(str),
-      writeErr: (str) => import_node_process.default.stderr.write(str),
-      outputError: (str, write) => write(str),
+      writeOut: (str2) => import_node_process.default.stdout.write(str2),
+      writeErr: (str2) => import_node_process.default.stderr.write(str2),
+      outputError: (str2, write) => write(str2),
       getOutHelpWidth: () => import_node_process.default.stdout.isTTY ? import_node_process.default.stdout.columns : void 0,
       getErrHelpWidth: () => import_node_process.default.stderr.isTTY ? import_node_process.default.stderr.columns : void 0,
       getOutHasColors: () => useColor() ?? (import_node_process.default.stdout.isTTY && import_node_process.default.stdout.hasColors?.()),
       getErrHasColors: () => useColor() ?? (import_node_process.default.stderr.isTTY && import_node_process.default.stderr.hasColors?.()),
-      stripColor: (str) => (0, import_node_util2.stripVTControlCharacters)(str)
+      stripColor: (str2) => (0, import_node_util2.stripVTControlCharacters)(str2)
     };
     this._hidden = false;
     this._helpOption = void 0;
@@ -4060,18 +4060,18 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} [description]
    * @return {(this | string | undefined)} `this` command for chaining, or version string if no arguments
    */
-  version(str, flags, description) {
-    if (str === void 0) return this._version;
-    this._version = str;
+  version(str2, flags, description) {
+    if (str2 === void 0) return this._version;
+    this._version = str2;
     flags = flags || "-V, --version";
     description = description || "output the version number";
     const versionOption = this.createOption(flags, description);
     this._versionOptionName = versionOption.attributeName();
     this._registerOption(versionOption);
     this.on("option:" + versionOption.name(), () => {
-      this._outputConfiguration.writeOut(`${str}
+      this._outputConfiguration.writeOut(`${str2}
 `);
-      this._exit(0, "commander.version", str);
+      this._exit(0, "commander.version", str2);
     });
     return this;
   }
@@ -4082,10 +4082,10 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {object} [argsDescription]
    * @return {(string|Command)}
    */
-  description(str, argsDescription) {
-    if (str === void 0 && argsDescription === void 0)
+  description(str2, argsDescription) {
+    if (str2 === void 0 && argsDescription === void 0)
       return this._description;
-    this._description = str;
+    this._description = str2;
     if (argsDescription) {
       this._argsDescription = argsDescription;
     }
@@ -4097,9 +4097,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} [str]
    * @return {(string|Command)}
    */
-  summary(str) {
-    if (str === void 0) return this._summary;
-    this._summary = str;
+  summary(str2) {
+    if (str2 === void 0) return this._summary;
+    this._summary = str2;
     return this;
   }
   /**
@@ -4147,8 +4147,8 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} [str]
    * @return {(string|Command)}
    */
-  usage(str) {
-    if (str === void 0) {
+  usage(str2) {
+    if (str2 === void 0) {
       if (this._usage) return this._usage;
       const args = this.registeredArguments.map((arg) => {
         return humanReadableArgName(arg);
@@ -4159,7 +4159,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         this.registeredArguments.length ? args : []
       ).join(" ");
     }
-    this._usage = str;
+    this._usage = str2;
     return this;
   }
   /**
@@ -4168,9 +4168,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} [str]
    * @return {(string|Command)}
    */
-  name(str) {
-    if (str === void 0) return this._name;
-    this._name = str;
+  name(str2) {
+    if (str2 === void 0) return this._name;
+    this._name = str2;
     return this;
   }
   /**
@@ -4304,17 +4304,17 @@ Expecting one of '${allowedValues.join("', '")}'`);
     let hasColors;
     let helpWidth;
     if (error) {
-      baseWrite = (str) => this._outputConfiguration.writeErr(str);
+      baseWrite = (str2) => this._outputConfiguration.writeErr(str2);
       hasColors = this._outputConfiguration.getErrHasColors();
       helpWidth = this._outputConfiguration.getErrHelpWidth();
     } else {
-      baseWrite = (str) => this._outputConfiguration.writeOut(str);
+      baseWrite = (str2) => this._outputConfiguration.writeOut(str2);
       hasColors = this._outputConfiguration.getOutHasColors();
       helpWidth = this._outputConfiguration.getOutHelpWidth();
     }
-    const write = (str) => {
-      if (!hasColors) str = this._outputConfiguration.stripColor(str);
-      return baseWrite(str);
+    const write = (str2) => {
+      if (!hasColors) str2 = this._outputConfiguration.stripColor(str2);
+      return baseWrite(str2);
     };
     return { error, write, hasColors, helpWidth };
   }
@@ -6380,7 +6380,7 @@ function decorateAwsModel(entries, registry2, verdicts) {
   });
 }
 var DECLARED_ENTRIES = [
-  { name: "mmi-backup (mm-central, mmi-fofu, zuber, mmi-oguz)", cadence: "17 2 * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup \u2192 /opt/mmi-control/nightly-backup.sh (verify: mmi-cli devops runtime box get <box> --ssh)" },
+  { name: "mmi-backup (mm-central, mm-work, zuber, mmi-oguz)", cadence: "17 2 * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup \u2192 /opt/mmi-control/nightly-backup.sh (verify: mmi-cli devops runtime box get <box> --ssh)" },
   // #3370/#6270: the one runner hygiene layer (runner-hygiene.yml was folded in and deleted). A workflow ran ON the runner and needed checkout +
   // setup-node before it can prune, so at 100% it dies at checkout and never prunes — the cleanup is
   // unavailable exactly when it is needed. This one is root cron on the box: no checkout, no node, and
@@ -7004,7 +7004,7 @@ init_github_client();
 
 // src/project-model.ts
 var PROJECT_TYPES = ["web-app", "hub-service", "content", "desktop-app", "desktop-game", "mobile-app", "non-deployable", "cli-tool", "worker"];
-var DEPLOY_MODELS = ["hub-serverless", "serverless", "tenant-container", "solo-container", "static-cdn", "registry-publish", "content", "none"];
+var DEPLOY_MODELS = ["hub-serverless", "serverless", "tenant-container", "solo-container", "static-cdn", "registry-publish", "content", "none", "vercel"];
 var RELEASE_TRACKS = ["full", "direct", "trunk"];
 var REQUIRED_CHECK_BRANCHES = ["development", "rc", "main"];
 var PROJECT_TYPE_SET = new Set(PROJECT_TYPES);
@@ -9209,6 +9209,66 @@ async function secretsCopy(deps, opts) {
   }
   return true;
 }
+function transferKey(leaf, stage) {
+  return stage ? `${stage}/${leaf}` : leaf;
+}
+async function secretsTransfer(deps, opts) {
+  const fromRepo = opts.fromRepo.trim();
+  const toRepo = opts.toRepo.trim();
+  if (!fromRepo || !toRepo) {
+    deps.err("secrets transfer: --from-repo and --to-repo are required (owner/repo)");
+    return false;
+  }
+  if (fromRepo.toLowerCase() === toRepo.toLowerCase() && opts.fromStage === opts.toStage) {
+    deps.err("secrets transfer: source and destination are the same coordinate \u2014 use `secrets copy` to move between stages of one project");
+    return false;
+  }
+  const report = await probeCapabilities(deps, fromRepo);
+  if (report?.role !== "master") {
+    deps.err(report === void 0 ? "secrets transfer: could not verify your role (capabilities probe unavailable) \u2014 cross-project transfer is master-only and refuses on an unverified role" : `secrets transfer: master-admin only \u2014 your role on ${fromRepo} is ${report.role}. Cross-project value movement is master-gated; ask the master to run the transfer.`);
+    return false;
+  }
+  const keys = [...new Set(opts.keys.flatMap((k) => k.split(/[,\s]+/)).filter(Boolean))];
+  if (!keys.length) {
+    deps.err("secrets transfer: --keys required (comma- or space-separated allowlist)");
+    return false;
+  }
+  for (const key of keys) {
+    if (!isValidSecretKey(key)) {
+      deps.err(`invalid secret key ${JSON.stringify(key)}`);
+      return false;
+    }
+    if (isSecretCopyBlocked(key)) {
+      deps.err(`secrets transfer: ${key} is not transferable \u2014 generate encryption/stage-distinct keys per project`);
+      return false;
+    }
+  }
+  for (const key of keys) {
+    const leaf = secretLeafName(key);
+    const srcKey = transferKey(leaf, opts.fromStage);
+    const dstKey = transferKey(leaf, opts.toStage);
+    const srcPath = `${fromRepo} ${srcKey}`;
+    const dstPath = `${toRepo} ${dstKey}`;
+    if (opts.dryRun) {
+      const probe = await fetchSecretValue(deps, srcKey, { repo: fromRepo });
+      if (!probe) {
+        deps.err(`secrets transfer: could not read source ${srcPath}`);
+        return false;
+      }
+      deps.log(`would transfer ${srcPath} \u2192 ${dstPath}`);
+      continue;
+    }
+    const value = await fetchSecretValue(deps, srcKey, { repo: fromRepo });
+    if (!value) {
+      deps.err(`secrets transfer: could not read source ${srcPath}`);
+      return false;
+    }
+    const ok = await putSecret(deps, dstKey, value, { repo: toRepo });
+    if (!ok) return false;
+    deps.log(`transferred ${srcPath} \u2192 ${dstPath}`);
+  }
+  return true;
+}
 var CMD_METACHAR_RE = /[&|^%<>()!"]/;
 var CMD_METACHAR_G = /[&|^%<>()!"]/g;
 function argvQuote(token, force) {
@@ -9379,6 +9439,18 @@ function resolveUseEnvNames(keys, name) {
   }
   return { ok: true, entries };
 }
+function referencesDollarEnv(arg, name) {
+  return arg.includes(`\${${name}}`) || new RegExp(`\\$${name}(?![A-Za-z0-9_])`).test(arg);
+}
+function secretsUseDollarHint(command, envNames) {
+  for (const arg of command) {
+    for (const name of envNames) {
+      if (!referencesDollarEnv(arg, name)) continue;
+      return `secrets use: $${name} is injected into the CHILD's env, not your shell \u2014 the caller expanded it (empty) before this ran. Wrap the consumer so expansion happens inside: bash -c 'your-command "$${name}"'`;
+    }
+  }
+  return null;
+}
 var PRE_SPAWN_DRAIN_TIMEOUT_MS = 2e3;
 async function drainHttpPoolBeforeSpawn() {
   const drained = await Promise.race([
@@ -9430,6 +9502,8 @@ async function secretsUse(deps, keys, opts) {
     deps.err(named.error);
     return false;
   }
+  const dollarHint = secretsUseDollarHint(command, named.entries.map((e) => e.envName));
+  if (dollarHint) deps.err(dollarHint);
   const repo = await targetRepo(deps, opts);
   const slug = opts.slug?.toLowerCase();
   const env = { ...process.env };
@@ -13772,7 +13846,7 @@ function walk(dir, root, out) {
   return out;
 }
 function defaultListDocs(root) {
-  const docs = ["docs", "skills/org-guide", "skills/mmi-help", "skills/brand"].flatMap((path2) => {
+  const docs = ["docs", "skills/org-guide", "skills/mmi-help"].flatMap((path2) => {
     const directory = (0, import_node_path12.join)(root, path2);
     return (0, import_node_fs14.existsSync)(directory) ? walk(directory, root, []) : [];
   }).filter(
@@ -14178,9 +14252,6 @@ function expectedHosts(cfg) {
       for (const env of ENV_PREFIXES) out.push(env ? `${env}.${base}` : base);
     }
   }
-  if (cfg.fofuSubdomain !== void 0) {
-    out.push(cfg.fofuSubdomain ? `${cfg.fofuSubdomain}.fofu.ai` : "fofu.ai");
-  }
   return uniq([...out, ...cfg.edgeHosts ?? []]);
 }
 function expectedJsOrigins(cfg) {
@@ -14245,10 +14316,7 @@ function parseOauthConfig(mmiConfig, slug) {
     );
   }
   const extraCallbackPaths = parseExtraCallbackPaths(raw.extraCallbackPaths);
-  const meta = mmiConfig ?? {};
-  const rawFofuSub = raw.fofuSubdomain;
-  const fofuSubdomain = meta.fofuEnabled === true ? typeof rawFofuSub === "string" ? rawFofuSub : defaultSubdomain(slug) : void 0;
-  return { subdomains, domains, callbackPath, extraCallbackPaths, fofuSubdomain, edgeHosts: Object.values(edgeDomainsByStage(mmiConfig)) };
+  return { subdomains, domains, callbackPath, extraCallbackPaths, edgeHosts: Object.values(edgeDomainsByStage(mmiConfig)) };
 }
 function probeRedirectUri(callbackPath, port = 9123) {
   return `http://localhost:${port}${callbackPath}`;
@@ -14755,6 +14823,7 @@ function planTrainApplyRepoGuard(applyRepo, cwdRepo, rerun, what = "--apply") {
   };
 }
 async function resolveFoldPaths(deps, model) {
+  if (model === "vercel") return [];
   const helper = "scripts/release-distribution.mjs";
   if (model === "hub-serverless" || model === "registry-publish") {
     if ((0, import_node_fs16.existsSync)(helper)) {
@@ -15801,10 +15870,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.3.67",
-    tag: "v4.3.67",
-    commit: "61dc785d3abb",
-    npm: "@mutmutco/cli@4.3.67"
+    version: "4.4.0",
+    tag: "v4.4.0",
+    commit: "8e1fae5ff484",
+    npm: "@mutmutco/cli@4.4.0"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15821,14 +15890,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.3.67"
+          v3Target: "v4.4.0"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.3.67 and redeploy the Hub Lambda from tag v4.3.67 (61dc785d3abb); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.3.67 (@mutmutco/cli@4.3.67, tag commit 61dc785d3abb \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.4.0 and redeploy the Hub Lambda from tag v4.4.0 (8e1fae5ff484); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.4.0 (@mutmutco/cli@4.4.0, tag commit 8e1fae5ff484 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -15925,12 +15994,6 @@ var rollout_plan_default = {
           schedule: "train",
           v3Target: "v0.3.0"
         },
-        {
-          repo: "mutmutco/mm-fofu",
-          role: "member",
-          schedule: "train",
-          v3Target: "v0.1.0"
-        },
         {
           repo: "mutmutco/mmi-junior",
           role: "member",
@@ -18670,6 +18733,56 @@ function isReleaseShaDeployEnumerationCandidate(row, nonDeployEvents) {
   return true;
 }
 
+// src/vercel-deployments.ts
+var TERMINAL = /* @__PURE__ */ new Set(["success", "failure", "error", "inactive"]);
+function isTerminalVercelState(state) {
+  return TERMINAL.has(state);
+}
+function str(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+async function readVercelDeployment(api, repo, target, environment) {
+  const query = target.sha ? `sha=${encodeURIComponent(target.sha)}` : `ref=${encodeURIComponent(target.ref ?? "")}`;
+  const listed = await api(`repos/${repo}/deployments?${query}&per_page=30`);
+  const rows = Array.isArray(listed) ? listed : [];
+  const prefix = environment.toLowerCase();
+  const hit = rows.find((d) => typeof d.id === "number" && (str(d.environment) ?? "").toLowerCase().startsWith(prefix));
+  if (!hit) return void 0;
+  const statuses = await api(`repos/${repo}/deployments/${hit.id}/statuses?per_page=1`);
+  const latest = Array.isArray(statuses) ? statuses[0] : void 0;
+  const state = str(latest?.state) ?? "none";
+  const url = str(latest?.environment_url) ?? str(latest?.target_url);
+  return {
+    id: hit.id,
+    environment: str(hit.environment) ?? environment,
+    sha: str(hit.sha) ?? target.sha ?? "",
+    ref: str(hit.ref) ?? target.ref ?? "",
+    state,
+    ...url ? { url } : {},
+    ...str(latest?.log_url) ? { logUrl: str(latest?.log_url) } : {}
+  };
+}
+var VERCEL_WATCH_ATTEMPTS = 120;
+var VERCEL_WATCH_DELAY_MS = 1e4;
+async function watchVercelProduction(api, repo, sha, sleep2, onTick) {
+  let last;
+  for (let attempt = 0; attempt < VERCEL_WATCH_ATTEMPTS; attempt++) {
+    if (attempt > 0) await sleep2(VERCEL_WATCH_DELAY_MS);
+    last = await readVercelDeployment(api, repo, { sha }, "Production");
+    onTick?.(attempt, last);
+    if (last && isTerminalVercelState(last.state)) return last;
+  }
+  return last;
+}
+async function probeVercelUrl(url, fetchImpl = fetch) {
+  try {
+    const res = await fetchImpl(url, { method: "GET", redirect: "follow", signal: AbortSignal.timeout(15e3) });
+    return { ok: res.status < 500, status: res.status };
+  } catch (e) {
+    return { ok: false, error: e instanceof Error ? e.message : String(e) };
+  }
+}
+
 // src/train-apply-deploy.ts
 var DISPATCH_ATTEMPTS = 3;
 var DISPATCH_RETRY_DELAY_MS = 2e3;
@@ -18841,7 +18954,45 @@ function prodReleaseTargets(model) {
   return [];
 }
 function trainObservesShipment(model) {
-  return isCentralDispatchModel(model) || prodReleaseTargets(model).length > 0;
+  return isCentralDispatchModel(model) || prodReleaseTargets(model).length > 0 || model === "vercel";
+}
+async function vercelDeployDispatch(deps, ctx, ref, watch, headSha) {
+  const note = "no dispatch: Vercel deploys main on push (Production) \u2014 observed via the Vercel GitHub app Deployment";
+  if (ref !== "main") return { note: "no dispatch on rc: a vercel repo is direct-track and has no rc stage", deployStatus: "pending" };
+  if (!headSha) return { note, deployStatus: "pending" };
+  const api = async (path2) => JSON.parse(await deps.run("gh", ["api", path2]));
+  const row = (d, conclusion) => ({
+    workflow: "vercel",
+    conclusion,
+    ...d?.logUrl ? { runUrl: d.logUrl } : { runUrlNote: "no Vercel Deployment posted for this SHA yet" },
+    event: "push"
+  });
+  const verdict = (d) => d?.state === "success" ? "success" : d && isTerminalVercelState(d.state) ? "failure" : "pending";
+  let read;
+  try {
+    if (!watch) {
+      deps.warn?.("Release: Checking Vercel deployment status");
+      read = await readVercelDeployment(api, ctx.repo, { sha: headSha }, "Production");
+    } else {
+      deps.warn?.("Release: Waiting for Vercel to deploy production");
+      read = await watchVercelProduction(api, ctx.repo, headSha, resolveSleep(deps), (attempt, d) => {
+        if (attempt > 0 && attempt % 6 === 0) deps.warn?.(`Vercel deployment ${d ? d.state : "not posted yet"} \u2014 ${attempt / 6}m elapsed`);
+      });
+    }
+  } catch (e) {
+    return { note: `${note}; the Deployment read FAILED (${describeReadError(e)}) \u2014 verify on Vercel; never re-tag`, workflowRuns: [row(void 0, "failure")], deployStatus: "failure" };
+  }
+  let deployStatus = verdict(read);
+  let detail = read ? `Vercel Production deployment ${read.state}${read.url ? ` at ${read.url}` : ""}` : "no Vercel Deployment posted for this SHA (is the Vercel GitHub app connected?)";
+  if (watch && deployStatus === "success" && read?.url) {
+    const probe = await (deps.probeUrl ?? probeVercelUrl)(read.url);
+    if (probe.ok) detail = `${detail}; URL answered HTTP ${probe.status}`;
+    else {
+      deployStatus = "failure";
+      detail = `${detail}; URL probe FAILED (${probe.error ?? `HTTP ${probe.status}`})`;
+    }
+  }
+  return { note: `${note}; ${detail}`, ...read?.logUrl ? { runUrl: read.logUrl } : {}, workflowRuns: [row(read, deployStatus)], deployStatus };
 }
 function shipLegsGreen(deploy, publish) {
   const green = (s) => s === "complete" || s === "skipped";
@@ -19023,6 +19174,7 @@ async function dispatchDeploy(deps, ctx, stage, ref, model, watch, autoRunSince,
       deployStatus: aggregateWorkflowRuns(workflowRuns)
     };
   }
+  if (model === "vercel") return vercelDeployDispatch(deps, ctx, ref, watch, autoRunHeadSha);
   return { note: `no manual dispatch: ${model} repo deploys via its own push-triggered workflow`, deployStatus: "pending" };
 }
 async function readEdgeDomains(deps, slug) {
@@ -29517,12 +29669,12 @@ function registerDeployCommands(program3) {
 init_cli_shared();
 
 // src/project-set.ts
-var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "dsManifestPath", "fofuEnabled", "consumesDesignSystem", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary"];
+var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "dsManifestPath", "consumesDesignSystem", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary"];
 var UNSET_KEY_SET = new Set(UNSET_KEYS);
 var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
 var SECRET_CONSUMERS = ["runtime", "build", "lambda", "actions", "agent", "box"];
 var SECRET_ENV_NAME_RE = /^[A-Za-z][A-Za-z0-9_]*$/;
-var BUILD_SECRET_REF_RE = /^(?:[A-Z_][A-Z0-9_]*=)?(?:[A-Z_][A-Z0-9_]*|(?:mm-fofu|_org\/[a-z0-9][a-z0-9-]*):[A-Z_][A-Z0-9_]*|@github-packages-token)$/;
+var BUILD_SECRET_REF_RE = /^(?:[A-Z_][A-Z0-9_]*=)?(?:[A-Z_][A-Z0-9_]*|(?:_org\/[a-z0-9][a-z0-9-]*):[A-Z_][A-Z0-9_]*|@github-packages-token)$/;
 function previewRegistryMetaMerge(existing, patch) {
   const out = { ...existing ?? {} };
   for (const [key, value] of Object.entries(patch)) {
@@ -29718,7 +29870,7 @@ function parseOauthVar(raw) {
     throw new Error(`org project set: oauth must be JSON, e.g. {"subdomains":["app"],"domains":["example.co"],"callbackPath":"${DEFAULT_CALLBACK_PATH}"}`);
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("org project set: oauth must be a {subdomains,domains,callbackPath,extraCallbackPaths,fofuSubdomain} object");
+    throw new Error("org project set: oauth must be a {subdomains,domains,callbackPath,extraCallbackPaths} object");
   }
   const map = parsed;
   const out = {};
@@ -29746,11 +29898,8 @@ function parseOauthVar(raw) {
       } catch (e) {
         throw new Error(`org project set: ${e.message}`);
       }
-    } else if (key === "fofuSubdomain") {
-      if (typeof value !== "string") throw new Error('org project set: oauth.fofuSubdomain must be a string ("" selects the apex fofu.ai)');
-      out.fofuSubdomain = value.trim();
     } else {
-      throw new Error(`org project set: oauth key "${key}" \u2014 expected only subdomains/domains/callbackPath/extraCallbackPaths/fofuSubdomain`);
+      throw new Error(`org project set: oauth key "${key}" \u2014 expected only subdomains/domains/callbackPath/extraCallbackPaths`);
     }
   }
   return out;
@@ -29772,11 +29921,6 @@ function parsePublishRequiredVar(raw) {
   if (raw === "false") return false;
   throw new Error("org project set: publishRequired must be true or false");
 }
-function parseFofuEnabledVar(raw) {
-  if (raw === "true") return true;
-  if (raw === "false") return false;
-  throw new Error("org project set: fofuEnabled must be true or false");
-}
 function parseRuntimeVaultOnlyVar(raw) {
   if (raw === "true") return true;
   if (raw === "false") return false;
@@ -29934,7 +30078,6 @@ var SETTABLE_VAR_KEYS = [
   "releaseChannel",
   "releaseLanguage",
   "dsManifestPath",
-  "fofuEnabled",
   "consumesDesignSystem",
   "runtimeVaultOnly",
   "requiredGcpApis",
@@ -29963,12 +30106,11 @@ var SETTABLE_VAR_HINTS = {
   releaseChannel: "Slack channel id, e.g. C0BE0BRGAT0",
   releaseLanguage: "2-letter language code for release notes, e.g. tr (default en)",
   dsManifestPath: "relative path to a package.json, e.g. web/package.json",
-  fofuEnabled: "true|false",
   consumesDesignSystem: '"fofu"',
   runtimeVaultOnly: "true|false",
   seedCanary: "true|false",
   repos: 'JSON array, e.g. ["mutmutco/mm-foo"]',
-  oauth: "JSON {subdomains,domains,callbackPath,extraCallbackPaths,fofuSubdomain}",
+  oauth: "JSON {subdomains,domains,callbackPath,extraCallbackPaths}",
   requiredGcpApis: "comma-string",
   requiredRuntimeSecrets: 'JSON stage map, e.g. {"dev":["KEY"],"rc":["KEY"],"main":["KEY"]}',
   requiredBuildSecrets: 'JSON flat array, e.g. ["NODE_AUTH_TOKEN=@github-packages-token"]',
@@ -30064,8 +30206,6 @@ function buildProjectSetPatch(input) {
       patch[key] = parseReposVar(raw);
     } else if (key === "publishRequired") {
       patch[key] = parsePublishRequiredVar(raw);
-    } else if (key === "fofuEnabled") {
-      patch[key] = parseFofuEnabledVar(raw);
     } else if (key === "runtimeVaultOnly") {
       patch[key] = parseRuntimeVaultOnlyVar(raw);
     } else if (key === "seedCanary") {
@@ -36269,6 +36409,30 @@ function registerSecretsCommands(program3) {
     });
     if (!ok) process.exitCode = 1;
   }));
+  secrets.command("transfer").description("(master-only) copy secret VALUES from one project vault to another \u2014 the succession path `copy` cannot serve (#6687). Values never printed, never in argv; encryption/stage-distinct keys blocked; declare-first enforced on the destination").requiredOption("--from-repo <owner/repo>", "source repo whose vault holds the values").requiredOption("--to-repo <owner/repo>", "destination repo receiving the values").requiredOption("--keys <names>", "comma- or space-separated secret names (encryption keys blocked)").option("--from-stage <stage>", "source tier: dev, rc, or main (omit for the stageless canonical)").option("--to-stage <stage>", "destination tier: dev, rc, or main (omit for the stageless canonical)").option("--dry-run", "report the transfers, and verify each source is readable, without writing").action((o) => withSecrets(async (d) => {
+    const stages = ["dev", "rc", "main"];
+    const parseStage = (v, flag) => {
+      if (v === void 0) return void 0;
+      if (!stages.includes(v)) {
+        fail(`secrets transfer: ${flag} must be dev, rc, or main`);
+        return null;
+      }
+      return v;
+    };
+    const fromStage = parseStage(o.fromStage, "--from-stage");
+    if (fromStage === null) return;
+    const toStage = parseStage(o.toStage, "--to-stage");
+    if (toStage === null) return;
+    const ok = await secretsTransfer(d, {
+      fromRepo: o.fromRepo,
+      toRepo: o.toRepo,
+      keys: o.keys.split(","),
+      ...fromStage !== void 0 ? { fromStage } : {},
+      ...toStage !== void 0 ? { toStage } : {},
+      ...o.dryRun !== void 0 ? { dryRun: o.dryRun } : {}
+    });
+    if (!ok) process.exitCode = 1;
+  }));
   secrets.command("import-rails-credentials").description("decrypt Rails credentials and import explicit mappings into the vault (values never printed)").requiredOption("--stage <dev|rc|main>", "target vault stage").option("--map <credential.path=ENV_KEY>", "explicit credential-to-env mapping; repeat for each key", collectMap, []).option("--app-dir <path>", "Rails app directory (defaults to cwd)").option("--credentials-file <path>", `encrypted credentials path relative to --app-dir (default: ${DEFAULT_RAILS_CREDENTIALS_FILE})`).option("--master-key-file <path>", `master key path relative to --app-dir (default: ${DEFAULT_RAILS_MASTER_KEY_FILE})`).option("--dry-run", "decrypt and show mapped key names without writing values").option("--remove-files", "delete credentials/master key files after every mapped value imports successfully").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((o) => withSecrets(async (d) => {
     const stages = ["dev", "rc", "main"];
     if (!stages.includes(o.stage)) {
@@ -36578,7 +36742,7 @@ async function runStageLiveDown(deps, t) {
 var GITHUB_PACKAGES_TOKEN_REF = "@github-packages-token";
 var ENV_ID_RE = /^[A-Z_][A-Z0-9_]*$/;
 var BARE_VAULT_KEY_RE = /^[A-Z_][A-Z0-9_]*$/;
-var CROSS_SLUG_REF_RE = /^(?:mm-fofu|_org\/[a-z0-9][a-z0-9-]*):[A-Z_][A-Z0-9_]*$/;
+var CROSS_SLUG_REF_RE = /^(?:_org\/[a-z0-9][a-z0-9-]*):[A-Z_][A-Z0-9_]*$/;
 function parseStageBuildSecretEntry(entry) {
   const trimmed = entry.trim();
   if (!trimmed) return null;
@@ -36650,7 +36814,6 @@ async function fetchVaultRef(fetchVault, ref) {
   if (colon === -1) return fetchVault(ref);
   const prefix = ref.slice(0, colon);
   const key = ref.slice(colon + 1);
-  if (prefix === "mm-fofu") return fetchVault(key, { slug: "mm-fofu" });
   if (prefix.startsWith("_org/")) {
     const provider = prefix.slice("_org/".length);
     return fetchVault(`${provider}/${key}`, { slug: "_org" });
@@ -36699,6 +36862,28 @@ function registerStageCommands(program3) {
       cfg
     };
   }
+  async function stagePreview(project2) {
+    if (project2?.deployModel !== "vercel") return null;
+    const branch = await gitOut(["rev-parse", "--abbrev-ref", "HEAD"]);
+    const repo = Array.isArray(project2.repos) && typeof project2.repos[0] === "string" ? project2.repos[0] : await repoSlug();
+    try {
+      const gh = defaultGitHubClient();
+      const deployment = await readVercelDeployment((path2) => gh.rest("GET", path2), repo, { ref: branch }, "Preview");
+      return { branch, ...deployment ? { deployment } : {} };
+    } catch (e) {
+      return { branch, error: e.message };
+    }
+  }
+  function previewLine(preview) {
+    if (!preview) return "";
+    if (preview.error) return `
+vercel preview (${preview.branch}): read failed \u2014 ${preview.error}`;
+    const d = preview.deployment;
+    if (!d) return `
+vercel preview (${preview.branch}): no Preview deployment posted yet \u2014 push the branch, or connect the Vercel GitHub app`;
+    return `
+vercel preview (${preview.branch}): ${d.state}${d.url ? ` \u2014 ${d.url}` : ""}`;
+  }
   async function fetchStageVaultEnvMerge(project2, cfg) {
     if (!cfg.sagaApiUrl || !project2) return void 0;
     const names = requiredRuntimeSecretNames("dev", project2.requiredRuntimeSecrets, { includeGoogleOAuth: false });
@@ -36839,6 +37024,7 @@ function registerStageCommands(program3) {
     if (o.down && !o.live) return fail("stage: --down applies to --live only (local teardown is `mmi-cli stage stop --apply`)");
     if (o.live) return runStageLiveCommand(o);
     const { resolution: res, project: project2, cfg: stageCfg } = await resolveStage();
+    const preview = await stagePreview(project2);
     if (o.apply) {
       if (res.source === "none") return failGraceful(`stage: ${res.gap}`);
       const cfg = res.derived.config;
@@ -36848,7 +37034,7 @@ function registerStageCommands(program3) {
         const result = await runStage(cfg, { ...stageScopedRunOpts({ timeoutMs: o.timeoutMs }), ...vaultOpts });
         const reportUrl = reportedStageUrl(res, result);
         const url = reportUrl ? ` \u2014 ${reportUrl}` : "";
-        return printLine(o.json ? JSON.stringify({ ...result, source: res.source, url: reportUrl }) : `mmi-cli stage: ${result.message}${url}`);
+        return printLine(o.json ? JSON.stringify({ ...result, source: res.source, url: reportUrl, ...preview ? { preview } : {} }) : `mmi-cli stage: ${result.message}${url}${previewLine(preview)}`);
       } catch (e) {
         return failGraceful(`stage: ${e.message}`);
       } finally {
@@ -36856,8 +37042,8 @@ function registerStageCommands(program3) {
       }
     }
     const steps = stageStepsFor(res);
-    if (o.json) return console.log(JSON.stringify({ command: "stage", ...stageReceiptFields(res), steps }, null, 2));
-    console.log(renderSteps("mmi-cli stage: dry-run plan", steps));
+    if (o.json) return console.log(JSON.stringify({ command: "stage", ...stageReceiptFields(res), steps, ...preview ? { preview } : {} }, null, 2));
+    console.log(renderSteps("mmi-cli stage: dry-run plan", steps) + previewLine(preview));
   });
   stage.command("stop").description("stop the previous local stage process recorded in tmp/stage/state.json").option("--json", "machine-readable output").option("--apply", "kill the recorded process tree and remove the state file").action(async () => {
     const o = { json: rawFlag("--json"), apply: rawFlag("--apply") };
@@ -41817,7 +42003,7 @@ function formatBoxTable(boxes) {
   }
   return lines2.join("\n");
 }
-function formatSshRecipe(box) {
+function formatSshRecipe(box, remoteCommand) {
   if (!box.address) {
     return `box ${box.name} has no public IPv4 \u2014 it is not directly reachable over ssh.`;
   }
@@ -41831,13 +42017,21 @@ function formatSshRecipe(box) {
     "  --with-decryption --query Parameter.Value --output text --region eu-central-1 \\",
     `  | tr -d '\\r' > "$kf"`,
     'test -s "$kf"       # never hand ssh an empty key file',
-    `ssh -i "$kf" -o StrictHostKeyChecking=accept-new root@${box.address} 'hostname; uptime'`
+    `ssh -i "$kf" -o StrictHostKeyChecking=accept-new root@${box.address} ${shellSingleQuote(sshRemoteCommand(remoteCommand))}`
   ].join("\n");
 }
+var SSH_DEFAULT_PROBE = "hostname; uptime";
+function sshRemoteCommand(remoteCommand) {
+  const trimmed = remoteCommand?.trim();
+  return trimmed ? trimmed : SSH_DEFAULT_PROBE;
+}
+function shellSingleQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
 var SSH_RECIPE_AGENT_NOTE = "# agent callers: this is multi-line, so running it inline is denied (#1473/#2125).\n# Use `mmi-cli devops runtime box get <name> --ssh --script <path>` to write it to a file, then `bash <path>`.";
-function sshRecipeScript(box) {
+function sshRecipeScript(box, remoteCommand) {
   return `#!/usr/bin/env bash
-${formatSshRecipe(box)}
+${formatSshRecipe(box, remoteCommand)}
 `;
 }
 
@@ -41912,7 +42106,7 @@ function registerBoxCommands(program3) {
       await failGraceful(e.message);
     }
   });
-  box.command("get <name>").description("one box by name \u2014 its address and ssh key path; --ssh prints a ready-to-run connect recipe").option("--json", "machine-readable output").option("--ssh", "print a copy-paste ssh recipe (materializes the key to a temp file; never echoes it)").option("--script <path>", "with --ssh: write the recipe to <path> and print the one line to run \u2014 the runnable form for agent callers, whose transport denies a multi-line inline body (#3385)").action(async (name, o) => {
+  box.command("get <name> [command...]").description("one box by name \u2014 its address and ssh key path; --ssh prints a ready-to-run connect recipe").option("--json", "machine-readable output").option("--ssh", "print a copy-paste ssh recipe (materializes the key to a temp file; never echoes it)").option("--script <path>", "with --ssh: write the recipe to <path> and print the one line to run \u2014 the runnable form for agent callers, whose transport denies a multi-line inline body (#3385)").action(async (name, command, o) => {
     try {
       const { boxes, incomplete } = await fetchInventory();
       const result = lookupBox(name, boxes, incomplete);
@@ -41932,8 +42126,9 @@ function registerBoxCommands(program3) {
         await failGraceful("runtime box get: --script requires --ssh (it writes the ssh connect recipe)");
         return;
       }
+      const remote = command && command.length ? command.join(" ") : void 0;
       const wroteScript = o.ssh && o.script ? o.script : null;
-      if (wroteScript) (0, import_node_fs42.writeFileSync)(wroteScript, sshRecipeScript(found), "utf8");
+      if (wroteScript) (0, import_node_fs42.writeFileSync)(wroteScript, sshRecipeScript(found, remote), "utf8");
       if (o.json) {
         console.log(JSON.stringify({
           box: found,
@@ -41941,7 +42136,7 @@ function registerBoxCommands(program3) {
           ...wroteScript ? { script: { path: wroteScript, run: `bash "${wroteScript}"` } } : {}
         }, null, 2));
       } else if (wroteScript) console.log(`wrote ${wroteScript} \u2014 run: bash "${wroteScript}"`);
-      else if (o.ssh) console.log(`${formatSshRecipe(found)}
+      else if (o.ssh) console.log(`${formatSshRecipe(found, remote)}
 ${SSH_RECIPE_AGENT_NOTE}`);
       else console.log(formatBoxTable([found]));
       if (!o.json) warnIncomplete2(incomplete);
@@ -45464,17 +45659,17 @@ function excessArgumentCorrection(extra, argv) {
   return sibling ? correctedPositionalCommand(sibling, extra[0], argv) : void 0;
 }
 var pendingHumanParseError;
-function writeHumanParseError(str) {
-  pendingHumanParseError = str;
+function writeHumanParseError(str2) {
+  pendingHumanParseError = str2;
 }
-function envelopeAwareWriteErr(str) {
-  const plain = str.replace(/\[[0-9;]*m/g, "");
+function envelopeAwareWriteErr(str2) {
+  const plain = str2.replace(/\[[0-9;]*m/g, "");
   if (plain.includes(PARSE_HINT_SENTINEL)) {
     if (unknownFlagJsonHandled && argvWantsJson3()) {
       pendingHumanParseError = void 0;
       return;
     }
-    const hint = str.replace(PARSE_HINT_SENTINEL, resolveParseHint());
+    const hint = str2.replace(PARSE_HINT_SENTINEL, resolveParseHint());
     if (lastParseErrorKind === "bad-arguments") {
       process.stderr.write(hint);
       if (pendingHumanParseError) process.stderr.write(pendingHumanParseError);
@@ -45490,7 +45685,7 @@ function envelopeAwareWriteErr(str) {
   const badChoice = parseInvalidChoiceError(plain);
   if (badChoice) {
     if (!argvWantsJson3()) {
-      writeHumanParseError(str);
+      writeHumanParseError(str2);
       return;
     }
     process.stderr.write(
@@ -45518,7 +45713,7 @@ function envelopeAwareWriteErr(str) {
       unknownFlagJsonHandled = true;
       return;
     }
-    writeHumanParseError(str.replace(/error: too many arguments[^\n]*/, `error: ${message2}`));
+    writeHumanParseError(str2.replace(/error: too many arguments[^\n]*/, `error: ${message2}`));
     return;
   }
   const match = /unknown option '([^']+)'/.exec(plain);
@@ -45544,18 +45739,18 @@ function envelopeAwareWriteErr(str) {
       return;
     }
     if (positional) {
-      writeHumanParseError(str.replace(/unknown option '[^']+'/, unknownTargetFlagMessage(flag, positional)));
+      writeHumanParseError(str2.replace(/unknown option '[^']+'/, unknownTargetFlagMessage(flag, positional)));
       return;
     }
-    writeHumanParseError(str);
+    writeHumanParseError(str2);
     return;
   }
   if (unknownFlagJsonHandled && argvWantsJson3()) return;
   if (argvWantsJson3()) {
-    process.stderr.write(str);
+    process.stderr.write(str2);
     return;
   }
-  writeHumanParseError(str);
+  writeHumanParseError(str2);
 }
 var INVOKED_ARGV3 = process.argv.slice(2);
 var program2 = new Command();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.3.67",
+  "version": "4.4.0",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",