@mutmutco/cli 4.3.9 → 4.3.10

package/dist/main.cjs

@@ -15450,10 +15450,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.3.9",
-    tag: "v4.3.9",
-    commit: "64fc1be95e37",
-    npm: "@mutmutco/cli@4.3.9"
+    version: "4.3.10",
+    tag: "v4.3.10",
+    commit: "6fe2720dc6ef",
+    npm: "@mutmutco/cli@4.3.10"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15470,14 +15470,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.3.9"
+          v3Target: "v4.3.10"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.3.9 and redeploy the Hub Lambda from tag v4.3.9 (64fc1be95e37); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.3.9 (@mutmutco/cli@4.3.9, tag commit 64fc1be95e37 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.3.10 and redeploy the Hub Lambda from tag v4.3.10 (6fe2720dc6ef); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.3.10 (@mutmutco/cli@4.3.10, tag commit 6fe2720dc6ef \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -21139,6 +21139,11 @@ async function probeRegistryWhoami(train) {
     (0, import_node_fs23.rmSync)(dir, { recursive: true, force: true });
   }
 }
+var REGISTRY_TOKEN_ENV = /\b(NODE_AUTH_TOKEN|NPM_TOKEN)\b/;
+function publishesViaTrustedPublisher(workflows) {
+  if (!workflows?.length) return false;
+  return workflows.some((f) => /\bid-token:\s*write\b/.test(f.body)) && !workflows.some((f) => REGISTRY_TOKEN_ENV.test(f.body));
+}
 var defaultDeps2 = {
   cliVersion: resolveClientVersion,
   fetchReleasedVersion: fetchNpmReleasedVersion,
@@ -21443,7 +21448,9 @@ async function runTrainDoctor(input) {
   }
   if (/"publishVisibility"\s*:\s*"private"/.test(deps.readSurfacesRaw(cwd) ?? "")) {
     const probe = await deps.registryWhoami(train);
-    if (probe.kind === "rejected") {
+    if (probe.kind === "rejected" && publishesViaTrustedPublisher(workflows)) {
+      add({ code: "npm-token-rejected", severity: "info", source: "origin", title: `the vault npm token (_org npm/NPM_TOKEN) is REJECTED by registry.npmjs.org \u2014 ${probe.detail}; no lane of this repo consumes it (its workflows publish through OIDC Trusted Publishing and name no registry token)`, remedy: "nothing on the release path. It affects only a manual `npm view` of a restricted package made through the `_org` hop, which 404s exactly like an absent one until the token is rotated (`mmi-cli vault secrets set npm/NPM_TOKEN --slug _org`). If this repo verifies through a different vault entry, this row does not describe that hop (#6187)" });
+    } else if (probe.kind === "rejected") {
       add({ code: "npm-token-rejected", severity: "warning", source: "origin", title: `the vault npm token (_org npm/NPM_TOKEN) is REJECTED by registry.npmjs.org \u2014 ${probe.detail}; every authenticated \`npm view\` of a restricted package will 404 exactly like an absent one`, remedy: 'rotate the org token: mint a fresh npm automation token, store it with `mmi-cli vault secrets set npm/NPM_TOKEN --slug _org` (master or an exact grant), and rerun. Until whoami answers a login, a restricted-package 404 proves nothing \u2014 never read it as "not published" (#6184)' });
     } else if (probe.kind === "unprobed") {
       add({ code: "npm-token-rejected", severity: "info", source: "origin", title: `the vault npm token was not probed (no _org npm/NPM_TOKEN grant, or a vault error): ${probe.detail}`, remedy: "nothing here \u2014 the release does not depend on it (CI publishes through OIDC Trusted Publishing). Before verifying a private publish by hand, run the whoami probe from an account holding the `_org` npm/NPM_TOKEN grant" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.3.9",
+  "version": "4.3.10",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",