@mutmutco/cli 4.4.0 → 4.4.2

package/dist/main.cjs

@@ -15870,10 +15870,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.4.0",
-    tag: "v4.4.0",
-    commit: "8e1fae5ff484",
-    npm: "@mutmutco/cli@4.4.0"
+    version: "4.4.2",
+    tag: "v4.4.2",
+    commit: "678e071c6859",
+    npm: "@mutmutco/cli@4.4.2"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15890,14 +15890,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.4.0"
+          v3Target: "v4.4.2"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.4.0 and redeploy the Hub Lambda from tag v4.4.0 (8e1fae5ff484); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.4.0 (@mutmutco/cli@4.4.0, tag commit 8e1fae5ff484 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.4.2 and redeploy the Hub Lambda from tag v4.4.2 (678e071c6859); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.4.2 (@mutmutco/cli@4.4.2, tag commit 678e071c6859 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -21628,6 +21628,51 @@ async function supersedeContentCausedDeployLeg(deps, cwd) {
 function supersedeablePublishLegShape(rec) {
   return rec.state === "failed" || rec.state === "pending" && rec.runId == null;
 }
+function deferredGatewayDeployLegShape(rec) {
+  return rec.state === "pending" && rec.runId == null && rec.workflow === "jerv-gateway";
+}
+async function proveOriginPromotionOrArchived(deps, prior, path2, label, ref) {
+  let liveSha = "";
+  try {
+    liveSha = (await deps.run("git", ["ls-remote", "origin", `refs/tags/${prior.tag}`])).trim().split(/\s+/)[0] ?? "";
+  } catch (e) {
+    throw new Error(`${label}: could not prove ${prior.tag} live on origin (${e instanceof Error ? e.message : String(e)}) \u2014 refusing to close the leg on an unproven state; retry when origin answers (${ref})`);
+  }
+  if (liveSha.toLowerCase() === prior.tagSha.toLowerCase()) return "live";
+  if (liveSha) {
+    throw new Error(
+      `${label}: origin reports ${prior.tag} at ${liveSha.slice(0, 12)} but the ledger anchors ${prior.tagSha.slice(0, 12)} \u2014 a divergent release is NOT supersedeable; nothing was written (${ref})`
+    );
+  }
+  let repository;
+  try {
+    repository = JSON.parse(await deps.run("gh", ["repo", "view", prior.repo, "--json", "nameWithOwner"]));
+  } catch (e) {
+    throw new Error(`${label}: could not prove repository access for ${prior.repo} (${e instanceof Error ? e.message.split("\n")[0] : String(e)}) \u2014 a Release 404 is untrusted without that proof; nothing was written (${ref})`);
+  }
+  if (repository.nameWithOwner !== prior.repo) {
+    throw new Error(`${label}: repository access proof named ${String(repository.nameWithOwner || "(missing)")}, not ${prior.repo} \u2014 nothing was written (${ref})`);
+  }
+  let releaseAbsent = false;
+  try {
+    await deps.run("gh", ["release", "view", prior.tag, "--repo", prior.repo, "--json", "tagName"]);
+  } catch (e) {
+    const detail = `${e instanceof Error ? e.message : String(e)} ${String(e.stderr ?? "")}`;
+    releaseAbsent = /release not found|HTTP 404|\(404\)/i.test(detail);
+    if (!releaseAbsent) {
+      throw new Error(`${label}: could not prove the GitHub Release for ${prior.tag} absent (${detail.split("\n")[0]}) \u2014 refusing to close on an unproven state; nothing was written (${ref})`);
+    }
+  }
+  if (!releaseAbsent) {
+    throw new Error(`${label}: origin no longer has ${prior.tag} but its GitHub Release still exists \u2014 resolve the mixed external state before closing the ledger; nothing was written (${ref})`);
+  }
+  const archivePath = (0, import_node_path21.join)((0, import_node_path21.dirname)(path2), `phases.archive-${prior.tag}.json`);
+  if ((0, import_node_fs21.existsSync)(archivePath)) {
+    throw new Error(`${label}: archive already exists at ${archivePath} \u2014 preserving both ledger records; resolve the collision by hand; nothing was written (${ref})`);
+  }
+  (0, import_node_fs21.renameSync)(path2, archivePath);
+  return "deleted";
+}
 async function supersedeContentCausedPublishLeg(deps, cwd) {
   const path2 = releaseLedgerPath(cwd);
   return withFileLock(`${path2}.lock`, { label: "release ledger" }, async () => {
@@ -21653,51 +21698,15 @@ async function supersedeContentCausedPublishLeg(deps, cwd) {
       const closed = await alignmentLegClosedLive(deps, prior);
       if (closed) phases.alignment = closed;
     }
-    const unresolved = ["promotion", "ordinaryCi", "githubRelease", "deploy", "alignment"].filter((phase) => phases[phase].state === "pending" || phases[phase].state === "failed");
+    let gatewayDeploy;
+    const deferredGateway = isJervHubRepo(prior.repo) && deferredGatewayDeployLegShape(phases.deploy);
+    const unresolved = ["promotion", "ordinaryCi", "githubRelease", "deploy", "alignment"].filter((phase) => !(phase === "deploy" && deferredGateway)).filter((phase) => phases[phase].state === "pending" || phases[phase].state === "failed");
     if (unresolved.length > 0) {
       throw new Error(
         `release --supersede-publish: ${prior.tag} has unresolved legs besides publish (${unresolved.map((p) => `${p}=${phases[p].state}`).join(", ")}) \u2014 the supersession closes only the publish leg of an otherwise-complete release; resolve those first, nothing was written (#6638)`
       );
     }
-    let liveSha = "";
-    try {
-      liveSha = (await deps.run("git", ["ls-remote", "origin", `refs/tags/${prior.tag}`])).trim().split(/\s+/)[0] ?? "";
-    } catch (e) {
-      throw new Error(`release --supersede-publish: could not prove ${prior.tag} live on origin (${e instanceof Error ? e.message : String(e)}) \u2014 refusing to close the leg on an unproven state; retry when origin answers (#6638)`);
-    }
-    if (liveSha.toLowerCase() !== prior.tagSha.toLowerCase()) {
-      if (liveSha) {
-        throw new Error(
-          `release --supersede-publish: origin reports ${prior.tag} at ${liveSha.slice(0, 12)} but the ledger anchors ${prior.tagSha.slice(0, 12)} \u2014 a divergent release is NOT supersedeable; nothing was written (#6638)`
-        );
-      }
-      let repository;
-      try {
-        repository = JSON.parse(await deps.run("gh", ["repo", "view", prior.repo, "--json", "nameWithOwner"]));
-      } catch (e) {
-        throw new Error(`release --supersede-publish: could not prove repository access for ${prior.repo} (${e instanceof Error ? e.message.split("\n")[0] : String(e)}) \u2014 a Release 404 is untrusted without that proof; nothing was written (#6638)`);
-      }
-      if (repository.nameWithOwner !== prior.repo) {
-        throw new Error(`release --supersede-publish: repository access proof named ${String(repository.nameWithOwner || "(missing)")}, not ${prior.repo} \u2014 nothing was written (#6638)`);
-      }
-      let releaseAbsent = false;
-      try {
-        await deps.run("gh", ["release", "view", prior.tag, "--repo", prior.repo, "--json", "tagName"]);
-      } catch (e) {
-        const detail = `${e instanceof Error ? e.message : String(e)} ${String(e.stderr ?? "")}`;
-        releaseAbsent = /release not found|HTTP 404|\(404\)/i.test(detail);
-        if (!releaseAbsent) {
-          throw new Error(`release --supersede-publish: could not prove the GitHub Release for ${prior.tag} absent (${detail.split("\n")[0]}) \u2014 refusing to close on an unproven state; nothing was written (#6638)`);
-        }
-      }
-      if (!releaseAbsent) {
-        throw new Error(`release --supersede-publish: origin no longer has ${prior.tag} but its GitHub Release still exists \u2014 resolve the mixed external state before closing the ledger; nothing was written (#6638)`);
-      }
-      const archivePath = (0, import_node_path21.join)((0, import_node_path21.dirname)(path2), `phases.archive-${prior.tag}.json`);
-      if ((0, import_node_fs21.existsSync)(archivePath)) {
-        throw new Error(`release --supersede-publish: archive already exists at ${archivePath} \u2014 preserving both ledger records; resolve the collision by hand; nothing was written (#6638)`);
-      }
-      (0, import_node_fs21.renameSync)(path2, archivePath);
+    if (await proveOriginPromotionOrArchived(deps, prior, path2, "release --supersede-publish", "#6638") === "deleted") {
       return {
         command: "release-supersede-publish",
         repo: prior.repo,
@@ -21706,6 +21715,25 @@ async function supersedeContentCausedPublishLeg(deps, cwd) {
         note: `closed the deleted ${prior.tag} publish failure by archiving its ledger after origin and GitHub both proved absent; start a fresh release train to carry the cause fix`
       };
     }
+    if (deferredGateway) {
+      const dispatch = await appendJervGatewayReleaseDeploy(
+        deps,
+        prior.repo,
+        prior.tag,
+        prior.tagSha,
+        { note: `Jerv Gateway operator-host deploy leg for ${prior.tag} run during the publish supersession`, deployStatus: "success" }
+      );
+      phases.deploy = {
+        ...phaseEntry(deployPhaseInput("registry-publish", dispatch, { releaseSha: prior.tagSha })),
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      if (dispatch.deployStatus !== "success") {
+        throw new Error(
+          `release --supersede-publish: the deferred ${prior.tag} Jerv Gateway operator-host deploy leg did not verify (${dispatch.note}) \u2014 run \`scripts/jerv-gateway-release-deploy.sh --tag ${prior.tag}\` to a healthy receipt naming the released tag and commit, then retry; nothing was written (#6742)`
+        );
+      }
+      gatewayDeploy = { workflow: "jerv-gateway", state: "complete", note: dispatch.note };
+    }
     const note = `superseded: content-caused publish failure on the immutable promoted ${prior.tag} \u2014 the cause fix rides the next patch train (master-approved closure, #6638)`;
     atomicWriteJson(path2, {
       ...prior,
@@ -21720,7 +21748,117 @@ async function supersedeContentCausedPublishLeg(deps, cwd) {
       repo: prior.repo,
       tag: prior.tag,
       tagSha: prior.tagSha,
-      note: `closed the ${prior.tag} publish leg as superseded (skipped) \u2014 the ledger is phases-green; rerun the train doctor to confirm, then run the next patch train (hotfix or release) to carry the cause fix`
+      note: `closed the ${prior.tag} publish leg as superseded (skipped) \u2014 the ledger is phases-green; rerun the train doctor to confirm, then run the next patch train (hotfix or release) to carry the cause fix`,
+      ...gatewayDeploy ? { gatewayDeploy } : {}
+    };
+  });
+}
+async function supersedeContentCausedDeployAndPublishLegs(deps, cwd) {
+  const label = "release --supersede-deploy --supersede-publish";
+  const ref = "#6752";
+  const path2 = releaseLedgerPath(cwd);
+  return withFileLock(`${path2}.lock`, { label: "release ledger" }, async () => {
+    let prior;
+    try {
+      prior = parseReleaseLedger((0, import_node_fs21.readFileSync)(path2, "utf8"));
+    } catch (e) {
+      throw new ReleaseLedgerError(
+        "unreadable",
+        `${label}: the active release ledger at ${path2} could not be read (${e instanceof Error ? e.message : String(e)}) \u2014 resolve it by hand before any train; nothing was written (${ref})`
+      );
+    }
+    const deploy = prior.phases.deploy;
+    const publish = prior.phases.publish;
+    const unresolvedLeg = (rec) => rec.superseded !== true && (rec.state === "pending" || rec.state === "failed");
+    const deployUnresolved = unresolvedLeg(deploy);
+    const publishUnresolved = unresolvedLeg(publish);
+    if (!deployUnresolved && !publishUnresolved) {
+      throw new Error(
+        deploy.superseded === true && publish.superseded === true ? `${label}: the ${prior.tag} deploy and publish legs are already superseded \u2014 nothing to do; the next train runs normally` : `${label}: the ${prior.tag} deploy and publish legs are both already resolved (deploy=${deploy.state}, publish=${publish.state}) \u2014 nothing to close; nothing was written (${ref})`
+      );
+    }
+    if (!deployUnresolved) {
+      throw new Error(`${label}: only the ${prior.tag} publish leg is unresolved (deploy=${deploy.state}) \u2014 use --supersede-publish for a single content-caused leg; nothing was written (${ref})`);
+    }
+    if (!publishUnresolved) {
+      throw new Error(`${label}: only the ${prior.tag} deploy leg is unresolved (publish=${publish.state}) \u2014 use --supersede-deploy for a single content-caused leg; nothing was written (${ref})`);
+    }
+    if (!supersedeablePublishLegShape(publish)) {
+      throw new Error(
+        `${label}: the ${prior.tag} publish leg is ${publish.state}` + (publish.runId != null ? ` with run ${publish.runId} \u2014 a run-backed leg is resolved by watching/reverifying its run, never superseded` : "") + `; the combined closure closes only a FAILED publish leg, or a PENDING one no run correlates (the uncorrelatable historical shape); nothing was written (${ref})`
+      );
+    }
+    const deferredGateway = isJervHubRepo(prior.repo) && deferredGatewayDeployLegShape(deploy);
+    if (!(deploy.state === "failed" && deploy.runId != null || deferredGateway)) {
+      throw new Error(
+        `${label}: the ${prior.tag} deploy leg is ${deploy.state}` + (deploy.runId != null ? ` with run ${deploy.runId} \u2014 a run-backed leg is resolved by watching/reverifying its run, never superseded` : "") + `; the combined closure closes only a content-caused FAILED deploy leg with its run id, or the deferred Jerv-Hub operator-host Gateway leg (#6742); nothing was written (${ref})`
+      );
+    }
+    const phases = { ...prior.phases };
+    if (phases.alignment.state === "pending") {
+      const closed = await alignmentLegClosedLive(deps, prior);
+      if (closed) phases.alignment = closed;
+    }
+    const unresolved = ["promotion", "ordinaryCi", "githubRelease", "alignment"].filter((phase) => phases[phase].state === "pending" || phases[phase].state === "failed");
+    if (unresolved.length > 0) {
+      throw new Error(
+        `${label}: ${prior.tag} has unresolved legs besides deploy and publish (${unresolved.map((p) => `${p}=${phases[p].state}`).join(", ")}) \u2014 the combined closure closes only the two content-caused legs of an otherwise-complete release; resolve those first, nothing was written (${ref})`
+      );
+    }
+    if (await proveOriginPromotionOrArchived(deps, prior, path2, label, ref) === "deleted") {
+      return {
+        command: "release-supersede-deploy-and-publish",
+        repo: prior.repo,
+        tag: prior.tag,
+        tagSha: prior.tagSha,
+        note: `closed the deleted ${prior.tag} deploy and publish failures by archiving its ledger after origin and GitHub both proved absent; start a fresh release train to carry the cause fix`
+      };
+    }
+    let deployEntry;
+    let gatewayDeploy;
+    if (deferredGateway) {
+      const dispatch = await appendJervGatewayReleaseDeploy(
+        deps,
+        prior.repo,
+        prior.tag,
+        prior.tagSha,
+        { note: `Jerv Gateway operator-host deploy leg for ${prior.tag} run during the deploy-and-publish supersession`, deployStatus: "success" }
+      );
+      deployEntry = {
+        ...phaseEntry(deployPhaseInput("registry-publish", dispatch, { releaseSha: prior.tagSha })),
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      if (dispatch.deployStatus !== "success") {
+        throw new Error(
+          `${label}: the deferred ${prior.tag} Jerv Gateway operator-host deploy leg did not verify (${dispatch.note}) \u2014 run \`scripts/jerv-gateway-release-deploy.sh --tag ${prior.tag}\` to a healthy receipt naming the released tag and commit, then retry; nothing was written (#6742)`
+        );
+      }
+      gatewayDeploy = { workflow: "jerv-gateway", state: "complete", note: dispatch.note };
+    } else {
+      deployEntry = {
+        state: "skipped",
+        sha: prior.tagSha,
+        superseded: true,
+        note: `superseded: content-caused deploy failure on the immutable promoted ${prior.tag} \u2014 the cause fix rides the next patch train (master-approved closure, ${ref})`,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+    }
+    phases.deploy = deployEntry;
+    phases.publish = {
+      state: "skipped",
+      sha: prior.tagSha,
+      superseded: true,
+      note: `superseded: content-caused publish failure on the immutable promoted ${prior.tag} \u2014 the cause fix rides the next patch train (master-approved closure, ${ref})`,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    atomicWriteJson(path2, { ...prior, phases, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    return {
+      command: "release-supersede-deploy-and-publish",
+      repo: prior.repo,
+      tag: prior.tag,
+      tagSha: prior.tagSha,
+      note: `closed the ${prior.tag} deploy and publish legs as superseded (skipped) \u2014 the ledger is phases-green; rerun the train doctor to confirm, then run the next patch train (hotfix or release) to carry the cause fix`,
+      ...gatewayDeploy ? { gatewayDeploy } : {}
     };
   });
 }
@@ -23810,6 +23948,17 @@ async function runReleaseSupersedePublish(deps, options = {}) {
     throw new Error(message2.includes("nothing was written") || message2.includes("nothing to do") ? message2 : `${message2}; nothing was written`);
   }
 }
+async function runReleaseSupersedeDeployAndPublish(deps, options = {}) {
+  if (!options.approved) {
+    throw new Error("release --supersede-deploy --supersede-publish requires --apply after explicit master approval; nothing was written");
+  }
+  try {
+    return await supersedeContentCausedDeployAndPublishLegs(deps, process.cwd());
+  } catch (e) {
+    const message2 = e instanceof Error ? e.message : String(e);
+    throw new Error(message2.includes("nothing was written") || message2.includes("nothing to do") ? message2 : `${message2}; nothing was written`);
+  }
+}
 async function runReleasePublishRetry(deps, runId, options = {}) {
   if (!options.approved) {
     throw new Error("release --retry-publish requires --apply after explicit approval; nothing was written");
@@ -29674,6 +29823,7 @@ var UNSET_KEY_SET = new Set(UNSET_KEYS);
 var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
 var SECRET_CONSUMERS = ["runtime", "build", "lambda", "actions", "agent", "box"];
 var SECRET_ENV_NAME_RE = /^[A-Za-z][A-Za-z0-9_]*$/;
+var SECRET_CATALOG_MAP_KEY_RE = /^[A-Za-z][A-Za-z0-9_]*(?:@(?:dev|rc|main))?$/;
 var BUILD_SECRET_REF_RE = /^(?:[A-Z_][A-Z0-9_]*=)?(?:[A-Z_][A-Z0-9_]*|(?:_org\/[a-z0-9][a-z0-9-]*):[A-Z_][A-Z0-9_]*|@github-packages-token)$/;
 function previewRegistryMetaMerge(existing, patch) {
   const out = { ...existing ?? {} };
@@ -30115,7 +30265,7 @@ var SETTABLE_VAR_HINTS = {
   requiredRuntimeSecrets: 'JSON stage map, e.g. {"dev":["KEY"],"rc":["KEY"],"main":["KEY"]}',
   requiredBuildSecrets: 'JSON flat array, e.g. ["NODE_AUTH_TOKEN=@github-packages-token"]',
   tenantTasks: 'JSON map {name:{service,command[],stages[],timeoutSeconds?,artifact?:"required"}}; use {artifact} in argv when required',
-  secrets: "JSON catalog map keyed by KEY {key,purpose,group,owner,stages[],consumers[]} \u2014 merged per entry; clear with --unset secrets; prefer --secrets-file",
+  secrets: "JSON catalog map keyed by KEY {key,purpose,group,owner,stages[],consumers[]} \u2014 merged per entry; drop ONE entry with --unset-secret KEY; clear ALL with --unset secrets --confirm-clear-secrets; prefer --secrets-file",
   edgeDomains: "JSON {dev,rc,main} domain map",
   statusOptions: "JSON name\u2192id map",
   priorityOptions: "JSON {Urgent,High,Medium,Low}\u2192id map",
@@ -30142,6 +30292,40 @@ function duplicateVarKeyAcrossFlags(vars, sets) {
   }
   return null;
 }
+function secretRemovalRefusal(existing, patch) {
+  const remove2 = Array.isArray(patch.secretsRemove) ? patch.secretsRemove : [];
+  if (remove2.length === 0) return null;
+  const declared = new Set(Object.keys(existing?.secrets ?? {}));
+  const runtime = patch.requiredRuntimeSecrets ?? existing?.requiredRuntimeSecrets ?? {};
+  const build = patch.requiredBuildSecrets ?? existing?.requiredBuildSecrets ?? [];
+  for (const mapKey of remove2) {
+    if (!declared.has(mapKey)) {
+      return `org project set: --unset-secret ${mapKey} is not declared in ${existing?.slug ?? "this project"}'s secrets catalog \u2014 nothing to remove`;
+    }
+    const at = mapKey.indexOf("@");
+    const canonical = at === -1 ? mapKey : mapKey.slice(0, at);
+    for (const [stage, names] of Object.entries(runtime)) {
+      if (Array.isArray(names) && names.includes(canonical)) {
+        return `org project set: ${canonical} is still required by stage ${stage} \u2014 drop it there first (--var requiredRuntimeSecrets=...)`;
+      }
+    }
+    for (const raw of build) {
+      if (typeof raw !== "string") continue;
+      const eq = raw.indexOf("=");
+      const ref = eq === -1 ? raw : raw.slice(eq + 1);
+      if (ref === canonical) {
+        return `org project set: ${canonical} is still required by the build secret contract \u2014 drop it there first (--var requiredBuildSecrets=...)`;
+      }
+    }
+  }
+  return null;
+}
+function clearSecretsConfirmationError(unsets, existing, confirmed) {
+  if (!unsets.includes("secrets")) return null;
+  const count = Object.keys(existing?.secrets ?? {}).length;
+  if (confirmed) return null;
+  return `org project set: --unset secrets clears the WHOLE catalog for ${existing?.slug ?? "this project"} (${count} declared entr${count === 1 ? "y" : "ies"} would be removed). To drop ONE entry use --unset-secret <KEY>; re-run with --confirm-clear-secrets to wipe all ${count}.`;
+}
 function buildProjectSetPatch(input) {
   const patch = {};
   if (input.class) {
@@ -30241,12 +30425,26 @@ function buildProjectSetPatch(input) {
     }
     patch[key] = null;
   }
+  if (input.unsetSecrets?.length) {
+    if (patch.secrets === null) {
+      throw new Error("org project set: --unset secrets clears the WHOLE catalog and cannot be combined with --unset-secret \u2014 pass one or the other");
+    }
+    const keys = [];
+    for (const raw of input.unsetSecrets) {
+      const key = raw.trim();
+      if (!SECRET_CATALOG_MAP_KEY_RE.test(key)) {
+        throw new Error(`org project set: --unset-secret must be a catalog KEY (UPPER_SNAKE, optionally KEY@dev|rc|main) \u2014 got ${JSON.stringify(raw)}`);
+      }
+      if (!keys.includes(key)) keys.push(key);
+    }
+    patch.secretsRemove = keys;
+  }
   if (input.clearWebProfile) {
     patch.oauth = null;
     patch.edgeDomains = null;
   }
   if (Object.keys(patch).length === 0) {
-    throw new Error("org project set: nothing to set - pass --class, --project-type, --deploy-model, --release-track, --var KEY=VALUE, --unset KEY, and/or --clear-web-profile");
+    throw new Error("org project set: nothing to set - pass --class, --project-type, --deploy-model, --release-track, --var KEY=VALUE, --unset KEY, --unset-secret KEY, and/or --clear-web-profile");
   }
   return patch;
 }
@@ -44613,7 +44811,12 @@ function renderReleaseSupersedeDeploy(r) {
   return `mmi-cli devops release --supersede-deploy --apply: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) \u2014 ${r.note}`;
 }
 function renderReleaseSupersedePublish(r) {
-  return `mmi-cli devops release --supersede-publish --apply: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) \u2014 ${r.note}`;
+  const base = `mmi-cli devops release --supersede-publish --apply: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) \u2014 ${r.note}`;
+  return r.gatewayDeploy ? `${base}; the deferred Jerv Gateway operator-host deploy leg was run and verified during the supersession (jerv-gateway=complete): ${r.gatewayDeploy.note}` : base;
+}
+function renderReleaseSupersedeDeployAndPublish(r) {
+  const base = `mmi-cli devops release --supersede-deploy --supersede-publish --apply: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) \u2014 ${r.note}`;
+  return r.gatewayDeploy ? `${base}; the deferred Jerv Gateway operator-host deploy leg was run and verified during the closure (jerv-gateway=complete): ${r.gatewayDeploy.note}` : base;
 }
 function renderReleasePublishRetry(r) {
   return `mmi-cli devops release --retry-publish: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) \u2014 ${r.note}; ${r.runUrl}`;
@@ -44844,8 +45047,8 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
       { flags: "--ack <shas>", description: "comma-separated dev shas a human verified are in the candidate, overriding the hotfix-coverage guard for a conflicted port whose -x trailer was lost (#958)" },
       { flags: "--dev", description: "full-track repos release development -> main directly, skipping rc (refuses if rc carries content not in development; no-op on direct-track repos) (#1062)" },
       { flags: "--abort", description: "with --apply, delete only a proven unpublished failed release candidate on any registered deploy model and restore local main for a same-version recut (#3944/#5650/#5657)" },
-      { flags: "--supersede-deploy", description: "with --apply, master-approved closure of a content-caused failed deploy leg on a PUBLISHED release whose immutable tag can never deploy green \u2014 the next patch train then carries the fix (#6553)" },
-      { flags: "--supersede-publish", description: "with --apply, master-approved closure of a content-caused failed publish leg on a fully PROMOTED release whose immutable tag can never publish green \u2014 the next patch train then carries the fix (#6638)" },
+      { flags: "--supersede-deploy", description: "with --apply, master-approved closure of a content-caused failed deploy leg on a PUBLISHED release whose immutable tag can never deploy green \u2014 the next patch train then carries the fix (#6553); combined with --supersede-publish it closes BOTH content-caused legs in one approved closure (#6752)" },
+      { flags: "--supersede-publish", description: "with --apply, master-approved closure of a content-caused failed publish leg on a fully PROMOTED release whose immutable tag can never publish green \u2014 a deferred Jerv-Hub operator-host Gateway deploy leg is run and verified as part of the closure \u2014 the next patch train then carries the fix (#6638/#6742); combined with --supersede-deploy it closes BOTH content-caused legs in one approved closure (#6752)" },
       { flags: "--retry-publish <run-id>", description: "with --apply, retry one proven failed or cancelled Hub publish release run (#3949/#5797)" }
     ];
     for (const f of RELEASE_ONLY_FLAGS) {
@@ -44885,6 +45088,25 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
       if (o.out && !o.apply && !o.resume) {
         return fail(`${commandName}: --out writes a terminal result receipt (--apply, --resume, --abort, --retry-publish) \u2014 the dry-run plan keeps its stdout/JSON output. Drop --out or rerun with --apply`);
       }
+      if (o.supersedeDeploy && o.supersedePublish) {
+        if (o.resume) return fail("release: --supersede-deploy --supersede-publish and --resume are mutually exclusive \u2014 the closure settles the ledger so a NEW train can run, resume re-derives the very legs it closes");
+        if (o.abort) return fail("release: --supersede-deploy --supersede-publish and --abort are mutually exclusive \u2014 the closure is for a PUBLISHED release, abort only ever deletes a proven unpublished candidate");
+        if (o.retryPublish) return fail("release: --supersede-deploy --supersede-publish cannot be combined with --retry-publish \u2014 a content-caused failure on the immutable tag cannot be retried green");
+        if (!o.apply) return fail("release: --supersede-deploy --supersede-publish requires --apply after explicit master approval; nothing was written");
+        if (o.watch || o.announceSummaryFile || o.ack || o.dev) {
+          return fail("release: --supersede-deploy --supersede-publish accepts only --apply, --repo, --json and --out; it closes ledger legs and dispatches nothing");
+        }
+        if (o.repo) {
+          const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), "mmi-cli devops release --supersede-deploy --supersede-publish --apply");
+          if (!guard.ok) return fail(`release: ${guard.message}`);
+        }
+        try {
+          const result = await runReleaseSupersedeDeployAndPublish(trainApplyDeps(), { approved: true });
+          return emitTrainResult("release --supersede-deploy --supersede-publish", o.json ? JSON.stringify(result, null, 2) : renderReleaseSupersedeDeployAndPublish(result), o.out);
+        } catch (e) {
+          return failGraceful(`release --supersede-deploy --supersede-publish: ${e.message}`);
+        }
+      }
       if (o.retryPublish) {
         if (o.resume || o.abort) return fail("release: --retry-publish cannot be combined with --resume or --abort");
         if (!o.apply) return fail("release: --retry-publish requires --apply after explicit approval; nothing was written");
@@ -44926,9 +45148,6 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
           return failGraceful(`release --abort: ${e.message}`);
         }
       }
-      if (o.supersedeDeploy && o.supersedePublish) {
-        return fail("release: --supersede-deploy and --supersede-publish are mutually exclusive \u2014 close the one leg that failed content-caused; the other leg has its own resolution paths");
-      }
       if (o.supersedeDeploy) {
         if (o.resume) return fail("release: --supersede-deploy and --resume are mutually exclusive \u2014 the closure settles the ledger so a NEW train can run, resume re-derives the very leg it closes");
         if (o.abort) return fail("release: --supersede-deploy and --abort are mutually exclusive \u2014 the closure is for a PUBLISHED release, abort only ever deletes a proven unpublished candidate");
@@ -46026,7 +46245,7 @@ projectDeploy.command("doctor").description("read-only estate scan for duplicate
   if (report.error && report.status !== 403) return failGraceful(`org project deploy doctor: ${report.error}`);
   if (!report.ok && !report.error) process.exitCode = 1;
 });
-project.command("set [owner/repo]").description("upsert project META (idempotent merge; master-gated)").addOption(new Option("--class <class>", "deployable | content").choices(["deployable", "content"])).addOption(new Option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).choices([...PROJECT_TYPES])).addOption(new Option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).choices([...DEPLOY_MODELS])).addOption(new Option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).choices([...RELEASE_TRACKS])).option("--var <KEY=VALUE...>", settableVarHelp()).option("--set <KEY=VALUE...>", "alias of --var (one KEY=VALUE per flag; repeat the flag to set several)").option("--secrets-file <path>", 'read the #2244 secrets catalog map (JSON) from a file and merge it per entry into the existing catalog (clear all with --unset secrets). SHAPE: a JSON object keyed by env name, each entry {"key":"UPPER_SNAKE" (repeat the env name), "purpose":"<non-empty>", "group":"<e.g. auth|database>", "owner":"<github login>", "stages":[] (empty = the one stageless shared value; else any of dev/rc/main), "consumers":["runtime"|"box"|?], "provider":"<optional>"}').option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, requiredBuildSecrets, secrets, edgeDomains, requiredGcpApis, publishRequired, releaseChannel, releaseLanguage").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+project.command("set [owner/repo]").description("upsert project META (idempotent merge; master-gated)").addOption(new Option("--class <class>", "deployable | content").choices(["deployable", "content"])).addOption(new Option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).choices([...PROJECT_TYPES])).addOption(new Option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).choices([...DEPLOY_MODELS])).addOption(new Option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).choices([...RELEASE_TRACKS])).option("--var <KEY=VALUE...>", settableVarHelp()).option("--set <KEY=VALUE...>", "alias of --var (one KEY=VALUE per flag; repeat the flag to set several)").option("--secrets-file <path>", 'read the #2244 secrets catalog map (JSON) from a file and merge it per entry into the existing catalog (drop ONE entry with --unset-secret KEY; clear ALL with --unset secrets --confirm-clear-secrets). SHAPE: a JSON object keyed by env name, each entry {"key":"UPPER_SNAKE" (repeat the env name), "purpose":"<non-empty>", "group":"<e.g. auth|database>", "owner":"<github login>", "stages":[] (empty = the one stageless shared value; else any of dev/rc/main), "consumers":["runtime"|"box"|?], "provider":"<optional>"}').option("--unset-secret <KEY...>", "remove exactly these #2244 catalog entries (repeatable; KEY or KEY@dev|rc|main). Refuses while a stage still requires the key \u2014 drop it from requiredRuntimeSecrets/requiredBuildSecrets first").option("--confirm-clear-secrets", "required to let --unset secrets wipe the WHOLE catalog (the refusal names how many entries that removes)").option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, requiredBuildSecrets, secrets (the WHOLE catalog \u2014 needs --confirm-clear-secrets), edgeDomains, requiredGcpApis, publishRequired, releaseChannel, releaseLanguage").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -46056,15 +46275,26 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
       releaseTrack: o.releaseTrack,
       vars,
       unsets: o.unset ?? [],
+      unsetSecrets: o.unsetSecret ?? [],
       clearWebProfile: Boolean(o.clearWebProfile)
     });
   } catch (e) {
     return fail(e.message.replace(/^org project set: /, "org project set: "));
   }
   const existing = await fetchProjectBySlug(slug, registryClientDeps(cfg));
+  const clearRefusal = clearSecretsConfirmationError(o.unset ?? [], existing, Boolean(o.confirmClearSecrets));
+  if (clearRefusal) return fail(clearRefusal);
+  const removalRefusal = secretRemovalRefusal(existing, patch);
+  if (removalRefusal) return fail(removalRefusal);
   const boardError = boardLinkWriteError(patch, existing);
   if (boardError) return fail(`org project set: ${boardError}`);
   const res = await upsertProject(slug, { ...patch, repo }, registryClientDeps(cfg));
+  const removedKeys = Array.isArray(patch.secretsRemove) ? patch.secretsRemove : [];
+  if (removedKeys.length && res.ok) {
+    const body = res.body;
+    const remaining = Object.keys(body?.project?.secrets ?? {}).sort();
+    printLine(`org project set: removed ${removedKeys.join(", ")} \u2014 catalog now declares ${remaining.length}: ${remaining.join(", ") || "(none)"}`);
+  }
   return reportWrite("org project set", res);
 });
 project.command("retire [owner/repo]").description("retire an orphaned registry slug (master-only): soft-delete the PROJECT# META row + drop the repo's board items; secrets/vault left alone. DRY-RUN by default \u2014 pass --apply to actually delete; defaults to the current repo").option("--apply", "actually delete (default is a dry-run preview of what would be removed)").option("--skip-board", "retire the registry META only \u2014 leave board items in place").option("--json", "machine-readable {slug, removedMeta, removedBoardItem} output").action(async (repoOrSlug, o) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.4.0",
+  "version": "4.4.2",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",