@mutmutco/cli 4.5.125 → 4.5.127

package/dist/main.cjs

@@ -8766,8 +8766,9 @@ async function retireProject(slug, deps) {
 async function setDeployCoords(slug, payload, deps) {
   return postJson(`/projects/${encodeURIComponent(slug)}/deploy`, payload, deps);
 }
-async function retireDeployCoords(slug, stage, deps) {
-  return postJson(`/projects/${encodeURIComponent(slug)}/deploy/${encodeURIComponent(stage)}`, {}, deps, "DELETE", { noRetry: true });
+async function retireDeployCoords(slug, stage, deps, decommissioned = false) {
+  const q = decommissioned ? "?decommissioned=1" : "";
+  return postJson(`/projects/${encodeURIComponent(slug)}/deploy/${encodeURIComponent(stage)}${q}`, {}, deps, "DELETE", { noRetry: true });
 }
 async function postSchedulesLift(repo, schedules, deps) {
   const res = await postJson("/schedules/lift", { repo, schedules }, deps);
@@ -18243,10 +18244,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.125",
-    tag: "v4.5.125",
-    commit: "00accba6d8e0",
-    npm: "@mutmutco/cli@4.5.125"
+    version: "4.5.127",
+    tag: "v4.5.127",
+    commit: "1a7a42121998",
+    npm: "@mutmutco/cli@4.5.127"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -18263,14 +18264,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.125"
+          v3Target: "v4.5.127"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.125 and redeploy the Hub Lambda from tag v4.5.125 (00accba6d8e0); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.125 (@mutmutco/cli@4.5.125, tag commit 00accba6d8e0 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.127 and redeploy the Hub Lambda from tag v4.5.127 (1a7a42121998); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.127 (@mutmutco/cli@4.5.127, tag commit 1a7a42121998 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -32313,7 +32314,7 @@ function parseTenantTasksVar(raw) {
     if (typeof task.service !== "string" || !serviceRe.test(task.service)) throw new Error(`org project set: tenantTasks.${name}.service has an unsafe shape`);
     if (!Array.isArray(task.command) || task.command.length < 1 || task.command.length > 32 || task.command.some((arg) => typeof arg !== "string" || arg.length < 1 || arg.length > 256 || /[\u0000\r\n]/.test(arg))) throw new Error(`org project set: tenantTasks.${name}.command must be 1-32 bounded argv strings`);
     if (!Array.isArray(task.stages) || task.stages.length < 1 || task.stages.length > 3 || task.stages.some((stage) => typeof stage !== "string" || !validStages.has(stage)) || new Set(task.stages).size !== task.stages.length) throw new Error(`org project set: tenantTasks.${name}.stages must be unique dev/rc/main values`);
-    const maxTimeout = task.secretOutput !== void 0 ? 3600 : 7200;
+    const maxTimeout = task.secretOutput !== void 0 ? 3600 : 10800;
     if (task.timeoutSeconds !== void 0 && (!Number.isInteger(task.timeoutSeconds) || task.timeoutSeconds < 1 || task.timeoutSeconds > maxTimeout)) throw new Error(`org project set: tenantTasks.${name}.timeoutSeconds must be an integer 1..${maxTimeout}`);
     const artifact = task.artifact ?? "none";
     if (artifact !== "none" && artifact !== "required") throw new Error(`org project set: tenantTasks.${name}.artifact must be none or required`);
@@ -52870,7 +52871,10 @@ function buildDeployRetirePlan(input) {
   if (!["dev", "rc", "main"].includes(input.stage)) {
     throw new Error("org project deploy retire: --stage must be dev, rc, or main");
   }
-  return { slug, stage: input.stage, apply: Boolean(input.apply) };
+  if (input.decommissioned && input.stage !== "main") {
+    throw new Error("org project deploy retire: --decommissioned applies to --stage main only (dev/rc always retire)");
+  }
+  return { slug, stage: input.stage, apply: Boolean(input.apply), decommissioned: Boolean(input.decommissioned) };
 }
 async function runDeployRetire(input, deps) {
   const plan = buildDeployRetirePlan(input);
@@ -52879,7 +52883,20 @@ async function runDeployRetire(input, deps) {
   if (!plan.apply) {
     return { slug: plan.slug, stage: plan.stage, applied: false, ok: facts !== null, existing };
   }
-  const res = await retireDeployCoords(plan.slug, plan.stage, deps.registry);
+  if (plan.decommissioned) {
+    const state = deps.boxServiceState ? await deps.boxServiceState(plan.stage) : "unknown";
+    if (state !== "missing") {
+      return {
+        slug: plan.slug,
+        stage: plan.stage,
+        applied: false,
+        ok: false,
+        existing,
+        error: `--decommissioned needs the box to show ${plan.stage} gone (tenant-control status serviceState=missing), got ${state} \u2014 run tenant control <repo> ${plan.stage} retire first`
+      };
+    }
+  }
+  const res = await retireDeployCoords(plan.slug, plan.stage, deps.registry, plan.decommissioned);
   if (!res.ok) {
     return { slug: plan.slug, stage: plan.stage, applied: true, ok: false, existing, error: writeError2(res) };
   }
@@ -56155,7 +56172,7 @@ projectDeploy.command("doctor").description("read-only estate port scan; --box l
   if (report.error && report.status !== 403) return failGraceful(`org project deploy doctor: ${report.error}`);
   if (!report.ok && !report.error) process.exitCode = 1;
 });
-projectDeploy.command("retire [owner/repo]").description("retire (tombstone) one stage's DEPLOY# row for a project that no longer deploys through it (#7095, master-only). --stage is required. DRY-RUN by default \u2014 pass --apply to actually write; defaults to the current repo. Refuses a tenant-container project's live main row.").addOption(new Option("--stage <stage>", "dev | rc | main (required)").choices(["dev", "rc", "main"])).option("--apply", "actually retire (default is a dry-run preview of the row that would be retired)").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+projectDeploy.command("retire [owner/repo]").description("retire (tombstone) one stage's DEPLOY# row for a project that no longer deploys through it (#7095, master-only). --stage is required. DRY-RUN by default \u2014 pass --apply to actually write; defaults to the current repo. Refuses a tenant-container project's live main row.").addOption(new Option("--stage <stage>", "dev | rc | main (required)").choices(["dev", "rc", "main"])).option("--apply", "actually retire (default is a dry-run preview of the row that would be retired)").option("--decommissioned", "main only (#8148): retire a tenant-container main row after `runtime tenant control <repo> main retire`; the box must show main gone").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const stage = projectDeploy.opts().stage;
   if (!stage) return fail("org project deploy retire: --stage is required (dev | rc | main)");
   const cfg = await loadConfig();
@@ -56168,8 +56185,14 @@ projectDeploy.command("retire [owner/repo]").description("retire (tombstone) one
   let result;
   try {
     result = await runDeployRetire(
-      { target, stage, apply: Boolean(o.apply) },
-      { registry: registryClientDeps(cfg) }
+      { target, stage, apply: Boolean(o.apply), decommissioned: Boolean(o.decommissioned) },
+      {
+        registry: registryClientDeps(cfg),
+        boxServiceState: async (s) => {
+          const r = await runTenantControl(trainApplyDeps(), { repo: target, stage: s, action: "status", watch: true });
+          return r.conclusion === "success" ? r.serviceState ?? "unknown" : "error";
+        }
+      }
     );
   } catch (e) {
     return fail(e.message);
@@ -56434,7 +56457,7 @@ ${filelessTransitionGuide(target, o.stage)}`
   return reportWrite("org project set-deploy", res);
 });
 var projectTenantTasks = project.command("tenant-tasks").description("project-admin self-declare of tenant tasks for every stage of your own repo \u2014 new-task-only; editing an existing task stays master-only (`org project set --var tenantTasks=...`)");
-projectTenantTasks.command("declare <name>").description("register a NEW tenant task \u2014 becomes runnable via `runtime tenant control \u2026 run-task` on its declared dev/rc/main stages. Body shape {service,command[],stages[],timeoutSeconds?,artifact?}; required artifact tasks must carry {artifact} in the command argv.").option("--service <name>", "service in the tenant runtime the task runs in (required unless --var carries it)").option("--command <argv...>", `task command as argv (repeatable; required unless --var carries it). An argv token that starts with "-" (python -m mod) is read as an option and the whole call fails to parse: declare such a command with --var '{"service":"<svc>","command":["python","-m","mod"],"stages":["dev"]}' instead (#7668)`).option("--stages <list>", "comma-separated dev,rc,main stages this task may run on (required unless --var carries it)").option("--timeout-seconds <n>", "optional wall-clock ceiling 1..7200 (1..3600 with a secretOutput)").option("--artifact <none|required>", "artifact contract (default none; required tasks must contain {artifact} in argv)").option("--var <json>", "full task object {service,command[],stages[],timeoutSeconds?,artifact?} \u2014 use instead of the individual flags. A task carrying secretOutput:{path,vault:{repo,key},overwrite?} is master-only; declare that via `org project set --var tenantTasks=...`").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (name, o) => {
+projectTenantTasks.command("declare <name>").description("register a NEW tenant task \u2014 becomes runnable via `runtime tenant control \u2026 run-task` on its declared dev/rc/main stages. Body shape {service,command[],stages[],timeoutSeconds?,artifact?}; required artifact tasks must carry {artifact} in the command argv.").option("--service <name>", "service in the tenant runtime the task runs in (required unless --var carries it)").option("--command <argv...>", `task command as argv (repeatable; required unless --var carries it). An argv token that starts with "-" (python -m mod) is read as an option and the whole call fails to parse: declare such a command with --var '{"service":"<svc>","command":["python","-m","mod"],"stages":["dev"]}' instead (#7668)`).option("--stages <list>", "comma-separated dev,rc,main stages this task may run on (required unless --var carries it)").option("--timeout-seconds <n>", "optional wall-clock ceiling 1..10800 (1..3600 with a secretOutput)").option("--artifact <none|required>", "artifact contract (default none; required tasks must contain {artifact} in argv)").option("--var <json>", "full task object {service,command[],stages[],timeoutSeconds?,artifact?} \u2014 use instead of the individual flags. A task carrying secretOutput:{path,vault:{repo,key},overwrite?} is master-only; declare that via `org project set --var tenantTasks=...`").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (name, o) => {
   const cfg = await loadConfig();
   let target;
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.125",
+  "version": "4.5.127",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",