@mutmutco/cli 4.5.175 → 4.5.176

package/dist/main.cjs

@@ -19193,10 +19193,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.175",
-    tag: "v4.5.175",
-    commit: "8efcf884c10f",
-    npm: "@mutmutco/cli@4.5.175"
+    version: "4.5.176",
+    tag: "v4.5.176",
+    commit: "d72dd40c950d",
+    npm: "@mutmutco/cli@4.5.176"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -19213,14 +19213,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.175"
+          v3Target: "v4.5.176"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.175 and redeploy the Hub Lambda from tag v4.5.175 (8efcf884c10f); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.175 (@mutmutco/cli@4.5.175, tag commit 8efcf884c10f \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.176 and redeploy the Hub Lambda from tag v4.5.176 (d72dd40c950d); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.176 (@mutmutco/cli@4.5.176, tag commit d72dd40c950d \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -33381,7 +33381,20 @@ init_hub_auth();
 init_github_client();
 
 // src/project-set.ts
-var UNSET_KEYS = ["projectAdmins", "installer", "oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary", "notifyOnDeploy", "vercelVersionEnv", "stageAllowlist", "suiteHold", "internalPeers", "previews"];
+function staticAssetsAreValid(value) {
+  if (value === void 0 || value === null) return true;
+  if (!Array.isArray(value) || value.length > 4) return false;
+  const prefixes = /* @__PURE__ */ new Set();
+  return value.every((entry) => {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) return false;
+    const e = entry;
+    if (Object.keys(e).some((k) => !["urlPrefix", "containerDir", "service"].includes(k))) return false;
+    if (typeof e.urlPrefix !== "string" || !/^\/[A-Za-z0-9._/-]+\/$/.test(e.urlPrefix) || e.urlPrefix.includes("..") || e.urlPrefix.includes("//") || prefixes.has(e.urlPrefix)) return false;
+    prefixes.add(e.urlPrefix);
+    return typeof e.containerDir === "string" && /^\/[A-Za-z0-9._/-]+$/.test(e.containerDir) && !e.containerDir.includes("..") && !e.containerDir.includes("//") && (e.service === void 0 || typeof e.service === "string" && /^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(e.service));
+  });
+}
+var UNSET_KEYS = ["projectAdmins", "installer", "oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "staticAssets", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary", "notifyOnDeploy", "vercelVersionEnv", "stageAllowlist", "suiteHold", "internalPeers", "previews"];
 var UNSET_KEY_SET = new Set(UNSET_KEYS);
 var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
 var SECRET_CONSUMERS = ["runtime", "build", "lambda", "actions", "agent", "box"];
@@ -33928,6 +33941,7 @@ var SETTABLE_VAR_KEYS = [
   "tenantTasks",
   "internalPeers",
   "edgeDomains",
+  "staticAssets",
   "statusFieldId",
   "statusOptions",
   "priorityFieldId",
@@ -33966,6 +33980,7 @@ var SETTABLE_VAR_HINTS = {
   tenantTasks: 'JSON map {name:{service,command[],stages[],timeoutSeconds?,artifact?:"required",output?:"file",secretOutput?:{path,vault:{repo,key},overwrite?}}} \u2014 merged per entry, at most 20 stored in total; retire ONE task with --unset-task NAME; use {artifact} in argv when required; a secretOutput is master-only',
   internalPeers: "JSON {owner/repo:[dev|rc|main]} \u2014 same-box suite peers via the box Caddy; clear with --unset internalPeers (#7886)",
   secrets: "JSON catalog map keyed by KEY {key,purpose,group,owner,stages[],consumers[],branchReadable?} \u2014 merged per entry; drop ONE entry with --unset-secret KEY; clear ALL with --unset secrets --confirm-clear-secrets; prefer --secrets-file",
+  staticAssets: 'JSON array, e.g. [{"urlPrefix":"/assets/","containerDir":"/app/dist/assets"}] \u2014 immutable edge skew protection',
   edgeDomains: "JSON {dev,rc,main} domain map",
   statusOptions: "JSON name\u2192id map",
   priorityOptions: "JSON {Urgent,High,Medium,Low}\u2192id map",
@@ -34166,6 +34181,15 @@ function buildProjectSetPatch(input) {
       patch[key] = parseRequiredChecksVar(raw);
     } else if (key === "requiredCheckBranches") {
       patch[key] = parseRequiredCheckBranchesVar(raw);
+    } else if (key === "staticAssets") {
+      let value2;
+      try {
+        value2 = JSON.parse(raw);
+      } catch {
+        throw new Error("staticAssets must be JSON");
+      }
+      if (value2 === null || !staticAssetsAreValid(value2)) throw new Error("staticAssets must be an array of up to 4 {urlPrefix, containerDir, service?} safe absolute paths with unique prefixes");
+      patch[key] = value2;
     } else if (key === "notifyOnDeploy") {
       patch[key] = parseNotifyOnDeployVar(raw);
     } else if (key === "vercelVersionEnv") {
@@ -38506,10 +38530,11 @@ function bundleTag(url) {
   }
 }
 async function stageStatus(member, stage, deps) {
-  const branch = stage === "dev" ? "development" : stage;
   if (member.repo === SUITE_REPO && stage === "rc") return { stage, head: "n/a", served: "n/a", source: "n/a", lag: null };
   let head;
   try {
+    const track = stage === "main" ? await deps.releaseTrack?.(member.repo) : void 0;
+    const branch = stage === "dev" || stage === "main" && track === "single" ? "development" : stage;
     const observed = await deps.head(member.repo, branch);
     if (observed === null) return { stage, head: "n/a", served: "n/a", source: "n/a", lag: null };
     head = observed || "unknown";
@@ -50939,6 +50964,11 @@ function suiteStatusDeps(github, registry2) {
       if (!file?.content) throw new Error(`MM-Work seed/modules.json at ${ref} is unavailable`);
       return JSON.parse(decodeGitHubContents(file.content));
     },
+    releaseTrack: async (repo) => {
+      const meta = await fetchProjectBySlugChecked(repo.split("/")[1].toLowerCase(), registry2);
+      if (!meta.ok || !meta.project) throw new Error(`${repo} META unreadable${meta.ok ? "" : `: ${meta.error}`}`);
+      return resolveReleaseTrack(meta.project, void 0, repo);
+    },
     deploy: async (repo, stage) => {
       const slug = repo.split("/")[1].toLowerCase();
       const facts = await fetchDeployFactsBySlug(slug, registry2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.175",
+  "version": "4.5.176",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",