@mutmutco/cli 4.5.21 → 4.5.23

package/dist/main.cjs

@@ -7803,6 +7803,28 @@ async function postJson(pathSuffix, payload, deps, method = "POST", opts = {}) {
     return { ok: false, status: 0, body: null, error: e.message, unreachable: "transport" };
   }
 }
+async function edgeCertificateForStage(slug, stage, deps, ensure = false) {
+  if (!deps.baseUrl) throw new Error("Hub API URL unavailable");
+  const token = await deps.token();
+  if (!token) throw new Error("Hub session token unavailable");
+  const path2 = `/projects/${encodeURIComponent(slug)}/edge-certificates/${stage}`;
+  if (ensure) {
+    const write = await postJson(path2, {}, deps, "POST", { noRetry: true });
+    if (!write.ok) throw new Error(`Hub edge certificate ensure failed: ${write.error ?? `HTTP ${write.status}`}`);
+    const body2 = write.body;
+    if (typeof body2?.required !== "boolean") throw new Error("Hub edge certificate response invalid");
+    return body2;
+  }
+  const res = await retriedFetch(
+    deps,
+    `${deps.baseUrl.replace(/\/$/, "")}${path2}`,
+    { method: "GET", headers: { Authorization: `Bearer ${token}` } }
+  );
+  if (!res.ok) throw new Error(`Hub edge certificate ${ensure ? "ensure" : "read"} failed: HTTP ${res.status}`);
+  const body = await res.json();
+  if (typeof body?.required !== "boolean") throw new Error("Hub edge certificate response invalid");
+  return body;
+}
 async function registerProject(payload, deps) {
   return postJson("/projects/register", payload, deps);
 }
@@ -8016,16 +8038,18 @@ function pickTenantDeployRun(rows, slug, stage) {
 function publicUrlFromDeployFact(fact) {
   return fact?.domain ? `https://${fact.domain}` : void 0;
 }
-function tenantRuntimeHints(stage, fact, probe) {
+function tenantRuntimeHints(stage, fact, probe, edgeCertificate) {
   const hints = [];
   if (!fact) {
     hints.push(`DEPLOY#${stage} row missing or state-only; seed deploy coords before runtime audit can prove the endpoint.`);
+    if (edgeCertificate?.missing && edgeCertificate.hint) hints.push(edgeCertificate.hint);
     return hints;
   }
   if (!fact.sshHostPresent && fact.substrate === "hetzner-ssh") hints.push(`DEPLOY#${stage} has hetzner-ssh substrate but no sshHost presence; tenant-deploy cannot reach the box.`);
   if (!fact.domain) hints.push(`DEPLOY#${stage} has no edgeVhost.domain; Cloudflare/Caddy public URL cannot be derived.`);
   if (typeof fact.port !== "number") hints.push(`DEPLOY#${stage} has no edgeVhost.port; Caddy upstream/healthUrl hints cannot be checked.`);
   if (probe?.url?.endsWith("/health") && probe.ok === false) hints.push(`Root is auth-walled (401/403) and ${probe.url} answered ${probe.status ?? probe.error}; expose a 2xx /health route or fix the app \u2014 the edge is fine.`);
+  else if (edgeCertificate?.missing && edgeCertificate.hint) hints.push(edgeCertificate.hint);
   else if (probe?.ok === false || probe?.status != null && probe.status >= 500) hints.push("Public URL probe failed; for Cloudflare 525 check Caddy TLS/origin certificate and Cloudflare SSL mode before changing app code.");
   if (stage === "rc") hints.push("rc runtime is expected to be ephemeral: present between /rcand and /release, then retired after release.");
   return hints;
@@ -8040,9 +8064,13 @@ function buildTenantRuntimeStatus(input) {
     deploy: input.deploy ?? null,
     publicUrl,
     publicProbe: input.publicProbe,
+    edgeCertificate: input.edgeCertificate,
     lastTenantDeployRun: input.lastTenantDeployRun,
     expectedEphemeralRc: input.stage === "rc",
-    hints: tenantRuntimeHints(input.stage, input.deploy, input.publicProbe)
+    hints: [
+      ...tenantRuntimeHints(input.stage, input.deploy, input.publicProbe, input.edgeCertificate),
+      ...input.edgeCertificateError ? [`Cloudflare edge certificate coverage unreadable: ${input.edgeCertificateError}`] : []
+    ]
   };
 }
 function buildFullTrackReadinessReport(input) {
@@ -16725,10 +16753,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.21",
-    tag: "v4.5.21",
-    commit: "af03f80d9717",
-    npm: "@mutmutco/cli@4.5.21"
+    version: "4.5.23",
+    tag: "v4.5.23",
+    commit: "cca49db9ef76",
+    npm: "@mutmutco/cli@4.5.23"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -16745,14 +16773,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.21"
+          v3Target: "v4.5.23"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.21 and redeploy the Hub Lambda from tag v4.5.21 (af03f80d9717); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.21 (@mutmutco/cli@4.5.21, tag commit af03f80d9717 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.23 and redeploy the Hub Lambda from tag v4.5.23 (cca49db9ef76); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.23 (@mutmutco/cli@4.5.23, tag commit cca49db9ef76 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -28350,6 +28378,8 @@ var APP_POLL_PERMISSIONS = {
   metadata: "read",
   contents: "read",
   pull_requests: "read",
+  // #7185: without issues:read GraphQL silently drops pr view's closingIssuesReferences.
+  issues: "read",
   checks: "read",
   statuses: "read",
   actions: "read"
@@ -31744,6 +31774,17 @@ function deployRowChecks(repo, deployModel, releaseTrack, facts, factsRead) {
     };
   });
 }
+function edgeCertificateChecks(results) {
+  return results.flatMap((result) => {
+    if (!result) return [];
+    const { stage, status, error } = result;
+    return [{
+      ok: !error && (status?.required === false || status?.required === true && status.missing === false),
+      label: `Cloudflare edge certificate: ${stage}`,
+      detail: error ? `certificate coverage unreadable (${error}); cannot verify TLS` : status?.hint
+    }];
+  });
+}
 async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
   const branchesWanted = expectedBranches(repoClass, releaseTrack);
   const baseBranch = releaseTrack === "trunk" || repoClass === "content" ? "main" : "development";
@@ -31865,6 +31906,7 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
     const check = npmrcGitHubPackagesAuthCheck(path2, await contentText(deps, repo, baseBranch, path2));
     if (check) checks.push(check);
   }
+  checks.push(...edgeCertificateChecks(deps.edgeCertificates ?? []));
   const portRangeCheck = centralContainerPortRangeCheck(deps.deployModel, deps.projectMeta?.portRange, repo);
   if (portRangeCheck) checks.push(portRangeCheck);
   checks.push(...deployRowChecks(
@@ -32279,6 +32321,15 @@ function registerBootstrapCommands(program3) {
       deployModel: typeof meta?.deployModel === "string" ? meta.deployModel : void 0,
       deployFacts,
       deployFactsRead: deployFacts !== null,
+      edgeCertificates: await Promise.all(["dev", "rc"].map(async (stage) => {
+        const domain = meta?.edgeDomains?.[stage];
+        if (!domain) return null;
+        try {
+          return { stage, status: await edgeCertificateForStage(slug, stage, reg) };
+        } catch (e) {
+          return { stage, error: e.message };
+        }
+      })),
       pushAllowlistOwners: verifyOwners,
       pushAllowlistOwnersRead: verifyOwnersRead,
       readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs28.existsSync)(path2) ? (0, import_node_fs28.readFileSync)(path2, "utf8") : null,
@@ -33003,6 +33054,15 @@ ${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owne
       if (res.ok) {
         ddbWrites.push({ slug: registerPayload.slug, action: "register", record: registerPayload });
         applied.push(`ddb register ${registerPayload.slug}`);
+        for (const stage of ["dev", "rc"]) {
+          if (!registerPayload.edgeDomains?.[stage]) continue;
+          try {
+            const cert = await edgeCertificateForStage(slug, stage, reg, true);
+            if (cert.required) applied.push(`edge certificate ${stage}: ${cert.action ?? "checked"}`);
+          } catch (e) {
+            return failGraceful(`bootstrap apply: edge certificate ${stage} could not be ensured after registry write (${e.message}); rerun apply to reconcile \u2014 do not treat this bootstrap as complete`);
+          }
+        }
         const deployModel = typeof registerPayload.deployModel === "string" ? registerPayload.deployModel : void 0;
         if (deployModel === "tenant-container" || deployModel === "solo-container") {
           const shortName = typeof registerPayload.name === "string" ? registerPayload.name : typeof registerPayload.slug === "string" ? registerPayload.slug : repo.split("/")[1] || repo;
@@ -48656,7 +48716,7 @@ tenant.command("status <owner/repo> <stage>").description("read tenant runtime r
   const cfg = await loadConfig();
   const result = await buildTenantRuntimeStatusFor(repo, stage, cfg);
   console.log(JSON.stringify(result, null, 2));
-  if (result.publicProbe?.ok === false) process.exitCode = 1;
+  if (result.publicProbe?.ok === false || result.edgeCertificate?.missing) process.exitCode = 1;
 });
 tenant.command("redeploy <owner/repo> <stage>").description("re-dispatch the central tenant-deploy.yml for an already-promoted ref (no re-tag/merge); train-authority gated").option("--ref <ref>", "ref to deploy (defaults to the stage branch rc/main, or `development` for dev \u2014 the promoted/staging ref)").option("--watch", "block on the dispatched run and report its outcome (gh run watch --exit-status)").option("--json", "machine-readable output").action(async (repo, stage, o) => {
   if (stage !== "dev" && stage !== "rc" && stage !== "main") return fail("runtime tenant redeploy: <stage> must be dev, rc, or main");
@@ -48700,12 +48760,27 @@ async function buildTenantRuntimeStatusFor(target, stage, cfg) {
   const deploy = facts?.stages[stage] ?? null;
   const publicUrl = publicUrlFromDeployFact(deploy);
   const publicProbe = publicUrl ? await probePublicHealth(publicUrl) : void 0;
+  let edgeCertificate;
+  let edgeCertificateError;
+  if (stage === "dev" || stage === "rc") {
+    try {
+      edgeCertificate = await edgeCertificateForStage(slug, stage, reg);
+      if (deploy?.domain && edgeCertificate.host !== deploy.domain.toLowerCase()) {
+        edgeCertificateError = `registered edge host ${edgeCertificate.host} differs from DEPLOY#${stage} ${deploy.domain}`;
+        edgeCertificate = void 0;
+      }
+    } catch (e) {
+      edgeCertificateError = e.message;
+    }
+  }
   return buildTenantRuntimeStatus({
     repo: target,
     slug,
     stage,
     deploy,
     publicProbe,
+    edgeCertificate,
+    edgeCertificateError,
     // Filter the central run list to THIS tenant + stage; rows[0] is whichever tenant deployed last (#2909).
     lastTenantDeployRun: (await fetchLastTenantDeployRun(slug, stage)).run
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.21",
+  "version": "4.5.23",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",