@mutmutco/cli 4.5.36 → 4.5.38

package/dist/main.cjs

@@ -863,6 +863,9 @@ var init_house_map = __esm({
 });
 
 // src/stdin-inject.ts
+function setInjectedStdin(payload) {
+  injectedStdin = payload;
+}
 function stdinHasPipedInput(statFd = () => (0, import_node_fs4.fstatSync)(0), getIsTTY = () => process.stdin.isTTY) {
   try {
     const stat4 = statFd();
@@ -922,6 +925,34 @@ var init_stdin_inject = __esm({
 });
 
 // src/cli-shared.ts
+var cli_shared_exports = {};
+__export(cli_shared_exports, {
+  DEFAULT_EXEC_TIMEOUT_MS: () => DEFAULT_EXEC_TIMEOUT_MS,
+  ExecDeadlineError: () => ExecDeadlineError,
+  GIT_TIMEOUT_MS: () => GIT_TIMEOUT_MS,
+  consoleIo: () => consoleIo,
+  execFileHard: () => execFileHard,
+  execFileP: () => execFileP,
+  fail: () => fail,
+  failGraceful: () => failGraceful,
+  failGracefulEnvelope: () => failGracefulEnvelope,
+  gitOut: () => gitOut,
+  githubLogin: () => githubLogin,
+  hubHeaders: () => hubHeaders,
+  installBrokenPipeGuard: () => installBrokenPipeGuard,
+  installProcessBackstop: () => installProcessBackstop,
+  isOrgRepoRoot: () => isOrgRepoRoot,
+  jsonParity: () => jsonParity,
+  loadConfig: () => loadConfig,
+  mutating: () => mutating,
+  planMutation: () => planMutation,
+  printLine: () => printLine,
+  rawFlag: () => rawFlag,
+  rawValue: () => rawValue,
+  readStdin: () => readStdin,
+  repoProject: () => repoProject,
+  setInjectedStdin: () => setInjectedStdin
+});
 function killProcessTree(pid) {
   try {
     if (process.platform === "win32") {
@@ -11654,11 +11685,11 @@ function writeMarketplacePinsOnDisk(path2, pins, succeeded, failedVerb, declineW
         return `could NOT ${failedVerb} ${[...pins.keys()].join(", ")} \u2014 set it by hand`;
       }
       const verify = readKnownMarketplacesFile(path2);
-      const failed = [...pins].filter(([name, want]) => {
+      const failed2 = [...pins].filter(([name, want]) => {
         const got = readKnownMarketplace(verify, name);
         return typeof want.autoUpdate === "boolean" && got.declared !== want.autoUpdate || want.ref !== void 0 && got.ref !== want.ref;
       });
-      return failed.length ? `${failedVerb} did NOT take for ${failed.map(([n]) => n).join(", ")} \u2014 set it by hand` : succeeded(pins);
+      return failed2.length ? `${failedVerb} did NOT take for ${failed2.map(([n]) => n).join(", ")} \u2014 set it by hand` : succeeded(pins);
     });
   } catch (error) {
     if (error instanceof Error && error.message.startsWith("shared-document lock timeout:")) return error.message;
@@ -16840,10 +16871,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.36",
-    tag: "v4.5.36",
-    commit: "dfc9e43e72eb",
-    npm: "@mutmutco/cli@4.5.36"
+    version: "4.5.38",
+    tag: "v4.5.38",
+    commit: "94bd7909821f",
+    npm: "@mutmutco/cli@4.5.38"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -16860,14 +16891,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.36"
+          v3Target: "v4.5.38"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.36 and redeploy the Hub Lambda from tag v4.5.36 (dfc9e43e72eb); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.36 (@mutmutco/cli@4.5.36, tag commit dfc9e43e72eb \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.38 and redeploy the Hub Lambda from tag v4.5.38 (94bd7909821f); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.38 (@mutmutco/cli@4.5.38, tag commit 94bd7909821f \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -19633,9 +19664,9 @@ async function waitForRequiredTrainChecks(deps, ctx, sha, required, freshSince)
     });
     const satisfiedNote = autoSatisfied.size ? `, auto-satisfied (never runs on a tag, see #2404): ${[...autoSatisfied].join(", ")}` : "";
     lastStatus = `${states.map(([c, s]) => `${c}=${s}`).join(", ")}${satisfiedNote}`;
-    const failed = states.filter(([, s]) => s === "failed").map(([c]) => c);
-    if (failed.length > 0) {
-      throw new Error(`required train check failed: ${failed.join(", ")} (${lastStatus}${fleetNote})`);
+    const failed2 = states.filter(([, s]) => s === "failed").map(([c]) => c);
+    if (failed2.length > 0) {
+      throw new Error(`required train check failed: ${failed2.join(", ")} (${lastStatus}${fleetNote})`);
     }
     if (states.every(([, s]) => s === "success")) {
       return `required checks passed: ${pending.join(", ") || "(none pending)"}${satisfiedNote}${fleetNote}`;
@@ -19774,6 +19805,26 @@ function installerPageError(value) {
   if (url.search || url.hash) return "installer.page must not carry a query string or fragment";
   return null;
 }
+var INSTALLER_VERIFY_HOSTS = ["mutmut.work", "dev.mutmut.work", "rc.mutmut.work"];
+var INSTALLER_VERIFY_STAGES = ["dev", "rc", "main"];
+function installerVerifyError(value) {
+  const shape = `installer.verify must be {dev?, rc?, main?} with at least one https URL on ${INSTALLER_VERIFY_HOSTS.join(", ")}`;
+  if (!value || typeof value !== "object" || Array.isArray(value)) return shape;
+  const entries = Object.entries(value);
+  if (entries.length === 0) return shape;
+  for (const [stage, url] of entries) {
+    if (!INSTALLER_VERIFY_STAGES.includes(stage)) return `installer.verify.${stage} is not a stage \u2014 expected dev, rc or main`;
+    let parsed;
+    try {
+      parsed = typeof url === "string" && url.trim() === url ? new URL(url) : null;
+    } catch {
+      parsed = null;
+    }
+    if (!parsed || parsed.protocol !== "https:" || parsed.username || parsed.password || !INSTALLER_VERIFY_HOSTS.includes(parsed.hostname)) return shape;
+    if (parsed.search || parsed.hash) return `installer.verify.${stage} must not carry a query string or fragment`;
+  }
+  return null;
+}
 function installerVersionUrl(installer) {
   if (typeof installer.gate === "string" && installer.gate) return `${installer.gate.replace(/\/+$/, "")}/release/version`;
   return `https://${INSTALLER_FAMILY_HOSTS[installer.family]}/${installer.product}/release/version`;
@@ -19781,14 +19832,14 @@ function installerVersionUrl(installer) {
 function installerDeclarationError(value, division) {
   if (value === void 0 || value === null) return null;
   if (typeof value !== "object" || Array.isArray(value)) {
-    return "installer must be an object {product, family, login?, gate?}";
+    return "installer must be an object {product, family, login?, gate?, page?, verify?}";
   }
   const record = (
     /** @type {Record<string, unknown>} */
     value
   );
   for (const key of Object.keys(record)) {
-    if (!["product", "family", "login", "gate", "page"].includes(key)) return `installer.${key} is not a field \u2014 expected product, family and optionally login, gate and page`;
+    if (!["product", "family", "login", "gate", "page", "verify"].includes(key)) return `installer.${key} is not a field \u2014 expected product, family and optionally login, gate, page and verify`;
   }
   if (typeof record.product !== "string" || !PRODUCT_RE.test(record.product)) {
     return "installer.product must be a lowercase kebab name (e.g. mm-strategy) \u2014 it is the /<product> path on the family host";
@@ -19812,6 +19863,10 @@ function installerDeclarationError(value, division) {
     const pageError = installerPageError(record.page);
     if (pageError) return pageError;
   }
+  if (record.verify !== void 0) {
+    const verifyError = installerVerifyError(record.verify);
+    if (verifyError) return verifyError;
+  }
   const expected = expectedInstallerLogin(
     /** @type {'jerv' | 'mmi'} */
     record.family,
@@ -19937,9 +19992,9 @@ async function readVercelDeployment(api, repo, sha, target, since) {
   }
   if (newest.size === 0) return void 0;
   const reads = await Promise.all([...newest].map(async ([env, id]) => ({ env, id, ...await readOne(api, repo, id, since) })));
-  const failed = reads.find((r) => FAILED.has(r.state));
+  const failed2 = reads.find((r) => FAILED.has(r.state));
   const unfinished = reads.find((r) => !isTerminalVercelState(r.state));
-  const pick = failed ?? unfinished ?? reads[0];
+  const pick = failed2 ?? unfinished ?? reads[0];
   return {
     id: pick.id,
     environment: reads.map((r) => r.env).join(", "),
@@ -20332,11 +20387,11 @@ async function appendServedChannelProof(deps, input, dispatch) {
   const channel = servedChannelFor(input.repo, input.installer);
   if (!channel) return dispatch;
   const expected = input.tag.replace(/^v/, "");
-  const withProof = (conclusion, evidence, note, failed = false) => ({
+  const withProof = (conclusion, evidence, note, failed2 = false) => ({
     ...dispatch,
     note: `${dispatch.note}; ${note}`,
     workflowRuns: [...dispatch.workflowRuns ?? [], servedChannelRow(channel.product, conclusion, evidence)],
-    ...failed ? { deployStatus: "failure" } : {}
+    ...failed2 ? { deployStatus: "failure" } : {}
   });
   if (!input.shipped) {
     return withProof("pending", `${channel.url} not probed`, `served channel ${channel.url} not probed \u2014 deploy/publish are not proven green, so it is not expected to have moved`);
@@ -20611,8 +20666,8 @@ function shipLegsGreen(deploy, publish) {
 async function announceShippedRelease(deps, args, model, legs, deferred) {
   if (!deps.announce) return void 0;
   if (trainObservesShipment(model) && !shipLegsGreen(legs.deploy, legs.publish)) {
-    const failed = legs.deploy.state === "failed" || legs.publish.state === "failed";
-    return `not announced: deploy/publish ${failed ? "FAILED" : "not proven green"} \u2014 ${deferred}`;
+    const failed2 = legs.deploy.state === "failed" || legs.publish.state === "failed";
+    return `not announced: deploy/publish ${failed2 ? "FAILED" : "not proven green"} \u2014 ${deferred}`;
   }
   return (await deps.announce(args)).note;
 }
@@ -23378,8 +23433,8 @@ function ledgerFailedRemedy(ledger) {
   const openLegs = derived.legs.filter((l) => l.state === "pending" || l.state === "failed");
   const tails = formatFailedLegTails(ledger);
   if (hotfixRetryDeployShape(ledger)) {
-    const failed = openLegs.filter((l) => l.state === "failed").map((l) => l.phase);
-    return `the published ${ledger.tag} hotfix can retry the failed ${joinLegNames(failed)} of the same tag: \`mmi-cli devops hotfix release ${ledger.tag} --retry-deploy\` (the deploy helper is idempotent; alignment re-attempts the fold-port PR) (#6985)${tails}`;
+    const failed2 = openLegs.filter((l) => l.state === "failed").map((l) => l.phase);
+    return `the published ${ledger.tag} hotfix can retry the failed ${joinLegNames(failed2)} of the same tag: \`mmi-cli devops hotfix release ${ledger.tag} --retry-deploy\` (the deploy helper is idempotent; alignment re-attempts the fold-port PR) (#6985)${tails}`;
   }
   if (rcandRetryDeployShape(ledger)) {
     return `fix the rc deploy failure, then retry the failed deploy of the promoted ${ledger.tag} candidate (same tag and SHA, never re-cut): \`mmi-cli devops rcand --retry-deploy --watch\` (#7053)${tails}`;
@@ -23547,8 +23602,8 @@ async function supersedeContentCausedDeployLeg(deps, cwd) {
         `release --supersede-deploy: origin reports ${prior.tag} at ${liveSha.slice(0, 12) || "no tag"} but the ledger anchors ${prior.tagSha.slice(0, 12)} \u2014 an absent or divergent release is NOT supersedeable (release --abort --apply is the unpublished candidate's own exit); nothing was written (#6553)`
       );
     }
-    const failed = prior.phases.deploy.state === "failed";
-    const note = failed ? `superseded: content-caused deploy failure on the immutable promoted ${prior.tag} \u2014 the cause fix rides the next patch train (master-approved closure, #6553)` : `superseded: ${prior.tag} deploy outcome uncorrelatable from the release SHA (no failure recorded) \u2014 closed on the owner's evidence (master-approved closure, #6553, #7327)`;
+    const failed2 = prior.phases.deploy.state === "failed";
+    const note = failed2 ? `superseded: content-caused deploy failure on the immutable promoted ${prior.tag} \u2014 the cause fix rides the next patch train (master-approved closure, #6553)` : `superseded: ${prior.tag} deploy outcome uncorrelatable from the release SHA (no failure recorded) \u2014 closed on the owner's evidence (master-approved closure, #6553, #7327)`;
     await fence(() => atomicWriteJson(path2, {
       ...prior,
       phases: {
@@ -23562,7 +23617,7 @@ async function supersedeContentCausedDeployLeg(deps, cwd) {
       repo: prior.repo,
       tag: prior.tag,
       tagSha: prior.tagSha,
-      note: failed ? `closed the ${prior.tag} deploy leg as superseded (skipped) \u2014 the ledger is phases-green; rerun the train doctor to confirm, then run the next patch train (hotfix or release) to carry the cause fix` : `closed the ${prior.tag} uncorrelatable deploy leg as superseded (skipped) \u2014 the ledger is phases-green; rerun the train doctor to confirm`
+      note: failed2 ? `closed the ${prior.tag} deploy leg as superseded (skipped) \u2014 the ledger is phases-green; rerun the train doctor to confirm, then run the next patch train (hotfix or release) to carry the cause fix` : `closed the ${prior.tag} uncorrelatable deploy leg as superseded (skipped) \u2014 the ledger is phases-green; rerun the train doctor to confirm`
     };
   });
 }
@@ -24537,17 +24592,17 @@ async function runTrainDoctor(input) {
       if (derived.phaseStatus !== "phases-green") {
         const openLegs = derived.legs.filter((l) => l.state === "pending" || l.state === "failed");
         const open2 = openLegs.map((l) => `${l.phase}=${l.state}`).join(", ");
-        const failed = derived.phaseStatus === "phases-failed";
+        const failed2 = derived.phaseStatus === "phases-failed";
         const deployOnlyDeadlock = openLegs.length > 0 && openLegs.every((l) => l.phase === "deploy" && supersedeableDeployLegShape(l));
         const supersession = deployOnlyDeadlock ? `; when the deploy failure is content-caused on the already-published ${ledger.tag} (the immutable tag can never deploy green), the sanctioned exit is \`mmi-cli devops release --supersede-deploy --apply\` after explicit master approval \u2014 the next patch train carries the cause fix (#6553)` : "";
         add({
-          code: failed ? "ledger-failed" : "ledger-pending",
+          code: failed2 ? "ledger-failed" : "ledger-pending",
           severity: "blocker",
           source: "local",
           // #6429: each lane finishes its own run (#6068) — an rcand-lane ledger named as a release
           // ledger, with `release --resume` as its remedy, sends the operator to a verb that refuses it.
           title: `a prior ${ledger.lane ?? "release"} ledger for ${ledger.tag} is ${derived.phaseStatus} (${open2}) \u2014 a new train must not stack on it (#5987)`,
-          remedy: failed ? ledgerFailedRemedy(ledger) : `finish it first: ${ledgerLaneResumeCommand(ledger)} (alignment-only pending legs close themselves with \`train doctor --heal\` once the PR merges, and a deploy/publish leg whose run already concluded folds under the same heal)${supersession}`
+          remedy: failed2 ? ledgerFailedRemedy(ledger) : `finish it first: ${ledgerLaneResumeCommand(ledger)} (alignment-only pending legs close themselves with \`train doctor --heal\` once the PR merges, and a deploy/publish leg whose run already concluded folds under the same heal)${supersession}`
         });
       } else if (newestRemoteReleaseTag && newestRemoteReleaseTag !== ledger.tag) {
         add({
@@ -24594,21 +24649,21 @@ regenerate the projections (\`node scripts/check-skill-payload.mjs\`) and commit
         const installed = [];
         let pending = firstDir;
         let outstanding = failure;
-        let failed = null;
+        let failed2 = null;
         while (pending && !installed.includes(pending)) {
           const dir = pending;
           try {
             await train.run("npm", ["--prefix", dir, "ci"]);
           } catch (e) {
-            failed = { dir, detail: `\`npm --prefix ${dir} ci\` failed: ${message(e)}` };
+            failed2 = { dir, detail: `\`npm --prefix ${dir} ci\` failed: ${message(e)}` };
             break;
           }
           installed.push(dir);
           outstanding = await verifyDeps();
           pending = outstanding ? /in (cli|updater)\/node_modules/u.exec(outstanding)?.[1] ?? null : null;
         }
-        if (failed) {
-          add({ code: "hub-build-deps", severity: "blocker", source: "local", title: failed.detail, remedy: `repair ${failed.dir}/node_modules by hand, then rerun` });
+        if (failed2) {
+          add({ code: "hub-build-deps", severity: "blocker", source: "local", title: failed2.detail, remedy: `repair ${failed2.dir}/node_modules by hand, then rerun` });
         } else if (outstanding) {
           add({ code: "hub-build-deps", severity: "blocker", source: "local", title: `installing ${installed.join(", ")} from ${installed.length === 1 ? "its lockfile" : "their lockfiles"} did not resolve the build dependencies`, remedy: outstanding });
         } else {
@@ -24709,6 +24764,133 @@ function formatTrainDoctor(v) {
   return lines2.join("\n");
 }
 
+// src/vercel-version-env.ts
+var SKIPPED = { status: "skipped", note: "" };
+function vercelVersionEnvAheadNote(key) {
+  return `a failed branch push can leave ${key} ahead of what is live`;
+}
+function safeReason(reason, token) {
+  const compact = reason.replace(/\s+/g, " ").trim().slice(0, 180);
+  const scrubbed = token && compact.includes(token) ? compact.split(token).join("[redacted]") : compact;
+  return scrubbed || "unknown error";
+}
+function failed(deps, key, tag, reason) {
+  const note = `vercel version env: FAILED to set ${key}=${tag} (${reason}) \u2014 /healthz will show the commit, not the tag; fix: set it and redeploy once`;
+  deps.warn?.(note);
+  return { status: "failed", note };
+}
+function targetLabel(stage) {
+  return stage === "main" ? "production" : "preview";
+}
+function envCollectionUrl(project2, team, extra) {
+  const url = new URL(`https://api.vercel.com/v10/projects/${encodeURIComponent(project2)}/env`);
+  if (team) url.searchParams.set("teamId", team);
+  for (const [key, value] of Object.entries(extra ?? {})) url.searchParams.set(key, value);
+  return url.toString();
+}
+function envItemUrl(project2, id, team) {
+  const url = new URL(`https://api.vercel.com/v9/projects/${encodeURIComponent(project2)}/env/${encodeURIComponent(id)}`);
+  if (team) url.searchParams.set("teamId", team);
+  return url.toString();
+}
+function isStageEnv(row, stage, key) {
+  if (row.key !== key) return false;
+  const target = Array.isArray(row.target) ? row.target.filter((item) => typeof item === "string") : [];
+  if (stage === "main") return target.length === 1 && target[0] === "production";
+  return target.length === 1 && target[0] === "preview" && row.gitBranch === "rc";
+}
+function envsOf(body) {
+  if (Array.isArray(body)) return body;
+  if (body && typeof body === "object" && Array.isArray(body.envs)) {
+    return body.envs;
+  }
+  return null;
+}
+async function readBody(res, token) {
+  let raw = "";
+  try {
+    raw = await res.text();
+  } catch (e) {
+    return { ok: false, reason: safeReason(e instanceof Error ? e.message : String(e), token) };
+  }
+  if (!res.ok) return { ok: false, reason: `HTTP ${res.status}${raw ? `: ${safeReason(raw, token)}` : ""}` };
+  if (!raw.trim()) return { ok: true, body: {} };
+  try {
+    return { ok: true, body: JSON.parse(raw) };
+  } catch {
+    return { ok: false, reason: "response was not JSON" };
+  }
+}
+async function setVercelVersionEnv(deps, meta, stage, tag) {
+  if (meta?.deployModel !== "vercel" || !meta.vercelVersionEnv) return SKIPPED;
+  const { project: project2, key, team } = meta.vercelVersionEnv;
+  if (!project2 || !key) return failed(deps, key || "(missing key)", tag, "vercelVersionEnv is missing project or key");
+  let token;
+  try {
+    token = await deps.readToken();
+  } catch (e) {
+    return failed(deps, key, tag, safeReason(e instanceof Error ? e.message : String(e), null));
+  }
+  if (!token) return failed(deps, key, tag, "no _org/vercel/API_TOKEN");
+  const headers = { Authorization: `Bearer ${token}`, "Content-Type": "application/json" };
+  let listed;
+  try {
+    const res = await deps.fetch(envCollectionUrl(project2, team, stage === "rc" ? { gitBranch: "rc" } : void 0), { method: "GET", headers });
+    listed = await readBody(res, token);
+  } catch (e) {
+    return failed(deps, key, tag, safeReason(e instanceof Error ? e.message : String(e), token));
+  }
+  if (!listed.ok) return failed(deps, key, tag, listed.reason);
+  const rows = envsOf(listed.body);
+  if (!rows) return failed(deps, key, tag, "env list returned an unexpected shape");
+  const existing = rows.find((row) => isStageEnv(row, stage, key) && typeof row.id === "string" && row.id.length > 0);
+  const createBody = stage === "main" ? { key, value: tag, type: "plain", target: ["production"] } : { key, value: tag, type: "plain", target: ["preview"], gitBranch: "rc" };
+  try {
+    const res = existing ? await deps.fetch(envItemUrl(project2, existing.id, team), {
+      method: "PATCH",
+      headers,
+      body: JSON.stringify({ value: tag })
+    }) : await deps.fetch(envCollectionUrl(project2, team), {
+      method: "POST",
+      headers,
+      body: JSON.stringify(createBody)
+    });
+    const written = await readBody(res, token);
+    if (!written.ok) return failed(deps, key, tag, written.reason);
+  } catch (e) {
+    return failed(deps, key, tag, safeReason(e instanceof Error ? e.message : String(e), token));
+  }
+  const note = `vercel version env: ${key}=${tag} set on ${targetLabel(stage)}`;
+  deps.warn?.(note);
+  return { status: "set", note };
+}
+async function defaultVercelFetch(url, init) {
+  const res = await fetch(url, { ...init, signal: AbortSignal.timeout(15e3) });
+  return { ok: res.ok, status: res.status, text: () => res.text() };
+}
+async function readOrgVercelApiToken() {
+  const { loadConfig: loadConfig2, hubHeaders: hubHeaders2, repoProject: repoProject2 } = await Promise.resolve().then(() => (init_cli_shared(), cli_shared_exports));
+  const cfg = await loadConfig2();
+  if (!cfg.sagaApiUrl) return null;
+  const repo = `mutmutco/${(await repoProject2(cfg)).toLowerCase()}`;
+  const res = await fetch(`${cfg.sagaApiUrl}/secrets/get`, {
+    method: "POST",
+    headers: await hubHeaders2({ "content-type": "application/json" }),
+    body: JSON.stringify({ repo, key: "vercel/API_TOKEN", use: true, slug: "_org" }),
+    signal: AbortSignal.timeout(8e3)
+  });
+  if (!res.ok) return null;
+  const body = await res.json();
+  return typeof body.value === "string" ? body.value : null;
+}
+function vercelVersionEnvDeps(deps) {
+  return {
+    fetch: deps.vercelFetch ?? defaultVercelFetch,
+    readToken: deps.readVercelApiToken ?? readOrgVercelApiToken,
+    warn: (message2) => deps.warn?.(message2)
+  };
+}
+
 // src/train-apply-phases.ts
 var TRAIN_BUMP_INTENTS = ["major", "minor", "patch"];
 function readLocalGateWorkflows() {
@@ -25313,14 +25495,14 @@ async function recoverFailedDispatchPhase(deps, ledger, anchors, phase, dispatch
   let fallbackRecovered = false;
   const failedRows = workflowRuns?.filter((run) => run.conclusion === "failure") ?? [];
   if (failedRows.length > 0) {
-    for (const failed of failedRows) {
-      const rowPhase = failed.workflow.includes("publish") ? "publish" : phase;
+    for (const failed2 of failedRows) {
+      const rowPhase = failed2.workflow.includes("publish") ? "publish" : phase;
       if (persisted?.phases[rowPhase]?.superseded === true) continue;
       const recovery = await recover(deps, ledger, anchors, rowPhase, {
         repo: input.repo,
         sha: input.sha,
-        failure: `watched ${rowPhase} run failed: ${failed.workflow} (${dispatch.note})`,
-        runs: [{ ...failed, repo: input.repo }],
+        failure: `watched ${rowPhase} run failed: ${failed2.workflow} (${dispatch.note})`,
+        runs: [{ ...failed2, repo: input.repo }],
         watched: input.watched
       });
       if (recovery.note) notes.push(recovery.note);
@@ -25386,6 +25568,27 @@ async function recordRcandDeployLegs(ledger, deps, anchors, deployModel, d, opts
 function releaseAnnounceDeferral(model, summaryFile) {
   return prodReleaseTargets(model).length > 0 || model === "vercel" ? `\`mmi-cli devops release --resume --watch${summaryFile ? ` --announce-summary-file ${summaryFile}` : ""}\` announces it once they are green` : "a central deploy is proven only under --watch, so this release stays unannounced";
 }
+function annotateVersionEnvDispatch(dispatch, result) {
+  if (!result.note) return dispatch;
+  return { ...dispatch, note: `${dispatch.note}; ${result.note}` };
+}
+function annotateVersionEnvAnnounce(note, result) {
+  if (!result.note) return note;
+  return note ? `${note}; ${result.note}` : result.note;
+}
+async function pushAfterVercelVersionEnv(deps, meta, stage, tag, pushArgs) {
+  const result = await setVercelVersionEnv(vercelVersionEnvDeps(deps), meta, stage, tag);
+  try {
+    await runGitPush(deps, pushArgs);
+  } catch (e) {
+    const base = e instanceof Error ? e.message : String(e);
+    const parts = [base];
+    if (result.note) parts.push(result.note);
+    if (result.status === "set" && meta.vercelVersionEnv?.key) parts.push(vercelVersionEnvAheadNote(meta.vercelVersionEnv.key));
+    throw new Error(parts.join(" \u2014 "));
+  }
+  return result;
+}
 async function completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha, startBranch, preFold, tagProbe, branchHints, ledger, alignEarly) {
   const resumeCommand = options.dev ? "mmi-cli devops release --dev --apply" : "mmi-cli devops release --apply";
   const ledgerAnchors = { repo: ctx.repo, tag, tagSha: releaseSha };
@@ -25482,9 +25685,10 @@ ${recovery.note}`), recoveryInput);
     landed: "the immutable tag pushed at " + releaseSha.slice(0, 12)
   });
   if (trueMergeGateNote) checks = `${trueMergeGateNote}; ${checks}`;
+  let versionEnv = { status: "skipped", note: "" };
   try {
     deps.warn?.("Release: Promoting the verified release");
-    await runGitPush(deps, ["push", "origin", "main"]);
+    versionEnv = await pushAfterVercelVersionEnv(deps, meta, "main", tag, ["push", "origin", "main"]);
   } catch (e) {
     await recordPhase(ledger, deps, ledgerAnchors, "promotion", phaseEntry({ state: "failed", sha: releaseSha, error: `origin/main push failed after ${tag} was pushed: ${e instanceof Error ? e.message : String(e)}` }), { landed: "the immutable tag pushed at " + releaseSha.slice(0, 12) });
     throw partialTrainRecoveryError(e, recoveryInput);
@@ -25517,7 +25721,7 @@ ${recovery.note}`), recoveryInput);
       workflow: failedReleaseRun?.workflow ?? (isCentralDispatchModel(deployModel) ? "tenant-deploy.yml" : "deploy workflow")
     }
   );
-  const deployDispatch = await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, releaseSha, recoveredDeployDispatch);
+  const deployDispatch = annotateVersionEnvDispatch(await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, releaseSha, recoveredDeployDispatch), versionEnv);
   const deployLeg = phaseEntry(validSuiteCutContext(ctx.repo, deps.suiteCut) && ctx.slug !== "mmi-katip" ? { state: "skipped", sha: releaseSha, note: "suite bundle-only: live backend not deployed (#7263)" } : deployPhaseInput(deployModel, deployDispatch, { releaseSha }));
   await recordPhase(ledger, deps, ledgerAnchors, "deploy", deployLeg, {
     landed: "the immutable tag, the green required-check wall, the origin/main fast-forward, and the verified GitHub Release"
@@ -25551,7 +25755,7 @@ ${recovery.note}`), recoveryInput);
     appendPublishDispatch(deployDispatch, publishDispatch)
   );
   alignment = await aligning;
-  const announceNote = await announcing;
+  const announceNote = annotateVersionEnvAnnounce(await announcing, versionEnv);
   return { checks, releaseUrl, announceNote, dispatch, ledgerAnchors, ...alignment ? { alignment } : {} };
 }
 function resumeStateOf(status) {
@@ -25754,10 +25958,10 @@ ${spent.note}`);
   await recordPhase(ledger, deps, anchors, "ordinaryCi", phaseEntry({ state: "complete", sha: tagSha, note: "re-verified the required-check wall live on this resume" }), { strict, landed: "the immutable rc tag on origin at the resumed SHA" });
   const autoRunSince = (deps.now ?? Date.now)();
   deps.warn?.("Release: Promoting the verified release candidate");
-  await runGitPush(deps, ["push", "origin", `${tagSha}:refs/heads/rc`]);
+  const versionEnv = await pushAfterVercelVersionEnv(deps, meta, "rc", tag, ["push", "origin", `${tagSha}:refs/heads/rc`]);
   await recordPhase(ledger, deps, anchors, "promotion", phaseEntry({ state: "complete", sha: tagSha, note: `resumed: ${tagSha.slice(0, 12)} pushed to origin/rc (tag preserved, never re-cut)` }), { strict, landed: "the immutable rc tag and the re-proven required-check wall" });
   await recordPhase(ledger, deps, anchors, "githubRelease", phaseEntry({ state: "skipped", sha: tagSha, note: "rcand mints no GitHub Release \u2014 the rc tag is the candidate" }), { strict, landed: "the immutable rc tag, the green wall, and origin/rc" });
-  const dispatch0 = await dispatchDeploy(deps, ctx, "rc", "rc", deployModel, watch, autoRunSince, tagSha, "report");
+  const dispatch0 = annotateVersionEnvDispatch(await dispatchDeploy(deps, ctx, "rc", "rc", deployModel, watch, autoRunSince, tagSha, "report"), versionEnv);
   const dispatch = await recordRcandDeployLegs(ledger, deps, anchors, deployModel, dispatch0, { strict });
   const ledgerReport = releaseLedgerReport(await ledger.load(anchors).catch(() => void 0), ledger.path);
   return {
@@ -26037,7 +26241,7 @@ ${recovery.note}`), recoveryInput);
   }
   await recordPhase(ledger, deps, anchors, "ordinaryCi", phaseEntry({ state: "complete", sha: tagSha, note: "re-verified the required-check wall live on this resume" }), { strict: ledgerMode === "strict", landed: "the immutable tag on origin at the resumed SHA" });
   deps.warn?.("Release: Promoting the verified release");
-  await runGitPush(deps, ["push", "origin", `${tagSha}:refs/heads/main`]);
+  const versionEnv = await pushAfterVercelVersionEnv(deps, meta, "main", tag, ["push", "origin", `${tagSha}:refs/heads/main`]);
   steps.push(`pushed ${tagSha.slice(0, 12)} to origin/main`);
   await recordPhase(ledger, deps, anchors, "promotion", phaseEntry({ state: "complete", sha: tagSha, note: `resumed: ${tagSha.slice(0, 12)} pushed to origin/main (tag preserved, never re-cut)` }), { strict: ledgerMode === "strict", landed: "the immutable tag and the re-proven required-check wall" });
   deps.warn?.("Release: Creating the GitHub Release");
@@ -26067,7 +26271,7 @@ ${recovery.note}`), recoveryInput);
       workflow: isCentralDispatchModel(deployModel) ? "tenant-deploy.yml" : "deploy workflow"
     }
   );
-  const deployDispatch = await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, tagSha, recoveredDeployDispatch);
+  const deployDispatch = annotateVersionEnvDispatch(await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, tagSha, recoveredDeployDispatch), versionEnv);
   steps.push(`dispatched the ${deployModel} deploy path`);
   const deployLeg = persisted?.phases.deploy.superseded === true ? persisted.phases.deploy : phaseEntry(validSuiteCutContext(ctx.repo, deps.suiteCut) && ctx.slug !== "mmi-katip" ? { state: "skipped", sha: tagSha, note: "suite bundle-only: live backend not deployed (#7263)" } : deployPhaseInput(deployModel, deployDispatch, { releaseSha: tagSha }));
   if (persisted?.phases.deploy.superseded !== true) {
@@ -26108,7 +26312,7 @@ ${recovery.note}`), recoveryInput);
     devRollForward = landed.dev;
     rcAlignment = landed.rc;
   }
-  const announceNote = await announcing;
+  const announceNote = annotateVersionEnvAnnounce(await announcing, versionEnv);
   steps.push(`development roll-forward: ${devRollForward.status}`);
   if (rcAlignment) steps.push(`rc alignment: ${rcAlignment.status}`);
   const followUp = deriveTrainFollowUpStatus({
@@ -26448,15 +26652,16 @@ ${spent.note}`), rcandRecovery(tag2));
     await recordPhase(ledger, deps, anchors, "ordinaryCi", phaseEntry({ state: "complete", sha: rcSha, note: checks2 }), { landed: "the immutable rc tag pushed at " + rcSha.slice(0, 12) });
     const autoRunSince = (deps.now ?? Date.now)();
     deps.warn?.("Release: Promoting the verified release candidate");
+    let versionEnv = { status: "skipped", note: "" };
     try {
-      await runGitPush(deps, ["push", "origin", "rc"]);
+      versionEnv = await pushAfterVercelVersionEnv(deps, meta, "rc", tag2, ["push", "origin", "rc"]);
     } catch (e) {
       await recordPhase(ledger, deps, anchors, "promotion", phaseEntry({ state: "failed", sha: rcSha, error: `origin/rc push failed after ${tag2} was pushed: ${e instanceof Error ? e.message : String(e)}` }), { landed: "the immutable rc tag pushed at " + rcSha.slice(0, 12) });
       throw partialTrainRecoveryError(e, rcandRecovery(tag2));
     }
     await recordPhase(ledger, deps, anchors, "promotion", phaseEntry({ state: "complete", sha: rcSha, note: `immutable ${tag2} pushed at ${rcSha.slice(0, 12)}; origin/rc fast-forwarded to it` }), { landed: "the immutable rc tag and the green required-check wall" });
     await recordPhase(ledger, deps, anchors, "githubRelease", phaseEntry({ state: "skipped", sha: rcSha, note: "rcand mints no GitHub Release \u2014 the rc tag is the candidate" }), { landed: "the immutable rc tag, the green wall, and origin/rc" });
-    const d0 = await dispatchDeploy(deps, ctx, "rc", "rc", deployModel2, watch, autoRunSince, rcSha, "report");
+    const d0 = annotateVersionEnvDispatch(await dispatchDeploy(deps, ctx, "rc", "rc", deployModel2, watch, autoRunSince, rcSha, "report"), versionEnv);
     const d2 = await recordRcandDeployLegs(ledger, deps, anchors, deployModel2, d0);
     const rcLedgerReport = releaseLedgerReport(await ledger?.load(anchors).catch(() => void 0), ledger?.path ?? "(no ledger)");
     return { ...ctx, command, stage: "rc", ref: "rc", tag: tag2, bumpIntent, deployModel: deployModel2, promoted: true, checks: checks2, resumeNote, dispatch: d2.note, runId: d2.runId, runUrl: d2.runUrl, workflowRuns: d2.workflowRuns, deployStatus: d2.deployStatus, ...rcLedgerReport ? { ledger: rcLedgerReport } : {} };
@@ -28643,13 +28848,13 @@ function buildPluginCachePlan(home, running, deps, opts = {}) {
 }
 function applyPluginCachePlan(plan, remove2, stagingGuard) {
   const removed = [];
-  const failed = [];
+  const failed2 = [];
   for (const version of plan.prune) {
     try {
       remove2(`${plan.cacheRoot}/${version}`);
       removed.push(version);
     } catch (e) {
-      failed.push({ version, error: e.message });
+      failed2.push({ version, error: e.message });
     }
   }
   const removedStaging = [];
@@ -28682,7 +28887,7 @@ function applyPluginCachePlan(plan, remove2, stagingGuard) {
   }
   return {
     removed,
-    failed,
+    failed: failed2,
     bytes: plan.bytes,
     removedStaging,
     failedStaging,
@@ -29694,7 +29899,7 @@ init_hub_auth();
 init_github_client();
 
 // src/project-set.ts
-var UNSET_KEYS = ["projectAdmins", "installer", "oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "dsManifestPath", "consumesDesignSystem", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary", "notifyOnDeploy"];
+var UNSET_KEYS = ["projectAdmins", "installer", "oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "dsManifestPath", "consumesDesignSystem", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary", "notifyOnDeploy", "vercelVersionEnv"];
 var UNSET_KEY_SET = new Set(UNSET_KEYS);
 var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
 var SECRET_CONSUMERS = ["runtime", "build", "lambda", "actions", "agent", "box"];
@@ -30048,6 +30253,32 @@ function parseNotifyOnDeployVar(raw) {
   }
   return parsed;
 }
+var VERCEL_VERSION_ENV_NAME_RE = /^[A-Za-z][A-Za-z0-9_]*$/;
+var VERCEL_VERSION_ENV_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/;
+function parseVercelVersionEnvVar(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error('org project set: vercelVersionEnv must be JSON, e.g. {"project":"mm-work","key":"MMW_VERSION","team":"team_xxx"}');
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("org project set: vercelVersionEnv must be a JSON object { project, key, team? }");
+  }
+  const row = parsed;
+  const unknown = Object.keys(row).filter((key) => key !== "project" && key !== "key" && key !== "team");
+  if (unknown.length > 0) throw new Error(`org project set: vercelVersionEnv has unknown field(s): ${unknown.join(", ")}`);
+  if (typeof row.project !== "string" || !VERCEL_VERSION_ENV_ID_RE.test(row.project)) {
+    throw new Error("org project set: vercelVersionEnv.project must be a Vercel project id or name");
+  }
+  if (typeof row.key !== "string" || !VERCEL_VERSION_ENV_NAME_RE.test(row.key)) {
+    throw new Error("org project set: vercelVersionEnv.key must be an env name (e.g. MMW_VERSION)");
+  }
+  if (row.team !== void 0 && (typeof row.team !== "string" || !VERCEL_VERSION_ENV_ID_RE.test(row.team))) {
+    throw new Error("org project set: vercelVersionEnv.team must be a Vercel team id or slug");
+  }
+  return { project: row.project, key: row.key, ...typeof row.team === "string" ? { team: row.team } : {} };
+}
 function parseCiExemptReasonVar(raw) {
   const trimmed = raw.trim();
   if (!trimmed) throw new Error("org project set: ciExemptReason must be a non-empty reason (or use --unset ciExemptReason to clear it)");
@@ -30189,7 +30420,8 @@ var SETTABLE_VAR_KEYS = [
   "secrets",
   "seedCanary",
   "installer",
-  "notifyOnDeploy"
+  "notifyOnDeploy",
+  "vercelVersionEnv"
 ];
 var SETTABLE_VAR_KEY_SET = new Set(SETTABLE_VAR_KEYS);
 var SETTABLE_VAR_HINTS = {
@@ -30219,6 +30451,7 @@ var SETTABLE_VAR_HINTS = {
   requiredChecks: 'JSON array, e.g. ["gate"] or [] for no-ci',
   requiredCheckBranches: "non-empty JSON branch-name array; exact product-ruleset scope (#5210)",
   notifyOnDeploy: 'JSON stage array, e.g. ["dev"] \u2014 successful tenant-deploy sends <stage>-deployed to the project repo (#7358)',
+  vercelVersionEnv: "JSON {project,key,team?} \u2014 train sets this Vercel env to the release tag before the main/rc push (#7362)",
   ciExemptReason: "non-empty string \u2014 declares this deployable repo has no CI surface (#4265)",
   gate: "JSON {runtime,cmd,affectedCmd,workdir,cacheDepPath,pyVersion}"
 };
@@ -30364,6 +30597,8 @@ function buildProjectSetPatch(input) {
       patch[key] = parseRequiredCheckBranchesVar(raw);
     } else if (key === "notifyOnDeploy") {
       patch[key] = parseNotifyOnDeployVar(raw);
+    } else if (key === "vercelVersionEnv") {
+      patch[key] = parseVercelVersionEnvVar(raw);
     } else if (key === "ciExemptReason") {
       patch[key] = parseCiExemptReasonVar(raw);
     } else if (key === "gate") {
@@ -35014,7 +35249,7 @@ async function runHotfixStartLocked(deps, options, doctor) {
     throw new Error(`working tree must be clean before hotfix start${describeBlockingPaths(status)}`);
   }
   await deps.run("git", ["fetch", "origin", "--tags"]);
-  const { deployModel } = await hotfixPreflight(deps, ctx, "start");
+  const { deployModel, meta } = await hotfixPreflight(deps, ctx, "start");
   const bumpNotes = [];
   let resolved = await resolveHotfixVersion(deps);
   for (; ; ) {
@@ -35136,6 +35371,8 @@ async function runHotfixStartLocked(deps, options, doctor) {
     await assertHotfixFoldBomStamp(deps, tag);
     await deps.run("git", ["push", "-u", "origin", branch]);
   }
+  const versionEnv = await setVercelVersionEnv(vercelVersionEnvDeps(deps), meta, "main", tag);
+  if (versionEnv.note) notes.push(versionEnv.note);
   const bumpNote = deployModel === "hub-serverless" ? " with the locked distribution bump" : foldPaths.length > 0 ? " with the package version bump" : "";
   const prUrl = clean3(await deps.run("gh", [
     "pr",
@@ -37387,12 +37624,12 @@ async function resolveBoardAdvanceForPr(prNumber, repoOption) {
 }
 function evaluatePrMergeHousekeeping(report, context, force = false) {
   const scratch = report.scratch;
-  const failed = scratch?.status === "failed";
+  const failed2 = scratch?.status === "failed";
   const prunable = scratch?.safeAuto ?? 0;
   const unprunable = scratch?.skipped ?? 0;
-  if (!(failed || prunable > 0 || unprunable > 0)) return { blocked: false };
+  if (!(failed2 || prunable > 0 || unprunable > 0)) return { blocked: false };
   if (force) return { blocked: false };
-  const detail = failed ? `scratch housekeeping failed${scratch?.error ? `: ${scratch.error}` : ""}` : `${prunable} prunable + ${unprunable} un-prunable scratch item(s) remain after cleanup`;
+  const detail = failed2 ? `scratch housekeeping failed${scratch?.error ? `: ${scratch.error}` : ""}` : `${prunable} prunable + ${unprunable} un-prunable scratch item(s) remain after cleanup`;
   return {
     blocked: true,
     reason: `${context} housekeeping blocked merge: ${detail}. Run host-owned scratch cleanup, then retry \u2014 or re-run \`mmi-cli ${context} --force\` to acknowledge and land anyway. (Kept advisory plans/ scratch never blocks: it is gitignored and can never reach origin.)`
@@ -45137,15 +45374,15 @@ function renderReport(checks, opts) {
 }
 function renderTally(checks) {
   const total = checks.length;
-  const failed = checks.filter((c) => !c.ok).length;
+  const failed2 = checks.filter((c) => !c.ok).length;
   const unverified = checks.filter((c) => c.ok && c.verified === false).length;
   const warned = checks.filter((c) => c.ok && c.verified !== false && c.warn).length;
-  const healthy = total - failed - unverified - warned;
-  if (failed === 0 && unverified === 0 && warned === 0) return `\u2713 all ${total} checks healthy`;
+  const healthy = total - failed2 - unverified - warned;
+  if (failed2 === 0 && unverified === 0 && warned === 0) return `\u2713 all ${total} checks healthy`;
   const parts = [`\u2713 ${healthy} verified healthy`];
   if (warned > 0) parts.push(`\u26A0 ${warned} warn`);
   if (unverified > 0) parts.push(`? ${unverified} unverified`);
-  if (failed > 0) parts.push(`\u2717 ${failed} failed`);
+  if (failed2 > 0) parts.push(`\u2717 ${failed2} failed`);
   return `${parts.join(" \xB7 ")} \u2014 ${total} checks`;
 }
 function doctorReportExitCode(checks) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.36",
+  "version": "4.5.38",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",