@mutmutco/cli 4.6.42 → 4.6.43

package/dist/main.cjs

@@ -25273,6 +25273,31 @@ function missingPlaceholders(rendered) {
   for (const m of rendered.matchAll(PLACEHOLDER_RE)) out.add(m[1]);
   return [...out];
 }
+function seedMatchesReleaseTrack(seed, releaseTrack) {
+  if (!seed.releaseTracks?.length) return true;
+  return releaseTrack != null && seed.releaseTracks.includes(releaseTrack);
+}
+var TRAIN_ONLY_BEGIN = "mmi-train-only:start";
+var TRAIN_ONLY_END = "mmi-train-only:end";
+function renderSelfSeedForTrack(content, releaseTrack) {
+  if (releaseTrack !== "single") return content;
+  const lines2 = content.split(/(?<=\n)/);
+  const out = [];
+  let skipping = false;
+  for (const line of lines2) {
+    if (!skipping && line.includes(TRAIN_ONLY_BEGIN)) {
+      skipping = true;
+      continue;
+    }
+    if (skipping) {
+      if (line.includes(TRAIN_ONLY_END)) skipping = false;
+      continue;
+    }
+    out.push(line);
+  }
+  if (skipping) throw new Error(`unterminated ${TRAIN_ONLY_BEGIN} region`);
+  return out.join("");
+}
 function isPropagatableSeed(seed) {
   return seed.ownership === "org" && seed.source === "self" || seed.managedBlock != null;
 }
@@ -26639,6 +26664,7 @@ function withDerivedRepoVars(vars, parsed, cls, releaseTrack, requiredCheckBranc
   out.CLASS ??= cls;
   out.PROJECT_OWNER ??= parsed.owner;
   const track = releaseTrack ?? resolveBootstrapReleaseTrack(cls);
+  out.RELEASE_TRACK ??= track;
   const runtime = out.GATE_RUNTIME === "python" ? "python" : "node";
   for (const [key, value] of Object.entries(gateSeedVars(cls, track, runtime, requiredCheckBranches, requiredChecks))) {
     out[key] ??= value;
@@ -26998,7 +27024,10 @@ function renderBootstrapAncillaryPlan(labels, environments, exceptions = []) {
   ].join("\n");
 }
 function resolveSeedContent(seed, vars, readFile11) {
-  if (seed.source === "self") return readFile11(seed.target);
+  if (seed.source === "self") {
+    const own = readFile11(seed.target);
+    return own == null ? null : renderSelfSeedForTrack(own, vars.RELEASE_TRACK);
+  }
   if (seed.source.startsWith("seed:")) {
     const tmpl = readFile11(`skills/bootstrap/seeds/${seed.source.slice("seed:".length)}`);
     return tmpl == null ? null : renderSeed(tmpl, vars);
@@ -28527,10 +28556,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.42",
-    tag: "v4.6.42",
-    commit: "cb451037f47d",
-    npm: "@mutmutco/cli@4.6.42"
+    version: "4.6.43",
+    tag: "v4.6.43",
+    commit: "856f4651277d",
+    npm: "@mutmutco/cli@4.6.43"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -28547,14 +28576,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.42"
+          v3Target: "v4.6.43"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.42 and redeploy the Hub Lambda from tag v4.6.42 (cb451037f47d); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.42 (@mutmutco/cli@4.6.42, tag commit cb451037f47d \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.43 and redeploy the Hub Lambda from tag v4.6.43 (856f4651277d); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.43 (@mutmutco/cli@4.6.43, tag commit 856f4651277d \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -31670,17 +31699,17 @@ function isBundleOnlySuiteMember(repo, suite) {
   if (!suite) return false;
   return repo.split("/")[1]?.toLowerCase() !== suite.toLowerCase();
 }
+var MM_GOES_LIVE = "MM-Work and its modules merge to development and it goes live; there is no release, rc or candidate stage.";
 function suiteMemberRefusal(repo, meta, lane, solo = false, cut) {
   const suite = meta?.suite;
   if (!suite) return null;
   if (!isBundleOnlySuiteMember(repo, suite)) {
     if (solo || cut?.token === SUITE_LEAD_TOKEN && cut.repo.toLowerCase() === repo.toLowerCase()) return null;
-    const route = lane === "hotfix" ? "hotfix the affected member from its own checkout, then run mmi-cli devops suite release --owner-go" : `run mmi-cli devops suite ${lane} --owner-go`;
-    return `${repo} is the ${suite} suite lead; a plain ${lane} would cut it without its members: ${route}. A lead-only ${lane} needs --suite-solo --owner-go.`;
+    return `${repo} is the ${suite} suite lead; ${MM_GOES_LIVE} There is no ${lane} to run: land the change through a normal PR to development and state what landed.`;
   }
   if (authorisedSuiteCut(repo, meta, cut)) return null;
   if (lane !== "rcand" && solo) return null;
-  return `${repo} is part of the ${suite} suite; the cut comes from the suite lead ${suiteLeadRepo(repo, suite)}. A suite member never asks for, proposes or prompts an rc, release or hotfix: the suite orchestrator is the only voice that brings a cut to Jervaise, so state what landed and stop. --owner-go and --suite-solo are never self-authorized; only a backward-compatible solo backend release/hotfix with actual owner approval may pass --suite-solo --owner-go.`;
+  return `${repo} is part of the ${suite} suite; ${MM_GOES_LIVE} A suite member never asks for, proposes or prompts an rc, release or hotfix: there is none, so state what landed and stop.`;
 }
 
 // src/tenant-control-parse.ts
@@ -51008,7 +51037,7 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
       detail: `expected: ${requiredProductRulesetRef} (apply as an active repo ruleset after bootstrap)`
     });
   }
-  if (repoClass === "deployable") {
+  if (repoClass === "deployable" && effectiveTrack !== "single") {
     const trainScript = "scripts/next-version.mjs";
     checks.push({ ok: await contentExists2(deps, repo, baseBranch, trainScript), label: `train tooling script exists: ${trainScript}` });
   }
@@ -51734,7 +51763,9 @@ function registerBootstrapCommands(program3) {
     for (const repo of targets) {
       const cls = classOf(repo);
       const meta = metaOf(repo);
-      const seeds = byteComparableSeeds(manifest, cls);
+      const track = resolveReleaseTrack(metaWithDeclaredClass(meta, cls), void 0, repo);
+      const seeds = byteComparableSeeds(manifest, cls).filter((s) => seedMatchesReleaseTrack(s, track));
+      const trackHubContents = new Map([...hubContents].map(([t, c]) => [t, c == null ? c : renderSelfSeedForTrack(c, track)]));
       seedsPerRepo = Math.max(seedsPerRepo, seeds.length);
       const baseBranch = cls === "content" ? "main" : "development";
       const reads = [];
@@ -51749,9 +51780,8 @@ function registerBootstrapCommands(program3) {
         }
         reads.push({ target: seed.target, content });
       }
-      findings.push(...auditRepoSeedDrift(repo, seeds, hubContents, reads));
+      findings.push(...auditRepoSeedDrift(repo, seeds, trackHubContents, reads));
       findings.push(...declaredRenderWaivers(manifest, repo));
-      const track = resolveReleaseTrack(metaWithDeclaredClass(meta, cls), void 0, repo);
       const github = await readBootstrapGitHubFacts(repo, track, controlClient);
       const deployFacts = await fetchDeployFactsBySlug((repo.split("/").pop() ?? repo).toLowerCase(), registryClientDeps(await loadConfig()));
       const controlRows = planBootstrapControlPlane({
@@ -52176,6 +52206,7 @@ function registerBootstrapCommands(program3) {
       if (!seed.classes.includes(o.class)) continue;
       if (!seedMatchesDeployModel(seed, applyDeployModel)) continue;
       if (!seedMatchesProjectType(seed, applyProjectType)) continue;
+      if (!seedMatchesReleaseTrack(seed, vars.RELEASE_TRACK)) continue;
       const waiver = seed.waivers?.[slug];
       if (waiver) {
         actions.push({ action: "skip", target: seed.target, ownership: seed.ownership, reason: `waived: ${waiver}` });
@@ -52670,7 +52701,12 @@ LIVE apply to ${repo}:
     const readSeedFile2 = (path2) => (0, import_node_fs40.existsSync)(path2) ? (0, import_node_fs40.readFileSync)(path2, "utf8") : null;
     const isWorkflowSeed = seed.target.startsWith(".github/workflows/");
     const { projects, classOf, inClassRepos, canarySlug, sourcePilot } = await propagationScope(seed.classes, `target '${seed.target}'`);
-    const repos = inClassRepos.map((repo) => {
+    const trackOf = (repo) => resolveReleaseTrack(
+      projects.find((p) => (p.repos ?? []).some((r) => r.toLowerCase() === repo.toLowerCase())),
+      void 0,
+      repo
+    );
+    const repos = inClassRepos.filter((repo) => seedMatchesReleaseTrack(seed, trackOf(repo))).map((repo) => {
       const slug = repo.split("/").pop().toLowerCase();
       const waiver = seed.waivers?.[slug];
       return { repo, slug, waiver };
@@ -52718,7 +52754,7 @@ LIVE apply to ${repo}:
         }
         desired = resolved.content;
       } else {
-        desired = hubContent;
+        desired = renderSelfSeedForTrack(hubContent, trackOf(r.repo));
       }
       desiredByRepo.set(r.repo, desired);
       const drift = compareSeedBytes(desired, content);
@@ -59669,7 +59705,7 @@ function branchRulesReadHint(path2) {
   const match = new RegExp(`^repos/(${NAME})/(${NAME})/(?:rules/branches/[^/?#]+|branches/[^/?#]+/protection(?:/|$)|rulesets(?:/|$))`).exec(path2.split("?")[0]);
   if (!match) return "";
   const slug = `${match[1]}/${match[2]}`;
-  return ` No raw rules, rulesets or branch-protection read is on the App allowlist, so retrying path or query variants cannot work \u2014 inspect a PR's required status contexts with \`MMI_ACTOR=app mmi-cli devops pr checks-required <pr> --repo ${slug} --json\`, or verify repository ruleset and branch-protection health with \`mmi-cli devops bootstrap verify --repo ${slug} --json\` and \`mmi-cli devops ci audit --repo ${slug} --json\`.`;
+  return ` No raw rules, rulesets or branch-protection read is on the App allowlist, so retrying path or query variants cannot work \u2014 inspect a PR's required status contexts with \`MMI_ACTOR=app mmi-cli devops pr checks-required <pr> --repo ${slug} --json\`, or verify repository ruleset and branch-protection health with \`mmi-cli devops bootstrap verify --repo ${slug} --json\` and \`mmi-cli devops ci audit --repo ${slug} --json\`. Stepping around it with a raw \`gh api repos/${slug}/rulesets/<id> > file\` is not a substitute \u2014 when that read fails it leaves an EMPTY file, and a later require/JSON.parse throws 'Unexpected end of JSON input' that looks like corrupt data while the real refusal is only on stderr; check the exit code and file size, or ask a human token holder for the raw ruleset body.`;
 }
 function commitsReadHint(path2) {
   const clean4 = path2.split("?")[0];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.42",
+  "version": "4.6.43",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",