@tokenoftrust/cli 1.4.0-rc.13 → 1.4.0-rc.15

package/src/plan.mjs

@@ -2,9 +2,10 @@
  * The shared "operation plan" affordance (unit U10) — the load-bearing
  * cross-cutting requirement from decision `operator-verb-and-hosting-model`:
  * every MUTATING operator verb (build / accept / ship / retire) must STATE
- * EXACTLY what it will do — which PR moves to main, which deploy targets
- * (preview / live) are touched, and their URLs — and get an explicit confirm
- * before acting. No silent multi-step mutations, in either surface (the CLI
+ * EXACTLY what it will do — which PR is queued/integrated/deployed, which
+ * deploy targets (preview / live) are touched, and their URLs — and get an
+ * explicit confirm before acting. (`accept` now queue-integrates a PR into the
+ * `preview` aggregate — unit b08 — rather than merging it to main.) No silent multi-step mutations, in either surface (the CLI
  * here, and `AdminPublishTab.astro`'s confirm dialog, which renders the same
  * shape of plan text server-side/inline).
  *
@@ -14,13 +15,14 @@
  * half — print the plan, then gate on an explicit yes (reusing `prompt.mjs`'s
  * TTY-safe `promptYesNo`; a non-TTY without `--yes` never silently proceeds).
  *
- * SHIP is context-dependent (decision `ship-context-dependent-semantics`):
- * run by the developer in their own checkout, the candidate is still open, so
- * shipping means accept-then-deploy (merge PR → main, THEN deploy main to
- * preview + live). Run by an operator already targeting a PR that's merged,
- * shipping means just deploy (main → preview + live) — there's nothing left
- * to merge. `planForAction` takes an explicit `context` so the caller (which
- * knows which situation it's in) picks the right narration; it never guesses.
+ * SHIP has ONE meaning (unit b10 — supersedes the retired context-dependent
+ * ship, decision `ship-context-dependent-semantics`): it publishes the
+ * tenant's CURRENT GREEN AGGREGATE — the batch of PRs that integrated
+ * cleanly — to live. No merge, no PR/candidate targeting, no developer-vs-
+ * operator branching. The plan states the pinned aggregate sha, its
+ * content-addressed artifact digest, every included PR, the rollback target,
+ * and the go-live paywall verdict, so the human reviews EXACTLY what "green"
+ * means before confirming.
  *
  * Dependency-free (no imports besides the sibling `prompt.mjs`).
  */
@@ -52,6 +54,11 @@ function targetLabel({ pr, changeId }) {
  *   endpoint?: string|null,
  *   targets?: { preview?: string|null, live?: string|null },
  *   context?: "developer"|"operator",
+ *   pinnedSha?: string|null,
+ *   artifactDigest?: string|null,
+ *   includedPrs?: Array<{ prNumber?: number|null, changeId?: string|null, headSha?: string|null }>,
+ *   rollbackTarget?: { receiptId: string, aggregateSha: string } | null,
+ *   paywall?: { allowed: boolean, message?: string|null } | null,
  * }} params
  * @returns {string[]} plan lines (no leading/trailing blank line)
  */
@@ -64,7 +71,14 @@ export function planForAction({
   endpoint = null,
   targets = {},
   context = "operator",
+  pinnedSha = null,
+  artifactDigest = null,
+  includedPrs = null,
+  rollbackTarget = null,
+  paywall = null,
 }) {
+  void context; // retained param — no action currently branches on it (ship, the
+  // last one that did, is now ONE meaning; kept so a future action can opt in).
   const label = targetLabel({ pr, changeId });
   const lines = [`${titleFor(action)} plan:`];
   if (tenant) lines.push(`  tenant:    ${tenant}`);
@@ -82,21 +96,43 @@ export function planForAction({
       break;
     }
     case "accept": {
-      lines.push(`  effect:    merge ${label} into main.`);
+      // Accept now means QUEUE-INTEGRATE-INTO-PREVIEW (unit b08), NOT merge-to-main:
+      // the candidate lands in the protected `preview` aggregate (serialized merge →
+      // rebuild → combined-evidence gate), and the aggregate goes live only later via
+      // `tot ship`. So the plan states the integration, never a merge or a go-live.
+      const into = tenant ? `${tenant}'s preview aggregate` : "the preview aggregate";
+      lines.push(
+        `  effect:    queue ${label} for integration into ${into} — NO merge to main, NO go-live.`,
+      );
       break;
     }
     case "ship": {
-      const deployTargets = deployTargetsLine(targets);
-      if (context === "developer") {
-        // The candidate is still open in the developer's own checkout — ship
-        // is accept-then-deploy in one gated step.
-        lines.push(
-          `  effect:    merge ${label} into main, then deploy main → ${deployTargets}.`,
-        );
-      } else {
-        // Operator targeting a PR that's already merged — nothing left to
-        // merge, so ship is just the deploy half.
-        lines.push(`  effect:    deploy main → ${deployTargets}.`);
+      // ONE meaning (b10): publish the tenant's CURRENT GREEN AGGREGATE to live.
+      // No merge — b09's orchestrator ships the already-materialized, already-
+      // reviewed digest. State exactly WHAT that is: the pinned sha, the
+      // content-addressed artifact digest, every included PR, the rollback
+      // target, and the go-live paywall verdict — so the human reviews the
+      // real content of "green" before confirming.
+      lines.push(
+        `  effect:    publish the current green aggregate to live${targets.live ? ` (${targets.live})` : ""} — no merge.`,
+      );
+      if (pinnedSha) lines.push(`  pinned sha:      ${pinnedSha}`);
+      if (artifactDigest) lines.push(`  artifact digest: ${artifactDigest}`);
+      if (Array.isArray(includedPrs)) {
+        lines.push(`  included PRs (${includedPrs.length}):`);
+        for (const p of includedPrs) {
+          const prLabel = p && p.prNumber != null ? `#${p.prNumber}` : p?.changeId || "(no PR)";
+          const shortSha = p && p.headSha ? ` ${String(p.headSha).slice(0, 8)}` : "";
+          lines.push(`    - ${prLabel}${shortSha}`);
+        }
+      }
+      lines.push(
+        rollbackTarget
+          ? `  rollback to: ${rollbackTarget.aggregateSha} (receipt ${rollbackTarget.receiptId})`
+          : "  rollback to: (none — first-ever ship)",
+      );
+      if (paywall && paywall.allowed === false) {
+        lines.push(`  ⚠ paywall:   ${paywall.message || "go-live is blocked by the storefront subscription gate"}`);
       }
       break;
     }
@@ -121,13 +157,6 @@ function titleFor(action) {
   return action ? action[0].toUpperCase() + action.slice(1) : "Operation";
 }
 
-/** Render "preview (<url>) + live (<url>)", degrading gracefully when a URL is unknown. Pure. */
-function deployTargetsLine(targets = {}) {
-  const preview = targets.preview ? `preview (${targets.preview})` : "preview";
-  const live = targets.live ? `live (${targets.live})` : "live";
-  return `${preview} + ${live}`;
-}
-
 /**
  * Print a plan and gate on an explicit confirm — the CLI half of the shared
  * affordance. Prints every line, a trailing blank line, then: