@tokenoftrust/cli 1.4.1 → 1.5.0

package/src/commands/retire.mjs

@@ -1,203 +0,0 @@
-/**
- * `tot retire --tenant <t> --pr <N>` — OPERATOR retire/GC (unit U7).
- *
- * Evict a candidate PR's hosted preview — its `ReviewEnvironment` projection +
- * its immutable site version — to RECLAIM SPACE. It calls the
- * session-authenticated storefront endpoint `POST /api/preview/retire` (unit
- * U7), which deletes the candidate record + prunes the tenant index and evicts
- * the candidate version (guarded: it refuses any version a channel points at).
- *
- * DISTINCT FROM `tot accept` / reject: retire touches NO change lifecycle — the
- * change stays open. It is REVERSIBLE-BY-REBUILD: because U1 build-on-demand
- * (`tot preview build`) + the U2 fallback page can rematerialize the PR head on
- * request, a retired PR degrades to "not built yet", NOT a dead 404.
- *
- * IDEMPOTENT — retiring an already-absent candidate is a clean success
- * (nothing to evict). Unlike `tot preview build`, retire needs NO head sha: it
- * targets an EXISTING candidate by `--pr` (→ `pr-<N>`) or an explicit
- * `--change-id`.
- *
- * AUTH — the storefront endpoint accepts the headless Bearer-operator-secret
- * path (`resolveOwnerSession` fallback). This verb sends `Authorization: Bearer
- * <secret>` (from `PREVIEW_RECONCILE_SECRET` / `GRANTS_ADMIN_SECRET` /
- * `TOT_OPERATOR_SECRET`, or `--secret`), `X-Tot-Owner: <tenant>`, and
- * `X-Tot-Capability: ship-on-behalf` — mirroring `tot preview build` and the
- * `/admin` AdminPublishTab retire call.
- *
- * SELF-DECLARING — it prints the EXACT plan (which PR → which tenant → evict +
- * rebuildable) and confirms before acting (`--yes` to skip; a non-TTY without
- * `--yes` aborts rather than acting silently). Retire is INERT re: shared
- * channels — it flips no preview/live channel and touches no live pointer — so
- * this is a teardown, not a deploy. The plan itself is built by the SHARED plan
- * module (`../plan.mjs`, unit U10) — the same affordance every other mutating
- * operator verb (build/accept/ship) and the `/admin` confirm dialog use, per
- * decision `operator-verb-and-hosting-model`.
- *
- * Dependency-free (global fetch + the shared plan module).
- */
-import { planForAction, printPlanAndConfirm } from "../plan.mjs";
-
-const DEFAULT_STOREFRONT_URL = "https://storefront.tokenoftrust.store";
-
-/** Parse `tot retire` argv. Pure — unit-testable. */
-export function parseRetireArgs(argv) {
-  const a = {
-    tenant: null,
-    pr: null,
-    changeId: null,
-    url: null,
-    secret: null,
-    yes: false,
-    help: false,
-  };
-  for (let i = 0; i < argv.length; i++) {
-    const t = argv[i];
-    if (t === "--tenant") a.tenant = argv[++i];
-    else if (t === "--pr") a.pr = argv[++i];
-    else if (t === "--change-id") a.changeId = argv[++i];
-    else if (t === "--url") a.url = argv[++i];
-    else if (t === "--secret") a.secret = argv[++i];
-    else if (t === "--yes" || t === "-y") a.yes = true;
-    else if (t === "--help" || t === "-h") a.help = true;
-  }
-  return a;
-}
-
-export function renderUsage() {
-  return `tot retire — operator retire/GC: evict a candidate PR's hosted preview
-
-Usage:
-  tot retire --tenant <appDomain> --pr <N> [options]
-  tot retire --tenant <appDomain> --change-id <id> [options]
-
-Evicts the candidate preview for PR #N of <tenant> — its review environment +
-immutable version — to reclaim space. REVERSIBLE: rebuild it any time with
-\`tot preview build\` (the change stays open; this is NOT reject). It flips NO
-shared channel and is NOT go-live.
-
-Options:
-  --tenant <appDomain>   Target tenant (e.g. tokenoftrust.com). Defaults to the
-                         current checkout's tenant when run inside one.
-  --pr <N>               PR number to retire (identifies the candidate pr-<N>).
-  --change-id <id>       Optional explicit candidate id (defaults to pr-<N>).
-  --url <origin>         Storefront origin. Defaults to $TOT_STOREFRONT_URL or
-                         ${DEFAULT_STOREFRONT_URL}.
-  --secret <s>           Operator secret. Prefer the env vars below.
-  --yes, -y              Skip the confirmation prompt.
-  --help, -h             Show this help.
-
-Auth (operator secret, from env, first found):
-  PREVIEW_RECONCILE_SECRET, GRANTS_ADMIN_SECRET, TOT_OPERATOR_SECRET`;
-}
-
-/**
- * @param {string[]} argv
- * @param {any} ctx — detected CLI context (ctx.tenant when in a checkout)
- */
-export async function run(argv, ctx) {
-  const args = parseRetireArgs(argv);
-  if (args.help) {
-    console.log(renderUsage());
-    return 0;
-  }
-
-  const base = (args.url || process.env.TOT_STOREFRONT_URL || process.env.STOREFRONT_BASE_URL || DEFAULT_STOREFRONT_URL)
-    .trim()
-    .replace(/\/+$/, "");
-
-  const tenant = (args.tenant || ctx?.tenant || "").trim();
-  if (!tenant) {
-    console.error(
-      "✗ no target tenant.\n\n  → next: pass --tenant <appDomain> (e.g. --tenant tokenoftrust.com), " +
-        "or run inside a store checkout.",
-    );
-    return 2;
-  }
-
-  const prRaw = args.pr;
-  const pr = prRaw != null && `${prRaw}`.trim() && Number.isFinite(Number(prRaw)) ? Number(prRaw) : null;
-  const changeId = (args.changeId || "").trim() || null;
-  if (pr == null && !changeId) {
-    console.error(
-      "✗ no candidate to retire.\n\n  → next: pass --pr <N> (the PR number to retire), or --change-id <id>.",
-    );
-    return 2;
-  }
-
-  const secret = (args.secret || process.env.PREVIEW_RECONCILE_SECRET || process.env.GRANTS_ADMIN_SECRET || process.env.TOT_OPERATOR_SECRET || "").trim();
-  if (!secret) {
-    console.error(
-      "✗ no operator secret.\n\n  → next: set PREVIEW_RECONCILE_SECRET (or GRANTS_ADMIN_SECRET / " +
-        "TOT_OPERATOR_SECRET) in the environment.",
-    );
-    return 2;
-  }
-
-  // Self-declaring: state the EXACT plan before acting (the shared plan module).
-  const planLines = planForAction({
-    action: "retire",
-    tenant,
-    pr,
-    changeId,
-    endpoint: `${base}/api/preview/retire`,
-  });
-  const { confirmed, reason } = await printPlanAndConfirm(planLines, {
-    yes: args.yes,
-    question: "Retire this preview now?",
-  });
-  if (!confirmed) {
-    if (reason === "non-tty") {
-      console.error("✗ refusing to retire without confirmation on a non-TTY.\n\n  → next: re-run with --yes.");
-      return 1;
-    }
-    console.log("Aborted — nothing was retired.");
-    return 1;
-  }
-
-  const body = {
-    ...(pr != null ? { pr } : {}),
-    ...(changeId ? { changeId } : {}),
-  };
-
-  let res;
-  try {
-    res = await fetch(`${base}/api/preview/retire`, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        authorization: `Bearer ${secret}`,
-        "x-tot-owner": tenant,
-        "x-tot-capability": "ship-on-behalf",
-      },
-      body: JSON.stringify(body),
-    });
-  } catch (e) {
-    console.error(`✗ could not reach ${base}: ${e?.message || e}\n\n  → next: check --url / your network.`);
-    return 1;
-  }
-
-  let data = {};
-  try {
-    data = await res.json();
-  } catch {
-    /* non-JSON error body */
-  }
-
-  const label = pr != null ? `PR #${pr}` : changeId;
-
-  if (res.ok && data?.ok) {
-    if (data.evicted) {
-      console.log(`✓ Retired ${label} for ${tenant} — the preview was evicted (rebuildable on demand).`);
-    } else {
-      console.log(`✓ Retire ${label} for ${tenant}: nothing to evict (already retired).`);
-    }
-    console.log("\n  → rebuild any time: `tot preview build --tenant " + tenant + (pr != null ? " --pr " + pr : "") + "`\n");
-    return 0;
-  }
-
-  // A refusal (e.g. 409 version-pinned) or an auth/other failure.
-  const message = data?.error || `HTTP ${res.status}`;
-  console.error(`✗ Retire did not succeed (HTTP ${res.status}).`);
-  console.error(`  • ${message}`);
-  return 1;
-}