@tokenoftrust/cli 2.0.15 → 2.0.17

package/README.md

@@ -15,9 +15,7 @@ tot ship                     # promote a reconciled preview live (diff + one con
 
 **Prerequisites: Node.js and an invite. Nothing else.** `tot dev` downloads the
 moat-free storefront runner and runs it as a plain host process — no Docker
-install, no hand-provisioned AWS credentials. (Docker remains available as a
-fallback — `tot dev --docker` — or automatically if the native artifact can't
-be fetched.)
+install or hand-provisioned AWS credentials.
 
 For Storefront Private App contracts, examples, and LLM-ready developer material, start at
 [Storefront Devkit — Apps / Private](https://github.com/tokenoftrust/storefront-devkit/tree/main/apps/private).
@@ -30,7 +28,7 @@ published npm SDK.
 | --- | --- | --- |
 | `tot clone [<tenant>] [<dir>]` | **built** | Clone a store you're entitled to build on (mirrors `git clone`), with an authenticated remote configured. Dir defaults to `<tenant>`. No arg → list your stores. |
 | `tot validate` | next | Lint your store before you preview. |
-| `tot dev` | **built** | Run your store locally with save→reload — NATIVELY (no Docker; falls back to it with `--docker` or automatically if the native artifact isn't available). |
+| `tot dev` | **built** | Run your store locally with save→reload — natively. |
 | `tot preview` | **built** | Bundle your edits into a compliance-reviewed preview (validates, auto-commits the known content trees, pushes the preview ref, opens/updates a candidate PR, reports the reconcile/compliance verdict + preview URL). `tot submit` / `tot deploy` still work as teaching aliases for this same flow. |
 | `tot ship` | **built** | Promote a reconciled preview live: always shows a diff-vs-live and asks for one `[y/N]` confirm (no `--yes`, refuses outside a terminal); records an approval request if you're not authorised to ship yourself. |
 | `tot pr [list\|view\|close]` | **built** | See and manage the candidate PRs `tot preview` opens (`gh pr`-shaped). |
@@ -75,4 +73,4 @@ A clean short name (`staff`, `dev`, `test-7`) becomes a readable `credentials.<n
 
 ## Design notes
 
-Dependency-free by design (global `fetch` + `git` + the system `tar`), so `npm i -g @tokenoftrust/cli` stays light. `tot dev` is the only command that pulls in the storefront runner: for a standalone checkout it downloads the moat-free runner artifact (`dev_renderer_artifact`, entitlement-gated, same shape as the Docker pull-token path) once per version to `~/.tot/cache/renderer/<version>/`, `pnpm install`s it there (via corepack — no separate pnpm install needed), and reuses that cache on every later run. See `src/` for the small modules: `context.mjs` (detection), `mcp.mjs` (transport), `auth.mjs` (the identity seam), `commands/`.
+Dependency-free by design (global `fetch` + `git` + the system `tar`), so `npm i -g @tokenoftrust/cli` stays light. `tot dev` is the only command that pulls in the storefront runner: for a standalone checkout it downloads the moat-free runner artifact (`dev_renderer_artifact`, entitlement-gated) once per version to `~/.tot/cache/renderer/<version>/`, `pnpm install`s it there (via corepack — no separate pnpm install needed), and reuses that cache on every later run. See `src/` for the small modules: `context.mjs` (detection), `mcp.mjs` (transport), `auth.mjs` (the identity seam), `commands/`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.0.15",
+  "version": "2.0.17",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/clone.mjs

@@ -117,7 +117,7 @@ const USAGE = `tot clone — clone a tenant store you can build on (mirrors \`gi
                                 <tenant>-pr<N>)
 
 Options:
-  --tag <tag>       which repo (repo = "<tenant>-<tag>"). Default: main.
+  --tag <tag>       deprecated compatibility input; tenant repos use the bare domain.
   --pr <N>          clone PR #<N>'s head instead of the default branch — a
                     READ-ONLY cross-tenant credential, not a push checkout.
   --remote-only     don't clone; just mint + print the clone URL for <tenant>.
@@ -287,7 +287,22 @@ export async function run(argv, ctx) {
  *   cloned: boolean, dir: string|null, head: string|null }>}
  */
 export async function checkoutTenant(client, { tenant, tag = "main", cloneDir = null, redact = (s) => s }) {
-  await client.callTool("client_switch", { tenant });
+  // The switch is LOAD-BEARING, so its refusal is the error the developer must see. When
+  // the tenant is not one of this session's clients the server refuses here with the real
+  // cause (no grant / a grant issued to a client this identity is not bound to / a grant
+  // issued after sign-in that needs a re-auth) — far more specific than the tenant_checkout
+  // refusal that follows it. Surfacing the switch's own words, with the server's nextAction,
+  // stops a genuinely-unentitled tenant from being reported as a scope-selection slip.
+  try {
+    await client.callTool("client_switch", { tenant });
+  } catch (e) {
+    throw new CliError(redact(String(e?.message || e)), {
+      next:
+        "confirm you're entitled to this store — `tot grants` lists what your session can " +
+        "act on, and `tot login` refreshes a grant issued after you signed in",
+      cause: e,
+    });
+  }
   // vc-app-binding safety-net (08-18, §5): ensure THIS developer is bound to the
   // storefront version-control app BEFORE checkout, so tenant_checkout can resolve
   // `appForCaller` for them instead of 403-ing "No version-control app is bound." The
@@ -541,6 +556,21 @@ export function checkoutError(checkout) {
     (c && (c.message || (typeof c.error === "string" ? c.error : c.error?.message))) ||
     (c && typeof c.raw === "string" && c.raw.trim() ? c.raw.trim() : null) ||
     null;
+  // Not entitled: the session resolved NO grant or client context for the asserted tenant.
+  // Distinct from both not-provisioned (the store is fine) and over-scope (you hold it but
+  // haven't switched) — and the one case where the remedy is upstream of this checkout.
+  if (
+    typeof msg === "string" &&
+    /not among the tenants your session holds|^Not entitled/i.test(msg)
+  ) {
+    return {
+      message: msg,
+      next:
+        "`tot grants` lists what your session can actually act on — a grant whose grantee " +
+        "your identity doesn't resolve to never becomes visible here; if it was issued after " +
+        "you signed in, run `tot login` to refresh, then retry",
+    };
+  }
   // The store's repo isn't provisioned yet — it isn't set up for this developer.
   if (typeof msg === "string" && /not provisioned/i.test(msg)) {
     return {

package/src/commands/dev.mjs

@@ -9,16 +9,14 @@
  *
  *   checkout — a standalone tenant checkout has no runner. `tot dev` DOWNLOADS the
  *              published, RUNNER ARTIFACT (a plain tarball — the exact
- *              same tree Docker used to bake into the image, see
+ *              same renderer tree used by the platform, see
  *              scripts/build/build-runner.mjs) and runs it NATIVELY: no Docker, no
  *              container. Cached once per version under ~/.tot/cache/renderer/, so
  *              only the first run pays the download+install cost. The runner's own
  *              scripts/tot-dev.mjs grafts the checkout in and boots astro dev
  *              --host at http://localhost:<port>/<appDomain>/, with real (not
  *              polled) file-watch HMR. Nothing is published; product data renders
- *              from local fixtures. Docker remains available as a fallback
- *              (--docker, or automatically if the native artifact can't be
- *              fetched) — see runContainer below.
+ *              from local fixtures.
  *
  *   --sample — the ZERO-LOGIN, NO-MCP free taste. Scaffolds a bundled sample store
  *              onto disk and runs it natively WITHOUT any authenticated
@@ -28,8 +26,7 @@
  *
  * IP note: the artifact is the pruned runner (control plane physically absent),
  * vended by a short-lived signed URL (`dev_renderer_artifact`) gated on the same
- * developer entitlement as the Docker pull token — no hand-provisioned AWS creds
- * either way.
+ * developer entitlement — no hand-provisioned AWS credentials.
  */
 import { spawn, spawnSync, execFileSync } from "node:child_process";
 import { existsSync, readFileSync, writeFileSync, mkdirSync, renameSync, rmSync, readdirSync, createWriteStream, openSync, closeSync, writeSync } from "node:fs";
@@ -55,7 +52,7 @@ import { streamDevLogs } from "../dev-logs.mjs";
 import { cockpitUrlFrom } from "../banner.mjs";
 import { recordDiagnostic } from "../diagnostics.mjs";
 
-/** The published runner image (--docker fallback). Override with --image / TOT_DEV_IMAGE. */
+// Kept for the internal `tot start` migration path. `tot dev` itself is native-only.
 const DEFAULT_DEV_IMAGE =
   "242086487598.dkr.ecr.us-east-1.amazonaws.com/tot-dev:latest";
 const DEFAULT_MCP_URL = "https://mcp.tokenoftrust.com";
@@ -67,19 +64,17 @@ const DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org";
 
 export function parseArgs(argv) {
   const a = {
-    workspace: null, port: "4321", image: null, mcp: null,
-    noLogin: false, noOpen: false, docker: false, sample: false, help: false,
+    workspace: null, port: "4321", mcp: null,
+    noLogin: false, noOpen: false, sample: false, help: false,
     rendererVersion: null,
   };
   for (let i = 0; i < argv.length; i++) {
     const t = argv[i];
     if (t === "--workspace") a.workspace = argv[++i];
     else if (t === "--port") a.port = argv[++i];
-    else if (t === "--image") a.image = argv[++i];
     else if (t === "--mcp") a.mcp = argv[++i];
     else if (t === "--no-login") a.noLogin = true;
     else if (t === "--no-open") a.noOpen = true;
-    else if (t === "--docker") a.docker = true;
     else if (t === "--sample") a.sample = true;
     else if (t === "--renderer-version") a.rendererVersion = argv[++i];
     else if (t === "--help" || t === "-h") a.help = true;
@@ -95,8 +90,6 @@ const USAGE = `tot dev — run your store locally with save→reload
                                 no MCP, no account (the free first taste)
   tot dev --workspace <dir>     run a specific checkout directory
   tot dev --port <n>            host port (default 4321)
-  tot dev --docker              use the Docker runner image instead of the native path
-  tot dev --image <ref>         runner image ref, only with --docker (default: the published image)
   tot dev --no-open             don't auto-open the browser when the server is up
 
 Edit content/*.html or the theme + save → the browser reloads. Private local
@@ -128,8 +121,7 @@ export async function run(argv, ctx) {
     return runMonorepo(ctx, argv);
   }
 
-  // Standalone checkout (or an explicit --workspace anywhere): native by default,
-  // Docker on request (--docker) or as an automatic fallback (see runStandalone).
+  // Standalone checkout (or an explicit --workspace anywhere): native runtime.
   const workspace = args.workspace
     ? resolve(args.workspace)
     : ctx.mode === "checkout"
@@ -148,31 +140,20 @@ export async function run(argv, ctx) {
 }
 
 /**
- * Standalone-checkout entrypoint: native runtime by default (no Docker
- * prerequisite), Docker on explicit request, and Docker as an automatic
- * fallback when the native artifact can't be fetched (e.g. the MCP's
- * dev_renderer_artifact isn't configured on this deployment yet) — so `tot dev`
- * keeps working instead of hard-failing.
+ * Standalone-checkout entrypoint: run the native renderer. When the entitled
+ * artifact is unavailable, use the public runner package on the same release line.
  */
 async function runStandalone(workspace, args, ctx) {
-  if (args.docker) return runContainer(workspace, args, ctx);
   try {
     return await runNative(workspace, args, ctx);
   } catch (e) {
     if (e instanceof NativeArtifactUnavailableError) {
       // Entitled artifact unavailable — stay NATIVE on the public npm runner
       // (@tokenoftrust/storefront-runner, the SAME renderer bits), so
-      // `tot dev` never needs Docker just because dev_renderer_artifact isn't
-      // configured. Docker is the last resort only if the public runner is also
-      // unreachable (offline).
       try {
-        console.error(`~ couldn't set up your store preview the usual way (${e.message}) — using the fallback preview engine instead (no Docker needed).`);
+        console.error(`~ couldn't set up your store preview the usual way (${e.message}) — using the public preview engine instead.`);
         return await runNativePublic(workspace, args, ctx);
       } catch (e2) {
-        if (e2 instanceof NativeArtifactUnavailableError) {
-          console.error(`~ couldn't reach the fallback preview engine either (${e2.message}) — switching to the Docker runner.`);
-          return runContainer(workspace, args, ctx);
-        }
         console.error(formatError(e2));
         return e2 instanceof CliError ? (e2.exitCode ?? 2) : 2;
       }
@@ -189,7 +170,7 @@ async function runStandalone(workspace, args, ctx) {
  * ensureSampleRenderer (env override → in-tree monorepo → version-pinned public
  * npm, reusing the matching `public-<version>` cache), which throws
  * NativeArtifactUnavailableError when even the public runner can't be fetched
- * (offline) so the caller can drop to Docker.
+ * (offline) so the caller can report the unavailable local preview.
  */
 async function runNativePublic(workspace, args, ctx) {
   const cfg = readWorkspaceConfig(workspace);

package/src/commands/submit.mjs

@@ -769,9 +769,9 @@ export function parseNameStatus(text) {
 }
 
 /**
- * Derive the g1b forge repo name (`"<tenant>-<tag>"`, e.g. `"acme.com-main"`)
+ * Derive the g1b forge repo name (the bare tenant domain, e.g. `"acme.com"`)
  * from the checkout's authenticated origin remote — the SAME name
- * `tenant_checkout` minted it as, so no separate lookup or stored tag is
+ * `tenant_checkout` resolved, so no separate lookup or stored tag is
  * needed. Returns null when the remote URL can't be parsed (candidate_open is
  * then skipped, reported, never crashed). Pure — unit-tested.
  * @param {string} remoteUrl
@@ -812,11 +812,10 @@ export function isForgeAuthError(text) {
 }
 
 /**
- * Derive the checkout's forge tag from its repo name (`"<tenant>-<tag>"`), so a
- * re-mint targets the SAME repo the checkout points at. Defaults to "main" when the
- * repo is bare (`"<tenant>"`, post-8425) or the `<tenant>-` prefix doesn't match, so
- * the mint degrades to the clone default rather than a wrong tag. Pure —
- * unit-tested.
+ * Retain compatibility with historical `"<tenant>-<tag>"` repos when re-minting a
+ * checkout credential. Current repos use the bare tenant domain and therefore
+ * resolve to the compatibility default `main`; the server ignores that tag for
+ * current repo naming. Pure — unit-tested.
  * @param {string|null} repoName
  * @param {string} tenant
  * @returns {string}