@tokenoftrust/cli 2.0.25 → 2.0.26

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.0.25",
+  "version": "2.0.26",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/ship.mjs

@@ -36,11 +36,9 @@
  *      `promote_failed` / `record_failed` (a partial failure, recoverable by
  *      re-running `tot ship`, never a false live claim).
  *
- * TRANSPORT: the CLI holds no storefront cookie (its OAuth login is with the
- * MCP, a different trust boundary), so `/api/changes/ship` is reached with a
- * Bearer OPERATOR SECRET + `X-Tot-Owner` — the SAME transport the retired
- * `tot ship <N> --tenant` operator-by-PR path used. No MCP client, no git: ship
- * is now pure HTTP (dependency-free — global `fetch` only).
+ * TRANSPORT: operators/CI may use a Bearer operator secret. A signed-in owner or
+ * developer instead mints a storefront viewer session from their OWN `tot login`
+ * identity; the server still enforces the live owner / `ship-on-behalf` grant.
  */
 import { fail } from "../errors.mjs";
 import { planForAction, printPlanAndConfirm } from "../plan.mjs";
@@ -52,6 +50,7 @@ import { emitActivity } from "../activity.mjs";
 // sees WHICH changes are keeping the aggregate from going green without a separate
 // `tot preview doctor` run.
 import { autoSurfaceDoctor } from "../merge-doctor-report.mjs";
+import { resolveViewerTransport } from "../viewer-session.mjs";
 
 const DEFAULT_STOREFRONT_URL = "https://storefront.tokenoftrust.store";
 
@@ -62,10 +61,15 @@ const USAGE = `tot ship — publish the tenant's CURRENT GREEN AGGREGATE to live
   tot ship --yes             confirm non-interactively (skip the [y/N] prompt)
   tot ship --url <origin>    storefront origin (default: env TOT_STOREFRONT_URL)
   tot ship --secret <s>      operator secret (prefer the env vars below)
+  tot ship --accept-quality-findings <reason>
+                            accept this revision's overridable quality findings,
+                            record the required reason, then continue publishing
   tot ship --no-open         don't open the live URL in your browser
 
-  Operator secret (from env, first found): PREVIEW_RECONCILE_SECRET,
-  GRANTS_ADMIN_SECRET, TOT_OPERATOR_SECRET (or pass --secret).
+  Authentication: a signed-in owner/developer with a live ship-on-behalf grant
+  can use their own \`tot login\` session. Operators/CI may instead provide a
+  secret via PREVIEW_RECONCILE_SECRET, GRANTS_ADMIN_SECRET,
+  TOT_OPERATOR_SECRET, or --secret.
 
   \`tot ship\` has ONE meaning: it publishes the tenant's shared preview
   aggregate — the batch of PRs that integrated cleanly and went GREEN — to
@@ -88,6 +92,7 @@ export function parseShipArgs(argv) {
     noOpen: false,
     url: null,
     secret: null,
+    acceptQualityReason: null,
     help: false,
   };
   for (let i = 0; i < argv.length; i++) {
@@ -97,6 +102,7 @@ export function parseShipArgs(argv) {
     else if (t === "--no-open") a.noOpen = true;
     else if (t === "--url") a.url = argv[++i];
     else if (t === "--secret") a.secret = argv[++i];
+    else if (t === "--accept-quality-findings") a.acceptQualityReason = argv[++i];
     else if (t === "--help" || t === "-h") a.help = true;
   }
   return a;
@@ -305,32 +311,46 @@ async function readJsonSafe(res) {
  * injected so it's unit-tested with no live network/TTY.
  *
  * @param {{ tenant:string, secret:string, storefrontUrl?:string|null,
- *   yes?:boolean, noOpen?:boolean }} params
+ *   yes?:boolean, noOpen?:boolean, acceptQualityReason?:string|null,
+ *   env?:NodeJS.ProcessEnv }} params
  * @param {{ fetch?:typeof fetch, confirmPlan?:typeof printPlanAndConfirm,
- *   openUrl?:(u:string)=>boolean, progress?:boolean }} [deps]
+ *   openUrl?:(u:string)=>boolean, progress?:boolean,
+ *   resolveViewerTransport?:typeof resolveViewerTransport }} [deps]
  * @returns {Promise<number>} process exit code
  */
-export async function runShip({ tenant, secret, storefrontUrl = null, yes = false, noOpen = false }, deps = {}) {
+export async function runShip(
+  {
+    tenant,
+    secret,
+    storefrontUrl = null,
+    yes = false,
+    noOpen = false,
+    acceptQualityReason = null,
+    env = process.env,
+  },
+  deps = {},
+) {
   const fetchImpl = deps.fetch || globalThis.fetch;
   const confirmPlan = deps.confirmPlan || printPlanAndConfirm;
-  const base = (storefrontUrl || DEFAULT_STOREFRONT_URL).trim().replace(/\/+$/, "");
-
-  if (!secret) {
-    console.error(
-      fail(
-        "shipping is an OPERATOR action — it needs an operator secret",
-        "set PREVIEW_RECONCILE_SECRET (or GRANTS_ADMIN_SECRET / TOT_OPERATOR_SECRET), or pass --secret",
-      ),
-    );
-    return 2;
+  const resolveViewer = deps.resolveViewerTransport || resolveViewerTransport;
+  let base = (storefrontUrl || DEFAULT_STOREFRONT_URL).trim().replace(/\/+$/, "");
+  let authHeaders;
+  if (secret) {
+    authHeaders = {
+      authorization: `Bearer ${secret}`,
+      "x-tot-owner": tenant,
+      "x-tot-capability": "ship-on-behalf",
+    };
+  } else {
+    const viewer = await resolveViewer({ tenant, env, fetchImpl, storefrontUrl });
+    if (!viewer.ok) {
+      console.error(fail(viewer.message, viewer.hint));
+      return 2;
+    }
+    base = viewer.base;
+    authHeaders = viewer.authHeaders;
   }
 
-  const authHeaders = {
-    authorization: `Bearer ${secret}`,
-    "x-tot-owner": tenant,
-    "x-tot-capability": "ship-on-behalf",
-  };
-
   // Auto-surface the merge-doctor on a refused/failed ship. Best-effort:
   // fetches the hosted doctor over the SAME operator transport and prints the COMPACT
   // summary; never throws and never touches the exit code. A clean/unreachable doctor
@@ -387,6 +407,10 @@ export async function runShip({ tenant, secret, storefrontUrl = null, yes = fals
     paywall: plan.paywall,
     targets: { live: liveUrl },
   });
+  if (acceptQualityReason) {
+    planLines.push("  quality findings: accept this exact revision and continue");
+    planLines.push(`  acceptance reason: ${acceptQualityReason.trim() || "(missing)"}`);
+  }
   const { confirmed, reason } = await confirmPlan(planLines, {
     yes,
     question: `Ship ${tenant}'s current green aggregate live?`,
@@ -405,6 +429,36 @@ export async function runShip({ tenant, secret, storefrontUrl = null, yes = fals
     return 0;
   }
 
+  // This is the same revision-bound acceptance as the Publish dialog, not a raw validator bypass.
+  // The server refuses it unless the current durable problem is quality-only and the reason is
+  // substantive. Only after that accountable record exists do we re-dispatch the release.
+  if (acceptQualityReason !== null) {
+    let acceptRes;
+    try {
+      acceptRes = await fetchImpl(`${base}/api/changes/accept-issue`, {
+        method: "POST",
+        headers: { "content-type": "application/json", ...authHeaders },
+        body: JSON.stringify({ operation: "publication", reason: acceptQualityReason }),
+      });
+    } catch (e) {
+      console.error(
+        fail(`couldn't record the quality acceptance at ${base}: ${String(e?.message || e)}`, "check --url / your network, then re-run"),
+      );
+      return 1;
+    }
+    const acceptData = await readJsonSafe(acceptRes);
+    if (!acceptRes.ok || acceptData?.ok !== true) {
+      console.error(
+        fail(
+          acceptData?.error || acceptData?.message || `quality acceptance was refused (HTTP ${acceptRes.status})`,
+          "review the current publish findings; only quality-only findings on this exact revision can be accepted",
+        ),
+      );
+      return 1;
+    }
+    console.log("  ✓ quality findings accepted for this revision; continuing the publish.");
+  }
+
   // 3. SHIP — the human go-live gate (confirmGoLive) plus the reviewed pin, so a
   //    STALE plan (the aggregate moved / the artifact changed since GET) is
   //    refused rather than shipping something nobody reviewed.
@@ -528,6 +582,8 @@ export async function run(argv, ctx) {
       storefrontUrl,
       yes: args.yes,
       noOpen: args.noOpen,
+      acceptQualityReason: args.acceptQualityReason,
+      env,
     },
     { openUrl: (u) => openBrowser(u) },
   );