@tokenoftrust/cli 2.4.1 → 2.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.4.1",
+  "version": "2.4.2",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/submit.mjs

@@ -28,11 +28,12 @@
  * needed. `--watch` just raises the budget (longer waitMs, more attempts) so an
  * attached dev can stay and watch reconcile+compliance resolve live.
  *
- * Watching through to accept (E1b): `--watch` also sets untilShipped, so once
- * reconcile resolves cleanly the loop keeps going (preview_status reuses the
- * SAME waitMs budget server-side to long-poll for a ship decision too — one
- * poll axis, not two) until change_accept ships it or the attempts budget
- * runs out. A failed reconcile never waits for ship — it can't have shipped.
+ * Watching through to live (E1b): `--watch` also sets untilShipped, so once
+ * reconcile resolves cleanly the loop keeps going until the pipeline verdict
+ * (`preview_status.verdict`) shows this commit live — on Cloudflare once the
+ * pointer flip is proven, on CloudFront once the CI publish is confirmed — or the
+ * attempts budget runs out. A failed reconcile never waits for ship — it can't
+ * have shipped.
  * Detached devs get the E1 email instead; this is the attached half.
  *
  * Dependency-free (global fetch + `git`).
@@ -1798,7 +1799,7 @@ export async function run(argv, ctx, {
     let status;
     operation = "preview_status";
     if (args.noWait) {
-      status = normalizePreviewStatus(await scoped.callTool("preview_status", { commit: statusSha }));
+      status = normalizePreviewStatus(await scoped.callTool("preview_status", { commit: statusSha }), statusSha);
     } else {
       // One in-place status line (TTY: a spinner with an elapsed-seconds counter;
       // non-TTY: a ~10s heartbeat) instead of a newline per poll — the wait reads
@@ -1880,10 +1881,10 @@ export async function run(argv, ctx, {
 /**
  * Normalize a `preview_status` tool response to the contract shape the CLI reports
  * on: { status, reconcile:{ok,errors}, compliance:{verdict,detail}, previewUrl,
- * shipped, delivery, dispatched }. A live tool always returns status
+ * shipped, delivery, dispatched, verdict }. A live tool always returns status
  * pending|reconciled|failed; anything else (an older MCP without the tool's flat
  * fields) normalizes to "unknown" so the CLI degrades visibly instead of pretending
- * it reconciled. `shipped` (E1b) is null until change_accept ships this exact commit.
+ * it reconciled. `shipped` (E1b) is derived from the verdict: null until this commit is live.
  *
  * `delivery` is the MCP's reconcile-observability triad for the Gitea webhook that
  * fired on this commit ({ target, actual, evidence, drift? }) — or null when NO
@@ -1893,7 +1894,11 @@ export async function run(argv, ctx, {
  * read under a different tenant scope than it was pushed to), which is a permanent
  * dead-end the CLI must not report as "still reconciling". Pure — unit-tested.
  */
-export function normalizePreviewStatus(r) {
+/**
+ * @param {any} r  the `preview_status` response
+ * @param {string|null} [commit]  the sha the status was asked for (what `shipped` is decided against)
+ */
+export function normalizePreviewStatus(r, commit = null) {
   const status = r?.status;
   const known = status === "pending" || status === "reconciled" || status === "failed";
   const delivery = r?.delivery ?? null;
@@ -1902,7 +1907,7 @@ export function normalizePreviewStatus(r) {
     reconcile: r?.reconcile ?? null,
     compliance: r?.compliance ?? null,
     previewUrl: r?.previewUrl ?? null,
-    shipped: r?.shipped ?? null,
+    shipped: shippedFromVerdict(r?.verdict ?? null, commit),
     delivery,
     dispatched: delivery != null,
     // The ONE pipeline-status read every surface (console, `preview_status`, `tot
@@ -1913,6 +1918,26 @@ export function normalizePreviewStatus(r) {
   };
 }
 
+/**
+ * Whether the pipeline verdict shows `commit` live, and where: the live release IS this commit, or
+ * the live release is the next release this commit's change was merged into (its membership names
+ * the commit as a change head). Per provider, the verdict's live release is recorded only once
+ * delivery is proven — the Cloudflare pointer flip read back, or the CloudFront CI publish
+ * confirmed. Null when not live (or no verdict). Pure — unit-tested.
+ * @param {any} verdict  @param {string|null} commit
+ * @returns {{ sha: string, receiptId: string|null, provider: string|null, provedAt: string|null }|null}
+ */
+export function shippedFromVerdict(verdict, commit) {
+  if (!commit || verdict?.kind !== "idle" || !verdict.live?.sha) return null;
+  const live = verdict.live;
+  const merged =
+    verdict.preview?.sha === live.sha &&
+    Array.isArray(verdict.preview?.membership) &&
+    verdict.preview.membership.some((m) => m?.headSha === commit);
+  if (live.sha !== commit && !merged) return null;
+  return { sha: live.sha, receiptId: live.receiptId ?? null, provider: live.provider ?? null, provedAt: live.provedAt ?? null };
+}
+
 /** A submit succeeds only when reconcile has neither failed nor failed to start. */
 export function previewSubmitSucceeded(status) {
   const knownSuccessState = status?.status === "pending" || status?.status === "reconciled";
@@ -1971,7 +1996,7 @@ export async function pollPreviewStatus(
   for (let i = 0; i < attempts; i++) {
     const startedAt = now();
     const args = waitMs ? { commit, waitMs } : { commit };
-    last = normalizePreviewStatus(await scoped.callTool("preview_status", args));
+    last = normalizePreviewStatus(await scoped.callTool("preview_status", args), commit);
     if (last.dispatched) everDispatched = true;
     last.everDispatched = everDispatched;
     if (onTick) onTick(last, i);
@@ -2194,6 +2219,25 @@ export function formatVerdictBlock(verdict, supportBundleText = null) {
  * --json — automation doesn't want a browser popping up). `commit`/`ref`/`verb`
  * feed the honest never-dispatched block.
  */
+/**
+ * The ship line after a watched submit: where this commit is live (per provider) once the verdict
+ * shows it, or that a reviewer still has to accept it. Null when reconcile has not settled. Pure.
+ * @param {{ status?: string, shipped?: { sha: string, receiptId: string|null, provider: string|null, provedAt: string|null }|null }} s
+ */
+export function formatShipLine(s) {
+  if (s?.shipped) {
+    const where =
+      s.shipped.provider === "s3-overwrite" ? "CloudFront" : s.shipped.provider === "worker-r2-pointer" ? "Cloudflare" : "your live site";
+    return (
+      `\n  ✓ shipped — live at ${s.shipped.sha.slice(0, 9)} on ${where}` +
+      (s.shipped.receiptId ? ` (receipt ${s.shipped.receiptId})` : "") +
+      (s.shipped.provedAt ? `, proven ${s.shipped.provedAt}` : "")
+    );
+  }
+  if (s?.status === "reconciled") return `\n  ~ not yet shipped — a reviewer still needs to run change_accept.`;
+  return null;
+}
+
 /**
  * @param {any} s @param {string} tenant
  * @param {{ open?: boolean, quiet?: boolean, commit?: string|null, ref?: string|null, verb?: string, noChanges?: boolean }} [opts]
@@ -2249,11 +2293,8 @@ function reportStatus(s, tenant, { open = true, quiet = false, commit = null, re
       console.log(`  compliance: ${s.compliance.verdict}${s.compliance.detail ? ` — ${s.compliance.detail}` : ""}`);
       for (const c of s.compliance.checks ?? []) reportComplianceCheck(c);
     }
-    if (s.shipped) {
-      console.log(`\n  ✓ shipped — change ${s.shipped.changeId} accepted at ${s.shipped.shippedAt}`);
-    } else if (s.status === "reconciled") {
-      console.log(`\n  ~ not yet shipped — a reviewer still needs to run change_accept.`);
-    }
+    const shipLine = formatShipLine(s);
+    if (shipLine) console.log(shipLine);
     for (const line of formatShareableUrlBlock(s, tenant)) console.log(line);
   }
   if (s.previewUrl && open && s.status === "reconciled" && openBrowser(s.previewUrl)) {