@tokenoftrust/cli 2.4.10 → 2.4.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.4.10",
+  "version": "2.4.11",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/hotfix.mjs

@@ -36,6 +36,7 @@ import { fail } from "../errors.mjs";
 import { planForAction, printPlanAndConfirm } from "../plan.mjs";
 import { startProgress } from "../progress.mjs";
 import { openBrowser } from "../open.mjs";
+import { missingGrantsOf, refusalHint } from "../admission-hint.mjs";
 // Reuse `tot ship`'s operator-secret precedence + live-url derivation verbatim so
 // ship + hotfix speak ONE operator-auth contract.
 import { resolveOperatorSecret, liveUrlFor } from "./ship.mjs";
@@ -245,18 +246,27 @@ export async function runHotfix(
     return 1;
   }
   const planData = await readJsonSafe(planRes);
-  if (!planRes.ok && planData?.ok !== false) {
+  if (planRes.status === 401 || planRes.status === 403) {
+    // The admission rule's own refusal (body shape `{ ok:false, error,
+    // admission:{ missing } }`) — name exactly what's missing instead of a
+    // generic "check the operator secret" when the server named one.
     const msg = planData?.error || `HTTP ${planRes.status}`;
+    const missing = missingGrantsOf(planData);
     console.error(
       fail(
         `the hotfix plan was refused: ${msg}`,
-        planRes.status === 401 || planRes.status === 403
-          ? "check the operator secret and that it's authorised for this tenant"
-          : "check --tenant / --url / --pr, then re-run",
+        missing.length > 0 ? refusalHint(planRes.status, missing) : "check the operator secret and that it's authorised for this tenant",
       ),
     );
     return 1;
   }
+  if (!planRes.ok && planData?.ok !== false) {
+    // A transport-level refusal the endpoint didn't explain in its own shape
+    // (tenant-resolution/network) — surface it honestly.
+    const msg = planData?.error || `HTTP ${planRes.status}`;
+    console.error(fail(`the hotfix plan was refused: ${msg}`, "check --tenant / --url / --pr, then re-run"));
+    return 1;
+  }
   const plan = normalizeHotfixPlan(planData);
   if (!plan.ok) {
     console.error(fail(plan.message, hotfixNextStep(plan.reason)));

package/src/commands/pr.mjs

@@ -41,6 +41,7 @@ import { repoNameFromRemote, currentBranch } from "./submit.mjs";
 // `tot pr list` reuses `tot ship --pr`'s operator-secret transport helpers verbatim
 // (same env precedence, same queue normalisation) so the two speak one wire, not two.
 import { resolveOperatorSecret, normalizeChangesQueue } from "./ship.mjs";
+import { missingGrantsOf, refusalHint } from "../admission-hint.mjs";
 import {
   defaultCandidateStatePath,
   readActiveChangeId,
@@ -280,11 +281,14 @@ export async function runPrListOperator({ tenant, secret, storefrontUrl = null }
   }
   if (!res.ok) {
     const msg = data?.error || `HTTP ${res.status}`;
+    const missing = missingGrantsOf(data);
     console.error(
       fail(
         `the candidate queue refused the request: ${msg}`,
         res.status === 401 || res.status === 403
-          ? "check the operator secret and that it's authorised for this tenant"
+          ? missing.length > 0
+            ? refusalHint(res.status, missing)
+            : "check the operator secret and that it's authorised for this tenant"
           : "check --tenant / --url, then re-run",
       ),
     );

package/src/commands/preview-token.mjs

@@ -14,6 +14,7 @@
  * Treat the token like a password: anyone holding it sees the unpublished site.
  */
 import { resolveViewerTransport } from "../viewer-session.mjs";
+import { missingGrantsOf, refusalHint } from "../admission-hint.mjs";
 
 const MAX_TTL_SECONDS = 24 * 3600;
 
@@ -107,19 +108,19 @@ export async function run(argv, ctx, deps = {}) {
     return 1;
   }
 
+  let data = null;
+  try {
+    data = await res.json();
+  } catch {
+    /* non-JSON error body — this endpoint answers 401/403 as plain text */
+  }
   if (res.status === 401 || res.status === 403) {
     err(
       `✗ your account can't view ${tenant}'s preview.\n\n` +
-        "  → next: ask the store owner for developer access (or check `tot whoami`), then re-run.",
+        `  → next: ${refusalHint(res.status, missingGrantsOf(data))}.`,
     );
     return 1;
   }
-  let data = null;
-  try {
-    data = await res.json();
-  } catch {
-    /* non-JSON error body */
-  }
   if (!res.ok || typeof data?.token !== "string") {
     err(`✗ the store didn't mint a token (HTTP ${res.status}).\n\n  → next: retry shortly; if it persists, report it with \`tot feedback\`.`);
     return 1;