@tokenoftrust/cli 3.11.0 → 3.12.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "3.11.0",
+  "version": "3.12.0",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/go-live.mjs

@@ -242,12 +242,13 @@ export async function pollRunTerminal(http, { attempts = 8, delayMs = 2000, slee
  * live DNS.
  *
  * @param {{ get:(path:string)=>Promise<any>, post:(path:string,body:any)=>Promise<any> }} http
- * @param {{ appDomain:string, action:"connect"|"rollback", rehearsal:boolean, noOpen?:boolean }} params
+ * @param {{ appDomain:string, action:"connect"|"rollback", rehearsal:boolean, noOpen?:boolean,
+ *   dnsSetup?: { domainConnectDeclared?: boolean, ciRoleCanChangeZone?: boolean, nameserversAtRegistrar?: boolean } }} params
  * @param {{ interactive?:()=>boolean, confirm?:(q:string,d:boolean)=>Promise<boolean>,
  *   poll?:typeof pollRunTerminal, openUrl?:(u:string)=>boolean, progress?:boolean }} [deps]
  * @returns {Promise<number>} process exit code
  */
-export async function runGoLive(http, { appDomain, action, rehearsal, noOpen }, deps = {}) {
+export async function runGoLive(http, { appDomain, action, rehearsal, noOpen, dnsSetup }, deps = {}) {
   const interactive = deps.interactive || isInteractive;
   const confirm = deps.confirm || promptYesNo;
   const poll = deps.poll || pollRunTerminal;
@@ -340,17 +341,80 @@ export async function runGoLive(http, { appDomain, action, rehearsal, noOpen },
   } finally {
     progress?.stop();
   }
-  return reportGoLive({ status, dispatch, action, rehearsal, domain, noOpen, openUrl: deps.openUrl });
+  return reportGoLive({
+    status, dispatch, action, rehearsal, domain, noOpen, openUrl: deps.openUrl, dnsSetup,
+  });
+}
+
+/**
+ * Which Connect apex setup a rehearsal measured. Pure — no DNS lookup.
+ * Writable only when `domainConnect` is declared, CI's role can change that
+ * Route53 zone, and the public nameservers are not still the registrar's.
+ * A registrar-held zone is not writable until the merchant delegates NS.
+ * There is no registrar API. `null` when this command was not given a measurement.
+ * @param {{ domainConnectDeclared?: boolean, ciRoleCanChangeZone?: boolean, nameserversAtRegistrar?: boolean } | null | undefined} measured
+ * @returns {{ id: "no-domain-connect"|"registrar-held"|"platform-route53-zone", writable: boolean, detail: string } | null}
+ */
+export function connectApexDnsSetup(measured) {
+  if (!measured || typeof measured !== "object") return null;
+  const declared = measured.domainConnectDeclared === true;
+  const roleCanWrite = measured.ciRoleCanChangeZone === true;
+  const registrarHeld = measured.nameserversAtRegistrar === true;
+  if (!declared) {
+    return {
+      id: "no-domain-connect",
+      writable: false,
+      detail:
+        "Connect apex cannot write this zone. CI refuses a tenant whose www-distributions entry declares no domainConnect. No registrar API.",
+    };
+  }
+  if (registrarHeld) {
+    return {
+      id: "registrar-held",
+      writable: false,
+      detail:
+        "Connect apex cannot write this zone while nameservers are still the registrar's. The merchant's first step is to delegate NS at the registrar to the declared platform zone. Lead time is the registry NS TTL, 172800 seconds (48 hours), not the ~60 second in-zone ALIAS change. No registrar API.",
+    };
+  }
+  if (!roleCanWrite) {
+    return {
+      id: "platform-route53-zone",
+      writable: false,
+      detail:
+        "domainConnect is declared, but CI's role cannot change that Route53 zone, so Connect apex cannot write it. No registrar API.",
+    };
+  }
+  return {
+    id: "platform-route53-zone",
+    writable: true,
+    detail:
+      "Connect apex can write this zone: domainConnect is declared and CI's role can change that Route53 zone. Records upserted: apex and www A and AAAA ALIAS only. Mail and every other name stay. In-zone propagation is about 60 seconds.",
+  };
+}
+
+/** Lines a successful rehearsal prints so the operator can see which setup applies. */
+function rehearsalSetupLines(dnsSetup) {
+  const measured = connectApexDnsSetup(dnsSetup);
+  if (measured) {
+    return [`  This rehearsal measured setup: ${measured.id}. ${measured.detail}`, "  DNS was not changed."];
+  }
+  return [
+    "  This rehearsal did not measure a per-tenant setup. Which setup applies:",
+    "  platform-route53-zone — writable only when the tenant declares domainConnect and CI's role can change that Route53 zone. Records upserted: apex and www A and AAAA ALIAS only.",
+    "  registrar-held — not writable while nameservers are still the registrar's. The merchant delegates NS at the registrar to the declared platform zone first. Lead time is the registry NS TTL, 172800 seconds (48 hours), not the ~60 second in-zone ALIAS change. No registrar API.",
+    "  no-domain-connect — CI refuses the tenant. Connect apex cannot write a zone.",
+  ];
 }
 
 /** Report the go-live outcome honestly + always surface the one-line revert. */
-function reportGoLive({ status, dispatch, action, rehearsal, domain, noOpen, openUrl }) {
+export function reportGoLive({ status, dispatch, action, rehearsal, domain, noOpen, openUrl, dnsSetup }) {
   const runUrl = status?.runUrl || null;
   const revertHint = "  Revert (one line): tot go-live --rollback";
 
   if (status?.status === "succeeded") {
     if (rehearsal) {
       console.log(`\n  ✓ rehearsal succeeded for ${domain} — DNS state unchanged (dry run).`);
+      for (const line of rehearsalSetupLines(dnsSetup)) console.log(line);
     } else if (action === "rollback") {
       console.log(`\n  ✓ rolled the apex DNS back for ${domain} to the captured prior records.`);
     } else {