@tokenoftrust/cli 3.9.0 → 3.10.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "3.9.0",
+  "version": "3.10.0",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/rollback.mjs

@@ -39,6 +39,7 @@ import { fail } from "../errors.mjs";
 import { scopeToTenant } from "../tenant-scope.mjs";
 import { isInteractive, promptYesNo } from "../prompt.mjs";
 import { startProgress } from "../progress.mjs";
+import { resolveViewerTransport } from "../viewer-session.mjs";
 
 const DEFAULT_MCP_URL = "https://mcp.tokenoftrust.com";
 
@@ -179,19 +180,56 @@ export function rollbackCandidates(history, currentVersionId) {
     .reverse();
 }
 
+/**
+ * Ledger/CDN mismatch shown before a rollback, or null when they match.
+ * Null shows neither the warning nor a corrected target.
+ * @typedef {{ reason: string, live: string|null, served: string|null, correctedTarget: string } | null} RollbackLiveDrift
+ */
+
+/** Lines naming a ledger/CDN mismatch. Empty when there is none.
+ * @param {RollbackLiveDrift} liveDrift
+ * @returns {string[]}
+ */
+export function liveDriftLines(liveDrift) {
+  if (!liveDrift?.reason || !liveDrift?.correctedTarget) return [];
+  return [
+    `    ⚠ ${liveDrift.reason}: ledger live is ${liveDrift.live ?? "nothing"}; the CDN serves ${liveDrift.served ?? "an unknown revision"}.`,
+    `    corrected rollback target: ${liveDrift.correctedTarget}`,
+  ];
+}
+
+/**
+ * The ship plan's CDN drift warning, or null. A missing or matching plan is null —
+ * the list then shows neither the warning nor a corrected target.
+ * @param {any} body
+ * @returns {RollbackLiveDrift}
+ */
+export function liveDriftFromShipPlan(body) {
+  const warning = body?.warning;
+  const corrected = warning?.correctedRollbackTarget?.aggregateSha;
+  if (!warning || typeof warning.reason !== "string" || typeof corrected !== "string") return null;
+  return {
+    reason: warning.reason,
+    live: typeof warning.live === "string" ? warning.live : null,
+    served: typeof warning.served === "string" ? warning.served : null,
+    correctedTarget: corrected,
+  };
+}
+
 /** Render the `tot rollback` (no args) history listing — the rollback-target
  *  picker, each entry annotated with its immutable `/rev/<sha>` link
  *  when a storefront origin is available. Pure — unit-tested.
  * @param {{ tenant:string, target:string, current:any,
- *   candidates:any[], revisionBase?:string|null }} input
+ *   candidates:any[], revisionBase?:string|null, liveDrift?: RollbackLiveDrift }} input
  * @returns {string[]}
  */
-export function renderHistory({ tenant, target, current, candidates, revisionBase }) {
+export function renderHistory({ tenant, target, current, candidates, revisionBase, liveDrift = null }) {
   const lines = ["", `  Promotion history for ${tenant} on "${target}":`];
   if (current) {
     const link = revisionUrl(revisionBase, tenant, current.versionId);
     lines.push(`    live now: ${current.versionId} (pinned tree ${current.digest})${link ? `  ${link}` : ""}`);
   }
+  lines.push(...liveDriftLines(liveDrift));
   if (!candidates.length) {
     lines.push("    (no prior version recorded yet — nothing to roll back to)");
     return lines;
@@ -207,11 +245,12 @@ export function renderHistory({ tenant, target, current, candidates, revisionBas
 
 /** Render the "what goes live" block for a rollback preview. Pure — unit-tested.
  * @param {{ tenant:string, target:string, toVersionId:string,
- *   preview:ReturnType<typeof normalizeRollbackPreview> }} input
+ *   preview:ReturnType<typeof normalizeRollbackPreview>, liveDrift?: RollbackLiveDrift }} input
  * @returns {string[]}
  */
-export function renderRollbackPreview({ tenant, target, toVersionId, preview }) {
+export function renderRollbackPreview({ tenant, target, toVersionId, preview, liveDrift = null }) {
   const lines = ["", `  This rollback will change the LIVE site for ${tenant}:`];
+  lines.push(...liveDriftLines(liveDrift));
   const current = /** @type {any} */ (preview.pointer?.current);
   if (current) lines.push(`    ${target}: ${current.versionId} → ${toVersionId}`);
   else lines.push(`    ${target}: → ${toVersionId}`);
@@ -231,12 +270,21 @@ export function renderRollbackPreview({ tenant, target, toVersionId, preview })
  *   the listing's `/rev/<sha>` links resolve against; omit to list
  *   without links.
  * @param {{ interactive?:()=>boolean, confirm?:(q:string,d:boolean)=>Promise<boolean>,
- *   progress?:boolean }} [deps]
+ *   progress?:boolean, readLiveDrift?:()=>Promise<ReturnType<typeof liveDriftFromShipPlan>> }} [deps]
  * @returns {Promise<number>} process exit code
  */
 export async function runRollback(scoped, { tenant, target, toVersionId, revisionBase }, deps = {}) {
   const interactive = deps.interactive || isInteractive;
   const confirm = deps.confirm || promptYesNo;
+  /** @type {RollbackLiveDrift} */
+  let liveDrift = null;
+  if (deps.readLiveDrift) {
+    try {
+      liveDrift = await deps.readLiveDrift();
+    } catch {
+      liveDrift = null;
+    }
+  }
 
   // 0. No target given — list promotion history as the set of rollback targets.
   if (!toVersionId) {
@@ -262,7 +310,7 @@ export async function runRollback(scoped, { tenant, target, toVersionId, revisio
       return 1;
     }
     const candidates = rollbackCandidates(status.history, /** @type {any} */ (status).current?.versionId ?? null);
-    for (const line of renderHistory({ tenant, target, current: status.current, candidates, revisionBase })) {
+    for (const line of renderHistory({ tenant, target, current: status.current, candidates, revisionBase, liveDrift })) {
       console.log(line);
     }
     return 0;
@@ -297,7 +345,7 @@ export async function runRollback(scoped, { tenant, target, toVersionId, revisio
   }
 
   // 2. ALWAYS render what would change, then require ONE explicit y/N confirm.
-  for (const line of renderRollbackPreview({ tenant, target, toVersionId, preview })) console.log(line);
+  for (const line of renderRollbackPreview({ tenant, target, toVersionId, preview, liveDrift })) console.log(line);
 
   // NON-TTY: refuse rather than auto-confirm — nothing rolls back without a human yes.
   if (!interactive()) {
@@ -354,6 +402,21 @@ function reportRolledBack(result, { tenant, target, toVersionId }) {
   return 0;
 }
 
+/**
+ * Best-effort read of the ship plan's CDN drift. A refusal, a network fault, or a
+ * matching ledger returns null — the list still renders, and it shows neither a
+ * warning nor a corrected target.
+ * @param {{ tenant: string, env: NodeJS.ProcessEnv, fetchImpl?: typeof fetch }} args
+ */
+async function readShipPlanDrift({ tenant, env, fetchImpl = globalThis.fetch }) {
+  const storefrontUrl = env.TOT_STOREFRONT_URL || env.STOREFRONT_BASE_URL || null;
+  const viewer = await resolveViewerTransport({ tenant, env, fetchImpl, storefrontUrl });
+  if (!viewer.ok) return null;
+  const res = await fetchImpl(`${viewer.base}/api/changes/ship`, { method: "GET", headers: viewer.authHeaders });
+  if (!res.ok) return null;
+  return liveDriftFromShipPlan(await res.json());
+}
+
 /**
  * @param {string[]} argv
  * @param {any} ctx
@@ -386,7 +449,9 @@ export async function run(argv, ctx) {
     await establishSession(client, { env, prefer: args.identity || undefined });
     const scoped = await scopeToTenant(client, tenant);
 
-    return await runRollback(scoped, { tenant, target, toVersionId: args.versionId, revisionBase });
+    return await runRollback(scoped, { tenant, target, toVersionId: args.versionId, revisionBase }, {
+      readLiveDrift: () => readShipPlanDrift({ tenant, env }),
+    });
   } catch (e) {
     if (e instanceof AuthUnavailableError) {
       console.error(fail("sign in to roll back", e.hint || "run `tot login`, then re-run `tot rollback`"));

package/src/commands/ship.mjs

@@ -245,6 +245,23 @@ export function liveUrlFor(tenant) {
  *   paywall:{allowed:boolean,message:string|null}, alreadyShipped:boolean} |
  *   {ok:false, reason:string, message:string}}
  */
+/** The ship-plan CDN drift warning, or null when the ledger and the CDN name the same release. */
+function normalizeLiveDrift(warning) {
+  if (!warning || typeof warning !== "object" || typeof warning.reason !== "string") return null;
+  const target = warning.correctedRollbackTarget;
+  if (!target || typeof target !== "object" || typeof target.aggregateSha !== "string") return null;
+  return {
+    reason: warning.reason,
+    live: typeof warning.live === "string" ? warning.live : null,
+    served: typeof warning.served === "string" ? warning.served : null,
+    correctedRollbackTarget: {
+      receiptId: typeof target.receiptId === "string" ? target.receiptId : "",
+      aggregateSha: target.aggregateSha,
+      artifactDigest: typeof target.artifactDigest === "string" ? target.artifactDigest : "",
+    },
+  };
+}
+
 export function normalizeShipPlan(data) {
   const o = data && typeof data === "object" ? data : {};
   if (o.ok === true) {
@@ -257,6 +274,7 @@ export function normalizeShipPlan(data) {
       integrationRunId: typeof o.integrationRunId === "string" ? o.integrationRunId : null,
       receiptId: typeof o.receiptId === "string" ? o.receiptId : null,
       rollbackTarget: o.rollbackTarget && typeof o.rollbackTarget === "object" ? o.rollbackTarget : null,
+      warning: normalizeLiveDrift(o.warning),
       paywall:
         o.paywall && typeof o.paywall === "object"
           ? {
@@ -546,6 +564,7 @@ export async function runShip(
       artifactDigest: plan.artifactDigest,
       includedPrs: plan.includedPrs,
       rollbackTarget: plan.rollbackTarget,
+      liveDrift: plan.warning,
       paywall: plan.paywall,
       targets: { live: liveUrl },
     })

package/src/plan.mjs

@@ -59,6 +59,7 @@ function targetLabel({ pr, changeId }) {
  *   artifactDigest?: string|null,
  *   includedPrs?: Array<{ prNumber?: number|null, changeId?: string|null, headSha?: string|null }>|null,
  *   rollbackTarget?: { receiptId: string, aggregateSha: string } | null,
+ *   liveDrift?: { reason: string, live?: string|null, served?: string|null } | null,
  *   paywall?: { allowed: boolean, message?: string|null } | null,
  *   refs?: Array<{ ref: string, sha?: string|null, reason?: string|null }>|null,
  *   bypassedPrs?: Array<{ prNumber?: number|null, changeId?: string|null, headSha?: string|null }>|null,
@@ -80,6 +81,7 @@ export function planForAction({
   artifactDigest = null,
   includedPrs = null,
   rollbackTarget = null,
+  liveDrift = null,
   paywall = null,
   refs = null,
   bypassedPrs = null,
@@ -135,9 +137,14 @@ export function planForAction({
           lines.push(`    - ${prLabel}${shortSha}`);
         }
       }
+      if (liveDrift?.reason) {
+        lines.push(
+          `  ⚠ ${liveDrift.reason}: the CDN serves ${liveDrift.served ?? "an unknown revision"}, not the ledger's live ${liveDrift.live ?? "nothing"}.`,
+        );
+      }
       lines.push(
         rollbackTarget
-          ? `  rollback to: ${rollbackTarget.aggregateSha} (receipt ${rollbackTarget.receiptId})`
+          ? `  rollback to: ${rollbackTarget.aggregateSha} (receipt ${rollbackTarget.receiptId})${liveDrift?.reason ? " — corrected target" : ""}`
           : "  rollback to: (none — first-ever ship)",
       );
       if (paywall && paywall.allowed === false) {