@tokenoftrust/cli 4.3.0 → 4.4.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "4.3.0",
+  "version": "4.4.1",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/pr.mjs

@@ -36,6 +36,7 @@ import {
 import { createMcpClient } from "../mcp.mjs";
 import { establishSession, AuthUnavailableError } from "../auth.mjs";
 import { fail } from "../errors.mjs";
+import { previewPrUrl } from "../preview-url.mjs";
 import { scopeToTenant } from "../tenant-scope.mjs";
 import { repoNameFromRemote, currentBranch } from "./submit.mjs";
 // `tot pr list` reuses `tot ship --pr`'s operator-secret transport helpers verbatim
@@ -53,7 +54,7 @@ const DEFAULT_STOREFRONT_URL = "https://storefront.tokenoftrust.store";
 const SUBCOMMANDS = ["list", "view", "close"];
 
 /**
- * The storefront-owned, shareable `/preview/<tenant>/pr/<N>` link — NEVER the
+ * The storefront-owned, shareable `/<tenant>/preview/pr/<N>` link — NEVER the
  * forge/Gitea `url` (2026-08-18 incident: a raw forge PR URL reached an
  * owner). `candidate_status` (the local-checkout MCP tool) has no
  * `previewUrl` field at all, unlike the operator `GET /api/changes` path — so
@@ -66,8 +67,7 @@ const SUBCOMMANDS = ["list", "view", "close"];
  */
 export function buildPreviewUrl(storefrontUrl, tenant, prNumber) {
   if (typeof prNumber !== "number" || !tenant) return null;
-  const base = (storefrontUrl || DEFAULT_STOREFRONT_URL).trim().replace(/\/+$/, "");
-  return `${base}/preview/${tenant}/pr/${prNumber}`;
+  return previewPrUrl(storefrontUrl || DEFAULT_STOREFRONT_URL, tenant, prNumber);
 }
 
 const USAGE = `tot pr — see and manage candidate PRs

package/src/commands/preview-build.mjs

@@ -30,6 +30,7 @@
  */
 import { execFileSync } from "node:child_process";
 import { planForAction, printPlanAndConfirm } from "../plan.mjs";
+import { previewPrUrl } from "../preview-url.mjs";
 
 const DEFAULT_STOREFRONT_URL = "https://storefront.tokenoftrust.store";
 
@@ -147,7 +148,7 @@ export async function run(argv, ctx) {
     return 2;
   }
 
-  const previewUrl = pr != null ? `${base}/preview/${encodeURIComponent(tenant)}/pr/${pr}` : null;
+  const previewUrl = pr != null ? previewPrUrl(base, tenant, pr) : null;
 
   // Self-declaring: state the EXACT plan before acting (the shared plan module).
   const planLines = planForAction({

package/src/commands/rollback.mjs

@@ -39,6 +39,7 @@ import { fail } from "../errors.mjs";
 import { scopeToTenant } from "../tenant-scope.mjs";
 import { isInteractive, promptYesNo } from "../prompt.mjs";
 import { startProgress } from "../progress.mjs";
+import { previewRevUrl } from "../preview-url.mjs";
 import { resolveViewerTransport } from "../viewer-session.mjs";
 
 const DEFAULT_MCP_URL = "https://mcp.tokenoftrust.com";
@@ -145,7 +146,7 @@ export function normalizeRollbackResult(r) {
 // ─── Revision links (pure) ───────────────────────────────────────────────
 
 /**
- * The immutable `/preview/<tenant>/rev/<sha>/` deep-link for a promoted
+ * The immutable `/<tenant>/preview/rev/<sha>/` deep-link for a promoted
  * `versionId` — this route, and per `gitea-only-tenant-content-authority` the
  * `versionId` recorded by a promote IS the tenant Gitea sha, so no extra lookup
  * is needed to build it. `null` when there's no `base` (storefront origin) or no
@@ -158,7 +159,7 @@ export function normalizeRollbackResult(r) {
  */
 export function revisionUrl(base, tenant, versionId) {
   if (!base || !versionId) return null;
-  return `${String(base).replace(/\/+$/, "")}/preview/${encodeURIComponent(tenant)}/rev/${encodeURIComponent(versionId)}/`;
+  return previewRevUrl(base, tenant, versionId);
 }
 
 // ─── Candidate selection + rendering (pure) ──────────────────────────────────────

package/src/commands/submit.mjs

@@ -57,6 +57,7 @@ import { startProgress } from "../progress.mjs";
 import { CliError, fail } from "../errors.mjs";
 import { isBrokerUnavailable, waitOutBrokerOutage } from "../broker-outage.mjs";
 import { emitActivity } from "../activity.mjs";
+import { previewPrUrl } from "../preview-url.mjs";
 import {
   diagnosticReference,
   invocationDegradedResult,
@@ -2096,7 +2097,7 @@ function reportComplianceCheck(c) {
  * formatShareableUrlBlock's job, above — the two are deliberately redundant:
  * this one is available immediately but "building", that one is authoritative
  * once reconcile actually lands). Same route shape as the server-minted one
- * (`/preview/<tenant>/pr/<N>`) by construction — see
+ * (`/<tenant>/preview/pr/<N>`) by construction — see
  * docs/architecture/preview-candidate-workflow.md — so the link doesn't change
  * out from under the reviewer once the build completes; it just starts
  * resolving.
@@ -2108,7 +2109,7 @@ function reportComplianceCheck(c) {
  * @returns {string}
  */
 export function shareablePrUrl(base, tenant, prNumber) {
-  return `${String(base).replace(/\/+$/, "")}/preview/${tenant}/pr/${prNumber}`;
+  return previewPrUrl(base, tenant, prNumber) ?? "";
 }
 
 /**

package/src/preview-url.mjs

@@ -0,0 +1,54 @@
+/**
+ * The one builder of preview URLs. A store's preview lives under the store, never under a
+ * `/preview/<store>` prefix:
+ *
+ *   <origin>/<store>/preview             the store's current shared preview
+ *   <origin>/<store>/preview/pr/<n>      candidate PR n
+ *   <origin>/<store>/preview/rev/<sha>/  an immutable revision
+ *
+ * Every producer (Worker, CLI) calls these; `apps/storefront/src/pages/preview/preview-url-routes.test.ts`
+ * resolves each shape against the page route table. `packages/cli/src/preview-url.mjs` is a
+ * byte-identical copy (a CLI test pins it).
+ */
+
+/** The canonical shapes, for messages that name the right URL. */
+export const PREVIEW_URL_SHAPE = "/<store>/preview[/pr/<n>]";
+
+function trimOrigin(origin) {
+  return String(origin).trim().replace(/\/+$/, "");
+}
+
+/** `/<store>/preview` with an optional sub-path (`/pr/5`). */
+export function previewPath(store, subPath = "") {
+  return `/${encodeURIComponent(store)}/preview${subPath}`;
+}
+
+export function previewUrl(origin, store) {
+  return `${trimOrigin(origin)}${previewPath(store)}`;
+}
+
+/** `null` when `prNumber` is not a positive integer. */
+export function previewPrUrl(origin, store, prNumber) {
+  const n = Number(prNumber);
+  if (!Number.isInteger(n) || n < 1) return null;
+  return `${trimOrigin(origin)}${previewPath(store, `/pr/${n}`)}`;
+}
+
+export function previewRevUrl(origin, store, versionId) {
+  return `${trimOrigin(origin)}${previewPath(store, `/rev/${encodeURIComponent(versionId)}/`)}`;
+}
+
+/**
+ * The canonical location for a legacy `/preview/<store>[/pr/<n>[/...]]` request, or `null` when
+ * the path is not that shape. `isStore` decides whether the first segment names a store
+ * (the caller owns what a store id looks like), so `/preview/pr/5`, `/preview/rev/...` and the
+ * other first-segment routes are never read as a store.
+ */
+export function legacyPreviewLocation(pathname, search, isStore) {
+  const m = /^\/preview\/([^/]+)(\/.*)?$/.exec(pathname);
+  if (!m) return null;
+  const store = m[1];
+  if (!/^[A-Za-z0-9.-]+$/.test(store) || !isStore(store)) return null;
+  const rest = (m[2] ?? "").replace(/\/+$/, "");
+  return `/${store}/preview${rest}${search ?? ""}`;
+}