@tokenoftrust/cli 4.4.2 → 4.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "4.4.2",
+  "version": "4.5.0",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/hotfix.mjs

@@ -39,7 +39,7 @@ import { openBrowser } from "../open.mjs";
 import { missingGrantsOf, refusalHint } from "../admission-hint.mjs";
 // Reuse `tot ship`'s operator-secret precedence + live-url derivation verbatim so
 // ship + hotfix speak ONE operator-auth contract.
-import { resolveOperatorSecret, liveUrlFor, normalizeLiveDrift } from "./ship.mjs";
+import { resolveOperatorSecret, normalizeLiveDrift } from "./ship.mjs";
 
 const DEFAULT_STOREFRONT_URL = "https://storefront.tokenoftrust.store";
 
@@ -127,6 +127,7 @@ export function normalizeHotfixPlan(data) {
       bypassedPrs: Array.isArray(o.bypassedPrs) ? o.bypassedPrs : [],
       rollbackTarget: o.rollbackTarget && typeof o.rollbackTarget === "object" ? o.rollbackTarget : null,
       warning: normalizeLiveDrift(o.warning),
+      liveUrl: typeof o.liveUrl === "string" && o.liveUrl ? o.liveUrl : null,
       paywall:
         o.paywall && typeof o.paywall === "object"
           ? { allowed: o.paywall.allowed === true, message: typeof o.paywall.message === "string" ? o.paywall.message : null }
@@ -277,7 +278,7 @@ export async function runHotfix(
 
   // 2. Print the EXACT plan — including the unshipped preview work it BYPASSES —
   //    then require ONE explicit confirm (default NO).
-  const liveUrl = liveUrlFor(tenant);
+  const liveUrl = plan.liveUrl;
   const planLines = planForAction({
     action: "hotfix",
     tenant,

package/src/commands/ship.mjs

@@ -223,14 +223,6 @@ export async function pollChangeShipped(scoped, { id }, { attempts = 6, delayMs
   return last;
 }
 
-// ─── URL derivation (pure) ─────────────────────────────────────────────────────
-
-/** The live site URL for a tenant (the tenant IS its apex domain, e.g. tokenoftrust.com). Pure. */
-export function liveUrlFor(tenant) {
-  const t = (tenant || "").trim();
-  return t ? `https://${t}` : null;
-}
-
 // ─── Response normalisation (defensive — one endpoint, but shapes may vary) ─────
 
 /**
@@ -242,7 +234,8 @@ export function liveUrlFor(tenant) {
  *   includedPrs:Array<{prNumber?:number|null,changeId?:string|null,headSha?:string|null}>,
  *   integrationRunId:string|null, receiptId:string|null,
  *   rollbackTarget:{receiptId:string,aggregateSha:string,artifactDigest?:string}|null,
- *   paywall:{allowed:boolean,message:string|null}, alreadyShipped:boolean} |
+ *   paywall:{allowed:boolean,message:string|null}, alreadyShipped:boolean,
+ *   provedAt:string|null, liveUrl:string|null} |
  *   {ok:false, reason:string, message:string}}
  */
 /** The plan CDN drift warning, or null when the ledger and the CDN name the same release. */
@@ -283,6 +276,8 @@ export function normalizeShipPlan(data) {
             }
           : { allowed: true, message: null },
       alreadyShipped: o.alreadyShipped === true,
+      provedAt: typeof o.provedAt === "string" && o.provedAt ? o.provedAt : null,
+      liveUrl: typeof o.liveUrl === "string" && o.liveUrl ? o.liveUrl : null,
     };
   }
   return {
@@ -553,9 +548,22 @@ export async function runShip(
     return 1;
   }
 
+  // The pinned release is already what live serves and nothing else is pending: there is nothing
+  // to confirm or POST. A CDN-drift warning means live is not what the ledger says, so that
+  // still goes through the plan.
+  if (plan.ok && plan.alreadyShipped && !plan.warning && !spaces.ready.length) {
+    const detail = [
+      plan.receiptId ? `receipt ${plan.receiptId}` : null,
+      plan.provedAt ? `proved ${plan.provedAt}` : null,
+    ].filter(Boolean).join(", ");
+    console.log(`  Already live: ${plan.pinnedSha}${detail ? ` (${detail})` : ""} — nothing to ship`);
+    return 0;
+  }
+
   // 2. Print the EXACT plan via the shared affordance, then require ONE
   //    explicit confirm (`--yes` non-interactive; a non-TTY without it refuses).
-  const liveUrl = liveUrlFor(tenant);
+  // The live URL is the server's served truth; the client derives none.
+  const liveUrl = plan.ok ? plan.liveUrl : null;
   const planLines = plan.ok
     ? planForAction({
       action: "ship",