@tokenoftrust/cli 5.0.1 → 6.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "5.0.1",
+  "version": "6.0.1",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/go-live.mjs

@@ -10,6 +10,8 @@
  *   tot go-live               show apex readiness, then (if ready) connect the apex
  *   tot go-live --rehearsal   dispatch a DRY-RUN cutover (never moves DNS state)
  *   tot go-live --rollback    restore the captured prior DNS records (the one-line revert)
+ *   tot go-live --acknowledge-uncaptured-images
+ *                             acknowledge the live bundle's uncaptured images, then continue
  *
  * The contract, deliberately strict — this is the apex DNS cutover of the live
  * site (mirrors `tot ship` / `tot rollback`):
@@ -49,6 +51,10 @@ const USAGE = `tot go-live — cut the apex domain over to the storefront
   tot go-live --url <origin>  storefront origin (default: env TOT_STOREFRONT_URL / ${DEFAULT_STOREFRONT_ORIGIN})
   tot go-live --owner <domain> owner/appDomain to act on (default: env TOT_STOREFRONT_OWNER / checkout tenant)
   tot go-live --no-open       don't open the store in your browser afterward
+  tot go-live --acknowledge-uncaptured-images
+                              acknowledge the live bundle's uncaptured images and continue.
+                              They keep loading from your source store's URLs and break
+                              when that store closes. Asks for its own y/N confirmation.
 
   go-live drives the SAME apex cutover the admin Domain button does, gated by the
   same server readiness gate. It ALWAYS shows you the readiness itemization and
@@ -69,6 +75,7 @@ export function parseGoLiveArgs(argv) {
     owner: null,
     identity: null,
     noOpen: false,
+    acknowledgeImages: false,
     help: false,
   };
   for (let i = 0; i < argv.length; i++) {
@@ -80,6 +87,7 @@ export function parseGoLiveArgs(argv) {
     else if (t === "--owner") a.owner = argv[++i];
     else if (t === "--identity") a.identity = argv[++i];
     else if (t === "--no-open") a.noOpen = true;
+    else if (t === "--acknowledge-uncaptured-images") a.acknowledgeImages = true;
     else if (t === "--help" || t === "-h") a.help = true;
     else if (t === "rollback") a.action = "rollback";
     else if (t === "connect") a.action = "connect";
@@ -108,6 +116,7 @@ export function normalizeReadiness(r) {
           label: typeof c.label === "string" ? c.label : c.id || "?",
           ok: c.ok === true,
           detail: typeof c.detail === "string" ? c.detail : "",
+          remedy: typeof c.remedy === "string" ? c.remedy : "",
         }))
     : [];
   return {
@@ -123,10 +132,30 @@ export function normalizeReadiness(r) {
       : checks.filter((c) => !c.ok).map((c) => c.detail),
     appDomain: typeof o.appDomain === "string" ? o.appDomain : null,
     imageTypes: normalizeImageTypes(o.imageTypes),
+    imageAcknowledgement: normalizeImageAcknowledgementScope(rd.imageAcknowledgement),
     domainState: rd && o.domain && typeof o.domain === "object" ? o.domain : null,
   };
 }
 
+/**
+ * The live bundle's uncaptured images an owner can acknowledge (`readiness.imageAcknowledgement`), or
+ * null when the server reports none. Pure.
+ * @param {any} raw
+ * @returns {{ digest: string, uncaptured: number, acknowledged: boolean } | null}
+ */
+export function normalizeImageAcknowledgementScope(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  if (typeof raw.digest !== "string" || !Number.isInteger(raw.uncaptured) || raw.uncaptured < 1) return null;
+  return { digest: raw.digest, uncaptured: raw.uncaptured, acknowledged: !!raw.acknowledged };
+}
+
+/** What `--acknowledge-uncaptured-images` tells the owner before asking. */
+export const UNCAPTURED_IMAGES_WARNING = [
+  "  These images were not captured into the platform's image store. If you continue, they keep",
+  "  loading from your source store's URLs, and they break when that store closes. Keep the source",
+  "  store running, or replace each image and publish again.",
+];
+
 /**
  * Normalise a `POST /api/domain/dispatch` response to { dispatched, runId, error }.
  * `dispatched` is true only when the server confirms it fired the CI dispatch. Pure.
@@ -269,6 +298,7 @@ export async function pollRunTerminal(http, { attempts = 8, delayMs = 2000, slee
  *
  * @param {{ get:(path:string)=>Promise<any>, post:(path:string,body:any)=>Promise<any> }} http
  * @param {{ appDomain:string, action:"connect"|"rollback", rehearsal:boolean, noOpen?:boolean,
+ *   acknowledgeImages?:boolean,
  *   dnsSetup?: { domainConnectDeclared?: boolean, ciRoleCanChangeZone?: boolean, nameserversAtRegistrar?: boolean } }} params
  * @param {{ interactive?:()=>boolean, confirm?:(q:string,d:boolean)=>Promise<boolean>,
  *   poll?:typeof pollRunTerminal, openUrl?:(u:string)=>boolean, progress?:boolean,
@@ -276,7 +306,7 @@ export async function pollRunTerminal(http, { attempts = 8, delayMs = 2000, slee
  *   `base`/`identity` only name where and as whom a failed readiness read was made.
  * @returns {Promise<number>} process exit code
  */
-export async function runGoLive(http, { appDomain, action, rehearsal, noOpen, dnsSetup }, deps = {}) {
+export async function runGoLive(http, { appDomain, action, rehearsal, noOpen, dnsSetup, acknowledgeImages }, deps = {}) {
   const interactive = deps.interactive || isInteractive;
   const confirm = deps.confirm || promptYesNo;
   const poll = deps.poll || pollRunTerminal;
@@ -293,6 +323,37 @@ export async function runGoLive(http, { appDomain, action, rehearsal, noOpen, dn
   const domain = appDomain || readiness.appDomain;
   for (const line of renderReadiness({ appDomain: domain, readiness, action })) console.log(line);
 
+  // The owner may acknowledge the live bundle's uncaptured images: the server records exactly the
+  // scope it reported, and the census keeps the true count.
+  const scope = readiness.imageAcknowledgement;
+  if (acknowledgeImages && action === "connect") {
+    if (!scope || scope.acknowledged) {
+      console.log("  No unacknowledged uncaptured images on the live bundle.");
+    } else {
+      if (!interactive()) {
+        console.error(fail("acknowledging uncaptured images needs an interactive terminal", "run it from a terminal (there is intentionally no --yes)"));
+        return 2;
+      }
+      for (const line of ["", ...UNCAPTURED_IMAGES_WARNING]) console.log(line);
+      const ok = await confirm(`\n  Acknowledge ${scope.uncaptured} uncaptured image reference(s) on ${domain} and continue?`, false);
+      if (!ok) {
+        console.log("  Cancelled — nothing changed.");
+        return 0;
+      }
+      try {
+        await http.post("/api/domain/readiness", { digest: scope.digest, uncaptured: scope.uncaptured });
+        readiness = normalizeReadiness(await http.get("/api/domain/readiness"));
+      } catch (e) {
+        console.error(fail(`the acknowledgement was refused: ${String(e?.message || e)}`, "re-run `tot go-live` to see the current image census, then acknowledge again"));
+        return 1;
+      }
+      console.log(`  Acknowledged ${scope.uncaptured} uncaptured image reference(s).`);
+      for (const line of renderReadiness({ appDomain: domain, readiness, action })) console.log(line);
+    }
+  } else if (action === "connect" && scope && !scope.acknowledged) {
+    console.log("  To continue with these images as they are: tot go-live --acknowledge-uncaptured-images");
+  }
+
   // A store that does not declare Connect apex has nothing to rehearse, confirm,
   // or dispatch. Image rows above are the whole checklist. DNS stays with the zone holder.
   if (readiness.domainConnect !== true) {
@@ -661,7 +722,7 @@ export async function run(argv, ctx) {
   const http = createStorefrontHttp(transport.base, { token: transport.token, owner, headers: transport.headers });
   return await runGoLive(
     http,
-    { appDomain: owner, action: /** @type {any} */ (args.action), rehearsal: args.rehearsal, noOpen: args.noOpen },
+    { appDomain: owner, action: /** @type {any} */ (args.action), rehearsal: args.rehearsal, noOpen: args.noOpen, acknowledgeImages: args.acknowledgeImages },
     { openUrl: (u) => openBrowser(u), base: transport.base, identity: transport.identity },
   );
 }

package/src/commands/ship.mjs

@@ -309,6 +309,12 @@ export function normalizeShipResult(data) {
   };
 }
 
+/** What accepting uncaptured images means, shown before and after the acceptance. */
+export const UNCAPTURED_IMAGES_LINES = [
+  "  These images were not captured into the platform's image store. They keep loading from your",
+  "  source store's URLs, and they break when that store closes.",
+];
+
 /** A clear next step per plan/ship refusal reason. Pure. */
 export function refusalNextStep(reason) {
   switch (reason) {
@@ -324,6 +330,8 @@ export function refusalNextStep(reason) {
       return "upgrade the storefront subscription to enable go-live";
     case "golive_unconfirmed":
       return "re-run `tot ship` and confirm the plan";
+    case "checks_blocked":
+      return 'replace or remove the named images and publish again, or accept them with `tot ship --accept-quality-findings "<reason>"`; accepted images keep loading from your source store\'s URLs and break when that store closes';
     case "compliance_review":
       return 'approve the warnings with `tot ship --accept-quality-findings "<reason>"`, or fix them in `.tot/config.json` and publish again';
     default:
@@ -606,24 +614,41 @@ export async function runShip(
   // The server refuses it unless the current durable problem is quality-only and the reason is
   // substantive. Only after that accountable record exists do we re-dispatch the release.
   if (acceptQualityReason !== null) {
+    const postAccept = (extra = {}) => fetchImpl(`${base}/api/changes/accept-issue`, {
+      method: "POST",
+      headers: { "content-type": "application/json", ...authHeaders },
+      body: JSON.stringify({
+        operation: "publication",
+        reason: acceptQualityReason,
+        ...(plan.ok && plan.artifactDigest ? { revision: plan.artifactDigest } : {}),
+        ...extra,
+      }),
+    });
     let acceptRes;
+    let acceptData;
     try {
-      acceptRes = await fetchImpl(`${base}/api/changes/accept-issue`, {
-        method: "POST",
-        headers: { "content-type": "application/json", ...authHeaders },
-        body: JSON.stringify({
-          operation: "publication",
-          reason: acceptQualityReason,
-          ...(plan.ok && plan.artifactDigest ? { revision: plan.artifactDigest } : {}),
-        }),
-      });
+      acceptRes = await postAccept();
+      acceptData = await readJsonSafe(acceptRes);
+      // Images that could not be captured: confirm the exact count, then accept that count.
+      if (acceptData?.reason === "scope-required" && Number.isInteger(acceptData.unresolvedImageReferences)) {
+        const count = acceptData.unresolvedImageReferences;
+        const scope = await confirmPlan([
+          `  uncaptured images: ${count}${Number.isInteger(acceptData.totalImageReferences) ? ` of ${acceptData.totalImageReferences}` : ""} image reference(s)`,
+          ...UNCAPTURED_IMAGES_LINES,
+        ], { yes, question: `Publish with ${count} uncaptured image reference(s) as they are?` });
+        if (!scope.confirmed) {
+          console.log("  Ship cancelled — nothing changed.");
+          return scope.reason === "non-tty" ? 2 : 0;
+        }
+        acceptRes = await postAccept({ acceptedUnresolvedImageCount: count });
+        acceptData = await readJsonSafe(acceptRes);
+      }
     } catch (e) {
       console.error(
         fail(`couldn't record the quality acceptance at ${base}: ${String(e?.message || e)}`, "check --url / your network, then re-run"),
       );
       return 1;
     }
-    const acceptData = await readJsonSafe(acceptRes);
     if (!acceptRes.ok || acceptData?.ok !== true) {
       console.error(
         fail(
@@ -637,6 +662,9 @@ export async function runShip(
     const count = Array.isArray(accepted.findingIds) ? accepted.findingIds.length : 0;
     const what = accepted.problemCode === "compliance-review" ? "compliance warning(s)" : "quality finding(s)";
     console.log(`  ✓ ${count ? `${count} ` : ""}${what} accepted for this revision; continuing the publish.`);
+    if (Array.isArray(accepted.findingIds) && accepted.findingIds.some((id) => typeof id === "string" && id.startsWith("IMAGE:"))) {
+      for (const line of UNCAPTURED_IMAGES_LINES) console.log(line);
+    }
   }
 
   // Each approved space goes live through its own reviewed transition, under the confirm above.