@taprootio/site-authoring 0.2.0 → 0.4.0

package/src/verbs/redirects-push.js

@@ -0,0 +1,100 @@
+import { replaceSiteRedirectMap, withRefusalGuidance } from "../api.js";
+import { VERB_REDIRECTS_PUSH } from "../constants.js";
+import { SiteAuthoringError } from "../errors.js";
+import {
+  projectRedirectMapForWorkspace,
+  REDIRECT_KIND_GONE,
+  REDIRECTS_FILE_NAME,
+  validateRedirectsDocument,
+} from "../redirects-contract.js";
+import { advanceRedirectsManifest, readRedirectsWorkspaceContext } from "../redirects-workspace.js";
+import { boundedList, openSession, successResult, warnIfExternalWritesPaused } from "../session.js";
+import { ApiError } from "../transport.js";
+import { readWorkspaceJson, WORKSPACE_LIMITS, writeWorkspaceJson } from "../workspace.js";
+
+const MAXIMUM_REPORTED = 200;
+
+/**
+ * `redirects push` — replace the whole map from the workspace file.
+ *
+ * The revision travels with the write. A push whose baseline predates a page
+ * rename is refused as a conflict rather than committing a map that silently
+ * drops the rename's entry, and the guidance says to re-pull and reconcile
+ * rather than to retry.
+ */
+function translateConflict(error) {
+  if (error instanceof ApiError && error.hasField("ExpectedRevision")) {
+    return new SiteAuthoringError(
+      "redirects.concurrent_modification",
+      "The redirect map changed after this workspace read it — most often a page or tag rename recorded its own "
+        + `entry. Run 'taproot-site redirects pull', reconcile ${REDIRECTS_FILE_NAME}, and retry. Nothing was `
+        + "written.",
+      { field: "revision", status: error.status },
+    );
+  }
+  return error;
+}
+
+export async function redirectsPush(invocation) {
+  const session = await openSession(invocation);
+  const { client, config, siteId, onProgress } = session;
+  warnIfExternalWritesPaused(session, VERB_REDIRECTS_PUSH);
+  const context = await readRedirectsWorkspaceContext(config.workspaceDir, siteId);
+  const validated = validateRedirectsDocument(
+    await readWorkspaceJson(config.workspaceDir, REDIRECTS_FILE_NAME, WORKSPACE_LIMITS.redirectsBytes),
+    siteId,
+    // The entry cap is scoped against the map this workspace pulled, the way
+    // the site scopes it against the rows it holds: a site whose accumulated
+    // path history is already over the cap can push its own map back, or a
+    // smaller one, without deleting a live redirect to satisfy a number.
+    { baselineEntries: context.redirects.entries },
+  );
+  onProgress(
+    `Validated ${validated.entries.length} redirect entr${validated.entries.length === 1 ? "y" : "ies"}: `
+      + "path normalization, targets, statuses, duplicates, chains, and loops.",
+  );
+
+  // The manifest baseline wins over the file's own `revision` field. The file
+  // is authored by hand and its revision is a record of a read, not a claim a
+  // caller gets to make; taking it from the manifest keeps a hand-edited value
+  // from widening what a push may overwrite.
+  const expectedRevision = context.redirects.revision;
+
+  let map;
+  try {
+    map = await withRefusalGuidance(
+      onProgress,
+      "redirects push",
+      async () => await replaceSiteRedirectMap(client, siteId, expectedRevision, validated.entries),
+    );
+  } catch (error) {
+    throw translateConflict(error);
+  }
+
+  const document_ = projectRedirectMapForWorkspace(siteId, map);
+  try {
+    // The document lands before its baseline, exactly as `footer push` orders
+    // its two writes: if the manifest write fails, a stale revision refuses the
+    // next push rather than letting it overwrite the map just saved.
+    await writeWorkspaceJson(config.workspaceDir, REDIRECTS_FILE_NAME, document_);
+    await advanceRedirectsManifest(config.workspaceDir, siteId, map);
+  } catch (error) {
+    if (error instanceof SiteAuthoringError) throw error.withCompletedWrites(["redirects"]);
+    throw error;
+  }
+  onProgress("Replaced the site's redirect map and recorded its new revision.");
+
+  const reported = boundedList(document_.entries, MAXIMUM_REPORTED);
+  return successResult(VERB_REDIRECTS_PUSH, siteId, {
+    redirectsFile: REDIRECTS_FILE_NAME,
+    revision: map.revision,
+    redirects: {
+      total: map.entries.length,
+      gone: map.entries.filter((entry) => entry.kind === REDIRECT_KIND_GONE).length,
+      items: reported.items,
+      ...(reported.truncated ? { itemsTruncated: true } : {}),
+    },
+    written: { items: ["redirects"], count: 1 },
+    nextStep: "deploy --staging",
+  });
+}

package/src/verbs/status.js

@@ -6,11 +6,22 @@ import {
   listSiteImages,
   withRefusalGuidance,
 } from "../api.js";
-import { VERB_STATUS } from "../constants.js";
+import {
+  CLI_UPGRADE_COMMAND,
+  CLI_VERSION,
+  EXTERNAL_WRITES_SETTING_KEY,
+  EXTERNAL_WRITES_SETTING_LOCATION,
+  PUBLISH_KEY_ENVIRONMENT_VARIABLE,
+  REFUSAL_CLI_OUTDATED,
+  REFUSAL_PLATFORM_PAUSED,
+  VERB_STATUS,
+} from "../constants.js";
+import { isBehindLatest } from "../cli-release.js";
 import { boundedList, openSession, successResult } from "../session.js";
 
 /**
- * `status` — deployments, publishing readiness, and image processing.
+ * `status` — the platform authoring switch, the CLI release, deployments,
+ * publishing readiness, and image processing.
  *
  * Broken references are deliberately absent. `GetSiteBrokenReferences` is
  * session-only under TR00602's read list, and TR00604 adds no server surface,
@@ -26,8 +37,82 @@ const MAXIMUM_BLOCKERS = 50;
 const BROKEN_REFERENCES_NOTE =
   "GetSiteBrokenReferences is session-only on the shipped contract, so a key-authorized CLI cannot read it.";
 
+const PLATFORM_UNKNOWN_NOTE =
+  "Taproot never reported the platform authoring switch on this run: either no sign-in token exchange happened "
+  + `(${PUBLISH_KEY_ENVIRONMENT_VARIABLE} supplies the site credential directly and skips it), or the Taproot that `
+  + "answered the exchange predates the field.";
+
+const CLI_RELEASE_UNKNOWN_NOTE =
+  "Taproot never named the latest published CLI release on this run: either no sign-in token exchange happened "
+  + `(${PUBLISH_KEY_ENVIRONMENT_VARIABLE} supplies the site credential directly and skips it), or the Taproot that `
+  + "answered the exchange predates the field.";
+
+/**
+ * Which release this CLI is against the latest Taproot named (TR00703).
+ *
+ * The same three-state shape as the platform switch, and reported the same way:
+ * a known answer carries `latestVersion`, an unknown one carries
+ * `latestKnown: false` and the reason. It is named `cliRelease` rather than
+ * `cli` because every result already carries a top-level `cli` naming this
+ * package and its version, and shadowing that would change what a field means
+ * depending on which verb produced it.
+ *
+ * `behind: true` is not reachable through a live exchange, and deliberately not
+ * removed: the exchange that supplies this value refuses an outdated CLI before
+ * it answers, so a run that gets here was accepted. What the branch protects is
+ * the case where those two facts ever come apart — a server that reports a
+ * latest it does not enforce — where reporting `behind: false` would be a
+ * confident lie rather than a missing field.
+ */
+function reportCliRelease(release, onProgress) {
+  const latestVersion = release?.latestVersion;
+  if (latestVersion === undefined) {
+    onProgress(`CLI release: ${CLI_VERSION}. Latest not known on this run. ${CLI_RELEASE_UNKNOWN_NOTE}`);
+    return { version: CLI_VERSION, latestKnown: false, reason: CLI_RELEASE_UNKNOWN_NOTE };
+  }
+  const behind = isBehindLatest(latestVersion);
+  onProgress(
+    behind
+      ? `CLI release: ${CLI_VERSION} is BEHIND the latest published release ${latestVersion}, and Taproot accepts `
+        + `only the latest, so every online verb is refused (refusal=${REFUSAL_CLI_OUTDATED}). Upgrade with: `
+        + CLI_UPGRADE_COMMAND
+      : `CLI release: ${CLI_VERSION}; latest published release ${latestVersion}.`,
+  );
+  return { version: CLI_VERSION, latestVersion, behind };
+}
+
+/**
+ * The rollout switch as `status` reports it (TR00692), on both channels.
+ *
+ * Three states, and the JSON says which it is by shape rather than by a
+ * three-valued boolean: a known state carries `externalWritesEnabled`, and an
+ * unknown one carries `externalWritesKnown: false` and the reason. An
+ * automation reading `platform.externalWritesEnabled === false` is therefore
+ * never reading an absent field as "paused".
+ */
+function reportPlatform(platform, onProgress) {
+  const enabled = platform?.externalWritesEnabled;
+  if (enabled === undefined) {
+    onProgress(`Platform authoring switch: not known on this run. ${PLATFORM_UNKNOWN_NOTE}`);
+    return { externalWritesKnown: false, reason: PLATFORM_UNKNOWN_NOTE };
+  }
+  onProgress(
+    enabled
+      ? "Platform authoring switch: external site authoring writes are enabled."
+      : "Platform authoring switch: external site authoring writes are PAUSED platform-wide, so every write verb "
+        + `is refused (refusal=${REFUSAL_PLATFORM_PAUSED}). A Taproot administrator re-enables the platform `
+        + `setting '${EXTERNAL_WRITES_SETTING_KEY}' (${EXTERNAL_WRITES_SETTING_LOCATION}).`,
+  );
+  return { externalWritesEnabled: enabled };
+}
+
 export async function status(invocation) {
-  const { client, siteId, onProgress } = await openSession(invocation);
+  const { client, siteId, platform, release, onProgress } = await openSession(invocation);
+  // Said first, and before any wire read: an operator running `status` because
+  // writes are being refused should not have to wait on three network calls to
+  // learn that the platform is paused — and this answer needs none of them.
+  const platformReport = reportPlatform(platform, onProgress);
+  const cliReleaseReport = reportCliRelease(release, onProgress);
 
   return await withRefusalGuidance(onProgress, "status check", async () => {
     onProgress("Reading publishing readiness.");
@@ -60,6 +145,8 @@ export async function status(invocation) {
     onProgress(`Broken references are not reported: ${BROKEN_REFERENCES_NOTE}`);
 
     return successResult(VERB_STATUS, siteId, {
+      platform: platformReport,
+      cliRelease: cliReleaseReport,
       readiness: {
         state: readiness.state,
         approvedPageCount: readiness.approvedPageCount,

package/src/verbs/theme-push.js

@@ -13,7 +13,7 @@ import {
   readAppearanceWorkspaceContext,
   requireFooterContentPushed,
 } from "../footer-workspace.js";
-import { boundedList, openSession, successResult } from "../session.js";
+import { boundedList, openSession, successResult, warnIfExternalWritesPaused } from "../session.js";
 import {
   SETTINGS_TYPE_BRAND,
   SETTINGS_TYPE_SITE_HEADER,
@@ -108,7 +108,12 @@ export async function validateThemeWorkspace(workspaceDir, siteId, knownImageIds
 }
 
 export async function themePush(invocation) {
-  const { client, config, siteId, onProgress } = await openSession(invocation);
+  const session = await openSession(invocation);
+  const { client, config, siteId, onProgress } = session;
+  // One advisory line before this verb does any work, and only when the
+  // exchange said the platform is paused. It changes nothing else: the write
+  // still runs and its refusal still classifies as platform_paused (TR00692).
+  warnIfExternalWritesPaused(session, VERB_THEME_PUSH);
   const appearanceContext = await readAppearanceWorkspaceContext(config.workspaceDir, siteId);
   const { publishing, themes, scalarOperations, footerColors } = await validateThemeWorkspace(
     config.workspaceDir,

package/src/verbs/validate.js

@@ -5,7 +5,22 @@ import { NAVIGATION_MAXIMUM_DEPTH, TEMPLATE_TYPE_FREE_FORM } from "../api.js";
 import { freeFormRootPresentation, sharedThemeContextNames } from "../content/free-form-sections.js";
 import { VERB_VALIDATE } from "../constants.js";
 import { isCanonicalUuid, SiteAuthoringError } from "../errors.js";
+import {
+  FIXTURE_CONTRACT_VERSION,
+  FIXTURE_DELIVERY_ORIGIN_DOMAIN,
+  FIXTURE_MANIFEST_FILE_NAME,
+  FIXTURE_MAXIMUM_DELIVERY_ORIGINS,
+  FIXTURE_METADATA_FIELDS,
+  FIXTURE_ROOT_FIELDS,
+} from "../fixture-contract.js";
 import { FOOTER_SETTINGS_FILE } from "../footer-workspace.js";
+import {
+  isRedirectMapRevision,
+  REDIRECT_KIND_GONE,
+  REDIRECTS_FILE_NAME,
+  validateRedirectsDocument,
+  normalizeRedirectPath,
+} from "../redirects-contract.js";
 import { boundedList, successResult } from "../session.js";
 import { SETTINGS_GROUPS, SETTINGS_TYPE_SITE_PUBLISHING_PREFERENCES } from "../settings-catalog.js";
 import { validateFooterWorkspaceDocument } from "./footer-push.js";
@@ -26,22 +41,9 @@ import {
   WORKSPACE_LIMITS,
 } from "../workspace.js";
 
-export const FIXTURE_MANIFEST_FILE_NAME = "manifest.fixture.json";
-export const FIXTURE_CONTRACT_VERSION = 1;
 const MAXIMUM_REPORTED = 200;
-const FIXTURE_ROOT_KEYS = new Set([
-  "manifestVersion",
-  "siteId",
-  "pulledAt",
-  "pages",
-  "pagesTruncated",
-  "navigation",
-  "settings",
-  "settingsSkipped",
-  "deployments",
-  "fixture",
-]);
-const FIXTURE_METADATA_KEYS = new Set(["contractVersion", "imageIds", "deliveryOrigins"]);
+const FIXTURE_ROOT_KEYS = new Set(FIXTURE_ROOT_FIELDS);
+const FIXTURE_METADATA_KEYS = new Set(FIXTURE_METADATA_FIELDS);
 
 function fail(code, message, field, exitCode) {
   throw new SiteAuthoringError(code, message, { field, exitCode });
@@ -123,6 +125,23 @@ function validateFixtureManifest(manifest) {
       "navigation",
     );
   }
+  // The redirect baseline is bound the way navigation is, with the revision a
+  // push is fenced by. A fixture's revision is a deterministic placeholder like
+  // every other identity in one — it proves the shape, never a live read.
+  if (
+    !isPlainObject(manifest.redirects)
+    || manifest.redirects.file !== REDIRECTS_FILE_NAME
+    || !isRedirectMapRevision(manifest.redirects.revision)
+    || !Number.isSafeInteger(manifest.redirects.entries)
+    || manifest.redirects.entries < 0
+  ) {
+    fail(
+      "fixture.redirects_invalid",
+      `The fixture manifest must bind '${REDIRECTS_FILE_NAME}', a 64-character lowercase hex revision, and its `
+        + "non-negative entry count.",
+      "redirects",
+    );
+  }
   if (!Array.isArray(manifest.settingsSkipped) || manifest.settingsSkipped.length !== 0) {
     fail(
       "fixture.settings_invalid",
@@ -163,7 +182,10 @@ function validateFixtureManifest(manifest) {
   if (imageIds.size !== manifest.fixture.imageIds.length) {
     fail("fixture.image_ids_invalid", "fixture.imageIds must not contain duplicates.", "fixture.imageIds");
   }
-  if (!Array.isArray(manifest.fixture.deliveryOrigins) || manifest.fixture.deliveryOrigins.length > 100) {
+  if (
+    !Array.isArray(manifest.fixture.deliveryOrigins)
+    || manifest.fixture.deliveryOrigins.length > FIXTURE_MAXIMUM_DELIVERY_ORIGINS
+  ) {
     fail(
       "fixture.delivery_origins_invalid",
       "fixture.deliveryOrigins must be a bounded list of reserved HTTPS example origins.",
@@ -186,11 +208,14 @@ function validateFixtureManifest(manifest) {
       || url.pathname !== "/"
       || url.search !== ""
       || url.hash !== ""
-      || !(url.hostname === "example.test" || url.hostname.endsWith(".example.test"))
+      || !(
+        url.hostname === FIXTURE_DELIVERY_ORIGIN_DOMAIN
+        || url.hostname.endsWith(`.${FIXTURE_DELIVERY_ORIGIN_DOMAIN}`)
+      )
     ) {
       fail(
         "fixture.delivery_origins_invalid",
-        "Every fixture delivery origin must be an origin-only HTTPS URL under the reserved example.test domain.",
+        `Every fixture delivery origin must be an origin-only HTTPS URL under the reserved ${FIXTURE_DELIVERY_ORIGIN_DOMAIN} domain.`,
         `fixture.deliveryOrigins[${index}]`,
       );
     }
@@ -452,6 +477,51 @@ export async function validateFixture(invocation = {}) {
     );
   }
 
+  onProgress("Validating the redirect map: paths, targets, statuses, chains, and loops.");
+  const redirectsDocument = await readWorkspaceJson(
+    fixtureRoot,
+    REDIRECTS_FILE_NAME,
+    WORKSPACE_LIMITS.redirectsBytes,
+  );
+  const redirects = validateRedirectsDocument(redirectsDocument, manifest.siteId);
+  if (redirects.entries.length !== manifest.redirects.entries) {
+    fail(
+      "fixture.redirects_count_mismatch",
+      `${REDIRECTS_FILE_NAME} contains ${redirects.entries.length} entr${
+        redirects.entries.length === 1 ? "y" : "ies"
+      }, but the fixture manifest records ${manifest.redirects.entries}.`,
+      "redirects.entries",
+    );
+  }
+  // A fixture is self-contained, so the occupancy rule the site enforces can be
+  // checked here too: a source the fixture's own pages occupy would be refused
+  // at the API, and saying so offline is the whole point of this verb. Paths
+  // compare case-insensitively, as the site's citext path column does, and a
+  // refusal names the entry where the author wrote it: the validated map is
+  // sorted by path, so its index is not the document's.
+  const fixturePagePaths = new Set(
+    manifest.pages.map((entry) =>
+      (`/${normalizePagePath(entry.path) ?? ""}`.replace(/\/+$/u, "") || "/").toLowerCase()
+    ),
+  );
+  const authoredIndexByPath = new Map();
+  for (const [index, entry] of redirectsDocument.entries.entries()) {
+    const path = normalizeRedirectPath(entry?.path);
+    if (path !== undefined && !authoredIndexByPath.has(path.toLowerCase())) {
+      authoredIndexByPath.set(path.toLowerCase(), index);
+    }
+  }
+  for (const entry of redirects.entries) {
+    const key = entry.path.toLowerCase();
+    if (fixturePagePaths.has(key)) {
+      fail(
+        "fixture.redirect_path_occupied",
+        `Redirect source '${entry.path}' is a page in this fixture, so it cannot also be a redirect source.`,
+        `entries[${authoredIndexByPath.get(key) ?? 0}].path`,
+      );
+    }
+  }
+
   onProgress("Validating the closed footer document and local page/image targets.");
   validateFooterWorkspaceDocument(
     await readWorkspaceJson(fixtureRoot, FOOTER_SETTINGS_FILE, WORKSPACE_LIMITS.settingsBytes),
@@ -482,6 +552,10 @@ export async function validateFixture(invocation = {}) {
         ...(reportedPages.truncated ? { itemsTruncated: true } : {}),
       },
       navigation: { items: navigation.items, maximumDepth: NAVIGATION_MAXIMUM_DEPTH },
+      redirects: {
+        entries: redirects.entries.length,
+        gone: redirects.entries.filter((entry) => entry.kind === REDIRECT_KIND_GONE).length,
+      },
       themes: 2,
       appearanceSettings: presentation.scalarOperations.length,
       footer: true,
@@ -496,6 +570,7 @@ export async function validateFixture(invocation = {}) {
       "fixture structure and bounded files",
       "page content and named theme contexts",
       "navigation shape and local page-resource references",
+      "redirect-map shape, normalization, chains, loops, and fixture-local path occupancy",
       "complete theme, appearance, header, brand, and footer semantics",
       "fixture-local image identities and reserved delivery origins",
     ],

package/src/verbs/whoami.js

@@ -1,9 +1,67 @@
-import { CLI_BINARY_NAME, PUBLISH_KEY_ENVIRONMENT_VARIABLE, VERB_LOGIN, VERB_USE, VERB_WHOAMI } from "../constants.js";
+import {
+  CLI_BINARY_NAME,
+  CLI_UPGRADE_COMMAND,
+  CLI_VERSION,
+  EXTERNAL_WRITES_SETTING_KEY,
+  EXTERNAL_WRITES_SETTING_LOCATION,
+  PUBLISH_KEY_ENVIRONMENT_VARIABLE,
+  VERB_LOGIN,
+  VERB_STATUS,
+  VERB_USE,
+  VERB_WHOAMI,
+} from "../constants.js";
+import { isBehindLatest } from "../cli-release.js";
 import { credentialApiOrigin, findCredential } from "../credentials.js";
 import { SITE_AUTHORING_CAPABILITIES } from "../capabilities.js";
 import { openAnonymousSession, successResult } from "../session.js";
 import { environmentNameFor } from "../settings.js";
 
+/**
+ * What the last exchange recorded about the platform authoring switch, dated
+ * with that exchange (TR00692).
+ *
+ * Never presented as the current state: this verb makes no request, so the
+ * value is as old as the last exchange, and `status` is where a current answer
+ * comes from. A record written before the field existed says so plainly rather
+ * than reading as "enabled".
+ */
+function platformLine(lastExchange) {
+  const when = lastExchange.at === undefined ? "at that exchange" : `as of ${lastExchange.at}`;
+  if (lastExchange.externalWritesEnabled === undefined) {
+    return `Platform authoring switch: not recorded by that exchange. Run '${CLI_BINARY_NAME} ${VERB_STATUS}' `
+      + "for a current answer.";
+  }
+  return lastExchange.externalWritesEnabled
+    ? `Platform authoring switch ${when}: external site authoring writes were enabled. This is a recording, not a `
+      + `live read; run '${CLI_BINARY_NAME} ${VERB_STATUS}' for the current answer.`
+    : `Platform authoring switch ${when}: external site authoring writes were PAUSED platform-wide. A Taproot `
+      + `administrator re-enables the platform setting '${EXTERNAL_WRITES_SETTING_KEY}' `
+      + `(${EXTERNAL_WRITES_SETTING_LOCATION}). This is a recording, not a live read; run `
+      + `'${CLI_BINARY_NAME} ${VERB_STATUS}' for the current answer.`;
+}
+
+/**
+ * The latest published CLI release that exchange recorded (TR00703), dated the
+ * same way and for the same reason.
+ *
+ * A run that is actually behind never reaches here — the gate in `runCli`
+ * refuses `whoami` outright — so this line is what a *current* CLI reads as
+ * confirmation, and what a CLI whose store predates the field reads as "not
+ * recorded". It is still stated as a recording rather than as live fact,
+ * because that is what it is.
+ */
+function cliReleaseLine(lastExchange) {
+  if (lastExchange.latestCliVersion === undefined) {
+    return `Latest CLI release: not recorded by that exchange. This CLI is ${CLI_VERSION}; run `
+      + `'${CLI_BINARY_NAME} ${VERB_STATUS}' for a current answer.`;
+  }
+  const when = lastExchange.at === undefined ? "at that exchange" : `as of ${lastExchange.at}`;
+  return isBehindLatest(lastExchange.latestCliVersion)
+    ? `Latest CLI release ${when}: ${lastExchange.latestCliVersion}. This CLI is ${CLI_VERSION} and is behind it; `
+      + `Taproot accepts only the latest. Upgrade with: ${CLI_UPGRADE_COMMAND}`
+    : `Latest CLI release ${when}: ${lastExchange.latestCliVersion}. This CLI is ${CLI_VERSION}.`;
+}
+
 /**
  * `taproot-site whoami` — which Taproot, which account, which site, until when.
  *
@@ -75,6 +133,12 @@ export async function whoami(invocation) {
       `That credential ${lapsed ? "expired" : "expires"} ${lastExchange.expiresAt}`
         + `${lapsed ? "; the next command mints another." : "."}`,
     );
+    // The platform authoring switch as of that exchange, dated (TR00692). It is
+    // reported as a recording rather than as the current state, because this
+    // command is offline by design and an operator reading an undated flag
+    // would take a snapshot from last week for a fact about right now.
+    onProgress(platformLine(lastExchange));
+    onProgress(cliReleaseLine(lastExchange));
   }
 
   return successResult(VERB_WHOAMI, config?.siteId, {
@@ -101,6 +165,20 @@ export async function whoami(invocation) {
         capabilities: lastExchange.capabilities,
         expiresAt: lastExchange.expiresAt,
         expired: Date.parse(lastExchange.expiresAt) <= now,
+        // Both absent on a record written before TR00692, and
+        // `externalWritesEnabled` also absent when the server that answered the
+        // exchange predated the field. Absent means "not recorded", never
+        // "enabled": an automation that wants a current answer reads
+        // `platform` off `status`, which says which of the three states it is.
+        ...(lastExchange.at === undefined ? {} : { at: lastExchange.at }),
+        ...(lastExchange.externalWritesEnabled === undefined
+          ? {}
+          : { externalWritesEnabled: lastExchange.externalWritesEnabled }),
+        // Absent on a record written before TR00703, and on one whose server
+        // predated the field. Absent means "not recorded", never "current".
+        ...(lastExchange.latestCliVersion === undefined
+          ? {}
+          : { latestCliVersion: lastExchange.latestCliVersion }),
       },
     }),
     ...(environmentOverride ? { capabilitiesKnown: false } : {}),