@tokenoftrust/cli 1.2.0 → 1.2.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Token of Trust developer CLI — check out a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/auth.mjs

@@ -27,6 +27,7 @@ import {
   defaultCredentialsPath, readCredentials, writeCredentials, isExpired,
 } from "./token-store.mjs";
 import { refreshAccessToken, credentialsFromToken } from "./oauth.mjs";
+import { recordServerPolicy } from "./update-check.mjs";
 
 /** Thrown when no provider can authenticate — carries actionable guidance. */
 export class AuthUnavailableError extends Error {
@@ -60,11 +61,14 @@ export async function resolveSession(client, opts = {}) {
         { hint: "source apps/storefront/lib/resolve-tot-credentials.sh (from a storefront checkout), or unset --identity to use developer sign-in." },
       );
     }
-    await client.callTool("credential_validate", {
+    const validated = await client.callTool("credential_validate", {
       totApiKey: env.TOT_API_KEY,
       totSecretKey: env.TOT_SECRET_KEY,
       appDomain: env.TOT_APP_DOMAIN,
     });
+    // Update-awareness Layer 2: the MCP may attach a version-support policy to the
+    // authed response (wire contract: `cliPolicy`). Safe no-op when absent.
+    recordServerPolicy(validated?.cliPolicy, env);
     return { identity: "operator", appDomain: env.TOT_APP_DOMAIN };
   }
 

package/src/commands/whoami.mjs

@@ -13,6 +13,7 @@ import { defaultCredentialsPath, readCredentials, isExpired } from "../token-sto
 import { hasOperatorCreds, resolveDeveloperSession } from "../auth.mjs";
 import { createMcpClient } from "../mcp.mjs";
 import { normalizeStores } from "./checkout.mjs";
+import { recordServerPolicy } from "../update-check.mjs";
 
 /**
  * Pure summary of the cached session — no network. Returned for both display and
@@ -56,7 +57,11 @@ export async function run(argv, _ctx) {
     const client = createMcpClient(status.mcpUrl || env.MCP_BASE_URL || env.TOT_MCP_URL || "https://mcp.tokenoftrust.com");
     await client.initialize();
     await resolveDeveloperSession(client, env);
-    const stores = normalizeStores(await client.callTool("client_list", {}));
+    const listResp = await client.callTool("client_list", {});
+    // Update-awareness Layer 2: an authed response may carry a version-support
+    // policy (wire contract: `cliPolicy`). Safe no-op when absent.
+    recordServerPolicy(listResp?.cliPolicy, env);
+    const stores = normalizeStores(listResp);
     if (stores.length) {
       console.log(`  stores you can build on: ${stores.map((s) => s.id).join(", ")}`);
     } else {

package/src/mcp.mjs

@@ -7,10 +7,26 @@
  * answer as JSON or as an SSE stream, with the session id carried in the
  * `Mcp-Session-Id` header across calls. Dependency-free (global fetch, Node 20+).
  */
+import { readFileSync } from "node:fs";
+
+// The CLI's REAL version for the MCP handshake — the transmission channel the
+// server-side support policy (update-awareness Layer 2) decides against. Read from
+// our own package.json (same pattern as bin/tot.mjs); best-effort, never throws.
+export const CLI_VERSION = (() => {
+  try {
+    return (
+      JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version ||
+      "0.0.0"
+    );
+  } catch {
+    return "0.0.0";
+  }
+})();
 
 /**
  * @param {string} baseUrl - MCP base URL; `/mcp` is appended if absent.
- * @param {{ token?: string }} [opts] - optional developer OAuth bearer to attach.
+ * @param {{ token?: string, clientVersion?: string }} [opts] - optional developer OAuth
+ *   bearer to attach; `clientVersion` overrides the handshake version (tests).
  * @returns a small client: { mcpUrl, initialize, callRaw, callTool, sessionId(), setToken }
  */
 export function createMcpClient(baseUrl, opts = {}) {
@@ -86,7 +102,9 @@ export function createMcpClient(baseUrl, opts = {}) {
   }
 
   /** Complete the MCP handshake. Call once before any tool call. */
-  async function initialize(clientInfo = { name: "tot-cli", version: "0.1.0" }) {
+  async function initialize(
+    clientInfo = { name: "tot-cli", version: opts.clientVersion || CLI_VERSION },
+  ) {
     await callRaw("initialize", {
       protocolVersion: "2025-06-18",
       capabilities: {},