@topolo/cli 0.12.10 → 0.12.12

package/dist/index.js

@@ -9,7 +9,7 @@ import { platform as platform2 } from "os";
 import { createInterface } from "readline/promises";
 import { stdin as input } from "process";
 
-// node_modules/.pnpm/@topolo+sdk@0.21.2/node_modules/@topolo/sdk/dist/index.js
+// node_modules/.pnpm/@topolo+sdk@0.22.0/node_modules/@topolo/sdk/dist/index.js
 function applyAuthHeaders(headers, credential) {
   if (credential.kind === "api_key") {
     headers.set("X-Api-Key", credential.apiKey);
@@ -28,58 +28,6 @@ function generateRequestId() {
   }
   return `req_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 10)}`;
 }
-var encoder = new TextEncoder();
-function encodeBase64Url(value) {
-  const bytes = value instanceof Uint8Array ? value : new Uint8Array(value);
-  let binary = "";
-  for (const byte of bytes) binary += String.fromCharCode(byte);
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
-}
-function encodeJson(value) {
-  return encodeBase64Url(encoder.encode(JSON.stringify(value)));
-}
-async function sha256Base64Url(value) {
-  return encodeBase64Url(await crypto.subtle.digest("SHA-256", encoder.encode(value)));
-}
-function publicJwk(privateJwk) {
-  const { crv, kty, x, y } = privateJwk;
-  if (kty !== "EC" || crv !== "P-256" || !x || !y || !privateJwk.d) {
-    throw new TypeError("A private P-256 JSON Web Key is required for DPoP signing.");
-  }
-  return { crv, kty, x, y };
-}
-function canonicalTargetUrl(value) {
-  const url = new URL(value);
-  return `${url.origin}${url.pathname}`;
-}
-async function calculateDpopJkt(privateJwk) {
-  const jwk = publicJwk(privateJwk);
-  return sha256Base64Url(JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y }));
-}
-async function createDpopProof(input2) {
-  const jwk = publicJwk(input2.privateJwk);
-  const key = await crypto.subtle.importKey(
-    "jwk",
-    input2.privateJwk,
-    { name: "ECDSA", namedCurve: "P-256" },
-    false,
-    ["sign"]
-  );
-  const header = encodeJson({ alg: "ES256", typ: "dpop+jwt", jwk });
-  const claims = encodeJson({
-    jti: crypto.randomUUID(),
-    iat: Math.floor(Date.now() / 1e3),
-    htm: input2.method.toUpperCase(),
-    htu: canonicalTargetUrl(input2.targetUrl),
-    ath: await sha256Base64Url(input2.accessToken)
-  });
-  const signature = await crypto.subtle.sign(
-    { name: "ECDSA", hash: "SHA-256" },
-    key,
-    encoder.encode(`${header}.${claims}`)
-  );
-  return `${header}.${claims}.${encodeBase64Url(signature)}`;
-}
 var TopoloSdkError = class extends Error {
   code;
   constructor(code, message2) {
@@ -135,6 +83,9 @@ var PUBLIC_ERROR_CODES = /* @__PURE__ */ new Set([
   "unknown_service"
 ]);
 var ERROR_CODE_PATTERN = /^[a-z][a-z0-9_]{0,63}$/;
+var SERVICE_ERROR_CODE_PATTERN = /^[a-z][a-z0-9]*(?:_[a-z][a-z0-9]*){1,9}$/;
+var SERVICE_MESSAGE_MAX_LENGTH = 300;
+var SERVICE_ISSUE_LIMIT = 32;
 var TOPOLO_REQUEST_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var CLOUDFLARE_RAY_ID_PATTERN = /^[0-9a-f]{16}-[A-Z]{3}$/;
 var PERMISSION_PATTERN = /^[a-z][a-z0-9_-]{0,63}(?:\.[a-z][a-z0-9_-]{0,63})*:(?:[a-z][a-z0-9_-]{0,63}|\*)$/;
@@ -159,6 +110,24 @@ function canonicalTopoloErrorCode(value) {
   if (!ERROR_CODE_PATTERN.test(candidate) || !PUBLIC_ERROR_CODES.has(candidate)) return null;
   return candidate;
 }
+function canonicalTopoloServiceErrorCode(value) {
+  const platform4 = canonicalTopoloErrorCode(value);
+  if (platform4) return platform4;
+  if (typeof value !== "string") return null;
+  const candidate = value.trim();
+  if (candidate.length > 64 || !SERVICE_ERROR_CODE_PATTERN.test(candidate)) return null;
+  const wordLike = candidate.split("_").every((segment) => {
+    const digits = segment.replace(/[a-z]/g, "").length;
+    return digits === 0 || digits < segment.length - digits && segment.length <= 8;
+  });
+  return wordLike ? candidate : null;
+}
+function sanitizeTopoloServiceMessage(value) {
+  if (typeof value !== "string") return void 0;
+  const text2 = value.replace(/[\u0000-\u001f\u007f-\u009f\u200b-\u200f\u2028-\u202e\u2066-\u2069\ufeff]/g, " ").replace(/\b[a-z][a-z0-9+.-]*:\/\/\S+/gi, "[url]").replace(/[^\s@<>()[\],;:"']+@[^\s@<>()[\],;:"']+\.[a-z]{2,}/gi, "[email]").replace(/[A-Za-z0-9_\-+/=.]{20,}/g, (run) => /[0-9]/.test(run) && /[A-Za-z]/.test(run) ? "[redacted]" : run).replace(/\s+/g, " ").trim();
+  if (!text2) return void 0;
+  return text2.length > SERVICE_MESSAGE_MAX_LENGTH ? `${text2.slice(0, SERVICE_MESSAGE_MAX_LENGTH - 1).trimEnd()}\u2026` : text2;
+}
 function canonicalTopoloRequestId(value) {
   if (typeof value !== "string") return void 0;
   const candidate = value.trim();
@@ -183,7 +152,7 @@ var TopoloAuthError = class extends TopoloSdkError {
   retryAfter;
   details;
   constructor(message2, code = "auth_error", options = {}) {
-    super(canonicalTopoloErrorCode(code) ?? "auth_error", message2);
+    super(canonicalTopoloServiceErrorCode(code) ?? "auth_error", message2);
     this.name = "TopoloAuthError";
     this.status = options.status ?? 401;
     this.body = options.body;
@@ -207,7 +176,7 @@ var TopoloPermissionError = class extends TopoloSdkError {
   details;
   constructor(message2, required, options = {}) {
     super(
-      canonicalTopoloErrorCode(options.code) ?? serviceErrorCode(options.body, "permission_denied"),
+      canonicalTopoloServiceErrorCode(options.code) ?? serviceErrorCode(options.body, "permission_denied"),
       message2
     );
     this.name = "TopoloPermissionError";
@@ -226,18 +195,34 @@ var TopoloPermissionError = class extends TopoloSdkError {
 function extractTopoloServiceErrorCode(body) {
   if (!body || typeof body !== "object" || Array.isArray(body)) return null;
   const record2 = body;
-  const topLevel = canonicalTopoloErrorCode(record2.code);
+  const topLevel = canonicalTopoloServiceErrorCode(record2.code);
   if (topLevel) return topLevel;
   const nested = record2.error;
-  const nestedString = canonicalTopoloErrorCode(nested);
+  const nestedString = canonicalTopoloServiceErrorCode(nested);
   if (nestedString) return nestedString;
   if (nested && typeof nested === "object" && !Array.isArray(nested)) {
     const code = nested.code;
-    const nestedCode = canonicalTopoloErrorCode(code);
+    const nestedCode = canonicalTopoloServiceErrorCode(code);
     if (nestedCode) return nestedCode;
   }
   return null;
 }
+function extractTopoloServiceErrorMessage(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return void 0;
+  const record2 = body;
+  const nested = record2.error;
+  const candidates = [];
+  if (nested && typeof nested === "object" && !Array.isArray(nested)) {
+    candidates.push(nested.message);
+  }
+  candidates.push(record2.message, record2.error_description);
+  if (typeof nested === "string" && !canonicalTopoloServiceErrorCode(nested)) candidates.push(nested);
+  for (const candidate of candidates) {
+    const message2 = sanitizeTopoloServiceMessage(candidate);
+    if (message2) return message2;
+  }
+  return void 0;
+}
 function serviceErrorCode(body, fallback) {
   return extractTopoloServiceErrorCode(body) ?? fallback;
 }
@@ -251,10 +236,7 @@ function extractTopoloServiceErrorDetails(body) {
     if (candidate === void 0) candidate = nestedRecord.details ?? nestedRecord;
   }
   if (candidate === void 0) candidate = record2;
-  if (Array.isArray(candidate)) {
-    const paths = canonicalTopoloValidationPaths(candidate);
-    return paths.length ? { paths } : void 0;
-  }
+  if (Array.isArray(candidate)) return validationIssueDetails(canonicalTopoloValidationIssues(candidate)) ?? void 0;
   if (!candidate || typeof candidate !== "object") return void 0;
   const source = candidate;
   const safe = {};
@@ -296,18 +278,59 @@ function extractTopoloServiceErrorDetails(body) {
       if (paths.length) safe[key] = paths;
     }
   }
+  const issues = [
+    ...Array.isArray(source.issues) ? canonicalTopoloValidationIssues(source.issues) : [],
+    ...flattenedValidationIssues(source.formErrors, source.fieldErrors)
+  ].slice(0, SERVICE_ISSUE_LIMIT);
+  Object.assign(safe, validationIssueDetails(issues));
   return Object.keys(safe).length ? safe : void 0;
 }
-function canonicalTopoloValidationPaths(issues) {
+function validationIssueDetails(issues) {
+  if (!issues.length) return null;
   const paths = [];
-  for (const issue of issues) {
-    if (!issue || typeof issue !== "object" || Array.isArray(issue)) continue;
-    const record2 = issue;
+  for (const issue22 of issues) {
+    if (issue22.path && !paths.includes(issue22.path)) paths.push(issue22.path);
+  }
+  return paths.length ? { paths, issues } : { issues };
+}
+function issue(path, message2) {
+  const text2 = sanitizeTopoloServiceMessage(message2);
+  if (!path && !text2) return null;
+  return { ...path ? { path } : {}, ...text2 ? { message: text2 } : {} };
+}
+function canonicalTopoloValidationIssues(values) {
+  const issues = [];
+  for (const value of values) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) continue;
+    const record2 = value;
     const path = canonicalTopoloValidationPath(record2.field) ?? canonicalTopoloValidationPath(record2.path);
-    if (path && !paths.includes(path)) paths.push(path);
-    if (paths.length === 32) break;
+    if (!path) continue;
+    const projected = issue(path, record2.message);
+    if (projected) issues.push(projected);
+    if (issues.length === SERVICE_ISSUE_LIMIT) break;
   }
-  return paths;
+  return issues;
+}
+function flattenedValidationIssues(formErrors, fieldErrors) {
+  const issues = [];
+  if (Array.isArray(formErrors)) {
+    for (const message2 of formErrors) {
+      const projected = issue(void 0, message2);
+      if (projected) issues.push(projected);
+    }
+  }
+  if (fieldErrors && typeof fieldErrors === "object" && !Array.isArray(fieldErrors)) {
+    for (const [key, messages] of Object.entries(fieldErrors)) {
+      const path = canonicalTopoloValidationPath(key);
+      if (!path) continue;
+      const list = Array.isArray(messages) && messages.length ? messages : [void 0];
+      for (const message2 of list) {
+        const projected = issue(path, message2);
+        if (projected) issues.push(projected);
+      }
+    }
+  }
+  return issues;
 }
 function canonicalTopoloValidationPath(value) {
   if (typeof value === "string") {
@@ -329,7 +352,9 @@ function canonicalTopoloValidationPath(value) {
   return PUBLIC_FIELD_PATH_PATTERN.test(path) ? path : void 0;
 }
 function publicTopoloErrorMessage(error) {
-  const code = canonicalTopoloErrorCode(
+  const serviceMessage = typeof error === "string" ? void 0 : extractTopoloServiceErrorMessage(error.body);
+  if (serviceMessage) return serviceMessage;
+  const code = canonicalTopoloServiceErrorCode(
     typeof error === "string" ? error : error.code ?? extractTopoloServiceErrorCode(error.body)
   ) ?? "request_failed";
   if (/(?:organization|org).*(?:enroll|membership|member|admission)/.test(code)) {
@@ -346,7 +371,7 @@ function publicTopoloErrorMessage(error) {
   return `Topolo request failed (${code}).`;
 }
 function topoloErrorHint(error) {
-  const code = canonicalTopoloErrorCode(
+  const code = canonicalTopoloServiceErrorCode(
     typeof error === "string" ? error : error.code ?? extractTopoloServiceErrorCode(error.body)
   );
   if (!code) return void 0;
@@ -401,6 +426,136 @@ var TopoloHttpError = class extends TopoloSdkError {
     );
   }
 };
+var ACTION_SECRET_PREFIX = "topolo-secret:";
+function isActionSecretReference(value) {
+  return typeof value === "string" && value.startsWith(ACTION_SECRET_PREFIX);
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function sensitive(key, value) {
+  const normalized = key.toLowerCase().replace(/[^a-z0-9]/g, "");
+  if (normalized === "capability") {
+    if (typeof value !== "string") return value !== null && value !== void 0 && typeof value !== "boolean" && typeof value !== "number";
+    const text2 = value.trim();
+    return Boolean(text2) && !/^[a-z][a-z0-9_-]{0,31}$/.test(text2);
+  }
+  return ["authorization", "cookie", "setcookie", "proxyauthorization"].includes(normalized) || /(token|secret|password|privatekey|apikey)$/.test(normalized);
+}
+function maskActionSecrets(value, secrets) {
+  let masked = value;
+  for (const [secret, reference] of secrets) {
+    const encoded = encodeURIComponent(secret);
+    const variants = [.../* @__PURE__ */ new Set([secret, encoded])].map((item) => item.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+    masked = masked.replace(new RegExp(variants.join("|"), "g"), (match) => match === secret ? reference : encodeURIComponent(reference));
+  }
+  return masked;
+}
+async function resolveActionSecrets(value, store, secrets) {
+  if (isActionSecretReference(value)) {
+    if (!store) throw new TopoloSdkError("action_secret_store_required", "Protected action references require a secret store.");
+    const resolved = await store.load(value);
+    if (typeof resolved !== "string" || !resolved) throw new TopoloSdkError("action_secret_unsupported_type", "Protected action handoff requires a nonempty string credential.");
+    secrets.set(resolved, value);
+    return resolved;
+  }
+  if (Array.isArray(value)) return Promise.all(value.map((item) => resolveActionSecrets(item, store, secrets)));
+  if (!isRecord(value)) return value;
+  return Object.fromEntries(await Promise.all(Object.entries(value).map(async ([key, item]) => [key, await resolveActionSecrets(item, store, secrets)])));
+}
+async function protectActionResult(value, store) {
+  const secrets = /* @__PURE__ */ new Map();
+  async function protect(item, key = "") {
+    if (isActionSecretReference(item)) return item;
+    if (sensitive(key, item)) {
+      const reference = store ? await store.save(item) : "[REDACTED]";
+      if (typeof item === "string" && item) secrets.set(item, reference);
+      return reference;
+    }
+    if (Array.isArray(item)) return Promise.all(item.map((child) => protect(child)));
+    if (!isRecord(item)) return item;
+    return Object.fromEntries(await Promise.all(Object.entries(item).map(async ([name, child]) => [name, await protect(child, name)])));
+  }
+  const protectedValue = await protect(value);
+  async function protectEmbedded(item) {
+    if (typeof item === "string" && !isActionSecretReference(item) && maskActionSecrets(item, secrets) !== item) {
+      return store ? store.save(item) : maskActionSecrets(item, secrets);
+    }
+    if (Array.isArray(item)) return Promise.all(item.map(protectEmbedded));
+    if (!isRecord(item)) return item;
+    return Object.fromEntries(await Promise.all(Object.entries(item).map(async ([key, child]) => [key, await protectEmbedded(child)])));
+  }
+  return protectEmbedded(protectedValue);
+}
+function maskActionSecretValue(value, secrets) {
+  if (value instanceof Error) return maskActionSecretError(value, secrets);
+  if (typeof value === "string") return maskActionSecrets(value, secrets);
+  if (Array.isArray(value)) return value.map((item) => maskActionSecretValue(item, secrets));
+  if (!isRecord(value)) return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, maskActionSecretValue(item, secrets)]));
+}
+function maskActionSecretError(error, secrets) {
+  if (!(error instanceof Error)) return maskActionSecretValue(error, secrets);
+  const masked = Object.create(Object.getPrototypeOf(error));
+  for (const key of Object.getOwnPropertyNames(error)) {
+    const descriptor = Object.getOwnPropertyDescriptor(error, key);
+    if ("value" in descriptor) descriptor.value = maskActionSecretValue(descriptor.value, secrets);
+    Object.defineProperty(masked, key, descriptor);
+  }
+  return masked;
+}
+var encoder = new TextEncoder();
+function encodeBase64Url(value) {
+  const bytes = value instanceof Uint8Array ? value : new Uint8Array(value);
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function encodeJson(value) {
+  return encodeBase64Url(encoder.encode(JSON.stringify(value)));
+}
+async function sha256Base64Url(value) {
+  return encodeBase64Url(await crypto.subtle.digest("SHA-256", encoder.encode(value)));
+}
+function publicJwk(privateJwk) {
+  const { crv, kty, x, y } = privateJwk;
+  if (kty !== "EC" || crv !== "P-256" || !x || !y || !privateJwk.d) {
+    throw new TypeError("A private P-256 JSON Web Key is required for DPoP signing.");
+  }
+  return { crv, kty, x, y };
+}
+function canonicalTargetUrl(value) {
+  const url = new URL(value);
+  return `${url.origin}${url.pathname}`;
+}
+async function calculateDpopJkt(privateJwk) {
+  const jwk = publicJwk(privateJwk);
+  return sha256Base64Url(JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y }));
+}
+async function createDpopProof(input2) {
+  const jwk = publicJwk(input2.privateJwk);
+  const key = await crypto.subtle.importKey(
+    "jwk",
+    input2.privateJwk,
+    { name: "ECDSA", namedCurve: "P-256" },
+    false,
+    ["sign"]
+  );
+  const header = encodeJson({ alg: "ES256", typ: "dpop+jwt", jwk });
+  const claims = encodeJson({
+    jti: crypto.randomUUID(),
+    iat: Math.floor(Date.now() / 1e3),
+    htm: input2.method.toUpperCase(),
+    htu: canonicalTargetUrl(input2.targetUrl),
+    ath: await sha256Base64Url(input2.accessToken)
+  });
+  const signature = await crypto.subtle.sign(
+    { name: "ECDSA", hash: "SHA-256" },
+    key,
+    encoder.encode(`${header}.${claims}`)
+  );
+  return `${header}.${claims}.${encodeBase64Url(signature)}`;
+}
 function hostnameHasSuffix(hostname, suffix) {
   return hostname === suffix || hostname.endsWith(`.${suffix}`);
 }
@@ -574,9 +729,9 @@ function inspectSchema(schema, path, root, depth) {
     return { path, code: "unsupported_schema_ref", message: `Cannot resolve schema reference ${schema.$ref}.` };
   }
   const children = [];
-  if (isRecord(schema.properties)) children.push(...Object.entries(schema.properties));
-  if (isRecord(schema.$defs)) children.push(...Object.entries(schema.$defs));
-  if (isRecord(schema.definitions)) children.push(...Object.entries(schema.definitions));
+  if (isRecord2(schema.properties)) children.push(...Object.entries(schema.properties));
+  if (isRecord2(schema.$defs)) children.push(...Object.entries(schema.$defs));
+  if (isRecord2(schema.definitions)) children.push(...Object.entries(schema.definitions));
   children.push(
     ["additionalProperties", schema.additionalProperties],
     ["propertyNames", schema.propertyNames],
@@ -586,9 +741,9 @@ function inspectSchema(schema, path, root, depth) {
     ...arraySchemaEntries("oneOf", schema.oneOf)
   );
   for (const [key, child] of children) {
-    if (!isRecord(child)) continue;
-    const issue = inspectSchema(child, `${path}.${key}`, root, depth + 1);
-    if (issue) return issue;
+    if (!isRecord2(child)) continue;
+    const issue22 = inspectSchema(child, `${path}.${key}`, root, depth + 1);
+    if (issue22) return issue22;
   }
   return null;
 }
@@ -610,7 +765,7 @@ function validateNode(schema, value, path, root, errors, depth) {
   }
   if (Array.isArray(schema.allOf)) {
     for (const candidate of schema.allOf) {
-      if (isRecord(candidate)) validateNode(candidate, value, path, root, errors, depth + 1);
+      if (isRecord2(candidate)) validateNode(candidate, value, path, root, errors, depth + 1);
     }
   }
   if (Array.isArray(schema.anyOf) && !schema.anyOf.some((candidate) => candidateMatches(candidate, value, root, depth))) {
@@ -640,7 +795,7 @@ function validateNode(schema, value, path, root, errors, depth) {
   if (typeof value === "string") validateString(schema, value, path, errors);
   if (typeof value === "number") validateNumber(schema, value, path, errors);
   if (Array.isArray(value)) validateArray(schema, value, path, root, errors, depth);
-  if (isRecord(value)) validateObject(schema, value, path, root, errors, depth);
+  if (isRecord2(value)) validateObject(schema, value, path, root, errors, depth);
 }
 function validateObject(schema, value, path, root, errors, depth) {
   if (typeof schema.minProperties === "number" && Object.keys(value).length < schema.minProperties) {
@@ -649,25 +804,25 @@ function validateObject(schema, value, path, root, errors, depth) {
   if (typeof schema.maxProperties === "number" && Object.keys(value).length > schema.maxProperties) {
     errors.push({ path, code: "max_properties", message: `Expected at most ${schema.maxProperties} properties.` });
   }
-  const properties = isRecord(schema.properties) ? schema.properties : {};
+  const properties = isRecord2(schema.properties) ? schema.properties : {};
   const required = Array.isArray(schema.required) ? schema.required.map(String) : [];
   for (const key of required) {
     if (!Object.prototype.hasOwnProperty.call(value, key)) {
       errors.push({ path: `${path}.${key}`, code: "required", message: "Required property is missing." });
     }
   }
-  if (isRecord(schema.propertyNames)) {
+  if (isRecord2(schema.propertyNames)) {
     for (const key of Object.keys(value)) {
       validateNode(schema.propertyNames, key, `${path}.${key}`, root, errors, depth + 1);
     }
   }
   for (const [key, child] of Object.entries(value)) {
     const childSchema = properties[key];
-    if (isRecord(childSchema)) {
+    if (isRecord2(childSchema)) {
       validateNode(childSchema, child, `${path}.${key}`, root, errors, depth + 1);
     } else if (schema.additionalProperties === false) {
       errors.push({ path: `${path}.${key}`, code: "additional_property", message: "Property is not declared by the action schema." });
-    } else if (isRecord(schema.additionalProperties)) {
+    } else if (isRecord2(schema.additionalProperties)) {
       validateNode(schema.additionalProperties, child, `${path}.${key}`, root, errors, depth + 1);
     }
   }
@@ -683,7 +838,7 @@ function validateArray(schema, value, path, root, errors, depth) {
     const unique = new Set(value.map((item) => JSON.stringify(item)));
     if (unique.size !== value.length) errors.push({ path, code: "unique_items", message: "Expected every item to be unique." });
   }
-  if (isRecord(schema.items)) {
+  if (isRecord2(schema.items)) {
     value.forEach((item, index) => validateNode(schema.items, item, `${path}[${index}]`, root, errors, depth + 1));
   }
 }
@@ -721,7 +876,7 @@ function validateNumber(schema, value, path, errors) {
   }
 }
 function candidateMatches(candidate, value, root, depth) {
-  if (!isRecord(candidate)) return false;
+  if (!isRecord2(candidate)) return false;
   const issues = [];
   validateNode(candidate, value, "$", root, issues, depth + 1);
   return issues.length === 0;
@@ -735,24 +890,24 @@ function resolveLocalReference(root, reference) {
       current = current[Number(token)];
       continue;
     }
-    if (!isRecord(current) || !Object.prototype.hasOwnProperty.call(current, token)) return null;
+    if (!isRecord2(current) || !Object.prototype.hasOwnProperty.call(current, token)) return null;
     current = current[token];
   }
-  return isRecord(current) ? current : null;
+  return isRecord2(current) ? current : null;
 }
 function matchesType(type, value) {
   if (type === void 0) return true;
   if (Array.isArray(type)) return type.some((candidate) => matchesType(candidate, value));
   if (type === "null") return value === null;
   if (type === "array") return Array.isArray(value);
-  if (type === "object") return isRecord(value);
+  if (type === "object") return isRecord2(value);
   if (type === "integer") return typeof value === "number" && Number.isInteger(value);
   return typeof value === type;
 }
 function sameJsonValue(left, right) {
   return JSON.stringify(left) === JSON.stringify(right);
 }
-function isRecord(value) {
+function isRecord2(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 function isUrl(value) {
@@ -987,7 +1142,7 @@ function fail(path, message2) {
   throw new ActorEnvelopeValidationError(path, message2);
 }
 function parseTopoloActionUploadContract(value) {
-  if (!isRecord2(value) || value.profile !== "inline-base64" && value.profile !== "url-session") {
+  if (!isRecord3(value) || value.profile !== "inline-base64" && value.profile !== "url-session") {
     throw new TopoloSdkError("upload_contract_unavailable", "This action does not publish a supported upload contract.");
   }
   const contentTypeField = requiredField(value.contentTypeField, "contentTypeField");
@@ -1066,17 +1221,17 @@ function prepareTopoloUrlSessionUploadInput(contractValue, byteLength, input2, o
   };
 }
 function topoloUploadResponseValue(response, path) {
-  return path.split(".").reduce((value, segment) => isRecord2(value) ? value[segment] : void 0, response);
+  return path.split(".").reduce((value, segment) => isRecord3(value) ? value[segment] : void 0, response);
 }
 function redactTopoloUrlSessionResult(response, uploadUrlPath) {
   const redacted = cloneUploadValue(response);
   let target = redacted;
   const segments = uploadUrlPath.split(".");
   for (const segment of segments.slice(0, -1)) {
-    target = isRecord2(target) ? target[segment] : void 0;
+    target = isRecord3(target) ? target[segment] : void 0;
   }
   const finalSegment = segments.at(-1);
-  if (finalSegment && isRecord2(target) && finalSegment in target) target[finalSegment] = "[REDACTED]";
+  if (finalSegment && isRecord3(target) && finalSegment in target) target[finalSegment] = "[REDACTED]";
   redactUploadHeaders(redacted);
   return redacted;
 }
@@ -1100,7 +1255,7 @@ function mapUploadInput(contract, contentBase64, input2, options) {
 }
 function cloneUploadValue(value) {
   if (Array.isArray(value)) return value.map(cloneUploadValue);
-  if (!isRecord2(value)) return value;
+  if (!isRecord3(value)) return value;
   return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, cloneUploadValue(item)]));
 }
 function redactUploadHeaders(value) {
@@ -1108,9 +1263,9 @@ function redactUploadHeaders(value) {
     value.forEach(redactUploadHeaders);
     return;
   }
-  if (!isRecord2(value)) return;
+  if (!isRecord3(value)) return;
   for (const [key, item] of Object.entries(value)) {
-    if (key.toLowerCase() === "headers" && isRecord2(item)) {
+    if (key.toLowerCase() === "headers" && isRecord3(item)) {
       for (const header of Object.keys(item)) {
         if (["authorization", "cookie", "set-cookie", "proxy-authorization", "x-api-key"].includes(header.toLowerCase())) {
           item[header] = "[REDACTED]";
@@ -1139,7 +1294,7 @@ function decodedBase64Size(contentBase64) {
   return contentBase64.length / 4 * 3 - padding;
 }
 function parseCompleteContract(value) {
-  if (!isRecord2(value)) throw new TopoloSdkError("invalid_upload_contract", "The action upload completion contract is invalid.");
+  if (!isRecord3(value)) throw new TopoloSdkError("invalid_upload_contract", "The action upload completion contract is invalid.");
   return {
     actionId: requiredPath(value.actionId, "complete.actionId"),
     inputField: requiredField(value.inputField, "complete.inputField"),
@@ -1177,7 +1332,7 @@ function encodeTopoloActionBase64(bytes) {
   }
   return btoa(binary);
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 var WRITE_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
@@ -1188,6 +1343,8 @@ var TOPOLO_RESOURCE_ID_HEADER = "X-Topolo-Resource-ID";
 var POSITIVE_CACHE_TTL_MS = 5 * 60 * 1e3;
 var NEGATIVE_CACHE_TTL_MS = 60 * 1e3;
 var TopoloClient = class _TopoloClient {
+  actionSecretStore;
+  actionSecrets = /* @__PURE__ */ new Map();
   credential;
   agent;
   actorContext;
@@ -1217,6 +1374,7 @@ var TopoloClient = class _TopoloClient {
     _TopoloClient.appIdCache.clear();
   }
   constructor(options) {
+    this.actionSecretStore = options.actionSecretStore;
     if (!options.credential) throw new TopoloAuthError("credential is required");
     if (!options.agent?.clientName) throw new TopoloAuthError("agent.clientName is required");
     this.credential = options.credential;
@@ -1238,6 +1396,7 @@ var TopoloClient = class _TopoloClient {
   }
   emit(event) {
     if (!this.debug) return;
+    event = maskActionSecretValue(event, this.actionSecrets);
     try {
       this.debug(event);
     } catch {
@@ -1623,7 +1782,7 @@ var TopoloClient = class _TopoloClient {
     }
     const entries = [];
     for (const item of raw) {
-      if (!isRecord3(item)) continue;
+      if (!isRecord4(item)) continue;
       const s = item;
       const appId = typeof s.app_id === "string" ? s.app_id : typeof s.id === "string" ? s.id : null;
       if (!appId) continue;
@@ -1698,8 +1857,8 @@ var TopoloClient = class _TopoloClient {
       "app_topolo_auth.service_api_key_resources.list",
       { appId: service.appId }
     );
-    const payload = isRecord3(response) && isRecord3(response.data) ? response.data : response;
-    if (!isRecord3(payload) || !Array.isArray(payload.resources)) {
+    const payload = isRecord4(response) && isRecord4(response.data) ? response.data : response;
+    if (!isRecord4(payload) || !Array.isArray(payload.resources)) {
       throw new TopoloSdkError("resource_catalog_unavailable", "TopoloAuth did not return bindable resources.");
     }
     return {
@@ -1880,24 +2039,27 @@ var TopoloClient = class _TopoloClient {
   }
   async validateActionInput(action, input2 = {}) {
     const entry = await this.getAction(action);
-    return { action: entry, validation: validateTopoloActionInput(entry.inputSchema, input2) };
+    const resolved = await resolveActionSecrets(input2, this.actionSecretStore, this.actionSecrets);
+    return { action: entry, validation: validateTopoloActionInput(entry.inputSchema, resolved) };
   }
   async planAction(action, input2 = {}, options = {}) {
     const entry = await this.getAction(action);
-    return this.planResolvedAction(entry, input2, options);
+    const resolved = await resolveActionSecrets(input2, this.actionSecretStore, this.actionSecrets);
+    return this.planResolvedAction(entry, resolved, options);
   }
   async prepareAction(action, input2, options = {}) {
     const entry = await this.getAction(action);
     const example = (entry.agentContract?.examples ?? []).find((candidate) => Boolean(candidate?.input) && typeof candidate.input === "object" && !Array.isArray(candidate.input) && validateTopoloActionInput(entry.inputSchema, candidate.input).valid) ?? null;
     const selectedInput = input2 ?? example?.input ?? {};
-    const plan = this.planResolvedAction(entry, selectedInput, options);
+    const resolved = await resolveActionSecrets(selectedInput, this.actionSecretStore, this.actionSecrets);
+    const plan = this.planResolvedAction(entry, resolved, options);
     return {
       action: entry,
       example,
       input: selectedInput,
       inputSource: input2 ? "provided" : example ? "example" : "empty",
       missingFields: [...new Set(
-        plan.validation.errors.filter((issue) => issue.code === "required").map((issue) => issue.path)
+        plan.validation.errors.filter((issue22) => issue22.code === "required").map((issue22) => issue22.path)
       )],
       plan
     };
@@ -1927,7 +2089,7 @@ var TopoloClient = class _TopoloClient {
       confirmationRequired,
       confirmationProvided: options.confirm === true,
       executable: validation.valid && agentAccess !== "off" && (!confirmationRequired || options.confirm === true),
-      request,
+      request: maskActionSecretValue(request, this.actionSecrets),
       verification: stringArray(entry.agentContract?.verify),
       rollbackActionId: pickActionString(entry.agentContract?.rollbackActionId),
       nextActionIds: stringArray(entry.agentContract?.nextActionIds)
@@ -1957,11 +2119,12 @@ var TopoloClient = class _TopoloClient {
         `Topolo action "${entry.actionId}" requires { confirm: true } before invocation.`
       );
     }
+    input2 = await resolveActionSecrets(input2, this.actionSecretStore, this.actionSecrets);
     const validation = validateTopoloActionInput(entry.inputSchema, input2);
     if (!validation.valid) {
       throw new TopoloSdkError(
         "invalid_action_input",
-        `Topolo action "${entry.actionId}" input is invalid: ${validation.errors.map((issue) => `${issue.path} ${issue.message}`).join("; ")}`
+        `Topolo action "${entry.actionId}" input is invalid: ${validation.errors.map((issue22) => `${issue22.path} ${issue22.message}`).join("; ")}`
       );
     }
     const resourceIssue = validateActionResource(entry, options.resource);
@@ -1987,22 +2150,31 @@ var TopoloClient = class _TopoloClient {
       }
     }
     const service = entry.appSlug || entry.appId;
-    const result = await this.request({
-      service,
-      ...entry.apiBaseUrl ? { baseUrl: entry.apiBaseUrl } : {},
-      method: entry.method,
-      path: mapped.path,
-      ...mapped.query ? { query: mapped.query } : {},
-      ...mapped.body !== void 0 ? { body: mapped.body } : {},
-      ...options.resource ? { resource: options.resource } : {},
-      ...resolvedActorEnvelope ? { actorEnvelope: resolvedActorEnvelope } : {},
-      headers: {
-        [TOPOLO_ACTION_ID_HEADER]: entry.actionId,
-        [TOPOLO_ACTION_NAME_HEADER]: entry.name
-      },
-      confirm: options.confirm === true || entry.readOnly && !entry.destructive && !entry.requiresConfirmation
-    });
-    return preserveSensitiveResult ? result : redactActionResult(result);
+    let result;
+    try {
+      result = await this.request({
+        service,
+        ...entry.apiBaseUrl ? { baseUrl: entry.apiBaseUrl } : {},
+        method: entry.method,
+        path: mapped.path,
+        ...mapped.query ? { query: mapped.query } : {},
+        ...mapped.body !== void 0 ? { body: mapped.body } : {},
+        ...options.resource ? { resource: options.resource } : {},
+        ...resolvedActorEnvelope ? { actorEnvelope: resolvedActorEnvelope } : {},
+        headers: {
+          [TOPOLO_ACTION_ID_HEADER]: entry.actionId,
+          [TOPOLO_ACTION_NAME_HEADER]: entry.name
+        },
+        confirm: options.confirm === true || entry.readOnly && !entry.destructive && !entry.requiresConfirmation
+      });
+    } catch (error) {
+      throw maskActionSecretError(error, this.actionSecrets);
+    }
+    return preserveSensitiveResult ? result : await protectActionResult(result, this.actionSecretStore);
+  }
+  async releaseActionSecret(reference) {
+    if (!this.actionSecretStore) throw new TopoloSdkError("action_secret_store_required", "Protected action references require a secret store.");
+    await this.actionSecretStore.delete(reference);
   }
   async buildVerifiedAgentActorEnvelope(actionId, input2, resource) {
     if (!this.actorContext) return void 0;
@@ -2149,7 +2321,7 @@ function resolveConfiguredAppId(slug, appIds) {
   return null;
 }
 function normalizeApiKeyResourceMetadata(input2) {
-  if (!isRecord3(input2)) return null;
+  if (!isRecord4(input2)) return null;
   const resourceType = readString(input2.resourceType ?? input2.resource_type);
   const label = readString(input2.label);
   const emptyLabel = readString(input2.emptyLabel ?? input2.empty_label);
@@ -2183,7 +2355,7 @@ function normalizeApiKeyResourceMetadataList(input2) {
   return resources;
 }
 function normalizeBindableResource(input2) {
-  if (!isRecord3(input2)) return null;
+  if (!isRecord4(input2)) return null;
   const resourceType = readString(input2.resourceType ?? input2.resource_type);
   const resourceId = readString(input2.resourceId ?? input2.resource_id);
   if (!resourceType || !resourceId) return null;
@@ -2194,13 +2366,13 @@ function normalizeBindableResource(input2) {
     slug: readOptionalString(input2.slug),
     status: readOptionalString(input2.status),
     organizationId: readOptionalString(input2.organizationId ?? input2.organization_id),
-    metadata: isRecord3(input2.metadata) ? input2.metadata : {}
+    metadata: isRecord4(input2.metadata) ? input2.metadata : {}
   };
 }
 function normalizeResourceBindings(input2) {
   if (!Array.isArray(input2)) return [];
   return input2.flatMap((binding) => {
-    if (!isRecord3(binding)) return [];
+    if (!isRecord4(binding)) return [];
     const resourceType = readString(binding.resourceType ?? binding.resource_type);
     const resourceId = readString(binding.resourceId ?? binding.resource_id);
     return resourceType && resourceId ? [{ resourceType, resourceId }] : [];
@@ -2213,30 +2385,9 @@ function readOptionalString(value) {
   const normalized = readString(value);
   return normalized || null;
 }
-function isRecord3(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function redactActionResult(value) {
-  if (Array.isArray(value)) return value.map(redactActionResult);
-  if (!isRecord3(value)) return value;
-  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
-    key,
-    isSensitiveActionResultKey(key, item) ? "[REDACTED]" : redactActionResult(item)
-  ]));
-}
-function isSensitiveActionResultKey(key, value) {
-  const normalized = key.toLowerCase().replace(/[^a-z0-9]/g, "");
-  if (normalized === "capability") return isCredentialShaped(value);
-  return ["authorization", "cookie", "setcookie", "proxyauthorization"].includes(normalized) || /(token|secret|password|privatekey|apikey)$/.test(normalized);
-}
-var PLAIN_ENUM_VALUE = /^[a-z][a-z0-9_-]{0,31}$/;
-function isCredentialShaped(value) {
-  if (typeof value !== "string") return value !== null && value !== void 0 && typeof value !== "boolean" && typeof value !== "number";
-  const trimmed = value.trim();
-  if (!trimmed) return false;
-  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed)) return true;
-  return !PLAIN_ENUM_VALUE.test(trimmed);
-}
 function resolveConfiguredServiceUrl(slug, serviceUrls) {
   for (const serviceKey of serviceKeyCandidates2(slug)) {
     const configured = serviceUrls?.[serviceKey];
@@ -2306,14 +2457,14 @@ function catalogSearchQuery(options) {
   return query;
 }
 function normalizeCatalogPage(value) {
-  if (!isRecord3(value)) return { nextCursor: null, hasMore: false };
+  if (!isRecord4(value)) return { nextCursor: null, hasMore: false };
   return {
     nextCursor: typeof value.nextCursor === "string" && value.nextCursor ? value.nextCursor : null,
     hasMore: value.hasMore === true
   };
 }
 function normalizeServiceCatalogEntry(item) {
-  if (!isRecord3(item)) return null;
+  if (!isRecord4(item)) return null;
   const appId = typeof item.app_id === "string" ? item.app_id : typeof item.id === "string" ? item.id : null;
   if (!appId) return null;
   const permissions = Array.isArray(item.granted_permissions) ? item.granted_permissions.filter(
@@ -3342,11 +3493,13 @@ function createTopolo(options) {
   };
 }
 
-// node_modules/.pnpm/@topolo+sdk@0.21.2/node_modules/@topolo/sdk/dist/node/credential-store.js
+// node_modules/.pnpm/@topolo+sdk@0.22.0/node_modules/@topolo/sdk/dist/node/credential-store.js
 import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2, chmod as chmod2, rm as rm2, stat } from "fs/promises";
 import { existsSync as existsSync2 } from "fs";
 import { homedir as homedir2, platform } from "os";
-import { dirname as dirname2, join as join2 } from "path";
+import { dirname as dirname2, join as join3 } from "path";
+import { createHash, randomUUID } from "crypto";
+import { join as join2 } from "path";
 import { spawnSync } from "child_process";
 import { mkdir, readFile, readdir, rename, rm, writeFile, chmod } from "fs/promises";
 import { existsSync } from "fs";
@@ -3407,6 +3560,9 @@ var PUBLIC_ERROR_CODES2 = /* @__PURE__ */ new Set([
   "unknown_service"
 ]);
 var ERROR_CODE_PATTERN2 = /^[a-z][a-z0-9_]{0,63}$/;
+var SERVICE_ERROR_CODE_PATTERN2 = /^[a-z][a-z0-9]*(?:_[a-z][a-z0-9]*){1,9}$/;
+var SERVICE_MESSAGE_MAX_LENGTH2 = 300;
+var SERVICE_ISSUE_LIMIT2 = 32;
 var TOPOLO_REQUEST_ID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var CLOUDFLARE_RAY_ID_PATTERN2 = /^[0-9a-f]{16}-[A-Z]{3}$/;
 var PERMISSION_PATTERN2 = /^[a-z][a-z0-9_-]{0,63}(?:\.[a-z][a-z0-9_-]{0,63})*:(?:[a-z][a-z0-9_-]{0,63}|\*)$/;
@@ -3431,6 +3587,24 @@ function canonicalTopoloErrorCode2(value) {
   if (!ERROR_CODE_PATTERN2.test(candidate) || !PUBLIC_ERROR_CODES2.has(candidate)) return null;
   return candidate;
 }
+function canonicalTopoloServiceErrorCode2(value) {
+  const platform22 = canonicalTopoloErrorCode2(value);
+  if (platform22) return platform22;
+  if (typeof value !== "string") return null;
+  const candidate = value.trim();
+  if (candidate.length > 64 || !SERVICE_ERROR_CODE_PATTERN2.test(candidate)) return null;
+  const wordLike = candidate.split("_").every((segment) => {
+    const digits = segment.replace(/[a-z]/g, "").length;
+    return digits === 0 || digits < segment.length - digits && segment.length <= 8;
+  });
+  return wordLike ? candidate : null;
+}
+function sanitizeTopoloServiceMessage2(value) {
+  if (typeof value !== "string") return void 0;
+  const text2 = value.replace(/[\u0000-\u001f\u007f-\u009f\u200b-\u200f\u2028-\u202e\u2066-\u2069\ufeff]/g, " ").replace(/\b[a-z][a-z0-9+.-]*:\/\/\S+/gi, "[url]").replace(/[^\s@<>()[\],;:"']+@[^\s@<>()[\],;:"']+\.[a-z]{2,}/gi, "[email]").replace(/[A-Za-z0-9_\-+/=.]{20,}/g, (run) => /[0-9]/.test(run) && /[A-Za-z]/.test(run) ? "[redacted]" : run).replace(/\s+/g, " ").trim();
+  if (!text2) return void 0;
+  return text2.length > SERVICE_MESSAGE_MAX_LENGTH2 ? `${text2.slice(0, SERVICE_MESSAGE_MAX_LENGTH2 - 1).trimEnd()}\u2026` : text2;
+}
 function canonicalTopoloRequestId2(value) {
   if (typeof value !== "string") return void 0;
   const candidate = value.trim();
@@ -3455,7 +3629,7 @@ var TopoloAuthError2 = class extends TopoloSdkError2 {
   retryAfter;
   details;
   constructor(message2, code = "auth_error", options = {}) {
-    super(canonicalTopoloErrorCode2(code) ?? "auth_error", message2);
+    super(canonicalTopoloServiceErrorCode2(code) ?? "auth_error", message2);
     this.name = "TopoloAuthError";
     this.status = options.status ?? 401;
     this.body = options.body;
@@ -3471,14 +3645,14 @@ var TopoloAuthError2 = class extends TopoloSdkError2 {
 function extractTopoloServiceErrorCode2(body) {
   if (!body || typeof body !== "object" || Array.isArray(body)) return null;
   const record2 = body;
-  const topLevel = canonicalTopoloErrorCode2(record2.code);
+  const topLevel = canonicalTopoloServiceErrorCode2(record2.code);
   if (topLevel) return topLevel;
   const nested = record2.error;
-  const nestedString = canonicalTopoloErrorCode2(nested);
+  const nestedString = canonicalTopoloServiceErrorCode2(nested);
   if (nestedString) return nestedString;
   if (nested && typeof nested === "object" && !Array.isArray(nested)) {
     const code = nested.code;
-    const nestedCode = canonicalTopoloErrorCode2(code);
+    const nestedCode = canonicalTopoloServiceErrorCode2(code);
     if (nestedCode) return nestedCode;
   }
   return null;
@@ -3496,10 +3670,7 @@ function extractTopoloServiceErrorDetails2(body) {
     if (candidate === void 0) candidate = nestedRecord.details ?? nestedRecord;
   }
   if (candidate === void 0) candidate = record2;
-  if (Array.isArray(candidate)) {
-    const paths = canonicalTopoloValidationPaths2(candidate);
-    return paths.length ? { paths } : void 0;
-  }
+  if (Array.isArray(candidate)) return validationIssueDetails2(canonicalTopoloValidationIssues2(candidate)) ?? void 0;
   if (!candidate || typeof candidate !== "object") return void 0;
   const source = candidate;
   const safe = {};
@@ -3541,18 +3712,59 @@ function extractTopoloServiceErrorDetails2(body) {
       if (paths.length) safe[key] = paths;
     }
   }
+  const issues = [
+    ...Array.isArray(source.issues) ? canonicalTopoloValidationIssues2(source.issues) : [],
+    ...flattenedValidationIssues2(source.formErrors, source.fieldErrors)
+  ].slice(0, SERVICE_ISSUE_LIMIT2);
+  Object.assign(safe, validationIssueDetails2(issues));
   return Object.keys(safe).length ? safe : void 0;
 }
-function canonicalTopoloValidationPaths2(issues) {
+function validationIssueDetails2(issues) {
+  if (!issues.length) return null;
   const paths = [];
-  for (const issue of issues) {
-    if (!issue || typeof issue !== "object" || Array.isArray(issue)) continue;
-    const record2 = issue;
+  for (const issue22 of issues) {
+    if (issue22.path && !paths.includes(issue22.path)) paths.push(issue22.path);
+  }
+  return paths.length ? { paths, issues } : { issues };
+}
+function issue2(path, message2) {
+  const text2 = sanitizeTopoloServiceMessage2(message2);
+  if (!path && !text2) return null;
+  return { ...path ? { path } : {}, ...text2 ? { message: text2 } : {} };
+}
+function canonicalTopoloValidationIssues2(values) {
+  const issues = [];
+  for (const value of values) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) continue;
+    const record2 = value;
     const path = canonicalTopoloValidationPath2(record2.field) ?? canonicalTopoloValidationPath2(record2.path);
-    if (path && !paths.includes(path)) paths.push(path);
-    if (paths.length === 32) break;
+    if (!path) continue;
+    const projected = issue2(path, record2.message);
+    if (projected) issues.push(projected);
+    if (issues.length === SERVICE_ISSUE_LIMIT2) break;
   }
-  return paths;
+  return issues;
+}
+function flattenedValidationIssues2(formErrors, fieldErrors) {
+  const issues = [];
+  if (Array.isArray(formErrors)) {
+    for (const message2 of formErrors) {
+      const projected = issue2(void 0, message2);
+      if (projected) issues.push(projected);
+    }
+  }
+  if (fieldErrors && typeof fieldErrors === "object" && !Array.isArray(fieldErrors)) {
+    for (const [key, messages] of Object.entries(fieldErrors)) {
+      const path = canonicalTopoloValidationPath2(key);
+      if (!path) continue;
+      const list = Array.isArray(messages) && messages.length ? messages : [void 0];
+      for (const message2 of list) {
+        const projected = issue2(path, message2);
+        if (projected) issues.push(projected);
+      }
+    }
+  }
+  return issues;
 }
 function canonicalTopoloValidationPath2(value) {
   if (typeof value === "string") {
@@ -3698,67 +3910,7 @@ var TopoloOAuth2 = class {
     return parsed;
   }
 };
-var TOPOLO_RUNTIME_ENVIRONMENTS = ["production", "staging", "development", "local"];
-var TOPOLO_ENVIRONMENT_SERVICE_URLS = {
-  production: {
-    auth: "https://auth.topolo.app",
-    developers: "https://developers.topolo.app"
-  },
-  staging: {
-    auth: "https://auth.stg.topolo.us",
-    developers: "https://developers.stg.topolo.us"
-  },
-  development: {
-    auth: "https://auth.topolo.dev",
-    developers: "https://developers.topolo.dev"
-  },
-  local: {}
-};
-function hostnameHasSuffix2(hostname, suffix) {
-  return hostname === suffix || hostname.endsWith(`.${suffix}`);
-}
-function workersDevAccountMatches2(hostname, account) {
-  if (!hostname.endsWith(".workers.dev")) return false;
-  const labels = hostname.slice(0, -".workers.dev".length).split(".");
-  return labels.length >= 2 && labels.at(-1) === account;
-}
-function originMatchesEnvironment2(url, environment) {
-  const hostname = url.hostname.toLowerCase();
-  if (environment === "local") {
-    return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "[::1]";
-  }
-  if (url.protocol !== "https:") return false;
-  if (environment === "production") {
-    return hostnameHasSuffix2(hostname, "topolo.app") || hostnameHasSuffix2(hostname, "topolo.io") || hostname === "api.ol0.me" || workersDevAccountMatches2(hostname, "topolo");
-  }
-  if (environment === "staging") {
-    return hostnameHasSuffix2(hostname, "stg.topolo.us") || workersDevAccountMatches2(hostname, "topolo-staging");
-  }
-  return hostnameHasSuffix2(hostname, "topolo.dev") || workersDevAccountMatches2(hostname, "topolo-development");
-}
-function assertTopoloServiceUrlEnvironment2(service, value, environment) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new TopoloSdkError2("invalid_service_url", `Invalid URL configured for Topolo service "${service}".`);
-  }
-  if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password || !originMatchesEnvironment2(url, environment)) {
-    throw new TopoloSdkError2(
-      "environment_mismatch",
-      `Refusing Topolo service "${service}": ${url.origin} does not belong to ${environment}.`
-    );
-  }
-  return url.origin;
-}
-function topoloServiceOrigins2(serviceUrls, environment) {
-  return Object.fromEntries(
-    Object.entries(serviceUrls ?? {}).sort(([left], [right]) => left.localeCompare(right)).map(([service, value]) => [
-      service,
-      assertTopoloServiceUrlEnvironment2(service, value, environment)
-    ])
-  );
-}
+var ACTION_SECRET_PREFIX2 = "topolo-secret:";
 var KEYCHAIN_SERVICE = "topolo-external-agent-installation";
 var MACOS_KEYCHAIN_CHUNK_SIZE = 96;
 var MACOS_KEYCHAIN_CHUNK_PREFIX = "topolo-keychain-chunks:v1:";
@@ -3801,6 +3953,7 @@ function createPlatformInstallationSecretBackend(options = {}) {
   const platform22 = options.platform ?? hostPlatform();
   const spawn3 = options.spawn ?? ((command, args, spawnOptions) => spawnSync(command, args, spawnOptions));
   const root = options.root ?? installationStorePath();
+  const service = options.service ?? KEYCHAIN_SERVICE;
   if (platform22 === "darwin") {
     const write = (account, value) => runOrThrow(spawn3("/usr/bin/expect", ["-c", MACOS_KEYCHAIN_WRITE_SCRIPT], {
       input: `${value}
@@ -3809,7 +3962,7 @@ function createPlatformInstallationSecretBackend(options = {}) {
       env: {
         ...process.env,
         TOPOLO_KEYCHAIN_ACCOUNT: account,
-        TOPOLO_KEYCHAIN_SERVICE: KEYCHAIN_SERVICE
+        TOPOLO_KEYCHAIN_SERVICE: service
       }
     }), "macOS Keychain write");
     const read = (account) => {
@@ -3818,7 +3971,7 @@ function createPlatformInstallationSecretBackend(options = {}) {
         "-a",
         account,
         "-s",
-        KEYCHAIN_SERVICE,
+        service,
         "-w"
       ], { encoding: "utf8" });
       if (result.status === 44) return null;
@@ -3830,7 +3983,7 @@ function createPlatformInstallationSecretBackend(options = {}) {
         "-a",
         account,
         "-s",
-        KEYCHAIN_SERVICE
+        service
       ], { encoding: "utf8" });
       if (result.status !== 44) runOrThrow(result, "macOS Keychain delete");
     };
@@ -3877,9 +4030,9 @@ function createPlatformInstallationSecretBackend(options = {}) {
       async set(account, value) {
         runOrThrow(spawn3("secret-tool", [
           "store",
-          "--label=Topolo external agent installation",
+          "--label=Topolo protected credential",
           "service",
-          KEYCHAIN_SERVICE,
+          service,
           "account",
           account
         ], { input: value, encoding: "utf8" }), "Linux Secret Service write");
@@ -3888,7 +4041,7 @@ function createPlatformInstallationSecretBackend(options = {}) {
         const result = spawn3("secret-tool", [
           "lookup",
           "service",
-          KEYCHAIN_SERVICE,
+          service,
           "account",
           account
         ], { encoding: "utf8" });
@@ -3899,7 +4052,7 @@ function createPlatformInstallationSecretBackend(options = {}) {
         const result = spawn3("secret-tool", [
           "clear",
           "service",
-          KEYCHAIN_SERVICE,
+          service,
           "account",
           account
         ], { encoding: "utf8" });
@@ -3961,6 +4114,114 @@ async function deleteExternalAgentInstallation(environment, id, backend = create
   await backend.delete(accountName(environment, id));
   await rm(installationPath(environment, id), { force: true });
 }
+function createProtectedActionSecretStore(options) {
+  const backend = options.backend ?? createPlatformInstallationSecretBackend({
+    service: "topolo-action-handoff",
+    root: join2(installationStorePath(), "action-handoff")
+  });
+  const now = options.now ?? Date.now;
+  async function account(reference) {
+    if (!/^topolo-secret:[0-9a-f-]{36}$/.test(reference)) throw new TopoloSdkError2("invalid_action_secret_reference", "Invalid protected action reference.");
+    const identity = await options.identity();
+    if (!identity.user.id) throw new TopoloSdkError2("action_secret_identity_required", "A verified identity is required for protected action handoff.");
+    if (identity.kind === "api_key" && !identity.apiKey?.id) throw new TopoloSdkError2("action_secret_identity_required", "A verified API key identity is required for protected action handoff.");
+    const scope = createHash("sha256").update(JSON.stringify([
+      options.environment,
+      identity.user.principalId ?? identity.user.id,
+      identity.organization?.id ?? null,
+      identity.apiKey?.id ?? null
+    ])).digest("hex");
+    return `${scope}-${reference.slice(ACTION_SECRET_PREFIX2.length)}`;
+  }
+  return {
+    async save(value) {
+      const reference = `${ACTION_SECRET_PREFIX2}${randomUUID()}`;
+      await backend.set(await account(reference), JSON.stringify({ value, expiresAt: now() + 30 * 60 * 1e3 }));
+      return reference;
+    },
+    async load(reference) {
+      const key = await account(reference);
+      const encoded = await backend.get(key);
+      if (!encoded) throw new TopoloSdkError2("action_secret_unavailable", "Protected action reference is missing or belongs to another identity or environment.");
+      let record2;
+      try {
+        record2 = JSON.parse(encoded);
+      } catch {
+        throw new TopoloSdkError2("action_secret_invalid", "Protected action reference is corrupt.");
+      }
+      if (!Number.isFinite(record2?.expiresAt) || !Object.hasOwn(record2, "value")) throw new TopoloSdkError2("action_secret_invalid", "Protected action reference is corrupt.");
+      if (record2.expiresAt <= now()) {
+        await backend.delete(key);
+        throw new TopoloSdkError2("action_secret_expired", "Protected action reference expired. Repeat the originating action if its contract permits.");
+      }
+      return record2.value;
+    },
+    async delete(reference) {
+      await backend.delete(await account(reference));
+    }
+  };
+}
+var TOPOLO_RUNTIME_ENVIRONMENTS = ["production", "staging", "development", "local"];
+var TOPOLO_ENVIRONMENT_SERVICE_URLS = {
+  production: {
+    auth: "https://auth.topolo.app",
+    developers: "https://developers.topolo.app"
+  },
+  staging: {
+    auth: "https://auth.stg.topolo.us",
+    developers: "https://developers.stg.topolo.us"
+  },
+  development: {
+    auth: "https://auth.topolo.dev",
+    developers: "https://developers.topolo.dev"
+  },
+  local: {}
+};
+function hostnameHasSuffix2(hostname, suffix) {
+  return hostname === suffix || hostname.endsWith(`.${suffix}`);
+}
+function workersDevAccountMatches2(hostname, account) {
+  if (!hostname.endsWith(".workers.dev")) return false;
+  const labels = hostname.slice(0, -".workers.dev".length).split(".");
+  return labels.length >= 2 && labels.at(-1) === account;
+}
+function originMatchesEnvironment2(url, environment) {
+  const hostname = url.hostname.toLowerCase();
+  if (environment === "local") {
+    return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "[::1]";
+  }
+  if (url.protocol !== "https:") return false;
+  if (environment === "production") {
+    return hostnameHasSuffix2(hostname, "topolo.app") || hostnameHasSuffix2(hostname, "topolo.io") || hostname === "api.ol0.me" || workersDevAccountMatches2(hostname, "topolo");
+  }
+  if (environment === "staging") {
+    return hostnameHasSuffix2(hostname, "stg.topolo.us") || workersDevAccountMatches2(hostname, "topolo-staging");
+  }
+  return hostnameHasSuffix2(hostname, "topolo.dev") || workersDevAccountMatches2(hostname, "topolo-development");
+}
+function assertTopoloServiceUrlEnvironment2(service, value, environment) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new TopoloSdkError2("invalid_service_url", `Invalid URL configured for Topolo service "${service}".`);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password || !originMatchesEnvironment2(url, environment)) {
+    throw new TopoloSdkError2(
+      "environment_mismatch",
+      `Refusing Topolo service "${service}": ${url.origin} does not belong to ${environment}.`
+    );
+  }
+  return url.origin;
+}
+function topoloServiceOrigins2(serviceUrls, environment) {
+  return Object.fromEntries(
+    Object.entries(serviceUrls ?? {}).sort(([left], [right]) => left.localeCompare(right)).map(([service, value]) => [
+      service,
+      assertTopoloServiceUrlEnvironment2(service, value, environment)
+    ])
+  );
+}
 var TOPOLO_ENVIRONMENTS = TOPOLO_RUNTIME_ENVIRONMENTS;
 function contextKey(contextType, organizationId) {
   return contextType === "organization" && organizationId ? `org:${organizationId}` : "personal";
@@ -3969,8 +4230,8 @@ var ENVIRONMENT_DEFAULT_SERVICE_URLS = TOPOLO_ENVIRONMENT_SERVICE_URLS;
 function configPath() {
   const override = process.env.TOPOLO_CONFIG_PATH;
   if (override) return override;
-  const base = process.env.XDG_CONFIG_HOME || (platform() === "win32" ? join2(homedir2(), "AppData", "Roaming") : join2(homedir2(), ".config"));
-  return join2(base, "topolo", "config.json");
+  const base = process.env.XDG_CONFIG_HOME || (platform() === "win32" ? join3(homedir2(), "AppData", "Roaming") : join3(homedir2(), ".config"));
+  return join3(base, "topolo", "config.json");
 }
 async function readConfig() {
   const path = configPath();
@@ -4337,6 +4598,10 @@ function fail2(err, mode) {
 `);
     if (payload.status) process.stderr.write(`HTTP:  ${payload.status}
 `);
+    for (const issue3 of validationIssues(payload.details)) {
+      process.stderr.write(`Issue: ${[issue3.path, issue3.message].filter(Boolean).join(": ")}
+`);
+    }
     if (payload.requestId) process.stderr.write(`Request: ${payload.requestId}
 `);
     if (payload.hint) process.stderr.write(`Hint:  ${payload.hint}
@@ -4344,6 +4609,10 @@ function fail2(err, mode) {
   }
   process.exit(payload.exitCode);
 }
+function validationIssues(details) {
+  const issues = details?.issues;
+  return Array.isArray(issues) ? issues : [];
+}
 function normalizeError(err) {
   if (err instanceof Error) {
     const code = err.code;
@@ -4361,9 +4630,9 @@ function normalizeError(err) {
       path: err.path,
       requestId: err.requestId,
       retryAfter: err.retryAfter,
-      details: extractTopoloServiceErrorDetails(
-        suppliedDetails === void 0 ? body : { details: suppliedDetails }
-      ),
+      // SDK HTTP errors already carry sanitized details; projecting them again
+      // would drop form-level issues that have no field path.
+      details: err instanceof TopoloHttpError || err instanceof TopoloAuthError || err instanceof TopoloPermissionError ? err.details : extractTopoloServiceErrorDetails(suppliedDetails === void 0 ? body : { details: suppliedDetails }),
       hint: topoloErrorHint({ code, body }) ?? (code ? fallbackHintMap[code] : void 0),
       exitCode: status === 401 || code === "auth_error" || code === "confirmation_required" ? 2 : status === 403 || code === "permission_denied" ? 3 : code === "immutable_drift" ? 4 : 1
     };
@@ -4373,14 +4642,14 @@ function normalizeError(err) {
 
 // src/version.ts
 import { readFileSync } from "fs";
-import { dirname as dirname3, join as join3 } from "path";
+import { dirname as dirname3, join as join4 } from "path";
 import { fileURLToPath } from "url";
 function readCliVersion() {
   try {
     const here = dirname3(fileURLToPath(import.meta.url));
     const candidates = [
-      join3(here, "package.json"),
-      join3(here, "..", "package.json")
+      join4(here, "package.json"),
+      join4(here, "..", "package.json")
     ];
     for (const path of candidates) {
       try {
@@ -4667,9 +4936,10 @@ async function buildClient(options) {
   if (!credential) return null;
   const config = await readConfig();
   const profile = resolvedProfileConfig(config, environment);
-  return createTopolo({
+  const topolo = createTopolo({
     credential,
     environment,
+    actionSecretStore: createProtectedActionSecretStore({ environment, identity: () => topolo.client.introspect() }),
     actorContext: { channel: "cli" },
     agent: {
       clientName: "topolo-cli",
@@ -4683,6 +4953,7 @@ async function buildClient(options) {
     } : {},
     ...isDebugEnabled() ? { debug: stderrDebugLogger } : {}
   });
+  return topolo;
 }
 function isDebugEnabled() {
   const v = process.env.TOPOLO_DEBUG;
@@ -4706,7 +4977,7 @@ function stderrDebugLogger(event) {
     return;
   }
   const statusPart = event.status ? ` ${event.status}` : "";
-  const errorCode = canonicalTopoloErrorCode(event.error) ?? "request_failed";
+  const errorCode = canonicalTopoloServiceErrorCode(event.error) ?? "request_failed";
   process.stderr.write(
     `[topolo] \u2717${statusPart} ${event.method} ${event.service} ${event.path} (${event.durationMs}ms, req=${requestId}, code=${errorCode})
 `
@@ -4878,6 +5149,18 @@ function registerActionsCommand(program2) {
       fail2(err, mode);
     }
   });
+  actions.command("release-secret <reference>").description("Delete a local protected action reference for the current verified identity and environment").option("--confirm", "Acknowledge local reference deletion; does not revoke the upstream credential").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (reference, opts, command) => {
+    const mode = resolveOutputMode(opts.json ?? command.parent?.opts().json);
+    try {
+      if (opts.confirm !== true) throw new Error("Releasing a protected action reference requires --confirm.");
+      const topolo = await buildClient();
+      if (!topolo) throw new Error("No credential configured. Run `topolo auth login`.");
+      await topolo.client.releaseActionSecret(reference);
+      emit({ released: true }, mode, () => "Protected action reference released.");
+    } catch (error) {
+      fail2(error, mode);
+    }
+  });
   actions.command("get <action>").description("Describe one Topolo action by exact action id").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (action, opts, command) => {
     const mode = resolveOutputMode(opts.json ?? command.parent?.opts().json);
     try {
@@ -4948,7 +5231,7 @@ Approval required. ${opened ? "Opening" : "Open"} ${approval.verificationUrl}` :
       const topolo = await requiredClient();
       const result = await topolo.client.validateActionInput(action, parseJsonObject(opts.data || "{}"));
       const output = detailRequested(opts.detail, command) ? result : compactActionValidation(result.action.actionId, result.validation);
-      emit(output, mode, () => result.validation.valid ? `Valid input for ${result.action.actionId}.` : result.validation.errors.map((issue) => `${issue.path}: ${issue.message}`).join("\n"));
+      emit(output, mode, () => result.validation.valid ? `Valid input for ${result.action.actionId}.` : result.validation.errors.map((issue3) => `${issue3.path}: ${issue3.message}`).join("\n"));
     } catch (err) {
       fail2(err, mode);
     }
@@ -5228,7 +5511,7 @@ function formatActionPlan(plan) {
   ];
   if (plan.request) lines.push(`Request:      ${plan.request.method} ${plan.request.apiBaseUrl || plan.request.service}${plan.request.path}`);
   if (plan.request?.resource) lines.push(`Resource:     ${plan.request.resource.resourceType}:${plan.request.resource.resourceId}`);
-  if (plan.validation.errors.length) lines.push("", ...plan.validation.errors.map((issue) => `${issue.path}: ${issue.message}`));
+  if (plan.validation.errors.length) lines.push("", ...plan.validation.errors.map((issue3) => `${issue3.path}: ${issue3.message}`));
   if (plan.verification.length) lines.push("", "Verify:", ...plan.verification.map((step) => `- ${step}`));
   if (plan.rollbackActionId) lines.push("", `Rollback: ${plan.rollbackActionId}`);
   return lines.join("\n");
@@ -5523,7 +5806,7 @@ function normalizeList(values, fallback = []) {
 
 // src/commands/integrations.ts
 import { readdir as readdir2, readFile as readFile3, stat as stat2 } from "fs/promises";
-import { join as join4, relative } from "path";
+import { join as join5, relative } from "path";
 function registerIntegrationsCommand(program2) {
   const integrations = program2.command("integrations").description("Generate and validate Topolo integration handoffs.");
   integrations.command("prompt").description("Print an agent prompt for adding a Topolo integration.").argument("<integration>", "Integration prompt id, currently login-with-topolo").option("--framework <framework>", "auto, authjs, express, or generic", "auto").option("--json", "Emit JSON output").action((integration, options) => {
@@ -5666,7 +5949,7 @@ function detectFramework(packageJson, haystack) {
 }
 async function readPackageJson(repoRoot) {
   try {
-    return JSON.parse(await readFile3(join4(repoRoot, "package.json"), "utf8"));
+    return JSON.parse(await readFile3(join5(repoRoot, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -5678,7 +5961,7 @@ async function collectFiles(repoRoot) {
     if (result.length > 2e3) return;
     const entries = await readdir2(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = join4(dir, entry.name);
+      const fullPath = join5(dir, entry.name);
       if (entry.isDirectory()) {
         if ([".git", "node_modules", "dist", "build", ".next", "coverage"].includes(entry.name)) continue;
         await walk(fullPath);
@@ -5709,7 +5992,7 @@ import { spawnSync as spawnSync3 } from "child_process";
 import { existsSync as existsSync5 } from "fs";
 import { readFile as readFile6, rm as rm3 } from "fs/promises";
 import { homedir as homedir4 } from "os";
-import { dirname as dirname5, join as join6, resolve } from "path";
+import { dirname as dirname5, join as join7, resolve } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { createRequire } from "module";
 
@@ -5718,7 +6001,7 @@ import { spawnSync as spawnSync2 } from "child_process";
 import { existsSync as existsSync3 } from "fs";
 import { readFile as readFile4 } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import { isAbsolute, join as join5 } from "path";
+import { isAbsolute, join as join6 } from "path";
 var SUPPORTED_AGENT_IDS = [
   "claude",
   "claude-desktop",
@@ -5776,23 +6059,23 @@ function stableNodeCommand() {
 function agentSkillPath(agent, homeDir = homedir3(), projectDir) {
   switch (agent) {
     case "claude":
-      return projectDir ? join5(projectDir, ".claude", "skills", "topolo", "SKILL.md") : join5(homeDir, ".claude", "skills", "topolo", "SKILL.md");
+      return projectDir ? join6(projectDir, ".claude", "skills", "topolo", "SKILL.md") : join6(homeDir, ".claude", "skills", "topolo", "SKILL.md");
     case "claude-desktop":
-      return join5(homeDir, ".claude", "skills", "topolo", "SKILL.md");
+      return join6(homeDir, ".claude", "skills", "topolo", "SKILL.md");
     case "codex":
-      return join5(homeDir, ".codex", "skills", "topolo", "SKILL.md");
+      return join6(homeDir, ".codex", "skills", "topolo", "SKILL.md");
     case "cursor":
-      return join5(projectDir ?? homeDir, ".cursor", "rules", "topolo.mdc");
+      return join6(projectDir ?? homeDir, ".cursor", "rules", "topolo.mdc");
     case "grok":
-      return join5(projectDir ?? homeDir, ".grok", "skills", "topolo", "SKILL.md");
+      return join6(projectDir ?? homeDir, ".grok", "skills", "topolo", "SKILL.md");
     case "gemini":
-      return join5(projectDir ?? homeDir, ".gemini", "skills", "topolo", "SKILL.md");
+      return join6(projectDir ?? homeDir, ".gemini", "skills", "topolo", "SKILL.md");
     case "copilot":
-      return projectDir ? join5(projectDir, ".github", "skills", "topolo", "SKILL.md") : join5(homeDir, ".copilot", "skills", "topolo", "SKILL.md");
+      return projectDir ? join6(projectDir, ".github", "skills", "topolo", "SKILL.md") : join6(homeDir, ".copilot", "skills", "topolo", "SKILL.md");
     case "windsurf":
-      return projectDir ? join5(projectDir, ".windsurf", "rules", "topolo.md") : void 0;
+      return projectDir ? join6(projectDir, ".windsurf", "rules", "topolo.md") : void 0;
     case "cline":
-      return join5(projectDir ?? homeDir, ".cline", "skills", "topolo", "SKILL.md");
+      return join6(projectDir ?? homeDir, ".cline", "skills", "topolo", "SKILL.md");
     case "goose":
     case "amazon-q":
       return void 0;
@@ -5801,7 +6084,7 @@ function agentSkillPath(agent, homeDir = homedir3(), projectDir) {
 function agentConfigPaths(agent, homeDir = homedir3(), projectDir) {
   switch (agent) {
     case "claude":
-      return [{ path: join5(homeDir, ".claude.json"), format: "json", rootKey: "mcpServers" }];
+      return [{ path: join6(homeDir, ".claude.json"), format: "json", rootKey: "mcpServers" }];
     case "claude-desktop":
       return [{
         path: claudeDesktopConfigPath(homeDir),
@@ -5809,31 +6092,31 @@ function agentConfigPaths(agent, homeDir = homedir3(), projectDir) {
         rootKey: "mcpServers"
       }];
     case "codex":
-      return [{ path: join5(homeDir, ".codex", "config.toml"), format: "toml" }];
+      return [{ path: join6(homeDir, ".codex", "config.toml"), format: "toml" }];
     case "cursor":
       return [{
-        path: projectDir ? join5(projectDir, ".cursor", "mcp.json") : join5(homeDir, ".cursor", "mcp.json"),
+        path: projectDir ? join6(projectDir, ".cursor", "mcp.json") : join6(homeDir, ".cursor", "mcp.json"),
         format: "json",
         rootKey: "mcpServers"
       }];
     case "grok":
       return [{
-        path: projectDir ? join5(projectDir, ".grok", "config.toml") : join5(homeDir, ".grok", "config.toml"),
+        path: projectDir ? join6(projectDir, ".grok", "config.toml") : join6(homeDir, ".grok", "config.toml"),
         format: "toml"
       }];
     case "gemini":
       return [{
-        path: projectDir ? join5(projectDir, ".gemini", "settings.json") : join5(homeDir, ".gemini", "settings.json"),
+        path: projectDir ? join6(projectDir, ".gemini", "settings.json") : join6(homeDir, ".gemini", "settings.json"),
         format: "json",
         rootKey: "mcpServers"
       }];
     case "copilot":
       return projectDir ? [
-        { path: join5(projectDir, ".mcp.json"), format: "json", rootKey: "mcpServers" },
-        { path: join5(projectDir, ".vscode", "mcp.json"), format: "json", rootKey: "servers" }
+        { path: join6(projectDir, ".mcp.json"), format: "json", rootKey: "mcpServers" },
+        { path: join6(projectDir, ".vscode", "mcp.json"), format: "json", rootKey: "servers" }
       ] : [
         {
-          path: join5(homeDir, ".copilot", "mcp-config.json"),
+          path: join6(homeDir, ".copilot", "mcp-config.json"),
           format: "json",
           rootKey: "mcpServers"
         },
@@ -5841,24 +6124,24 @@ function agentConfigPaths(agent, homeDir = homedir3(), projectDir) {
       ];
     case "windsurf":
       return [{
-        path: join5(homeDir, ".codeium", "windsurf", "mcp_config.json"),
+        path: join6(homeDir, ".codeium", "windsurf", "mcp_config.json"),
         format: "json",
         rootKey: "mcpServers"
       }];
     case "cline":
       return [{
-        path: projectDir ? join5(projectDir, ".cline", "mcp.json") : join5(homeDir, ".cline", "mcp.json"),
+        path: projectDir ? join6(projectDir, ".cline", "mcp.json") : join6(homeDir, ".cline", "mcp.json"),
         format: "json",
         rootKey: "mcpServers"
       }];
     case "goose":
-      return [{ path: join5(homeDir, ".config", "goose", "config.yaml"), format: "yaml" }];
+      return [{ path: join6(homeDir, ".config", "goose", "config.yaml"), format: "yaml" }];
     case "amazon-q":
       if (projectDir) {
-        return [{ path: join5(projectDir, ".amazonq", "mcp.json"), format: "json", rootKey: "mcpServers" }];
+        return [{ path: join6(projectDir, ".amazonq", "mcp.json"), format: "json", rootKey: "mcpServers" }];
       }
       return [{
-        path: existsSync3(join5(homeDir, ".aws", "amazonq", "mcp.json")) ? join5(homeDir, ".aws", "amazonq", "mcp.json") : join5(homeDir, ".aws", "amazonq", "default.json"),
+        path: existsSync3(join6(homeDir, ".aws", "amazonq", "mcp.json")) ? join6(homeDir, ".aws", "amazonq", "mcp.json") : join6(homeDir, ".aws", "amazonq", "default.json"),
         format: "json",
         rootKey: "mcpServers"
       }];
@@ -5894,14 +6177,14 @@ function agentConfigExists(agent, homeDir = homedir3(), projectDir) {
   return agentConfigPaths(agent, homeDir, projectDir).some((config) => existsSync3(config.path));
 }
 function claudeDesktopConfigPath(homeDir) {
-  if (process.platform === "darwin") return join5(homeDir, "Library", "Application Support", "Claude", "claude_desktop_config.json");
-  if (process.platform === "win32") return join5(process.env.APPDATA ?? join5(homeDir, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
-  return join5(process.env.XDG_CONFIG_HOME ?? join5(homeDir, ".config"), "Claude", "claude_desktop_config.json");
+  if (process.platform === "darwin") return join6(homeDir, "Library", "Application Support", "Claude", "claude_desktop_config.json");
+  if (process.platform === "win32") return join6(process.env.APPDATA ?? join6(homeDir, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
+  return join6(process.env.XDG_CONFIG_HOME ?? join6(homeDir, ".config"), "Claude", "claude_desktop_config.json");
 }
 function vscodeUserConfigPath(homeDir) {
-  if (process.platform === "darwin") return join5(homeDir, "Library", "Application Support", "Code", "User", "mcp.json");
-  if (process.platform === "win32") return join5(process.env.APPDATA ?? join5(homeDir, "AppData", "Roaming"), "Code", "User", "mcp.json");
-  return join5(process.env.XDG_CONFIG_HOME ?? join5(homeDir, ".config"), "Code", "User", "mcp.json");
+  if (process.platform === "darwin") return join6(homeDir, "Library", "Application Support", "Code", "User", "mcp.json");
+  if (process.platform === "win32") return join6(process.env.APPDATA ?? join6(homeDir, "AppData", "Roaming"), "Code", "User", "mcp.json");
+  return join6(process.env.XDG_CONFIG_HOME ?? join6(homeDir, ".config"), "Code", "User", "mcp.json");
 }
 async function readAgentRegistrations(agent, homeDir = homedir3(), projectDir) {
   const registrations = [];
@@ -6359,7 +6642,7 @@ function skillsSourceDir() {
   const distCandidate = resolve(here, "../skills");
   const srcCandidate = resolve(here, "../../skills");
   for (const candidate of [distCandidate, srcCandidate]) {
-    if (existsSync5(join6(candidate, "topolo", "SKILL.md"))) return candidate;
+    if (existsSync5(join7(candidate, "topolo", "SKILL.md"))) return candidate;
   }
   return distCandidate;
 }
@@ -6402,7 +6685,7 @@ function resolveMcpRegistration(options) {
   return { name, ...context ? { context } : {}, environment, ...installationId ? { installationId } : {} };
 }
 async function installForAgent(agent, sourceDir, mcp, opts) {
-  const source = await readFile6(join6(sourceDir, "topolo", "SKILL.md"), "utf8");
+  const source = await readFile6(join7(sourceDir, "topolo", "SKILL.md"), "utf8");
   const skill = await installAgentSkill(agent, source, opts.homeDir, opts.projectDir);
   if (!opts.withMcp) {
     return { agent, skillPath: skill.path, skillInstalled: skill.installed, mcp: "skipped" };
@@ -6498,7 +6781,7 @@ function registerSkillsCommand(program2) {
 }
 async function installAgentSurfaces(opts) {
   const sourceDir = skillsSourceDir();
-  if (!existsSync5(join6(sourceDir, "topolo", "SKILL.md"))) {
+  if (!existsSync5(join7(sourceDir, "topolo", "SKILL.md"))) {
     throw new Error("Bundled skill file not found. Reinstall the CLI: npm install -g @topolo/cli");
   }
   const mcp = resolveMcpCommand();
@@ -6539,7 +6822,7 @@ function assertAgentSetupSucceeded(results) {
 }
 async function agentSurfaceStatus(options = {}) {
   const homeDir = options.homeDir ?? homedir4();
-  const sourceSkill = await readFile6(join6(skillsSourceDir(), "topolo", "SKILL.md"), "utf8");
+  const sourceSkill = await readFile6(join7(skillsSourceDir(), "topolo", "SKILL.md"), "utf8");
   const agents = resolveTargets({
     agent: options.agent,
     all: options.all,