@topolo/cli 0.12.19 → 0.12.21

package/dist/index.js

@@ -10,6 +10,23 @@ import { createInterface } from "readline/promises";
 import { stdin as input } from "process";
 
 // node_modules/@topolo/sdk/dist/index.js
+function record(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function strings(value) {
+  return Array.isArray(value) && value.length > 0 && value.every((entry) => typeof entry === "string" && entry.trim().length > 0) && new Set(value).size === value.length;
+}
+function validTopoloActionAccessPolicy(value) {
+  if (!record(value) || Object.keys(value).some((key) => key !== "human" && key !== "service") || !value.human && !value.service) return false;
+  if (value.human !== void 0) {
+    const human = value.human;
+    if (!record(human) || Object.keys(human).some((key) => !["organizationId", "permissionAnyOf", "platformAccess"].includes(key)) || Object.keys(human).length === 0 || human.organizationId !== void 0 && (typeof human.organizationId !== "string" || !human.organizationId.trim()) || human.permissionAnyOf !== void 0 && !strings(human.permissionAnyOf) || human.platformAccess !== void 0 && !["platform_admin", "platform_super_admin"].includes(String(human.platformAccess))) return false;
+  }
+  if (value.service !== void 0) {
+    if (!record(value.service) || Object.keys(value.service).some((key) => key !== "scopeAnyOf") || !strings(value.service.scopeAnyOf)) return false;
+  }
+  return true;
+}
 function applyAuthHeaders(headers, credential) {
   if (credential.kind === "api_key") {
     headers.set("X-Api-Key", credential.apiKey);
@@ -194,10 +211,10 @@ var TopoloPermissionError = class extends TopoloSdkError {
 };
 function extractTopoloServiceErrorCode(body) {
   if (!body || typeof body !== "object" || Array.isArray(body)) return null;
-  const record3 = body;
-  const topLevel = canonicalTopoloServiceErrorCode(record3.code);
+  const record4 = body;
+  const topLevel = canonicalTopoloServiceErrorCode(record4.code);
   if (topLevel) return topLevel;
-  const nested = record3.error;
+  const nested = record4.error;
   const nestedString = canonicalTopoloServiceErrorCode(nested);
   if (nestedString) return nestedString;
   if (nested && typeof nested === "object" && !Array.isArray(nested)) {
@@ -209,13 +226,13 @@ function extractTopoloServiceErrorCode(body) {
 }
 function extractTopoloServiceErrorMessage(body) {
   if (!body || typeof body !== "object" || Array.isArray(body)) return void 0;
-  const record3 = body;
-  const nested = record3.error;
+  const record4 = body;
+  const nested = record4.error;
   const candidates = [];
   if (nested && typeof nested === "object" && !Array.isArray(nested)) {
     candidates.push(nested.message);
   }
-  candidates.push(record3.message, record3.error_description);
+  candidates.push(record4.message, record4.error_description);
   if (typeof nested === "string" && !canonicalTopoloServiceErrorCode(nested)) candidates.push(nested);
   for (const candidate of candidates) {
     const message2 = sanitizeTopoloServiceMessage(candidate);
@@ -228,14 +245,14 @@ function serviceErrorCode(body, fallback) {
 }
 function extractTopoloServiceErrorDetails(body) {
   if (!body || typeof body !== "object" || Array.isArray(body)) return void 0;
-  const record3 = body;
-  let candidate = record3.details;
-  const nested = record3.error;
+  const record4 = body;
+  let candidate = record4.details;
+  const nested = record4.error;
   if (nested && typeof nested === "object" && !Array.isArray(nested)) {
     const nestedRecord = nested;
     if (candidate === void 0) candidate = nestedRecord.details ?? nestedRecord;
   }
-  if (candidate === void 0) candidate = record3;
+  if (candidate === void 0) candidate = record4;
   if (Array.isArray(candidate)) return validationIssueDetails(canonicalTopoloValidationIssues(candidate)) ?? void 0;
   if (!candidate || typeof candidate !== "object") return void 0;
   const source = candidate;
@@ -302,10 +319,10 @@ function canonicalTopoloValidationIssues(values) {
   const issues = [];
   for (const value of values) {
     if (!value || typeof value !== "object" || Array.isArray(value)) continue;
-    const record3 = value;
-    const path = canonicalTopoloValidationPath(record3.field) ?? canonicalTopoloValidationPath(record3.path);
+    const record4 = value;
+    const path = canonicalTopoloValidationPath(record4.field) ?? canonicalTopoloValidationPath(record4.path);
     if (!path) continue;
-    const projected = issue(path, record3.message);
+    const projected = issue(path, record4.message);
     if (projected) issues.push(projected);
     if (issues.length === SERVICE_ISSUE_LIMIT) break;
   }
@@ -466,6 +483,7 @@ async function resolveActionSecrets(value, store, secrets) {
 async function protectActionResult(value, store, options = {}) {
   const secrets = /* @__PURE__ */ new Map();
   function documentation(item, key) {
+    if (options.preserveActionSchemas === true && ["inputSchema", "outputSchema", "input_schema", "output_schema"].includes(key) && isRecord(item)) return true;
     return options.preserveAgentGuidance === true && key === "agentGuidance" && isRecord(item) && item.schemaVersion === 1 && typeof item.kind === "string" && ["action-guide", "product-guide", "concept"].includes(item.kind);
   }
   async function protect(item, key = "") {
@@ -796,14 +814,25 @@ function validateNode(schema, value, path, root, errors, depth) {
       validateNode(selected, value, path, root, errors, depth + 1);
     }
   }
-  if (Array.isArray(schema.anyOf) && !schema.anyOf.some((candidate) => candidateMatches(candidate, value, root, depth))) {
-    errors.push({ path, code: "any_of", message: "Value does not match any allowed schema." });
-    return;
+  if (Array.isArray(schema.anyOf)) {
+    const alternatives = [];
+    const matches = schema.anyOf.some((candidate) => {
+      const issues = candidateIssues(candidate, value, path, root, depth);
+      alternatives.push(issues);
+      return issues?.length === 0;
+    });
+    if (!matches) {
+      errors.push({ path, code: "any_of", message: "Value does not match any allowed schema." });
+      appendAlternativeIssues(alternatives, errors);
+      return;
+    }
   }
   if (Array.isArray(schema.oneOf)) {
-    const matches = schema.oneOf.filter((candidate) => candidateMatches(candidate, value, root, depth)).length;
+    const alternatives = schema.oneOf.map((candidate) => candidateIssues(candidate, value, path, root, depth));
+    const matches = alternatives.filter((issues) => issues?.length === 0).length;
     if (matches !== 1) {
       errors.push({ path, code: "one_of", message: "Value must match exactly one allowed schema." });
+      if (matches === 0) appendAlternativeIssues(alternatives, errors);
       return;
     }
   }
@@ -905,10 +934,22 @@ function validateNumber(schema, value, path, errors) {
   }
 }
 function candidateMatches(candidate, value, root, depth) {
-  if (!isRecord2(candidate)) return false;
+  return candidateIssues(candidate, value, "$", root, depth)?.length === 0;
+}
+function candidateIssues(candidate, value, path, root, depth) {
+  if (!isRecord2(candidate)) return null;
   const issues = [];
-  validateNode(candidate, value, "$", root, issues, depth + 1);
-  return issues.length === 0;
+  validateNode(candidate, value, path, root, issues, depth + 1);
+  return issues;
+}
+function appendAlternativeIssues(alternatives, errors) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const issue22 of alternatives.flatMap((issues) => issues ?? [])) {
+    const key = JSON.stringify(issue22);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    errors.push(issue22);
+  }
 }
 function resolveLocalReference(root, reference) {
   if (!reference.startsWith("#/")) return null;
@@ -976,7 +1017,7 @@ var ActorEnvelopeValidationError = class extends Error {
   }
 };
 function parseActorEnvelope(value) {
-  const envelope = record(value, "actorEnvelope");
+  const envelope = record2(value, "actorEnvelope");
   exactKeys(envelope, [
     "schemaVersion",
     "organizationId",
@@ -1001,13 +1042,13 @@ function parseActorEnvelope(value) {
   if (expiresAt && Date.parse(expiresAt) <= Date.parse(issuedAt)) {
     fail("actorEnvelope.expiresAt", "must be later than issuedAt");
   }
-  const assuranceValue = record(envelope.assurance, "actorEnvelope.assurance");
+  const assuranceValue = record2(envelope.assurance, "actorEnvelope.assurance");
   exactKeys(assuranceValue, ["level", "methods"], "actorEnvelope.assurance");
   const assurance = {
     level: member(assuranceValue.level, ASSURANCE_LEVELS, "actorEnvelope.assurance.level"),
     methods: textArray(assuranceValue.methods, "actorEnvelope.assurance.methods")
   };
-  const actionValue = record(envelope.action, "actorEnvelope.action");
+  const actionValue = record2(envelope.action, "actorEnvelope.action");
   exactKeys(actionValue, ["requestId", "actionId", "resourceType", "resourceId", "inputHash"], "actorEnvelope.action");
   const inputHash = text(actionValue.inputHash, "actorEnvelope.action.inputHash");
   if (!HASH_PATTERN.test(inputHash)) fail("actorEnvelope.action.inputHash", "must be a lowercase sha256 digest");
@@ -1077,7 +1118,7 @@ function canonicalJson(value) {
 }
 function parseAccountableSubject(value) {
   const path = "actorEnvelope.accountableSubject";
-  const subject = record(value, path);
+  const subject = record2(value, path);
   exactKeys(subject, ["principalType", "principalId", "displayName"], path);
   return {
     principalType: member(subject.principalType, ACCOUNTABLE_SUBJECT_TYPES, `${path}.principalType`),
@@ -1091,7 +1132,7 @@ async function sha256CanonicalValue(value) {
   return `sha256:${Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
 }
 function parseIdentity(value, path) {
-  const identity = record(value, path);
+  const identity = record2(value, path);
   exactKeys(identity, [
     "principalType",
     "principalId",
@@ -1117,7 +1158,7 @@ function parseIdentity(value, path) {
 }
 function parseDelegation(value) {
   if (value === null) return null;
-  const delegation = record(value, "actorEnvelope.delegation");
+  const delegation = record2(value, "actorEnvelope.delegation");
   exactKeys(delegation, ["taskId", "runId", "lineage"], "actorEnvelope.delegation");
   if (!Array.isArray(delegation.lineage) || delegation.lineage.length === 0 || delegation.lineage.length > 16) {
     fail("actorEnvelope.delegation.lineage", "must contain between 1 and 16 hops");
@@ -1126,7 +1167,7 @@ function parseDelegation(value) {
     taskId: text(delegation.taskId, "actorEnvelope.delegation.taskId"),
     runId: text(delegation.runId, "actorEnvelope.delegation.runId"),
     lineage: delegation.lineage.map((value2, index) => {
-      const hop = record(value2, `actorEnvelope.delegation.lineage[${index}]`);
+      const hop = record2(value2, `actorEnvelope.delegation.lineage[${index}]`);
       exactKeys(hop, ["principalType", "principalId"], `actorEnvelope.delegation.lineage[${index}]`);
       return {
         principalType: member(hop.principalType, PRINCIPAL_TYPES, `actorEnvelope.delegation.lineage[${index}].principalType`),
@@ -1135,7 +1176,7 @@ function parseDelegation(value) {
     })
   };
 }
-function record(value, path) {
+function record2(value, path) {
   if (!value || typeof value !== "object" || Array.isArray(value)) fail(path, "must be an object");
   return value;
 }
@@ -1945,14 +1986,14 @@ var TopoloClient = class _TopoloClient {
     if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
       throw new TopoloSdkError("action_catalog_summary_unavailable", "Action catalog summary is unavailable.");
     }
-    const record3 = raw;
-    if (record3.algorithm !== "sha256-v1" || typeof record3.digest !== "string" || !/^[a-f0-9]{64}$/.test(record3.digest) || !Number.isSafeInteger(record3.actionCount) || Number(record3.actionCount) < 0) {
+    const record4 = raw;
+    if (record4.algorithm !== "sha256-v1" || typeof record4.digest !== "string" || !/^[a-f0-9]{64}$/.test(record4.digest) || !Number.isSafeInteger(record4.actionCount) || Number(record4.actionCount) < 0) {
       throw new TopoloSdkError("action_catalog_summary_unavailable", "Action catalog summary is invalid.");
     }
     return {
       algorithm: "sha256-v1",
-      digest: record3.digest,
-      actionCount: Number(record3.actionCount)
+      digest: record4.digest,
+      actionCount: Number(record4.actionCount)
     };
   }
   /** @deprecated Prefer searchActions() so callers retain the continuation cursor. */
@@ -2200,7 +2241,8 @@ var TopoloClient = class _TopoloClient {
       throw maskActionSecretError(error, this.actionSecrets);
     }
     return preserveSensitiveResult ? result : await protectActionResult(result, this.actionSecretStore, {
-      preserveAgentGuidance: entry.appId === "app_topolo_docs"
+      preserveAgentGuidance: entry.appId === "app_topolo_docs",
+      preserveActionSchemas: entry.appId === "app_topolo_developers" && entry.name === "apps.actions.list"
     });
   }
   async releaseActionSecret(reference) {
@@ -2548,6 +2590,7 @@ function normalizeActionCatalogEntry(item) {
     permissionName: pickActionString(a.permission_name) ?? pickActionString(a.permissionName) ?? "",
     requiredPermission: pickActionString(a.required_permission) ?? pickActionString(a.requiredPermission) ?? "",
     principalAccess: pickPrincipalAccess(a.principal_access ?? a.principalAccess),
+    ...validTopoloActionAccessPolicy(a.access_policy ?? a.accessPolicy) ? { accessPolicy: a.access_policy ?? a.accessPolicy } : {},
     authorizationMode: pickAuthorizationMode(a.authorization_mode ?? a.authorizationMode),
     allowedServices: stringArray(a.allowed_services ?? a.allowedServices),
     inputSchema: plainObject(a.input_schema ?? a.inputSchema),
@@ -2565,7 +2608,7 @@ function isHttpMethod(value) {
   return value === "GET" || value === "POST" || value === "PUT" || value === "PATCH" || value === "DELETE";
 }
 function pickPrincipalAccess(value) {
-  return value === "platform_admin" || value === "platform_super_admin" ? value : null;
+  return value === "platform_admin" || value === "platform_super_admin" || value === "platform_admin_or_service" || value === "platform_super_admin_or_service" ? value : null;
 }
 function pickActionString(value) {
   return typeof value === "string" && value.trim() ? value.trim() : null;
@@ -2672,10 +2715,10 @@ function extractRequired(body) {
     if (Array.isArray(maybe.required)) return canonicalTopoloRequired(maybe.required);
     for (const nested of [maybe.details, maybe.error]) {
       if (!nested || typeof nested !== "object" || Array.isArray(nested)) continue;
-      const record3 = nested;
-      if (Array.isArray(record3.required)) return canonicalTopoloRequired(record3.required);
-      if (record3.details && typeof record3.details === "object" && !Array.isArray(record3.details)) {
-        const required = record3.details.required;
+      const record4 = nested;
+      if (Array.isArray(record4.required)) return canonicalTopoloRequired(record4.required);
+      if (record4.details && typeof record4.details === "object" && !Array.isArray(record4.details)) {
+        const required = record4.details.required;
         if (Array.isArray(required)) return canonicalTopoloRequired(required);
       }
     }
@@ -2704,6 +2747,8 @@ function compactActionCatalogEntry(action) {
     requiresConfirmation: action.requiresConfirmation,
     agentAccess: action.agentAccess ?? (action.requiresConfirmation ? "confirm" : action.readOnly ? "auto" : "confirm"),
     requiredPermission: action.requiredPermission,
+    ...action.principalAccess ? { principalAccess: action.principalAccess } : {},
+    ...action.accessPolicy ? { accessPolicy: action.accessPolicy } : {},
     requiredInput: required,
     resourceType: action.agentContract?.resourceContext?.kind ?? (action.permissionName.startsWith("workspace:") ? "workspace" : null),
     resultResourceType: action.agentContract?.resource?.kind ?? null,
@@ -2750,8 +2795,8 @@ function compactResultValue(value, depth, budget) {
     return value.length > ACTION_RESULT_MAX_ITEMS ? { count: value.length, items, omittedItems: value.length - ACTION_RESULT_MAX_ITEMS } : items;
   }
   if (typeof value === "object") {
-    const record3 = value;
-    const allKeys = Object.keys(record3);
+    const record4 = value;
+    const allKeys = Object.keys(record4);
     const ranked = allKeys.sort((left, right) => resultKeyPriority(left) - resultKeyPriority(right));
     const prioritized = ranked.filter((key) => resultKeyPriority(key) < 2);
     const ordinary = ranked.filter((key) => resultKeyPriority(key) === 2);
@@ -2760,7 +2805,7 @@ function compactResultValue(value, depth, budget) {
       ...prioritized,
       ...ordinary.slice(0, ordinaryLimit)
     ].slice(0, ACTION_RESULT_MAX_KEYS);
-    const compact = Object.fromEntries(keys.map((key) => [key, compactResultValue(record3[key], depth + 1, budget)]));
+    const compact = Object.fromEntries(keys.map((key) => [key, compactResultValue(record4[key], depth + 1, budget)]));
     if (allKeys.length > keys.length) compact["_omittedKeys"] = allKeys.length - keys.length;
     return compact;
   }
@@ -3675,10 +3720,10 @@ var TopoloAuthError2 = class extends TopoloSdkError2 {
 };
 function extractTopoloServiceErrorCode2(body) {
   if (!body || typeof body !== "object" || Array.isArray(body)) return null;
-  const record2 = body;
-  const topLevel = canonicalTopoloServiceErrorCode2(record2.code);
+  const record3 = body;
+  const topLevel = canonicalTopoloServiceErrorCode2(record3.code);
   if (topLevel) return topLevel;
-  const nested = record2.error;
+  const nested = record3.error;
   const nestedString = canonicalTopoloServiceErrorCode2(nested);
   if (nestedString) return nestedString;
   if (nested && typeof nested === "object" && !Array.isArray(nested)) {
@@ -3693,14 +3738,14 @@ function serviceErrorCode2(body, fallback) {
 }
 function extractTopoloServiceErrorDetails2(body) {
   if (!body || typeof body !== "object" || Array.isArray(body)) return void 0;
-  const record2 = body;
-  let candidate = record2.details;
-  const nested = record2.error;
+  const record3 = body;
+  let candidate = record3.details;
+  const nested = record3.error;
   if (nested && typeof nested === "object" && !Array.isArray(nested)) {
     const nestedRecord = nested;
     if (candidate === void 0) candidate = nestedRecord.details ?? nestedRecord;
   }
-  if (candidate === void 0) candidate = record2;
+  if (candidate === void 0) candidate = record3;
   if (Array.isArray(candidate)) return validationIssueDetails2(canonicalTopoloValidationIssues2(candidate)) ?? void 0;
   if (!candidate || typeof candidate !== "object") return void 0;
   const source = candidate;
@@ -3767,10 +3812,10 @@ function canonicalTopoloValidationIssues2(values) {
   const issues = [];
   for (const value of values) {
     if (!value || typeof value !== "object" || Array.isArray(value)) continue;
-    const record2 = value;
-    const path = canonicalTopoloValidationPath2(record2.field) ?? canonicalTopoloValidationPath2(record2.path);
+    const record3 = value;
+    const path = canonicalTopoloValidationPath2(record3.field) ?? canonicalTopoloValidationPath2(record3.path);
     if (!path) continue;
-    const projected = issue2(path, record2.message);
+    const projected = issue2(path, record3.message);
     if (projected) issues.push(projected);
     if (issues.length === SERVICE_ISSUE_LIMIT2) break;
   }
@@ -4174,18 +4219,18 @@ function createProtectedActionSecretStore(options) {
       const key = await account(reference);
       const encoded = await backend.get(key);
       if (!encoded) throw new TopoloSdkError2("action_secret_unavailable", "Protected action reference is missing or belongs to another identity or environment.");
-      let record2;
+      let record3;
       try {
-        record2 = JSON.parse(encoded);
+        record3 = JSON.parse(encoded);
       } catch {
         throw new TopoloSdkError2("action_secret_invalid", "Protected action reference is corrupt.");
       }
-      if (!Number.isFinite(record2?.expiresAt) || !Object.hasOwn(record2, "value")) throw new TopoloSdkError2("action_secret_invalid", "Protected action reference is corrupt.");
-      if (record2.expiresAt <= now()) {
+      if (!Number.isFinite(record3?.expiresAt) || !Object.hasOwn(record3, "value")) throw new TopoloSdkError2("action_secret_invalid", "Protected action reference is corrupt.");
+      if (record3.expiresAt <= now()) {
         await backend.delete(key);
         throw new TopoloSdkError2("action_secret_expired", "Protected action reference expired. Repeat the originating action if its contract permits.");
       }
-      return record2.value;
+      return record3.value;
     },
     async delete(reference) {
       await backend.delete(await account(reference));
@@ -5373,9 +5418,9 @@ function externalApprovalHandoff(action, result) {
   if (!result || typeof result !== "object" || Array.isArray(result)) return null;
   const invocation = result.invocation;
   if (!invocation || typeof invocation !== "object" || Array.isArray(invocation)) return null;
-  const record2 = invocation;
-  if (record2.status !== "awaiting_approval") return null;
-  const approval = record2.approval;
+  const record3 = invocation;
+  if (record3.status !== "awaiting_approval") return null;
+  const approval = record3.approval;
   if (!approval || typeof approval !== "object" || Array.isArray(approval)) return null;
   const handoff = approval;
   if (typeof handoff.requestId !== "string" || typeof handoff.verificationUrl !== "string") return null;
@@ -7435,16 +7480,16 @@ var REVOKE_CREDENTIAL = "app_topolo_auth.principal_credentials.revoke";
 var INSTALLATION_BOOTSTRAP_GRANT = "app_topolo_auth:identity";
 function actionData(value) {
   if (!value || typeof value !== "object") throw new Error("Topolo returned an invalid action response.");
-  const record2 = value;
-  const data = record2.data;
-  return data && typeof data === "object" ? data : record2;
+  const record3 = value;
+  const data = record3.data;
+  return data && typeof data === "object" ? data : record3;
 }
 function requiredRecord(value, name) {
   if (!value || typeof value !== "object") throw new Error(`Topolo did not return ${name}.`);
   return value;
 }
-function requiredString(record2, key) {
-  const value = record2[key];
+function requiredString(record3, key) {
+  const value = record3[key];
   if (typeof value !== "string" || !value.trim()) throw new Error(`Topolo did not return ${key}.`);
   return value;
 }

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@topolo/cli",
   "packageManager": "pnpm@10.17.1",
-  "version": "0.12.19",
-  "topoloPublishedVersion": "0.12.19",
+  "version": "0.12.21",
+  "topoloPublishedVersion": "0.12.21",
   "description": "Public command-line interface for Topolo customer organizations, developers, and agents.",
   "license": "UNLICENSED",
   "author": "Topolo",
@@ -28,8 +28,8 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "@topolo/mcp": "0.14.11",
-    "@topolo/sdk": "0.23.6",
+    "@topolo/mcp": "0.14.13",
+    "@topolo/sdk": "0.23.9",
     "commander": "^12.1.0"
   },
   "devDependencies": {