@topolo/cli 0.13.12 → 0.13.15

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json CHANGED
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "name": "@topolo/cli",
3
3
  "packageManager": "pnpm@10.17.1",
4
- "version": "0.13.12",
5
- "topoloPublishedVersion": "0.13.12",
4
+ "version": "0.13.15",
5
+ "topoloPublishedVersion": "0.13.15",
6
6
  "description": "Public command-line interface for Topolo customer organizations, developers, and agents.",
7
7
  "license": "UNLICENSED",
8
8
  "author": "Topolo",
@@ -31,7 +31,7 @@
31
31
  },
32
32
  "dependencies": {
33
33
  "@modelcontextprotocol/sdk": "1.31.0",
34
- "@topolo/mcp": "0.14.27",
34
+ "@topolo/mcp": "0.14.30",
35
35
  "@topolo/sdk": "0.23.22",
36
36
  "commander": "^12.1.0",
37
37
  "undici": "6.29.0"
@@ -270,6 +270,13 @@ Local deletion does not revoke the upstream credential; use its published
270
270
  revocation action separately when required. Other SDK/remote hosts keep
271
271
  redaction unless they explicitly provide a protected store.
272
272
 
273
+ The only supported way to put a referenced API key on disk is an
274
+ operator-approved custody file:
275
+ `topolo credentials write-custody <reference> --out <absolute-dir> --app <appId> --api-key-id <id> --confirm --json`
276
+ verifies the key against Auth, writes 0600 `api-key.json` and `custody.json`
277
+ (metadata and a SHA-256 digest only) into a 0700 directory, prints no secret,
278
+ and deletes the local reference without revoking the upstream key.
279
+
273
280
  ## Generic public API escape hatch
274
281
 
275
282
  Only when public docs provide a complete contract: