@topolo/cli 0.13.26 → 0.13.27

package/dist/index.js

@@ -326,74 +326,6 @@ function validTopoloActionAccessPolicy(value) {
   }
   return true;
 }
-function record2(value) {
-  return !!value && typeof value === "object" && !Array.isArray(value);
-}
-function text(value, limit = 512) {
-  return typeof value === "string" && value.trim() ? value.trim().slice(0, limit) : null;
-}
-function strings2(value) {
-  return Array.isArray(value) ? value.slice(0, 8).flatMap((item) => {
-    const result = text(item);
-    return result ? [result] : [];
-  }) : [];
-}
-function pairs(value, first, second) {
-  return Array.isArray(value) ? value.slice(0, 8).flatMap((item) => {
-    if (!record2(item)) return [];
-    const a = text(item[first], 160);
-    const b = text(item[second]);
-    return a && b ? [{ [first]: a, [second]: b }] : [];
-  }) : [];
-}
-function docs(value) {
-  const result = text(value, 2048);
-  if (!result) return null;
-  try {
-    const url = new URL(result);
-    return url.protocol === "https:" && !url.username && !url.password ? url.href : null;
-  } catch {
-    return null;
-  }
-}
-function normalizeApplicationGuide(value) {
-  if (!record2(value) || value.schemaVersion !== 1 || value.source !== "published_application_manifest") return null;
-  const purpose = text(value.purpose, 2048);
-  const gettingStarted = strings2(value.gettingStarted);
-  const docsUrl = docs(value.docsUrl);
-  return {
-    schemaVersion: 1,
-    source: "published_application_manifest",
-    publishedAt: text(value.publishedAt, 160),
-    purpose,
-    problemStatement: text(value.problemStatement, 2048),
-    solutionStatement: text(value.solutionStatement, 2048),
-    benefits: strings2(value.benefits),
-    features: pairs(value.features, "title", "description"),
-    gettingStarted,
-    worksWellWith: pairs(value.worksWellWith, "appId", "reason"),
-    docsUrl,
-    missingFields: [...!purpose ? ["purpose"] : [], ...!docsUrl ? ["docsUrl"] : [], ...!gettingStarted.length ? ["gettingStarted"] : []]
-  };
-}
-function applyAuthHeaders(headers, credential) {
-  if (credential.kind === "api_key") {
-    headers.set("X-Api-Key", credential.apiKey);
-    return;
-  }
-  headers.set("Authorization", `${credential.kind === "dpop_access_token" ? "DPoP" : "Bearer"} ${credential.accessToken}`);
-}
-function applyAuditHeaders(headers, agent, requestId) {
-  headers.set("X-Topolo-Client", `${agent.clientName}/${agent.clientVersion}`);
-  if (agent.agentName) headers.set("X-Topolo-Agent", agent.agentName);
-  headers.set("X-Topolo-Request-Id", requestId);
-}
-function generateRequestId() {
-  if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") {
-    return crypto.randomUUID();
-  }
-  return `req_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 10)}`;
-}
 var TopoloSdkError = class extends Error {
   code;
   constructor(code, message3) {
@@ -823,152 +755,6 @@ var TopoloReauthRequiredError = class extends TopoloAuthError {
     this.reauthorization = Object.freeze({ ...reauthorization });
   }
 };
-var ACTION_SECRET_PREFIX = "topolo-secret:";
-function isActionSecretReference(value) {
-  return typeof value === "string" && value.startsWith(ACTION_SECRET_PREFIX);
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function sensitive(key, value) {
-  const normalized = key.toLowerCase().replace(/[^a-z0-9]/g, "");
-  if (normalized === "capability") {
-    if (typeof value !== "string") return value !== null && value !== void 0 && typeof value !== "boolean" && typeof value !== "number";
-    const text4 = value.trim();
-    return Boolean(text4) && !/^[a-z][a-z0-9_-]{0,31}$/.test(text4);
-  }
-  return ["authorization", "cookie", "setcookie", "proxyauthorization"].includes(normalized) || /(token|secret|password|privatekey|apikey|backupcodes?|recoverycodes?)$/.test(normalized);
-}
-function maskActionSecrets(value, secrets) {
-  let masked = value;
-  for (const [secret, reference] of secrets) {
-    const encoded = encodeURIComponent(secret);
-    const variants = [.../* @__PURE__ */ new Set([secret, encoded])].map((item) => item.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
-    masked = masked.replace(new RegExp(variants.join("|"), "g"), (match) => match === secret ? reference : encodeURIComponent(reference));
-  }
-  return masked;
-}
-async function resolveActionSecrets(value, store, secrets) {
-  if (isActionSecretReference(value)) {
-    if (!store) throw new TopoloSdkError("action_secret_store_required", "Protected action references require a secret store.");
-    const resolved = await store.load(value);
-    if (typeof resolved !== "string" || !resolved) throw new TopoloSdkError("action_secret_unsupported_type", "Protected action handoff requires a nonempty string credential.");
-    secrets.set(resolved, value);
-    return resolved;
-  }
-  if (Array.isArray(value)) return Promise.all(value.map((item) => resolveActionSecrets(item, store, secrets)));
-  if (!isRecord(value)) return value;
-  return Object.fromEntries(await Promise.all(Object.entries(value).map(async ([key, item]) => [key, await resolveActionSecrets(item, store, secrets)])));
-}
-async function protectActionResult(value, store, options = {}) {
-  const secrets = /* @__PURE__ */ new Map();
-  function documentation(item, key) {
-    if (options.preserveActionSchemas === true && ["inputSchema", "outputSchema", "input_schema", "output_schema"].includes(key) && isRecord(item)) return true;
-    if (options.preserveActionContracts === true && ["agentContract", "agent_contract"].includes(key) && isRecord(item)) return true;
-    return options.preserveAgentGuidance === true && key === "agentGuidance" && isRecord(item) && item.schemaVersion === 1 && typeof item.kind === "string" && ["action-guide", "product-guide", "concept"].includes(item.kind);
-  }
-  function localizationMap(path) {
-    const location = path.join("/");
-    if (options.localizationAction === "sources.verify") return location === "data/hashes";
-    if (options.localizationAction === "values.bulk_upsert") return location === "data/sourceHashes";
-    return ["translation.release.prepare", "translation.release.import", "translation.release.get"].includes(options.localizationAction ?? "") && /^data\/bundle\/catalogs\/\*\/(sources|(?:packs|provenance)\/[^/]+)$/.test(location);
-  }
-  async function protect(item, key = "", path = []) {
-    if (documentation(item, key)) return item;
-    if (isActionSecretReference(item)) return item;
-    if (Array.isArray(item) && /(?:backup|recovery)codes$/.test(key.toLowerCase().replace(/[^a-z0-9]/g, ""))) {
-      return Promise.all(item.map((child) => protect(child, key, [...path, "*"])));
-    }
-    if (sensitive(key, item)) {
-      const reference = store ? await store.save(item) : "[REDACTED]";
-      if (typeof item === "string" && item) secrets.set(item, reference);
-      return reference;
-    }
-    if (Array.isArray(item)) return Promise.all(item.map((child) => protect(child, "", [...path, "*"])));
-    if (!isRecord(item)) return item;
-    return Object.fromEntries(await Promise.all(Object.entries(item).map(async ([name, child]) => [name, await protect(child, localizationMap(path) ? "" : name, [...path, name])])));
-  }
-  const protectedValue = await protect(value);
-  async function protectEmbedded(item, key = "") {
-    if (documentation(item, key)) return item;
-    if (typeof item === "string" && !isActionSecretReference(item) && maskActionSecrets(item, secrets) !== item) {
-      return store ? store.save(item) : maskActionSecrets(item, secrets);
-    }
-    if (Array.isArray(item)) return Promise.all(item.map((child) => protectEmbedded(child)));
-    if (!isRecord(item)) return item;
-    return Object.fromEntries(await Promise.all(Object.entries(item).map(async ([key2, child]) => [key2, await protectEmbedded(child, key2)])));
-  }
-  return protectEmbedded(protectedValue);
-}
-function maskActionSecretValue(value, secrets) {
-  if (value instanceof Error) return maskActionSecretError(value, secrets);
-  if (typeof value === "string") return maskActionSecrets(value, secrets);
-  if (Array.isArray(value)) return value.map((item) => maskActionSecretValue(item, secrets));
-  if (!isRecord(value)) return value;
-  return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, maskActionSecretValue(item, secrets)]));
-}
-function maskActionSecretError(error, secrets) {
-  if (!(error instanceof Error)) return maskActionSecretValue(error, secrets);
-  const masked = Object.create(Object.getPrototypeOf(error));
-  for (const key of Object.getOwnPropertyNames(error)) {
-    const descriptor = Object.getOwnPropertyDescriptor(error, key);
-    if ("value" in descriptor) descriptor.value = maskActionSecretValue(descriptor.value, secrets);
-    Object.defineProperty(masked, key, descriptor);
-  }
-  return masked;
-}
-var encoder = new TextEncoder();
-function encodeBase64Url(value) {
-  const bytes = value instanceof Uint8Array ? value : new Uint8Array(value);
-  let binary = "";
-  for (const byte of bytes) binary += String.fromCharCode(byte);
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
-}
-function encodeJson(value) {
-  return encodeBase64Url(encoder.encode(JSON.stringify(value)));
-}
-async function sha256Base64Url(value) {
-  return encodeBase64Url(await crypto.subtle.digest("SHA-256", encoder.encode(value)));
-}
-function publicJwk(privateJwk) {
-  const { crv, kty, x, y } = privateJwk;
-  if (kty !== "EC" || crv !== "P-256" || !x || !y || !privateJwk.d) {
-    throw new TypeError("A private P-256 JSON Web Key is required for DPoP signing.");
-  }
-  return { crv, kty, x, y };
-}
-function canonicalTargetUrl(value) {
-  const url = new URL(value);
-  return `${url.origin}${url.pathname}`;
-}
-async function calculateDpopJkt(privateJwk) {
-  const jwk = publicJwk(privateJwk);
-  return sha256Base64Url(JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y }));
-}
-async function createDpopProof(input2) {
-  const jwk = publicJwk(input2.privateJwk);
-  const key = await crypto.subtle.importKey(
-    "jwk",
-    input2.privateJwk,
-    { name: "ECDSA", namedCurve: "P-256" },
-    false,
-    ["sign"]
-  );
-  const header = encodeJson({ alg: "ES256", typ: "dpop+jwt", jwk });
-  const claims = encodeJson({
-    jti: crypto.randomUUID(),
-    iat: Math.floor(Date.now() / 1e3),
-    htm: input2.method.toUpperCase(),
-    htu: canonicalTargetUrl(input2.targetUrl),
-    ath: await sha256Base64Url(input2.accessToken)
-  });
-  const signature = await crypto.subtle.sign(
-    { name: "ECDSA", hash: "SHA-256" },
-    key,
-    encoder.encode(`${header}.${claims}`)
-  );
-  return `${header}.${claims}.${encodeBase64Url(signature)}`;
-}
 var TOPOLO_FIRST_PARTY_ORIGINS = Object.freeze({
   production: Object.freeze([
     "https://admin.topolo.app",
@@ -1269,6 +1055,270 @@ async function fetchWithCredentialBoundary(fetchImpl, environment, service, targ
   }
   return response;
 }
+var MARKETING_ORIGINS = Object.freeze({
+  development: "https://topolo.dev",
+  staging: "https://stg.topolo.us",
+  production: "https://topolo.io"
+});
+function isOnePublicMarketingAction(entry) {
+  return entry.appId === "app_topolo_one" && entry.target === "marketing" && entry.authorizationMode === "public";
+}
+function publicMarketingOrigin(entry, environment) {
+  const selected = requireTopoloRuntimeEnvironment(environment);
+  const origin = selected === "local" ? void 0 : MARKETING_ORIGINS[selected];
+  if (!isOnePublicMarketingAction(entry) || !origin || entry.apiBaseUrl !== origin && entry.apiBaseUrl !== origin + "/") {
+    throw new TopoloSdkError("environment_mismatch", "Public action target does not match the registered application, target and environment.");
+  }
+  return origin;
+}
+async function fetchPublicMarketingAction(fetchImpl, entry, environment, target, init) {
+  const origin = publicMarketingOrigin(entry, environment);
+  if (target.origin !== origin || target.protocol !== "https:" || target.username || target.password || target.port) {
+    throw new TopoloSdkError("service_path_origin_mismatch", "Public action path changes the registered target origin.");
+  }
+  init.signal?.throwIfAborted();
+  const headers = new Headers({
+    Accept: "application/json",
+    "X-Topolo-Action-Id": entry.actionId,
+    "X-Topolo-Action-Name": entry.name
+  });
+  const contentType = new Headers(init.headers).get("Content-Type");
+  if (contentType) headers.set("Content-Type", contentType);
+  const response = await fetchImpl(target.toString(), {
+    method: init.method,
+    headers,
+    body: init.body,
+    signal: init.signal,
+    credentials: "omit",
+    redirect: "manual",
+    referrerPolicy: "no-referrer"
+  });
+  let responseOrigin = origin;
+  try {
+    if (response.url) responseOrigin = new URL(response.url).origin;
+  } catch {
+    responseOrigin = "";
+  }
+  if (response.redirected || responseOrigin !== origin || response.status >= 300 && response.status < 400) {
+    await response.body?.cancel().catch(() => void 0);
+    throw new TopoloSdkError("public_action_redirect_refused", "Public action redirects are refused.");
+  }
+  return response;
+}
+function record2(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function text(value, limit = 512) {
+  return typeof value === "string" && value.trim() ? value.trim().slice(0, limit) : null;
+}
+function strings2(value) {
+  return Array.isArray(value) ? value.slice(0, 8).flatMap((item) => {
+    const result = text(item);
+    return result ? [result] : [];
+  }) : [];
+}
+function pairs(value, first, second) {
+  return Array.isArray(value) ? value.slice(0, 8).flatMap((item) => {
+    if (!record2(item)) return [];
+    const a = text(item[first], 160);
+    const b = text(item[second]);
+    return a && b ? [{ [first]: a, [second]: b }] : [];
+  }) : [];
+}
+function docs(value) {
+  const result = text(value, 2048);
+  if (!result) return null;
+  try {
+    const url = new URL(result);
+    return url.protocol === "https:" && !url.username && !url.password ? url.href : null;
+  } catch {
+    return null;
+  }
+}
+function normalizeApplicationGuide(value) {
+  if (!record2(value) || value.schemaVersion !== 1 || value.source !== "published_application_manifest") return null;
+  const purpose = text(value.purpose, 2048);
+  const gettingStarted = strings2(value.gettingStarted);
+  const docsUrl = docs(value.docsUrl);
+  return {
+    schemaVersion: 1,
+    source: "published_application_manifest",
+    publishedAt: text(value.publishedAt, 160),
+    purpose,
+    problemStatement: text(value.problemStatement, 2048),
+    solutionStatement: text(value.solutionStatement, 2048),
+    benefits: strings2(value.benefits),
+    features: pairs(value.features, "title", "description"),
+    gettingStarted,
+    worksWellWith: pairs(value.worksWellWith, "appId", "reason"),
+    docsUrl,
+    missingFields: [...!purpose ? ["purpose"] : [], ...!docsUrl ? ["docsUrl"] : [], ...!gettingStarted.length ? ["gettingStarted"] : []]
+  };
+}
+function applyAuthHeaders(headers, credential) {
+  if (credential.kind === "api_key") {
+    headers.set("X-Api-Key", credential.apiKey);
+    return;
+  }
+  headers.set("Authorization", `${credential.kind === "dpop_access_token" ? "DPoP" : "Bearer"} ${credential.accessToken}`);
+}
+function applyAuditHeaders(headers, agent, requestId) {
+  headers.set("X-Topolo-Client", `${agent.clientName}/${agent.clientVersion}`);
+  if (agent.agentName) headers.set("X-Topolo-Agent", agent.agentName);
+  headers.set("X-Topolo-Request-Id", requestId);
+}
+function generateRequestId() {
+  if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") {
+    return crypto.randomUUID();
+  }
+  return `req_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 10)}`;
+}
+var ACTION_SECRET_PREFIX = "topolo-secret:";
+function isActionSecretReference(value) {
+  return typeof value === "string" && value.startsWith(ACTION_SECRET_PREFIX);
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function sensitive(key, value) {
+  const normalized = key.toLowerCase().replace(/[^a-z0-9]/g, "");
+  if (normalized === "capability") {
+    if (typeof value !== "string") return value !== null && value !== void 0 && typeof value !== "boolean" && typeof value !== "number";
+    const text4 = value.trim();
+    return Boolean(text4) && !/^[a-z][a-z0-9_-]{0,31}$/.test(text4);
+  }
+  return ["authorization", "cookie", "setcookie", "proxyauthorization"].includes(normalized) || /(token|secret|password|privatekey|apikey|backupcodes?|recoverycodes?)$/.test(normalized);
+}
+function maskActionSecrets(value, secrets) {
+  let masked = value;
+  for (const [secret, reference] of secrets) {
+    const encoded = encodeURIComponent(secret);
+    const variants = [.../* @__PURE__ */ new Set([secret, encoded])].map((item) => item.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+    masked = masked.replace(new RegExp(variants.join("|"), "g"), (match) => match === secret ? reference : encodeURIComponent(reference));
+  }
+  return masked;
+}
+async function resolveActionSecrets(value, store, secrets) {
+  if (isActionSecretReference(value)) {
+    if (!store) throw new TopoloSdkError("action_secret_store_required", "Protected action references require a secret store.");
+    const resolved = await store.load(value);
+    if (typeof resolved !== "string" || !resolved) throw new TopoloSdkError("action_secret_unsupported_type", "Protected action handoff requires a nonempty string credential.");
+    secrets.set(resolved, value);
+    return resolved;
+  }
+  if (Array.isArray(value)) return Promise.all(value.map((item) => resolveActionSecrets(item, store, secrets)));
+  if (!isRecord(value)) return value;
+  return Object.fromEntries(await Promise.all(Object.entries(value).map(async ([key, item]) => [key, await resolveActionSecrets(item, store, secrets)])));
+}
+async function protectActionResult(value, store, options = {}) {
+  const secrets = /* @__PURE__ */ new Map();
+  function documentation(item, key) {
+    if (options.preserveActionSchemas === true && ["inputSchema", "outputSchema", "input_schema", "output_schema"].includes(key) && isRecord(item)) return true;
+    if (options.preserveActionContracts === true && ["agentContract", "agent_contract"].includes(key) && isRecord(item)) return true;
+    return options.preserveAgentGuidance === true && key === "agentGuidance" && isRecord(item) && item.schemaVersion === 1 && typeof item.kind === "string" && ["action-guide", "product-guide", "concept"].includes(item.kind);
+  }
+  function localizationMap(path) {
+    const location = path.join("/");
+    if (options.localizationAction === "sources.verify") return location === "data/hashes";
+    if (options.localizationAction === "values.bulk_upsert") return location === "data/sourceHashes";
+    return ["translation.release.prepare", "translation.release.import", "translation.release.get"].includes(options.localizationAction ?? "") && /^data\/bundle\/catalogs\/\*\/(sources|(?:packs|provenance)\/[^/]+)$/.test(location);
+  }
+  async function protect(item, key = "", path = []) {
+    if (documentation(item, key)) return item;
+    if (isActionSecretReference(item)) return item;
+    if (Array.isArray(item) && /(?:backup|recovery)codes$/.test(key.toLowerCase().replace(/[^a-z0-9]/g, ""))) {
+      return Promise.all(item.map((child) => protect(child, key, [...path, "*"])));
+    }
+    if (sensitive(key, item)) {
+      const reference = store ? await store.save(item) : "[REDACTED]";
+      if (typeof item === "string" && item) secrets.set(item, reference);
+      return reference;
+    }
+    if (Array.isArray(item)) return Promise.all(item.map((child) => protect(child, "", [...path, "*"])));
+    if (!isRecord(item)) return item;
+    return Object.fromEntries(await Promise.all(Object.entries(item).map(async ([name, child]) => [name, await protect(child, localizationMap(path) ? "" : name, [...path, name])])));
+  }
+  const protectedValue = await protect(value);
+  async function protectEmbedded(item, key = "") {
+    if (documentation(item, key)) return item;
+    if (typeof item === "string" && !isActionSecretReference(item) && maskActionSecrets(item, secrets) !== item) {
+      return store ? store.save(item) : maskActionSecrets(item, secrets);
+    }
+    if (Array.isArray(item)) return Promise.all(item.map((child) => protectEmbedded(child)));
+    if (!isRecord(item)) return item;
+    return Object.fromEntries(await Promise.all(Object.entries(item).map(async ([key2, child]) => [key2, await protectEmbedded(child, key2)])));
+  }
+  return protectEmbedded(protectedValue);
+}
+function maskActionSecretValue(value, secrets) {
+  if (value instanceof Error) return maskActionSecretError(value, secrets);
+  if (typeof value === "string") return maskActionSecrets(value, secrets);
+  if (Array.isArray(value)) return value.map((item) => maskActionSecretValue(item, secrets));
+  if (!isRecord(value)) return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, maskActionSecretValue(item, secrets)]));
+}
+function maskActionSecretError(error, secrets) {
+  if (!(error instanceof Error)) return maskActionSecretValue(error, secrets);
+  const masked = Object.create(Object.getPrototypeOf(error));
+  for (const key of Object.getOwnPropertyNames(error)) {
+    const descriptor = Object.getOwnPropertyDescriptor(error, key);
+    if ("value" in descriptor) descriptor.value = maskActionSecretValue(descriptor.value, secrets);
+    Object.defineProperty(masked, key, descriptor);
+  }
+  return masked;
+}
+var encoder = new TextEncoder();
+function encodeBase64Url(value) {
+  const bytes = value instanceof Uint8Array ? value : new Uint8Array(value);
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function encodeJson(value) {
+  return encodeBase64Url(encoder.encode(JSON.stringify(value)));
+}
+async function sha256Base64Url(value) {
+  return encodeBase64Url(await crypto.subtle.digest("SHA-256", encoder.encode(value)));
+}
+function publicJwk(privateJwk) {
+  const { crv, kty, x, y } = privateJwk;
+  if (kty !== "EC" || crv !== "P-256" || !x || !y || !privateJwk.d) {
+    throw new TypeError("A private P-256 JSON Web Key is required for DPoP signing.");
+  }
+  return { crv, kty, x, y };
+}
+function canonicalTargetUrl(value) {
+  const url = new URL(value);
+  return `${url.origin}${url.pathname}`;
+}
+async function calculateDpopJkt(privateJwk) {
+  const jwk = publicJwk(privateJwk);
+  return sha256Base64Url(JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y }));
+}
+async function createDpopProof(input2) {
+  const jwk = publicJwk(input2.privateJwk);
+  const key = await crypto.subtle.importKey(
+    "jwk",
+    input2.privateJwk,
+    { name: "ECDSA", namedCurve: "P-256" },
+    false,
+    ["sign"]
+  );
+  const header = encodeJson({ alg: "ES256", typ: "dpop+jwt", jwk });
+  const claims = encodeJson({
+    jti: crypto.randomUUID(),
+    iat: Math.floor(Date.now() / 1e3),
+    htm: input2.method.toUpperCase(),
+    htu: canonicalTargetUrl(input2.targetUrl),
+    ath: await sha256Base64Url(input2.accessToken)
+  });
+  const signature = await crypto.subtle.sign(
+    { name: "ECDSA", hash: "SHA-256" },
+    key,
+    encoder.encode(`${header}.${claims}`)
+  );
+  return `${header}.${claims}.${encodeBase64Url(signature)}`;
+}
 var APP_API_URLS = {
   auth: "https://auth.topolo.app",
   developers: "https://developers.topolo.app"
@@ -2140,7 +2190,17 @@ var TopoloClient = class _TopoloClient {
    * use and for the generic `topolo api` / MCP passthrough tool.
    */
   async request(opts) {
+    return this.requestWithTarget(opts);
+  }
+  async requestWithTarget(opts, publicAction) {
     requireTopoloRuntimeEnvironment(this.environment);
+    const publicOrigin = publicAction ? publicMarketingOrigin(publicAction, this.environment) : void 0;
+    if (publicOrigin && (opts.actorEnvelope !== void 0 || opts.resource !== void 0)) {
+      throw new TopoloSdkError("public_action_context_not_supported", "Public marketing actions do not accept actor or resource authority.");
+    }
+    if (publicOrigin && (!opts.path.startsWith("/") || opts.path.startsWith("//") || opts.path.includes("\\"))) {
+      throw new TopoloSdkError("service_path_origin_mismatch", "Public action paths must be origin-relative paths.");
+    }
     const method = opts.method ?? "GET";
     if (this.requireConfirmForWrites && WRITE_METHODS.has(method) && !opts.confirm) {
       throw new TopoloConfirmationRequiredError(
@@ -2149,7 +2209,7 @@ var TopoloClient = class _TopoloClient {
     }
     const actionId = requestActionId(opts.headers);
     const taskId = opts.actorEnvelope?.delegation?.taskId ?? this.actorContext?.taskId;
-    let requestCredential = await this.loadCurrentCredential({
+    let requestCredential = publicOrigin ? void 0 : await this.loadCurrentCredential({
       service: normalizeLookupKey(opts.service),
       method,
       path: opts.path,
@@ -2157,7 +2217,7 @@ var TopoloClient = class _TopoloClient {
       ...taskId ? { taskId } : {},
       ...opts.resource ? { resource: opts.resource } : {}
     });
-    const resolvedService = opts.baseUrl ? { serviceKey: normalizeLookupKey(opts.service), baseUrl: this.validatedServiceOrigin(opts.service, opts.baseUrl) } : await this.resolveRequestService(opts.service);
+    const resolvedService = publicOrigin ? { serviceKey: normalizeLookupKey(opts.service), baseUrl: publicOrigin } : opts.baseUrl ? { serviceKey: normalizeLookupKey(opts.service), baseUrl: this.validatedServiceOrigin(opts.service, opts.baseUrl) } : await this.resolveRequestService(opts.service);
     const baseUrl = resolvedService.baseUrl;
     const url = new URL(opts.path, baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`);
     if (url.origin !== new URL(baseUrl).origin) {
@@ -2178,17 +2238,21 @@ var TopoloClient = class _TopoloClient {
     headers.set("Accept", "application/json");
     if (opts.body !== void 0) headers.set("Content-Type", "application/json");
     const platformAppId = resolveConfiguredAppId(resolvedService.serviceKey, this.appIds);
-    if (platformAppId) headers.set("X-App-ID", platformAppId);
-    const actorEnvelope = opts.actorEnvelope === void 0 ? void 0 : parseActorEnvelope(opts.actorEnvelope);
+    if (platformAppId && !publicOrigin) headers.set("X-App-ID", platformAppId);
+    const actorEnvelope = publicOrigin || opts.actorEnvelope === void 0 ? void 0 : parseActorEnvelope(opts.actorEnvelope);
     const requestId = actorEnvelope?.action.requestId ?? generateRequestId();
-    applyAuditHeaders(headers, this.agent, requestId);
-    if (opts.headers) {
+    if (!publicOrigin) applyAuditHeaders(headers, this.agent, requestId);
+    if (publicAction) {
+      headers.set(TOPOLO_ACTION_ID_HEADER, publicAction.actionId);
+      headers.set(TOPOLO_ACTION_NAME_HEADER, publicAction.name);
+    }
+    if (opts.headers && !publicOrigin) {
       for (const [k, v] of Object.entries(opts.headers)) headers.set(k, v);
     }
     if (actorEnvelope) {
       headers.set(TOPOLO_ACTOR_ENVELOPE_HEADER, encodeActorEnvelopeHeader(actorEnvelope));
     }
-    if (opts.resource) {
+    if (opts.resource && !publicOrigin) {
       const resourceType = opts.resource.resourceType.trim();
       const resourceId = opts.resource.resourceId.trim();
       if (!resourceType || !resourceId) {
@@ -2213,8 +2277,8 @@ var TopoloClient = class _TopoloClient {
       const signal = opts.signal ? mergeSignals(opts.signal, controller.signal) : controller.signal;
       try {
         const requestHeaders = new Headers(headers);
-        applyAuthHeaders(requestHeaders, requestCredential);
-        if (requestCredential.kind === "dpop_access_token") {
+        if (requestCredential) applyAuthHeaders(requestHeaders, requestCredential);
+        if (requestCredential?.kind === "dpop_access_token") {
           requestHeaders.set("DPoP", await createDpopProof({
             accessToken: requestCredential.accessToken,
             method,
@@ -2222,12 +2286,13 @@ var TopoloClient = class _TopoloClient {
             privateJwk: requestCredential.privateJwk
           }));
         }
-        return await this.credentialedFetch(resolvedService.serviceKey, urlStr, {
+        const init = {
           method,
           headers: requestHeaders,
           body: opts.rawBody ?? (opts.body !== void 0 ? JSON.stringify(opts.body) : null),
           signal
-        });
+        };
+        return publicOrigin ? await fetchPublicMarketingAction((input2, requestInit) => this.fetchImpl(input2, requestInit), publicAction, this.environment, url, init) : await this.credentialedFetch(resolvedService.serviceKey, urlStr, init);
       } catch (error) {
         if (timedOut) {
           throw new TopoloSdkError(
@@ -2235,6 +2300,9 @@ var TopoloClient = class _TopoloClient {
             `Topolo request timed out after ${this.timeoutMs}ms. Verify current state before retrying a mutation.`
           );
         }
+        if (publicOrigin && opts.signal?.aborted) {
+          throw new TopoloSdkError("request_cancelled", "Public action request was cancelled.");
+        }
         throw error;
       } finally {
         clearTimeout(timeoutId);
@@ -2257,7 +2325,7 @@ var TopoloClient = class _TopoloClient {
     try {
       const attemptedCredential = requestCredential;
       res = await fetchWithReadRetry();
-      if (res.status === 401 && attemptedCredential.kind === "access_token" && this.refreshCredential) {
+      if (res.status === 401 && attemptedCredential?.kind === "access_token" && this.refreshCredential) {
         await res.body?.cancel().catch(() => void 0);
         const refreshed = await this.refreshRejectedAccessToken(attemptedCredential.accessToken);
         if (refreshed) {
@@ -2411,6 +2479,9 @@ var TopoloClient = class _TopoloClient {
     return fetchWithCredentialBoundary((input2, requestInit) => this.fetchImpl(input2, requestInit), this.environment, service, target, init);
   }
   validatedActionEntry(entry) {
+    if (isOnePublicMarketingAction(entry)) {
+      return { ...entry, apiBaseUrl: publicMarketingOrigin(entry, this.environment) };
+    }
     if (!entry.apiBaseUrl) return entry;
     return {
       ...entry,
@@ -2652,7 +2723,7 @@ var TopoloClient = class _TopoloClient {
         "TopoloAuth did not return an action catalog for the current credential."
       );
     }
-    const entries = raw.map((item) => normalizeActionCatalogEntry(item)).filter((entry) => Boolean(entry)).map((entry) => this.validatedActionEntry(entry));
+    const entries = raw.map((item) => normalizeActionCatalogEntry(item)).filter((entry) => Boolean(entry));
     return {
       actions: entries,
       page: normalizeCatalogPage(
@@ -2717,11 +2788,18 @@ var TopoloClient = class _TopoloClient {
     const raw = res.data?.action ?? res.action;
     const match = normalizeActionCatalogEntry(raw);
     if (!match) throw new TopoloSdkError("unknown_action", `Unknown or unavailable Topolo action "${action}".`);
+    if (isOnePublicMarketingAction(match) && match.actionId !== actionId) {
+      throw new TopoloSdkError("action_contract_mismatch", "Public action catalog response does not match the requested action ID.");
+    }
     return this.validatedActionEntry(match);
   }
   async callAction(action, input2 = {}, options = {}) {
-    const entry = await this.getAction(action);
-    return this.executeResolvedAction(entry, input2, options);
+    const entry = Object.freeze({ ...await this.getAction(action) });
+    const publicAction = isOnePublicMarketingAction(entry);
+    if (publicAction && entry.actionId !== action.trim()) {
+      throw new TopoloSdkError("action_contract_mismatch", "Public action catalog response does not match the requested action ID.");
+    }
+    return this.executeResolvedAction(entry, input2, options, false, publicAction);
   }
   async issueExternalAgentCredential(input2) {
     const actionId = "app_topolo_auth.principal_credentials.issue";
@@ -2865,7 +2943,15 @@ var TopoloClient = class _TopoloClient {
     }
     return this.executeResolvedAction(entry, input2, options);
   }
-  async executeResolvedAction(entry, input2, options, preserveSensitiveResult = false) {
+  async executeResolvedAction(entry, input2, options, preserveSensitiveResult = false, allowPublicMarketing = false) {
+    if (isOnePublicMarketingAction(entry)) {
+      if (!allowPublicMarketing) {
+        throw new TopoloSdkError("public_action_entrypoint_required", "Public marketing actions require callAction.");
+      }
+      if (options.actorEnvelope !== void 0 || options.resource !== void 0) {
+        throw new TopoloSdkError("public_action_context_not_supported", "Public marketing actions do not accept actor or resource authority.");
+      }
+    }
     const agentAccess = entry.agentAccess ?? (entry.destructive ? "off" : entry.readOnly && !entry.requiresConfirmation ? "auto" : "confirm");
     if (agentAccess === "off") {
       throw new TopoloPermissionError(
@@ -2894,7 +2980,8 @@ var TopoloClient = class _TopoloClient {
       );
     }
     const mapped = mapActionInput(entry, input2);
-    const resolvedActorEnvelope = options.actorEnvelope ?? await this.buildVerifiedAgentActorEnvelope(entry.actionId, input2, options.resource);
+    const publicAction = isOnePublicMarketingAction(entry);
+    const resolvedActorEnvelope = publicAction ? void 0 : options.actorEnvelope ?? await this.buildVerifiedAgentActorEnvelope(entry.actionId, input2, options.resource);
     if (resolvedActorEnvelope) {
       const actorEnvelope = parseActorEnvelope(resolvedActorEnvelope);
       if (actorEnvelope.action.actionId !== entry.actionId) {
@@ -2911,8 +2998,9 @@ var TopoloClient = class _TopoloClient {
     const service = entry.appSlug || entry.appId;
     let result;
     try {
-      result = await this.request({
+      result = await this.requestWithTarget({
         service,
+        signal: options.signal,
         ...entry.apiBaseUrl ? { baseUrl: entry.apiBaseUrl } : {},
         method: entry.method,
         path: mapped.path,
@@ -2925,7 +3013,7 @@ var TopoloClient = class _TopoloClient {
           [TOPOLO_ACTION_NAME_HEADER]: entry.name
         },
         confirm: options.confirm === true || entry.readOnly && !entry.destructive && !entry.requiresConfirmation
-      });
+      }, publicAction ? entry : void 0);
     } catch (error) {
       throw maskActionSecretError(error, this.actionSecrets);
     }

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@topolo/cli",
   "packageManager": "pnpm@10.17.1",
-  "version": "0.13.26",
-  "topoloPublishedVersion": "0.13.26",
+  "version": "0.13.27",
+  "topoloPublishedVersion": "0.13.27",
   "description": "Public command-line interface for Topolo customer organizations, developers, and agents.",
   "license": "UNLICENSED",
   "author": "Topolo",
@@ -33,8 +33,8 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.31.0",
-    "@topolo/mcp": "0.14.38",
-    "@topolo/sdk": "0.24.0",
+    "@topolo/mcp": "0.14.39",
+    "@topolo/sdk": "0.24.1",
     "commander": "^12.1.0",
     "undici": "6.29.0"
   },