@topolo/cli 0.2.2 → 0.2.3

package/dist/index.js

@@ -2582,6 +2582,7 @@ var TopoloClient = class _TopoloClient {
     const kind = payload.credentialType === "api_key" ? "api_key" : "access_token";
     return {
       kind,
+      authorizationMode: normalizeCredentialAuthorizationMode(payload.authorizationMode, kind),
       user: {
         id: user.id,
         email: user.email,
@@ -2844,6 +2845,11 @@ function objectToQuery(value) {
   }
   return Object.keys(query).length > 0 ? query : void 0;
 }
+function normalizeCredentialAuthorizationMode(value, kind) {
+  if (kind === "api_key") return "api_key";
+  if (value === "context_rbac" || value === "oauth_scopes" || value === "session_rbac") return value;
+  return "unknown";
+}
 function describeError(body, fallback) {
   if (body && typeof body === "object") {
     const maybe = body;
@@ -3446,7 +3452,7 @@ function resolveOAuthClientId(config, environment = selectedEnvironment()) {
   const envSpecific = process.env[`${envVarPrefix(environment)}_CLI_CLIENT_ID`];
   if (envSpecific) return envSpecific;
   if (process.env.TOPOLO_CLI_CLIENT_ID) return process.env.TOPOLO_CLI_CLIENT_ID;
-  return profileForEnvironment(config, environment).oauthClientId ?? DEFAULT_CLI_CLIENT_IDS[environment];
+  return DEFAULT_CLI_CLIENT_IDS[environment] ?? profileForEnvironment(config, environment).oauthClientId;
 }
 var NON_PROD_URL_MARKERS = {
   staging: [".stg.topolo.us", "topolo-staging"],
@@ -3832,7 +3838,7 @@ function stderrDebugLogger(event) {
 
 // src/commands/whoami.ts
 function registerWhoamiCommand(program2) {
-  program2.command("whoami").description("Show the user, organization, and scopes attached to the current credential").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (opts) => {
+  program2.command("whoami").description("Show the current user, organization, and authorization mode").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (opts) => {
     const mode = resolveOutputMode(opts.json);
     try {
       const environment = selectedEnvironment();
@@ -3857,7 +3863,10 @@ function formatPretty(info) {
     `Organization: ${info.organization ? `${info.organization.name} (${info.organization.slug})` : "(none)"}`
   );
   lines.push(`Credential:   ${info.kind}`);
-  lines.push(`Scopes:       ${info.user.permissions.length === 0 ? "(none)" : ""}`);
+  const dynamicRbac = info.authorizationMode === "context_rbac";
+  const authorization = dynamicRbac ? "Dynamic RBAC (checked per application action)" : info.authorizationMode === "oauth_scopes" ? "Delegated OAuth scopes" : info.authorizationMode === "api_key" ? "API key scopes" : info.authorizationMode === "session_rbac" ? "Session RBAC" : "Credential scopes";
+  lines.push(`Authorization: ${authorization}`);
+  lines.push(`${dynamicRbac ? "Identity scopes" : "Scopes"}: ${info.user.permissions.length === 0 ? "(none)" : ""}`);
   for (const p of info.user.permissions) lines.push(`  - ${p}`);
   return lines.join("\n");
 }
@@ -5169,7 +5178,6 @@ function isFile(filePath) {
 }
 
 // src/commands/app-scaffold.ts
-import { randomBytes } from "crypto";
 import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
 import { dirname as dirname3, resolve as resolve2 } from "path";
 
@@ -6152,12 +6160,15 @@ function platformAppTsx(application, options) {
     "  }",
     "",
     "  if (!auth) {",
+    "    // Pre-AppRoot: appId is still resolving, so auth can't be built yet.",
+    "    // Render the SAME scaffold layout AppRoot uses below so this phase and",
+    "    // the auth-gate fallback read as one continuous loading state (the",
+    "    // scaffold resolves theme + rail width on its own to match the shell).",
     "    return (",
     "      <TopoloAppLoadingScaffold",
     "        appId={appId}",
     "        appName={APP_NAME}",
     "        layout={{ shell: 'topbar', content: 'workspace' }}",
-    "        subtitle={`Loading ${APP_NAME}...`}",
     "      />",
     "    );",
     "  }",
@@ -6198,8 +6209,6 @@ function platformAppTsx(application, options) {
     "          appId={appId}",
     "          appName={APP_NAME}",
     "          layout={{ shell: loading?.shell || 'topbar', content: loading?.content || 'workspace' }}",
-    "          title={loading?.title}",
-    "          subtitle={`Loading ${APP_NAME}...`}",
     "        />",
     "      )}",
     "      shell={{",
@@ -6896,7 +6905,7 @@ function platformWorkerTs(application, options) {
     "import { createTopoloWorkerRuntime, type TopoloRuntimeContext } from '@topolo-io/worker-runtime';",
     "import { withSecurityHeaders } from '@topolo-io/security-headers';",
     "import { withErrorReporting } from '@topolo-io/error-middleware';",
-    "import { SCAFFOLD_APP_ID, SCAFFOLD_APP_NAME, SCAFFOLD_SERVICE_SLUG, resolveRuntimeAppId } from './app-identity';",
+    "import { SCAFFOLD_APP_NAME, SCAFFOLD_SERVICE_SLUG, resolveRuntimeAppId } from './app-identity';",
     ...options.resources.workflow ? ["import { WorkflowEntrypoint, type WorkflowEvent, type WorkflowStep } from 'cloudflare:workers';"] : [],
     "",
     "export interface Env {",
@@ -6921,12 +6930,10 @@ function platformWorkerTs(application, options) {
     "const runtime = createTopoloWorkerRuntime<Env>({",
     "  appName: SCAFFOLD_APP_NAME,",
     "  serviceSlug: SCAFFOLD_SERVICE_SLUG,",
-    "  resolveAppId: (env) => resolveRuntimeAppId(env),",
+    "  // Auth verification base URL is environment-driven (staging/prod/dev),",
+    "  // so rt.verifyAuth() targets the correct Auth service per deploy.",
     "  authBaseUrl: (env) => env.AUTH_BASE_URL,",
-    "  usageMonitoring: {",
-    "    appId: SCAFFOLD_APP_ID,",
-    "    nexusGatewayUrl: (env) => env.NEXUS_GATEWAY_URL,",
-    "  },",
+    "  authGateway: { enabled: false },",
     "});",
     "",
     "async function handleRequest(",
@@ -7348,6 +7355,7 @@ function topoloAppManifestJson(application, options) {
       }
     } : {}
   };
+  const actions = options.api ? baselineApiActions() : [];
   return `${json({
     $schema: "./../../topolo-platform/tooling/app-manifest-schema.json",
     name: `topolo-${slug}`,
@@ -7367,10 +7375,87 @@ function topoloAppManifestJson(application, options) {
         domain: "topolo.app"
       }
     },
-    targets
+    targets,
+    ...actions.length ? { actions } : {}
   })}
 `;
 }
+function topoloActionContractsMjs() {
+  return [
+    "// Canonical action contracts \u2014 the source of truth for the agent/SDK/MCP",
+    "// surface. Each entry maps 1:1 to a worker route (method + path) and validates",
+    "// its input with zod. Add product actions here and mirror them into",
+    "// topolo.app.json actions[]. Mirrors the normalized fleet convention.",
+    "",
+    "import { z } from 'zod';",
+    "",
+    "const emptyInput = z.object({}).strict();",
+    "",
+    "export const topoloActionContracts = {",
+    "  'widget.get': {",
+    "    name: 'widget.get',",
+    "    method: 'GET',",
+    "    path: '/api/widget',",
+    "    input: emptyInput,",
+    "  },",
+    "  'workspace.bootstrap': {",
+    "    name: 'workspace.bootstrap',",
+    "    method: 'GET',",
+    "    path: '/api/bootstrap',",
+    "    input: emptyInput,",
+    "  },",
+    "};",
+    "",
+    "export const topoloActionInputSchemas = Object.fromEntries(",
+    "  Object.entries(topoloActionContracts).map(([name, contract]) => [",
+    "    name,",
+    "    z.toJSONSchema(contract.input),",
+    "  ]),",
+    ");",
+    ""
+  ].join("\n");
+}
+function baselineApiActions() {
+  const emptyInputSchema = {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    type: "object",
+    properties: {},
+    additionalProperties: false
+  };
+  const openOutputSchema = { type: "object", additionalProperties: true };
+  return [
+    {
+      name: "widget.get",
+      title: "Get widget summary",
+      description: "Get the TopoloOne widget summary for this service.",
+      method: "GET",
+      path: "/api/widget",
+      permission: "workspace:read",
+      readOnly: true,
+      inputSchema: emptyInputSchema,
+      outputSchema: openOutputSchema,
+      target: "api",
+      destructive: false,
+      requiresConfirmation: false,
+      agentAccess: "auto"
+    },
+    {
+      name: "workspace.bootstrap",
+      title: "Get workspace bootstrap",
+      description: "Get the signed workspace bootstrap payload for this service.",
+      method: "GET",
+      path: "/api/bootstrap",
+      permission: "workspace:read",
+      readOnly: true,
+      inputSchema: emptyInputSchema,
+      outputSchema: openOutputSchema,
+      target: "api",
+      destructive: false,
+      requiresConfirmation: false,
+      agentAccess: "auto"
+    }
+  ];
+}
 function cloudcontrolJson(application, options) {
   const slug = toSlug(application.id);
   const appPath = firstPartyAppPath(application.appDir, options.audience);
@@ -8024,9 +8109,6 @@ function envExample(application) {
 }
 
 // src/commands/app-scaffold.ts
-function generateOpaqueAppId() {
-  return `app_${randomBytes(9).toString("base64url")}`;
-}
 function standardScriptStub() {
   return `#!/usr/bin/env python3
 """Canonical-fetching stub for .github/scripts/standard_*.py.
@@ -8122,7 +8204,7 @@ function applicationScaffoldPayload(application, options = {}) {
   const name = options.name ?? catalogApplication?.name ?? `topolo-${slug}`;
   const packageName = options.packageName ?? catalogApplication?.packageName ?? `topolo-${slug}`;
   const serviceSlug = api ? target === "platform" ? `topolo-${slug}` : id : null;
-  const defaultAppId = target === "platform" ? generateOpaqueAppId() : catalogApplication?.services[0] ?? id;
+  const defaultAppId = target === "platform" ? `app_topolo_${id}` : catalogApplication?.services[0] ?? id;
   const appId = api ? options.appId ?? defaultAppId : null;
   const productionUrl = browser ? options.productionUrl ?? catalogApplication?.productionUrl ?? `https://${slug}.topolo.app` : null;
   const scopes = scaffoldScopes({ browser, api });
@@ -8438,6 +8520,17 @@ function scaffoldFiles(options) {
           profile: options.payload.profile
         })
       },
+      ...options.api ? [
+        {
+          path: `${base}/topolo.action-contracts.mjs`,
+          purpose: "Zod source of truth for the agent/SDK/MCP action catalog, mirrored into topolo.app.json actions[].",
+          requiredSignals: [
+            "declares topoloActionContracts with name/method/path per action",
+            "each contract has a zod input validator, keeping the manifest actions[] honest"
+          ],
+          content: topoloActionContractsMjs()
+        }
+      ] : [],
       {
         path: `${base}/topolo.cloudcontrol.json`,
         purpose: "CloudControl source of truth for deploy targets, routes, bindings, and CI metadata.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topolo/cli",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Command-line interface for Topolo developers, operators, and agents, with internal first-party scaffolding available under the topolo platform namespace.",
   "type": "module",
   "bin": {