@topolo/cli 0.2.2 → 0.2.4

package/dist/index.js

@@ -78,6 +78,7 @@ var APP_API_URLS = {
   bugfix: "https://bugfix.topolo.app",
   bytes: "https://bytes.topolo.app",
   calendar: "https://calendar.topolo.app",
+  campaigns: "https://campaigns.topolo.app",
   capacity: "https://capacity.topolo.app",
   chat: "https://chat.topolo.app",
   commerce: "https://commerce.topolo.app",
@@ -336,6 +337,38 @@ var APPLICATIONS = {
       }
     ]
   },
+  "campaigns": {
+    "id": "campaigns",
+    "appDir": "TopoloCampaigns",
+    "name": "topolo-campaigns",
+    "packageName": "topolo-campaigns",
+    "productionUrl": "https://campaigns.topolo.app",
+    "services": [
+      "campaigns"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-campaigns",
+        "kind": "worker",
+        "apiUrl": "https://campaigns.topolo.app",
+        "domains": [
+          "campaigns.topolo.app"
+        ],
+        "routes": [
+          "campaigns.topolo.app"
+        ],
+        "appId": "campaigns"
+      },
+      {
+        "name": "topolo-campaigns-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
   "capacity": {
     "id": "capacity",
     "appDir": "TopoloCapacity",
@@ -2510,7 +2543,21 @@ var TopoloClient = class _TopoloClient {
     return match;
   }
   async callAction(action, input2 = {}, options = {}) {
+    const entry = await this.getAction(action);
+    return this.executeResolvedAction(entry, input2, options);
+  }
+  async readAction(action, input2 = {}, options = {}) {
     const entry = await this.getAction(action);
+    const agentAccess = entry.agentAccess ?? (entry.destructive ? "off" : entry.readOnly && !entry.requiresConfirmation ? "auto" : "confirm");
+    if (entry.method !== "GET" || !entry.readOnly || entry.destructive || entry.requiresConfirmation || agentAccess !== "auto") {
+      throw new TopoloPermissionError(
+        `Topolo action "${entry.actionId}" is not an automatic read-only action.`,
+        entry.requiredPermission ? [entry.requiredPermission] : []
+      );
+    }
+    return this.executeResolvedAction(entry, input2, options);
+  }
+  async executeResolvedAction(entry, input2, options) {
     const agentAccess = entry.agentAccess ?? (entry.destructive ? "off" : entry.readOnly && !entry.requiresConfirmation ? "auto" : "confirm");
     if (agentAccess === "off") {
       throw new TopoloPermissionError(
@@ -2582,6 +2629,7 @@ var TopoloClient = class _TopoloClient {
     const kind = payload.credentialType === "api_key" ? "api_key" : "access_token";
     return {
       kind,
+      authorizationMode: normalizeCredentialAuthorizationMode(payload.authorizationMode, kind),
       user: {
         id: user.id,
         email: user.email,
@@ -2844,6 +2892,11 @@ function objectToQuery(value) {
   }
   return Object.keys(query).length > 0 ? query : void 0;
 }
+function normalizeCredentialAuthorizationMode(value, kind) {
+  if (kind === "api_key") return "api_key";
+  if (value === "context_rbac" || value === "oauth_scopes" || value === "session_rbac") return value;
+  return "unknown";
+}
 function describeError(body, fallback) {
   if (body && typeof body === "object") {
     const maybe = body;
@@ -3064,6 +3117,7 @@ var APP_API_URLS2 = {
   bugfix: "https://bugfix.topolo.app",
   bytes: "https://bytes.topolo.app",
   calendar: "https://calendar.topolo.app",
+  campaigns: "https://campaigns.topolo.app",
   capacity: "https://capacity.topolo.app",
   chat: "https://chat.topolo.app",
   commerce: "https://commerce.topolo.app",
@@ -3388,6 +3442,46 @@ async function refreshCredentialIfNeeded(environment = selectedEnvironment(), op
     return cred;
   }
 }
+async function refreshContextCredentialIfNeeded(environment, key, options = {}) {
+  const config = await readConfig();
+  const profile = profileForEnvironment(config, environment);
+  const context = profile.contexts?.[key];
+  const credential = context?.credential;
+  if (!credential || credential.kind !== "access_token") return credential ?? null;
+  const oauthClientId = context.oauthClientId ?? profile.oauthClientId;
+  if (!credential.refreshToken || !credential.expiresAt || !oauthClientId) return credential;
+  const now = Math.floor(Date.now() / 1e3);
+  if (!options.force && credential.expiresAt - REFRESH_SKEW_SECONDS > now) return credential;
+  try {
+    const oauth = new TopoloOAuth2({
+      serviceUrls: resolveServiceUrls(profile.serviceUrls, environment)
+    });
+    const tokens = await oauth.refreshToken({
+      clientId: oauthClientId,
+      refreshToken: credential.refreshToken
+    });
+    const refreshed = {
+      kind: "access_token",
+      accessToken: tokens.access_token,
+      ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: credential.refreshToken },
+      expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
+    };
+    await writeConfig(writeProfileConfig(config, environment, {
+      ...profile.activeContext === key ? { credential: refreshed } : {},
+      contexts: {
+        ...profile.contexts ?? {},
+        [key]: {
+          ...context,
+          credential: refreshed,
+          oauthClientId
+        }
+      }
+    }));
+    return refreshed;
+  } catch {
+    return credential;
+  }
+}
 function resolveAgentName(configAgentName) {
   return process.env.TOPOLO_AGENT_NAME ?? configAgentName;
 }
@@ -3446,7 +3540,7 @@ function resolveOAuthClientId(config, environment = selectedEnvironment()) {
   const envSpecific = process.env[`${envVarPrefix(environment)}_CLI_CLIENT_ID`];
   if (envSpecific) return envSpecific;
   if (process.env.TOPOLO_CLI_CLIENT_ID) return process.env.TOPOLO_CLI_CLIENT_ID;
-  return profileForEnvironment(config, environment).oauthClientId ?? DEFAULT_CLI_CLIENT_IDS[environment];
+  return DEFAULT_CLI_CLIENT_IDS[environment] ?? profileForEnvironment(config, environment).oauthClientId;
 }
 var NON_PROD_URL_MARKERS = {
   staging: [".stg.topolo.us", "topolo-staging"],
@@ -3832,7 +3926,7 @@ function stderrDebugLogger(event) {
 
 // src/commands/whoami.ts
 function registerWhoamiCommand(program2) {
-  program2.command("whoami").description("Show the user, organization, and scopes attached to the current credential").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (opts) => {
+  program2.command("whoami").description("Show the current user, organization, and authorization mode").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (opts) => {
     const mode = resolveOutputMode(opts.json);
     try {
       const environment = selectedEnvironment();
@@ -3857,7 +3951,10 @@ function formatPretty(info) {
     `Organization: ${info.organization ? `${info.organization.name} (${info.organization.slug})` : "(none)"}`
   );
   lines.push(`Credential:   ${info.kind}`);
-  lines.push(`Scopes:       ${info.user.permissions.length === 0 ? "(none)" : ""}`);
+  const dynamicRbac = info.authorizationMode === "context_rbac";
+  const authorization = dynamicRbac ? "Dynamic RBAC (checked per application action)" : info.authorizationMode === "oauth_scopes" ? "Delegated OAuth scopes" : info.authorizationMode === "api_key" ? "API key scopes" : info.authorizationMode === "session_rbac" ? "Session RBAC" : "Credential scopes";
+  lines.push(`Authorization: ${authorization}`);
+  lines.push(`${dynamicRbac ? "Identity scopes" : "Scopes"}: ${info.user.permissions.length === 0 ? "(none)" : ""}`);
   for (const p of info.user.permissions) lines.push(`  - ${p}`);
   return lines.join("\n");
 }
@@ -5169,7 +5266,6 @@ function isFile(filePath) {
 }
 
 // src/commands/app-scaffold.ts
-import { randomBytes } from "crypto";
 import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
 import { dirname as dirname3, resolve as resolve2 } from "path";
 
@@ -6152,12 +6248,15 @@ function platformAppTsx(application, options) {
     "  }",
     "",
     "  if (!auth) {",
+    "    // Pre-AppRoot: appId is still resolving, so auth can't be built yet.",
+    "    // Render the SAME scaffold layout AppRoot uses below so this phase and",
+    "    // the auth-gate fallback read as one continuous loading state (the",
+    "    // scaffold resolves theme + rail width on its own to match the shell).",
     "    return (",
     "      <TopoloAppLoadingScaffold",
     "        appId={appId}",
     "        appName={APP_NAME}",
     "        layout={{ shell: 'topbar', content: 'workspace' }}",
-    "        subtitle={`Loading ${APP_NAME}...`}",
     "      />",
     "    );",
     "  }",
@@ -6198,8 +6297,6 @@ function platformAppTsx(application, options) {
     "          appId={appId}",
     "          appName={APP_NAME}",
     "          layout={{ shell: loading?.shell || 'topbar', content: loading?.content || 'workspace' }}",
-    "          title={loading?.title}",
-    "          subtitle={`Loading ${APP_NAME}...`}",
     "        />",
     "      )}",
     "      shell={{",
@@ -6896,7 +6993,7 @@ function platformWorkerTs(application, options) {
     "import { createTopoloWorkerRuntime, type TopoloRuntimeContext } from '@topolo-io/worker-runtime';",
     "import { withSecurityHeaders } from '@topolo-io/security-headers';",
     "import { withErrorReporting } from '@topolo-io/error-middleware';",
-    "import { SCAFFOLD_APP_ID, SCAFFOLD_APP_NAME, SCAFFOLD_SERVICE_SLUG, resolveRuntimeAppId } from './app-identity';",
+    "import { SCAFFOLD_APP_NAME, SCAFFOLD_SERVICE_SLUG, resolveRuntimeAppId } from './app-identity';",
     ...options.resources.workflow ? ["import { WorkflowEntrypoint, type WorkflowEvent, type WorkflowStep } from 'cloudflare:workers';"] : [],
     "",
     "export interface Env {",
@@ -6921,12 +7018,10 @@ function platformWorkerTs(application, options) {
     "const runtime = createTopoloWorkerRuntime<Env>({",
     "  appName: SCAFFOLD_APP_NAME,",
     "  serviceSlug: SCAFFOLD_SERVICE_SLUG,",
-    "  resolveAppId: (env) => resolveRuntimeAppId(env),",
+    "  // Auth verification base URL is environment-driven (staging/prod/dev),",
+    "  // so rt.verifyAuth() targets the correct Auth service per deploy.",
     "  authBaseUrl: (env) => env.AUTH_BASE_URL,",
-    "  usageMonitoring: {",
-    "    appId: SCAFFOLD_APP_ID,",
-    "    nexusGatewayUrl: (env) => env.NEXUS_GATEWAY_URL,",
-    "  },",
+    "  authGateway: { enabled: false },",
     "});",
     "",
     "async function handleRequest(",
@@ -7348,6 +7443,7 @@ function topoloAppManifestJson(application, options) {
       }
     } : {}
   };
+  const actions = options.api ? baselineApiActions() : [];
   return `${json({
     $schema: "./../../topolo-platform/tooling/app-manifest-schema.json",
     name: `topolo-${slug}`,
@@ -7367,10 +7463,87 @@ function topoloAppManifestJson(application, options) {
         domain: "topolo.app"
       }
     },
-    targets
+    targets,
+    ...actions.length ? { actions } : {}
   })}
 `;
 }
+function topoloActionContractsMjs() {
+  return [
+    "// Canonical action contracts \u2014 the source of truth for the agent/SDK/MCP",
+    "// surface. Each entry maps 1:1 to a worker route (method + path) and validates",
+    "// its input with zod. Add product actions here and mirror them into",
+    "// topolo.app.json actions[]. Mirrors the normalized fleet convention.",
+    "",
+    "import { z } from 'zod';",
+    "",
+    "const emptyInput = z.object({}).strict();",
+    "",
+    "export const topoloActionContracts = {",
+    "  'widget.get': {",
+    "    name: 'widget.get',",
+    "    method: 'GET',",
+    "    path: '/api/widget',",
+    "    input: emptyInput,",
+    "  },",
+    "  'workspace.bootstrap': {",
+    "    name: 'workspace.bootstrap',",
+    "    method: 'GET',",
+    "    path: '/api/bootstrap',",
+    "    input: emptyInput,",
+    "  },",
+    "};",
+    "",
+    "export const topoloActionInputSchemas = Object.fromEntries(",
+    "  Object.entries(topoloActionContracts).map(([name, contract]) => [",
+    "    name,",
+    "    z.toJSONSchema(contract.input),",
+    "  ]),",
+    ");",
+    ""
+  ].join("\n");
+}
+function baselineApiActions() {
+  const emptyInputSchema = {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    type: "object",
+    properties: {},
+    additionalProperties: false
+  };
+  const openOutputSchema = { type: "object", additionalProperties: true };
+  return [
+    {
+      name: "widget.get",
+      title: "Get widget summary",
+      description: "Get the TopoloOne widget summary for this service.",
+      method: "GET",
+      path: "/api/widget",
+      permission: "workspace:read",
+      readOnly: true,
+      inputSchema: emptyInputSchema,
+      outputSchema: openOutputSchema,
+      target: "api",
+      destructive: false,
+      requiresConfirmation: false,
+      agentAccess: "auto"
+    },
+    {
+      name: "workspace.bootstrap",
+      title: "Get workspace bootstrap",
+      description: "Get the signed workspace bootstrap payload for this service.",
+      method: "GET",
+      path: "/api/bootstrap",
+      permission: "workspace:read",
+      readOnly: true,
+      inputSchema: emptyInputSchema,
+      outputSchema: openOutputSchema,
+      target: "api",
+      destructive: false,
+      requiresConfirmation: false,
+      agentAccess: "auto"
+    }
+  ];
+}
 function cloudcontrolJson(application, options) {
   const slug = toSlug(application.id);
   const appPath = firstPartyAppPath(application.appDir, options.audience);
@@ -8024,9 +8197,6 @@ function envExample(application) {
 }
 
 // src/commands/app-scaffold.ts
-function generateOpaqueAppId() {
-  return `app_${randomBytes(9).toString("base64url")}`;
-}
 function standardScriptStub() {
   return `#!/usr/bin/env python3
 """Canonical-fetching stub for .github/scripts/standard_*.py.
@@ -8122,7 +8292,7 @@ function applicationScaffoldPayload(application, options = {}) {
   const name = options.name ?? catalogApplication?.name ?? `topolo-${slug}`;
   const packageName = options.packageName ?? catalogApplication?.packageName ?? `topolo-${slug}`;
   const serviceSlug = api ? target === "platform" ? `topolo-${slug}` : id : null;
-  const defaultAppId = target === "platform" ? generateOpaqueAppId() : catalogApplication?.services[0] ?? id;
+  const defaultAppId = target === "platform" ? `app_topolo_${id}` : catalogApplication?.services[0] ?? id;
   const appId = api ? options.appId ?? defaultAppId : null;
   const productionUrl = browser ? options.productionUrl ?? catalogApplication?.productionUrl ?? `https://${slug}.topolo.app` : null;
   const scopes = scaffoldScopes({ browser, api });
@@ -8438,6 +8608,17 @@ function scaffoldFiles(options) {
           profile: options.payload.profile
         })
       },
+      ...options.api ? [
+        {
+          path: `${base}/topolo.action-contracts.mjs`,
+          purpose: "Zod source of truth for the agent/SDK/MCP action catalog, mirrored into topolo.app.json actions[].",
+          requiredSignals: [
+            "declares topoloActionContracts with name/method/path per action",
+            "each contract has a zod input validator, keeping the manifest actions[] honest"
+          ],
+          content: topoloActionContractsMjs()
+        }
+      ] : [],
       {
         path: `${base}/topolo.cloudcontrol.json`,
         purpose: "CloudControl source of truth for deploy targets, routes, bindings, and CI metadata.",
@@ -10621,11 +10802,25 @@ function registerContextCommand(program2) {
       }
       const wantPersonal = /^(personal|me)$/i.test(target.trim());
       let resolved;
-      if (wantPersonal) {
+      let exchangeCredential = cred;
+      const needle = target.trim().toLowerCase();
+      const storedEntry = Object.entries(profile.contexts ?? {}).find(([, candidate]) => {
+        if (wantPersonal) return candidate.contextType === "personal";
+        return candidate.contextType === "organization" && (candidate.organizationId === target || candidate.organizationSlug?.toLowerCase() === needle || candidate.organizationName?.toLowerCase() === needle);
+      });
+      const storedContext = storedEntry?.[1];
+      if (storedEntry && storedContext?.credential) {
+        exchangeCredential = await refreshContextCredentialIfNeeded(environment, storedEntry[0]) ?? storedContext.credential;
+        resolved = {
+          contextType: storedContext.contextType,
+          organizationId: storedContext.organizationId,
+          organizationSlug: storedContext.organizationSlug,
+          organizationName: storedContext.organizationName
+        };
+      } else if (wantPersonal) {
         resolved = { contextType: "personal" };
       } else {
         const me = await fetchMe(cred, serviceUrls);
-        const needle = target.trim().toLowerCase();
         const match = me.memberships.find(
           (m) => m.id === target || m.slug?.toLowerCase() === needle || m.name?.toLowerCase() === needle
         );
@@ -10644,13 +10839,13 @@ function registerContextCommand(program2) {
       }
       const key = contextKey(resolved.contextType, resolved.organizationId);
       const existing = profile.contexts?.[key];
-      const newCredential = await exchangeForContext(cred, serviceUrls, {
+      const newCredential = await exchangeForContext(exchangeCredential, serviceUrls, {
         type: resolved.contextType,
         id: resolved.organizationId
       });
       resolved.credential = newCredential;
       resolved.oauthClientId = existing?.oauthClientId ?? profile.oauthClientId;
-      const updated = writeContextCredential(config, environment, resolved, true);
+      const updated = writeContextCredential(await readConfig(), environment, resolved, true);
       await writeConfig(updated);
       emit(
         { environment, active: key, context: { type: resolved.contextType, label: labelFor(resolved) } },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topolo/cli",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Command-line interface for Topolo developers, operators, and agents, with internal first-party scaffolding available under the topolo platform namespace.",
   "type": "module",
   "bin": {