@topolo/cli 0.4.4 → 0.4.6

package/dist/index.js

@@ -75,6 +75,7 @@ var APP_API_URLS = {
   auth: "https://auth.topolo.app",
   backup: "https://backup.topolo.app",
   books: "https://books.topolo.app",
+  brand: "https://brand.topolo.app",
   bugfix: "https://bugfix.topolo.app",
   bytes: "https://bytes.topolo.app",
   calendar: "https://calendar.topolo.app",
@@ -255,6 +256,38 @@ var APPLICATIONS = {
       }
     ]
   },
+  "brand": {
+    "id": "brand",
+    "appDir": "TopoloBrand",
+    "name": "topolo-brand",
+    "packageName": "@topolo/topolo-brand",
+    "productionUrl": "https://brand.topolo.app",
+    "services": [
+      "brand"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-brand",
+        "kind": "worker",
+        "apiUrl": "https://brand.topolo.app",
+        "domains": [
+          "brand.topolo.app"
+        ],
+        "routes": [
+          "brand.topolo.app"
+        ],
+        "appId": "brand"
+      },
+      {
+        "name": "topolo-brand-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
   "bugfix": {
     "id": "bugfix",
     "appDir": "TopoloBugFix",
@@ -2369,6 +2402,8 @@ var TopoloClient = class _TopoloClient {
   requireConfirmForWrites;
   timeoutMs;
   fetchImpl;
+  credentialProvider;
+  credentialLoadInFlight = null;
   refreshCredential;
   refreshInFlight = null;
   debug;
@@ -2396,6 +2431,7 @@ var TopoloClient = class _TopoloClient {
     this.requireConfirmForWrites = options.requireConfirmForWrites !== false;
     this.timeoutMs = options.timeoutMs ?? 3e4;
     this.fetchImpl = options.fetch ?? fetch;
+    this.credentialProvider = options.credentialProvider;
     this.refreshCredential = options.refreshCredential;
     this.debug = options.debug;
   }
@@ -2418,6 +2454,7 @@ var TopoloClient = class _TopoloClient {
         `Mutating ${method} requests require { confirm: true }. This guardrail prevents agents from issuing writes without an explicit human-in-the-loop acknowledgement.`
       );
     }
+    await this.loadCurrentCredential();
     const resolvedService = opts.baseUrl ? { serviceKey: normalizeLookupKey(opts.service), baseUrl: requireHttpOrigin(opts.baseUrl) } : await this.resolveRequestService(opts.service);
     const baseUrl = resolvedService.baseUrl;
     const url = new URL(opts.path, baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`);
@@ -2529,6 +2566,19 @@ var TopoloClient = class _TopoloClient {
     });
     return parsed;
   }
+  async loadCurrentCredential() {
+    if (!this.credentialProvider) return;
+    this.credentialLoadInFlight ??= this.credentialProvider().then((credential) => {
+      if (!credential) {
+        throw new TopoloAuthError("The configured Topolo credential is no longer available.");
+      }
+      this.credential = credential;
+      return credential;
+    }).finally(() => {
+      this.credentialLoadInFlight = null;
+    });
+    await this.credentialLoadInFlight;
+  }
   async refreshRejectedAccessToken(attemptedAccessToken) {
     if (this.credential.kind === "access_token" && this.credential.accessToken !== attemptedAccessToken) {
       return this.credential;
@@ -3197,6 +3247,7 @@ function normalizeActionCatalogEntry(item) {
     permissionName: pickActionString(a.permission_name) ?? pickActionString(a.permissionName) ?? "",
     requiredPermission: pickActionString(a.required_permission) ?? pickActionString(a.requiredPermission) ?? "",
     authorizationMode: pickAuthorizationMode(a.authorization_mode ?? a.authorizationMode),
+    allowedServices: stringArray(a.allowed_services ?? a.allowedServices),
     inputSchema: plainObject(a.input_schema ?? a.inputSchema),
     outputSchema: plainObject(a.output_schema ?? a.outputSchema),
     agentContract: plainObject(a.agent_contract ?? a.agentContract),
@@ -3218,7 +3269,7 @@ function pickAgentAccess(value) {
   return value === "auto" || value === "confirm" || value === "off" ? value : null;
 }
 function pickAuthorizationMode(value) {
-  return value === "runtime" ? "runtime" : "static";
+  return value === "runtime" || value === "public" || value === "service" ? value : "static";
 }
 function plainObject(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
@@ -3312,6 +3363,7 @@ var CrmModule = class {
   constructor(client) {
     this.client = client;
   }
+  client;
   async listContacts(options = {}) {
     const res = await this.client.request({
       service: "crm",
@@ -3357,6 +3409,7 @@ var IdentityModule = class {
   constructor(client) {
     this.client = client;
   }
+  client;
   /** Returns the resolved user, organization, and permission set for the
    *  current credential. Equivalent to `TopoloClient.introspect()` — exposed
    *  on this module for symmetry with the other domain modules. */
@@ -3489,6 +3542,7 @@ var APP_API_URLS2 = {
   auth: "https://auth.topolo.app",
   backup: "https://backup.topolo.app",
   books: "https://books.topolo.app",
+  brand: "https://brand.topolo.app",
   bugfix: "https://bugfix.topolo.app",
   bytes: "https://bytes.topolo.app",
   calendar: "https://calendar.topolo.app",
@@ -3817,6 +3871,46 @@ async function refreshCredentialIfNeeded(environment = selectedEnvironment(), op
     return cred;
   }
 }
+async function refreshContextCredentialIfNeeded(environment, key, options = {}) {
+  const config = await readConfig();
+  const profile = profileForEnvironment(config, environment);
+  const context = profile.contexts?.[key];
+  const credential = context?.credential;
+  if (!credential || credential.kind !== "access_token") return credential ?? null;
+  const oauthClientId = context.oauthClientId ?? profile.oauthClientId;
+  if (!credential.refreshToken || !oauthClientId) return credential;
+  const now = Math.floor(Date.now() / 1e3);
+  if (!options.force && credential.expiresAt && credential.expiresAt - REFRESH_SKEW_SECONDS > now) return credential;
+  try {
+    const oauth = new TopoloOAuth2({
+      serviceUrls: resolveServiceUrls(profile.serviceUrls, environment)
+    });
+    const tokens = await oauth.refreshToken({
+      clientId: oauthClientId,
+      refreshToken: credential.refreshToken
+    });
+    const refreshed = {
+      kind: "access_token",
+      accessToken: tokens.access_token,
+      ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: credential.refreshToken },
+      expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
+    };
+    await writeConfig(writeProfileConfig(config, environment, {
+      ...profile.activeContext === key ? { credential: refreshed } : {},
+      contexts: {
+        ...profile.contexts ?? {},
+        [key]: {
+          ...context,
+          credential: refreshed,
+          oauthClientId
+        }
+      }
+    }));
+    return refreshed;
+  } catch {
+    return credential;
+  }
+}
 function resolveAgentName(configAgentName) {
   return process.env.TOPOLO_AGENT_NAME ?? configAgentName;
 }
@@ -5924,6 +6018,7 @@ function packageJson(application, target, options) {
     version: "0.1.0",
     private: true,
     type: "module",
+    ...target === "platform" ? { packageManager: "pnpm@10.17.1" } : {},
     scripts,
     dependencies,
     devDependencies
@@ -5942,7 +6037,7 @@ function topoloPackageVersion(packageName, target) {
     "@topolo/login": "^0.1.0",
     "@topolo-io/app-funnel": "^0.1.6",
     "@topolo-io/app-launcher": "^0.1.15",
-    "@topolo-io/app-shell": "^0.5.54",
+    "@topolo-io/app-shell": "^0.8.4",
     "@topolo-io/auth-client": "^1.2.1",
     "@topolo-io/auth-middleware": "^0.4.0",
     "@topolo-io/error-middleware": "^0.6.0",
@@ -7419,6 +7514,7 @@ function platformWorkerTs(application, options) {
     "import { withSecurityHeaders } from '@topolo-io/security-headers';",
     "import { withErrorReporting } from '@topolo-io/error-middleware';",
     "import { SCAFFOLD_APP_NAME, SCAFFOLD_SERVICE_SLUG, resolveRuntimeAppId } from './app-identity';",
+    "import { topoloActionContracts } from '../../../topolo.action-contracts.mjs';",
     ...options.resources.workflow ? ["import { WorkflowEntrypoint, type WorkflowEvent, type WorkflowStep } from 'cloudflare:workers';"] : [],
     "",
     "export interface Env {",
@@ -7447,6 +7543,7 @@ function platformWorkerTs(application, options) {
     "  // so rt.verifyAuth() targets the correct Auth service per deploy.",
     "  authBaseUrl: (env) => env.AUTH_BASE_URL,",
     "  authGateway: { enabled: false },",
+    "  actionContracts: topoloActionContracts,",
     "});",
     "",
     "async function handleRequest(",
@@ -7476,9 +7573,10 @@ function platformWorkerTs(application, options) {
     "      }, { status: 200 });",
     "    }",
     "",
+    "    const auth = await rt.verifyAuth({ appId });",
+    "    if (!auth.ok) return rt.authError(auth);",
+    "",
     "    if (url.pathname === '/api/widget') {",
-    "      const auth = await rt.verifyAuth({ appId });",
-    "      if (!auth.ok) return rt.authError(auth);",
     "      return rt.json(createTopoloWidgetResponse({",
     "        appId,",
     "        serviceName: SCAFFOLD_APP_NAME,",
@@ -7486,12 +7584,6 @@ function platformWorkerTs(application, options) {
     "      }), { status: 200, headers: { 'Cache-Control': 'public, max-age=15' } });",
     "    }",
     "",
-    "    const auth = await rt.verifyAuth({ appId });",
-    "",
-    "    if (!auth.ok) {",
-    "      return rt.authError(auth);",
-    "    }",
-    "",
     "    if (url.pathname === '/api/bootstrap') {",
     ...bootstrapBody,
     "    }",
@@ -7850,8 +7942,8 @@ function topoloAppManifestJson(application, options) {
     },
     compatibilityFlags: ["nodejs_compat"],
     buildCommand: {
-      staging: "cd ../.. && DEPLOY_ENVIRONMENT=staging VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us npm run build",
-      production: "cd ../.. && DEPLOY_ENVIRONMENT=production VITE_TOPOLO_AUTH_URL=https://auth.topolo.app npm run build"
+      staging: "cd ../.. && DEPLOY_ENVIRONMENT=staging VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us pnpm run build",
+      production: "cd ../.. && DEPLOY_ENVIRONMENT=production VITE_TOPOLO_AUTH_URL=https://auth.topolo.app pnpm run build"
     },
     healthcheckPath: options.api ? "/api/health" : "/",
     ...options.api ? {
@@ -7909,12 +8001,14 @@ function topoloActionContractsMjs() {
     "    name: 'widget.get',",
     "    method: 'GET',",
     "    path: '/api/widget',",
+    "    permission: 'workspace:read',",
     "    input: emptyInput,",
     "  },",
     "  'workspace.bootstrap': {",
     "    name: 'workspace.bootstrap',",
     "    method: 'GET',",
     "    path: '/api/bootstrap',",
+    "    permission: 'workspace:read',",
     "    input: emptyInput,",
     "  },",
     "};",
@@ -8105,7 +8199,7 @@ function cloudcontrolJson(application, options) {
       cloudflare_account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
       config_path: "apps/web/wrangler.toml",
       workdir: "apps/web",
-      build_command: "DEPLOY_ENVIRONMENT=staging VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us npm run build",
+      build_command: "cd ../.. && DEPLOY_ENVIRONMENT=staging VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us pnpm run build",
       output_dir: null,
       production_branch: "staging",
       healthcheck_path: "/api/health",
@@ -8138,7 +8232,7 @@ function cloudcontrolJson(application, options) {
       cloudflare_account_id: CLOUDFLARE_ACCOUNT_ID,
       config_path: "apps/web/wrangler.toml",
       workdir: "apps/web",
-      build_command: "DEPLOY_ENVIRONMENT=production VITE_TOPOLO_AUTH_URL=https://auth.topolo.app npm run build",
+      build_command: "cd ../.. && DEPLOY_ENVIRONMENT=production VITE_TOPOLO_AUTH_URL=https://auth.topolo.app pnpm run build",
       output_dir: null,
       production_branch: "main",
       healthcheck_path: "/api/health",
@@ -8206,17 +8300,17 @@ function cloudcontrolJson(application, options) {
     ci_targets: [
       {
         name: "typecheck",
-        command: "npm run typecheck",
+        command: "pnpm run typecheck",
         required: true
       },
       {
         name: "test",
-        command: "npm run test",
+        command: "pnpm run test",
         required: true
       },
       {
         name: "build",
-        command: "npm run build",
+        command: "pnpm run build",
         required: true
       }
     ],
@@ -11181,6 +11275,10 @@ function hasSameAccessToken(left, right) {
   const rightCredential = right;
   return leftCredential?.kind === "access_token" && rightCredential?.kind === "access_token" && leftCredential.accessToken === rightCredential.accessToken;
 }
+function identityMatchesContext(me, context) {
+  if (context.contextType === "personal") return me.activeType === "personal";
+  return me.activeType === "organization" && me.activeOrgId === context.organizationId;
+}
 function registerContextCommand(program2) {
   const context = program2.command("context").description("Show and switch the active context (personal or an organization)");
   context.command("ls", { isDefault: true }).alias("list").description("List the contexts you can act in and which is active").option("--json", "Output JSON", true).option("--no-json", "Output human-readable text").action(async (opts) => {
@@ -11276,24 +11374,38 @@ function registerContextCommand(program2) {
       const key = contextKey(resolved.contextType, resolved.organizationId);
       const existing = profile.contexts?.[key];
       let newCredential;
-      try {
-        newCredential = await exchangeForContext(cred, serviceUrls, {
-          type: resolved.contextType,
-          id: resolved.organizationId
-        });
-      } catch (error) {
-        if (!isAuthenticationFailure(error)) throw error;
-        const refreshed = await refreshCredentialIfNeeded(environment, { force: true });
-        if (!refreshed || hasSameAccessToken(cred, refreshed)) {
-          throw new Error(
-            `The active credential could not be refreshed. Run \`topolo --env ${environment} auth login\` to sign in again.`
-          );
+      if (existing?.credential && profile.activeContext !== key) {
+        const storedCredential = await refreshContextCredentialIfNeeded(environment, key);
+        if (storedCredential) {
+          try {
+            const storedIdentity = await fetchMe(storedCredential, serviceUrls);
+            if (identityMatchesContext(storedIdentity, resolved)) {
+              newCredential = storedCredential;
+            }
+          } catch {
+          }
+        }
+      }
+      if (!newCredential) {
+        try {
+          newCredential = await exchangeForContext(cred, serviceUrls, {
+            type: resolved.contextType,
+            id: resolved.organizationId
+          });
+        } catch (error) {
+          if (!isAuthenticationFailure(error)) throw error;
+          const refreshed = await refreshCredentialIfNeeded(environment, { force: true });
+          if (!refreshed || hasSameAccessToken(cred, refreshed)) {
+            throw new Error(
+              `The active credential could not be refreshed. Run \`topolo --env ${environment} auth login\` to sign in again.`
+            );
+          }
+          cred = refreshed;
+          newCredential = await exchangeForContext(cred, serviceUrls, {
+            type: resolved.contextType,
+            id: resolved.organizationId
+          });
         }
-        cred = refreshed;
-        newCredential = await exchangeForContext(cred, serviceUrls, {
-          type: resolved.contextType,
-          id: resolved.organizationId
-        });
       }
       resolved.credential = newCredential;
       resolved.oauthClientId = existing?.oauthClientId ?? profile.oauthClientId;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topolo/cli",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "description": "Command-line interface for Topolo developers, operators, and agents, with internal first-party scaffolding available under the topolo platform namespace.",
   "type": "module",
   "bin": {