@topolo/cli 0.4.5 → 0.4.6

package/dist/index.js

@@ -75,6 +75,7 @@ var APP_API_URLS = {
   auth: "https://auth.topolo.app",
   backup: "https://backup.topolo.app",
   books: "https://books.topolo.app",
+  brand: "https://brand.topolo.app",
   bugfix: "https://bugfix.topolo.app",
   bytes: "https://bytes.topolo.app",
   calendar: "https://calendar.topolo.app",
@@ -255,6 +256,38 @@ var APPLICATIONS = {
       }
     ]
   },
+  "brand": {
+    "id": "brand",
+    "appDir": "TopoloBrand",
+    "name": "topolo-brand",
+    "packageName": "@topolo/topolo-brand",
+    "productionUrl": "https://brand.topolo.app",
+    "services": [
+      "brand"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-brand",
+        "kind": "worker",
+        "apiUrl": "https://brand.topolo.app",
+        "domains": [
+          "brand.topolo.app"
+        ],
+        "routes": [
+          "brand.topolo.app"
+        ],
+        "appId": "brand"
+      },
+      {
+        "name": "topolo-brand-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
   "bugfix": {
     "id": "bugfix",
     "appDir": "TopoloBugFix",
@@ -2369,6 +2402,8 @@ var TopoloClient = class _TopoloClient {
   requireConfirmForWrites;
   timeoutMs;
   fetchImpl;
+  credentialProvider;
+  credentialLoadInFlight = null;
   refreshCredential;
   refreshInFlight = null;
   debug;
@@ -2396,6 +2431,7 @@ var TopoloClient = class _TopoloClient {
     this.requireConfirmForWrites = options.requireConfirmForWrites !== false;
     this.timeoutMs = options.timeoutMs ?? 3e4;
     this.fetchImpl = options.fetch ?? fetch;
+    this.credentialProvider = options.credentialProvider;
     this.refreshCredential = options.refreshCredential;
     this.debug = options.debug;
   }
@@ -2418,6 +2454,7 @@ var TopoloClient = class _TopoloClient {
         `Mutating ${method} requests require { confirm: true }. This guardrail prevents agents from issuing writes without an explicit human-in-the-loop acknowledgement.`
       );
     }
+    await this.loadCurrentCredential();
     const resolvedService = opts.baseUrl ? { serviceKey: normalizeLookupKey(opts.service), baseUrl: requireHttpOrigin(opts.baseUrl) } : await this.resolveRequestService(opts.service);
     const baseUrl = resolvedService.baseUrl;
     const url = new URL(opts.path, baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`);
@@ -2529,6 +2566,19 @@ var TopoloClient = class _TopoloClient {
     });
     return parsed;
   }
+  async loadCurrentCredential() {
+    if (!this.credentialProvider) return;
+    this.credentialLoadInFlight ??= this.credentialProvider().then((credential) => {
+      if (!credential) {
+        throw new TopoloAuthError("The configured Topolo credential is no longer available.");
+      }
+      this.credential = credential;
+      return credential;
+    }).finally(() => {
+      this.credentialLoadInFlight = null;
+    });
+    await this.credentialLoadInFlight;
+  }
   async refreshRejectedAccessToken(attemptedAccessToken) {
     if (this.credential.kind === "access_token" && this.credential.accessToken !== attemptedAccessToken) {
       return this.credential;
@@ -3197,6 +3247,7 @@ function normalizeActionCatalogEntry(item) {
     permissionName: pickActionString(a.permission_name) ?? pickActionString(a.permissionName) ?? "",
     requiredPermission: pickActionString(a.required_permission) ?? pickActionString(a.requiredPermission) ?? "",
     authorizationMode: pickAuthorizationMode(a.authorization_mode ?? a.authorizationMode),
+    allowedServices: stringArray(a.allowed_services ?? a.allowedServices),
     inputSchema: plainObject(a.input_schema ?? a.inputSchema),
     outputSchema: plainObject(a.output_schema ?? a.outputSchema),
     agentContract: plainObject(a.agent_contract ?? a.agentContract),
@@ -3218,7 +3269,7 @@ function pickAgentAccess(value) {
   return value === "auto" || value === "confirm" || value === "off" ? value : null;
 }
 function pickAuthorizationMode(value) {
-  return value === "runtime" ? "runtime" : "static";
+  return value === "runtime" || value === "public" || value === "service" ? value : "static";
 }
 function plainObject(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
@@ -3312,6 +3363,7 @@ var CrmModule = class {
   constructor(client) {
     this.client = client;
   }
+  client;
   async listContacts(options = {}) {
     const res = await this.client.request({
       service: "crm",
@@ -3357,6 +3409,7 @@ var IdentityModule = class {
   constructor(client) {
     this.client = client;
   }
+  client;
   /** Returns the resolved user, organization, and permission set for the
    *  current credential. Equivalent to `TopoloClient.introspect()` — exposed
    *  on this module for symmetry with the other domain modules. */
@@ -3489,6 +3542,7 @@ var APP_API_URLS2 = {
   auth: "https://auth.topolo.app",
   backup: "https://backup.topolo.app",
   books: "https://books.topolo.app",
+  brand: "https://brand.topolo.app",
   bugfix: "https://bugfix.topolo.app",
   bytes: "https://bytes.topolo.app",
   calendar: "https://calendar.topolo.app",
@@ -5964,6 +6018,7 @@ function packageJson(application, target, options) {
     version: "0.1.0",
     private: true,
     type: "module",
+    ...target === "platform" ? { packageManager: "pnpm@10.17.1" } : {},
     scripts,
     dependencies,
     devDependencies
@@ -5982,7 +6037,7 @@ function topoloPackageVersion(packageName, target) {
     "@topolo/login": "^0.1.0",
     "@topolo-io/app-funnel": "^0.1.6",
     "@topolo-io/app-launcher": "^0.1.15",
-    "@topolo-io/app-shell": "^0.5.54",
+    "@topolo-io/app-shell": "^0.8.4",
     "@topolo-io/auth-client": "^1.2.1",
     "@topolo-io/auth-middleware": "^0.4.0",
     "@topolo-io/error-middleware": "^0.6.0",
@@ -7459,6 +7514,7 @@ function platformWorkerTs(application, options) {
     "import { withSecurityHeaders } from '@topolo-io/security-headers';",
     "import { withErrorReporting } from '@topolo-io/error-middleware';",
     "import { SCAFFOLD_APP_NAME, SCAFFOLD_SERVICE_SLUG, resolveRuntimeAppId } from './app-identity';",
+    "import { topoloActionContracts } from '../../../topolo.action-contracts.mjs';",
     ...options.resources.workflow ? ["import { WorkflowEntrypoint, type WorkflowEvent, type WorkflowStep } from 'cloudflare:workers';"] : [],
     "",
     "export interface Env {",
@@ -7487,6 +7543,7 @@ function platformWorkerTs(application, options) {
     "  // so rt.verifyAuth() targets the correct Auth service per deploy.",
     "  authBaseUrl: (env) => env.AUTH_BASE_URL,",
     "  authGateway: { enabled: false },",
+    "  actionContracts: topoloActionContracts,",
     "});",
     "",
     "async function handleRequest(",
@@ -7516,9 +7573,10 @@ function platformWorkerTs(application, options) {
     "      }, { status: 200 });",
     "    }",
     "",
+    "    const auth = await rt.verifyAuth({ appId });",
+    "    if (!auth.ok) return rt.authError(auth);",
+    "",
     "    if (url.pathname === '/api/widget') {",
-    "      const auth = await rt.verifyAuth({ appId });",
-    "      if (!auth.ok) return rt.authError(auth);",
     "      return rt.json(createTopoloWidgetResponse({",
     "        appId,",
     "        serviceName: SCAFFOLD_APP_NAME,",
@@ -7526,12 +7584,6 @@ function platformWorkerTs(application, options) {
     "      }), { status: 200, headers: { 'Cache-Control': 'public, max-age=15' } });",
     "    }",
     "",
-    "    const auth = await rt.verifyAuth({ appId });",
-    "",
-    "    if (!auth.ok) {",
-    "      return rt.authError(auth);",
-    "    }",
-    "",
     "    if (url.pathname === '/api/bootstrap') {",
     ...bootstrapBody,
     "    }",
@@ -7890,8 +7942,8 @@ function topoloAppManifestJson(application, options) {
     },
     compatibilityFlags: ["nodejs_compat"],
     buildCommand: {
-      staging: "cd ../.. && DEPLOY_ENVIRONMENT=staging VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us npm run build",
-      production: "cd ../.. && DEPLOY_ENVIRONMENT=production VITE_TOPOLO_AUTH_URL=https://auth.topolo.app npm run build"
+      staging: "cd ../.. && DEPLOY_ENVIRONMENT=staging VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us pnpm run build",
+      production: "cd ../.. && DEPLOY_ENVIRONMENT=production VITE_TOPOLO_AUTH_URL=https://auth.topolo.app pnpm run build"
     },
     healthcheckPath: options.api ? "/api/health" : "/",
     ...options.api ? {
@@ -7949,12 +8001,14 @@ function topoloActionContractsMjs() {
     "    name: 'widget.get',",
     "    method: 'GET',",
     "    path: '/api/widget',",
+    "    permission: 'workspace:read',",
     "    input: emptyInput,",
     "  },",
     "  'workspace.bootstrap': {",
     "    name: 'workspace.bootstrap',",
     "    method: 'GET',",
     "    path: '/api/bootstrap',",
+    "    permission: 'workspace:read',",
     "    input: emptyInput,",
     "  },",
     "};",
@@ -8145,7 +8199,7 @@ function cloudcontrolJson(application, options) {
       cloudflare_account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
       config_path: "apps/web/wrangler.toml",
       workdir: "apps/web",
-      build_command: "DEPLOY_ENVIRONMENT=staging VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us npm run build",
+      build_command: "cd ../.. && DEPLOY_ENVIRONMENT=staging VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us pnpm run build",
       output_dir: null,
       production_branch: "staging",
       healthcheck_path: "/api/health",
@@ -8178,7 +8232,7 @@ function cloudcontrolJson(application, options) {
       cloudflare_account_id: CLOUDFLARE_ACCOUNT_ID,
       config_path: "apps/web/wrangler.toml",
       workdir: "apps/web",
-      build_command: "DEPLOY_ENVIRONMENT=production VITE_TOPOLO_AUTH_URL=https://auth.topolo.app npm run build",
+      build_command: "cd ../.. && DEPLOY_ENVIRONMENT=production VITE_TOPOLO_AUTH_URL=https://auth.topolo.app pnpm run build",
       output_dir: null,
       production_branch: "main",
       healthcheck_path: "/api/health",
@@ -8246,17 +8300,17 @@ function cloudcontrolJson(application, options) {
     ci_targets: [
       {
         name: "typecheck",
-        command: "npm run typecheck",
+        command: "pnpm run typecheck",
         required: true
       },
       {
         name: "test",
-        command: "npm run test",
+        command: "pnpm run test",
         required: true
       },
       {
         name: "build",
-        command: "npm run build",
+        command: "pnpm run build",
         required: true
       }
     ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topolo/cli",
-  "version": "0.4.5",
+  "version": "0.4.6",
   "description": "Command-line interface for Topolo developers, operators, and agents, with internal first-party scaffolding available under the topolo platform namespace.",
   "type": "module",
   "bin": {