@topolo/cli 0.6.2 → 0.6.5

package/README.md

@@ -109,9 +109,13 @@ this too:
 
 ```bash
 topolo actions call app_topolo_mail.messages.send --data '{"mailboxId":"primary","subject":"Hello"}' --confirm
+topolo actions upload app_topolo_brand.brand_assets.upload --file ./logo.png --data '{"assetId":"asset_1"}' --confirm
+topolo actions upload app_topolo_chat.uploads.request --file ./launch.mp4 --data '{}' --complete-data '{"conversationKind":"channel","conversationId":"channel_1"}' --confirm
 topolo api mail POST /api/mail/mailboxes/primary/messages --data '{"subject":"Hello"}' --confirm
 ```
 
+`actions upload` requires the resolved action to publish an upload contract. It reads the file, infers common MIME types or accepts `--content-type`, then follows either the declared inline-base64 mapping or the complete initiate/upload/finish URL-session flow. `--complete-data` supplies only fields required by a declared completion action; the upload/session id is mapped from the initiation response by contract.
+
 ## Commands
 
 ### `topolo whoami`

package/dist/generate-wrangler.mjs

@@ -288,6 +288,7 @@ function emitWranglerToml(targetName, target) {
     lines.push(`directory = ${tomlString(target.assets.directory || target.outputDir || 'dist')}`);
     if (target.assets.binding) lines.push(`binding = ${tomlString(target.assets.binding)}`);
     else lines.push(`binding = "ASSETS"`);
+    if (target.assets.htmlHandling) lines.push(`html_handling = ${tomlString(target.assets.htmlHandling)}`);
     if (target.assets.notFoundHandling) lines.push(`not_found_handling = ${tomlString(target.assets.notFoundHandling)}`);
     if (target.assets.runWorkerFirst !== undefined) lines.push(`run_worker_first = ${tomlString(target.assets.runWorkerFirst)}`);
     lines.push('');
@@ -390,6 +391,7 @@ function emitWranglerToml(targetName, target) {
       lines.push(`[env.${env}.assets]`);
       lines.push(`directory = ${tomlString(target.assets.directory || target.outputDir || 'dist')}`);
       lines.push(`binding = ${tomlString(target.assets.binding || 'ASSETS')}`);
+      if (target.assets.htmlHandling) lines.push(`html_handling = ${tomlString(target.assets.htmlHandling)}`);
       if (target.assets.notFoundHandling) lines.push(`not_found_handling = ${tomlString(target.assets.notFoundHandling)}`);
       if (target.assets.runWorkerFirst !== undefined) lines.push(`run_worker_first = ${tomlString(target.assets.runWorkerFirst)}`);
       lines.push('');
@@ -572,6 +574,20 @@ function emitBindings(lines, bindings, env) {
     lines.push(`service = ${tomlString(service)}`);
     lines.push('');
   }
+  // Cloudflare Secrets Store bindings — the durable data-at-rest key escrow
+  // (docs/data-at-rest-encryption-architecture.md). Store ids differ per env
+  // (per-env Cloudflare accounts), so the shape mirrors d1/kv: per-env config
+  // objects under the binding.
+  for (const s of bindings.secretsStore || []) {
+    if (!bindingAppliesToEnv(s, env)) continue;
+    const cfg = s[env];
+    if (!cfg) continue;
+    lines.push(`[[env.${env}.secrets_store_secrets]]`);
+    lines.push(`binding = ${tomlString(s.binding)}`);
+    lines.push(`store_id = ${tomlString(cfg.storeId)}`);
+    lines.push(`secret_name = ${tomlString(cfg.secretName)}`);
+    lines.push('');
+  }
   for (const a of bindings.ai || []) {
     lines.push(`[env.${env}.ai]`);
     lines.push(`binding = ${tomlString(a.binding)}`);
@@ -595,7 +611,7 @@ function emitCloudcontrol() {
     deployableTargets.flatMap((target) => target.environments || ENVS),
   );
   cc.deploy_method = deployableTargets.length ? 'wrangler' : 'none';
-  cc.ci_provider = existing.ci_provider || 'github_actions';
+  cc.ci_provider = existing.ci_provider || 'local';
   cc.quality_policy = existing.quality_policy || {
     profile: 'first_party_app',
     coverage: { mode: 'ratchet' },

package/dist/index.js

@@ -9,7 +9,7 @@ import { platform as platform2 } from "os";
 import { createInterface } from "readline/promises";
 import { stdin as input } from "process";
 
-// node_modules/@topolo/sdk/dist/index.js
+// ../topolo-sdk/dist/index.js
 function applyAuthHeaders(headers, credential) {
   if (credential.kind === "api_key") {
     headers.set("X-Api-Key", credential.apiKey);
@@ -37,19 +37,54 @@ var TopoloSdkError = class extends Error {
   }
 };
 var TopoloAuthError = class extends TopoloSdkError {
-  constructor(message, code = "auth_error") {
+  status;
+  body;
+  service;
+  path;
+  requestId;
+  retryAfter;
+  constructor(message, code = "auth_error", options = {}) {
     super(code, message);
     this.name = "TopoloAuthError";
+    this.status = options.status ?? 401;
+    this.body = options.body;
+    this.service = options.service;
+    this.path = options.path;
+    this.requestId = options.requestId;
+    this.retryAfter = options.retryAfter;
   }
 };
 var TopoloPermissionError = class extends TopoloSdkError {
   required;
-  constructor(message, required) {
+  status;
+  body;
+  service;
+  path;
+  requestId;
+  retryAfter;
+  constructor(message, required, options = {}) {
     super("permission_denied", message);
     this.name = "TopoloPermissionError";
     this.required = required;
+    this.status = options.status ?? 403;
+    this.body = options.body;
+    this.service = options.service;
+    this.path = options.path;
+    this.requestId = options.requestId;
+    this.retryAfter = options.retryAfter;
   }
 };
+function extractHttpErrorCode(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return "http_error";
+  const record4 = body;
+  if (typeof record4.code === "string" && record4.code.trim()) return record4.code.trim();
+  const nested = record4.error;
+  if (nested && typeof nested === "object" && !Array.isArray(nested)) {
+    const code = nested.code;
+    if (typeof code === "string" && code.trim()) return code.trim();
+  }
+  return "http_error";
+}
 var TopoloConfirmationRequiredError = class extends TopoloSdkError {
   constructor(message) {
     super("confirmation_required", message);
@@ -61,13 +96,17 @@ var TopoloHttpError = class extends TopoloSdkError {
   body;
   service;
   path;
-  constructor(service, path8, status, body, message) {
-    super("http_error", message ?? `HTTP ${status} from ${service}${path8}`);
+  requestId;
+  retryAfter;
+  constructor(service, path8, status, body, message, options = {}) {
+    super(extractHttpErrorCode(body), message ?? `HTTP ${status} from ${service}${path8}`);
     this.name = "TopoloHttpError";
     this.status = status;
     this.body = body;
     this.service = service;
     this.path = path8;
+    this.requestId = options.requestId;
+    this.retryAfter = options.retryAfter;
   }
 };
 var APP_API_URLS = {
@@ -137,7 +176,9 @@ var APPLICATIONS = {
         "domains": [
           "admin.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "admin.topolo.app"
+        ],
         "appId": null
       },
       {
@@ -185,7 +226,7 @@ var APPLICATIONS = {
     "appDir": "TopoloAuth",
     "name": "topolo-auth",
     "packageName": "topolo-auth",
-    "productionUrl": "https://auth.topolo.app/login",
+    "productionUrl": "https://auth.topolo.app",
     "services": [
       "auth"
     ],
@@ -221,7 +262,9 @@ var APPLICATIONS = {
         "domains": [
           "backup.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "backup.topolo.app"
+        ],
         "appId": "backup"
       }
     ]
@@ -305,7 +348,9 @@ var APPLICATIONS = {
         "domains": [
           "bugfix.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "bugfix.topolo.app"
+        ],
         "appId": "bugfix"
       }
     ]
@@ -327,7 +372,9 @@ var APPLICATIONS = {
         "domains": [
           "bytes.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "bytes.topolo.app"
+        ],
         "appId": "bytes"
       },
       {
@@ -357,7 +404,9 @@ var APPLICATIONS = {
         "domains": [
           "calendar.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "calendar.topolo.app"
+        ],
         "appId": "calendar"
       },
       {
@@ -387,9 +436,7 @@ var APPLICATIONS = {
         "domains": [
           "campaigns.topolo.app"
         ],
-        "routes": [
-          "campaigns.topolo.app"
-        ],
+        "routes": [],
         "appId": "campaigns"
       },
       {
@@ -419,7 +466,9 @@ var APPLICATIONS = {
         "domains": [
           "capacity.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "capacity.topolo.app"
+        ],
         "appId": "capacity"
       }
     ]
@@ -441,7 +490,9 @@ var APPLICATIONS = {
         "domains": [
           "chat.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "chat.topolo.app"
+        ],
         "appId": "chat"
       },
       {
@@ -479,7 +530,9 @@ var APPLICATIONS = {
         "domains": [
           "guest.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "guest.topolo.app"
+        ],
         "appId": null
       },
       {
@@ -489,7 +542,9 @@ var APPLICATIONS = {
         "domains": [
           "commerce.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "commerce.topolo.app"
+        ],
         "appId": "commerce"
       },
       {
@@ -499,7 +554,9 @@ var APPLICATIONS = {
         "domains": [
           "station-commerce.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "station-commerce.topolo.app"
+        ],
         "appId": null
       }
     ]
@@ -677,7 +734,9 @@ var APPLICATIONS = {
         "domains": [
           "docs.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "docs.topolo.app"
+        ],
         "appId": null
       },
       {
@@ -707,7 +766,9 @@ var APPLICATIONS = {
         "domains": [
           "feed-analytics-api.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "feed-analytics-api.topolo.app"
+        ],
         "appId": null
       },
       {
@@ -717,7 +778,9 @@ var APPLICATIONS = {
         "domains": [
           "feed-api.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "feed-api.topolo.app"
+        ],
         "appId": null
       },
       {
@@ -727,7 +790,9 @@ var APPLICATIONS = {
         "domains": [
           "feed.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "feed.topolo.app"
+        ],
         "appId": "feed"
       }
     ]
@@ -809,7 +874,9 @@ var APPLICATIONS = {
         "domains": [
           "forms.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "forms.topolo.app"
+        ],
         "appId": "forms"
       },
       {
@@ -839,7 +906,9 @@ var APPLICATIONS = {
         "domains": [
           "home.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "home.topolo.app"
+        ],
         "appId": "home"
       },
       {
@@ -929,7 +998,9 @@ var APPLICATIONS = {
         "domains": [
           "learn.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "learn.topolo.app"
+        ],
         "appId": "learn"
       },
       {
@@ -983,7 +1054,9 @@ var APPLICATIONS = {
         "domains": [
           "mail.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "mail.topolo.app"
+        ],
         "appId": "mail"
       },
       {
@@ -1021,7 +1094,9 @@ var APPLICATIONS = {
         "domains": [
           "mdm.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "mdm.topolo.app"
+        ],
         "appId": "mdm"
       }
     ]
@@ -1043,7 +1118,9 @@ var APPLICATIONS = {
         "domains": [
           "messages.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "messages.topolo.app"
+        ],
         "appId": "messages"
       },
       {
@@ -1077,11 +1154,13 @@ var APPLICATIONS = {
       {
         "name": "topolo-nexus-dashboard",
         "kind": "worker",
-        "apiUrl": null,
+        "apiUrl": "https://nexus.topolo.app",
         "domains": [
           "nexus.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "nexus.topolo.app"
+        ],
         "appId": null
       },
       {
@@ -1137,7 +1216,9 @@ var APPLICATIONS = {
         "domains": [
           "observability-watch.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "observability-watch.topolo.app"
+        ],
         "appId": "observability_watch"
       }
     ]
@@ -1209,7 +1290,9 @@ var APPLICATIONS = {
         "domains": [
           "p2p.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "p2p.topolo.app"
+        ],
         "appId": "p2p"
       },
       {
@@ -1324,7 +1407,9 @@ var APPLICATIONS = {
         "domains": [
           "quro.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "quro.topolo.app"
+        ],
         "appId": null
       }
     ]
@@ -1406,7 +1491,9 @@ var APPLICATIONS = {
         "domains": [
           "studio.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "studio.topolo.app"
+        ],
         "appId": "social_studio"
       },
       {
@@ -1444,7 +1531,9 @@ var APPLICATIONS = {
         "domains": [
           "socialize.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "socialize.topolo.app"
+        ],
         "appId": "socialize"
       },
       {
@@ -1454,7 +1543,9 @@ var APPLICATIONS = {
         "domains": [
           "socialize-api.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "socialize-api.topolo.app"
+        ],
         "appId": null
       },
       {
@@ -1514,7 +1605,9 @@ var APPLICATIONS = {
         "domains": [
           "status.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "status.topolo.app"
+        ],
         "appId": "status"
       }
     ]
@@ -1600,7 +1693,9 @@ var APPLICATIONS = {
         "domains": [
           "survey.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "survey.topolo.app"
+        ],
         "appId": "survey"
       },
       {
@@ -1630,7 +1725,9 @@ var APPLICATIONS = {
         "domains": [
           "voice.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "voice.topolo.app"
+        ],
         "appId": "voice"
       },
       {
@@ -1681,7 +1778,9 @@ var APPLICATIONS = {
         "domains": [
           "web.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "web.topolo.app"
+        ],
         "appId": "web"
       }
     ]
@@ -1758,7 +1857,7 @@ var APPLICATION_REQUIREMENTS = [
       "Use TopoloAppMetricCard, TopoloAppEmptyState, TopoloAppStatusBadge, TopoloAppGrid, and TopoloAppSection for repeated app body patterns",
       "Keep visual QA fixtures available through visualQa=1 or __devpreview=1 so screenshot checks do not depend on live API state",
       "Keep mobile and desktop shell behavior aligned with the platform UI kit",
-      "Constrain app-owned workspace wrappers with min-width: 0, width: auto, and viewport-aware max-width so shell padding cannot create page-level horizontal overflow"
+      "Constrain the app workspace-view layout wrappers with min-width: 0, width: auto, and viewport-aware max-width so shell padding cannot create page-level horizontal overflow"
     ]
   },
   {
@@ -2387,6 +2486,166 @@ function isMultipleOf(value, divisor) {
   const quotient = value / divisor;
   return Math.abs(quotient - Math.round(quotient)) < Number.EPSILON * Math.max(1, Math.abs(quotient)) * 4;
 }
+function parseTopoloActionUploadContract(value) {
+  if (!isRecord2(value) || value.profile !== "inline-base64" && value.profile !== "url-session") {
+    throw new TopoloSdkError("upload_contract_unavailable", "This action does not publish a supported upload contract.");
+  }
+  const contentTypeField = requiredField(value.contentTypeField, "contentTypeField");
+  const fileNameField = requiredField(value.fileNameField, "fileNameField");
+  const maxBytes = Number(value.maxBytes);
+  const acceptedContentTypes = Array.isArray(value.acceptedContentTypes) ? value.acceptedContentTypes.map((item) => String(item).trim().toLowerCase()).filter(Boolean) : [];
+  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0 || acceptedContentTypes.length === 0) {
+    throw new TopoloSdkError("invalid_upload_contract", "The action upload contract must declare maxBytes and acceptedContentTypes.");
+  }
+  if (value.profile === "inline-base64") {
+    return {
+      profile: "inline-base64",
+      contentField: requiredField(value.contentField, "contentField"),
+      contentTypeField,
+      fileNameField,
+      maxBytes,
+      acceptedContentTypes
+    };
+  }
+  const uploadMethod = value.uploadMethod === "PUT" || value.uploadMethod === "POST" ? value.uploadMethod : null;
+  const uploadUrlPath = requiredPath(value.uploadUrlPath, "uploadUrlPath");
+  const complete = value.complete === void 0 ? void 0 : parseCompleteContract(value.complete);
+  if (!uploadMethod) throw new TopoloSdkError("invalid_upload_contract", "The action upload contract has an invalid uploadMethod.");
+  return {
+    profile: "url-session",
+    fileNameField,
+    contentTypeField,
+    sizeField: requiredField(value.sizeField, "sizeField"),
+    maxBytes,
+    acceptedContentTypes,
+    uploadUrlPath,
+    uploadMethod,
+    ...complete ? { complete } : {}
+  };
+}
+function prepareTopoloActionUploadInput(contractValue, content, input3, options) {
+  const contract = parseTopoloActionUploadContract(contractValue);
+  if (contract.profile !== "inline-base64") throw unsupportedInlineProfile();
+  const bytes = content instanceof Uint8Array ? content : new Uint8Array(content);
+  if (bytes.byteLength === 0) {
+    throw new TopoloSdkError("invalid_upload_content", "Upload content must not be empty.");
+  }
+  if (bytes.byteLength > contract.maxBytes) {
+    throw new TopoloSdkError("upload_too_large", `Upload content exceeds the ${contract.maxBytes}-byte action limit.`);
+  }
+  return mapUploadInput(contract, bytesToBase64(bytes), input3, options);
+}
+function prepareTopoloActionBase64UploadInput(contractValue, contentBase64, input3, options) {
+  const contract = parseTopoloActionUploadContract(contractValue);
+  if (contract.profile !== "inline-base64") throw unsupportedInlineProfile();
+  if (!isCanonicalBase64(contentBase64)) {
+    throw new TopoloSdkError("invalid_upload_content", "Upload content must be canonical base64.");
+  }
+  const padding = contentBase64.endsWith("==") ? 2 : contentBase64.endsWith("=") ? 1 : 0;
+  const byteLength = contentBase64.length / 4 * 3 - padding;
+  if (byteLength === 0) throw new TopoloSdkError("invalid_upload_content", "Upload content must not be empty.");
+  if (byteLength > contract.maxBytes) {
+    throw new TopoloSdkError("upload_too_large", `Upload content exceeds the ${contract.maxBytes}-byte action limit.`);
+  }
+  return mapUploadInput(contract, contentBase64, input3, options);
+}
+function prepareTopoloUrlSessionUploadInput(contractValue, byteLength, input3, options) {
+  const contract = parseTopoloActionUploadContract(contractValue);
+  if (contract.profile !== "url-session") {
+    throw new TopoloSdkError("invalid_upload_contract", "This action does not publish a URL-session upload contract.");
+  }
+  validateUploadMetadata(contract, byteLength, options);
+  return {
+    contract,
+    input: {
+      ...input3,
+      [contract.fileNameField]: options.fileName.trim(),
+      [contract.contentTypeField]: options.contentType.trim().toLowerCase(),
+      [contract.sizeField]: byteLength
+    }
+  };
+}
+function topoloUploadResponseValue(response, path8) {
+  return path8.split(".").reduce((value, segment) => isRecord2(value) ? value[segment] : void 0, response);
+}
+function decodeTopoloActionBase64(contentBase64) {
+  if (!isCanonicalBase64(contentBase64)) {
+    throw new TopoloSdkError("invalid_upload_content", "Upload content must be canonical base64.");
+  }
+  const binary = atob(contentBase64);
+  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+}
+function mapUploadInput(contract, contentBase64, input3, options) {
+  validateUploadMetadata(contract, Math.max(1, decodedBase64Size(contentBase64)), options);
+  const fileName = options.fileName.trim();
+  const contentType = options.contentType.trim().toLowerCase();
+  return {
+    ...input3,
+    [contract.contentField]: contentBase64,
+    [contract.contentTypeField]: contentType,
+    [contract.fileNameField]: fileName
+  };
+}
+function validateUploadMetadata(contract, byteLength, options) {
+  const fileName = options.fileName.trim();
+  const contentType = options.contentType.trim().toLowerCase();
+  if (!fileName) throw new TopoloSdkError("invalid_upload_file_name", "Upload fileName must not be empty.");
+  if (!Number.isSafeInteger(byteLength) || byteLength <= 0) {
+    throw new TopoloSdkError("invalid_upload_content", "Upload content must not be empty.");
+  }
+  if (byteLength > contract.maxBytes) {
+    throw new TopoloSdkError("upload_too_large", `Upload content exceeds the ${contract.maxBytes}-byte action limit.`);
+  }
+  if (!matchesContentType(contentType, contract.acceptedContentTypes)) {
+    throw new TopoloSdkError("unsupported_upload_content_type", `Content type "${contentType}" is not accepted by this action.`);
+  }
+}
+function decodedBase64Size(contentBase64) {
+  const padding = contentBase64.endsWith("==") ? 2 : contentBase64.endsWith("=") ? 1 : 0;
+  return contentBase64.length / 4 * 3 - padding;
+}
+function parseCompleteContract(value) {
+  if (!isRecord2(value)) throw new TopoloSdkError("invalid_upload_contract", "The action upload completion contract is invalid.");
+  return {
+    actionId: requiredPath(value.actionId, "complete.actionId"),
+    inputField: requiredField(value.inputField, "complete.inputField"),
+    responsePath: requiredPath(value.responsePath, "complete.responsePath")
+  };
+}
+function requiredPath(value, name) {
+  const path8 = typeof value === "string" ? value.trim() : "";
+  if (!/^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)*$/.test(path8)) {
+    throw new TopoloSdkError("invalid_upload_contract", `The action upload contract has an invalid ${name}.`);
+  }
+  return path8;
+}
+function unsupportedInlineProfile() {
+  return new TopoloSdkError("invalid_upload_contract", "This action does not publish an inline-base64 upload contract.");
+}
+function isCanonicalBase64(value) {
+  return value.length > 0 && value.length % 4 === 0 && /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value);
+}
+function requiredField(value, name) {
+  const field = typeof value === "string" ? value.trim() : "";
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(field)) {
+    throw new TopoloSdkError("invalid_upload_contract", `The action upload contract has an invalid ${name}.`);
+  }
+  return field;
+}
+function matchesContentType(contentType, accepted) {
+  return accepted.some((candidate) => candidate === "*/*" || candidate === contentType || candidate.endsWith("/*") && contentType.startsWith(candidate.slice(0, -1)));
+}
+function bytesToBase64(bytes) {
+  let binary = "";
+  const chunkSize = 32768;
+  for (let offset = 0; offset < bytes.length; offset += chunkSize) {
+    binary += String.fromCharCode(...bytes.subarray(offset, offset + chunkSize));
+  }
+  return btoa(binary);
+}
+function isRecord2(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
 var WRITE_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
 var TOPOLO_ACTION_ID_HEADER = "X-Topolo-Action-Id";
 var TOPOLO_ACTION_NAME_HEADER = "X-Topolo-Action-Name";
@@ -2463,6 +2722,9 @@ var TopoloClient = class _TopoloClient {
         if (v !== void 0) url.searchParams.set(k, String(v));
       }
     }
+    if (opts.body !== void 0 && opts.rawBody !== void 0) {
+      throw new TopoloSdkError("invalid_request_body", "body and rawBody are mutually exclusive.");
+    }
     const headers = new Headers();
     headers.set("Accept", "application/json");
     if (opts.body !== void 0) headers.set("Content-Type", "application/json");
@@ -2497,7 +2759,7 @@ var TopoloClient = class _TopoloClient {
         return await this.fetchImpl(urlStr, {
           method,
           headers: new Headers(headers),
-          body: opts.body !== void 0 ? JSON.stringify(opts.body) : null,
+          body: opts.rawBody ?? (opts.body !== void 0 ? JSON.stringify(opts.body) : null),
           signal
         });
       } finally {
@@ -2545,14 +2807,32 @@ var TopoloClient = class _TopoloClient {
         error: message,
         status: res.status
       });
-      if (res.status === 401) throw new TopoloAuthError(describeError(parsed, "Unauthorized"));
+      const errorContext = {
+        status: res.status,
+        body: parsed,
+        service: resolvedService.serviceKey,
+        path: opts.path,
+        requestId: res.headers.get("X-Topolo-Request-Id") || requestId,
+        retryAfter: res.headers.get("Retry-After") || void 0
+      };
+      if (res.status === 401) {
+        throw new TopoloAuthError(describeError(parsed, "Unauthorized"), "auth_error", errorContext);
+      }
       if (res.status === 403) {
         throw new TopoloPermissionError(
           describeError(parsed, "Permission denied"),
-          extractRequired(parsed)
+          extractRequired(parsed),
+          errorContext
         );
       }
-      throw new TopoloHttpError(resolvedService.serviceKey, opts.path, res.status, parsed);
+      throw new TopoloHttpError(
+        resolvedService.serviceKey,
+        opts.path,
+        res.status,
+        parsed,
+        message,
+        errorContext
+      );
     }
     this.emit({
       phase: "response",
@@ -2711,7 +2991,7 @@ var TopoloClient = class _TopoloClient {
     }
     const entries = [];
     for (const item of raw) {
-      if (!isRecord2(item)) continue;
+      if (!isRecord3(item)) continue;
       const s = item;
       const appId = typeof s.app_id === "string" ? s.app_id : typeof s.id === "string" ? s.id : null;
       if (!appId) continue;
@@ -2786,8 +3066,8 @@ var TopoloClient = class _TopoloClient {
       "app_topolo_auth.service_api_key_resources.list",
       { appId: service.appId }
     );
-    const payload = isRecord2(response) && isRecord2(response.data) ? response.data : response;
-    if (!isRecord2(payload) || !Array.isArray(payload.resources)) {
+    const payload = isRecord3(response) && isRecord3(response.data) ? response.data : response;
+    if (!isRecord3(payload) || !Array.isArray(payload.resources)) {
       throw new TopoloSdkError("resource_catalog_unavailable", "TopoloAuth did not return bindable resources.");
     }
     return {
@@ -2893,6 +3173,71 @@ var TopoloClient = class _TopoloClient {
     const entry = await this.getAction(action);
     return this.executeResolvedAction(entry, input3, options);
   }
+  async uploadAction(action, content, input3, options) {
+    const entry = await this.getAction(action);
+    const contract = parseTopoloActionUploadContract(entry.agentContract?.upload);
+    if (contract.profile === "url-session") {
+      const bytes = content instanceof Uint8Array ? content : new Uint8Array(content);
+      return this.executeUrlSessionUpload(entry, contract, bytes, input3, options);
+    }
+    const uploadInput = prepareTopoloActionUploadInput(entry.agentContract?.upload, content, input3, options);
+    return this.executeResolvedAction(entry, uploadInput, options);
+  }
+  async uploadActionBase64(action, contentBase64, input3, options) {
+    const entry = await this.getAction(action);
+    const contract = parseTopoloActionUploadContract(entry.agentContract?.upload);
+    if (contract.profile === "url-session") {
+      return this.executeUrlSessionUpload(entry, contract, decodeTopoloActionBase64(contentBase64), input3, options);
+    }
+    const uploadInput = prepareTopoloActionBase64UploadInput(entry.agentContract?.upload, contentBase64, input3, options);
+    return this.executeResolvedAction(entry, uploadInput, options);
+  }
+  async executeUrlSessionUpload(entry, contract, bytes, input3, options) {
+    const prepared = prepareTopoloUrlSessionUploadInput(contract, bytes.byteLength, input3, options);
+    const initiation = await this.executeResolvedAction(entry, prepared.input, options);
+    const uploadUrl = topoloUploadResponseValue(initiation, contract.uploadUrlPath);
+    if (typeof uploadUrl !== "string" || !uploadUrl.trim()) {
+      throw new TopoloSdkError("invalid_upload_response", `Upload action response is missing ${contract.uploadUrlPath}.`);
+    }
+    await this.putUrlSessionContent(entry, uploadUrl, contract.uploadMethod, bytes, options);
+    if (!contract.complete) return initiation;
+    const completionValue = topoloUploadResponseValue(initiation, contract.complete.responsePath);
+    if (typeof completionValue !== "string" || !completionValue.trim()) {
+      throw new TopoloSdkError("invalid_upload_response", `Upload action response is missing ${contract.complete.responsePath}.`);
+    }
+    const completion = await this.getAction(contract.complete.actionId);
+    return this.executeResolvedAction(completion, {
+      ...options.completionInput ?? {},
+      [contract.complete.inputField]: completionValue
+    }, options);
+  }
+  async putUrlSessionContent(entry, uploadUrl, method, bytes, options) {
+    const service = entry.appSlug || entry.appId;
+    const resolved = entry.apiBaseUrl ? { serviceKey: normalizeLookupKey(service), baseUrl: requireHttpOrigin(entry.apiBaseUrl) } : await this.resolveRequestService(service);
+    const target = new URL(uploadUrl, resolved.baseUrl.endsWith("/") ? resolved.baseUrl : `${resolved.baseUrl}/`);
+    const body = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+    if (target.origin === new URL(resolved.baseUrl).origin) {
+      await this.request({
+        service,
+        baseUrl: resolved.baseUrl,
+        path: target.toString(),
+        method,
+        rawBody: body,
+        headers: { "Content-Type": options.contentType.trim().toLowerCase() },
+        resource: options.resource,
+        confirm: options.confirm
+      });
+      return;
+    }
+    const response = await this.fetchImpl(target, {
+      method,
+      headers: { "Content-Type": options.contentType.trim().toLowerCase() },
+      body
+    });
+    if (!response.ok) {
+      throw new TopoloHttpError(service, target.pathname, response.status, await response.text(), `Upload transport failed with HTTP ${response.status}.`);
+    }
+  }
   async validateActionInput(action, input3 = {}) {
     const entry = await this.getAction(action);
     return { action: entry, validation: validateTopoloActionInput(entry.inputSchema, input3) };
@@ -3051,7 +3396,7 @@ function resolveConfiguredAppId(slug, appIds) {
   return null;
 }
 function normalizeApiKeyResourceMetadata(input3) {
-  if (!isRecord2(input3)) return null;
+  if (!isRecord3(input3)) return null;
   const resourceType = readString(input3.resourceType ?? input3.resource_type);
   const label = readString(input3.label);
   const emptyLabel = readString(input3.emptyLabel ?? input3.empty_label);
@@ -3085,7 +3430,7 @@ function normalizeApiKeyResourceMetadataList(input3) {
   return resources;
 }
 function normalizeBindableResource(input3) {
-  if (!isRecord2(input3)) return null;
+  if (!isRecord3(input3)) return null;
   const resourceType = readString(input3.resourceType ?? input3.resource_type);
   const resourceId = readString(input3.resourceId ?? input3.resource_id);
   if (!resourceType || !resourceId) return null;
@@ -3096,13 +3441,13 @@ function normalizeBindableResource(input3) {
     slug: readOptionalString(input3.slug),
     status: readOptionalString(input3.status),
     organizationId: readOptionalString(input3.organizationId ?? input3.organization_id),
-    metadata: isRecord2(input3.metadata) ? input3.metadata : {}
+    metadata: isRecord3(input3.metadata) ? input3.metadata : {}
   };
 }
 function normalizeResourceBindings(input3) {
   if (!Array.isArray(input3)) return [];
   return input3.flatMap((binding) => {
-    if (!isRecord2(binding)) return [];
+    if (!isRecord3(binding)) return [];
     const resourceType = readString(binding.resourceType ?? binding.resource_type);
     const resourceId = readString(binding.resourceId ?? binding.resource_id);
     return resourceType && resourceId ? [{ resourceType, resourceId }] : [];
@@ -3115,7 +3460,7 @@ function readOptionalString(value) {
   const normalized = readString(value);
   return normalized || null;
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function resolveConfiguredServiceUrl(slug, serviceUrls) {
@@ -3187,14 +3532,14 @@ function catalogSearchQuery(options) {
   return query;
 }
 function normalizeCatalogPage(value) {
-  if (!isRecord2(value)) return { nextCursor: null, hasMore: false };
+  if (!isRecord3(value)) return { nextCursor: null, hasMore: false };
   return {
     nextCursor: typeof value.nextCursor === "string" && value.nextCursor ? value.nextCursor : null,
     hasMore: value.hasMore === true
   };
 }
 function normalizeServiceCatalogEntry(item) {
-  if (!isRecord2(item)) return null;
+  if (!isRecord3(item)) return null;
   const appId = typeof item.app_id === "string" ? item.app_id : typeof item.id === "string" ? item.id : null;
   if (!appId) return null;
   const permissions = Array.isArray(item.granted_permissions) ? item.granted_permissions.filter(
@@ -3504,7 +3849,7 @@ function createTopolo(options) {
   };
 }
 
-// node_modules/@topolo/sdk/dist/node/credential-store.js
+// ../topolo-sdk/dist/node/credential-store.js
 import { mkdir, readFile, writeFile, chmod } from "fs/promises";
 import { existsSync } from "fs";
 import { homedir, platform } from "os";
@@ -3518,23 +3863,50 @@ var TopoloSdkError2 = class extends Error {
   }
 };
 var TopoloAuthError2 = class extends TopoloSdkError2 {
-  constructor(message, code = "auth_error") {
+  status;
+  body;
+  service;
+  path;
+  requestId;
+  retryAfter;
+  constructor(message, code = "auth_error", options = {}) {
     super(code, message);
     this.name = "TopoloAuthError";
+    this.status = options.status ?? 401;
+    this.body = options.body;
+    this.service = options.service;
+    this.path = options.path;
+    this.requestId = options.requestId;
+    this.retryAfter = options.retryAfter;
   }
 };
+function extractHttpErrorCode2(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return "http_error";
+  const record4 = body;
+  if (typeof record4.code === "string" && record4.code.trim()) return record4.code.trim();
+  const nested = record4.error;
+  if (nested && typeof nested === "object" && !Array.isArray(nested)) {
+    const code = nested.code;
+    if (typeof code === "string" && code.trim()) return code.trim();
+  }
+  return "http_error";
+}
 var TopoloHttpError2 = class extends TopoloSdkError2 {
   status;
   body;
   service;
   path;
-  constructor(service, path8, status, body, message) {
-    super("http_error", message ?? `HTTP ${status} from ${service}${path8}`);
+  requestId;
+  retryAfter;
+  constructor(service, path8, status, body, message, options = {}) {
+    super(extractHttpErrorCode2(body), message ?? `HTTP ${status} from ${service}${path8}`);
     this.name = "TopoloHttpError";
     this.status = status;
     this.body = body;
     this.service = service;
     this.path = path8;
+    this.requestId = options.requestId;
+    this.retryAfter = options.retryAfter;
   }
 };
 var APP_API_URLS2 = {
@@ -4011,6 +4383,10 @@ function fail(err, mode) {
     process.stderr.write(`Error: ${payload.message}
 `);
     if (payload.code) process.stderr.write(`Code:  ${payload.code}
+`);
+    if (payload.status) process.stderr.write(`HTTP:  ${payload.status}
+`);
+    if (payload.requestId) process.stderr.write(`Request: ${payload.requestId}
 `);
     if (payload.hint) process.stderr.write(`Hint:  ${payload.hint}
 `);
@@ -4029,6 +4405,12 @@ function normalizeError(err) {
     return {
       message: err.message,
       code,
+      status: err.status,
+      service: err.service,
+      path: err.path,
+      requestId: err.requestId,
+      retryAfter: err.retryAfter,
+      details: err.body,
       hint: code ? hintMap[code] : void 0,
       exitCode: code === "auth_error" || code === "confirmation_required" ? 2 : code === "permission_denied" ? 3 : code === "immutable_drift" ? 4 : 1
     };
@@ -4397,6 +4779,7 @@ function formatPretty(info) {
 
 // src/commands/actions.ts
 import { readFileSync as readFileSync2 } from "fs";
+import { basename, extname } from "path";
 
 // src/commands/api.ts
 var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
@@ -4551,6 +4934,30 @@ function registerActionsCommand(program2) {
       fail(err, mode);
     }
   });
+  actions.command("upload <action>").description("Upload one local file through an action-declared upload contract").requiredOption("--file <path>", "Local file to upload").option("--content-type <type>", "MIME type; inferred for common file extensions").option("-d, --data <json-or-@file>", "Additional JSON action input or @path to a JSON file", "{}").option("--complete-data <json-or-@file>", "Additional input for a declared completion action", "{}").option("--resource-type <type>", "App-local resource alias, such as workspace").option("--resource-id <id>", "Resource id for the selected resource type").option("--confirm", "Acknowledge a mutating upload action").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (action, opts, command) => {
+    const mode = resolveOutputMode(opts.json ?? command.parent?.opts().json);
+    try {
+      const topolo = await requiredClient();
+      const contentType = opts.contentType?.trim().toLowerCase() || inferContentType(opts.file);
+      if (!contentType) throw new Error("--content-type is required for this file extension");
+      const resource = parseResourceOption(opts.resourceType, opts.resourceId);
+      const result = await topolo.client.uploadAction(
+        action,
+        readFileSync2(opts.file),
+        parseJsonObject(opts.data || "{}"),
+        {
+          fileName: basename(opts.file),
+          contentType,
+          completionInput: parseJsonObject(opts.completeData || "{}"),
+          confirm: opts.confirm === true,
+          ...resource ? { resource } : {}
+        }
+      );
+      emit(result, mode, () => JSON.stringify(result, null, 2));
+    } catch (err) {
+      fail(err, mode);
+    }
+  });
   actions.command("validate <action>").description("Validate action input locally against the published JSON Schema").option("-d, --data <json-or-@file>", "JSON action input or @path to a JSON file", "{}").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (action, opts, command) => {
     const mode = resolveOutputMode(opts.json ?? command.parent?.opts().json);
     try {
@@ -4631,6 +5038,21 @@ function parseJsonObject(value) {
   }
   return parsed;
 }
+function inferContentType(path8) {
+  return {
+    ".avif": "image/avif",
+    ".gif": "image/gif",
+    ".heic": "image/heic",
+    ".jpeg": "image/jpeg",
+    ".jpg": "image/jpeg",
+    ".mov": "video/quicktime",
+    ".mp4": "video/mp4",
+    ".pdf": "application/pdf",
+    ".png": "image/png",
+    ".svg": "image/svg+xml",
+    ".webp": "image/webp"
+  }[extname(path8).toLowerCase()] ?? null;
+}
 function formatActionRows(rows, nextCursor = null) {
   if (rows.length === 0) return "No actions available for this credential.";
   const serviceWidth = Math.max(7, ...rows.map((row) => (row.appSlug || row.appId).length));
@@ -11692,16 +12114,16 @@ function scanStagingProductionUrls(rootInput, allowPatterns) {
   const allowlist = allowPatterns.map((pattern) => new RegExp(pattern));
   const violations = [];
   function shouldSkipFile(filePath) {
-    const basename = path7.basename(filePath);
+    const basename2 = path7.basename(filePath);
     const relativePath2 = path7.relative(root, filePath);
-    if (basename === "package-lock.json" || basename === "pnpm-lock.yaml" || basename === "yarn.lock") return true;
-    if (basename === "topolo.cloudcontrol.json") return true;
-    if (basename === "wrangler.toml" || basename === "wrangler.jsonc") return true;
-    if (basename === "consumer-graph.json") return true;
-    if (/^cloudcontrol-deployment-report-.+\.json$/.test(basename)) return true;
-    if (basename.endsWith(".generated.ts")) return true;
-    if (basename.endsWith(".test.ts") || basename.endsWith(".test.tsx") || basename.endsWith(".spec.ts")) return true;
-    if (basename === ".env.production") return true;
+    if (basename2 === "package-lock.json" || basename2 === "pnpm-lock.yaml" || basename2 === "yarn.lock") return true;
+    if (basename2 === "topolo.cloudcontrol.json") return true;
+    if (basename2 === "wrangler.toml" || basename2 === "wrangler.jsonc") return true;
+    if (basename2 === "consumer-graph.json") return true;
+    if (/^cloudcontrol-deployment-report-.+\.json$/.test(basename2)) return true;
+    if (basename2.endsWith(".generated.ts")) return true;
+    if (basename2.endsWith(".test.ts") || basename2.endsWith(".test.tsx") || basename2.endsWith(".spec.ts")) return true;
+    if (basename2 === ".env.production") return true;
     if (relativePath2 === path7.join("src", "environment.ts") || relativePath2 === path7.join("src", "environmentUrls.ts") || relativePath2.endsWith(path7.join("src", "environment.ts")) || relativePath2.endsWith(path7.join("src", "lib", "environment.ts")) || relativePath2 === path7.join("packages", "topolo-ui-kit", "src", "environmentUrls.ts")) return true;
     if (relativePath2.includes(`${path7.sep}test${path7.sep}`) || relativePath2.includes(`${path7.sep}tests${path7.sep}`) || relativePath2.includes(`${path7.sep}e2e${path7.sep}`)) return true;
     if (relativePath2.startsWith(`scripts${path7.sep}`) || relativePath2.includes(`${path7.sep}scripts${path7.sep}`)) return true;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@topolo/cli",
-  "version": "0.6.2",
-  "topoloPublishedVersion": "0.6.2",
+  "version": "0.6.5",
+  "topoloPublishedVersion": "0.6.5",
   "description": "Command-line interface for Topolo developers, operators, and agents, with internal first-party scaffolding available under the topolo platform namespace.",
   "type": "module",
   "bin": {
@@ -12,7 +12,7 @@
     "skills"
   ],
   "scripts": {
-    "build:sdk": "pnpm --dir ../topolo-sdk build",
+    "build:sdk": "python3 ../../tooling/with-resource-lock.py ../topolo-sdk -- pnpm --dir ../topolo-sdk build",
     "prebuild": "pnpm run build:sdk",
     "build": "tsup && node scripts/vendor-generator.mjs",
     "dev": "tsup --watch",
@@ -29,7 +29,7 @@
     "commander": "^12.1.0"
   },
   "devDependencies": {
-    "@topolo/sdk": "latest",
+    "@topolo/sdk": "file:../topolo-sdk",
     "@types/node": "^20.12.0",
     "@vitest/coverage-v8": "3.2.6",
     "tsup": "^8.0.0",