@topolo/mcp 0.11.7 → 0.11.9

package/dist/index.js

@@ -724,7 +724,7 @@ function prepareTopoloActionUploadInput(contractValue, content, input, options)
   if (bytes.byteLength > contract.maxBytes) {
     throw new TopoloSdkError("upload_too_large", `Upload content exceeds the ${contract.maxBytes}-byte action limit.`);
   }
-  return mapUploadInput(contract, bytesToBase64(bytes), input, options);
+  return mapUploadInput(contract, encodeTopoloActionBase64(bytes), input, options);
 }
 function prepareTopoloActionBase64UploadInput(contractValue, contentBase64, input, options) {
   const contract = parseTopoloActionUploadContract(contractValue);
@@ -860,7 +860,7 @@ function requiredField(value, name) {
 function matchesContentType(contentType, accepted) {
   return accepted.some((candidate) => candidate === "*/*" || candidate === contentType || candidate.endsWith("/*") && contentType.startsWith(candidate.slice(0, -1)));
 }
-function bytesToBase64(bytes) {
+function encodeTopoloActionBase64(bytes) {
   let binary = "";
   const chunkSize = 32768;
   for (let offset = 0; offset < bytes.length; offset += chunkSize) {
@@ -1037,7 +1037,20 @@ var TopoloClient = class _TopoloClient {
       throw err;
     }
     const contentType = res.headers.get("Content-Type") ?? "";
-    const parsed = contentType.includes("application/json") ? await res.json().catch(() => null) : await res.text().catch(() => null);
+    const normalizedContentType = contentType.split(";", 1)[0]?.trim().toLowerCase() ?? "";
+    let parsed;
+    if (normalizedContentType === "application/json" || normalizedContentType.endsWith("+json")) {
+      parsed = await res.json().catch(() => null);
+    } else if (!res.ok || !normalizedContentType || normalizedContentType.startsWith("text/")) {
+      parsed = await res.text().catch(() => null);
+    } else {
+      const bytes = new Uint8Array(await res.arrayBuffer());
+      parsed = {
+        contentType: normalizedContentType,
+        contentLength: bytes.byteLength,
+        contentBase64: encodeTopoloActionBase64(bytes)
+      };
+    }
     if (!res.ok) {
       const durationMs = Date.now() - startedAt;
       const message = describeError(parsed, `HTTP ${res.status}`);
@@ -1588,7 +1601,7 @@ var TopoloClient = class _TopoloClient {
     }
     const mapped = mapActionInput(entry, input);
     const service = entry.appSlug || entry.appId;
-    return this.request({
+    const result = await this.request({
       service,
       ...entry.apiBaseUrl ? { baseUrl: entry.apiBaseUrl } : {},
       method: entry.method,
@@ -1602,6 +1615,7 @@ var TopoloClient = class _TopoloClient {
       },
       confirm: options.confirm === true || entry.readOnly && !entry.destructive && !entry.requiresConfirmation
     });
+    return redactActionResult(result);
   }
   /**
    * Introspect the current credential. Returns the caller's resolved identity,
@@ -1725,6 +1739,18 @@ function readOptionalString(value) {
 function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function redactActionResult(value) {
+  if (Array.isArray(value)) return value.map(redactActionResult);
+  if (!isRecord3(value)) return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+    key,
+    isSensitiveActionResultKey(key) ? "[REDACTED]" : redactActionResult(item)
+  ]));
+}
+function isSensitiveActionResultKey(key) {
+  const normalized = key.toLowerCase().replace(/[^a-z0-9]/g, "");
+  return ["authorization", "cookie", "setcookie", "proxyauthorization", "capability"].includes(normalized) || /(token|secret|password|privatekey|apikey)$/.test(normalized);
+}
 function resolveConfiguredServiceUrl(slug, serviceUrls) {
   for (const serviceKey of serviceKeyCandidates2(slug)) {
     const configured = serviceUrls?.[serviceKey];

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@topolo/mcp",
-  "version": "0.11.7",
-  "topoloPublishedVersion": "0.11.7",
+  "version": "0.11.9",
+  "topoloPublishedVersion": "0.11.9",
   "description": "Model Context Protocol server for the Topolo platform. Exposes scope-gated tools that third-party agents (Claude, Codex, etc.) can call natively.",
   "license": "UNLICENSED",
   "author": "Topolo",
@@ -35,7 +35,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "@topolo/sdk": "0.11.7"
+    "@topolo/sdk": "0.11.9"
   },
   "devDependencies": {
     "@types/node": "^20.12.0",