@topolo/mcp 0.14.3 → 0.14.5

package/README.md

@@ -59,7 +59,7 @@ must not use an `npx` launcher because that makes startup network-dependent.
 
 Local stdio action results return `topolo-secret:<id>` references instead of
 bearer credentials. Pass these references unchanged to subsequent published
-actions; SDK 0.21.3 resolves them internally using the OS protected store and
+actions; SDK 0.21.4 resolves nonempty string credentials internally using the OS protected store and
 masks them in plans and diagnostics. Entries are bound to the verified
 principal, organization, API key identity when present, and environment.
 References expire after 30 minutes; accessing an expired entry deletes it.

package/dist/index.js

@@ -3,7 +3,7 @@
 // src/index.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
-// node_modules/.pnpm/@topolo+sdk@0.21.3/node_modules/@topolo/sdk/dist/index.js
+// node_modules/.pnpm/@topolo+sdk@0.22.0/node_modules/@topolo/sdk/dist/index.js
 function applyAuthHeaders(headers, credential) {
   if (credential.kind === "api_key") {
     headers.set("X-Api-Key", credential.apiKey);
@@ -77,6 +77,9 @@ var PUBLIC_ERROR_CODES = /* @__PURE__ */ new Set([
   "unknown_service"
 ]);
 var ERROR_CODE_PATTERN = /^[a-z][a-z0-9_]{0,63}$/;
+var SERVICE_ERROR_CODE_PATTERN = /^[a-z][a-z0-9]*(?:_[a-z][a-z0-9]*){1,9}$/;
+var SERVICE_MESSAGE_MAX_LENGTH = 300;
+var SERVICE_ISSUE_LIMIT = 32;
 var TOPOLO_REQUEST_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var CLOUDFLARE_RAY_ID_PATTERN = /^[0-9a-f]{16}-[A-Z]{3}$/;
 var PERMISSION_PATTERN = /^[a-z][a-z0-9_-]{0,63}(?:\.[a-z][a-z0-9_-]{0,63})*:(?:[a-z][a-z0-9_-]{0,63}|\*)$/;
@@ -101,6 +104,24 @@ function canonicalTopoloErrorCode(value) {
   if (!ERROR_CODE_PATTERN.test(candidate) || !PUBLIC_ERROR_CODES.has(candidate)) return null;
   return candidate;
 }
+function canonicalTopoloServiceErrorCode(value) {
+  const platform2 = canonicalTopoloErrorCode(value);
+  if (platform2) return platform2;
+  if (typeof value !== "string") return null;
+  const candidate = value.trim();
+  if (candidate.length > 64 || !SERVICE_ERROR_CODE_PATTERN.test(candidate)) return null;
+  const wordLike = candidate.split("_").every((segment) => {
+    const digits = segment.replace(/[a-z]/g, "").length;
+    return digits === 0 || digits < segment.length - digits && segment.length <= 8;
+  });
+  return wordLike ? candidate : null;
+}
+function sanitizeTopoloServiceMessage(value) {
+  if (typeof value !== "string") return void 0;
+  const text2 = value.replace(/[\u0000-\u001f\u007f-\u009f\u200b-\u200f\u2028-\u202e\u2066-\u2069\ufeff]/g, " ").replace(/\b[a-z][a-z0-9+.-]*:\/\/\S+/gi, "[url]").replace(/[^\s@<>()[\],;:"']+@[^\s@<>()[\],;:"']+\.[a-z]{2,}/gi, "[email]").replace(/[A-Za-z0-9_\-+/=.]{20,}/g, (run) => /[0-9]/.test(run) && /[A-Za-z]/.test(run) ? "[redacted]" : run).replace(/\s+/g, " ").trim();
+  if (!text2) return void 0;
+  return text2.length > SERVICE_MESSAGE_MAX_LENGTH ? `${text2.slice(0, SERVICE_MESSAGE_MAX_LENGTH - 1).trimEnd()}\u2026` : text2;
+}
 function canonicalTopoloRequestId(value) {
   if (typeof value !== "string") return void 0;
   const candidate = value.trim();
@@ -125,7 +146,7 @@ var TopoloAuthError = class extends TopoloSdkError {
   retryAfter;
   details;
   constructor(message, code = "auth_error", options = {}) {
-    super(canonicalTopoloErrorCode(code) ?? "auth_error", message);
+    super(canonicalTopoloServiceErrorCode(code) ?? "auth_error", message);
     this.name = "TopoloAuthError";
     this.status = options.status ?? 401;
     this.body = options.body;
@@ -149,7 +170,7 @@ var TopoloPermissionError = class extends TopoloSdkError {
   details;
   constructor(message, required, options = {}) {
     super(
-      canonicalTopoloErrorCode(options.code) ?? serviceErrorCode(options.body, "permission_denied"),
+      canonicalTopoloServiceErrorCode(options.code) ?? serviceErrorCode(options.body, "permission_denied"),
       message
     );
     this.name = "TopoloPermissionError";
@@ -168,18 +189,34 @@ var TopoloPermissionError = class extends TopoloSdkError {
 function extractTopoloServiceErrorCode(body) {
   if (!body || typeof body !== "object" || Array.isArray(body)) return null;
   const record2 = body;
-  const topLevel = canonicalTopoloErrorCode(record2.code);
+  const topLevel = canonicalTopoloServiceErrorCode(record2.code);
   if (topLevel) return topLevel;
   const nested = record2.error;
-  const nestedString = canonicalTopoloErrorCode(nested);
+  const nestedString = canonicalTopoloServiceErrorCode(nested);
   if (nestedString) return nestedString;
   if (nested && typeof nested === "object" && !Array.isArray(nested)) {
     const code = nested.code;
-    const nestedCode = canonicalTopoloErrorCode(code);
+    const nestedCode = canonicalTopoloServiceErrorCode(code);
     if (nestedCode) return nestedCode;
   }
   return null;
 }
+function extractTopoloServiceErrorMessage(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return void 0;
+  const record2 = body;
+  const nested = record2.error;
+  const candidates = [];
+  if (nested && typeof nested === "object" && !Array.isArray(nested)) {
+    candidates.push(nested.message);
+  }
+  candidates.push(record2.message, record2.error_description);
+  if (typeof nested === "string" && !canonicalTopoloServiceErrorCode(nested)) candidates.push(nested);
+  for (const candidate of candidates) {
+    const message = sanitizeTopoloServiceMessage(candidate);
+    if (message) return message;
+  }
+  return void 0;
+}
 function serviceErrorCode(body, fallback) {
   return extractTopoloServiceErrorCode(body) ?? fallback;
 }
@@ -193,10 +230,7 @@ function extractTopoloServiceErrorDetails(body) {
     if (candidate === void 0) candidate = nestedRecord.details ?? nestedRecord;
   }
   if (candidate === void 0) candidate = record2;
-  if (Array.isArray(candidate)) {
-    const paths = canonicalTopoloValidationPaths(candidate);
-    return paths.length ? { paths } : void 0;
-  }
+  if (Array.isArray(candidate)) return validationIssueDetails(canonicalTopoloValidationIssues(candidate)) ?? void 0;
   if (!candidate || typeof candidate !== "object") return void 0;
   const source = candidate;
   const safe = {};
@@ -238,18 +272,59 @@ function extractTopoloServiceErrorDetails(body) {
       if (paths.length) safe[key] = paths;
     }
   }
+  const issues = [
+    ...Array.isArray(source.issues) ? canonicalTopoloValidationIssues(source.issues) : [],
+    ...flattenedValidationIssues(source.formErrors, source.fieldErrors)
+  ].slice(0, SERVICE_ISSUE_LIMIT);
+  Object.assign(safe, validationIssueDetails(issues));
   return Object.keys(safe).length ? safe : void 0;
 }
-function canonicalTopoloValidationPaths(issues) {
+function validationIssueDetails(issues) {
+  if (!issues.length) return null;
   const paths = [];
-  for (const issue of issues) {
-    if (!issue || typeof issue !== "object" || Array.isArray(issue)) continue;
-    const record2 = issue;
+  for (const issue22 of issues) {
+    if (issue22.path && !paths.includes(issue22.path)) paths.push(issue22.path);
+  }
+  return paths.length ? { paths, issues } : { issues };
+}
+function issue(path, message) {
+  const text2 = sanitizeTopoloServiceMessage(message);
+  if (!path && !text2) return null;
+  return { ...path ? { path } : {}, ...text2 ? { message: text2 } : {} };
+}
+function canonicalTopoloValidationIssues(values) {
+  const issues = [];
+  for (const value of values) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) continue;
+    const record2 = value;
     const path = canonicalTopoloValidationPath(record2.field) ?? canonicalTopoloValidationPath(record2.path);
-    if (path && !paths.includes(path)) paths.push(path);
-    if (paths.length === 32) break;
+    if (!path) continue;
+    const projected = issue(path, record2.message);
+    if (projected) issues.push(projected);
+    if (issues.length === SERVICE_ISSUE_LIMIT) break;
+  }
+  return issues;
+}
+function flattenedValidationIssues(formErrors, fieldErrors) {
+  const issues = [];
+  if (Array.isArray(formErrors)) {
+    for (const message of formErrors) {
+      const projected = issue(void 0, message);
+      if (projected) issues.push(projected);
+    }
+  }
+  if (fieldErrors && typeof fieldErrors === "object" && !Array.isArray(fieldErrors)) {
+    for (const [key, messages] of Object.entries(fieldErrors)) {
+      const path = canonicalTopoloValidationPath(key);
+      if (!path) continue;
+      const list = Array.isArray(messages) && messages.length ? messages : [void 0];
+      for (const message of list) {
+        const projected = issue(path, message);
+        if (projected) issues.push(projected);
+      }
+    }
   }
-  return paths;
+  return issues;
 }
 function canonicalTopoloValidationPath(value) {
   if (typeof value === "string") {
@@ -271,7 +346,9 @@ function canonicalTopoloValidationPath(value) {
   return PUBLIC_FIELD_PATH_PATTERN.test(path) ? path : void 0;
 }
 function publicTopoloErrorMessage(error) {
-  const code = canonicalTopoloErrorCode(
+  const serviceMessage = typeof error === "string" ? void 0 : extractTopoloServiceErrorMessage(error.body);
+  if (serviceMessage) return serviceMessage;
+  const code = canonicalTopoloServiceErrorCode(
     typeof error === "string" ? error : error.code ?? extractTopoloServiceErrorCode(error.body)
   ) ?? "request_failed";
   if (/(?:organization|org).*(?:enroll|membership|member|admission)/.test(code)) {
@@ -288,7 +365,7 @@ function publicTopoloErrorMessage(error) {
   return `Topolo request failed (${code}).`;
 }
 function topoloErrorHint(error) {
-  const code = canonicalTopoloErrorCode(
+  const code = canonicalTopoloServiceErrorCode(
     typeof error === "string" ? error : error.code ?? extractTopoloServiceErrorCode(error.body)
   );
   if (!code) return void 0;
@@ -372,7 +449,8 @@ async function resolveActionSecrets(value, store, secrets) {
   if (isActionSecretReference(value)) {
     if (!store) throw new TopoloSdkError("action_secret_store_required", "Protected action references require a secret store.");
     const resolved = await store.load(value);
-    if (typeof resolved === "string" && resolved) secrets.set(resolved, value);
+    if (typeof resolved !== "string" || !resolved) throw new TopoloSdkError("action_secret_unsupported_type", "Protected action handoff requires a nonempty string credential.");
+    secrets.set(resolved, value);
     return resolved;
   }
   if (Array.isArray(value)) return Promise.all(value.map((item) => resolveActionSecrets(item, store, secrets)));
@@ -654,8 +732,8 @@ function inspectSchema(schema, path, root, depth) {
   );
   for (const [key, child] of children) {
     if (!isRecord2(child)) continue;
-    const issue = inspectSchema(child, `${path}.${key}`, root, depth + 1);
-    if (issue) return issue;
+    const issue22 = inspectSchema(child, `${path}.${key}`, root, depth + 1);
+    if (issue22) return issue22;
   }
   return null;
 }
@@ -1971,7 +2049,7 @@ var TopoloClient = class _TopoloClient {
       input: selectedInput,
       inputSource: input ? "provided" : example ? "example" : "empty",
       missingFields: [...new Set(
-        plan.validation.errors.filter((issue) => issue.code === "required").map((issue) => issue.path)
+        plan.validation.errors.filter((issue22) => issue22.code === "required").map((issue22) => issue22.path)
       )],
       plan
     };
@@ -2036,7 +2114,7 @@ var TopoloClient = class _TopoloClient {
     if (!validation.valid) {
       throw new TopoloSdkError(
         "invalid_action_input",
-        `Topolo action "${entry.actionId}" input is invalid: ${validation.errors.map((issue) => `${issue.path} ${issue.message}`).join("; ")}`
+        `Topolo action "${entry.actionId}" input is invalid: ${validation.errors.map((issue22) => `${issue22.path} ${issue22.message}`).join("; ")}`
       );
     }
     const resourceIssue = validateActionResource(entry, options.resource);
@@ -3327,7 +3405,7 @@ function createTopolo(options) {
   };
 }
 
-// node_modules/.pnpm/@topolo+sdk@0.21.3/node_modules/@topolo/sdk/dist/node/credential-store.js
+// node_modules/.pnpm/@topolo+sdk@0.22.0/node_modules/@topolo/sdk/dist/node/credential-store.js
 import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2, chmod as chmod2, rm as rm2, stat } from "fs/promises";
 import { existsSync as existsSync2 } from "fs";
 import { homedir as homedir2, platform } from "os";
@@ -3394,6 +3472,9 @@ var PUBLIC_ERROR_CODES2 = /* @__PURE__ */ new Set([
   "unknown_service"
 ]);
 var ERROR_CODE_PATTERN2 = /^[a-z][a-z0-9_]{0,63}$/;
+var SERVICE_ERROR_CODE_PATTERN2 = /^[a-z][a-z0-9]*(?:_[a-z][a-z0-9]*){1,9}$/;
+var SERVICE_MESSAGE_MAX_LENGTH2 = 300;
+var SERVICE_ISSUE_LIMIT2 = 32;
 var TOPOLO_REQUEST_ID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var CLOUDFLARE_RAY_ID_PATTERN2 = /^[0-9a-f]{16}-[A-Z]{3}$/;
 var PERMISSION_PATTERN2 = /^[a-z][a-z0-9_-]{0,63}(?:\.[a-z][a-z0-9_-]{0,63})*:(?:[a-z][a-z0-9_-]{0,63}|\*)$/;
@@ -3418,6 +3499,24 @@ function canonicalTopoloErrorCode2(value) {
   if (!ERROR_CODE_PATTERN2.test(candidate) || !PUBLIC_ERROR_CODES2.has(candidate)) return null;
   return candidate;
 }
+function canonicalTopoloServiceErrorCode2(value) {
+  const platform2 = canonicalTopoloErrorCode2(value);
+  if (platform2) return platform2;
+  if (typeof value !== "string") return null;
+  const candidate = value.trim();
+  if (candidate.length > 64 || !SERVICE_ERROR_CODE_PATTERN2.test(candidate)) return null;
+  const wordLike = candidate.split("_").every((segment) => {
+    const digits = segment.replace(/[a-z]/g, "").length;
+    return digits === 0 || digits < segment.length - digits && segment.length <= 8;
+  });
+  return wordLike ? candidate : null;
+}
+function sanitizeTopoloServiceMessage2(value) {
+  if (typeof value !== "string") return void 0;
+  const text2 = value.replace(/[\u0000-\u001f\u007f-\u009f\u200b-\u200f\u2028-\u202e\u2066-\u2069\ufeff]/g, " ").replace(/\b[a-z][a-z0-9+.-]*:\/\/\S+/gi, "[url]").replace(/[^\s@<>()[\],;:"']+@[^\s@<>()[\],;:"']+\.[a-z]{2,}/gi, "[email]").replace(/[A-Za-z0-9_\-+/=.]{20,}/g, (run) => /[0-9]/.test(run) && /[A-Za-z]/.test(run) ? "[redacted]" : run).replace(/\s+/g, " ").trim();
+  if (!text2) return void 0;
+  return text2.length > SERVICE_MESSAGE_MAX_LENGTH2 ? `${text2.slice(0, SERVICE_MESSAGE_MAX_LENGTH2 - 1).trimEnd()}\u2026` : text2;
+}
 function canonicalTopoloRequestId2(value) {
   if (typeof value !== "string") return void 0;
   const candidate = value.trim();
@@ -3442,7 +3541,7 @@ var TopoloAuthError2 = class extends TopoloSdkError2 {
   retryAfter;
   details;
   constructor(message, code = "auth_error", options = {}) {
-    super(canonicalTopoloErrorCode2(code) ?? "auth_error", message);
+    super(canonicalTopoloServiceErrorCode2(code) ?? "auth_error", message);
     this.name = "TopoloAuthError";
     this.status = options.status ?? 401;
     this.body = options.body;
@@ -3458,14 +3557,14 @@ var TopoloAuthError2 = class extends TopoloSdkError2 {
 function extractTopoloServiceErrorCode2(body) {
   if (!body || typeof body !== "object" || Array.isArray(body)) return null;
   const record2 = body;
-  const topLevel = canonicalTopoloErrorCode2(record2.code);
+  const topLevel = canonicalTopoloServiceErrorCode2(record2.code);
   if (topLevel) return topLevel;
   const nested = record2.error;
-  const nestedString = canonicalTopoloErrorCode2(nested);
+  const nestedString = canonicalTopoloServiceErrorCode2(nested);
   if (nestedString) return nestedString;
   if (nested && typeof nested === "object" && !Array.isArray(nested)) {
     const code = nested.code;
-    const nestedCode = canonicalTopoloErrorCode2(code);
+    const nestedCode = canonicalTopoloServiceErrorCode2(code);
     if (nestedCode) return nestedCode;
   }
   return null;
@@ -3483,10 +3582,7 @@ function extractTopoloServiceErrorDetails2(body) {
     if (candidate === void 0) candidate = nestedRecord.details ?? nestedRecord;
   }
   if (candidate === void 0) candidate = record2;
-  if (Array.isArray(candidate)) {
-    const paths = canonicalTopoloValidationPaths2(candidate);
-    return paths.length ? { paths } : void 0;
-  }
+  if (Array.isArray(candidate)) return validationIssueDetails2(canonicalTopoloValidationIssues2(candidate)) ?? void 0;
   if (!candidate || typeof candidate !== "object") return void 0;
   const source = candidate;
   const safe = {};
@@ -3528,18 +3624,59 @@ function extractTopoloServiceErrorDetails2(body) {
       if (paths.length) safe[key] = paths;
     }
   }
+  const issues = [
+    ...Array.isArray(source.issues) ? canonicalTopoloValidationIssues2(source.issues) : [],
+    ...flattenedValidationIssues2(source.formErrors, source.fieldErrors)
+  ].slice(0, SERVICE_ISSUE_LIMIT2);
+  Object.assign(safe, validationIssueDetails2(issues));
   return Object.keys(safe).length ? safe : void 0;
 }
-function canonicalTopoloValidationPaths2(issues) {
+function validationIssueDetails2(issues) {
+  if (!issues.length) return null;
   const paths = [];
-  for (const issue of issues) {
-    if (!issue || typeof issue !== "object" || Array.isArray(issue)) continue;
-    const record2 = issue;
+  for (const issue22 of issues) {
+    if (issue22.path && !paths.includes(issue22.path)) paths.push(issue22.path);
+  }
+  return paths.length ? { paths, issues } : { issues };
+}
+function issue2(path, message) {
+  const text2 = sanitizeTopoloServiceMessage2(message);
+  if (!path && !text2) return null;
+  return { ...path ? { path } : {}, ...text2 ? { message: text2 } : {} };
+}
+function canonicalTopoloValidationIssues2(values) {
+  const issues = [];
+  for (const value of values) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) continue;
+    const record2 = value;
     const path = canonicalTopoloValidationPath2(record2.field) ?? canonicalTopoloValidationPath2(record2.path);
-    if (path && !paths.includes(path)) paths.push(path);
-    if (paths.length === 32) break;
+    if (!path) continue;
+    const projected = issue2(path, record2.message);
+    if (projected) issues.push(projected);
+    if (issues.length === SERVICE_ISSUE_LIMIT2) break;
+  }
+  return issues;
+}
+function flattenedValidationIssues2(formErrors, fieldErrors) {
+  const issues = [];
+  if (Array.isArray(formErrors)) {
+    for (const message of formErrors) {
+      const projected = issue2(void 0, message);
+      if (projected) issues.push(projected);
+    }
+  }
+  if (fieldErrors && typeof fieldErrors === "object" && !Array.isArray(fieldErrors)) {
+    for (const [key, messages] of Object.entries(fieldErrors)) {
+      const path = canonicalTopoloValidationPath2(key);
+      if (!path) continue;
+      const list = Array.isArray(messages) && messages.length ? messages : [void 0];
+      for (const message of list) {
+        const projected = issue2(path, message);
+        if (projected) issues.push(projected);
+      }
+    }
   }
-  return paths;
+  return issues;
 }
 function canonicalTopoloValidationPath2(value) {
   if (typeof value === "string") {

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@topolo/mcp",
   "packageManager": "pnpm@10.17.1",
-  "version": "0.14.3",
-  "topoloPublishedVersion": "0.14.3",
+  "version": "0.14.5",
+  "topoloPublishedVersion": "0.14.5",
   "description": "Model Context Protocol server for the Topolo platform. Exposes scope-gated tools that third-party agents (Claude, Codex, etc.) can call natively.",
   "license": "UNLICENSED",
   "author": "Topolo",
@@ -36,7 +36,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "@topolo/sdk": "0.21.3"
+    "@topolo/sdk": "0.22.0"
   },
   "devDependencies": {
     "@types/node": "^20.12.0",