@topolo/sdk 0.11.0 → 0.11.1

package/README.md

@@ -191,25 +191,17 @@ Still routes through auth + audit headers. Mutating methods still require
 | `TopoloHttpError`        | Other non-2xx responses                  |
 | `TopoloSdkError`         | Base class                               |
 
-## Service URL Overrides
+## Service URL overrides
 
-Defaults target production. Override per-service for staging/dev:
+Defaults target production. Self-hosted installations may override a service:
 
 ```ts
 createTopolo({
   /* ... */
   serviceUrls: {
-    mail: 'https://mail.stg.topolo.us',
+    mail: 'https://mail.example.com',
   },
 });
 ```
 
 Or via env: `TOPOLO_SERVICE_URL_MAIL=...` (falls through `resolveServiceUrl`).
-
-## Development
-
-```bash
-npm install
-npm run build
-npm run typecheck
-```

package/dist/node/credential-store.cjs

@@ -571,6 +571,41 @@ async function resolveCredential(environment = selectedEnvironment()) {
   return profileForEnvironment(config, environment).credential ?? null;
 }
 var REFRESH_SKEW_SECONDS = 60;
+var CONFIG_LOCK_RETRY_MS = 25;
+var CONFIG_LOCK_TIMEOUT_MS = 5e3;
+var CONFIG_LOCK_STALE_MS = 12e4;
+async function withConfigWriteLock(operation) {
+  const lockPath = `${configPath()}.lock`;
+  await (0, import_promises.mkdir)((0, import_node_path.dirname)(lockPath), { recursive: true });
+  const startedAt = Date.now();
+  while (true) {
+    try {
+      await (0, import_promises.mkdir)(lockPath);
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      try {
+        const lock = await (0, import_promises.stat)(lockPath);
+        if (Date.now() - lock.mtimeMs > CONFIG_LOCK_STALE_MS) {
+          await (0, import_promises.rm)(lockPath, { recursive: true, force: true });
+          continue;
+        }
+      } catch (inspectionError) {
+        if (inspectionError.code !== "ENOENT") throw inspectionError;
+        continue;
+      }
+      if (Date.now() - startedAt >= CONFIG_LOCK_TIMEOUT_MS) {
+        throw new Error(`Timed out waiting for credential configuration lock at ${lockPath}.`);
+      }
+      await new Promise((resolve) => setTimeout(resolve, CONFIG_LOCK_RETRY_MS));
+    }
+  }
+  try {
+    return await operation();
+  } finally {
+    await (0, import_promises.rm)(lockPath, { recursive: true, force: true });
+  }
+}
 async function refreshCredentialIfNeeded(environment = selectedEnvironment(), options = {}) {
   const prefix = envVarPrefix(environment);
   if (process.env[`${prefix}_API_KEY`] || process.env[`${prefix}_ACCESS_TOKEN`] || environment === "production" && process.env.TOPOLO_API_KEY || environment === "production" && process.env.TOPOLO_ACCESS_TOKEN) {
@@ -624,51 +659,47 @@ async function refreshCredentialIfNeeded(environment = selectedEnvironment(), op
   }
 }
 async function refreshContextCredentialIfNeeded(environment, key, options = {}) {
-  const config = await readConfig();
-  const profile = profileForEnvironment(config, environment);
-  const context = profile.contexts?.[key];
-  const credential = context?.credential;
-  if (!credential || credential.kind !== "access_token") return credential ?? null;
-  const oauthClientId = context.oauthClientId ?? profile.oauthClientId;
-  if (!credential.refreshToken || !oauthClientId) return credential;
-  const now = Math.floor(Date.now() / 1e3);
-  if (!options.force && credential.expiresAt && credential.expiresAt - REFRESH_SKEW_SECONDS > now) return credential;
-  const serviceUrls = resolveServiceUrls(profile.serviceUrls, environment);
-  if (environment === "local" && !serviceUrls?.auth) {
-    throw new TopoloSdkError(
-      "environment_service_url_required",
-      "Local Topolo context refresh requires an explicit local Auth service origin."
-    );
-  }
-  try {
-    const oauth = new TopoloOAuth({
-      serviceUrls
-    });
-    const tokens = await oauth.refreshToken({
-      clientId: oauthClientId,
-      refreshToken: credential.refreshToken
-    });
-    const refreshed = {
-      kind: "access_token",
-      accessToken: tokens.access_token,
-      ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: credential.refreshToken },
-      expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
-    };
-    await writeConfig(writeProfileConfig(config, environment, {
-      ...profile.activeContext === key ? { credential: refreshed } : {},
-      contexts: {
-        ...profile.contexts ?? {},
-        [key]: {
-          ...context,
-          credential: refreshed,
-          oauthClientId
+  return withConfigWriteLock(async () => {
+    const config = await readConfig();
+    const profile = profileForEnvironment(config, environment);
+    const context = profile.contexts?.[key];
+    const credential = context?.credential;
+    if (!credential || credential.kind !== "access_token") return credential ?? null;
+    const oauthClientId = context.oauthClientId ?? profile.oauthClientId;
+    if (!credential.refreshToken || !oauthClientId) return credential;
+    const now = Math.floor(Date.now() / 1e3);
+    if (!options.force && credential.expiresAt && credential.expiresAt - REFRESH_SKEW_SECONDS > now) return credential;
+    const serviceUrls = resolveServiceUrls(profile.serviceUrls, environment);
+    if (environment === "local" && !serviceUrls?.auth) {
+      throw new TopoloSdkError(
+        "environment_service_url_required",
+        "Local Topolo context refresh requires an explicit local Auth service origin."
+      );
+    }
+    try {
+      const oauth = new TopoloOAuth({ serviceUrls });
+      const tokens = await oauth.refreshToken({
+        clientId: oauthClientId,
+        refreshToken: credential.refreshToken
+      });
+      const refreshed = {
+        kind: "access_token",
+        accessToken: tokens.access_token,
+        ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: credential.refreshToken },
+        expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
+      };
+      await writeConfig(writeProfileConfig(config, environment, {
+        ...profile.activeContext === key ? { credential: refreshed } : {},
+        contexts: {
+          ...profile.contexts ?? {},
+          [key]: { ...context, credential: refreshed, oauthClientId }
         }
-      }
-    }));
-    return refreshed;
-  } catch {
-    return credential;
-  }
+      }));
+      return refreshed;
+    } catch {
+      return credential;
+    }
+  });
 }
 function resolveAgentName(configAgentName) {
   return process.env.TOPOLO_AGENT_NAME ?? configAgentName;

package/dist/node/credential-store.js

@@ -1,5 +1,5 @@
 // src/node/credential-store.ts
-import { mkdir, readFile, writeFile, chmod } from "fs/promises";
+import { mkdir, readFile, writeFile, chmod, rm, stat } from "fs/promises";
 import { existsSync } from "fs";
 import { homedir, platform } from "os";
 import { dirname, join } from "path";
@@ -524,6 +524,41 @@ async function resolveCredential(environment = selectedEnvironment()) {
   return profileForEnvironment(config, environment).credential ?? null;
 }
 var REFRESH_SKEW_SECONDS = 60;
+var CONFIG_LOCK_RETRY_MS = 25;
+var CONFIG_LOCK_TIMEOUT_MS = 5e3;
+var CONFIG_LOCK_STALE_MS = 12e4;
+async function withConfigWriteLock(operation) {
+  const lockPath = `${configPath()}.lock`;
+  await mkdir(dirname(lockPath), { recursive: true });
+  const startedAt = Date.now();
+  while (true) {
+    try {
+      await mkdir(lockPath);
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      try {
+        const lock = await stat(lockPath);
+        if (Date.now() - lock.mtimeMs > CONFIG_LOCK_STALE_MS) {
+          await rm(lockPath, { recursive: true, force: true });
+          continue;
+        }
+      } catch (inspectionError) {
+        if (inspectionError.code !== "ENOENT") throw inspectionError;
+        continue;
+      }
+      if (Date.now() - startedAt >= CONFIG_LOCK_TIMEOUT_MS) {
+        throw new Error(`Timed out waiting for credential configuration lock at ${lockPath}.`);
+      }
+      await new Promise((resolve) => setTimeout(resolve, CONFIG_LOCK_RETRY_MS));
+    }
+  }
+  try {
+    return await operation();
+  } finally {
+    await rm(lockPath, { recursive: true, force: true });
+  }
+}
 async function refreshCredentialIfNeeded(environment = selectedEnvironment(), options = {}) {
   const prefix = envVarPrefix(environment);
   if (process.env[`${prefix}_API_KEY`] || process.env[`${prefix}_ACCESS_TOKEN`] || environment === "production" && process.env.TOPOLO_API_KEY || environment === "production" && process.env.TOPOLO_ACCESS_TOKEN) {
@@ -577,51 +612,47 @@ async function refreshCredentialIfNeeded(environment = selectedEnvironment(), op
   }
 }
 async function refreshContextCredentialIfNeeded(environment, key, options = {}) {
-  const config = await readConfig();
-  const profile = profileForEnvironment(config, environment);
-  const context = profile.contexts?.[key];
-  const credential = context?.credential;
-  if (!credential || credential.kind !== "access_token") return credential ?? null;
-  const oauthClientId = context.oauthClientId ?? profile.oauthClientId;
-  if (!credential.refreshToken || !oauthClientId) return credential;
-  const now = Math.floor(Date.now() / 1e3);
-  if (!options.force && credential.expiresAt && credential.expiresAt - REFRESH_SKEW_SECONDS > now) return credential;
-  const serviceUrls = resolveServiceUrls(profile.serviceUrls, environment);
-  if (environment === "local" && !serviceUrls?.auth) {
-    throw new TopoloSdkError(
-      "environment_service_url_required",
-      "Local Topolo context refresh requires an explicit local Auth service origin."
-    );
-  }
-  try {
-    const oauth = new TopoloOAuth({
-      serviceUrls
-    });
-    const tokens = await oauth.refreshToken({
-      clientId: oauthClientId,
-      refreshToken: credential.refreshToken
-    });
-    const refreshed = {
-      kind: "access_token",
-      accessToken: tokens.access_token,
-      ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: credential.refreshToken },
-      expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
-    };
-    await writeConfig(writeProfileConfig(config, environment, {
-      ...profile.activeContext === key ? { credential: refreshed } : {},
-      contexts: {
-        ...profile.contexts ?? {},
-        [key]: {
-          ...context,
-          credential: refreshed,
-          oauthClientId
+  return withConfigWriteLock(async () => {
+    const config = await readConfig();
+    const profile = profileForEnvironment(config, environment);
+    const context = profile.contexts?.[key];
+    const credential = context?.credential;
+    if (!credential || credential.kind !== "access_token") return credential ?? null;
+    const oauthClientId = context.oauthClientId ?? profile.oauthClientId;
+    if (!credential.refreshToken || !oauthClientId) return credential;
+    const now = Math.floor(Date.now() / 1e3);
+    if (!options.force && credential.expiresAt && credential.expiresAt - REFRESH_SKEW_SECONDS > now) return credential;
+    const serviceUrls = resolveServiceUrls(profile.serviceUrls, environment);
+    if (environment === "local" && !serviceUrls?.auth) {
+      throw new TopoloSdkError(
+        "environment_service_url_required",
+        "Local Topolo context refresh requires an explicit local Auth service origin."
+      );
+    }
+    try {
+      const oauth = new TopoloOAuth({ serviceUrls });
+      const tokens = await oauth.refreshToken({
+        clientId: oauthClientId,
+        refreshToken: credential.refreshToken
+      });
+      const refreshed = {
+        kind: "access_token",
+        accessToken: tokens.access_token,
+        ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: credential.refreshToken },
+        expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
+      };
+      await writeConfig(writeProfileConfig(config, environment, {
+        ...profile.activeContext === key ? { credential: refreshed } : {},
+        contexts: {
+          ...profile.contexts ?? {},
+          [key]: { ...context, credential: refreshed, oauthClientId }
         }
-      }
-    }));
-    return refreshed;
-  } catch {
-    return credential;
-  }
+      }));
+      return refreshed;
+    } catch {
+      return credential;
+    }
+  });
 }
 function resolveAgentName(configAgentName) {
   return process.env.TOPOLO_AGENT_NAME ?? configAgentName;

package/package.json

@@ -1,8 +1,11 @@
 {
   "name": "@topolo/sdk",
-  "version": "0.11.0",
-  "topoloPublishedVersion": "0.11.0",
+  "version": "0.11.1",
+  "topoloPublishedVersion": "0.11.1",
   "description": "Typed client SDK for the Topolo platform. Used by TopoloCli, TopoloMCP, and third-party agents.",
+  "license": "UNLICENSED",
+  "author": "Topolo",
+  "homepage": "https://docs.topolo.app",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",