@topolo/sdk 0.11.7 → 0.11.9

package/dist/index.cjs

@@ -59,6 +59,7 @@ __export(index_exports, {
   defineTopoloRecentActivityWidget: () => defineTopoloRecentActivityWidget,
   defineTopoloStatsWidget: () => defineTopoloStatsWidget,
   digestTopoloActionCatalog: () => digestTopoloActionCatalog,
+  encodeTopoloActionBase64: () => encodeTopoloActionBase64,
   enrichActionContract: () => enrichActionContract,
   extractTopoloServiceErrorCode: () => extractTopoloServiceErrorCode,
   extractTopoloServiceErrorDetails: () => extractTopoloServiceErrorDetails,
@@ -938,7 +939,7 @@ function prepareTopoloActionUploadInput(contractValue, content, input, options)
   if (bytes.byteLength > contract.maxBytes) {
     throw new TopoloSdkError("upload_too_large", `Upload content exceeds the ${contract.maxBytes}-byte action limit.`);
   }
-  return mapUploadInput(contract, bytesToBase64(bytes), input, options);
+  return mapUploadInput(contract, encodeTopoloActionBase64(bytes), input, options);
 }
 function prepareTopoloActionBase64UploadInput(contractValue, contentBase64, input, options) {
   const contract = parseTopoloActionUploadContract(contractValue);
@@ -1074,7 +1075,7 @@ function requiredField(value, name) {
 function matchesContentType(contentType, accepted) {
   return accepted.some((candidate) => candidate === "*/*" || candidate === contentType || candidate.endsWith("/*") && contentType.startsWith(candidate.slice(0, -1)));
 }
-function bytesToBase64(bytes) {
+function encodeTopoloActionBase64(bytes) {
   let binary = "";
   const chunkSize = 32768;
   for (let offset = 0; offset < bytes.length; offset += chunkSize) {
@@ -1253,7 +1254,20 @@ var TopoloClient = class _TopoloClient {
       throw err;
     }
     const contentType = res.headers.get("Content-Type") ?? "";
-    const parsed = contentType.includes("application/json") ? await res.json().catch(() => null) : await res.text().catch(() => null);
+    const normalizedContentType = contentType.split(";", 1)[0]?.trim().toLowerCase() ?? "";
+    let parsed;
+    if (normalizedContentType === "application/json" || normalizedContentType.endsWith("+json")) {
+      parsed = await res.json().catch(() => null);
+    } else if (!res.ok || !normalizedContentType || normalizedContentType.startsWith("text/")) {
+      parsed = await res.text().catch(() => null);
+    } else {
+      const bytes = new Uint8Array(await res.arrayBuffer());
+      parsed = {
+        contentType: normalizedContentType,
+        contentLength: bytes.byteLength,
+        contentBase64: encodeTopoloActionBase64(bytes)
+      };
+    }
     if (!res.ok) {
       const durationMs = Date.now() - startedAt;
       const message = describeError(parsed, `HTTP ${res.status}`);
@@ -1804,7 +1818,7 @@ var TopoloClient = class _TopoloClient {
     }
     const mapped = mapActionInput(entry, input);
     const service = entry.appSlug || entry.appId;
-    return this.request({
+    const result = await this.request({
       service,
       ...entry.apiBaseUrl ? { baseUrl: entry.apiBaseUrl } : {},
       method: entry.method,
@@ -1818,6 +1832,7 @@ var TopoloClient = class _TopoloClient {
       },
       confirm: options.confirm === true || entry.readOnly && !entry.destructive && !entry.requiresConfirmation
     });
+    return redactActionResult(result);
   }
   /**
    * Introspect the current credential. Returns the caller's resolved identity,
@@ -1941,6 +1956,18 @@ function readOptionalString(value) {
 function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function redactActionResult(value) {
+  if (Array.isArray(value)) return value.map(redactActionResult);
+  if (!isRecord3(value)) return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+    key,
+    isSensitiveActionResultKey(key) ? "[REDACTED]" : redactActionResult(item)
+  ]));
+}
+function isSensitiveActionResultKey(key) {
+  const normalized = key.toLowerCase().replace(/[^a-z0-9]/g, "");
+  return ["authorization", "cookie", "setcookie", "proxyauthorization", "capability"].includes(normalized) || /(token|secret|password|privatekey|apikey)$/.test(normalized);
+}
 function resolveConfiguredServiceUrl(slug, serviceUrls) {
   for (const serviceKey of serviceKeyCandidates2(slug)) {
     const configured = serviceUrls?.[serviceKey];
@@ -3448,6 +3475,7 @@ function createTopolo(options) {
   defineTopoloRecentActivityWidget,
   defineTopoloStatsWidget,
   digestTopoloActionCatalog,
+  encodeTopoloActionBase64,
   enrichActionContract,
   extractTopoloServiceErrorCode,
   extractTopoloServiceErrorDetails,

package/dist/index.d.cts

@@ -80,6 +80,7 @@ interface TopoloActionUploadOptions {
 declare function parseTopoloActionUploadContract(value: unknown): TopoloActionUploadContract;
 declare function prepareTopoloActionUploadInput(contractValue: unknown, content: Uint8Array | ArrayBuffer, input: Record<string, unknown>, options: TopoloActionUploadOptions): Record<string, unknown>;
 declare function prepareTopoloActionBase64UploadInput(contractValue: unknown, contentBase64: string, input: Record<string, unknown>, options: TopoloActionUploadOptions): Record<string, unknown>;
+declare function encodeTopoloActionBase64(bytes: Uint8Array): string;
 
 interface TopoloClientOptions {
     credential: TopoloCredential;
@@ -167,6 +168,11 @@ interface RequestOptions {
     headers?: Record<string, string>;
     signal?: AbortSignal;
 }
+interface TopoloBinaryResponse {
+    contentType: string;
+    contentLength: number;
+    contentBase64: string;
+}
 /**
  * A single entry from the live platform service catalog. Returned by
  * {@link TopoloClient.listServices}. Shape mirrors the public-safe projection
@@ -1380,4 +1386,4 @@ declare function createTopolo(options: TopoloClientOptions): {
 };
 type Topolo = ReturnType<typeof createTopolo>;
 
-export { ACTION_CATALOG_DIGEST_ALGORITHM, type ActionContractManifest, type ActionContractSource, type AgentIdentity, type AppApiId, type ApplicationCatalogEntry, type ApplicationDeployTarget, type ApplicationDirectory, type ApplicationDirectoryApplication, type ApplicationDirectoryClient, type ApplicationDirectorySource, type ApplicationId, type CredentialIntrospection, type CrmContactSummary, CrmModule, DEFAULT_APP_URLS, type DeviceAuthorizationResponse, IdentityModule, type ListContactsOptions, type ListContactsResult, type OAuthHelperOptions, type P2PActionDetail, type P2PActionRequestInput, type P2PActionRequestResult, type P2PActionRow, type P2PActionRun, type P2PCapability, type P2PConnection, type P2PHold, type P2PLedgerEntry, P2PModule, type P2PPolicy, type P2PPricingModel, type P2PSettlementBatch, type P2PSettlementGroup, type PublishCapabilityInput, type RequestOptions, type ServiceCatalogUrlEntry, TOPOLO_ENVIRONMENT_SERVICE_URLS, TOPOLO_RUNTIME_ENVIRONMENTS, TOPOLO_WIDGET_ENDPOINT, TOPOLO_WIDGET_REFRESH_INTERVAL_MS, type TokenResponse, type Topolo, type TopoloActionAgentContract, type TopoloActionCatalogEntry, type TopoloActionCatalogSummary, type TopoloActionDigestInput, type TopoloActionPlan, type TopoloActionPreparation, type TopoloActionUploadOptions, type TopoloActionValidationIssue, type TopoloActionValidationResult, type TopoloAgentExecutionContext, type TopoloApiKeyResourceMetadata, TopoloAuthError, type TopoloBindableResource, type TopoloBindableResourceCatalog, type TopoloChartWidget, TopoloClient, type TopoloClientOptions, TopoloConfirmationRequiredError, type TopoloCredential, type TopoloDebugEvent, TopoloHttpError, type TopoloInlineBase64UploadContract, type TopoloNotificationsWidget, TopoloOAuth, TopoloPermissionError, type TopoloQuickActionsWidget, type TopoloRecentActivityWidget, type TopoloRuntimeEnvironment, TopoloSdkError, type TopoloServiceCatalogEntry, type TopoloStatsWidget, type TopoloWidget, type TopoloWidgetActionItem, type TopoloWidgetActivityItem, type TopoloWidgetApiResponse, type TopoloWidgetBase, type TopoloWidgetConfig, type TopoloWidgetDraft, type TopoloWidgetMetric, type TopoloWidgetNotificationItem, type TopoloWidgetResponseOptions, type TopoloWidgetSnapshotMetadata, type TopoloWidgetSnapshotMetric, type TopoloWidgetType, type TopoloWidgetValidationResult, type TopoloWorkspace, type TopoloWorkspaceListResult, type TopoloWorkspaceMutationResult, type TopoloWorkspacePolicy, WorkspacesModule, actionContractCompleteness, applicationEntryFromCatalog, assertTopoloServiceUrlEnvironment, canonicalTopoloErrorCode, canonicalTopoloRequestId, canonicalTopoloRequired, canonicalTopoloRetryAfter, compactActionCatalogEntry, compactActionPlan, compactActionPreparation, compactActionResult, compactActionValidation, createTopolo, createTopoloAgentExecutionContext, createTopoloWidgetError, createTopoloWidgetResponse, defineTopoloChartWidget, defineTopoloNotificationsWidget, defineTopoloQuickActionsWidget, defineTopoloRecentActivityWidget, defineTopoloStatsWidget, digestTopoloActionCatalog, enrichActionContract, extractTopoloServiceErrorCode, extractTopoloServiceErrorDetails, formatDirectoryApplicationIds, friendlyAppId, listApplicationDirectory, parseTopoloActionUploadContract, preferExactActionMatches, prepareTopoloActionBase64UploadInput, prepareTopoloActionUploadInput, publicTopoloErrorMessage, resolveApplicationDirectoryEntry, resolveCatalogServiceUrl, resolveServiceUrl, topoloErrorHint, topoloServiceOrigins, validateTopoloActionInput, validateTopoloWidgetResponse };
+export { ACTION_CATALOG_DIGEST_ALGORITHM, type ActionContractManifest, type ActionContractSource, type AgentIdentity, type AppApiId, type ApplicationCatalogEntry, type ApplicationDeployTarget, type ApplicationDirectory, type ApplicationDirectoryApplication, type ApplicationDirectoryClient, type ApplicationDirectorySource, type ApplicationId, type CredentialIntrospection, type CrmContactSummary, CrmModule, DEFAULT_APP_URLS, type DeviceAuthorizationResponse, IdentityModule, type ListContactsOptions, type ListContactsResult, type OAuthHelperOptions, type P2PActionDetail, type P2PActionRequestInput, type P2PActionRequestResult, type P2PActionRow, type P2PActionRun, type P2PCapability, type P2PConnection, type P2PHold, type P2PLedgerEntry, P2PModule, type P2PPolicy, type P2PPricingModel, type P2PSettlementBatch, type P2PSettlementGroup, type PublishCapabilityInput, type RequestOptions, type ServiceCatalogUrlEntry, TOPOLO_ENVIRONMENT_SERVICE_URLS, TOPOLO_RUNTIME_ENVIRONMENTS, TOPOLO_WIDGET_ENDPOINT, TOPOLO_WIDGET_REFRESH_INTERVAL_MS, type TokenResponse, type Topolo, type TopoloActionAgentContract, type TopoloActionCatalogEntry, type TopoloActionCatalogSummary, type TopoloActionDigestInput, type TopoloActionPlan, type TopoloActionPreparation, type TopoloActionUploadOptions, type TopoloActionValidationIssue, type TopoloActionValidationResult, type TopoloAgentExecutionContext, type TopoloApiKeyResourceMetadata, TopoloAuthError, type TopoloBinaryResponse, type TopoloBindableResource, type TopoloBindableResourceCatalog, type TopoloChartWidget, TopoloClient, type TopoloClientOptions, TopoloConfirmationRequiredError, type TopoloCredential, type TopoloDebugEvent, TopoloHttpError, type TopoloInlineBase64UploadContract, type TopoloNotificationsWidget, TopoloOAuth, TopoloPermissionError, type TopoloQuickActionsWidget, type TopoloRecentActivityWidget, type TopoloRuntimeEnvironment, TopoloSdkError, type TopoloServiceCatalogEntry, type TopoloStatsWidget, type TopoloWidget, type TopoloWidgetActionItem, type TopoloWidgetActivityItem, type TopoloWidgetApiResponse, type TopoloWidgetBase, type TopoloWidgetConfig, type TopoloWidgetDraft, type TopoloWidgetMetric, type TopoloWidgetNotificationItem, type TopoloWidgetResponseOptions, type TopoloWidgetSnapshotMetadata, type TopoloWidgetSnapshotMetric, type TopoloWidgetType, type TopoloWidgetValidationResult, type TopoloWorkspace, type TopoloWorkspaceListResult, type TopoloWorkspaceMutationResult, type TopoloWorkspacePolicy, WorkspacesModule, actionContractCompleteness, applicationEntryFromCatalog, assertTopoloServiceUrlEnvironment, canonicalTopoloErrorCode, canonicalTopoloRequestId, canonicalTopoloRequired, canonicalTopoloRetryAfter, compactActionCatalogEntry, compactActionPlan, compactActionPreparation, compactActionResult, compactActionValidation, createTopolo, createTopoloAgentExecutionContext, createTopoloWidgetError, createTopoloWidgetResponse, defineTopoloChartWidget, defineTopoloNotificationsWidget, defineTopoloQuickActionsWidget, defineTopoloRecentActivityWidget, defineTopoloStatsWidget, digestTopoloActionCatalog, encodeTopoloActionBase64, enrichActionContract, extractTopoloServiceErrorCode, extractTopoloServiceErrorDetails, formatDirectoryApplicationIds, friendlyAppId, listApplicationDirectory, parseTopoloActionUploadContract, preferExactActionMatches, prepareTopoloActionBase64UploadInput, prepareTopoloActionUploadInput, publicTopoloErrorMessage, resolveApplicationDirectoryEntry, resolveCatalogServiceUrl, resolveServiceUrl, topoloErrorHint, topoloServiceOrigins, validateTopoloActionInput, validateTopoloWidgetResponse };

package/dist/index.d.ts

@@ -80,6 +80,7 @@ interface TopoloActionUploadOptions {
 declare function parseTopoloActionUploadContract(value: unknown): TopoloActionUploadContract;
 declare function prepareTopoloActionUploadInput(contractValue: unknown, content: Uint8Array | ArrayBuffer, input: Record<string, unknown>, options: TopoloActionUploadOptions): Record<string, unknown>;
 declare function prepareTopoloActionBase64UploadInput(contractValue: unknown, contentBase64: string, input: Record<string, unknown>, options: TopoloActionUploadOptions): Record<string, unknown>;
+declare function encodeTopoloActionBase64(bytes: Uint8Array): string;
 
 interface TopoloClientOptions {
     credential: TopoloCredential;
@@ -167,6 +168,11 @@ interface RequestOptions {
     headers?: Record<string, string>;
     signal?: AbortSignal;
 }
+interface TopoloBinaryResponse {
+    contentType: string;
+    contentLength: number;
+    contentBase64: string;
+}
 /**
  * A single entry from the live platform service catalog. Returned by
  * {@link TopoloClient.listServices}. Shape mirrors the public-safe projection
@@ -1380,4 +1386,4 @@ declare function createTopolo(options: TopoloClientOptions): {
 };
 type Topolo = ReturnType<typeof createTopolo>;
 
-export { ACTION_CATALOG_DIGEST_ALGORITHM, type ActionContractManifest, type ActionContractSource, type AgentIdentity, type AppApiId, type ApplicationCatalogEntry, type ApplicationDeployTarget, type ApplicationDirectory, type ApplicationDirectoryApplication, type ApplicationDirectoryClient, type ApplicationDirectorySource, type ApplicationId, type CredentialIntrospection, type CrmContactSummary, CrmModule, DEFAULT_APP_URLS, type DeviceAuthorizationResponse, IdentityModule, type ListContactsOptions, type ListContactsResult, type OAuthHelperOptions, type P2PActionDetail, type P2PActionRequestInput, type P2PActionRequestResult, type P2PActionRow, type P2PActionRun, type P2PCapability, type P2PConnection, type P2PHold, type P2PLedgerEntry, P2PModule, type P2PPolicy, type P2PPricingModel, type P2PSettlementBatch, type P2PSettlementGroup, type PublishCapabilityInput, type RequestOptions, type ServiceCatalogUrlEntry, TOPOLO_ENVIRONMENT_SERVICE_URLS, TOPOLO_RUNTIME_ENVIRONMENTS, TOPOLO_WIDGET_ENDPOINT, TOPOLO_WIDGET_REFRESH_INTERVAL_MS, type TokenResponse, type Topolo, type TopoloActionAgentContract, type TopoloActionCatalogEntry, type TopoloActionCatalogSummary, type TopoloActionDigestInput, type TopoloActionPlan, type TopoloActionPreparation, type TopoloActionUploadOptions, type TopoloActionValidationIssue, type TopoloActionValidationResult, type TopoloAgentExecutionContext, type TopoloApiKeyResourceMetadata, TopoloAuthError, type TopoloBindableResource, type TopoloBindableResourceCatalog, type TopoloChartWidget, TopoloClient, type TopoloClientOptions, TopoloConfirmationRequiredError, type TopoloCredential, type TopoloDebugEvent, TopoloHttpError, type TopoloInlineBase64UploadContract, type TopoloNotificationsWidget, TopoloOAuth, TopoloPermissionError, type TopoloQuickActionsWidget, type TopoloRecentActivityWidget, type TopoloRuntimeEnvironment, TopoloSdkError, type TopoloServiceCatalogEntry, type TopoloStatsWidget, type TopoloWidget, type TopoloWidgetActionItem, type TopoloWidgetActivityItem, type TopoloWidgetApiResponse, type TopoloWidgetBase, type TopoloWidgetConfig, type TopoloWidgetDraft, type TopoloWidgetMetric, type TopoloWidgetNotificationItem, type TopoloWidgetResponseOptions, type TopoloWidgetSnapshotMetadata, type TopoloWidgetSnapshotMetric, type TopoloWidgetType, type TopoloWidgetValidationResult, type TopoloWorkspace, type TopoloWorkspaceListResult, type TopoloWorkspaceMutationResult, type TopoloWorkspacePolicy, WorkspacesModule, actionContractCompleteness, applicationEntryFromCatalog, assertTopoloServiceUrlEnvironment, canonicalTopoloErrorCode, canonicalTopoloRequestId, canonicalTopoloRequired, canonicalTopoloRetryAfter, compactActionCatalogEntry, compactActionPlan, compactActionPreparation, compactActionResult, compactActionValidation, createTopolo, createTopoloAgentExecutionContext, createTopoloWidgetError, createTopoloWidgetResponse, defineTopoloChartWidget, defineTopoloNotificationsWidget, defineTopoloQuickActionsWidget, defineTopoloRecentActivityWidget, defineTopoloStatsWidget, digestTopoloActionCatalog, enrichActionContract, extractTopoloServiceErrorCode, extractTopoloServiceErrorDetails, formatDirectoryApplicationIds, friendlyAppId, listApplicationDirectory, parseTopoloActionUploadContract, preferExactActionMatches, prepareTopoloActionBase64UploadInput, prepareTopoloActionUploadInput, publicTopoloErrorMessage, resolveApplicationDirectoryEntry, resolveCatalogServiceUrl, resolveServiceUrl, topoloErrorHint, topoloServiceOrigins, validateTopoloActionInput, validateTopoloWidgetResponse };
+export { ACTION_CATALOG_DIGEST_ALGORITHM, type ActionContractManifest, type ActionContractSource, type AgentIdentity, type AppApiId, type ApplicationCatalogEntry, type ApplicationDeployTarget, type ApplicationDirectory, type ApplicationDirectoryApplication, type ApplicationDirectoryClient, type ApplicationDirectorySource, type ApplicationId, type CredentialIntrospection, type CrmContactSummary, CrmModule, DEFAULT_APP_URLS, type DeviceAuthorizationResponse, IdentityModule, type ListContactsOptions, type ListContactsResult, type OAuthHelperOptions, type P2PActionDetail, type P2PActionRequestInput, type P2PActionRequestResult, type P2PActionRow, type P2PActionRun, type P2PCapability, type P2PConnection, type P2PHold, type P2PLedgerEntry, P2PModule, type P2PPolicy, type P2PPricingModel, type P2PSettlementBatch, type P2PSettlementGroup, type PublishCapabilityInput, type RequestOptions, type ServiceCatalogUrlEntry, TOPOLO_ENVIRONMENT_SERVICE_URLS, TOPOLO_RUNTIME_ENVIRONMENTS, TOPOLO_WIDGET_ENDPOINT, TOPOLO_WIDGET_REFRESH_INTERVAL_MS, type TokenResponse, type Topolo, type TopoloActionAgentContract, type TopoloActionCatalogEntry, type TopoloActionCatalogSummary, type TopoloActionDigestInput, type TopoloActionPlan, type TopoloActionPreparation, type TopoloActionUploadOptions, type TopoloActionValidationIssue, type TopoloActionValidationResult, type TopoloAgentExecutionContext, type TopoloApiKeyResourceMetadata, TopoloAuthError, type TopoloBinaryResponse, type TopoloBindableResource, type TopoloBindableResourceCatalog, type TopoloChartWidget, TopoloClient, type TopoloClientOptions, TopoloConfirmationRequiredError, type TopoloCredential, type TopoloDebugEvent, TopoloHttpError, type TopoloInlineBase64UploadContract, type TopoloNotificationsWidget, TopoloOAuth, TopoloPermissionError, type TopoloQuickActionsWidget, type TopoloRecentActivityWidget, type TopoloRuntimeEnvironment, TopoloSdkError, type TopoloServiceCatalogEntry, type TopoloStatsWidget, type TopoloWidget, type TopoloWidgetActionItem, type TopoloWidgetActivityItem, type TopoloWidgetApiResponse, type TopoloWidgetBase, type TopoloWidgetConfig, type TopoloWidgetDraft, type TopoloWidgetMetric, type TopoloWidgetNotificationItem, type TopoloWidgetResponseOptions, type TopoloWidgetSnapshotMetadata, type TopoloWidgetSnapshotMetric, type TopoloWidgetType, type TopoloWidgetValidationResult, type TopoloWorkspace, type TopoloWorkspaceListResult, type TopoloWorkspaceMutationResult, type TopoloWorkspacePolicy, WorkspacesModule, actionContractCompleteness, applicationEntryFromCatalog, assertTopoloServiceUrlEnvironment, canonicalTopoloErrorCode, canonicalTopoloRequestId, canonicalTopoloRequired, canonicalTopoloRetryAfter, compactActionCatalogEntry, compactActionPlan, compactActionPreparation, compactActionResult, compactActionValidation, createTopolo, createTopoloAgentExecutionContext, createTopoloWidgetError, createTopoloWidgetResponse, defineTopoloChartWidget, defineTopoloNotificationsWidget, defineTopoloQuickActionsWidget, defineTopoloRecentActivityWidget, defineTopoloStatsWidget, digestTopoloActionCatalog, encodeTopoloActionBase64, enrichActionContract, extractTopoloServiceErrorCode, extractTopoloServiceErrorDetails, formatDirectoryApplicationIds, friendlyAppId, listApplicationDirectory, parseTopoloActionUploadContract, preferExactActionMatches, prepareTopoloActionBase64UploadInput, prepareTopoloActionUploadInput, publicTopoloErrorMessage, resolveApplicationDirectoryEntry, resolveCatalogServiceUrl, resolveServiceUrl, topoloErrorHint, topoloServiceOrigins, validateTopoloActionInput, validateTopoloWidgetResponse };

package/dist/index.js

@@ -856,7 +856,7 @@ function prepareTopoloActionUploadInput(contractValue, content, input, options)
   if (bytes.byteLength > contract.maxBytes) {
     throw new TopoloSdkError("upload_too_large", `Upload content exceeds the ${contract.maxBytes}-byte action limit.`);
   }
-  return mapUploadInput(contract, bytesToBase64(bytes), input, options);
+  return mapUploadInput(contract, encodeTopoloActionBase64(bytes), input, options);
 }
 function prepareTopoloActionBase64UploadInput(contractValue, contentBase64, input, options) {
   const contract = parseTopoloActionUploadContract(contractValue);
@@ -992,7 +992,7 @@ function requiredField(value, name) {
 function matchesContentType(contentType, accepted) {
   return accepted.some((candidate) => candidate === "*/*" || candidate === contentType || candidate.endsWith("/*") && contentType.startsWith(candidate.slice(0, -1)));
 }
-function bytesToBase64(bytes) {
+function encodeTopoloActionBase64(bytes) {
   let binary = "";
   const chunkSize = 32768;
   for (let offset = 0; offset < bytes.length; offset += chunkSize) {
@@ -1171,7 +1171,20 @@ var TopoloClient = class _TopoloClient {
       throw err;
     }
     const contentType = res.headers.get("Content-Type") ?? "";
-    const parsed = contentType.includes("application/json") ? await res.json().catch(() => null) : await res.text().catch(() => null);
+    const normalizedContentType = contentType.split(";", 1)[0]?.trim().toLowerCase() ?? "";
+    let parsed;
+    if (normalizedContentType === "application/json" || normalizedContentType.endsWith("+json")) {
+      parsed = await res.json().catch(() => null);
+    } else if (!res.ok || !normalizedContentType || normalizedContentType.startsWith("text/")) {
+      parsed = await res.text().catch(() => null);
+    } else {
+      const bytes = new Uint8Array(await res.arrayBuffer());
+      parsed = {
+        contentType: normalizedContentType,
+        contentLength: bytes.byteLength,
+        contentBase64: encodeTopoloActionBase64(bytes)
+      };
+    }
     if (!res.ok) {
       const durationMs = Date.now() - startedAt;
       const message = describeError(parsed, `HTTP ${res.status}`);
@@ -1722,7 +1735,7 @@ var TopoloClient = class _TopoloClient {
     }
     const mapped = mapActionInput(entry, input);
     const service = entry.appSlug || entry.appId;
-    return this.request({
+    const result = await this.request({
       service,
       ...entry.apiBaseUrl ? { baseUrl: entry.apiBaseUrl } : {},
       method: entry.method,
@@ -1736,6 +1749,7 @@ var TopoloClient = class _TopoloClient {
       },
       confirm: options.confirm === true || entry.readOnly && !entry.destructive && !entry.requiresConfirmation
     });
+    return redactActionResult(result);
   }
   /**
    * Introspect the current credential. Returns the caller's resolved identity,
@@ -1859,6 +1873,18 @@ function readOptionalString(value) {
 function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function redactActionResult(value) {
+  if (Array.isArray(value)) return value.map(redactActionResult);
+  if (!isRecord3(value)) return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+    key,
+    isSensitiveActionResultKey(key) ? "[REDACTED]" : redactActionResult(item)
+  ]));
+}
+function isSensitiveActionResultKey(key) {
+  const normalized = key.toLowerCase().replace(/[^a-z0-9]/g, "");
+  return ["authorization", "cookie", "setcookie", "proxyauthorization", "capability"].includes(normalized) || /(token|secret|password|privatekey|apikey)$/.test(normalized);
+}
 function resolveConfiguredServiceUrl(slug, serviceUrls) {
   for (const serviceKey of serviceKeyCandidates2(slug)) {
     const configured = serviceUrls?.[serviceKey];
@@ -3365,6 +3391,7 @@ export {
   defineTopoloRecentActivityWidget,
   defineTopoloStatsWidget,
   digestTopoloActionCatalog,
+  encodeTopoloActionBase64,
   enrichActionContract,
   extractTopoloServiceErrorCode,
   extractTopoloServiceErrorDetails,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@topolo/sdk",
-  "version": "0.11.7",
-  "topoloPublishedVersion": "0.11.7",
+  "version": "0.11.9",
+  "topoloPublishedVersion": "0.11.9",
   "description": "Typed client SDK for the Topolo platform. Used by TopoloCli, TopoloMCP, and third-party agents.",
   "license": "UNLICENSED",
   "author": "Topolo",