@topolo/sdk 0.11.9 → 0.11.11

package/dist/index.cjs

@@ -1757,7 +1757,9 @@ var TopoloClient = class _TopoloClient {
     };
   }
   planResolvedAction(entry, input, options) {
-    const validation = validateTopoloActionInput(entry.inputSchema, input);
+    const inputValidation = validateTopoloActionInput(entry.inputSchema, input);
+    const resourceIssue = validateActionResource(entry, options.resource);
+    const validation = resourceIssue ? { valid: false, errors: [...inputValidation.errors, resourceIssue] } : inputValidation;
     const agentAccess = entry.agentAccess ?? (entry.destructive ? "off" : entry.readOnly && !entry.requiresConfirmation ? "auto" : "confirm");
     const confirmationRequired = agentAccess === "confirm" || entry.requiresConfirmation || entry.destructive;
     let request = null;
@@ -1816,6 +1818,13 @@ var TopoloClient = class _TopoloClient {
         `Topolo action "${entry.actionId}" input is invalid: ${validation.errors.map((issue) => `${issue.path} ${issue.message}`).join("; ")}`
       );
     }
+    const resourceIssue = validateActionResource(entry, options.resource);
+    if (resourceIssue) {
+      throw new TopoloSdkError(
+        "invalid_action_resource",
+        `Topolo action "${entry.actionId}" resource context is invalid: ${resourceIssue.message}`
+      );
+    }
     const mapped = mapActionInput(entry, input);
     const service = entry.appSlug || entry.appId;
     const result = await this.request({
@@ -1878,6 +1887,32 @@ var TopoloClient = class _TopoloClient {
     };
   }
 };
+function validateActionResource(entry, resource) {
+  const permissionName = entry.permissionName || entry.requiredPermission.split(".").at(-1) || "";
+  if (!permissionName.startsWith("workspace:")) return null;
+  if (!resource) {
+    return {
+      path: "$.resource",
+      code: "required",
+      message: "Select a workspace with the application resource catalog before planning or calling this action."
+    };
+  }
+  if (resource.resourceType !== "workspace") {
+    return {
+      path: "$.resource.resourceType",
+      code: "const",
+      message: 'This action requires resourceType "workspace".'
+    };
+  }
+  if (!resource.resourceId.trim()) {
+    return {
+      path: "$.resource.resourceId",
+      code: "required",
+      message: "This action requires a workspace resourceId."
+    };
+  }
+  return null;
+}
 function resolveConfiguredAppId(slug, appIds) {
   for (const serviceKey of serviceKeyCandidates2(slug)) {
     const configured = appIds?.[serviceKey];

package/dist/index.js

@@ -1674,7 +1674,9 @@ var TopoloClient = class _TopoloClient {
     };
   }
   planResolvedAction(entry, input, options) {
-    const validation = validateTopoloActionInput(entry.inputSchema, input);
+    const inputValidation = validateTopoloActionInput(entry.inputSchema, input);
+    const resourceIssue = validateActionResource(entry, options.resource);
+    const validation = resourceIssue ? { valid: false, errors: [...inputValidation.errors, resourceIssue] } : inputValidation;
     const agentAccess = entry.agentAccess ?? (entry.destructive ? "off" : entry.readOnly && !entry.requiresConfirmation ? "auto" : "confirm");
     const confirmationRequired = agentAccess === "confirm" || entry.requiresConfirmation || entry.destructive;
     let request = null;
@@ -1733,6 +1735,13 @@ var TopoloClient = class _TopoloClient {
         `Topolo action "${entry.actionId}" input is invalid: ${validation.errors.map((issue) => `${issue.path} ${issue.message}`).join("; ")}`
       );
     }
+    const resourceIssue = validateActionResource(entry, options.resource);
+    if (resourceIssue) {
+      throw new TopoloSdkError(
+        "invalid_action_resource",
+        `Topolo action "${entry.actionId}" resource context is invalid: ${resourceIssue.message}`
+      );
+    }
     const mapped = mapActionInput(entry, input);
     const service = entry.appSlug || entry.appId;
     const result = await this.request({
@@ -1795,6 +1804,32 @@ var TopoloClient = class _TopoloClient {
     };
   }
 };
+function validateActionResource(entry, resource) {
+  const permissionName = entry.permissionName || entry.requiredPermission.split(".").at(-1) || "";
+  if (!permissionName.startsWith("workspace:")) return null;
+  if (!resource) {
+    return {
+      path: "$.resource",
+      code: "required",
+      message: "Select a workspace with the application resource catalog before planning or calling this action."
+    };
+  }
+  if (resource.resourceType !== "workspace") {
+    return {
+      path: "$.resource.resourceType",
+      code: "const",
+      message: 'This action requires resourceType "workspace".'
+    };
+  }
+  if (!resource.resourceId.trim()) {
+    return {
+      path: "$.resource.resourceId",
+      code: "required",
+      message: "This action requires a workspace resourceId."
+    };
+  }
+  return null;
+}
 function resolveConfiguredAppId(slug, appIds) {
   for (const serviceKey of serviceKeyCandidates2(slug)) {
     const configured = appIds?.[serviceKey];

package/dist/node/credential-store.cjs

@@ -612,52 +612,58 @@ async function refreshCredentialIfNeeded(environment = selectedEnvironment(), op
   if (process.env[`${prefix}_API_KEY`] || process.env[`${prefix}_ACCESS_TOKEN`] || environment === "production" && process.env.TOPOLO_API_KEY || environment === "production" && process.env.TOPOLO_ACCESS_TOKEN) {
     return resolveCredential(environment);
   }
-  const config = await readConfig();
-  const profile = profileForEnvironment(config, environment);
-  const cred = profile.credential;
-  if (!cred || cred.kind !== "access_token") return cred ?? null;
-  if (!cred.refreshToken || !profile.oauthClientId) return cred;
-  const now = Math.floor(Date.now() / 1e3);
-  if (!options.force && cred.expiresAt && cred.expiresAt - REFRESH_SKEW_SECONDS > now) return cred;
-  const serviceUrls = resolveServiceUrls(profile.serviceUrls, environment);
-  if (environment === "local" && !serviceUrls?.auth) {
-    throw new TopoloSdkError(
-      "environment_service_url_required",
-      "Local Topolo credential refresh requires an explicit local Auth service origin."
-    );
-  }
-  try {
-    const oauth = new TopoloOAuth({
-      serviceUrls
-    });
-    const tokens = await oauth.refreshToken({
-      clientId: profile.oauthClientId,
-      refreshToken: cred.refreshToken
-    });
-    const refreshed = {
-      kind: "access_token",
-      accessToken: tokens.access_token,
-      ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: cred.refreshToken },
-      expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
-    };
-    const activeContext = profile.activeContext;
-    const activeEntry = activeContext ? profile.contexts?.[activeContext] : void 0;
-    const updated = activeContext && activeEntry ? writeProfileConfig(config, environment, {
-      credential: refreshed,
-      contexts: {
-        ...profile.contexts ?? {},
-        [activeContext]: {
-          ...activeEntry,
-          credential: refreshed,
-          oauthClientId: activeEntry.oauthClientId ?? profile.oauthClientId
+  const observed = profileForEnvironment(await readConfig(), environment).credential;
+  return withConfigWriteLock(async () => {
+    const config = await readConfig();
+    const profile = profileForEnvironment(config, environment);
+    const cred = profile.credential;
+    if (!cred || cred.kind !== "access_token") return cred ?? null;
+    if (!cred.refreshToken || !profile.oauthClientId) return cred;
+    if (options.force && observed?.kind === "access_token" && observed.accessToken !== cred.accessToken) {
+      return cred;
+    }
+    const now = Math.floor(Date.now() / 1e3);
+    if (!options.force && cred.expiresAt && cred.expiresAt - REFRESH_SKEW_SECONDS > now) return cred;
+    const serviceUrls = resolveServiceUrls(profile.serviceUrls, environment);
+    if (environment === "local" && !serviceUrls?.auth) {
+      throw new TopoloSdkError(
+        "environment_service_url_required",
+        "Local Topolo credential refresh requires an explicit local Auth service origin."
+      );
+    }
+    try {
+      const oauth = new TopoloOAuth({
+        serviceUrls
+      });
+      const tokens = await oauth.refreshToken({
+        clientId: profile.oauthClientId,
+        refreshToken: cred.refreshToken
+      });
+      const refreshed = {
+        kind: "access_token",
+        accessToken: tokens.access_token,
+        ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: cred.refreshToken },
+        expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
+      };
+      const activeContext = profile.activeContext;
+      const activeEntry = activeContext ? profile.contexts?.[activeContext] : void 0;
+      const updated = activeContext && activeEntry ? writeProfileConfig(config, environment, {
+        credential: refreshed,
+        contexts: {
+          ...profile.contexts ?? {},
+          [activeContext]: {
+            ...activeEntry,
+            credential: refreshed,
+            oauthClientId: activeEntry.oauthClientId ?? profile.oauthClientId
+          }
         }
-      }
-    }) : environment === "production" && !config.profiles?.production ? { ...config, credential: refreshed } : writeProfileConfig(config, environment, { credential: refreshed });
-    await writeConfig(updated);
-    return refreshed;
-  } catch {
-    return cred;
-  }
+      }) : environment === "production" && !config.profiles?.production ? { ...config, credential: refreshed } : writeProfileConfig(config, environment, { credential: refreshed });
+      await writeConfig(updated);
+      return refreshed;
+    } catch {
+      return cred;
+    }
+  });
 }
 async function refreshContextCredentialIfNeeded(environment, key, options = {}) {
   return withConfigWriteLock(async () => {

package/dist/node/credential-store.js

@@ -565,52 +565,58 @@ async function refreshCredentialIfNeeded(environment = selectedEnvironment(), op
   if (process.env[`${prefix}_API_KEY`] || process.env[`${prefix}_ACCESS_TOKEN`] || environment === "production" && process.env.TOPOLO_API_KEY || environment === "production" && process.env.TOPOLO_ACCESS_TOKEN) {
     return resolveCredential(environment);
   }
-  const config = await readConfig();
-  const profile = profileForEnvironment(config, environment);
-  const cred = profile.credential;
-  if (!cred || cred.kind !== "access_token") return cred ?? null;
-  if (!cred.refreshToken || !profile.oauthClientId) return cred;
-  const now = Math.floor(Date.now() / 1e3);
-  if (!options.force && cred.expiresAt && cred.expiresAt - REFRESH_SKEW_SECONDS > now) return cred;
-  const serviceUrls = resolveServiceUrls(profile.serviceUrls, environment);
-  if (environment === "local" && !serviceUrls?.auth) {
-    throw new TopoloSdkError(
-      "environment_service_url_required",
-      "Local Topolo credential refresh requires an explicit local Auth service origin."
-    );
-  }
-  try {
-    const oauth = new TopoloOAuth({
-      serviceUrls
-    });
-    const tokens = await oauth.refreshToken({
-      clientId: profile.oauthClientId,
-      refreshToken: cred.refreshToken
-    });
-    const refreshed = {
-      kind: "access_token",
-      accessToken: tokens.access_token,
-      ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: cred.refreshToken },
-      expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
-    };
-    const activeContext = profile.activeContext;
-    const activeEntry = activeContext ? profile.contexts?.[activeContext] : void 0;
-    const updated = activeContext && activeEntry ? writeProfileConfig(config, environment, {
-      credential: refreshed,
-      contexts: {
-        ...profile.contexts ?? {},
-        [activeContext]: {
-          ...activeEntry,
-          credential: refreshed,
-          oauthClientId: activeEntry.oauthClientId ?? profile.oauthClientId
+  const observed = profileForEnvironment(await readConfig(), environment).credential;
+  return withConfigWriteLock(async () => {
+    const config = await readConfig();
+    const profile = profileForEnvironment(config, environment);
+    const cred = profile.credential;
+    if (!cred || cred.kind !== "access_token") return cred ?? null;
+    if (!cred.refreshToken || !profile.oauthClientId) return cred;
+    if (options.force && observed?.kind === "access_token" && observed.accessToken !== cred.accessToken) {
+      return cred;
+    }
+    const now = Math.floor(Date.now() / 1e3);
+    if (!options.force && cred.expiresAt && cred.expiresAt - REFRESH_SKEW_SECONDS > now) return cred;
+    const serviceUrls = resolveServiceUrls(profile.serviceUrls, environment);
+    if (environment === "local" && !serviceUrls?.auth) {
+      throw new TopoloSdkError(
+        "environment_service_url_required",
+        "Local Topolo credential refresh requires an explicit local Auth service origin."
+      );
+    }
+    try {
+      const oauth = new TopoloOAuth({
+        serviceUrls
+      });
+      const tokens = await oauth.refreshToken({
+        clientId: profile.oauthClientId,
+        refreshToken: cred.refreshToken
+      });
+      const refreshed = {
+        kind: "access_token",
+        accessToken: tokens.access_token,
+        ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: cred.refreshToken },
+        expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
+      };
+      const activeContext = profile.activeContext;
+      const activeEntry = activeContext ? profile.contexts?.[activeContext] : void 0;
+      const updated = activeContext && activeEntry ? writeProfileConfig(config, environment, {
+        credential: refreshed,
+        contexts: {
+          ...profile.contexts ?? {},
+          [activeContext]: {
+            ...activeEntry,
+            credential: refreshed,
+            oauthClientId: activeEntry.oauthClientId ?? profile.oauthClientId
+          }
         }
-      }
-    }) : environment === "production" && !config.profiles?.production ? { ...config, credential: refreshed } : writeProfileConfig(config, environment, { credential: refreshed });
-    await writeConfig(updated);
-    return refreshed;
-  } catch {
-    return cred;
-  }
+      }) : environment === "production" && !config.profiles?.production ? { ...config, credential: refreshed } : writeProfileConfig(config, environment, { credential: refreshed });
+      await writeConfig(updated);
+      return refreshed;
+    } catch {
+      return cred;
+    }
+  });
 }
 async function refreshContextCredentialIfNeeded(environment, key, options = {}) {
   return withConfigWriteLock(async () => {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@topolo/sdk",
-  "version": "0.11.9",
-  "topoloPublishedVersion": "0.11.9",
+  "version": "0.11.11",
+  "topoloPublishedVersion": "0.11.11",
   "description": "Typed client SDK for the Topolo platform. Used by TopoloCli, TopoloMCP, and third-party agents.",
   "license": "UNLICENSED",
   "author": "Topolo",