@topolo/sdk 0.16.0 → 0.18.0

package/README.md

@@ -160,6 +160,19 @@ input and resource before sending its canonical base64url representation in
 `X-Topolo-Actor-Envelope`; the envelope request ID also becomes the transport
 request ID.
 
+Use `projectActorAuditEvent` when persisting or rendering immutable audit
+events. The role remains explicit and the friendly label is derived without
+rewriting either identity:
+
+```ts
+const executedBy = projectActorAuditEvent(actorEnvelope, 'executed_by');
+// executedBy.label === 'Ashley Lane via codex'
+```
+
+The frozen projection retains the accountable subject, actual performer,
+delegation, channel, assurance, resource, request, action and canonical input
+hash for consistent application queries and exports.
+
 ## Modules
 
 | Surface      | Methods                               |

package/dist/index.cjs

@@ -21,6 +21,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var index_exports = {};
 __export(index_exports, {
   ACTION_CATALOG_DIGEST_ALGORITHM: () => ACTION_CATALOG_DIGEST_ALGORITHM,
+  ACTOR_AUDIT_PROJECTION_VERSION: () => ACTOR_AUDIT_PROJECTION_VERSION,
   ACTOR_ENVELOPE_VERSION: () => ACTOR_ENVELOPE_VERSION,
   ActorEnvelopeValidationError: () => ActorEnvelopeValidationError,
   CrmModule: () => CrmModule,
@@ -81,6 +82,7 @@ __export(index_exports, {
   preferExactActionMatches: () => preferExactActionMatches,
   prepareTopoloActionBase64UploadInput: () => prepareTopoloActionBase64UploadInput,
   prepareTopoloActionUploadInput: () => prepareTopoloActionUploadInput,
+  projectActorAuditEvent: () => projectActorAuditEvent,
   publicTopoloErrorMessage: () => publicTopoloErrorMessage,
   resolveApplicationDirectoryEntry: () => resolveApplicationDirectoryEntry,
   resolveCatalogServiceUrl: () => resolveCatalogServiceUrl,
@@ -1381,6 +1383,7 @@ var NEGATIVE_CACHE_TTL_MS = 60 * 1e3;
 var TopoloClient = class _TopoloClient {
   credential;
   agent;
+  actorContext;
   serviceUrls;
   environment;
   appIds;
@@ -1411,6 +1414,11 @@ var TopoloClient = class _TopoloClient {
     if (!options.agent?.clientName) throw new TopoloAuthError("agent.clientName is required");
     this.credential = options.credential;
     this.agent = options.agent;
+    this.actorContext = options.actorContext ? {
+      channel: options.actorContext.channel,
+      taskId: options.actorContext.taskId ?? `task_${generateRequestId()}`,
+      runId: options.actorContext.runId ?? `run_${generateRequestId()}`
+    } : void 0;
     this.environment = options.environment;
     this.serviceUrls = options.environment ? topoloServiceOrigins(options.serviceUrls, options.environment) : options.serviceUrls;
     this.appIds = options.appIds;
@@ -2126,8 +2134,9 @@ var TopoloClient = class _TopoloClient {
       );
     }
     const mapped = mapActionInput(entry, input);
-    if (options.actorEnvelope) {
-      const actorEnvelope = parseActorEnvelope(options.actorEnvelope);
+    const resolvedActorEnvelope = options.actorEnvelope ?? await this.buildVerifiedAgentActorEnvelope(entry.actionId, input, options.resource);
+    if (resolvedActorEnvelope) {
+      const actorEnvelope = parseActorEnvelope(resolvedActorEnvelope);
       if (actorEnvelope.action.actionId !== entry.actionId) {
         throw new TopoloSdkError("actor_envelope_action_mismatch", "Actor envelope actionId does not match the executed action.");
       }
@@ -2148,7 +2157,7 @@ var TopoloClient = class _TopoloClient {
       ...mapped.query ? { query: mapped.query } : {},
       ...mapped.body !== void 0 ? { body: mapped.body } : {},
       ...options.resource ? { resource: options.resource } : {},
-      ...options.actorEnvelope ? { actorEnvelope: options.actorEnvelope } : {},
+      ...resolvedActorEnvelope ? { actorEnvelope: resolvedActorEnvelope } : {},
       headers: {
         [TOPOLO_ACTION_ID_HEADER]: entry.actionId,
         [TOPOLO_ACTION_NAME_HEADER]: entry.name
@@ -2157,6 +2166,56 @@ var TopoloClient = class _TopoloClient {
     });
     return redactActionResult(result);
   }
+  async buildVerifiedAgentActorEnvelope(actionId, input, resource) {
+    if (!this.actorContext) return void 0;
+    const identity = await this.introspect();
+    const principalType = identity.user.principalType;
+    if (principalType !== "agent_employee" && principalType !== "external_agent") return void 0;
+    if (!identity.organization || !identity.user.accountableUserId || !identity.user.principalId) {
+      throw new TopoloSdkError(
+        "incomplete_agent_identity",
+        "Verified agent credentials must resolve an organization, accountable user, and principal id."
+      );
+    }
+    const performer = principalType === "external_agent" ? {
+      principalType: "external_agent",
+      principalId: identity.user.principalId,
+      installationId: identity.user.installationId ?? void 0,
+      provider: identity.user.provider ?? void 0,
+      model: identity.user.model ?? void 0
+    } : {
+      principalType: "managed_agent",
+      principalId: identity.user.principalId,
+      agentInstanceId: identity.user.agentInstanceId ?? void 0,
+      model: identity.user.model ?? void 0
+    };
+    if (performer.principalType === "external_agent" && (!performer.installationId || !performer.provider) || performer.principalType === "managed_agent" && !performer.agentInstanceId) {
+      throw new TopoloSdkError(
+        "incomplete_agent_identity",
+        "Verified agent credentials are missing the performer identity required for provenance."
+      );
+    }
+    return parseActorEnvelope({
+      schemaVersion: 1,
+      organizationId: identity.organization.id,
+      accountableSubject: { principalType: "human", principalId: identity.user.accountableUserId },
+      performer,
+      delegation: {
+        taskId: this.actorContext.taskId,
+        runId: this.actorContext.runId,
+        lineage: [{ principalType: performer.principalType, principalId: performer.principalId }]
+      },
+      channel: this.actorContext.channel,
+      assurance: { level: "workload_identity", methods: ["client_credentials"] },
+      action: {
+        requestId: generateRequestId(),
+        actionId,
+        ...resource ? resource : {},
+        inputHash: await sha256CanonicalValue(input)
+      },
+      issuedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  }
   /**
    * Introspect the current credential. Returns the caller's resolved identity,
    * organization, and permission set. Used by CLI `whoami` and by MCP to gate
@@ -2184,7 +2243,18 @@ var TopoloClient = class _TopoloClient {
         email: user.email,
         name: user.name ?? null,
         role: user.role ?? (kind === "api_key" ? "service" : "member"),
-        permissions: payload.permissions ?? user.permissions ?? []
+        permissions: payload.permissions ?? user.permissions ?? [],
+        ...normalizeAgentPrincipalType(user.principalType) ? {
+          principalId: readOptionalString(user.principalId),
+          principalType: normalizeAgentPrincipalType(user.principalType),
+          accountableUserId: readOptionalString(user.accountableUserId),
+          agentInstanceId: readOptionalString(user.agentInstanceId),
+          installationId: readOptionalString(user.installationId),
+          provider: readOptionalString(user.provider),
+          model: readOptionalString(user.model),
+          serviceScopes: stringArray(user.serviceScopes),
+          policyRef: readOptionalString(user.policyRef)
+        } : {}
       },
       organization: organization ? {
         id: organization.id,
@@ -2549,6 +2619,9 @@ function normalizeCredentialAuthorizationMode(value, kind) {
   if (value === "context_rbac" || value === "oauth_scopes" || value === "session_rbac") return value;
   return "unknown";
 }
+function normalizeAgentPrincipalType(value) {
+  return value === "agent_employee" || value === "external_agent" ? value : null;
+}
 function describeError(body, fallback) {
   if (body && typeof body === "object") {
     const maybe = body;
@@ -3273,6 +3346,43 @@ var IdentityModule = class {
   }
 };
 
+// src/actor-audit.ts
+var ACTOR_AUDIT_PROJECTION_VERSION = 1;
+var EVENT_ROLES = /* @__PURE__ */ new Set([
+  "requested_by",
+  "acting_on_behalf_of",
+  "approved_by",
+  "executed_by"
+]);
+function projectActorAuditEvent(value, role) {
+  if (!EVENT_ROLES.has(role)) throw new TypeError("Unsupported actor audit event role");
+  const envelope = parseActorEnvelope(value);
+  const subjectLabel = envelope.accountableSubject.displayName || envelope.accountableSubject.principalId;
+  const performerLabel = envelope.performer.displayName || envelope.performer.model || envelope.performer.provider || envelope.performer.principalId;
+  const direct = envelope.performer.principalType === envelope.accountableSubject.principalType && envelope.performer.principalId === envelope.accountableSubject.principalId;
+  return deepFreeze({
+    schemaVersion: ACTOR_AUDIT_PROJECTION_VERSION,
+    role,
+    label: direct ? subjectLabel : `${subjectLabel} via ${performerLabel}`,
+    organizationId: envelope.organizationId,
+    accountableSubject: envelope.accountableSubject,
+    performer: envelope.performer,
+    delegation: envelope.delegation,
+    channel: envelope.channel,
+    assurance: envelope.assurance,
+    action: envelope.action,
+    issuedAt: envelope.issuedAt,
+    ...envelope.expiresAt ? { expiresAt: envelope.expiresAt } : {}
+  });
+}
+function deepFreeze(value) {
+  if (value && typeof value === "object" && !Object.isFrozen(value)) {
+    Object.freeze(value);
+    for (const nested of Object.values(value)) deepFreeze(nested);
+  }
+  return value;
+}
+
 // src/modules/workspaces.ts
 var ACTIONS = {
   list: "app_topolo_auth.workspaces.list",
@@ -4764,6 +4874,7 @@ function createTopolo(options) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ACTION_CATALOG_DIGEST_ALGORITHM,
+  ACTOR_AUDIT_PROJECTION_VERSION,
   ACTOR_ENVELOPE_VERSION,
   ActorEnvelopeValidationError,
   CrmModule,
@@ -4824,6 +4935,7 @@ function createTopolo(options) {
   preferExactActionMatches,
   prepareTopoloActionBase64UploadInput,
   prepareTopoloActionUploadInput,
+  projectActorAuditEvent,
   publicTopoloErrorMessage,
   resolveApplicationDirectoryEntry,
   resolveCatalogServiceUrl,

package/dist/index.d.cts

@@ -146,6 +146,12 @@ declare function encodeTopoloActionBase64(bytes: Uint8Array): string;
 interface TopoloClientOptions {
     credential: TopoloCredential;
     agent: AgentIdentity;
+    /** Host surface used to attribute actions performed with verified agent credentials. */
+    actorContext?: {
+        channel: ActorChannel;
+        taskId?: string;
+        runId?: string;
+    };
     /** Per-service URL overrides. Useful for staging/dev. */
     serviceUrls?: Record<string, string>;
     /** Explicit environment used to reject cross-environment service and action origins. */
@@ -403,6 +409,7 @@ interface TopoloCatalogSearchOptions {
 declare class TopoloClient {
     private credential;
     private readonly agent;
+    private readonly actorContext?;
     private readonly serviceUrls?;
     private readonly environment?;
     private readonly appIds?;
@@ -534,6 +541,7 @@ declare class TopoloClient {
         actorEnvelope?: ActorEnvelope;
     }): Promise<T>;
     private executeResolvedAction;
+    private buildVerifiedAgentActorEnvelope;
     /**
      * Introspect the current credential. Returns the caller's resolved identity,
      * organization, and permission set. Used by CLI `whoami` and by MCP to gate
@@ -554,6 +562,15 @@ interface CredentialIntrospection {
         name: string | null;
         role: string;
         permissions: string[];
+        principalId?: string | null;
+        principalType?: 'agent_employee' | 'external_agent' | null;
+        accountableUserId?: string | null;
+        agentInstanceId?: string | null;
+        installationId?: string | null;
+        provider?: string | null;
+        model?: string | null;
+        serviceScopes?: string[];
+        policyRef?: string | null;
     };
     organization: {
         id: string;
@@ -967,6 +984,24 @@ declare class IdentityModule {
     whoami(): Promise<CredentialIntrospection>;
 }
 
+declare const ACTOR_AUDIT_PROJECTION_VERSION: 1;
+type ActorAuditEventRole = 'requested_by' | 'acting_on_behalf_of' | 'approved_by' | 'executed_by';
+interface ActorAuditProjection {
+    readonly schemaVersion: typeof ACTOR_AUDIT_PROJECTION_VERSION;
+    readonly role: ActorAuditEventRole;
+    readonly label: string;
+    readonly organizationId: string;
+    readonly accountableSubject: Readonly<AccountableSubject>;
+    readonly performer: Readonly<ActorIdentity>;
+    readonly delegation: Readonly<NonNullable<ActorEnvelope['delegation']>> | null;
+    readonly channel: ActorEnvelope['channel'];
+    readonly assurance: Readonly<ActorEnvelope['assurance']>;
+    readonly action: Readonly<ActorEnvelope['action']>;
+    readonly issuedAt: string;
+    readonly expiresAt?: string;
+}
+declare function projectActorAuditEvent(value: unknown, role: ActorAuditEventRole): ActorAuditProjection;
+
 interface TopoloWorkspace {
     id: string;
     appId: string;
@@ -1659,4 +1694,4 @@ declare function createTopolo(options: TopoloClientOptions): {
 };
 type Topolo = ReturnType<typeof createTopolo>;
 
-export { ACTION_CATALOG_DIGEST_ALGORITHM, ACTOR_ENVELOPE_VERSION, type AccountableSubject, type AccountableSubjectType, type ActionContractManifest, type ActionContractSource, type ActorAssurance, type ActorChannel, type ActorDelegationHop, type ActorEnvelope, ActorEnvelopeValidationError, type ActorIdentity, type ActorPrincipalType, type AgentIdentity, type AppApiId, type ApplicationCatalogEntry, type ApplicationDeployTarget, type ApplicationDirectory, type ApplicationDirectoryApplication, type ApplicationDirectoryClient, type ApplicationDirectorySource, type ApplicationId, type CredentialIntrospection, type CrmContactSummary, CrmModule, DEFAULT_APP_URLS, type DeviceAuthorizationResponse, IdentityModule, type ListContactsOptions, type ListContactsResult, type OAuthHelperOptions, type P2PActionDetail, type P2PActionRequestInput, type P2PActionRequestResult, type P2PActionRow, type P2PActionRun, type P2PCapability, type P2PConnection, type P2PHold, type P2PLedgerEntry, P2PModule, type P2PPolicy, type P2PPricingModel, type P2PSettlementBatch, type P2PSettlementGroup, type PublishCapabilityInput, type RequestOptions, type ServiceCatalogUrlEntry, TOPOLO_ACTOR_ENVELOPE_HEADER, TOPOLO_ENVIRONMENT_SERVICE_URLS, TOPOLO_RUNTIME_ENVIRONMENTS, TOPOLO_WIDGET_CONTRACT_VERSION, TOPOLO_WIDGET_ENDPOINT, TOPOLO_WIDGET_OUTPUT_SCHEMA, TOPOLO_WIDGET_REFRESH_INTERVAL_MS, type TokenResponse, type Topolo, type TopoloActionAgentContract, type TopoloActionCatalogEntry, type TopoloActionCatalogSummary, type TopoloActionDigestInput, type TopoloActionPlan, type TopoloActionPreparation, type TopoloActionUploadOptions, type TopoloActionValidationIssue, type TopoloActionValidationResult, type TopoloActionsWidget, type TopoloActivityWidget, type TopoloAgentExecutionContext, type TopoloApiKeyResourceMetadata, TopoloAuthError, type TopoloBinaryResponse, type TopoloBindableResource, type TopoloBindableResourceCatalog, type TopoloChartWidget, TopoloClient, type TopoloClientOptions, TopoloConfirmationRequiredError, type TopoloCredential, type TopoloDebugEvent, TopoloHttpError, type TopoloInlineBase64UploadContract, type TopoloJsonSchema, type TopoloNotificationsWidget, TopoloOAuth, TopoloPermissionError, type TopoloRuntimeEnvironment, TopoloSdkError, type TopoloServiceCatalogEntry, type TopoloStatsWidget, type TopoloWidget, type TopoloWidgetAccessibility, type TopoloWidgetActionBinding, type TopoloWidgetActionRecovery, type TopoloWidgetActivityItem, type TopoloWidgetApiError, type TopoloWidgetApiErrorResponse, type TopoloWidgetApiResponse, type TopoloWidgetApiSuccessResponse, type TopoloWidgetBase, type TopoloWidgetConfig, type TopoloWidgetConfiguration, type TopoloWidgetConfigurationField, type TopoloWidgetConfigurationOption, type TopoloWidgetContext, type TopoloWidgetContribution, type TopoloWidgetDatasetDefinition, type TopoloWidgetDimension, type TopoloWidgetDimensionDefinition, type TopoloWidgetDraft, type TopoloWidgetDrilldown, type TopoloWidgetErrorResponseOptions, type TopoloWidgetEventDefinition, type TopoloWidgetLifecycleStage, type TopoloWidgetLocalization, type TopoloWidgetMetric, type TopoloWidgetMetricAggregation, type TopoloWidgetMetricComparison, type TopoloWidgetMetricDefinition, type TopoloWidgetMetricSemantic, type TopoloWidgetNotificationItem, type TopoloWidgetPeriod, type TopoloWidgetPresentation, type TopoloWidgetRefreshPolicy, type TopoloWidgetResourceBinding, type TopoloWidgetResponseOptions, type TopoloWidgetSeries, type TopoloWidgetSeriesDefinition, type TopoloWidgetSeriesPoint, type TopoloWidgetSize, type TopoloWidgetState, type TopoloWidgetStatus, type TopoloWidgetType, type TopoloWidgetValidationResult, type TopoloWidgetVisualizationFamily, type TopoloWidgetWorkspaceSelector, type TopoloWorkspace, type TopoloWorkspaceListResult, type TopoloWorkspaceMutationResult, type TopoloWorkspacePolicy, WorkspacesModule, actionContractCompleteness, applicationEntryFromCatalog, assertTopoloServiceUrlEnvironment, canonicalJson, canonicalTopoloErrorCode, canonicalTopoloRequestId, canonicalTopoloRequired, canonicalTopoloRetryAfter, canonicalizeActorEnvelope, compactActionCatalogEntry, compactActionPlan, compactActionPreparation, compactActionResult, compactActionValidation, createTopolo, createTopoloAgentExecutionContext, createTopoloWidgetError, createTopoloWidgetResponse, decodeActorEnvelopeHeader, defineTopoloActionsWidget, defineTopoloActivityWidget, defineTopoloChartWidget, defineTopoloNotificationsWidget, defineTopoloStatsWidget, digestTopoloActionCatalog, encodeActorEnvelopeHeader, encodeTopoloActionBase64, enrichActionContract, extractTopoloServiceErrorCode, extractTopoloServiceErrorDetails, formatDirectoryApplicationIds, friendlyAppId, isTopoloWidgetOutputSchema, listApplicationDirectory, parseActorEnvelope, parseTopoloActionUploadContract, preferExactActionMatches, prepareTopoloActionBase64UploadInput, prepareTopoloActionUploadInput, publicTopoloErrorMessage, resolveApplicationDirectoryEntry, resolveCatalogServiceUrl, resolveServiceUrl, sha256CanonicalValue, topoloErrorHint, topoloServiceOrigins, validateTopoloActionInput, validateTopoloWidgetResponse };
+export { ACTION_CATALOG_DIGEST_ALGORITHM, ACTOR_AUDIT_PROJECTION_VERSION, ACTOR_ENVELOPE_VERSION, type AccountableSubject, type AccountableSubjectType, type ActionContractManifest, type ActionContractSource, type ActorAssurance, type ActorAuditEventRole, type ActorAuditProjection, type ActorChannel, type ActorDelegationHop, type ActorEnvelope, ActorEnvelopeValidationError, type ActorIdentity, type ActorPrincipalType, type AgentIdentity, type AppApiId, type ApplicationCatalogEntry, type ApplicationDeployTarget, type ApplicationDirectory, type ApplicationDirectoryApplication, type ApplicationDirectoryClient, type ApplicationDirectorySource, type ApplicationId, type CredentialIntrospection, type CrmContactSummary, CrmModule, DEFAULT_APP_URLS, type DeviceAuthorizationResponse, IdentityModule, type ListContactsOptions, type ListContactsResult, type OAuthHelperOptions, type P2PActionDetail, type P2PActionRequestInput, type P2PActionRequestResult, type P2PActionRow, type P2PActionRun, type P2PCapability, type P2PConnection, type P2PHold, type P2PLedgerEntry, P2PModule, type P2PPolicy, type P2PPricingModel, type P2PSettlementBatch, type P2PSettlementGroup, type PublishCapabilityInput, type RequestOptions, type ServiceCatalogUrlEntry, TOPOLO_ACTOR_ENVELOPE_HEADER, TOPOLO_ENVIRONMENT_SERVICE_URLS, TOPOLO_RUNTIME_ENVIRONMENTS, TOPOLO_WIDGET_CONTRACT_VERSION, TOPOLO_WIDGET_ENDPOINT, TOPOLO_WIDGET_OUTPUT_SCHEMA, TOPOLO_WIDGET_REFRESH_INTERVAL_MS, type TokenResponse, type Topolo, type TopoloActionAgentContract, type TopoloActionCatalogEntry, type TopoloActionCatalogSummary, type TopoloActionDigestInput, type TopoloActionPlan, type TopoloActionPreparation, type TopoloActionUploadOptions, type TopoloActionValidationIssue, type TopoloActionValidationResult, type TopoloActionsWidget, type TopoloActivityWidget, type TopoloAgentExecutionContext, type TopoloApiKeyResourceMetadata, TopoloAuthError, type TopoloBinaryResponse, type TopoloBindableResource, type TopoloBindableResourceCatalog, type TopoloChartWidget, TopoloClient, type TopoloClientOptions, TopoloConfirmationRequiredError, type TopoloCredential, type TopoloDebugEvent, TopoloHttpError, type TopoloInlineBase64UploadContract, type TopoloJsonSchema, type TopoloNotificationsWidget, TopoloOAuth, TopoloPermissionError, type TopoloRuntimeEnvironment, TopoloSdkError, type TopoloServiceCatalogEntry, type TopoloStatsWidget, type TopoloWidget, type TopoloWidgetAccessibility, type TopoloWidgetActionBinding, type TopoloWidgetActionRecovery, type TopoloWidgetActivityItem, type TopoloWidgetApiError, type TopoloWidgetApiErrorResponse, type TopoloWidgetApiResponse, type TopoloWidgetApiSuccessResponse, type TopoloWidgetBase, type TopoloWidgetConfig, type TopoloWidgetConfiguration, type TopoloWidgetConfigurationField, type TopoloWidgetConfigurationOption, type TopoloWidgetContext, type TopoloWidgetContribution, type TopoloWidgetDatasetDefinition, type TopoloWidgetDimension, type TopoloWidgetDimensionDefinition, type TopoloWidgetDraft, type TopoloWidgetDrilldown, type TopoloWidgetErrorResponseOptions, type TopoloWidgetEventDefinition, type TopoloWidgetLifecycleStage, type TopoloWidgetLocalization, type TopoloWidgetMetric, type TopoloWidgetMetricAggregation, type TopoloWidgetMetricComparison, type TopoloWidgetMetricDefinition, type TopoloWidgetMetricSemantic, type TopoloWidgetNotificationItem, type TopoloWidgetPeriod, type TopoloWidgetPresentation, type TopoloWidgetRefreshPolicy, type TopoloWidgetResourceBinding, type TopoloWidgetResponseOptions, type TopoloWidgetSeries, type TopoloWidgetSeriesDefinition, type TopoloWidgetSeriesPoint, type TopoloWidgetSize, type TopoloWidgetState, type TopoloWidgetStatus, type TopoloWidgetType, type TopoloWidgetValidationResult, type TopoloWidgetVisualizationFamily, type TopoloWidgetWorkspaceSelector, type TopoloWorkspace, type TopoloWorkspaceListResult, type TopoloWorkspaceMutationResult, type TopoloWorkspacePolicy, WorkspacesModule, actionContractCompleteness, applicationEntryFromCatalog, assertTopoloServiceUrlEnvironment, canonicalJson, canonicalTopoloErrorCode, canonicalTopoloRequestId, canonicalTopoloRequired, canonicalTopoloRetryAfter, canonicalizeActorEnvelope, compactActionCatalogEntry, compactActionPlan, compactActionPreparation, compactActionResult, compactActionValidation, createTopolo, createTopoloAgentExecutionContext, createTopoloWidgetError, createTopoloWidgetResponse, decodeActorEnvelopeHeader, defineTopoloActionsWidget, defineTopoloActivityWidget, defineTopoloChartWidget, defineTopoloNotificationsWidget, defineTopoloStatsWidget, digestTopoloActionCatalog, encodeActorEnvelopeHeader, encodeTopoloActionBase64, enrichActionContract, extractTopoloServiceErrorCode, extractTopoloServiceErrorDetails, formatDirectoryApplicationIds, friendlyAppId, isTopoloWidgetOutputSchema, listApplicationDirectory, parseActorEnvelope, parseTopoloActionUploadContract, preferExactActionMatches, prepareTopoloActionBase64UploadInput, prepareTopoloActionUploadInput, projectActorAuditEvent, publicTopoloErrorMessage, resolveApplicationDirectoryEntry, resolveCatalogServiceUrl, resolveServiceUrl, sha256CanonicalValue, topoloErrorHint, topoloServiceOrigins, validateTopoloActionInput, validateTopoloWidgetResponse };

package/dist/index.d.ts

@@ -146,6 +146,12 @@ declare function encodeTopoloActionBase64(bytes: Uint8Array): string;
 interface TopoloClientOptions {
     credential: TopoloCredential;
     agent: AgentIdentity;
+    /** Host surface used to attribute actions performed with verified agent credentials. */
+    actorContext?: {
+        channel: ActorChannel;
+        taskId?: string;
+        runId?: string;
+    };
     /** Per-service URL overrides. Useful for staging/dev. */
     serviceUrls?: Record<string, string>;
     /** Explicit environment used to reject cross-environment service and action origins. */
@@ -403,6 +409,7 @@ interface TopoloCatalogSearchOptions {
 declare class TopoloClient {
     private credential;
     private readonly agent;
+    private readonly actorContext?;
     private readonly serviceUrls?;
     private readonly environment?;
     private readonly appIds?;
@@ -534,6 +541,7 @@ declare class TopoloClient {
         actorEnvelope?: ActorEnvelope;
     }): Promise<T>;
     private executeResolvedAction;
+    private buildVerifiedAgentActorEnvelope;
     /**
      * Introspect the current credential. Returns the caller's resolved identity,
      * organization, and permission set. Used by CLI `whoami` and by MCP to gate
@@ -554,6 +562,15 @@ interface CredentialIntrospection {
         name: string | null;
         role: string;
         permissions: string[];
+        principalId?: string | null;
+        principalType?: 'agent_employee' | 'external_agent' | null;
+        accountableUserId?: string | null;
+        agentInstanceId?: string | null;
+        installationId?: string | null;
+        provider?: string | null;
+        model?: string | null;
+        serviceScopes?: string[];
+        policyRef?: string | null;
     };
     organization: {
         id: string;
@@ -967,6 +984,24 @@ declare class IdentityModule {
     whoami(): Promise<CredentialIntrospection>;
 }
 
+declare const ACTOR_AUDIT_PROJECTION_VERSION: 1;
+type ActorAuditEventRole = 'requested_by' | 'acting_on_behalf_of' | 'approved_by' | 'executed_by';
+interface ActorAuditProjection {
+    readonly schemaVersion: typeof ACTOR_AUDIT_PROJECTION_VERSION;
+    readonly role: ActorAuditEventRole;
+    readonly label: string;
+    readonly organizationId: string;
+    readonly accountableSubject: Readonly<AccountableSubject>;
+    readonly performer: Readonly<ActorIdentity>;
+    readonly delegation: Readonly<NonNullable<ActorEnvelope['delegation']>> | null;
+    readonly channel: ActorEnvelope['channel'];
+    readonly assurance: Readonly<ActorEnvelope['assurance']>;
+    readonly action: Readonly<ActorEnvelope['action']>;
+    readonly issuedAt: string;
+    readonly expiresAt?: string;
+}
+declare function projectActorAuditEvent(value: unknown, role: ActorAuditEventRole): ActorAuditProjection;
+
 interface TopoloWorkspace {
     id: string;
     appId: string;
@@ -1659,4 +1694,4 @@ declare function createTopolo(options: TopoloClientOptions): {
 };
 type Topolo = ReturnType<typeof createTopolo>;
 
-export { ACTION_CATALOG_DIGEST_ALGORITHM, ACTOR_ENVELOPE_VERSION, type AccountableSubject, type AccountableSubjectType, type ActionContractManifest, type ActionContractSource, type ActorAssurance, type ActorChannel, type ActorDelegationHop, type ActorEnvelope, ActorEnvelopeValidationError, type ActorIdentity, type ActorPrincipalType, type AgentIdentity, type AppApiId, type ApplicationCatalogEntry, type ApplicationDeployTarget, type ApplicationDirectory, type ApplicationDirectoryApplication, type ApplicationDirectoryClient, type ApplicationDirectorySource, type ApplicationId, type CredentialIntrospection, type CrmContactSummary, CrmModule, DEFAULT_APP_URLS, type DeviceAuthorizationResponse, IdentityModule, type ListContactsOptions, type ListContactsResult, type OAuthHelperOptions, type P2PActionDetail, type P2PActionRequestInput, type P2PActionRequestResult, type P2PActionRow, type P2PActionRun, type P2PCapability, type P2PConnection, type P2PHold, type P2PLedgerEntry, P2PModule, type P2PPolicy, type P2PPricingModel, type P2PSettlementBatch, type P2PSettlementGroup, type PublishCapabilityInput, type RequestOptions, type ServiceCatalogUrlEntry, TOPOLO_ACTOR_ENVELOPE_HEADER, TOPOLO_ENVIRONMENT_SERVICE_URLS, TOPOLO_RUNTIME_ENVIRONMENTS, TOPOLO_WIDGET_CONTRACT_VERSION, TOPOLO_WIDGET_ENDPOINT, TOPOLO_WIDGET_OUTPUT_SCHEMA, TOPOLO_WIDGET_REFRESH_INTERVAL_MS, type TokenResponse, type Topolo, type TopoloActionAgentContract, type TopoloActionCatalogEntry, type TopoloActionCatalogSummary, type TopoloActionDigestInput, type TopoloActionPlan, type TopoloActionPreparation, type TopoloActionUploadOptions, type TopoloActionValidationIssue, type TopoloActionValidationResult, type TopoloActionsWidget, type TopoloActivityWidget, type TopoloAgentExecutionContext, type TopoloApiKeyResourceMetadata, TopoloAuthError, type TopoloBinaryResponse, type TopoloBindableResource, type TopoloBindableResourceCatalog, type TopoloChartWidget, TopoloClient, type TopoloClientOptions, TopoloConfirmationRequiredError, type TopoloCredential, type TopoloDebugEvent, TopoloHttpError, type TopoloInlineBase64UploadContract, type TopoloJsonSchema, type TopoloNotificationsWidget, TopoloOAuth, TopoloPermissionError, type TopoloRuntimeEnvironment, TopoloSdkError, type TopoloServiceCatalogEntry, type TopoloStatsWidget, type TopoloWidget, type TopoloWidgetAccessibility, type TopoloWidgetActionBinding, type TopoloWidgetActionRecovery, type TopoloWidgetActivityItem, type TopoloWidgetApiError, type TopoloWidgetApiErrorResponse, type TopoloWidgetApiResponse, type TopoloWidgetApiSuccessResponse, type TopoloWidgetBase, type TopoloWidgetConfig, type TopoloWidgetConfiguration, type TopoloWidgetConfigurationField, type TopoloWidgetConfigurationOption, type TopoloWidgetContext, type TopoloWidgetContribution, type TopoloWidgetDatasetDefinition, type TopoloWidgetDimension, type TopoloWidgetDimensionDefinition, type TopoloWidgetDraft, type TopoloWidgetDrilldown, type TopoloWidgetErrorResponseOptions, type TopoloWidgetEventDefinition, type TopoloWidgetLifecycleStage, type TopoloWidgetLocalization, type TopoloWidgetMetric, type TopoloWidgetMetricAggregation, type TopoloWidgetMetricComparison, type TopoloWidgetMetricDefinition, type TopoloWidgetMetricSemantic, type TopoloWidgetNotificationItem, type TopoloWidgetPeriod, type TopoloWidgetPresentation, type TopoloWidgetRefreshPolicy, type TopoloWidgetResourceBinding, type TopoloWidgetResponseOptions, type TopoloWidgetSeries, type TopoloWidgetSeriesDefinition, type TopoloWidgetSeriesPoint, type TopoloWidgetSize, type TopoloWidgetState, type TopoloWidgetStatus, type TopoloWidgetType, type TopoloWidgetValidationResult, type TopoloWidgetVisualizationFamily, type TopoloWidgetWorkspaceSelector, type TopoloWorkspace, type TopoloWorkspaceListResult, type TopoloWorkspaceMutationResult, type TopoloWorkspacePolicy, WorkspacesModule, actionContractCompleteness, applicationEntryFromCatalog, assertTopoloServiceUrlEnvironment, canonicalJson, canonicalTopoloErrorCode, canonicalTopoloRequestId, canonicalTopoloRequired, canonicalTopoloRetryAfter, canonicalizeActorEnvelope, compactActionCatalogEntry, compactActionPlan, compactActionPreparation, compactActionResult, compactActionValidation, createTopolo, createTopoloAgentExecutionContext, createTopoloWidgetError, createTopoloWidgetResponse, decodeActorEnvelopeHeader, defineTopoloActionsWidget, defineTopoloActivityWidget, defineTopoloChartWidget, defineTopoloNotificationsWidget, defineTopoloStatsWidget, digestTopoloActionCatalog, encodeActorEnvelopeHeader, encodeTopoloActionBase64, enrichActionContract, extractTopoloServiceErrorCode, extractTopoloServiceErrorDetails, formatDirectoryApplicationIds, friendlyAppId, isTopoloWidgetOutputSchema, listApplicationDirectory, parseActorEnvelope, parseTopoloActionUploadContract, preferExactActionMatches, prepareTopoloActionBase64UploadInput, prepareTopoloActionUploadInput, publicTopoloErrorMessage, resolveApplicationDirectoryEntry, resolveCatalogServiceUrl, resolveServiceUrl, sha256CanonicalValue, topoloErrorHint, topoloServiceOrigins, validateTopoloActionInput, validateTopoloWidgetResponse };
+export { ACTION_CATALOG_DIGEST_ALGORITHM, ACTOR_AUDIT_PROJECTION_VERSION, ACTOR_ENVELOPE_VERSION, type AccountableSubject, type AccountableSubjectType, type ActionContractManifest, type ActionContractSource, type ActorAssurance, type ActorAuditEventRole, type ActorAuditProjection, type ActorChannel, type ActorDelegationHop, type ActorEnvelope, ActorEnvelopeValidationError, type ActorIdentity, type ActorPrincipalType, type AgentIdentity, type AppApiId, type ApplicationCatalogEntry, type ApplicationDeployTarget, type ApplicationDirectory, type ApplicationDirectoryApplication, type ApplicationDirectoryClient, type ApplicationDirectorySource, type ApplicationId, type CredentialIntrospection, type CrmContactSummary, CrmModule, DEFAULT_APP_URLS, type DeviceAuthorizationResponse, IdentityModule, type ListContactsOptions, type ListContactsResult, type OAuthHelperOptions, type P2PActionDetail, type P2PActionRequestInput, type P2PActionRequestResult, type P2PActionRow, type P2PActionRun, type P2PCapability, type P2PConnection, type P2PHold, type P2PLedgerEntry, P2PModule, type P2PPolicy, type P2PPricingModel, type P2PSettlementBatch, type P2PSettlementGroup, type PublishCapabilityInput, type RequestOptions, type ServiceCatalogUrlEntry, TOPOLO_ACTOR_ENVELOPE_HEADER, TOPOLO_ENVIRONMENT_SERVICE_URLS, TOPOLO_RUNTIME_ENVIRONMENTS, TOPOLO_WIDGET_CONTRACT_VERSION, TOPOLO_WIDGET_ENDPOINT, TOPOLO_WIDGET_OUTPUT_SCHEMA, TOPOLO_WIDGET_REFRESH_INTERVAL_MS, type TokenResponse, type Topolo, type TopoloActionAgentContract, type TopoloActionCatalogEntry, type TopoloActionCatalogSummary, type TopoloActionDigestInput, type TopoloActionPlan, type TopoloActionPreparation, type TopoloActionUploadOptions, type TopoloActionValidationIssue, type TopoloActionValidationResult, type TopoloActionsWidget, type TopoloActivityWidget, type TopoloAgentExecutionContext, type TopoloApiKeyResourceMetadata, TopoloAuthError, type TopoloBinaryResponse, type TopoloBindableResource, type TopoloBindableResourceCatalog, type TopoloChartWidget, TopoloClient, type TopoloClientOptions, TopoloConfirmationRequiredError, type TopoloCredential, type TopoloDebugEvent, TopoloHttpError, type TopoloInlineBase64UploadContract, type TopoloJsonSchema, type TopoloNotificationsWidget, TopoloOAuth, TopoloPermissionError, type TopoloRuntimeEnvironment, TopoloSdkError, type TopoloServiceCatalogEntry, type TopoloStatsWidget, type TopoloWidget, type TopoloWidgetAccessibility, type TopoloWidgetActionBinding, type TopoloWidgetActionRecovery, type TopoloWidgetActivityItem, type TopoloWidgetApiError, type TopoloWidgetApiErrorResponse, type TopoloWidgetApiResponse, type TopoloWidgetApiSuccessResponse, type TopoloWidgetBase, type TopoloWidgetConfig, type TopoloWidgetConfiguration, type TopoloWidgetConfigurationField, type TopoloWidgetConfigurationOption, type TopoloWidgetContext, type TopoloWidgetContribution, type TopoloWidgetDatasetDefinition, type TopoloWidgetDimension, type TopoloWidgetDimensionDefinition, type TopoloWidgetDraft, type TopoloWidgetDrilldown, type TopoloWidgetErrorResponseOptions, type TopoloWidgetEventDefinition, type TopoloWidgetLifecycleStage, type TopoloWidgetLocalization, type TopoloWidgetMetric, type TopoloWidgetMetricAggregation, type TopoloWidgetMetricComparison, type TopoloWidgetMetricDefinition, type TopoloWidgetMetricSemantic, type TopoloWidgetNotificationItem, type TopoloWidgetPeriod, type TopoloWidgetPresentation, type TopoloWidgetRefreshPolicy, type TopoloWidgetResourceBinding, type TopoloWidgetResponseOptions, type TopoloWidgetSeries, type TopoloWidgetSeriesDefinition, type TopoloWidgetSeriesPoint, type TopoloWidgetSize, type TopoloWidgetState, type TopoloWidgetStatus, type TopoloWidgetType, type TopoloWidgetValidationResult, type TopoloWidgetVisualizationFamily, type TopoloWidgetWorkspaceSelector, type TopoloWorkspace, type TopoloWorkspaceListResult, type TopoloWorkspaceMutationResult, type TopoloWorkspacePolicy, WorkspacesModule, actionContractCompleteness, applicationEntryFromCatalog, assertTopoloServiceUrlEnvironment, canonicalJson, canonicalTopoloErrorCode, canonicalTopoloRequestId, canonicalTopoloRequired, canonicalTopoloRetryAfter, canonicalizeActorEnvelope, compactActionCatalogEntry, compactActionPlan, compactActionPreparation, compactActionResult, compactActionValidation, createTopolo, createTopoloAgentExecutionContext, createTopoloWidgetError, createTopoloWidgetResponse, decodeActorEnvelopeHeader, defineTopoloActionsWidget, defineTopoloActivityWidget, defineTopoloChartWidget, defineTopoloNotificationsWidget, defineTopoloStatsWidget, digestTopoloActionCatalog, encodeActorEnvelopeHeader, encodeTopoloActionBase64, enrichActionContract, extractTopoloServiceErrorCode, extractTopoloServiceErrorDetails, formatDirectoryApplicationIds, friendlyAppId, isTopoloWidgetOutputSchema, listApplicationDirectory, parseActorEnvelope, parseTopoloActionUploadContract, preferExactActionMatches, prepareTopoloActionBase64UploadInput, prepareTopoloActionUploadInput, projectActorAuditEvent, publicTopoloErrorMessage, resolveApplicationDirectoryEntry, resolveCatalogServiceUrl, resolveServiceUrl, sha256CanonicalValue, topoloErrorHint, topoloServiceOrigins, validateTopoloActionInput, validateTopoloWidgetResponse };

package/dist/index.js

@@ -1286,6 +1286,7 @@ var NEGATIVE_CACHE_TTL_MS = 60 * 1e3;
 var TopoloClient = class _TopoloClient {
   credential;
   agent;
+  actorContext;
   serviceUrls;
   environment;
   appIds;
@@ -1316,6 +1317,11 @@ var TopoloClient = class _TopoloClient {
     if (!options.agent?.clientName) throw new TopoloAuthError("agent.clientName is required");
     this.credential = options.credential;
     this.agent = options.agent;
+    this.actorContext = options.actorContext ? {
+      channel: options.actorContext.channel,
+      taskId: options.actorContext.taskId ?? `task_${generateRequestId()}`,
+      runId: options.actorContext.runId ?? `run_${generateRequestId()}`
+    } : void 0;
     this.environment = options.environment;
     this.serviceUrls = options.environment ? topoloServiceOrigins(options.serviceUrls, options.environment) : options.serviceUrls;
     this.appIds = options.appIds;
@@ -2031,8 +2037,9 @@ var TopoloClient = class _TopoloClient {
       );
     }
     const mapped = mapActionInput(entry, input);
-    if (options.actorEnvelope) {
-      const actorEnvelope = parseActorEnvelope(options.actorEnvelope);
+    const resolvedActorEnvelope = options.actorEnvelope ?? await this.buildVerifiedAgentActorEnvelope(entry.actionId, input, options.resource);
+    if (resolvedActorEnvelope) {
+      const actorEnvelope = parseActorEnvelope(resolvedActorEnvelope);
       if (actorEnvelope.action.actionId !== entry.actionId) {
         throw new TopoloSdkError("actor_envelope_action_mismatch", "Actor envelope actionId does not match the executed action.");
       }
@@ -2053,7 +2060,7 @@ var TopoloClient = class _TopoloClient {
       ...mapped.query ? { query: mapped.query } : {},
       ...mapped.body !== void 0 ? { body: mapped.body } : {},
       ...options.resource ? { resource: options.resource } : {},
-      ...options.actorEnvelope ? { actorEnvelope: options.actorEnvelope } : {},
+      ...resolvedActorEnvelope ? { actorEnvelope: resolvedActorEnvelope } : {},
       headers: {
         [TOPOLO_ACTION_ID_HEADER]: entry.actionId,
         [TOPOLO_ACTION_NAME_HEADER]: entry.name
@@ -2062,6 +2069,56 @@ var TopoloClient = class _TopoloClient {
     });
     return redactActionResult(result);
   }
+  async buildVerifiedAgentActorEnvelope(actionId, input, resource) {
+    if (!this.actorContext) return void 0;
+    const identity = await this.introspect();
+    const principalType = identity.user.principalType;
+    if (principalType !== "agent_employee" && principalType !== "external_agent") return void 0;
+    if (!identity.organization || !identity.user.accountableUserId || !identity.user.principalId) {
+      throw new TopoloSdkError(
+        "incomplete_agent_identity",
+        "Verified agent credentials must resolve an organization, accountable user, and principal id."
+      );
+    }
+    const performer = principalType === "external_agent" ? {
+      principalType: "external_agent",
+      principalId: identity.user.principalId,
+      installationId: identity.user.installationId ?? void 0,
+      provider: identity.user.provider ?? void 0,
+      model: identity.user.model ?? void 0
+    } : {
+      principalType: "managed_agent",
+      principalId: identity.user.principalId,
+      agentInstanceId: identity.user.agentInstanceId ?? void 0,
+      model: identity.user.model ?? void 0
+    };
+    if (performer.principalType === "external_agent" && (!performer.installationId || !performer.provider) || performer.principalType === "managed_agent" && !performer.agentInstanceId) {
+      throw new TopoloSdkError(
+        "incomplete_agent_identity",
+        "Verified agent credentials are missing the performer identity required for provenance."
+      );
+    }
+    return parseActorEnvelope({
+      schemaVersion: 1,
+      organizationId: identity.organization.id,
+      accountableSubject: { principalType: "human", principalId: identity.user.accountableUserId },
+      performer,
+      delegation: {
+        taskId: this.actorContext.taskId,
+        runId: this.actorContext.runId,
+        lineage: [{ principalType: performer.principalType, principalId: performer.principalId }]
+      },
+      channel: this.actorContext.channel,
+      assurance: { level: "workload_identity", methods: ["client_credentials"] },
+      action: {
+        requestId: generateRequestId(),
+        actionId,
+        ...resource ? resource : {},
+        inputHash: await sha256CanonicalValue(input)
+      },
+      issuedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  }
   /**
    * Introspect the current credential. Returns the caller's resolved identity,
    * organization, and permission set. Used by CLI `whoami` and by MCP to gate
@@ -2089,7 +2146,18 @@ var TopoloClient = class _TopoloClient {
         email: user.email,
         name: user.name ?? null,
         role: user.role ?? (kind === "api_key" ? "service" : "member"),
-        permissions: payload.permissions ?? user.permissions ?? []
+        permissions: payload.permissions ?? user.permissions ?? [],
+        ...normalizeAgentPrincipalType(user.principalType) ? {
+          principalId: readOptionalString(user.principalId),
+          principalType: normalizeAgentPrincipalType(user.principalType),
+          accountableUserId: readOptionalString(user.accountableUserId),
+          agentInstanceId: readOptionalString(user.agentInstanceId),
+          installationId: readOptionalString(user.installationId),
+          provider: readOptionalString(user.provider),
+          model: readOptionalString(user.model),
+          serviceScopes: stringArray(user.serviceScopes),
+          policyRef: readOptionalString(user.policyRef)
+        } : {}
       },
       organization: organization ? {
         id: organization.id,
@@ -2454,6 +2522,9 @@ function normalizeCredentialAuthorizationMode(value, kind) {
   if (value === "context_rbac" || value === "oauth_scopes" || value === "session_rbac") return value;
   return "unknown";
 }
+function normalizeAgentPrincipalType(value) {
+  return value === "agent_employee" || value === "external_agent" ? value : null;
+}
 function describeError(body, fallback) {
   if (body && typeof body === "object") {
     const maybe = body;
@@ -3178,6 +3249,43 @@ var IdentityModule = class {
   }
 };
 
+// src/actor-audit.ts
+var ACTOR_AUDIT_PROJECTION_VERSION = 1;
+var EVENT_ROLES = /* @__PURE__ */ new Set([
+  "requested_by",
+  "acting_on_behalf_of",
+  "approved_by",
+  "executed_by"
+]);
+function projectActorAuditEvent(value, role) {
+  if (!EVENT_ROLES.has(role)) throw new TypeError("Unsupported actor audit event role");
+  const envelope = parseActorEnvelope(value);
+  const subjectLabel = envelope.accountableSubject.displayName || envelope.accountableSubject.principalId;
+  const performerLabel = envelope.performer.displayName || envelope.performer.model || envelope.performer.provider || envelope.performer.principalId;
+  const direct = envelope.performer.principalType === envelope.accountableSubject.principalType && envelope.performer.principalId === envelope.accountableSubject.principalId;
+  return deepFreeze({
+    schemaVersion: ACTOR_AUDIT_PROJECTION_VERSION,
+    role,
+    label: direct ? subjectLabel : `${subjectLabel} via ${performerLabel}`,
+    organizationId: envelope.organizationId,
+    accountableSubject: envelope.accountableSubject,
+    performer: envelope.performer,
+    delegation: envelope.delegation,
+    channel: envelope.channel,
+    assurance: envelope.assurance,
+    action: envelope.action,
+    issuedAt: envelope.issuedAt,
+    ...envelope.expiresAt ? { expiresAt: envelope.expiresAt } : {}
+  });
+}
+function deepFreeze(value) {
+  if (value && typeof value === "object" && !Object.isFrozen(value)) {
+    Object.freeze(value);
+    for (const nested of Object.values(value)) deepFreeze(nested);
+  }
+  return value;
+}
+
 // src/modules/workspaces.ts
 var ACTIONS = {
   list: "app_topolo_auth.workspaces.list",
@@ -4668,6 +4776,7 @@ function createTopolo(options) {
 }
 export {
   ACTION_CATALOG_DIGEST_ALGORITHM,
+  ACTOR_AUDIT_PROJECTION_VERSION,
   ACTOR_ENVELOPE_VERSION,
   ActorEnvelopeValidationError,
   CrmModule,
@@ -4728,6 +4837,7 @@ export {
   preferExactActionMatches,
   prepareTopoloActionBase64UploadInput,
   prepareTopoloActionUploadInput,
+  projectActorAuditEvent,
   publicTopoloErrorMessage,
   resolveApplicationDirectoryEntry,
   resolveCatalogServiceUrl,

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@topolo/sdk",
   "packageManager": "pnpm@10.17.1",
-  "version": "0.16.0",
-  "topoloPublishedVersion": "0.16.0",
+  "version": "0.18.0",
+  "topoloPublishedVersion": "0.18.0",
   "description": "Typed client SDK for the Topolo platform. Used by TopoloCli, TopoloMCP, and third-party agents.",
   "license": "UNLICENSED",
   "author": "Topolo",