@topolo/sdk 0.17.1 → 0.19.0

package/README.md

@@ -160,6 +160,19 @@ input and resource before sending its canonical base64url representation in
 `X-Topolo-Actor-Envelope`; the envelope request ID also becomes the transport
 request ID.
 
+Use `projectActorAuditEvent` when persisting or rendering immutable audit
+events. The role remains explicit and the friendly label is derived without
+rewriting either identity:
+
+```ts
+const executedBy = projectActorAuditEvent(actorEnvelope, 'executed_by');
+// executedBy.label === 'Ashley Lane via codex'
+```
+
+The frozen projection retains the accountable subject, actual performer,
+delegation, channel, assurance, resource, request, action and canonical input
+hash for consistent application queries and exports.
+
 ## Modules
 
 | Surface      | Methods                               |

package/dist/index.cjs

@@ -21,6 +21,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var index_exports = {};
 __export(index_exports, {
   ACTION_CATALOG_DIGEST_ALGORITHM: () => ACTION_CATALOG_DIGEST_ALGORITHM,
+  ACTOR_AUDIT_PROJECTION_VERSION: () => ACTOR_AUDIT_PROJECTION_VERSION,
   ACTOR_ENVELOPE_VERSION: () => ACTOR_ENVELOPE_VERSION,
   ActorEnvelopeValidationError: () => ActorEnvelopeValidationError,
   CrmModule: () => CrmModule,
@@ -45,6 +46,7 @@ __export(index_exports, {
   actionContractCompleteness: () => actionContractCompleteness,
   applicationEntryFromCatalog: () => applicationEntryFromCatalog,
   assertTopoloServiceUrlEnvironment: () => assertTopoloServiceUrlEnvironment,
+  calculateDpopJkt: () => calculateDpopJkt,
   canonicalJson: () => canonicalJson,
   canonicalTopoloErrorCode: () => canonicalTopoloErrorCode,
   canonicalTopoloRequestId: () => canonicalTopoloRequestId,
@@ -56,6 +58,7 @@ __export(index_exports, {
   compactActionPreparation: () => compactActionPreparation,
   compactActionResult: () => compactActionResult,
   compactActionValidation: () => compactActionValidation,
+  createDpopProof: () => createDpopProof,
   createTopolo: () => createTopolo,
   createTopoloAgentExecutionContext: () => createTopoloAgentExecutionContext,
   createTopoloWidgetError: () => createTopoloWidgetError,
@@ -81,6 +84,7 @@ __export(index_exports, {
   preferExactActionMatches: () => preferExactActionMatches,
   prepareTopoloActionBase64UploadInput: () => prepareTopoloActionBase64UploadInput,
   prepareTopoloActionUploadInput: () => prepareTopoloActionUploadInput,
+  projectActorAuditEvent: () => projectActorAuditEvent,
   publicTopoloErrorMessage: () => publicTopoloErrorMessage,
   resolveApplicationDirectoryEntry: () => resolveApplicationDirectoryEntry,
   resolveCatalogServiceUrl: () => resolveCatalogServiceUrl,
@@ -99,7 +103,7 @@ function applyAuthHeaders(headers, credential) {
     headers.set("X-Api-Key", credential.apiKey);
     return;
   }
-  headers.set("Authorization", `Bearer ${credential.accessToken}`);
+  headers.set("Authorization", `${credential.kind === "dpop_access_token" ? "DPoP" : "Bearer"} ${credential.accessToken}`);
 }
 function applyAuditHeaders(headers, agent, requestId) {
   headers.set("X-Topolo-Client", `${agent.clientName}/${agent.clientVersion}`);
@@ -113,6 +117,60 @@ function generateRequestId() {
   return `req_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 10)}`;
 }
 
+// src/dpop.ts
+var encoder = new TextEncoder();
+function encodeBase64Url(value) {
+  const bytes = value instanceof Uint8Array ? value : new Uint8Array(value);
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function encodeJson(value) {
+  return encodeBase64Url(encoder.encode(JSON.stringify(value)));
+}
+async function sha256Base64Url(value) {
+  return encodeBase64Url(await crypto.subtle.digest("SHA-256", encoder.encode(value)));
+}
+function publicJwk(privateJwk) {
+  const { crv, kty, x, y } = privateJwk;
+  if (kty !== "EC" || crv !== "P-256" || !x || !y || !privateJwk.d) {
+    throw new TypeError("A private P-256 JSON Web Key is required for DPoP signing.");
+  }
+  return { crv, kty, x, y };
+}
+function canonicalTargetUrl(value) {
+  const url = new URL(value);
+  return `${url.origin}${url.pathname}`;
+}
+async function calculateDpopJkt(privateJwk) {
+  const jwk = publicJwk(privateJwk);
+  return sha256Base64Url(JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y }));
+}
+async function createDpopProof(input) {
+  const jwk = publicJwk(input.privateJwk);
+  const key = await crypto.subtle.importKey(
+    "jwk",
+    input.privateJwk,
+    { name: "ECDSA", namedCurve: "P-256" },
+    false,
+    ["sign"]
+  );
+  const header = encodeJson({ alg: "ES256", typ: "dpop+jwt", jwk });
+  const claims = encodeJson({
+    jti: crypto.randomUUID(),
+    iat: Math.floor(Date.now() / 1e3),
+    htm: input.method.toUpperCase(),
+    htu: canonicalTargetUrl(input.targetUrl),
+    ath: await sha256Base64Url(input.accessToken)
+  });
+  const signature = await crypto.subtle.sign(
+    { name: "ECDSA", hash: "SHA-256" },
+    key,
+    encoder.encode(`${header}.${claims}`)
+  );
+  return `${header}.${claims}.${encodeBase64Url(signature)}`;
+}
+
 // src/errors.ts
 var TopoloSdkError = class extends Error {
   code;
@@ -1469,7 +1527,6 @@ var TopoloClient = class _TopoloClient {
     if (opts.body !== void 0) headers.set("Content-Type", "application/json");
     const platformAppId = resolveConfiguredAppId(resolvedService.serviceKey, this.appIds);
     if (platformAppId) headers.set("X-App-ID", platformAppId);
-    applyAuthHeaders(headers, this.credential);
     const actorEnvelope = opts.actorEnvelope === void 0 ? void 0 : parseActorEnvelope(opts.actorEnvelope);
     const requestId = actorEnvelope?.action.requestId ?? generateRequestId();
     applyAuditHeaders(headers, this.agent, requestId);
@@ -1503,9 +1560,19 @@ var TopoloClient = class _TopoloClient {
       }, this.timeoutMs);
       const signal = opts.signal ? mergeSignals(opts.signal, controller.signal) : controller.signal;
       try {
+        const requestHeaders = new Headers(headers);
+        applyAuthHeaders(requestHeaders, this.credential);
+        if (this.credential.kind === "dpop_access_token") {
+          requestHeaders.set("DPoP", await createDpopProof({
+            accessToken: this.credential.accessToken,
+            method,
+            targetUrl: urlStr,
+            privateJwk: this.credential.privateJwk
+          }));
+        }
         return await this.fetchImpl(urlStr, {
           method,
-          headers: new Headers(headers),
+          headers: requestHeaders,
           body: opts.rawBody ?? (opts.body !== void 0 ? JSON.stringify(opts.body) : null),
           signal
         });
@@ -1542,7 +1609,6 @@ var TopoloClient = class _TopoloClient {
         await res.body?.cancel().catch(() => void 0);
         const refreshed = await this.refreshRejectedAccessToken(attemptedCredential.accessToken);
         if (refreshed) {
-          applyAuthHeaders(headers, refreshed);
           res = await fetchWithReadRetry();
         }
       }
@@ -3344,6 +3410,43 @@ var IdentityModule = class {
   }
 };
 
+// src/actor-audit.ts
+var ACTOR_AUDIT_PROJECTION_VERSION = 1;
+var EVENT_ROLES = /* @__PURE__ */ new Set([
+  "requested_by",
+  "acting_on_behalf_of",
+  "approved_by",
+  "executed_by"
+]);
+function projectActorAuditEvent(value, role) {
+  if (!EVENT_ROLES.has(role)) throw new TypeError("Unsupported actor audit event role");
+  const envelope = parseActorEnvelope(value);
+  const subjectLabel = envelope.accountableSubject.displayName || envelope.accountableSubject.principalId;
+  const performerLabel = envelope.performer.displayName || envelope.performer.model || envelope.performer.provider || envelope.performer.principalId;
+  const direct = envelope.performer.principalType === envelope.accountableSubject.principalType && envelope.performer.principalId === envelope.accountableSubject.principalId;
+  return deepFreeze({
+    schemaVersion: ACTOR_AUDIT_PROJECTION_VERSION,
+    role,
+    label: direct ? subjectLabel : `${subjectLabel} via ${performerLabel}`,
+    organizationId: envelope.organizationId,
+    accountableSubject: envelope.accountableSubject,
+    performer: envelope.performer,
+    delegation: envelope.delegation,
+    channel: envelope.channel,
+    assurance: envelope.assurance,
+    action: envelope.action,
+    issuedAt: envelope.issuedAt,
+    ...envelope.expiresAt ? { expiresAt: envelope.expiresAt } : {}
+  });
+}
+function deepFreeze(value) {
+  if (value && typeof value === "object" && !Object.isFrozen(value)) {
+    Object.freeze(value);
+    for (const nested of Object.values(value)) deepFreeze(nested);
+  }
+  return value;
+}
+
 // src/modules/workspaces.ts
 var ACTIONS = {
   list: "app_topolo_auth.workspaces.list",
@@ -4835,6 +4938,7 @@ function createTopolo(options) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ACTION_CATALOG_DIGEST_ALGORITHM,
+  ACTOR_AUDIT_PROJECTION_VERSION,
   ACTOR_ENVELOPE_VERSION,
   ActorEnvelopeValidationError,
   CrmModule,
@@ -4859,6 +4963,7 @@ function createTopolo(options) {
   actionContractCompleteness,
   applicationEntryFromCatalog,
   assertTopoloServiceUrlEnvironment,
+  calculateDpopJkt,
   canonicalJson,
   canonicalTopoloErrorCode,
   canonicalTopoloRequestId,
@@ -4870,6 +4975,7 @@ function createTopolo(options) {
   compactActionPreparation,
   compactActionResult,
   compactActionValidation,
+  createDpopProof,
   createTopolo,
   createTopoloAgentExecutionContext,
   createTopoloWidgetError,
@@ -4895,6 +5001,7 @@ function createTopolo(options) {
   preferExactActionMatches,
   prepareTopoloActionBase64UploadInput,
   prepareTopoloActionUploadInput,
+  projectActorAuditEvent,
   publicTopoloErrorMessage,
   resolveApplicationDirectoryEntry,
   resolveCatalogServiceUrl,

package/dist/index.d.cts

@@ -1,14 +1,13 @@
 /**
  * Auth credential types used by the SDK.
  *
- * Phase 1 supports two modes:
+ * Supported modes:
  *   - `api_key`: a single platform API key (service-scoped at issuance).
- *     Preferred for long-lived agent installs.
+ *     Used for service integrations that are not installation-bound.
  *   - `access_token`: a short-lived JWT from the interactive login flow.
  *     Used by TopoloCli after `topolo auth login`.
- *
- * Phase 2 will add OAuth access tokens issued by the authorization-code +
- * PKCE flow in TopoloAuth. Those will plug in as a third variant.
+ *   - `dpop_access_token`: a short-lived delegated token bound to an external
+ *     agent installation key. Every request proves possession of that key.
  */
 type TopoloCredential = {
     kind: 'api_key';
@@ -18,6 +17,11 @@ type TopoloCredential = {
     accessToken: string;
     refreshToken?: string;
     expiresAt?: number;
+} | {
+    kind: 'dpop_access_token';
+    accessToken: string;
+    privateJwk: JsonWebKey;
+    expiresAt?: number;
 };
 interface AgentIdentity {
     /** Display name of the agent or tool making requests. Included in audit headers. */
@@ -761,6 +765,14 @@ declare function actionContractCompleteness(
   action: ActionContractSource,
 ): Record<string, boolean>;
 
+declare function calculateDpopJkt(privateJwk: JsonWebKey): Promise<string>;
+declare function createDpopProof(input: {
+    accessToken: string;
+    method: string;
+    targetUrl: string;
+    privateJwk: JsonWebKey;
+}): Promise<string>;
+
 /**
  * Bootstrap seed URLs — the ONLY static service endpoints in the SDK.
  *
@@ -984,6 +996,24 @@ declare class IdentityModule {
     whoami(): Promise<CredentialIntrospection>;
 }
 
+declare const ACTOR_AUDIT_PROJECTION_VERSION: 1;
+type ActorAuditEventRole = 'requested_by' | 'acting_on_behalf_of' | 'approved_by' | 'executed_by';
+interface ActorAuditProjection {
+    readonly schemaVersion: typeof ACTOR_AUDIT_PROJECTION_VERSION;
+    readonly role: ActorAuditEventRole;
+    readonly label: string;
+    readonly organizationId: string;
+    readonly accountableSubject: Readonly<AccountableSubject>;
+    readonly performer: Readonly<ActorIdentity>;
+    readonly delegation: Readonly<NonNullable<ActorEnvelope['delegation']>> | null;
+    readonly channel: ActorEnvelope['channel'];
+    readonly assurance: Readonly<ActorEnvelope['assurance']>;
+    readonly action: Readonly<ActorEnvelope['action']>;
+    readonly issuedAt: string;
+    readonly expiresAt?: string;
+}
+declare function projectActorAuditEvent(value: unknown, role: ActorAuditEventRole): ActorAuditProjection;
+
 interface TopoloWorkspace {
     id: string;
     appId: string;
@@ -1676,4 +1706,4 @@ declare function createTopolo(options: TopoloClientOptions): {
 };
 type Topolo = ReturnType<typeof createTopolo>;
 
-export { ACTION_CATALOG_DIGEST_ALGORITHM, ACTOR_ENVELOPE_VERSION, type AccountableSubject, type AccountableSubjectType, type ActionContractManifest, type ActionContractSource, type ActorAssurance, type ActorChannel, type ActorDelegationHop, type ActorEnvelope, ActorEnvelopeValidationError, type ActorIdentity, type ActorPrincipalType, type AgentIdentity, type AppApiId, type ApplicationCatalogEntry, type ApplicationDeployTarget, type ApplicationDirectory, type ApplicationDirectoryApplication, type ApplicationDirectoryClient, type ApplicationDirectorySource, type ApplicationId, type CredentialIntrospection, type CrmContactSummary, CrmModule, DEFAULT_APP_URLS, type DeviceAuthorizationResponse, IdentityModule, type ListContactsOptions, type ListContactsResult, type OAuthHelperOptions, type P2PActionDetail, type P2PActionRequestInput, type P2PActionRequestResult, type P2PActionRow, type P2PActionRun, type P2PCapability, type P2PConnection, type P2PHold, type P2PLedgerEntry, P2PModule, type P2PPolicy, type P2PPricingModel, type P2PSettlementBatch, type P2PSettlementGroup, type PublishCapabilityInput, type RequestOptions, type ServiceCatalogUrlEntry, TOPOLO_ACTOR_ENVELOPE_HEADER, TOPOLO_ENVIRONMENT_SERVICE_URLS, TOPOLO_RUNTIME_ENVIRONMENTS, TOPOLO_WIDGET_CONTRACT_VERSION, TOPOLO_WIDGET_ENDPOINT, TOPOLO_WIDGET_OUTPUT_SCHEMA, TOPOLO_WIDGET_REFRESH_INTERVAL_MS, type TokenResponse, type Topolo, type TopoloActionAgentContract, type TopoloActionCatalogEntry, type TopoloActionCatalogSummary, type TopoloActionDigestInput, type TopoloActionPlan, type TopoloActionPreparation, type TopoloActionUploadOptions, type TopoloActionValidationIssue, type TopoloActionValidationResult, type TopoloActionsWidget, type TopoloActivityWidget, type TopoloAgentExecutionContext, type TopoloApiKeyResourceMetadata, TopoloAuthError, type TopoloBinaryResponse, type TopoloBindableResource, type TopoloBindableResourceCatalog, type TopoloChartWidget, TopoloClient, type TopoloClientOptions, TopoloConfirmationRequiredError, type TopoloCredential, type TopoloDebugEvent, TopoloHttpError, type TopoloInlineBase64UploadContract, type TopoloJsonSchema, type TopoloNotificationsWidget, TopoloOAuth, TopoloPermissionError, type TopoloRuntimeEnvironment, TopoloSdkError, type TopoloServiceCatalogEntry, type TopoloStatsWidget, type TopoloWidget, type TopoloWidgetAccessibility, type TopoloWidgetActionBinding, type TopoloWidgetActionRecovery, type TopoloWidgetActivityItem, type TopoloWidgetApiError, type TopoloWidgetApiErrorResponse, type TopoloWidgetApiResponse, type TopoloWidgetApiSuccessResponse, type TopoloWidgetBase, type TopoloWidgetConfig, type TopoloWidgetConfiguration, type TopoloWidgetConfigurationField, type TopoloWidgetConfigurationOption, type TopoloWidgetContext, type TopoloWidgetContribution, type TopoloWidgetDatasetDefinition, type TopoloWidgetDimension, type TopoloWidgetDimensionDefinition, type TopoloWidgetDraft, type TopoloWidgetDrilldown, type TopoloWidgetErrorResponseOptions, type TopoloWidgetEventDefinition, type TopoloWidgetLifecycleStage, type TopoloWidgetLocalization, type TopoloWidgetMetric, type TopoloWidgetMetricAggregation, type TopoloWidgetMetricComparison, type TopoloWidgetMetricDefinition, type TopoloWidgetMetricSemantic, type TopoloWidgetNotificationItem, type TopoloWidgetPeriod, type TopoloWidgetPresentation, type TopoloWidgetRefreshPolicy, type TopoloWidgetResourceBinding, type TopoloWidgetResponseOptions, type TopoloWidgetSeries, type TopoloWidgetSeriesDefinition, type TopoloWidgetSeriesPoint, type TopoloWidgetSize, type TopoloWidgetState, type TopoloWidgetStatus, type TopoloWidgetType, type TopoloWidgetValidationResult, type TopoloWidgetVisualizationFamily, type TopoloWidgetWorkspaceSelector, type TopoloWorkspace, type TopoloWorkspaceListResult, type TopoloWorkspaceMutationResult, type TopoloWorkspacePolicy, WorkspacesModule, actionContractCompleteness, applicationEntryFromCatalog, assertTopoloServiceUrlEnvironment, canonicalJson, canonicalTopoloErrorCode, canonicalTopoloRequestId, canonicalTopoloRequired, canonicalTopoloRetryAfter, canonicalizeActorEnvelope, compactActionCatalogEntry, compactActionPlan, compactActionPreparation, compactActionResult, compactActionValidation, createTopolo, createTopoloAgentExecutionContext, createTopoloWidgetError, createTopoloWidgetResponse, decodeActorEnvelopeHeader, defineTopoloActionsWidget, defineTopoloActivityWidget, defineTopoloChartWidget, defineTopoloNotificationsWidget, defineTopoloStatsWidget, digestTopoloActionCatalog, encodeActorEnvelopeHeader, encodeTopoloActionBase64, enrichActionContract, extractTopoloServiceErrorCode, extractTopoloServiceErrorDetails, formatDirectoryApplicationIds, friendlyAppId, isTopoloWidgetOutputSchema, listApplicationDirectory, parseActorEnvelope, parseTopoloActionUploadContract, preferExactActionMatches, prepareTopoloActionBase64UploadInput, prepareTopoloActionUploadInput, publicTopoloErrorMessage, resolveApplicationDirectoryEntry, resolveCatalogServiceUrl, resolveServiceUrl, sha256CanonicalValue, topoloErrorHint, topoloServiceOrigins, validateTopoloActionInput, validateTopoloWidgetResponse };
+export { ACTION_CATALOG_DIGEST_ALGORITHM, ACTOR_AUDIT_PROJECTION_VERSION, ACTOR_ENVELOPE_VERSION, type AccountableSubject, type AccountableSubjectType, type ActionContractManifest, type ActionContractSource, type ActorAssurance, type ActorAuditEventRole, type ActorAuditProjection, type ActorChannel, type ActorDelegationHop, type ActorEnvelope, ActorEnvelopeValidationError, type ActorIdentity, type ActorPrincipalType, type AgentIdentity, type AppApiId, type ApplicationCatalogEntry, type ApplicationDeployTarget, type ApplicationDirectory, type ApplicationDirectoryApplication, type ApplicationDirectoryClient, type ApplicationDirectorySource, type ApplicationId, type CredentialIntrospection, type CrmContactSummary, CrmModule, DEFAULT_APP_URLS, type DeviceAuthorizationResponse, IdentityModule, type ListContactsOptions, type ListContactsResult, type OAuthHelperOptions, type P2PActionDetail, type P2PActionRequestInput, type P2PActionRequestResult, type P2PActionRow, type P2PActionRun, type P2PCapability, type P2PConnection, type P2PHold, type P2PLedgerEntry, P2PModule, type P2PPolicy, type P2PPricingModel, type P2PSettlementBatch, type P2PSettlementGroup, type PublishCapabilityInput, type RequestOptions, type ServiceCatalogUrlEntry, TOPOLO_ACTOR_ENVELOPE_HEADER, TOPOLO_ENVIRONMENT_SERVICE_URLS, TOPOLO_RUNTIME_ENVIRONMENTS, TOPOLO_WIDGET_CONTRACT_VERSION, TOPOLO_WIDGET_ENDPOINT, TOPOLO_WIDGET_OUTPUT_SCHEMA, TOPOLO_WIDGET_REFRESH_INTERVAL_MS, type TokenResponse, type Topolo, type TopoloActionAgentContract, type TopoloActionCatalogEntry, type TopoloActionCatalogSummary, type TopoloActionDigestInput, type TopoloActionPlan, type TopoloActionPreparation, type TopoloActionUploadOptions, type TopoloActionValidationIssue, type TopoloActionValidationResult, type TopoloActionsWidget, type TopoloActivityWidget, type TopoloAgentExecutionContext, type TopoloApiKeyResourceMetadata, TopoloAuthError, type TopoloBinaryResponse, type TopoloBindableResource, type TopoloBindableResourceCatalog, type TopoloChartWidget, TopoloClient, type TopoloClientOptions, TopoloConfirmationRequiredError, type TopoloCredential, type TopoloDebugEvent, TopoloHttpError, type TopoloInlineBase64UploadContract, type TopoloJsonSchema, type TopoloNotificationsWidget, TopoloOAuth, TopoloPermissionError, type TopoloRuntimeEnvironment, TopoloSdkError, type TopoloServiceCatalogEntry, type TopoloStatsWidget, type TopoloWidget, type TopoloWidgetAccessibility, type TopoloWidgetActionBinding, type TopoloWidgetActionRecovery, type TopoloWidgetActivityItem, type TopoloWidgetApiError, type TopoloWidgetApiErrorResponse, type TopoloWidgetApiResponse, type TopoloWidgetApiSuccessResponse, type TopoloWidgetBase, type TopoloWidgetConfig, type TopoloWidgetConfiguration, type TopoloWidgetConfigurationField, type TopoloWidgetConfigurationOption, type TopoloWidgetContext, type TopoloWidgetContribution, type TopoloWidgetDatasetDefinition, type TopoloWidgetDimension, type TopoloWidgetDimensionDefinition, type TopoloWidgetDraft, type TopoloWidgetDrilldown, type TopoloWidgetErrorResponseOptions, type TopoloWidgetEventDefinition, type TopoloWidgetLifecycleStage, type TopoloWidgetLocalization, type TopoloWidgetMetric, type TopoloWidgetMetricAggregation, type TopoloWidgetMetricComparison, type TopoloWidgetMetricDefinition, type TopoloWidgetMetricSemantic, type TopoloWidgetNotificationItem, type TopoloWidgetPeriod, type TopoloWidgetPresentation, type TopoloWidgetRefreshPolicy, type TopoloWidgetResourceBinding, type TopoloWidgetResponseOptions, type TopoloWidgetSeries, type TopoloWidgetSeriesDefinition, type TopoloWidgetSeriesPoint, type TopoloWidgetSize, type TopoloWidgetState, type TopoloWidgetStatus, type TopoloWidgetType, type TopoloWidgetValidationResult, type TopoloWidgetVisualizationFamily, type TopoloWidgetWorkspaceSelector, type TopoloWorkspace, type TopoloWorkspaceListResult, type TopoloWorkspaceMutationResult, type TopoloWorkspacePolicy, WorkspacesModule, actionContractCompleteness, applicationEntryFromCatalog, assertTopoloServiceUrlEnvironment, calculateDpopJkt, canonicalJson, canonicalTopoloErrorCode, canonicalTopoloRequestId, canonicalTopoloRequired, canonicalTopoloRetryAfter, canonicalizeActorEnvelope, compactActionCatalogEntry, compactActionPlan, compactActionPreparation, compactActionResult, compactActionValidation, createDpopProof, createTopolo, createTopoloAgentExecutionContext, createTopoloWidgetError, createTopoloWidgetResponse, decodeActorEnvelopeHeader, defineTopoloActionsWidget, defineTopoloActivityWidget, defineTopoloChartWidget, defineTopoloNotificationsWidget, defineTopoloStatsWidget, digestTopoloActionCatalog, encodeActorEnvelopeHeader, encodeTopoloActionBase64, enrichActionContract, extractTopoloServiceErrorCode, extractTopoloServiceErrorDetails, formatDirectoryApplicationIds, friendlyAppId, isTopoloWidgetOutputSchema, listApplicationDirectory, parseActorEnvelope, parseTopoloActionUploadContract, preferExactActionMatches, prepareTopoloActionBase64UploadInput, prepareTopoloActionUploadInput, projectActorAuditEvent, publicTopoloErrorMessage, resolveApplicationDirectoryEntry, resolveCatalogServiceUrl, resolveServiceUrl, sha256CanonicalValue, topoloErrorHint, topoloServiceOrigins, validateTopoloActionInput, validateTopoloWidgetResponse };

package/dist/index.d.ts

@@ -1,14 +1,13 @@
 /**
  * Auth credential types used by the SDK.
  *
- * Phase 1 supports two modes:
+ * Supported modes:
  *   - `api_key`: a single platform API key (service-scoped at issuance).
- *     Preferred for long-lived agent installs.
+ *     Used for service integrations that are not installation-bound.
  *   - `access_token`: a short-lived JWT from the interactive login flow.
  *     Used by TopoloCli after `topolo auth login`.
- *
- * Phase 2 will add OAuth access tokens issued by the authorization-code +
- * PKCE flow in TopoloAuth. Those will plug in as a third variant.
+ *   - `dpop_access_token`: a short-lived delegated token bound to an external
+ *     agent installation key. Every request proves possession of that key.
  */
 type TopoloCredential = {
     kind: 'api_key';
@@ -18,6 +17,11 @@ type TopoloCredential = {
     accessToken: string;
     refreshToken?: string;
     expiresAt?: number;
+} | {
+    kind: 'dpop_access_token';
+    accessToken: string;
+    privateJwk: JsonWebKey;
+    expiresAt?: number;
 };
 interface AgentIdentity {
     /** Display name of the agent or tool making requests. Included in audit headers. */
@@ -761,6 +765,14 @@ declare function actionContractCompleteness(
   action: ActionContractSource,
 ): Record<string, boolean>;
 
+declare function calculateDpopJkt(privateJwk: JsonWebKey): Promise<string>;
+declare function createDpopProof(input: {
+    accessToken: string;
+    method: string;
+    targetUrl: string;
+    privateJwk: JsonWebKey;
+}): Promise<string>;
+
 /**
  * Bootstrap seed URLs — the ONLY static service endpoints in the SDK.
  *
@@ -984,6 +996,24 @@ declare class IdentityModule {
     whoami(): Promise<CredentialIntrospection>;
 }
 
+declare const ACTOR_AUDIT_PROJECTION_VERSION: 1;
+type ActorAuditEventRole = 'requested_by' | 'acting_on_behalf_of' | 'approved_by' | 'executed_by';
+interface ActorAuditProjection {
+    readonly schemaVersion: typeof ACTOR_AUDIT_PROJECTION_VERSION;
+    readonly role: ActorAuditEventRole;
+    readonly label: string;
+    readonly organizationId: string;
+    readonly accountableSubject: Readonly<AccountableSubject>;
+    readonly performer: Readonly<ActorIdentity>;
+    readonly delegation: Readonly<NonNullable<ActorEnvelope['delegation']>> | null;
+    readonly channel: ActorEnvelope['channel'];
+    readonly assurance: Readonly<ActorEnvelope['assurance']>;
+    readonly action: Readonly<ActorEnvelope['action']>;
+    readonly issuedAt: string;
+    readonly expiresAt?: string;
+}
+declare function projectActorAuditEvent(value: unknown, role: ActorAuditEventRole): ActorAuditProjection;
+
 interface TopoloWorkspace {
     id: string;
     appId: string;
@@ -1676,4 +1706,4 @@ declare function createTopolo(options: TopoloClientOptions): {
 };
 type Topolo = ReturnType<typeof createTopolo>;
 
-export { ACTION_CATALOG_DIGEST_ALGORITHM, ACTOR_ENVELOPE_VERSION, type AccountableSubject, type AccountableSubjectType, type ActionContractManifest, type ActionContractSource, type ActorAssurance, type ActorChannel, type ActorDelegationHop, type ActorEnvelope, ActorEnvelopeValidationError, type ActorIdentity, type ActorPrincipalType, type AgentIdentity, type AppApiId, type ApplicationCatalogEntry, type ApplicationDeployTarget, type ApplicationDirectory, type ApplicationDirectoryApplication, type ApplicationDirectoryClient, type ApplicationDirectorySource, type ApplicationId, type CredentialIntrospection, type CrmContactSummary, CrmModule, DEFAULT_APP_URLS, type DeviceAuthorizationResponse, IdentityModule, type ListContactsOptions, type ListContactsResult, type OAuthHelperOptions, type P2PActionDetail, type P2PActionRequestInput, type P2PActionRequestResult, type P2PActionRow, type P2PActionRun, type P2PCapability, type P2PConnection, type P2PHold, type P2PLedgerEntry, P2PModule, type P2PPolicy, type P2PPricingModel, type P2PSettlementBatch, type P2PSettlementGroup, type PublishCapabilityInput, type RequestOptions, type ServiceCatalogUrlEntry, TOPOLO_ACTOR_ENVELOPE_HEADER, TOPOLO_ENVIRONMENT_SERVICE_URLS, TOPOLO_RUNTIME_ENVIRONMENTS, TOPOLO_WIDGET_CONTRACT_VERSION, TOPOLO_WIDGET_ENDPOINT, TOPOLO_WIDGET_OUTPUT_SCHEMA, TOPOLO_WIDGET_REFRESH_INTERVAL_MS, type TokenResponse, type Topolo, type TopoloActionAgentContract, type TopoloActionCatalogEntry, type TopoloActionCatalogSummary, type TopoloActionDigestInput, type TopoloActionPlan, type TopoloActionPreparation, type TopoloActionUploadOptions, type TopoloActionValidationIssue, type TopoloActionValidationResult, type TopoloActionsWidget, type TopoloActivityWidget, type TopoloAgentExecutionContext, type TopoloApiKeyResourceMetadata, TopoloAuthError, type TopoloBinaryResponse, type TopoloBindableResource, type TopoloBindableResourceCatalog, type TopoloChartWidget, TopoloClient, type TopoloClientOptions, TopoloConfirmationRequiredError, type TopoloCredential, type TopoloDebugEvent, TopoloHttpError, type TopoloInlineBase64UploadContract, type TopoloJsonSchema, type TopoloNotificationsWidget, TopoloOAuth, TopoloPermissionError, type TopoloRuntimeEnvironment, TopoloSdkError, type TopoloServiceCatalogEntry, type TopoloStatsWidget, type TopoloWidget, type TopoloWidgetAccessibility, type TopoloWidgetActionBinding, type TopoloWidgetActionRecovery, type TopoloWidgetActivityItem, type TopoloWidgetApiError, type TopoloWidgetApiErrorResponse, type TopoloWidgetApiResponse, type TopoloWidgetApiSuccessResponse, type TopoloWidgetBase, type TopoloWidgetConfig, type TopoloWidgetConfiguration, type TopoloWidgetConfigurationField, type TopoloWidgetConfigurationOption, type TopoloWidgetContext, type TopoloWidgetContribution, type TopoloWidgetDatasetDefinition, type TopoloWidgetDimension, type TopoloWidgetDimensionDefinition, type TopoloWidgetDraft, type TopoloWidgetDrilldown, type TopoloWidgetErrorResponseOptions, type TopoloWidgetEventDefinition, type TopoloWidgetLifecycleStage, type TopoloWidgetLocalization, type TopoloWidgetMetric, type TopoloWidgetMetricAggregation, type TopoloWidgetMetricComparison, type TopoloWidgetMetricDefinition, type TopoloWidgetMetricSemantic, type TopoloWidgetNotificationItem, type TopoloWidgetPeriod, type TopoloWidgetPresentation, type TopoloWidgetRefreshPolicy, type TopoloWidgetResourceBinding, type TopoloWidgetResponseOptions, type TopoloWidgetSeries, type TopoloWidgetSeriesDefinition, type TopoloWidgetSeriesPoint, type TopoloWidgetSize, type TopoloWidgetState, type TopoloWidgetStatus, type TopoloWidgetType, type TopoloWidgetValidationResult, type TopoloWidgetVisualizationFamily, type TopoloWidgetWorkspaceSelector, type TopoloWorkspace, type TopoloWorkspaceListResult, type TopoloWorkspaceMutationResult, type TopoloWorkspacePolicy, WorkspacesModule, actionContractCompleteness, applicationEntryFromCatalog, assertTopoloServiceUrlEnvironment, canonicalJson, canonicalTopoloErrorCode, canonicalTopoloRequestId, canonicalTopoloRequired, canonicalTopoloRetryAfter, canonicalizeActorEnvelope, compactActionCatalogEntry, compactActionPlan, compactActionPreparation, compactActionResult, compactActionValidation, createTopolo, createTopoloAgentExecutionContext, createTopoloWidgetError, createTopoloWidgetResponse, decodeActorEnvelopeHeader, defineTopoloActionsWidget, defineTopoloActivityWidget, defineTopoloChartWidget, defineTopoloNotificationsWidget, defineTopoloStatsWidget, digestTopoloActionCatalog, encodeActorEnvelopeHeader, encodeTopoloActionBase64, enrichActionContract, extractTopoloServiceErrorCode, extractTopoloServiceErrorDetails, formatDirectoryApplicationIds, friendlyAppId, isTopoloWidgetOutputSchema, listApplicationDirectory, parseActorEnvelope, parseTopoloActionUploadContract, preferExactActionMatches, prepareTopoloActionBase64UploadInput, prepareTopoloActionUploadInput, publicTopoloErrorMessage, resolveApplicationDirectoryEntry, resolveCatalogServiceUrl, resolveServiceUrl, sha256CanonicalValue, topoloErrorHint, topoloServiceOrigins, validateTopoloActionInput, validateTopoloWidgetResponse };
+export { ACTION_CATALOG_DIGEST_ALGORITHM, ACTOR_AUDIT_PROJECTION_VERSION, ACTOR_ENVELOPE_VERSION, type AccountableSubject, type AccountableSubjectType, type ActionContractManifest, type ActionContractSource, type ActorAssurance, type ActorAuditEventRole, type ActorAuditProjection, type ActorChannel, type ActorDelegationHop, type ActorEnvelope, ActorEnvelopeValidationError, type ActorIdentity, type ActorPrincipalType, type AgentIdentity, type AppApiId, type ApplicationCatalogEntry, type ApplicationDeployTarget, type ApplicationDirectory, type ApplicationDirectoryApplication, type ApplicationDirectoryClient, type ApplicationDirectorySource, type ApplicationId, type CredentialIntrospection, type CrmContactSummary, CrmModule, DEFAULT_APP_URLS, type DeviceAuthorizationResponse, IdentityModule, type ListContactsOptions, type ListContactsResult, type OAuthHelperOptions, type P2PActionDetail, type P2PActionRequestInput, type P2PActionRequestResult, type P2PActionRow, type P2PActionRun, type P2PCapability, type P2PConnection, type P2PHold, type P2PLedgerEntry, P2PModule, type P2PPolicy, type P2PPricingModel, type P2PSettlementBatch, type P2PSettlementGroup, type PublishCapabilityInput, type RequestOptions, type ServiceCatalogUrlEntry, TOPOLO_ACTOR_ENVELOPE_HEADER, TOPOLO_ENVIRONMENT_SERVICE_URLS, TOPOLO_RUNTIME_ENVIRONMENTS, TOPOLO_WIDGET_CONTRACT_VERSION, TOPOLO_WIDGET_ENDPOINT, TOPOLO_WIDGET_OUTPUT_SCHEMA, TOPOLO_WIDGET_REFRESH_INTERVAL_MS, type TokenResponse, type Topolo, type TopoloActionAgentContract, type TopoloActionCatalogEntry, type TopoloActionCatalogSummary, type TopoloActionDigestInput, type TopoloActionPlan, type TopoloActionPreparation, type TopoloActionUploadOptions, type TopoloActionValidationIssue, type TopoloActionValidationResult, type TopoloActionsWidget, type TopoloActivityWidget, type TopoloAgentExecutionContext, type TopoloApiKeyResourceMetadata, TopoloAuthError, type TopoloBinaryResponse, type TopoloBindableResource, type TopoloBindableResourceCatalog, type TopoloChartWidget, TopoloClient, type TopoloClientOptions, TopoloConfirmationRequiredError, type TopoloCredential, type TopoloDebugEvent, TopoloHttpError, type TopoloInlineBase64UploadContract, type TopoloJsonSchema, type TopoloNotificationsWidget, TopoloOAuth, TopoloPermissionError, type TopoloRuntimeEnvironment, TopoloSdkError, type TopoloServiceCatalogEntry, type TopoloStatsWidget, type TopoloWidget, type TopoloWidgetAccessibility, type TopoloWidgetActionBinding, type TopoloWidgetActionRecovery, type TopoloWidgetActivityItem, type TopoloWidgetApiError, type TopoloWidgetApiErrorResponse, type TopoloWidgetApiResponse, type TopoloWidgetApiSuccessResponse, type TopoloWidgetBase, type TopoloWidgetConfig, type TopoloWidgetConfiguration, type TopoloWidgetConfigurationField, type TopoloWidgetConfigurationOption, type TopoloWidgetContext, type TopoloWidgetContribution, type TopoloWidgetDatasetDefinition, type TopoloWidgetDimension, type TopoloWidgetDimensionDefinition, type TopoloWidgetDraft, type TopoloWidgetDrilldown, type TopoloWidgetErrorResponseOptions, type TopoloWidgetEventDefinition, type TopoloWidgetLifecycleStage, type TopoloWidgetLocalization, type TopoloWidgetMetric, type TopoloWidgetMetricAggregation, type TopoloWidgetMetricComparison, type TopoloWidgetMetricDefinition, type TopoloWidgetMetricSemantic, type TopoloWidgetNotificationItem, type TopoloWidgetPeriod, type TopoloWidgetPresentation, type TopoloWidgetRefreshPolicy, type TopoloWidgetResourceBinding, type TopoloWidgetResponseOptions, type TopoloWidgetSeries, type TopoloWidgetSeriesDefinition, type TopoloWidgetSeriesPoint, type TopoloWidgetSize, type TopoloWidgetState, type TopoloWidgetStatus, type TopoloWidgetType, type TopoloWidgetValidationResult, type TopoloWidgetVisualizationFamily, type TopoloWidgetWorkspaceSelector, type TopoloWorkspace, type TopoloWorkspaceListResult, type TopoloWorkspaceMutationResult, type TopoloWorkspacePolicy, WorkspacesModule, actionContractCompleteness, applicationEntryFromCatalog, assertTopoloServiceUrlEnvironment, calculateDpopJkt, canonicalJson, canonicalTopoloErrorCode, canonicalTopoloRequestId, canonicalTopoloRequired, canonicalTopoloRetryAfter, canonicalizeActorEnvelope, compactActionCatalogEntry, compactActionPlan, compactActionPreparation, compactActionResult, compactActionValidation, createDpopProof, createTopolo, createTopoloAgentExecutionContext, createTopoloWidgetError, createTopoloWidgetResponse, decodeActorEnvelopeHeader, defineTopoloActionsWidget, defineTopoloActivityWidget, defineTopoloChartWidget, defineTopoloNotificationsWidget, defineTopoloStatsWidget, digestTopoloActionCatalog, encodeActorEnvelopeHeader, encodeTopoloActionBase64, enrichActionContract, extractTopoloServiceErrorCode, extractTopoloServiceErrorDetails, formatDirectoryApplicationIds, friendlyAppId, isTopoloWidgetOutputSchema, listApplicationDirectory, parseActorEnvelope, parseTopoloActionUploadContract, preferExactActionMatches, prepareTopoloActionBase64UploadInput, prepareTopoloActionUploadInput, projectActorAuditEvent, publicTopoloErrorMessage, resolveApplicationDirectoryEntry, resolveCatalogServiceUrl, resolveServiceUrl, sha256CanonicalValue, topoloErrorHint, topoloServiceOrigins, validateTopoloActionInput, validateTopoloWidgetResponse };

package/dist/index.js

@@ -4,7 +4,7 @@ function applyAuthHeaders(headers, credential) {
     headers.set("X-Api-Key", credential.apiKey);
     return;
   }
-  headers.set("Authorization", `Bearer ${credential.accessToken}`);
+  headers.set("Authorization", `${credential.kind === "dpop_access_token" ? "DPoP" : "Bearer"} ${credential.accessToken}`);
 }
 function applyAuditHeaders(headers, agent, requestId) {
   headers.set("X-Topolo-Client", `${agent.clientName}/${agent.clientVersion}`);
@@ -18,6 +18,60 @@ function generateRequestId() {
   return `req_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 10)}`;
 }
 
+// src/dpop.ts
+var encoder = new TextEncoder();
+function encodeBase64Url(value) {
+  const bytes = value instanceof Uint8Array ? value : new Uint8Array(value);
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function encodeJson(value) {
+  return encodeBase64Url(encoder.encode(JSON.stringify(value)));
+}
+async function sha256Base64Url(value) {
+  return encodeBase64Url(await crypto.subtle.digest("SHA-256", encoder.encode(value)));
+}
+function publicJwk(privateJwk) {
+  const { crv, kty, x, y } = privateJwk;
+  if (kty !== "EC" || crv !== "P-256" || !x || !y || !privateJwk.d) {
+    throw new TypeError("A private P-256 JSON Web Key is required for DPoP signing.");
+  }
+  return { crv, kty, x, y };
+}
+function canonicalTargetUrl(value) {
+  const url = new URL(value);
+  return `${url.origin}${url.pathname}`;
+}
+async function calculateDpopJkt(privateJwk) {
+  const jwk = publicJwk(privateJwk);
+  return sha256Base64Url(JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y }));
+}
+async function createDpopProof(input) {
+  const jwk = publicJwk(input.privateJwk);
+  const key = await crypto.subtle.importKey(
+    "jwk",
+    input.privateJwk,
+    { name: "ECDSA", namedCurve: "P-256" },
+    false,
+    ["sign"]
+  );
+  const header = encodeJson({ alg: "ES256", typ: "dpop+jwt", jwk });
+  const claims = encodeJson({
+    jti: crypto.randomUUID(),
+    iat: Math.floor(Date.now() / 1e3),
+    htm: input.method.toUpperCase(),
+    htu: canonicalTargetUrl(input.targetUrl),
+    ath: await sha256Base64Url(input.accessToken)
+  });
+  const signature = await crypto.subtle.sign(
+    { name: "ECDSA", hash: "SHA-256" },
+    key,
+    encoder.encode(`${header}.${claims}`)
+  );
+  return `${header}.${claims}.${encodeBase64Url(signature)}`;
+}
+
 // src/errors.ts
 var TopoloSdkError = class extends Error {
   code;
@@ -1374,7 +1428,6 @@ var TopoloClient = class _TopoloClient {
     if (opts.body !== void 0) headers.set("Content-Type", "application/json");
     const platformAppId = resolveConfiguredAppId(resolvedService.serviceKey, this.appIds);
     if (platformAppId) headers.set("X-App-ID", platformAppId);
-    applyAuthHeaders(headers, this.credential);
     const actorEnvelope = opts.actorEnvelope === void 0 ? void 0 : parseActorEnvelope(opts.actorEnvelope);
     const requestId = actorEnvelope?.action.requestId ?? generateRequestId();
     applyAuditHeaders(headers, this.agent, requestId);
@@ -1408,9 +1461,19 @@ var TopoloClient = class _TopoloClient {
       }, this.timeoutMs);
       const signal = opts.signal ? mergeSignals(opts.signal, controller.signal) : controller.signal;
       try {
+        const requestHeaders = new Headers(headers);
+        applyAuthHeaders(requestHeaders, this.credential);
+        if (this.credential.kind === "dpop_access_token") {
+          requestHeaders.set("DPoP", await createDpopProof({
+            accessToken: this.credential.accessToken,
+            method,
+            targetUrl: urlStr,
+            privateJwk: this.credential.privateJwk
+          }));
+        }
         return await this.fetchImpl(urlStr, {
           method,
-          headers: new Headers(headers),
+          headers: requestHeaders,
           body: opts.rawBody ?? (opts.body !== void 0 ? JSON.stringify(opts.body) : null),
           signal
         });
@@ -1447,7 +1510,6 @@ var TopoloClient = class _TopoloClient {
         await res.body?.cancel().catch(() => void 0);
         const refreshed = await this.refreshRejectedAccessToken(attemptedCredential.accessToken);
         if (refreshed) {
-          applyAuthHeaders(headers, refreshed);
           res = await fetchWithReadRetry();
         }
       }
@@ -3249,6 +3311,43 @@ var IdentityModule = class {
   }
 };
 
+// src/actor-audit.ts
+var ACTOR_AUDIT_PROJECTION_VERSION = 1;
+var EVENT_ROLES = /* @__PURE__ */ new Set([
+  "requested_by",
+  "acting_on_behalf_of",
+  "approved_by",
+  "executed_by"
+]);
+function projectActorAuditEvent(value, role) {
+  if (!EVENT_ROLES.has(role)) throw new TypeError("Unsupported actor audit event role");
+  const envelope = parseActorEnvelope(value);
+  const subjectLabel = envelope.accountableSubject.displayName || envelope.accountableSubject.principalId;
+  const performerLabel = envelope.performer.displayName || envelope.performer.model || envelope.performer.provider || envelope.performer.principalId;
+  const direct = envelope.performer.principalType === envelope.accountableSubject.principalType && envelope.performer.principalId === envelope.accountableSubject.principalId;
+  return deepFreeze({
+    schemaVersion: ACTOR_AUDIT_PROJECTION_VERSION,
+    role,
+    label: direct ? subjectLabel : `${subjectLabel} via ${performerLabel}`,
+    organizationId: envelope.organizationId,
+    accountableSubject: envelope.accountableSubject,
+    performer: envelope.performer,
+    delegation: envelope.delegation,
+    channel: envelope.channel,
+    assurance: envelope.assurance,
+    action: envelope.action,
+    issuedAt: envelope.issuedAt,
+    ...envelope.expiresAt ? { expiresAt: envelope.expiresAt } : {}
+  });
+}
+function deepFreeze(value) {
+  if (value && typeof value === "object" && !Object.isFrozen(value)) {
+    Object.freeze(value);
+    for (const nested of Object.values(value)) deepFreeze(nested);
+  }
+  return value;
+}
+
 // src/modules/workspaces.ts
 var ACTIONS = {
   list: "app_topolo_auth.workspaces.list",
@@ -4739,6 +4838,7 @@ function createTopolo(options) {
 }
 export {
   ACTION_CATALOG_DIGEST_ALGORITHM,
+  ACTOR_AUDIT_PROJECTION_VERSION,
   ACTOR_ENVELOPE_VERSION,
   ActorEnvelopeValidationError,
   CrmModule,
@@ -4763,6 +4863,7 @@ export {
   actionContractCompleteness,
   applicationEntryFromCatalog,
   assertTopoloServiceUrlEnvironment,
+  calculateDpopJkt,
   canonicalJson,
   canonicalTopoloErrorCode,
   canonicalTopoloRequestId,
@@ -4774,6 +4875,7 @@ export {
   compactActionPreparation,
   compactActionResult,
   compactActionValidation,
+  createDpopProof,
   createTopolo,
   createTopoloAgentExecutionContext,
   createTopoloWidgetError,
@@ -4799,6 +4901,7 @@ export {
   preferExactActionMatches,
   prepareTopoloActionBase64UploadInput,
   prepareTopoloActionUploadInput,
+  projectActorAuditEvent,
   publicTopoloErrorMessage,
   resolveApplicationDirectoryEntry,
   resolveCatalogServiceUrl,

package/dist/node/credential-store.d.cts

@@ -1,14 +1,13 @@
 /**
  * Auth credential types used by the SDK.
  *
- * Phase 1 supports two modes:
+ * Supported modes:
  *   - `api_key`: a single platform API key (service-scoped at issuance).
- *     Preferred for long-lived agent installs.
+ *     Used for service integrations that are not installation-bound.
  *   - `access_token`: a short-lived JWT from the interactive login flow.
  *     Used by TopoloCli after `topolo auth login`.
- *
- * Phase 2 will add OAuth access tokens issued by the authorization-code +
- * PKCE flow in TopoloAuth. Those will plug in as a third variant.
+ *   - `dpop_access_token`: a short-lived delegated token bound to an external
+ *     agent installation key. Every request proves possession of that key.
  */
 type TopoloCredential = {
     kind: 'api_key';
@@ -18,6 +17,11 @@ type TopoloCredential = {
     accessToken: string;
     refreshToken?: string;
     expiresAt?: number;
+} | {
+    kind: 'dpop_access_token';
+    accessToken: string;
+    privateJwk: JsonWebKey;
+    expiresAt?: number;
 };
 
 declare const TOPOLO_RUNTIME_ENVIRONMENTS: readonly ["production", "staging", "development", "local"];

package/dist/node/credential-store.d.ts

@@ -1,14 +1,13 @@
 /**
  * Auth credential types used by the SDK.
  *
- * Phase 1 supports two modes:
+ * Supported modes:
  *   - `api_key`: a single platform API key (service-scoped at issuance).
- *     Preferred for long-lived agent installs.
+ *     Used for service integrations that are not installation-bound.
  *   - `access_token`: a short-lived JWT from the interactive login flow.
  *     Used by TopoloCli after `topolo auth login`.
- *
- * Phase 2 will add OAuth access tokens issued by the authorization-code +
- * PKCE flow in TopoloAuth. Those will plug in as a third variant.
+ *   - `dpop_access_token`: a short-lived delegated token bound to an external
+ *     agent installation key. Every request proves possession of that key.
  */
 type TopoloCredential = {
     kind: 'api_key';
@@ -18,6 +17,11 @@ type TopoloCredential = {
     accessToken: string;
     refreshToken?: string;
     expiresAt?: number;
+} | {
+    kind: 'dpop_access_token';
+    accessToken: string;
+    privateJwk: JsonWebKey;
+    expiresAt?: number;
 };
 
 declare const TOPOLO_RUNTIME_ENVIRONMENTS: readonly ["production", "staging", "development", "local"];

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@topolo/sdk",
   "packageManager": "pnpm@10.17.1",
-  "version": "0.17.1",
-  "topoloPublishedVersion": "0.17.1",
+  "version": "0.19.0",
+  "topoloPublishedVersion": "0.19.0",
   "description": "Typed client SDK for the Topolo platform. Used by TopoloCli, TopoloMCP, and third-party agents.",
   "license": "UNLICENSED",
   "author": "Topolo",