@topolo/sdk 0.21.1 → 0.21.3

package/dist/node/credential-store.js

@@ -2,7 +2,7 @@
 import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2, chmod as chmod2, rm as rm2, stat } from "fs/promises";
 import { existsSync as existsSync2 } from "fs";
 import { homedir as homedir2, platform } from "os";
-import { dirname as dirname2, join as join2 } from "path";
+import { dirname as dirname2, join as join3 } from "path";
 
 // src/errors.ts
 var TopoloSdkError = class extends Error {
@@ -358,68 +358,12 @@ var TopoloOAuth = class {
   }
 };
 
-// src/environment.ts
-var TOPOLO_RUNTIME_ENVIRONMENTS = ["production", "staging", "development", "local"];
-var TOPOLO_ENVIRONMENT_SERVICE_URLS = {
-  production: {
-    auth: "https://auth.topolo.app",
-    developers: "https://developers.topolo.app"
-  },
-  staging: {
-    auth: "https://auth.stg.topolo.us",
-    developers: "https://developers.stg.topolo.us"
-  },
-  development: {
-    auth: "https://auth.topolo.dev",
-    developers: "https://developers.topolo.dev"
-  },
-  local: {}
-};
-function hostnameHasSuffix(hostname, suffix) {
-  return hostname === suffix || hostname.endsWith(`.${suffix}`);
-}
-function workersDevAccountMatches(hostname, account) {
-  if (!hostname.endsWith(".workers.dev")) return false;
-  const labels = hostname.slice(0, -".workers.dev".length).split(".");
-  return labels.length >= 2 && labels.at(-1) === account;
-}
-function originMatchesEnvironment(url, environment) {
-  const hostname = url.hostname.toLowerCase();
-  if (environment === "local") {
-    return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "[::1]";
-  }
-  if (url.protocol !== "https:") return false;
-  if (environment === "production") {
-    return hostnameHasSuffix(hostname, "topolo.app") || hostnameHasSuffix(hostname, "topolo.io") || hostname === "api.ol0.me" || workersDevAccountMatches(hostname, "topolo");
-  }
-  if (environment === "staging") {
-    return hostnameHasSuffix(hostname, "stg.topolo.us") || workersDevAccountMatches(hostname, "topolo-staging");
-  }
-  return hostnameHasSuffix(hostname, "topolo.dev") || workersDevAccountMatches(hostname, "topolo-development");
-}
-function assertTopoloServiceUrlEnvironment(service, value, environment) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new TopoloSdkError("invalid_service_url", `Invalid URL configured for Topolo service "${service}".`);
-  }
-  if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password || !originMatchesEnvironment(url, environment)) {
-    throw new TopoloSdkError(
-      "environment_mismatch",
-      `Refusing Topolo service "${service}": ${url.origin} does not belong to ${environment}.`
-    );
-  }
-  return url.origin;
-}
-function topoloServiceOrigins(serviceUrls, environment) {
-  return Object.fromEntries(
-    Object.entries(serviceUrls ?? {}).sort(([left], [right]) => left.localeCompare(right)).map(([service, value]) => [
-      service,
-      assertTopoloServiceUrlEnvironment(service, value, environment)
-    ])
-  );
-}
+// src/node/action-secret-store.ts
+import { createHash, randomUUID } from "crypto";
+import { join as join2 } from "path";
+
+// src/action-secrets.ts
+var ACTION_SECRET_PREFIX = "topolo-secret:";
 
 // src/node/installation-store.ts
 import { spawnSync } from "child_process";
@@ -428,6 +372,8 @@ import { existsSync } from "fs";
 import { homedir, platform as hostPlatform } from "os";
 import { dirname, join } from "path";
 var KEYCHAIN_SERVICE = "topolo-external-agent-installation";
+var MACOS_KEYCHAIN_CHUNK_SIZE = 96;
+var MACOS_KEYCHAIN_CHUNK_PREFIX = "topolo-keychain-chunks:v1:";
 var MACOS_KEYCHAIN_WRITE_SCRIPT = [
   "log_user 0",
   "set timeout 10",
@@ -467,41 +413,75 @@ function createPlatformInstallationSecretBackend(options = {}) {
   const platform2 = options.platform ?? hostPlatform();
   const spawn = options.spawn ?? ((command, args, spawnOptions) => spawnSync(command, args, spawnOptions));
   const root = options.root ?? installationStorePath();
+  const service = options.service ?? KEYCHAIN_SERVICE;
   if (platform2 === "darwin") {
+    const write = (account, value) => runOrThrow(spawn("/usr/bin/expect", ["-c", MACOS_KEYCHAIN_WRITE_SCRIPT], {
+      input: `${value}
+`,
+      encoding: "utf8",
+      env: {
+        ...process.env,
+        TOPOLO_KEYCHAIN_ACCOUNT: account,
+        TOPOLO_KEYCHAIN_SERVICE: service
+      }
+    }), "macOS Keychain write");
+    const read = (account) => {
+      const result = spawn("security", [
+        "find-generic-password",
+        "-a",
+        account,
+        "-s",
+        service,
+        "-w"
+      ], { encoding: "utf8" });
+      if (result.status === 44) return null;
+      return runOrThrow(result, "macOS Keychain read");
+    };
+    const remove = (account) => {
+      const result = spawn("security", [
+        "delete-generic-password",
+        "-a",
+        account,
+        "-s",
+        service
+      ], { encoding: "utf8" });
+      if (result.status !== 44) runOrThrow(result, "macOS Keychain delete");
+    };
+    const chunkAccount = (account, index) => `${account}:chunk:${index}`;
+    const chunkCount = (value) => {
+      if (!value?.startsWith(MACOS_KEYCHAIN_CHUNK_PREFIX)) return 0;
+      const count = Number(value.slice(MACOS_KEYCHAIN_CHUNK_PREFIX.length));
+      if (!Number.isSafeInteger(count) || count < 1) throw new Error("macOS Keychain chunk manifest is invalid.");
+      return count;
+    };
     return {
       async set(account, value) {
-        runOrThrow(spawn("/usr/bin/expect", ["-c", MACOS_KEYCHAIN_WRITE_SCRIPT], {
-          input: `${value}
-`,
-          encoding: "utf8",
-          env: {
-            ...process.env,
-            TOPOLO_KEYCHAIN_ACCOUNT: account,
-            TOPOLO_KEYCHAIN_SERVICE: KEYCHAIN_SERVICE
-          }
-        }), "macOS Keychain write");
+        const previousCount = chunkCount(read(account));
+        const chunks = Array.from(
+          { length: Math.max(1, Math.ceil(value.length / MACOS_KEYCHAIN_CHUNK_SIZE)) },
+          (_, index) => value.slice(index * MACOS_KEYCHAIN_CHUNK_SIZE, (index + 1) * MACOS_KEYCHAIN_CHUNK_SIZE)
+        );
+        try {
+          chunks.forEach((chunk, index) => write(chunkAccount(account, index), chunk));
+          write(account, `${MACOS_KEYCHAIN_CHUNK_PREFIX}${chunks.length}`);
+          for (let index = chunks.length; index < previousCount; index += 1) remove(chunkAccount(account, index));
+        } catch (error) {
+          chunks.forEach((_, index) => remove(chunkAccount(account, index)));
+          throw error;
+        }
       },
       async get(account) {
-        const result = spawn("security", [
-          "find-generic-password",
-          "-a",
-          account,
-          "-s",
-          KEYCHAIN_SERVICE,
-          "-w"
-        ], { encoding: "utf8" });
-        if (result.status === 44) return null;
-        return runOrThrow(result, "macOS Keychain read");
+        const manifest = read(account);
+        const count = chunkCount(manifest);
+        if (!count) return manifest;
+        const chunks = Array.from({ length: count }, (_, index) => read(chunkAccount(account, index)));
+        if (chunks.some((chunk) => chunk === null)) throw new Error("macOS Keychain installation secret is incomplete.");
+        return chunks.join("");
       },
       async delete(account) {
-        const result = spawn("security", [
-          "delete-generic-password",
-          "-a",
-          account,
-          "-s",
-          KEYCHAIN_SERVICE
-        ], { encoding: "utf8" });
-        if (result.status !== 44) runOrThrow(result, "macOS Keychain delete");
+        const count = chunkCount(read(account));
+        for (let index = 0; index < count; index += 1) remove(chunkAccount(account, index));
+        remove(account);
       }
     };
   }
@@ -510,9 +490,9 @@ function createPlatformInstallationSecretBackend(options = {}) {
       async set(account, value) {
         runOrThrow(spawn("secret-tool", [
           "store",
-          "--label=Topolo external agent installation",
+          "--label=Topolo protected credential",
           "service",
-          KEYCHAIN_SERVICE,
+          service,
           "account",
           account
         ], { input: value, encoding: "utf8" }), "Linux Secret Service write");
@@ -521,7 +501,7 @@ function createPlatformInstallationSecretBackend(options = {}) {
         const result = spawn("secret-tool", [
           "lookup",
           "service",
-          KEYCHAIN_SERVICE,
+          service,
           "account",
           account
         ], { encoding: "utf8" });
@@ -532,7 +512,7 @@ function createPlatformInstallationSecretBackend(options = {}) {
         const result = spawn("secret-tool", [
           "clear",
           "service",
-          KEYCHAIN_SERVICE,
+          service,
           "account",
           account
         ], { encoding: "utf8" });
@@ -603,6 +583,118 @@ async function deleteExternalAgentInstallation(environment, id, backend = create
   await rm(installationPath(environment, id), { force: true });
 }
 
+// src/node/action-secret-store.ts
+function createProtectedActionSecretStore(options) {
+  const backend = options.backend ?? createPlatformInstallationSecretBackend({
+    service: "topolo-action-handoff",
+    root: join2(installationStorePath(), "action-handoff")
+  });
+  const now = options.now ?? Date.now;
+  async function account(reference) {
+    if (!/^topolo-secret:[0-9a-f-]{36}$/.test(reference)) throw new TopoloSdkError("invalid_action_secret_reference", "Invalid protected action reference.");
+    const identity = await options.identity();
+    if (!identity.user.id) throw new TopoloSdkError("action_secret_identity_required", "A verified identity is required for protected action handoff.");
+    if (identity.kind === "api_key" && !identity.apiKey?.id) throw new TopoloSdkError("action_secret_identity_required", "A verified API key identity is required for protected action handoff.");
+    const scope = createHash("sha256").update(JSON.stringify([
+      options.environment,
+      identity.user.principalId ?? identity.user.id,
+      identity.organization?.id ?? null,
+      identity.apiKey?.id ?? null
+    ])).digest("hex");
+    return `${scope}-${reference.slice(ACTION_SECRET_PREFIX.length)}`;
+  }
+  return {
+    async save(value) {
+      const reference = `${ACTION_SECRET_PREFIX}${randomUUID()}`;
+      await backend.set(await account(reference), JSON.stringify({ value, expiresAt: now() + 30 * 60 * 1e3 }));
+      return reference;
+    },
+    async load(reference) {
+      const key = await account(reference);
+      const encoded = await backend.get(key);
+      if (!encoded) throw new TopoloSdkError("action_secret_unavailable", "Protected action reference is missing or belongs to another identity or environment.");
+      let record;
+      try {
+        record = JSON.parse(encoded);
+      } catch {
+        throw new TopoloSdkError("action_secret_invalid", "Protected action reference is corrupt.");
+      }
+      if (!Number.isFinite(record?.expiresAt) || !Object.hasOwn(record, "value")) throw new TopoloSdkError("action_secret_invalid", "Protected action reference is corrupt.");
+      if (record.expiresAt <= now()) {
+        await backend.delete(key);
+        throw new TopoloSdkError("action_secret_expired", "Protected action reference expired. Repeat the originating action if its contract permits.");
+      }
+      return record.value;
+    },
+    async delete(reference) {
+      await backend.delete(await account(reference));
+    }
+  };
+}
+
+// src/environment.ts
+var TOPOLO_RUNTIME_ENVIRONMENTS = ["production", "staging", "development", "local"];
+var TOPOLO_ENVIRONMENT_SERVICE_URLS = {
+  production: {
+    auth: "https://auth.topolo.app",
+    developers: "https://developers.topolo.app"
+  },
+  staging: {
+    auth: "https://auth.stg.topolo.us",
+    developers: "https://developers.stg.topolo.us"
+  },
+  development: {
+    auth: "https://auth.topolo.dev",
+    developers: "https://developers.topolo.dev"
+  },
+  local: {}
+};
+function hostnameHasSuffix(hostname, suffix) {
+  return hostname === suffix || hostname.endsWith(`.${suffix}`);
+}
+function workersDevAccountMatches(hostname, account) {
+  if (!hostname.endsWith(".workers.dev")) return false;
+  const labels = hostname.slice(0, -".workers.dev".length).split(".");
+  return labels.length >= 2 && labels.at(-1) === account;
+}
+function originMatchesEnvironment(url, environment) {
+  const hostname = url.hostname.toLowerCase();
+  if (environment === "local") {
+    return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "[::1]";
+  }
+  if (url.protocol !== "https:") return false;
+  if (environment === "production") {
+    return hostnameHasSuffix(hostname, "topolo.app") || hostnameHasSuffix(hostname, "topolo.io") || hostname === "api.ol0.me" || workersDevAccountMatches(hostname, "topolo");
+  }
+  if (environment === "staging") {
+    return hostnameHasSuffix(hostname, "stg.topolo.us") || workersDevAccountMatches(hostname, "topolo-staging");
+  }
+  return hostnameHasSuffix(hostname, "topolo.dev") || workersDevAccountMatches(hostname, "topolo-development");
+}
+function assertTopoloServiceUrlEnvironment(service, value, environment) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new TopoloSdkError("invalid_service_url", `Invalid URL configured for Topolo service "${service}".`);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password || !originMatchesEnvironment(url, environment)) {
+    throw new TopoloSdkError(
+      "environment_mismatch",
+      `Refusing Topolo service "${service}": ${url.origin} does not belong to ${environment}.`
+    );
+  }
+  return url.origin;
+}
+function topoloServiceOrigins(serviceUrls, environment) {
+  return Object.fromEntries(
+    Object.entries(serviceUrls ?? {}).sort(([left], [right]) => left.localeCompare(right)).map(([service, value]) => [
+      service,
+      assertTopoloServiceUrlEnvironment(service, value, environment)
+    ])
+  );
+}
+
 // src/node/credential-store.ts
 var TOPOLO_ENVIRONMENTS = TOPOLO_RUNTIME_ENVIRONMENTS;
 function contextKey(contextType, organizationId) {
@@ -612,8 +704,8 @@ var ENVIRONMENT_DEFAULT_SERVICE_URLS = TOPOLO_ENVIRONMENT_SERVICE_URLS;
 function configPath() {
   const override = process.env.TOPOLO_CONFIG_PATH;
   if (override) return override;
-  const base = process.env.XDG_CONFIG_HOME || (platform() === "win32" ? join2(homedir2(), "AppData", "Roaming") : join2(homedir2(), ".config"));
-  return join2(base, "topolo", "config.json");
+  const base = process.env.XDG_CONFIG_HOME || (platform() === "win32" ? join3(homedir2(), "AppData", "Roaming") : join3(homedir2(), ".config"));
+  return join3(base, "topolo", "config.json");
 }
 async function readConfig() {
   const path = configPath();
@@ -923,6 +1015,7 @@ export {
   configPath,
   contextKey,
   createPlatformInstallationSecretBackend,
+  createProtectedActionSecretStore,
   credentialSourceFromConfig,
   deleteExternalAgentInstallation,
   envVarPrefix,

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@topolo/sdk",
   "packageManager": "pnpm@10.17.1",
-  "version": "0.21.1",
-  "topoloPublishedVersion": "0.21.1",
+  "version": "0.21.3",
+  "topoloPublishedVersion": "0.21.3",
   "description": "Typed client SDK for the Topolo platform. Used by TopoloCli, TopoloMCP, and third-party agents.",
   "license": "UNLICENSED",
   "author": "Topolo",