@topolo/sdk 0.21.2 → 0.21.4

package/dist/node/credential-store.js

@@ -2,7 +2,7 @@
 import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2, chmod as chmod2, rm as rm2, stat } from "fs/promises";
 import { existsSync as existsSync2 } from "fs";
 import { homedir as homedir2, platform } from "os";
-import { dirname as dirname2, join as join2 } from "path";
+import { dirname as dirname2, join as join3 } from "path";
 
 // src/errors.ts
 var TopoloSdkError = class extends Error {
@@ -358,68 +358,12 @@ var TopoloOAuth = class {
   }
 };
 
-// src/environment.ts
-var TOPOLO_RUNTIME_ENVIRONMENTS = ["production", "staging", "development", "local"];
-var TOPOLO_ENVIRONMENT_SERVICE_URLS = {
-  production: {
-    auth: "https://auth.topolo.app",
-    developers: "https://developers.topolo.app"
-  },
-  staging: {
-    auth: "https://auth.stg.topolo.us",
-    developers: "https://developers.stg.topolo.us"
-  },
-  development: {
-    auth: "https://auth.topolo.dev",
-    developers: "https://developers.topolo.dev"
-  },
-  local: {}
-};
-function hostnameHasSuffix(hostname, suffix) {
-  return hostname === suffix || hostname.endsWith(`.${suffix}`);
-}
-function workersDevAccountMatches(hostname, account) {
-  if (!hostname.endsWith(".workers.dev")) return false;
-  const labels = hostname.slice(0, -".workers.dev".length).split(".");
-  return labels.length >= 2 && labels.at(-1) === account;
-}
-function originMatchesEnvironment(url, environment) {
-  const hostname = url.hostname.toLowerCase();
-  if (environment === "local") {
-    return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "[::1]";
-  }
-  if (url.protocol !== "https:") return false;
-  if (environment === "production") {
-    return hostnameHasSuffix(hostname, "topolo.app") || hostnameHasSuffix(hostname, "topolo.io") || hostname === "api.ol0.me" || workersDevAccountMatches(hostname, "topolo");
-  }
-  if (environment === "staging") {
-    return hostnameHasSuffix(hostname, "stg.topolo.us") || workersDevAccountMatches(hostname, "topolo-staging");
-  }
-  return hostnameHasSuffix(hostname, "topolo.dev") || workersDevAccountMatches(hostname, "topolo-development");
-}
-function assertTopoloServiceUrlEnvironment(service, value, environment) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new TopoloSdkError("invalid_service_url", `Invalid URL configured for Topolo service "${service}".`);
-  }
-  if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password || !originMatchesEnvironment(url, environment)) {
-    throw new TopoloSdkError(
-      "environment_mismatch",
-      `Refusing Topolo service "${service}": ${url.origin} does not belong to ${environment}.`
-    );
-  }
-  return url.origin;
-}
-function topoloServiceOrigins(serviceUrls, environment) {
-  return Object.fromEntries(
-    Object.entries(serviceUrls ?? {}).sort(([left], [right]) => left.localeCompare(right)).map(([service, value]) => [
-      service,
-      assertTopoloServiceUrlEnvironment(service, value, environment)
-    ])
-  );
-}
+// src/node/action-secret-store.ts
+import { createHash, randomUUID } from "crypto";
+import { join as join2 } from "path";
+
+// src/action-secrets.ts
+var ACTION_SECRET_PREFIX = "topolo-secret:";
 
 // src/node/installation-store.ts
 import { spawnSync } from "child_process";
@@ -469,6 +413,7 @@ function createPlatformInstallationSecretBackend(options = {}) {
   const platform2 = options.platform ?? hostPlatform();
   const spawn = options.spawn ?? ((command, args, spawnOptions) => spawnSync(command, args, spawnOptions));
   const root = options.root ?? installationStorePath();
+  const service = options.service ?? KEYCHAIN_SERVICE;
   if (platform2 === "darwin") {
     const write = (account, value) => runOrThrow(spawn("/usr/bin/expect", ["-c", MACOS_KEYCHAIN_WRITE_SCRIPT], {
       input: `${value}
@@ -477,7 +422,7 @@ function createPlatformInstallationSecretBackend(options = {}) {
       env: {
         ...process.env,
         TOPOLO_KEYCHAIN_ACCOUNT: account,
-        TOPOLO_KEYCHAIN_SERVICE: KEYCHAIN_SERVICE
+        TOPOLO_KEYCHAIN_SERVICE: service
       }
     }), "macOS Keychain write");
     const read = (account) => {
@@ -486,7 +431,7 @@ function createPlatformInstallationSecretBackend(options = {}) {
         "-a",
         account,
         "-s",
-        KEYCHAIN_SERVICE,
+        service,
         "-w"
       ], { encoding: "utf8" });
       if (result.status === 44) return null;
@@ -498,7 +443,7 @@ function createPlatformInstallationSecretBackend(options = {}) {
         "-a",
         account,
         "-s",
-        KEYCHAIN_SERVICE
+        service
       ], { encoding: "utf8" });
       if (result.status !== 44) runOrThrow(result, "macOS Keychain delete");
     };
@@ -545,9 +490,9 @@ function createPlatformInstallationSecretBackend(options = {}) {
       async set(account, value) {
         runOrThrow(spawn("secret-tool", [
           "store",
-          "--label=Topolo external agent installation",
+          "--label=Topolo protected credential",
           "service",
-          KEYCHAIN_SERVICE,
+          service,
           "account",
           account
         ], { input: value, encoding: "utf8" }), "Linux Secret Service write");
@@ -556,7 +501,7 @@ function createPlatformInstallationSecretBackend(options = {}) {
         const result = spawn("secret-tool", [
           "lookup",
           "service",
-          KEYCHAIN_SERVICE,
+          service,
           "account",
           account
         ], { encoding: "utf8" });
@@ -567,7 +512,7 @@ function createPlatformInstallationSecretBackend(options = {}) {
         const result = spawn("secret-tool", [
           "clear",
           "service",
-          KEYCHAIN_SERVICE,
+          service,
           "account",
           account
         ], { encoding: "utf8" });
@@ -638,6 +583,118 @@ async function deleteExternalAgentInstallation(environment, id, backend = create
   await rm(installationPath(environment, id), { force: true });
 }
 
+// src/node/action-secret-store.ts
+function createProtectedActionSecretStore(options) {
+  const backend = options.backend ?? createPlatformInstallationSecretBackend({
+    service: "topolo-action-handoff",
+    root: join2(installationStorePath(), "action-handoff")
+  });
+  const now = options.now ?? Date.now;
+  async function account(reference) {
+    if (!/^topolo-secret:[0-9a-f-]{36}$/.test(reference)) throw new TopoloSdkError("invalid_action_secret_reference", "Invalid protected action reference.");
+    const identity = await options.identity();
+    if (!identity.user.id) throw new TopoloSdkError("action_secret_identity_required", "A verified identity is required for protected action handoff.");
+    if (identity.kind === "api_key" && !identity.apiKey?.id) throw new TopoloSdkError("action_secret_identity_required", "A verified API key identity is required for protected action handoff.");
+    const scope = createHash("sha256").update(JSON.stringify([
+      options.environment,
+      identity.user.principalId ?? identity.user.id,
+      identity.organization?.id ?? null,
+      identity.apiKey?.id ?? null
+    ])).digest("hex");
+    return `${scope}-${reference.slice(ACTION_SECRET_PREFIX.length)}`;
+  }
+  return {
+    async save(value) {
+      const reference = `${ACTION_SECRET_PREFIX}${randomUUID()}`;
+      await backend.set(await account(reference), JSON.stringify({ value, expiresAt: now() + 30 * 60 * 1e3 }));
+      return reference;
+    },
+    async load(reference) {
+      const key = await account(reference);
+      const encoded = await backend.get(key);
+      if (!encoded) throw new TopoloSdkError("action_secret_unavailable", "Protected action reference is missing or belongs to another identity or environment.");
+      let record;
+      try {
+        record = JSON.parse(encoded);
+      } catch {
+        throw new TopoloSdkError("action_secret_invalid", "Protected action reference is corrupt.");
+      }
+      if (!Number.isFinite(record?.expiresAt) || !Object.hasOwn(record, "value")) throw new TopoloSdkError("action_secret_invalid", "Protected action reference is corrupt.");
+      if (record.expiresAt <= now()) {
+        await backend.delete(key);
+        throw new TopoloSdkError("action_secret_expired", "Protected action reference expired. Repeat the originating action if its contract permits.");
+      }
+      return record.value;
+    },
+    async delete(reference) {
+      await backend.delete(await account(reference));
+    }
+  };
+}
+
+// src/environment.ts
+var TOPOLO_RUNTIME_ENVIRONMENTS = ["production", "staging", "development", "local"];
+var TOPOLO_ENVIRONMENT_SERVICE_URLS = {
+  production: {
+    auth: "https://auth.topolo.app",
+    developers: "https://developers.topolo.app"
+  },
+  staging: {
+    auth: "https://auth.stg.topolo.us",
+    developers: "https://developers.stg.topolo.us"
+  },
+  development: {
+    auth: "https://auth.topolo.dev",
+    developers: "https://developers.topolo.dev"
+  },
+  local: {}
+};
+function hostnameHasSuffix(hostname, suffix) {
+  return hostname === suffix || hostname.endsWith(`.${suffix}`);
+}
+function workersDevAccountMatches(hostname, account) {
+  if (!hostname.endsWith(".workers.dev")) return false;
+  const labels = hostname.slice(0, -".workers.dev".length).split(".");
+  return labels.length >= 2 && labels.at(-1) === account;
+}
+function originMatchesEnvironment(url, environment) {
+  const hostname = url.hostname.toLowerCase();
+  if (environment === "local") {
+    return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "[::1]";
+  }
+  if (url.protocol !== "https:") return false;
+  if (environment === "production") {
+    return hostnameHasSuffix(hostname, "topolo.app") || hostnameHasSuffix(hostname, "topolo.io") || hostname === "api.ol0.me" || workersDevAccountMatches(hostname, "topolo");
+  }
+  if (environment === "staging") {
+    return hostnameHasSuffix(hostname, "stg.topolo.us") || workersDevAccountMatches(hostname, "topolo-staging");
+  }
+  return hostnameHasSuffix(hostname, "topolo.dev") || workersDevAccountMatches(hostname, "topolo-development");
+}
+function assertTopoloServiceUrlEnvironment(service, value, environment) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new TopoloSdkError("invalid_service_url", `Invalid URL configured for Topolo service "${service}".`);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password || !originMatchesEnvironment(url, environment)) {
+    throw new TopoloSdkError(
+      "environment_mismatch",
+      `Refusing Topolo service "${service}": ${url.origin} does not belong to ${environment}.`
+    );
+  }
+  return url.origin;
+}
+function topoloServiceOrigins(serviceUrls, environment) {
+  return Object.fromEntries(
+    Object.entries(serviceUrls ?? {}).sort(([left], [right]) => left.localeCompare(right)).map(([service, value]) => [
+      service,
+      assertTopoloServiceUrlEnvironment(service, value, environment)
+    ])
+  );
+}
+
 // src/node/credential-store.ts
 var TOPOLO_ENVIRONMENTS = TOPOLO_RUNTIME_ENVIRONMENTS;
 function contextKey(contextType, organizationId) {
@@ -647,8 +704,8 @@ var ENVIRONMENT_DEFAULT_SERVICE_URLS = TOPOLO_ENVIRONMENT_SERVICE_URLS;
 function configPath() {
   const override = process.env.TOPOLO_CONFIG_PATH;
   if (override) return override;
-  const base = process.env.XDG_CONFIG_HOME || (platform() === "win32" ? join2(homedir2(), "AppData", "Roaming") : join2(homedir2(), ".config"));
-  return join2(base, "topolo", "config.json");
+  const base = process.env.XDG_CONFIG_HOME || (platform() === "win32" ? join3(homedir2(), "AppData", "Roaming") : join3(homedir2(), ".config"));
+  return join3(base, "topolo", "config.json");
 }
 async function readConfig() {
   const path = configPath();
@@ -958,6 +1015,7 @@ export {
   configPath,
   contextKey,
   createPlatformInstallationSecretBackend,
+  createProtectedActionSecretStore,
   credentialSourceFromConfig,
   deleteExternalAgentInstallation,
   envVarPrefix,

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@topolo/sdk",
   "packageManager": "pnpm@10.17.1",
-  "version": "0.21.2",
-  "topoloPublishedVersion": "0.21.2",
+  "version": "0.21.4",
+  "topoloPublishedVersion": "0.21.4",
   "description": "Typed client SDK for the Topolo platform. Used by TopoloCli, TopoloMCP, and third-party agents.",
   "license": "UNLICENSED",
   "author": "Topolo",