@topolo/sdk 0.7.0 → 0.8.1

package/dist/index.js

@@ -41,6 +41,12 @@ var TopoloPermissionError = class extends TopoloSdkError {
     this.required = required;
   }
 };
+var TopoloConfirmationRequiredError = class extends TopoloSdkError {
+  constructor(message) {
+    super("confirmation_required", message);
+    this.name = "TopoloConfirmationRequiredError";
+  }
+};
 var TopoloHttpError = class extends TopoloSdkError {
   status;
   body;
@@ -1107,6 +1113,7 @@ var APPLICATIONS = {
           "topolo.io"
         ],
         "routes": [
+          "one.topolo.io",
           "topolo.io",
           "www.topolo.io"
         ],
@@ -2066,7 +2073,6 @@ var TOPOLO_RESOURCE_TYPE_HEADER = "X-Topolo-Resource-Type";
 var TOPOLO_RESOURCE_ID_HEADER = "X-Topolo-Resource-ID";
 var POSITIVE_CACHE_TTL_MS = 5 * 60 * 1e3;
 var NEGATIVE_CACHE_TTL_MS = 60 * 1e3;
-var CATALOG_CACHE_TTL_MS = 60 * 1e3;
 var TopoloClient = class _TopoloClient {
   credential;
   agent;
@@ -2075,9 +2081,9 @@ var TopoloClient = class _TopoloClient {
   requireConfirmForWrites;
   timeoutMs;
   fetchImpl;
+  refreshCredential;
+  refreshInFlight = null;
   debug;
-  serviceCatalogCache = null;
-  actionCatalogCache = null;
   /**
    * Process-wide cache for slug → app-id lookups. Keyed by
    * `${authBaseUrl}|${slug}` so multiple `TopoloClient` instances pointing at
@@ -2102,6 +2108,7 @@ var TopoloClient = class _TopoloClient {
     this.requireConfirmForWrites = options.requireConfirmForWrites !== false;
     this.timeoutMs = options.timeoutMs ?? 3e4;
     this.fetchImpl = options.fetch ?? fetch;
+    this.refreshCredential = options.refreshCredential;
     this.debug = options.debug;
   }
   emit(event) {
@@ -2119,11 +2126,11 @@ var TopoloClient = class _TopoloClient {
   async request(opts) {
     const method = opts.method ?? "GET";
     if (this.requireConfirmForWrites && WRITE_METHODS.has(method) && !opts.confirm) {
-      throw new TopoloAuthError(
+      throw new TopoloConfirmationRequiredError(
         `Mutating ${method} requests require { confirm: true }. This guardrail prevents agents from issuing writes without an explicit human-in-the-loop acknowledgement.`
       );
     }
-    const resolvedService = await this.resolveRequestService(opts.service);
+    const resolvedService = opts.baseUrl ? { serviceKey: normalizeLookupKey(opts.service), baseUrl: requireHttpOrigin(opts.baseUrl) } : await this.resolveRequestService(opts.service);
     const baseUrl = resolvedService.baseUrl;
     const url = new URL(opts.path, baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`);
     if (opts.query) {
@@ -2154,20 +2161,36 @@ var TopoloClient = class _TopoloClient {
       headers.set(TOPOLO_RESOURCE_TYPE_HEADER, resourceType);
       headers.set(TOPOLO_RESOURCE_ID_HEADER, resourceId);
     }
-    const controller = new AbortController();
-    const timeoutId = setTimeout(() => controller.abort(), this.timeoutMs);
-    const signal = opts.signal ? mergeSignals(opts.signal, controller.signal) : controller.signal;
     const urlStr = url.toString();
     const startedAt = Date.now();
     this.emit({ phase: "request", method, service: resolvedService.serviceKey, path: opts.path, url: urlStr, requestId });
+    const fetchOnce = async () => {
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => controller.abort(), this.timeoutMs);
+      const signal = opts.signal ? mergeSignals(opts.signal, controller.signal) : controller.signal;
+      try {
+        return await this.fetchImpl(urlStr, {
+          method,
+          headers: new Headers(headers),
+          body: opts.body !== void 0 ? JSON.stringify(opts.body) : null,
+          signal
+        });
+      } finally {
+        clearTimeout(timeoutId);
+      }
+    };
     let res;
     try {
-      res = await this.fetchImpl(urlStr, {
-        method,
-        headers,
-        body: opts.body !== void 0 ? JSON.stringify(opts.body) : null,
-        signal
-      });
+      const attemptedCredential = this.credential;
+      res = await fetchOnce();
+      if (res.status === 401 && attemptedCredential.kind === "access_token" && this.refreshCredential) {
+        await res.body?.cancel().catch(() => void 0);
+        const refreshed = await this.refreshRejectedAccessToken(attemptedCredential.accessToken);
+        if (refreshed) {
+          applyAuthHeaders(headers, refreshed);
+          res = await fetchOnce();
+        }
+      }
     } catch (err) {
       this.emit({
         phase: "error",
@@ -2180,8 +2203,6 @@ var TopoloClient = class _TopoloClient {
         error: err instanceof Error ? err.message : String(err)
       });
       throw err;
-    } finally {
-      clearTimeout(timeoutId);
     }
     const contentType = res.headers.get("Content-Type") ?? "";
     const parsed = contentType.includes("application/json") ? await res.json().catch(() => null) : await res.text().catch(() => null);
@@ -2220,6 +2241,19 @@ var TopoloClient = class _TopoloClient {
     });
     return parsed;
   }
+  async refreshRejectedAccessToken(attemptedAccessToken) {
+    if (this.credential.kind === "access_token" && this.credential.accessToken !== attemptedAccessToken) {
+      return this.credential;
+    }
+    if (!this.refreshCredential) return null;
+    this.refreshInFlight ??= this.refreshCredential().then((credential) => {
+      if (credential) this.credential = credential;
+      return credential;
+    }).catch(() => null).finally(() => {
+      this.refreshInFlight = null;
+    });
+    return this.refreshInFlight;
+  }
   async resolveRequestService(service) {
     const serviceKey = normalizeLookupKey(service);
     if (!serviceKey) {
@@ -2245,9 +2279,8 @@ var TopoloClient = class _TopoloClient {
     );
   }
   async resolveLiveCallableService(serviceKey) {
-    const catalog = await this.listServices();
-    const match = catalog.find((entry) => catalogEntryMatches(entry, serviceKey));
-    if (!match) return null;
+    const match = await this.getService(serviceKey).catch(() => null);
+    if (!match || !catalogEntryMatches(match, serviceKey)) return null;
     const baseUrl = resolveCatalogServiceUrl(match, {
       serviceKey,
       overrides: this.serviceUrls
@@ -2321,12 +2354,13 @@ var TopoloClient = class _TopoloClient {
    * The live Auth catalog is the authority because it is scoped to the caller's
    * organization and effective permissions.
    */
-  async listServices() {
-    const now = Date.now();
-    if (this.serviceCatalogCache && this.serviceCatalogCache.expiresAt > now) {
-      return this.serviceCatalogCache.entries;
-    }
-    const res = await this.request({ service: "developers", method: "GET", path: "/api/services/catalog" });
+  async searchServices(options = {}) {
+    const res = await this.request({
+      service: "developers",
+      method: "GET",
+      path: "/api/services/catalog",
+      query: catalogSearchQuery(options)
+    });
     const raw = res.data?.services ?? res.services;
     if (!Array.isArray(raw)) {
       throw new TopoloSdkError(
@@ -2336,6 +2370,7 @@ var TopoloClient = class _TopoloClient {
     }
     const entries = [];
     for (const item of raw) {
+      if (!isRecord(item)) continue;
       const s = item;
       const appId = typeof s.app_id === "string" ? s.app_id : typeof s.id === "string" ? s.id : null;
       if (!appId) continue;
@@ -2360,11 +2395,30 @@ var TopoloClient = class _TopoloClient {
         apiKeyResources
       });
     }
-    this.serviceCatalogCache = {
-      entries,
-      expiresAt: now + CATALOG_CACHE_TTL_MS
-    };
-    return entries;
+    const page = normalizeCatalogPage(
+      res.data?.page ?? res.page
+    );
+    return { services: entries, page };
+  }
+  /** @deprecated Prefer searchServices() so callers retain the continuation cursor. */
+  async listServices(options = {}) {
+    return (await this.searchServices(options)).services;
+  }
+  async getService(application) {
+    const needle = application.trim();
+    if (!needle) throw new TopoloSdkError("unknown_service", "application is required");
+    const res = await this.request({
+      service: "developers",
+      method: "GET",
+      path: "/api/services/catalog",
+      query: { application: needle }
+    });
+    const raw = res.data?.application ?? res.application;
+    const entry = normalizeServiceCatalogEntry(raw);
+    if (!entry) {
+      throw new TopoloSdkError("unknown_service", `Unknown Topolo application "${application}".`);
+    }
+    return entry;
   }
   /**
    * List callable actions from the live registry-canonical catalog (definitions
@@ -2372,16 +2426,15 @@ var TopoloClient = class _TopoloClient {
    * caller's organization and effective permissions; no bundled/static app
    * action list is used as an authorization source.
    */
-  async listActions(options = {}) {
-    const now = Date.now();
-    if (!options.service && this.actionCatalogCache && this.actionCatalogCache.expiresAt > now) {
-      return this.actionCatalogCache.entries;
+  async searchActions(options) {
+    if (!options.service?.trim()) {
+      throw new TopoloSdkError("service_required", "service is required for bounded action discovery");
     }
     const res = await this.request({
       service: "developers",
       method: "GET",
       path: "/api/actions/catalog",
-      ...options.service ? { query: { service: options.service } } : {}
+      query: { service: options.service, ...catalogSearchQuery(options) }
     });
     const raw = res.data?.actions ?? res.actions;
     if (!Array.isArray(raw)) {
@@ -2391,36 +2444,96 @@ var TopoloClient = class _TopoloClient {
       );
     }
     const entries = raw.map((item) => normalizeActionCatalogEntry(item)).filter((entry) => Boolean(entry));
-    if (!options.service) {
-      this.actionCatalogCache = {
-        entries,
-        expiresAt: now + CATALOG_CACHE_TTL_MS
-      };
+    return {
+      actions: entries,
+      page: normalizeCatalogPage(
+        res.data?.page ?? res.page
+      )
+    };
+  }
+  async getActionCatalogSummary(service) {
+    const boundedService = service.trim();
+    if (!boundedService) {
+      throw new TopoloSdkError("service_required", "service is required for bounded action discovery");
     }
-    return entries;
+    const res = await this.request({
+      service: "developers",
+      method: "GET",
+      path: "/api/actions/catalog",
+      query: { service: boundedService, summary: "true" }
+    });
+    const raw = res.data?.summary ?? res.summary;
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+      throw new TopoloSdkError("action_catalog_summary_unavailable", "Action catalog summary is unavailable.");
+    }
+    const record = raw;
+    if (record.algorithm !== "sha256-v1" || typeof record.digest !== "string" || !/^[a-f0-9]{64}$/.test(record.digest) || !Number.isSafeInteger(record.actionCount) || Number(record.actionCount) < 0) {
+      throw new TopoloSdkError("action_catalog_summary_unavailable", "Action catalog summary is invalid.");
+    }
+    return {
+      algorithm: "sha256-v1",
+      digest: record.digest,
+      actionCount: Number(record.actionCount)
+    };
+  }
+  /** @deprecated Prefer searchActions() so callers retain the continuation cursor. */
+  async listActions(options) {
+    if (!options) {
+      throw new TopoloSdkError("service_required", "service is required for bounded action discovery");
+    }
+    return (await this.searchActions(options)).actions;
   }
   async getAction(action) {
-    const needle = normalizeActionLookupKey(action);
-    const actions = await this.listActions();
-    const match = actions.find((entry) => actionEntryMatches(entry, needle));
-    if (!match) {
+    const actionId = action.trim();
+    if (!actionId) {
       throw new TopoloSdkError(
         "unknown_action",
-        `Unknown Topolo action "${action}". Run action discovery first and pass an action id, name, or tool name.`
+        "action id is required"
       );
     }
+    let res;
+    try {
+      res = await this.request({
+        service: "developers",
+        method: "GET",
+        path: "/api/actions/catalog",
+        query: { actionId }
+      });
+    } catch (error) {
+      if (error instanceof TopoloHttpError && error.status === 404) {
+        throw new TopoloSdkError("unknown_action", `Unknown or unavailable Topolo action "${action}".`);
+      }
+      throw error;
+    }
+    const raw = res.data?.action ?? res.action;
+    const match = normalizeActionCatalogEntry(raw);
+    if (!match) throw new TopoloSdkError("unknown_action", `Unknown or unavailable Topolo action "${action}".`);
     return match;
   }
   async callAction(action, input = {}, options = {}) {
     const entry = await this.getAction(action);
+    const agentAccess = entry.agentAccess ?? (entry.destructive ? "off" : entry.readOnly && !entry.requiresConfirmation ? "auto" : "confirm");
+    if (agentAccess === "off") {
+      throw new TopoloPermissionError(
+        `Topolo action "${entry.actionId}" is not available for agent invocation.`,
+        entry.requiredPermission ? [entry.requiredPermission] : []
+      );
+    }
+    if ((agentAccess === "confirm" || entry.requiresConfirmation || entry.destructive) && options.confirm !== true) {
+      throw new TopoloConfirmationRequiredError(
+        `Topolo action "${entry.actionId}" requires { confirm: true } before invocation.`
+      );
+    }
     const mapped = mapActionInput(entry, input);
     const service = entry.appSlug || entry.appId;
     return this.request({
       service,
+      ...entry.apiBaseUrl ? { baseUrl: entry.apiBaseUrl } : {},
       method: entry.method,
       path: mapped.path,
       ...mapped.query ? { query: mapped.query } : {},
       ...mapped.body !== void 0 ? { body: mapped.body } : {},
+      ...options.resource ? { resource: options.resource } : {},
       headers: {
         [TOPOLO_ACTION_ID_HEADER]: entry.actionId,
         [TOPOLO_ACTION_NAME_HEADER]: entry.name
@@ -2558,6 +2671,18 @@ function serviceKeyCandidates2(slug) {
 function normalizeLookupKey(value) {
   return String(value || "").trim().toLowerCase().replace(/\s+/g, "-");
 }
+function requireHttpOrigin(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new TopoloSdkError("invalid_action_target", `Invalid action API origin "${value}".`);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password) {
+    throw new TopoloSdkError("invalid_action_target", `Invalid action API origin "${value}".`);
+  }
+  return url.origin;
+}
 function deriveDevelopersFromAuth(authUrl) {
   if (!authUrl) return null;
   try {
@@ -2584,6 +2709,47 @@ function catalogEntryLookupKeys(entry) {
   }
   return [...keys];
 }
+function catalogSearchQuery(options) {
+  const query = {};
+  if (typeof options.query === "string" && options.query.trim()) query.query = options.query.trim();
+  if (typeof options.cursor === "string" && options.cursor.trim()) query.cursor = options.cursor.trim();
+  if (typeof options.limit === "number" && Number.isFinite(options.limit)) query.limit = Math.trunc(options.limit);
+  return query;
+}
+function normalizeCatalogPage(value) {
+  if (!isRecord(value)) return { nextCursor: null, hasMore: false };
+  return {
+    nextCursor: typeof value.nextCursor === "string" && value.nextCursor ? value.nextCursor : null,
+    hasMore: value.hasMore === true
+  };
+}
+function normalizeServiceCatalogEntry(item) {
+  if (!isRecord(item)) return null;
+  const appId = typeof item.app_id === "string" ? item.app_id : typeof item.id === "string" ? item.id : null;
+  if (!appId) return null;
+  const permissions = Array.isArray(item.granted_permissions) ? item.granted_permissions.filter(
+    (permission) => typeof permission === "string" && permission.trim().length > 0
+  ) : [];
+  const catalogApiKeyResources = normalizeApiKeyResourceMetadataList(
+    item.api_key_resources ?? item.apiKeyResources
+  );
+  const apiKeyResource = normalizeApiKeyResourceMetadata(item.api_key_resource ?? item.apiKeyResource) ?? catalogApiKeyResources[0] ?? null;
+  const apiKeyResources = catalogApiKeyResources.length > 0 ? catalogApiKeyResources : apiKeyResource ? [apiKeyResource] : [];
+  return {
+    appId,
+    slug: typeof item.app_slug === "string" ? item.app_slug : null,
+    name: typeof item.name === "string" ? item.name : null,
+    description: typeof item.description === "string" ? item.description : null,
+    apiBaseUrl: typeof item.api_base_url === "string" ? item.api_base_url : typeof item.apiBaseUrl === "string" ? item.apiBaseUrl : null,
+    launchUrl: typeof item.launch_url === "string" ? item.launch_url : typeof item.launchUrl === "string" ? item.launchUrl : null,
+    status: typeof item.status === "string" ? item.status : null,
+    surfaceKind: typeof item.surface_kind === "string" ? item.surface_kind : null,
+    launchable: item.launchable === true,
+    permissions,
+    apiKeyResource,
+    apiKeyResources
+  };
+}
 function normalizeActionCatalogEntry(item) {
   if (!item || typeof item !== "object" || Array.isArray(item)) return null;
   const a = item;
@@ -2597,6 +2763,8 @@ function normalizeActionCatalogEntry(item) {
   }
   return {
     actionId,
+    target: pickActionString(a.target_key) ?? pickActionString(a.target) ?? null,
+    apiBaseUrl: pickActionString(a.api_base_url) ?? pickActionString(a.apiBaseUrl) ?? null,
     name,
     toolName: pickActionString(a.tool_name) ?? pickActionString(a.toolName) ?? null,
     title: pickActionString(a.title) ?? name,
@@ -2608,6 +2776,7 @@ function normalizeActionCatalogEntry(item) {
     path,
     permissionName: pickActionString(a.permission_name) ?? pickActionString(a.permissionName) ?? "",
     requiredPermission: pickActionString(a.required_permission) ?? pickActionString(a.requiredPermission) ?? "",
+    authorizationMode: pickAuthorizationMode(a.authorization_mode ?? a.authorizationMode),
     inputSchema: plainObject(a.input_schema ?? a.inputSchema),
     outputSchema: plainObject(a.output_schema ?? a.outputSchema),
     readOnly: Boolean(a.read_only ?? a.readOnly),
@@ -2627,16 +2796,12 @@ function pickActionString(value) {
 function pickAgentAccess(value) {
   return value === "auto" || value === "confirm" || value === "off" ? value : null;
 }
+function pickAuthorizationMode(value) {
+  return value === "runtime" ? "runtime" : "static";
+}
 function plainObject(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
-function normalizeActionLookupKey(value) {
-  return String(value || "").trim().toLowerCase();
-}
-function actionEntryMatches(entry, needle) {
-  if (!needle) return false;
-  return [entry.actionId, entry.name, entry.toolName].filter((value) => typeof value === "string" && value.length > 0).some((value) => value.toLowerCase() === needle);
-}
 function mapActionInput(action, input) {
   const remaining = { ...input || {} };
   const path = action.path.replace(/\{([a-zA-Z0-9_]+)\}/g, (_match, key) => {
@@ -2715,6 +2880,40 @@ function mergeSignals(a, b) {
   return controller.signal;
 }
 
+// src/action-catalog-digest.ts
+var ACTION_CATALOG_DIGEST_ALGORITHM = "sha256-v1";
+function canonicalPermission(value, appId) {
+  let permission = String(value || "").trim().toLowerCase().replace(/\s+/g, "");
+  const prefix = `${String(appId || "").trim().toLowerCase()}.`;
+  if (prefix !== "." && permission.startsWith(prefix)) permission = permission.slice(prefix.length);
+  return permission.replace(/\./g, ":");
+}
+function stableJson(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    const record = value;
+    return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableJson(record[key])}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+async function digestTopoloActionCatalog(actions, appId) {
+  const canonical = actions.filter((action) => action.agentAccess !== "off").map((action) => ({
+    actionId: action.actionId || `${appId}.${action.name}`,
+    authorizationMode: action.authorizationMode === "runtime" ? "runtime" : "static",
+    inputSchema: action.inputSchema,
+    method: action.method,
+    outputSchema: action.outputSchema,
+    path: action.path,
+    permission: canonicalPermission(action.permission ?? action.permissionName ?? "", appId),
+    readOnly: action.readOnly,
+    requiresConfirmation: action.requiresConfirmation,
+    target: action.target ?? ""
+  })).sort((left, right) => left.actionId.localeCompare(right.actionId));
+  const bytes = new TextEncoder().encode(canonical.map(stableJson).join("\n"));
+  const digest = await crypto.subtle.digest("SHA-256", bytes);
+  return [...new Uint8Array(digest)].map((value) => value.toString(16).padStart(2, "0")).join("");
+}
+
 // src/modules/crm.ts
 var CrmModule = class {
   constructor(client) {
@@ -3239,6 +3438,7 @@ function createTopolo(options) {
   };
 }
 export {
+  ACTION_CATALOG_DIGEST_ALGORITHM,
   APPLICATIONS,
   APPLICATION_REQUIREMENTS,
   APPLICATION_REQUIREMENTS_VERSION,
@@ -3250,6 +3450,7 @@ export {
   TOPOLO_WIDGET_REFRESH_INTERVAL_MS,
   TopoloAuthError,
   TopoloClient,
+  TopoloConfirmationRequiredError,
   TopoloHttpError,
   TopoloOAuth,
   TopoloPermissionError,
@@ -3265,6 +3466,7 @@ export {
   defineTopoloQuickActionsWidget,
   defineTopoloRecentActivityWidget,
   defineTopoloStatsWidget,
+  digestTopoloActionCatalog,
   requirementsForApplication,
   resolveCatalogServiceUrl,
   resolveServiceUrl,

package/dist/node/credential-store.cjs

@@ -382,7 +382,7 @@ async function resolveCredential(environment = selectedEnvironment()) {
   return profileForEnvironment(config, environment).credential ?? null;
 }
 var REFRESH_SKEW_SECONDS = 60;
-async function refreshCredentialIfNeeded(environment = selectedEnvironment()) {
+async function refreshCredentialIfNeeded(environment = selectedEnvironment(), options = {}) {
   const prefix = envVarPrefix(environment);
   if (process.env[`${prefix}_API_KEY`] || process.env[`${prefix}_ACCESS_TOKEN`] || process.env.TOPOLO_API_KEY || process.env.TOPOLO_ACCESS_TOKEN) {
     return resolveCredential(environment);
@@ -393,7 +393,7 @@ async function refreshCredentialIfNeeded(environment = selectedEnvironment()) {
   if (!cred || cred.kind !== "access_token") return cred ?? null;
   if (!cred.refreshToken || !cred.expiresAt || !profile.oauthClientId) return cred;
   const now = Math.floor(Date.now() / 1e3);
-  if (cred.expiresAt - REFRESH_SKEW_SECONDS > now) return cred;
+  if (!options.force && cred.expiresAt - REFRESH_SKEW_SECONDS > now) return cred;
   try {
     const oauth = new TopoloOAuth({
       serviceUrls: resolveServiceUrls(profile.serviceUrls, environment)
@@ -408,9 +408,20 @@ async function refreshCredentialIfNeeded(environment = selectedEnvironment()) {
       ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: cred.refreshToken },
       expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
     };
-    await writeConfig(
-      environment === "production" && !config.profiles?.production ? { ...config, credential: refreshed } : writeProfileConfig(config, environment, { credential: refreshed })
-    );
+    const activeContext = profile.activeContext;
+    const activeEntry = activeContext ? profile.contexts?.[activeContext] : void 0;
+    const updated = activeContext && activeEntry ? writeProfileConfig(config, environment, {
+      credential: refreshed,
+      contexts: {
+        ...profile.contexts ?? {},
+        [activeContext]: {
+          ...activeEntry,
+          credential: refreshed,
+          oauthClientId: activeEntry.oauthClientId ?? profile.oauthClientId
+        }
+      }
+    }) : environment === "production" && !config.profiles?.production ? { ...config, credential: refreshed } : writeProfileConfig(config, environment, { credential: refreshed });
+    await writeConfig(updated);
     return refreshed;
   } catch {
     return cred;

package/dist/node/credential-store.d.cts

@@ -100,7 +100,9 @@ declare function credentialSourceFromConfig(config: TopoloConfig, environment?:
  * interactive users get after running `topolo auth login`.
  */
 declare function resolveCredential(environment?: TopoloEnvironment): Promise<TopoloCredential | null>;
-declare function refreshCredentialIfNeeded(environment?: TopoloEnvironment): Promise<TopoloCredential | null>;
+declare function refreshCredentialIfNeeded(environment?: TopoloEnvironment, options?: {
+    force?: boolean;
+}): Promise<TopoloCredential | null>;
 declare function resolveAgentName(configAgentName?: string): string | undefined;
 declare function resolveServiceUrls(configUrls?: Record<string, string>, environment?: TopoloEnvironment): Record<string, string> | undefined;
 declare function resolvedProfileConfig(config: TopoloConfig, environment?: TopoloEnvironment): TopoloEnvironmentProfile;

package/dist/node/credential-store.d.ts

@@ -100,7 +100,9 @@ declare function credentialSourceFromConfig(config: TopoloConfig, environment?:
  * interactive users get after running `topolo auth login`.
  */
 declare function resolveCredential(environment?: TopoloEnvironment): Promise<TopoloCredential | null>;
-declare function refreshCredentialIfNeeded(environment?: TopoloEnvironment): Promise<TopoloCredential | null>;
+declare function refreshCredentialIfNeeded(environment?: TopoloEnvironment, options?: {
+    force?: boolean;
+}): Promise<TopoloCredential | null>;
 declare function resolveAgentName(configAgentName?: string): string | undefined;
 declare function resolveServiceUrls(configUrls?: Record<string, string>, environment?: TopoloEnvironment): Record<string, string> | undefined;
 declare function resolvedProfileConfig(config: TopoloConfig, environment?: TopoloEnvironment): TopoloEnvironmentProfile;

package/dist/node/credential-store.js

@@ -339,7 +339,7 @@ async function resolveCredential(environment = selectedEnvironment()) {
   return profileForEnvironment(config, environment).credential ?? null;
 }
 var REFRESH_SKEW_SECONDS = 60;
-async function refreshCredentialIfNeeded(environment = selectedEnvironment()) {
+async function refreshCredentialIfNeeded(environment = selectedEnvironment(), options = {}) {
   const prefix = envVarPrefix(environment);
   if (process.env[`${prefix}_API_KEY`] || process.env[`${prefix}_ACCESS_TOKEN`] || process.env.TOPOLO_API_KEY || process.env.TOPOLO_ACCESS_TOKEN) {
     return resolveCredential(environment);
@@ -350,7 +350,7 @@ async function refreshCredentialIfNeeded(environment = selectedEnvironment()) {
   if (!cred || cred.kind !== "access_token") return cred ?? null;
   if (!cred.refreshToken || !cred.expiresAt || !profile.oauthClientId) return cred;
   const now = Math.floor(Date.now() / 1e3);
-  if (cred.expiresAt - REFRESH_SKEW_SECONDS > now) return cred;
+  if (!options.force && cred.expiresAt - REFRESH_SKEW_SECONDS > now) return cred;
   try {
     const oauth = new TopoloOAuth({
       serviceUrls: resolveServiceUrls(profile.serviceUrls, environment)
@@ -365,9 +365,20 @@ async function refreshCredentialIfNeeded(environment = selectedEnvironment()) {
       ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: cred.refreshToken },
       expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
     };
-    await writeConfig(
-      environment === "production" && !config.profiles?.production ? { ...config, credential: refreshed } : writeProfileConfig(config, environment, { credential: refreshed })
-    );
+    const activeContext = profile.activeContext;
+    const activeEntry = activeContext ? profile.contexts?.[activeContext] : void 0;
+    const updated = activeContext && activeEntry ? writeProfileConfig(config, environment, {
+      credential: refreshed,
+      contexts: {
+        ...profile.contexts ?? {},
+        [activeContext]: {
+          ...activeEntry,
+          credential: refreshed,
+          oauthClientId: activeEntry.oauthClientId ?? profile.oauthClientId
+        }
+      }
+    }) : environment === "production" && !config.profiles?.production ? { ...config, credential: refreshed } : writeProfileConfig(config, environment, { credential: refreshed });
+    await writeConfig(updated);
     return refreshed;
   } catch {
     return cred;

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@topolo/sdk",
-  "version": "0.7.0",
+  "version": "0.8.1",
+  "topoloPublishedVersion": "0.8.0",
   "description": "Typed client SDK for the Topolo platform. Used by TopoloCli, TopoloMCP, and third-party agents.",
   "type": "module",
   "main": "./dist/index.js",
@@ -19,8 +20,7 @@
     }
   },
   "files": [
-    "dist",
-    "src"
+    "dist"
   ],
   "scripts": {
     "generate:services": "node scripts/generate-services.mjs",
@@ -31,7 +31,8 @@
     "typecheck": "node scripts/generate-services.mjs && tsc --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",
-    "prepublishOnly": "npm run build",
+    "prepublishOnly": "npm run build && npm run verify:package",
+    "verify:package": "node ../../tooling/verify-npm-package.mjs .",
     "coverage": "vitest run --coverage"
   },
   "devDependencies": {