@topolo/sdk 0.8.0 → 0.8.2

package/dist/index.cjs

@@ -20,6 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  ACTION_CATALOG_DIGEST_ALGORITHM: () => ACTION_CATALOG_DIGEST_ALGORITHM,
   APPLICATIONS: () => APPLICATIONS,
   APPLICATION_REQUIREMENTS: () => APPLICATION_REQUIREMENTS,
   APPLICATION_REQUIREMENTS_VERSION: () => APPLICATION_REQUIREMENTS_VERSION,
@@ -47,6 +48,7 @@ __export(index_exports, {
   defineTopoloQuickActionsWidget: () => defineTopoloQuickActionsWidget,
   defineTopoloRecentActivityWidget: () => defineTopoloRecentActivityWidget,
   defineTopoloStatsWidget: () => defineTopoloStatsWidget,
+  digestTopoloActionCatalog: () => digestTopoloActionCatalog,
   requirementsForApplication: () => requirementsForApplication,
   resolveCatalogServiceUrl: () => resolveCatalogServiceUrl,
   resolveServiceUrl: () => resolveServiceUrl,
@@ -2507,6 +2509,31 @@ var TopoloClient = class _TopoloClient {
       )
     };
   }
+  async getActionCatalogSummary(service) {
+    const boundedService = service.trim();
+    if (!boundedService) {
+      throw new TopoloSdkError("service_required", "service is required for bounded action discovery");
+    }
+    const res = await this.request({
+      service: "developers",
+      method: "GET",
+      path: "/api/actions/catalog",
+      query: { service: boundedService, summary: "true" }
+    });
+    const raw = res.data?.summary ?? res.summary;
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+      throw new TopoloSdkError("action_catalog_summary_unavailable", "Action catalog summary is unavailable.");
+    }
+    const record = raw;
+    if (record.algorithm !== "sha256-v1" || typeof record.digest !== "string" || !/^[a-f0-9]{64}$/.test(record.digest) || !Number.isSafeInteger(record.actionCount) || Number(record.actionCount) < 0) {
+      throw new TopoloSdkError("action_catalog_summary_unavailable", "Action catalog summary is invalid.");
+    }
+    return {
+      algorithm: "sha256-v1",
+      digest: record.digest,
+      actionCount: Number(record.actionCount)
+    };
+  }
   /** @deprecated Prefer searchActions() so callers retain the continuation cursor. */
   async listActions(options) {
     if (!options) {
@@ -2522,15 +2549,23 @@ var TopoloClient = class _TopoloClient {
         "action id is required"
       );
     }
-    const res = await this.request({
-      service: "developers",
-      method: "GET",
-      path: "/api/actions/catalog",
-      query: { actionId }
-    });
+    let res;
+    try {
+      res = await this.request({
+        service: "developers",
+        method: "GET",
+        path: "/api/actions/catalog",
+        query: { actionId }
+      });
+    } catch (error) {
+      if (error instanceof TopoloHttpError && error.status === 404) {
+        throw new TopoloSdkError("unknown_action", `Unknown or unavailable Topolo action "${action}".`);
+      }
+      throw error;
+    }
     const raw = res.data?.action ?? res.action;
     const match = normalizeActionCatalogEntry(raw);
-    if (!match) throw new TopoloSdkError("unknown_action", `Unknown Topolo action "${action}".`);
+    if (!match) throw new TopoloSdkError("unknown_action", `Unknown or unavailable Topolo action "${action}".`);
     return match;
   }
   async callAction(action, input = {}, options = {}) {
@@ -2606,6 +2641,7 @@ var TopoloClient = class _TopoloClient {
     const kind = payload.credentialType === "api_key" ? "api_key" : "access_token";
     return {
       kind,
+      authorizationMode: normalizeCredentialAuthorizationMode(payload.authorizationMode, kind),
       user: {
         id: user.id,
         email: user.email,
@@ -2868,6 +2904,11 @@ function objectToQuery(value) {
   }
   return Object.keys(query).length > 0 ? query : void 0;
 }
+function normalizeCredentialAuthorizationMode(value, kind) {
+  if (kind === "api_key") return "api_key";
+  if (value === "context_rbac" || value === "oauth_scopes" || value === "session_rbac") return value;
+  return "unknown";
+}
 function describeError(body, fallback) {
   if (body && typeof body === "object") {
     const maybe = body;
@@ -2903,6 +2944,40 @@ function mergeSignals(a, b) {
   return controller.signal;
 }
 
+// src/action-catalog-digest.ts
+var ACTION_CATALOG_DIGEST_ALGORITHM = "sha256-v1";
+function canonicalPermission(value, appId) {
+  let permission = String(value || "").trim().toLowerCase().replace(/\s+/g, "");
+  const prefix = `${String(appId || "").trim().toLowerCase()}.`;
+  if (prefix !== "." && permission.startsWith(prefix)) permission = permission.slice(prefix.length);
+  return permission.replace(/\./g, ":");
+}
+function stableJson(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    const record = value;
+    return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableJson(record[key])}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+async function digestTopoloActionCatalog(actions, appId) {
+  const canonical = actions.filter((action) => action.agentAccess !== "off").map((action) => ({
+    actionId: action.actionId || `${appId}.${action.name}`,
+    authorizationMode: action.authorizationMode === "runtime" ? "runtime" : "static",
+    inputSchema: action.inputSchema,
+    method: action.method,
+    outputSchema: action.outputSchema,
+    path: action.path,
+    permission: canonicalPermission(action.permission ?? action.permissionName ?? "", appId),
+    readOnly: action.readOnly,
+    requiresConfirmation: action.requiresConfirmation,
+    target: action.target ?? ""
+  })).sort((left, right) => left.actionId.localeCompare(right.actionId));
+  const bytes = new TextEncoder().encode(canonical.map(stableJson).join("\n"));
+  const digest = await crypto.subtle.digest("SHA-256", bytes);
+  return [...new Uint8Array(digest)].map((value) => value.toString(16).padStart(2, "0")).join("");
+}
+
 // src/modules/crm.ts
 var CrmModule = class {
   constructor(client) {
@@ -3428,6 +3503,7 @@ function createTopolo(options) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ACTION_CATALOG_DIGEST_ALGORITHM,
   APPLICATIONS,
   APPLICATION_REQUIREMENTS,
   APPLICATION_REQUIREMENTS_VERSION,
@@ -3455,6 +3531,7 @@ function createTopolo(options) {
   defineTopoloQuickActionsWidget,
   defineTopoloRecentActivityWidget,
   defineTopoloStatsWidget,
+  digestTopoloActionCatalog,
   requirementsForApplication,
   resolveCatalogServiceUrl,
   resolveServiceUrl,

package/dist/index.d.cts

@@ -174,6 +174,11 @@ interface TopoloActionCatalogPage {
     actions: TopoloActionCatalogEntry[];
     page: TopoloCatalogPage;
 }
+interface TopoloActionCatalogSummary {
+    algorithm: 'sha256-v1';
+    digest: string;
+    actionCount: number;
+}
 interface TopoloCatalogSearchOptions {
     query?: string;
     cursor?: string;
@@ -249,6 +254,7 @@ declare class TopoloClient {
     searchActions(options: TopoloCatalogSearchOptions & {
         service: string;
     }): Promise<TopoloActionCatalogPage>;
+    getActionCatalogSummary(service: string): Promise<TopoloActionCatalogSummary>;
     /** @deprecated Prefer searchActions() so callers retain the continuation cursor. */
     listActions(options?: TopoloCatalogSearchOptions & {
         service: string;
@@ -279,6 +285,7 @@ declare class TopoloClient {
 }
 interface CredentialIntrospection {
     kind: 'api_key' | 'access_token';
+    authorizationMode: 'context_rbac' | 'oauth_scopes' | 'session_rbac' | 'api_key' | 'unknown';
     user: {
         id: string;
         email: string;
@@ -293,6 +300,24 @@ interface CredentialIntrospection {
     } | null;
 }
 
+declare const ACTION_CATALOG_DIGEST_ALGORITHM: "sha256-v1";
+interface TopoloActionDigestInput {
+    actionId?: string;
+    name: string;
+    method: string;
+    path: string;
+    permission?: string | null;
+    permissionName?: string | null;
+    authorizationMode?: string | null;
+    target?: string | null;
+    readOnly: boolean;
+    requiresConfirmation: boolean;
+    agentAccess?: string | null;
+    inputSchema: Record<string, unknown>;
+    outputSchema: Record<string, unknown>;
+}
+declare function digestTopoloActionCatalog(actions: TopoloActionDigestInput[], appId: string): Promise<string>;
+
 declare const APP_API_URLS: {
     readonly agent: "https://agent.topolo.app";
     readonly auth: "https://auth.topolo.app";
@@ -2136,4 +2161,4 @@ declare function createTopolo(options: TopoloClientOptions): {
 };
 type Topolo = ReturnType<typeof createTopolo>;
 
-export { APPLICATIONS, APPLICATION_REQUIREMENTS, APPLICATION_REQUIREMENTS_VERSION, type AgentIdentity, type AppApiId, type ApplicationCatalogEntry, type ApplicationDeployTarget, type ApplicationId, type ApplicationRequirement, type ApplicationRequirementAudit, type ApplicationRequirementFinding, type ApplicationRequirementMigrationItem, type ApplicationRequirementScope, type ApplicationRequirementScore, type ApplicationRequirementStatus, type ApplicationRequirementsAuditReport, type CredentialIntrospection, type CrmContactSummary, CrmModule, DEFAULT_APP_URLS, type DeviceAuthorizationResponse, IdentityModule, type ListContactsOptions, type ListContactsResult, type OAuthHelperOptions, type P2PActionDetail, type P2PActionRequestInput, type P2PActionRequestResult, type P2PActionRow, type P2PActionRun, type P2PCapability, type P2PConnection, type P2PHold, type P2PLedgerEntry, P2PModule, type P2PPolicy, type P2PPricingModel, type P2PSettlementBatch, type P2PSettlementGroup, type PublishCapabilityInput, type RequestOptions, type ServiceCatalogUrlEntry, TOPOLO_WIDGET_ENDPOINT, TOPOLO_WIDGET_REFRESH_INTERVAL_MS, type TokenResponse, type Topolo, type TopoloActionCatalogEntry, type TopoloApiKeyResourceMetadata, TopoloAuthError, type TopoloChartWidget, TopoloClient, type TopoloClientOptions, TopoloConfirmationRequiredError, type TopoloCredential, type TopoloDebugEvent, TopoloHttpError, type TopoloNotificationsWidget, TopoloOAuth, TopoloPermissionError, type TopoloQuickActionsWidget, type TopoloRecentActivityWidget, TopoloSdkError, type TopoloServiceCatalogEntry, type TopoloStatsWidget, type TopoloWidget, type TopoloWidgetActionItem, type TopoloWidgetActivityItem, type TopoloWidgetApiResponse, type TopoloWidgetBase, type TopoloWidgetConfig, type TopoloWidgetDraft, type TopoloWidgetMetric, type TopoloWidgetNotificationItem, type TopoloWidgetResponseOptions, type TopoloWidgetSnapshotMetadata, type TopoloWidgetSnapshotMetric, type TopoloWidgetType, type TopoloWidgetValidationResult, applicationRequirementScopes, auditAllApplicationRequirements, auditApplicationRequirements, createTopolo, createTopoloWidgetError, createTopoloWidgetResponse, defineTopoloChartWidget, defineTopoloNotificationsWidget, defineTopoloQuickActionsWidget, defineTopoloRecentActivityWidget, defineTopoloStatsWidget, requirementsForApplication, resolveCatalogServiceUrl, resolveServiceUrl, validateTopoloWidgetResponse };
+export { ACTION_CATALOG_DIGEST_ALGORITHM, APPLICATIONS, APPLICATION_REQUIREMENTS, APPLICATION_REQUIREMENTS_VERSION, type AgentIdentity, type AppApiId, type ApplicationCatalogEntry, type ApplicationDeployTarget, type ApplicationId, type ApplicationRequirement, type ApplicationRequirementAudit, type ApplicationRequirementFinding, type ApplicationRequirementMigrationItem, type ApplicationRequirementScope, type ApplicationRequirementScore, type ApplicationRequirementStatus, type ApplicationRequirementsAuditReport, type CredentialIntrospection, type CrmContactSummary, CrmModule, DEFAULT_APP_URLS, type DeviceAuthorizationResponse, IdentityModule, type ListContactsOptions, type ListContactsResult, type OAuthHelperOptions, type P2PActionDetail, type P2PActionRequestInput, type P2PActionRequestResult, type P2PActionRow, type P2PActionRun, type P2PCapability, type P2PConnection, type P2PHold, type P2PLedgerEntry, P2PModule, type P2PPolicy, type P2PPricingModel, type P2PSettlementBatch, type P2PSettlementGroup, type PublishCapabilityInput, type RequestOptions, type ServiceCatalogUrlEntry, TOPOLO_WIDGET_ENDPOINT, TOPOLO_WIDGET_REFRESH_INTERVAL_MS, type TokenResponse, type Topolo, type TopoloActionCatalogEntry, type TopoloActionCatalogSummary, type TopoloActionDigestInput, type TopoloApiKeyResourceMetadata, TopoloAuthError, type TopoloChartWidget, TopoloClient, type TopoloClientOptions, TopoloConfirmationRequiredError, type TopoloCredential, type TopoloDebugEvent, TopoloHttpError, type TopoloNotificationsWidget, TopoloOAuth, TopoloPermissionError, type TopoloQuickActionsWidget, type TopoloRecentActivityWidget, TopoloSdkError, type TopoloServiceCatalogEntry, type TopoloStatsWidget, type TopoloWidget, type TopoloWidgetActionItem, type TopoloWidgetActivityItem, type TopoloWidgetApiResponse, type TopoloWidgetBase, type TopoloWidgetConfig, type TopoloWidgetDraft, type TopoloWidgetMetric, type TopoloWidgetNotificationItem, type TopoloWidgetResponseOptions, type TopoloWidgetSnapshotMetadata, type TopoloWidgetSnapshotMetric, type TopoloWidgetType, type TopoloWidgetValidationResult, applicationRequirementScopes, auditAllApplicationRequirements, auditApplicationRequirements, createTopolo, createTopoloWidgetError, createTopoloWidgetResponse, defineTopoloChartWidget, defineTopoloNotificationsWidget, defineTopoloQuickActionsWidget, defineTopoloRecentActivityWidget, defineTopoloStatsWidget, digestTopoloActionCatalog, requirementsForApplication, resolveCatalogServiceUrl, resolveServiceUrl, validateTopoloWidgetResponse };

package/dist/index.d.ts

@@ -174,6 +174,11 @@ interface TopoloActionCatalogPage {
     actions: TopoloActionCatalogEntry[];
     page: TopoloCatalogPage;
 }
+interface TopoloActionCatalogSummary {
+    algorithm: 'sha256-v1';
+    digest: string;
+    actionCount: number;
+}
 interface TopoloCatalogSearchOptions {
     query?: string;
     cursor?: string;
@@ -249,6 +254,7 @@ declare class TopoloClient {
     searchActions(options: TopoloCatalogSearchOptions & {
         service: string;
     }): Promise<TopoloActionCatalogPage>;
+    getActionCatalogSummary(service: string): Promise<TopoloActionCatalogSummary>;
     /** @deprecated Prefer searchActions() so callers retain the continuation cursor. */
     listActions(options?: TopoloCatalogSearchOptions & {
         service: string;
@@ -279,6 +285,7 @@ declare class TopoloClient {
 }
 interface CredentialIntrospection {
     kind: 'api_key' | 'access_token';
+    authorizationMode: 'context_rbac' | 'oauth_scopes' | 'session_rbac' | 'api_key' | 'unknown';
     user: {
         id: string;
         email: string;
@@ -293,6 +300,24 @@ interface CredentialIntrospection {
     } | null;
 }
 
+declare const ACTION_CATALOG_DIGEST_ALGORITHM: "sha256-v1";
+interface TopoloActionDigestInput {
+    actionId?: string;
+    name: string;
+    method: string;
+    path: string;
+    permission?: string | null;
+    permissionName?: string | null;
+    authorizationMode?: string | null;
+    target?: string | null;
+    readOnly: boolean;
+    requiresConfirmation: boolean;
+    agentAccess?: string | null;
+    inputSchema: Record<string, unknown>;
+    outputSchema: Record<string, unknown>;
+}
+declare function digestTopoloActionCatalog(actions: TopoloActionDigestInput[], appId: string): Promise<string>;
+
 declare const APP_API_URLS: {
     readonly agent: "https://agent.topolo.app";
     readonly auth: "https://auth.topolo.app";
@@ -2136,4 +2161,4 @@ declare function createTopolo(options: TopoloClientOptions): {
 };
 type Topolo = ReturnType<typeof createTopolo>;
 
-export { APPLICATIONS, APPLICATION_REQUIREMENTS, APPLICATION_REQUIREMENTS_VERSION, type AgentIdentity, type AppApiId, type ApplicationCatalogEntry, type ApplicationDeployTarget, type ApplicationId, type ApplicationRequirement, type ApplicationRequirementAudit, type ApplicationRequirementFinding, type ApplicationRequirementMigrationItem, type ApplicationRequirementScope, type ApplicationRequirementScore, type ApplicationRequirementStatus, type ApplicationRequirementsAuditReport, type CredentialIntrospection, type CrmContactSummary, CrmModule, DEFAULT_APP_URLS, type DeviceAuthorizationResponse, IdentityModule, type ListContactsOptions, type ListContactsResult, type OAuthHelperOptions, type P2PActionDetail, type P2PActionRequestInput, type P2PActionRequestResult, type P2PActionRow, type P2PActionRun, type P2PCapability, type P2PConnection, type P2PHold, type P2PLedgerEntry, P2PModule, type P2PPolicy, type P2PPricingModel, type P2PSettlementBatch, type P2PSettlementGroup, type PublishCapabilityInput, type RequestOptions, type ServiceCatalogUrlEntry, TOPOLO_WIDGET_ENDPOINT, TOPOLO_WIDGET_REFRESH_INTERVAL_MS, type TokenResponse, type Topolo, type TopoloActionCatalogEntry, type TopoloApiKeyResourceMetadata, TopoloAuthError, type TopoloChartWidget, TopoloClient, type TopoloClientOptions, TopoloConfirmationRequiredError, type TopoloCredential, type TopoloDebugEvent, TopoloHttpError, type TopoloNotificationsWidget, TopoloOAuth, TopoloPermissionError, type TopoloQuickActionsWidget, type TopoloRecentActivityWidget, TopoloSdkError, type TopoloServiceCatalogEntry, type TopoloStatsWidget, type TopoloWidget, type TopoloWidgetActionItem, type TopoloWidgetActivityItem, type TopoloWidgetApiResponse, type TopoloWidgetBase, type TopoloWidgetConfig, type TopoloWidgetDraft, type TopoloWidgetMetric, type TopoloWidgetNotificationItem, type TopoloWidgetResponseOptions, type TopoloWidgetSnapshotMetadata, type TopoloWidgetSnapshotMetric, type TopoloWidgetType, type TopoloWidgetValidationResult, applicationRequirementScopes, auditAllApplicationRequirements, auditApplicationRequirements, createTopolo, createTopoloWidgetError, createTopoloWidgetResponse, defineTopoloChartWidget, defineTopoloNotificationsWidget, defineTopoloQuickActionsWidget, defineTopoloRecentActivityWidget, defineTopoloStatsWidget, requirementsForApplication, resolveCatalogServiceUrl, resolveServiceUrl, validateTopoloWidgetResponse };
+export { ACTION_CATALOG_DIGEST_ALGORITHM, APPLICATIONS, APPLICATION_REQUIREMENTS, APPLICATION_REQUIREMENTS_VERSION, type AgentIdentity, type AppApiId, type ApplicationCatalogEntry, type ApplicationDeployTarget, type ApplicationId, type ApplicationRequirement, type ApplicationRequirementAudit, type ApplicationRequirementFinding, type ApplicationRequirementMigrationItem, type ApplicationRequirementScope, type ApplicationRequirementScore, type ApplicationRequirementStatus, type ApplicationRequirementsAuditReport, type CredentialIntrospection, type CrmContactSummary, CrmModule, DEFAULT_APP_URLS, type DeviceAuthorizationResponse, IdentityModule, type ListContactsOptions, type ListContactsResult, type OAuthHelperOptions, type P2PActionDetail, type P2PActionRequestInput, type P2PActionRequestResult, type P2PActionRow, type P2PActionRun, type P2PCapability, type P2PConnection, type P2PHold, type P2PLedgerEntry, P2PModule, type P2PPolicy, type P2PPricingModel, type P2PSettlementBatch, type P2PSettlementGroup, type PublishCapabilityInput, type RequestOptions, type ServiceCatalogUrlEntry, TOPOLO_WIDGET_ENDPOINT, TOPOLO_WIDGET_REFRESH_INTERVAL_MS, type TokenResponse, type Topolo, type TopoloActionCatalogEntry, type TopoloActionCatalogSummary, type TopoloActionDigestInput, type TopoloApiKeyResourceMetadata, TopoloAuthError, type TopoloChartWidget, TopoloClient, type TopoloClientOptions, TopoloConfirmationRequiredError, type TopoloCredential, type TopoloDebugEvent, TopoloHttpError, type TopoloNotificationsWidget, TopoloOAuth, TopoloPermissionError, type TopoloQuickActionsWidget, type TopoloRecentActivityWidget, TopoloSdkError, type TopoloServiceCatalogEntry, type TopoloStatsWidget, type TopoloWidget, type TopoloWidgetActionItem, type TopoloWidgetActivityItem, type TopoloWidgetApiResponse, type TopoloWidgetBase, type TopoloWidgetConfig, type TopoloWidgetDraft, type TopoloWidgetMetric, type TopoloWidgetNotificationItem, type TopoloWidgetResponseOptions, type TopoloWidgetSnapshotMetadata, type TopoloWidgetSnapshotMetric, type TopoloWidgetType, type TopoloWidgetValidationResult, applicationRequirementScopes, auditAllApplicationRequirements, auditApplicationRequirements, createTopolo, createTopoloWidgetError, createTopoloWidgetResponse, defineTopoloChartWidget, defineTopoloNotificationsWidget, defineTopoloQuickActionsWidget, defineTopoloRecentActivityWidget, defineTopoloStatsWidget, digestTopoloActionCatalog, requirementsForApplication, resolveCatalogServiceUrl, resolveServiceUrl, validateTopoloWidgetResponse };

package/dist/index.js

@@ -2451,6 +2451,31 @@ var TopoloClient = class _TopoloClient {
       )
     };
   }
+  async getActionCatalogSummary(service) {
+    const boundedService = service.trim();
+    if (!boundedService) {
+      throw new TopoloSdkError("service_required", "service is required for bounded action discovery");
+    }
+    const res = await this.request({
+      service: "developers",
+      method: "GET",
+      path: "/api/actions/catalog",
+      query: { service: boundedService, summary: "true" }
+    });
+    const raw = res.data?.summary ?? res.summary;
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+      throw new TopoloSdkError("action_catalog_summary_unavailable", "Action catalog summary is unavailable.");
+    }
+    const record = raw;
+    if (record.algorithm !== "sha256-v1" || typeof record.digest !== "string" || !/^[a-f0-9]{64}$/.test(record.digest) || !Number.isSafeInteger(record.actionCount) || Number(record.actionCount) < 0) {
+      throw new TopoloSdkError("action_catalog_summary_unavailable", "Action catalog summary is invalid.");
+    }
+    return {
+      algorithm: "sha256-v1",
+      digest: record.digest,
+      actionCount: Number(record.actionCount)
+    };
+  }
   /** @deprecated Prefer searchActions() so callers retain the continuation cursor. */
   async listActions(options) {
     if (!options) {
@@ -2466,15 +2491,23 @@ var TopoloClient = class _TopoloClient {
         "action id is required"
       );
     }
-    const res = await this.request({
-      service: "developers",
-      method: "GET",
-      path: "/api/actions/catalog",
-      query: { actionId }
-    });
+    let res;
+    try {
+      res = await this.request({
+        service: "developers",
+        method: "GET",
+        path: "/api/actions/catalog",
+        query: { actionId }
+      });
+    } catch (error) {
+      if (error instanceof TopoloHttpError && error.status === 404) {
+        throw new TopoloSdkError("unknown_action", `Unknown or unavailable Topolo action "${action}".`);
+      }
+      throw error;
+    }
     const raw = res.data?.action ?? res.action;
     const match = normalizeActionCatalogEntry(raw);
-    if (!match) throw new TopoloSdkError("unknown_action", `Unknown Topolo action "${action}".`);
+    if (!match) throw new TopoloSdkError("unknown_action", `Unknown or unavailable Topolo action "${action}".`);
     return match;
   }
   async callAction(action, input = {}, options = {}) {
@@ -2550,6 +2583,7 @@ var TopoloClient = class _TopoloClient {
     const kind = payload.credentialType === "api_key" ? "api_key" : "access_token";
     return {
       kind,
+      authorizationMode: normalizeCredentialAuthorizationMode(payload.authorizationMode, kind),
       user: {
         id: user.id,
         email: user.email,
@@ -2812,6 +2846,11 @@ function objectToQuery(value) {
   }
   return Object.keys(query).length > 0 ? query : void 0;
 }
+function normalizeCredentialAuthorizationMode(value, kind) {
+  if (kind === "api_key") return "api_key";
+  if (value === "context_rbac" || value === "oauth_scopes" || value === "session_rbac") return value;
+  return "unknown";
+}
 function describeError(body, fallback) {
   if (body && typeof body === "object") {
     const maybe = body;
@@ -2847,6 +2886,40 @@ function mergeSignals(a, b) {
   return controller.signal;
 }
 
+// src/action-catalog-digest.ts
+var ACTION_CATALOG_DIGEST_ALGORITHM = "sha256-v1";
+function canonicalPermission(value, appId) {
+  let permission = String(value || "").trim().toLowerCase().replace(/\s+/g, "");
+  const prefix = `${String(appId || "").trim().toLowerCase()}.`;
+  if (prefix !== "." && permission.startsWith(prefix)) permission = permission.slice(prefix.length);
+  return permission.replace(/\./g, ":");
+}
+function stableJson(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    const record = value;
+    return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableJson(record[key])}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+async function digestTopoloActionCatalog(actions, appId) {
+  const canonical = actions.filter((action) => action.agentAccess !== "off").map((action) => ({
+    actionId: action.actionId || `${appId}.${action.name}`,
+    authorizationMode: action.authorizationMode === "runtime" ? "runtime" : "static",
+    inputSchema: action.inputSchema,
+    method: action.method,
+    outputSchema: action.outputSchema,
+    path: action.path,
+    permission: canonicalPermission(action.permission ?? action.permissionName ?? "", appId),
+    readOnly: action.readOnly,
+    requiresConfirmation: action.requiresConfirmation,
+    target: action.target ?? ""
+  })).sort((left, right) => left.actionId.localeCompare(right.actionId));
+  const bytes = new TextEncoder().encode(canonical.map(stableJson).join("\n"));
+  const digest = await crypto.subtle.digest("SHA-256", bytes);
+  return [...new Uint8Array(digest)].map((value) => value.toString(16).padStart(2, "0")).join("");
+}
+
 // src/modules/crm.ts
 var CrmModule = class {
   constructor(client) {
@@ -3371,6 +3444,7 @@ function createTopolo(options) {
   };
 }
 export {
+  ACTION_CATALOG_DIGEST_ALGORITHM,
   APPLICATIONS,
   APPLICATION_REQUIREMENTS,
   APPLICATION_REQUIREMENTS_VERSION,
@@ -3398,6 +3472,7 @@ export {
   defineTopoloQuickActionsWidget,
   defineTopoloRecentActivityWidget,
   defineTopoloStatsWidget,
+  digestTopoloActionCatalog,
   requirementsForApplication,
   resolveCatalogServiceUrl,
   resolveServiceUrl,