@topolo/sdk 0.9.1 → 0.9.3

package/dist/index.cjs

@@ -127,6 +127,7 @@ var APP_API_URLS = {
   auth: "https://auth.topolo.app",
   backup: "https://backup.topolo.app",
   books: "https://books.topolo.app",
+  brand: "https://brand.topolo.app",
   bugfix: "https://bugfix.topolo.app",
   bytes: "https://bytes.topolo.app",
   calendar: "https://calendar.topolo.app",
@@ -309,6 +310,38 @@ var APPLICATIONS = {
       }
     ]
   },
+  "brand": {
+    "id": "brand",
+    "appDir": "TopoloBrand",
+    "name": "topolo-brand",
+    "packageName": "@topolo/topolo-brand",
+    "productionUrl": "https://brand.topolo.app",
+    "services": [
+      "brand"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-brand",
+        "kind": "worker",
+        "apiUrl": "https://brand.topolo.app",
+        "domains": [
+          "brand.topolo.app"
+        ],
+        "routes": [
+          "brand.topolo.app"
+        ],
+        "appId": "brand"
+      },
+      {
+        "name": "topolo-brand-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
   "bugfix": {
     "id": "bugfix",
     "appDir": "TopoloBugFix",
@@ -2431,6 +2464,8 @@ var TopoloClient = class _TopoloClient {
   requireConfirmForWrites;
   timeoutMs;
   fetchImpl;
+  credentialProvider;
+  credentialLoadInFlight = null;
   refreshCredential;
   refreshInFlight = null;
   debug;
@@ -2458,6 +2493,7 @@ var TopoloClient = class _TopoloClient {
     this.requireConfirmForWrites = options.requireConfirmForWrites !== false;
     this.timeoutMs = options.timeoutMs ?? 3e4;
     this.fetchImpl = options.fetch ?? fetch;
+    this.credentialProvider = options.credentialProvider;
     this.refreshCredential = options.refreshCredential;
     this.debug = options.debug;
   }
@@ -2480,6 +2516,7 @@ var TopoloClient = class _TopoloClient {
         `Mutating ${method} requests require { confirm: true }. This guardrail prevents agents from issuing writes without an explicit human-in-the-loop acknowledgement.`
       );
     }
+    await this.loadCurrentCredential();
     const resolvedService = opts.baseUrl ? { serviceKey: normalizeLookupKey(opts.service), baseUrl: requireHttpOrigin(opts.baseUrl) } : await this.resolveRequestService(opts.service);
     const baseUrl = resolvedService.baseUrl;
     const url = new URL(opts.path, baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`);
@@ -2591,6 +2628,19 @@ var TopoloClient = class _TopoloClient {
     });
     return parsed;
   }
+  async loadCurrentCredential() {
+    if (!this.credentialProvider) return;
+    this.credentialLoadInFlight ??= this.credentialProvider().then((credential) => {
+      if (!credential) {
+        throw new TopoloAuthError("The configured Topolo credential is no longer available.");
+      }
+      this.credential = credential;
+      return credential;
+    }).finally(() => {
+      this.credentialLoadInFlight = null;
+    });
+    await this.credentialLoadInFlight;
+  }
   async refreshRejectedAccessToken(attemptedAccessToken) {
     if (this.credential.kind === "access_token" && this.credential.accessToken !== attemptedAccessToken) {
       return this.credential;
@@ -3259,6 +3309,7 @@ function normalizeActionCatalogEntry(item) {
     permissionName: pickActionString(a.permission_name) ?? pickActionString(a.permissionName) ?? "",
     requiredPermission: pickActionString(a.required_permission) ?? pickActionString(a.requiredPermission) ?? "",
     authorizationMode: pickAuthorizationMode(a.authorization_mode ?? a.authorizationMode),
+    allowedServices: stringArray(a.allowed_services ?? a.allowedServices),
     inputSchema: plainObject(a.input_schema ?? a.inputSchema),
     outputSchema: plainObject(a.output_schema ?? a.outputSchema),
     agentContract: plainObject(a.agent_contract ?? a.agentContract),
@@ -3280,7 +3331,7 @@ function pickAgentAccess(value) {
   return value === "auto" || value === "confirm" || value === "off" ? value : null;
 }
 function pickAuthorizationMode(value) {
-  return value === "runtime" ? "runtime" : "static";
+  return value === "runtime" || value === "public" || value === "service" ? value : "static";
 }
 function plainObject(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
@@ -3388,18 +3439,23 @@ function stableJson(value) {
   return JSON.stringify(value);
 }
 async function digestTopoloActionCatalog(actions, appId) {
-  const canonical = actions.filter((action) => action.agentAccess !== "off").map((action) => ({
-    actionId: action.actionId || `${appId}.${action.name}`,
-    authorizationMode: action.authorizationMode === "runtime" ? "runtime" : "static",
-    inputSchema: action.inputSchema,
-    method: action.method,
-    outputSchema: action.outputSchema,
-    path: action.path,
-    permission: canonicalPermission(action.permission ?? action.permissionName ?? "", appId),
-    readOnly: action.readOnly,
-    requiresConfirmation: action.requiresConfirmation,
-    target: action.target ?? ""
-  })).sort((left, right) => left.actionId.localeCompare(right.actionId));
+  const canonical = actions.filter((action) => action.agentAccess !== "off").map((action) => {
+    const authorizationMode = ["runtime", "public", "service"].includes(action.authorizationMode || "") ? action.authorizationMode : "static";
+    const allowedServices = [...action.allowedServices || []].map((service) => service.trim()).filter(Boolean).sort();
+    return {
+      actionId: action.actionId || `${appId}.${action.name}`,
+      authorizationMode,
+      ...authorizationMode === "service" ? { allowedServices } : {},
+      inputSchema: action.inputSchema,
+      method: action.method,
+      outputSchema: action.outputSchema,
+      path: action.path,
+      permission: canonicalPermission(action.permission ?? action.permissionName ?? "", appId),
+      readOnly: action.readOnly,
+      requiresConfirmation: action.requiresConfirmation,
+      target: action.target ?? ""
+    };
+  }).sort((left, right) => left.actionId.localeCompare(right.actionId));
   const bytes = new TextEncoder().encode(canonical.map(stableJson).join("\n"));
   const digest = await crypto.subtle.digest("SHA-256", bytes);
   return [...new Uint8Array(digest)].map((value) => value.toString(16).padStart(2, "0")).join("");

package/dist/index.d.cts

@@ -58,6 +58,12 @@ interface TopoloClientOptions {
     timeoutMs?: number;
     /** Injected fetch, for testing. Defaults to global fetch. */
     fetch?: typeof fetch;
+    /**
+     * Load the credential currently stored for this client before each request.
+     * Long-lived hosts use this to adopt context reauthentication and claim
+     * changes without waiting for the previous token to fail with a 401.
+     */
+    credentialProvider?: () => Promise<TopoloCredential | null>;
     /**
      * Refresh a rejected access-token credential. When supplied, the client
      * retries one 401 response with the returned credential. Concurrent 401s
@@ -182,8 +188,9 @@ interface TopoloActionCatalogEntry {
     path: string;
     permissionName: string;
     requiredPermission: string;
-    /** Static catalog permission or target-enforced input-dependent authorization. */
-    authorizationMode?: 'static' | 'runtime';
+    /** Static RBAC, contextual runtime policy, or an explicit public/service exception. */
+    authorizationMode?: 'static' | 'runtime' | 'public' | 'service';
+    allowedServices?: string[];
     inputSchema: Record<string, unknown>;
     outputSchema: Record<string, unknown>;
     agentContract?: TopoloActionAgentContract;
@@ -270,6 +277,8 @@ declare class TopoloClient {
     private readonly requireConfirmForWrites;
     private readonly timeoutMs;
     private readonly fetchImpl;
+    private readonly credentialProvider?;
+    private credentialLoadInFlight;
     private readonly refreshCredential?;
     private refreshInFlight;
     private readonly debug?;
@@ -293,6 +302,7 @@ declare class TopoloClient {
      * use and for the generic `topolo api` / MCP passthrough tool.
      */
     request<T = unknown>(opts: RequestOptions): Promise<T>;
+    private loadCurrentCredential;
     private refreshRejectedAccessToken;
     private resolveRequestService;
     private resolveLiveCallableService;
@@ -416,6 +426,7 @@ interface TopoloActionDigestInput {
     permission?: string | null;
     permissionName?: string | null;
     authorizationMode?: string | null;
+    allowedServices?: string[] | null;
     target?: string | null;
     readOnly: boolean;
     requiresConfirmation: boolean;
@@ -430,6 +441,7 @@ declare const APP_API_URLS: {
     readonly auth: "https://auth.topolo.app";
     readonly backup: "https://backup.topolo.app";
     readonly books: "https://books.topolo.app";
+    readonly brand: "https://brand.topolo.app";
     readonly bugfix: "https://bugfix.topolo.app";
     readonly bytes: "https://bytes.topolo.app";
     readonly calendar: "https://calendar.topolo.app";
@@ -579,6 +591,29 @@ declare const APPLICATIONS: {
             readonly appId: null;
         }];
     };
+    readonly brand: {
+        readonly id: "brand";
+        readonly appDir: "TopoloBrand";
+        readonly name: "topolo-brand";
+        readonly packageName: "@topolo/topolo-brand";
+        readonly productionUrl: "https://brand.topolo.app";
+        readonly services: readonly ["brand"];
+        readonly deployTargets: readonly [{
+            readonly name: "topolo-brand";
+            readonly kind: "worker";
+            readonly apiUrl: "https://brand.topolo.app";
+            readonly domains: readonly ["brand.topolo.app"];
+            readonly routes: readonly ["brand.topolo.app"];
+            readonly appId: "brand";
+        }, {
+            readonly name: "topolo-brand-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly appId: null;
+        }];
+    };
     readonly bugfix: {
         readonly id: "bugfix";
         readonly appDir: "TopoloBugFix";

package/dist/index.d.ts

@@ -58,6 +58,12 @@ interface TopoloClientOptions {
     timeoutMs?: number;
     /** Injected fetch, for testing. Defaults to global fetch. */
     fetch?: typeof fetch;
+    /**
+     * Load the credential currently stored for this client before each request.
+     * Long-lived hosts use this to adopt context reauthentication and claim
+     * changes without waiting for the previous token to fail with a 401.
+     */
+    credentialProvider?: () => Promise<TopoloCredential | null>;
     /**
      * Refresh a rejected access-token credential. When supplied, the client
      * retries one 401 response with the returned credential. Concurrent 401s
@@ -182,8 +188,9 @@ interface TopoloActionCatalogEntry {
     path: string;
     permissionName: string;
     requiredPermission: string;
-    /** Static catalog permission or target-enforced input-dependent authorization. */
-    authorizationMode?: 'static' | 'runtime';
+    /** Static RBAC, contextual runtime policy, or an explicit public/service exception. */
+    authorizationMode?: 'static' | 'runtime' | 'public' | 'service';
+    allowedServices?: string[];
     inputSchema: Record<string, unknown>;
     outputSchema: Record<string, unknown>;
     agentContract?: TopoloActionAgentContract;
@@ -270,6 +277,8 @@ declare class TopoloClient {
     private readonly requireConfirmForWrites;
     private readonly timeoutMs;
     private readonly fetchImpl;
+    private readonly credentialProvider?;
+    private credentialLoadInFlight;
     private readonly refreshCredential?;
     private refreshInFlight;
     private readonly debug?;
@@ -293,6 +302,7 @@ declare class TopoloClient {
      * use and for the generic `topolo api` / MCP passthrough tool.
      */
     request<T = unknown>(opts: RequestOptions): Promise<T>;
+    private loadCurrentCredential;
     private refreshRejectedAccessToken;
     private resolveRequestService;
     private resolveLiveCallableService;
@@ -416,6 +426,7 @@ interface TopoloActionDigestInput {
     permission?: string | null;
     permissionName?: string | null;
     authorizationMode?: string | null;
+    allowedServices?: string[] | null;
     target?: string | null;
     readOnly: boolean;
     requiresConfirmation: boolean;
@@ -430,6 +441,7 @@ declare const APP_API_URLS: {
     readonly auth: "https://auth.topolo.app";
     readonly backup: "https://backup.topolo.app";
     readonly books: "https://books.topolo.app";
+    readonly brand: "https://brand.topolo.app";
     readonly bugfix: "https://bugfix.topolo.app";
     readonly bytes: "https://bytes.topolo.app";
     readonly calendar: "https://calendar.topolo.app";
@@ -579,6 +591,29 @@ declare const APPLICATIONS: {
             readonly appId: null;
         }];
     };
+    readonly brand: {
+        readonly id: "brand";
+        readonly appDir: "TopoloBrand";
+        readonly name: "topolo-brand";
+        readonly packageName: "@topolo/topolo-brand";
+        readonly productionUrl: "https://brand.topolo.app";
+        readonly services: readonly ["brand"];
+        readonly deployTargets: readonly [{
+            readonly name: "topolo-brand";
+            readonly kind: "worker";
+            readonly apiUrl: "https://brand.topolo.app";
+            readonly domains: readonly ["brand.topolo.app"];
+            readonly routes: readonly ["brand.topolo.app"];
+            readonly appId: "brand";
+        }, {
+            readonly name: "topolo-brand-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly appId: null;
+        }];
+    };
     readonly bugfix: {
         readonly id: "bugfix";
         readonly appDir: "TopoloBugFix";

package/dist/index.js

@@ -68,6 +68,7 @@ var APP_API_URLS = {
   auth: "https://auth.topolo.app",
   backup: "https://backup.topolo.app",
   books: "https://books.topolo.app",
+  brand: "https://brand.topolo.app",
   bugfix: "https://bugfix.topolo.app",
   bytes: "https://bytes.topolo.app",
   calendar: "https://calendar.topolo.app",
@@ -250,6 +251,38 @@ var APPLICATIONS = {
       }
     ]
   },
+  "brand": {
+    "id": "brand",
+    "appDir": "TopoloBrand",
+    "name": "topolo-brand",
+    "packageName": "@topolo/topolo-brand",
+    "productionUrl": "https://brand.topolo.app",
+    "services": [
+      "brand"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-brand",
+        "kind": "worker",
+        "apiUrl": "https://brand.topolo.app",
+        "domains": [
+          "brand.topolo.app"
+        ],
+        "routes": [
+          "brand.topolo.app"
+        ],
+        "appId": "brand"
+      },
+      {
+        "name": "topolo-brand-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
   "bugfix": {
     "id": "bugfix",
     "appDir": "TopoloBugFix",
@@ -2372,6 +2405,8 @@ var TopoloClient = class _TopoloClient {
   requireConfirmForWrites;
   timeoutMs;
   fetchImpl;
+  credentialProvider;
+  credentialLoadInFlight = null;
   refreshCredential;
   refreshInFlight = null;
   debug;
@@ -2399,6 +2434,7 @@ var TopoloClient = class _TopoloClient {
     this.requireConfirmForWrites = options.requireConfirmForWrites !== false;
     this.timeoutMs = options.timeoutMs ?? 3e4;
     this.fetchImpl = options.fetch ?? fetch;
+    this.credentialProvider = options.credentialProvider;
     this.refreshCredential = options.refreshCredential;
     this.debug = options.debug;
   }
@@ -2421,6 +2457,7 @@ var TopoloClient = class _TopoloClient {
         `Mutating ${method} requests require { confirm: true }. This guardrail prevents agents from issuing writes without an explicit human-in-the-loop acknowledgement.`
       );
     }
+    await this.loadCurrentCredential();
     const resolvedService = opts.baseUrl ? { serviceKey: normalizeLookupKey(opts.service), baseUrl: requireHttpOrigin(opts.baseUrl) } : await this.resolveRequestService(opts.service);
     const baseUrl = resolvedService.baseUrl;
     const url = new URL(opts.path, baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`);
@@ -2532,6 +2569,19 @@ var TopoloClient = class _TopoloClient {
     });
     return parsed;
   }
+  async loadCurrentCredential() {
+    if (!this.credentialProvider) return;
+    this.credentialLoadInFlight ??= this.credentialProvider().then((credential) => {
+      if (!credential) {
+        throw new TopoloAuthError("The configured Topolo credential is no longer available.");
+      }
+      this.credential = credential;
+      return credential;
+    }).finally(() => {
+      this.credentialLoadInFlight = null;
+    });
+    await this.credentialLoadInFlight;
+  }
   async refreshRejectedAccessToken(attemptedAccessToken) {
     if (this.credential.kind === "access_token" && this.credential.accessToken !== attemptedAccessToken) {
       return this.credential;
@@ -3200,6 +3250,7 @@ function normalizeActionCatalogEntry(item) {
     permissionName: pickActionString(a.permission_name) ?? pickActionString(a.permissionName) ?? "",
     requiredPermission: pickActionString(a.required_permission) ?? pickActionString(a.requiredPermission) ?? "",
     authorizationMode: pickAuthorizationMode(a.authorization_mode ?? a.authorizationMode),
+    allowedServices: stringArray(a.allowed_services ?? a.allowedServices),
     inputSchema: plainObject(a.input_schema ?? a.inputSchema),
     outputSchema: plainObject(a.output_schema ?? a.outputSchema),
     agentContract: plainObject(a.agent_contract ?? a.agentContract),
@@ -3221,7 +3272,7 @@ function pickAgentAccess(value) {
   return value === "auto" || value === "confirm" || value === "off" ? value : null;
 }
 function pickAuthorizationMode(value) {
-  return value === "runtime" ? "runtime" : "static";
+  return value === "runtime" || value === "public" || value === "service" ? value : "static";
 }
 function plainObject(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
@@ -3329,18 +3380,23 @@ function stableJson(value) {
   return JSON.stringify(value);
 }
 async function digestTopoloActionCatalog(actions, appId) {
-  const canonical = actions.filter((action) => action.agentAccess !== "off").map((action) => ({
-    actionId: action.actionId || `${appId}.${action.name}`,
-    authorizationMode: action.authorizationMode === "runtime" ? "runtime" : "static",
-    inputSchema: action.inputSchema,
-    method: action.method,
-    outputSchema: action.outputSchema,
-    path: action.path,
-    permission: canonicalPermission(action.permission ?? action.permissionName ?? "", appId),
-    readOnly: action.readOnly,
-    requiresConfirmation: action.requiresConfirmation,
-    target: action.target ?? ""
-  })).sort((left, right) => left.actionId.localeCompare(right.actionId));
+  const canonical = actions.filter((action) => action.agentAccess !== "off").map((action) => {
+    const authorizationMode = ["runtime", "public", "service"].includes(action.authorizationMode || "") ? action.authorizationMode : "static";
+    const allowedServices = [...action.allowedServices || []].map((service) => service.trim()).filter(Boolean).sort();
+    return {
+      actionId: action.actionId || `${appId}.${action.name}`,
+      authorizationMode,
+      ...authorizationMode === "service" ? { allowedServices } : {},
+      inputSchema: action.inputSchema,
+      method: action.method,
+      outputSchema: action.outputSchema,
+      path: action.path,
+      permission: canonicalPermission(action.permission ?? action.permissionName ?? "", appId),
+      readOnly: action.readOnly,
+      requiresConfirmation: action.requiresConfirmation,
+      target: action.target ?? ""
+    };
+  }).sort((left, right) => left.actionId.localeCompare(right.actionId));
   const bytes = new TextEncoder().encode(canonical.map(stableJson).join("\n"));
   const digest = await crypto.subtle.digest("SHA-256", bytes);
   return [...new Uint8Array(digest)].map((value) => value.toString(16).padStart(2, "0")).join("");

package/dist/node/credential-store.cjs

@@ -84,6 +84,7 @@ var APP_API_URLS = {
   auth: "https://auth.topolo.app",
   backup: "https://backup.topolo.app",
   books: "https://books.topolo.app",
+  brand: "https://brand.topolo.app",
   bugfix: "https://bugfix.topolo.app",
   bytes: "https://bytes.topolo.app",
   calendar: "https://calendar.topolo.app",

package/dist/node/credential-store.js

@@ -40,6 +40,7 @@ var APP_API_URLS = {
   auth: "https://auth.topolo.app",
   backup: "https://backup.topolo.app",
   books: "https://books.topolo.app",
+  brand: "https://brand.topolo.app",
   bugfix: "https://bugfix.topolo.app",
   bytes: "https://bytes.topolo.app",
   calendar: "https://calendar.topolo.app",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@topolo/sdk",
-  "version": "0.9.1",
-  "topoloPublishedVersion": "0.9.1",
+  "version": "0.9.3",
+  "topoloPublishedVersion": "0.9.3",
   "description": "Typed client SDK for the Topolo platform. Used by TopoloCli, TopoloMCP, and third-party agents.",
   "type": "module",
   "main": "./dist/index.js",
@@ -23,16 +23,13 @@
     "dist"
   ],
   "scripts": {
-    "generate:services": "node scripts/generate-services.mjs",
-    "check:generated": "node scripts/check-generated.mjs",
-    "prebuild": "node scripts/generate-services.mjs",
+    "check:generated": "git diff --exit-code -- src/services.generated.ts src/applications.generated.ts",
     "build": "tsup src/index.ts --format esm,cjs --dts --clean && tsup src/node/credential-store.ts --format esm,cjs --dts --out-dir dist/node",
     "dev": "tsup src/index.ts --format esm,cjs --dts --watch",
-    "typecheck": "node scripts/generate-services.mjs && tsc --noEmit",
+    "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",
-    "prepublishOnly": "npm run build && npm run verify:package",
-    "verify:package": "node ../../tooling/verify-npm-package.mjs .",
+    "prepublishOnly": "npm run build",
     "coverage": "vitest run --coverage"
   },
   "devDependencies": {