@topolo/sdk 0.9.2 → 0.9.3

package/dist/index.cjs

@@ -3309,6 +3309,7 @@ function normalizeActionCatalogEntry(item) {
     permissionName: pickActionString(a.permission_name) ?? pickActionString(a.permissionName) ?? "",
     requiredPermission: pickActionString(a.required_permission) ?? pickActionString(a.requiredPermission) ?? "",
     authorizationMode: pickAuthorizationMode(a.authorization_mode ?? a.authorizationMode),
+    allowedServices: stringArray(a.allowed_services ?? a.allowedServices),
     inputSchema: plainObject(a.input_schema ?? a.inputSchema),
     outputSchema: plainObject(a.output_schema ?? a.outputSchema),
     agentContract: plainObject(a.agent_contract ?? a.agentContract),
@@ -3330,7 +3331,7 @@ function pickAgentAccess(value) {
   return value === "auto" || value === "confirm" || value === "off" ? value : null;
 }
 function pickAuthorizationMode(value) {
-  return value === "runtime" ? "runtime" : "static";
+  return value === "runtime" || value === "public" || value === "service" ? value : "static";
 }
 function plainObject(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
@@ -3438,18 +3439,23 @@ function stableJson(value) {
   return JSON.stringify(value);
 }
 async function digestTopoloActionCatalog(actions, appId) {
-  const canonical = actions.filter((action) => action.agentAccess !== "off").map((action) => ({
-    actionId: action.actionId || `${appId}.${action.name}`,
-    authorizationMode: action.authorizationMode === "runtime" ? "runtime" : "static",
-    inputSchema: action.inputSchema,
-    method: action.method,
-    outputSchema: action.outputSchema,
-    path: action.path,
-    permission: canonicalPermission(action.permission ?? action.permissionName ?? "", appId),
-    readOnly: action.readOnly,
-    requiresConfirmation: action.requiresConfirmation,
-    target: action.target ?? ""
-  })).sort((left, right) => left.actionId.localeCompare(right.actionId));
+  const canonical = actions.filter((action) => action.agentAccess !== "off").map((action) => {
+    const authorizationMode = ["runtime", "public", "service"].includes(action.authorizationMode || "") ? action.authorizationMode : "static";
+    const allowedServices = [...action.allowedServices || []].map((service) => service.trim()).filter(Boolean).sort();
+    return {
+      actionId: action.actionId || `${appId}.${action.name}`,
+      authorizationMode,
+      ...authorizationMode === "service" ? { allowedServices } : {},
+      inputSchema: action.inputSchema,
+      method: action.method,
+      outputSchema: action.outputSchema,
+      path: action.path,
+      permission: canonicalPermission(action.permission ?? action.permissionName ?? "", appId),
+      readOnly: action.readOnly,
+      requiresConfirmation: action.requiresConfirmation,
+      target: action.target ?? ""
+    };
+  }).sort((left, right) => left.actionId.localeCompare(right.actionId));
   const bytes = new TextEncoder().encode(canonical.map(stableJson).join("\n"));
   const digest = await crypto.subtle.digest("SHA-256", bytes);
   return [...new Uint8Array(digest)].map((value) => value.toString(16).padStart(2, "0")).join("");

package/dist/index.d.cts

@@ -188,8 +188,9 @@ interface TopoloActionCatalogEntry {
     path: string;
     permissionName: string;
     requiredPermission: string;
-    /** Static catalog permission or target-enforced input-dependent authorization. */
-    authorizationMode?: 'static' | 'runtime';
+    /** Static RBAC, contextual runtime policy, or an explicit public/service exception. */
+    authorizationMode?: 'static' | 'runtime' | 'public' | 'service';
+    allowedServices?: string[];
     inputSchema: Record<string, unknown>;
     outputSchema: Record<string, unknown>;
     agentContract?: TopoloActionAgentContract;
@@ -425,6 +426,7 @@ interface TopoloActionDigestInput {
     permission?: string | null;
     permissionName?: string | null;
     authorizationMode?: string | null;
+    allowedServices?: string[] | null;
     target?: string | null;
     readOnly: boolean;
     requiresConfirmation: boolean;

package/dist/index.d.ts

@@ -188,8 +188,9 @@ interface TopoloActionCatalogEntry {
     path: string;
     permissionName: string;
     requiredPermission: string;
-    /** Static catalog permission or target-enforced input-dependent authorization. */
-    authorizationMode?: 'static' | 'runtime';
+    /** Static RBAC, contextual runtime policy, or an explicit public/service exception. */
+    authorizationMode?: 'static' | 'runtime' | 'public' | 'service';
+    allowedServices?: string[];
     inputSchema: Record<string, unknown>;
     outputSchema: Record<string, unknown>;
     agentContract?: TopoloActionAgentContract;
@@ -425,6 +426,7 @@ interface TopoloActionDigestInput {
     permission?: string | null;
     permissionName?: string | null;
     authorizationMode?: string | null;
+    allowedServices?: string[] | null;
     target?: string | null;
     readOnly: boolean;
     requiresConfirmation: boolean;

package/dist/index.js

@@ -3250,6 +3250,7 @@ function normalizeActionCatalogEntry(item) {
     permissionName: pickActionString(a.permission_name) ?? pickActionString(a.permissionName) ?? "",
     requiredPermission: pickActionString(a.required_permission) ?? pickActionString(a.requiredPermission) ?? "",
     authorizationMode: pickAuthorizationMode(a.authorization_mode ?? a.authorizationMode),
+    allowedServices: stringArray(a.allowed_services ?? a.allowedServices),
     inputSchema: plainObject(a.input_schema ?? a.inputSchema),
     outputSchema: plainObject(a.output_schema ?? a.outputSchema),
     agentContract: plainObject(a.agent_contract ?? a.agentContract),
@@ -3271,7 +3272,7 @@ function pickAgentAccess(value) {
   return value === "auto" || value === "confirm" || value === "off" ? value : null;
 }
 function pickAuthorizationMode(value) {
-  return value === "runtime" ? "runtime" : "static";
+  return value === "runtime" || value === "public" || value === "service" ? value : "static";
 }
 function plainObject(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
@@ -3379,18 +3380,23 @@ function stableJson(value) {
   return JSON.stringify(value);
 }
 async function digestTopoloActionCatalog(actions, appId) {
-  const canonical = actions.filter((action) => action.agentAccess !== "off").map((action) => ({
-    actionId: action.actionId || `${appId}.${action.name}`,
-    authorizationMode: action.authorizationMode === "runtime" ? "runtime" : "static",
-    inputSchema: action.inputSchema,
-    method: action.method,
-    outputSchema: action.outputSchema,
-    path: action.path,
-    permission: canonicalPermission(action.permission ?? action.permissionName ?? "", appId),
-    readOnly: action.readOnly,
-    requiresConfirmation: action.requiresConfirmation,
-    target: action.target ?? ""
-  })).sort((left, right) => left.actionId.localeCompare(right.actionId));
+  const canonical = actions.filter((action) => action.agentAccess !== "off").map((action) => {
+    const authorizationMode = ["runtime", "public", "service"].includes(action.authorizationMode || "") ? action.authorizationMode : "static";
+    const allowedServices = [...action.allowedServices || []].map((service) => service.trim()).filter(Boolean).sort();
+    return {
+      actionId: action.actionId || `${appId}.${action.name}`,
+      authorizationMode,
+      ...authorizationMode === "service" ? { allowedServices } : {},
+      inputSchema: action.inputSchema,
+      method: action.method,
+      outputSchema: action.outputSchema,
+      path: action.path,
+      permission: canonicalPermission(action.permission ?? action.permissionName ?? "", appId),
+      readOnly: action.readOnly,
+      requiresConfirmation: action.requiresConfirmation,
+      target: action.target ?? ""
+    };
+  }).sort((left, right) => left.actionId.localeCompare(right.actionId));
   const bytes = new TextEncoder().encode(canonical.map(stableJson).join("\n"));
   const digest = await crypto.subtle.digest("SHA-256", bytes);
   return [...new Uint8Array(digest)].map((value) => value.toString(16).padStart(2, "0")).join("");

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@topolo/sdk",
-  "version": "0.9.2",
-  "topoloPublishedVersion": "0.9.2",
+  "version": "0.9.3",
+  "topoloPublishedVersion": "0.9.3",
   "description": "Typed client SDK for the Topolo platform. Used by TopoloCli, TopoloMCP, and third-party agents.",
   "type": "module",
   "main": "./dist/index.js",
@@ -23,16 +23,13 @@
     "dist"
   ],
   "scripts": {
-    "generate:services": "node scripts/generate-services.mjs",
-    "check:generated": "node scripts/check-generated.mjs",
-    "prebuild": "node scripts/generate-services.mjs",
+    "check:generated": "git diff --exit-code -- src/services.generated.ts src/applications.generated.ts",
     "build": "tsup src/index.ts --format esm,cjs --dts --clean && tsup src/node/credential-store.ts --format esm,cjs --dts --out-dir dist/node",
     "dev": "tsup src/index.ts --format esm,cjs --dts --watch",
-    "typecheck": "node scripts/generate-services.mjs && tsc --noEmit",
+    "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",
-    "prepublishOnly": "npm run build && npm run verify:package",
-    "verify:package": "node ../../tooling/verify-npm-package.mjs .",
+    "prepublishOnly": "npm run build",
     "coverage": "vitest run --coverage"
   },
   "devDependencies": {