@topolo/sdk 0.9.7 → 0.9.9

package/dist/index.cjs

@@ -51,6 +51,9 @@ __export(index_exports, {
   defineTopoloStatsWidget: () => defineTopoloStatsWidget,
   digestTopoloActionCatalog: () => digestTopoloActionCatalog,
   enrichActionContract: () => enrichActionContract,
+  parseTopoloActionUploadContract: () => parseTopoloActionUploadContract,
+  prepareTopoloActionBase64UploadInput: () => prepareTopoloActionBase64UploadInput,
+  prepareTopoloActionUploadInput: () => prepareTopoloActionUploadInput,
   requirementsForApplication: () => requirementsForApplication,
   resolveCatalogServiceUrl: () => resolveCatalogServiceUrl,
   resolveServiceUrl: () => resolveServiceUrl,
@@ -89,19 +92,54 @@ var TopoloSdkError = class extends Error {
   }
 };
 var TopoloAuthError = class extends TopoloSdkError {
-  constructor(message, code = "auth_error") {
+  status;
+  body;
+  service;
+  path;
+  requestId;
+  retryAfter;
+  constructor(message, code = "auth_error", options = {}) {
     super(code, message);
     this.name = "TopoloAuthError";
+    this.status = options.status ?? 401;
+    this.body = options.body;
+    this.service = options.service;
+    this.path = options.path;
+    this.requestId = options.requestId;
+    this.retryAfter = options.retryAfter;
   }
 };
 var TopoloPermissionError = class extends TopoloSdkError {
   required;
-  constructor(message, required) {
+  status;
+  body;
+  service;
+  path;
+  requestId;
+  retryAfter;
+  constructor(message, required, options = {}) {
     super("permission_denied", message);
     this.name = "TopoloPermissionError";
     this.required = required;
+    this.status = options.status ?? 403;
+    this.body = options.body;
+    this.service = options.service;
+    this.path = options.path;
+    this.requestId = options.requestId;
+    this.retryAfter = options.retryAfter;
   }
 };
+function extractHttpErrorCode(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return "http_error";
+  const record = body;
+  if (typeof record.code === "string" && record.code.trim()) return record.code.trim();
+  const nested = record.error;
+  if (nested && typeof nested === "object" && !Array.isArray(nested)) {
+    const code = nested.code;
+    if (typeof code === "string" && code.trim()) return code.trim();
+  }
+  return "http_error";
+}
 var TopoloConfirmationRequiredError = class extends TopoloSdkError {
   constructor(message) {
     super("confirmation_required", message);
@@ -113,13 +151,17 @@ var TopoloHttpError = class extends TopoloSdkError {
   body;
   service;
   path;
-  constructor(service, path, status, body, message) {
-    super("http_error", message ?? `HTTP ${status} from ${service}${path}`);
+  requestId;
+  retryAfter;
+  constructor(service, path, status, body, message, options = {}) {
+    super(extractHttpErrorCode(body), message ?? `HTTP ${status} from ${service}${path}`);
     this.name = "TopoloHttpError";
     this.status = status;
     this.body = body;
     this.service = service;
     this.path = path;
+    this.requestId = options.requestId;
+    this.retryAfter = options.retryAfter;
   }
 };
 
@@ -128,6 +170,7 @@ var APP_API_URLS = {
   agent: "https://agent.topolo.app",
   auth: "https://auth.topolo.app",
   backup: "https://backup.topolo.app",
+  blog: "https://blog.topolo.app",
   books: "https://books.topolo.app",
   brand: "https://brand.topolo.app",
   bugfix: "https://bugfix.topolo.app",
@@ -140,6 +183,7 @@ var APP_API_URLS = {
   compose: "https://compose.topolo.app",
   consent: "https://consent.topolo.app",
   crm: "https://crm.topolo.app",
+  design: "https://design.topolo.app",
   developers: "https://developers.topolo.app",
   director: "https://director.topolo.app",
   feed: "https://feed.topolo.app",
@@ -225,7 +269,9 @@ var APPLICATIONS = {
         "domains": [
           "agent.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "agent.topolo.app"
+        ],
         "appId": "agent"
       },
       {
@@ -286,6 +332,38 @@ var APPLICATIONS = {
       }
     ]
   },
+  "blog": {
+    "id": "blog",
+    "appDir": "TopoloBlog",
+    "name": "topolo-blog",
+    "packageName": "topolo-blog",
+    "productionUrl": "https://blog.topolo.app",
+    "services": [
+      "blog"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-blog",
+        "kind": "worker",
+        "apiUrl": "https://blog.topolo.app",
+        "domains": [
+          "blog.topolo.app"
+        ],
+        "routes": [
+          "blog.topolo.app"
+        ],
+        "appId": "blog"
+      },
+      {
+        "name": "topolo-blog-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
   "books": {
     "id": "books",
     "appDir": "TopoloBooks",
@@ -303,7 +381,9 @@ var APPLICATIONS = {
         "domains": [
           "books.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "books.topolo.app"
+        ],
         "appId": "books"
       },
       {
@@ -333,7 +413,9 @@ var APPLICATIONS = {
         "domains": [
           "brand.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "brand.topolo.app"
+        ],
         "appId": "brand"
       },
       {
@@ -451,7 +533,9 @@ var APPLICATIONS = {
         "domains": [
           "campaigns.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "campaigns.topolo.app"
+        ],
         "appId": "campaigns"
       },
       {
@@ -505,7 +589,9 @@ var APPLICATIONS = {
         "domains": [
           "chat.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "chat.topolo.app"
+        ],
         "appId": "chat"
       },
       {
@@ -591,7 +677,9 @@ var APPLICATIONS = {
         "domains": [
           "compose.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "compose.topolo.app"
+        ],
         "appId": "compose"
       },
       {
@@ -621,7 +709,9 @@ var APPLICATIONS = {
         "domains": [
           "consent.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "consent.topolo.app"
+        ],
         "appId": "consent"
       },
       {
@@ -659,11 +749,45 @@ var APPLICATIONS = {
         "domains": [
           "crm.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "crm.topolo.app"
+        ],
         "appId": "crm"
       }
     ]
   },
+  "design": {
+    "id": "design",
+    "appDir": "TopoloDesign",
+    "name": "topolo-design",
+    "packageName": "@topolo-io/design",
+    "productionUrl": "https://design.topolo.app",
+    "services": [
+      "design"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-design",
+        "kind": "worker",
+        "apiUrl": "https://design.topolo.app",
+        "domains": [
+          "design.topolo.app"
+        ],
+        "routes": [
+          "design.topolo.app"
+        ],
+        "appId": "design"
+      },
+      {
+        "name": "topolo-design-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
   "developers": {
     "id": "developers",
     "appDir": "TopoloDevelopers",
@@ -689,7 +813,9 @@ var APPLICATIONS = {
         "domains": [
           "developers.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "developers.topolo.app"
+        ],
         "appId": "developers"
       },
       {
@@ -719,7 +845,9 @@ var APPLICATIONS = {
         "domains": [
           "director.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "director.topolo.app"
+        ],
         "appId": "director"
       },
       {
@@ -827,7 +955,9 @@ var APPLICATIONS = {
         "domains": [
           "flow.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "flow.topolo.app"
+        ],
         "appId": "flow"
       },
       {
@@ -857,7 +987,9 @@ var APPLICATIONS = {
         "domains": [
           "forecast.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "forecast.topolo.app"
+        ],
         "appId": "forecast"
       },
       {
@@ -887,7 +1019,9 @@ var APPLICATIONS = {
         "domains": [
           "forms.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "forms.topolo.app"
+        ],
         "appId": "forms"
       },
       {
@@ -949,7 +1083,9 @@ var APPLICATIONS = {
         "domains": [
           "insights.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "insights.topolo.app"
+        ],
         "appId": "insights"
       },
       {
@@ -979,7 +1115,9 @@ var APPLICATIONS = {
         "domains": [
           "inventory.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "inventory.topolo.app"
+        ],
         "appId": "inventory"
       },
       {
@@ -1065,7 +1203,9 @@ var APPLICATIONS = {
         "domains": [
           "mail.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "mail.topolo.app"
+        ],
         "appId": "mail"
       },
       {
@@ -1331,7 +1471,9 @@ var APPLICATIONS = {
         "domains": [
           "pay.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "pay.topolo.app"
+        ],
         "appId": "pay"
       },
       {
@@ -1361,7 +1503,9 @@ var APPLICATIONS = {
         "domains": [
           "people.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "people.topolo.app"
+        ],
         "appId": "people"
       },
       {
@@ -1416,7 +1560,9 @@ var APPLICATIONS = {
         "domains": [
           "quro.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "quro.topolo.app"
+        ],
         "appId": null
       }
     ]
@@ -1438,7 +1584,9 @@ var APPLICATIONS = {
         "domains": [
           "roadmapper.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "roadmapper.topolo.app"
+        ],
         "appId": "roadmapper"
       },
       {
@@ -1468,7 +1616,9 @@ var APPLICATIONS = {
         "domains": [
           "sign.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "sign.topolo.app"
+        ],
         "appId": "sign"
       },
       {
@@ -1582,7 +1732,9 @@ var APPLICATIONS = {
         "domains": [
           "spaces.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "spaces.topolo.app"
+        ],
         "appId": "spaces"
       },
       {
@@ -1700,7 +1852,9 @@ var APPLICATIONS = {
         "domains": [
           "survey.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "survey.topolo.app"
+        ],
         "appId": "survey"
       },
       {
@@ -2498,6 +2652,168 @@ function isMultipleOf(value, divisor) {
   return Math.abs(quotient - Math.round(quotient)) < Number.EPSILON * Math.max(1, Math.abs(quotient)) * 4;
 }
 
+// src/action-upload.ts
+function parseTopoloActionUploadContract(value) {
+  if (!isRecord2(value) || value.profile !== "inline-base64" && value.profile !== "url-session") {
+    throw new TopoloSdkError("upload_contract_unavailable", "This action does not publish a supported upload contract.");
+  }
+  const contentTypeField = requiredField(value.contentTypeField, "contentTypeField");
+  const fileNameField = requiredField(value.fileNameField, "fileNameField");
+  const maxBytes = Number(value.maxBytes);
+  const acceptedContentTypes = Array.isArray(value.acceptedContentTypes) ? value.acceptedContentTypes.map((item) => String(item).trim().toLowerCase()).filter(Boolean) : [];
+  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0 || acceptedContentTypes.length === 0) {
+    throw new TopoloSdkError("invalid_upload_contract", "The action upload contract must declare maxBytes and acceptedContentTypes.");
+  }
+  if (value.profile === "inline-base64") {
+    return {
+      profile: "inline-base64",
+      contentField: requiredField(value.contentField, "contentField"),
+      contentTypeField,
+      fileNameField,
+      maxBytes,
+      acceptedContentTypes
+    };
+  }
+  const uploadMethod = value.uploadMethod === "PUT" || value.uploadMethod === "POST" ? value.uploadMethod : null;
+  const uploadUrlPath = requiredPath(value.uploadUrlPath, "uploadUrlPath");
+  const complete = value.complete === void 0 ? void 0 : parseCompleteContract(value.complete);
+  if (!uploadMethod) throw new TopoloSdkError("invalid_upload_contract", "The action upload contract has an invalid uploadMethod.");
+  return {
+    profile: "url-session",
+    fileNameField,
+    contentTypeField,
+    sizeField: requiredField(value.sizeField, "sizeField"),
+    maxBytes,
+    acceptedContentTypes,
+    uploadUrlPath,
+    uploadMethod,
+    ...complete ? { complete } : {}
+  };
+}
+function prepareTopoloActionUploadInput(contractValue, content, input, options) {
+  const contract = parseTopoloActionUploadContract(contractValue);
+  if (contract.profile !== "inline-base64") throw unsupportedInlineProfile();
+  const bytes = content instanceof Uint8Array ? content : new Uint8Array(content);
+  if (bytes.byteLength === 0) {
+    throw new TopoloSdkError("invalid_upload_content", "Upload content must not be empty.");
+  }
+  if (bytes.byteLength > contract.maxBytes) {
+    throw new TopoloSdkError("upload_too_large", `Upload content exceeds the ${contract.maxBytes}-byte action limit.`);
+  }
+  return mapUploadInput(contract, bytesToBase64(bytes), input, options);
+}
+function prepareTopoloActionBase64UploadInput(contractValue, contentBase64, input, options) {
+  const contract = parseTopoloActionUploadContract(contractValue);
+  if (contract.profile !== "inline-base64") throw unsupportedInlineProfile();
+  if (!isCanonicalBase64(contentBase64)) {
+    throw new TopoloSdkError("invalid_upload_content", "Upload content must be canonical base64.");
+  }
+  const padding = contentBase64.endsWith("==") ? 2 : contentBase64.endsWith("=") ? 1 : 0;
+  const byteLength = contentBase64.length / 4 * 3 - padding;
+  if (byteLength === 0) throw new TopoloSdkError("invalid_upload_content", "Upload content must not be empty.");
+  if (byteLength > contract.maxBytes) {
+    throw new TopoloSdkError("upload_too_large", `Upload content exceeds the ${contract.maxBytes}-byte action limit.`);
+  }
+  return mapUploadInput(contract, contentBase64, input, options);
+}
+function prepareTopoloUrlSessionUploadInput(contractValue, byteLength, input, options) {
+  const contract = parseTopoloActionUploadContract(contractValue);
+  if (contract.profile !== "url-session") {
+    throw new TopoloSdkError("invalid_upload_contract", "This action does not publish a URL-session upload contract.");
+  }
+  validateUploadMetadata(contract, byteLength, options);
+  return {
+    contract,
+    input: {
+      ...input,
+      [contract.fileNameField]: options.fileName.trim(),
+      [contract.contentTypeField]: options.contentType.trim().toLowerCase(),
+      [contract.sizeField]: byteLength
+    }
+  };
+}
+function topoloUploadResponseValue(response, path) {
+  return path.split(".").reduce((value, segment) => isRecord2(value) ? value[segment] : void 0, response);
+}
+function decodeTopoloActionBase64(contentBase64) {
+  if (!isCanonicalBase64(contentBase64)) {
+    throw new TopoloSdkError("invalid_upload_content", "Upload content must be canonical base64.");
+  }
+  const binary = atob(contentBase64);
+  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+}
+function mapUploadInput(contract, contentBase64, input, options) {
+  validateUploadMetadata(contract, Math.max(1, decodedBase64Size(contentBase64)), options);
+  const fileName = options.fileName.trim();
+  const contentType = options.contentType.trim().toLowerCase();
+  return {
+    ...input,
+    [contract.contentField]: contentBase64,
+    [contract.contentTypeField]: contentType,
+    [contract.fileNameField]: fileName
+  };
+}
+function validateUploadMetadata(contract, byteLength, options) {
+  const fileName = options.fileName.trim();
+  const contentType = options.contentType.trim().toLowerCase();
+  if (!fileName) throw new TopoloSdkError("invalid_upload_file_name", "Upload fileName must not be empty.");
+  if (!Number.isSafeInteger(byteLength) || byteLength <= 0) {
+    throw new TopoloSdkError("invalid_upload_content", "Upload content must not be empty.");
+  }
+  if (byteLength > contract.maxBytes) {
+    throw new TopoloSdkError("upload_too_large", `Upload content exceeds the ${contract.maxBytes}-byte action limit.`);
+  }
+  if (!matchesContentType(contentType, contract.acceptedContentTypes)) {
+    throw new TopoloSdkError("unsupported_upload_content_type", `Content type "${contentType}" is not accepted by this action.`);
+  }
+}
+function decodedBase64Size(contentBase64) {
+  const padding = contentBase64.endsWith("==") ? 2 : contentBase64.endsWith("=") ? 1 : 0;
+  return contentBase64.length / 4 * 3 - padding;
+}
+function parseCompleteContract(value) {
+  if (!isRecord2(value)) throw new TopoloSdkError("invalid_upload_contract", "The action upload completion contract is invalid.");
+  return {
+    actionId: requiredPath(value.actionId, "complete.actionId"),
+    inputField: requiredField(value.inputField, "complete.inputField"),
+    responsePath: requiredPath(value.responsePath, "complete.responsePath")
+  };
+}
+function requiredPath(value, name) {
+  const path = typeof value === "string" ? value.trim() : "";
+  if (!/^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)*$/.test(path)) {
+    throw new TopoloSdkError("invalid_upload_contract", `The action upload contract has an invalid ${name}.`);
+  }
+  return path;
+}
+function unsupportedInlineProfile() {
+  return new TopoloSdkError("invalid_upload_contract", "This action does not publish an inline-base64 upload contract.");
+}
+function isCanonicalBase64(value) {
+  return value.length > 0 && value.length % 4 === 0 && /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value);
+}
+function requiredField(value, name) {
+  const field = typeof value === "string" ? value.trim() : "";
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(field)) {
+    throw new TopoloSdkError("invalid_upload_contract", `The action upload contract has an invalid ${name}.`);
+  }
+  return field;
+}
+function matchesContentType(contentType, accepted) {
+  return accepted.some((candidate) => candidate === "*/*" || candidate === contentType || candidate.endsWith("/*") && contentType.startsWith(candidate.slice(0, -1)));
+}
+function bytesToBase64(bytes) {
+  let binary = "";
+  const chunkSize = 32768;
+  for (let offset = 0; offset < bytes.length; offset += chunkSize) {
+    binary += String.fromCharCode(...bytes.subarray(offset, offset + chunkSize));
+  }
+  return btoa(binary);
+}
+function isRecord2(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
 // src/client.ts
 var WRITE_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
 var TOPOLO_ACTION_ID_HEADER = "X-Topolo-Action-Id";
@@ -2575,6 +2891,9 @@ var TopoloClient = class _TopoloClient {
         if (v !== void 0) url.searchParams.set(k, String(v));
       }
     }
+    if (opts.body !== void 0 && opts.rawBody !== void 0) {
+      throw new TopoloSdkError("invalid_request_body", "body and rawBody are mutually exclusive.");
+    }
     const headers = new Headers();
     headers.set("Accept", "application/json");
     if (opts.body !== void 0) headers.set("Content-Type", "application/json");
@@ -2609,7 +2928,7 @@ var TopoloClient = class _TopoloClient {
         return await this.fetchImpl(urlStr, {
           method,
           headers: new Headers(headers),
-          body: opts.body !== void 0 ? JSON.stringify(opts.body) : null,
+          body: opts.rawBody ?? (opts.body !== void 0 ? JSON.stringify(opts.body) : null),
           signal
         });
       } finally {
@@ -2657,14 +2976,32 @@ var TopoloClient = class _TopoloClient {
         error: message,
         status: res.status
       });
-      if (res.status === 401) throw new TopoloAuthError(describeError(parsed, "Unauthorized"));
+      const errorContext = {
+        status: res.status,
+        body: parsed,
+        service: resolvedService.serviceKey,
+        path: opts.path,
+        requestId: res.headers.get("X-Topolo-Request-Id") || requestId,
+        retryAfter: res.headers.get("Retry-After") || void 0
+      };
+      if (res.status === 401) {
+        throw new TopoloAuthError(describeError(parsed, "Unauthorized"), "auth_error", errorContext);
+      }
       if (res.status === 403) {
         throw new TopoloPermissionError(
           describeError(parsed, "Permission denied"),
-          extractRequired(parsed)
+          extractRequired(parsed),
+          errorContext
         );
       }
-      throw new TopoloHttpError(resolvedService.serviceKey, opts.path, res.status, parsed);
+      throw new TopoloHttpError(
+        resolvedService.serviceKey,
+        opts.path,
+        res.status,
+        parsed,
+        message,
+        errorContext
+      );
     }
     this.emit({
       phase: "response",
@@ -2823,7 +3160,7 @@ var TopoloClient = class _TopoloClient {
     }
     const entries = [];
     for (const item of raw) {
-      if (!isRecord2(item)) continue;
+      if (!isRecord3(item)) continue;
       const s = item;
       const appId = typeof s.app_id === "string" ? s.app_id : typeof s.id === "string" ? s.id : null;
       if (!appId) continue;
@@ -2898,8 +3235,8 @@ var TopoloClient = class _TopoloClient {
       "app_topolo_auth.service_api_key_resources.list",
       { appId: service.appId }
     );
-    const payload = isRecord2(response) && isRecord2(response.data) ? response.data : response;
-    if (!isRecord2(payload) || !Array.isArray(payload.resources)) {
+    const payload = isRecord3(response) && isRecord3(response.data) ? response.data : response;
+    if (!isRecord3(payload) || !Array.isArray(payload.resources)) {
       throw new TopoloSdkError("resource_catalog_unavailable", "TopoloAuth did not return bindable resources.");
     }
     return {
@@ -3005,6 +3342,71 @@ var TopoloClient = class _TopoloClient {
     const entry = await this.getAction(action);
     return this.executeResolvedAction(entry, input, options);
   }
+  async uploadAction(action, content, input, options) {
+    const entry = await this.getAction(action);
+    const contract = parseTopoloActionUploadContract(entry.agentContract?.upload);
+    if (contract.profile === "url-session") {
+      const bytes = content instanceof Uint8Array ? content : new Uint8Array(content);
+      return this.executeUrlSessionUpload(entry, contract, bytes, input, options);
+    }
+    const uploadInput = prepareTopoloActionUploadInput(entry.agentContract?.upload, content, input, options);
+    return this.executeResolvedAction(entry, uploadInput, options);
+  }
+  async uploadActionBase64(action, contentBase64, input, options) {
+    const entry = await this.getAction(action);
+    const contract = parseTopoloActionUploadContract(entry.agentContract?.upload);
+    if (contract.profile === "url-session") {
+      return this.executeUrlSessionUpload(entry, contract, decodeTopoloActionBase64(contentBase64), input, options);
+    }
+    const uploadInput = prepareTopoloActionBase64UploadInput(entry.agentContract?.upload, contentBase64, input, options);
+    return this.executeResolvedAction(entry, uploadInput, options);
+  }
+  async executeUrlSessionUpload(entry, contract, bytes, input, options) {
+    const prepared = prepareTopoloUrlSessionUploadInput(contract, bytes.byteLength, input, options);
+    const initiation = await this.executeResolvedAction(entry, prepared.input, options);
+    const uploadUrl = topoloUploadResponseValue(initiation, contract.uploadUrlPath);
+    if (typeof uploadUrl !== "string" || !uploadUrl.trim()) {
+      throw new TopoloSdkError("invalid_upload_response", `Upload action response is missing ${contract.uploadUrlPath}.`);
+    }
+    await this.putUrlSessionContent(entry, uploadUrl, contract.uploadMethod, bytes, options);
+    if (!contract.complete) return initiation;
+    const completionValue = topoloUploadResponseValue(initiation, contract.complete.responsePath);
+    if (typeof completionValue !== "string" || !completionValue.trim()) {
+      throw new TopoloSdkError("invalid_upload_response", `Upload action response is missing ${contract.complete.responsePath}.`);
+    }
+    const completion = await this.getAction(contract.complete.actionId);
+    return this.executeResolvedAction(completion, {
+      ...options.completionInput ?? {},
+      [contract.complete.inputField]: completionValue
+    }, options);
+  }
+  async putUrlSessionContent(entry, uploadUrl, method, bytes, options) {
+    const service = entry.appSlug || entry.appId;
+    const resolved = entry.apiBaseUrl ? { serviceKey: normalizeLookupKey(service), baseUrl: requireHttpOrigin(entry.apiBaseUrl) } : await this.resolveRequestService(service);
+    const target = new URL(uploadUrl, resolved.baseUrl.endsWith("/") ? resolved.baseUrl : `${resolved.baseUrl}/`);
+    const body = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+    if (target.origin === new URL(resolved.baseUrl).origin) {
+      await this.request({
+        service,
+        baseUrl: resolved.baseUrl,
+        path: target.toString(),
+        method,
+        rawBody: body,
+        headers: { "Content-Type": options.contentType.trim().toLowerCase() },
+        resource: options.resource,
+        confirm: options.confirm
+      });
+      return;
+    }
+    const response = await this.fetchImpl(target, {
+      method,
+      headers: { "Content-Type": options.contentType.trim().toLowerCase() },
+      body
+    });
+    if (!response.ok) {
+      throw new TopoloHttpError(service, target.pathname, response.status, await response.text(), `Upload transport failed with HTTP ${response.status}.`);
+    }
+  }
   async validateActionInput(action, input = {}) {
     const entry = await this.getAction(action);
     return { action: entry, validation: validateTopoloActionInput(entry.inputSchema, input) };
@@ -3163,7 +3565,7 @@ function resolveConfiguredAppId(slug, appIds) {
   return null;
 }
 function normalizeApiKeyResourceMetadata(input) {
-  if (!isRecord2(input)) return null;
+  if (!isRecord3(input)) return null;
   const resourceType = readString(input.resourceType ?? input.resource_type);
   const label = readString(input.label);
   const emptyLabel = readString(input.emptyLabel ?? input.empty_label);
@@ -3197,7 +3599,7 @@ function normalizeApiKeyResourceMetadataList(input) {
   return resources;
 }
 function normalizeBindableResource(input) {
-  if (!isRecord2(input)) return null;
+  if (!isRecord3(input)) return null;
   const resourceType = readString(input.resourceType ?? input.resource_type);
   const resourceId = readString(input.resourceId ?? input.resource_id);
   if (!resourceType || !resourceId) return null;
@@ -3208,13 +3610,13 @@ function normalizeBindableResource(input) {
     slug: readOptionalString(input.slug),
     status: readOptionalString(input.status),
     organizationId: readOptionalString(input.organizationId ?? input.organization_id),
-    metadata: isRecord2(input.metadata) ? input.metadata : {}
+    metadata: isRecord3(input.metadata) ? input.metadata : {}
   };
 }
 function normalizeResourceBindings(input) {
   if (!Array.isArray(input)) return [];
   return input.flatMap((binding) => {
-    if (!isRecord2(binding)) return [];
+    if (!isRecord3(binding)) return [];
     const resourceType = readString(binding.resourceType ?? binding.resource_type);
     const resourceId = readString(binding.resourceId ?? binding.resource_id);
     return resourceType && resourceId ? [{ resourceType, resourceId }] : [];
@@ -3227,7 +3629,7 @@ function readOptionalString(value) {
   const normalized = readString(value);
   return normalized || null;
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function resolveConfiguredServiceUrl(slug, serviceUrls) {
@@ -3299,14 +3701,14 @@ function catalogSearchQuery(options) {
   return query;
 }
 function normalizeCatalogPage(value) {
-  if (!isRecord2(value)) return { nextCursor: null, hasMore: false };
+  if (!isRecord3(value)) return { nextCursor: null, hasMore: false };
   return {
     nextCursor: typeof value.nextCursor === "string" && value.nextCursor ? value.nextCursor : null,
     hasMore: value.hasMore === true
   };
 }
 function normalizeServiceCatalogEntry(item) {
-  if (!isRecord2(item)) return null;
+  if (!isRecord3(item)) return null;
   const appId = typeof item.app_id === "string" ? item.app_id : typeof item.id === "string" ? item.id : null;
   if (!appId) return null;
   const permissions = Array.isArray(item.granted_permissions) ? item.granted_permissions.filter(
@@ -3402,10 +3804,19 @@ function mapActionInput(action, input) {
     delete remaining[key];
     return encodeURIComponent(String(value));
   });
-  const explicitQuery = plainObject(remaining.query);
-  delete remaining.query;
-  const explicitBody = Object.prototype.hasOwnProperty.call(remaining, "body") ? remaining.body : void 0;
-  delete remaining.body;
+  const schemaProperties = plainObject(plainObject(action.inputSchema).properties);
+  const schemaOwnsQuery = Object.prototype.hasOwnProperty.call(schemaProperties, "query");
+  const schemaOwnsBody = Object.prototype.hasOwnProperty.call(schemaProperties, "body");
+  let explicitQuery = {};
+  if (!schemaOwnsQuery) {
+    explicitQuery = plainObject(remaining.query);
+    delete remaining.query;
+  }
+  let explicitBody;
+  if (!schemaOwnsBody) {
+    explicitBody = Object.prototype.hasOwnProperty.call(remaining, "body") ? remaining.body : void 0;
+    delete remaining.body;
+  }
   if (action.method === "GET") {
     return {
       path,
@@ -3564,7 +3975,7 @@ var INVERSE_OPERATIONS = /* @__PURE__ */ new Map([
   ["restore", "archive"],
   ["unpublish", "publish"]
 ]);
-function isRecord3(value) {
+function isRecord4(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 function nonEmptyStrings(value) {
@@ -3602,10 +4013,10 @@ function collectionFor(action, resource) {
   return resource.endsWith("s") ? resource : `${resource}s`;
 }
 function isConcreteOutputSchema(schema) {
-  if (!isRecord3(schema)) return false;
+  if (!isRecord4(schema)) return false;
   if (typeof schema.$ref === "string" && schema.$ref.trim()) return true;
-  if (schema.type === "array" && isRecord3(schema.items) && Object.keys(schema.items).length > 0) return true;
-  if (isRecord3(schema.properties) && Object.keys(schema.properties).length > 0) return true;
+  if (schema.type === "array" && isRecord4(schema.items) && Object.keys(schema.items).length > 0) return true;
+  if (isRecord4(schema.properties) && Object.keys(schema.properties).length > 0) return true;
   return ["oneOf", "anyOf", "allOf"].some((key) => Array.isArray(schema[key]) && schema[key].some(isConcreteOutputSchema));
 }
 function resourceSchema(resource) {
@@ -3686,7 +4097,7 @@ function derivedOutputSchema(action) {
   };
 }
 function sampleForSchema(schema, depth = 0) {
-  if (!isRecord3(schema) || depth > 5) return null;
+  if (!isRecord4(schema) || depth > 5) return null;
   if (schema.const !== void 0) return schema.const;
   if (Array.isArray(schema.enum) && schema.enum.length > 0) return schema.enum[0];
   if (Array.isArray(schema.oneOf) && schema.oneOf.length > 0) return sampleForSchema(schema.oneOf[0], depth + 1);
@@ -3700,8 +4111,8 @@ function sampleForSchema(schema, depth = 0) {
     return schema.minLength > 1 ? "example".padEnd(schema.minLength, "x") : "example";
   }
   if (schema.type === "null") return null;
-  if (schema.type === "object" || isRecord3(schema.properties)) {
-    const properties = isRecord3(schema.properties) ? schema.properties : {};
+  if (schema.type === "object" || isRecord4(schema.properties)) {
+    const properties = isRecord4(schema.properties) ? schema.properties : {};
     const required = new Set(Array.isArray(schema.required) ? schema.required : []);
     const entries = Object.entries(properties).filter(([key]) => required.has(key)).map(([key, child]) => [key, sampleForSchema(child, depth + 1)]);
     return Object.fromEntries(entries);
@@ -3751,21 +4162,32 @@ function defaultErrors(action) {
   const errors = [
     { status: 401, code: "authentication_required", recovery: "Authenticate again or provide a valid Topolo API key." },
     { status: 403, code: "permission_denied", recovery: `Grant the credential permission ${action.permission || action.permissionName || "required by this action"} and the required resource binding.` },
-    { status: 422, code: "invalid_input", recovery: "Correct the payload using inputSchema, then validate before retrying." }
+    { status: 429, code: "rate_limited", recovery: "Wait for Retry-After when present, then retry without parallel duplicate calls." },
+    { status: 422, code: "invalid_input", recovery: "Correct the payload using inputSchema, then validate before retrying." },
+    { status: 503, code: "dependency_unavailable", recovery: "Retry the action. If it continues, inspect the structured error details using the request ID." }
   ];
   if (action.method !== "GET") {
     errors.push({ status: 409, code: "state_conflict", recovery: "Read the current resource state, reconcile the intended change, and retry only if still valid." });
   }
   return errors;
 }
+function mergeErrors(defaults, declared) {
+  const merged = [...defaults];
+  for (const error of Array.isArray(declared) ? declared : []) {
+    const index = merged.findIndex((candidate) => candidate.status === error?.status && candidate.code === error?.code);
+    if (index === -1) merged.push(error);
+    else merged[index] = error;
+  }
+  return merged;
+}
 function enrichActionContract(manifest, action, allActions = manifest.actions || []) {
   const appId = String(manifest.appId || manifest.app_id || "").trim();
   const service = slugify(manifest.slug || appId.replace(/^app_/, "").replaceAll("_", "-") || manifest.name);
   const outputSchema = isConcreteOutputSchema(action.outputSchema) ? structuredClone(action.outputSchema) : derivedOutputSchema(action);
   const resource = resourceFor(action);
   const readOnly = action.readOnly !== void 0 ? action.readOnly === true : action.method === "GET";
-  const existing = isRecord3(action.agentContract) ? structuredClone(action.agentContract) : {};
-  const recovery = isRecord3(existing.recovery) ? existing.recovery : recoveryFor(action, allActions, appId);
+  const existing = isRecord4(action.agentContract) ? structuredClone(action.agentContract) : {};
+  const recovery = isRecord4(existing.recovery) ? existing.recovery : recoveryFor(action, allActions, appId);
   const rollbackActionId = typeof existing.rollbackActionId === "string" && existing.rollbackActionId.trim() ? existing.rollbackActionId.trim() : recovery.mode === "compensating_action" ? recovery.actionId : void 0;
   const inputExample = sampleForSchema(action.inputSchema);
   const examples = Array.isArray(existing.examples) && existing.examples.length > 0 ? existing.examples : [{ input: inputExample ?? {}, expected: `A response matching the published outputSchema for ${action.name}.` }];
@@ -3777,9 +4199,9 @@ function enrichActionContract(manifest, action, allActions = manifest.actions ||
       ...existing,
       docsUrl,
       ...existingDocsUrl && existingDocsUrl !== docsUrl ? { guideUrl: existingDocsUrl } : {},
-      resource: isRecord3(existing.resource) ? existing.resource : { kind: resource, idPath: readOnly && ["list", "search"].includes(operationFor(action)) ? "$.items[].id" : "$.id" },
+      resource: isRecord4(existing.resource) ? existing.resource : { kind: resource, idPath: readOnly && ["list", "search"].includes(operationFor(action)) ? "$.items[].id" : "$.id" },
       effects: nonEmptyStrings(existing.effects) ? existing.effects : [readOnly ? `Reads ${resource.replaceAll("_", " ")} data without changing service state.` : action.destructive === true || action.method === "DELETE" ? `Permanently removes or invalidates ${resource.replaceAll("_", " ")} state.` : `Changes ${resource.replaceAll("_", " ")} state in the selected Topolo resource context.`],
-      errors: Array.isArray(existing.errors) && existing.errors.length > 0 ? existing.errors : defaultErrors(action),
+      errors: mergeErrors(defaultErrors(action), existing.errors),
       verify: nonEmptyStrings(existing.verify) ? existing.verify : [`Validate the response against outputSchema and ${readOnly ? "confirm it belongs to the selected resource context" : "re-read the affected resource to confirm the intended state"}.`],
       examples,
       recovery,
@@ -3791,15 +4213,15 @@ function enrichActionContract(manifest, action, allActions = manifest.actions ||
 function actionContractCompleteness(action) {
   const contract = action?.agentContract;
   return {
-    inputSchema: isRecord3(action?.inputSchema),
+    inputSchema: isRecord4(action?.inputSchema),
     outputSchema: isConcreteOutputSchema(action?.outputSchema),
     effects: nonEmptyStrings(contract?.effects),
     errors: Array.isArray(contract?.errors) && contract.errors.length > 0,
     docs: typeof contract?.docsUrl === "string" && contract.docsUrl.startsWith("https://"),
     examples: Array.isArray(contract?.examples) && contract.examples.length > 0,
     verification: nonEmptyStrings(contract?.verify),
-    recovery: isRecord3(contract?.recovery) && ["not_applicable", "compensating_action", "irreversible"].includes(contract.recovery.mode),
-    agentContract: isRecord3(contract) && isRecord3(contract.resource) && nonEmptyStrings(contract.effects) && Array.isArray(contract.errors) && contract.errors.length > 0
+    recovery: isRecord4(contract?.recovery) && ["not_applicable", "compensating_action", "irreversible"].includes(contract.recovery.mode),
+    agentContract: isRecord4(contract) && isRecord4(contract.resource) && nonEmptyStrings(contract.effects) && Array.isArray(contract.errors) && contract.errors.length > 0
   };
 }
 
@@ -4204,7 +4626,7 @@ function createTopoloWidgetError(error) {
 }
 function validateTopoloWidgetResponse(response) {
   const errors = [];
-  if (!isRecord4(response)) {
+  if (!isRecord5(response)) {
     return { ok: false, errors: ["response must be an object"] };
   }
   if (typeof response.success !== "boolean") {
@@ -4223,7 +4645,7 @@ function validateTopoloWidgetResponse(response) {
   return { ok: errors.length === 0, errors };
 }
 function validateWidget(widget, path, errors) {
-  if (!isRecord4(widget)) {
+  if (!isRecord5(widget)) {
     errors.push(`${path} must be an object`);
     return;
   }
@@ -4250,7 +4672,7 @@ function validateWidget(widget, path, errors) {
     case "chart":
       validateNonEmptyString(widget.chartType, `${path}.chartType`, errors);
       validateNonEmptyString(widget.title, `${path}.title`, errors);
-      if (!isRecord4(widget.data)) {
+      if (!isRecord5(widget.data)) {
         errors.push(`${path}.data must be an object`);
       } else {
         validateArray2(widget.data.labels, `${path}.data.labels`, errors);
@@ -4266,7 +4688,7 @@ function validateSnapshotMetadata(snapshot, path, errors) {
     errors.push(`${path} must be an object`);
     return;
   }
-  if (!isRecord4(snapshot)) {
+  if (!isRecord5(snapshot)) {
     errors.push(`${path} must be an object`);
     return;
   }
@@ -4286,7 +4708,7 @@ function validateSnapshotMetadata(snapshot, path, errors) {
   }
   snapshot.availableMetrics.forEach((metric, index) => {
     const metricPath = `${path}.availableMetrics[${index}]`;
-    if (!isRecord4(metric)) {
+    if (!isRecord5(metric)) {
       errors.push(`${metricPath} must be an object`);
       return;
     }
@@ -4307,7 +4729,7 @@ function validateArray2(value, path, errors) {
     errors.push(`${path} must be an array`);
   }
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function toIsoTimestamp(input) {
@@ -4359,6 +4781,9 @@ function createTopolo(options) {
   defineTopoloStatsWidget,
   digestTopoloActionCatalog,
   enrichActionContract,
+  parseTopoloActionUploadContract,
+  prepareTopoloActionBase64UploadInput,
+  prepareTopoloActionUploadInput,
   requirementsForApplication,
   resolveCatalogServiceUrl,
   resolveServiceUrl,