@topolo/cli 0.1.22 → 0.1.23

package/dist/index.js

@@ -9,7 +9,7 @@ import { platform as platform2 } from "os";
 import { createInterface } from "readline/promises";
 import { stdin as input } from "process";
 
-// node_modules/@topolo/sdk/dist/index.js
+// ../topolo-sdk/dist/index.js
 function applyAuthHeaders(headers, credential) {
   if (credential.kind === "api_key") {
     headers.set("X-Api-Key", credential.apiKey);
@@ -1522,12 +1522,12 @@ var APPLICATION_REQUIREMENTS = [
     summary: "Applications must derive identity, organization, scopes, and service entitlement from TopoloAuth rather than inventing parallel auth state.",
     appliesTo: ["browser", "api", "tooling", "agent_surface"],
     evidence: [
-      "@topolo/auth-client or @topolo-io/worker-runtime is used where applicable",
+      "@topolo/auth-client or @topolo/auth-middleware is used where applicable",
       "No public command, tool, or SDK method accepts orgId",
       "Service slug and Auth service registration are documented for protected services"
     ],
     implementation: [
-      "Use shared auth/runtime packages instead of copying token parsing, gateway, or browser storage flows",
+      "Use shared auth packages instead of copying token parsing or browser storage flows",
       "Derive organization from the credential on every request",
       "Route OAuth, refresh, logout, and SSO paths according to the shared Auth contract"
     ]
@@ -2068,58 +2068,6 @@ var TopoloClient = class _TopoloClient {
     });
     return value;
   }
-  /**
-   * List the platform service catalog from the live registry
-   * (`GET /api/services/catalog` on TopoloAuth). Credential-aware: the
-   * caller's credential is attached, so an authenticated caller in an
-   * entitled org also receives the `developer_only` services its role
-   * permits; an unauthenticated/agent caller receives `active` only.
-   *
-   * Resilient: on any network/HTTP failure this falls back to the
-   * build-time generated `APPLICATIONS` snapshot so offline/degraded
-   * callers still get a usable (if static) catalog. The live result is
-   * authoritative; the snapshot is a floor, not a cap.
-   */
-  async listServices() {
-    try {
-      const res = await this.request({ service: "auth", method: "GET", path: "/api/services/catalog" });
-      const raw = res.data?.services ?? res.services;
-      if (Array.isArray(raw) && raw.length > 0) {
-        const entries = [];
-        for (const item of raw) {
-          const s = item;
-          const serviceId = typeof s.service_id === "string" ? s.service_id : typeof s.id === "string" ? s.id : null;
-          if (!serviceId) continue;
-          entries.push({
-            serviceId,
-            slug: typeof s.app_slug === "string" ? s.app_slug : null,
-            name: typeof s.name === "string" ? s.name : null,
-            description: typeof s.description === "string" ? s.description : null,
-            baseUrl: typeof s.base_url === "string" ? s.base_url : null,
-            status: typeof s.status === "string" ? s.status : null,
-            surfaceKind: typeof s.surface_kind === "string" ? s.surface_kind : null,
-            launchable: s.launchable === true
-          });
-        }
-        if (entries.length > 0) return entries;
-      }
-    } catch {
-    }
-    return this.generatedCatalogFallback();
-  }
-  generatedCatalogFallback() {
-    const apps = Object.values(APPLICATIONS);
-    return apps.map((app) => ({
-      serviceId: app.id,
-      slug: app.id,
-      name: app.name ?? app.id,
-      description: null,
-      baseUrl: app.productionUrl ?? null,
-      status: "active",
-      surfaceKind: "application",
-      launchable: Boolean(app.productionUrl)
-    }));
-  }
   /**
    * Introspect the current credential. Returns the caller's resolved identity,
    * organization, and permission set. Used by CLI `whoami` and by MCP to gate
@@ -3108,6 +3056,8 @@ import {
 } from "fs";
 import path from "path";
 var EVIDENCE_FRESHNESS_MS = 36 * 60 * 60 * 1e3;
+var REQUIRED_AUTH_CLIENT_VERSION = "1.1.8";
+var REQUIRED_UI_KIT_VERSION = "0.4.63";
 function readEvidenceFile(appRoot) {
   const candidate = path.join(appRoot, ".topolo", "evidence.json");
   if (!isFile(candidate)) return null;
@@ -3269,32 +3219,56 @@ function enrichFinding(application, finding2, evidence) {
           evidence: ["service=auth"]
         });
       }
+      const usesWorkerRuntime = authEvidence.includes("source=@topolo-io/worker-runtime") || authEvidence.includes("source=topolo-worker-runtime") || authEvidence.includes("source=createTopoloWorkerRuntime");
       const usesAuthMiddleware = authEvidence.includes("source=@topolo-io/auth-middleware") || authEvidence.includes("source=topolo-auth-middleware") || authEvidence.includes("source=TopoloAuthMiddleware");
       const usesAuthClient = authEvidence.includes("source=@topolo-io/auth-client") || authEvidence.includes("source=topolo-auth-client");
       const usesTopoloClient = authEvidence.includes("source=TopoloClient");
       const usesAuthValidateFetch = authEvidence.includes("source=auth-validate-fetch");
-      if (usesAuthMiddleware || usesAuthClient || usesTopoloClient || usesAuthValidateFetch) {
+      if (authEvidence.includes(`dependency-version=@topolo-io/auth-client<${REQUIRED_AUTH_CLIENT_VERSION}`)) {
+        return mergeFinding(finding2, {
+          status: "needs_review",
+          reason: `The app depends on @topolo-io/auth-client below ${REQUIRED_AUTH_CLIENT_VERSION}; public-route auth boot and session-channel fixes require the current shared client.`,
+          evidence: authEvidence,
+          nextActions: [
+            `Update @topolo-io/auth-client to ${REQUIRED_AUTH_CLIENT_VERSION} or the workspace package that resolves to it`,
+            "Regenerate the lockfile without reverting unrelated app changes",
+            "Rerun this audit after the package update"
+          ]
+        });
+      }
+      if (authEvidence.includes("auth-boot=blocking-cookie-refresh") && !authEvidence.includes("auth-boot=background-cookie-refresh")) {
+        return mergeFinding(finding2, {
+          status: "needs_review",
+          reason: "The app appears to block all browser routes on auth cookie refresh. Public landing and login routes must render immediately and restore the cookie session in the background.",
+          evidence: authEvidence,
+          nextActions: [
+            "Use authClient.initialize({ cookieRefresh: 'background' }) or initializeSession({ cookieRefresh: 'background' }) on public landing/login routes",
+            "Keep cookieRefresh: 'blocking' for protected workspace routes",
+            "Subscribe to auth:session-updated so background restore updates the visible user state"
+          ]
+        });
+      }
+      if (usesWorkerRuntime || usesAuthMiddleware || usesAuthClient || usesTopoloClient || usesAuthValidateFetch) {
         return mergeFinding(finding2, {
           status: "met",
-          reason: "Canonical Topolo auth wiring is present (auth-middleware verifyRequest, auth-client browser module, or TopoloClient).",
+          reason: "Canonical Topolo auth wiring is present (worker-runtime, auth-middleware verifyRequest, auth-client browser session controller, or TopoloClient).",
           evidence: authEvidence
         });
       }
       return mergeFinding(finding2, {
         status: "partial",
-        reason: "Shared Topolo auth dependency is declared but the canonical wiring (verifyRequest / createBrowserAuthModule / useTopoloAuth / TopoloClient) is not visible.",
+        reason: "Shared Topolo auth dependency is declared but the canonical wiring (verifyRequest / createBrowserAuthSessionController / useTopoloAuth / TopoloClient) is not visible.",
         evidence: authEvidence
       });
     }
     case "service-registration-and-scopes": {
-      const applicationId = String(application.id);
       const declaredServices = application.services ?? [];
       if (declaredServices.length === 0) {
-        if (applicationId === "cli" || applicationId === "mcp" || applicationId === "cloudcontrol") {
+        if (application.id === "cloudcontrol") {
           return mergeFinding(finding2, {
             status: "met",
             reason: "This application is itself a tooling/agent surface and does not register a callable platform service.",
-            evidence: [`tooling=${applicationId}`],
+            evidence: [`tooling=${application.id}`],
             nextActions: []
           });
         }
@@ -3373,6 +3347,18 @@ function enrichFinding(application, finding2, evidence) {
         });
       }
       if (shellEvidence.length === 0) return finding2;
+      if (shellEvidence.includes(`dependency-version=@topolo-io/ui-kit<${REQUIRED_UI_KIT_VERSION}`)) {
+        return mergeFinding(finding2, {
+          status: "needs_review",
+          reason: `The app depends on @topolo-io/ui-kit below ${REQUIRED_UI_KIT_VERSION}; launcher catalog cache/dedupe fixes require the current shared kit.`,
+          evidence: shellEvidence,
+          nextActions: [
+            `Update @topolo-io/ui-kit to ${REQUIRED_UI_KIT_VERSION}`,
+            "Regenerate the lockfile without reverting unrelated app changes",
+            "Rerun this audit after the package update"
+          ]
+        });
+      }
       if (shellEvidence.includes("forbidden=workspace-shell")) {
         return mergeFinding(finding2, {
           status: "needs_review",
@@ -3439,7 +3425,7 @@ function enrichFinding(application, finding2, evidence) {
       }
       const text = evidence.source.text;
       const hasOrganizationIdColumn = orgEvidence.includes("source=organization_id") || orgEvidence.includes("source=organizationId") || orgEvidence.includes("source=tenantId") || orgEvidence.includes("source=tenant_id");
-      const hasCredentialBoundary = orgEvidence.includes("source=organization-auth-boundary") || text.includes("verifyRequest") || text.includes("createBrowserAuthModule") || text.includes("useTopoloAuth");
+      const hasCredentialBoundary = orgEvidence.includes("source=organization-auth-boundary") || text.includes("verifyRequest") || text.includes("createBrowserAuthSessionController") || text.includes("useTopoloAuth");
       if (hasOrganizationIdColumn && hasCredentialBoundary) {
         return mergeFinding(finding2, {
           status: "met",
@@ -3454,7 +3440,6 @@ function enrichFinding(application, finding2, evidence) {
       });
     }
     case "agent-and-operator-surfaces": {
-      const applicationId = String(application.id);
       const declaredServices = application.services ?? [];
       const text = evidence.source.text;
       const items = [];
@@ -3464,11 +3449,11 @@ function enrichFinding(application, finding2, evidence) {
         items.push("source=confirm-write-gate");
       }
       if (text.includes("@topolo/sdk")) items.push("source=@topolo/sdk");
-      if (applicationId === "cli" || applicationId === "mcp" || applicationId === "cloudcontrol") {
+      if (application.id === "cloudcontrol") {
         return mergeFinding(finding2, {
           status: "met",
-          reason: "This application is itself an agent/operator surface (CLI / MCP / CloudControl).",
-          evidence: [`tooling=${applicationId}`, ...items],
+          reason: "This application is itself an agent/operator surface (CloudControl).",
+          evidence: [`tooling=${application.id}`, ...items],
           nextActions: []
         });
       }
@@ -3715,15 +3700,24 @@ function sharedAuthEvidence(evidence) {
   const text = evidence.source.text;
   const items = [];
   if (deps.has("@topolo-io/auth-client")) items.push("dependency=@topolo-io/auth-client");
+  if (packageDependencyVersions(evidence, "@topolo-io/auth-client").some((version) => isStaleDependencyVersion(version, REQUIRED_AUTH_CLIENT_VERSION))) {
+    items.push(`dependency-version=@topolo-io/auth-client<${REQUIRED_AUTH_CLIENT_VERSION}`);
+  }
   if (deps.has("@topolo-io/auth-middleware")) items.push("dependency=@topolo-io/auth-middleware");
+  if (deps.has("@topolo-io/worker-runtime")) items.push("dependency=@topolo-io/worker-runtime");
   if (deps.has("@topolo/sdk")) items.push("dependency=@topolo/sdk");
   if (text.includes("@topolo-io/auth-client")) items.push("source=@topolo-io/auth-client");
   if (text.includes("@topolo-io/auth-middleware")) items.push("source=@topolo-io/auth-middleware");
+  if (text.includes("@topolo-io/worker-runtime")) items.push("source=@topolo-io/worker-runtime");
+  if (text.includes("topolo-worker-runtime")) items.push("source=topolo-worker-runtime");
+  if (text.includes("createTopoloWorkerRuntime")) items.push("source=createTopoloWorkerRuntime");
   if (text.includes("topolo-auth-client")) items.push("source=topolo-auth-client");
   if (text.includes("topolo-auth-middleware")) items.push("source=topolo-auth-middleware");
   if (text.includes("TopoloAuthMiddleware")) items.push("source=TopoloAuthMiddleware");
   if (text.includes("TopoloClient")) items.push("source=TopoloClient");
   if (text.includes("TopoloOAuth")) items.push("source=TopoloOAuth");
+  if (/\.initialize(?:Session)?\(\s*\)/.test(text)) items.push("auth-boot=blocking-cookie-refresh");
+  if (/cookieRefresh:\s*['"]background['"]/.test(text)) items.push("auth-boot=background-cookie-refresh");
   if (/Authorization.*Bearer/i.test(text) && (text.includes("/validate") || text.includes("TOPOLO_AUTH_URL") || text.includes("AUTH_BASE_URL") || text.includes("auth.topolo.app"))) {
     items.push("source=auth-validate-fetch");
   }
@@ -3745,6 +3739,9 @@ function sharedShellEvidence(evidence) {
   const text = evidence.source.text;
   const items = [];
   if (deps.has("@topolo-io/ui-kit")) items.push("dependency=@topolo-io/ui-kit");
+  if (packageDependencyVersions(evidence, "@topolo-io/ui-kit").some((version) => isStaleDependencyVersion(version, REQUIRED_UI_KIT_VERSION))) {
+    items.push(`dependency-version=@topolo-io/ui-kit<${REQUIRED_UI_KIT_VERSION}`);
+  }
   if (text.includes("@topolo-io/ui-kit")) items.push("source=@topolo-io/ui-kit");
   if (text.includes("TopoloAppShell")) items.push("source=TopoloAppShell");
   if (text.includes(["Topolo", "Workspace", "Shell"].join(""))) items.push("forbidden=workspace-shell");
@@ -3851,6 +3848,36 @@ function dependencyNames(evidence) {
     ])
   );
 }
+function packageDependencyVersions(evidence, packageName) {
+  return unique(
+    evidence.packageJsons.flatMap((record) => {
+      const specs = [
+        record.packageJson.dependencies?.[packageName],
+        record.packageJson.devDependencies?.[packageName],
+        record.packageJson.peerDependencies?.[packageName]
+      ];
+      return specs.filter((spec) => typeof spec === "string");
+    })
+  );
+}
+function isStaleDependencyVersion(spec, minimumVersion) {
+  if (spec.startsWith("workspace:")) return false;
+  const current = parseDependencyVersion(spec);
+  const minimum = parseDependencyVersion(minimumVersion);
+  if (!current || !minimum) return false;
+  const currentParts = current;
+  const minimumParts = minimum;
+  for (const index of [0, 1, 2]) {
+    if (currentParts[index] < minimumParts[index]) return true;
+    if (currentParts[index] > minimumParts[index]) return false;
+  }
+  return false;
+}
+function parseDependencyVersion(spec) {
+  const match = spec.match(/(\d+)\.(\d+)\.(\d+)/);
+  if (!match) return null;
+  return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
 function matchingSystems(repoRoot, application) {
   const docsRoot = topoloDocsRoot(repoRoot);
   const systemsRoot = path.join(docsRoot, "src", "content", "systems");
@@ -4624,7 +4651,7 @@ function packageJson(application, target, options) {
       dependencies["@topolo/sdk"] = topoloPackageVersion("@topolo/sdk", target);
       scripts.deploy = `node -e 'console.error("\\nX Bare deploy is disabled. Use deploy:staging or deploy:production.\\n"); process.exit(1)'`;
       scripts["deploy:staging"] = "DEPLOY_ENVIRONMENT=staging VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us npm run build && wrangler deploy --env staging";
-      scripts["deploy:production"] = "DEPLOY_ENVIRONMENT=production npm run build && wrangler deploy";
+      scripts["deploy:production"] = "DEPLOY_ENVIRONMENT=production VITE_TOPOLO_AUTH_URL=https://auth.topolo.app npm run build && wrangler deploy";
     } else {
       dependencies["@topolo-io/widget-server"] = topoloPackageVersion("@topolo-io/widget-server", target);
       scripts.deploy = "npm run build && wrangler deploy";
@@ -5244,7 +5271,9 @@ function platformAppTsx(application, options) {
     "    if (!auth) return;",
     "    let active = true;",
     "    const syncAuth = async () => {",
-    "      setLoading(true);",
+    "      const publicRoute = route.kind === 'root' || route.kind === 'login';",
+    "      if (publicRoute) setLoading(false);",
+    "      else setLoading(true);",
     "      setAuthError('');",
     "",
     "      if (route.kind === 'callback') {",
@@ -5260,7 +5289,9 @@ function platformAppTsx(application, options) {
     "        return;",
     "      }",
     "",
-    "      const nextUser = await auth.authClient.initialize();",
+    "      const nextUser = await auth.authClient.initialize({",
+    "        cookieRefresh: publicRoute ? 'background' : 'blocking',",
+    "      });",
     "      if (!active) return;",
     "      setUser(nextUser);",
     "      setLoading(false);",
@@ -5277,6 +5308,16 @@ function platformAppTsx(application, options) {
     "  }, [auth, route.kind]);",
     "",
     "  useEffect(() => {",
+    "    if (!auth) return;",
+    "    const handleSessionUpdated = () => {",
+    "      const nextUser = auth.authClient.getHydratedCurrentUser() || auth.authClient.getTokenIdentity();",
+    "      if (nextUser) setUser(nextUser);",
+    "    };",
+    "    window.addEventListener('auth:session-updated', handleSessionUpdated);",
+    "    return () => window.removeEventListener('auth:session-updated', handleSessionUpdated);",
+    "  }, [auth]);",
+    "",
+    "  useEffect(() => {",
     "    if (!loading && user && route.kind === 'login') {",
     "      window.location.replace('/');",
     "    }",
@@ -6881,8 +6922,31 @@ function readRequiredString(value, message) {
   }
   return resolved;
 }
+async function applyProvisionedServiceId(manifestPath, serviceId) {
+  let raw;
+  try {
+    raw = await readFile2(manifestPath, "utf8");
+  } catch {
+    return { changed: false, previous: null };
+  }
+  let json2;
+  try {
+    json2 = JSON.parse(raw);
+  } catch {
+    return { changed: false, previous: null };
+  }
+  const previous = typeof json2.serviceId === "string" ? json2.serviceId : null;
+  if (previous === serviceId) {
+    return { changed: false, previous };
+  }
+  json2.serviceId = serviceId;
+  await writeFile3(manifestPath, `${JSON.stringify(json2, null, 2)}
+`, "utf8");
+  return { changed: true, previous };
+}
 
 // src/commands/apps.ts
+import { join as join3 } from "path";
 var APPLICATION_IDS = Object.keys(APPLICATIONS).sort();
 function registerAppsCommand(program2) {
   const apps = program2.command("apps").description("List every Topolo platform application known to the SDK catalog").option("--json", "Output JSON", true).option("--no-json", "Output human-readable table").action((opts) => {
@@ -6981,15 +7045,25 @@ function registerAppsCommand(program2) {
       });
       const writeResult = opts.write ? await writeApplicationScaffold(payload, { repoRoot: opts.repoRoot, force: opts.force }) : null;
       const provisionResult = opts.provision ? await provisionApplicationScaffold(payload) : null;
+      let serviceIdWriteBack = null;
+      if (writeResult && provisionResult?.authService?.id) {
+        const manifestFile = writeResult.files.find((f) => f.path.endsWith("topolo.app.json"));
+        if (manifestFile) {
+          const manifestPath = join3(writeResult.root, manifestFile.path);
+          const result = await applyProvisionedServiceId(manifestPath, provisionResult.authService.id);
+          serviceIdWriteBack = { ...result, path: manifestFile.path };
+        }
+      }
       const output = {
         ...payload,
         ...writeResult ? { write: writeResult } : {},
-        ...provisionResult ? { provision: provisionResult } : {}
+        ...provisionResult ? { provision: provisionResult } : {},
+        ...serviceIdWriteBack ? { serviceIdWriteBack } : {}
       };
       emit(
         output,
         mode,
-        () => formatScaffold(payload, writeResult, provisionResult)
+        () => formatScaffold(payload, writeResult, provisionResult, serviceIdWriteBack)
       );
     } catch (err) {
       fail(err, mode);
@@ -7223,7 +7297,7 @@ function formatAudit(payload) {
   }
   return lines.join("\n");
 }
-function formatScaffold(payload, writeResult = null, provisionResult = null) {
+function formatScaffold(payload, writeResult = null, provisionResult = null, serviceIdWriteBack = null) {
   const lines = [
     `Version: ${payload.version}`,
     `Target: ${payload.target}`,
@@ -7283,6 +7357,11 @@ function formatScaffold(payload, writeResult = null, provisionResult = null) {
       );
     }
   }
+  if (serviceIdWriteBack) {
+    lines.push(
+      serviceIdWriteBack.changed ? `  - service id written back to ${serviceIdWriteBack.path} (was ${serviceIdWriteBack.previous ?? "unset"})` : `  - service id already current in ${serviceIdWriteBack.path}`
+    );
+  }
   return lines.join("\n");
 }
 function resolveScaffoldAudience(value) {
@@ -7915,7 +7994,7 @@ function normalizeList(values, fallback = []) {
 
 // src/commands/integrations.ts
 import { readdir, readFile as readFile3, stat } from "fs/promises";
-import { join as join3, relative as relative2 } from "path";
+import { join as join4, relative as relative2 } from "path";
 function registerIntegrationsCommand(program2) {
   const integrations = program2.command("integrations").description("Generate and validate Topolo integration handoffs.");
   integrations.command("prompt").description("Print an agent prompt for adding a Topolo integration.").argument("<integration>", "Integration prompt id, currently login-with-topolo").option("--framework <framework>", "auto, authjs, express, or generic", "auto").option("--json", "Emit JSON output").action((integration, options) => {
@@ -7973,7 +8052,7 @@ ${file.content}`).join("\n");
     makeCheck(
       "package",
       "@topolo/login dependency",
-      packageJson2?.dependencies?.["@topolo/login"] || packageJson2?.devDependencies?.["@topolo/login"] ? ["package.json declares @topolo/login"] : [],
+      topoloLoginPackageEvidence(packageJson2, files),
       true
     ),
     makeCheck(
@@ -8025,6 +8104,25 @@ function makeCheck(id, label, evidence, required) {
 function matchEvidence(haystack, needles) {
   return needles.filter((needle) => haystack.toLowerCase().includes(needle.toLowerCase()));
 }
+function topoloLoginPackageEvidence(rootPackageJson, files) {
+  const evidence = [];
+  if (declaresTopoloLogin(rootPackageJson)) evidence.push("package.json declares @topolo/login");
+  for (const file of files) {
+    if (!file.path.endsWith("package.json") || file.path === "package.json") continue;
+    try {
+      if (declaresTopoloLogin(JSON.parse(file.content))) {
+        evidence.push(`${file.path} declares @topolo/login`);
+      }
+    } catch {
+    }
+  }
+  return evidence;
+}
+function declaresTopoloLogin(packageJson2) {
+  return Boolean(
+    packageJson2?.dependencies?.["@topolo/login"] || packageJson2?.devDependencies?.["@topolo/login"] || packageJson2?.peerDependencies?.["@topolo/login"]
+  );
+}
 function detectFramework(packageJson2, haystack) {
   const deps = {
     ...packageJson2?.dependencies ?? {},
@@ -8039,7 +8137,7 @@ function detectFramework(packageJson2, haystack) {
 }
 async function readPackageJson2(repoRoot) {
   try {
-    return JSON.parse(await readFile3(join3(repoRoot, "package.json"), "utf8"));
+    return JSON.parse(await readFile3(join4(repoRoot, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -8051,7 +8149,7 @@ async function collectFiles(repoRoot) {
     if (result.length > 2e3) return;
     const entries = await readdir(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = join3(dir, entry.name);
+      const fullPath = join4(dir, entry.name);
       if (entry.isDirectory()) {
         if ([".git", "node_modules", "dist", "build", ".next", "coverage"].includes(entry.name)) continue;
         await walk(fullPath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topolo/cli",
-  "version": "0.1.22",
+  "version": "0.1.23",
   "description": "Command-line interface for Topolo developers, operators, and agents, with internal first-party scaffolding available under the topolo platform namespace.",
   "type": "module",
   "bin": {
@@ -22,7 +22,7 @@
     "commander": "^12.1.0"
   },
   "devDependencies": {
-    "@topolo/sdk": "latest",
+    "@topolo/sdk": "workspace:*",
     "@types/node": "^20.12.0",
     "@vitest/coverage-v8": "^2.1.0",
     "tsup": "^8.0.0",