@topolo/cli 0.6.1 → 0.6.4

package/dist/generate-wrangler.mjs

@@ -288,6 +288,7 @@ function emitWranglerToml(targetName, target) {
     lines.push(`directory = ${tomlString(target.assets.directory || target.outputDir || 'dist')}`);
     if (target.assets.binding) lines.push(`binding = ${tomlString(target.assets.binding)}`);
     else lines.push(`binding = "ASSETS"`);
+    if (target.assets.htmlHandling) lines.push(`html_handling = ${tomlString(target.assets.htmlHandling)}`);
     if (target.assets.notFoundHandling) lines.push(`not_found_handling = ${tomlString(target.assets.notFoundHandling)}`);
     if (target.assets.runWorkerFirst !== undefined) lines.push(`run_worker_first = ${tomlString(target.assets.runWorkerFirst)}`);
     lines.push('');
@@ -390,6 +391,7 @@ function emitWranglerToml(targetName, target) {
       lines.push(`[env.${env}.assets]`);
       lines.push(`directory = ${tomlString(target.assets.directory || target.outputDir || 'dist')}`);
       lines.push(`binding = ${tomlString(target.assets.binding || 'ASSETS')}`);
+      if (target.assets.htmlHandling) lines.push(`html_handling = ${tomlString(target.assets.htmlHandling)}`);
       if (target.assets.notFoundHandling) lines.push(`not_found_handling = ${tomlString(target.assets.notFoundHandling)}`);
       if (target.assets.runWorkerFirst !== undefined) lines.push(`run_worker_first = ${tomlString(target.assets.runWorkerFirst)}`);
       lines.push('');
@@ -572,6 +574,20 @@ function emitBindings(lines, bindings, env) {
     lines.push(`service = ${tomlString(service)}`);
     lines.push('');
   }
+  // Cloudflare Secrets Store bindings — the durable data-at-rest key escrow
+  // (docs/data-at-rest-encryption-architecture.md). Store ids differ per env
+  // (per-env Cloudflare accounts), so the shape mirrors d1/kv: per-env config
+  // objects under the binding.
+  for (const s of bindings.secretsStore || []) {
+    if (!bindingAppliesToEnv(s, env)) continue;
+    const cfg = s[env];
+    if (!cfg) continue;
+    lines.push(`[[env.${env}.secrets_store_secrets]]`);
+    lines.push(`binding = ${tomlString(s.binding)}`);
+    lines.push(`store_id = ${tomlString(cfg.storeId)}`);
+    lines.push(`secret_name = ${tomlString(cfg.secretName)}`);
+    lines.push('');
+  }
   for (const a of bindings.ai || []) {
     lines.push(`[env.${env}.ai]`);
     lines.push(`binding = ${tomlString(a.binding)}`);
@@ -595,7 +611,7 @@ function emitCloudcontrol() {
     deployableTargets.flatMap((target) => target.environments || ENVS),
   );
   cc.deploy_method = deployableTargets.length ? 'wrangler' : 'none';
-  cc.ci_provider = existing.ci_provider || 'github_actions';
+  cc.ci_provider = existing.ci_provider || 'local';
   cc.quality_policy = existing.quality_policy || {
     profile: 'first_party_app',
     coverage: { mode: 'ratchet' },

package/dist/index.js

@@ -277,7 +277,9 @@ var APPLICATIONS = {
         "domains": [
           "brand.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "brand.topolo.app"
+        ],
         "appId": "brand"
       },
       {
@@ -307,7 +309,9 @@ var APPLICATIONS = {
         "domains": [
           "bugfix.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "bugfix.topolo.app"
+        ],
         "appId": "bugfix"
       }
     ]
@@ -361,7 +365,9 @@ var APPLICATIONS = {
         "domains": [
           "calendar.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "calendar.topolo.app"
+        ],
         "appId": "calendar"
       },
       {
@@ -421,7 +427,9 @@ var APPLICATIONS = {
         "domains": [
           "capacity.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "capacity.topolo.app"
+        ],
         "appId": "capacity"
       }
     ]
@@ -443,7 +451,9 @@ var APPLICATIONS = {
         "domains": [
           "chat.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "chat.topolo.app"
+        ],
         "appId": "chat"
       },
       {
@@ -1003,7 +1013,9 @@ var APPLICATIONS = {
         "domains": [
           "mail.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "mail.topolo.app"
+        ],
         "appId": "mail"
       },
       {
@@ -1163,7 +1175,9 @@ var APPLICATIONS = {
         "domains": [
           "observability-watch.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "observability-watch.topolo.app"
+        ],
         "appId": "observability_watch"
       }
     ]
@@ -1798,7 +1812,7 @@ var APPLICATION_REQUIREMENTS = [
       "Use TopoloAppMetricCard, TopoloAppEmptyState, TopoloAppStatusBadge, TopoloAppGrid, and TopoloAppSection for repeated app body patterns",
       "Keep visual QA fixtures available through visualQa=1 or __devpreview=1 so screenshot checks do not depend on live API state",
       "Keep mobile and desktop shell behavior aligned with the platform UI kit",
-      "Constrain app-owned workspace wrappers with min-width: 0, width: auto, and viewport-aware max-width so shell padding cannot create page-level horizontal overflow"
+      "Constrain the app workspace-view layout wrappers with min-width: 0, width: auto, and viewport-aware max-width so shell padding cannot create page-level horizontal overflow"
     ]
   },
   {
@@ -3403,6 +3417,7 @@ var CrmModule = class {
   constructor(client) {
     this.client = client;
   }
+  client;
   async listContacts(options = {}) {
     const res = await this.client.request({
       service: "crm",
@@ -3448,6 +3463,7 @@ var IdentityModule = class {
   constructor(client) {
     this.client = client;
   }
+  client;
   /** Returns the resolved user, organization, and permission set for the
    *  current credential. Equivalent to `TopoloClient.introspect()` — exposed
    *  on this module for symmetry with the other domain modules. */
@@ -9461,20 +9477,13 @@ function scaffoldFiles(options) {
     `CREATE TABLE IF NOT EXISTS ${tablePrefix}_workspaces (`,
     "  id TEXT PRIMARY KEY,",
     `  ${tenantColumn} TEXT NOT NULL,`,
-    "  name TEXT NOT NULL,",
-    "  slug TEXT NOT NULL,",
-    "  created_by_user_id TEXT,",
-    "  created_by_email TEXT,",
+    "  status TEXT NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'archived')),",
     "  created_at TEXT NOT NULL,",
-    "  updated_at TEXT NOT NULL,",
-    `  UNIQUE(${tenantColumn}, slug)`,
+    "  updated_at TEXT NOT NULL",
     ");",
     "",
     `CREATE INDEX IF NOT EXISTS idx_${tablePrefix}_workspaces_${tenantColumn}`,
     `  ON ${tablePrefix}_workspaces(${tenantColumn});`,
-    "",
-    `CREATE INDEX IF NOT EXISTS idx_${tablePrefix}_workspaces_slug`,
-    `  ON ${tablePrefix}_workspaces(${tenantColumn}, slug);`,
     ""
   ].join("\n");
   const base = target === "platform" ? firstPartyAppPath(application.appDir, options.payload.audience) : application.appDir;
@@ -10037,10 +10046,10 @@ export default defineConfig({
       if (options.payload.resources.d1) {
         files.push({
           path: `${apiBase}/migrations/0001_initial.sql`,
-          purpose: "Canonical multi-tenant baseline: the app workspaces table.",
+          purpose: "Canonical multi-tenant baseline: the identity-only workspace mirror (platform owns the record).",
           requiredSignals: [
-            `${tablePrefix}_workspaces carries ${tenantColumn} on every row`,
-            "every domain table added later carries the tenant + workspace columns"
+            `${tablePrefix}_workspaces is an identity-only mirror (id, ${tenantColumn}, status) \u2014 no name/slug/is_default; the workspace record lives in TopoloAuth`,
+            `every domain table added later carries ${tenantColumn} and a workspace_id scope column`
           ],
           content: workspacesMigrationSql
         });
@@ -10332,6 +10341,22 @@ async function reconcileApplicationCapabilitySource(options) {
     distributionModel: registration.distributionModel === "marketplace" ? "marketplace" : "organization_internal",
     requested: [...existing, ...options.additions ?? []]
   });
+  const marketplace = record(registration.marketplace);
+  const unlistedNativeArtifact = options.ownerType === "topolo_first_party" && registration.surfaceModel === "mobile_container" && registration.distributionModel === "organization_internal" && marketplace?.intent === "unlisted";
+  if (unlistedNativeArtifact) {
+    return {
+      mode: options.mode,
+      applied: false,
+      status: "in_sync",
+      manifestPath,
+      packagePath,
+      contractPath,
+      capabilities,
+      changes: [],
+      missingResources: [],
+      verticalConfiguration: []
+    };
+  }
   const expectedComposition = capabilityCompositionProjection(capabilities);
   const expectedNotifications = capabilities.selected.includes("notification_producer") ? { role: "producer", contracts: "topolo.notification-contracts.json" } : capabilities.selected.includes("notifications") ? { role: "consumer_only" } : { role: "internal_non_producer" };
   const changes = [];
@@ -10598,6 +10623,9 @@ function resolveManifestApplicationUrl(manifest, environment) {
   if (hostOverride) return `https://${hostOverride.replace(/^https?:\/\//, "").replace(/\/+$/, "")}`;
   const domain = manifest.environments?.[environment]?.domain;
   if (!target.subdomain || !domain) {
+    if (manifest.registration?.productionUrl) {
+      return manifest.registration.productionUrl.replace(/\/+$/, "");
+    }
     throw new Error(`Cannot derive the ${environment} application URL from target ${targetName}.`);
   }
   return `https://${target.subdomain}.${domain}`;
@@ -10623,10 +10651,11 @@ function assertRegistration(value) {
     "version",
     "pricing",
     "supportEmail",
-    "auth",
     "capabilities",
     "marketplace"
   ];
+  const marketplace = record2(registration?.marketplace);
+  if (marketplace?.intent !== "unlisted") required.push("auth");
   const missing = required.filter((field) => registration?.[field] == null || registration[field] === "");
   if (missing.length) {
     throw new Error(
@@ -10730,7 +10759,7 @@ async function loadApplicationReconcileRequest(options) {
   }
   const environment = options.environment || selectedEnvironment();
   const productionUrl = resolveManifestApplicationUrl(manifest, environment);
-  const callbackPath = registration.auth.callbackPath.startsWith("/") ? registration.auth.callbackPath : `/${registration.auth.callbackPath}`;
+  const callbackPath = registration.auth ? registration.auth.callbackPath.startsWith("/") ? registration.auth.callbackPath : `/${registration.auth.callbackPath}` : null;
   const appId = String(manifest.appId || manifest.app_id || "").trim();
   if (!appId) throw new Error("topolo.app.json must declare the immutable appId.");
   return {
@@ -10760,8 +10789,8 @@ async function loadApplicationReconcileRequest(options) {
       supportEmail: registration.supportEmail,
       tags: registration.tags ?? [],
       screenshots: registration.screenshots ?? [],
-      callbackUrls: [`${productionUrl}${callbackPath}`],
-      requestedScopes: registration.auth.requestedScopes,
+      callbackUrls: callbackPath ? [`${productionUrl}${callbackPath}`] : [],
+      requestedScopes: registration.auth?.requestedScopes ?? [],
       capabilities: registration.capabilities,
       marketplace: { ...registration.marketplace, appUrl: productionUrl },
       notifications: manifest.notifications ?? null

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@topolo/cli",
-  "version": "0.6.1",
-  "topoloPublishedVersion": "0.6.1",
+  "version": "0.6.4",
+  "topoloPublishedVersion": "0.6.4",
   "description": "Command-line interface for Topolo developers, operators, and agents, with internal first-party scaffolding available under the topolo platform namespace.",
   "type": "module",
   "bin": {
@@ -12,7 +12,7 @@
     "skills"
   ],
   "scripts": {
-    "build:sdk": "pnpm --dir ../topolo-sdk build",
+    "build:sdk": "python3 ../../tooling/with-resource-lock.py ../topolo-sdk -- pnpm --dir ../topolo-sdk build",
     "prebuild": "pnpm run build:sdk",
     "build": "tsup && node scripts/vendor-generator.mjs",
     "dev": "tsup --watch",