npm - @topolo/mcp - Versions diffs - 0.10.2 → 0.11.0 - Mend

@topolo/mcp 0.10.2 → 0.11.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7) hide show

package/dist/index.js CHANGED Viewed

@@ -3,7 +3,7 @@
 // src/index.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-// ../topolo-sdk/dist/index.js
+// ../../../public-platform-tooling-boundary-20260813/packages/topolo-sdk/dist/index.js
 function applyAuthHeaders(headers, credential) {
   if (credential.kind === "api_key") {
     headers.set("X-Api-Key", credential.apiKey);
@@ -30,6 +30,90 @@ var TopoloSdkError = class extends Error {
     this.code = code;
   }
 };
+var PUBLIC_ERROR_CODES = /* @__PURE__ */ new Set([
+  "action_app_identity_unavailable",
+  "action_authentication_required",
+  "action_catalog_summary_unavailable",
+  "action_catalog_unavailable",
+  "action_contract_mismatch",
+  "action_permission_required",
+  "action_runtime_authorization_required",
+  "action_service_not_allowed",
+  "auth_error",
+  "authentication_required",
+  "authorization_pending",
+  "bad_sig",
+  "confirmation_required",
+  "dependency_unavailable",
+  "environment_mismatch",
+  "environment_service_url_required",
+  "expired_token",
+  "forbidden",
+  "http_error",
+  "immutable_drift",
+  "integration_dependency_unavailable",
+  "integration_misconfigured",
+  "invalid_action",
+  "invalid_action_input",
+  "invalid_grant",
+  "invalid_input",
+  "invalid_token",
+  "mcp_error",
+  "membership_required",
+  "network_error",
+  "organization_context_required",
+  "organization_enrollment_required",
+  "permission_denied",
+  "rate_limited",
+  "request_failed",
+  "service_catalog_unavailable",
+  "service_path_origin_mismatch",
+  "service_required",
+  "slow_down",
+  "state_conflict",
+  "unauthorized",
+  "unknown_action",
+  "unknown_service"
+]);
+var ERROR_CODE_PATTERN = /^[a-z][a-z0-9_]{0,63}$/;
+var TOPOLO_REQUEST_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var CLOUDFLARE_RAY_ID_PATTERN = /^[0-9a-f]{16}-[A-Z]{3}$/;
+var PERMISSION_PATTERN = /^[a-z][a-z0-9_-]{0,63}(?:\.[a-z][a-z0-9_-]{0,63})*:(?:[a-z][a-z0-9_-]{0,63}|\*)$/;
+var RETRY_AFTER_DATE_PATTERN = /^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), \d{2} (?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \d{4} \d{2}:\d{2}:\d{2} GMT$/;
+var PUBLIC_DETAIL_SOURCES = /* @__PURE__ */ new Set([
+  "api_key_introspection",
+  "api_key_validation",
+  "auth_context",
+  "auth_validate",
+  "catalog",
+  "credential",
+  "runtime",
+  "service_token_provider",
+  "service_verify_key",
+  "token_validation",
+  "upstream"
+]);
+function canonicalTopoloErrorCode(value) {
+  if (typeof value !== "string") return null;
+  const candidate = value.trim().toLowerCase();
+  if (!ERROR_CODE_PATTERN.test(candidate) || !PUBLIC_ERROR_CODES.has(candidate)) return null;
+  return candidate;
+}
+function canonicalTopoloRequestId(value) {
+  if (typeof value !== "string") return void 0;
+  const candidate = value.trim();
+  return TOPOLO_REQUEST_ID_PATTERN.test(candidate) || CLOUDFLARE_RAY_ID_PATTERN.test(candidate) ? candidate : void 0;
+}
+function canonicalTopoloRetryAfter(value) {
+  if (typeof value !== "string") return void 0;
+  const candidate = value.trim();
+  if (/^\d{1,10}$/.test(candidate) || RETRY_AFTER_DATE_PATTERN.test(candidate)) return candidate;
+  return void 0;
+}
+function canonicalTopoloRequired(value) {
+  if (!Array.isArray(value)) return [];
+  return [...new Set(value.filter((item) => typeof item === "string" && PERMISSION_PATTERN.test(item)))].slice(0, 32);
+}
 var TopoloAuthError = class extends TopoloSdkError {
   status;
   body;
@@ -37,15 +121,19 @@ var TopoloAuthError = class extends TopoloSdkError {
   path;
   requestId;
   retryAfter;
+  details;
   constructor(message, code = "auth_error", options = {}) {
-    super(code, message);
+    super(canonicalTopoloErrorCode(code) ?? "auth_error", message);
     this.name = "TopoloAuthError";
     this.status = options.status ?? 401;
     this.body = options.body;
     this.service = options.service;
     this.path = options.path;
-    this.requestId = options.requestId;
-    this.retryAfter = options.retryAfter;
+    this.requestId = canonicalTopoloRequestId(options.requestId);
+    this.retryAfter = canonicalTopoloRetryAfter(options.retryAfter);
+    this.details = extractTopoloServiceErrorDetails(
+      options.details === void 0 ? options.body : { details: options.details }
+    );
   }
 };
 var TopoloPermissionError = class extends TopoloSdkError {
@@ -56,28 +144,140 @@ var TopoloPermissionError = class extends TopoloSdkError {
   path;
   requestId;
   retryAfter;
+  details;
   constructor(message, required, options = {}) {
-    super("permission_denied", message);
+    super(
+      canonicalTopoloErrorCode(options.code) ?? serviceErrorCode(options.body, "permission_denied"),
+      message
+    );
     this.name = "TopoloPermissionError";
-    this.required = required;
+    this.required = canonicalTopoloRequired(required);
     this.status = options.status ?? 403;
     this.body = options.body;
     this.service = options.service;
     this.path = options.path;
-    this.requestId = options.requestId;
-    this.retryAfter = options.retryAfter;
+    this.requestId = canonicalTopoloRequestId(options.requestId);
+    this.retryAfter = canonicalTopoloRetryAfter(options.retryAfter);
+    this.details = extractTopoloServiceErrorDetails(
+      options.details === void 0 ? options.body : { details: options.details }
+    );
   }
 };
-function extractHttpErrorCode(body) {
-  if (!body || typeof body !== "object" || Array.isArray(body)) return "http_error";
+function extractTopoloServiceErrorCode(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return null;
   const record = body;
-  if (typeof record.code === "string" && record.code.trim()) return record.code.trim();
+  const topLevel = canonicalTopoloErrorCode(record.code);
+  if (topLevel) return topLevel;
   const nested = record.error;
+  const nestedString = canonicalTopoloErrorCode(nested);
+  if (nestedString) return nestedString;
   if (nested && typeof nested === "object" && !Array.isArray(nested)) {
     const code = nested.code;
-    if (typeof code === "string" && code.trim()) return code.trim();
+    const nestedCode = canonicalTopoloErrorCode(code);
+    if (nestedCode) return nestedCode;
+  }
+  return null;
+}
+function serviceErrorCode(body, fallback) {
+  return extractTopoloServiceErrorCode(body) ?? fallback;
+}
+function extractTopoloServiceErrorDetails(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return void 0;
+  const record = body;
+  let candidate = record.details;
+  const nested = record.error;
+  if (nested && typeof nested === "object" && !Array.isArray(nested)) {
+    const nestedRecord = nested;
+    if (candidate === void 0) candidate = nestedRecord.details ?? nestedRecord;
+  }
+  if (candidate === void 0) candidate = record;
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) return void 0;
+  const source = candidate;
+  const safe = {};
+  for (const [key, value] of Object.entries(source)) {
+    if (/present$/i.test(key) && typeof value === "boolean") {
+      safe[key] = value;
+      continue;
+    }
+    if (key === "retryable" && typeof value === "boolean") {
+      safe.retryable = value;
+      continue;
+    }
+    if (key === "code") {
+      const sanitized = canonicalTopoloErrorCode(value);
+      if (sanitized) safe.code = sanitized;
+      continue;
+    }
+    if (key === "source") {
+      const sanitized = typeof value === "string" ? value.trim().toLowerCase() : "";
+      if (PUBLIC_DETAIL_SOURCES.has(sanitized)) safe.source = sanitized;
+      continue;
+    }
+    if (key === "dependency" || key === "platform") {
+      safe[`${key}Present`] = value !== null && value !== void 0;
+      continue;
+    }
+    if (key === "error" && !safe.code) {
+      const sanitized = canonicalTopoloErrorCode(value);
+      if (sanitized) safe.code = sanitized;
+      continue;
+    }
+    if (key === "required" && Array.isArray(value)) {
+      const required = canonicalTopoloRequired(value);
+      if (required.length) safe.required = required;
+      continue;
+    }
+    if (["missingFields", "fields", "paths"].includes(key) && Array.isArray(value)) {
+      const paths = value.filter((item) => typeof item === "string" && /^[$.a-z0-9_[\]-]{1,160}$/i.test(item));
+      if (paths.length) safe[key] = paths;
+    }
+  }
+  return Object.keys(safe).length ? safe : void 0;
+}
+function publicTopoloErrorMessage(error) {
+  const code = canonicalTopoloErrorCode(
+    typeof error === "string" ? error : error.code ?? extractTopoloServiceErrorCode(error.body)
+  ) ?? "request_failed";
+  if (/(?:organization|org).*(?:enroll|membership|member|admission)/.test(code)) {
+    return "Organization or application enrollment is required.";
+  }
+  if (/(?:organization|org).*(?:context|required|missing|invalid|unknown|not_found)/.test(code)) {
+    return "Organization context is unavailable.";
+  }
+  if (["auth_error", "authentication_required", "unauthorized", "invalid_token", "expired_token"].includes(code)) {
+    return "Authentication failed.";
+  }
+  if (code === "permission_denied" || code === "forbidden") return "Permission denied.";
+  if (code === "confirmation_required") return "Confirmation is required.";
+  return `Topolo request failed (${code}).`;
+}
+function topoloErrorHint(error) {
+  const code = canonicalTopoloErrorCode(
+    typeof error === "string" ? error : error.code ?? extractTopoloServiceErrorCode(error.body)
+  );
+  if (!code) return void 0;
+  if (code === "auth_error" || code === "authentication_required" || code === "unauthorized" || code === "invalid_token" || code === "expired_token") {
+    return "Run `topolo auth login`, then verify the effective Topolo identity and organization.";
+  }
+  if (code === "confirmation_required") {
+    return "Review the unchanged action plan, obtain approval, and retry once with --confirm or confirm:true.";
+  }
+  if (code === "enrollment_required" || code === "membership_required" || /(?:organization|org).*(?:enroll|membership|member|admission)|(?:enroll|membership).*(?:organization|org)/.test(code)) {
+    return "The current identity is not enrolled for this organization or application. Use an enrolled identity or ask an organization administrator to complete enrollment.";
+  }
+  if (/(?:organization|org).*(?:context|required|missing|invalid|unknown|not_found)/.test(code)) {
+    return "Select a signed-in organization context, then verify the effective identity and organization before retrying.";
   }
-  return "http_error";
+  if (code === "permission_denied" || code === "forbidden") {
+    return "The current identity or resource context is not authorized. Review the structured details and published authorization contract.";
+  }
+  if (code === "environment_mismatch") {
+    return "Use service origins and credentials from one explicit Topolo environment only.";
+  }
+  if (code === "invalid_action_input" || code === "invalid_input") {
+    return "Correct only the reported schema paths, then prepare the action again.";
+  }
+  return void 0;
 }
 var TopoloConfirmationRequiredError = class extends TopoloSdkError {
   constructor(message) {
@@ -92,2282 +292,78 @@ var TopoloHttpError = class extends TopoloSdkError {
   path;
   requestId;
   retryAfter;
+  details;
   constructor(service, path, status, body, message, options = {}) {
-    super(extractHttpErrorCode(body), message ?? `HTTP ${status} from ${service}${path}`);
+    super(serviceErrorCode(body, "http_error"), message ?? `HTTP ${status} from ${service}${path}`);
     this.name = "TopoloHttpError";
     this.status = status;
     this.body = body;
     this.service = service;
-    this.path = path;
-    this.requestId = options.requestId;
-    this.retryAfter = options.retryAfter;
-  }
-};
-var APP_API_URLS = {
-  auth: "https://auth.topolo.app",
-  developers: "https://developers.topolo.app"
-};
-var APPLICATIONS = {
-  "admin": {
-    "id": "admin",
-    "appDir": "TopoloAdmin",
-    "name": "topolo-admin",
-    "packageName": "topolo-admin",
-    "productionUrl": "https://admin.topolo.app",
-    "services": [],
-    "deployTargets": [
-      {
-        "name": "topolo-admin",
-        "kind": "worker",
-        "apiUrl": "https://admin.topolo.app",
-        "domains": [
-          "admin.topolo.app"
-        ],
-        "routes": [
-          "admin.topolo.app"
-        ],
-        "appId": null
-      },
-      {
-        "name": "topolo-admin-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "agent": {
-    "id": "agent",
-    "appDir": "TopoloAgent",
-    "name": "topolo-agent",
-    "packageName": "topolo-agent",
-    "productionUrl": "https://agent.topolo.app",
-    "services": [
-      "agent"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-agent",
-        "kind": "worker",
-        "apiUrl": "https://agent.topolo.app",
-        "domains": [
-          "agent.topolo.app"
-        ],
-        "routes": [
-          "agent.topolo.app"
-        ],
-        "appId": "agent"
-      },
-      {
-        "name": "topolo-agent-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "auth": {
-    "id": "auth",
-    "appDir": "TopoloAuth",
-    "name": "topolo-auth",
-    "packageName": "topolo-auth",
-    "productionUrl": "https://auth.topolo.app",
-    "services": [
-      "auth"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-auth",
-        "kind": "worker",
-        "apiUrl": "https://auth.topolo.app",
-        "domains": [
-          "auth.topolo.app"
-        ],
-        "routes": [
-          "auth.topolo.app"
-        ],
-        "appId": "auth"
-      }
-    ]
-  },
-  "backup": {
-    "id": "backup",
-    "appDir": "TopoloBackup",
-    "name": "topolo-backup",
-    "packageName": "topolo-backup",
-    "productionUrl": "https://backup.topolo.app",
-    "services": [
-      "backup"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-backup",
-        "kind": "worker",
-        "apiUrl": "https://backup.topolo.app",
-        "domains": [
-          "backup.topolo.app"
-        ],
-        "routes": [
-          "backup.topolo.app"
-        ],
-        "appId": "backup"
-      }
-    ]
-  },
-  "blog": {
-    "id": "blog",
-    "appDir": "TopoloBlog",
-    "name": "topolo-blog",
-    "packageName": "topolo-blog",
-    "productionUrl": "https://blog.topolo.app",
-    "services": [
-      "blog"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-blog",
-        "kind": "worker",
-        "apiUrl": "https://blog.topolo.app",
-        "domains": [
-          "blog.topolo.app"
-        ],
-        "routes": [
-          "blog.topolo.app"
-        ],
-        "appId": "blog"
-      },
-      {
-        "name": "topolo-blog-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "books": {
-    "id": "books",
-    "appDir": "TopoloBooks",
-    "name": "topolo-books",
-    "packageName": "topolo-books",
-    "productionUrl": "https://books.topolo.app",
-    "services": [
-      "books"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-books",
-        "kind": "worker",
-        "apiUrl": "https://books.topolo.app",
-        "domains": [
-          "books.topolo.app"
-        ],
-        "routes": [
-          "books.topolo.app"
-        ],
-        "appId": "books"
-      },
-      {
-        "name": "topolo-books-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "brand": {
-    "id": "brand",
-    "appDir": "TopoloBrand",
-    "name": "topolo-brand",
-    "packageName": "@topolo/topolo-brand",
-    "productionUrl": "https://brand.topolo.app",
-    "services": [
-      "brand"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-brand",
-        "kind": "worker",
-        "apiUrl": "https://brand.topolo.app",
-        "domains": [
-          "brand.topolo.app"
-        ],
-        "routes": [
-          "brand.topolo.app"
-        ],
-        "appId": "brand"
-      },
-      {
-        "name": "topolo-brand-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "bugfix": {
-    "id": "bugfix",
-    "appDir": "TopoloBugFix",
-    "name": "topolo-bugfix",
-    "packageName": "topolo-bugfix",
-    "productionUrl": "https://bugfix.topolo.app",
-    "services": [
-      "bugfix"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-bugfix",
-        "kind": "worker",
-        "apiUrl": "https://bugfix.topolo.app",
-        "domains": [
-          "bugfix.topolo.app"
-        ],
-        "routes": [
-          "bugfix.topolo.app"
-        ],
-        "appId": "bugfix"
-      }
-    ]
-  },
-  "bytes": {
-    "id": "bytes",
-    "appDir": "TopoloBytes",
-    "name": "topolo-bytes",
-    "packageName": "topolo-bytes",
-    "productionUrl": "https://bytes.topolo.app",
-    "services": [
-      "bytes"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-bytes",
-        "kind": "worker",
-        "apiUrl": "https://bytes.topolo.app",
-        "domains": [
-          "bytes.topolo.app"
-        ],
-        "routes": [
-          "bytes.topolo.app"
-        ],
-        "appId": "bytes"
-      },
-      {
-        "name": "topolo-bytes-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "calendar": {
-    "id": "calendar",
-    "appDir": "TopoloCalendar",
-    "name": "topolo-calendar",
-    "packageName": "topolo-calendar",
-    "productionUrl": "https://calendar.topolo.app",
-    "services": [
-      "calendar"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-calendar",
-        "kind": "worker",
-        "apiUrl": "https://calendar.topolo.app",
-        "domains": [
-          "calendar.topolo.app"
-        ],
-        "routes": [
-          "calendar.topolo.app"
-        ],
-        "appId": "calendar"
-      },
-      {
-        "name": "topolo-calendar-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "campaigns": {
-    "id": "campaigns",
-    "appDir": "TopoloCampaigns",
-    "name": "topolo-campaigns",
-    "packageName": "topolo-campaigns",
-    "productionUrl": "https://campaigns.topolo.app",
-    "services": [
-      "campaigns"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-campaigns",
-        "kind": "worker",
-        "apiUrl": "https://campaigns.topolo.app",
-        "domains": [
-          "campaigns.topolo.app"
-        ],
-        "routes": [
-          "campaigns.topolo.app"
-        ],
-        "appId": "campaigns"
-      },
-      {
-        "name": "topolo-campaigns-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "capacity": {
-    "id": "capacity",
-    "appDir": "TopoloCapacity",
-    "name": "topolo-capacity",
-    "packageName": "topolo-capacity",
-    "productionUrl": "https://capacity.topolo.app",
-    "services": [
-      "capacity"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-capacity",
-        "kind": "worker",
-        "apiUrl": "https://capacity.topolo.app",
-        "domains": [
-          "capacity.topolo.app"
-        ],
-        "routes": [
-          "capacity.topolo.app"
-        ],
-        "appId": "capacity"
-      }
-    ]
-  },
-  "chat": {
-    "id": "chat",
-    "appDir": "TopoloChat",
-    "name": "topolo-chat",
-    "packageName": "topolo-chat",
-    "productionUrl": "https://chat.topolo.app",
-    "services": [
-      "chat"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-chat",
-        "kind": "worker",
-        "apiUrl": "https://chat.topolo.app",
-        "domains": [
-          "chat.topolo.app"
-        ],
-        "routes": [
-          "chat.topolo.app"
-        ],
-        "appId": "chat"
-      },
-      {
-        "name": "topolo-chat-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "commerce": {
-    "id": "commerce",
-    "appDir": "TopoloCommerce",
-    "name": "topolo-commerce",
-    "packageName": "topolo-commerce",
-    "productionUrl": "https://commerce.topolo.app",
-    "services": [
-      "commerce"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-commerce-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      },
-      {
-        "name": "topolo-commerce-guest-web",
-        "kind": "worker",
-        "apiUrl": "https://guest.topolo.app",
-        "domains": [
-          "guest.topolo.app"
-        ],
-        "routes": [
-          "guest.topolo.app"
-        ],
-        "appId": null
-      },
-      {
-        "name": "topolo-commerce-ops-web",
-        "kind": "worker",
-        "apiUrl": "https://commerce.topolo.app",
-        "domains": [
-          "commerce.topolo.app"
-        ],
-        "routes": [
-          "commerce.topolo.app"
-        ],
-        "appId": "commerce"
-      },
-      {
-        "name": "topolo-commerce-station-web",
-        "kind": "worker",
-        "apiUrl": "https://station-commerce.topolo.app",
-        "domains": [
-          "station-commerce.topolo.app"
-        ],
-        "routes": [
-          "station-commerce.topolo.app"
-        ],
-        "appId": null
-      }
-    ]
-  },
-  "compose": {
-    "id": "compose",
-    "appDir": "TopoloCompose",
-    "name": "topolo-compose",
-    "packageName": "@topolo/compose",
-    "productionUrl": "https://compose.topolo.app",
-    "services": [
-      "compose"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-compose",
-        "kind": "worker",
-        "apiUrl": "https://compose.topolo.app",
-        "domains": [
-          "compose.topolo.app"
-        ],
-        "routes": [
-          "compose.topolo.app"
-        ],
-        "appId": "compose"
-      },
-      {
-        "name": "topolo-compose-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "consent": {
-    "id": "consent",
-    "appDir": "TopoloConsent",
-    "name": "topolo-consent",
-    "packageName": "topolo-consent",
-    "productionUrl": "https://consent.topolo.app",
-    "services": [
-      "consent"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-consent",
-        "kind": "worker",
-        "apiUrl": "https://consent.topolo.app",
-        "domains": [
-          "consent.topolo.app"
-        ],
-        "routes": [
-          "consent.topolo.app"
-        ],
-        "appId": "consent"
-      },
-      {
-        "name": "topolo-consent-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "crm": {
-    "id": "crm",
-    "appDir": "TopoloCRM",
-    "name": "topolo-crm",
-    "packageName": "topolo-crm",
-    "productionUrl": "https://crm.topolo.app",
-    "services": [
-      "crm"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-crm-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      },
-      {
-        "name": "topolo-crm-app",
-        "kind": "worker",
-        "apiUrl": "https://crm.topolo.app",
-        "domains": [
-          "crm.topolo.app"
-        ],
-        "routes": [
-          "crm.topolo.app"
-        ],
-        "appId": "crm"
-      }
-    ]
-  },
-  "design": {
-    "id": "design",
-    "appDir": "TopoloDesign",
-    "name": "topolo-design",
-    "packageName": "@topolo-io/design",
-    "productionUrl": "https://design.topolo.app",
-    "services": [
-      "design"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-design",
-        "kind": "worker",
-        "apiUrl": "https://design.topolo.app",
-        "domains": [
-          "design.topolo.app"
-        ],
-        "routes": [
-          "design.topolo.app"
-        ],
-        "appId": "design"
-      },
-      {
-        "name": "topolo-design-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "developers": {
-    "id": "developers",
-    "appDir": "TopoloDevelopers",
-    "name": "topolo-developers",
-    "packageName": "topolo-developers",
-    "productionUrl": "https://developers.topolo.app",
-    "services": [
-      "developers"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-catalog-cron",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      },
-      {
-        "name": "topolo-developers",
-        "kind": "worker",
-        "apiUrl": "https://developers.topolo.app",
-        "domains": [
-          "developers.topolo.app"
-        ],
-        "routes": [
-          "developers.topolo.app"
-        ],
-        "appId": "developers"
-      },
-      {
-        "name": "topolo-developers-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "director": {
-    "id": "director",
-    "appDir": "TopoloDirector",
-    "name": "topolo-director",
-    "packageName": "topolo-director",
-    "productionUrl": "https://director.topolo.app",
-    "services": [
-      "director"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-director",
-        "kind": "worker",
-        "apiUrl": "https://director.topolo.app",
-        "domains": [
-          "director.topolo.app"
-        ],
-        "routes": [
-          "director.topolo.app"
-        ],
-        "appId": "director"
-      },
-      {
-        "name": "topolo-director-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "docs": {
-    "id": "docs",
-    "appDir": "TopoloDocs",
-    "name": "topolo-docs",
-    "packageName": "topolo-docs",
-    "productionUrl": "https://docs.topolo.app",
-    "services": [],
-    "deployTargets": [
-      {
-        "name": "topolo-docs",
-        "kind": "worker",
-        "apiUrl": "https://docs.topolo.app",
-        "domains": [
-          "docs.topolo.app"
-        ],
-        "routes": [
-          "docs.topolo.app"
-        ],
-        "appId": null
-      },
-      {
-        "name": "topolo-docs-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "feed": {
-    "id": "feed",
-    "appDir": "TopoloFeed",
-    "name": "TopoloFeed",
-    "packageName": "topolo-feed",
-    "productionUrl": "https://feed.topolo.app",
-    "services": [
-      "feed"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-feed-analytics-api",
-        "kind": "worker",
-        "apiUrl": "https://feed-analytics-api.topolo.app",
-        "domains": [
-          "feed-analytics-api.topolo.app"
-        ],
-        "routes": [
-          "feed-analytics-api.topolo.app"
-        ],
-        "appId": null
-      },
-      {
-        "name": "topolo-feed-api",
-        "kind": "worker",
-        "apiUrl": "https://feed-api.topolo.app",
-        "domains": [
-          "feed-api.topolo.app"
-        ],
-        "routes": [
-          "feed-api.topolo.app"
-        ],
-        "appId": null
-      },
-      {
-        "name": "topolo-feed-web",
-        "kind": "worker",
-        "apiUrl": "https://feed.topolo.app",
-        "domains": [
-          "feed.topolo.app"
-        ],
-        "routes": [
-          "feed.topolo.app"
-        ],
-        "appId": "feed"
-      }
-    ]
-  },
-  "flow": {
-    "id": "flow",
-    "appDir": "TopoloFlow",
-    "name": "topolo-flow",
-    "packageName": "topolo-flow",
-    "productionUrl": "https://flow.topolo.app",
-    "services": [
-      "flow"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-flow",
-        "kind": "worker",
-        "apiUrl": "https://flow.topolo.app",
-        "domains": [
-          "flow.topolo.app"
-        ],
-        "routes": [
-          "flow.topolo.app"
-        ],
-        "appId": "flow"
-      },
-      {
-        "name": "topolo-flow-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "forecast": {
-    "id": "forecast",
-    "appDir": "TopoloForecast",
-    "name": "topolo-forecast",
-    "packageName": "topolo-forecast",
-    "productionUrl": "https://forecast.topolo.app",
-    "services": [
-      "forecast"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-forecast",
-        "kind": "worker",
-        "apiUrl": "https://forecast.topolo.app",
-        "domains": [
-          "forecast.topolo.app"
-        ],
-        "routes": [
-          "forecast.topolo.app"
-        ],
-        "appId": "forecast"
-      },
-      {
-        "name": "topolo-forecast-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "forms": {
-    "id": "forms",
-    "appDir": "TopoloForms",
-    "name": "topolo-forms",
-    "packageName": "topolo-forms",
-    "productionUrl": "https://forms.topolo.app",
-    "services": [
-      "forms"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-forms",
-        "kind": "worker",
-        "apiUrl": "https://forms.topolo.app",
-        "domains": [
-          "forms.topolo.app"
-        ],
-        "routes": [
-          "forms.topolo.app"
-        ],
-        "appId": "forms"
-      },
-      {
-        "name": "topolo-forms-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "home": {
-    "id": "home",
-    "appDir": "TopoloHome",
-    "name": "topolo-home",
-    "packageName": "topolo-home",
-    "productionUrl": "https://home.topolo.app",
-    "services": [
-      "home"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-home",
-        "kind": "worker",
-        "apiUrl": "https://home.topolo.app",
-        "domains": [
-          "home.topolo.app"
-        ],
-        "routes": [
-          "home.topolo.app"
-        ],
-        "appId": "home"
-      },
-      {
-        "name": "topolo-home-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "insights": {
-    "id": "insights",
-    "appDir": "TopoloInsights",
-    "name": "topolo-insights",
-    "packageName": "topolo-insights",
-    "productionUrl": "https://insights.topolo.app",
-    "services": [
-      "insights"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-insights",
-        "kind": "worker",
-        "apiUrl": "https://insights.topolo.app",
-        "domains": [
-          "insights.topolo.app"
-        ],
-        "routes": [
-          "insights.topolo.app"
-        ],
-        "appId": "insights"
-      },
-      {
-        "name": "topolo-insights-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "inventory": {
-    "id": "inventory",
-    "appDir": "TopoloInventory",
-    "name": "topolo-inventory",
-    "packageName": "topolo-inventory",
-    "productionUrl": "https://inventory.topolo.app",
-    "services": [
-      "inventory"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-inventory",
-        "kind": "worker",
-        "apiUrl": "https://inventory.topolo.app",
-        "domains": [
-          "inventory.topolo.app"
-        ],
-        "routes": [
-          "inventory.topolo.app"
-        ],
-        "appId": "inventory"
-      },
-      {
-        "name": "topolo-inventory-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "learn": {
-    "id": "learn",
-    "appDir": "TopoloLearn",
-    "name": "topololearn",
-    "packageName": "topolo-learn",
-    "productionUrl": "https://learn.topolo.app",
-    "services": [
-      "learn"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-learn",
-        "kind": "worker",
-        "apiUrl": "https://learn.topolo.app",
-        "domains": [
-          "learn.topolo.app"
-        ],
-        "routes": [
-          "learn.topolo.app"
-        ],
-        "appId": "learn"
-      },
-      {
-        "name": "topolo-learn-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "localize": {
-    "id": "localize",
-    "appDir": "TopoloLocalize",
-    "name": "topolo-localize",
-    "packageName": "topolo-localize",
-    "productionUrl": "https://localize.topolo.app",
-    "services": [
-      "localize"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-localize",
-        "kind": "worker",
-        "apiUrl": "https://localize.topolo.app",
-        "domains": [
-          "localize.topolo.app"
-        ],
-        "routes": [
-          "localize.topolo.app"
-        ],
-        "appId": "localize"
-      }
-    ]
-  },
-  "mail": {
-    "id": "mail",
-    "appDir": "TopoloMail",
-    "name": "topolo-mail",
-    "packageName": "topolo-mail",
-    "productionUrl": "https://mail.topolo.app",
-    "services": [
-      "mail"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-mail",
-        "kind": "worker",
-        "apiUrl": "https://mail.topolo.app",
-        "domains": [
-          "mail.topolo.app"
-        ],
-        "routes": [
-          "mail.topolo.app"
-        ],
-        "appId": "mail"
-      },
-      {
-        "name": "topolo-mail-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "mdm": {
-    "id": "mdm",
-    "appDir": "TopoloMDM",
-    "name": "TopoloMDM",
-    "packageName": "topolo-mdm",
-    "productionUrl": "https://mdm.topolo.app",
-    "services": [
-      "mdm"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-mdm-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      },
-      {
-        "name": "topolo-mdm-console",
-        "kind": "worker",
-        "apiUrl": "https://mdm.topolo.app",
-        "domains": [
-          "mdm.topolo.app"
-        ],
-        "routes": [
-          "mdm.topolo.app"
-        ],
-        "appId": "mdm"
-      }
-    ]
-  },
-  "messages": {
-    "id": "messages",
-    "appDir": "TopoloMessages",
-    "name": "topolo-messages",
-    "packageName": "topolo-messages",
-    "productionUrl": "https://messages.topolo.app",
-    "services": [
-      "messages"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-messages",
-        "kind": "worker",
-        "apiUrl": "https://messages.topolo.app",
-        "domains": [
-          "messages.topolo.app"
-        ],
-        "routes": [
-          "messages.topolo.app"
-        ],
-        "appId": "messages"
-      },
-      {
-        "name": "topolo-messages-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      },
-      {
-        "name": "topolo-messages-dispatch",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "nexus": {
-    "id": "nexus",
-    "appDir": "TopoloNexus",
-    "name": "topolo-nexus",
-    "packageName": "topolo-nexus",
-    "productionUrl": "https://nexus.topolo.app",
-    "services": [
-      "nexus"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-nexus-dashboard",
-        "kind": "worker",
-        "apiUrl": "https://nexus.topolo.app",
-        "domains": [
-          "nexus.topolo.app"
-        ],
-        "routes": [
-          "nexus.topolo.app"
-        ],
-        "appId": null
-      },
-      {
-        "name": "topolo-nexus-gateway",
-        "kind": "worker",
-        "apiUrl": "https://nexus.topolo.app",
-        "domains": [
-          "nexus.topolo.app"
-        ],
-        "routes": [],
-        "appId": "nexus"
-      }
-    ]
-  },
-  "notify": {
-    "id": "notify",
-    "appDir": "TopoloNotify",
-    "name": "topolo-notify",
-    "packageName": "@topolo/notify",
-    "productionUrl": "https://notify.topolo.app",
-    "services": [
-      "notify"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-notify",
-        "kind": "worker",
-        "apiUrl": "https://notify.topolo.app",
-        "domains": [
-          "notify.topolo.app"
-        ],
-        "routes": [
-          "notify.topolo.app"
-        ],
-        "appId": "notify"
-      }
-    ]
-  },
-  "observability_watch": {
-    "id": "observability_watch",
-    "appDir": "TopoloObservabilityWatch",
-    "name": "topolo-observability-watch",
-    "packageName": "topolo-observability-watch",
-    "productionUrl": "https://observability-watch.topolo.app",
-    "services": [
-      "observability_watch"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-observability-watch",
-        "kind": "worker",
-        "apiUrl": "https://observability-watch.topolo.app",
-        "domains": [
-          "observability-watch.topolo.app"
-        ],
-        "routes": [
-          "observability-watch.topolo.app"
-        ],
-        "appId": "observability_watch"
-      }
-    ]
-  },
-  "one": {
-    "id": "one",
-    "appDir": "TopoloOne",
-    "name": "TopoloOne",
-    "packageName": "topolo-oneclick-sso",
-    "productionUrl": "https://one.topolo.app",
-    "services": [
-      "one"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-one",
-        "kind": "worker",
-        "apiUrl": "https://one.topolo.app",
-        "domains": [
-          "one.topolo.app"
-        ],
-        "routes": [
-          "one.topolo.app/*"
-        ],
-        "appId": null
-      },
-      {
-        "name": "topolo-one-api",
-        "kind": "worker",
-        "apiUrl": "https://www.topolo.app",
-        "domains": [
-          "www.topolo.app"
-        ],
-        "routes": [
-          "www.topolo.app/*"
-        ],
-        "appId": "one"
-      },
-      {
-        "name": "topolo-one-website",
-        "kind": "worker",
-        "apiUrl": "https://topolo.io",
-        "domains": [
-          "topolo.io"
-        ],
-        "routes": [
-          "one.topolo.io",
-          "topolo.io",
-          "www.topolo.io"
-        ],
-        "appId": null
-      }
-    ]
-  },
-  "p2p": {
-    "id": "p2p",
-    "appDir": "TopoloP2P",
-    "name": "topolo-p2p",
-    "packageName": "topolo-p2p",
-    "productionUrl": "https://p2p.topolo.app",
-    "services": [
-      "p2p"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-p2p",
-        "kind": "worker",
-        "apiUrl": "https://p2p.topolo.app",
-        "domains": [
-          "p2p.topolo.app"
-        ],
-        "routes": [
-          "p2p.topolo.app"
-        ],
-        "appId": "p2p"
-      },
-      {
-        "name": "topolo-p2p-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "pay": {
-    "id": "pay",
-    "appDir": "TopoloPay",
-    "name": "topolo-pay",
-    "packageName": "topolo-pay",
-    "productionUrl": "https://pay.topolo.app",
-    "services": [
-      "pay"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-pay",
-        "kind": "worker",
-        "apiUrl": "https://pay.topolo.app",
-        "domains": [
-          "pay.topolo.app"
-        ],
-        "routes": [
-          "pay.topolo.app"
-        ],
-        "appId": "pay"
-      },
-      {
-        "name": "topolo-pay-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "people": {
-    "id": "people",
-    "appDir": "TopoloPeople",
-    "name": "topolo-people",
-    "packageName": "topolo-people",
-    "productionUrl": "https://people.topolo.app",
-    "services": [
-      "people"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-people",
-        "kind": "worker",
-        "apiUrl": "https://people.topolo.app",
-        "domains": [
-          "people.topolo.app"
-        ],
-        "routes": [
-          "people.topolo.app"
-        ],
-        "appId": "people"
-      },
-      {
-        "name": "topolo-people-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "quro": {
-    "id": "quro",
-    "appDir": "TopoloQuro",
-    "name": "TopoloQuro",
-    "packageName": "topolo-quro",
-    "productionUrl": "https://quro.topolo.app",
-    "services": [
-      "quro.api",
-      "quro.redirect"
-    ],
-    "deployTargets": [
-      {
-        "name": "quro-api",
-        "kind": "worker",
-        "apiUrl": "https://api.ol0.me",
-        "domains": [
-          "api.ol0.me"
-        ],
-        "routes": [
-          "api.ol0.me/*"
-        ],
-        "appId": "quro.api"
-      },
-      {
-        "name": "quro-redirect-system",
-        "kind": "worker",
-        "apiUrl": "https://ol0.me",
-        "domains": [
-          "ol0.me"
-        ],
-        "routes": [
-          "ol0.me/*"
-        ],
-        "appId": "quro.redirect"
-      },
-      {
-        "name": "quro-ui",
-        "kind": "worker",
-        "apiUrl": "https://quro.topolo.app",
-        "domains": [
-          "quro.topolo.app"
-        ],
-        "routes": [
-          "quro.topolo.app"
-        ],
-        "appId": null
-      }
-    ]
-  },
-  "roadmapper": {
-    "id": "roadmapper",
-    "appDir": "TopoloRoadmapper",
-    "name": "topolo-roadmapper",
-    "packageName": "topolo-roadmapper",
-    "productionUrl": "https://roadmapper.topolo.app",
-    "services": [
-      "roadmapper"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-roadmapper",
-        "kind": "worker",
-        "apiUrl": "https://roadmapper.topolo.app",
-        "domains": [
-          "roadmapper.topolo.app"
-        ],
-        "routes": [
-          "roadmapper.topolo.app"
-        ],
-        "appId": "roadmapper"
-      },
-      {
-        "name": "topolo-roadmapper-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "sign": {
-    "id": "sign",
-    "appDir": "TopoloSign",
-    "name": "topolo-sign",
-    "packageName": "topolo-sign",
-    "productionUrl": "https://sign.topolo.app",
-    "services": [
-      "sign"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-sign",
-        "kind": "worker",
-        "apiUrl": "https://sign.topolo.app",
-        "domains": [
-          "sign.topolo.app"
-        ],
-        "routes": [
-          "sign.topolo.app"
-        ],
-        "appId": "sign"
-      },
-      {
-        "name": "topolo-sign-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "social_studio": {
-    "id": "social_studio",
-    "appDir": "TopoloSocialStudio",
-    "name": "topolo-social-studio",
-    "packageName": "topolo-social-studio",
-    "productionUrl": "https://studio.topolo.app",
-    "services": [
-      "social_studio"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-social-studio",
-        "kind": "worker",
-        "apiUrl": "https://studio.topolo.app",
-        "domains": [
-          "studio.topolo.app"
-        ],
-        "routes": [
-          "studio.topolo.app"
-        ],
-        "appId": "social_studio"
-      },
-      {
-        "name": "topolo-social-studio-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      },
-      {
-        "name": "topolo-social-studio-queue",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "socialize": {
-    "id": "socialize",
-    "appDir": "TopoloSocialize",
-    "name": "socialize",
-    "packageName": "topolo-socialize",
-    "productionUrl": "https://socialize.topolo.app",
-    "services": [
-      "socialize"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-socialize",
-        "kind": "worker",
-        "apiUrl": "https://socialize.topolo.app",
-        "domains": [
-          "socialize.topolo.app"
-        ],
-        "routes": [
-          "socialize.topolo.app"
-        ],
-        "appId": "socialize"
-      },
-      {
-        "name": "topolo-socialize-api",
-        "kind": "worker",
-        "apiUrl": "https://socialize-api.topolo.app",
-        "domains": [
-          "socialize-api.topolo.app"
-        ],
-        "routes": [
-          "socialize-api.topolo.app"
-        ],
-        "appId": null
-      },
-      {
-        "name": "topolo-socialize-scheduler",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "spaces": {
-    "id": "spaces",
-    "appDir": "TopoloSpaces",
-    "name": "topolo-spaces",
-    "packageName": "@topolo/spaces",
-    "productionUrl": "https://spaces.topolo.app",
-    "services": [
-      "spaces"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-spaces",
-        "kind": "worker",
-        "apiUrl": "https://spaces.topolo.app",
-        "domains": [
-          "spaces.topolo.app"
-        ],
-        "routes": [
-          "spaces.topolo.app"
-        ],
-        "appId": "spaces"
-      },
-      {
-        "name": "topolo-spaces-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "status": {
-    "id": "status",
-    "appDir": "TopoloStatus",
-    "name": "topolo-status",
-    "packageName": "topolo-status",
-    "productionUrl": "https://status.topolo.app",
-    "services": [
-      "status"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-status",
-        "kind": "worker",
-        "apiUrl": "https://status.topolo.app",
-        "domains": [
-          "status.topolo.app"
-        ],
-        "routes": [
-          "status.topolo.app"
-        ],
-        "appId": "status"
-      }
-    ]
-  },
-  "success": {
-    "id": "success",
-    "appDir": "TopoloSuccess",
-    "name": "topolo-success",
-    "packageName": "topolo-success",
-    "productionUrl": "https://success.topolo.app",
-    "services": [
-      "success"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-success",
-        "kind": "worker",
-        "apiUrl": "https://success.topolo.app",
-        "domains": [
-          "success.topolo.app"
-        ],
-        "routes": [
-          "success.topolo.app"
-        ],
-        "appId": "success"
-      },
-      {
-        "name": "topolo-success-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "support": {
-    "id": "support",
-    "appDir": "TopoloSupport",
-    "name": "topolo-support",
-    "packageName": "topolo-support",
-    "productionUrl": "https://support.topolo.app",
-    "services": [
-      "support"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-support",
-        "kind": "worker",
-        "apiUrl": "https://support.topolo.app",
-        "domains": [
-          "support.topolo.app"
-        ],
-        "routes": [
-          "support.topolo.app/*"
-        ],
-        "appId": "support"
-      },
-      {
-        "name": "topolo-support-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "survey": {
-    "id": "survey",
-    "appDir": "TopoloSurvey",
-    "name": "topolo-survey",
-    "packageName": "topolo-survey",
-    "productionUrl": "https://survey.topolo.app",
-    "services": [
-      "survey"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-survey",
-        "kind": "worker",
-        "apiUrl": "https://survey.topolo.app",
-        "domains": [
-          "survey.topolo.app"
-        ],
-        "routes": [
-          "survey.topolo.app"
-        ],
-        "appId": "survey"
-      },
-      {
-        "name": "topolo-survey-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "voice": {
-    "id": "voice",
-    "appDir": "TopoloVoice",
-    "name": "topolo-voice",
-    "packageName": "topolo-voice",
-    "productionUrl": "https://voice.topolo.app",
-    "services": [
-      "voice"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-voice",
-        "kind": "worker",
-        "apiUrl": "https://voice.topolo.app",
-        "domains": [
-          "voice.topolo.app"
-        ],
-        "routes": [
-          "voice.topolo.app"
-        ],
-        "appId": "voice"
-      },
-      {
-        "name": "topolo-voice-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      }
-    ]
-  },
-  "web": {
-    "id": "web",
-    "appDir": "TopoloWeb",
-    "name": "topoloweb",
-    "packageName": "topolo-web",
-    "productionUrl": "https://web.topolo.app",
-    "services": [
-      "web"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-web-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "appId": null
-      },
-      {
-        "name": "topolo-web-runtime",
-        "kind": "worker",
-        "apiUrl": "https://sites.topolo.app",
-        "domains": [
-          "sites.topolo.app"
-        ],
-        "routes": [
-          "*.sites.topolo.app/*",
-          "sites.topolo.app"
-        ],
-        "appId": null
-      },
-      {
-        "name": "topolo-web-studio",
-        "kind": "worker",
-        "apiUrl": "https://web.topolo.app",
-        "domains": [
-          "web.topolo.app"
-        ],
-        "routes": [
-          "web.topolo.app"
-        ],
-        "appId": "web"
-      }
-    ]
-  }
-};
-function friendlyAppId(entry) {
-  for (const value of [entry.slug, entry.name, entry.appId]) {
-    if (typeof value !== "string" || !value.trim()) continue;
-    const normalized = value.trim().toLowerCase().replace(/\s+/g, "-");
-    const withoutPrefix = normalized.replace(/^(?:app[_-])?topolo[-_]+/, "");
-    if (withoutPrefix) return withoutPrefix;
-  }
-  return entry.appId;
-}
-function idVariants(value) {
-  const normalized = value.trim().toLowerCase().replace(/\s+/g, "-");
-  return [.../* @__PURE__ */ new Set([
-    normalized,
-    normalized.replace(/-/g, "_"),
-    normalized.replace(/_/g, "-")
-  ])].filter(Boolean);
-}
-var STATIC_APPLICATIONS = APPLICATIONS;
-function staticApplicationForId(id) {
-  for (const variant of idVariants(id)) {
-    const entry = STATIC_APPLICATIONS[variant];
-    if (entry) return entry;
-  }
-  return null;
-}
-function applicationEntryFromCatalog(live) {
-  const id = friendlyAppId(live);
-  return {
-    id,
-    appDir: "-",
-    name: live.name ?? live.slug ?? live.appId,
-    packageName: null,
-    productionUrl: live.launchUrl ?? live.apiBaseUrl ?? null,
-    services: live.apiBaseUrl ? [id] : [],
-    deployTargets: []
-  };
-}
-var DIRECTORY_PAGE_LIMIT = 100;
-var DIRECTORY_MAX_PAGES = 100;
-function staticApplicationDirectory() {
-  const applications = Object.entries(STATIC_APPLICATIONS).map(([id, application]) => ({
-    id,
-    application,
-    source: "static",
-    live: null
-  })).sort((left, right) => left.id.localeCompare(right.id));
-  return { source: "static_fallback", applications };
-}
-function directoryApplicationFromLive(live) {
-  const id = friendlyAppId(live);
-  return {
-    id,
-    // Prefer the static snapshot's richer repo/deploy metadata when the live
-    // registry confirms the app; synthesize from the live entry otherwise.
-    application: staticApplicationForId(id) ?? applicationEntryFromCatalog(live),
-    source: "live",
-    live
-  };
-}
-async function listApplicationDirectory(client) {
-  if (!client) return staticApplicationDirectory();
-  let services;
-  try {
-    services = [];
-    let cursor;
-    for (let page = 0; page < DIRECTORY_MAX_PAGES; page += 1) {
-      const result = await client.searchServices({
-        ...cursor ? { cursor } : {},
-        limit: DIRECTORY_PAGE_LIMIT
-      });
-      services.push(...result.services);
-      if (!result.page.nextCursor) break;
-      cursor = result.page.nextCursor;
-    }
-  } catch {
-    return staticApplicationDirectory();
-  }
-  const seen = /* @__PURE__ */ new Map();
-  for (const live of services) {
-    const entry = directoryApplicationFromLive(live);
-    if (!seen.has(entry.id)) seen.set(entry.id, entry);
-  }
-  return {
-    source: "live",
-    applications: [...seen.values()].sort((left, right) => left.id.localeCompare(right.id))
-  };
-}
-function matchesDirectoryApplication(app, needle) {
-  const candidates = new Set(idVariants(needle));
-  const keys = [
-    app.id,
-    app.application.id,
-    app.application.name,
-    app.live?.appId,
-    app.live?.slug,
-    app.live?.name
-  ];
-  for (const key of keys) {
-    if (typeof key !== "string" || !key.trim()) continue;
-    for (const variant of idVariants(key)) {
-      if (candidates.has(variant)) return true;
-    }
-    for (const variant of idVariants(friendlyAppId({ appId: key }))) {
-      if (candidates.has(variant)) return true;
-    }
-  }
-  return false;
-}
-function formatDirectoryApplicationIds(directory) {
-  const ids = directory.applications.map((app) => app.id).sort();
-  const preview = ids.slice(0, 50).join(", ");
-  const suffix = ids.length > 50 ? `, ... +${ids.length - 50} more` : "";
-  const label = directory.source === "live" ? "Applications available to this credential" : "Applications in the bundled static snapshot (live registry unreachable)";
-  return `${label}: ${preview}${suffix}`;
-}
-async function resolveApplicationDirectoryEntry(client, application) {
-  const needle = typeof application === "string" ? application.trim() : "";
-  if (!needle) {
-    throw new TopoloSdkError("unknown_application", "application is required");
-  }
-  if (client) {
-    let live = null;
-    try {
-      live = await client.getService(needle);
-    } catch {
-      live = null;
-    }
-    if (live) return directoryApplicationFromLive(live);
-  }
-  const directory = await listApplicationDirectory(client);
-  const match = directory.applications.find((app) => matchesDirectoryApplication(app, needle));
-  if (match) return match;
-  throw new TopoloSdkError(
-    "unknown_application",
-    `Unknown application "${application}". ${formatDirectoryApplicationIds(directory)}`
-  );
-}
-var STATIC_APPLICATIONS2 = APPLICATIONS;
-var APPLICATION_REQUIREMENTS_VERSION = "2026-08-11.1";
-var APPLICATION_REQUIREMENTS = [
-  {
-    id: "platform-metadata",
-    title: "Register the application in platform metadata",
-    summary: "Every app must have a stable application ID, CloudControl metadata for deployed surfaces, and package metadata where code is shipped.",
-    appliesTo: ["all"],
-    evidence: [
-      "topolo.cloudcontrol.json exists for every deployed app surface",
-      "package.json names the package or app when the repo ships code",
-      "The live platform registry exposes the app through topolo apps and MCP discovery"
-    ],
-    implementation: [
-      "Register the app in the live platform registry (Auth service catalog) before exposing it to agents",
-      "Keep production URLs, Worker names, Pages projects, routes, domains, and bindings current in CloudControl metadata",
-      "Do not leave a new Topolo* app directory without an explicit application ID"
-    ]
-  },
-  {
-    id: "canonical-docs",
-    title: "Update canonical docs with the code change",
-    summary: "TopoloDocs is the source of truth for application behavior, ownership, deployment shape, auth boundaries, and operations.",
-    appliesTo: ["all"],
-    evidence: [
-      "Matching system registry entry exists in TopoloDocs",
-      "Internal handbook coverage exists for the system",
-      "npm run validate passes in TopoloDocs when docs are touched"
-    ],
-    implementation: [
-      "Read the matching TopoloDocs system entry before coding",
-      "Update docs in the same change when behavior, API, auth, data ownership, deployment, or operations change",
-      "Update last_verified dates on touched canonical pages"
-    ]
-  },
-  {
-    id: "shared-auth-boundary",
-    title: "Use the shared Topolo auth boundary",
-    summary: "Applications must derive identity, organization, scopes, and app entitlement from TopoloAuth rather than inventing parallel auth state.",
-    appliesTo: ["browser", "api", "tooling", "agent_surface"],
-    evidence: [
-      "@topolo/auth-client or @topolo-io/worker-runtime is used where applicable",
-      "No public command, tool, or SDK method accepts orgId",
-      "App slug and Auth app registration are documented for protected APIs"
-    ],
-    implementation: [
-      "Use shared auth/runtime packages instead of copying token parsing, gateway, or browser storage flows",
-      "Derive organization from the credential on every request",
-      "Route OAuth, refresh, logout, and SSO paths according to the shared Auth contract"
-    ]
-  },
-  {
-    id: "shared-shell-and-launcher",
-    title: "Use the shared shell, launcher, and account menu",
-    summary: "Browser applications should feel like one platform and should not create isolated navigation or account surfaces.",
-    appliesTo: ["browser"],
-    evidence: [
-      "@topolo-io/app-shell is used for the platform shell where the app has authenticated UI",
-      "@topolo-io/app-launcher keeps the shared launcher/app switcher reachable from authenticated app chrome",
-      "Account menu and sign-out behavior use TopoloAppShell or the ui-kit TopoloAccountMenu primitive",
-      "Repeated app body surfaces use shared TopoloAppLayout primitives instead of local stat cards, empty states, or status badges",
-      "Local preview supports deterministic visual QA fixtures for overview, list, detail, settings, and empty/loading states",
-      "Authenticated app body content stays inside the viewport on mobile and desktop widths"
-    ],
-    implementation: [
-      "Use @topolo-io/app-shell TopoloAppShell for authenticated app layouts",
-      "Use the @topolo-io/ui-kit TopoloAccountMenu primitive when a partial-shell surface still needs account chrome",
-      "Pass app-specific account actions as additive menu items instead of forking dropdowns",
-      "Use shared design tokens and platform UI primitives before creating local equivalents",
-      "Use TopoloAppMetricCard, TopoloAppEmptyState, TopoloAppStatusBadge, TopoloAppGrid, and TopoloAppSection for repeated app body patterns",
-      "Keep visual QA fixtures available through visualQa=1 or __devpreview=1 so screenshot checks do not depend on live API state",
-      "Keep mobile and desktop shell behavior aligned with the platform UI kit",
-      "Constrain the app workspace-view layout wrappers with min-width: 0, width: auto, and viewport-aware max-width so shell padding cannot create page-level horizontal overflow"
-    ]
-  },
-  {
-    id: "app-registration-and-scopes",
-    title: "Register protected APIs as platform apps",
-    summary: "Callable app APIs need a stable app ID, app slug, permissions, role bundles, and API-key scopes before agents or users rely on them.",
-    appliesTo: ["api"],
-    evidence: [
-      "Auth app catalog contains the app ID and slug",
-      "Permissions, role bundles, and API-key scopes exist for the app",
-      "SDK, CLI, and MCP app discovery include the callable production API",
-      "CloudControl production HTTP targets classify agent reachability with sdk_app_id or agent_callable:false"
-    ],
-    implementation: [
-      "Add production Worker api_url metadata and sdk_app_id for every agent-callable API target",
-      "Mark browser, documentation, and runtime-only Worker targets with agent_callable:false",
-      "Expose stable app IDs through live catalog discovery",
-      "Keep typed SDK/CLI/MCP surfaces in sync when an API contract stabilizes"
-    ]
-  },
-  {
-    id: "organization-scoped-data",
-    title: "Keep application data organization-scoped",
-    summary: "Protected data access must be scoped by the authenticated organization at the backend boundary, not by client-provided hints.",
-    appliesTo: ["api"],
-    evidence: [
-      "Backend request handlers derive org membership from credential validation",
-      "Queries and Durable Object keys include the authenticated organization boundary where data is tenant-owned",
-      "MCP and CLI inputs do not include orgId overrides"
-    ],
-    implementation: [
-      "Reject or ignore organization hints supplied by clients",
-      "Bind SQL, KV, R2, queue, and Durable Object access to the authenticated organization",
-      "Document service-local exceptions explicitly in the system security assurance record"
-    ]
-  },
-  {
-    id: "cloudflare-deployment-contract",
-    title: "Keep Cloudflare deployment metadata complete",
-    summary: "Workers, Pages, bindings, routes, env vars, queues, cron triggers, and deployment commands must be discoverable through CloudControl metadata.",
-    appliesTo: ["browser", "api"],
-    evidence: [
-      "topolo.cloudcontrol.json lists production deploy targets and URLs",
-      "Wrangler/Pages configuration matches CloudControl metadata",
-      "Secrets and environment variables are not committed"
-    ],
-    implementation: [
-      "Update CloudControl metadata whenever deployment topology changes",
-      "Prefer Cloudflare-native runtime surfaces for new Topolo app infrastructure",
-      "Keep Worker bindings and Pages domains explicit enough for agents to inspect before deploying"
-    ]
-  },
-  {
-    id: "agent-and-operator-surfaces",
-    title: "Expose agent-safe operations through SDK, CLI, and MCP",
-    summary: "Agent-accessible functionality should be discoverable, scope-gated, and write-confirmed instead of hidden behind ad hoc HTTP calls.",
-    appliesTo: ["api", "tooling", "agent_surface"],
-    evidence: [
-      "Read operations have typed SDK/CLI/MCP surfaces once their contract stabilizes",
-      "Mutating generic calls require --confirm or confirm:true",
-      "MCP tools never accept orgId and advertise only appropriate scope-gated tools"
-    ],
-    implementation: [
-      "Add SDK types first, then CLI commands and MCP tools for durable workflows",
-      "Use generic API passthrough only as a temporary escape hatch",
-      "Keep command output JSON-stable for agents and human-readable with --no-json"
-    ]
-  },
-  {
-    id: "native-dashboard-widget",
-    title: "Expose a native dashboard widget contract",
-    summary: "Launchable first-party applications must populate TopoloOne live workspace through an app-owned /api/widget endpoint using the SDK widget response contract.",
-    appliesTo: ["api"],
-    evidence: [
-      "The app-owned API exposes GET /api/widget",
-      "The endpoint returns TopoloWidgetApiResponse from @topolo/sdk",
-      "Every returned widget includes snapshot.summary with app-owned operational prose",
-      "The endpoint derives organization/user context from the app auth boundary"
-    ],
-    implementation: [
-      "Import createTopoloWidgetResponse from @topolo/sdk in the app backend",
-      "Return native app metrics or action widgets instead of generic launch-card fallbacks",
-      "Populate snapshot.summary in the producing app for every widget instead of synthesizing summaries in TopoloOne",
-      "Add a route-level test that validates the response with validateTopoloWidgetResponse"
-    ]
-  },
-  {
-    id: "observability-and-audit",
-    title: "Emit platform audit and debugging signals",
-    summary: "Requests, agent actions, and operational workflows need traceable IDs, client labels, and useful failure evidence.",
-    appliesTo: ["api", "tooling", "agent_surface"],
-    evidence: [
-      "Requests carry X-Topolo-Client and X-Topolo-Request-Id where the SDK is involved",
-      "Agent-originated calls can include X-Topolo-Agent",
-      "Failure modes are documented with request IDs or deployment/log lookup paths"
-    ],
-    implementation: [
-      "Use TopoloClient for platform API calls rather than raw fetch where practical",
-      "Keep logs free of secrets and tokens",
-      "Document live smoke commands and request-id correlation in canonical docs"
-    ]
-  },
-  {
-    id: "verification-gates",
-    title: "Ship with build, test, docs, and smoke verification",
-    summary: "A Topolo app change is not complete until the relevant code checks and docs checks have been run or explicitly reported as blocked.",
-    appliesTo: ["all"],
-    evidence: [
-      "Relevant package build/typecheck/test commands pass",
-      "TopoloDocs validation passes when docs are touched",
-      "Live or local smoke evidence is captured for user-visible or API behavior"
-    ],
-    implementation: [
-      "Prefer existing package scripts before adding new tooling",
-      "Run app-specific checks and shared docs validation for behavior changes",
-      "Report any skipped verification with the blocker and residual risk"
-    ]
-  }
-];
-function applicationRequirementScopes(application) {
-  const scopes = /* @__PURE__ */ new Set(["all"]);
-  const appId = application.id;
-  const hasBrowserSurface = Boolean(application.productionUrl) || // String() keeps this guard valid after the Pages->Worker migration narrowed
-  // the generated kind union to "worker" (no "pages" literal remains).
-  application.deployTargets.some((target) => String(target.kind) === "pages");
-  const hasApiSurface = application.services.length > 0 || application.deployTargets.some((target) => Boolean(target.appId));
-  if (hasBrowserSurface) scopes.add("browser");
-  if (hasApiSurface) scopes.add("api");
-  if (appId === "cli" || appId === "mcp" || appId === "cloudcontrol") {
-    scopes.add("tooling");
-  }
-  if (appId === "cli" || appId === "mcp" || hasApiSurface) {
-    scopes.add("agent_surface");
-  }
-  return Array.from(scopes);
-}
-function fallbackApplication(id) {
-  const entry = STATIC_APPLICATIONS2[id];
-  if (!entry) {
-    throw new Error(
-      `Unknown application "${id}" in the static fallback snapshot. Resolve applications from the live registry (resolveApplicationDirectoryEntry) and pass the entry directly.`
+    this.path = path;
+    this.requestId = canonicalTopoloRequestId(options.requestId);
+    this.retryAfter = canonicalTopoloRetryAfter(options.retryAfter);
+    this.details = extractTopoloServiceErrorDetails(
+      options.details === void 0 ? body : { details: options.details }
     );
   }
-  return entry;
-}
-function requirementsForApplication(applicationOrId) {
-  const application = typeof applicationOrId === "string" ? fallbackApplication(applicationOrId) : applicationOrId;
-  const scopes = new Set(applicationRequirementScopes(application));
-  return APPLICATION_REQUIREMENTS.filter(
-    (requirement) => requirement.appliesTo.some((scope) => scopes.has(scope))
-  );
-}
-function auditApplicationRequirements(applicationOrId) {
-  const application = typeof applicationOrId === "string" ? fallbackApplication(applicationOrId) : applicationOrId;
-  const scopes = applicationRequirementScopes(application);
-  const findings = requirementsForApplication(application).map(
-    (requirement) => evaluateRequirement(application, requirement)
-  );
-  return {
-    version: APPLICATION_REQUIREMENTS_VERSION,
-    application,
-    scopes,
-    score: scoreFindings(findings),
-    findings
-  };
-}
-function auditApplicationEntries(applications) {
-  return buildAuditReport(
-    applications.map((application) => auditApplicationRequirements(application))
-  );
+};
+function hostnameHasSuffix(hostname, suffix) {
+  return hostname === suffix || hostname.endsWith(`.${suffix}`);
 }
-function buildAuditReport(applications) {
-  const migrationQueue = applications.flatMap(
-    (audit) => audit.findings.filter((finding2) => finding2.status !== "met").map((finding2) => ({
-      applicationId: audit.application.id,
-      applicationName: audit.application.name,
-      requirementId: finding2.requirementId,
-      title: finding2.title,
-      status: finding2.status,
-      reason: finding2.reason,
-      nextActions: finding2.nextActions
-    }))
-  ).sort((a, b) => {
-    const statusOrder = statusRank(a.status) - statusRank(b.status);
-    if (statusOrder !== 0) return statusOrder;
-    const appOrder = a.applicationId.localeCompare(b.applicationId);
-    if (appOrder !== 0) return appOrder;
-    return a.requirementId.localeCompare(b.requirementId);
-  });
-  return {
-    version: APPLICATION_REQUIREMENTS_VERSION,
-    applications,
-    migrationQueue
-  };
+function workersDevAccountMatches(hostname, account) {
+  if (!hostname.endsWith(".workers.dev")) return false;
+  const labels = hostname.slice(0, -".workers.dev".length).split(".");
+  return labels.length >= 2 && labels.at(-1) === account;
 }
-function evaluateRequirement(application, requirement) {
-  const evidence = [];
-  switch (requirement.id) {
-    case "platform-metadata": {
-      if (application.packageName) evidence.push(`package=${application.packageName}`);
-      if (application.productionUrl) evidence.push(`productionUrl=${application.productionUrl}`);
-      if (application.deployTargets.length > 0) {
-        evidence.push(`deployTargets=${application.deployTargets.length}`);
-      }
-      if (application.services.length > 0) {
-        evidence.push(`services=${application.services.join(",")}`);
-      }
-      if (evidence.length === 0) {
-        return finding(requirement, "missing", "No package, production URL, deploy target, or service metadata is available.", evidence);
-      }
-      return finding(requirement, "met", "Catalog metadata exists for this application.", evidence);
-    }
-    case "canonical-docs":
-      return finding(
-        requirement,
-        "needs_review",
-        "Catalog metadata cannot verify matching TopoloDocs system and handbook coverage.",
-        evidence
-      );
-    case "shared-auth-boundary":
-      return finding(
-        requirement,
-        "needs_review",
-        "Catalog metadata cannot verify that implementation uses shared Topolo auth packages and derives org from credentials.",
-        evidence
-      );
-    case "shared-shell-and-launcher":
-      return finding(
-        requirement,
-        "needs_review",
-        "Catalog metadata cannot verify shared shell, launcher, and account menu adoption.",
-        evidence
-      );
-    case "app-registration-and-scopes": {
-      if (application.services.length > 0) {
-        evidence.push(`services=${application.services.join(",")}`);
-        return finding(
-          requirement,
-          "partial",
-          "SDK service discovery exists, but Auth catalog permissions, role bundles, and API-key scopes still need confirmation.",
-          evidence
-        );
-      }
-      return finding(requirement, "missing", "No SDK app API id is registered for this callable API surface.", evidence);
-    }
-    case "organization-scoped-data":
-      return finding(
-        requirement,
-        "needs_review",
-        "Catalog metadata cannot verify backend tenant filters, storage keys, or Durable Object boundaries.",
-        evidence
-      );
-    case "cloudflare-deployment-contract": {
-      if (application.deployTargets.length < 1) {
-        return finding(requirement, "missing", "No CloudControl deploy targets are registered.", evidence);
-      }
-      evidence.push(`deployTargets=${application.deployTargets.length}`);
-      if (application.productionUrl) evidence.push(`productionUrl=${application.productionUrl}`);
-      return finding(requirement, "met", "CloudControl deploy target metadata is present.", evidence);
-    }
-    case "agent-and-operator-surfaces": {
-      const appId = application.id;
-      if (application.services.length > 0) {
-        evidence.push(`services=${application.services.join(",")}`);
-        return finding(requirement, "partial", "SDK service discovery exists; typed SDK/CLI/MCP workflow coverage should be checked as APIs stabilize.", evidence);
-      }
-      if (appId === "cli" || appId === "mcp" || appId === "cloudcontrol") {
-        evidence.push(`tooling=${appId}`);
-        return finding(requirement, "met", "This application is itself an agent/operator surface.", evidence);
-      }
-      return finding(requirement, "missing", "No SDK service or tooling surface is registered.", evidence);
-    }
-    case "native-dashboard-widget":
-      return finding(
-        requirement,
-        "needs_review",
-        "Catalog metadata cannot verify app-owned /api/widget implementation details.",
-        evidence
-      );
-    case "observability-and-audit":
-      return finding(
-        requirement,
-        "needs_review",
-        "Catalog metadata cannot verify runtime request IDs, client labels, or log redaction.",
-        evidence
-      );
-    case "verification-gates":
-      return finding(
-        requirement,
-        "needs_review",
-        "Catalog metadata cannot verify package checks, docs validation, or smoke evidence.",
-        evidence
-      );
-    default:
-      return finding(requirement, "needs_review", "No automated evaluator exists for this requirement yet.", evidence);
+function originMatchesEnvironment(url, environment) {
+  const hostname = url.hostname.toLowerCase();
+  if (environment === "local") {
+    return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "[::1]";
   }
+  if (url.protocol !== "https:") return false;
+  if (environment === "production") {
+    return hostnameHasSuffix(hostname, "topolo.app") || hostnameHasSuffix(hostname, "topolo.io") || workersDevAccountMatches(hostname, "topolo");
+  }
+  if (environment === "staging") {
+    return hostnameHasSuffix(hostname, "stg.topolo.us") || workersDevAccountMatches(hostname, "topolo-staging");
+  }
+  return hostnameHasSuffix(hostname, "topolo.dev") || workersDevAccountMatches(hostname, "topolo-development");
 }
-function finding(requirement, status, reason, evidence) {
-  return {
-    requirementId: requirement.id,
-    title: requirement.title,
-    status,
-    reason,
-    evidence,
-    nextActions: status === "met" ? [] : requirement.implementation
-  };
+function assertTopoloServiceUrlEnvironment(service, value, environment) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new TopoloSdkError("invalid_service_url", `Invalid URL configured for Topolo service "${service}".`);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password || !originMatchesEnvironment(url, environment)) {
+    throw new TopoloSdkError(
+      "environment_mismatch",
+      `Refusing Topolo service "${service}": ${url.origin} does not belong to ${environment}.`
+    );
+  }
+  return url.origin;
 }
-function scoreFindings(findings) {
-  const met = findings.filter((finding2) => finding2.status === "met").length;
-  const partial = findings.filter((finding2) => finding2.status === "partial").length;
-  const missing = findings.filter((finding2) => finding2.status === "missing").length;
-  const needsReview = findings.filter((finding2) => finding2.status === "needs_review").length;
-  const total = findings.length;
-  const weighted = met + partial * 0.5;
-  return {
-    met,
-    partial,
-    missing,
-    needsReview,
-    total,
-    percent: total === 0 ? 100 : Math.round(weighted / total * 100)
-  };
+function topoloServiceOrigins(serviceUrls, environment) {
+  return Object.fromEntries(
+    Object.entries(serviceUrls ?? {}).sort(([left], [right]) => left.localeCompare(right)).map(([service, value]) => [
+      service,
+      assertTopoloServiceUrlEnvironment(service, value, environment)
+    ])
+  );
 }
-function statusRank(status) {
-  if (status === "missing") return 0;
-  if (status === "partial") return 1;
-  return 2;
+var APP_API_URLS = {
+  auth: "https://auth.topolo.app",
+  developers: "https://developers.topolo.app"
+};
+function friendlyAppId(entry) {
+  for (const value of [entry.slug, entry.name, entry.appId]) {
+    if (typeof value !== "string" || !value.trim()) continue;
+    const normalized = value.trim().toLowerCase().replace(/\s+/g, "-");
+    const withoutPrefix = normalized.replace(/^(?:app[_-])?topolo[-_]+/, "");
+    if (withoutPrefix) return withoutPrefix;
+  }
+  return entry.appId;
 }
 var DEFAULT_APP_URLS = APP_API_URLS;
 function resolveCatalogServiceUrl(entry, options = {}) {
@@ -2851,6 +847,7 @@ var TopoloClient = class _TopoloClient {
   credential;
   agent;
   serviceUrls;
+  environment;
   appIds;
   requireConfirmForWrites;
   timeoutMs;
@@ -2879,7 +876,8 @@ var TopoloClient = class _TopoloClient {
     if (!options.agent?.clientName) throw new TopoloAuthError("agent.clientName is required");
     this.credential = options.credential;
     this.agent = options.agent;
-    this.serviceUrls = options.serviceUrls;
+    this.environment = options.environment;
+    this.serviceUrls = options.environment ? topoloServiceOrigins(options.serviceUrls, options.environment) : options.serviceUrls;
     this.appIds = options.appIds;
     this.requireConfirmForWrites = options.requireConfirmForWrites !== false;
     this.timeoutMs = options.timeoutMs ?? 3e4;
@@ -2908,9 +906,15 @@ var TopoloClient = class _TopoloClient {
       );
     }
     await this.loadCurrentCredential();
-    const resolvedService = opts.baseUrl ? { serviceKey: normalizeLookupKey(opts.service), baseUrl: requireHttpOrigin(opts.baseUrl) } : await this.resolveRequestService(opts.service);
+    const resolvedService = opts.baseUrl ? { serviceKey: normalizeLookupKey(opts.service), baseUrl: this.validatedServiceOrigin(opts.service, opts.baseUrl) } : await this.resolveRequestService(opts.service);
     const baseUrl = resolvedService.baseUrl;
     const url = new URL(opts.path, baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`);
+    if (url.origin !== new URL(baseUrl).origin) {
+      throw new TopoloSdkError(
+        "service_path_origin_mismatch",
+        `Refusing Topolo request path because it changes the resolved ${resolvedService.serviceKey || opts.service} service origin.`
+      );
+    }
     if (opts.query) {
       for (const [k, v] of Object.entries(opts.query)) {
         if (v !== void 0) url.searchParams.set(k, String(v));
@@ -2981,7 +985,7 @@ var TopoloClient = class _TopoloClient {
         url: urlStr,
         requestId,
         durationMs: Date.now() - startedAt,
-        error: err instanceof Error ? err.message : String(err)
+        error: "network_error"
       });
       throw err;
     }
@@ -2990,6 +994,7 @@ var TopoloClient = class _TopoloClient {
     if (!res.ok) {
       const durationMs = Date.now() - startedAt;
       const message = describeError(parsed, `HTTP ${res.status}`);
+      const publicCode = extractTopoloServiceErrorCode(parsed) ?? "http_error";
       this.emit({
         phase: "error",
         method,
@@ -2998,7 +1003,7 @@ var TopoloClient = class _TopoloClient {
         url: urlStr,
         requestId,
         durationMs,
-        error: message,
+        error: publicCode,
         status: res.status
       });
       const errorContext = {
@@ -3006,17 +1011,21 @@ var TopoloClient = class _TopoloClient {
         body: parsed,
         service: resolvedService.serviceKey,
         path: opts.path,
-        requestId: res.headers.get("X-Topolo-Request-Id") || requestId,
-        retryAfter: res.headers.get("Retry-After") || void 0
+        requestId: canonicalTopoloRequestId(res.headers.get("X-Topolo-Request-Id")) ?? requestId,
+        retryAfter: canonicalTopoloRetryAfter(res.headers.get("Retry-After"))
       };
       if (res.status === 401) {
-        throw new TopoloAuthError(describeError(parsed, "Unauthorized"), "auth_error", errorContext);
+        throw new TopoloAuthError(
+          describeError(parsed, "Unauthorized"),
+          extractTopoloServiceErrorCode(parsed) ?? "auth_error",
+          errorContext
+        );
       }
       if (res.status === 403) {
         throw new TopoloPermissionError(
           describeError(parsed, "Permission denied"),
           extractRequired(parsed),
-          errorContext
+          { ...errorContext, code: extractTopoloServiceErrorCode(parsed) ?? "permission_denied" }
         );
       }
       throw new TopoloHttpError(
@@ -3066,6 +1075,17 @@ var TopoloClient = class _TopoloClient {
     });
     return this.refreshInFlight;
   }
+  validatedServiceOrigin(service, value) {
+    const origin = requireHttpOrigin(value);
+    return this.environment ? assertTopoloServiceUrlEnvironment(service, origin, this.environment) : origin;
+  }
+  validatedActionEntry(entry) {
+    if (!entry.apiBaseUrl) return entry;
+    return {
+      ...entry,
+      apiBaseUrl: this.validatedServiceOrigin(entry.appSlug || entry.appId, entry.apiBaseUrl)
+    };
+  }
   async resolveRequestService(service) {
     const serviceKey = normalizeLookupKey(service);
     if (!serviceKey) {
@@ -3073,17 +1093,20 @@ var TopoloClient = class _TopoloClient {
     }
     if (serviceKey === "auth" || serviceKey === "developers") {
       const overrideUrl = resolveConfiguredServiceUrl(serviceKey, this.serviceUrls);
-      if (overrideUrl) return { serviceKey, baseUrl: overrideUrl };
+      if (overrideUrl) return { serviceKey, baseUrl: this.validatedServiceOrigin(serviceKey, overrideUrl) };
       if (serviceKey === "developers") {
         const derived = deriveDevelopersFromAuth(resolveConfiguredServiceUrl("auth", this.serviceUrls));
-        if (derived) return { serviceKey, baseUrl: derived };
+        if (derived) return { serviceKey, baseUrl: this.validatedServiceOrigin(serviceKey, derived) };
       }
-      return { serviceKey, baseUrl: DEFAULT_APP_URLS[serviceKey] };
+      return {
+        serviceKey,
+        baseUrl: this.validatedServiceOrigin(serviceKey, DEFAULT_APP_URLS[serviceKey])
+      };
     }
     const live = await this.resolveLiveCallableService(serviceKey);
     if (live) {
       const overrideUrl = resolveConfiguredServiceUrl(serviceKey, this.serviceUrls);
-      return overrideUrl ? { ...live, baseUrl: overrideUrl } : live;
+      return overrideUrl ? { ...live, baseUrl: this.validatedServiceOrigin(serviceKey, overrideUrl) } : { ...live, baseUrl: this.validatedServiceOrigin(serviceKey, live.baseUrl) };
     }
     throw new TopoloSdkError(
       "unknown_service",
@@ -3097,10 +1120,10 @@ var TopoloClient = class _TopoloClient {
       serviceKey,
       overrides: this.serviceUrls
     });
-    if (baseUrl) return { serviceKey, baseUrl };
+    if (baseUrl) return { serviceKey, baseUrl: this.validatedServiceOrigin(serviceKey, baseUrl) };
     const actionPage = await this.searchActions({ service: match.appId, limit: 1 }).catch(() => null);
     const actionBaseUrl = actionPage?.actions.find((action) => action.apiBaseUrl)?.apiBaseUrl ?? null;
-    return actionBaseUrl ? { serviceKey, baseUrl: requireHttpOrigin(actionBaseUrl) } : null;
+    return actionBaseUrl ? { serviceKey, baseUrl: this.validatedServiceOrigin(serviceKey, actionBaseUrl) } : null;
   }
   /**
    * Resolve a service-slug → opaque app-id via caller config or TopoloAuth.
@@ -3120,7 +1143,7 @@ var TopoloClient = class _TopoloClient {
     if (!normalized) return null;
     const configuredAppId = resolveConfiguredAppId(normalized, this.appIds);
     if (configuredAppId) return configuredAppId;
-    const authBase = resolveServiceUrl("developers", this.serviceUrls);
+    const authBase = this.validatedServiceOrigin("developers", resolveServiceUrl("developers", this.serviceUrls));
     const cacheKey = `${authBase}|${normalized}`;
     const now = Date.now();
     const cached = _TopoloClient.appIdCache.get(cacheKey);
@@ -3296,7 +1319,7 @@ var TopoloClient = class _TopoloClient {
         "TopoloAuth did not return an action catalog for the current credential."
       );
     }
-    const entries = raw.map((item) => normalizeActionCatalogEntry(item)).filter((entry) => Boolean(entry));
+    const entries = raw.map((item) => normalizeActionCatalogEntry(item)).filter((entry) => Boolean(entry)).map((entry) => this.validatedActionEntry(entry));
     return {
       actions: entries,
       page: normalizeCatalogPage(
@@ -3361,7 +1384,7 @@ var TopoloClient = class _TopoloClient {
     const raw = res.data?.action ?? res.action;
     const match = normalizeActionCatalogEntry(raw);
     if (!match) throw new TopoloSdkError("unknown_action", `Unknown or unavailable Topolo action "${action}".`);
-    return match;
+    return this.validatedActionEntry(match);
   }
   async callAction(action, input = {}, options = {}) {
     const entry = await this.getAction(action);
@@ -3438,6 +1461,25 @@ var TopoloClient = class _TopoloClient {
   }
   async planAction(action, input = {}, options = {}) {
     const entry = await this.getAction(action);
+    return this.planResolvedAction(entry, input, options);
+  }
+  async prepareAction(action, input, options = {}) {
+    const entry = await this.getAction(action);
+    const example = (entry.agentContract?.examples ?? []).find((candidate) => Boolean(candidate?.input) && typeof candidate.input === "object" && !Array.isArray(candidate.input) && validateTopoloActionInput(entry.inputSchema, candidate.input).valid) ?? null;
+    const selectedInput = input ?? example?.input ?? {};
+    const plan = this.planResolvedAction(entry, selectedInput, options);
+    return {
+      action: entry,
+      example,
+      input: selectedInput,
+      inputSource: input ? "provided" : example ? "example" : "empty",
+      missingFields: [...new Set(
+        plan.validation.errors.filter((issue) => issue.code === "required").map((issue) => issue.path)
+      )],
+      plan
+    };
+  }
+  planResolvedAction(entry, input, options) {
     const validation = validateTopoloActionInput(entry.inputSchema, input);
     const agentAccess = entry.agentAccess ?? (entry.destructive ? "off" : entry.readOnly && !entry.requiresConfirmation ? "auto" : "confirm");
     const confirmationRequired = agentAccess === "confirm" || entry.requiresConfirmation || entry.destructive;
@@ -3514,28 +1556,6 @@ var TopoloClient = class _TopoloClient {
       confirm: options.confirm === true || entry.readOnly && !entry.destructive && !entry.requiresConfirmation
     });
   }
-  /**
-   * @deprecated Static fallback snapshot only. Use `searchServices()` (the
-   * live credential-scoped registry) for anything that decides behavior; this
-   * exists for offline packaging audits when the registry is unreachable.
-   */
-  listBundledServices() {
-    const apps = Object.values(APPLICATIONS);
-    return apps.map((app) => ({
-      appId: app.id,
-      slug: app.id,
-      name: app.name ?? app.id,
-      description: null,
-      apiBaseUrl: null,
-      launchUrl: app.productionUrl ?? null,
-      status: "bundled",
-      surfaceKind: "application",
-      launchable: Boolean(app.productionUrl),
-      permissions: [],
-      apiKeyResource: null,
-      apiKeyResources: []
-    }));
-  }
   /**
    * Introspect the current credential. Returns the caller's resolved identity,
    * organization, and permission set. Used by CLI `whoami` and by MCP to gate
@@ -3786,6 +1806,7 @@ function normalizeActionCatalogEntry(item) {
     path,
     permissionName: pickActionString(a.permission_name) ?? pickActionString(a.permissionName) ?? "",
     requiredPermission: pickActionString(a.required_permission) ?? pickActionString(a.requiredPermission) ?? "",
+    principalAccess: pickPrincipalAccess(a.principal_access ?? a.principalAccess),
     authorizationMode: pickAuthorizationMode(a.authorization_mode ?? a.authorizationMode),
     allowedServices: stringArray(a.allowed_services ?? a.allowedServices),
     inputSchema: plainObject(a.input_schema ?? a.inputSchema),
@@ -3802,6 +1823,9 @@ function normalizeActionCatalogEntry(item) {
 function isHttpMethod(value) {
   return value === "GET" || value === "POST" || value === "PUT" || value === "PATCH" || value === "DELETE";
 }
+function pickPrincipalAccess(value) {
+  return value === "platform_admin" || value === "platform_super_admin" ? value : null;
+}
 function pickActionString(value) {
   return typeof value === "string" && value.trim() ? value.trim() : null;
 }
@@ -3895,7 +1919,16 @@ function pickString(value) {
 function extractRequired(body) {
   if (body && typeof body === "object") {
     const maybe = body;
-    if (Array.isArray(maybe.required)) return maybe.required.map(String);
+    if (Array.isArray(maybe.required)) return canonicalTopoloRequired(maybe.required);
+    for (const nested of [maybe.details, maybe.error]) {
+      if (!nested || typeof nested !== "object" || Array.isArray(nested)) continue;
+      const record = nested;
+      if (Array.isArray(record.required)) return canonicalTopoloRequired(record.required);
+      if (record.details && typeof record.details === "object" && !Array.isArray(record.details)) {
+        const required = record.details.required;
+        if (Array.isArray(required)) return canonicalTopoloRequired(required);
+      }
+    }
   }
   return [];
 }
@@ -3943,17 +1976,72 @@ function compactActionPlan(plan) {
     nextActionIds: plan.nextActionIds
   };
 }
-function compactApplicationAudit(report) {
+function requiredContextText(value, field) {
+  if (typeof value !== "string" || !value.trim() || value.trim().toLowerCase() === "unknown") {
+    throw new TopoloSdkError("invalid_identity_context", `Effective Topolo ${field} is incomplete.`);
+  }
+  return value.trim();
+}
+function createTopoloAgentExecutionContext(input) {
+  if (input.contextKey !== null && input.contextKey !== "personal" && !/^org:[^:]+$/.test(input.contextKey)) {
+    throw new TopoloSdkError("invalid_identity_context", "Effective Topolo context key is invalid.");
+  }
+  const user = Object.freeze({
+    id: requiredContextText(input.identity.user.id, "user id"),
+    email: requiredContextText(input.identity.user.email, "user email"),
+    name: input.identity.user.name?.trim() || null,
+    role: requiredContextText(input.identity.user.role, "user role")
+  });
+  const organization = input.identity.organization ? Object.freeze({
+    id: requiredContextText(input.identity.organization.id, "organization id"),
+    slug: requiredContextText(input.identity.organization.slug, "organization slug"),
+    name: requiredContextText(input.identity.organization.name, "organization name")
+  }) : null;
+  if (input.contextKey === "personal" && organization) {
+    throw new TopoloSdkError("identity_context_mismatch", "Personal Topolo context resolved an organization.");
+  }
+  if (input.contextKey?.startsWith("org:")) {
+    const expectedOrganizationId = input.contextKey.slice("org:".length);
+    if (!organization || organization.id !== expectedOrganizationId) {
+      throw new TopoloSdkError("identity_context_mismatch", "Pinned Topolo organization does not match the effective identity.");
+    }
+  }
+  return Object.freeze({
+    environment: input.environment,
+    contextKey: input.contextKey,
+    user,
+    organization,
+    serviceOrigins: Object.freeze(topoloServiceOrigins(input.serviceUrls, input.environment))
+  });
+}
+function compactActionPreparationCore(preparation) {
+  const example = preparation.example ? { title: preparation.example.title ?? null, input: preparation.example.input } : null;
+  const effectiveInput = preparation.inputSource === "example" ? { source: "example" } : { source: preparation.inputSource, value: preparation.input };
   return {
-    version: report.version,
-    applications: report.applications.map((audit) => ({
-      applicationId: audit.application.id,
-      applicationName: audit.application.name,
-      score: audit.score
-    })),
-    migrationQueueCount: report.migrationQueue.length
+    action: {
+      id: preparation.action.actionId,
+      title: preparation.action.title,
+      docsUrl: preparation.action.agentContract?.docsUrl ?? null
+    },
+    example,
+    input: effectiveInput,
+    missingFields: preparation.missingFields,
+    valid: preparation.plan.validation.valid,
+    errors: preparation.plan.validation.errors,
+    request: preparation.plan.request,
+    confirmation: {
+      required: preparation.plan.confirmationRequired,
+      provided: preparation.plan.confirmationProvided
+    },
+    executable: preparation.plan.executable,
+    verification: preparation.plan.verification,
+    rollbackActionId: preparation.plan.rollbackActionId
   };
 }
+function compactActionPreparation(preparation, context) {
+  const compact = compactActionPreparationCore(preparation);
+  return context ? { context, ...compact } : compact;
+}
 var CrmModule = class {
   constructor(client) {
     this.client = client;
@@ -4081,7 +2169,7 @@ function createTopolo(options) {
   };
 }
-// ../topolo-sdk/dist/node/credential-store.js
+// ../../../public-platform-tooling-boundary-20260813/packages/topolo-sdk/dist/node/credential-store.js
 import { mkdir, readFile, writeFile, chmod } from "fs/promises";
 import { existsSync } from "fs";
 import { homedir, platform } from "os";
@@ -4094,6 +2182,90 @@ var TopoloSdkError2 = class extends Error {
     this.code = code;
   }
 };
+var PUBLIC_ERROR_CODES2 = /* @__PURE__ */ new Set([
+  "action_app_identity_unavailable",
+  "action_authentication_required",
+  "action_catalog_summary_unavailable",
+  "action_catalog_unavailable",
+  "action_contract_mismatch",
+  "action_permission_required",
+  "action_runtime_authorization_required",
+  "action_service_not_allowed",
+  "auth_error",
+  "authentication_required",
+  "authorization_pending",
+  "bad_sig",
+  "confirmation_required",
+  "dependency_unavailable",
+  "environment_mismatch",
+  "environment_service_url_required",
+  "expired_token",
+  "forbidden",
+  "http_error",
+  "immutable_drift",
+  "integration_dependency_unavailable",
+  "integration_misconfigured",
+  "invalid_action",
+  "invalid_action_input",
+  "invalid_grant",
+  "invalid_input",
+  "invalid_token",
+  "mcp_error",
+  "membership_required",
+  "network_error",
+  "organization_context_required",
+  "organization_enrollment_required",
+  "permission_denied",
+  "rate_limited",
+  "request_failed",
+  "service_catalog_unavailable",
+  "service_path_origin_mismatch",
+  "service_required",
+  "slow_down",
+  "state_conflict",
+  "unauthorized",
+  "unknown_action",
+  "unknown_service"
+]);
+var ERROR_CODE_PATTERN2 = /^[a-z][a-z0-9_]{0,63}$/;
+var TOPOLO_REQUEST_ID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var CLOUDFLARE_RAY_ID_PATTERN2 = /^[0-9a-f]{16}-[A-Z]{3}$/;
+var PERMISSION_PATTERN2 = /^[a-z][a-z0-9_-]{0,63}(?:\.[a-z][a-z0-9_-]{0,63})*:(?:[a-z][a-z0-9_-]{0,63}|\*)$/;
+var RETRY_AFTER_DATE_PATTERN2 = /^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), \d{2} (?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \d{4} \d{2}:\d{2}:\d{2} GMT$/;
+var PUBLIC_DETAIL_SOURCES2 = /* @__PURE__ */ new Set([
+  "api_key_introspection",
+  "api_key_validation",
+  "auth_context",
+  "auth_validate",
+  "catalog",
+  "credential",
+  "runtime",
+  "service_token_provider",
+  "service_verify_key",
+  "token_validation",
+  "upstream"
+]);
+function canonicalTopoloErrorCode2(value) {
+  if (typeof value !== "string") return null;
+  const candidate = value.trim().toLowerCase();
+  if (!ERROR_CODE_PATTERN2.test(candidate) || !PUBLIC_ERROR_CODES2.has(candidate)) return null;
+  return candidate;
+}
+function canonicalTopoloRequestId2(value) {
+  if (typeof value !== "string") return void 0;
+  const candidate = value.trim();
+  return TOPOLO_REQUEST_ID_PATTERN2.test(candidate) || CLOUDFLARE_RAY_ID_PATTERN2.test(candidate) ? candidate : void 0;
+}
+function canonicalTopoloRetryAfter2(value) {
+  if (typeof value !== "string") return void 0;
+  const candidate = value.trim();
+  if (/^\d{1,10}$/.test(candidate) || RETRY_AFTER_DATE_PATTERN2.test(candidate)) return candidate;
+  return void 0;
+}
+function canonicalTopoloRequired2(value) {
+  if (!Array.isArray(value)) return [];
+  return [...new Set(value.filter((item) => typeof item === "string" && PERMISSION_PATTERN2.test(item)))].slice(0, 32);
+}
 var TopoloAuthError2 = class extends TopoloSdkError2 {
   status;
   body;
@@ -4101,27 +2273,91 @@ var TopoloAuthError2 = class extends TopoloSdkError2 {
   path;
   requestId;
   retryAfter;
+  details;
   constructor(message, code = "auth_error", options = {}) {
-    super(code, message);
+    super(canonicalTopoloErrorCode2(code) ?? "auth_error", message);
     this.name = "TopoloAuthError";
     this.status = options.status ?? 401;
     this.body = options.body;
     this.service = options.service;
     this.path = options.path;
-    this.requestId = options.requestId;
-    this.retryAfter = options.retryAfter;
+    this.requestId = canonicalTopoloRequestId2(options.requestId);
+    this.retryAfter = canonicalTopoloRetryAfter2(options.retryAfter);
+    this.details = extractTopoloServiceErrorDetails2(
+      options.details === void 0 ? options.body : { details: options.details }
+    );
   }
 };
-function extractHttpErrorCode2(body) {
-  if (!body || typeof body !== "object" || Array.isArray(body)) return "http_error";
+function extractTopoloServiceErrorCode2(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return null;
   const record = body;
-  if (typeof record.code === "string" && record.code.trim()) return record.code.trim();
+  const topLevel = canonicalTopoloErrorCode2(record.code);
+  if (topLevel) return topLevel;
   const nested = record.error;
+  const nestedString = canonicalTopoloErrorCode2(nested);
+  if (nestedString) return nestedString;
   if (nested && typeof nested === "object" && !Array.isArray(nested)) {
     const code = nested.code;
-    if (typeof code === "string" && code.trim()) return code.trim();
+    const nestedCode = canonicalTopoloErrorCode2(code);
+    if (nestedCode) return nestedCode;
+  }
+  return null;
+}
+function serviceErrorCode2(body, fallback) {
+  return extractTopoloServiceErrorCode2(body) ?? fallback;
+}
+function extractTopoloServiceErrorDetails2(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return void 0;
+  const record = body;
+  let candidate = record.details;
+  const nested = record.error;
+  if (nested && typeof nested === "object" && !Array.isArray(nested)) {
+    const nestedRecord = nested;
+    if (candidate === void 0) candidate = nestedRecord.details ?? nestedRecord;
+  }
+  if (candidate === void 0) candidate = record;
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) return void 0;
+  const source = candidate;
+  const safe = {};
+  for (const [key, value] of Object.entries(source)) {
+    if (/present$/i.test(key) && typeof value === "boolean") {
+      safe[key] = value;
+      continue;
+    }
+    if (key === "retryable" && typeof value === "boolean") {
+      safe.retryable = value;
+      continue;
+    }
+    if (key === "code") {
+      const sanitized = canonicalTopoloErrorCode2(value);
+      if (sanitized) safe.code = sanitized;
+      continue;
+    }
+    if (key === "source") {
+      const sanitized = typeof value === "string" ? value.trim().toLowerCase() : "";
+      if (PUBLIC_DETAIL_SOURCES2.has(sanitized)) safe.source = sanitized;
+      continue;
+    }
+    if (key === "dependency" || key === "platform") {
+      safe[`${key}Present`] = value !== null && value !== void 0;
+      continue;
+    }
+    if (key === "error" && !safe.code) {
+      const sanitized = canonicalTopoloErrorCode2(value);
+      if (sanitized) safe.code = sanitized;
+      continue;
+    }
+    if (key === "required" && Array.isArray(value)) {
+      const required = canonicalTopoloRequired2(value);
+      if (required.length) safe.required = required;
+      continue;
+    }
+    if (["missingFields", "fields", "paths"].includes(key) && Array.isArray(value)) {
+      const paths = value.filter((item) => typeof item === "string" && /^[$.a-z0-9_[\]-]{1,160}$/i.test(item));
+      if (paths.length) safe[key] = paths;
+    }
   }
-  return "http_error";
+  return Object.keys(safe).length ? safe : void 0;
 }
 var TopoloHttpError2 = class extends TopoloSdkError2 {
   status;
@@ -4130,15 +2366,19 @@ var TopoloHttpError2 = class extends TopoloSdkError2 {
   path;
   requestId;
   retryAfter;
+  details;
   constructor(service, path, status, body, message, options = {}) {
-    super(extractHttpErrorCode2(body), message ?? `HTTP ${status} from ${service}${path}`);
+    super(serviceErrorCode2(body, "http_error"), message ?? `HTTP ${status} from ${service}${path}`);
     this.name = "TopoloHttpError";
     this.status = status;
     this.body = body;
     this.service = service;
     this.path = path;
-    this.requestId = options.requestId;
-    this.retryAfter = options.retryAfter;
+    this.requestId = canonicalTopoloRequestId2(options.requestId);
+    this.retryAfter = canonicalTopoloRetryAfter2(options.retryAfter);
+    this.details = extractTopoloServiceErrorDetails2(
+      options.details === void 0 ? body : { details: options.details }
+    );
   }
 };
 var APP_API_URLS2 = {
@@ -4244,14 +2484,14 @@ var TopoloOAuth = class {
     return parsed;
   }
 };
-var ENVIRONMENT_DEFAULT_SERVICE_URLS = {
+var TOPOLO_ENVIRONMENT_SERVICE_URLS = {
   production: {
+    auth: "https://auth.topolo.app",
     developers: "https://developers.topolo.app"
   },
   staging: {
     auth: "https://auth.stg.topolo.us",
-    developers: "https://developers.stg.topolo.us",
-    seed: "https://seed.stg.topolo.us"
+    developers: "https://developers.stg.topolo.us"
   },
   development: {
     auth: "https://auth.topolo.dev",
@@ -4259,6 +2499,52 @@ var ENVIRONMENT_DEFAULT_SERVICE_URLS = {
   },
   local: {}
 };
+function hostnameHasSuffix2(hostname, suffix) {
+  return hostname === suffix || hostname.endsWith(`.${suffix}`);
+}
+function workersDevAccountMatches2(hostname, account) {
+  if (!hostname.endsWith(".workers.dev")) return false;
+  const labels = hostname.slice(0, -".workers.dev".length).split(".");
+  return labels.length >= 2 && labels.at(-1) === account;
+}
+function originMatchesEnvironment2(url, environment) {
+  const hostname = url.hostname.toLowerCase();
+  if (environment === "local") {
+    return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "[::1]";
+  }
+  if (url.protocol !== "https:") return false;
+  if (environment === "production") {
+    return hostnameHasSuffix2(hostname, "topolo.app") || hostnameHasSuffix2(hostname, "topolo.io") || workersDevAccountMatches2(hostname, "topolo");
+  }
+  if (environment === "staging") {
+    return hostnameHasSuffix2(hostname, "stg.topolo.us") || workersDevAccountMatches2(hostname, "topolo-staging");
+  }
+  return hostnameHasSuffix2(hostname, "topolo.dev") || workersDevAccountMatches2(hostname, "topolo-development");
+}
+function assertTopoloServiceUrlEnvironment2(service, value, environment) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new TopoloSdkError2("invalid_service_url", `Invalid URL configured for Topolo service "${service}".`);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password || !originMatchesEnvironment2(url, environment)) {
+    throw new TopoloSdkError2(
+      "environment_mismatch",
+      `Refusing Topolo service "${service}": ${url.origin} does not belong to ${environment}.`
+    );
+  }
+  return url.origin;
+}
+function topoloServiceOrigins2(serviceUrls, environment) {
+  return Object.fromEntries(
+    Object.entries(serviceUrls ?? {}).sort(([left], [right]) => left.localeCompare(right)).map(([service, value]) => [
+      service,
+      assertTopoloServiceUrlEnvironment2(service, value, environment)
+    ])
+  );
+}
+var ENVIRONMENT_DEFAULT_SERVICE_URLS = TOPOLO_ENVIRONMENT_SERVICE_URLS;
 function configPath() {
   const override = process.env.TOPOLO_CONFIG_PATH;
   if (override) return override;
@@ -4339,9 +2625,9 @@ function writeProfileConfig(config, environment, profile) {
 }
 async function resolveCredential(environment = selectedEnvironment()) {
   const prefix = envVarPrefix(environment);
-  const apiKey = process.env[`${prefix}_API_KEY`] ?? process.env.TOPOLO_API_KEY;
+  const apiKey = process.env[`${prefix}_API_KEY`] ?? (environment === "production" ? process.env.TOPOLO_API_KEY : void 0);
   if (apiKey) return { kind: "api_key", apiKey };
-  const accessToken = process.env[`${prefix}_ACCESS_TOKEN`] ?? process.env.TOPOLO_ACCESS_TOKEN;
+  const accessToken = process.env[`${prefix}_ACCESS_TOKEN`] ?? (environment === "production" ? process.env.TOPOLO_ACCESS_TOKEN : void 0);
   if (accessToken) return { kind: "access_token", accessToken };
   const config = await readConfig();
   return profileForEnvironment(config, environment).credential ?? null;
@@ -4349,7 +2635,7 @@ async function resolveCredential(environment = selectedEnvironment()) {
 var REFRESH_SKEW_SECONDS = 60;
 async function refreshCredentialIfNeeded(environment = selectedEnvironment(), options = {}) {
   const prefix = envVarPrefix(environment);
-  if (process.env[`${prefix}_API_KEY`] || process.env[`${prefix}_ACCESS_TOKEN`] || process.env.TOPOLO_API_KEY || process.env.TOPOLO_ACCESS_TOKEN) {
+  if (process.env[`${prefix}_API_KEY`] || process.env[`${prefix}_ACCESS_TOKEN`] || environment === "production" && process.env.TOPOLO_API_KEY || environment === "production" && process.env.TOPOLO_ACCESS_TOKEN) {
     return resolveCredential(environment);
   }
   const config = await readConfig();
@@ -4359,9 +2645,16 @@ async function refreshCredentialIfNeeded(environment = selectedEnvironment(), op
   if (!cred.refreshToken || !profile.oauthClientId) return cred;
   const now = Math.floor(Date.now() / 1e3);
   if (!options.force && cred.expiresAt && cred.expiresAt - REFRESH_SKEW_SECONDS > now) return cred;
+  const serviceUrls = resolveServiceUrls(profile.serviceUrls, environment);
+  if (environment === "local" && !serviceUrls?.auth) {
+    throw new TopoloSdkError2(
+      "environment_service_url_required",
+      "Local Topolo credential refresh requires an explicit local Auth service origin."
+    );
+  }
   try {
     const oauth = new TopoloOAuth({
-      serviceUrls: resolveServiceUrls(profile.serviceUrls, environment)
+      serviceUrls
     });
     const tokens = await oauth.refreshToken({
       clientId: profile.oauthClientId,
@@ -4402,9 +2695,16 @@ async function refreshContextCredentialIfNeeded(environment, key, options = {})
   if (!credential.refreshToken || !oauthClientId) return credential;
   const now = Math.floor(Date.now() / 1e3);
   if (!options.force && credential.expiresAt && credential.expiresAt - REFRESH_SKEW_SECONDS > now) return credential;
+  const serviceUrls = resolveServiceUrls(profile.serviceUrls, environment);
+  if (environment === "local" && !serviceUrls?.auth) {
+    throw new TopoloSdkError2(
+      "environment_service_url_required",
+      "Local Topolo context refresh requires an explicit local Auth service origin."
+    );
+  }
   try {
     const oauth = new TopoloOAuth({
-      serviceUrls: resolveServiceUrls(profile.serviceUrls, environment)
+      serviceUrls
     });
     const tokens = await oauth.refreshToken({
       clientId: oauthClientId,
@@ -4451,7 +2751,8 @@ function resolveServiceUrls(configUrls, environment = selectedEnvironment()) {
       merged[k.slice("TOPOLO_SERVICE_URL_".length).toLowerCase()] = v;
     }
   }
-  return Object.keys(merged).length > 0 ? merged : void 0;
+  const origins = topoloServiceOrigins2(merged, environment);
+  return Object.keys(origins).length > 0 ? origins : void 0;
 }
 // src/server.ts
@@ -4462,11 +2763,7 @@ import {
 } from "@modelcontextprotocol/sdk/types.js";
 // src/gating.ts
-function hasPlatformAccess(set) {
-  return (set.role === "platform_super_admin" || set.role === "platform_admin") && set.orgSlug === "admin";
-}
 function hasScope(set, required) {
-  if (hasPlatformAccess(set)) return true;
   if (set.permissions.includes("*")) return true;
   const [servicePart, actionPart] = splitPermission(required);
   if (!servicePart) return set.permissions.includes(required);
@@ -4816,6 +3113,38 @@ var TOOLS = [
       return args["detail"] === true ? result : compactActionValidation(result.action.actionId, result.validation);
     }
   },
+  {
+    name: "topolo_prepare_action",
+    title: "Prepare one Topolo action",
+    description: "Fetches one exact live action contract once and returns one valid published example, missing fields, exact request, confirmation state, verification, and rollback without executing it.",
+    requiredScopes: [],
+    destructive: false,
+    inputSchema: {
+      type: "object",
+      properties: {
+        actionId: { type: "string", minLength: 1 },
+        input: { type: "object", additionalProperties: true },
+        resourceType: { type: "string" },
+        resourceId: { type: "string" },
+        confirm: { type: "boolean", description: "Include confirmation in the plan without executing the action." }
+      },
+      required: ["actionId"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => {
+      const actionId = requiredString(args, "actionId");
+      const resource = optionalResourceContext(args);
+      const preparation = await topolo.client.prepareAction(
+        actionId,
+        args["input"] === void 0 ? void 0 : coerceObjectParam(args["input"], "input"),
+        {
+          confirm: args["confirm"] === true,
+          ...resource ? { resource } : {}
+        }
+      );
+      return compactActionPreparation(preparation);
+    }
+  },
   {
     name: "topolo_plan_action",
     title: "Plan one Topolo action",
@@ -5027,87 +3356,6 @@ var TOOLS = [
       args["confirm"] === true
     )
   },
-  {
-    name: "topolo_list_application_requirements",
-    title: "List Topolo application build requirements",
-    description: "Returns the current versioned Topolo application-build contract, optionally filtered to one application. Use this before creating or expanding a Topolo app so the agent follows shared metadata, docs, auth, shell, service registration, deployment, observability, and verification requirements.",
-    requiredScopes: [],
-    destructive: false,
-    inputSchema: {
-      type: "object",
-      properties: {
-        application: {
-          type: "string",
-          description: "Optional application ID from topolo_search_applications."
-        }
-      },
-      additionalProperties: false
-    },
-    handler: async (topolo, args) => {
-      const application = args["application"];
-      if (application === void 0) {
-        return {
-          version: APPLICATION_REQUIREMENTS_VERSION,
-          application: null,
-          scopes: ["all", "browser", "api", "tooling", "agent_surface"],
-          requirements: APPLICATION_REQUIREMENTS
-        };
-      }
-      const resolved = await resolveDirectoryApplication(topolo, application);
-      const app = resolved.application;
-      return {
-        version: APPLICATION_REQUIREMENTS_VERSION,
-        application: app,
-        scopes: applicationRequirementScopes(app),
-        requirements: requirementsForApplication(app)
-      };
-    }
-  },
-  {
-    name: "topolo_audit_applications",
-    title: "Audit Topolo applications against platform requirements",
-    description: "Returns catalog-backed conformance scores and migration-queue items for all Topolo apps, or one application when provided. Use this to see which shared platform requirements need implementation, verification, or deeper review.",
-    requiredScopes: [],
-    destructive: false,
-    inputSchema: {
-      type: "object",
-      properties: {
-        application: {
-          type: "string",
-          description: "Optional application ID from topolo_search_applications."
-        },
-        failOn: {
-          type: "string",
-          enum: ["missing", "needs_review", "partial"],
-          description: "Optional conformance gate. Returns conformanceGate.passed=false when findings at this severity or worse exist."
-        },
-        detail: {
-          type: "boolean",
-          description: "Include every finding and migration item. Defaults to per-app scores and a queue count."
-        }
-      },
-      additionalProperties: false
-    },
-    handler: async (topolo, args) => {
-      const application = args["application"];
-      const failOn = args["failOn"];
-      if (failOn !== void 0 && typeof failOn !== "string") {
-        throw new TopoloMcpPublicError("failOn must be one of: missing, needs_review, partial");
-      }
-      const gate = failOn ? normalizeFailOn(failOn) : null;
-      let report;
-      if (application === void 0) {
-        const directory = await listApplicationDirectory(topolo.client);
-        report = auditApplicationEntries(directory.applications.map((app) => app.application));
-        const output2 = args["detail"] === true ? report : compactApplicationAudit(report);
-        return gate ? { ...output2, conformanceGate: evaluateApplicationAuditGate(report, gate) } : output2;
-      }
-      const resolved = await resolveDirectoryApplication(topolo, application);
-      report = auditApplicationEntries([resolved.application]);
-      const output = args["detail"] === true ? report : compactApplicationAudit(report);
-      return gate ? { ...output, conformanceGate: evaluateApplicationAuditGate(report, gate) } : output;
-    }
-  },
   {
     name: "topolo_api_call",
     title: "Call any Topolo platform service",
@@ -5207,57 +3455,9 @@ async function buildTopoloTools(topolo, scopes, tools = TOOLS) {
   void topolo;
   return filterToolsByScopes(tools, scopes);
 }
-function evaluateApplicationAuditGate(report, threshold) {
-  const counts = {
-    met: 0,
-    partial: 0,
-    missing: 0,
-    needs_review: 0
-  };
-  for (const audit of report.applications) {
-    for (const finding2 of audit.findings) {
-      counts[finding2.status] += 1;
-    }
-  }
-  const failingFindings = statusesAtOrWorse(threshold).reduce(
-    (total, status) => total + counts[status],
-    0
-  );
-  return {
-    threshold,
-    passed: failingFindings === 0,
-    message: failingFindings === 0 ? `No findings at or above ${threshold}.` : `${failingFindings} finding(s) at or above ${threshold}.`,
-    failingFindings,
-    counts
-  };
-}
-function normalizeFailOn(value) {
-  const normalized = value.trim().toLowerCase().replace(/-/g, "_");
-  if (normalized === "missing" || normalized === "needs_review" || normalized === "partial") {
-    return normalized;
-  }
-  throw new TopoloMcpPublicError("failOn must be one of: missing, needs_review, partial");
-}
-function statusesAtOrWorse(threshold) {
-  if (threshold === "missing") return ["missing"];
-  if (threshold === "needs_review") return ["missing", "needs_review"];
-  return ["missing", "needs_review", "partial"];
-}
 function displayAppId(entry) {
   return friendlyAppId(entry);
 }
-async function resolveDirectoryApplication(topolo, application) {
-  if (typeof application !== "string" || !application.trim()) {
-    throw new TopoloMcpPublicError("`application` must be a non-empty string.");
-  }
-  try {
-    return await resolveApplicationDirectoryEntry(topolo.client, application);
-  } catch (error) {
-    throw new TopoloMcpPublicError(
-      error instanceof Error ? error.message : `Unknown application "${application}".`
-    );
-  }
-}
 // src/version.ts
 import { readFileSync } from "fs";
@@ -5283,11 +3483,29 @@ function readMcpVersion() {
 }
 var MCP_VERSION = readMcpVersion();
+// src/context.ts
+function createMcpExecutionContext(input) {
+  return createTopoloAgentExecutionContext(input);
+}
+function mcpServerInstructions(context) {
+  return JSON.stringify({
+    effectiveTopoloContext: context,
+    rules: [
+      "Use only this environment, identity, organization, context key, and service origins.",
+      "Prepare mutations before execution and preserve the unchanged request for confirmation.",
+      "Never infer undisclosed actions or switch organization context inside this MCP session."
+    ]
+  });
+}
+function mcpResultEnvelope(context, data) {
+  return { context, data };
+}
 // src/server.ts
-function buildServer(topolo, scopes, tools = TOOLS) {
+function buildServer(topolo, scopes, context, tools = TOOLS) {
   const server = new Server(
     { name: "topolo", version: MCP_VERSION },
-    { capabilities: { tools: {} } }
+    { capabilities: { tools: {} }, instructions: mcpServerInstructions(context) }
   );
   server.setRequestHandler(ListToolsRequestSchema, async () => {
     const availableTools = await buildTopoloTools(topolo, scopes, tools);
@@ -5310,66 +3528,74 @@ function buildServer(topolo, scopes, tools = TOOLS) {
     const tool = availableTools.find((t) => t.name === params.name);
     if (!tool) {
       return toolError(
+        context,
         `Tool "${params.name}" is not available for this credential. Either the tool does not exist or the current scopes do not permit it.`
       );
     }
     if (!hasAnyScope(scopes, tool.requiredScopes)) {
       return toolError(
+        context,
         `Tool "${tool.name}" requires one of: ${tool.requiredScopes.join(", ")}. Current credential does not grant any of these.`
       );
     }
     try {
       const result = await tool.handler(topolo, params.arguments ?? {});
       return {
-        content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        content: [{ type: "text", text: JSON.stringify(mcpResultEnvelope(context, result)) }]
       };
     } catch (err) {
       if (err instanceof TopoloPermissionError) {
-        return toolStructuredError(err, `Permission denied. Required: ${err.required.join(", ") || "(unknown)"}`, {
+        return toolStructuredError(context, err, err.message || "Permission denied.", {
           required: err.required
         });
       }
       if (err instanceof TopoloAuthError) {
-        return toolStructuredError(err, "Authentication failed.");
+        return toolStructuredError(context, err, "Authentication failed.");
       }
       if (err instanceof TopoloHttpError) {
-        return toolStructuredError(err, err.message);
+        return toolStructuredError(context, err, err.message);
       }
-      return toolError(publicMcpErrorMessage(err, "Tool execution failed."));
+      return toolError(context, publicMcpErrorMessage(err, "Tool execution failed."));
     }
   });
   return server;
 }
-function toolStructuredError(error, message, extra = {}) {
-  return toolError(JSON.stringify({
-    error: {
-      code: error.code,
-      status: error.status,
-      message,
-      service: error.service,
-      path: error.path,
-      requestId: error.requestId,
-      retryAfter: error.retryAfter,
-      details: error.body,
-      ...extra
-    }
-  }, null, 2));
+function toolStructuredError(context, error, _message, extra = {}) {
+  return toolError(context, {
+    code: error.code,
+    status: error.status,
+    message: publicTopoloErrorMessage(error),
+    service: error.service,
+    path: error.path,
+    requestId: error.requestId,
+    retryAfter: error.retryAfter,
+    details: error.details,
+    hint: topoloErrorHint(error),
+    ...extra
+  });
 }
 async function advertisedToolNames(topolo, scopes, tools = TOOLS) {
   return (await buildTopoloTools(topolo, scopes, tools)).map((t) => t.name);
 }
-function toolError(message) {
+function toolError(context, error) {
   return {
     isError: true,
-    content: [{ type: "text", text: message }]
+    content: [{
+      type: "text",
+      text: JSON.stringify({
+        context,
+        error: typeof error === "string" ? { code: "mcp_error", message: error } : error
+      })
+    }]
   };
 }
 // src/auth.ts
-function resolveCredentialFromEnv() {
-  const apiKey = process.env.TOPOLO_API_KEY;
+function resolveCredentialFromEnv(environment = "production") {
+  const prefix = environment === "production" ? "TOPOLO_PRODUCTION" : `TOPOLO_${environment.toUpperCase()}`;
+  const apiKey = process.env[`${prefix}_API_KEY`] ?? (environment === "production" ? process.env.TOPOLO_API_KEY : void 0);
   if (apiKey) return { kind: "api_key", apiKey };
-  const accessToken = process.env.TOPOLO_ACCESS_TOKEN;
+  const accessToken = process.env[`${prefix}_ACCESS_TOKEN`] ?? (environment === "production" ? process.env.TOPOLO_ACCESS_TOKEN : void 0);
   if (accessToken) return { kind: "access_token", accessToken };
   return null;
 }
@@ -5401,7 +3627,7 @@ function resolvePinnedContextKey(profile, selector) {
   throw new TopoloMcpPublicError(`TOPOLO_CONTEXT "${selector}" is not signed in for this environment`);
 }
 async function resolveMcpCredential(environment, selector = process.env.TOPOLO_CONTEXT, dependencies = DEFAULT_DEPENDENCIES) {
-  const environmentCredential = dependencies.resolveCredentialFromEnv();
+  const environmentCredential = dependencies.resolveCredentialFromEnv(environment);
   const requestedSelector = selector?.trim();
   if (environmentCredential) {
     if (requestedSelector) {
@@ -5410,15 +3636,16 @@ async function resolveMcpCredential(environment, selector = process.env.TOPOLO_C
     return { credential: environmentCredential, contextKey: null };
   }
   if (requestedSelector) {
-    const config = await dependencies.readConfig();
+    const config2 = await dependencies.readConfig();
     const contextKey = resolvePinnedContextKey(
-      profileForEnvironment(config, environment),
+      profileForEnvironment(config2, environment),
       requestedSelector
     );
     const credential = await dependencies.refreshContextCredentialIfNeeded(environment, contextKey);
     return {
       credential,
       contextKey,
+      storedContext: profileForEnvironment(config2, environment).contexts?.[contextKey],
       credentialProvider: () => dependencies.refreshContextCredentialIfNeeded(
         environment,
         contextKey
@@ -5430,6 +3657,25 @@ async function resolveMcpCredential(environment, selector = process.env.TOPOLO_C
       )
     };
   }
+  const config = await dependencies.readConfig();
+  const profile = profileForEnvironment(config, environment);
+  const activeContext = profile.activeContext;
+  if (activeContext) {
+    const storedContext = profile.contexts?.[activeContext];
+    if (!storedContext) {
+      throw new TopoloMcpPublicError(`Active Topolo context "${activeContext}" is not signed in for this environment`);
+    }
+    return {
+      credential: await dependencies.refreshContextCredentialIfNeeded(environment, activeContext),
+      contextKey: activeContext,
+      storedContext,
+      credentialProvider: () => dependencies.refreshContextCredentialIfNeeded(environment, activeContext),
+      refreshCredential: () => dependencies.refreshContextCredentialIfNeeded(environment, activeContext, { force: true })
+    };
+  }
+  if (Object.keys(profile.contexts ?? {}).length > 0) {
+    throw new TopoloMcpPublicError("No active Topolo context is selected for this environment");
+  }
   return {
     credential: await dependencies.refreshCredentialIfNeeded(environment),
     contextKey: null,
@@ -5484,6 +3730,7 @@ async function runStdioMcp(dependencies = DEFAULT_DEPENDENCIES2) {
   const serviceUrls = dependencies.resolveServiceUrls(profile.serviceUrls, environment);
   const topolo = dependencies.createTopolo({
     credential,
+    environment,
     agent: {
       clientName: "topolo-mcp",
       clientVersion: MCP_VERSION,
@@ -5494,8 +3741,15 @@ async function runStdioMcp(dependencies = DEFAULT_DEPENDENCIES2) {
     ...resolvedCredential.credentialProvider ? { credentialProvider: resolvedCredential.credentialProvider } : {},
     ...resolvedCredential.refreshCredential ? { refreshCredential: resolvedCredential.refreshCredential } : {}
   });
-  const scopes = await loadScopes(topolo);
-  const server = dependencies.buildServer(topolo, scopes);
+  const identity = await loadIdentity(topolo);
+  const scopes = scopesForIdentity(identity);
+  const executionContext = createMcpExecutionContext({
+    environment,
+    contextKey: resolvedCredential.contextKey,
+    identity,
+    serviceUrls
+  });
+  const server = dependencies.buildServer(topolo, scopes, executionContext);
   const transport = dependencies.createTransport();
   await server.connect(transport);
   const toolNames = await dependencies.advertisedToolNames(topolo, scopes);
@@ -5505,14 +3759,19 @@ async function runStdioMcp(dependencies = DEFAULT_DEPENDENCIES2) {
   );
 }
 async function loadScopes(topolo) {
+  return scopesForIdentity(await loadIdentity(topolo));
+}
+function scopesForIdentity(info) {
+  const userWithOrgSlug = info.user;
+  return {
+    permissions: info.user.permissions,
+    role: info.user.role,
+    orgSlug: info.organization?.slug || userWithOrgSlug.orgSlug || void 0
+  };
+}
+async function loadIdentity(topolo) {
   try {
-    const info = await topolo.identity.whoami();
-    const userWithOrgSlug = info.user;
-    return {
-      permissions: info.user.permissions,
-      role: info.user.role,
-      orgSlug: info.organization?.slug || userWithOrgSlug.orgSlug || void 0
-    };
+    return await topolo.identity.whoami();
   } catch (err) {
     if (err instanceof TopoloAuthError) {
       throw new TopoloMcpPublicError("credential rejected.");
@@ -5544,9 +3803,11 @@ export {
   createStdioTransport,
   exitStdioProcess,
   isDirectExecution,
+  loadIdentity,
   loadScopes,
   readStdioEnvironment,
   runStdioMcp,
+  scopesForIdentity,
   terminateStdioMcp,
   writeStdioError
 };