@topolo/mcp 0.4.10 → 0.6.0

package/dist/index.js

@@ -58,7 +58,7 @@ var TopoloHttpError = class extends TopoloSdkError {
     this.path = path;
   }
 };
-var SERVICES = {
+var APP_API_URLS = {
   agent: "https://agent.topolo.app",
   auth: "https://auth.topolo.app",
   backup: "https://backup.topolo.app",
@@ -124,7 +124,7 @@ var APPLICATIONS = {
           "admin.topolo.app"
         ],
         "routes": [],
-        "serviceId": null
+        "appId": null
       },
       {
         "name": "topolo-admin-api",
@@ -132,7 +132,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -154,7 +154,7 @@ var APPLICATIONS = {
           "agent.topolo.app"
         ],
         "routes": [],
-        "serviceId": "agent"
+        "appId": "agent"
       },
       {
         "name": "topolo-agent-api",
@@ -162,7 +162,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -186,7 +186,7 @@ var APPLICATIONS = {
         "routes": [
           "auth.topolo.app"
         ],
-        "serviceId": "auth"
+        "appId": "auth"
       }
     ]
   },
@@ -208,7 +208,7 @@ var APPLICATIONS = {
           "backup.topolo.app"
         ],
         "routes": [],
-        "serviceId": "backup"
+        "appId": "backup"
       }
     ]
   },
@@ -230,7 +230,7 @@ var APPLICATIONS = {
           "books.topolo.app"
         ],
         "routes": [],
-        "serviceId": "books"
+        "appId": "books"
       },
       {
         "name": "topolo-books-api",
@@ -238,7 +238,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -260,7 +260,7 @@ var APPLICATIONS = {
           "bugfix.topolo.app"
         ],
         "routes": [],
-        "serviceId": "bugfix"
+        "appId": "bugfix"
       }
     ]
   },
@@ -282,7 +282,7 @@ var APPLICATIONS = {
           "bytes.topolo.app"
         ],
         "routes": [],
-        "serviceId": "bytes"
+        "appId": "bytes"
       },
       {
         "name": "topolo-bytes-api",
@@ -290,7 +290,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -312,7 +312,7 @@ var APPLICATIONS = {
           "calendar.topolo.app"
         ],
         "routes": [],
-        "serviceId": "calendar"
+        "appId": "calendar"
       },
       {
         "name": "topolo-calendar-api",
@@ -320,7 +320,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -342,7 +342,7 @@ var APPLICATIONS = {
           "capacity.topolo.app"
         ],
         "routes": [],
-        "serviceId": "capacity"
+        "appId": "capacity"
       }
     ]
   },
@@ -364,7 +364,7 @@ var APPLICATIONS = {
           "chat.topolo.app"
         ],
         "routes": [],
-        "serviceId": "chat"
+        "appId": "chat"
       },
       {
         "name": "topolo-chat-api",
@@ -372,7 +372,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -392,7 +392,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       },
       {
         "name": "topolo-commerce-guest-web",
@@ -402,7 +402,7 @@ var APPLICATIONS = {
           "guest.topolo.app"
         ],
         "routes": [],
-        "serviceId": null
+        "appId": null
       },
       {
         "name": "topolo-commerce-ops-web",
@@ -412,7 +412,7 @@ var APPLICATIONS = {
           "commerce.topolo.app"
         ],
         "routes": [],
-        "serviceId": "commerce"
+        "appId": "commerce"
       },
       {
         "name": "topolo-commerce-station-web",
@@ -422,7 +422,7 @@ var APPLICATIONS = {
           "station-commerce.topolo.app"
         ],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -444,7 +444,7 @@ var APPLICATIONS = {
           "compose.topolo.app"
         ],
         "routes": [],
-        "serviceId": "compose"
+        "appId": "compose"
       },
       {
         "name": "topolo-compose-api",
@@ -452,7 +452,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -474,7 +474,7 @@ var APPLICATIONS = {
           "consent.topolo.app"
         ],
         "routes": [],
-        "serviceId": "consent"
+        "appId": "consent"
       },
       {
         "name": "topolo-consent-api",
@@ -482,7 +482,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -502,7 +502,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       },
       {
         "name": "topolo-crm-app",
@@ -512,7 +512,7 @@ var APPLICATIONS = {
           "crm.topolo.app"
         ],
         "routes": [],
-        "serviceId": "crm"
+        "appId": "crm"
       }
     ]
   },
@@ -532,7 +532,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       },
       {
         "name": "topolo-developers",
@@ -542,7 +542,7 @@ var APPLICATIONS = {
           "developers.topolo.app"
         ],
         "routes": [],
-        "serviceId": "developers"
+        "appId": "developers"
       },
       {
         "name": "topolo-developers-api",
@@ -550,7 +550,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -572,7 +572,7 @@ var APPLICATIONS = {
           "director.topolo.app"
         ],
         "routes": [],
-        "serviceId": "director"
+        "appId": "director"
       },
       {
         "name": "topolo-director-api",
@@ -580,7 +580,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -600,7 +600,7 @@ var APPLICATIONS = {
           "docs.topolo.app"
         ],
         "routes": [],
-        "serviceId": null
+        "appId": null
       },
       {
         "name": "topolo-docs-api",
@@ -608,7 +608,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -630,7 +630,7 @@ var APPLICATIONS = {
           "feed-analytics-api.topolo.app"
         ],
         "routes": [],
-        "serviceId": null
+        "appId": null
       },
       {
         "name": "topolo-feed-api",
@@ -640,7 +640,7 @@ var APPLICATIONS = {
           "feed-api.topolo.app"
         ],
         "routes": [],
-        "serviceId": null
+        "appId": null
       },
       {
         "name": "topolo-feed-web",
@@ -650,7 +650,7 @@ var APPLICATIONS = {
           "feed.topolo.app"
         ],
         "routes": [],
-        "serviceId": "feed"
+        "appId": "feed"
       }
     ]
   },
@@ -672,7 +672,7 @@ var APPLICATIONS = {
           "flow.topolo.app"
         ],
         "routes": [],
-        "serviceId": "flow"
+        "appId": "flow"
       },
       {
         "name": "topolo-flow-api",
@@ -680,7 +680,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -702,7 +702,7 @@ var APPLICATIONS = {
           "forecast.topolo.app"
         ],
         "routes": [],
-        "serviceId": "forecast"
+        "appId": "forecast"
       },
       {
         "name": "topolo-forecast-api",
@@ -710,7 +710,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -732,7 +732,7 @@ var APPLICATIONS = {
           "forms.topolo.app"
         ],
         "routes": [],
-        "serviceId": "forms"
+        "appId": "forms"
       },
       {
         "name": "topolo-forms-api",
@@ -740,7 +740,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -762,7 +762,7 @@ var APPLICATIONS = {
           "home.topolo.app"
         ],
         "routes": [],
-        "serviceId": "home"
+        "appId": "home"
       },
       {
         "name": "topolo-home-api",
@@ -770,7 +770,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -792,7 +792,7 @@ var APPLICATIONS = {
           "insights.topolo.app"
         ],
         "routes": [],
-        "serviceId": "insights"
+        "appId": "insights"
       },
       {
         "name": "topolo-insights-api",
@@ -800,7 +800,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -822,7 +822,7 @@ var APPLICATIONS = {
           "inventory.topolo.app"
         ],
         "routes": [],
-        "serviceId": "inventory"
+        "appId": "inventory"
       },
       {
         "name": "topolo-inventory-api",
@@ -830,7 +830,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -852,7 +852,7 @@ var APPLICATIONS = {
           "learn.topolo.app"
         ],
         "routes": [],
-        "serviceId": "learn"
+        "appId": "learn"
       },
       {
         "name": "topolo-learn-api",
@@ -860,7 +860,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -884,7 +884,7 @@ var APPLICATIONS = {
         "routes": [
           "localize.topolo.app"
         ],
-        "serviceId": "localize"
+        "appId": "localize"
       }
     ]
   },
@@ -906,7 +906,7 @@ var APPLICATIONS = {
           "mail.topolo.app"
         ],
         "routes": [],
-        "serviceId": "mail"
+        "appId": "mail"
       },
       {
         "name": "topolo-mail-api",
@@ -914,7 +914,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -934,7 +934,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       },
       {
         "name": "topolo-mdm-console",
@@ -944,7 +944,7 @@ var APPLICATIONS = {
           "mdm.topolo.app"
         ],
         "routes": [],
-        "serviceId": "mdm"
+        "appId": "mdm"
       }
     ]
   },
@@ -966,7 +966,7 @@ var APPLICATIONS = {
           "messages.topolo.app"
         ],
         "routes": [],
-        "serviceId": "messages"
+        "appId": "messages"
       },
       {
         "name": "topolo-messages-api",
@@ -974,7 +974,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       },
       {
         "name": "topolo-messages-dispatch",
@@ -982,7 +982,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -1004,7 +1004,7 @@ var APPLICATIONS = {
           "nexus.topolo.app"
         ],
         "routes": [],
-        "serviceId": null
+        "appId": null
       },
       {
         "name": "topolo-nexus-gateway",
@@ -1014,7 +1014,7 @@ var APPLICATIONS = {
           "nexus.topolo.app"
         ],
         "routes": [],
-        "serviceId": "nexus"
+        "appId": "nexus"
       }
     ]
   },
@@ -1038,7 +1038,7 @@ var APPLICATIONS = {
         "routes": [
           "notify.topolo.app"
         ],
-        "serviceId": "notify"
+        "appId": "notify"
       }
     ]
   },
@@ -1060,7 +1060,7 @@ var APPLICATIONS = {
           "observability-watch.topolo.app"
         ],
         "routes": [],
-        "serviceId": "observability_watch"
+        "appId": "observability_watch"
       }
     ]
   },
@@ -1084,7 +1084,7 @@ var APPLICATIONS = {
         "routes": [
           "one.topolo.app/*"
         ],
-        "serviceId": null
+        "appId": null
       },
       {
         "name": "topolo-one-api",
@@ -1096,7 +1096,7 @@ var APPLICATIONS = {
         "routes": [
           "www.topolo.app/*"
         ],
-        "serviceId": "one"
+        "appId": "one"
       },
       {
         "name": "topolo-one-website",
@@ -1109,7 +1109,7 @@ var APPLICATIONS = {
           "topolo.io",
           "www.topolo.io"
         ],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -1131,7 +1131,7 @@ var APPLICATIONS = {
           "p2p.topolo.app"
         ],
         "routes": [],
-        "serviceId": "p2p"
+        "appId": "p2p"
       },
       {
         "name": "topolo-p2p-api",
@@ -1139,7 +1139,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -1161,7 +1161,7 @@ var APPLICATIONS = {
           "pay.topolo.app"
         ],
         "routes": [],
-        "serviceId": "pay"
+        "appId": "pay"
       },
       {
         "name": "topolo-pay-api",
@@ -1169,7 +1169,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -1191,7 +1191,7 @@ var APPLICATIONS = {
           "people.topolo.app"
         ],
         "routes": [],
-        "serviceId": "people"
+        "appId": "people"
       },
       {
         "name": "topolo-people-api",
@@ -1199,7 +1199,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -1224,7 +1224,7 @@ var APPLICATIONS = {
         "routes": [
           "api.ol0.me/*"
         ],
-        "serviceId": "quro.api"
+        "appId": "quro.api"
       },
       {
         "name": "quro-redirect-system",
@@ -1236,7 +1236,7 @@ var APPLICATIONS = {
         "routes": [
           "ol0.me/*"
         ],
-        "serviceId": "quro.redirect"
+        "appId": "quro.redirect"
       },
       {
         "name": "quro-ui",
@@ -1246,7 +1246,7 @@ var APPLICATIONS = {
           "quro.topolo.app"
         ],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -1268,7 +1268,7 @@ var APPLICATIONS = {
           "roadmapper.topolo.app"
         ],
         "routes": [],
-        "serviceId": "roadmapper"
+        "appId": "roadmapper"
       },
       {
         "name": "topolo-roadmapper-api",
@@ -1276,7 +1276,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -1298,7 +1298,7 @@ var APPLICATIONS = {
           "sign.topolo.app"
         ],
         "routes": [],
-        "serviceId": "sign"
+        "appId": "sign"
       },
       {
         "name": "topolo-sign-api",
@@ -1306,7 +1306,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -1328,7 +1328,7 @@ var APPLICATIONS = {
           "studio.topolo.app"
         ],
         "routes": [],
-        "serviceId": "social_studio"
+        "appId": "social_studio"
       },
       {
         "name": "topolo-social-studio-api",
@@ -1336,7 +1336,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       },
       {
         "name": "topolo-social-studio-queue",
@@ -1344,7 +1344,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -1366,7 +1366,7 @@ var APPLICATIONS = {
           "socialize.topolo.app"
         ],
         "routes": [],
-        "serviceId": "socialize"
+        "appId": "socialize"
       },
       {
         "name": "topolo-socialize-api",
@@ -1376,7 +1376,7 @@ var APPLICATIONS = {
           "socialize-api.topolo.app"
         ],
         "routes": [],
-        "serviceId": null
+        "appId": null
       },
       {
         "name": "topolo-socialize-scheduler",
@@ -1384,7 +1384,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -1406,7 +1406,7 @@ var APPLICATIONS = {
           "spaces.topolo.app"
         ],
         "routes": [],
-        "serviceId": "spaces"
+        "appId": "spaces"
       },
       {
         "name": "topolo-spaces-api",
@@ -1414,7 +1414,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -1436,7 +1436,7 @@ var APPLICATIONS = {
           "status.topolo.app"
         ],
         "routes": [],
-        "serviceId": "status"
+        "appId": "status"
       }
     ]
   },
@@ -1460,7 +1460,7 @@ var APPLICATIONS = {
         "routes": [
           "success.topolo.app"
         ],
-        "serviceId": "success"
+        "appId": "success"
       },
       {
         "name": "topolo-success-api",
@@ -1468,7 +1468,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -1492,7 +1492,7 @@ var APPLICATIONS = {
         "routes": [
           "support.topolo.app/*"
         ],
-        "serviceId": "support"
+        "appId": "support"
       },
       {
         "name": "topolo-support-api",
@@ -1500,7 +1500,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -1522,7 +1522,7 @@ var APPLICATIONS = {
           "survey.topolo.app"
         ],
         "routes": [],
-        "serviceId": "survey"
+        "appId": "survey"
       },
       {
         "name": "topolo-survey-api",
@@ -1530,7 +1530,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -1552,7 +1552,7 @@ var APPLICATIONS = {
           "voice.topolo.app"
         ],
         "routes": [],
-        "serviceId": "voice"
+        "appId": "voice"
       },
       {
         "name": "topolo-voice-api",
@@ -1560,7 +1560,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       }
     ]
   },
@@ -1580,7 +1580,7 @@ var APPLICATIONS = {
         "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": null
+        "appId": null
       },
       {
         "name": "topolo-web-runtime",
@@ -1593,7 +1593,7 @@ var APPLICATIONS = {
           "*.sites.topolo.app/*",
           "sites.topolo.app"
         ],
-        "serviceId": null
+        "appId": null
       },
       {
         "name": "topolo-web-studio",
@@ -1603,7 +1603,7 @@ var APPLICATIONS = {
           "web.topolo.app"
         ],
         "routes": [],
-        "serviceId": "web"
+        "appId": "web"
       }
     ]
   }
@@ -1645,12 +1645,12 @@ var APPLICATION_REQUIREMENTS = [
   {
     id: "shared-auth-boundary",
     title: "Use the shared Topolo auth boundary",
-    summary: "Applications must derive identity, organization, scopes, and service entitlement from TopoloAuth rather than inventing parallel auth state.",
+    summary: "Applications must derive identity, organization, scopes, and app entitlement from TopoloAuth rather than inventing parallel auth state.",
     appliesTo: ["browser", "api", "tooling", "agent_surface"],
     evidence: [
       "@topolo/auth-client or @topolo-io/worker-runtime is used where applicable",
       "No public command, tool, or SDK method accepts orgId",
-      "Service slug and Auth service registration are documented for protected services"
+      "App slug and Auth app registration are documented for protected APIs"
     ],
     implementation: [
       "Use shared auth/runtime packages instead of copying token parsing, gateway, or browser storage flows",
@@ -1683,20 +1683,20 @@ var APPLICATION_REQUIREMENTS = [
     ]
   },
   {
-    id: "service-registration-and-scopes",
-    title: "Register protected APIs as platform services",
-    summary: "Callable app APIs need a stable service ID, service slug, permissions, role bundles, and API-key scopes before agents or users rely on them.",
+    id: "app-registration-and-scopes",
+    title: "Register protected APIs as platform apps",
+    summary: "Callable app APIs need a stable app ID, app slug, permissions, role bundles, and API-key scopes before agents or users rely on them.",
     appliesTo: ["api"],
     evidence: [
-      "Auth service catalog contains the service ID and slug",
-      "Permissions, role bundles, and API-key scopes exist for the service",
-      "SDK, CLI, and MCP service discovery include the callable production API",
-      "CloudControl production HTTP targets classify agent reachability with sdk_service_id or agent_callable:false"
+      "Auth app catalog contains the app ID and slug",
+      "Permissions, role bundles, and API-key scopes exist for the app",
+      "SDK, CLI, and MCP app discovery include the callable production API",
+      "CloudControl production HTTP targets classify agent reachability with sdk_app_id or agent_callable:false"
     ],
     implementation: [
-      "Add production Worker api_url metadata and sdk_service_id for every agent-callable API target",
+      "Add production Worker api_url metadata and sdk_app_id for every agent-callable API target",
       "Mark browser, documentation, and runtime-only Worker targets with agent_callable:false",
-      "Expose stable service IDs through generated DEFAULT_SERVICE_URLS and live catalog discovery",
+      "Expose stable app IDs through generated DEFAULT_APP_URLS and live catalog discovery",
       "Keep typed SDK/CLI/MCP surfaces in sync when an API contract stabilizes"
     ]
   },
@@ -1805,7 +1805,7 @@ function applicationRequirementScopes(application) {
   const hasBrowserSurface = Boolean(application.productionUrl) || // String() keeps this guard valid after the Pages->Worker migration narrowed
   // the generated kind union to "worker" (no "pages" literal remains).
   application.deployTargets.some((target) => String(target.kind) === "pages");
-  const hasApiSurface = application.services.length > 0 || application.deployTargets.some((target) => Boolean(target.serviceId));
+  const hasApiSurface = application.services.length > 0 || application.deployTargets.some((target) => Boolean(target.appId));
   if (hasBrowserSurface) scopes.add("browser");
   if (hasApiSurface) scopes.add("api");
   if (appId === "cli" || appId === "mcp" || appId === "cloudcontrol") {
@@ -1902,7 +1902,7 @@ function evaluateRequirement(application, requirement) {
         "Catalog metadata cannot verify shared shell, launcher, and account menu adoption.",
         evidence
       );
-    case "service-registration-and-scopes": {
+    case "app-registration-and-scopes": {
       if (application.services.length > 0) {
         evidence.push(`services=${application.services.join(",")}`);
         return finding(
@@ -1912,7 +1912,7 @@ function evaluateRequirement(application, requirement) {
           evidence
         );
       }
-      return finding(requirement, "missing", "No SDK service ID is registered for this callable API surface.", evidence);
+      return finding(requirement, "missing", "No SDK app API id is registered for this callable API surface.", evidence);
     }
     case "organization-scoped-data":
       return finding(
@@ -1997,7 +1997,7 @@ function statusRank(status) {
   if (status === "partial") return 1;
   return 2;
 }
-var DEFAULT_SERVICE_URLS = SERVICES;
+var DEFAULT_APP_URLS = APP_API_URLS;
 function resolveCatalogServiceUrl(entry, options = {}) {
   const keys = catalogServiceKeyCandidates(entry, options.serviceKey);
   const override = resolveServiceUrlOverride(keys, options.overrides);
@@ -2009,10 +2009,10 @@ function resolveCatalogServiceUrl(entry, options = {}) {
 function resolveServiceUrl(service, overrides) {
   const override = resolveServiceUrlOverride([service], overrides);
   if (override) return override;
-  return DEFAULT_SERVICE_URLS[service];
+  return DEFAULT_APP_URLS[service];
 }
 function catalogServiceKeyCandidates(entry, preferred) {
-  const values = [preferred, entry.slug, entry.name, entry.serviceId].filter(
+  const values = [preferred, entry.slug, entry.name, entry.appId].filter(
     (value) => typeof value === "string" && value.trim().length > 0
   );
   const keys = /* @__PURE__ */ new Set();
@@ -2040,7 +2040,7 @@ function resolveServiceUrlOverride(keys, overrides) {
     if (envStyle) return envStyle;
   }
   for (const key of keys) {
-    const envKey = `TOPOLO_SERVICE_URL_${key.replace(/\./g, "_").toUpperCase()}`;
+    const envKey = `TOPOLO_APP_URL_${key.replace(/\./g, "_").toUpperCase()}`;
     const envValue = typeof process !== "undefined" ? process.env?.[envKey] : void 0;
     if (envValue) return envValue;
   }
@@ -2064,7 +2064,7 @@ var TopoloClient = class _TopoloClient {
   credential;
   agent;
   serviceUrls;
-  serviceIds;
+  appIds;
   requireConfirmForWrites;
   timeoutMs;
   fetchImpl;
@@ -2072,18 +2072,18 @@ var TopoloClient = class _TopoloClient {
   serviceCatalogCache = null;
   actionCatalogCache = null;
   /**
-   * Process-wide cache for slug → service-id lookups. Keyed by
+   * Process-wide cache for slug → app-id lookups. Keyed by
    * `${authBaseUrl}|${slug}` so multiple `TopoloClient` instances pointing at
    * the same Auth share, but staging vs prod don't poison each other.
-   * Cleared via `TopoloClient.clearServiceIdCache()` if a test needs it.
+   * Cleared via `TopoloClient.clearAppIdCache()` if a test needs it.
    */
-  static serviceIdCache = /* @__PURE__ */ new Map();
+  static appIdCache = /* @__PURE__ */ new Map();
   /**
-   * Drop the slug→service-id cache. Test-only — production callers should
+   * Drop the slug→app-id cache. Test-only — production callers should
    * let the 5-minute TTL expire naturally.
    */
-  static clearServiceIdCache() {
-    _TopoloClient.serviceIdCache.clear();
+  static clearAppIdCache() {
+    _TopoloClient.appIdCache.clear();
   }
   constructor(options) {
     if (!options.credential) throw new TopoloAuthError("credential is required");
@@ -2091,7 +2091,7 @@ var TopoloClient = class _TopoloClient {
     this.credential = options.credential;
     this.agent = options.agent;
     this.serviceUrls = options.serviceUrls;
-    this.serviceIds = options.serviceIds;
+    this.appIds = options.appIds;
     this.requireConfirmForWrites = options.requireConfirmForWrites !== false;
     this.timeoutMs = options.timeoutMs ?? 3e4;
     this.fetchImpl = options.fetch ?? fetch;
@@ -2127,8 +2127,8 @@ var TopoloClient = class _TopoloClient {
     const headers = new Headers();
     headers.set("Accept", "application/json");
     if (opts.body !== void 0) headers.set("Content-Type", "application/json");
-    const platformServiceId = resolveConfiguredServiceId(resolvedService.serviceKey, this.serviceIds);
-    if (platformServiceId) headers.set("X-Service-ID", platformServiceId);
+    const platformAppId = resolveConfiguredAppId(resolvedService.serviceKey, this.appIds);
+    if (platformAppId) headers.set("X-App-ID", platformAppId);
     applyAuthHeaders(headers, this.credential);
     const requestId = generateRequestId();
     applyAuditHeaders(headers, this.agent, requestId);
@@ -2225,7 +2225,7 @@ var TopoloClient = class _TopoloClient {
         const derived = deriveDevelopersFromAuth(resolveConfiguredServiceUrl("auth", this.serviceUrls));
         if (derived) return { serviceKey, baseUrl: derived };
       }
-      return { serviceKey, baseUrl: DEFAULT_SERVICE_URLS[serviceKey] };
+      return { serviceKey, baseUrl: DEFAULT_APP_URLS[serviceKey] };
     }
     const live = await this.resolveLiveCallableService(serviceKey);
     if (live) {
@@ -2234,7 +2234,7 @@ var TopoloClient = class _TopoloClient {
     }
     throw new TopoloSdkError(
       "unknown_service",
-      `Unknown Topolo service "${service}". Run service discovery first and pass a callable service id or slug.`
+      `Unknown Topolo app API "${service}". Run app discovery first and pass a callable app id or slug.`
     );
   }
   async resolveLiveCallableService(serviceKey) {
@@ -2248,7 +2248,7 @@ var TopoloClient = class _TopoloClient {
     return baseUrl ? { serviceKey, baseUrl } : null;
   }
   /**
-   * Resolve a service-slug → opaque service-id via caller config or TopoloAuth.
+   * Resolve a service-slug → opaque app-id via caller config or TopoloAuth.
    *
    * Cache: 5 minutes per process per `(slug, auth_base_url)`. Negative
    * results (404) are cached for 60s so a typo doesn't hot-loop the
@@ -2259,16 +2259,16 @@ var TopoloClient = class _TopoloClient {
    * This keeps the resolver usable during early bootstrap before a caller
    * has acquired an access token.
    */
-  async getServiceIdBySlug(slug) {
+  async getAppIdBySlug(slug) {
     if (typeof slug !== "string") return null;
     const normalized = slug.trim().toLowerCase();
     if (!normalized) return null;
-    const configuredServiceId = resolveConfiguredServiceId(normalized, this.serviceIds);
-    if (configuredServiceId) return configuredServiceId;
+    const configuredAppId = resolveConfiguredAppId(normalized, this.appIds);
+    if (configuredAppId) return configuredAppId;
     const authBase = resolveServiceUrl("developers", this.serviceUrls);
     const cacheKey = `${authBase}|${normalized}`;
     const now = Date.now();
-    const cached = _TopoloClient.serviceIdCache.get(cacheKey);
+    const cached = _TopoloClient.appIdCache.get(cacheKey);
     if (cached && cached.expiresAt > now) {
       return cached.value;
     }
@@ -2286,7 +2286,7 @@ var TopoloClient = class _TopoloClient {
       return null;
     }
     if (res.status === 404) {
-      _TopoloClient.serviceIdCache.set(cacheKey, {
+      _TopoloClient.appIdCache.set(cacheKey, {
         value: null,
         expiresAt: now + NEGATIVE_CACHE_TTL_MS
       });
@@ -2296,9 +2296,9 @@ var TopoloClient = class _TopoloClient {
       return null;
     }
     const body = await res.json().catch(() => null);
-    const serviceId = body?.data?.service_id;
-    const value = typeof serviceId === "string" && serviceId ? serviceId : null;
-    _TopoloClient.serviceIdCache.set(cacheKey, {
+    const appId = body?.data?.app_id;
+    const value = typeof appId === "string" && appId ? appId : null;
+    _TopoloClient.appIdCache.set(cacheKey, {
       value,
       expiresAt: now + POSITIVE_CACHE_TTL_MS
     });
@@ -2330,8 +2330,8 @@ var TopoloClient = class _TopoloClient {
     const entries = [];
     for (const item of raw) {
       const s = item;
-      const serviceId = typeof s.service_id === "string" ? s.service_id : typeof s.id === "string" ? s.id : null;
-      if (!serviceId) continue;
+      const appId = typeof s.app_id === "string" ? s.app_id : typeof s.id === "string" ? s.id : null;
+      if (!appId) continue;
       const permissions = Array.isArray(s.granted_permissions) ? s.granted_permissions.filter((permission) => typeof permission === "string" && permission.trim().length > 0) : [];
       const catalogApiKeyResources = normalizeApiKeyResourceMetadataList(
         s.api_key_resources ?? s.apiKeyResources
@@ -2339,7 +2339,7 @@ var TopoloClient = class _TopoloClient {
       const apiKeyResource = normalizeApiKeyResourceMetadata(s.api_key_resource ?? s.apiKeyResource) ?? catalogApiKeyResources[0] ?? null;
       const apiKeyResources = catalogApiKeyResources.length > 0 ? catalogApiKeyResources : apiKeyResource ? [apiKeyResource] : [];
       entries.push({
-        serviceId,
+        appId,
         slug: typeof s.app_slug === "string" ? s.app_slug : null,
         name: typeof s.name === "string" ? s.name : null,
         description: typeof s.description === "string" ? s.description : null,
@@ -2407,7 +2407,7 @@ var TopoloClient = class _TopoloClient {
   async callAction(action, input = {}, options = {}) {
     const entry = await this.getAction(action);
     const mapped = mapActionInput(entry, input);
-    const service = entry.serviceSlug || entry.serviceId;
+    const service = entry.appSlug || entry.appId;
     return this.request({
       service,
       method: entry.method,
@@ -2428,7 +2428,7 @@ var TopoloClient = class _TopoloClient {
   listBundledServices() {
     const apps = Object.values(APPLICATIONS);
     return apps.map((app) => ({
-      serviceId: app.id,
+      appId: app.id,
       slug: app.id,
       name: app.name ?? app.id,
       description: null,
@@ -2478,11 +2478,11 @@ var TopoloClient = class _TopoloClient {
     };
   }
 };
-function resolveConfiguredServiceId(slug, serviceIds) {
+function resolveConfiguredAppId(slug, appIds) {
   for (const serviceKey of serviceKeyCandidates2(slug)) {
-    const configured = serviceIds?.[serviceKey];
+    const configured = appIds?.[serviceKey];
     if (typeof configured === "string" && configured.trim()) return configured.trim();
-    const envKey = `TOPOLO_SERVICE_ID_${serviceKey.replace(/\./g, "_").toUpperCase()}`;
+    const envKey = `TOPOLO_APP_ID_${serviceKey.replace(/\./g, "_").toUpperCase()}`;
     const envValue = typeof process !== "undefined" ? process.env?.[envKey] : void 0;
     if (typeof envValue === "string" && envValue.trim()) return envValue.trim();
   }
@@ -2566,7 +2566,7 @@ function catalogEntryMatches(entry, needle) {
   return catalogEntryLookupKeys(entry).includes(needle);
 }
 function catalogEntryLookupKeys(entry) {
-  const values = [entry.serviceId, entry.slug, entry.name].filter((value) => typeof value === "string" && value.trim().length > 0);
+  const values = [entry.appId, entry.slug, entry.name].filter((value) => typeof value === "string" && value.trim().length > 0);
   const keys = /* @__PURE__ */ new Set();
   for (const value of values) {
     const normalized = normalizeLookupKey(value);
@@ -2582,10 +2582,10 @@ function normalizeActionCatalogEntry(item) {
   const a = item;
   const actionId = pickActionString(a.action_id) ?? pickActionString(a.actionId);
   const name = pickActionString(a.name);
-  const serviceId = pickActionString(a.service_id) ?? pickActionString(a.serviceId);
+  const appId = pickActionString(a.app_id) ?? pickActionString(a.appId);
   const method = pickActionString(a.method)?.toUpperCase();
   const path = pickActionString(a.path);
-  if (!actionId || !name || !serviceId || !method || !path || !isHttpMethod(method)) {
+  if (!actionId || !name || !appId || !method || !path || !isHttpMethod(method)) {
     return null;
   }
   return {
@@ -2594,9 +2594,9 @@ function normalizeActionCatalogEntry(item) {
     toolName: pickActionString(a.tool_name) ?? pickActionString(a.toolName) ?? null,
     title: pickActionString(a.title) ?? name,
     description: pickActionString(a.description) ?? "",
-    serviceId,
-    serviceSlug: pickActionString(a.service_slug) ?? pickActionString(a.serviceSlug) ?? null,
-    serviceName: pickActionString(a.service_name) ?? pickActionString(a.serviceName) ?? null,
+    appId,
+    appSlug: pickActionString(a.app_slug) ?? pickActionString(a.appSlug) ?? null,
+    appName: pickActionString(a.app_name) ?? pickActionString(a.appName) ?? null,
     method,
     path,
     permissionName: pickActionString(a.permission_name) ?? pickActionString(a.permissionName) ?? "",
@@ -2711,6 +2711,7 @@ var CrmModule = class {
   constructor(client) {
     this.client = client;
   }
+  client;
   async listContacts(options = {}) {
     const res = await this.client.request({
       service: "crm",
@@ -2756,6 +2757,7 @@ var IdentityModule = class {
   constructor(client) {
     this.client = client;
   }
+  client;
   /** Returns the resolved user, organization, and permission set for the
    *  current credential. Equivalent to `TopoloClient.introspect()` — exposed
    *  on this module for symmetry with the other domain modules. */
@@ -2772,22 +2774,353 @@ function createTopolo(options) {
   };
 }
 
-// src/auth.ts
-function resolveCredentialFromEnv() {
-  const apiKey = process.env.TOPOLO_API_KEY;
+// ../topolo-sdk/dist/node/credential-store.js
+import { mkdir, readFile, writeFile, chmod } from "fs/promises";
+import { existsSync } from "fs";
+import { homedir, platform } from "os";
+import { dirname, join } from "path";
+var TopoloSdkError2 = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "TopoloSdkError";
+    this.code = code;
+  }
+};
+var TopoloAuthError2 = class extends TopoloSdkError2 {
+  constructor(message, code = "auth_error") {
+    super(code, message);
+    this.name = "TopoloAuthError";
+  }
+};
+var TopoloHttpError2 = class extends TopoloSdkError2 {
+  status;
+  body;
+  service;
+  path;
+  constructor(service, path, status, body, message) {
+    super("http_error", message ?? `HTTP ${status} from ${service}${path}`);
+    this.name = "TopoloHttpError";
+    this.status = status;
+    this.body = body;
+    this.service = service;
+    this.path = path;
+  }
+};
+var APP_API_URLS2 = {
+  agent: "https://agent.topolo.app",
+  auth: "https://auth.topolo.app",
+  backup: "https://backup.topolo.app",
+  books: "https://books.topolo.app",
+  bugfix: "https://bugfix.topolo.app",
+  bytes: "https://bytes.topolo.app",
+  calendar: "https://calendar.topolo.app",
+  capacity: "https://capacity.topolo.app",
+  chat: "https://chat.topolo.app",
+  commerce: "https://commerce.topolo.app",
+  compose: "https://compose.topolo.app",
+  consent: "https://consent.topolo.app",
+  crm: "https://crm.topolo.app",
+  developers: "https://developers.topolo.app",
+  director: "https://director.topolo.app",
+  feed: "https://feed.topolo.app",
+  flow: "https://flow.topolo.app",
+  forecast: "https://forecast.topolo.app",
+  forms: "https://forms.topolo.app",
+  home: "https://home.topolo.app",
+  insights: "https://insights.topolo.app",
+  inventory: "https://inventory.topolo.app",
+  learn: "https://learn.topolo.app",
+  localize: "https://localize.topolo.app",
+  mail: "https://mail.topolo.app",
+  mdm: "https://mdm.topolo.app",
+  messages: "https://messages.topolo.app",
+  nexus: "https://nexus.topolo.app",
+  notify: "https://notify.topolo.app",
+  observability_watch: "https://observability-watch.topolo.app",
+  one: "https://www.topolo.app",
+  p2p: "https://p2p.topolo.app",
+  pay: "https://pay.topolo.app",
+  people: "https://people.topolo.app",
+  "quro.api": "https://api.ol0.me",
+  "quro.redirect": "https://ol0.me",
+  roadmapper: "https://roadmapper.topolo.app",
+  sign: "https://sign.topolo.app",
+  social_studio: "https://studio.topolo.app",
+  socialize: "https://socialize.topolo.app",
+  spaces: "https://spaces.topolo.app",
+  status: "https://status.topolo.app",
+  success: "https://success.topolo.app",
+  support: "https://support.topolo.app",
+  survey: "https://survey.topolo.app",
+  voice: "https://voice.topolo.app",
+  web: "https://web.topolo.app"
+};
+var DEFAULT_APP_URLS2 = APP_API_URLS2;
+function resolveServiceUrl2(service, overrides) {
+  const override = resolveServiceUrlOverride2([service], overrides);
+  if (override) return override;
+  return DEFAULT_APP_URLS2[service];
+}
+function resolveServiceUrlOverride2(keys, overrides) {
+  for (const key of keys) {
+    const direct = overrides?.[key];
+    if (direct) return direct;
+    const envStyleKey = key.replace(/\./g, "_");
+    const envStyle = overrides?.[envStyleKey];
+    if (envStyle) return envStyle;
+  }
+  for (const key of keys) {
+    const envKey = `TOPOLO_APP_URL_${key.replace(/\./g, "_").toUpperCase()}`;
+    const envValue = typeof process !== "undefined" ? process.env?.[envKey] : void 0;
+    if (envValue) return envValue;
+  }
+  return null;
+}
+var DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+var TopoloOAuth = class {
+  baseUrl;
+  fetchImpl;
+  constructor(options = {}) {
+    this.baseUrl = resolveServiceUrl2("auth", options.serviceUrls);
+    this.fetchImpl = options.fetch ?? fetch;
+  }
+  /**
+   * RFC 8628 device authorization grant — starts the flow by asking the server
+   * for a device_code + user_code. The caller prints the user_code +
+   * verification_uri and then polls `pollDeviceToken` until approval.
+   */
+  async requestDeviceCode(params) {
+    const body = new URLSearchParams();
+    body.set("client_id", params.clientId);
+    if (params.scope) {
+      body.set("scope", Array.isArray(params.scope) ? params.scope.join(" ") : params.scope);
+    }
+    return this.#postForm("/api/developer-oauth/device_authorization", body);
+  }
+  /**
+   * Polls the token endpoint once. Returns the token pair on success, or
+   * throws a `TopoloAuthError` whose `code` is one of the RFC 8628 poll
+   * states: `authorization_pending`, `slow_down`, `access_denied`,
+   * `expired_token`. Callers should back off on `slow_down`, wait at least
+   * one `interval` on `authorization_pending`, and give up on the rest.
+   */
+  async pollDeviceToken(params) {
+    const body = new URLSearchParams();
+    body.set("grant_type", DEVICE_GRANT);
+    body.set("client_id", params.clientId);
+    body.set("device_code", params.deviceCode);
+    if (params.clientSecret) body.set("client_secret", params.clientSecret);
+    return this.#postForm("/api/developer-oauth/token", body);
+  }
+  /** Exchange an authorization code (with PKCE) for tokens. */
+  async exchangeAuthorizationCode(params) {
+    const body = new URLSearchParams();
+    body.set("grant_type", "authorization_code");
+    body.set("client_id", params.clientId);
+    body.set("code", params.code);
+    body.set("redirect_uri", params.redirectUri);
+    if (params.codeVerifier) body.set("code_verifier", params.codeVerifier);
+    if (params.clientSecret) body.set("client_secret", params.clientSecret);
+    return this.#postForm("/api/developer-oauth/token", body);
+  }
+  /** Rotate a refresh token for a new token pair. */
+  async refreshToken(params) {
+    const body = new URLSearchParams();
+    body.set("grant_type", "refresh_token");
+    body.set("client_id", params.clientId);
+    body.set("refresh_token", params.refreshToken);
+    if (params.clientSecret) body.set("client_secret", params.clientSecret);
+    return this.#postForm("/api/developer-oauth/token", body);
+  }
+  async #postForm(path, body) {
+    const url = new URL(path, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
+    const res = await this.fetchImpl(url.toString(), {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json"
+      },
+      body: body.toString()
+    });
+    const contentType = res.headers.get("Content-Type") ?? "";
+    const parsed = contentType.includes("application/json") ? await res.json().catch(() => null) : await res.text().catch(() => null);
+    if (!res.ok) {
+      if (parsed && typeof parsed === "object" && "error" in parsed) {
+        const err = parsed;
+        throw new TopoloAuthError2(err.error_description || err.error, err.error);
+      }
+      throw new TopoloHttpError2("auth", path, res.status, parsed);
+    }
+    return parsed;
+  }
+};
+var ENVIRONMENT_DEFAULT_SERVICE_URLS = {
+  production: {
+    developers: "https://developers.topolo.app"
+  },
+  staging: {
+    auth: "https://auth.stg.topolo.us",
+    developers: "https://developers.stg.topolo.us",
+    seed: "https://seed.stg.topolo.us"
+  },
+  development: {
+    auth: "https://auth.topolo.dev",
+    developers: "https://developers.topolo.dev"
+  },
+  local: {}
+};
+function configPath() {
+  const override = process.env.TOPOLO_CONFIG_PATH;
+  if (override) return override;
+  const base = process.env.XDG_CONFIG_HOME || (platform() === "win32" ? join(homedir(), "AppData", "Roaming") : join(homedir(), ".config"));
+  return join(base, "topolo", "config.json");
+}
+async function readConfig() {
+  const path = configPath();
+  if (!existsSync(path)) return {};
+  try {
+    const raw = await readFile(path, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+}
+async function writeConfig(config) {
+  const path = configPath();
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(path, JSON.stringify(config, null, 2) + "\n", "utf8");
+  if (platform() !== "win32") {
+    try {
+      await chmod(path, 384);
+    } catch {
+    }
+  }
+}
+function normalizeEnvironment(value) {
+  const normalized = (value ?? "production").trim().toLowerCase();
+  if (normalized === "" || normalized === "production" || normalized === "prod") {
+    return "production";
+  }
+  if (normalized === "staging" || normalized === "stage" || normalized === "stg") {
+    return "staging";
+  }
+  if (normalized === "development" || normalized === "dev") {
+    return "development";
+  }
+  if (normalized === "local" || normalized === "localhost") {
+    return "local";
+  }
+  throw new Error(
+    `Unknown Topolo environment "${value}". Expected production, staging, development, or local.`
+  );
+}
+function selectedEnvironment() {
+  return normalizeEnvironment(process.env.TOPOLO_ENV);
+}
+function envVarPrefix(environment) {
+  if (environment === "production") return "TOPOLO_PRODUCTION";
+  if (environment === "staging") return "TOPOLO_STAGING";
+  if (environment === "development") return "TOPOLO_DEVELOPMENT";
+  return "TOPOLO_LOCAL";
+}
+function profileForEnvironment(config, environment = selectedEnvironment()) {
+  const profile = config.profiles?.[environment] ?? {};
+  if (environment === "production") {
+    return {
+      credential: config.credential,
+      oauthClientId: config.oauthClientId,
+      ...profile,
+      serviceUrls: {
+        ...config.serviceUrls ?? {},
+        ...profile.serviceUrls ?? {}
+      },
+      agentName: profile.agentName ?? config.agentName
+    };
+  }
+  return profile;
+}
+function writeProfileConfig(config, environment, profile) {
+  const profiles = { ...config.profiles ?? {} };
+  profiles[environment] = {
+    ...profiles[environment] ?? {},
+    ...profile
+  };
+  return { ...config, profiles };
+}
+async function resolveCredential(environment = selectedEnvironment()) {
+  const prefix = envVarPrefix(environment);
+  const apiKey = process.env[`${prefix}_API_KEY`] ?? process.env.TOPOLO_API_KEY;
   if (apiKey) return { kind: "api_key", apiKey };
-  const accessToken = process.env.TOPOLO_ACCESS_TOKEN;
+  const accessToken = process.env[`${prefix}_ACCESS_TOKEN`] ?? process.env.TOPOLO_ACCESS_TOKEN;
   if (accessToken) return { kind: "access_token", accessToken };
-  return null;
+  const config = await readConfig();
+  return profileForEnvironment(config, environment).credential ?? null;
+}
+var REFRESH_SKEW_SECONDS = 60;
+async function refreshCredentialIfNeeded(environment = selectedEnvironment()) {
+  const prefix = envVarPrefix(environment);
+  if (process.env[`${prefix}_API_KEY`] || process.env[`${prefix}_ACCESS_TOKEN`] || process.env.TOPOLO_API_KEY || process.env.TOPOLO_ACCESS_TOKEN) {
+    return resolveCredential(environment);
+  }
+  const config = await readConfig();
+  const profile = profileForEnvironment(config, environment);
+  const cred = profile.credential;
+  if (!cred || cred.kind !== "access_token") return cred ?? null;
+  if (!cred.refreshToken || !cred.expiresAt || !profile.oauthClientId) return cred;
+  const now = Math.floor(Date.now() / 1e3);
+  if (cred.expiresAt - REFRESH_SKEW_SECONDS > now) return cred;
+  try {
+    const oauth = new TopoloOAuth({
+      serviceUrls: resolveServiceUrls(profile.serviceUrls, environment)
+    });
+    const tokens = await oauth.refreshToken({
+      clientId: profile.oauthClientId,
+      refreshToken: cred.refreshToken
+    });
+    const refreshed = {
+      kind: "access_token",
+      accessToken: tokens.access_token,
+      ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: cred.refreshToken },
+      expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
+    };
+    await writeConfig(
+      environment === "production" && !config.profiles?.production ? { ...config, credential: refreshed } : writeProfileConfig(config, environment, { credential: refreshed })
+    );
+    return refreshed;
+  } catch {
+    return cred;
+  }
+}
+function resolveAgentName(configAgentName) {
+  return process.env.TOPOLO_AGENT_NAME ?? configAgentName;
 }
-function resolveServiceUrlsFromEnv() {
-  const out = {};
+function resolveServiceUrls(configUrls, environment = selectedEnvironment()) {
+  const merged = {
+    ...ENVIRONMENT_DEFAULT_SERVICE_URLS[environment],
+    ...configUrls ?? {}
+  };
+  const prefix = `${envVarPrefix(environment)}_SERVICE_URL_`;
+  for (const [k, v] of Object.entries(process.env)) {
+    if (k.startsWith(prefix) && v) {
+      merged[k.slice(prefix.length).toLowerCase()] = v;
+    }
+  }
   for (const [k, v] of Object.entries(process.env)) {
     if (k.startsWith("TOPOLO_SERVICE_URL_") && v) {
-      out[k.slice("TOPOLO_SERVICE_URL_".length).toLowerCase()] = v;
+      merged[k.slice("TOPOLO_SERVICE_URL_".length).toLowerCase()] = v;
     }
   }
-  return Object.keys(out).length > 0 ? out : void 0;
+  return Object.keys(merged).length > 0 ? merged : void 0;
+}
+
+// src/auth.ts
+function resolveCredentialFromEnv() {
+  const apiKey = process.env.TOPOLO_API_KEY;
+  if (apiKey) return { kind: "api_key", apiKey };
+  const accessToken = process.env.TOPOLO_ACCESS_TOKEN;
+  if (accessToken) return { kind: "access_token", accessToken };
+  return null;
 }
 
 // src/server.ts
@@ -2806,13 +3139,13 @@ function hasScope(set, required) {
   if (set.permissions.includes("*")) return true;
   const [servicePart, actionPart] = splitPermission(required);
   if (!servicePart) return set.permissions.includes(required);
-  const [serviceId, resource] = splitService(servicePart);
+  const [appId, resource] = splitService(servicePart);
   const candidates = new Set([
     required,
     "*",
-    serviceId ? `${serviceId}.*` : null,
-    serviceId && resource && actionPart ? `${serviceId}.${resource}:*` : null,
-    serviceId && resource && actionPart ? `${serviceId}.${resource}.${actionPart}` : null,
+    appId ? `${appId}.*` : null,
+    appId && resource && actionPart ? `${appId}.${resource}:*` : null,
+    appId && resource && actionPart ? `${appId}.${resource}.${actionPart}` : null,
     resource && actionPart ? `${resource}:*` : null,
     resource && actionPart ? `${resource}.${actionPart}` : null,
     resource && actionPart ? `${resource}:${actionPart}` : null
@@ -2864,10 +3197,10 @@ var TOOLS = [
     },
     handler: async (topolo) => {
       const services = (await topolo.client.listServices()).map((entry) => {
-        const id = displayServiceId(entry);
+        const id = displayAppId(entry);
         return {
           id,
-          serviceId: entry.serviceId,
+          appId: entry.appId,
           slug: entry.slug,
           name: entry.name,
           apiBaseUrl: entry.apiBaseUrl,
@@ -2894,7 +3227,7 @@ var TOOLS = [
       properties: {
         service: {
           type: "string",
-          description: "Optional service id, slug, or name filter."
+          description: "Optional app id, slug, or name filter."
         }
       },
       additionalProperties: false
@@ -2923,7 +3256,7 @@ var TOOLS = [
   {
     name: "topolo_get_application",
     title: "Describe one Topolo platform application",
-    description: "Returns one live application catalog entry (service id, slug, name, API URL, launch URL, status). Accepts the service id, slug, or name. Resolved against the live registry so newly-registered apps work without a client rebuild.",
+    description: "Returns one live application catalog entry (app id, slug, name, API URL, launch URL, status). Accepts the app id, slug, or name. Resolved against the live registry so newly-registered apps work without a client rebuild.",
     requiredScopes: [],
     destructive: false,
     inputSchema: {
@@ -2931,7 +3264,7 @@ var TOOLS = [
       properties: {
         application: {
           type: "string",
-          description: "Application identifier: service id, slug, or name from topolo_list_applications."
+          description: "Application identifier: app id, slug, or name from topolo_list_applications."
         }
       },
       required: ["application"],
@@ -2945,10 +3278,10 @@ var TOOLS = [
       const needle = application.trim().toLowerCase();
       const catalog = await topolo.client.listServices();
       const match = catalog.find(
-        (e) => e.serviceId.toLowerCase() === needle || e.slug && e.slug.toLowerCase() === needle || e.name && e.name.toLowerCase() === needle
+        (e) => e.appId.toLowerCase() === needle || e.slug && e.slug.toLowerCase() === needle || e.name && e.name.toLowerCase() === needle
       );
       if (!match) {
-        const known = catalog.map((e) => e.slug || e.serviceId).sort().filter((value) => typeof value === "string" && value.length > 0);
+        const known = catalog.map((e) => e.slug || e.appId).sort().filter((value) => typeof value === "string" && value.length > 0);
         throw new Error(
           `Unknown application "${application}". ${formatKnownValues(known, "applications")}`
         );
@@ -3041,7 +3374,7 @@ var TOOLS = [
   {
     name: "topolo_api_call",
     title: "Call any Topolo platform service",
-    description: "Low-level passthrough to any Topolo service. Use when no domain-specific tool exists for the operation you need. The request is signed with the current credential and scoped to the caller's organization \u2014 the target service will return 403 if your scopes do not permit the operation, even though this tool is advertised. Mutating calls (non-GET methods) require confirm:true. Call topolo_list_services first to discover callable service IDs; the SDK can also resolve live Auth-catalog service ids/slugs for newly registered API surfaces.",
+    description: "Low-level passthrough to any Topolo service. Use when no domain-specific tool exists for the operation you need. The request is signed with the current credential and scoped to the caller's organization \u2014 the target service will return 403 if your scopes do not permit the operation, even though this tool is advertised. Mutating calls (non-GET methods) require confirm:true. Call topolo_list_services first to discover callable app IDs; the SDK can also resolve live Auth-catalog app ids/slugs for newly registered API surfaces.",
     requiredScopes: [],
     destructive: true,
     inputSchema: {
@@ -3049,7 +3382,7 @@ var TOOLS = [
       properties: {
         service: {
           type: "string",
-          description: "Target service ID from the platform registry."
+          description: "Target app ID from the platform registry."
         },
         method: {
           type: "string",
@@ -3154,7 +3487,7 @@ function actionsToToolDefs(actions) {
   }));
 }
 function toolNameForAction(action) {
-  const service = (action.serviceSlug || action.serviceId || "service").replace(/^topolo-/, "").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  const service = (action.appSlug || action.appId || "service").replace(/^topolo-/, "").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
   const name = action.name.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
   return ["topolo", service, name].filter(Boolean).join("_").slice(0, 96);
 }
@@ -3215,18 +3548,18 @@ function statusesAtOrWorse(threshold) {
   if (threshold === "needs_review") return ["missing", "needs_review"];
   return ["missing", "needs_review", "partial"];
 }
-function displayServiceId(entry) {
-  for (const value of [entry.slug, entry.name, entry.serviceId]) {
+function displayAppId(entry) {
+  for (const value of [entry.slug, entry.name, entry.appId]) {
     if (typeof value !== "string" || !value.trim()) continue;
-    for (const candidate of serviceIdCandidates(value)) {
-      if (Object.prototype.hasOwnProperty.call(DEFAULT_SERVICE_URLS, candidate)) {
+    for (const candidate of appIdCandidates(value)) {
+      if (Object.prototype.hasOwnProperty.call(DEFAULT_APP_URLS, candidate)) {
         return candidate;
       }
     }
   }
-  return serviceIdCandidates(entry.slug || entry.serviceId)[0] || entry.serviceId;
+  return appIdCandidates(entry.slug || entry.appId)[0] || entry.appId;
 }
-function serviceIdCandidates(value) {
+function appIdCandidates(value) {
   const normalized = value.trim().toLowerCase().replace(/\s+/g, "-");
   const withoutTopolo = normalized.startsWith("topolo-") ? normalized.slice("topolo-".length) : normalized;
   return [.../* @__PURE__ */ new Set([
@@ -3245,14 +3578,14 @@ function formatKnownValues(values, label) {
 
 // src/version.ts
 import { readFileSync } from "fs";
-import { dirname, join } from "path";
+import { dirname as dirname2, join as join2 } from "path";
 import { fileURLToPath } from "url";
 function readMcpVersion() {
   try {
-    const here = dirname(fileURLToPath(import.meta.url));
+    const here = dirname2(fileURLToPath(import.meta.url));
     const candidates = [
-      join(here, "package.json"),
-      join(here, "..", "package.json")
+      join2(here, "package.json"),
+      join2(here, "..", "package.json")
     ];
     for (const path of candidates) {
       try {
@@ -3331,15 +3664,21 @@ function toolError(message) {
 
 // src/index.ts
 async function main() {
-  const credential = resolveCredentialFromEnv();
+  const environment = normalizeEnvironment(process.env.TOPOLO_ENV);
+  let credential = resolveCredentialFromEnv();
+  if (!credential) {
+    credential = await refreshCredentialIfNeeded(environment);
+  }
   if (!credential) {
     process.stderr.write(
-      "TopoloMCP: TOPOLO_API_KEY or TOPOLO_ACCESS_TOKEN must be set in the environment.\n"
+      "TopoloMCP: no Topolo credential. Run `topolo auth login`, or set TOPOLO_API_KEY / TOPOLO_ACCESS_TOKEN.\n"
     );
     process.exit(1);
   }
-  const agentName = process.env.TOPOLO_AGENT_NAME;
-  const serviceUrls = resolveServiceUrlsFromEnv();
+  const config = await readConfig();
+  const profile = profileForEnvironment(config, environment);
+  const agentName = resolveAgentName(profile.agentName);
+  const serviceUrls = resolveServiceUrls(profile.serviceUrls, environment);
   const topolo = createTopolo({
     credential,
     agent: {
@@ -3356,7 +3695,7 @@ async function main() {
   await server.connect(transport);
   const toolNames = await advertisedToolNames(topolo, scopes);
   process.stderr.write(
-    `TopoloMCP v${MCP_VERSION} connected. Tools available: ${toolNames.join(", ") || "(none)"}
+    `TopoloMCP v${MCP_VERSION} connected (${environment}). Tools available: ${toolNames.join(", ") || "(none)"}
 `
   );
 }