@topolo/sdk 0.1.2 → 0.2.2

package/dist/index.js

@@ -56,18 +56,1209 @@ var TopoloHttpError = class extends TopoloSdkError {
   }
 };
 
-// src/services.ts
-var DEFAULT_SERVICE_URLS = {
+// src/services.generated.ts
+var SERVICES = {
+  agent: "https://topolo-agent-worker.topolo.workers.dev",
   auth: "https://auth.topolo.app",
-  crm: "https://topolo-crm-worker.topolo.workers.dev"
+  bugfix: "https://bugfix.topolo.app",
+  bytes: "https://r2-media-manager-worker.topolo.workers.dev",
+  calendar: "https://calendar.topolo.app",
+  chat: "https://chat.topolo.app",
+  commerce: "https://topolo-commerce-api.topolo.workers.dev",
+  crm: "https://crm-api.topolo.app",
+  forecast: "https://forecast-worker-production.topolo.workers.dev",
+  learn: "https://topololearn-api.topolo.workers.dev",
+  mail: "https://mail.topolo.app",
+  mdm: "https://topolo-mdm-api.topolo.app",
+  messaging: "https://messages.topolo.app",
+  nexus: "https://topolo-nexus-gateway.topolo.workers.dev",
+  one: "https://topoloone-worker.topolo.workers.dev",
+  pay: "https://topolo-pay.topolo.workers.dev",
+  "quro.api": "https://api.ol0.me",
+  "quro.redirect": "https://ol0.me",
+  roadmapper: "https://roadmapper-api.topolo.app",
+  social_studio: "https://topolo-social-studio-api.topolo.workers.dev",
+  socialize: "https://socialize-prod-api.topolo.workers.dev",
+  support: "https://support.topolo.app",
+  web: "https://web-api.topolo.app"
 };
 var PLATFORM_SERVICE_IDS = {
   crm: "srv_iCwM4jGXcwlj"
 };
+
+// src/applications.generated.ts
+var APPLICATIONS = {
+  "admin": {
+    "id": "admin",
+    "appDir": "TopoloAdmin",
+    "name": "topoloadmin",
+    "packageName": "topolo-admin",
+    "productionUrl": "https://admin.topolo.app",
+    "services": [],
+    "deployTargets": [
+      {
+        "name": "topoloadmin",
+        "kind": "pages",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
+      }
+    ]
+  },
+  "agent": {
+    "id": "agent",
+    "appDir": "TopoloAgent",
+    "name": "topolo-agent",
+    "packageName": "topolo-agent",
+    "productionUrl": "https://agent.topolo.app",
+    "services": [
+      "agent"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-agent",
+        "kind": "pages",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
+      },
+      {
+        "name": "topolo-agent-worker",
+        "kind": "worker",
+        "apiUrl": "https://topolo-agent-worker.topolo.workers.dev",
+        "domains": [],
+        "routes": [],
+        "serviceId": "agent"
+      }
+    ]
+  },
+  "auth": {
+    "id": "auth",
+    "appDir": "TopoloAuth",
+    "name": "topolo-auth",
+    "packageName": "topolo-auth",
+    "productionUrl": "https://auth.topolo.app/login",
+    "services": [
+      "auth"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-auth",
+        "kind": "worker",
+        "apiUrl": "https://auth.topolo.app",
+        "domains": [
+          "auth.topolo.app"
+        ],
+        "routes": [
+          "auth.topolo.app"
+        ],
+        "serviceId": "auth"
+      }
+    ]
+  },
+  "bugfix": {
+    "id": "bugfix",
+    "appDir": "TopoloBugFix",
+    "name": "topolo-bugfix",
+    "packageName": "topolo-bugfix",
+    "productionUrl": "https://bugfix.topolo.app",
+    "services": [
+      "bugfix"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-bugfix",
+        "kind": "worker",
+        "apiUrl": "https://bugfix.topolo.app",
+        "domains": [
+          "bugfix.topolo.app"
+        ],
+        "routes": [
+          "bugfix.topolo.app"
+        ],
+        "serviceId": "bugfix"
+      }
+    ]
+  },
+  "bytes": {
+    "id": "bytes",
+    "appDir": "TopoloBytes",
+    "name": "topolo-bytes",
+    "packageName": "topolo-bytes",
+    "productionUrl": "https://bytes.topolo.app",
+    "services": [
+      "bytes"
+    ],
+    "deployTargets": [
+      {
+        "name": "bytes",
+        "kind": "pages",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
+      },
+      {
+        "name": "r2-media-manager-worker",
+        "kind": "worker",
+        "apiUrl": "https://r2-media-manager-worker.topolo.workers.dev",
+        "domains": [],
+        "routes": [],
+        "serviceId": "bytes"
+      }
+    ]
+  },
+  "calendar": {
+    "id": "calendar",
+    "appDir": "TopoloCalendar",
+    "name": "topolo-calendar",
+    "packageName": "topolo-calendar",
+    "productionUrl": "https://calendar.topolo.app",
+    "services": [
+      "calendar"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-calendar",
+        "kind": "worker",
+        "apiUrl": "https://calendar.topolo.app",
+        "domains": [
+          "calendar.topolo.app"
+        ],
+        "routes": [
+          "calendar.topolo.app"
+        ],
+        "serviceId": "calendar"
+      }
+    ]
+  },
+  "chat": {
+    "id": "chat",
+    "appDir": "TopoloChat",
+    "name": "topolo-chat",
+    "packageName": "topolo-chat",
+    "productionUrl": "https://chat.topolo.app",
+    "services": [
+      "chat"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-chat",
+        "kind": "worker",
+        "apiUrl": "https://chat.topolo.app",
+        "domains": [
+          "chat.topolo.app"
+        ],
+        "routes": [
+          "chat.topolo.app"
+        ],
+        "serviceId": "chat"
+      }
+    ]
+  },
+  "cli": {
+    "id": "cli",
+    "appDir": "TopoloCli",
+    "name": "@topolo/cli",
+    "packageName": "@topolo/cli",
+    "productionUrl": null,
+    "services": [],
+    "deployTargets": []
+  },
+  "cloudcontrol": {
+    "id": "cloudcontrol",
+    "appDir": "TopoloCloudControl",
+    "name": "topolo-cloudcontrol",
+    "packageName": "topolo-cloudcontrol",
+    "productionUrl": null,
+    "services": [],
+    "deployTargets": []
+  },
+  "commerce": {
+    "id": "commerce",
+    "appDir": "TopoloCommerce",
+    "name": "topolo-commerce",
+    "packageName": "topolo-commerce",
+    "productionUrl": "https://commerce.topolo.app",
+    "services": [
+      "commerce"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-commerce-api",
+        "kind": "worker",
+        "apiUrl": "https://topolo-commerce-api.topolo.workers.dev",
+        "domains": [
+          "topolo-commerce-api.topolo.workers.dev"
+        ],
+        "routes": [],
+        "serviceId": "commerce"
+      },
+      {
+        "name": "topolo-commerce-guest-web",
+        "kind": "pages",
+        "apiUrl": null,
+        "domains": [
+          "guest.topolo.app",
+          "topolo-commerce-guest-web.pages.dev"
+        ],
+        "routes": [],
+        "serviceId": null
+      },
+      {
+        "name": "topolo-commerce-ops-web",
+        "kind": "pages",
+        "apiUrl": null,
+        "domains": [
+          "commerce.topolo.app",
+          "topolo-commerce-ops-web.pages.dev"
+        ],
+        "routes": [],
+        "serviceId": null
+      },
+      {
+        "name": "topolo-commerce-station-web",
+        "kind": "pages",
+        "apiUrl": null,
+        "domains": [
+          "station-commerce.topolo.app",
+          "topolo-commerce-station-web.pages.dev"
+        ],
+        "routes": [],
+        "serviceId": null
+      }
+    ]
+  },
+  "crm": {
+    "id": "crm",
+    "appDir": "TopoloCRM",
+    "name": "topolo-crm",
+    "packageName": "topolo-crm",
+    "productionUrl": "https://crm.topolo.app",
+    "services": [
+      "crm"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-crm-frontend",
+        "kind": "pages",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
+      },
+      {
+        "name": "topolo-crm-worker",
+        "kind": "worker",
+        "apiUrl": "https://crm-api.topolo.app",
+        "domains": [],
+        "routes": [],
+        "serviceId": "crm"
+      }
+    ]
+  },
+  "developers": {
+    "id": "developers",
+    "appDir": "TopoloDevelopers",
+    "name": "topolo-developers",
+    "packageName": "topolo-developers",
+    "productionUrl": "https://developers.topolo.app",
+    "services": [],
+    "deployTargets": [
+      {
+        "name": "topolo-developers",
+        "kind": "pages",
+        "apiUrl": null,
+        "domains": [
+          "developers.topolo.app"
+        ],
+        "routes": [],
+        "serviceId": null
+      }
+    ]
+  },
+  "docs": {
+    "id": "docs",
+    "appDir": "TopoloDocs",
+    "name": "topolo-docs",
+    "packageName": "topolo-docs",
+    "productionUrl": "https://docs.topolo.app",
+    "services": [],
+    "deployTargets": [
+      {
+        "name": "topolo-docs",
+        "kind": "pages",
+        "apiUrl": null,
+        "domains": [
+          "docs.topolo.app"
+        ],
+        "routes": [],
+        "serviceId": null
+      }
+    ]
+  },
+  "feed": {
+    "id": "feed",
+    "appDir": "TopoloFeed",
+    "name": "TopoloFeed",
+    "packageName": null,
+    "productionUrl": null,
+    "services": [],
+    "deployTargets": [
+      {
+        "name": "topolo-feed-analytics-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
+      },
+      {
+        "name": "topolo-feed-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
+      }
+    ]
+  },
+  "forecast": {
+    "id": "forecast",
+    "appDir": "TopoloForecast",
+    "name": "forecast-cloud",
+    "packageName": "topolo-forecast",
+    "productionUrl": "https://forecast.topolo.app",
+    "services": [
+      "forecast"
+    ],
+    "deployTargets": [
+      {
+        "name": "forecast",
+        "kind": "pages",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
+      },
+      {
+        "name": "forecast-worker-production",
+        "kind": "worker",
+        "apiUrl": "https://forecast-worker-production.topolo.workers.dev",
+        "domains": [],
+        "routes": [],
+        "serviceId": "forecast"
+      }
+    ]
+  },
+  "learn": {
+    "id": "learn",
+    "appDir": "TopoloLearn",
+    "name": "topololearn",
+    "packageName": "topolo-learn",
+    "productionUrl": "https://learn.topolo.app",
+    "services": [
+      "learn"
+    ],
+    "deployTargets": [
+      {
+        "name": "topololearn",
+        "kind": "pages",
+        "apiUrl": null,
+        "domains": [
+          "learn.topolo.app"
+        ],
+        "routes": [],
+        "serviceId": null
+      },
+      {
+        "name": "topololearn-api",
+        "kind": "worker",
+        "apiUrl": "https://topololearn-api.topolo.workers.dev",
+        "domains": [
+          "topololearn-api.topolo.workers.dev"
+        ],
+        "routes": [],
+        "serviceId": "learn"
+      }
+    ]
+  },
+  "mail": {
+    "id": "mail",
+    "appDir": "TopoloMail",
+    "name": "topolo-mail",
+    "packageName": "topolo-mail",
+    "productionUrl": "https://mail.topolo.app",
+    "services": [
+      "mail"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-mail",
+        "kind": "workers",
+        "apiUrl": "https://mail.topolo.app",
+        "domains": [
+          "mail.topolo.app"
+        ],
+        "routes": [
+          "mail.topolo.app"
+        ],
+        "serviceId": "mail"
+      }
+    ]
+  },
+  "mcp": {
+    "id": "mcp",
+    "appDir": "TopoloMCP",
+    "name": "@topolo/mcp",
+    "packageName": "@topolo/mcp",
+    "productionUrl": null,
+    "services": [],
+    "deployTargets": []
+  },
+  "mdm": {
+    "id": "mdm",
+    "appDir": "TopoloMDM",
+    "name": "TopoloMDM",
+    "packageName": null,
+    "productionUrl": "https://mdm.topolo.app",
+    "services": [
+      "mdm"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-mdm-api",
+        "kind": "worker",
+        "apiUrl": "https://topolo-mdm-api.topolo.app",
+        "domains": [
+          "topolo-mdm-api.topolo.app"
+        ],
+        "routes": [
+          "topolo-mdm-api.topolo.app"
+        ],
+        "serviceId": "mdm"
+      },
+      {
+        "name": "topolo-mdm-console",
+        "kind": "pages",
+        "apiUrl": null,
+        "domains": [
+          "mdm.topolo.app",
+          "topolo-mdm-console.pages.dev"
+        ],
+        "routes": [
+          "mdm.topolo.app"
+        ],
+        "serviceId": null
+      }
+    ]
+  },
+  "messaging": {
+    "id": "messaging",
+    "appDir": "TopoloMessaging",
+    "name": "topolo-messaging",
+    "packageName": "topolo-messaging",
+    "productionUrl": "https://messages.topolo.app",
+    "services": [
+      "messaging"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-messaging",
+        "kind": "workers",
+        "apiUrl": "https://messages.topolo.app",
+        "domains": [
+          "messages.topolo.app"
+        ],
+        "routes": [],
+        "serviceId": "messaging"
+      },
+      {
+        "name": "topolo-messaging-dispatch",
+        "kind": "workers",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
+      }
+    ]
+  },
+  "nexus": {
+    "id": "nexus",
+    "appDir": "TopoloNexus",
+    "name": "topolo-nexus",
+    "packageName": "topolo-nexus",
+    "productionUrl": "https://nexus.topolo.app",
+    "services": [
+      "nexus"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-nexus-dashboard",
+        "kind": "pages",
+        "apiUrl": null,
+        "domains": [
+          "nexus.topolo.app",
+          "topolo-nexus-dashboard.pages.dev"
+        ],
+        "routes": [],
+        "serviceId": null
+      },
+      {
+        "name": "topolo-nexus-gateway",
+        "kind": "worker",
+        "apiUrl": "https://topolo-nexus-gateway.topolo.workers.dev",
+        "domains": [
+          "topolo-nexus-gateway.topolo.workers.dev"
+        ],
+        "routes": [],
+        "serviceId": "nexus"
+      }
+    ]
+  },
+  "one": {
+    "id": "one",
+    "appDir": "TopoloOne",
+    "name": "topolo-oneclick-sso",
+    "packageName": "topolo-oneclick-sso",
+    "productionUrl": "https://one.topolo.app",
+    "services": [
+      "one"
+    ],
+    "deployTargets": [
+      {
+        "name": "ai-chat-rag",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [
+          "ai-chat-rag.topolo.workers.dev"
+        ],
+        "routes": [],
+        "serviceId": null
+      },
+      {
+        "name": "topoloone",
+        "kind": "pages",
+        "apiUrl": null,
+        "domains": [
+          "oneclick-dashboard.pages.dev"
+        ],
+        "routes": [],
+        "serviceId": null
+      },
+      {
+        "name": "topoloone-website",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [
+          "one.topolo.io"
+        ],
+        "routes": [],
+        "serviceId": null
+      },
+      {
+        "name": "topoloone-worker",
+        "kind": "worker",
+        "apiUrl": "https://topoloone-worker.topolo.workers.dev",
+        "domains": [],
+        "routes": [
+          "one.topolo.app/*"
+        ],
+        "serviceId": "one"
+      }
+    ]
+  },
+  "pay": {
+    "id": "pay",
+    "appDir": "TopoloPay",
+    "name": "topolo-pay",
+    "packageName": "topolo-pay",
+    "productionUrl": "https://pay.topolo.app",
+    "services": [
+      "pay"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-pay",
+        "kind": "worker",
+        "apiUrl": "https://topolo-pay.topolo.workers.dev",
+        "domains": [],
+        "routes": [],
+        "serviceId": "pay"
+      }
+    ]
+  },
+  "quro": {
+    "id": "quro",
+    "appDir": "TopoloQuro",
+    "name": "TopoloQuro",
+    "packageName": null,
+    "productionUrl": "https://quro.topolo.app",
+    "services": [
+      "quro.api",
+      "quro.redirect"
+    ],
+    "deployTargets": [
+      {
+        "name": "quro-api",
+        "kind": "worker",
+        "apiUrl": "https://api.ol0.me",
+        "domains": [],
+        "routes": [],
+        "serviceId": "quro.api"
+      },
+      {
+        "name": "quro-redirect-system",
+        "kind": "worker",
+        "apiUrl": "https://ol0.me",
+        "domains": [],
+        "routes": [
+          "ol0.me/*"
+        ],
+        "serviceId": "quro.redirect"
+      },
+      {
+        "name": "quro-ui",
+        "kind": "pages",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
+      }
+    ]
+  },
+  "roadmapper": {
+    "id": "roadmapper",
+    "appDir": "TopoloRoadmapper",
+    "name": "topolo-roadmapper",
+    "packageName": "topolo-roadmapper",
+    "productionUrl": "https://roadmapper.topolo.app",
+    "services": [
+      "roadmapper"
+    ],
+    "deployTargets": [
+      {
+        "name": "roadmapper",
+        "kind": "pages",
+        "apiUrl": null,
+        "domains": [
+          "roadmapper.topolo.app"
+        ],
+        "routes": [],
+        "serviceId": null
+      },
+      {
+        "name": "topolo-production-roadmapper",
+        "kind": "worker",
+        "apiUrl": "https://roadmapper-api.topolo.app",
+        "domains": [
+          "roadmapper-api.topolo.app"
+        ],
+        "routes": [],
+        "serviceId": "roadmapper"
+      }
+    ]
+  },
+  "social_studio": {
+    "id": "social_studio",
+    "appDir": "TopoloSocialStudio",
+    "name": "topolo-social-studio",
+    "packageName": "topolo-social-studio",
+    "productionUrl": "https://studio.topolo.app",
+    "services": [
+      "social_studio"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-social-studio",
+        "kind": "pages",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
+      },
+      {
+        "name": "topolo-social-studio-api",
+        "kind": "worker",
+        "apiUrl": "https://topolo-social-studio-api.topolo.workers.dev",
+        "domains": [],
+        "routes": [],
+        "serviceId": "social_studio"
+      },
+      {
+        "name": "topolo-social-studio-queue",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
+      }
+    ]
+  },
+  "socialize": {
+    "id": "socialize",
+    "appDir": "TopoloSocialize",
+    "name": "socialize",
+    "packageName": "topolo-socialize",
+    "productionUrl": "https://socialize.topolo.app",
+    "services": [
+      "socialize"
+    ],
+    "deployTargets": [
+      {
+        "name": "socialize",
+        "kind": "pages",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
+      },
+      {
+        "name": "socialize-prod-api",
+        "kind": "worker",
+        "apiUrl": "https://socialize-prod-api.topolo.workers.dev",
+        "domains": [],
+        "routes": [],
+        "serviceId": "socialize"
+      },
+      {
+        "name": "socialize-prod-scheduler",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
+      }
+    ]
+  },
+  "support": {
+    "id": "support",
+    "appDir": "TopoloSupport",
+    "name": "topolo-support",
+    "packageName": "topolo-support",
+    "productionUrl": "https://support.topolo.app",
+    "services": [
+      "support"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-support",
+        "kind": "workers",
+        "apiUrl": "https://support.topolo.app",
+        "domains": [
+          "support.topolo.app"
+        ],
+        "routes": [
+          "support.topolo.app/*"
+        ],
+        "serviceId": "support"
+      }
+    ]
+  },
+  "web": {
+    "id": "web",
+    "appDir": "TopoloWeb",
+    "name": "topoloweb",
+    "packageName": "topolo-web",
+    "productionUrl": "https://web.topolo.app",
+    "services": [
+      "web"
+    ],
+    "deployTargets": [
+      {
+        "name": "topoloweb-api",
+        "kind": "worker",
+        "apiUrl": "https://web-api.topolo.app",
+        "domains": [
+          "web-api.topolo.app"
+        ],
+        "routes": [],
+        "serviceId": "web"
+      },
+      {
+        "name": "topoloweb-runtime",
+        "kind": "worker",
+        "apiUrl": "https://sites.topolo.app",
+        "domains": [
+          "sites.topolo.app"
+        ],
+        "routes": [],
+        "serviceId": null
+      },
+      {
+        "name": "topoloweb-studio",
+        "kind": "pages",
+        "apiUrl": null,
+        "domains": [
+          "web.topolo.app"
+        ],
+        "routes": [],
+        "serviceId": null
+      }
+    ]
+  }
+};
+
+// src/application-requirements.ts
+var APPLICATION_REQUIREMENTS_VERSION = "2026-04-22.1";
+var APPLICATION_REQUIREMENTS = [
+  {
+    id: "platform-metadata",
+    title: "Register the application in platform metadata",
+    summary: "Every app must have a stable application ID, CloudControl metadata for deployed surfaces, and package metadata where code is shipped.",
+    appliesTo: ["all"],
+    evidence: [
+      "topolo.cloudcontrol.json exists for every deployed app surface",
+      "package.json names the package or app when the repo ships code",
+      "The SDK application catalog exposes the app through topolo apps and MCP discovery"
+    ],
+    implementation: [
+      "Add the app to the SDK application catalog generator before exposing it to agents",
+      "Keep production URLs, Worker names, Pages projects, routes, domains, and bindings current in CloudControl metadata",
+      "Do not leave a new Topolo* app directory without an explicit application ID"
+    ]
+  },
+  {
+    id: "canonical-docs",
+    title: "Update canonical docs with the code change",
+    summary: "TopoloDocs is the source of truth for application behavior, ownership, deployment shape, auth boundaries, and operations.",
+    appliesTo: ["all"],
+    evidence: [
+      "Matching system registry entry exists in TopoloDocs",
+      "Internal handbook coverage exists for the system",
+      "npm run validate passes in TopoloDocs when docs are touched"
+    ],
+    implementation: [
+      "Read the matching TopoloDocs system entry before coding",
+      "Update docs in the same change when behavior, API, auth, data ownership, deployment, or operations change",
+      "Update last_verified dates on touched canonical pages"
+    ]
+  },
+  {
+    id: "shared-auth-boundary",
+    title: "Use the shared Topolo auth boundary",
+    summary: "Applications must derive identity, organization, scopes, and service entitlement from TopoloAuth rather than inventing parallel auth state.",
+    appliesTo: ["browser", "api", "tooling", "agent_surface"],
+    evidence: [
+      "@topolo/auth-client or @topolo/auth-middleware is used where applicable",
+      "No public command, tool, or SDK method accepts orgId",
+      "Service slug and Auth service registration are documented for protected services"
+    ],
+    implementation: [
+      "Use shared auth packages instead of copying token parsing or browser storage flows",
+      "Derive organization from the credential on every request",
+      "Route OAuth, refresh, logout, and SSO paths according to the shared Auth contract"
+    ]
+  },
+  {
+    id: "shared-shell-and-launcher",
+    title: "Use the shared shell, launcher, and account menu",
+    summary: "Browser applications should feel like one platform and should not create isolated navigation or account surfaces.",
+    appliesTo: ["browser"],
+    evidence: [
+      "@topolo/ui-kit is used for the platform shell where the app has authenticated UI",
+      "The shared launcher/app switcher is reachable from authenticated app chrome",
+      "Account menu and sign-out behavior use the shared platform affordance"
+    ],
+    implementation: [
+      "Use TopoloShell or the current shared shell contract for authenticated app layouts",
+      "Use shared design tokens and platform UI primitives before creating local equivalents",
+      "Keep mobile and desktop shell behavior aligned with the platform UI kit"
+    ]
+  },
+  {
+    id: "service-registration-and-scopes",
+    title: "Register protected APIs as platform services",
+    summary: "Callable app APIs need a stable service ID, service slug, permissions, role bundles, and API-key scopes before agents or users rely on them.",
+    appliesTo: ["api"],
+    evidence: [
+      "Auth service catalog contains the service ID and slug",
+      "Permissions, role bundles, and API-key scopes exist for the service",
+      "SDK, CLI, and MCP service discovery include the callable production API"
+    ],
+    implementation: [
+      "Add production Worker api_url metadata before adding an SDK service ID",
+      "Expose stable service IDs through DEFAULT_SERVICE_URLS",
+      "Keep typed SDK/CLI/MCP surfaces in sync when an API contract stabilizes"
+    ]
+  },
+  {
+    id: "organization-scoped-data",
+    title: "Keep application data organization-scoped",
+    summary: "Protected data access must be scoped by the authenticated organization at the backend boundary, not by client-provided hints.",
+    appliesTo: ["api"],
+    evidence: [
+      "Backend request handlers derive org membership from credential validation",
+      "Queries and Durable Object keys include the authenticated organization boundary where data is tenant-owned",
+      "MCP and CLI inputs do not include orgId overrides"
+    ],
+    implementation: [
+      "Reject or ignore organization hints supplied by clients",
+      "Bind SQL, KV, R2, queue, and Durable Object access to the authenticated organization",
+      "Document service-local exceptions explicitly in the system security assurance record"
+    ]
+  },
+  {
+    id: "cloudflare-deployment-contract",
+    title: "Keep Cloudflare deployment metadata complete",
+    summary: "Workers, Pages, bindings, routes, env vars, queues, cron triggers, and deployment commands must be discoverable through CloudControl metadata.",
+    appliesTo: ["browser", "api"],
+    evidence: [
+      "topolo.cloudcontrol.json lists production deploy targets and URLs",
+      "Wrangler/Pages configuration matches CloudControl metadata",
+      "Secrets and environment variables are not committed"
+    ],
+    implementation: [
+      "Update CloudControl metadata whenever deployment topology changes",
+      "Prefer Cloudflare-native runtime surfaces for new Topolo app infrastructure",
+      "Keep Worker bindings and Pages domains explicit enough for agents to inspect before deploying"
+    ]
+  },
+  {
+    id: "agent-and-operator-surfaces",
+    title: "Expose agent-safe operations through SDK, CLI, and MCP",
+    summary: "Agent-accessible functionality should be discoverable, scope-gated, and write-confirmed instead of hidden behind ad hoc HTTP calls.",
+    appliesTo: ["api", "tooling", "agent_surface"],
+    evidence: [
+      "Read operations have typed SDK/CLI/MCP surfaces once their contract stabilizes",
+      "Mutating generic calls require --confirm or confirm:true",
+      "MCP tools never accept orgId and advertise only appropriate scope-gated tools"
+    ],
+    implementation: [
+      "Add SDK types first, then CLI commands and MCP tools for durable workflows",
+      "Use generic API passthrough only as a temporary escape hatch",
+      "Keep command output JSON-stable for agents and human-readable with --no-json"
+    ]
+  },
+  {
+    id: "observability-and-audit",
+    title: "Emit platform audit and debugging signals",
+    summary: "Requests, agent actions, and operational workflows need traceable IDs, client labels, and useful failure evidence.",
+    appliesTo: ["api", "tooling", "agent_surface"],
+    evidence: [
+      "Requests carry X-Topolo-Client and X-Topolo-Request-Id where the SDK is involved",
+      "Agent-originated calls can include X-Topolo-Agent",
+      "Failure modes are documented with request IDs or deployment/log lookup paths"
+    ],
+    implementation: [
+      "Use TopoloClient for platform API calls rather than raw fetch where practical",
+      "Keep logs free of secrets and tokens",
+      "Document live smoke commands and request-id correlation in canonical docs"
+    ]
+  },
+  {
+    id: "verification-gates",
+    title: "Ship with build, test, docs, and smoke verification",
+    summary: "A Topolo app change is not complete until the relevant code checks and docs checks have been run or explicitly reported as blocked.",
+    appliesTo: ["all"],
+    evidence: [
+      "Relevant package build/typecheck/test commands pass",
+      "TopoloDocs validation passes when docs are touched",
+      "Live or local smoke evidence is captured for user-visible or API behavior"
+    ],
+    implementation: [
+      "Prefer existing package scripts before adding new tooling",
+      "Run app-specific checks and shared docs validation for behavior changes",
+      "Report any skipped verification with the blocker and residual risk"
+    ]
+  }
+];
+function applicationRequirementScopes(application) {
+  const scopes = /* @__PURE__ */ new Set(["all"]);
+  const hasBrowserSurface = Boolean(application.productionUrl) || application.deployTargets.some((target) => target.kind === "pages");
+  const hasApiSurface = application.services.length > 0 || application.deployTargets.some((target) => Boolean(target.apiUrl));
+  if (hasBrowserSurface) scopes.add("browser");
+  if (hasApiSurface) scopes.add("api");
+  if (application.id === "cli" || application.id === "mcp" || application.id === "cloudcontrol") {
+    scopes.add("tooling");
+  }
+  if (application.id === "cli" || application.id === "mcp" || hasApiSurface) {
+    scopes.add("agent_surface");
+  }
+  return Array.from(scopes);
+}
+function requirementsForApplication(applicationOrId) {
+  const application = typeof applicationOrId === "string" ? APPLICATIONS[applicationOrId] : applicationOrId;
+  const scopes = new Set(applicationRequirementScopes(application));
+  return APPLICATION_REQUIREMENTS.filter(
+    (requirement) => requirement.appliesTo.some((scope) => scopes.has(scope))
+  );
+}
+function auditApplicationRequirements(applicationOrId) {
+  const application = typeof applicationOrId === "string" ? APPLICATIONS[applicationOrId] : applicationOrId;
+  const scopes = applicationRequirementScopes(application);
+  const findings = requirementsForApplication(application).map(
+    (requirement) => evaluateRequirement(application, requirement)
+  );
+  return {
+    version: APPLICATION_REQUIREMENTS_VERSION,
+    application,
+    scopes,
+    score: scoreFindings(findings),
+    findings
+  };
+}
+function auditAllApplicationRequirements(applicationIds = Object.keys(APPLICATIONS).sort()) {
+  const applications = applicationIds.map(
+    (applicationId) => auditApplicationRequirements(applicationId)
+  );
+  const migrationQueue = applications.flatMap(
+    (audit) => audit.findings.filter((finding2) => finding2.status !== "met").map((finding2) => ({
+      applicationId: audit.application.id,
+      applicationName: audit.application.name,
+      requirementId: finding2.requirementId,
+      title: finding2.title,
+      status: finding2.status,
+      reason: finding2.reason,
+      nextActions: finding2.nextActions
+    }))
+  ).sort((a, b) => {
+    const statusOrder = statusRank(a.status) - statusRank(b.status);
+    if (statusOrder !== 0) return statusOrder;
+    const appOrder = a.applicationId.localeCompare(b.applicationId);
+    if (appOrder !== 0) return appOrder;
+    return a.requirementId.localeCompare(b.requirementId);
+  });
+  return {
+    version: APPLICATION_REQUIREMENTS_VERSION,
+    applications,
+    migrationQueue
+  };
+}
+function evaluateRequirement(application, requirement) {
+  const evidence = [];
+  switch (requirement.id) {
+    case "platform-metadata": {
+      if (application.packageName) evidence.push(`package=${application.packageName}`);
+      if (application.productionUrl) evidence.push(`productionUrl=${application.productionUrl}`);
+      if (application.deployTargets.length > 0) {
+        evidence.push(`deployTargets=${application.deployTargets.length}`);
+      }
+      if (application.services.length > 0) {
+        evidence.push(`services=${application.services.join(",")}`);
+      }
+      if (evidence.length === 0) {
+        return finding(requirement, "missing", "No package, production URL, deploy target, or service metadata is available.", evidence);
+      }
+      return finding(requirement, "met", "Catalog metadata exists for this application.", evidence);
+    }
+    case "canonical-docs":
+      return finding(
+        requirement,
+        "needs_review",
+        "Catalog metadata cannot verify matching TopoloDocs system and handbook coverage.",
+        evidence
+      );
+    case "shared-auth-boundary":
+      return finding(
+        requirement,
+        "needs_review",
+        "Catalog metadata cannot verify that implementation uses shared Topolo auth packages and derives org from credentials.",
+        evidence
+      );
+    case "shared-shell-and-launcher":
+      return finding(
+        requirement,
+        "needs_review",
+        "Catalog metadata cannot verify shared shell, launcher, and account menu adoption.",
+        evidence
+      );
+    case "service-registration-and-scopes": {
+      if (application.services.length > 0) {
+        evidence.push(`services=${application.services.join(",")}`);
+        return finding(
+          requirement,
+          "partial",
+          "SDK service discovery exists, but Auth catalog permissions, role bundles, and API-key scopes still need confirmation.",
+          evidence
+        );
+      }
+      return finding(requirement, "missing", "No SDK service ID is registered for this callable API surface.", evidence);
+    }
+    case "organization-scoped-data":
+      return finding(
+        requirement,
+        "needs_review",
+        "Catalog metadata cannot verify backend tenant filters, storage keys, or Durable Object boundaries.",
+        evidence
+      );
+    case "cloudflare-deployment-contract": {
+      if (application.deployTargets.length === 0) {
+        return finding(requirement, "missing", "No CloudControl deploy targets are registered.", evidence);
+      }
+      evidence.push(`deployTargets=${application.deployTargets.length}`);
+      if (application.productionUrl) evidence.push(`productionUrl=${application.productionUrl}`);
+      return finding(requirement, "met", "CloudControl deploy target metadata is present.", evidence);
+    }
+    case "agent-and-operator-surfaces": {
+      if (application.services.length > 0) {
+        evidence.push(`services=${application.services.join(",")}`);
+        return finding(requirement, "partial", "SDK service discovery exists; typed SDK/CLI/MCP workflow coverage should be checked as APIs stabilize.", evidence);
+      }
+      if (application.id === "cli" || application.id === "mcp" || application.id === "cloudcontrol") {
+        evidence.push(`tooling=${application.id}`);
+        return finding(requirement, "met", "This application is itself an agent/operator surface.", evidence);
+      }
+      return finding(requirement, "missing", "No SDK service or tooling surface is registered.", evidence);
+    }
+    case "observability-and-audit":
+      return finding(
+        requirement,
+        "needs_review",
+        "Catalog metadata cannot verify runtime request IDs, client labels, or log redaction.",
+        evidence
+      );
+    case "verification-gates":
+      return finding(
+        requirement,
+        "needs_review",
+        "Catalog metadata cannot verify package checks, docs validation, or smoke evidence.",
+        evidence
+      );
+    default:
+      return finding(requirement, "needs_review", "No automated evaluator exists for this requirement yet.", evidence);
+  }
+}
+function finding(requirement, status, reason, evidence) {
+  return {
+    requirementId: requirement.id,
+    title: requirement.title,
+    status,
+    reason,
+    evidence,
+    nextActions: status === "met" ? [] : requirement.implementation
+  };
+}
+function scoreFindings(findings) {
+  const met = findings.filter((finding2) => finding2.status === "met").length;
+  const partial = findings.filter((finding2) => finding2.status === "partial").length;
+  const missing = findings.filter((finding2) => finding2.status === "missing").length;
+  const needsReview = findings.filter((finding2) => finding2.status === "needs_review").length;
+  const total = findings.length;
+  const weighted = met + partial * 0.5;
+  return {
+    met,
+    partial,
+    missing,
+    needsReview,
+    total,
+    percent: total === 0 ? 100 : Math.round(weighted / total * 100)
+  };
+}
+function statusRank(status) {
+  if (status === "missing") return 0;
+  if (status === "partial") return 1;
+  return 2;
+}
+
+// src/services.ts
+var DEFAULT_SERVICE_URLS = SERVICES;
 function resolveServiceUrl(service, overrides) {
   const override = overrides?.[service];
   if (override) return override;
-  const envKey = `TOPOLO_SERVICE_URL_${service.toUpperCase()}`;
+  const envKey = `TOPOLO_SERVICE_URL_${service.replace(/\./g, "_").toUpperCase()}`;
   const envValue = typeof process !== "undefined" ? process.env?.[envKey] : void 0;
   if (envValue) return envValue;
   return DEFAULT_SERVICE_URLS[service];
@@ -420,6 +1611,9 @@ function createTopolo(options) {
   };
 }
 export {
+  APPLICATIONS,
+  APPLICATION_REQUIREMENTS,
+  APPLICATION_REQUIREMENTS_VERSION,
   CrmModule,
   DEFAULT_SERVICE_URLS,
   IdentityModule,
@@ -430,6 +1624,10 @@ export {
   TopoloOAuth,
   TopoloPermissionError,
   TopoloSdkError,
+  applicationRequirementScopes,
+  auditAllApplicationRequirements,
+  auditApplicationRequirements,
   createTopolo,
+  requirementsForApplication,
   resolveServiceUrl
 };