@topolo/sdk 0.11.1 → 0.11.2

package/dist/index.cjs

@@ -21,6 +21,9 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var index_exports = {};
 __export(index_exports, {
   ACTION_CATALOG_DIGEST_ALGORITHM: () => ACTION_CATALOG_DIGEST_ALGORITHM,
+  APPLICATIONS: () => APPLICATIONS,
+  APPLICATION_REQUIREMENTS: () => APPLICATION_REQUIREMENTS,
+  APPLICATION_REQUIREMENTS_VERSION: () => APPLICATION_REQUIREMENTS_VERSION,
   CrmModule: () => CrmModule,
   DEFAULT_APP_URLS: () => DEFAULT_APP_URLS,
   IdentityModule: () => IdentityModule,
@@ -39,7 +42,11 @@ __export(index_exports, {
   WorkspacesModule: () => WorkspacesModule,
   actionContractCompleteness: () => actionContractCompleteness,
   applicationEntryFromCatalog: () => applicationEntryFromCatalog,
+  applicationRequirementScopes: () => applicationRequirementScopes,
   assertTopoloServiceUrlEnvironment: () => assertTopoloServiceUrlEnvironment,
+  auditAllApplicationRequirements: () => auditAllApplicationRequirements,
+  auditApplicationEntries: () => auditApplicationEntries,
+  auditApplicationRequirements: () => auditApplicationRequirements,
   canonicalTopoloErrorCode: () => canonicalTopoloErrorCode,
   canonicalTopoloRequestId: () => canonicalTopoloRequestId,
   canonicalTopoloRequired: () => canonicalTopoloRequired,
@@ -68,6 +75,7 @@ __export(index_exports, {
   prepareTopoloActionBase64UploadInput: () => prepareTopoloActionBase64UploadInput,
   prepareTopoloActionUploadInput: () => prepareTopoloActionUploadInput,
   publicTopoloErrorMessage: () => publicTopoloErrorMessage,
+  requirementsForApplication: () => requirementsForApplication,
   resolveApplicationDirectoryEntry: () => resolveApplicationDirectoryEntry,
   resolveCatalogServiceUrl: () => resolveCatalogServiceUrl,
   resolveServiceUrl: () => resolveServiceUrl,
@@ -970,6 +978,18 @@ function prepareTopoloUrlSessionUploadInput(contractValue, byteLength, input, op
 function topoloUploadResponseValue(response, path) {
   return path.split(".").reduce((value, segment) => isRecord2(value) ? value[segment] : void 0, response);
 }
+function redactTopoloUrlSessionResult(response, uploadUrlPath) {
+  const redacted = cloneUploadValue(response);
+  let target = redacted;
+  const segments = uploadUrlPath.split(".");
+  for (const segment of segments.slice(0, -1)) {
+    target = isRecord2(target) ? target[segment] : void 0;
+  }
+  const finalSegment = segments.at(-1);
+  if (finalSegment && isRecord2(target) && finalSegment in target) target[finalSegment] = "[REDACTED]";
+  redactUploadHeaders(redacted);
+  return redacted;
+}
 function decodeTopoloActionBase64(contentBase64) {
   if (!isCanonicalBase64(contentBase64)) {
     throw new TopoloSdkError("invalid_upload_content", "Upload content must be canonical base64.");
@@ -988,6 +1008,28 @@ function mapUploadInput(contract, contentBase64, input, options) {
     [contract.fileNameField]: fileName
   };
 }
+function cloneUploadValue(value) {
+  if (Array.isArray(value)) return value.map(cloneUploadValue);
+  if (!isRecord2(value)) return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, cloneUploadValue(item)]));
+}
+function redactUploadHeaders(value) {
+  if (Array.isArray(value)) {
+    value.forEach(redactUploadHeaders);
+    return;
+  }
+  if (!isRecord2(value)) return;
+  for (const [key, item] of Object.entries(value)) {
+    if (key.toLowerCase() === "headers" && isRecord2(item)) {
+      for (const header of Object.keys(item)) {
+        if (["authorization", "cookie", "set-cookie", "proxy-authorization", "x-api-key"].includes(header.toLowerCase())) {
+          item[header] = "[REDACTED]";
+        }
+      }
+    }
+    redactUploadHeaders(item);
+  }
+}
 function validateUploadMetadata(contract, byteLength, options) {
   const fileName = options.fileName.trim();
   const contentType = options.contentType.trim().toLowerCase();
@@ -1631,7 +1673,7 @@ var TopoloClient = class _TopoloClient {
       throw new TopoloSdkError("invalid_upload_response", `Upload action response is missing ${contract.uploadUrlPath}.`);
     }
     await this.putUrlSessionContent(entry, uploadUrl, contract.uploadMethod, bytes, options);
-    if (!contract.complete) return initiation;
+    if (!contract.complete) return redactTopoloUrlSessionResult(initiation, contract.uploadUrlPath);
     const completionValue = topoloUploadResponseValue(initiation, contract.complete.responsePath);
     if (typeof completionValue !== "string" || !completionValue.trim()) {
       throw new TopoloSdkError("invalid_upload_response", `Upload action response is missing ${contract.complete.responsePath}.`);
@@ -2673,6 +2715,2140 @@ function actionContractCompleteness(action) {
   };
 }
 
+// src/applications-fallback.ts
+var APPLICATIONS = {
+  "admin": {
+    "id": "admin",
+    "appDir": "TopoloAdmin",
+    "name": "topolo-admin",
+    "packageName": "topolo-admin",
+    "productionUrl": "https://admin.topolo.app",
+    "services": [],
+    "deployTargets": [
+      {
+        "name": "topolo-admin",
+        "kind": "worker",
+        "apiUrl": "https://admin.topolo.app",
+        "domains": [
+          "admin.topolo.app"
+        ],
+        "routes": [
+          "admin.topolo.app"
+        ],
+        "appId": null
+      },
+      {
+        "name": "topolo-admin-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "agent": {
+    "id": "agent",
+    "appDir": "TopoloAgent",
+    "name": "topolo-agent",
+    "packageName": "topolo-agent",
+    "productionUrl": "https://agent.topolo.app",
+    "services": [
+      "agent"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-agent",
+        "kind": "worker",
+        "apiUrl": "https://agent.topolo.app",
+        "domains": [
+          "agent.topolo.app"
+        ],
+        "routes": [
+          "agent.topolo.app"
+        ],
+        "appId": "agent"
+      },
+      {
+        "name": "topolo-agent-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "auth": {
+    "id": "auth",
+    "appDir": "TopoloAuth",
+    "name": "topolo-auth",
+    "packageName": "topolo-auth",
+    "productionUrl": "https://auth.topolo.app",
+    "services": [
+      "auth"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-auth",
+        "kind": "worker",
+        "apiUrl": "https://auth.topolo.app",
+        "domains": [
+          "auth.topolo.app"
+        ],
+        "routes": [
+          "auth.topolo.app"
+        ],
+        "appId": "auth"
+      }
+    ]
+  },
+  "backup": {
+    "id": "backup",
+    "appDir": "TopoloBackup",
+    "name": "topolo-backup",
+    "packageName": "topolo-backup",
+    "productionUrl": "https://backup.topolo.app",
+    "services": [
+      "backup"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-backup",
+        "kind": "worker",
+        "apiUrl": "https://backup.topolo.app",
+        "domains": [
+          "backup.topolo.app"
+        ],
+        "routes": [
+          "backup.topolo.app"
+        ],
+        "appId": "backup"
+      }
+    ]
+  },
+  "blog": {
+    "id": "blog",
+    "appDir": "TopoloBlog",
+    "name": "topolo-blog",
+    "packageName": "topolo-blog",
+    "productionUrl": "https://blog.topolo.app",
+    "services": [
+      "blog"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-blog",
+        "kind": "worker",
+        "apiUrl": "https://blog.topolo.app",
+        "domains": [
+          "blog.topolo.app"
+        ],
+        "routes": [
+          "blog.topolo.app"
+        ],
+        "appId": "blog"
+      },
+      {
+        "name": "topolo-blog-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "books": {
+    "id": "books",
+    "appDir": "TopoloBooks",
+    "name": "topolo-books",
+    "packageName": "topolo-books",
+    "productionUrl": "https://books.topolo.app",
+    "services": [
+      "books"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-books",
+        "kind": "worker",
+        "apiUrl": "https://books.topolo.app",
+        "domains": [
+          "books.topolo.app"
+        ],
+        "routes": [
+          "books.topolo.app"
+        ],
+        "appId": "books"
+      },
+      {
+        "name": "topolo-books-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "brand": {
+    "id": "brand",
+    "appDir": "TopoloBrand",
+    "name": "topolo-brand",
+    "packageName": "@topolo/topolo-brand",
+    "productionUrl": "https://brand.topolo.app",
+    "services": [
+      "brand"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-brand",
+        "kind": "worker",
+        "apiUrl": "https://brand.topolo.app",
+        "domains": [
+          "brand.topolo.app"
+        ],
+        "routes": [
+          "brand.topolo.app"
+        ],
+        "appId": "brand"
+      },
+      {
+        "name": "topolo-brand-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "bugfix": {
+    "id": "bugfix",
+    "appDir": "TopoloBugFix",
+    "name": "topolo-bugfix",
+    "packageName": "topolo-bugfix",
+    "productionUrl": "https://bugfix.topolo.app",
+    "services": [
+      "bugfix"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-bugfix",
+        "kind": "worker",
+        "apiUrl": "https://bugfix.topolo.app",
+        "domains": [
+          "bugfix.topolo.app"
+        ],
+        "routes": [
+          "bugfix.topolo.app"
+        ],
+        "appId": "bugfix"
+      }
+    ]
+  },
+  "bytes": {
+    "id": "bytes",
+    "appDir": "TopoloBytes",
+    "name": "topolo-bytes",
+    "packageName": "topolo-bytes",
+    "productionUrl": "https://bytes.topolo.app",
+    "services": [
+      "bytes"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-bytes",
+        "kind": "worker",
+        "apiUrl": "https://bytes.topolo.app",
+        "domains": [
+          "bytes.topolo.app"
+        ],
+        "routes": [
+          "bytes.topolo.app"
+        ],
+        "appId": "bytes"
+      },
+      {
+        "name": "topolo-bytes-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "calendar": {
+    "id": "calendar",
+    "appDir": "TopoloCalendar",
+    "name": "topolo-calendar",
+    "packageName": "topolo-calendar",
+    "productionUrl": "https://calendar.topolo.app",
+    "services": [
+      "calendar"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-calendar",
+        "kind": "worker",
+        "apiUrl": "https://calendar.topolo.app",
+        "domains": [
+          "calendar.topolo.app"
+        ],
+        "routes": [
+          "calendar.topolo.app"
+        ],
+        "appId": "calendar"
+      },
+      {
+        "name": "topolo-calendar-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "campaigns": {
+    "id": "campaigns",
+    "appDir": "TopoloCampaigns",
+    "name": "topolo-campaigns",
+    "packageName": "topolo-campaigns",
+    "productionUrl": "https://campaigns.topolo.app",
+    "services": [
+      "campaigns"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-campaigns",
+        "kind": "worker",
+        "apiUrl": "https://campaigns.topolo.app",
+        "domains": [
+          "campaigns.topolo.app"
+        ],
+        "routes": [
+          "campaigns.topolo.app"
+        ],
+        "appId": "campaigns"
+      },
+      {
+        "name": "topolo-campaigns-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "capacity": {
+    "id": "capacity",
+    "appDir": "TopoloCapacity",
+    "name": "topolo-capacity",
+    "packageName": "topolo-capacity",
+    "productionUrl": "https://capacity.topolo.app",
+    "services": [
+      "capacity"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-capacity",
+        "kind": "worker",
+        "apiUrl": "https://capacity.topolo.app",
+        "domains": [
+          "capacity.topolo.app"
+        ],
+        "routes": [
+          "capacity.topolo.app"
+        ],
+        "appId": "capacity"
+      }
+    ]
+  },
+  "chat": {
+    "id": "chat",
+    "appDir": "TopoloChat",
+    "name": "topolo-chat",
+    "packageName": "topolo-chat",
+    "productionUrl": "https://chat.topolo.app",
+    "services": [
+      "chat"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-chat",
+        "kind": "worker",
+        "apiUrl": "https://chat.topolo.app",
+        "domains": [
+          "chat.topolo.app"
+        ],
+        "routes": [
+          "chat.topolo.app"
+        ],
+        "appId": "chat"
+      },
+      {
+        "name": "topolo-chat-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "commerce": {
+    "id": "commerce",
+    "appDir": "TopoloCommerce",
+    "name": "topolo-commerce",
+    "packageName": "topolo-commerce",
+    "productionUrl": "https://commerce.topolo.app",
+    "services": [
+      "commerce"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-commerce-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      },
+      {
+        "name": "topolo-commerce-guest-web",
+        "kind": "worker",
+        "apiUrl": "https://guest.topolo.app",
+        "domains": [
+          "guest.topolo.app"
+        ],
+        "routes": [
+          "guest.topolo.app"
+        ],
+        "appId": null
+      },
+      {
+        "name": "topolo-commerce-ops-web",
+        "kind": "worker",
+        "apiUrl": "https://commerce.topolo.app",
+        "domains": [
+          "commerce.topolo.app"
+        ],
+        "routes": [
+          "commerce.topolo.app"
+        ],
+        "appId": "commerce"
+      },
+      {
+        "name": "topolo-commerce-station-web",
+        "kind": "worker",
+        "apiUrl": "https://station-commerce.topolo.app",
+        "domains": [
+          "station-commerce.topolo.app"
+        ],
+        "routes": [
+          "station-commerce.topolo.app"
+        ],
+        "appId": null
+      }
+    ]
+  },
+  "compose": {
+    "id": "compose",
+    "appDir": "TopoloCompose",
+    "name": "topolo-compose",
+    "packageName": "@topolo/compose",
+    "productionUrl": "https://compose.topolo.app",
+    "services": [
+      "compose"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-compose",
+        "kind": "worker",
+        "apiUrl": "https://compose.topolo.app",
+        "domains": [
+          "compose.topolo.app"
+        ],
+        "routes": [
+          "compose.topolo.app"
+        ],
+        "appId": "compose"
+      },
+      {
+        "name": "topolo-compose-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "consent": {
+    "id": "consent",
+    "appDir": "TopoloConsent",
+    "name": "topolo-consent",
+    "packageName": "topolo-consent",
+    "productionUrl": "https://consent.topolo.app",
+    "services": [
+      "consent"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-consent",
+        "kind": "worker",
+        "apiUrl": "https://consent.topolo.app",
+        "domains": [
+          "consent.topolo.app"
+        ],
+        "routes": [
+          "consent.topolo.app"
+        ],
+        "appId": "consent"
+      },
+      {
+        "name": "topolo-consent-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "crm": {
+    "id": "crm",
+    "appDir": "TopoloCRM",
+    "name": "topolo-crm",
+    "packageName": "topolo-crm",
+    "productionUrl": "https://crm.topolo.app",
+    "services": [
+      "crm"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-crm-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      },
+      {
+        "name": "topolo-crm-app",
+        "kind": "worker",
+        "apiUrl": "https://crm.topolo.app",
+        "domains": [
+          "crm.topolo.app"
+        ],
+        "routes": [
+          "crm.topolo.app"
+        ],
+        "appId": "crm"
+      }
+    ]
+  },
+  "design": {
+    "id": "design",
+    "appDir": "TopoloDesign",
+    "name": "topolo-design",
+    "packageName": "@topolo-io/design",
+    "productionUrl": "https://design.topolo.app",
+    "services": [
+      "design"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-design",
+        "kind": "worker",
+        "apiUrl": "https://design.topolo.app",
+        "domains": [
+          "design.topolo.app"
+        ],
+        "routes": [
+          "design.topolo.app"
+        ],
+        "appId": "design"
+      },
+      {
+        "name": "topolo-design-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "developers": {
+    "id": "developers",
+    "appDir": "TopoloDevelopers",
+    "name": "topolo-developers",
+    "packageName": "topolo-developers",
+    "productionUrl": "https://developers.topolo.app",
+    "services": [
+      "developers"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-catalog-cron",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      },
+      {
+        "name": "topolo-developers",
+        "kind": "worker",
+        "apiUrl": "https://developers.topolo.app",
+        "domains": [
+          "developers.topolo.app"
+        ],
+        "routes": [
+          "developers.topolo.app"
+        ],
+        "appId": "developers"
+      },
+      {
+        "name": "topolo-developers-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "director": {
+    "id": "director",
+    "appDir": "TopoloDirector",
+    "name": "topolo-director",
+    "packageName": "topolo-director",
+    "productionUrl": "https://director.topolo.app",
+    "services": [
+      "director"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-director",
+        "kind": "worker",
+        "apiUrl": "https://director.topolo.app",
+        "domains": [
+          "director.topolo.app"
+        ],
+        "routes": [
+          "director.topolo.app"
+        ],
+        "appId": "director"
+      },
+      {
+        "name": "topolo-director-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "docs": {
+    "id": "docs",
+    "appDir": "TopoloDocs",
+    "name": "topolo-docs",
+    "packageName": "topolo-docs",
+    "productionUrl": "https://docs.topolo.app",
+    "services": [],
+    "deployTargets": [
+      {
+        "name": "topolo-docs",
+        "kind": "worker",
+        "apiUrl": "https://docs.topolo.app",
+        "domains": [
+          "docs.topolo.app"
+        ],
+        "routes": [
+          "docs.topolo.app"
+        ],
+        "appId": null
+      },
+      {
+        "name": "topolo-docs-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "feed": {
+    "id": "feed",
+    "appDir": "TopoloFeed",
+    "name": "TopoloFeed",
+    "packageName": "topolo-feed",
+    "productionUrl": "https://feed.topolo.app",
+    "services": [
+      "feed"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-feed-analytics-api",
+        "kind": "worker",
+        "apiUrl": "https://feed-analytics-api.topolo.app",
+        "domains": [
+          "feed-analytics-api.topolo.app"
+        ],
+        "routes": [
+          "feed-analytics-api.topolo.app"
+        ],
+        "appId": null
+      },
+      {
+        "name": "topolo-feed-api",
+        "kind": "worker",
+        "apiUrl": "https://feed-api.topolo.app",
+        "domains": [
+          "feed-api.topolo.app"
+        ],
+        "routes": [
+          "feed-api.topolo.app"
+        ],
+        "appId": null
+      },
+      {
+        "name": "topolo-feed-web",
+        "kind": "worker",
+        "apiUrl": "https://feed.topolo.app",
+        "domains": [
+          "feed.topolo.app"
+        ],
+        "routes": [
+          "feed.topolo.app"
+        ],
+        "appId": "feed"
+      }
+    ]
+  },
+  "flow": {
+    "id": "flow",
+    "appDir": "TopoloFlow",
+    "name": "topolo-flow",
+    "packageName": "topolo-flow",
+    "productionUrl": "https://flow.topolo.app",
+    "services": [
+      "flow"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-flow",
+        "kind": "worker",
+        "apiUrl": "https://flow.topolo.app",
+        "domains": [
+          "flow.topolo.app"
+        ],
+        "routes": [
+          "flow.topolo.app"
+        ],
+        "appId": "flow"
+      },
+      {
+        "name": "topolo-flow-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "forecast": {
+    "id": "forecast",
+    "appDir": "TopoloForecast",
+    "name": "topolo-forecast",
+    "packageName": "topolo-forecast",
+    "productionUrl": "https://forecast.topolo.app",
+    "services": [
+      "forecast"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-forecast",
+        "kind": "worker",
+        "apiUrl": "https://forecast.topolo.app",
+        "domains": [
+          "forecast.topolo.app"
+        ],
+        "routes": [
+          "forecast.topolo.app"
+        ],
+        "appId": "forecast"
+      },
+      {
+        "name": "topolo-forecast-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "forms": {
+    "id": "forms",
+    "appDir": "TopoloForms",
+    "name": "topolo-forms",
+    "packageName": "topolo-forms",
+    "productionUrl": "https://forms.topolo.app",
+    "services": [
+      "forms"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-forms",
+        "kind": "worker",
+        "apiUrl": "https://forms.topolo.app",
+        "domains": [
+          "forms.topolo.app"
+        ],
+        "routes": [
+          "forms.topolo.app"
+        ],
+        "appId": "forms"
+      },
+      {
+        "name": "topolo-forms-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "home": {
+    "id": "home",
+    "appDir": "TopoloHome",
+    "name": "topolo-home",
+    "packageName": "topolo-home",
+    "productionUrl": "https://home.topolo.app",
+    "services": [
+      "home"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-home",
+        "kind": "worker",
+        "apiUrl": "https://home.topolo.app",
+        "domains": [
+          "home.topolo.app"
+        ],
+        "routes": [
+          "home.topolo.app"
+        ],
+        "appId": "home"
+      },
+      {
+        "name": "topolo-home-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "insights": {
+    "id": "insights",
+    "appDir": "TopoloInsights",
+    "name": "topolo-insights",
+    "packageName": "topolo-insights",
+    "productionUrl": "https://insights.topolo.app",
+    "services": [
+      "insights"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-insights",
+        "kind": "worker",
+        "apiUrl": "https://insights.topolo.app",
+        "domains": [
+          "insights.topolo.app"
+        ],
+        "routes": [
+          "insights.topolo.app"
+        ],
+        "appId": "insights"
+      },
+      {
+        "name": "topolo-insights-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "inventory": {
+    "id": "inventory",
+    "appDir": "TopoloInventory",
+    "name": "topolo-inventory",
+    "packageName": "topolo-inventory",
+    "productionUrl": "https://inventory.topolo.app",
+    "services": [
+      "inventory"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-inventory",
+        "kind": "worker",
+        "apiUrl": "https://inventory.topolo.app",
+        "domains": [
+          "inventory.topolo.app"
+        ],
+        "routes": [
+          "inventory.topolo.app"
+        ],
+        "appId": "inventory"
+      },
+      {
+        "name": "topolo-inventory-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "learn": {
+    "id": "learn",
+    "appDir": "TopoloLearn",
+    "name": "topololearn",
+    "packageName": "topolo-learn",
+    "productionUrl": "https://learn.topolo.app",
+    "services": [
+      "learn"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-learn",
+        "kind": "worker",
+        "apiUrl": "https://learn.topolo.app",
+        "domains": [
+          "learn.topolo.app"
+        ],
+        "routes": [
+          "learn.topolo.app"
+        ],
+        "appId": "learn"
+      },
+      {
+        "name": "topolo-learn-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "localize": {
+    "id": "localize",
+    "appDir": "TopoloLocalize",
+    "name": "topolo-localize",
+    "packageName": "topolo-localize",
+    "productionUrl": "https://localize.topolo.app",
+    "services": [
+      "localize"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-localize",
+        "kind": "worker",
+        "apiUrl": "https://localize.topolo.app",
+        "domains": [
+          "localize.topolo.app"
+        ],
+        "routes": [
+          "localize.topolo.app"
+        ],
+        "appId": "localize"
+      }
+    ]
+  },
+  "mail": {
+    "id": "mail",
+    "appDir": "TopoloMail",
+    "name": "topolo-mail",
+    "packageName": "topolo-mail",
+    "productionUrl": "https://mail.topolo.app",
+    "services": [
+      "mail"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-mail",
+        "kind": "worker",
+        "apiUrl": "https://mail.topolo.app",
+        "domains": [
+          "mail.topolo.app"
+        ],
+        "routes": [
+          "mail.topolo.app"
+        ],
+        "appId": "mail"
+      },
+      {
+        "name": "topolo-mail-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "mdm": {
+    "id": "mdm",
+    "appDir": "TopoloMDM",
+    "name": "TopoloMDM",
+    "packageName": "topolo-mdm",
+    "productionUrl": "https://mdm.topolo.app",
+    "services": [
+      "mdm"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-mdm-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      },
+      {
+        "name": "topolo-mdm-console",
+        "kind": "worker",
+        "apiUrl": "https://mdm.topolo.app",
+        "domains": [
+          "mdm.topolo.app"
+        ],
+        "routes": [
+          "mdm.topolo.app"
+        ],
+        "appId": "mdm"
+      }
+    ]
+  },
+  "messages": {
+    "id": "messages",
+    "appDir": "TopoloMessages",
+    "name": "topolo-messages",
+    "packageName": "topolo-messages",
+    "productionUrl": "https://messages.topolo.app",
+    "services": [
+      "messages"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-messages",
+        "kind": "worker",
+        "apiUrl": "https://messages.topolo.app",
+        "domains": [
+          "messages.topolo.app"
+        ],
+        "routes": [
+          "messages.topolo.app"
+        ],
+        "appId": "messages"
+      },
+      {
+        "name": "topolo-messages-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      },
+      {
+        "name": "topolo-messages-dispatch",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "nexus": {
+    "id": "nexus",
+    "appDir": "TopoloNexus",
+    "name": "topolo-nexus",
+    "packageName": "topolo-nexus",
+    "productionUrl": "https://nexus.topolo.app",
+    "services": [
+      "nexus"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-nexus-dashboard",
+        "kind": "worker",
+        "apiUrl": "https://nexus.topolo.app",
+        "domains": [
+          "nexus.topolo.app"
+        ],
+        "routes": [
+          "nexus.topolo.app"
+        ],
+        "appId": null
+      },
+      {
+        "name": "topolo-nexus-gateway",
+        "kind": "worker",
+        "apiUrl": "https://nexus.topolo.app",
+        "domains": [
+          "nexus.topolo.app"
+        ],
+        "routes": [],
+        "appId": "nexus"
+      }
+    ]
+  },
+  "notify": {
+    "id": "notify",
+    "appDir": "TopoloNotify",
+    "name": "topolo-notify",
+    "packageName": "@topolo/notify",
+    "productionUrl": "https://notify.topolo.app",
+    "services": [
+      "notify"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-notify",
+        "kind": "worker",
+        "apiUrl": "https://notify.topolo.app",
+        "domains": [
+          "notify.topolo.app"
+        ],
+        "routes": [
+          "notify.topolo.app"
+        ],
+        "appId": "notify"
+      }
+    ]
+  },
+  "observability_watch": {
+    "id": "observability_watch",
+    "appDir": "TopoloObservabilityWatch",
+    "name": "topolo-observability-watch",
+    "packageName": "topolo-observability-watch",
+    "productionUrl": "https://observability-watch.topolo.app",
+    "services": [
+      "observability_watch"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-observability-watch",
+        "kind": "worker",
+        "apiUrl": "https://observability-watch.topolo.app",
+        "domains": [
+          "observability-watch.topolo.app"
+        ],
+        "routes": [
+          "observability-watch.topolo.app"
+        ],
+        "appId": "observability_watch"
+      }
+    ]
+  },
+  "one": {
+    "id": "one",
+    "appDir": "TopoloOne",
+    "name": "TopoloOne",
+    "packageName": "topolo-oneclick-sso",
+    "productionUrl": "https://one.topolo.app",
+    "services": [
+      "one"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-one",
+        "kind": "worker",
+        "apiUrl": "https://one.topolo.app",
+        "domains": [
+          "one.topolo.app"
+        ],
+        "routes": [
+          "one.topolo.app/*"
+        ],
+        "appId": null
+      },
+      {
+        "name": "topolo-one-api",
+        "kind": "worker",
+        "apiUrl": "https://www.topolo.app",
+        "domains": [
+          "www.topolo.app"
+        ],
+        "routes": [
+          "www.topolo.app/*"
+        ],
+        "appId": "one"
+      },
+      {
+        "name": "topolo-one-website",
+        "kind": "worker",
+        "apiUrl": "https://topolo.io",
+        "domains": [
+          "topolo.io"
+        ],
+        "routes": [
+          "one.topolo.io",
+          "topolo.io",
+          "www.topolo.io"
+        ],
+        "appId": null
+      }
+    ]
+  },
+  "p2p": {
+    "id": "p2p",
+    "appDir": "TopoloP2P",
+    "name": "topolo-p2p",
+    "packageName": "topolo-p2p",
+    "productionUrl": "https://p2p.topolo.app",
+    "services": [
+      "p2p"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-p2p",
+        "kind": "worker",
+        "apiUrl": "https://p2p.topolo.app",
+        "domains": [
+          "p2p.topolo.app"
+        ],
+        "routes": [
+          "p2p.topolo.app"
+        ],
+        "appId": "p2p"
+      },
+      {
+        "name": "topolo-p2p-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "pay": {
+    "id": "pay",
+    "appDir": "TopoloPay",
+    "name": "topolo-pay",
+    "packageName": "topolo-pay",
+    "productionUrl": "https://pay.topolo.app",
+    "services": [
+      "pay"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-pay",
+        "kind": "worker",
+        "apiUrl": "https://pay.topolo.app",
+        "domains": [
+          "pay.topolo.app"
+        ],
+        "routes": [
+          "pay.topolo.app"
+        ],
+        "appId": "pay"
+      },
+      {
+        "name": "topolo-pay-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "people": {
+    "id": "people",
+    "appDir": "TopoloPeople",
+    "name": "topolo-people",
+    "packageName": "topolo-people",
+    "productionUrl": "https://people.topolo.app",
+    "services": [
+      "people"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-people",
+        "kind": "worker",
+        "apiUrl": "https://people.topolo.app",
+        "domains": [
+          "people.topolo.app"
+        ],
+        "routes": [
+          "people.topolo.app"
+        ],
+        "appId": "people"
+      },
+      {
+        "name": "topolo-people-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "quro": {
+    "id": "quro",
+    "appDir": "TopoloQuro",
+    "name": "TopoloQuro",
+    "packageName": "topolo-quro",
+    "productionUrl": "https://quro.topolo.app",
+    "services": [
+      "quro.api",
+      "quro.redirect"
+    ],
+    "deployTargets": [
+      {
+        "name": "quro-api",
+        "kind": "worker",
+        "apiUrl": "https://api.ol0.me",
+        "domains": [
+          "api.ol0.me"
+        ],
+        "routes": [
+          "api.ol0.me/*"
+        ],
+        "appId": "quro.api"
+      },
+      {
+        "name": "quro-redirect-system",
+        "kind": "worker",
+        "apiUrl": "https://ol0.me",
+        "domains": [
+          "ol0.me"
+        ],
+        "routes": [
+          "ol0.me/*"
+        ],
+        "appId": "quro.redirect"
+      },
+      {
+        "name": "quro-ui",
+        "kind": "worker",
+        "apiUrl": "https://quro.topolo.app",
+        "domains": [
+          "quro.topolo.app"
+        ],
+        "routes": [
+          "quro.topolo.app"
+        ],
+        "appId": null
+      }
+    ]
+  },
+  "roadmapper": {
+    "id": "roadmapper",
+    "appDir": "TopoloRoadmapper",
+    "name": "topolo-roadmapper",
+    "packageName": "topolo-roadmapper",
+    "productionUrl": "https://roadmapper.topolo.app",
+    "services": [
+      "roadmapper"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-roadmapper",
+        "kind": "worker",
+        "apiUrl": "https://roadmapper.topolo.app",
+        "domains": [
+          "roadmapper.topolo.app"
+        ],
+        "routes": [
+          "roadmapper.topolo.app"
+        ],
+        "appId": "roadmapper"
+      },
+      {
+        "name": "topolo-roadmapper-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "sign": {
+    "id": "sign",
+    "appDir": "TopoloSign",
+    "name": "topolo-sign",
+    "packageName": "topolo-sign",
+    "productionUrl": "https://sign.topolo.app",
+    "services": [
+      "sign"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-sign",
+        "kind": "worker",
+        "apiUrl": "https://sign.topolo.app",
+        "domains": [
+          "sign.topolo.app"
+        ],
+        "routes": [
+          "sign.topolo.app"
+        ],
+        "appId": "sign"
+      },
+      {
+        "name": "topolo-sign-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "social_studio": {
+    "id": "social_studio",
+    "appDir": "TopoloSocialStudio",
+    "name": "topolo-social-studio",
+    "packageName": "topolo-social-studio",
+    "productionUrl": "https://studio.topolo.app",
+    "services": [
+      "social_studio"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-social-studio",
+        "kind": "worker",
+        "apiUrl": "https://studio.topolo.app",
+        "domains": [
+          "studio.topolo.app"
+        ],
+        "routes": [
+          "studio.topolo.app"
+        ],
+        "appId": "social_studio"
+      },
+      {
+        "name": "topolo-social-studio-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      },
+      {
+        "name": "topolo-social-studio-queue",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "socialize": {
+    "id": "socialize",
+    "appDir": "TopoloSocialize",
+    "name": "socialize",
+    "packageName": "topolo-socialize",
+    "productionUrl": "https://socialize.topolo.app",
+    "services": [
+      "socialize"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-socialize",
+        "kind": "worker",
+        "apiUrl": "https://socialize.topolo.app",
+        "domains": [
+          "socialize.topolo.app"
+        ],
+        "routes": [
+          "socialize.topolo.app"
+        ],
+        "appId": "socialize"
+      },
+      {
+        "name": "topolo-socialize-api",
+        "kind": "worker",
+        "apiUrl": "https://socialize-api.topolo.app",
+        "domains": [
+          "socialize-api.topolo.app"
+        ],
+        "routes": [
+          "socialize-api.topolo.app"
+        ],
+        "appId": null
+      },
+      {
+        "name": "topolo-socialize-scheduler",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "spaces": {
+    "id": "spaces",
+    "appDir": "TopoloSpaces",
+    "name": "topolo-spaces",
+    "packageName": "@topolo/spaces",
+    "productionUrl": "https://spaces.topolo.app",
+    "services": [
+      "spaces"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-spaces",
+        "kind": "worker",
+        "apiUrl": "https://spaces.topolo.app",
+        "domains": [
+          "spaces.topolo.app"
+        ],
+        "routes": [
+          "spaces.topolo.app"
+        ],
+        "appId": "spaces"
+      },
+      {
+        "name": "topolo-spaces-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "status": {
+    "id": "status",
+    "appDir": "TopoloStatus",
+    "name": "topolo-status",
+    "packageName": "topolo-status",
+    "productionUrl": "https://status.topolo.app",
+    "services": [
+      "status"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-status",
+        "kind": "worker",
+        "apiUrl": "https://status.topolo.app",
+        "domains": [
+          "status.topolo.app"
+        ],
+        "routes": [
+          "status.topolo.app"
+        ],
+        "appId": "status"
+      }
+    ]
+  },
+  "success": {
+    "id": "success",
+    "appDir": "TopoloSuccess",
+    "name": "topolo-success",
+    "packageName": "topolo-success",
+    "productionUrl": "https://success.topolo.app",
+    "services": [
+      "success"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-success",
+        "kind": "worker",
+        "apiUrl": "https://success.topolo.app",
+        "domains": [
+          "success.topolo.app"
+        ],
+        "routes": [
+          "success.topolo.app"
+        ],
+        "appId": "success"
+      },
+      {
+        "name": "topolo-success-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "support": {
+    "id": "support",
+    "appDir": "TopoloSupport",
+    "name": "topolo-support",
+    "packageName": "topolo-support",
+    "productionUrl": "https://support.topolo.app",
+    "services": [
+      "support"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-support",
+        "kind": "worker",
+        "apiUrl": "https://support.topolo.app",
+        "domains": [
+          "support.topolo.app"
+        ],
+        "routes": [
+          "support.topolo.app/*"
+        ],
+        "appId": "support"
+      },
+      {
+        "name": "topolo-support-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "survey": {
+    "id": "survey",
+    "appDir": "TopoloSurvey",
+    "name": "topolo-survey",
+    "packageName": "topolo-survey",
+    "productionUrl": "https://survey.topolo.app",
+    "services": [
+      "survey"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-survey",
+        "kind": "worker",
+        "apiUrl": "https://survey.topolo.app",
+        "domains": [
+          "survey.topolo.app"
+        ],
+        "routes": [
+          "survey.topolo.app"
+        ],
+        "appId": "survey"
+      },
+      {
+        "name": "topolo-survey-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "voice": {
+    "id": "voice",
+    "appDir": "TopoloVoice",
+    "name": "topolo-voice",
+    "packageName": "topolo-voice",
+    "productionUrl": "https://voice.topolo.app",
+    "services": [
+      "voice"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-voice",
+        "kind": "worker",
+        "apiUrl": "https://voice.topolo.app",
+        "domains": [
+          "voice.topolo.app"
+        ],
+        "routes": [
+          "voice.topolo.app"
+        ],
+        "appId": "voice"
+      },
+      {
+        "name": "topolo-voice-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
+  "web": {
+    "id": "web",
+    "appDir": "TopoloWeb",
+    "name": "topoloweb",
+    "packageName": "topolo-web",
+    "productionUrl": "https://web.topolo.app",
+    "services": [
+      "web"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-web-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      },
+      {
+        "name": "topolo-web-runtime",
+        "kind": "worker",
+        "apiUrl": "https://sites.topolo.app",
+        "domains": [
+          "sites.topolo.app"
+        ],
+        "routes": [
+          "*.sites.topolo.app/*",
+          "sites.topolo.app"
+        ],
+        "appId": null
+      },
+      {
+        "name": "topolo-web-studio",
+        "kind": "worker",
+        "apiUrl": "https://web.topolo.app",
+        "domains": [
+          "web.topolo.app"
+        ],
+        "routes": [
+          "web.topolo.app"
+        ],
+        "appId": "web"
+      }
+    ]
+  }
+};
+
+// src/application-requirements.ts
+var STATIC_APPLICATIONS = APPLICATIONS;
+var APPLICATION_REQUIREMENTS_VERSION = "2026-08-11.1";
+var APPLICATION_REQUIREMENTS = [
+  {
+    id: "platform-metadata",
+    title: "Register the application in platform metadata",
+    summary: "Every app must have a stable application ID, CloudControl metadata for deployed surfaces, and package metadata where code is shipped.",
+    appliesTo: ["all"],
+    evidence: [
+      "topolo.cloudcontrol.json exists for every deployed app surface",
+      "package.json names the package or app when the repo ships code",
+      "The live platform registry exposes the app through topolo apps and MCP discovery"
+    ],
+    implementation: [
+      "Register the app in the live platform registry (Auth service catalog) before exposing it to agents",
+      "Keep production URLs, Worker names, Pages projects, routes, domains, and bindings current in CloudControl metadata",
+      "Do not leave a new Topolo* app directory without an explicit application ID"
+    ]
+  },
+  {
+    id: "canonical-docs",
+    title: "Update canonical docs with the code change",
+    summary: "TopoloDocs is the source of truth for application behavior, ownership, deployment shape, auth boundaries, and operations.",
+    appliesTo: ["all"],
+    evidence: [
+      "Matching system registry entry exists in TopoloDocs",
+      "Internal handbook coverage exists for the system",
+      "npm run validate passes in TopoloDocs when docs are touched"
+    ],
+    implementation: [
+      "Read the matching TopoloDocs system entry before coding",
+      "Update docs in the same change when behavior, API, auth, data ownership, deployment, or operations change",
+      "Update last_verified dates on touched canonical pages"
+    ]
+  },
+  {
+    id: "shared-auth-boundary",
+    title: "Use the shared Topolo auth boundary",
+    summary: "Applications must derive identity, organization, scopes, and app entitlement from TopoloAuth rather than inventing parallel auth state.",
+    appliesTo: ["browser", "api", "tooling", "agent_surface"],
+    evidence: [
+      "@topolo/auth-client or @topolo-io/worker-runtime is used where applicable",
+      "No public command, tool, or SDK method accepts orgId",
+      "App slug and Auth app registration are documented for protected APIs"
+    ],
+    implementation: [
+      "Use shared auth/runtime packages instead of copying token parsing, gateway, or browser storage flows",
+      "Derive organization from the credential on every request",
+      "Route OAuth, refresh, logout, and SSO paths according to the shared Auth contract"
+    ]
+  },
+  {
+    id: "shared-shell-and-launcher",
+    title: "Use the shared shell, launcher, and account menu",
+    summary: "Browser applications should feel like one platform and should not create isolated navigation or account surfaces.",
+    appliesTo: ["browser"],
+    evidence: [
+      "@topolo-io/app-shell is used for the platform shell where the app has authenticated UI",
+      "@topolo-io/app-launcher keeps the shared launcher/app switcher reachable from authenticated app chrome",
+      "Account menu and sign-out behavior use TopoloAppShell or the ui-kit TopoloAccountMenu primitive",
+      "Repeated app body surfaces use shared TopoloAppLayout primitives instead of local stat cards, empty states, or status badges",
+      "Local preview supports deterministic visual QA fixtures for overview, list, detail, settings, and empty/loading states",
+      "Authenticated app body content stays inside the viewport on mobile and desktop widths"
+    ],
+    implementation: [
+      "Use @topolo-io/app-shell TopoloAppShell for authenticated app layouts",
+      "Use the @topolo-io/ui-kit TopoloAccountMenu primitive when a partial-shell surface still needs account chrome",
+      "Pass app-specific account actions as additive menu items instead of forking dropdowns",
+      "Use shared design tokens and platform UI primitives before creating local equivalents",
+      "Use TopoloAppMetricCard, TopoloAppEmptyState, TopoloAppStatusBadge, TopoloAppGrid, and TopoloAppSection for repeated app body patterns",
+      "Keep visual QA fixtures available through visualQa=1 or __devpreview=1 so screenshot checks do not depend on live API state",
+      "Keep mobile and desktop shell behavior aligned with the platform UI kit",
+      "Constrain the app workspace-view layout wrappers with min-width: 0, width: auto, and viewport-aware max-width so shell padding cannot create page-level horizontal overflow"
+    ]
+  },
+  {
+    id: "app-registration-and-scopes",
+    title: "Register protected APIs as platform apps",
+    summary: "Callable app APIs need a stable app ID, app slug, permissions, role bundles, and API-key scopes before agents or users rely on them.",
+    appliesTo: ["api"],
+    evidence: [
+      "Auth app catalog contains the app ID and slug",
+      "Permissions, role bundles, and API-key scopes exist for the app",
+      "SDK, CLI, and MCP app discovery include the callable production API",
+      "CloudControl production HTTP targets classify agent reachability with sdk_app_id or agent_callable:false"
+    ],
+    implementation: [
+      "Add production Worker api_url metadata and sdk_app_id for every agent-callable API target",
+      "Mark browser, documentation, and runtime-only Worker targets with agent_callable:false",
+      "Expose stable app IDs through live catalog discovery",
+      "Keep typed SDK/CLI/MCP surfaces in sync when an API contract stabilizes"
+    ]
+  },
+  {
+    id: "organization-scoped-data",
+    title: "Keep application data organization-scoped",
+    summary: "Protected data access must be scoped by the authenticated organization at the backend boundary, not by client-provided hints.",
+    appliesTo: ["api"],
+    evidence: [
+      "Backend request handlers derive org membership from credential validation",
+      "Queries and Durable Object keys include the authenticated organization boundary where data is tenant-owned",
+      "MCP and CLI inputs do not include orgId overrides"
+    ],
+    implementation: [
+      "Reject or ignore organization hints supplied by clients",
+      "Bind SQL, KV, R2, queue, and Durable Object access to the authenticated organization",
+      "Document service-local exceptions explicitly in the system security assurance record"
+    ]
+  },
+  {
+    id: "cloudflare-deployment-contract",
+    title: "Keep Cloudflare deployment metadata complete",
+    summary: "Workers, Pages, bindings, routes, env vars, queues, cron triggers, and deployment commands must be discoverable through CloudControl metadata.",
+    appliesTo: ["browser", "api"],
+    evidence: [
+      "topolo.cloudcontrol.json lists production deploy targets and URLs",
+      "Wrangler/Pages configuration matches CloudControl metadata",
+      "Secrets and environment variables are not committed"
+    ],
+    implementation: [
+      "Update CloudControl metadata whenever deployment topology changes",
+      "Prefer Cloudflare-native runtime surfaces for new Topolo app infrastructure",
+      "Keep Worker bindings and Pages domains explicit enough for agents to inspect before deploying"
+    ]
+  },
+  {
+    id: "agent-and-operator-surfaces",
+    title: "Expose agent-safe operations through SDK, CLI, and MCP",
+    summary: "Agent-accessible functionality should be discoverable, scope-gated, and write-confirmed instead of hidden behind ad hoc HTTP calls.",
+    appliesTo: ["api", "tooling", "agent_surface"],
+    evidence: [
+      "Read operations have typed SDK/CLI/MCP surfaces once their contract stabilizes",
+      "Mutating generic calls require --confirm or confirm:true",
+      "MCP tools never accept orgId and advertise only appropriate scope-gated tools"
+    ],
+    implementation: [
+      "Add SDK types first, then CLI commands and MCP tools for durable workflows",
+      "Use generic API passthrough only as a temporary escape hatch",
+      "Keep command output JSON-stable for agents and human-readable with --no-json"
+    ]
+  },
+  {
+    id: "native-dashboard-widget",
+    title: "Expose a native dashboard widget contract",
+    summary: "Launchable first-party applications must populate TopoloOne live workspace through an app-owned /api/widget endpoint using the SDK widget response contract.",
+    appliesTo: ["api"],
+    evidence: [
+      "The app-owned API exposes GET /api/widget",
+      "The endpoint returns TopoloWidgetApiResponse from @topolo/sdk",
+      "Every returned widget includes snapshot.summary with app-owned operational prose",
+      "The endpoint derives organization/user context from the app auth boundary"
+    ],
+    implementation: [
+      "Import createTopoloWidgetResponse from @topolo/sdk in the app backend",
+      "Return native app metrics or action widgets instead of generic launch-card fallbacks",
+      "Populate snapshot.summary in the producing app for every widget instead of synthesizing summaries in TopoloOne",
+      "Add a route-level test that validates the response with validateTopoloWidgetResponse"
+    ]
+  },
+  {
+    id: "observability-and-audit",
+    title: "Emit platform audit and debugging signals",
+    summary: "Requests, agent actions, and operational workflows need traceable IDs, client labels, and useful failure evidence.",
+    appliesTo: ["api", "tooling", "agent_surface"],
+    evidence: [
+      "Requests carry X-Topolo-Client and X-Topolo-Request-Id where the SDK is involved",
+      "Agent-originated calls can include X-Topolo-Agent",
+      "Failure modes are documented with request IDs or deployment/log lookup paths"
+    ],
+    implementation: [
+      "Use TopoloClient for platform API calls rather than raw fetch where practical",
+      "Keep logs free of secrets and tokens",
+      "Document live smoke commands and request-id correlation in canonical docs"
+    ]
+  },
+  {
+    id: "verification-gates",
+    title: "Ship with build, test, docs, and smoke verification",
+    summary: "A Topolo app change is not complete until the relevant code checks and docs checks have been run or explicitly reported as blocked.",
+    appliesTo: ["all"],
+    evidence: [
+      "Relevant package build/typecheck/test commands pass",
+      "TopoloDocs validation passes when docs are touched",
+      "Live or local smoke evidence is captured for user-visible or API behavior"
+    ],
+    implementation: [
+      "Prefer existing package scripts before adding new tooling",
+      "Run app-specific checks and shared docs validation for behavior changes",
+      "Report any skipped verification with the blocker and residual risk"
+    ]
+  }
+];
+function applicationRequirementScopes(application) {
+  const scopes = /* @__PURE__ */ new Set(["all"]);
+  const appId = application.id;
+  const hasBrowserSurface = Boolean(application.productionUrl) || // String() keeps this guard valid after the Pages->Worker migration narrowed
+  // the generated kind union to "worker" (no "pages" literal remains).
+  application.deployTargets.some((target) => String(target.kind) === "pages");
+  const hasApiSurface = application.services.length > 0 || application.deployTargets.some((target) => Boolean(target.appId));
+  if (hasBrowserSurface) scopes.add("browser");
+  if (hasApiSurface) scopes.add("api");
+  if (appId === "cli" || appId === "mcp" || appId === "cloudcontrol") {
+    scopes.add("tooling");
+  }
+  if (appId === "cli" || appId === "mcp" || hasApiSurface) {
+    scopes.add("agent_surface");
+  }
+  return Array.from(scopes);
+}
+function fallbackApplication(id) {
+  const entry = STATIC_APPLICATIONS[id];
+  if (!entry) {
+    throw new Error(
+      `Unknown application "${id}" in the static fallback snapshot. Resolve applications from the live registry (resolveApplicationDirectoryEntry) and pass the entry directly.`
+    );
+  }
+  return entry;
+}
+function requirementsForApplication(applicationOrId) {
+  const application = typeof applicationOrId === "string" ? fallbackApplication(applicationOrId) : applicationOrId;
+  const scopes = new Set(applicationRequirementScopes(application));
+  return APPLICATION_REQUIREMENTS.filter(
+    (requirement) => requirement.appliesTo.some((scope) => scopes.has(scope))
+  );
+}
+function auditApplicationRequirements(applicationOrId) {
+  const application = typeof applicationOrId === "string" ? fallbackApplication(applicationOrId) : applicationOrId;
+  const scopes = applicationRequirementScopes(application);
+  const findings = requirementsForApplication(application).map(
+    (requirement) => evaluateRequirement(application, requirement)
+  );
+  return {
+    version: APPLICATION_REQUIREMENTS_VERSION,
+    application,
+    scopes,
+    score: scoreFindings(findings),
+    findings
+  };
+}
+function auditApplicationEntries(applications) {
+  return buildAuditReport(
+    applications.map((application) => auditApplicationRequirements(application))
+  );
+}
+function auditAllApplicationRequirements(applicationIds = Object.keys(APPLICATIONS).sort()) {
+  return buildAuditReport(
+    applicationIds.map((applicationId) => auditApplicationRequirements(applicationId))
+  );
+}
+function buildAuditReport(applications) {
+  const migrationQueue = applications.flatMap(
+    (audit) => audit.findings.filter((finding2) => finding2.status !== "met").map((finding2) => ({
+      applicationId: audit.application.id,
+      applicationName: audit.application.name,
+      requirementId: finding2.requirementId,
+      title: finding2.title,
+      status: finding2.status,
+      reason: finding2.reason,
+      nextActions: finding2.nextActions
+    }))
+  ).sort((a, b) => {
+    const statusOrder = statusRank(a.status) - statusRank(b.status);
+    if (statusOrder !== 0) return statusOrder;
+    const appOrder = a.applicationId.localeCompare(b.applicationId);
+    if (appOrder !== 0) return appOrder;
+    return a.requirementId.localeCompare(b.requirementId);
+  });
+  return {
+    version: APPLICATION_REQUIREMENTS_VERSION,
+    applications,
+    migrationQueue
+  };
+}
+function evaluateRequirement(application, requirement) {
+  const evidence = [];
+  switch (requirement.id) {
+    case "platform-metadata": {
+      if (application.packageName) evidence.push(`package=${application.packageName}`);
+      if (application.productionUrl) evidence.push(`productionUrl=${application.productionUrl}`);
+      if (application.deployTargets.length > 0) {
+        evidence.push(`deployTargets=${application.deployTargets.length}`);
+      }
+      if (application.services.length > 0) {
+        evidence.push(`services=${application.services.join(",")}`);
+      }
+      if (evidence.length === 0) {
+        return finding(requirement, "missing", "No package, production URL, deploy target, or service metadata is available.", evidence);
+      }
+      return finding(requirement, "met", "Catalog metadata exists for this application.", evidence);
+    }
+    case "canonical-docs":
+      return finding(
+        requirement,
+        "needs_review",
+        "Catalog metadata cannot verify matching TopoloDocs system and handbook coverage.",
+        evidence
+      );
+    case "shared-auth-boundary":
+      return finding(
+        requirement,
+        "needs_review",
+        "Catalog metadata cannot verify that implementation uses shared Topolo auth packages and derives org from credentials.",
+        evidence
+      );
+    case "shared-shell-and-launcher":
+      return finding(
+        requirement,
+        "needs_review",
+        "Catalog metadata cannot verify shared shell, launcher, and account menu adoption.",
+        evidence
+      );
+    case "app-registration-and-scopes": {
+      if (application.services.length > 0) {
+        evidence.push(`services=${application.services.join(",")}`);
+        return finding(
+          requirement,
+          "partial",
+          "SDK service discovery exists, but Auth catalog permissions, role bundles, and API-key scopes still need confirmation.",
+          evidence
+        );
+      }
+      return finding(requirement, "missing", "No SDK app API id is registered for this callable API surface.", evidence);
+    }
+    case "organization-scoped-data":
+      return finding(
+        requirement,
+        "needs_review",
+        "Catalog metadata cannot verify backend tenant filters, storage keys, or Durable Object boundaries.",
+        evidence
+      );
+    case "cloudflare-deployment-contract": {
+      if (application.deployTargets.length < 1) {
+        return finding(requirement, "missing", "No CloudControl deploy targets are registered.", evidence);
+      }
+      evidence.push(`deployTargets=${application.deployTargets.length}`);
+      if (application.productionUrl) evidence.push(`productionUrl=${application.productionUrl}`);
+      return finding(requirement, "met", "CloudControl deploy target metadata is present.", evidence);
+    }
+    case "agent-and-operator-surfaces": {
+      const appId = application.id;
+      if (application.services.length > 0) {
+        evidence.push(`services=${application.services.join(",")}`);
+        return finding(requirement, "partial", "SDK service discovery exists; typed SDK/CLI/MCP workflow coverage should be checked as APIs stabilize.", evidence);
+      }
+      if (appId === "cli" || appId === "mcp" || appId === "cloudcontrol") {
+        evidence.push(`tooling=${appId}`);
+        return finding(requirement, "met", "This application is itself an agent/operator surface.", evidence);
+      }
+      return finding(requirement, "missing", "No SDK service or tooling surface is registered.", evidence);
+    }
+    case "native-dashboard-widget":
+      return finding(
+        requirement,
+        "needs_review",
+        "Catalog metadata cannot verify app-owned /api/widget implementation details.",
+        evidence
+      );
+    case "observability-and-audit":
+      return finding(
+        requirement,
+        "needs_review",
+        "Catalog metadata cannot verify runtime request IDs, client labels, or log redaction.",
+        evidence
+      );
+    case "verification-gates":
+      return finding(
+        requirement,
+        "needs_review",
+        "Catalog metadata cannot verify package checks, docs validation, or smoke evidence.",
+        evidence
+      );
+    default:
+      return finding(requirement, "needs_review", "No automated evaluator exists for this requirement yet.", evidence);
+  }
+}
+function finding(requirement, status, reason, evidence) {
+  return {
+    requirementId: requirement.id,
+    title: requirement.title,
+    status,
+    reason,
+    evidence,
+    nextActions: status === "met" ? [] : requirement.implementation
+  };
+}
+function scoreFindings(findings) {
+  const met = findings.filter((finding2) => finding2.status === "met").length;
+  const partial = findings.filter((finding2) => finding2.status === "partial").length;
+  const missing = findings.filter((finding2) => finding2.status === "missing").length;
+  const needsReview = findings.filter((finding2) => finding2.status === "needs_review").length;
+  const total = findings.length;
+  const weighted = met + partial * 0.5;
+  return {
+    met,
+    partial,
+    missing,
+    needsReview,
+    total,
+    percent: total === 0 ? 100 : Math.round(weighted / total * 100)
+  };
+}
+function statusRank(status) {
+  if (status === "missing") return 0;
+  if (status === "partial") return 1;
+  return 2;
+}
+
 // src/modules/crm.ts
 var CrmModule = class {
   constructor(client) {
@@ -3261,6 +5437,9 @@ function createTopolo(options) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ACTION_CATALOG_DIGEST_ALGORITHM,
+  APPLICATIONS,
+  APPLICATION_REQUIREMENTS,
+  APPLICATION_REQUIREMENTS_VERSION,
   CrmModule,
   DEFAULT_APP_URLS,
   IdentityModule,
@@ -3279,7 +5458,11 @@ function createTopolo(options) {
   WorkspacesModule,
   actionContractCompleteness,
   applicationEntryFromCatalog,
+  applicationRequirementScopes,
   assertTopoloServiceUrlEnvironment,
+  auditAllApplicationRequirements,
+  auditApplicationEntries,
+  auditApplicationRequirements,
   canonicalTopoloErrorCode,
   canonicalTopoloRequestId,
   canonicalTopoloRequired,
@@ -3308,6 +5491,7 @@ function createTopolo(options) {
   prepareTopoloActionBase64UploadInput,
   prepareTopoloActionUploadInput,
   publicTopoloErrorMessage,
+  requirementsForApplication,
   resolveApplicationDirectoryEntry,
   resolveCatalogServiceUrl,
   resolveServiceUrl,