@topolo/sdk 0.3.0 → 0.4.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topolo/sdk",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "Typed client SDK for the Topolo platform. Used by TopoloCli, TopoloMCP, and third-party agents.",
   "type": "module",
   "main": "./dist/index.js",
@@ -25,10 +25,13 @@
     "dev": "tsup src/index.ts --format esm,cjs --dts --watch",
     "typecheck": "node scripts/generate-services.mjs && tsc --noEmit",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "prepublishOnly": "npm run build",
+    "coverage": "vitest run --coverage"
   },
   "devDependencies": {
     "@types/node": "^20.19.39",
+    "@vitest/coverage-v8": "^2.1.0",
     "tsup": "^8.0.0",
     "typescript": "^5.4.0",
     "vitest": "^2.1.0"

package/src/application-requirements.ts

@@ -108,12 +108,12 @@ export const APPLICATION_REQUIREMENTS = [
       'Applications must derive identity, organization, scopes, and service entitlement from TopoloAuth rather than inventing parallel auth state.',
     appliesTo: ['browser', 'api', 'tooling', 'agent_surface'],
     evidence: [
-      '@topolo/auth-client or @topolo/auth-middleware is used where applicable',
+      '@topolo/auth-client or @topolo-io/worker-runtime is used where applicable',
       'No public command, tool, or SDK method accepts orgId',
       'Service slug and Auth service registration are documented for protected services',
     ],
     implementation: [
-      'Use shared auth packages instead of copying token parsing or browser storage flows',
+      'Use shared auth/runtime packages instead of copying token parsing, gateway, or browser storage flows',
       'Derive organization from the credential on every request',
       'Route OAuth, refresh, logout, and SSO paths according to the shared Auth contract',
     ],
@@ -149,10 +149,12 @@ export const APPLICATION_REQUIREMENTS = [
       'Auth service catalog contains the service ID and slug',
       'Permissions, role bundles, and API-key scopes exist for the service',
       'SDK, CLI, and MCP service discovery include the callable production API',
+      'CloudControl production HTTP targets classify agent reachability with sdk_service_id or agent_callable:false',
     ],
     implementation: [
-      'Add production Worker api_url metadata before adding an SDK service ID',
-      'Expose stable service IDs through DEFAULT_SERVICE_URLS',
+      'Add production Worker api_url metadata and sdk_service_id for every agent-callable API target',
+      'Mark browser, documentation, and runtime-only Worker targets with agent_callable:false',
+      'Expose stable service IDs through generated DEFAULT_SERVICE_URLS and live catalog discovery',
       'Keep typed SDK/CLI/MCP surfaces in sync when an API contract stabilizes',
     ],
   },
@@ -264,18 +266,28 @@ export function applicationRequirementScopes(
   application: ApplicationCatalogEntry,
 ): ApplicationRequirementScope[] {
   const scopes = new Set<ApplicationRequirementScope>(['all']);
+  // id is checked by value: tooling ids (cli/mcp) are intentionally not in
+  // the deploy catalog union, so compare as string rather than assert overlap.
+  const appId: string = application.id;
   const hasBrowserSurface =
-    Boolean(application.productionUrl) || application.deployTargets.some((target) => target.kind === 'pages');
+    Boolean(application.productionUrl) ||
+    // String() keeps this guard valid after the Pages->Worker migration narrowed
+    // the generated kind union to "worker" (no "pages" literal remains).
+    application.deployTargets.some((target) => String(target.kind) === 'pages');
+  // An API surface means an agent-callable service — keyed on a resolved
+  // serviceId, NOT a bare apiUrl. After the Pages->Worker migration every
+  // frontend shell carries an apiUrl (its own serving domain), so apiUrl is no
+  // longer a signal for "exposes a callable API"; serviceId is.
   const hasApiSurface =
     application.services.length > 0 ||
-    application.deployTargets.some((target) => Boolean(target.apiUrl));
+    application.deployTargets.some((target) => Boolean(target.serviceId));
 
   if (hasBrowserSurface) scopes.add('browser');
   if (hasApiSurface) scopes.add('api');
-  if (application.id === 'cli' || application.id === 'mcp' || application.id === 'cloudcontrol') {
+  if (appId === 'cli' || appId === 'mcp' || appId === 'cloudcontrol') {
     scopes.add('tooling');
   }
-  if (application.id === 'cli' || application.id === 'mcp' || hasApiSurface) {
+  if (appId === 'cli' || appId === 'mcp' || hasApiSurface) {
     scopes.add('agent_surface');
   }
 
@@ -412,7 +424,9 @@ function evaluateRequirement(
         evidence,
       );
     case 'cloudflare-deployment-contract': {
-      if (application.deployTargets.length === 0) {
+      // `< 1` rather than `=== 0`: every catalogued app now has >=1 deploy target,
+      // so the generated tuple-length union excludes 0 and `=== 0` fails typecheck.
+      if (application.deployTargets.length < 1) {
         return finding(requirement, 'missing', 'No CloudControl deploy targets are registered.', evidence);
       }
       evidence.push(`deployTargets=${application.deployTargets.length}`);
@@ -420,12 +434,13 @@ function evaluateRequirement(
       return finding(requirement, 'met', 'CloudControl deploy target metadata is present.', evidence);
     }
     case 'agent-and-operator-surfaces': {
+      const appId: string = application.id;
       if (application.services.length > 0) {
         evidence.push(`services=${application.services.join(',')}`);
         return finding(requirement, 'partial', 'SDK service discovery exists; typed SDK/CLI/MCP workflow coverage should be checked as APIs stabilize.', evidence);
       }
-      if (application.id === 'cli' || application.id === 'mcp' || application.id === 'cloudcontrol') {
-        evidence.push(`tooling=${application.id}`);
+      if (appId === 'cli' || appId === 'mcp' || appId === 'cloudcontrol') {
+        evidence.push(`tooling=${appId}`);
         return finding(requirement, 'met', 'This application is itself an agent/operator surface.', evidence);
       }
       return finding(requirement, 'missing', 'No SDK service or tooling surface is registered.', evidence);