@topolo/sdk 0.4.0 → 0.4.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topolo/sdk",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Typed client SDK for the Topolo platform. Used by TopoloCli, TopoloMCP, and third-party agents.",
   "type": "module",
   "main": "./dist/index.js",

package/src/application-requirements.ts

@@ -149,10 +149,12 @@ export const APPLICATION_REQUIREMENTS = [
       'Auth service catalog contains the service ID and slug',
       'Permissions, role bundles, and API-key scopes exist for the service',
       'SDK, CLI, and MCP service discovery include the callable production API',
+      'CloudControl production HTTP targets classify agent reachability with sdk_service_id or agent_callable:false',
     ],
     implementation: [
-      'Add production Worker api_url metadata before adding an SDK service ID',
-      'Expose stable service IDs through DEFAULT_SERVICE_URLS',
+      'Add production Worker api_url metadata and sdk_service_id for every agent-callable API target',
+      'Mark browser, documentation, and runtime-only Worker targets with agent_callable:false',
+      'Expose stable service IDs through generated DEFAULT_SERVICE_URLS and live catalog discovery',
       'Keep typed SDK/CLI/MCP surfaces in sync when an API contract stabilizes',
     ],
   },
@@ -268,10 +270,17 @@ export function applicationRequirementScopes(
   // the deploy catalog union, so compare as string rather than assert overlap.
   const appId: string = application.id;
   const hasBrowserSurface =
-    Boolean(application.productionUrl) || application.deployTargets.some((target) => target.kind === 'pages');
+    Boolean(application.productionUrl) ||
+    // String() keeps this guard valid after the Pages->Worker migration narrowed
+    // the generated kind union to "worker" (no "pages" literal remains).
+    application.deployTargets.some((target) => String(target.kind) === 'pages');
+  // An API surface means an agent-callable service — keyed on a resolved
+  // serviceId, NOT a bare apiUrl. After the Pages->Worker migration every
+  // frontend shell carries an apiUrl (its own serving domain), so apiUrl is no
+  // longer a signal for "exposes a callable API"; serviceId is.
   const hasApiSurface =
     application.services.length > 0 ||
-    application.deployTargets.some((target) => Boolean(target.apiUrl));
+    application.deployTargets.some((target) => Boolean(target.serviceId));
 
   if (hasBrowserSurface) scopes.add('browser');
   if (hasApiSurface) scopes.add('api');
@@ -415,7 +424,9 @@ function evaluateRequirement(
         evidence,
       );
     case 'cloudflare-deployment-contract': {
-      if (application.deployTargets.length === 0) {
+      // `< 1` rather than `=== 0`: every catalogued app now has >=1 deploy target,
+      // so the generated tuple-length union excludes 0 and `=== 0` fails typecheck.
+      if (application.deployTargets.length < 1) {
         return finding(requirement, 'missing', 'No CloudControl deploy targets are registered.', evidence);
       }
       evidence.push(`deployTargets=${application.deployTargets.length}`);