{
  "generated_at": "2026-06-12T22:05:57.125Z",
  "system": {
    "id": "topolo-bytes",
    "name": "Bytes",
    "slug": "topolo-bytes",
    "kind": "application",
    "summary": "Media and asset management surface for uploads, organization, review, and sharing.",
    "aliases": [],
    "lifecycle": "active",
    "last_verified": "2026-05-14",
    "owners": [
      "media-platform"
    ],
    "repo_paths": [],
    "external_repo_paths": [
      "Apps/shared/TopoloBytes"
    ],
    "service_ids": [
      "srv_JUFXzHBX4eWq"
    ],
    "visibility": "public",
    "api_contract": {
      "type": "curated",
      "source": "PlatformApplications/TopoloDocs/src/content/public/applications/bytes.mdx",
      "notes": "Canonical Bytes coverage now lives in the docs application, the browser launcher lane now reads Auth-owned catalog data through same-origin /api/auth/* on the Bytes host, the browser callback delegates one-time `sso_code` exchange to the shared Auth client without exposing a legacy `/sso?token=` route or app-local `/sso/exchange` parser, accepts a compact exchanged-token payload, and SPA-navigates after auth update events so the memory-only token survives protected-route hydration. First-party embedded password login also completes through Bytes-owned router navigation after shared Auth token persistence. Closed lazy panels and modals are deferred until opened so `/browse` startup is not held behind hidden Suspense loaders. The worker now requires Topolo Auth validation for all operator bearer tokens with no Bytes-local JWT secret path. Bytes keeps app identity in the repo-level app-identity module and resolves the concrete Auth service id from the canonical topolo-bytes slug at runtime for browser headers, worker permission checks, API-key management, notification emission, and widget responses. Bytes exposes `GET /api/widget` with the shared `@topolo/sdk` widget response contract for TopoloOne live workspace."
    },
    "primary_hosts": [
      "https://bytes.topolo.app",
      "https://bytes-api.topolo.app",
      "https://bytes.stg.topolo.us",
      "https://bytes-api.stg.topolo.us"
    ],
    "doc_paths": [
      "applications/bytes",
      "internal/apps/bytes"
    ],
    "security_assurance": {
      "risk_tier": "high",
      "auth_boundary": "Topolo Auth service `/validate` access for operator bearer tokens with Bytes-owned media, sharing, and storage authorization. First-party embedded password login is persisted by the shared Auth client and completed by Bytes router navigation. Guest share surfaces remain public or tokenized and separate from operator auth.",
      "tenant_isolation": "organization_scoped",
      "external_inputs": [
        "browser",
        "api",
        "callback"
      ],
      "sensitive_data": [
        "identity",
        "org_data",
        "customer_content",
        "telemetry"
      ],
      "last_security_review": "2026-04-30",
      "security_review_status": "reviewed",
      "pentest_status": "passed",
      "evidence_doc": "internal/apps/bytes"
    },
    "data_privacy": {
      "classification": "restricted",
      "sensitive_data_classes": [
        "customer_content",
        "identity",
        "organization",
        "telemetry"
      ],
      "storage_locations": [
        "external_provider",
        "kv",
        "r2"
      ],
      "encryption_at_rest": "application_layer_required",
      "encryption_in_transit": "https_only",
      "key_management": "versioned_platform_key_required",
      "retention_policy": "partial",
      "deletion_export_status": "planned",
      "logging_redaction_status": "needs_review",
      "privacy_review_status": "reviewed",
      "enterprise_ready": false,
      "evidence_doc": "internal/apps/bytes"
    },
    "dependencies": [
      "topolo-auth",
      "applications-packages"
    ],
    "bugfix_policy": {
      "tier": "autonomous",
      "preferred_agent": "either",
      "require_validator": false
    },
    "public_hub_url": "/systems/topolo-bytes",
    "internal_hub_url": null,
    "application_api_url": "/reference/apps/topolo-bytes",
    "generated_openapi_url": null,
    "machine_urls": {
      "system": "/machine/systems/topolo-bytes.json",
      "application": "/machine/applications/topolo-bytes.json"
    }
  },
  "docs": {
    "public": [
      {
        "id": "applications/bytes",
        "title": "Topolo Bytes",
        "summary": "Public overview of the media-management and sharing surface built around Cloudflare edge storage and media tooling.",
        "audience": "public",
        "tags": [
          "media",
          "assets",
          "sharing"
        ],
        "url": "/applications/bytes",
        "last_verified": "2026-05-13"
      }
    ],
    "internal": [],
    "runbooks": []
  },
  "authority": {
    "owners": [
      "media-platform"
    ],
    "repo_paths": [],
    "service_ids": [
      "srv_JUFXzHBX4eWq"
    ],
    "dependencies": [
      "topolo-auth",
      "applications-packages"
    ],
    "aliases": []
  },
  "interfaces": {
    "contract_type": "curated",
    "contract_source": "PlatformApplications/TopoloDocs/src/content/public/applications/bytes.mdx",
    "contract_source_exists": false,
    "openapi": null,
    "readme": null
  },
  "auth": {
    "depends_on_topolo_auth": true,
    "api_key_scopes": [
      {
        "id": "aks_bytes_api_keys_write",
        "name": "api_keys.write",
        "description": "Manage Bytes machine credentials",
        "resourcePattern": null,
        "kind": "api_key_scope"
      },
      {
        "id": "aks_bytes_files_delete",
        "name": "files.delete",
        "description": "Delete files and folders",
        "resourcePattern": null,
        "kind": "api_key_scope"
      },
      {
        "id": "aks_bytes_files_read",
        "name": "files.read",
        "description": "View and download files",
        "resourcePattern": null,
        "kind": "api_key_scope"
      },
      {
        "id": "aks_bytes_files_write",
        "name": "files.write",
        "description": "Upload and edit files",
        "resourcePattern": null,
        "kind": "api_key_scope"
      },
      {
        "id": "aks_bytes_folders_read",
        "name": "folders.read",
        "description": "View folder structure",
        "resourcePattern": null,
        "kind": "api_key_scope"
      },
      {
        "id": "aks_bytes_folders_write",
        "name": "folders.write",
        "description": "Create and organize folders",
        "resourcePattern": null,
        "kind": "api_key_scope"
      },
      {
        "id": "aks_bytes_media_read",
        "name": "media.read",
        "description": "View stored media assets and metadata",
        "resourcePattern": null,
        "kind": "api_key_scope"
      },
      {
        "id": "aks_bytes_media_write",
        "name": "media.write",
        "description": "Upload, update, and delete media assets",
        "resourcePattern": null,
        "kind": "api_key_scope"
      },
      {
        "id": "aks_bytes_pipelines_invoke",
        "name": "pipelines.invoke",
        "description": "Invoke media-processing pipelines",
        "resourcePattern": null,
        "kind": "api_key_scope"
      },
      {
        "id": "aks_bytes_share_read",
        "name": "sharing.read",
        "description": "View shared files and permissions",
        "resourcePattern": null,
        "kind": "api_key_scope"
      },
      {
        "id": "aks_bytes_share_write",
        "name": "sharing.write",
        "description": "Share files and manage permissions",
        "resourcePattern": null,
        "kind": "api_key_scope"
      },
      {
        "id": "aks_bytes_storage_read",
        "name": "storage.read",
        "description": "View storage usage and analytics",
        "resourcePattern": null,
        "kind": "api_key_scope"
      }
    ],
    "service_permissions": [
      {
        "id": "perm_bytes_api_keys_write",
        "name": "api_keys:write",
        "description": "Manage Bytes machine credentials",
        "resourcePattern": null,
        "kind": "permission"
      },
      {
        "id": "perm_bytes_files_delete",
        "name": "files:delete",
        "description": "Delete files and folders",
        "resourcePattern": null,
        "kind": "permission"
      },
      {
        "id": "perm_bytes_files_read",
        "name": "files:read",
        "description": "View and download files",
        "resourcePattern": null,
        "kind": "permission"
      },
      {
        "id": "perm_bytes_files_write",
        "name": "files:write",
        "description": "Upload and edit files",
        "resourcePattern": null,
        "kind": "permission"
      },
      {
        "id": "perm_bytes_folders_read",
        "name": "folders:read",
        "description": "View folder structure",
        "resourcePattern": null,
        "kind": "permission"
      },
      {
        "id": "perm_bytes_folders_write",
        "name": "folders:write",
        "description": "Create and organize folders",
        "resourcePattern": null,
        "kind": "permission"
      },
      {
        "id": "perm_bytes_media_read",
        "name": "media:read",
        "description": "View stored media assets and metadata",
        "resourcePattern": null,
        "kind": "permission"
      },
      {
        "id": "perm_bytes_media_write",
        "name": "media:write",
        "description": "Upload, update, and delete media assets",
        "resourcePattern": null,
        "kind": "permission"
      },
      {
        "id": "perm_bytes_pipelines_invoke",
        "name": "pipelines:invoke",
        "description": "Invoke media-processing pipelines",
        "resourcePattern": null,
        "kind": "permission"
      },
      {
        "id": "perm_bytes_share_read",
        "name": "sharing:read",
        "description": "View shared files and permissions",
        "resourcePattern": null,
        "kind": "permission"
      },
      {
        "id": "perm_bytes_share_write",
        "name": "sharing:write",
        "description": "Share files and manage permissions",
        "resourcePattern": null,
        "kind": "permission"
      },
      {
        "id": "perm_bytes_storage_read",
        "name": "storage:read",
        "description": "View storage usage and analytics",
        "resourcePattern": null,
        "kind": "permission"
      }
    ]
  },
  "runtime": {
    "primary_hosts": [
      "https://bytes.topolo.app",
      "https://bytes-api.topolo.app",
      "https://bytes.stg.topolo.us",
      "https://bytes-api.stg.topolo.us"
    ],
    "repo_entries": [],
    "wrangler_surfaces": [],
    "packages": []
  },
  "data": {
    "env_vars": [],
    "bindings": [],
    "queue_bindings": [],
    "storage_kinds": [],
    "workflow_signals": []
  },
  "deployment": {
    "commands": [],
    "routes": [],
    "environments": [],
    "assets_directories": [],
    "observability_enabled": false
  },
  "debugging": {
    "failure_modes": [
      "No wrangler.toml surface was discovered under the registered repo paths.",
      "The registered contract source is missing: PlatformApplications/TopoloDocs/src/content/public/applications/bytes.mdx",
      "Neither OpenAPI nor README-derived interface detail was found."
    ],
    "entrypoints": [
      "PlatformApplications/TopoloDocs/src/content/public/applications/bytes.mdx"
    ]
  }
}