@topolo/cli 0.1.24 → 0.1.26

package/README.md

@@ -108,26 +108,26 @@ topolo crm contacts:get contact_abc123
 
 ### `topolo services`
 
-Lists every service id and effective URL known to the generated SDK registry.
-In staging, `environmentSafe: false` means that service still resolves to a
-production SDK default and will be refused by `topolo api` until a staging URL
-override is configured.
+Lists the services the current credential can use in its organization, with the
+effective URL and granted permissions. This command requires a credential and
+does not expose the global platform catalog. In staging, `environmentSafe:
+false` means that service still resolves to a production URL and will be
+refused by `topolo api` until a staging URL override is configured.
 
 ```bash
 topolo services --json
 topolo services --env staging --json
 ```
 
-`topolo api` also accepts live Auth-catalog service IDs/slugs for newly
-registered API/technical service surfaces, so agents can address future services
-before the next CLI package release. Use `topolo services --json` as the stable
-offline discovery floor, then rely on the SDK's live resolver for newly
-registered services.
+`topolo api` accepts the IDs/slugs returned by this credential-scoped live
+catalog. New services become usable without a CLI release once Auth grants the
+organization and credential the relevant permissions.
 
 ### `topolo apps`
 
-Lists every Topolo application known to the generated SDK catalog, including
-browser-only Worker applications that do not expose a callable API service.
+Lists launchable Topolo applications available to the current credential. This
+uses the same live Auth catalog as `topolo services`; it is not the global
+generated application list.
 
 ```bash
 topolo apps --json
@@ -209,8 +209,8 @@ topolo api auth GET /api/me
 topolo api crm POST /api/contacts --data '{"first":"Jane"}' --confirm
 ```
 
-Use `topolo services --json` to discover valid service ids before calling a
-service that does not have a typed command yet.
+Use `topolo services --json` to discover service ids permitted for the current
+credential before calling a service that does not have a typed command yet.
 
 ## Output modes
 

package/dist/index.js

@@ -2203,12 +2203,16 @@ var TopoloClient = class _TopoloClient {
     if (!serviceKey) {
       throw new TopoloSdkError("unknown_service", "service is required");
     }
-    const overrideUrl = resolveConfiguredServiceUrl(serviceKey, this.serviceUrls);
-    if (overrideUrl) return { serviceKey, baseUrl: overrideUrl };
-    const staticUrl = DEFAULT_SERVICE_URLS[serviceKey];
-    if (staticUrl) return { serviceKey, baseUrl: staticUrl };
+    if (serviceKey === "auth") {
+      const overrideUrl = resolveConfiguredServiceUrl(serviceKey, this.serviceUrls);
+      if (overrideUrl) return { serviceKey, baseUrl: overrideUrl };
+      return { serviceKey, baseUrl: DEFAULT_SERVICE_URLS.auth };
+    }
     const live = await this.resolveLiveCallableService(serviceKey);
-    if (live) return live;
+    if (live) {
+      const overrideUrl = resolveConfiguredServiceUrl(serviceKey, this.serviceUrls);
+      return overrideUrl ? { ...live, baseUrl: overrideUrl } : live;
+    }
     throw new TopoloSdkError(
       "unknown_service",
       `Unknown Topolo service "${service}". Run service discovery first and pass a callable service id or slug.`
@@ -2218,10 +2222,7 @@ var TopoloClient = class _TopoloClient {
     const catalog = await this.listServices();
     const match = catalog.find((entry) => catalogEntryMatches(entry, serviceKey));
     if (!match?.baseUrl || !isCallableCatalogEntry(match)) return null;
-    return {
-      serviceKey: normalizeLookupKey(match.slug || match.name || match.serviceId) || serviceKey,
-      baseUrl: match.baseUrl
-    };
+    return { serviceKey, baseUrl: match.baseUrl };
   }
   /**
    * Resolve a service-slug → opaque service-id via caller config or TopoloAuth.
@@ -2283,53 +2284,55 @@ var TopoloClient = class _TopoloClient {
   /**
    * List the platform service catalog from the live registry
    * (`GET /api/services/catalog` on TopoloAuth). Credential-aware: the
-   * caller's credential is attached, so an authenticated caller in an
-   * entitled org also receives the `developer_only` services its role
-   * permits; an unauthenticated/agent caller receives `active` only.
+   * caller's credential is attached, so the result only includes services the
+   * credential's organization and effective permissions can use.
    *
-   * Resilient: on any network/HTTP failure this falls back to the
-   * build-time generated `APPLICATIONS` snapshot so offline/degraded
-   * callers still get a usable (if static) catalog. The live result is
-   * authoritative; the snapshot is a floor, not a cap.
+   * Security boundary: this never falls back to the generated global snapshot.
+   * The live Auth catalog is the authority because it is scoped to the caller's
+   * organization and effective permissions.
    */
   async listServices() {
     const now = Date.now();
     if (this.serviceCatalogCache && this.serviceCatalogCache.expiresAt > now) {
       return this.serviceCatalogCache.entries;
     }
-    try {
-      const res = await this.request({ service: "auth", method: "GET", path: "/api/services/catalog" });
-      const raw = res.data?.services ?? res.services;
-      if (Array.isArray(raw) && raw.length > 0) {
-        const entries = [];
-        for (const item of raw) {
-          const s = item;
-          const serviceId = typeof s.service_id === "string" ? s.service_id : typeof s.id === "string" ? s.id : null;
-          if (!serviceId) continue;
-          entries.push({
-            serviceId,
-            slug: typeof s.app_slug === "string" ? s.app_slug : null,
-            name: typeof s.name === "string" ? s.name : null,
-            description: typeof s.description === "string" ? s.description : null,
-            baseUrl: typeof s.base_url === "string" ? s.base_url : null,
-            status: typeof s.status === "string" ? s.status : null,
-            surfaceKind: typeof s.surface_kind === "string" ? s.surface_kind : null,
-            launchable: s.launchable === true
-          });
-        }
-        if (entries.length > 0) {
-          this.serviceCatalogCache = {
-            entries,
-            expiresAt: now + CATALOG_CACHE_TTL_MS
-          };
-          return entries;
-        }
-      }
-    } catch {
+    const res = await this.request({ service: "auth", method: "GET", path: "/api/services/catalog" });
+    const raw = res.data?.services ?? res.services;
+    if (!Array.isArray(raw)) {
+      throw new TopoloSdkError(
+        "service_catalog_unavailable",
+        "TopoloAuth did not return a service catalog for the current credential."
+      );
+    }
+    const entries = [];
+    for (const item of raw) {
+      const s = item;
+      const serviceId = typeof s.service_id === "string" ? s.service_id : typeof s.id === "string" ? s.id : null;
+      if (!serviceId) continue;
+      const permissions = Array.isArray(s.granted_permissions) ? s.granted_permissions.filter((permission) => typeof permission === "string" && permission.trim().length > 0) : [];
+      entries.push({
+        serviceId,
+        slug: typeof s.app_slug === "string" ? s.app_slug : null,
+        name: typeof s.name === "string" ? s.name : null,
+        description: typeof s.description === "string" ? s.description : null,
+        baseUrl: typeof s.base_url === "string" ? s.base_url : null,
+        status: typeof s.status === "string" ? s.status : null,
+        surfaceKind: typeof s.surface_kind === "string" ? s.surface_kind : null,
+        launchable: s.launchable === true,
+        permissions
+      });
     }
-    return this.generatedCatalogFallback();
+    this.serviceCatalogCache = {
+      entries,
+      expiresAt: now + CATALOG_CACHE_TTL_MS
+    };
+    return entries;
   }
-  generatedCatalogFallback() {
+  /**
+   * Bundled generated registry for tooling that audits platform packaging, not
+   * for deciding what the current credential may use.
+   */
+  listBundledServices() {
     const apps = Object.values(APPLICATIONS);
     return apps.map((app) => ({
       serviceId: app.id,
@@ -2337,9 +2340,10 @@ var TopoloClient = class _TopoloClient {
       name: app.name ?? app.id,
       description: null,
       baseUrl: app.productionUrl ?? null,
-      status: "active",
+      status: "bundled",
       surfaceKind: "application",
-      launchable: Boolean(app.productionUrl)
+      launchable: Boolean(app.productionUrl),
+      permissions: []
     }));
   }
   /**
@@ -2409,7 +2413,7 @@ function serviceKeyCandidates(slug) {
   ])];
 }
 function normalizeLookupKey(value) {
-  return String(value || "").trim().toLowerCase();
+  return String(value || "").trim().toLowerCase().replace(/\s+/g, "-");
 }
 function catalogEntryMatches(entry, needle) {
   return catalogEntryLookupKeys(entry).includes(needle);
@@ -2420,12 +2424,8 @@ function catalogEntryLookupKeys(entry) {
   for (const value of values) {
     const normalized = normalizeLookupKey(value);
     if (!normalized) continue;
-    keys.add(normalized);
-    keys.add(normalized.replace(/-/g, "_"));
-    if (normalized.startsWith("topolo-")) {
-      const withoutTopolo = normalized.slice("topolo-".length);
-      keys.add(withoutTopolo);
-      keys.add(withoutTopolo.replace(/-/g, "_"));
+    for (const candidate of serviceKeyCandidates(normalized)) {
+      keys.add(candidate);
     }
   }
   return [...keys];
@@ -2433,7 +2433,9 @@ function catalogEntryLookupKeys(entry) {
 function isCallableCatalogEntry(entry) {
   const kind = normalizeLookupKey(entry.surfaceKind || "");
   if (kind === "api" || kind === "technical_service" || kind === "service") return true;
-  return Boolean(entry.slug && Object.prototype.hasOwnProperty.call(DEFAULT_SERVICE_URLS, catalogEntryLookupKeys(entry)[0] ?? ""));
+  return Boolean(
+    entry.baseUrl && catalogEntryLookupKeys(entry).some((key) => Object.prototype.hasOwnProperty.call(DEFAULT_SERVICE_URLS, key))
+  );
 }
 function describeError(body, fallback) {
   if (body && typeof body === "object") {
@@ -6797,8 +6799,14 @@ function topoloAppManifestJson(application, options) {
         AUTH_BASE_URL: {
           staging: "https://auth.stg.topolo.us",
           production: "https://auth.topolo.app"
-        }
+        },
+        NEXUS_GATEWAY_URL: {
+          staging: "https://nexus-api.stg.topolo.us",
+          production: "https://nexus-api.topolo.app"
+        },
+        NEXUS_APP_ID: slug
       },
+      secrets: ["TOPOLO_SERVICE_CLIENT_SECRET"],
       ...Object.keys(bindings).length ? { bindings } : {}
     };
   }
@@ -7862,20 +7870,28 @@ var CLOUDCONTROL_LOCAL_APPLICATION = {
   deployTargets: []
 };
 function registerAppsCommand(program2) {
-  const apps = program2.command("apps").description("List every Topolo platform application known to the SDK catalog").option("--json", "Output JSON", true).option("--no-json", "Output human-readable table").action((opts) => {
+  const apps = program2.command("apps").description("List Topolo platform applications available to the current credential").option("--json", "Output JSON", true).option("--no-json", "Output human-readable table").action(async (opts) => {
     const mode = resolveOutputMode(opts.json);
     try {
-      const rows = applicationRows();
+      const topolo = await buildClient();
+      if (!topolo) {
+        throw new Error("No credential configured. Run `topolo auth login` or set TOPOLO_API_KEY.");
+      }
+      const rows = applicationRowsFromCatalog(await topolo.client.listServices());
       emit({ applications: rows }, mode, () => formatRows(rows));
     } catch (err) {
       fail(err, mode);
     }
   });
-  apps.command("get <application>").description("Show one Topolo application. Run `topolo apps --json` to discover application IDs.").option("--json", "Output JSON", true).option("--no-json", "Output human-readable details").action((application, opts) => {
+  apps.command("get <application>").description("Show one Topolo application available to the current credential.").option("--json", "Output JSON", true).option("--no-json", "Output human-readable details").action(async (application, opts) => {
     const mode = resolveOutputMode(opts.json);
     try {
-      const app = resolveApplication(application);
-      emit({ application: app }, mode, () => formatApplication(app));
+      const topolo = await buildClient();
+      if (!topolo) {
+        throw new Error("No credential configured. Run `topolo auth login` or set TOPOLO_API_KEY.");
+      }
+      const app = resolveCatalogApplication(await topolo.client.listServices(), application);
+      emit({ application: app }, mode, () => formatApplicationRow(app));
     } catch (err) {
       fail(err, mode);
     }
@@ -7983,19 +7999,27 @@ function registerAppsCommand(program2) {
     }
   });
 }
-function applicationRows() {
-  return APPLICATION_IDS.map((id) => {
-    const app = APPLICATIONS[id];
-    return {
-      id,
-      name: app.name,
-      appDir: app.appDir,
-      packageName: app.packageName,
-      productionUrl: app.productionUrl,
-      services: [...app.services],
-      deployTargets: app.deployTargets.length
-    };
-  });
+function applicationRowsFromCatalog(catalog) {
+  return catalog.filter((entry) => entry.launchable || entry.surfaceKind === "application").map((entry) => ({
+    id: displayCatalogId(entry),
+    name: entry.name ?? entry.slug ?? entry.serviceId,
+    appDir: "-",
+    packageName: null,
+    productionUrl: entry.baseUrl,
+    services: [displayCatalogId(entry)],
+    deployTargets: 0
+  })).sort((left, right) => left.id.localeCompare(right.id));
+}
+function resolveCatalogApplication(catalog, application) {
+  const needle = application.trim().toLowerCase();
+  const rows = applicationRowsFromCatalog(catalog);
+  const match = rows.find(
+    (row) => row.id.toLowerCase() === needle || row.name.toLowerCase() === needle || row.services.some((service) => service.toLowerCase() === needle)
+  );
+  if (!match) {
+    throw new Error(`Unknown application "${application}". Run \`topolo apps --json\` to discover applications available to this credential.`);
+  }
+  return match;
 }
 function resolveApplication(application) {
   const id = application.trim().toLowerCase();
@@ -8150,28 +8174,31 @@ function formatRows(rows) {
   }
   return lines.join("\n");
 }
-function formatApplication(application) {
-  const deployTargets = application.deployTargets;
-  const lines = [
+function formatApplicationRow(application) {
+  return [
     `ID: ${application.id}`,
     `Name: ${application.name}`,
-    `Directory: ${application.appDir}`,
-    `Package: ${application.packageName ?? "-"}`,
     `URL: ${application.productionUrl ?? "-"}`,
-    `Services: ${application.services.length ? application.services.join(", ") : "-"}`,
-    "Targets:"
-  ];
-  if (deployTargets.length === 0) {
-    lines.push("  - none");
-  } else {
-    for (const target of deployTargets) {
-      const parts = [`${target.name} (${target.kind})`];
-      if (target.serviceId) parts.push(`service=${target.serviceId}`);
-      if (target.apiUrl) parts.push(`api=${target.apiUrl}`);
-      lines.push(`  - ${parts.join(" ")}`);
-    }
+    `Services: ${application.services.length ? application.services.join(", ") : "-"}`
+  ].join("\n");
+}
+function displayCatalogId(entry) {
+  for (const value of [entry.slug, entry.name, entry.serviceId]) {
+    if (typeof value !== "string" || !value.trim()) continue;
+    const candidates = catalogIdCandidates(value);
+    const withoutTopolo = candidates.find((candidate) => !candidate.startsWith("topolo-"));
+    if (withoutTopolo) return withoutTopolo;
+    if (candidates[0]) return candidates[0];
   }
-  return lines.join("\n");
+  return entry.serviceId;
+}
+function catalogIdCandidates(value) {
+  const normalized = value.trim().toLowerCase().replace(/\s+/g, "-");
+  const withoutTopolo = normalized.startsWith("topolo-") ? normalized.slice("topolo-".length) : normalized;
+  return [.../* @__PURE__ */ new Set([
+    normalized,
+    withoutTopolo
+  ])].filter(Boolean);
 }
 function formatRequirements(payload) {
   const lines = [
@@ -8550,26 +8577,35 @@ function registerServicesCommand(program2) {
     try {
       const environment = selectedEnvironment();
       const config = await readConfig();
-      const rows = buildRows(config.serviceUrls, environment);
+      const topolo = await buildClient();
+      if (!topolo) {
+        throw new Error("No credential configured. Run `topolo auth login` or set TOPOLO_API_KEY.");
+      }
+      const rows = buildRows(await topolo.client.listServices(), config.serviceUrls, environment);
       emit({ environment, services: rows }, mode, () => formatRows2(rows, environment));
     } catch (err) {
       fail(err, mode);
     }
   });
 }
-function buildRows(overrides, environment = selectedEnvironment()) {
+function buildRows(catalog, overrides, environment = selectedEnvironment()) {
   const resolvedOverrides = resolveServiceUrls(overrides, environment);
-  return Object.keys(DEFAULT_SERVICE_URLS).sort().map((id) => {
-    const defaultUrl = DEFAULT_SERVICE_URLS[id];
-    const effectiveUrl = resolveServiceUrl(id, resolvedOverrides);
+  return catalog.map((entry) => {
+    const id = displayServiceId(entry);
+    const defaultUrl = defaultServiceUrl(id, entry.baseUrl);
+    const configuredUrl = configuredServiceUrl(id, resolvedOverrides);
+    const effectiveUrl = configuredUrl || defaultUrl;
     return {
       id,
+      serviceId: entry.serviceId,
+      slug: entry.slug,
       defaultUrl,
       effectiveUrl,
-      overridden: defaultUrl !== effectiveUrl,
-      environmentSafe: environment !== "staging" || isStagingUrl(effectiveUrl)
+      overridden: Boolean(configuredUrl && configuredUrl !== defaultUrl),
+      environmentSafe: environment !== "staging" || isStagingUrl(effectiveUrl),
+      permissions: [...entry.permissions]
     };
-  });
+  }).sort((left, right) => left.id.localeCompare(right.id));
 }
 function formatRows2(rows, environment = selectedEnvironment()) {
   const idWidth = Math.max(3, ...rows.map((r) => r.id.length));
@@ -8590,6 +8626,40 @@ function isStagingUrl(value) {
   const url = value.toLowerCase();
   return url.includes(".stg.topolo.us") || url.includes("localhost") || url.includes("127.0.0.1") || url.includes("topolo-staging");
 }
+function displayServiceId(entry) {
+  for (const value of [entry.slug, entry.name, entry.serviceId]) {
+    if (typeof value !== "string" || !value.trim()) continue;
+    for (const candidate of serviceIdCandidates(value)) {
+      if (Object.prototype.hasOwnProperty.call(DEFAULT_SERVICE_URLS, candidate)) {
+        return candidate;
+      }
+    }
+  }
+  return serviceIdCandidates(entry.slug || entry.serviceId)[0] || entry.serviceId;
+}
+function defaultServiceUrl(id, fallback) {
+  return fallback ?? DEFAULT_SERVICE_URLS[id] ?? "";
+}
+function configuredServiceUrl(id, overrides) {
+  if (!overrides) return null;
+  for (const candidate of serviceIdCandidates(id)) {
+    const direct = overrides[candidate];
+    if (direct) return direct;
+    const envStyle = overrides[candidate.replace(/\./g, "_")];
+    if (envStyle) return envStyle;
+  }
+  return null;
+}
+function serviceIdCandidates(value) {
+  const normalized = value.trim().toLowerCase().replace(/\s+/g, "-");
+  const withoutTopolo = normalized.startsWith("topolo-") ? normalized.slice("topolo-".length) : normalized;
+  return [.../* @__PURE__ */ new Set([
+    normalized,
+    normalized.replace(/-/g, "_"),
+    withoutTopolo,
+    withoutTopolo.replace(/-/g, "_")
+  ])].filter(Boolean);
+}
 
 // src/commands/seed.ts
 var DEFAULT_SEED_BASE_URL = "https://seed.stg.topolo.us";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topolo/cli",
-  "version": "0.1.24",
+  "version": "0.1.26",
   "description": "Command-line interface for Topolo developers, operators, and agents, with internal first-party scaffolding available under the topolo platform namespace.",
   "type": "module",
   "bin": {