@topolo/sdk 0.4.0 → 0.4.2

package/dist/index.d.cts

@@ -31,9 +31,177 @@ interface AgentIdentity {
     agentName?: string;
 }
 
+interface TopoloClientOptions {
+    credential: TopoloCredential;
+    agent: AgentIdentity;
+    /** Per-service URL overrides. Useful for staging/dev. */
+    serviceUrls?: Record<string, string>;
+    /** Per-service TopoloAuth service id overrides from the owning app/deployment. */
+    serviceIds?: Record<string, string>;
+    /**
+     * When true, mutating helpers (POST/PUT/PATCH/DELETE) require callers to pass
+     * `{ confirm: true }`. Defaults to true. Set false only for trusted surfaces.
+     */
+    requireConfirmForWrites?: boolean;
+    /** HTTP request timeout (ms). Default 30s. */
+    timeoutMs?: number;
+    /** Injected fetch, for testing. Defaults to global fetch. */
+    fetch?: typeof fetch;
+    /**
+     * Observability hook. Fires once per request lifecycle (`request` at start,
+     * then exactly one of `response` or `error`). Safe to leave unset — off by
+     * default. Intended for CLI/MCP hosts to surface request-level diagnostics
+     * and for consumers building their own logging/tracing.
+     */
+    debug?: (event: TopoloDebugEvent) => void;
+}
+type TopoloDebugEvent = {
+    phase: 'request';
+    method: string;
+    service: string;
+    path: string;
+    url: string;
+    requestId: string;
+} | {
+    phase: 'response';
+    method: string;
+    service: string;
+    path: string;
+    url: string;
+    requestId: string;
+    status: number;
+    durationMs: number;
+} | {
+    phase: 'error';
+    method: string;
+    service: string;
+    path: string;
+    url: string;
+    requestId: string;
+    durationMs: number;
+    error: string;
+    status?: number;
+};
+interface RequestOptions {
+    service: string;
+    path: string;
+    method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+    query?: Record<string, string | number | boolean | undefined>;
+    body?: unknown;
+    /** Explicit write-acknowledgement for mutating calls. */
+    confirm?: boolean;
+    /** Extra headers appended after auth/audit headers. */
+    headers?: Record<string, string>;
+    signal?: AbortSignal;
+}
+/**
+ * A single entry from the live platform service catalog. Returned by
+ * {@link TopoloClient.listServices}. Shape mirrors the public-safe projection
+ * from TopoloAuth `GET /api/services/catalog`.
+ */
+interface TopoloServiceCatalogEntry {
+    serviceId: string;
+    slug: string | null;
+    name: string | null;
+    description: string | null;
+    baseUrl: string | null;
+    status: string | null;
+    surfaceKind: string | null;
+    launchable: boolean;
+    permissions: string[];
+}
+declare class TopoloClient {
+    private readonly credential;
+    private readonly agent;
+    private readonly serviceUrls?;
+    private readonly serviceIds?;
+    private readonly requireConfirmForWrites;
+    private readonly timeoutMs;
+    private readonly fetchImpl;
+    private readonly debug?;
+    private serviceCatalogCache;
+    /**
+     * Process-wide cache for slug → service-id lookups. Keyed by
+     * `${authBaseUrl}|${slug}` so multiple `TopoloClient` instances pointing at
+     * the same Auth share, but staging vs prod don't poison each other.
+     * Cleared via `TopoloClient.clearServiceIdCache()` if a test needs it.
+     */
+    private static readonly serviceIdCache;
+    /**
+     * Drop the slug→service-id cache. Test-only — production callers should
+     * let the 5-minute TTL expire naturally.
+     */
+    static clearServiceIdCache(): void;
+    constructor(options: TopoloClientOptions);
+    private emit;
+    /**
+     * Low-level JSON request. Prefer the typed module helpers (identity, crm, ...)
+     * for anything a caller would reach for; this stays exported for escape-hatch
+     * use and for the generic `topolo api` / MCP passthrough tool.
+     */
+    request<T = unknown>(opts: RequestOptions): Promise<T>;
+    private resolveRequestService;
+    private resolveLiveCallableService;
+    /**
+     * Resolve a service-slug → opaque service-id via caller config or TopoloAuth.
+     *
+     * Cache: 5 minutes per process per `(slug, auth_base_url)`. Negative
+     * results (404) are cached for 60s so a typo doesn't hot-loop the
+     * resolver. Returns null when the slug isn't registered — callers decide
+     * whether to throw.
+     *
+     * No credential is sent: the endpoint is public (slugs aren't secret).
+     * This keeps the resolver usable during early bootstrap before a caller
+     * has acquired an access token.
+     */
+    getServiceIdBySlug(slug: string): Promise<string | null>;
+    /**
+     * List the platform service catalog from the live registry
+     * (`GET /api/services/catalog` on TopoloAuth). Credential-aware: the
+     * caller's credential is attached, so the result only includes services the
+     * credential's organization and effective permissions can use.
+     *
+     * Security boundary: this never falls back to the generated global snapshot.
+     * The live Auth catalog is the authority because it is scoped to the caller's
+     * organization and effective permissions.
+     */
+    listServices(): Promise<TopoloServiceCatalogEntry[]>;
+    /**
+     * Bundled generated registry for tooling that audits platform packaging, not
+     * for deciding what the current credential may use.
+     */
+    listBundledServices(): TopoloServiceCatalogEntry[];
+    /**
+     * Introspect the current credential. Returns the caller's resolved identity,
+     * organization, and permission set. Used by CLI `whoami` and by MCP to gate
+     * advertised tools by scope.
+     *
+     * Both JWT access tokens and platform API keys are resolved via the unified
+     * `GET /api/auth/me` endpoint on TopoloAuth, which does not require service
+     * credentials. The caller's possession of the credential secret is proof.
+     */
+    introspect(): Promise<CredentialIntrospection>;
+}
+interface CredentialIntrospection {
+    kind: 'api_key' | 'access_token';
+    user: {
+        id: string;
+        email: string;
+        name: string | null;
+        role: string;
+        permissions: string[];
+    };
+    organization: {
+        id: string;
+        slug: string;
+        name: string;
+    } | null;
+}
+
 declare const SERVICES: {
     readonly agent: "https://agent-api.topolo.app";
     readonly auth: "https://auth.topolo.app";
+    readonly backup: "https://backup.topolo.app";
     readonly books: "https://books.topolo.app";
     readonly bugfix: "https://bugfix.topolo.app";
     readonly bytes: "https://bytes-api.topolo.app";
@@ -44,7 +212,6 @@ declare const SERVICES: {
     readonly compose: "https://compose.topolo.app";
     readonly consent: "https://consent.topolo.app";
     readonly crm: "https://crm-api.topolo.app";
-    readonly customer_success: "https://success.topolo.app";
     readonly developers: "https://developers.topolo.app";
     readonly director: "https://director.topolo.app";
     readonly feed: "https://feed-api.topolo.app";
@@ -58,9 +225,10 @@ declare const SERVICES: {
     readonly localize: "https://localize.topolo.app";
     readonly mail: "https://mail.topolo.app";
     readonly mdm: "https://mdm-api.topolo.app";
-    readonly messaging: "https://messages.topolo.app";
+    readonly messages: "https://messages.topolo.app";
     readonly nexus: "https://nexus-api.topolo.app";
     readonly notify: "https://notify.topolo.app";
+    readonly observability_watch: "https://observability-watch.topolo.app";
     readonly one: "https://one.topolo.app";
     readonly p2p: "https://p2p.topolo.app";
     readonly pay: "https://pay.topolo.app";
@@ -74,6 +242,7 @@ declare const SERVICES: {
     readonly socialize: "https://socialize-api.topolo.app";
     readonly spaces: "https://spaces.topolo.app";
     readonly status: "https://status.topolo.app";
+    readonly success: "https://success.topolo.app";
     readonly support: "https://support.topolo.app";
     readonly survey: "https://survey.topolo.app";
     readonly voice: "https://voice.topolo.app";
@@ -91,11 +260,18 @@ declare const APPLICATIONS: {
         readonly services: readonly [];
         readonly deployTargets: readonly [{
             readonly name: "topolo-admin";
-            readonly kind: "pages";
-            readonly apiUrl: null;
+            readonly kind: "worker";
+            readonly apiUrl: "https://admin.topolo.app";
             readonly domains: readonly ["admin.topolo.app"];
             readonly routes: readonly [];
             readonly serviceId: null;
+        }, {
+            readonly name: "topolo-admin-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly serviceId: null;
         }];
     };
     readonly agent: {
@@ -108,12 +284,12 @@ declare const APPLICATIONS: {
         readonly deployTargets: readonly [{
             readonly name: "topolo-agent";
             readonly kind: "worker";
-            readonly apiUrl: null;
+            readonly apiUrl: "https://agent.topolo.app";
             readonly domains: readonly ["agent.topolo.app"];
             readonly routes: readonly [];
             readonly serviceId: null;
         }, {
-            readonly name: "topolo-agent-worker";
+            readonly name: "topolo-agent-api";
             readonly kind: "worker";
             readonly apiUrl: "https://agent-api.topolo.app";
             readonly domains: readonly ["agent-api.topolo.app"];
@@ -142,15 +318,15 @@ declare const APPLICATIONS: {
         readonly appDir: "TopoloBackup";
         readonly name: "topolo-backup";
         readonly packageName: "topolo-backup";
-        readonly productionUrl: null;
-        readonly services: readonly [];
+        readonly productionUrl: "https://backup.topolo.app";
+        readonly services: readonly ["backup"];
         readonly deployTargets: readonly [{
             readonly name: "topolo-backup";
             readonly kind: "worker";
-            readonly apiUrl: null;
-            readonly domains: readonly [];
+            readonly apiUrl: "https://backup.topolo.app";
+            readonly domains: readonly ["backup.topolo.app"];
             readonly routes: readonly [];
-            readonly serviceId: null;
+            readonly serviceId: "backup";
         }];
     };
     readonly books: {
@@ -165,8 +341,15 @@ declare const APPLICATIONS: {
             readonly kind: "worker";
             readonly apiUrl: "https://books.topolo.app";
             readonly domains: readonly ["books.topolo.app"];
-            readonly routes: readonly ["books.topolo.app"];
+            readonly routes: readonly [];
             readonly serviceId: "books";
+        }, {
+            readonly name: "topolo-books-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly serviceId: null;
         }];
     };
     readonly bugfix: {
@@ -181,7 +364,7 @@ declare const APPLICATIONS: {
             readonly kind: "worker";
             readonly apiUrl: "https://bugfix.topolo.app";
             readonly domains: readonly ["bugfix.topolo.app"];
-            readonly routes: readonly ["bugfix.topolo.app"];
+            readonly routes: readonly [];
             readonly serviceId: "bugfix";
         }];
     };
@@ -194,8 +377,8 @@ declare const APPLICATIONS: {
         readonly services: readonly ["bytes"];
         readonly deployTargets: readonly [{
             readonly name: "topolo-bytes";
-            readonly kind: "pages";
-            readonly apiUrl: null;
+            readonly kind: "worker";
+            readonly apiUrl: "https://bytes.topolo.app";
             readonly domains: readonly ["bytes.topolo.app"];
             readonly routes: readonly [];
             readonly serviceId: null;
@@ -220,8 +403,15 @@ declare const APPLICATIONS: {
             readonly kind: "worker";
             readonly apiUrl: "https://calendar.topolo.app";
             readonly domains: readonly ["calendar.topolo.app"];
-            readonly routes: readonly ["calendar.topolo.app"];
+            readonly routes: readonly [];
             readonly serviceId: "calendar";
+        }, {
+            readonly name: "topolo-calendar-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly serviceId: null;
         }];
     };
     readonly capacity: {
@@ -252,19 +442,17 @@ declare const APPLICATIONS: {
             readonly kind: "worker";
             readonly apiUrl: "https://chat.topolo.app";
             readonly domains: readonly ["chat.topolo.app"];
-            readonly routes: readonly ["chat.topolo.app"];
+            readonly routes: readonly [];
             readonly serviceId: "chat";
+        }, {
+            readonly name: "topolo-chat-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly serviceId: null;
         }];
     };
-    readonly cloudcontrol: {
-        readonly id: "cloudcontrol";
-        readonly appDir: "TopoloCloudControl";
-        readonly name: "cloudcontrol";
-        readonly packageName: "topolo-cloudcontrol";
-        readonly productionUrl: null;
-        readonly services: readonly [];
-        readonly deployTargets: readonly [];
-    };
     readonly commerce: {
         readonly id: "commerce";
         readonly appDir: "TopoloCommerce";
@@ -281,22 +469,22 @@ declare const APPLICATIONS: {
             readonly serviceId: "commerce";
         }, {
             readonly name: "topolo-commerce-guest-web";
-            readonly kind: "pages";
-            readonly apiUrl: null;
+            readonly kind: "worker";
+            readonly apiUrl: "https://guest.topolo.app";
             readonly domains: readonly ["guest.topolo.app"];
             readonly routes: readonly [];
             readonly serviceId: null;
         }, {
             readonly name: "topolo-commerce-ops-web";
-            readonly kind: "pages";
-            readonly apiUrl: null;
+            readonly kind: "worker";
+            readonly apiUrl: "https://commerce.topolo.app";
             readonly domains: readonly ["commerce.topolo.app"];
             readonly routes: readonly [];
             readonly serviceId: null;
         }, {
             readonly name: "topolo-commerce-station-web";
-            readonly kind: "pages";
-            readonly apiUrl: null;
+            readonly kind: "worker";
+            readonly apiUrl: "https://station-commerce.topolo.app";
             readonly domains: readonly ["station-commerce.topolo.app"];
             readonly routes: readonly [];
             readonly serviceId: null;
@@ -314,8 +502,15 @@ declare const APPLICATIONS: {
             readonly kind: "worker";
             readonly apiUrl: "https://compose.topolo.app";
             readonly domains: readonly ["compose.topolo.app"];
-            readonly routes: readonly ["compose.topolo.app"];
+            readonly routes: readonly [];
             readonly serviceId: "compose";
+        }, {
+            readonly name: "topolo-compose-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly serviceId: null;
         }];
     };
     readonly consent: {
@@ -330,8 +525,15 @@ declare const APPLICATIONS: {
             readonly kind: "worker";
             readonly apiUrl: "https://consent.topolo.app";
             readonly domains: readonly ["consent.topolo.app"];
-            readonly routes: readonly ["consent.topolo.app"];
+            readonly routes: readonly [];
             readonly serviceId: "consent";
+        }, {
+            readonly name: "topolo-consent-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly serviceId: null;
         }];
     };
     readonly crm: {
@@ -351,28 +553,12 @@ declare const APPLICATIONS: {
         }, {
             readonly name: "topolo-crm-app";
             readonly kind: "worker";
-            readonly apiUrl: null;
+            readonly apiUrl: "https://crm.topolo.app";
             readonly domains: readonly ["crm.topolo.app"];
             readonly routes: readonly [];
             readonly serviceId: null;
         }];
     };
-    readonly customer_success: {
-        readonly id: "customer_success";
-        readonly appDir: "TopoloSuccess";
-        readonly name: "topolo-success";
-        readonly packageName: "topolo-success";
-        readonly productionUrl: "https://success.topolo.app";
-        readonly services: readonly ["customer_success"];
-        readonly deployTargets: readonly [{
-            readonly name: "topolo-success";
-            readonly kind: "worker";
-            readonly apiUrl: "https://success.topolo.app";
-            readonly domains: readonly ["success.topolo.app"];
-            readonly routes: readonly ["success.topolo.app"];
-            readonly serviceId: "customer_success";
-        }];
-    };
     readonly developers: {
         readonly id: "developers";
         readonly appDir: "TopoloDevelopers";
@@ -394,6 +580,13 @@ declare const APPLICATIONS: {
             readonly domains: readonly ["developers.topolo.app"];
             readonly routes: readonly [];
             readonly serviceId: "developers";
+        }, {
+            readonly name: "topolo-developers-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly serviceId: null;
         }];
     };
     readonly director: {
@@ -408,8 +601,15 @@ declare const APPLICATIONS: {
             readonly kind: "worker";
             readonly apiUrl: "https://director.topolo.app";
             readonly domains: readonly ["director.topolo.app"];
-            readonly routes: readonly ["director.topolo.app"];
+            readonly routes: readonly [];
             readonly serviceId: "director";
+        }, {
+            readonly name: "topolo-director-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly serviceId: null;
         }];
     };
     readonly docs: {
@@ -421,11 +621,18 @@ declare const APPLICATIONS: {
         readonly services: readonly [];
         readonly deployTargets: readonly [{
             readonly name: "topolo-docs";
-            readonly kind: "pages";
-            readonly apiUrl: null;
+            readonly kind: "worker";
+            readonly apiUrl: "https://docs.topolo.app";
             readonly domains: readonly ["docs.topolo.app"];
             readonly routes: readonly [];
             readonly serviceId: null;
+        }, {
+            readonly name: "topolo-docs-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly serviceId: null;
         }];
     };
     readonly feed: {
@@ -433,22 +640,29 @@ declare const APPLICATIONS: {
         readonly appDir: "TopoloFeed";
         readonly name: "TopoloFeed";
         readonly packageName: "topolo-feed";
-        readonly productionUrl: "https://feed-api.topolo.app";
+        readonly productionUrl: "https://feed.topolo.app";
         readonly services: readonly ["feed"];
         readonly deployTargets: readonly [{
             readonly name: "topolo-feed-analytics-api";
             readonly kind: "worker";
             readonly apiUrl: "https://feed-analytics-api.topolo.app";
             readonly domains: readonly ["feed-analytics-api.topolo.app"];
-            readonly routes: readonly ["feed-analytics-api.topolo.app"];
+            readonly routes: readonly [];
             readonly serviceId: null;
         }, {
             readonly name: "topolo-feed-api";
             readonly kind: "worker";
             readonly apiUrl: "https://feed-api.topolo.app";
             readonly domains: readonly ["feed-api.topolo.app"];
-            readonly routes: readonly ["feed-api.topolo.app"];
+            readonly routes: readonly [];
             readonly serviceId: "feed";
+        }, {
+            readonly name: "topolo-feed-web";
+            readonly kind: "worker";
+            readonly apiUrl: "https://feed.topolo.app";
+            readonly domains: readonly ["feed.topolo.app"];
+            readonly routes: readonly [];
+            readonly serviceId: null;
         }];
     };
     readonly flow: {
@@ -463,21 +677,28 @@ declare const APPLICATIONS: {
             readonly kind: "worker";
             readonly apiUrl: "https://flow.topolo.app";
             readonly domains: readonly ["flow.topolo.app"];
-            readonly routes: readonly ["flow.topolo.app"];
+            readonly routes: readonly [];
             readonly serviceId: "flow";
+        }, {
+            readonly name: "topolo-flow-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly serviceId: null;
         }];
     };
     readonly forecast: {
         readonly id: "forecast";
         readonly appDir: "TopoloForecast";
-        readonly name: "forecast-cloud";
+        readonly name: "topolo-forecast";
         readonly packageName: "topolo-forecast";
         readonly productionUrl: "https://forecast.topolo.app";
         readonly services: readonly ["forecast"];
         readonly deployTargets: readonly [{
             readonly name: "topolo-forecast";
             readonly kind: "worker";
-            readonly apiUrl: null;
+            readonly apiUrl: "https://forecast.topolo.app";
             readonly domains: readonly ["forecast.topolo.app"];
             readonly routes: readonly [];
             readonly serviceId: null;
@@ -502,8 +723,15 @@ declare const APPLICATIONS: {
             readonly kind: "worker";
             readonly apiUrl: "https://forms.topolo.app";
             readonly domains: readonly ["forms.topolo.app"];
-            readonly routes: readonly ["forms.topolo.app"];
+            readonly routes: readonly [];
             readonly serviceId: "forms";
+        }, {
+            readonly name: "topolo-forms-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly serviceId: null;
         }];
     };
     readonly home: {
@@ -518,8 +746,15 @@ declare const APPLICATIONS: {
             readonly kind: "worker";
             readonly apiUrl: "https://home.topolo.app";
             readonly domains: readonly ["home.topolo.app"];
-            readonly routes: readonly ["home.topolo.app"];
+            readonly routes: readonly [];
             readonly serviceId: "home";
+        }, {
+            readonly name: "topolo-home-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly serviceId: null;
         }];
     };
     readonly insights: {
@@ -534,8 +769,15 @@ declare const APPLICATIONS: {
             readonly kind: "worker";
             readonly apiUrl: "https://insights.topolo.app";
             readonly domains: readonly ["insights.topolo.app"];
-            readonly routes: readonly ["insights.topolo.app"];
+            readonly routes: readonly [];
             readonly serviceId: "insights";
+        }, {
+            readonly name: "topolo-insights-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly serviceId: null;
         }];
     };
     readonly inventory: {
@@ -550,8 +792,15 @@ declare const APPLICATIONS: {
             readonly kind: "worker";
             readonly apiUrl: "https://inventory.topolo.app";
             readonly domains: readonly ["inventory.topolo.app"];
-            readonly routes: readonly ["inventory.topolo.app"];
+            readonly routes: readonly [];
             readonly serviceId: "inventory";
+        }, {
+            readonly name: "topolo-inventory-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly serviceId: null;
         }];
     };
     readonly learn: {
@@ -564,7 +813,7 @@ declare const APPLICATIONS: {
         readonly deployTargets: readonly [{
             readonly name: "topolo-learn";
             readonly kind: "worker";
-            readonly apiUrl: null;
+            readonly apiUrl: "https://learn.topolo.app";
             readonly domains: readonly ["learn.topolo.app"];
             readonly routes: readonly [];
             readonly serviceId: null;
@@ -605,8 +854,15 @@ declare const APPLICATIONS: {
             readonly kind: "worker";
             readonly apiUrl: "https://mail.topolo.app";
             readonly domains: readonly ["mail.topolo.app"];
-            readonly routes: readonly ["mail.topolo.app"];
+            readonly routes: readonly [];
             readonly serviceId: "mail";
+        }, {
+            readonly name: "topolo-mail-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly serviceId: null;
         }];
     };
     readonly mdm: {
@@ -621,33 +877,40 @@ declare const APPLICATIONS: {
             readonly kind: "worker";
             readonly apiUrl: "https://mdm-api.topolo.app";
             readonly domains: readonly ["mdm-api.topolo.app"];
-            readonly routes: readonly ["mdm-api.topolo.app"];
+            readonly routes: readonly [];
             readonly serviceId: "mdm";
         }, {
             readonly name: "topolo-mdm-console";
             readonly kind: "worker";
-            readonly apiUrl: null;
+            readonly apiUrl: "https://mdm.topolo.app";
             readonly domains: readonly ["mdm.topolo.app"];
-            readonly routes: readonly ["mdm.topolo.app"];
+            readonly routes: readonly [];
             readonly serviceId: null;
         }];
     };
-    readonly messaging: {
-        readonly id: "messaging";
-        readonly appDir: "TopoloMessaging";
-        readonly name: "topolo-messaging";
-        readonly packageName: "topolo-messaging";
+    readonly messages: {
+        readonly id: "messages";
+        readonly appDir: "TopoloMessages";
+        readonly name: "topolo-messages";
+        readonly packageName: "topolo-messages";
         readonly productionUrl: "https://messages.topolo.app";
-        readonly services: readonly ["messaging"];
+        readonly services: readonly ["messages"];
         readonly deployTargets: readonly [{
-            readonly name: "topolo-messaging";
+            readonly name: "topolo-messages";
             readonly kind: "worker";
             readonly apiUrl: "https://messages.topolo.app";
             readonly domains: readonly ["messages.topolo.app"];
             readonly routes: readonly [];
-            readonly serviceId: "messaging";
+            readonly serviceId: "messages";
+        }, {
+            readonly name: "topolo-messages-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly serviceId: null;
         }, {
-            readonly name: "topolo-messaging-dispatch";
+            readonly name: "topolo-messages-dispatch";
             readonly kind: "worker";
             readonly apiUrl: null;
             readonly domains: readonly [];
@@ -699,9 +962,16 @@ declare const APPLICATIONS: {
         readonly appDir: "TopoloObservabilityWatch";
         readonly name: "topolo-observability-watch";
         readonly packageName: "topolo-observability-watch";
-        readonly productionUrl: null;
-        readonly services: readonly [];
-        readonly deployTargets: readonly [];
+        readonly productionUrl: "https://observability-watch.topolo.app";
+        readonly services: readonly ["observability_watch"];
+        readonly deployTargets: readonly [{
+            readonly name: "topolo-observability-watch";
+            readonly kind: "worker";
+            readonly apiUrl: "https://observability-watch.topolo.app";
+            readonly domains: readonly ["observability-watch.topolo.app"];
+            readonly routes: readonly [];
+            readonly serviceId: "observability_watch";
+        }];
     };
     readonly one: {
         readonly id: "one";
@@ -712,25 +982,25 @@ declare const APPLICATIONS: {
         readonly services: readonly ["one"];
         readonly deployTargets: readonly [{
             readonly name: "topolo-one";
-            readonly kind: "pages";
-            readonly apiUrl: null;
-            readonly domains: readonly ["one.topolo.app"];
-            readonly routes: readonly [];
-            readonly serviceId: null;
-        }, {
-            readonly name: "topolo-one-website";
             readonly kind: "worker";
             readonly apiUrl: null;
-            readonly domains: readonly ["topolo.io", "www.topolo.io"];
+            readonly domains: readonly [];
             readonly routes: readonly [];
             readonly serviceId: null;
         }, {
-            readonly name: "topolo-one-worker";
+            readonly name: "topolo-one-api";
             readonly kind: "worker";
             readonly apiUrl: "https://one.topolo.app";
-            readonly domains: readonly ["one.topolo.app", "topolo.app", "www.topolo.app"];
-            readonly routes: readonly ["one.topolo.app/*", "topolo.app", "www.topolo.app/*"];
+            readonly domains: readonly ["one.topolo.app"];
+            readonly routes: readonly ["one.topolo.app/*", "www.topolo.app/*"];
             readonly serviceId: "one";
+        }, {
+            readonly name: "topolo-one-website";
+            readonly kind: "worker";
+            readonly apiUrl: "https://topolo.io";
+            readonly domains: readonly ["topolo.io"];
+            readonly routes: readonly ["topolo.io", "www.topolo.io"];
+            readonly serviceId: null;
         }];
     };
     readonly p2p: {
@@ -745,8 +1015,15 @@ declare const APPLICATIONS: {
             readonly kind: "worker";
             readonly apiUrl: "https://p2p.topolo.app";
             readonly domains: readonly ["p2p.topolo.app"];
-            readonly routes: readonly ["p2p.topolo.app"];
+            readonly routes: readonly [];
             readonly serviceId: "p2p";
+        }, {
+            readonly name: "topolo-p2p-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly serviceId: null;
         }];
     };
     readonly pay: {
@@ -763,6 +1040,13 @@ declare const APPLICATIONS: {
             readonly domains: readonly ["pay.topolo.app"];
             readonly routes: readonly [];
             readonly serviceId: "pay";
+        }, {
+            readonly name: "topolo-pay-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly serviceId: null;
         }];
     };
     readonly people: {
@@ -777,8 +1061,15 @@ declare const APPLICATIONS: {
             readonly kind: "worker";
             readonly apiUrl: "https://people.topolo.app";
             readonly domains: readonly ["people.topolo.app"];
-            readonly routes: readonly ["people.topolo.app"];
+            readonly routes: readonly [];
             readonly serviceId: "people";
+        }, {
+            readonly name: "topolo-people-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly serviceId: null;
         }];
     };
     readonly pulse: {
@@ -793,8 +1084,15 @@ declare const APPLICATIONS: {
             readonly kind: "worker";
             readonly apiUrl: "https://pulse.topolo.app";
             readonly domains: readonly ["pulse.topolo.app"];
-            readonly routes: readonly ["pulse.topolo.app"];
+            readonly routes: readonly [];
             readonly serviceId: "pulse";
+        }, {
+            readonly name: "topolo-pulse-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly serviceId: null;
         }];
     };
     readonly quro: {
@@ -809,7 +1107,7 @@ declare const APPLICATIONS: {
             readonly kind: "worker";
             readonly apiUrl: "https://api.ol0.me";
             readonly domains: readonly ["api.ol0.me"];
-            readonly routes: readonly [];
+            readonly routes: readonly ["api.ol0.me/*"];
             readonly serviceId: "quro.api";
         }, {
             readonly name: "quro-redirect-system";
@@ -821,7 +1119,7 @@ declare const APPLICATIONS: {
         }, {
             readonly name: "quro-ui";
             readonly kind: "worker";
-            readonly apiUrl: null;
+            readonly apiUrl: "https://quro.topolo.app";
             readonly domains: readonly ["quro.topolo.app"];
             readonly routes: readonly [];
             readonly serviceId: null;
@@ -837,7 +1135,7 @@ declare const APPLICATIONS: {
         readonly deployTargets: readonly [{
             readonly name: "topolo-roadmapper";
             readonly kind: "worker";
-            readonly apiUrl: null;
+            readonly apiUrl: "https://roadmapper.topolo.app";
             readonly domains: readonly ["roadmapper.topolo.app"];
             readonly routes: readonly [];
             readonly serviceId: null;
@@ -862,8 +1160,15 @@ declare const APPLICATIONS: {
             readonly kind: "worker";
             readonly apiUrl: "https://sign.topolo.app";
             readonly domains: readonly ["sign.topolo.app"];
-            readonly routes: readonly ["sign.topolo.app"];
+            readonly routes: readonly [];
             readonly serviceId: "sign";
+        }, {
+            readonly name: "topolo-sign-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly serviceId: null;
         }];
     };
     readonly social_studio: {
@@ -876,7 +1181,7 @@ declare const APPLICATIONS: {
         readonly deployTargets: readonly [{
             readonly name: "topolo-social-studio";
             readonly kind: "worker";
-            readonly apiUrl: null;
+            readonly apiUrl: "https://studio.topolo.app";
             readonly domains: readonly ["studio.topolo.app"];
             readonly routes: readonly [];
             readonly serviceId: null;
@@ -905,8 +1210,8 @@ declare const APPLICATIONS: {
         readonly services: readonly ["socialize"];
         readonly deployTargets: readonly [{
             readonly name: "topolo-socialize";
-            readonly kind: "pages";
-            readonly apiUrl: null;
+            readonly kind: "worker";
+            readonly apiUrl: "https://socialize.topolo.app";
             readonly domains: readonly ["socialize.topolo.app"];
             readonly routes: readonly [];
             readonly serviceId: null;
@@ -938,8 +1243,15 @@ declare const APPLICATIONS: {
             readonly kind: "worker";
             readonly apiUrl: "https://spaces.topolo.app";
             readonly domains: readonly ["spaces.topolo.app"];
-            readonly routes: readonly ["spaces.topolo.app"];
+            readonly routes: readonly [];
             readonly serviceId: "spaces";
+        }, {
+            readonly name: "topolo-spaces-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly serviceId: null;
         }];
     };
     readonly status: {
@@ -954,10 +1266,33 @@ declare const APPLICATIONS: {
             readonly kind: "worker";
             readonly apiUrl: "https://status.topolo.app";
             readonly domains: readonly ["status.topolo.app"];
-            readonly routes: readonly ["status.topolo.app"];
+            readonly routes: readonly [];
             readonly serviceId: "status";
         }];
     };
+    readonly success: {
+        readonly id: "success";
+        readonly appDir: "TopoloSuccess";
+        readonly name: "topolo-success";
+        readonly packageName: "topolo-success";
+        readonly productionUrl: "https://success.topolo.app";
+        readonly services: readonly ["success"];
+        readonly deployTargets: readonly [{
+            readonly name: "topolo-success";
+            readonly kind: "worker";
+            readonly apiUrl: "https://success.topolo.app";
+            readonly domains: readonly ["success.topolo.app"];
+            readonly routes: readonly ["success.topolo.app"];
+            readonly serviceId: "success";
+        }, {
+            readonly name: "topolo-success-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly serviceId: null;
+        }];
+    };
     readonly support: {
         readonly id: "support";
         readonly appDir: "TopoloSupport";
@@ -972,6 +1307,13 @@ declare const APPLICATIONS: {
             readonly domains: readonly ["support.topolo.app"];
             readonly routes: readonly ["support.topolo.app/*"];
             readonly serviceId: "support";
+        }, {
+            readonly name: "topolo-support-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly serviceId: null;
         }];
     };
     readonly survey: {
@@ -986,8 +1328,15 @@ declare const APPLICATIONS: {
             readonly kind: "worker";
             readonly apiUrl: "https://survey.topolo.app";
             readonly domains: readonly ["survey.topolo.app"];
-            readonly routes: readonly ["survey.topolo.app"];
+            readonly routes: readonly [];
             readonly serviceId: "survey";
+        }, {
+            readonly name: "topolo-survey-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly serviceId: null;
         }];
     };
     readonly voice: {
@@ -1002,8 +1351,15 @@ declare const APPLICATIONS: {
             readonly kind: "worker";
             readonly apiUrl: "https://voice.topolo.app";
             readonly domains: readonly ["voice.topolo.app"];
-            readonly routes: readonly ["voice.topolo.app"];
+            readonly routes: readonly [];
             readonly serviceId: "voice";
+        }, {
+            readonly name: "topolo-voice-api";
+            readonly kind: "worker";
+            readonly apiUrl: null;
+            readonly domains: readonly [];
+            readonly routes: readonly [];
+            readonly serviceId: null;
         }];
     };
     readonly web: {
@@ -1025,12 +1381,12 @@ declare const APPLICATIONS: {
             readonly kind: "worker";
             readonly apiUrl: "https://sites.topolo.app";
             readonly domains: readonly ["sites.topolo.app"];
-            readonly routes: readonly [];
+            readonly routes: readonly ["*.sites.topolo.app/*", "sites.topolo.app"];
             readonly serviceId: null;
         }, {
             readonly name: "topolo-web-studio";
             readonly kind: "worker";
-            readonly apiUrl: null;
+            readonly apiUrl: "https://web.topolo.app";
             readonly domains: readonly ["web.topolo.app"];
             readonly routes: readonly [];
             readonly serviceId: null;
@@ -1122,8 +1478,8 @@ declare const APPLICATION_REQUIREMENTS: readonly [{
     readonly title: "Register protected APIs as platform services";
     readonly summary: "Callable app APIs need a stable service ID, service slug, permissions, role bundles, and API-key scopes before agents or users rely on them.";
     readonly appliesTo: readonly ["api"];
-    readonly evidence: readonly ["Auth service catalog contains the service ID and slug", "Permissions, role bundles, and API-key scopes exist for the service", "SDK, CLI, and MCP service discovery include the callable production API"];
-    readonly implementation: readonly ["Add production Worker api_url metadata before adding an SDK service ID", "Expose stable service IDs through DEFAULT_SERVICE_URLS", "Keep typed SDK/CLI/MCP surfaces in sync when an API contract stabilizes"];
+    readonly evidence: readonly ["Auth service catalog contains the service ID and slug", "Permissions, role bundles, and API-key scopes exist for the service", "SDK, CLI, and MCP service discovery include the callable production API", "CloudControl production HTTP targets classify agent reachability with sdk_service_id or agent_callable:false"];
+    readonly implementation: readonly ["Add production Worker api_url metadata and sdk_service_id for every agent-callable API target", "Mark browser, documentation, and runtime-only Worker targets with agent_callable:false", "Expose stable service IDs through generated DEFAULT_SERVICE_URLS and live catalog discovery", "Keep typed SDK/CLI/MCP surfaces in sync when an API contract stabilizes"];
 }, {
     readonly id: "organization-scoped-data";
     readonly title: "Keep application data organization-scoped";
@@ -1191,167 +1547,6 @@ declare function auditAllApplicationRequirements(applicationIds?: readonly Appli
 declare const DEFAULT_SERVICE_URLS: Record<ServiceId, string>;
 declare function resolveServiceUrl(service: ServiceId, overrides?: Partial<Record<ServiceId, string>>): string;
 
-interface TopoloClientOptions {
-    credential: TopoloCredential;
-    agent: AgentIdentity;
-    /** Per-service URL overrides. Useful for staging/dev. */
-    serviceUrls?: Partial<Record<ServiceId, string>>;
-    /** Per-service TopoloAuth service id overrides from the owning app/deployment. */
-    serviceIds?: Partial<Record<ServiceId, string>>;
-    /**
-     * When true, mutating helpers (POST/PUT/PATCH/DELETE) require callers to pass
-     * `{ confirm: true }`. Defaults to true. Set false only for trusted surfaces.
-     */
-    requireConfirmForWrites?: boolean;
-    /** HTTP request timeout (ms). Default 30s. */
-    timeoutMs?: number;
-    /** Injected fetch, for testing. Defaults to global fetch. */
-    fetch?: typeof fetch;
-    /**
-     * Observability hook. Fires once per request lifecycle (`request` at start,
-     * then exactly one of `response` or `error`). Safe to leave unset — off by
-     * default. Intended for CLI/MCP hosts to surface request-level diagnostics
-     * and for consumers building their own logging/tracing.
-     */
-    debug?: (event: TopoloDebugEvent) => void;
-}
-type TopoloDebugEvent = {
-    phase: 'request';
-    method: string;
-    service: ServiceId;
-    path: string;
-    url: string;
-    requestId: string;
-} | {
-    phase: 'response';
-    method: string;
-    service: ServiceId;
-    path: string;
-    url: string;
-    requestId: string;
-    status: number;
-    durationMs: number;
-} | {
-    phase: 'error';
-    method: string;
-    service: ServiceId;
-    path: string;
-    url: string;
-    requestId: string;
-    durationMs: number;
-    error: string;
-    status?: number;
-};
-interface RequestOptions {
-    service: ServiceId;
-    path: string;
-    method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
-    query?: Record<string, string | number | boolean | undefined>;
-    body?: unknown;
-    /** Explicit write-acknowledgement for mutating calls. */
-    confirm?: boolean;
-    /** Extra headers appended after auth/audit headers. */
-    headers?: Record<string, string>;
-    signal?: AbortSignal;
-}
-/**
- * A single entry from the live platform service catalog. Returned by
- * {@link TopoloClient.listServices}. Shape mirrors the public-safe projection
- * from TopoloAuth `GET /api/services/catalog`.
- */
-interface TopoloServiceCatalogEntry {
-    serviceId: string;
-    slug: string | null;
-    name: string | null;
-    description: string | null;
-    baseUrl: string | null;
-    status: string | null;
-    surfaceKind: string | null;
-    launchable: boolean;
-}
-declare class TopoloClient {
-    private readonly credential;
-    private readonly agent;
-    private readonly serviceUrls?;
-    private readonly serviceIds?;
-    private readonly requireConfirmForWrites;
-    private readonly timeoutMs;
-    private readonly fetchImpl;
-    private readonly debug?;
-    /**
-     * Process-wide cache for slug → service-id lookups. Keyed by
-     * `${authBaseUrl}|${slug}` so multiple `TopoloClient` instances pointing at
-     * the same Auth share, but staging vs prod don't poison each other.
-     * Cleared via `TopoloClient.clearServiceIdCache()` if a test needs it.
-     */
-    private static readonly serviceIdCache;
-    /**
-     * Drop the slug→service-id cache. Test-only — production callers should
-     * let the 5-minute TTL expire naturally.
-     */
-    static clearServiceIdCache(): void;
-    constructor(options: TopoloClientOptions);
-    private emit;
-    /**
-     * Low-level JSON request. Prefer the typed module helpers (identity, crm, ...)
-     * for anything a caller would reach for; this stays exported for escape-hatch
-     * use and for the generic `topolo api` / MCP passthrough tool.
-     */
-    request<T = unknown>(opts: RequestOptions): Promise<T>;
-    /**
-     * Resolve a service-slug → opaque service-id via caller config or TopoloAuth.
-     *
-     * Cache: 5 minutes per process per `(slug, auth_base_url)`. Negative
-     * results (404) are cached for 60s so a typo doesn't hot-loop the
-     * resolver. Returns null when the slug isn't registered — callers decide
-     * whether to throw.
-     *
-     * No credential is sent: the endpoint is public (slugs aren't secret).
-     * This keeps the resolver usable during early bootstrap before a caller
-     * has acquired an access token.
-     */
-    getServiceIdBySlug(slug: string): Promise<string | null>;
-    /**
-     * List the platform service catalog from the live registry
-     * (`GET /api/services/catalog` on TopoloAuth). Credential-aware: the
-     * caller's credential is attached, so an authenticated caller in an
-     * entitled org also receives the `developer_only` services its role
-     * permits; an unauthenticated/agent caller receives `active` only.
-     *
-     * Resilient: on any network/HTTP failure this falls back to the
-     * build-time generated `APPLICATIONS` snapshot so offline/degraded
-     * callers still get a usable (if static) catalog. The live result is
-     * authoritative; the snapshot is a floor, not a cap.
-     */
-    listServices(): Promise<TopoloServiceCatalogEntry[]>;
-    private generatedCatalogFallback;
-    /**
-     * Introspect the current credential. Returns the caller's resolved identity,
-     * organization, and permission set. Used by CLI `whoami` and by MCP to gate
-     * advertised tools by scope.
-     *
-     * Both JWT access tokens and platform API keys are resolved via the unified
-     * `GET /api/auth/me` endpoint on TopoloAuth, which does not require service
-     * credentials. The caller's possession of the credential secret is proof.
-     */
-    introspect(): Promise<CredentialIntrospection>;
-}
-interface CredentialIntrospection {
-    kind: 'api_key' | 'access_token';
-    user: {
-        id: string;
-        email: string;
-        name: string | null;
-        role: string;
-        permissions: string[];
-    };
-    organization: {
-        id: string;
-        slug: string;
-        name: string;
-    } | null;
-}
-
 declare class TopoloSdkError extends Error {
     readonly code: string;
     constructor(code: string, message: string);