@topolo/sdk 0.4.0 → 0.4.2

package/src/client.test.ts

@@ -17,9 +17,29 @@ function stubFetch(responses: Array<{ status?: number; body?: unknown; contentTy
 
 const AGENT = { clientName: 'topolo-test', clientVersion: '0.0.0' };
 const SERVICE_LOOKUP = { body: { success: true, data: { service_id: 'service_test' } } };
+const CRM_CATALOG = {
+  body: {
+    data: {
+      services: [
+        {
+          service_id: 'srv_crm',
+          app_slug: 'topolo-crm',
+          name: 'Topolo CRM',
+          base_url: 'https://crm-api.topolo.app',
+          surface_kind: 'api',
+          status: 'active',
+          granted_permissions: ['srv_crm.contacts:read'],
+        },
+      ],
+    },
+  },
+};
 
 function requestCalls(calls: Array<{ url: string; init: RequestInit }>) {
-  return calls.filter((call) => !call.url.includes('/api/services/by-slug/'));
+  return calls.filter((call) =>
+    !call.url.includes('/api/services/by-slug/') &&
+    !call.url.includes('/api/services/catalog')
+  );
 }
 
 beforeEach(() => {
@@ -28,7 +48,7 @@ beforeEach(() => {
 
 describe('TopoloClient.request', () => {
   it('injects Bearer auth + audit headers for access_token credentials', async () => {
-    const { impl, calls } = stubFetch([{ body: { ok: true } }]);
+    const { impl, calls } = stubFetch([CRM_CATALOG, { body: { ok: true } }]);
     const client = new TopoloClient({
       credential: { kind: 'access_token', accessToken: 'tok_abc' },
       agent: AGENT,
@@ -44,7 +64,7 @@ describe('TopoloClient.request', () => {
   });
 
   it('uses X-Api-Key header for api_key credentials', async () => {
-    const { impl, calls } = stubFetch([{ body: { ok: true } }]);
+    const { impl, calls } = stubFetch([CRM_CATALOG, { body: { ok: true } }]);
     const client = new TopoloClient({
       credential: { kind: 'api_key', apiKey: 'dak_xyz' },
       agent: AGENT,
@@ -69,7 +89,7 @@ describe('TopoloClient.request', () => {
   });
 
   it('allows mutating requests with confirm: true', async () => {
-    const { impl, calls } = stubFetch([{ body: { id: 'c_1' } }]);
+    const { impl, calls } = stubFetch([CRM_CATALOG, { body: { id: 'c_1' } }]);
     const client = new TopoloClient({
       credential: { kind: 'api_key', apiKey: 'dak_xyz' },
       agent: AGENT,
@@ -122,6 +142,7 @@ describe('TopoloClient.request', () => {
 
   it('maps 403 → TopoloPermissionError with required scopes extracted', async () => {
     const { impl } = stubFetch([
+      CRM_CATALOG,
       { status: 403, body: { error: 'forbidden', required: ['crm.contacts:write'] } },
     ]);
     const client = new TopoloClient({
@@ -135,7 +156,7 @@ describe('TopoloClient.request', () => {
   });
 
   it('maps non-401/403 failures → TopoloHttpError with status preserved', async () => {
-    const { impl } = stubFetch([{ status: 500, body: { error: 'boom' } }]);
+    const { impl } = stubFetch([CRM_CATALOG, { status: 500, body: { error: 'boom' } }]);
     const client = new TopoloClient({
       credential: { kind: 'api_key', apiKey: 'dak_xyz' },
       agent: AGENT,
@@ -148,7 +169,7 @@ describe('TopoloClient.request', () => {
   });
 
   it('appends query params as search string', async () => {
-    const { impl, calls } = stubFetch([{ body: { contacts: [] } }]);
+    const { impl, calls } = stubFetch([CRM_CATALOG, { body: { contacts: [] } }]);
     const client = new TopoloClient({
       credential: { kind: 'api_key', apiKey: 'dak_xyz' },
       agent: AGENT,
@@ -369,6 +390,7 @@ describe('TopoloClient.listServices', () => {
                 status: 'active',
                 surface_kind: 'application',
                 launchable: true,
+                granted_permissions: ['srv_wRCnLLbtvmVT.dashboard:read'],
               },
             ],
           },
@@ -392,6 +414,7 @@ describe('TopoloClient.listServices', () => {
         status: 'active',
         surfaceKind: 'application',
         launchable: true,
+        permissions: ['srv_wRCnLLbtvmVT.dashboard:read'],
       },
     ]);
     expect(calls[0]!.url).toBe(
@@ -402,7 +425,7 @@ describe('TopoloClient.listServices', () => {
     );
   });
 
-  it('falls back to the generated snapshot on HTTP failure', async () => {
+  it('does not fall back to the generated global snapshot on HTTP failure', async () => {
     const { impl } = stubFetch([{ status: 503, body: { error: 'down' } }]);
     const client = new TopoloClient({
       credential: { kind: 'api_key', apiKey: 'dak_xyz' },
@@ -410,10 +433,146 @@ describe('TopoloClient.listServices', () => {
       fetch: impl,
       serviceUrls: { auth: 'https://auth.example.com' },
     });
-    const out = await client.listServices();
-    expect(out.length).toBeGreaterThan(10);
-    expect(out.some((e) => e.serviceId === 'admin')).toBe(true);
-    expect(out.every((e) => typeof e.serviceId === 'string')).toBe(true);
+    await expect(client.listServices()).rejects.toBeInstanceOf(TopoloHttpError);
+  });
+
+  it('routes bundled service aliases only after the scoped live catalog grants access', async () => {
+    const { impl, calls } = stubFetch([
+      {
+        body: {
+          data: {
+            services: [
+              {
+                service_id: 'srv_mail',
+                app_slug: 'topolo-mail',
+                name: 'Topolo Mail',
+                base_url: 'https://mail.topolo.app',
+                surface_kind: 'application',
+                status: 'active',
+                granted_permissions: ['srv_mail.messages:read'],
+              },
+            ],
+          },
+        },
+      },
+      { body: { ok: true } },
+    ]);
+    const client = new TopoloClient({
+      credential: { kind: 'api_key', apiKey: 'dak_xyz' },
+      agent: AGENT,
+      fetch: impl,
+      serviceUrls: { auth: 'https://auth.example.com' },
+    });
+
+    await client.request({ service: 'mail', path: '/api/health' });
+
+    expect(calls[0]!.url).toBe('https://auth.example.com/api/services/catalog');
+    expect(calls[1]!.url).toBe('https://mail.topolo.app/api/health');
+  });
+
+  it('refuses a bundled static service that is absent from the scoped live catalog', async () => {
+    const { impl, calls } = stubFetch([
+      {
+        body: {
+          data: {
+            services: [
+              {
+                service_id: 'srv_crm',
+                app_slug: 'topolo-crm',
+                name: 'Topolo CRM',
+                base_url: 'https://crm-api.topolo.app',
+                surface_kind: 'api',
+                status: 'active',
+                granted_permissions: ['srv_crm.contacts:read'],
+              },
+            ],
+          },
+        },
+      },
+    ]);
+    const client = new TopoloClient({
+      credential: { kind: 'api_key', apiKey: 'dak_xyz' },
+      agent: AGENT,
+      fetch: impl,
+      serviceUrls: { auth: 'https://auth.example.com' },
+    });
+
+    await expect(client.request({ service: 'mail', path: '/api/health' })).rejects.toMatchObject({
+      code: 'unknown_service',
+    });
+    expect(calls).toHaveLength(1);
+  });
+
+  it('does not treat live browser applications as generic API services', async () => {
+    const { impl } = stubFetch([
+      {
+        body: {
+          data: {
+            services: [
+              {
+                service_id: 'srv_future_app',
+                app_slug: 'topolo-future-app',
+                name: 'Future App',
+                base_url: 'https://future-app.topolo.app',
+                surface_kind: 'application',
+                status: 'active',
+                granted_permissions: ['srv_future_app.launch:read'],
+                launchable: true,
+              },
+            ],
+          },
+        },
+      },
+    ]);
+    const client = new TopoloClient({
+      credential: { kind: 'api_key', apiKey: 'dak_xyz' },
+      agent: AGENT,
+      fetch: impl,
+      serviceUrls: { auth: 'https://auth.example.com' },
+    });
+
+    await expect(client.request({ service: 'future-app', path: '/api/health' })).rejects.toMatchObject({
+      code: 'unknown_service',
+    });
+  });
+
+  it('caches the live catalog per client for repeated dynamic service calls', async () => {
+    const { impl, calls } = stubFetch([
+      {
+        body: {
+          data: {
+            services: [
+              {
+                service_id: 'srv_future',
+                app_slug: 'topolo-warehouse',
+                name: 'Warehouse',
+                base_url: 'https://warehouse.topolo.app',
+                surface_kind: 'api',
+                status: 'active',
+                granted_permissions: ['srv_future.read:all'],
+              },
+            ],
+          },
+        },
+      },
+      { body: { ok: true } },
+      { body: { ok: true } },
+    ]);
+    const client = new TopoloClient({
+      credential: { kind: 'api_key', apiKey: 'dak_xyz' },
+      agent: AGENT,
+      fetch: impl,
+      serviceUrls: { auth: 'https://auth.example.com' },
+    });
+
+    await client.request({ service: 'warehouse', path: '/api/one' });
+    await client.request({ service: 'warehouse', path: '/api/two' });
+
+    expect(calls.map((call) => call.url)).toEqual([
+      'https://auth.example.com/api/services/catalog',
+      'https://warehouse.topolo.app/api/one',
+      'https://warehouse.topolo.app/api/two',
+    ]);
   });
 });
 

package/src/client.ts

@@ -5,8 +5,9 @@ import {
   type AgentIdentity,
   type TopoloCredential,
 } from './auth.js';
-import { TopoloAuthError, TopoloHttpError, TopoloPermissionError } from './errors.js';
+import { TopoloAuthError, TopoloHttpError, TopoloPermissionError, TopoloSdkError } from './errors.js';
 import {
+  DEFAULT_SERVICE_URLS,
   APPLICATIONS,
   resolveServiceUrl,
   type ServiceId,
@@ -16,9 +17,9 @@ export interface TopoloClientOptions {
   credential: TopoloCredential;
   agent: AgentIdentity;
   /** Per-service URL overrides. Useful for staging/dev. */
-  serviceUrls?: Partial<Record<ServiceId, string>>;
+  serviceUrls?: Record<string, string>;
   /** Per-service TopoloAuth service id overrides from the owning app/deployment. */
-  serviceIds?: Partial<Record<ServiceId, string>>;
+  serviceIds?: Record<string, string>;
   /**
    * When true, mutating helpers (POST/PUT/PATCH/DELETE) require callers to pass
    * `{ confirm: true }`. Defaults to true. Set false only for trusted surfaces.
@@ -41,7 +42,7 @@ export type TopoloDebugEvent =
   | {
       phase: 'request';
       method: string;
-      service: ServiceId;
+      service: string;
       path: string;
       url: string;
       requestId: string;
@@ -49,7 +50,7 @@ export type TopoloDebugEvent =
   | {
       phase: 'response';
       method: string;
-      service: ServiceId;
+      service: string;
       path: string;
       url: string;
       requestId: string;
@@ -59,7 +60,7 @@ export type TopoloDebugEvent =
   | {
       phase: 'error';
       method: string;
-      service: ServiceId;
+      service: string;
       path: string;
       url: string;
       requestId: string;
@@ -69,7 +70,7 @@ export type TopoloDebugEvent =
     };
 
 export interface RequestOptions {
-  service: ServiceId;
+  service: string;
   path: string;
   method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
   query?: Record<string, string | number | boolean | undefined>;
@@ -85,6 +86,7 @@ const WRITE_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
 
 const POSITIVE_CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
 const NEGATIVE_CACHE_TTL_MS = 60 * 1000; // 1 minute
+const CATALOG_CACHE_TTL_MS = 60 * 1000; // 1 minute
 
 interface ServiceIdCacheEntry {
   value: string | null;
@@ -105,17 +107,19 @@ export interface TopoloServiceCatalogEntry {
   status: string | null;
   surfaceKind: string | null;
   launchable: boolean;
+  permissions: string[];
 }
 
 export class TopoloClient {
   private readonly credential: TopoloCredential;
   private readonly agent: AgentIdentity;
-  private readonly serviceUrls?: Partial<Record<ServiceId, string>>;
-  private readonly serviceIds?: Partial<Record<ServiceId, string>>;
+  private readonly serviceUrls?: Record<string, string>;
+  private readonly serviceIds?: Record<string, string>;
   private readonly requireConfirmForWrites: boolean;
   private readonly timeoutMs: number;
   private readonly fetchImpl: typeof fetch;
   private readonly debug?: (event: TopoloDebugEvent) => void;
+  private serviceCatalogCache: { entries: TopoloServiceCatalogEntry[]; expiresAt: number } | null = null;
 
   /**
    * Process-wide cache for slug → service-id lookups. Keyed by
@@ -169,7 +173,8 @@ export class TopoloClient {
       );
     }
 
-    const baseUrl = resolveServiceUrl(opts.service, this.serviceUrls);
+    const resolvedService = await this.resolveRequestService(opts.service);
+    const baseUrl = resolvedService.baseUrl;
     const url = new URL(opts.path, baseUrl.endsWith('/') ? baseUrl : `${baseUrl}/`);
     if (opts.query) {
       for (const [k, v] of Object.entries(opts.query)) {
@@ -180,7 +185,7 @@ export class TopoloClient {
     const headers = new Headers();
     headers.set('Accept', 'application/json');
     if (opts.body !== undefined) headers.set('Content-Type', 'application/json');
-    const platformServiceId = resolveConfiguredServiceId(opts.service, this.serviceIds);
+    const platformServiceId = resolveConfiguredServiceId(resolvedService.serviceKey, this.serviceIds);
     if (platformServiceId) headers.set('X-Service-ID', platformServiceId);
 
     applyAuthHeaders(headers, this.credential);
@@ -199,7 +204,7 @@ export class TopoloClient {
 
     const urlStr = url.toString();
     const startedAt = Date.now();
-    this.emit({ phase: 'request', method, service: opts.service, path: opts.path, url: urlStr, requestId });
+    this.emit({ phase: 'request', method, service: resolvedService.serviceKey, path: opts.path, url: urlStr, requestId });
 
     let res: Response;
     try {
@@ -213,7 +218,7 @@ export class TopoloClient {
       this.emit({
         phase: 'error',
         method,
-        service: opts.service,
+        service: resolvedService.serviceKey,
         path: opts.path,
         url: urlStr,
         requestId,
@@ -236,7 +241,7 @@ export class TopoloClient {
       this.emit({
         phase: 'error',
         method,
-        service: opts.service,
+        service: resolvedService.serviceKey,
         path: opts.path,
         url: urlStr,
         requestId,
@@ -251,13 +256,13 @@ export class TopoloClient {
           extractRequired(parsed),
         );
       }
-      throw new TopoloHttpError(opts.service, opts.path, res.status, parsed);
+      throw new TopoloHttpError(resolvedService.serviceKey, opts.path, res.status, parsed);
     }
 
     this.emit({
       phase: 'response',
       method,
-      service: opts.service,
+      service: resolvedService.serviceKey,
       path: opts.path,
       url: urlStr,
       requestId,
@@ -268,6 +273,37 @@ export class TopoloClient {
     return parsed as T;
   }
 
+  private async resolveRequestService(service: string): Promise<{ serviceKey: string; baseUrl: string }> {
+    const serviceKey = normalizeLookupKey(service);
+    if (!serviceKey) {
+      throw new TopoloSdkError('unknown_service', 'service is required');
+    }
+
+    if (serviceKey === 'auth') {
+      const overrideUrl = resolveConfiguredServiceUrl(serviceKey, this.serviceUrls);
+      if (overrideUrl) return { serviceKey, baseUrl: overrideUrl };
+      return { serviceKey, baseUrl: DEFAULT_SERVICE_URLS.auth };
+    }
+
+    const live = await this.resolveLiveCallableService(serviceKey);
+    if (live) {
+      const overrideUrl = resolveConfiguredServiceUrl(serviceKey, this.serviceUrls);
+      return overrideUrl ? { ...live, baseUrl: overrideUrl } : live;
+    }
+
+    throw new TopoloSdkError(
+      'unknown_service',
+      `Unknown Topolo service "${service}". Run service discovery first and pass a callable service id or slug.`,
+    );
+  }
+
+  private async resolveLiveCallableService(serviceKey: string): Promise<{ serviceKey: string; baseUrl: string } | null> {
+    const catalog = await this.listServices();
+    const match = catalog.find((entry) => catalogEntryMatches(entry, serviceKey));
+    if (!match?.baseUrl || !isCallableCatalogEntry(match)) return null;
+    return { serviceKey, baseUrl: match.baseUrl };
+  }
+
   /**
    * Resolve a service-slug → opaque service-id via caller config or TopoloAuth.
    *
@@ -339,57 +375,73 @@ export class TopoloClient {
   /**
    * List the platform service catalog from the live registry
    * (`GET /api/services/catalog` on TopoloAuth). Credential-aware: the
-   * caller's credential is attached, so an authenticated caller in an
-   * entitled org also receives the `developer_only` services its role
-   * permits; an unauthenticated/agent caller receives `active` only.
+   * caller's credential is attached, so the result only includes services the
+   * credential's organization and effective permissions can use.
    *
-   * Resilient: on any network/HTTP failure this falls back to the
-   * build-time generated `APPLICATIONS` snapshot so offline/degraded
-   * callers still get a usable (if static) catalog. The live result is
-   * authoritative; the snapshot is a floor, not a cap.
+   * Security boundary: this never falls back to the generated global snapshot.
+   * The live Auth catalog is the authority because it is scoped to the caller's
+   * organization and effective permissions.
    */
   async listServices(): Promise<TopoloServiceCatalogEntry[]> {
-    try {
-      const res = await this.request<
-        | { data?: { services?: unknown[] } }
-        | { services?: unknown[] }
-      >({ service: 'auth', method: 'GET', path: '/api/services/catalog' });
-      const raw =
-        (res as { data?: { services?: unknown[] } }).data?.services ??
-        (res as { services?: unknown[] }).services;
-      if (Array.isArray(raw) && raw.length > 0) {
-        const entries: TopoloServiceCatalogEntry[] = [];
-        for (const item of raw) {
-          const s = item as Record<string, unknown>;
-          const serviceId =
-            typeof s.service_id === 'string'
-              ? s.service_id
-              : typeof s.id === 'string'
-                ? s.id
-                : null;
-          if (!serviceId) continue;
-          entries.push({
-            serviceId,
-            slug: typeof s.app_slug === 'string' ? s.app_slug : null,
-            name: typeof s.name === 'string' ? s.name : null,
-            description:
-              typeof s.description === 'string' ? s.description : null,
-            baseUrl: typeof s.base_url === 'string' ? s.base_url : null,
-            status: typeof s.status === 'string' ? s.status : null,
-            surfaceKind:
-              typeof s.surface_kind === 'string' ? s.surface_kind : null,
-            launchable: s.launchable === true,
-          });
-        }
-        if (entries.length > 0) return entries;
-      }
-    } catch {
-      // Fall through to the generated snapshot.
+    const now = Date.now();
+    if (this.serviceCatalogCache && this.serviceCatalogCache.expiresAt > now) {
+      return this.serviceCatalogCache.entries;
+    }
+
+    const res = await this.request<
+      | { data?: { services?: unknown[] } }
+      | { services?: unknown[] }
+    >({ service: 'auth', method: 'GET', path: '/api/services/catalog' });
+    const raw =
+      (res as { data?: { services?: unknown[] } }).data?.services ??
+      (res as { services?: unknown[] }).services;
+    if (!Array.isArray(raw)) {
+      throw new TopoloSdkError(
+        'service_catalog_unavailable',
+        'TopoloAuth did not return a service catalog for the current credential.',
+      );
     }
-    return this.generatedCatalogFallback();
+
+    const entries: TopoloServiceCatalogEntry[] = [];
+    for (const item of raw) {
+      const s = item as Record<string, unknown>;
+      const serviceId =
+        typeof s.service_id === 'string'
+          ? s.service_id
+          : typeof s.id === 'string'
+            ? s.id
+            : null;
+      if (!serviceId) continue;
+      const permissions = Array.isArray(s.granted_permissions)
+        ? s.granted_permissions
+            .filter((permission): permission is string => typeof permission === 'string' && permission.trim().length > 0)
+        : [];
+      entries.push({
+        serviceId,
+        slug: typeof s.app_slug === 'string' ? s.app_slug : null,
+        name: typeof s.name === 'string' ? s.name : null,
+        description:
+          typeof s.description === 'string' ? s.description : null,
+        baseUrl: typeof s.base_url === 'string' ? s.base_url : null,
+        status: typeof s.status === 'string' ? s.status : null,
+        surfaceKind:
+          typeof s.surface_kind === 'string' ? s.surface_kind : null,
+        launchable: s.launchable === true,
+        permissions,
+      });
+    }
+    this.serviceCatalogCache = {
+      entries,
+      expiresAt: now + CATALOG_CACHE_TTL_MS,
+    };
+    return entries;
   }
 
-  private generatedCatalogFallback(): TopoloServiceCatalogEntry[] {
+  /**
+   * Bundled generated registry for tooling that audits platform packaging, not
+   * for deciding what the current credential may use.
+   */
+  listBundledServices(): TopoloServiceCatalogEntry[] {
     const apps = Object.values(APPLICATIONS) as ReadonlyArray<{
       id: string;
       name?: string;
@@ -401,9 +453,10 @@ export class TopoloClient {
       name: app.name ?? app.id,
       description: null,
       baseUrl: app.productionUrl ?? null,
-      status: 'active',
+      status: 'bundled',
       surfaceKind: 'application',
       launchable: Boolean(app.productionUrl),
+      permissions: [],
     }));
   }
 
@@ -453,7 +506,7 @@ export class TopoloClient {
 
 function resolveConfiguredServiceId(
   slug: string,
-  serviceIds?: Partial<Record<ServiceId, string>>,
+  serviceIds?: Record<string, string>,
 ): string | null {
   for (const serviceKey of serviceKeyCandidates(slug)) {
     const configured = serviceIds?.[serviceKey as ServiceId];
@@ -467,8 +520,24 @@ function resolveConfiguredServiceId(
   return null;
 }
 
+function resolveConfiguredServiceUrl(
+  slug: string,
+  serviceUrls?: Record<string, string>,
+): string | null {
+  for (const serviceKey of serviceKeyCandidates(slug)) {
+    const configured = serviceUrls?.[serviceKey];
+    if (typeof configured === 'string' && configured.trim()) return configured.trim();
+
+    const envKey = `TOPOLO_SERVICE_URL_${serviceKey.replace(/\./g, '_').toUpperCase()}`;
+    const envValue = typeof process !== 'undefined' ? process.env?.[envKey] : undefined;
+    if (typeof envValue === 'string' && envValue.trim()) return envValue.trim();
+  }
+
+  return null;
+}
+
 function serviceKeyCandidates(slug: string): string[] {
-  const normalized = slug.trim().toLowerCase();
+  const normalized = normalizeLookupKey(slug);
   const withoutTopolo = normalized.startsWith('topolo-')
     ? normalized.slice('topolo-'.length)
     : normalized;
@@ -480,6 +549,38 @@ function serviceKeyCandidates(slug: string): string[] {
   ])];
 }
 
+function normalizeLookupKey(value: string): string {
+  return String(value || '').trim().toLowerCase().replace(/\s+/g, '-');
+}
+
+function catalogEntryMatches(entry: TopoloServiceCatalogEntry, needle: string): boolean {
+  return catalogEntryLookupKeys(entry).includes(needle);
+}
+
+function catalogEntryLookupKeys(entry: TopoloServiceCatalogEntry): string[] {
+  const values = [entry.serviceId, entry.slug, entry.name].filter((value): value is string => (
+    typeof value === 'string' && value.trim().length > 0
+  ));
+  const keys = new Set<string>();
+  for (const value of values) {
+    const normalized = normalizeLookupKey(value);
+    if (!normalized) continue;
+    for (const candidate of serviceKeyCandidates(normalized)) {
+      keys.add(candidate);
+    }
+  }
+  return [...keys];
+}
+
+function isCallableCatalogEntry(entry: TopoloServiceCatalogEntry): boolean {
+  const kind = normalizeLookupKey(entry.surfaceKind || '');
+  if (kind === 'api' || kind === 'technical_service' || kind === 'service') return true;
+  return Boolean(
+    entry.baseUrl &&
+    catalogEntryLookupKeys(entry).some((key) => Object.prototype.hasOwnProperty.call(DEFAULT_SERVICE_URLS, key)),
+  );
+}
+
 interface AuthMePayload {
   credentialType?: 'access_token' | 'api_key';
   user: RawUser;