@topolo/sdk 0.4.6 → 0.4.8

package/src/modules/p2p.test.ts

@@ -255,4 +255,290 @@ describe('P2PModule.releaseHold', () => {
     expect(sent.resolution).toBe('seller');
     expect(sent.reason).toBe('arbitration');
   });
+
+  it('rejects an empty holdId', async () => {
+    const { impl } = stubFetch([]);
+    const p2p = new P2PModule(clientWith(impl));
+    await expect(p2p.releaseHold('', 'buyer')).rejects.toThrow('holdId is required');
+  });
+
+  it('defaults reason to null when omitted', async () => {
+    const { impl, calls } = stubFetch([
+      { body: { success: true, data: { hold: { hold_id: 'h2' }, resolution: 'buyer', cancel_entries: [] } } },
+    ]);
+    const p2p = new P2PModule(clientWith(impl));
+    await p2p.releaseHold('h2', 'buyer');
+    const sent = JSON.parse(String(requestCalls(calls)[0]!.init.body));
+    expect(sent.reason).toBeNull();
+  });
+});
+
+describe('P2PModule.getCapability (additional)', () => {
+  it('rejects an empty capabilityId', async () => {
+    const { impl } = stubFetch([]);
+    const p2p = new P2PModule(clientWith(impl));
+    await expect(p2p.getCapability('')).rejects.toThrow('capabilityId is required');
+  });
+
+  it('returns the unwrapped capability on success', async () => {
+    const { impl, calls } = stubFetch([
+      { body: { success: true, data: { capability: { capability_id: 'cap_ok' } } } },
+    ]);
+    const p2p = new P2PModule(clientWith(impl));
+    const cap = await p2p.getCapability('cap ok/1');
+    expect(cap!.capability_id).toBe('cap_ok');
+    expect(requestCalls(calls)[0]!.url).toContain('/api/directory/capabilities/cap%20ok%2F1');
+  });
+
+  it('rethrows non-404 errors', async () => {
+    const { impl } = stubFetch([{ status: 500, body: { success: false, error: 'boom' } }]);
+    const p2p = new P2PModule(clientWith(impl));
+    await expect(p2p.getCapability('cap_x')).rejects.toThrow();
+  });
+});
+
+describe('P2PModule.listActions', () => {
+  it('GETs /api/actions forwarding state + limit', async () => {
+    const { impl, calls } = stubFetch([
+      { body: { success: true, data: { actions: [{ request_id: 'req_1' }] } } },
+    ]);
+    const p2p = new P2PModule(clientWith(impl));
+    const actions = await p2p.listActions({ state: 'pending', limit: 5 });
+    expect(actions).toHaveLength(1);
+    const url = new URL(requestCalls(calls)[0]!.url);
+    expect(url.pathname).toBe('/api/actions');
+    expect(url.searchParams.get('state')).toBe('pending');
+    expect(url.searchParams.get('limit')).toBe('5');
+  });
+});
+
+describe('P2PModule.getAction', () => {
+  it('rejects an empty requestId', async () => {
+    const { impl } = stubFetch([]);
+    const p2p = new P2PModule(clientWith(impl));
+    await expect(p2p.getAction('')).rejects.toThrow('requestId is required');
+  });
+
+  it('returns the action detail on success', async () => {
+    const { impl } = stubFetch([
+      { body: { success: true, data: { request: { request_id: 'req_2' } } } },
+    ]);
+    const p2p = new P2PModule(clientWith(impl));
+    const detail = await p2p.getAction('req_2');
+    expect(detail).toMatchObject({ request: { request_id: 'req_2' } });
+  });
+
+  it('returns null on 404', async () => {
+    const { impl } = stubFetch([{ status: 404, body: { success: false, error: 'not_found' } }]);
+    const p2p = new P2PModule(clientWith(impl));
+    expect(await p2p.getAction('req_missing')).toBeNull();
+  });
+});
+
+describe('P2PModule.requestAction (validation + happy path)', () => {
+  it('rejects a missing capability_id', async () => {
+    const { impl } = stubFetch([]);
+    const p2p = new P2PModule(clientWith(impl));
+    await expect(
+      p2p.requestAction({ capability_id: '', idempotency_key: 'k', inputs: {} }),
+    ).rejects.toThrow('capability_id is required');
+  });
+
+  it('POSTs the request and defaults inputs to {}', async () => {
+    const { impl, calls } = stubFetch([
+      { body: { success: true, data: { request_id: 'req_new', status: 'requested' } } },
+    ]);
+    const p2p = new P2PModule(clientWith(impl));
+    const result = await p2p.requestAction({ capability_id: 'cap_1', idempotency_key: 'idem_1' });
+    expect(result).toMatchObject({ request_id: 'req_new' });
+    const call = requestCalls(calls)[0]!;
+    expect(new URL(call.url).pathname).toBe('/api/actions/request');
+    const sent = JSON.parse(String(call.init.body));
+    expect(sent.idempotency_key).toBe('idem_1');
+    expect(sent.inputs).toEqual({});
+  });
+});
+
+describe('P2PModule.respondAction / completeAction / disputeAction', () => {
+  it('respondAction POSTs response + extras and unwraps request', async () => {
+    const { impl, calls } = stubFetch([
+      { body: { success: true, data: { request: { request_id: 'req_3', state: 'accepted' } } } },
+    ]);
+    const p2p = new P2PModule(clientWith(impl));
+    const row = await p2p.respondAction('req_3', 'accepted', { quote_minor: 100 });
+    expect(row).toMatchObject({ request_id: 'req_3', state: 'accepted' });
+    const call = requestCalls(calls)[0]!;
+    expect(new URL(call.url).pathname).toBe('/api/actions/req_3/respond');
+    const sent = JSON.parse(String(call.init.body));
+    expect(sent.response).toBe('accepted');
+    expect(sent.quote_minor).toBe(100);
+  });
+
+  it('respondAction rejects an empty requestId', async () => {
+    const { impl } = stubFetch([]);
+    const p2p = new P2PModule(clientWith(impl));
+    await expect(p2p.respondAction('', 'rejected')).rejects.toThrow('requestId is required');
+  });
+
+  it('completeAction POSTs the result payload', async () => {
+    const { impl, calls } = stubFetch([
+      { body: { success: true, data: { request: { request_id: 'req_4' } } } },
+    ]);
+    const p2p = new P2PModule(clientWith(impl));
+    await p2p.completeAction('req_4', { output: 'done' });
+    const call = requestCalls(calls)[0]!;
+    expect(new URL(call.url).pathname).toBe('/api/actions/req_4/complete');
+    expect(JSON.parse(String(call.init.body)).result).toEqual({ output: 'done' });
+  });
+
+  it('completeAction rejects an empty requestId', async () => {
+    const { impl } = stubFetch([]);
+    const p2p = new P2PModule(clientWith(impl));
+    await expect(p2p.completeAction('')).rejects.toThrow('requestId is required');
+  });
+
+  it('disputeAction POSTs the reason', async () => {
+    const { impl, calls } = stubFetch([
+      { body: { success: true, data: { request: { request_id: 'req_5' } } } },
+    ]);
+    const p2p = new P2PModule(clientWith(impl));
+    await p2p.disputeAction('req_5', 'wrong output');
+    const call = requestCalls(calls)[0]!;
+    expect(new URL(call.url).pathname).toBe('/api/actions/req_5/dispute');
+    expect(JSON.parse(String(call.init.body)).reason).toBe('wrong output');
+  });
+
+  it('disputeAction rejects an empty requestId', async () => {
+    const { impl } = stubFetch([]);
+    const p2p = new P2PModule(clientWith(impl));
+    await expect(p2p.disputeAction('', 'reason')).rejects.toThrow('requestId is required');
+  });
+});
+
+describe('P2PModule.getPolicy / updatePolicy', () => {
+  it('getPolicy GETs /api/policies and unwraps the policy', async () => {
+    const { impl, calls } = stubFetch([
+      { body: { success: true, data: { policy: { organization_id: 'org_a', auto_accept: false } } } },
+    ]);
+    const p2p = new P2PModule(clientWith(impl));
+    const policy = await p2p.getPolicy();
+    expect(policy).toMatchObject({ organization_id: 'org_a' });
+    expect(new URL(requestCalls(calls)[0]!.url).pathname).toBe('/api/policies');
+  });
+
+  it('updatePolicy PUTs the partial policy', async () => {
+    const { impl, calls } = stubFetch([
+      { body: { success: true, data: { policy: { organization_id: 'org_a', auto_accept: true } } } },
+    ]);
+    const p2p = new P2PModule(clientWith(impl));
+    const policy = await p2p.updatePolicy({ auto_accept: true } as never);
+    expect(policy).toMatchObject({ auto_accept: true });
+    const call = requestCalls(calls)[0]!;
+    expect((call.init.method ?? '').toUpperCase()).toBe('PUT');
+    expect(JSON.parse(String(call.init.body)).auto_accept).toBe(true);
+  });
+});
+
+describe('P2PModule connections', () => {
+  it('listConnections GETs /api/connections', async () => {
+    const { impl, calls } = stubFetch([
+      { body: { success: true, data: { connections: [{ connection_id: 'conn_1' }] } } },
+    ]);
+    const p2p = new P2PModule(clientWith(impl));
+    const conns = await p2p.listConnections();
+    expect(conns).toHaveLength(1);
+    expect(new URL(requestCalls(calls)[0]!.url).pathname).toBe('/api/connections');
+  });
+
+  it('createConnection POSTs counterparty + default active status', async () => {
+    const { impl, calls } = stubFetch([
+      { body: { success: true, data: { connection: { connection_id: 'conn_2', status: 'active' } } } },
+    ]);
+    const p2p = new P2PModule(clientWith(impl));
+    const conn = await p2p.createConnection('org_other');
+    expect(conn.status).toBe('active');
+    const sent = JSON.parse(String(requestCalls(calls)[0]!.init.body));
+    expect(sent.counterparty_org_id).toBe('org_other');
+    expect(sent.status).toBe('active');
+  });
+
+  it('createConnection honors an explicit status', async () => {
+    const { impl, calls } = stubFetch([
+      { body: { success: true, data: { connection: { connection_id: 'conn_3', status: 'pending' } } } },
+    ]);
+    const p2p = new P2PModule(clientWith(impl));
+    await p2p.createConnection('org_other', { status: 'pending' });
+    expect(JSON.parse(String(requestCalls(calls)[0]!.init.body)).status).toBe('pending');
+  });
+
+  it('createConnection rejects an empty counterpartyOrgId', async () => {
+    const { impl } = stubFetch([]);
+    const p2p = new P2PModule(clientWith(impl));
+    await expect(p2p.createConnection('')).rejects.toThrow('counterpartyOrgId is required');
+  });
+
+  it('revokeConnection DELETEs the encoded connection id', async () => {
+    const { impl, calls } = stubFetch([{ body: { success: true, data: {} } }]);
+    const p2p = new P2PModule(clientWith(impl));
+    await p2p.revokeConnection('conn/9');
+    const call = requestCalls(calls)[0]!;
+    expect((call.init.method ?? '').toUpperCase()).toBe('DELETE');
+    expect(call.url).toContain('/api/connections/conn%2F9');
+  });
+
+  it('revokeConnection rejects an empty connectionId', async () => {
+    const { impl } = stubFetch([]);
+    const p2p = new P2PModule(clientWith(impl));
+    await expect(p2p.revokeConnection('')).rejects.toThrow('connectionId is required');
+  });
+});
+
+describe('P2PModule ledger + settlements', () => {
+  it('listLedger GETs /api/ledger and unwraps entries', async () => {
+    const { impl, calls } = stubFetch([
+      { body: { success: true, data: { ledger_entries: [{ entry_id: 'led_1' }] } } },
+    ]);
+    const p2p = new P2PModule(clientWith(impl));
+    const entries = await p2p.listLedger();
+    expect(entries).toHaveLength(1);
+    expect(new URL(requestCalls(calls)[0]!.url).pathname).toBe('/api/ledger');
+  });
+
+  it('previewSettlements POSTs filters and unwraps groups', async () => {
+    const { impl, calls } = stubFetch([
+      { body: { success: true, data: { groups: [{ buyer_org_id: 'org_b', seller_org_id: 'org_s' }] } } },
+    ]);
+    const p2p = new P2PModule(clientWith(impl));
+    const groups = await p2p.previewSettlements({ currency: 'USD' });
+    expect(groups).toHaveLength(1);
+    const call = requestCalls(calls)[0]!;
+    expect(new URL(call.url).pathname).toBe('/api/settlements/preview');
+    expect(JSON.parse(String(call.init.body)).currency).toBe('USD');
+  });
+
+  it('createSettlement defaults trigger to manual and unwraps batch + group', async () => {
+    const { impl, calls } = stubFetch([
+      {
+        body: {
+          success: true,
+          data: { batch: { batch_id: 'bat_1' }, group: { buyer_org_id: 'org_b' } },
+        },
+      },
+    ]);
+    const p2p = new P2PModule(clientWith(impl));
+    const result = await p2p.createSettlement({ buyer_org_id: 'org_b' });
+    expect(result.batch.batch_id).toBe('bat_1');
+    const sent = JSON.parse(String(requestCalls(calls)[0]!.init.body));
+    expect(sent.trigger).toBe('manual');
+    expect(sent.buyer_org_id).toBe('org_b');
+  });
+
+  it('createSettlement honors an explicit trigger override', async () => {
+    const { impl, calls } = stubFetch([
+      { body: { success: true, data: { batch: { batch_id: 'bat_2' }, group: {} } } },
+    ]);
+    const p2p = new P2PModule(clientWith(impl));
+    await p2p.createSettlement({ trigger: 'schedule' });
+    expect(JSON.parse(String(requestCalls(calls)[0]!.init.body)).trigger).toBe('schedule');
+  });
 });

package/src/oauth.test.ts

@@ -109,5 +109,108 @@ describe('TopoloOAuth.requestDeviceCode', () => {
   });
 });
 
+describe('TopoloOAuth.exchangeAuthorizationCode', () => {
+  it('POSTs grant_type=authorization_code with PKCE verifier + secret', async () => {
+    const { impl, calls } = stubFetch({
+      status: 200,
+      body: { access_token: 'at', token_type: 'Bearer', expires_in: 3600 },
+    });
+    const oauth = new TopoloOAuth({ fetch: impl });
+    const res = await oauth.exchangeAuthorizationCode({
+      clientId: 'doac_x',
+      code: 'auth_code_1',
+      redirectUri: 'https://app/cb',
+      codeVerifier: 'verifier_1',
+      clientSecret: 'secret_1',
+    });
+    expect(res.access_token).toBe('at');
+    const body = new URLSearchParams(calls[0]!.init.body as string);
+    expect(body.get('grant_type')).toBe('authorization_code');
+    expect(body.get('code')).toBe('auth_code_1');
+    expect(body.get('redirect_uri')).toBe('https://app/cb');
+    expect(body.get('code_verifier')).toBe('verifier_1');
+    expect(body.get('client_secret')).toBe('secret_1');
+  });
+
+  it('omits optional PKCE verifier + secret when not provided', async () => {
+    const { impl, calls } = stubFetch({
+      status: 200,
+      body: { access_token: 'at', token_type: 'Bearer', expires_in: 3600 },
+    });
+    const oauth = new TopoloOAuth({ fetch: impl });
+    await oauth.exchangeAuthorizationCode({
+      clientId: 'doac_x',
+      code: 'c',
+      redirectUri: 'https://app/cb',
+    });
+    const body = new URLSearchParams(calls[0]!.init.body as string);
+    expect(body.has('code_verifier')).toBe(false);
+    expect(body.has('client_secret')).toBe(false);
+  });
+});
+
+describe('TopoloOAuth.requestDeviceCode (single scope + omitted)', () => {
+  function deviceBody() {
+    return {
+      device_code: 'dc',
+      user_code: 'X',
+      verification_uri: 'https://ex/dev',
+      expires_in: 600,
+      interval: 5,
+    };
+  }
+
+  it('passes a string scope through unchanged', async () => {
+    const { impl, calls } = stubFetch({ status: 200, body: deviceBody() });
+    const oauth = new TopoloOAuth({ fetch: impl });
+    await oauth.requestDeviceCode({ clientId: 'doac_x', scope: 'read' });
+    expect(new URLSearchParams(calls[0]!.init.body as string).get('scope')).toBe('read');
+  });
+
+  it('omits scope when not provided', async () => {
+    const { impl, calls } = stubFetch({ status: 200, body: deviceBody() });
+    const oauth = new TopoloOAuth({ fetch: impl });
+    await oauth.requestDeviceCode({ clientId: 'doac_x' });
+    expect(new URLSearchParams(calls[0]!.init.body as string).has('scope')).toBe(false);
+  });
+});
+
+describe('TopoloOAuth #postForm content negotiation', () => {
+  it('parses a non-JSON (text/plain) successful body as a string', async () => {
+    const impl = vi.fn(async () =>
+      new Response('plain-ok', { status: 200, headers: { 'Content-Type': 'text/plain' } }),
+    ) as unknown as typeof fetch;
+    const oauth = new TopoloOAuth({ fetch: impl });
+    const res = await oauth.pollDeviceToken({ clientId: 'doac_x', deviceCode: 'dc_1' });
+    expect(res as unknown).toBe('plain-ok');
+  });
+
+  it('wraps a non-OAuth text error body in TopoloHttpError', async () => {
+    const impl = vi.fn(async () =>
+      new Response('upstream exploded', {
+        status: 502,
+        headers: { 'Content-Type': 'text/plain' },
+      }),
+    ) as unknown as typeof fetch;
+    const oauth = new TopoloOAuth({ fetch: impl });
+    await expect(
+      oauth.pollDeviceToken({ clientId: 'doac_x', deviceCode: 'dc_1' }),
+    ).rejects.toBeInstanceOf(TopoloHttpError);
+  });
+
+  it('normalizes a base URL that already ends with a slash', async () => {
+    const { impl, calls } = stubFetch({
+      status: 200,
+      body: { access_token: 'at', token_type: 'Bearer', expires_in: 1 },
+    });
+    const oauth = new TopoloOAuth({
+      fetch: impl,
+      serviceUrls: { auth: 'https://auth.example/' },
+    });
+    await oauth.pollDeviceToken({ clientId: 'doac_x', deviceCode: 'dc_1' });
+    expect(calls[0]!.url).toBe('https://auth.example/api/developer-oauth/token');
+  });
+});
+
 // Keep the TopoloAuthError import non-dead for type inference
 void TopoloAuthError;

package/src/services.generated.ts

@@ -3,54 +3,53 @@
 // Regenerate: npm run generate:services
 
 export const SERVICES = {
-  agent: "https://agent-api.topolo.app",
+  agent: "https://agent.topolo.app",
   auth: "https://auth.topolo.app",
   backup: "https://backup.topolo.app",
   books: "https://books.topolo.app",
   bugfix: "https://bugfix.topolo.app",
-  bytes: "https://bytes-api.topolo.app",
+  bytes: "https://bytes.topolo.app",
   calendar: "https://calendar.topolo.app",
   capacity: "https://capacity.topolo.app",
   chat: "https://chat.topolo.app",
-  commerce: "https://commerce-api.topolo.app",
+  commerce: "https://commerce.topolo.app",
   compose: "https://compose.topolo.app",
   consent: "https://consent.topolo.app",
-  crm: "https://crm-api.topolo.app",
+  crm: "https://crm.topolo.app",
   developers: "https://developers.topolo.app",
   director: "https://director.topolo.app",
-  feed: "https://feed-api.topolo.app",
+  feed: "https://feed.topolo.app",
   flow: "https://flow.topolo.app",
-  forecast: "https://forecast-api.topolo.app",
+  forecast: "https://forecast.topolo.app",
   forms: "https://forms.topolo.app",
   home: "https://home.topolo.app",
   insights: "https://insights.topolo.app",
   inventory: "https://inventory.topolo.app",
-  learn: "https://learn-api.topolo.app",
+  learn: "https://learn.topolo.app",
   localize: "https://localize.topolo.app",
-  mail: "https://mail-api.topolo.app",
-  mdm: "https://mdm-api.topolo.app",
+  mail: "https://mail.topolo.app",
+  mdm: "https://mdm.topolo.app",
   messages: "https://messages.topolo.app",
   nexus: "https://nexus-api.topolo.app",
   notify: "https://notify.topolo.app",
   observability_watch: "https://observability-watch.topolo.app",
-  one: "https://one.topolo.app",
+  one: "https://www.topolo.app",
   p2p: "https://p2p.topolo.app",
   pay: "https://pay.topolo.app",
   people: "https://people.topolo.app",
-  pulse: "https://pulse.topolo.app",
   "quro.api": "https://api.ol0.me",
   "quro.redirect": "https://ol0.me",
-  roadmapper: "https://roadmapper-api.topolo.app",
+  roadmapper: "https://roadmapper.topolo.app",
   sign: "https://sign.topolo.app",
-  social_studio: "https://studio-api.topolo.app",
-  socialize: "https://socialize-api.topolo.app",
+  social_studio: "https://studio.topolo.app",
+  socialize: "https://socialize.topolo.app",
   spaces: "https://spaces.topolo.app",
   status: "https://status.topolo.app",
   success: "https://success.topolo.app",
   support: "https://support.topolo.app",
   survey: "https://survey.topolo.app",
   voice: "https://voice.topolo.app",
-  web: "https://web-api.topolo.app",
+  web: "https://web.topolo.app",
 } as const;
 
 export type ServiceId = keyof typeof SERVICES;

package/src/services.test.ts

@@ -48,7 +48,6 @@ const EXPECTED_APPLICATION_IDS = [
   'p2p',
   'pay',
   'people',
-  'pulse',
   'quro',
   'roadmapper',
   'sign',
@@ -69,10 +68,10 @@ describe('service registry', () => {
       calendar: 'https://calendar.topolo.app',
       books: 'https://books.topolo.app',
       consent: 'https://consent.topolo.app',
-      feed: 'https://feed-api.topolo.app',
-      mail: 'https://mail-api.topolo.app',
-      one: 'https://one.topolo.app',
-      web: 'https://web-api.topolo.app',
+      feed: 'https://feed.topolo.app',
+      mail: 'https://mail.topolo.app',
+      one: 'https://www.topolo.app',
+      web: 'https://web.topolo.app',
     });
     expect(DEFAULT_SERVICE_URLS).toMatchObject({
       success: 'https://success.topolo.app',
@@ -130,7 +129,7 @@ describe('service registry', () => {
 });
 
 describe('application catalog', () => {
-  it('covers every current Topolo application directory', () => {
+  it('covers every production-routable Topolo application directory', () => {
     expect(Object.keys(APPLICATIONS).sort()).toEqual(EXPECTED_APPLICATION_IDS);
   });
 
@@ -149,9 +148,15 @@ describe('application catalog', () => {
 
   it('treats TopoloWeb runtime as a standalone deploy, not an agent-callable API service', () => {
     expect(APPLICATIONS.web.services).toEqual(['web']);
+    // Front-door standardization: the callable `web` service is served by the
+    // studio web worker (web.topolo.app/api); the API worker is de-routed and
+    // no longer carries a public service registration.
     expect(
-      APPLICATIONS.web.deployTargets.find((target) => target.name === 'topolo-web-api')?.serviceId,
+      APPLICATIONS.web.deployTargets.find((target) => target.name === 'topolo-web-studio')?.serviceId,
     ).toBe('web');
+    expect(
+      APPLICATIONS.web.deployTargets.find((target) => target.name === 'topolo-web-api')?.serviceId,
+    ).toBeNull();
     // topolo-web-runtime (Astro, sites.topolo.app) deploys from its own wrangler
     // config and is intentionally listed as non-callable, so it can never be an
     // agent-callable service.
@@ -166,9 +171,15 @@ describe('application catalog', () => {
 
   it('treats TopoloFeed analytics as telemetry, not an agent-callable API service', () => {
     expect(APPLICATIONS.feed.services).toEqual(['feed']);
+    // Front-door standardization: the callable `feed` service is served by the
+    // feed web worker (feed.topolo.app/api); the API worker is de-routed.
     expect(
-      APPLICATIONS.feed.deployTargets.find((target) => target.name === 'topolo-feed-api')?.serviceId,
+      APPLICATIONS.feed.deployTargets.find((target) => target.name === 'topolo-feed-web')?.serviceId,
     ).toBe('feed');
+    expect(
+      APPLICATIONS.feed.deployTargets.find((target) => target.name === 'topolo-feed-api')?.serviceId,
+    ).toBeNull();
+    // The analytics ingestion worker keeps its own host and is non-callable.
     expect(
       APPLICATIONS.feed.deployTargets.find((target) => target.name === 'topolo-feed-analytics-api')?.serviceId,
     ).toBeNull();