@topolo/sdk 0.4.8 → 0.4.10

package/dist/index.cjs

@@ -140,7 +140,7 @@ var SERVICES = {
   mail: "https://mail.topolo.app",
   mdm: "https://mdm.topolo.app",
   messages: "https://messages.topolo.app",
-  nexus: "https://nexus-api.topolo.app",
+  nexus: "https://nexus.topolo.app",
   notify: "https://notify.topolo.app",
   observability_watch: "https://observability-watch.topolo.app",
   one: "https://www.topolo.app",
@@ -691,8 +691,10 @@ var APPLICATIONS = {
       {
         "name": "topolo-feed-api",
         "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
+        "apiUrl": "https://feed-api.topolo.app",
+        "domains": [
+          "feed-api.topolo.app"
+        ],
         "routes": [],
         "serviceId": null
       },
@@ -1063,9 +1065,9 @@ var APPLICATIONS = {
       {
         "name": "topolo-nexus-gateway",
         "kind": "worker",
-        "apiUrl": "https://nexus-api.topolo.app",
+        "apiUrl": "https://nexus.topolo.app",
         "domains": [
-          "nexus-api.topolo.app"
+          "nexus.topolo.app"
         ],
         "routes": [],
         "serviceId": "nexus"
@@ -1425,8 +1427,10 @@ var APPLICATIONS = {
       {
         "name": "topolo-socialize-api",
         "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
+        "apiUrl": "https://socialize-api.topolo.app",
+        "domains": [
+          "socialize-api.topolo.app"
+        ],
         "routes": [],
         "serviceId": null
       },
@@ -2276,10 +2280,14 @@ var TopoloClient = class _TopoloClient {
     if (!serviceKey) {
       throw new TopoloSdkError("unknown_service", "service is required");
     }
-    if (serviceKey === "auth") {
+    if (serviceKey === "auth" || serviceKey === "developers") {
       const overrideUrl = resolveConfiguredServiceUrl(serviceKey, this.serviceUrls);
       if (overrideUrl) return { serviceKey, baseUrl: overrideUrl };
-      return { serviceKey, baseUrl: DEFAULT_SERVICE_URLS.auth };
+      if (serviceKey === "developers") {
+        const derived = deriveDevelopersFromAuth(resolveConfiguredServiceUrl("auth", this.serviceUrls));
+        if (derived) return { serviceKey, baseUrl: derived };
+      }
+      return { serviceKey, baseUrl: DEFAULT_SERVICE_URLS[serviceKey] };
     }
     const live = await this.resolveLiveCallableService(serviceKey);
     if (live) {
@@ -2319,7 +2327,7 @@ var TopoloClient = class _TopoloClient {
     if (!normalized) return null;
     const configuredServiceId = resolveConfiguredServiceId(normalized, this.serviceIds);
     if (configuredServiceId) return configuredServiceId;
-    const authBase = resolveServiceUrl("auth", this.serviceUrls);
+    const authBase = resolveServiceUrl("developers", this.serviceUrls);
     const cacheKey = `${authBase}|${normalized}`;
     const now = Date.now();
     const cached = _TopoloClient.serviceIdCache.get(cacheKey);
@@ -2373,7 +2381,7 @@ var TopoloClient = class _TopoloClient {
     if (this.serviceCatalogCache && this.serviceCatalogCache.expiresAt > now) {
       return this.serviceCatalogCache.entries;
     }
-    const res = await this.request({ service: "auth", method: "GET", path: "/api/services/catalog" });
+    const res = await this.request({ service: "developers", method: "GET", path: "/api/services/catalog" });
     const raw = res.data?.services ?? res.services;
     if (!Array.isArray(raw)) {
       throw new TopoloSdkError(
@@ -2414,8 +2422,9 @@ var TopoloClient = class _TopoloClient {
     return entries;
   }
   /**
-   * List callable actions from the live Auth catalog. The response is scoped to
-   * the caller's organization and effective permissions; no bundled/static app
+   * List callable actions from the live registry-canonical catalog (definitions
+   * from the Catalog registry, scoping from Auth). The response is scoped to the
+   * caller's organization and effective permissions; no bundled/static app
    * action list is used as an authorization source.
    */
   async listActions(options = {}) {
@@ -2424,7 +2433,7 @@ var TopoloClient = class _TopoloClient {
       return this.actionCatalogCache.entries;
     }
     const res = await this.request({
-      service: "auth",
+      service: "developers",
       method: "GET",
       path: "/api/actions/catalog",
       ...options.service ? { query: { service: options.service } } : {}
@@ -2604,6 +2613,17 @@ function serviceKeyCandidates2(slug) {
 function normalizeLookupKey(value) {
   return String(value || "").trim().toLowerCase().replace(/\s+/g, "-");
 }
+function deriveDevelopersFromAuth(authUrl) {
+  if (!authUrl) return null;
+  try {
+    const url = new URL(authUrl);
+    if (!/^auth\./i.test(url.hostname)) return null;
+    url.hostname = url.hostname.replace(/^auth\./i, "developers.");
+    return url.origin;
+  } catch {
+    return null;
+  }
+}
 function catalogEntryMatches(entry, needle) {
   return catalogEntryLookupKeys(entry).includes(needle);
 }
@@ -2648,6 +2668,7 @@ function normalizeActionCatalogEntry(item) {
     readOnly: Boolean(a.read_only ?? a.readOnly),
     destructive: Boolean(a.destructive),
     requiresConfirmation: Boolean(a.requires_confirmation ?? a.requiresConfirmation),
+    agentAccess: pickAgentAccess(a.agent_access ?? a.agentAccess),
     status: pickActionString(a.status),
     sourceRevision: pickActionString(a.source_revision) ?? pickActionString(a.sourceRevision)
   };
@@ -2658,6 +2679,9 @@ function isHttpMethod(value) {
 function pickActionString(value) {
   return typeof value === "string" && value.trim() ? value.trim() : null;
 }
+function pickAgentAccess(value) {
+  return value === "auto" || value === "confirm" || value === "off" ? value : null;
+}
 function plainObject(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
@@ -2751,7 +2775,6 @@ var CrmModule = class {
   constructor(client) {
     this.client = client;
   }
-  client;
   async listContacts(options = {}) {
     const res = await this.client.request({
       service: "crm",
@@ -2799,7 +2822,6 @@ var IdentityModule = class {
   constructor(client) {
     this.client = client;
   }
-  client;
   /** Returns the resolved user, organization, and permission set for the
    *  current credential. Equivalent to `TopoloClient.introspect()` — exposed
    *  on this module for symmetry with the other domain modules. */
@@ -2813,7 +2835,6 @@ var P2PModule = class {
   constructor(client) {
     this.client = client;
   }
-  client;
   // Directory ----------------------------------------------------------------
   async listDirectory(options = {}) {
     const res = await this.client.request({

package/dist/index.d.cts

@@ -145,6 +145,8 @@ interface TopoloActionCatalogEntry {
     readOnly: boolean;
     destructive: boolean;
     requiresConfirmation: boolean;
+    /** Agent access tier. null/absent when the catalog does not specify one (consumers derive a default). */
+    agentAccess?: 'auto' | 'confirm' | 'off' | null;
     status: string | null;
     sourceRevision: string | null;
 }
@@ -206,8 +208,9 @@ declare class TopoloClient {
      */
     listServices(): Promise<TopoloServiceCatalogEntry[]>;
     /**
-     * List callable actions from the live Auth catalog. The response is scoped to
-     * the caller's organization and effective permissions; no bundled/static app
+     * List callable actions from the live registry-canonical catalog (definitions
+     * from the Catalog registry, scoping from Auth). The response is scoped to the
+     * caller's organization and effective permissions; no bundled/static app
      * action list is used as an authorization source.
      */
     listActions(options?: {
@@ -277,7 +280,7 @@ declare const SERVICES: {
     readonly mail: "https://mail.topolo.app";
     readonly mdm: "https://mdm.topolo.app";
     readonly messages: "https://messages.topolo.app";
-    readonly nexus: "https://nexus-api.topolo.app";
+    readonly nexus: "https://nexus.topolo.app";
     readonly notify: "https://notify.topolo.app";
     readonly observability_watch: "https://observability-watch.topolo.app";
     readonly one: "https://www.topolo.app";
@@ -702,8 +705,8 @@ declare const APPLICATIONS: {
         }, {
             readonly name: "topolo-feed-api";
             readonly kind: "worker";
-            readonly apiUrl: null;
-            readonly domains: readonly [];
+            readonly apiUrl: "https://feed-api.topolo.app";
+            readonly domains: readonly ["feed-api.topolo.app"];
             readonly routes: readonly [];
             readonly serviceId: null;
         }, {
@@ -985,8 +988,8 @@ declare const APPLICATIONS: {
         }, {
             readonly name: "topolo-nexus-gateway";
             readonly kind: "worker";
-            readonly apiUrl: "https://nexus-api.topolo.app";
-            readonly domains: readonly ["nexus-api.topolo.app"];
+            readonly apiUrl: "https://nexus.topolo.app";
+            readonly domains: readonly ["nexus.topolo.app"];
             readonly routes: readonly [];
             readonly serviceId: "nexus";
         }];
@@ -1245,8 +1248,8 @@ declare const APPLICATIONS: {
         }, {
             readonly name: "topolo-socialize-api";
             readonly kind: "worker";
-            readonly apiUrl: null;
-            readonly domains: readonly [];
+            readonly apiUrl: "https://socialize-api.topolo.app";
+            readonly domains: readonly ["socialize-api.topolo.app"];
             readonly routes: readonly [];
             readonly serviceId: null;
         }, {

package/dist/index.d.ts

@@ -145,6 +145,8 @@ interface TopoloActionCatalogEntry {
     readOnly: boolean;
     destructive: boolean;
     requiresConfirmation: boolean;
+    /** Agent access tier. null/absent when the catalog does not specify one (consumers derive a default). */
+    agentAccess?: 'auto' | 'confirm' | 'off' | null;
     status: string | null;
     sourceRevision: string | null;
 }
@@ -206,8 +208,9 @@ declare class TopoloClient {
      */
     listServices(): Promise<TopoloServiceCatalogEntry[]>;
     /**
-     * List callable actions from the live Auth catalog. The response is scoped to
-     * the caller's organization and effective permissions; no bundled/static app
+     * List callable actions from the live registry-canonical catalog (definitions
+     * from the Catalog registry, scoping from Auth). The response is scoped to the
+     * caller's organization and effective permissions; no bundled/static app
      * action list is used as an authorization source.
      */
     listActions(options?: {
@@ -277,7 +280,7 @@ declare const SERVICES: {
     readonly mail: "https://mail.topolo.app";
     readonly mdm: "https://mdm.topolo.app";
     readonly messages: "https://messages.topolo.app";
-    readonly nexus: "https://nexus-api.topolo.app";
+    readonly nexus: "https://nexus.topolo.app";
     readonly notify: "https://notify.topolo.app";
     readonly observability_watch: "https://observability-watch.topolo.app";
     readonly one: "https://www.topolo.app";
@@ -702,8 +705,8 @@ declare const APPLICATIONS: {
         }, {
             readonly name: "topolo-feed-api";
             readonly kind: "worker";
-            readonly apiUrl: null;
-            readonly domains: readonly [];
+            readonly apiUrl: "https://feed-api.topolo.app";
+            readonly domains: readonly ["feed-api.topolo.app"];
             readonly routes: readonly [];
             readonly serviceId: null;
         }, {
@@ -985,8 +988,8 @@ declare const APPLICATIONS: {
         }, {
             readonly name: "topolo-nexus-gateway";
             readonly kind: "worker";
-            readonly apiUrl: "https://nexus-api.topolo.app";
-            readonly domains: readonly ["nexus-api.topolo.app"];
+            readonly apiUrl: "https://nexus.topolo.app";
+            readonly domains: readonly ["nexus.topolo.app"];
             readonly routes: readonly [];
             readonly serviceId: "nexus";
         }];
@@ -1245,8 +1248,8 @@ declare const APPLICATIONS: {
         }, {
             readonly name: "topolo-socialize-api";
             readonly kind: "worker";
-            readonly apiUrl: null;
-            readonly domains: readonly [];
+            readonly apiUrl: "https://socialize-api.topolo.app";
+            readonly domains: readonly ["socialize-api.topolo.app"];
             readonly routes: readonly [];
             readonly serviceId: null;
         }, {

package/dist/index.js

@@ -85,7 +85,7 @@ var SERVICES = {
   mail: "https://mail.topolo.app",
   mdm: "https://mdm.topolo.app",
   messages: "https://messages.topolo.app",
-  nexus: "https://nexus-api.topolo.app",
+  nexus: "https://nexus.topolo.app",
   notify: "https://notify.topolo.app",
   observability_watch: "https://observability-watch.topolo.app",
   one: "https://www.topolo.app",
@@ -636,8 +636,10 @@ var APPLICATIONS = {
       {
         "name": "topolo-feed-api",
         "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
+        "apiUrl": "https://feed-api.topolo.app",
+        "domains": [
+          "feed-api.topolo.app"
+        ],
         "routes": [],
         "serviceId": null
       },
@@ -1008,9 +1010,9 @@ var APPLICATIONS = {
       {
         "name": "topolo-nexus-gateway",
         "kind": "worker",
-        "apiUrl": "https://nexus-api.topolo.app",
+        "apiUrl": "https://nexus.topolo.app",
         "domains": [
-          "nexus-api.topolo.app"
+          "nexus.topolo.app"
         ],
         "routes": [],
         "serviceId": "nexus"
@@ -1370,8 +1372,10 @@ var APPLICATIONS = {
       {
         "name": "topolo-socialize-api",
         "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
+        "apiUrl": "https://socialize-api.topolo.app",
+        "domains": [
+          "socialize-api.topolo.app"
+        ],
         "routes": [],
         "serviceId": null
       },
@@ -2221,10 +2225,14 @@ var TopoloClient = class _TopoloClient {
     if (!serviceKey) {
       throw new TopoloSdkError("unknown_service", "service is required");
     }
-    if (serviceKey === "auth") {
+    if (serviceKey === "auth" || serviceKey === "developers") {
       const overrideUrl = resolveConfiguredServiceUrl(serviceKey, this.serviceUrls);
       if (overrideUrl) return { serviceKey, baseUrl: overrideUrl };
-      return { serviceKey, baseUrl: DEFAULT_SERVICE_URLS.auth };
+      if (serviceKey === "developers") {
+        const derived = deriveDevelopersFromAuth(resolveConfiguredServiceUrl("auth", this.serviceUrls));
+        if (derived) return { serviceKey, baseUrl: derived };
+      }
+      return { serviceKey, baseUrl: DEFAULT_SERVICE_URLS[serviceKey] };
     }
     const live = await this.resolveLiveCallableService(serviceKey);
     if (live) {
@@ -2264,7 +2272,7 @@ var TopoloClient = class _TopoloClient {
     if (!normalized) return null;
     const configuredServiceId = resolveConfiguredServiceId(normalized, this.serviceIds);
     if (configuredServiceId) return configuredServiceId;
-    const authBase = resolveServiceUrl("auth", this.serviceUrls);
+    const authBase = resolveServiceUrl("developers", this.serviceUrls);
     const cacheKey = `${authBase}|${normalized}`;
     const now = Date.now();
     const cached = _TopoloClient.serviceIdCache.get(cacheKey);
@@ -2318,7 +2326,7 @@ var TopoloClient = class _TopoloClient {
     if (this.serviceCatalogCache && this.serviceCatalogCache.expiresAt > now) {
       return this.serviceCatalogCache.entries;
     }
-    const res = await this.request({ service: "auth", method: "GET", path: "/api/services/catalog" });
+    const res = await this.request({ service: "developers", method: "GET", path: "/api/services/catalog" });
     const raw = res.data?.services ?? res.services;
     if (!Array.isArray(raw)) {
       throw new TopoloSdkError(
@@ -2359,8 +2367,9 @@ var TopoloClient = class _TopoloClient {
     return entries;
   }
   /**
-   * List callable actions from the live Auth catalog. The response is scoped to
-   * the caller's organization and effective permissions; no bundled/static app
+   * List callable actions from the live registry-canonical catalog (definitions
+   * from the Catalog registry, scoping from Auth). The response is scoped to the
+   * caller's organization and effective permissions; no bundled/static app
    * action list is used as an authorization source.
    */
   async listActions(options = {}) {
@@ -2369,7 +2378,7 @@ var TopoloClient = class _TopoloClient {
       return this.actionCatalogCache.entries;
     }
     const res = await this.request({
-      service: "auth",
+      service: "developers",
       method: "GET",
       path: "/api/actions/catalog",
       ...options.service ? { query: { service: options.service } } : {}
@@ -2549,6 +2558,17 @@ function serviceKeyCandidates2(slug) {
 function normalizeLookupKey(value) {
   return String(value || "").trim().toLowerCase().replace(/\s+/g, "-");
 }
+function deriveDevelopersFromAuth(authUrl) {
+  if (!authUrl) return null;
+  try {
+    const url = new URL(authUrl);
+    if (!/^auth\./i.test(url.hostname)) return null;
+    url.hostname = url.hostname.replace(/^auth\./i, "developers.");
+    return url.origin;
+  } catch {
+    return null;
+  }
+}
 function catalogEntryMatches(entry, needle) {
   return catalogEntryLookupKeys(entry).includes(needle);
 }
@@ -2593,6 +2613,7 @@ function normalizeActionCatalogEntry(item) {
     readOnly: Boolean(a.read_only ?? a.readOnly),
     destructive: Boolean(a.destructive),
     requiresConfirmation: Boolean(a.requires_confirmation ?? a.requiresConfirmation),
+    agentAccess: pickAgentAccess(a.agent_access ?? a.agentAccess),
     status: pickActionString(a.status),
     sourceRevision: pickActionString(a.source_revision) ?? pickActionString(a.sourceRevision)
   };
@@ -2603,6 +2624,9 @@ function isHttpMethod(value) {
 function pickActionString(value) {
   return typeof value === "string" && value.trim() ? value.trim() : null;
 }
+function pickAgentAccess(value) {
+  return value === "auto" || value === "confirm" || value === "off" ? value : null;
+}
 function plainObject(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
@@ -2696,7 +2720,6 @@ var CrmModule = class {
   constructor(client) {
     this.client = client;
   }
-  client;
   async listContacts(options = {}) {
     const res = await this.client.request({
       service: "crm",
@@ -2744,7 +2767,6 @@ var IdentityModule = class {
   constructor(client) {
     this.client = client;
   }
-  client;
   /** Returns the resolved user, organization, and permission set for the
    *  current credential. Equivalent to `TopoloClient.introspect()` — exposed
    *  on this module for symmetry with the other domain modules. */
@@ -2758,7 +2780,6 @@ var P2PModule = class {
   constructor(client) {
     this.client = client;
   }
-  client;
   // Directory ----------------------------------------------------------------
   async listDirectory(options = {}) {
     const res = await this.client.request({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topolo/sdk",
-  "version": "0.4.8",
+  "version": "0.4.10",
   "description": "Typed client SDK for the Topolo platform. Used by TopoloCli, TopoloMCP, and third-party agents.",
   "type": "module",
   "main": "./dist/index.js",

package/src/applications.generated.ts

@@ -530,8 +530,10 @@ export const APPLICATIONS = {
       {
         "name": "topolo-feed-api",
         "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
+        "apiUrl": "https://feed-api.topolo.app",
+        "domains": [
+          "feed-api.topolo.app"
+        ],
         "routes": [],
         "serviceId": null
       },
@@ -902,9 +904,9 @@ export const APPLICATIONS = {
       {
         "name": "topolo-nexus-gateway",
         "kind": "worker",
-        "apiUrl": "https://nexus-api.topolo.app",
+        "apiUrl": "https://nexus.topolo.app",
         "domains": [
-          "nexus-api.topolo.app"
+          "nexus.topolo.app"
         ],
         "routes": [],
         "serviceId": "nexus"
@@ -1264,8 +1266,10 @@ export const APPLICATIONS = {
       {
         "name": "topolo-socialize-api",
         "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
+        "apiUrl": "https://socialize-api.topolo.app",
+        "domains": [
+          "socialize-api.topolo.app"
+        ],
         "routes": [],
         "serviceId": null
       },

package/src/client.test.ts

@@ -401,7 +401,7 @@ describe('TopoloClient.getServiceIdBySlug', () => {
       credential: { kind: 'api_key', apiKey: 'x' },
       agent: AGENT,
       fetch: impl,
-      serviceUrls: { auth: 'https://auth.example.com' } as never,
+      serviceUrls: { auth: 'https://auth.example.com', developers: 'https://auth.example.com' } as never,
       serviceIds: { notify: 'service_notify' },
     });
     const id = await client.getServiceIdBySlug('topolo-notify');
@@ -413,7 +413,7 @@ describe('TopoloClient.getServiceIdBySlug', () => {
     const { impl, calls } = stubFetch([
       { body: { success: true, data: { service_id: 'service_abc123', api_base_url: 'https://x-api' } } },
     ]);
-    const client = freshClient(impl, { auth: 'https://auth.example.com' });
+    const client = freshClient(impl, { auth: 'https://auth.example.com', developers: 'https://auth.example.com' });
     const id = await client.getServiceIdBySlug('external-service');
     expect(id).toBe('service_abc123');
     expect(calls[0]!.url).toBe('https://auth.example.com/api/services/by-slug/external-service');
@@ -425,7 +425,7 @@ describe('TopoloClient.getServiceIdBySlug', () => {
 
   it('returns null on 404 and caches the negative result', async () => {
     const { impl, calls } = stubFetch([{ status: 404, body: { success: false } }]);
-    const client = freshClient(impl, { auth: 'https://auth.example.com' });
+    const client = freshClient(impl, { auth: 'https://auth.example.com', developers: 'https://auth.example.com' });
     expect(await client.getServiceIdBySlug('nope')).toBeNull();
     expect(await client.getServiceIdBySlug('nope')).toBeNull();
     expect(calls.length).toBe(1);
@@ -435,7 +435,7 @@ describe('TopoloClient.getServiceIdBySlug', () => {
     const { impl, calls } = stubFetch([
       { body: { success: true, data: { service_id: 'service_external' } } },
     ]);
-    const client = freshClient(impl, { auth: 'https://auth.example.com' });
+    const client = freshClient(impl, { auth: 'https://auth.example.com', developers: 'https://auth.example.com' });
     expect(await client.getServiceIdBySlug('external-service')).toBe('service_external');
     expect(await client.getServiceIdBySlug('external-service')).toBe('service_external');
     expect(calls.length).toBe(1);
@@ -445,7 +445,7 @@ describe('TopoloClient.getServiceIdBySlug', () => {
     const { impl, calls } = stubFetch([
       { body: { success: true, data: { service_id: 'service_x' } } },
     ]);
-    const client = freshClient(impl, { auth: 'https://auth.example.com' });
+    const client = freshClient(impl, { auth: 'https://auth.example.com', developers: 'https://auth.example.com' });
     await client.getServiceIdBySlug('  EXTERNAL-SERVICE  ');
     expect(calls[0]!.url).toBe('https://auth.example.com/api/services/by-slug/external-service');
   });
@@ -467,7 +467,7 @@ describe('TopoloClient.getServiceIdBySlug', () => {
       credential: { kind: 'api_key', apiKey: 'x' },
       agent: AGENT,
       fetch: impl,
-      serviceUrls: { auth: 'https://auth.example.com' } as never,
+      serviceUrls: { auth: 'https://auth.example.com', developers: 'https://auth.example.com' } as never,
     });
     expect(await client.getServiceIdBySlug('flaky')).toBeNull();
     // Second call retries — earlier null was not cached.
@@ -523,7 +523,7 @@ describe('TopoloClient.listServices', () => {
       credential: { kind: 'access_token', accessToken: 'tok_abc' },
       agent: AGENT,
       fetch: impl,
-      serviceUrls: { auth: 'https://auth.example.com' },
+      serviceUrls: { auth: 'https://auth.example.com', developers: 'https://auth.example.com' },
     });
     const out = await client.listServices();
     expect(out).toEqual([
@@ -574,7 +574,7 @@ describe('TopoloClient.listServices', () => {
       credential: { kind: 'api_key', apiKey: 'dak_xyz' },
       agent: AGENT,
       fetch: impl,
-      serviceUrls: { auth: 'https://auth.example.com' },
+      serviceUrls: { auth: 'https://auth.example.com', developers: 'https://auth.example.com' },
     });
     await expect(client.listServices()).rejects.toBeInstanceOf(TopoloHttpError);
   });
@@ -605,7 +605,7 @@ describe('TopoloClient.listServices', () => {
       credential: { kind: 'api_key', apiKey: 'dak_xyz' },
       agent: AGENT,
       fetch: impl,
-      serviceUrls: { auth: 'https://auth.example.com' },
+      serviceUrls: { auth: 'https://auth.example.com', developers: 'https://auth.example.com' },
     });
 
     await client.request({ service: 'mail', path: '/api/health' });
@@ -640,7 +640,7 @@ describe('TopoloClient.listServices', () => {
       credential: { kind: 'api_key', apiKey: 'dak_xyz' },
       agent: AGENT,
       fetch: impl,
-      serviceUrls: { auth: 'https://auth.example.com' },
+      serviceUrls: { auth: 'https://auth.example.com', developers: 'https://auth.example.com' },
     });
 
     await client.request({ service: 'crm', path: '/health' });
@@ -649,6 +649,21 @@ describe('TopoloClient.listServices', () => {
     expect(calls[1]!.url).toBe('https://crm-api.topolo.app/health');
   });
 
+  it('derives the catalog (developers) host from the auth url when developers is unset', async () => {
+    const { impl, calls } = stubFetch([{ body: { data: { services: [] } } }]);
+    const client = new TopoloClient({
+      credential: { kind: 'api_key', apiKey: 'dak_xyz' },
+      agent: AGENT,
+      fetch: impl,
+      // Fleet apps configure only `auth` per-env; the catalog host is derived.
+      serviceUrls: { auth: 'https://auth.stg.topolo.us' },
+    });
+
+    await client.listServices();
+
+    expect(calls[0]!.url).toBe('https://developers.stg.topolo.us/api/services/catalog');
+  });
+
   it('prefers live catalog api_base_url for dynamic services', async () => {
     const { impl, calls } = stubFetch([
       {
@@ -675,7 +690,7 @@ describe('TopoloClient.listServices', () => {
       credential: { kind: 'api_key', apiKey: 'dak_xyz' },
       agent: AGENT,
       fetch: impl,
-      serviceUrls: { auth: 'https://auth.example.com' },
+      serviceUrls: { auth: 'https://auth.example.com', developers: 'https://auth.example.com' },
     });
 
     await client.request({ service: 'future', path: '/health' });
@@ -708,7 +723,7 @@ describe('TopoloClient.listServices', () => {
       credential: { kind: 'api_key', apiKey: 'dak_xyz' },
       agent: AGENT,
       fetch: impl,
-      serviceUrls: { auth: 'https://auth.example.com' },
+      serviceUrls: { auth: 'https://auth.example.com', developers: 'https://auth.example.com' },
     });
 
     await expect(client.request({ service: 'mail', path: '/api/health' })).rejects.toMatchObject({
@@ -742,7 +757,7 @@ describe('TopoloClient.listServices', () => {
       credential: { kind: 'api_key', apiKey: 'dak_xyz' },
       agent: AGENT,
       fetch: impl,
-      serviceUrls: { auth: 'https://auth.example.com' },
+      serviceUrls: { auth: 'https://auth.example.com', developers: 'https://auth.example.com' },
     });
 
     await expect(client.request({ service: 'future-app', path: '/api/health' })).rejects.toMatchObject({
@@ -777,7 +792,7 @@ describe('TopoloClient.listServices', () => {
       credential: { kind: 'api_key', apiKey: 'dak_xyz' },
       agent: AGENT,
       fetch: impl,
-      serviceUrls: { auth: 'https://auth.example.com' },
+      serviceUrls: { auth: 'https://auth.example.com', developers: 'https://auth.example.com' },
     });
 
     await client.request({ service: 'warehouse', path: '/api/one' });
@@ -798,7 +813,7 @@ describe('TopoloClient action catalog', () => {
       credential: { kind: 'access_token', accessToken: 'tok_abc' },
       agent: AGENT,
       fetch: impl,
-      serviceUrls: { auth: 'https://auth.example.com' },
+      serviceUrls: { auth: 'https://auth.example.com', developers: 'https://auth.example.com' },
     });
     const actions = await client.listActions();
     expect(actions.map((action) => action.name)).toEqual([
@@ -815,7 +830,7 @@ describe('TopoloClient action catalog', () => {
       credential: { kind: 'api_key', apiKey: 'dak_xyz' },
       agent: AGENT,
       fetch: impl,
-      serviceUrls: { auth: 'https://auth.example.com' },
+      serviceUrls: { auth: 'https://auth.example.com', developers: 'https://auth.example.com' },
     });
     await client.callAction('messages.list', { mailboxId: 'primary', q: 'Ada', page: 2 });
     const call = requestCalls(calls)[0]!;
@@ -833,7 +848,7 @@ describe('TopoloClient action catalog', () => {
       credential: { kind: 'api_key', apiKey: 'dak_xyz' },
       agent: AGENT,
       fetch: impl,
-      serviceUrls: { auth: 'https://auth.example.com' },
+      serviceUrls: { auth: 'https://auth.example.com', developers: 'https://auth.example.com' },
     });
     await client.callAction('topolo_mail_messages_get', {
       mailboxId: 'primary',
@@ -853,7 +868,7 @@ describe('TopoloClient action catalog', () => {
       credential: { kind: 'api_key', apiKey: 'dak_xyz' },
       agent: AGENT,
       fetch: impl,
-      serviceUrls: { auth: 'https://auth.example.com' },
+      serviceUrls: { auth: 'https://auth.example.com', developers: 'https://auth.example.com' },
     });
     await expect(
       client.callAction('messages.send', { mailboxId: 'primary', subject: 'Hello' }),
@@ -866,7 +881,7 @@ describe('TopoloClient action catalog', () => {
       credential: { kind: 'api_key', apiKey: 'dak_xyz' },
       agent: AGENT,
       fetch: impl,
-      serviceUrls: { auth: 'https://auth.example.com' },
+      serviceUrls: { auth: 'https://auth.example.com', developers: 'https://auth.example.com' },
     });
     await client.callAction('messages.send', { mailboxId: 'primary', subject: 'Hello' }, { confirm: true });
     const call = requestCalls(calls)[0]!;

package/src/client.ts

@@ -151,6 +151,8 @@ export interface TopoloActionCatalogEntry {
   readOnly: boolean;
   destructive: boolean;
   requiresConfirmation: boolean;
+  /** Agent access tier. null/absent when the catalog does not specify one (consumers derive a default). */
+  agentAccess?: 'auto' | 'confirm' | 'off' | null;
   status: string | null;
   sourceRevision: string | null;
 }
@@ -337,10 +339,20 @@ export class TopoloClient {
       throw new TopoloSdkError('unknown_service', 'service is required');
     }
 
-    if (serviceKey === 'auth') {
+    // auth + developers are DIRECT services resolved without a catalog lookup:
+    // developers serves the catalog itself, so resolving it via the catalog would
+    // recurse infinitely.
+    if (serviceKey === 'auth' || serviceKey === 'developers') {
       const overrideUrl = resolveConfiguredServiceUrl(serviceKey, this.serviceUrls);
       if (overrideUrl) return { serviceKey, baseUrl: overrideUrl };
-      return { serviceKey, baseUrl: DEFAULT_SERVICE_URLS.auth };
+      // The catalog host (developers) defaults to the SAME environment as auth.
+      // Apps configure only `auth` per-env; derive developers from it (auth.X ->
+      // developers.X) so the catalog cutover needs no per-app config change.
+      if (serviceKey === 'developers') {
+        const derived = deriveDevelopersFromAuth(resolveConfiguredServiceUrl('auth', this.serviceUrls));
+        if (derived) return { serviceKey, baseUrl: derived };
+      }
+      return { serviceKey, baseUrl: DEFAULT_SERVICE_URLS[serviceKey as 'auth' | 'developers'] };
     }
 
     const live = await this.resolveLiveCallableService(serviceKey);
@@ -386,7 +398,8 @@ export class TopoloClient {
     const configuredServiceId = resolveConfiguredServiceId(normalized, this.serviceIds);
     if (configuredServiceId) return configuredServiceId;
 
-    const authBase = resolveServiceUrl('auth', this.serviceUrls);
+    // app-catalog greenfield: by-slug resolver lives on the Catalog (developers).
+    const authBase = resolveServiceUrl('developers', this.serviceUrls);
     const cacheKey = `${authBase}|${normalized}`;
     const now = Date.now();
     const cached = TopoloClient.serviceIdCache.get(cacheKey);
@@ -450,10 +463,13 @@ export class TopoloClient {
       return this.serviceCatalogCache.entries;
     }
 
+    // app-catalog greenfield: the catalog moved to the Catalog (developers)
+    // service. Auth no longer owns the registry; it only provides scoping, which
+    // the Catalog composes server-side. Consumers pass the per-env developers URL.
     const res = await this.request<
       | { data?: { services?: unknown[] } }
       | { services?: unknown[] }
-    >({ service: 'auth', method: 'GET', path: '/api/services/catalog' });
+    >({ service: 'developers', method: 'GET', path: '/api/services/catalog' });
     const raw =
       (res as { data?: { services?: unknown[] } }).data?.services ??
       (res as { services?: unknown[] }).services;
@@ -525,8 +541,9 @@ export class TopoloClient {
   }
 
   /**
-   * List callable actions from the live Auth catalog. The response is scoped to
-   * the caller's organization and effective permissions; no bundled/static app
+   * List callable actions from the live registry-canonical catalog (definitions
+   * from the Catalog registry, scoping from Auth). The response is scoped to the
+   * caller's organization and effective permissions; no bundled/static app
    * action list is used as an authorization source.
    */
   async listActions(options: { service?: string } = {}): Promise<TopoloActionCatalogEntry[]> {
@@ -539,7 +556,7 @@ export class TopoloClient {
       | { data?: { actions?: unknown[] } }
       | { actions?: unknown[] }
     >({
-      service: 'auth',
+      service: 'developers',
       method: 'GET',
       path: '/api/actions/catalog',
       ...(options.service ? { query: { service: options.service } } : {}),
@@ -774,6 +791,24 @@ function normalizeLookupKey(value: string): string {
   return String(value || '').trim().toLowerCase().replace(/\s+/g, '-');
 }
 
+/**
+ * Derive the Catalog (developers) base URL from a configured auth base URL by
+ * swapping the leading `auth` host label for `developers` (auth.stg.topolo.us ->
+ * developers.stg.topolo.us). Returns null if the auth URL is absent or doesn't
+ * start with the `auth.` label, so the caller falls back to the bundled default.
+ */
+function deriveDevelopersFromAuth(authUrl: string | null | undefined): string | null {
+  if (!authUrl) return null;
+  try {
+    const url = new URL(authUrl);
+    if (!/^auth\./i.test(url.hostname)) return null;
+    url.hostname = url.hostname.replace(/^auth\./i, 'developers.');
+    return url.origin;
+  } catch {
+    return null;
+  }
+}
+
 function catalogEntryMatches(entry: TopoloServiceCatalogEntry, needle: string): boolean {
   return catalogEntryLookupKeys(entry).includes(needle);
 }
@@ -823,6 +858,7 @@ function normalizeActionCatalogEntry(item: unknown): TopoloActionCatalogEntry |
     readOnly: Boolean(a.read_only ?? a.readOnly),
     destructive: Boolean(a.destructive),
     requiresConfirmation: Boolean(a.requires_confirmation ?? a.requiresConfirmation),
+    agentAccess: pickAgentAccess(a.agent_access ?? a.agentAccess),
     status: pickActionString(a.status),
     sourceRevision: pickActionString(a.source_revision) ?? pickActionString(a.sourceRevision),
   };
@@ -836,6 +872,10 @@ function pickActionString(value: unknown): string | null {
   return typeof value === 'string' && value.trim() ? value.trim() : null;
 }
 
+function pickAgentAccess(value: unknown): 'auto' | 'confirm' | 'off' | null {
+  return value === 'auto' || value === 'confirm' || value === 'off' ? value : null;
+}
+
 function plainObject(value: unknown): Record<string, unknown> {
   return value && typeof value === 'object' && !Array.isArray(value)
     ? value as Record<string, unknown>

package/src/index.test.ts

@@ -63,7 +63,7 @@ describe('createTopolo', () => {
 describe('package surface re-exports', () => {
   it('re-exports the error classes from the barrel', () => {
     expect(new TopoloAuthError('x').name).toBe('TopoloAuthError');
-    expect(new TopoloHttpError('auth', '/p', 500).name).toBe('TopoloHttpError');
+    expect(new TopoloHttpError('auth', '/p', 500, null).name).toBe('TopoloHttpError');
     expect(new TopoloPermissionError('nope', []).name).toBe('TopoloPermissionError');
   });
 });

package/src/services.generated.ts

@@ -30,7 +30,7 @@ export const SERVICES = {
   mail: "https://mail.topolo.app",
   mdm: "https://mdm.topolo.app",
   messages: "https://messages.topolo.app",
-  nexus: "https://nexus-api.topolo.app",
+  nexus: "https://nexus.topolo.app",
   notify: "https://notify.topolo.app",
   observability_watch: "https://observability-watch.topolo.app",
   one: "https://www.topolo.app",