Topolo Support

Authority

Service IDs:

Repos:

Hosts:

Dependencies: topolo-auth, topolo-nexus, applications-packages

Depends on Topolo Auth: yes

Contract Source

Type: curated

Source: PlatformApplications/TopoloSupport/functions/api/support/[[path]].ts

Source exists: no

Topolo Support is a standalone Worker application with a support-owned /api/support/* route family for workspace context, ticket, message, notification-dispatch, and signed inbound webhook workflow. The browser app now consumes the canonical shared `PlatformApplications/packages/topolo-ui-kit` and `PlatformApplications/packages/topolo-auth-client` surfaces for its public landing/login pages, authenticated shell, launcher, local command palette, loading/auth transitions, and browser auth contract. Its signed desk should follow the same fixed responsive `TopoloShell` sidebar/header composition used by the other first-party apps rather than keeping a Support-local static layout inside the shell container. It uses the same-origin /api/auth/* gateway only for Auth-owned reads such as session, user, organization, and launcher-catalog context, with that gateway preserving the upstream Auth /api/* path instead of stripping it; browser login URL construction and callback completion delegate to the shared Topolo auth client, including one-time sso_code redemption before the signed workspace route continues, and do not support direct bearer-token callbacks or /sso?token= bridge routes. Support resolves the concrete Auth service id for `topolo-support` at runtime through Auth `/api/services/by-slug/topolo-support`; source, seed scripts, and browser bundles must not carry environment-specific `svc_*` or `srv_*` ids. Support workflow state is persisted in the support-owned D1 schema instead of Auth, including explicit Support-owned workspaces and inboxes for tenant queue routing, checked-in schema ownership in `PlatformApplications/TopoloSupport/scripts/support-schema.sql`, a first-party ticket activity ledger plus notification outbox for reply and assignment workflow, first-party retry-state fields and scheduled backlog processing for unattended notification recovery, a first-party `support_webhook_events` audit and idempotency table for inbound provider callbacks, the same Worker serving the built frontend asset bundle, workspace-scoped macros, and signed API tenant-safe queue access so Topolo operators can switch across workspaces while org operators and requester-grade users stay confined to their own support scope. Outbound email delivery is delegated to Topolo Nexus rather than being sent directly from the Support worker, using a dedicated Support trusted service token when no caller bearer token is available.

API key scopes in Auth catalog: 6

Auth Requirements

No global OpenAPI security scheme is declared.

• context.read
• macros.read
• macros.write
• replies.invoke
• tickets.read
• tickets.write

Runtime and Deployment

Wrangler surfaces: none detected

Environment variables: none derived

Routes: workers.dev fallback or no explicit route declared

Observability enabled: no explicit signal found