Topolo Support

Authority

Service IDs:

Repos: PlatformApplications/TopoloSupport

Hosts:

Dependencies: topolo-auth, topolo-nexus

Depends on Topolo Auth: yes

Contract Source

Type: curated

Source: PlatformApplications/TopoloSupport/functions/api/support/[[path]].ts

Source exists: yes

Topolo Support is a standalone Worker application with a support-owned /api/support/* route family for workspace context, ticket, message, notification-dispatch, and signed inbound webhook workflow. The browser app now consumes the canonical shared `PlatformApplications/packages/topolo-ui-kit` and `PlatformApplications/packages/topolo-auth-client` surfaces for its public landing/login pages, authenticated shell, launcher, local command palette, loading/auth transitions, and browser auth contract. Its signed desk should follow the same fixed responsive `TopoloShell` sidebar/header composition used by the other first-party apps rather than keeping a Support-local static layout inside the shell container. It uses the same-origin /api/auth/* gateway only for Auth-owned reads such as session, user, organization, and launcher-catalog context, with that gateway preserving the upstream Auth /api/* path instead of stripping it; callback completion must also rehydrate local auth state from the shared browser auth events before the signed workspace route continues. Support workflow state is persisted in the support-owned D1 schema instead of Auth, including explicit Support-owned workspaces and inboxes for tenant queue routing, checked-in schema ownership in `PlatformApplications/TopoloSupport/scripts/support-schema.sql`, a first-party ticket activity ledger plus notification outbox for reply and assignment workflow, first-party retry-state fields and scheduled backlog processing for unattended notification recovery, a first-party `support_webhook_events` audit and idempotency table for inbound provider callbacks, the same Worker serving the built frontend asset bundle, workspace-scoped macros, and signed API tenant-safe queue access so Topolo operators can switch across workspaces while org operators and requester-grade users stay confined to their own support scope. Outbound email delivery is delegated to Topolo Nexus rather than being sent directly from the Support worker, using a dedicated Support trusted service token when no caller bearer token is available.

API key scopes in Auth catalog: 5

Auth Requirements

No global OpenAPI security scheme is declared.

• context.read
• macros.read
• macros.write
• tickets.read
• tickets.write

Runtime and Deployment

Wrangler surfaces: PlatformApplications/TopoloSupport/wrangler.toml

Environment variables: AUTH_API_URL, TOPOLO_NEXUS_API_URL

Routes: workers.dev or Pages-only delivery

Observability enabled: yes