@groundfloorcloud/mcp 0.1.11 → 0.1.13

package/dist/index.js

@@ -685,11 +685,11 @@ When the handler looks right locally, \`gf deploy\` the same tree.
 Do not pass credential-shaped keys as \`--env KEY=VALUE\` (\`*_SECRET\`,
 \`*_API_KEY\`, \`DATABASE_URL\`, \u2026). Control Plane returns **422**.
 \`gf secrets set KEY\` then \`gf deploy --secret KEY\` (inject by reference).
-This requires \`CODERUNNER_INJECT_ENV_SECRETS\` enabled for the workspace \u2014
-**off by default**. If \`--secret\` 422s naming that setting, either ask your
-platform operator to enable it, or read the secret live via M2M
-\`secrets:read\` instead (below) rather than falling back to plaintext
-\`--env\`.
+This requires \`CODERUNNER_INJECT_ENV_SECRETS\`, a platform-wide Control Plane
+setting \u2014 **off by default** and currently off. It cannot be enabled per
+workspace, so there is nothing to request. If \`--secret\` 422s naming that
+setting, read the secret live via M2M \`secrets:read\` instead (below) rather
+than falling back to plaintext \`--env\`.
 
 ## M2M tokens (Vault, Files, and Secrets)
 
@@ -699,6 +699,11 @@ M2M tokens**, attach it on the Coderunner card, then deploy. v1 M2M is Team
 Writer on that workspace (full Vault skip-ACL + Files). Grant site users on
 **Administer \u2192 Access**. Never inject a Dataplane key.
 
+Cache the minted JWT for its \`expires_in\` (refresh at ~80%). Never mint per
+request: \`POST \u2026/m2m/token\` is rate-limited per client and per IP (default
+20/minute each) and returns **429** when exceeded. Treat 429/401 from the mint
+call as retryable, not a crash.
+
 An M2M client can also read secret **values** directly at runtime instead
 of (or alongside) \`--secret\` deploy-time injection: grant it the
 **\`secrets:read\`** scope (same Portal **Administer \u2192 M2M tokens** screen,
@@ -900,6 +905,14 @@ database only if you need a different engine or workspace-owned isolation
 (\`docs_get\` id \`databases\`). Local UI without live vault:
 \`npm run dev:fixtures\`.
 
+Detail routes (e.g. \`records/:id\`): once the record loads, call
+\`setBreadcrumbLabel(record.name)\` from the kit's \`src/lib/shellBridge.ts\`
+(wraps \`window.__GF_SET_BREADCRUMB_LABEL__(location.pathname, label)\`; no-op
+outside Shell) so the breadcrumb does not show the raw id. Give that route
+\`hidden: true\` in the manifest so it stays out of the sidebar nav but still
+routes (omit it or use \`false\` otherwise \u2014 never \`null\`). \`visibility:
+"public"\` makes a route reachable without login.
+
 ## suggest_cli
 
 - init_app \u2192 \`gf apps init --slug <portal-slug>\`
@@ -1023,7 +1036,7 @@ var DOC_CATALOG = [
     path: "/docs/customer-portal/coderunner",
     summary: "Workload types (function, job, schedule, service/Deployment), runtime contract (scripts.start, 0.0.0.0:8080), Dockerfile for services, Coderunner identities for Vault, App authentication optional, local live data, gf deploy.",
     embedded: CODERUNNER_GUIDE,
-    lastUpdated: "2026-09-23"
+    lastUpdated: "2026-09-25"
   },
   {
     id: "coderunner-runtime",
@@ -1039,7 +1052,7 @@ var DOC_CATALOG = [
     path: "/docs/integrations/coderunner/overview",
     summary: "Architecture and lifecycle. Prefer docs_get id coderunner for type usage, Dockerfile, and create prerequisites.",
     embedded: CODERUNNER_GUIDE,
-    lastUpdated: "2026-09-23"
+    lastUpdated: "2026-09-25"
   },
   {
     id: "authentication",
@@ -1057,7 +1070,7 @@ var DOC_CATALOG = [
     id: "m2m",
     title: "M2M tokens",
     path: "/docs/customer-portal/m2m-tokens",
-    summary: "Confidential client secret \u2192 short Control Plane JWT (typ=m2m). Attach on Coderunner or gf m2m token. Never DATAPLANE_SERVICE_API_KEY. v1 is Team Writer, no collection ACL."
+    summary: "Confidential client secret \u2192 short Control Plane JWT (typ=m2m). Attach on Coderunner or gf m2m token. Never DATAPLANE_SERVICE_API_KEY. v1 is Team Writer, no collection ACL. Secrets only with the opt-in secrets:read scope (read-only). Cache the token; minting is rate-limited per client and IP."
   },
   {
     id: "api-authentication",
@@ -1071,7 +1084,7 @@ var DOC_CATALOG = [
     path: "/docs/integrations/shell",
     summary: "Product Apps vs Coderunner. Always gf apps init --slug <portal-slug>, then npm run release and gf apps publish --path release.zip. Never zip dist/ or upload only remoteEntry.js.",
     embedded: SHELL_APP_GUIDE,
-    lastUpdated: "2026-09-22"
+    lastUpdated: "2026-09-24"
   },
   {
     id: "design-standard",
@@ -1111,7 +1124,7 @@ var DOC_CATALOG = [
     path: "/docs/customer-portal/scheduled-jobs",
     summary: "workload_type=schedule plus cron. gf coderunner status shows type/schedule/last_job. Use Process Log, not a public URL.",
     embedded: CODERUNNER_GUIDE,
-    lastUpdated: "2026-09-23"
+    lastUpdated: "2026-09-25"
   }
 ];
 function docUrl(entry) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groundfloorcloud/mcp",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "Groundfloor MCP — inspect workspace state and docs; take actions with the gf CLI.",
   "type": "module",
   "bin": {
@@ -38,6 +38,7 @@
   },
   "devDependencies": {
     "@types/node": "^20",
+    "esbuild": "^0.27.7",
     "tsup": "^8.3.0",
     "typescript": "^5"
   },