@groundfloorcloud/mcp 0.2.0 → 0.2.1

package/dist/index.js

@@ -522,7 +522,10 @@ the provider.
   created on the **Roles** tab. Roles here are unrelated to Portal team roles.
 - The role decides what the user reaches once granted on **Site access**
   (Data Vault collections, workspace-wide Files, App launch). The built-in
-  \`admin\` role reaches everything. A signed-in user with no recognised role
+  \`admin\` role is granted like any other role: new collections start with
+  an \`admin\` grant and new workspaces give it Files write, and removing a
+  grant removes admins' access. Keep \`admin\` in every Access PUT unless the
+  user means to remove it. A signed-in user with no recognised role
   gets 403 on role-gated endpoints (Vault, feature flags).
 - SSO (OIDC or SAML) can be connected per workspace; role names in the
   provider's tokens must match the roles granted on Site access.
@@ -1326,6 +1329,18 @@ Grant site roles on **Administer \u2192 Access**. Workload identities get
 collection grants via \`PUT \u2026/vault/collections/{name}/acl\`. M2M is Team
 Writer (workspace-wide), not an Access subject.
 
+- \`PUT \u2026/acl\` is a **full replace**, saved exactly as sent. \`GET\` the
+  current grants first and send them all back with your change: every site
+  role grant, \`admin\` included, and every workload identity grant. Anything
+  you leave out is removed.
+- The built-in site role \`admin\` is granted like any other role. New
+  collections start with \`admin\` \u2192 \`delete\`; if a PUT leaves \`admin\`
+  out, admins lose access to that collection. Never drop it unless the user
+  asked for that.
+- Only builders (team members with \`ddl\`, or the Client Portal) read or
+  change ACLs. A site (app end user) token gets 403 on every ACL route,
+  even with the \`admin\` role.
+
 ## Identities vs M2M
 
 - Unattended Coderunners: attach an M2M client, \`gf deploy\`, then
@@ -1407,13 +1422,13 @@ var DOC_CATALOG = [
     path: "/docs/access/app-authentication",
     summary: "App end users sign in only to the app via the workspace App Authentication realm; no Groundfloor console account or workspace membership. Modes none / Groundfloor / external, users and roles, SSO, multi-tenant. Optional; not required to create Apps or Coderunners. Separate from portal Team.",
     embedded: APP_AUTHENTICATION_GUIDE,
-    lastUpdated: "2026-10-08"
+    lastUpdated: "2026-10-12"
   },
   {
     id: "access",
     title: "Access",
     path: "/docs/access/site-access",
-    summary: "Grant site roles Data Vault collections, workspace-wide Files, and Apps launch. Admin is implicit. M2M is not an Access subject. Team membership is unchanged."
+    summary: "Grant site roles Data Vault collections, workspace-wide Files, and Apps launch. The built-in admin role is granted like any other role; every Access PUT is a full replace, so include admin and the existing grants or they are removed. Only builders manage Access; app end users get 403. M2M is not an Access subject. Team membership is unchanged."
   },
   {
     id: "m2m",
@@ -1465,7 +1480,7 @@ var DOC_CATALOG = [
     path: "/docs/api/vault",
     summary: "Create collections with JSON Schema, record routes (/vault/collections/{collection}/\u2026), query request/response (items, total, has_more, next_offset, limit 1-500), $text substring search (bounded scan, chunked_scan/scan_cursor), ACLs, implicit tables, nested filters, identities vs M2M, secrets fallback.",
     embedded: VAULT_GUIDE,
-    lastUpdated: "2026-10-09"
+    lastUpdated: "2026-10-12"
   },
   {
     id: "feature-flags",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groundfloorcloud/mcp",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Groundfloor MCP — inspect workspace state and docs; take actions with the gf CLI.",
   "type": "module",
   "bin": {