@groundfloorcloud/mcp 0.2.0 → 0.2.2

package/dist/index.js

@@ -516,17 +516,39 @@ the provider.
 
 ## Users and roles (Groundfloor mode)
 
-- **Invite user**: they set their own password (email needs Branding set up).
-- **Add user**: you set a password now; no email is sent.
+- **Invite user**: they set their own password from an emailed invitation.
+- **Add user**: you set a password now; they get an email with their sign-in
+  address and role (never the password).
 - Each user has a role: built-in \`viewer\`, \`user\`, \`admin\`, or a custom role
   created on the **Roles** tab. Roles here are unrelated to Portal team roles.
 - The role decides what the user reaches once granted on **Site access**
   (Data Vault collections, workspace-wide Files, App launch). The built-in
-  \`admin\` role reaches everything. A signed-in user with no recognised role
+  \`admin\` role is granted like any other role: new collections start with
+  an \`admin\` grant and new workspaces give it Files write, and removing a
+  grant removes admins' access. Keep \`admin\` in every Access PUT unless the
+  user means to remove it. A signed-in user with no recognised role
   gets 403 on role-gated endpoints (Vault, feature flags).
 - SSO (OIDC or SAML) can be connected per workspace; role names in the
   provider's tokens must match the roles granted on Site access.
 
+## Sign-in email (invites, password resets, email verification)
+
+- Sent by **Groundfloor email** by default in every workspace: a Groundfloor
+  no-reply address with the organization's name as sender. Nothing to set up;
+  do not tell the user to configure email before inviting.
+- To use their own mail server, the user chooses **Your own email server**
+  under **Branding \u2192 Email sending** (host, port and from address required;
+  port 25, 465, 587 or 2525), then **Send test email** (goes to their own
+  verified address). API: \`PUT /v1/workspaces/{id}/auth\` with
+  \`mail: {mode: "custom", ...}\`; test with
+  \`POST /v1/workspaces/{id}/auth/mail/test\`.
+- A failing custom server does not fall back to Groundfloor email; the send
+  fails. Changing host or port needs the password again.
+- **Warning:** saving a \`mail\` block with no \`host\` (or
+  \`mode: "groundfloor"\`) switches back to Groundfloor email and deletes the
+  stored custom server settings and password. Only send \`mail\` when the user
+  means to change email settings.
+
 ## Multi-tenant (customer companies inside one workspace)
 
 Turn on **Multi-tenant** in Settings to get a Tenants tab: one tenant per
@@ -1326,6 +1348,18 @@ Grant site roles on **Administer \u2192 Access**. Workload identities get
 collection grants via \`PUT \u2026/vault/collections/{name}/acl\`. M2M is Team
 Writer (workspace-wide), not an Access subject.
 
+- \`PUT \u2026/acl\` is a **full replace**, saved exactly as sent. \`GET\` the
+  current grants first and send them all back with your change: every site
+  role grant, \`admin\` included, and every workload identity grant. Anything
+  you leave out is removed.
+- The built-in site role \`admin\` is granted like any other role. New
+  collections start with \`admin\` \u2192 \`delete\`; if a PUT leaves \`admin\`
+  out, admins lose access to that collection. Never drop it unless the user
+  asked for that.
+- Only builders (team members with \`ddl\`, or the Client Portal) read or
+  change ACLs. A site (app end user) token gets 403 on every ACL route,
+  even with the \`admin\` role.
+
 ## Identities vs M2M
 
 - Unattended Coderunners: attach an M2M client, \`gf deploy\`, then
@@ -1405,15 +1439,15 @@ var DOC_CATALOG = [
     id: "authentication",
     title: "Workspace Authentication",
     path: "/docs/access/app-authentication",
-    summary: "App end users sign in only to the app via the workspace App Authentication realm; no Groundfloor console account or workspace membership. Modes none / Groundfloor / external, users and roles, SSO, multi-tenant. Optional; not required to create Apps or Coderunners. Separate from portal Team.",
+    summary: "App end users sign in only to the app via the workspace App Authentication realm; no Groundfloor console account or workspace membership. Modes none / Groundfloor / external, users and roles, SSO, multi-tenant, sign-in email (Groundfloor email by default, or your own server). Optional; not required to create Apps or Coderunners. Separate from portal Team.",
     embedded: APP_AUTHENTICATION_GUIDE,
-    lastUpdated: "2026-10-08"
+    lastUpdated: "2026-10-13"
   },
   {
     id: "access",
     title: "Access",
     path: "/docs/access/site-access",
-    summary: "Grant site roles Data Vault collections, workspace-wide Files, and Apps launch. Admin is implicit. M2M is not an Access subject. Team membership is unchanged."
+    summary: "Grant site roles Data Vault collections, workspace-wide Files, and Apps launch. The built-in admin role is granted like any other role; every Access PUT is a full replace, so include admin and the existing grants or they are removed. Only builders manage Access; app end users get 403. M2M is not an Access subject. Team membership is unchanged."
   },
   {
     id: "m2m",
@@ -1465,7 +1499,7 @@ var DOC_CATALOG = [
     path: "/docs/api/vault",
     summary: "Create collections with JSON Schema, record routes (/vault/collections/{collection}/\u2026), query request/response (items, total, has_more, next_offset, limit 1-500), $text substring search (bounded scan, chunked_scan/scan_cursor), ACLs, implicit tables, nested filters, identities vs M2M, secrets fallback.",
     embedded: VAULT_GUIDE,
-    lastUpdated: "2026-10-09"
+    lastUpdated: "2026-10-12"
   },
   {
     id: "feature-flags",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groundfloorcloud/mcp",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Groundfloor MCP — inspect workspace state and docs; take actions with the gf CLI.",
   "type": "module",
   "bin": {