@motorical/scope-catalog 0.1.0 → 0.3.0

package/README.md

@@ -2,7 +2,7 @@
 
 Canonical MCP/OAuth scope metadata for Motorical. One source of truth for:
 
-- what each of the seven grantable MCP scopes means, for an agent AND for a customer (`SCOPES`)
+- what each of the eight grantable MCP scopes means, for an agent AND for a customer (`SCOPES`)
 - which Public API scopes each MCP scope unlocks (`SCOPES[id].publicScopes`, `publicScopesFor`)
 - "manage implies read", in both the MCP and Public API vocabularies (`implication.js`)
 - which scopes a tool needs, and which scopes a given MCP resource server allows (`tools.js`)
@@ -11,3 +11,11 @@ Canonical MCP/OAuth scope metadata for Motorical. One source of truth for:
 Consumed by `motorical-backend` (OAuth server, Public API auth) and `@motorical/mcp`
 (the hosted/local MCP server). See `motorical-docs/specs/2026-09-23-mcp-p7-scope-legibility-founding-doc.md`
 for why this package exists.
+
+## Motor Block management
+
+`manage:motor-blocks` maps to the existing Public API `config.read` and
+`config.manage` scopes. Its dedicated resource is
+`https://mcp.motorical.com/v1/motorical_motor_blocks/mcp`, which advertises the
+nine bounded production Motor Block lifecycle tools. Communications Block and
+marketing-block operations are deliberately excluded.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@motorical/scope-catalog",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Canonical MCP/OAuth scope metadata for Motorical — descriptions, Public API scope mapping, implied-read rules, and declarative tool/resource membership. One source of truth consumed by motorical-backend and @motorical/mcp.",
   "main": "./src/index.js",
   "engines": {

package/src/scopes.js

@@ -39,13 +39,27 @@ const SCOPES = {
     agentDescription: 'Add, verify, and read sending domains and their DNS health. Includes everything read:domains grants.',
     customerAction: 'Add and verify sending domains',
   },
+  'manage:motor-blocks': {
+    resource: 'motor-blocks',
+    level: 'manage',
+    publicScopes: ['config.read', 'config.manage'],
+    agentDescription: 'List and manage the ordinary lifecycle of production Motor Blocks: create, rename, change type, assign domain, deactivate, reactivate, and delete. Includes no credential values and cannot change the active auth method.',
+    customerAction: 'Manage production Motor Blocks',
+  },
   'manage:sandbox': {
     resource: 'sandbox',
     level: 'manage',
     publicScopes: ['sandbox.manage'],
-    agentDescription: 'Check, provision, and convert the developer sandbox. Sandbox allowlist requests/confirmations additionally require a dashboard session — this scope alone does not make them callable over OAuth.',
+    agentDescription: 'Check, provision, and convert the developer sandbox. Allowlisting by 6-digit code additionally requires a dashboard session, so this scope alone does not make that callable over OAuth; recipients confirm by emailed link under manage:recipients instead.',
     customerAction: 'Manage your developer sandbox',
   },
+  'manage:recipients': {
+    resource: 'recipients',
+    level: 'manage',
+    publicScopes: ['recipients.manage'],
+    agentDescription: 'Request permission to send test email to an address you name, and see which addresses have confirmed or stopped. The recipient confirms by clicking an emailed link; an agent can never confirm on their behalf.',
+    customerAction: 'Ask recipients to allow your test emails, and see who has confirmed',
+  },
   'manage:webhooks': {
     resource: 'webhooks',
     level: 'manage',

package/src/tools.js

@@ -54,6 +54,9 @@ const SANDBOX_TOOLS = [
   'motorical_sandbox_convert',
   'motorical_sandbox_allowlist_request',
   'motorical_sandbox_allowlist_confirm',
+  'motorical_free_recipient_add',
+  'motorical_free_recipient_list',
+  'motorical_free_recipient_remove',
 ];
 
 const WEBHOOK_TOOLS = [
@@ -66,8 +69,27 @@ const WEBHOOK_TOOLS = [
   'motorical_webhook_get_stats',
 ];
 
+const MOTOR_BLOCK_TOOLS = [
+  'motorical_motor_block_list',
+  'motorical_motor_block_create',
+  'motorical_motor_block_rename',
+  'motorical_motor_block_change_type',
+  'motorical_motor_block_assign_domain',
+  'motorical_motor_block_deactivate',
+  'motorical_motor_block_reactivate',
+  'motorical_motor_block_delete',
+  'motorical_motor_block_delete_status',
+];
+
 const ALL_TOOLS = [
-  ...new Set([...TRANSACTIONAL_TOOLS, ...ANALYTICS_TOOLS, ...DOMAIN_TOOLS, ...SANDBOX_TOOLS, ...WEBHOOK_TOOLS]),
+  ...new Set([
+    ...TRANSACTIONAL_TOOLS,
+    ...ANALYTICS_TOOLS,
+    ...DOMAIN_TOOLS,
+    ...SANDBOX_TOOLS,
+    ...WEBHOOK_TOOLS,
+    ...MOTOR_BLOCK_TOOLS,
+  ]),
 ];
 
 const SERVER_TOOLS = {
@@ -77,6 +99,7 @@ const SERVER_TOOLS = {
   domains: DOMAIN_TOOLS,
   sandbox: SANDBOX_TOOLS,
   webhooks: WEBHOOK_TOOLS,
+  motorBlocks: MOTOR_BLOCK_TOOLS,
   signup: ['motorical_signup_handoff'],
 };
 
@@ -113,6 +136,9 @@ const TOOL_SCOPES = {
   motorical_sandbox_convert: ['manage:sandbox'],
   motorical_sandbox_allowlist_request: ['manage:sandbox'],
   motorical_sandbox_allowlist_confirm: ['manage:sandbox'],
+  motorical_free_recipient_add: ['manage:recipients'],
+  motorical_free_recipient_list: ['manage:recipients'],
+  motorical_free_recipient_remove: ['manage:recipients'],
   motorical_webhook_list: ['read:webhooks'],
   motorical_webhook_create: ['manage:webhooks'],
   motorical_webhook_update: ['manage:webhooks'],
@@ -120,6 +146,15 @@ const TOOL_SCOPES = {
   motorical_webhook_test: ['manage:webhooks'],
   motorical_webhook_get_deliveries: ['read:webhooks'],
   motorical_webhook_get_stats: ['read:webhooks'],
+  motorical_motor_block_list: ['manage:motor-blocks'],
+  motorical_motor_block_create: ['manage:motor-blocks'],
+  motorical_motor_block_rename: ['manage:motor-blocks'],
+  motorical_motor_block_change_type: ['manage:motor-blocks'],
+  motorical_motor_block_assign_domain: ['manage:motor-blocks'],
+  motorical_motor_block_deactivate: ['manage:motor-blocks'],
+  motorical_motor_block_reactivate: ['manage:motor-blocks'],
+  motorical_motor_block_delete: ['manage:motor-blocks'],
+  motorical_motor_block_delete_status: ['manage:motor-blocks'],
 };
 
 /** `|| []`: a tool with no entry (signup's own tool) contributes no scopes rather than throwing. */
@@ -134,6 +169,7 @@ const SERVER_SLUGS = {
   domains: 'motorical_domains',
   sandbox: 'motorical_sandbox',
   webhooks: 'motorical_webhooks',
+  motorBlocks: 'motorical_motor_blocks',
   signup: 'signup',
 };