@motorical/scope-catalog 0.8.0 → 0.10.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@motorical/scope-catalog",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "Canonical MCP/OAuth scope metadata for Motorical — descriptions, Public API scope mapping, implied-read rules, and declarative tool/resource membership. One source of truth consumed by motorical-backend and @motorical/mcp.",
   "main": "./src/index.js",
   "engines": {

package/src/scopes.js

@@ -81,7 +81,9 @@ const SCOPES = {
     agentDescription: 'List and read sending domains, their DNS records and email-authentication health, and read a Motor Block\'s configuration, without adding or verifying any domain.',
     customerAction: 'View your sending domains and Motor Block configuration',
   },
-  // Communications (marketing). One area per scope so the consent screen shows sending on its own line. No Public API scopes:
+  // Communications (marketing). Reading and the two edit scopes share ONE consent line (`resource: 'comms'`, one label for both edit scopes:
+  // the account has one person, so the first consent stays short); sending, workspace settings and webhooks each keep their own line,
+  // so sending is never hidden under editing. No Public API scopes:
   // the Comms API is not a Public API route, the Communications Block checks these itself. There is deliberately no scope for
   // permanent delete, recycle-bin cleanup or GDPR export/erase: those stay human-only.
   'read:comms': {
@@ -92,18 +94,18 @@ const SCOPES = {
     customerAction: 'View your lists, templates, campaigns and results',
   },
   'write:comms.audience': {
-    resource: 'comms-audience',
+    resource: 'comms',
     level: 'manage',
     publicScopes: [],
     agentDescription: 'Create and change lists and contacts, add contacts (with a dry run), derive lists from lists, import, and add or remove suppressions. Includes everything read:comms grants. Cannot delete anything permanently.',
-    customerAction: 'Add and change your lists and contacts',
+    customerAction: 'View and edit your lists, contacts, templates and campaign drafts, and send test emails to you. This never emails your contacts.',
   },
   'write:comms.content': {
-    resource: 'comms-content',
+    resource: 'comms',
     level: 'manage',
     publicScopes: [],
     agentDescription: 'Create and change templates, the brand kit and campaign drafts, duplicate and compile campaigns, and send a test email to the account owner only. Includes everything read:comms grants. Does not send to your contacts.',
-    customerAction: 'Create and edit email templates and campaign drafts, and send test emails to you',
+    customerAction: 'View and edit your lists, contacts, templates and campaign drafts, and send test emails to you. This never emails your contacts.',
   },
   'send:comms.campaign': {
     resource: 'comms-sending',

package/src/tools.js

@@ -91,7 +91,35 @@ const MOTOR_BLOCK_TOOLS = [
  * the comms audience, grant resolution, scope table, workspace binding). Not in ALL_TOOLS and not on the main server: marketing has its
  * own server and its own consent. More tools arrive in M3, each adding the scope it needs to this server's offer.
  */
-const COMMS_TOOLS = ['comms_get_readiness', 'comms_get_map'];
+const COMMS_TOOLS = [
+  'comms_get_readiness', 'comms_get_map',
+  'comms_list_workspaces',
+  'comms_list_marketing_blocks',
+  'comms_list_lists',
+  'comms_get_list',
+  'comms_compare_lists',
+  'comms_get_list_relations',
+  'comms_list_templates',
+  'comms_get_template',
+  'comms_get_template_rules',
+  'comms_lint_template',
+  'comms_suggest_template_fixes',
+  'comms_check_links',
+  'comms_preview_template',
+  'comms_list_starters',
+  'comms_get_brand_kit',
+  'comms_list_campaigns',
+  'comms_get_campaign',
+  // M3-2: content writes (write:comms.content) and the list card (write:comms.audience). Nothing here deletes, sends or touches contacts.
+  'comms_create_template',
+  'comms_create_template_from_starter',
+  'comms_update_template',
+  'comms_apply_template_fixes',
+  'comms_duplicate_template',
+  'comms_set_brand_kit',
+  'comms_create_list',
+  'comms_update_list',
+];
 
 const ALL_TOOLS = [
   ...new Set([
@@ -182,6 +210,31 @@ const TOOL_SCOPES = {
   motorical_motor_block_delete_status: ['manage:motor-blocks'],
   comms_get_readiness: ['read:comms'],
   comms_get_map: ['read:comms'],
+  comms_list_workspaces: ['read:comms'],
+  comms_list_marketing_blocks: ['read:comms'],
+  comms_list_lists: ['read:comms'],
+  comms_get_list: ['read:comms'],
+  comms_compare_lists: ['read:comms'],
+  comms_get_list_relations: ['read:comms'],
+  comms_list_templates: ['read:comms'],
+  comms_get_template: ['read:comms'],
+  comms_get_template_rules: ['read:comms'],
+  comms_lint_template: ['read:comms'],
+  comms_suggest_template_fixes: ['read:comms'],
+  comms_check_links: ['read:comms'],
+  comms_preview_template: ['read:comms'],
+  comms_list_starters: ['read:comms'],
+  comms_get_brand_kit: ['read:comms'],
+  comms_list_campaigns: ['read:comms'],
+  comms_get_campaign: ['read:comms'],
+  comms_create_template: ['write:comms.content'],
+  comms_create_template_from_starter: ['write:comms.content'],
+  comms_update_template: ['write:comms.content'],
+  comms_apply_template_fixes: ['write:comms.content'],
+  comms_duplicate_template: ['write:comms.content'],
+  comms_set_brand_kit: ['write:comms.content'],
+  comms_create_list: ['write:comms.audience'],
+  comms_update_list: ['write:comms.audience'],
 };
 
 /** `|| []`: a tool with no entry (signup's own tool) contributes no scopes rather than throwing. */