@motorical/scope-catalog 0.9.0 → 0.11.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@motorical/scope-catalog",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "Canonical MCP/OAuth scope metadata for Motorical — descriptions, Public API scope mapping, implied-read rules, and declarative tool/resource membership. One source of truth consumed by motorical-backend and @motorical/mcp.",
   "main": "./src/index.js",
   "engines": {

package/src/scopes.js

@@ -81,7 +81,9 @@ const SCOPES = {
     agentDescription: 'List and read sending domains, their DNS records and email-authentication health, and read a Motor Block\'s configuration, without adding or verifying any domain.',
     customerAction: 'View your sending domains and Motor Block configuration',
   },
-  // Communications (marketing). One area per scope so the consent screen shows sending on its own line. No Public API scopes:
+  // Communications (marketing). Reading and the two edit scopes share ONE consent line (`resource: 'comms'`, one label for both edit scopes:
+  // the account has one person, so the first consent stays short); sending, workspace settings and webhooks each keep their own line,
+  // so sending is never hidden under editing. No Public API scopes:
   // the Comms API is not a Public API route, the Communications Block checks these itself. There is deliberately no scope for
   // permanent delete, recycle-bin cleanup or GDPR export/erase: those stay human-only.
   'read:comms': {
@@ -92,18 +94,18 @@ const SCOPES = {
     customerAction: 'View your lists, templates, campaigns and results',
   },
   'write:comms.audience': {
-    resource: 'comms-audience',
+    resource: 'comms',
     level: 'manage',
     publicScopes: [],
     agentDescription: 'Create and change lists and contacts, add contacts (with a dry run), derive lists from lists, import, and add or remove suppressions. Includes everything read:comms grants. Cannot delete anything permanently.',
-    customerAction: 'Add and change your lists and contacts',
+    customerAction: 'View and edit your lists, contacts, templates and campaign drafts, and send test emails to you. This never emails your contacts.',
   },
   'write:comms.content': {
-    resource: 'comms-content',
+    resource: 'comms',
     level: 'manage',
     publicScopes: [],
     agentDescription: 'Create and change templates, the brand kit and campaign drafts, duplicate and compile campaigns, and send a test email to the account owner only. Includes everything read:comms grants. Does not send to your contacts.',
-    customerAction: 'Create and edit email templates and campaign drafts, and send test emails to you',
+    customerAction: 'View and edit your lists, contacts, templates and campaign drafts, and send test emails to you. This never emails your contacts.',
   },
   'send:comms.campaign': {
     resource: 'comms-sending',

package/src/tools.js

@@ -110,6 +110,23 @@ const COMMS_TOOLS = [
   'comms_get_brand_kit',
   'comms_list_campaigns',
   'comms_get_campaign',
+  // M3-2: content writes (write:comms.content) and the list card (write:comms.audience). Nothing here deletes, sends or touches contacts.
+  'comms_create_template',
+  'comms_create_template_from_starter',
+  'comms_update_template',
+  'comms_apply_template_fixes',
+  'comms_duplicate_template',
+  'comms_set_brand_kit',
+  'comms_create_list',
+  'comms_update_list',
+  // M3-3: contacts. Reads are masked (read:comms); writes are dry-run-by-default (write:comms.audience). Nothing deletes, exports, resubscribes or sends.
+  'comms_list_list_contacts',
+  'comms_find_contact',
+  'comms_import_contacts',
+  'comms_remove_from_list',
+  'comms_derive_list',
+  'comms_unsubscribe_contact',
+  'comms_add_suppression',
 ];
 
 const ALL_TOOLS = [
@@ -218,6 +235,21 @@ const TOOL_SCOPES = {
   comms_get_brand_kit: ['read:comms'],
   comms_list_campaigns: ['read:comms'],
   comms_get_campaign: ['read:comms'],
+  comms_create_template: ['write:comms.content'],
+  comms_create_template_from_starter: ['write:comms.content'],
+  comms_update_template: ['write:comms.content'],
+  comms_apply_template_fixes: ['write:comms.content'],
+  comms_duplicate_template: ['write:comms.content'],
+  comms_set_brand_kit: ['write:comms.content'],
+  comms_create_list: ['write:comms.audience'],
+  comms_update_list: ['write:comms.audience'],
+  comms_list_list_contacts: ['read:comms'],
+  comms_find_contact: ['read:comms'],
+  comms_import_contacts: ['write:comms.audience'],
+  comms_remove_from_list: ['write:comms.audience'],
+  comms_derive_list: ['write:comms.audience'],
+  comms_unsubscribe_contact: ['write:comms.audience'],
+  comms_add_suppression: ['write:comms.audience'],
 };
 
 /** `|| []`: a tool with no entry (signup's own tool) contributes no scopes rather than throwing. */