@topolo/cli 0.3.0 → 0.4.0

package/dist/index.js

@@ -9,7 +9,7 @@ import { platform as platform2 } from "os";
 import { createInterface } from "readline/promises";
 import { stdin as input } from "process";
 
-// ../topolo-sdk/dist/index.js
+// ../../../topolo-platform/packages/topolo-sdk/dist/index.js
 function applyAuthHeaders(headers, credential) {
   if (credential.kind === "api_key") {
     headers.set("X-Api-Key", credential.apiKey);
@@ -3453,7 +3453,7 @@ function createTopolo(options) {
   };
 }
 
-// ../topolo-sdk/dist/node/credential-store.js
+// ../../../topolo-platform/packages/topolo-sdk/dist/node/credential-store.js
 import { mkdir, readFile, writeFile, chmod } from "fs/promises";
 import { existsSync } from "fs";
 import { homedir, platform } from "os";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topolo/cli",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Command-line interface for Topolo developers, operators, and agents, with internal first-party scaffolding available under the topolo platform namespace.",
   "type": "module",
   "bin": {

package/skills/topolo/SKILL.md

@@ -48,6 +48,15 @@ topolo context use <organization-name|personal> --json
 topolo whoami --json
 ```
 
+For concurrent agents or multiple MCP connections, never coordinate by changing
+one shared active context. Register one named `topolo-mcp` process per context
+with both `TOPOLO_ENV` and `TOPOLO_CONTEXT`. The context selector accepts an
+exact key returned by `topolo context ls --json` (such as `personal` or
+`org:<orgId>`) or a unique stored organization id, slug, or name. Each process
+reads and refreshes only its pinned credential without changing the CLI or web
+session. Do not set `TOPOLO_CONTEXT` alongside an injected API key or access
+token because that credential already carries its immutable context.
+
 ## Mandatory clean-room workflow
 
 For every Topolo task, follow this sequence.
@@ -114,6 +123,10 @@ topolo actions call <read-action-id> \
 
 Provide `--resource-type` and `--resource-id` together. MCP read actions use `topolo_read_action` with the same separate resource fields.
 
+For API-key creation or updates, do not use the application's general resource list as the authorization decision. Discover and call Auth's `api_keys.options` action with the selected application and active organization. Its response is the complete caller-specific contract for that key operation: organization-wide scopes, deduplicated resource types, authorized resources, each resource's access level and allowed scopes, and whether key creation is allowed.
+
+Choose resource bindings before scopes. With no bindings, use only `organizationWideScopes`. With one or more bindings, use only the intersection of `allowedScopes` across every selected resource. Then validate and plan `api_keys.create` or `api_keys.update` with that exact selection. Never widen, merge, or infer eligibility from application metadata, organization ownership alone, or a resource returned in another organization context.
+
 ### 4. Validate locally
 
 Before every call, validate exact input against the published JSON Schema: