@topolo/cli 0.6.7 → 0.6.10

package/README.md

@@ -12,7 +12,7 @@ via `stdin`/`stdout`.
 - First-class `production`, `staging`, `development`, and `local` environments with separate stored credentials and service URL overrides.
 - **Per-context credentials** — hold and switch between your personal space and multiple organizations with `topolo context`.
 - **One-command agent setup** — `topolo skills install` wires the skill + MCP into Claude Code / Codex.
-- Commands: `auth`, `whoami`, `context`, `skills`, `apps`, `services`, credential-scoped `actions`, generic `api` passthrough, and internal `platform` scaffolding.
+- Commands: `auth`, `whoami`, `context`, `skills`, `apps`, `services`, `workspaces`, credential-scoped `actions`, generic `api` passthrough, and internal `platform` scaffolding.
 
 ## Install
 
@@ -177,6 +177,22 @@ Both resource flags are required together. This supports concurrent agent
 operations across many app-local workspaces without changing the CLI/MCP org
 context or the user's web switcher.
 
+### `topolo workspaces`
+
+Discovers canonical workspaces and the caller-specific creation policy for a
+target application. Auth owns workspace identity, while its runtime policy
+decides access separately for each app and caller.
+
+```bash
+topolo workspaces list design --json
+topolo workspaces create design --name "Campaigns" --confirm --json
+topolo workspaces rename design <workspace-id> --name "Social campaigns" --confirm --json
+topolo workspaces default design <workspace-id> --confirm --json
+```
+
+Always read `data.policy.canCreate` and `data.policy.reason` from `list` before
+creation. Organization ownership is not treated as permission for every app.
+
 ### `topolo apps`
 
 Lists launchable Topolo applications available to the current credential. This

package/dist/index.js

@@ -754,7 +754,9 @@ var APPLICATIONS = {
         "domains": [
           "developers.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "developers.topolo.app"
+        ],
         "appId": "developers"
       },
       {
@@ -1442,7 +1444,9 @@ var APPLICATIONS = {
         "domains": [
           "people.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "people.topolo.app"
+        ],
         "appId": "people"
       },
       {
@@ -1521,7 +1525,9 @@ var APPLICATIONS = {
         "domains": [
           "roadmapper.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "roadmapper.topolo.app"
+        ],
         "appId": "roadmapper"
       },
       {
@@ -1551,7 +1557,9 @@ var APPLICATIONS = {
         "domains": [
           "sign.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "sign.topolo.app"
+        ],
         "appId": "sign"
       },
       {
@@ -1665,7 +1673,9 @@ var APPLICATIONS = {
         "domains": [
           "spaces.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "spaces.topolo.app"
+        ],
         "appId": "spaces"
       },
       {
@@ -3725,10 +3735,19 @@ function mapActionInput(action, input3) {
     delete remaining[key];
     return encodeURIComponent(String(value));
   });
-  const explicitQuery = plainObject(remaining.query);
-  delete remaining.query;
-  const explicitBody = Object.prototype.hasOwnProperty.call(remaining, "body") ? remaining.body : void 0;
-  delete remaining.body;
+  const schemaProperties = plainObject(plainObject(action.inputSchema).properties);
+  const schemaOwnsQuery = Object.prototype.hasOwnProperty.call(schemaProperties, "query");
+  const schemaOwnsBody = Object.prototype.hasOwnProperty.call(schemaProperties, "body");
+  let explicitQuery = {};
+  if (!schemaOwnsQuery) {
+    explicitQuery = plainObject(remaining.query);
+    delete remaining.query;
+  }
+  let explicitBody;
+  if (!schemaOwnsBody) {
+    explicitBody = Object.prototype.hasOwnProperty.call(remaining, "body") ? remaining.body : void 0;
+    delete remaining.body;
+  }
   if (action.method === "GET") {
     return {
       path: path9,
@@ -3852,6 +3871,65 @@ var IdentityModule = class {
     return this.client.introspect();
   }
 };
+var ACTIONS = {
+  list: "app_topolo_auth.workspaces.list",
+  create: "app_topolo_auth.workspaces.create",
+  rename: "app_topolo_auth.workspaces.rename",
+  setDefault: "app_topolo_auth.workspaces.default.set"
+};
+var WorkspacesModule = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  async list(application) {
+    const context = await this.resolveContext(application);
+    return this.client.callAction(ACTIONS.list, {
+      org_id: context.organizationId,
+      app_id: context.appId
+    });
+  }
+  async create(application, input3) {
+    const current = await this.list(application);
+    if (!current.data.policy.canCreate) {
+      throw new TopoloSdkError(
+        "workspace_creation_not_allowed",
+        `Workspace creation is not allowed for ${current.data.appId}: ${current.data.policy.reason}`
+      );
+    }
+    return this.client.callAction(ACTIONS.create, {
+      organizationId: current.data.organizationId,
+      appId: current.data.appId,
+      name: input3.name,
+      ...input3.isDefault === void 0 ? {} : { isDefault: input3.isDefault }
+    }, { confirm: input3.confirm === true });
+  }
+  async rename(application, workspaceId, name, confirm = false) {
+    const context = await this.resolveContext(application);
+    return this.client.callAction(ACTIONS.rename, {
+      workspaceId,
+      organizationId: context.organizationId,
+      appId: context.appId,
+      name
+    }, { confirm });
+  }
+  async setDefault(application, workspaceId, confirm = false) {
+    const context = await this.resolveContext(application);
+    return this.client.callAction(ACTIONS.setDefault, {
+      workspaceId,
+      organizationId: context.organizationId,
+      appId: context.appId
+    }, { confirm });
+  }
+  async resolveContext(application) {
+    const identity = await this.client.introspect();
+    if (!identity.organization?.id) {
+      throw new TopoloSdkError("organization_required", "Workspace lifecycle requires an organization-scoped credential.");
+    }
+    const service = await this.client.getService(application);
+    return { organizationId: identity.organization.id, appId: service.appId };
+  }
+};
 var DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 var TopoloOAuth = class {
   baseUrl;
@@ -3935,6 +4013,7 @@ function createTopolo(options) {
   return {
     client,
     identity: new IdentityModule(client),
+    workspaces: new WorkspacesModule(client),
     crm: new CrmModule(client)
   };
 }
@@ -5089,13 +5168,13 @@ function registerActionsCommand(program2) {
       fail(err, mode);
     }
   });
-  actions.command("capabilities").description("Discover capability and schema actions for one application").option("-s, --service <service>", "App id, slug, or name").option("--json", "Output JSON").option("--no-json", "Output human-readable table").action(async (opts, command) => {
+  actions.command("capabilities").description("List every published action for one application (its capability contract)").option("-s, --service <service>", "App id, slug, or name").option("--json", "Output JSON").option("--no-json", "Output human-readable table").action(async (opts, command) => {
     const mode = resolveOutputMode(opts.json ?? command.parent?.opts().json);
     try {
       const topolo = await requiredClient();
       const service = opts.service || command.parent?.opts().service;
       if (!service?.trim()) throw new Error("--service is required for capability discovery");
-      const result = await topolo.client.searchActions({ service: service.trim(), query: "capabilities", limit: 100 });
+      const result = await topolo.client.searchActions({ service: service.trim(), limit: 100 });
       emit(result, mode, () => formatActionRows(result.actions, result.page.nextCursor));
     } catch (err) {
       fail(err, mode);
@@ -13451,6 +13530,79 @@ function formatResources(result) {
   return lines.join("\n");
 }
 
+// src/commands/workspaces.ts
+function registerWorkspacesCommand(program2) {
+  const workspaces = program2.command("workspaces").description("Discover and manage caller-authorized workspaces for one Topolo application");
+  workspaces.command("list <application>").description("List workspaces and the caller-specific creation policy for one application").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (application, opts) => {
+    const mode = resolveOutputMode(opts.json);
+    try {
+      const topolo = await requiredClient2();
+      const result = await topolo.workspaces.list(application);
+      emit(result, mode, () => formatWorkspaceList(result));
+    } catch (error) {
+      fail(error, mode);
+    }
+  });
+  workspaces.command("create <application>").description("Create a workspace when the target application policy permits it").requiredOption("--name <name>", "Workspace display name").option("--default", "Make the new workspace the application default").option("--confirm", "Acknowledge workspace creation").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (application, opts) => {
+    const mode = resolveOutputMode(opts.json);
+    try {
+      const topolo = await requiredClient2();
+      const result = await topolo.workspaces.create(application, {
+        name: opts.name.trim(),
+        isDefault: opts.default === true,
+        confirm: opts.confirm === true
+      });
+      emit(result, mode, () => formatWorkspaceMutation(result));
+    } catch (error) {
+      fail(error, mode);
+    }
+  });
+  workspaces.command("rename <application> <workspace-id>").description("Rename a caller-authorized workspace without changing its stable id").requiredOption("--name <name>", "New workspace display name").option("--confirm", "Acknowledge workspace rename").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (application, workspaceId, opts) => {
+    const mode = resolveOutputMode(opts.json);
+    try {
+      const topolo = await requiredClient2();
+      const result = await topolo.workspaces.rename(application, workspaceId, opts.name.trim(), opts.confirm === true);
+      emit(result, mode, () => formatWorkspaceMutation(result));
+    } catch (error) {
+      fail(error, mode);
+    }
+  });
+  workspaces.command("default <application> <workspace-id>").description("Set the default workspace for one application").option("--confirm", "Acknowledge the default-workspace change").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (application, workspaceId, opts) => {
+    const mode = resolveOutputMode(opts.json);
+    try {
+      const topolo = await requiredClient2();
+      const result = await topolo.workspaces.setDefault(application, workspaceId, opts.confirm === true);
+      emit(result, mode, () => formatWorkspaceMutation(result));
+    } catch (error) {
+      fail(error, mode);
+    }
+  });
+}
+async function requiredClient2() {
+  const topolo = await buildClient();
+  if (!topolo) throw new Error("No credential configured. Run `topolo auth login` or set TOPOLO_API_KEY.");
+  return topolo;
+}
+function formatWorkspaceList(result) {
+  const { data } = result;
+  const lines = [
+    `Application: ${data.appId}`,
+    `Organization: ${data.organizationId}`,
+    `Can create: ${data.policy.canCreate ? "yes" : "no"} (${data.policy.reason})`
+  ];
+  if (!data.workspaces.length) return [...lines, "", "No accessible workspaces."].join("\n");
+  lines.push("", "DEFAULT  ID  NAME  ACCESS");
+  for (const workspace of data.workspaces) {
+    lines.push(`${workspace.isDefault ? "yes" : "no"}  ${workspace.id}  ${workspace.name}  ${workspace.accessLevel}`);
+  }
+  return lines.join("\n");
+}
+function formatWorkspaceMutation(result) {
+  const workspace = result.data.workspace;
+  return `${result.message}
+Workspace: ${workspace.name} (${workspace.id})${workspace.isDefault ? "\nDefault: yes" : ""}`;
+}
+
 // src/index.ts
 var program = new Command();
 var argv;
@@ -13482,6 +13634,7 @@ registerSeedCommands(program);
 registerSkillsCommand(program);
 registerContextCommand(program);
 registerResourcesCommand(program);
+registerWorkspacesCommand(program);
 program.parseAsync(argv).catch((err) => {
   process.stderr.write(`Unexpected error: ${err instanceof Error ? err.message : String(err)}
 `);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@topolo/cli",
-  "version": "0.6.7",
-  "topoloPublishedVersion": "0.6.7",
+  "version": "0.6.10",
+  "topoloPublishedVersion": "0.6.10",
   "description": "Command-line interface for Topolo developers, operators, and agents, with internal first-party scaffolding available under the topolo platform namespace.",
   "type": "module",
   "bin": {
@@ -11,20 +11,6 @@
     "dist",
     "skills"
   ],
-  "dependencies": {
-    "commander": "^12.1.0"
-  },
-  "devDependencies": {
-    "@topolo/sdk": "file:../topolo-sdk",
-    "@types/node": "^20.12.0",
-    "@vitest/coverage-v8": "3.2.6",
-    "tsup": "^8.0.0",
-    "typescript": "^5.4.0",
-    "vitest": "3.2.6"
-  },
-  "engines": {
-    "node": ">=20"
-  },
   "scripts": {
     "build:sdk": "python3 ../../tooling/with-resource-lock.py ../topolo-sdk -- pnpm --dir ../topolo-sdk build",
     "prebuild": "pnpm run build:sdk",
@@ -38,5 +24,19 @@
     "test:watch": "vitest",
     "precoverage": "pnpm run build:sdk",
     "coverage": "vitest run --coverage"
+  },
+  "dependencies": {
+    "commander": "^12.1.0"
+  },
+  "devDependencies": {
+    "@topolo/sdk": "file:../topolo-sdk",
+    "@types/node": "^20.12.0",
+    "@vitest/coverage-v8": "3.2.6",
+    "tsup": "^8.0.0",
+    "typescript": "^5.4.0",
+    "vitest": "3.2.6"
+  },
+  "engines": {
+    "node": ">=20"
   }
-}
+}

package/skills/topolo/SKILL.md

@@ -72,12 +72,24 @@ topolo resources <application> --json
 
 Use the returned app id or slug. Read `apiKeyResources` to learn whether calls can be scoped to aliases such as a workspace, site, mailbox, brand, or venue. Use `topolo resources` to resolve the actual credential-scoped resource ids. With an API key it returns only the key's bound resources; with OAuth it uses the published Auth resource catalog. Never assume that an organization id is a valid app resource id.
 
+Workspace lifecycle is canonically owned by Topolo Auth but authorized against the concrete target application. Never conclude that workspace provisioning is unavailable because the target app's own action catalog does not duplicate Auth actions. Always run:
+
+```bash
+topolo workspaces list <application> --json
+```
+
+Its `data.policy.canCreate` and `data.policy.reason` are the caller-specific creation decision for that application. Organization ownership does not imply permission to create workspaces for every app. When permitted, the first-class mutations are `topolo workspaces create`, `topolo workspaces rename`, and `topolo workspaces default`; each still requires confirmation and Auth performs the final runtime authorization.
+
 MCP equivalents:
 
 - `topolo_search_applications`
 - `topolo_get_application`
 - `topolo_get_resource_types`
 - `topolo_list_resources`
+- `topolo_list_workspaces`
+- `topolo_create_workspace`
+- `topolo_rename_workspace`
+- `topolo_set_default_workspace`
 
 ### 2. Discover credential-scoped actions