@topolo/mcp 0.4.7 → 0.4.9

package/dist/dispatch.js

@@ -91,6 +91,8 @@ var TOOLS = [
           effectiveUrl: resolveCatalogServiceUrl(entry, { serviceKey: id }),
           surfaceKind: entry.surfaceKind,
           launchable: entry.launchable,
+          apiKeyResource: entry.apiKeyResource,
+          apiKeyResources: [...entry.apiKeyResources],
           permissions: [...entry.permissions]
         };
       }).sort((left, right) => left.id.localeCompare(right.id));
@@ -284,6 +286,14 @@ var TOOLS = [
           additionalProperties: { type: "string" },
           description: "Query string parameters as string values."
         },
+        resourceType: {
+          type: "string",
+          description: "Optional workspace resource alias from topolo_list_services apiKeyResources. Aliases are app-defined, e.g. brand, mailbox, venue, merchant, or any other cataloged alias."
+        },
+        resourceId: {
+          type: "string",
+          description: "Resource id for resourceType. Required when resourceType is provided."
+        },
         confirm: {
           type: "boolean",
           description: "Required for non-GET methods. Explicit human-in-the-loop acknowledgement for writes."
@@ -310,12 +320,19 @@ var TOOLS = [
       const normalisedQuery = query && typeof query === "object" && !Array.isArray(query) ? Object.fromEntries(
         Object.entries(query).map(([k, v]) => [k, String(v)])
       ) : void 0;
+      const resourceType = typeof args["resourceType"] === "string" ? args["resourceType"].trim() : "";
+      const resourceId = typeof args["resourceId"] === "string" ? args["resourceId"].trim() : "";
+      if (resourceType && !resourceId || !resourceType && resourceId) {
+        throw new Error("resourceType and resourceId must be provided together.");
+      }
+      const resource = resourceType && resourceId ? { resourceType, resourceId } : void 0;
       return topolo.client.request({
         service: service.trim(),
         method,
         path,
         body: args["body"],
         ...normalisedQuery ? { query: normalisedQuery } : {},
+        ...resource ? { resource } : {},
         confirm: Boolean(args["confirm"])
       });
     }

package/dist/index.js

@@ -59,54 +59,53 @@ var TopoloHttpError = class extends TopoloSdkError {
   }
 };
 var SERVICES = {
-  agent: "https://agent-api.topolo.app",
+  agent: "https://agent.topolo.app",
   auth: "https://auth.topolo.app",
   backup: "https://backup.topolo.app",
   books: "https://books.topolo.app",
   bugfix: "https://bugfix.topolo.app",
-  bytes: "https://bytes-api.topolo.app",
+  bytes: "https://bytes.topolo.app",
   calendar: "https://calendar.topolo.app",
   capacity: "https://capacity.topolo.app",
   chat: "https://chat.topolo.app",
-  commerce: "https://commerce-api.topolo.app",
+  commerce: "https://commerce.topolo.app",
   compose: "https://compose.topolo.app",
   consent: "https://consent.topolo.app",
-  crm: "https://crm-api.topolo.app",
+  crm: "https://crm.topolo.app",
   developers: "https://developers.topolo.app",
   director: "https://director.topolo.app",
-  feed: "https://feed-api.topolo.app",
+  feed: "https://feed.topolo.app",
   flow: "https://flow.topolo.app",
-  forecast: "https://forecast-api.topolo.app",
+  forecast: "https://forecast.topolo.app",
   forms: "https://forms.topolo.app",
   home: "https://home.topolo.app",
   insights: "https://insights.topolo.app",
   inventory: "https://inventory.topolo.app",
-  learn: "https://learn-api.topolo.app",
+  learn: "https://learn.topolo.app",
   localize: "https://localize.topolo.app",
-  mail: "https://mail-api.topolo.app",
-  mdm: "https://mdm-api.topolo.app",
+  mail: "https://mail.topolo.app",
+  mdm: "https://mdm.topolo.app",
   messages: "https://messages.topolo.app",
-  nexus: "https://nexus-api.topolo.app",
+  nexus: "https://nexus.topolo.app",
   notify: "https://notify.topolo.app",
   observability_watch: "https://observability-watch.topolo.app",
-  one: "https://one.topolo.app",
+  one: "https://www.topolo.app",
   p2p: "https://p2p.topolo.app",
   pay: "https://pay.topolo.app",
   people: "https://people.topolo.app",
-  pulse: "https://pulse.topolo.app",
   "quro.api": "https://api.ol0.me",
   "quro.redirect": "https://ol0.me",
-  roadmapper: "https://roadmapper-api.topolo.app",
+  roadmapper: "https://roadmapper.topolo.app",
   sign: "https://sign.topolo.app",
-  social_studio: "https://studio-api.topolo.app",
-  socialize: "https://socialize-api.topolo.app",
+  social_studio: "https://studio.topolo.app",
+  socialize: "https://socialize.topolo.app",
   spaces: "https://spaces.topolo.app",
   status: "https://status.topolo.app",
   success: "https://success.topolo.app",
   support: "https://support.topolo.app",
   survey: "https://survey.topolo.app",
   voice: "https://voice.topolo.app",
-  web: "https://web-api.topolo.app"
+  web: "https://web.topolo.app"
 };
 var APPLICATIONS = {
   "admin": {
@@ -155,17 +154,15 @@ var APPLICATIONS = {
           "agent.topolo.app"
         ],
         "routes": [],
-        "serviceId": null
+        "serviceId": "agent"
       },
       {
         "name": "topolo-agent-api",
         "kind": "worker",
-        "apiUrl": "https://agent-api.topolo.app",
-        "domains": [
-          "agent-api.topolo.app"
-        ],
+        "apiUrl": null,
+        "domains": [],
         "routes": [],
-        "serviceId": "agent"
+        "serviceId": null
       }
     ]
   },
@@ -285,17 +282,15 @@ var APPLICATIONS = {
           "bytes.topolo.app"
         ],
         "routes": [],
-        "serviceId": null
+        "serviceId": "bytes"
       },
       {
         "name": "topolo-bytes-api",
         "kind": "worker",
-        "apiUrl": "https://bytes-api.topolo.app",
-        "domains": [
-          "bytes-api.topolo.app"
-        ],
+        "apiUrl": null,
+        "domains": [],
         "routes": [],
-        "serviceId": "bytes"
+        "serviceId": null
       }
     ]
   },
@@ -394,12 +389,10 @@ var APPLICATIONS = {
       {
         "name": "topolo-commerce-api",
         "kind": "worker",
-        "apiUrl": "https://commerce-api.topolo.app",
-        "domains": [
-          "commerce-api.topolo.app"
-        ],
+        "apiUrl": null,
+        "domains": [],
         "routes": [],
-        "serviceId": "commerce"
+        "serviceId": null
       },
       {
         "name": "topolo-commerce-guest-web",
@@ -419,7 +412,7 @@ var APPLICATIONS = {
           "commerce.topolo.app"
         ],
         "routes": [],
-        "serviceId": null
+        "serviceId": "commerce"
       },
       {
         "name": "topolo-commerce-station-web",
@@ -506,12 +499,10 @@ var APPLICATIONS = {
       {
         "name": "topolo-crm-api",
         "kind": "worker",
-        "apiUrl": "https://crm-api.topolo.app",
-        "domains": [
-          "crm-api.topolo.app"
-        ],
+        "apiUrl": null,
+        "domains": [],
         "routes": [],
-        "serviceId": "crm"
+        "serviceId": null
       },
       {
         "name": "topolo-crm-app",
@@ -521,7 +512,7 @@ var APPLICATIONS = {
           "crm.topolo.app"
         ],
         "routes": [],
-        "serviceId": null
+        "serviceId": "crm"
       }
     ]
   },
@@ -649,7 +640,7 @@ var APPLICATIONS = {
           "feed-api.topolo.app"
         ],
         "routes": [],
-        "serviceId": "feed"
+        "serviceId": null
       },
       {
         "name": "topolo-feed-web",
@@ -659,7 +650,7 @@ var APPLICATIONS = {
           "feed.topolo.app"
         ],
         "routes": [],
-        "serviceId": null
+        "serviceId": "feed"
       }
     ]
   },
@@ -711,17 +702,15 @@ var APPLICATIONS = {
           "forecast.topolo.app"
         ],
         "routes": [],
-        "serviceId": null
+        "serviceId": "forecast"
       },
       {
         "name": "topolo-forecast-api",
         "kind": "worker",
-        "apiUrl": "https://forecast-api.topolo.app",
-        "domains": [
-          "forecast-api.topolo.app"
-        ],
+        "apiUrl": null,
+        "domains": [],
         "routes": [],
-        "serviceId": "forecast"
+        "serviceId": null
       }
     ]
   },
@@ -863,17 +852,15 @@ var APPLICATIONS = {
           "learn.topolo.app"
         ],
         "routes": [],
-        "serviceId": null
+        "serviceId": "learn"
       },
       {
         "name": "topolo-learn-api",
         "kind": "worker",
-        "apiUrl": "https://learn-api.topolo.app",
-        "domains": [
-          "learn-api.topolo.app"
-        ],
+        "apiUrl": null,
+        "domains": [],
         "routes": [],
-        "serviceId": "learn"
+        "serviceId": null
       }
     ]
   },
@@ -919,17 +906,15 @@ var APPLICATIONS = {
           "mail.topolo.app"
         ],
         "routes": [],
-        "serviceId": null
+        "serviceId": "mail"
       },
       {
         "name": "topolo-mail-api",
         "kind": "worker",
-        "apiUrl": "https://mail-api.topolo.app",
-        "domains": [
-          "mail-api.topolo.app"
-        ],
+        "apiUrl": null,
+        "domains": [],
         "routes": [],
-        "serviceId": "mail"
+        "serviceId": null
       }
     ]
   },
@@ -946,12 +931,10 @@ var APPLICATIONS = {
       {
         "name": "topolo-mdm-api",
         "kind": "worker",
-        "apiUrl": "https://mdm-api.topolo.app",
-        "domains": [
-          "mdm-api.topolo.app"
-        ],
+        "apiUrl": null,
+        "domains": [],
         "routes": [],
-        "serviceId": "mdm"
+        "serviceId": null
       },
       {
         "name": "topolo-mdm-console",
@@ -961,7 +944,7 @@ var APPLICATIONS = {
           "mdm.topolo.app"
         ],
         "routes": [],
-        "serviceId": null
+        "serviceId": "mdm"
       }
     ]
   },
@@ -1026,9 +1009,9 @@ var APPLICATIONS = {
       {
         "name": "topolo-nexus-gateway",
         "kind": "worker",
-        "apiUrl": "https://nexus-api.topolo.app",
+        "apiUrl": "https://nexus.topolo.app",
         "domains": [
-          "nexus-api.topolo.app"
+          "nexus.topolo.app"
         ],
         "routes": [],
         "serviceId": "nexus"
@@ -1094,20 +1077,23 @@ var APPLICATIONS = {
       {
         "name": "topolo-one",
         "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
+        "apiUrl": "https://one.topolo.app",
+        "domains": [
+          "one.topolo.app"
+        ],
+        "routes": [
+          "one.topolo.app/*"
+        ],
         "serviceId": null
       },
       {
         "name": "topolo-one-api",
         "kind": "worker",
-        "apiUrl": "https://one.topolo.app",
+        "apiUrl": "https://www.topolo.app",
         "domains": [
-          "one.topolo.app"
+          "www.topolo.app"
         ],
         "routes": [
-          "one.topolo.app/*",
           "www.topolo.app/*"
         ],
         "serviceId": "one"
@@ -1217,36 +1203,6 @@ var APPLICATIONS = {
       }
     ]
   },
-  "pulse": {
-    "id": "pulse",
-    "appDir": "TopoloPulse",
-    "name": "topolo-pulse",
-    "packageName": "topolo-pulse",
-    "productionUrl": "https://pulse.topolo.app",
-    "services": [
-      "pulse"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-pulse",
-        "kind": "worker",
-        "apiUrl": "https://pulse.topolo.app",
-        "domains": [
-          "pulse.topolo.app"
-        ],
-        "routes": [],
-        "serviceId": "pulse"
-      },
-      {
-        "name": "topolo-pulse-api",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "serviceId": null
-      }
-    ]
-  },
   "quro": {
     "id": "quro",
     "appDir": "TopoloQuro",
@@ -1312,17 +1268,15 @@ var APPLICATIONS = {
           "roadmapper.topolo.app"
         ],
         "routes": [],
-        "serviceId": null
+        "serviceId": "roadmapper"
       },
       {
         "name": "topolo-roadmapper-api",
         "kind": "worker",
-        "apiUrl": "https://roadmapper-api.topolo.app",
-        "domains": [
-          "roadmapper-api.topolo.app"
-        ],
+        "apiUrl": null,
+        "domains": [],
         "routes": [],
-        "serviceId": "roadmapper"
+        "serviceId": null
       }
     ]
   },
@@ -1374,17 +1328,15 @@ var APPLICATIONS = {
           "studio.topolo.app"
         ],
         "routes": [],
-        "serviceId": null
+        "serviceId": "social_studio"
       },
       {
         "name": "topolo-social-studio-api",
         "kind": "worker",
-        "apiUrl": "https://studio-api.topolo.app",
-        "domains": [
-          "studio-api.topolo.app"
-        ],
+        "apiUrl": null,
+        "domains": [],
         "routes": [],
-        "serviceId": "social_studio"
+        "serviceId": null
       },
       {
         "name": "topolo-social-studio-queue",
@@ -1414,7 +1366,7 @@ var APPLICATIONS = {
           "socialize.topolo.app"
         ],
         "routes": [],
-        "serviceId": null
+        "serviceId": "socialize"
       },
       {
         "name": "topolo-socialize-api",
@@ -1424,7 +1376,7 @@ var APPLICATIONS = {
           "socialize-api.topolo.app"
         ],
         "routes": [],
-        "serviceId": "socialize"
+        "serviceId": null
       },
       {
         "name": "topolo-socialize-scheduler",
@@ -1625,12 +1577,10 @@ var APPLICATIONS = {
       {
         "name": "topolo-web-api",
         "kind": "worker",
-        "apiUrl": "https://web-api.topolo.app",
-        "domains": [
-          "web-api.topolo.app"
-        ],
+        "apiUrl": null,
+        "domains": [],
         "routes": [],
-        "serviceId": "web"
+        "serviceId": null
       },
       {
         "name": "topolo-web-runtime",
@@ -1653,12 +1603,12 @@ var APPLICATIONS = {
           "web.topolo.app"
         ],
         "routes": [],
-        "serviceId": null
+        "serviceId": "web"
       }
     ]
   }
 };
-var APPLICATION_REQUIREMENTS_VERSION = "2026-05-01.1";
+var APPLICATION_REQUIREMENTS_VERSION = "2026-06-07.1";
 var APPLICATION_REQUIREMENTS = [
   {
     id: "platform-metadata",
@@ -1714,16 +1664,20 @@ var APPLICATION_REQUIREMENTS = [
     summary: "Browser applications should feel like one platform and should not create isolated navigation or account surfaces.",
     appliesTo: ["browser"],
     evidence: [
-      "@topolo/ui-kit is used for the platform shell where the app has authenticated UI",
-      "The shared launcher/app switcher is reachable from authenticated app chrome",
-      "Account menu and sign-out behavior use TopoloAppShell or TopoloAccountMenu",
+      "@topolo-io/app-shell is used for the platform shell where the app has authenticated UI",
+      "@topolo-io/app-launcher keeps the shared launcher/app switcher reachable from authenticated app chrome",
+      "Account menu and sign-out behavior use TopoloAppShell or the ui-kit TopoloAccountMenu primitive",
+      "Repeated app body surfaces use shared TopoloAppLayout primitives instead of local stat cards, empty states, or status badges",
+      "Local preview supports deterministic visual QA fixtures for overview, list, detail, settings, and empty/loading states",
       "Authenticated app body content stays inside the viewport on mobile and desktop widths"
     ],
     implementation: [
-      "Use TopoloAppShell for authenticated app layouts",
-      "Use TopoloAccountMenu when a partial-shell surface still needs account chrome",
+      "Use @topolo-io/app-shell TopoloAppShell for authenticated app layouts",
+      "Use the @topolo-io/ui-kit TopoloAccountMenu primitive when a partial-shell surface still needs account chrome",
       "Pass app-specific account actions as additive menu items instead of forking dropdowns",
       "Use shared design tokens and platform UI primitives before creating local equivalents",
+      "Use TopoloAppMetricCard, TopoloAppEmptyState, TopoloAppStatusBadge, TopoloAppGrid, and TopoloAppSection for repeated app body patterns",
+      "Keep visual QA fixtures available through visualQa=1 or __devpreview=1 so screenshot checks do not depend on live API state",
       "Keep mobile and desktop shell behavior aligned with the platform UI kit",
       "Constrain app-owned workspace wrappers with min-width: 0, width: auto, and viewport-aware max-width so shell padding cannot create page-level horizontal overflow"
     ]
@@ -1802,11 +1756,13 @@ var APPLICATION_REQUIREMENTS = [
     evidence: [
       "The app-owned API exposes GET /api/widget",
       "The endpoint returns TopoloWidgetApiResponse from @topolo/sdk",
+      "Every returned widget includes snapshot.summary with app-owned operational prose",
       "The endpoint derives organization/user context from the app auth boundary"
     ],
     implementation: [
       "Import createTopoloWidgetResponse from @topolo/sdk in the app backend",
       "Return native app metrics or action widgets instead of generic launch-card fallbacks",
+      "Populate snapshot.summary in the producing app for every widget instead of synthesizing summaries in TopoloOne",
       "Add a route-level test that validates the response with validateTopoloWidgetResponse"
     ]
   },
@@ -2099,6 +2055,8 @@ function firstString(...values) {
 var WRITE_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
 var TOPOLO_ACTION_ID_HEADER = "X-Topolo-Action-Id";
 var TOPOLO_ACTION_NAME_HEADER = "X-Topolo-Action-Name";
+var TOPOLO_RESOURCE_TYPE_HEADER = "X-Topolo-Resource-Type";
+var TOPOLO_RESOURCE_ID_HEADER = "X-Topolo-Resource-ID";
 var POSITIVE_CACHE_TTL_MS = 5 * 60 * 1e3;
 var NEGATIVE_CACHE_TTL_MS = 60 * 1e3;
 var CATALOG_CACHE_TTL_MS = 60 * 1e3;
@@ -2177,6 +2135,18 @@ var TopoloClient = class _TopoloClient {
     if (opts.headers) {
       for (const [k, v] of Object.entries(opts.headers)) headers.set(k, v);
     }
+    if (opts.resource) {
+      const resourceType = opts.resource.resourceType.trim();
+      const resourceId = opts.resource.resourceId.trim();
+      if (!resourceType || !resourceId) {
+        throw new TopoloSdkError(
+          "invalid_resource_context",
+          "Both resource.resourceType and resource.resourceId are required when resource context is provided."
+        );
+      }
+      headers.set(TOPOLO_RESOURCE_TYPE_HEADER, resourceType);
+      headers.set(TOPOLO_RESOURCE_ID_HEADER, resourceId);
+    }
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), this.timeoutMs);
     const signal = opts.signal ? mergeSignals(opts.signal, controller.signal) : controller.signal;
@@ -2248,10 +2218,14 @@ var TopoloClient = class _TopoloClient {
     if (!serviceKey) {
       throw new TopoloSdkError("unknown_service", "service is required");
     }
-    if (serviceKey === "auth") {
+    if (serviceKey === "auth" || serviceKey === "developers") {
       const overrideUrl = resolveConfiguredServiceUrl(serviceKey, this.serviceUrls);
       if (overrideUrl) return { serviceKey, baseUrl: overrideUrl };
-      return { serviceKey, baseUrl: DEFAULT_SERVICE_URLS.auth };
+      if (serviceKey === "developers") {
+        const derived = deriveDevelopersFromAuth(resolveConfiguredServiceUrl("auth", this.serviceUrls));
+        if (derived) return { serviceKey, baseUrl: derived };
+      }
+      return { serviceKey, baseUrl: DEFAULT_SERVICE_URLS[serviceKey] };
     }
     const live = await this.resolveLiveCallableService(serviceKey);
     if (live) {
@@ -2291,7 +2265,7 @@ var TopoloClient = class _TopoloClient {
     if (!normalized) return null;
     const configuredServiceId = resolveConfiguredServiceId(normalized, this.serviceIds);
     if (configuredServiceId) return configuredServiceId;
-    const authBase = resolveServiceUrl("auth", this.serviceUrls);
+    const authBase = resolveServiceUrl("developers", this.serviceUrls);
     const cacheKey = `${authBase}|${normalized}`;
     const now = Date.now();
     const cached = _TopoloClient.serviceIdCache.get(cacheKey);
@@ -2345,7 +2319,7 @@ var TopoloClient = class _TopoloClient {
     if (this.serviceCatalogCache && this.serviceCatalogCache.expiresAt > now) {
       return this.serviceCatalogCache.entries;
     }
-    const res = await this.request({ service: "auth", method: "GET", path: "/api/services/catalog" });
+    const res = await this.request({ service: "developers", method: "GET", path: "/api/services/catalog" });
     const raw = res.data?.services ?? res.services;
     if (!Array.isArray(raw)) {
       throw new TopoloSdkError(
@@ -2359,6 +2333,11 @@ var TopoloClient = class _TopoloClient {
       const serviceId = typeof s.service_id === "string" ? s.service_id : typeof s.id === "string" ? s.id : null;
       if (!serviceId) continue;
       const permissions = Array.isArray(s.granted_permissions) ? s.granted_permissions.filter((permission) => typeof permission === "string" && permission.trim().length > 0) : [];
+      const catalogApiKeyResources = normalizeApiKeyResourceMetadataList(
+        s.api_key_resources ?? s.apiKeyResources
+      );
+      const apiKeyResource = normalizeApiKeyResourceMetadata(s.api_key_resource ?? s.apiKeyResource) ?? catalogApiKeyResources[0] ?? null;
+      const apiKeyResources = catalogApiKeyResources.length > 0 ? catalogApiKeyResources : apiKeyResource ? [apiKeyResource] : [];
       entries.push({
         serviceId,
         slug: typeof s.app_slug === "string" ? s.app_slug : null,
@@ -2369,7 +2348,9 @@ var TopoloClient = class _TopoloClient {
         status: typeof s.status === "string" ? s.status : null,
         surfaceKind: typeof s.surface_kind === "string" ? s.surface_kind : null,
         launchable: s.launchable === true,
-        permissions
+        permissions,
+        apiKeyResource,
+        apiKeyResources
       });
     }
     this.serviceCatalogCache = {
@@ -2455,7 +2436,9 @@ var TopoloClient = class _TopoloClient {
       status: "bundled",
       surfaceKind: "application",
       launchable: Boolean(app.productionUrl),
-      permissions: []
+      permissions: [],
+      apiKeyResource: null,
+      apiKeyResources: []
     }));
   }
   /**
@@ -2504,6 +2487,46 @@ function resolveConfiguredServiceId(slug, serviceIds) {
   }
   return null;
 }
+function normalizeApiKeyResourceMetadata(input) {
+  if (!isRecord(input)) return null;
+  const resourceType = readString(input.resourceType ?? input.resource_type);
+  const label = readString(input.label);
+  const emptyLabel = readString(input.emptyLabel ?? input.empty_label);
+  const resourceConcept = readString(input.resourceConcept ?? input.resource_concept);
+  const canonicalResourceType = readString(input.canonicalResourceType ?? input.canonical_resource_type);
+  const defaultEntitlement = readString(input.defaultEntitlement ?? input.default_entitlement);
+  const exceptionPolicy = readString(input.exceptionPolicy ?? input.exception_policy);
+  if (!resourceType || !label || !emptyLabel || resourceConcept !== "workspace" || canonicalResourceType !== "workspace" || defaultEntitlement !== "enterprise" || exceptionPolicy !== "app_or_organization") {
+    return null;
+  }
+  return {
+    resourceType,
+    label,
+    emptyLabel,
+    resourceConcept,
+    canonicalResourceType,
+    defaultEntitlement,
+    exceptionPolicy
+  };
+}
+function normalizeApiKeyResourceMetadataList(input) {
+  if (!Array.isArray(input)) return [];
+  const resources = [];
+  const seenTypes = /* @__PURE__ */ new Set();
+  for (const item of input) {
+    const resource = normalizeApiKeyResourceMetadata(item);
+    if (!resource || seenTypes.has(resource.resourceType)) continue;
+    seenTypes.add(resource.resourceType);
+    resources.push(resource);
+  }
+  return resources;
+}
+function readString(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 function resolveConfiguredServiceUrl(slug, serviceUrls) {
   for (const serviceKey of serviceKeyCandidates2(slug)) {
     const configured = serviceUrls?.[serviceKey];
@@ -2527,6 +2550,17 @@ function serviceKeyCandidates2(slug) {
 function normalizeLookupKey(value) {
   return String(value || "").trim().toLowerCase().replace(/\s+/g, "-");
 }
+function deriveDevelopersFromAuth(authUrl) {
+  if (!authUrl) return null;
+  try {
+    const url = new URL(authUrl);
+    if (!/^auth\./i.test(url.hostname)) return null;
+    url.hostname = url.hostname.replace(/^auth\./i, "developers.");
+    return url.origin;
+  } catch {
+    return null;
+  }
+}
 function catalogEntryMatches(entry, needle) {
   return catalogEntryLookupKeys(entry).includes(needle);
 }
@@ -2838,6 +2872,8 @@ var TOOLS = [
           effectiveUrl: resolveCatalogServiceUrl(entry, { serviceKey: id }),
           surfaceKind: entry.surfaceKind,
           launchable: entry.launchable,
+          apiKeyResource: entry.apiKeyResource,
+          apiKeyResources: [...entry.apiKeyResources],
           permissions: [...entry.permissions]
         };
       }).sort((left, right) => left.id.localeCompare(right.id));
@@ -3031,6 +3067,14 @@ var TOOLS = [
           additionalProperties: { type: "string" },
           description: "Query string parameters as string values."
         },
+        resourceType: {
+          type: "string",
+          description: "Optional workspace resource alias from topolo_list_services apiKeyResources. Aliases are app-defined, e.g. brand, mailbox, venue, merchant, or any other cataloged alias."
+        },
+        resourceId: {
+          type: "string",
+          description: "Resource id for resourceType. Required when resourceType is provided."
+        },
         confirm: {
           type: "boolean",
           description: "Required for non-GET methods. Explicit human-in-the-loop acknowledgement for writes."
@@ -3057,12 +3101,19 @@ var TOOLS = [
       const normalisedQuery = query && typeof query === "object" && !Array.isArray(query) ? Object.fromEntries(
         Object.entries(query).map(([k, v]) => [k, String(v)])
       ) : void 0;
+      const resourceType = typeof args["resourceType"] === "string" ? args["resourceType"].trim() : "";
+      const resourceId = typeof args["resourceId"] === "string" ? args["resourceId"].trim() : "";
+      if (resourceType && !resourceId || !resourceType && resourceId) {
+        throw new Error("resourceType and resourceId must be provided together.");
+      }
+      const resource = resourceType && resourceId ? { resourceType, resourceId } : void 0;
       return topolo.client.request({
         service: service.trim(),
         method,
         path,
         body: args["body"],
         ...normalisedQuery ? { query: normalisedQuery } : {},
+        ...resource ? { resource } : {},
         confirm: Boolean(args["confirm"])
       });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topolo/mcp",
-  "version": "0.4.7",
+  "version": "0.4.9",
   "description": "Model Context Protocol server for the Topolo platform. Exposes scope-gated tools that third-party agents (Claude, Codex, etc.) can call natively.",
   "type": "module",
   "bin": {
@@ -15,27 +15,27 @@
   "files": [
     "dist"
   ],
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch",
-    "typecheck": "tsc --noEmit",
-    "start": "node dist/index.js",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "coverage": "vitest run --coverage"
-  },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0"
   },
   "devDependencies": {
-    "@topolo/sdk": "workspace:*",
     "@types/node": "^20.12.0",
     "@vitest/coverage-v8": "^2.1.0",
     "tsup": "^8.0.0",
     "typescript": "^5.4.0",
-    "vitest": "^2.1.0"
+    "vitest": "^2.1.0",
+    "@topolo/sdk": "0.4.9"
   },
   "engines": {
     "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit",
+    "start": "node dist/index.js",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "coverage": "vitest run --coverage"
   }
-}
+}