@topolo/mcp 0.5.0 → 0.6.0

package/README.md

@@ -123,7 +123,7 @@ yet. GET requests work without confirmation; mutating HTTP methods must pass
 `confirm: true` or the SDK rejects the call. Backing services still enforce
 permissions for every request. The tool schema intentionally does not embed a
 large service enum; agents should call `topolo_list_services` first, then pass a
-service ID/slug from that credential-scoped result. New services become callable
+app ID/slug from that credential-scoped result. New services become callable
 without an MCP release once Auth grants the organization and credential the
 relevant permissions, and new actions become typed tools without an MCP release
 once the application publishes them.

package/dist/dispatch.js

@@ -6,7 +6,7 @@ import {
   APPLICATION_REQUIREMENTS,
   APPLICATION_REQUIREMENTS_VERSION,
   APPLICATIONS,
-  DEFAULT_SERVICE_URLS,
+  DEFAULT_APP_URLS,
   auditAllApplicationRequirements,
   applicationRequirementScopes,
   requirementsForApplication,
@@ -257,7 +257,7 @@ var TOOLS = [
   {
     name: "topolo_api_call",
     title: "Call any Topolo platform service",
-    description: "Low-level passthrough to any Topolo service. Use when no domain-specific tool exists for the operation you need. The request is signed with the current credential and scoped to the caller's organization \u2014 the target service will return 403 if your scopes do not permit the operation, even though this tool is advertised. Mutating calls (non-GET methods) require confirm:true. Call topolo_list_services first to discover callable service IDs; the SDK can also resolve live Auth-catalog service ids/slugs for newly registered API surfaces.",
+    description: "Low-level passthrough to any Topolo service. Use when no domain-specific tool exists for the operation you need. The request is signed with the current credential and scoped to the caller's organization \u2014 the target service will return 403 if your scopes do not permit the operation, even though this tool is advertised. Mutating calls (non-GET methods) require confirm:true. Call topolo_list_services first to discover callable app IDs; the SDK can also resolve live Auth-catalog app ids/slugs for newly registered API surfaces.",
     requiredScopes: [],
     destructive: true,
     inputSchema: {
@@ -265,7 +265,7 @@ var TOOLS = [
       properties: {
         service: {
           type: "string",
-          description: "Target service ID from the platform registry."
+          description: "Target app ID from the platform registry."
         },
         method: {
           type: "string",
@@ -370,7 +370,7 @@ function actionsToToolDefs(actions) {
   }));
 }
 function toolNameForAction(action) {
-  const service = (action.serviceSlug || action.appId || "service").replace(/^topolo-/, "").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  const service = (action.appSlug || action.appId || "service").replace(/^topolo-/, "").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
   const name = action.name.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
   return ["topolo", service, name].filter(Boolean).join("_").slice(0, 96);
 }
@@ -435,7 +435,7 @@ function displayAppId(entry) {
   for (const value of [entry.slug, entry.name, entry.appId]) {
     if (typeof value !== "string" || !value.trim()) continue;
     for (const candidate of appIdCandidates(value)) {
-      if (Object.prototype.hasOwnProperty.call(DEFAULT_SERVICE_URLS, candidate)) {
+      if (Object.prototype.hasOwnProperty.call(DEFAULT_APP_URLS, candidate)) {
         return candidate;
       }
     }

package/dist/http.js

@@ -15814,7 +15814,7 @@ import {
   APPLICATION_REQUIREMENTS,
   APPLICATION_REQUIREMENTS_VERSION,
   APPLICATIONS,
-  DEFAULT_SERVICE_URLS,
+  DEFAULT_APP_URLS,
   auditAllApplicationRequirements,
   applicationRequirementScopes,
   requirementsForApplication,
@@ -16065,7 +16065,7 @@ var TOOLS = [
   {
     name: "topolo_api_call",
     title: "Call any Topolo platform service",
-    description: "Low-level passthrough to any Topolo service. Use when no domain-specific tool exists for the operation you need. The request is signed with the current credential and scoped to the caller's organization \u2014 the target service will return 403 if your scopes do not permit the operation, even though this tool is advertised. Mutating calls (non-GET methods) require confirm:true. Call topolo_list_services first to discover callable service IDs; the SDK can also resolve live Auth-catalog service ids/slugs for newly registered API surfaces.",
+    description: "Low-level passthrough to any Topolo service. Use when no domain-specific tool exists for the operation you need. The request is signed with the current credential and scoped to the caller's organization \u2014 the target service will return 403 if your scopes do not permit the operation, even though this tool is advertised. Mutating calls (non-GET methods) require confirm:true. Call topolo_list_services first to discover callable app IDs; the SDK can also resolve live Auth-catalog app ids/slugs for newly registered API surfaces.",
     requiredScopes: [],
     destructive: true,
     inputSchema: {
@@ -16073,7 +16073,7 @@ var TOOLS = [
       properties: {
         service: {
           type: "string",
-          description: "Target service ID from the platform registry."
+          description: "Target app ID from the platform registry."
         },
         method: {
           type: "string",
@@ -16178,7 +16178,7 @@ function actionsToToolDefs(actions) {
   }));
 }
 function toolNameForAction(action) {
-  const service = (action.serviceSlug || action.appId || "service").replace(/^topolo-/, "").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  const service = (action.appSlug || action.appId || "service").replace(/^topolo-/, "").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
   const name = action.name.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
   return ["topolo", service, name].filter(Boolean).join("_").slice(0, 96);
 }
@@ -16243,7 +16243,7 @@ function displayAppId(entry) {
   for (const value of [entry.slug, entry.name, entry.appId]) {
     if (typeof value !== "string" || !value.trim()) continue;
     for (const candidate of appIdCandidates(value)) {
-      if (Object.prototype.hasOwnProperty.call(DEFAULT_SERVICE_URLS, candidate)) {
+      if (Object.prototype.hasOwnProperty.call(DEFAULT_APP_URLS, candidate)) {
         return candidate;
       }
     }

package/dist/index.js

@@ -58,7 +58,7 @@ var TopoloHttpError = class extends TopoloSdkError {
     this.path = path;
   }
 };
-var SERVICES = {
+var APP_API_URLS = {
   agent: "https://agent.topolo.app",
   auth: "https://auth.topolo.app",
   backup: "https://backup.topolo.app",
@@ -1645,12 +1645,12 @@ var APPLICATION_REQUIREMENTS = [
   {
     id: "shared-auth-boundary",
     title: "Use the shared Topolo auth boundary",
-    summary: "Applications must derive identity, organization, scopes, and service entitlement from TopoloAuth rather than inventing parallel auth state.",
+    summary: "Applications must derive identity, organization, scopes, and app entitlement from TopoloAuth rather than inventing parallel auth state.",
     appliesTo: ["browser", "api", "tooling", "agent_surface"],
     evidence: [
       "@topolo/auth-client or @topolo-io/worker-runtime is used where applicable",
       "No public command, tool, or SDK method accepts orgId",
-      "Service slug and Auth service registration are documented for protected services"
+      "App slug and Auth app registration are documented for protected APIs"
     ],
     implementation: [
       "Use shared auth/runtime packages instead of copying token parsing, gateway, or browser storage flows",
@@ -1683,20 +1683,20 @@ var APPLICATION_REQUIREMENTS = [
     ]
   },
   {
-    id: "service-registration-and-scopes",
-    title: "Register protected APIs as platform services",
-    summary: "Callable app APIs need a stable service ID, service slug, permissions, role bundles, and API-key scopes before agents or users rely on them.",
+    id: "app-registration-and-scopes",
+    title: "Register protected APIs as platform apps",
+    summary: "Callable app APIs need a stable app ID, app slug, permissions, role bundles, and API-key scopes before agents or users rely on them.",
     appliesTo: ["api"],
     evidence: [
-      "Auth service catalog contains the service ID and slug",
-      "Permissions, role bundles, and API-key scopes exist for the service",
-      "SDK, CLI, and MCP service discovery include the callable production API",
-      "CloudControl production HTTP targets classify agent reachability with sdk_service_id or agent_callable:false"
+      "Auth app catalog contains the app ID and slug",
+      "Permissions, role bundles, and API-key scopes exist for the app",
+      "SDK, CLI, and MCP app discovery include the callable production API",
+      "CloudControl production HTTP targets classify agent reachability with sdk_app_id or agent_callable:false"
     ],
     implementation: [
-      "Add production Worker api_url metadata and sdk_service_id for every agent-callable API target",
+      "Add production Worker api_url metadata and sdk_app_id for every agent-callable API target",
       "Mark browser, documentation, and runtime-only Worker targets with agent_callable:false",
-      "Expose stable service IDs through generated DEFAULT_SERVICE_URLS and live catalog discovery",
+      "Expose stable app IDs through generated DEFAULT_APP_URLS and live catalog discovery",
       "Keep typed SDK/CLI/MCP surfaces in sync when an API contract stabilizes"
     ]
   },
@@ -1902,7 +1902,7 @@ function evaluateRequirement(application, requirement) {
         "Catalog metadata cannot verify shared shell, launcher, and account menu adoption.",
         evidence
       );
-    case "service-registration-and-scopes": {
+    case "app-registration-and-scopes": {
       if (application.services.length > 0) {
         evidence.push(`services=${application.services.join(",")}`);
         return finding(
@@ -1912,7 +1912,7 @@ function evaluateRequirement(application, requirement) {
           evidence
         );
       }
-      return finding(requirement, "missing", "No SDK service ID is registered for this callable API surface.", evidence);
+      return finding(requirement, "missing", "No SDK app API id is registered for this callable API surface.", evidence);
     }
     case "organization-scoped-data":
       return finding(
@@ -1997,7 +1997,7 @@ function statusRank(status) {
   if (status === "partial") return 1;
   return 2;
 }
-var DEFAULT_SERVICE_URLS = SERVICES;
+var DEFAULT_APP_URLS = APP_API_URLS;
 function resolveCatalogServiceUrl(entry, options = {}) {
   const keys = catalogServiceKeyCandidates(entry, options.serviceKey);
   const override = resolveServiceUrlOverride(keys, options.overrides);
@@ -2009,7 +2009,7 @@ function resolveCatalogServiceUrl(entry, options = {}) {
 function resolveServiceUrl(service, overrides) {
   const override = resolveServiceUrlOverride([service], overrides);
   if (override) return override;
-  return DEFAULT_SERVICE_URLS[service];
+  return DEFAULT_APP_URLS[service];
 }
 function catalogServiceKeyCandidates(entry, preferred) {
   const values = [preferred, entry.slug, entry.name, entry.appId].filter(
@@ -2040,7 +2040,7 @@ function resolveServiceUrlOverride(keys, overrides) {
     if (envStyle) return envStyle;
   }
   for (const key of keys) {
-    const envKey = `TOPOLO_SERVICE_URL_${key.replace(/\./g, "_").toUpperCase()}`;
+    const envKey = `TOPOLO_APP_URL_${key.replace(/\./g, "_").toUpperCase()}`;
     const envValue = typeof process !== "undefined" ? process.env?.[envKey] : void 0;
     if (envValue) return envValue;
   }
@@ -2225,7 +2225,7 @@ var TopoloClient = class _TopoloClient {
         const derived = deriveDevelopersFromAuth(resolveConfiguredServiceUrl("auth", this.serviceUrls));
         if (derived) return { serviceKey, baseUrl: derived };
       }
-      return { serviceKey, baseUrl: DEFAULT_SERVICE_URLS[serviceKey] };
+      return { serviceKey, baseUrl: DEFAULT_APP_URLS[serviceKey] };
     }
     const live = await this.resolveLiveCallableService(serviceKey);
     if (live) {
@@ -2234,7 +2234,7 @@ var TopoloClient = class _TopoloClient {
     }
     throw new TopoloSdkError(
       "unknown_service",
-      `Unknown Topolo service "${service}". Run service discovery first and pass a callable service id or slug.`
+      `Unknown Topolo app API "${service}". Run app discovery first and pass a callable app id or slug.`
     );
   }
   async resolveLiveCallableService(serviceKey) {
@@ -2407,7 +2407,7 @@ var TopoloClient = class _TopoloClient {
   async callAction(action, input = {}, options = {}) {
     const entry = await this.getAction(action);
     const mapped = mapActionInput(entry, input);
-    const service = entry.serviceSlug || entry.appId;
+    const service = entry.appSlug || entry.appId;
     return this.request({
       service,
       method: entry.method,
@@ -2595,8 +2595,8 @@ function normalizeActionCatalogEntry(item) {
     title: pickActionString(a.title) ?? name,
     description: pickActionString(a.description) ?? "",
     appId,
-    serviceSlug: pickActionString(a.service_slug) ?? pickActionString(a.serviceSlug) ?? null,
-    serviceName: pickActionString(a.service_name) ?? pickActionString(a.serviceName) ?? null,
+    appSlug: pickActionString(a.app_slug) ?? pickActionString(a.appSlug) ?? null,
+    appName: pickActionString(a.app_name) ?? pickActionString(a.appName) ?? null,
     method,
     path,
     permissionName: pickActionString(a.permission_name) ?? pickActionString(a.permissionName) ?? "",
@@ -2711,6 +2711,7 @@ var CrmModule = class {
   constructor(client) {
     this.client = client;
   }
+  client;
   async listContacts(options = {}) {
     const res = await this.client.request({
       service: "crm",
@@ -2756,6 +2757,7 @@ var IdentityModule = class {
   constructor(client) {
     this.client = client;
   }
+  client;
   /** Returns the resolved user, organization, and permission set for the
    *  current credential. Equivalent to `TopoloClient.introspect()` — exposed
    *  on this module for symmetry with the other domain modules. */
@@ -2772,22 +2774,353 @@ function createTopolo(options) {
   };
 }
 
-// src/auth.ts
-function resolveCredentialFromEnv() {
-  const apiKey = process.env.TOPOLO_API_KEY;
+// ../topolo-sdk/dist/node/credential-store.js
+import { mkdir, readFile, writeFile, chmod } from "fs/promises";
+import { existsSync } from "fs";
+import { homedir, platform } from "os";
+import { dirname, join } from "path";
+var TopoloSdkError2 = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "TopoloSdkError";
+    this.code = code;
+  }
+};
+var TopoloAuthError2 = class extends TopoloSdkError2 {
+  constructor(message, code = "auth_error") {
+    super(code, message);
+    this.name = "TopoloAuthError";
+  }
+};
+var TopoloHttpError2 = class extends TopoloSdkError2 {
+  status;
+  body;
+  service;
+  path;
+  constructor(service, path, status, body, message) {
+    super("http_error", message ?? `HTTP ${status} from ${service}${path}`);
+    this.name = "TopoloHttpError";
+    this.status = status;
+    this.body = body;
+    this.service = service;
+    this.path = path;
+  }
+};
+var APP_API_URLS2 = {
+  agent: "https://agent.topolo.app",
+  auth: "https://auth.topolo.app",
+  backup: "https://backup.topolo.app",
+  books: "https://books.topolo.app",
+  bugfix: "https://bugfix.topolo.app",
+  bytes: "https://bytes.topolo.app",
+  calendar: "https://calendar.topolo.app",
+  capacity: "https://capacity.topolo.app",
+  chat: "https://chat.topolo.app",
+  commerce: "https://commerce.topolo.app",
+  compose: "https://compose.topolo.app",
+  consent: "https://consent.topolo.app",
+  crm: "https://crm.topolo.app",
+  developers: "https://developers.topolo.app",
+  director: "https://director.topolo.app",
+  feed: "https://feed.topolo.app",
+  flow: "https://flow.topolo.app",
+  forecast: "https://forecast.topolo.app",
+  forms: "https://forms.topolo.app",
+  home: "https://home.topolo.app",
+  insights: "https://insights.topolo.app",
+  inventory: "https://inventory.topolo.app",
+  learn: "https://learn.topolo.app",
+  localize: "https://localize.topolo.app",
+  mail: "https://mail.topolo.app",
+  mdm: "https://mdm.topolo.app",
+  messages: "https://messages.topolo.app",
+  nexus: "https://nexus.topolo.app",
+  notify: "https://notify.topolo.app",
+  observability_watch: "https://observability-watch.topolo.app",
+  one: "https://www.topolo.app",
+  p2p: "https://p2p.topolo.app",
+  pay: "https://pay.topolo.app",
+  people: "https://people.topolo.app",
+  "quro.api": "https://api.ol0.me",
+  "quro.redirect": "https://ol0.me",
+  roadmapper: "https://roadmapper.topolo.app",
+  sign: "https://sign.topolo.app",
+  social_studio: "https://studio.topolo.app",
+  socialize: "https://socialize.topolo.app",
+  spaces: "https://spaces.topolo.app",
+  status: "https://status.topolo.app",
+  success: "https://success.topolo.app",
+  support: "https://support.topolo.app",
+  survey: "https://survey.topolo.app",
+  voice: "https://voice.topolo.app",
+  web: "https://web.topolo.app"
+};
+var DEFAULT_APP_URLS2 = APP_API_URLS2;
+function resolveServiceUrl2(service, overrides) {
+  const override = resolveServiceUrlOverride2([service], overrides);
+  if (override) return override;
+  return DEFAULT_APP_URLS2[service];
+}
+function resolveServiceUrlOverride2(keys, overrides) {
+  for (const key of keys) {
+    const direct = overrides?.[key];
+    if (direct) return direct;
+    const envStyleKey = key.replace(/\./g, "_");
+    const envStyle = overrides?.[envStyleKey];
+    if (envStyle) return envStyle;
+  }
+  for (const key of keys) {
+    const envKey = `TOPOLO_APP_URL_${key.replace(/\./g, "_").toUpperCase()}`;
+    const envValue = typeof process !== "undefined" ? process.env?.[envKey] : void 0;
+    if (envValue) return envValue;
+  }
+  return null;
+}
+var DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+var TopoloOAuth = class {
+  baseUrl;
+  fetchImpl;
+  constructor(options = {}) {
+    this.baseUrl = resolveServiceUrl2("auth", options.serviceUrls);
+    this.fetchImpl = options.fetch ?? fetch;
+  }
+  /**
+   * RFC 8628 device authorization grant — starts the flow by asking the server
+   * for a device_code + user_code. The caller prints the user_code +
+   * verification_uri and then polls `pollDeviceToken` until approval.
+   */
+  async requestDeviceCode(params) {
+    const body = new URLSearchParams();
+    body.set("client_id", params.clientId);
+    if (params.scope) {
+      body.set("scope", Array.isArray(params.scope) ? params.scope.join(" ") : params.scope);
+    }
+    return this.#postForm("/api/developer-oauth/device_authorization", body);
+  }
+  /**
+   * Polls the token endpoint once. Returns the token pair on success, or
+   * throws a `TopoloAuthError` whose `code` is one of the RFC 8628 poll
+   * states: `authorization_pending`, `slow_down`, `access_denied`,
+   * `expired_token`. Callers should back off on `slow_down`, wait at least
+   * one `interval` on `authorization_pending`, and give up on the rest.
+   */
+  async pollDeviceToken(params) {
+    const body = new URLSearchParams();
+    body.set("grant_type", DEVICE_GRANT);
+    body.set("client_id", params.clientId);
+    body.set("device_code", params.deviceCode);
+    if (params.clientSecret) body.set("client_secret", params.clientSecret);
+    return this.#postForm("/api/developer-oauth/token", body);
+  }
+  /** Exchange an authorization code (with PKCE) for tokens. */
+  async exchangeAuthorizationCode(params) {
+    const body = new URLSearchParams();
+    body.set("grant_type", "authorization_code");
+    body.set("client_id", params.clientId);
+    body.set("code", params.code);
+    body.set("redirect_uri", params.redirectUri);
+    if (params.codeVerifier) body.set("code_verifier", params.codeVerifier);
+    if (params.clientSecret) body.set("client_secret", params.clientSecret);
+    return this.#postForm("/api/developer-oauth/token", body);
+  }
+  /** Rotate a refresh token for a new token pair. */
+  async refreshToken(params) {
+    const body = new URLSearchParams();
+    body.set("grant_type", "refresh_token");
+    body.set("client_id", params.clientId);
+    body.set("refresh_token", params.refreshToken);
+    if (params.clientSecret) body.set("client_secret", params.clientSecret);
+    return this.#postForm("/api/developer-oauth/token", body);
+  }
+  async #postForm(path, body) {
+    const url = new URL(path, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
+    const res = await this.fetchImpl(url.toString(), {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json"
+      },
+      body: body.toString()
+    });
+    const contentType = res.headers.get("Content-Type") ?? "";
+    const parsed = contentType.includes("application/json") ? await res.json().catch(() => null) : await res.text().catch(() => null);
+    if (!res.ok) {
+      if (parsed && typeof parsed === "object" && "error" in parsed) {
+        const err = parsed;
+        throw new TopoloAuthError2(err.error_description || err.error, err.error);
+      }
+      throw new TopoloHttpError2("auth", path, res.status, parsed);
+    }
+    return parsed;
+  }
+};
+var ENVIRONMENT_DEFAULT_SERVICE_URLS = {
+  production: {
+    developers: "https://developers.topolo.app"
+  },
+  staging: {
+    auth: "https://auth.stg.topolo.us",
+    developers: "https://developers.stg.topolo.us",
+    seed: "https://seed.stg.topolo.us"
+  },
+  development: {
+    auth: "https://auth.topolo.dev",
+    developers: "https://developers.topolo.dev"
+  },
+  local: {}
+};
+function configPath() {
+  const override = process.env.TOPOLO_CONFIG_PATH;
+  if (override) return override;
+  const base = process.env.XDG_CONFIG_HOME || (platform() === "win32" ? join(homedir(), "AppData", "Roaming") : join(homedir(), ".config"));
+  return join(base, "topolo", "config.json");
+}
+async function readConfig() {
+  const path = configPath();
+  if (!existsSync(path)) return {};
+  try {
+    const raw = await readFile(path, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+}
+async function writeConfig(config) {
+  const path = configPath();
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(path, JSON.stringify(config, null, 2) + "\n", "utf8");
+  if (platform() !== "win32") {
+    try {
+      await chmod(path, 384);
+    } catch {
+    }
+  }
+}
+function normalizeEnvironment(value) {
+  const normalized = (value ?? "production").trim().toLowerCase();
+  if (normalized === "" || normalized === "production" || normalized === "prod") {
+    return "production";
+  }
+  if (normalized === "staging" || normalized === "stage" || normalized === "stg") {
+    return "staging";
+  }
+  if (normalized === "development" || normalized === "dev") {
+    return "development";
+  }
+  if (normalized === "local" || normalized === "localhost") {
+    return "local";
+  }
+  throw new Error(
+    `Unknown Topolo environment "${value}". Expected production, staging, development, or local.`
+  );
+}
+function selectedEnvironment() {
+  return normalizeEnvironment(process.env.TOPOLO_ENV);
+}
+function envVarPrefix(environment) {
+  if (environment === "production") return "TOPOLO_PRODUCTION";
+  if (environment === "staging") return "TOPOLO_STAGING";
+  if (environment === "development") return "TOPOLO_DEVELOPMENT";
+  return "TOPOLO_LOCAL";
+}
+function profileForEnvironment(config, environment = selectedEnvironment()) {
+  const profile = config.profiles?.[environment] ?? {};
+  if (environment === "production") {
+    return {
+      credential: config.credential,
+      oauthClientId: config.oauthClientId,
+      ...profile,
+      serviceUrls: {
+        ...config.serviceUrls ?? {},
+        ...profile.serviceUrls ?? {}
+      },
+      agentName: profile.agentName ?? config.agentName
+    };
+  }
+  return profile;
+}
+function writeProfileConfig(config, environment, profile) {
+  const profiles = { ...config.profiles ?? {} };
+  profiles[environment] = {
+    ...profiles[environment] ?? {},
+    ...profile
+  };
+  return { ...config, profiles };
+}
+async function resolveCredential(environment = selectedEnvironment()) {
+  const prefix = envVarPrefix(environment);
+  const apiKey = process.env[`${prefix}_API_KEY`] ?? process.env.TOPOLO_API_KEY;
   if (apiKey) return { kind: "api_key", apiKey };
-  const accessToken = process.env.TOPOLO_ACCESS_TOKEN;
+  const accessToken = process.env[`${prefix}_ACCESS_TOKEN`] ?? process.env.TOPOLO_ACCESS_TOKEN;
   if (accessToken) return { kind: "access_token", accessToken };
-  return null;
+  const config = await readConfig();
+  return profileForEnvironment(config, environment).credential ?? null;
+}
+var REFRESH_SKEW_SECONDS = 60;
+async function refreshCredentialIfNeeded(environment = selectedEnvironment()) {
+  const prefix = envVarPrefix(environment);
+  if (process.env[`${prefix}_API_KEY`] || process.env[`${prefix}_ACCESS_TOKEN`] || process.env.TOPOLO_API_KEY || process.env.TOPOLO_ACCESS_TOKEN) {
+    return resolveCredential(environment);
+  }
+  const config = await readConfig();
+  const profile = profileForEnvironment(config, environment);
+  const cred = profile.credential;
+  if (!cred || cred.kind !== "access_token") return cred ?? null;
+  if (!cred.refreshToken || !cred.expiresAt || !profile.oauthClientId) return cred;
+  const now = Math.floor(Date.now() / 1e3);
+  if (cred.expiresAt - REFRESH_SKEW_SECONDS > now) return cred;
+  try {
+    const oauth = new TopoloOAuth({
+      serviceUrls: resolveServiceUrls(profile.serviceUrls, environment)
+    });
+    const tokens = await oauth.refreshToken({
+      clientId: profile.oauthClientId,
+      refreshToken: cred.refreshToken
+    });
+    const refreshed = {
+      kind: "access_token",
+      accessToken: tokens.access_token,
+      ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: cred.refreshToken },
+      expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
+    };
+    await writeConfig(
+      environment === "production" && !config.profiles?.production ? { ...config, credential: refreshed } : writeProfileConfig(config, environment, { credential: refreshed })
+    );
+    return refreshed;
+  } catch {
+    return cred;
+  }
+}
+function resolveAgentName(configAgentName) {
+  return process.env.TOPOLO_AGENT_NAME ?? configAgentName;
 }
-function resolveServiceUrlsFromEnv() {
-  const out = {};
+function resolveServiceUrls(configUrls, environment = selectedEnvironment()) {
+  const merged = {
+    ...ENVIRONMENT_DEFAULT_SERVICE_URLS[environment],
+    ...configUrls ?? {}
+  };
+  const prefix = `${envVarPrefix(environment)}_SERVICE_URL_`;
+  for (const [k, v] of Object.entries(process.env)) {
+    if (k.startsWith(prefix) && v) {
+      merged[k.slice(prefix.length).toLowerCase()] = v;
+    }
+  }
   for (const [k, v] of Object.entries(process.env)) {
     if (k.startsWith("TOPOLO_SERVICE_URL_") && v) {
-      out[k.slice("TOPOLO_SERVICE_URL_".length).toLowerCase()] = v;
+      merged[k.slice("TOPOLO_SERVICE_URL_".length).toLowerCase()] = v;
     }
   }
-  return Object.keys(out).length > 0 ? out : void 0;
+  return Object.keys(merged).length > 0 ? merged : void 0;
+}
+
+// src/auth.ts
+function resolveCredentialFromEnv() {
+  const apiKey = process.env.TOPOLO_API_KEY;
+  if (apiKey) return { kind: "api_key", apiKey };
+  const accessToken = process.env.TOPOLO_ACCESS_TOKEN;
+  if (accessToken) return { kind: "access_token", accessToken };
+  return null;
 }
 
 // src/server.ts
@@ -3041,7 +3374,7 @@ var TOOLS = [
   {
     name: "topolo_api_call",
     title: "Call any Topolo platform service",
-    description: "Low-level passthrough to any Topolo service. Use when no domain-specific tool exists for the operation you need. The request is signed with the current credential and scoped to the caller's organization \u2014 the target service will return 403 if your scopes do not permit the operation, even though this tool is advertised. Mutating calls (non-GET methods) require confirm:true. Call topolo_list_services first to discover callable service IDs; the SDK can also resolve live Auth-catalog service ids/slugs for newly registered API surfaces.",
+    description: "Low-level passthrough to any Topolo service. Use when no domain-specific tool exists for the operation you need. The request is signed with the current credential and scoped to the caller's organization \u2014 the target service will return 403 if your scopes do not permit the operation, even though this tool is advertised. Mutating calls (non-GET methods) require confirm:true. Call topolo_list_services first to discover callable app IDs; the SDK can also resolve live Auth-catalog app ids/slugs for newly registered API surfaces.",
     requiredScopes: [],
     destructive: true,
     inputSchema: {
@@ -3049,7 +3382,7 @@ var TOOLS = [
       properties: {
         service: {
           type: "string",
-          description: "Target service ID from the platform registry."
+          description: "Target app ID from the platform registry."
         },
         method: {
           type: "string",
@@ -3154,7 +3487,7 @@ function actionsToToolDefs(actions) {
   }));
 }
 function toolNameForAction(action) {
-  const service = (action.serviceSlug || action.appId || "service").replace(/^topolo-/, "").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  const service = (action.appSlug || action.appId || "service").replace(/^topolo-/, "").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
   const name = action.name.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
   return ["topolo", service, name].filter(Boolean).join("_").slice(0, 96);
 }
@@ -3219,7 +3552,7 @@ function displayAppId(entry) {
   for (const value of [entry.slug, entry.name, entry.appId]) {
     if (typeof value !== "string" || !value.trim()) continue;
     for (const candidate of appIdCandidates(value)) {
-      if (Object.prototype.hasOwnProperty.call(DEFAULT_SERVICE_URLS, candidate)) {
+      if (Object.prototype.hasOwnProperty.call(DEFAULT_APP_URLS, candidate)) {
         return candidate;
       }
     }
@@ -3245,14 +3578,14 @@ function formatKnownValues(values, label) {
 
 // src/version.ts
 import { readFileSync } from "fs";
-import { dirname, join } from "path";
+import { dirname as dirname2, join as join2 } from "path";
 import { fileURLToPath } from "url";
 function readMcpVersion() {
   try {
-    const here = dirname(fileURLToPath(import.meta.url));
+    const here = dirname2(fileURLToPath(import.meta.url));
     const candidates = [
-      join(here, "package.json"),
-      join(here, "..", "package.json")
+      join2(here, "package.json"),
+      join2(here, "..", "package.json")
     ];
     for (const path of candidates) {
       try {
@@ -3331,15 +3664,21 @@ function toolError(message) {
 
 // src/index.ts
 async function main() {
-  const credential = resolveCredentialFromEnv();
+  const environment = normalizeEnvironment(process.env.TOPOLO_ENV);
+  let credential = resolveCredentialFromEnv();
+  if (!credential) {
+    credential = await refreshCredentialIfNeeded(environment);
+  }
   if (!credential) {
     process.stderr.write(
-      "TopoloMCP: TOPOLO_API_KEY or TOPOLO_ACCESS_TOKEN must be set in the environment.\n"
+      "TopoloMCP: no Topolo credential. Run `topolo auth login`, or set TOPOLO_API_KEY / TOPOLO_ACCESS_TOKEN.\n"
     );
     process.exit(1);
   }
-  const agentName = process.env.TOPOLO_AGENT_NAME;
-  const serviceUrls = resolveServiceUrlsFromEnv();
+  const config = await readConfig();
+  const profile = profileForEnvironment(config, environment);
+  const agentName = resolveAgentName(profile.agentName);
+  const serviceUrls = resolveServiceUrls(profile.serviceUrls, environment);
   const topolo = createTopolo({
     credential,
     agent: {
@@ -3356,7 +3695,7 @@ async function main() {
   await server.connect(transport);
   const toolNames = await advertisedToolNames(topolo, scopes);
   process.stderr.write(
-    `TopoloMCP v${MCP_VERSION} connected. Tools available: ${toolNames.join(", ") || "(none)"}
+    `TopoloMCP v${MCP_VERSION} connected (${environment}). Tools available: ${toolNames.join(", ") || "(none)"}
 `
   );
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topolo/mcp",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Model Context Protocol server for the Topolo platform. Exposes scope-gated tools that third-party agents (Claude, Codex, etc.) can call natively.",
   "type": "module",
   "bin": {