@topolo/mcp 0.6.0 → 0.7.1

package/dist/http.js

@@ -3098,9 +3098,9 @@ var require_data = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/utils.js
+// ../../node_modules/.pnpm/fast-uri@3.1.3/node_modules/fast-uri/lib/utils.js
 var require_utils = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/utils.js"(exports, module) {
+  "../../node_modules/.pnpm/fast-uri@3.1.3/node_modules/fast-uri/lib/utils.js"(exports, module) {
     "use strict";
     var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
     var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
@@ -3411,9 +3411,9 @@ var require_utils = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/schemes.js
+// ../../node_modules/.pnpm/fast-uri@3.1.3/node_modules/fast-uri/lib/schemes.js
 var require_schemes = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/schemes.js"(exports, module) {
+  "../../node_modules/.pnpm/fast-uri@3.1.3/node_modules/fast-uri/lib/schemes.js"(exports, module) {
     "use strict";
     var { isUUID } = require_utils();
     var URN_REG = /([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-.:;=@]|%[\da-f]{2})+)/iu;
@@ -3621,9 +3621,9 @@ var require_schemes = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/index.js
+// ../../node_modules/.pnpm/fast-uri@3.1.3/node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/index.js"(exports, module) {
+  "../../node_modules/.pnpm/fast-uri@3.1.3/node_modules/fast-uri/index.js"(exports, module) {
     "use strict";
     var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
@@ -3836,7 +3836,7 @@ var require_fast_uri = __commonJS({
         if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
           if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
             try {
-              parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
+              parsed.host = new URL("http://" + parsed.host).hostname;
             } catch (e) {
               parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
             }
@@ -15861,6 +15861,15 @@ function splitService(servicePart) {
 // src/tools.ts
 var APPLICATION_IDS = Object.keys(APPLICATIONS).sort();
 var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
+function optionalResourceContext(args) {
+  const resourceType = typeof args["resourceType"] === "string" ? args["resourceType"].trim() : "";
+  const resourceId = typeof args["resourceId"] === "string" ? args["resourceId"].trim() : "";
+  if (!resourceType && !resourceId) return void 0;
+  if (!resourceType || !resourceId) {
+    throw new Error("resourceType and resourceId must be provided together.");
+  }
+  return { resourceType, resourceId };
+}
 var TOOLS = [
   {
     name: "topolo_whoami",
@@ -15876,22 +15885,32 @@ var TOOLS = [
     handler: async (topolo) => topolo.identity.whoami()
   },
   {
-    name: "topolo_list_services",
-    title: "List every Topolo service the agent can reach",
-    description: "Returns the credential-scoped service registry: one entry per platform service the current credential can use in its organization, with granted permissions, API URL, and launch URL. Use this to discover what `topolo_api_call` can address. This is not the global platform catalog.",
+    name: "topolo_search_applications",
+    title: "Search Topolo applications the agent can reach",
+    description: "Searches the credential-scoped application registry with a bounded page and continuation cursor. Returns actionService as the canonical selector for topolo_search_actions, plus granted permissions, API URL, and launch URL without loading the global platform catalog.",
     requiredScopes: [],
     destructive: false,
     inputSchema: {
       type: "object",
-      properties: {},
+      properties: {
+        query: { type: "string" },
+        cursor: { type: "string" },
+        limit: { type: "integer", minimum: 1, maximum: 100, default: 25 }
+      },
       additionalProperties: false
     },
-    handler: async (topolo) => {
-      const services = (await topolo.client.listServices()).map((entry) => {
+    handler: async (topolo, args) => {
+      const result = await topolo.client.searchServices({
+        query: typeof args["query"] === "string" ? args["query"] : void 0,
+        cursor: typeof args["cursor"] === "string" ? args["cursor"] : void 0,
+        limit: typeof args["limit"] === "number" ? args["limit"] : void 0
+      });
+      const applications = result.services.map((entry) => {
         const id = displayAppId(entry);
         return {
           id,
           appId: entry.appId,
+          actionService: entry.appId,
           slug: entry.slug,
           name: entry.name,
           apiBaseUrl: entry.apiBaseUrl,
@@ -15904,13 +15923,13 @@ var TOOLS = [
           permissions: [...entry.permissions]
         };
       }).sort((left, right) => left.id.localeCompare(right.id));
-      return { services };
+      return { applications, page: result.page };
     }
   },
   {
-    name: "topolo_list_actions",
-    title: "List every Topolo action the agent can call",
-    description: "Returns the credential-scoped callable action catalog. Actions are published by applications through TopoloDevelopers and filtered by TopoloAuth against the current organization and effective permissions.",
+    name: "topolo_search_actions",
+    title: "Search Topolo actions the agent can call",
+    description: "Searches one application's credential-scoped actions with a bounded page and continuation cursor.",
     requiredScopes: [],
     destructive: false,
     inputSchema: {
@@ -15918,31 +15937,25 @@ var TOOLS = [
       properties: {
         service: {
           type: "string",
-          description: "Optional app id, slug, or name filter."
-        }
+          description: "Required application selector. Prefer actionService from topolo_search_applications; canonical app id, slug, and name are also accepted."
+        },
+        query: { type: "string" },
+        cursor: { type: "string" },
+        limit: { type: "integer", minimum: 1, maximum: 100, default: 25 }
       },
+      required: ["service"],
       additionalProperties: false
     },
-    handler: async (topolo, args) => ({
-      actions: await topolo.client.listActions({
-        service: typeof args["service"] === "string" ? args["service"] : void 0
-      })
-    })
-  },
-  {
-    name: "topolo_list_applications",
-    title: "List every Topolo platform application",
-    description: "Returns the live Topolo application catalog from the platform registry. Reflects apps as they are registered/removed with no client rebuild. Authenticated callers in an entitled org also see the developer_only apps their role permits. Falls back to a bundled snapshot only if the registry is unreachable.",
-    requiredScopes: [],
-    destructive: false,
-    inputSchema: {
-      type: "object",
-      properties: {},
-      additionalProperties: false
-    },
-    handler: async (topolo) => ({
-      applications: await topolo.client.listServices()
-    })
+    handler: async (topolo, args) => {
+      const service = typeof args["service"] === "string" ? args["service"].trim() : "";
+      if (!service) throw new Error("service is required for bounded action discovery.");
+      return topolo.client.searchActions({
+        service,
+        query: typeof args["query"] === "string" ? args["query"] : void 0,
+        cursor: typeof args["cursor"] === "string" ? args["cursor"] : void 0,
+        limit: typeof args["limit"] === "number" ? args["limit"] : void 0
+      });
+    }
   },
   {
     name: "topolo_get_application",
@@ -15955,7 +15968,7 @@ var TOOLS = [
       properties: {
         application: {
           type: "string",
-          description: "Application identifier: app id, slug, or name from topolo_list_applications."
+          description: "Application identifier: app id, slug, or name from topolo_search_applications."
         }
       },
       required: ["application"],
@@ -15966,18 +15979,98 @@ var TOOLS = [
       if (typeof application !== "string" || !application.trim()) {
         throw new Error("`application` must be a non-empty string.");
       }
-      const needle = application.trim().toLowerCase();
-      const catalog = await topolo.client.listServices();
-      const match = catalog.find(
-        (e) => e.appId.toLowerCase() === needle || e.slug && e.slug.toLowerCase() === needle || e.name && e.name.toLowerCase() === needle
+      return { application: await topolo.client.getService(application) };
+    }
+  },
+  {
+    name: "topolo_get_action",
+    title: "Describe one Topolo action",
+    description: "Returns one credential-scoped action by exact action id.",
+    requiredScopes: [],
+    destructive: false,
+    inputSchema: {
+      type: "object",
+      properties: { actionId: { type: "string", minLength: 1 } },
+      required: ["actionId"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => {
+      const actionId = typeof args["actionId"] === "string" ? args["actionId"].trim() : "";
+      if (!actionId) throw new Error("actionId is required.");
+      return { action: await topolo.client.getAction(actionId) };
+    }
+  },
+  {
+    name: "topolo_read_action",
+    title: "Call one read-only Topolo action",
+    description: "Calls one exact action id only when its published contract is read-only and needs no confirmation.",
+    requiredScopes: [],
+    destructive: false,
+    inputSchema: {
+      type: "object",
+      properties: {
+        actionId: { type: "string", minLength: 1 },
+        input: { type: "object", additionalProperties: true },
+        resourceType: { type: "string", description: "Optional app-local resource alias, such as workspace." },
+        resourceId: { type: "string", description: "Resource id. Required when resourceType is provided." }
+      },
+      required: ["actionId"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => {
+      const actionId = typeof args["actionId"] === "string" ? args["actionId"].trim() : "";
+      if (!actionId) throw new Error("actionId is required.");
+      const input = args["input"];
+      if (input !== void 0 && (!input || typeof input !== "object" || Array.isArray(input))) {
+        throw new Error("input must be an object.");
+      }
+      const action = await topolo.client.getAction(actionId);
+      const agentAccess = action.agentAccess ?? (action.destructive ? "off" : action.readOnly && !action.requiresConfirmation ? "auto" : "confirm");
+      if (action.method !== "GET" || !action.readOnly || action.destructive || action.requiresConfirmation || agentAccess !== "auto") {
+        throw new Error(`Action "${actionId}" is not an automatic read-only action. Use topolo_call_action with confirmation.`);
+      }
+      const resource = optionalResourceContext(args);
+      return topolo.client.callAction(
+        actionId,
+        input ?? {},
+        resource ? { resource } : {}
+      );
+    }
+  },
+  {
+    name: "topolo_call_action",
+    title: "Call one Topolo action",
+    description: "Calls one exact action id. Mutating actions require confirm:true.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: {
+        actionId: { type: "string", minLength: 1 },
+        input: { type: "object", additionalProperties: true },
+        resourceType: { type: "string", description: "Optional app-local resource alias, such as workspace." },
+        resourceId: { type: "string", description: "Resource id. Required when resourceType is provided." },
+        confirm: { type: "boolean" }
+      },
+      required: ["actionId"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => {
+      const actionId = typeof args["actionId"] === "string" ? args["actionId"].trim() : "";
+      if (!actionId) throw new Error("actionId is required.");
+      const input = args["input"];
+      if (input !== void 0 && (!input || typeof input !== "object" || Array.isArray(input))) {
+        throw new Error("input must be an object.");
+      }
+      const resource = optionalResourceContext(args);
+      return topolo.client.callAction(
+        actionId,
+        input ?? {},
+        {
+          confirm: args["confirm"] === true,
+          ...resource ? { resource } : {}
+        }
       );
-      if (!match) {
-        const known = catalog.map((e) => e.slug || e.appId).sort().filter((value) => typeof value === "string" && value.length > 0);
-        throw new Error(
-          `Unknown application "${application}". ${formatKnownValues(known, "applications")}`
-        );
-      }
-      return { application: match };
     }
   },
   {
@@ -15991,7 +16084,7 @@ var TOOLS = [
       properties: {
         application: {
           type: "string",
-          description: "Optional application ID from topolo_list_applications."
+          description: "Optional application ID from topolo_search_applications."
         }
       },
       additionalProperties: false
@@ -16031,7 +16124,7 @@ var TOOLS = [
       properties: {
         application: {
           type: "string",
-          description: "Optional application ID from topolo_list_applications."
+          description: "Optional application ID from topolo_search_applications."
         },
         failOn: {
           type: "string",
@@ -16065,7 +16158,7 @@ var TOOLS = [
   {
     name: "topolo_api_call",
     title: "Call any Topolo platform service",
-    description: "Low-level passthrough to any Topolo service. Use when no domain-specific tool exists for the operation you need. The request is signed with the current credential and scoped to the caller's organization \u2014 the target service will return 403 if your scopes do not permit the operation, even though this tool is advertised. Mutating calls (non-GET methods) require confirm:true. Call topolo_list_services first to discover callable app IDs; the SDK can also resolve live Auth-catalog app ids/slugs for newly registered API surfaces.",
+    description: "Low-level passthrough to any Topolo service. Use when no domain-specific tool exists for the operation you need. The request is signed with the current credential and scoped to the caller's organization \u2014 the target service will return 403 if your scopes do not permit the operation, even though this tool is advertised. Mutating calls (non-GET methods) require confirm:true. Call topolo_search_applications first to discover callable app IDs; the SDK can also resolve live Auth-catalog app ids/slugs for newly registered API surfaces.",
     requiredScopes: [],
     destructive: true,
     inputSchema: {
@@ -16096,7 +16189,7 @@ var TOOLS = [
         },
         resourceType: {
           type: "string",
-          description: "Optional workspace resource alias from topolo_list_services apiKeyResources. Aliases are app-defined, e.g. brand, mailbox, venue, merchant, or any other cataloged alias."
+          description: "Optional workspace resource alias from topolo_search_applications apiKeyResources. Aliases are app-defined, e.g. brand, mailbox, venue, merchant, or any other cataloged alias."
         },
         resourceId: {
           type: "string",
@@ -16114,7 +16207,7 @@ var TOOLS = [
       const service = args["service"];
       const path = args["path"];
       if (typeof service !== "string" || !service.trim()) {
-        throw new Error("service is required. Call topolo_list_services first to discover callable services.");
+        throw new Error("service is required. Call topolo_search_applications first to discover callable services.");
       }
       if (typeof path !== "string" || !path) {
         throw new Error("path is required");
@@ -16128,12 +16221,7 @@ var TOOLS = [
       const normalisedQuery = query && typeof query === "object" && !Array.isArray(query) ? Object.fromEntries(
         Object.entries(query).map(([k, v]) => [k, String(v)])
       ) : void 0;
-      const resourceType = typeof args["resourceType"] === "string" ? args["resourceType"].trim() : "";
-      const resourceId = typeof args["resourceId"] === "string" ? args["resourceId"].trim() : "";
-      if (resourceType && !resourceId || !resourceType && resourceId) {
-        throw new Error("resourceType and resourceId must be provided together.");
-      }
-      const resource = resourceType && resourceId ? { resourceType, resourceId } : void 0;
+      const resource = optionalResourceContext(args);
       return topolo.client.request({
         service: service.trim(),
         method,
@@ -16150,58 +16238,8 @@ function filterToolsByScopes(tools, scopes) {
   return tools.filter((t) => hasAnyScope(scopes, t.requiredScopes));
 }
 async function buildTopoloTools(topolo, scopes, tools = TOOLS) {
-  const baseTools = filterToolsByScopes(tools, scopes);
-  const actions = await topolo.client.listActions().catch(() => []);
-  const actionTools = actionsToToolDefs(actions);
-  return filterToolsByScopes([...baseTools, ...actionTools], scopes);
-}
-function effectiveAgentAccess(a) {
-  if (a.agentAccess) return a.agentAccess;
-  if (a.destructive) return "off";
-  if (a.readOnly && !a.requiresConfirmation) return "auto";
-  return "confirm";
-}
-function actionsToToolDefs(actions) {
-  return actions.map((action) => ({ action, access: effectiveAgentAccess(action) })).filter(({ access }) => access !== "off").map(({ action, access }) => ({
-    name: action.toolName || toolNameForAction(action),
-    title: action.title,
-    description: action.description,
-    requiredScopes: action.requiredPermission ? [action.requiredPermission] : [],
-    destructive: access === "confirm",
-    inputSchema: actionInputSchema(action, access),
-    handler: async (topolo, args) => {
-      const confirm = Boolean(args["confirm"]);
-      const input = { ...args };
-      delete input["confirm"];
-      return topolo.client.callAction(action.actionId, input, { confirm });
-    }
-  }));
-}
-function toolNameForAction(action) {
-  const service = (action.appSlug || action.appId || "service").replace(/^topolo-/, "").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
-  const name = action.name.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
-  return ["topolo", service, name].filter(Boolean).join("_").slice(0, 96);
-}
-function actionInputSchema(action, access = "auto") {
-  const schema = {
-    type: "object",
-    properties: {},
-    additionalProperties: false,
-    ...action.inputSchema
-  };
-  const properties = schema.properties && typeof schema.properties === "object" && !Array.isArray(schema.properties) ? { ...schema.properties } : {};
-  if (access === "confirm") {
-    properties.confirm = {
-      type: "boolean",
-      description: "Required for mutating actions. Explicit human-in-the-loop acknowledgement."
-    };
-  }
-  return {
-    ...schema,
-    type: "object",
-    properties,
-    additionalProperties: schema.additionalProperties ?? false
-  };
+  void topolo;
+  return filterToolsByScopes(tools, scopes);
 }
 function evaluateApplicationAuditGate(report, threshold) {
   const counts = {