@topolo/mcp 0.7.0 → 0.7.2

package/README.md

@@ -201,10 +201,33 @@ npx @modelcontextprotocol/inspector node dist/index.js
 
 ## Release Flow
 
-Preferred flow: push a `v<x.y.z>` tag to `main`; GitHub Actions typechecks,
-tests, builds, verifies the tag matches `package.json`, and publishes to npm via
-the `NPM_TOKEN` secret. Operators may publish directly with an npm token only
-after running the same package checks and `npm pack --dry-run`.
+Agent packages are released locally from the `staging` branch after its package
+gates pass. Publish in dependency order (`@topolo/sdk`, `@topolo/cli`, then
+`@topolo/mcp`) so every public dependency already exists in the registry.
+
+For each package, run its tests, typecheck, build, and tarball verification:
+
+```bash
+pnpm --dir packages/topolo-mcp test
+pnpm --dir packages/topolo-mcp typecheck
+pnpm --dir packages/topolo-mcp build
+node tooling/verify-npm-package.mjs packages/topolo-mcp
+```
+
+The npm token is stored in the macOS Keychain under `registry.npmjs.org`. Use a
+temporary npm config so the token is never written into the repository or
+printed:
+
+```bash
+printf '//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}\n' > /tmp/topolo-release.npmrc
+NODE_AUTH_TOKEN="$(security find-generic-password -s registry.npmjs.org -w)" \
+  NPM_CONFIG_USERCONFIG=/tmp/topolo-release.npmrc \
+  sh -c 'cd packages/topolo-mcp && npm publish --access public'
+```
+
+After publishing, install exact versions into an empty temporary directory and
+exercise the SDK exports, CLI version command, MCP exports, and `topolo-mcp`
+executable before updating `topoloPublishedVersion`.
 
 ## Phase 2 (planned)
 

package/dist/dispatch.js

@@ -79,7 +79,7 @@ var TOOLS = [
   {
     name: "topolo_search_applications",
     title: "Search Topolo applications the agent can reach",
-    description: "Searches the credential-scoped application registry with a bounded page and continuation cursor. Returns granted permissions, API URL, and launch URL without loading the global platform catalog.",
+    description: "Searches the credential-scoped application registry with a bounded page and continuation cursor. Returns actionService as the canonical selector for topolo_search_actions, plus granted permissions, API URL, and launch URL without loading the global platform catalog.",
     requiredScopes: [],
     destructive: false,
     inputSchema: {
@@ -102,6 +102,7 @@ var TOOLS = [
         return {
           id,
           appId: entry.appId,
+          actionService: entry.appId,
           slug: entry.slug,
           name: entry.name,
           apiBaseUrl: entry.apiBaseUrl,
@@ -128,7 +129,7 @@ var TOOLS = [
       properties: {
         service: {
           type: "string",
-          description: "Required app id, slug, or name."
+          description: "Required application selector. Prefer actionService from topolo_search_applications; canonical app id, slug, and name are also accepted."
         },
         query: { type: "string" },
         cursor: { type: "string" },
@@ -215,13 +216,8 @@ var TOOLS = [
       if (input !== void 0 && (!input || typeof input !== "object" || Array.isArray(input))) {
         throw new Error("input must be an object.");
       }
-      const action = await topolo.client.getAction(actionId);
-      const agentAccess = action.agentAccess ?? (action.destructive ? "off" : action.readOnly && !action.requiresConfirmation ? "auto" : "confirm");
-      if (action.method !== "GET" || !action.readOnly || action.destructive || action.requiresConfirmation || agentAccess !== "auto") {
-        throw new Error(`Action "${actionId}" is not an automatic read-only action. Use topolo_call_action with confirmation.`);
-      }
       const resource = optionalResourceContext(args);
-      return topolo.client.callAction(
+      return topolo.client.readAction(
         actionId,
         input ?? {},
         resource ? { resource } : {}

package/dist/http.js

@@ -15887,7 +15887,7 @@ var TOOLS = [
   {
     name: "topolo_search_applications",
     title: "Search Topolo applications the agent can reach",
-    description: "Searches the credential-scoped application registry with a bounded page and continuation cursor. Returns granted permissions, API URL, and launch URL without loading the global platform catalog.",
+    description: "Searches the credential-scoped application registry with a bounded page and continuation cursor. Returns actionService as the canonical selector for topolo_search_actions, plus granted permissions, API URL, and launch URL without loading the global platform catalog.",
     requiredScopes: [],
     destructive: false,
     inputSchema: {
@@ -15910,6 +15910,7 @@ var TOOLS = [
         return {
           id,
           appId: entry.appId,
+          actionService: entry.appId,
           slug: entry.slug,
           name: entry.name,
           apiBaseUrl: entry.apiBaseUrl,
@@ -15936,7 +15937,7 @@ var TOOLS = [
       properties: {
         service: {
           type: "string",
-          description: "Required app id, slug, or name."
+          description: "Required application selector. Prefer actionService from topolo_search_applications; canonical app id, slug, and name are also accepted."
         },
         query: { type: "string" },
         cursor: { type: "string" },
@@ -16023,13 +16024,8 @@ var TOOLS = [
       if (input !== void 0 && (!input || typeof input !== "object" || Array.isArray(input))) {
         throw new Error("input must be an object.");
       }
-      const action = await topolo.client.getAction(actionId);
-      const agentAccess = action.agentAccess ?? (action.destructive ? "off" : action.readOnly && !action.requiresConfirmation ? "auto" : "confirm");
-      if (action.method !== "GET" || !action.readOnly || action.destructive || action.requiresConfirmation || agentAccess !== "auto") {
-        throw new Error(`Action "${actionId}" is not an automatic read-only action. Use topolo_call_action with confirmation.`);
-      }
       const resource = optionalResourceContext(args);
-      return topolo.client.callAction(
+      return topolo.client.readAction(
         actionId,
         input ?? {},
         resource ? { resource } : {}

package/dist/index.js

@@ -72,6 +72,7 @@ var APP_API_URLS = {
   bugfix: "https://bugfix.topolo.app",
   bytes: "https://bytes.topolo.app",
   calendar: "https://calendar.topolo.app",
+  campaigns: "https://campaigns.topolo.app",
   capacity: "https://capacity.topolo.app",
   chat: "https://chat.topolo.app",
   commerce: "https://commerce.topolo.app",
@@ -330,6 +331,38 @@ var APPLICATIONS = {
       }
     ]
   },
+  "campaigns": {
+    "id": "campaigns",
+    "appDir": "TopoloCampaigns",
+    "name": "topolo-campaigns",
+    "packageName": "topolo-campaigns",
+    "productionUrl": "https://campaigns.topolo.app",
+    "services": [
+      "campaigns"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-campaigns",
+        "kind": "worker",
+        "apiUrl": "https://campaigns.topolo.app",
+        "domains": [
+          "campaigns.topolo.app"
+        ],
+        "routes": [
+          "campaigns.topolo.app"
+        ],
+        "appId": "campaigns"
+      },
+      {
+        "name": "topolo-campaigns-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
   "capacity": {
     "id": "capacity",
     "appDir": "TopoloCapacity",
@@ -2504,7 +2537,21 @@ var TopoloClient = class _TopoloClient {
     return match;
   }
   async callAction(action, input = {}, options = {}) {
+    const entry = await this.getAction(action);
+    return this.executeResolvedAction(entry, input, options);
+  }
+  async readAction(action, input = {}, options = {}) {
     const entry = await this.getAction(action);
+    const agentAccess = entry.agentAccess ?? (entry.destructive ? "off" : entry.readOnly && !entry.requiresConfirmation ? "auto" : "confirm");
+    if (entry.method !== "GET" || !entry.readOnly || entry.destructive || entry.requiresConfirmation || agentAccess !== "auto") {
+      throw new TopoloPermissionError(
+        `Topolo action "${entry.actionId}" is not an automatic read-only action.`,
+        entry.requiredPermission ? [entry.requiredPermission] : []
+      );
+    }
+    return this.executeResolvedAction(entry, input, options);
+  }
+  async executeResolvedAction(entry, input, options) {
     const agentAccess = entry.agentAccess ?? (entry.destructive ? "off" : entry.readOnly && !entry.requiresConfirmation ? "auto" : "confirm");
     if (agentAccess === "off") {
       throw new TopoloPermissionError(
@@ -2576,6 +2623,7 @@ var TopoloClient = class _TopoloClient {
     const kind = payload.credentialType === "api_key" ? "api_key" : "access_token";
     return {
       kind,
+      authorizationMode: normalizeCredentialAuthorizationMode(payload.authorizationMode, kind),
       user: {
         id: user.id,
         email: user.email,
@@ -2838,6 +2886,11 @@ function objectToQuery(value) {
   }
   return Object.keys(query).length > 0 ? query : void 0;
 }
+function normalizeCredentialAuthorizationMode(value, kind) {
+  if (kind === "api_key") return "api_key";
+  if (value === "context_rbac" || value === "oauth_scopes" || value === "session_rbac") return value;
+  return "unknown";
+}
 function describeError(body, fallback) {
   if (body && typeof body === "object") {
     const maybe = body;
@@ -2980,6 +3033,7 @@ var APP_API_URLS2 = {
   bugfix: "https://bugfix.topolo.app",
   bytes: "https://bytes.topolo.app",
   calendar: "https://calendar.topolo.app",
+  campaigns: "https://campaigns.topolo.app",
   capacity: "https://capacity.topolo.app",
   chat: "https://chat.topolo.app",
   commerce: "https://commerce.topolo.app",
@@ -3372,7 +3426,7 @@ var TOOLS = [
   {
     name: "topolo_search_applications",
     title: "Search Topolo applications the agent can reach",
-    description: "Searches the credential-scoped application registry with a bounded page and continuation cursor. Returns granted permissions, API URL, and launch URL without loading the global platform catalog.",
+    description: "Searches the credential-scoped application registry with a bounded page and continuation cursor. Returns actionService as the canonical selector for topolo_search_actions, plus granted permissions, API URL, and launch URL without loading the global platform catalog.",
     requiredScopes: [],
     destructive: false,
     inputSchema: {
@@ -3395,6 +3449,7 @@ var TOOLS = [
         return {
           id,
           appId: entry.appId,
+          actionService: entry.appId,
           slug: entry.slug,
           name: entry.name,
           apiBaseUrl: entry.apiBaseUrl,
@@ -3421,7 +3476,7 @@ var TOOLS = [
       properties: {
         service: {
           type: "string",
-          description: "Required app id, slug, or name."
+          description: "Required application selector. Prefer actionService from topolo_search_applications; canonical app id, slug, and name are also accepted."
         },
         query: { type: "string" },
         cursor: { type: "string" },
@@ -3508,13 +3563,8 @@ var TOOLS = [
       if (input !== void 0 && (!input || typeof input !== "object" || Array.isArray(input))) {
         throw new Error("input must be an object.");
       }
-      const action = await topolo.client.getAction(actionId);
-      const agentAccess = action.agentAccess ?? (action.destructive ? "off" : action.readOnly && !action.requiresConfirmation ? "auto" : "confirm");
-      if (action.method !== "GET" || !action.readOnly || action.destructive || action.requiresConfirmation || agentAccess !== "auto") {
-        throw new Error(`Action "${actionId}" is not an automatic read-only action. Use topolo_call_action with confirmation.`);
-      }
       const resource = optionalResourceContext(args);
-      return topolo.client.callAction(
+      return topolo.client.readAction(
         actionId,
         input ?? {},
         resource ? { resource } : {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topolo/mcp",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "Model Context Protocol server for the Topolo platform. Exposes scope-gated tools that third-party agents (Claude, Codex, etc.) can call natively.",
   "type": "module",
   "bin": {
@@ -36,7 +36,7 @@
     "@modelcontextprotocol/sdk": "^1.0.0"
   },
   "peerDependencies": {
-    "@topolo/sdk": "^0.8.1"
+    "@topolo/sdk": "^0.8.3"
   },
   "devDependencies": {
     "@topolo/sdk": "file:../topolo-sdk",