@topolo/mcp 0.8.0 → 0.9.0

package/dist/index.js

@@ -3,7 +3,7 @@
 // src/index.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
-// ../topolo-sdk/dist/index.js
+// ../../../topolo-platform/packages/topolo-sdk/dist/index.js
 function applyAuthHeaders(headers, credential) {
   if (credential.kind === "api_key") {
     headers.set("X-Api-Key", credential.apiKey);
@@ -3369,7 +3369,7 @@ function createTopolo(options) {
   };
 }
 
-// ../topolo-sdk/dist/node/credential-store.js
+// ../../../topolo-platform/packages/topolo-sdk/dist/node/credential-store.js
 import { mkdir, readFile, writeFile, chmod } from "fs/promises";
 import { existsSync } from "fs";
 import { homedir, platform } from "os";
@@ -3699,6 +3699,46 @@ async function refreshCredentialIfNeeded(environment = selectedEnvironment(), op
     return cred;
   }
 }
+async function refreshContextCredentialIfNeeded(environment, key, options = {}) {
+  const config = await readConfig();
+  const profile = profileForEnvironment(config, environment);
+  const context = profile.contexts?.[key];
+  const credential = context?.credential;
+  if (!credential || credential.kind !== "access_token") return credential ?? null;
+  const oauthClientId = context.oauthClientId ?? profile.oauthClientId;
+  if (!credential.refreshToken || !credential.expiresAt || !oauthClientId) return credential;
+  const now = Math.floor(Date.now() / 1e3);
+  if (!options.force && credential.expiresAt - REFRESH_SKEW_SECONDS > now) return credential;
+  try {
+    const oauth = new TopoloOAuth({
+      serviceUrls: resolveServiceUrls(profile.serviceUrls, environment)
+    });
+    const tokens = await oauth.refreshToken({
+      clientId: oauthClientId,
+      refreshToken: credential.refreshToken
+    });
+    const refreshed = {
+      kind: "access_token",
+      accessToken: tokens.access_token,
+      ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: credential.refreshToken },
+      expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
+    };
+    await writeConfig(writeProfileConfig(config, environment, {
+      ...profile.activeContext === key ? { credential: refreshed } : {},
+      contexts: {
+        ...profile.contexts ?? {},
+        [key]: {
+          ...context,
+          credential: refreshed,
+          oauthClientId
+        }
+      }
+    }));
+    return refreshed;
+  } catch {
+    return credential;
+  }
+}
 function resolveAgentName(configAgentName) {
   return process.env.TOPOLO_AGENT_NAME ?? configAgentName;
 }
@@ -3721,15 +3761,6 @@ function resolveServiceUrls(configUrls, environment = selectedEnvironment()) {
   return Object.keys(merged).length > 0 ? merged : void 0;
 }
 
-// src/auth.ts
-function resolveCredentialFromEnv() {
-  const apiKey = process.env.TOPOLO_API_KEY;
-  if (apiKey) return { kind: "api_key", apiKey };
-  const accessToken = process.env.TOPOLO_ACCESS_TOKEN;
-  if (accessToken) return { kind: "access_token", accessToken };
-  return null;
-}
-
 // src/server.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import {
@@ -4444,14 +4475,79 @@ function toolError(message) {
   };
 }
 
+// src/auth.ts
+function resolveCredentialFromEnv() {
+  const apiKey = process.env.TOPOLO_API_KEY;
+  if (apiKey) return { kind: "api_key", apiKey };
+  const accessToken = process.env.TOPOLO_ACCESS_TOKEN;
+  if (accessToken) return { kind: "access_token", accessToken };
+  return null;
+}
+
+// src/context-credential.ts
+var DEFAULT_DEPENDENCIES = {
+  readConfig,
+  refreshContextCredentialIfNeeded,
+  refreshCredentialIfNeeded,
+  resolveCredentialFromEnv
+};
+function resolvePinnedContextKey(profile, selector) {
+  const normalized = selector.trim().toLowerCase();
+  if (!normalized) {
+    throw new Error("TOPOLO_CONTEXT must not be empty");
+  }
+  const contexts = Object.entries(profile.contexts ?? {});
+  const exact = contexts.find(([key]) => key.toLowerCase() === normalized);
+  if (exact) return exact[0];
+  const matches = contexts.filter(([, context]) => [
+    context.organizationId,
+    context.organizationSlug,
+    context.organizationName
+  ].some((value) => String(value || "").trim().toLowerCase() === normalized));
+  if (matches.length === 1) return matches[0][0];
+  if (matches.length > 1) {
+    throw new Error(`TOPOLO_CONTEXT "${selector}" is ambiguous; use an exact context key`);
+  }
+  throw new Error(`TOPOLO_CONTEXT "${selector}" is not signed in for this environment`);
+}
+async function resolveMcpCredential(environment, selector = process.env.TOPOLO_CONTEXT, dependencies = DEFAULT_DEPENDENCIES) {
+  const environmentCredential = dependencies.resolveCredentialFromEnv();
+  const requestedSelector = selector?.trim();
+  if (environmentCredential) {
+    if (requestedSelector) {
+      throw new Error("TOPOLO_CONTEXT cannot be combined with an environment credential");
+    }
+    return { credential: environmentCredential, contextKey: null };
+  }
+  if (requestedSelector) {
+    const config = await dependencies.readConfig();
+    const contextKey = resolvePinnedContextKey(
+      profileForEnvironment(config, environment),
+      requestedSelector
+    );
+    const credential = await dependencies.refreshContextCredentialIfNeeded(environment, contextKey);
+    return {
+      credential,
+      contextKey,
+      refreshCredential: () => dependencies.refreshContextCredentialIfNeeded(
+        environment,
+        contextKey,
+        { force: true }
+      )
+    };
+  }
+  return {
+    credential: await dependencies.refreshCredentialIfNeeded(environment),
+    contextKey: null,
+    refreshCredential: () => dependencies.refreshCredentialIfNeeded(environment, { force: true })
+  };
+}
+
 // src/index.ts
 async function main() {
   const environment = normalizeEnvironment(process.env.TOPOLO_ENV);
-  const environmentCredential = resolveCredentialFromEnv();
-  let credential = environmentCredential;
-  if (!credential) {
-    credential = await refreshCredentialIfNeeded(environment);
-  }
+  const resolvedCredential = await resolveMcpCredential(environment);
+  const credential = resolvedCredential.credential;
   if (!credential) {
     process.stderr.write(
       "TopoloMCP: no Topolo credential. Run `topolo auth login`, or set TOPOLO_API_KEY / TOPOLO_ACCESS_TOKEN.\n"
@@ -4471,7 +4567,7 @@ async function main() {
     },
     serviceUrls,
     requireConfirmForWrites: true,
-    ...!environmentCredential ? { refreshCredential: () => refreshCredentialIfNeeded(environment, { force: true }) } : {}
+    ...resolvedCredential.refreshCredential ? { refreshCredential: resolvedCredential.refreshCredential } : {}
   });
   const scopes = await loadScopes(topolo);
   const server = buildServer(topolo, scopes);
@@ -4479,7 +4575,7 @@ async function main() {
   await server.connect(transport);
   const toolNames = await advertisedToolNames(topolo, scopes);
   process.stderr.write(
-    `TopoloMCP v${MCP_VERSION} connected (${environment}). Tools available: ${toolNames.join(", ") || "(none)"}
+    `TopoloMCP v${MCP_VERSION} connected (${environment}${resolvedCredential.contextKey ? `, ${resolvedCredential.contextKey}` : ""}). Tools available: ${toolNames.join(", ") || "(none)"}
 `
   );
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topolo/mcp",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Model Context Protocol server for the Topolo platform. Exposes scope-gated tools that third-party agents (Claude, Codex, etc.) can call natively.",
   "type": "module",
   "bin": {