@topolo/mcp 0.9.10 → 0.10.0

package/README.md

@@ -153,6 +153,10 @@ deletion, encryption, and audit storage for the data they own.
 | `topolo_get_action`          | (credential-scoped)   | no               |
 | `topolo_read_action`         | catalog or target policy | no            |
 | `topolo_call_action`         | catalog or target policy | yes           |
+| `topolo_list_workspaces`     | target app runtime policy | no            |
+| `topolo_create_workspace`    | target app runtime policy | yes           |
+| `topolo_rename_workspace`    | target app runtime policy | yes           |
+| `topolo_set_default_workspace` | target app runtime policy | yes         |
 | `topolo_api_call`            | (service-enforced)    | yes              |
 
 Applications publish machine-action definitions through Topolo Developers.
@@ -171,6 +175,12 @@ capability without inventing a global permission, and the target service checks
 the current database-backed policy for the supplied organization/application on
 every call.
 
+Workspace lifecycle is first-class so agents do not have to know that Auth is
+the canonical owner. The tools accept the target application, derive the
+organization from the credential, and retain Auth's per-app runtime decision.
+`topolo_list_workspaces` exposes `policy.canCreate` and `policy.reason`; the
+write tools never infer access from organization ownership.
+
 `topolo_api_call` is the escape hatch for endpoints without typed MCP tools
 yet. GET requests work without confirmation; mutating HTTP methods must pass
 `confirm: true` or the SDK rejects the call. Backing services still enforce

package/dist/dispatch.js

@@ -5,11 +5,12 @@ import { TopoloAuthError, TopoloPermissionError } from "@topolo/sdk";
 import {
   APPLICATION_REQUIREMENTS,
   APPLICATION_REQUIREMENTS_VERSION,
-  APPLICATIONS,
-  DEFAULT_APP_URLS,
-  auditAllApplicationRequirements,
+  auditApplicationEntries,
   applicationRequirementScopes,
+  friendlyAppId,
+  listApplicationDirectory,
   requirementsForApplication,
+  resolveApplicationDirectoryEntry,
   resolveCatalogServiceUrl
 } from "@topolo/sdk";
 
@@ -62,8 +63,12 @@ function publicMcpErrorMessage(error, fallback) {
 }
 
 // src/tools.ts
-var APPLICATION_IDS = Object.keys(APPLICATIONS).sort();
 var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
+function requiredString(args, name) {
+  const value = typeof args[name] === "string" ? args[name].trim() : "";
+  if (!value) throw new TopoloMcpPublicError(`${name} is required.`);
+  return value;
+}
 function optionalResourceContext(args) {
   const resourceType = typeof args["resourceType"] === "string" ? args["resourceType"].trim() : "";
   const resourceId = typeof args["resourceId"] === "string" ? args["resourceId"].trim() : "";
@@ -463,6 +468,78 @@ var TOOLS = [
       return topolo.client.listBindableResources(application);
     }
   },
+  {
+    name: "topolo_list_workspaces",
+    title: "List workspaces for one Topolo application",
+    description: "Lists caller-visible workspaces and the caller-specific creation policy for one target application. Use this before creating a workspace; organization ownership alone does not imply creation rights for every app.",
+    requiredScopes: [],
+    destructive: false,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 } },
+      required: ["application"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => {
+      const application = requiredString(args, "application");
+      return topolo.workspaces.list(application);
+    }
+  },
+  {
+    name: "topolo_create_workspace",
+    title: "Create a workspace for one Topolo application",
+    description: "Creates a workspace only after reading the target application policy and confirming it permits this caller. The canonical Auth runtime still authorizes the concrete app and organization. Set confirm:true only after approval.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, name: { type: "string", minLength: 1, maxLength: 120 }, isDefault: { type: "boolean" }, confirm: { type: "boolean" } },
+      required: ["application", "name"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.create(requiredString(args, "application"), {
+      name: requiredString(args, "name"),
+      ...typeof args["isDefault"] === "boolean" ? { isDefault: args["isDefault"] } : {},
+      confirm: args["confirm"] === true
+    })
+  },
+  {
+    name: "topolo_rename_workspace",
+    title: "Rename one Topolo application workspace",
+    description: "Renames a caller-authorized workspace without changing its stable id, slug, ownership, membership, or app data.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, workspaceId: { type: "string", minLength: 1 }, name: { type: "string", minLength: 1, maxLength: 120 }, confirm: { type: "boolean" } },
+      required: ["application", "workspaceId", "name"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.rename(
+      requiredString(args, "application"),
+      requiredString(args, "workspaceId"),
+      requiredString(args, "name"),
+      args["confirm"] === true
+    )
+  },
+  {
+    name: "topolo_set_default_workspace",
+    title: "Set an application default workspace",
+    description: "Sets exactly one caller-authorized workspace as the default for the target application and current organization.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, workspaceId: { type: "string", minLength: 1 }, confirm: { type: "boolean" } },
+      required: ["application", "workspaceId"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.setDefault(
+      requiredString(args, "application"),
+      requiredString(args, "workspaceId"),
+      args["confirm"] === true
+    )
+  },
   {
     name: "topolo_list_application_requirements",
     title: "List Topolo application build requirements",
@@ -479,7 +556,7 @@ var TOOLS = [
       },
       additionalProperties: false
     },
-    handler: async (_topolo, args) => {
+    handler: async (topolo, args) => {
       const application = args["application"];
       if (application === void 0) {
         return {
@@ -489,12 +566,8 @@ var TOOLS = [
           requirements: APPLICATION_REQUIREMENTS
         };
       }
-      if (typeof application !== "string" || !APPLICATION_IDS.includes(application)) {
-        throw new TopoloMcpPublicError(
-          `Unknown application "${String(application)}". ${formatKnownValues(APPLICATION_IDS, "applications")}`
-        );
-      }
-      const app = APPLICATIONS[application];
+      const resolved = await resolveDirectoryApplication(topolo, application);
+      const app = resolved.application;
       return {
         version: APPLICATION_REQUIREMENTS_VERSION,
         application: app,
@@ -524,7 +597,7 @@ var TOOLS = [
       },
       additionalProperties: false
     },
-    handler: async (_topolo, args) => {
+    handler: async (topolo, args) => {
       const application = args["application"];
       const failOn = args["failOn"];
       if (failOn !== void 0 && typeof failOn !== "string") {
@@ -533,15 +606,12 @@ var TOOLS = [
       const gate = failOn ? normalizeFailOn(failOn) : null;
       let report;
       if (application === void 0) {
-        report = auditAllApplicationRequirements();
+        const directory = await listApplicationDirectory(topolo.client);
+        report = auditApplicationEntries(directory.applications.map((app) => app.application));
         return gate ? { ...report, conformanceGate: evaluateApplicationAuditGate(report, gate) } : report;
       }
-      if (typeof application !== "string" || !APPLICATION_IDS.includes(application)) {
-        throw new TopoloMcpPublicError(
-          `Unknown application "${String(application)}". ${formatKnownValues(APPLICATION_IDS, "applications")}`
-        );
-      }
-      report = auditAllApplicationRequirements([application]);
+      const resolved = await resolveDirectoryApplication(topolo, application);
+      report = auditApplicationEntries([resolved.application]);
       return gate ? { ...report, conformanceGate: evaluateApplicationAuditGate(report, gate) } : report;
     }
   },
@@ -681,31 +751,19 @@ function statusesAtOrWorse(threshold) {
   return ["missing", "needs_review", "partial"];
 }
 function displayAppId(entry) {
-  for (const value of [entry.slug, entry.name, entry.appId]) {
-    if (typeof value !== "string" || !value.trim()) continue;
-    for (const candidate of appIdCandidates(value)) {
-      if (Object.prototype.hasOwnProperty.call(DEFAULT_APP_URLS, candidate)) {
-        return candidate;
-      }
-    }
-  }
-  return appIdCandidates(entry.slug || entry.appId)[0] || entry.appId;
-}
-function appIdCandidates(value) {
-  const normalized = value.trim().toLowerCase().replace(/\s+/g, "-");
-  const withoutTopolo = normalized.startsWith("topolo-") ? normalized.slice("topolo-".length) : normalized;
-  return [.../* @__PURE__ */ new Set([
-    normalized,
-    normalized.replace(/-/g, "_"),
-    withoutTopolo,
-    withoutTopolo.replace(/-/g, "_")
-  ])].filter(Boolean);
+  return friendlyAppId(entry);
 }
-function formatKnownValues(values, label) {
-  const sorted = [...values].sort();
-  const preview = sorted.slice(0, 25).join(", ");
-  const suffix = sorted.length > 25 ? `, ... +${sorted.length - 25} more` : "";
-  return `Run discovery for the full ${label} list. Known snapshot sample: ${preview}${suffix}`;
+async function resolveDirectoryApplication(topolo, application) {
+  if (typeof application !== "string" || !application.trim()) {
+    throw new TopoloMcpPublicError("`application` must be a non-empty string.");
+  }
+  try {
+    return await resolveApplicationDirectoryEntry(topolo.client, application);
+  } catch (error) {
+    throw new TopoloMcpPublicError(
+      error instanceof Error ? error.message : `Unknown application "${application}".`
+    );
+  }
 }
 
 // src/dispatch.ts

package/dist/http.js

@@ -15830,11 +15830,12 @@ import { TopoloAuthError, TopoloHttpError, TopoloPermissionError } from "@topolo
 import {
   APPLICATION_REQUIREMENTS,
   APPLICATION_REQUIREMENTS_VERSION,
-  APPLICATIONS,
-  DEFAULT_APP_URLS,
-  auditAllApplicationRequirements,
+  auditApplicationEntries,
   applicationRequirementScopes,
+  friendlyAppId,
+  listApplicationDirectory,
   requirementsForApplication,
+  resolveApplicationDirectoryEntry,
   resolveCatalogServiceUrl
 } from "@topolo/sdk";
 
@@ -15876,8 +15877,12 @@ function splitService(servicePart) {
 }
 
 // src/tools.ts
-var APPLICATION_IDS = Object.keys(APPLICATIONS).sort();
 var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
+function requiredString(args, name) {
+  const value = typeof args[name] === "string" ? args[name].trim() : "";
+  if (!value) throw new TopoloMcpPublicError(`${name} is required.`);
+  return value;
+}
 function optionalResourceContext(args) {
   const resourceType = typeof args["resourceType"] === "string" ? args["resourceType"].trim() : "";
   const resourceId = typeof args["resourceId"] === "string" ? args["resourceId"].trim() : "";
@@ -16277,6 +16282,78 @@ var TOOLS = [
       return topolo.client.listBindableResources(application);
     }
   },
+  {
+    name: "topolo_list_workspaces",
+    title: "List workspaces for one Topolo application",
+    description: "Lists caller-visible workspaces and the caller-specific creation policy for one target application. Use this before creating a workspace; organization ownership alone does not imply creation rights for every app.",
+    requiredScopes: [],
+    destructive: false,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 } },
+      required: ["application"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => {
+      const application = requiredString(args, "application");
+      return topolo.workspaces.list(application);
+    }
+  },
+  {
+    name: "topolo_create_workspace",
+    title: "Create a workspace for one Topolo application",
+    description: "Creates a workspace only after reading the target application policy and confirming it permits this caller. The canonical Auth runtime still authorizes the concrete app and organization. Set confirm:true only after approval.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, name: { type: "string", minLength: 1, maxLength: 120 }, isDefault: { type: "boolean" }, confirm: { type: "boolean" } },
+      required: ["application", "name"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.create(requiredString(args, "application"), {
+      name: requiredString(args, "name"),
+      ...typeof args["isDefault"] === "boolean" ? { isDefault: args["isDefault"] } : {},
+      confirm: args["confirm"] === true
+    })
+  },
+  {
+    name: "topolo_rename_workspace",
+    title: "Rename one Topolo application workspace",
+    description: "Renames a caller-authorized workspace without changing its stable id, slug, ownership, membership, or app data.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, workspaceId: { type: "string", minLength: 1 }, name: { type: "string", minLength: 1, maxLength: 120 }, confirm: { type: "boolean" } },
+      required: ["application", "workspaceId", "name"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.rename(
+      requiredString(args, "application"),
+      requiredString(args, "workspaceId"),
+      requiredString(args, "name"),
+      args["confirm"] === true
+    )
+  },
+  {
+    name: "topolo_set_default_workspace",
+    title: "Set an application default workspace",
+    description: "Sets exactly one caller-authorized workspace as the default for the target application and current organization.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, workspaceId: { type: "string", minLength: 1 }, confirm: { type: "boolean" } },
+      required: ["application", "workspaceId"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.setDefault(
+      requiredString(args, "application"),
+      requiredString(args, "workspaceId"),
+      args["confirm"] === true
+    )
+  },
   {
     name: "topolo_list_application_requirements",
     title: "List Topolo application build requirements",
@@ -16293,7 +16370,7 @@ var TOOLS = [
       },
       additionalProperties: false
     },
-    handler: async (_topolo, args) => {
+    handler: async (topolo, args) => {
       const application = args["application"];
       if (application === void 0) {
         return {
@@ -16303,12 +16380,8 @@ var TOOLS = [
           requirements: APPLICATION_REQUIREMENTS
         };
       }
-      if (typeof application !== "string" || !APPLICATION_IDS.includes(application)) {
-        throw new TopoloMcpPublicError(
-          `Unknown application "${String(application)}". ${formatKnownValues(APPLICATION_IDS, "applications")}`
-        );
-      }
-      const app = APPLICATIONS[application];
+      const resolved = await resolveDirectoryApplication(topolo, application);
+      const app = resolved.application;
       return {
         version: APPLICATION_REQUIREMENTS_VERSION,
         application: app,
@@ -16338,7 +16411,7 @@ var TOOLS = [
       },
       additionalProperties: false
     },
-    handler: async (_topolo, args) => {
+    handler: async (topolo, args) => {
       const application = args["application"];
       const failOn = args["failOn"];
       if (failOn !== void 0 && typeof failOn !== "string") {
@@ -16347,15 +16420,12 @@ var TOOLS = [
       const gate = failOn ? normalizeFailOn(failOn) : null;
       let report;
       if (application === void 0) {
-        report = auditAllApplicationRequirements();
+        const directory = await listApplicationDirectory(topolo.client);
+        report = auditApplicationEntries(directory.applications.map((app) => app.application));
         return gate ? { ...report, conformanceGate: evaluateApplicationAuditGate(report, gate) } : report;
       }
-      if (typeof application !== "string" || !APPLICATION_IDS.includes(application)) {
-        throw new TopoloMcpPublicError(
-          `Unknown application "${String(application)}". ${formatKnownValues(APPLICATION_IDS, "applications")}`
-        );
-      }
-      report = auditAllApplicationRequirements([application]);
+      const resolved = await resolveDirectoryApplication(topolo, application);
+      report = auditApplicationEntries([resolved.application]);
       return gate ? { ...report, conformanceGate: evaluateApplicationAuditGate(report, gate) } : report;
     }
   },
@@ -16495,31 +16565,19 @@ function statusesAtOrWorse(threshold) {
   return ["missing", "needs_review", "partial"];
 }
 function displayAppId(entry) {
-  for (const value of [entry.slug, entry.name, entry.appId]) {
-    if (typeof value !== "string" || !value.trim()) continue;
-    for (const candidate of appIdCandidates(value)) {
-      if (Object.prototype.hasOwnProperty.call(DEFAULT_APP_URLS, candidate)) {
-        return candidate;
-      }
-    }
-  }
-  return appIdCandidates(entry.slug || entry.appId)[0] || entry.appId;
-}
-function appIdCandidates(value) {
-  const normalized = value.trim().toLowerCase().replace(/\s+/g, "-");
-  const withoutTopolo = normalized.startsWith("topolo-") ? normalized.slice("topolo-".length) : normalized;
-  return [.../* @__PURE__ */ new Set([
-    normalized,
-    normalized.replace(/-/g, "_"),
-    withoutTopolo,
-    withoutTopolo.replace(/-/g, "_")
-  ])].filter(Boolean);
+  return friendlyAppId(entry);
 }
-function formatKnownValues(values, label) {
-  const sorted = [...values].sort();
-  const preview = sorted.slice(0, 25).join(", ");
-  const suffix = sorted.length > 25 ? `, ... +${sorted.length - 25} more` : "";
-  return `Run discovery for the full ${label} list. Known snapshot sample: ${preview}${suffix}`;
+async function resolveDirectoryApplication(topolo, application) {
+  if (typeof application !== "string" || !application.trim()) {
+    throw new TopoloMcpPublicError("`application` must be a non-empty string.");
+  }
+  try {
+    return await resolveApplicationDirectoryEntry(topolo.client, application);
+  } catch (error2) {
+    throw new TopoloMcpPublicError(
+      error2 instanceof Error ? error2.message : `Unknown application "${application}".`
+    );
+  }
 }
 
 // src/version.ts

package/dist/index.js

@@ -104,57 +104,8 @@ var TopoloHttpError = class extends TopoloSdkError {
   }
 };
 var APP_API_URLS = {
-  agent: "https://agent.topolo.app",
   auth: "https://auth.topolo.app",
-  backup: "https://backup.topolo.app",
-  blog: "https://blog.topolo.app",
-  books: "https://books.topolo.app",
-  brand: "https://brand.topolo.app",
-  bugfix: "https://bugfix.topolo.app",
-  bytes: "https://bytes.topolo.app",
-  calendar: "https://calendar.topolo.app",
-  campaigns: "https://campaigns.topolo.app",
-  capacity: "https://capacity.topolo.app",
-  chat: "https://chat.topolo.app",
-  commerce: "https://commerce.topolo.app",
-  compose: "https://compose.topolo.app",
-  consent: "https://consent.topolo.app",
-  crm: "https://crm.topolo.app",
-  design: "https://design.topolo.app",
-  developers: "https://developers.topolo.app",
-  director: "https://director.topolo.app",
-  feed: "https://feed.topolo.app",
-  flow: "https://flow.topolo.app",
-  forecast: "https://forecast.topolo.app",
-  forms: "https://forms.topolo.app",
-  home: "https://home.topolo.app",
-  insights: "https://insights.topolo.app",
-  inventory: "https://inventory.topolo.app",
-  learn: "https://learn.topolo.app",
-  localize: "https://localize.topolo.app",
-  mail: "https://mail.topolo.app",
-  mdm: "https://mdm.topolo.app",
-  messages: "https://messages.topolo.app",
-  nexus: "https://nexus.topolo.app",
-  notify: "https://notify.topolo.app",
-  observability_watch: "https://observability-watch.topolo.app",
-  one: "https://www.topolo.app",
-  p2p: "https://p2p.topolo.app",
-  pay: "https://pay.topolo.app",
-  people: "https://people.topolo.app",
-  "quro.api": "https://api.ol0.me",
-  "quro.redirect": "https://ol0.me",
-  roadmapper: "https://roadmapper.topolo.app",
-  sign: "https://sign.topolo.app",
-  social_studio: "https://studio.topolo.app",
-  socialize: "https://socialize.topolo.app",
-  spaces: "https://spaces.topolo.app",
-  status: "https://status.topolo.app",
-  success: "https://success.topolo.app",
-  support: "https://support.topolo.app",
-  survey: "https://survey.topolo.app",
-  voice: "https://voice.topolo.app",
-  web: "https://web.topolo.app"
+  developers: "https://developers.topolo.app"
 };
 var APPLICATIONS = {
   "admin": {
@@ -1880,7 +1831,145 @@ var APPLICATIONS = {
     ]
   }
 };
-var APPLICATION_REQUIREMENTS_VERSION = "2026-06-07.1";
+function friendlyAppId(entry) {
+  for (const value of [entry.slug, entry.name, entry.appId]) {
+    if (typeof value !== "string" || !value.trim()) continue;
+    const normalized = value.trim().toLowerCase().replace(/\s+/g, "-");
+    const withoutPrefix = normalized.replace(/^(?:app[_-])?topolo[-_]+/, "");
+    if (withoutPrefix) return withoutPrefix;
+  }
+  return entry.appId;
+}
+function idVariants(value) {
+  const normalized = value.trim().toLowerCase().replace(/\s+/g, "-");
+  return [.../* @__PURE__ */ new Set([
+    normalized,
+    normalized.replace(/-/g, "_"),
+    normalized.replace(/_/g, "-")
+  ])].filter(Boolean);
+}
+var STATIC_APPLICATIONS = APPLICATIONS;
+function staticApplicationForId(id) {
+  for (const variant of idVariants(id)) {
+    const entry = STATIC_APPLICATIONS[variant];
+    if (entry) return entry;
+  }
+  return null;
+}
+function applicationEntryFromCatalog(live) {
+  const id = friendlyAppId(live);
+  return {
+    id,
+    appDir: "-",
+    name: live.name ?? live.slug ?? live.appId,
+    packageName: null,
+    productionUrl: live.launchUrl ?? live.apiBaseUrl ?? null,
+    services: live.apiBaseUrl ? [id] : [],
+    deployTargets: []
+  };
+}
+var DIRECTORY_PAGE_LIMIT = 100;
+var DIRECTORY_MAX_PAGES = 100;
+function staticApplicationDirectory() {
+  const applications = Object.entries(STATIC_APPLICATIONS).map(([id, application]) => ({
+    id,
+    application,
+    source: "static",
+    live: null
+  })).sort((left, right) => left.id.localeCompare(right.id));
+  return { source: "static_fallback", applications };
+}
+function directoryApplicationFromLive(live) {
+  const id = friendlyAppId(live);
+  return {
+    id,
+    // Prefer the static snapshot's richer repo/deploy metadata when the live
+    // registry confirms the app; synthesize from the live entry otherwise.
+    application: staticApplicationForId(id) ?? applicationEntryFromCatalog(live),
+    source: "live",
+    live
+  };
+}
+async function listApplicationDirectory(client) {
+  if (!client) return staticApplicationDirectory();
+  let services;
+  try {
+    services = [];
+    let cursor;
+    for (let page = 0; page < DIRECTORY_MAX_PAGES; page += 1) {
+      const result = await client.searchServices({
+        ...cursor ? { cursor } : {},
+        limit: DIRECTORY_PAGE_LIMIT
+      });
+      services.push(...result.services);
+      if (!result.page.nextCursor) break;
+      cursor = result.page.nextCursor;
+    }
+  } catch {
+    return staticApplicationDirectory();
+  }
+  const seen = /* @__PURE__ */ new Map();
+  for (const live of services) {
+    const entry = directoryApplicationFromLive(live);
+    if (!seen.has(entry.id)) seen.set(entry.id, entry);
+  }
+  return {
+    source: "live",
+    applications: [...seen.values()].sort((left, right) => left.id.localeCompare(right.id))
+  };
+}
+function matchesDirectoryApplication(app, needle) {
+  const candidates = new Set(idVariants(needle));
+  const keys = [
+    app.id,
+    app.application.id,
+    app.application.name,
+    app.live?.appId,
+    app.live?.slug,
+    app.live?.name
+  ];
+  for (const key of keys) {
+    if (typeof key !== "string" || !key.trim()) continue;
+    for (const variant of idVariants(key)) {
+      if (candidates.has(variant)) return true;
+    }
+    for (const variant of idVariants(friendlyAppId({ appId: key }))) {
+      if (candidates.has(variant)) return true;
+    }
+  }
+  return false;
+}
+function formatDirectoryApplicationIds(directory) {
+  const ids = directory.applications.map((app) => app.id).sort();
+  const preview = ids.slice(0, 50).join(", ");
+  const suffix = ids.length > 50 ? `, ... +${ids.length - 50} more` : "";
+  const label = directory.source === "live" ? "Applications available to this credential" : "Applications in the bundled static snapshot (live registry unreachable)";
+  return `${label}: ${preview}${suffix}`;
+}
+async function resolveApplicationDirectoryEntry(client, application) {
+  const needle = typeof application === "string" ? application.trim() : "";
+  if (!needle) {
+    throw new TopoloSdkError("unknown_application", "application is required");
+  }
+  if (client) {
+    let live = null;
+    try {
+      live = await client.getService(needle);
+    } catch {
+      live = null;
+    }
+    if (live) return directoryApplicationFromLive(live);
+  }
+  const directory = await listApplicationDirectory(client);
+  const match = directory.applications.find((app) => matchesDirectoryApplication(app, needle));
+  if (match) return match;
+  throw new TopoloSdkError(
+    "unknown_application",
+    `Unknown application "${application}". ${formatDirectoryApplicationIds(directory)}`
+  );
+}
+var STATIC_APPLICATIONS2 = APPLICATIONS;
+var APPLICATION_REQUIREMENTS_VERSION = "2026-08-11.1";
 var APPLICATION_REQUIREMENTS = [
   {
     id: "platform-metadata",
@@ -1890,10 +1979,10 @@ var APPLICATION_REQUIREMENTS = [
     evidence: [
       "topolo.cloudcontrol.json exists for every deployed app surface",
       "package.json names the package or app when the repo ships code",
-      "The SDK application catalog exposes the app through topolo apps and MCP discovery"
+      "The live platform registry exposes the app through topolo apps and MCP discovery"
     ],
     implementation: [
-      "Add the app to the SDK application catalog generator before exposing it to agents",
+      "Register the app in the live platform registry (Auth service catalog) before exposing it to agents",
       "Keep production URLs, Worker names, Pages projects, routes, domains, and bindings current in CloudControl metadata",
       "Do not leave a new Topolo* app directory without an explicit application ID"
     ]
@@ -1968,7 +2057,7 @@ var APPLICATION_REQUIREMENTS = [
     implementation: [
       "Add production Worker api_url metadata and sdk_app_id for every agent-callable API target",
       "Mark browser, documentation, and runtime-only Worker targets with agent_callable:false",
-      "Expose stable app IDs through generated DEFAULT_APP_URLS and live catalog discovery",
+      "Expose stable app IDs through live catalog discovery",
       "Keep typed SDK/CLI/MCP surfaces in sync when an API contract stabilizes"
     ]
   },
@@ -2088,15 +2177,24 @@ function applicationRequirementScopes(application) {
   }
   return Array.from(scopes);
 }
+function fallbackApplication(id) {
+  const entry = STATIC_APPLICATIONS2[id];
+  if (!entry) {
+    throw new Error(
+      `Unknown application "${id}" in the static fallback snapshot. Resolve applications from the live registry (resolveApplicationDirectoryEntry) and pass the entry directly.`
+    );
+  }
+  return entry;
+}
 function requirementsForApplication(applicationOrId) {
-  const application = typeof applicationOrId === "string" ? APPLICATIONS[applicationOrId] : applicationOrId;
+  const application = typeof applicationOrId === "string" ? fallbackApplication(applicationOrId) : applicationOrId;
   const scopes = new Set(applicationRequirementScopes(application));
   return APPLICATION_REQUIREMENTS.filter(
     (requirement) => requirement.appliesTo.some((scope) => scopes.has(scope))
   );
 }
 function auditApplicationRequirements(applicationOrId) {
-  const application = typeof applicationOrId === "string" ? APPLICATIONS[applicationOrId] : applicationOrId;
+  const application = typeof applicationOrId === "string" ? fallbackApplication(applicationOrId) : applicationOrId;
   const scopes = applicationRequirementScopes(application);
   const findings = requirementsForApplication(application).map(
     (requirement) => evaluateRequirement(application, requirement)
@@ -2109,10 +2207,12 @@ function auditApplicationRequirements(applicationOrId) {
     findings
   };
 }
-function auditAllApplicationRequirements(applicationIds = Object.keys(APPLICATIONS).sort()) {
-  const applications = applicationIds.map(
-    (applicationId) => auditApplicationRequirements(applicationId)
+function auditApplicationEntries(applications) {
+  return buildAuditReport(
+    applications.map((application) => auditApplicationRequirements(application))
   );
+}
+function buildAuditReport(applications) {
   const migrationQueue = applications.flatMap(
     (audit) => audit.findings.filter((finding2) => finding2.status !== "met").map((finding2) => ({
       applicationId: audit.application.id,
@@ -3415,8 +3515,9 @@ var TopoloClient = class _TopoloClient {
     });
   }
   /**
-   * Bundled generated registry for tooling that audits platform packaging, not
-   * for deciding what the current credential may use.
+   * @deprecated Static fallback snapshot only. Use `searchServices()` (the
+   * live credential-scoped registry) for anything that decides behavior; this
+   * exists for offline packaging audits when the registry is unreachable.
    */
   listBundledServices() {
     const apps = Object.values(APPLICATIONS);
@@ -3865,11 +3966,71 @@ var IdentityModule = class {
     return this.client.introspect();
   }
 };
+var ACTIONS = {
+  list: "app_topolo_auth.workspaces.list",
+  create: "app_topolo_auth.workspaces.create",
+  rename: "app_topolo_auth.workspaces.rename",
+  setDefault: "app_topolo_auth.workspaces.default.set"
+};
+var WorkspacesModule = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  async list(application) {
+    const context = await this.resolveContext(application);
+    return this.client.callAction(ACTIONS.list, {
+      org_id: context.organizationId,
+      app_id: context.appId
+    });
+  }
+  async create(application, input) {
+    const current = await this.list(application);
+    if (!current.data.policy.canCreate) {
+      throw new TopoloSdkError(
+        "workspace_creation_not_allowed",
+        `Workspace creation is not allowed for ${current.data.appId}: ${current.data.policy.reason}`
+      );
+    }
+    return this.client.callAction(ACTIONS.create, {
+      organizationId: current.data.organizationId,
+      appId: current.data.appId,
+      name: input.name,
+      ...input.isDefault === void 0 ? {} : { isDefault: input.isDefault }
+    }, { confirm: input.confirm === true });
+  }
+  async rename(application, workspaceId, name, confirm = false) {
+    const context = await this.resolveContext(application);
+    return this.client.callAction(ACTIONS.rename, {
+      workspaceId,
+      organizationId: context.organizationId,
+      appId: context.appId,
+      name
+    }, { confirm });
+  }
+  async setDefault(application, workspaceId, confirm = false) {
+    const context = await this.resolveContext(application);
+    return this.client.callAction(ACTIONS.setDefault, {
+      workspaceId,
+      organizationId: context.organizationId,
+      appId: context.appId
+    }, { confirm });
+  }
+  async resolveContext(application) {
+    const identity = await this.client.introspect();
+    if (!identity.organization?.id) {
+      throw new TopoloSdkError("organization_required", "Workspace lifecycle requires an organization-scoped credential.");
+    }
+    const service = await this.client.getService(application);
+    return { organizationId: identity.organization.id, appId: service.appId };
+  }
+};
 function createTopolo(options) {
   const client = new TopoloClient(options);
   return {
     client,
     identity: new IdentityModule(client),
+    workspaces: new WorkspacesModule(client),
     crm: new CrmModule(client)
   };
 }
@@ -3935,57 +4096,8 @@ var TopoloHttpError2 = class extends TopoloSdkError2 {
   }
 };
 var APP_API_URLS2 = {
-  agent: "https://agent.topolo.app",
   auth: "https://auth.topolo.app",
-  backup: "https://backup.topolo.app",
-  blog: "https://blog.topolo.app",
-  books: "https://books.topolo.app",
-  brand: "https://brand.topolo.app",
-  bugfix: "https://bugfix.topolo.app",
-  bytes: "https://bytes.topolo.app",
-  calendar: "https://calendar.topolo.app",
-  campaigns: "https://campaigns.topolo.app",
-  capacity: "https://capacity.topolo.app",
-  chat: "https://chat.topolo.app",
-  commerce: "https://commerce.topolo.app",
-  compose: "https://compose.topolo.app",
-  consent: "https://consent.topolo.app",
-  crm: "https://crm.topolo.app",
-  design: "https://design.topolo.app",
-  developers: "https://developers.topolo.app",
-  director: "https://director.topolo.app",
-  feed: "https://feed.topolo.app",
-  flow: "https://flow.topolo.app",
-  forecast: "https://forecast.topolo.app",
-  forms: "https://forms.topolo.app",
-  home: "https://home.topolo.app",
-  insights: "https://insights.topolo.app",
-  inventory: "https://inventory.topolo.app",
-  learn: "https://learn.topolo.app",
-  localize: "https://localize.topolo.app",
-  mail: "https://mail.topolo.app",
-  mdm: "https://mdm.topolo.app",
-  messages: "https://messages.topolo.app",
-  nexus: "https://nexus.topolo.app",
-  notify: "https://notify.topolo.app",
-  observability_watch: "https://observability-watch.topolo.app",
-  one: "https://www.topolo.app",
-  p2p: "https://p2p.topolo.app",
-  pay: "https://pay.topolo.app",
-  people: "https://people.topolo.app",
-  "quro.api": "https://api.ol0.me",
-  "quro.redirect": "https://ol0.me",
-  roadmapper: "https://roadmapper.topolo.app",
-  sign: "https://sign.topolo.app",
-  social_studio: "https://studio.topolo.app",
-  socialize: "https://socialize.topolo.app",
-  spaces: "https://spaces.topolo.app",
-  status: "https://status.topolo.app",
-  success: "https://success.topolo.app",
-  support: "https://support.topolo.app",
-  survey: "https://survey.topolo.app",
-  voice: "https://voice.topolo.app",
-  web: "https://web.topolo.app"
+  developers: "https://developers.topolo.app"
 };
 var DEFAULT_APP_URLS2 = APP_API_URLS2;
 function resolveServiceUrl2(service, overrides) {
@@ -4352,8 +4464,12 @@ function publicMcpErrorMessage(error, fallback) {
 }
 
 // src/tools.ts
-var APPLICATION_IDS = Object.keys(APPLICATIONS).sort();
 var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
+function requiredString(args, name) {
+  const value = typeof args[name] === "string" ? args[name].trim() : "";
+  if (!value) throw new TopoloMcpPublicError(`${name} is required.`);
+  return value;
+}
 function optionalResourceContext(args) {
   const resourceType = typeof args["resourceType"] === "string" ? args["resourceType"].trim() : "";
   const resourceId = typeof args["resourceId"] === "string" ? args["resourceId"].trim() : "";
@@ -4753,6 +4869,78 @@ var TOOLS = [
       return topolo.client.listBindableResources(application);
     }
   },
+  {
+    name: "topolo_list_workspaces",
+    title: "List workspaces for one Topolo application",
+    description: "Lists caller-visible workspaces and the caller-specific creation policy for one target application. Use this before creating a workspace; organization ownership alone does not imply creation rights for every app.",
+    requiredScopes: [],
+    destructive: false,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 } },
+      required: ["application"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => {
+      const application = requiredString(args, "application");
+      return topolo.workspaces.list(application);
+    }
+  },
+  {
+    name: "topolo_create_workspace",
+    title: "Create a workspace for one Topolo application",
+    description: "Creates a workspace only after reading the target application policy and confirming it permits this caller. The canonical Auth runtime still authorizes the concrete app and organization. Set confirm:true only after approval.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, name: { type: "string", minLength: 1, maxLength: 120 }, isDefault: { type: "boolean" }, confirm: { type: "boolean" } },
+      required: ["application", "name"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.create(requiredString(args, "application"), {
+      name: requiredString(args, "name"),
+      ...typeof args["isDefault"] === "boolean" ? { isDefault: args["isDefault"] } : {},
+      confirm: args["confirm"] === true
+    })
+  },
+  {
+    name: "topolo_rename_workspace",
+    title: "Rename one Topolo application workspace",
+    description: "Renames a caller-authorized workspace without changing its stable id, slug, ownership, membership, or app data.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, workspaceId: { type: "string", minLength: 1 }, name: { type: "string", minLength: 1, maxLength: 120 }, confirm: { type: "boolean" } },
+      required: ["application", "workspaceId", "name"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.rename(
+      requiredString(args, "application"),
+      requiredString(args, "workspaceId"),
+      requiredString(args, "name"),
+      args["confirm"] === true
+    )
+  },
+  {
+    name: "topolo_set_default_workspace",
+    title: "Set an application default workspace",
+    description: "Sets exactly one caller-authorized workspace as the default for the target application and current organization.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, workspaceId: { type: "string", minLength: 1 }, confirm: { type: "boolean" } },
+      required: ["application", "workspaceId"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.setDefault(
+      requiredString(args, "application"),
+      requiredString(args, "workspaceId"),
+      args["confirm"] === true
+    )
+  },
   {
     name: "topolo_list_application_requirements",
     title: "List Topolo application build requirements",
@@ -4769,7 +4957,7 @@ var TOOLS = [
       },
       additionalProperties: false
     },
-    handler: async (_topolo, args) => {
+    handler: async (topolo, args) => {
       const application = args["application"];
       if (application === void 0) {
         return {
@@ -4779,12 +4967,8 @@ var TOOLS = [
           requirements: APPLICATION_REQUIREMENTS
         };
       }
-      if (typeof application !== "string" || !APPLICATION_IDS.includes(application)) {
-        throw new TopoloMcpPublicError(
-          `Unknown application "${String(application)}". ${formatKnownValues(APPLICATION_IDS, "applications")}`
-        );
-      }
-      const app = APPLICATIONS[application];
+      const resolved = await resolveDirectoryApplication(topolo, application);
+      const app = resolved.application;
       return {
         version: APPLICATION_REQUIREMENTS_VERSION,
         application: app,
@@ -4814,7 +4998,7 @@ var TOOLS = [
       },
       additionalProperties: false
     },
-    handler: async (_topolo, args) => {
+    handler: async (topolo, args) => {
       const application = args["application"];
       const failOn = args["failOn"];
       if (failOn !== void 0 && typeof failOn !== "string") {
@@ -4823,15 +5007,12 @@ var TOOLS = [
       const gate = failOn ? normalizeFailOn(failOn) : null;
       let report;
       if (application === void 0) {
-        report = auditAllApplicationRequirements();
+        const directory = await listApplicationDirectory(topolo.client);
+        report = auditApplicationEntries(directory.applications.map((app) => app.application));
         return gate ? { ...report, conformanceGate: evaluateApplicationAuditGate(report, gate) } : report;
       }
-      if (typeof application !== "string" || !APPLICATION_IDS.includes(application)) {
-        throw new TopoloMcpPublicError(
-          `Unknown application "${String(application)}". ${formatKnownValues(APPLICATION_IDS, "applications")}`
-        );
-      }
-      report = auditAllApplicationRequirements([application]);
+      const resolved = await resolveDirectoryApplication(topolo, application);
+      report = auditApplicationEntries([resolved.application]);
       return gate ? { ...report, conformanceGate: evaluateApplicationAuditGate(report, gate) } : report;
     }
   },
@@ -4971,31 +5152,19 @@ function statusesAtOrWorse(threshold) {
   return ["missing", "needs_review", "partial"];
 }
 function displayAppId(entry) {
-  for (const value of [entry.slug, entry.name, entry.appId]) {
-    if (typeof value !== "string" || !value.trim()) continue;
-    for (const candidate of appIdCandidates(value)) {
-      if (Object.prototype.hasOwnProperty.call(DEFAULT_APP_URLS, candidate)) {
-        return candidate;
-      }
-    }
-  }
-  return appIdCandidates(entry.slug || entry.appId)[0] || entry.appId;
+  return friendlyAppId(entry);
 }
-function appIdCandidates(value) {
-  const normalized = value.trim().toLowerCase().replace(/\s+/g, "-");
-  const withoutTopolo = normalized.startsWith("topolo-") ? normalized.slice("topolo-".length) : normalized;
-  return [.../* @__PURE__ */ new Set([
-    normalized,
-    normalized.replace(/-/g, "_"),
-    withoutTopolo,
-    withoutTopolo.replace(/-/g, "_")
-  ])].filter(Boolean);
-}
-function formatKnownValues(values, label) {
-  const sorted = [...values].sort();
-  const preview = sorted.slice(0, 25).join(", ");
-  const suffix = sorted.length > 25 ? `, ... +${sorted.length - 25} more` : "";
-  return `Run discovery for the full ${label} list. Known snapshot sample: ${preview}${suffix}`;
+async function resolveDirectoryApplication(topolo, application) {
+  if (typeof application !== "string" || !application.trim()) {
+    throw new TopoloMcpPublicError("`application` must be a non-empty string.");
+  }
+  try {
+    return await resolveApplicationDirectoryEntry(topolo.client, application);
+  } catch (error) {
+    throw new TopoloMcpPublicError(
+      error instanceof Error ? error.message : `Unknown application "${application}".`
+    );
+  }
 }
 
 // src/version.ts

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@topolo/mcp",
-  "version": "0.9.10",
-  "topoloPublishedVersion": "0.9.10",
+  "version": "0.10.0",
+  "topoloPublishedVersion": "0.10.0",
   "description": "Model Context Protocol server for the Topolo platform. Exposes scope-gated tools that third-party agents (Claude, Codex, etc.) can call natively.",
   "type": "module",
   "bin": {
@@ -37,7 +37,7 @@
     "@modelcontextprotocol/sdk": "^1.0.0"
   },
   "peerDependencies": {
-    "@topolo/sdk": "^0.9.9"
+    "@topolo/sdk": "^0.10.0"
   },
   "devDependencies": {
     "@topolo/sdk": "file:../topolo-sdk",