@topolo/mcp 0.9.10 → 0.9.11

package/README.md

@@ -153,6 +153,10 @@ deletion, encryption, and audit storage for the data they own.
 | `topolo_get_action`          | (credential-scoped)   | no               |
 | `topolo_read_action`         | catalog or target policy | no            |
 | `topolo_call_action`         | catalog or target policy | yes           |
+| `topolo_list_workspaces`     | target app runtime policy | no            |
+| `topolo_create_workspace`    | target app runtime policy | yes           |
+| `topolo_rename_workspace`    | target app runtime policy | yes           |
+| `topolo_set_default_workspace` | target app runtime policy | yes         |
 | `topolo_api_call`            | (service-enforced)    | yes              |
 
 Applications publish machine-action definitions through Topolo Developers.
@@ -171,6 +175,12 @@ capability without inventing a global permission, and the target service checks
 the current database-backed policy for the supplied organization/application on
 every call.
 
+Workspace lifecycle is first-class so agents do not have to know that Auth is
+the canonical owner. The tools accept the target application, derive the
+organization from the credential, and retain Auth's per-app runtime decision.
+`topolo_list_workspaces` exposes `policy.canCreate` and `policy.reason`; the
+write tools never infer access from organization ownership.
+
 `topolo_api_call` is the escape hatch for endpoints without typed MCP tools
 yet. GET requests work without confirmation; mutating HTTP methods must pass
 `confirm: true` or the SDK rejects the call. Backing services still enforce

package/dist/dispatch.js

@@ -64,6 +64,11 @@ function publicMcpErrorMessage(error, fallback) {
 // src/tools.ts
 var APPLICATION_IDS = Object.keys(APPLICATIONS).sort();
 var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
+function requiredString(args, name) {
+  const value = typeof args[name] === "string" ? args[name].trim() : "";
+  if (!value) throw new TopoloMcpPublicError(`${name} is required.`);
+  return value;
+}
 function optionalResourceContext(args) {
   const resourceType = typeof args["resourceType"] === "string" ? args["resourceType"].trim() : "";
   const resourceId = typeof args["resourceId"] === "string" ? args["resourceId"].trim() : "";
@@ -73,20 +78,6 @@ function optionalResourceContext(args) {
   }
   return { resourceType, resourceId };
 }
-function coerceObjectParam(value, name) {
-  let candidate = value;
-  if (typeof candidate === "string" && candidate.trim().startsWith("{")) {
-    try {
-      candidate = JSON.parse(candidate);
-    } catch {
-    }
-  }
-  if (candidate === void 0) return {};
-  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) {
-    throw new TopoloMcpPublicError(`${name} must be an object.`);
-  }
-  return candidate;
-}
 var TOOLS = [
   {
     name: "topolo_whoami",
@@ -237,11 +228,14 @@ var TOOLS = [
     handler: async (topolo, args) => {
       const actionId = typeof args["actionId"] === "string" ? args["actionId"].trim() : "";
       if (!actionId) throw new TopoloMcpPublicError("actionId is required.");
-      const input = coerceObjectParam(args["input"], "input");
+      const input = args["input"];
+      if (input !== void 0 && (!input || typeof input !== "object" || Array.isArray(input))) {
+        throw new TopoloMcpPublicError("input must be an object.");
+      }
       const resource = optionalResourceContext(args);
       return topolo.client.readAction(
         actionId,
-        input,
+        input ?? {},
         resource ? { resource } : {}
       );
     }
@@ -267,11 +261,14 @@ var TOOLS = [
     handler: async (topolo, args) => {
       const actionId = typeof args["actionId"] === "string" ? args["actionId"].trim() : "";
       if (!actionId) throw new TopoloMcpPublicError("actionId is required.");
-      const input = coerceObjectParam(args["input"], "input");
+      const input = args["input"];
+      if (input !== void 0 && (!input || typeof input !== "object" || Array.isArray(input))) {
+        throw new TopoloMcpPublicError("input must be an object.");
+      }
       const resource = optionalResourceContext(args);
       return topolo.client.callAction(
         actionId,
-        input,
+        input ?? {},
         {
           confirm: args["confirm"] === true,
           ...resource ? { resource } : {}
@@ -310,17 +307,23 @@ var TOOLS = [
       if (!isCanonicalBase64(contentBase64)) throw new TopoloMcpPublicError("contentBase64 must be canonical base64.");
       if (!contentType) throw new TopoloMcpPublicError("contentType is required.");
       if (!fileName) throw new TopoloMcpPublicError("fileName is required.");
-      const input = coerceObjectParam(args["input"], "input");
-      const completionInput = coerceObjectParam(args["completionInput"], "completionInput");
+      const input = args["input"];
+      if (input !== void 0 && (!input || typeof input !== "object" || Array.isArray(input))) {
+        throw new TopoloMcpPublicError("input must be an object.");
+      }
+      const completionInput = args["completionInput"];
+      if (completionInput !== void 0 && (!completionInput || typeof completionInput !== "object" || Array.isArray(completionInput))) {
+        throw new TopoloMcpPublicError("completionInput must be an object.");
+      }
       const resource = optionalResourceContext(args);
       return topolo.client.uploadActionBase64(
         actionId,
         contentBase64,
-        input,
+        input ?? {},
         {
           fileName,
           contentType,
-          completionInput,
+          completionInput: completionInput ?? {},
           confirm: args["confirm"] === true,
           ...resource ? { resource } : {}
         }
@@ -345,8 +348,11 @@ var TOOLS = [
     handler: async (topolo, args) => {
       const actionId = typeof args["actionId"] === "string" ? args["actionId"].trim() : "";
       if (!actionId) throw new TopoloMcpPublicError("actionId is required.");
-      const input = coerceObjectParam(args["input"], "input");
-      return topolo.client.validateActionInput(actionId, input);
+      const input = args["input"];
+      if (input !== void 0 && (!input || typeof input !== "object" || Array.isArray(input))) {
+        throw new TopoloMcpPublicError("input must be an object.");
+      }
+      return topolo.client.validateActionInput(actionId, input ?? {});
     }
   },
   {
@@ -370,11 +376,14 @@ var TOOLS = [
     handler: async (topolo, args) => {
       const actionId = typeof args["actionId"] === "string" ? args["actionId"].trim() : "";
       if (!actionId) throw new TopoloMcpPublicError("actionId is required.");
-      const input = coerceObjectParam(args["input"], "input");
+      const input = args["input"];
+      if (input !== void 0 && (!input || typeof input !== "object" || Array.isArray(input))) {
+        throw new TopoloMcpPublicError("input must be an object.");
+      }
       const resource = optionalResourceContext(args);
       return topolo.client.planAction(
         actionId,
-        input,
+        input ?? {},
         {
           confirm: args["confirm"] === true,
           ...resource ? { resource } : {}
@@ -463,6 +472,78 @@ var TOOLS = [
       return topolo.client.listBindableResources(application);
     }
   },
+  {
+    name: "topolo_list_workspaces",
+    title: "List workspaces for one Topolo application",
+    description: "Lists caller-visible workspaces and the caller-specific creation policy for one target application. Use this before creating a workspace; organization ownership alone does not imply creation rights for every app.",
+    requiredScopes: [],
+    destructive: false,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 } },
+      required: ["application"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => {
+      const application = requiredString(args, "application");
+      return topolo.workspaces.list(application);
+    }
+  },
+  {
+    name: "topolo_create_workspace",
+    title: "Create a workspace for one Topolo application",
+    description: "Creates a workspace only after reading the target application policy and confirming it permits this caller. The canonical Auth runtime still authorizes the concrete app and organization. Set confirm:true only after approval.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, name: { type: "string", minLength: 1, maxLength: 120 }, isDefault: { type: "boolean" }, confirm: { type: "boolean" } },
+      required: ["application", "name"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.create(requiredString(args, "application"), {
+      name: requiredString(args, "name"),
+      ...typeof args["isDefault"] === "boolean" ? { isDefault: args["isDefault"] } : {},
+      confirm: args["confirm"] === true
+    })
+  },
+  {
+    name: "topolo_rename_workspace",
+    title: "Rename one Topolo application workspace",
+    description: "Renames a caller-authorized workspace without changing its stable id, slug, ownership, membership, or app data.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, workspaceId: { type: "string", minLength: 1 }, name: { type: "string", minLength: 1, maxLength: 120 }, confirm: { type: "boolean" } },
+      required: ["application", "workspaceId", "name"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.rename(
+      requiredString(args, "application"),
+      requiredString(args, "workspaceId"),
+      requiredString(args, "name"),
+      args["confirm"] === true
+    )
+  },
+  {
+    name: "topolo_set_default_workspace",
+    title: "Set an application default workspace",
+    description: "Sets exactly one caller-authorized workspace as the default for the target application and current organization.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, workspaceId: { type: "string", minLength: 1 }, confirm: { type: "boolean" } },
+      required: ["application", "workspaceId"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.setDefault(
+      requiredString(args, "application"),
+      requiredString(args, "workspaceId"),
+      args["confirm"] === true
+    )
+  },
   {
     name: "topolo_list_application_requirements",
     title: "List Topolo application build requirements",

package/dist/http.js

@@ -15878,6 +15878,11 @@ function splitService(servicePart) {
 // src/tools.ts
 var APPLICATION_IDS = Object.keys(APPLICATIONS).sort();
 var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
+function requiredString(args, name) {
+  const value = typeof args[name] === "string" ? args[name].trim() : "";
+  if (!value) throw new TopoloMcpPublicError(`${name} is required.`);
+  return value;
+}
 function optionalResourceContext(args) {
   const resourceType = typeof args["resourceType"] === "string" ? args["resourceType"].trim() : "";
   const resourceId = typeof args["resourceId"] === "string" ? args["resourceId"].trim() : "";
@@ -15887,20 +15892,6 @@ function optionalResourceContext(args) {
   }
   return { resourceType, resourceId };
 }
-function coerceObjectParam(value, name) {
-  let candidate = value;
-  if (typeof candidate === "string" && candidate.trim().startsWith("{")) {
-    try {
-      candidate = JSON.parse(candidate);
-    } catch {
-    }
-  }
-  if (candidate === void 0) return {};
-  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) {
-    throw new TopoloMcpPublicError(`${name} must be an object.`);
-  }
-  return candidate;
-}
 var TOOLS = [
   {
     name: "topolo_whoami",
@@ -16051,11 +16042,14 @@ var TOOLS = [
     handler: async (topolo, args) => {
       const actionId = typeof args["actionId"] === "string" ? args["actionId"].trim() : "";
       if (!actionId) throw new TopoloMcpPublicError("actionId is required.");
-      const input = coerceObjectParam(args["input"], "input");
+      const input = args["input"];
+      if (input !== void 0 && (!input || typeof input !== "object" || Array.isArray(input))) {
+        throw new TopoloMcpPublicError("input must be an object.");
+      }
       const resource = optionalResourceContext(args);
       return topolo.client.readAction(
         actionId,
-        input,
+        input ?? {},
         resource ? { resource } : {}
       );
     }
@@ -16081,11 +16075,14 @@ var TOOLS = [
     handler: async (topolo, args) => {
       const actionId = typeof args["actionId"] === "string" ? args["actionId"].trim() : "";
       if (!actionId) throw new TopoloMcpPublicError("actionId is required.");
-      const input = coerceObjectParam(args["input"], "input");
+      const input = args["input"];
+      if (input !== void 0 && (!input || typeof input !== "object" || Array.isArray(input))) {
+        throw new TopoloMcpPublicError("input must be an object.");
+      }
       const resource = optionalResourceContext(args);
       return topolo.client.callAction(
         actionId,
-        input,
+        input ?? {},
         {
           confirm: args["confirm"] === true,
           ...resource ? { resource } : {}
@@ -16124,17 +16121,23 @@ var TOOLS = [
       if (!isCanonicalBase64(contentBase64)) throw new TopoloMcpPublicError("contentBase64 must be canonical base64.");
       if (!contentType) throw new TopoloMcpPublicError("contentType is required.");
       if (!fileName) throw new TopoloMcpPublicError("fileName is required.");
-      const input = coerceObjectParam(args["input"], "input");
-      const completionInput = coerceObjectParam(args["completionInput"], "completionInput");
+      const input = args["input"];
+      if (input !== void 0 && (!input || typeof input !== "object" || Array.isArray(input))) {
+        throw new TopoloMcpPublicError("input must be an object.");
+      }
+      const completionInput = args["completionInput"];
+      if (completionInput !== void 0 && (!completionInput || typeof completionInput !== "object" || Array.isArray(completionInput))) {
+        throw new TopoloMcpPublicError("completionInput must be an object.");
+      }
       const resource = optionalResourceContext(args);
       return topolo.client.uploadActionBase64(
         actionId,
         contentBase64,
-        input,
+        input ?? {},
         {
           fileName,
           contentType,
-          completionInput,
+          completionInput: completionInput ?? {},
           confirm: args["confirm"] === true,
           ...resource ? { resource } : {}
         }
@@ -16159,8 +16162,11 @@ var TOOLS = [
     handler: async (topolo, args) => {
       const actionId = typeof args["actionId"] === "string" ? args["actionId"].trim() : "";
       if (!actionId) throw new TopoloMcpPublicError("actionId is required.");
-      const input = coerceObjectParam(args["input"], "input");
-      return topolo.client.validateActionInput(actionId, input);
+      const input = args["input"];
+      if (input !== void 0 && (!input || typeof input !== "object" || Array.isArray(input))) {
+        throw new TopoloMcpPublicError("input must be an object.");
+      }
+      return topolo.client.validateActionInput(actionId, input ?? {});
     }
   },
   {
@@ -16184,11 +16190,14 @@ var TOOLS = [
     handler: async (topolo, args) => {
       const actionId = typeof args["actionId"] === "string" ? args["actionId"].trim() : "";
       if (!actionId) throw new TopoloMcpPublicError("actionId is required.");
-      const input = coerceObjectParam(args["input"], "input");
+      const input = args["input"];
+      if (input !== void 0 && (!input || typeof input !== "object" || Array.isArray(input))) {
+        throw new TopoloMcpPublicError("input must be an object.");
+      }
       const resource = optionalResourceContext(args);
       return topolo.client.planAction(
         actionId,
-        input,
+        input ?? {},
         {
           confirm: args["confirm"] === true,
           ...resource ? { resource } : {}
@@ -16277,6 +16286,78 @@ var TOOLS = [
       return topolo.client.listBindableResources(application);
     }
   },
+  {
+    name: "topolo_list_workspaces",
+    title: "List workspaces for one Topolo application",
+    description: "Lists caller-visible workspaces and the caller-specific creation policy for one target application. Use this before creating a workspace; organization ownership alone does not imply creation rights for every app.",
+    requiredScopes: [],
+    destructive: false,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 } },
+      required: ["application"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => {
+      const application = requiredString(args, "application");
+      return topolo.workspaces.list(application);
+    }
+  },
+  {
+    name: "topolo_create_workspace",
+    title: "Create a workspace for one Topolo application",
+    description: "Creates a workspace only after reading the target application policy and confirming it permits this caller. The canonical Auth runtime still authorizes the concrete app and organization. Set confirm:true only after approval.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, name: { type: "string", minLength: 1, maxLength: 120 }, isDefault: { type: "boolean" }, confirm: { type: "boolean" } },
+      required: ["application", "name"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.create(requiredString(args, "application"), {
+      name: requiredString(args, "name"),
+      ...typeof args["isDefault"] === "boolean" ? { isDefault: args["isDefault"] } : {},
+      confirm: args["confirm"] === true
+    })
+  },
+  {
+    name: "topolo_rename_workspace",
+    title: "Rename one Topolo application workspace",
+    description: "Renames a caller-authorized workspace without changing its stable id, slug, ownership, membership, or app data.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, workspaceId: { type: "string", minLength: 1 }, name: { type: "string", minLength: 1, maxLength: 120 }, confirm: { type: "boolean" } },
+      required: ["application", "workspaceId", "name"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.rename(
+      requiredString(args, "application"),
+      requiredString(args, "workspaceId"),
+      requiredString(args, "name"),
+      args["confirm"] === true
+    )
+  },
+  {
+    name: "topolo_set_default_workspace",
+    title: "Set an application default workspace",
+    description: "Sets exactly one caller-authorized workspace as the default for the target application and current organization.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, workspaceId: { type: "string", minLength: 1 }, confirm: { type: "boolean" } },
+      required: ["application", "workspaceId"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.setDefault(
+      requiredString(args, "application"),
+      requiredString(args, "workspaceId"),
+      args["confirm"] === true
+    )
+  },
   {
     name: "topolo_list_application_requirements",
     title: "List Topolo application build requirements",

package/dist/index.js

@@ -3865,11 +3865,71 @@ var IdentityModule = class {
     return this.client.introspect();
   }
 };
+var ACTIONS = {
+  list: "app_topolo_auth.workspaces.list",
+  create: "app_topolo_auth.workspaces.create",
+  rename: "app_topolo_auth.workspaces.rename",
+  setDefault: "app_topolo_auth.workspaces.default.set"
+};
+var WorkspacesModule = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  async list(application) {
+    const context = await this.resolveContext(application);
+    return this.client.callAction(ACTIONS.list, {
+      org_id: context.organizationId,
+      app_id: context.appId
+    });
+  }
+  async create(application, input) {
+    const current = await this.list(application);
+    if (!current.data.policy.canCreate) {
+      throw new TopoloSdkError(
+        "workspace_creation_not_allowed",
+        `Workspace creation is not allowed for ${current.data.appId}: ${current.data.policy.reason}`
+      );
+    }
+    return this.client.callAction(ACTIONS.create, {
+      organizationId: current.data.organizationId,
+      appId: current.data.appId,
+      name: input.name,
+      ...input.isDefault === void 0 ? {} : { isDefault: input.isDefault }
+    }, { confirm: input.confirm === true });
+  }
+  async rename(application, workspaceId, name, confirm = false) {
+    const context = await this.resolveContext(application);
+    return this.client.callAction(ACTIONS.rename, {
+      workspaceId,
+      organizationId: context.organizationId,
+      appId: context.appId,
+      name
+    }, { confirm });
+  }
+  async setDefault(application, workspaceId, confirm = false) {
+    const context = await this.resolveContext(application);
+    return this.client.callAction(ACTIONS.setDefault, {
+      workspaceId,
+      organizationId: context.organizationId,
+      appId: context.appId
+    }, { confirm });
+  }
+  async resolveContext(application) {
+    const identity = await this.client.introspect();
+    if (!identity.organization?.id) {
+      throw new TopoloSdkError("organization_required", "Workspace lifecycle requires an organization-scoped credential.");
+    }
+    const service = await this.client.getService(application);
+    return { organizationId: identity.organization.id, appId: service.appId };
+  }
+};
 function createTopolo(options) {
   const client = new TopoloClient(options);
   return {
     client,
     identity: new IdentityModule(client),
+    workspaces: new WorkspacesModule(client),
     crm: new CrmModule(client)
   };
 }
@@ -4354,6 +4414,11 @@ function publicMcpErrorMessage(error, fallback) {
 // src/tools.ts
 var APPLICATION_IDS = Object.keys(APPLICATIONS).sort();
 var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
+function requiredString(args, name) {
+  const value = typeof args[name] === "string" ? args[name].trim() : "";
+  if (!value) throw new TopoloMcpPublicError(`${name} is required.`);
+  return value;
+}
 function optionalResourceContext(args) {
   const resourceType = typeof args["resourceType"] === "string" ? args["resourceType"].trim() : "";
   const resourceId = typeof args["resourceId"] === "string" ? args["resourceId"].trim() : "";
@@ -4363,20 +4428,6 @@ function optionalResourceContext(args) {
   }
   return { resourceType, resourceId };
 }
-function coerceObjectParam(value, name) {
-  let candidate = value;
-  if (typeof candidate === "string" && candidate.trim().startsWith("{")) {
-    try {
-      candidate = JSON.parse(candidate);
-    } catch {
-    }
-  }
-  if (candidate === void 0) return {};
-  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) {
-    throw new TopoloMcpPublicError(`${name} must be an object.`);
-  }
-  return candidate;
-}
 var TOOLS = [
   {
     name: "topolo_whoami",
@@ -4527,11 +4578,14 @@ var TOOLS = [
     handler: async (topolo, args) => {
       const actionId = typeof args["actionId"] === "string" ? args["actionId"].trim() : "";
       if (!actionId) throw new TopoloMcpPublicError("actionId is required.");
-      const input = coerceObjectParam(args["input"], "input");
+      const input = args["input"];
+      if (input !== void 0 && (!input || typeof input !== "object" || Array.isArray(input))) {
+        throw new TopoloMcpPublicError("input must be an object.");
+      }
       const resource = optionalResourceContext(args);
       return topolo.client.readAction(
         actionId,
-        input,
+        input ?? {},
         resource ? { resource } : {}
       );
     }
@@ -4557,11 +4611,14 @@ var TOOLS = [
     handler: async (topolo, args) => {
       const actionId = typeof args["actionId"] === "string" ? args["actionId"].trim() : "";
       if (!actionId) throw new TopoloMcpPublicError("actionId is required.");
-      const input = coerceObjectParam(args["input"], "input");
+      const input = args["input"];
+      if (input !== void 0 && (!input || typeof input !== "object" || Array.isArray(input))) {
+        throw new TopoloMcpPublicError("input must be an object.");
+      }
       const resource = optionalResourceContext(args);
       return topolo.client.callAction(
         actionId,
-        input,
+        input ?? {},
         {
           confirm: args["confirm"] === true,
           ...resource ? { resource } : {}
@@ -4600,17 +4657,23 @@ var TOOLS = [
       if (!isCanonicalBase642(contentBase64)) throw new TopoloMcpPublicError("contentBase64 must be canonical base64.");
       if (!contentType) throw new TopoloMcpPublicError("contentType is required.");
       if (!fileName) throw new TopoloMcpPublicError("fileName is required.");
-      const input = coerceObjectParam(args["input"], "input");
-      const completionInput = coerceObjectParam(args["completionInput"], "completionInput");
+      const input = args["input"];
+      if (input !== void 0 && (!input || typeof input !== "object" || Array.isArray(input))) {
+        throw new TopoloMcpPublicError("input must be an object.");
+      }
+      const completionInput = args["completionInput"];
+      if (completionInput !== void 0 && (!completionInput || typeof completionInput !== "object" || Array.isArray(completionInput))) {
+        throw new TopoloMcpPublicError("completionInput must be an object.");
+      }
       const resource = optionalResourceContext(args);
       return topolo.client.uploadActionBase64(
         actionId,
         contentBase64,
-        input,
+        input ?? {},
         {
           fileName,
           contentType,
-          completionInput,
+          completionInput: completionInput ?? {},
           confirm: args["confirm"] === true,
           ...resource ? { resource } : {}
         }
@@ -4635,8 +4698,11 @@ var TOOLS = [
     handler: async (topolo, args) => {
       const actionId = typeof args["actionId"] === "string" ? args["actionId"].trim() : "";
       if (!actionId) throw new TopoloMcpPublicError("actionId is required.");
-      const input = coerceObjectParam(args["input"], "input");
-      return topolo.client.validateActionInput(actionId, input);
+      const input = args["input"];
+      if (input !== void 0 && (!input || typeof input !== "object" || Array.isArray(input))) {
+        throw new TopoloMcpPublicError("input must be an object.");
+      }
+      return topolo.client.validateActionInput(actionId, input ?? {});
     }
   },
   {
@@ -4660,11 +4726,14 @@ var TOOLS = [
     handler: async (topolo, args) => {
       const actionId = typeof args["actionId"] === "string" ? args["actionId"].trim() : "";
       if (!actionId) throw new TopoloMcpPublicError("actionId is required.");
-      const input = coerceObjectParam(args["input"], "input");
+      const input = args["input"];
+      if (input !== void 0 && (!input || typeof input !== "object" || Array.isArray(input))) {
+        throw new TopoloMcpPublicError("input must be an object.");
+      }
       const resource = optionalResourceContext(args);
       return topolo.client.planAction(
         actionId,
-        input,
+        input ?? {},
         {
           confirm: args["confirm"] === true,
           ...resource ? { resource } : {}
@@ -4753,6 +4822,78 @@ var TOOLS = [
       return topolo.client.listBindableResources(application);
     }
   },
+  {
+    name: "topolo_list_workspaces",
+    title: "List workspaces for one Topolo application",
+    description: "Lists caller-visible workspaces and the caller-specific creation policy for one target application. Use this before creating a workspace; organization ownership alone does not imply creation rights for every app.",
+    requiredScopes: [],
+    destructive: false,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 } },
+      required: ["application"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => {
+      const application = requiredString(args, "application");
+      return topolo.workspaces.list(application);
+    }
+  },
+  {
+    name: "topolo_create_workspace",
+    title: "Create a workspace for one Topolo application",
+    description: "Creates a workspace only after reading the target application policy and confirming it permits this caller. The canonical Auth runtime still authorizes the concrete app and organization. Set confirm:true only after approval.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, name: { type: "string", minLength: 1, maxLength: 120 }, isDefault: { type: "boolean" }, confirm: { type: "boolean" } },
+      required: ["application", "name"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.create(requiredString(args, "application"), {
+      name: requiredString(args, "name"),
+      ...typeof args["isDefault"] === "boolean" ? { isDefault: args["isDefault"] } : {},
+      confirm: args["confirm"] === true
+    })
+  },
+  {
+    name: "topolo_rename_workspace",
+    title: "Rename one Topolo application workspace",
+    description: "Renames a caller-authorized workspace without changing its stable id, slug, ownership, membership, or app data.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, workspaceId: { type: "string", minLength: 1 }, name: { type: "string", minLength: 1, maxLength: 120 }, confirm: { type: "boolean" } },
+      required: ["application", "workspaceId", "name"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.rename(
+      requiredString(args, "application"),
+      requiredString(args, "workspaceId"),
+      requiredString(args, "name"),
+      args["confirm"] === true
+    )
+  },
+  {
+    name: "topolo_set_default_workspace",
+    title: "Set an application default workspace",
+    description: "Sets exactly one caller-authorized workspace as the default for the target application and current organization.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, workspaceId: { type: "string", minLength: 1 }, confirm: { type: "boolean" } },
+      required: ["application", "workspaceId"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.setDefault(
+      requiredString(args, "application"),
+      requiredString(args, "workspaceId"),
+      args["confirm"] === true
+    )
+  },
   {
     name: "topolo_list_application_requirements",
     title: "List Topolo application build requirements",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@topolo/mcp",
-  "version": "0.9.10",
-  "topoloPublishedVersion": "0.9.10",
+  "version": "0.9.11",
+  "topoloPublishedVersion": "0.9.11",
   "description": "Model Context Protocol server for the Topolo platform. Exposes scope-gated tools that third-party agents (Claude, Codex, etc.) can call natively.",
   "type": "module",
   "bin": {
@@ -37,7 +37,7 @@
     "@modelcontextprotocol/sdk": "^1.0.0"
   },
   "peerDependencies": {
-    "@topolo/sdk": "^0.9.9"
+    "@topolo/sdk": "^0.9.10"
   },
   "devDependencies": {
     "@topolo/sdk": "file:../topolo-sdk",