@topolo/mcp 0.9.2 → 0.9.3

package/README.md

@@ -168,10 +168,14 @@ relevant permissions, and new actions become discoverable/callable without an
 MCP release once the application publishes them.
 
 `topolo_read_action` and `topolo_call_action` accept an optional paired
-`resourceType` / `resourceId` context for app-local workspace boundaries. The
-SDK sends it as resource headers without changing the credential's personal or
-organization context. This lets agents address many workspaces independently;
-providing only one of the pair is rejected before the request is sent.
+`resourceType` / `resourceId` context that scopes the call to one workspace (or
+another cataloged resource alias). Workspaces are platform-owned — the record
+lives once in TopoloAuth and a workspace belongs to exactly one app — so this
+only selects which workspace the call is scoped to; it does not create or own
+one. The SDK sends it as resource headers without changing the credential's
+personal or organization context. This lets agents address many workspaces
+independently; providing only one of the pair is rejected before the request is
+sent.
 
 ## Safety rails
 

package/dist/dispatch.js

@@ -203,7 +203,7 @@ var TOOLS = [
       properties: {
         actionId: { type: "string", minLength: 1 },
         input: { type: "object", additionalProperties: true },
-        resourceType: { type: "string", description: "Optional app-local resource alias, such as workspace." },
+        resourceType: { type: "string", description: "Optional resource-scoping alias published in the app resource catalog (e.g. workspace, brand, merchant)." },
         resourceId: { type: "string", description: "Resource id. Required when resourceType is provided." }
       },
       required: ["actionId"],
@@ -235,7 +235,7 @@ var TOOLS = [
       properties: {
         actionId: { type: "string", minLength: 1 },
         input: { type: "object", additionalProperties: true },
-        resourceType: { type: "string", description: "Optional app-local resource alias, such as workspace." },
+        resourceType: { type: "string", description: "Optional resource-scoping alias published in the app resource catalog (e.g. workspace, brand, merchant)." },
         resourceId: { type: "string", description: "Resource id. Required when resourceType is provided." },
         confirm: { type: "boolean" }
       },
@@ -296,7 +296,7 @@ var TOOLS = [
       properties: {
         actionId: { type: "string", minLength: 1 },
         input: { type: "object", additionalProperties: true },
-        resourceType: { type: "string", description: "Optional app-local resource alias, such as workspace." },
+        resourceType: { type: "string", description: "Optional resource-scoping alias published in the app resource catalog (e.g. workspace, brand, merchant)." },
         resourceId: { type: "string", description: "Resource id. Required when resourceType is provided." },
         confirm: { type: "boolean", description: "Include confirmation in the plan without executing the action." }
       },

package/dist/http.js

@@ -3098,9 +3098,9 @@ var require_data = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/utils.js
+// ../../node_modules/.pnpm/fast-uri@3.1.4/node_modules/fast-uri/lib/utils.js
 var require_utils = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/utils.js"(exports, module) {
+  "../../node_modules/.pnpm/fast-uri@3.1.4/node_modules/fast-uri/lib/utils.js"(exports, module) {
     "use strict";
     var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
     var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
@@ -3411,9 +3411,9 @@ var require_utils = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/schemes.js
+// ../../node_modules/.pnpm/fast-uri@3.1.4/node_modules/fast-uri/lib/schemes.js
 var require_schemes = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/schemes.js"(exports, module) {
+  "../../node_modules/.pnpm/fast-uri@3.1.4/node_modules/fast-uri/lib/schemes.js"(exports, module) {
     "use strict";
     var { isUUID } = require_utils();
     var URN_REG = /([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-.:;=@]|%[\da-f]{2})+)/iu;
@@ -3621,9 +3621,9 @@ var require_schemes = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/index.js
+// ../../node_modules/.pnpm/fast-uri@3.1.4/node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/index.js"(exports, module) {
+  "../../node_modules/.pnpm/fast-uri@3.1.4/node_modules/fast-uri/index.js"(exports, module) {
     "use strict";
     var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
@@ -3764,6 +3764,7 @@ var require_fast_uri = __commonJS({
       return uriTokens.join("");
     }
     var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
+    var AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/;
     function getParseError(parsed, matches) {
       if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") {
         return 'URI path must start with "/" when authority is present.';
@@ -3793,6 +3794,11 @@ var require_fast_uri = __commonJS({
           uri = "//" + uri;
         }
       }
+      const authorityMatch = uri.match(AUTHORITY_PREFIX);
+      if (authorityMatch !== null && authorityMatch[1].indexOf("\\") !== -1) {
+        parsed.error = "URI authority must not contain a literal backslash.";
+        malformedAuthorityOrPort = true;
+      }
       const matches = uri.match(URI_PARSE);
       if (matches) {
         parsed.scheme = matches[1];
@@ -3836,7 +3842,7 @@ var require_fast_uri = __commonJS({
         if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
           if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
             try {
-              parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
+              parsed.host = new URL("http://" + parsed.host).hostname;
             } catch (e) {
               parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
             }
@@ -16011,7 +16017,7 @@ var TOOLS = [
       properties: {
         actionId: { type: "string", minLength: 1 },
         input: { type: "object", additionalProperties: true },
-        resourceType: { type: "string", description: "Optional app-local resource alias, such as workspace." },
+        resourceType: { type: "string", description: "Optional resource-scoping alias published in the app resource catalog (e.g. workspace, brand, merchant)." },
         resourceId: { type: "string", description: "Resource id. Required when resourceType is provided." }
       },
       required: ["actionId"],
@@ -16043,7 +16049,7 @@ var TOOLS = [
       properties: {
         actionId: { type: "string", minLength: 1 },
         input: { type: "object", additionalProperties: true },
-        resourceType: { type: "string", description: "Optional app-local resource alias, such as workspace." },
+        resourceType: { type: "string", description: "Optional resource-scoping alias published in the app resource catalog (e.g. workspace, brand, merchant)." },
         resourceId: { type: "string", description: "Resource id. Required when resourceType is provided." },
         confirm: { type: "boolean" }
       },
@@ -16104,7 +16110,7 @@ var TOOLS = [
       properties: {
         actionId: { type: "string", minLength: 1 },
         input: { type: "object", additionalProperties: true },
-        resourceType: { type: "string", description: "Optional app-local resource alias, such as workspace." },
+        resourceType: { type: "string", description: "Optional resource-scoping alias published in the app resource catalog (e.g. workspace, brand, merchant)." },
         resourceId: { type: "string", description: "Resource id. Required when resourceType is provided." },
         confirm: { type: "boolean", description: "Include confirmation in the plan without executing the action." }
       },

package/dist/index.js

@@ -131,7 +131,9 @@ var APPLICATIONS = {
         "domains": [
           "admin.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "admin.topolo.app"
+        ],
         "appId": null
       },
       {
@@ -179,7 +181,7 @@ var APPLICATIONS = {
     "appDir": "TopoloAuth",
     "name": "topolo-auth",
     "packageName": "topolo-auth",
-    "productionUrl": "https://auth.topolo.app/login",
+    "productionUrl": "https://auth.topolo.app",
     "services": [
       "auth"
     ],
@@ -215,7 +217,9 @@ var APPLICATIONS = {
         "domains": [
           "backup.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "backup.topolo.app"
+        ],
         "appId": "backup"
       }
     ]
@@ -267,9 +271,7 @@ var APPLICATIONS = {
         "domains": [
           "brand.topolo.app"
         ],
-        "routes": [
-          "brand.topolo.app"
-        ],
+        "routes": [],
         "appId": "brand"
       },
       {
@@ -321,7 +323,9 @@ var APPLICATIONS = {
         "domains": [
           "bytes.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "bytes.topolo.app"
+        ],
         "appId": "bytes"
       },
       {
@@ -351,7 +355,9 @@ var APPLICATIONS = {
         "domains": [
           "calendar.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "calendar.topolo.app"
+        ],
         "appId": "calendar"
       },
       {
@@ -381,9 +387,7 @@ var APPLICATIONS = {
         "domains": [
           "campaigns.topolo.app"
         ],
-        "routes": [
-          "campaigns.topolo.app"
-        ],
+        "routes": [],
         "appId": "campaigns"
       },
       {
@@ -473,7 +477,9 @@ var APPLICATIONS = {
         "domains": [
           "guest.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "guest.topolo.app"
+        ],
         "appId": null
       },
       {
@@ -483,7 +489,9 @@ var APPLICATIONS = {
         "domains": [
           "commerce.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "commerce.topolo.app"
+        ],
         "appId": "commerce"
       },
       {
@@ -493,7 +501,9 @@ var APPLICATIONS = {
         "domains": [
           "station-commerce.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "station-commerce.topolo.app"
+        ],
         "appId": null
       }
     ]
@@ -671,7 +681,9 @@ var APPLICATIONS = {
         "domains": [
           "docs.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "docs.topolo.app"
+        ],
         "appId": null
       },
       {
@@ -701,7 +713,9 @@ var APPLICATIONS = {
         "domains": [
           "feed-analytics-api.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "feed-analytics-api.topolo.app"
+        ],
         "appId": null
       },
       {
@@ -711,7 +725,9 @@ var APPLICATIONS = {
         "domains": [
           "feed-api.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "feed-api.topolo.app"
+        ],
         "appId": null
       },
       {
@@ -721,7 +737,9 @@ var APPLICATIONS = {
         "domains": [
           "feed.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "feed.topolo.app"
+        ],
         "appId": "feed"
       }
     ]
@@ -833,7 +851,9 @@ var APPLICATIONS = {
         "domains": [
           "home.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "home.topolo.app"
+        ],
         "appId": "home"
       },
       {
@@ -923,7 +943,9 @@ var APPLICATIONS = {
         "domains": [
           "learn.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "learn.topolo.app"
+        ],
         "appId": "learn"
       },
       {
@@ -1015,7 +1037,9 @@ var APPLICATIONS = {
         "domains": [
           "mdm.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "mdm.topolo.app"
+        ],
         "appId": "mdm"
       }
     ]
@@ -1037,7 +1061,9 @@ var APPLICATIONS = {
         "domains": [
           "messages.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "messages.topolo.app"
+        ],
         "appId": "messages"
       },
       {
@@ -1071,11 +1097,13 @@ var APPLICATIONS = {
       {
         "name": "topolo-nexus-dashboard",
         "kind": "worker",
-        "apiUrl": null,
+        "apiUrl": "https://nexus.topolo.app",
         "domains": [
           "nexus.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "nexus.topolo.app"
+        ],
         "appId": null
       },
       {
@@ -1203,7 +1231,9 @@ var APPLICATIONS = {
         "domains": [
           "p2p.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "p2p.topolo.app"
+        ],
         "appId": "p2p"
       },
       {
@@ -1400,7 +1430,9 @@ var APPLICATIONS = {
         "domains": [
           "studio.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "studio.topolo.app"
+        ],
         "appId": "social_studio"
       },
       {
@@ -1438,7 +1470,9 @@ var APPLICATIONS = {
         "domains": [
           "socialize.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "socialize.topolo.app"
+        ],
         "appId": "socialize"
       },
       {
@@ -1448,7 +1482,9 @@ var APPLICATIONS = {
         "domains": [
           "socialize-api.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "socialize-api.topolo.app"
+        ],
         "appId": null
       },
       {
@@ -1508,7 +1544,9 @@ var APPLICATIONS = {
         "domains": [
           "status.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "status.topolo.app"
+        ],
         "appId": "status"
       }
     ]
@@ -1624,7 +1662,9 @@ var APPLICATIONS = {
         "domains": [
           "voice.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "voice.topolo.app"
+        ],
         "appId": "voice"
       },
       {
@@ -1675,7 +1715,9 @@ var APPLICATIONS = {
         "domains": [
           "web.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "web.topolo.app"
+        ],
         "appId": "web"
       }
     ]
@@ -1752,7 +1794,7 @@ var APPLICATION_REQUIREMENTS = [
       "Use TopoloAppMetricCard, TopoloAppEmptyState, TopoloAppStatusBadge, TopoloAppGrid, and TopoloAppSection for repeated app body patterns",
       "Keep visual QA fixtures available through visualQa=1 or __devpreview=1 so screenshot checks do not depend on live API state",
       "Keep mobile and desktop shell behavior aligned with the platform UI kit",
-      "Constrain app-owned workspace wrappers with min-width: 0, width: auto, and viewport-aware max-width so shell padding cannot create page-level horizontal overflow"
+      "Constrain the app workspace-view layout wrappers with min-width: 0, width: auto, and viewport-aware max-width so shell padding cannot create page-level horizontal overflow"
     ]
   },
   {
@@ -3241,6 +3283,7 @@ function normalizeActionCatalogEntry(item) {
     permissionName: pickActionString(a.permission_name) ?? pickActionString(a.permissionName) ?? "",
     requiredPermission: pickActionString(a.required_permission) ?? pickActionString(a.requiredPermission) ?? "",
     authorizationMode: pickAuthorizationMode(a.authorization_mode ?? a.authorizationMode),
+    allowedServices: stringArray(a.allowed_services ?? a.allowedServices),
     inputSchema: plainObject(a.input_schema ?? a.inputSchema),
     outputSchema: plainObject(a.output_schema ?? a.outputSchema),
     agentContract: plainObject(a.agent_contract ?? a.agentContract),
@@ -3262,7 +3305,7 @@ function pickAgentAccess(value) {
   return value === "auto" || value === "confirm" || value === "off" ? value : null;
 }
 function pickAuthorizationMode(value) {
-  return value === "runtime" ? "runtime" : "static";
+  return value === "runtime" || value === "public" || value === "service" ? value : "static";
 }
 function plainObject(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
@@ -4009,7 +4052,7 @@ var TOOLS = [
       properties: {
         actionId: { type: "string", minLength: 1 },
         input: { type: "object", additionalProperties: true },
-        resourceType: { type: "string", description: "Optional app-local resource alias, such as workspace." },
+        resourceType: { type: "string", description: "Optional resource-scoping alias published in the app resource catalog (e.g. workspace, brand, merchant)." },
         resourceId: { type: "string", description: "Resource id. Required when resourceType is provided." }
       },
       required: ["actionId"],
@@ -4041,7 +4084,7 @@ var TOOLS = [
       properties: {
         actionId: { type: "string", minLength: 1 },
         input: { type: "object", additionalProperties: true },
-        resourceType: { type: "string", description: "Optional app-local resource alias, such as workspace." },
+        resourceType: { type: "string", description: "Optional resource-scoping alias published in the app resource catalog (e.g. workspace, brand, merchant)." },
         resourceId: { type: "string", description: "Resource id. Required when resourceType is provided." },
         confirm: { type: "boolean" }
       },
@@ -4102,7 +4145,7 @@ var TOOLS = [
       properties: {
         actionId: { type: "string", minLength: 1 },
         input: { type: "object", additionalProperties: true },
-        resourceType: { type: "string", description: "Optional app-local resource alias, such as workspace." },
+        resourceType: { type: "string", description: "Optional resource-scoping alias published in the app resource catalog (e.g. workspace, brand, merchant)." },
         resourceId: { type: "string", description: "Resource id. Required when resourceType is provided." },
         confirm: { type: "boolean", description: "Include confirmation in the plan without executing the action." }
       },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topolo/mcp",
-  "version": "0.9.2",
+  "version": "0.9.3",
   "description": "Model Context Protocol server for the Topolo platform. Exposes scope-gated tools that third-party agents (Claude, Codex, etc.) can call natively.",
   "type": "module",
   "bin": {
@@ -36,7 +36,7 @@
     "@modelcontextprotocol/sdk": "^1.0.0"
   },
   "peerDependencies": {
-    "@topolo/sdk": "^0.9.2"
+    "@topolo/sdk": "^0.9.4"
   },
   "devDependencies": {
     "@topolo/sdk": "file:../topolo-sdk",