@topolo/mcp 0.9.9 → 0.9.11

package/README.md

@@ -153,6 +153,10 @@ deletion, encryption, and audit storage for the data they own.
 | `topolo_get_action`          | (credential-scoped)   | no               |
 | `topolo_read_action`         | catalog or target policy | no            |
 | `topolo_call_action`         | catalog or target policy | yes           |
+| `topolo_list_workspaces`     | target app runtime policy | no            |
+| `topolo_create_workspace`    | target app runtime policy | yes           |
+| `topolo_rename_workspace`    | target app runtime policy | yes           |
+| `topolo_set_default_workspace` | target app runtime policy | yes         |
 | `topolo_api_call`            | (service-enforced)    | yes              |
 
 Applications publish machine-action definitions through Topolo Developers.
@@ -171,6 +175,12 @@ capability without inventing a global permission, and the target service checks
 the current database-backed policy for the supplied organization/application on
 every call.
 
+Workspace lifecycle is first-class so agents do not have to know that Auth is
+the canonical owner. The tools accept the target application, derive the
+organization from the credential, and retain Auth's per-app runtime decision.
+`topolo_list_workspaces` exposes `policy.canCreate` and `policy.reason`; the
+write tools never infer access from organization ownership.
+
 `topolo_api_call` is the escape hatch for endpoints without typed MCP tools
 yet. GET requests work without confirmation; mutating HTTP methods must pass
 `confirm: true` or the SDK rejects the call. Backing services still enforce

package/dist/dispatch.js

@@ -64,6 +64,11 @@ function publicMcpErrorMessage(error, fallback) {
 // src/tools.ts
 var APPLICATION_IDS = Object.keys(APPLICATIONS).sort();
 var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
+function requiredString(args, name) {
+  const value = typeof args[name] === "string" ? args[name].trim() : "";
+  if (!value) throw new TopoloMcpPublicError(`${name} is required.`);
+  return value;
+}
 function optionalResourceContext(args) {
   const resourceType = typeof args["resourceType"] === "string" ? args["resourceType"].trim() : "";
   const resourceId = typeof args["resourceId"] === "string" ? args["resourceId"].trim() : "";
@@ -467,6 +472,78 @@ var TOOLS = [
       return topolo.client.listBindableResources(application);
     }
   },
+  {
+    name: "topolo_list_workspaces",
+    title: "List workspaces for one Topolo application",
+    description: "Lists caller-visible workspaces and the caller-specific creation policy for one target application. Use this before creating a workspace; organization ownership alone does not imply creation rights for every app.",
+    requiredScopes: [],
+    destructive: false,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 } },
+      required: ["application"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => {
+      const application = requiredString(args, "application");
+      return topolo.workspaces.list(application);
+    }
+  },
+  {
+    name: "topolo_create_workspace",
+    title: "Create a workspace for one Topolo application",
+    description: "Creates a workspace only after reading the target application policy and confirming it permits this caller. The canonical Auth runtime still authorizes the concrete app and organization. Set confirm:true only after approval.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, name: { type: "string", minLength: 1, maxLength: 120 }, isDefault: { type: "boolean" }, confirm: { type: "boolean" } },
+      required: ["application", "name"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.create(requiredString(args, "application"), {
+      name: requiredString(args, "name"),
+      ...typeof args["isDefault"] === "boolean" ? { isDefault: args["isDefault"] } : {},
+      confirm: args["confirm"] === true
+    })
+  },
+  {
+    name: "topolo_rename_workspace",
+    title: "Rename one Topolo application workspace",
+    description: "Renames a caller-authorized workspace without changing its stable id, slug, ownership, membership, or app data.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, workspaceId: { type: "string", minLength: 1 }, name: { type: "string", minLength: 1, maxLength: 120 }, confirm: { type: "boolean" } },
+      required: ["application", "workspaceId", "name"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.rename(
+      requiredString(args, "application"),
+      requiredString(args, "workspaceId"),
+      requiredString(args, "name"),
+      args["confirm"] === true
+    )
+  },
+  {
+    name: "topolo_set_default_workspace",
+    title: "Set an application default workspace",
+    description: "Sets exactly one caller-authorized workspace as the default for the target application and current organization.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, workspaceId: { type: "string", minLength: 1 }, confirm: { type: "boolean" } },
+      required: ["application", "workspaceId"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.setDefault(
+      requiredString(args, "application"),
+      requiredString(args, "workspaceId"),
+      args["confirm"] === true
+    )
+  },
   {
     name: "topolo_list_application_requirements",
     title: "List Topolo application build requirements",
@@ -616,11 +693,21 @@ var TOOLS = [
         Object.entries(query).map(([k, v]) => [k, String(v)])
       ) : void 0;
       const resource = optionalResourceContext(args);
+      let body = args["body"];
+      if (typeof body === "string") {
+        const candidate = body.trim();
+        if (candidate.startsWith("{") || candidate.startsWith("[")) {
+          try {
+            body = JSON.parse(candidate);
+          } catch {
+          }
+        }
+      }
       return topolo.client.request({
         service: service.trim(),
         method,
         path,
-        body: args["body"],
+        body,
         ...normalisedQuery ? { query: normalisedQuery } : {},
         ...resource ? { resource } : {},
         confirm: Boolean(args["confirm"])

package/dist/http.js

@@ -15878,6 +15878,11 @@ function splitService(servicePart) {
 // src/tools.ts
 var APPLICATION_IDS = Object.keys(APPLICATIONS).sort();
 var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
+function requiredString(args, name) {
+  const value = typeof args[name] === "string" ? args[name].trim() : "";
+  if (!value) throw new TopoloMcpPublicError(`${name} is required.`);
+  return value;
+}
 function optionalResourceContext(args) {
   const resourceType = typeof args["resourceType"] === "string" ? args["resourceType"].trim() : "";
   const resourceId = typeof args["resourceId"] === "string" ? args["resourceId"].trim() : "";
@@ -16281,6 +16286,78 @@ var TOOLS = [
       return topolo.client.listBindableResources(application);
     }
   },
+  {
+    name: "topolo_list_workspaces",
+    title: "List workspaces for one Topolo application",
+    description: "Lists caller-visible workspaces and the caller-specific creation policy for one target application. Use this before creating a workspace; organization ownership alone does not imply creation rights for every app.",
+    requiredScopes: [],
+    destructive: false,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 } },
+      required: ["application"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => {
+      const application = requiredString(args, "application");
+      return topolo.workspaces.list(application);
+    }
+  },
+  {
+    name: "topolo_create_workspace",
+    title: "Create a workspace for one Topolo application",
+    description: "Creates a workspace only after reading the target application policy and confirming it permits this caller. The canonical Auth runtime still authorizes the concrete app and organization. Set confirm:true only after approval.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, name: { type: "string", minLength: 1, maxLength: 120 }, isDefault: { type: "boolean" }, confirm: { type: "boolean" } },
+      required: ["application", "name"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.create(requiredString(args, "application"), {
+      name: requiredString(args, "name"),
+      ...typeof args["isDefault"] === "boolean" ? { isDefault: args["isDefault"] } : {},
+      confirm: args["confirm"] === true
+    })
+  },
+  {
+    name: "topolo_rename_workspace",
+    title: "Rename one Topolo application workspace",
+    description: "Renames a caller-authorized workspace without changing its stable id, slug, ownership, membership, or app data.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, workspaceId: { type: "string", minLength: 1 }, name: { type: "string", minLength: 1, maxLength: 120 }, confirm: { type: "boolean" } },
+      required: ["application", "workspaceId", "name"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.rename(
+      requiredString(args, "application"),
+      requiredString(args, "workspaceId"),
+      requiredString(args, "name"),
+      args["confirm"] === true
+    )
+  },
+  {
+    name: "topolo_set_default_workspace",
+    title: "Set an application default workspace",
+    description: "Sets exactly one caller-authorized workspace as the default for the target application and current organization.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, workspaceId: { type: "string", minLength: 1 }, confirm: { type: "boolean" } },
+      required: ["application", "workspaceId"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.setDefault(
+      requiredString(args, "application"),
+      requiredString(args, "workspaceId"),
+      args["confirm"] === true
+    )
+  },
   {
     name: "topolo_list_application_requirements",
     title: "List Topolo application build requirements",
@@ -16430,11 +16507,21 @@ var TOOLS = [
         Object.entries(query).map(([k, v]) => [k, String(v)])
       ) : void 0;
       const resource = optionalResourceContext(args);
+      let body = args["body"];
+      if (typeof body === "string") {
+        const candidate = body.trim();
+        if (candidate.startsWith("{") || candidate.startsWith("[")) {
+          try {
+            body = JSON.parse(candidate);
+          } catch {
+          }
+        }
+      }
       return topolo.client.request({
         service: service.trim(),
         method,
         path,
-        body: args["body"],
+        body,
         ...normalisedQuery ? { query: normalisedQuery } : {},
         ...resource ? { resource } : {},
         confirm: Boolean(args["confirm"])

package/dist/index.js

@@ -3729,10 +3729,19 @@ function mapActionInput(action, input) {
     delete remaining[key];
     return encodeURIComponent(String(value));
   });
-  const explicitQuery = plainObject(remaining.query);
-  delete remaining.query;
-  const explicitBody = Object.prototype.hasOwnProperty.call(remaining, "body") ? remaining.body : void 0;
-  delete remaining.body;
+  const schemaProperties = plainObject(plainObject(action.inputSchema).properties);
+  const schemaOwnsQuery = Object.prototype.hasOwnProperty.call(schemaProperties, "query");
+  const schemaOwnsBody = Object.prototype.hasOwnProperty.call(schemaProperties, "body");
+  let explicitQuery = {};
+  if (!schemaOwnsQuery) {
+    explicitQuery = plainObject(remaining.query);
+    delete remaining.query;
+  }
+  let explicitBody;
+  if (!schemaOwnsBody) {
+    explicitBody = Object.prototype.hasOwnProperty.call(remaining, "body") ? remaining.body : void 0;
+    delete remaining.body;
+  }
   if (action.method === "GET") {
     return {
       path,
@@ -3856,11 +3865,71 @@ var IdentityModule = class {
     return this.client.introspect();
   }
 };
+var ACTIONS = {
+  list: "app_topolo_auth.workspaces.list",
+  create: "app_topolo_auth.workspaces.create",
+  rename: "app_topolo_auth.workspaces.rename",
+  setDefault: "app_topolo_auth.workspaces.default.set"
+};
+var WorkspacesModule = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  async list(application) {
+    const context = await this.resolveContext(application);
+    return this.client.callAction(ACTIONS.list, {
+      org_id: context.organizationId,
+      app_id: context.appId
+    });
+  }
+  async create(application, input) {
+    const current = await this.list(application);
+    if (!current.data.policy.canCreate) {
+      throw new TopoloSdkError(
+        "workspace_creation_not_allowed",
+        `Workspace creation is not allowed for ${current.data.appId}: ${current.data.policy.reason}`
+      );
+    }
+    return this.client.callAction(ACTIONS.create, {
+      organizationId: current.data.organizationId,
+      appId: current.data.appId,
+      name: input.name,
+      ...input.isDefault === void 0 ? {} : { isDefault: input.isDefault }
+    }, { confirm: input.confirm === true });
+  }
+  async rename(application, workspaceId, name, confirm = false) {
+    const context = await this.resolveContext(application);
+    return this.client.callAction(ACTIONS.rename, {
+      workspaceId,
+      organizationId: context.organizationId,
+      appId: context.appId,
+      name
+    }, { confirm });
+  }
+  async setDefault(application, workspaceId, confirm = false) {
+    const context = await this.resolveContext(application);
+    return this.client.callAction(ACTIONS.setDefault, {
+      workspaceId,
+      organizationId: context.organizationId,
+      appId: context.appId
+    }, { confirm });
+  }
+  async resolveContext(application) {
+    const identity = await this.client.introspect();
+    if (!identity.organization?.id) {
+      throw new TopoloSdkError("organization_required", "Workspace lifecycle requires an organization-scoped credential.");
+    }
+    const service = await this.client.getService(application);
+    return { organizationId: identity.organization.id, appId: service.appId };
+  }
+};
 function createTopolo(options) {
   const client = new TopoloClient(options);
   return {
     client,
     identity: new IdentityModule(client),
+    workspaces: new WorkspacesModule(client),
     crm: new CrmModule(client)
   };
 }
@@ -4345,6 +4414,11 @@ function publicMcpErrorMessage(error, fallback) {
 // src/tools.ts
 var APPLICATION_IDS = Object.keys(APPLICATIONS).sort();
 var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
+function requiredString(args, name) {
+  const value = typeof args[name] === "string" ? args[name].trim() : "";
+  if (!value) throw new TopoloMcpPublicError(`${name} is required.`);
+  return value;
+}
 function optionalResourceContext(args) {
   const resourceType = typeof args["resourceType"] === "string" ? args["resourceType"].trim() : "";
   const resourceId = typeof args["resourceId"] === "string" ? args["resourceId"].trim() : "";
@@ -4748,6 +4822,78 @@ var TOOLS = [
       return topolo.client.listBindableResources(application);
     }
   },
+  {
+    name: "topolo_list_workspaces",
+    title: "List workspaces for one Topolo application",
+    description: "Lists caller-visible workspaces and the caller-specific creation policy for one target application. Use this before creating a workspace; organization ownership alone does not imply creation rights for every app.",
+    requiredScopes: [],
+    destructive: false,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 } },
+      required: ["application"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => {
+      const application = requiredString(args, "application");
+      return topolo.workspaces.list(application);
+    }
+  },
+  {
+    name: "topolo_create_workspace",
+    title: "Create a workspace for one Topolo application",
+    description: "Creates a workspace only after reading the target application policy and confirming it permits this caller. The canonical Auth runtime still authorizes the concrete app and organization. Set confirm:true only after approval.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, name: { type: "string", minLength: 1, maxLength: 120 }, isDefault: { type: "boolean" }, confirm: { type: "boolean" } },
+      required: ["application", "name"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.create(requiredString(args, "application"), {
+      name: requiredString(args, "name"),
+      ...typeof args["isDefault"] === "boolean" ? { isDefault: args["isDefault"] } : {},
+      confirm: args["confirm"] === true
+    })
+  },
+  {
+    name: "topolo_rename_workspace",
+    title: "Rename one Topolo application workspace",
+    description: "Renames a caller-authorized workspace without changing its stable id, slug, ownership, membership, or app data.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, workspaceId: { type: "string", minLength: 1 }, name: { type: "string", minLength: 1, maxLength: 120 }, confirm: { type: "boolean" } },
+      required: ["application", "workspaceId", "name"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.rename(
+      requiredString(args, "application"),
+      requiredString(args, "workspaceId"),
+      requiredString(args, "name"),
+      args["confirm"] === true
+    )
+  },
+  {
+    name: "topolo_set_default_workspace",
+    title: "Set an application default workspace",
+    description: "Sets exactly one caller-authorized workspace as the default for the target application and current organization.",
+    requiredScopes: [],
+    destructive: true,
+    inputSchema: {
+      type: "object",
+      properties: { application: { type: "string", minLength: 1 }, workspaceId: { type: "string", minLength: 1 }, confirm: { type: "boolean" } },
+      required: ["application", "workspaceId"],
+      additionalProperties: false
+    },
+    handler: async (topolo, args) => topolo.workspaces.setDefault(
+      requiredString(args, "application"),
+      requiredString(args, "workspaceId"),
+      args["confirm"] === true
+    )
+  },
   {
     name: "topolo_list_application_requirements",
     title: "List Topolo application build requirements",
@@ -4897,11 +5043,21 @@ var TOOLS = [
         Object.entries(query).map(([k, v]) => [k, String(v)])
       ) : void 0;
       const resource = optionalResourceContext(args);
+      let body = args["body"];
+      if (typeof body === "string") {
+        const candidate = body.trim();
+        if (candidate.startsWith("{") || candidate.startsWith("[")) {
+          try {
+            body = JSON.parse(candidate);
+          } catch {
+          }
+        }
+      }
       return topolo.client.request({
         service: service.trim(),
         method,
         path,
-        body: args["body"],
+        body,
         ...normalisedQuery ? { query: normalisedQuery } : {},
         ...resource ? { resource } : {},
         confirm: Boolean(args["confirm"])

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@topolo/mcp",
-  "version": "0.9.9",
-  "topoloPublishedVersion": "0.9.9",
+  "version": "0.9.11",
+  "topoloPublishedVersion": "0.9.11",
   "description": "Model Context Protocol server for the Topolo platform. Exposes scope-gated tools that third-party agents (Claude, Codex, etc.) can call natively.",
   "type": "module",
   "bin": {
@@ -37,7 +37,7 @@
     "@modelcontextprotocol/sdk": "^1.0.0"
   },
   "peerDependencies": {
-    "@topolo/sdk": "^0.9.8"
+    "@topolo/sdk": "^0.9.10"
   },
   "devDependencies": {
     "@topolo/sdk": "file:../topolo-sdk",