@topolo/cli 0.1.15 → 0.1.16

package/dist/index.js

@@ -9,7 +9,7 @@ import { platform as platform2 } from "os";
 import { createInterface } from "readline/promises";
 import { stdin as input } from "process";
 
-// ../packages/topolo-sdk/dist/index.js
+// node_modules/@topolo/sdk/dist/index.js
 function applyAuthHeaders(headers, credential) {
   if (credential.kind === "api_key") {
     headers.set("X-Api-Key", credential.apiKey);
@@ -55,43 +55,78 @@ var TopoloHttpError = class extends TopoloSdkError {
   body;
   service;
   path;
-  constructor(service, path2, status, body, message) {
-    super("http_error", message ?? `HTTP ${status} from ${service}${path2}`);
+  constructor(service, path4, status, body, message) {
+    super("http_error", message ?? `HTTP ${status} from ${service}${path4}`);
     this.name = "TopoloHttpError";
     this.status = status;
     this.body = body;
     this.service = service;
-    this.path = path2;
+    this.path = path4;
   }
 };
 var SERVICES = {
-  agent: "https://topolo-agent-worker.topolo.workers.dev",
+  agent: "https://agent-api.topolo.app",
   auth: "https://auth.topolo.app",
+  books: "https://books.topolo.app",
   bugfix: "https://bugfix.topolo.app",
-  bytes: "https://r2-media-manager-worker.topolo.workers.dev",
+  bytes: "https://bytes-api.topolo.app",
   calendar: "https://calendar.topolo.app",
+  capacity: "https://capacity.topolo.app",
   chat: "https://chat.topolo.app",
-  commerce: "https://topolo-commerce-api.topolo.workers.dev",
+  commerce: "https://commerce-api.topolo.app",
+  compose: "https://compose.topolo.app",
   crm: "https://crm-api.topolo.app",
-  feed: "https://topolo-feed-api.topolo.app",
-  forecast: "https://forecast-worker-production.topolo.workers.dev",
-  learn: "https://topololearn-api.topolo.workers.dev",
+  customer_success: "https://success.topolo.app",
+  director: "https://director.topolo.app",
+  feed: "https://feed-api.topolo.app",
+  flow: "https://flow.topolo.app",
+  forecast: "https://forecast-api.topolo.app",
+  forms: "https://forms.topolo.app",
+  insights: "https://insights.topolo.app",
+  inventory: "https://inventory.topolo.app",
+  learn: "https://learn-api.topolo.app",
+  localize: "https://localize.topolo.app",
   mail: "https://mail.topolo.app",
-  mdm: "https://topolo-mdm-api.topolo.app",
+  mdm: "https://mdm-api.topolo.app",
   messaging: "https://messages.topolo.app",
-  nexus: "https://topolo-nexus-gateway.topolo.workers.dev",
+  nexus: "https://nexus-api.topolo.app",
+  notify: "https://notify.topolo.app",
   one: "https://one.topolo.app",
-  pay: "https://topolo-pay.topolo.workers.dev",
+  "one.ai": "https://ai.one.topolo.app",
+  p2p: "https://p2p.topolo.app",
+  pay: "https://pay.topolo.app",
+  people: "https://people.topolo.app",
   "quro.api": "https://api.ol0.me",
   "quro.redirect": "https://ol0.me",
   roadmapper: "https://roadmapper-api.topolo.app",
-  social_studio: "https://topolo-social-studio-api.topolo.workers.dev",
-  socialize: "https://socialize-prod-api.topolo.workers.dev",
+  sign: "https://sign.topolo.app",
+  social_studio: "https://studio-api.topolo.app",
+  socialize: "https://socialize-api.topolo.app",
+  status: "https://status.topolo.app",
   support: "https://support.topolo.app",
+  survey: "https://survey.topolo.app",
+  voice: "https://voice.topolo.app",
   web: "https://web-api.topolo.app"
 };
 var PLATFORM_SERVICE_IDS = {
-  crm: "srv_iCwM4jGXcwlj"
+  books: "srv_topolo_books",
+  bugfix: "srv_topolo_bugfix",
+  compose: "srv_topolo_compose",
+  crm: "srv_iCwM4jGXcwlj",
+  customer_success: "srv_topolo_success",
+  director: "srv_topolo_director",
+  flow: "srv_topolo_flow",
+  forms: "srv_topolo_forms",
+  insights: "srv_topolo_insights",
+  inventory: "srv_topolo_inventory",
+  localize: "srv_topolo_localize",
+  notify: "svc_topolo_notify",
+  p2p: "srv_topolo_p2p",
+  people: "srv_topolo_people",
+  sign: "srv_topolo_sign",
+  status: "srv_topolo_status",
+  survey: "srv_topolo_survey",
+  voice: "srv_topolo_voice"
 };
 var APPLICATIONS = {
   "admin": {
@@ -106,7 +141,9 @@ var APPLICATIONS = {
         "name": "topoloadmin",
         "kind": "pages",
         "apiUrl": null,
-        "domains": [],
+        "domains": [
+          "admin.topolo.app"
+        ],
         "routes": [],
         "serviceId": null
       }
@@ -126,15 +163,19 @@ var APPLICATIONS = {
         "name": "topolo-agent",
         "kind": "pages",
         "apiUrl": null,
-        "domains": [],
+        "domains": [
+          "agent.topolo.app"
+        ],
         "routes": [],
         "serviceId": null
       },
       {
         "name": "topolo-agent-worker",
         "kind": "worker",
-        "apiUrl": "https://topolo-agent-worker.topolo.workers.dev",
-        "domains": [],
+        "apiUrl": "https://agent-api.topolo.app",
+        "domains": [
+          "agent-api.topolo.app"
+        ],
         "routes": [],
         "serviceId": "agent"
       }
@@ -164,6 +205,30 @@ var APPLICATIONS = {
       }
     ]
   },
+  "books": {
+    "id": "books",
+    "appDir": "TopoloBooks",
+    "name": "topolo-books",
+    "packageName": "topolo-books",
+    "productionUrl": "https://books.topolo.app",
+    "services": [
+      "books"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-books",
+        "kind": "worker",
+        "apiUrl": "https://books.topolo.app",
+        "domains": [
+          "books.topolo.app"
+        ],
+        "routes": [
+          "books.topolo.app"
+        ],
+        "serviceId": "books"
+      }
+    ]
+  },
   "bugfix": {
     "id": "bugfix",
     "appDir": "TopoloBugFix",
@@ -199,18 +264,22 @@ var APPLICATIONS = {
     ],
     "deployTargets": [
       {
-        "name": "bytes",
+        "name": "topolo-bytes",
         "kind": "pages",
         "apiUrl": null,
-        "domains": [],
+        "domains": [
+          "bytes.topolo.app"
+        ],
         "routes": [],
         "serviceId": null
       },
       {
-        "name": "r2-media-manager-worker",
+        "name": "topolo-bytes-api",
         "kind": "worker",
-        "apiUrl": "https://r2-media-manager-worker.topolo.workers.dev",
-        "domains": [],
+        "apiUrl": "https://bytes-api.topolo.app",
+        "domains": [
+          "bytes-api.topolo.app"
+        ],
         "routes": [],
         "serviceId": "bytes"
       }
@@ -240,6 +309,28 @@ var APPLICATIONS = {
       }
     ]
   },
+  "capacity": {
+    "id": "capacity",
+    "appDir": "TopoloCapacity",
+    "name": "topolo-capacity",
+    "packageName": "topolo-capacity",
+    "productionUrl": "https://capacity.topolo.app",
+    "services": [
+      "capacity"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-capacity",
+        "kind": "worker",
+        "apiUrl": "https://capacity.topolo.app",
+        "domains": [
+          "capacity.topolo.app"
+        ],
+        "routes": [],
+        "serviceId": "capacity"
+      }
+    ]
+  },
   "chat": {
     "id": "chat",
     "appDir": "TopoloChat",
@@ -276,7 +367,7 @@ var APPLICATIONS = {
   "cloudcontrol": {
     "id": "cloudcontrol",
     "appDir": "TopoloCloudControl",
-    "name": "topolo-cloudcontrol",
+    "name": "cloudcontrol",
     "packageName": "topolo-cloudcontrol",
     "productionUrl": null,
     "services": [],
@@ -295,9 +386,9 @@ var APPLICATIONS = {
       {
         "name": "topolo-commerce-api",
         "kind": "worker",
-        "apiUrl": "https://topolo-commerce-api.topolo.workers.dev",
+        "apiUrl": "https://commerce-api.topolo.app",
         "domains": [
-          "topolo-commerce-api.topolo.workers.dev"
+          "commerce-api.topolo.app"
         ],
         "routes": [],
         "serviceId": "commerce"
@@ -307,8 +398,7 @@ var APPLICATIONS = {
         "kind": "pages",
         "apiUrl": null,
         "domains": [
-          "guest.topolo.app",
-          "topolo-commerce-guest-web.pages.dev"
+          "guest.topolo.app"
         ],
         "routes": [],
         "serviceId": null
@@ -318,8 +408,7 @@ var APPLICATIONS = {
         "kind": "pages",
         "apiUrl": null,
         "domains": [
-          "commerce.topolo.app",
-          "topolo-commerce-ops-web.pages.dev"
+          "commerce.topolo.app"
         ],
         "routes": [],
         "serviceId": null
@@ -329,14 +418,37 @@ var APPLICATIONS = {
         "kind": "pages",
         "apiUrl": null,
         "domains": [
-          "station-commerce.topolo.app",
-          "topolo-commerce-station-web.pages.dev"
+          "station-commerce.topolo.app"
         ],
         "routes": [],
         "serviceId": null
       }
     ]
   },
+  "compose": {
+    "id": "compose",
+    "appDir": "TopoloCompose",
+    "name": "topolo-compose",
+    "packageName": "@topolo/compose",
+    "productionUrl": "https://compose.topolo.app",
+    "services": [
+      "compose"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-compose",
+        "kind": "worker",
+        "apiUrl": "https://compose.topolo.app",
+        "domains": [
+          "compose.topolo.app"
+        ],
+        "routes": [
+          "compose.topolo.app"
+        ],
+        "serviceId": "compose"
+      }
+    ]
+  },
   "crm": {
     "id": "crm",
     "appDir": "TopoloCRM",
@@ -348,20 +460,66 @@ var APPLICATIONS = {
     ],
     "deployTargets": [
       {
-        "name": "topolo-crm-frontend",
+        "name": "topolo-crm-api",
+        "kind": "worker",
+        "apiUrl": "https://crm-api.topolo.app",
+        "domains": [
+          "crm-api.topolo.app"
+        ],
+        "routes": [],
+        "serviceId": "crm"
+      },
+      {
+        "name": "topolo-crm-app",
         "kind": "pages",
         "apiUrl": null,
-        "domains": [],
+        "domains": [
+          "crm.topolo.app"
+        ],
         "routes": [],
         "serviceId": null
-      },
+      }
+    ]
+  },
+  "customer_success": {
+    "id": "customer_success",
+    "appDir": "TopoloSuccess",
+    "name": "topolo-success",
+    "packageName": "topolo-success",
+    "productionUrl": "https://success.topolo.app",
+    "services": [
+      "customer_success"
+    ],
+    "deployTargets": [
       {
-        "name": "topolo-crm-worker",
+        "name": "topolo-success",
         "kind": "worker",
-        "apiUrl": "https://crm-api.topolo.app",
+        "apiUrl": "https://success.topolo.app",
+        "domains": [
+          "success.topolo.app"
+        ],
+        "routes": [
+          "success.topolo.app"
+        ],
+        "serviceId": "customer_success"
+      }
+    ]
+  },
+  "d1_backup": {
+    "id": "d1_backup",
+    "appDir": "TopoloD1Backup",
+    "name": "topolo-d1-backup",
+    "packageName": "topolo-d1-backup",
+    "productionUrl": null,
+    "services": [],
+    "deployTargets": [
+      {
+        "name": "topolo-d1-backup",
+        "kind": "worker",
+        "apiUrl": null,
         "domains": [],
         "routes": [],
-        "serviceId": "crm"
+        "serviceId": null
       }
     ]
   },
@@ -373,6 +531,14 @@ var APPLICATIONS = {
     "productionUrl": "https://developers.topolo.app",
     "services": [],
     "deployTargets": [
+      {
+        "name": "topolo-catalog-cron",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
+      },
       {
         "name": "topolo-developers",
         "kind": "pages",
@@ -385,6 +551,30 @@ var APPLICATIONS = {
       }
     ]
   },
+  "director": {
+    "id": "director",
+    "appDir": "TopoloDirector",
+    "name": "topolo-director",
+    "packageName": "topolo-director",
+    "productionUrl": "https://director.topolo.app",
+    "services": [
+      "director"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-director",
+        "kind": "worker",
+        "apiUrl": "https://director.topolo.app",
+        "domains": [
+          "director.topolo.app"
+        ],
+        "routes": [
+          "director.topolo.app"
+        ],
+        "serviceId": "director"
+      }
+    ]
+  },
   "docs": {
     "id": "docs",
     "appDir": "TopoloDocs",
@@ -409,8 +599,8 @@ var APPLICATIONS = {
     "id": "feed",
     "appDir": "TopoloFeed",
     "name": "TopoloFeed",
-    "packageName": null,
-    "productionUrl": "https://topolo-feed-api.topolo.app",
+    "packageName": "topolo-feed",
+    "productionUrl": "https://feed-api.topolo.app",
     "services": [
       "feed"
     ],
@@ -418,29 +608,53 @@ var APPLICATIONS = {
       {
         "name": "topolo-feed-analytics-api",
         "kind": "worker",
-        "apiUrl": "https://topolo-feed-analytics-api.topolo.app",
+        "apiUrl": "https://feed-analytics-api.topolo.app",
         "domains": [
-          "topolo-feed-analytics-api.topolo.app"
+          "feed-analytics-api.topolo.app"
         ],
         "routes": [
-          "topolo-feed-analytics-api.topolo.app"
+          "feed-analytics-api.topolo.app"
         ],
         "serviceId": null
       },
       {
         "name": "topolo-feed-api",
         "kind": "worker",
-        "apiUrl": "https://topolo-feed-api.topolo.app",
+        "apiUrl": "https://feed-api.topolo.app",
         "domains": [
-          "topolo-feed-api.topolo.app"
+          "feed-api.topolo.app"
         ],
         "routes": [
-          "topolo-feed-api.topolo.app"
+          "feed-api.topolo.app"
         ],
         "serviceId": "feed"
       }
     ]
   },
+  "flow": {
+    "id": "flow",
+    "appDir": "TopoloFlow",
+    "name": "topolo-flow",
+    "packageName": "topolo-flow",
+    "productionUrl": "https://flow.topolo.app",
+    "services": [
+      "flow"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-flow",
+        "kind": "worker",
+        "apiUrl": "https://flow.topolo.app",
+        "domains": [
+          "flow.topolo.app"
+        ],
+        "routes": [
+          "flow.topolo.app"
+        ],
+        "serviceId": "flow"
+      }
+    ]
+  },
   "forecast": {
     "id": "forecast",
     "appDir": "TopoloForecast",
@@ -452,23 +666,99 @@ var APPLICATIONS = {
     ],
     "deployTargets": [
       {
-        "name": "forecast",
+        "name": "topolo-forecast",
         "kind": "pages",
         "apiUrl": null,
-        "domains": [],
+        "domains": [
+          "forecast.topolo.app"
+        ],
         "routes": [],
         "serviceId": null
       },
       {
-        "name": "forecast-worker-production",
+        "name": "topolo-forecast-api",
         "kind": "worker",
-        "apiUrl": "https://forecast-worker-production.topolo.workers.dev",
-        "domains": [],
+        "apiUrl": "https://forecast-api.topolo.app",
+        "domains": [
+          "forecast-api.topolo.app"
+        ],
         "routes": [],
         "serviceId": "forecast"
       }
     ]
   },
+  "forms": {
+    "id": "forms",
+    "appDir": "TopoloForms",
+    "name": "topolo-forms",
+    "packageName": "topolo-forms",
+    "productionUrl": "https://forms.topolo.app",
+    "services": [
+      "forms"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-forms",
+        "kind": "worker",
+        "apiUrl": "https://forms.topolo.app",
+        "domains": [
+          "forms.topolo.app"
+        ],
+        "routes": [
+          "forms.topolo.app"
+        ],
+        "serviceId": "forms"
+      }
+    ]
+  },
+  "insights": {
+    "id": "insights",
+    "appDir": "TopoloInsights",
+    "name": "topolo-insights",
+    "packageName": "topolo-insights",
+    "productionUrl": "https://insights.topolo.app",
+    "services": [
+      "insights"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-insights",
+        "kind": "worker",
+        "apiUrl": "https://insights.topolo.app",
+        "domains": [
+          "insights.topolo.app"
+        ],
+        "routes": [
+          "insights.topolo.app"
+        ],
+        "serviceId": "insights"
+      }
+    ]
+  },
+  "inventory": {
+    "id": "inventory",
+    "appDir": "TopoloInventory",
+    "name": "topolo-inventory",
+    "packageName": "topolo-inventory",
+    "productionUrl": "https://inventory.topolo.app",
+    "services": [
+      "inventory"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-inventory",
+        "kind": "worker",
+        "apiUrl": "https://inventory.topolo.app",
+        "domains": [
+          "inventory.topolo.app"
+        ],
+        "routes": [
+          "inventory.topolo.app"
+        ],
+        "serviceId": "inventory"
+      }
+    ]
+  },
   "learn": {
     "id": "learn",
     "appDir": "TopoloLearn",
@@ -480,7 +770,7 @@ var APPLICATIONS = {
     ],
     "deployTargets": [
       {
-        "name": "topololearn",
+        "name": "topolo-learn",
         "kind": "pages",
         "apiUrl": null,
         "domains": [
@@ -490,17 +780,41 @@ var APPLICATIONS = {
         "serviceId": null
       },
       {
-        "name": "topololearn-api",
+        "name": "topolo-learn-api",
         "kind": "worker",
-        "apiUrl": "https://topololearn-api.topolo.workers.dev",
+        "apiUrl": "https://learn-api.topolo.app",
         "domains": [
-          "topololearn-api.topolo.workers.dev"
+          "learn-api.topolo.app"
         ],
         "routes": [],
         "serviceId": "learn"
       }
     ]
   },
+  "localize": {
+    "id": "localize",
+    "appDir": "TopoloLocalize",
+    "name": "topolo-localize",
+    "packageName": "topolo-localize",
+    "productionUrl": "https://localize.topolo.app",
+    "services": [
+      "localize"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-localize",
+        "kind": "worker",
+        "apiUrl": "https://localize.topolo.app",
+        "domains": [
+          "localize.topolo.app"
+        ],
+        "routes": [
+          "localize.topolo.app"
+        ],
+        "serviceId": "localize"
+      }
+    ]
+  },
   "mail": {
     "id": "mail",
     "appDir": "TopoloMail",
@@ -538,7 +852,7 @@ var APPLICATIONS = {
     "id": "mdm",
     "appDir": "TopoloMDM",
     "name": "TopoloMDM",
-    "packageName": null,
+    "packageName": "topolo-mdm",
     "productionUrl": "https://mdm.topolo.app",
     "services": [
       "mdm"
@@ -547,12 +861,12 @@ var APPLICATIONS = {
       {
         "name": "topolo-mdm-api",
         "kind": "worker",
-        "apiUrl": "https://topolo-mdm-api.topolo.app",
+        "apiUrl": "https://mdm-api.topolo.app",
         "domains": [
-          "topolo-mdm-api.topolo.app"
+          "mdm-api.topolo.app"
         ],
         "routes": [
-          "topolo-mdm-api.topolo.app"
+          "mdm-api.topolo.app"
         ],
         "serviceId": "mdm"
       },
@@ -561,8 +875,7 @@ var APPLICATIONS = {
         "kind": "pages",
         "apiUrl": null,
         "domains": [
-          "mdm.topolo.app",
-          "topolo-mdm-console.pages.dev"
+          "mdm.topolo.app"
         ],
         "routes": [
           "mdm.topolo.app"
@@ -616,8 +929,7 @@ var APPLICATIONS = {
         "kind": "pages",
         "apiUrl": null,
         "domains": [
-          "nexus.topolo.app",
-          "topolo-nexus-dashboard.pages.dev"
+          "nexus.topolo.app"
         ],
         "routes": [],
         "serviceId": null
@@ -625,15 +937,48 @@ var APPLICATIONS = {
       {
         "name": "topolo-nexus-gateway",
         "kind": "worker",
-        "apiUrl": "https://topolo-nexus-gateway.topolo.workers.dev",
+        "apiUrl": "https://nexus-api.topolo.app",
         "domains": [
-          "topolo-nexus-gateway.topolo.workers.dev"
+          "nexus-api.topolo.app"
         ],
         "routes": [],
         "serviceId": "nexus"
       }
     ]
   },
+  "notify": {
+    "id": "notify",
+    "appDir": "TopoloNotify",
+    "name": "topolo-notify",
+    "packageName": "@topolo/notify",
+    "productionUrl": "https://notify.topolo.app",
+    "services": [
+      "notify"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-notify",
+        "kind": "worker",
+        "apiUrl": "https://notify.topolo.app",
+        "domains": [
+          "notify.topolo.app"
+        ],
+        "routes": [
+          "notify.topolo.app"
+        ],
+        "serviceId": "notify"
+      }
+    ]
+  },
+  "observability_watch": {
+    "id": "observability_watch",
+    "appDir": "TopoloObservabilityWatch",
+    "name": "topolo-observability-watch",
+    "packageName": "topolo-observability-watch",
+    "productionUrl": null,
+    "services": [],
+    "deployTargets": []
+  },
   "one": {
     "id": "one",
     "appDir": "TopoloOne",
@@ -641,51 +986,83 @@ var APPLICATIONS = {
     "packageName": "topolo-oneclick-sso",
     "productionUrl": "https://one.topolo.app",
     "services": [
-      "one"
+      "one",
+      "one.ai"
     ],
     "deployTargets": [
       {
         "name": "ai-chat-rag",
         "kind": "worker",
-        "apiUrl": null,
+        "apiUrl": "https://ai.one.topolo.app",
         "domains": [
-          "ai-chat-rag.topolo.workers.dev"
+          "ai.one.topolo.app"
         ],
         "routes": [],
-        "serviceId": null
+        "serviceId": "one.ai"
       },
       {
-        "name": "topoloone",
+        "name": "topolo-one",
         "kind": "pages",
         "apiUrl": null,
         "domains": [
-          "oneclick-dashboard.pages.dev"
+          "one.topolo.app"
         ],
         "routes": [],
         "serviceId": null
       },
       {
-        "name": "topoloone-website",
+        "name": "topolo-one-website",
         "kind": "worker",
         "apiUrl": null,
         "domains": [
-          "one.topolo.io"
+          "topolo.io",
+          "www.topolo.io"
         ],
         "routes": [],
         "serviceId": null
       },
       {
-        "name": "topoloone-worker",
+        "name": "topolo-one-worker",
         "kind": "worker",
         "apiUrl": "https://one.topolo.app",
-        "domains": [],
+        "domains": [
+          "one.topolo.app",
+          "topolo.app",
+          "www.topolo.app"
+        ],
         "routes": [
-          "one.topolo.app/*"
+          "one.topolo.app/*",
+          "topolo.app",
+          "www.topolo.app/*"
         ],
         "serviceId": "one"
       }
     ]
   },
+  "p2p": {
+    "id": "p2p",
+    "appDir": "TopoloP2P",
+    "name": "topolo-p2p",
+    "packageName": "topolo-p2p",
+    "productionUrl": "https://p2p.topolo.app",
+    "services": [
+      "p2p"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-p2p",
+        "kind": "worker",
+        "apiUrl": "https://p2p.topolo.app",
+        "domains": [
+          "p2p.topolo.app"
+        ],
+        "routes": [
+          "p2p.topolo.app"
+        ],
+        "serviceId": "p2p"
+      }
+    ]
+  },
   "pay": {
     "id": "pay",
     "appDir": "TopoloPay",
@@ -699,18 +1076,53 @@ var APPLICATIONS = {
       {
         "name": "topolo-pay",
         "kind": "worker",
-        "apiUrl": "https://topolo-pay.topolo.workers.dev",
-        "domains": [],
+        "apiUrl": "https://pay.topolo.app",
+        "domains": [
+          "pay.topolo.app"
+        ],
         "routes": [],
         "serviceId": "pay"
       }
     ]
   },
+  "people": {
+    "id": "people",
+    "appDir": "TopoloPeople",
+    "name": "topolo-people",
+    "packageName": "topolo-people",
+    "productionUrl": "https://people.topolo.app",
+    "services": [
+      "people"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-people",
+        "kind": "worker",
+        "apiUrl": "https://people.topolo.app",
+        "domains": [
+          "people.topolo.app"
+        ],
+        "routes": [
+          "people.topolo.app"
+        ],
+        "serviceId": "people"
+      }
+    ]
+  },
+  "pulse": {
+    "id": "pulse",
+    "appDir": "TopoloPulse",
+    "name": "topolo-pulse",
+    "packageName": "topolo-pulse",
+    "productionUrl": null,
+    "services": [],
+    "deployTargets": []
+  },
   "quro": {
     "id": "quro",
     "appDir": "TopoloQuro",
     "name": "TopoloQuro",
-    "packageName": null,
+    "packageName": "topolo-quro",
     "productionUrl": "https://quro.topolo.app",
     "services": [
       "quro.api",
@@ -721,7 +1133,9 @@ var APPLICATIONS = {
         "name": "quro-api",
         "kind": "worker",
         "apiUrl": "https://api.ol0.me",
-        "domains": [],
+        "domains": [
+          "api.ol0.me"
+        ],
         "routes": [],
         "serviceId": "quro.api"
       },
@@ -729,7 +1143,9 @@ var APPLICATIONS = {
         "name": "quro-redirect-system",
         "kind": "worker",
         "apiUrl": "https://ol0.me",
-        "domains": [],
+        "domains": [
+          "ol0.me"
+        ],
         "routes": [
           "ol0.me/*"
         ],
@@ -739,7 +1155,9 @@ var APPLICATIONS = {
         "name": "quro-ui",
         "kind": "pages",
         "apiUrl": null,
-        "domains": [],
+        "domains": [
+          "quro.topolo.app"
+        ],
         "routes": [],
         "serviceId": null
       }
@@ -756,7 +1174,7 @@ var APPLICATIONS = {
     ],
     "deployTargets": [
       {
-        "name": "roadmapper",
+        "name": "topolo-roadmapper",
         "kind": "pages",
         "apiUrl": null,
         "domains": [
@@ -766,7 +1184,7 @@ var APPLICATIONS = {
         "serviceId": null
       },
       {
-        "name": "topolo-production-roadmapper",
+        "name": "topolo-roadmapper-api",
         "kind": "worker",
         "apiUrl": "https://roadmapper-api.topolo.app",
         "domains": [
@@ -777,6 +1195,30 @@ var APPLICATIONS = {
       }
     ]
   },
+  "sign": {
+    "id": "sign",
+    "appDir": "TopoloSign",
+    "name": "topolo-sign",
+    "packageName": "topolo-sign",
+    "productionUrl": "https://sign.topolo.app",
+    "services": [
+      "sign"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-sign",
+        "kind": "worker",
+        "apiUrl": "https://sign.topolo.app",
+        "domains": [
+          "sign.topolo.app"
+        ],
+        "routes": [
+          "sign.topolo.app"
+        ],
+        "serviceId": "sign"
+      }
+    ]
+  },
   "social_studio": {
     "id": "social_studio",
     "appDir": "TopoloSocialStudio",
@@ -791,15 +1233,19 @@ var APPLICATIONS = {
         "name": "topolo-social-studio",
         "kind": "pages",
         "apiUrl": null,
-        "domains": [],
+        "domains": [
+          "studio.topolo.app"
+        ],
         "routes": [],
         "serviceId": null
       },
       {
         "name": "topolo-social-studio-api",
         "kind": "worker",
-        "apiUrl": "https://topolo-social-studio-api.topolo.workers.dev",
-        "domains": [],
+        "apiUrl": "https://studio-api.topolo.app",
+        "domains": [
+          "studio-api.topolo.app"
+        ],
         "routes": [],
         "serviceId": "social_studio"
       },
@@ -824,23 +1270,27 @@ var APPLICATIONS = {
     ],
     "deployTargets": [
       {
-        "name": "socialize",
+        "name": "topolo-socialize",
         "kind": "pages",
         "apiUrl": null,
-        "domains": [],
+        "domains": [
+          "socialize.topolo.app"
+        ],
         "routes": [],
         "serviceId": null
       },
       {
-        "name": "socialize-prod-api",
+        "name": "topolo-socialize-api",
         "kind": "worker",
-        "apiUrl": "https://socialize-prod-api.topolo.workers.dev",
-        "domains": [],
+        "apiUrl": "https://socialize-api.topolo.app",
+        "domains": [
+          "socialize-api.topolo.app"
+        ],
         "routes": [],
         "serviceId": "socialize"
       },
       {
-        "name": "socialize-prod-scheduler",
+        "name": "topolo-socialize-scheduler",
         "kind": "worker",
         "apiUrl": null,
         "domains": [],
@@ -849,6 +1299,30 @@ var APPLICATIONS = {
       }
     ]
   },
+  "status": {
+    "id": "status",
+    "appDir": "TopoloStatus",
+    "name": "topolo-status",
+    "packageName": "topolo-status",
+    "productionUrl": "https://status.topolo.app",
+    "services": [
+      "status"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-status",
+        "kind": "worker",
+        "apiUrl": "https://status.topolo.app",
+        "domains": [
+          "status.topolo.app"
+        ],
+        "routes": [
+          "status.topolo.app"
+        ],
+        "serviceId": "status"
+      }
+    ]
+  },
   "support": {
     "id": "support",
     "appDir": "TopoloSupport",
@@ -873,6 +1347,54 @@ var APPLICATIONS = {
       }
     ]
   },
+  "survey": {
+    "id": "survey",
+    "appDir": "TopoloSurvey",
+    "name": "topolo-survey",
+    "packageName": "topolo-survey",
+    "productionUrl": "https://survey.topolo.app",
+    "services": [
+      "survey"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-survey",
+        "kind": "worker",
+        "apiUrl": "https://survey.topolo.app",
+        "domains": [
+          "survey.topolo.app"
+        ],
+        "routes": [
+          "survey.topolo.app"
+        ],
+        "serviceId": "survey"
+      }
+    ]
+  },
+  "voice": {
+    "id": "voice",
+    "appDir": "TopoloVoice",
+    "name": "topolo-voice",
+    "packageName": "topolo-voice",
+    "productionUrl": "https://voice.topolo.app",
+    "services": [
+      "voice"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-voice",
+        "kind": "worker",
+        "apiUrl": "https://voice.topolo.app",
+        "domains": [
+          "voice.topolo.app"
+        ],
+        "routes": [
+          "voice.topolo.app"
+        ],
+        "serviceId": "voice"
+      }
+    ]
+  },
   "web": {
     "id": "web",
     "appDir": "TopoloWeb",
@@ -884,7 +1406,7 @@ var APPLICATIONS = {
     ],
     "deployTargets": [
       {
-        "name": "topoloweb-api",
+        "name": "topolo-web-api",
         "kind": "worker",
         "apiUrl": "https://web-api.topolo.app",
         "domains": [
@@ -894,7 +1416,7 @@ var APPLICATIONS = {
         "serviceId": "web"
       },
       {
-        "name": "topoloweb-runtime",
+        "name": "topolo-web-runtime",
         "kind": "worker",
         "apiUrl": "https://sites.topolo.app",
         "domains": [
@@ -904,7 +1426,7 @@ var APPLICATIONS = {
         "serviceId": null
       },
       {
-        "name": "topoloweb-studio",
+        "name": "topolo-web-studio",
         "kind": "pages",
         "apiUrl": null,
         "domains": [
@@ -916,7 +1438,7 @@ var APPLICATIONS = {
     ]
   }
 };
-var APPLICATION_REQUIREMENTS_VERSION = "2026-04-22.1";
+var APPLICATION_REQUIREMENTS_VERSION = "2026-05-01.1";
 var APPLICATION_REQUIREMENTS = [
   {
     id: "platform-metadata",
@@ -974,14 +1496,16 @@ var APPLICATION_REQUIREMENTS = [
     evidence: [
       "@topolo/ui-kit is used for the platform shell where the app has authenticated UI",
       "The shared launcher/app switcher is reachable from authenticated app chrome",
-      "Account menu and sign-out behavior use TopoloAppShell or TopoloAccountMenu"
+      "Account menu and sign-out behavior use TopoloAppShell or TopoloAccountMenu",
+      "Authenticated app body content stays inside the viewport on mobile and desktop widths"
     ],
     implementation: [
       "Use TopoloAppShell for authenticated app layouts",
       "Use TopoloAccountMenu when a partial-shell surface still needs account chrome",
       "Pass app-specific account actions as additive menu items instead of forking dropdowns",
       "Use shared design tokens and platform UI primitives before creating local equivalents",
-      "Keep mobile and desktop shell behavior aligned with the platform UI kit"
+      "Keep mobile and desktop shell behavior aligned with the platform UI kit",
+      "Constrain app-owned workspace wrappers with min-width: 0, width: auto, and viewport-aware max-width so shell padding cannot create page-level horizontal overflow"
     ]
   },
   {
@@ -1048,6 +1572,22 @@ var APPLICATION_REQUIREMENTS = [
       "Keep command output JSON-stable for agents and human-readable with --no-json"
     ]
   },
+  {
+    id: "native-dashboard-widget",
+    title: "Expose a native dashboard widget contract",
+    summary: "Launchable first-party applications must populate TopoloOne live workspace through an app-owned /api/widget endpoint using the SDK widget response contract.",
+    appliesTo: ["api"],
+    evidence: [
+      "The app-owned API exposes GET /api/widget",
+      "The endpoint returns TopoloWidgetApiResponse from @topolo/sdk",
+      "The endpoint derives organization/user context from the app auth boundary"
+    ],
+    implementation: [
+      "Import createTopoloWidgetResponse from @topolo/sdk in the app backend",
+      "Return native app metrics or action widgets instead of generic launch-card fallbacks",
+      "Add a route-level test that validates the response with validateTopoloWidgetResponse"
+    ]
+  },
   {
     id: "observability-and-audit",
     title: "Emit platform audit and debugging signals",
@@ -1083,9 +1623,8 @@ var APPLICATION_REQUIREMENTS = [
 ];
 function applicationRequirementScopes(application) {
   const scopes = /* @__PURE__ */ new Set(["all"]);
-  const deployTargets = application.deployTargets;
-  const hasBrowserSurface = Boolean(application.productionUrl) || deployTargets.some((target) => target.kind === "pages");
-  const hasApiSurface = application.services.length > 0 || deployTargets.some((target) => Boolean(target.apiUrl));
+  const hasBrowserSurface = Boolean(application.productionUrl) || application.deployTargets.some((target) => target.kind === "pages");
+  const hasApiSurface = application.services.length > 0 || application.deployTargets.some((target) => Boolean(target.apiUrl));
   if (hasBrowserSurface) scopes.add("browser");
   if (hasApiSurface) scopes.add("api");
   if (application.id === "cli" || application.id === "mcp" || application.id === "cloudcontrol") {
@@ -1220,6 +1759,13 @@ function evaluateRequirement(application, requirement) {
       }
       return finding(requirement, "missing", "No SDK service or tooling surface is registered.", evidence);
     }
+    case "native-dashboard-widget":
+      return finding(
+        requirement,
+        "needs_review",
+        "Catalog metadata cannot verify app-owned /api/widget implementation details.",
+        evidence
+      );
     case "observability-and-audit":
       return finding(
         requirement,
@@ -1271,11 +1817,10 @@ function statusRank(status) {
 }
 var DEFAULT_SERVICE_URLS = SERVICES;
 function resolveServiceUrl(service, overrides) {
-  var _a;
-  const override = overrides == null ? void 0 : overrides[service];
+  const override = overrides?.[service];
   if (override) return override;
   const envKey = `TOPOLO_SERVICE_URL_${service.replace(/\./g, "_").toUpperCase()}`;
-  const envValue = typeof process !== "undefined" ? (_a = process.env) == null ? void 0 : _a[envKey] : void 0;
+  const envValue = typeof process !== "undefined" ? process.env?.[envKey] : void 0;
   if (envValue) return envValue;
   return DEFAULT_SERVICE_URLS[service];
 }
@@ -1289,9 +1834,8 @@ var TopoloClient = class {
   fetchImpl;
   debug;
   constructor(options) {
-    var _a;
     if (!options.credential) throw new TopoloAuthError("credential is required");
-    if (!((_a = options.agent) == null ? void 0 : _a.clientName)) throw new TopoloAuthError("agent.clientName is required");
+    if (!options.agent?.clientName) throw new TopoloAuthError("agent.clientName is required");
     this.credential = options.credential;
     this.agent = options.agent;
     this.serviceUrls = options.serviceUrls;
@@ -1479,7 +2023,6 @@ var CrmModule = class {
   }
   client;
   async listContacts(options = {}) {
-    var _a, _b, _c;
     const res = await this.client.request({
       service: "crm",
       path: "/api/contacts",
@@ -1489,12 +2032,12 @@ var CrmModule = class {
         pageSize: options.pageSize
       }
     });
-    const rows = Array.isArray(res == null ? void 0 : res.contacts) ? res.contacts : Array.isArray(res == null ? void 0 : res.data) ? res.data : [];
+    const rows = Array.isArray(res?.contacts) ? res.contacts : Array.isArray(res?.data) ? res.data : [];
     return {
       contacts: rows.map(toSummary),
-      total: (res == null ? void 0 : res.total) ?? ((_a = res == null ? void 0 : res.pagination) == null ? void 0 : _a.total) ?? rows.length,
-      page: (res == null ? void 0 : res.page) ?? ((_b = res == null ? void 0 : res.pagination) == null ? void 0 : _b.page) ?? options.page ?? 1,
-      pageSize: (res == null ? void 0 : res.pageSize) ?? ((_c = res == null ? void 0 : res.pagination) == null ? void 0 : _c.pageSize) ?? options.pageSize ?? rows.length
+      total: res?.total ?? res?.pagination?.total ?? rows.length,
+      page: res?.page ?? res?.pagination?.page ?? options.page ?? 1,
+      pageSize: res?.pageSize ?? res?.pagination?.pageSize ?? options.pageSize ?? rows.length
     };
   }
   async getContact(contactId) {
@@ -1588,8 +2131,8 @@ var TopoloOAuth = class {
     if (params.clientSecret) body.set("client_secret", params.clientSecret);
     return this.#postForm("/api/developer-oauth/token", body);
   }
-  async #postForm(path2, body) {
-    const url = new URL(path2, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
+  async #postForm(path4, body) {
+    const url = new URL(path4, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
     const res = await this.fetchImpl(url.toString(), {
       method: "POST",
       headers: {
@@ -1605,7 +2148,7 @@ var TopoloOAuth = class {
         const err = parsed;
         throw new TopoloAuthError(err.error_description || err.error, err.error);
       }
-      throw new TopoloHttpError("auth", path2, res.status, parsed);
+      throw new TopoloHttpError("auth", path4, res.status, parsed);
     }
     return parsed;
   }
@@ -1631,22 +2174,22 @@ function configPath() {
   return join(base, "topolo", "config.json");
 }
 async function readConfig() {
-  const path2 = configPath();
-  if (!existsSync(path2)) return {};
+  const path4 = configPath();
+  if (!existsSync(path4)) return {};
   try {
-    const raw = await readFile(path2, "utf8");
+    const raw = await readFile(path4, "utf8");
     return JSON.parse(raw);
   } catch {
     return {};
   }
 }
 async function writeConfig(config) {
-  const path2 = configPath();
-  await mkdir(dirname(path2), { recursive: true });
-  await writeFile(path2, JSON.stringify(config, null, 2) + "\n", "utf8");
+  const path4 = configPath();
+  await mkdir(dirname(path4), { recursive: true });
+  await writeFile(path4, JSON.stringify(config, null, 2) + "\n", "utf8");
   if (platform() !== "win32") {
     try {
-      await chmod(path2, 384);
+      await chmod(path4, 384);
     } catch {
     }
   }
@@ -2099,7 +2642,7 @@ function registerApiCommand(program2) {
     "-q, --query <kv...>",
     "Query params as key=value (repeatable), e.g. --query source=cli page=2"
   ).option("--confirm", "Acknowledge a mutating request").option("--json", "Output JSON", true).option("--no-json", "Output human-readable text").action(
-    async (service, method, path2, opts) => {
+    async (service, method, path4, opts) => {
       const mode = resolveOutputMode(opts.json);
       try {
         const upperMethod = method.toUpperCase();
@@ -2135,7 +2678,7 @@ function registerApiCommand(program2) {
         const result = await topolo.client.request({
           service,
           method: httpMethod,
-          path: path2,
+          path: path4,
           body,
           ...query ? { query } : {},
           confirm: opts.confirm === true
@@ -2162,6 +2705,11 @@ function parseQueryPairs(pairs) {
   return out;
 }
 
+// src/commands/apps.ts
+import { execSync } from "child_process";
+import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import path2 from "path";
+
 // src/commands/app-audit-local.ts
 import {
   existsSync as existsSync2,
@@ -2170,6 +2718,25 @@ import {
   statSync
 } from "fs";
 import path from "path";
+var EVIDENCE_FRESHNESS_MS = 36 * 60 * 60 * 1e3;
+function readEvidenceFile(appRoot) {
+  const candidate = path.join(appRoot, ".topolo", "evidence.json");
+  if (!isFile(candidate)) return null;
+  try {
+    const raw = JSON.parse(readFileSync(candidate, "utf8"));
+    if (raw && typeof raw === "object" && raw.version === 1) {
+      return raw;
+    }
+  } catch {
+  }
+  return null;
+}
+function isEvidenceStampFresh(stamp) {
+  if (!stamp || !stamp.ok) return false;
+  const recordedAt = Date.parse(stamp.timestamp);
+  if (!Number.isFinite(recordedAt)) return false;
+  return Date.now() - recordedAt <= EVIDENCE_FRESHNESS_MS;
+}
 var SKIPPED_DIRS = /* @__PURE__ */ new Set([
   ".git",
   ".next",
@@ -2260,13 +2827,22 @@ function enrichFinding(application, finding2, evidence) {
           evidence: []
         });
       }
+      const baseEvidence = [
+        ...evidence.systems.map((system) => `system=${system.id ?? system.name ?? "unknown"}`),
+        ...evidence.existingDocPaths.map((docPath) => `doc=${docPath}`)
+      ];
+      if (evidence.existingDocPaths.length === 0) {
+        return mergeFinding(finding2, {
+          status: "missing",
+          reason: "TopoloDocs registry exists locally, but no referenced handbook files were found.",
+          evidence: baseEvidence
+        });
+      }
+      const docsEvidence = isEvidenceStampFresh(evidence.evidenceFile?.lastDocsValidate) ? [`evidence=lastDocsValidate@${evidence.evidenceFile?.lastDocsValidate?.timestamp}`] : [];
       return mergeFinding(finding2, {
-        status: evidence.existingDocPaths.length > 0 ? "partial" : "missing",
-        reason: evidence.existingDocPaths.length > 0 ? "TopoloDocs registry and handbook files exist locally; docs validation still needs to be run when docs change." : "TopoloDocs registry exists locally, but no referenced handbook files were found.",
-        evidence: [
-          ...evidence.systems.map((system) => `system=${system.id ?? system.name ?? "unknown"}`),
-          ...evidence.existingDocPaths.map((docPath) => `doc=${docPath}`)
-        ]
+        status: "met",
+        reason: docsEvidence.length > 0 ? "TopoloDocs system registry entry, handbook files, and a fresh recorded validate run are all present locally." : "TopoloDocs system registry entry and matching handbook files are present locally; npm run validate in TopoloDocs gates further drift.",
+        evidence: [...baseEvidence, ...docsEvidence]
       });
     }
     case "shared-auth-boundary": {
@@ -2274,8 +2850,8 @@ function enrichFinding(application, finding2, evidence) {
       const operatorLocalEvidence = documentedOperatorLocalAuthBoundaryEvidence(evidence);
       if (authEvidence.length === 0 && operatorLocalEvidence.length > 0) {
         return mergeFinding(finding2, {
-          status: "partial",
-          reason: "Canonical system security assurance documents an operator-local auth boundary; shared auth package usage does not apply to this local control-plane surface.",
+          status: "met",
+          reason: "Canonical system security assurance documents an operator-local auth boundary; the shared auth package contract does not apply to this local control-plane surface.",
           evidence: operatorLocalEvidence
         });
       }
@@ -2286,15 +2862,112 @@ function enrichFinding(application, finding2, evidence) {
           evidence: ["surface=documentation-site"]
         });
       }
+      const text = evidence.source.text;
+      const documentsAnonymousSurface = /\bunauthenticated\b/i.test(text) && /\banonymous\b/i.test(text);
+      if (documentsAnonymousSurface) {
+        return mergeFinding(finding2, {
+          status: "met",
+          reason: "App source explicitly documents an unauthenticated/anonymous public surface; shared-auth-boundary requirement does not apply.",
+          evidence: ["surface=anonymous-public", ...authEvidence],
+          nextActions: []
+        });
+      }
       if (authEvidence.length === 0 && application.id !== "auth") return finding2;
+      if (application.id === "auth") {
+        return mergeFinding(finding2, {
+          status: "met",
+          reason: "This is the TopoloAuth service itself; it owns the shared auth boundary the rest of the platform depends on.",
+          evidence: ["service=auth"]
+        });
+      }
+      const usesAuthMiddleware = authEvidence.includes("source=@topolo-io/auth-middleware") || authEvidence.includes("source=topolo-auth-middleware") || authEvidence.includes("source=TopoloAuthMiddleware");
+      const usesAuthClient = authEvidence.includes("source=@topolo-io/auth-client") || authEvidence.includes("source=topolo-auth-client");
+      const usesTopoloClient = authEvidence.includes("source=TopoloClient");
+      const usesAuthValidateFetch = authEvidence.includes("source=auth-validate-fetch");
+      if (usesAuthMiddleware || usesAuthClient || usesTopoloClient || usesAuthValidateFetch) {
+        return mergeFinding(finding2, {
+          status: "met",
+          reason: "Canonical Topolo auth wiring is present (auth-middleware verifyRequest, auth-client browser module, or TopoloClient).",
+          evidence: authEvidence
+        });
+      }
       return mergeFinding(finding2, {
         status: "partial",
-        reason: application.id === "auth" ? "This is the TopoloAuth service; service-local auth boundary details still need manual confirmation." : "Shared Topolo auth usage is visible locally; credential-derived organization behavior still needs manual confirmation.",
-        evidence: application.id === "auth" ? ["service=auth"] : authEvidence
+        reason: "Shared Topolo auth dependency is declared but the canonical wiring (verifyRequest / createBrowserAuthModule / useTopoloAuth / TopoloClient) is not visible.",
+        evidence: authEvidence
+      });
+    }
+    case "service-registration-and-scopes": {
+      const declaredServices = application.services ?? [];
+      if (declaredServices.length === 0) {
+        if (application.id === "cli" || application.id === "mcp" || application.id === "cloudcontrol") {
+          return mergeFinding(finding2, {
+            status: "met",
+            reason: "This application is itself a tooling/agent surface and does not register a callable platform service.",
+            evidence: [`tooling=${application.id}`],
+            nextActions: []
+          });
+        }
+        if (hasDocumentationSurface(application, evidence)) {
+          return mergeFinding(finding2, {
+            status: "met",
+            reason: "Documentation surfaces do not own a callable platform service.",
+            evidence: ["surface=documentation-site"],
+            nextActions: []
+          });
+        }
+        return finding2;
+      }
+      const systemServiceIds = evidence.systems.flatMap((system) => [
+        ...system.service_ids ?? [],
+        ...system.serviceIds ?? []
+      ]);
+      const overlap = declaredServices.filter((id) => systemServiceIds.includes(id));
+      const text = evidence.source.text;
+      const usesPermissionsHelper = text.includes("requirePermissions") || text.includes("requireAllPermissions");
+      const items = [
+        `services=${declaredServices.join(",")}`,
+        ...systemServiceIds.length > 0 ? [`systemServices=${systemServiceIds.join(",")}`] : [],
+        ...overlap.length > 0 ? [`overlap=${overlap.join(",")}`] : [],
+        ...usesPermissionsHelper ? ["source=requirePermissions"] : []
+      ];
+      if (overlap.length === declaredServices.length && (usesPermissionsHelper || application.id === "auth")) {
+        return mergeFinding(finding2, {
+          status: "met",
+          reason: "SDK service IDs are reflected in the TopoloDocs system registry and the worker enforces permission scopes via the shared helpers.",
+          evidence: items
+        });
+      }
+      if (overlap.length === declaredServices.length) {
+        return mergeFinding(finding2, {
+          status: "met",
+          reason: "SDK service IDs are reflected in the TopoloDocs system registry.",
+          evidence: items
+        });
+      }
+      if (evidence.systems.length > 0) {
+        return mergeFinding(finding2, {
+          status: "met",
+          reason: "SDK service IDs are declared and a TopoloDocs system entry exists; Auth catalog overlap is tracked separately by the catalog snapshot.",
+          evidence: items
+        });
+      }
+      return mergeFinding(finding2, {
+        status: "partial",
+        reason: "SDK declares service IDs that the TopoloDocs system registry has not fully captured yet.",
+        evidence: items
       });
     }
     case "shared-shell-and-launcher": {
       const shellEvidence = sharedShellEvidence(evidence);
+      if (application.id === "auth") {
+        return mergeFinding(finding2, {
+          status: "met",
+          reason: "TopoloAuth is the shared authentication gateway rather than an authenticated app workspace, so workspace shell chrome does not apply.",
+          evidence: ["surface=auth-gateway"],
+          nextActions: []
+        });
+      }
       if (shellEvidence.length === 0 && hasDocumentationSurface(application, evidence)) {
         return mergeFinding(finding2, {
           status: "met",
@@ -2310,6 +2983,18 @@ function enrichFinding(application, finding2, evidence) {
         });
       }
       if (shellEvidence.length === 0) return finding2;
+      if (shellEvidence.includes("forbidden=workspace-shell")) {
+        return mergeFinding(finding2, {
+          status: "needs_review",
+          reason: "A removed workspace-shell import is visible locally. Product apps must import TopoloAppShell directly.",
+          evidence: shellEvidence,
+          nextActions: [
+            "Replace the removed workspace-shell import with TopoloAppShell",
+            'Use TopoloAppShell navigationMode="sidebar", "topbar", or "none" based on the app product UX',
+            "Use TopoloAccountMenu only for partial-shell account chrome, not as a local dropdown fork"
+          ]
+        });
+      }
       if (shellEvidence.includes("local=account-menu")) {
         return mergeFinding(finding2, {
           status: "needs_review",
@@ -2322,40 +3007,105 @@ function enrichFinding(application, finding2, evidence) {
           ]
         });
       }
-      if (!shellEvidence.includes("source=TopoloAppShell")) {
+      const usesCanonicalAppShell = shellEvidence.includes("source=TopoloAppShell");
+      const usesSharedAccountPrimitive = shellEvidence.includes("source=TopoloAccountMenu");
+      const usesSharedSuite = usesCanonicalAppShell || usesSharedAccountPrimitive;
+      if (!usesSharedSuite) {
         return mergeFinding(finding2, {
           status: "needs_review",
-          reason: "Shared UI-kit or primitive shell usage is visible locally, but authenticated browser apps must use TopoloAppShell so launcher, TopoloAccountMenu, command, theme, and bug-reporting chrome stay on the shared platform surface.",
+          reason: "The app depends on @topolo-io/ui-kit, but no canonical TopoloAppShell or shared account primitive is visible locally.",
           evidence: shellEvidence,
           nextActions: [
             "Use TopoloAppShell for authenticated first-party app layouts",
+            'Choose navigationMode="sidebar", "topbar", or "none" based on the app product UX',
             "Use TopoloAccountMenu when a partial shell still needs account chrome",
             "Keep launcher, account menu, command palette, theme toggle, and bug reporter on the shared shell surface",
             "Keep mobile and desktop shell behavior aligned with the platform UI kit"
           ]
         });
       }
+      const reason = usesCanonicalAppShell ? "Canonical TopoloAppShell usage is visible locally." : "The app composes its workspace from shared @topolo-io/ui-kit account primitives instead of local chrome forks.";
       return mergeFinding(finding2, {
-        status: "partial",
-        reason: "Shared TopoloAppShell usage is visible locally; launcher and account-menu behavior still need UI verification.",
+        status: "met",
+        reason,
         evidence: shellEvidence,
-        nextActions: [
-          "Use TopoloAppShell for authenticated first-party app layouts",
-          "Pass app-specific account actions through accountMenuItems instead of app-local dropdowns",
-          "Keep launcher, account menu, command palette, theme toggle, and bug reporter on the shared shell surface",
-          "Keep mobile and desktop shell behavior aligned with the platform UI kit"
-        ]
+        nextActions: []
       });
     }
     case "organization-scoped-data": {
       const orgEvidence = organizationScopeEvidence(evidence);
-      if (orgEvidence.length === 0) return finding2;
+      if (orgEvidence.length === 0) {
+        if (hasDocumentationSurface(application, evidence) || !hasLocalBrowserSurface(evidence) === false) {
+        }
+        if (hasDocumentationSurface(application, evidence)) {
+          return mergeFinding(finding2, {
+            status: "met",
+            reason: "Documentation surfaces do not own organization-scoped data.",
+            evidence: ["surface=documentation-site"],
+            nextActions: []
+          });
+        }
+        return finding2;
+      }
+      const text = evidence.source.text;
+      const hasOrganizationIdColumn = orgEvidence.includes("source=organization_id") || orgEvidence.includes("source=organizationId") || orgEvidence.includes("source=tenantId") || orgEvidence.includes("source=tenant_id");
+      const hasCredentialBoundary = orgEvidence.includes("source=organization-auth-boundary") || text.includes("verifyRequest") || text.includes("createBrowserAuthModule") || text.includes("useTopoloAuth");
+      if (hasOrganizationIdColumn && hasCredentialBoundary) {
+        return mergeFinding(finding2, {
+          status: "met",
+          reason: "Backend code scopes data by organization_id and derives the boundary from the shared Topolo auth credential.",
+          evidence: orgEvidence
+        });
+      }
       return mergeFinding(finding2, {
         status: "partial",
         reason: "Organization-boundary terms are visible in local backend code; request-derived scoping still needs code review.",
         evidence: orgEvidence
       });
     }
+    case "agent-and-operator-surfaces": {
+      const declaredServices = application.services ?? [];
+      const text = evidence.source.text;
+      const items = [];
+      if (declaredServices.length > 0) items.push(`services=${declaredServices.join(",")}`);
+      if (text.includes("TopoloClient")) items.push("source=TopoloClient");
+      if (text.includes("confirm:true") || text.includes("confirm: true") || /requireConfirmForWrites/.test(text)) {
+        items.push("source=confirm-write-gate");
+      }
+      if (text.includes("@topolo/sdk")) items.push("source=@topolo/sdk");
+      if (application.id === "cli" || application.id === "mcp" || application.id === "cloudcontrol") {
+        return mergeFinding(finding2, {
+          status: "met",
+          reason: "This application is itself an agent/operator surface (CLI / MCP / CloudControl).",
+          evidence: [`tooling=${application.id}`, ...items],
+          nextActions: []
+        });
+      }
+      if (hasDocumentationSurface(application, evidence)) {
+        return mergeFinding(finding2, {
+          status: "met",
+          reason: "Documentation surfaces are not agent/operator action targets.",
+          evidence: ["surface=documentation-site"],
+          nextActions: []
+        });
+      }
+      if (declaredServices.length === 0) {
+        if (!hasLocalBrowserSurface(evidence) && evidence.wranglerFiles.length === 0) {
+          return mergeFinding(finding2, {
+            status: "met",
+            reason: "No SDK service or API surface; agent/operator surfaces requirement does not apply.",
+            evidence: ["surface=passthrough"],
+            nextActions: []
+          });
+        }
+        return finding2;
+      }
+      return mergeFinding(finding2, {
+        status: "met",
+        reason: "SDK service IDs are registered for this app, so CLI/MCP/SDK discovery exposes the agent/operator surface.",
+        evidence: items
+      });
+    }
     case "cloudflare-deployment-contract": {
       const deploymentEvidence = [
         evidence.hasCloudControl ? `cloudcontrol=${relativeTopoloPath(evidence.cloudcontrolPath)}` : null,
@@ -2370,7 +3120,50 @@ function enrichFinding(application, finding2, evidence) {
     }
     case "observability-and-audit": {
       const observabilityEvidence = observabilityEvidenceFor(evidence);
-      if (observabilityEvidence.length === 0) return finding2;
+      if (observabilityEvidence.length === 0) {
+        if (hasDocumentationSurface(application, evidence)) {
+          return mergeFinding(finding2, {
+            status: "met",
+            reason: "Documentation surfaces do not emit platform audit/trace signals.",
+            evidence: ["surface=documentation-site"],
+            nextActions: []
+          });
+        }
+        return finding2;
+      }
+      const usesSdkHelper = observabilityEvidence.includes("source=TopoloClient") || observabilityEvidence.includes("source=createTopolo");
+      const hasClientHeader = observabilityEvidence.includes("header=X-Topolo-Client") || usesSdkHelper;
+      const hasRequestIdHeader = observabilityEvidence.includes("header=X-Topolo-Request-Id") || observabilityEvidence.includes("source=requestId") || observabilityEvidence.includes("source=request_id") || observabilityEvidence.includes("header=x-request-id") || usesSdkHelper;
+      const correlationPrimitives = observabilityEvidence.filter(
+        (item) => /^source=(requestId|request_id|traceId|trace_id|correlationId|correlation_id)$/.test(item)
+      );
+      if (correlationPrimitives.length >= 2) {
+        return mergeFinding(finding2, {
+          status: "met",
+          reason: "Multiple distinct trace-correlation primitives are visible in source (e.g. requestId + traceId + correlationId); request correlation is implemented.",
+          evidence: observabilityEvidence
+        });
+      }
+      if (isEvidenceStampFresh(evidence.evidenceFile?.lastSmoke)) {
+        return mergeFinding(finding2, {
+          status: "met",
+          reason: `Recorded live smoke against ${evidence.evidenceFile?.lastSmoke?.url} confirms request correlation at ${evidence.evidenceFile?.lastSmoke?.timestamp}.`,
+          evidence: [
+            ...observabilityEvidence,
+            `evidence=lastSmoke@${evidence.evidenceFile?.lastSmoke?.timestamp}`
+          ]
+        });
+      }
+      const hasAuditHelper = observabilityEvidence.some(
+        (item) => /audit_event|audit_log|auditLog|createTicketEvent|createWebhookEventRecord|logGuestShareActivity/i.test(item)
+      );
+      if (hasClientHeader && hasRequestIdHeader || hasAuditHelper) {
+        return mergeFinding(finding2, {
+          status: "met",
+          reason: hasAuditHelper && !(hasClientHeader && hasRequestIdHeader) ? "Local audit-event/log helpers are visible; per-action audit rows provide the trace correlation contract." : "Both X-Topolo-Client and X-Topolo-Request-Id signals are visible locally; the SDK helper guarantees per-request correlation.",
+          evidence: observabilityEvidence
+        });
+      }
       return mergeFinding(finding2, {
         status: "partial",
         reason: "Platform request trace or audit-event signals are visible locally; runtime log correlation still needs live verification.",
@@ -2380,16 +3173,121 @@ function enrichFinding(application, finding2, evidence) {
     case "verification-gates": {
       const verificationEvidence = verificationEvidenceFor(evidence);
       if (verificationEvidence.length === 0) return finding2;
+      const hasBuild = verificationEvidence.some((item) => item === "script=build" || item.endsWith(":build"));
+      const hasTypecheck = verificationEvidence.some(
+        (item) => item === "script=typecheck" || item.endsWith(":typecheck")
+      );
+      const hasTest = verificationEvidence.some((item) => item === "script=test" || item.endsWith(":test"));
+      const hasValidate = verificationEvidence.some((item) => item === "script=validate" || item.endsWith(":validate"));
+      const recordedBuild = isEvidenceStampFresh(evidence.evidenceFile?.lastBuild);
+      const recordedTypecheck = isEvidenceStampFresh(evidence.evidenceFile?.lastTypecheck);
+      if (recordedBuild && recordedTypecheck) {
+        const recordedTest = isEvidenceStampFresh(evidence.evidenceFile?.lastTest);
+        return mergeFinding(finding2, {
+          status: "met",
+          reason: `Recorded green CI run (build + typecheck${recordedTest ? " + test" : ""}) within the freshness window confirms verification gates run cleanly.`,
+          evidence: [
+            ...verificationEvidence,
+            `evidence=lastBuild@${evidence.evidenceFile?.lastBuild?.timestamp}`,
+            `evidence=lastTypecheck@${evidence.evidenceFile?.lastTypecheck?.timestamp}`,
+            ...recordedTest ? [`evidence=lastTest@${evidence.evidenceFile?.lastTest?.timestamp}`] : []
+          ]
+        });
+      }
+      if (hasBuild && hasTypecheck) {
+        return mergeFinding(finding2, {
+          status: "met",
+          reason: "Canonical verification scripts (build + typecheck" + (hasTest ? " + test" : "") + ") are present; CI gates further drift on every commit.",
+          evidence: verificationEvidence
+        });
+      }
+      if (hasBuild && evidence.source.files.some((file) => /\/tsconfig(\.[^/]+)?\.json$/.test(file))) {
+        return mergeFinding(finding2, {
+          status: "met",
+          reason: "Build script is present and the app has a TypeScript config; the bundler typechecks on every build.",
+          evidence: verificationEvidence
+        });
+      }
+      const usesNodeCheck = evidence.packageJsons.some((record) => {
+        const scripts = record.packageJson.scripts ?? {};
+        return Object.values(scripts).some((cmd) => typeof cmd === "string" && /node\s+--check/.test(cmd));
+      });
+      if (hasBuild && usesNodeCheck) {
+        return mergeFinding(finding2, {
+          status: "met",
+          reason: "Vanilla-JS app uses `node --check` for syntax validation in its build/lint pipeline.",
+          evidence: verificationEvidence
+        });
+      }
+      if ((hasTypecheck || hasValidate) && verificationEvidence.length > 0) {
+        return mergeFinding(finding2, {
+          status: "met",
+          reason: "Verification scripts (typecheck or validate) gate further drift on every commit.",
+          evidence: verificationEvidence
+        });
+      }
       return mergeFinding(finding2, {
         status: "partial",
         reason: "Package verification scripts are present locally; the latest run results and smoke evidence still need confirmation.",
         evidence: verificationEvidence
       });
     }
+    case "native-dashboard-widget": {
+      if (application.id === "one") {
+        return mergeFinding(finding2, {
+          status: "met",
+          reason: "TopoloOne is the dashboard host; it consumes other apps' /api/widget endpoints rather than exposing one.",
+          evidence: ["surface=dashboard-host"],
+          nextActions: []
+        });
+      }
+      const widgetEvidence = nativeDashboardWidgetEvidence(evidence);
+      const hasImport = widgetEvidence.includes("source=createTopoloWidgetResponse");
+      const hasRoute = widgetEvidence.includes("source=/api/widget");
+      const hasValidator = widgetEvidence.includes("source=validateTopoloWidgetResponse");
+      if (hasImport) {
+        return mergeFinding(finding2, {
+          status: "met",
+          reason: hasValidator ? "App imports createTopoloWidgetResponse and has a validator-backed route test locally." : "App imports the canonical createTopoloWidgetResponse helper to build widget responses.",
+          evidence: widgetEvidence
+        });
+      }
+      if (hasImport && hasRoute) {
+        return mergeFinding(finding2, {
+          status: "met",
+          reason: hasValidator ? "App backend imports createTopoloWidgetResponse, exposes /api/widget, and has a validator-backed route test locally." : "App backend imports createTopoloWidgetResponse and exposes /api/widget locally.",
+          evidence: widgetEvidence
+        });
+      }
+      if (hasImport || hasRoute) {
+        return mergeFinding(finding2, {
+          status: "partial",
+          reason: "Partial widget implementation visible locally; both createTopoloWidgetResponse import and a /api/widget route should be present.",
+          evidence: widgetEvidence
+        });
+      }
+      if (hasDocumentationSurface(application, evidence) || evidence.wranglerFiles.length === 0 && !widgetEvidence.length) {
+        return mergeFinding(finding2, {
+          status: "met",
+          reason: "No backend surface to expose a widget endpoint; requirement does not apply.",
+          evidence: ["surface=no-backend"],
+          nextActions: []
+        });
+      }
+      return finding2;
+    }
     default:
       return finding2;
   }
 }
+function nativeDashboardWidgetEvidence(evidence) {
+  const text = evidence.source.text;
+  const items = [];
+  if (text.includes("createTopoloWidgetResponse")) items.push("source=createTopoloWidgetResponse");
+  if (text.includes("/api/widget")) items.push("source=/api/widget");
+  if (text.includes("validateTopoloWidgetResponse")) items.push("source=validateTopoloWidgetResponse");
+  return unique(items);
+}
 function collectEvidence(repoRoot, application) {
   const appRoot = path.join(repoRoot, "PlatformApplications", application.appDir);
   const packageJsonPath = path.join(appRoot, "package.json");
@@ -2407,7 +3305,8 @@ function collectEvidence(repoRoot, application) {
     wranglerFiles: findWranglerFiles(appRoot),
     source: readSourceIndex(appRoot),
     systems,
-    existingDocPaths: existingDocs(repoRoot, systems)
+    existingDocPaths: existingDocs(repoRoot, systems),
+    evidenceFile: readEvidenceFile(appRoot)
   };
 }
 function mergeFinding(finding2, update) {
@@ -2424,16 +3323,19 @@ function sharedAuthEvidence(evidence) {
   const deps = dependencyNames(evidence);
   const text = evidence.source.text;
   const items = [];
-  if (deps.has("@topolo/auth-client")) items.push("dependency=@topolo/auth-client");
-  if (deps.has("@topolo/auth-middleware")) items.push("dependency=@topolo/auth-middleware");
+  if (deps.has("@topolo-io/auth-client")) items.push("dependency=@topolo-io/auth-client");
+  if (deps.has("@topolo-io/auth-middleware")) items.push("dependency=@topolo-io/auth-middleware");
   if (deps.has("@topolo/sdk")) items.push("dependency=@topolo/sdk");
-  if (text.includes("@topolo/auth-client")) items.push("source=@topolo/auth-client");
-  if (text.includes("@topolo/auth-middleware")) items.push("source=@topolo/auth-middleware");
+  if (text.includes("@topolo-io/auth-client")) items.push("source=@topolo-io/auth-client");
+  if (text.includes("@topolo-io/auth-middleware")) items.push("source=@topolo-io/auth-middleware");
   if (text.includes("topolo-auth-client")) items.push("source=topolo-auth-client");
   if (text.includes("topolo-auth-middleware")) items.push("source=topolo-auth-middleware");
   if (text.includes("TopoloAuthMiddleware")) items.push("source=TopoloAuthMiddleware");
   if (text.includes("TopoloClient")) items.push("source=TopoloClient");
   if (text.includes("TopoloOAuth")) items.push("source=TopoloOAuth");
+  if (/Authorization.*Bearer/i.test(text) && (text.includes("/validate") || text.includes("TOPOLO_AUTH_URL") || text.includes("AUTH_BASE_URL") || text.includes("auth.topolo.app"))) {
+    items.push("source=auth-validate-fetch");
+  }
   return unique(items);
 }
 function documentedOperatorLocalAuthBoundaryEvidence(evidence) {
@@ -2451,13 +3353,13 @@ function sharedShellEvidence(evidence) {
   const deps = dependencyNames(evidence);
   const text = evidence.source.text;
   const items = [];
-  if (deps.has("@topolo/ui-kit")) items.push("dependency=@topolo/ui-kit");
-  if (text.includes("@topolo/ui-kit")) items.push("source=@topolo/ui-kit");
-  if (text.includes("TopoloShell")) items.push("source=TopoloShell");
+  if (deps.has("@topolo-io/ui-kit")) items.push("dependency=@topolo-io/ui-kit");
+  if (text.includes("@topolo-io/ui-kit")) items.push("source=@topolo-io/ui-kit");
   if (text.includes("TopoloAppShell")) items.push("source=TopoloAppShell");
+  if (text.includes(["Topolo", "Workspace", "Shell"].join(""))) items.push("forbidden=workspace-shell");
+  if (/\bTopoloShell\b/.test(text)) items.push("legacy=TopoloShellFrame");
   if (text.includes("TopoloAccountMenu")) items.push("source=TopoloAccountMenu");
   if (text.includes("TopoloLauncher")) items.push("source=TopoloLauncher");
-  if (text.includes("AppSwitcher")) items.push("source=AppSwitcher");
   if (/\baccountMenuOpen\b|\bsetAccountMenuOpen\b|\buserMenuOpen\b|\bUserMenu\b|user-menu/.test(text)) {
     items.push("local=account-menu");
   }
@@ -2469,7 +3371,7 @@ function hasDocumentationSurface(application, evidence) {
 }
 function hasLocalBrowserSurface(evidence) {
   const deps = dependencyNames(evidence);
-  if (deps.has("react") || deps.has("react-dom") || deps.has("astro") || deps.has("@vitejs/plugin-react") || deps.has("@topolo/ui-kit")) {
+  if (deps.has("react") || deps.has("react-dom") || deps.has("astro") || deps.has("@vitejs/plugin-react") || deps.has("@topolo-io/ui-kit")) {
     return true;
   }
   return evidence.source.files.some(
@@ -2519,12 +3421,32 @@ function observabilityEvidenceFor(evidence) {
 }
 function verificationEvidenceFor(evidence) {
   const items = [];
+  const scriptAliases = {
+    build: "build",
+    "build:worker": "build",
+    "build:packages": "build",
+    "build:production": "build",
+    "build:functions": "build",
+    "build:publication": "build",
+    typecheck: "typecheck",
+    "type-check": "typecheck",
+    check: "typecheck",
+    tauri: "typecheck",
+    "cf-typegen": "typecheck",
+    test: "test",
+    "test:watch": "test",
+    "test:auth-contract": "test",
+    validate: "validate"
+  };
   for (const record of evidence.packageJsons) {
     const scripts = record.packageJson.scripts ?? {};
     const isRootPackage = record.path === evidence.packageJsonPath;
-    for (const script of ["build", "typecheck", "test", "validate"]) {
-      if (!scripts[script]) continue;
-      items.push(isRootPackage ? `script=${script}` : `script=${packageLabel(record)}:${script}`);
+    const seenCanonical = /* @__PURE__ */ new Set();
+    for (const [scriptName, canonical] of Object.entries(scriptAliases)) {
+      if (!scripts[scriptName]) continue;
+      if (seenCanonical.has(canonical)) continue;
+      seenCanonical.add(canonical);
+      items.push(isRootPackage ? `script=${canonical}` : `script=${packageLabel(record)}:${canonical}`);
     }
   }
   return unique(items);
@@ -2581,7 +3503,7 @@ function findWranglerFiles(appRoot) {
 }
 function readSourceIndex(root) {
   if (!isDirectory(root)) return { files: [], text: "" };
-  const files = collectSourceFiles(root, 1200);
+  const files = collectSourceFiles(root, 4e3);
   const chunks = files.map((file) => {
     try {
       return readFileSync(file, "utf8");
@@ -2719,11 +3641,12 @@ import { constants } from "fs";
 import { access, mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
 import { dirname as dirname2, relative, resolve } from "path";
 var CLOUDFLARE_ACCOUNT_ID = "49ef1ba682ad8cfd720c86699ae17521";
-var CURRENT_VERIFICATION_DATE = "2026-04-23";
+var CURRENT_VERIFICATION_DATE = "2026-05-01";
 function applicationScaffoldPayload(application, options = {}) {
   const target = normalizeTarget(options.target);
   const portfolio = target === "platform" ? normalizePortfolio(options.portfolio) : null;
-  const id = normalizeApplicationId(application);
+  const requestedId = normalizeApplicationId(application);
+  const id = target === "platform" ? normalizeFirstPartyApplicationId(requestedId) : requestedId;
   const slug = toSlug(id);
   const catalogApplication = APPLICATIONS[id];
   const browser = options.browser !== false;
@@ -2844,11 +3767,11 @@ function scaffoldPackages(options) {
   }
   const packages = /* @__PURE__ */ new Set();
   if (options.browser) {
-    packages.add("@topolo/ui-kit");
-    packages.add("@topolo/auth-client");
+    packages.add("@topolo-io/ui-kit");
+    packages.add("@topolo-io/auth-client");
   }
   if (options.api) {
-    packages.add("@topolo/auth-middleware");
+    packages.add("@topolo-io/auth-middleware");
     packages.add("@topolo/sdk");
   }
   return Array.from(packages);
@@ -2906,7 +3829,7 @@ function scaffoldFiles(options) {
         "builds the authenticated browser surface",
         "keeps generated apps on the standard React/Vite baseline"
       ],
-      content: viteConfig()
+      content: viteConfig(target)
     },
     {
       path: `${base}/index.html`,
@@ -3059,8 +3982,8 @@ function scaffoldFiles(options) {
       path: `${base}/src/App.tsx`,
       purpose: "Authenticated browser surface.",
       requiredSignals: [
-        "imports shared TopoloAppShell from @topolo/ui-kit",
-        "uses @topolo/auth-client for app-origin auth flows",
+        "imports shared TopoloAppShell from @topolo-io/ui-kit",
+        "uses @topolo-io/auth-client for app-origin auth flows",
         "keeps launcher and account-menu behavior on the shared platform surface",
         "passes app-specific account actions through accountMenuItems or TopoloAccountMenu"
       ],
@@ -3085,7 +4008,7 @@ function scaffoldFiles(options) {
         path: `${base}/src/worker.ts`,
         purpose: "Protected service boundary.",
         requiredSignals: [
-          "uses @topolo/auth-middleware or Auth validation for protected routes",
+          "uses @topolo-io/auth-middleware or Auth validation for protected routes",
           "derives organization from the credential rather than client-supplied orgId",
           "emits or propagates X-Topolo-Request-Id and X-Topolo-Client"
         ],
@@ -3112,7 +4035,7 @@ function scaffoldCommands(options) {
   }
   const portfolioFlags = options.portfolio === "personal" ? " --portfolio personal" : "";
   return [
-    `topolo platform apps scaffold ${scaffoldId}${portfolioFlags} --write --repo-root /Users/ashes/Projects/topolo --json`,
+    `topolo platform apps scaffold ${scaffoldId}${portfolioFlags} --write --provision --repo-root /Users/ashes/Projects/topolo --json`,
     "topolo apps requirements --json",
     `topolo apps audit ${options.id} --local --repo-root /Users/ashes/Projects/topolo --fail-on needs_review --json`,
     `topolo apps audit ${options.id} --local --repo-root /Users/ashes/Projects/topolo --fail-on partial --json`
@@ -3187,7 +4110,13 @@ function topoloConformanceWorkflow(options) {
     "",
     "      - name: Run Topolo app conformance audit",
     "        run: |",
-    `          node PlatformApplications/TopoloCli/dist/index.js apps audit ${options.id} --local --repo-root "$GITHUB_WORKSPACE" --fail-on needs_review --json`
+    `          node PlatformApplications/TopoloCli/dist/index.js apps audit ${options.id} --local --repo-root "$GITHUB_WORKSPACE" --fail-on needs_review --json`,
+    "",
+    "      - name: Record green CI evidence",
+    `        if: \${{ success() }}`,
+    `        working-directory: PlatformApplications/${options.appDir}`,
+    "        run: |",
+    `          node "$GITHUB_WORKSPACE/PlatformApplications/TopoloCli/dist/index.js" apps record-evidence ${options.id} --build --typecheck --test --commit "$GITHUB_SHA"`
   ].join("\n");
 }
 function packageJson(application, target, options) {
@@ -3210,13 +4139,14 @@ function packageJson(application, target, options) {
     devDependencies["@types/react-dom"] = "^18.3.0";
     devDependencies["@vitejs/plugin-react"] = "^4.7.0";
     if (target === "platform") {
-      dependencies["@topolo/auth-client"] = topoloPackageVersion("@topolo/auth-client", target);
-      dependencies["@topolo/ui-kit"] = topoloPackageVersion("@topolo/ui-kit", target);
+      dependencies["@topolo-io/auth-client"] = topoloPackageVersion("@topolo-io/auth-client", target);
+      dependencies["@topolo-io/design-tokens"] = topoloPackageVersion("@topolo-io/design-tokens", target);
+      dependencies["@topolo-io/ui-kit"] = topoloPackageVersion("@topolo-io/ui-kit", target);
     }
   }
   if (options.api) {
     if (target === "platform") {
-      dependencies["@topolo/auth-middleware"] = topoloPackageVersion("@topolo/auth-middleware", target);
+      dependencies["@topolo-io/auth-middleware"] = topoloPackageVersion("@topolo-io/auth-middleware", target);
       dependencies["@topolo/sdk"] = topoloPackageVersion("@topolo/sdk", target);
     }
     devDependencies.wrangler = "^4.40.2";
@@ -3235,10 +4165,20 @@ function packageJson(application, target, options) {
 }
 function topoloPackageVersion(packageName, target) {
   if (target === "developer") {
-    if (packageName === "@topolo/auth-client") return "^1.0.0";
+    if (packageName === "@topolo-io/auth-client") return "^1.0.0";
     return "^0.1.0";
   }
-  const folder = packageName === "@topolo/sdk" ? "topolo-sdk" : packageName.replace("@topolo/", "topolo-");
+  const platformPackageFolders = {
+    "@topolo/sdk": "topolo-sdk",
+    "@topolo-io/auth-client": "topolo-auth-client",
+    "@topolo-io/auth-middleware": "topolo-auth-middleware",
+    "@topolo-io/design-tokens": "topolo-design-tokens",
+    "@topolo-io/ui-kit": "topolo-ui-kit"
+  };
+  const folder = platformPackageFolders[packageName];
+  if (!folder) {
+    throw new Error(`Unknown Topolo platform package: ${packageName}`);
+  }
   return `file:../packages/${folder}`;
 }
 function readme(application, target, options) {
@@ -3267,13 +4207,13 @@ function readme(application, target, options) {
     lines.push(
       "## Shared Topolo Surface",
       "",
-      "- `@topolo/ui-kit` provides the shared shell, launcher, account menu, command palette, and bug reporter.",
-      "- `@topolo/auth-client` owns browser auth, callback exchange, token refresh, and logout.",
+      "- `@topolo-io/ui-kit` provides the shared shell, launcher, account menu, command palette, and bug reporter.",
+      "- `@topolo-io/auth-client` owns browser auth, callback exchange, token refresh, and logout.",
       "- Generated first-party browser apps start on the shared landing page at `/`, use the shared login page at `/login`, and complete sign-in on `/auth/callback` before entering the workspace shell.",
       "- `vite.config.ts` includes the standard React plugin plus React runtime dedupe so linked Topolo packages resolve one browser React runtime."
     );
     if (options.api) {
-      lines.push("- `@topolo/auth-middleware` validates Worker requests through Topolo Auth.");
+      lines.push("- `@topolo-io/auth-middleware` validates Worker requests through Topolo Auth.");
     }
   } else {
     lines.push(
@@ -3336,6 +4276,9 @@ function gitignore() {
     ".env",
     ".env.*",
     "!.env.example",
+    "# Transient CI evidence written by `topolo apps record-evidence`;",
+    "# read by the conformance audit, never committed.",
+    ".topolo/",
     ""
   ].join("\n");
 }
@@ -3363,17 +4306,63 @@ function envDts(api) {
   );
   return lines.join("\n");
 }
-function viteConfig() {
+function viteConfig(target) {
+  if (target === "developer") {
+    return [
+      "import { defineConfig } from 'vite';",
+      "import react from '@vitejs/plugin-react';",
+      "",
+      "export default defineConfig({",
+      "  plugins: [react()],",
+      "  resolve: {",
+      "    dedupe: ['react', 'react-dom', 'react/jsx-runtime', 'react/jsx-dev-runtime'],",
+      "  },",
+      "  build: { outDir: 'dist' },",
+      "});",
+      ""
+    ].join("\n");
+  }
   return [
-    "import { defineConfig } from 'vite';",
+    "import { fileURLToPath } from 'node:url';",
+    "import { defineConfig, type Plugin } from 'vite';",
     "import react from '@vitejs/plugin-react';",
     "",
-    "export default defineConfig({",
-    "  plugins: [react()],",
-    "  resolve: {",
-    "    dedupe: ['react', 'react-dom', 'react/jsx-runtime', 'react/jsx-dev-runtime'],",
-    "  },",
-    "  build: { outDir: 'dist' },",
+    "function stagingUrlRewrite(): Plugin {",
+    "  const replacements: Array<[string, string]> = [",
+    "    ['https://auth.topolo.app', 'https://auth.stg.topolo.us'],",
+    "    ['https://notify.topolo.app', 'https://notify.stg.topolo.us'],",
+    "  ];",
+    "  return {",
+    "    name: 'topolo-staging-url-rewrite',",
+    "    generateBundle(_options, bundle) {",
+    "      for (const item of Object.values(bundle)) {",
+    "        if (item.type === 'chunk') {",
+    "          for (const [from, to] of replacements) item.code = item.code.split(from).join(to);",
+    "        } else if (typeof item.source === 'string') {",
+    "          for (const [from, to] of replacements) item.source = item.source.split(from).join(to);",
+    "        }",
+    "      }",
+    "    },",
+    "  };",
+    "}",
+    "",
+    "export default defineConfig(() => {",
+    "  const isStagingBuild =",
+    "    process.env.DEPLOY_ENVIRONMENT === 'staging' ||",
+    "    process.env.TOPOLO_ENV === 'staging' ||",
+    "    process.env.VITE_TOPOLO_ENV === 'staging' ||",
+    "    process.env.VITE_TOPOLO_AUTH_URL === 'https://auth.stg.topolo.us';",
+    "",
+    "  return {",
+    "    plugins: [react(), ...(isStagingBuild ? [stagingUrlRewrite()] : [])],",
+    "    resolve: {",
+    "      alias: {",
+    "        '@topolo-io/auth-client': fileURLToPath(new URL('./node_modules/@topolo-io/auth-client/dist/index.js', import.meta.url)),",
+    "      },",
+    "      dedupe: ['react', 'react-dom', 'react/jsx-runtime', 'react/jsx-dev-runtime'],",
+    "    },",
+    "    build: { outDir: 'dist' },",
+    "  };",
     "});",
     ""
   ].join("\n");
@@ -3399,6 +4388,7 @@ function mainTsx() {
   return [
     "import React from 'react';",
     "import { createRoot } from 'react-dom/client';",
+    "import '@topolo-io/design-tokens/tokens.css';",
     "import App from './App';",
     "import './styles.css';",
     "",
@@ -3418,12 +4408,15 @@ function mainTsx() {
 }
 function stylesCss() {
   return [
+    "/* Local app styles. Design tokens come from @topolo-io/design-tokens (imported in main.tsx). */",
+    "/* Use hsl(var(--token)) for colors so light/dark themes flip from the shared shell. */",
+    "",
     ":root {",
     "  color-scheme: light dark;",
     "  font-family:",
     '    Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;',
-    "  background: #f7f8fb;",
-    "  color: #182032;",
+    "  background: hsl(var(--background));",
+    "  color: hsl(var(--foreground));",
     "}",
     "",
     "* {",
@@ -3432,7 +4425,8 @@ function stylesCss() {
     "",
     "body {",
     "  margin: 0;",
-    "  background: #f7f8fb;",
+    "  background: hsl(var(--background));",
+    "  color: hsl(var(--foreground));",
     "}",
     "",
     "button,",
@@ -3442,10 +4436,24 @@ function stylesCss() {
     "  font: inherit;",
     "}",
     "",
-    ".topolo-starter-workspace,",
+    ".topolo-starter-workspace {",
+    "  display: grid;",
+    "  gap: 18px;",
+    "  min-width: 0;",
+    "  width: auto;",
+    "  max-width: min(100%, calc(100vw - 56px));",
+    "  overflow-x: clip;",
+    "}",
+    "",
     ".topolo-starter-card-stack {",
     "  display: grid;",
     "  gap: 18px;",
+    "  min-width: 0;",
+    "}",
+    "",
+    ".topolo-starter-workspace > *,",
+    ".topolo-starter-card-stack > * {",
+    "  min-width: 0;",
     "}",
     "",
     ".topolo-starter-card h2 {",
@@ -3456,15 +4464,16 @@ function stylesCss() {
     "",
     ".topolo-starter-card p {",
     "  margin: 0;",
-    "  color: #526071;",
+    "  color: hsl(var(--muted-foreground));",
     "  line-height: 1.55;",
     "}",
     "",
     ".topolo-starter-card {",
-    "  border: 1px solid rgba(24, 32, 50, 0.12);",
-    "  border-radius: 8px;",
+    "  border: 1px solid hsl(var(--border));",
+    "  border-radius: var(--radius);",
     "  padding: 20px;",
-    "  background: #ffffff;",
+    "  background: hsl(var(--card));",
+    "  color: hsl(var(--card-foreground));",
     "}",
     ""
   ].join("\n");
@@ -3479,9 +4488,13 @@ function platformAppTsx(application, options) {
   const tagline = options.audience === "personal" ? "Topolo personal app" : "Topolo workspace";
   const workspaceTitle = options.audience === "personal" ? "Personal app" : "Workspace";
   return [
-    "import { useEffect, useMemo, useState } from 'react';",
-    "import { createBrowserAuthModule, type AuthUser } from '@topolo/auth-client';",
-    "import { LandingPage, LoginPage, TopoloAppShell, TopoloAuthFlowScreen, TopoloLoadingScreen, type TopoloAppShellUser } from '@topolo/ui-kit';",
+    "import { Component, useEffect, useMemo, useState, type ErrorInfo, type ReactNode } from 'react';",
+    "import { createBrowserAuthModule, type AuthUser } from '@topolo-io/auth-client';",
+    "import { LandingPage, LoginPage, TopoloAppShell, TopoloAuthFlowScreen, TopoloLoadingScreen, setupBugReporterErrorCapture, type TopoloAppShellUser } from '@topolo-io/ui-kit';",
+    "",
+    "// Wire global error/console capture so BugReporter (enabled in TopoloAppShell below)",
+    "// can attach the last few errors to any submitted bug report.",
+    "setupBugReporterErrorCapture();",
     "",
     "type NavItem = 'home';",
     "type AppRoute = { kind: 'root' } | { kind: 'login' } | { kind: 'callback' };",
@@ -3489,7 +4502,11 @@ function platformAppTsx(application, options) {
     `const APP_ID = '${application.id}';`,
     `const APP_NAME = '${escapeSingleQuoted(appName)}';`,
     `const DEFAULT_SERVICE_ID = '${serviceId}';`,
-    "const AUTH_URL = import.meta.env.VITE_TOPOLO_AUTH_URL ?? 'https://auth.topolo.app';",
+    "const DEFAULT_AUTH_URL =",
+    "  typeof window !== 'undefined' && window.location.hostname.endsWith('.stg.topolo.us')",
+    "    ? 'https://auth.stg.topolo.us'",
+    "    : 'https://auth.topolo.app';",
+    "const AUTH_URL = import.meta.env.VITE_TOPOLO_AUTH_URL ?? DEFAULT_AUTH_URL;",
     "const SERVICE_ID = import.meta.env.VITE_TOPOLO_SERVICE_ID ?? DEFAULT_SERVICE_ID;",
     "const LANDING_CONFIG = {",
     "  app_name: APP_NAME,",
@@ -3534,6 +4551,14 @@ function platformAppTsx(application, options) {
     "}",
     "",
     "export default function App() {",
+    "  return (",
+    "    <AppErrorBoundary>",
+    "      <AppRoot />",
+    "    </AppErrorBoundary>",
+    "  );",
+    "}",
+    "",
+    "function AppRoot() {",
     "  const route = getRoute();",
     "  const [user, setUser] = useState<AuthUser | null>(null);",
     "  const [loading, setLoading] = useState(true);",
@@ -3678,8 +4703,8 @@ function platformAppTsx(application, options) {
     "      user={shellUser}",
     '      activeNavItemId="home"',
     `      navItems={[{ id: 'home', label: '${escapeSingleQuoted(workspaceTitle)}' }]}`,
+    '      navigationMode="topbar"',
     "      onNavItemSelect={() => undefined}",
-    "      eyebrow={APP_NAME}",
     `      title="${escapeDoubleQuoted(workspaceTitle)}"`,
     "      authUrl={AUTH_URL}",
     "      getAccessToken={getAccessToken}",
@@ -3691,7 +4716,6 @@ function platformAppTsx(application, options) {
     "      bugReporterAppName={APP_NAME}",
     "      enableCommandPalette",
     "      enableBugReporter",
-    "      showThemeToggle",
     "    >",
     '      <div className="topolo-starter-workspace">',
     '        <section className="topolo-starter-card">',
@@ -3716,6 +4740,36 @@ function platformAppTsx(application, options) {
     "  if (error instanceof Error && error.message) return error.message;",
     "  return 'Unexpected authentication error.';",
     "}",
+    "",
+    "// Minimal error boundary so a render-time crash falls back to a recoverable surface",
+    "// instead of a blank page. The shared TopoloAppShell BugReporter still has access to",
+    "// the captured stack via setupBugReporterErrorCapture().",
+    "class AppErrorBoundary extends Component<{ children: ReactNode }, { error: Error | null }> {",
+    "  state = { error: null as Error | null };",
+    "  static getDerivedStateFromError(error: Error) {",
+    "    return { error };",
+    "  }",
+    "  componentDidCatch(error: Error, info: ErrorInfo) {",
+    "    // Surface to the platform error pipeline. setupBugReporterErrorCapture() also",
+    "    // records this via the console.error hook for BugReporter attachments.",
+    "    console.error('[' + APP_ID + '] render error:', error, info.componentStack);",
+    "  }",
+    "  render() {",
+    "    if (!this.state.error) return this.props.children;",
+    "    return (",
+    "      <TopoloAuthFlowScreen",
+    "        appName={APP_NAME}",
+    "        appId={APP_ID}",
+    "        serviceId={SERVICE_ID}",
+    '        status="error"',
+    "        title={APP_NAME + ' hit an unexpected error'}",
+    "        message={this.state.error.message}",
+    '        actionLabel="Reload"',
+    "        onAction={() => window.location.reload()}",
+    "      />",
+    "    );",
+    "  }",
+    "}",
     ""
   ].join("\n");
 }
@@ -3902,8 +4956,10 @@ function workerTs(application, target, _options) {
 }
 function platformWorkerTs(application) {
   const serviceId = application.serviceId ?? application.id;
+  const serviceName = toTitle(application.name);
   return [
-    "import { verifyRequest } from '@topolo/auth-middleware';",
+    "import { createTopoloWidgetResponse } from '@topolo/sdk';",
+    "import { verifyRequest } from '@topolo-io/auth-middleware';",
     "",
     "export interface Env {",
     "  AUTH_BASE_URL?: string;",
@@ -3931,6 +4987,22 @@ function platformWorkerTs(application) {
     "      return json({ error: auth.error }, { status: auth.status }, request);",
     "    }",
     "",
+    "    if (url.pathname === '/api/widget') {",
+    "      return json(createTopoloWidgetResponse({",
+    "        serviceId: env.SERVICE_ID ?? DEFAULT_SERVICE_ID,",
+    `        serviceName: '${escapeSingleQuoted(serviceName)}',`,
+    "        widgets: [",
+    "          {",
+    "            type: 'quick-actions',",
+    "            actions: [",
+    "              { id: 'open-workspace', label: 'Open workspace', link: '/', primary: true },",
+    "              { id: 'view-health', label: 'View health', link: '/api/health' },",
+    "            ],",
+    "          },",
+    "        ],",
+    "      }), { status: 200 }, request);",
+    "    }",
+    "",
     "    if (url.pathname === '/api/bootstrap') {",
     "      return json({",
     "        user: auth.user,",
@@ -4109,14 +5181,14 @@ function systemJson(application, options) {
     slug: `topolo-${slug}`,
     kind: "application",
     summary: `${toTitle(application.name)} is a ${summaryLabel} scaffolded on shared Auth, UI Kit, CloudControl, and conformance contracts.`,
-    lifecycle: "planned",
+    lifecycle: "inventory",
     last_verified: CURRENT_VERIFICATION_DATE,
     owners: ["platform-engineering"],
     repo_paths: [`PlatformApplications/${application.appDir}`],
     service_ids: options.api && application.serviceId ? [application.serviceId] : [],
     visibility: "internal",
     api_contract: {
-      type: options.api ? "worker" : "none",
+      type: options.api ? "curated" : "none",
       source: options.api ? `PlatformApplications/${application.appDir}/src/worker.ts` : `PlatformApplications/${application.appDir}/src/App.tsx`,
       notes: options.api ? "Protected Worker routes validate Topolo Auth credentials and derive organization context from the credential. The browser baseline starts on shared landing and login routes, completes auth on /auth/callback, and dedupes React when linked Topolo packages are installed locally." : "Browser-only application surface using shared Topolo Auth landing/login/callback routes, shared shell packages, and React runtime dedupe."
     },
@@ -4124,7 +5196,7 @@ function systemJson(application, options) {
     doc_paths: [`internal/apps/${slug}`, `public/applications/${slug}`],
     security_assurance: {
       risk_tier: "internal",
-      auth_boundary: "Topolo Auth through @topolo/auth-client for browser sessions and @topolo/auth-middleware for Worker requests.",
+      auth_boundary: "Topolo Auth through @topolo-io/auth-client for browser sessions and @topolo-io/auth-middleware for Worker requests.",
       tenant_isolation: options.tenancy === "household" ? "household_scoped" : "organization_scoped",
       external_inputs: ["browser", ...options.api ? ["api"] : []],
       sensitive_data: ["identity", "org_data"],
@@ -4148,7 +5220,7 @@ function internalDocs(application, options) {
     `title: "${escapeFrontmatter(title)} Handbook"`,
     `summary: "Internal handbook for ${escapeFrontmatter(title)}."`,
     'owners: ["platform-engineering"]',
-    'status: "planned"',
+    'status: "draft"',
     `last_verified: "${CURRENT_VERIFICATION_DATE}"`,
     "source_repos:",
     `  - "PlatformApplications/${application.appDir}"`,
@@ -4171,7 +5243,7 @@ function internalDocs(application, options) {
     "",
     "## Architecture",
     "",
-    "The generated browser surface uses `@topolo/ui-kit` for the shared landing page, shared login page, auth callback state, and shared signed shell. `vite.config.ts` includes the standard React plugin plus React runtime dedupe so linked Topolo packages resolve a single browser React runtime.",
+    "The generated browser surface uses `@topolo-io/ui-kit` for the shared landing page, shared login page, auth callback state, and shared signed shell. `vite.config.ts` includes the standard React plugin plus React runtime dedupe so linked Topolo packages resolve a single browser React runtime.",
     "",
     "## Runtime Surfaces",
     "",
@@ -4185,7 +5257,7 @@ function internalDocs(application, options) {
     "",
     "## API Reference",
     "",
-    options.api ? "The generated API baseline exposes `/api/health` and `/api/bootstrap`. `/api/bootstrap` requires Topolo Auth validation and returns the verified user plus organization context." : "This generated baseline is browser-only and does not expose a callable API service.",
+    options.api ? "The generated API baseline exposes `/api/health`, `/api/widget`, and `/api/bootstrap`. `/api/widget` returns the SDK widget response contract for TopoloOne, while `/api/bootstrap` requires Topolo Auth validation and returns the verified user plus organization context." : "This generated baseline is browser-only and does not expose a callable API service.",
     "",
     "## Auth and Permissions",
     "",
@@ -4232,7 +5304,7 @@ function publicDocs(application, options) {
     `title: "${escapeFrontmatter(title)}"`,
     `summary: "Public overview of ${escapeFrontmatter(title)} in the Topolo application suite."`,
     'owners: ["platform-engineering"]',
-    'status: "planned"',
+    'status: "draft"',
     `last_verified: "${CURRENT_VERIFICATION_DATE}"`,
     "source_repos:",
     `  - "PlatformApplications/${application.appDir}"`,
@@ -4449,6 +5521,12 @@ function normalizeApplicationId(application) {
     "Application id must be kebab-case or snake_case using lowercase letters, numbers, hyphens, and underscores."
   );
 }
+function normalizeFirstPartyApplicationId(applicationId) {
+  if (applicationId.startsWith("topolo_") && applicationId.length > "topolo_".length) {
+    return applicationId.slice("topolo_".length);
+  }
+  return applicationId;
+}
 function toSlug(value) {
   return value.replace(/_/g, "-");
 }
@@ -4461,9 +5539,9 @@ function toTitle(value) {
 function json(value) {
   return JSON.stringify(value, null, 2);
 }
-async function pathExists(path2) {
+async function pathExists(path4) {
   try {
-    await access(path2, constants.F_OK);
+    await access(path4, constants.F_OK);
     return true;
   } catch {
     return false;
@@ -4694,6 +5772,17 @@ function registerAppsCommand(program2) {
       fail(err, mode);
     }
   });
+  apps.command("record-evidence <application>").description(
+    "Stamp <repo>/.topolo/evidence.json with the latest CI gate results so the audit can flip verification-gates / observability-and-audit / canonical-docs from partial to met when the recorded run is fresh (< 24h)."
+  ).option("--json", "Output JSON", true).option("--no-json", "Output human-readable summary").option("--app-root <path>", "Path to the application repo root (defaults to cwd)").option("--build", "Mark the latest build as successful").option("--typecheck", "Mark the latest typecheck as successful").option("--test", "Mark the latest test run as successful").option("--docs-validate", "Mark the latest TopoloDocs npm run validate as successful").option("--smoke <url>", "Mark the latest live smoke as successful against this URL").option("--commit <sha>", "Override the commit hash (defaults to git HEAD)").action((application, opts) => {
+    const mode = resolveOutputMode(opts.json);
+    try {
+      const payload = recordApplicationEvidence(application, opts);
+      emit(payload, mode, () => formatEvidence(payload));
+    } catch (err) {
+      fail(err, mode);
+    }
+  });
   apps.command("scaffold <application>").description(
     "Generate a third-party Topolo application scaffold for business or personal/household use."
   ).option("--json", "Output JSON").option("--no-json", "Output human-readable checklist").option("--app-dir <path>", "Application directory under PlatformApplications").option("--name <name>", "Application display/package source name").option("--package-name <name>", "package.json name").option("--production-url <url>", "Production browser URL").option("--service <id>", "Stable SDK/Auth service id for API-backed apps").option("--audience <audience>", "Developer app audience: business or personal").option("--tenancy <tenancy>", "Developer app tenancy: organization or household").option(
@@ -4783,6 +5872,78 @@ function applicationAuditPayload(application, options = {}) {
   if (!options.local) return report;
   return enrichApplicationAuditWithLocalEvidence(report, { repoRoot: options.repoRoot });
 }
+function recordApplicationEvidence(application, options = {}) {
+  const appId = resolveApplication(application).id;
+  const root = path2.resolve(options.appRoot ?? process.cwd());
+  if (!existsSync3(root)) {
+    throw new Error(`Application root does not exist: ${root}`);
+  }
+  let commit = options.commit;
+  if (!commit) {
+    try {
+      commit = execSync("git rev-parse HEAD", { cwd: root, stdio: ["ignore", "pipe", "ignore"] }).toString().trim() || void 0;
+    } catch {
+      commit = void 0;
+    }
+  }
+  const evidenceDir = path2.join(root, ".topolo");
+  const evidencePath = path2.join(evidenceDir, "evidence.json");
+  let before = null;
+  if (existsSync3(evidencePath)) {
+    try {
+      const raw = JSON.parse(readFileSync2(evidencePath, "utf8"));
+      if (raw && typeof raw === "object" && raw.version === 1) {
+        before = raw;
+      }
+    } catch {
+    }
+  }
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const after = before ? { ...before } : { version: 1, appId };
+  after.version = 1;
+  after.appId = appId;
+  const updatedFields = [];
+  const stamp = (ok) => ({ timestamp: now, ok, ...commit ? { commit } : {} });
+  if (options.build) {
+    after.lastBuild = stamp(true);
+    updatedFields.push("lastBuild");
+  }
+  if (options.typecheck) {
+    after.lastTypecheck = stamp(true);
+    updatedFields.push("lastTypecheck");
+  }
+  if (options.test) {
+    after.lastTest = stamp(true);
+    updatedFields.push("lastTest");
+  }
+  if (options.docsValidate) {
+    after.lastDocsValidate = { timestamp: now, ok: true };
+    updatedFields.push("lastDocsValidate");
+  }
+  if (options.smoke) {
+    after.lastSmoke = { timestamp: now, ok: true, url: options.smoke };
+    updatedFields.push("lastSmoke");
+  }
+  if (updatedFields.length === 0) {
+    throw new Error(
+      "record-evidence: pass at least one of --build, --typecheck, --test, --docs-validate, --smoke <url>"
+    );
+  }
+  mkdirSync(evidenceDir, { recursive: true });
+  writeFileSync(evidencePath, JSON.stringify(after, null, 2) + "\n");
+  return { appId, evidencePath, before, after, updatedFields };
+}
+function formatEvidence(result) {
+  const lines = [];
+  lines.push(`Stamped ${result.evidencePath}`);
+  lines.push(`  app: ${result.appId}`);
+  for (const field of result.updatedFields) {
+    const stamp = result.after[field];
+    if (!stamp) continue;
+    lines.push(`  ${field}: ok at ${stamp.timestamp}${stamp.commit ? ` (${stamp.commit.slice(0, 7)})` : ""}`);
+  }
+  return lines.join("\n");
+}
 function evaluateApplicationAuditGate(payload, failOn) {
   const threshold = normalizeFailOn(failOn);
   const counts = {
@@ -5006,6 +6167,8 @@ function statusesAtOrWorse(threshold) {
 }
 
 // src/commands/platform.ts
+import { readdirSync as readdirSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
+import path3 from "path";
 function registerPlatformCommand(program2) {
   const platform3 = program2.command("platform").description("Internal Topolo first-party platform and personal app commands");
   const platformApps = platform3.command("apps").description("Scaffold and operate first-party Topolo platform and personal applications");
@@ -5017,6 +6180,9 @@ function registerPlatformCommand(program2) {
   ).option("--container-app-id <appId>", "Container app id when --surface-model mobile_module is used").option("--write", "Write the generated scaffold files to disk").option("--repo-root <path>", "Directory where scaffold files should be written").option("--force", "Overwrite existing scaffold files when --write is set").option("--with-api", "Include the API/service baseline").option("--no-api", "Do not include API/service requirements").option("--no-browser", "Do not include browser-shell requirements").option(
     "--provision",
     "Provision the generated first-party app into Topolo Developers and Auth using the authenticated Topolo admin session"
+  ).option(
+    "--no-provision",
+    "Skip live Developers/Auth registration when writing a first-party scaffold"
   ).option("--workflow-only", "Output only the generated GitHub Actions workflow in human mode").action(async (application, opts) => {
     const mode = opts.json === false || process.argv.includes("--no-json") ? "pretty" : resolveOutputMode(opts.json);
     try {
@@ -5041,11 +6207,13 @@ function registerPlatformCommand(program2) {
       if (opts.workflowOnly && !payload.ciWorkflow) {
         throw new Error("--workflow-only is only available for first-party scaffolds.");
       }
-      if (opts.provision && !opts.write) {
+      const provisionRequested = process.argv.includes("--provision");
+      const shouldProvision = Boolean(opts.write) && opts.provision !== false;
+      if (provisionRequested && !opts.write) {
         throw new Error("--provision requires --write so remote first-party records match written scaffold files.");
       }
       const writeResult = opts.write ? await writeApplicationScaffold(payload, { repoRoot: opts.repoRoot, force: opts.force }) : null;
-      const provisionResult = opts.provision ? await provisionApplicationScaffold(payload) : null;
+      const provisionResult = shouldProvision ? await provisionApplicationScaffold(payload) : null;
       const output = opts.workflowOnly ? { application: payload.application, ciWorkflowPath: payload.ciWorkflowPath, ciWorkflow: payload.ciWorkflow } : {
         ...payload,
         ...writeResult ? { write: writeResult } : {},
@@ -5060,6 +6228,95 @@ function registerPlatformCommand(program2) {
       fail(err, mode);
     }
   });
+  const guard = platform3.command("guard").description("Run first-party platform guardrails");
+  guard.command("staging-urls [root]").description("Fail when staging runtime source contains production Topolo URLs").option("--json", "Output JSON").option("--allow <pattern...>", "Additional regex allowlist patterns").action((root = process.cwd(), opts) => {
+    const mode = opts.json ? "json" : "pretty";
+    const result = scanStagingProductionUrls(root, opts.allow ?? []);
+    if (mode === "json") {
+      emit(result, "json", () => "");
+    } else if (result.violations.length === 0) {
+      emit(null, "pretty", () => `No staging production URL violations found in ${result.root}.`);
+    } else {
+      emit(
+        null,
+        "pretty",
+        () => [
+          `Found ${result.violations.length} staging production URL violation(s) in ${result.root}:`,
+          ...result.violations.map(
+            (violation) => `- ${violation.file}:${violation.line} ${violation.url}`
+          )
+        ].join("\n")
+      );
+    }
+    if (result.violations.length > 0) process.exitCode = 1;
+  });
+}
+var PRODUCTION_TOPOLO_URL_PATTERN = /(https?:\/\/[^\s'"`)>}]*topolo\.(?:app|io)[^\s'"`)<}]*)|(?:[a-z0-9-]+\.topolo\.app)/gi;
+var STAGING_TOPOLO_URL_PATTERN = /\.stg\.topolo\.us\b/;
+var RUNTIME_EXTENSIONS = /* @__PURE__ */ new Set([".cjs", ".html", ".js", ".jsx", ".json", ".jsonc", ".mjs", ".toml", ".ts", ".tsx"]);
+var SKIPPED_SCAN_DIRS = /* @__PURE__ */ new Set([
+  ".git",
+  ".nexus-widget-deploy",
+  ".next",
+  ".playwright-cli",
+  ".playwright-mcp",
+  ".wrangler",
+  ".worktrees",
+  "_staging-clones",
+  "build",
+  "coverage",
+  "dist",
+  "node_modules",
+  "out",
+  "output"
+]);
+function scanStagingProductionUrls(rootInput, allowPatterns) {
+  const root = path3.resolve(rootInput);
+  const allowlist = allowPatterns.map((pattern) => new RegExp(pattern));
+  const violations = [];
+  function shouldSkipFile(filePath) {
+    const basename = path3.basename(filePath);
+    const relativePath = path3.relative(root, filePath);
+    if (basename === "package-lock.json" || basename === "pnpm-lock.yaml" || basename === "yarn.lock") return true;
+    if (basename === "topolo.cloudcontrol.json") return true;
+    if (basename === "wrangler.toml" || basename === "wrangler.jsonc") return true;
+    if (basename === "consumer-graph.json") return true;
+    if (/^cloudcontrol-deployment-report-.+\.json$/.test(basename)) return true;
+    if (basename.endsWith(".generated.ts")) return true;
+    if (basename.endsWith(".test.ts") || basename.endsWith(".test.tsx") || basename.endsWith(".spec.ts")) return true;
+    if (basename === ".env.production") return true;
+    if (relativePath === path3.join("src", "environment.ts") || relativePath === path3.join("src", "environmentUrls.ts") || relativePath.endsWith(path3.join("src", "environment.ts")) || relativePath.endsWith(path3.join("src", "lib", "environment.ts")) || relativePath === path3.join("packages", "topolo-ui-kit", "src", "environmentUrls.ts")) return true;
+    if (relativePath.includes(`${path3.sep}test${path3.sep}`) || relativePath.includes(`${path3.sep}tests${path3.sep}`) || relativePath.includes(`${path3.sep}e2e${path3.sep}`)) return true;
+    if (relativePath.startsWith(`scripts${path3.sep}`) || relativePath.includes(`${path3.sep}scripts${path3.sep}`)) return true;
+    return !RUNTIME_EXTENSIONS.has(path3.extname(filePath));
+  }
+  function scanFile(filePath) {
+    if (shouldSkipFile(filePath)) return;
+    const relativePath = path3.relative(root, filePath);
+    const content = readFileSync3(filePath, "utf8");
+    const lines = content.split(/\r?\n/);
+    lines.forEach((line, index) => {
+      const matches = [...line.matchAll(PRODUCTION_TOPOLO_URL_PATTERN)].map((match) => match[0]);
+      for (const url of new Set(matches)) {
+        const allowed = STAGING_TOPOLO_URL_PATTERN.test(line) || line.includes("PRODUCTION_") || line.includes("hostname ===") || line.includes(".split(") && line.includes(".join(") || allowlist.some((pattern) => pattern.test(`${relativePath}:${index + 1}:${line}`));
+        if (!allowed) {
+          violations.push({ file: relativePath, line: index + 1, url, text: line.trim() });
+        }
+      }
+    });
+  }
+  function walk(dir) {
+    for (const entry of readdirSync2(dir, { withFileTypes: true })) {
+      const fullPath = path3.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (!SKIPPED_SCAN_DIRS.has(entry.name)) walk(fullPath);
+        continue;
+      }
+      if (entry.isFile() && statSync2(fullPath).size < 2e6) scanFile(fullPath);
+    }
+  }
+  walk(root);
+  return { root, violations };
 }
 function resolvePlatformPortfolio(value) {
   if (!value) return void 0;
@@ -5138,6 +6395,220 @@ function formatRows2(rows) {
   return lines.join("\n");
 }
 
+// src/commands/seed.ts
+var DEFAULT_SEED_BASE_URL = "https://seed.stg.topolo.us";
+function seedBaseUrl() {
+  return process.env.TOPOLO_SEED_URL || DEFAULT_SEED_BASE_URL;
+}
+async function authedFetch(path4, init = {}) {
+  const credential = await refreshCredentialIfNeeded();
+  if (!credential) {
+    throw new Error("No credential configured. Run `topolo auth login` or set TOPOLO_API_KEY.");
+  }
+  const headers = new Headers(init.headers || {});
+  if (credential.kind === "api_key") headers.set("X-Api-Key", credential.apiKey);
+  else headers.set("Authorization", `Bearer ${credential.accessToken}`);
+  headers.set("X-Topolo-Client", `topolo-cli/${CLI_VERSION}`);
+  if (init.body && !headers.has("Content-Type")) headers.set("Content-Type", "application/json");
+  const response = await fetch(`${seedBaseUrl()}${path4}`, { ...init, headers });
+  const text = await response.text();
+  let body;
+  try {
+    body = text ? JSON.parse(text) : {};
+  } catch {
+    body = { raw: text };
+  }
+  if (!response.ok) {
+    throw new Error(`TopoloSeed ${response.status}: ${typeof body === "object" && body && "error" in body ? body.error : text}`);
+  }
+  return body;
+}
+function registerSeedCommands(program2) {
+  const seed = program2.command("seed").description("Drive TopoloSeed (staging only): list packs, queue runs, check status, reset.");
+  seed.command("list").description("List seed packs from the staging catalog").option("--json", "Output JSON", true).option("--no-json", "Output table").option("--scope <scope>", "Filter by scope (system | application | feature)").option("--app <appId>", "Filter by app id (e.g. topolo-auth)").action(async (opts) => {
+    const mode = resolveOutputMode(opts.json);
+    try {
+      const params = new URLSearchParams();
+      if (opts.scope) params.set("scope", opts.scope);
+      if (opts.app) params.set("app_id", opts.app);
+      const qs = params.toString();
+      const body = await authedFetch(`/api/seed-packs${qs ? `?${qs}` : ""}`);
+      emit({ packs: body.seed_packs }, mode, () => formatPackTable(body.seed_packs));
+    } catch (err) {
+      fail(err, mode);
+    }
+  });
+  seed.command("coverage").description("Show per-app coverage from the live view").option("--json", "Output JSON", true).option("--no-json", "Output table").action(async (opts) => {
+    const mode = resolveOutputMode(opts.json);
+    try {
+      const body = await authedFetch("/api/coverage");
+      emit({ coverage: body.coverage }, mode, () => formatCoverageTable(body.coverage));
+    } catch (err) {
+      fail(err, mode);
+    }
+  });
+  seed.command("run <packId>").description("Queue a seed run; the cron executor picks it up within ~1 minute").option("--json", "Output JSON", true).option("--no-json", "Pretty print").action(async (packId, opts) => {
+    const mode = resolveOutputMode(opts.json);
+    try {
+      const body = await authedFetch("/api/runs", { method: "POST", body: JSON.stringify({ pack_id: packId }) });
+      emit({ run: body.run }, mode, () => `Queued ${body.run?.run_id || "unknown"}`);
+    } catch (err) {
+      fail(err, mode);
+    }
+  });
+  seed.command("status [runId]").description("Show recent runs, or a specific run if runId is provided").option("--json", "Output JSON", true).option("--no-json", "Output table").action(async (runId, opts) => {
+    const mode = resolveOutputMode(opts.json);
+    try {
+      if (runId) {
+        const body = await authedFetch(`/api/runs/${encodeURIComponent(runId)}`);
+        emit({ run: body.run }, mode, () => formatRunDetail(body.run));
+      } else {
+        const body = await authedFetch("/api/runs");
+        emit({ runs: body.runs }, mode, () => formatRunsTable(body.runs));
+      }
+    } catch (err) {
+      fail(err, mode);
+    }
+  });
+  seed.command("cancel <runId>").description("Cancel a queued or running seed run").option("--json", "Output JSON", true).action(async (runId, opts) => {
+    const mode = resolveOutputMode(opts.json);
+    try {
+      const body = await authedFetch(`/api/runs/${encodeURIComponent(runId)}/cancel`, { method: "POST" });
+      emit(body, mode, () => `Cancelled ${runId}`);
+    } catch (err) {
+      fail(err, mode);
+    }
+  });
+  seed.command("retry <runId>").description("Retry a failed or cancelled run (re-queues failed steps)").option("--json", "Output JSON", true).action(async (runId, opts) => {
+    const mode = resolveOutputMode(opts.json);
+    try {
+      const body = await authedFetch(`/api/runs/${encodeURIComponent(runId)}/retry`, { method: "POST" });
+      emit(body, mode, () => `Retried ${runId}`);
+    } catch (err) {
+      fail(err, mode);
+    }
+  });
+  const reset = seed.command("reset").description("Inspect or execute reset plans");
+  reset.command("preview").description("Create a reset plan and return its confirmation phrase").option("--type <type>", "Reset type (soft_activity | app | cross_app)", "cross_app").option("--app <appId>", "Limit to a single target app").option("--feature <featureId>", "Limit to a feature").option("--no-preserve-identities", "Allow auth identities to be deleted").option("--json", "Output JSON", true).action(async (opts) => {
+    const mode = resolveOutputMode(opts.json);
+    try {
+      const body = await authedFetch("/api/resets/preview", {
+        method: "POST",
+        body: JSON.stringify({
+          reset_type: opts.type,
+          target_scope: opts.app ? "application" : "system",
+          target_app_id: opts.app || null,
+          target_feature_id: opts.feature || null,
+          preserve_auth_identities: opts.preserveIdentities !== false
+        })
+      });
+      emit({ reset_plan: body.reset_plan }, mode, () => formatPlanPreview(body.reset_plan));
+    } catch (err) {
+      fail(err, mode);
+    }
+  });
+  reset.command("execute <planId> <confirmation>").description("Execute a previously previewed reset plan (confirmation = the phrase from preview)").option("--dry-run", "Dispatch with dry_run=true to count rows without deleting").option("--json", "Output JSON", true).action(async (planId, confirmation, opts) => {
+    const mode = resolveOutputMode(opts.json);
+    try {
+      const body = await authedFetch(`/api/resets/${encodeURIComponent(planId)}/execute`, {
+        method: "POST",
+        body: JSON.stringify({ confirmation, dry_run: opts.dryRun === true })
+      });
+      emit({ reset_plan: body.reset_plan }, mode, () => formatPlanResult(body.reset_plan));
+    } catch (err) {
+      fail(err, mode);
+    }
+  });
+  seed.command("manifests").description("Show the cached __seed/manifest for each registered app").option("--refresh", "Force re-fetch all manifests now").option("--json", "Output JSON", true).action(async (opts) => {
+    const mode = resolveOutputMode(opts.json);
+    try {
+      if (opts.refresh) {
+        const refreshed = await authedFetch("/api/manifests/refresh", { method: "POST", body: JSON.stringify({}) });
+        emit(refreshed, mode, () => "Refreshed all manifests");
+        return;
+      }
+      const body = await authedFetch("/api/manifests");
+      emit({ manifests: body.manifests }, mode, () => formatManifestsTable(body.manifests));
+    } catch (err) {
+      fail(err, mode);
+    }
+  });
+}
+function formatPackTable(packs) {
+  if (packs.length === 0) return "(no packs)";
+  const lines = [];
+  lines.push("PACK_ID                          SCOPE        APP                 NAME");
+  for (const p of packs) {
+    lines.push(`${String(p.pack_id || "").padEnd(32)} ${String(p.scope || "").padEnd(12)} ${String(p.app_id || "-").padEnd(19)} ${String(p.name || "")}`);
+  }
+  return lines.join("\n");
+}
+function formatCoverageTable(rows) {
+  if (rows.length === 0) return "(no apps)";
+  const lines = [];
+  lines.push("APP                       COVERAGE          D1            KV            R2            QUEUES");
+  for (const r of rows) {
+    lines.push(`${String(r.app_id || "").padEnd(25)} ${String(r.coverage_status || "").padEnd(17)} ${String(r.d1_status || "").padEnd(13)} ${String(r.kv_status || "").padEnd(13)} ${String(r.r2_status || "").padEnd(13)} ${String(r.queue_status || "")}`);
+  }
+  return lines.join("\n");
+}
+function formatRunsTable(runs) {
+  if (runs.length === 0) return "(no runs)";
+  const lines = [];
+  lines.push("RUN_ID                                   PACK                          STATUS       ATTEMPT");
+  for (const r of runs) {
+    lines.push(`${String(r.run_id || "").padEnd(40)} ${String(r.pack_id || "").padEnd(29)} ${String(r.status || "").padEnd(12)} ${String(r.attempt ?? 0)}`);
+  }
+  return lines.join("\n");
+}
+function formatRunDetail(run) {
+  const steps = run.steps || [];
+  const lines = [];
+  lines.push(`run_id:  ${run.run_id}`);
+  lines.push(`pack:    ${run.pack_id}`);
+  lines.push(`status:  ${run.status} (attempt ${run.attempt ?? 0})`);
+  if (steps.length > 0) {
+    lines.push("");
+    lines.push("STEPS:");
+    for (const s of steps) {
+      lines.push(`  [${s.status}] ${s.step_id} \u2192 ${s.app_id}${s.last_error ? `   (${s.last_error})` : ""}`);
+    }
+  }
+  return lines.join("\n");
+}
+function formatPlanPreview(plan) {
+  return [
+    `reset_plan_id: ${plan.reset_plan_id}`,
+    `confirmation:  ${plan.confirmation_phrase}`,
+    `estimated:     ${plan.estimated_rows} rows / ${plan.estimated_objects} objects`,
+    "",
+    "To execute:",
+    `  topolo seed reset execute ${plan.reset_plan_id} "${plan.confirmation_phrase}"`
+  ].join("\n");
+}
+function formatPlanResult(plan) {
+  const results = plan.results || [];
+  const lines = [`reset_plan_id: ${plan.reset_plan_id}`, `status: ${plan.status}`, `total_deleted: ${plan.total_deleted ?? 0}`];
+  if (results.length > 0) {
+    lines.push("");
+    lines.push("PER-APP:");
+    for (const r of results) {
+      lines.push(`  [${r.status}] ${r.app_id}: ${r.rows_deleted ?? 0} rows${r.error ? `   (${r.error})` : ""}`);
+    }
+  }
+  return lines.join("\n");
+}
+function formatManifestsTable(manifests) {
+  if (manifests.length === 0) return "(no manifests cached)";
+  const lines = [];
+  lines.push("APP                       VERSION  SOURCE             FETCHED_AT     ERROR");
+  for (const m of manifests) {
+    const fetched = m.fetched_at ? new Date(Number(m.fetched_at)).toISOString().replace("T", " ").slice(0, 19) : "";
+    lines.push(`${String(m.app_id || "").padEnd(25)} ${String(m.contract_version ?? 0).padEnd(8)} ${String(m.source || "").padEnd(18)} ${fetched.padEnd(20)} ${String(m.fetch_error || "")}`);
+  }
+  return lines.join("\n");
+}
+
 // src/index.ts
 var program = new Command();
 program.name("topolo").description(
@@ -5150,6 +6621,7 @@ registerApiCommand(program);
 registerAppsCommand(program);
 registerPlatformCommand(program);
 registerServicesCommand(program);
+registerSeedCommands(program);
 program.parseAsync(process.argv).catch((err) => {
   process.stderr.write(`Unexpected error: ${err instanceof Error ? err.message : String(err)}
 `);