@topolo/cli 0.6.10 → 0.7.1

package/README.md

@@ -153,6 +153,7 @@ and the CLI calls them through the shared SDK.
 
 ```bash
 topolo actions --service mail --json
+topolo actions --service mail --detail --json
 topolo actions get app_topolo_mail.messages.send --json
 topolo actions call app_topolo_mail.messages.send \
   --data '{"mailboxId":"primary","subject":"Hello","text":"..."}' \
@@ -163,6 +164,11 @@ Use `topolo actions` before `topolo api` when an app has published a machine
 contract for the operation. `topolo api` remains the escape hatch for endpoints
 that are not yet in the action catalog.
 
+Action search, capability discovery, validation, and planning return compact
+agent guidance by default. Use `--detail` only when the full schemas and agent
+contract are required. `topolo resources --service <app>` is accepted alongside
+the positional application selector.
+
 Workspace-scoped actions carry resource context independently from the active
 personal/organization credential and independently from the browser session:
 
@@ -215,8 +221,9 @@ Agents should call `topolo apps requirements <app> --json` before creating or
 expanding a Topolo app. The output is the versioned platform contract for app
 metadata, canonical docs, shared auth, shared shell, service registration,
 deployment metadata, agent surfaces, observability, and verification.
-`topolo apps audit --json` turns the same contract into per-app scores and a
-catalog-backed migration queue. Add `--local --repo-root <topolo-checkout>` to
+`topolo apps audit --json` returns compact per-app scores and a migration queue
+count. Add `--detail` for every finding and migration item, or
+`--local --repo-root <topolo-checkout>` to
 include filesystem evidence from the app repo, CloudControl metadata, and
 TopoloDocs. Add `--fail-on needs_review` for the default new-work gate, or
 `--fail-on partial` for strict release readiness.

package/dist/index.js

@@ -110,57 +110,8 @@ var TopoloHttpError = class extends TopoloSdkError {
   }
 };
 var APP_API_URLS = {
-  agent: "https://agent.topolo.app",
   auth: "https://auth.topolo.app",
-  backup: "https://backup.topolo.app",
-  blog: "https://blog.topolo.app",
-  books: "https://books.topolo.app",
-  brand: "https://brand.topolo.app",
-  bugfix: "https://bugfix.topolo.app",
-  bytes: "https://bytes.topolo.app",
-  calendar: "https://calendar.topolo.app",
-  campaigns: "https://campaigns.topolo.app",
-  capacity: "https://capacity.topolo.app",
-  chat: "https://chat.topolo.app",
-  commerce: "https://commerce.topolo.app",
-  compose: "https://compose.topolo.app",
-  consent: "https://consent.topolo.app",
-  crm: "https://crm.topolo.app",
-  design: "https://design.topolo.app",
-  developers: "https://developers.topolo.app",
-  director: "https://director.topolo.app",
-  feed: "https://feed.topolo.app",
-  flow: "https://flow.topolo.app",
-  forecast: "https://forecast.topolo.app",
-  forms: "https://forms.topolo.app",
-  home: "https://home.topolo.app",
-  insights: "https://insights.topolo.app",
-  inventory: "https://inventory.topolo.app",
-  learn: "https://learn.topolo.app",
-  localize: "https://localize.topolo.app",
-  mail: "https://mail.topolo.app",
-  mdm: "https://mdm.topolo.app",
-  messages: "https://messages.topolo.app",
-  nexus: "https://nexus.topolo.app",
-  notify: "https://notify.topolo.app",
-  observability_watch: "https://observability-watch.topolo.app",
-  one: "https://www.topolo.app",
-  p2p: "https://p2p.topolo.app",
-  pay: "https://pay.topolo.app",
-  people: "https://people.topolo.app",
-  "quro.api": "https://api.ol0.me",
-  "quro.redirect": "https://ol0.me",
-  roadmapper: "https://roadmapper.topolo.app",
-  sign: "https://sign.topolo.app",
-  social_studio: "https://studio.topolo.app",
-  socialize: "https://socialize.topolo.app",
-  spaces: "https://spaces.topolo.app",
-  status: "https://status.topolo.app",
-  success: "https://success.topolo.app",
-  support: "https://support.topolo.app",
-  survey: "https://survey.topolo.app",
-  voice: "https://voice.topolo.app",
-  web: "https://web.topolo.app"
+  developers: "https://developers.topolo.app"
 };
 var APPLICATIONS = {
   "admin": {
@@ -1886,7 +1837,145 @@ var APPLICATIONS = {
     ]
   }
 };
-var APPLICATION_REQUIREMENTS_VERSION = "2026-06-07.1";
+function friendlyAppId(entry) {
+  for (const value of [entry.slug, entry.name, entry.appId]) {
+    if (typeof value !== "string" || !value.trim()) continue;
+    const normalized = value.trim().toLowerCase().replace(/\s+/g, "-");
+    const withoutPrefix = normalized.replace(/^(?:app[_-])?topolo[-_]+/, "");
+    if (withoutPrefix) return withoutPrefix;
+  }
+  return entry.appId;
+}
+function idVariants(value) {
+  const normalized = value.trim().toLowerCase().replace(/\s+/g, "-");
+  return [.../* @__PURE__ */ new Set([
+    normalized,
+    normalized.replace(/-/g, "_"),
+    normalized.replace(/_/g, "-")
+  ])].filter(Boolean);
+}
+var STATIC_APPLICATIONS = APPLICATIONS;
+function staticApplicationForId(id) {
+  for (const variant of idVariants(id)) {
+    const entry = STATIC_APPLICATIONS[variant];
+    if (entry) return entry;
+  }
+  return null;
+}
+function applicationEntryFromCatalog(live) {
+  const id = friendlyAppId(live);
+  return {
+    id,
+    appDir: "-",
+    name: live.name ?? live.slug ?? live.appId,
+    packageName: null,
+    productionUrl: live.launchUrl ?? live.apiBaseUrl ?? null,
+    services: live.apiBaseUrl ? [id] : [],
+    deployTargets: []
+  };
+}
+var DIRECTORY_PAGE_LIMIT = 100;
+var DIRECTORY_MAX_PAGES = 100;
+function staticApplicationDirectory() {
+  const applications = Object.entries(STATIC_APPLICATIONS).map(([id, application]) => ({
+    id,
+    application,
+    source: "static",
+    live: null
+  })).sort((left, right) => left.id.localeCompare(right.id));
+  return { source: "static_fallback", applications };
+}
+function directoryApplicationFromLive(live) {
+  const id = friendlyAppId(live);
+  return {
+    id,
+    // Prefer the static snapshot's richer repo/deploy metadata when the live
+    // registry confirms the app; synthesize from the live entry otherwise.
+    application: staticApplicationForId(id) ?? applicationEntryFromCatalog(live),
+    source: "live",
+    live
+  };
+}
+async function listApplicationDirectory(client) {
+  if (!client) return staticApplicationDirectory();
+  let services;
+  try {
+    services = [];
+    let cursor;
+    for (let page = 0; page < DIRECTORY_MAX_PAGES; page += 1) {
+      const result = await client.searchServices({
+        ...cursor ? { cursor } : {},
+        limit: DIRECTORY_PAGE_LIMIT
+      });
+      services.push(...result.services);
+      if (!result.page.nextCursor) break;
+      cursor = result.page.nextCursor;
+    }
+  } catch {
+    return staticApplicationDirectory();
+  }
+  const seen = /* @__PURE__ */ new Map();
+  for (const live of services) {
+    const entry = directoryApplicationFromLive(live);
+    if (!seen.has(entry.id)) seen.set(entry.id, entry);
+  }
+  return {
+    source: "live",
+    applications: [...seen.values()].sort((left, right) => left.id.localeCompare(right.id))
+  };
+}
+function matchesDirectoryApplication(app, needle) {
+  const candidates = new Set(idVariants(needle));
+  const keys = [
+    app.id,
+    app.application.id,
+    app.application.name,
+    app.live?.appId,
+    app.live?.slug,
+    app.live?.name
+  ];
+  for (const key of keys) {
+    if (typeof key !== "string" || !key.trim()) continue;
+    for (const variant of idVariants(key)) {
+      if (candidates.has(variant)) return true;
+    }
+    for (const variant of idVariants(friendlyAppId({ appId: key }))) {
+      if (candidates.has(variant)) return true;
+    }
+  }
+  return false;
+}
+function formatDirectoryApplicationIds(directory) {
+  const ids = directory.applications.map((app) => app.id).sort();
+  const preview = ids.slice(0, 50).join(", ");
+  const suffix = ids.length > 50 ? `, ... +${ids.length - 50} more` : "";
+  const label = directory.source === "live" ? "Applications available to this credential" : "Applications in the bundled static snapshot (live registry unreachable)";
+  return `${label}: ${preview}${suffix}`;
+}
+async function resolveApplicationDirectoryEntry(client, application) {
+  const needle = typeof application === "string" ? application.trim() : "";
+  if (!needle) {
+    throw new TopoloSdkError("unknown_application", "application is required");
+  }
+  if (client) {
+    let live = null;
+    try {
+      live = await client.getService(needle);
+    } catch {
+      live = null;
+    }
+    if (live) return directoryApplicationFromLive(live);
+  }
+  const directory = await listApplicationDirectory(client);
+  const match = directory.applications.find((app) => matchesDirectoryApplication(app, needle));
+  if (match) return match;
+  throw new TopoloSdkError(
+    "unknown_application",
+    `Unknown application "${application}". ${formatDirectoryApplicationIds(directory)}`
+  );
+}
+var STATIC_APPLICATIONS2 = APPLICATIONS;
+var APPLICATION_REQUIREMENTS_VERSION = "2026-08-11.1";
 var APPLICATION_REQUIREMENTS = [
   {
     id: "platform-metadata",
@@ -1896,10 +1985,10 @@ var APPLICATION_REQUIREMENTS = [
     evidence: [
       "topolo.cloudcontrol.json exists for every deployed app surface",
       "package.json names the package or app when the repo ships code",
-      "The SDK application catalog exposes the app through topolo apps and MCP discovery"
+      "The live platform registry exposes the app through topolo apps and MCP discovery"
     ],
     implementation: [
-      "Add the app to the SDK application catalog generator before exposing it to agents",
+      "Register the app in the live platform registry (Auth service catalog) before exposing it to agents",
       "Keep production URLs, Worker names, Pages projects, routes, domains, and bindings current in CloudControl metadata",
       "Do not leave a new Topolo* app directory without an explicit application ID"
     ]
@@ -1974,7 +2063,7 @@ var APPLICATION_REQUIREMENTS = [
     implementation: [
       "Add production Worker api_url metadata and sdk_app_id for every agent-callable API target",
       "Mark browser, documentation, and runtime-only Worker targets with agent_callable:false",
-      "Expose stable app IDs through generated DEFAULT_APP_URLS and live catalog discovery",
+      "Expose stable app IDs through live catalog discovery",
       "Keep typed SDK/CLI/MCP surfaces in sync when an API contract stabilizes"
     ]
   },
@@ -2094,15 +2183,24 @@ function applicationRequirementScopes(application) {
   }
   return Array.from(scopes);
 }
+function fallbackApplication(id) {
+  const entry = STATIC_APPLICATIONS2[id];
+  if (!entry) {
+    throw new Error(
+      `Unknown application "${id}" in the static fallback snapshot. Resolve applications from the live registry (resolveApplicationDirectoryEntry) and pass the entry directly.`
+    );
+  }
+  return entry;
+}
 function requirementsForApplication(applicationOrId) {
-  const application = typeof applicationOrId === "string" ? APPLICATIONS[applicationOrId] : applicationOrId;
+  const application = typeof applicationOrId === "string" ? fallbackApplication(applicationOrId) : applicationOrId;
   const scopes = new Set(applicationRequirementScopes(application));
   return APPLICATION_REQUIREMENTS.filter(
     (requirement) => requirement.appliesTo.some((scope) => scopes.has(scope))
   );
 }
 function auditApplicationRequirements(applicationOrId) {
-  const application = typeof applicationOrId === "string" ? APPLICATIONS[applicationOrId] : applicationOrId;
+  const application = typeof applicationOrId === "string" ? fallbackApplication(applicationOrId) : applicationOrId;
   const scopes = applicationRequirementScopes(application);
   const findings = requirementsForApplication(application).map(
     (requirement) => evaluateRequirement(application, requirement)
@@ -2115,10 +2213,12 @@ function auditApplicationRequirements(applicationOrId) {
     findings
   };
 }
-function auditAllApplicationRequirements(applicationIds = Object.keys(APPLICATIONS).sort()) {
-  const applications = applicationIds.map(
-    (applicationId) => auditApplicationRequirements(applicationId)
+function auditApplicationEntries(applications) {
+  return buildAuditReport(
+    applications.map((application) => auditApplicationRequirements(application))
   );
+}
+function buildAuditReport(applications) {
   const migrationQueue = applications.flatMap(
     (audit) => audit.findings.filter((finding2) => finding2.status !== "met").map((finding2) => ({
       applicationId: audit.application.id,
@@ -3421,8 +3521,9 @@ var TopoloClient = class _TopoloClient {
     });
   }
   /**
-   * Bundled generated registry for tooling that audits platform packaging, not
-   * for deciding what the current credential may use.
+   * @deprecated Static fallback snapshot only. Use `searchServices()` (the
+   * live credential-scoped registry) for anything that decides behavior; this
+   * exists for offline packaging audits when the registry is unreachable.
    */
   listBundledServices() {
     const apps = Object.values(APPLICATIONS);
@@ -3813,6 +3914,52 @@ function mergeSignals(a, b) {
   b.addEventListener("abort", onAbort, { once: true });
   return controller.signal;
 }
+function compactActionCatalogEntry(action) {
+  const required = Array.isArray(action.inputSchema["required"]) ? action.inputSchema["required"].filter((value) => typeof value === "string") : [];
+  const examples = action.agentContract?.examples ?? [];
+  return {
+    actionId: action.actionId,
+    title: action.title,
+    description: action.description,
+    method: action.method,
+    readOnly: action.readOnly,
+    requiresConfirmation: action.requiresConfirmation,
+    agentAccess: action.agentAccess ?? (action.requiresConfirmation ? "confirm" : action.readOnly ? "auto" : "confirm"),
+    requiredPermission: action.requiredPermission,
+    requiredInput: required,
+    resourceType: action.agentContract?.resource?.kind ?? null,
+    exampleInput: examples[0]?.input ?? null,
+    docsUrl: action.agentContract?.docsUrl ?? null
+  };
+}
+function compactActionValidation(actionId, validation) {
+  return { actionId, valid: validation.valid, errors: validation.errors };
+}
+function compactActionPlan(plan) {
+  return {
+    actionId: plan.action.actionId,
+    valid: plan.validation.valid,
+    errors: plan.validation.errors,
+    executable: plan.executable,
+    confirmationRequired: plan.confirmationRequired,
+    confirmationProvided: plan.confirmationProvided,
+    request: plan.request,
+    verification: plan.verification,
+    rollbackActionId: plan.rollbackActionId,
+    nextActionIds: plan.nextActionIds
+  };
+}
+function compactApplicationAudit(report) {
+  return {
+    version: report.version,
+    applications: report.applications.map((audit) => ({
+      applicationId: audit.application.id,
+      applicationName: audit.application.name,
+      score: audit.score
+    })),
+    migrationQueueCount: report.migrationQueue.length
+  };
+}
 var CrmModule = class {
   constructor(client) {
     this.client = client;
@@ -4079,57 +4226,8 @@ var TopoloHttpError2 = class extends TopoloSdkError2 {
   }
 };
 var APP_API_URLS2 = {
-  agent: "https://agent.topolo.app",
   auth: "https://auth.topolo.app",
-  backup: "https://backup.topolo.app",
-  blog: "https://blog.topolo.app",
-  books: "https://books.topolo.app",
-  brand: "https://brand.topolo.app",
-  bugfix: "https://bugfix.topolo.app",
-  bytes: "https://bytes.topolo.app",
-  calendar: "https://calendar.topolo.app",
-  campaigns: "https://campaigns.topolo.app",
-  capacity: "https://capacity.topolo.app",
-  chat: "https://chat.topolo.app",
-  commerce: "https://commerce.topolo.app",
-  compose: "https://compose.topolo.app",
-  consent: "https://consent.topolo.app",
-  crm: "https://crm.topolo.app",
-  design: "https://design.topolo.app",
-  developers: "https://developers.topolo.app",
-  director: "https://director.topolo.app",
-  feed: "https://feed.topolo.app",
-  flow: "https://flow.topolo.app",
-  forecast: "https://forecast.topolo.app",
-  forms: "https://forms.topolo.app",
-  home: "https://home.topolo.app",
-  insights: "https://insights.topolo.app",
-  inventory: "https://inventory.topolo.app",
-  learn: "https://learn.topolo.app",
-  localize: "https://localize.topolo.app",
-  mail: "https://mail.topolo.app",
-  mdm: "https://mdm.topolo.app",
-  messages: "https://messages.topolo.app",
-  nexus: "https://nexus.topolo.app",
-  notify: "https://notify.topolo.app",
-  observability_watch: "https://observability-watch.topolo.app",
-  one: "https://www.topolo.app",
-  p2p: "https://p2p.topolo.app",
-  pay: "https://pay.topolo.app",
-  people: "https://people.topolo.app",
-  "quro.api": "https://api.ol0.me",
-  "quro.redirect": "https://ol0.me",
-  roadmapper: "https://roadmapper.topolo.app",
-  sign: "https://sign.topolo.app",
-  social_studio: "https://studio.topolo.app",
-  socialize: "https://socialize.topolo.app",
-  spaces: "https://spaces.topolo.app",
-  status: "https://status.topolo.app",
-  success: "https://success.topolo.app",
-  support: "https://support.topolo.app",
-  survey: "https://survey.topolo.app",
-  voice: "https://voice.topolo.app",
-  web: "https://web.topolo.app"
+  developers: "https://developers.topolo.app"
 };
 var DEFAULT_APP_URLS2 = APP_API_URLS2;
 function resolveServiceUrl2(service, overrides) {
@@ -5055,7 +5153,7 @@ function parseQueryPairs(pairs) {
 
 // src/commands/actions.ts
 function registerActionsCommand(program2) {
-  const actions = program2.command("actions").description("Search permission-scoped Topolo actions for one application").option("-s, --service <service>", "App id, slug, or name (required for search)").option("-q, --query <query>", "Filter by action id, name, or title").option("--cursor <cursor>", "Continuation cursor from the previous page").option("--limit <limit>", "Page size (1-100)", "25").option("--json", "Output JSON").option("--no-json", "Output human-readable table").action(async (opts) => {
+  const actions = program2.command("actions").description("Search permission-scoped Topolo actions for one application").option("-s, --service <service>", "App id, slug, or name (required for search)").option("-q, --query <query>", "Filter by action id, name, or title").option("--cursor <cursor>", "Continuation cursor from the previous page").option("--limit <limit>", "Page size (1-100)", "25").option("--detail", "Include full schemas and agent contracts").option("--json", "Output JSON").option("--no-json", "Output human-readable table").action(async (opts) => {
     const mode = resolveOutputMode(opts.json);
     try {
       const topolo = await buildClient();
@@ -5069,7 +5167,8 @@ function registerActionsCommand(program2) {
         cursor: opts.cursor,
         limit: parsePageSize(opts.limit)
       });
-      emit(result, mode, () => formatActionRows(result.actions, result.page.nextCursor));
+      const output2 = opts.detail ? result : { actions: result.actions.map(compactActionCatalogEntry), page: result.page };
+      emit(output2, mode, () => formatActionRows(result.actions, result.page.nextCursor));
     } catch (err) {
       fail(err, mode);
     }
@@ -5129,17 +5228,18 @@ function registerActionsCommand(program2) {
       fail(err, mode);
     }
   });
-  actions.command("validate <action>").description("Validate action input locally against the published JSON Schema").option("-d, --data <json-or-@file>", "JSON action input or @path to a JSON file", "{}").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (action, opts, command) => {
+  actions.command("validate <action>").description("Validate action input locally against the published JSON Schema").option("-d, --data <json-or-@file>", "JSON action input or @path to a JSON file", "{}").option("--detail", "Include the full action contract").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (action, opts, command) => {
     const mode = resolveOutputMode(opts.json ?? command.parent?.opts().json);
     try {
       const topolo = await requiredClient();
       const result = await topolo.client.validateActionInput(action, parseJsonObject(opts.data || "{}"));
-      emit(result, mode, () => result.validation.valid ? `Valid input for ${result.action.actionId}.` : result.validation.errors.map((issue) => `${issue.path}: ${issue.message}`).join("\n"));
+      const output2 = detailRequested(opts.detail, command) ? result : compactActionValidation(result.action.actionId, result.validation);
+      emit(output2, mode, () => result.validation.valid ? `Valid input for ${result.action.actionId}.` : result.validation.errors.map((issue) => `${issue.path}: ${issue.message}`).join("\n"));
     } catch (err) {
       fail(err, mode);
     }
   });
-  actions.command("plan <action>").description("Validate and preview the exact request, confirmation, verification, and rollback plan").option("-d, --data <json-or-@file>", "JSON action input or @path to a JSON file", "{}").option("--resource-type <type>", "App-local resource alias, such as workspace").option("--resource-id <id>", "Resource id for the selected resource type").option("--confirm", "Include confirmation in the plan without executing it").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (action, opts, command) => {
+  actions.command("plan <action>").description("Validate and preview the exact request, confirmation, verification, and rollback plan").option("-d, --data <json-or-@file>", "JSON action input or @path to a JSON file", "{}").option("--resource-type <type>", "App-local resource alias, such as workspace").option("--resource-id <id>", "Resource id for the selected resource type").option("--confirm", "Include confirmation in the plan without executing it").option("--detail", "Include the full action contract").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (action, opts, command) => {
     const mode = resolveOutputMode(opts.json ?? command.parent?.opts().json);
     try {
       const topolo = await requiredClient();
@@ -5148,7 +5248,7 @@ function registerActionsCommand(program2) {
         confirm: opts.confirm === true,
         ...resource ? { resource } : {}
       });
-      emit(plan, mode, () => formatActionPlan(plan));
+      emit(detailRequested(opts.detail, command) ? plan : compactActionPlan(plan), mode, () => formatActionPlan(plan));
     } catch (err) {
       fail(err, mode);
     }
@@ -5168,19 +5268,23 @@ function registerActionsCommand(program2) {
       fail(err, mode);
     }
   });
-  actions.command("capabilities").description("List every published action for one application (its capability contract)").option("-s, --service <service>", "App id, slug, or name").option("--json", "Output JSON").option("--no-json", "Output human-readable table").action(async (opts, command) => {
+  actions.command("capabilities").description("List every published action for one application (its capability contract)").option("-s, --service <service>", "App id, slug, or name").option("--detail", "Include full schemas and agent contracts").option("--json", "Output JSON").option("--no-json", "Output human-readable table").action(async (opts, command) => {
     const mode = resolveOutputMode(opts.json ?? command.parent?.opts().json);
     try {
       const topolo = await requiredClient();
       const service = opts.service || command.parent?.opts().service;
       if (!service?.trim()) throw new Error("--service is required for capability discovery");
       const result = await topolo.client.searchActions({ service: service.trim(), limit: 100 });
-      emit(result, mode, () => formatActionRows(result.actions, result.page.nextCursor));
+      const output2 = detailRequested(opts.detail, command) ? result : { actions: result.actions.map(compactActionCatalogEntry), page: result.page };
+      emit(output2, mode, () => formatActionRows(result.actions, result.page.nextCursor));
     } catch (err) {
       fail(err, mode);
     }
   });
 }
+function detailRequested(local, command) {
+  return local === true || command.parent?.opts().detail === true;
+}
 async function requiredClient() {
   const topolo = await buildClient();
   if (!topolo) throw new Error("No credential configured. Run `topolo auth login` or set TOPOLO_API_KEY.");
@@ -5284,7 +5388,7 @@ function formatActionPlan(plan) {
 
 // src/commands/apps.ts
 import { execSync } from "child_process";
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync2 } from "fs";
 import path6 from "path";
 
 // src/commands/app-audit-local.ts
@@ -6523,12 +6627,6 @@ function normalizeContainerAppId(value, surfaceModel) {
 function normalizeApplicationId(application) {
   const raw = application.trim().toLowerCase();
   const normalized = raw.replace(/-/g, "_");
-  if (Object.prototype.hasOwnProperty.call(APPLICATIONS, raw)) {
-    return raw;
-  }
-  if (Object.prototype.hasOwnProperty.call(APPLICATIONS, normalized)) {
-    return normalized;
-  }
   if (/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(raw) || /^[a-z0-9](?:[a-z0-9_]*[a-z0-9])?$/.test(raw)) {
     return normalized;
   }
@@ -6593,7 +6691,7 @@ function firstPartyAppPath(appDir, _audience) {
 }
 
 // src/commands/app-scaffold-platform-versions.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
 import path2 from "path";
 var versionCache = /* @__PURE__ */ new Map();
 function platformPackagePin(packageName, options = {}) {
@@ -6601,7 +6699,7 @@ function platformPackagePin(packageName, options = {}) {
     options.repoRoot ?? process.env.TOPOLO_WORKSPACE_ROOT ?? void 0,
     options.cwd ?? process.cwd()
   );
-  if (!workspaceRoot) {
+  if (!workspaceRoot || !existsSync3(path2.join(workspaceRoot, "topolo-platform", "packages"))) {
     throw new Error(
       `Cannot resolve a concrete version for ${packageName}: platform-target scaffolds must run inside the Topolo workspace checkout (a directory containing apps/ and system-apps/), or receive --repo-root. The fleet pinning policy requires exact ^<latest> pins, never "latest".`
     );
@@ -7148,6 +7246,7 @@ function readme(application, target, options) {
       "- `@topolo-io/app-launcher` provides shared app switching and handoff helpers.",
       "- `@topolo-io/ui-kit` provides every control, table, panel, workbench, inspector, icon, transition, and bug reporter primitive used by the generated product surface.",
       "- `@topolo-io/auth-client` owns browser auth, callback exchange, token refresh, and logout.",
+      '- Build the app data client with `authClient.createJsonClient()` (or `createAuthenticatedFetch()`) from `@topolo-io/auth-client`. It already attaches the bearer token, refreshes proactively near expiry, and refreshes-and-retries once on a 401. NEVER hand-roll an `Authorization: Bearer` header in browser code: every app that has done so forgot the 401 recovery and showed raw auth errors ("Token expired") to the user on an ordinary 15-minute expiry. The `browser-auth-refresh` fleet static guard fails any browser file that builds its own bearer header.',
       "- `@topolo-io/api-key-management`, `@topolo-io/chat-widget`, `@topolo-io/notifications`, and `@topolo-io/resource-context` complete the AppShell capability baseline.",
       "- Every Topolo-owned browser dependency is emitted at `latest`; product-domain packages are added only when the app actually adopts that domain.",
       "- `.npmrc` routes private `@topolo-io` packages to GitHub Packages without storing credentials; public `@topolo` packages remain on npm. Local and CI environments must provide a GitHub Packages token.",
@@ -8714,7 +8813,7 @@ function developerWorkerTs(application) {
 }
 
 // src/commands/app-scaffold-generate.ts
-import { existsSync as existsSync3, mkdirSync, mkdtempSync, readFileSync as readFileSync5, rmSync, writeFileSync } from "fs";
+import { existsSync as existsSync4, mkdirSync, mkdtempSync, readFileSync as readFileSync5, rmSync, writeFileSync } from "fs";
 import { spawnSync } from "child_process";
 import { tmpdir } from "os";
 import path3 from "path";
@@ -8728,7 +8827,7 @@ function resolveGeneratorPath() {
   ];
   for (const candidate of candidates) {
     const p = decodeURIComponent(candidate.pathname);
-    if (existsSync3(p)) return p;
+    if (existsSync4(p)) return p;
   }
   throw new Error(
     `topolo: could not locate generate-wrangler.mjs. A published CLI vendors it into dist/ at build time; in-repo it is read from topolo-platform/tooling/. Looked in:
@@ -9914,7 +10013,7 @@ function applicationScaffoldPayload(application, options = {}) {
   const requestedId = normalizeApplicationId(application);
   const id = target === "platform" ? normalizeFirstPartyApplicationId(requestedId) : requestedId;
   const slug = toSlug(id);
-  const catalogApplication = APPLICATIONS[id];
+  const catalogApplication = options.catalogApplication ?? null;
   const browser = options.browser !== false;
   const api = options.api ?? target === "platform";
   const audience = normalizeAudience(
@@ -11550,7 +11649,6 @@ function registerApplicationReconcileCommand(parent, ownerType, dependencies = {
 }
 
 // src/commands/apps.ts
-var APPLICATION_IDS = Object.keys(APPLICATIONS).sort();
 var CLOUDCONTROL_LOCAL_APPLICATION = {
   id: "cloudcontrol",
   appDir: "TopoloCloudControl",
@@ -11560,6 +11658,21 @@ var CLOUDCONTROL_LOCAL_APPLICATION = {
   services: [],
   deployTargets: []
 };
+async function directoryClient() {
+  try {
+    const topolo = await buildClient();
+    return topolo ? topolo.client : null;
+  } catch {
+    return null;
+  }
+}
+async function resolveScaffoldCatalogApplication(application) {
+  try {
+    return await resolveApplication(application, await directoryClient());
+  } catch {
+    return null;
+  }
+}
 function registerAppsCommand(program2) {
   const apps = program2.command("apps").description("Search Topolo platform applications available to the current credential").option("-q, --query <query>", "Filter by app id, slug, or name").option("--cursor <cursor>", "Continuation cursor from the previous page").option("--limit <limit>", "Page size (1-100)", "25").option("--json", "Output JSON", true).option("--no-json", "Output human-readable table").action(async (opts) => {
     const mode = resolveOutputMode(opts.json);
@@ -11597,10 +11710,10 @@ function registerAppsCommand(program2) {
   });
   apps.command("requirements [application]").description(
     "Show the versioned Topolo application-build requirements, optionally filtered to one app."
-  ).option("--json", "Output JSON", true).option("--no-json", "Output human-readable details").action((application, opts) => {
+  ).option("--json", "Output JSON", true).option("--no-json", "Output human-readable details").action(async (application, opts) => {
     const mode = resolveOutputMode(opts.json);
     try {
-      const payload = applicationRequirementsPayload(application);
+      const payload = await applicationRequirementsPayload(application, await directoryClient());
       emit(payload, mode, () => formatRequirements(payload));
     } catch (err) {
       fail(err, mode);
@@ -11608,19 +11721,21 @@ function registerAppsCommand(program2) {
   });
   apps.command("audit [application]").description(
     "Audit Topolo applications against the versioned application-build requirements."
-  ).option("--json", "Output JSON", true).option("--no-json", "Output human-readable table").option("--local", "Inspect the local Topolo checkout for filesystem-backed evidence").option("--repo-root <path>", "Topolo checkout root to inspect when --local is set").option(
+  ).option("--json", "Output JSON", true).option("--no-json", "Output human-readable table").option("--detail", "Include all findings and migration queue items").option("--local", "Inspect the local Topolo checkout for filesystem-backed evidence").option("--repo-root <path>", "Topolo checkout root to inspect when --local is set").option(
     "--fail-on <status>",
     "Exit non-zero when audit has findings at this severity or worse: missing, needs_review, partial"
-  ).action((application, opts) => {
+  ).action(async (application, opts) => {
     const mode = resolveOutputMode(opts.json);
     try {
-      const payload = applicationAuditPayload(application, {
+      const payload = await applicationAuditPayload(application, {
         local: opts.local,
-        repoRoot: opts.repoRoot
+        repoRoot: opts.repoRoot,
+        client: await directoryClient()
       });
       const gate = opts.failOn ? evaluateApplicationAuditGate(payload, opts.failOn) : null;
-      const output2 = gate ? { ...payload, conformanceGate: gate } : payload;
-      emit(output2, mode, () => formatAudit(output2));
+      const compact = opts.detail ? payload : compactApplicationAudit(payload);
+      const output2 = gate ? { ...compact, conformanceGate: gate } : compact;
+      emit(output2, mode, () => formatAudit(gate ? { ...payload, conformanceGate: gate } : payload));
       if (gate && !gate.passed) {
         if (mode === "json") {
           process.stderr.write(JSON.stringify({ error: gate.message, conformanceGate: gate }, null, 2) + "\n");
@@ -11636,10 +11751,13 @@ function registerAppsCommand(program2) {
   });
   apps.command("record-evidence <application>").description(
     "Stamp <repo>/.topolo/evidence.json with the latest CI gate results so the audit can flip verification-gates / observability-and-audit / canonical-docs from partial to met when the recorded run is fresh (< 24h)."
-  ).option("--json", "Output JSON", true).option("--no-json", "Output human-readable summary").option("--app-root <path>", "Path to the application repo root (defaults to cwd)").option("--build", "Mark the latest build as successful").option("--typecheck", "Mark the latest typecheck as successful").option("--test", "Mark the latest test run as successful").option("--docs-validate", "Mark the latest TopoloDocs npm run validate as successful").option("--smoke <url>", "Mark the latest live smoke as successful against this URL").option("--commit <sha>", "Override the commit hash (defaults to git HEAD)").action((application, opts) => {
+  ).option("--json", "Output JSON", true).option("--no-json", "Output human-readable summary").option("--app-root <path>", "Path to the application repo root (defaults to cwd)").option("--build", "Mark the latest build as successful").option("--typecheck", "Mark the latest typecheck as successful").option("--test", "Mark the latest test run as successful").option("--docs-validate", "Mark the latest TopoloDocs npm run validate as successful").option("--smoke <url>", "Mark the latest live smoke as successful against this URL").option("--commit <sha>", "Override the commit hash (defaults to git HEAD)").action(async (application, opts) => {
     const mode = resolveOutputMode(opts.json);
     try {
-      const payload = recordApplicationEvidence(application, opts);
+      const payload = await recordApplicationEvidence(application, {
+        ...opts,
+        client: await directoryClient()
+      });
       emit(payload, mode, () => formatEvidence(payload));
     } catch (err) {
       fail(err, mode);
@@ -11661,6 +11779,7 @@ function registerAppsCommand(program2) {
     try {
       const api = resolveScaffoldApiOption(opts.api, opts.withApi);
       const payload = applicationScaffoldPayload(application, {
+        catalogApplication: await resolveScaffoldCatalogApplication(application),
         appDir: opts.appDir,
         name: opts.name,
         packageName: opts.packageName,
@@ -11722,14 +11841,11 @@ function parsePageSize2(value) {
   }
   return parsed;
 }
-function resolveApplication(application) {
-  const id = application.trim().toLowerCase();
-  if (!APPLICATION_IDS.includes(id)) {
-    throw new Error(`Unknown application "${application}". ${formatKnownValues(APPLICATION_IDS, "applications")}`);
-  }
-  return APPLICATIONS[id];
+async function resolveApplication(application, client = null) {
+  const resolved = await resolveApplicationDirectoryEntry(client, application);
+  return resolved.application;
 }
-function applicationRequirementsPayload(application) {
+async function applicationRequirementsPayload(application, client = null) {
   if (!application) {
     return {
       version: APPLICATION_REQUIREMENTS_VERSION,
@@ -11738,7 +11854,7 @@ function applicationRequirementsPayload(application) {
       requirements: [...APPLICATION_REQUIREMENTS]
     };
   }
-  const app = resolveApplication(application);
+  const app = await resolveApplication(application, client);
   return {
     version: APPLICATION_REQUIREMENTS_VERSION,
     application: app,
@@ -11746,20 +11862,23 @@ function applicationRequirementsPayload(application) {
     requirements: requirementsForApplication(app)
   };
 }
-function applicationAuditPayload(application, options = {}) {
+async function applicationAuditPayload(application, options = {}) {
+  const client = options.client ?? null;
   const requestedId = application?.trim().toLowerCase();
   const report = requestedId === "cloudcontrol" && options.local ? {
     version: APPLICATION_REQUIREMENTS_VERSION,
     applications: [auditApplicationRequirements(CLOUDCONTROL_LOCAL_APPLICATION)],
     migrationQueue: []
-  } : application ? auditAllApplicationRequirements([resolveApplication(application).id]) : auditAllApplicationRequirements();
+  } : application ? auditApplicationEntries([await resolveApplication(application, client)]) : auditApplicationEntries(
+    (await listApplicationDirectory(client)).applications.map((app) => app.application)
+  );
   if (!options.local) return report;
   return enrichApplicationAuditWithLocalEvidence(report, { repoRoot: options.repoRoot });
 }
-function recordApplicationEvidence(application, options = {}) {
-  const appId = resolveApplication(application).id;
+async function recordApplicationEvidence(application, options = {}) {
+  const appId = (await resolveApplication(application, options.client ?? null)).id;
   const root = path6.resolve(options.appRoot ?? process.cwd());
-  if (!existsSync4(root)) {
+  if (!existsSync5(root)) {
     throw new Error(`Application root does not exist: ${root}`);
   }
   let commit = options.commit;
@@ -11773,7 +11892,7 @@ function recordApplicationEvidence(application, options = {}) {
   const evidenceDir = path6.join(root, ".topolo");
   const evidencePath = path6.join(evidenceDir, "evidence.json");
   let before = null;
-  if (existsSync4(evidencePath)) {
+  if (existsSync5(evidencePath)) {
     try {
       const raw = JSON.parse(readFileSync6(evidencePath, "utf8"));
       if (raw && typeof raw === "object" && raw.version === 1) {
@@ -11888,22 +12007,7 @@ function applicationUrl(application) {
   return application.apiBaseUrl ?? application.launchUrl ?? application.productionUrl ?? null;
 }
 function displayCatalogId(entry) {
-  for (const value of [entry.slug, entry.name, entry.appId]) {
-    if (typeof value !== "string" || !value.trim()) continue;
-    const candidates = catalogIdCandidates(value);
-    const withoutTopolo = candidates.find((candidate) => !candidate.startsWith("topolo-"));
-    if (withoutTopolo) return withoutTopolo;
-    if (candidates[0]) return candidates[0];
-  }
-  return entry.appId;
-}
-function catalogIdCandidates(value) {
-  const normalized = value.trim().toLowerCase().replace(/\s+/g, "-");
-  const withoutTopolo = normalized.startsWith("topolo-") ? normalized.slice("topolo-".length) : normalized;
-  return [.../* @__PURE__ */ new Set([
-    normalized,
-    withoutTopolo
-  ])].filter(Boolean);
+  return friendlyAppId(entry);
 }
 function formatRequirements(payload) {
   const lines = [
@@ -12067,12 +12171,6 @@ function normalizeFailOn(value) {
   }
   throw new Error("Invalid --fail-on value. Use missing, needs_review, or partial.");
 }
-function formatKnownValues(values, label) {
-  const sorted = [...values].sort();
-  const preview = sorted.slice(0, 25).join(", ");
-  const suffix = sorted.length > 25 ? `, ... +${sorted.length - 25} more` : "";
-  return `Run discovery for the full ${label} list. Known snapshot sample: ${preview}${suffix}`;
-}
 function statusesAtOrWorse(threshold) {
   if (threshold === "missing") return ["missing"];
   if (threshold === "needs_review") return ["missing", "needs_review"];
@@ -12274,6 +12372,7 @@ function registerPlatformCommand(program2) {
       }
       const api = resolveScaffoldApiOption(opts.api, opts.withApi);
       const payload = applicationScaffoldPayload(application, {
+        catalogApplication: await resolveScaffoldCatalogApplication(application),
         appDir: opts.appDir,
         name: opts.name,
         packageName: opts.packageName,
@@ -12525,15 +12624,7 @@ function isStagingUrl(value) {
   return url.includes(".stg.topolo.us") || url.includes("localhost") || url.includes("127.0.0.1") || url.includes("topolo-staging");
 }
 function displayAppId(entry) {
-  for (const value of [entry.slug, entry.name, entry.appId]) {
-    if (typeof value !== "string" || !value.trim()) continue;
-    for (const candidate of appIdCandidates(value)) {
-      if (Object.prototype.hasOwnProperty.call(DEFAULT_APP_URLS, candidate)) {
-        return candidate;
-      }
-    }
-  }
-  return appIdCandidates(entry.slug || entry.appId)[0] || entry.appId;
+  return friendlyAppId(entry);
 }
 function defaultServiceUrl(id, entry) {
   return resolveCatalogServiceUrl(entry, { serviceKey: id });
@@ -13073,7 +13164,7 @@ function formatCheckResult(result) {
 
 // src/commands/skills.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync6 } from "fs";
 import { mkdir as mkdir4, copyFile, readFile as readFile7, writeFile as writeFile7, rm } from "fs/promises";
 import { homedir as homedir2 } from "os";
 import { dirname as dirname4, join as join5, resolve as resolve3 } from "path";
@@ -13085,7 +13176,7 @@ function skillsSourceDir() {
   const distCandidate = resolve3(here, "../skills");
   const srcCandidate = resolve3(here, "../../skills");
   for (const candidate of [distCandidate, srcCandidate]) {
-    if (existsSync5(join5(candidate, "topolo", "SKILL.md"))) return candidate;
+    if (existsSync6(join5(candidate, "topolo", "SKILL.md"))) return candidate;
   }
   return distCandidate;
 }
@@ -13130,7 +13221,7 @@ function registerViaOfficialCli(cli, mcp, agentName) {
 async function registerClaudeViaConfig(mcp) {
   const path9 = join5(homedir2(), ".claude.json");
   let config = {};
-  if (existsSync5(path9)) {
+  if (existsSync6(path9)) {
     try {
       config = JSON.parse(await readFile7(path9, "utf8"));
     } catch {
@@ -13151,7 +13242,7 @@ async function registerClaudeViaConfig(mcp) {
 async function registerCodexViaConfig(mcp) {
   const path9 = join5(homedir2(), ".codex", "config.toml");
   let text = "";
-  if (existsSync5(path9)) text = await readFile7(path9, "utf8");
+  if (existsSync6(path9)) text = await readFile7(path9, "utf8");
   text = text.replace(
     /(^|\n)\[mcp_servers\.topolo(?:\.[a-z]+)?\][^\[]*/g,
     (match) => match.startsWith("\n") ? "\n" : ""
@@ -13206,7 +13297,7 @@ function registerSkillsCommand(program2) {
       const mode = resolveOutputMode(opts.json);
       try {
         const sourceDir = skillsSourceDir();
-        if (!existsSync5(join5(sourceDir, "topolo", "SKILL.md"))) {
+        if (!existsSync6(join5(sourceDir, "topolo", "SKILL.md"))) {
           throw new Error(
             "Bundled skill file not found. Reinstall the CLI: npm install -g @topolo/cli"
           );
@@ -13235,7 +13326,7 @@ function registerSkillsCommand(program2) {
         const skillDir = agent === "claude" ? claudeSkillDir() : codexSkillDir();
         return {
           agent,
-          skillInstalled: existsSync5(join5(skillDir, "SKILL.md")),
+          skillInstalled: existsSync6(join5(skillDir, "SKILL.md")),
           skillPath: join5(skillDir, "SKILL.md"),
           cliAvailable: agentBinaryExists(agent)
         };
@@ -13252,7 +13343,7 @@ function registerSkillsCommand(program2) {
       for (const agent of resolveTargets(opts)) {
         const skillDir = agent === "claude" ? claudeSkillDir() : codexSkillDir();
         const skillFile = join5(skillDir, "SKILL.md");
-        const skillRemoved = existsSync5(skillFile);
+        const skillRemoved = existsSync6(skillFile);
         if (skillRemoved) await rm(skillFile, { force: true });
         if (agentBinaryExists(agent)) {
           spawnSync2(agent, ["mcp", "remove", "topolo"], { stdio: "ignore" });
@@ -13504,12 +13595,14 @@ function registerContextCommand(program2) {
 
 // src/commands/resources.ts
 function registerResourcesCommand(program2) {
-  program2.command("resources <application>").description("List bindable resource ids for one credential-scoped Topolo application").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (application, opts) => {
+  program2.command("resources [application]").description("List bindable resource ids for one credential-scoped Topolo application").option("-s, --service <service>", "App id, slug, or name").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (application, opts) => {
     const mode = resolveOutputMode(opts.json);
     try {
       const topolo = await buildClient();
       if (!topolo) throw new Error("No credential configured. Run `topolo auth login` or set TOPOLO_API_KEY.");
-      const result = await topolo.client.listBindableResources(application);
+      const selector = application?.trim() || opts.service?.trim();
+      if (!selector) throw new Error("application or --service is required");
+      const result = await topolo.client.listBindableResources(selector);
       emit(result, mode, () => formatResources(result));
     } catch (err) {
       fail(err, mode);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@topolo/cli",
-  "version": "0.6.10",
-  "topoloPublishedVersion": "0.6.10",
+  "version": "0.7.1",
+  "topoloPublishedVersion": "0.7.1",
   "description": "Command-line interface for Topolo developers, operators, and agents, with internal first-party scaffolding available under the topolo platform namespace.",
   "type": "module",
   "bin": {

package/skills/codex/AGENTS.md

@@ -4,7 +4,7 @@ This file teaches an agent how to interact with the Topolo platform via the `top
 
 ## What the platform is
 
-Topolo is a multi-app SaaS platform. The CLI and MCP server both use `@topolo/sdk`; bundled app IDs come from the generated registry, and newly registered API/technical services can be resolved from the live Auth catalog.
+Topolo is a multi-app SaaS platform. The CLI and MCP server both use `@topolo/sdk`; every application resolves from the live credential-scoped registry, so newly registered apps and API/technical services work immediately — there is no bundled application catalog to rely on or wait for.
 
 - Use `topolo apps --json` or the MCP `topolo_search_applications` tool to discover platform applications, including browser-only Worker apps.
 - Use `topolo apps requirements <application_id> --json` or the MCP `topolo_list_application_requirements` tool before creating or expanding a Topolo app.
@@ -12,7 +12,7 @@ Topolo is a multi-app SaaS platform. The CLI and MCP server both use `@topolo/sd
 - Use `topolo services --json` or the MCP `topolo_search_applications` tool to discover callable app ids and effective URLs.
 - Use `topolo actions --service <app> --json` or MCP `topolo_search_actions` to discover callable operations granted to the current credential; invoke automatic reads with `topolo_read_action` and confirmation-gated operations with `topolo_call_action`.
 - Use `topolo actions capabilities`, `actions examples`, `actions validate`, and `actions plan` (or their MCP equivalents) to obtain schemas, examples, verification, and rollback before execution.
-- The generic `api` command and MCP `topolo_api_call` tool can reach bundled SDK services and live Auth-catalog API/technical services when no action contract exists yet.
+- The generic `api` command and MCP `topolo_api_call` tool can reach any live Auth-catalog application or API/technical service when no action contract exists yet; discover ids with `topolo apps --json` first.
 
 Every call is scoped to the organization embedded in the credential. There is no `--org` flag anywhere — attempting to target another org will fail.
 

package/skills/topolo/SKILL.md

@@ -20,6 +20,22 @@ topolo skills install
 
 `topolo skills install` installs this skill and registers the Topolo MCP server for Claude Code and Codex. Both use the same credential written by `topolo auth login`.
 
+Before testing platform behavior, verify every installed agent surface against
+the package registry. Do not diagnose behavior with stale tooling:
+
+```bash
+topolo --version
+npm list -g --depth=0 @topolo/cli @topolo/mcp @topolo/sdk
+npm view @topolo/cli version
+npm view @topolo/mcp version
+npm view @topolo/sdk version
+```
+
+If any version differs, install the three latest released versions together,
+run `topolo skills install`, and restart the MCP client before testing. Record
+the versions used with the results. Source builds may test a candidate fix, but
+must be labelled separately from released-tooling proof.
+
 Production is the default. Use `--env staging` on every staging command, or set `TOPOLO_ENV=staging`. Never mix staging discovery with production execution.
 
 ## Authentication gate