@topolo/cli 0.6.8 → 0.7.0

package/README.md

@@ -12,7 +12,7 @@ via `stdin`/`stdout`.
 - First-class `production`, `staging`, `development`, and `local` environments with separate stored credentials and service URL overrides.
 - **Per-context credentials** — hold and switch between your personal space and multiple organizations with `topolo context`.
 - **One-command agent setup** — `topolo skills install` wires the skill + MCP into Claude Code / Codex.
-- Commands: `auth`, `whoami`, `context`, `skills`, `apps`, `services`, credential-scoped `actions`, generic `api` passthrough, and internal `platform` scaffolding.
+- Commands: `auth`, `whoami`, `context`, `skills`, `apps`, `services`, `workspaces`, credential-scoped `actions`, generic `api` passthrough, and internal `platform` scaffolding.
 
 ## Install
 
@@ -177,6 +177,22 @@ Both resource flags are required together. This supports concurrent agent
 operations across many app-local workspaces without changing the CLI/MCP org
 context or the user's web switcher.
 
+### `topolo workspaces`
+
+Discovers canonical workspaces and the caller-specific creation policy for a
+target application. Auth owns workspace identity, while its runtime policy
+decides access separately for each app and caller.
+
+```bash
+topolo workspaces list design --json
+topolo workspaces create design --name "Campaigns" --confirm --json
+topolo workspaces rename design <workspace-id> --name "Social campaigns" --confirm --json
+topolo workspaces default design <workspace-id> --confirm --json
+```
+
+Always read `data.policy.canCreate` and `data.policy.reason` from `list` before
+creation. Organization ownership is not treated as permission for every app.
+
 ### `topolo apps`
 
 Lists launchable Topolo applications available to the current credential. This

package/dist/index.js

@@ -110,57 +110,8 @@ var TopoloHttpError = class extends TopoloSdkError {
   }
 };
 var APP_API_URLS = {
-  agent: "https://agent.topolo.app",
   auth: "https://auth.topolo.app",
-  backup: "https://backup.topolo.app",
-  blog: "https://blog.topolo.app",
-  books: "https://books.topolo.app",
-  brand: "https://brand.topolo.app",
-  bugfix: "https://bugfix.topolo.app",
-  bytes: "https://bytes.topolo.app",
-  calendar: "https://calendar.topolo.app",
-  campaigns: "https://campaigns.topolo.app",
-  capacity: "https://capacity.topolo.app",
-  chat: "https://chat.topolo.app",
-  commerce: "https://commerce.topolo.app",
-  compose: "https://compose.topolo.app",
-  consent: "https://consent.topolo.app",
-  crm: "https://crm.topolo.app",
-  design: "https://design.topolo.app",
-  developers: "https://developers.topolo.app",
-  director: "https://director.topolo.app",
-  feed: "https://feed.topolo.app",
-  flow: "https://flow.topolo.app",
-  forecast: "https://forecast.topolo.app",
-  forms: "https://forms.topolo.app",
-  home: "https://home.topolo.app",
-  insights: "https://insights.topolo.app",
-  inventory: "https://inventory.topolo.app",
-  learn: "https://learn.topolo.app",
-  localize: "https://localize.topolo.app",
-  mail: "https://mail.topolo.app",
-  mdm: "https://mdm.topolo.app",
-  messages: "https://messages.topolo.app",
-  nexus: "https://nexus.topolo.app",
-  notify: "https://notify.topolo.app",
-  observability_watch: "https://observability-watch.topolo.app",
-  one: "https://www.topolo.app",
-  p2p: "https://p2p.topolo.app",
-  pay: "https://pay.topolo.app",
-  people: "https://people.topolo.app",
-  "quro.api": "https://api.ol0.me",
-  "quro.redirect": "https://ol0.me",
-  roadmapper: "https://roadmapper.topolo.app",
-  sign: "https://sign.topolo.app",
-  social_studio: "https://studio.topolo.app",
-  socialize: "https://socialize.topolo.app",
-  spaces: "https://spaces.topolo.app",
-  status: "https://status.topolo.app",
-  success: "https://success.topolo.app",
-  support: "https://support.topolo.app",
-  survey: "https://survey.topolo.app",
-  voice: "https://voice.topolo.app",
-  web: "https://web.topolo.app"
+  developers: "https://developers.topolo.app"
 };
 var APPLICATIONS = {
   "admin": {
@@ -1886,7 +1837,145 @@ var APPLICATIONS = {
     ]
   }
 };
-var APPLICATION_REQUIREMENTS_VERSION = "2026-06-07.1";
+function friendlyAppId(entry) {
+  for (const value of [entry.slug, entry.name, entry.appId]) {
+    if (typeof value !== "string" || !value.trim()) continue;
+    const normalized = value.trim().toLowerCase().replace(/\s+/g, "-");
+    const withoutPrefix = normalized.replace(/^(?:app[_-])?topolo[-_]+/, "");
+    if (withoutPrefix) return withoutPrefix;
+  }
+  return entry.appId;
+}
+function idVariants(value) {
+  const normalized = value.trim().toLowerCase().replace(/\s+/g, "-");
+  return [.../* @__PURE__ */ new Set([
+    normalized,
+    normalized.replace(/-/g, "_"),
+    normalized.replace(/_/g, "-")
+  ])].filter(Boolean);
+}
+var STATIC_APPLICATIONS = APPLICATIONS;
+function staticApplicationForId(id) {
+  for (const variant of idVariants(id)) {
+    const entry = STATIC_APPLICATIONS[variant];
+    if (entry) return entry;
+  }
+  return null;
+}
+function applicationEntryFromCatalog(live) {
+  const id = friendlyAppId(live);
+  return {
+    id,
+    appDir: "-",
+    name: live.name ?? live.slug ?? live.appId,
+    packageName: null,
+    productionUrl: live.launchUrl ?? live.apiBaseUrl ?? null,
+    services: live.apiBaseUrl ? [id] : [],
+    deployTargets: []
+  };
+}
+var DIRECTORY_PAGE_LIMIT = 100;
+var DIRECTORY_MAX_PAGES = 100;
+function staticApplicationDirectory() {
+  const applications = Object.entries(STATIC_APPLICATIONS).map(([id, application]) => ({
+    id,
+    application,
+    source: "static",
+    live: null
+  })).sort((left, right) => left.id.localeCompare(right.id));
+  return { source: "static_fallback", applications };
+}
+function directoryApplicationFromLive(live) {
+  const id = friendlyAppId(live);
+  return {
+    id,
+    // Prefer the static snapshot's richer repo/deploy metadata when the live
+    // registry confirms the app; synthesize from the live entry otherwise.
+    application: staticApplicationForId(id) ?? applicationEntryFromCatalog(live),
+    source: "live",
+    live
+  };
+}
+async function listApplicationDirectory(client) {
+  if (!client) return staticApplicationDirectory();
+  let services;
+  try {
+    services = [];
+    let cursor;
+    for (let page = 0; page < DIRECTORY_MAX_PAGES; page += 1) {
+      const result = await client.searchServices({
+        ...cursor ? { cursor } : {},
+        limit: DIRECTORY_PAGE_LIMIT
+      });
+      services.push(...result.services);
+      if (!result.page.nextCursor) break;
+      cursor = result.page.nextCursor;
+    }
+  } catch {
+    return staticApplicationDirectory();
+  }
+  const seen = /* @__PURE__ */ new Map();
+  for (const live of services) {
+    const entry = directoryApplicationFromLive(live);
+    if (!seen.has(entry.id)) seen.set(entry.id, entry);
+  }
+  return {
+    source: "live",
+    applications: [...seen.values()].sort((left, right) => left.id.localeCompare(right.id))
+  };
+}
+function matchesDirectoryApplication(app, needle) {
+  const candidates = new Set(idVariants(needle));
+  const keys = [
+    app.id,
+    app.application.id,
+    app.application.name,
+    app.live?.appId,
+    app.live?.slug,
+    app.live?.name
+  ];
+  for (const key of keys) {
+    if (typeof key !== "string" || !key.trim()) continue;
+    for (const variant of idVariants(key)) {
+      if (candidates.has(variant)) return true;
+    }
+    for (const variant of idVariants(friendlyAppId({ appId: key }))) {
+      if (candidates.has(variant)) return true;
+    }
+  }
+  return false;
+}
+function formatDirectoryApplicationIds(directory) {
+  const ids = directory.applications.map((app) => app.id).sort();
+  const preview = ids.slice(0, 50).join(", ");
+  const suffix = ids.length > 50 ? `, ... +${ids.length - 50} more` : "";
+  const label = directory.source === "live" ? "Applications available to this credential" : "Applications in the bundled static snapshot (live registry unreachable)";
+  return `${label}: ${preview}${suffix}`;
+}
+async function resolveApplicationDirectoryEntry(client, application) {
+  const needle = typeof application === "string" ? application.trim() : "";
+  if (!needle) {
+    throw new TopoloSdkError("unknown_application", "application is required");
+  }
+  if (client) {
+    let live = null;
+    try {
+      live = await client.getService(needle);
+    } catch {
+      live = null;
+    }
+    if (live) return directoryApplicationFromLive(live);
+  }
+  const directory = await listApplicationDirectory(client);
+  const match = directory.applications.find((app) => matchesDirectoryApplication(app, needle));
+  if (match) return match;
+  throw new TopoloSdkError(
+    "unknown_application",
+    `Unknown application "${application}". ${formatDirectoryApplicationIds(directory)}`
+  );
+}
+var STATIC_APPLICATIONS2 = APPLICATIONS;
+var APPLICATION_REQUIREMENTS_VERSION = "2026-08-11.1";
 var APPLICATION_REQUIREMENTS = [
   {
     id: "platform-metadata",
@@ -1896,10 +1985,10 @@ var APPLICATION_REQUIREMENTS = [
     evidence: [
       "topolo.cloudcontrol.json exists for every deployed app surface",
       "package.json names the package or app when the repo ships code",
-      "The SDK application catalog exposes the app through topolo apps and MCP discovery"
+      "The live platform registry exposes the app through topolo apps and MCP discovery"
     ],
     implementation: [
-      "Add the app to the SDK application catalog generator before exposing it to agents",
+      "Register the app in the live platform registry (Auth service catalog) before exposing it to agents",
       "Keep production URLs, Worker names, Pages projects, routes, domains, and bindings current in CloudControl metadata",
       "Do not leave a new Topolo* app directory without an explicit application ID"
     ]
@@ -1974,7 +2063,7 @@ var APPLICATION_REQUIREMENTS = [
     implementation: [
       "Add production Worker api_url metadata and sdk_app_id for every agent-callable API target",
       "Mark browser, documentation, and runtime-only Worker targets with agent_callable:false",
-      "Expose stable app IDs through generated DEFAULT_APP_URLS and live catalog discovery",
+      "Expose stable app IDs through live catalog discovery",
       "Keep typed SDK/CLI/MCP surfaces in sync when an API contract stabilizes"
     ]
   },
@@ -2094,15 +2183,24 @@ function applicationRequirementScopes(application) {
   }
   return Array.from(scopes);
 }
+function fallbackApplication(id) {
+  const entry = STATIC_APPLICATIONS2[id];
+  if (!entry) {
+    throw new Error(
+      `Unknown application "${id}" in the static fallback snapshot. Resolve applications from the live registry (resolveApplicationDirectoryEntry) and pass the entry directly.`
+    );
+  }
+  return entry;
+}
 function requirementsForApplication(applicationOrId) {
-  const application = typeof applicationOrId === "string" ? APPLICATIONS[applicationOrId] : applicationOrId;
+  const application = typeof applicationOrId === "string" ? fallbackApplication(applicationOrId) : applicationOrId;
   const scopes = new Set(applicationRequirementScopes(application));
   return APPLICATION_REQUIREMENTS.filter(
     (requirement) => requirement.appliesTo.some((scope) => scopes.has(scope))
   );
 }
 function auditApplicationRequirements(applicationOrId) {
-  const application = typeof applicationOrId === "string" ? APPLICATIONS[applicationOrId] : applicationOrId;
+  const application = typeof applicationOrId === "string" ? fallbackApplication(applicationOrId) : applicationOrId;
   const scopes = applicationRequirementScopes(application);
   const findings = requirementsForApplication(application).map(
     (requirement) => evaluateRequirement(application, requirement)
@@ -2115,10 +2213,12 @@ function auditApplicationRequirements(applicationOrId) {
     findings
   };
 }
-function auditAllApplicationRequirements(applicationIds = Object.keys(APPLICATIONS).sort()) {
-  const applications = applicationIds.map(
-    (applicationId) => auditApplicationRequirements(applicationId)
+function auditApplicationEntries(applications) {
+  return buildAuditReport(
+    applications.map((application) => auditApplicationRequirements(application))
   );
+}
+function buildAuditReport(applications) {
   const migrationQueue = applications.flatMap(
     (audit) => audit.findings.filter((finding2) => finding2.status !== "met").map((finding2) => ({
       applicationId: audit.application.id,
@@ -3421,8 +3521,9 @@ var TopoloClient = class _TopoloClient {
     });
   }
   /**
-   * Bundled generated registry for tooling that audits platform packaging, not
-   * for deciding what the current credential may use.
+   * @deprecated Static fallback snapshot only. Use `searchServices()` (the
+   * live credential-scoped registry) for anything that decides behavior; this
+   * exists for offline packaging audits when the registry is unreachable.
    */
   listBundledServices() {
     const apps = Object.values(APPLICATIONS);
@@ -3735,10 +3836,19 @@ function mapActionInput(action, input3) {
     delete remaining[key];
     return encodeURIComponent(String(value));
   });
-  const explicitQuery = plainObject(remaining.query);
-  delete remaining.query;
-  const explicitBody = Object.prototype.hasOwnProperty.call(remaining, "body") ? remaining.body : void 0;
-  delete remaining.body;
+  const schemaProperties = plainObject(plainObject(action.inputSchema).properties);
+  const schemaOwnsQuery = Object.prototype.hasOwnProperty.call(schemaProperties, "query");
+  const schemaOwnsBody = Object.prototype.hasOwnProperty.call(schemaProperties, "body");
+  let explicitQuery = {};
+  if (!schemaOwnsQuery) {
+    explicitQuery = plainObject(remaining.query);
+    delete remaining.query;
+  }
+  let explicitBody;
+  if (!schemaOwnsBody) {
+    explicitBody = Object.prototype.hasOwnProperty.call(remaining, "body") ? remaining.body : void 0;
+    delete remaining.body;
+  }
   if (action.method === "GET") {
     return {
       path: path9,
@@ -3862,6 +3972,65 @@ var IdentityModule = class {
     return this.client.introspect();
   }
 };
+var ACTIONS = {
+  list: "app_topolo_auth.workspaces.list",
+  create: "app_topolo_auth.workspaces.create",
+  rename: "app_topolo_auth.workspaces.rename",
+  setDefault: "app_topolo_auth.workspaces.default.set"
+};
+var WorkspacesModule = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  async list(application) {
+    const context = await this.resolveContext(application);
+    return this.client.callAction(ACTIONS.list, {
+      org_id: context.organizationId,
+      app_id: context.appId
+    });
+  }
+  async create(application, input3) {
+    const current = await this.list(application);
+    if (!current.data.policy.canCreate) {
+      throw new TopoloSdkError(
+        "workspace_creation_not_allowed",
+        `Workspace creation is not allowed for ${current.data.appId}: ${current.data.policy.reason}`
+      );
+    }
+    return this.client.callAction(ACTIONS.create, {
+      organizationId: current.data.organizationId,
+      appId: current.data.appId,
+      name: input3.name,
+      ...input3.isDefault === void 0 ? {} : { isDefault: input3.isDefault }
+    }, { confirm: input3.confirm === true });
+  }
+  async rename(application, workspaceId, name, confirm = false) {
+    const context = await this.resolveContext(application);
+    return this.client.callAction(ACTIONS.rename, {
+      workspaceId,
+      organizationId: context.organizationId,
+      appId: context.appId,
+      name
+    }, { confirm });
+  }
+  async setDefault(application, workspaceId, confirm = false) {
+    const context = await this.resolveContext(application);
+    return this.client.callAction(ACTIONS.setDefault, {
+      workspaceId,
+      organizationId: context.organizationId,
+      appId: context.appId
+    }, { confirm });
+  }
+  async resolveContext(application) {
+    const identity = await this.client.introspect();
+    if (!identity.organization?.id) {
+      throw new TopoloSdkError("organization_required", "Workspace lifecycle requires an organization-scoped credential.");
+    }
+    const service = await this.client.getService(application);
+    return { organizationId: identity.organization.id, appId: service.appId };
+  }
+};
 var DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 var TopoloOAuth = class {
   baseUrl;
@@ -3945,6 +4114,7 @@ function createTopolo(options) {
   return {
     client,
     identity: new IdentityModule(client),
+    workspaces: new WorkspacesModule(client),
     crm: new CrmModule(client)
   };
 }
@@ -4010,57 +4180,8 @@ var TopoloHttpError2 = class extends TopoloSdkError2 {
   }
 };
 var APP_API_URLS2 = {
-  agent: "https://agent.topolo.app",
   auth: "https://auth.topolo.app",
-  backup: "https://backup.topolo.app",
-  blog: "https://blog.topolo.app",
-  books: "https://books.topolo.app",
-  brand: "https://brand.topolo.app",
-  bugfix: "https://bugfix.topolo.app",
-  bytes: "https://bytes.topolo.app",
-  calendar: "https://calendar.topolo.app",
-  campaigns: "https://campaigns.topolo.app",
-  capacity: "https://capacity.topolo.app",
-  chat: "https://chat.topolo.app",
-  commerce: "https://commerce.topolo.app",
-  compose: "https://compose.topolo.app",
-  consent: "https://consent.topolo.app",
-  crm: "https://crm.topolo.app",
-  design: "https://design.topolo.app",
-  developers: "https://developers.topolo.app",
-  director: "https://director.topolo.app",
-  feed: "https://feed.topolo.app",
-  flow: "https://flow.topolo.app",
-  forecast: "https://forecast.topolo.app",
-  forms: "https://forms.topolo.app",
-  home: "https://home.topolo.app",
-  insights: "https://insights.topolo.app",
-  inventory: "https://inventory.topolo.app",
-  learn: "https://learn.topolo.app",
-  localize: "https://localize.topolo.app",
-  mail: "https://mail.topolo.app",
-  mdm: "https://mdm.topolo.app",
-  messages: "https://messages.topolo.app",
-  nexus: "https://nexus.topolo.app",
-  notify: "https://notify.topolo.app",
-  observability_watch: "https://observability-watch.topolo.app",
-  one: "https://www.topolo.app",
-  p2p: "https://p2p.topolo.app",
-  pay: "https://pay.topolo.app",
-  people: "https://people.topolo.app",
-  "quro.api": "https://api.ol0.me",
-  "quro.redirect": "https://ol0.me",
-  roadmapper: "https://roadmapper.topolo.app",
-  sign: "https://sign.topolo.app",
-  social_studio: "https://studio.topolo.app",
-  socialize: "https://socialize.topolo.app",
-  spaces: "https://spaces.topolo.app",
-  status: "https://status.topolo.app",
-  success: "https://success.topolo.app",
-  support: "https://support.topolo.app",
-  survey: "https://survey.topolo.app",
-  voice: "https://voice.topolo.app",
-  web: "https://web.topolo.app"
+  developers: "https://developers.topolo.app"
 };
 var DEFAULT_APP_URLS2 = APP_API_URLS2;
 function resolveServiceUrl2(service, overrides) {
@@ -6454,12 +6575,6 @@ function normalizeContainerAppId(value, surfaceModel) {
 function normalizeApplicationId(application) {
   const raw = application.trim().toLowerCase();
   const normalized = raw.replace(/-/g, "_");
-  if (Object.prototype.hasOwnProperty.call(APPLICATIONS, raw)) {
-    return raw;
-  }
-  if (Object.prototype.hasOwnProperty.call(APPLICATIONS, normalized)) {
-    return normalized;
-  }
   if (/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(raw) || /^[a-z0-9](?:[a-z0-9_]*[a-z0-9])?$/.test(raw)) {
     return normalized;
   }
@@ -9845,7 +9960,7 @@ function applicationScaffoldPayload(application, options = {}) {
   const requestedId = normalizeApplicationId(application);
   const id = target === "platform" ? normalizeFirstPartyApplicationId(requestedId) : requestedId;
   const slug = toSlug(id);
-  const catalogApplication = APPLICATIONS[id];
+  const catalogApplication = options.catalogApplication ?? null;
   const browser = options.browser !== false;
   const api = options.api ?? target === "platform";
   const audience = normalizeAudience(
@@ -11481,7 +11596,6 @@ function registerApplicationReconcileCommand(parent, ownerType, dependencies = {
 }
 
 // src/commands/apps.ts
-var APPLICATION_IDS = Object.keys(APPLICATIONS).sort();
 var CLOUDCONTROL_LOCAL_APPLICATION = {
   id: "cloudcontrol",
   appDir: "TopoloCloudControl",
@@ -11491,6 +11605,21 @@ var CLOUDCONTROL_LOCAL_APPLICATION = {
   services: [],
   deployTargets: []
 };
+async function directoryClient() {
+  try {
+    const topolo = await buildClient();
+    return topolo ? topolo.client : null;
+  } catch {
+    return null;
+  }
+}
+async function resolveScaffoldCatalogApplication(application) {
+  try {
+    return await resolveApplication(application, await directoryClient());
+  } catch {
+    return null;
+  }
+}
 function registerAppsCommand(program2) {
   const apps = program2.command("apps").description("Search Topolo platform applications available to the current credential").option("-q, --query <query>", "Filter by app id, slug, or name").option("--cursor <cursor>", "Continuation cursor from the previous page").option("--limit <limit>", "Page size (1-100)", "25").option("--json", "Output JSON", true).option("--no-json", "Output human-readable table").action(async (opts) => {
     const mode = resolveOutputMode(opts.json);
@@ -11528,10 +11657,10 @@ function registerAppsCommand(program2) {
   });
   apps.command("requirements [application]").description(
     "Show the versioned Topolo application-build requirements, optionally filtered to one app."
-  ).option("--json", "Output JSON", true).option("--no-json", "Output human-readable details").action((application, opts) => {
+  ).option("--json", "Output JSON", true).option("--no-json", "Output human-readable details").action(async (application, opts) => {
     const mode = resolveOutputMode(opts.json);
     try {
-      const payload = applicationRequirementsPayload(application);
+      const payload = await applicationRequirementsPayload(application, await directoryClient());
       emit(payload, mode, () => formatRequirements(payload));
     } catch (err) {
       fail(err, mode);
@@ -11542,12 +11671,13 @@ function registerAppsCommand(program2) {
   ).option("--json", "Output JSON", true).option("--no-json", "Output human-readable table").option("--local", "Inspect the local Topolo checkout for filesystem-backed evidence").option("--repo-root <path>", "Topolo checkout root to inspect when --local is set").option(
     "--fail-on <status>",
     "Exit non-zero when audit has findings at this severity or worse: missing, needs_review, partial"
-  ).action((application, opts) => {
+  ).action(async (application, opts) => {
     const mode = resolveOutputMode(opts.json);
     try {
-      const payload = applicationAuditPayload(application, {
+      const payload = await applicationAuditPayload(application, {
         local: opts.local,
-        repoRoot: opts.repoRoot
+        repoRoot: opts.repoRoot,
+        client: await directoryClient()
       });
       const gate = opts.failOn ? evaluateApplicationAuditGate(payload, opts.failOn) : null;
       const output2 = gate ? { ...payload, conformanceGate: gate } : payload;
@@ -11567,10 +11697,13 @@ function registerAppsCommand(program2) {
   });
   apps.command("record-evidence <application>").description(
     "Stamp <repo>/.topolo/evidence.json with the latest CI gate results so the audit can flip verification-gates / observability-and-audit / canonical-docs from partial to met when the recorded run is fresh (< 24h)."
-  ).option("--json", "Output JSON", true).option("--no-json", "Output human-readable summary").option("--app-root <path>", "Path to the application repo root (defaults to cwd)").option("--build", "Mark the latest build as successful").option("--typecheck", "Mark the latest typecheck as successful").option("--test", "Mark the latest test run as successful").option("--docs-validate", "Mark the latest TopoloDocs npm run validate as successful").option("--smoke <url>", "Mark the latest live smoke as successful against this URL").option("--commit <sha>", "Override the commit hash (defaults to git HEAD)").action((application, opts) => {
+  ).option("--json", "Output JSON", true).option("--no-json", "Output human-readable summary").option("--app-root <path>", "Path to the application repo root (defaults to cwd)").option("--build", "Mark the latest build as successful").option("--typecheck", "Mark the latest typecheck as successful").option("--test", "Mark the latest test run as successful").option("--docs-validate", "Mark the latest TopoloDocs npm run validate as successful").option("--smoke <url>", "Mark the latest live smoke as successful against this URL").option("--commit <sha>", "Override the commit hash (defaults to git HEAD)").action(async (application, opts) => {
     const mode = resolveOutputMode(opts.json);
     try {
-      const payload = recordApplicationEvidence(application, opts);
+      const payload = await recordApplicationEvidence(application, {
+        ...opts,
+        client: await directoryClient()
+      });
       emit(payload, mode, () => formatEvidence(payload));
     } catch (err) {
       fail(err, mode);
@@ -11592,6 +11725,7 @@ function registerAppsCommand(program2) {
     try {
       const api = resolveScaffoldApiOption(opts.api, opts.withApi);
       const payload = applicationScaffoldPayload(application, {
+        catalogApplication: await resolveScaffoldCatalogApplication(application),
         appDir: opts.appDir,
         name: opts.name,
         packageName: opts.packageName,
@@ -11653,14 +11787,11 @@ function parsePageSize2(value) {
   }
   return parsed;
 }
-function resolveApplication(application) {
-  const id = application.trim().toLowerCase();
-  if (!APPLICATION_IDS.includes(id)) {
-    throw new Error(`Unknown application "${application}". ${formatKnownValues(APPLICATION_IDS, "applications")}`);
-  }
-  return APPLICATIONS[id];
+async function resolveApplication(application, client = null) {
+  const resolved = await resolveApplicationDirectoryEntry(client, application);
+  return resolved.application;
 }
-function applicationRequirementsPayload(application) {
+async function applicationRequirementsPayload(application, client = null) {
   if (!application) {
     return {
       version: APPLICATION_REQUIREMENTS_VERSION,
@@ -11669,7 +11800,7 @@ function applicationRequirementsPayload(application) {
       requirements: [...APPLICATION_REQUIREMENTS]
     };
   }
-  const app = resolveApplication(application);
+  const app = await resolveApplication(application, client);
   return {
     version: APPLICATION_REQUIREMENTS_VERSION,
     application: app,
@@ -11677,18 +11808,21 @@ function applicationRequirementsPayload(application) {
     requirements: requirementsForApplication(app)
   };
 }
-function applicationAuditPayload(application, options = {}) {
+async function applicationAuditPayload(application, options = {}) {
+  const client = options.client ?? null;
   const requestedId = application?.trim().toLowerCase();
   const report = requestedId === "cloudcontrol" && options.local ? {
     version: APPLICATION_REQUIREMENTS_VERSION,
     applications: [auditApplicationRequirements(CLOUDCONTROL_LOCAL_APPLICATION)],
     migrationQueue: []
-  } : application ? auditAllApplicationRequirements([resolveApplication(application).id]) : auditAllApplicationRequirements();
+  } : application ? auditApplicationEntries([await resolveApplication(application, client)]) : auditApplicationEntries(
+    (await listApplicationDirectory(client)).applications.map((app) => app.application)
+  );
   if (!options.local) return report;
   return enrichApplicationAuditWithLocalEvidence(report, { repoRoot: options.repoRoot });
 }
-function recordApplicationEvidence(application, options = {}) {
-  const appId = resolveApplication(application).id;
+async function recordApplicationEvidence(application, options = {}) {
+  const appId = (await resolveApplication(application, options.client ?? null)).id;
   const root = path6.resolve(options.appRoot ?? process.cwd());
   if (!existsSync4(root)) {
     throw new Error(`Application root does not exist: ${root}`);
@@ -11819,22 +11953,7 @@ function applicationUrl(application) {
   return application.apiBaseUrl ?? application.launchUrl ?? application.productionUrl ?? null;
 }
 function displayCatalogId(entry) {
-  for (const value of [entry.slug, entry.name, entry.appId]) {
-    if (typeof value !== "string" || !value.trim()) continue;
-    const candidates = catalogIdCandidates(value);
-    const withoutTopolo = candidates.find((candidate) => !candidate.startsWith("topolo-"));
-    if (withoutTopolo) return withoutTopolo;
-    if (candidates[0]) return candidates[0];
-  }
-  return entry.appId;
-}
-function catalogIdCandidates(value) {
-  const normalized = value.trim().toLowerCase().replace(/\s+/g, "-");
-  const withoutTopolo = normalized.startsWith("topolo-") ? normalized.slice("topolo-".length) : normalized;
-  return [.../* @__PURE__ */ new Set([
-    normalized,
-    withoutTopolo
-  ])].filter(Boolean);
+  return friendlyAppId(entry);
 }
 function formatRequirements(payload) {
   const lines = [
@@ -11998,12 +12117,6 @@ function normalizeFailOn(value) {
   }
   throw new Error("Invalid --fail-on value. Use missing, needs_review, or partial.");
 }
-function formatKnownValues(values, label) {
-  const sorted = [...values].sort();
-  const preview = sorted.slice(0, 25).join(", ");
-  const suffix = sorted.length > 25 ? `, ... +${sorted.length - 25} more` : "";
-  return `Run discovery for the full ${label} list. Known snapshot sample: ${preview}${suffix}`;
-}
 function statusesAtOrWorse(threshold) {
   if (threshold === "missing") return ["missing"];
   if (threshold === "needs_review") return ["missing", "needs_review"];
@@ -12205,6 +12318,7 @@ function registerPlatformCommand(program2) {
       }
       const api = resolveScaffoldApiOption(opts.api, opts.withApi);
       const payload = applicationScaffoldPayload(application, {
+        catalogApplication: await resolveScaffoldCatalogApplication(application),
         appDir: opts.appDir,
         name: opts.name,
         packageName: opts.packageName,
@@ -12456,15 +12570,7 @@ function isStagingUrl(value) {
   return url.includes(".stg.topolo.us") || url.includes("localhost") || url.includes("127.0.0.1") || url.includes("topolo-staging");
 }
 function displayAppId(entry) {
-  for (const value of [entry.slug, entry.name, entry.appId]) {
-    if (typeof value !== "string" || !value.trim()) continue;
-    for (const candidate of appIdCandidates(value)) {
-      if (Object.prototype.hasOwnProperty.call(DEFAULT_APP_URLS, candidate)) {
-        return candidate;
-      }
-    }
-  }
-  return appIdCandidates(entry.slug || entry.appId)[0] || entry.appId;
+  return friendlyAppId(entry);
 }
 function defaultServiceUrl(id, entry) {
   return resolveCatalogServiceUrl(entry, { serviceKey: id });
@@ -13461,6 +13567,79 @@ function formatResources(result) {
   return lines.join("\n");
 }
 
+// src/commands/workspaces.ts
+function registerWorkspacesCommand(program2) {
+  const workspaces = program2.command("workspaces").description("Discover and manage caller-authorized workspaces for one Topolo application");
+  workspaces.command("list <application>").description("List workspaces and the caller-specific creation policy for one application").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (application, opts) => {
+    const mode = resolveOutputMode(opts.json);
+    try {
+      const topolo = await requiredClient2();
+      const result = await topolo.workspaces.list(application);
+      emit(result, mode, () => formatWorkspaceList(result));
+    } catch (error) {
+      fail(error, mode);
+    }
+  });
+  workspaces.command("create <application>").description("Create a workspace when the target application policy permits it").requiredOption("--name <name>", "Workspace display name").option("--default", "Make the new workspace the application default").option("--confirm", "Acknowledge workspace creation").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (application, opts) => {
+    const mode = resolveOutputMode(opts.json);
+    try {
+      const topolo = await requiredClient2();
+      const result = await topolo.workspaces.create(application, {
+        name: opts.name.trim(),
+        isDefault: opts.default === true,
+        confirm: opts.confirm === true
+      });
+      emit(result, mode, () => formatWorkspaceMutation(result));
+    } catch (error) {
+      fail(error, mode);
+    }
+  });
+  workspaces.command("rename <application> <workspace-id>").description("Rename a caller-authorized workspace without changing its stable id").requiredOption("--name <name>", "New workspace display name").option("--confirm", "Acknowledge workspace rename").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (application, workspaceId, opts) => {
+    const mode = resolveOutputMode(opts.json);
+    try {
+      const topolo = await requiredClient2();
+      const result = await topolo.workspaces.rename(application, workspaceId, opts.name.trim(), opts.confirm === true);
+      emit(result, mode, () => formatWorkspaceMutation(result));
+    } catch (error) {
+      fail(error, mode);
+    }
+  });
+  workspaces.command("default <application> <workspace-id>").description("Set the default workspace for one application").option("--confirm", "Acknowledge the default-workspace change").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (application, workspaceId, opts) => {
+    const mode = resolveOutputMode(opts.json);
+    try {
+      const topolo = await requiredClient2();
+      const result = await topolo.workspaces.setDefault(application, workspaceId, opts.confirm === true);
+      emit(result, mode, () => formatWorkspaceMutation(result));
+    } catch (error) {
+      fail(error, mode);
+    }
+  });
+}
+async function requiredClient2() {
+  const topolo = await buildClient();
+  if (!topolo) throw new Error("No credential configured. Run `topolo auth login` or set TOPOLO_API_KEY.");
+  return topolo;
+}
+function formatWorkspaceList(result) {
+  const { data } = result;
+  const lines = [
+    `Application: ${data.appId}`,
+    `Organization: ${data.organizationId}`,
+    `Can create: ${data.policy.canCreate ? "yes" : "no"} (${data.policy.reason})`
+  ];
+  if (!data.workspaces.length) return [...lines, "", "No accessible workspaces."].join("\n");
+  lines.push("", "DEFAULT  ID  NAME  ACCESS");
+  for (const workspace of data.workspaces) {
+    lines.push(`${workspace.isDefault ? "yes" : "no"}  ${workspace.id}  ${workspace.name}  ${workspace.accessLevel}`);
+  }
+  return lines.join("\n");
+}
+function formatWorkspaceMutation(result) {
+  const workspace = result.data.workspace;
+  return `${result.message}
+Workspace: ${workspace.name} (${workspace.id})${workspace.isDefault ? "\nDefault: yes" : ""}`;
+}
+
 // src/index.ts
 var program = new Command();
 var argv;
@@ -13492,6 +13671,7 @@ registerSeedCommands(program);
 registerSkillsCommand(program);
 registerContextCommand(program);
 registerResourcesCommand(program);
+registerWorkspacesCommand(program);
 program.parseAsync(argv).catch((err) => {
   process.stderr.write(`Unexpected error: ${err instanceof Error ? err.message : String(err)}
 `);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@topolo/cli",
-  "version": "0.6.8",
-  "topoloPublishedVersion": "0.6.8",
+  "version": "0.7.0",
+  "topoloPublishedVersion": "0.7.0",
   "description": "Command-line interface for Topolo developers, operators, and agents, with internal first-party scaffolding available under the topolo platform namespace.",
   "type": "module",
   "bin": {

package/skills/codex/AGENTS.md

@@ -4,7 +4,7 @@ This file teaches an agent how to interact with the Topolo platform via the `top
 
 ## What the platform is
 
-Topolo is a multi-app SaaS platform. The CLI and MCP server both use `@topolo/sdk`; bundled app IDs come from the generated registry, and newly registered API/technical services can be resolved from the live Auth catalog.
+Topolo is a multi-app SaaS platform. The CLI and MCP server both use `@topolo/sdk`; every application resolves from the live credential-scoped registry, so newly registered apps and API/technical services work immediately — there is no bundled application catalog to rely on or wait for.
 
 - Use `topolo apps --json` or the MCP `topolo_search_applications` tool to discover platform applications, including browser-only Worker apps.
 - Use `topolo apps requirements <application_id> --json` or the MCP `topolo_list_application_requirements` tool before creating or expanding a Topolo app.
@@ -12,7 +12,7 @@ Topolo is a multi-app SaaS platform. The CLI and MCP server both use `@topolo/sd
 - Use `topolo services --json` or the MCP `topolo_search_applications` tool to discover callable app ids and effective URLs.
 - Use `topolo actions --service <app> --json` or MCP `topolo_search_actions` to discover callable operations granted to the current credential; invoke automatic reads with `topolo_read_action` and confirmation-gated operations with `topolo_call_action`.
 - Use `topolo actions capabilities`, `actions examples`, `actions validate`, and `actions plan` (or their MCP equivalents) to obtain schemas, examples, verification, and rollback before execution.
-- The generic `api` command and MCP `topolo_api_call` tool can reach bundled SDK services and live Auth-catalog API/technical services when no action contract exists yet.
+- The generic `api` command and MCP `topolo_api_call` tool can reach any live Auth-catalog application or API/technical service when no action contract exists yet; discover ids with `topolo apps --json` first.
 
 Every call is scoped to the organization embedded in the credential. There is no `--org` flag anywhere — attempting to target another org will fail.
 

package/skills/topolo/SKILL.md

@@ -72,12 +72,24 @@ topolo resources <application> --json
 
 Use the returned app id or slug. Read `apiKeyResources` to learn whether calls can be scoped to aliases such as a workspace, site, mailbox, brand, or venue. Use `topolo resources` to resolve the actual credential-scoped resource ids. With an API key it returns only the key's bound resources; with OAuth it uses the published Auth resource catalog. Never assume that an organization id is a valid app resource id.
 
+Workspace lifecycle is canonically owned by Topolo Auth but authorized against the concrete target application. Never conclude that workspace provisioning is unavailable because the target app's own action catalog does not duplicate Auth actions. Always run:
+
+```bash
+topolo workspaces list <application> --json
+```
+
+Its `data.policy.canCreate` and `data.policy.reason` are the caller-specific creation decision for that application. Organization ownership does not imply permission to create workspaces for every app. When permitted, the first-class mutations are `topolo workspaces create`, `topolo workspaces rename`, and `topolo workspaces default`; each still requires confirmation and Auth performs the final runtime authorization.
+
 MCP equivalents:
 
 - `topolo_search_applications`
 - `topolo_get_application`
 - `topolo_get_resource_types`
 - `topolo_list_resources`
+- `topolo_list_workspaces`
+- `topolo_create_workspace`
+- `topolo_rename_workspace`
+- `topolo_set_default_workspace`
 
 ### 2. Discover credential-scoped actions