@topolo/cli 0.1.11 → 0.1.13

package/dist/index.js

@@ -67,20 +67,14 @@ var TopoloHttpError = class extends TopoloSdkError {
 var SERVICES = {
   agent: "https://topolo-agent-worker.topolo.workers.dev",
   auth: "https://auth.topolo.app",
-  books: "https://books.topolo.app",
   bugfix: "https://bugfix.topolo.app",
   bytes: "https://r2-media-manager-worker.topolo.workers.dev",
   calendar: "https://calendar.topolo.app",
   chat: "https://chat.topolo.app",
   commerce: "https://topolo-commerce-api.topolo.workers.dev",
   crm: "https://crm-api.topolo.app",
-  customer_success: "https://customer-success.topolo.app",
   feed: "https://topolo-feed-api.topolo.app",
-  flow: "https://flow.topolo.app",
   forecast: "https://forecast-worker-production.topolo.workers.dev",
-  forms: "https://forms.topolo.app",
-  insights: "https://insights.topolo.app",
-  inventory: "https://inventory.topolo.app",
   learn: "https://topololearn-api.topolo.workers.dev",
   mail: "https://mail.topolo.app",
   mdm: "https://topolo-mdm-api.topolo.app",
@@ -88,30 +82,16 @@ var SERVICES = {
   nexus: "https://topolo-nexus-gateway.topolo.workers.dev",
   one: "https://topoloone-worker.topolo.workers.dev",
   pay: "https://topolo-pay.topolo.workers.dev",
-  people: "https://people.topolo.app",
   "quro.api": "https://api.ol0.me",
   "quro.redirect": "https://ol0.me",
   roadmapper: "https://roadmapper-api.topolo.app",
-  sign: "https://sign.topolo.app",
   social_studio: "https://topolo-social-studio-api.topolo.workers.dev",
   socialize: "https://socialize-prod-api.topolo.workers.dev",
   support: "https://support.topolo.app",
-  survey: "https://survey.topolo.app",
-  voice: "https://voice.topolo.app",
   web: "https://web-api.topolo.app"
 };
 var PLATFORM_SERVICE_IDS = {
-  books: "srv_topolo_books",
-  crm: "srv_iCwM4jGXcwlj",
-  customer_success: "srv_topolo_customer_success",
-  flow: "srv_topolo_flow",
-  forms: "srv_topolo_forms",
-  insights: "srv_topolo_insights",
-  inventory: "srv_topolo_inventory",
-  people: "srv_topolo_people",
-  sign: "srv_topolo_sign",
-  survey: "srv_topolo_survey",
-  voice: "srv_topolo_voice"
+  crm: "srv_iCwM4jGXcwlj"
 };
 var APPLICATIONS = {
   "admin": {
@@ -184,30 +164,6 @@ var APPLICATIONS = {
       }
     ]
   },
-  "books": {
-    "id": "books",
-    "appDir": "TopoloBooks",
-    "name": "topolo-books",
-    "packageName": "topolo-books",
-    "productionUrl": "https://books.topolo.app",
-    "services": [
-      "books"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-books",
-        "kind": "worker",
-        "apiUrl": "https://books.topolo.app",
-        "domains": [
-          "books.topolo.app"
-        ],
-        "routes": [
-          "books.topolo.app"
-        ],
-        "serviceId": "books"
-      }
-    ]
-  },
   "bugfix": {
     "id": "bugfix",
     "appDir": "TopoloBugFix",
@@ -409,30 +365,6 @@ var APPLICATIONS = {
       }
     ]
   },
-  "customer_success": {
-    "id": "customer_success",
-    "appDir": "TopoloCustomerSuccess",
-    "name": "topolo-customer-success",
-    "packageName": "topolo-customer-success",
-    "productionUrl": "https://customer-success.topolo.app",
-    "services": [
-      "customer_success"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-customer-success",
-        "kind": "worker",
-        "apiUrl": "https://customer-success.topolo.app",
-        "domains": [
-          "customer-success.topolo.app"
-        ],
-        "routes": [
-          "customer-success.topolo.app"
-        ],
-        "serviceId": "customer_success"
-      }
-    ]
-  },
   "developers": {
     "id": "developers",
     "appDir": "TopoloDevelopers",
@@ -509,30 +441,6 @@ var APPLICATIONS = {
       }
     ]
   },
-  "flow": {
-    "id": "flow",
-    "appDir": "TopoloFlow",
-    "name": "topolo-flow",
-    "packageName": "topolo-flow",
-    "productionUrl": "https://flow.topolo.app",
-    "services": [
-      "flow"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-flow",
-        "kind": "worker",
-        "apiUrl": "https://flow.topolo.app",
-        "domains": [
-          "flow.topolo.app"
-        ],
-        "routes": [
-          "flow.topolo.app"
-        ],
-        "serviceId": "flow"
-      }
-    ]
-  },
   "forecast": {
     "id": "forecast",
     "appDir": "TopoloForecast",
@@ -561,78 +469,6 @@ var APPLICATIONS = {
       }
     ]
   },
-  "forms": {
-    "id": "forms",
-    "appDir": "TopoloForms",
-    "name": "topolo-forms",
-    "packageName": "topolo-forms",
-    "productionUrl": "https://forms.topolo.app",
-    "services": [
-      "forms"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-forms",
-        "kind": "worker",
-        "apiUrl": "https://forms.topolo.app",
-        "domains": [
-          "forms.topolo.app"
-        ],
-        "routes": [
-          "forms.topolo.app"
-        ],
-        "serviceId": "forms"
-      }
-    ]
-  },
-  "insights": {
-    "id": "insights",
-    "appDir": "TopoloInsights",
-    "name": "topolo-insights",
-    "packageName": "topolo-insights",
-    "productionUrl": "https://insights.topolo.app",
-    "services": [
-      "insights"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-insights",
-        "kind": "worker",
-        "apiUrl": "https://insights.topolo.app",
-        "domains": [
-          "insights.topolo.app"
-        ],
-        "routes": [
-          "insights.topolo.app"
-        ],
-        "serviceId": "insights"
-      }
-    ]
-  },
-  "inventory": {
-    "id": "inventory",
-    "appDir": "TopoloInventory",
-    "name": "topolo-inventory",
-    "packageName": "topolo-inventory",
-    "productionUrl": "https://inventory.topolo.app",
-    "services": [
-      "inventory"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-inventory",
-        "kind": "worker",
-        "apiUrl": "https://inventory.topolo.app",
-        "domains": [
-          "inventory.topolo.app"
-        ],
-        "routes": [
-          "inventory.topolo.app"
-        ],
-        "serviceId": "inventory"
-      }
-    ]
-  },
   "learn": {
     "id": "learn",
     "appDir": "TopoloLearn",
@@ -833,9 +669,7 @@ var APPLICATIONS = {
         "kind": "worker",
         "apiUrl": null,
         "domains": [
-          "one.topolo.io",
-          "topolo.io",
-          "www.topolo.io"
+          "one.topolo.io"
         ],
         "routes": [],
         "serviceId": null
@@ -872,30 +706,6 @@ var APPLICATIONS = {
       }
     ]
   },
-  "people": {
-    "id": "people",
-    "appDir": "TopoloPeople",
-    "name": "topolo-people",
-    "packageName": "topolo-people",
-    "productionUrl": "https://people.topolo.app",
-    "services": [
-      "people"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-people",
-        "kind": "worker",
-        "apiUrl": "https://people.topolo.app",
-        "domains": [
-          "people.topolo.app"
-        ],
-        "routes": [
-          "people.topolo.app"
-        ],
-        "serviceId": "people"
-      }
-    ]
-  },
   "quro": {
     "id": "quro",
     "appDir": "TopoloQuro",
@@ -967,30 +777,6 @@ var APPLICATIONS = {
       }
     ]
   },
-  "sign": {
-    "id": "sign",
-    "appDir": "TopoloSign",
-    "name": "topolo-sign",
-    "packageName": "topolo-sign",
-    "productionUrl": "https://sign.topolo.app",
-    "services": [
-      "sign"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-sign",
-        "kind": "worker",
-        "apiUrl": "https://sign.topolo.app",
-        "domains": [
-          "sign.topolo.app"
-        ],
-        "routes": [
-          "sign.topolo.app"
-        ],
-        "serviceId": "sign"
-      }
-    ]
-  },
   "social_studio": {
     "id": "social_studio",
     "appDir": "TopoloSocialStudio",
@@ -1087,54 +873,6 @@ var APPLICATIONS = {
       }
     ]
   },
-  "survey": {
-    "id": "survey",
-    "appDir": "TopoloSurvey",
-    "name": "topolo-survey",
-    "packageName": "topolo-survey",
-    "productionUrl": "https://survey.topolo.app",
-    "services": [
-      "survey"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-survey",
-        "kind": "worker",
-        "apiUrl": "https://survey.topolo.app",
-        "domains": [
-          "survey.topolo.app"
-        ],
-        "routes": [
-          "survey.topolo.app"
-        ],
-        "serviceId": "survey"
-      }
-    ]
-  },
-  "voice": {
-    "id": "voice",
-    "appDir": "TopoloVoice",
-    "name": "topolo-voice",
-    "packageName": "topolo-voice",
-    "productionUrl": "https://voice.topolo.app",
-    "services": [
-      "voice"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-voice",
-        "kind": "worker",
-        "apiUrl": "https://voice.topolo.app",
-        "domains": [
-          "voice.topolo.app"
-        ],
-        "routes": [
-          "voice.topolo.app"
-        ],
-        "serviceId": "voice"
-      }
-    ]
-  },
   "web": {
     "id": "web",
     "appDir": "TopoloWeb",
@@ -2204,7 +1942,7 @@ function sleep(ms) {
 }
 
 // src/version.ts
-var CLI_VERSION = "0.1.11";
+var CLI_VERSION = "0.1.13";
 
 // src/client.ts
 async function buildClient(options) {
@@ -2978,11 +2716,21 @@ var CLOUDFLARE_ACCOUNT_ID = "49ef1ba682ad8cfd720c86699ae17521";
 var CURRENT_VERIFICATION_DATE = "2026-04-23";
 function applicationScaffoldPayload(application, options = {}) {
   const target = normalizeTarget(options.target);
+  const portfolio = target === "platform" ? normalizePortfolio(options.portfolio) : null;
   const id = normalizeApplicationId(application);
   const slug = toSlug(id);
   const catalogApplication = APPLICATIONS[id];
   const browser = options.browser !== false;
   const api = options.api ?? target === "platform";
+  const audience = normalizeAudience(
+    options.audience,
+    target === "platform" ? portfolio : null
+  );
+  const tenancy = normalizeTenancy(options.tenancy, audience);
+  const surfaceModel = normalizeSurfaceModel(options.surfaceModel);
+  const containerAppId = normalizeContainerAppId(options.containerAppId, surfaceModel);
+  const ownerType = target === "platform" ? "topolo_first_party" : "third_party";
+  const distributionModel = target === "platform" ? "marketplace" : "organization_internal";
   const appDir = options.appDir ?? catalogApplication?.appDir ?? (target === "platform" ? `Topolo${toPascalCase(id)}` : `topolo-${slug}`);
   const name = options.name ?? catalogApplication?.name ?? `topolo-${slug}`;
   const packageName = options.packageName ?? catalogApplication?.packageName ?? `topolo-${slug}`;
@@ -3003,6 +2751,13 @@ function applicationScaffoldPayload(application, options = {}) {
   return {
     version: APPLICATION_REQUIREMENTS_VERSION,
     target,
+    ownerType,
+    portfolio,
+    audience,
+    tenancy,
+    surfaceModel,
+    containerAppId,
+    distributionModel,
     application: applicationPayload,
     scopes,
     requirements: APPLICATION_REQUIREMENTS.filter(
@@ -3010,13 +2765,28 @@ function applicationScaffoldPayload(application, options = {}) {
     ),
     packages: scaffoldPackages({ browser, api, target }),
     files: scaffoldFiles({
+      payload: {
+        ownerType,
+        portfolio,
+        audience,
+        tenancy,
+        surfaceModel,
+        containerAppId,
+        distributionModel
+      },
       application: applicationPayload,
       target,
       browser,
       api,
       ciWorkflow
     }),
-    commands: scaffoldCommands(id, target),
+    commands: scaffoldCommands({
+      id,
+      target,
+      audience,
+      tenancy,
+      portfolio
+    }),
     ciWorkflowPath,
     ciWorkflow
   };
@@ -3098,7 +2868,12 @@ function scaffoldFiles(options) {
         "documents the generated app target",
         "points maintainers to the shared Topolo packages used by the scaffold"
       ],
-      content: readme(application, target, { api: options.api })
+      content: readme(application, target, {
+        api: options.api,
+        audience: options.payload.audience,
+        tenancy: options.payload.tenancy,
+        portfolio: options.payload.portfolio
+      })
     },
     {
       path: `${base}/.gitignore`,
@@ -3194,7 +2969,12 @@ function scaffoldFiles(options) {
           "doc_paths includes internal handbook coverage",
           "security_assurance records the auth, tenancy, deployment, and verification boundary"
         ],
-        content: systemJson(application, { api: options.api })
+        content: systemJson(application, {
+          api: options.api,
+          audience: options.payload.audience,
+          tenancy: options.payload.tenancy,
+          portfolio: options.payload.portfolio
+        })
       },
       {
         path: `PlatformApplications/TopoloDocs/src/content/internal/apps/${slug}.mdx`,
@@ -3203,7 +2983,12 @@ function scaffoldFiles(options) {
           "documents ownership, routes, auth boundary, deployment, operations, and verification",
           "last_verified is updated when behavior changes"
         ],
-        content: internalDocs(application, { api: options.api })
+        content: internalDocs(application, {
+          api: options.api,
+          audience: options.payload.audience,
+          tenancy: options.payload.tenancy,
+          portfolio: options.payload.portfolio
+        })
       },
       {
         path: `PlatformApplications/TopoloDocs/src/content/public/applications/${slug}.mdx`,
@@ -3212,7 +2997,12 @@ function scaffoldFiles(options) {
           "documents the product surface without internal-only details",
           "links back to the canonical system registry entry"
         ],
-        content: publicDocs(application, { api: options.api })
+        content: publicDocs(application, {
+          api: options.api,
+          audience: options.payload.audience,
+          tenancy: options.payload.tenancy,
+          portfolio: options.payload.portfolio
+        })
       }
     );
     if (options.api && application.serviceId) {
@@ -3224,7 +3014,9 @@ function scaffoldFiles(options) {
           "permissions, role bundles, and API-key scopes exist before the app is catalog-visible",
           "systems metadata maps the service back to the generated TopoloDocs entries"
         ],
-        content: serviceManifestJson(application)
+        content: serviceManifestJson(application, {
+          tenancy: options.payload.tenancy
+        })
       });
     }
   } else {
@@ -3236,7 +3028,14 @@ function scaffoldFiles(options) {
           "declares the external app id, callback URLs, and requested platform scopes",
           "does not include internal Topolo CloudControl or canonical-docs ownership"
         ],
-        content: developerManifest(application, { api: options.api })
+        content: developerManifest(application, {
+          api: options.api,
+          audience: options.payload.audience,
+          tenancy: options.payload.tenancy,
+          surfaceModel: options.payload.surfaceModel,
+          containerAppId: options.payload.containerAppId,
+          distributionModel: options.payload.distributionModel
+        })
       },
       {
         path: `${base}/.env.example`,
@@ -3259,7 +3058,10 @@ function scaffoldFiles(options) {
         "keeps launcher and account-menu behavior on the shared platform surface",
         "passes app-specific account actions through accountMenuItems or TopoloAccountMenu"
       ],
-      content: appTsx(application, target)
+      content: appTsx(application, target, {
+        audience: options.payload.audience,
+        portfolio: options.payload.portfolio
+      })
     });
   }
   if (options.api) {
@@ -3281,28 +3083,33 @@ function scaffoldFiles(options) {
           "derives organization from the credential rather than client-supplied orgId",
           "emits or propagates X-Topolo-Request-Id and X-Topolo-Client"
         ],
-        content: workerTs(application, target)
+        content: workerTs(application, target, {
+          audience: options.payload.audience,
+          tenancy: options.payload.tenancy
+        })
       }
     );
   }
   return files;
 }
-function scaffoldCommands(id, target) {
-  const scaffoldId = toSlug(id);
-  if (target === "developer") {
+function scaffoldCommands(options) {
+  const scaffoldId = toSlug(options.id);
+  if (options.target === "developer") {
+    const audienceFlags = options.audience === "personal" ? " --audience personal --tenancy household" : "";
     return [
-      `topolo apps scaffold ${scaffoldId} --target developer --write --repo-root .`,
+      `topolo apps scaffold ${scaffoldId}${audienceFlags} --write --repo-root .`,
       `cd topolo-${scaffoldId}`,
       "npm install",
       "npm run typecheck",
       "npm run build"
     ];
   }
+  const portfolioFlags = options.portfolio === "personal" ? " --portfolio personal" : "";
   return [
-    `topolo apps scaffold ${scaffoldId} --write --repo-root /Users/ashes/Projects/topolo --json`,
+    `topolo platform apps scaffold ${scaffoldId}${portfolioFlags} --write --repo-root /Users/ashes/Projects/topolo --json`,
     "topolo apps requirements --json",
-    `topolo apps audit ${id} --local --repo-root /Users/ashes/Projects/topolo --fail-on needs_review --json`,
-    `topolo apps audit ${id} --local --repo-root /Users/ashes/Projects/topolo --fail-on partial --json`
+    `topolo apps audit ${options.id} --local --repo-root /Users/ashes/Projects/topolo --fail-on needs_review --json`,
+    `topolo apps audit ${options.id} --local --repo-root /Users/ashes/Projects/topolo --fail-on partial --json`
   ];
 }
 function topoloConformanceWorkflow(options) {
@@ -3430,12 +3237,16 @@ function topoloPackageVersion(packageName, target) {
 }
 function readme(application, target, options) {
   const displayName = toTitle(application.name);
-  const targetLabel = target === "platform" ? "first-party platform application" : "third-party Topolo application";
+  const targetLabel = target === "platform" ? options.portfolio === "personal" ? "first-party Topolo personal application" : "first-party Topolo platform application" : options.audience === "personal" ? "third-party Topolo personal application" : "third-party Topolo business application";
   const lines = [
     `# ${displayName}`,
     "",
     `Generated ${targetLabel} scaffold for Topolo.`,
     "",
+    `Audience: ${options.audience}`,
+    `Tenancy: ${options.tenancy}`,
+    ...target === "platform" && options.portfolio ? [`Portfolio: ${options.portfolio}`] : [],
+    "",
     "## Development",
     "",
     "```bash",
@@ -3464,6 +3275,7 @@ function readme(application, target, options) {
       "",
       "- `topolo.app.json` declares callback URLs, requested scopes, and runtime shape for Topolo Developers.",
       "- Browser sign-in uses the public Topolo OAuth authorization-code + PKCE flow.",
+      `- The generated app is seeded as a ${options.audience}/${options.tenancy} developer application.`,
       "- The starter intentionally avoids private first-party packages so it can install outside the Topolo monorepo."
     );
   }
@@ -3651,13 +3463,15 @@ function stylesCss() {
     ""
   ].join("\n");
 }
-function appTsx(application, target) {
+function appTsx(application, target, options) {
   if (target === "developer") return developerAppTsx(application);
-  return platformAppTsx(application);
+  return platformAppTsx(application, options);
 }
-function platformAppTsx(application) {
+function platformAppTsx(application, options) {
   const appName = toTitle(application.name);
   const serviceId = application.serviceId ?? application.id;
+  const tagline = options.audience === "personal" ? "Topolo personal app" : "Topolo workspace";
+  const workspaceTitle = options.audience === "personal" ? "Personal app" : "Workspace";
   return [
     "import { useEffect, useMemo, useState } from 'react';",
     "import { createBrowserAuthModule, type AuthUser } from '@topolo/auth-client';",
@@ -3673,7 +3487,7 @@ function platformAppTsx(application) {
     "const SERVICE_ID = import.meta.env.VITE_TOPOLO_SERVICE_ID ?? DEFAULT_SERVICE_ID;",
     "const LANDING_CONFIG = {",
     "  app_name: APP_NAME,",
-    "  app_tagline: 'Topolo workspace',",
+    `  app_tagline: '${escapeSingleQuoted(tagline)}',`,
     "  hero_title: `Open ${APP_NAME} in Topolo`,",
     "  hero_subtitle: 'Shared landing, login, callback, auth, and workspace shell wiring are already included in the generated baseline.',",
     "  hero_cta_text: 'Sign in',",
@@ -3683,7 +3497,7 @@ function platformAppTsx(application) {
     "};",
     "const LOGIN_CONFIG = {",
     "  app_name: APP_NAME,",
-    "  app_tagline: 'Topolo workspace',",
+    `  app_tagline: '${escapeSingleQuoted(tagline)}',`,
     "  hero_title: `Sign in to ${APP_NAME}`,",
     "  hero_subtitle: 'Use Topolo Auth to open the shared workspace shell for this application.',",
     "  authenticated_home_path: '/',",
@@ -3857,10 +3671,10 @@ function platformAppTsx(application) {
     "      appName={APP_NAME}",
     "      user={shellUser}",
     '      activeNavItemId="home"',
-    "      navItems={[{ id: 'home', label: 'Workspace' }]}",
+    `      navItems={[{ id: 'home', label: '${escapeSingleQuoted(workspaceTitle)}' }]}`,
     "      onNavItemSelect={() => undefined}",
     "      eyebrow={APP_NAME}",
-    '      title="Workspace"',
+    `      title="${escapeDoubleQuoted(workspaceTitle)}"`,
     "      authUrl={AUTH_URL}",
     "      getAccessToken={getAccessToken}",
     "      onSignOut={async () => {",
@@ -4076,7 +3890,7 @@ function wranglerToml(application, target) {
   );
   return lines.join("\n");
 }
-function workerTs(application, target) {
+function workerTs(application, target, _options) {
   if (target === "developer") return developerWorkerTs(application);
   return platformWorkerTs(application);
 }
@@ -4281,12 +4095,14 @@ function cloudcontrolJson(application, options) {
 }
 function systemJson(application, options) {
   const slug = toSlug(application.id);
+  const suiteLabel = options.audience === "personal" ? "personal" : "platform";
+  const summaryLabel = options.audience === "personal" ? "first-party Topolo personal application" : "first-party Topolo platform application";
   return `${json({
     id: `topolo-${slug}`,
     name: toTitle(application.name),
     slug: `topolo-${slug}`,
     kind: "application",
-    summary: `${toTitle(application.name)} is a first-party Topolo application scaffolded on shared Auth, UI Kit, CloudControl, and conformance contracts.`,
+    summary: `${toTitle(application.name)} is a ${summaryLabel} scaffolded on shared Auth, UI Kit, CloudControl, and conformance contracts.`,
     lifecycle: "planned",
     last_verified: CURRENT_VERIFICATION_DATE,
     owners: ["platform-engineering"],
@@ -4303,7 +4119,7 @@ function systemJson(application, options) {
     security_assurance: {
       risk_tier: "internal",
       auth_boundary: "Topolo Auth through @topolo/auth-client for browser sessions and @topolo/auth-middleware for Worker requests.",
-      tenant_isolation: "organization_scoped",
+      tenant_isolation: options.tenancy === "household" ? "household_scoped" : "organization_scoped",
       external_inputs: ["browser", ...options.api ? ["api"] : []],
       sensitive_data: ["identity", "org_data"],
       security_review_status: "not_started",
@@ -4311,13 +4127,16 @@ function systemJson(application, options) {
       pentest_status: "not_started",
       evidence_doc: `internal/apps/${slug}`
     },
-    dependencies: ["topolo-auth", "topolo-platform"]
+    dependencies: options.audience === "personal" ? ["topolo-auth"] : ["topolo-auth", "topolo-platform"],
+    tags: ["application", "cloudflare", "typescript", suiteLabel]
   })}
 `;
 }
 function internalDocs(application, options) {
   const slug = toSlug(application.id);
   const title = toTitle(application.name);
+  const suiteLabel = options.audience === "personal" ? "personal" : "platform";
+  const tenantLabel = options.tenancy === "household" ? "household" : "organization";
   return [
     "---",
     `title: "${escapeFrontmatter(title)} Handbook"`,
@@ -4342,7 +4161,7 @@ function internalDocs(application, options) {
     "",
     "## What It Is",
     "",
-    `${title} is a first-party Topolo application scaffolded from the shared platform application contract.`,
+    `${title} is a first-party Topolo ${suiteLabel} application scaffolded from the shared first-party application contract.`,
     "",
     "## Architecture",
     "",
@@ -4368,7 +4187,7 @@ function internalDocs(application, options) {
     "",
     "## Data Ownership",
     "",
-    "The generated scaffold stores no durable application data yet. Future domain tables, Durable Objects, queues, KV namespaces, R2 buckets, and external provider records must be scoped to the authenticated organization at the backend boundary.",
+    `The generated scaffold stores no durable application data yet. Future domain tables, Durable Objects, queues, KV namespaces, R2 buckets, and external provider records must be scoped to the authenticated ${tenantLabel} context at the backend boundary.`,
     "",
     "## Deployments",
     "",
@@ -4390,7 +4209,7 @@ function internalDocs(application, options) {
     "",
     "## Change Log / Verification",
     "",
-    `- Scaffold generated on ${CURRENT_VERIFICATION_DATE} from \`topolo apps scaffold\`.`,
+    `- Scaffold generated on ${CURRENT_VERIFICATION_DATE} from \`${options.portfolio ? "topolo platform apps scaffold" : "topolo apps scaffold"}\`.`,
     "- `npm run typecheck`",
     "- `npm run build`",
     "- `npm run validate` in TopoloDocs",
@@ -4400,6 +4219,8 @@ function internalDocs(application, options) {
 function publicDocs(application, options) {
   const slug = toSlug(application.id);
   const title = toTitle(application.name);
+  const suiteLabel = options.audience === "personal" ? "personal" : "business";
+  const tenantLabel = options.tenancy === "household" ? "household" : "organization";
   return [
     "---",
     `title: "${escapeFrontmatter(title)}"`,
@@ -4423,7 +4244,7 @@ function publicDocs(application, options) {
     "",
     "## What It Is",
     "",
-    `${title} is part of the Topolo business application suite.`,
+    `${title} is part of the Topolo ${suiteLabel} application suite.`,
     "",
     "## Architecture",
     "",
@@ -4443,7 +4264,7 @@ function publicDocs(application, options) {
     "",
     "## Data Ownership",
     "",
-    "The generated baseline has no durable domain data yet. Future data must be organization-scoped at the backend boundary.",
+    `The generated baseline has no durable domain data yet. Future data must be ${tenantLabel}-scoped at the backend boundary.`,
     "",
     "## Deployments",
     "",
@@ -4465,10 +4286,11 @@ function publicDocs(application, options) {
     ""
   ].join("\n");
 }
-function serviceManifestJson(application) {
+function serviceManifestJson(application, options) {
   const slug = toSlug(application.id);
   const title = toTitle(application.name);
   const permissionPrefix = application.id.replace(/[^a-z0-9_]/g, "_");
+  const resourceLabel = options.tenancy === "household" ? "household" : "workspace";
   return `${json({
     serviceId: application.serviceId,
     systems: [
@@ -4483,13 +4305,13 @@ function serviceManifestJson(application) {
       {
         id: `perm_${permissionPrefix}_workspace_read`,
         name: "workspace:read",
-        description: `View ${title} workspace data`,
+        description: `View ${title} ${resourceLabel} data`,
         resourcePattern: null
       },
       {
         id: `perm_${permissionPrefix}_workspace_write`,
         name: "workspace:write",
-        description: `Manage ${title} workspace data`,
+        description: `Manage ${title} ${resourceLabel} data`,
         resourcePattern: null
       }
     ],
@@ -4497,13 +4319,13 @@ function serviceManifestJson(application) {
       {
         id: `aks_${permissionPrefix}_workspace_read`,
         name: "workspace.read",
-        description: `View ${title} workspace data`,
+        description: `View ${title} ${resourceLabel} data`,
         resourcePattern: null
       },
       {
         id: `aks_${permissionPrefix}_workspace_write`,
         name: "workspace.write",
-        description: `Manage ${title} workspace data`,
+        description: `Manage ${title} ${resourceLabel} data`,
         resourcePattern: null
       }
     ],
@@ -4522,6 +4344,11 @@ function developerManifest(application, options) {
     id: application.id,
     name: toTitle(application.name),
     type: "third_party",
+    audience: options.audience,
+    tenancy: options.tenancy,
+    distribution_model: options.distributionModel,
+    surface_model: options.surfaceModel,
+    container_app_id: options.containerAppId,
     package_name: application.packageName,
     service_id: options.api ? application.serviceId : null,
     auth: {
@@ -4554,6 +4381,52 @@ function normalizeTarget(value) {
   if (value === "platform" || value === "developer") return value;
   throw new Error("Invalid scaffold target. Use platform or developer.");
 }
+function normalizePortfolio(value) {
+  if (!value) return "platform";
+  if (value === "platform" || value === "personal") return value;
+  throw new Error("Invalid scaffold portfolio. Use platform or personal.");
+}
+function normalizeAudience(value, portfolio) {
+  if (!value) {
+    return portfolio === "personal" ? "personal" : "business";
+  }
+  if (value === "business" || value === "personal") {
+    return value;
+  }
+  throw new Error("Invalid scaffold audience. Use business or personal.");
+}
+function normalizeTenancy(value, audience) {
+  const resolved = value ?? (audience === "personal" ? "household" : "organization");
+  if (resolved !== "organization" && resolved !== "household") {
+    throw new Error("Invalid scaffold tenancy. Use organization or household.");
+  }
+  if (audience === "business" && resolved !== "organization") {
+    throw new Error("Business scaffolds must use organization tenancy.");
+  }
+  if (audience === "personal" && resolved !== "household") {
+    throw new Error("Personal scaffolds must use household tenancy.");
+  }
+  return resolved;
+}
+function normalizeSurfaceModel(value) {
+  if (!value) return "web_app";
+  if (value === "web_app" || value === "mobile_container" || value === "mobile_module" || value === "messaging_surface") {
+    return value;
+  }
+  throw new Error(
+    "Invalid scaffold surface model. Use web_app, mobile_container, mobile_module, or messaging_surface."
+  );
+}
+function normalizeContainerAppId(value, surfaceModel) {
+  const trimmed = String(value || "").trim();
+  if (surfaceModel === "mobile_module") {
+    if (!trimmed) {
+      throw new Error("Mobile-module scaffolds require --container-app-id.");
+    }
+    return trimmed;
+  }
+  return trimmed || null;
+}
 function normalizeApplicationId(application) {
   const raw = application.trim().toLowerCase();
   const normalized = raw.replace(/-/g, "_");
@@ -4604,10 +4477,157 @@ function escapeHtml(value) {
 function escapeSingleQuoted(value) {
   return value.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
 }
+function escapeDoubleQuoted(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
 function escapeFrontmatter(value) {
   return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
 }
 
+// src/commands/app-scaffold-provision.ts
+var DEFAULT_DEVELOPERS_ORIGIN = "https://developers.topolo.app";
+var DEVELOPERS_SERVICE_ID = "svc_topolo_developers";
+async function provisionApplicationScaffold(payload) {
+  if (!payload.application.productionUrl) {
+    throw new Error(
+      "Scaffold provisioning requires a browser-capable application with a production URL."
+    );
+  }
+  if (payload.target === "platform" && !payload.application.serviceId) {
+    throw new Error(
+      "Platform scaffold provisioning requires a service id. Re-run without --no-api or pass --service."
+    );
+  }
+  const credential = await refreshCredentialIfNeeded();
+  if (!credential) {
+    throw new Error(
+      "topolo apps scaffold --provision requires an authenticated Topolo session. Run `topolo auth login` first."
+    );
+  }
+  const client = await buildClient();
+  if (!client) {
+    throw new Error(
+      "Could not build a Topolo client for scaffold provisioning. Run `topolo auth login` first."
+    );
+  }
+  const identity = await client.client.introspect();
+  const config = await readConfig();
+  const serviceUrls = resolveServiceUrls(config.serviceUrls) ?? {};
+  const developersOrigin = sanitizeOrigin(serviceUrls.developers ?? DEFAULT_DEVELOPERS_ORIGIN);
+  const endpoint = payload.target === "platform" ? "/api/developer-console/admin/first-party-app-scaffolds" : "/api/developer-console/apps/scaffold";
+  const headers = new Headers({
+    "Content-Type": "application/json",
+    "X-Service-ID": DEVELOPERS_SERVICE_ID,
+    "X-Topolo-Client": `topolo-cli/${CLI_VERSION}`
+  });
+  const agentName = resolveAgentName(config.agentName);
+  if (agentName) {
+    headers.set("X-Topolo-Agent", agentName);
+  }
+  if (credential.kind === "api_key") {
+    headers.set("X-Api-Key", credential.apiKey);
+  } else {
+    headers.set("Authorization", `Bearer ${credential.accessToken}`);
+  }
+  const response = await fetch(`${developersOrigin}${endpoint}`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(buildProvisioningRequest(payload))
+  });
+  const envelope = await response.json().catch(() => null);
+  if (!response.ok || !envelope?.success || !envelope.data) {
+    throw new Error(
+      resolveProvisioningError(envelope, response.status, payload.target)
+    );
+  }
+  const app = pickRecord(envelope.data.app);
+  const service = pickRecord(envelope.data.service);
+  const authConfig = pickRecord(envelope.data.authConfig);
+  if (!app) {
+    throw new Error("Developers provisioning did not return an app record.");
+  }
+  const appId = readRequiredString(app.id, "Developers provisioning did not return an app id.");
+  return {
+    target: payload.target,
+    actor: {
+      kind: identity.kind,
+      userId: identity.user.id,
+      email: identity.user.email,
+      role: identity.user.role,
+      organizationId: identity.organization?.id ?? null,
+      organizationSlug: identity.organization?.slug ?? null
+    },
+    developersOrigin,
+    developersApp: {
+      id: appId,
+      slug: readString(app.slug),
+      listingStatus: readString(app.listingStatus),
+      organizationId: readString(app.organizationId)
+    },
+    authService: service ? {
+      id: readRequiredString(
+        service.id,
+        "Auth registration did not return a service id."
+      ),
+      status: readString(service.status),
+      baseUrl: readString(service.base_url) ?? readString(service.baseUrl)
+    } : null,
+    authConfig: authConfig ? {
+      login: authConfig.login === true,
+      landing: authConfig.landing === true,
+      appUi: authConfig.appUi === true
+    } : null
+  };
+}
+function buildProvisioningRequest(payload) {
+  return {
+    target: payload.target,
+    ownerType: payload.ownerType,
+    portfolio: payload.portfolio,
+    audience: payload.audience,
+    tenancy: payload.tenancy,
+    surfaceModel: payload.surfaceModel,
+    containerAppId: payload.containerAppId,
+    distributionModel: payload.distributionModel,
+    applicationId: payload.application.id,
+    appDir: payload.application.appDir,
+    packageName: payload.application.packageName,
+    name: payload.application.name,
+    productionUrl: payload.application.productionUrl,
+    serviceId: payload.application.serviceId
+  };
+}
+function resolveProvisioningError(envelope, status, target) {
+  const message = (typeof envelope?.error === "string" ? envelope.error : envelope?.error?.message) || envelope?.message || `Scaffold provisioning failed with status ${status}.`;
+  if (status === 401 || status === 403) {
+    if (target === "platform") {
+      return `${message} Platform scaffold provisioning requires a Topolo platform-admin session with Developers commerce access.`;
+    }
+    return `${message} Developer scaffold provisioning requires a signed-in Topolo developer workspace session.`;
+  }
+  return message;
+}
+function sanitizeOrigin(value) {
+  return value.replace(/\/+$/, "");
+}
+function pickRecord(value) {
+  return value && typeof value === "object" ? value : null;
+}
+function readString(value) {
+  if (typeof value !== "string") {
+    return null;
+  }
+  const trimmed = value.trim();
+  return trimmed ? trimmed : null;
+}
+function readRequiredString(value, message) {
+  const resolved = readString(value);
+  if (!resolved) {
+    throw new Error(message);
+  }
+  return resolved;
+}
+
 // src/commands/apps.ts
 var APPLICATION_IDS = Object.keys(APPLICATIONS).sort();
 function registerAppsCommand(program2) {
@@ -4669,14 +4689,16 @@ function registerAppsCommand(program2) {
     }
   });
   apps.command("scaffold <application>").description(
-    "Generate the required Topolo new-application scaffold, including a conformance workflow."
-  ).option("--json", "Output JSON").option("--no-json", "Output human-readable checklist").option("--app-dir <path>", "Application directory under PlatformApplications").option("--name <name>", "Application display/package source name").option("--package-name <name>", "package.json name").option("--production-url <url>", "Production browser URL").option("--service <id>", "Stable SDK/Auth service id for API-backed apps").option("--target <target>", "Scaffold target: platform or developer").option("--developer", "Shortcut for --target developer").option("--write", "Write the generated scaffold files to disk").option("--repo-root <path>", "Directory where scaffold files should be written").option("--force", "Overwrite existing scaffold files when --write is set").option("--with-api", "Include API/service files for developer scaffolds").option("--no-api", "Do not include API/service requirements").option("--no-browser", "Do not include browser-shell requirements").option("--workflow-only", "Output only the generated GitHub Actions workflow in human mode").action(async (application, opts) => {
+    "Generate a third-party Topolo application scaffold for business or personal/household use."
+  ).option("--json", "Output JSON").option("--no-json", "Output human-readable checklist").option("--app-dir <path>", "Application directory under PlatformApplications").option("--name <name>", "Application display/package source name").option("--package-name <name>", "package.json name").option("--production-url <url>", "Production browser URL").option("--service <id>", "Stable SDK/Auth service id for API-backed apps").option("--audience <audience>", "Developer app audience: business or personal").option("--tenancy <tenancy>", "Developer app tenancy: organization or household").option(
+    "--surface-model <surfaceModel>",
+    "Developer app surface model: web_app, mobile_container, mobile_module, or messaging_surface"
+  ).option("--container-app-id <appId>", "Container app id when --surface-model mobile_module is used").option("--write", "Write the generated scaffold files to disk").option("--repo-root <path>", "Directory where scaffold files should be written").option("--force", "Overwrite existing scaffold files when --write is set").option("--with-api", "Include API/service files for developer scaffolds").option("--no-api", "Do not include API/service requirements").option("--no-browser", "Do not include browser-shell requirements").option(
+    "--provision",
+    "Provision the generated app into the current Topolo developer workspace using the authenticated session"
+  ).action(async (application, opts) => {
     const mode = opts.json === false || process.argv.includes("--no-json") ? "pretty" : resolveOutputMode(opts.json);
     try {
-      const target = resolveScaffoldTarget(opts.target, opts.developer);
-      if (opts.workflowOnly && opts.write) {
-        throw new Error("--workflow-only cannot be used with --write.");
-      }
       const api = resolveScaffoldApiOption(opts.api, opts.withApi);
       const payload = applicationScaffoldPayload(application, {
         appDir: opts.appDir,
@@ -4686,14 +4708,27 @@ function registerAppsCommand(program2) {
         service: opts.service,
         api,
         browser: opts.browser,
-        target
+        target: "developer",
+        audience: resolveScaffoldAudience(opts.audience),
+        tenancy: resolveScaffoldTenancy(opts.tenancy),
+        surfaceModel: resolveScaffoldSurfaceModel(opts.surfaceModel),
+        containerAppId: opts.containerAppId
       });
-      if (opts.workflowOnly && !payload.ciWorkflow) {
-        throw new Error("--workflow-only is only available for platform scaffolds.");
+      if (opts.provision && !opts.write) {
+        throw new Error("--provision requires --write so remote developer records match written scaffold files.");
       }
       const writeResult = opts.write ? await writeApplicationScaffold(payload, { repoRoot: opts.repoRoot, force: opts.force }) : null;
-      const output = opts.workflowOnly ? { application: payload.application, ciWorkflowPath: payload.ciWorkflowPath, ciWorkflow: payload.ciWorkflow } : writeResult ? { ...payload, write: writeResult } : payload;
-      emit(output, mode, () => opts.workflowOnly ? payload.ciWorkflow ?? "" : formatScaffold(payload, writeResult));
+      const provisionResult = opts.provision ? await provisionApplicationScaffold(payload) : null;
+      const output = {
+        ...payload,
+        ...writeResult ? { write: writeResult } : {},
+        ...provisionResult ? { provision: provisionResult } : {}
+      };
+      emit(
+        output,
+        mode,
+        () => formatScaffold(payload, writeResult, provisionResult)
+      );
     } catch (err) {
       fail(err, mode);
     }
@@ -4854,10 +4889,17 @@ function formatAudit(payload) {
   }
   return lines.join("\n");
 }
-function formatScaffold(payload, writeResult = null) {
+function formatScaffold(payload, writeResult = null, provisionResult = null) {
   const lines = [
     `Version: ${payload.version}`,
     `Target: ${payload.target}`,
+    `Owner: ${payload.ownerType}`,
+    `Audience: ${payload.audience}`,
+    `Tenancy: ${payload.tenancy}`,
+    `Portfolio: ${payload.portfolio ?? "-"}`,
+    `Surface: ${payload.surfaceModel}`,
+    `Container: ${payload.containerAppId ?? "-"}`,
+    `Distribution: ${payload.distributionModel}`,
     `Application: ${payload.application.id}`,
     `Directory: ${payload.application.appDir}`,
     `Package: ${payload.application.packageName}`,
@@ -4886,13 +4928,54 @@ function formatScaffold(payload, writeResult = null) {
       lines.push(`  - ${file.status}: ${file.path}`);
     }
   }
+  if (provisionResult) {
+    lines.push("Provisioning:");
+    lines.push(`  - target: ${provisionResult.target}`);
+    lines.push(
+      `  - actor: ${provisionResult.actor.email} (${provisionResult.actor.role}, org=${provisionResult.actor.organizationSlug ?? provisionResult.actor.organizationId ?? "-"})`
+    );
+    lines.push(`  - developers origin: ${provisionResult.developersOrigin}`);
+    lines.push(
+      `  - developers app: ${provisionResult.developersApp.id} (listing=${provisionResult.developersApp.listingStatus ?? "-"}, org=${provisionResult.developersApp.organizationId ?? "-"})`
+    );
+    if (provisionResult.authService) {
+      lines.push(
+        `  - auth service: ${provisionResult.authService.id} (status=${provisionResult.authService.status ?? "-"}, url=${provisionResult.authService.baseUrl ?? "-"})`
+      );
+    }
+    if (provisionResult.authConfig) {
+      lines.push(
+        `  - auth config: login=${provisionResult.authConfig.login} landing=${provisionResult.authConfig.landing} app_ui=${provisionResult.authConfig.appUi}`
+      );
+    }
+  }
   return lines.join("\n");
 }
-function resolveScaffoldTarget(target, developer) {
-  const normalized = developer ? "developer" : target?.trim().toLowerCase();
-  if (!normalized) return "platform";
-  if (normalized === "platform" || normalized === "developer") return normalized;
-  throw new Error("Invalid --target value. Use platform or developer.");
+function resolveScaffoldAudience(value) {
+  if (!value) return void 0;
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "business" || normalized === "personal") {
+    return normalized;
+  }
+  throw new Error("Invalid --audience value. Use business or personal.");
+}
+function resolveScaffoldTenancy(value) {
+  if (!value) return void 0;
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "organization" || normalized === "household") {
+    return normalized;
+  }
+  throw new Error("Invalid --tenancy value. Use organization or household.");
+}
+function resolveScaffoldSurfaceModel(value) {
+  if (!value) return void 0;
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "web_app" || normalized === "mobile_container" || normalized === "mobile_module" || normalized === "messaging_surface") {
+    return normalized;
+  }
+  throw new Error(
+    "Invalid --surface-model value. Use web_app, mobile_container, mobile_module, or messaging_surface."
+  );
 }
 function resolveScaffoldApiOption(api, withApi) {
   const noApi = process.argv.includes("--no-api");
@@ -4916,6 +4999,100 @@ function statusesAtOrWorse(threshold) {
   return ["missing", "needs_review", "partial"];
 }
 
+// src/commands/platform.ts
+function registerPlatformCommand(program2) {
+  const platform3 = program2.command("platform").description("Internal Topolo first-party platform and personal app commands");
+  const platformApps = platform3.command("apps").description("Scaffold and operate first-party Topolo platform and personal applications");
+  platformApps.command("scaffold <application>").description(
+    "Generate a first-party Topolo scaffold for the platform or personal portfolio."
+  ).option("--json", "Output JSON").option("--no-json", "Output human-readable checklist").option("--app-dir <path>", "Application directory under PlatformApplications").option("--name <name>", "Application display/package source name").option("--package-name <name>", "package.json name").option("--production-url <url>", "Production browser URL").option("--service <id>", "Stable SDK/Auth service id for API-backed apps").option("--portfolio <portfolio>", "First-party portfolio: platform or personal").option(
+    "--surface-model <surfaceModel>",
+    "First-party surface model: web_app, mobile_container, mobile_module, or messaging_surface"
+  ).option("--container-app-id <appId>", "Container app id when --surface-model mobile_module is used").option("--write", "Write the generated scaffold files to disk").option("--repo-root <path>", "Directory where scaffold files should be written").option("--force", "Overwrite existing scaffold files when --write is set").option("--with-api", "Include the API/service baseline").option("--no-api", "Do not include API/service requirements").option("--no-browser", "Do not include browser-shell requirements").option(
+    "--provision",
+    "Provision the generated first-party app into Topolo Developers and Auth using the authenticated Topolo admin session"
+  ).option("--workflow-only", "Output only the generated GitHub Actions workflow in human mode").action(async (application, opts) => {
+    const mode = opts.json === false || process.argv.includes("--no-json") ? "pretty" : resolveOutputMode(opts.json);
+    try {
+      await requirePlatformAdminSession();
+      if (opts.workflowOnly && opts.write) {
+        throw new Error("--workflow-only cannot be used with --write.");
+      }
+      const api = resolveScaffoldApiOption(opts.api, opts.withApi);
+      const payload = applicationScaffoldPayload(application, {
+        appDir: opts.appDir,
+        name: opts.name,
+        packageName: opts.packageName,
+        productionUrl: opts.productionUrl,
+        service: opts.service,
+        api,
+        browser: opts.browser,
+        target: "platform",
+        portfolio: resolvePlatformPortfolio(opts.portfolio),
+        surfaceModel: resolvePlatformSurfaceModel(opts.surfaceModel),
+        containerAppId: opts.containerAppId
+      });
+      if (opts.workflowOnly && !payload.ciWorkflow) {
+        throw new Error("--workflow-only is only available for first-party scaffolds.");
+      }
+      if (opts.provision && !opts.write) {
+        throw new Error("--provision requires --write so remote first-party records match written scaffold files.");
+      }
+      const writeResult = opts.write ? await writeApplicationScaffold(payload, { repoRoot: opts.repoRoot, force: opts.force }) : null;
+      const provisionResult = opts.provision ? await provisionApplicationScaffold(payload) : null;
+      const output = opts.workflowOnly ? { application: payload.application, ciWorkflowPath: payload.ciWorkflowPath, ciWorkflow: payload.ciWorkflow } : {
+        ...payload,
+        ...writeResult ? { write: writeResult } : {},
+        ...provisionResult ? { provision: provisionResult } : {}
+      };
+      emit(
+        output,
+        mode,
+        () => opts.workflowOnly ? payload.ciWorkflow ?? "" : formatScaffold(payload, writeResult, provisionResult)
+      );
+    } catch (err) {
+      fail(err, mode);
+    }
+  });
+}
+function resolvePlatformPortfolio(value) {
+  if (!value) return void 0;
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "platform" || normalized === "personal") {
+    return normalized;
+  }
+  throw new Error("Invalid --portfolio value. Use platform or personal.");
+}
+function resolvePlatformSurfaceModel(value) {
+  if (!value) return void 0;
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "web_app" || normalized === "mobile_container" || normalized === "mobile_module" || normalized === "messaging_surface") {
+    return normalized;
+  }
+  throw new Error(
+    "Invalid --surface-model value. Use web_app, mobile_container, mobile_module, or messaging_surface."
+  );
+}
+function isPlatformAdminIdentity(identity) {
+  const role = String(identity?.user?.role || "").trim().toLowerCase();
+  const orgSlug = String(identity?.organization?.slug || "").trim().toLowerCase();
+  return orgSlug === "admin" && (role === "platform_super_admin" || role === "platform_admin");
+}
+async function requirePlatformAdminSession() {
+  const client = await buildClient();
+  if (!client) {
+    throw new Error(
+      "`topolo platform ...` requires an authenticated Topolo platform-admin session. Run `topolo auth login` first."
+    );
+  }
+  const identity = await client.client.introspect();
+  if (!isPlatformAdminIdentity(identity)) {
+    throw new Error(
+      "`topolo platform ...` is restricted to Topolo platform admins in the Auth `admin` organization."
+    );
+  }
+}
+
 // src/commands/services.ts
 function registerServicesCommand(program2) {
   program2.command("services").description("List every Topolo service the SDK can route to").option("--json", "Output JSON", true).option("--no-json", "Output human-readable table").action((opts) => {
@@ -4954,13 +5131,14 @@ function formatRows2(rows) {
 // src/index.ts
 var program = new Command();
 program.name("topolo").description(
-  "Topolo platform CLI. Every command is scoped to the authenticated organization \u2014 there is no way to target a different org."
+  "Topolo CLI. Public commands are scoped to the authenticated organization or developer workspace, and first-party Topolo scaffolding lives under the internal `topolo platform` namespace."
 ).version(CLI_VERSION);
 registerAuthCommands(program);
 registerWhoamiCommand(program);
 registerCrmCommands(program);
 registerApiCommand(program);
 registerAppsCommand(program);
+registerPlatformCommand(program);
 registerServicesCommand(program);
 program.parseAsync(process.argv).catch((err) => {
   process.stderr.write(`Unexpected error: ${err instanceof Error ? err.message : String(err)}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@topolo/cli",
-  "version": "0.1.11",
-  "description": "Command-line interface for the Topolo platform. Designed for humans and for agents (Claude, Codex, etc.) that prefer shell invocation.",
+  "version": "0.1.13",
+  "description": "Command-line interface for Topolo developers, operators, and agents, with internal first-party scaffolding available under the topolo platform namespace.",
   "type": "module",
   "bin": {
     "topolo": "./dist/index.js"