@topolo/cli 0.1.21 → 0.1.22

package/dist/index.js

@@ -95,56 +95,34 @@ var SERVICES = {
   nexus: "https://nexus-api.topolo.app",
   notify: "https://notify.topolo.app",
   one: "https://one.topolo.app",
-  "one.ai": "https://ai.one.topolo.app",
   p2p: "https://p2p.topolo.app",
   pay: "https://pay.topolo.app",
   people: "https://people.topolo.app",
+  pulse: "https://pulse.topolo.app",
   "quro.api": "https://api.ol0.me",
   "quro.redirect": "https://ol0.me",
   roadmapper: "https://roadmapper-api.topolo.app",
   sign: "https://sign.topolo.app",
   social_studio: "https://studio-api.topolo.app",
   socialize: "https://socialize-api.topolo.app",
+  spaces: "https://spaces.topolo.app",
   status: "https://status.topolo.app",
   support: "https://support.topolo.app",
   survey: "https://survey.topolo.app",
   voice: "https://voice.topolo.app",
   web: "https://web-api.topolo.app"
 };
-var PLATFORM_SERVICE_IDS = {
-  books: "srv_topolo_books",
-  bugfix: "srv_topolo_bugfix",
-  compose: "srv_topolo_compose",
-  consent: "srv_topolo_consent",
-  crm: "srv_iCwM4jGXcwlj",
-  customer_success: "srv_topolo_success",
-  developers: "svc_topolo_developers",
-  director: "srv_topolo_director",
-  flow: "srv_topolo_flow",
-  forms: "srv_topolo_forms",
-  home: "srv_topolo_home",
-  insights: "srv_topolo_insights",
-  inventory: "srv_topolo_inventory",
-  localize: "srv_topolo_localize",
-  notify: "svc_topolo_notify",
-  p2p: "srv_topolo_p2p",
-  people: "srv_topolo_people",
-  sign: "srv_topolo_sign",
-  status: "srv_topolo_status",
-  survey: "srv_topolo_survey",
-  voice: "srv_topolo_voice"
-};
 var APPLICATIONS = {
   "admin": {
     "id": "admin",
     "appDir": "TopoloAdmin",
-    "name": "topoloadmin",
+    "name": "topolo-admin",
     "packageName": "topolo-admin",
     "productionUrl": "https://admin.topolo.app",
     "services": [],
     "deployTargets": [
       {
-        "name": "topoloadmin",
+        "name": "topolo-admin",
         "kind": "pages",
         "apiUrl": null,
         "domains": [
@@ -167,7 +145,7 @@ var APPLICATIONS = {
     "deployTargets": [
       {
         "name": "topolo-agent",
-        "kind": "pages",
+        "kind": "worker",
         "apiUrl": null,
         "domains": [
           "agent.topolo.app"
@@ -211,6 +189,24 @@ var APPLICATIONS = {
       }
     ]
   },
+  "backup": {
+    "id": "backup",
+    "appDir": "TopoloBackup",
+    "name": "topolo-backup",
+    "packageName": "topolo-backup",
+    "productionUrl": null,
+    "services": [],
+    "deployTargets": [
+      {
+        "name": "topolo-backup",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
+      }
+    ]
+  },
   "books": {
     "id": "books",
     "appDir": "TopoloBooks",
@@ -361,15 +357,6 @@ var APPLICATIONS = {
       }
     ]
   },
-  "cli": {
-    "id": "cli",
-    "appDir": "TopoloCli",
-    "name": "@topolo/cli",
-    "packageName": "@topolo/cli",
-    "productionUrl": null,
-    "services": [],
-    "deployTargets": []
-  },
   "cloudcontrol": {
     "id": "cloudcontrol",
     "appDir": "TopoloCloudControl",
@@ -501,7 +488,7 @@ var APPLICATIONS = {
       },
       {
         "name": "topolo-crm-app",
-        "kind": "pages",
+        "kind": "worker",
         "apiUrl": null,
         "domains": [
           "crm.topolo.app"
@@ -535,24 +522,6 @@ var APPLICATIONS = {
       }
     ]
   },
-  "d1_backup": {
-    "id": "d1_backup",
-    "appDir": "TopoloD1Backup",
-    "name": "topolo-d1-backup",
-    "packageName": "topolo-d1-backup",
-    "productionUrl": null,
-    "services": [],
-    "deployTargets": [
-      {
-        "name": "topolo-d1-backup",
-        "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
-        "routes": [],
-        "serviceId": null
-      }
-    ]
-  },
   "developers": {
     "id": "developers",
     "appDir": "TopoloDevelopers",
@@ -699,7 +668,7 @@ var APPLICATIONS = {
     "deployTargets": [
       {
         "name": "topolo-forecast",
-        "kind": "pages",
+        "kind": "worker",
         "apiUrl": null,
         "domains": [
           "forecast.topolo.app"
@@ -827,7 +796,7 @@ var APPLICATIONS = {
     "deployTargets": [
       {
         "name": "topolo-learn",
-        "kind": "pages",
+        "kind": "worker",
         "apiUrl": null,
         "domains": [
           "learn.topolo.app"
@@ -883,7 +852,7 @@ var APPLICATIONS = {
     "deployTargets": [
       {
         "name": "topolo-mail",
-        "kind": "workers",
+        "kind": "worker",
         "apiUrl": "https://mail.topolo.app",
         "domains": [
           "mail.topolo.app"
@@ -895,15 +864,6 @@ var APPLICATIONS = {
       }
     ]
   },
-  "mcp": {
-    "id": "mcp",
-    "appDir": "TopoloMCP",
-    "name": "@topolo/mcp",
-    "packageName": "@topolo/mcp",
-    "productionUrl": null,
-    "services": [],
-    "deployTargets": []
-  },
   "mdm": {
     "id": "mdm",
     "appDir": "TopoloMDM",
@@ -928,7 +888,7 @@ var APPLICATIONS = {
       },
       {
         "name": "topolo-mdm-console",
-        "kind": "pages",
+        "kind": "worker",
         "apiUrl": null,
         "domains": [
           "mdm.topolo.app"
@@ -952,7 +912,7 @@ var APPLICATIONS = {
     "deployTargets": [
       {
         "name": "topolo-messaging",
-        "kind": "workers",
+        "kind": "worker",
         "apiUrl": "https://messages.topolo.app",
         "domains": [
           "messages.topolo.app"
@@ -962,7 +922,7 @@ var APPLICATIONS = {
       },
       {
         "name": "topolo-messaging-dispatch",
-        "kind": "workers",
+        "kind": "worker",
         "apiUrl": null,
         "domains": [],
         "routes": [],
@@ -982,7 +942,7 @@ var APPLICATIONS = {
     "deployTargets": [
       {
         "name": "topolo-nexus-dashboard",
-        "kind": "pages",
+        "kind": "worker",
         "apiUrl": null,
         "domains": [
           "nexus.topolo.app"
@@ -1038,24 +998,13 @@ var APPLICATIONS = {
   "one": {
     "id": "one",
     "appDir": "TopoloOne",
-    "name": "topolo-oneclick-sso",
+    "name": "TopoloOne",
     "packageName": "topolo-oneclick-sso",
     "productionUrl": "https://one.topolo.app",
     "services": [
-      "one",
-      "one.ai"
+      "one"
     ],
     "deployTargets": [
-      {
-        "name": "ai-chat-rag",
-        "kind": "worker",
-        "apiUrl": "https://ai.one.topolo.app",
-        "domains": [
-          "ai.one.topolo.app"
-        ],
-        "routes": [],
-        "serviceId": "one.ai"
-      },
       {
         "name": "topolo-one",
         "kind": "pages",
@@ -1170,9 +1119,24 @@ var APPLICATIONS = {
     "appDir": "TopoloPulse",
     "name": "topolo-pulse",
     "packageName": "topolo-pulse",
-    "productionUrl": null,
-    "services": [],
-    "deployTargets": []
+    "productionUrl": "https://pulse.topolo.app",
+    "services": [
+      "pulse"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-pulse",
+        "kind": "worker",
+        "apiUrl": "https://pulse.topolo.app",
+        "domains": [
+          "pulse.topolo.app"
+        ],
+        "routes": [
+          "pulse.topolo.app"
+        ],
+        "serviceId": "pulse"
+      }
+    ]
   },
   "quro": {
     "id": "quro",
@@ -1209,7 +1173,7 @@ var APPLICATIONS = {
       },
       {
         "name": "quro-ui",
-        "kind": "pages",
+        "kind": "worker",
         "apiUrl": null,
         "domains": [
           "quro.topolo.app"
@@ -1231,7 +1195,7 @@ var APPLICATIONS = {
     "deployTargets": [
       {
         "name": "topolo-roadmapper",
-        "kind": "pages",
+        "kind": "worker",
         "apiUrl": null,
         "domains": [
           "roadmapper.topolo.app"
@@ -1287,7 +1251,7 @@ var APPLICATIONS = {
     "deployTargets": [
       {
         "name": "topolo-social-studio",
-        "kind": "pages",
+        "kind": "worker",
         "apiUrl": null,
         "domains": [
           "studio.topolo.app"
@@ -1355,6 +1319,30 @@ var APPLICATIONS = {
       }
     ]
   },
+  "spaces": {
+    "id": "spaces",
+    "appDir": "TopoloSpaces",
+    "name": "topolo-spaces",
+    "packageName": "@topolo/spaces",
+    "productionUrl": "https://spaces.topolo.app",
+    "services": [
+      "spaces"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-spaces",
+        "kind": "worker",
+        "apiUrl": "https://spaces.topolo.app",
+        "domains": [
+          "spaces.topolo.app"
+        ],
+        "routes": [
+          "spaces.topolo.app"
+        ],
+        "serviceId": "spaces"
+      }
+    ]
+  },
   "status": {
     "id": "status",
     "appDir": "TopoloStatus",
@@ -1391,7 +1379,7 @@ var APPLICATIONS = {
     "deployTargets": [
       {
         "name": "topolo-support",
-        "kind": "workers",
+        "kind": "worker",
         "apiUrl": "https://support.topolo.app",
         "domains": [
           "support.topolo.app"
@@ -1483,7 +1471,7 @@ var APPLICATIONS = {
       },
       {
         "name": "topolo-web-studio",
-        "kind": "pages",
+        "kind": "worker",
         "apiUrl": null,
         "domains": [
           "web.topolo.app"
@@ -1534,12 +1522,12 @@ var APPLICATION_REQUIREMENTS = [
     summary: "Applications must derive identity, organization, scopes, and service entitlement from TopoloAuth rather than inventing parallel auth state.",
     appliesTo: ["browser", "api", "tooling", "agent_surface"],
     evidence: [
-      "@topolo/auth-client or @topolo/auth-middleware is used where applicable",
+      "@topolo/auth-client or @topolo-io/worker-runtime is used where applicable",
       "No public command, tool, or SDK method accepts orgId",
       "Service slug and Auth service registration are documented for protected services"
     ],
     implementation: [
-      "Use shared auth packages instead of copying token parsing or browser storage flows",
+      "Use shared auth/runtime packages instead of copying token parsing, gateway, or browser storage flows",
       "Derive organization from the credential on every request",
       "Route OAuth, refresh, logout, and SSO paths according to the shared Auth contract"
     ]
@@ -1679,14 +1667,15 @@ var APPLICATION_REQUIREMENTS = [
 ];
 function applicationRequirementScopes(application) {
   const scopes = /* @__PURE__ */ new Set(["all"]);
+  const appId = application.id;
   const hasBrowserSurface = Boolean(application.productionUrl) || application.deployTargets.some((target) => target.kind === "pages");
   const hasApiSurface = application.services.length > 0 || application.deployTargets.some((target) => Boolean(target.apiUrl));
   if (hasBrowserSurface) scopes.add("browser");
   if (hasApiSurface) scopes.add("api");
-  if (application.id === "cli" || application.id === "mcp" || application.id === "cloudcontrol") {
+  if (appId === "cli" || appId === "mcp" || appId === "cloudcontrol") {
     scopes.add("tooling");
   }
-  if (application.id === "cli" || application.id === "mcp" || hasApiSurface) {
+  if (appId === "cli" || appId === "mcp" || hasApiSurface) {
     scopes.add("agent_surface");
   }
   return Array.from(scopes);
@@ -1805,12 +1794,13 @@ function evaluateRequirement(application, requirement) {
       return finding(requirement, "met", "CloudControl deploy target metadata is present.", evidence);
     }
     case "agent-and-operator-surfaces": {
+      const appId = application.id;
       if (application.services.length > 0) {
         evidence.push(`services=${application.services.join(",")}`);
         return finding(requirement, "partial", "SDK service discovery exists; typed SDK/CLI/MCP workflow coverage should be checked as APIs stabilize.", evidence);
       }
-      if (application.id === "cli" || application.id === "mcp" || application.id === "cloudcontrol") {
-        evidence.push(`tooling=${application.id}`);
+      if (appId === "cli" || appId === "mcp" || appId === "cloudcontrol") {
+        evidence.push(`tooling=${appId}`);
         return finding(requirement, "met", "This application is itself an agent/operator surface.", evidence);
       }
       return finding(requirement, "missing", "No SDK service or tooling surface is registered.", evidence);
@@ -1881,20 +1871,38 @@ function resolveServiceUrl(service, overrides) {
   return DEFAULT_SERVICE_URLS[service];
 }
 var WRITE_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
-var TopoloClient = class {
+var POSITIVE_CACHE_TTL_MS = 5 * 60 * 1e3;
+var NEGATIVE_CACHE_TTL_MS = 60 * 1e3;
+var TopoloClient = class _TopoloClient {
   credential;
   agent;
   serviceUrls;
+  serviceIds;
   requireConfirmForWrites;
   timeoutMs;
   fetchImpl;
   debug;
+  /**
+   * Process-wide cache for slug → service-id lookups. Keyed by
+   * `${authBaseUrl}|${slug}` so multiple `TopoloClient` instances pointing at
+   * the same Auth share, but staging vs prod don't poison each other.
+   * Cleared via `TopoloClient.clearServiceIdCache()` if a test needs it.
+   */
+  static serviceIdCache = /* @__PURE__ */ new Map();
+  /**
+   * Drop the slug→service-id cache. Test-only — production callers should
+   * let the 5-minute TTL expire naturally.
+   */
+  static clearServiceIdCache() {
+    _TopoloClient.serviceIdCache.clear();
+  }
   constructor(options) {
     if (!options.credential) throw new TopoloAuthError("credential is required");
     if (!options.agent?.clientName) throw new TopoloAuthError("agent.clientName is required");
     this.credential = options.credential;
     this.agent = options.agent;
     this.serviceUrls = options.serviceUrls;
+    this.serviceIds = options.serviceIds;
     this.requireConfirmForWrites = options.requireConfirmForWrites !== false;
     this.timeoutMs = options.timeoutMs ?? 3e4;
     this.fetchImpl = options.fetch ?? fetch;
@@ -1929,7 +1937,7 @@ var TopoloClient = class {
     const headers = new Headers();
     headers.set("Accept", "application/json");
     if (opts.body !== void 0) headers.set("Content-Type", "application/json");
-    const platformServiceId = PLATFORM_SERVICE_IDS[opts.service];
+    const platformServiceId = resolveConfiguredServiceId(opts.service, this.serviceIds);
     if (platformServiceId) headers.set("X-Service-ID", platformServiceId);
     applyAuthHeaders(headers, this.credential);
     const requestId = generateRequestId();
@@ -2003,6 +2011,115 @@ var TopoloClient = class {
     });
     return parsed;
   }
+  /**
+   * Resolve a service-slug → opaque service-id via caller config or TopoloAuth.
+   *
+   * Cache: 5 minutes per process per `(slug, auth_base_url)`. Negative
+   * results (404) are cached for 60s so a typo doesn't hot-loop the
+   * resolver. Returns null when the slug isn't registered — callers decide
+   * whether to throw.
+   *
+   * No credential is sent: the endpoint is public (slugs aren't secret).
+   * This keeps the resolver usable during early bootstrap before a caller
+   * has acquired an access token.
+   */
+  async getServiceIdBySlug(slug) {
+    if (typeof slug !== "string") return null;
+    const normalized = slug.trim().toLowerCase();
+    if (!normalized) return null;
+    const configuredServiceId = resolveConfiguredServiceId(normalized, this.serviceIds);
+    if (configuredServiceId) return configuredServiceId;
+    const authBase = resolveServiceUrl("auth", this.serviceUrls);
+    const cacheKey = `${authBase}|${normalized}`;
+    const now = Date.now();
+    const cached = _TopoloClient.serviceIdCache.get(cacheKey);
+    if (cached && cached.expiresAt > now) {
+      return cached.value;
+    }
+    const url = new URL(
+      `/api/services/by-slug/${encodeURIComponent(normalized)}`,
+      authBase.endsWith("/") ? authBase : `${authBase}/`
+    ).toString();
+    let res;
+    try {
+      res = await this.fetchImpl(url, {
+        method: "GET",
+        headers: { Accept: "application/json" }
+      });
+    } catch {
+      return null;
+    }
+    if (res.status === 404) {
+      _TopoloClient.serviceIdCache.set(cacheKey, {
+        value: null,
+        expiresAt: now + NEGATIVE_CACHE_TTL_MS
+      });
+      return null;
+    }
+    if (!res.ok) {
+      return null;
+    }
+    const body = await res.json().catch(() => null);
+    const serviceId = body?.data?.service_id;
+    const value = typeof serviceId === "string" && serviceId ? serviceId : null;
+    _TopoloClient.serviceIdCache.set(cacheKey, {
+      value,
+      expiresAt: now + POSITIVE_CACHE_TTL_MS
+    });
+    return value;
+  }
+  /**
+   * List the platform service catalog from the live registry
+   * (`GET /api/services/catalog` on TopoloAuth). Credential-aware: the
+   * caller's credential is attached, so an authenticated caller in an
+   * entitled org also receives the `developer_only` services its role
+   * permits; an unauthenticated/agent caller receives `active` only.
+   *
+   * Resilient: on any network/HTTP failure this falls back to the
+   * build-time generated `APPLICATIONS` snapshot so offline/degraded
+   * callers still get a usable (if static) catalog. The live result is
+   * authoritative; the snapshot is a floor, not a cap.
+   */
+  async listServices() {
+    try {
+      const res = await this.request({ service: "auth", method: "GET", path: "/api/services/catalog" });
+      const raw = res.data?.services ?? res.services;
+      if (Array.isArray(raw) && raw.length > 0) {
+        const entries = [];
+        for (const item of raw) {
+          const s = item;
+          const serviceId = typeof s.service_id === "string" ? s.service_id : typeof s.id === "string" ? s.id : null;
+          if (!serviceId) continue;
+          entries.push({
+            serviceId,
+            slug: typeof s.app_slug === "string" ? s.app_slug : null,
+            name: typeof s.name === "string" ? s.name : null,
+            description: typeof s.description === "string" ? s.description : null,
+            baseUrl: typeof s.base_url === "string" ? s.base_url : null,
+            status: typeof s.status === "string" ? s.status : null,
+            surfaceKind: typeof s.surface_kind === "string" ? s.surface_kind : null,
+            launchable: s.launchable === true
+          });
+        }
+        if (entries.length > 0) return entries;
+      }
+    } catch {
+    }
+    return this.generatedCatalogFallback();
+  }
+  generatedCatalogFallback() {
+    const apps = Object.values(APPLICATIONS);
+    return apps.map((app) => ({
+      serviceId: app.id,
+      slug: app.id,
+      name: app.name ?? app.id,
+      description: null,
+      baseUrl: app.productionUrl ?? null,
+      status: "active",
+      surfaceKind: "application",
+      launchable: Boolean(app.productionUrl)
+    }));
+  }
   /**
    * Introspect the current credential. Returns the caller's resolved identity,
    * organization, and permission set. Used by CLI `whoami` and by MCP to gate
@@ -2039,6 +2156,26 @@ var TopoloClient = class {
     };
   }
 };
+function resolveConfiguredServiceId(slug, serviceIds) {
+  for (const serviceKey of serviceKeyCandidates(slug)) {
+    const configured = serviceIds?.[serviceKey];
+    if (typeof configured === "string" && configured.trim()) return configured.trim();
+    const envKey = `TOPOLO_SERVICE_ID_${serviceKey.replace(/\./g, "_").toUpperCase()}`;
+    const envValue = typeof process !== "undefined" ? process.env?.[envKey] : void 0;
+    if (typeof envValue === "string" && envValue.trim()) return envValue.trim();
+  }
+  return null;
+}
+function serviceKeyCandidates(slug) {
+  const normalized = slug.trim().toLowerCase();
+  const withoutTopolo = normalized.startsWith("topolo-") ? normalized.slice("topolo-".length) : normalized;
+  return [.../* @__PURE__ */ new Set([
+    normalized,
+    normalized.replace(/-/g, "_"),
+    withoutTopolo,
+    withoutTopolo.replace(/-/g, "_")
+  ])];
+}
 function describeError(body, fallback) {
   if (body && typeof body === "object") {
     const maybe = body;
@@ -3150,13 +3287,14 @@ function enrichFinding(application, finding2, evidence) {
       });
     }
     case "service-registration-and-scopes": {
+      const applicationId = String(application.id);
       const declaredServices = application.services ?? [];
       if (declaredServices.length === 0) {
-        if (application.id === "cli" || application.id === "mcp" || application.id === "cloudcontrol") {
+        if (applicationId === "cli" || applicationId === "mcp" || applicationId === "cloudcontrol") {
           return mergeFinding(finding2, {
             status: "met",
             reason: "This application is itself a tooling/agent surface and does not register a callable platform service.",
-            evidence: [`tooling=${application.id}`],
+            evidence: [`tooling=${applicationId}`],
             nextActions: []
           });
         }
@@ -3316,6 +3454,7 @@ function enrichFinding(application, finding2, evidence) {
       });
     }
     case "agent-and-operator-surfaces": {
+      const applicationId = String(application.id);
       const declaredServices = application.services ?? [];
       const text = evidence.source.text;
       const items = [];
@@ -3325,11 +3464,11 @@ function enrichFinding(application, finding2, evidence) {
         items.push("source=confirm-write-gate");
       }
       if (text.includes("@topolo/sdk")) items.push("source=@topolo/sdk");
-      if (application.id === "cli" || application.id === "mcp" || application.id === "cloudcontrol") {
+      if (applicationId === "cli" || applicationId === "mcp" || applicationId === "cloudcontrol") {
         return mergeFinding(finding2, {
           status: "met",
           reason: "This application is itself an agent/operator surface (CLI / MCP / CloudControl).",
-          evidence: [`tooling=${application.id}`, ...items],
+          evidence: [`tooling=${applicationId}`, ...items],
           nextActions: []
         });
       }
@@ -3889,13 +4028,17 @@ function isFile(filePath) {
 }
 
 // src/commands/app-scaffold.ts
+import { randomBytes } from "crypto";
 import { constants } from "fs";
 import { access, mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
 import { dirname as dirname3, relative, resolve } from "path";
 var CLOUDFLARE_ACCOUNT_ID = "49ef1ba682ad8cfd720c86699ae17521";
 var STAGING_CLOUDFLARE_ACCOUNT_ID = "4f4e1c69a3830946f9fea7b1eb7531ac";
 var CLOUDFLARE_COMPATIBILITY_DATE = "2026-05-05";
-var CURRENT_VERIFICATION_DATE = "2026-05-06";
+var CURRENT_VERIFICATION_DATE = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+function generateOpaqueServiceId() {
+  return `srv_${randomBytes(9).toString("base64url")}`;
+}
 function applicationScaffoldPayload(application, options = {}) {
   const target = normalizeTarget(options.target);
   const portfolio = target === "platform" ? normalizePortfolio(options.portfolio) : null;
@@ -3912,23 +4055,28 @@ function applicationScaffoldPayload(application, options = {}) {
   const tenancy = normalizeTenancy(options.tenancy, audience);
   const surfaceModel = normalizeSurfaceModel(options.surfaceModel);
   const containerAppId = normalizeContainerAppId(options.containerAppId, surfaceModel);
+  const profile = normalizeScaffoldProfile(options.profile);
+  const resources = resolveScaffoldResources(profile, options);
   const ownerType = target === "platform" ? "topolo_first_party" : "third_party";
   const distributionModel = target === "platform" ? "marketplace" : "organization_internal";
   const appDir = options.appDir ?? catalogApplication?.appDir ?? (target === "platform" ? `Topolo${toPascalCase(id)}` : `topolo-${slug}`);
   const name = options.name ?? catalogApplication?.name ?? `topolo-${slug}`;
   const packageName = options.packageName ?? catalogApplication?.packageName ?? `topolo-${slug}`;
-  const defaultServiceId = target === "platform" ? `srv_topolo_${id}` : id;
-  const serviceId = api ? options.service ?? (target === "platform" ? defaultServiceId : catalogApplication?.services[0] ?? defaultServiceId) : null;
+  const serviceSlug = api ? target === "platform" ? `topolo-${slug}` : id : null;
+  const defaultServiceId = target === "platform" ? generateOpaqueServiceId() : catalogApplication?.services[0] ?? id;
+  const serviceId = api ? options.service ?? defaultServiceId : null;
   const productionUrl = browser ? options.productionUrl ?? catalogApplication?.productionUrl ?? `https://${slug}.topolo.app` : null;
   const scopes = scaffoldScopes({ browser, api });
+  const capabilities = scaffoldCapabilities({ browser, api, distributionModel });
   const ciWorkflowPath = target === "platform" ? ".github/workflows/topolo-conformance.yml" : null;
-  const ciWorkflow = target === "platform" ? topoloConformanceWorkflow({ id, appDir }) : null;
+  const ciWorkflow = target === "platform" ? topoloConformanceWorkflow({ id, appDir, audience }) : null;
   const applicationPayload = {
     id,
     name,
     appDir,
     packageName,
     productionUrl,
+    serviceSlug,
     serviceId
   };
   return {
@@ -3940,7 +4088,10 @@ function applicationScaffoldPayload(application, options = {}) {
     tenancy,
     surfaceModel,
     containerAppId,
+    profile,
+    resources,
     distributionModel,
+    capabilities,
     application: applicationPayload,
     scopes,
     requirements: APPLICATION_REQUIREMENTS.filter(
@@ -3955,7 +4106,10 @@ function applicationScaffoldPayload(application, options = {}) {
         tenancy,
         surfaceModel,
         containerAppId,
-        distributionModel
+        profile,
+        resources,
+        distributionModel,
+        capabilities
       },
       application: applicationPayload,
       target,
@@ -3968,7 +4122,8 @@ function applicationScaffoldPayload(application, options = {}) {
       target,
       audience,
       tenancy,
-      portfolio
+      portfolio,
+      profile
     }),
     ciWorkflowPath,
     ciWorkflow
@@ -4017,7 +4172,7 @@ function scaffoldScopes(options) {
 }
 function scaffoldPackages(options) {
   if (options.target === "developer") {
-    return [];
+    return options.browser ? ["@topolo/login"] : [];
   }
   const packages = /* @__PURE__ */ new Set();
   if (options.browser) {
@@ -4025,15 +4180,30 @@ function scaffoldPackages(options) {
     packages.add("@topolo-io/auth-client");
   }
   if (options.api) {
-    packages.add("@topolo-io/auth-middleware");
+    packages.add("@topolo-io/worker-runtime");
     packages.add("@topolo/sdk");
   }
   return Array.from(packages);
 }
+function scaffoldCapabilities(options) {
+  const capabilities = [];
+  if (options.browser) {
+    capabilities.push("login", "launcher");
+  }
+  if (options.distributionModel === "marketplace") capabilities.push("marketplace");
+  if (options.api) capabilities.push("api", "widget");
+  return capabilities;
+}
+function firstPartyAppPath(appDir, audience) {
+  if (appDir === "TopoloCli" || appDir === "TopoloCLI") return "Apps/system/TopoloCLI";
+  if (appDir === "TopoloDocs") return "Apps/system/TopoloDocs";
+  if (appDir === "TopoloAuth") return "Apps/system/TopoloAuth";
+  return `${audience === "personal" ? "Apps/personal" : "Apps/business"}/${appDir}`;
+}
 function scaffoldFiles(options) {
   const { application, target } = options;
   const slug = toSlug(application.id);
-  const base = target === "platform" ? `PlatformApplications/${application.appDir}` : application.appDir;
+  const base = target === "platform" ? firstPartyAppPath(application.appDir, options.payload.audience) : application.appDir;
   const files = [
     {
       path: `${base}/package.json`,
@@ -4042,7 +4212,11 @@ function scaffoldFiles(options) {
         "name matches the packageName in the SDK application catalog",
         "scripts include build plus typecheck where the stack supports them"
       ],
-      content: packageJson(application, target, { browser: options.browser, api: options.api })
+      content: packageJson(application, target, {
+        browser: options.browser,
+        api: options.api,
+        resources: options.payload.resources
+      })
     },
     {
       path: `${base}/README.md`,
@@ -4055,7 +4229,9 @@ function scaffoldFiles(options) {
         api: options.api,
         audience: options.payload.audience,
         tenancy: options.payload.tenancy,
-        portfolio: options.payload.portfolio
+        portfolio: options.payload.portfolio,
+        profile: options.payload.profile,
+        resources: options.payload.resources
       })
     },
     {
@@ -4112,6 +4288,17 @@ function scaffoldFiles(options) {
       ],
       content: envDts(options.api)
     },
+    ...options.payload.resources.workflow ? [
+      {
+        path: `${base}/src/cloudflare-workers.d.ts`,
+        purpose: "Minimal Cloudflare Workflow entrypoint typing for scaffolded Workers.",
+        requiredSignals: [
+          "declares cloudflare:workers WorkflowEntrypoint for TypeScript",
+          "keeps Workflow imports deployable without adding a new dependency"
+        ],
+        content: cloudflareWorkersDts()
+      }
+    ] : [],
     {
       path: `${base}/src/styles.css`,
       purpose: "Minimal app-local styles outside the shared Topolo shell.",
@@ -4131,21 +4318,26 @@ function scaffoldFiles(options) {
           "production URLs and Cloudflare targets are explicit",
           "resource bindings and required secrets are declared without secret values"
         ],
-        content: cloudcontrolJson(application, { api: options.api })
+        content: cloudcontrolJson(application, {
+          api: options.api,
+          audience: options.payload.audience,
+          profile: options.payload.profile,
+          resources: options.payload.resources
+        })
       },
       {
         path: `${base}/.github/workflows/topolo-conformance.yml`,
         purpose: "PR/push gate that runs the local Topolo app audit with docs evidence.",
         requiredSignals: [
-          "checks out this repo under its PlatformApplications app directory",
-          "checks out TopoloDocs under PlatformApplications/TopoloDocs",
+          "checks out this repo under its Apps lane directory",
+          "checks out TopoloDocs under Apps/system/TopoloDocs",
           "checks out topolo-sdk and TopoloCli from main so the gate does not wait for an npm publish",
           "runs topolo apps audit with --local and --fail-on needs_review"
         ],
         content: options.ciWorkflow ?? ""
       },
       {
-        path: `PlatformApplications/TopoloDocs/src/content/systems/topolo-${slug}.json`,
+        path: `Apps/system/TopoloDocs/src/content/systems/topolo-${slug}.json`,
         purpose: "Canonical system registry entry.",
         requiredSignals: [
           `repo_paths includes ${base}`,
@@ -4156,11 +4348,13 @@ function scaffoldFiles(options) {
           api: options.api,
           audience: options.payload.audience,
           tenancy: options.payload.tenancy,
-          portfolio: options.payload.portfolio
+          portfolio: options.payload.portfolio,
+          profile: options.payload.profile,
+          resources: options.payload.resources
         })
       },
       {
-        path: `PlatformApplications/TopoloDocs/src/content/internal/apps/${slug}.mdx`,
+        path: `Apps/system/TopoloDocs/src/content/internal/apps/${slug}.mdx`,
         purpose: "Internal operator handbook.",
         requiredSignals: [
           "documents ownership, routes, auth boundary, deployment, operations, and verification",
@@ -4170,11 +4364,13 @@ function scaffoldFiles(options) {
           api: options.api,
           audience: options.payload.audience,
           tenancy: options.payload.tenancy,
-          portfolio: options.payload.portfolio
+          portfolio: options.payload.portfolio,
+          profile: options.payload.profile,
+          resources: options.payload.resources
         })
       },
       {
-        path: `PlatformApplications/TopoloDocs/src/content/public/applications/${slug}.mdx`,
+        path: `Apps/system/TopoloDocs/src/content/public/applications/${slug}.mdx`,
         purpose: "Public application overview.",
         requiredSignals: [
           "documents the product surface without internal-only details",
@@ -4184,14 +4380,16 @@ function scaffoldFiles(options) {
           api: options.api,
           audience: options.payload.audience,
           tenancy: options.payload.tenancy,
-          portfolio: options.payload.portfolio
+          portfolio: options.payload.portfolio,
+          profile: options.payload.profile,
+          resources: options.payload.resources
         })
       }
     );
     if (options.api && application.serviceId) {
       files.push(
         {
-          path: `PlatformApplications/TopoloAuth/catalog/service-manifests/${application.serviceId}.json`,
+          path: `Apps/system/TopoloAuth/catalog/service-manifests/${application.serviceId}.json`,
           purpose: "Auth service manifest for first-party permissions, role bundles, and API-key scopes.",
           requiredSignals: [
             "serviceId matches the generated Worker service id",
@@ -4199,6 +4397,7 @@ function scaffoldFiles(options) {
             "systems metadata maps the service back to the generated TopoloDocs entries"
           ],
           content: serviceManifestJson(application, {
+            audience: options.payload.audience,
             tenancy: options.payload.tenancy
           })
         }
@@ -4219,7 +4418,8 @@ function scaffoldFiles(options) {
           tenancy: options.payload.tenancy,
           surfaceModel: options.payload.surfaceModel,
           containerAppId: options.payload.containerAppId,
-          distributionModel: options.payload.distributionModel
+          distributionModel: options.payload.distributionModel,
+          capabilities: options.payload.capabilities
         })
       },
       {
@@ -4234,6 +4434,17 @@ function scaffoldFiles(options) {
     );
   }
   if (options.browser) {
+    if (target === "platform") {
+      files.push({
+        path: `${base}/src/service-identity.ts`,
+        purpose: "Central service identity resolver shared by browser and Worker runtime surfaces.",
+        requiredSignals: [
+          "exports the generated app id, display name, and stable Auth service slug",
+          "requires the provisioned Auth service id from the Worker deployment config"
+        ],
+        content: serviceIdentityTs(application)
+      });
+    }
     files.push({
       path: `${base}/src/App.tsx`,
       purpose: "Authenticated browser surface.",
@@ -4258,19 +4469,21 @@ function scaffoldFiles(options) {
           "bindings match topolo.cloudcontrol.json or topolo.app.json",
           "secrets are referenced by name only"
         ],
-        content: wranglerToml(application, target)
+        content: wranglerToml(application, target, options.payload.resources, options.payload.profile)
       },
       {
         path: `${base}/src/worker.ts`,
         purpose: "Protected service boundary.",
         requiredSignals: [
-          "uses @topolo-io/auth-middleware or Auth validation for protected routes",
+          "uses @topolo-io/worker-runtime for Worker auth, gatewaying, headers, and request helpers",
           "derives organization from the credential rather than client-supplied orgId",
           "emits or propagates X-Topolo-Request-Id and X-Topolo-Client"
         ],
         content: workerTs(application, target, {
           audience: options.payload.audience,
-          tenancy: options.payload.tenancy
+          tenancy: options.payload.tenancy,
+          profile: options.payload.profile,
+          resources: options.payload.resources
         })
       }
     );
@@ -4290,30 +4503,32 @@ function scaffoldCommands(options) {
     ];
   }
   const portfolioFlags = options.portfolio === "personal" ? " --portfolio personal" : "";
+  const profileFlags = options.profile ? ` --profile ${options.profile}` : "";
   return [
-    `topolo platform apps scaffold ${scaffoldId}${portfolioFlags} --write --provision --repo-root /Users/ashes/Projects/topolo --json`,
+    `topolo platform apps scaffold ${scaffoldId}${portfolioFlags}${profileFlags} --write --provision --repo-root /Users/ashes/Projects/Topolo/Platform --json`,
     "topolo apps requirements --json",
-    `topolo apps audit ${options.id} --local --repo-root /Users/ashes/Projects/topolo --fail-on needs_review --json`,
-    `topolo apps audit ${options.id} --local --repo-root /Users/ashes/Projects/topolo --fail-on partial --json`
+    `topolo apps audit ${options.id} --local --repo-root /Users/ashes/Projects/Topolo/Platform --fail-on needs_review --json`,
+    `topolo apps audit ${options.id} --local --repo-root /Users/ashes/Projects/Topolo/Platform --fail-on partial --json`
   ];
 }
 function topoloConformanceWorkflow(options) {
+  const appPath = firstPartyAppPath(options.appDir, options.audience);
   const docsCheckoutStep = options.appDir === "TopoloDocs" ? [] : [
     "",
     "      - name: Checkout TopoloDocs",
     "        uses: actions/checkout@v4",
     "        with:",
     "          repository: Topolo-io/docs",
-    "          path: PlatformApplications/TopoloDocs",
+    "          path: Apps/system/TopoloDocs",
     "          token: ${{ secrets.TOPOLO_CI_REPO_TOKEN || github.token }}"
   ];
-  const cliCheckoutStep = options.appDir === "TopoloCli" ? [] : [
+  const cliCheckoutStep = options.appDir === "TopoloCLI" || options.appDir === "TopoloCli" ? [] : [
     "",
     "      - name: Checkout Topolo CLI",
     "        uses: actions/checkout@v4",
     "        with:",
     "          repository: Topolo-io/TopoloCli",
-    "          path: PlatformApplications/TopoloCli",
+    "          path: Apps/system/TopoloCLI",
     "          token: ${{ secrets.TOPOLO_CI_REPO_TOKEN || github.token }}"
   ];
   return [
@@ -4336,14 +4551,14 @@ function topoloConformanceWorkflow(options) {
     "      - name: Checkout application",
     "        uses: actions/checkout@v4",
     "        with:",
-    `          path: PlatformApplications/${options.appDir}`,
+    `          path: ${appPath}`,
     ...docsCheckoutStep,
     "",
     "      - name: Checkout Topolo SDK",
     "        uses: actions/checkout@v4",
     "        with:",
     "          repository: Topolo-io/topolo-sdk",
-    "          path: PlatformApplications/packages/topolo-sdk",
+    "          path: Apps/packages/topolo-sdk",
     "          token: ${{ secrets.TOPOLO_CI_REPO_TOKEN || github.token }}",
     ...cliCheckoutStep,
     "",
@@ -4353,26 +4568,26 @@ function topoloConformanceWorkflow(options) {
     "          node-version: 20",
     "",
     "      - name: Build Topolo SDK",
-    "        working-directory: PlatformApplications/packages/topolo-sdk",
+    "        working-directory: Apps/packages/topolo-sdk",
     "        run: |",
     "          npm install --no-audit --no-fund",
     "          npm run build",
     "",
     "      - name: Build Topolo CLI",
-    "        working-directory: PlatformApplications/TopoloCli",
+    "        working-directory: Apps/system/TopoloCLI",
     "        run: |",
     "          npm install --no-audit --no-fund",
     "          npm run build",
     "",
     "      - name: Run Topolo app conformance audit",
     "        run: |",
-    `          node PlatformApplications/TopoloCli/dist/index.js apps audit ${options.id} --local --repo-root "$GITHUB_WORKSPACE" --fail-on needs_review --json`,
+    `          node Apps/system/TopoloCLI/dist/index.js apps audit ${options.id} --local --repo-root "$GITHUB_WORKSPACE" --fail-on needs_review --json`,
     "",
     "      - name: Record green CI evidence",
     `        if: \${{ success() }}`,
-    `        working-directory: PlatformApplications/${options.appDir}`,
+    `        working-directory: ${appPath}`,
     "        run: |",
-    `          node "$GITHUB_WORKSPACE/PlatformApplications/TopoloCli/dist/index.js" apps record-evidence ${options.id} --build --typecheck --test --commit "$GITHUB_SHA"`
+    `          node "$GITHUB_WORKSPACE/Apps/system/TopoloCLI/dist/index.js" apps record-evidence ${options.id} --build --typecheck --test --commit "$GITHUB_SHA"`
   ].join("\n");
 }
 function packageJson(application, target, options) {
@@ -4398,20 +4613,27 @@ function packageJson(application, target, options) {
       dependencies["@topolo-io/auth-client"] = topoloPackageVersion("@topolo-io/auth-client", target);
       dependencies["@topolo-io/design-tokens"] = topoloPackageVersion("@topolo-io/design-tokens", target);
       dependencies["@topolo-io/ui-kit"] = topoloPackageVersion("@topolo-io/ui-kit", target);
+    } else {
+      dependencies["@topolo/login"] = topoloPackageVersion("@topolo/login", target);
     }
   }
   if (options.api) {
     if (target === "platform") {
-      dependencies["@topolo-io/auth-middleware"] = topoloPackageVersion("@topolo-io/auth-middleware", target);
+      dependencies["@topolo-io/worker-runtime"] = topoloPackageVersion("@topolo-io/worker-runtime", target);
+      dependencies["@topolo-io/widget-server"] = topoloPackageVersion("@topolo-io/widget-server", target);
       dependencies["@topolo/sdk"] = topoloPackageVersion("@topolo/sdk", target);
       scripts.deploy = `node -e 'console.error("\\nX Bare deploy is disabled. Use deploy:staging or deploy:production.\\n"); process.exit(1)'`;
       scripts["deploy:staging"] = "DEPLOY_ENVIRONMENT=staging VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us npm run build && wrangler deploy --env staging";
       scripts["deploy:production"] = "DEPLOY_ENVIRONMENT=production npm run build && wrangler deploy";
     } else {
+      dependencies["@topolo-io/widget-server"] = topoloPackageVersion("@topolo-io/widget-server", target);
       scripts.deploy = "npm run build && wrangler deploy";
     }
     devDependencies.wrangler = "^4.40.2";
   }
+  if (target === "platform" && hasScaffoldResources(options.resources)) {
+    scripts["check:deploy-config"] = "wrangler deploy --dry-run --outdir .wrangler/build";
+  }
   return `${json({
     name: application.packageName,
     version: "0.1.0",
@@ -4425,15 +4647,20 @@ function packageJson(application, target, options) {
 }
 function topoloPackageVersion(packageName, target) {
   if (target === "developer") {
+    if (packageName === "@topolo/login") return "^0.1.0";
     if (packageName === "@topolo-io/auth-client") return "^1.0.0";
+    if (packageName === "@topolo-io/widget-server") return "^0.1.1";
     return "^0.1.0";
   }
   const platformPackageFolders = {
     "@topolo/sdk": "topolo-sdk",
+    "@topolo/login": "topolo-login",
     "@topolo-io/auth-client": "topolo-auth-client",
     "@topolo-io/auth-middleware": "topolo-auth-middleware",
+    "@topolo-io/worker-runtime": "topolo-worker-runtime",
     "@topolo-io/design-tokens": "topolo-design-tokens",
-    "@topolo-io/ui-kit": "topolo-ui-kit"
+    "@topolo-io/ui-kit": "topolo-ui-kit",
+    "@topolo-io/widget-server": "topolo-widget-server"
   };
   const folder = platformPackageFolders[packageName];
   if (!folder) {
@@ -4441,6 +4668,49 @@ function topoloPackageVersion(packageName, target) {
   }
   return `file:../packages/${folder}`;
 }
+function hasScaffoldResources(resources) {
+  return resources.d1 || resources.r2 || resources.queue || resources.workflow || resources.containerProcessing;
+}
+function resourceConfig(application, profile) {
+  const slug = toSlug(application.id);
+  const pascal = toPascalCase(application.id);
+  if (profile === "spatial-assets") {
+    return {
+      d1Binding: "APP_DB",
+      d1ProductionName: `topolo-${slug}-production-db`,
+      d1StagingName: `topolo-${slug}-staging-db`,
+      r2Binding: "SPACES_ASSETS",
+      r2ProductionName: `topolo-${slug}-assets`,
+      r2StagingName: `topolo-${slug}-assets-staging`,
+      queueBinding: "SPACES_PROCESSING_QUEUE",
+      queueProductionName: `topolo-${slug}-processing`,
+      queueStagingName: `topolo-${slug}-processing-staging`,
+      workflowBinding: "SPACES_IMPORT_WORKFLOW",
+      workflowClassName: `${pascal}ImportWorkflow`,
+      workflowProductionName: `topolo-${slug}-import`,
+      workflowStagingName: `topolo-${slug}-import-staging`,
+      containerProductionName: `topolo-${slug}-processor`,
+      containerStagingName: `topolo-${slug}-processor-staging`
+    };
+  }
+  return {
+    d1Binding: "APP_DB",
+    d1ProductionName: `topolo-${slug}-prod`,
+    d1StagingName: `topolo-${slug}-staging`,
+    r2Binding: "APP_ASSETS",
+    r2ProductionName: `topolo-${slug}-assets`,
+    r2StagingName: `topolo-${slug}-assets-staging`,
+    queueBinding: "APP_QUEUE",
+    queueProductionName: `topolo-${slug}-queue`,
+    queueStagingName: `topolo-${slug}-queue-staging`,
+    workflowBinding: "APP_WORKFLOW",
+    workflowClassName: `${pascal}Workflow`,
+    workflowProductionName: `topolo-${slug}-workflow`,
+    workflowStagingName: `topolo-${slug}-workflow-staging`,
+    containerProductionName: `topolo-${slug}-processor`,
+    containerStagingName: `topolo-${slug}-processor-staging`
+  };
+}
 function readme(application, target, options) {
   const displayName = toTitle(application.name);
   const slug = toSlug(application.id);
@@ -4453,6 +4723,7 @@ function readme(application, target, options) {
     `Audience: ${options.audience}`,
     `Tenancy: ${options.tenancy}`,
     ...target === "platform" && options.portfolio ? [`Portfolio: ${options.portfolio}`] : [],
+    ...options.profile ? [`Profile: ${options.profile}`] : [],
     "",
     "## Development",
     "",
@@ -4474,7 +4745,12 @@ function readme(application, target, options) {
       "- `vite.config.ts` includes the standard React plugin plus React runtime dedupe so linked Topolo packages resolve one browser React runtime."
     );
     if (options.api) {
-      lines.push("- `@topolo-io/auth-middleware` validates Worker requests through Topolo Auth.");
+      lines.push("- `@topolo-io/worker-runtime` owns Worker auth validation, `/api/auth/*` gatewaying, security headers, request ids, and BugFix reporting.");
+    }
+    if (hasScaffoldResources(options.resources)) {
+      lines.push(
+        "- Generated resource bindings are declared in both `wrangler.toml` and `topolo.cloudcontrol.json`."
+      );
     }
   } else {
     lines.push(
@@ -4501,6 +4777,15 @@ function readme(application, target, options) {
       "`topolo.app.json` is the app manifest used to register callback URLs, requested scopes, and local development metadata with Topolo."
     );
   }
+  if (hasScaffoldResources(options.resources)) {
+    lines.push(
+      "",
+      "## Resource Verification",
+      "",
+      "- Keep CloudControl resource bindings aligned with Wrangler bindings before deploy.",
+      "- Run `npm run check:deploy-config` after changing Worker bindings."
+    );
+  }
   return `${lines.join("\n")}
 `;
 }
@@ -4551,8 +4836,7 @@ function envDts(api) {
     "  readonly VITE_TOPOLO_AUTH_URL?: string;",
     "  readonly VITE_TOPOLO_CLIENT_ID?: string;",
     "  readonly VITE_TOPOLO_REDIRECT_URI?: string;",
-    "  readonly VITE_TOPOLO_SCOPES?: string;",
-    "  readonly VITE_TOPOLO_SERVICE_ID?: string;"
+    "  readonly VITE_TOPOLO_SCOPES?: string;"
   ];
   if (api) {
     lines.push("  readonly VITE_TOPOLO_API_URL?: string;");
@@ -4567,6 +4851,105 @@ function envDts(api) {
   );
   return lines.join("\n");
 }
+function serviceIdentityTs(application) {
+  const appName = toTitle(application.name);
+  const serviceSlug = application.serviceSlug ?? `topolo-${toSlug(application.id)}`;
+  return [
+    `export const SCAFFOLD_APP_ID = '${application.id}';`,
+    `export const SCAFFOLD_APP_NAME = '${escapeSingleQuoted(appName)}';`,
+    `export const SCAFFOLD_SERVICE_SLUG = '${escapeSingleQuoted(serviceSlug)}';`,
+    "",
+    "interface ServiceIdentityEnv {",
+    "  SERVICE_ID?: string;",
+    "}",
+    "",
+    "let cachedBrowserServiceId = '';",
+    "",
+    "declare global {",
+    "  interface Window {",
+    "    __TOPOLO_SCAFFOLD_SERVICE_ID__?: string;",
+    "  }",
+    "}",
+    "",
+    "export function getBrowserAuthBaseUrl(): string {",
+    "  const defaultAuthUrl =",
+    "    typeof window !== 'undefined' && window.location.hostname.endsWith('.stg.topolo.us')",
+    "      ? 'https://auth.stg.topolo.us'",
+    "      : 'https://auth.topolo.app';",
+    "  return (import.meta.env.VITE_TOPOLO_AUTH_URL || defaultAuthUrl).replace(/\\/+$/, '');",
+    "}",
+    "",
+    "export function getAppServiceId(): string {",
+    "  const runtimeServiceId =",
+    "    typeof window !== 'undefined'",
+    "      ? window.__TOPOLO_SCAFFOLD_SERVICE_ID__",
+    "      : undefined;",
+    "  return (cachedBrowserServiceId || runtimeServiceId || '').trim();",
+    "}",
+    "",
+    "export async function resolveAppServiceId(): Promise<string> {",
+    "  const current = getAppServiceId();",
+    "  if (current) {",
+    "    cachedBrowserServiceId = current;",
+    "    return current;",
+    "  }",
+    "",
+    "  const response = await fetchServiceIdentity();",
+    "  const payload = await response.json().catch(() => null);",
+    "  const serviceId = payload?.serviceId || payload?.data?.serviceId || payload?.data?.service_id;",
+    "  if (typeof serviceId !== 'string' || !serviceId.trim()) {",
+    "    throw new Error(`Missing Auth service id for ${SCAFFOLD_SERVICE_SLUG}`);",
+    "  }",
+    "  cachedBrowserServiceId = serviceId.trim();",
+    "  if (typeof window !== 'undefined') {",
+    "    window.__TOPOLO_SCAFFOLD_SERVICE_ID__ = cachedBrowserServiceId;",
+    "  }",
+    "  return cachedBrowserServiceId;",
+    "}",
+    "",
+    "async function fetchServiceIdentity(): Promise<Response> {",
+    "  const response = await fetch('/api/service-identity', {",
+    "    headers: { Accept: 'application/json' },",
+    "  );",
+    "  if (!response.ok) {",
+    "    throw new Error(`Unable to resolve ${SCAFFOLD_SERVICE_SLUG} service identity`);",
+    "  }",
+    "  return response;",
+    "}",
+    "",
+    "function requireServiceId(value: unknown): string {",
+    "  const serviceId = typeof value === 'string' ? value.trim() : '';",
+    "  if (!serviceId) {",
+    "    throw new Error(`SERVICE_ID is required for ${SCAFFOLD_SERVICE_SLUG}`);",
+    "    }",
+    "  return serviceId;",
+    "}",
+    "",
+    "export function resolveRuntimeServiceId(env: ServiceIdentityEnv): Promise<string> {",
+    "  return Promise.resolve(requireServiceId(env.SERVICE_ID));",
+    "}",
+    ""
+  ].join("\n");
+}
+function cloudflareWorkersDts() {
+  return [
+    "declare module 'cloudflare:workers' {",
+    "  export interface WorkflowEvent<T = unknown> {",
+    "    payload: T;",
+    "  }",
+    "",
+    "  export interface WorkflowStep {",
+    "    do<T>(name: string, callback: () => Promise<T> | T): Promise<T>;",
+    "  }",
+    "",
+    "  export abstract class WorkflowEntrypoint<Env = unknown, Params = unknown> {",
+    "    env: Env;",
+    "    abstract run(event: Readonly<WorkflowEvent<Params>>, step: WorkflowStep): Promise<unknown>;",
+    "  }",
+    "}",
+    ""
+  ].join("\n");
+}
 function viteConfig(target) {
   if (target === "developer") {
     return [
@@ -4744,8 +5127,6 @@ function appTsx(application, target, options) {
   return platformAppTsx(application, options);
 }
 function platformAppTsx(application, options) {
-  const appName = toTitle(application.name);
-  const serviceId = application.serviceId ?? application.id;
   const isPersonal = options.audience === "personal";
   const tagline = isPersonal ? "Topolo personal app" : "Topolo workspace";
   const workspaceTitle = isPersonal ? "Personal app" : "Workspace";
@@ -4755,8 +5136,9 @@ function platformAppTsx(application, options) {
   const baselineDescription = isPersonal ? "This scaffold starts on the shared landing and login surfaces, completes sign-in on the shared callback path, and renders the signed personal app inside the shared Topolo shell." : "This scaffold starts on the shared landing and login surfaces, completes sign-in on the shared callback path, and renders the signed workspace inside the shared Topolo shell.";
   return [
     "import { Component, useEffect, useMemo, useState, type ErrorInfo, type ReactNode } from 'react';",
-    "import { createBrowserAuthModule, type AuthUser } from '@topolo-io/auth-client';",
+    "import { createBrowserAuthSessionController, type AuthUser } from '@topolo-io/auth-client';",
     "import { LandingPage, LoginPage, TopoloAppShell, TopoloAuthFlowScreen, TopoloLoadingScreen, setupBugReporterErrorCapture, type TopoloAppShellUser } from '@topolo-io/ui-kit';",
+    "import { SCAFFOLD_APP_ID, SCAFFOLD_APP_NAME, SCAFFOLD_SERVICE_SLUG, getBrowserAuthBaseUrl, resolveAppServiceId } from './service-identity';",
     "",
     "// Wire global error/console capture so BugReporter (enabled in TopoloAppShell below)",
     "// can attach the last few errors to any submitted bug report.",
@@ -4764,16 +5146,11 @@ function platformAppTsx(application, options) {
     "",
     "type NavItem = 'home';",
     "type AppRoute = { kind: 'root' } | { kind: 'login' } | { kind: 'callback' };",
+    "type BrowserAuthModule = ReturnType<typeof createBrowserAuthSessionController>;",
     "",
-    `const APP_ID = '${application.id}';`,
-    `const APP_NAME = '${escapeSingleQuoted(appName)}';`,
-    `const DEFAULT_SERVICE_ID = '${serviceId}';`,
-    "const DEFAULT_AUTH_URL =",
-    "  typeof window !== 'undefined' && window.location.hostname.endsWith('.stg.topolo.us')",
-    "    ? 'https://auth.stg.topolo.us'",
-    "    : 'https://auth.topolo.app';",
-    "const AUTH_URL = import.meta.env.VITE_TOPOLO_AUTH_URL ?? DEFAULT_AUTH_URL;",
-    "const SERVICE_ID = import.meta.env.VITE_TOPOLO_SERVICE_ID ?? DEFAULT_SERVICE_ID;",
+    "const APP_ID = SCAFFOLD_APP_ID;",
+    "const APP_NAME = SCAFFOLD_APP_NAME;",
+    "const AUTH_URL = getBrowserAuthBaseUrl();",
     "const LANDING_CONFIG = {",
     "  app_name: APP_NAME,",
     `  app_tagline: '${escapeSingleQuoted(tagline)}',`,
@@ -4792,17 +5169,28 @@ function platformAppTsx(application, options) {
     "  authenticated_home_path: '/',",
     "};",
     "",
-    "const auth = createBrowserAuthModule({",
-    "  authServiceUrl: AUTH_URL,",
-    "  serviceId: SERVICE_ID,",
-    "  devSessionKey: `${SERVICE_ID}_session`,",
-    "  devSessionStorageEnabled: import.meta.env.DEV,",
-    "  callbackPath: '/auth/callback',",
-    "  debug: import.meta.env.DEV,",
-    "});",
+    "let activeAuthServiceId = '';",
+    "let activeAuthModule: BrowserAuthModule | null = null;",
+    "",
+    "function getAuthModule(serviceId: string): BrowserAuthModule {",
+    "  const normalizedServiceId = serviceId.trim();",
+    "  if (!normalizedServiceId) throw new Error(`Missing Auth service id for ${SCAFFOLD_SERVICE_SLUG}`);",
+    "  if (!activeAuthModule || activeAuthServiceId !== normalizedServiceId) {",
+    "    activeAuthServiceId = normalizedServiceId;",
+    "    activeAuthModule = createBrowserAuthSessionController({",
+    "      authServiceUrl: AUTH_URL,",
+    "      serviceId: normalizedServiceId,",
+    "      devSessionKey: `${normalizedServiceId}_session`,",
+    "      devSessionStorageEnabled: import.meta.env.DEV,",
+    "      callbackPath: '/auth/callback',",
+    "      debug: import.meta.env.DEV,",
+    "    });",
+    "  }",
+    "  return activeAuthModule;",
+    "}",
     "",
     "function getAccessToken(): string | null {",
-    "  return auth.accessTokenMemory.get() ?? auth.accessTokenSession.get();",
+    "  return activeAuthModule?.accessTokenMemory.get() ?? activeAuthModule?.accessTokenSession.get() ?? null;",
     "}",
     "",
     "function toShellUser(user: AuthUser | null): TopoloAppShellUser | null {",
@@ -4828,12 +5216,33 @@ function platformAppTsx(application, options) {
     "function AppRoot() {",
     "  const route = getRoute();",
     "  const [user, setUser] = useState<AuthUser | null>(null);",
+    "  const [serviceId, setServiceId] = useState('');",
+    "  const [serviceIdentityError, setServiceIdentityError] = useState('');",
     "  const [loading, setLoading] = useState(true);",
     "  const [authError, setAuthError] = useState('');",
     "  const [loginAttempted, setLoginAttempted] = useState(false);",
+    "  const auth = useMemo(() => serviceId ? getAuthModule(serviceId) : null, [serviceId]);",
     "",
     "  useEffect(() => {",
     "    let active = true;",
+    "    setServiceIdentityError('');",
+    "    void resolveAppServiceId()",
+    "      .then((nextServiceId) => {",
+    "        if (active) setServiceId(nextServiceId);",
+    "      })",
+    "      .catch((error) => {",
+    "        if (!active) return;",
+    "        setServiceIdentityError(errorMessage(error));",
+    "        setLoading(false);",
+    "      });",
+    "    return () => {",
+    "      active = false;",
+    "    };",
+    "  }, []);",
+    "",
+    "  useEffect(() => {",
+    "    if (!auth) return;",
+    "    let active = true;",
     "    const syncAuth = async () => {",
     "      setLoading(true);",
     "      setAuthError('');",
@@ -4865,7 +5274,7 @@ function platformAppTsx(application, options) {
     "    return () => {",
     "      active = false;",
     "    };",
-    "  }, [route.kind]);",
+    "  }, [auth, route.kind]);",
     "",
     "  useEffect(() => {",
     "    if (!loading && user && route.kind === 'login') {",
@@ -4874,13 +5283,39 @@ function platformAppTsx(application, options) {
     "  }, [loading, route.kind, user]);",
     "",
     "  const shellUser = useMemo(() => toShellUser(user), [user]);",
+    "  const activeServiceId = serviceId || SCAFFOLD_SERVICE_SLUG;",
+    "",
+    "  if (!auth) {",
+    "    if (serviceIdentityError) {",
+    "      return (",
+    "        <TopoloAuthFlowScreen",
+    "          appName={APP_NAME}",
+    "          appId={APP_ID}",
+    "          serviceId={SCAFFOLD_SERVICE_SLUG}",
+    '          status="error"',
+    '          title="Service identity unavailable"',
+    "          message={serviceIdentityError}",
+    '          actionLabel="Retry"',
+    "          onAction={() => window.location.reload()}",
+    "        />",
+    "      );",
+    "    }",
+    "    return (",
+    "      <TopoloLoadingScreen",
+    "        appId={APP_ID}",
+    "        serviceId={SCAFFOLD_SERVICE_SLUG}",
+    "        appName={APP_NAME}",
+    "        subtitle={`Loading ${APP_NAME}...`}",
+    "      />",
+    "    );",
+    "  }",
     "",
     "  if (route.kind === 'callback') {",
     "    if (loading) {",
     "      return (",
     "        <TopoloLoadingScreen",
     "          appId={APP_ID}",
-    "          serviceId={SERVICE_ID}",
+    "          serviceId={activeServiceId}",
     "          appName={APP_NAME}",
     '          subtitle="Completing secure sign-in..."',
     "        />",
@@ -4891,7 +5326,7 @@ function platformAppTsx(application, options) {
     "      <TopoloAuthFlowScreen",
     "        appName={APP_NAME}",
     "        appId={APP_ID}",
-    "        serviceId={SERVICE_ID}",
+    "        serviceId={activeServiceId}",
     '        status="error"',
     '        title="Authentication failed"',
     "        message={authError || `We could not complete sign-in for ${APP_NAME}.`}",
@@ -4905,7 +5340,7 @@ function platformAppTsx(application, options) {
     "    return (",
     "      <TopoloLoadingScreen",
     "        appId={APP_ID}",
-    "        serviceId={SERVICE_ID}",
+    "        serviceId={activeServiceId}",
     "        appName={APP_NAME}",
     "        subtitle={`Loading ${APP_NAME}...`}",
     "      />",
@@ -4916,7 +5351,7 @@ function platformAppTsx(application, options) {
     "    if (route.kind === 'login') {",
     "      return (",
     "        <LoginPage",
-    "          serviceId={SERVICE_ID}",
+    "          serviceId={activeServiceId}",
     "          authApiUrl={AUTH_URL}",
     "          config={LOGIN_CONFIG}",
     "          isLoading={loginAttempted}",
@@ -4943,7 +5378,7 @@ function platformAppTsx(application, options) {
     "",
     "    return (",
     "      <LandingPage",
-    "        serviceId={SERVICE_ID}",
+    "        serviceId={activeServiceId}",
     "        authApiUrl={AUTH_URL}",
     "        config={LANDING_CONFIG}",
     "        onCTAClick={() => window.location.assign('/login')}",
@@ -4955,7 +5390,7 @@ function platformAppTsx(application, options) {
     "    return (",
     "      <TopoloLoadingScreen",
     "        appId={APP_ID}",
-    "        serviceId={SERVICE_ID}",
+    "        serviceId={activeServiceId}",
     "        appName={APP_NAME}",
     `        subtitle="Opening your ${escapeDoubleQuoted(signedSurfaceLabel)}..."`,
     "      />",
@@ -4965,7 +5400,7 @@ function platformAppTsx(application, options) {
     "  return (",
     "    <TopoloAppShell<NavItem>",
     "      appId={APP_ID}",
-    "      serviceId={SERVICE_ID}",
+    "      serviceId={activeServiceId}",
     "      appName={APP_NAME}",
     "      user={shellUser}",
     "      orgId={user.activeContextType === 'organization' ? user.activeContextId ?? user.orgId ?? null : null}",
@@ -5030,7 +5465,7 @@ function platformAppTsx(application, options) {
     "      <TopoloAuthFlowScreen",
     "        appName={APP_NAME}",
     "        appId={APP_ID}",
-    "        serviceId={SERVICE_ID}",
+    "        serviceId={SCAFFOLD_SERVICE_SLUG}",
     '        status="error"',
     "        title={APP_NAME + ' hit an unexpected error'}",
     "        message={this.state.error.message}",
@@ -5048,19 +5483,21 @@ function developerAppTsx(application) {
   const defaultClientId = `${toSlug(application.id)}_local_client`;
   return [
     "import { useEffect, useMemo, useState } from 'react';",
+    "import { createAccountLinkPayload, createTopoloAuthorizationUrl, exchangeTopoloCode, fetchTopoloUserInfo, type TopoloUserInfo } from '@topolo/login';",
     "",
     "type AuthState = 'ready' | 'missing_client' | 'authorizing' | 'authenticated' | 'error';",
     "",
     `const APP_NAME = '${escapeSingleQuoted(appName)}';`,
-    "const AUTH_URL = import.meta.env.VITE_TOPOLO_AUTH_URL ?? 'https://auth.topolo.app';",
+    "const AUTH_URL = import.meta.env.VITE_TOPOLO_AUTH_URL ?? import.meta.env.VITE_TOPOLO_AUTH_BASE_URL ?? 'https://auth.topolo.app';",
     `const CLIENT_ID = import.meta.env.VITE_TOPOLO_CLIENT_ID || '${defaultClientId}';`,
     "const REDIRECT_URI = import.meta.env.VITE_TOPOLO_REDIRECT_URI || `${window.location.origin}/auth/callback`;",
-    "const REQUESTED_SCOPES = (import.meta.env.VITE_TOPOLO_SCOPES || 'identity:read organization:read').trim();",
+    "const REQUESTED_SCOPES = (import.meta.env.VITE_TOPOLO_SCOPES || 'openid profile email organization:read entitlements:read').split(/[\\s,]+/).filter(Boolean);",
     "",
     "export default function App() {",
     "  const [authState, setAuthState] = useState<AuthState>(() => CLIENT_ID ? 'ready' : 'missing_client');",
     "  const [message, setMessage] = useState<string | null>(null);",
     "  const [tokenPreview, setTokenPreview] = useState<string | null>(null);",
+    "  const [userInfo, setUserInfo] = useState<TopoloUserInfo | null>(null);",
     "",
     "  const callbackCode = useMemo(() => new URLSearchParams(window.location.search).get('code'), []);",
     "  const callbackError = useMemo(() => new URLSearchParams(window.location.search).get('error'), []);",
@@ -5075,11 +5512,18 @@ function developerAppTsx(application) {
     "",
     "    setAuthState('authorizing');",
     "    void exchangeAuthorizationCode(callbackCode)",
-    "      .then((tokens) => {",
+    "      .then(async (tokens) => {",
     "        sessionStorage.setItem(`${CLIENT_ID}:topolo_access_token`, tokens.access_token);",
     "        if (tokens.refresh_token) {",
     "          sessionStorage.setItem(`${CLIENT_ID}:topolo_refresh_token`, tokens.refresh_token);",
     "        }",
+    "        const profile = await fetchTopoloUserInfo({ authBaseUrl: AUTH_URL, accessToken: tokens.access_token });",
+    "        const link = createAccountLinkPayload({",
+    "          localUserId: profile.email ? `local:${profile.email}` : `local:${profile.sub}`,",
+    "          userInfo: profile,",
+    "        });",
+    "        sessionStorage.setItem(`${CLIENT_ID}:topolo_account_link`, JSON.stringify(link));",
+    "        setUserInfo(profile);",
     "        setTokenPreview(`${tokens.access_token.slice(0, 18)}...`);",
     "        setAuthState('authenticated');",
     "        window.history.replaceState({}, document.title, '/');",
@@ -5099,7 +5543,7 @@ function developerAppTsx(application) {
     "          <p>Set VITE_TOPOLO_CLIENT_ID after registering this app in Topolo Developers.</p>",
     "        )}",
     "        {authState === 'authenticated' && (",
-    "          <p>Topolo sign-in complete. Access token: {tokenPreview}</p>",
+    "          <p>Topolo sign-in complete for {userInfo?.email ?? userInfo?.sub}. Access token: {tokenPreview}</p>",
     "        )}",
     "        {authState === 'error' && <p>{message}</p>}",
     `        <button type="button" disabled={!CLIENT_ID || authState === 'authorizing'} onClick={() => void startTopoloLogin()}>`,
@@ -5111,21 +5555,15 @@ function developerAppTsx(application) {
     "}",
     "",
     "async function startTopoloLogin(): Promise<void> {",
-    "  const verifier = randomString(64);",
-    "  const challenge = await pkceChallenge(verifier);",
-    "  const state = randomString(32);",
-    "  sessionStorage.setItem(`${CLIENT_ID}:topolo_pkce_verifier`, verifier);",
-    "  sessionStorage.setItem(`${CLIENT_ID}:topolo_oauth_state`, state);",
-    "",
-    "  const authorizeUrl = new URL('/api/developer-oauth/authorize', AUTH_URL);",
-    "  authorizeUrl.searchParams.set('response_type', 'code');",
-    "  authorizeUrl.searchParams.set('client_id', CLIENT_ID);",
-    "  authorizeUrl.searchParams.set('redirect_uri', REDIRECT_URI);",
-    "  authorizeUrl.searchParams.set('scope', REQUESTED_SCOPES);",
-    "  authorizeUrl.searchParams.set('state', state);",
-    "  authorizeUrl.searchParams.set('code_challenge', challenge);",
-    "  authorizeUrl.searchParams.set('code_challenge_method', 'S256');",
-    "  window.location.assign(authorizeUrl.toString());",
+    "  const authorization = await createTopoloAuthorizationUrl({",
+    "    authBaseUrl: AUTH_URL,",
+    "    clientId: CLIENT_ID,",
+    "    redirectUri: REDIRECT_URI,",
+    "    scopes: REQUESTED_SCOPES,",
+    "  });",
+    "  sessionStorage.setItem(`${CLIENT_ID}:topolo_pkce_verifier`, authorization.codeVerifier);",
+    "  sessionStorage.setItem(`${CLIENT_ID}:topolo_oauth_state`, authorization.state);",
+    "  window.location.assign(authorization.url);",
     "}",
     "",
     "async function exchangeAuthorizationCode(code: string): Promise<{ access_token: string; refresh_token?: string }> {",
@@ -5137,49 +5575,23 @@ function developerAppTsx(application) {
     "  const verifier = sessionStorage.getItem(`${CLIENT_ID}:topolo_pkce_verifier`);",
     "  if (!verifier) throw new Error('Missing PKCE verifier. Restart sign-in.');",
     "",
-    "  const tokenUrl = new URL('/api/developer-oauth/token', AUTH_URL);",
-    "  const response = await fetch(tokenUrl, {",
-    "    method: 'POST',",
-    "    headers: { 'Content-Type': 'application/json' },",
-    "    body: JSON.stringify({",
-    "      grant_type: 'authorization_code',",
-    "      client_id: CLIENT_ID,",
+    "  return exchangeTopoloCode({",
+    "    authBaseUrl: AUTH_URL,",
+    "    clientId: CLIENT_ID,",
     "      code,",
-    "      redirect_uri: REDIRECT_URI,",
-    "      code_verifier: verifier,",
-    "    }),",
+    "    redirectUri: REDIRECT_URI,",
+    "    codeVerifier: verifier,",
     "  });",
-    "  const payload = await response.json().catch(() => null);",
-    "  if (!response.ok || !payload?.access_token) {",
-    "    throw new Error(payload?.error_description || payload?.error || 'Token exchange failed.');",
-    "  }",
-    "  return payload;",
-    "}",
-    "",
-    "function randomString(length: number): string {",
-    "  const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';",
-    "  const bytes = crypto.getRandomValues(new Uint8Array(length));",
-    "  return Array.from(bytes, (byte) => alphabet[byte % alphabet.length]).join('');",
-    "}",
-    "",
-    "async function pkceChallenge(verifier: string): Promise<string> {",
-    "  const data = new TextEncoder().encode(verifier);",
-    "  const digest = await crypto.subtle.digest('SHA-256', data);",
-    "  return base64Url(new Uint8Array(digest));",
-    "}",
-    "",
-    "function base64Url(bytes: Uint8Array): string {",
-    "  let binary = '';",
-    "  for (const byte of bytes) binary += String.fromCharCode(byte);",
-    "  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/g, '');",
     "}",
     ""
   ].join("\n");
 }
-function wranglerToml(application, target) {
+function wranglerToml(application, target, resources, profile) {
   const slug = toSlug(application.id);
   const workerName = target === "platform" ? `topolo-${slug}` : application.packageName;
   const routeHost = application.productionUrl ? new URL(application.productionUrl).host : null;
+  const resource = resourceConfig(application, profile);
+  const runtimeIdentityVar = target === "platform" ? `SERVICE_ID = "${application.serviceId ?? ""}"` : `SERVICE_ID = "${application.serviceId ?? application.id}"`;
   const lines = [
     `name = "${workerName}"`,
     'main = "src/worker.ts"',
@@ -5215,9 +5627,47 @@ function wranglerToml(application, target) {
     "",
     "[vars]",
     'AUTH_BASE_URL = "https://auth.topolo.app"',
-    `SERVICE_ID = "${application.serviceId ?? application.id}"`,
+    runtimeIdentityVar,
     ""
   );
+  if (resources.d1) {
+    lines.push(
+      "[[d1_databases]]",
+      `binding = "${resource.d1Binding}"`,
+      `database_name = "${resource.d1ProductionName}"`,
+      'database_id = "provision-after-scaffold"',
+      'migrations_dir = "migrations"',
+      ""
+    );
+  }
+  if (resources.r2) {
+    lines.push(
+      "[[r2_buckets]]",
+      `binding = "${resource.r2Binding}"`,
+      `bucket_name = "${resource.r2ProductionName}"`,
+      ""
+    );
+  }
+  if (resources.queue) {
+    lines.push(
+      "[[queues.producers]]",
+      `binding = "${resource.queueBinding}"`,
+      `queue = "${resource.queueProductionName}"`,
+      "",
+      "[[queues.consumers]]",
+      `queue = "${resource.queueProductionName}"`,
+      ""
+    );
+  }
+  if (resources.workflow) {
+    lines.push(
+      "[[workflows]]",
+      `binding = "${resource.workflowBinding}"`,
+      `name = "${resource.workflowProductionName}"`,
+      `class_name = "${resource.workflowClassName}"`,
+      ""
+    );
+  }
   if (target === "platform") {
     lines.push(
       "# Staging deploys use the separate Topolo Staging Cloudflare account.",
@@ -5231,9 +5681,47 @@ function wranglerToml(application, target) {
       "",
       "[env.staging.vars]",
       'AUTH_BASE_URL = "https://auth.stg.topolo.us"',
-      `SERVICE_ID = "${application.serviceId ?? application.id}"`,
+      runtimeIdentityVar,
       ""
     );
+    if (resources.d1) {
+      lines.push(
+        "[[env.staging.d1_databases]]",
+        `binding = "${resource.d1Binding}"`,
+        `database_name = "${resource.d1StagingName}"`,
+        'database_id = "provision-after-scaffold"',
+        'migrations_dir = "migrations"',
+        ""
+      );
+    }
+    if (resources.r2) {
+      lines.push(
+        "[[env.staging.r2_buckets]]",
+        `binding = "${resource.r2Binding}"`,
+        `bucket_name = "${resource.r2StagingName}"`,
+        ""
+      );
+    }
+    if (resources.queue) {
+      lines.push(
+        "[[env.staging.queues.producers]]",
+        `binding = "${resource.queueBinding}"`,
+        `queue = "${resource.queueStagingName}"`,
+        "",
+        "[[env.staging.queues.consumers]]",
+        `queue = "${resource.queueStagingName}"`,
+        ""
+      );
+    }
+    if (resources.workflow) {
+      lines.push(
+        "[[env.staging.workflows]]",
+        `binding = "${resource.workflowBinding}"`,
+        `name = "${resource.workflowStagingName}"`,
+        `class_name = "${resource.workflowClassName}"`,
+        ""
+      );
+    }
   }
   return lines.join("\n");
 }
@@ -5242,12 +5730,29 @@ function workerTs(application, target, options) {
   return platformWorkerTs(application, options);
 }
 function platformWorkerTs(application, options) {
-  const serviceId = application.serviceId ?? application.id;
   const serviceName = toTitle(application.name);
   const openActionLabel = options.audience === "personal" ? "Open app" : "Open workspace";
+  const resource = resourceConfig(application, options.profile);
+  const envBindings = [
+    "  AUTH_BASE_URL?: string;",
+    "  SERVICE_ID?: string;",
+    "  TOPOLO_SERVICE_API_KEY?: string;",
+    ...options.resources.d1 ? [`  ${resource.d1Binding}?: unknown;`] : [],
+    ...options.resources.r2 ? [`  ${resource.r2Binding}?: unknown;`] : [],
+    ...options.resources.queue ? [`  ${resource.queueBinding}?: { send(message: unknown): Promise<void> };`] : [],
+    ...options.resources.workflow ? [`  ${resource.workflowBinding}?: unknown;`] : []
+  ];
+  const workflowExport = options.resources.workflow ? [
+    "",
+    `export class ${resource.workflowClassName} extends WorkflowEntrypoint<Env, unknown> {`,
+    "  async run(_event: Readonly<WorkflowEvent<unknown>>, step: WorkflowStep): Promise<unknown> {",
+    "    return step.do('scaffold no-op', async () => ({ status: 'pending_implementation' }));",
+    "  }",
+    "}"
+  ] : [];
   const bootstrapBody = options.tenancy === "household" ? [
     "      const userContext = auth.user && typeof auth.user === 'object' ? (auth.user as unknown as Record<string, unknown>) : {};",
-    "      return json({",
+    "      return rt.json({",
     "        user: auth.user,",
     "        activeContextType: userContext.activeContextType ?? null,",
     "        activeContextId: userContext.activeContextId ?? null,",
@@ -5256,82 +5761,111 @@ function platformWorkerTs(application, options) {
     "        selectedHousehold: userContext.selectedHousehold ?? null,",
     "        household: userContext.selectedHousehold ?? null,",
     "        householdMemberships: userContext.householdMemberships ?? [],",
-    "      }, { status: 200 }, request);"
+    "      }, { status: 200 });"
   ] : [
-    "      return json({",
+    "      return rt.json({",
     "        user: auth.user,",
     "        organization: auth.organization,",
-    "      }, { status: 200 }, request);"
+    "      }, { status: 200 });"
   ];
   return [
-    "import { createTopoloWidgetResponse } from '@topolo/sdk';",
-    "import { verifyRequest } from '@topolo-io/auth-middleware';",
+    "import { createWidgetHandler } from '@topolo-io/widget-server';",
+    "import { createTopoloWorkerRuntime } from '@topolo-io/worker-runtime';",
+    "import { SCAFFOLD_APP_ID, SCAFFOLD_APP_NAME, SCAFFOLD_SERVICE_SLUG, resolveRuntimeServiceId } from './service-identity';",
+    ...options.resources.workflow ? ["import { WorkflowEntrypoint, type WorkflowEvent, type WorkflowStep } from 'cloudflare:workers';"] : [],
     "",
     "export interface Env {",
-    "  AUTH_BASE_URL?: string;",
-    "  SERVICE_ID?: string;",
-    "  TOPOLO_SERVICE_API_KEY?: string;",
+    ...envBindings,
     "}",
     "",
-    "const CLIENT_HEADER = 'topolo-worker-starter';",
+    "// Required by the platform `native-dashboard-widget` requirement \u2014",
+    "// TopoloOne renders this in the user's live workspace whenever the app",
+    "// is installed. Replace the quick-actions placeholder with org-scoped",
+    "// stats once your data model is ready: ctx.user / ctx.orgId / ctx.orgSlug",
+    "// / ctx.isPlatformAdmin / ctx.contextType / ctx.householdId are all",
+    "// pre-resolved. Builder exceptions degrade to empty widgets, not 500s.",
+    "const widgetHandler = createWidgetHandler<Env>({",
+    "  serviceId: SCAFFOLD_SERVICE_SLUG,",
+    `  serviceName: '${escapeSingleQuoted(serviceName)}',`,
+    "  authBaseUrl: (env) => env.AUTH_BASE_URL,",
+    "  serviceApiKey: (env) => env.TOPOLO_SERVICE_API_KEY,",
+    "  build: () => [",
+    "    {",
+    "      type: 'quick-actions',",
+    "      actions: [",
+    `        { id: 'open-workspace', label: '${escapeSingleQuoted(openActionLabel)}', link: '/', primary: true },`,
+    "        { id: 'view-health', label: 'View health', link: '/api/health' },",
+    "      ],",
+    "    },",
+    "  ],",
+    "});",
     "",
-    "export default {",
-    "  async fetch(request: Request, env: Env): Promise<Response> {",
-    "    const url = new URL(request.url);",
+    "const runtime = createTopoloWorkerRuntime<Env>({",
+    "  appName: SCAFFOLD_APP_NAME,",
+    "  serviceSlug: SCAFFOLD_SERVICE_SLUG,",
+    "  resolveServiceId: (env) => resolveRuntimeServiceId(env),",
+    "  authBaseUrl: (env) => env.AUTH_BASE_URL,",
+    "  serviceApiKey: (env) => env.TOPOLO_SERVICE_API_KEY,",
+    "});",
     "",
-    "    if (url.pathname === '/api/health') {",
-    "      return json({ ok: true, service: env.SERVICE_ID ?? DEFAULT_SERVICE_ID }, { status: 200 }, request);",
+    "const handleFetch = runtime.worker(async (request, env, _ctx, rt): Promise<Response> => {",
+    "    const url = rt.url;",
+    "",
+    "    let serviceId: string;",
+    "    try {",
+    "      serviceId = await resolveRuntimeServiceId(env);",
+    "    } catch (error) {",
+    "      return rt.json({ error: 'service_identity_unavailable', message: errorMessage(error) }, { status: 503 });",
     "    }",
     "",
-    "    const auth = await verifyRequest(request, {",
-    "      authBaseUrl: env.AUTH_BASE_URL,",
-    "      serviceId: env.SERVICE_ID ?? DEFAULT_SERVICE_ID,",
-    "      serviceApiKey: env.TOPOLO_SERVICE_API_KEY,",
-    "    });",
+    "    if (url.pathname === '/api/health') {",
+    "      return rt.json({ ok: true, service: serviceId, serviceSlug: SCAFFOLD_SERVICE_SLUG }, { status: 200 });",
+    "    }",
     "",
-    "    if (!auth.ok) {",
-    "      return json({ error: auth.error }, { status: auth.status }, request);",
+    "    if (url.pathname === '/api/service-identity') {",
+    "      return rt.json({",
+    "        appId: SCAFFOLD_APP_ID,",
+    "        appName: SCAFFOLD_APP_NAME,",
+    "        serviceSlug: SCAFFOLD_SERVICE_SLUG,",
+    "        serviceId,",
+    "      }, { status: 200 });",
     "    }",
     "",
-    "    if (url.pathname === '/api/widget') {",
-    "      return json(createTopoloWidgetResponse({",
-    "        serviceId: env.SERVICE_ID ?? DEFAULT_SERVICE_ID,",
-    `        serviceName: '${escapeSingleQuoted(serviceName)}',`,
-    "        widgets: [",
-    "          {",
-    "            type: 'quick-actions',",
-    "            actions: [",
-    `              { id: 'open-workspace', label: '${escapeSingleQuoted(openActionLabel)}', link: '/', primary: true },`,
-    "              { id: 'view-health', label: 'View health', link: '/api/health' },",
-    "            ],",
-    "          },",
-    "        ],",
-    "      }), { status: 200 }, request);",
+    "    // /api/widget delegates fully to @topolo-io/widget-server \u2014 it owns",
+    "    // auth, context parsing, response wrapping, and error degradation.",
+    "    if (url.pathname === '/api/widget') return widgetHandler(request, env);",
+    "",
+    "    const auth = await rt.verifyAuth({ serviceId });",
+    "",
+    "    if (!auth.ok) {",
+    "      return rt.authError(auth);",
     "    }",
     "",
     "    if (url.pathname === '/api/bootstrap') {",
     ...bootstrapBody,
     "    }",
     "",
-    "    return json({ error: 'not_found' }, { status: 404 }, request);",
-    "  },",
-    "};",
+    "    return rt.notFound();",
+    "});",
     "",
-    `const DEFAULT_SERVICE_ID = '${serviceId}';`,
+    "export default {",
+    "  fetch: handleFetch,",
+    "};",
     "",
-    "function json(body: unknown, init: ResponseInit, request: Request): Response {",
-    "  const headers = new Headers(init.headers);",
-    "  headers.set('Content-Type', 'application/json');",
-    "  headers.set('X-Topolo-Client', CLIENT_HEADER);",
-    "  headers.set('X-Topolo-Request-Id', request.headers.get('X-Topolo-Request-Id') ?? crypto.randomUUID());",
-    "  return new Response(JSON.stringify(body), { ...init, headers });",
+    "function errorMessage(error: unknown): string {",
+    "  if (error instanceof Error && error.message) return error.message;",
+    "  return 'Unexpected service identity error.';",
     "}",
+    ...workflowExport,
     ""
   ].join("\n");
 }
 function developerWorkerTs(application) {
   const serviceId = application.serviceId ?? application.id;
+  const serviceName = application.name || "Topolo App";
   return [
+    "import { createWidgetHandler } from '@topolo-io/widget-server';",
+    "",
     "export interface Env {",
     "  AUTH_BASE_URL?: string;",
     "  SERVICE_ID?: string;",
@@ -5339,6 +5873,28 @@ function developerWorkerTs(application) {
     "",
     "const CLIENT_HEADER = 'topolo-developer-starter';",
     `const DEFAULT_SERVICE_ID = '${serviceId}';`,
+    `const SERVICE_NAME = '${escapeSingleQuoted(serviceName)}';`,
+    "",
+    "// Required by the platform `native-dashboard-widget` requirement \u2014",
+    "// TopoloOne renders this in the user's live workspace whenever the app",
+    "// is installed. Replace the quick-actions placeholder with org-scoped",
+    "// stats once your data model is ready: ctx.user / ctx.orgId / ctx.orgSlug",
+    "// / ctx.isPlatformAdmin / ctx.contextType / ctx.householdId are all",
+    "// pre-resolved. Builder exceptions degrade to empty widgets, not 500s.",
+    "const widgetHandler = createWidgetHandler<Env>({",
+    "  serviceId: DEFAULT_SERVICE_ID,",
+    "  serviceName: SERVICE_NAME,",
+    "  authBaseUrl: (env) => env.AUTH_BASE_URL,",
+    "  build: () => [",
+    "    {",
+    "      type: 'quick-actions',",
+    "      actions: [",
+    "        { id: 'open-app', label: `Open ${SERVICE_NAME}`, link: '/', primary: true },",
+    "        { id: 'view-health', label: 'View health', link: '/api/health' },",
+    "      ],",
+    "    },",
+    "  ],",
+    "});",
     "",
     "export default {",
     "  async fetch(request: Request, env: Env): Promise<Response> {",
@@ -5348,6 +5904,9 @@ function developerWorkerTs(application) {
     "      return json({ ok: true, service: env.SERVICE_ID ?? DEFAULT_SERVICE_ID }, { status: 200 }, request);",
     "    }",
     "",
+    "    // /api/widget delegates fully to @topolo-io/widget-server.",
+    "    if (url.pathname === '/api/widget') return widgetHandler(request, env);",
+    "",
     "    const auth = await verifyTopoloRequest(request, env);",
     "    if (!auth.ok) {",
     "      return json({ error: auth.error }, { status: auth.status }, request);",
@@ -5404,8 +5963,108 @@ function developerWorkerTs(application) {
 }
 function cloudcontrolJson(application, options) {
   const slug = toSlug(application.id);
+  const appPath = firstPartyAppPath(application.appDir, options.audience);
   const host = application.productionUrl ? new URL(application.productionUrl).host : `${slug}.topolo.app`;
   const stagingHost = `${slug}.stg.topolo.us`;
+  const serviceSlug = application.serviceSlug ?? `topolo-${slug}`;
+  const resources = resourceConfig(application, options.profile);
+  const resourceBindings = [];
+  if (options.resources.d1) {
+    resourceBindings.push(
+      {
+        resource_type: "d1",
+        binding: resources.d1Binding,
+        environment: "production",
+        account_id: CLOUDFLARE_ACCOUNT_ID,
+        resource_name: resources.d1ProductionName,
+        resource_id: "provision-after-scaffold",
+        migrations_dir: "migrations"
+      },
+      {
+        resource_type: "d1",
+        binding: resources.d1Binding,
+        environment: "staging",
+        account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
+        resource_name: resources.d1StagingName,
+        resource_id: "provision-after-scaffold",
+        migrations_dir: "migrations"
+      }
+    );
+  }
+  if (options.resources.r2) {
+    resourceBindings.push(
+      {
+        resource_type: "r2",
+        binding: resources.r2Binding,
+        environment: "production",
+        account_id: CLOUDFLARE_ACCOUNT_ID,
+        resource_name: resources.r2ProductionName
+      },
+      {
+        resource_type: "r2",
+        binding: resources.r2Binding,
+        environment: "staging",
+        account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
+        resource_name: resources.r2StagingName
+      }
+    );
+  }
+  if (options.resources.queue) {
+    resourceBindings.push(
+      {
+        resource_type: "queue",
+        binding: resources.queueBinding,
+        environment: "production",
+        account_id: CLOUDFLARE_ACCOUNT_ID,
+        resource_name: resources.queueProductionName
+      },
+      {
+        resource_type: "queue",
+        binding: resources.queueBinding,
+        environment: "staging",
+        account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
+        resource_name: resources.queueStagingName
+      }
+    );
+  }
+  if (options.resources.workflow) {
+    resourceBindings.push(
+      {
+        resource_type: "workflow",
+        binding: resources.workflowBinding,
+        environment: "production",
+        account_id: CLOUDFLARE_ACCOUNT_ID,
+        resource_name: resources.workflowProductionName,
+        class_name: resources.workflowClassName
+      },
+      {
+        resource_type: "workflow",
+        binding: resources.workflowBinding,
+        environment: "staging",
+        account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
+        resource_name: resources.workflowStagingName,
+        class_name: resources.workflowClassName
+      }
+    );
+  }
+  if (options.resources.containerProcessing) {
+    resourceBindings.push(
+      {
+        resource_type: "container",
+        environment: "production",
+        account_id: CLOUDFLARE_ACCOUNT_ID,
+        resource_name: resources.containerProductionName,
+        purpose: "processing"
+      },
+      {
+        resource_type: "container",
+        environment: "staging",
+        account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
+        resource_name: resources.containerStagingName,
+        purpose: "processing"
+      }
+    );
+  }
   const deployTargets = options.api ? [
     {
       kind: "worker",
@@ -5420,7 +6079,7 @@ function cloudcontrolJson(application, options) {
       domains: [host],
       routes: [host],
       api_url: application.productionUrl,
-      service_id: application.serviceId
+      service_slug: serviceSlug
     },
     {
       kind: "worker",
@@ -5430,12 +6089,12 @@ function cloudcontrolJson(application, options) {
       config_path: "wrangler.toml",
       build_command: "VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us npm run build",
       output_dir: "dist",
-      production_branch: "staging",
+      production_branch: "main",
       healthcheck_path: "/api/health",
       domains: [stagingHost],
       routes: [stagingHost],
       api_url: `https://${stagingHost}`,
-      service_id: application.serviceId
+      service_slug: serviceSlug
     }
   ] : [
     {
@@ -5455,14 +6114,14 @@ function cloudcontrolJson(application, options) {
   ];
   return `${json({
     name: `topolo-${slug}`,
-    description: `Canonical documentation for ${toTitle(application.name)} lives in PlatformApplications/TopoloDocs.`,
+    description: `Canonical documentation for ${toTitle(application.name)} lives in Apps/system/TopoloDocs.`,
     deploy_method: options.api ? "wrangler" : "cloudflare_pages",
     ci_provider: "github_actions",
     repo_identity: {
       provider: "github",
       owner: "Topolo-io",
-      repo: `topolo-${slug}`,
-      remote_url: `git@github.com:Topolo-io/topolo-${slug}.git`,
+      repo: application.appDir,
+      remote_url: `git@github.com:Topolo-io/${application.appDir}.git`,
       default_branch: "main"
     },
     environments: application.productionUrl ? [
@@ -5475,12 +6134,12 @@ function cloudcontrolJson(application, options) {
       {
         name: "staging",
         url: `https://${stagingHost}`,
-        branch: "staging",
+        branch: "main",
         status: "unknown"
       }
     ] : [],
     deploy_targets: deployTargets,
-    resource_bindings: [],
+    resource_bindings: resourceBindings,
     ci_workflows: [
       {
         provider: "github_actions",
@@ -5490,8 +6149,25 @@ function cloudcontrolJson(application, options) {
         required: true
       }
     ],
-    ci_targets: [],
-    tags: ["application", "cloudflare", "typescript"],
+    ci_targets: [
+      {
+        name: "typecheck",
+        command: "npm run typecheck",
+        required: true
+      },
+      {
+        name: "test",
+        command: "npm run test",
+        required: true
+      },
+      {
+        name: "build",
+        command: "npm run build",
+        required: true
+      }
+    ],
+    tags: ["application", "cloudflare", "typescript", ...hasScaffoldResources(options.resources) ? ["resource-backed"] : []],
+    source_paths: [appPath],
     cloudflare_account_id: CLOUDFLARE_ACCOUNT_ID
   })}
 `;
@@ -5500,7 +6176,9 @@ function systemJson(application, options) {
   const slug = toSlug(application.id);
   const suiteLabel = options.audience === "personal" ? "personal" : "platform";
   const summaryLabel = options.audience === "personal" ? "first-party Topolo personal application" : "first-party Topolo platform application";
-  const apiNotes = options.api ? options.tenancy === "household" ? "Protected Worker routes validate Topolo Auth credentials and derive active personal context plus selected household context from the credential. The browser baseline starts on shared landing and login routes, completes auth on /auth/callback, and dedupes React when linked Topolo packages are installed locally." : "Protected Worker routes validate Topolo Auth credentials and derive organization context from the credential. The browser baseline starts on shared landing and login routes, completes auth on /auth/callback, and dedupes React when linked Topolo packages are installed locally." : "Browser-only application surface using shared Topolo Auth landing/login/callback routes, shared shell packages, and React runtime dedupe.";
+  const appPath = firstPartyAppPath(application.appDir, options.audience);
+  const resourceNotes = hasScaffoldResources(options.resources) ? " Generated resource bindings are declared in Wrangler and CloudControl for durable platform-owned state and processing." : "";
+  const apiNotes = options.api ? options.tenancy === "household" ? `Protected Worker routes validate Topolo Auth credentials and derive active personal context plus selected household context from the credential. The browser baseline starts on shared landing and login routes, completes auth on /auth/callback, and dedupes React when linked Topolo packages are installed locally.${resourceNotes}` : `Protected Worker routes validate Topolo Auth credentials and derive organization context from the credential. The browser baseline starts on shared landing and login routes, completes auth on /auth/callback, and dedupes React when linked Topolo packages are installed locally.${resourceNotes}` : "Browser-only application surface using shared Topolo Auth landing/login/callback routes, shared shell packages, and React runtime dedupe.";
   const sensitiveData = options.tenancy === "household" ? ["identity", "personal_data", "household_data"] : ["identity", "org_data"];
   const privacySensitiveData = options.tenancy === "household" ? ["identity", "personal", "household"] : ["identity", "organization"];
   return `${json({
@@ -5512,19 +6190,19 @@ function systemJson(application, options) {
     lifecycle: "inventory",
     last_verified: CURRENT_VERIFICATION_DATE,
     owners: ["platform-engineering"],
-    repo_paths: [`PlatformApplications/${application.appDir}`],
+    repo_paths: [appPath],
     service_ids: options.api && application.serviceId ? [application.serviceId] : [],
     visibility: "internal",
     api_contract: {
       type: options.api ? "curated" : "none",
-      source: options.api ? `PlatformApplications/${application.appDir}/src/worker.ts` : `PlatformApplications/${application.appDir}/src/App.tsx`,
+      source: options.api ? `${appPath}/src/worker.ts` : `${appPath}/src/App.tsx`,
       notes: apiNotes
     },
     primary_hosts: application.productionUrl ? [application.productionUrl] : [],
     doc_paths: [`internal/apps/${slug}`, `public/applications/${slug}`],
     security_assurance: {
       risk_tier: "internal",
-      auth_boundary: "Topolo Auth through @topolo-io/auth-client for browser sessions and @topolo-io/auth-middleware for Worker requests.",
+      auth_boundary: "Topolo Auth through @topolo-io/auth-client for browser sessions and @topolo-io/worker-runtime for Worker requests.",
       tenant_isolation: options.tenancy === "household" ? "household_scoped" : "organization_scoped",
       external_inputs: ["browser", ...options.api ? ["api"] : []],
       sensitive_data: sensitiveData,
@@ -5536,7 +6214,13 @@ function systemJson(application, options) {
     data_privacy: {
       classification: "confidential",
       sensitive_data_classes: privacySensitiveData,
-      storage_locations: ["source_control"],
+      storage_locations: [
+        "source_control",
+        ...options.resources.d1 ? ["d1"] : [],
+        ...options.resources.r2 ? ["r2"] : [],
+        ...options.resources.queue ? ["queue"] : [],
+        ...options.resources.workflow ? ["workflow"] : []
+      ],
       encryption_at_rest: "platform_managed",
       encryption_in_transit: "https_only",
       key_management: "cloudflare_managed",
@@ -5554,11 +6238,24 @@ function systemJson(application, options) {
 }
 function internalDocs(application, options) {
   const slug = toSlug(application.id);
+  const serviceSlug = application.serviceSlug ?? `topolo-${slug}`;
   const title = toTitle(application.name);
+  const appPath = firstPartyAppPath(application.appDir, options.audience);
   const suiteLabel = options.audience === "personal" ? "personal" : "platform";
   const tenantLabel = options.tenancy === "household" ? "household" : "organization";
   const apiContextLabel = options.tenancy === "household" ? "active personal context and selected household context" : "organization context";
   const boundaryFailureText = options.tenancy === "household" ? "Domain data is added without a household-scoped backend boundary." : "Domain data is added without an organization-scoped backend boundary.";
+  const resource = resourceConfig(application, options.profile);
+  const resourceLines = hasScaffoldResources(options.resources) ? [
+    "",
+    "## Resource Bindings",
+    "",
+    ...options.resources.d1 ? [`- D1 binding \`${resource.d1Binding}\` for durable metadata.`] : [],
+    ...options.resources.r2 ? [`- R2 binding \`${resource.r2Binding}\` for object assets.`] : [],
+    ...options.resources.queue ? [`- Queue binding \`${resource.queueBinding}\` for asynchronous work intake.`] : [],
+    ...options.resources.workflow ? [`- Workflow binding \`${resource.workflowBinding}\` for import or processing orchestration.`] : [],
+    ...options.resources.containerProcessing ? ["- Container processing metadata is declared in CloudControl for CPU/file-heavy jobs."] : []
+  ] : [];
   return [
     "---",
     `title: "${escapeFrontmatter(title)} Handbook"`,
@@ -5567,8 +6264,8 @@ function internalDocs(application, options) {
     'status: "draft"',
     `last_verified: "${CURRENT_VERIFICATION_DATE}"`,
     "source_repos:",
-    `  - "PlatformApplications/${application.appDir}"`,
-    '  - "PlatformApplications/TopoloDocs"',
+    `  - "${appPath}"`,
+    '  - "Apps/system/TopoloDocs"',
     'audience: "internal"',
     "tags:",
     `  - "${slug}"`,
@@ -5588,16 +6285,18 @@ function internalDocs(application, options) {
     "## Architecture",
     "",
     "The generated browser surface uses `@topolo-io/ui-kit` for the shared landing page, shared login page, auth callback state, and shared signed shell. `vite.config.ts` includes the standard React plugin plus React runtime dedupe so linked Topolo packages resolve a single browser React runtime.",
+    options.api ? `The generated app centralizes service identity in \`${appPath}/src/service-identity.ts\`. Runtime code reads the provisioned Auth service id from the Worker \`SERVICE_ID\` binding and exposes it to the browser through the same-origin service-identity route.` : `The generated app centralizes browser service identity in \`${appPath}/src/service-identity.ts\` and reads Auth identity from the app runtime instead of calling Auth for slug lookups.`,
     "",
     "## Runtime Surfaces",
     "",
-    `- \`PlatformApplications/${application.appDir}/src/App.tsx\``,
+    `- \`${appPath}/src/App.tsx\``,
+    `- \`${appPath}/src/service-identity.ts\``,
     "- public landing route: `/`",
     "- public sign-in route: `/login`",
     "- auth callback route: `/auth/callback`",
-    ...options.api ? [`- \`PlatformApplications/${application.appDir}/src/worker.ts\``] : [],
-    `- \`PlatformApplications/${application.appDir}/topolo.cloudcontrol.json\``,
-    ...options.api && application.serviceId ? [`- \`PlatformApplications/TopoloAuth/catalog/service-manifests/${application.serviceId}.json\``] : [],
+    ...options.api ? [`- \`${appPath}/src/worker.ts\``] : [],
+    `- \`${appPath}/topolo.cloudcontrol.json\``,
+    ...options.api && application.serviceId ? [`- \`Apps/system/TopoloAuth/catalog/service-manifests/${application.serviceId}.json\``] : [],
     "",
     "## API Reference",
     "",
@@ -5605,11 +6304,12 @@ function internalDocs(application, options) {
     "",
     "## Auth and Permissions",
     "",
-    options.api ? `Browser sessions and Worker requests must be validated through Topolo Auth under service id \`${application.serviceId}\`. Worker routes derive ${apiContextLabel} from the verified credential.` : "Browser sessions must be established through Topolo Auth and rendered inside the shared Topolo shell.",
+    options.api ? `Browser sessions and Worker requests must be validated through Topolo Auth with the provisioned \`SERVICE_ID\` for \`${serviceSlug}\`. Worker routes derive ${apiContextLabel} from the verified credential.` : "Browser sessions must be established through Topolo Auth and rendered inside the shared Topolo shell.",
     "",
     "## Data Ownership",
     "",
     `The generated scaffold stores no durable application data yet. Future domain tables, Durable Objects, queues, KV namespaces, R2 buckets, and external provider records must be scoped to the authenticated ${tenantLabel} context at the backend boundary.`,
+    ...resourceLines,
     "",
     "## Deployments",
     "",
@@ -5617,7 +6317,7 @@ function internalDocs(application, options) {
     "",
     "## Failure Modes",
     "",
-    "- Developers provisioning drifts from the generated Worker `SERVICE_ID`.",
+    `- the Worker \`SERVICE_ID\` binding drifts from the Auth service manifest for \`${serviceSlug}\`.`,
     "- CloudControl metadata does not match the eventual Cloudflare project or route.",
     "- linked Topolo packages resolve a second React runtime and the browser shell renders blank instead of mounting the shared surfaces.",
     `- ${boundaryFailureText}`,
@@ -5625,9 +6325,9 @@ function internalDocs(application, options) {
     "## Debugging",
     "",
     "- run `npm run typecheck` and `npm run build` in the application directory",
-    "- run `topolo apps audit <app> --local --repo-root /Users/ashes/Projects/topolo --fail-on needs_review --json` after SDK catalog registration",
+    "- run `topolo apps audit <app> --local --repo-root /Users/ashes/Projects/Topolo/Platform --fail-on needs_review --json` after SDK catalog registration",
     "- inspect `topolo.cloudcontrol.json` before deployment changes",
-    ...options.api && application.serviceId ? [`- inspect \`PlatformApplications/TopoloAuth/catalog/service-manifests/${application.serviceId}.json\` when permission grants fail`] : [],
+    ...options.api ? ["- inspect the Worker `SERVICE_ID` binding and matching Auth service manifest when permission grants fail"] : [],
     ...options.api && application.serviceId ? [`- re-run \`topolo platform apps scaffold ${slug} --write --provision\` when embedded app login, launcher visibility, or callback origins drift`] : [],
     "",
     "## Change Log / Verification",
@@ -5641,7 +6341,9 @@ function internalDocs(application, options) {
 }
 function publicDocs(application, options) {
   const slug = toSlug(application.id);
+  const serviceSlug = application.serviceSlug ?? `topolo-${slug}`;
   const title = toTitle(application.name);
+  const appPath = firstPartyAppPath(application.appDir, options.audience);
   const suiteLabel = options.audience === "personal" ? "personal" : "business";
   const tenantLabel = options.tenancy === "household" ? "household" : "organization";
   const apiRouteLabel = options.tenancy === "household" ? "authenticated personal and household routes" : "authenticated workspace routes";
@@ -5654,7 +6356,7 @@ function publicDocs(application, options) {
     'status: "draft"',
     `last_verified: "${CURRENT_VERIFICATION_DATE}"`,
     "source_repos:",
-    `  - "PlatformApplications/${application.appDir}"`,
+    `  - "${appPath}"`,
     'audience: "public"',
     "tags:",
     `  - "${slug}"`,
@@ -5685,11 +6387,11 @@ function publicDocs(application, options) {
     "",
     "## Auth and Permissions",
     "",
-    options.api && application.serviceId ? `Signed browser and API requests use Topolo Auth through service id \`${application.serviceId}\`.` : "Signed browser requests use Topolo Auth and the shared Topolo shell.",
+    options.api ? `Signed browser and API requests use Topolo Auth through the \`${serviceSlug}\` service slug, resolving the concrete environment-specific service id at runtime.` : "Signed browser requests use Topolo Auth and the shared Topolo shell.",
     "",
     "## Data Ownership",
     "",
-    `The generated baseline has no durable domain data yet. Future data must be ${tenantLabel}-scoped at the backend boundary.`,
+    hasScaffoldResources(options.resources) ? `Generated resource bindings are ready for ${tenantLabel}-scoped durable data and assets; product code must still enforce that boundary.` : `The generated baseline has no durable domain data yet. Future data must be ${tenantLabel}-scoped at the backend boundary.`,
     "",
     "## Deployments",
     "",
@@ -5714,16 +6416,20 @@ function publicDocs(application, options) {
 function serviceManifestJson(application, options) {
   const slug = toSlug(application.id);
   const title = toTitle(application.name);
+  const appPath = firstPartyAppPath(application.appDir, options.audience);
   const permissionPrefix = application.id.replace(/[^a-z0-9_]/g, "_");
   const resourceLabel = options.tenancy === "household" ? "household" : "workspace";
-  const launcherSettings = options.tenancy === "household" ? {
+  const launcherSettings = {
     settings: {
       launcher: {
-        supported_contexts: ["personal"],
-        household_capable: true
+        category: "first_party",
+        source: "first_party",
+        app_id: slug,
+        supported_contexts: options.tenancy === "household" ? ["personal"] : ["organization"],
+        ...options.tenancy === "household" ? { household_capable: true } : {}
       }
     }
-  } : {};
+  };
   return `${json({
     serviceId: application.serviceId,
     ...launcherSettings,
@@ -5731,7 +6437,7 @@ function serviceManifestJson(application, options) {
       {
         systemId: `topolo-${slug}`,
         name: title,
-        repoPaths: [`PlatformApplications/${application.appDir}`],
+        repoPaths: [appPath],
         docPaths: [`applications/${slug}`, `internal/apps/${slug}`]
       }
     ],
@@ -5773,6 +6479,10 @@ function serviceManifestJson(application, options) {
 `;
 }
 function developerManifest(application, options) {
+  const callbackPath = "/auth/callback";
+  const localCallbackUrl = "http://localhost:5173/auth/callback";
+  const productionCallbackUrl = application.productionUrl ? `${application.productionUrl.replace(/\/$/, "")}${callbackPath}` : null;
+  const requestedScopes = options.api ? ["openid", "profile", "email", "organization:read", "entitlements:read", `${application.id}:read`] : ["openid", "profile", "email", "organization:read"];
   return `${json({
     schema: "https://topolo.app/schemas/topolo-app-manifest.v1.json",
     id: application.id,
@@ -5785,17 +6495,49 @@ function developerManifest(application, options) {
     container_app_id: options.containerAppId,
     package_name: application.packageName,
     service_id: options.api ? application.serviceId : null,
+    capabilities: {
+      selected: options.capabilities,
+      supported_v1: [
+        "login",
+        "launcher",
+        "marketplace",
+        "api",
+        "widget",
+        "billing",
+        "nexus_ai",
+        "agent_access",
+        "hosting"
+      ]
+    },
     auth: {
       provider: "topolo",
       flow: "authorization_code_pkce",
-      callback_path: "/auth/callback",
-      local_callback_url: "http://localhost:5173/auth/callback",
-      production_callback_url: application.productionUrl ? `${application.productionUrl.replace(/\/$/, "")}/auth/callback` : null,
-      requested_scopes: options.api ? ["identity:read", "organization:read", `${application.id}:read`] : ["identity:read", "organization:read"]
+      callback_path: callbackPath,
+      callback_urls: [localCallbackUrl, productionCallbackUrl].filter(Boolean),
+      local_callback_url: localCallbackUrl,
+      production_callback_url: productionCallbackUrl,
+      requested_scopes: requestedScopes,
+      account_linking: {
+        required_columns: [
+          "local_user_id",
+          "topolo_user_id",
+          "topolo_org_id",
+          "topolo_context_id",
+          "topolo_service_id",
+          "connected_at",
+          "last_seen_at"
+        ],
+        email_match_policy: "confirm_or_current_session_only"
+      }
     },
     runtime: {
+      strategy: "external",
       browser: true,
-      api: options.api
+      api: options.api,
+      health_endpoint: options.api ? "/api/health" : null
+    },
+    marketplace: {
+      intent: options.distributionModel === "marketplace" ? "submit_when_ready" : "not_requested"
     }
   })}
 `;
@@ -5803,10 +6545,10 @@ function developerManifest(application, options) {
 function envExample(application) {
   return [
     "VITE_TOPOLO_AUTH_URL=https://auth.topolo.app",
+    "VITE_TOPOLO_AUTH_BASE_URL=https://auth.topolo.app",
     "VITE_TOPOLO_CLIENT_ID=",
     "VITE_TOPOLO_REDIRECT_URI=http://localhost:5173/auth/callback",
-    "VITE_TOPOLO_SCOPES=identity:read organization:read",
-    `VITE_TOPOLO_SERVICE_ID=${application.serviceId ?? application.id}`,
+    "VITE_TOPOLO_SCOPES=openid profile email organization:read entitlements:read",
     ""
   ].join("\n");
 }
@@ -5851,6 +6593,21 @@ function normalizeSurfaceModel(value) {
     "Invalid scaffold surface model. Use web_app, mobile_container, mobile_module, or messaging_surface."
   );
 }
+function normalizeScaffoldProfile(value) {
+  if (!value) return null;
+  if (value === "spatial-assets") return value;
+  throw new Error("Invalid scaffold profile. Use spatial-assets.");
+}
+function resolveScaffoldResources(profile, options) {
+  const profileResources = profile === "spatial-assets" ? { d1: true, r2: true, queue: true, workflow: true, containerProcessing: true } : { d1: false, r2: false, queue: false, workflow: false, containerProcessing: false };
+  return {
+    d1: Boolean(profileResources.d1 || options.withD1),
+    r2: Boolean(profileResources.r2 || options.withR2),
+    queue: Boolean(profileResources.queue || options.withQueue),
+    workflow: Boolean(profileResources.workflow || options.withWorkflow),
+    containerProcessing: Boolean(profileResources.containerProcessing || options.withContainerProcessing)
+  };
+}
 function normalizeContainerAppId(value, surfaceModel) {
   const trimmed = String(value || "").trim();
   if (surfaceModel === "mobile_module") {
@@ -5887,7 +6644,8 @@ function toSlug(value) {
   return value.replace(/_/g, "-");
 }
 function toPascalCase(value) {
-  return value.split(/[-_]/).filter(Boolean).map((part) => part.slice(0, 1).toUpperCase() + part.slice(1)).join("");
+  const acronyms = /* @__PURE__ */ new Set(["api", "cli", "crm", "mcp", "mdm", "p2p"]);
+  return value.split(/[-_]/).filter(Boolean).map((part) => acronyms.has(part.toLowerCase()) ? part.toUpperCase() : part.slice(0, 1).toUpperCase() + part.slice(1)).join("");
 }
 function toTitle(value) {
   return value.replace(/^topolo[-_\s]*/i, "Topolo ").split(/[-_\s]+/).filter(Boolean).map((part) => part.slice(0, 1).toUpperCase() + part.slice(1)).join(" ");
@@ -5925,7 +6683,30 @@ function escapeFrontmatter(value) {
 }
 
 // src/commands/app-scaffold-provision.ts
-var DEVELOPERS_SERVICE_ID = "svc_topolo_developers";
+import { readFile as readFile2, writeFile as writeFile3 } from "fs/promises";
+var DEVELOPERS_SERVICE_SLUG = "topolo-developers";
+var SERVICE_ID_PLACEHOLDER_RE = /TODO|FILL[_-]?IN|PLACEHOLDER|CHANGE[_-]?ME|XXX/i;
+function assertProvisioningPayloadComplete(payload) {
+  const app = payload.application;
+  const missing = [];
+  if (!app.name?.trim()) missing.push("name");
+  if (!app.serviceSlug?.trim()) missing.push("serviceSlug");
+  if (!payload.audience) missing.push("audience");
+  if (!payload.tenancy) missing.push("tenancy");
+  if (!payload.surfaceModel) missing.push("surfaceModel");
+  if (!payload.ownerType) missing.push("ownerType");
+  if (missing.length > 0) {
+    throw new Error(
+      `Scaffold provisioning is missing required fields: ${missing.join(", ")}. An app must meet the minimum standard before it can be projected into the platform.`
+    );
+  }
+  const serviceId = app.serviceId?.trim();
+  if (serviceId && SERVICE_ID_PLACEHOLDER_RE.test(serviceId)) {
+    throw new Error(
+      `Refusing to provision with a placeholder service id (${serviceId}). Remove the placeholder and let provisioning mint/assign the canonical srv_ id.`
+    );
+  }
+}
 async function provisionApplicationScaffold(payload) {
   if (!payload.application.productionUrl) {
     throw new Error(
@@ -5937,6 +6718,7 @@ async function provisionApplicationScaffold(payload) {
       "Platform scaffold provisioning requires a service id. Re-run without --no-api or pass --service."
     );
   }
+  assertProvisioningPayloadComplete(payload);
   const environment = selectedEnvironment();
   const credential = await refreshCredentialIfNeeded(environment);
   if (!credential) {
@@ -5953,12 +6735,20 @@ async function provisionApplicationScaffold(payload) {
   const identity = await client.client.introspect();
   const config = await readConfig();
   const profile = resolvedProfileConfig(config, environment);
+  const authOrigin = sanitizeOrigin(profile.serviceUrls?.auth ?? defaultAuthOrigin(environment));
+  assertServiceUrlForEnvironment("auth", authOrigin, environment);
   const developersOrigin = sanitizeOrigin(profile.serviceUrls?.developers ?? "https://developers.topolo.app");
   assertServiceUrlForEnvironment("developers", developersOrigin, environment);
+  const developersServiceId = await resolveServiceIdBySlug(authOrigin, DEVELOPERS_SERVICE_SLUG);
+  if (!developersServiceId) {
+    throw new Error(
+      `Could not resolve Developers service id from Auth slug ${DEVELOPERS_SERVICE_SLUG}.`
+    );
+  }
   const endpoint = payload.target === "platform" ? "/api/developer-console/admin/first-party-app-scaffolds" : "/api/developer-console/apps/scaffold";
   const headers = new Headers({
     "Content-Type": "application/json",
-    "X-Service-ID": DEVELOPERS_SERVICE_ID,
+    "X-Service-ID": developersServiceId,
     "X-Topolo-Client": `topolo-cli/${CLI_VERSION}`
   });
   const agentName = resolveAgentName(profile.agentName);
@@ -6030,11 +6820,21 @@ function buildProvisioningRequest(payload) {
     surfaceModel: payload.surfaceModel,
     containerAppId: payload.containerAppId,
     distributionModel: payload.distributionModel,
+    capabilities: payload.capabilities,
+    callbackUrls: [
+      "http://localhost:5173/auth/callback",
+      payload.application.productionUrl ? `${payload.application.productionUrl.replace(/\/$/, "")}/auth/callback` : null
+    ].filter(Boolean),
+    healthEndpoint: payload.application.productionUrl ? `${payload.application.productionUrl.replace(/\/$/, "")}/api/health` : null,
+    runtimeStrategy: "external",
+    requestedScopes: payload.application.serviceId ? ["openid", "profile", "email", "organization:read", "entitlements:read", `${payload.application.id}:read`] : ["openid", "profile", "email", "organization:read"],
+    marketplaceIntent: payload.distributionModel === "marketplace" ? "submit_when_ready" : "not_requested",
     applicationId: payload.application.id,
     appDir: payload.application.appDir,
     packageName: payload.application.packageName,
     name: payload.application.name,
     productionUrl: payload.application.productionUrl,
+    serviceSlug: payload.application.serviceSlug,
     serviceId: payload.application.serviceId
   };
 }
@@ -6051,6 +6851,19 @@ function resolveProvisioningError(envelope, status, target) {
 function sanitizeOrigin(value) {
   return value.replace(/\/+$/, "");
 }
+function defaultAuthOrigin(environment) {
+  return environment === "staging" ? "https://auth.stg.topolo.us" : "https://auth.topolo.app";
+}
+async function resolveServiceIdBySlug(authOrigin, slug) {
+  const response = await fetch(
+    `${authOrigin}/api/services/by-slug/${encodeURIComponent(slug)}`,
+    { headers: { Accept: "application/json" } }
+  ).catch(() => null);
+  if (!response?.ok) return null;
+  const payload = await response.json().catch(() => null);
+  const serviceId = payload?.data?.service_id;
+  return typeof serviceId === "string" && serviceId.trim() ? serviceId.trim() : null;
+}
 function pickRecord(value) {
   return value && typeof value === "object" ? value : null;
 }
@@ -6147,7 +6960,7 @@ function registerAppsCommand(program2) {
     "Developer app surface model: web_app, mobile_container, mobile_module, or messaging_surface"
   ).option("--container-app-id <appId>", "Container app id when --surface-model mobile_module is used").option("--write", "Write the generated scaffold files to disk").option("--repo-root <path>", "Directory where scaffold files should be written").option("--force", "Overwrite existing scaffold files when --write is set").option("--with-api", "Include API/service files for developer scaffolds").option("--no-api", "Do not include API/service requirements").option("--no-browser", "Do not include browser-shell requirements").option(
     "--provision",
-    "Provision the generated app into the current Topolo developer workspace using the authenticated session"
+    "Register the app in the current Topolo developer workspace using the authenticated session"
   ).action(async (application, opts) => {
     const mode = opts.json === false || process.argv.includes("--no-json") ? "pretty" : resolveOutputMode(opts.json);
     try {
@@ -6166,9 +6979,6 @@ function registerAppsCommand(program2) {
         surfaceModel: resolveScaffoldSurfaceModel(opts.surfaceModel),
         containerAppId: opts.containerAppId
       });
-      if (opts.provision && !opts.write) {
-        throw new Error("--provision requires --write so remote developer records match written scaffold files.");
-      }
       const writeResult = opts.write ? await writeApplicationScaffold(payload, { repoRoot: opts.repoRoot, force: opts.force }) : null;
       const provisionResult = opts.provision ? await provisionApplicationScaffold(payload) : null;
       const output = {
@@ -6534,7 +7344,7 @@ function registerPlatformCommand(program2) {
   ).option("--json", "Output JSON").option("--no-json", "Output human-readable checklist").option("--app-dir <path>", "Application directory under PlatformApplications").option("--name <name>", "Application display/package source name").option("--package-name <name>", "package.json name").option("--production-url <url>", "Production browser URL").option("--service <id>", "Stable SDK/Auth service id for API-backed apps").option("--portfolio <portfolio>", "First-party portfolio: platform or personal").option(
     "--surface-model <surfaceModel>",
     "First-party surface model: web_app, mobile_container, mobile_module, or messaging_surface"
-  ).option("--container-app-id <appId>", "Container app id when --surface-model mobile_module is used").option("--write", "Write the generated scaffold files to disk").option("--repo-root <path>", "Directory where scaffold files should be written").option("--force", "Overwrite existing scaffold files when --write is set").option("--with-api", "Include the API/service baseline").option("--no-api", "Do not include API/service requirements").option("--no-browser", "Do not include browser-shell requirements").option(
+  ).option("--container-app-id <appId>", "Container app id when --surface-model mobile_module is used").option("--profile <profile>", "First-party scaffold profile such as spatial-assets").option("--with-d1", "Declare a D1 binding in the first-party scaffold").option("--with-r2", "Declare an R2 binding in the first-party scaffold").option("--with-queue", "Declare a Queue binding in the first-party scaffold").option("--with-workflow", "Declare a Workflow binding in the first-party scaffold").option("--with-container-processing", "Declare container-processing metadata in CloudControl").option("--write", "Write the generated scaffold files to disk").option("--repo-root <path>", "Directory where scaffold files should be written").option("--force", "Overwrite existing scaffold files when --write is set").option("--with-api", "Include the API/service baseline").option("--no-api", "Do not include API/service requirements").option("--no-browser", "Do not include browser-shell requirements").option(
     "--provision",
     "Provision the generated first-party app into Topolo Developers and Auth using the authenticated Topolo admin session"
   ).option(
@@ -6543,10 +7353,14 @@ function registerPlatformCommand(program2) {
   ).option("--workflow-only", "Output only the generated GitHub Actions workflow in human mode").action(async (application, opts) => {
     const mode = opts.json === false || process.argv.includes("--no-json") ? "pretty" : resolveOutputMode(opts.json);
     try {
-      await requirePlatformAdminSession();
       if (opts.workflowOnly && opts.write) {
         throw new Error("--workflow-only cannot be used with --write.");
       }
+      const provisionRequested = process.argv.includes("--provision");
+      const shouldProvision = Boolean(opts.write) && opts.provision !== false;
+      if (shouldProvision) {
+        await requirePlatformAdminSession();
+      }
       const api = resolveScaffoldApiOption(opts.api, opts.withApi);
       const payload = applicationScaffoldPayload(application, {
         appDir: opts.appDir,
@@ -6559,13 +7373,17 @@ function registerPlatformCommand(program2) {
         target: "platform",
         portfolio: resolvePlatformPortfolio(opts.portfolio),
         surfaceModel: resolvePlatformSurfaceModel(opts.surfaceModel),
-        containerAppId: opts.containerAppId
+        containerAppId: opts.containerAppId,
+        profile: opts.profile,
+        withD1: opts.withD1,
+        withR2: opts.withR2,
+        withQueue: opts.withQueue,
+        withWorkflow: opts.withWorkflow,
+        withContainerProcessing: opts.withContainerProcessing
       });
       if (opts.workflowOnly && !payload.ciWorkflow) {
         throw new Error("--workflow-only is only available for first-party scaffolds.");
       }
-      const provisionRequested = process.argv.includes("--provision");
-      const shouldProvision = Boolean(opts.write) && opts.provision !== false;
       if (provisionRequested && !opts.write) {
         throw new Error("--provision requires --write so remote first-party records match written scaffold files.");
       }
@@ -6698,6 +7516,14 @@ function isPlatformAdminIdentity(identity) {
   const orgSlug = String(identity?.organization?.slug || "").trim().toLowerCase();
   return orgSlug === "admin" && (role === "platform_super_admin" || role === "platform_admin");
 }
+function isTopoloWorkspaceAdminIdentity(identity) {
+  const role = String(identity?.user?.role || "").trim().toLowerCase();
+  const orgSlug = String(identity?.organization?.slug || "").trim().toLowerCase();
+  return orgSlug === "topolo" && (role === "owner" || role === "admin" || role === "super_admin");
+}
+function canProvisionFirstPartyScaffoldIdentity(identity) {
+  return isPlatformAdminIdentity(identity) || isTopoloWorkspaceAdminIdentity(identity);
+}
 async function requirePlatformAdminSession() {
   const client = await buildClient();
   if (!client) {
@@ -6706,9 +7532,9 @@ async function requirePlatformAdminSession() {
     );
   }
   const identity = await client.client.introspect();
-  if (!isPlatformAdminIdentity(identity)) {
+  if (!canProvisionFirstPartyScaffoldIdentity(identity)) {
     throw new Error(
-      "`topolo platform ...` is restricted to Topolo platform admins in the Auth `admin` organization."
+      "`topolo platform ...` is restricted to Topolo platform admins in the Auth `admin` organization or owner/admin users in the Topolo developer workspace."
     );
   }
 }
@@ -6975,6 +7801,282 @@ function formatManifestsTable(manifests) {
   return lines.join("\n");
 }
 
+// src/commands/oauth.ts
+function registerOAuthCommands(program2) {
+  const oauth = program2.command("oauth").description("Manage Topolo OAuth resources.");
+  const clients = oauth.command("clients").description("Manage Login with Topolo OAuth clients.");
+  clients.command("list").description("List OAuth clients owned by the authenticated developer organization.").option("--json", "Emit JSON output").action(async (options) => {
+    const mode = resolveOutputMode(options.json);
+    try {
+      const payload = await authFetchJson("/api/developer-oauth/clients");
+      emit(payload, mode, () => {
+        const clients2 = Array.isArray(payload.data?.clients) ? payload.data.clients : [];
+        if (clients2.length === 0) return "No OAuth clients found.";
+        return clients2.map((client) => `${client.client_id}	${client.name}	${client.status}`).join("\n");
+      });
+    } catch (err) {
+      fail(err, mode);
+    }
+  });
+  clients.command("create").description("Create a Login with Topolo OAuth client.").requiredOption("--name <name>", "Client display name").requiredOption("--developer-id <id>", "Topolo developer id that owns this client").option("--developer-app-id <id>", "Developer app id to associate with this client").option("--description <description>", "Client description").option("--redirect-uri <uri...>", "Allowed callback URI. Repeat or pass a space-separated list.").option("--scope <scope...>", "Allowed scope. Defaults to openid profile email.").option("--public", "Create a public PKCE client instead of a confidential client").option("--homepage-url <url>", "Client homepage URL").option("--logo-url <url>", "Client logo URL").option("--json", "Emit JSON output").action(async (options) => {
+    const mode = resolveOutputMode(options.json);
+    try {
+      const payload = createOAuthClientPayload(options);
+      const response = await authFetchJson("/api/developer-oauth/clients", {
+        method: "POST",
+        body: JSON.stringify(payload)
+      });
+      emit(response, mode, () => {
+        const client = response.data?.client;
+        const secret = response.data?.client_secret;
+        return [
+          `Created OAuth client ${client?.client_id ?? ""}`,
+          secret ? `Client secret: ${secret}` : "Public client: no secret issued"
+        ].join("\n");
+      });
+    } catch (err) {
+      fail(err, mode);
+    }
+  });
+  clients.command("revoke").description("Revoke an OAuth client for all users.").argument("<id>", "OAuth client record id, for example oac_...").option("--json", "Emit JSON output").action(async (id, options) => {
+    const mode = resolveOutputMode(options.json);
+    try {
+      const payload = await authFetchJson(`/api/developer-oauth/clients/${encodeURIComponent(id)}`, {
+        method: "DELETE"
+      });
+      emit(payload, mode, () => `Revoked OAuth client ${id}`);
+    } catch (err) {
+      fail(err, mode);
+    }
+  });
+  clients.command("rotate-secret").description("Rotate a confidential OAuth client secret.").argument("<id>", "OAuth client record id, for example oac_...").option("--json", "Emit JSON output").action(async (id, options) => {
+    const mode = resolveOutputMode(options.json);
+    try {
+      const payload = await authFetchJson(`/api/developer-oauth/clients/${encodeURIComponent(id)}/rotate-secret`, {
+        method: "POST"
+      });
+      emit(payload, mode, () => `New client secret: ${payload.data?.client_secret ?? ""}`);
+    } catch (err) {
+      fail(err, mode);
+    }
+  });
+}
+function createOAuthClientPayload(options) {
+  const redirectUris = normalizeList(options.redirectUri);
+  if (redirectUris.length === 0) {
+    throw new Error("At least one --redirect-uri is required.");
+  }
+  return {
+    name: options.name,
+    developer_id: options.developerId,
+    developer_app_id: options.developerAppId,
+    description: options.description,
+    client_type: options.public ? "public" : "confidential",
+    redirect_uris: redirectUris,
+    allowed_scopes: normalizeList(options.scope, ["openid", "profile", "email"]),
+    grant_types: ["authorization_code", "refresh_token"],
+    homepage_url: options.homepageUrl,
+    logo_url: options.logoUrl
+  };
+}
+async function authFetchJson(path4, init = {}) {
+  const environment = selectedEnvironment();
+  const credential = await refreshCredentialIfNeeded(environment);
+  if (!credential) {
+    const err = new Error("Topolo credentials are required.");
+    err.code = "auth_error";
+    throw err;
+  }
+  const config = await readConfig();
+  const profile = resolvedProfileConfig(config, environment);
+  const authBaseUrl = (profile.serviceUrls?.auth ?? "https://auth.topolo.app").replace(/\/+$/, "");
+  const headers = new Headers(init.headers);
+  headers.set("Accept", "application/json");
+  if (init.body && !headers.has("Content-Type")) headers.set("Content-Type", "application/json");
+  if (credential.kind === "api_key") {
+    headers.set("Authorization", `Bearer ${credential.apiKey}`);
+  } else {
+    headers.set("Authorization", `Bearer ${credential.accessToken}`);
+  }
+  const response = await fetch(`${authBaseUrl}${path4}`, { ...init, headers });
+  const text = await response.text();
+  const payload = text ? JSON.parse(text) : {};
+  if (!response.ok || payload.success === false) {
+    const err = new Error(payload.message || payload.error_description || payload.error || "Topolo Auth request failed");
+    err.code = payload.code || payload.error;
+    throw err;
+  }
+  return payload;
+}
+function normalizeList(values, fallback = []) {
+  const source = values && values.length > 0 ? values : fallback;
+  return Array.from(new Set(source.flatMap((value) => value.split(/[\s,]+/)).map((value) => value.trim()).filter(Boolean)));
+}
+
+// src/commands/integrations.ts
+import { readdir, readFile as readFile3, stat } from "fs/promises";
+import { join as join3, relative as relative2 } from "path";
+function registerIntegrationsCommand(program2) {
+  const integrations = program2.command("integrations").description("Generate and validate Topolo integration handoffs.");
+  integrations.command("prompt").description("Print an agent prompt for adding a Topolo integration.").argument("<integration>", "Integration prompt id, currently login-with-topolo").option("--framework <framework>", "auto, authjs, express, or generic", "auto").option("--json", "Emit JSON output").action((integration, options) => {
+    const mode = resolveOutputMode(options.json);
+    try {
+      if (integration !== "login-with-topolo") throw new Error(`Unknown integration prompt: ${integration}`);
+      const framework = normalizeFramework(options.framework);
+      const prompt = buildLoginWithTopoloPrompt(framework);
+      emit({ integration, framework, prompt }, mode, () => prompt);
+    } catch (err) {
+      fail(err, mode);
+    }
+  });
+  integrations.command("check").description("Check whether a repo has the Login with Topolo integration pieces.").argument("<integration>", "Integration check id, currently login-with-topolo").option("--repo-root <path>", "Repository root to inspect", ".").option("--json", "Emit JSON output").action(async (integration, options) => {
+    const mode = resolveOutputMode(options.json);
+    try {
+      if (integration !== "login-with-topolo") throw new Error(`Unknown integration check: ${integration}`);
+      const result = await checkLoginWithTopolo(options.repoRoot ?? ".");
+      emit(result, mode, () => formatCheckResult(result));
+      if (!result.passed) process.exitCode = 1;
+    } catch (err) {
+      fail(err, mode);
+    }
+  });
+}
+function buildLoginWithTopoloPrompt(framework = "auto") {
+  return [
+    "You are adding Login with Topolo to an existing third-party application.",
+    "",
+    "Objective:",
+    "- Add Topolo as an additional OAuth/OIDC login provider without replacing existing Google, Facebook, email, SSO, or password login.",
+    "- Use @topolo/login for provider URL generation, token exchange, userinfo, ID-token verification, refresh, and account-link payloads.",
+    "- Use @topolo/sdk only after login when calling Topolo APIs with the Topolo access_token.",
+    "",
+    "Implementation steps:",
+    "1. Inspect the current auth stack, session store, user model, workspace/org model, and callback route conventions.",
+    `2. Select the integration path: ${framework === "auto" ? "auto-detect Auth.js/NextAuth, Express/Passport, or generic OIDC" : framework}.`,
+    "3. Add env vars: TOPOLO_CLIENT_ID, TOPOLO_CLIENT_SECRET when confidential, TOPOLO_AUTH_BASE_URL, and TOPOLO_REDIRECT_URI.",
+    "4. Register the callback URI in TopoloDevelopers or run `topolo oauth clients create`.",
+    "5. Add the Topolo callback route and exchange the authorization code with PKCE.",
+    "6. Fetch userinfo and link it to a local account record with local_user_id, topolo_user_id, topolo_org_id, topolo_context_id, topolo_service_id, connected_at, and last_seen_at.",
+    "7. Never auto-merge solely by matching email unless the user is already signed into the local account or explicitly confirms linking.",
+    "8. Store refresh tokens according to the app\u2019s existing token-security pattern and refresh Topolo tokens when calling Topolo APIs.",
+    "9. Preserve all existing login providers and add tests for callback exchange, account linking, refresh handling, and disconnect/re-login.",
+    "10. Run `topolo integrations check login-with-topolo --repo-root . --json` and fix every failing check."
+  ].join("\n");
+}
+async function checkLoginWithTopolo(repoRoot) {
+  const files = await collectFiles(repoRoot);
+  const packageJson2 = await readPackageJson2(repoRoot);
+  const haystack = files.map((file) => `${file.path}
+${file.content}`).join("\n");
+  const framework = detectFramework(packageJson2, haystack);
+  const checks = [
+    makeCheck(
+      "package",
+      "@topolo/login dependency",
+      packageJson2?.dependencies?.["@topolo/login"] || packageJson2?.devDependencies?.["@topolo/login"] ? ["package.json declares @topolo/login"] : [],
+      true
+    ),
+    makeCheck(
+      "env",
+      "Topolo OAuth env vars",
+      matchEvidence(haystack, ["TOPOLO_CLIENT_ID", "TOPOLO_AUTH_BASE_URL", "TOPOLO_REDIRECT_URI"]),
+      true
+    ),
+    makeCheck(
+      "callback",
+      "OAuth callback route",
+      matchEvidence(haystack, ["topolo/callback", "auth/topolo/callback", "exchangeTopoloCode", "createTopoloAuthJsProvider"]),
+      true
+    ),
+    makeCheck(
+      "account_link",
+      "Account-linking model",
+      matchEvidence(haystack, ["topolo_user_id", "topolo_org_id", "createAccountLinkPayload"]),
+      true
+    ),
+    makeCheck(
+      "refresh",
+      "Token refresh handling",
+      matchEvidence(haystack, ["refreshTopoloToken", "refresh_token", "expires_at"]),
+      false
+    ),
+    makeCheck(
+      "safety",
+      "Existing auth preserved",
+      matchEvidence(haystack, ["google", "facebook", "email", "password", "credentials"]),
+      false
+    )
+  ];
+  return {
+    integration: "login-with-topolo",
+    framework,
+    passed: checks.every((check) => check.status !== "fail"),
+    checks
+  };
+}
+function normalizeFramework(value) {
+  if (value === "auto" || value === "authjs" || value === "express" || value === "generic") return value;
+  throw new Error("--framework must be auto, authjs, express, or generic.");
+}
+function makeCheck(id, label, evidence, required) {
+  if (evidence.length > 0) return { id, label, status: "pass", evidence };
+  return { id, label, status: required ? "fail" : "warn", evidence: [] };
+}
+function matchEvidence(haystack, needles) {
+  return needles.filter((needle) => haystack.toLowerCase().includes(needle.toLowerCase()));
+}
+function detectFramework(packageJson2, haystack) {
+  const deps = {
+    ...packageJson2?.dependencies ?? {},
+    ...packageJson2?.devDependencies ?? {}
+  };
+  if (deps["next-auth"] || deps["@auth/core"] || deps["@auth/nextjs"] || haystack.includes("NextAuth")) return "authjs";
+  if (deps.express || deps.passport || haystack.includes("passport.use")) return "express";
+  if (haystack.includes("Gemfile") || haystack.includes("omniauth")) return "rails";
+  if (haystack.includes("Laravel") || haystack.includes("Socialite")) return "laravel";
+  if (haystack.includes("django") || haystack.includes("allauth")) return "django";
+  return "generic";
+}
+async function readPackageJson2(repoRoot) {
+  try {
+    return JSON.parse(await readFile3(join3(repoRoot, "package.json"), "utf8"));
+  } catch {
+    return null;
+  }
+}
+async function collectFiles(repoRoot) {
+  const result = [];
+  const root = repoRoot;
+  async function walk(dir) {
+    if (result.length > 2e3) return;
+    const entries = await readdir(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const fullPath = join3(dir, entry.name);
+      if (entry.isDirectory()) {
+        if ([".git", "node_modules", "dist", "build", ".next", "coverage"].includes(entry.name)) continue;
+        await walk(fullPath);
+        continue;
+      }
+      if (!entry.isFile() || !isInspectable(entry.name)) continue;
+      const info = await stat(fullPath);
+      if (info.size > 25e4) continue;
+      result.push({
+        path: relative2(root, fullPath),
+        content: await readFile3(fullPath, "utf8")
+      });
+    }
+  }
+  await walk(root);
+  return result;
+}
+function isInspectable(name) {
+  return /\.(ts|tsx|js|jsx|mjs|cjs|json|md|env|py|rb|php|go|java|cs|rs|sql)$/i.test(name) || ["Gemfile", "Procfile", ".env", ".env.example"].includes(name);
+}
+function formatCheckResult(result) {
+  const rows = result.checks.map((check) => `${check.status.toUpperCase()}	${check.label}`);
+  return [`Framework: ${result.framework}`, `Passed: ${result.passed ? "yes" : "no"}`, ...rows].join("\n");
+}
+
 // src/index.ts
 var program = new Command();
 var argv;
@@ -6998,6 +8100,8 @@ registerWhoamiCommand(program);
 registerCrmCommands(program);
 registerApiCommand(program);
 registerAppsCommand(program);
+registerOAuthCommands(program);
+registerIntegrationsCommand(program);
 registerPlatformCommand(program);
 registerServicesCommand(program);
 registerSeedCommands(program);