npm - @topolo/cli - Versions diffs - 0.1.22 → 0.1.24 - Mend

@topolo/cli 0.1.22 → 0.1.24

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/dist/index.js CHANGED Viewed

@@ -9,7 +9,7 @@ import { platform as platform2 } from "os";
 import { createInterface } from "readline/promises";
 import { stdin as input } from "process";
-// node_modules/@topolo/sdk/dist/index.js
+// ../topolo-sdk/dist/index.js
 function applyAuthHeaders(headers, credential) {
   if (credential.kind === "api_key") {
     headers.set("X-Api-Key", credential.apiKey);
@@ -67,6 +67,7 @@ var TopoloHttpError = class extends TopoloSdkError {
 var SERVICES = {
   agent: "https://agent-api.topolo.app",
   auth: "https://auth.topolo.app",
+  backup: "https://backup.topolo.app",
   books: "https://books.topolo.app",
   bugfix: "https://bugfix.topolo.app",
   bytes: "https://bytes-api.topolo.app",
@@ -77,7 +78,6 @@ var SERVICES = {
   compose: "https://compose.topolo.app",
   consent: "https://consent.topolo.app",
   crm: "https://crm-api.topolo.app",
-  customer_success: "https://success.topolo.app",
   developers: "https://developers.topolo.app",
   director: "https://director.topolo.app",
   feed: "https://feed-api.topolo.app",
@@ -91,9 +91,10 @@ var SERVICES = {
   localize: "https://localize.topolo.app",
   mail: "https://mail.topolo.app",
   mdm: "https://mdm-api.topolo.app",
-  messaging: "https://messages.topolo.app",
+  messages: "https://messages.topolo.app",
   nexus: "https://nexus-api.topolo.app",
   notify: "https://notify.topolo.app",
+  observability_watch: "https://observability-watch.topolo.app",
   one: "https://one.topolo.app",
   p2p: "https://p2p.topolo.app",
   pay: "https://pay.topolo.app",
@@ -107,6 +108,7 @@ var SERVICES = {
   socialize: "https://socialize-api.topolo.app",
   spaces: "https://spaces.topolo.app",
   status: "https://status.topolo.app",
+  success: "https://success.topolo.app",
   support: "https://support.topolo.app",
   survey: "https://survey.topolo.app",
   voice: "https://voice.topolo.app",
@@ -123,13 +125,21 @@ var APPLICATIONS = {
     "deployTargets": [
       {
         "name": "topolo-admin",
-        "kind": "pages",
-        "apiUrl": null,
+        "kind": "worker",
+        "apiUrl": "https://admin.topolo.app",
         "domains": [
           "admin.topolo.app"
         ],
         "routes": [],
         "serviceId": null
+      },
+      {
+        "name": "topolo-admin-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
       }
     ]
   },
@@ -146,7 +156,7 @@ var APPLICATIONS = {
       {
         "name": "topolo-agent",
         "kind": "worker",
-        "apiUrl": null,
+        "apiUrl": "https://agent.topolo.app",
         "domains": [
           "agent.topolo.app"
         ],
@@ -154,7 +164,7 @@ var APPLICATIONS = {
         "serviceId": null
       },
       {
-        "name": "topolo-agent-worker",
+        "name": "topolo-agent-api",
         "kind": "worker",
         "apiUrl": "https://agent-api.topolo.app",
         "domains": [
@@ -194,16 +204,20 @@ var APPLICATIONS = {
     "appDir": "TopoloBackup",
     "name": "topolo-backup",
     "packageName": "topolo-backup",
-    "productionUrl": null,
-    "services": [],
+    "productionUrl": "https://backup.topolo.app",
+    "services": [
+      "backup"
+    ],
     "deployTargets": [
       {
         "name": "topolo-backup",
         "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
+        "apiUrl": "https://backup.topolo.app",
+        "domains": [
+          "backup.topolo.app"
+        ],
         "routes": [],
-        "serviceId": null
+        "serviceId": "backup"
       }
     ]
   },
@@ -224,10 +238,16 @@ var APPLICATIONS = {
         "domains": [
           "books.topolo.app"
         ],
-        "routes": [
-          "books.topolo.app"
-        ],
+        "routes": [],
         "serviceId": "books"
+      },
+      {
+        "name": "topolo-books-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
       }
     ]
   },
@@ -248,9 +268,7 @@ var APPLICATIONS = {
         "domains": [
           "bugfix.topolo.app"
         ],
-        "routes": [
-          "bugfix.topolo.app"
-        ],
+        "routes": [],
         "serviceId": "bugfix"
       }
     ]
@@ -267,8 +285,8 @@ var APPLICATIONS = {
     "deployTargets": [
       {
         "name": "topolo-bytes",
-        "kind": "pages",
-        "apiUrl": null,
+        "kind": "worker",
+        "apiUrl": "https://bytes.topolo.app",
         "domains": [
           "bytes.topolo.app"
         ],
@@ -304,10 +322,16 @@ var APPLICATIONS = {
         "domains": [
           "calendar.topolo.app"
         ],
-        "routes": [
-          "calendar.topolo.app"
-        ],
+        "routes": [],
         "serviceId": "calendar"
+      },
+      {
+        "name": "topolo-calendar-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
       }
     ]
   },
@@ -350,22 +374,19 @@ var APPLICATIONS = {
         "domains": [
           "chat.topolo.app"
         ],
-        "routes": [
-          "chat.topolo.app"
-        ],
+        "routes": [],
         "serviceId": "chat"
+      },
+      {
+        "name": "topolo-chat-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
       }
     ]
   },
-  "cloudcontrol": {
-    "id": "cloudcontrol",
-    "appDir": "TopoloCloudControl",
-    "name": "cloudcontrol",
-    "packageName": "topolo-cloudcontrol",
-    "productionUrl": null,
-    "services": [],
-    "deployTargets": []
-  },
   "commerce": {
     "id": "commerce",
     "appDir": "TopoloCommerce",
@@ -388,8 +409,8 @@ var APPLICATIONS = {
       },
       {
         "name": "topolo-commerce-guest-web",
-        "kind": "pages",
-        "apiUrl": null,
+        "kind": "worker",
+        "apiUrl": "https://guest.topolo.app",
         "domains": [
           "guest.topolo.app"
         ],
@@ -398,8 +419,8 @@ var APPLICATIONS = {
       },
       {
         "name": "topolo-commerce-ops-web",
-        "kind": "pages",
-        "apiUrl": null,
+        "kind": "worker",
+        "apiUrl": "https://commerce.topolo.app",
         "domains": [
           "commerce.topolo.app"
         ],
@@ -408,8 +429,8 @@ var APPLICATIONS = {
       },
       {
         "name": "topolo-commerce-station-web",
-        "kind": "pages",
-        "apiUrl": null,
+        "kind": "worker",
+        "apiUrl": "https://station-commerce.topolo.app",
         "domains": [
           "station-commerce.topolo.app"
         ],
@@ -435,10 +456,16 @@ var APPLICATIONS = {
         "domains": [
           "compose.topolo.app"
         ],
-        "routes": [
-          "compose.topolo.app"
-        ],
+        "routes": [],
         "serviceId": "compose"
+      },
+      {
+        "name": "topolo-compose-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
       }
     ]
   },
@@ -459,10 +486,16 @@ var APPLICATIONS = {
         "domains": [
           "consent.topolo.app"
         ],
-        "routes": [
-          "consent.topolo.app"
-        ],
+        "routes": [],
         "serviceId": "consent"
+      },
+      {
+        "name": "topolo-consent-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
       }
     ]
   },
@@ -489,7 +522,7 @@ var APPLICATIONS = {
       {
         "name": "topolo-crm-app",
         "kind": "worker",
-        "apiUrl": null,
+        "apiUrl": "https://crm.topolo.app",
         "domains": [
           "crm.topolo.app"
         ],
@@ -498,30 +531,6 @@ var APPLICATIONS = {
       }
     ]
   },
-  "customer_success": {
-    "id": "customer_success",
-    "appDir": "TopoloSuccess",
-    "name": "topolo-success",
-    "packageName": "topolo-success",
-    "productionUrl": "https://success.topolo.app",
-    "services": [
-      "customer_success"
-    ],
-    "deployTargets": [
-      {
-        "name": "topolo-success",
-        "kind": "worker",
-        "apiUrl": "https://success.topolo.app",
-        "domains": [
-          "success.topolo.app"
-        ],
-        "routes": [
-          "success.topolo.app"
-        ],
-        "serviceId": "customer_success"
-      }
-    ]
-  },
   "developers": {
     "id": "developers",
     "appDir": "TopoloDevelopers",
@@ -549,6 +558,14 @@ var APPLICATIONS = {
         ],
         "routes": [],
         "serviceId": "developers"
+      },
+      {
+        "name": "topolo-developers-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
       }
     ]
   },
@@ -569,10 +586,16 @@ var APPLICATIONS = {
         "domains": [
           "director.topolo.app"
         ],
-        "routes": [
-          "director.topolo.app"
-        ],
+        "routes": [],
         "serviceId": "director"
+      },
+      {
+        "name": "topolo-director-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
       }
     ]
   },
@@ -586,13 +609,21 @@ var APPLICATIONS = {
     "deployTargets": [
       {
         "name": "topolo-docs",
-        "kind": "pages",
-        "apiUrl": null,
+        "kind": "worker",
+        "apiUrl": "https://docs.topolo.app",
         "domains": [
           "docs.topolo.app"
         ],
         "routes": [],
         "serviceId": null
+      },
+      {
+        "name": "topolo-docs-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
       }
     ]
   },
@@ -601,7 +632,7 @@ var APPLICATIONS = {
     "appDir": "TopoloFeed",
     "name": "TopoloFeed",
     "packageName": "topolo-feed",
-    "productionUrl": "https://feed-api.topolo.app",
+    "productionUrl": "https://feed.topolo.app",
     "services": [
       "feed"
     ],
@@ -613,9 +644,7 @@ var APPLICATIONS = {
         "domains": [
           "feed-analytics-api.topolo.app"
         ],
-        "routes": [
-          "feed-analytics-api.topolo.app"
-        ],
+        "routes": [],
         "serviceId": null
       },
       {
@@ -625,10 +654,18 @@ var APPLICATIONS = {
         "domains": [
           "feed-api.topolo.app"
         ],
-        "routes": [
-          "feed-api.topolo.app"
-        ],
+        "routes": [],
         "serviceId": "feed"
+      },
+      {
+        "name": "topolo-feed-web",
+        "kind": "worker",
+        "apiUrl": "https://feed.topolo.app",
+        "domains": [
+          "feed.topolo.app"
+        ],
+        "routes": [],
+        "serviceId": null
       }
     ]
   },
@@ -649,17 +686,23 @@ var APPLICATIONS = {
         "domains": [
           "flow.topolo.app"
         ],
-        "routes": [
-          "flow.topolo.app"
-        ],
+        "routes": [],
         "serviceId": "flow"
+      },
+      {
+        "name": "topolo-flow-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
       }
     ]
   },
   "forecast": {
     "id": "forecast",
     "appDir": "TopoloForecast",
-    "name": "forecast-cloud",
+    "name": "topolo-forecast",
     "packageName": "topolo-forecast",
     "productionUrl": "https://forecast.topolo.app",
     "services": [
@@ -669,7 +712,7 @@ var APPLICATIONS = {
       {
         "name": "topolo-forecast",
         "kind": "worker",
-        "apiUrl": null,
+        "apiUrl": "https://forecast.topolo.app",
         "domains": [
           "forecast.topolo.app"
         ],
@@ -705,10 +748,16 @@ var APPLICATIONS = {
         "domains": [
           "forms.topolo.app"
         ],
-        "routes": [
-          "forms.topolo.app"
-        ],
+        "routes": [],
         "serviceId": "forms"
+      },
+      {
+        "name": "topolo-forms-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
       }
     ]
   },
@@ -729,10 +778,16 @@ var APPLICATIONS = {
         "domains": [
           "home.topolo.app"
         ],
-        "routes": [
-          "home.topolo.app"
-        ],
+        "routes": [],
         "serviceId": "home"
+      },
+      {
+        "name": "topolo-home-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
       }
     ]
   },
@@ -753,10 +808,16 @@ var APPLICATIONS = {
         "domains": [
           "insights.topolo.app"
         ],
-        "routes": [
-          "insights.topolo.app"
-        ],
+        "routes": [],
         "serviceId": "insights"
+      },
+      {
+        "name": "topolo-insights-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
       }
     ]
   },
@@ -777,10 +838,16 @@ var APPLICATIONS = {
         "domains": [
           "inventory.topolo.app"
         ],
-        "routes": [
-          "inventory.topolo.app"
-        ],
+        "routes": [],
         "serviceId": "inventory"
+      },
+      {
+        "name": "topolo-inventory-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
       }
     ]
   },
@@ -797,7 +864,7 @@ var APPLICATIONS = {
       {
         "name": "topolo-learn",
         "kind": "worker",
-        "apiUrl": null,
+        "apiUrl": "https://learn.topolo.app",
         "domains": [
           "learn.topolo.app"
         ],
@@ -857,10 +924,16 @@ var APPLICATIONS = {
         "domains": [
           "mail.topolo.app"
         ],
-        "routes": [
-          "mail.topolo.app"
-        ],
+        "routes": [],
         "serviceId": "mail"
+      },
+      {
+        "name": "topolo-mail-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
       }
     ]
   },
@@ -881,47 +954,51 @@ var APPLICATIONS = {
         "domains": [
           "mdm-api.topolo.app"
         ],
-        "routes": [
-          "mdm-api.topolo.app"
-        ],
+        "routes": [],
         "serviceId": "mdm"
       },
       {
         "name": "topolo-mdm-console",
         "kind": "worker",
-        "apiUrl": null,
+        "apiUrl": "https://mdm.topolo.app",
         "domains": [
           "mdm.topolo.app"
         ],
-        "routes": [
-          "mdm.topolo.app"
-        ],
+        "routes": [],
         "serviceId": null
       }
     ]
   },
-  "messaging": {
-    "id": "messaging",
-    "appDir": "TopoloMessaging",
-    "name": "topolo-messaging",
-    "packageName": "topolo-messaging",
+  "messages": {
+    "id": "messages",
+    "appDir": "TopoloMessages",
+    "name": "topolo-messages",
+    "packageName": "topolo-messages",
     "productionUrl": "https://messages.topolo.app",
     "services": [
-      "messaging"
+      "messages"
     ],
     "deployTargets": [
       {
-        "name": "topolo-messaging",
+        "name": "topolo-messages",
         "kind": "worker",
         "apiUrl": "https://messages.topolo.app",
         "domains": [
           "messages.topolo.app"
         ],
         "routes": [],
-        "serviceId": "messaging"
+        "serviceId": "messages"
       },
       {
-        "name": "topolo-messaging-dispatch",
+        "name": "topolo-messages-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
+      },
+      {
+        "name": "topolo-messages-dispatch",
         "kind": "worker",
         "apiUrl": null,
         "domains": [],
@@ -991,9 +1068,22 @@ var APPLICATIONS = {
     "appDir": "TopoloObservabilityWatch",
     "name": "topolo-observability-watch",
     "packageName": "topolo-observability-watch",
-    "productionUrl": null,
-    "services": [],
-    "deployTargets": []
+    "productionUrl": "https://observability-watch.topolo.app",
+    "services": [
+      "observability_watch"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-observability-watch",
+        "kind": "worker",
+        "apiUrl": "https://observability-watch.topolo.app",
+        "domains": [
+          "observability-watch.topolo.app"
+        ],
+        "routes": [],
+        "serviceId": "observability_watch"
+      }
+    ]
   },
   "one": {
     "id": "one",
@@ -1007,40 +1097,37 @@ var APPLICATIONS = {
     "deployTargets": [
       {
         "name": "topolo-one",
-        "kind": "pages",
-        "apiUrl": null,
-        "domains": [
-          "one.topolo.app"
-        ],
-        "routes": [],
-        "serviceId": null
-      },
-      {
-        "name": "topolo-one-website",
         "kind": "worker",
         "apiUrl": null,
-        "domains": [
-          "topolo.io",
-          "www.topolo.io"
-        ],
+        "domains": [],
         "routes": [],
         "serviceId": null
       },
       {
-        "name": "topolo-one-worker",
+        "name": "topolo-one-api",
         "kind": "worker",
         "apiUrl": "https://one.topolo.app",
         "domains": [
-          "one.topolo.app",
-          "topolo.app",
-          "www.topolo.app"
+          "one.topolo.app"
         ],
         "routes": [
           "one.topolo.app/*",
-          "topolo.app",
           "www.topolo.app/*"
         ],
         "serviceId": "one"
+      },
+      {
+        "name": "topolo-one-website",
+        "kind": "worker",
+        "apiUrl": "https://topolo.io",
+        "domains": [
+          "topolo.io"
+        ],
+        "routes": [
+          "topolo.io",
+          "www.topolo.io"
+        ],
+        "serviceId": null
       }
     ]
   },
@@ -1061,10 +1148,16 @@ var APPLICATIONS = {
         "domains": [
           "p2p.topolo.app"
         ],
-        "routes": [
-          "p2p.topolo.app"
-        ],
+        "routes": [],
         "serviceId": "p2p"
+      },
+      {
+        "name": "topolo-p2p-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
       }
     ]
   },
@@ -1087,6 +1180,14 @@ var APPLICATIONS = {
         ],
         "routes": [],
         "serviceId": "pay"
+      },
+      {
+        "name": "topolo-pay-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
       }
     ]
   },
@@ -1107,10 +1208,16 @@ var APPLICATIONS = {
         "domains": [
           "people.topolo.app"
         ],
-        "routes": [
-          "people.topolo.app"
-        ],
+        "routes": [],
         "serviceId": "people"
+      },
+      {
+        "name": "topolo-people-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
       }
     ]
   },
@@ -1131,10 +1238,16 @@ var APPLICATIONS = {
         "domains": [
           "pulse.topolo.app"
         ],
-        "routes": [
-          "pulse.topolo.app"
-        ],
+        "routes": [],
         "serviceId": "pulse"
+      },
+      {
+        "name": "topolo-pulse-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
       }
     ]
   },
@@ -1156,7 +1269,9 @@ var APPLICATIONS = {
         "domains": [
           "api.ol0.me"
         ],
-        "routes": [],
+        "routes": [
+          "api.ol0.me/*"
+        ],
         "serviceId": "quro.api"
       },
       {
@@ -1174,7 +1289,7 @@ var APPLICATIONS = {
       {
         "name": "quro-ui",
         "kind": "worker",
-        "apiUrl": null,
+        "apiUrl": "https://quro.topolo.app",
         "domains": [
           "quro.topolo.app"
         ],
@@ -1196,7 +1311,7 @@ var APPLICATIONS = {
       {
         "name": "topolo-roadmapper",
         "kind": "worker",
-        "apiUrl": null,
+        "apiUrl": "https://roadmapper.topolo.app",
         "domains": [
           "roadmapper.topolo.app"
         ],
@@ -1232,10 +1347,16 @@ var APPLICATIONS = {
         "domains": [
           "sign.topolo.app"
         ],
-        "routes": [
-          "sign.topolo.app"
-        ],
+        "routes": [],
         "serviceId": "sign"
+      },
+      {
+        "name": "topolo-sign-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
       }
     ]
   },
@@ -1252,7 +1373,7 @@ var APPLICATIONS = {
       {
         "name": "topolo-social-studio",
         "kind": "worker",
-        "apiUrl": null,
+        "apiUrl": "https://studio.topolo.app",
         "domains": [
           "studio.topolo.app"
         ],
@@ -1291,8 +1412,8 @@ var APPLICATIONS = {
     "deployTargets": [
       {
         "name": "topolo-socialize",
-        "kind": "pages",
-        "apiUrl": null,
+        "kind": "worker",
+        "apiUrl": "https://socialize.topolo.app",
         "domains": [
           "socialize.topolo.app"
         ],
@@ -1336,10 +1457,16 @@ var APPLICATIONS = {
         "domains": [
           "spaces.topolo.app"
         ],
-        "routes": [
-          "spaces.topolo.app"
-        ],
+        "routes": [],
         "serviceId": "spaces"
+      },
+      {
+        "name": "topolo-spaces-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
       }
     ]
   },
@@ -1360,10 +1487,40 @@ var APPLICATIONS = {
         "domains": [
           "status.topolo.app"
         ],
+        "routes": [],
+        "serviceId": "status"
+      }
+    ]
+  },
+  "success": {
+    "id": "success",
+    "appDir": "TopoloSuccess",
+    "name": "topolo-success",
+    "packageName": "topolo-success",
+    "productionUrl": "https://success.topolo.app",
+    "services": [
+      "success"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-success",
+        "kind": "worker",
+        "apiUrl": "https://success.topolo.app",
+        "domains": [
+          "success.topolo.app"
+        ],
         "routes": [
-          "status.topolo.app"
+          "success.topolo.app"
         ],
-        "serviceId": "status"
+        "serviceId": "success"
+      },
+      {
+        "name": "topolo-success-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
       }
     ]
   },
@@ -1388,6 +1545,14 @@ var APPLICATIONS = {
           "support.topolo.app/*"
         ],
         "serviceId": "support"
+      },
+      {
+        "name": "topolo-support-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
       }
     ]
   },
@@ -1408,10 +1573,16 @@ var APPLICATIONS = {
         "domains": [
           "survey.topolo.app"
         ],
-        "routes": [
-          "survey.topolo.app"
-        ],
+        "routes": [],
         "serviceId": "survey"
+      },
+      {
+        "name": "topolo-survey-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
       }
     ]
   },
@@ -1432,10 +1603,16 @@ var APPLICATIONS = {
         "domains": [
           "voice.topolo.app"
         ],
-        "routes": [
-          "voice.topolo.app"
-        ],
+        "routes": [],
         "serviceId": "voice"
+      },
+      {
+        "name": "topolo-voice-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "serviceId": null
       }
     ]
   },
@@ -1466,13 +1643,16 @@ var APPLICATIONS = {
         "domains": [
           "sites.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "*.sites.topolo.app/*",
+          "sites.topolo.app"
+        ],
         "serviceId": null
       },
       {
         "name": "topolo-web-studio",
         "kind": "worker",
-        "apiUrl": null,
+        "apiUrl": "https://web.topolo.app",
         "domains": [
           "web.topolo.app"
         ],
@@ -1560,11 +1740,13 @@ var APPLICATION_REQUIREMENTS = [
     evidence: [
       "Auth service catalog contains the service ID and slug",
       "Permissions, role bundles, and API-key scopes exist for the service",
-      "SDK, CLI, and MCP service discovery include the callable production API"
+      "SDK, CLI, and MCP service discovery include the callable production API",
+      "CloudControl production HTTP targets classify agent reachability with sdk_service_id or agent_callable:false"
     ],
     implementation: [
-      "Add production Worker api_url metadata before adding an SDK service ID",
-      "Expose stable service IDs through DEFAULT_SERVICE_URLS",
+      "Add production Worker api_url metadata and sdk_service_id for every agent-callable API target",
+      "Mark browser, documentation, and runtime-only Worker targets with agent_callable:false",
+      "Expose stable service IDs through generated DEFAULT_SERVICE_URLS and live catalog discovery",
       "Keep typed SDK/CLI/MCP surfaces in sync when an API contract stabilizes"
     ]
   },
@@ -1668,8 +1850,10 @@ var APPLICATION_REQUIREMENTS = [
 function applicationRequirementScopes(application) {
   const scopes = /* @__PURE__ */ new Set(["all"]);
   const appId = application.id;
-  const hasBrowserSurface = Boolean(application.productionUrl) || application.deployTargets.some((target) => target.kind === "pages");
-  const hasApiSurface = application.services.length > 0 || application.deployTargets.some((target) => Boolean(target.apiUrl));
+  const hasBrowserSurface = Boolean(application.productionUrl) || // String() keeps this guard valid after the Pages->Worker migration narrowed
+  // the generated kind union to "worker" (no "pages" literal remains).
+  application.deployTargets.some((target) => String(target.kind) === "pages");
+  const hasApiSurface = application.services.length > 0 || application.deployTargets.some((target) => Boolean(target.serviceId));
   if (hasBrowserSurface) scopes.add("browser");
   if (hasApiSurface) scopes.add("api");
   if (appId === "cli" || appId === "mcp" || appId === "cloudcontrol") {
@@ -1786,7 +1970,7 @@ function evaluateRequirement(application, requirement) {
         evidence
       );
     case "cloudflare-deployment-contract": {
-      if (application.deployTargets.length === 0) {
+      if (application.deployTargets.length < 1) {
         return finding(requirement, "missing", "No CloudControl deploy targets are registered.", evidence);
       }
       evidence.push(`deployTargets=${application.deployTargets.length}`);
@@ -1873,6 +2057,7 @@ function resolveServiceUrl(service, overrides) {
 var WRITE_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
 var POSITIVE_CACHE_TTL_MS = 5 * 60 * 1e3;
 var NEGATIVE_CACHE_TTL_MS = 60 * 1e3;
+var CATALOG_CACHE_TTL_MS = 60 * 1e3;
 var TopoloClient = class _TopoloClient {
   credential;
   agent;
@@ -1882,6 +2067,7 @@ var TopoloClient = class _TopoloClient {
   timeoutMs;
   fetchImpl;
   debug;
+  serviceCatalogCache = null;
   /**
    * Process-wide cache for slug → service-id lookups. Keyed by
    * `${authBaseUrl}|${slug}` so multiple `TopoloClient` instances pointing at
@@ -1927,7 +2113,8 @@ var TopoloClient = class _TopoloClient {
         `Mutating ${method} requests require { confirm: true }. This guardrail prevents agents from issuing writes without an explicit human-in-the-loop acknowledgement.`
       );
     }
-    const baseUrl = resolveServiceUrl(opts.service, this.serviceUrls);
+    const resolvedService = await this.resolveRequestService(opts.service);
+    const baseUrl = resolvedService.baseUrl;
     const url = new URL(opts.path, baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`);
     if (opts.query) {
       for (const [k, v] of Object.entries(opts.query)) {
@@ -1937,7 +2124,7 @@ var TopoloClient = class _TopoloClient {
     const headers = new Headers();
     headers.set("Accept", "application/json");
     if (opts.body !== void 0) headers.set("Content-Type", "application/json");
-    const platformServiceId = resolveConfiguredServiceId(opts.service, this.serviceIds);
+    const platformServiceId = resolveConfiguredServiceId(resolvedService.serviceKey, this.serviceIds);
     if (platformServiceId) headers.set("X-Service-ID", platformServiceId);
     applyAuthHeaders(headers, this.credential);
     const requestId = generateRequestId();
@@ -1950,7 +2137,7 @@ var TopoloClient = class _TopoloClient {
     const signal = opts.signal ? mergeSignals(opts.signal, controller.signal) : controller.signal;
     const urlStr = url.toString();
     const startedAt = Date.now();
-    this.emit({ phase: "request", method, service: opts.service, path: opts.path, url: urlStr, requestId });
+    this.emit({ phase: "request", method, service: resolvedService.serviceKey, path: opts.path, url: urlStr, requestId });
     let res;
     try {
       res = await this.fetchImpl(urlStr, {
@@ -1963,7 +2150,7 @@ var TopoloClient = class _TopoloClient {
       this.emit({
         phase: "error",
         method,
-        service: opts.service,
+        service: resolvedService.serviceKey,
         path: opts.path,
         url: urlStr,
         requestId,
@@ -1982,7 +2169,7 @@ var TopoloClient = class _TopoloClient {
       this.emit({
         phase: "error",
         method,
-        service: opts.service,
+        service: resolvedService.serviceKey,
         path: opts.path,
         url: urlStr,
         requestId,
@@ -1997,12 +2184,12 @@ var TopoloClient = class _TopoloClient {
           extractRequired(parsed)
         );
       }
-      throw new TopoloHttpError(opts.service, opts.path, res.status, parsed);
+      throw new TopoloHttpError(resolvedService.serviceKey, opts.path, res.status, parsed);
     }
     this.emit({
       phase: "response",
       method,
-      service: opts.service,
+      service: resolvedService.serviceKey,
       path: opts.path,
       url: urlStr,
       requestId,
@@ -2011,6 +2198,31 @@ var TopoloClient = class _TopoloClient {
     });
     return parsed;
   }
+  async resolveRequestService(service) {
+    const serviceKey = normalizeLookupKey(service);
+    if (!serviceKey) {
+      throw new TopoloSdkError("unknown_service", "service is required");
+    }
+    const overrideUrl = resolveConfiguredServiceUrl(serviceKey, this.serviceUrls);
+    if (overrideUrl) return { serviceKey, baseUrl: overrideUrl };
+    const staticUrl = DEFAULT_SERVICE_URLS[serviceKey];
+    if (staticUrl) return { serviceKey, baseUrl: staticUrl };
+    const live = await this.resolveLiveCallableService(serviceKey);
+    if (live) return live;
+    throw new TopoloSdkError(
+      "unknown_service",
+      `Unknown Topolo service "${service}". Run service discovery first and pass a callable service id or slug.`
+    );
+  }
+  async resolveLiveCallableService(serviceKey) {
+    const catalog = await this.listServices();
+    const match = catalog.find((entry) => catalogEntryMatches(entry, serviceKey));
+    if (!match?.baseUrl || !isCallableCatalogEntry(match)) return null;
+    return {
+      serviceKey: normalizeLookupKey(match.slug || match.name || match.serviceId) || serviceKey,
+      baseUrl: match.baseUrl
+    };
+  }
   /**
    * Resolve a service-slug → opaque service-id via caller config or TopoloAuth.
    *
@@ -2081,6 +2293,10 @@ var TopoloClient = class _TopoloClient {
    * authoritative; the snapshot is a floor, not a cap.
    */
   async listServices() {
+    const now = Date.now();
+    if (this.serviceCatalogCache && this.serviceCatalogCache.expiresAt > now) {
+      return this.serviceCatalogCache.entries;
+    }
     try {
       const res = await this.request({ service: "auth", method: "GET", path: "/api/services/catalog" });
       const raw = res.data?.services ?? res.services;
@@ -2101,7 +2317,13 @@ var TopoloClient = class _TopoloClient {
             launchable: s.launchable === true
           });
         }
-        if (entries.length > 0) return entries;
+        if (entries.length > 0) {
+          this.serviceCatalogCache = {
+            entries,
+            expiresAt: now + CATALOG_CACHE_TTL_MS
+          };
+          return entries;
+        }
       }
     } catch {
     }
@@ -2166,8 +2388,18 @@ function resolveConfiguredServiceId(slug, serviceIds) {
   }
   return null;
 }
+function resolveConfiguredServiceUrl(slug, serviceUrls) {
+  for (const serviceKey of serviceKeyCandidates(slug)) {
+    const configured = serviceUrls?.[serviceKey];
+    if (typeof configured === "string" && configured.trim()) return configured.trim();
+    const envKey = `TOPOLO_SERVICE_URL_${serviceKey.replace(/\./g, "_").toUpperCase()}`;
+    const envValue = typeof process !== "undefined" ? process.env?.[envKey] : void 0;
+    if (typeof envValue === "string" && envValue.trim()) return envValue.trim();
+  }
+  return null;
+}
 function serviceKeyCandidates(slug) {
-  const normalized = slug.trim().toLowerCase();
+  const normalized = normalizeLookupKey(slug);
   const withoutTopolo = normalized.startsWith("topolo-") ? normalized.slice("topolo-".length) : normalized;
   return [.../* @__PURE__ */ new Set([
     normalized,
@@ -2176,6 +2408,33 @@ function serviceKeyCandidates(slug) {
     withoutTopolo.replace(/-/g, "_")
   ])];
 }
+function normalizeLookupKey(value) {
+  return String(value || "").trim().toLowerCase();
+}
+function catalogEntryMatches(entry, needle) {
+  return catalogEntryLookupKeys(entry).includes(needle);
+}
+function catalogEntryLookupKeys(entry) {
+  const values = [entry.serviceId, entry.slug, entry.name].filter((value) => typeof value === "string" && value.trim().length > 0);
+  const keys = /* @__PURE__ */ new Set();
+  for (const value of values) {
+    const normalized = normalizeLookupKey(value);
+    if (!normalized) continue;
+    keys.add(normalized);
+    keys.add(normalized.replace(/-/g, "_"));
+    if (normalized.startsWith("topolo-")) {
+      const withoutTopolo = normalized.slice("topolo-".length);
+      keys.add(withoutTopolo);
+      keys.add(withoutTopolo.replace(/-/g, "_"));
+    }
+  }
+  return [...keys];
+}
+function isCallableCatalogEntry(entry) {
+  const kind = normalizeLookupKey(entry.surfaceKind || "");
+  if (kind === "api" || kind === "technical_service" || kind === "service") return true;
+  return Boolean(entry.slug && Object.prototype.hasOwnProperty.call(DEFAULT_SERVICE_URLS, catalogEntryLookupKeys(entry)[0] ?? ""));
+}
 function describeError(body, fallback) {
   if (body && typeof body === "object") {
     const maybe = body;
@@ -3013,12 +3272,12 @@ function formatContact(c) {
 }
 // src/commands/api.ts
-var KNOWN_SERVICES = Object.keys(DEFAULT_SERVICE_URLS).sort();
+var STATIC_SERVICE_IDS = new Set(Object.keys(DEFAULT_SERVICE_URLS));
 var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
 var WRITE_METHODS2 = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
 function registerApiCommand(program2) {
   program2.command("api <service> <method> <path>").description(
-    `Generic passthrough to a Topolo service. Known services: ${KNOWN_SERVICES.join(", ")}.`
+    "Generic passthrough to a Topolo service. Run `topolo services --json` to discover callable services."
   ).option("-d, --data <json>", "JSON body (for POST/PUT/PATCH)").option(
     "-q, --query <kv...>",
     "Query params as key=value (repeatable), e.g. --query source=cli page=2"
@@ -3033,22 +3292,17 @@ function registerApiCommand(program2) {
           );
         }
         const httpMethod = upperMethod;
-        if (!KNOWN_SERVICES.includes(service)) {
-          throw new Error(
-            `Unknown service "${service}". Known services: ${KNOWN_SERVICES.join(", ")}`
-          );
-        }
         if (WRITE_METHODS2.has(httpMethod) && !opts.confirm) {
           throw new Error(`Mutating ${httpMethod} requires --confirm.`);
         }
         const environment = selectedEnvironment();
         const config = await readConfig();
         const profile = resolvedProfileConfig(config, environment);
-        assertServiceUrlForEnvironment(
-          service,
-          resolveServiceUrl(service, profile.serviceUrls),
-          environment
-        );
+        const configuredUrl = resolveConfiguredServiceUrl2(service, profile.serviceUrls);
+        const staticUrl = STATIC_SERVICE_IDS.has(service) ? DEFAULT_SERVICE_URLS[service] : void 0;
+        if (configuredUrl || staticUrl) {
+          assertServiceUrlForEnvironment(service, configuredUrl ?? staticUrl, environment);
+        }
         let body = void 0;
         if (opts.data) {
           try {
@@ -3079,6 +3333,21 @@ function registerApiCommand(program2) {
     }
   );
 }
+function resolveConfiguredServiceUrl2(service, serviceUrls) {
+  const normalized = service.trim().toLowerCase();
+  const withoutTopolo = normalized.startsWith("topolo-") ? normalized.slice("topolo-".length) : normalized;
+  const candidates = [
+    normalized,
+    normalized.replace(/-/g, "_"),
+    withoutTopolo,
+    withoutTopolo.replace(/-/g, "_")
+  ];
+  for (const candidate of candidates) {
+    const url = serviceUrls?.[candidate];
+    if (typeof url === "string" && url.trim()) return url.trim();
+  }
+  return void 0;
+}
 function parseQueryPairs(pairs) {
   if (!pairs || pairs.length === 0) return void 0;
   const out = {};
@@ -3108,6 +3377,8 @@ import {
 } from "fs";
 import path from "path";
 var EVIDENCE_FRESHNESS_MS = 36 * 60 * 60 * 1e3;
+var REQUIRED_AUTH_CLIENT_VERSION = "1.1.9";
+var REQUIRED_UI_KIT_VERSION = "0.4.67";
 function readEvidenceFile(appRoot) {
   const candidate = path.join(appRoot, ".topolo", "evidence.json");
   if (!isFile(candidate)) return null;
@@ -3269,28 +3540,53 @@ function enrichFinding(application, finding2, evidence) {
           evidence: ["service=auth"]
         });
       }
+      const usesWorkerRuntime = authEvidence.includes("source=@topolo-io/worker-runtime") || authEvidence.includes("source=topolo-worker-runtime") || authEvidence.includes("source=createTopoloWorkerRuntime");
       const usesAuthMiddleware = authEvidence.includes("source=@topolo-io/auth-middleware") || authEvidence.includes("source=topolo-auth-middleware") || authEvidence.includes("source=TopoloAuthMiddleware");
       const usesAuthClient = authEvidence.includes("source=@topolo-io/auth-client") || authEvidence.includes("source=topolo-auth-client");
       const usesTopoloClient = authEvidence.includes("source=TopoloClient");
       const usesAuthValidateFetch = authEvidence.includes("source=auth-validate-fetch");
-      if (usesAuthMiddleware || usesAuthClient || usesTopoloClient || usesAuthValidateFetch) {
+      if (authEvidence.includes(`dependency-version=@topolo-io/auth-client<${REQUIRED_AUTH_CLIENT_VERSION}`)) {
+        return mergeFinding(finding2, {
+          status: "needs_review",
+          reason: `The app depends on @topolo-io/auth-client below ${REQUIRED_AUTH_CLIENT_VERSION}; public-route auth boot and session-channel fixes require the current shared client.`,
+          evidence: authEvidence,
+          nextActions: [
+            `Update @topolo-io/auth-client to ${REQUIRED_AUTH_CLIENT_VERSION} or the workspace package that resolves to it`,
+            "Regenerate the lockfile without reverting unrelated app changes",
+            "Rerun this audit after the package update"
+          ]
+        });
+      }
+      if (authEvidence.includes("auth-boot=blocking-cookie-refresh") && !authEvidence.includes("auth-boot=background-cookie-refresh")) {
+        return mergeFinding(finding2, {
+          status: "needs_review",
+          reason: "The app appears to block all browser routes on auth cookie refresh. Public landing and login routes must render immediately and restore the cookie session in the background.",
+          evidence: authEvidence,
+          nextActions: [
+            "Use authClient.initialize({ cookieRefresh: 'background' }) or initializeSession({ cookieRefresh: 'background' }) on public landing/login routes",
+            "Keep cookieRefresh: 'blocking' for protected workspace routes",
+            "Subscribe to auth:session-updated so background restore updates the visible user state"
+          ]
+        });
+      }
+      if (usesWorkerRuntime || usesAuthMiddleware || usesAuthClient || usesTopoloClient || usesAuthValidateFetch) {
         return mergeFinding(finding2, {
           status: "met",
-          reason: "Canonical Topolo auth wiring is present (auth-middleware verifyRequest, auth-client browser module, or TopoloClient).",
+          reason: "Canonical Topolo auth wiring is present (worker-runtime, auth-middleware verifyRequest, auth-client browser session controller, or TopoloClient).",
           evidence: authEvidence
         });
       }
       return mergeFinding(finding2, {
         status: "partial",
-        reason: "Shared Topolo auth dependency is declared but the canonical wiring (verifyRequest / createBrowserAuthModule / useTopoloAuth / TopoloClient) is not visible.",
+        reason: "Shared Topolo auth dependency is declared but the canonical wiring (verifyRequest / createBrowserAuthSessionController / useTopoloAuth / TopoloClient) is not visible.",
         evidence: authEvidence
       });
     }
     case "service-registration-and-scopes": {
-      const applicationId = String(application.id);
       const declaredServices = application.services ?? [];
       if (declaredServices.length === 0) {
-        if (applicationId === "cli" || applicationId === "mcp" || applicationId === "cloudcontrol") {
+        const applicationId = String(application.id);
+        if (applicationId === "cloudcontrol") {
           return mergeFinding(finding2, {
             status: "met",
             reason: "This application is itself a tooling/agent surface and does not register a callable platform service.",
@@ -3373,6 +3669,18 @@ function enrichFinding(application, finding2, evidence) {
         });
       }
       if (shellEvidence.length === 0) return finding2;
+      if (shellEvidence.includes(`dependency-version=@topolo-io/ui-kit<${REQUIRED_UI_KIT_VERSION}`)) {
+        return mergeFinding(finding2, {
+          status: "needs_review",
+          reason: `The app depends on @topolo-io/ui-kit below ${REQUIRED_UI_KIT_VERSION}; launcher catalog cache/dedupe fixes require the current shared kit.`,
+          evidence: shellEvidence,
+          nextActions: [
+            `Update @topolo-io/ui-kit to ${REQUIRED_UI_KIT_VERSION}`,
+            "Regenerate the lockfile without reverting unrelated app changes",
+            "Rerun this audit after the package update"
+          ]
+        });
+      }
       if (shellEvidence.includes("forbidden=workspace-shell")) {
         return mergeFinding(finding2, {
           status: "needs_review",
@@ -3439,7 +3747,7 @@ function enrichFinding(application, finding2, evidence) {
       }
       const text = evidence.source.text;
       const hasOrganizationIdColumn = orgEvidence.includes("source=organization_id") || orgEvidence.includes("source=organizationId") || orgEvidence.includes("source=tenantId") || orgEvidence.includes("source=tenant_id");
-      const hasCredentialBoundary = orgEvidence.includes("source=organization-auth-boundary") || text.includes("verifyRequest") || text.includes("createBrowserAuthModule") || text.includes("useTopoloAuth");
+      const hasCredentialBoundary = orgEvidence.includes("source=organization-auth-boundary") || text.includes("verifyRequest") || text.includes("createBrowserAuthSessionController") || text.includes("useTopoloAuth");
       if (hasOrganizationIdColumn && hasCredentialBoundary) {
         return mergeFinding(finding2, {
           status: "met",
@@ -3454,9 +3762,9 @@ function enrichFinding(application, finding2, evidence) {
       });
     }
     case "agent-and-operator-surfaces": {
-      const applicationId = String(application.id);
       const declaredServices = application.services ?? [];
       const text = evidence.source.text;
+      const applicationId = String(application.id);
       const items = [];
       if (declaredServices.length > 0) items.push(`services=${declaredServices.join(",")}`);
       if (text.includes("TopoloClient")) items.push("source=TopoloClient");
@@ -3464,10 +3772,10 @@ function enrichFinding(application, finding2, evidence) {
         items.push("source=confirm-write-gate");
       }
       if (text.includes("@topolo/sdk")) items.push("source=@topolo/sdk");
-      if (applicationId === "cli" || applicationId === "mcp" || applicationId === "cloudcontrol") {
+      if (applicationId === "cloudcontrol") {
         return mergeFinding(finding2, {
           status: "met",
-          reason: "This application is itself an agent/operator surface (CLI / MCP / CloudControl).",
+          reason: "This application is itself an agent/operator surface (CloudControl).",
           evidence: [`tooling=${applicationId}`, ...items],
           nextActions: []
         });
@@ -3715,15 +4023,24 @@ function sharedAuthEvidence(evidence) {
   const text = evidence.source.text;
   const items = [];
   if (deps.has("@topolo-io/auth-client")) items.push("dependency=@topolo-io/auth-client");
+  if (packageDependencyVersions(evidence, "@topolo-io/auth-client").some((version) => isStaleDependencyVersion(version, REQUIRED_AUTH_CLIENT_VERSION))) {
+    items.push(`dependency-version=@topolo-io/auth-client<${REQUIRED_AUTH_CLIENT_VERSION}`);
+  }
   if (deps.has("@topolo-io/auth-middleware")) items.push("dependency=@topolo-io/auth-middleware");
+  if (deps.has("@topolo-io/worker-runtime")) items.push("dependency=@topolo-io/worker-runtime");
   if (deps.has("@topolo/sdk")) items.push("dependency=@topolo/sdk");
   if (text.includes("@topolo-io/auth-client")) items.push("source=@topolo-io/auth-client");
   if (text.includes("@topolo-io/auth-middleware")) items.push("source=@topolo-io/auth-middleware");
+  if (text.includes("@topolo-io/worker-runtime")) items.push("source=@topolo-io/worker-runtime");
+  if (text.includes("topolo-worker-runtime")) items.push("source=topolo-worker-runtime");
+  if (text.includes("createTopoloWorkerRuntime")) items.push("source=createTopoloWorkerRuntime");
   if (text.includes("topolo-auth-client")) items.push("source=topolo-auth-client");
   if (text.includes("topolo-auth-middleware")) items.push("source=topolo-auth-middleware");
   if (text.includes("TopoloAuthMiddleware")) items.push("source=TopoloAuthMiddleware");
   if (text.includes("TopoloClient")) items.push("source=TopoloClient");
   if (text.includes("TopoloOAuth")) items.push("source=TopoloOAuth");
+  if (/\.initialize(?:Session)?\(\s*\)/.test(text)) items.push("auth-boot=blocking-cookie-refresh");
+  if (/cookieRefresh:\s*['"]background['"]/.test(text)) items.push("auth-boot=background-cookie-refresh");
   if (/Authorization.*Bearer/i.test(text) && (text.includes("/validate") || text.includes("TOPOLO_AUTH_URL") || text.includes("AUTH_BASE_URL") || text.includes("auth.topolo.app"))) {
     items.push("source=auth-validate-fetch");
   }
@@ -3745,6 +4062,9 @@ function sharedShellEvidence(evidence) {
   const text = evidence.source.text;
   const items = [];
   if (deps.has("@topolo-io/ui-kit")) items.push("dependency=@topolo-io/ui-kit");
+  if (packageDependencyVersions(evidence, "@topolo-io/ui-kit").some((version) => isStaleDependencyVersion(version, REQUIRED_UI_KIT_VERSION))) {
+    items.push(`dependency-version=@topolo-io/ui-kit<${REQUIRED_UI_KIT_VERSION}`);
+  }
   if (text.includes("@topolo-io/ui-kit")) items.push("source=@topolo-io/ui-kit");
   if (text.includes("TopoloAppShell")) items.push("source=TopoloAppShell");
   if (text.includes(["Topolo", "Workspace", "Shell"].join(""))) items.push("forbidden=workspace-shell");
@@ -3851,6 +4171,36 @@ function dependencyNames(evidence) {
     ])
   );
 }
+function packageDependencyVersions(evidence, packageName) {
+  return unique(
+    evidence.packageJsons.flatMap((record) => {
+      const specs = [
+        record.packageJson.dependencies?.[packageName],
+        record.packageJson.devDependencies?.[packageName],
+        record.packageJson.peerDependencies?.[packageName]
+      ];
+      return specs.filter((spec) => typeof spec === "string");
+    })
+  );
+}
+function isStaleDependencyVersion(spec, minimumVersion) {
+  if (spec.startsWith("workspace:")) return false;
+  const current = parseDependencyVersion(spec);
+  const minimum = parseDependencyVersion(minimumVersion);
+  if (!current || !minimum) return false;
+  const currentParts = current;
+  const minimumParts = minimum;
+  for (const index of [0, 1, 2]) {
+    if (currentParts[index] < minimumParts[index]) return true;
+    if (currentParts[index] > minimumParts[index]) return false;
+  }
+  return false;
+}
+function parseDependencyVersion(spec) {
+  const match = spec.match(/(\d+)\.(\d+)\.(\d+)/);
+  if (!match) return null;
+  return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
 function matchingSystems(repoRoot, application) {
   const docsRoot = topoloDocsRoot(repoRoot);
   const systemsRoot = path.join(docsRoot, "src", "content", "systems");
@@ -4204,6 +4554,8 @@ function scaffoldFiles(options) {
   const { application, target } = options;
   const slug = toSlug(application.id);
   const base = target === "platform" ? firstPartyAppPath(application.appDir, options.payload.audience) : application.appDir;
+  const browserBase = target === "platform" ? `${base}/apps/web` : base;
+  const apiBase = target === "platform" ? `${base}/apps/api` : base;
   const files = [
     {
       path: `${base}/package.json`,
@@ -4250,10 +4602,10 @@ function scaffoldFiles(options) {
         "uses strict mode",
         "includes browser DOM types for React and Worker types for API-backed apps"
       ],
-      content: tsconfigJson(options.api)
+      content: tsconfigJson(options.api, target)
     },
     {
-      path: `${base}/vite.config.ts`,
+      path: `${browserBase}/vite.config.ts`,
       purpose: "Vite browser build configuration.",
       requiredSignals: [
         "builds the authenticated browser surface",
@@ -4262,7 +4614,7 @@ function scaffoldFiles(options) {
       content: viteConfig(target)
     },
     {
-      path: `${base}/index.html`,
+      path: `${browserBase}/index.html`,
       purpose: "Browser entry document.",
       requiredSignals: [
         "mounts the React app at #root",
@@ -4271,7 +4623,7 @@ function scaffoldFiles(options) {
       content: indexHtml(application.name)
     },
     {
-      path: `${base}/src/main.tsx`,
+      path: `${browserBase}/src/main.tsx`,
       purpose: "React app entrypoint.",
       requiredSignals: [
         "renders the generated app component",
@@ -4280,7 +4632,7 @@ function scaffoldFiles(options) {
       content: mainTsx()
     },
     {
-      path: `${base}/src/env.d.ts`,
+      path: `${browserBase}/src/env.d.ts`,
       purpose: "Vite environment variable typing.",
       requiredSignals: [
         "loads vite/client import.meta.env types",
@@ -4300,7 +4652,7 @@ function scaffoldFiles(options) {
       }
     ] : [],
     {
-      path: `${base}/src/styles.css`,
+      path: `${browserBase}/src/styles.css`,
       purpose: "Minimal app-local styles outside the shared Topolo shell.",
       requiredSignals: [
         "does not fork the shared shell chrome",
@@ -4311,6 +4663,19 @@ function scaffoldFiles(options) {
   ];
   if (target === "platform") {
     files.push(
+      {
+        path: `${base}/topolo.app.json`,
+        purpose: "Canonical app manifest that drives generated Wrangler and CloudControl metadata.",
+        requiredSignals: [
+          "declares web/api targets with canonical names and app-local target directories",
+          "keeps Cloudflare account, domain, service id, and bindings in one manifest source of truth"
+        ],
+        content: topoloAppManifestJson(application, {
+          api: options.api,
+          resources: options.payload.resources,
+          profile: options.payload.profile
+        })
+      },
       {
         path: `${base}/topolo.cloudcontrol.json`,
         purpose: "CloudControl source of truth for deploy targets, routes, bindings, and CI metadata.",
@@ -4436,7 +4801,7 @@ function scaffoldFiles(options) {
   if (options.browser) {
     if (target === "platform") {
       files.push({
-        path: `${base}/src/service-identity.ts`,
+        path: `${browserBase}/src/service-identity.ts`,
         purpose: "Central service identity resolver shared by browser and Worker runtime surfaces.",
         requiredSignals: [
           "exports the generated app id, display name, and stable Auth service slug",
@@ -4446,7 +4811,7 @@ function scaffoldFiles(options) {
       });
     }
     files.push({
-      path: `${base}/src/App.tsx`,
+      path: `${browserBase}/src/App.tsx`,
       purpose: "Authenticated browser surface.",
       requiredSignals: [
         "imports shared TopoloAppShell from @topolo-io/ui-kit",
@@ -4463,16 +4828,16 @@ function scaffoldFiles(options) {
   if (options.api) {
     files.push(
       {
-        path: `${base}/wrangler.toml`,
+        path: `${apiBase}/wrangler.toml`,
         purpose: "Cloudflare Worker runtime configuration.",
         requiredSignals: [
           "bindings match topolo.cloudcontrol.json or topolo.app.json",
           "secrets are referenced by name only"
         ],
-        content: wranglerToml(application, target, options.payload.resources, options.payload.profile)
+        content: target === "platform" ? platformApiWranglerToml(application, options.payload.resources, options.payload.profile) : wranglerToml(application, target, options.payload.resources, options.payload.profile)
       },
       {
-        path: `${base}/src/worker.ts`,
+        path: `${apiBase}/src/worker.ts`,
         purpose: "Protected service boundary.",
         requiredSignals: [
           "uses @topolo-io/worker-runtime for Worker auth, gatewaying, headers, and request helpers",
@@ -4487,6 +4852,37 @@ function scaffoldFiles(options) {
         })
       }
     );
+    if (target === "platform") {
+      files.push(
+        {
+          path: `${apiBase}/src/service-identity.ts`,
+          purpose: "Runtime service identity resolver for the API Worker.",
+          requiredSignals: [
+            "resolves the concrete Auth service id from Worker vars",
+            "keeps the API Worker independent from browser-only import.meta usage"
+          ],
+          content: apiServiceIdentityTs(application)
+        },
+        {
+          path: `${browserBase}/src/worker.ts`,
+          purpose: "Browser Worker that serves assets and forwards API paths to the API Worker binding.",
+          requiredSignals: [
+            "keeps the frontend Worker thin",
+            "routes /api/* to the API service binding instead of owning backend routes locally"
+          ],
+          content: webWorkerTs(application)
+        },
+        {
+          path: `${browserBase}/wrangler.toml`,
+          purpose: "Cloudflare Worker static-assets configuration for the browser surface.",
+          requiredSignals: [
+            "serves Vite assets through a Worker with assets",
+            "binds the frontend Worker to the API Worker for /api/* requests"
+          ],
+          content: platformWebWranglerToml(application)
+        }
+      );
+    }
   }
   return files;
 }
@@ -4516,20 +4912,22 @@ function topoloConformanceWorkflow(options) {
   const docsCheckoutStep = options.appDir === "TopoloDocs" ? [] : [
     "",
     "      - name: Checkout TopoloDocs",
+    `        if: steps.app-token.outputs.token != '' || env.HAS_TOPOLO_CI_REPO_TOKEN == 'true'`,
     "        uses: actions/checkout@v4",
     "        with:",
-    "          repository: Topolo-io/docs",
+    "          repository: Topolo-io/TopoloDocs",
     "          path: Apps/system/TopoloDocs",
-    "          token: ${{ secrets.TOPOLO_CI_REPO_TOKEN || github.token }}"
+    "          token: ${{ steps.app-token.outputs.token || secrets.TOPOLO_CI_REPO_TOKEN }}"
   ];
   const cliCheckoutStep = options.appDir === "TopoloCLI" || options.appDir === "TopoloCli" ? [] : [
     "",
     "      - name: Checkout Topolo CLI",
+    `        if: steps.app-token.outputs.token != '' || env.HAS_TOPOLO_CI_REPO_TOKEN == 'true'`,
     "        uses: actions/checkout@v4",
     "        with:",
     "          repository: Topolo-io/TopoloCli",
     "          path: Apps/system/TopoloCLI",
-    "          token: ${{ secrets.TOPOLO_CI_REPO_TOKEN || github.token }}"
+    "          token: ${{ steps.app-token.outputs.token || secrets.TOPOLO_CI_REPO_TOKEN }}"
   ];
   return [
     "name: Topolo App Conformance",
@@ -4547,44 +4945,66 @@ function topoloConformanceWorkflow(options) {
     "jobs:",
     "  conformance:",
     "    runs-on: ubuntu-latest",
+    "    env:",
+    `      HAS_TOPOLO_PACKAGES_APP: \${{ secrets.TOPOLO_PACKAGES_APP_ID != '' && secrets.TOPOLO_PACKAGES_APP_PRIVATE_KEY != '' }}`,
+    `      HAS_TOPOLO_CI_REPO_TOKEN: \${{ secrets.TOPOLO_CI_REPO_TOKEN != '' }}`,
     "    steps:",
     "      - name: Checkout application",
     "        uses: actions/checkout@v4",
     "        with:",
     `          path: ${appPath}`,
+    "",
+    "      - name: Mint Topolo cross-repo token",
+    "        id: app-token",
+    `        if: env.HAS_TOPOLO_PACKAGES_APP == 'true'`,
+    "        uses: actions/create-github-app-token@v1",
+    "        with:",
+    `          app-id: \${{ secrets.TOPOLO_PACKAGES_APP_ID }}`,
+    `          private-key: \${{ secrets.TOPOLO_PACKAGES_APP_PRIVATE_KEY }}`,
+    "          owner: Topolo-io",
     ...docsCheckoutStep,
     "",
     "      - name: Checkout Topolo SDK",
+    `        if: steps.app-token.outputs.token != '' || env.HAS_TOPOLO_CI_REPO_TOKEN == 'true'`,
     "        uses: actions/checkout@v4",
     "        with:",
     "          repository: Topolo-io/topolo-sdk",
     "          path: Apps/packages/topolo-sdk",
-    "          token: ${{ secrets.TOPOLO_CI_REPO_TOKEN || github.token }}",
+    "          token: ${{ steps.app-token.outputs.token || secrets.TOPOLO_CI_REPO_TOKEN }}",
     ...cliCheckoutStep,
     "",
+    "      - name: Skip conformance without cross-repo token",
+    `        if: steps.app-token.outputs.token == '' && env.HAS_TOPOLO_CI_REPO_TOKEN != 'true'`,
+    "        run: |",
+    '          echo "::warning::Skipping Topolo app conformance because no Topolo cross-repo token is available to this workflow context."',
+    "",
     "      - name: Setup Node.js",
+    `        if: steps.app-token.outputs.token != '' || env.HAS_TOPOLO_CI_REPO_TOKEN == 'true'`,
     "        uses: actions/setup-node@v4",
     "        with:",
     "          node-version: 20",
     "",
     "      - name: Build Topolo SDK",
+    `        if: steps.app-token.outputs.token != '' || env.HAS_TOPOLO_CI_REPO_TOKEN == 'true'`,
     "        working-directory: Apps/packages/topolo-sdk",
     "        run: |",
     "          npm install --no-audit --no-fund",
     "          npm run build",
     "",
     "      - name: Build Topolo CLI",
+    `        if: steps.app-token.outputs.token != '' || env.HAS_TOPOLO_CI_REPO_TOKEN == 'true'`,
     "        working-directory: Apps/system/TopoloCLI",
     "        run: |",
     "          npm install --no-audit --no-fund",
     "          npm run build",
     "",
     "      - name: Run Topolo app conformance audit",
+    `        if: steps.app-token.outputs.token != '' || env.HAS_TOPOLO_CI_REPO_TOKEN == 'true'`,
     "        run: |",
     `          node Apps/system/TopoloCLI/dist/index.js apps audit ${options.id} --local --repo-root "$GITHUB_WORKSPACE" --fail-on needs_review --json`,
     "",
     "      - name: Record green CI evidence",
-    `        if: \${{ success() }}`,
+    `        if: \${{ success() && (steps.app-token.outputs.token != '' || env.HAS_TOPOLO_CI_REPO_TOKEN == 'true') }}`,
     `        working-directory: ${appPath}`,
     "        run: |",
     `          node "$GITHUB_WORKSPACE/Apps/system/TopoloCLI/dist/index.js" apps record-evidence ${options.id} --build --typecheck --test --commit "$GITHUB_SHA"`
@@ -4598,9 +5018,9 @@ function packageJson(application, target, options) {
     vite: "^5.4.0"
   };
   const scripts = {
-    dev: "vite --host 0.0.0.0",
-    build: "vite build",
-    preview: "vite preview --host 0.0.0.0",
+    dev: target === "platform" ? "vite --config apps/web/vite.config.ts --host 0.0.0.0" : "vite --host 0.0.0.0",
+    build: target === "platform" ? "vite build --config apps/web/vite.config.ts" : "vite build",
+    preview: target === "platform" ? "vite preview --config apps/web/vite.config.ts --host 0.0.0.0" : "vite preview --host 0.0.0.0",
     typecheck: "tsc --noEmit"
   };
   if (options.browser) {
@@ -4612,27 +5032,30 @@ function packageJson(application, target, options) {
     if (target === "platform") {
       dependencies["@topolo-io/auth-client"] = topoloPackageVersion("@topolo-io/auth-client", target);
       dependencies["@topolo-io/design-tokens"] = topoloPackageVersion("@topolo-io/design-tokens", target);
+      dependencies["@topolo-io/onboarding"] = topoloPackageVersion("@topolo-io/onboarding", target);
+      dependencies["@topolo-io/tour"] = topoloPackageVersion("@topolo-io/tour", target);
       dependencies["@topolo-io/ui-kit"] = topoloPackageVersion("@topolo-io/ui-kit", target);
     } else {
       dependencies["@topolo/login"] = topoloPackageVersion("@topolo/login", target);
     }
   }
   if (options.api) {
+    devDependencies["@cloudflare/workers-types"] = "^4.20260413.1";
     if (target === "platform") {
       dependencies["@topolo-io/worker-runtime"] = topoloPackageVersion("@topolo-io/worker-runtime", target);
-      dependencies["@topolo-io/widget-server"] = topoloPackageVersion("@topolo-io/widget-server", target);
       dependencies["@topolo/sdk"] = topoloPackageVersion("@topolo/sdk", target);
+      dependencies.hono = "^4";
       scripts.deploy = `node -e 'console.error("\\nX Bare deploy is disabled. Use deploy:staging or deploy:production.\\n"); process.exit(1)'`;
-      scripts["deploy:staging"] = "DEPLOY_ENVIRONMENT=staging VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us npm run build && wrangler deploy --env staging";
-      scripts["deploy:production"] = "DEPLOY_ENVIRONMENT=production npm run build && wrangler deploy";
+      scripts["deploy:staging"] = "DEPLOY_ENVIRONMENT=staging VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us npm run build && wrangler deploy --config apps/api/wrangler.toml --env staging && wrangler deploy --config apps/web/wrangler.toml --env staging";
+      scripts["deploy:production"] = "DEPLOY_ENVIRONMENT=production VITE_TOPOLO_AUTH_URL=https://auth.topolo.app npm run build && wrangler deploy --config apps/api/wrangler.toml --env production && wrangler deploy --config apps/web/wrangler.toml --env production";
     } else {
-      dependencies["@topolo-io/widget-server"] = topoloPackageVersion("@topolo-io/widget-server", target);
+      dependencies["@topolo/sdk"] = topoloPackageVersion("@topolo/sdk", target);
       scripts.deploy = "npm run build && wrangler deploy";
     }
     devDependencies.wrangler = "^4.40.2";
   }
   if (target === "platform" && hasScaffoldResources(options.resources)) {
-    scripts["check:deploy-config"] = "wrangler deploy --dry-run --outdir .wrangler/build";
+    scripts["check:deploy-config"] = "wrangler deploy --config apps/api/wrangler.toml --env staging --dry-run --outdir .wrangler/api-build && wrangler deploy --config apps/web/wrangler.toml --env staging --dry-run --outdir .wrangler/web-build";
   }
   return `${json({
     name: application.packageName,
@@ -4649,7 +5072,7 @@ function topoloPackageVersion(packageName, target) {
   if (target === "developer") {
     if (packageName === "@topolo/login") return "^0.1.0";
     if (packageName === "@topolo-io/auth-client") return "^1.0.0";
-    if (packageName === "@topolo-io/widget-server") return "^0.1.1";
+    if (packageName === "@topolo/sdk") return "^0.4.1";
     return "^0.1.0";
   }
   const platformPackageFolders = {
@@ -4659,8 +5082,9 @@ function topoloPackageVersion(packageName, target) {
     "@topolo-io/auth-middleware": "topolo-auth-middleware",
     "@topolo-io/worker-runtime": "topolo-worker-runtime",
     "@topolo-io/design-tokens": "topolo-design-tokens",
-    "@topolo-io/ui-kit": "topolo-ui-kit",
-    "@topolo-io/widget-server": "topolo-widget-server"
+    "@topolo-io/onboarding": "topolo-onboarding",
+    "@topolo-io/tour": "topolo-tour",
+    "@topolo-io/ui-kit": "topolo-ui-kit"
   };
   const folder = platformPackageFolders[packageName];
   if (!folder) {
@@ -4745,7 +5169,7 @@ function readme(application, target, options) {
       "- `vite.config.ts` includes the standard React plugin plus React runtime dedupe so linked Topolo packages resolve one browser React runtime."
     );
     if (options.api) {
-      lines.push("- `@topolo-io/worker-runtime` owns Worker auth validation, `/api/auth/*` gatewaying, security headers, request ids, and BugFix reporting.");
+      lines.push("- `@topolo-io/worker-runtime` owns Worker auth validation, `/api/auth/*` gatewaying, security headers, request ids, Nexus API-call usage monitoring, and BugFix reporting.");
     }
     if (hasScaffoldResources(options.resources)) {
       lines.push(
@@ -4789,7 +5213,8 @@ function readme(application, target, options) {
   return `${lines.join("\n")}
 `;
 }
-function tsconfigJson(api) {
+function tsconfigJson(api, target) {
+  const include = target === "platform" ? ["apps/web/src", ...api ? ["apps/api/src"] : []] : ["src"];
   return `${json({
     compilerOptions: {
       target: "ES2022",
@@ -4807,9 +5232,9 @@ function tsconfigJson(api) {
       isolatedModules: true,
       noEmit: true,
       jsx: "react-jsx",
-      types: ["vite/client"]
+      types: api ? ["vite/client", "@cloudflare/workers-types"] : ["vite/client"]
     },
-    include: ["src"],
+    include,
     references: []
   })}
 `;
@@ -4907,21 +5332,47 @@ function serviceIdentityTs(application) {
     "  return cachedBrowserServiceId;",
     "}",
     "",
-    "async function fetchServiceIdentity(): Promise<Response> {",
-    "  const response = await fetch('/api/service-identity', {",
-    "    headers: { Accept: 'application/json' },",
-    "  );",
-    "  if (!response.ok) {",
-    "    throw new Error(`Unable to resolve ${SCAFFOLD_SERVICE_SLUG} service identity`);",
-    "  }",
-    "  return response;",
+    "async function fetchServiceIdentity(): Promise<Response> {",
+    "  const response = await fetch('/api/service-identity', {",
+    "    headers: { Accept: 'application/json' },",
+    "  );",
+    "  if (!response.ok) {",
+    "    throw new Error(`Unable to resolve ${SCAFFOLD_SERVICE_SLUG} service identity`);",
+    "  }",
+    "  return response;",
+    "}",
+    "",
+    "function requireServiceId(value: unknown): string {",
+    "  const serviceId = typeof value === 'string' ? value.trim() : '';",
+    "  if (!serviceId) {",
+    "    throw new Error(`SERVICE_ID is required for ${SCAFFOLD_SERVICE_SLUG}`);",
+    "    }",
+    "  return serviceId;",
+    "}",
+    "",
+    "export function resolveRuntimeServiceId(env: ServiceIdentityEnv): Promise<string> {",
+    "  return Promise.resolve(requireServiceId(env.SERVICE_ID));",
+    "}",
+    ""
+  ].join("\n");
+}
+function apiServiceIdentityTs(application) {
+  const appName = toTitle(application.name);
+  const serviceSlug = application.serviceSlug ?? `topolo-${toSlug(application.id)}`;
+  return [
+    `export const SCAFFOLD_APP_ID = '${application.id}';`,
+    `export const SCAFFOLD_APP_NAME = '${escapeSingleQuoted(appName)}';`,
+    `export const SCAFFOLD_SERVICE_SLUG = '${escapeSingleQuoted(serviceSlug)}';`,
+    "",
+    "interface ServiceIdentityEnv {",
+    "  SERVICE_ID?: string;",
     "}",
     "",
     "function requireServiceId(value: unknown): string {",
     "  const serviceId = typeof value === 'string' ? value.trim() : '';",
     "  if (!serviceId) {",
     "    throw new Error(`SERVICE_ID is required for ${SCAFFOLD_SERVICE_SLUG}`);",
-    "    }",
+    "  }",
     "  return serviceId;",
     "}",
     "",
@@ -4998,10 +5449,11 @@ function viteConfig(target) {
     "    process.env.VITE_TOPOLO_AUTH_URL === 'https://auth.stg.topolo.us';",
     "",
     "  return {",
+    "    root: fileURLToPath(new URL('.', import.meta.url)),",
     "    plugins: [react(), ...(isStagingBuild ? [stagingUrlRewrite()] : [])],",
     "    resolve: {",
     "      alias: {",
-    "        '@topolo-io/auth-client': fileURLToPath(new URL('./node_modules/@topolo-io/auth-client/dist/index.js', import.meta.url)),",
+    "        '@topolo-io/auth-client': fileURLToPath(new URL('../../node_modules/@topolo-io/auth-client/dist/index.js', import.meta.url)),",
     "      },",
     "      dedupe: ['react', 'react-dom', 'react/jsx-runtime', 'react/jsx-dev-runtime'],",
     "    },",
@@ -5033,6 +5485,8 @@ function mainTsx() {
     "import React from 'react';",
     "import { createRoot } from 'react-dom/client';",
     "import '@topolo-io/design-tokens/tokens.css';",
+    "import '@topolo-io/tour/styles.css';",
+    "import '@topolo-io/onboarding/styles.css';",
     "import App from './App';",
     "import './styles.css';",
     "",
@@ -5135,16 +5589,19 @@ function platformAppTsx(application, options) {
   const baselineHeading = isPersonal ? "Shared personal baseline" : "Shared workspace baseline";
   const baselineDescription = isPersonal ? "This scaffold starts on the shared landing and login surfaces, completes sign-in on the shared callback path, and renders the signed personal app inside the shared Topolo shell." : "This scaffold starts on the shared landing and login surfaces, completes sign-in on the shared callback path, and renders the signed workspace inside the shared Topolo shell.";
   return [
-    "import { Component, useEffect, useMemo, useState, type ErrorInfo, type ReactNode } from 'react';",
+    "import { Component, useCallback, useEffect, useMemo, useState, type ErrorInfo, type ReactNode } from 'react';",
     "import { createBrowserAuthSessionController, type AuthUser } from '@topolo-io/auth-client';",
     "import { LandingPage, LoginPage, TopoloAppShell, TopoloAuthFlowScreen, TopoloLoadingScreen, setupBugReporterErrorCapture, type TopoloAppShellUser } from '@topolo-io/ui-kit';",
+    "import { GettingStarted, type OnboardingGuideStep } from '@topolo-io/onboarding';",
+    "import { IntroTour } from '@topolo-io/tour';",
     "import { SCAFFOLD_APP_ID, SCAFFOLD_APP_NAME, SCAFFOLD_SERVICE_SLUG, getBrowserAuthBaseUrl, resolveAppServiceId } from './service-identity';",
     "",
     "// Wire global error/console capture so BugReporter (enabled in TopoloAppShell below)",
     "// can attach the last few errors to any submitted bug report.",
     "setupBugReporterErrorCapture();",
     "",
-    "type NavItem = 'home';",
+    "type NavItem = 'home' | 'getting-started';",
+    "type WorkspaceView = 'workspace' | 'getting-started';",
     "type AppRoute = { kind: 'root' } | { kind: 'login' } | { kind: 'callback' };",
     "type BrowserAuthModule = ReturnType<typeof createBrowserAuthSessionController>;",
     "",
@@ -5221,7 +5678,17 @@ function platformAppTsx(application, options) {
     "  const [loading, setLoading] = useState(true);",
     "  const [authError, setAuthError] = useState('');",
     "  const [loginAttempted, setLoginAttempted] = useState(false);",
+    "  const [view, setView] = useState<WorkspaceView>('workspace');",
     "  const auth = useMemo(() => serviceId ? getAuthModule(serviceId) : null, [serviceId]);",
+    "  const openWorkspace = useCallback(() => setView('workspace'), []);",
+    "  const openGettingStarted = useCallback(() => {",
+    "    setView('getting-started');",
+    "    if (typeof window !== 'undefined') window.scrollTo({ top: 0, behavior: 'smooth' });",
+    "  }, []);",
+    "  const handleNavSelect = useCallback((id: NavItem) => {",
+    "    if (id === 'getting-started') openGettingStarted();",
+    "    else openWorkspace();",
+    "  }, [openGettingStarted, openWorkspace]);",
     "",
     "  useEffect(() => {",
     "    let active = true;",
@@ -5244,7 +5711,9 @@ function platformAppTsx(application, options) {
     "    if (!auth) return;",
     "    let active = true;",
     "    const syncAuth = async () => {",
-    "      setLoading(true);",
+    "      const publicRoute = route.kind === 'root' || route.kind === 'login';",
+    "      if (publicRoute) setLoading(false);",
+    "      else setLoading(true);",
     "      setAuthError('');",
     "",
     "      if (route.kind === 'callback') {",
@@ -5260,7 +5729,9 @@ function platformAppTsx(application, options) {
     "        return;",
     "      }",
     "",
-    "      const nextUser = await auth.authClient.initialize();",
+    "      const nextUser = await auth.authClient.initialize({",
+    "        cookieRefresh: publicRoute ? 'background' : 'blocking',",
+    "      });",
     "      if (!active) return;",
     "      setUser(nextUser);",
     "      setLoading(false);",
@@ -5277,6 +5748,16 @@ function platformAppTsx(application, options) {
     "  }, [auth, route.kind]);",
     "",
     "  useEffect(() => {",
+    "    if (!auth) return;",
+    "    const handleSessionUpdated = () => {",
+    "      const nextUser = auth.authClient.getHydratedCurrentUser() || auth.authClient.getTokenIdentity();",
+    "      if (nextUser) setUser(nextUser);",
+    "    };",
+    "    window.addEventListener('auth:session-updated', handleSessionUpdated);",
+    "    return () => window.removeEventListener('auth:session-updated', handleSessionUpdated);",
+    "  }, [auth]);",
+    "",
+    "  useEffect(() => {",
     "    if (!loading && user && route.kind === 'login') {",
     "      window.location.replace('/');",
     "    }",
@@ -5406,11 +5887,11 @@ function platformAppTsx(application, options) {
     "      orgId={user.activeContextType === 'organization' ? user.activeContextId ?? user.orgId ?? null : null}",
     "      activeContextType={user.activeContextType}",
     "      activeContextId={user.activeContextId}",
-    '      activeNavItemId="home"',
-    `      navItems={[{ id: 'home', label: '${escapeSingleQuoted(workspaceTitle)}' }]}`,
+    "      activeNavItemId={view === 'getting-started' ? 'getting-started' : 'home'}",
+    `      navItems={[{ id: 'home', label: '${escapeSingleQuoted(workspaceTitle)}' }, { id: 'getting-started', label: 'Getting started' }]}`,
     '      navigationMode="topbar"',
-    "      onNavItemSelect={() => undefined}",
-    `      title="${escapeDoubleQuoted(workspaceTitle)}"`,
+    "      onNavItemSelect={handleNavSelect}",
+    `      title={view === 'getting-started' ? 'Getting started' : '${escapeSingleQuoted(workspaceTitle)}'}`,
     "      authUrl={AUTH_URL}",
     "      getAccessToken={getAccessToken}",
     "      onSignOut={async () => {",
@@ -5422,18 +5903,94 @@ function platformAppTsx(application, options) {
     "      enableCommandPalette",
     "      enableBugReporter",
     "    >",
-    '      <div className="topolo-starter-workspace">',
-    '        <section className="topolo-starter-card">',
-    `          <h2>${baselineHeading}</h2>`,
-    "          <p>",
-    `            ${baselineDescription}`,
-    "          </p>",
-    "        </section>",
-    "      </div>",
+    "      {view === 'getting-started' ? (",
+    "        <ScaffoldGettingStarted",
+    "          serviceId={activeServiceId}",
+    "          organizationId={user.organization?.id ?? user.orgId ?? ''}",
+    "          role={user.role}",
+    "          onOpenWorkspace={openWorkspace}",
+    "        />",
+    "      ) : (",
+    '        <div className="topolo-starter-workspace">',
+    '          <section className="topolo-starter-card" data-tour="workspace-card">',
+    `            <h2>${baselineHeading}</h2>`,
+    "            <p>",
+    `              ${baselineDescription}`,
+    "            </p>",
+    "          </section>",
+    "        </div>",
+    "      )}",
+    "      <IntroTour",
+    "        appName={APP_NAME}",
+    "        role={user.role}",
+    "        onOpenGettingStarted={openGettingStarted}",
+    "        extraSteps={[",
+    "          {",
+    "            id: 'workspace-card',",
+    `            target: '[data-tour="workspace-card"]',`,
+    "            title: 'Your workspace',",
+    "            content: 'Everything you build renders here, inside the shared Topolo shell.',",
+    "            placement: 'bottom' as const,",
+    "            beforeStep: () => openWorkspace(),",
+    "          },",
+    "        ]}",
+    "      />",
     "    </TopoloAppShell>",
     "  );",
     "}",
     "",
+    "function ScaffoldGettingStarted(props: {",
+    "  serviceId: string;",
+    "  organizationId: string;",
+    "  role?: string;",
+    "  onOpenWorkspace: () => void;",
+    "}) {",
+    "  const { serviceId, organizationId, role, onOpenWorkspace } = props;",
+    "  const steps: OnboardingGuideStep[] = [",
+    "    {",
+    "      id: 'explore-workspace',",
+    "      title: 'Explore your workspace',",
+    "      description:",
+    "        'Your app renders inside the shared Topolo shell \u2014 launcher, command palette, and account menu are already wired in.',",
+    "      actionLabel: 'Open workspace',",
+    "      onAction: onOpenWorkspace,",
+    "    },",
+    "    {",
+    "      id: 'discover-platform',",
+    "      title: 'Move between your Topolo apps',",
+    "      description:",
+    "        'Use the launcher to switch between your Topolo apps, and the command palette (Cmd/Ctrl-K) to jump anywhere fast.',",
+    "      optional: true,",
+    "    },",
+    "    {",
+    "      id: 'build-feature',",
+    "      title: 'Build your first feature',",
+    "      description:",
+    "        'Replace the starter card with your product surface, and gate write actions with service scopes before you ship.',",
+    "    },",
+    "  ];",
+    "  return (",
+    '    <div className="topolo-starter-workspace">',
+    "      <GettingStarted",
+    "        authApiBaseUrl={`${AUTH_URL}/api`}",
+    "        organizationId={organizationId}",
+    "        serviceId={serviceId}",
+    "        getAccessToken={() => getAccessToken()}",
+    "        role={role || undefined}",
+    "        steps={steps}",
+    "        eyebrow={`Welcome to ${APP_NAME}`}",
+    "        title={`Get started with ${APP_NAME}`}",
+    '        subtitle="A short checklist to orient you in your new Topolo workspace."',
+    '        completeLabel="Mark done"',
+    '        dismissLabel="Skip for now"',
+    "        completedContent={`You're all set \u2014 ${APP_NAME} is ready to build on.`}",
+    "        completeAction={{ label: 'Go to workspace', onClick: onOpenWorkspace }}",
+    "        onDismiss={onOpenWorkspace}",
+    "      />",
+    "    </div>",
+    "  );",
+    "}",
+    "",
     "function getRoute(): AppRoute {",
     "  const pathname = window.location.pathname.replace(/\\/+$/, '') || '/';",
     "  if (pathname === '/login') return { kind: 'login' };",
@@ -5586,6 +6143,208 @@ function developerAppTsx(application) {
     ""
   ].join("\n");
 }
+function webWorkerTs(application) {
+  const serviceName = toTitle(application.name);
+  return [
+    "interface Env {",
+    "  API: { fetch(request: Request): Promise<Response> };",
+    "}",
+    "",
+    `const SERVICE_NAME = '${escapeSingleQuoted(serviceName)}';`,
+    "",
+    "export default {",
+    "  async fetch(request: Request, env: Env): Promise<Response> {",
+    "    const url = new URL(request.url);",
+    "    if (url.pathname.startsWith('/api/')) {",
+    "      return env.API.fetch(request);",
+    "    }",
+    "    return Response.json({ ok: true, service: SERVICE_NAME }, { status: 200 });",
+    "  },",
+    "};",
+    ""
+  ].join("\n");
+}
+function platformWebWranglerToml(application) {
+  const slug = toSlug(application.id);
+  const host = application.productionUrl ? new URL(application.productionUrl).host : `${slug}.topolo.app`;
+  return [
+    `name = "topolo-${slug}"`,
+    'main = "src/worker.ts"',
+    `compatibility_date = "${CLOUDFLARE_COMPATIBILITY_DATE}"`,
+    'compatibility_flags = ["nodejs_compat"]',
+    `account_id = "${CLOUDFLARE_ACCOUNT_ID}"`,
+    "workers_dev = false",
+    "",
+    "[assets]",
+    'directory = "./dist"',
+    'binding = "ASSETS"',
+    'not_found_handling = "single-page-application"',
+    'run_worker_first = ["/api/*"]',
+    "",
+    "[observability]",
+    "enabled = true",
+    "",
+    "[[routes]]",
+    `pattern = "${host}"`,
+    "custom_domain = true",
+    "",
+    "[vars]",
+    `SERVICE_ID = "${application.serviceId ?? ""}"`,
+    `VITE_TOPOLO_SERVICE_ID = "${application.serviceId ?? ""}"`,
+    "",
+    "[[services]]",
+    'binding = "API"',
+    `service = "topolo-${slug}-api"`,
+    "",
+    "[env.staging]",
+    `name = "topolo-${slug}-staging"`,
+    `account_id = "${STAGING_CLOUDFLARE_ACCOUNT_ID}"`,
+    "workers_dev = true",
+    "",
+    "[env.staging.vars]",
+    `SERVICE_ID = "${application.serviceId ?? ""}"`,
+    `VITE_TOPOLO_SERVICE_ID = "${application.serviceId ?? ""}"`,
+    "",
+    "[[env.staging.routes]]",
+    `pattern = "${slug}.stg.topolo.us"`,
+    "custom_domain = true",
+    "",
+    "[env.staging.assets]",
+    'directory = "./dist"',
+    'binding = "ASSETS"',
+    'not_found_handling = "single-page-application"',
+    'run_worker_first = ["/api/*"]',
+    "",
+    "[[env.staging.services]]",
+    'binding = "API"',
+    `service = "topolo-${slug}-api-staging"`,
+    "",
+    "[env.production]",
+    `name = "topolo-${slug}-production"`,
+    `account_id = "${CLOUDFLARE_ACCOUNT_ID}"`,
+    "workers_dev = false",
+    "",
+    "[env.production.vars]",
+    `SERVICE_ID = "${application.serviceId ?? ""}"`,
+    `VITE_TOPOLO_SERVICE_ID = "${application.serviceId ?? ""}"`,
+    "",
+    "[[env.production.routes]]",
+    `pattern = "${host}"`,
+    "custom_domain = true",
+    "",
+    "[env.production.assets]",
+    'directory = "./dist"',
+    'binding = "ASSETS"',
+    'not_found_handling = "single-page-application"',
+    'run_worker_first = ["/api/*"]',
+    "",
+    "[[env.production.services]]",
+    'binding = "API"',
+    `service = "topolo-${slug}-api-production"`,
+    ""
+  ].join("\n");
+}
+function platformApiWranglerToml(application, resources, profile) {
+  const slug = toSlug(application.id);
+  const resource = resourceConfig(application, profile);
+  const lines = [
+    `name = "topolo-${slug}-api"`,
+    'main = "src/worker.ts"',
+    `compatibility_date = "${CLOUDFLARE_COMPATIBILITY_DATE}"`,
+    'compatibility_flags = ["nodejs_compat"]',
+    `account_id = "${CLOUDFLARE_ACCOUNT_ID}"`,
+    "workers_dev = true",
+    "",
+    "[observability]",
+    "enabled = true",
+    "",
+    "[vars]",
+    'AUTH_BASE_URL = "https://auth.topolo.app"',
+    'NEXUS_GATEWAY_URL = "https://nexus-api.topolo.app"',
+    `NEXUS_APP_ID = "${slug}"`,
+    `SERVICE_ID = "${application.serviceId ?? ""}"`,
+    `VITE_TOPOLO_SERVICE_ID = "${application.serviceId ?? ""}"`,
+    ""
+  ];
+  appendResourceWranglerBlocks(lines, resources, resource, "production");
+  lines.push(
+    "[env.staging]",
+    `name = "topolo-${slug}-api-staging"`,
+    `account_id = "${STAGING_CLOUDFLARE_ACCOUNT_ID}"`,
+    "workers_dev = true",
+    "",
+    "[env.staging.vars]",
+    'AUTH_BASE_URL = "https://auth.stg.topolo.us"',
+    'NEXUS_GATEWAY_URL = "https://nexus-api.stg.topolo.us"',
+    `NEXUS_APP_ID = "${slug}"`,
+    `SERVICE_ID = "${application.serviceId ?? ""}"`,
+    `VITE_TOPOLO_SERVICE_ID = "${application.serviceId ?? ""}"`,
+    ""
+  );
+  appendResourceWranglerBlocks(lines, resources, resource, "staging");
+  lines.push(
+    "[env.production]",
+    `name = "topolo-${slug}-api-production"`,
+    `account_id = "${CLOUDFLARE_ACCOUNT_ID}"`,
+    "workers_dev = false",
+    "",
+    "[env.production.vars]",
+    'AUTH_BASE_URL = "https://auth.topolo.app"',
+    'NEXUS_GATEWAY_URL = "https://nexus-api.topolo.app"',
+    `NEXUS_APP_ID = "${slug}"`,
+    `SERVICE_ID = "${application.serviceId ?? ""}"`,
+    `VITE_TOPOLO_SERVICE_ID = "${application.serviceId ?? ""}"`,
+    ""
+  );
+  appendResourceWranglerBlocks(lines, resources, resource, "production-env");
+  return lines.join("\n");
+}
+function appendResourceWranglerBlocks(lines, resources, resource, environment) {
+  const prefix = environment === "staging" ? "env.staging." : environment === "production-env" ? "env.production." : "";
+  const envName = environment === "staging" ? "Staging" : "Production";
+  if (resources.d1) {
+    lines.push(
+      `[[${prefix}d1_databases]]`,
+      `binding = "${resource.d1Binding}"`,
+      `database_name = "${environment === "staging" ? resource.d1StagingName : resource.d1ProductionName}"`,
+      'database_id = "provision-after-scaffold"',
+      'migrations_dir = "migrations"',
+      ""
+    );
+  }
+  if (resources.r2) {
+    lines.push(
+      `[[${prefix}r2_buckets]]`,
+      `binding = "${resource.r2Binding}"`,
+      `bucket_name = "${environment === "staging" ? resource.r2StagingName : resource.r2ProductionName}"`,
+      ""
+    );
+  }
+  if (resources.queue) {
+    lines.push(
+      `[[${prefix}queues.producers]]`,
+      `binding = "${resource.queueBinding}"`,
+      `queue = "${environment === "staging" ? resource.queueStagingName : resource.queueProductionName}"`,
+      "",
+      `[[${prefix}queues.consumers]]`,
+      `queue = "${environment === "staging" ? resource.queueStagingName : resource.queueProductionName}"`,
+      ""
+    );
+  }
+  if (resources.workflow) {
+    lines.push(
+      `[[${prefix}workflows]]`,
+      `binding = "${resource.workflowBinding}"`,
+      `name = "${environment === "staging" ? resource.workflowStagingName : resource.workflowProductionName}"`,
+      `class_name = "${resource.workflowClassName}"`,
+      ""
+    );
+  }
+  if (resources.containerProcessing) {
+    lines.push(`# ${envName} container metadata is declared in topolo.app.json and topolo.cloudcontrol.json.`);
+    lines.push("");
+  }
+}
 function wranglerToml(application, target, resources, profile) {
   const slug = toSlug(application.id);
   const workerName = target === "platform" ? `topolo-${slug}` : application.packageName;
@@ -5627,6 +6386,7 @@ function wranglerToml(application, target, resources, profile) {
     "",
     "[vars]",
     'AUTH_BASE_URL = "https://auth.topolo.app"',
+    'NEXUS_GATEWAY_URL = "https://nexus-api.topolo.app"',
     runtimeIdentityVar,
     ""
   );
@@ -5681,6 +6441,7 @@ function wranglerToml(application, target, resources, profile) {
       "",
       "[env.staging.vars]",
       'AUTH_BASE_URL = "https://auth.stg.topolo.us"',
+      'NEXUS_GATEWAY_URL = "https://nexus-api.stg.topolo.us"',
       runtimeIdentityVar,
       ""
     );
@@ -5735,8 +6496,8 @@ function platformWorkerTs(application, options) {
   const resource = resourceConfig(application, options.profile);
   const envBindings = [
     "  AUTH_BASE_URL?: string;",
+    "  NEXUS_GATEWAY_URL?: string;",
     "  SERVICE_ID?: string;",
-    "  TOPOLO_SERVICE_API_KEY?: string;",
     ...options.resources.d1 ? [`  ${resource.d1Binding}?: unknown;`] : [],
     ...options.resources.r2 ? [`  ${resource.r2Binding}?: unknown;`] : [],
     ...options.resources.queue ? [`  ${resource.queueBinding}?: { send(message: unknown): Promise<void> };`] : [],
@@ -5769,8 +6530,9 @@ function platformWorkerTs(application, options) {
     "      }, { status: 200 });"
   ];
   return [
-    "import { createWidgetHandler } from '@topolo-io/widget-server';",
-    "import { createTopoloWorkerRuntime } from '@topolo-io/worker-runtime';",
+    "import { Hono } from 'hono';",
+    "import { createTopoloWidgetResponse, type TopoloWidgetDraft } from '@topolo/sdk';",
+    "import { createTopoloWorkerRuntime, type TopoloRuntimeContext } from '@topolo-io/worker-runtime';",
     "import { SCAFFOLD_APP_ID, SCAFFOLD_APP_NAME, SCAFFOLD_SERVICE_SLUG, resolveRuntimeServiceId } from './service-identity';",
     ...options.resources.workflow ? ["import { WorkflowEntrypoint, type WorkflowEvent, type WorkflowStep } from 'cloudflare:workers';"] : [],
     "",
@@ -5778,18 +6540,8 @@ function platformWorkerTs(application, options) {
     ...envBindings,
     "}",
     "",
-    "// Required by the platform `native-dashboard-widget` requirement \u2014",
-    "// TopoloOne renders this in the user's live workspace whenever the app",
-    "// is installed. Replace the quick-actions placeholder with org-scoped",
-    "// stats once your data model is ready: ctx.user / ctx.orgId / ctx.orgSlug",
-    "// / ctx.isPlatformAdmin / ctx.contextType / ctx.householdId are all",
-    "// pre-resolved. Builder exceptions degrade to empty widgets, not 500s.",
-    "const widgetHandler = createWidgetHandler<Env>({",
-    "  serviceId: SCAFFOLD_SERVICE_SLUG,",
-    `  serviceName: '${escapeSingleQuoted(serviceName)}',`,
-    "  authBaseUrl: (env) => env.AUTH_BASE_URL,",
-    "  serviceApiKey: (env) => env.TOPOLO_SERVICE_API_KEY,",
-    "  build: () => [",
+    "function buildWidgets(): TopoloWidgetDraft[] {",
+    "  return [",
     "    {",
     "      type: 'quick-actions',",
     "      actions: [",
@@ -5797,18 +6549,25 @@ function platformWorkerTs(application, options) {
     "        { id: 'view-health', label: 'View health', link: '/api/health' },",
     "      ],",
     "    },",
-    "  ],",
-    "});",
+    "  ];",
+    "}",
     "",
     "const runtime = createTopoloWorkerRuntime<Env>({",
     "  appName: SCAFFOLD_APP_NAME,",
     "  serviceSlug: SCAFFOLD_SERVICE_SLUG,",
     "  resolveServiceId: (env) => resolveRuntimeServiceId(env),",
     "  authBaseUrl: (env) => env.AUTH_BASE_URL,",
-    "  serviceApiKey: (env) => env.TOPOLO_SERVICE_API_KEY,",
+    "  usageMonitoring: {",
+    "    appId: SCAFFOLD_APP_ID,",
+    "    nexusGatewayUrl: (env) => env.NEXUS_GATEWAY_URL,",
+    "  },",
     "});",
     "",
-    "const handleFetch = runtime.worker(async (request, env, _ctx, rt): Promise<Response> => {",
+    "async function handleRequest(",
+    "  _request: Request,",
+    "  env: Env,",
+    "  rt: TopoloRuntimeContext<Env>,",
+    "): Promise<Response> {",
     "    const url = rt.url;",
     "",
     "    let serviceId: string;",
@@ -5831,9 +6590,15 @@ function platformWorkerTs(application, options) {
     "      }, { status: 200 });",
     "    }",
     "",
-    "    // /api/widget delegates fully to @topolo-io/widget-server \u2014 it owns",
-    "    // auth, context parsing, response wrapping, and error degradation.",
-    "    if (url.pathname === '/api/widget') return widgetHandler(request, env);",
+    "    if (url.pathname === '/api/widget') {",
+    "      const auth = await rt.verifyAuth({ serviceId });",
+    "      if (!auth.ok) return rt.authError(auth);",
+    "      return rt.json(createTopoloWidgetResponse({",
+    "        serviceId,",
+    "        serviceName: SCAFFOLD_APP_NAME,",
+    "        widgets: buildWidgets(),",
+    "      }), { status: 200, headers: { 'Cache-Control': 'public, max-age=15' } });",
+    "    }",
     "",
     "    const auth = await rt.verifyAuth({ serviceId });",
     "",
@@ -5846,10 +6611,21 @@ function platformWorkerTs(application, options) {
     "    }",
     "",
     "    return rt.notFound();",
+    "}",
+    "",
+    "const api = new Hono<{ Bindings: Env & { __rt?: TopoloRuntimeContext<Env> } }>();",
+    "api.all('*', (c) => {",
+    "  const rt = c.env.__rt;",
+    "  if (!rt) return Response.json({ error: 'runtime_context_unavailable' }, { status: 500 });",
+    "  return handleRequest(c.req.raw, c.env, rt);",
     "});",
     "",
     "export default {",
-    "  fetch: handleFetch,",
+    "  fetch: runtime.worker((request, env, ctx, rt) => {",
+    "    const bindings = env as Env & { __rt?: TopoloRuntimeContext<Env> };",
+    "    bindings.__rt = rt;",
+    "    return api.fetch(request, bindings, ctx as ExecutionContext);",
+    "  }),",
     "};",
     "",
     "function errorMessage(error: unknown): string {",
@@ -5864,7 +6640,7 @@ function developerWorkerTs(application) {
   const serviceId = application.serviceId ?? application.id;
   const serviceName = application.name || "Topolo App";
   return [
-    "import { createWidgetHandler } from '@topolo-io/widget-server';",
+    "import { createTopoloWidgetResponse, type TopoloWidgetDraft } from '@topolo/sdk';",
     "",
     "export interface Env {",
     "  AUTH_BASE_URL?: string;",
@@ -5875,17 +6651,8 @@ function developerWorkerTs(application) {
     `const DEFAULT_SERVICE_ID = '${serviceId}';`,
     `const SERVICE_NAME = '${escapeSingleQuoted(serviceName)}';`,
     "",
-    "// Required by the platform `native-dashboard-widget` requirement \u2014",
-    "// TopoloOne renders this in the user's live workspace whenever the app",
-    "// is installed. Replace the quick-actions placeholder with org-scoped",
-    "// stats once your data model is ready: ctx.user / ctx.orgId / ctx.orgSlug",
-    "// / ctx.isPlatformAdmin / ctx.contextType / ctx.householdId are all",
-    "// pre-resolved. Builder exceptions degrade to empty widgets, not 500s.",
-    "const widgetHandler = createWidgetHandler<Env>({",
-    "  serviceId: DEFAULT_SERVICE_ID,",
-    "  serviceName: SERVICE_NAME,",
-    "  authBaseUrl: (env) => env.AUTH_BASE_URL,",
-    "  build: () => [",
+    "function buildWidgets(): TopoloWidgetDraft[] {",
+    "  return [",
     "    {",
     "      type: 'quick-actions',",
     "      actions: [",
@@ -5893,8 +6660,8 @@ function developerWorkerTs(application) {
     "        { id: 'view-health', label: 'View health', link: '/api/health' },",
     "      ],",
     "    },",
-    "  ],",
-    "});",
+    "  ];",
+    "}",
     "",
     "export default {",
     "  async fetch(request: Request, env: Env): Promise<Response> {",
@@ -5904,8 +6671,15 @@ function developerWorkerTs(application) {
     "      return json({ ok: true, service: env.SERVICE_ID ?? DEFAULT_SERVICE_ID }, { status: 200 }, request);",
     "    }",
     "",
-    "    // /api/widget delegates fully to @topolo-io/widget-server.",
-    "    if (url.pathname === '/api/widget') return widgetHandler(request, env);",
+    "    if (url.pathname === '/api/widget') {",
+    "      const auth = await verifyTopoloRequest(request, env);",
+    "      if (!auth.ok) return json({ error: auth.error }, { status: auth.status }, request);",
+    "      return json(createTopoloWidgetResponse({",
+    "        serviceId: env.SERVICE_ID ?? DEFAULT_SERVICE_ID,",
+    "        serviceName: SERVICE_NAME,",
+    "        widgets: buildWidgets(),",
+    "      }), { status: 200, headers: { 'Cache-Control': 'public, max-age=15' } }, request);",
+    "    }",
     "",
     "    const auth = await verifyTopoloRequest(request, env);",
     "    if (!auth.ok) {",
@@ -5961,6 +6735,126 @@ function developerWorkerTs(application) {
     ""
   ].join("\n");
 }
+function topoloAppManifestJson(application, options) {
+  const slug = toSlug(application.id);
+  const resource = resourceConfig(application, options.profile);
+  const targets = {};
+  if (options.api) {
+    const bindings = {};
+    if (options.resources.d1) {
+      bindings.d1 = [
+        {
+          binding: resource.d1Binding,
+          staging: {
+            databaseName: resource.d1StagingName,
+            databaseId: "provision-after-scaffold"
+          },
+          production: {
+            databaseName: resource.d1ProductionName,
+            databaseId: "provision-after-scaffold"
+          },
+          migrationsDir: "migrations"
+        }
+      ];
+    }
+    if (options.resources.r2) {
+      bindings.r2 = [
+        {
+          binding: resource.r2Binding,
+          staging: { bucketName: resource.r2StagingName },
+          production: { bucketName: resource.r2ProductionName }
+        }
+      ];
+    }
+    if (options.resources.queue) {
+      bindings.queues = [
+        {
+          binding: resource.queueBinding,
+          staging: { queueName: resource.queueStagingName },
+          production: { queueName: resource.queueProductionName },
+          consumer: true
+        }
+      ];
+    }
+    if (options.resources.workflow) {
+      bindings.workflows = [
+        {
+          binding: resource.workflowBinding,
+          className: resource.workflowClassName,
+          staging: { name: resource.workflowStagingName },
+          production: { name: resource.workflowProductionName }
+        }
+      ];
+    }
+    targets.api = {
+      kind: "worker",
+      dir: "apps/api",
+      wranglerName: `topolo-${slug}-api`,
+      main: "src/worker.ts",
+      compatibilityFlags: ["nodejs_compat"],
+      healthcheckPath: "/api/health",
+      vars: {
+        AUTH_BASE_URL: {
+          staging: "https://auth.stg.topolo.us",
+          production: "https://auth.topolo.app"
+        }
+      },
+      ...Object.keys(bindings).length ? { bindings } : {}
+    };
+  }
+  targets.web = {
+    kind: "worker",
+    dir: "apps/web",
+    wranglerName: `topolo-${slug}`,
+    subdomain: slug,
+    main: "src/worker.ts",
+    workersDev: false,
+    assets: {
+      directory: "./dist",
+      binding: "ASSETS",
+      notFoundHandling: "single-page-application",
+      runWorkerFirst: ["/api/*"]
+    },
+    compatibilityFlags: ["nodejs_compat"],
+    buildCommand: {
+      staging: "cd ../.. && DEPLOY_ENVIRONMENT=staging VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us npm run build",
+      production: "cd ../.. && DEPLOY_ENVIRONMENT=production VITE_TOPOLO_AUTH_URL=https://auth.topolo.app npm run build"
+    },
+    healthcheckPath: options.api ? "/api/health" : "/",
+    ...options.api ? {
+      bindings: {
+        services: [
+          {
+            binding: "API",
+            service: {
+              staging: `topolo-${slug}-api-staging`,
+              production: `topolo-${slug}-api-production`
+            }
+          }
+        ]
+      }
+    } : {}
+  };
+  return `${json({
+    $schema: "./../../topolo-platform/tooling/app-manifest-schema.json",
+    name: `topolo-${slug}`,
+    serviceId: application.serviceId,
+    primaryTarget: "web",
+    compatibilityDate: CLOUDFLARE_COMPATIBILITY_DATE,
+    environments: {
+      staging: {
+        accountId: STAGING_CLOUDFLARE_ACCOUNT_ID,
+        domain: "stg.topolo.us"
+      },
+      production: {
+        accountId: CLOUDFLARE_ACCOUNT_ID,
+        domain: "topolo.app"
+      }
+    },
+    targets
+  })}
+`;
+}
 function cloudcontrolJson(application, options) {
   const slug = toSlug(application.id);
   const appPath = firstPartyAppPath(application.appDir, options.audience);
@@ -6069,16 +6963,16 @@ function cloudcontrolJson(application, options) {
     {
       kind: "worker",
       environment: "production",
-      target_name: `topolo-${slug}`,
+      target_name: `topolo-${slug}-api-production`,
       cloudflare_account_id: CLOUDFLARE_ACCOUNT_ID,
-      config_path: "wrangler.toml",
-      build_command: "npm run build",
-      output_dir: "dist",
+      config_path: "apps/api/wrangler.toml",
+      workdir: "apps/api",
+      build_command: null,
+      output_dir: null,
       production_branch: "main",
       healthcheck_path: "/api/health",
-      domains: [host],
-      routes: [host],
-      api_url: application.productionUrl,
+      domains: [],
+      routes: [],
       service_slug: serviceSlug
     },
     {
@@ -6086,36 +6980,73 @@ function cloudcontrolJson(application, options) {
       environment: "staging",
       target_name: `topolo-${slug}-staging`,
       cloudflare_account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
-      config_path: "wrangler.toml",
-      build_command: "VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us npm run build",
-      output_dir: "dist",
-      production_branch: "main",
+      config_path: "apps/web/wrangler.toml",
+      workdir: "apps/web",
+      build_command: "DEPLOY_ENVIRONMENT=staging VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us npm run build",
+      output_dir: null,
+      production_branch: "staging",
       healthcheck_path: "/api/health",
       domains: [stagingHost],
       routes: [stagingHost],
       api_url: `https://${stagingHost}`,
+      service_slug: serviceSlug,
+      sdk_service_id: application.id,
+      agent_callable: true
+    },
+    {
+      kind: "worker",
+      environment: "staging",
+      target_name: `topolo-${slug}-api-staging`,
+      cloudflare_account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
+      config_path: "apps/api/wrangler.toml",
+      workdir: "apps/api",
+      build_command: null,
+      output_dir: null,
+      production_branch: "staging",
+      healthcheck_path: "/api/health",
+      domains: [],
+      routes: [],
       service_slug: serviceSlug
+    },
+    {
+      kind: "worker",
+      environment: "production",
+      target_name: `topolo-${slug}-production`,
+      cloudflare_account_id: CLOUDFLARE_ACCOUNT_ID,
+      config_path: "apps/web/wrangler.toml",
+      workdir: "apps/web",
+      build_command: "DEPLOY_ENVIRONMENT=production VITE_TOPOLO_AUTH_URL=https://auth.topolo.app npm run build",
+      output_dir: null,
+      production_branch: "main",
+      healthcheck_path: "/api/health",
+      domains: [host],
+      routes: [host],
+      api_url: application.productionUrl,
+      service_slug: serviceSlug,
+      sdk_service_id: application.id,
+      agent_callable: true
     }
   ] : [
     {
-      kind: "pages",
+      kind: "worker",
       environment: "production",
       target_name: `topolo-${slug}`,
       cloudflare_account_id: CLOUDFLARE_ACCOUNT_ID,
-      config_path: null,
+      config_path: "wrangler.toml",
       build_command: "npm run build",
       output_dir: "dist",
       production_branch: "main",
-      healthcheck_path: null,
+      healthcheck_path: "/",
       domains: [host],
       routes: [host],
-      api_url: null
+      api_url: application.productionUrl,
+      agent_callable: false
     }
   ];
   return `${json({
     name: `topolo-${slug}`,
     description: `Canonical documentation for ${toTitle(application.name)} lives in Apps/system/TopoloDocs.`,
-    deploy_method: options.api ? "wrangler" : "cloudflare_pages",
+    deploy_method: "wrangler",
     ci_provider: "github_actions",
     repo_identity: {
       provider: "github",
@@ -6195,7 +7126,7 @@ function systemJson(application, options) {
     visibility: "internal",
     api_contract: {
       type: options.api ? "curated" : "none",
-      source: options.api ? `${appPath}/src/worker.ts` : `${appPath}/src/App.tsx`,
+      source: options.api ? `${appPath}/apps/api/src/worker.ts` : `${appPath}/apps/web/src/App.tsx`,
       notes: apiNotes
     },
     primary_hosts: application.productionUrl ? [application.productionUrl] : [],
@@ -6284,17 +7215,19 @@ function internalDocs(application, options) {
     "",
     "## Architecture",
     "",
-    "The generated browser surface uses `@topolo-io/ui-kit` for the shared landing page, shared login page, auth callback state, and shared signed shell. `vite.config.ts` includes the standard React plugin plus React runtime dedupe so linked Topolo packages resolve a single browser React runtime.",
-    options.api ? `The generated app centralizes service identity in \`${appPath}/src/service-identity.ts\`. Runtime code reads the provisioned Auth service id from the Worker \`SERVICE_ID\` binding and exposes it to the browser through the same-origin service-identity route.` : `The generated app centralizes browser service identity in \`${appPath}/src/service-identity.ts\` and reads Auth identity from the app runtime instead of calling Auth for slug lookups.`,
+    "The generated browser surface in `apps/web` uses `@topolo-io/ui-kit` for the shared landing page, shared login page, auth callback state, and shared signed shell. `apps/web/vite.config.ts` includes the standard React plugin plus React runtime dedupe so linked Topolo packages resolve a single browser React runtime.",
+    options.api ? `The generated app keeps browser service identity in \`${appPath}/apps/web/src/service-identity.ts\` and API runtime service identity in \`${appPath}/apps/api/src/service-identity.ts\`. Runtime code reads the provisioned Auth service id from the API Worker \`SERVICE_ID\` binding and exposes it to the browser through the same-origin service-identity route forwarded by the web Worker.` : `The generated app centralizes browser service identity in \`${appPath}/apps/web/src/service-identity.ts\` and reads Auth identity from the app runtime instead of calling Auth for slug lookups.`,
     "",
     "## Runtime Surfaces",
     "",
-    `- \`${appPath}/src/App.tsx\``,
-    `- \`${appPath}/src/service-identity.ts\``,
+    `- \`${appPath}/apps/web/src/App.tsx\``,
+    `- \`${appPath}/apps/web/src/service-identity.ts\``,
+    `- \`${appPath}/apps/web/wrangler.toml\``,
     "- public landing route: `/`",
     "- public sign-in route: `/login`",
     "- auth callback route: `/auth/callback`",
-    ...options.api ? [`- \`${appPath}/src/worker.ts\``] : [],
+    ...options.api ? [`- \`${appPath}/apps/api/src/worker.ts\``, `- \`${appPath}/apps/api/wrangler.toml\``] : [],
+    `- \`${appPath}/topolo.app.json\``,
     `- \`${appPath}/topolo.cloudcontrol.json\``,
     ...options.api && application.serviceId ? [`- \`Apps/system/TopoloAuth/catalog/service-manifests/${application.serviceId}.json\``] : [],
     "",
@@ -6453,6 +7386,12 @@ function serviceManifestJson(application, options) {
         name: "workspace:write",
         description: `Manage ${title} ${resourceLabel} data`,
         resourcePattern: null
+      },
+      {
+        id: `perm_${permissionPrefix}_usage_write`,
+        name: "usage:write",
+        description: `Record Nexus usage events for ${title}`,
+        resourcePattern: null
       }
     ],
     apiKeyScopes: [
@@ -6467,6 +7406,12 @@ function serviceManifestJson(application, options) {
         name: "workspace.write",
         description: `Manage ${title} ${resourceLabel} data`,
         resourcePattern: null
+      },
+      {
+        id: `aks_${permissionPrefix}_usage_write`,
+        name: "usage.write",
+        description: `Record Nexus usage events for ${title}`,
+        resourcePattern: null
       }
     ],
     roleBundles: {
@@ -6881,9 +7826,41 @@ function readRequiredString(value, message) {
   }
   return resolved;
 }
+async function applyProvisionedServiceId(manifestPath, serviceId) {
+  let raw;
+  try {
+    raw = await readFile2(manifestPath, "utf8");
+  } catch {
+    return { changed: false, previous: null };
+  }
+  let json2;
+  try {
+    json2 = JSON.parse(raw);
+  } catch {
+    return { changed: false, previous: null };
+  }
+  const previous = typeof json2.serviceId === "string" ? json2.serviceId : null;
+  if (previous === serviceId) {
+    return { changed: false, previous };
+  }
+  json2.serviceId = serviceId;
+  await writeFile3(manifestPath, `${JSON.stringify(json2, null, 2)}
+`, "utf8");
+  return { changed: true, previous };
+}
 // src/commands/apps.ts
+import { join as join3 } from "path";
 var APPLICATION_IDS = Object.keys(APPLICATIONS).sort();
+var CLOUDCONTROL_LOCAL_APPLICATION = {
+  id: "cloudcontrol",
+  appDir: "TopoloCloudControl",
+  name: "topolo-cloudcontrol",
+  packageName: "topolo-cloudcontrol",
+  productionUrl: null,
+  services: [],
+  deployTargets: []
+};
 function registerAppsCommand(program2) {
   const apps = program2.command("apps").description("List every Topolo platform application known to the SDK catalog").option("--json", "Output JSON", true).option("--no-json", "Output human-readable table").action((opts) => {
     const mode = resolveOutputMode(opts.json);
@@ -6894,7 +7871,7 @@ function registerAppsCommand(program2) {
       fail(err, mode);
     }
   });
-  apps.command("get <application>").description(`Show one Topolo application. Known applications: ${APPLICATION_IDS.join(", ")}.`).option("--json", "Output JSON", true).option("--no-json", "Output human-readable details").action((application, opts) => {
+  apps.command("get <application>").description("Show one Topolo application. Run `topolo apps --json` to discover application IDs.").option("--json", "Output JSON", true).option("--no-json", "Output human-readable details").action((application, opts) => {
     const mode = resolveOutputMode(opts.json);
     try {
       const app = resolveApplication(application);
@@ -6981,15 +7958,25 @@ function registerAppsCommand(program2) {
       });
       const writeResult = opts.write ? await writeApplicationScaffold(payload, { repoRoot: opts.repoRoot, force: opts.force }) : null;
       const provisionResult = opts.provision ? await provisionApplicationScaffold(payload) : null;
+      let serviceIdWriteBack = null;
+      if (writeResult && provisionResult?.authService?.id) {
+        const manifestFile = writeResult.files.find((f) => f.path.endsWith("topolo.app.json"));
+        if (manifestFile) {
+          const manifestPath = join3(writeResult.root, manifestFile.path);
+          const result = await applyProvisionedServiceId(manifestPath, provisionResult.authService.id);
+          serviceIdWriteBack = { ...result, path: manifestFile.path };
+        }
+      }
       const output = {
         ...payload,
         ...writeResult ? { write: writeResult } : {},
-        ...provisionResult ? { provision: provisionResult } : {}
+        ...provisionResult ? { provision: provisionResult } : {},
+        ...serviceIdWriteBack ? { serviceIdWriteBack } : {}
       };
       emit(
         output,
         mode,
-        () => formatScaffold(payload, writeResult, provisionResult)
+        () => formatScaffold(payload, writeResult, provisionResult, serviceIdWriteBack)
       );
     } catch (err) {
       fail(err, mode);
@@ -7013,7 +8000,7 @@ function applicationRows() {
 function resolveApplication(application) {
   const id = application.trim().toLowerCase();
   if (!APPLICATION_IDS.includes(id)) {
-    throw new Error(`Unknown application "${application}". Known applications: ${APPLICATION_IDS.join(", ")}`);
+    throw new Error(`Unknown application "${application}". ${formatKnownValues(APPLICATION_IDS, "applications")}`);
   }
   return APPLICATIONS[id];
 }
@@ -7035,7 +8022,12 @@ function applicationRequirementsPayload(application) {
   };
 }
 function applicationAuditPayload(application, options = {}) {
-  const report = application ? auditAllApplicationRequirements([resolveApplication(application).id]) : auditAllApplicationRequirements();
+  const requestedId = application?.trim().toLowerCase();
+  const report = requestedId === "cloudcontrol" && options.local ? {
+    version: APPLICATION_REQUIREMENTS_VERSION,
+    applications: [auditApplicationRequirements(CLOUDCONTROL_LOCAL_APPLICATION)],
+    migrationQueue: []
+  } : application ? auditAllApplicationRequirements([resolveApplication(application).id]) : auditAllApplicationRequirements();
   if (!options.local) return report;
   return enrichApplicationAuditWithLocalEvidence(report, { repoRoot: options.repoRoot });
 }
@@ -7159,6 +8151,7 @@ function formatRows(rows) {
   return lines.join("\n");
 }
 function formatApplication(application) {
+  const deployTargets = application.deployTargets;
   const lines = [
     `ID: ${application.id}`,
     `Name: ${application.name}`,
@@ -7168,10 +8161,10 @@ function formatApplication(application) {
     `Services: ${application.services.length ? application.services.join(", ") : "-"}`,
     "Targets:"
   ];
-  if (application.deployTargets.length === 0) {
+  if (deployTargets.length === 0) {
     lines.push("  - none");
   } else {
-    for (const target of application.deployTargets) {
+    for (const target of deployTargets) {
       const parts = [`${target.name} (${target.kind})`];
       if (target.serviceId) parts.push(`service=${target.serviceId}`);
       if (target.apiUrl) parts.push(`api=${target.apiUrl}`);
@@ -7223,7 +8216,7 @@ function formatAudit(payload) {
   }
   return lines.join("\n");
 }
-function formatScaffold(payload, writeResult = null, provisionResult = null) {
+function formatScaffold(payload, writeResult = null, provisionResult = null, serviceIdWriteBack = null) {
   const lines = [
     `Version: ${payload.version}`,
     `Target: ${payload.target}`,
@@ -7283,6 +8276,11 @@ function formatScaffold(payload, writeResult = null, provisionResult = null) {
       );
     }
   }
+  if (serviceIdWriteBack) {
+    lines.push(
+      serviceIdWriteBack.changed ? `  - service id written back to ${serviceIdWriteBack.path} (was ${serviceIdWriteBack.previous ?? "unset"})` : `  - service id already current in ${serviceIdWriteBack.path}`
+    );
+  }
   return lines.join("\n");
 }
 function resolveScaffoldAudience(value) {
@@ -7327,6 +8325,12 @@ function normalizeFailOn(value) {
   }
   throw new Error("Invalid --fail-on value. Use missing, needs_review, or partial.");
 }
+function formatKnownValues(values, label) {
+  const sorted = [...values].sort();
+  const preview = sorted.slice(0, 25).join(", ");
+  const suffix = sorted.length > 25 ? `, ... +${sorted.length - 25} more` : "";
+  return `Run discovery for the full ${label} list. Known snapshot sample: ${preview}${suffix}`;
+}
 function statusesAtOrWorse(threshold) {
   if (threshold === "missing") return ["missing"];
   if (threshold === "needs_review") return ["missing", "needs_review"];
@@ -7915,7 +8919,7 @@ function normalizeList(values, fallback = []) {
 // src/commands/integrations.ts
 import { readdir, readFile as readFile3, stat } from "fs/promises";
-import { join as join3, relative as relative2 } from "path";
+import { join as join4, relative as relative2 } from "path";
 function registerIntegrationsCommand(program2) {
   const integrations = program2.command("integrations").description("Generate and validate Topolo integration handoffs.");
   integrations.command("prompt").description("Print an agent prompt for adding a Topolo integration.").argument("<integration>", "Integration prompt id, currently login-with-topolo").option("--framework <framework>", "auto, authjs, express, or generic", "auto").option("--json", "Emit JSON output").action((integration, options) => {
@@ -7973,7 +8977,7 @@ ${file.content}`).join("\n");
     makeCheck(
       "package",
       "@topolo/login dependency",
-      packageJson2?.dependencies?.["@topolo/login"] || packageJson2?.devDependencies?.["@topolo/login"] ? ["package.json declares @topolo/login"] : [],
+      topoloLoginPackageEvidence(packageJson2, files),
       true
     ),
     makeCheck(
@@ -8025,6 +9029,25 @@ function makeCheck(id, label, evidence, required) {
 function matchEvidence(haystack, needles) {
   return needles.filter((needle) => haystack.toLowerCase().includes(needle.toLowerCase()));
 }
+function topoloLoginPackageEvidence(rootPackageJson, files) {
+  const evidence = [];
+  if (declaresTopoloLogin(rootPackageJson)) evidence.push("package.json declares @topolo/login");
+  for (const file of files) {
+    if (!file.path.endsWith("package.json") || file.path === "package.json") continue;
+    try {
+      if (declaresTopoloLogin(JSON.parse(file.content))) {
+        evidence.push(`${file.path} declares @topolo/login`);
+      }
+    } catch {
+    }
+  }
+  return evidence;
+}
+function declaresTopoloLogin(packageJson2) {
+  return Boolean(
+    packageJson2?.dependencies?.["@topolo/login"] || packageJson2?.devDependencies?.["@topolo/login"] || packageJson2?.peerDependencies?.["@topolo/login"]
+  );
+}
 function detectFramework(packageJson2, haystack) {
   const deps = {
     ...packageJson2?.dependencies ?? {},
@@ -8039,7 +9062,7 @@ function detectFramework(packageJson2, haystack) {
 }
 async function readPackageJson2(repoRoot) {
   try {
-    return JSON.parse(await readFile3(join3(repoRoot, "package.json"), "utf8"));
+    return JSON.parse(await readFile3(join4(repoRoot, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -8051,7 +9074,7 @@ async function collectFiles(repoRoot) {
     if (result.length > 2e3) return;
     const entries = await readdir(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = join3(dir, entry.name);
+      const fullPath = join4(dir, entry.name);
       if (entry.isDirectory()) {
         if ([".git", "node_modules", "dist", "build", ".next", "coverage"].includes(entry.name)) continue;
         await walk(fullPath);