@topolo/cli 0.1.30 → 0.1.31

package/dist/index.js

@@ -92,7 +92,7 @@ var SERVICES = {
   mail: "https://mail.topolo.app",
   mdm: "https://mdm.topolo.app",
   messages: "https://messages.topolo.app",
-  nexus: "https://nexus-api.topolo.app",
+  nexus: "https://nexus.topolo.app",
   notify: "https://notify.topolo.app",
   observability_watch: "https://observability-watch.topolo.app",
   one: "https://www.topolo.app",
@@ -641,8 +641,10 @@ var APPLICATIONS = {
       {
         "name": "topolo-feed-api",
         "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
+        "apiUrl": "https://feed-api.topolo.app",
+        "domains": [
+          "feed-api.topolo.app"
+        ],
         "routes": [],
         "serviceId": null
       },
@@ -1013,9 +1015,9 @@ var APPLICATIONS = {
       {
         "name": "topolo-nexus-gateway",
         "kind": "worker",
-        "apiUrl": "https://nexus-api.topolo.app",
+        "apiUrl": "https://nexus.topolo.app",
         "domains": [
-          "nexus-api.topolo.app"
+          "nexus.topolo.app"
         ],
         "routes": [],
         "serviceId": "nexus"
@@ -1375,8 +1377,10 @@ var APPLICATIONS = {
       {
         "name": "topolo-socialize-api",
         "kind": "worker",
-        "apiUrl": null,
-        "domains": [],
+        "apiUrl": "https://socialize-api.topolo.app",
+        "domains": [
+          "socialize-api.topolo.app"
+        ],
         "routes": [],
         "serviceId": null
       },
@@ -2220,10 +2224,14 @@ var TopoloClient = class _TopoloClient {
     if (!serviceKey) {
       throw new TopoloSdkError("unknown_service", "service is required");
     }
-    if (serviceKey === "auth") {
+    if (serviceKey === "auth" || serviceKey === "developers") {
       const overrideUrl = resolveConfiguredServiceUrl(serviceKey, this.serviceUrls);
       if (overrideUrl) return { serviceKey, baseUrl: overrideUrl };
-      return { serviceKey, baseUrl: DEFAULT_SERVICE_URLS.auth };
+      if (serviceKey === "developers") {
+        const derived = deriveDevelopersFromAuth(resolveConfiguredServiceUrl("auth", this.serviceUrls));
+        if (derived) return { serviceKey, baseUrl: derived };
+      }
+      return { serviceKey, baseUrl: DEFAULT_SERVICE_URLS[serviceKey] };
     }
     const live = await this.resolveLiveCallableService(serviceKey);
     if (live) {
@@ -2263,7 +2271,7 @@ var TopoloClient = class _TopoloClient {
     if (!normalized) return null;
     const configuredServiceId = resolveConfiguredServiceId(normalized, this.serviceIds);
     if (configuredServiceId) return configuredServiceId;
-    const authBase = resolveServiceUrl("auth", this.serviceUrls);
+    const authBase = resolveServiceUrl("developers", this.serviceUrls);
     const cacheKey = `${authBase}|${normalized}`;
     const now = Date.now();
     const cached = _TopoloClient.serviceIdCache.get(cacheKey);
@@ -2317,7 +2325,7 @@ var TopoloClient = class _TopoloClient {
     if (this.serviceCatalogCache && this.serviceCatalogCache.expiresAt > now) {
       return this.serviceCatalogCache.entries;
     }
-    const res = await this.request({ service: "auth", method: "GET", path: "/api/services/catalog" });
+    const res = await this.request({ service: "developers", method: "GET", path: "/api/services/catalog" });
     const raw = res.data?.services ?? res.services;
     if (!Array.isArray(raw)) {
       throw new TopoloSdkError(
@@ -2548,6 +2556,17 @@ function serviceKeyCandidates2(slug) {
 function normalizeLookupKey(value) {
   return String(value || "").trim().toLowerCase().replace(/\s+/g, "-");
 }
+function deriveDevelopersFromAuth(authUrl) {
+  if (!authUrl) return null;
+  try {
+    const url = new URL(authUrl);
+    if (!/^auth\./i.test(url.hostname)) return null;
+    url.hostname = url.hostname.replace(/^auth\./i, "developers.");
+    return url.origin;
+  } catch {
+    return null;
+  }
+}
 function catalogEntryMatches(entry, needle) {
   return catalogEntryLookupKeys(entry).includes(needle);
 }
@@ -3311,7 +3330,7 @@ async function pollUntilApproved(params) {
   throw new Error("Device code expired. Run `topolo auth login` again.");
 }
 function sleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 
 // src/version.ts
@@ -4694,640 +4713,150 @@ function isFile(filePath) {
 
 // src/commands/app-scaffold.ts
 import { randomBytes } from "crypto";
+import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
+import { dirname as dirname3, resolve as resolve2 } from "path";
+
+// src/commands/app-scaffold-normalizers.ts
 import { constants } from "fs";
-import { access, mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
-import { dirname as dirname3, relative, resolve } from "path";
-var CLOUDFLARE_ACCOUNT_ID = "49ef1ba682ad8cfd720c86699ae17521";
-var STAGING_CLOUDFLARE_ACCOUNT_ID = "4f4e1c69a3830946f9fea7b1eb7531ac";
-var CLOUDFLARE_COMPATIBILITY_DATE = "2026-05-05";
-var CURRENT_VERIFICATION_DATE = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-function generateOpaqueServiceId() {
-  return `srv_${randomBytes(9).toString("base64url")}`;
+import { access } from "fs/promises";
+import { relative, resolve } from "path";
+function normalizeTarget(value) {
+  if (!value) return "platform";
+  if (value === "platform" || value === "developer") return value;
+  throw new Error("Invalid scaffold target. Use platform or developer.");
 }
-function applicationScaffoldPayload(application, options = {}) {
-  const target = normalizeTarget(options.target);
-  const portfolio = target === "platform" ? normalizePortfolio(options.portfolio) : null;
-  const requestedId = normalizeApplicationId(application);
-  const id = target === "platform" ? normalizeFirstPartyApplicationId(requestedId) : requestedId;
-  const slug = toSlug(id);
-  const catalogApplication = APPLICATIONS[id];
-  const browser = options.browser !== false;
-  const api = options.api ?? target === "platform";
-  const audience = normalizeAudience(
-    options.audience,
-    target === "platform" ? portfolio : null
-  );
-  const tenancy = normalizeTenancy(options.tenancy, audience);
-  const surfaceModel = normalizeSurfaceModel(options.surfaceModel);
-  const containerAppId = normalizeContainerAppId(options.containerAppId, surfaceModel);
-  const profile = normalizeScaffoldProfile(options.profile);
-  const resources = resolveScaffoldResources(profile, options);
-  const ownerType = target === "platform" ? "topolo_first_party" : "third_party";
-  const distributionModel = target === "platform" ? "marketplace" : "organization_internal";
-  const appDir = options.appDir ?? catalogApplication?.appDir ?? (target === "platform" ? `Topolo${toPascalCase(id)}` : `topolo-${slug}`);
-  const name = options.name ?? catalogApplication?.name ?? `topolo-${slug}`;
-  const packageName = options.packageName ?? catalogApplication?.packageName ?? `topolo-${slug}`;
-  const serviceSlug = api ? target === "platform" ? `topolo-${slug}` : id : null;
-  const defaultServiceId = target === "platform" ? generateOpaqueServiceId() : catalogApplication?.services[0] ?? id;
-  const serviceId = api ? options.service ?? defaultServiceId : null;
-  const productionUrl = browser ? options.productionUrl ?? catalogApplication?.productionUrl ?? `https://${slug}.topolo.app` : null;
-  const scopes = scaffoldScopes({ browser, api });
-  const capabilities = scaffoldCapabilities({ browser, api, distributionModel });
-  const ciWorkflowPath = target === "platform" ? ".github/workflows/topolo-conformance.yml" : null;
-  const ciWorkflow = target === "platform" ? topoloConformanceWorkflow({ id, appDir, audience }) : null;
-  const applicationPayload = {
-    id,
-    name,
-    appDir,
-    packageName,
-    productionUrl,
-    serviceSlug,
-    serviceId
-  };
-  return {
-    version: APPLICATION_REQUIREMENTS_VERSION,
-    target,
-    ownerType,
-    portfolio,
-    audience,
-    tenancy,
-    surfaceModel,
-    containerAppId,
-    profile,
-    resources,
-    distributionModel,
-    capabilities,
-    application: applicationPayload,
-    scopes,
-    requirements: APPLICATION_REQUIREMENTS.filter(
-      (requirement) => requirement.appliesTo.some((scope) => scopes.includes(scope))
-    ),
-    packages: scaffoldPackages({ browser, api, target }),
-    files: scaffoldFiles({
-      payload: {
-        ownerType,
-        portfolio,
-        audience,
-        tenancy,
-        surfaceModel,
-        containerAppId,
-        profile,
-        resources,
-        distributionModel,
-        capabilities
-      },
-      application: applicationPayload,
-      target,
-      browser,
-      api,
-      ciWorkflow
-    }),
-    commands: scaffoldCommands({
-      id,
-      target,
-      audience,
-      tenancy,
-      portfolio,
-      profile
-    }),
-    ciWorkflowPath,
-    ciWorkflow
-  };
+function normalizePortfolio(value) {
+  if (!value) return "platform";
+  if (value === "platform" || value === "personal") return value;
+  throw new Error("Invalid scaffold portfolio. Use platform or personal.");
 }
-async function writeApplicationScaffold(payload, options = {}) {
-  const root = resolve(options.repoRoot ?? process.cwd());
-  const plannedFiles = payload.files.map((file) => ({
-    file,
-    absolutePath: resolveInside(root, file.path)
-  }));
-  const existingFiles = [];
-  for (const planned of plannedFiles) {
-    if (await pathExists(planned.absolutePath)) {
-      existingFiles.push(planned.file.path);
-    }
+function normalizeAudience(value, portfolio) {
+  if (!value) {
+    return portfolio === "personal" ? "personal" : "business";
   }
-  if (existingFiles.length > 0 && !options.force) {
-    throw new Error(
-      [
-        "Refusing to overwrite existing scaffold files:",
-        ...existingFiles.map((filePath) => `- ${filePath}`),
-        "Pass --force to overwrite these files."
-      ].join("\n")
-    );
+  if (value === "business" || value === "personal") {
+    return value;
   }
-  const files = [];
-  for (const planned of plannedFiles) {
-    const existed = await pathExists(planned.absolutePath);
-    await mkdir2(dirname3(planned.absolutePath), { recursive: true });
-    await writeFile2(planned.absolutePath, planned.file.content, "utf8");
-    files.push({
-      path: planned.file.path,
-      status: existed ? "overwritten" : "created"
-    });
+  throw new Error("Invalid scaffold audience. Use business or personal.");
+}
+function normalizeTenancy(value, audience) {
+  const resolved = value ?? (audience === "personal" ? "household" : "organization");
+  if (resolved !== "organization" && resolved !== "household") {
+    throw new Error("Invalid scaffold tenancy. Use organization or household.");
   }
-  return { root, files };
+  if (audience === "business" && resolved !== "organization") {
+    throw new Error("Business scaffolds must use organization tenancy.");
+  }
+  if (audience === "personal" && resolved !== "household") {
+    throw new Error("Personal scaffolds must use household tenancy.");
+  }
+  return resolved;
 }
-function scaffoldScopes(options) {
-  const scopes = ["all"];
-  if (options.browser) scopes.push("browser");
-  if (options.api) {
-    scopes.push("api", "agent_surface");
+function normalizeSurfaceModel(value) {
+  if (!value) return "web_app";
+  if (value === "web_app" || value === "mobile_container" || value === "mobile_module" || value === "messaging_surface") {
+    return value;
   }
-  return scopes;
+  throw new Error(
+    "Invalid scaffold surface model. Use web_app, mobile_container, mobile_module, or messaging_surface."
+  );
 }
-function scaffoldPackages(options) {
-  if (options.target === "developer") {
-    return options.browser ? ["@topolo/login"] : [];
+function normalizeScaffoldProfile(value) {
+  if (!value) return null;
+  if (value === "spatial-assets") return value;
+  throw new Error("Invalid scaffold profile. Use spatial-assets.");
+}
+function resolveScaffoldResources(profile, options) {
+  const profileResources = profile === "spatial-assets" ? { d1: true, r2: true, queue: true, workflow: true, containerProcessing: true } : { d1: false, r2: false, queue: false, workflow: false, containerProcessing: false };
+  return {
+    d1: Boolean(profileResources.d1 || options.withD1),
+    r2: Boolean(profileResources.r2 || options.withR2),
+    queue: Boolean(profileResources.queue || options.withQueue),
+    workflow: Boolean(profileResources.workflow || options.withWorkflow),
+    containerProcessing: Boolean(profileResources.containerProcessing || options.withContainerProcessing)
+  };
+}
+function normalizeContainerAppId(value, surfaceModel) {
+  const trimmed = String(value || "").trim();
+  if (surfaceModel === "mobile_module") {
+    if (!trimmed) {
+      throw new Error("Mobile-module scaffolds require --container-app-id.");
+    }
+    return trimmed;
   }
-  const packages = /* @__PURE__ */ new Set();
-  if (options.browser) {
-    packages.add("@topolo-io/app-funnel");
-    packages.add("@topolo-io/app-launcher");
-    packages.add("@topolo-io/app-shell");
-    packages.add("@topolo-io/auth-client");
-    packages.add("@topolo-io/ui-kit");
+  return trimmed || null;
+}
+function normalizeApplicationId(application) {
+  const raw = application.trim().toLowerCase();
+  const normalized = raw.replace(/-/g, "_");
+  if (Object.prototype.hasOwnProperty.call(APPLICATIONS, raw)) {
+    return raw;
   }
-  if (options.api) {
-    packages.add("@topolo-io/worker-runtime");
-    packages.add("@topolo/sdk");
+  if (Object.prototype.hasOwnProperty.call(APPLICATIONS, normalized)) {
+    return normalized;
   }
-  return Array.from(packages);
+  if (/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(raw) || /^[a-z0-9](?:[a-z0-9_]*[a-z0-9])?$/.test(raw)) {
+    return normalized;
+  }
+  throw new Error(
+    "Application id must be kebab-case or snake_case using lowercase letters, numbers, hyphens, and underscores."
+  );
 }
-function scaffoldCapabilities(options) {
-  const capabilities = [];
-  if (options.browser) {
-    capabilities.push("login", "launcher");
+function normalizeFirstPartyApplicationId(applicationId) {
+  if (applicationId.startsWith("topolo_") && applicationId.length > "topolo_".length) {
+    return applicationId.slice("topolo_".length);
   }
-  if (options.distributionModel === "marketplace") capabilities.push("marketplace");
-  if (options.api) capabilities.push("api", "widget");
-  return capabilities;
+  return applicationId;
 }
-function firstPartyAppPath(appDir, audience) {
-  if (appDir === "TopoloCli" || appDir === "TopoloCLI") return "Apps/system/TopoloCLI";
-  if (appDir === "TopoloDocs") return "Apps/system/TopoloDocs";
-  if (appDir === "TopoloAuth") return "Apps/system/TopoloAuth";
-  return `${audience === "personal" ? "Apps/personal" : "Apps/business"}/${appDir}`;
+function toSlug(value) {
+  return value.replace(/_/g, "-");
 }
-function scaffoldFiles(options) {
-  const { application, target } = options;
-  const slug = toSlug(application.id);
-  const base = target === "platform" ? firstPartyAppPath(application.appDir, options.payload.audience) : application.appDir;
-  const browserBase = target === "platform" ? `${base}/apps/web` : base;
-  const apiBase = target === "platform" ? `${base}/apps/api` : base;
-  const files = [
-    {
-      path: `${base}/package.json`,
-      purpose: "Package metadata and verification commands.",
-      requiredSignals: [
-        "name matches the packageName in the SDK application catalog",
-        "scripts include build plus typecheck where the stack supports them"
-      ],
-      content: packageJson(application, target, {
-        browser: options.browser,
-        api: options.api,
-        resources: options.payload.resources
-      })
-    },
-    {
-      path: `${base}/README.md`,
-      purpose: "Starter README with install, run, and verification commands.",
-      requiredSignals: [
-        "documents the generated app target",
-        "points maintainers to the shared Topolo packages used by the scaffold"
-      ],
-      content: readme(application, target, {
-        api: options.api,
-        audience: options.payload.audience,
-        tenancy: options.payload.tenancy,
-        portfolio: options.payload.portfolio,
-        profile: options.payload.profile,
-        resources: options.payload.resources
-      })
-    },
-    {
-      path: `${base}/.gitignore`,
-      purpose: "Generated-app ignore rules.",
-      requiredSignals: [
-        "ignores dependency installs and build output",
-        "keeps local environment files out of source control"
-      ],
-      content: gitignore()
-    },
-    {
-      path: `${base}/tsconfig.json`,
-      purpose: "TypeScript configuration for the generated app.",
-      requiredSignals: [
-        "uses strict mode",
-        "includes browser DOM types for React and Worker types for API-backed apps"
-      ],
-      content: tsconfigJson(options.api, target)
-    },
-    {
-      path: `${browserBase}/vite.config.ts`,
-      purpose: "Vite browser build configuration.",
-      requiredSignals: [
-        "builds the authenticated browser surface",
-        "keeps generated apps on the standard React/Vite baseline"
-      ],
-      content: viteConfig(target)
-    },
-    {
-      path: `${browserBase}/index.html`,
-      purpose: "Browser entry document.",
-      requiredSignals: [
-        "mounts the React app at #root",
-        "uses the generated application display name"
-      ],
-      content: indexHtml(application.name)
-    },
-    {
-      path: `${browserBase}/src/main.tsx`,
-      purpose: "React app entrypoint.",
-      requiredSignals: [
-        "renders the generated app component",
-        "imports the generated app stylesheet"
-      ],
-      content: mainTsx()
-    },
-    {
-      path: `${browserBase}/src/env.d.ts`,
-      purpose: "Vite environment variable typing.",
-      requiredSignals: [
-        "loads vite/client import.meta.env types",
-        "declares the Topolo environment variables consumed by the starter"
-      ],
-      content: envDts(options.api)
-    },
-    ...options.payload.resources.workflow ? [
-      {
-        path: `${base}/src/cloudflare-workers.d.ts`,
-        purpose: "Minimal Cloudflare Workflow entrypoint typing for scaffolded Workers.",
-        requiredSignals: [
-          "declares cloudflare:workers WorkflowEntrypoint for TypeScript",
-          "keeps Workflow imports deployable without adding a new dependency"
-        ],
-        content: cloudflareWorkersDts()
-      }
-    ] : [],
-    {
-      path: `${browserBase}/src/styles.css`,
-      purpose: "Minimal app-local styles outside the shared Topolo shell.",
-      requiredSignals: [
-        "does not fork the shared shell chrome",
-        "keeps app-specific layout scoped under generated classes"
-      ],
-      content: stylesCss()
-    }
-  ];
-  if (target === "platform") {
-    files.push(
-      {
-        path: `${base}/topolo.app.json`,
-        purpose: "Canonical app manifest that drives generated Wrangler and CloudControl metadata.",
-        requiredSignals: [
-          "declares web/api targets with canonical names and app-local target directories",
-          "keeps Cloudflare account, domain, service id, and bindings in one manifest source of truth"
-        ],
-        content: topoloAppManifestJson(application, {
-          api: options.api,
-          resources: options.payload.resources,
-          profile: options.payload.profile
-        })
-      },
-      {
-        path: `${base}/topolo.cloudcontrol.json`,
-        purpose: "CloudControl source of truth for deploy targets, routes, bindings, and CI metadata.",
-        requiredSignals: [
-          "production URLs and Cloudflare targets are explicit",
-          "resource bindings and required secrets are declared without secret values"
-        ],
-        content: cloudcontrolJson(application, {
-          api: options.api,
-          audience: options.payload.audience,
-          profile: options.payload.profile,
-          resources: options.payload.resources
-        })
-      },
-      {
-        path: `${base}/.github/workflows/topolo-conformance.yml`,
-        purpose: "PR/push gate that runs the local Topolo app audit with docs evidence.",
-        requiredSignals: [
-          "checks out this repo under its Apps lane directory",
-          "checks out TopoloDocs under Apps/system/TopoloDocs",
-          "checks out topolo-sdk and TopoloCli from main so the gate does not wait for an npm publish",
-          "runs topolo apps audit with --local and --fail-on needs_review"
-        ],
-        content: options.ciWorkflow ?? ""
-      },
-      {
-        path: `Apps/system/TopoloDocs/src/content/systems/topolo-${slug}.json`,
-        purpose: "Canonical system registry entry.",
-        requiredSignals: [
-          `repo_paths includes ${base}`,
-          "doc_paths includes internal handbook coverage",
-          "security_assurance records the auth, tenancy, deployment, and verification boundary"
-        ],
-        content: systemJson(application, {
-          api: options.api,
-          audience: options.payload.audience,
-          tenancy: options.payload.tenancy,
-          portfolio: options.payload.portfolio,
-          profile: options.payload.profile,
-          resources: options.payload.resources
-        })
-      },
-      {
-        path: `Apps/system/TopoloDocs/src/content/internal/apps/${slug}.mdx`,
-        purpose: "Internal operator handbook.",
-        requiredSignals: [
-          "documents ownership, routes, auth boundary, deployment, operations, and verification",
-          "last_verified is updated when behavior changes"
-        ],
-        content: internalDocs(application, {
-          api: options.api,
-          audience: options.payload.audience,
-          tenancy: options.payload.tenancy,
-          portfolio: options.payload.portfolio,
-          profile: options.payload.profile,
-          resources: options.payload.resources
-        })
-      },
-      {
-        path: `Apps/system/TopoloDocs/src/content/public/applications/${slug}.mdx`,
-        purpose: "Public application overview.",
-        requiredSignals: [
-          "documents the product surface without internal-only details",
-          "links back to the canonical system registry entry"
-        ],
-        content: publicDocs(application, {
-          api: options.api,
-          audience: options.payload.audience,
-          tenancy: options.payload.tenancy,
-          portfolio: options.payload.portfolio,
-          profile: options.payload.profile,
-          resources: options.payload.resources
-        })
-      }
-    );
-    if (options.api && application.serviceId) {
-      files.push(
-        {
-          path: `Apps/system/TopoloAuth/catalog/service-manifests/${application.serviceId}.json`,
-          purpose: "Auth service manifest for first-party permissions, role bundles, and API-key scopes.",
-          requiredSignals: [
-            "serviceId matches the generated Worker service id",
-            "permissions, role bundles, and API-key scopes exist before the app is catalog-visible",
-            "systems metadata maps the service back to the generated TopoloDocs entries"
-          ],
-          content: serviceManifestJson(application, {
-            audience: options.payload.audience,
-            tenancy: options.payload.tenancy
-          })
-        }
-      );
-    }
-  } else {
-    files.push(
-      {
-        path: `${base}/topolo.app.json`,
-        purpose: "Third-party Topolo application manifest.",
-        requiredSignals: [
-          "declares the external app id, callback URLs, and requested platform scopes",
-          "does not include internal Topolo CloudControl or canonical-docs ownership"
-        ],
-        content: developerManifest(application, {
-          api: options.api,
-          audience: options.payload.audience,
-          tenancy: options.payload.tenancy,
-          surfaceModel: options.payload.surfaceModel,
-          containerAppId: options.payload.containerAppId,
-          distributionModel: options.payload.distributionModel,
-          capabilities: options.payload.capabilities
-        })
-      },
-      {
-        path: `${base}/.env.example`,
-        purpose: "Developer environment template for local auth configuration.",
-        requiredSignals: [
-          "names the Topolo Auth URL",
-          "keeps OAuth client ids and service ids out of source control by default"
-        ],
-        content: envExample(application)
-      }
-    );
+function toConstantCase(value) {
+  return value.split(/[-_]/).filter(Boolean).join("_").toUpperCase();
+}
+function toPascalCase(value) {
+  const acronyms = /* @__PURE__ */ new Set(["api", "cli", "crm", "mcp", "mdm", "p2p"]);
+  return value.split(/[-_]/).filter(Boolean).map((part) => acronyms.has(part.toLowerCase()) ? part.toUpperCase() : part.slice(0, 1).toUpperCase() + part.slice(1)).join("");
+}
+function toTitle(value) {
+  return value.replace(/^topolo[-_\s]*/i, "Topolo ").split(/[-_\s]+/).filter(Boolean).map((part) => part.slice(0, 1).toUpperCase() + part.slice(1)).join(" ");
+}
+function json(value) {
+  return JSON.stringify(value, null, 2);
+}
+async function pathExists(path4) {
+  try {
+    await access(path4, constants.F_OK);
+    return true;
+  } catch {
+    return false;
   }
-  if (options.browser) {
-    if (target === "platform") {
-      files.push({
-        path: `${browserBase}/src/service-identity.ts`,
-        purpose: "Central service identity resolver shared by browser and Worker runtime surfaces.",
-        requiredSignals: [
-          "exports the generated app id, display name, and stable Auth service slug",
-          "requires the provisioned Auth service id from the Worker deployment config"
-        ],
-        content: serviceIdentityTs(application)
-      });
-    }
-    files.push({
-      path: `${browserBase}/src/App.tsx`,
-      purpose: "Authenticated browser surface.",
-      requiredSignals: [
-        "bootstraps routes, auth provider, and shared shell through @topolo-io/app-shell",
-        "uses @topolo-io/auth-client through the app-shell wrapper for app-origin auth flows",
-        "keeps launcher and account-menu behavior on the shared platform surface",
-        "passes app-specific account actions through accountMenuItems or TopoloAccountMenu"
-      ],
-      content: appTsx(application, target, {
-        audience: options.payload.audience,
-        portfolio: options.payload.portfolio
-      })
-    });
-  }
-  if (options.api) {
-    files.push(
-      {
-        path: `${apiBase}/wrangler.toml`,
-        purpose: "Cloudflare Worker runtime configuration.",
-        requiredSignals: [
-          "bindings match topolo.cloudcontrol.json or topolo.app.json",
-          "secrets are referenced by name only"
-        ],
-        content: target === "platform" ? platformApiWranglerToml(application, options.payload.resources, options.payload.profile) : wranglerToml(application, target, options.payload.resources, options.payload.profile)
-      },
-      {
-        path: `${apiBase}/src/worker.ts`,
-        purpose: "Protected service boundary.",
-        requiredSignals: [
-          "uses @topolo-io/worker-runtime for Worker auth, gatewaying, headers, and request helpers",
-          "derives organization from the credential rather than client-supplied orgId",
-          "emits or propagates X-Topolo-Request-Id and X-Topolo-Client"
-        ],
-        content: workerTs(application, target, {
-          audience: options.payload.audience,
-          tenancy: options.payload.tenancy,
-          profile: options.payload.profile,
-          resources: options.payload.resources
-        })
-      }
-    );
-    if (target === "platform") {
-      files.push(
-        {
-          path: `${apiBase}/src/service-identity.ts`,
-          purpose: "Runtime service identity resolver for the API Worker.",
-          requiredSignals: [
-            "resolves the concrete Auth service id from Worker vars",
-            "keeps the API Worker independent from browser-only import.meta usage"
-          ],
-          content: apiServiceIdentityTs(application)
-        },
-        {
-          path: `${browserBase}/src/worker.ts`,
-          purpose: "Browser Worker that serves assets and forwards API paths to the API Worker binding.",
-          requiredSignals: [
-            "keeps the frontend Worker thin",
-            "routes /api/* to the API service binding instead of owning backend routes locally"
-          ],
-          content: webWorkerTs(application)
-        },
-        {
-          path: `${browserBase}/wrangler.toml`,
-          purpose: "Cloudflare Worker static-assets configuration for the browser surface.",
-          requiredSignals: [
-            "serves Vite assets through a Worker with assets",
-            "binds the frontend Worker to the API Worker for /api/* requests"
-          ],
-          content: platformWebWranglerToml(application)
-        }
-      );
-    }
-  }
-  return files;
 }
-function scaffoldCommands(options) {
-  const scaffoldId = toSlug(options.id);
-  if (options.target === "developer") {
-    const audienceFlags = options.audience === "personal" ? " --audience personal --tenancy household" : "";
-    return [
-      `topolo apps scaffold ${scaffoldId}${audienceFlags} --write --repo-root .`,
-      `cd topolo-${scaffoldId}`,
-      "npm install",
-      "npm run typecheck",
-      "npm run build"
-    ];
+function resolveInside(root, filePath) {
+  const resolved = resolve(root, filePath);
+  const relativePath = relative(root, resolved);
+  if (relativePath.startsWith("..") || relativePath === "" || relativePath.startsWith("/")) {
+    throw new Error(`Scaffold file path escapes the target root: ${filePath}`);
   }
-  const portfolioFlags = options.portfolio === "personal" ? " --portfolio personal" : "";
-  const profileFlags = options.profile ? ` --profile ${options.profile}` : "";
-  return [
-    `topolo platform apps scaffold ${scaffoldId}${portfolioFlags}${profileFlags} --write --provision --repo-root /Users/ashes/Projects/Topolo/Platform --json`,
-    "topolo apps requirements --json",
-    `topolo apps audit ${options.id} --local --repo-root /Users/ashes/Projects/Topolo/Platform --fail-on needs_review --json`,
-    `topolo apps audit ${options.id} --local --repo-root /Users/ashes/Projects/Topolo/Platform --fail-on partial --json`
-  ];
+  return resolved;
 }
-function topoloConformanceWorkflow(options) {
-  const appPath = firstPartyAppPath(options.appDir, options.audience);
-  const docsCheckoutStep = options.appDir === "TopoloDocs" ? [] : [
-    "",
-    "      - name: Checkout TopoloDocs",
-    `        if: steps.app-token.outputs.token != '' || env.HAS_TOPOLO_CI_REPO_TOKEN == 'true'`,
-    "        uses: actions/checkout@v4",
-    "        with:",
-    "          repository: Topolo-io/TopoloDocs",
-    "          path: Apps/system/TopoloDocs",
-    "          token: ${{ steps.app-token.outputs.token || secrets.TOPOLO_CI_REPO_TOKEN }}"
-  ];
-  const cliCheckoutStep = options.appDir === "TopoloCLI" || options.appDir === "TopoloCli" ? [] : [
-    "",
-    "      - name: Checkout Topolo CLI",
-    `        if: steps.app-token.outputs.token != '' || env.HAS_TOPOLO_CI_REPO_TOKEN == 'true'`,
-    "        uses: actions/checkout@v4",
-    "        with:",
-    "          repository: Topolo-io/TopoloCli",
-    "          path: Apps/system/TopoloCLI",
-    "          token: ${{ steps.app-token.outputs.token || secrets.TOPOLO_CI_REPO_TOKEN }}"
-  ];
-  return [
-    "name: Topolo App Conformance",
-    "",
-    "on:",
-    "  pull_request:",
-    "  push:",
-    "    branches:",
-    "      - main",
-    "  workflow_dispatch:",
-    "",
-    "permissions:",
-    "  contents: read",
-    "",
-    "jobs:",
-    "  conformance:",
-    "    runs-on: ubuntu-latest",
-    "    env:",
-    `      HAS_TOPOLO_PACKAGES_APP: \${{ secrets.TOPOLO_PACKAGES_APP_ID != '' && secrets.TOPOLO_PACKAGES_APP_PRIVATE_KEY != '' }}`,
-    `      HAS_TOPOLO_CI_REPO_TOKEN: \${{ secrets.TOPOLO_CI_REPO_TOKEN != '' }}`,
-    "    steps:",
-    "      - name: Checkout application",
-    "        uses: actions/checkout@v4",
-    "        with:",
-    `          path: ${appPath}`,
-    "",
-    "      - name: Mint Topolo cross-repo token",
-    "        id: app-token",
-    `        if: env.HAS_TOPOLO_PACKAGES_APP == 'true'`,
-    "        uses: actions/create-github-app-token@v1",
-    "        with:",
-    `          app-id: \${{ secrets.TOPOLO_PACKAGES_APP_ID }}`,
-    `          private-key: \${{ secrets.TOPOLO_PACKAGES_APP_PRIVATE_KEY }}`,
-    "          owner: Topolo-io",
-    ...docsCheckoutStep,
-    "",
-    "      - name: Checkout Topolo SDK",
-    `        if: steps.app-token.outputs.token != '' || env.HAS_TOPOLO_CI_REPO_TOKEN == 'true'`,
-    "        uses: actions/checkout@v4",
-    "        with:",
-    "          repository: Topolo-io/topolo-sdk",
-    "          path: Apps/packages/topolo-sdk",
-    "          token: ${{ steps.app-token.outputs.token || secrets.TOPOLO_CI_REPO_TOKEN }}",
-    ...cliCheckoutStep,
-    "",
-    "      - name: Skip conformance without cross-repo token",
-    `        if: steps.app-token.outputs.token == '' && env.HAS_TOPOLO_CI_REPO_TOKEN != 'true'`,
-    "        run: |",
-    '          echo "::warning::Skipping Topolo app conformance because no Topolo cross-repo token is available to this workflow context."',
-    "",
-    "      - name: Setup Node.js",
-    `        if: steps.app-token.outputs.token != '' || env.HAS_TOPOLO_CI_REPO_TOKEN == 'true'`,
-    "        uses: actions/setup-node@v4",
-    "        with:",
-    "          node-version: 20",
-    "",
-    "      - name: Build Topolo SDK",
-    `        if: steps.app-token.outputs.token != '' || env.HAS_TOPOLO_CI_REPO_TOKEN == 'true'`,
-    "        working-directory: Apps/packages/topolo-sdk",
-    "        run: |",
-    "          npm install --no-audit --no-fund",
-    "          npm run build",
-    "",
-    "      - name: Build Topolo CLI",
-    `        if: steps.app-token.outputs.token != '' || env.HAS_TOPOLO_CI_REPO_TOKEN == 'true'`,
-    "        working-directory: Apps/system/TopoloCLI",
-    "        run: |",
-    "          npm install --no-audit --no-fund",
-    "          npm run build",
-    "",
-    "      - name: Run Topolo app conformance audit",
-    `        if: steps.app-token.outputs.token != '' || env.HAS_TOPOLO_CI_REPO_TOKEN == 'true'`,
-    "        run: |",
-    `          node Apps/system/TopoloCLI/dist/index.js apps audit ${options.id} --local --repo-root "$GITHUB_WORKSPACE" --fail-on needs_review --json`,
-    "",
-    "      - name: Record green CI evidence",
-    `        if: \${{ success() && (steps.app-token.outputs.token != '' || env.HAS_TOPOLO_CI_REPO_TOKEN == 'true') }}`,
-    `        working-directory: ${appPath}`,
-    "        run: |",
-    `          node "$GITHUB_WORKSPACE/Apps/system/TopoloCLI/dist/index.js" apps record-evidence ${options.id} --build --typecheck --test --commit "$GITHUB_SHA"`
-  ].join("\n");
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function escapeSingleQuoted(value) {
+  return value.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+}
+function escapeFrontmatter(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+function firstPartyAppPath(appDir, audience) {
+  if (appDir === "TopoloCli" || appDir === "TopoloCLI") return "Apps/system/TopoloCLI";
+  if (appDir === "TopoloDocs") return "Apps/system/TopoloDocs";
+  if (appDir === "TopoloAuth") return "Apps/system/TopoloAuth";
+  return `${audience === "personal" ? "Apps/personal" : "Apps/business"}/${appDir}`;
 }
+
+// src/commands/app-scaffold-package-template.ts
 function packageJson(application, target, options) {
   const dependencies = {};
   const devDependencies = {
@@ -5423,11 +4952,12 @@ function hasScaffoldResources(resources) {
 function resourceConfig(application, profile) {
   const slug = toSlug(application.id);
   const pascal = toPascalCase(application.id);
+  const constant = toConstantCase(application.id);
   if (profile === "spatial-assets") {
     return {
-      d1Binding: "APP_DB",
-      d1ProductionName: `topolo-${slug}-production-db`,
-      d1StagingName: `topolo-${slug}-staging-db`,
+      d1Binding: `${constant}_CORE_DB`,
+      d1ProductionName: `topolo-${slug}-core-prod`,
+      d1StagingName: `topolo-${slug}-core-staging`,
       r2Binding: "SPACES_ASSETS",
       r2ProductionName: `topolo-${slug}-assets`,
       r2StagingName: `topolo-${slug}-assets-staging`,
@@ -5443,9 +4973,9 @@ function resourceConfig(application, profile) {
     };
   }
   return {
-    d1Binding: "APP_DB",
-    d1ProductionName: `topolo-${slug}-prod`,
-    d1StagingName: `topolo-${slug}-staging`,
+    d1Binding: `${constant}_CORE_DB`,
+    d1ProductionName: `topolo-${slug}-core-prod`,
+    d1StagingName: `topolo-${slug}-core-staging`,
     r2Binding: "APP_ASSETS",
     r2ProductionName: `topolo-${slug}-assets`,
     r2StagingName: `topolo-${slug}-assets-staging`,
@@ -5460,6 +4990,8 @@ function resourceConfig(application, profile) {
     containerStagingName: `topolo-${slug}-processor-staging`
   };
 }
+
+// src/commands/app-scaffold-browser-template.ts
 function readme(application, target, options) {
   const displayName = toTitle(application.name);
   const slug = toSlug(application.id);
@@ -5904,6 +5436,8 @@ function stylesCss() {
     ""
   ].join("\n");
 }
+
+// src/commands/app-scaffold-app-template.ts
 function appTsx(application, target, options) {
   if (target === "developer") return developerAppTsx(application);
   return platformAppTsx(application, options);
@@ -6331,6 +5865,13 @@ function developerAppTsx(application) {
     ""
   ].join("\n");
 }
+
+// src/commands/app-scaffold-cloudflare-constants.ts
+var CLOUDFLARE_ACCOUNT_ID = "49ef1ba682ad8cfd720c86699ae17521";
+var STAGING_CLOUDFLARE_ACCOUNT_ID = "4f4e1c69a3830946f9fea7b1eb7531ac";
+var CLOUDFLARE_COMPATIBILITY_DATE = "2026-05-05";
+
+// src/commands/app-scaffold-worker-template.ts
 function webWorkerTs(application) {
   const serviceName = toTitle(application.name);
   return [
@@ -6448,7 +5989,7 @@ function platformApiWranglerToml(application, resources, profile) {
     "",
     "[vars]",
     'AUTH_BASE_URL = "https://auth.topolo.app"',
-    'NEXUS_GATEWAY_URL = "https://nexus-api.topolo.app"',
+    'NEXUS_GATEWAY_URL = "https://nexus.topolo.app"',
     `NEXUS_APP_ID = "${slug}"`,
     `SERVICE_ID = "${application.serviceId ?? ""}"`,
     `VITE_TOPOLO_SERVICE_ID = "${application.serviceId ?? ""}"`,
@@ -6463,7 +6004,7 @@ function platformApiWranglerToml(application, resources, profile) {
     "",
     "[env.staging.vars]",
     'AUTH_BASE_URL = "https://auth.stg.topolo.us"',
-    'NEXUS_GATEWAY_URL = "https://nexus-api.stg.topolo.us"',
+    'NEXUS_GATEWAY_URL = "https://nexus.stg.topolo.us"',
     `NEXUS_APP_ID = "${slug}"`,
     `SERVICE_ID = "${application.serviceId ?? ""}"`,
     `VITE_TOPOLO_SERVICE_ID = "${application.serviceId ?? ""}"`,
@@ -6478,7 +6019,7 @@ function platformApiWranglerToml(application, resources, profile) {
     "",
     "[env.production.vars]",
     'AUTH_BASE_URL = "https://auth.topolo.app"',
-    'NEXUS_GATEWAY_URL = "https://nexus-api.topolo.app"',
+    'NEXUS_GATEWAY_URL = "https://nexus.topolo.app"',
     `NEXUS_APP_ID = "${slug}"`,
     `SERVICE_ID = "${application.serviceId ?? ""}"`,
     `VITE_TOPOLO_SERVICE_ID = "${application.serviceId ?? ""}"`,
@@ -6574,7 +6115,7 @@ function wranglerToml(application, target, resources, profile) {
     "",
     "[vars]",
     'AUTH_BASE_URL = "https://auth.topolo.app"',
-    'NEXUS_GATEWAY_URL = "https://nexus-api.topolo.app"',
+    'NEXUS_GATEWAY_URL = "https://nexus.topolo.app"',
     runtimeIdentityVar,
     ""
   );
@@ -6629,7 +6170,7 @@ function wranglerToml(application, target, resources, profile) {
       "",
       "[env.staging.vars]",
       'AUTH_BASE_URL = "https://auth.stg.topolo.us"',
-      'NEXUS_GATEWAY_URL = "https://nexus-api.stg.topolo.us"',
+      'NEXUS_GATEWAY_URL = "https://nexus.stg.topolo.us"',
       runtimeIdentityVar,
       ""
     );
@@ -6929,6 +6470,632 @@ function developerWorkerTs(application) {
     ""
   ].join("\n");
 }
+
+// src/commands/app-scaffold-workflows.ts
+function scaffoldCommands(options) {
+  const scaffoldId = toSlug(options.id);
+  if (options.target === "developer") {
+    const audienceFlags = options.audience === "personal" ? " --audience personal --tenancy household" : "";
+    return [
+      `topolo apps scaffold ${scaffoldId}${audienceFlags} --write --repo-root .`,
+      `cd topolo-${scaffoldId}`,
+      "npm install",
+      "npm run typecheck",
+      "npm run build"
+    ];
+  }
+  const portfolioFlags = options.portfolio === "personal" ? " --portfolio personal" : "";
+  const profileFlags = options.profile ? ` --profile ${options.profile}` : "";
+  return [
+    `topolo platform apps scaffold ${scaffoldId}${portfolioFlags}${profileFlags} --write --provision --repo-root /Users/ashes/Projects/Topolo/Platform --json`,
+    "topolo apps requirements --json",
+    `topolo apps audit ${options.id} --local --repo-root /Users/ashes/Projects/Topolo/Platform --fail-on needs_review --json`,
+    `topolo apps audit ${options.id} --local --repo-root /Users/ashes/Projects/Topolo/Platform --fail-on partial --json`
+  ];
+}
+function topoloConformanceWorkflow(options) {
+  const appPath = firstPartyAppPath(options.appDir, options.audience);
+  const docsCheckoutStep = options.appDir === "TopoloDocs" ? [] : [
+    "",
+    "      - name: Checkout TopoloDocs",
+    `        if: steps.app-token.outputs.token != '' || env.HAS_TOPOLO_CI_REPO_TOKEN == 'true'`,
+    "        uses: actions/checkout@v4",
+    "        with:",
+    "          repository: Topolo-io/TopoloDocs",
+    "          path: Apps/system/TopoloDocs",
+    "          token: ${{ steps.app-token.outputs.token || secrets.TOPOLO_CI_REPO_TOKEN }}"
+  ];
+  const cliCheckoutStep = options.appDir === "TopoloCLI" || options.appDir === "TopoloCli" ? [] : [
+    "",
+    "      - name: Checkout Topolo CLI",
+    `        if: steps.app-token.outputs.token != '' || env.HAS_TOPOLO_CI_REPO_TOKEN == 'true'`,
+    "        uses: actions/checkout@v4",
+    "        with:",
+    "          repository: Topolo-io/TopoloCli",
+    "          path: Apps/system/TopoloCLI",
+    "          token: ${{ steps.app-token.outputs.token || secrets.TOPOLO_CI_REPO_TOKEN }}"
+  ];
+  return [
+    "name: Topolo App Conformance",
+    "",
+    "on:",
+    "  pull_request:",
+    "  push:",
+    "    branches:",
+    "      - main",
+    "  workflow_dispatch:",
+    "",
+    "permissions:",
+    "  contents: read",
+    "",
+    "jobs:",
+    "  conformance:",
+    "    runs-on: ubuntu-latest",
+    "    env:",
+    `      HAS_TOPOLO_PACKAGES_APP: \${{ secrets.TOPOLO_PACKAGES_APP_ID != '' && secrets.TOPOLO_PACKAGES_APP_PRIVATE_KEY != '' }}`,
+    `      HAS_TOPOLO_CI_REPO_TOKEN: \${{ secrets.TOPOLO_CI_REPO_TOKEN != '' }}`,
+    "    steps:",
+    "      - name: Checkout application",
+    "        uses: actions/checkout@v4",
+    "        with:",
+    `          path: ${appPath}`,
+    "",
+    "      - name: Mint Topolo cross-repo token",
+    "        id: app-token",
+    `        if: env.HAS_TOPOLO_PACKAGES_APP == 'true'`,
+    "        uses: actions/create-github-app-token@v1",
+    "        with:",
+    `          app-id: \${{ secrets.TOPOLO_PACKAGES_APP_ID }}`,
+    `          private-key: \${{ secrets.TOPOLO_PACKAGES_APP_PRIVATE_KEY }}`,
+    "          owner: Topolo-io",
+    ...docsCheckoutStep,
+    "",
+    "      - name: Checkout Topolo SDK",
+    `        if: steps.app-token.outputs.token != '' || env.HAS_TOPOLO_CI_REPO_TOKEN == 'true'`,
+    "        uses: actions/checkout@v4",
+    "        with:",
+    "          repository: Topolo-io/topolo-sdk",
+    "          path: Apps/packages/topolo-sdk",
+    "          token: ${{ steps.app-token.outputs.token || secrets.TOPOLO_CI_REPO_TOKEN }}",
+    ...cliCheckoutStep,
+    "",
+    "      - name: Skip conformance without cross-repo token",
+    `        if: steps.app-token.outputs.token == '' && env.HAS_TOPOLO_CI_REPO_TOKEN != 'true'`,
+    "        run: |",
+    '          echo "::warning::Skipping Topolo app conformance because no Topolo cross-repo token is available to this workflow context."',
+    "",
+    "      - name: Setup Node.js",
+    `        if: steps.app-token.outputs.token != '' || env.HAS_TOPOLO_CI_REPO_TOKEN == 'true'`,
+    "        uses: actions/setup-node@v4",
+    "        with:",
+    "          node-version: 20",
+    "",
+    "      - name: Build Topolo SDK",
+    `        if: steps.app-token.outputs.token != '' || env.HAS_TOPOLO_CI_REPO_TOKEN == 'true'`,
+    "        working-directory: Apps/packages/topolo-sdk",
+    "        run: |",
+    "          npm install --no-audit --no-fund",
+    "          npm run build",
+    "",
+    "      - name: Build Topolo CLI",
+    `        if: steps.app-token.outputs.token != '' || env.HAS_TOPOLO_CI_REPO_TOKEN == 'true'`,
+    "        working-directory: Apps/system/TopoloCLI",
+    "        run: |",
+    "          npm install --no-audit --no-fund",
+    "          npm run build",
+    "",
+    "      - name: Run Topolo app conformance audit",
+    `        if: steps.app-token.outputs.token != '' || env.HAS_TOPOLO_CI_REPO_TOKEN == 'true'`,
+    "        run: |",
+    `          node Apps/system/TopoloCLI/dist/index.js apps audit ${options.id} --local --repo-root "$GITHUB_WORKSPACE" --fail-on needs_review --json`,
+    "",
+    "      - name: Record green CI evidence",
+    `        if: \${{ success() && (steps.app-token.outputs.token != '' || env.HAS_TOPOLO_CI_REPO_TOKEN == 'true') }}`,
+    `        working-directory: ${appPath}`,
+    "        run: |",
+    `          node "$GITHUB_WORKSPACE/Apps/system/TopoloCLI/dist/index.js" apps record-evidence ${options.id} --build --typecheck --test --commit "$GITHUB_SHA"`
+  ].join("\n");
+}
+
+// src/commands/app-scaffold.ts
+var CURRENT_VERIFICATION_DATE = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+function generateOpaqueServiceId() {
+  return `srv_${randomBytes(9).toString("base64url")}`;
+}
+function applicationScaffoldPayload(application, options = {}) {
+  const target = normalizeTarget(options.target);
+  const portfolio = target === "platform" ? normalizePortfolio(options.portfolio) : null;
+  const requestedId = normalizeApplicationId(application);
+  const id = target === "platform" ? normalizeFirstPartyApplicationId(requestedId) : requestedId;
+  const slug = toSlug(id);
+  const catalogApplication = APPLICATIONS[id];
+  const browser = options.browser !== false;
+  const api = options.api ?? target === "platform";
+  const audience = normalizeAudience(
+    options.audience,
+    target === "platform" ? portfolio : null
+  );
+  const tenancy = normalizeTenancy(options.tenancy, audience);
+  const surfaceModel = normalizeSurfaceModel(options.surfaceModel);
+  const containerAppId = normalizeContainerAppId(options.containerAppId, surfaceModel);
+  const profile = normalizeScaffoldProfile(options.profile);
+  const resources = resolveScaffoldResources(profile, options);
+  const ownerType = target === "platform" ? "topolo_first_party" : "third_party";
+  const distributionModel = target === "platform" ? "marketplace" : "organization_internal";
+  const appDir = options.appDir ?? catalogApplication?.appDir ?? (target === "platform" ? `Topolo${toPascalCase(id)}` : `topolo-${slug}`);
+  const name = options.name ?? catalogApplication?.name ?? `topolo-${slug}`;
+  const packageName = options.packageName ?? catalogApplication?.packageName ?? `topolo-${slug}`;
+  const serviceSlug = api ? target === "platform" ? `topolo-${slug}` : id : null;
+  const defaultServiceId = target === "platform" ? generateOpaqueServiceId() : catalogApplication?.services[0] ?? id;
+  const serviceId = api ? options.service ?? defaultServiceId : null;
+  const productionUrl = browser ? options.productionUrl ?? catalogApplication?.productionUrl ?? `https://${slug}.topolo.app` : null;
+  const scopes = scaffoldScopes({ browser, api });
+  const capabilities = scaffoldCapabilities({ browser, api, distributionModel });
+  const ciWorkflowPath = target === "platform" ? ".github/workflows/topolo-conformance.yml" : null;
+  const ciWorkflow = target === "platform" ? topoloConformanceWorkflow({ id, appDir, audience }) : null;
+  const applicationPayload = {
+    id,
+    name,
+    appDir,
+    packageName,
+    productionUrl,
+    serviceSlug,
+    serviceId
+  };
+  return {
+    version: APPLICATION_REQUIREMENTS_VERSION,
+    target,
+    ownerType,
+    portfolio,
+    audience,
+    tenancy,
+    surfaceModel,
+    containerAppId,
+    profile,
+    resources,
+    distributionModel,
+    capabilities,
+    application: applicationPayload,
+    scopes,
+    requirements: APPLICATION_REQUIREMENTS.filter(
+      (requirement) => requirement.appliesTo.some((scope) => scopes.includes(scope))
+    ),
+    packages: scaffoldPackages({ browser, api, target }),
+    files: scaffoldFiles({
+      payload: {
+        ownerType,
+        portfolio,
+        audience,
+        tenancy,
+        surfaceModel,
+        containerAppId,
+        profile,
+        resources,
+        distributionModel,
+        capabilities
+      },
+      application: applicationPayload,
+      target,
+      browser,
+      api,
+      ciWorkflow
+    }),
+    commands: scaffoldCommands({
+      id,
+      target,
+      audience,
+      tenancy,
+      portfolio,
+      profile
+    }),
+    ciWorkflowPath,
+    ciWorkflow
+  };
+}
+async function writeApplicationScaffold(payload, options = {}) {
+  const root = resolve2(options.repoRoot ?? process.cwd());
+  const plannedFiles = payload.files.map((file) => ({
+    file,
+    absolutePath: resolveInside(root, file.path)
+  }));
+  const existingFiles = [];
+  for (const planned of plannedFiles) {
+    if (await pathExists(planned.absolutePath)) {
+      existingFiles.push(planned.file.path);
+    }
+  }
+  if (existingFiles.length > 0 && !options.force) {
+    throw new Error(
+      [
+        "Refusing to overwrite existing scaffold files:",
+        ...existingFiles.map((filePath) => `- ${filePath}`),
+        "Pass --force to overwrite these files."
+      ].join("\n")
+    );
+  }
+  const files = [];
+  for (const planned of plannedFiles) {
+    const existed = await pathExists(planned.absolutePath);
+    await mkdir2(dirname3(planned.absolutePath), { recursive: true });
+    await writeFile2(planned.absolutePath, planned.file.content, "utf8");
+    files.push({
+      path: planned.file.path,
+      status: existed ? "overwritten" : "created"
+    });
+  }
+  return { root, files };
+}
+function scaffoldScopes(options) {
+  const scopes = ["all"];
+  if (options.browser) scopes.push("browser");
+  if (options.api) {
+    scopes.push("api", "agent_surface");
+  }
+  return scopes;
+}
+function scaffoldPackages(options) {
+  if (options.target === "developer") {
+    return options.browser ? ["@topolo/login"] : [];
+  }
+  const packages = /* @__PURE__ */ new Set();
+  if (options.browser) {
+    packages.add("@topolo-io/app-funnel");
+    packages.add("@topolo-io/app-launcher");
+    packages.add("@topolo-io/app-shell");
+    packages.add("@topolo-io/auth-client");
+    packages.add("@topolo-io/ui-kit");
+  }
+  if (options.api) {
+    packages.add("@topolo-io/worker-runtime");
+    packages.add("@topolo/sdk");
+  }
+  return Array.from(packages);
+}
+function scaffoldCapabilities(options) {
+  const capabilities = [];
+  if (options.browser) {
+    capabilities.push("login", "launcher");
+  }
+  if (options.distributionModel === "marketplace") capabilities.push("marketplace");
+  if (options.api) capabilities.push("api", "widget");
+  return capabilities;
+}
+function scaffoldFiles(options) {
+  const { application, target } = options;
+  const slug = toSlug(application.id);
+  const base = target === "platform" ? firstPartyAppPath(application.appDir, options.payload.audience) : application.appDir;
+  const browserBase = target === "platform" ? `${base}/apps/web` : base;
+  const apiBase = target === "platform" ? `${base}/apps/api` : base;
+  const files = [
+    {
+      path: `${base}/package.json`,
+      purpose: "Package metadata and verification commands.",
+      requiredSignals: [
+        "name matches the packageName in the SDK application catalog",
+        "scripts include build plus typecheck where the stack supports them"
+      ],
+      content: packageJson(application, target, {
+        browser: options.browser,
+        api: options.api,
+        resources: options.payload.resources
+      })
+    },
+    {
+      path: `${base}/README.md`,
+      purpose: "Starter README with install, run, and verification commands.",
+      requiredSignals: [
+        "documents the generated app target",
+        "points maintainers to the shared Topolo packages used by the scaffold"
+      ],
+      content: readme(application, target, {
+        api: options.api,
+        audience: options.payload.audience,
+        tenancy: options.payload.tenancy,
+        portfolio: options.payload.portfolio,
+        profile: options.payload.profile,
+        resources: options.payload.resources
+      })
+    },
+    {
+      path: `${base}/.gitignore`,
+      purpose: "Generated-app ignore rules.",
+      requiredSignals: [
+        "ignores dependency installs and build output",
+        "keeps local environment files out of source control"
+      ],
+      content: gitignore()
+    },
+    {
+      path: `${base}/tsconfig.json`,
+      purpose: "TypeScript configuration for the generated app.",
+      requiredSignals: [
+        "uses strict mode",
+        "includes browser DOM types for React and Worker types for API-backed apps"
+      ],
+      content: tsconfigJson(options.api, target)
+    },
+    {
+      path: `${browserBase}/vite.config.ts`,
+      purpose: "Vite browser build configuration.",
+      requiredSignals: [
+        "builds the authenticated browser surface",
+        "keeps generated apps on the standard React/Vite baseline"
+      ],
+      content: viteConfig(target)
+    },
+    {
+      path: `${browserBase}/index.html`,
+      purpose: "Browser entry document.",
+      requiredSignals: [
+        "mounts the React app at #root",
+        "uses the generated application display name"
+      ],
+      content: indexHtml(application.name)
+    },
+    {
+      path: `${browserBase}/src/main.tsx`,
+      purpose: "React app entrypoint.",
+      requiredSignals: [
+        "renders the generated app component",
+        "imports the generated app stylesheet"
+      ],
+      content: mainTsx()
+    },
+    {
+      path: `${browserBase}/src/env.d.ts`,
+      purpose: "Vite environment variable typing.",
+      requiredSignals: [
+        "loads vite/client import.meta.env types",
+        "declares the Topolo environment variables consumed by the starter"
+      ],
+      content: envDts(options.api)
+    },
+    ...options.payload.resources.workflow ? [
+      {
+        path: `${base}/src/cloudflare-workers.d.ts`,
+        purpose: "Minimal Cloudflare Workflow entrypoint typing for scaffolded Workers.",
+        requiredSignals: [
+          "declares cloudflare:workers WorkflowEntrypoint for TypeScript",
+          "keeps Workflow imports deployable without adding a new dependency"
+        ],
+        content: cloudflareWorkersDts()
+      }
+    ] : [],
+    {
+      path: `${browserBase}/src/styles.css`,
+      purpose: "Minimal app-local styles outside the shared Topolo shell.",
+      requiredSignals: [
+        "does not fork the shared shell chrome",
+        "keeps app-specific layout scoped under generated classes"
+      ],
+      content: stylesCss()
+    }
+  ];
+  if (target === "platform") {
+    files.push(
+      {
+        path: `${base}/topolo.app.json`,
+        purpose: "Canonical app manifest that drives generated Wrangler and CloudControl metadata.",
+        requiredSignals: [
+          "declares web/api targets with canonical names and app-local target directories",
+          "keeps Cloudflare account, domain, service id, and bindings in one manifest source of truth"
+        ],
+        content: topoloAppManifestJson(application, {
+          api: options.api,
+          resources: options.payload.resources,
+          profile: options.payload.profile
+        })
+      },
+      {
+        path: `${base}/topolo.cloudcontrol.json`,
+        purpose: "CloudControl source of truth for deploy targets, routes, bindings, and CI metadata.",
+        requiredSignals: [
+          "production URLs and Cloudflare targets are explicit",
+          "resource bindings and required secrets are declared without secret values"
+        ],
+        content: cloudcontrolJson(application, {
+          api: options.api,
+          audience: options.payload.audience,
+          profile: options.payload.profile,
+          resources: options.payload.resources
+        })
+      },
+      {
+        path: `${base}/.github/workflows/topolo-conformance.yml`,
+        purpose: "PR/push gate that runs the local Topolo app audit with docs evidence.",
+        requiredSignals: [
+          "checks out this repo under its Apps lane directory",
+          "checks out TopoloDocs under Apps/system/TopoloDocs",
+          "checks out topolo-sdk and TopoloCli from main so the gate does not wait for an npm publish",
+          "runs topolo apps audit with --local and --fail-on needs_review"
+        ],
+        content: options.ciWorkflow ?? ""
+      },
+      {
+        path: `Apps/system/TopoloDocs/src/content/systems/topolo-${slug}.json`,
+        purpose: "Canonical system registry entry.",
+        requiredSignals: [
+          `repo_paths includes ${base}`,
+          "doc_paths includes internal handbook coverage",
+          "security_assurance records the auth, tenancy, deployment, and verification boundary"
+        ],
+        content: systemJson(application, {
+          api: options.api,
+          audience: options.payload.audience,
+          tenancy: options.payload.tenancy,
+          portfolio: options.payload.portfolio,
+          profile: options.payload.profile,
+          resources: options.payload.resources
+        })
+      },
+      {
+        path: `Apps/system/TopoloDocs/src/content/internal/apps/${slug}.mdx`,
+        purpose: "Internal operator handbook.",
+        requiredSignals: [
+          "documents ownership, routes, auth boundary, deployment, operations, and verification",
+          "last_verified is updated when behavior changes"
+        ],
+        content: internalDocs(application, {
+          api: options.api,
+          audience: options.payload.audience,
+          tenancy: options.payload.tenancy,
+          portfolio: options.payload.portfolio,
+          profile: options.payload.profile,
+          resources: options.payload.resources
+        })
+      },
+      {
+        path: `Apps/system/TopoloDocs/src/content/public/applications/${slug}.mdx`,
+        purpose: "Public application overview.",
+        requiredSignals: [
+          "documents the product surface without internal-only details",
+          "links back to the canonical system registry entry"
+        ],
+        content: publicDocs(application, {
+          api: options.api,
+          audience: options.payload.audience,
+          tenancy: options.payload.tenancy,
+          portfolio: options.payload.portfolio,
+          profile: options.payload.profile,
+          resources: options.payload.resources
+        })
+      }
+    );
+    if (options.api && application.serviceId) {
+      files.push(
+        {
+          path: `Apps/system/TopoloAuth/catalog/service-manifests/${application.serviceId}.json`,
+          purpose: "Auth service manifest for first-party permissions, role bundles, and API-key scopes.",
+          requiredSignals: [
+            "serviceId matches the generated Worker service id",
+            "permissions, role bundles, and API-key scopes exist before the app is catalog-visible",
+            "systems metadata maps the service back to the generated TopoloDocs entries"
+          ],
+          content: serviceManifestJson(application, {
+            audience: options.payload.audience,
+            tenancy: options.payload.tenancy
+          })
+        }
+      );
+    }
+  } else {
+    files.push(
+      {
+        path: `${base}/topolo.app.json`,
+        purpose: "Third-party Topolo application manifest.",
+        requiredSignals: [
+          "declares the external app id, callback URLs, and requested platform scopes",
+          "does not include internal Topolo CloudControl or canonical-docs ownership"
+        ],
+        content: developerManifest(application, {
+          api: options.api,
+          audience: options.payload.audience,
+          tenancy: options.payload.tenancy,
+          surfaceModel: options.payload.surfaceModel,
+          containerAppId: options.payload.containerAppId,
+          distributionModel: options.payload.distributionModel,
+          capabilities: options.payload.capabilities
+        })
+      },
+      {
+        path: `${base}/.env.example`,
+        purpose: "Developer environment template for local auth configuration.",
+        requiredSignals: [
+          "names the Topolo Auth URL",
+          "keeps OAuth client ids and service ids out of source control by default"
+        ],
+        content: envExample(application)
+      }
+    );
+  }
+  if (options.browser) {
+    if (target === "platform") {
+      files.push({
+        path: `${browserBase}/src/service-identity.ts`,
+        purpose: "Central service identity resolver shared by browser and Worker runtime surfaces.",
+        requiredSignals: [
+          "exports the generated app id, display name, and stable Auth service slug",
+          "requires the provisioned Auth service id from the Worker deployment config"
+        ],
+        content: serviceIdentityTs(application)
+      });
+    }
+    files.push({
+      path: `${browserBase}/src/App.tsx`,
+      purpose: "Authenticated browser surface.",
+      requiredSignals: [
+        "bootstraps routes, auth provider, and shared shell through @topolo-io/app-shell",
+        "uses @topolo-io/auth-client through the app-shell wrapper for app-origin auth flows",
+        "keeps launcher and account-menu behavior on the shared platform surface",
+        "passes app-specific account actions through accountMenuItems or TopoloAccountMenu"
+      ],
+      content: appTsx(application, target, {
+        audience: options.payload.audience,
+        portfolio: options.payload.portfolio
+      })
+    });
+  }
+  if (options.api) {
+    files.push(
+      {
+        path: `${apiBase}/wrangler.toml`,
+        purpose: "Cloudflare Worker runtime configuration.",
+        requiredSignals: [
+          "bindings match topolo.cloudcontrol.json or topolo.app.json",
+          "secrets are referenced by name only"
+        ],
+        content: target === "platform" ? platformApiWranglerToml(application, options.payload.resources, options.payload.profile) : wranglerToml(application, target, options.payload.resources, options.payload.profile)
+      },
+      {
+        path: `${apiBase}/src/worker.ts`,
+        purpose: "Protected service boundary.",
+        requiredSignals: [
+          "uses @topolo-io/worker-runtime for Worker auth, gatewaying, headers, and request helpers",
+          "derives organization from the credential rather than client-supplied orgId",
+          "emits or propagates X-Topolo-Request-Id and X-Topolo-Client"
+        ],
+        content: workerTs(application, target, {
+          audience: options.payload.audience,
+          tenancy: options.payload.tenancy,
+          profile: options.payload.profile,
+          resources: options.payload.resources
+        })
+      }
+    );
+    if (target === "platform") {
+      files.push(
+        {
+          path: `${apiBase}/src/service-identity.ts`,
+          purpose: "Runtime service identity resolver for the API Worker.",
+          requiredSignals: [
+            "resolves the concrete Auth service id from Worker vars",
+            "keeps the API Worker independent from browser-only import.meta usage"
+          ],
+          content: apiServiceIdentityTs(application)
+        },
+        {
+          path: `${browserBase}/src/worker.ts`,
+          purpose: "Browser Worker that serves assets and forwards API paths to the API Worker binding.",
+          requiredSignals: [
+            "keeps the frontend Worker thin",
+            "routes /api/* to the API service binding instead of owning backend routes locally"
+          ],
+          content: webWorkerTs(application)
+        },
+        {
+          path: `${browserBase}/wrangler.toml`,
+          purpose: "Cloudflare Worker static-assets configuration for the browser surface.",
+          requiredSignals: [
+            "serves Vite assets through a Worker with assets",
+            "binds the frontend Worker to the API Worker for /api/* requests"
+          ],
+          content: platformWebWranglerToml(application)
+        }
+      );
+    }
+  }
+  return files;
+}
 function topoloAppManifestJson(application, options) {
   const slug = toSlug(application.id);
   const resource = resourceConfig(application, options.profile);
@@ -6993,8 +7160,8 @@ function topoloAppManifestJson(application, options) {
           production: "https://auth.topolo.app"
         },
         NEXUS_GATEWAY_URL: {
-          staging: "https://nexus-api.stg.topolo.us",
-          production: "https://nexus-api.topolo.app"
+          staging: "https://nexus.stg.topolo.us",
+          production: "https://nexus.topolo.app"
         },
         NEXUS_APP_ID: slug
       },
@@ -7697,132 +7864,6 @@ function envExample(application) {
     ""
   ].join("\n");
 }
-function normalizeTarget(value) {
-  if (!value) return "platform";
-  if (value === "platform" || value === "developer") return value;
-  throw new Error("Invalid scaffold target. Use platform or developer.");
-}
-function normalizePortfolio(value) {
-  if (!value) return "platform";
-  if (value === "platform" || value === "personal") return value;
-  throw new Error("Invalid scaffold portfolio. Use platform or personal.");
-}
-function normalizeAudience(value, portfolio) {
-  if (!value) {
-    return portfolio === "personal" ? "personal" : "business";
-  }
-  if (value === "business" || value === "personal") {
-    return value;
-  }
-  throw new Error("Invalid scaffold audience. Use business or personal.");
-}
-function normalizeTenancy(value, audience) {
-  const resolved = value ?? (audience === "personal" ? "household" : "organization");
-  if (resolved !== "organization" && resolved !== "household") {
-    throw new Error("Invalid scaffold tenancy. Use organization or household.");
-  }
-  if (audience === "business" && resolved !== "organization") {
-    throw new Error("Business scaffolds must use organization tenancy.");
-  }
-  if (audience === "personal" && resolved !== "household") {
-    throw new Error("Personal scaffolds must use household tenancy.");
-  }
-  return resolved;
-}
-function normalizeSurfaceModel(value) {
-  if (!value) return "web_app";
-  if (value === "web_app" || value === "mobile_container" || value === "mobile_module" || value === "messaging_surface") {
-    return value;
-  }
-  throw new Error(
-    "Invalid scaffold surface model. Use web_app, mobile_container, mobile_module, or messaging_surface."
-  );
-}
-function normalizeScaffoldProfile(value) {
-  if (!value) return null;
-  if (value === "spatial-assets") return value;
-  throw new Error("Invalid scaffold profile. Use spatial-assets.");
-}
-function resolveScaffoldResources(profile, options) {
-  const profileResources = profile === "spatial-assets" ? { d1: true, r2: true, queue: true, workflow: true, containerProcessing: true } : { d1: false, r2: false, queue: false, workflow: false, containerProcessing: false };
-  return {
-    d1: Boolean(profileResources.d1 || options.withD1),
-    r2: Boolean(profileResources.r2 || options.withR2),
-    queue: Boolean(profileResources.queue || options.withQueue),
-    workflow: Boolean(profileResources.workflow || options.withWorkflow),
-    containerProcessing: Boolean(profileResources.containerProcessing || options.withContainerProcessing)
-  };
-}
-function normalizeContainerAppId(value, surfaceModel) {
-  const trimmed = String(value || "").trim();
-  if (surfaceModel === "mobile_module") {
-    if (!trimmed) {
-      throw new Error("Mobile-module scaffolds require --container-app-id.");
-    }
-    return trimmed;
-  }
-  return trimmed || null;
-}
-function normalizeApplicationId(application) {
-  const raw = application.trim().toLowerCase();
-  const normalized = raw.replace(/-/g, "_");
-  if (Object.prototype.hasOwnProperty.call(APPLICATIONS, raw)) {
-    return raw;
-  }
-  if (Object.prototype.hasOwnProperty.call(APPLICATIONS, normalized)) {
-    return normalized;
-  }
-  if (/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(raw) || /^[a-z0-9](?:[a-z0-9_]*[a-z0-9])?$/.test(raw)) {
-    return normalized;
-  }
-  throw new Error(
-    "Application id must be kebab-case or snake_case using lowercase letters, numbers, hyphens, and underscores."
-  );
-}
-function normalizeFirstPartyApplicationId(applicationId) {
-  if (applicationId.startsWith("topolo_") && applicationId.length > "topolo_".length) {
-    return applicationId.slice("topolo_".length);
-  }
-  return applicationId;
-}
-function toSlug(value) {
-  return value.replace(/_/g, "-");
-}
-function toPascalCase(value) {
-  const acronyms = /* @__PURE__ */ new Set(["api", "cli", "crm", "mcp", "mdm", "p2p"]);
-  return value.split(/[-_]/).filter(Boolean).map((part) => acronyms.has(part.toLowerCase()) ? part.toUpperCase() : part.slice(0, 1).toUpperCase() + part.slice(1)).join("");
-}
-function toTitle(value) {
-  return value.replace(/^topolo[-_\s]*/i, "Topolo ").split(/[-_\s]+/).filter(Boolean).map((part) => part.slice(0, 1).toUpperCase() + part.slice(1)).join(" ");
-}
-function json(value) {
-  return JSON.stringify(value, null, 2);
-}
-async function pathExists(path4) {
-  try {
-    await access(path4, constants.F_OK);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function resolveInside(root, filePath) {
-  const resolved = resolve(root, filePath);
-  const relativePath = relative(root, resolved);
-  if (relativePath.startsWith("..") || relativePath === "" || relativePath.startsWith("/")) {
-    throw new Error(`Scaffold file path escapes the target root: ${filePath}`);
-  }
-  return resolved;
-}
-function escapeHtml(value) {
-  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
-function escapeSingleQuoted(value) {
-  return value.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
-}
-function escapeFrontmatter(value) {
-  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
-}
 
 // src/commands/app-scaffold-provision.ts
 import { readFile as readFile2, writeFile as writeFile3 } from "fs/promises";
@@ -9182,7 +9223,7 @@ function normalizeList(values, fallback = []) {
 
 // src/commands/integrations.ts
 import { readdir, readFile as readFile3, stat } from "fs/promises";
-import { join as join4, relative as relative2 } from "path";
+import { join as join4, relative as relative3 } from "path";
 function registerIntegrationsCommand(program2) {
   const integrations = program2.command("integrations").description("Generate and validate Topolo integration handoffs.");
   integrations.command("prompt").description("Print an agent prompt for adding a Topolo integration.").argument("<integration>", "Integration prompt id, currently login-with-topolo").option("--framework <framework>", "auto, authjs, express, or generic", "auto").option("--json", "Emit JSON output").action((integration, options) => {
@@ -9347,7 +9388,7 @@ async function collectFiles(repoRoot) {
       const info = await stat(fullPath);
       if (info.size > 25e4) continue;
       result.push({
-        path: relative2(root, fullPath),
+        path: relative3(root, fullPath),
         content: await readFile3(fullPath, "utf8")
       });
     }