@topolo/cli 0.1.34 → 0.2.2

package/dist/index.js

@@ -50,6 +50,12 @@ var TopoloPermissionError = class extends TopoloSdkError {
     this.required = required;
   }
 };
+var TopoloConfirmationRequiredError = class extends TopoloSdkError {
+  constructor(message) {
+    super("confirmation_required", message);
+    this.name = "TopoloConfirmationRequiredError";
+  }
+};
 var TopoloHttpError = class extends TopoloSdkError {
   status;
   body;
@@ -1112,6 +1118,7 @@ var APPLICATIONS = {
           "topolo.io"
         ],
         "routes": [
+          "one.topolo.io",
           "topolo.io",
           "www.topolo.io"
         ],
@@ -2065,7 +2072,6 @@ var TOPOLO_RESOURCE_TYPE_HEADER = "X-Topolo-Resource-Type";
 var TOPOLO_RESOURCE_ID_HEADER = "X-Topolo-Resource-ID";
 var POSITIVE_CACHE_TTL_MS = 5 * 60 * 1e3;
 var NEGATIVE_CACHE_TTL_MS = 60 * 1e3;
-var CATALOG_CACHE_TTL_MS = 60 * 1e3;
 var TopoloClient = class _TopoloClient {
   credential;
   agent;
@@ -2074,9 +2080,9 @@ var TopoloClient = class _TopoloClient {
   requireConfirmForWrites;
   timeoutMs;
   fetchImpl;
+  refreshCredential;
+  refreshInFlight = null;
   debug;
-  serviceCatalogCache = null;
-  actionCatalogCache = null;
   /**
    * Process-wide cache for slug → app-id lookups. Keyed by
    * `${authBaseUrl}|${slug}` so multiple `TopoloClient` instances pointing at
@@ -2101,6 +2107,7 @@ var TopoloClient = class _TopoloClient {
     this.requireConfirmForWrites = options.requireConfirmForWrites !== false;
     this.timeoutMs = options.timeoutMs ?? 3e4;
     this.fetchImpl = options.fetch ?? fetch;
+    this.refreshCredential = options.refreshCredential;
     this.debug = options.debug;
   }
   emit(event) {
@@ -2118,11 +2125,11 @@ var TopoloClient = class _TopoloClient {
   async request(opts) {
     const method = opts.method ?? "GET";
     if (this.requireConfirmForWrites && WRITE_METHODS.has(method) && !opts.confirm) {
-      throw new TopoloAuthError(
+      throw new TopoloConfirmationRequiredError(
         `Mutating ${method} requests require { confirm: true }. This guardrail prevents agents from issuing writes without an explicit human-in-the-loop acknowledgement.`
       );
     }
-    const resolvedService = await this.resolveRequestService(opts.service);
+    const resolvedService = opts.baseUrl ? { serviceKey: normalizeLookupKey(opts.service), baseUrl: requireHttpOrigin(opts.baseUrl) } : await this.resolveRequestService(opts.service);
     const baseUrl = resolvedService.baseUrl;
     const url = new URL(opts.path, baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`);
     if (opts.query) {
@@ -2153,20 +2160,36 @@ var TopoloClient = class _TopoloClient {
       headers.set(TOPOLO_RESOURCE_TYPE_HEADER, resourceType);
       headers.set(TOPOLO_RESOURCE_ID_HEADER, resourceId);
     }
-    const controller = new AbortController();
-    const timeoutId = setTimeout(() => controller.abort(), this.timeoutMs);
-    const signal = opts.signal ? mergeSignals(opts.signal, controller.signal) : controller.signal;
     const urlStr = url.toString();
     const startedAt = Date.now();
     this.emit({ phase: "request", method, service: resolvedService.serviceKey, path: opts.path, url: urlStr, requestId });
+    const fetchOnce = async () => {
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => controller.abort(), this.timeoutMs);
+      const signal = opts.signal ? mergeSignals(opts.signal, controller.signal) : controller.signal;
+      try {
+        return await this.fetchImpl(urlStr, {
+          method,
+          headers: new Headers(headers),
+          body: opts.body !== void 0 ? JSON.stringify(opts.body) : null,
+          signal
+        });
+      } finally {
+        clearTimeout(timeoutId);
+      }
+    };
     let res;
     try {
-      res = await this.fetchImpl(urlStr, {
-        method,
-        headers,
-        body: opts.body !== void 0 ? JSON.stringify(opts.body) : null,
-        signal
-      });
+      const attemptedCredential = this.credential;
+      res = await fetchOnce();
+      if (res.status === 401 && attemptedCredential.kind === "access_token" && this.refreshCredential) {
+        await res.body?.cancel().catch(() => void 0);
+        const refreshed = await this.refreshRejectedAccessToken(attemptedCredential.accessToken);
+        if (refreshed) {
+          applyAuthHeaders(headers, refreshed);
+          res = await fetchOnce();
+        }
+      }
     } catch (err) {
       this.emit({
         phase: "error",
@@ -2179,8 +2202,6 @@ var TopoloClient = class _TopoloClient {
         error: err instanceof Error ? err.message : String(err)
       });
       throw err;
-    } finally {
-      clearTimeout(timeoutId);
     }
     const contentType = res.headers.get("Content-Type") ?? "";
     const parsed = contentType.includes("application/json") ? await res.json().catch(() => null) : await res.text().catch(() => null);
@@ -2219,6 +2240,19 @@ var TopoloClient = class _TopoloClient {
     });
     return parsed;
   }
+  async refreshRejectedAccessToken(attemptedAccessToken) {
+    if (this.credential.kind === "access_token" && this.credential.accessToken !== attemptedAccessToken) {
+      return this.credential;
+    }
+    if (!this.refreshCredential) return null;
+    this.refreshInFlight ??= this.refreshCredential().then((credential) => {
+      if (credential) this.credential = credential;
+      return credential;
+    }).catch(() => null).finally(() => {
+      this.refreshInFlight = null;
+    });
+    return this.refreshInFlight;
+  }
   async resolveRequestService(service) {
     const serviceKey = normalizeLookupKey(service);
     if (!serviceKey) {
@@ -2244,9 +2278,8 @@ var TopoloClient = class _TopoloClient {
     );
   }
   async resolveLiveCallableService(serviceKey) {
-    const catalog = await this.listServices();
-    const match = catalog.find((entry) => catalogEntryMatches(entry, serviceKey));
-    if (!match) return null;
+    const match = await this.getService(serviceKey).catch(() => null);
+    if (!match || !catalogEntryMatches(match, serviceKey)) return null;
     const baseUrl = resolveCatalogServiceUrl(match, {
       serviceKey,
       overrides: this.serviceUrls
@@ -2320,12 +2353,13 @@ var TopoloClient = class _TopoloClient {
    * The live Auth catalog is the authority because it is scoped to the caller's
    * organization and effective permissions.
    */
-  async listServices() {
-    const now = Date.now();
-    if (this.serviceCatalogCache && this.serviceCatalogCache.expiresAt > now) {
-      return this.serviceCatalogCache.entries;
-    }
-    const res = await this.request({ service: "developers", method: "GET", path: "/api/services/catalog" });
+  async searchServices(options = {}) {
+    const res = await this.request({
+      service: "developers",
+      method: "GET",
+      path: "/api/services/catalog",
+      query: catalogSearchQuery(options)
+    });
     const raw = res.data?.services ?? res.services;
     if (!Array.isArray(raw)) {
       throw new TopoloSdkError(
@@ -2335,6 +2369,7 @@ var TopoloClient = class _TopoloClient {
     }
     const entries = [];
     for (const item of raw) {
+      if (!isRecord(item)) continue;
       const s = item;
       const appId = typeof s.app_id === "string" ? s.app_id : typeof s.id === "string" ? s.id : null;
       if (!appId) continue;
@@ -2359,11 +2394,30 @@ var TopoloClient = class _TopoloClient {
         apiKeyResources
       });
     }
-    this.serviceCatalogCache = {
-      entries,
-      expiresAt: now + CATALOG_CACHE_TTL_MS
-    };
-    return entries;
+    const page = normalizeCatalogPage(
+      res.data?.page ?? res.page
+    );
+    return { services: entries, page };
+  }
+  /** @deprecated Prefer searchServices() so callers retain the continuation cursor. */
+  async listServices(options = {}) {
+    return (await this.searchServices(options)).services;
+  }
+  async getService(application) {
+    const needle = application.trim();
+    if (!needle) throw new TopoloSdkError("unknown_service", "application is required");
+    const res = await this.request({
+      service: "developers",
+      method: "GET",
+      path: "/api/services/catalog",
+      query: { application: needle }
+    });
+    const raw = res.data?.application ?? res.application;
+    const entry = normalizeServiceCatalogEntry(raw);
+    if (!entry) {
+      throw new TopoloSdkError("unknown_service", `Unknown Topolo application "${application}".`);
+    }
+    return entry;
   }
   /**
    * List callable actions from the live registry-canonical catalog (definitions
@@ -2371,16 +2425,15 @@ var TopoloClient = class _TopoloClient {
    * caller's organization and effective permissions; no bundled/static app
    * action list is used as an authorization source.
    */
-  async listActions(options = {}) {
-    const now = Date.now();
-    if (!options.service && this.actionCatalogCache && this.actionCatalogCache.expiresAt > now) {
-      return this.actionCatalogCache.entries;
+  async searchActions(options) {
+    if (!options.service?.trim()) {
+      throw new TopoloSdkError("service_required", "service is required for bounded action discovery");
     }
     const res = await this.request({
       service: "developers",
       method: "GET",
       path: "/api/actions/catalog",
-      ...options.service ? { query: { service: options.service } } : {}
+      query: { service: options.service, ...catalogSearchQuery(options) }
     });
     const raw = res.data?.actions ?? res.actions;
     if (!Array.isArray(raw)) {
@@ -2390,36 +2443,96 @@ var TopoloClient = class _TopoloClient {
       );
     }
     const entries = raw.map((item) => normalizeActionCatalogEntry(item)).filter((entry) => Boolean(entry));
-    if (!options.service) {
-      this.actionCatalogCache = {
-        entries,
-        expiresAt: now + CATALOG_CACHE_TTL_MS
-      };
+    return {
+      actions: entries,
+      page: normalizeCatalogPage(
+        res.data?.page ?? res.page
+      )
+    };
+  }
+  async getActionCatalogSummary(service) {
+    const boundedService = service.trim();
+    if (!boundedService) {
+      throw new TopoloSdkError("service_required", "service is required for bounded action discovery");
     }
-    return entries;
+    const res = await this.request({
+      service: "developers",
+      method: "GET",
+      path: "/api/actions/catalog",
+      query: { service: boundedService, summary: "true" }
+    });
+    const raw = res.data?.summary ?? res.summary;
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+      throw new TopoloSdkError("action_catalog_summary_unavailable", "Action catalog summary is unavailable.");
+    }
+    const record = raw;
+    if (record.algorithm !== "sha256-v1" || typeof record.digest !== "string" || !/^[a-f0-9]{64}$/.test(record.digest) || !Number.isSafeInteger(record.actionCount) || Number(record.actionCount) < 0) {
+      throw new TopoloSdkError("action_catalog_summary_unavailable", "Action catalog summary is invalid.");
+    }
+    return {
+      algorithm: "sha256-v1",
+      digest: record.digest,
+      actionCount: Number(record.actionCount)
+    };
+  }
+  /** @deprecated Prefer searchActions() so callers retain the continuation cursor. */
+  async listActions(options) {
+    if (!options) {
+      throw new TopoloSdkError("service_required", "service is required for bounded action discovery");
+    }
+    return (await this.searchActions(options)).actions;
   }
   async getAction(action) {
-    const needle = normalizeActionLookupKey(action);
-    const actions = await this.listActions();
-    const match = actions.find((entry) => actionEntryMatches(entry, needle));
-    if (!match) {
+    const actionId = action.trim();
+    if (!actionId) {
       throw new TopoloSdkError(
         "unknown_action",
-        `Unknown Topolo action "${action}". Run action discovery first and pass an action id, name, or tool name.`
+        "action id is required"
       );
     }
+    let res;
+    try {
+      res = await this.request({
+        service: "developers",
+        method: "GET",
+        path: "/api/actions/catalog",
+        query: { actionId }
+      });
+    } catch (error) {
+      if (error instanceof TopoloHttpError && error.status === 404) {
+        throw new TopoloSdkError("unknown_action", `Unknown or unavailable Topolo action "${action}".`);
+      }
+      throw error;
+    }
+    const raw = res.data?.action ?? res.action;
+    const match = normalizeActionCatalogEntry(raw);
+    if (!match) throw new TopoloSdkError("unknown_action", `Unknown or unavailable Topolo action "${action}".`);
     return match;
   }
   async callAction(action, input2 = {}, options = {}) {
     const entry = await this.getAction(action);
+    const agentAccess = entry.agentAccess ?? (entry.destructive ? "off" : entry.readOnly && !entry.requiresConfirmation ? "auto" : "confirm");
+    if (agentAccess === "off") {
+      throw new TopoloPermissionError(
+        `Topolo action "${entry.actionId}" is not available for agent invocation.`,
+        entry.requiredPermission ? [entry.requiredPermission] : []
+      );
+    }
+    if ((agentAccess === "confirm" || entry.requiresConfirmation || entry.destructive) && options.confirm !== true) {
+      throw new TopoloConfirmationRequiredError(
+        `Topolo action "${entry.actionId}" requires { confirm: true } before invocation.`
+      );
+    }
     const mapped = mapActionInput(entry, input2);
     const service = entry.appSlug || entry.appId;
     return this.request({
       service,
+      ...entry.apiBaseUrl ? { baseUrl: entry.apiBaseUrl } : {},
       method: entry.method,
       path: mapped.path,
       ...mapped.query ? { query: mapped.query } : {},
       ...mapped.body !== void 0 ? { body: mapped.body } : {},
+      ...options.resource ? { resource: options.resource } : {},
       headers: {
         [TOPOLO_ACTION_ID_HEADER]: entry.actionId,
         [TOPOLO_ACTION_NAME_HEADER]: entry.name
@@ -2557,6 +2670,18 @@ function serviceKeyCandidates2(slug) {
 function normalizeLookupKey(value) {
   return String(value || "").trim().toLowerCase().replace(/\s+/g, "-");
 }
+function requireHttpOrigin(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new TopoloSdkError("invalid_action_target", `Invalid action API origin "${value}".`);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password) {
+    throw new TopoloSdkError("invalid_action_target", `Invalid action API origin "${value}".`);
+  }
+  return url.origin;
+}
 function deriveDevelopersFromAuth(authUrl) {
   if (!authUrl) return null;
   try {
@@ -2583,6 +2708,47 @@ function catalogEntryLookupKeys(entry) {
   }
   return [...keys];
 }
+function catalogSearchQuery(options) {
+  const query = {};
+  if (typeof options.query === "string" && options.query.trim()) query.query = options.query.trim();
+  if (typeof options.cursor === "string" && options.cursor.trim()) query.cursor = options.cursor.trim();
+  if (typeof options.limit === "number" && Number.isFinite(options.limit)) query.limit = Math.trunc(options.limit);
+  return query;
+}
+function normalizeCatalogPage(value) {
+  if (!isRecord(value)) return { nextCursor: null, hasMore: false };
+  return {
+    nextCursor: typeof value.nextCursor === "string" && value.nextCursor ? value.nextCursor : null,
+    hasMore: value.hasMore === true
+  };
+}
+function normalizeServiceCatalogEntry(item) {
+  if (!isRecord(item)) return null;
+  const appId = typeof item.app_id === "string" ? item.app_id : typeof item.id === "string" ? item.id : null;
+  if (!appId) return null;
+  const permissions = Array.isArray(item.granted_permissions) ? item.granted_permissions.filter(
+    (permission) => typeof permission === "string" && permission.trim().length > 0
+  ) : [];
+  const catalogApiKeyResources = normalizeApiKeyResourceMetadataList(
+    item.api_key_resources ?? item.apiKeyResources
+  );
+  const apiKeyResource = normalizeApiKeyResourceMetadata(item.api_key_resource ?? item.apiKeyResource) ?? catalogApiKeyResources[0] ?? null;
+  const apiKeyResources = catalogApiKeyResources.length > 0 ? catalogApiKeyResources : apiKeyResource ? [apiKeyResource] : [];
+  return {
+    appId,
+    slug: typeof item.app_slug === "string" ? item.app_slug : null,
+    name: typeof item.name === "string" ? item.name : null,
+    description: typeof item.description === "string" ? item.description : null,
+    apiBaseUrl: typeof item.api_base_url === "string" ? item.api_base_url : typeof item.apiBaseUrl === "string" ? item.apiBaseUrl : null,
+    launchUrl: typeof item.launch_url === "string" ? item.launch_url : typeof item.launchUrl === "string" ? item.launchUrl : null,
+    status: typeof item.status === "string" ? item.status : null,
+    surfaceKind: typeof item.surface_kind === "string" ? item.surface_kind : null,
+    launchable: item.launchable === true,
+    permissions,
+    apiKeyResource,
+    apiKeyResources
+  };
+}
 function normalizeActionCatalogEntry(item) {
   if (!item || typeof item !== "object" || Array.isArray(item)) return null;
   const a = item;
@@ -2596,6 +2762,8 @@ function normalizeActionCatalogEntry(item) {
   }
   return {
     actionId,
+    target: pickActionString(a.target_key) ?? pickActionString(a.target) ?? null,
+    apiBaseUrl: pickActionString(a.api_base_url) ?? pickActionString(a.apiBaseUrl) ?? null,
     name,
     toolName: pickActionString(a.tool_name) ?? pickActionString(a.toolName) ?? null,
     title: pickActionString(a.title) ?? name,
@@ -2607,6 +2775,7 @@ function normalizeActionCatalogEntry(item) {
     path: path4,
     permissionName: pickActionString(a.permission_name) ?? pickActionString(a.permissionName) ?? "",
     requiredPermission: pickActionString(a.required_permission) ?? pickActionString(a.requiredPermission) ?? "",
+    authorizationMode: pickAuthorizationMode(a.authorization_mode ?? a.authorizationMode),
     inputSchema: plainObject(a.input_schema ?? a.inputSchema),
     outputSchema: plainObject(a.output_schema ?? a.outputSchema),
     readOnly: Boolean(a.read_only ?? a.readOnly),
@@ -2626,16 +2795,12 @@ function pickActionString(value) {
 function pickAgentAccess(value) {
   return value === "auto" || value === "confirm" || value === "off" ? value : null;
 }
+function pickAuthorizationMode(value) {
+  return value === "runtime" ? "runtime" : "static";
+}
 function plainObject(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
-function normalizeActionLookupKey(value) {
-  return String(value || "").trim().toLowerCase();
-}
-function actionEntryMatches(entry, needle) {
-  if (!needle) return false;
-  return [entry.actionId, entry.name, entry.toolName].filter((value) => typeof value === "string" && value.length > 0).some((value) => value.toLowerCase() === needle);
-}
 function mapActionInput(action, input2) {
   const remaining = { ...input2 || {} };
   const path4 = action.path.replace(/\{([a-zA-Z0-9_]+)\}/g, (_match, key) => {
@@ -3039,6 +3204,9 @@ var TopoloOAuth2 = class {
     return parsed;
   }
 };
+function contextKey(contextType, organizationId) {
+  return contextType === "organization" && organizationId ? `org:${organizationId}` : "personal";
+}
 var ENVIRONMENT_DEFAULT_SERVICE_URLS = {
   production: {
     developers: "https://developers.topolo.app"
@@ -3132,6 +3300,18 @@ function writeProfileConfig(config, environment, profile) {
   };
   return { ...config, profiles };
 }
+function writeContextCredential(config, environment, ctx, makeActive = true) {
+  const key = contextKey(ctx.contextType, ctx.organizationId);
+  const profile = profileForEnvironment(config, environment);
+  const contexts = { ...profile.contexts ?? {}, [key]: ctx };
+  const next = { contexts };
+  if (makeActive) {
+    next.activeContext = key;
+    next.credential = ctx.credential;
+    next.oauthClientId = ctx.oauthClientId ?? profile.oauthClientId;
+  }
+  return writeProfileConfig(config, environment, next);
+}
 function clearProfileCredential(config, environment) {
   const next = { ...config };
   if (environment === "production") {
@@ -3163,7 +3343,7 @@ async function resolveCredential(environment = selectedEnvironment()) {
   return profileForEnvironment(config, environment).credential ?? null;
 }
 var REFRESH_SKEW_SECONDS = 60;
-async function refreshCredentialIfNeeded(environment = selectedEnvironment()) {
+async function refreshCredentialIfNeeded(environment = selectedEnvironment(), options = {}) {
   const prefix = envVarPrefix(environment);
   if (process.env[`${prefix}_API_KEY`] || process.env[`${prefix}_ACCESS_TOKEN`] || process.env.TOPOLO_API_KEY || process.env.TOPOLO_ACCESS_TOKEN) {
     return resolveCredential(environment);
@@ -3174,7 +3354,7 @@ async function refreshCredentialIfNeeded(environment = selectedEnvironment()) {
   if (!cred || cred.kind !== "access_token") return cred ?? null;
   if (!cred.refreshToken || !cred.expiresAt || !profile.oauthClientId) return cred;
   const now = Math.floor(Date.now() / 1e3);
-  if (cred.expiresAt - REFRESH_SKEW_SECONDS > now) return cred;
+  if (!options.force && cred.expiresAt - REFRESH_SKEW_SECONDS > now) return cred;
   try {
     const oauth = new TopoloOAuth2({
       serviceUrls: resolveServiceUrls(profile.serviceUrls, environment)
@@ -3189,9 +3369,20 @@ async function refreshCredentialIfNeeded(environment = selectedEnvironment()) {
       ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: cred.refreshToken },
       expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
     };
-    await writeConfig(
-      environment === "production" && !config.profiles?.production ? { ...config, credential: refreshed } : writeProfileConfig(config, environment, { credential: refreshed })
-    );
+    const activeContext = profile.activeContext;
+    const activeEntry = activeContext ? profile.contexts?.[activeContext] : void 0;
+    const updated = activeContext && activeEntry ? writeProfileConfig(config, environment, {
+      credential: refreshed,
+      contexts: {
+        ...profile.contexts ?? {},
+        [activeContext]: {
+          ...activeEntry,
+          credential: refreshed,
+          oauthClientId: activeEntry.oauthClientId ?? profile.oauthClientId
+        }
+      }
+    }) : environment === "production" && !config.profiles?.production ? { ...config, credential: refreshed } : writeProfileConfig(config, environment, { credential: refreshed });
+    await writeConfig(updated);
     return refreshed;
   } catch {
     return cred;
@@ -3243,7 +3434,14 @@ function oauthClientRegistrationUrl(environment = selectedEnvironment()) {
 function apiKeyIssuanceUrl(environment = selectedEnvironment()) {
   return `${developerConsoleUrl(environment)}/credentials`;
 }
-var DEFAULT_CLI_CLIENT_IDS = {};
+var DEFAULT_CLI_CLIENT_IDS = {
+  // First-party `topolo-cli` device-flow client, seeded per environment by Auth
+  // (core/TopoloAuth/scripts/seed-first-party-oauth-clients.sql). Each env's
+  // Auth must have this client before the CLI ships pointing at it.
+  production: "topolo-cli",
+  staging: "topolo-cli",
+  development: "topolo-cli"
+};
 function resolveOAuthClientId(config, environment = selectedEnvironment()) {
   const envSpecific = process.env[`${envVarPrefix(environment)}_CLI_CLIENT_ID`];
   if (envSpecific) return envSpecific;
@@ -3301,18 +3499,43 @@ function normalizeError(err) {
     const code = err.code;
     const hintMap = {
       auth_error: "Run `topolo auth login` or set TOPOLO_API_KEY.",
+      confirmation_required: "Review the action and rerun with --confirm to allow it.",
       permission_denied: "Check your API key scopes or role assignments in TopoloDevelopers."
     };
     return {
       message: err.message,
       code,
       hint: code ? hintMap[code] : void 0,
-      exitCode: code === "auth_error" ? 2 : code === "permission_denied" ? 3 : 1
+      exitCode: code === "auth_error" || code === "confirmation_required" ? 2 : code === "permission_denied" ? 3 : 1
     };
   }
   return { message: String(err), exitCode: 1 };
 }
 
+// src/version.ts
+import { readFileSync } from "fs";
+import { dirname as dirname2, join as join2 } from "path";
+import { fileURLToPath } from "url";
+function readCliVersion() {
+  try {
+    const here = dirname2(fileURLToPath(import.meta.url));
+    const candidates = [
+      join2(here, "package.json"),
+      join2(here, "..", "package.json")
+    ];
+    for (const path4 of candidates) {
+      try {
+        const pkg = JSON.parse(readFileSync(path4, "utf8"));
+        if (typeof pkg.version === "string" && pkg.version) return pkg.version;
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return "0.0.0";
+}
+var CLI_VERSION = readCliVersion();
+
 // src/commands/auth.ts
 function registerAuthCommands(program2) {
   const auth = program2.command("auth").description("Manage Topolo credentials");
@@ -3450,18 +3673,15 @@ async function runDeviceFlow(options) {
   } finally {
     spinner?.stop();
   }
+  const credential = {
+    kind: "access_token",
+    accessToken: token.access_token,
+    ...token.refresh_token ? { refreshToken: token.refresh_token } : {},
+    expiresAt: Math.floor(Date.now() / 1e3) + token.expires_in
+  };
+  const context = await resolveLoginContext(credential, resolved.serviceUrls, options.clientId);
   const updated = await readConfig();
-  await writeConfig(
-    writeProfileConfig(updated, options.environment, {
-      credential: {
-        kind: "access_token",
-        accessToken: token.access_token,
-        ...token.refresh_token ? { refreshToken: token.refresh_token } : {},
-        expiresAt: Math.floor(Date.now() / 1e3) + token.expires_in
-      },
-      oauthClientId: options.clientId
-    })
-  );
+  await writeConfig(writeContextCredential(updated, options.environment, context));
   emit(
     {
       ok: true,
@@ -3476,6 +3696,29 @@ async function runDeviceFlow(options) {
     () => "\n  \u2713 Signed in. Run `topolo whoami` to see your identity."
   );
 }
+async function resolveLoginContext(credential, serviceUrls, clientId) {
+  try {
+    const topolo = createTopolo({
+      credential,
+      agent: { clientName: "topolo-cli", clientVersion: CLI_VERSION },
+      serviceUrls
+    });
+    const me = await topolo.identity.whoami();
+    const org = me.organization;
+    if (org?.id) {
+      return {
+        contextType: "organization",
+        organizationId: org.id,
+        organizationSlug: org.slug,
+        organizationName: org.name,
+        credential,
+        oauthClientId: clientId
+      };
+    }
+  } catch {
+  }
+  return { contextType: "personal", credential, oauthClientId: clientId };
+}
 function tryOpenBrowser(url) {
   try {
     const os = platform2();
@@ -3540,30 +3783,6 @@ function sleep(ms) {
   return new Promise((resolve4) => setTimeout(resolve4, ms));
 }
 
-// src/version.ts
-import { readFileSync } from "fs";
-import { dirname as dirname2, join as join2 } from "path";
-import { fileURLToPath } from "url";
-function readCliVersion() {
-  try {
-    const here = dirname2(fileURLToPath(import.meta.url));
-    const candidates = [
-      join2(here, "package.json"),
-      join2(here, "..", "package.json")
-    ];
-    for (const path4 of candidates) {
-      try {
-        const pkg = JSON.parse(readFileSync(path4, "utf8"));
-        if (typeof pkg.version === "string" && pkg.version) return pkg.version;
-      } catch {
-      }
-    }
-  } catch {
-  }
-  return "0.0.0";
-}
-var CLI_VERSION = readCliVersion();
-
 // src/client.ts
 async function buildClient(options) {
   const environment = selectedEnvironment();
@@ -3580,6 +3799,7 @@ async function buildClient(options) {
     },
     serviceUrls: profile.serviceUrls,
     requireConfirmForWrites: options?.requireConfirmForWrites,
+    ...credential.kind === "access_token" && credential.refreshToken ? { refreshCredential: () => refreshCredentialIfNeeded(environment, { force: true }) } : {},
     ...isDebugEnabled() ? { debug: stderrDebugLogger } : {}
   });
 }
@@ -3642,93 +3862,6 @@ function formatPretty(info) {
   return lines.join("\n");
 }
 
-// src/commands/actions.ts
-function registerActionsCommand(program2) {
-  const actions = program2.command("actions").description("List and call permission-scoped Topolo actions from the live catalog").option("-s, --service <service>", "Filter by app id, slug, or name").option("--json", "Output JSON", true).option("--no-json", "Output human-readable table").action(async (opts) => {
-    const mode = resolveOutputMode(opts.json);
-    try {
-      const topolo = await buildClient();
-      if (!topolo) {
-        throw new Error("No credential configured. Run `topolo auth login` or set TOPOLO_API_KEY.");
-      }
-      const rows = await topolo.client.listActions({ service: opts.service });
-      emit({ actions: rows }, mode, () => formatActionRows(rows));
-    } catch (err) {
-      fail(err, mode);
-    }
-  });
-  actions.command("get <action>").description("Describe one Topolo action by action id, name, or tool name").option("--json", "Output JSON", true).option("--no-json", "Output human-readable text").action(async (action, opts) => {
-    const mode = resolveOutputMode(opts.json);
-    try {
-      const topolo = await buildClient();
-      if (!topolo) {
-        throw new Error("No credential configured. Run `topolo auth login` or set TOPOLO_API_KEY.");
-      }
-      const entry = await topolo.client.getAction(action);
-      emit(entry, mode, () => formatActionDetail(entry));
-    } catch (err) {
-      fail(err, mode);
-    }
-  });
-  actions.command("call <action>").description("Call a permission-scoped Topolo action").option("-d, --data <json>", "JSON action input", "{}").option("--confirm", "Acknowledge a mutating action").option("--json", "Output JSON", true).option("--no-json", "Output human-readable text").action(async (action, opts) => {
-    const mode = resolveOutputMode(opts.json);
-    try {
-      const topolo = await buildClient();
-      if (!topolo) {
-        throw new Error("No credential configured. Run `topolo auth login` or set TOPOLO_API_KEY.");
-      }
-      const input2 = parseJsonObject(opts.data || "{}");
-      const result = await topolo.client.callAction(action, input2, { confirm: opts.confirm === true });
-      emit(result, mode, () => JSON.stringify(result, null, 2));
-    } catch (err) {
-      fail(err, mode);
-    }
-  });
-}
-function parseJsonObject(value) {
-  let parsed;
-  try {
-    parsed = JSON.parse(value);
-  } catch {
-    throw new Error("--data must be valid JSON");
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("--data must be a JSON object");
-  }
-  return parsed;
-}
-function formatActionRows(rows) {
-  if (rows.length === 0) return "No actions available for this credential.";
-  const serviceWidth = Math.max(7, ...rows.map((row) => (row.appSlug || row.appId).length));
-  const nameWidth = Math.max(6, ...rows.map((row) => row.name.length));
-  const methodWidth = Math.max(6, ...rows.map((row) => row.method.length));
-  const lines = [
-    `${"SERVICE".padEnd(serviceWidth)}  ${"ACTION".padEnd(nameWidth)}  ${"METHOD".padEnd(methodWidth)}  CONFIRM  PERMISSION`,
-    `${"-".repeat(serviceWidth)}  ${"-".repeat(nameWidth)}  ${"-".repeat(methodWidth)}  -------  ----------`
-  ];
-  for (const row of rows) {
-    const confirmation = row.requiresConfirmation ? "yes" : "no";
-    lines.push(
-      `${(row.appSlug || row.appId).padEnd(serviceWidth)}  ${row.name.padEnd(nameWidth)}  ${row.method.padEnd(methodWidth)}  ${confirmation.padEnd(7)}  ${row.requiredPermission}`
-    );
-  }
-  return lines.join("\n");
-}
-function formatActionDetail(action) {
-  return [
-    `Action:       ${action.name}`,
-    `ID:           ${action.actionId}`,
-    `Tool:         ${action.toolName || "-"}`,
-    `Service:      ${action.appSlug || action.appId}`,
-    `Method:       ${action.method}`,
-    `Path:         ${action.path}`,
-    `Permission:   ${action.requiredPermission}`,
-    `Confirmation: ${action.requiresConfirmation ? "required" : "not required"}`,
-    "",
-    action.description
-  ].join("\n");
-}
-
 // src/commands/api.ts
 var STATIC_APP_IDS = new Set(Object.keys(DEFAULT_APP_URLS));
 var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
@@ -3811,25 +3944,132 @@ function resolveConfiguredServiceUrl2(service, serviceUrls) {
     withoutTopolo,
     withoutTopolo.replace(/-/g, "_")
   ];
-  for (const candidate of candidates) {
-    const url = serviceUrls?.[candidate];
-    if (typeof url === "string" && url.trim()) return url.trim();
+  for (const candidate of candidates) {
+    const url = serviceUrls?.[candidate];
+    if (typeof url === "string" && url.trim()) return url.trim();
+  }
+  return void 0;
+}
+function parseQueryPairs(pairs) {
+  if (!pairs || pairs.length === 0) return void 0;
+  const out = {};
+  for (const pair of pairs) {
+    const eq = pair.indexOf("=");
+    if (eq <= 0) {
+      throw new Error(`Invalid --query entry "${pair}". Expected key=value.`);
+    }
+    const key = pair.slice(0, eq);
+    const value = pair.slice(eq + 1);
+    out[key] = value;
+  }
+  return out;
+}
+
+// src/commands/actions.ts
+function registerActionsCommand(program2) {
+  const actions = program2.command("actions").description("Search permission-scoped Topolo actions for one application").option("-s, --service <service>", "App id, slug, or name (required for search)").option("-q, --query <query>", "Filter by action id, name, or title").option("--cursor <cursor>", "Continuation cursor from the previous page").option("--limit <limit>", "Page size (1-100)", "25").option("--json", "Output JSON").option("--no-json", "Output human-readable table").action(async (opts) => {
+    const mode = resolveOutputMode(opts.json);
+    try {
+      const topolo = await buildClient();
+      if (!topolo) {
+        throw new Error("No credential configured. Run `topolo auth login` or set TOPOLO_API_KEY.");
+      }
+      if (!opts.service?.trim()) throw new Error("--service is required for action search");
+      const result = await topolo.client.searchActions({
+        service: opts.service.trim(),
+        query: opts.query,
+        cursor: opts.cursor,
+        limit: parsePageSize(opts.limit)
+      });
+      emit(result, mode, () => formatActionRows(result.actions, result.page.nextCursor));
+    } catch (err) {
+      fail(err, mode);
+    }
+  });
+  actions.command("get <action>").description("Describe one Topolo action by exact action id").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (action, opts, command) => {
+    const mode = resolveOutputMode(opts.json ?? command.parent?.opts().json);
+    try {
+      const topolo = await buildClient();
+      if (!topolo) {
+        throw new Error("No credential configured. Run `topolo auth login` or set TOPOLO_API_KEY.");
+      }
+      const entry = await topolo.client.getAction(action);
+      emit(entry, mode, () => formatActionDetail(entry));
+    } catch (err) {
+      fail(err, mode);
+    }
+  });
+  actions.command("call <action>").description("Call a permission-scoped Topolo action").option("-d, --data <json>", "JSON action input", "{}").option("--resource-type <type>", "App-local resource alias, such as workspace").option("--resource-id <id>", "Resource id for the selected resource type").option("--confirm", "Acknowledge a mutating action").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (action, opts, command) => {
+    const mode = resolveOutputMode(opts.json ?? command.parent?.opts().json);
+    try {
+      const topolo = await buildClient();
+      if (!topolo) {
+        throw new Error("No credential configured. Run `topolo auth login` or set TOPOLO_API_KEY.");
+      }
+      const input2 = parseJsonObject(opts.data || "{}");
+      const resource = parseResourceOption(opts.resourceType, opts.resourceId);
+      const result = await topolo.client.callAction(action, input2, {
+        confirm: opts.confirm === true,
+        ...resource ? { resource } : {}
+      });
+      emit(result, mode, () => JSON.stringify(result, null, 2));
+    } catch (err) {
+      fail(err, mode);
+    }
+  });
+}
+function parseJsonObject(value) {
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    throw new Error("--data must be valid JSON");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("--data must be a JSON object");
+  }
+  return parsed;
+}
+function formatActionRows(rows, nextCursor = null) {
+  if (rows.length === 0) return "No actions available for this credential.";
+  const serviceWidth = Math.max(7, ...rows.map((row) => (row.appSlug || row.appId).length));
+  const nameWidth = Math.max(6, ...rows.map((row) => row.name.length));
+  const methodWidth = Math.max(6, ...rows.map((row) => row.method.length));
+  const lines = [
+    `${"SERVICE".padEnd(serviceWidth)}  ${"ACTION".padEnd(nameWidth)}  ${"METHOD".padEnd(methodWidth)}  CONFIRM  PERMISSION`,
+    `${"-".repeat(serviceWidth)}  ${"-".repeat(nameWidth)}  ${"-".repeat(methodWidth)}  -------  ----------`
+  ];
+  for (const row of rows) {
+    const confirmation = row.requiresConfirmation ? "yes" : "no";
+    lines.push(
+      `${(row.appSlug || row.appId).padEnd(serviceWidth)}  ${row.name.padEnd(nameWidth)}  ${row.method.padEnd(methodWidth)}  ${confirmation.padEnd(7)}  ${row.requiredPermission}`
+    );
   }
-  return void 0;
+  if (nextCursor) lines.push("", `Next cursor: ${nextCursor}`);
+  return lines.join("\n");
 }
-function parseQueryPairs(pairs) {
-  if (!pairs || pairs.length === 0) return void 0;
-  const out = {};
-  for (const pair of pairs) {
-    const eq = pair.indexOf("=");
-    if (eq <= 0) {
-      throw new Error(`Invalid --query entry "${pair}". Expected key=value.`);
-    }
-    const key = pair.slice(0, eq);
-    const value = pair.slice(eq + 1);
-    out[key] = value;
+function parsePageSize(value) {
+  const parsed = Number.parseInt(value || "25", 10);
+  if (!Number.isFinite(parsed) || parsed < 1 || parsed > 100) {
+    throw new Error("--limit must be an integer between 1 and 100");
   }
-  return out;
+  return parsed;
+}
+function formatActionDetail(action) {
+  return [
+    `Action:       ${action.name}`,
+    `ID:           ${action.actionId}`,
+    `Tool:         ${action.toolName || "-"}`,
+    `Service:      ${action.appSlug || action.appId}`,
+    `Target:       ${action.target || "-"}`,
+    `API URL:      ${action.apiBaseUrl || "-"}`,
+    `Method:       ${action.method}`,
+    `Path:         ${action.path}`,
+    `Permission:   ${action.requiredPermission}`,
+    `Confirmation: ${action.requiresConfirmation ? "required" : "not required"}`,
+    "",
+    action.description
+  ].join("\n");
 }
 
 // src/commands/apps.ts
@@ -5073,6 +5313,12 @@ function firstPartyAppPath(appDir, _audience) {
   return `apps/${appDir}`;
 }
 
+// src/commands/app-scaffold-cloudflare-constants.ts
+var CLOUDFLARE_ACCOUNT_ID = "49ef1ba682ad8cfd720c86699ae17521";
+var STAGING_CLOUDFLARE_ACCOUNT_ID = "4f4e1c69a3830946f9fea7b1eb7531ac";
+var DEVELOPMENT_CLOUDFLARE_ACCOUNT_ID = "0ebdeec262a245481a721fc4f9d6d798";
+var CLOUDFLARE_COMPATIBILITY_DATE = "2026-05-05";
+
 // src/commands/app-scaffold-package-template.ts
 function packageJson(application, target, options) {
   const dependencies = {};
@@ -5111,16 +5357,43 @@ function packageJson(application, target, options) {
     devDependencies["@cloudflare/workers-types"] = "^4.20260413.1";
     if (target === "platform") {
       dependencies["@topolo-io/worker-runtime"] = topoloPackageVersion("@topolo-io/worker-runtime", target);
+      dependencies["@topolo-io/auth-middleware"] = topoloPackageVersion("@topolo-io/auth-middleware", target);
+      dependencies["@topolo-io/error-middleware"] = topoloPackageVersion("@topolo-io/error-middleware", target);
+      dependencies["@topolo-io/security-headers"] = topoloPackageVersion("@topolo-io/security-headers", target);
+      dependencies["@topolo-io/resource-context"] = topoloPackageVersion("@topolo-io/resource-context", target);
+      dependencies["@topolo-io/data"] = topoloPackageVersion("@topolo-io/data", target);
       dependencies["@topolo/sdk"] = topoloPackageVersion("@topolo/sdk", target);
       dependencies.hono = "^4";
+      dependencies.zod = "^4.4.3";
       scripts.deploy = `node -e 'console.error("\\nX Bare deploy is disabled. Use deploy:staging or deploy:production.\\n"); process.exit(1)'`;
-      scripts["deploy:staging"] = "DEPLOY_ENVIRONMENT=staging VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us npm run build && wrangler deploy --config apps/api/wrangler.toml --env staging && wrangler deploy --config apps/web/wrangler.toml --env staging";
-      scripts["deploy:production"] = "DEPLOY_ENVIRONMENT=production VITE_TOPOLO_AUTH_URL=https://auth.topolo.app npm run build && wrangler deploy --config apps/api/wrangler.toml --env production && wrangler deploy --config apps/web/wrangler.toml --env production";
+      scripts["deploy:staging"] = `DEPLOY_ENVIRONMENT=staging CLOUDFLARE_ACCOUNT_ID=${STAGING_CLOUDFLARE_ACCOUNT_ID} python3 .github/scripts/standard_deploy.py local-deploy`;
+      scripts["deploy:production"] = `DEPLOY_ENVIRONMENT=production CLOUDFLARE_ACCOUNT_ID=${CLOUDFLARE_ACCOUNT_ID} python3 .github/scripts/standard_deploy.py local-deploy`;
     } else {
       dependencies["@topolo/sdk"] = topoloPackageVersion("@topolo/sdk", target);
       scripts.deploy = "npm run build && wrangler deploy";
     }
-    devDependencies.wrangler = "^4.40.2";
+    devDependencies.wrangler = "^4.91.0";
+  }
+  if (target === "platform") {
+    const testDirs = [];
+    if (options.browser) testDirs.push("apps/web");
+    if (options.api) testDirs.push("apps/api");
+    if (testDirs.length > 0) {
+      const chain = (withCoverage) => testDirs.map((dir, index) => {
+        const enter = index === 0 ? `cd ${dir}` : `cd ../${dir.split("/").pop()}`;
+        return `${enter} && vitest run --config vitest.config.ts --passWithNoTests${withCoverage ? " --coverage" : ""}`;
+      }).join(" && ");
+      scripts.test = chain(false);
+      scripts.coverage = chain(true);
+      scripts.typecheck = testDirs.map((dir) => `tsc --noEmit -p ${dir}/tsconfig.json`).join(" && ");
+      devDependencies.vitest = "^3.2.4";
+      devDependencies["@vitest/coverage-v8"] = "^3.2.4";
+      if (options.browser) {
+        devDependencies.jsdom = "^29.1.1";
+        devDependencies["@testing-library/react"] = "^16.3.2";
+        devDependencies["@testing-library/user-event"] = "^14.6.1";
+      }
+    }
   }
   if (target === "platform" && hasScaffoldResources(options.resources)) {
     scripts["check:deploy-config"] = "wrangler deploy --config apps/api/wrangler.toml --env staging --dry-run --outdir .wrangler/api-build && wrangler deploy --config apps/web/wrangler.toml --env staging --dry-run --outdir .wrangler/web-build";
@@ -5140,17 +5413,21 @@ function topoloPackageVersion(packageName, target) {
   if (target === "developer") {
     if (packageName === "@topolo/login") return "^0.1.0";
     if (packageName === "@topolo-io/auth-client") return "^1.0.0";
-    if (packageName === "@topolo/sdk") return "^0.4.9";
+    if (packageName === "@topolo/sdk") return "^0.8.1";
     return "^0.1.0";
   }
   const platformPackageVersions = {
-    "@topolo/sdk": "^0.4.9",
+    "@topolo/sdk": "^0.8.1",
     "@topolo/login": "^0.1.0",
     "@topolo-io/app-funnel": "^0.1.6",
     "@topolo-io/app-launcher": "^0.1.15",
     "@topolo-io/app-shell": "^0.5.54",
     "@topolo-io/auth-client": "^1.2.1",
-    "@topolo-io/auth-middleware": "^0.3.4",
+    "@topolo-io/auth-middleware": "^0.4.0",
+    "@topolo-io/error-middleware": "^0.6.0",
+    "@topolo-io/security-headers": "^0.2.2",
+    "@topolo-io/resource-context": "^0.3.0",
+    "@topolo-io/data": "^0.1.2",
     "@topolo-io/worker-runtime": "^0.1.11",
     "@topolo-io/design-tokens": "^0.1.8",
     "@topolo-io/onboarding": "^0.9.5",
@@ -5186,7 +5463,12 @@ function resourceConfig(application, profile) {
       workflowProductionName: `topolo-${slug}-import`,
       workflowStagingName: `topolo-${slug}-import-staging`,
       containerProductionName: `topolo-${slug}-processor`,
-      containerStagingName: `topolo-${slug}-processor-staging`
+      containerStagingName: `topolo-${slug}-processor-staging`,
+      d1DevelopmentName: `topolo-${slug}-core-development`,
+      r2DevelopmentName: `topolo-${slug}-assets-development`,
+      queueDevelopmentName: `topolo-${slug}-processing-development`,
+      workflowDevelopmentName: `topolo-${slug}-import-development`,
+      containerDevelopmentName: `topolo-${slug}-processor-development`
     };
   }
   return {
@@ -5204,7 +5486,12 @@ function resourceConfig(application, profile) {
     workflowProductionName: `topolo-${slug}-workflow`,
     workflowStagingName: `topolo-${slug}-workflow-staging`,
     containerProductionName: `topolo-${slug}-processor`,
-    containerStagingName: `topolo-${slug}-processor-staging`
+    containerStagingName: `topolo-${slug}-processor-staging`,
+    d1DevelopmentName: `topolo-${slug}-core-development`,
+    r2DevelopmentName: `topolo-${slug}-assets-development`,
+    queueDevelopmentName: `topolo-${slug}-queue-development`,
+    workflowDevelopmentName: `topolo-${slug}-workflow-development`,
+    containerDevelopmentName: `topolo-${slug}-processor-development`
   };
 }
 
@@ -5377,6 +5664,64 @@ function tsconfigJson(api, target) {
   })}
 `;
 }
+var TSCONFIG_TEST_EXCLUDE = [
+  "src/**/*.test.ts",
+  "src/**/*.test.tsx",
+  "src/**/*.test.mts",
+  "src/**/*.spec.ts",
+  "src/**/*.spec.tsx",
+  "test"
+];
+function webTsconfigJson() {
+  return `${json({
+    compilerOptions: {
+      target: "ES2022",
+      useDefineForClassFields: true,
+      lib: ["ES2022", "DOM", "DOM.Iterable"],
+      allowJs: false,
+      skipLibCheck: true,
+      esModuleInterop: true,
+      allowSyntheticDefaultImports: true,
+      strict: true,
+      forceConsistentCasingInFileNames: true,
+      module: "ESNext",
+      moduleResolution: "Bundler",
+      resolveJsonModule: true,
+      isolatedModules: true,
+      noEmit: true,
+      jsx: "react-jsx",
+      types: ["vite/client"]
+    },
+    include: ["src"],
+    references: [],
+    exclude: TSCONFIG_TEST_EXCLUDE
+  })}
+`;
+}
+function apiTsconfigJson() {
+  return `${json({
+    compilerOptions: {
+      target: "ES2022",
+      lib: ["ES2022", "DOM", "DOM.Iterable", "WebWorker"],
+      allowJs: false,
+      skipLibCheck: true,
+      esModuleInterop: true,
+      allowSyntheticDefaultImports: true,
+      strict: true,
+      forceConsistentCasingInFileNames: true,
+      module: "ESNext",
+      moduleResolution: "Bundler",
+      resolveJsonModule: true,
+      isolatedModules: true,
+      noEmit: true,
+      types: ["@cloudflare/workers-types", "node"]
+    },
+    include: ["src"],
+    references: [],
+    exclude: TSCONFIG_TEST_EXCLUDE
+  })}
+`;
+}
 function gitignore() {
   return [
     "node_modules/",
@@ -6118,11 +6463,6 @@ function developerAppTsx(application) {
   ].join("\n");
 }
 
-// src/commands/app-scaffold-cloudflare-constants.ts
-var CLOUDFLARE_ACCOUNT_ID = "49ef1ba682ad8cfd720c86699ae17521";
-var STAGING_CLOUDFLARE_ACCOUNT_ID = "4f4e1c69a3830946f9fea7b1eb7531ac";
-var CLOUDFLARE_COMPATIBILITY_DATE = "2026-05-05";
-
 // src/commands/app-scaffold-worker-template.ts
 function webWorkerTs(application) {
   const serviceName = toTitle(application.name);
@@ -6177,6 +6517,29 @@ function platformWebWranglerToml(application) {
     'binding = "API"',
     `service = "topolo-${slug}-api"`,
     "",
+    "[env.development]",
+    `name = "topolo-${slug}-development"`,
+    `account_id = "${DEVELOPMENT_CLOUDFLARE_ACCOUNT_ID}"`,
+    "workers_dev = true",
+    "",
+    "[env.development.vars]",
+    `APP_ID = "${application.appId ?? ""}"`,
+    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
+    "",
+    "[[env.development.routes]]",
+    `pattern = "${slug}.topolo.dev"`,
+    "custom_domain = true",
+    "",
+    "[env.development.assets]",
+    'directory = "./dist"',
+    'binding = "ASSETS"',
+    'not_found_handling = "single-page-application"',
+    'run_worker_first = ["/api/*"]',
+    "",
+    "[[env.development.services]]",
+    'binding = "API"',
+    `service = "topolo-${slug}-api-development"`,
+    "",
     "[env.staging]",
     `name = "topolo-${slug}-staging"`,
     `account_id = "${STAGING_CLOUDFLARE_ACCOUNT_ID}"`,
@@ -6248,6 +6611,22 @@ function platformApiWranglerToml(application, resources, profile) {
     ""
   ];
   appendResourceWranglerBlocks(lines, resources, resource, "production");
+  lines.push(
+    "[env.development]",
+    `name = "topolo-${slug}-api-development"`,
+    `account_id = "${DEVELOPMENT_CLOUDFLARE_ACCOUNT_ID}"`,
+    "workers_dev = true",
+    "",
+    "[env.development.vars]",
+    'AUTH_BASE_URL = "https://auth.topolo.dev"',
+    'NEXUS_GATEWAY_URL = "https://nexus.topolo.dev"',
+    `NEXUS_APP_ID = "${slug}"`,
+    `APP_ID = "${application.appId ?? ""}"`,
+    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
+    'ENVIRONMENT = "development"',
+    ""
+  );
+  appendResourceWranglerBlocks(lines, resources, resource, "development");
   lines.push(
     "[env.staging]",
     `name = "topolo-${slug}-api-staging"`,
@@ -6281,13 +6660,14 @@ function platformApiWranglerToml(application, resources, profile) {
   return lines.join("\n");
 }
 function appendResourceWranglerBlocks(lines, resources, resource, environment) {
-  const prefix = environment === "staging" ? "env.staging." : environment === "production-env" ? "env.production." : "";
-  const envName = environment === "staging" ? "Staging" : "Production";
+  const prefix = environment === "staging" ? "env.staging." : environment === "development" ? "env.development." : environment === "production-env" ? "env.production." : "";
+  const envName = environment === "staging" ? "Staging" : environment === "development" ? "Development" : "Production";
+  const pick = (dev, staging, prod) => environment === "development" ? dev : environment === "staging" ? staging : prod;
   if (resources.d1) {
     lines.push(
       `[[${prefix}d1_databases]]`,
       `binding = "${resource.d1Binding}"`,
-      `database_name = "${environment === "staging" ? resource.d1StagingName : resource.d1ProductionName}"`,
+      `database_name = "${pick(resource.d1DevelopmentName, resource.d1StagingName, resource.d1ProductionName)}"`,
       'database_id = "provision-after-scaffold"',
       'migrations_dir = "migrations"',
       ""
@@ -6297,7 +6677,7 @@ function appendResourceWranglerBlocks(lines, resources, resource, environment) {
     lines.push(
       `[[${prefix}r2_buckets]]`,
       `binding = "${resource.r2Binding}"`,
-      `bucket_name = "${environment === "staging" ? resource.r2StagingName : resource.r2ProductionName}"`,
+      `bucket_name = "${pick(resource.r2DevelopmentName, resource.r2StagingName, resource.r2ProductionName)}"`,
       ""
     );
   }
@@ -6305,10 +6685,10 @@ function appendResourceWranglerBlocks(lines, resources, resource, environment) {
     lines.push(
       `[[${prefix}queues.producers]]`,
       `binding = "${resource.queueBinding}"`,
-      `queue = "${environment === "staging" ? resource.queueStagingName : resource.queueProductionName}"`,
+      `queue = "${pick(resource.queueDevelopmentName, resource.queueStagingName, resource.queueProductionName)}"`,
       "",
       `[[${prefix}queues.consumers]]`,
-      `queue = "${environment === "staging" ? resource.queueStagingName : resource.queueProductionName}"`,
+      `queue = "${pick(resource.queueDevelopmentName, resource.queueStagingName, resource.queueProductionName)}"`,
       ""
     );
   }
@@ -6316,7 +6696,7 @@ function appendResourceWranglerBlocks(lines, resources, resource, environment) {
     lines.push(
       `[[${prefix}workflows]]`,
       `binding = "${resource.workflowBinding}"`,
-      `name = "${environment === "staging" ? resource.workflowStagingName : resource.workflowProductionName}"`,
+      `name = "${pick(resource.workflowDevelopmentName, resource.workflowStagingName, resource.workflowProductionName)}"`,
       `class_name = "${resource.workflowClassName}"`,
       ""
     );
@@ -6514,6 +6894,8 @@ function platformWorkerTs(application, options) {
     "import { Hono } from 'hono';",
     "import { createTopoloWidgetResponse, type TopoloWidgetDraft } from '@topolo/sdk';",
     "import { createTopoloWorkerRuntime, type TopoloRuntimeContext } from '@topolo-io/worker-runtime';",
+    "import { withSecurityHeaders } from '@topolo-io/security-headers';",
+    "import { withErrorReporting } from '@topolo-io/error-middleware';",
     "import { SCAFFOLD_APP_ID, SCAFFOLD_APP_NAME, SCAFFOLD_SERVICE_SLUG, resolveRuntimeAppId } from './app-identity';",
     ...options.resources.workflow ? ["import { WorkflowEntrypoint, type WorkflowEvent, type WorkflowStep } from 'cloudflare:workers';"] : [],
     "",
@@ -6604,11 +6986,20 @@ function platformWorkerTs(application, options) {
     "  return handleRequest(c.req.raw, c.env, rt);",
     "});",
     "",
+    "// Platform security headers + structured error reporting wrap the whole app",
+    "// (outermost), so headers are stamped even on error-middleware 5xx responses.",
+    "const securedFetch = withSecurityHeaders(",
+    "  withErrorReporting(",
+    "    (request: Request, env: Env, ctx: ExecutionContext) => api.fetch(request, env, ctx),",
+    "    { appName: SCAFFOLD_APP_NAME, appId: SCAFFOLD_SERVICE_SLUG },",
+    "  ),",
+    ") as (request: Request, env: Env, ctx: ExecutionContext) => Response | Promise<Response>;",
+    "",
     "export default {",
     "  fetch: runtime.worker((request, env, ctx, rt) => {",
     "    const bindings = env as Env & { __rt?: TopoloRuntimeContext<Env> };",
     "    bindings.__rt = rt;",
-    "    return api.fetch(request, bindings, ctx as ExecutionContext);",
+    "    return securedFetch(request, bindings, ctx as ExecutionContext);",
     "  }),",
     "};",
     "",
@@ -6961,9 +7352,12 @@ function topoloAppManifestJson(application, options) {
     $schema: "./../../topolo-platform/tooling/app-manifest-schema.json",
     name: `topolo-${slug}`,
     appId: application.appId,
-    primaryTarget: "web",
     compatibilityDate: CLOUDFLARE_COMPATIBILITY_DATE,
     environments: {
+      development: {
+        accountId: DEVELOPMENT_CLOUDFLARE_ACCOUNT_ID,
+        domain: "topolo.dev"
+      },
       staging: {
         accountId: STAGING_CLOUDFLARE_ACCOUNT_ID,
         domain: "stg.topolo.us"
@@ -7004,6 +7398,15 @@ function cloudcontrolJson(application, options) {
         resource_name: resources.d1StagingName,
         resource_id: "provision-after-scaffold",
         migrations_dir: "migrations"
+      },
+      {
+        resource_type: "d1",
+        binding: resources.d1Binding,
+        environment: "development",
+        account_id: DEVELOPMENT_CLOUDFLARE_ACCOUNT_ID,
+        resource_name: resources.d1DevelopmentName,
+        resource_id: "provision-after-scaffold",
+        migrations_dir: "migrations"
       }
     );
   }
@@ -7624,6 +8027,74 @@ function envExample(application) {
 function generateOpaqueAppId() {
   return `app_${randomBytes(9).toString("base64url")}`;
 }
+function standardScriptStub() {
+  return `#!/usr/bin/env python3
+"""Canonical-fetching stub for .github/scripts/standard_*.py.
+
+Replaces a vendored copy. At runtime, finds the canonical sibling in
+\`<repo-parent>/topolo-platform/tooling/<name>.py\` and execs it, passing argv
+through, so every consumer runs the current platform script on every
+invocation (no drifted per-app copies).
+
+Override: set TOPOLO_PLATFORM_DIR to the absolute path of the topolo-platform
+repo when the canonical is in a non-default checkout layout (e.g. CI). If no
+canonical can be found, exits 2 with a clear message rather than silently
+falling back.
+"""
+from __future__ import annotations
+
+import os
+import sys
+
+STUB_NAME = os.path.basename(__file__)  # standard_ci.py OR standard_deploy.py
+HERE = os.path.dirname(os.path.abspath(__file__))
+
+
+def find_canonical() -> str | None:
+    # 1. Explicit override (CI runners with non-standard layouts).
+    override = os.environ.get('TOPOLO_PLATFORM_DIR')
+    if override:
+        path = os.path.join(override, 'tooling', STUB_NAME)
+        if os.path.exists(path):
+            return path
+    # 2. Walk up looking for a sibling topolo-platform/tooling/<name>.py.
+    cursor = HERE
+    for _ in range(10):
+        candidate = os.path.normpath(os.path.join(cursor, '..', 'topolo-platform', 'tooling', STUB_NAME))
+        if os.path.exists(candidate):
+            return candidate
+        parent = os.path.dirname(cursor)
+        if parent == cursor:
+            break
+        cursor = parent
+    # 3. node_modules-based delivery (future): @topolo-io/standard-ci.
+    cursor = HERE
+    for _ in range(10):
+        candidate = os.path.normpath(os.path.join(cursor, 'node_modules', '@topolo-io', 'standard-ci', 'bin', STUB_NAME))
+        if os.path.exists(candidate):
+            return candidate
+        parent = os.path.dirname(cursor)
+        if parent == cursor:
+            break
+        cursor = parent
+    return None
+
+
+def main() -> None:
+    canonical = find_canonical()
+    if not canonical:
+        sys.stderr.write(
+            f'[topolo-canonical-stub] could not locate canonical {STUB_NAME}.\\n'
+            f'  Set TOPOLO_PLATFORM_DIR or checkout topolo-platform as a sibling of this app.\\n'
+        )
+        sys.exit(2)
+    os.execv(sys.executable, [sys.executable, canonical, *sys.argv[1:]])
+
+
+if __name__ == '__main__':
+    main()
+`;
+}
 function applicationScaffoldPayload(application, options = {}) {
   const target = normalizeTarget(options.target);
   const portfolio = target === "platform" ? normalizePortfolio(options.portfolio) : null;
@@ -7642,6 +8113,9 @@ function applicationScaffoldPayload(application, options = {}) {
   const containerAppId = normalizeContainerAppId(options.containerAppId, surfaceModel);
   const profile = normalizeScaffoldProfile(options.profile);
   const resources = resolveScaffoldResources(profile, options);
+  if (target === "platform" && api && !profile) {
+    resources.d1 = true;
+  }
   const ownerType = target === "platform" ? "topolo_first_party" : "third_party";
   const distributionModel = target === "platform" ? "marketplace" : "organization_internal";
   const appDir = options.appDir ?? catalogApplication?.appDir ?? (target === "platform" ? `Topolo${toPascalCase(id)}` : `topolo-${slug}`);
@@ -7788,6 +8262,28 @@ function scaffoldCapabilities(options) {
 function scaffoldFiles(options) {
   const { application, target } = options;
   const slug = toSlug(application.id);
+  const tablePrefix = slug.replace(/-/g, "_");
+  const tenantColumn = options.payload.tenancy === "household" ? "household_id" : "organization_id";
+  const workspacesMigrationSql = [
+    `CREATE TABLE IF NOT EXISTS ${tablePrefix}_workspaces (`,
+    "  id TEXT PRIMARY KEY,",
+    `  ${tenantColumn} TEXT NOT NULL,`,
+    "  name TEXT NOT NULL,",
+    "  slug TEXT NOT NULL,",
+    "  created_by_user_id TEXT,",
+    "  created_by_email TEXT,",
+    "  created_at TEXT NOT NULL,",
+    "  updated_at TEXT NOT NULL,",
+    `  UNIQUE(${tenantColumn}, slug)`,
+    ");",
+    "",
+    `CREATE INDEX IF NOT EXISTS idx_${tablePrefix}_workspaces_${tenantColumn}`,
+    `  ON ${tablePrefix}_workspaces(${tenantColumn});`,
+    "",
+    `CREATE INDEX IF NOT EXISTS idx_${tablePrefix}_workspaces_slug`,
+    `  ON ${tablePrefix}_workspaces(${tenantColumn}, slug);`,
+    ""
+  ].join("\n");
   const base = target === "platform" ? firstPartyAppPath(application.appDir, options.payload.audience) : application.appDir;
   const browserBase = target === "platform" ? `${base}/apps/web` : base;
   const apiBase = target === "platform" ? `${base}/apps/api` : base;
@@ -7845,15 +8341,6 @@ function scaffoldFiles(options) {
         resources: options.payload.resources
       })
     },
-    {
-      path: `${base}/tsconfig.json`,
-      purpose: "TypeScript configuration for the generated app.",
-      requiredSignals: [
-        "uses strict mode",
-        "includes browser DOM types for React and Worker types for API-backed apps"
-      ],
-      content: tsconfigJson(options.api, target)
-    },
     {
       path: `${browserBase}/vite.config.ts`,
       purpose: "Vite browser build configuration.",
@@ -7911,6 +8398,31 @@ function scaffoldFiles(options) {
       content: stylesCss()
     }
   ];
+  if (target === "platform") {
+    if (options.browser) {
+      files.push({
+        path: `${browserBase}/tsconfig.json`,
+        purpose: "TypeScript configuration for the browser surface (DOM + vite types).",
+        requiredSignals: ["uses strict mode", "includes browser DOM types for React"],
+        content: webTsconfigJson()
+      });
+    }
+    if (options.api) {
+      files.push({
+        path: `${apiBase}/tsconfig.json`,
+        purpose: "TypeScript configuration for the API worker surface (Workers types).",
+        requiredSignals: ["uses strict mode", "includes Cloudflare Workers types"],
+        content: apiTsconfigJson()
+      });
+    }
+  } else {
+    files.push({
+      path: `${base}/tsconfig.json`,
+      purpose: "TypeScript configuration for the generated app.",
+      requiredSignals: ["uses strict mode", "includes browser DOM types for React and Worker types for API-backed apps"],
+      content: tsconfigJson(options.api, target)
+    });
+  }
   if (target === "platform") {
     files.push(
       {
@@ -7951,6 +8463,33 @@ function scaffoldFiles(options) {
         ],
         content: options.ciWorkflow ?? ""
       },
+      {
+        path: `${base}/.github/scripts/standard_deploy.py`,
+        purpose: "Canonical-fetching deploy stub (execs topolo-platform/tooling/standard_deploy.py).",
+        requiredSignals: [
+          "never a vendored copy of the canonical script",
+          "runs the current platform standard_deploy.py on every invocation"
+        ],
+        content: standardScriptStub()
+      },
+      {
+        path: `${base}/.github/scripts/standard_ci.py`,
+        purpose: "Canonical-fetching CI stub (execs topolo-platform/tooling/standard_ci.py).",
+        requiredSignals: [
+          "never a vendored copy of the canonical script",
+          "runs the current platform standard_ci.py on every invocation"
+        ],
+        content: standardScriptStub()
+      },
+      {
+        path: `${base}/.github/scripts/standard_ops.py`,
+        purpose: "Canonical-fetching ops stub (execs topolo-platform/tooling/standard_ops.py).",
+        requiredSignals: [
+          "never a vendored copy of the canonical script",
+          "runs the current platform standard_ops.py on every invocation"
+        ],
+        content: standardScriptStub()
+      },
       {
         path: `system-apps/TopoloDocs/apps/web/src/content/systems/topolo-${slug}.json`,
         purpose: "Canonical system registry entry.",
@@ -8074,6 +8613,25 @@ function scaffoldFiles(options) {
         portfolio: options.payload.portfolio
       })
     });
+    if (target === "platform") {
+      files.push({
+        path: `${browserBase}/vitest.config.ts`,
+        purpose: "Vitest config for the browser surface.",
+        requiredSignals: [
+          "runs component/unit tests under jsdom",
+          "keeps the generated browser surface testable from day one"
+        ],
+        content: `import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    include: ['test/**/*.test.{ts,tsx}'],
+    environment: 'jsdom',
+  },
+});
+`
+      });
+    }
   }
   if (options.api) {
     files.push(
@@ -8130,8 +8688,45 @@ function scaffoldFiles(options) {
             "binds the frontend Worker to the API Worker for /api/* requests"
           ],
           content: platformWebWranglerToml(application)
+        },
+        {
+          path: `${apiBase}/vitest.config.ts`,
+          purpose: "Vitest config for the API worker surface.",
+          requiredSignals: [
+            "runs worker/unit tests under the node environment",
+            "keeps the generated service testable from day one"
+          ],
+          content: `import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    include: ['test/**/*.test.{js,mjs,mts,ts,tsx}'],
+    environment: 'node',
+  },
+});
+`
+        },
+        {
+          path: `${apiBase}/test/health.test.ts`,
+          purpose: "Smoke test so the API test suite is non-empty from scaffold.",
+          requiredSignals: [
+            "asserts the scaffold boots",
+            "is replaced by real route/repository tests as the surface grows"
+          ],
+          content: "import { describe, expect, it } from 'vitest';\n\n// Smoke test so the API test suite is non-empty from day one. Replace with\n// real route/repository tests as the surface grows.\ndescribe('api scaffold', () => {\n  it('boots', () => {\n    expect(true).toBe(true);\n  });\n});\n"
         }
       );
+      if (options.payload.resources.d1) {
+        files.push({
+          path: `${apiBase}/migrations/0001_initial.sql`,
+          purpose: "Canonical multi-tenant baseline: the app workspaces table.",
+          requiredSignals: [
+            `${tablePrefix}_workspaces carries ${tenantColumn} on every row`,
+            "every domain table added later carries the tenant + workspace columns"
+          ],
+          content: workspacesMigrationSql
+        });
+      }
     }
   }
   return files;
@@ -8372,15 +8967,20 @@ var CLOUDCONTROL_LOCAL_APPLICATION = {
   deployTargets: []
 };
 function registerAppsCommand(program2) {
-  const apps = program2.command("apps").description("List Topolo platform applications available to the current credential").option("--json", "Output JSON", true).option("--no-json", "Output human-readable table").action(async (opts) => {
+  const apps = program2.command("apps").description("Search Topolo platform applications available to the current credential").option("-q, --query <query>", "Filter by app id, slug, or name").option("--cursor <cursor>", "Continuation cursor from the previous page").option("--limit <limit>", "Page size (1-100)", "25").option("--json", "Output JSON", true).option("--no-json", "Output human-readable table").action(async (opts) => {
     const mode = resolveOutputMode(opts.json);
     try {
       const topolo = await buildClient();
       if (!topolo) {
         throw new Error("No credential configured. Run `topolo auth login` or set TOPOLO_API_KEY.");
       }
-      const rows = applicationRowsFromCatalog(await topolo.client.listServices());
-      emit({ applications: rows }, mode, () => formatRows(rows));
+      const result = await topolo.client.searchServices({
+        query: opts.query,
+        cursor: opts.cursor,
+        limit: parsePageSize2(opts.limit)
+      });
+      const rows = applicationRowsFromCatalog(result.services);
+      emit({ applications: rows, page: result.page }, mode, () => formatRows(rows));
     } catch (err) {
       fail(err, mode);
     }
@@ -8392,7 +8992,8 @@ function registerAppsCommand(program2) {
       if (!topolo) {
         throw new Error("No credential configured. Run `topolo auth login` or set TOPOLO_API_KEY.");
       }
-      const app = resolveCatalogApplication(await topolo.client.listServices(), application);
+      const entry = await topolo.client.getService(application);
+      const app = applicationRowsFromCatalog([entry])[0];
       emit({ application: app }, mode, () => formatApplicationRow(app));
     } catch (err) {
       fail(err, mode);
@@ -8512,16 +9113,12 @@ function applicationRowsFromCatalog(catalog) {
     deployTargets: 0
   })).sort((left, right) => left.id.localeCompare(right.id));
 }
-function resolveCatalogApplication(catalog, application) {
-  const needle = application.trim().toLowerCase();
-  const rows = applicationRowsFromCatalog(catalog);
-  const match = rows.find(
-    (row) => row.id.toLowerCase() === needle || row.name.toLowerCase() === needle || row.services.some((service) => service.toLowerCase() === needle)
-  );
-  if (!match) {
-    throw new Error(`Unknown application "${application}". Run \`topolo apps --json\` to discover applications available to this credential.`);
+function parsePageSize2(value) {
+  const parsed = Number.parseInt(value || "25", 10);
+  if (!Number.isFinite(parsed) || parsed < 1 || parsed > 100) {
+    throw new Error("--limit must be an integer between 1 and 100");
   }
-  return match;
+  return parsed;
 }
 function resolveApplication(application) {
   const id = application.trim().toLowerCase();
@@ -9074,7 +9671,7 @@ async function requirePlatformAdminSession() {
 
 // src/commands/services.ts
 function registerServicesCommand(program2) {
-  program2.command("services").description("List every Topolo service the SDK can route to").option("--json", "Output JSON", true).option("--no-json", "Output human-readable table").action(async (opts) => {
+  program2.command("services").description("Search Topolo services the SDK can route to").option("-q, --query <query>", "Filter by app id, slug, or name").option("--cursor <cursor>", "Continuation cursor from the previous page").option("--limit <limit>", "Page size (1-100)", "25").option("--json", "Output JSON", true).option("--no-json", "Output human-readable table").action(async (opts) => {
     const mode = resolveOutputMode(opts.json);
     try {
       const environment = selectedEnvironment();
@@ -9083,8 +9680,13 @@ function registerServicesCommand(program2) {
       if (!topolo) {
         throw new Error("No credential configured. Run `topolo auth login` or set TOPOLO_API_KEY.");
       }
-      const rows = buildRows(await topolo.client.listServices(), config.serviceUrls, environment);
-      emit({ environment, services: rows }, mode, () => formatRows2(rows, environment));
+      const result = await topolo.client.searchServices({
+        query: opts.query,
+        cursor: opts.cursor,
+        limit: parsePageSize3(opts.limit)
+      });
+      const rows = buildRows(result.services, config.serviceUrls, environment);
+      emit({ environment, services: rows, page: result.page }, mode, () => formatRows2(rows, environment, result.page.nextCursor));
     } catch (err) {
       fail(err, mode);
     }
@@ -9111,7 +9713,7 @@ function buildRows(catalog, overrides, environment = selectedEnvironment()) {
     };
   }).sort((left, right) => left.id.localeCompare(right.id));
 }
-function formatRows2(rows, environment = selectedEnvironment()) {
+function formatRows2(rows, environment = selectedEnvironment(), nextCursor = null) {
   const idWidth = Math.max(3, ...rows.map((r) => r.id.length));
   const urlWidth = Math.max(7, ...rows.map((r) => (r.effectiveUrl ?? "-").length));
   const lines = [];
@@ -9126,8 +9728,14 @@ function formatRows2(rows, environment = selectedEnvironment()) {
       `${r.id.padEnd(idWidth)}  ${effectiveUrl.padEnd(urlWidth)}  ${r.overridden ? "yes" : "".padEnd(8)}  ${r.environmentSafe ? "yes" : "no"}    ${apiKeyResource}`
     );
   }
+  if (nextCursor) lines.push("", `Next cursor: ${nextCursor}`);
   return lines.join("\n");
 }
+function parsePageSize3(value) {
+  const parsed = Number.parseInt(value || "25", 10);
+  if (!Number.isFinite(parsed) || parsed < 1 || parsed > 100) throw new Error("--limit must be an integer between 1 and 100");
+  return parsed;
+}
 function isStagingUrl(value) {
   const url = value.toLowerCase();
   return url.includes(".stg.topolo.us") || url.includes("localhost") || url.includes("127.0.0.1") || url.includes("topolo-staging");
@@ -9900,6 +10508,162 @@ function formatStatus(rows) {
   ).join("\n");
 }
 
+// src/commands/context.ts
+function makeClient(credential, serviceUrls) {
+  return createTopolo({
+    credential,
+    agent: { clientName: "topolo-cli", clientVersion: CLI_VERSION },
+    serviceUrls
+  });
+}
+function unwrap(res) {
+  const r = res ?? {};
+  return r.data ?? r;
+}
+async function fetchMe(credential, serviceUrls) {
+  const topolo = makeClient(credential, serviceUrls);
+  const data = unwrap(await topolo.client.request({ service: "auth", method: "GET", path: "/api/auth/me" }));
+  const user = data.user ?? {};
+  const rawMemberships = user.organizationMemberships || data.organizations || [];
+  const memberships = rawMemberships.filter((m) => m && m.id);
+  const activeType = user.orgId ? "organization" : "personal";
+  return { memberships, activeType, activeOrgId: user.orgId || void 0 };
+}
+function credentialFromTokens(tokens) {
+  const accessToken = tokens.accessToken || tokens.access_token;
+  const refreshToken = tokens.refreshToken || tokens.refresh_token;
+  const expiresIn = tokens.expiresIn || tokens.expires_in;
+  const expiresAtRaw = tokens.expiresAt || tokens.expires_at;
+  return {
+    kind: "access_token",
+    accessToken,
+    ...refreshToken ? { refreshToken } : {},
+    ...expiresAtRaw ? { expiresAt: expiresAtRaw } : expiresIn ? { expiresAt: Math.floor(Date.now() / 1e3) + expiresIn } : {}
+  };
+}
+async function exchangeForContext(credential, serviceUrls, target) {
+  const topolo = makeClient(credential, serviceUrls);
+  const data = unwrap(
+    await topolo.client.request({
+      service: "auth",
+      method: "PUT",
+      path: "/api/me/active-context",
+      body: {
+        contextType: target.type,
+        contextId: target.type === "organization" ? target.id : null
+      },
+      confirm: true
+    })
+  );
+  const tokens = data.tokens || {};
+  return credentialFromTokens(tokens);
+}
+function labelFor(ctx) {
+  if (ctx.contextType === "personal") return "Personal";
+  return ctx.organizationName || ctx.organizationSlug || ctx.organizationId || "organization";
+}
+function registerContextCommand(program2) {
+  const context = program2.command("context").description("Show and switch the active context (personal or an organization)");
+  context.command("ls", { isDefault: true }).alias("list").description("List the contexts you can act in and which is active").option("--json", "Output JSON", true).option("--no-json", "Output human-readable text").action(async (opts) => {
+    const mode = resolveOutputMode(opts.json);
+    try {
+      const environment = selectedEnvironment();
+      const config = await readConfig();
+      const profile = profileForEnvironment(config, environment);
+      const stored = profile.contexts ?? {};
+      const activeKey = profile.activeContext;
+      const rows = /* @__PURE__ */ new Map();
+      for (const [key, ctx] of Object.entries(stored)) {
+        rows.set(key, { key, type: ctx.contextType, label: labelFor(ctx), signedIn: true, active: key === activeKey });
+      }
+      const cred = await refreshCredentialIfNeeded(environment);
+      if (cred) {
+        try {
+          const me = await fetchMe(cred, resolvedProfileConfig(config, environment).serviceUrls);
+          const personalKey = contextKey("personal");
+          if (!rows.has(personalKey)) {
+            rows.set(personalKey, { key: personalKey, type: "personal", label: "Personal", signedIn: false, active: personalKey === activeKey });
+          }
+          for (const m of me.memberships) {
+            const key = contextKey("organization", m.id);
+            if (!rows.has(key)) {
+              rows.set(key, { key, type: "organization", label: m.name || m.slug || m.id, signedIn: false, active: key === activeKey });
+            }
+          }
+        } catch {
+        }
+      }
+      const list = [...rows.values()];
+      emit({ environment, active: activeKey ?? null, contexts: list }, mode, () => {
+        if (list.length === 0) return "No contexts yet. Run `topolo auth login` first.";
+        const lines = [`Contexts (${environmentLabel(environment)}):`, ""];
+        for (const r of list) {
+          const marks = [r.active ? "active" : "", r.signedIn ? "signed in" : "available"].filter(Boolean).join(", ");
+          lines.push(`  ${r.active ? "*" : " "} ${r.label}  (${r.type})  [${marks}]`);
+        }
+        lines.push("", "Switch with: topolo context use <organization|personal>");
+        return lines.join("\n");
+      });
+    } catch (err) {
+      fail(err, mode);
+    }
+  });
+  context.command("use <target>").description('Switch the active context (an organization name/slug, or "personal")').option("--json", "Output JSON", true).option("--no-json", "Output human-readable text").action(async (target, opts) => {
+    const mode = resolveOutputMode(opts.json);
+    try {
+      const environment = selectedEnvironment();
+      const config = await readConfig();
+      const profile = profileForEnvironment(config, environment);
+      const serviceUrls = resolvedProfileConfig(config, environment).serviceUrls;
+      const cred = await refreshCredentialIfNeeded(environment);
+      if (!cred) {
+        throw new Error("Not signed in. Run `topolo auth login` first.");
+      }
+      const wantPersonal = /^(personal|me)$/i.test(target.trim());
+      let resolved;
+      if (wantPersonal) {
+        resolved = { contextType: "personal" };
+      } else {
+        const me = await fetchMe(cred, serviceUrls);
+        const needle = target.trim().toLowerCase();
+        const match = me.memberships.find(
+          (m) => m.id === target || m.slug?.toLowerCase() === needle || m.name?.toLowerCase() === needle
+        );
+        if (!match) {
+          const names = me.memberships.map((m) => m.slug || m.name || m.id);
+          throw new Error(
+            `You are not a member of "${target}". Available: personal${names.length ? ", " + names.join(", ") : ""}.`
+          );
+        }
+        resolved = {
+          contextType: "organization",
+          organizationId: match.id,
+          organizationSlug: match.slug,
+          organizationName: match.name
+        };
+      }
+      const key = contextKey(resolved.contextType, resolved.organizationId);
+      const existing = profile.contexts?.[key];
+      const newCredential = await exchangeForContext(cred, serviceUrls, {
+        type: resolved.contextType,
+        id: resolved.organizationId
+      });
+      resolved.credential = newCredential;
+      resolved.oauthClientId = existing?.oauthClientId ?? profile.oauthClientId;
+      const updated = writeContextCredential(config, environment, resolved, true);
+      await writeConfig(updated);
+      emit(
+        { environment, active: key, context: { type: resolved.contextType, label: labelFor(resolved) } },
+        mode,
+        () => `
+  \u2713 Now acting as ${labelFor(resolved)} (${resolved.contextType}).`
+      );
+    } catch (err) {
+      fail(err, mode);
+    }
+  });
+}
+
 // src/index.ts
 var program = new Command();
 var argv;
@@ -9929,6 +10693,7 @@ registerPlatformCommand(program);
 registerServicesCommand(program);
 registerSeedCommands(program);
 registerSkillsCommand(program);
+registerContextCommand(program);
 program.parseAsync(argv).catch((err) => {
   process.stderr.write(`Unexpected error: ${err instanceof Error ? err.message : String(err)}
 `);