@topolo/cli 0.2.1 → 0.2.2

package/dist/index.js

@@ -3312,16 +3312,6 @@ function writeContextCredential(config, environment, ctx, makeActive = true) {
   }
   return writeProfileConfig(config, environment, next);
 }
-function activateContext(config, environment, key) {
-  const profile = profileForEnvironment(config, environment);
-  const ctx = profile.contexts?.[key];
-  if (!ctx) return config;
-  return writeProfileConfig(config, environment, {
-    activeContext: key,
-    credential: ctx.credential,
-    oauthClientId: ctx.oauthClientId ?? profile.oauthClientId
-  });
-}
 function clearProfileCredential(config, environment) {
   const next = { ...config };
   if (environment === "production") {
@@ -5323,6 +5313,12 @@ function firstPartyAppPath(appDir, _audience) {
   return `apps/${appDir}`;
 }
 
+// src/commands/app-scaffold-cloudflare-constants.ts
+var CLOUDFLARE_ACCOUNT_ID = "49ef1ba682ad8cfd720c86699ae17521";
+var STAGING_CLOUDFLARE_ACCOUNT_ID = "4f4e1c69a3830946f9fea7b1eb7531ac";
+var DEVELOPMENT_CLOUDFLARE_ACCOUNT_ID = "0ebdeec262a245481a721fc4f9d6d798";
+var CLOUDFLARE_COMPATIBILITY_DATE = "2026-05-05";
+
 // src/commands/app-scaffold-package-template.ts
 function packageJson(application, target, options) {
   const dependencies = {};
@@ -5361,17 +5357,44 @@ function packageJson(application, target, options) {
     devDependencies["@cloudflare/workers-types"] = "^4.20260413.1";
     if (target === "platform") {
       dependencies["@topolo-io/worker-runtime"] = topoloPackageVersion("@topolo-io/worker-runtime", target);
+      dependencies["@topolo-io/auth-middleware"] = topoloPackageVersion("@topolo-io/auth-middleware", target);
+      dependencies["@topolo-io/error-middleware"] = topoloPackageVersion("@topolo-io/error-middleware", target);
+      dependencies["@topolo-io/security-headers"] = topoloPackageVersion("@topolo-io/security-headers", target);
+      dependencies["@topolo-io/resource-context"] = topoloPackageVersion("@topolo-io/resource-context", target);
+      dependencies["@topolo-io/data"] = topoloPackageVersion("@topolo-io/data", target);
       dependencies["@topolo/sdk"] = topoloPackageVersion("@topolo/sdk", target);
       dependencies.hono = "^4";
+      dependencies.zod = "^4.4.3";
       scripts.deploy = `node -e 'console.error("\\nX Bare deploy is disabled. Use deploy:staging or deploy:production.\\n"); process.exit(1)'`;
-      scripts["deploy:staging"] = "DEPLOY_ENVIRONMENT=staging VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us npm run build && wrangler deploy --config apps/api/wrangler.toml --env staging && wrangler deploy --config apps/web/wrangler.toml --env staging";
-      scripts["deploy:production"] = "DEPLOY_ENVIRONMENT=production VITE_TOPOLO_AUTH_URL=https://auth.topolo.app npm run build && wrangler deploy --config apps/api/wrangler.toml --env production && wrangler deploy --config apps/web/wrangler.toml --env production";
+      scripts["deploy:staging"] = `DEPLOY_ENVIRONMENT=staging CLOUDFLARE_ACCOUNT_ID=${STAGING_CLOUDFLARE_ACCOUNT_ID} python3 .github/scripts/standard_deploy.py local-deploy`;
+      scripts["deploy:production"] = `DEPLOY_ENVIRONMENT=production CLOUDFLARE_ACCOUNT_ID=${CLOUDFLARE_ACCOUNT_ID} python3 .github/scripts/standard_deploy.py local-deploy`;
     } else {
       dependencies["@topolo/sdk"] = topoloPackageVersion("@topolo/sdk", target);
       scripts.deploy = "npm run build && wrangler deploy";
     }
     devDependencies.wrangler = "^4.91.0";
   }
+  if (target === "platform") {
+    const testDirs = [];
+    if (options.browser) testDirs.push("apps/web");
+    if (options.api) testDirs.push("apps/api");
+    if (testDirs.length > 0) {
+      const chain = (withCoverage) => testDirs.map((dir, index) => {
+        const enter = index === 0 ? `cd ${dir}` : `cd ../${dir.split("/").pop()}`;
+        return `${enter} && vitest run --config vitest.config.ts --passWithNoTests${withCoverage ? " --coverage" : ""}`;
+      }).join(" && ");
+      scripts.test = chain(false);
+      scripts.coverage = chain(true);
+      scripts.typecheck = testDirs.map((dir) => `tsc --noEmit -p ${dir}/tsconfig.json`).join(" && ");
+      devDependencies.vitest = "^3.2.4";
+      devDependencies["@vitest/coverage-v8"] = "^3.2.4";
+      if (options.browser) {
+        devDependencies.jsdom = "^29.1.1";
+        devDependencies["@testing-library/react"] = "^16.3.2";
+        devDependencies["@testing-library/user-event"] = "^14.6.1";
+      }
+    }
+  }
   if (target === "platform" && hasScaffoldResources(options.resources)) {
     scripts["check:deploy-config"] = "wrangler deploy --config apps/api/wrangler.toml --env staging --dry-run --outdir .wrangler/api-build && wrangler deploy --config apps/web/wrangler.toml --env staging --dry-run --outdir .wrangler/web-build";
   }
@@ -5400,7 +5423,11 @@ function topoloPackageVersion(packageName, target) {
     "@topolo-io/app-launcher": "^0.1.15",
     "@topolo-io/app-shell": "^0.5.54",
     "@topolo-io/auth-client": "^1.2.1",
-    "@topolo-io/auth-middleware": "^0.3.4",
+    "@topolo-io/auth-middleware": "^0.4.0",
+    "@topolo-io/error-middleware": "^0.6.0",
+    "@topolo-io/security-headers": "^0.2.2",
+    "@topolo-io/resource-context": "^0.3.0",
+    "@topolo-io/data": "^0.1.2",
     "@topolo-io/worker-runtime": "^0.1.11",
     "@topolo-io/design-tokens": "^0.1.8",
     "@topolo-io/onboarding": "^0.9.5",
@@ -5436,7 +5463,12 @@ function resourceConfig(application, profile) {
       workflowProductionName: `topolo-${slug}-import`,
       workflowStagingName: `topolo-${slug}-import-staging`,
       containerProductionName: `topolo-${slug}-processor`,
-      containerStagingName: `topolo-${slug}-processor-staging`
+      containerStagingName: `topolo-${slug}-processor-staging`,
+      d1DevelopmentName: `topolo-${slug}-core-development`,
+      r2DevelopmentName: `topolo-${slug}-assets-development`,
+      queueDevelopmentName: `topolo-${slug}-processing-development`,
+      workflowDevelopmentName: `topolo-${slug}-import-development`,
+      containerDevelopmentName: `topolo-${slug}-processor-development`
     };
   }
   return {
@@ -5454,7 +5486,12 @@ function resourceConfig(application, profile) {
     workflowProductionName: `topolo-${slug}-workflow`,
     workflowStagingName: `topolo-${slug}-workflow-staging`,
     containerProductionName: `topolo-${slug}-processor`,
-    containerStagingName: `topolo-${slug}-processor-staging`
+    containerStagingName: `topolo-${slug}-processor-staging`,
+    d1DevelopmentName: `topolo-${slug}-core-development`,
+    r2DevelopmentName: `topolo-${slug}-assets-development`,
+    queueDevelopmentName: `topolo-${slug}-queue-development`,
+    workflowDevelopmentName: `topolo-${slug}-workflow-development`,
+    containerDevelopmentName: `topolo-${slug}-processor-development`
   };
 }
 
@@ -5627,6 +5664,64 @@ function tsconfigJson(api, target) {
   })}
 `;
 }
+var TSCONFIG_TEST_EXCLUDE = [
+  "src/**/*.test.ts",
+  "src/**/*.test.tsx",
+  "src/**/*.test.mts",
+  "src/**/*.spec.ts",
+  "src/**/*.spec.tsx",
+  "test"
+];
+function webTsconfigJson() {
+  return `${json({
+    compilerOptions: {
+      target: "ES2022",
+      useDefineForClassFields: true,
+      lib: ["ES2022", "DOM", "DOM.Iterable"],
+      allowJs: false,
+      skipLibCheck: true,
+      esModuleInterop: true,
+      allowSyntheticDefaultImports: true,
+      strict: true,
+      forceConsistentCasingInFileNames: true,
+      module: "ESNext",
+      moduleResolution: "Bundler",
+      resolveJsonModule: true,
+      isolatedModules: true,
+      noEmit: true,
+      jsx: "react-jsx",
+      types: ["vite/client"]
+    },
+    include: ["src"],
+    references: [],
+    exclude: TSCONFIG_TEST_EXCLUDE
+  })}
+`;
+}
+function apiTsconfigJson() {
+  return `${json({
+    compilerOptions: {
+      target: "ES2022",
+      lib: ["ES2022", "DOM", "DOM.Iterable", "WebWorker"],
+      allowJs: false,
+      skipLibCheck: true,
+      esModuleInterop: true,
+      allowSyntheticDefaultImports: true,
+      strict: true,
+      forceConsistentCasingInFileNames: true,
+      module: "ESNext",
+      moduleResolution: "Bundler",
+      resolveJsonModule: true,
+      isolatedModules: true,
+      noEmit: true,
+      types: ["@cloudflare/workers-types", "node"]
+    },
+    include: ["src"],
+    references: [],
+    exclude: TSCONFIG_TEST_EXCLUDE
+  })}
+`;
+}
 function gitignore() {
   return [
     "node_modules/",
@@ -6368,11 +6463,6 @@ function developerAppTsx(application) {
   ].join("\n");
 }
 
-// src/commands/app-scaffold-cloudflare-constants.ts
-var CLOUDFLARE_ACCOUNT_ID = "49ef1ba682ad8cfd720c86699ae17521";
-var STAGING_CLOUDFLARE_ACCOUNT_ID = "4f4e1c69a3830946f9fea7b1eb7531ac";
-var CLOUDFLARE_COMPATIBILITY_DATE = "2026-05-05";
-
 // src/commands/app-scaffold-worker-template.ts
 function webWorkerTs(application) {
   const serviceName = toTitle(application.name);
@@ -6427,6 +6517,29 @@ function platformWebWranglerToml(application) {
     'binding = "API"',
     `service = "topolo-${slug}-api"`,
     "",
+    "[env.development]",
+    `name = "topolo-${slug}-development"`,
+    `account_id = "${DEVELOPMENT_CLOUDFLARE_ACCOUNT_ID}"`,
+    "workers_dev = true",
+    "",
+    "[env.development.vars]",
+    `APP_ID = "${application.appId ?? ""}"`,
+    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
+    "",
+    "[[env.development.routes]]",
+    `pattern = "${slug}.topolo.dev"`,
+    "custom_domain = true",
+    "",
+    "[env.development.assets]",
+    'directory = "./dist"',
+    'binding = "ASSETS"',
+    'not_found_handling = "single-page-application"',
+    'run_worker_first = ["/api/*"]',
+    "",
+    "[[env.development.services]]",
+    'binding = "API"',
+    `service = "topolo-${slug}-api-development"`,
+    "",
     "[env.staging]",
     `name = "topolo-${slug}-staging"`,
     `account_id = "${STAGING_CLOUDFLARE_ACCOUNT_ID}"`,
@@ -6498,6 +6611,22 @@ function platformApiWranglerToml(application, resources, profile) {
     ""
   ];
   appendResourceWranglerBlocks(lines, resources, resource, "production");
+  lines.push(
+    "[env.development]",
+    `name = "topolo-${slug}-api-development"`,
+    `account_id = "${DEVELOPMENT_CLOUDFLARE_ACCOUNT_ID}"`,
+    "workers_dev = true",
+    "",
+    "[env.development.vars]",
+    'AUTH_BASE_URL = "https://auth.topolo.dev"',
+    'NEXUS_GATEWAY_URL = "https://nexus.topolo.dev"',
+    `NEXUS_APP_ID = "${slug}"`,
+    `APP_ID = "${application.appId ?? ""}"`,
+    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
+    'ENVIRONMENT = "development"',
+    ""
+  );
+  appendResourceWranglerBlocks(lines, resources, resource, "development");
   lines.push(
     "[env.staging]",
     `name = "topolo-${slug}-api-staging"`,
@@ -6531,13 +6660,14 @@ function platformApiWranglerToml(application, resources, profile) {
   return lines.join("\n");
 }
 function appendResourceWranglerBlocks(lines, resources, resource, environment) {
-  const prefix = environment === "staging" ? "env.staging." : environment === "production-env" ? "env.production." : "";
-  const envName = environment === "staging" ? "Staging" : "Production";
+  const prefix = environment === "staging" ? "env.staging." : environment === "development" ? "env.development." : environment === "production-env" ? "env.production." : "";
+  const envName = environment === "staging" ? "Staging" : environment === "development" ? "Development" : "Production";
+  const pick = (dev, staging, prod) => environment === "development" ? dev : environment === "staging" ? staging : prod;
   if (resources.d1) {
     lines.push(
       `[[${prefix}d1_databases]]`,
       `binding = "${resource.d1Binding}"`,
-      `database_name = "${environment === "staging" ? resource.d1StagingName : resource.d1ProductionName}"`,
+      `database_name = "${pick(resource.d1DevelopmentName, resource.d1StagingName, resource.d1ProductionName)}"`,
       'database_id = "provision-after-scaffold"',
       'migrations_dir = "migrations"',
       ""
@@ -6547,7 +6677,7 @@ function appendResourceWranglerBlocks(lines, resources, resource, environment) {
     lines.push(
       `[[${prefix}r2_buckets]]`,
       `binding = "${resource.r2Binding}"`,
-      `bucket_name = "${environment === "staging" ? resource.r2StagingName : resource.r2ProductionName}"`,
+      `bucket_name = "${pick(resource.r2DevelopmentName, resource.r2StagingName, resource.r2ProductionName)}"`,
       ""
     );
   }
@@ -6555,10 +6685,10 @@ function appendResourceWranglerBlocks(lines, resources, resource, environment) {
     lines.push(
       `[[${prefix}queues.producers]]`,
       `binding = "${resource.queueBinding}"`,
-      `queue = "${environment === "staging" ? resource.queueStagingName : resource.queueProductionName}"`,
+      `queue = "${pick(resource.queueDevelopmentName, resource.queueStagingName, resource.queueProductionName)}"`,
       "",
       `[[${prefix}queues.consumers]]`,
-      `queue = "${environment === "staging" ? resource.queueStagingName : resource.queueProductionName}"`,
+      `queue = "${pick(resource.queueDevelopmentName, resource.queueStagingName, resource.queueProductionName)}"`,
       ""
     );
   }
@@ -6566,7 +6696,7 @@ function appendResourceWranglerBlocks(lines, resources, resource, environment) {
     lines.push(
       `[[${prefix}workflows]]`,
       `binding = "${resource.workflowBinding}"`,
-      `name = "${environment === "staging" ? resource.workflowStagingName : resource.workflowProductionName}"`,
+      `name = "${pick(resource.workflowDevelopmentName, resource.workflowStagingName, resource.workflowProductionName)}"`,
       `class_name = "${resource.workflowClassName}"`,
       ""
     );
@@ -6764,6 +6894,8 @@ function platformWorkerTs(application, options) {
     "import { Hono } from 'hono';",
     "import { createTopoloWidgetResponse, type TopoloWidgetDraft } from '@topolo/sdk';",
     "import { createTopoloWorkerRuntime, type TopoloRuntimeContext } from '@topolo-io/worker-runtime';",
+    "import { withSecurityHeaders } from '@topolo-io/security-headers';",
+    "import { withErrorReporting } from '@topolo-io/error-middleware';",
     "import { SCAFFOLD_APP_ID, SCAFFOLD_APP_NAME, SCAFFOLD_SERVICE_SLUG, resolveRuntimeAppId } from './app-identity';",
     ...options.resources.workflow ? ["import { WorkflowEntrypoint, type WorkflowEvent, type WorkflowStep } from 'cloudflare:workers';"] : [],
     "",
@@ -6854,11 +6986,20 @@ function platformWorkerTs(application, options) {
     "  return handleRequest(c.req.raw, c.env, rt);",
     "});",
     "",
+    "// Platform security headers + structured error reporting wrap the whole app",
+    "// (outermost), so headers are stamped even on error-middleware 5xx responses.",
+    "const securedFetch = withSecurityHeaders(",
+    "  withErrorReporting(",
+    "    (request: Request, env: Env, ctx: ExecutionContext) => api.fetch(request, env, ctx),",
+    "    { appName: SCAFFOLD_APP_NAME, appId: SCAFFOLD_SERVICE_SLUG },",
+    "  ),",
+    ") as (request: Request, env: Env, ctx: ExecutionContext) => Response | Promise<Response>;",
+    "",
     "export default {",
     "  fetch: runtime.worker((request, env, ctx, rt) => {",
     "    const bindings = env as Env & { __rt?: TopoloRuntimeContext<Env> };",
     "    bindings.__rt = rt;",
-    "    return api.fetch(request, bindings, ctx as ExecutionContext);",
+    "    return securedFetch(request, bindings, ctx as ExecutionContext);",
     "  }),",
     "};",
     "",
@@ -7211,9 +7352,12 @@ function topoloAppManifestJson(application, options) {
     $schema: "./../../topolo-platform/tooling/app-manifest-schema.json",
     name: `topolo-${slug}`,
     appId: application.appId,
-    primaryTarget: "web",
     compatibilityDate: CLOUDFLARE_COMPATIBILITY_DATE,
     environments: {
+      development: {
+        accountId: DEVELOPMENT_CLOUDFLARE_ACCOUNT_ID,
+        domain: "topolo.dev"
+      },
       staging: {
         accountId: STAGING_CLOUDFLARE_ACCOUNT_ID,
         domain: "stg.topolo.us"
@@ -7254,6 +7398,15 @@ function cloudcontrolJson(application, options) {
         resource_name: resources.d1StagingName,
         resource_id: "provision-after-scaffold",
         migrations_dir: "migrations"
+      },
+      {
+        resource_type: "d1",
+        binding: resources.d1Binding,
+        environment: "development",
+        account_id: DEVELOPMENT_CLOUDFLARE_ACCOUNT_ID,
+        resource_name: resources.d1DevelopmentName,
+        resource_id: "provision-after-scaffold",
+        migrations_dir: "migrations"
       }
     );
   }
@@ -7874,6 +8027,74 @@ function envExample(application) {
 function generateOpaqueAppId() {
   return `app_${randomBytes(9).toString("base64url")}`;
 }
+function standardScriptStub() {
+  return `#!/usr/bin/env python3
+"""Canonical-fetching stub for .github/scripts/standard_*.py.
+
+Replaces a vendored copy. At runtime, finds the canonical sibling in
+\`<repo-parent>/topolo-platform/tooling/<name>.py\` and execs it, passing argv
+through, so every consumer runs the current platform script on every
+invocation (no drifted per-app copies).
+
+Override: set TOPOLO_PLATFORM_DIR to the absolute path of the topolo-platform
+repo when the canonical is in a non-default checkout layout (e.g. CI). If no
+canonical can be found, exits 2 with a clear message rather than silently
+falling back.
+"""
+from __future__ import annotations
+
+import os
+import sys
+
+STUB_NAME = os.path.basename(__file__)  # standard_ci.py OR standard_deploy.py
+HERE = os.path.dirname(os.path.abspath(__file__))
+
+
+def find_canonical() -> str | None:
+    # 1. Explicit override (CI runners with non-standard layouts).
+    override = os.environ.get('TOPOLO_PLATFORM_DIR')
+    if override:
+        path = os.path.join(override, 'tooling', STUB_NAME)
+        if os.path.exists(path):
+            return path
+    # 2. Walk up looking for a sibling topolo-platform/tooling/<name>.py.
+    cursor = HERE
+    for _ in range(10):
+        candidate = os.path.normpath(os.path.join(cursor, '..', 'topolo-platform', 'tooling', STUB_NAME))
+        if os.path.exists(candidate):
+            return candidate
+        parent = os.path.dirname(cursor)
+        if parent == cursor:
+            break
+        cursor = parent
+    # 3. node_modules-based delivery (future): @topolo-io/standard-ci.
+    cursor = HERE
+    for _ in range(10):
+        candidate = os.path.normpath(os.path.join(cursor, 'node_modules', '@topolo-io', 'standard-ci', 'bin', STUB_NAME))
+        if os.path.exists(candidate):
+            return candidate
+        parent = os.path.dirname(cursor)
+        if parent == cursor:
+            break
+        cursor = parent
+    return None
+
+
+def main() -> None:
+    canonical = find_canonical()
+    if not canonical:
+        sys.stderr.write(
+            f'[topolo-canonical-stub] could not locate canonical {STUB_NAME}.\\n'
+            f'  Set TOPOLO_PLATFORM_DIR or checkout topolo-platform as a sibling of this app.\\n'
+        )
+        sys.exit(2)
+    os.execv(sys.executable, [sys.executable, canonical, *sys.argv[1:]])
+
+
+if __name__ == '__main__':
+    main()
+`;
+}
 function applicationScaffoldPayload(application, options = {}) {
   const target = normalizeTarget(options.target);
   const portfolio = target === "platform" ? normalizePortfolio(options.portfolio) : null;
@@ -7892,6 +8113,9 @@ function applicationScaffoldPayload(application, options = {}) {
   const containerAppId = normalizeContainerAppId(options.containerAppId, surfaceModel);
   const profile = normalizeScaffoldProfile(options.profile);
   const resources = resolveScaffoldResources(profile, options);
+  if (target === "platform" && api && !profile) {
+    resources.d1 = true;
+  }
   const ownerType = target === "platform" ? "topolo_first_party" : "third_party";
   const distributionModel = target === "platform" ? "marketplace" : "organization_internal";
   const appDir = options.appDir ?? catalogApplication?.appDir ?? (target === "platform" ? `Topolo${toPascalCase(id)}` : `topolo-${slug}`);
@@ -8038,6 +8262,28 @@ function scaffoldCapabilities(options) {
 function scaffoldFiles(options) {
   const { application, target } = options;
   const slug = toSlug(application.id);
+  const tablePrefix = slug.replace(/-/g, "_");
+  const tenantColumn = options.payload.tenancy === "household" ? "household_id" : "organization_id";
+  const workspacesMigrationSql = [
+    `CREATE TABLE IF NOT EXISTS ${tablePrefix}_workspaces (`,
+    "  id TEXT PRIMARY KEY,",
+    `  ${tenantColumn} TEXT NOT NULL,`,
+    "  name TEXT NOT NULL,",
+    "  slug TEXT NOT NULL,",
+    "  created_by_user_id TEXT,",
+    "  created_by_email TEXT,",
+    "  created_at TEXT NOT NULL,",
+    "  updated_at TEXT NOT NULL,",
+    `  UNIQUE(${tenantColumn}, slug)`,
+    ");",
+    "",
+    `CREATE INDEX IF NOT EXISTS idx_${tablePrefix}_workspaces_${tenantColumn}`,
+    `  ON ${tablePrefix}_workspaces(${tenantColumn});`,
+    "",
+    `CREATE INDEX IF NOT EXISTS idx_${tablePrefix}_workspaces_slug`,
+    `  ON ${tablePrefix}_workspaces(${tenantColumn}, slug);`,
+    ""
+  ].join("\n");
   const base = target === "platform" ? firstPartyAppPath(application.appDir, options.payload.audience) : application.appDir;
   const browserBase = target === "platform" ? `${base}/apps/web` : base;
   const apiBase = target === "platform" ? `${base}/apps/api` : base;
@@ -8095,15 +8341,6 @@ function scaffoldFiles(options) {
         resources: options.payload.resources
       })
     },
-    {
-      path: `${base}/tsconfig.json`,
-      purpose: "TypeScript configuration for the generated app.",
-      requiredSignals: [
-        "uses strict mode",
-        "includes browser DOM types for React and Worker types for API-backed apps"
-      ],
-      content: tsconfigJson(options.api, target)
-    },
     {
       path: `${browserBase}/vite.config.ts`,
       purpose: "Vite browser build configuration.",
@@ -8161,6 +8398,31 @@ function scaffoldFiles(options) {
       content: stylesCss()
     }
   ];
+  if (target === "platform") {
+    if (options.browser) {
+      files.push({
+        path: `${browserBase}/tsconfig.json`,
+        purpose: "TypeScript configuration for the browser surface (DOM + vite types).",
+        requiredSignals: ["uses strict mode", "includes browser DOM types for React"],
+        content: webTsconfigJson()
+      });
+    }
+    if (options.api) {
+      files.push({
+        path: `${apiBase}/tsconfig.json`,
+        purpose: "TypeScript configuration for the API worker surface (Workers types).",
+        requiredSignals: ["uses strict mode", "includes Cloudflare Workers types"],
+        content: apiTsconfigJson()
+      });
+    }
+  } else {
+    files.push({
+      path: `${base}/tsconfig.json`,
+      purpose: "TypeScript configuration for the generated app.",
+      requiredSignals: ["uses strict mode", "includes browser DOM types for React and Worker types for API-backed apps"],
+      content: tsconfigJson(options.api, target)
+    });
+  }
   if (target === "platform") {
     files.push(
       {
@@ -8201,6 +8463,33 @@ function scaffoldFiles(options) {
         ],
         content: options.ciWorkflow ?? ""
       },
+      {
+        path: `${base}/.github/scripts/standard_deploy.py`,
+        purpose: "Canonical-fetching deploy stub (execs topolo-platform/tooling/standard_deploy.py).",
+        requiredSignals: [
+          "never a vendored copy of the canonical script",
+          "runs the current platform standard_deploy.py on every invocation"
+        ],
+        content: standardScriptStub()
+      },
+      {
+        path: `${base}/.github/scripts/standard_ci.py`,
+        purpose: "Canonical-fetching CI stub (execs topolo-platform/tooling/standard_ci.py).",
+        requiredSignals: [
+          "never a vendored copy of the canonical script",
+          "runs the current platform standard_ci.py on every invocation"
+        ],
+        content: standardScriptStub()
+      },
+      {
+        path: `${base}/.github/scripts/standard_ops.py`,
+        purpose: "Canonical-fetching ops stub (execs topolo-platform/tooling/standard_ops.py).",
+        requiredSignals: [
+          "never a vendored copy of the canonical script",
+          "runs the current platform standard_ops.py on every invocation"
+        ],
+        content: standardScriptStub()
+      },
       {
         path: `system-apps/TopoloDocs/apps/web/src/content/systems/topolo-${slug}.json`,
         purpose: "Canonical system registry entry.",
@@ -8324,6 +8613,25 @@ function scaffoldFiles(options) {
         portfolio: options.payload.portfolio
       })
     });
+    if (target === "platform") {
+      files.push({
+        path: `${browserBase}/vitest.config.ts`,
+        purpose: "Vitest config for the browser surface.",
+        requiredSignals: [
+          "runs component/unit tests under jsdom",
+          "keeps the generated browser surface testable from day one"
+        ],
+        content: `import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    include: ['test/**/*.test.{ts,tsx}'],
+    environment: 'jsdom',
+  },
+});
+`
+      });
+    }
   }
   if (options.api) {
     files.push(
@@ -8380,8 +8688,45 @@ function scaffoldFiles(options) {
             "binds the frontend Worker to the API Worker for /api/* requests"
           ],
           content: platformWebWranglerToml(application)
+        },
+        {
+          path: `${apiBase}/vitest.config.ts`,
+          purpose: "Vitest config for the API worker surface.",
+          requiredSignals: [
+            "runs worker/unit tests under the node environment",
+            "keeps the generated service testable from day one"
+          ],
+          content: `import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    include: ['test/**/*.test.{js,mjs,mts,ts,tsx}'],
+    environment: 'node',
+  },
+});
+`
+        },
+        {
+          path: `${apiBase}/test/health.test.ts`,
+          purpose: "Smoke test so the API test suite is non-empty from scaffold.",
+          requiredSignals: [
+            "asserts the scaffold boots",
+            "is replaced by real route/repository tests as the surface grows"
+          ],
+          content: "import { describe, expect, it } from 'vitest';\n\n// Smoke test so the API test suite is non-empty from day one. Replace with\n// real route/repository tests as the surface grows.\ndescribe('api scaffold', () => {\n  it('boots', () => {\n    expect(true).toBe(true);\n  });\n});\n"
         }
       );
+      if (options.payload.resources.d1) {
+        files.push({
+          path: `${apiBase}/migrations/0001_initial.sql`,
+          purpose: "Canonical multi-tenant baseline: the app workspaces table.",
+          requiredSignals: [
+            `${tablePrefix}_workspaces carries ${tenantColumn} on every row`,
+            "every domain table added later carries the tenant + workspace columns"
+          ],
+          content: workspacesMigrationSql
+        });
+      }
     }
   }
   return files;
@@ -10299,18 +10644,13 @@ function registerContextCommand(program2) {
       }
       const key = contextKey(resolved.contextType, resolved.organizationId);
       const existing = profile.contexts?.[key];
-      let updated = config;
-      if (existing?.credential) {
-        updated = activateContext(config, environment, key);
-      } else {
-        const newCredential = await exchangeForContext(cred, serviceUrls, {
-          type: resolved.contextType,
-          id: resolved.organizationId
-        });
-        resolved.credential = newCredential;
-        resolved.oauthClientId = existing?.oauthClientId ?? profile.oauthClientId;
-        updated = writeContextCredential(config, environment, resolved, true);
-      }
+      const newCredential = await exchangeForContext(cred, serviceUrls, {
+        type: resolved.contextType,
+        id: resolved.organizationId
+      });
+      resolved.credential = newCredential;
+      resolved.oauthClientId = existing?.oauthClientId ?? profile.oauthClientId;
+      const updated = writeContextCredential(config, environment, resolved, true);
       await writeConfig(updated);
       emit(
         { environment, active: key, context: { type: resolved.contextType, label: labelFor(resolved) } },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topolo/cli",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Command-line interface for Topolo developers, operators, and agents, with internal first-party scaffolding available under the topolo platform namespace.",
   "type": "module",
   "bin": {