@topolo/cli 0.2.1 → 0.2.3

package/dist/index.js

@@ -2582,6 +2582,7 @@ var TopoloClient = class _TopoloClient {
     const kind = payload.credentialType === "api_key" ? "api_key" : "access_token";
     return {
       kind,
+      authorizationMode: normalizeCredentialAuthorizationMode(payload.authorizationMode, kind),
       user: {
         id: user.id,
         email: user.email,
@@ -2844,6 +2845,11 @@ function objectToQuery(value) {
   }
   return Object.keys(query).length > 0 ? query : void 0;
 }
+function normalizeCredentialAuthorizationMode(value, kind) {
+  if (kind === "api_key") return "api_key";
+  if (value === "context_rbac" || value === "oauth_scopes" || value === "session_rbac") return value;
+  return "unknown";
+}
 function describeError(body, fallback) {
   if (body && typeof body === "object") {
     const maybe = body;
@@ -3312,16 +3318,6 @@ function writeContextCredential(config, environment, ctx, makeActive = true) {
   }
   return writeProfileConfig(config, environment, next);
 }
-function activateContext(config, environment, key) {
-  const profile = profileForEnvironment(config, environment);
-  const ctx = profile.contexts?.[key];
-  if (!ctx) return config;
-  return writeProfileConfig(config, environment, {
-    activeContext: key,
-    credential: ctx.credential,
-    oauthClientId: ctx.oauthClientId ?? profile.oauthClientId
-  });
-}
 function clearProfileCredential(config, environment) {
   const next = { ...config };
   if (environment === "production") {
@@ -3456,7 +3452,7 @@ function resolveOAuthClientId(config, environment = selectedEnvironment()) {
   const envSpecific = process.env[`${envVarPrefix(environment)}_CLI_CLIENT_ID`];
   if (envSpecific) return envSpecific;
   if (process.env.TOPOLO_CLI_CLIENT_ID) return process.env.TOPOLO_CLI_CLIENT_ID;
-  return profileForEnvironment(config, environment).oauthClientId ?? DEFAULT_CLI_CLIENT_IDS[environment];
+  return DEFAULT_CLI_CLIENT_IDS[environment] ?? profileForEnvironment(config, environment).oauthClientId;
 }
 var NON_PROD_URL_MARKERS = {
   staging: [".stg.topolo.us", "topolo-staging"],
@@ -3842,7 +3838,7 @@ function stderrDebugLogger(event) {
 
 // src/commands/whoami.ts
 function registerWhoamiCommand(program2) {
-  program2.command("whoami").description("Show the user, organization, and scopes attached to the current credential").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (opts) => {
+  program2.command("whoami").description("Show the current user, organization, and authorization mode").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (opts) => {
     const mode = resolveOutputMode(opts.json);
     try {
       const environment = selectedEnvironment();
@@ -3867,7 +3863,10 @@ function formatPretty(info) {
     `Organization: ${info.organization ? `${info.organization.name} (${info.organization.slug})` : "(none)"}`
   );
   lines.push(`Credential:   ${info.kind}`);
-  lines.push(`Scopes:       ${info.user.permissions.length === 0 ? "(none)" : ""}`);
+  const dynamicRbac = info.authorizationMode === "context_rbac";
+  const authorization = dynamicRbac ? "Dynamic RBAC (checked per application action)" : info.authorizationMode === "oauth_scopes" ? "Delegated OAuth scopes" : info.authorizationMode === "api_key" ? "API key scopes" : info.authorizationMode === "session_rbac" ? "Session RBAC" : "Credential scopes";
+  lines.push(`Authorization: ${authorization}`);
+  lines.push(`${dynamicRbac ? "Identity scopes" : "Scopes"}: ${info.user.permissions.length === 0 ? "(none)" : ""}`);
   for (const p of info.user.permissions) lines.push(`  - ${p}`);
   return lines.join("\n");
 }
@@ -5179,7 +5178,6 @@ function isFile(filePath) {
 }
 
 // src/commands/app-scaffold.ts
-import { randomBytes } from "crypto";
 import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
 import { dirname as dirname3, resolve as resolve2 } from "path";
 
@@ -5323,6 +5321,12 @@ function firstPartyAppPath(appDir, _audience) {
   return `apps/${appDir}`;
 }
 
+// src/commands/app-scaffold-cloudflare-constants.ts
+var CLOUDFLARE_ACCOUNT_ID = "49ef1ba682ad8cfd720c86699ae17521";
+var STAGING_CLOUDFLARE_ACCOUNT_ID = "4f4e1c69a3830946f9fea7b1eb7531ac";
+var DEVELOPMENT_CLOUDFLARE_ACCOUNT_ID = "0ebdeec262a245481a721fc4f9d6d798";
+var CLOUDFLARE_COMPATIBILITY_DATE = "2026-05-05";
+
 // src/commands/app-scaffold-package-template.ts
 function packageJson(application, target, options) {
   const dependencies = {};
@@ -5361,17 +5365,44 @@ function packageJson(application, target, options) {
     devDependencies["@cloudflare/workers-types"] = "^4.20260413.1";
     if (target === "platform") {
       dependencies["@topolo-io/worker-runtime"] = topoloPackageVersion("@topolo-io/worker-runtime", target);
+      dependencies["@topolo-io/auth-middleware"] = topoloPackageVersion("@topolo-io/auth-middleware", target);
+      dependencies["@topolo-io/error-middleware"] = topoloPackageVersion("@topolo-io/error-middleware", target);
+      dependencies["@topolo-io/security-headers"] = topoloPackageVersion("@topolo-io/security-headers", target);
+      dependencies["@topolo-io/resource-context"] = topoloPackageVersion("@topolo-io/resource-context", target);
+      dependencies["@topolo-io/data"] = topoloPackageVersion("@topolo-io/data", target);
       dependencies["@topolo/sdk"] = topoloPackageVersion("@topolo/sdk", target);
       dependencies.hono = "^4";
+      dependencies.zod = "^4.4.3";
       scripts.deploy = `node -e 'console.error("\\nX Bare deploy is disabled. Use deploy:staging or deploy:production.\\n"); process.exit(1)'`;
-      scripts["deploy:staging"] = "DEPLOY_ENVIRONMENT=staging VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us npm run build && wrangler deploy --config apps/api/wrangler.toml --env staging && wrangler deploy --config apps/web/wrangler.toml --env staging";
-      scripts["deploy:production"] = "DEPLOY_ENVIRONMENT=production VITE_TOPOLO_AUTH_URL=https://auth.topolo.app npm run build && wrangler deploy --config apps/api/wrangler.toml --env production && wrangler deploy --config apps/web/wrangler.toml --env production";
+      scripts["deploy:staging"] = `DEPLOY_ENVIRONMENT=staging CLOUDFLARE_ACCOUNT_ID=${STAGING_CLOUDFLARE_ACCOUNT_ID} python3 .github/scripts/standard_deploy.py local-deploy`;
+      scripts["deploy:production"] = `DEPLOY_ENVIRONMENT=production CLOUDFLARE_ACCOUNT_ID=${CLOUDFLARE_ACCOUNT_ID} python3 .github/scripts/standard_deploy.py local-deploy`;
     } else {
       dependencies["@topolo/sdk"] = topoloPackageVersion("@topolo/sdk", target);
       scripts.deploy = "npm run build && wrangler deploy";
     }
     devDependencies.wrangler = "^4.91.0";
   }
+  if (target === "platform") {
+    const testDirs = [];
+    if (options.browser) testDirs.push("apps/web");
+    if (options.api) testDirs.push("apps/api");
+    if (testDirs.length > 0) {
+      const chain = (withCoverage) => testDirs.map((dir, index) => {
+        const enter = index === 0 ? `cd ${dir}` : `cd ../${dir.split("/").pop()}`;
+        return `${enter} && vitest run --config vitest.config.ts --passWithNoTests${withCoverage ? " --coverage" : ""}`;
+      }).join(" && ");
+      scripts.test = chain(false);
+      scripts.coverage = chain(true);
+      scripts.typecheck = testDirs.map((dir) => `tsc --noEmit -p ${dir}/tsconfig.json`).join(" && ");
+      devDependencies.vitest = "^3.2.4";
+      devDependencies["@vitest/coverage-v8"] = "^3.2.4";
+      if (options.browser) {
+        devDependencies.jsdom = "^29.1.1";
+        devDependencies["@testing-library/react"] = "^16.3.2";
+        devDependencies["@testing-library/user-event"] = "^14.6.1";
+      }
+    }
+  }
   if (target === "platform" && hasScaffoldResources(options.resources)) {
     scripts["check:deploy-config"] = "wrangler deploy --config apps/api/wrangler.toml --env staging --dry-run --outdir .wrangler/api-build && wrangler deploy --config apps/web/wrangler.toml --env staging --dry-run --outdir .wrangler/web-build";
   }
@@ -5400,7 +5431,11 @@ function topoloPackageVersion(packageName, target) {
     "@topolo-io/app-launcher": "^0.1.15",
     "@topolo-io/app-shell": "^0.5.54",
     "@topolo-io/auth-client": "^1.2.1",
-    "@topolo-io/auth-middleware": "^0.3.4",
+    "@topolo-io/auth-middleware": "^0.4.0",
+    "@topolo-io/error-middleware": "^0.6.0",
+    "@topolo-io/security-headers": "^0.2.2",
+    "@topolo-io/resource-context": "^0.3.0",
+    "@topolo-io/data": "^0.1.2",
     "@topolo-io/worker-runtime": "^0.1.11",
     "@topolo-io/design-tokens": "^0.1.8",
     "@topolo-io/onboarding": "^0.9.5",
@@ -5436,7 +5471,12 @@ function resourceConfig(application, profile) {
       workflowProductionName: `topolo-${slug}-import`,
       workflowStagingName: `topolo-${slug}-import-staging`,
       containerProductionName: `topolo-${slug}-processor`,
-      containerStagingName: `topolo-${slug}-processor-staging`
+      containerStagingName: `topolo-${slug}-processor-staging`,
+      d1DevelopmentName: `topolo-${slug}-core-development`,
+      r2DevelopmentName: `topolo-${slug}-assets-development`,
+      queueDevelopmentName: `topolo-${slug}-processing-development`,
+      workflowDevelopmentName: `topolo-${slug}-import-development`,
+      containerDevelopmentName: `topolo-${slug}-processor-development`
     };
   }
   return {
@@ -5454,7 +5494,12 @@ function resourceConfig(application, profile) {
     workflowProductionName: `topolo-${slug}-workflow`,
     workflowStagingName: `topolo-${slug}-workflow-staging`,
     containerProductionName: `topolo-${slug}-processor`,
-    containerStagingName: `topolo-${slug}-processor-staging`
+    containerStagingName: `topolo-${slug}-processor-staging`,
+    d1DevelopmentName: `topolo-${slug}-core-development`,
+    r2DevelopmentName: `topolo-${slug}-assets-development`,
+    queueDevelopmentName: `topolo-${slug}-queue-development`,
+    workflowDevelopmentName: `topolo-${slug}-workflow-development`,
+    containerDevelopmentName: `topolo-${slug}-processor-development`
   };
 }
 
@@ -5627,6 +5672,64 @@ function tsconfigJson(api, target) {
   })}
 `;
 }
+var TSCONFIG_TEST_EXCLUDE = [
+  "src/**/*.test.ts",
+  "src/**/*.test.tsx",
+  "src/**/*.test.mts",
+  "src/**/*.spec.ts",
+  "src/**/*.spec.tsx",
+  "test"
+];
+function webTsconfigJson() {
+  return `${json({
+    compilerOptions: {
+      target: "ES2022",
+      useDefineForClassFields: true,
+      lib: ["ES2022", "DOM", "DOM.Iterable"],
+      allowJs: false,
+      skipLibCheck: true,
+      esModuleInterop: true,
+      allowSyntheticDefaultImports: true,
+      strict: true,
+      forceConsistentCasingInFileNames: true,
+      module: "ESNext",
+      moduleResolution: "Bundler",
+      resolveJsonModule: true,
+      isolatedModules: true,
+      noEmit: true,
+      jsx: "react-jsx",
+      types: ["vite/client"]
+    },
+    include: ["src"],
+    references: [],
+    exclude: TSCONFIG_TEST_EXCLUDE
+  })}
+`;
+}
+function apiTsconfigJson() {
+  return `${json({
+    compilerOptions: {
+      target: "ES2022",
+      lib: ["ES2022", "DOM", "DOM.Iterable", "WebWorker"],
+      allowJs: false,
+      skipLibCheck: true,
+      esModuleInterop: true,
+      allowSyntheticDefaultImports: true,
+      strict: true,
+      forceConsistentCasingInFileNames: true,
+      module: "ESNext",
+      moduleResolution: "Bundler",
+      resolveJsonModule: true,
+      isolatedModules: true,
+      noEmit: true,
+      types: ["@cloudflare/workers-types", "node"]
+    },
+    include: ["src"],
+    references: [],
+    exclude: TSCONFIG_TEST_EXCLUDE
+  })}
+`;
+}
 function gitignore() {
   return [
     "node_modules/",
@@ -6057,12 +6160,15 @@ function platformAppTsx(application, options) {
     "  }",
     "",
     "  if (!auth) {",
+    "    // Pre-AppRoot: appId is still resolving, so auth can't be built yet.",
+    "    // Render the SAME scaffold layout AppRoot uses below so this phase and",
+    "    // the auth-gate fallback read as one continuous loading state (the",
+    "    // scaffold resolves theme + rail width on its own to match the shell).",
     "    return (",
     "      <TopoloAppLoadingScaffold",
     "        appId={appId}",
     "        appName={APP_NAME}",
     "        layout={{ shell: 'topbar', content: 'workspace' }}",
-    "        subtitle={`Loading ${APP_NAME}...`}",
     "      />",
     "    );",
     "  }",
@@ -6103,8 +6209,6 @@ function platformAppTsx(application, options) {
     "          appId={appId}",
     "          appName={APP_NAME}",
     "          layout={{ shell: loading?.shell || 'topbar', content: loading?.content || 'workspace' }}",
-    "          title={loading?.title}",
-    "          subtitle={`Loading ${APP_NAME}...`}",
     "        />",
     "      )}",
     "      shell={{",
@@ -6368,11 +6472,6 @@ function developerAppTsx(application) {
   ].join("\n");
 }
 
-// src/commands/app-scaffold-cloudflare-constants.ts
-var CLOUDFLARE_ACCOUNT_ID = "49ef1ba682ad8cfd720c86699ae17521";
-var STAGING_CLOUDFLARE_ACCOUNT_ID = "4f4e1c69a3830946f9fea7b1eb7531ac";
-var CLOUDFLARE_COMPATIBILITY_DATE = "2026-05-05";
-
 // src/commands/app-scaffold-worker-template.ts
 function webWorkerTs(application) {
   const serviceName = toTitle(application.name);
@@ -6427,6 +6526,29 @@ function platformWebWranglerToml(application) {
     'binding = "API"',
     `service = "topolo-${slug}-api"`,
     "",
+    "[env.development]",
+    `name = "topolo-${slug}-development"`,
+    `account_id = "${DEVELOPMENT_CLOUDFLARE_ACCOUNT_ID}"`,
+    "workers_dev = true",
+    "",
+    "[env.development.vars]",
+    `APP_ID = "${application.appId ?? ""}"`,
+    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
+    "",
+    "[[env.development.routes]]",
+    `pattern = "${slug}.topolo.dev"`,
+    "custom_domain = true",
+    "",
+    "[env.development.assets]",
+    'directory = "./dist"',
+    'binding = "ASSETS"',
+    'not_found_handling = "single-page-application"',
+    'run_worker_first = ["/api/*"]',
+    "",
+    "[[env.development.services]]",
+    'binding = "API"',
+    `service = "topolo-${slug}-api-development"`,
+    "",
     "[env.staging]",
     `name = "topolo-${slug}-staging"`,
     `account_id = "${STAGING_CLOUDFLARE_ACCOUNT_ID}"`,
@@ -6498,6 +6620,22 @@ function platformApiWranglerToml(application, resources, profile) {
     ""
   ];
   appendResourceWranglerBlocks(lines, resources, resource, "production");
+  lines.push(
+    "[env.development]",
+    `name = "topolo-${slug}-api-development"`,
+    `account_id = "${DEVELOPMENT_CLOUDFLARE_ACCOUNT_ID}"`,
+    "workers_dev = true",
+    "",
+    "[env.development.vars]",
+    'AUTH_BASE_URL = "https://auth.topolo.dev"',
+    'NEXUS_GATEWAY_URL = "https://nexus.topolo.dev"',
+    `NEXUS_APP_ID = "${slug}"`,
+    `APP_ID = "${application.appId ?? ""}"`,
+    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
+    'ENVIRONMENT = "development"',
+    ""
+  );
+  appendResourceWranglerBlocks(lines, resources, resource, "development");
   lines.push(
     "[env.staging]",
     `name = "topolo-${slug}-api-staging"`,
@@ -6531,13 +6669,14 @@ function platformApiWranglerToml(application, resources, profile) {
   return lines.join("\n");
 }
 function appendResourceWranglerBlocks(lines, resources, resource, environment) {
-  const prefix = environment === "staging" ? "env.staging." : environment === "production-env" ? "env.production." : "";
-  const envName = environment === "staging" ? "Staging" : "Production";
+  const prefix = environment === "staging" ? "env.staging." : environment === "development" ? "env.development." : environment === "production-env" ? "env.production." : "";
+  const envName = environment === "staging" ? "Staging" : environment === "development" ? "Development" : "Production";
+  const pick = (dev, staging, prod) => environment === "development" ? dev : environment === "staging" ? staging : prod;
   if (resources.d1) {
     lines.push(
       `[[${prefix}d1_databases]]`,
       `binding = "${resource.d1Binding}"`,
-      `database_name = "${environment === "staging" ? resource.d1StagingName : resource.d1ProductionName}"`,
+      `database_name = "${pick(resource.d1DevelopmentName, resource.d1StagingName, resource.d1ProductionName)}"`,
       'database_id = "provision-after-scaffold"',
       'migrations_dir = "migrations"',
       ""
@@ -6547,7 +6686,7 @@ function appendResourceWranglerBlocks(lines, resources, resource, environment) {
     lines.push(
       `[[${prefix}r2_buckets]]`,
       `binding = "${resource.r2Binding}"`,
-      `bucket_name = "${environment === "staging" ? resource.r2StagingName : resource.r2ProductionName}"`,
+      `bucket_name = "${pick(resource.r2DevelopmentName, resource.r2StagingName, resource.r2ProductionName)}"`,
       ""
     );
   }
@@ -6555,10 +6694,10 @@ function appendResourceWranglerBlocks(lines, resources, resource, environment) {
     lines.push(
       `[[${prefix}queues.producers]]`,
       `binding = "${resource.queueBinding}"`,
-      `queue = "${environment === "staging" ? resource.queueStagingName : resource.queueProductionName}"`,
+      `queue = "${pick(resource.queueDevelopmentName, resource.queueStagingName, resource.queueProductionName)}"`,
       "",
       `[[${prefix}queues.consumers]]`,
-      `queue = "${environment === "staging" ? resource.queueStagingName : resource.queueProductionName}"`,
+      `queue = "${pick(resource.queueDevelopmentName, resource.queueStagingName, resource.queueProductionName)}"`,
       ""
     );
   }
@@ -6566,7 +6705,7 @@ function appendResourceWranglerBlocks(lines, resources, resource, environment) {
     lines.push(
       `[[${prefix}workflows]]`,
       `binding = "${resource.workflowBinding}"`,
-      `name = "${environment === "staging" ? resource.workflowStagingName : resource.workflowProductionName}"`,
+      `name = "${pick(resource.workflowDevelopmentName, resource.workflowStagingName, resource.workflowProductionName)}"`,
       `class_name = "${resource.workflowClassName}"`,
       ""
     );
@@ -6764,7 +6903,9 @@ function platformWorkerTs(application, options) {
     "import { Hono } from 'hono';",
     "import { createTopoloWidgetResponse, type TopoloWidgetDraft } from '@topolo/sdk';",
     "import { createTopoloWorkerRuntime, type TopoloRuntimeContext } from '@topolo-io/worker-runtime';",
-    "import { SCAFFOLD_APP_ID, SCAFFOLD_APP_NAME, SCAFFOLD_SERVICE_SLUG, resolveRuntimeAppId } from './app-identity';",
+    "import { withSecurityHeaders } from '@topolo-io/security-headers';",
+    "import { withErrorReporting } from '@topolo-io/error-middleware';",
+    "import { SCAFFOLD_APP_NAME, SCAFFOLD_SERVICE_SLUG, resolveRuntimeAppId } from './app-identity';",
     ...options.resources.workflow ? ["import { WorkflowEntrypoint, type WorkflowEvent, type WorkflowStep } from 'cloudflare:workers';"] : [],
     "",
     "export interface Env {",
@@ -6789,12 +6930,10 @@ function platformWorkerTs(application, options) {
     "const runtime = createTopoloWorkerRuntime<Env>({",
     "  appName: SCAFFOLD_APP_NAME,",
     "  serviceSlug: SCAFFOLD_SERVICE_SLUG,",
-    "  resolveAppId: (env) => resolveRuntimeAppId(env),",
+    "  // Auth verification base URL is environment-driven (staging/prod/dev),",
+    "  // so rt.verifyAuth() targets the correct Auth service per deploy.",
     "  authBaseUrl: (env) => env.AUTH_BASE_URL,",
-    "  usageMonitoring: {",
-    "    appId: SCAFFOLD_APP_ID,",
-    "    nexusGatewayUrl: (env) => env.NEXUS_GATEWAY_URL,",
-    "  },",
+    "  authGateway: { enabled: false },",
     "});",
     "",
     "async function handleRequest(",
@@ -6854,11 +6993,20 @@ function platformWorkerTs(application, options) {
     "  return handleRequest(c.req.raw, c.env, rt);",
     "});",
     "",
+    "// Platform security headers + structured error reporting wrap the whole app",
+    "// (outermost), so headers are stamped even on error-middleware 5xx responses.",
+    "const securedFetch = withSecurityHeaders(",
+    "  withErrorReporting(",
+    "    (request: Request, env: Env, ctx: ExecutionContext) => api.fetch(request, env, ctx),",
+    "    { appName: SCAFFOLD_APP_NAME, appId: SCAFFOLD_SERVICE_SLUG },",
+    "  ),",
+    ") as (request: Request, env: Env, ctx: ExecutionContext) => Response | Promise<Response>;",
+    "",
     "export default {",
     "  fetch: runtime.worker((request, env, ctx, rt) => {",
     "    const bindings = env as Env & { __rt?: TopoloRuntimeContext<Env> };",
     "    bindings.__rt = rt;",
-    "    return api.fetch(request, bindings, ctx as ExecutionContext);",
+    "    return securedFetch(request, bindings, ctx as ExecutionContext);",
     "  }),",
     "};",
     "",
@@ -7207,13 +7355,17 @@ function topoloAppManifestJson(application, options) {
       }
     } : {}
   };
+  const actions = options.api ? baselineApiActions() : [];
   return `${json({
     $schema: "./../../topolo-platform/tooling/app-manifest-schema.json",
     name: `topolo-${slug}`,
     appId: application.appId,
-    primaryTarget: "web",
     compatibilityDate: CLOUDFLARE_COMPATIBILITY_DATE,
     environments: {
+      development: {
+        accountId: DEVELOPMENT_CLOUDFLARE_ACCOUNT_ID,
+        domain: "topolo.dev"
+      },
       staging: {
         accountId: STAGING_CLOUDFLARE_ACCOUNT_ID,
         domain: "stg.topolo.us"
@@ -7223,10 +7375,87 @@ function topoloAppManifestJson(application, options) {
         domain: "topolo.app"
       }
     },
-    targets
+    targets,
+    ...actions.length ? { actions } : {}
   })}
 `;
 }
+function topoloActionContractsMjs() {
+  return [
+    "// Canonical action contracts \u2014 the source of truth for the agent/SDK/MCP",
+    "// surface. Each entry maps 1:1 to a worker route (method + path) and validates",
+    "// its input with zod. Add product actions here and mirror them into",
+    "// topolo.app.json actions[]. Mirrors the normalized fleet convention.",
+    "",
+    "import { z } from 'zod';",
+    "",
+    "const emptyInput = z.object({}).strict();",
+    "",
+    "export const topoloActionContracts = {",
+    "  'widget.get': {",
+    "    name: 'widget.get',",
+    "    method: 'GET',",
+    "    path: '/api/widget',",
+    "    input: emptyInput,",
+    "  },",
+    "  'workspace.bootstrap': {",
+    "    name: 'workspace.bootstrap',",
+    "    method: 'GET',",
+    "    path: '/api/bootstrap',",
+    "    input: emptyInput,",
+    "  },",
+    "};",
+    "",
+    "export const topoloActionInputSchemas = Object.fromEntries(",
+    "  Object.entries(topoloActionContracts).map(([name, contract]) => [",
+    "    name,",
+    "    z.toJSONSchema(contract.input),",
+    "  ]),",
+    ");",
+    ""
+  ].join("\n");
+}
+function baselineApiActions() {
+  const emptyInputSchema = {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    type: "object",
+    properties: {},
+    additionalProperties: false
+  };
+  const openOutputSchema = { type: "object", additionalProperties: true };
+  return [
+    {
+      name: "widget.get",
+      title: "Get widget summary",
+      description: "Get the TopoloOne widget summary for this service.",
+      method: "GET",
+      path: "/api/widget",
+      permission: "workspace:read",
+      readOnly: true,
+      inputSchema: emptyInputSchema,
+      outputSchema: openOutputSchema,
+      target: "api",
+      destructive: false,
+      requiresConfirmation: false,
+      agentAccess: "auto"
+    },
+    {
+      name: "workspace.bootstrap",
+      title: "Get workspace bootstrap",
+      description: "Get the signed workspace bootstrap payload for this service.",
+      method: "GET",
+      path: "/api/bootstrap",
+      permission: "workspace:read",
+      readOnly: true,
+      inputSchema: emptyInputSchema,
+      outputSchema: openOutputSchema,
+      target: "api",
+      destructive: false,
+      requiresConfirmation: false,
+      agentAccess: "auto"
+    }
+  ];
+}
 function cloudcontrolJson(application, options) {
   const slug = toSlug(application.id);
   const appPath = firstPartyAppPath(application.appDir, options.audience);
@@ -7254,6 +7483,15 @@ function cloudcontrolJson(application, options) {
         resource_name: resources.d1StagingName,
         resource_id: "provision-after-scaffold",
         migrations_dir: "migrations"
+      },
+      {
+        resource_type: "d1",
+        binding: resources.d1Binding,
+        environment: "development",
+        account_id: DEVELOPMENT_CLOUDFLARE_ACCOUNT_ID,
+        resource_name: resources.d1DevelopmentName,
+        resource_id: "provision-after-scaffold",
+        migrations_dir: "migrations"
       }
     );
   }
@@ -7871,8 +8109,73 @@ function envExample(application) {
 }
 
 // src/commands/app-scaffold.ts
-function generateOpaqueAppId() {
-  return `app_${randomBytes(9).toString("base64url")}`;
+function standardScriptStub() {
+  return `#!/usr/bin/env python3
+"""Canonical-fetching stub for .github/scripts/standard_*.py.
+
+Replaces a vendored copy. At runtime, finds the canonical sibling in
+\`<repo-parent>/topolo-platform/tooling/<name>.py\` and execs it, passing argv
+through, so every consumer runs the current platform script on every
+invocation (no drifted per-app copies).
+
+Override: set TOPOLO_PLATFORM_DIR to the absolute path of the topolo-platform
+repo when the canonical is in a non-default checkout layout (e.g. CI). If no
+canonical can be found, exits 2 with a clear message rather than silently
+falling back.
+"""
+from __future__ import annotations
+
+import os
+import sys
+
+STUB_NAME = os.path.basename(__file__)  # standard_ci.py OR standard_deploy.py
+HERE = os.path.dirname(os.path.abspath(__file__))
+
+
+def find_canonical() -> str | None:
+    # 1. Explicit override (CI runners with non-standard layouts).
+    override = os.environ.get('TOPOLO_PLATFORM_DIR')
+    if override:
+        path = os.path.join(override, 'tooling', STUB_NAME)
+        if os.path.exists(path):
+            return path
+    # 2. Walk up looking for a sibling topolo-platform/tooling/<name>.py.
+    cursor = HERE
+    for _ in range(10):
+        candidate = os.path.normpath(os.path.join(cursor, '..', 'topolo-platform', 'tooling', STUB_NAME))
+        if os.path.exists(candidate):
+            return candidate
+        parent = os.path.dirname(cursor)
+        if parent == cursor:
+            break
+        cursor = parent
+    # 3. node_modules-based delivery (future): @topolo-io/standard-ci.
+    cursor = HERE
+    for _ in range(10):
+        candidate = os.path.normpath(os.path.join(cursor, 'node_modules', '@topolo-io', 'standard-ci', 'bin', STUB_NAME))
+        if os.path.exists(candidate):
+            return candidate
+        parent = os.path.dirname(cursor)
+        if parent == cursor:
+            break
+        cursor = parent
+    return None
+
+
+def main() -> None:
+    canonical = find_canonical()
+    if not canonical:
+        sys.stderr.write(
+            f'[topolo-canonical-stub] could not locate canonical {STUB_NAME}.\\n'
+            f'  Set TOPOLO_PLATFORM_DIR or checkout topolo-platform as a sibling of this app.\\n'
+        )
+        sys.exit(2)
+    os.execv(sys.executable, [sys.executable, canonical, *sys.argv[1:]])
+
+
+if __name__ == '__main__':
+    main()
+`;
 }
 function applicationScaffoldPayload(application, options = {}) {
   const target = normalizeTarget(options.target);
@@ -7892,13 +8195,16 @@ function applicationScaffoldPayload(application, options = {}) {
   const containerAppId = normalizeContainerAppId(options.containerAppId, surfaceModel);
   const profile = normalizeScaffoldProfile(options.profile);
   const resources = resolveScaffoldResources(profile, options);
+  if (target === "platform" && api && !profile) {
+    resources.d1 = true;
+  }
   const ownerType = target === "platform" ? "topolo_first_party" : "third_party";
   const distributionModel = target === "platform" ? "marketplace" : "organization_internal";
   const appDir = options.appDir ?? catalogApplication?.appDir ?? (target === "platform" ? `Topolo${toPascalCase(id)}` : `topolo-${slug}`);
   const name = options.name ?? catalogApplication?.name ?? `topolo-${slug}`;
   const packageName = options.packageName ?? catalogApplication?.packageName ?? `topolo-${slug}`;
   const serviceSlug = api ? target === "platform" ? `topolo-${slug}` : id : null;
-  const defaultAppId = target === "platform" ? generateOpaqueAppId() : catalogApplication?.services[0] ?? id;
+  const defaultAppId = target === "platform" ? `app_topolo_${id}` : catalogApplication?.services[0] ?? id;
   const appId = api ? options.appId ?? defaultAppId : null;
   const productionUrl = browser ? options.productionUrl ?? catalogApplication?.productionUrl ?? `https://${slug}.topolo.app` : null;
   const scopes = scaffoldScopes({ browser, api });
@@ -8038,6 +8344,28 @@ function scaffoldCapabilities(options) {
 function scaffoldFiles(options) {
   const { application, target } = options;
   const slug = toSlug(application.id);
+  const tablePrefix = slug.replace(/-/g, "_");
+  const tenantColumn = options.payload.tenancy === "household" ? "household_id" : "organization_id";
+  const workspacesMigrationSql = [
+    `CREATE TABLE IF NOT EXISTS ${tablePrefix}_workspaces (`,
+    "  id TEXT PRIMARY KEY,",
+    `  ${tenantColumn} TEXT NOT NULL,`,
+    "  name TEXT NOT NULL,",
+    "  slug TEXT NOT NULL,",
+    "  created_by_user_id TEXT,",
+    "  created_by_email TEXT,",
+    "  created_at TEXT NOT NULL,",
+    "  updated_at TEXT NOT NULL,",
+    `  UNIQUE(${tenantColumn}, slug)`,
+    ");",
+    "",
+    `CREATE INDEX IF NOT EXISTS idx_${tablePrefix}_workspaces_${tenantColumn}`,
+    `  ON ${tablePrefix}_workspaces(${tenantColumn});`,
+    "",
+    `CREATE INDEX IF NOT EXISTS idx_${tablePrefix}_workspaces_slug`,
+    `  ON ${tablePrefix}_workspaces(${tenantColumn}, slug);`,
+    ""
+  ].join("\n");
   const base = target === "platform" ? firstPartyAppPath(application.appDir, options.payload.audience) : application.appDir;
   const browserBase = target === "platform" ? `${base}/apps/web` : base;
   const apiBase = target === "platform" ? `${base}/apps/api` : base;
@@ -8095,15 +8423,6 @@ function scaffoldFiles(options) {
         resources: options.payload.resources
       })
     },
-    {
-      path: `${base}/tsconfig.json`,
-      purpose: "TypeScript configuration for the generated app.",
-      requiredSignals: [
-        "uses strict mode",
-        "includes browser DOM types for React and Worker types for API-backed apps"
-      ],
-      content: tsconfigJson(options.api, target)
-    },
     {
       path: `${browserBase}/vite.config.ts`,
       purpose: "Vite browser build configuration.",
@@ -8161,6 +8480,31 @@ function scaffoldFiles(options) {
       content: stylesCss()
     }
   ];
+  if (target === "platform") {
+    if (options.browser) {
+      files.push({
+        path: `${browserBase}/tsconfig.json`,
+        purpose: "TypeScript configuration for the browser surface (DOM + vite types).",
+        requiredSignals: ["uses strict mode", "includes browser DOM types for React"],
+        content: webTsconfigJson()
+      });
+    }
+    if (options.api) {
+      files.push({
+        path: `${apiBase}/tsconfig.json`,
+        purpose: "TypeScript configuration for the API worker surface (Workers types).",
+        requiredSignals: ["uses strict mode", "includes Cloudflare Workers types"],
+        content: apiTsconfigJson()
+      });
+    }
+  } else {
+    files.push({
+      path: `${base}/tsconfig.json`,
+      purpose: "TypeScript configuration for the generated app.",
+      requiredSignals: ["uses strict mode", "includes browser DOM types for React and Worker types for API-backed apps"],
+      content: tsconfigJson(options.api, target)
+    });
+  }
   if (target === "platform") {
     files.push(
       {
@@ -8176,6 +8520,17 @@ function scaffoldFiles(options) {
           profile: options.payload.profile
         })
       },
+      ...options.api ? [
+        {
+          path: `${base}/topolo.action-contracts.mjs`,
+          purpose: "Zod source of truth for the agent/SDK/MCP action catalog, mirrored into topolo.app.json actions[].",
+          requiredSignals: [
+            "declares topoloActionContracts with name/method/path per action",
+            "each contract has a zod input validator, keeping the manifest actions[] honest"
+          ],
+          content: topoloActionContractsMjs()
+        }
+      ] : [],
       {
         path: `${base}/topolo.cloudcontrol.json`,
         purpose: "CloudControl source of truth for deploy targets, routes, bindings, and CI metadata.",
@@ -8201,6 +8556,33 @@ function scaffoldFiles(options) {
         ],
         content: options.ciWorkflow ?? ""
       },
+      {
+        path: `${base}/.github/scripts/standard_deploy.py`,
+        purpose: "Canonical-fetching deploy stub (execs topolo-platform/tooling/standard_deploy.py).",
+        requiredSignals: [
+          "never a vendored copy of the canonical script",
+          "runs the current platform standard_deploy.py on every invocation"
+        ],
+        content: standardScriptStub()
+      },
+      {
+        path: `${base}/.github/scripts/standard_ci.py`,
+        purpose: "Canonical-fetching CI stub (execs topolo-platform/tooling/standard_ci.py).",
+        requiredSignals: [
+          "never a vendored copy of the canonical script",
+          "runs the current platform standard_ci.py on every invocation"
+        ],
+        content: standardScriptStub()
+      },
+      {
+        path: `${base}/.github/scripts/standard_ops.py`,
+        purpose: "Canonical-fetching ops stub (execs topolo-platform/tooling/standard_ops.py).",
+        requiredSignals: [
+          "never a vendored copy of the canonical script",
+          "runs the current platform standard_ops.py on every invocation"
+        ],
+        content: standardScriptStub()
+      },
       {
         path: `system-apps/TopoloDocs/apps/web/src/content/systems/topolo-${slug}.json`,
         purpose: "Canonical system registry entry.",
@@ -8324,6 +8706,25 @@ function scaffoldFiles(options) {
         portfolio: options.payload.portfolio
       })
     });
+    if (target === "platform") {
+      files.push({
+        path: `${browserBase}/vitest.config.ts`,
+        purpose: "Vitest config for the browser surface.",
+        requiredSignals: [
+          "runs component/unit tests under jsdom",
+          "keeps the generated browser surface testable from day one"
+        ],
+        content: `import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    include: ['test/**/*.test.{ts,tsx}'],
+    environment: 'jsdom',
+  },
+});
+`
+      });
+    }
   }
   if (options.api) {
     files.push(
@@ -8380,8 +8781,45 @@ function scaffoldFiles(options) {
             "binds the frontend Worker to the API Worker for /api/* requests"
           ],
           content: platformWebWranglerToml(application)
+        },
+        {
+          path: `${apiBase}/vitest.config.ts`,
+          purpose: "Vitest config for the API worker surface.",
+          requiredSignals: [
+            "runs worker/unit tests under the node environment",
+            "keeps the generated service testable from day one"
+          ],
+          content: `import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    include: ['test/**/*.test.{js,mjs,mts,ts,tsx}'],
+    environment: 'node',
+  },
+});
+`
+        },
+        {
+          path: `${apiBase}/test/health.test.ts`,
+          purpose: "Smoke test so the API test suite is non-empty from scaffold.",
+          requiredSignals: [
+            "asserts the scaffold boots",
+            "is replaced by real route/repository tests as the surface grows"
+          ],
+          content: "import { describe, expect, it } from 'vitest';\n\n// Smoke test so the API test suite is non-empty from day one. Replace with\n// real route/repository tests as the surface grows.\ndescribe('api scaffold', () => {\n  it('boots', () => {\n    expect(true).toBe(true);\n  });\n});\n"
         }
       );
+      if (options.payload.resources.d1) {
+        files.push({
+          path: `${apiBase}/migrations/0001_initial.sql`,
+          purpose: "Canonical multi-tenant baseline: the app workspaces table.",
+          requiredSignals: [
+            `${tablePrefix}_workspaces carries ${tenantColumn} on every row`,
+            "every domain table added later carries the tenant + workspace columns"
+          ],
+          content: workspacesMigrationSql
+        });
+      }
     }
   }
   return files;
@@ -10299,18 +10737,13 @@ function registerContextCommand(program2) {
       }
       const key = contextKey(resolved.contextType, resolved.organizationId);
       const existing = profile.contexts?.[key];
-      let updated = config;
-      if (existing?.credential) {
-        updated = activateContext(config, environment, key);
-      } else {
-        const newCredential = await exchangeForContext(cred, serviceUrls, {
-          type: resolved.contextType,
-          id: resolved.organizationId
-        });
-        resolved.credential = newCredential;
-        resolved.oauthClientId = existing?.oauthClientId ?? profile.oauthClientId;
-        updated = writeContextCredential(config, environment, resolved, true);
-      }
+      const newCredential = await exchangeForContext(cred, serviceUrls, {
+        type: resolved.contextType,
+        id: resolved.organizationId
+      });
+      resolved.credential = newCredential;
+      resolved.oauthClientId = existing?.oauthClientId ?? profile.oauthClientId;
+      const updated = writeContextCredential(config, environment, resolved, true);
       await writeConfig(updated);
       emit(
         { environment, active: key, context: { type: resolved.contextType, label: labelFor(resolved) } },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topolo/cli",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Command-line interface for Topolo developers, operators, and agents, with internal first-party scaffolding available under the topolo platform namespace.",
   "type": "module",
   "bin": {