@topolo/cli 0.4.9 → 0.5.1

package/dist/index.js

@@ -9,7 +9,7 @@ import { platform as platform2 } from "os";
 import { createInterface } from "readline/promises";
 import { stdin as input } from "process";
 
-// node_modules/@topolo/sdk/dist/index.js
+// ../topolo-sdk/dist/index.js
 function applyAuthHeaders(headers, credential) {
   if (credential.kind === "api_key") {
     headers.set("X-Api-Key", credential.apiKey);
@@ -61,13 +61,13 @@ var TopoloHttpError = class extends TopoloSdkError {
   body;
   service;
   path;
-  constructor(service, path4, status, body, message) {
-    super("http_error", message ?? `HTTP ${status} from ${service}${path4}`);
+  constructor(service, path5, status, body, message) {
+    super("http_error", message ?? `HTTP ${status} from ${service}${path5}`);
     this.name = "TopoloHttpError";
     this.status = status;
     this.body = body;
     this.service = service;
-    this.path = path4;
+    this.path = path5;
   }
 };
 var APP_API_URLS = {
@@ -2171,24 +2171,24 @@ var SUPPORTED_SCHEMA_KEYWORDS = /* @__PURE__ */ new Set([
   "exclusiveMaximum",
   "multipleOf"
 ]);
-function validateTopoloActionInput(schema, input2) {
+function validateTopoloActionInput(schema, input3) {
   const schemaIssue = inspectSchema(schema, "$", schema, 0);
   if (schemaIssue) return { valid: false, errors: [schemaIssue] };
   const errors = [];
-  validateNode(schema, input2, "$", schema, errors, 0);
+  validateNode(schema, input3, "$", schema, errors, 0);
   return { valid: errors.length === 0, errors };
 }
-function inspectSchema(schema, path4, root, depth) {
-  if (depth > 128) return { path: path4, code: "schema_depth", message: "Schema recursion exceeded 128 levels." };
+function inspectSchema(schema, path5, root, depth) {
+  if (depth > 128) return { path: path5, code: "schema_depth", message: "Schema recursion exceeded 128 levels." };
   const unsupportedKeyword = Object.keys(schema).find((keyword) => !SUPPORTED_SCHEMA_KEYWORDS.has(keyword));
   if (unsupportedKeyword) {
-    return { path: path4, code: "unsupported_schema_keyword", message: `Action schema uses unsupported keyword ${unsupportedKeyword}.` };
+    return { path: path5, code: "unsupported_schema_keyword", message: `Action schema uses unsupported keyword ${unsupportedKeyword}.` };
   }
   if (typeof schema.format === "string" && !["uri", "email", "date-time"].includes(schema.format)) {
-    return { path: path4, code: "unsupported_schema_format", message: `Action schema uses unsupported format ${schema.format}.` };
+    return { path: path5, code: "unsupported_schema_format", message: `Action schema uses unsupported format ${schema.format}.` };
   }
   if (typeof schema.$ref === "string" && !resolveLocalReference(root, schema.$ref)) {
-    return { path: path4, code: "unsupported_schema_ref", message: `Cannot resolve schema reference ${schema.$ref}.` };
+    return { path: path5, code: "unsupported_schema_ref", message: `Cannot resolve schema reference ${schema.$ref}.` };
   }
   const children = [];
   if (isRecord(schema.properties)) children.push(...Object.entries(schema.properties));
@@ -2204,7 +2204,7 @@ function inspectSchema(schema, path4, root, depth) {
   );
   for (const [key, child] of children) {
     if (!isRecord(child)) continue;
-    const issue = inspectSchema(child, `${path4}.${key}`, root, depth + 1);
+    const issue = inspectSchema(child, `${path5}.${key}`, root, depth + 1);
     if (issue) return issue;
   }
   return null;
@@ -2212,129 +2212,129 @@ function inspectSchema(schema, path4, root, depth) {
 function arraySchemaEntries(keyword, value) {
   return Array.isArray(value) ? value.map((candidate, index) => [`${keyword}[${index}]`, candidate]) : [];
 }
-function validateNode(schema, value, path4, root, errors, depth) {
+function validateNode(schema, value, path5, root, errors, depth) {
   if (depth > 128) {
-    errors.push({ path: path4, code: "schema_depth", message: "Schema recursion exceeded 128 levels." });
+    errors.push({ path: path5, code: "schema_depth", message: "Schema recursion exceeded 128 levels." });
     return;
   }
   if (typeof schema.$ref === "string") {
     const resolved = resolveLocalReference(root, schema.$ref);
     if (!resolved) {
-      errors.push({ path: path4, code: "unsupported_schema_ref", message: `Cannot resolve schema reference ${schema.$ref}.` });
+      errors.push({ path: path5, code: "unsupported_schema_ref", message: `Cannot resolve schema reference ${schema.$ref}.` });
       return;
     }
-    validateNode(resolved, value, path4, root, errors, depth + 1);
+    validateNode(resolved, value, path5, root, errors, depth + 1);
   }
   if (Array.isArray(schema.allOf)) {
     for (const candidate of schema.allOf) {
-      if (isRecord(candidate)) validateNode(candidate, value, path4, root, errors, depth + 1);
+      if (isRecord(candidate)) validateNode(candidate, value, path5, root, errors, depth + 1);
     }
   }
   if (Array.isArray(schema.anyOf) && !schema.anyOf.some((candidate) => candidateMatches(candidate, value, root, depth))) {
-    errors.push({ path: path4, code: "any_of", message: "Value does not match any allowed schema." });
+    errors.push({ path: path5, code: "any_of", message: "Value does not match any allowed schema." });
     return;
   }
   if (Array.isArray(schema.oneOf)) {
     const matches = schema.oneOf.filter((candidate) => candidateMatches(candidate, value, root, depth)).length;
     if (matches !== 1) {
-      errors.push({ path: path4, code: "one_of", message: "Value must match exactly one allowed schema." });
+      errors.push({ path: path5, code: "one_of", message: "Value must match exactly one allowed schema." });
       return;
     }
   }
   if (value === null && schema.nullable === true) return;
   if (Object.prototype.hasOwnProperty.call(schema, "const") && !sameJsonValue(value, schema.const)) {
-    errors.push({ path: path4, code: "const", message: `Value must equal ${JSON.stringify(schema.const)}.` });
+    errors.push({ path: path5, code: "const", message: `Value must equal ${JSON.stringify(schema.const)}.` });
     return;
   }
   if (Array.isArray(schema.enum) && !schema.enum.some((candidate) => sameJsonValue(value, candidate))) {
-    errors.push({ path: path4, code: "enum", message: `Value must be one of ${schema.enum.map((item) => JSON.stringify(item)).join(", ")}.` });
+    errors.push({ path: path5, code: "enum", message: `Value must be one of ${schema.enum.map((item) => JSON.stringify(item)).join(", ")}.` });
     return;
   }
   if (!matchesType(schema.type, value)) {
-    errors.push({ path: path4, code: "type", message: `Expected ${String(schema.type)}.` });
+    errors.push({ path: path5, code: "type", message: `Expected ${String(schema.type)}.` });
     return;
   }
-  if (typeof value === "string") validateString(schema, value, path4, errors);
-  if (typeof value === "number") validateNumber(schema, value, path4, errors);
-  if (Array.isArray(value)) validateArray(schema, value, path4, root, errors, depth);
-  if (isRecord(value)) validateObject(schema, value, path4, root, errors, depth);
+  if (typeof value === "string") validateString(schema, value, path5, errors);
+  if (typeof value === "number") validateNumber(schema, value, path5, errors);
+  if (Array.isArray(value)) validateArray(schema, value, path5, root, errors, depth);
+  if (isRecord(value)) validateObject(schema, value, path5, root, errors, depth);
 }
-function validateObject(schema, value, path4, root, errors, depth) {
+function validateObject(schema, value, path5, root, errors, depth) {
   if (typeof schema.minProperties === "number" && Object.keys(value).length < schema.minProperties) {
-    errors.push({ path: path4, code: "min_properties", message: `Expected at least ${schema.minProperties} properties.` });
+    errors.push({ path: path5, code: "min_properties", message: `Expected at least ${schema.minProperties} properties.` });
   }
   if (typeof schema.maxProperties === "number" && Object.keys(value).length > schema.maxProperties) {
-    errors.push({ path: path4, code: "max_properties", message: `Expected at most ${schema.maxProperties} properties.` });
+    errors.push({ path: path5, code: "max_properties", message: `Expected at most ${schema.maxProperties} properties.` });
   }
   const properties = isRecord(schema.properties) ? schema.properties : {};
   const required = Array.isArray(schema.required) ? schema.required.map(String) : [];
   for (const key of required) {
     if (!Object.prototype.hasOwnProperty.call(value, key)) {
-      errors.push({ path: `${path4}.${key}`, code: "required", message: "Required property is missing." });
+      errors.push({ path: `${path5}.${key}`, code: "required", message: "Required property is missing." });
     }
   }
   if (isRecord(schema.propertyNames)) {
     for (const key of Object.keys(value)) {
-      validateNode(schema.propertyNames, key, `${path4}.${key}`, root, errors, depth + 1);
+      validateNode(schema.propertyNames, key, `${path5}.${key}`, root, errors, depth + 1);
     }
   }
   for (const [key, child] of Object.entries(value)) {
     const childSchema = properties[key];
     if (isRecord(childSchema)) {
-      validateNode(childSchema, child, `${path4}.${key}`, root, errors, depth + 1);
+      validateNode(childSchema, child, `${path5}.${key}`, root, errors, depth + 1);
     } else if (schema.additionalProperties === false) {
-      errors.push({ path: `${path4}.${key}`, code: "additional_property", message: "Property is not declared by the action schema." });
+      errors.push({ path: `${path5}.${key}`, code: "additional_property", message: "Property is not declared by the action schema." });
     } else if (isRecord(schema.additionalProperties)) {
-      validateNode(schema.additionalProperties, child, `${path4}.${key}`, root, errors, depth + 1);
+      validateNode(schema.additionalProperties, child, `${path5}.${key}`, root, errors, depth + 1);
     }
   }
 }
-function validateArray(schema, value, path4, root, errors, depth) {
+function validateArray(schema, value, path5, root, errors, depth) {
   if (typeof schema.minItems === "number" && value.length < schema.minItems) {
-    errors.push({ path: path4, code: "min_items", message: `Expected at least ${schema.minItems} items.` });
+    errors.push({ path: path5, code: "min_items", message: `Expected at least ${schema.minItems} items.` });
   }
   if (typeof schema.maxItems === "number" && value.length > schema.maxItems) {
-    errors.push({ path: path4, code: "max_items", message: `Expected at most ${schema.maxItems} items.` });
+    errors.push({ path: path5, code: "max_items", message: `Expected at most ${schema.maxItems} items.` });
   }
   if (schema.uniqueItems === true) {
     const unique2 = new Set(value.map((item) => JSON.stringify(item)));
-    if (unique2.size !== value.length) errors.push({ path: path4, code: "unique_items", message: "Expected every item to be unique." });
+    if (unique2.size !== value.length) errors.push({ path: path5, code: "unique_items", message: "Expected every item to be unique." });
   }
   if (isRecord(schema.items)) {
-    value.forEach((item, index) => validateNode(schema.items, item, `${path4}[${index}]`, root, errors, depth + 1));
+    value.forEach((item, index) => validateNode(schema.items, item, `${path5}[${index}]`, root, errors, depth + 1));
   }
 }
-function validateString(schema, value, path4, errors) {
+function validateString(schema, value, path5, errors) {
   if (typeof schema.minLength === "number" && value.length < schema.minLength) {
-    errors.push({ path: path4, code: "min_length", message: `Expected at least ${schema.minLength} characters.` });
+    errors.push({ path: path5, code: "min_length", message: `Expected at least ${schema.minLength} characters.` });
   }
   if (typeof schema.maxLength === "number" && value.length > schema.maxLength) {
-    errors.push({ path: path4, code: "max_length", message: `Expected at most ${schema.maxLength} characters.` });
+    errors.push({ path: path5, code: "max_length", message: `Expected at most ${schema.maxLength} characters.` });
   }
   if (typeof schema.pattern === "string") {
     try {
-      if (!new RegExp(schema.pattern).test(value)) errors.push({ path: path4, code: "pattern", message: "Value does not match the required pattern." });
+      if (!new RegExp(schema.pattern).test(value)) errors.push({ path: path5, code: "pattern", message: "Value does not match the required pattern." });
     } catch {
-      errors.push({ path: path4, code: "invalid_schema_pattern", message: "Action schema contains an invalid pattern." });
+      errors.push({ path: path5, code: "invalid_schema_pattern", message: "Action schema contains an invalid pattern." });
     }
   }
-  if (schema.format === "uri" && !isUrl(value)) errors.push({ path: path4, code: "format_uri", message: "Expected an absolute URL." });
-  if (schema.format === "email" && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(value)) errors.push({ path: path4, code: "format_email", message: "Expected an email address." });
-  if (schema.format === "date-time" && !isDateTime(value)) errors.push({ path: path4, code: "format_date_time", message: "Expected an ISO-8601 date-time." });
+  if (schema.format === "uri" && !isUrl(value)) errors.push({ path: path5, code: "format_uri", message: "Expected an absolute URL." });
+  if (schema.format === "email" && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(value)) errors.push({ path: path5, code: "format_email", message: "Expected an email address." });
+  if (schema.format === "date-time" && !isDateTime(value)) errors.push({ path: path5, code: "format_date_time", message: "Expected an ISO-8601 date-time." });
 }
-function validateNumber(schema, value, path4, errors) {
-  if (typeof schema.minimum === "number" && value < schema.minimum) errors.push({ path: path4, code: "minimum", message: `Expected a value of at least ${schema.minimum}.` });
-  if (typeof schema.maximum === "number" && value > schema.maximum) errors.push({ path: path4, code: "maximum", message: `Expected a value of at most ${schema.maximum}.` });
+function validateNumber(schema, value, path5, errors) {
+  if (typeof schema.minimum === "number" && value < schema.minimum) errors.push({ path: path5, code: "minimum", message: `Expected a value of at least ${schema.minimum}.` });
+  if (typeof schema.maximum === "number" && value > schema.maximum) errors.push({ path: path5, code: "maximum", message: `Expected a value of at most ${schema.maximum}.` });
   const exclusiveMinimum = typeof schema.exclusiveMinimum === "number" ? schema.exclusiveMinimum : schema.exclusiveMinimum === true && typeof schema.minimum === "number" ? schema.minimum : null;
   const exclusiveMaximum = typeof schema.exclusiveMaximum === "number" ? schema.exclusiveMaximum : schema.exclusiveMaximum === true && typeof schema.maximum === "number" ? schema.maximum : null;
   if (exclusiveMinimum !== null && value <= exclusiveMinimum) {
-    errors.push({ path: path4, code: "exclusive_minimum", message: `Expected a value greater than ${exclusiveMinimum}.` });
+    errors.push({ path: path5, code: "exclusive_minimum", message: `Expected a value greater than ${exclusiveMinimum}.` });
   }
   if (exclusiveMaximum !== null && value >= exclusiveMaximum) {
-    errors.push({ path: path4, code: "exclusive_maximum", message: `Expected a value less than ${exclusiveMaximum}.` });
+    errors.push({ path: path5, code: "exclusive_maximum", message: `Expected a value less than ${exclusiveMaximum}.` });
   }
   if (typeof schema.multipleOf === "number" && !isMultipleOf(value, schema.multipleOf)) {
-    errors.push({ path: path4, code: "multiple_of", message: `Expected a multiple of ${schema.multipleOf}.` });
+    errors.push({ path: path5, code: "multiple_of", message: `Expected a multiple of ${schema.multipleOf}.` });
   }
 }
 function candidateMatches(candidate, value, root, depth) {
@@ -2845,14 +2845,14 @@ var TopoloClient = class _TopoloClient {
     if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
       throw new TopoloSdkError("action_catalog_summary_unavailable", "Action catalog summary is unavailable.");
     }
-    const record = raw;
-    if (record.algorithm !== "sha256-v1" || typeof record.digest !== "string" || !/^[a-f0-9]{64}$/.test(record.digest) || !Number.isSafeInteger(record.actionCount) || Number(record.actionCount) < 0) {
+    const record2 = raw;
+    if (record2.algorithm !== "sha256-v1" || typeof record2.digest !== "string" || !/^[a-f0-9]{64}$/.test(record2.digest) || !Number.isSafeInteger(record2.actionCount) || Number(record2.actionCount) < 0) {
       throw new TopoloSdkError("action_catalog_summary_unavailable", "Action catalog summary is invalid.");
     }
     return {
       algorithm: "sha256-v1",
-      digest: record.digest,
-      actionCount: Number(record.actionCount)
+      digest: record2.digest,
+      actionCount: Number(record2.actionCount)
     };
   }
   /** @deprecated Prefer searchActions() so callers retain the continuation cursor. */
@@ -2889,22 +2889,22 @@ var TopoloClient = class _TopoloClient {
     if (!match) throw new TopoloSdkError("unknown_action", `Unknown or unavailable Topolo action "${action}".`);
     return match;
   }
-  async callAction(action, input2 = {}, options = {}) {
+  async callAction(action, input3 = {}, options = {}) {
     const entry = await this.getAction(action);
-    return this.executeResolvedAction(entry, input2, options);
+    return this.executeResolvedAction(entry, input3, options);
   }
-  async validateActionInput(action, input2 = {}) {
+  async validateActionInput(action, input3 = {}) {
     const entry = await this.getAction(action);
-    return { action: entry, validation: validateTopoloActionInput(entry.inputSchema, input2) };
+    return { action: entry, validation: validateTopoloActionInput(entry.inputSchema, input3) };
   }
-  async planAction(action, input2 = {}, options = {}) {
+  async planAction(action, input3 = {}, options = {}) {
     const entry = await this.getAction(action);
-    const validation = validateTopoloActionInput(entry.inputSchema, input2);
+    const validation = validateTopoloActionInput(entry.inputSchema, input3);
     const agentAccess = entry.agentAccess ?? (entry.destructive ? "off" : entry.readOnly && !entry.requiresConfirmation ? "auto" : "confirm");
     const confirmationRequired = agentAccess === "confirm" || entry.requiresConfirmation || entry.destructive;
     let request = null;
     if (validation.valid) {
-      const mapped = mapActionInput(entry, input2);
+      const mapped = mapActionInput(entry, input3);
       request = {
         method: entry.method,
         service: entry.appSlug || entry.appId,
@@ -2927,7 +2927,7 @@ var TopoloClient = class _TopoloClient {
       nextActionIds: stringArray(entry.agentContract?.nextActionIds)
     };
   }
-  async readAction(action, input2 = {}, options = {}) {
+  async readAction(action, input3 = {}, options = {}) {
     const entry = await this.getAction(action);
     const agentAccess = entry.agentAccess ?? (entry.destructive ? "off" : entry.readOnly && !entry.requiresConfirmation ? "auto" : "confirm");
     if (!entry.readOnly || entry.destructive || entry.requiresConfirmation || agentAccess !== "auto") {
@@ -2936,9 +2936,9 @@ var TopoloClient = class _TopoloClient {
         entry.requiredPermission ? [entry.requiredPermission] : []
       );
     }
-    return this.executeResolvedAction(entry, input2, options);
+    return this.executeResolvedAction(entry, input3, options);
   }
-  async executeResolvedAction(entry, input2, options) {
+  async executeResolvedAction(entry, input3, options) {
     const agentAccess = entry.agentAccess ?? (entry.destructive ? "off" : entry.readOnly && !entry.requiresConfirmation ? "auto" : "confirm");
     if (agentAccess === "off") {
       throw new TopoloPermissionError(
@@ -2951,14 +2951,14 @@ var TopoloClient = class _TopoloClient {
         `Topolo action "${entry.actionId}" requires { confirm: true } before invocation.`
       );
     }
-    const validation = validateTopoloActionInput(entry.inputSchema, input2);
+    const validation = validateTopoloActionInput(entry.inputSchema, input3);
     if (!validation.valid) {
       throw new TopoloSdkError(
         "invalid_action_input",
         `Topolo action "${entry.actionId}" input is invalid: ${validation.errors.map((issue) => `${issue.path} ${issue.message}`).join("; ")}`
       );
     }
-    const mapped = mapActionInput(entry, input2);
+    const mapped = mapActionInput(entry, input3);
     const service = entry.appSlug || entry.appId;
     return this.request({
       service,
@@ -3050,15 +3050,15 @@ function resolveConfiguredAppId(slug, appIds) {
   }
   return null;
 }
-function normalizeApiKeyResourceMetadata(input2) {
-  if (!isRecord2(input2)) return null;
-  const resourceType = readString(input2.resourceType ?? input2.resource_type);
-  const label = readString(input2.label);
-  const emptyLabel = readString(input2.emptyLabel ?? input2.empty_label);
-  const resourceConcept = readString(input2.resourceConcept ?? input2.resource_concept);
-  const canonicalResourceType = readString(input2.canonicalResourceType ?? input2.canonical_resource_type);
-  const defaultEntitlement = readString(input2.defaultEntitlement ?? input2.default_entitlement);
-  const exceptionPolicy = readString(input2.exceptionPolicy ?? input2.exception_policy);
+function normalizeApiKeyResourceMetadata(input3) {
+  if (!isRecord2(input3)) return null;
+  const resourceType = readString(input3.resourceType ?? input3.resource_type);
+  const label = readString(input3.label);
+  const emptyLabel = readString(input3.emptyLabel ?? input3.empty_label);
+  const resourceConcept = readString(input3.resourceConcept ?? input3.resource_concept);
+  const canonicalResourceType = readString(input3.canonicalResourceType ?? input3.canonical_resource_type);
+  const defaultEntitlement = readString(input3.defaultEntitlement ?? input3.default_entitlement);
+  const exceptionPolicy = readString(input3.exceptionPolicy ?? input3.exception_policy);
   if (!resourceType || !label || !emptyLabel || resourceConcept !== "workspace" || canonicalResourceType !== "workspace" || defaultEntitlement !== "enterprise" || exceptionPolicy !== "app_or_organization") {
     return null;
   }
@@ -3072,11 +3072,11 @@ function normalizeApiKeyResourceMetadata(input2) {
     exceptionPolicy
   };
 }
-function normalizeApiKeyResourceMetadataList(input2) {
-  if (!Array.isArray(input2)) return [];
+function normalizeApiKeyResourceMetadataList(input3) {
+  if (!Array.isArray(input3)) return [];
   const resources = [];
   const seenTypes = /* @__PURE__ */ new Set();
-  for (const item of input2) {
+  for (const item of input3) {
     const resource = normalizeApiKeyResourceMetadata(item);
     if (!resource || seenTypes.has(resource.resourceType)) continue;
     seenTypes.add(resource.resourceType);
@@ -3084,24 +3084,24 @@ function normalizeApiKeyResourceMetadataList(input2) {
   }
   return resources;
 }
-function normalizeBindableResource(input2) {
-  if (!isRecord2(input2)) return null;
-  const resourceType = readString(input2.resourceType ?? input2.resource_type);
-  const resourceId = readString(input2.resourceId ?? input2.resource_id);
+function normalizeBindableResource(input3) {
+  if (!isRecord2(input3)) return null;
+  const resourceType = readString(input3.resourceType ?? input3.resource_type);
+  const resourceId = readString(input3.resourceId ?? input3.resource_id);
   if (!resourceType || !resourceId) return null;
   return {
     resourceType,
     resourceId,
-    label: readOptionalString(input2.label),
-    slug: readOptionalString(input2.slug),
-    status: readOptionalString(input2.status),
-    organizationId: readOptionalString(input2.organizationId ?? input2.organization_id),
-    metadata: isRecord2(input2.metadata) ? input2.metadata : {}
+    label: readOptionalString(input3.label),
+    slug: readOptionalString(input3.slug),
+    status: readOptionalString(input3.status),
+    organizationId: readOptionalString(input3.organizationId ?? input3.organization_id),
+    metadata: isRecord2(input3.metadata) ? input3.metadata : {}
   };
 }
-function normalizeResourceBindings(input2) {
-  if (!Array.isArray(input2)) return [];
-  return input2.flatMap((binding) => {
+function normalizeResourceBindings(input3) {
+  if (!Array.isArray(input3)) return [];
+  return input3.flatMap((binding) => {
     if (!isRecord2(binding)) return [];
     const resourceType = readString(binding.resourceType ?? binding.resource_type);
     const resourceId = readString(binding.resourceId ?? binding.resource_id);
@@ -3227,8 +3227,8 @@ function normalizeActionCatalogEntry(item) {
   const name = pickActionString(a.name);
   const appId = pickActionString(a.app_id) ?? pickActionString(a.appId);
   const method = pickActionString(a.method)?.toUpperCase();
-  const path4 = pickActionString(a.path);
-  if (!actionId || !name || !appId || !method || !path4 || !isHttpMethod(method)) {
+  const path5 = pickActionString(a.path);
+  if (!actionId || !name || !appId || !method || !path5 || !isHttpMethod(method)) {
     return null;
   }
   return {
@@ -3243,7 +3243,7 @@ function normalizeActionCatalogEntry(item) {
     appSlug: pickActionString(a.app_slug) ?? pickActionString(a.appSlug) ?? null,
     appName: pickActionString(a.app_name) ?? pickActionString(a.appName) ?? null,
     method,
-    path: path4,
+    path: path5,
     permissionName: pickActionString(a.permission_name) ?? pickActionString(a.permissionName) ?? "",
     requiredPermission: pickActionString(a.required_permission) ?? pickActionString(a.requiredPermission) ?? "",
     authorizationMode: pickAuthorizationMode(a.authorization_mode ?? a.authorizationMode),
@@ -3277,9 +3277,9 @@ function plainObject(value) {
 function stringArray(value) {
   return Array.isArray(value) ? value.map((item) => String(item || "").trim()).filter(Boolean) : [];
 }
-function mapActionInput(action, input2) {
-  const remaining = { ...input2 || {} };
-  const path4 = action.path.replace(/\{([a-zA-Z0-9_]+)\}/g, (_match, key) => {
+function mapActionInput(action, input3) {
+  const remaining = { ...input3 || {} };
+  const path5 = action.path.replace(/\{([a-zA-Z0-9_]+)\}/g, (_match, key) => {
     const value = remaining[key];
     if (value === void 0 || value === null || value === "") {
       throw new TopoloSdkError(
@@ -3296,14 +3296,14 @@ function mapActionInput(action, input2) {
   delete remaining.body;
   if (action.method === "GET") {
     return {
-      path: path4,
+      path: path5,
       query: objectToQuery({ ...remaining, ...explicitQuery })
     };
   }
   const query = objectToQuery(explicitQuery);
   const body = explicitBody !== void 0 ? explicitBody : remaining;
   return {
-    path: path4,
+    path: path5,
     ...query ? { query } : {},
     body
   };
@@ -3473,8 +3473,8 @@ var TopoloOAuth = class {
     if (params.clientSecret) body.set("client_secret", params.clientSecret);
     return this.#postForm("/api/developer-oauth/token", body);
   }
-  async #postForm(path4, body) {
-    const url = new URL(path4, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
+  async #postForm(path5, body) {
+    const url = new URL(path5, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
     const res = await this.fetchImpl(url.toString(), {
       method: "POST",
       headers: {
@@ -3490,7 +3490,7 @@ var TopoloOAuth = class {
         const err = parsed;
         throw new TopoloAuthError(err.error_description || err.error, err.error);
       }
-      throw new TopoloHttpError("auth", path4, res.status, parsed);
+      throw new TopoloHttpError("auth", path5, res.status, parsed);
     }
     return parsed;
   }
@@ -3504,7 +3504,7 @@ function createTopolo(options) {
   };
 }
 
-// node_modules/@topolo/sdk/dist/node/credential-store.js
+// ../topolo-sdk/dist/node/credential-store.js
 import { mkdir, readFile, writeFile, chmod } from "fs/promises";
 import { existsSync } from "fs";
 import { homedir, platform } from "os";
@@ -3528,13 +3528,13 @@ var TopoloHttpError2 = class extends TopoloSdkError2 {
   body;
   service;
   path;
-  constructor(service, path4, status, body, message) {
-    super("http_error", message ?? `HTTP ${status} from ${service}${path4}`);
+  constructor(service, path5, status, body, message) {
+    super("http_error", message ?? `HTTP ${status} from ${service}${path5}`);
     this.name = "TopoloHttpError";
     this.status = status;
     this.body = body;
     this.service = service;
-    this.path = path4;
+    this.path = path5;
   }
 };
 var APP_API_URLS2 = {
@@ -3665,8 +3665,8 @@ var TopoloOAuth2 = class {
     if (params.clientSecret) body.set("client_secret", params.clientSecret);
     return this.#postForm("/api/developer-oauth/token", body);
   }
-  async #postForm(path4, body) {
-    const url = new URL(path4, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
+  async #postForm(path5, body) {
+    const url = new URL(path5, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
     const res = await this.fetchImpl(url.toString(), {
       method: "POST",
       headers: {
@@ -3682,7 +3682,7 @@ var TopoloOAuth2 = class {
         const err = parsed;
         throw new TopoloAuthError2(err.error_description || err.error, err.error);
       }
-      throw new TopoloHttpError2("auth", path4, res.status, parsed);
+      throw new TopoloHttpError2("auth", path5, res.status, parsed);
     }
     return parsed;
   }
@@ -3712,22 +3712,22 @@ function configPath() {
   return join(base, "topolo", "config.json");
 }
 async function readConfig() {
-  const path4 = configPath();
-  if (!existsSync(path4)) return {};
+  const path5 = configPath();
+  if (!existsSync(path5)) return {};
   try {
-    const raw = await readFile(path4, "utf8");
+    const raw = await readFile(path5, "utf8");
     return JSON.parse(raw);
   } catch {
     return {};
   }
 }
 async function writeConfig(config) {
-  const path4 = configPath();
-  await mkdir(dirname(path4), { recursive: true });
-  await writeFile(path4, JSON.stringify(config, null, 2) + "\n", "utf8");
+  const path5 = configPath();
+  await mkdir(dirname(path5), { recursive: true });
+  await writeFile(path5, JSON.stringify(config, null, 2) + "\n", "utf8");
   if (platform() !== "win32") {
     try {
-      await chmod(path4, 384);
+      await chmod(path5, 384);
     } catch {
     }
   }
@@ -4023,13 +4023,14 @@ function normalizeError(err) {
     const hintMap = {
       auth_error: "Run `topolo auth login` or set TOPOLO_API_KEY.",
       confirmation_required: "Review the action and rerun with --confirm to allow it.",
-      permission_denied: "Check your API key scopes or role assignments in TopoloDevelopers."
+      permission_denied: "Check your API key scopes or role assignments in TopoloDevelopers.",
+      immutable_drift: "Restore the manifest identity fields to the registered values; immutable ids cannot be updated."
     };
     return {
       message: err.message,
       code,
       hint: code ? hintMap[code] : void 0,
-      exitCode: code === "auth_error" || code === "confirmation_required" ? 2 : code === "permission_denied" ? 3 : 1
+      exitCode: code === "auth_error" || code === "confirmation_required" ? 2 : code === "permission_denied" ? 3 : code === "immutable_drift" ? 4 : 1
     };
   }
   return { message: String(err), exitCode: 1 };
@@ -4046,9 +4047,9 @@ function readCliVersion() {
       join2(here, "package.json"),
       join2(here, "..", "package.json")
     ];
-    for (const path4 of candidates) {
+    for (const path5 of candidates) {
       try {
-        const pkg = JSON.parse(readFileSync(path4, "utf8"));
+        const pkg = JSON.parse(readFileSync(path5, "utf8"));
         if (typeof pkg.version === "string" && pkg.version) return pkg.version;
       } catch {
       }
@@ -4407,7 +4408,7 @@ function registerApiCommand(program2) {
     "-q, --query <kv...>",
     "Query params as key=value (repeatable), e.g. --query source=cli page=2"
   ).option("--resource-type <type>", "Cataloged app-local workspace resource alias for resource-scoped API keys").option("--resource-id <id>", "Workspace resource id for resource-scoped API keys").option("--confirm", "Acknowledge a mutating request").option("--json", "Output JSON", true).option("--no-json", "Output human-readable text").action(
-    async (service, method, path4, opts) => {
+    async (service, method, path5, opts) => {
       const mode = resolveOutputMode(opts.json);
       try {
         const upperMethod = method.toUpperCase();
@@ -4446,7 +4447,7 @@ function registerApiCommand(program2) {
         const result = await topolo.client.request({
           service,
           method: httpMethod,
-          path: path4,
+          path: path5,
           body,
           ...query ? { query } : {},
           ...resource ? { resource } : {},
@@ -4539,9 +4540,9 @@ function registerActionsCommand(program2) {
       if (!topolo) {
         throw new Error("No credential configured. Run `topolo auth login` or set TOPOLO_API_KEY.");
       }
-      const input2 = parseJsonObject(opts.data || "{}");
+      const input3 = parseJsonObject(opts.data || "{}");
       const resource = parseResourceOption(opts.resourceType, opts.resourceId);
-      const result = await topolo.client.callAction(action, input2, {
+      const result = await topolo.client.callAction(action, input3, {
         confirm: opts.confirm === true,
         ...resource ? { resource } : {}
       });
@@ -4610,13 +4611,13 @@ async function requiredClient() {
 function parseJsonObject(value) {
   let source = value;
   if (value.startsWith("@")) {
-    const path4 = value.slice(1);
-    if (!path4) throw new Error("--data @file path must not be empty");
+    const path5 = value.slice(1);
+    if (!path5) throw new Error("--data @file path must not be empty");
     try {
-      source = readFileSync2(path4, "utf8");
+      source = readFileSync2(path5, "utf8");
     } catch (err) {
       const detail = err instanceof Error ? err.message : String(err);
-      throw new Error(`Could not read --data file ${path4}: ${detail}`);
+      throw new Error(`Could not read --data file ${path5}: ${detail}`);
     }
   }
   let parsed;
@@ -4691,7 +4692,7 @@ function formatActionPlan(plan) {
 // src/commands/apps.ts
 import { execSync } from "child_process";
 import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync4, writeFileSync } from "fs";
-import path2 from "path";
+import path3 from "path";
 
 // src/commands/app-audit-local.ts
 import {
@@ -5282,8 +5283,8 @@ function enrichFinding(application, finding2, evidence) {
           evidence: verificationEvidence
         });
       }
-      const usesNodeCheck = evidence.packageJsons.some((record) => {
-        const scripts = record.packageJson.scripts ?? {};
+      const usesNodeCheck = evidence.packageJsons.some((record2) => {
+        const scripts = record2.packageJson.scripts ?? {};
         return Object.values(scripts).some((cmd) => typeof cmd === "string" && /node\s+--check/.test(cmd));
       });
       if (hasBuild && usesNodeCheck) {
@@ -5549,35 +5550,35 @@ function verificationEvidenceFor(evidence) {
     "test:auth-contract": "test",
     validate: "validate"
   };
-  for (const record of evidence.packageJsons) {
-    const scripts = record.packageJson.scripts ?? {};
-    const isRootPackage = record.path === evidence.packageJsonPath;
+  for (const record2 of evidence.packageJsons) {
+    const scripts = record2.packageJson.scripts ?? {};
+    const isRootPackage = record2.path === evidence.packageJsonPath;
     const seenCanonical = /* @__PURE__ */ new Set();
     for (const [scriptName, canonical] of Object.entries(scriptAliases)) {
       if (!scripts[scriptName]) continue;
       if (seenCanonical.has(canonical)) continue;
       seenCanonical.add(canonical);
-      items.push(isRootPackage ? `script=${canonical}` : `script=${packageLabel(record)}:${canonical}`);
+      items.push(isRootPackage ? `script=${canonical}` : `script=${packageLabel(record2)}:${canonical}`);
     }
   }
   return unique(items);
 }
 function dependencyNames(evidence) {
   return new Set(
-    evidence.packageJsons.flatMap((record) => [
-      ...Object.keys(record.packageJson.dependencies ?? {}),
-      ...Object.keys(record.packageJson.devDependencies ?? {}),
-      ...Object.keys(record.packageJson.peerDependencies ?? {})
+    evidence.packageJsons.flatMap((record2) => [
+      ...Object.keys(record2.packageJson.dependencies ?? {}),
+      ...Object.keys(record2.packageJson.devDependencies ?? {}),
+      ...Object.keys(record2.packageJson.peerDependencies ?? {})
     ])
   );
 }
 function packageDependencyVersions(evidence, packageName) {
   return unique(
-    evidence.packageJsons.flatMap((record) => {
+    evidence.packageJsons.flatMap((record2) => {
       const specs = [
-        record.packageJson.dependencies?.[packageName],
-        record.packageJson.devDependencies?.[packageName],
-        record.packageJson.peerDependencies?.[packageName]
+        record2.packageJson.dependencies?.[packageName],
+        record2.packageJson.devDependencies?.[packageName],
+        record2.packageJson.peerDependencies?.[packageName]
       ];
       return specs.filter((spec) => typeof spec === "string");
     })
@@ -5703,8 +5704,8 @@ function collectPackageJsons(root) {
 function readPackageJson(filePath) {
   return readJson(filePath);
 }
-function packageLabel(record) {
-  return record.packageJson.name ?? relativeTopoloPath(path.dirname(record.path));
+function packageLabel(record2) {
+  return record2.packageJson.name ?? relativeTopoloPath(path.dirname(record2.path));
 }
 function sortedDirEntries(dir) {
   return readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
@@ -5793,14 +5794,14 @@ import { constants } from "fs";
 import { access } from "fs/promises";
 import { relative, resolve } from "path";
 function normalizeHomePath(value) {
-  const path4 = String(value || "/dashboard").trim();
-  if (!path4.startsWith("/") || path4.startsWith("//") || /[?#]/.test(path4)) {
+  const path5 = String(value || "/dashboard").trim();
+  if (!path5.startsWith("/") || path5.startsWith("//") || /[?#]/.test(path5)) {
     throw new Error("Invalid home path. Use an absolute application path such as /dashboard.");
   }
-  if (["/", "/login", "/auth/callback", "/getting-started"].includes(path4)) {
+  if (["/", "/login", "/auth/callback", "/getting-started"].includes(path5)) {
     throw new Error("Home path must be a protected product route, not a reserved entry route.");
   }
-  return path4.replace(/\/$/, "") || "/dashboard";
+  return path5.replace(/\/$/, "") || "/dashboard";
 }
 function normalizeHomeLabel(value) {
   const label = String(value || "Dashboard").trim();
@@ -5819,6 +5820,13 @@ function normalizeWorkspaceSwitcherMode(value) {
   if (mode === "required" || mode === "optional" || mode === "off") return mode;
   throw new Error("Invalid workspace switcher mode. Use required, optional, or off.");
 }
+function normalizeUiTemplate(value) {
+  const template = String(value || "operations").trim();
+  if (template === "operations" || template === "index" || template === "workbench" || template === "minimal") {
+    return template;
+  }
+  throw new Error("Invalid UI template. Use operations, index, workbench, or minimal.");
+}
 function normalizeFirstPartyAppDir(value) {
   const requested = String(value).trim().replace(/\\/g, "/").replace(/^\.\//, "");
   const appDir = requested.startsWith("apps/") ? requested.slice("apps/".length) : requested;
@@ -5927,14 +5935,16 @@ function toPascalCase(value) {
   return value.split(/[-_]/).filter(Boolean).map((part) => acronyms.has(part.toLowerCase()) ? part.toUpperCase() : part.slice(0, 1).toUpperCase() + part.slice(1)).join("");
 }
 function toTitle(value) {
-  return value.replace(/^topolo[-_\s]*/i, "Topolo ").split(/[-_\s]+/).filter(Boolean).map((part) => part.slice(0, 1).toUpperCase() + part.slice(1)).join(" ");
+  const withoutVendorPrefix = value.replace(/^topolo[-_\s]+/i, "");
+  const source = withoutVendorPrefix.trim() ? withoutVendorPrefix : value;
+  return source.split(/[-_\s]+/).filter(Boolean).map((part) => part.slice(0, 1).toUpperCase() + part.slice(1)).join(" ");
 }
 function json(value) {
   return JSON.stringify(value, null, 2);
 }
-async function pathExists(path4) {
+async function pathExists(path5) {
   try {
-    await access(path4, constants.F_OK);
+    await access(path5, constants.F_OK);
     return true;
   } catch {
     return false;
@@ -6033,6 +6043,9 @@ function packageJson(application, target, options) {
     devDependencies["@types/react-dom"] = "^19.2.2";
     devDependencies["@vitejs/plugin-react"] = "^4.7.0";
     if (target === "platform") {
+      devDependencies.autoprefixer = "10.5.0";
+      devDependencies.postcss = "8.5.6";
+      devDependencies.tailwindcss = "3.4.19";
       for (const packageName of PLATFORM_BROWSER_TOPOLO_PACKAGES) {
         dependencies[packageName] = topoloPackageVersion(packageName, target);
       }
@@ -6196,13 +6209,16 @@ function readme(application, target, options) {
       "- `@topolo-io/app-funnel` provides the generated public application funnel/landing surface.",
       "- `@topolo-io/app-shell` provides the generated route/auth bootstrap, product shell, login, callback, and loading surfaces.",
       "- `@topolo-io/app-launcher` provides shared app switching and handoff helpers.",
-      "- `@topolo-io/ui-kit` provides primitive account, command palette, icon, transition, and bug reporter UI.",
+      "- `@topolo-io/ui-kit` provides every control, table, panel, workbench, inspector, icon, transition, and bug reporter primitive used by the generated product surface.",
       "- `@topolo-io/auth-client` owns browser auth, callback exchange, token refresh, and logout.",
       "- `@topolo-io/api-key-management`, `@topolo-io/chat-widget`, `@topolo-io/notifications`, and `@topolo-io/resource-context` complete the AppShell capability baseline.",
       "- Every Topolo-owned browser dependency is emitted at `latest`; product-domain packages are added only when the app actually adopts that domain.",
       "- `.npmrc` routes private `@topolo-io` packages to GitHub Packages without storing credentials; public `@topolo` packages remain on npm. Local and CI environments must provide a GitHub Packages token.",
       "- Generated first-party browser apps start on the shared landing page at `/`, use the shared login page at `/login`, and complete sign-in on `/auth/callback` before entering the configured authenticated home.",
       "- The workspace selector renders in the top utility bar; Getting Started is an account-menu action and is not part of the left product rail.",
+      "- The default `operations` UI template separates dashboard, CRUD index, detail workbench, and inspector concerns. Use `--ui-template index`, `--ui-template workbench`, or `--ui-template minimal` only when that product shape is intentional.",
+      "- Every visible product navigation item includes a canonical icon so the shared sidebar remains usable when collapsed.",
+      "- `styles.css` contains only Tailwind directives; app-local controls, semantic tables, or replacement design-system CSS fail the generated UI contract test.",
       "- `vite.config.ts` includes the standard React plugin plus React runtime dedupe so linked Topolo packages resolve one browser React runtime."
     );
     if (options.api) {
@@ -6299,6 +6315,8 @@ function agentRules(application, target, options) {
     "- Start from `staging`, preserve other agents' work, and do not revert unrelated local changes.",
     "- Make contained changes at the real ownership boundary; do not patch around shared runtime, auth, launcher, shell, or resource-context issues locally.",
     "- Browser code should stay on the shared landing/login/callback/AppShell baseline generated by the scaffold.",
+    "- Keep every visible product navigation item on a canonical `@topolo-io/ui-kit/icons` icon so collapsed navigation remains complete.",
+    "- Use shared UI-kit controls, tables, panels, workbenches, and inspectors; the generated UI contract intentionally rejects app-local native controls and tables.",
     ...options.api ? ["- API code should stay on `@topolo-io/worker-runtime`, derive auth context from verified credentials, and preserve Nexus usage monitoring."] : [],
     ...hasScaffoldResources(options.resources) ? ["- Keep Cloudflare resource bindings in Wrangler, CloudControl, Env typing, docs, and README verification output in sync."] : [],
     "",
@@ -6649,7 +6667,36 @@ function mainTsx() {
     ""
   ].join("\n");
 }
-function stylesCss() {
+function tailwindConfigCjs() {
+  return [
+    "const { createTopoloTailwindConfig } = require('@topolo-io/design-tokens/tailwind.config.cjs');",
+    "",
+    "module.exports = createTopoloTailwindConfig({",
+    "  content: [",
+    "    './apps/web/index.html',",
+    "    './apps/web/src/**/*.{js,jsx,ts,tsx}',",
+    "  ],",
+    "});",
+    ""
+  ].join("\n");
+}
+function postcssConfigCjs() {
+  return [
+    "const path = require('node:path');",
+    "",
+    "module.exports = {",
+    "  plugins: {",
+    "    tailwindcss: { config: path.join(__dirname, 'tailwind.config.cjs') },",
+    "    autoprefixer: {},",
+    "  },",
+    "};",
+    ""
+  ].join("\n");
+}
+function stylesCss(target) {
+  if (target === "platform") {
+    return ["@tailwind base;", "@tailwind components;", "@tailwind utilities;", ""].join("\n");
+  }
   return [
     "/* Local app styles. Design tokens come from @topolo-io/design-tokens (imported in main.tsx). */",
     "/* Use hsl(var(--token)) for colors so light/dark themes flip from the shared shell. */",
@@ -6855,20 +6902,41 @@ export const APP_DISPLAY_NAME = '${escapeSingleQuoted(appName)}';
 `;
 }
 function platformAppRoutesTsx(experience) {
-  const nav = experience.navigationMode === "none" ? "" : "      nav: { id: 'home', label: HOME_LABEL },\n";
+  const nav = experience.navigationMode === "none" ? "" : "      nav: { id: 'home', label: HOME_LABEL, icon: LayoutDashboard },\n";
+  const recordsNav = experience.navigationMode === "none" ? "" : "      nav: { id: 'records', label: 'Records', icon: ListTree },\n";
+  const starterImports = experience.uiTemplate === "minimal" ? "" : "import RecordDetailRoute from './routes/RecordDetailRoute';\nimport RecordsRoute from './routes/RecordsRoute';\n";
+  const homeElement = experience.uiTemplate === "index" ? "<RecordsRoute />" : experience.uiTemplate === "workbench" ? "<RecordDetailRoute />" : "<HomeRoute />";
+  const starterRoutes = experience.uiTemplate === "minimal" ? "" : experience.uiTemplate === "operations" ? `    {
+      path: '/records',
+${recordsNav}      loading: { shell: NAVIGATION_MODE, content: 'table', title: 'Records' },
+      element: <RecordsRoute />,
+    },
+    {
+      path: '/records/:recordId/:section',
+      loading: { shell: NAVIGATION_MODE, content: 'split', title: 'Record' },
+      element: <RecordDetailRoute />,
+    },
+` : `    {
+      path: '/records/:recordId/:section',
+      loading: { shell: NAVIGATION_MODE, content: 'split', title: 'Record' },
+      element: <RecordDetailRoute />,
+    },
+`;
   return `import type { AppRoute } from '@topolo-io/app-shell';
+import { LayoutDashboard, ListTree } from '@topolo-io/ui-kit/icons';
 import { HOME_LABEL, HOME_PATH, NAVIGATION_MODE } from './app-config';
 import GettingStartedRoute from './routes/GettingStartedRoute';
 import HomeRoute from './routes/HomeRoute';
+${starterImports}
 
 export function createAppRoutes(appId: string): AppRoute[] {
   return [
     {
       path: HOME_PATH,
 ${nav}      loading: { shell: NAVIGATION_MODE, content: 'workspace', title: HOME_LABEL },
-      element: <HomeRoute />,
+      element: ${homeElement},
     },
-    {
+${starterRoutes}    {
       path: '/getting-started',
       loading: { shell: NAVIGATION_MODE, content: 'card-grid', title: 'Getting started' },
       element: <GettingStartedRoute appId={appId} />,
@@ -6877,7 +6945,8 @@ ${nav}      loading: { shell: NAVIGATION_MODE, content: 'workspace', title: HOME
 }
 `;
 }
-function platformHomeRouteTsx() {
+function platformHomeRouteTsx(uiTemplate) {
+  if (uiTemplate === "operations") return platformOperationsHomeRouteTsx();
   return `import { TopoloAppPage, TopoloAppPageHeader, useAuth } from '@topolo-io/app-shell';
 import { IntroTour } from '@topolo-io/tour';
 import { useTranslation } from '@topolo-io/ui-kit';
@@ -6913,6 +6982,148 @@ export default function HomeRoute() {
 }
 `;
 }
+function platformOperationsHomeRouteTsx() {
+  return `import { TopoloAppPage, TopoloAppPageHeader, useAuth } from '@topolo-io/app-shell';
+import { Button, ListRow, TopoloMetricStrip, TopoloOperationalPanel } from '@topolo-io/ui-kit';
+import { IntroTour } from '@topolo-io/tour';
+import { useNavigate } from 'react-router-dom';
+import { APP_NAME, HOME_LABEL, HOME_PATH, PRODUCT_TAGLINE } from '../app-config';
+import { STARTER_RECORDS } from './starter-records';
+
+// STARTER TEMPLATE: replace the sample metrics and activity with product data.
+export default function HomeRoute() {
+  const { user } = useAuth();
+  const navigate = useNavigate();
+  const active = STARTER_RECORDS.filter((record) => record.status === 'active').length;
+  return (
+    <TopoloAppPage width="none" data-tour="home-page">
+      <TopoloAppPageHeader eyebrow={APP_NAME} title={HOME_LABEL} description={PRODUCT_TAGLINE} actions={<Button onClick={() => navigate('/records')}>Open records</Button>} />
+      <TopoloMetricStrip metrics={[
+        { id: 'total', label: 'Total records', value: STARTER_RECORDS.length },
+        { id: 'active', label: 'Active', value: active, tone: 'success' },
+        { id: 'attention', label: 'Needs attention', value: STARTER_RECORDS.length - active, tone: 'warning' },
+      ]} />
+      <TopoloOperationalPanel title="Recent records" description="Keep operational summaries focused; detailed CRUD belongs in the index and workbench routes." action={<Button variant="secondary" onClick={() => navigate('/records')}>View index</Button>}>
+        <div className="grid gap-1">{STARTER_RECORDS.slice(0, 3).map((record) => <ListRow key={record.id} title={record.name} subtitle={record.owner} meta={record.updatedAt} onSelect={() => navigate(\`/records/\${record.id}/overview\`)} />)}</div>
+      </TopoloOperationalPanel>
+      <IntroTour appName={APP_NAME} role={user?.role} onOpenGettingStarted={() => navigate('/getting-started')} extraSteps={[{
+        id: 'home-page', target: '[data-tour="home-page"]', title: HOME_LABEL, content: PRODUCT_TAGLINE,
+        placement: 'bottom' as const, beforeStep: () => navigate(HOME_PATH),
+      }]} />
+    </TopoloAppPage>
+  );
+}
+`;
+}
+function platformStarterDataTs() {
+  return `// STARTER TEMPLATE: replace this file with the app's real API-backed domain model.
+export type StarterRecordStatus = 'active' | 'draft' | 'paused';
+
+export interface StarterRecord {
+  id: string;
+  name: string;
+  status: StarterRecordStatus;
+  owner: string;
+  summary: string;
+  updatedAt: string;
+}
+
+export const STARTER_RECORDS: StarterRecord[] = [
+  { id: 'starter-record-1', name: 'First starter record', status: 'active', owner: 'Product team', summary: 'Replace this sample with one app-specific concept.', updatedAt: 'Today' },
+  { id: 'starter-record-2', name: 'Second starter record', status: 'draft', owner: 'Operations', summary: 'Use the index for discovery and the workbench for focused editing.', updatedAt: 'Yesterday' },
+  { id: 'starter-record-3', name: 'Third starter record', status: 'paused', owner: 'Workspace admin', summary: 'Keep unrelated workflows on separate routes.', updatedAt: '3 days ago' },
+];
+`;
+}
+function platformRecordsRouteTsx() {
+  return `import { useMemo, useState, type FormEvent } from 'react';
+import { TopoloAppDataTable, TopoloAppEmptyState, TopoloAppFilterBar, TopoloAppPage, TopoloAppPageHeader, TopoloAppToolbar } from '@topolo-io/app-shell';
+import { Badge, Button, FormField, Input, SearchInput, Select, Table, TableBody, TableCell, TableHead, TableHeader, TableRow, TopoloRightPanel } from '@topolo-io/ui-kit';
+import { Plus } from '@topolo-io/ui-kit/icons';
+import { useNavigate } from 'react-router-dom';
+import { STARTER_RECORDS, type StarterRecord, type StarterRecordStatus } from './starter-records';
+
+// STARTER TEMPLATE: keep the index focused on discovery, filtering, and create entry.
+export default function RecordsRoute() {
+  const navigate = useNavigate();
+  const [records, setRecords] = useState<StarterRecord[]>(STARTER_RECORDS);
+  const [query, setQuery] = useState('');
+  const [status, setStatus] = useState('current');
+  const [createOpen, setCreateOpen] = useState(false);
+  const visible = useMemo(() => records.filter((record) => {
+    if (status !== 'current' && status !== 'all' && record.status !== status) return false;
+    return !query || record.name.toLowerCase().includes(query.toLowerCase());
+  }), [query, records, status]);
+
+  function createRecord(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    const data = new FormData(event.currentTarget);
+    const name = String(data.get('name') || '').trim();
+    if (!name) return;
+    const record: StarterRecord = {
+      id: \`starter-record-\${Date.now()}\`, name, status: 'draft', owner: String(data.get('owner') || 'Workspace team'),
+      summary: String(data.get('summary') || 'Replace this starter form with domain fields.'), updatedAt: 'Just now',
+    };
+    setRecords((current) => [record, ...current]);
+    setCreateOpen(false);
+  }
+
+  return (
+    <TopoloAppPage width="none">
+      <TopoloAppPageHeader eyebrow="Starter CRUD" title="Records" description="A canonical index route with shared controls, shared tables, and a separate creation panel." actions={<Button leftIcon={<Plus size={16} />} onClick={() => setCreateOpen(true)}>New record</Button>} />
+      <TopoloAppToolbar><TopoloAppFilterBar>
+        <SearchInput className="w-64" value={query} onChange={(event) => setQuery(event.target.value)} placeholder="Search records" aria-label="Search records" />
+        <Select className="w-44" value={status} onChange={(event) => setStatus(event.target.value)} aria-label="Record status"><option value="current">Current</option><option value="active">Active</option><option value="draft">Draft</option><option value="paused">Paused</option><option value="all">All</option></Select>
+      </TopoloAppFilterBar><span className="text-sm text-muted-foreground">{visible.length} result{visible.length === 1 ? '' : 's'}</span></TopoloAppToolbar>
+      {visible.length ? <TopoloAppDataTable aria-label="Records"><Table>
+        <TableHeader><TableRow><TableHead>Name</TableHead><TableHead>Status</TableHead><TableHead>Owner</TableHead><TableHead>Updated</TableHead></TableRow></TableHeader>
+        <TableBody>{visible.map((record) => <TableRow className="cursor-pointer" key={record.id} tabIndex={0} onClick={() => navigate(\`/records/\${record.id}/overview\`)} onKeyDown={(event) => { if (event.key === 'Enter') navigate(\`/records/\${record.id}/overview\`); }}>
+          <TableCell><span className="grid gap-0.5"><strong>{record.name}</strong><small className="text-xs text-muted-foreground">{record.id}</small></span></TableCell>
+          <TableCell><RecordStatus status={record.status} /></TableCell><TableCell>{record.owner}</TableCell><TableCell>{record.updatedAt}</TableCell>
+        </TableRow>)}</TableBody>
+      </Table></TopoloAppDataTable> : <TopoloAppEmptyState title="No records match" description="Adjust the filters or create a record." action={<Button onClick={() => setCreateOpen(true)}>Create record</Button>} />}
+      <TopoloRightPanel open={createOpen} onOpenChange={setCreateOpen} title="Create record" description="Replace these starter fields with the smallest valid domain create flow." footer={<Button type="submit" form="starter-create-record">Create record</Button>}>
+        <form id="starter-create-record" className="grid gap-5" onSubmit={createRecord}><FormField label="Name"><Input name="name" required autoFocus /></FormField><FormField label="Owner"><Input name="owner" placeholder="Workspace team" /></FormField><FormField label="Summary"><Input name="summary" placeholder="What this record represents" /></FormField></form>
+      </TopoloRightPanel>
+    </TopoloAppPage>
+  );
+}
+
+export function RecordStatus({ status }: { status: StarterRecordStatus }) {
+  const tone = status === 'active' ? 'success' : status === 'paused' ? 'warning' : 'info';
+  return <Badge tone={tone}>{status}</Badge>;
+}
+`;
+}
+function platformRecordDetailRouteTsx() {
+  return `import { TopoloAppEmptyState } from '@topolo-io/app-shell';
+import { Button, CopyField, Tabs, TabsList, TabsTrigger, TopoloCommandBar, TopoloInspectorPanel, TopoloKeyValueRow, TopoloOperationalPanel, TopoloWorkbench } from '@topolo-io/ui-kit';
+import { useNavigate, useParams } from 'react-router-dom';
+import { RecordStatus } from './RecordsRoute';
+import { STARTER_RECORDS } from './starter-records';
+
+const sections = ['overview', 'activity', 'settings'] as const;
+
+// STARTER TEMPLATE: one selected record, one focused workflow, one inspector. The product sidebar remains the only left rail.
+export default function RecordDetailRoute() {
+  const navigate = useNavigate();
+  const { recordId, section: rawSection } = useParams();
+  const record = STARTER_RECORDS.find((item) => item.id === recordId) ?? STARTER_RECORDS[0];
+  const section = sections.includes(rawSection as (typeof sections)[number]) ? rawSection! : 'overview';
+  if (!record) return <TopoloAppEmptyState title="Record not found" description="Return to the index and choose another record." action={<Button onClick={() => navigate('/records')}>Back to records</Button>} />;
+  return (
+    <div className="-m-6 min-w-0 max-md:-m-4"><TopoloWorkbench layout="split" className="min-h-[calc(100dvh-4rem)] gap-0 overflow-hidden bg-background">
+      <main className="min-w-0 overflow-y-auto p-6 max-md:p-4">
+        <TopoloCommandBar eyebrow="Starter record" title={record.name} description={record.summary} meta={<RecordStatus status={record.status} />} actions={<Button>Edit record</Button>} />
+        <Tabs className="my-5" value={section} onValueChange={(next) => navigate(\`/records/\${record.id}/\${next}\`)}><TabsList>{sections.map((item) => <TabsTrigger key={item} value={item}>{item}</TabsTrigger>)}</TabsList></Tabs>
+        <TopoloOperationalPanel title={section === 'overview' ? 'Record overview' : section === 'activity' ? 'Record activity' : 'Record settings'} description="Replace this panel with one focused domain workflow. Do not combine unrelated concepts on this route."><TopoloKeyValueRow label="Owner" value={record.owner} /><TopoloKeyValueRow label="Updated" value={record.updatedAt} /></TopoloOperationalPanel>
+      </main>
+      <TopoloInspectorPanel className="m-4 ml-0 max-lg:m-4" title="Record context" description="Keep selected-record metadata and secondary actions here." sticky><TopoloKeyValueRow label="Status" value={<RecordStatus status={record.status} />} /><TopoloKeyValueRow label="Owner" value={record.owner} /><CopyField label="Record ID" value={record.id} /></TopoloInspectorPanel>
+    </TopoloWorkbench></div>
+  );
+}
+`;
+}
 function platformGettingStartedRouteTsx() {
   return `import { TopoloAppPage, useAuth } from '@topolo-io/app-shell';
 import { GettingStarted, type OnboardingGuideStep } from '@topolo-io/onboarding';
@@ -7866,7 +8077,7 @@ function topoloConformanceWorkflow(options) {
     "      - name: Install generated application",
     `        if: steps.app-token.outputs.token != '' || env.HAS_TOPOLO_CI_REPO_TOKEN == 'true'`,
     `        working-directory: ${appPath}`,
-    "        run: pnpm install --frozen-lockfile",
+    "        run: pnpm install --no-frozen-lockfile",
     "",
     "      - name: Run generated application quality gates",
     `        if: steps.app-token.outputs.token != '' || env.HAS_TOPOLO_CI_REPO_TOKEN == 'true'`,
@@ -8019,6 +8230,37 @@ function topoloAppManifestJson(application, options) {
       }
     },
     targets,
+    registration: {
+      ownerType: options.payload.ownerType,
+      portfolio: options.payload.portfolio,
+      applicationId: application.id,
+      serviceSlug: application.serviceSlug,
+      displayName: toTitle(application.name),
+      description: options.payload.experience.tagline,
+      category: "topolo-platform",
+      audience: options.payload.audience,
+      tenancy: options.payload.tenancy,
+      surfaceModel: options.payload.surfaceModel,
+      containerAppId: options.payload.containerAppId,
+      distributionModel: options.payload.distributionModel,
+      version: "1.0.0",
+      pricing: { type: "free", monthlyPrice: null },
+      supportEmail: "support@topolo.io",
+      auth: {
+        callbackPath: "/auth/callback",
+        requestedScopes: options.api ? ["openid", "profile", "email", "organization:read", "entitlements:read", `${application.id}:read`] : ["openid", "profile", "email", "organization:read"]
+      },
+      capabilities: options.payload.capabilities,
+      marketplace: {
+        intent: options.payload.distributionModel === "marketplace" ? "submit_when_ready" : "not_requested",
+        status: "preview",
+        shortBlurb: options.payload.experience.tagline,
+        tagline: options.payload.experience.tagline,
+        description: options.payload.experience.tagline,
+        docsUrl: `https://docs.topolo.app/applications/${slug}`
+      }
+    },
+    notifications: { role: "consumer_only" },
     ...actions.length ? { actions } : {}
   })}
 `;
@@ -8703,7 +8945,7 @@ function developerManifest(application, options) {
     surface_model: options.surfaceModel,
     container_app_id: options.containerAppId,
     package_name: application.packageName,
-    app_id: options.api ? application.appId : null,
+    app_id: application.appId,
     capabilities: {
       selected: options.capabilities,
       supported_v1: [
@@ -8747,7 +8989,38 @@ function developerManifest(application, options) {
     },
     marketplace: {
       intent: options.distributionModel === "marketplace" ? "submit_when_ready" : "not_requested"
-    }
+    },
+    registration: {
+      ownerType: "third_party",
+      applicationId: application.id,
+      serviceSlug: application.serviceSlug,
+      displayName: toTitle(application.name),
+      description: `${toTitle(application.name)} application for Topolo.`,
+      category: "productivity",
+      audience: options.audience,
+      tenancy: options.tenancy,
+      surfaceModel: options.surfaceModel,
+      containerAppId: options.containerAppId,
+      distributionModel: options.distributionModel,
+      version: "1.0.0",
+      pricing: { type: "free", monthlyPrice: null },
+      supportEmail: "",
+      productionUrl: application.productionUrl,
+      auth: {
+        callbackPath,
+        requestedScopes
+      },
+      capabilities: options.capabilities,
+      marketplace: {
+        intent: options.distributionModel === "marketplace" ? "submit_when_ready" : "not_requested",
+        status: "preview",
+        shortBlurb: `${toTitle(application.name)} application for Topolo.`,
+        tagline: `${toTitle(application.name)} application for Topolo.`,
+        description: `${toTitle(application.name)} application for Topolo.`,
+        docsUrl: application.productionUrl || "https://developers.topolo.app"
+      }
+    },
+    notifications: { role: "consumer_only" }
   })}
 `;
 }
@@ -8804,7 +9077,8 @@ ${coverageThresholds}
 function platformBrowserContractTest(application, experience) {
   const required = experience.workspaceSwitcher === "required";
   const enabled = experience.workspaceSwitcher !== "off";
-  const navExpectation = experience.navigationMode === "none" ? "    expect(home.nav).toBeUndefined();" : `    expect(home.nav).toEqual({ id: 'home', label: '${escapeSingleQuoted(experience.homeLabel)}' });`;
+  const navExpectation = experience.navigationMode === "none" ? "    expect(home.nav).toBeUndefined();" : `    expect(home.nav).toMatchObject({ id: 'home', label: '${escapeSingleQuoted(experience.homeLabel)}' });
+    expect(home.nav?.icon).toBeDefined();`;
   return `import { describe, expect, it, vi } from 'vitest';
 
 vi.mock('../src/app-identity', () => ({
@@ -8825,12 +9099,52 @@ describe('generated application contract', () => {
   });
 
   it('keeps Getting Started out of product navigation', () => {
-    const [home, gettingStarted] = createAppRoutes('app_test');
+    const routes = createAppRoutes('app_test');
+    const home = routes.find((route) => route.path === '${escapeSingleQuoted(experience.homePath)}')!;
+    const gettingStarted = routes.find((route) => route.path === '/getting-started')!;
     expect(home.path).toBe('${escapeSingleQuoted(experience.homePath)}');
 ${navExpectation}
     expect(gettingStarted.path).toBe('/getting-started');
     expect(gettingStarted.nav).toBeUndefined();
   });
+
+  it('keeps every visible route reachable when a sidebar is collapsed', () => {
+    for (const route of createAppRoutes('app_test').filter((candidate) => candidate.nav)) {
+      expect(route.nav?.icon).toBeDefined();
+    }
+  });
+});
+`;
+}
+function platformUiKitContractTest() {
+  return `import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { describe, expect, it } from 'vitest';
+
+function sourceFiles(root: string): string[] {
+  return readdirSync(root).flatMap((entry) => {
+    const path = join(root, entry);
+    return statSync(path).isDirectory() ? sourceFiles(path) : path.endsWith('.tsx') ? [path] : [];
+  });
+}
+
+describe('generated shared UI contract', () => {
+  const sourceRoot = join(process.cwd(), 'src');
+  const source = sourceFiles(sourceRoot).map((path) => readFileSync(path, 'utf8')).join('\\n');
+
+  it('does not hand-roll controls or semantic tables in first-party routes', () => {
+    expect(source).not.toMatch(/<(button|input|select|textarea|table|thead|tbody|tr|th|td)(\\s|>)/);
+  });
+
+  it('keeps app-local CSS limited to the shared Tailwind pipeline', () => {
+    expect(readFileSync(join(sourceRoot, 'styles.css'), 'utf8').trim()).toBe('@tailwind base;\\n@tailwind components;\\n@tailwind utilities;');
+  });
+
+  it('scans app source and shared packages through the canonical token config', () => {
+    const config = readFileSync(join(process.cwd(), 'tailwind.config.cjs'), 'utf8');
+    expect(config).toContain('createTopoloTailwindConfig');
+    expect(config).toContain("./apps/web/src/**/*.{js,jsx,ts,tsx}");
+  });
 });
 `;
 }
@@ -8988,12 +9302,14 @@ function applicationScaffoldPayload(application, options = {}) {
     homeLabel: normalizeHomeLabel(options.homeLabel),
     navigationMode: normalizeNavigationMode(options.navigationMode),
     workspaceSwitcher: normalizeWorkspaceSwitcherMode(options.workspaceSwitcher),
+    uiTemplate: normalizeUiTemplate(options.uiTemplate),
     workspaceLabel: tenancy === "household" ? "Households" : "Workspaces",
     tagline: String(options.tagline || "").trim() || `Manage your work in ${toTitle(name)}.`
   };
-  const serviceSlug = api ? target === "platform" ? `topolo-${slug}` : id : null;
-  const defaultAppId = target === "platform" ? `app_topolo_${id}` : catalogApplication?.services[0] ?? id;
-  const appId = api ? options.appId ?? defaultAppId : null;
+  const serviceSlug = target === "platform" ? `topolo-${slug}` : id;
+  const catalogAppId = catalogApplication?.services.find((service) => service.startsWith("app_"));
+  const defaultAppId = target === "platform" ? `app_topolo_${id}` : catalogAppId ?? `app_${id.replace(/-/g, "_")}`;
+  const appId = options.appId ?? defaultAppId;
   const productionUrl = browser ? options.productionUrl ?? catalogApplication?.productionUrl ?? `https://${slug}.topolo.app` : null;
   const scopes = scaffoldScopes({ browser, api });
   const capabilities = scaffoldCapabilities({ browser, api, distributionModel });
@@ -9267,9 +9583,21 @@ function scaffoldFiles(options) {
         "does not fork the shared shell chrome",
         "keeps app-specific layout scoped under generated classes"
       ],
-      content: stylesCss()
+      content: stylesCss(target)
     }] : [],
     ...target === "platform" && options.browser ? [
+      {
+        path: `${browserBase}/tailwind.config.cjs`,
+        purpose: "Canonical shared-token Tailwind content configuration.",
+        requiredSignals: ["extends the shared Topolo token config", "scans app source correctly when Vite starts from the repository root"],
+        content: tailwindConfigCjs()
+      },
+      {
+        path: `${browserBase}/postcss.config.cjs`,
+        purpose: "PostCSS pipeline for shared Topolo utility classes.",
+        requiredSignals: ["loads the generated Tailwind config", "runs autoprefixer"],
+        content: postcssConfigCjs()
+      },
       {
         path: `${browserBase}/src/app-config.ts`,
         purpose: "Product route, navigation, context-switcher, and entry-surface configuration.",
@@ -9286,8 +9614,28 @@ function scaffoldFiles(options) {
         path: `${browserBase}/src/routes/HomeRoute.tsx`,
         purpose: "Focused authenticated home product surface.",
         requiredSignals: ["uses shared page primitives", "uses translation-safe product copy"],
-        content: platformHomeRouteTsx()
+        content: platformHomeRouteTsx(options.payload.experience.uiTemplate)
       },
+      ...options.payload.experience.uiTemplate === "minimal" ? [] : [
+        {
+          path: `${browserBase}/src/routes/starter-records.ts`,
+          purpose: "Clearly marked replaceable starter records for the generated UI template.",
+          requiredSignals: ["keeps sample data outside route components", "is explicitly marked for replacement"],
+          content: platformStarterDataTs()
+        },
+        {
+          path: `${browserBase}/src/routes/RecordsRoute.tsx`,
+          purpose: "Focused CRUD index template built exclusively from shared UI primitives.",
+          requiredSignals: ["uses shared table, search, select, button, and right-panel primitives", "keeps creation separate from the index"],
+          content: platformRecordsRouteTsx()
+        },
+        {
+          path: `${browserBase}/src/routes/RecordDetailRoute.tsx`,
+          purpose: "Focused record workbench template with collection rail and inspector.",
+          requiredSignals: ["uses the shared workbench and inspector primitives", "keeps detail sections URL-addressable"],
+          content: platformRecordDetailRouteTsx()
+        }
+      ],
       {
         path: `${browserBase}/src/routes/GettingStartedRoute.tsx`,
         purpose: "Focused role-aware onboarding route reached from the account menu.",
@@ -9339,7 +9687,8 @@ function scaffoldFiles(options) {
         content: topoloAppManifestJson(application, {
           api: options.api,
           resources: options.payload.resources,
-          profile: options.payload.profile
+          profile: options.payload.profile,
+          payload: options.payload
         })
       },
       ...options.api ? [
@@ -9570,6 +9919,12 @@ export default defineConfig({
             requiredSignals: ["proves API proxying", "proves non-API browser fallback"],
             content: platformWebWorkerTest(application, options.api)
           },
+          {
+            path: `${browserBase}/test/ui-kit-contract.test.ts`,
+            purpose: "Executable guard against hand-rolled first-party controls and broken shared styling.",
+            requiredSignals: ["rejects native controls and semantic tables in generated routes", "proves canonical Tailwind scanning and zero app-local design CSS"],
+            content: platformUiKitContractTest()
+          },
           {
             path: `${browserBase}/src/worker.ts`,
             purpose: "Browser Worker that serves assets and forwards API paths when an API target exists.",
@@ -9736,7 +10091,7 @@ async function provisionApplicationScaffold(payload) {
       `Could not resolve Developers app id from Auth slug ${DEVELOPERS_SERVICE_SLUG}.`
     );
   }
-  const endpoint = payload.target === "platform" ? "/api/developer-console/admin/first-party-app-scaffolds" : "/api/developer-console/apps/scaffold";
+  const endpoint = payload.target === "platform" ? "/api/developer-console/admin/apps/reconcile" : "/api/developer-console/apps/reconcile";
   const headers = new Headers({
     "Content-Type": "application/json",
     "X-App-ID": developersAppId,
@@ -9754,7 +10109,7 @@ async function provisionApplicationScaffold(payload) {
   const response = await fetch(`${developersOrigin}${endpoint}`, {
     method: "POST",
     headers,
-    body: JSON.stringify(buildProvisioningRequest(payload))
+    body: JSON.stringify(buildProvisioningRequest(payload, identity.user.email))
   });
   const envelope = await response.json().catch(() => null);
   if (!response.ok || !envelope?.success || !envelope.data) {
@@ -9763,8 +10118,10 @@ async function provisionApplicationScaffold(payload) {
     );
   }
   const app = pickRecord(envelope.data.app);
-  const service = pickRecord(envelope.data.service);
-  const authConfig = pickRecord(envelope.data.authConfig);
+  const projections = pickRecord(envelope.data.projections);
+  const authProjection = pickRecord(projections?.auth);
+  const service = pickRecord(authProjection?.service);
+  const authConfig = pickRecord(authProjection?.authConfig);
   if (!app) {
     throw new Error("Developers provisioning did not return an app record.");
   }
@@ -9801,9 +10158,9 @@ async function provisionApplicationScaffold(payload) {
     } : null
   };
 }
-function buildProvisioningRequest(payload) {
+function buildProvisioningRequest(payload, supportEmail) {
   return {
-    target: payload.target,
+    mode: "apply",
     ownerType: payload.ownerType,
     portfolio: payload.portfolio,
     audience: payload.audience,
@@ -9816,14 +10173,28 @@ function buildProvisioningRequest(payload) {
       "http://localhost:5173/auth/callback",
       payload.application.productionUrl ? `${payload.application.productionUrl.replace(/\/$/, "")}/auth/callback` : null
     ].filter(Boolean),
-    healthEndpoint: payload.application.productionUrl ? `${payload.application.productionUrl.replace(/\/$/, "")}/api/health` : null,
-    runtimeStrategy: "external",
     requestedScopes: payload.application.appId ? ["openid", "profile", "email", "organization:read", "entitlements:read", `${payload.application.id}:read`] : ["openid", "profile", "email", "organization:read"],
-    marketplaceIntent: payload.distributionModel === "marketplace" ? "submit_when_ready" : "not_requested",
+    marketplace: {
+      intent: payload.distributionModel === "marketplace" ? "submit_when_ready" : "not_requested",
+      status: "preview",
+      shortBlurb: payload.experience.tagline,
+      tagline: payload.experience.tagline,
+      description: payload.experience.tagline,
+      docsUrl: payload.application.productionUrl || "https://developers.topolo.app"
+    },
+    notifications: { role: "consumer_only" },
     applicationId: payload.application.id,
-    appDir: payload.application.appDir,
-    packageName: payload.application.packageName,
     name: payload.application.name,
+    description: payload.experience.tagline,
+    category: payload.target === "platform" ? "topolo-platform" : "productivity",
+    version: "1.0.0",
+    pricingType: "free",
+    monthlyPrice: null,
+    demoUrl: payload.application.productionUrl,
+    repoUrl: null,
+    supportEmail,
+    tags: [],
+    screenshots: [],
     productionUrl: payload.application.productionUrl,
     serviceSlug: payload.application.serviceSlug,
     appId: payload.application.appId
@@ -9897,6 +10268,332 @@ async function applyProvisionedAppId(manifestPath, appId) {
 
 // src/commands/apps.ts
 import { join as join3 } from "path";
+
+// src/commands/app-reconcile.ts
+import { readFile as readFile3, writeFile as writeFile4 } from "fs/promises";
+import path2 from "path";
+import { createInterface as createInterface2 } from "readline/promises";
+import { stdin as input2, stdout as output } from "process";
+function record(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function environmentValue(value, environment) {
+  if (typeof value === "string") return value;
+  if (!value) return null;
+  return typeof value[environment] === "string" ? value[environment] : null;
+}
+function resolveManifestApplicationUrl(manifest, environment) {
+  const targets = manifest.targets || {};
+  const targetName = manifest.primaryTarget || (targets.web ? "web" : Object.keys(targets)[0]);
+  const target = targetName ? targets[targetName] : null;
+  if (!target) {
+    if (manifest.registration?.productionUrl) return manifest.registration.productionUrl.replace(/\/+$/, "");
+    throw new Error("topolo.app.json has no application target or registration.productionUrl.");
+  }
+  const publicUrl = environmentValue(target.publicUrl, environment);
+  if (publicUrl) return publicUrl.replace(/\/+$/, "");
+  const hostOverride = target.hostOverride?.[environment];
+  if (hostOverride) return `https://${hostOverride.replace(/^https?:\/\//, "").replace(/\/+$/, "")}`;
+  const domain = manifest.environments?.[environment]?.domain;
+  if (!target.subdomain || !domain) {
+    throw new Error(`Cannot derive the ${environment} application URL from target ${targetName}.`);
+  }
+  return `https://${target.subdomain}.${domain}`;
+}
+function assertRegistration(value) {
+  const registration = record(value);
+  const required = [
+    "ownerType",
+    "applicationId",
+    "serviceSlug",
+    "displayName",
+    "description",
+    "audience",
+    "tenancy",
+    "surfaceModel",
+    "distributionModel",
+    "version",
+    "pricing",
+    "supportEmail",
+    "auth",
+    "capabilities",
+    "marketplace"
+  ];
+  const missing = required.filter((field) => registration?.[field] == null || registration[field] === "");
+  if (missing.length) {
+    throw new Error(
+      `topolo.app.json registration is incomplete: ${missing.join(", ")}. Run in an interactive terminal to complete the manifest, or edit the declarative registration block.`
+    );
+  }
+}
+function titleFromSlug(value) {
+  return value.replace(/^topolo[-_]/, "").split(/[-_]+/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
+}
+async function completeApplicationRegistrationInteractively(options) {
+  const manifestPath = path2.resolve(options.manifestPath || "topolo.app.json");
+  const manifest = JSON.parse(await readFile3(manifestPath, "utf8"));
+  const existing = record(manifest.registration) || {};
+  const appId = String(manifest.appId || manifest.app_id || "").trim();
+  const slug = String(existing.serviceSlug || manifest.name || "").trim();
+  const defaultName = titleFromSlug(slug);
+  const readline = options.prompt ? null : createInterface2({ input: input2, output });
+  const ask = options.prompt || ((question) => readline.question(question));
+  let changed = !manifest.registration;
+  const requiredText = async (field, label, fallback = "") => {
+    const current = typeof existing[field] === "string" ? String(existing[field]).trim() : "";
+    if (current) return current;
+    const answer = (await ask(`${label}${fallback ? ` [${fallback}]` : ""}: `)).trim() || fallback;
+    if (!answer) throw new Error(`${field} is required.`);
+    changed = true;
+    return answer;
+  };
+  try {
+    const productionUrl = String(existing.productionUrl || resolveManifestApplicationUrl(manifest, options.environment || selectedEnvironment()));
+    const displayName = await requiredText("displayName", "Application display name", defaultName);
+    const description = await requiredText("description", "Application description", `${displayName} application for Topolo.`);
+    const supportEmail = await requiredText("supportEmail", "Support email");
+    manifest.registration = {
+      ownerType: options.expectedOwnerType,
+      ...options.expectedOwnerType === "topolo_first_party" ? { portfolio: existing.portfolio || "platform" } : {},
+      applicationId: String(existing.applicationId || slug).replace(/^topolo-/, "topolo-"),
+      serviceSlug: slug,
+      displayName,
+      description,
+      category: String(existing.category || (options.expectedOwnerType === "topolo_first_party" ? "topolo-platform" : "productivity")),
+      audience: existing.audience || "business",
+      tenancy: existing.tenancy || "organization",
+      surfaceModel: existing.surfaceModel || "web_app",
+      containerAppId: existing.containerAppId,
+      distributionModel: existing.distributionModel || (options.expectedOwnerType === "topolo_first_party" ? "marketplace" : "organization_internal"),
+      version: String(existing.version || "1.0.0"),
+      pricing: record(existing.pricing) || { type: "free", monthlyPrice: null },
+      supportEmail,
+      productionUrl,
+      demoUrl: typeof existing.demoUrl === "string" ? existing.demoUrl : void 0,
+      repoUrl: typeof existing.repoUrl === "string" ? existing.repoUrl : void 0,
+      tags: Array.isArray(existing.tags) ? existing.tags : [],
+      screenshots: Array.isArray(existing.screenshots) ? existing.screenshots : [],
+      auth: record(existing.auth) || {
+        callbackPath: "/auth/callback",
+        requestedScopes: ["openid", "profile", "email", "organization:read"]
+      },
+      capabilities: Array.isArray(existing.capabilities) ? existing.capabilities : ["login", "launcher"],
+      marketplace: record(existing.marketplace) || {
+        intent: options.expectedOwnerType === "topolo_first_party" ? "submit_when_ready" : "not_requested",
+        status: "preview",
+        shortBlurb: description,
+        tagline: description,
+        description,
+        docsUrl: productionUrl
+      }
+    };
+    if (!manifest.notifications) {
+      const role = (await ask("Notification role [consumer_only]: ")).trim() || "consumer_only";
+      if (!["producer", "consumer_only", "internal_non_producer"].includes(role)) {
+        throw new Error("Notification role must be producer, consumer_only, or internal_non_producer.");
+      }
+      if (role === "producer") {
+        const contracts = (await ask("Notification contracts path: ")).trim();
+        if (!contracts) throw new Error("Producer applications must declare a notification contracts path.");
+        manifest.notifications = { role, contracts };
+      } else {
+        manifest.notifications = { role };
+      }
+      changed = true;
+    }
+    if (!appId) throw new Error("topolo.app.json must declare the immutable appId before reconciliation.");
+    if (changed) await writeFile4(manifestPath, `${JSON.stringify(manifest, null, 2)}
+`, "utf8");
+    return { changed, manifestPath };
+  } finally {
+    if (readline) readline.close();
+  }
+}
+async function loadApplicationReconcileRequest(options) {
+  const manifestPath = path2.resolve(options.manifestPath || "topolo.app.json");
+  const raw = await readFile3(manifestPath, "utf8");
+  const manifest = JSON.parse(raw);
+  assertRegistration(manifest.registration);
+  const registration = manifest.registration;
+  if (registration.ownerType !== options.expectedOwnerType) {
+    throw new Error(
+      `${registration.ownerType} registration cannot be reconciled through the ${options.expectedOwnerType} command surface.`
+    );
+  }
+  const environment = options.environment || selectedEnvironment();
+  const productionUrl = resolveManifestApplicationUrl(manifest, environment);
+  const callbackPath = registration.auth.callbackPath.startsWith("/") ? registration.auth.callbackPath : `/${registration.auth.callbackPath}`;
+  const appId = String(manifest.appId || manifest.app_id || "").trim();
+  if (!appId) throw new Error("topolo.app.json must declare the immutable appId.");
+  return {
+    manifestPath,
+    request: {
+      mode: options.mode,
+      appId,
+      ownerType: registration.ownerType,
+      portfolio: registration.portfolio ?? null,
+      applicationId: registration.applicationId,
+      serviceSlug: registration.serviceSlug,
+      audience: registration.audience,
+      tenancy: registration.tenancy,
+      surfaceModel: registration.surfaceModel,
+      containerAppId: registration.containerAppId ?? null,
+      distributionModel: registration.distributionModel,
+      name: registration.displayName,
+      description: registration.description,
+      category: registration.category ?? null,
+      version: registration.version,
+      pricingType: registration.pricing.type,
+      monthlyPrice: registration.pricing.monthlyPrice ?? null,
+      productionUrl,
+      demoUrl: registration.ownerType === "topolo_first_party" ? productionUrl : registration.demoUrl ?? productionUrl,
+      repoUrl: registration.repoUrl ?? null,
+      supportEmail: registration.supportEmail,
+      tags: registration.tags ?? [],
+      screenshots: registration.screenshots ?? [],
+      callbackUrls: [`${productionUrl}${callbackPath}`],
+      requestedScopes: registration.auth.requestedScopes,
+      capabilities: registration.capabilities,
+      marketplace: { ...registration.marketplace, appUrl: productionUrl },
+      notifications: manifest.notifications ?? null
+    }
+  };
+}
+function defaultAuthOrigin2(environment) {
+  if (environment === "development") return "https://auth.topolo.dev";
+  if (environment === "staging") return "https://auth.stg.topolo.us";
+  return "https://auth.topolo.app";
+}
+async function resolveDevelopersAppId(authOrigin, fetchImpl) {
+  const response = await fetchImpl(`${authOrigin}/api/services/by-slug/topolo-developers`, {
+    headers: { Accept: "application/json" }
+  });
+  const payload = await response.json().catch(() => null);
+  const appId = typeof payload?.data?.app_id === "string" ? payload.data.app_id.trim() : "";
+  if (!response.ok || !appId) throw new Error("Could not resolve the Developers app id from Auth.");
+  return appId;
+}
+async function reconcileApplicationRequest(request, dependencies = {}) {
+  const selectEnvironment = dependencies.selectedEnvironment || selectedEnvironment;
+  const refreshCredential = dependencies.refreshCredentialIfNeeded || refreshCredentialIfNeeded;
+  const makeClient2 = dependencies.buildClient || buildClient;
+  const loadConfig = dependencies.readConfig || readConfig;
+  const resolveProfile = dependencies.resolvedProfileConfig || resolvedProfileConfig;
+  const assertServiceUrl = dependencies.assertServiceUrlForEnvironment || assertServiceUrlForEnvironment;
+  const fetchImpl = dependencies.fetch || fetch;
+  const environment = selectEnvironment();
+  const credential = await refreshCredential(environment);
+  if (!credential) throw new Error("Application reconciliation requires an authenticated Topolo session. Run `topolo auth login`.");
+  const client = await makeClient2();
+  if (!client) throw new Error("Could not build the authenticated Topolo client.");
+  await client.client.introspect();
+  const config = await loadConfig();
+  const profile = resolveProfile(config, environment);
+  const authOrigin = (profile.serviceUrls?.auth || defaultAuthOrigin2(environment)).replace(/\/+$/, "");
+  const developersOrigin = (profile.serviceUrls?.developers || "https://developers.topolo.app").replace(/\/+$/, "");
+  assertServiceUrl("auth", authOrigin, environment);
+  assertServiceUrl("developers", developersOrigin, environment);
+  const headers = new Headers({
+    "Content-Type": "application/json",
+    "X-App-ID": await resolveDevelopersAppId(authOrigin, fetchImpl),
+    "X-Topolo-Client": `topolo-cli/${CLI_VERSION}`
+  });
+  const agentName = resolveAgentName(profile.agentName);
+  if (agentName) headers.set("X-Topolo-Agent", agentName);
+  if (credential.kind === "api_key") headers.set("X-Api-Key", credential.apiKey);
+  else headers.set("Authorization", `Bearer ${credential.accessToken}`);
+  const endpoint = request.ownerType === "topolo_first_party" ? "/api/developer-console/admin/apps/reconcile" : "/api/developer-console/apps/reconcile";
+  const response = await fetchImpl(`${developersOrigin}${endpoint}`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(request)
+  });
+  const envelope = await response.json().catch(() => null);
+  if (!response.ok || !envelope?.success || !envelope.data) {
+    const message = typeof envelope?.error === "string" ? envelope.error : envelope?.error?.message || envelope?.message || `Application reconciliation failed with status ${response.status}.`;
+    const error = new Error(message);
+    error.code = response.status === 409 ? "immutable_drift" : response.status === 403 ? "permission_denied" : "reconcile_failed";
+    error.details = typeof envelope?.error === "object" ? envelope.error.details : void 0;
+    throw error;
+  }
+  return envelope.data;
+}
+function resolveReconcileMode(options) {
+  const explicit = [options.check, options.dryRun, options.apply].filter(Boolean).length;
+  if (explicit > 1) throw new Error("Choose exactly one of --check, --dry-run, or --apply.");
+  if (options.apply) return { mode: "apply", interactiveApply: false };
+  if (options.check || options.dryRun) return { mode: "check", interactiveApply: false };
+  return {
+    mode: "check",
+    interactiveApply: !options.nonInteractive && Boolean(options.interactive || process.stdin.isTTY && process.stdout.isTTY)
+  };
+}
+async function confirmApplicationReconcile(result) {
+  if (result.plan.status === "in_sync") return false;
+  const readline = createInterface2({ input: input2, output });
+  try {
+    const answer = await readline.question(`Apply ${result.plan.changes.length} application registration change(s)? [y/N] `);
+    return /^(y|yes)$/i.test(answer.trim());
+  } finally {
+    readline.close();
+  }
+}
+function formatApplicationReconcile(result, manifestPath) {
+  const lines = [
+    `Application registration: ${result.plan.status}`,
+    `Manifest: ${manifestPath}`,
+    `Mode: ${result.mode}`
+  ];
+  for (const change of result.changes || result.plan.changes) {
+    lines.push(`- ${change.path}: ${JSON.stringify(change.before)} -> ${JSON.stringify(change.after)}`);
+  }
+  if (result.projections) lines.push("Catalog/Auth projections: reconciled");
+  return lines.join("\n");
+}
+function registerApplicationReconcileCommand(parent, ownerType, dependencies = {}) {
+  const completeRegistration = dependencies.completeRegistration || completeApplicationRegistrationInteractively;
+  const loadRequest = dependencies.loadRequest || loadApplicationReconcileRequest;
+  const reconcileRequest = dependencies.reconcileRequest || reconcileApplicationRequest;
+  const confirm = dependencies.confirm || confirmApplicationReconcile;
+  parent.command("reconcile").description("Check or apply the declarative application registration in topolo.app.json.").option("--manifest <path>", "Path to topolo.app.json", "topolo.app.json").option("--check", "Report drift without mutating remote data").option("--dry-run", "Alias for --check").option("--apply", "Apply mutable drift and required projections").option("--interactive", "Use the human confirmation flow").option("--non-interactive", "Disable all prompts").option("--yes", "Accept the interactive apply confirmation").option("--json", "Output JSON").option("--no-json", "Output human-readable details").action(async (options) => {
+    const outputMode = resolveOutputMode(options.json);
+    try {
+      const selection = resolveReconcileMode(options);
+      if (selection.interactiveApply) {
+        await completeRegistration({
+          manifestPath: options.manifest,
+          expectedOwnerType: ownerType
+        });
+      }
+      const loaded = await loadRequest({
+        manifestPath: options.manifest,
+        expectedOwnerType: ownerType,
+        mode: selection.mode
+      });
+      let result = await reconcileRequest(loaded.request);
+      if (selection.interactiveApply && result.plan.status !== "in_sync") {
+        if (outputMode === "pretty") {
+          process.stdout.write(`${formatApplicationReconcile(result, loaded.manifestPath)}
+`);
+        }
+        const confirmed = options.yes || await confirm(result);
+        if (confirmed) {
+          result = await reconcileRequest({ ...loaded.request, mode: "apply" });
+        }
+      }
+      emit(
+        { manifest: loaded.manifestPath, reconciliation: result },
+        outputMode,
+        () => formatApplicationReconcile(result, loaded.manifestPath)
+      );
+      if (result.mode === "check" && result.plan.status !== "in_sync") process.exitCode = 2;
+    } catch (error) {
+      fail(error, outputMode);
+    }
+  });
+}
+
+// src/commands/apps.ts
 var APPLICATION_IDS = Object.keys(APPLICATIONS).sort();
 var CLOUDCONTROL_LOCAL_APPLICATION = {
   id: "cloudcontrol",
@@ -9926,6 +10623,7 @@ function registerAppsCommand(program2) {
       fail(err, mode);
     }
   });
+  registerApplicationReconcileCommand(apps, "third_party");
   apps.command("get <application>").description("Show one Topolo application available to the current credential.").option("--json", "Output JSON", true).option("--no-json", "Output human-readable details").action(async (application, opts) => {
     const mode = resolveOutputMode(opts.json);
     try {
@@ -9964,8 +10662,8 @@ function registerAppsCommand(program2) {
         repoRoot: opts.repoRoot
       });
       const gate = opts.failOn ? evaluateApplicationAuditGate(payload, opts.failOn) : null;
-      const output = gate ? { ...payload, conformanceGate: gate } : payload;
-      emit(output, mode, () => formatAudit(output));
+      const output2 = gate ? { ...payload, conformanceGate: gate } : payload;
+      emit(output2, mode, () => formatAudit(output2));
       if (gate && !gate.passed) {
         if (mode === "json") {
           process.stderr.write(JSON.stringify({ error: gate.message, conformanceGate: gate }, null, 2) + "\n");
@@ -10027,14 +10725,14 @@ function registerAppsCommand(program2) {
           appIdWriteBack = { ...result, path: manifestFile.path };
         }
       }
-      const output = {
+      const output2 = {
         ...payload,
         ...writeResult ? { write: writeResult } : {},
         ...provisionResult ? { provision: provisionResult } : {},
         ...appIdWriteBack ? { appIdWriteBack } : {}
       };
       emit(
-        output,
+        output2,
         mode,
         () => formatScaffold(payload, writeResult, provisionResult, appIdWriteBack)
       );
@@ -10098,7 +10796,7 @@ function applicationAuditPayload(application, options = {}) {
 }
 function recordApplicationEvidence(application, options = {}) {
   const appId = resolveApplication(application).id;
-  const root = path2.resolve(options.appRoot ?? process.cwd());
+  const root = path3.resolve(options.appRoot ?? process.cwd());
   if (!existsSync3(root)) {
     throw new Error(`Application root does not exist: ${root}`);
   }
@@ -10110,8 +10808,8 @@ function recordApplicationEvidence(application, options = {}) {
       commit = void 0;
     }
   }
-  const evidenceDir = path2.join(root, ".topolo");
-  const evidencePath = path2.join(evidenceDir, "evidence.json");
+  const evidenceDir = path3.join(root, ".topolo");
+  const evidencePath = path3.join(evidenceDir, "evidence.json");
   let before = null;
   if (existsSync3(evidencePath)) {
     try {
@@ -10411,16 +11109,17 @@ function statusesAtOrWorse(threshold) {
 
 // src/commands/platform.ts
 import { readdirSync as readdirSync2, readFileSync as readFileSync5, statSync as statSync2 } from "fs";
-import path3 from "path";
+import path4 from "path";
 function registerPlatformCommand(program2) {
   const platform3 = program2.command("platform").description("Internal Topolo first-party platform and personal app commands");
   const platformApps = platform3.command("apps").description("Scaffold and operate first-party Topolo platform and personal applications");
+  registerApplicationReconcileCommand(platformApps, "topolo_first_party");
   platformApps.command("scaffold <application>").description(
     "Generate a first-party Topolo scaffold for the platform or personal portfolio."
   ).option("--json", "Output JSON").option("--no-json", "Output human-readable checklist").option("--app-dir <path>", "Application repo name or apps/<repo> path").option("--name <name>", "Application display/package source name").option("--package-name <name>", "package.json name").option("--production-url <url>", "Production browser URL").option("--service <id>", "Stable SDK/Auth app id for API-backed apps").option("--portfolio <portfolio>", "First-party portfolio: platform or personal").option(
     "--surface-model <surfaceModel>",
     "First-party surface model: web_app, mobile_container, mobile_module, or messaging_surface"
-  ).option("--container-app-id <appId>", "Container app id when --surface-model mobile_module is used").option("--profile <profile>", "First-party scaffold profile such as spatial-assets").option("--with-d1", "Declare a D1 binding in the first-party scaffold").option("--with-r2", "Declare an R2 binding in the first-party scaffold").option("--with-queue", "Declare a Queue binding in the first-party scaffold").option("--with-workflow", "Declare a Workflow binding in the first-party scaffold").option("--with-container-processing", "Declare container-processing metadata in CloudControl").option("--home-path <path>", "Authenticated home route (default: /dashboard)").option("--home-label <label>", "Home navigation label (default: Dashboard)").option("--navigation-mode <mode>", "Product navigation: sidebar, topbar, or none").option("--workspace-switcher <mode>", "Workspace context selector: required, optional, or off").option("--tagline <text>", "Product-facing landing and home description").option("--write", "Write the generated scaffold files to disk").option("--repo-root <path>", "Directory where scaffold files should be written").option("--force", "Overwrite existing scaffold files when --write is set").option("--with-api", "Include the API/service baseline").option("--no-api", "Do not include API/service requirements").option("--no-browser", "Do not include browser-shell requirements").option(
+  ).option("--container-app-id <appId>", "Container app id when --surface-model mobile_module is used").option("--profile <profile>", "First-party scaffold profile such as spatial-assets").option("--with-d1", "Declare a D1 binding in the first-party scaffold").option("--with-r2", "Declare an R2 binding in the first-party scaffold").option("--with-queue", "Declare a Queue binding in the first-party scaffold").option("--with-workflow", "Declare a Workflow binding in the first-party scaffold").option("--with-container-processing", "Declare container-processing metadata in CloudControl").option("--home-path <path>", "Authenticated home route (default: /dashboard)").option("--home-label <label>", "Home navigation label (default: Dashboard)").option("--navigation-mode <mode>", "Product navigation: sidebar, topbar, or none").option("--workspace-switcher <mode>", "Workspace context selector: required, optional, or off").option("--ui-template <template>", "Shared UI starter: operations, index, workbench, or minimal").option("--tagline <text>", "Product-facing landing and home description").option("--write", "Write the generated scaffold files to disk").option("--repo-root <path>", "Directory where scaffold files should be written").option("--force", "Overwrite existing scaffold files when --write is set").option("--with-api", "Include the API/service baseline").option("--no-api", "Do not include API/service requirements").option("--no-browser", "Do not include browser-shell requirements").option(
     "--provision",
     "Provision the generated first-party app into Topolo Developers and Auth using the authenticated Topolo admin session"
   ).option(
@@ -10460,6 +11159,7 @@ function registerPlatformCommand(program2) {
         homeLabel: opts.homeLabel,
         navigationMode: opts.navigationMode,
         workspaceSwitcher: opts.workspaceSwitcher,
+        uiTemplate: opts.uiTemplate,
         tagline: opts.tagline
       });
       if (opts.workflowOnly && !payload.ciWorkflow) {
@@ -10470,13 +11170,13 @@ function registerPlatformCommand(program2) {
       }
       const writeResult = opts.write ? await writeApplicationScaffold(payload, { repoRoot: opts.repoRoot, force: opts.force }) : null;
       const provisionResult = shouldProvision ? await provisionApplicationScaffold(payload) : null;
-      const output = opts.workflowOnly ? { application: payload.application, ciWorkflowPath: payload.ciWorkflowPath, ciWorkflow: payload.ciWorkflow } : {
+      const output2 = opts.workflowOnly ? { application: payload.application, ciWorkflowPath: payload.ciWorkflowPath, ciWorkflow: payload.ciWorkflow } : {
         ...payload,
         ...writeResult ? { write: writeResult } : {},
         ...provisionResult ? { provision: provisionResult } : {}
       };
       emit(
-        output,
+        output2,
         mode,
         () => opts.workflowOnly ? payload.ciWorkflow ?? "" : formatScaffold(payload, writeResult, provisionResult)
       );
@@ -10527,12 +11227,12 @@ var SKIPPED_SCAN_DIRS = /* @__PURE__ */ new Set([
   "output"
 ]);
 function scanStagingProductionUrls(rootInput, allowPatterns) {
-  const root = path3.resolve(rootInput);
+  const root = path4.resolve(rootInput);
   const allowlist = allowPatterns.map((pattern) => new RegExp(pattern));
   const violations = [];
   function shouldSkipFile(filePath) {
-    const basename = path3.basename(filePath);
-    const relativePath = path3.relative(root, filePath);
+    const basename = path4.basename(filePath);
+    const relativePath = path4.relative(root, filePath);
     if (basename === "package-lock.json" || basename === "pnpm-lock.yaml" || basename === "yarn.lock") return true;
     if (basename === "topolo.cloudcontrol.json") return true;
     if (basename === "wrangler.toml" || basename === "wrangler.jsonc") return true;
@@ -10541,14 +11241,14 @@ function scanStagingProductionUrls(rootInput, allowPatterns) {
     if (basename.endsWith(".generated.ts")) return true;
     if (basename.endsWith(".test.ts") || basename.endsWith(".test.tsx") || basename.endsWith(".spec.ts")) return true;
     if (basename === ".env.production") return true;
-    if (relativePath === path3.join("src", "environment.ts") || relativePath === path3.join("src", "environmentUrls.ts") || relativePath.endsWith(path3.join("src", "environment.ts")) || relativePath.endsWith(path3.join("src", "lib", "environment.ts")) || relativePath === path3.join("packages", "topolo-ui-kit", "src", "environmentUrls.ts")) return true;
-    if (relativePath.includes(`${path3.sep}test${path3.sep}`) || relativePath.includes(`${path3.sep}tests${path3.sep}`) || relativePath.includes(`${path3.sep}e2e${path3.sep}`)) return true;
-    if (relativePath.startsWith(`scripts${path3.sep}`) || relativePath.includes(`${path3.sep}scripts${path3.sep}`)) return true;
-    return !RUNTIME_EXTENSIONS.has(path3.extname(filePath));
+    if (relativePath === path4.join("src", "environment.ts") || relativePath === path4.join("src", "environmentUrls.ts") || relativePath.endsWith(path4.join("src", "environment.ts")) || relativePath.endsWith(path4.join("src", "lib", "environment.ts")) || relativePath === path4.join("packages", "topolo-ui-kit", "src", "environmentUrls.ts")) return true;
+    if (relativePath.includes(`${path4.sep}test${path4.sep}`) || relativePath.includes(`${path4.sep}tests${path4.sep}`) || relativePath.includes(`${path4.sep}e2e${path4.sep}`)) return true;
+    if (relativePath.startsWith(`scripts${path4.sep}`) || relativePath.includes(`${path4.sep}scripts${path4.sep}`)) return true;
+    return !RUNTIME_EXTENSIONS.has(path4.extname(filePath));
   }
   function scanFile(filePath) {
     if (shouldSkipFile(filePath)) return;
-    const relativePath = path3.relative(root, filePath);
+    const relativePath = path4.relative(root, filePath);
     const content = readFileSync5(filePath, "utf8");
     const lines = content.split(/\r?\n/);
     lines.forEach((line, index) => {
@@ -10563,7 +11263,7 @@ function scanStagingProductionUrls(rootInput, allowPatterns) {
   }
   function walk(dir) {
     for (const entry of readdirSync2(dir, { withFileTypes: true })) {
-      const fullPath = path3.join(dir, entry.name);
+      const fullPath = path4.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (!SKIPPED_SCAN_DIRS.has(entry.name)) walk(fullPath);
         continue;
@@ -10731,7 +11431,7 @@ var DEFAULT_SEED_BASE_URL = "https://seed.stg.topolo.us";
 function seedBaseUrl() {
   return process.env.TOPOLO_SEED_URL || DEFAULT_SEED_BASE_URL;
 }
-async function authedFetch(path4, init = {}) {
+async function authedFetch(path5, init = {}) {
   const credential = await refreshCredentialIfNeeded("staging");
   if (!credential) {
     throw new Error("No staging credential configured. Run `topolo auth login --env staging` or set TOPOLO_STAGING_API_KEY.");
@@ -10741,7 +11441,7 @@ async function authedFetch(path4, init = {}) {
   else headers.set("Authorization", `Bearer ${credential.accessToken}`);
   headers.set("X-Topolo-Client", `topolo-cli/${CLI_VERSION}`);
   if (init.body && !headers.has("Content-Type")) headers.set("Content-Type", "application/json");
-  const response = await fetch(`${seedBaseUrl()}${path4}`, { ...init, headers });
+  const response = await fetch(`${seedBaseUrl()}${path5}`, { ...init, headers });
   const text = await response.text();
   let body;
   try {
@@ -11018,7 +11718,7 @@ function createOAuthClientPayload(options) {
     logo_url: options.logoUrl
   };
 }
-async function authFetchJson(path4, init = {}) {
+async function authFetchJson(path5, init = {}) {
   const environment = selectedEnvironment();
   const credential = await refreshCredentialIfNeeded(environment);
   if (!credential) {
@@ -11040,7 +11740,7 @@ async function authFetchJson(path4, init = {}) {
     throw err;
   }
   headers.set("Authorization", `Bearer ${credential.accessToken}`);
-  const response = await fetch(`${authBaseUrl}${path4}`, { ...init, headers });
+  const response = await fetch(`${authBaseUrl}${path5}`, { ...init, headers });
   const text = await response.text();
   const payload = text ? JSON.parse(text) : {};
   if (!response.ok || payload.success === false) {
@@ -11056,7 +11756,7 @@ function normalizeList(values, fallback = []) {
 }
 
 // src/commands/integrations.ts
-import { readdir, readFile as readFile3, stat } from "fs/promises";
+import { readdir, readFile as readFile4, stat } from "fs/promises";
 import { join as join4, relative as relative3 } from "path";
 function registerIntegrationsCommand(program2) {
   const integrations = program2.command("integrations").description("Generate and validate Topolo integration handoffs.");
@@ -11200,7 +11900,7 @@ function detectFramework(packageJson2, haystack) {
 }
 async function readPackageJson2(repoRoot) {
   try {
-    return JSON.parse(await readFile3(join4(repoRoot, "package.json"), "utf8"));
+    return JSON.parse(await readFile4(join4(repoRoot, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -11223,7 +11923,7 @@ async function collectFiles(repoRoot) {
       if (info.size > 25e4) continue;
       result.push({
         path: relative3(root, fullPath),
-        content: await readFile3(fullPath, "utf8")
+        content: await readFile4(fullPath, "utf8")
       });
     }
   }
@@ -11241,7 +11941,7 @@ function formatCheckResult(result) {
 // src/commands/skills.ts
 import { spawnSync } from "child_process";
 import { existsSync as existsSync4 } from "fs";
-import { mkdir as mkdir3, copyFile, readFile as readFile4, writeFile as writeFile4, rm } from "fs/promises";
+import { mkdir as mkdir3, copyFile, readFile as readFile5, writeFile as writeFile5, rm } from "fs/promises";
 import { homedir as homedir2 } from "os";
 import { dirname as dirname4, join as join5, resolve as resolve3 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
@@ -11295,11 +11995,11 @@ function registerViaOfficialCli(cli, mcp, agentName) {
   return result.status === 0;
 }
 async function registerClaudeViaConfig(mcp) {
-  const path4 = join5(homedir2(), ".claude.json");
+  const path5 = join5(homedir2(), ".claude.json");
   let config = {};
-  if (existsSync4(path4)) {
+  if (existsSync4(path5)) {
     try {
-      config = JSON.parse(await readFile4(path4, "utf8"));
+      config = JSON.parse(await readFile5(path5, "utf8"));
     } catch {
       config = {};
     }
@@ -11312,13 +12012,13 @@ async function registerClaudeViaConfig(mcp) {
     env: { TOPOLO_AGENT_NAME: AGENT_NAME_FOR.claude }
   };
   config.mcpServers = servers;
-  await writeFile4(path4, `${JSON.stringify(config, null, 2)}
+  await writeFile5(path5, `${JSON.stringify(config, null, 2)}
 `, "utf8");
 }
 async function registerCodexViaConfig(mcp) {
-  const path4 = join5(homedir2(), ".codex", "config.toml");
+  const path5 = join5(homedir2(), ".codex", "config.toml");
   let text = "";
-  if (existsSync4(path4)) text = await readFile4(path4, "utf8");
+  if (existsSync4(path5)) text = await readFile5(path5, "utf8");
   text = text.replace(
     /(^|\n)\[mcp_servers\.topolo(?:\.[a-z]+)?\][^\[]*/g,
     (match) => match.startsWith("\n") ? "\n" : ""
@@ -11334,8 +12034,8 @@ command = "${mcp.command}"${argsToml}
 [mcp_servers.topolo.env]
 TOPOLO_AGENT_NAME = "${AGENT_NAME_FOR.codex}"
 `;
-  await mkdir3(dirname4(path4), { recursive: true });
-  await writeFile4(path4, `${text}${block}`, "utf8");
+  await mkdir3(dirname4(path5), { recursive: true });
+  await writeFile5(path5, `${text}${block}`, "utf8");
 }
 async function installForAgent(agent, sourceDir, mcp, opts) {
   const skillDir = agent === "claude" ? claudeSkillDir(opts.projectDir) : codexSkillDir();