@topolo/cli 0.5.0 → 0.5.2

package/dist/index.js

@@ -61,13 +61,13 @@ var TopoloHttpError = class extends TopoloSdkError {
   body;
   service;
   path;
-  constructor(service, path4, status, body, message) {
-    super("http_error", message ?? `HTTP ${status} from ${service}${path4}`);
+  constructor(service, path6, status, body, message) {
+    super("http_error", message ?? `HTTP ${status} from ${service}${path6}`);
     this.name = "TopoloHttpError";
     this.status = status;
     this.body = body;
     this.service = service;
-    this.path = path4;
+    this.path = path6;
   }
 };
 var APP_API_URLS = {
@@ -185,7 +185,7 @@ var APPLICATIONS = {
     "appDir": "TopoloAuth",
     "name": "topolo-auth",
     "packageName": "topolo-auth",
-    "productionUrl": "https://auth.topolo.app/login",
+    "productionUrl": "https://auth.topolo.app",
     "services": [
       "auth"
     ],
@@ -273,9 +273,7 @@ var APPLICATIONS = {
         "domains": [
           "brand.topolo.app"
         ],
-        "routes": [
-          "brand.topolo.app"
-        ],
+        "routes": [],
         "appId": "brand"
       },
       {
@@ -387,9 +385,7 @@ var APPLICATIONS = {
         "domains": [
           "campaigns.topolo.app"
         ],
-        "routes": [
-          "campaigns.topolo.app"
-        ],
+        "routes": [],
         "appId": "campaigns"
       },
       {
@@ -1077,11 +1073,13 @@ var APPLICATIONS = {
       {
         "name": "topolo-nexus-dashboard",
         "kind": "worker",
-        "apiUrl": null,
+        "apiUrl": "https://nexus.topolo.app",
         "domains": [
           "nexus.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "nexus.topolo.app"
+        ],
         "appId": null
       },
       {
@@ -2171,24 +2169,24 @@ var SUPPORTED_SCHEMA_KEYWORDS = /* @__PURE__ */ new Set([
   "exclusiveMaximum",
   "multipleOf"
 ]);
-function validateTopoloActionInput(schema, input2) {
+function validateTopoloActionInput(schema, input3) {
   const schemaIssue = inspectSchema(schema, "$", schema, 0);
   if (schemaIssue) return { valid: false, errors: [schemaIssue] };
   const errors = [];
-  validateNode(schema, input2, "$", schema, errors, 0);
+  validateNode(schema, input3, "$", schema, errors, 0);
   return { valid: errors.length === 0, errors };
 }
-function inspectSchema(schema, path4, root, depth) {
-  if (depth > 128) return { path: path4, code: "schema_depth", message: "Schema recursion exceeded 128 levels." };
+function inspectSchema(schema, path6, root, depth) {
+  if (depth > 128) return { path: path6, code: "schema_depth", message: "Schema recursion exceeded 128 levels." };
   const unsupportedKeyword = Object.keys(schema).find((keyword) => !SUPPORTED_SCHEMA_KEYWORDS.has(keyword));
   if (unsupportedKeyword) {
-    return { path: path4, code: "unsupported_schema_keyword", message: `Action schema uses unsupported keyword ${unsupportedKeyword}.` };
+    return { path: path6, code: "unsupported_schema_keyword", message: `Action schema uses unsupported keyword ${unsupportedKeyword}.` };
   }
   if (typeof schema.format === "string" && !["uri", "email", "date-time"].includes(schema.format)) {
-    return { path: path4, code: "unsupported_schema_format", message: `Action schema uses unsupported format ${schema.format}.` };
+    return { path: path6, code: "unsupported_schema_format", message: `Action schema uses unsupported format ${schema.format}.` };
   }
   if (typeof schema.$ref === "string" && !resolveLocalReference(root, schema.$ref)) {
-    return { path: path4, code: "unsupported_schema_ref", message: `Cannot resolve schema reference ${schema.$ref}.` };
+    return { path: path6, code: "unsupported_schema_ref", message: `Cannot resolve schema reference ${schema.$ref}.` };
   }
   const children = [];
   if (isRecord(schema.properties)) children.push(...Object.entries(schema.properties));
@@ -2204,7 +2202,7 @@ function inspectSchema(schema, path4, root, depth) {
   );
   for (const [key, child] of children) {
     if (!isRecord(child)) continue;
-    const issue = inspectSchema(child, `${path4}.${key}`, root, depth + 1);
+    const issue = inspectSchema(child, `${path6}.${key}`, root, depth + 1);
     if (issue) return issue;
   }
   return null;
@@ -2212,129 +2210,129 @@ function inspectSchema(schema, path4, root, depth) {
 function arraySchemaEntries(keyword, value) {
   return Array.isArray(value) ? value.map((candidate, index) => [`${keyword}[${index}]`, candidate]) : [];
 }
-function validateNode(schema, value, path4, root, errors, depth) {
+function validateNode(schema, value, path6, root, errors, depth) {
   if (depth > 128) {
-    errors.push({ path: path4, code: "schema_depth", message: "Schema recursion exceeded 128 levels." });
+    errors.push({ path: path6, code: "schema_depth", message: "Schema recursion exceeded 128 levels." });
     return;
   }
   if (typeof schema.$ref === "string") {
     const resolved = resolveLocalReference(root, schema.$ref);
     if (!resolved) {
-      errors.push({ path: path4, code: "unsupported_schema_ref", message: `Cannot resolve schema reference ${schema.$ref}.` });
+      errors.push({ path: path6, code: "unsupported_schema_ref", message: `Cannot resolve schema reference ${schema.$ref}.` });
       return;
     }
-    validateNode(resolved, value, path4, root, errors, depth + 1);
+    validateNode(resolved, value, path6, root, errors, depth + 1);
   }
   if (Array.isArray(schema.allOf)) {
     for (const candidate of schema.allOf) {
-      if (isRecord(candidate)) validateNode(candidate, value, path4, root, errors, depth + 1);
+      if (isRecord(candidate)) validateNode(candidate, value, path6, root, errors, depth + 1);
     }
   }
   if (Array.isArray(schema.anyOf) && !schema.anyOf.some((candidate) => candidateMatches(candidate, value, root, depth))) {
-    errors.push({ path: path4, code: "any_of", message: "Value does not match any allowed schema." });
+    errors.push({ path: path6, code: "any_of", message: "Value does not match any allowed schema." });
     return;
   }
   if (Array.isArray(schema.oneOf)) {
     const matches = schema.oneOf.filter((candidate) => candidateMatches(candidate, value, root, depth)).length;
     if (matches !== 1) {
-      errors.push({ path: path4, code: "one_of", message: "Value must match exactly one allowed schema." });
+      errors.push({ path: path6, code: "one_of", message: "Value must match exactly one allowed schema." });
       return;
     }
   }
   if (value === null && schema.nullable === true) return;
   if (Object.prototype.hasOwnProperty.call(schema, "const") && !sameJsonValue(value, schema.const)) {
-    errors.push({ path: path4, code: "const", message: `Value must equal ${JSON.stringify(schema.const)}.` });
+    errors.push({ path: path6, code: "const", message: `Value must equal ${JSON.stringify(schema.const)}.` });
     return;
   }
   if (Array.isArray(schema.enum) && !schema.enum.some((candidate) => sameJsonValue(value, candidate))) {
-    errors.push({ path: path4, code: "enum", message: `Value must be one of ${schema.enum.map((item) => JSON.stringify(item)).join(", ")}.` });
+    errors.push({ path: path6, code: "enum", message: `Value must be one of ${schema.enum.map((item) => JSON.stringify(item)).join(", ")}.` });
     return;
   }
   if (!matchesType(schema.type, value)) {
-    errors.push({ path: path4, code: "type", message: `Expected ${String(schema.type)}.` });
+    errors.push({ path: path6, code: "type", message: `Expected ${String(schema.type)}.` });
     return;
   }
-  if (typeof value === "string") validateString(schema, value, path4, errors);
-  if (typeof value === "number") validateNumber(schema, value, path4, errors);
-  if (Array.isArray(value)) validateArray(schema, value, path4, root, errors, depth);
-  if (isRecord(value)) validateObject(schema, value, path4, root, errors, depth);
+  if (typeof value === "string") validateString(schema, value, path6, errors);
+  if (typeof value === "number") validateNumber(schema, value, path6, errors);
+  if (Array.isArray(value)) validateArray(schema, value, path6, root, errors, depth);
+  if (isRecord(value)) validateObject(schema, value, path6, root, errors, depth);
 }
-function validateObject(schema, value, path4, root, errors, depth) {
+function validateObject(schema, value, path6, root, errors, depth) {
   if (typeof schema.minProperties === "number" && Object.keys(value).length < schema.minProperties) {
-    errors.push({ path: path4, code: "min_properties", message: `Expected at least ${schema.minProperties} properties.` });
+    errors.push({ path: path6, code: "min_properties", message: `Expected at least ${schema.minProperties} properties.` });
   }
   if (typeof schema.maxProperties === "number" && Object.keys(value).length > schema.maxProperties) {
-    errors.push({ path: path4, code: "max_properties", message: `Expected at most ${schema.maxProperties} properties.` });
+    errors.push({ path: path6, code: "max_properties", message: `Expected at most ${schema.maxProperties} properties.` });
   }
   const properties = isRecord(schema.properties) ? schema.properties : {};
   const required = Array.isArray(schema.required) ? schema.required.map(String) : [];
   for (const key of required) {
     if (!Object.prototype.hasOwnProperty.call(value, key)) {
-      errors.push({ path: `${path4}.${key}`, code: "required", message: "Required property is missing." });
+      errors.push({ path: `${path6}.${key}`, code: "required", message: "Required property is missing." });
     }
   }
   if (isRecord(schema.propertyNames)) {
     for (const key of Object.keys(value)) {
-      validateNode(schema.propertyNames, key, `${path4}.${key}`, root, errors, depth + 1);
+      validateNode(schema.propertyNames, key, `${path6}.${key}`, root, errors, depth + 1);
     }
   }
   for (const [key, child] of Object.entries(value)) {
     const childSchema = properties[key];
     if (isRecord(childSchema)) {
-      validateNode(childSchema, child, `${path4}.${key}`, root, errors, depth + 1);
+      validateNode(childSchema, child, `${path6}.${key}`, root, errors, depth + 1);
     } else if (schema.additionalProperties === false) {
-      errors.push({ path: `${path4}.${key}`, code: "additional_property", message: "Property is not declared by the action schema." });
+      errors.push({ path: `${path6}.${key}`, code: "additional_property", message: "Property is not declared by the action schema." });
     } else if (isRecord(schema.additionalProperties)) {
-      validateNode(schema.additionalProperties, child, `${path4}.${key}`, root, errors, depth + 1);
+      validateNode(schema.additionalProperties, child, `${path6}.${key}`, root, errors, depth + 1);
     }
   }
 }
-function validateArray(schema, value, path4, root, errors, depth) {
+function validateArray(schema, value, path6, root, errors, depth) {
   if (typeof schema.minItems === "number" && value.length < schema.minItems) {
-    errors.push({ path: path4, code: "min_items", message: `Expected at least ${schema.minItems} items.` });
+    errors.push({ path: path6, code: "min_items", message: `Expected at least ${schema.minItems} items.` });
   }
   if (typeof schema.maxItems === "number" && value.length > schema.maxItems) {
-    errors.push({ path: path4, code: "max_items", message: `Expected at most ${schema.maxItems} items.` });
+    errors.push({ path: path6, code: "max_items", message: `Expected at most ${schema.maxItems} items.` });
   }
   if (schema.uniqueItems === true) {
     const unique2 = new Set(value.map((item) => JSON.stringify(item)));
-    if (unique2.size !== value.length) errors.push({ path: path4, code: "unique_items", message: "Expected every item to be unique." });
+    if (unique2.size !== value.length) errors.push({ path: path6, code: "unique_items", message: "Expected every item to be unique." });
   }
   if (isRecord(schema.items)) {
-    value.forEach((item, index) => validateNode(schema.items, item, `${path4}[${index}]`, root, errors, depth + 1));
+    value.forEach((item, index) => validateNode(schema.items, item, `${path6}[${index}]`, root, errors, depth + 1));
   }
 }
-function validateString(schema, value, path4, errors) {
+function validateString(schema, value, path6, errors) {
   if (typeof schema.minLength === "number" && value.length < schema.minLength) {
-    errors.push({ path: path4, code: "min_length", message: `Expected at least ${schema.minLength} characters.` });
+    errors.push({ path: path6, code: "min_length", message: `Expected at least ${schema.minLength} characters.` });
   }
   if (typeof schema.maxLength === "number" && value.length > schema.maxLength) {
-    errors.push({ path: path4, code: "max_length", message: `Expected at most ${schema.maxLength} characters.` });
+    errors.push({ path: path6, code: "max_length", message: `Expected at most ${schema.maxLength} characters.` });
   }
   if (typeof schema.pattern === "string") {
     try {
-      if (!new RegExp(schema.pattern).test(value)) errors.push({ path: path4, code: "pattern", message: "Value does not match the required pattern." });
+      if (!new RegExp(schema.pattern).test(value)) errors.push({ path: path6, code: "pattern", message: "Value does not match the required pattern." });
     } catch {
-      errors.push({ path: path4, code: "invalid_schema_pattern", message: "Action schema contains an invalid pattern." });
+      errors.push({ path: path6, code: "invalid_schema_pattern", message: "Action schema contains an invalid pattern." });
     }
   }
-  if (schema.format === "uri" && !isUrl(value)) errors.push({ path: path4, code: "format_uri", message: "Expected an absolute URL." });
-  if (schema.format === "email" && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(value)) errors.push({ path: path4, code: "format_email", message: "Expected an email address." });
-  if (schema.format === "date-time" && !isDateTime(value)) errors.push({ path: path4, code: "format_date_time", message: "Expected an ISO-8601 date-time." });
+  if (schema.format === "uri" && !isUrl(value)) errors.push({ path: path6, code: "format_uri", message: "Expected an absolute URL." });
+  if (schema.format === "email" && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(value)) errors.push({ path: path6, code: "format_email", message: "Expected an email address." });
+  if (schema.format === "date-time" && !isDateTime(value)) errors.push({ path: path6, code: "format_date_time", message: "Expected an ISO-8601 date-time." });
 }
-function validateNumber(schema, value, path4, errors) {
-  if (typeof schema.minimum === "number" && value < schema.minimum) errors.push({ path: path4, code: "minimum", message: `Expected a value of at least ${schema.minimum}.` });
-  if (typeof schema.maximum === "number" && value > schema.maximum) errors.push({ path: path4, code: "maximum", message: `Expected a value of at most ${schema.maximum}.` });
+function validateNumber(schema, value, path6, errors) {
+  if (typeof schema.minimum === "number" && value < schema.minimum) errors.push({ path: path6, code: "minimum", message: `Expected a value of at least ${schema.minimum}.` });
+  if (typeof schema.maximum === "number" && value > schema.maximum) errors.push({ path: path6, code: "maximum", message: `Expected a value of at most ${schema.maximum}.` });
   const exclusiveMinimum = typeof schema.exclusiveMinimum === "number" ? schema.exclusiveMinimum : schema.exclusiveMinimum === true && typeof schema.minimum === "number" ? schema.minimum : null;
   const exclusiveMaximum = typeof schema.exclusiveMaximum === "number" ? schema.exclusiveMaximum : schema.exclusiveMaximum === true && typeof schema.maximum === "number" ? schema.maximum : null;
   if (exclusiveMinimum !== null && value <= exclusiveMinimum) {
-    errors.push({ path: path4, code: "exclusive_minimum", message: `Expected a value greater than ${exclusiveMinimum}.` });
+    errors.push({ path: path6, code: "exclusive_minimum", message: `Expected a value greater than ${exclusiveMinimum}.` });
   }
   if (exclusiveMaximum !== null && value >= exclusiveMaximum) {
-    errors.push({ path: path4, code: "exclusive_maximum", message: `Expected a value less than ${exclusiveMaximum}.` });
+    errors.push({ path: path6, code: "exclusive_maximum", message: `Expected a value less than ${exclusiveMaximum}.` });
   }
   if (typeof schema.multipleOf === "number" && !isMultipleOf(value, schema.multipleOf)) {
-    errors.push({ path: path4, code: "multiple_of", message: `Expected a multiple of ${schema.multipleOf}.` });
+    errors.push({ path: path6, code: "multiple_of", message: `Expected a multiple of ${schema.multipleOf}.` });
   }
 }
 function candidateMatches(candidate, value, root, depth) {
@@ -2845,14 +2843,14 @@ var TopoloClient = class _TopoloClient {
     if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
       throw new TopoloSdkError("action_catalog_summary_unavailable", "Action catalog summary is unavailable.");
     }
-    const record = raw;
-    if (record.algorithm !== "sha256-v1" || typeof record.digest !== "string" || !/^[a-f0-9]{64}$/.test(record.digest) || !Number.isSafeInteger(record.actionCount) || Number(record.actionCount) < 0) {
+    const record2 = raw;
+    if (record2.algorithm !== "sha256-v1" || typeof record2.digest !== "string" || !/^[a-f0-9]{64}$/.test(record2.digest) || !Number.isSafeInteger(record2.actionCount) || Number(record2.actionCount) < 0) {
       throw new TopoloSdkError("action_catalog_summary_unavailable", "Action catalog summary is invalid.");
     }
     return {
       algorithm: "sha256-v1",
-      digest: record.digest,
-      actionCount: Number(record.actionCount)
+      digest: record2.digest,
+      actionCount: Number(record2.actionCount)
     };
   }
   /** @deprecated Prefer searchActions() so callers retain the continuation cursor. */
@@ -2889,22 +2887,22 @@ var TopoloClient = class _TopoloClient {
     if (!match) throw new TopoloSdkError("unknown_action", `Unknown or unavailable Topolo action "${action}".`);
     return match;
   }
-  async callAction(action, input2 = {}, options = {}) {
+  async callAction(action, input3 = {}, options = {}) {
     const entry = await this.getAction(action);
-    return this.executeResolvedAction(entry, input2, options);
+    return this.executeResolvedAction(entry, input3, options);
   }
-  async validateActionInput(action, input2 = {}) {
+  async validateActionInput(action, input3 = {}) {
     const entry = await this.getAction(action);
-    return { action: entry, validation: validateTopoloActionInput(entry.inputSchema, input2) };
+    return { action: entry, validation: validateTopoloActionInput(entry.inputSchema, input3) };
   }
-  async planAction(action, input2 = {}, options = {}) {
+  async planAction(action, input3 = {}, options = {}) {
     const entry = await this.getAction(action);
-    const validation = validateTopoloActionInput(entry.inputSchema, input2);
+    const validation = validateTopoloActionInput(entry.inputSchema, input3);
     const agentAccess = entry.agentAccess ?? (entry.destructive ? "off" : entry.readOnly && !entry.requiresConfirmation ? "auto" : "confirm");
     const confirmationRequired = agentAccess === "confirm" || entry.requiresConfirmation || entry.destructive;
     let request = null;
     if (validation.valid) {
-      const mapped = mapActionInput(entry, input2);
+      const mapped = mapActionInput(entry, input3);
       request = {
         method: entry.method,
         service: entry.appSlug || entry.appId,
@@ -2927,7 +2925,7 @@ var TopoloClient = class _TopoloClient {
       nextActionIds: stringArray(entry.agentContract?.nextActionIds)
     };
   }
-  async readAction(action, input2 = {}, options = {}) {
+  async readAction(action, input3 = {}, options = {}) {
     const entry = await this.getAction(action);
     const agentAccess = entry.agentAccess ?? (entry.destructive ? "off" : entry.readOnly && !entry.requiresConfirmation ? "auto" : "confirm");
     if (!entry.readOnly || entry.destructive || entry.requiresConfirmation || agentAccess !== "auto") {
@@ -2936,9 +2934,9 @@ var TopoloClient = class _TopoloClient {
         entry.requiredPermission ? [entry.requiredPermission] : []
       );
     }
-    return this.executeResolvedAction(entry, input2, options);
+    return this.executeResolvedAction(entry, input3, options);
   }
-  async executeResolvedAction(entry, input2, options) {
+  async executeResolvedAction(entry, input3, options) {
     const agentAccess = entry.agentAccess ?? (entry.destructive ? "off" : entry.readOnly && !entry.requiresConfirmation ? "auto" : "confirm");
     if (agentAccess === "off") {
       throw new TopoloPermissionError(
@@ -2951,14 +2949,14 @@ var TopoloClient = class _TopoloClient {
         `Topolo action "${entry.actionId}" requires { confirm: true } before invocation.`
       );
     }
-    const validation = validateTopoloActionInput(entry.inputSchema, input2);
+    const validation = validateTopoloActionInput(entry.inputSchema, input3);
     if (!validation.valid) {
       throw new TopoloSdkError(
         "invalid_action_input",
         `Topolo action "${entry.actionId}" input is invalid: ${validation.errors.map((issue) => `${issue.path} ${issue.message}`).join("; ")}`
       );
     }
-    const mapped = mapActionInput(entry, input2);
+    const mapped = mapActionInput(entry, input3);
     const service = entry.appSlug || entry.appId;
     return this.request({
       service,
@@ -3050,15 +3048,15 @@ function resolveConfiguredAppId(slug, appIds) {
   }
   return null;
 }
-function normalizeApiKeyResourceMetadata(input2) {
-  if (!isRecord2(input2)) return null;
-  const resourceType = readString(input2.resourceType ?? input2.resource_type);
-  const label = readString(input2.label);
-  const emptyLabel = readString(input2.emptyLabel ?? input2.empty_label);
-  const resourceConcept = readString(input2.resourceConcept ?? input2.resource_concept);
-  const canonicalResourceType = readString(input2.canonicalResourceType ?? input2.canonical_resource_type);
-  const defaultEntitlement = readString(input2.defaultEntitlement ?? input2.default_entitlement);
-  const exceptionPolicy = readString(input2.exceptionPolicy ?? input2.exception_policy);
+function normalizeApiKeyResourceMetadata(input3) {
+  if (!isRecord2(input3)) return null;
+  const resourceType = readString(input3.resourceType ?? input3.resource_type);
+  const label = readString(input3.label);
+  const emptyLabel = readString(input3.emptyLabel ?? input3.empty_label);
+  const resourceConcept = readString(input3.resourceConcept ?? input3.resource_concept);
+  const canonicalResourceType = readString(input3.canonicalResourceType ?? input3.canonical_resource_type);
+  const defaultEntitlement = readString(input3.defaultEntitlement ?? input3.default_entitlement);
+  const exceptionPolicy = readString(input3.exceptionPolicy ?? input3.exception_policy);
   if (!resourceType || !label || !emptyLabel || resourceConcept !== "workspace" || canonicalResourceType !== "workspace" || defaultEntitlement !== "enterprise" || exceptionPolicy !== "app_or_organization") {
     return null;
   }
@@ -3072,11 +3070,11 @@ function normalizeApiKeyResourceMetadata(input2) {
     exceptionPolicy
   };
 }
-function normalizeApiKeyResourceMetadataList(input2) {
-  if (!Array.isArray(input2)) return [];
+function normalizeApiKeyResourceMetadataList(input3) {
+  if (!Array.isArray(input3)) return [];
   const resources = [];
   const seenTypes = /* @__PURE__ */ new Set();
-  for (const item of input2) {
+  for (const item of input3) {
     const resource = normalizeApiKeyResourceMetadata(item);
     if (!resource || seenTypes.has(resource.resourceType)) continue;
     seenTypes.add(resource.resourceType);
@@ -3084,24 +3082,24 @@ function normalizeApiKeyResourceMetadataList(input2) {
   }
   return resources;
 }
-function normalizeBindableResource(input2) {
-  if (!isRecord2(input2)) return null;
-  const resourceType = readString(input2.resourceType ?? input2.resource_type);
-  const resourceId = readString(input2.resourceId ?? input2.resource_id);
+function normalizeBindableResource(input3) {
+  if (!isRecord2(input3)) return null;
+  const resourceType = readString(input3.resourceType ?? input3.resource_type);
+  const resourceId = readString(input3.resourceId ?? input3.resource_id);
   if (!resourceType || !resourceId) return null;
   return {
     resourceType,
     resourceId,
-    label: readOptionalString(input2.label),
-    slug: readOptionalString(input2.slug),
-    status: readOptionalString(input2.status),
-    organizationId: readOptionalString(input2.organizationId ?? input2.organization_id),
-    metadata: isRecord2(input2.metadata) ? input2.metadata : {}
+    label: readOptionalString(input3.label),
+    slug: readOptionalString(input3.slug),
+    status: readOptionalString(input3.status),
+    organizationId: readOptionalString(input3.organizationId ?? input3.organization_id),
+    metadata: isRecord2(input3.metadata) ? input3.metadata : {}
   };
 }
-function normalizeResourceBindings(input2) {
-  if (!Array.isArray(input2)) return [];
-  return input2.flatMap((binding) => {
+function normalizeResourceBindings(input3) {
+  if (!Array.isArray(input3)) return [];
+  return input3.flatMap((binding) => {
     if (!isRecord2(binding)) return [];
     const resourceType = readString(binding.resourceType ?? binding.resource_type);
     const resourceId = readString(binding.resourceId ?? binding.resource_id);
@@ -3227,8 +3225,8 @@ function normalizeActionCatalogEntry(item) {
   const name = pickActionString(a.name);
   const appId = pickActionString(a.app_id) ?? pickActionString(a.appId);
   const method = pickActionString(a.method)?.toUpperCase();
-  const path4 = pickActionString(a.path);
-  if (!actionId || !name || !appId || !method || !path4 || !isHttpMethod(method)) {
+  const path6 = pickActionString(a.path);
+  if (!actionId || !name || !appId || !method || !path6 || !isHttpMethod(method)) {
     return null;
   }
   return {
@@ -3243,7 +3241,7 @@ function normalizeActionCatalogEntry(item) {
     appSlug: pickActionString(a.app_slug) ?? pickActionString(a.appSlug) ?? null,
     appName: pickActionString(a.app_name) ?? pickActionString(a.appName) ?? null,
     method,
-    path: path4,
+    path: path6,
     permissionName: pickActionString(a.permission_name) ?? pickActionString(a.permissionName) ?? "",
     requiredPermission: pickActionString(a.required_permission) ?? pickActionString(a.requiredPermission) ?? "",
     authorizationMode: pickAuthorizationMode(a.authorization_mode ?? a.authorizationMode),
@@ -3277,9 +3275,9 @@ function plainObject(value) {
 function stringArray(value) {
   return Array.isArray(value) ? value.map((item) => String(item || "").trim()).filter(Boolean) : [];
 }
-function mapActionInput(action, input2) {
-  const remaining = { ...input2 || {} };
-  const path4 = action.path.replace(/\{([a-zA-Z0-9_]+)\}/g, (_match, key) => {
+function mapActionInput(action, input3) {
+  const remaining = { ...input3 || {} };
+  const path6 = action.path.replace(/\{([a-zA-Z0-9_]+)\}/g, (_match, key) => {
     const value = remaining[key];
     if (value === void 0 || value === null || value === "") {
       throw new TopoloSdkError(
@@ -3296,14 +3294,14 @@ function mapActionInput(action, input2) {
   delete remaining.body;
   if (action.method === "GET") {
     return {
-      path: path4,
+      path: path6,
       query: objectToQuery({ ...remaining, ...explicitQuery })
     };
   }
   const query = objectToQuery(explicitQuery);
   const body = explicitBody !== void 0 ? explicitBody : remaining;
   return {
-    path: path4,
+    path: path6,
     ...query ? { query } : {},
     body
   };
@@ -3473,8 +3471,8 @@ var TopoloOAuth = class {
     if (params.clientSecret) body.set("client_secret", params.clientSecret);
     return this.#postForm("/api/developer-oauth/token", body);
   }
-  async #postForm(path4, body) {
-    const url = new URL(path4, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
+  async #postForm(path6, body) {
+    const url = new URL(path6, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
     const res = await this.fetchImpl(url.toString(), {
       method: "POST",
       headers: {
@@ -3490,7 +3488,7 @@ var TopoloOAuth = class {
         const err = parsed;
         throw new TopoloAuthError(err.error_description || err.error, err.error);
       }
-      throw new TopoloHttpError("auth", path4, res.status, parsed);
+      throw new TopoloHttpError("auth", path6, res.status, parsed);
     }
     return parsed;
   }
@@ -3528,13 +3526,13 @@ var TopoloHttpError2 = class extends TopoloSdkError2 {
   body;
   service;
   path;
-  constructor(service, path4, status, body, message) {
-    super("http_error", message ?? `HTTP ${status} from ${service}${path4}`);
+  constructor(service, path6, status, body, message) {
+    super("http_error", message ?? `HTTP ${status} from ${service}${path6}`);
     this.name = "TopoloHttpError";
     this.status = status;
     this.body = body;
     this.service = service;
-    this.path = path4;
+    this.path = path6;
   }
 };
 var APP_API_URLS2 = {
@@ -3665,8 +3663,8 @@ var TopoloOAuth2 = class {
     if (params.clientSecret) body.set("client_secret", params.clientSecret);
     return this.#postForm("/api/developer-oauth/token", body);
   }
-  async #postForm(path4, body) {
-    const url = new URL(path4, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
+  async #postForm(path6, body) {
+    const url = new URL(path6, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
     const res = await this.fetchImpl(url.toString(), {
       method: "POST",
       headers: {
@@ -3682,7 +3680,7 @@ var TopoloOAuth2 = class {
         const err = parsed;
         throw new TopoloAuthError2(err.error_description || err.error, err.error);
       }
-      throw new TopoloHttpError2("auth", path4, res.status, parsed);
+      throw new TopoloHttpError2("auth", path6, res.status, parsed);
     }
     return parsed;
   }
@@ -3712,22 +3710,22 @@ function configPath() {
   return join(base, "topolo", "config.json");
 }
 async function readConfig() {
-  const path4 = configPath();
-  if (!existsSync(path4)) return {};
+  const path6 = configPath();
+  if (!existsSync(path6)) return {};
   try {
-    const raw = await readFile(path4, "utf8");
+    const raw = await readFile(path6, "utf8");
     return JSON.parse(raw);
   } catch {
     return {};
   }
 }
 async function writeConfig(config) {
-  const path4 = configPath();
-  await mkdir(dirname(path4), { recursive: true });
-  await writeFile(path4, JSON.stringify(config, null, 2) + "\n", "utf8");
+  const path6 = configPath();
+  await mkdir(dirname(path6), { recursive: true });
+  await writeFile(path6, JSON.stringify(config, null, 2) + "\n", "utf8");
   if (platform() !== "win32") {
     try {
-      await chmod(path4, 384);
+      await chmod(path6, 384);
     } catch {
     }
   }
@@ -4023,13 +4021,14 @@ function normalizeError(err) {
     const hintMap = {
       auth_error: "Run `topolo auth login` or set TOPOLO_API_KEY.",
       confirmation_required: "Review the action and rerun with --confirm to allow it.",
-      permission_denied: "Check your API key scopes or role assignments in TopoloDevelopers."
+      permission_denied: "Check your API key scopes or role assignments in TopoloDevelopers.",
+      immutable_drift: "Restore the manifest identity fields to the registered values; immutable ids cannot be updated."
     };
     return {
       message: err.message,
       code,
       hint: code ? hintMap[code] : void 0,
-      exitCode: code === "auth_error" || code === "confirmation_required" ? 2 : code === "permission_denied" ? 3 : 1
+      exitCode: code === "auth_error" || code === "confirmation_required" ? 2 : code === "permission_denied" ? 3 : code === "immutable_drift" ? 4 : 1
     };
   }
   return { message: String(err), exitCode: 1 };
@@ -4046,9 +4045,9 @@ function readCliVersion() {
       join2(here, "package.json"),
       join2(here, "..", "package.json")
     ];
-    for (const path4 of candidates) {
+    for (const path6 of candidates) {
       try {
-        const pkg = JSON.parse(readFileSync(path4, "utf8"));
+        const pkg = JSON.parse(readFileSync(path6, "utf8"));
         if (typeof pkg.version === "string" && pkg.version) return pkg.version;
       } catch {
       }
@@ -4407,7 +4406,7 @@ function registerApiCommand(program2) {
     "-q, --query <kv...>",
     "Query params as key=value (repeatable), e.g. --query source=cli page=2"
   ).option("--resource-type <type>", "Cataloged app-local workspace resource alias for resource-scoped API keys").option("--resource-id <id>", "Workspace resource id for resource-scoped API keys").option("--confirm", "Acknowledge a mutating request").option("--json", "Output JSON", true).option("--no-json", "Output human-readable text").action(
-    async (service, method, path4, opts) => {
+    async (service, method, path6, opts) => {
       const mode = resolveOutputMode(opts.json);
       try {
         const upperMethod = method.toUpperCase();
@@ -4446,7 +4445,7 @@ function registerApiCommand(program2) {
         const result = await topolo.client.request({
           service,
           method: httpMethod,
-          path: path4,
+          path: path6,
           body,
           ...query ? { query } : {},
           ...resource ? { resource } : {},
@@ -4539,9 +4538,9 @@ function registerActionsCommand(program2) {
       if (!topolo) {
         throw new Error("No credential configured. Run `topolo auth login` or set TOPOLO_API_KEY.");
       }
-      const input2 = parseJsonObject(opts.data || "{}");
+      const input3 = parseJsonObject(opts.data || "{}");
       const resource = parseResourceOption(opts.resourceType, opts.resourceId);
-      const result = await topolo.client.callAction(action, input2, {
+      const result = await topolo.client.callAction(action, input3, {
         confirm: opts.confirm === true,
         ...resource ? { resource } : {}
       });
@@ -4610,13 +4609,13 @@ async function requiredClient() {
 function parseJsonObject(value) {
   let source = value;
   if (value.startsWith("@")) {
-    const path4 = value.slice(1);
-    if (!path4) throw new Error("--data @file path must not be empty");
+    const path6 = value.slice(1);
+    if (!path6) throw new Error("--data @file path must not be empty");
     try {
-      source = readFileSync2(path4, "utf8");
+      source = readFileSync2(path6, "utf8");
     } catch (err) {
       const detail = err instanceof Error ? err.message : String(err);
-      throw new Error(`Could not read --data file ${path4}: ${detail}`);
+      throw new Error(`Could not read --data file ${path6}: ${detail}`);
     }
   }
   let parsed;
@@ -4690,8 +4689,8 @@ function formatActionPlan(plan) {
 
 // src/commands/apps.ts
 import { execSync } from "child_process";
-import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync4, writeFileSync } from "fs";
-import path2 from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
+import path4 from "path";
 
 // src/commands/app-audit-local.ts
 import {
@@ -5282,8 +5281,8 @@ function enrichFinding(application, finding2, evidence) {
           evidence: verificationEvidence
         });
       }
-      const usesNodeCheck = evidence.packageJsons.some((record) => {
-        const scripts = record.packageJson.scripts ?? {};
+      const usesNodeCheck = evidence.packageJsons.some((record2) => {
+        const scripts = record2.packageJson.scripts ?? {};
         return Object.values(scripts).some((cmd) => typeof cmd === "string" && /node\s+--check/.test(cmd));
       });
       if (hasBuild && usesNodeCheck) {
@@ -5549,35 +5548,35 @@ function verificationEvidenceFor(evidence) {
     "test:auth-contract": "test",
     validate: "validate"
   };
-  for (const record of evidence.packageJsons) {
-    const scripts = record.packageJson.scripts ?? {};
-    const isRootPackage = record.path === evidence.packageJsonPath;
+  for (const record2 of evidence.packageJsons) {
+    const scripts = record2.packageJson.scripts ?? {};
+    const isRootPackage = record2.path === evidence.packageJsonPath;
     const seenCanonical = /* @__PURE__ */ new Set();
     for (const [scriptName, canonical] of Object.entries(scriptAliases)) {
       if (!scripts[scriptName]) continue;
       if (seenCanonical.has(canonical)) continue;
       seenCanonical.add(canonical);
-      items.push(isRootPackage ? `script=${canonical}` : `script=${packageLabel(record)}:${canonical}`);
+      items.push(isRootPackage ? `script=${canonical}` : `script=${packageLabel(record2)}:${canonical}`);
     }
   }
   return unique(items);
 }
 function dependencyNames(evidence) {
   return new Set(
-    evidence.packageJsons.flatMap((record) => [
-      ...Object.keys(record.packageJson.dependencies ?? {}),
-      ...Object.keys(record.packageJson.devDependencies ?? {}),
-      ...Object.keys(record.packageJson.peerDependencies ?? {})
+    evidence.packageJsons.flatMap((record2) => [
+      ...Object.keys(record2.packageJson.dependencies ?? {}),
+      ...Object.keys(record2.packageJson.devDependencies ?? {}),
+      ...Object.keys(record2.packageJson.peerDependencies ?? {})
     ])
   );
 }
 function packageDependencyVersions(evidence, packageName) {
   return unique(
-    evidence.packageJsons.flatMap((record) => {
+    evidence.packageJsons.flatMap((record2) => {
       const specs = [
-        record.packageJson.dependencies?.[packageName],
-        record.packageJson.devDependencies?.[packageName],
-        record.packageJson.peerDependencies?.[packageName]
+        record2.packageJson.dependencies?.[packageName],
+        record2.packageJson.devDependencies?.[packageName],
+        record2.packageJson.peerDependencies?.[packageName]
       ];
       return specs.filter((spec) => typeof spec === "string");
     })
@@ -5703,8 +5702,8 @@ function collectPackageJsons(root) {
 function readPackageJson(filePath) {
   return readJson(filePath);
 }
-function packageLabel(record) {
-  return record.packageJson.name ?? relativeTopoloPath(path.dirname(record.path));
+function packageLabel(record2) {
+  return record2.packageJson.name ?? relativeTopoloPath(path.dirname(record2.path));
 }
 function sortedDirEntries(dir) {
   return readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
@@ -5793,14 +5792,14 @@ import { constants } from "fs";
 import { access } from "fs/promises";
 import { relative, resolve } from "path";
 function normalizeHomePath(value) {
-  const path4 = String(value || "/dashboard").trim();
-  if (!path4.startsWith("/") || path4.startsWith("//") || /[?#]/.test(path4)) {
+  const path6 = String(value || "/dashboard").trim();
+  if (!path6.startsWith("/") || path6.startsWith("//") || /[?#]/.test(path6)) {
     throw new Error("Invalid home path. Use an absolute application path such as /dashboard.");
   }
-  if (["/", "/login", "/auth/callback", "/getting-started"].includes(path4)) {
+  if (["/", "/login", "/auth/callback", "/getting-started"].includes(path6)) {
     throw new Error("Home path must be a protected product route, not a reserved entry route.");
   }
-  return path4.replace(/\/$/, "") || "/dashboard";
+  return path6.replace(/\/$/, "") || "/dashboard";
 }
 function normalizeHomeLabel(value) {
   const label = String(value || "Dashboard").trim();
@@ -5941,9 +5940,9 @@ function toTitle(value) {
 function json(value) {
   return JSON.stringify(value, null, 2);
 }
-async function pathExists(path4) {
+async function pathExists(path6) {
   try {
-    await access(path4, constants.F_OK);
+    await access(path6, constants.F_OK);
     return true;
   } catch {
     return false;
@@ -6479,11 +6478,20 @@ function appIdentityTs(application) {
     "}",
     "",
     "export function getBrowserAuthBaseUrl(): string {",
-    "  const defaultAuthUrl =",
-    "    typeof window !== 'undefined' && window.location.hostname.endsWith('.stg.topolo.us')",
-    "      ? 'https://auth.stg.topolo.us'",
-    "      : 'https://auth.topolo.app';",
-    "  return (import.meta.env.VITE_TOPOLO_AUTH_URL || defaultAuthUrl).replace(/\\/+$/, '');",
+    "  // A declared URL always wins; deployed builds set VITE_TOPOLO_AUTH_URL in",
+    "  // their per-environment build commands, so the host map below only covers",
+    "  // platform domains. Anything else fails loudly \u2014 an unknown host",
+    "  // (localhost, workers.dev previews) must never silently authenticate",
+    "  // against production Auth.",
+    "  const declared = import.meta.env.VITE_TOPOLO_AUTH_URL;",
+    "  if (declared) return declared.replace(/\\/+$/, '');",
+    "  const hostname = typeof window !== 'undefined' ? window.location.hostname : '';",
+    "  if (hostname.endsWith('.stg.topolo.us')) return 'https://auth.stg.topolo.us';",
+    "  if (hostname.endsWith('.topolo.dev')) return 'https://auth.topolo.dev';",
+    "  if (hostname.endsWith('.topolo.app')) return 'https://auth.topolo.app';",
+    "  throw new Error(",
+    "    `VITE_TOPOLO_AUTH_URL must be set for host \"${hostname || 'non-browser context'}\" \u2014 refusing to default to production Auth.`,",
+    "  );",
     "}",
     "",
     "// Canonical browser app id. index.html bakes %VITE_TOPOLO_APP_ID% into",
@@ -7218,7 +7226,12 @@ import { createAccountLinkPayload, createTopoloAuthorizationUrl, exchangeTopoloC
 
 type AuthState = 'ready' | 'missing_client' | 'authorizing' | 'authenticated' | 'error';
 const APP_NAME = '${escapeSingleQuoted(appName)}';
-const AUTH_URL = import.meta.env.VITE_TOPOLO_AUTH_URL ?? import.meta.env.VITE_TOPOLO_AUTH_BASE_URL ?? 'https://auth.topolo.app';
+// Environment-aware default: hardcoding the production host would point a
+// staging build at prod Auth whenever the VITE_ vars were dropped.
+const DEFAULT_AUTH_URL = window.location.hostname.endsWith('.stg.topolo.us')
+  ? 'https://auth.stg.topolo.us'
+  : 'https://auth.topolo.app';
+const AUTH_URL = import.meta.env.VITE_TOPOLO_AUTH_URL ?? import.meta.env.VITE_TOPOLO_AUTH_BASE_URL ?? DEFAULT_AUTH_URL;
 const CLIENT_ID = import.meta.env.VITE_TOPOLO_CLIENT_ID || '${defaultClientId}';
 const REDIRECT_URI = import.meta.env.VITE_TOPOLO_REDIRECT_URI || \`\${window.location.origin}/auth/callback\`;
 const REQUESTED_SCOPES = (import.meta.env.VITE_TOPOLO_SCOPES || 'openid profile email organization:read entitlements:read').split(/[\\s,]+/).filter(Boolean);
@@ -7317,235 +7330,6 @@ function webWorkerTs(application, api) {
     ""
   ].join("\n");
 }
-function platformWebWranglerToml(application, api) {
-  const slug = toSlug(application.id);
-  const host = application.productionUrl ? new URL(application.productionUrl).host : `${slug}.topolo.app`;
-  return [
-    `name = "topolo-${slug}"`,
-    'main = "src/worker.ts"',
-    `compatibility_date = "${CLOUDFLARE_COMPATIBILITY_DATE}"`,
-    'compatibility_flags = ["nodejs_compat"]',
-    `account_id = "${CLOUDFLARE_ACCOUNT_ID}"`,
-    "workers_dev = false",
-    "",
-    "[assets]",
-    'directory = "./dist"',
-    'binding = "ASSETS"',
-    'not_found_handling = "single-page-application"',
-    ...api ? ['run_worker_first = ["/api/*"]'] : [],
-    "",
-    "[observability]",
-    "enabled = true",
-    "",
-    "[[routes]]",
-    `pattern = "${host}"`,
-    "custom_domain = true",
-    "",
-    "[vars]",
-    `APP_ID = "${application.appId ?? ""}"`,
-    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
-    "",
-    ...api ? [
-      "[[services]]",
-      'binding = "API"',
-      `service = "topolo-${slug}-api"`,
-      ""
-    ] : [],
-    "[env.development]",
-    `name = "topolo-${slug}-development"`,
-    `account_id = "${DEVELOPMENT_CLOUDFLARE_ACCOUNT_ID}"`,
-    "workers_dev = true",
-    "",
-    "[env.development.vars]",
-    `APP_ID = "${application.appId ?? ""}"`,
-    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
-    "",
-    "[[env.development.routes]]",
-    `pattern = "${slug}.topolo.dev"`,
-    "custom_domain = true",
-    "",
-    "[env.development.assets]",
-    'directory = "./dist"',
-    'binding = "ASSETS"',
-    'not_found_handling = "single-page-application"',
-    ...api ? ['run_worker_first = ["/api/*"]'] : [],
-    "",
-    ...api ? [
-      "[[env.development.services]]",
-      'binding = "API"',
-      `service = "topolo-${slug}-api-development"`,
-      ""
-    ] : [],
-    "[env.staging]",
-    `name = "topolo-${slug}-staging"`,
-    `account_id = "${STAGING_CLOUDFLARE_ACCOUNT_ID}"`,
-    "workers_dev = true",
-    "",
-    "[env.staging.vars]",
-    `APP_ID = "${application.appId ?? ""}"`,
-    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
-    "",
-    "[[env.staging.routes]]",
-    `pattern = "${slug}.stg.topolo.us"`,
-    "custom_domain = true",
-    "",
-    "[env.staging.assets]",
-    'directory = "./dist"',
-    'binding = "ASSETS"',
-    'not_found_handling = "single-page-application"',
-    ...api ? ['run_worker_first = ["/api/*"]'] : [],
-    "",
-    ...api ? [
-      "[[env.staging.services]]",
-      'binding = "API"',
-      `service = "topolo-${slug}-api-staging"`,
-      ""
-    ] : [],
-    "[env.production]",
-    `name = "topolo-${slug}-production"`,
-    `account_id = "${CLOUDFLARE_ACCOUNT_ID}"`,
-    "workers_dev = false",
-    "",
-    "[env.production.vars]",
-    `APP_ID = "${application.appId ?? ""}"`,
-    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
-    "",
-    "[[env.production.routes]]",
-    `pattern = "${host}"`,
-    "custom_domain = true",
-    "",
-    "[env.production.assets]",
-    'directory = "./dist"',
-    'binding = "ASSETS"',
-    'not_found_handling = "single-page-application"',
-    ...api ? ['run_worker_first = ["/api/*"]'] : [],
-    "",
-    ...api ? [
-      "[[env.production.services]]",
-      'binding = "API"',
-      `service = "topolo-${slug}-api-production"`,
-      ""
-    ] : []
-  ].join("\n");
-}
-function platformApiWranglerToml(application, resources, profile) {
-  const slug = toSlug(application.id);
-  const resource = resourceConfig(application, profile);
-  const lines = [
-    `name = "topolo-${slug}-api"`,
-    'main = "src/worker.ts"',
-    `compatibility_date = "${CLOUDFLARE_COMPATIBILITY_DATE}"`,
-    'compatibility_flags = ["nodejs_compat"]',
-    `account_id = "${CLOUDFLARE_ACCOUNT_ID}"`,
-    "workers_dev = true",
-    "",
-    "[observability]",
-    "enabled = true",
-    "",
-    "[vars]",
-    'AUTH_BASE_URL = "https://auth.topolo.app"',
-    'NEXUS_GATEWAY_URL = "https://nexus.topolo.app"',
-    `NEXUS_APP_ID = "${slug}"`,
-    `APP_ID = "${application.appId ?? ""}"`,
-    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
-    ""
-  ];
-  appendResourceWranglerBlocks(lines, resources, resource, "production");
-  lines.push(
-    "[env.development]",
-    `name = "topolo-${slug}-api-development"`,
-    `account_id = "${DEVELOPMENT_CLOUDFLARE_ACCOUNT_ID}"`,
-    "workers_dev = true",
-    "",
-    "[env.development.vars]",
-    'AUTH_BASE_URL = "https://auth.topolo.dev"',
-    'NEXUS_GATEWAY_URL = "https://nexus.topolo.dev"',
-    `NEXUS_APP_ID = "${slug}"`,
-    `APP_ID = "${application.appId ?? ""}"`,
-    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
-    'ENVIRONMENT = "development"',
-    ""
-  );
-  appendResourceWranglerBlocks(lines, resources, resource, "development");
-  lines.push(
-    "[env.staging]",
-    `name = "topolo-${slug}-api-staging"`,
-    `account_id = "${STAGING_CLOUDFLARE_ACCOUNT_ID}"`,
-    "workers_dev = true",
-    "",
-    "[env.staging.vars]",
-    'AUTH_BASE_URL = "https://auth.stg.topolo.us"',
-    'NEXUS_GATEWAY_URL = "https://nexus.stg.topolo.us"',
-    `NEXUS_APP_ID = "${slug}"`,
-    `APP_ID = "${application.appId ?? ""}"`,
-    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
-    ""
-  );
-  appendResourceWranglerBlocks(lines, resources, resource, "staging");
-  lines.push(
-    "[env.production]",
-    `name = "topolo-${slug}-api-production"`,
-    `account_id = "${CLOUDFLARE_ACCOUNT_ID}"`,
-    "workers_dev = false",
-    "",
-    "[env.production.vars]",
-    'AUTH_BASE_URL = "https://auth.topolo.app"',
-    'NEXUS_GATEWAY_URL = "https://nexus.topolo.app"',
-    `NEXUS_APP_ID = "${slug}"`,
-    `APP_ID = "${application.appId ?? ""}"`,
-    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
-    ""
-  );
-  appendResourceWranglerBlocks(lines, resources, resource, "production-env");
-  return lines.join("\n");
-}
-function appendResourceWranglerBlocks(lines, resources, resource, environment) {
-  const prefix = environment === "staging" ? "env.staging." : environment === "development" ? "env.development." : environment === "production-env" ? "env.production." : "";
-  const envName = environment === "staging" ? "Staging" : environment === "development" ? "Development" : "Production";
-  const pick = (dev, staging, prod) => environment === "development" ? dev : environment === "staging" ? staging : prod;
-  if (resources.d1) {
-    lines.push(
-      `[[${prefix}d1_databases]]`,
-      `binding = "${resource.d1Binding}"`,
-      `database_name = "${pick(resource.d1DevelopmentName, resource.d1StagingName, resource.d1ProductionName)}"`,
-      'database_id = "provision-after-scaffold"',
-      'migrations_dir = "migrations"',
-      ""
-    );
-  }
-  if (resources.r2) {
-    lines.push(
-      `[[${prefix}r2_buckets]]`,
-      `binding = "${resource.r2Binding}"`,
-      `bucket_name = "${pick(resource.r2DevelopmentName, resource.r2StagingName, resource.r2ProductionName)}"`,
-      ""
-    );
-  }
-  if (resources.queue) {
-    lines.push(
-      `[[${prefix}queues.producers]]`,
-      `binding = "${resource.queueBinding}"`,
-      `queue = "${pick(resource.queueDevelopmentName, resource.queueStagingName, resource.queueProductionName)}"`,
-      "",
-      `[[${prefix}queues.consumers]]`,
-      `queue = "${pick(resource.queueDevelopmentName, resource.queueStagingName, resource.queueProductionName)}"`,
-      ""
-    );
-  }
-  if (resources.workflow) {
-    lines.push(
-      `[[${prefix}workflows]]`,
-      `binding = "${resource.workflowBinding}"`,
-      `name = "${pick(resource.workflowDevelopmentName, resource.workflowStagingName, resource.workflowProductionName)}"`,
-      `class_name = "${resource.workflowClassName}"`,
-      ""
-    );
-  }
-  if (resources.containerProcessing) {
-    lines.push(`# ${envName} container metadata is declared in topolo.app.json and topolo.cloudcontrol.json.`);
-    lines.push("");
-  }
-}
 function wranglerToml(application, target, resources, profile) {
   const slug = toSlug(application.id);
   const workerName = target === "platform" ? `topolo-${slug}` : application.packageName;
@@ -7765,7 +7549,10 @@ function platformWorkerTs(application, options) {
     "  // Auth verification base URL is environment-driven (staging/prod/dev),",
     "  // so rt.verifyAuth() targets the correct Auth service per deploy.",
     "  authBaseUrl: (env) => env.AUTH_BASE_URL,",
-    "  authGateway: { enabled: false },",
+    "  // The runtime's /api/auth/* gateway serves the app-switcher catalog,",
+    "  // preferences, and theme for the shared app shell \u2014 it must run before",
+    "  // the app's own auth so unentitled users still get the switcher.",
+    "  authGateway: { enabled: true },",
     "  actionContracts: topoloActionContracts,",
     "});",
     "",
@@ -7918,8 +7705,13 @@ function developerWorkerTs(application) {
     "  const token = authHeader.startsWith('Bearer ') ? authHeader.slice(7) : null;",
     "  if (!token) return { ok: false, status: 401, error: 'Bearer token required' };",
     "",
+    "  // Fail loudly: defaulting to the production Auth host here would let a",
+    "  // misconfigured staging/dev worker validate tokens against prod. The",
+    "  // manifest declares AUTH_BASE_URL for every environment.",
+    "  if (!env.AUTH_BASE_URL) return { ok: false, status: 500, error: 'AUTH_BASE_URL not configured' };",
+    "",
     "  try {",
-    "    const authBaseUrl = env.AUTH_BASE_URL || 'https://auth.topolo.app';",
+    "    const authBaseUrl = env.AUTH_BASE_URL;",
     "    const response = await fetch(`${authBaseUrl}/validate`, {",
     "      method: 'POST',",
     "      headers: {",
@@ -7949,6 +7741,72 @@ function developerWorkerTs(application) {
   ].join("\n");
 }
 
+// src/commands/app-scaffold-generate.ts
+import { existsSync as existsSync3, mkdirSync, mkdtempSync, readFileSync as readFileSync4, rmSync, writeFileSync } from "fs";
+import { spawnSync } from "child_process";
+import { tmpdir } from "os";
+import path2 from "path";
+function resolveGeneratorPath() {
+  const candidates = [
+    // Published CLI: vendored alongside dist/index.js at build time.
+    new URL("./generate-wrangler.mjs", import.meta.url),
+    // In-repo (tests, `pnpm dev`): the platform's canonical copy, which is the
+    // very file the vendor step copies.
+    new URL("../../../../tooling/generate-wrangler.mjs", import.meta.url)
+  ];
+  for (const candidate of candidates) {
+    const p = decodeURIComponent(candidate.pathname);
+    if (existsSync3(p)) return p;
+  }
+  throw new Error(
+    `topolo: could not locate generate-wrangler.mjs. A published CLI vendors it into dist/ at build time; in-repo it is read from topolo-platform/tooling/. Looked in:
+${candidates.map((c) => `  ${decodeURIComponent(c.pathname)}`).join("\n")}`
+  );
+}
+var GENERATED = {
+  purpose: "GENERATED from topolo.app.json by topolo-platform/tooling/generate-wrangler.mjs \u2014 never hand-edit.",
+  requiredSignals: [
+    "byte-identical to what generate-wrangler emits for this manifest",
+    "every change is made in topolo.app.json, never here"
+  ]
+};
+function deriveGeneratedConfigs(files, base) {
+  const generator = resolveGeneratorPath();
+  const root = mkdtempSync(path2.join(tmpdir(), "topolo-scaffold-generate-"));
+  try {
+    const prefix = `${base}/`;
+    for (const file of files) {
+      if (!file.path.startsWith(prefix)) continue;
+      const abs = path2.join(root, file.path.slice(prefix.length));
+      mkdirSync(path2.dirname(abs), { recursive: true });
+      writeFileSync(abs, file.content, "utf8");
+    }
+    const result = spawnSync(
+      process.execPath,
+      [generator, `--manifest=${path2.join(root, "topolo.app.json")}`],
+      { cwd: root, encoding: "utf8" }
+    );
+    if (result.status !== 0) {
+      throw new Error(
+        `topolo: generate-wrangler failed for the scaffolded manifest (exit ${result.status}).
+${result.stdout ?? ""}${result.stderr ?? ""}`
+      );
+    }
+    const written = [...(result.stdout ?? "").matchAll(/^\[generate\] wrote (.+)$/gm)].map((m) => (m[1] ?? "").trim()).filter(Boolean);
+    if (!written.length) {
+      throw new Error(`topolo: generate-wrangler wrote no files.
+${result.stdout ?? ""}`);
+    }
+    return written.map((rel) => ({
+      path: `${base}/${rel}`,
+      ...GENERATED,
+      content: readFileSync4(path2.join(root, rel), "utf8")
+    }));
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+}
+
 // src/commands/app-scaffold-workflows.ts
 function scaffoldCommands(options) {
   const scaffoldId = toSlug(options.id);
@@ -8112,6 +7970,10 @@ function topoloAppManifestJson(application, options) {
       bindings.d1 = [
         {
           binding: resource.d1Binding,
+          development: {
+            databaseName: resource.d1DevelopmentName,
+            databaseId: "provision-after-scaffold"
+          },
           staging: {
             databaseName: resource.d1StagingName,
             databaseId: "provision-after-scaffold"
@@ -8128,26 +7990,29 @@ function topoloAppManifestJson(application, options) {
       bindings.r2 = [
         {
           binding: resource.r2Binding,
+          development: { bucketName: resource.r2DevelopmentName },
           staging: { bucketName: resource.r2StagingName },
           production: { bucketName: resource.r2ProductionName }
         }
       ];
     }
     if (options.resources.queue) {
-      bindings.queues = [
-        {
-          binding: resource.queueBinding,
-          staging: { queueName: resource.queueStagingName },
-          production: { queueName: resource.queueProductionName },
-          consumer: true
-        }
-      ];
+      const queue = {
+        development: { queue: resource.queueDevelopmentName },
+        staging: { queue: resource.queueStagingName },
+        production: { queue: resource.queueProductionName }
+      };
+      bindings.queues = {
+        producers: [{ binding: resource.queueBinding, ...queue }],
+        consumers: [{ ...queue }]
+      };
     }
     if (options.resources.workflow) {
       bindings.workflows = [
         {
           binding: resource.workflowBinding,
           className: resource.workflowClassName,
+          development: { name: resource.workflowDevelopmentName },
           staging: { name: resource.workflowStagingName },
           production: { name: resource.workflowProductionName }
         }
@@ -8161,53 +8026,67 @@ function topoloAppManifestJson(application, options) {
       compatibilityFlags: ["nodejs_compat"],
       healthcheckPath: "/api/health",
       vars: {
+        // Every environment the manifest declares must be listed. A per-env map
+        // that omits one leaves that env with no value, and both of these fall
+        // back to PRODUCTION when unset (@topolo-io/nexus-client defaults
+        // gatewayUrl to https://nexus.topolo.app) — a staging or dev worker
+        // silently talking to prod.
         AUTH_BASE_URL: {
+          development: "https://auth.topolo.dev",
           staging: "https://auth.stg.topolo.us",
           production: "https://auth.topolo.app"
         },
         NEXUS_GATEWAY_URL: {
+          development: "https://nexus.topolo.dev",
           staging: "https://nexus.stg.topolo.us",
           production: "https://nexus.topolo.app"
-        },
-        NEXUS_APP_ID: slug
+        }
+        // No NEXUS_APP_ID: generate-wrangler binds APP_ID (the app_id) into every
+        // env, and worker-runtime reads env.APP_ID for Nexus usage attribution,
+        // so a second copy of the same identity would only be a chance to drift.
+        // It previously carried the SLUG, which reads as a working identity while
+        // Nexus attributes by app_id.
       },
       secrets: ["TOPOLO_SERVICE_CLIENT_SECRET"],
       ...Object.keys(bindings).length ? { bindings } : {}
     };
   }
-  targets.web = {
-    kind: "worker",
-    dir: "apps/web",
-    wranglerName: `topolo-${slug}`,
-    subdomain: slug,
-    main: "src/worker.ts",
-    workersDev: false,
-    assets: {
-      directory: "./dist",
-      binding: "ASSETS",
-      notFoundHandling: "single-page-application",
-      runWorkerFirst: ["/api/*"]
-    },
-    compatibilityFlags: ["nodejs_compat"],
-    buildCommand: {
-      staging: "cd ../.. && DEPLOY_ENVIRONMENT=staging VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us pnpm run build",
-      production: "cd ../.. && DEPLOY_ENVIRONMENT=production VITE_TOPOLO_AUTH_URL=https://auth.topolo.app pnpm run build"
-    },
-    healthcheckPath: options.api ? "/api/health" : "/",
-    ...options.api ? {
-      bindings: {
-        services: [
-          {
-            binding: "API",
-            service: {
-              staging: `topolo-${slug}-api-staging`,
-              production: `topolo-${slug}-api-production`
+  if (options.browser) {
+    targets.web = {
+      kind: "worker",
+      dir: "apps/web",
+      wranglerName: `topolo-${slug}`,
+      subdomain: slug,
+      main: "src/worker.ts",
+      workersDev: false,
+      assets: {
+        directory: "./dist",
+        binding: "ASSETS",
+        notFoundHandling: "single-page-application",
+        // Only meaningful when there is an API Worker to run first.
+        ...options.api ? { runWorkerFirst: ["/api/*"] } : {}
+      },
+      compatibilityFlags: ["nodejs_compat"],
+      buildCommand: {
+        staging: "cd ../.. && DEPLOY_ENVIRONMENT=staging VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us pnpm run build",
+        production: "cd ../.. && DEPLOY_ENVIRONMENT=production VITE_TOPOLO_AUTH_URL=https://auth.topolo.app pnpm run build"
+      },
+      healthcheckPath: options.api ? "/api/health" : "/",
+      ...options.api ? {
+        bindings: {
+          services: [
+            {
+              binding: "API",
+              service: {
+                staging: `topolo-${slug}-api-staging`,
+                production: `topolo-${slug}-api-production`
+              }
             }
-          }
-        ]
-      }
-    } : {}
-  };
+          ]
+        }
+      } : {}
+    };
+  }
   const actions = options.api ? baselineApiActions() : [];
   return `${json({
     $schema: "./../../topolo-platform/tooling/app-manifest-schema.json",
@@ -8229,6 +8108,37 @@ function topoloAppManifestJson(application, options) {
       }
     },
     targets,
+    registration: {
+      ownerType: options.payload.ownerType,
+      portfolio: options.payload.portfolio,
+      applicationId: application.id,
+      serviceSlug: application.serviceSlug,
+      displayName: toTitle(application.name),
+      description: options.payload.experience.tagline,
+      category: "topolo-platform",
+      audience: options.payload.audience,
+      tenancy: options.payload.tenancy,
+      surfaceModel: options.payload.surfaceModel,
+      containerAppId: options.payload.containerAppId,
+      distributionModel: options.payload.distributionModel,
+      version: "1.0.0",
+      pricing: { type: "free", monthlyPrice: null },
+      supportEmail: "support@topolo.io",
+      auth: {
+        callbackPath: "/auth/callback",
+        requestedScopes: options.api ? ["openid", "profile", "email", "organization:read", "entitlements:read", `${application.id}:read`] : ["openid", "profile", "email", "organization:read"]
+      },
+      capabilities: options.payload.capabilities,
+      marketplace: {
+        intent: options.payload.distributionModel === "marketplace" ? "submit_when_ready" : "not_requested",
+        status: "preview",
+        shortBlurb: options.payload.experience.tagline,
+        tagline: options.payload.experience.tagline,
+        description: options.payload.experience.tagline,
+        docsUrl: `https://docs.topolo.app/applications/${slug}`
+      }
+    },
+    notifications: { role: "consumer_only" },
     ...actions.length ? { actions } : {}
   })}
 `;
@@ -8320,263 +8230,6 @@ function baselineApiActions() {
     }
   ];
 }
-function cloudcontrolJson(application, options) {
-  const slug = toSlug(application.id);
-  const appPath = firstPartyAppPath(application.appDir, options.audience);
-  const host = application.productionUrl ? new URL(application.productionUrl).host : `${slug}.topolo.app`;
-  const stagingHost = `${slug}.stg.topolo.us`;
-  const serviceSlug = application.serviceSlug ?? `topolo-${slug}`;
-  const resources = resourceConfig(application, options.profile);
-  const resourceBindings = [];
-  if (options.resources.d1) {
-    resourceBindings.push(
-      {
-        resource_type: "d1",
-        binding: resources.d1Binding,
-        environment: "production",
-        account_id: CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.d1ProductionName,
-        resource_id: "provision-after-scaffold",
-        migrations_dir: "migrations"
-      },
-      {
-        resource_type: "d1",
-        binding: resources.d1Binding,
-        environment: "staging",
-        account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.d1StagingName,
-        resource_id: "provision-after-scaffold",
-        migrations_dir: "migrations"
-      },
-      {
-        resource_type: "d1",
-        binding: resources.d1Binding,
-        environment: "development",
-        account_id: DEVELOPMENT_CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.d1DevelopmentName,
-        resource_id: "provision-after-scaffold",
-        migrations_dir: "migrations"
-      }
-    );
-  }
-  if (options.resources.r2) {
-    resourceBindings.push(
-      {
-        resource_type: "r2",
-        binding: resources.r2Binding,
-        environment: "production",
-        account_id: CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.r2ProductionName
-      },
-      {
-        resource_type: "r2",
-        binding: resources.r2Binding,
-        environment: "staging",
-        account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.r2StagingName
-      }
-    );
-  }
-  if (options.resources.queue) {
-    resourceBindings.push(
-      {
-        resource_type: "queue",
-        binding: resources.queueBinding,
-        environment: "production",
-        account_id: CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.queueProductionName
-      },
-      {
-        resource_type: "queue",
-        binding: resources.queueBinding,
-        environment: "staging",
-        account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.queueStagingName
-      }
-    );
-  }
-  if (options.resources.workflow) {
-    resourceBindings.push(
-      {
-        resource_type: "workflow",
-        binding: resources.workflowBinding,
-        environment: "production",
-        account_id: CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.workflowProductionName,
-        class_name: resources.workflowClassName
-      },
-      {
-        resource_type: "workflow",
-        binding: resources.workflowBinding,
-        environment: "staging",
-        account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.workflowStagingName,
-        class_name: resources.workflowClassName
-      }
-    );
-  }
-  if (options.resources.containerProcessing) {
-    resourceBindings.push(
-      {
-        resource_type: "container",
-        environment: "production",
-        account_id: CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.containerProductionName,
-        purpose: "processing"
-      },
-      {
-        resource_type: "container",
-        environment: "staging",
-        account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.containerStagingName,
-        purpose: "processing"
-      }
-    );
-  }
-  const deployTargets = options.api ? [
-    {
-      kind: "worker",
-      environment: "production",
-      target_name: `topolo-${slug}-api-production`,
-      cloudflare_account_id: CLOUDFLARE_ACCOUNT_ID,
-      config_path: "apps/api/wrangler.toml",
-      workdir: "apps/api",
-      build_command: null,
-      output_dir: null,
-      production_branch: "main",
-      healthcheck_path: "/api/health",
-      domains: [],
-      routes: [],
-      service_slug: serviceSlug
-    },
-    {
-      kind: "worker",
-      environment: "staging",
-      target_name: `topolo-${slug}-staging`,
-      cloudflare_account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
-      config_path: "apps/web/wrangler.toml",
-      workdir: "apps/web",
-      build_command: "cd ../.. && DEPLOY_ENVIRONMENT=staging VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us pnpm run build",
-      output_dir: null,
-      production_branch: "staging",
-      healthcheck_path: "/api/health",
-      domains: [stagingHost],
-      routes: [stagingHost],
-      api_url: `https://${stagingHost}`,
-      service_slug: serviceSlug,
-      sdk_app_id: application.id,
-      agent_callable: true
-    },
-    {
-      kind: "worker",
-      environment: "staging",
-      target_name: `topolo-${slug}-api-staging`,
-      cloudflare_account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
-      config_path: "apps/api/wrangler.toml",
-      workdir: "apps/api",
-      build_command: null,
-      output_dir: null,
-      production_branch: "staging",
-      healthcheck_path: "/api/health",
-      domains: [],
-      routes: [],
-      service_slug: serviceSlug
-    },
-    {
-      kind: "worker",
-      environment: "production",
-      target_name: `topolo-${slug}-production`,
-      cloudflare_account_id: CLOUDFLARE_ACCOUNT_ID,
-      config_path: "apps/web/wrangler.toml",
-      workdir: "apps/web",
-      build_command: "cd ../.. && DEPLOY_ENVIRONMENT=production VITE_TOPOLO_AUTH_URL=https://auth.topolo.app pnpm run build",
-      output_dir: null,
-      production_branch: "main",
-      healthcheck_path: "/api/health",
-      domains: [host],
-      routes: [host],
-      api_url: application.productionUrl,
-      service_slug: serviceSlug,
-      sdk_app_id: application.id,
-      agent_callable: true
-    }
-  ] : [
-    {
-      kind: "worker",
-      environment: "production",
-      target_name: `topolo-${slug}`,
-      cloudflare_account_id: CLOUDFLARE_ACCOUNT_ID,
-      config_path: "wrangler.toml",
-      build_command: "npm run build",
-      output_dir: "dist",
-      production_branch: "main",
-      healthcheck_path: "/",
-      domains: [host],
-      routes: [host],
-      api_url: application.productionUrl,
-      agent_callable: false
-    }
-  ];
-  return `${json({
-    name: `topolo-${slug}`,
-    description: `Canonical documentation for ${toTitle(application.name)} lives in system-apps/TopoloDocs.`,
-    deploy_method: "wrangler",
-    ci_provider: "github_actions",
-    repo_identity: {
-      provider: "github",
-      owner: "Topolo-io",
-      repo: application.appDir,
-      remote_url: `git@github.com:Topolo-io/${application.appDir}.git`,
-      default_branch: "main"
-    },
-    environments: application.productionUrl ? [
-      {
-        name: "production",
-        url: application.productionUrl,
-        branch: "main",
-        status: "unknown"
-      },
-      {
-        name: "staging",
-        url: `https://${stagingHost}`,
-        branch: "main",
-        status: "unknown"
-      }
-    ] : [],
-    deploy_targets: deployTargets,
-    resource_bindings: resourceBindings,
-    ci_workflows: [
-      {
-        provider: "github_actions",
-        workflow_name: "topolo-conformance.yml",
-        path: ".github/workflows/topolo-conformance.yml",
-        branch: null,
-        required: true
-      }
-    ],
-    ci_targets: [
-      {
-        name: "typecheck",
-        command: "pnpm run typecheck",
-        required: true
-      },
-      {
-        name: "test",
-        command: "pnpm run test",
-        required: true
-      },
-      {
-        name: "build",
-        command: "pnpm run build",
-        required: true
-      }
-    ],
-    tags: ["application", "cloudflare", "typescript", ...hasScaffoldResources(options.resources) ? ["resource-backed"] : []],
-    source_paths: [appPath],
-    cloudflare_account_id: CLOUDFLARE_ACCOUNT_ID
-  })}
-`;
-}
 function systemJson(application, options) {
   const slug = toSlug(application.id);
   const suiteLabel = options.audience === "personal" ? "personal" : "platform";
@@ -8913,7 +8566,7 @@ function developerManifest(application, options) {
     surface_model: options.surfaceModel,
     container_app_id: options.containerAppId,
     package_name: application.packageName,
-    app_id: options.api ? application.appId : null,
+    app_id: application.appId,
     capabilities: {
       selected: options.capabilities,
       supported_v1: [
@@ -8957,7 +8610,38 @@ function developerManifest(application, options) {
     },
     marketplace: {
       intent: options.distributionModel === "marketplace" ? "submit_when_ready" : "not_requested"
-    }
+    },
+    registration: {
+      ownerType: "third_party",
+      applicationId: application.id,
+      serviceSlug: application.serviceSlug,
+      displayName: toTitle(application.name),
+      description: `${toTitle(application.name)} application for Topolo.`,
+      category: "productivity",
+      audience: options.audience,
+      tenancy: options.tenancy,
+      surfaceModel: options.surfaceModel,
+      containerAppId: options.containerAppId,
+      distributionModel: options.distributionModel,
+      version: "1.0.0",
+      pricing: { type: "free", monthlyPrice: null },
+      supportEmail: "",
+      productionUrl: application.productionUrl,
+      auth: {
+        callbackPath,
+        requestedScopes
+      },
+      capabilities: options.capabilities,
+      marketplace: {
+        intent: options.distributionModel === "marketplace" ? "submit_when_ready" : "not_requested",
+        status: "preview",
+        shortBlurb: `${toTitle(application.name)} application for Topolo.`,
+        tagline: `${toTitle(application.name)} application for Topolo.`,
+        description: `${toTitle(application.name)} application for Topolo.`,
+        docsUrl: application.productionUrl || "https://developers.topolo.app"
+      }
+    },
+    notifications: { role: "consumer_only" }
   })}
 `;
 }
@@ -9243,9 +8927,10 @@ function applicationScaffoldPayload(application, options = {}) {
     workspaceLabel: tenancy === "household" ? "Households" : "Workspaces",
     tagline: String(options.tagline || "").trim() || `Manage your work in ${toTitle(name)}.`
   };
-  const serviceSlug = api ? target === "platform" ? `topolo-${slug}` : id : null;
-  const defaultAppId = target === "platform" ? `app_topolo_${id}` : catalogApplication?.services[0] ?? id;
-  const appId = api ? options.appId ?? defaultAppId : null;
+  const serviceSlug = target === "platform" ? `topolo-${slug}` : id;
+  const catalogAppId = catalogApplication?.services.find((service) => service.startsWith("app_"));
+  const defaultAppId = target === "platform" ? `app_topolo_${id}` : catalogAppId ?? `app_${id.replace(/-/g, "_")}`;
+  const appId = options.appId ?? defaultAppId;
   const productionUrl = browser ? options.productionUrl ?? catalogApplication?.productionUrl ?? `https://${slug}.topolo.app` : null;
   const scopes = scaffoldScopes({ browser, api });
   const capabilities = scaffoldCapabilities({ browser, api, distributionModel });
@@ -9622,8 +9307,10 @@ function scaffoldFiles(options) {
         ],
         content: topoloAppManifestJson(application, {
           api: options.api,
+          browser: options.browser,
           resources: options.payload.resources,
-          profile: options.payload.profile
+          profile: options.payload.profile,
+          payload: options.payload
         })
       },
       ...options.api ? [
@@ -9646,20 +9333,6 @@ function scaffoldFiles(options) {
           content: topoloActionContractsDmts()
         }
       ] : [],
-      {
-        path: `${base}/topolo.cloudcontrol.json`,
-        purpose: "CloudControl source of truth for deploy targets, routes, bindings, and CI metadata.",
-        requiredSignals: [
-          "production URLs and Cloudflare targets are explicit",
-          "resource bindings and required secrets are declared without secret values"
-        ],
-        content: cloudcontrolJson(application, {
-          api: options.api,
-          audience: options.payload.audience,
-          profile: options.payload.profile,
-          resources: options.payload.resources
-        })
-      },
       {
         path: `${base}/.github/workflows/topolo-conformance.yml`,
         purpose: "PR/push gate that runs the local Topolo app audit with docs evidence.",
@@ -9868,15 +9541,6 @@ export default defineConfig({
               "only declares an API service binding for API-backed scaffolds"
             ],
             content: webWorkerTs(application, options.api)
-          },
-          {
-            path: `${browserBase}/wrangler.toml`,
-            purpose: "Cloudflare Worker static-assets configuration for the browser surface.",
-            requiredSignals: [
-              "serves Vite assets through a Worker with assets",
-              "only binds an API Worker when the scaffold includes one"
-            ],
-            content: platformWebWranglerToml(application, options.api)
           }
         );
       }
@@ -9884,15 +9548,15 @@ export default defineConfig({
   }
   if (options.api) {
     files.push(
-      {
+      ...target === "platform" ? [] : [{
         path: `${apiBase}/wrangler.toml`,
         purpose: "Cloudflare Worker runtime configuration.",
         requiredSignals: [
-          "bindings match topolo.cloudcontrol.json or topolo.app.json",
+          "bindings match the declared resources",
           "secrets are referenced by name only"
         ],
-        content: target === "platform" ? platformApiWranglerToml(application, options.payload.resources, options.payload.profile) : wranglerToml(application, target, options.payload.resources, options.payload.profile)
-      },
+        content: wranglerToml(application, target, options.payload.resources, options.payload.profile)
+      }],
       {
         path: `${apiBase}/src/worker.ts`,
         purpose: "Protected service boundary.",
@@ -9960,6 +9624,9 @@ export default defineConfig({
       }
     }
   }
+  if (target === "platform") {
+    files.push(...deriveGeneratedConfigs(files, base));
+  }
   return files;
 }
 
@@ -10026,7 +9693,7 @@ async function provisionApplicationScaffold(payload) {
       `Could not resolve Developers app id from Auth slug ${DEVELOPERS_SERVICE_SLUG}.`
     );
   }
-  const endpoint = payload.target === "platform" ? "/api/developer-console/admin/first-party-app-scaffolds" : "/api/developer-console/apps/scaffold";
+  const endpoint = payload.target === "platform" ? "/api/developer-console/admin/apps/reconcile" : "/api/developer-console/apps/reconcile";
   const headers = new Headers({
     "Content-Type": "application/json",
     "X-App-ID": developersAppId,
@@ -10044,7 +9711,7 @@ async function provisionApplicationScaffold(payload) {
   const response = await fetch(`${developersOrigin}${endpoint}`, {
     method: "POST",
     headers,
-    body: JSON.stringify(buildProvisioningRequest(payload))
+    body: JSON.stringify(buildProvisioningRequest(payload, identity.user.email))
   });
   const envelope = await response.json().catch(() => null);
   if (!response.ok || !envelope?.success || !envelope.data) {
@@ -10053,8 +9720,10 @@ async function provisionApplicationScaffold(payload) {
     );
   }
   const app = pickRecord(envelope.data.app);
-  const service = pickRecord(envelope.data.service);
-  const authConfig = pickRecord(envelope.data.authConfig);
+  const projections = pickRecord(envelope.data.projections);
+  const authProjection = pickRecord(projections?.auth);
+  const service = pickRecord(authProjection?.service);
+  const authConfig = pickRecord(authProjection?.authConfig);
   if (!app) {
     throw new Error("Developers provisioning did not return an app record.");
   }
@@ -10091,9 +9760,9 @@ async function provisionApplicationScaffold(payload) {
     } : null
   };
 }
-function buildProvisioningRequest(payload) {
+function buildProvisioningRequest(payload, supportEmail) {
   return {
-    target: payload.target,
+    mode: "apply",
     ownerType: payload.ownerType,
     portfolio: payload.portfolio,
     audience: payload.audience,
@@ -10106,14 +9775,28 @@ function buildProvisioningRequest(payload) {
       "http://localhost:5173/auth/callback",
       payload.application.productionUrl ? `${payload.application.productionUrl.replace(/\/$/, "")}/auth/callback` : null
     ].filter(Boolean),
-    healthEndpoint: payload.application.productionUrl ? `${payload.application.productionUrl.replace(/\/$/, "")}/api/health` : null,
-    runtimeStrategy: "external",
     requestedScopes: payload.application.appId ? ["openid", "profile", "email", "organization:read", "entitlements:read", `${payload.application.id}:read`] : ["openid", "profile", "email", "organization:read"],
-    marketplaceIntent: payload.distributionModel === "marketplace" ? "submit_when_ready" : "not_requested",
+    marketplace: {
+      intent: payload.distributionModel === "marketplace" ? "submit_when_ready" : "not_requested",
+      status: "preview",
+      shortBlurb: payload.experience.tagline,
+      tagline: payload.experience.tagline,
+      description: payload.experience.tagline,
+      docsUrl: payload.application.productionUrl || "https://developers.topolo.app"
+    },
+    notifications: { role: "consumer_only" },
     applicationId: payload.application.id,
-    appDir: payload.application.appDir,
-    packageName: payload.application.packageName,
     name: payload.application.name,
+    description: payload.experience.tagline,
+    category: payload.target === "platform" ? "topolo-platform" : "productivity",
+    version: "1.0.0",
+    pricingType: "free",
+    monthlyPrice: null,
+    demoUrl: payload.application.productionUrl,
+    repoUrl: null,
+    supportEmail,
+    tags: [],
+    screenshots: [],
     productionUrl: payload.application.productionUrl,
     serviceSlug: payload.application.serviceSlug,
     appId: payload.application.appId
@@ -10187,6 +9870,332 @@ async function applyProvisionedAppId(manifestPath, appId) {
 
 // src/commands/apps.ts
 import { join as join3 } from "path";
+
+// src/commands/app-reconcile.ts
+import { readFile as readFile3, writeFile as writeFile4 } from "fs/promises";
+import path3 from "path";
+import { createInterface as createInterface2 } from "readline/promises";
+import { stdin as input2, stdout as output } from "process";
+function record(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function environmentValue(value, environment) {
+  if (typeof value === "string") return value;
+  if (!value) return null;
+  return typeof value[environment] === "string" ? value[environment] : null;
+}
+function resolveManifestApplicationUrl(manifest, environment) {
+  const targets = manifest.targets || {};
+  const targetName = manifest.primaryTarget || (targets.web ? "web" : Object.keys(targets)[0]);
+  const target = targetName ? targets[targetName] : null;
+  if (!target) {
+    if (manifest.registration?.productionUrl) return manifest.registration.productionUrl.replace(/\/+$/, "");
+    throw new Error("topolo.app.json has no application target or registration.productionUrl.");
+  }
+  const publicUrl = environmentValue(target.publicUrl, environment);
+  if (publicUrl) return publicUrl.replace(/\/+$/, "");
+  const hostOverride = target.hostOverride?.[environment];
+  if (hostOverride) return `https://${hostOverride.replace(/^https?:\/\//, "").replace(/\/+$/, "")}`;
+  const domain = manifest.environments?.[environment]?.domain;
+  if (!target.subdomain || !domain) {
+    throw new Error(`Cannot derive the ${environment} application URL from target ${targetName}.`);
+  }
+  return `https://${target.subdomain}.${domain}`;
+}
+function assertRegistration(value) {
+  const registration = record(value);
+  const required = [
+    "ownerType",
+    "applicationId",
+    "serviceSlug",
+    "displayName",
+    "description",
+    "audience",
+    "tenancy",
+    "surfaceModel",
+    "distributionModel",
+    "version",
+    "pricing",
+    "supportEmail",
+    "auth",
+    "capabilities",
+    "marketplace"
+  ];
+  const missing = required.filter((field) => registration?.[field] == null || registration[field] === "");
+  if (missing.length) {
+    throw new Error(
+      `topolo.app.json registration is incomplete: ${missing.join(", ")}. Run in an interactive terminal to complete the manifest, or edit the declarative registration block.`
+    );
+  }
+}
+function titleFromSlug(value) {
+  return value.replace(/^topolo[-_]/, "").split(/[-_]+/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
+}
+async function completeApplicationRegistrationInteractively(options) {
+  const manifestPath = path3.resolve(options.manifestPath || "topolo.app.json");
+  const manifest = JSON.parse(await readFile3(manifestPath, "utf8"));
+  const existing = record(manifest.registration) || {};
+  const appId = String(manifest.appId || manifest.app_id || "").trim();
+  const slug = String(existing.serviceSlug || manifest.name || "").trim();
+  const defaultName = titleFromSlug(slug);
+  const readline = options.prompt ? null : createInterface2({ input: input2, output });
+  const ask = options.prompt || ((question) => readline.question(question));
+  let changed = !manifest.registration;
+  const requiredText = async (field, label, fallback = "") => {
+    const current = typeof existing[field] === "string" ? String(existing[field]).trim() : "";
+    if (current) return current;
+    const answer = (await ask(`${label}${fallback ? ` [${fallback}]` : ""}: `)).trim() || fallback;
+    if (!answer) throw new Error(`${field} is required.`);
+    changed = true;
+    return answer;
+  };
+  try {
+    const productionUrl = String(existing.productionUrl || resolveManifestApplicationUrl(manifest, options.environment || selectedEnvironment()));
+    const displayName = await requiredText("displayName", "Application display name", defaultName);
+    const description = await requiredText("description", "Application description", `${displayName} application for Topolo.`);
+    const supportEmail = await requiredText("supportEmail", "Support email");
+    manifest.registration = {
+      ownerType: options.expectedOwnerType,
+      ...options.expectedOwnerType === "topolo_first_party" ? { portfolio: existing.portfolio || "platform" } : {},
+      applicationId: String(existing.applicationId || slug).replace(/^topolo-/, "topolo-"),
+      serviceSlug: slug,
+      displayName,
+      description,
+      category: String(existing.category || (options.expectedOwnerType === "topolo_first_party" ? "topolo-platform" : "productivity")),
+      audience: existing.audience || "business",
+      tenancy: existing.tenancy || "organization",
+      surfaceModel: existing.surfaceModel || "web_app",
+      containerAppId: existing.containerAppId,
+      distributionModel: existing.distributionModel || (options.expectedOwnerType === "topolo_first_party" ? "marketplace" : "organization_internal"),
+      version: String(existing.version || "1.0.0"),
+      pricing: record(existing.pricing) || { type: "free", monthlyPrice: null },
+      supportEmail,
+      productionUrl,
+      demoUrl: typeof existing.demoUrl === "string" ? existing.demoUrl : void 0,
+      repoUrl: typeof existing.repoUrl === "string" ? existing.repoUrl : void 0,
+      tags: Array.isArray(existing.tags) ? existing.tags : [],
+      screenshots: Array.isArray(existing.screenshots) ? existing.screenshots : [],
+      auth: record(existing.auth) || {
+        callbackPath: "/auth/callback",
+        requestedScopes: ["openid", "profile", "email", "organization:read"]
+      },
+      capabilities: Array.isArray(existing.capabilities) ? existing.capabilities : ["login", "launcher"],
+      marketplace: record(existing.marketplace) || {
+        intent: options.expectedOwnerType === "topolo_first_party" ? "submit_when_ready" : "not_requested",
+        status: "preview",
+        shortBlurb: description,
+        tagline: description,
+        description,
+        docsUrl: productionUrl
+      }
+    };
+    if (!manifest.notifications) {
+      const role = (await ask("Notification role [consumer_only]: ")).trim() || "consumer_only";
+      if (!["producer", "consumer_only", "internal_non_producer"].includes(role)) {
+        throw new Error("Notification role must be producer, consumer_only, or internal_non_producer.");
+      }
+      if (role === "producer") {
+        const contracts = (await ask("Notification contracts path: ")).trim();
+        if (!contracts) throw new Error("Producer applications must declare a notification contracts path.");
+        manifest.notifications = { role, contracts };
+      } else {
+        manifest.notifications = { role };
+      }
+      changed = true;
+    }
+    if (!appId) throw new Error("topolo.app.json must declare the immutable appId before reconciliation.");
+    if (changed) await writeFile4(manifestPath, `${JSON.stringify(manifest, null, 2)}
+`, "utf8");
+    return { changed, manifestPath };
+  } finally {
+    if (readline) readline.close();
+  }
+}
+async function loadApplicationReconcileRequest(options) {
+  const manifestPath = path3.resolve(options.manifestPath || "topolo.app.json");
+  const raw = await readFile3(manifestPath, "utf8");
+  const manifest = JSON.parse(raw);
+  assertRegistration(manifest.registration);
+  const registration = manifest.registration;
+  if (registration.ownerType !== options.expectedOwnerType) {
+    throw new Error(
+      `${registration.ownerType} registration cannot be reconciled through the ${options.expectedOwnerType} command surface.`
+    );
+  }
+  const environment = options.environment || selectedEnvironment();
+  const productionUrl = resolveManifestApplicationUrl(manifest, environment);
+  const callbackPath = registration.auth.callbackPath.startsWith("/") ? registration.auth.callbackPath : `/${registration.auth.callbackPath}`;
+  const appId = String(manifest.appId || manifest.app_id || "").trim();
+  if (!appId) throw new Error("topolo.app.json must declare the immutable appId.");
+  return {
+    manifestPath,
+    request: {
+      mode: options.mode,
+      appId,
+      ownerType: registration.ownerType,
+      portfolio: registration.portfolio ?? null,
+      applicationId: registration.applicationId,
+      serviceSlug: registration.serviceSlug,
+      audience: registration.audience,
+      tenancy: registration.tenancy,
+      surfaceModel: registration.surfaceModel,
+      containerAppId: registration.containerAppId ?? null,
+      distributionModel: registration.distributionModel,
+      name: registration.displayName,
+      description: registration.description,
+      category: registration.category ?? null,
+      version: registration.version,
+      pricingType: registration.pricing.type,
+      monthlyPrice: registration.pricing.monthlyPrice ?? null,
+      productionUrl,
+      demoUrl: registration.ownerType === "topolo_first_party" ? productionUrl : registration.demoUrl ?? productionUrl,
+      repoUrl: registration.repoUrl ?? null,
+      supportEmail: registration.supportEmail,
+      tags: registration.tags ?? [],
+      screenshots: registration.screenshots ?? [],
+      callbackUrls: [`${productionUrl}${callbackPath}`],
+      requestedScopes: registration.auth.requestedScopes,
+      capabilities: registration.capabilities,
+      marketplace: { ...registration.marketplace, appUrl: productionUrl },
+      notifications: manifest.notifications ?? null
+    }
+  };
+}
+function defaultAuthOrigin2(environment) {
+  if (environment === "development") return "https://auth.topolo.dev";
+  if (environment === "staging") return "https://auth.stg.topolo.us";
+  return "https://auth.topolo.app";
+}
+async function resolveDevelopersAppId(authOrigin, fetchImpl) {
+  const response = await fetchImpl(`${authOrigin}/api/services/by-slug/topolo-developers`, {
+    headers: { Accept: "application/json" }
+  });
+  const payload = await response.json().catch(() => null);
+  const appId = typeof payload?.data?.app_id === "string" ? payload.data.app_id.trim() : "";
+  if (!response.ok || !appId) throw new Error("Could not resolve the Developers app id from Auth.");
+  return appId;
+}
+async function reconcileApplicationRequest(request, dependencies = {}) {
+  const selectEnvironment = dependencies.selectedEnvironment || selectedEnvironment;
+  const refreshCredential = dependencies.refreshCredentialIfNeeded || refreshCredentialIfNeeded;
+  const makeClient2 = dependencies.buildClient || buildClient;
+  const loadConfig = dependencies.readConfig || readConfig;
+  const resolveProfile = dependencies.resolvedProfileConfig || resolvedProfileConfig;
+  const assertServiceUrl = dependencies.assertServiceUrlForEnvironment || assertServiceUrlForEnvironment;
+  const fetchImpl = dependencies.fetch || fetch;
+  const environment = selectEnvironment();
+  const credential = await refreshCredential(environment);
+  if (!credential) throw new Error("Application reconciliation requires an authenticated Topolo session. Run `topolo auth login`.");
+  const client = await makeClient2();
+  if (!client) throw new Error("Could not build the authenticated Topolo client.");
+  await client.client.introspect();
+  const config = await loadConfig();
+  const profile = resolveProfile(config, environment);
+  const authOrigin = (profile.serviceUrls?.auth || defaultAuthOrigin2(environment)).replace(/\/+$/, "");
+  const developersOrigin = (profile.serviceUrls?.developers || "https://developers.topolo.app").replace(/\/+$/, "");
+  assertServiceUrl("auth", authOrigin, environment);
+  assertServiceUrl("developers", developersOrigin, environment);
+  const headers = new Headers({
+    "Content-Type": "application/json",
+    "X-App-ID": await resolveDevelopersAppId(authOrigin, fetchImpl),
+    "X-Topolo-Client": `topolo-cli/${CLI_VERSION}`
+  });
+  const agentName = resolveAgentName(profile.agentName);
+  if (agentName) headers.set("X-Topolo-Agent", agentName);
+  if (credential.kind === "api_key") headers.set("X-Api-Key", credential.apiKey);
+  else headers.set("Authorization", `Bearer ${credential.accessToken}`);
+  const endpoint = request.ownerType === "topolo_first_party" ? "/api/developer-console/admin/apps/reconcile" : "/api/developer-console/apps/reconcile";
+  const response = await fetchImpl(`${developersOrigin}${endpoint}`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(request)
+  });
+  const envelope = await response.json().catch(() => null);
+  if (!response.ok || !envelope?.success || !envelope.data) {
+    const message = typeof envelope?.error === "string" ? envelope.error : envelope?.error?.message || envelope?.message || `Application reconciliation failed with status ${response.status}.`;
+    const error = new Error(message);
+    error.code = response.status === 409 ? "immutable_drift" : response.status === 403 ? "permission_denied" : "reconcile_failed";
+    error.details = typeof envelope?.error === "object" ? envelope.error.details : void 0;
+    throw error;
+  }
+  return envelope.data;
+}
+function resolveReconcileMode(options) {
+  const explicit = [options.check, options.dryRun, options.apply].filter(Boolean).length;
+  if (explicit > 1) throw new Error("Choose exactly one of --check, --dry-run, or --apply.");
+  if (options.apply) return { mode: "apply", interactiveApply: false };
+  if (options.check || options.dryRun) return { mode: "check", interactiveApply: false };
+  return {
+    mode: "check",
+    interactiveApply: !options.nonInteractive && Boolean(options.interactive || process.stdin.isTTY && process.stdout.isTTY)
+  };
+}
+async function confirmApplicationReconcile(result) {
+  if (result.plan.status === "in_sync") return false;
+  const readline = createInterface2({ input: input2, output });
+  try {
+    const answer = await readline.question(`Apply ${result.plan.changes.length} application registration change(s)? [y/N] `);
+    return /^(y|yes)$/i.test(answer.trim());
+  } finally {
+    readline.close();
+  }
+}
+function formatApplicationReconcile(result, manifestPath) {
+  const lines = [
+    `Application registration: ${result.plan.status}`,
+    `Manifest: ${manifestPath}`,
+    `Mode: ${result.mode}`
+  ];
+  for (const change of result.changes || result.plan.changes) {
+    lines.push(`- ${change.path}: ${JSON.stringify(change.before)} -> ${JSON.stringify(change.after)}`);
+  }
+  if (result.projections) lines.push("Catalog/Auth projections: reconciled");
+  return lines.join("\n");
+}
+function registerApplicationReconcileCommand(parent, ownerType, dependencies = {}) {
+  const completeRegistration = dependencies.completeRegistration || completeApplicationRegistrationInteractively;
+  const loadRequest = dependencies.loadRequest || loadApplicationReconcileRequest;
+  const reconcileRequest = dependencies.reconcileRequest || reconcileApplicationRequest;
+  const confirm = dependencies.confirm || confirmApplicationReconcile;
+  parent.command("reconcile").description("Check or apply the declarative application registration in topolo.app.json.").option("--manifest <path>", "Path to topolo.app.json", "topolo.app.json").option("--check", "Report drift without mutating remote data").option("--dry-run", "Alias for --check").option("--apply", "Apply mutable drift and required projections").option("--interactive", "Use the human confirmation flow").option("--non-interactive", "Disable all prompts").option("--yes", "Accept the interactive apply confirmation").option("--json", "Output JSON").option("--no-json", "Output human-readable details").action(async (options) => {
+    const outputMode = resolveOutputMode(options.json);
+    try {
+      const selection = resolveReconcileMode(options);
+      if (selection.interactiveApply) {
+        await completeRegistration({
+          manifestPath: options.manifest,
+          expectedOwnerType: ownerType
+        });
+      }
+      const loaded = await loadRequest({
+        manifestPath: options.manifest,
+        expectedOwnerType: ownerType,
+        mode: selection.mode
+      });
+      let result = await reconcileRequest(loaded.request);
+      if (selection.interactiveApply && result.plan.status !== "in_sync") {
+        if (outputMode === "pretty") {
+          process.stdout.write(`${formatApplicationReconcile(result, loaded.manifestPath)}
+`);
+        }
+        const confirmed = options.yes || await confirm(result);
+        if (confirmed) {
+          result = await reconcileRequest({ ...loaded.request, mode: "apply" });
+        }
+      }
+      emit(
+        { manifest: loaded.manifestPath, reconciliation: result },
+        outputMode,
+        () => formatApplicationReconcile(result, loaded.manifestPath)
+      );
+      if (result.mode === "check" && result.plan.status !== "in_sync") process.exitCode = 2;
+    } catch (error) {
+      fail(error, outputMode);
+    }
+  });
+}
+
+// src/commands/apps.ts
 var APPLICATION_IDS = Object.keys(APPLICATIONS).sort();
 var CLOUDCONTROL_LOCAL_APPLICATION = {
   id: "cloudcontrol",
@@ -10216,6 +10225,7 @@ function registerAppsCommand(program2) {
       fail(err, mode);
     }
   });
+  registerApplicationReconcileCommand(apps, "third_party");
   apps.command("get <application>").description("Show one Topolo application available to the current credential.").option("--json", "Output JSON", true).option("--no-json", "Output human-readable details").action(async (application, opts) => {
     const mode = resolveOutputMode(opts.json);
     try {
@@ -10254,8 +10264,8 @@ function registerAppsCommand(program2) {
         repoRoot: opts.repoRoot
       });
       const gate = opts.failOn ? evaluateApplicationAuditGate(payload, opts.failOn) : null;
-      const output = gate ? { ...payload, conformanceGate: gate } : payload;
-      emit(output, mode, () => formatAudit(output));
+      const output2 = gate ? { ...payload, conformanceGate: gate } : payload;
+      emit(output2, mode, () => formatAudit(output2));
       if (gate && !gate.passed) {
         if (mode === "json") {
           process.stderr.write(JSON.stringify({ error: gate.message, conformanceGate: gate }, null, 2) + "\n");
@@ -10317,14 +10327,14 @@ function registerAppsCommand(program2) {
           appIdWriteBack = { ...result, path: manifestFile.path };
         }
       }
-      const output = {
+      const output2 = {
         ...payload,
         ...writeResult ? { write: writeResult } : {},
         ...provisionResult ? { provision: provisionResult } : {},
         ...appIdWriteBack ? { appIdWriteBack } : {}
       };
       emit(
-        output,
+        output2,
         mode,
         () => formatScaffold(payload, writeResult, provisionResult, appIdWriteBack)
       );
@@ -10388,8 +10398,8 @@ function applicationAuditPayload(application, options = {}) {
 }
 function recordApplicationEvidence(application, options = {}) {
   const appId = resolveApplication(application).id;
-  const root = path2.resolve(options.appRoot ?? process.cwd());
-  if (!existsSync3(root)) {
+  const root = path4.resolve(options.appRoot ?? process.cwd());
+  if (!existsSync4(root)) {
     throw new Error(`Application root does not exist: ${root}`);
   }
   let commit = options.commit;
@@ -10400,12 +10410,12 @@ function recordApplicationEvidence(application, options = {}) {
       commit = void 0;
     }
   }
-  const evidenceDir = path2.join(root, ".topolo");
-  const evidencePath = path2.join(evidenceDir, "evidence.json");
+  const evidenceDir = path4.join(root, ".topolo");
+  const evidencePath = path4.join(evidenceDir, "evidence.json");
   let before = null;
-  if (existsSync3(evidencePath)) {
+  if (existsSync4(evidencePath)) {
     try {
-      const raw = JSON.parse(readFileSync4(evidencePath, "utf8"));
+      const raw = JSON.parse(readFileSync5(evidencePath, "utf8"));
       if (raw && typeof raw === "object" && raw.version === 1) {
         before = raw;
       }
@@ -10443,8 +10453,8 @@ function recordApplicationEvidence(application, options = {}) {
       "record-evidence: pass at least one of --build, --typecheck, --test, --docs-validate, --smoke <url>"
     );
   }
-  mkdirSync(evidenceDir, { recursive: true });
-  writeFileSync(evidencePath, JSON.stringify(after, null, 2) + "\n");
+  mkdirSync2(evidenceDir, { recursive: true });
+  writeFileSync2(evidencePath, JSON.stringify(after, null, 2) + "\n");
   return { appId, evidencePath, before, after, updatedFields };
 }
 function formatEvidence(result) {
@@ -10700,11 +10710,12 @@ function statusesAtOrWorse(threshold) {
 }
 
 // src/commands/platform.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync5, statSync as statSync2 } from "fs";
-import path3 from "path";
+import { readdirSync as readdirSync2, readFileSync as readFileSync6, statSync as statSync2 } from "fs";
+import path5 from "path";
 function registerPlatformCommand(program2) {
   const platform3 = program2.command("platform").description("Internal Topolo first-party platform and personal app commands");
   const platformApps = platform3.command("apps").description("Scaffold and operate first-party Topolo platform and personal applications");
+  registerApplicationReconcileCommand(platformApps, "topolo_first_party");
   platformApps.command("scaffold <application>").description(
     "Generate a first-party Topolo scaffold for the platform or personal portfolio."
   ).option("--json", "Output JSON").option("--no-json", "Output human-readable checklist").option("--app-dir <path>", "Application repo name or apps/<repo> path").option("--name <name>", "Application display/package source name").option("--package-name <name>", "package.json name").option("--production-url <url>", "Production browser URL").option("--service <id>", "Stable SDK/Auth app id for API-backed apps").option("--portfolio <portfolio>", "First-party portfolio: platform or personal").option(
@@ -10761,13 +10772,13 @@ function registerPlatformCommand(program2) {
       }
       const writeResult = opts.write ? await writeApplicationScaffold(payload, { repoRoot: opts.repoRoot, force: opts.force }) : null;
       const provisionResult = shouldProvision ? await provisionApplicationScaffold(payload) : null;
-      const output = opts.workflowOnly ? { application: payload.application, ciWorkflowPath: payload.ciWorkflowPath, ciWorkflow: payload.ciWorkflow } : {
+      const output2 = opts.workflowOnly ? { application: payload.application, ciWorkflowPath: payload.ciWorkflowPath, ciWorkflow: payload.ciWorkflow } : {
         ...payload,
         ...writeResult ? { write: writeResult } : {},
         ...provisionResult ? { provision: provisionResult } : {}
       };
       emit(
-        output,
+        output2,
         mode,
         () => opts.workflowOnly ? payload.ciWorkflow ?? "" : formatScaffold(payload, writeResult, provisionResult)
       );
@@ -10818,12 +10829,12 @@ var SKIPPED_SCAN_DIRS = /* @__PURE__ */ new Set([
   "output"
 ]);
 function scanStagingProductionUrls(rootInput, allowPatterns) {
-  const root = path3.resolve(rootInput);
+  const root = path5.resolve(rootInput);
   const allowlist = allowPatterns.map((pattern) => new RegExp(pattern));
   const violations = [];
   function shouldSkipFile(filePath) {
-    const basename = path3.basename(filePath);
-    const relativePath = path3.relative(root, filePath);
+    const basename = path5.basename(filePath);
+    const relativePath = path5.relative(root, filePath);
     if (basename === "package-lock.json" || basename === "pnpm-lock.yaml" || basename === "yarn.lock") return true;
     if (basename === "topolo.cloudcontrol.json") return true;
     if (basename === "wrangler.toml" || basename === "wrangler.jsonc") return true;
@@ -10832,15 +10843,15 @@ function scanStagingProductionUrls(rootInput, allowPatterns) {
     if (basename.endsWith(".generated.ts")) return true;
     if (basename.endsWith(".test.ts") || basename.endsWith(".test.tsx") || basename.endsWith(".spec.ts")) return true;
     if (basename === ".env.production") return true;
-    if (relativePath === path3.join("src", "environment.ts") || relativePath === path3.join("src", "environmentUrls.ts") || relativePath.endsWith(path3.join("src", "environment.ts")) || relativePath.endsWith(path3.join("src", "lib", "environment.ts")) || relativePath === path3.join("packages", "topolo-ui-kit", "src", "environmentUrls.ts")) return true;
-    if (relativePath.includes(`${path3.sep}test${path3.sep}`) || relativePath.includes(`${path3.sep}tests${path3.sep}`) || relativePath.includes(`${path3.sep}e2e${path3.sep}`)) return true;
-    if (relativePath.startsWith(`scripts${path3.sep}`) || relativePath.includes(`${path3.sep}scripts${path3.sep}`)) return true;
-    return !RUNTIME_EXTENSIONS.has(path3.extname(filePath));
+    if (relativePath === path5.join("src", "environment.ts") || relativePath === path5.join("src", "environmentUrls.ts") || relativePath.endsWith(path5.join("src", "environment.ts")) || relativePath.endsWith(path5.join("src", "lib", "environment.ts")) || relativePath === path5.join("packages", "topolo-ui-kit", "src", "environmentUrls.ts")) return true;
+    if (relativePath.includes(`${path5.sep}test${path5.sep}`) || relativePath.includes(`${path5.sep}tests${path5.sep}`) || relativePath.includes(`${path5.sep}e2e${path5.sep}`)) return true;
+    if (relativePath.startsWith(`scripts${path5.sep}`) || relativePath.includes(`${path5.sep}scripts${path5.sep}`)) return true;
+    return !RUNTIME_EXTENSIONS.has(path5.extname(filePath));
   }
   function scanFile(filePath) {
     if (shouldSkipFile(filePath)) return;
-    const relativePath = path3.relative(root, filePath);
-    const content = readFileSync5(filePath, "utf8");
+    const relativePath = path5.relative(root, filePath);
+    const content = readFileSync6(filePath, "utf8");
     const lines = content.split(/\r?\n/);
     lines.forEach((line, index) => {
       const matches = [...line.matchAll(PRODUCTION_TOPOLO_URL_PATTERN)].map((match) => match[0]);
@@ -10854,7 +10865,7 @@ function scanStagingProductionUrls(rootInput, allowPatterns) {
   }
   function walk(dir) {
     for (const entry of readdirSync2(dir, { withFileTypes: true })) {
-      const fullPath = path3.join(dir, entry.name);
+      const fullPath = path5.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (!SKIPPED_SCAN_DIRS.has(entry.name)) walk(fullPath);
         continue;
@@ -11022,7 +11033,7 @@ var DEFAULT_SEED_BASE_URL = "https://seed.stg.topolo.us";
 function seedBaseUrl() {
   return process.env.TOPOLO_SEED_URL || DEFAULT_SEED_BASE_URL;
 }
-async function authedFetch(path4, init = {}) {
+async function authedFetch(path6, init = {}) {
   const credential = await refreshCredentialIfNeeded("staging");
   if (!credential) {
     throw new Error("No staging credential configured. Run `topolo auth login --env staging` or set TOPOLO_STAGING_API_KEY.");
@@ -11032,7 +11043,7 @@ async function authedFetch(path4, init = {}) {
   else headers.set("Authorization", `Bearer ${credential.accessToken}`);
   headers.set("X-Topolo-Client", `topolo-cli/${CLI_VERSION}`);
   if (init.body && !headers.has("Content-Type")) headers.set("Content-Type", "application/json");
-  const response = await fetch(`${seedBaseUrl()}${path4}`, { ...init, headers });
+  const response = await fetch(`${seedBaseUrl()}${path6}`, { ...init, headers });
   const text = await response.text();
   let body;
   try {
@@ -11309,7 +11320,7 @@ function createOAuthClientPayload(options) {
     logo_url: options.logoUrl
   };
 }
-async function authFetchJson(path4, init = {}) {
+async function authFetchJson(path6, init = {}) {
   const environment = selectedEnvironment();
   const credential = await refreshCredentialIfNeeded(environment);
   if (!credential) {
@@ -11331,7 +11342,7 @@ async function authFetchJson(path4, init = {}) {
     throw err;
   }
   headers.set("Authorization", `Bearer ${credential.accessToken}`);
-  const response = await fetch(`${authBaseUrl}${path4}`, { ...init, headers });
+  const response = await fetch(`${authBaseUrl}${path6}`, { ...init, headers });
   const text = await response.text();
   const payload = text ? JSON.parse(text) : {};
   if (!response.ok || payload.success === false) {
@@ -11347,7 +11358,7 @@ function normalizeList(values, fallback = []) {
 }
 
 // src/commands/integrations.ts
-import { readdir, readFile as readFile3, stat } from "fs/promises";
+import { readdir, readFile as readFile4, stat } from "fs/promises";
 import { join as join4, relative as relative3 } from "path";
 function registerIntegrationsCommand(program2) {
   const integrations = program2.command("integrations").description("Generate and validate Topolo integration handoffs.");
@@ -11491,7 +11502,7 @@ function detectFramework(packageJson2, haystack) {
 }
 async function readPackageJson2(repoRoot) {
   try {
-    return JSON.parse(await readFile3(join4(repoRoot, "package.json"), "utf8"));
+    return JSON.parse(await readFile4(join4(repoRoot, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -11514,7 +11525,7 @@ async function collectFiles(repoRoot) {
       if (info.size > 25e4) continue;
       result.push({
         path: relative3(root, fullPath),
-        content: await readFile3(fullPath, "utf8")
+        content: await readFile4(fullPath, "utf8")
       });
     }
   }
@@ -11530,9 +11541,9 @@ function formatCheckResult(result) {
 }
 
 // src/commands/skills.ts
-import { spawnSync } from "child_process";
-import { existsSync as existsSync4 } from "fs";
-import { mkdir as mkdir3, copyFile, readFile as readFile4, writeFile as writeFile4, rm } from "fs/promises";
+import { spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync5 } from "fs";
+import { mkdir as mkdir3, copyFile, readFile as readFile5, writeFile as writeFile5, rm } from "fs/promises";
 import { homedir as homedir2 } from "os";
 import { dirname as dirname4, join as join5, resolve as resolve3 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
@@ -11543,19 +11554,19 @@ function skillsSourceDir() {
   const distCandidate = resolve3(here, "../skills");
   const srcCandidate = resolve3(here, "../../skills");
   for (const candidate of [distCandidate, srcCandidate]) {
-    if (existsSync4(join5(candidate, "topolo", "SKILL.md"))) return candidate;
+    if (existsSync5(join5(candidate, "topolo", "SKILL.md"))) return candidate;
   }
   return distCandidate;
 }
 function resolveMcpCommand() {
-  const probe = spawnSync(process.platform === "win32" ? "where" : "which", ["topolo-mcp"], {
+  const probe = spawnSync2(process.platform === "win32" ? "where" : "which", ["topolo-mcp"], {
     stdio: "ignore"
   });
   if (probe.status === 0) return { command: "topolo-mcp", args: [] };
   return { command: "npx", args: ["-y", "@topolo/mcp"] };
 }
 function agentBinaryExists(bin) {
-  const probe = spawnSync(process.platform === "win32" ? "where" : "which", [bin], {
+  const probe = spawnSync2(process.platform === "win32" ? "where" : "which", [bin], {
     stdio: "ignore"
   });
   return probe.status === 0;
@@ -11576,9 +11587,9 @@ async function installSkillFile(sourceDir, targetDir) {
 function registerViaOfficialCli(cli, mcp, agentName) {
   if (!agentBinaryExists(cli)) return false;
   const scopeArgs = cli === "claude" ? ["-s", "user"] : [];
-  spawnSync(cli, ["mcp", "remove", "topolo", ...scopeArgs], { stdio: "ignore" });
+  spawnSync2(cli, ["mcp", "remove", "topolo", ...scopeArgs], { stdio: "ignore" });
   const envArgs = cli === "claude" ? ["-e", `TOPOLO_AGENT_NAME=${agentName}`] : ["--env", `TOPOLO_AGENT_NAME=${agentName}`];
-  const result = spawnSync(
+  const result = spawnSync2(
     cli,
     ["mcp", "add", "topolo", ...scopeArgs, ...envArgs, "--", mcp.command, ...mcp.args],
     { stdio: "ignore" }
@@ -11586,11 +11597,11 @@ function registerViaOfficialCli(cli, mcp, agentName) {
   return result.status === 0;
 }
 async function registerClaudeViaConfig(mcp) {
-  const path4 = join5(homedir2(), ".claude.json");
+  const path6 = join5(homedir2(), ".claude.json");
   let config = {};
-  if (existsSync4(path4)) {
+  if (existsSync5(path6)) {
     try {
-      config = JSON.parse(await readFile4(path4, "utf8"));
+      config = JSON.parse(await readFile5(path6, "utf8"));
     } catch {
       config = {};
     }
@@ -11603,13 +11614,13 @@ async function registerClaudeViaConfig(mcp) {
     env: { TOPOLO_AGENT_NAME: AGENT_NAME_FOR.claude }
   };
   config.mcpServers = servers;
-  await writeFile4(path4, `${JSON.stringify(config, null, 2)}
+  await writeFile5(path6, `${JSON.stringify(config, null, 2)}
 `, "utf8");
 }
 async function registerCodexViaConfig(mcp) {
-  const path4 = join5(homedir2(), ".codex", "config.toml");
+  const path6 = join5(homedir2(), ".codex", "config.toml");
   let text = "";
-  if (existsSync4(path4)) text = await readFile4(path4, "utf8");
+  if (existsSync5(path6)) text = await readFile5(path6, "utf8");
   text = text.replace(
     /(^|\n)\[mcp_servers\.topolo(?:\.[a-z]+)?\][^\[]*/g,
     (match) => match.startsWith("\n") ? "\n" : ""
@@ -11625,8 +11636,8 @@ command = "${mcp.command}"${argsToml}
 [mcp_servers.topolo.env]
 TOPOLO_AGENT_NAME = "${AGENT_NAME_FOR.codex}"
 `;
-  await mkdir3(dirname4(path4), { recursive: true });
-  await writeFile4(path4, `${text}${block}`, "utf8");
+  await mkdir3(dirname4(path6), { recursive: true });
+  await writeFile5(path6, `${text}${block}`, "utf8");
 }
 async function installForAgent(agent, sourceDir, mcp, opts) {
   const skillDir = agent === "claude" ? claudeSkillDir(opts.projectDir) : codexSkillDir();
@@ -11664,7 +11675,7 @@ function registerSkillsCommand(program2) {
       const mode = resolveOutputMode(opts.json);
       try {
         const sourceDir = skillsSourceDir();
-        if (!existsSync4(join5(sourceDir, "topolo", "SKILL.md"))) {
+        if (!existsSync5(join5(sourceDir, "topolo", "SKILL.md"))) {
           throw new Error(
             "Bundled skill file not found. Reinstall the CLI: npm install -g @topolo/cli"
           );
@@ -11693,7 +11704,7 @@ function registerSkillsCommand(program2) {
         const skillDir = agent === "claude" ? claudeSkillDir() : codexSkillDir();
         return {
           agent,
-          skillInstalled: existsSync4(join5(skillDir, "SKILL.md")),
+          skillInstalled: existsSync5(join5(skillDir, "SKILL.md")),
           skillPath: join5(skillDir, "SKILL.md"),
           cliAvailable: agentBinaryExists(agent)
         };
@@ -11710,10 +11721,10 @@ function registerSkillsCommand(program2) {
       for (const agent of resolveTargets(opts)) {
         const skillDir = agent === "claude" ? claudeSkillDir() : codexSkillDir();
         const skillFile = join5(skillDir, "SKILL.md");
-        const skillRemoved = existsSync4(skillFile);
+        const skillRemoved = existsSync5(skillFile);
         if (skillRemoved) await rm(skillFile, { force: true });
         if (agentBinaryExists(agent)) {
-          spawnSync(agent, ["mcp", "remove", "topolo"], { stdio: "ignore" });
+          spawnSync2(agent, ["mcp", "remove", "topolo"], { stdio: "ignore" });
         }
         removed.push({ agent, skillRemoved });
       }