@topolo/cli 0.5.1 → 0.5.2

package/dist/index.js

@@ -61,13 +61,13 @@ var TopoloHttpError = class extends TopoloSdkError {
   body;
   service;
   path;
-  constructor(service, path5, status, body, message) {
-    super("http_error", message ?? `HTTP ${status} from ${service}${path5}`);
+  constructor(service, path6, status, body, message) {
+    super("http_error", message ?? `HTTP ${status} from ${service}${path6}`);
     this.name = "TopoloHttpError";
     this.status = status;
     this.body = body;
     this.service = service;
-    this.path = path5;
+    this.path = path6;
   }
 };
 var APP_API_URLS = {
@@ -185,7 +185,7 @@ var APPLICATIONS = {
     "appDir": "TopoloAuth",
     "name": "topolo-auth",
     "packageName": "topolo-auth",
-    "productionUrl": "https://auth.topolo.app/login",
+    "productionUrl": "https://auth.topolo.app",
     "services": [
       "auth"
     ],
@@ -273,9 +273,7 @@ var APPLICATIONS = {
         "domains": [
           "brand.topolo.app"
         ],
-        "routes": [
-          "brand.topolo.app"
-        ],
+        "routes": [],
         "appId": "brand"
       },
       {
@@ -387,9 +385,7 @@ var APPLICATIONS = {
         "domains": [
           "campaigns.topolo.app"
         ],
-        "routes": [
-          "campaigns.topolo.app"
-        ],
+        "routes": [],
         "appId": "campaigns"
       },
       {
@@ -1077,11 +1073,13 @@ var APPLICATIONS = {
       {
         "name": "topolo-nexus-dashboard",
         "kind": "worker",
-        "apiUrl": null,
+        "apiUrl": "https://nexus.topolo.app",
         "domains": [
           "nexus.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "nexus.topolo.app"
+        ],
         "appId": null
       },
       {
@@ -2178,17 +2176,17 @@ function validateTopoloActionInput(schema, input3) {
   validateNode(schema, input3, "$", schema, errors, 0);
   return { valid: errors.length === 0, errors };
 }
-function inspectSchema(schema, path5, root, depth) {
-  if (depth > 128) return { path: path5, code: "schema_depth", message: "Schema recursion exceeded 128 levels." };
+function inspectSchema(schema, path6, root, depth) {
+  if (depth > 128) return { path: path6, code: "schema_depth", message: "Schema recursion exceeded 128 levels." };
   const unsupportedKeyword = Object.keys(schema).find((keyword) => !SUPPORTED_SCHEMA_KEYWORDS.has(keyword));
   if (unsupportedKeyword) {
-    return { path: path5, code: "unsupported_schema_keyword", message: `Action schema uses unsupported keyword ${unsupportedKeyword}.` };
+    return { path: path6, code: "unsupported_schema_keyword", message: `Action schema uses unsupported keyword ${unsupportedKeyword}.` };
   }
   if (typeof schema.format === "string" && !["uri", "email", "date-time"].includes(schema.format)) {
-    return { path: path5, code: "unsupported_schema_format", message: `Action schema uses unsupported format ${schema.format}.` };
+    return { path: path6, code: "unsupported_schema_format", message: `Action schema uses unsupported format ${schema.format}.` };
   }
   if (typeof schema.$ref === "string" && !resolveLocalReference(root, schema.$ref)) {
-    return { path: path5, code: "unsupported_schema_ref", message: `Cannot resolve schema reference ${schema.$ref}.` };
+    return { path: path6, code: "unsupported_schema_ref", message: `Cannot resolve schema reference ${schema.$ref}.` };
   }
   const children = [];
   if (isRecord(schema.properties)) children.push(...Object.entries(schema.properties));
@@ -2204,7 +2202,7 @@ function inspectSchema(schema, path5, root, depth) {
   );
   for (const [key, child] of children) {
     if (!isRecord(child)) continue;
-    const issue = inspectSchema(child, `${path5}.${key}`, root, depth + 1);
+    const issue = inspectSchema(child, `${path6}.${key}`, root, depth + 1);
     if (issue) return issue;
   }
   return null;
@@ -2212,129 +2210,129 @@ function inspectSchema(schema, path5, root, depth) {
 function arraySchemaEntries(keyword, value) {
   return Array.isArray(value) ? value.map((candidate, index) => [`${keyword}[${index}]`, candidate]) : [];
 }
-function validateNode(schema, value, path5, root, errors, depth) {
+function validateNode(schema, value, path6, root, errors, depth) {
   if (depth > 128) {
-    errors.push({ path: path5, code: "schema_depth", message: "Schema recursion exceeded 128 levels." });
+    errors.push({ path: path6, code: "schema_depth", message: "Schema recursion exceeded 128 levels." });
     return;
   }
   if (typeof schema.$ref === "string") {
     const resolved = resolveLocalReference(root, schema.$ref);
     if (!resolved) {
-      errors.push({ path: path5, code: "unsupported_schema_ref", message: `Cannot resolve schema reference ${schema.$ref}.` });
+      errors.push({ path: path6, code: "unsupported_schema_ref", message: `Cannot resolve schema reference ${schema.$ref}.` });
       return;
     }
-    validateNode(resolved, value, path5, root, errors, depth + 1);
+    validateNode(resolved, value, path6, root, errors, depth + 1);
   }
   if (Array.isArray(schema.allOf)) {
     for (const candidate of schema.allOf) {
-      if (isRecord(candidate)) validateNode(candidate, value, path5, root, errors, depth + 1);
+      if (isRecord(candidate)) validateNode(candidate, value, path6, root, errors, depth + 1);
     }
   }
   if (Array.isArray(schema.anyOf) && !schema.anyOf.some((candidate) => candidateMatches(candidate, value, root, depth))) {
-    errors.push({ path: path5, code: "any_of", message: "Value does not match any allowed schema." });
+    errors.push({ path: path6, code: "any_of", message: "Value does not match any allowed schema." });
     return;
   }
   if (Array.isArray(schema.oneOf)) {
     const matches = schema.oneOf.filter((candidate) => candidateMatches(candidate, value, root, depth)).length;
     if (matches !== 1) {
-      errors.push({ path: path5, code: "one_of", message: "Value must match exactly one allowed schema." });
+      errors.push({ path: path6, code: "one_of", message: "Value must match exactly one allowed schema." });
       return;
     }
   }
   if (value === null && schema.nullable === true) return;
   if (Object.prototype.hasOwnProperty.call(schema, "const") && !sameJsonValue(value, schema.const)) {
-    errors.push({ path: path5, code: "const", message: `Value must equal ${JSON.stringify(schema.const)}.` });
+    errors.push({ path: path6, code: "const", message: `Value must equal ${JSON.stringify(schema.const)}.` });
     return;
   }
   if (Array.isArray(schema.enum) && !schema.enum.some((candidate) => sameJsonValue(value, candidate))) {
-    errors.push({ path: path5, code: "enum", message: `Value must be one of ${schema.enum.map((item) => JSON.stringify(item)).join(", ")}.` });
+    errors.push({ path: path6, code: "enum", message: `Value must be one of ${schema.enum.map((item) => JSON.stringify(item)).join(", ")}.` });
     return;
   }
   if (!matchesType(schema.type, value)) {
-    errors.push({ path: path5, code: "type", message: `Expected ${String(schema.type)}.` });
+    errors.push({ path: path6, code: "type", message: `Expected ${String(schema.type)}.` });
     return;
   }
-  if (typeof value === "string") validateString(schema, value, path5, errors);
-  if (typeof value === "number") validateNumber(schema, value, path5, errors);
-  if (Array.isArray(value)) validateArray(schema, value, path5, root, errors, depth);
-  if (isRecord(value)) validateObject(schema, value, path5, root, errors, depth);
+  if (typeof value === "string") validateString(schema, value, path6, errors);
+  if (typeof value === "number") validateNumber(schema, value, path6, errors);
+  if (Array.isArray(value)) validateArray(schema, value, path6, root, errors, depth);
+  if (isRecord(value)) validateObject(schema, value, path6, root, errors, depth);
 }
-function validateObject(schema, value, path5, root, errors, depth) {
+function validateObject(schema, value, path6, root, errors, depth) {
   if (typeof schema.minProperties === "number" && Object.keys(value).length < schema.minProperties) {
-    errors.push({ path: path5, code: "min_properties", message: `Expected at least ${schema.minProperties} properties.` });
+    errors.push({ path: path6, code: "min_properties", message: `Expected at least ${schema.minProperties} properties.` });
   }
   if (typeof schema.maxProperties === "number" && Object.keys(value).length > schema.maxProperties) {
-    errors.push({ path: path5, code: "max_properties", message: `Expected at most ${schema.maxProperties} properties.` });
+    errors.push({ path: path6, code: "max_properties", message: `Expected at most ${schema.maxProperties} properties.` });
   }
   const properties = isRecord(schema.properties) ? schema.properties : {};
   const required = Array.isArray(schema.required) ? schema.required.map(String) : [];
   for (const key of required) {
     if (!Object.prototype.hasOwnProperty.call(value, key)) {
-      errors.push({ path: `${path5}.${key}`, code: "required", message: "Required property is missing." });
+      errors.push({ path: `${path6}.${key}`, code: "required", message: "Required property is missing." });
     }
   }
   if (isRecord(schema.propertyNames)) {
     for (const key of Object.keys(value)) {
-      validateNode(schema.propertyNames, key, `${path5}.${key}`, root, errors, depth + 1);
+      validateNode(schema.propertyNames, key, `${path6}.${key}`, root, errors, depth + 1);
     }
   }
   for (const [key, child] of Object.entries(value)) {
     const childSchema = properties[key];
     if (isRecord(childSchema)) {
-      validateNode(childSchema, child, `${path5}.${key}`, root, errors, depth + 1);
+      validateNode(childSchema, child, `${path6}.${key}`, root, errors, depth + 1);
     } else if (schema.additionalProperties === false) {
-      errors.push({ path: `${path5}.${key}`, code: "additional_property", message: "Property is not declared by the action schema." });
+      errors.push({ path: `${path6}.${key}`, code: "additional_property", message: "Property is not declared by the action schema." });
     } else if (isRecord(schema.additionalProperties)) {
-      validateNode(schema.additionalProperties, child, `${path5}.${key}`, root, errors, depth + 1);
+      validateNode(schema.additionalProperties, child, `${path6}.${key}`, root, errors, depth + 1);
     }
   }
 }
-function validateArray(schema, value, path5, root, errors, depth) {
+function validateArray(schema, value, path6, root, errors, depth) {
   if (typeof schema.minItems === "number" && value.length < schema.minItems) {
-    errors.push({ path: path5, code: "min_items", message: `Expected at least ${schema.minItems} items.` });
+    errors.push({ path: path6, code: "min_items", message: `Expected at least ${schema.minItems} items.` });
   }
   if (typeof schema.maxItems === "number" && value.length > schema.maxItems) {
-    errors.push({ path: path5, code: "max_items", message: `Expected at most ${schema.maxItems} items.` });
+    errors.push({ path: path6, code: "max_items", message: `Expected at most ${schema.maxItems} items.` });
   }
   if (schema.uniqueItems === true) {
     const unique2 = new Set(value.map((item) => JSON.stringify(item)));
-    if (unique2.size !== value.length) errors.push({ path: path5, code: "unique_items", message: "Expected every item to be unique." });
+    if (unique2.size !== value.length) errors.push({ path: path6, code: "unique_items", message: "Expected every item to be unique." });
   }
   if (isRecord(schema.items)) {
-    value.forEach((item, index) => validateNode(schema.items, item, `${path5}[${index}]`, root, errors, depth + 1));
+    value.forEach((item, index) => validateNode(schema.items, item, `${path6}[${index}]`, root, errors, depth + 1));
   }
 }
-function validateString(schema, value, path5, errors) {
+function validateString(schema, value, path6, errors) {
   if (typeof schema.minLength === "number" && value.length < schema.minLength) {
-    errors.push({ path: path5, code: "min_length", message: `Expected at least ${schema.minLength} characters.` });
+    errors.push({ path: path6, code: "min_length", message: `Expected at least ${schema.minLength} characters.` });
   }
   if (typeof schema.maxLength === "number" && value.length > schema.maxLength) {
-    errors.push({ path: path5, code: "max_length", message: `Expected at most ${schema.maxLength} characters.` });
+    errors.push({ path: path6, code: "max_length", message: `Expected at most ${schema.maxLength} characters.` });
   }
   if (typeof schema.pattern === "string") {
     try {
-      if (!new RegExp(schema.pattern).test(value)) errors.push({ path: path5, code: "pattern", message: "Value does not match the required pattern." });
+      if (!new RegExp(schema.pattern).test(value)) errors.push({ path: path6, code: "pattern", message: "Value does not match the required pattern." });
     } catch {
-      errors.push({ path: path5, code: "invalid_schema_pattern", message: "Action schema contains an invalid pattern." });
+      errors.push({ path: path6, code: "invalid_schema_pattern", message: "Action schema contains an invalid pattern." });
     }
   }
-  if (schema.format === "uri" && !isUrl(value)) errors.push({ path: path5, code: "format_uri", message: "Expected an absolute URL." });
-  if (schema.format === "email" && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(value)) errors.push({ path: path5, code: "format_email", message: "Expected an email address." });
-  if (schema.format === "date-time" && !isDateTime(value)) errors.push({ path: path5, code: "format_date_time", message: "Expected an ISO-8601 date-time." });
+  if (schema.format === "uri" && !isUrl(value)) errors.push({ path: path6, code: "format_uri", message: "Expected an absolute URL." });
+  if (schema.format === "email" && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(value)) errors.push({ path: path6, code: "format_email", message: "Expected an email address." });
+  if (schema.format === "date-time" && !isDateTime(value)) errors.push({ path: path6, code: "format_date_time", message: "Expected an ISO-8601 date-time." });
 }
-function validateNumber(schema, value, path5, errors) {
-  if (typeof schema.minimum === "number" && value < schema.minimum) errors.push({ path: path5, code: "minimum", message: `Expected a value of at least ${schema.minimum}.` });
-  if (typeof schema.maximum === "number" && value > schema.maximum) errors.push({ path: path5, code: "maximum", message: `Expected a value of at most ${schema.maximum}.` });
+function validateNumber(schema, value, path6, errors) {
+  if (typeof schema.minimum === "number" && value < schema.minimum) errors.push({ path: path6, code: "minimum", message: `Expected a value of at least ${schema.minimum}.` });
+  if (typeof schema.maximum === "number" && value > schema.maximum) errors.push({ path: path6, code: "maximum", message: `Expected a value of at most ${schema.maximum}.` });
   const exclusiveMinimum = typeof schema.exclusiveMinimum === "number" ? schema.exclusiveMinimum : schema.exclusiveMinimum === true && typeof schema.minimum === "number" ? schema.minimum : null;
   const exclusiveMaximum = typeof schema.exclusiveMaximum === "number" ? schema.exclusiveMaximum : schema.exclusiveMaximum === true && typeof schema.maximum === "number" ? schema.maximum : null;
   if (exclusiveMinimum !== null && value <= exclusiveMinimum) {
-    errors.push({ path: path5, code: "exclusive_minimum", message: `Expected a value greater than ${exclusiveMinimum}.` });
+    errors.push({ path: path6, code: "exclusive_minimum", message: `Expected a value greater than ${exclusiveMinimum}.` });
   }
   if (exclusiveMaximum !== null && value >= exclusiveMaximum) {
-    errors.push({ path: path5, code: "exclusive_maximum", message: `Expected a value less than ${exclusiveMaximum}.` });
+    errors.push({ path: path6, code: "exclusive_maximum", message: `Expected a value less than ${exclusiveMaximum}.` });
   }
   if (typeof schema.multipleOf === "number" && !isMultipleOf(value, schema.multipleOf)) {
-    errors.push({ path: path5, code: "multiple_of", message: `Expected a multiple of ${schema.multipleOf}.` });
+    errors.push({ path: path6, code: "multiple_of", message: `Expected a multiple of ${schema.multipleOf}.` });
   }
 }
 function candidateMatches(candidate, value, root, depth) {
@@ -3227,8 +3225,8 @@ function normalizeActionCatalogEntry(item) {
   const name = pickActionString(a.name);
   const appId = pickActionString(a.app_id) ?? pickActionString(a.appId);
   const method = pickActionString(a.method)?.toUpperCase();
-  const path5 = pickActionString(a.path);
-  if (!actionId || !name || !appId || !method || !path5 || !isHttpMethod(method)) {
+  const path6 = pickActionString(a.path);
+  if (!actionId || !name || !appId || !method || !path6 || !isHttpMethod(method)) {
     return null;
   }
   return {
@@ -3243,7 +3241,7 @@ function normalizeActionCatalogEntry(item) {
     appSlug: pickActionString(a.app_slug) ?? pickActionString(a.appSlug) ?? null,
     appName: pickActionString(a.app_name) ?? pickActionString(a.appName) ?? null,
     method,
-    path: path5,
+    path: path6,
     permissionName: pickActionString(a.permission_name) ?? pickActionString(a.permissionName) ?? "",
     requiredPermission: pickActionString(a.required_permission) ?? pickActionString(a.requiredPermission) ?? "",
     authorizationMode: pickAuthorizationMode(a.authorization_mode ?? a.authorizationMode),
@@ -3279,7 +3277,7 @@ function stringArray(value) {
 }
 function mapActionInput(action, input3) {
   const remaining = { ...input3 || {} };
-  const path5 = action.path.replace(/\{([a-zA-Z0-9_]+)\}/g, (_match, key) => {
+  const path6 = action.path.replace(/\{([a-zA-Z0-9_]+)\}/g, (_match, key) => {
     const value = remaining[key];
     if (value === void 0 || value === null || value === "") {
       throw new TopoloSdkError(
@@ -3296,14 +3294,14 @@ function mapActionInput(action, input3) {
   delete remaining.body;
   if (action.method === "GET") {
     return {
-      path: path5,
+      path: path6,
       query: objectToQuery({ ...remaining, ...explicitQuery })
     };
   }
   const query = objectToQuery(explicitQuery);
   const body = explicitBody !== void 0 ? explicitBody : remaining;
   return {
-    path: path5,
+    path: path6,
     ...query ? { query } : {},
     body
   };
@@ -3473,8 +3471,8 @@ var TopoloOAuth = class {
     if (params.clientSecret) body.set("client_secret", params.clientSecret);
     return this.#postForm("/api/developer-oauth/token", body);
   }
-  async #postForm(path5, body) {
-    const url = new URL(path5, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
+  async #postForm(path6, body) {
+    const url = new URL(path6, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
     const res = await this.fetchImpl(url.toString(), {
       method: "POST",
       headers: {
@@ -3490,7 +3488,7 @@ var TopoloOAuth = class {
         const err = parsed;
         throw new TopoloAuthError(err.error_description || err.error, err.error);
       }
-      throw new TopoloHttpError("auth", path5, res.status, parsed);
+      throw new TopoloHttpError("auth", path6, res.status, parsed);
     }
     return parsed;
   }
@@ -3528,13 +3526,13 @@ var TopoloHttpError2 = class extends TopoloSdkError2 {
   body;
   service;
   path;
-  constructor(service, path5, status, body, message) {
-    super("http_error", message ?? `HTTP ${status} from ${service}${path5}`);
+  constructor(service, path6, status, body, message) {
+    super("http_error", message ?? `HTTP ${status} from ${service}${path6}`);
     this.name = "TopoloHttpError";
     this.status = status;
     this.body = body;
     this.service = service;
-    this.path = path5;
+    this.path = path6;
   }
 };
 var APP_API_URLS2 = {
@@ -3665,8 +3663,8 @@ var TopoloOAuth2 = class {
     if (params.clientSecret) body.set("client_secret", params.clientSecret);
     return this.#postForm("/api/developer-oauth/token", body);
   }
-  async #postForm(path5, body) {
-    const url = new URL(path5, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
+  async #postForm(path6, body) {
+    const url = new URL(path6, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
     const res = await this.fetchImpl(url.toString(), {
       method: "POST",
       headers: {
@@ -3682,7 +3680,7 @@ var TopoloOAuth2 = class {
         const err = parsed;
         throw new TopoloAuthError2(err.error_description || err.error, err.error);
       }
-      throw new TopoloHttpError2("auth", path5, res.status, parsed);
+      throw new TopoloHttpError2("auth", path6, res.status, parsed);
     }
     return parsed;
   }
@@ -3712,22 +3710,22 @@ function configPath() {
   return join(base, "topolo", "config.json");
 }
 async function readConfig() {
-  const path5 = configPath();
-  if (!existsSync(path5)) return {};
+  const path6 = configPath();
+  if (!existsSync(path6)) return {};
   try {
-    const raw = await readFile(path5, "utf8");
+    const raw = await readFile(path6, "utf8");
     return JSON.parse(raw);
   } catch {
     return {};
   }
 }
 async function writeConfig(config) {
-  const path5 = configPath();
-  await mkdir(dirname(path5), { recursive: true });
-  await writeFile(path5, JSON.stringify(config, null, 2) + "\n", "utf8");
+  const path6 = configPath();
+  await mkdir(dirname(path6), { recursive: true });
+  await writeFile(path6, JSON.stringify(config, null, 2) + "\n", "utf8");
   if (platform() !== "win32") {
     try {
-      await chmod(path5, 384);
+      await chmod(path6, 384);
     } catch {
     }
   }
@@ -4047,9 +4045,9 @@ function readCliVersion() {
       join2(here, "package.json"),
       join2(here, "..", "package.json")
     ];
-    for (const path5 of candidates) {
+    for (const path6 of candidates) {
       try {
-        const pkg = JSON.parse(readFileSync(path5, "utf8"));
+        const pkg = JSON.parse(readFileSync(path6, "utf8"));
         if (typeof pkg.version === "string" && pkg.version) return pkg.version;
       } catch {
       }
@@ -4408,7 +4406,7 @@ function registerApiCommand(program2) {
     "-q, --query <kv...>",
     "Query params as key=value (repeatable), e.g. --query source=cli page=2"
   ).option("--resource-type <type>", "Cataloged app-local workspace resource alias for resource-scoped API keys").option("--resource-id <id>", "Workspace resource id for resource-scoped API keys").option("--confirm", "Acknowledge a mutating request").option("--json", "Output JSON", true).option("--no-json", "Output human-readable text").action(
-    async (service, method, path5, opts) => {
+    async (service, method, path6, opts) => {
       const mode = resolveOutputMode(opts.json);
       try {
         const upperMethod = method.toUpperCase();
@@ -4447,7 +4445,7 @@ function registerApiCommand(program2) {
         const result = await topolo.client.request({
           service,
           method: httpMethod,
-          path: path5,
+          path: path6,
           body,
           ...query ? { query } : {},
           ...resource ? { resource } : {},
@@ -4611,13 +4609,13 @@ async function requiredClient() {
 function parseJsonObject(value) {
   let source = value;
   if (value.startsWith("@")) {
-    const path5 = value.slice(1);
-    if (!path5) throw new Error("--data @file path must not be empty");
+    const path6 = value.slice(1);
+    if (!path6) throw new Error("--data @file path must not be empty");
     try {
-      source = readFileSync2(path5, "utf8");
+      source = readFileSync2(path6, "utf8");
     } catch (err) {
       const detail = err instanceof Error ? err.message : String(err);
-      throw new Error(`Could not read --data file ${path5}: ${detail}`);
+      throw new Error(`Could not read --data file ${path6}: ${detail}`);
     }
   }
   let parsed;
@@ -4691,8 +4689,8 @@ function formatActionPlan(plan) {
 
 // src/commands/apps.ts
 import { execSync } from "child_process";
-import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync4, writeFileSync } from "fs";
-import path3 from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
+import path4 from "path";
 
 // src/commands/app-audit-local.ts
 import {
@@ -5794,14 +5792,14 @@ import { constants } from "fs";
 import { access } from "fs/promises";
 import { relative, resolve } from "path";
 function normalizeHomePath(value) {
-  const path5 = String(value || "/dashboard").trim();
-  if (!path5.startsWith("/") || path5.startsWith("//") || /[?#]/.test(path5)) {
+  const path6 = String(value || "/dashboard").trim();
+  if (!path6.startsWith("/") || path6.startsWith("//") || /[?#]/.test(path6)) {
     throw new Error("Invalid home path. Use an absolute application path such as /dashboard.");
   }
-  if (["/", "/login", "/auth/callback", "/getting-started"].includes(path5)) {
+  if (["/", "/login", "/auth/callback", "/getting-started"].includes(path6)) {
     throw new Error("Home path must be a protected product route, not a reserved entry route.");
   }
-  return path5.replace(/\/$/, "") || "/dashboard";
+  return path6.replace(/\/$/, "") || "/dashboard";
 }
 function normalizeHomeLabel(value) {
   const label = String(value || "Dashboard").trim();
@@ -5942,9 +5940,9 @@ function toTitle(value) {
 function json(value) {
   return JSON.stringify(value, null, 2);
 }
-async function pathExists(path5) {
+async function pathExists(path6) {
   try {
-    await access(path5, constants.F_OK);
+    await access(path6, constants.F_OK);
     return true;
   } catch {
     return false;
@@ -6480,11 +6478,20 @@ function appIdentityTs(application) {
     "}",
     "",
     "export function getBrowserAuthBaseUrl(): string {",
-    "  const defaultAuthUrl =",
-    "    typeof window !== 'undefined' && window.location.hostname.endsWith('.stg.topolo.us')",
-    "      ? 'https://auth.stg.topolo.us'",
-    "      : 'https://auth.topolo.app';",
-    "  return (import.meta.env.VITE_TOPOLO_AUTH_URL || defaultAuthUrl).replace(/\\/+$/, '');",
+    "  // A declared URL always wins; deployed builds set VITE_TOPOLO_AUTH_URL in",
+    "  // their per-environment build commands, so the host map below only covers",
+    "  // platform domains. Anything else fails loudly \u2014 an unknown host",
+    "  // (localhost, workers.dev previews) must never silently authenticate",
+    "  // against production Auth.",
+    "  const declared = import.meta.env.VITE_TOPOLO_AUTH_URL;",
+    "  if (declared) return declared.replace(/\\/+$/, '');",
+    "  const hostname = typeof window !== 'undefined' ? window.location.hostname : '';",
+    "  if (hostname.endsWith('.stg.topolo.us')) return 'https://auth.stg.topolo.us';",
+    "  if (hostname.endsWith('.topolo.dev')) return 'https://auth.topolo.dev';",
+    "  if (hostname.endsWith('.topolo.app')) return 'https://auth.topolo.app';",
+    "  throw new Error(",
+    "    `VITE_TOPOLO_AUTH_URL must be set for host \"${hostname || 'non-browser context'}\" \u2014 refusing to default to production Auth.`,",
+    "  );",
     "}",
     "",
     "// Canonical browser app id. index.html bakes %VITE_TOPOLO_APP_ID% into",
@@ -7219,7 +7226,12 @@ import { createAccountLinkPayload, createTopoloAuthorizationUrl, exchangeTopoloC
 
 type AuthState = 'ready' | 'missing_client' | 'authorizing' | 'authenticated' | 'error';
 const APP_NAME = '${escapeSingleQuoted(appName)}';
-const AUTH_URL = import.meta.env.VITE_TOPOLO_AUTH_URL ?? import.meta.env.VITE_TOPOLO_AUTH_BASE_URL ?? 'https://auth.topolo.app';
+// Environment-aware default: hardcoding the production host would point a
+// staging build at prod Auth whenever the VITE_ vars were dropped.
+const DEFAULT_AUTH_URL = window.location.hostname.endsWith('.stg.topolo.us')
+  ? 'https://auth.stg.topolo.us'
+  : 'https://auth.topolo.app';
+const AUTH_URL = import.meta.env.VITE_TOPOLO_AUTH_URL ?? import.meta.env.VITE_TOPOLO_AUTH_BASE_URL ?? DEFAULT_AUTH_URL;
 const CLIENT_ID = import.meta.env.VITE_TOPOLO_CLIENT_ID || '${defaultClientId}';
 const REDIRECT_URI = import.meta.env.VITE_TOPOLO_REDIRECT_URI || \`\${window.location.origin}/auth/callback\`;
 const REQUESTED_SCOPES = (import.meta.env.VITE_TOPOLO_SCOPES || 'openid profile email organization:read entitlements:read').split(/[\\s,]+/).filter(Boolean);
@@ -7318,235 +7330,6 @@ function webWorkerTs(application, api) {
     ""
   ].join("\n");
 }
-function platformWebWranglerToml(application, api) {
-  const slug = toSlug(application.id);
-  const host = application.productionUrl ? new URL(application.productionUrl).host : `${slug}.topolo.app`;
-  return [
-    `name = "topolo-${slug}"`,
-    'main = "src/worker.ts"',
-    `compatibility_date = "${CLOUDFLARE_COMPATIBILITY_DATE}"`,
-    'compatibility_flags = ["nodejs_compat"]',
-    `account_id = "${CLOUDFLARE_ACCOUNT_ID}"`,
-    "workers_dev = false",
-    "",
-    "[assets]",
-    'directory = "./dist"',
-    'binding = "ASSETS"',
-    'not_found_handling = "single-page-application"',
-    ...api ? ['run_worker_first = ["/api/*"]'] : [],
-    "",
-    "[observability]",
-    "enabled = true",
-    "",
-    "[[routes]]",
-    `pattern = "${host}"`,
-    "custom_domain = true",
-    "",
-    "[vars]",
-    `APP_ID = "${application.appId ?? ""}"`,
-    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
-    "",
-    ...api ? [
-      "[[services]]",
-      'binding = "API"',
-      `service = "topolo-${slug}-api"`,
-      ""
-    ] : [],
-    "[env.development]",
-    `name = "topolo-${slug}-development"`,
-    `account_id = "${DEVELOPMENT_CLOUDFLARE_ACCOUNT_ID}"`,
-    "workers_dev = true",
-    "",
-    "[env.development.vars]",
-    `APP_ID = "${application.appId ?? ""}"`,
-    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
-    "",
-    "[[env.development.routes]]",
-    `pattern = "${slug}.topolo.dev"`,
-    "custom_domain = true",
-    "",
-    "[env.development.assets]",
-    'directory = "./dist"',
-    'binding = "ASSETS"',
-    'not_found_handling = "single-page-application"',
-    ...api ? ['run_worker_first = ["/api/*"]'] : [],
-    "",
-    ...api ? [
-      "[[env.development.services]]",
-      'binding = "API"',
-      `service = "topolo-${slug}-api-development"`,
-      ""
-    ] : [],
-    "[env.staging]",
-    `name = "topolo-${slug}-staging"`,
-    `account_id = "${STAGING_CLOUDFLARE_ACCOUNT_ID}"`,
-    "workers_dev = true",
-    "",
-    "[env.staging.vars]",
-    `APP_ID = "${application.appId ?? ""}"`,
-    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
-    "",
-    "[[env.staging.routes]]",
-    `pattern = "${slug}.stg.topolo.us"`,
-    "custom_domain = true",
-    "",
-    "[env.staging.assets]",
-    'directory = "./dist"',
-    'binding = "ASSETS"',
-    'not_found_handling = "single-page-application"',
-    ...api ? ['run_worker_first = ["/api/*"]'] : [],
-    "",
-    ...api ? [
-      "[[env.staging.services]]",
-      'binding = "API"',
-      `service = "topolo-${slug}-api-staging"`,
-      ""
-    ] : [],
-    "[env.production]",
-    `name = "topolo-${slug}-production"`,
-    `account_id = "${CLOUDFLARE_ACCOUNT_ID}"`,
-    "workers_dev = false",
-    "",
-    "[env.production.vars]",
-    `APP_ID = "${application.appId ?? ""}"`,
-    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
-    "",
-    "[[env.production.routes]]",
-    `pattern = "${host}"`,
-    "custom_domain = true",
-    "",
-    "[env.production.assets]",
-    'directory = "./dist"',
-    'binding = "ASSETS"',
-    'not_found_handling = "single-page-application"',
-    ...api ? ['run_worker_first = ["/api/*"]'] : [],
-    "",
-    ...api ? [
-      "[[env.production.services]]",
-      'binding = "API"',
-      `service = "topolo-${slug}-api-production"`,
-      ""
-    ] : []
-  ].join("\n");
-}
-function platformApiWranglerToml(application, resources, profile) {
-  const slug = toSlug(application.id);
-  const resource = resourceConfig(application, profile);
-  const lines = [
-    `name = "topolo-${slug}-api"`,
-    'main = "src/worker.ts"',
-    `compatibility_date = "${CLOUDFLARE_COMPATIBILITY_DATE}"`,
-    'compatibility_flags = ["nodejs_compat"]',
-    `account_id = "${CLOUDFLARE_ACCOUNT_ID}"`,
-    "workers_dev = true",
-    "",
-    "[observability]",
-    "enabled = true",
-    "",
-    "[vars]",
-    'AUTH_BASE_URL = "https://auth.topolo.app"',
-    'NEXUS_GATEWAY_URL = "https://nexus.topolo.app"',
-    `NEXUS_APP_ID = "${slug}"`,
-    `APP_ID = "${application.appId ?? ""}"`,
-    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
-    ""
-  ];
-  appendResourceWranglerBlocks(lines, resources, resource, "production");
-  lines.push(
-    "[env.development]",
-    `name = "topolo-${slug}-api-development"`,
-    `account_id = "${DEVELOPMENT_CLOUDFLARE_ACCOUNT_ID}"`,
-    "workers_dev = true",
-    "",
-    "[env.development.vars]",
-    'AUTH_BASE_URL = "https://auth.topolo.dev"',
-    'NEXUS_GATEWAY_URL = "https://nexus.topolo.dev"',
-    `NEXUS_APP_ID = "${slug}"`,
-    `APP_ID = "${application.appId ?? ""}"`,
-    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
-    'ENVIRONMENT = "development"',
-    ""
-  );
-  appendResourceWranglerBlocks(lines, resources, resource, "development");
-  lines.push(
-    "[env.staging]",
-    `name = "topolo-${slug}-api-staging"`,
-    `account_id = "${STAGING_CLOUDFLARE_ACCOUNT_ID}"`,
-    "workers_dev = true",
-    "",
-    "[env.staging.vars]",
-    'AUTH_BASE_URL = "https://auth.stg.topolo.us"',
-    'NEXUS_GATEWAY_URL = "https://nexus.stg.topolo.us"',
-    `NEXUS_APP_ID = "${slug}"`,
-    `APP_ID = "${application.appId ?? ""}"`,
-    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
-    ""
-  );
-  appendResourceWranglerBlocks(lines, resources, resource, "staging");
-  lines.push(
-    "[env.production]",
-    `name = "topolo-${slug}-api-production"`,
-    `account_id = "${CLOUDFLARE_ACCOUNT_ID}"`,
-    "workers_dev = false",
-    "",
-    "[env.production.vars]",
-    'AUTH_BASE_URL = "https://auth.topolo.app"',
-    'NEXUS_GATEWAY_URL = "https://nexus.topolo.app"',
-    `NEXUS_APP_ID = "${slug}"`,
-    `APP_ID = "${application.appId ?? ""}"`,
-    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
-    ""
-  );
-  appendResourceWranglerBlocks(lines, resources, resource, "production-env");
-  return lines.join("\n");
-}
-function appendResourceWranglerBlocks(lines, resources, resource, environment) {
-  const prefix = environment === "staging" ? "env.staging." : environment === "development" ? "env.development." : environment === "production-env" ? "env.production." : "";
-  const envName = environment === "staging" ? "Staging" : environment === "development" ? "Development" : "Production";
-  const pick = (dev, staging, prod) => environment === "development" ? dev : environment === "staging" ? staging : prod;
-  if (resources.d1) {
-    lines.push(
-      `[[${prefix}d1_databases]]`,
-      `binding = "${resource.d1Binding}"`,
-      `database_name = "${pick(resource.d1DevelopmentName, resource.d1StagingName, resource.d1ProductionName)}"`,
-      'database_id = "provision-after-scaffold"',
-      'migrations_dir = "migrations"',
-      ""
-    );
-  }
-  if (resources.r2) {
-    lines.push(
-      `[[${prefix}r2_buckets]]`,
-      `binding = "${resource.r2Binding}"`,
-      `bucket_name = "${pick(resource.r2DevelopmentName, resource.r2StagingName, resource.r2ProductionName)}"`,
-      ""
-    );
-  }
-  if (resources.queue) {
-    lines.push(
-      `[[${prefix}queues.producers]]`,
-      `binding = "${resource.queueBinding}"`,
-      `queue = "${pick(resource.queueDevelopmentName, resource.queueStagingName, resource.queueProductionName)}"`,
-      "",
-      `[[${prefix}queues.consumers]]`,
-      `queue = "${pick(resource.queueDevelopmentName, resource.queueStagingName, resource.queueProductionName)}"`,
-      ""
-    );
-  }
-  if (resources.workflow) {
-    lines.push(
-      `[[${prefix}workflows]]`,
-      `binding = "${resource.workflowBinding}"`,
-      `name = "${pick(resource.workflowDevelopmentName, resource.workflowStagingName, resource.workflowProductionName)}"`,
-      `class_name = "${resource.workflowClassName}"`,
-      ""
-    );
-  }
-  if (resources.containerProcessing) {
-    lines.push(`# ${envName} container metadata is declared in topolo.app.json and topolo.cloudcontrol.json.`);
-    lines.push("");
-  }
-}
 function wranglerToml(application, target, resources, profile) {
   const slug = toSlug(application.id);
   const workerName = target === "platform" ? `topolo-${slug}` : application.packageName;
@@ -7766,7 +7549,10 @@ function platformWorkerTs(application, options) {
     "  // Auth verification base URL is environment-driven (staging/prod/dev),",
     "  // so rt.verifyAuth() targets the correct Auth service per deploy.",
     "  authBaseUrl: (env) => env.AUTH_BASE_URL,",
-    "  authGateway: { enabled: false },",
+    "  // The runtime's /api/auth/* gateway serves the app-switcher catalog,",
+    "  // preferences, and theme for the shared app shell \u2014 it must run before",
+    "  // the app's own auth so unentitled users still get the switcher.",
+    "  authGateway: { enabled: true },",
     "  actionContracts: topoloActionContracts,",
     "});",
     "",
@@ -7919,8 +7705,13 @@ function developerWorkerTs(application) {
     "  const token = authHeader.startsWith('Bearer ') ? authHeader.slice(7) : null;",
     "  if (!token) return { ok: false, status: 401, error: 'Bearer token required' };",
     "",
+    "  // Fail loudly: defaulting to the production Auth host here would let a",
+    "  // misconfigured staging/dev worker validate tokens against prod. The",
+    "  // manifest declares AUTH_BASE_URL for every environment.",
+    "  if (!env.AUTH_BASE_URL) return { ok: false, status: 500, error: 'AUTH_BASE_URL not configured' };",
+    "",
     "  try {",
-    "    const authBaseUrl = env.AUTH_BASE_URL || 'https://auth.topolo.app';",
+    "    const authBaseUrl = env.AUTH_BASE_URL;",
     "    const response = await fetch(`${authBaseUrl}/validate`, {",
     "      method: 'POST',",
     "      headers: {",
@@ -7950,6 +7741,72 @@ function developerWorkerTs(application) {
   ].join("\n");
 }
 
+// src/commands/app-scaffold-generate.ts
+import { existsSync as existsSync3, mkdirSync, mkdtempSync, readFileSync as readFileSync4, rmSync, writeFileSync } from "fs";
+import { spawnSync } from "child_process";
+import { tmpdir } from "os";
+import path2 from "path";
+function resolveGeneratorPath() {
+  const candidates = [
+    // Published CLI: vendored alongside dist/index.js at build time.
+    new URL("./generate-wrangler.mjs", import.meta.url),
+    // In-repo (tests, `pnpm dev`): the platform's canonical copy, which is the
+    // very file the vendor step copies.
+    new URL("../../../../tooling/generate-wrangler.mjs", import.meta.url)
+  ];
+  for (const candidate of candidates) {
+    const p = decodeURIComponent(candidate.pathname);
+    if (existsSync3(p)) return p;
+  }
+  throw new Error(
+    `topolo: could not locate generate-wrangler.mjs. A published CLI vendors it into dist/ at build time; in-repo it is read from topolo-platform/tooling/. Looked in:
+${candidates.map((c) => `  ${decodeURIComponent(c.pathname)}`).join("\n")}`
+  );
+}
+var GENERATED = {
+  purpose: "GENERATED from topolo.app.json by topolo-platform/tooling/generate-wrangler.mjs \u2014 never hand-edit.",
+  requiredSignals: [
+    "byte-identical to what generate-wrangler emits for this manifest",
+    "every change is made in topolo.app.json, never here"
+  ]
+};
+function deriveGeneratedConfigs(files, base) {
+  const generator = resolveGeneratorPath();
+  const root = mkdtempSync(path2.join(tmpdir(), "topolo-scaffold-generate-"));
+  try {
+    const prefix = `${base}/`;
+    for (const file of files) {
+      if (!file.path.startsWith(prefix)) continue;
+      const abs = path2.join(root, file.path.slice(prefix.length));
+      mkdirSync(path2.dirname(abs), { recursive: true });
+      writeFileSync(abs, file.content, "utf8");
+    }
+    const result = spawnSync(
+      process.execPath,
+      [generator, `--manifest=${path2.join(root, "topolo.app.json")}`],
+      { cwd: root, encoding: "utf8" }
+    );
+    if (result.status !== 0) {
+      throw new Error(
+        `topolo: generate-wrangler failed for the scaffolded manifest (exit ${result.status}).
+${result.stdout ?? ""}${result.stderr ?? ""}`
+      );
+    }
+    const written = [...(result.stdout ?? "").matchAll(/^\[generate\] wrote (.+)$/gm)].map((m) => (m[1] ?? "").trim()).filter(Boolean);
+    if (!written.length) {
+      throw new Error(`topolo: generate-wrangler wrote no files.
+${result.stdout ?? ""}`);
+    }
+    return written.map((rel) => ({
+      path: `${base}/${rel}`,
+      ...GENERATED,
+      content: readFileSync4(path2.join(root, rel), "utf8")
+    }));
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+}
+
 // src/commands/app-scaffold-workflows.ts
 function scaffoldCommands(options) {
   const scaffoldId = toSlug(options.id);
@@ -8113,6 +7970,10 @@ function topoloAppManifestJson(application, options) {
       bindings.d1 = [
         {
           binding: resource.d1Binding,
+          development: {
+            databaseName: resource.d1DevelopmentName,
+            databaseId: "provision-after-scaffold"
+          },
           staging: {
             databaseName: resource.d1StagingName,
             databaseId: "provision-after-scaffold"
@@ -8129,26 +7990,29 @@ function topoloAppManifestJson(application, options) {
       bindings.r2 = [
         {
           binding: resource.r2Binding,
+          development: { bucketName: resource.r2DevelopmentName },
           staging: { bucketName: resource.r2StagingName },
           production: { bucketName: resource.r2ProductionName }
         }
       ];
     }
     if (options.resources.queue) {
-      bindings.queues = [
-        {
-          binding: resource.queueBinding,
-          staging: { queueName: resource.queueStagingName },
-          production: { queueName: resource.queueProductionName },
-          consumer: true
-        }
-      ];
+      const queue = {
+        development: { queue: resource.queueDevelopmentName },
+        staging: { queue: resource.queueStagingName },
+        production: { queue: resource.queueProductionName }
+      };
+      bindings.queues = {
+        producers: [{ binding: resource.queueBinding, ...queue }],
+        consumers: [{ ...queue }]
+      };
     }
     if (options.resources.workflow) {
       bindings.workflows = [
         {
           binding: resource.workflowBinding,
           className: resource.workflowClassName,
+          development: { name: resource.workflowDevelopmentName },
           staging: { name: resource.workflowStagingName },
           production: { name: resource.workflowProductionName }
         }
@@ -8162,53 +8026,67 @@ function topoloAppManifestJson(application, options) {
       compatibilityFlags: ["nodejs_compat"],
       healthcheckPath: "/api/health",
       vars: {
+        // Every environment the manifest declares must be listed. A per-env map
+        // that omits one leaves that env with no value, and both of these fall
+        // back to PRODUCTION when unset (@topolo-io/nexus-client defaults
+        // gatewayUrl to https://nexus.topolo.app) — a staging or dev worker
+        // silently talking to prod.
         AUTH_BASE_URL: {
+          development: "https://auth.topolo.dev",
           staging: "https://auth.stg.topolo.us",
           production: "https://auth.topolo.app"
         },
         NEXUS_GATEWAY_URL: {
+          development: "https://nexus.topolo.dev",
           staging: "https://nexus.stg.topolo.us",
           production: "https://nexus.topolo.app"
-        },
-        NEXUS_APP_ID: slug
+        }
+        // No NEXUS_APP_ID: generate-wrangler binds APP_ID (the app_id) into every
+        // env, and worker-runtime reads env.APP_ID for Nexus usage attribution,
+        // so a second copy of the same identity would only be a chance to drift.
+        // It previously carried the SLUG, which reads as a working identity while
+        // Nexus attributes by app_id.
       },
       secrets: ["TOPOLO_SERVICE_CLIENT_SECRET"],
       ...Object.keys(bindings).length ? { bindings } : {}
     };
   }
-  targets.web = {
-    kind: "worker",
-    dir: "apps/web",
-    wranglerName: `topolo-${slug}`,
-    subdomain: slug,
-    main: "src/worker.ts",
-    workersDev: false,
-    assets: {
-      directory: "./dist",
-      binding: "ASSETS",
-      notFoundHandling: "single-page-application",
-      runWorkerFirst: ["/api/*"]
-    },
-    compatibilityFlags: ["nodejs_compat"],
-    buildCommand: {
-      staging: "cd ../.. && DEPLOY_ENVIRONMENT=staging VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us pnpm run build",
-      production: "cd ../.. && DEPLOY_ENVIRONMENT=production VITE_TOPOLO_AUTH_URL=https://auth.topolo.app pnpm run build"
-    },
-    healthcheckPath: options.api ? "/api/health" : "/",
-    ...options.api ? {
-      bindings: {
-        services: [
-          {
-            binding: "API",
-            service: {
-              staging: `topolo-${slug}-api-staging`,
-              production: `topolo-${slug}-api-production`
+  if (options.browser) {
+    targets.web = {
+      kind: "worker",
+      dir: "apps/web",
+      wranglerName: `topolo-${slug}`,
+      subdomain: slug,
+      main: "src/worker.ts",
+      workersDev: false,
+      assets: {
+        directory: "./dist",
+        binding: "ASSETS",
+        notFoundHandling: "single-page-application",
+        // Only meaningful when there is an API Worker to run first.
+        ...options.api ? { runWorkerFirst: ["/api/*"] } : {}
+      },
+      compatibilityFlags: ["nodejs_compat"],
+      buildCommand: {
+        staging: "cd ../.. && DEPLOY_ENVIRONMENT=staging VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us pnpm run build",
+        production: "cd ../.. && DEPLOY_ENVIRONMENT=production VITE_TOPOLO_AUTH_URL=https://auth.topolo.app pnpm run build"
+      },
+      healthcheckPath: options.api ? "/api/health" : "/",
+      ...options.api ? {
+        bindings: {
+          services: [
+            {
+              binding: "API",
+              service: {
+                staging: `topolo-${slug}-api-staging`,
+                production: `topolo-${slug}-api-production`
+              }
             }
-          }
-        ]
-      }
-    } : {}
-  };
+          ]
+        }
+      } : {}
+    };
+  }
   const actions = options.api ? baselineApiActions() : [];
   return `${json({
     $schema: "./../../topolo-platform/tooling/app-manifest-schema.json",
@@ -8352,263 +8230,6 @@ function baselineApiActions() {
     }
   ];
 }
-function cloudcontrolJson(application, options) {
-  const slug = toSlug(application.id);
-  const appPath = firstPartyAppPath(application.appDir, options.audience);
-  const host = application.productionUrl ? new URL(application.productionUrl).host : `${slug}.topolo.app`;
-  const stagingHost = `${slug}.stg.topolo.us`;
-  const serviceSlug = application.serviceSlug ?? `topolo-${slug}`;
-  const resources = resourceConfig(application, options.profile);
-  const resourceBindings = [];
-  if (options.resources.d1) {
-    resourceBindings.push(
-      {
-        resource_type: "d1",
-        binding: resources.d1Binding,
-        environment: "production",
-        account_id: CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.d1ProductionName,
-        resource_id: "provision-after-scaffold",
-        migrations_dir: "migrations"
-      },
-      {
-        resource_type: "d1",
-        binding: resources.d1Binding,
-        environment: "staging",
-        account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.d1StagingName,
-        resource_id: "provision-after-scaffold",
-        migrations_dir: "migrations"
-      },
-      {
-        resource_type: "d1",
-        binding: resources.d1Binding,
-        environment: "development",
-        account_id: DEVELOPMENT_CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.d1DevelopmentName,
-        resource_id: "provision-after-scaffold",
-        migrations_dir: "migrations"
-      }
-    );
-  }
-  if (options.resources.r2) {
-    resourceBindings.push(
-      {
-        resource_type: "r2",
-        binding: resources.r2Binding,
-        environment: "production",
-        account_id: CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.r2ProductionName
-      },
-      {
-        resource_type: "r2",
-        binding: resources.r2Binding,
-        environment: "staging",
-        account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.r2StagingName
-      }
-    );
-  }
-  if (options.resources.queue) {
-    resourceBindings.push(
-      {
-        resource_type: "queue",
-        binding: resources.queueBinding,
-        environment: "production",
-        account_id: CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.queueProductionName
-      },
-      {
-        resource_type: "queue",
-        binding: resources.queueBinding,
-        environment: "staging",
-        account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.queueStagingName
-      }
-    );
-  }
-  if (options.resources.workflow) {
-    resourceBindings.push(
-      {
-        resource_type: "workflow",
-        binding: resources.workflowBinding,
-        environment: "production",
-        account_id: CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.workflowProductionName,
-        class_name: resources.workflowClassName
-      },
-      {
-        resource_type: "workflow",
-        binding: resources.workflowBinding,
-        environment: "staging",
-        account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.workflowStagingName,
-        class_name: resources.workflowClassName
-      }
-    );
-  }
-  if (options.resources.containerProcessing) {
-    resourceBindings.push(
-      {
-        resource_type: "container",
-        environment: "production",
-        account_id: CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.containerProductionName,
-        purpose: "processing"
-      },
-      {
-        resource_type: "container",
-        environment: "staging",
-        account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.containerStagingName,
-        purpose: "processing"
-      }
-    );
-  }
-  const deployTargets = options.api ? [
-    {
-      kind: "worker",
-      environment: "production",
-      target_name: `topolo-${slug}-api-production`,
-      cloudflare_account_id: CLOUDFLARE_ACCOUNT_ID,
-      config_path: "apps/api/wrangler.toml",
-      workdir: "apps/api",
-      build_command: null,
-      output_dir: null,
-      production_branch: "main",
-      healthcheck_path: "/api/health",
-      domains: [],
-      routes: [],
-      service_slug: serviceSlug
-    },
-    {
-      kind: "worker",
-      environment: "staging",
-      target_name: `topolo-${slug}-staging`,
-      cloudflare_account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
-      config_path: "apps/web/wrangler.toml",
-      workdir: "apps/web",
-      build_command: "cd ../.. && DEPLOY_ENVIRONMENT=staging VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us pnpm run build",
-      output_dir: null,
-      production_branch: "staging",
-      healthcheck_path: "/api/health",
-      domains: [stagingHost],
-      routes: [stagingHost],
-      api_url: `https://${stagingHost}`,
-      service_slug: serviceSlug,
-      sdk_app_id: application.id,
-      agent_callable: true
-    },
-    {
-      kind: "worker",
-      environment: "staging",
-      target_name: `topolo-${slug}-api-staging`,
-      cloudflare_account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
-      config_path: "apps/api/wrangler.toml",
-      workdir: "apps/api",
-      build_command: null,
-      output_dir: null,
-      production_branch: "staging",
-      healthcheck_path: "/api/health",
-      domains: [],
-      routes: [],
-      service_slug: serviceSlug
-    },
-    {
-      kind: "worker",
-      environment: "production",
-      target_name: `topolo-${slug}-production`,
-      cloudflare_account_id: CLOUDFLARE_ACCOUNT_ID,
-      config_path: "apps/web/wrangler.toml",
-      workdir: "apps/web",
-      build_command: "cd ../.. && DEPLOY_ENVIRONMENT=production VITE_TOPOLO_AUTH_URL=https://auth.topolo.app pnpm run build",
-      output_dir: null,
-      production_branch: "main",
-      healthcheck_path: "/api/health",
-      domains: [host],
-      routes: [host],
-      api_url: application.productionUrl,
-      service_slug: serviceSlug,
-      sdk_app_id: application.id,
-      agent_callable: true
-    }
-  ] : [
-    {
-      kind: "worker",
-      environment: "production",
-      target_name: `topolo-${slug}`,
-      cloudflare_account_id: CLOUDFLARE_ACCOUNT_ID,
-      config_path: "wrangler.toml",
-      build_command: "npm run build",
-      output_dir: "dist",
-      production_branch: "main",
-      healthcheck_path: "/",
-      domains: [host],
-      routes: [host],
-      api_url: application.productionUrl,
-      agent_callable: false
-    }
-  ];
-  return `${json({
-    name: `topolo-${slug}`,
-    description: `Canonical documentation for ${toTitle(application.name)} lives in system-apps/TopoloDocs.`,
-    deploy_method: "wrangler",
-    ci_provider: "github_actions",
-    repo_identity: {
-      provider: "github",
-      owner: "Topolo-io",
-      repo: application.appDir,
-      remote_url: `git@github.com:Topolo-io/${application.appDir}.git`,
-      default_branch: "main"
-    },
-    environments: application.productionUrl ? [
-      {
-        name: "production",
-        url: application.productionUrl,
-        branch: "main",
-        status: "unknown"
-      },
-      {
-        name: "staging",
-        url: `https://${stagingHost}`,
-        branch: "main",
-        status: "unknown"
-      }
-    ] : [],
-    deploy_targets: deployTargets,
-    resource_bindings: resourceBindings,
-    ci_workflows: [
-      {
-        provider: "github_actions",
-        workflow_name: "topolo-conformance.yml",
-        path: ".github/workflows/topolo-conformance.yml",
-        branch: null,
-        required: true
-      }
-    ],
-    ci_targets: [
-      {
-        name: "typecheck",
-        command: "pnpm run typecheck",
-        required: true
-      },
-      {
-        name: "test",
-        command: "pnpm run test",
-        required: true
-      },
-      {
-        name: "build",
-        command: "pnpm run build",
-        required: true
-      }
-    ],
-    tags: ["application", "cloudflare", "typescript", ...hasScaffoldResources(options.resources) ? ["resource-backed"] : []],
-    source_paths: [appPath],
-    cloudflare_account_id: CLOUDFLARE_ACCOUNT_ID
-  })}
-`;
-}
 function systemJson(application, options) {
   const slug = toSlug(application.id);
   const suiteLabel = options.audience === "personal" ? "personal" : "platform";
@@ -9686,6 +9307,7 @@ function scaffoldFiles(options) {
         ],
         content: topoloAppManifestJson(application, {
           api: options.api,
+          browser: options.browser,
           resources: options.payload.resources,
           profile: options.payload.profile,
           payload: options.payload
@@ -9711,20 +9333,6 @@ function scaffoldFiles(options) {
           content: topoloActionContractsDmts()
         }
       ] : [],
-      {
-        path: `${base}/topolo.cloudcontrol.json`,
-        purpose: "CloudControl source of truth for deploy targets, routes, bindings, and CI metadata.",
-        requiredSignals: [
-          "production URLs and Cloudflare targets are explicit",
-          "resource bindings and required secrets are declared without secret values"
-        ],
-        content: cloudcontrolJson(application, {
-          api: options.api,
-          audience: options.payload.audience,
-          profile: options.payload.profile,
-          resources: options.payload.resources
-        })
-      },
       {
         path: `${base}/.github/workflows/topolo-conformance.yml`,
         purpose: "PR/push gate that runs the local Topolo app audit with docs evidence.",
@@ -9933,15 +9541,6 @@ export default defineConfig({
               "only declares an API service binding for API-backed scaffolds"
             ],
             content: webWorkerTs(application, options.api)
-          },
-          {
-            path: `${browserBase}/wrangler.toml`,
-            purpose: "Cloudflare Worker static-assets configuration for the browser surface.",
-            requiredSignals: [
-              "serves Vite assets through a Worker with assets",
-              "only binds an API Worker when the scaffold includes one"
-            ],
-            content: platformWebWranglerToml(application, options.api)
           }
         );
       }
@@ -9949,15 +9548,15 @@ export default defineConfig({
   }
   if (options.api) {
     files.push(
-      {
+      ...target === "platform" ? [] : [{
         path: `${apiBase}/wrangler.toml`,
         purpose: "Cloudflare Worker runtime configuration.",
         requiredSignals: [
-          "bindings match topolo.cloudcontrol.json or topolo.app.json",
+          "bindings match the declared resources",
           "secrets are referenced by name only"
         ],
-        content: target === "platform" ? platformApiWranglerToml(application, options.payload.resources, options.payload.profile) : wranglerToml(application, target, options.payload.resources, options.payload.profile)
-      },
+        content: wranglerToml(application, target, options.payload.resources, options.payload.profile)
+      }],
       {
         path: `${apiBase}/src/worker.ts`,
         purpose: "Protected service boundary.",
@@ -10025,6 +9624,9 @@ export default defineConfig({
       }
     }
   }
+  if (target === "platform") {
+    files.push(...deriveGeneratedConfigs(files, base));
+  }
   return files;
 }
 
@@ -10271,7 +9873,7 @@ import { join as join3 } from "path";
 
 // src/commands/app-reconcile.ts
 import { readFile as readFile3, writeFile as writeFile4 } from "fs/promises";
-import path2 from "path";
+import path3 from "path";
 import { createInterface as createInterface2 } from "readline/promises";
 import { stdin as input2, stdout as output } from "process";
 function record(value) {
@@ -10330,7 +9932,7 @@ function titleFromSlug(value) {
   return value.replace(/^topolo[-_]/, "").split(/[-_]+/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
 }
 async function completeApplicationRegistrationInteractively(options) {
-  const manifestPath = path2.resolve(options.manifestPath || "topolo.app.json");
+  const manifestPath = path3.resolve(options.manifestPath || "topolo.app.json");
   const manifest = JSON.parse(await readFile3(manifestPath, "utf8"));
   const existing = record(manifest.registration) || {};
   const appId = String(manifest.appId || manifest.app_id || "").trim();
@@ -10410,7 +10012,7 @@ async function completeApplicationRegistrationInteractively(options) {
   }
 }
 async function loadApplicationReconcileRequest(options) {
-  const manifestPath = path2.resolve(options.manifestPath || "topolo.app.json");
+  const manifestPath = path3.resolve(options.manifestPath || "topolo.app.json");
   const raw = await readFile3(manifestPath, "utf8");
   const manifest = JSON.parse(raw);
   assertRegistration(manifest.registration);
@@ -10796,8 +10398,8 @@ function applicationAuditPayload(application, options = {}) {
 }
 function recordApplicationEvidence(application, options = {}) {
   const appId = resolveApplication(application).id;
-  const root = path3.resolve(options.appRoot ?? process.cwd());
-  if (!existsSync3(root)) {
+  const root = path4.resolve(options.appRoot ?? process.cwd());
+  if (!existsSync4(root)) {
     throw new Error(`Application root does not exist: ${root}`);
   }
   let commit = options.commit;
@@ -10808,12 +10410,12 @@ function recordApplicationEvidence(application, options = {}) {
       commit = void 0;
     }
   }
-  const evidenceDir = path3.join(root, ".topolo");
-  const evidencePath = path3.join(evidenceDir, "evidence.json");
+  const evidenceDir = path4.join(root, ".topolo");
+  const evidencePath = path4.join(evidenceDir, "evidence.json");
   let before = null;
-  if (existsSync3(evidencePath)) {
+  if (existsSync4(evidencePath)) {
     try {
-      const raw = JSON.parse(readFileSync4(evidencePath, "utf8"));
+      const raw = JSON.parse(readFileSync5(evidencePath, "utf8"));
       if (raw && typeof raw === "object" && raw.version === 1) {
         before = raw;
       }
@@ -10851,8 +10453,8 @@ function recordApplicationEvidence(application, options = {}) {
       "record-evidence: pass at least one of --build, --typecheck, --test, --docs-validate, --smoke <url>"
     );
   }
-  mkdirSync(evidenceDir, { recursive: true });
-  writeFileSync(evidencePath, JSON.stringify(after, null, 2) + "\n");
+  mkdirSync2(evidenceDir, { recursive: true });
+  writeFileSync2(evidencePath, JSON.stringify(after, null, 2) + "\n");
   return { appId, evidencePath, before, after, updatedFields };
 }
 function formatEvidence(result) {
@@ -11108,8 +10710,8 @@ function statusesAtOrWorse(threshold) {
 }
 
 // src/commands/platform.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync5, statSync as statSync2 } from "fs";
-import path4 from "path";
+import { readdirSync as readdirSync2, readFileSync as readFileSync6, statSync as statSync2 } from "fs";
+import path5 from "path";
 function registerPlatformCommand(program2) {
   const platform3 = program2.command("platform").description("Internal Topolo first-party platform and personal app commands");
   const platformApps = platform3.command("apps").description("Scaffold and operate first-party Topolo platform and personal applications");
@@ -11227,12 +10829,12 @@ var SKIPPED_SCAN_DIRS = /* @__PURE__ */ new Set([
   "output"
 ]);
 function scanStagingProductionUrls(rootInput, allowPatterns) {
-  const root = path4.resolve(rootInput);
+  const root = path5.resolve(rootInput);
   const allowlist = allowPatterns.map((pattern) => new RegExp(pattern));
   const violations = [];
   function shouldSkipFile(filePath) {
-    const basename = path4.basename(filePath);
-    const relativePath = path4.relative(root, filePath);
+    const basename = path5.basename(filePath);
+    const relativePath = path5.relative(root, filePath);
     if (basename === "package-lock.json" || basename === "pnpm-lock.yaml" || basename === "yarn.lock") return true;
     if (basename === "topolo.cloudcontrol.json") return true;
     if (basename === "wrangler.toml" || basename === "wrangler.jsonc") return true;
@@ -11241,15 +10843,15 @@ function scanStagingProductionUrls(rootInput, allowPatterns) {
     if (basename.endsWith(".generated.ts")) return true;
     if (basename.endsWith(".test.ts") || basename.endsWith(".test.tsx") || basename.endsWith(".spec.ts")) return true;
     if (basename === ".env.production") return true;
-    if (relativePath === path4.join("src", "environment.ts") || relativePath === path4.join("src", "environmentUrls.ts") || relativePath.endsWith(path4.join("src", "environment.ts")) || relativePath.endsWith(path4.join("src", "lib", "environment.ts")) || relativePath === path4.join("packages", "topolo-ui-kit", "src", "environmentUrls.ts")) return true;
-    if (relativePath.includes(`${path4.sep}test${path4.sep}`) || relativePath.includes(`${path4.sep}tests${path4.sep}`) || relativePath.includes(`${path4.sep}e2e${path4.sep}`)) return true;
-    if (relativePath.startsWith(`scripts${path4.sep}`) || relativePath.includes(`${path4.sep}scripts${path4.sep}`)) return true;
-    return !RUNTIME_EXTENSIONS.has(path4.extname(filePath));
+    if (relativePath === path5.join("src", "environment.ts") || relativePath === path5.join("src", "environmentUrls.ts") || relativePath.endsWith(path5.join("src", "environment.ts")) || relativePath.endsWith(path5.join("src", "lib", "environment.ts")) || relativePath === path5.join("packages", "topolo-ui-kit", "src", "environmentUrls.ts")) return true;
+    if (relativePath.includes(`${path5.sep}test${path5.sep}`) || relativePath.includes(`${path5.sep}tests${path5.sep}`) || relativePath.includes(`${path5.sep}e2e${path5.sep}`)) return true;
+    if (relativePath.startsWith(`scripts${path5.sep}`) || relativePath.includes(`${path5.sep}scripts${path5.sep}`)) return true;
+    return !RUNTIME_EXTENSIONS.has(path5.extname(filePath));
   }
   function scanFile(filePath) {
     if (shouldSkipFile(filePath)) return;
-    const relativePath = path4.relative(root, filePath);
-    const content = readFileSync5(filePath, "utf8");
+    const relativePath = path5.relative(root, filePath);
+    const content = readFileSync6(filePath, "utf8");
     const lines = content.split(/\r?\n/);
     lines.forEach((line, index) => {
       const matches = [...line.matchAll(PRODUCTION_TOPOLO_URL_PATTERN)].map((match) => match[0]);
@@ -11263,7 +10865,7 @@ function scanStagingProductionUrls(rootInput, allowPatterns) {
   }
   function walk(dir) {
     for (const entry of readdirSync2(dir, { withFileTypes: true })) {
-      const fullPath = path4.join(dir, entry.name);
+      const fullPath = path5.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (!SKIPPED_SCAN_DIRS.has(entry.name)) walk(fullPath);
         continue;
@@ -11431,7 +11033,7 @@ var DEFAULT_SEED_BASE_URL = "https://seed.stg.topolo.us";
 function seedBaseUrl() {
   return process.env.TOPOLO_SEED_URL || DEFAULT_SEED_BASE_URL;
 }
-async function authedFetch(path5, init = {}) {
+async function authedFetch(path6, init = {}) {
   const credential = await refreshCredentialIfNeeded("staging");
   if (!credential) {
     throw new Error("No staging credential configured. Run `topolo auth login --env staging` or set TOPOLO_STAGING_API_KEY.");
@@ -11441,7 +11043,7 @@ async function authedFetch(path5, init = {}) {
   else headers.set("Authorization", `Bearer ${credential.accessToken}`);
   headers.set("X-Topolo-Client", `topolo-cli/${CLI_VERSION}`);
   if (init.body && !headers.has("Content-Type")) headers.set("Content-Type", "application/json");
-  const response = await fetch(`${seedBaseUrl()}${path5}`, { ...init, headers });
+  const response = await fetch(`${seedBaseUrl()}${path6}`, { ...init, headers });
   const text = await response.text();
   let body;
   try {
@@ -11718,7 +11320,7 @@ function createOAuthClientPayload(options) {
     logo_url: options.logoUrl
   };
 }
-async function authFetchJson(path5, init = {}) {
+async function authFetchJson(path6, init = {}) {
   const environment = selectedEnvironment();
   const credential = await refreshCredentialIfNeeded(environment);
   if (!credential) {
@@ -11740,7 +11342,7 @@ async function authFetchJson(path5, init = {}) {
     throw err;
   }
   headers.set("Authorization", `Bearer ${credential.accessToken}`);
-  const response = await fetch(`${authBaseUrl}${path5}`, { ...init, headers });
+  const response = await fetch(`${authBaseUrl}${path6}`, { ...init, headers });
   const text = await response.text();
   const payload = text ? JSON.parse(text) : {};
   if (!response.ok || payload.success === false) {
@@ -11939,8 +11541,8 @@ function formatCheckResult(result) {
 }
 
 // src/commands/skills.ts
-import { spawnSync } from "child_process";
-import { existsSync as existsSync4 } from "fs";
+import { spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync5 } from "fs";
 import { mkdir as mkdir3, copyFile, readFile as readFile5, writeFile as writeFile5, rm } from "fs/promises";
 import { homedir as homedir2 } from "os";
 import { dirname as dirname4, join as join5, resolve as resolve3 } from "path";
@@ -11952,19 +11554,19 @@ function skillsSourceDir() {
   const distCandidate = resolve3(here, "../skills");
   const srcCandidate = resolve3(here, "../../skills");
   for (const candidate of [distCandidate, srcCandidate]) {
-    if (existsSync4(join5(candidate, "topolo", "SKILL.md"))) return candidate;
+    if (existsSync5(join5(candidate, "topolo", "SKILL.md"))) return candidate;
   }
   return distCandidate;
 }
 function resolveMcpCommand() {
-  const probe = spawnSync(process.platform === "win32" ? "where" : "which", ["topolo-mcp"], {
+  const probe = spawnSync2(process.platform === "win32" ? "where" : "which", ["topolo-mcp"], {
     stdio: "ignore"
   });
   if (probe.status === 0) return { command: "topolo-mcp", args: [] };
   return { command: "npx", args: ["-y", "@topolo/mcp"] };
 }
 function agentBinaryExists(bin) {
-  const probe = spawnSync(process.platform === "win32" ? "where" : "which", [bin], {
+  const probe = spawnSync2(process.platform === "win32" ? "where" : "which", [bin], {
     stdio: "ignore"
   });
   return probe.status === 0;
@@ -11985,9 +11587,9 @@ async function installSkillFile(sourceDir, targetDir) {
 function registerViaOfficialCli(cli, mcp, agentName) {
   if (!agentBinaryExists(cli)) return false;
   const scopeArgs = cli === "claude" ? ["-s", "user"] : [];
-  spawnSync(cli, ["mcp", "remove", "topolo", ...scopeArgs], { stdio: "ignore" });
+  spawnSync2(cli, ["mcp", "remove", "topolo", ...scopeArgs], { stdio: "ignore" });
   const envArgs = cli === "claude" ? ["-e", `TOPOLO_AGENT_NAME=${agentName}`] : ["--env", `TOPOLO_AGENT_NAME=${agentName}`];
-  const result = spawnSync(
+  const result = spawnSync2(
     cli,
     ["mcp", "add", "topolo", ...scopeArgs, ...envArgs, "--", mcp.command, ...mcp.args],
     { stdio: "ignore" }
@@ -11995,11 +11597,11 @@ function registerViaOfficialCli(cli, mcp, agentName) {
   return result.status === 0;
 }
 async function registerClaudeViaConfig(mcp) {
-  const path5 = join5(homedir2(), ".claude.json");
+  const path6 = join5(homedir2(), ".claude.json");
   let config = {};
-  if (existsSync4(path5)) {
+  if (existsSync5(path6)) {
     try {
-      config = JSON.parse(await readFile5(path5, "utf8"));
+      config = JSON.parse(await readFile5(path6, "utf8"));
     } catch {
       config = {};
     }
@@ -12012,13 +11614,13 @@ async function registerClaudeViaConfig(mcp) {
     env: { TOPOLO_AGENT_NAME: AGENT_NAME_FOR.claude }
   };
   config.mcpServers = servers;
-  await writeFile5(path5, `${JSON.stringify(config, null, 2)}
+  await writeFile5(path6, `${JSON.stringify(config, null, 2)}
 `, "utf8");
 }
 async function registerCodexViaConfig(mcp) {
-  const path5 = join5(homedir2(), ".codex", "config.toml");
+  const path6 = join5(homedir2(), ".codex", "config.toml");
   let text = "";
-  if (existsSync4(path5)) text = await readFile5(path5, "utf8");
+  if (existsSync5(path6)) text = await readFile5(path6, "utf8");
   text = text.replace(
     /(^|\n)\[mcp_servers\.topolo(?:\.[a-z]+)?\][^\[]*/g,
     (match) => match.startsWith("\n") ? "\n" : ""
@@ -12034,8 +11636,8 @@ command = "${mcp.command}"${argsToml}
 [mcp_servers.topolo.env]
 TOPOLO_AGENT_NAME = "${AGENT_NAME_FOR.codex}"
 `;
-  await mkdir3(dirname4(path5), { recursive: true });
-  await writeFile5(path5, `${text}${block}`, "utf8");
+  await mkdir3(dirname4(path6), { recursive: true });
+  await writeFile5(path6, `${text}${block}`, "utf8");
 }
 async function installForAgent(agent, sourceDir, mcp, opts) {
   const skillDir = agent === "claude" ? claudeSkillDir(opts.projectDir) : codexSkillDir();
@@ -12073,7 +11675,7 @@ function registerSkillsCommand(program2) {
       const mode = resolveOutputMode(opts.json);
       try {
         const sourceDir = skillsSourceDir();
-        if (!existsSync4(join5(sourceDir, "topolo", "SKILL.md"))) {
+        if (!existsSync5(join5(sourceDir, "topolo", "SKILL.md"))) {
           throw new Error(
             "Bundled skill file not found. Reinstall the CLI: npm install -g @topolo/cli"
           );
@@ -12102,7 +11704,7 @@ function registerSkillsCommand(program2) {
         const skillDir = agent === "claude" ? claudeSkillDir() : codexSkillDir();
         return {
           agent,
-          skillInstalled: existsSync4(join5(skillDir, "SKILL.md")),
+          skillInstalled: existsSync5(join5(skillDir, "SKILL.md")),
           skillPath: join5(skillDir, "SKILL.md"),
           cliAvailable: agentBinaryExists(agent)
         };
@@ -12119,10 +11721,10 @@ function registerSkillsCommand(program2) {
       for (const agent of resolveTargets(opts)) {
         const skillDir = agent === "claude" ? claudeSkillDir() : codexSkillDir();
         const skillFile = join5(skillDir, "SKILL.md");
-        const skillRemoved = existsSync4(skillFile);
+        const skillRemoved = existsSync5(skillFile);
         if (skillRemoved) await rm(skillFile, { force: true });
         if (agentBinaryExists(agent)) {
-          spawnSync(agent, ["mcp", "remove", "topolo"], { stdio: "ignore" });
+          spawnSync2(agent, ["mcp", "remove", "topolo"], { stdio: "ignore" });
         }
         removed.push({ agent, skillRemoved });
       }