@topolo/cli 0.5.1 → 0.6.0

package/dist/index.js

@@ -9,7 +9,7 @@ import { platform as platform2 } from "os";
 import { createInterface } from "readline/promises";
 import { stdin as input } from "process";
 
-// ../topolo-sdk/dist/index.js
+// node_modules/@topolo/sdk/dist/index.js
 function applyAuthHeaders(headers, credential) {
   if (credential.kind === "api_key") {
     headers.set("X-Api-Key", credential.apiKey);
@@ -61,13 +61,13 @@ var TopoloHttpError = class extends TopoloSdkError {
   body;
   service;
   path;
-  constructor(service, path5, status, body, message) {
-    super("http_error", message ?? `HTTP ${status} from ${service}${path5}`);
+  constructor(service, path8, status, body, message) {
+    super("http_error", message ?? `HTTP ${status} from ${service}${path8}`);
     this.name = "TopoloHttpError";
     this.status = status;
     this.body = body;
     this.service = service;
-    this.path = path5;
+    this.path = path8;
   }
 };
 var APP_API_URLS = {
@@ -2178,17 +2178,17 @@ function validateTopoloActionInput(schema, input3) {
   validateNode(schema, input3, "$", schema, errors, 0);
   return { valid: errors.length === 0, errors };
 }
-function inspectSchema(schema, path5, root, depth) {
-  if (depth > 128) return { path: path5, code: "schema_depth", message: "Schema recursion exceeded 128 levels." };
+function inspectSchema(schema, path8, root, depth) {
+  if (depth > 128) return { path: path8, code: "schema_depth", message: "Schema recursion exceeded 128 levels." };
   const unsupportedKeyword = Object.keys(schema).find((keyword) => !SUPPORTED_SCHEMA_KEYWORDS.has(keyword));
   if (unsupportedKeyword) {
-    return { path: path5, code: "unsupported_schema_keyword", message: `Action schema uses unsupported keyword ${unsupportedKeyword}.` };
+    return { path: path8, code: "unsupported_schema_keyword", message: `Action schema uses unsupported keyword ${unsupportedKeyword}.` };
   }
   if (typeof schema.format === "string" && !["uri", "email", "date-time"].includes(schema.format)) {
-    return { path: path5, code: "unsupported_schema_format", message: `Action schema uses unsupported format ${schema.format}.` };
+    return { path: path8, code: "unsupported_schema_format", message: `Action schema uses unsupported format ${schema.format}.` };
   }
   if (typeof schema.$ref === "string" && !resolveLocalReference(root, schema.$ref)) {
-    return { path: path5, code: "unsupported_schema_ref", message: `Cannot resolve schema reference ${schema.$ref}.` };
+    return { path: path8, code: "unsupported_schema_ref", message: `Cannot resolve schema reference ${schema.$ref}.` };
   }
   const children = [];
   if (isRecord(schema.properties)) children.push(...Object.entries(schema.properties));
@@ -2204,7 +2204,7 @@ function inspectSchema(schema, path5, root, depth) {
   );
   for (const [key, child] of children) {
     if (!isRecord(child)) continue;
-    const issue = inspectSchema(child, `${path5}.${key}`, root, depth + 1);
+    const issue = inspectSchema(child, `${path8}.${key}`, root, depth + 1);
     if (issue) return issue;
   }
   return null;
@@ -2212,129 +2212,129 @@ function inspectSchema(schema, path5, root, depth) {
 function arraySchemaEntries(keyword, value) {
   return Array.isArray(value) ? value.map((candidate, index) => [`${keyword}[${index}]`, candidate]) : [];
 }
-function validateNode(schema, value, path5, root, errors, depth) {
+function validateNode(schema, value, path8, root, errors, depth) {
   if (depth > 128) {
-    errors.push({ path: path5, code: "schema_depth", message: "Schema recursion exceeded 128 levels." });
+    errors.push({ path: path8, code: "schema_depth", message: "Schema recursion exceeded 128 levels." });
     return;
   }
   if (typeof schema.$ref === "string") {
     const resolved = resolveLocalReference(root, schema.$ref);
     if (!resolved) {
-      errors.push({ path: path5, code: "unsupported_schema_ref", message: `Cannot resolve schema reference ${schema.$ref}.` });
+      errors.push({ path: path8, code: "unsupported_schema_ref", message: `Cannot resolve schema reference ${schema.$ref}.` });
       return;
     }
-    validateNode(resolved, value, path5, root, errors, depth + 1);
+    validateNode(resolved, value, path8, root, errors, depth + 1);
   }
   if (Array.isArray(schema.allOf)) {
     for (const candidate of schema.allOf) {
-      if (isRecord(candidate)) validateNode(candidate, value, path5, root, errors, depth + 1);
+      if (isRecord(candidate)) validateNode(candidate, value, path8, root, errors, depth + 1);
     }
   }
   if (Array.isArray(schema.anyOf) && !schema.anyOf.some((candidate) => candidateMatches(candidate, value, root, depth))) {
-    errors.push({ path: path5, code: "any_of", message: "Value does not match any allowed schema." });
+    errors.push({ path: path8, code: "any_of", message: "Value does not match any allowed schema." });
     return;
   }
   if (Array.isArray(schema.oneOf)) {
     const matches = schema.oneOf.filter((candidate) => candidateMatches(candidate, value, root, depth)).length;
     if (matches !== 1) {
-      errors.push({ path: path5, code: "one_of", message: "Value must match exactly one allowed schema." });
+      errors.push({ path: path8, code: "one_of", message: "Value must match exactly one allowed schema." });
       return;
     }
   }
   if (value === null && schema.nullable === true) return;
   if (Object.prototype.hasOwnProperty.call(schema, "const") && !sameJsonValue(value, schema.const)) {
-    errors.push({ path: path5, code: "const", message: `Value must equal ${JSON.stringify(schema.const)}.` });
+    errors.push({ path: path8, code: "const", message: `Value must equal ${JSON.stringify(schema.const)}.` });
     return;
   }
   if (Array.isArray(schema.enum) && !schema.enum.some((candidate) => sameJsonValue(value, candidate))) {
-    errors.push({ path: path5, code: "enum", message: `Value must be one of ${schema.enum.map((item) => JSON.stringify(item)).join(", ")}.` });
+    errors.push({ path: path8, code: "enum", message: `Value must be one of ${schema.enum.map((item) => JSON.stringify(item)).join(", ")}.` });
     return;
   }
   if (!matchesType(schema.type, value)) {
-    errors.push({ path: path5, code: "type", message: `Expected ${String(schema.type)}.` });
+    errors.push({ path: path8, code: "type", message: `Expected ${String(schema.type)}.` });
     return;
   }
-  if (typeof value === "string") validateString(schema, value, path5, errors);
-  if (typeof value === "number") validateNumber(schema, value, path5, errors);
-  if (Array.isArray(value)) validateArray(schema, value, path5, root, errors, depth);
-  if (isRecord(value)) validateObject(schema, value, path5, root, errors, depth);
+  if (typeof value === "string") validateString(schema, value, path8, errors);
+  if (typeof value === "number") validateNumber(schema, value, path8, errors);
+  if (Array.isArray(value)) validateArray(schema, value, path8, root, errors, depth);
+  if (isRecord(value)) validateObject(schema, value, path8, root, errors, depth);
 }
-function validateObject(schema, value, path5, root, errors, depth) {
+function validateObject(schema, value, path8, root, errors, depth) {
   if (typeof schema.minProperties === "number" && Object.keys(value).length < schema.minProperties) {
-    errors.push({ path: path5, code: "min_properties", message: `Expected at least ${schema.minProperties} properties.` });
+    errors.push({ path: path8, code: "min_properties", message: `Expected at least ${schema.minProperties} properties.` });
   }
   if (typeof schema.maxProperties === "number" && Object.keys(value).length > schema.maxProperties) {
-    errors.push({ path: path5, code: "max_properties", message: `Expected at most ${schema.maxProperties} properties.` });
+    errors.push({ path: path8, code: "max_properties", message: `Expected at most ${schema.maxProperties} properties.` });
   }
   const properties = isRecord(schema.properties) ? schema.properties : {};
   const required = Array.isArray(schema.required) ? schema.required.map(String) : [];
   for (const key of required) {
     if (!Object.prototype.hasOwnProperty.call(value, key)) {
-      errors.push({ path: `${path5}.${key}`, code: "required", message: "Required property is missing." });
+      errors.push({ path: `${path8}.${key}`, code: "required", message: "Required property is missing." });
     }
   }
   if (isRecord(schema.propertyNames)) {
     for (const key of Object.keys(value)) {
-      validateNode(schema.propertyNames, key, `${path5}.${key}`, root, errors, depth + 1);
+      validateNode(schema.propertyNames, key, `${path8}.${key}`, root, errors, depth + 1);
     }
   }
   for (const [key, child] of Object.entries(value)) {
     const childSchema = properties[key];
     if (isRecord(childSchema)) {
-      validateNode(childSchema, child, `${path5}.${key}`, root, errors, depth + 1);
+      validateNode(childSchema, child, `${path8}.${key}`, root, errors, depth + 1);
     } else if (schema.additionalProperties === false) {
-      errors.push({ path: `${path5}.${key}`, code: "additional_property", message: "Property is not declared by the action schema." });
+      errors.push({ path: `${path8}.${key}`, code: "additional_property", message: "Property is not declared by the action schema." });
     } else if (isRecord(schema.additionalProperties)) {
-      validateNode(schema.additionalProperties, child, `${path5}.${key}`, root, errors, depth + 1);
+      validateNode(schema.additionalProperties, child, `${path8}.${key}`, root, errors, depth + 1);
     }
   }
 }
-function validateArray(schema, value, path5, root, errors, depth) {
+function validateArray(schema, value, path8, root, errors, depth) {
   if (typeof schema.minItems === "number" && value.length < schema.minItems) {
-    errors.push({ path: path5, code: "min_items", message: `Expected at least ${schema.minItems} items.` });
+    errors.push({ path: path8, code: "min_items", message: `Expected at least ${schema.minItems} items.` });
   }
   if (typeof schema.maxItems === "number" && value.length > schema.maxItems) {
-    errors.push({ path: path5, code: "max_items", message: `Expected at most ${schema.maxItems} items.` });
+    errors.push({ path: path8, code: "max_items", message: `Expected at most ${schema.maxItems} items.` });
   }
   if (schema.uniqueItems === true) {
-    const unique2 = new Set(value.map((item) => JSON.stringify(item)));
-    if (unique2.size !== value.length) errors.push({ path: path5, code: "unique_items", message: "Expected every item to be unique." });
+    const unique4 = new Set(value.map((item) => JSON.stringify(item)));
+    if (unique4.size !== value.length) errors.push({ path: path8, code: "unique_items", message: "Expected every item to be unique." });
   }
   if (isRecord(schema.items)) {
-    value.forEach((item, index) => validateNode(schema.items, item, `${path5}[${index}]`, root, errors, depth + 1));
+    value.forEach((item, index) => validateNode(schema.items, item, `${path8}[${index}]`, root, errors, depth + 1));
   }
 }
-function validateString(schema, value, path5, errors) {
+function validateString(schema, value, path8, errors) {
   if (typeof schema.minLength === "number" && value.length < schema.minLength) {
-    errors.push({ path: path5, code: "min_length", message: `Expected at least ${schema.minLength} characters.` });
+    errors.push({ path: path8, code: "min_length", message: `Expected at least ${schema.minLength} characters.` });
   }
   if (typeof schema.maxLength === "number" && value.length > schema.maxLength) {
-    errors.push({ path: path5, code: "max_length", message: `Expected at most ${schema.maxLength} characters.` });
+    errors.push({ path: path8, code: "max_length", message: `Expected at most ${schema.maxLength} characters.` });
   }
   if (typeof schema.pattern === "string") {
     try {
-      if (!new RegExp(schema.pattern).test(value)) errors.push({ path: path5, code: "pattern", message: "Value does not match the required pattern." });
+      if (!new RegExp(schema.pattern).test(value)) errors.push({ path: path8, code: "pattern", message: "Value does not match the required pattern." });
     } catch {
-      errors.push({ path: path5, code: "invalid_schema_pattern", message: "Action schema contains an invalid pattern." });
+      errors.push({ path: path8, code: "invalid_schema_pattern", message: "Action schema contains an invalid pattern." });
     }
   }
-  if (schema.format === "uri" && !isUrl(value)) errors.push({ path: path5, code: "format_uri", message: "Expected an absolute URL." });
-  if (schema.format === "email" && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(value)) errors.push({ path: path5, code: "format_email", message: "Expected an email address." });
-  if (schema.format === "date-time" && !isDateTime(value)) errors.push({ path: path5, code: "format_date_time", message: "Expected an ISO-8601 date-time." });
+  if (schema.format === "uri" && !isUrl(value)) errors.push({ path: path8, code: "format_uri", message: "Expected an absolute URL." });
+  if (schema.format === "email" && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(value)) errors.push({ path: path8, code: "format_email", message: "Expected an email address." });
+  if (schema.format === "date-time" && !isDateTime(value)) errors.push({ path: path8, code: "format_date_time", message: "Expected an ISO-8601 date-time." });
 }
-function validateNumber(schema, value, path5, errors) {
-  if (typeof schema.minimum === "number" && value < schema.minimum) errors.push({ path: path5, code: "minimum", message: `Expected a value of at least ${schema.minimum}.` });
-  if (typeof schema.maximum === "number" && value > schema.maximum) errors.push({ path: path5, code: "maximum", message: `Expected a value of at most ${schema.maximum}.` });
+function validateNumber(schema, value, path8, errors) {
+  if (typeof schema.minimum === "number" && value < schema.minimum) errors.push({ path: path8, code: "minimum", message: `Expected a value of at least ${schema.minimum}.` });
+  if (typeof schema.maximum === "number" && value > schema.maximum) errors.push({ path: path8, code: "maximum", message: `Expected a value of at most ${schema.maximum}.` });
   const exclusiveMinimum = typeof schema.exclusiveMinimum === "number" ? schema.exclusiveMinimum : schema.exclusiveMinimum === true && typeof schema.minimum === "number" ? schema.minimum : null;
   const exclusiveMaximum = typeof schema.exclusiveMaximum === "number" ? schema.exclusiveMaximum : schema.exclusiveMaximum === true && typeof schema.maximum === "number" ? schema.maximum : null;
   if (exclusiveMinimum !== null && value <= exclusiveMinimum) {
-    errors.push({ path: path5, code: "exclusive_minimum", message: `Expected a value greater than ${exclusiveMinimum}.` });
+    errors.push({ path: path8, code: "exclusive_minimum", message: `Expected a value greater than ${exclusiveMinimum}.` });
   }
   if (exclusiveMaximum !== null && value >= exclusiveMaximum) {
-    errors.push({ path: path5, code: "exclusive_maximum", message: `Expected a value less than ${exclusiveMaximum}.` });
+    errors.push({ path: path8, code: "exclusive_maximum", message: `Expected a value less than ${exclusiveMaximum}.` });
   }
   if (typeof schema.multipleOf === "number" && !isMultipleOf(value, schema.multipleOf)) {
-    errors.push({ path: path5, code: "multiple_of", message: `Expected a multiple of ${schema.multipleOf}.` });
+    errors.push({ path: path8, code: "multiple_of", message: `Expected a multiple of ${schema.multipleOf}.` });
   }
 }
 function candidateMatches(candidate, value, root, depth) {
@@ -2845,14 +2845,14 @@ var TopoloClient = class _TopoloClient {
     if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
       throw new TopoloSdkError("action_catalog_summary_unavailable", "Action catalog summary is unavailable.");
     }
-    const record2 = raw;
-    if (record2.algorithm !== "sha256-v1" || typeof record2.digest !== "string" || !/^[a-f0-9]{64}$/.test(record2.digest) || !Number.isSafeInteger(record2.actionCount) || Number(record2.actionCount) < 0) {
+    const record4 = raw;
+    if (record4.algorithm !== "sha256-v1" || typeof record4.digest !== "string" || !/^[a-f0-9]{64}$/.test(record4.digest) || !Number.isSafeInteger(record4.actionCount) || Number(record4.actionCount) < 0) {
       throw new TopoloSdkError("action_catalog_summary_unavailable", "Action catalog summary is invalid.");
     }
     return {
       algorithm: "sha256-v1",
-      digest: record2.digest,
-      actionCount: Number(record2.actionCount)
+      digest: record4.digest,
+      actionCount: Number(record4.actionCount)
     };
   }
   /** @deprecated Prefer searchActions() so callers retain the continuation cursor. */
@@ -3227,8 +3227,8 @@ function normalizeActionCatalogEntry(item) {
   const name = pickActionString(a.name);
   const appId = pickActionString(a.app_id) ?? pickActionString(a.appId);
   const method = pickActionString(a.method)?.toUpperCase();
-  const path5 = pickActionString(a.path);
-  if (!actionId || !name || !appId || !method || !path5 || !isHttpMethod(method)) {
+  const path8 = pickActionString(a.path);
+  if (!actionId || !name || !appId || !method || !path8 || !isHttpMethod(method)) {
     return null;
   }
   return {
@@ -3243,7 +3243,7 @@ function normalizeActionCatalogEntry(item) {
     appSlug: pickActionString(a.app_slug) ?? pickActionString(a.appSlug) ?? null,
     appName: pickActionString(a.app_name) ?? pickActionString(a.appName) ?? null,
     method,
-    path: path5,
+    path: path8,
     permissionName: pickActionString(a.permission_name) ?? pickActionString(a.permissionName) ?? "",
     requiredPermission: pickActionString(a.required_permission) ?? pickActionString(a.requiredPermission) ?? "",
     authorizationMode: pickAuthorizationMode(a.authorization_mode ?? a.authorizationMode),
@@ -3279,7 +3279,7 @@ function stringArray(value) {
 }
 function mapActionInput(action, input3) {
   const remaining = { ...input3 || {} };
-  const path5 = action.path.replace(/\{([a-zA-Z0-9_]+)\}/g, (_match, key) => {
+  const path8 = action.path.replace(/\{([a-zA-Z0-9_]+)\}/g, (_match, key) => {
     const value = remaining[key];
     if (value === void 0 || value === null || value === "") {
       throw new TopoloSdkError(
@@ -3296,14 +3296,14 @@ function mapActionInput(action, input3) {
   delete remaining.body;
   if (action.method === "GET") {
     return {
-      path: path5,
+      path: path8,
       query: objectToQuery({ ...remaining, ...explicitQuery })
     };
   }
   const query = objectToQuery(explicitQuery);
   const body = explicitBody !== void 0 ? explicitBody : remaining;
   return {
-    path: path5,
+    path: path8,
     ...query ? { query } : {},
     body
   };
@@ -3473,8 +3473,8 @@ var TopoloOAuth = class {
     if (params.clientSecret) body.set("client_secret", params.clientSecret);
     return this.#postForm("/api/developer-oauth/token", body);
   }
-  async #postForm(path5, body) {
-    const url = new URL(path5, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
+  async #postForm(path8, body) {
+    const url = new URL(path8, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
     const res = await this.fetchImpl(url.toString(), {
       method: "POST",
       headers: {
@@ -3490,7 +3490,7 @@ var TopoloOAuth = class {
         const err = parsed;
         throw new TopoloAuthError(err.error_description || err.error, err.error);
       }
-      throw new TopoloHttpError("auth", path5, res.status, parsed);
+      throw new TopoloHttpError("auth", path8, res.status, parsed);
     }
     return parsed;
   }
@@ -3504,7 +3504,7 @@ function createTopolo(options) {
   };
 }
 
-// ../topolo-sdk/dist/node/credential-store.js
+// node_modules/@topolo/sdk/dist/node/credential-store.js
 import { mkdir, readFile, writeFile, chmod } from "fs/promises";
 import { existsSync } from "fs";
 import { homedir, platform } from "os";
@@ -3528,13 +3528,13 @@ var TopoloHttpError2 = class extends TopoloSdkError2 {
   body;
   service;
   path;
-  constructor(service, path5, status, body, message) {
-    super("http_error", message ?? `HTTP ${status} from ${service}${path5}`);
+  constructor(service, path8, status, body, message) {
+    super("http_error", message ?? `HTTP ${status} from ${service}${path8}`);
     this.name = "TopoloHttpError";
     this.status = status;
     this.body = body;
     this.service = service;
-    this.path = path5;
+    this.path = path8;
   }
 };
 var APP_API_URLS2 = {
@@ -3665,8 +3665,8 @@ var TopoloOAuth2 = class {
     if (params.clientSecret) body.set("client_secret", params.clientSecret);
     return this.#postForm("/api/developer-oauth/token", body);
   }
-  async #postForm(path5, body) {
-    const url = new URL(path5, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
+  async #postForm(path8, body) {
+    const url = new URL(path8, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
     const res = await this.fetchImpl(url.toString(), {
       method: "POST",
       headers: {
@@ -3682,7 +3682,7 @@ var TopoloOAuth2 = class {
         const err = parsed;
         throw new TopoloAuthError2(err.error_description || err.error, err.error);
       }
-      throw new TopoloHttpError2("auth", path5, res.status, parsed);
+      throw new TopoloHttpError2("auth", path8, res.status, parsed);
     }
     return parsed;
   }
@@ -3712,22 +3712,22 @@ function configPath() {
   return join(base, "topolo", "config.json");
 }
 async function readConfig() {
-  const path5 = configPath();
-  if (!existsSync(path5)) return {};
+  const path8 = configPath();
+  if (!existsSync(path8)) return {};
   try {
-    const raw = await readFile(path5, "utf8");
+    const raw = await readFile(path8, "utf8");
     return JSON.parse(raw);
   } catch {
     return {};
   }
 }
 async function writeConfig(config) {
-  const path5 = configPath();
-  await mkdir(dirname(path5), { recursive: true });
-  await writeFile(path5, JSON.stringify(config, null, 2) + "\n", "utf8");
+  const path8 = configPath();
+  await mkdir(dirname(path8), { recursive: true });
+  await writeFile(path8, JSON.stringify(config, null, 2) + "\n", "utf8");
   if (platform() !== "win32") {
     try {
-      await chmod(path5, 384);
+      await chmod(path8, 384);
     } catch {
     }
   }
@@ -4047,9 +4047,9 @@ function readCliVersion() {
       join2(here, "package.json"),
       join2(here, "..", "package.json")
     ];
-    for (const path5 of candidates) {
+    for (const path8 of candidates) {
       try {
-        const pkg = JSON.parse(readFileSync(path5, "utf8"));
+        const pkg = JSON.parse(readFileSync(path8, "utf8"));
         if (typeof pkg.version === "string" && pkg.version) return pkg.version;
       } catch {
       }
@@ -4408,7 +4408,7 @@ function registerApiCommand(program2) {
     "-q, --query <kv...>",
     "Query params as key=value (repeatable), e.g. --query source=cli page=2"
   ).option("--resource-type <type>", "Cataloged app-local workspace resource alias for resource-scoped API keys").option("--resource-id <id>", "Workspace resource id for resource-scoped API keys").option("--confirm", "Acknowledge a mutating request").option("--json", "Output JSON", true).option("--no-json", "Output human-readable text").action(
-    async (service, method, path5, opts) => {
+    async (service, method, path8, opts) => {
       const mode = resolveOutputMode(opts.json);
       try {
         const upperMethod = method.toUpperCase();
@@ -4447,7 +4447,7 @@ function registerApiCommand(program2) {
         const result = await topolo.client.request({
           service,
           method: httpMethod,
-          path: path5,
+          path: path8,
           body,
           ...query ? { query } : {},
           ...resource ? { resource } : {},
@@ -4611,13 +4611,13 @@ async function requiredClient() {
 function parseJsonObject(value) {
   let source = value;
   if (value.startsWith("@")) {
-    const path5 = value.slice(1);
-    if (!path5) throw new Error("--data @file path must not be empty");
+    const path8 = value.slice(1);
+    if (!path8) throw new Error("--data @file path must not be empty");
     try {
-      source = readFileSync2(path5, "utf8");
+      source = readFileSync2(path8, "utf8");
     } catch (err) {
       const detail = err instanceof Error ? err.message : String(err);
-      throw new Error(`Could not read --data file ${path5}: ${detail}`);
+      throw new Error(`Could not read --data file ${path8}: ${detail}`);
     }
   }
   let parsed;
@@ -4691,8 +4691,8 @@ function formatActionPlan(plan) {
 
 // src/commands/apps.ts
 import { execSync } from "child_process";
-import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync4, writeFileSync } from "fs";
-import path3 from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
+import path5 from "path";
 
 // src/commands/app-audit-local.ts
 import {
@@ -5283,8 +5283,8 @@ function enrichFinding(application, finding2, evidence) {
           evidence: verificationEvidence
         });
       }
-      const usesNodeCheck = evidence.packageJsons.some((record2) => {
-        const scripts = record2.packageJson.scripts ?? {};
+      const usesNodeCheck = evidence.packageJsons.some((record4) => {
+        const scripts = record4.packageJson.scripts ?? {};
         return Object.values(scripts).some((cmd) => typeof cmd === "string" && /node\s+--check/.test(cmd));
       });
       if (hasBuild && usesNodeCheck) {
@@ -5364,7 +5364,7 @@ function nativeDashboardWidgetEvidence(evidence) {
   return unique(items);
 }
 function collectEvidence(repoRoot, application) {
-  const appRepoPath = applicationSourcePath(application.appDir);
+  const appRepoPath = applicationSourcePath(repoRoot, application.appDir);
   const appRoot = path.join(repoRoot, appRepoPath);
   const packageJsonPath = path.join(appRoot, "package.json");
   const packageJson2 = readPackageJson(packageJsonPath);
@@ -5550,35 +5550,35 @@ function verificationEvidenceFor(evidence) {
     "test:auth-contract": "test",
     validate: "validate"
   };
-  for (const record2 of evidence.packageJsons) {
-    const scripts = record2.packageJson.scripts ?? {};
-    const isRootPackage = record2.path === evidence.packageJsonPath;
+  for (const record4 of evidence.packageJsons) {
+    const scripts = record4.packageJson.scripts ?? {};
+    const isRootPackage = record4.path === evidence.packageJsonPath;
     const seenCanonical = /* @__PURE__ */ new Set();
     for (const [scriptName, canonical] of Object.entries(scriptAliases)) {
       if (!scripts[scriptName]) continue;
       if (seenCanonical.has(canonical)) continue;
       seenCanonical.add(canonical);
-      items.push(isRootPackage ? `script=${canonical}` : `script=${packageLabel(record2)}:${canonical}`);
+      items.push(isRootPackage ? `script=${canonical}` : `script=${packageLabel(record4)}:${canonical}`);
     }
   }
   return unique(items);
 }
 function dependencyNames(evidence) {
   return new Set(
-    evidence.packageJsons.flatMap((record2) => [
-      ...Object.keys(record2.packageJson.dependencies ?? {}),
-      ...Object.keys(record2.packageJson.devDependencies ?? {}),
-      ...Object.keys(record2.packageJson.peerDependencies ?? {})
+    evidence.packageJsons.flatMap((record4) => [
+      ...Object.keys(record4.packageJson.dependencies ?? {}),
+      ...Object.keys(record4.packageJson.devDependencies ?? {}),
+      ...Object.keys(record4.packageJson.peerDependencies ?? {})
     ])
   );
 }
 function packageDependencyVersions(evidence, packageName) {
   return unique(
-    evidence.packageJsons.flatMap((record2) => {
+    evidence.packageJsons.flatMap((record4) => {
       const specs = [
-        record2.packageJson.dependencies?.[packageName],
-        record2.packageJson.devDependencies?.[packageName],
-        record2.packageJson.peerDependencies?.[packageName]
+        record4.packageJson.dependencies?.[packageName],
+        record4.packageJson.devDependencies?.[packageName],
+        record4.packageJson.peerDependencies?.[packageName]
       ];
       return specs.filter((spec) => typeof spec === "string");
     })
@@ -5606,7 +5606,7 @@ function matchingSystems(repoRoot, application) {
   const docsRoot = topoloDocsRoot(repoRoot);
   const systemsRoot = path.join(docsRoot, "src", "content", "systems");
   if (!isDirectory(systemsRoot)) return [];
-  const appRepoPath = applicationSourcePath(application.appDir);
+  const appRepoPath = applicationSourcePath(repoRoot, application.appDir);
   return readdirSync(systemsRoot).filter((entry) => entry.endsWith(".json")).map((entry) => readJson(path.join(systemsRoot, entry))).filter((system) => Boolean(system)).filter((system) => {
     const repoPaths = [...system.repo_paths ?? [], ...system.repoPaths ?? []];
     return repoPaths.some(
@@ -5629,11 +5629,19 @@ function existingDocs(repoRoot, systems) {
 function topoloDocsRoot(repoRoot) {
   return path.join(repoRoot, "system-apps", "TopoloDocs", "apps", "web");
 }
-function applicationSourcePath(appDir) {
+var APPLICATION_SOURCE_ROOTS = [
+  "apps",
+  "system-apps",
+  "topolo-platform/services",
+  "topolo-platform/core",
+  "topolo-platform/packages"
+];
+function applicationSourcePath(repoRoot, appDir) {
   if (appDir === "TopoloCli" || appDir === "TopoloCLI") return "topolo-platform/packages/topolo-cli";
-  if (appDir === "TopoloDocs") return "system-apps/TopoloDocs";
-  if (appDir === "TopoloAuth") return "topolo-platform/core/TopoloAuth";
-  if (appDir === "TopoloCloudControl") return "topolo-platform/core/TopoloCloudControl";
+  for (const root of APPLICATION_SOURCE_ROOTS) {
+    const relative4 = `${root}/${appDir}`;
+    if (isDirectory(path.join(repoRoot, relative4))) return relative4;
+  }
   return `apps/${appDir}`;
 }
 function docExists(contentRoot, docPath) {
@@ -5704,8 +5712,8 @@ function collectPackageJsons(root) {
 function readPackageJson(filePath) {
   return readJson(filePath);
 }
-function packageLabel(record2) {
-  return record2.packageJson.name ?? relativeTopoloPath(path.dirname(record2.path));
+function packageLabel(record4) {
+  return record4.packageJson.name ?? relativeTopoloPath(path.dirname(record4.path));
 }
 function sortedDirEntries(dir) {
   return readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
@@ -5794,14 +5802,14 @@ import { constants } from "fs";
 import { access } from "fs/promises";
 import { relative, resolve } from "path";
 function normalizeHomePath(value) {
-  const path5 = String(value || "/dashboard").trim();
-  if (!path5.startsWith("/") || path5.startsWith("//") || /[?#]/.test(path5)) {
+  const path8 = String(value || "/dashboard").trim();
+  if (!path8.startsWith("/") || path8.startsWith("//") || /[?#]/.test(path8)) {
     throw new Error("Invalid home path. Use an absolute application path such as /dashboard.");
   }
-  if (["/", "/login", "/auth/callback", "/getting-started"].includes(path5)) {
+  if (["/", "/login", "/auth/callback", "/getting-started"].includes(path8)) {
     throw new Error("Home path must be a protected product route, not a reserved entry route.");
   }
-  return path5.replace(/\/$/, "") || "/dashboard";
+  return path8.replace(/\/$/, "") || "/dashboard";
 }
 function normalizeHomeLabel(value) {
   const label = String(value || "Dashboard").trim();
@@ -5882,16 +5890,6 @@ function normalizeScaffoldProfile(value) {
   if (value === "spatial-assets") return value;
   throw new Error("Invalid scaffold profile. Use spatial-assets.");
 }
-function resolveScaffoldResources(profile, options) {
-  const profileResources = profile === "spatial-assets" ? { d1: true, r2: true, queue: true, workflow: true, containerProcessing: true } : { d1: false, r2: false, queue: false, workflow: false, containerProcessing: false };
-  return {
-    d1: Boolean(profileResources.d1 || options.withD1),
-    r2: Boolean(profileResources.r2 || options.withR2),
-    queue: Boolean(profileResources.queue || options.withQueue),
-    workflow: Boolean(profileResources.workflow || options.withWorkflow),
-    containerProcessing: Boolean(profileResources.containerProcessing || options.withContainerProcessing)
-  };
-}
 function normalizeContainerAppId(value, surfaceModel) {
   const trimmed = String(value || "").trim();
   if (surfaceModel === "mobile_module") {
@@ -5942,9 +5940,9 @@ function toTitle(value) {
 function json(value) {
   return JSON.stringify(value, null, 2);
 }
-async function pathExists(path5) {
+async function pathExists(path8) {
   try {
-    await access(path5, constants.F_OK);
+    await access(path8, constants.F_OK);
     return true;
   } catch {
     return false;
@@ -5952,8 +5950,8 @@ async function pathExists(path5) {
 }
 function resolveInside(root, filePath) {
   const resolved = resolve(root, filePath);
-  const relativePath = relative(root, resolved);
-  if (relativePath.startsWith("..") || relativePath === "" || relativePath.startsWith("/")) {
+  const relativePath2 = relative(root, resolved);
+  if (relativePath2.startsWith("..") || relativePath2 === "" || relativePath2.startsWith("/")) {
     throw new Error(`Scaffold file path escapes the target root: ${filePath}`);
   }
   return resolved;
@@ -5980,48 +5978,6 @@ var STAGING_CLOUDFLARE_ACCOUNT_ID = "4f4e1c69a3830946f9fea7b1eb7531ac";
 var DEVELOPMENT_CLOUDFLARE_ACCOUNT_ID = "0ebdeec262a245481a721fc4f9d6d798";
 var CLOUDFLARE_COMPATIBILITY_DATE = "2026-05-05";
 
-// src/commands/app-scaffold-package-policy.ts
-var TOPOLO_PACKAGE_SCAFFOLD_POLICY = {
-  "@topolo-io/api-key-management": "browser-baseline",
-  "@topolo-io/app-funnel": "browser-baseline",
-  "@topolo-io/app-launcher": "browser-baseline",
-  "@topolo-io/app-manifest": "domain-opt-in",
-  "@topolo-io/app-shell": "browser-baseline",
-  "@topolo-io/auth-client": "browser-baseline",
-  "@topolo-io/auth-middleware": "api-baseline",
-  "@topolo-io/billing-manifest": "domain-opt-in",
-  "@topolo-io/billing-ui": "domain-opt-in",
-  "@topolo-io/bridge": "domain-opt-in",
-  "@topolo-io/calendar": "domain-opt-in",
-  "@topolo-io/chat-widget": "browser-baseline",
-  "@topolo-io/data": "domain-opt-in",
-  "@topolo-io/design-tokens": "browser-baseline",
-  "@topolo-io/error-middleware": "api-baseline",
-  "@topolo-io/mailbox": "domain-opt-in",
-  "@topolo-io/mobile-error-middleware": "domain-opt-in",
-  "@topolo-io/mobile-experience-contracts": "domain-opt-in",
-  "@topolo-io/nexus-client": "api-baseline",
-  "@topolo-io/node-canvas": "domain-opt-in",
-  "@topolo-io/notifications": "browser-baseline",
-  "@topolo-io/onboarding": "browser-baseline",
-  "@topolo-io/platform-mcp": "tooling",
-  "@topolo-io/resource-context": "browser-baseline",
-  "@topolo-io/security-headers": "api-baseline",
-  "@topolo-io/tour": "browser-baseline",
-  "@topolo-io/ui-kit": "browser-baseline",
-  "@topolo-io/widget-server": "api-baseline",
-  "@topolo-io/worker-runtime": "api-baseline",
-  "@topolo/cli": "tooling",
-  "@topolo/login": "developer-baseline",
-  "@topolo/mcp": "tooling",
-  "@topolo/sdk": "api-baseline"
-};
-function packagesForScaffoldClass(scaffoldClass) {
-  return Object.entries(TOPOLO_PACKAGE_SCAFFOLD_POLICY).filter(([, value]) => value === scaffoldClass).map(([name]) => name).sort();
-}
-var PLATFORM_BROWSER_TOPOLO_PACKAGES = packagesForScaffoldClass("browser-baseline");
-var PLATFORM_API_TOPOLO_PACKAGES = packagesForScaffoldClass("api-baseline");
-
 // src/commands/app-scaffold-package-template.ts
 function packageJson(application, target, options) {
   const dependencies = {};
@@ -6046,9 +6002,6 @@ function packageJson(application, target, options) {
       devDependencies.autoprefixer = "10.5.0";
       devDependencies.postcss = "8.5.6";
       devDependencies.tailwindcss = "3.4.19";
-      for (const packageName of PLATFORM_BROWSER_TOPOLO_PACKAGES) {
-        dependencies[packageName] = topoloPackageVersion(packageName, target);
-      }
       dependencies["react-router-dom"] = "^7.6.2";
     } else {
       dependencies["@topolo/login"] = topoloPackageVersion("@topolo/login", target);
@@ -6057,9 +6010,6 @@ function packageJson(application, target, options) {
   if (options.api) {
     devDependencies["@cloudflare/workers-types"] = "^5.20260716.1";
     if (target === "platform") {
-      for (const packageName of PLATFORM_API_TOPOLO_PACKAGES) {
-        dependencies[packageName] = topoloPackageVersion(packageName, target);
-      }
       dependencies.hono = "^4";
       dependencies.zod = "^4.4.3";
       scripts.deploy = `node -e 'console.error("\\nX Bare deploy is disabled. Use deploy:staging or deploy:production.\\n"); process.exit(1)'`;
@@ -6071,6 +6021,9 @@ function packageJson(application, target, options) {
     }
     devDependencies.wrangler = "^4.91.0";
   }
+  for (const packageName of options.packages) {
+    dependencies[packageName] = topoloPackageVersion(packageName, target);
+  }
   if (target === "platform") {
     const testDirs = [];
     if (options.browser) testDirs.push("apps/web");
@@ -6092,7 +6045,7 @@ function packageJson(application, target, options) {
       }
     }
   }
-  if (target === "platform" && hasScaffoldResources(options.resources)) {
+  if (target === "platform" && (options.api || options.browser)) {
     const deployChecks = [
       ...options.api ? ["wrangler deploy --config apps/api/wrangler.toml --env staging --dry-run --outdir .wrangler/api-build"] : [],
       ...options.browser ? ["wrangler deploy --config apps/web/wrangler.toml --env staging --dry-run --outdir .wrangler/web-build"] : []
@@ -6176,6 +6129,320 @@ function resourceConfig(application, profile) {
   };
 }
 
+// src/commands/app-capability-registry.ts
+var APPLICATION_CAPABILITY_REGISTRY_VERSION = "1";
+var TOPOLO_APP_CAPABILITY_IDS = [
+  "login",
+  "launcher",
+  "marketplace",
+  "hosting",
+  "api",
+  "widget",
+  "onboarding",
+  "resource_management",
+  "notifications",
+  "notification_producer",
+  "billing",
+  "metering",
+  "nexus_ai",
+  "integrations",
+  "webhooks",
+  "automation",
+  "agent_access",
+  "data",
+  "object_storage",
+  "background_jobs",
+  "durable_workflows",
+  "privacy",
+  "chat",
+  "calendar",
+  "mailbox",
+  "mobile"
+];
+var bothTargets = ["platform", "developer"];
+var platformTarget = ["platform"];
+var APPLICATION_CAPABILITY_REGISTRY = {
+  login: capability("login", "TopoloAuth", bothTargets, [], ["browser"], {
+    platform: ["@topolo-io/auth-client", "@topolo-io/app-shell"],
+    developer: ["@topolo/login"]
+  }, ["openid", "profile", "email", "organization:read"], [], [], ["auth-client"], ["auth-login-smoke"]),
+  launcher: capability("launcher", "TopoloDevelopers + TopoloAuth", bothTargets, ["login"], ["browser"], {
+    platform: ["@topolo-io/app-funnel", "@topolo-io/app-launcher", "@topolo-io/app-shell", "@topolo-io/design-tokens", "@topolo-io/ui-kit"],
+    developer: []
+  }, [], [], [], ["launcher-registration"], ["launcher-catalog-smoke"]),
+  marketplace: capability("marketplace", "TopoloDevelopers", bothTargets, ["launcher"], ["browser"], emptyPackages(), [], [], [], ["marketplace-registration"], ["marketplace-projection-check"]),
+  hosting: capability("hosting", "TopoloCloudControl or external owner", bothTargets, [], [], emptyPackages(), [], [], [], ["environment-manifest", "health-contract"], ["environment-health-smoke"]),
+  api: capability("api", "Application runtime + TopoloAuth", bothTargets, [], ["api"], {
+    platform: ["@topolo-io/auth-middleware", "@topolo-io/error-middleware", "@topolo-io/security-headers", "@topolo-io/worker-runtime", "@topolo/sdk"],
+    developer: ["@topolo/sdk"]
+  }, ["entitlements:read"], ["workspace:read", "workspace:write"], [], ["protected-worker"], ["api-auth-allow-deny"]),
+  widget: capability("widget", "Application runtime + TopoloDevelopers", bothTargets, ["api"], ["api"], {
+    platform: ["@topolo-io/widget-server", "@topolo/sdk"],
+    developer: ["@topolo/sdk"]
+  }, [], ["workspace:read"], [], ["widget-route", "widget-action-contract"], ["widget-contract-smoke"]),
+  onboarding: capability("onboarding", "TopoloAuth + shared onboarding packages", platformTarget, ["launcher"], ["browser"], {
+    platform: ["@topolo-io/onboarding", "@topolo-io/tour"],
+    developer: []
+  }, [], [], [], ["getting-started-route"], ["onboarding-progress-smoke"]),
+  resource_management: capability("resource_management", "TopoloAuth + application resource catalog", platformTarget, ["launcher"], ["browser"], {
+    platform: ["@topolo-io/api-key-management", "@topolo-io/resource-context"],
+    developer: []
+  }, [], ["workspace:read"], [], ["resource-selector"], ["resource-binding-smoke"]),
+  notifications: capability("notifications", "TopoloNotify + TopoloAuth", platformTarget, ["launcher"], ["browser"], {
+    platform: ["@topolo-io/notifications"],
+    developer: []
+  }, [], [], [], ["notification-consumer"], ["notification-inbox-smoke"]),
+  notification_producer: capability("notification_producer", "TopoloNotify + TopoloDevelopers", platformTarget, ["notifications", "api"], ["api"], {
+    platform: ["@topolo-io/notifications", "@topolo-io/auth-middleware"],
+    developer: []
+  }, [], ["events:write"], [], ["notification-producer-adapter", "notification-contracts"], ["notification-delivery-smoke"]),
+  billing: capability("billing", "TopoloPay + TopoloAuth", bothTargets, ["launcher"], ["browser"], {
+    platform: ["@topolo-io/billing-manifest", "@topolo-io/billing-ui"],
+    developer: []
+  }, ["entitlements:read"], [], [], ["pricing-manifest"], ["pricing-registration-smoke"]),
+  metering: capability("metering", "TopoloNexus", platformTarget, ["api"], ["api"], {
+    platform: ["@topolo-io/nexus-client", "@topolo-io/worker-runtime"],
+    developer: []
+  }, [], ["usage:write"], [], ["nexus-usage-adapter"], ["usage-attribution-smoke"]),
+  nexus_ai: capability("nexus_ai", "TopoloNexus", platformTarget, ["metering"], ["api"], {
+    platform: ["@topolo-io/nexus-client"],
+    developer: []
+  }, [], ["usage:write"], [], ["nexus-ai-adapter"], ["ai-budget-rejection-smoke"]),
+  integrations: capability("integrations", "TopoloNexus", platformTarget, ["api"], ["api"], {
+    platform: ["@topolo-io/nexus-client"],
+    developer: []
+  }, [], [], [], ["integration-connection-adapter"], ["integration-connection-smoke"]),
+  webhooks: capability("webhooks", "TopoloNotify", bothTargets, ["api"], ["api"], {
+    platform: ["@topolo-io/notifications"],
+    developer: []
+  }, [], [], [], ["webhook-receiver"], ["webhook-signature-smoke"]),
+  automation: capability("automation", "TopoloFlow + application runtime", platformTarget, ["api"], ["api"], {
+    platform: ["@topolo/sdk"],
+    developer: []
+  }, [], [], [], ["flow-adapter"], ["flow-run-smoke"]),
+  agent_access: capability("agent_access", "TopoloDevelopers + TopoloAgent", bothTargets, ["widget"], ["api"], {
+    platform: ["@topolo-io/worker-runtime", "@topolo/sdk"],
+    developer: ["@topolo/sdk"]
+  }, [], ["workspace:read"], [], ["action-contracts"], ["credential-scoped-action-smoke"]),
+  data: capability("data", "Application runtime through @topolo-io/data", platformTarget, ["api"], ["api"], {
+    platform: ["@topolo-io/data"],
+    developer: []
+  }, [], ["workspace:read", "workspace:write"], ["d1"], ["workspace-migration", "data-port"], ["tenant-isolation-smoke"]),
+  object_storage: capability("object_storage", "Application runtime through @topolo-io/data", platformTarget, ["data"], ["api"], {
+    platform: ["@topolo-io/data"],
+    developer: []
+  }, [], ["workspace:read", "workspace:write"], ["r2"], ["object-store-port"], ["object-lifecycle-smoke"]),
+  background_jobs: capability("background_jobs", "Application runtime", platformTarget, ["api"], ["api"], emptyPackages(), [], ["workspace:write"], ["queue"], ["queue-producer", "queue-consumer"], ["queue-execution-smoke"]),
+  durable_workflows: capability("durable_workflows", "Application runtime + TopoloFlow", platformTarget, ["background_jobs"], ["api"], emptyPackages(), [], ["workspace:write"], ["workflow"], ["workflow-entrypoint"], ["workflow-execution-smoke"]),
+  privacy: capability("privacy", "TopoloConsent + application data owner", platformTarget, ["api"], ["api"], emptyPackages(), [], [], [], ["privacy-adapter", "retention-declaration"], ["dsr-export-delete-smoke"]),
+  chat: capability("chat", "TopoloChat", platformTarget, ["launcher"], ["browser"], {
+    platform: ["@topolo-io/chat-widget"],
+    developer: []
+  }, [], [], [], ["chat-surface"], ["chat-surface-smoke"]),
+  calendar: capability("calendar", "TopoloCalendar", platformTarget, ["launcher"], ["browser"], {
+    platform: ["@topolo-io/calendar"],
+    developer: []
+  }, [], [], [], ["calendar-surface"], ["calendar-surface-smoke"]),
+  mailbox: capability("mailbox", "TopoloMail", platformTarget, ["launcher"], ["browser"], {
+    platform: ["@topolo-io/mailbox"],
+    developer: []
+  }, [], [], [], ["mailbox-surface"], ["mailbox-surface-smoke"]),
+  mobile: capability("mobile", "TopoloOne + application native runtime", bothTargets, [], ["mobile"], {
+    platform: ["@topolo-io/bridge", "@topolo-io/mobile-error-middleware", "@topolo-io/mobile-experience-contracts"],
+    developer: []
+  }, [], [], [], ["mobile-experience-metadata"], ["native-experience-smoke"])
+};
+var PROFILE_CAPABILITIES = {
+  "spatial-assets": ["object_storage", "background_jobs", "durable_workflows"]
+};
+function resolveApplicationCapabilities(options) {
+  const requested = options.requested ?? [];
+  const unknown = requested.filter((id) => !isTopoloAppCapability(id));
+  if (unknown.length > 0) {
+    throw new Error(`Unknown application capability: ${unknown.join(", ")}. Supported capabilities: ${TOPOLO_APP_CAPABILITY_IDS.join(", ")}.`);
+  }
+  if (options.profile && !PROFILE_CAPABILITIES[options.profile]) {
+    throw new Error(`Unknown capability profile: ${options.profile}.`);
+  }
+  const selected = /* @__PURE__ */ new Set();
+  const add = (id) => {
+    const definition = APPLICATION_CAPABILITY_REGISTRY[id];
+    if (!definition.targets.includes(options.target)) {
+      throw new Error(`Capability ${id} is not available to ${options.target} applications.`);
+    }
+    for (const dependency of definition.requires) add(dependency);
+    selected.add(id);
+  };
+  if (options.browser) {
+    add("login");
+    add("launcher");
+    add("hosting");
+    if (options.target === "platform") {
+      add("onboarding");
+      add("resource_management");
+      add("notifications");
+    }
+  }
+  if (options.distributionModel === "marketplace" && options.browser) add("marketplace");
+  if (options.api) {
+    add("api");
+    add("widget");
+    if (options.target === "platform") add("agent_access");
+  }
+  if (options.mobile) add("mobile");
+  for (const id of options.profile ? PROFILE_CAPABILITIES[options.profile] ?? [] : []) add(id);
+  for (const id of requested) add(id);
+  for (const id of selected) {
+    const definition = APPLICATION_CAPABILITY_REGISTRY[id];
+    if (definition.surfaces.includes("browser") && !options.browser) {
+      throw new Error(`Capability ${id} requires a browser surface.`);
+    }
+    if (definition.surfaces.includes("api") && !options.api) {
+      throw new Error(`Capability ${id} requires an API surface.`);
+    }
+    if (definition.surfaces.includes("mobile") && !options.mobile) {
+      throw new Error(`Capability ${id} requires a mobile surface model.`);
+    }
+  }
+  const ordered = TOPOLO_APP_CAPABILITY_IDS.filter((id) => selected.has(id));
+  const definitions = ordered.map((id) => APPLICATION_CAPABILITY_REGISTRY[id]);
+  const targetPackages = options.target === "platform" ? "platform" : "developer";
+  return {
+    registryVersion: APPLICATION_CAPABILITY_REGISTRY_VERSION,
+    selected: ordered,
+    declarations: ordered.map((id) => ({ id, version: 1 })),
+    packages: unique2(definitions.flatMap((definition) => definition.packages[targetPackages])),
+    authScopes: unique2(definitions.flatMap((definition) => definition.authScopes)),
+    servicePermissions: unique2(definitions.flatMap((definition) => definition.servicePermissions)),
+    resources: unique2(definitions.flatMap((definition) => definition.resources)),
+    artifacts: unique2(definitions.flatMap((definition) => definition.artifacts)),
+    stagingEvidence: unique2(definitions.flatMap((definition) => definition.stagingEvidence))
+  };
+}
+function isTopoloAppCapability(value) {
+  return TOPOLO_APP_CAPABILITY_IDS.includes(value);
+}
+function capability(id, owner, targets, requires, surfaces, packages, authScopes, servicePermissions, resources, artifacts, stagingEvidence) {
+  return { id, version: 1, owner, targets, requires, surfaces, packages, authScopes, servicePermissions, resources, artifacts, stagingEvidence };
+}
+function emptyPackages() {
+  return { platform: [], developer: [] };
+}
+function unique2(values) {
+  return Array.from(new Set(values));
+}
+
+// src/commands/app-capability-artifacts.ts
+function capabilityCompositionProjection(capabilities) {
+  return {
+    registryVersion: capabilities.registryVersion,
+    selected: capabilities.declarations,
+    artifacts: capabilities.artifacts,
+    stagingEvidence: capabilities.stagingEvidence
+  };
+}
+function capabilityContractProjection(capabilities) {
+  return {
+    registryVersion: APPLICATION_CAPABILITY_REGISTRY_VERSION,
+    selected: capabilities.selected.map((id) => {
+      const definition = APPLICATION_CAPABILITY_REGISTRY[id];
+      return {
+        id,
+        version: definition.version,
+        owner: definition.owner,
+        packages: definition.packages,
+        authScopes: definition.authScopes,
+        servicePermissions: definition.servicePermissions,
+        resources: definition.resources,
+        artifacts: definition.artifacts,
+        stagingEvidence: definition.stagingEvidence
+      };
+    })
+  };
+}
+function defaultPricingManifest(options) {
+  if (!options.appId) throw new Error("Billing composition requires a canonical appId.");
+  return {
+    appId: options.appId,
+    developerOrgId: null,
+    schemaVersion: 1,
+    marketingCopy: { tagline: options.description, marketplaceBadges: ["free"] },
+    meters: [],
+    plans: [{
+      id: "free",
+      tier: "free",
+      displayName: "Free",
+      summary: `Start using ${options.displayName}.`,
+      pricing: { model: "free" },
+      bullets: ["Shared Topolo identity and application access"],
+      isDefault: true
+    }]
+  };
+}
+
+// src/commands/app-capability-adapter-template.ts
+function managedCapabilityAdapter(capabilities) {
+  const notifications = capabilities.includes("notification_producer");
+  const nexus = capabilities.some((capability2) => capability2 === "metering" || capability2 === "nexus_ai" || capability2 === "integrations");
+  const webhooks = capabilities.includes("webhooks");
+  if (!notifications && !nexus && !webhooks) return null;
+  return [
+    ...notifications || nexus ? ["import { createServiceClient } from '@topolo-io/auth-middleware';"] : [],
+    ...notifications ? ["import { TopoloEvents } from '@topolo-io/notifications';"] : [],
+    ...webhooks ? ["import { WEBHOOK_SIGNATURE_HEADER, verifyWebhookSignature } from '@topolo-io/notifications';"] : [],
+    ...nexus ? ["import { createNexusClient } from '@topolo-io/nexus-client';"] : [],
+    "",
+    "export interface TopoloCapabilityEnv {",
+    "  APP_ID?: string;",
+    "  TOPOLO_SERVICE_CLIENT_SECRET?: string;",
+    ...notifications ? ["  TOPOLO_NOTIFY_URL?: string;"] : [],
+    ...nexus ? ["  NEXUS_GATEWAY_URL?: string;"] : [],
+    ...webhooks ? ["  TOPOLO_WEBHOOK_SECRET?: string;"] : [],
+    "}",
+    ...notifications ? [
+      "",
+      "export function createTopoloEvents(env: TopoloCapabilityEnv): TopoloEvents {",
+      "  if (!env.APP_ID) throw new Error('APP_ID is required for notification attribution.');",
+      "  if (!env.TOPOLO_NOTIFY_URL) throw new Error('TOPOLO_NOTIFY_URL is required for notification delivery.');",
+      "  return new TopoloEvents({",
+      "    appId: env.APP_ID,",
+      "    notifyBaseUrl: env.TOPOLO_NOTIFY_URL,",
+      "    serviceClient: createServiceClient(env),",
+      "  });",
+      "}"
+    ] : [],
+    ...nexus ? [
+      "",
+      "export function createTopoloNexus(env: TopoloCapabilityEnv, organizationId: string) {",
+      "  if (!env.APP_ID) throw new Error('APP_ID is required for Nexus attribution.');",
+      "  if (!env.NEXUS_GATEWAY_URL) throw new Error('NEXUS_GATEWAY_URL is required for Nexus requests.');",
+      "  if (!organizationId) throw new Error('Verified organizationId is required for Nexus requests.');",
+      "  const serviceClient = createServiceClient(env);",
+      "  return createNexusClient({",
+      "    appId: env.APP_ID,",
+      "    gatewayUrl: env.NEXUS_GATEWAY_URL,",
+      "    organizationId,",
+      "    serviceTokenProvider: (scope) => serviceClient.getToken(scope ?? 'usage:write'),",
+      "  });",
+      "}"
+    ] : [],
+    ...webhooks ? [
+      "",
+      "export async function verifyTopoloWebhookRequest(",
+      "  request: Request,",
+      "  env: TopoloCapabilityEnv,",
+      "): Promise<{ ok: true; body: string } | { ok: false; response: Response }> {",
+      "  if (!env.TOPOLO_WEBHOOK_SECRET) return { ok: false, response: Response.json({ error: 'webhook_secret_missing' }, { status: 503 }) };",
+      "  const body = await request.text();",
+      "  const valid = await verifyWebhookSignature(env.TOPOLO_WEBHOOK_SECRET, body, request.headers.get(WEBHOOK_SIGNATURE_HEADER));",
+      "  if (!valid) return { ok: false, response: Response.json({ error: 'invalid_webhook_signature' }, { status: 401 }) };",
+      "  return { ok: true, body };",
+      "}"
+    ] : [],
+    ""
+  ].join("\n");
+}
+
 // src/commands/app-scaffold-browser-template.ts
 function readme(application, target, options) {
   const displayName = toTitle(application.name);
@@ -6480,11 +6747,20 @@ function appIdentityTs(application) {
     "}",
     "",
     "export function getBrowserAuthBaseUrl(): string {",
-    "  const defaultAuthUrl =",
-    "    typeof window !== 'undefined' && window.location.hostname.endsWith('.stg.topolo.us')",
-    "      ? 'https://auth.stg.topolo.us'",
-    "      : 'https://auth.topolo.app';",
-    "  return (import.meta.env.VITE_TOPOLO_AUTH_URL || defaultAuthUrl).replace(/\\/+$/, '');",
+    "  // A declared URL always wins; deployed builds set VITE_TOPOLO_AUTH_URL in",
+    "  // their per-environment build commands, so the host map below only covers",
+    "  // platform domains. Anything else fails loudly \u2014 an unknown host",
+    "  // (localhost, workers.dev previews) must never silently authenticate",
+    "  // against production Auth.",
+    "  const declared = import.meta.env.VITE_TOPOLO_AUTH_URL;",
+    "  if (declared) return declared.replace(/\\/+$/, '');",
+    "  const hostname = typeof window !== 'undefined' ? window.location.hostname : '';",
+    "  if (hostname.endsWith('.stg.topolo.us')) return 'https://auth.stg.topolo.us';",
+    "  if (hostname.endsWith('.topolo.dev')) return 'https://auth.topolo.dev';",
+    "  if (hostname.endsWith('.topolo.app')) return 'https://auth.topolo.app';",
+    "  throw new Error(",
+    "    `VITE_TOPOLO_AUTH_URL must be set for host \"${hostname || 'non-browser context'}\" \u2014 refusing to default to production Auth.`,",
+    "  );",
     "}",
     "",
     "// Canonical browser app id. index.html bakes %VITE_TOPOLO_APP_ID% into",
@@ -7219,7 +7495,12 @@ import { createAccountLinkPayload, createTopoloAuthorizationUrl, exchangeTopoloC
 
 type AuthState = 'ready' | 'missing_client' | 'authorizing' | 'authenticated' | 'error';
 const APP_NAME = '${escapeSingleQuoted(appName)}';
-const AUTH_URL = import.meta.env.VITE_TOPOLO_AUTH_URL ?? import.meta.env.VITE_TOPOLO_AUTH_BASE_URL ?? 'https://auth.topolo.app';
+// Environment-aware default: hardcoding the production host would point a
+// staging build at prod Auth whenever the VITE_ vars were dropped.
+const DEFAULT_AUTH_URL = window.location.hostname.endsWith('.stg.topolo.us')
+  ? 'https://auth.stg.topolo.us'
+  : 'https://auth.topolo.app';
+const AUTH_URL = import.meta.env.VITE_TOPOLO_AUTH_URL ?? import.meta.env.VITE_TOPOLO_AUTH_BASE_URL ?? DEFAULT_AUTH_URL;
 const CLIENT_ID = import.meta.env.VITE_TOPOLO_CLIENT_ID || '${defaultClientId}';
 const REDIRECT_URI = import.meta.env.VITE_TOPOLO_REDIRECT_URI || \`\${window.location.origin}/auth/callback\`;
 const REQUESTED_SCOPES = (import.meta.env.VITE_TOPOLO_SCOPES || 'openid profile email organization:read entitlements:read').split(/[\\s,]+/).filter(Boolean);
@@ -7318,235 +7599,6 @@ function webWorkerTs(application, api) {
     ""
   ].join("\n");
 }
-function platformWebWranglerToml(application, api) {
-  const slug = toSlug(application.id);
-  const host = application.productionUrl ? new URL(application.productionUrl).host : `${slug}.topolo.app`;
-  return [
-    `name = "topolo-${slug}"`,
-    'main = "src/worker.ts"',
-    `compatibility_date = "${CLOUDFLARE_COMPATIBILITY_DATE}"`,
-    'compatibility_flags = ["nodejs_compat"]',
-    `account_id = "${CLOUDFLARE_ACCOUNT_ID}"`,
-    "workers_dev = false",
-    "",
-    "[assets]",
-    'directory = "./dist"',
-    'binding = "ASSETS"',
-    'not_found_handling = "single-page-application"',
-    ...api ? ['run_worker_first = ["/api/*"]'] : [],
-    "",
-    "[observability]",
-    "enabled = true",
-    "",
-    "[[routes]]",
-    `pattern = "${host}"`,
-    "custom_domain = true",
-    "",
-    "[vars]",
-    `APP_ID = "${application.appId ?? ""}"`,
-    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
-    "",
-    ...api ? [
-      "[[services]]",
-      'binding = "API"',
-      `service = "topolo-${slug}-api"`,
-      ""
-    ] : [],
-    "[env.development]",
-    `name = "topolo-${slug}-development"`,
-    `account_id = "${DEVELOPMENT_CLOUDFLARE_ACCOUNT_ID}"`,
-    "workers_dev = true",
-    "",
-    "[env.development.vars]",
-    `APP_ID = "${application.appId ?? ""}"`,
-    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
-    "",
-    "[[env.development.routes]]",
-    `pattern = "${slug}.topolo.dev"`,
-    "custom_domain = true",
-    "",
-    "[env.development.assets]",
-    'directory = "./dist"',
-    'binding = "ASSETS"',
-    'not_found_handling = "single-page-application"',
-    ...api ? ['run_worker_first = ["/api/*"]'] : [],
-    "",
-    ...api ? [
-      "[[env.development.services]]",
-      'binding = "API"',
-      `service = "topolo-${slug}-api-development"`,
-      ""
-    ] : [],
-    "[env.staging]",
-    `name = "topolo-${slug}-staging"`,
-    `account_id = "${STAGING_CLOUDFLARE_ACCOUNT_ID}"`,
-    "workers_dev = true",
-    "",
-    "[env.staging.vars]",
-    `APP_ID = "${application.appId ?? ""}"`,
-    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
-    "",
-    "[[env.staging.routes]]",
-    `pattern = "${slug}.stg.topolo.us"`,
-    "custom_domain = true",
-    "",
-    "[env.staging.assets]",
-    'directory = "./dist"',
-    'binding = "ASSETS"',
-    'not_found_handling = "single-page-application"',
-    ...api ? ['run_worker_first = ["/api/*"]'] : [],
-    "",
-    ...api ? [
-      "[[env.staging.services]]",
-      'binding = "API"',
-      `service = "topolo-${slug}-api-staging"`,
-      ""
-    ] : [],
-    "[env.production]",
-    `name = "topolo-${slug}-production"`,
-    `account_id = "${CLOUDFLARE_ACCOUNT_ID}"`,
-    "workers_dev = false",
-    "",
-    "[env.production.vars]",
-    `APP_ID = "${application.appId ?? ""}"`,
-    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
-    "",
-    "[[env.production.routes]]",
-    `pattern = "${host}"`,
-    "custom_domain = true",
-    "",
-    "[env.production.assets]",
-    'directory = "./dist"',
-    'binding = "ASSETS"',
-    'not_found_handling = "single-page-application"',
-    ...api ? ['run_worker_first = ["/api/*"]'] : [],
-    "",
-    ...api ? [
-      "[[env.production.services]]",
-      'binding = "API"',
-      `service = "topolo-${slug}-api-production"`,
-      ""
-    ] : []
-  ].join("\n");
-}
-function platformApiWranglerToml(application, resources, profile) {
-  const slug = toSlug(application.id);
-  const resource = resourceConfig(application, profile);
-  const lines = [
-    `name = "topolo-${slug}-api"`,
-    'main = "src/worker.ts"',
-    `compatibility_date = "${CLOUDFLARE_COMPATIBILITY_DATE}"`,
-    'compatibility_flags = ["nodejs_compat"]',
-    `account_id = "${CLOUDFLARE_ACCOUNT_ID}"`,
-    "workers_dev = true",
-    "",
-    "[observability]",
-    "enabled = true",
-    "",
-    "[vars]",
-    'AUTH_BASE_URL = "https://auth.topolo.app"',
-    'NEXUS_GATEWAY_URL = "https://nexus.topolo.app"',
-    `NEXUS_APP_ID = "${slug}"`,
-    `APP_ID = "${application.appId ?? ""}"`,
-    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
-    ""
-  ];
-  appendResourceWranglerBlocks(lines, resources, resource, "production");
-  lines.push(
-    "[env.development]",
-    `name = "topolo-${slug}-api-development"`,
-    `account_id = "${DEVELOPMENT_CLOUDFLARE_ACCOUNT_ID}"`,
-    "workers_dev = true",
-    "",
-    "[env.development.vars]",
-    'AUTH_BASE_URL = "https://auth.topolo.dev"',
-    'NEXUS_GATEWAY_URL = "https://nexus.topolo.dev"',
-    `NEXUS_APP_ID = "${slug}"`,
-    `APP_ID = "${application.appId ?? ""}"`,
-    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
-    'ENVIRONMENT = "development"',
-    ""
-  );
-  appendResourceWranglerBlocks(lines, resources, resource, "development");
-  lines.push(
-    "[env.staging]",
-    `name = "topolo-${slug}-api-staging"`,
-    `account_id = "${STAGING_CLOUDFLARE_ACCOUNT_ID}"`,
-    "workers_dev = true",
-    "",
-    "[env.staging.vars]",
-    'AUTH_BASE_URL = "https://auth.stg.topolo.us"',
-    'NEXUS_GATEWAY_URL = "https://nexus.stg.topolo.us"',
-    `NEXUS_APP_ID = "${slug}"`,
-    `APP_ID = "${application.appId ?? ""}"`,
-    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
-    ""
-  );
-  appendResourceWranglerBlocks(lines, resources, resource, "staging");
-  lines.push(
-    "[env.production]",
-    `name = "topolo-${slug}-api-production"`,
-    `account_id = "${CLOUDFLARE_ACCOUNT_ID}"`,
-    "workers_dev = false",
-    "",
-    "[env.production.vars]",
-    'AUTH_BASE_URL = "https://auth.topolo.app"',
-    'NEXUS_GATEWAY_URL = "https://nexus.topolo.app"',
-    `NEXUS_APP_ID = "${slug}"`,
-    `APP_ID = "${application.appId ?? ""}"`,
-    `VITE_TOPOLO_APP_ID = "${application.appId ?? ""}"`,
-    ""
-  );
-  appendResourceWranglerBlocks(lines, resources, resource, "production-env");
-  return lines.join("\n");
-}
-function appendResourceWranglerBlocks(lines, resources, resource, environment) {
-  const prefix = environment === "staging" ? "env.staging." : environment === "development" ? "env.development." : environment === "production-env" ? "env.production." : "";
-  const envName = environment === "staging" ? "Staging" : environment === "development" ? "Development" : "Production";
-  const pick = (dev, staging, prod) => environment === "development" ? dev : environment === "staging" ? staging : prod;
-  if (resources.d1) {
-    lines.push(
-      `[[${prefix}d1_databases]]`,
-      `binding = "${resource.d1Binding}"`,
-      `database_name = "${pick(resource.d1DevelopmentName, resource.d1StagingName, resource.d1ProductionName)}"`,
-      'database_id = "provision-after-scaffold"',
-      'migrations_dir = "migrations"',
-      ""
-    );
-  }
-  if (resources.r2) {
-    lines.push(
-      `[[${prefix}r2_buckets]]`,
-      `binding = "${resource.r2Binding}"`,
-      `bucket_name = "${pick(resource.r2DevelopmentName, resource.r2StagingName, resource.r2ProductionName)}"`,
-      ""
-    );
-  }
-  if (resources.queue) {
-    lines.push(
-      `[[${prefix}queues.producers]]`,
-      `binding = "${resource.queueBinding}"`,
-      `queue = "${pick(resource.queueDevelopmentName, resource.queueStagingName, resource.queueProductionName)}"`,
-      "",
-      `[[${prefix}queues.consumers]]`,
-      `queue = "${pick(resource.queueDevelopmentName, resource.queueStagingName, resource.queueProductionName)}"`,
-      ""
-    );
-  }
-  if (resources.workflow) {
-    lines.push(
-      `[[${prefix}workflows]]`,
-      `binding = "${resource.workflowBinding}"`,
-      `name = "${pick(resource.workflowDevelopmentName, resource.workflowStagingName, resource.workflowProductionName)}"`,
-      `class_name = "${resource.workflowClassName}"`,
-      ""
-    );
-  }
-  if (resources.containerProcessing) {
-    lines.push(`# ${envName} container metadata is declared in topolo.app.json and topolo.cloudcontrol.json.`);
-    lines.push("");
-  }
-}
 function wranglerToml(application, target, resources, profile) {
   const slug = toSlug(application.id);
   const workerName = target === "platform" ? `topolo-${slug}` : application.packageName;
@@ -7707,9 +7759,15 @@ function platformWorkerTs(application, options) {
   ];
   const workflowExport = options.resources.workflow ? [
     "",
-    `export class ${resource.workflowClassName} extends WorkflowEntrypoint<Env, unknown> {`,
-    "  async run(_event: Readonly<WorkflowEvent<unknown>>, step: WorkflowStep): Promise<unknown> {",
-    "    return step.do('scaffold no-op', async () => ({ status: 'pending_implementation' }));",
+    `export class ${resource.workflowClassName} extends WorkflowEntrypoint<Env, CapabilityWorkflowInput> {`,
+    "  async run(event: Readonly<WorkflowEvent<CapabilityWorkflowInput>>, step: WorkflowStep): Promise<unknown> {",
+    "    if (event.payload.type !== 'capability.probe' || !event.payload.workspaceId) {",
+    "      throw new Error('Unsupported workflow message. Implement a vertical workflow contract before dispatching it.');",
+    "    }",
+    "    return step.do('capability probe', async () => ({",
+    "      status: 'completed',",
+    "      workspaceId: event.payload.workspaceId,",
+    "    }));",
     "  }",
     "}"
   ] : [];
@@ -7744,6 +7802,21 @@ function platformWorkerTs(application, options) {
     "export interface Env {",
     ...envBindings,
     "}",
+    ...options.resources.queue ? [
+      "",
+      "interface CapabilityJob {",
+      "  type: 'capability.probe';",
+      "  workspaceId: string;",
+      "  payload?: unknown;",
+      "}"
+    ] : [],
+    ...options.resources.workflow ? [
+      "",
+      "interface CapabilityWorkflowInput {",
+      "  type: 'capability.probe';",
+      "  workspaceId: string;",
+      "}"
+    ] : [],
     "",
     "function buildWidgets(): TopoloWidgetDraft[] {",
     "  return [",
@@ -7766,7 +7839,10 @@ function platformWorkerTs(application, options) {
     "  // Auth verification base URL is environment-driven (staging/prod/dev),",
     "  // so rt.verifyAuth() targets the correct Auth service per deploy.",
     "  authBaseUrl: (env) => env.AUTH_BASE_URL,",
-    "  authGateway: { enabled: false },",
+    "  // The runtime's /api/auth/* gateway serves the app-switcher catalog,",
+    "  // preferences, and theme for the shared app shell \u2014 it must run before",
+    "  // the app's own auth so unentitled users still get the switcher.",
+    "  authGateway: { enabled: true },",
     "  actionContracts: topoloActionContracts,",
     "});",
     "",
@@ -7837,6 +7913,14 @@ function platformWorkerTs(application, options) {
     "    bindings.__rt = rt;",
     "    return securedFetch(request, bindings, ctx as ExecutionContext);",
     "  }),",
+    ...options.resources.queue ? [
+      "  async queue(batch: MessageBatch<CapabilityJob>): Promise<void> {",
+      "    for (const message of batch.messages) {",
+      "      if (message.body?.type === 'capability.probe' && message.body.workspaceId) message.ack();",
+      "      else message.retry();",
+      "    }",
+      "  },"
+    ] : [],
     "};",
     "",
     "function errorMessage(error: unknown): string {",
@@ -7919,8 +8003,13 @@ function developerWorkerTs(application) {
     "  const token = authHeader.startsWith('Bearer ') ? authHeader.slice(7) : null;",
     "  if (!token) return { ok: false, status: 401, error: 'Bearer token required' };",
     "",
+    "  // Fail loudly: defaulting to the production Auth host here would let a",
+    "  // misconfigured staging/dev worker validate tokens against prod. The",
+    "  // manifest declares AUTH_BASE_URL for every environment.",
+    "  if (!env.AUTH_BASE_URL) return { ok: false, status: 500, error: 'AUTH_BASE_URL not configured' };",
+    "",
     "  try {",
-    "    const authBaseUrl = env.AUTH_BASE_URL || 'https://auth.topolo.app';",
+    "    const authBaseUrl = env.AUTH_BASE_URL;",
     "    const response = await fetch(`${authBaseUrl}/validate`, {",
     "      method: 'POST',",
     "      headers: {",
@@ -7950,6 +8039,72 @@ function developerWorkerTs(application) {
   ].join("\n");
 }
 
+// src/commands/app-scaffold-generate.ts
+import { existsSync as existsSync3, mkdirSync, mkdtempSync, readFileSync as readFileSync4, rmSync, writeFileSync } from "fs";
+import { spawnSync } from "child_process";
+import { tmpdir } from "os";
+import path2 from "path";
+function resolveGeneratorPath() {
+  const candidates = [
+    // Published CLI: vendored alongside dist/index.js at build time.
+    new URL("./generate-wrangler.mjs", import.meta.url),
+    // In-repo (tests, `pnpm dev`): the platform's canonical copy, which is the
+    // very file the vendor step copies.
+    new URL("../../../../tooling/generate-wrangler.mjs", import.meta.url)
+  ];
+  for (const candidate of candidates) {
+    const p = decodeURIComponent(candidate.pathname);
+    if (existsSync3(p)) return p;
+  }
+  throw new Error(
+    `topolo: could not locate generate-wrangler.mjs. A published CLI vendors it into dist/ at build time; in-repo it is read from topolo-platform/tooling/. Looked in:
+${candidates.map((c) => `  ${decodeURIComponent(c.pathname)}`).join("\n")}`
+  );
+}
+var GENERATED = {
+  purpose: "GENERATED from topolo.app.json by topolo-platform/tooling/generate-wrangler.mjs \u2014 never hand-edit.",
+  requiredSignals: [
+    "byte-identical to what generate-wrangler emits for this manifest",
+    "every change is made in topolo.app.json, never here"
+  ]
+};
+function deriveGeneratedConfigs(files, base) {
+  const generator = resolveGeneratorPath();
+  const root = mkdtempSync(path2.join(tmpdir(), "topolo-scaffold-generate-"));
+  try {
+    const prefix = `${base}/`;
+    for (const file of files) {
+      if (!file.path.startsWith(prefix)) continue;
+      const abs = path2.join(root, file.path.slice(prefix.length));
+      mkdirSync(path2.dirname(abs), { recursive: true });
+      writeFileSync(abs, file.content, "utf8");
+    }
+    const result = spawnSync(
+      process.execPath,
+      [generator, `--manifest=${path2.join(root, "topolo.app.json")}`],
+      { cwd: root, encoding: "utf8" }
+    );
+    if (result.status !== 0) {
+      throw new Error(
+        `topolo: generate-wrangler failed for the scaffolded manifest (exit ${result.status}).
+${result.stdout ?? ""}${result.stderr ?? ""}`
+      );
+    }
+    const written = [...(result.stdout ?? "").matchAll(/^\[generate\] wrote (.+)$/gm)].map((m) => (m[1] ?? "").trim()).filter(Boolean);
+    if (!written.length) {
+      throw new Error(`topolo: generate-wrangler wrote no files.
+${result.stdout ?? ""}`);
+    }
+    return written.map((rel) => ({
+      path: `${base}/${rel}`,
+      ...GENERATED,
+      content: readFileSync4(path2.join(root, rel), "utf8")
+    }));
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+}
+
 // src/commands/app-scaffold-workflows.ts
 function scaffoldCommands(options) {
   const scaffoldId = toSlug(options.id);
@@ -8113,6 +8268,10 @@ function topoloAppManifestJson(application, options) {
       bindings.d1 = [
         {
           binding: resource.d1Binding,
+          development: {
+            databaseName: resource.d1DevelopmentName,
+            databaseId: "provision-after-scaffold"
+          },
           staging: {
             databaseName: resource.d1StagingName,
             databaseId: "provision-after-scaffold"
@@ -8129,26 +8288,29 @@ function topoloAppManifestJson(application, options) {
       bindings.r2 = [
         {
           binding: resource.r2Binding,
+          development: { bucketName: resource.r2DevelopmentName },
           staging: { bucketName: resource.r2StagingName },
           production: { bucketName: resource.r2ProductionName }
         }
       ];
     }
     if (options.resources.queue) {
-      bindings.queues = [
-        {
-          binding: resource.queueBinding,
-          staging: { queueName: resource.queueStagingName },
-          production: { queueName: resource.queueProductionName },
-          consumer: true
-        }
-      ];
+      const queue = {
+        development: { queue: resource.queueDevelopmentName },
+        staging: { queue: resource.queueStagingName },
+        production: { queue: resource.queueProductionName }
+      };
+      bindings.queues = {
+        producers: [{ binding: resource.queueBinding, ...queue }],
+        consumers: [{ ...queue }]
+      };
     }
     if (options.resources.workflow) {
       bindings.workflows = [
         {
           binding: resource.workflowBinding,
           className: resource.workflowClassName,
+          development: { name: resource.workflowDevelopmentName },
           staging: { name: resource.workflowStagingName },
           production: { name: resource.workflowProductionName }
         }
@@ -8162,53 +8324,77 @@ function topoloAppManifestJson(application, options) {
       compatibilityFlags: ["nodejs_compat"],
       healthcheckPath: "/api/health",
       vars: {
+        // Every environment the manifest declares must be listed. A per-env map
+        // that omits one leaves that env with no value, and both of these fall
+        // back to PRODUCTION when unset (@topolo-io/nexus-client defaults
+        // gatewayUrl to https://nexus.topolo.app) — a staging or dev worker
+        // silently talking to prod.
         AUTH_BASE_URL: {
+          development: "https://auth.topolo.dev",
           staging: "https://auth.stg.topolo.us",
           production: "https://auth.topolo.app"
         },
         NEXUS_GATEWAY_URL: {
+          development: "https://nexus.topolo.dev",
           staging: "https://nexus.stg.topolo.us",
           production: "https://nexus.topolo.app"
         },
-        NEXUS_APP_ID: slug
+        ...options.payload.capabilities.includes("notification_producer") ? {
+          TOPOLO_NOTIFY_URL: {
+            development: "https://notify.topolo.dev",
+            staging: "https://notify.stg.topolo.us",
+            production: "https://notify.topolo.app"
+          }
+        } : {}
+        // No NEXUS_APP_ID: generate-wrangler binds APP_ID (the app_id) into every
+        // env, and worker-runtime reads env.APP_ID for Nexus usage attribution,
+        // so a second copy of the same identity would only be a chance to drift.
+        // It previously carried the SLUG, which reads as a working identity while
+        // Nexus attributes by app_id.
       },
-      secrets: ["TOPOLO_SERVICE_CLIENT_SECRET"],
+      secrets: [
+        "TOPOLO_SERVICE_CLIENT_SECRET",
+        ...options.payload.capabilities.includes("webhooks") ? ["TOPOLO_WEBHOOK_SECRET"] : []
+      ],
       ...Object.keys(bindings).length ? { bindings } : {}
     };
   }
-  targets.web = {
-    kind: "worker",
-    dir: "apps/web",
-    wranglerName: `topolo-${slug}`,
-    subdomain: slug,
-    main: "src/worker.ts",
-    workersDev: false,
-    assets: {
-      directory: "./dist",
-      binding: "ASSETS",
-      notFoundHandling: "single-page-application",
-      runWorkerFirst: ["/api/*"]
-    },
-    compatibilityFlags: ["nodejs_compat"],
-    buildCommand: {
-      staging: "cd ../.. && DEPLOY_ENVIRONMENT=staging VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us pnpm run build",
-      production: "cd ../.. && DEPLOY_ENVIRONMENT=production VITE_TOPOLO_AUTH_URL=https://auth.topolo.app pnpm run build"
-    },
-    healthcheckPath: options.api ? "/api/health" : "/",
-    ...options.api ? {
-      bindings: {
-        services: [
-          {
-            binding: "API",
-            service: {
-              staging: `topolo-${slug}-api-staging`,
-              production: `topolo-${slug}-api-production`
+  if (options.browser) {
+    targets.web = {
+      kind: "worker",
+      dir: "apps/web",
+      wranglerName: `topolo-${slug}`,
+      subdomain: slug,
+      main: "src/worker.ts",
+      workersDev: false,
+      assets: {
+        directory: "./dist",
+        binding: "ASSETS",
+        notFoundHandling: "single-page-application",
+        // Only meaningful when there is an API Worker to run first.
+        ...options.api ? { runWorkerFirst: ["/api/*"] } : {}
+      },
+      compatibilityFlags: ["nodejs_compat"],
+      buildCommand: {
+        staging: "cd ../.. && DEPLOY_ENVIRONMENT=staging VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us pnpm run build",
+        production: "cd ../.. && DEPLOY_ENVIRONMENT=production VITE_TOPOLO_AUTH_URL=https://auth.topolo.app pnpm run build"
+      },
+      healthcheckPath: options.api ? "/api/health" : "/",
+      ...options.api ? {
+        bindings: {
+          services: [
+            {
+              binding: "API",
+              service: {
+                staging: `topolo-${slug}-api-staging`,
+                production: `topolo-${slug}-api-production`
+              }
             }
-          }
-        ]
-      }
-    } : {}
-  };
+          ]
+        }
+      } : {}
+    };
+  }
   const actions = options.api ? baselineApiActions() : [];
   return `${json({
     $schema: "./../../topolo-platform/tooling/app-manifest-schema.json",
@@ -8230,6 +8416,12 @@ function topoloAppManifestJson(application, options) {
       }
     },
     targets,
+    capabilityComposition: {
+      registryVersion: options.payload.capabilityComposition.registryVersion,
+      selected: options.payload.capabilityComposition.declarations,
+      artifacts: options.payload.capabilityComposition.artifacts,
+      stagingEvidence: options.payload.capabilityComposition.stagingEvidence
+    },
     registration: {
       ownerType: options.payload.ownerType,
       portfolio: options.payload.portfolio,
@@ -8248,7 +8440,14 @@ function topoloAppManifestJson(application, options) {
       supportEmail: "support@topolo.io",
       auth: {
         callbackPath: "/auth/callback",
-        requestedScopes: options.api ? ["openid", "profile", "email", "organization:read", "entitlements:read", `${application.id}:read`] : ["openid", "profile", "email", "organization:read"]
+        requestedScopes: unique3([
+          "openid",
+          "profile",
+          "email",
+          "organization:read",
+          ...options.payload.capabilityComposition.authScopes,
+          ...options.api ? [`${application.id}:read`] : []
+        ])
       },
       capabilities: options.payload.capabilities,
       marketplace: {
@@ -8260,7 +8459,7 @@ function topoloAppManifestJson(application, options) {
         docsUrl: `https://docs.topolo.app/applications/${slug}`
       }
     },
-    notifications: { role: "consumer_only" },
+    notifications: options.payload.capabilities.includes("notification_producer") ? { role: "producer", contracts: "topolo.notification-contracts.json" } : options.payload.capabilities.includes("notifications") ? { role: "consumer_only" } : { role: "internal_non_producer" },
     ...actions.length ? { actions } : {}
   })}
 `;
@@ -8352,263 +8551,6 @@ function baselineApiActions() {
     }
   ];
 }
-function cloudcontrolJson(application, options) {
-  const slug = toSlug(application.id);
-  const appPath = firstPartyAppPath(application.appDir, options.audience);
-  const host = application.productionUrl ? new URL(application.productionUrl).host : `${slug}.topolo.app`;
-  const stagingHost = `${slug}.stg.topolo.us`;
-  const serviceSlug = application.serviceSlug ?? `topolo-${slug}`;
-  const resources = resourceConfig(application, options.profile);
-  const resourceBindings = [];
-  if (options.resources.d1) {
-    resourceBindings.push(
-      {
-        resource_type: "d1",
-        binding: resources.d1Binding,
-        environment: "production",
-        account_id: CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.d1ProductionName,
-        resource_id: "provision-after-scaffold",
-        migrations_dir: "migrations"
-      },
-      {
-        resource_type: "d1",
-        binding: resources.d1Binding,
-        environment: "staging",
-        account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.d1StagingName,
-        resource_id: "provision-after-scaffold",
-        migrations_dir: "migrations"
-      },
-      {
-        resource_type: "d1",
-        binding: resources.d1Binding,
-        environment: "development",
-        account_id: DEVELOPMENT_CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.d1DevelopmentName,
-        resource_id: "provision-after-scaffold",
-        migrations_dir: "migrations"
-      }
-    );
-  }
-  if (options.resources.r2) {
-    resourceBindings.push(
-      {
-        resource_type: "r2",
-        binding: resources.r2Binding,
-        environment: "production",
-        account_id: CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.r2ProductionName
-      },
-      {
-        resource_type: "r2",
-        binding: resources.r2Binding,
-        environment: "staging",
-        account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.r2StagingName
-      }
-    );
-  }
-  if (options.resources.queue) {
-    resourceBindings.push(
-      {
-        resource_type: "queue",
-        binding: resources.queueBinding,
-        environment: "production",
-        account_id: CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.queueProductionName
-      },
-      {
-        resource_type: "queue",
-        binding: resources.queueBinding,
-        environment: "staging",
-        account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.queueStagingName
-      }
-    );
-  }
-  if (options.resources.workflow) {
-    resourceBindings.push(
-      {
-        resource_type: "workflow",
-        binding: resources.workflowBinding,
-        environment: "production",
-        account_id: CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.workflowProductionName,
-        class_name: resources.workflowClassName
-      },
-      {
-        resource_type: "workflow",
-        binding: resources.workflowBinding,
-        environment: "staging",
-        account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.workflowStagingName,
-        class_name: resources.workflowClassName
-      }
-    );
-  }
-  if (options.resources.containerProcessing) {
-    resourceBindings.push(
-      {
-        resource_type: "container",
-        environment: "production",
-        account_id: CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.containerProductionName,
-        purpose: "processing"
-      },
-      {
-        resource_type: "container",
-        environment: "staging",
-        account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
-        resource_name: resources.containerStagingName,
-        purpose: "processing"
-      }
-    );
-  }
-  const deployTargets = options.api ? [
-    {
-      kind: "worker",
-      environment: "production",
-      target_name: `topolo-${slug}-api-production`,
-      cloudflare_account_id: CLOUDFLARE_ACCOUNT_ID,
-      config_path: "apps/api/wrangler.toml",
-      workdir: "apps/api",
-      build_command: null,
-      output_dir: null,
-      production_branch: "main",
-      healthcheck_path: "/api/health",
-      domains: [],
-      routes: [],
-      service_slug: serviceSlug
-    },
-    {
-      kind: "worker",
-      environment: "staging",
-      target_name: `topolo-${slug}-staging`,
-      cloudflare_account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
-      config_path: "apps/web/wrangler.toml",
-      workdir: "apps/web",
-      build_command: "cd ../.. && DEPLOY_ENVIRONMENT=staging VITE_TOPOLO_AUTH_URL=https://auth.stg.topolo.us pnpm run build",
-      output_dir: null,
-      production_branch: "staging",
-      healthcheck_path: "/api/health",
-      domains: [stagingHost],
-      routes: [stagingHost],
-      api_url: `https://${stagingHost}`,
-      service_slug: serviceSlug,
-      sdk_app_id: application.id,
-      agent_callable: true
-    },
-    {
-      kind: "worker",
-      environment: "staging",
-      target_name: `topolo-${slug}-api-staging`,
-      cloudflare_account_id: STAGING_CLOUDFLARE_ACCOUNT_ID,
-      config_path: "apps/api/wrangler.toml",
-      workdir: "apps/api",
-      build_command: null,
-      output_dir: null,
-      production_branch: "staging",
-      healthcheck_path: "/api/health",
-      domains: [],
-      routes: [],
-      service_slug: serviceSlug
-    },
-    {
-      kind: "worker",
-      environment: "production",
-      target_name: `topolo-${slug}-production`,
-      cloudflare_account_id: CLOUDFLARE_ACCOUNT_ID,
-      config_path: "apps/web/wrangler.toml",
-      workdir: "apps/web",
-      build_command: "cd ../.. && DEPLOY_ENVIRONMENT=production VITE_TOPOLO_AUTH_URL=https://auth.topolo.app pnpm run build",
-      output_dir: null,
-      production_branch: "main",
-      healthcheck_path: "/api/health",
-      domains: [host],
-      routes: [host],
-      api_url: application.productionUrl,
-      service_slug: serviceSlug,
-      sdk_app_id: application.id,
-      agent_callable: true
-    }
-  ] : [
-    {
-      kind: "worker",
-      environment: "production",
-      target_name: `topolo-${slug}`,
-      cloudflare_account_id: CLOUDFLARE_ACCOUNT_ID,
-      config_path: "wrangler.toml",
-      build_command: "npm run build",
-      output_dir: "dist",
-      production_branch: "main",
-      healthcheck_path: "/",
-      domains: [host],
-      routes: [host],
-      api_url: application.productionUrl,
-      agent_callable: false
-    }
-  ];
-  return `${json({
-    name: `topolo-${slug}`,
-    description: `Canonical documentation for ${toTitle(application.name)} lives in system-apps/TopoloDocs.`,
-    deploy_method: "wrangler",
-    ci_provider: "github_actions",
-    repo_identity: {
-      provider: "github",
-      owner: "Topolo-io",
-      repo: application.appDir,
-      remote_url: `git@github.com:Topolo-io/${application.appDir}.git`,
-      default_branch: "main"
-    },
-    environments: application.productionUrl ? [
-      {
-        name: "production",
-        url: application.productionUrl,
-        branch: "main",
-        status: "unknown"
-      },
-      {
-        name: "staging",
-        url: `https://${stagingHost}`,
-        branch: "main",
-        status: "unknown"
-      }
-    ] : [],
-    deploy_targets: deployTargets,
-    resource_bindings: resourceBindings,
-    ci_workflows: [
-      {
-        provider: "github_actions",
-        workflow_name: "topolo-conformance.yml",
-        path: ".github/workflows/topolo-conformance.yml",
-        branch: null,
-        required: true
-      }
-    ],
-    ci_targets: [
-      {
-        name: "typecheck",
-        command: "pnpm run typecheck",
-        required: true
-      },
-      {
-        name: "test",
-        command: "pnpm run test",
-        required: true
-      },
-      {
-        name: "build",
-        command: "pnpm run build",
-        required: true
-      }
-    ],
-    tags: ["application", "cloudflare", "typescript", ...hasScaffoldResources(options.resources) ? ["resource-backed"] : []],
-    source_paths: [appPath],
-    cloudflare_account_id: CLOUDFLARE_ACCOUNT_ID
-  })}
-`;
-}
 function systemJson(application, options) {
   const slug = toSlug(application.id);
   const suiteLabel = options.audience === "personal" ? "personal" : "platform";
@@ -8893,12 +8835,18 @@ function serviceManifestJson(application, options) {
         description: `Manage ${title} ${resourceLabel} data`,
         resourcePattern: null
       },
-      {
+      ...options.servicePermissions.includes("usage:write") ? [{
         id: `perm_${permissionPrefix}_usage_write`,
         name: "usage:write",
         description: `Record Nexus usage events for ${title}`,
         resourcePattern: null
-      }
+      }] : [],
+      ...options.servicePermissions.includes("events:write") ? [{
+        id: `perm_${permissionPrefix}_events_write`,
+        name: "events:write",
+        description: `Publish governed notification events for ${title}`,
+        resourcePattern: null
+      }] : []
     ],
     apiKeyScopes: [
       {
@@ -8913,12 +8861,18 @@ function serviceManifestJson(application, options) {
         description: `Manage ${title} ${resourceLabel} data`,
         resourcePattern: null
       },
-      {
+      ...options.servicePermissions.includes("usage:write") ? [{
         id: `aks_${permissionPrefix}_usage_write`,
         name: "usage.write",
         description: `Record Nexus usage events for ${title}`,
         resourcePattern: null
-      }
+      }] : [],
+      ...options.servicePermissions.includes("events:write") ? [{
+        id: `aks_${permissionPrefix}_events_write`,
+        name: "events.write",
+        description: `Publish governed notification events for ${title}`,
+        resourcePattern: null
+      }] : []
     ],
     roleBundles: {
       admin: ["workspace:read", "workspace:write"],
@@ -8933,7 +8887,14 @@ function developerManifest(application, options) {
   const callbackPath = "/auth/callback";
   const localCallbackUrl = "http://localhost:5173/auth/callback";
   const productionCallbackUrl = application.productionUrl ? `${application.productionUrl.replace(/\/$/, "")}${callbackPath}` : null;
-  const requestedScopes = options.api ? ["openid", "profile", "email", "organization:read", "entitlements:read", `${application.id}:read`] : ["openid", "profile", "email", "organization:read"];
+  const requestedScopes = unique3([
+    "openid",
+    "profile",
+    "email",
+    "organization:read",
+    ...options.capabilityComposition.authScopes,
+    ...options.api ? [`${application.id}:read`] : []
+  ]);
   return `${json({
     schema: "https://topolo.app/schemas/topolo-app-manifest.v1.json",
     id: application.id,
@@ -8948,17 +8909,9 @@ function developerManifest(application, options) {
     app_id: application.appId,
     capabilities: {
       selected: options.capabilities,
-      supported_v1: [
-        "login",
-        "launcher",
-        "marketplace",
-        "api",
-        "widget",
-        "billing",
-        "nexus_ai",
-        "agent_access",
-        "hosting"
-      ]
+      registry_version: options.capabilityComposition.registryVersion,
+      declarations: options.capabilityComposition.declarations,
+      supported_v1: TOPOLO_APP_CAPABILITY_IDS
     },
     auth: {
       provider: "topolo",
@@ -9020,10 +8973,13 @@ function developerManifest(application, options) {
         docsUrl: application.productionUrl || "https://developers.topolo.app"
       }
     },
-    notifications: { role: "consumer_only" }
+    notifications: options.capabilities.includes("notification_producer") ? { role: "producer", contracts: "topolo.notification-contracts.json" } : options.capabilities.includes("notifications") ? { role: "consumer_only" } : { role: "internal_non_producer" }
   })}
 `;
 }
+function unique3(values) {
+  return Array.from(new Set(values));
+}
 function envExample(application) {
   return [
     "VITE_TOPOLO_AUTH_URL=https://auth.topolo.app",
@@ -9287,12 +9243,24 @@ function applicationScaffoldPayload(application, options = {}) {
   const surfaceModel = normalizeSurfaceModel(options.surfaceModel);
   const containerAppId = normalizeContainerAppId(options.containerAppId, surfaceModel);
   const profile = normalizeScaffoldProfile(options.profile);
-  const resources = resolveScaffoldResources(profile, options);
-  if (target === "platform" && api && !profile) {
-    resources.d1 = true;
-  }
   const ownerType = target === "platform" ? "topolo_first_party" : "third_party";
   const distributionModel = target === "platform" ? "marketplace" : "organization_internal";
+  const capabilityComposition = resolveApplicationCapabilities({
+    target,
+    browser,
+    api,
+    mobile: surfaceModel === "mobile_container" || surfaceModel === "mobile_module",
+    distributionModel,
+    requested: options.capabilities,
+    profile
+  });
+  const resources = {
+    d1: capabilityComposition.resources.includes("d1"),
+    r2: capabilityComposition.resources.includes("r2"),
+    queue: capabilityComposition.resources.includes("queue"),
+    workflow: capabilityComposition.resources.includes("workflow"),
+    containerProcessing: profile === "spatial-assets"
+  };
   const requestedAppDir = options.appDir ?? catalogApplication?.appDir ?? (target === "platform" ? `Topolo${toPascalCase(id)}` : `topolo-${slug}`);
   const appDir = target === "platform" ? normalizeFirstPartyAppDir(requestedAppDir) : requestedAppDir;
   const name = options.name ?? catalogApplication?.name ?? `topolo-${slug}`;
@@ -9312,7 +9280,7 @@ function applicationScaffoldPayload(application, options = {}) {
   const appId = options.appId ?? defaultAppId;
   const productionUrl = browser ? options.productionUrl ?? catalogApplication?.productionUrl ?? `https://${slug}.topolo.app` : null;
   const scopes = scaffoldScopes({ browser, api });
-  const capabilities = scaffoldCapabilities({ browser, api, distributionModel });
+  const capabilities = capabilityComposition.selected;
   const ciWorkflowPath = target === "platform" ? ".github/workflows/topolo-conformance.yml" : null;
   const ciWorkflow = target === "platform" ? topoloConformanceWorkflow({ id, appDir, audience }) : null;
   const applicationPayload = {
@@ -9338,12 +9306,13 @@ function applicationScaffoldPayload(application, options = {}) {
     experience,
     distributionModel,
     capabilities,
+    capabilityComposition,
     application: applicationPayload,
     scopes,
     requirements: APPLICATION_REQUIREMENTS.filter(
       (requirement) => requirement.appliesTo.some((scope) => scopes.includes(scope))
     ),
-    packages: scaffoldPackages({ browser, api, target }),
+    packages: capabilityComposition.packages,
     files: scaffoldFiles({
       payload: {
         ownerType,
@@ -9356,7 +9325,8 @@ function applicationScaffoldPayload(application, options = {}) {
         resources,
         experience,
         distributionModel,
-        capabilities
+        capabilities,
+        capabilityComposition
       },
       application: applicationPayload,
       target,
@@ -9417,28 +9387,6 @@ function scaffoldScopes(options) {
   }
   return scopes;
 }
-function scaffoldPackages(options) {
-  if (options.target === "developer") {
-    return options.browser ? ["@topolo/login"] : [];
-  }
-  const packages = /* @__PURE__ */ new Set();
-  if (options.browser) {
-    for (const packageName of PLATFORM_BROWSER_TOPOLO_PACKAGES) packages.add(packageName);
-  }
-  if (options.api) {
-    for (const packageName of PLATFORM_API_TOPOLO_PACKAGES) packages.add(packageName);
-  }
-  return Array.from(packages);
-}
-function scaffoldCapabilities(options) {
-  const capabilities = [];
-  if (options.browser) {
-    capabilities.push("login", "launcher");
-  }
-  if (options.distributionModel === "marketplace") capabilities.push("marketplace");
-  if (options.api) capabilities.push("api", "widget");
-  return capabilities;
-}
 function scaffoldFiles(options) {
   const { application, target } = options;
   const slug = toSlug(application.id);
@@ -9478,9 +9426,31 @@ function scaffoldFiles(options) {
       content: packageJson(application, target, {
         browser: options.browser,
         api: options.api,
-        resources: options.payload.resources
+        resources: options.payload.resources,
+        packages: options.payload.capabilityComposition.packages
       })
     },
+    {
+      path: `${base}/topolo.capability-contract.json`,
+      purpose: "Resolved application-factory contract for packages, permissions, resources, artifacts, and staging proof.",
+      requiredSignals: [
+        "registry version matches topolo.app.json capability composition",
+        "every selected capability names its canonical owner and verification contract"
+      ],
+      content: `${json(capabilityContractProjection(options.payload.capabilityComposition))}
+`
+    },
+    ...options.payload.capabilities.includes("billing") ? [{
+      path: `${base}/pricing-manifest.json`,
+      purpose: "Canonical TopoloPay/Nexus pricing and meter registration manifest.",
+      requiredSignals: ["contains a valid default plan", "remains the source for app-specific plan and meter design"],
+      content: `${json(defaultPricingManifest({
+        appId: application.appId ?? "",
+        displayName: toTitle(application.name),
+        description: options.payload.experience.tagline
+      }))}
+`
+    }] : [],
     {
       path: `${base}/README.md`,
       purpose: "Starter README with install, run, and verification commands.",
@@ -9686,6 +9656,7 @@ function scaffoldFiles(options) {
         ],
         content: topoloAppManifestJson(application, {
           api: options.api,
+          browser: options.browser,
           resources: options.payload.resources,
           profile: options.payload.profile,
           payload: options.payload
@@ -9711,20 +9682,6 @@ function scaffoldFiles(options) {
           content: topoloActionContractsDmts()
         }
       ] : [],
-      {
-        path: `${base}/topolo.cloudcontrol.json`,
-        purpose: "CloudControl source of truth for deploy targets, routes, bindings, and CI metadata.",
-        requiredSignals: [
-          "production URLs and Cloudflare targets are explicit",
-          "resource bindings and required secrets are declared without secret values"
-        ],
-        content: cloudcontrolJson(application, {
-          api: options.api,
-          audience: options.payload.audience,
-          profile: options.payload.profile,
-          resources: options.payload.resources
-        })
-      },
       {
         path: `${base}/.github/workflows/topolo-conformance.yml`,
         purpose: "PR/push gate that runs the local Topolo app audit with docs evidence.",
@@ -9825,7 +9782,8 @@ function scaffoldFiles(options) {
           ],
           content: serviceManifestJson(application, {
             audience: options.payload.audience,
-            tenancy: options.payload.tenancy
+            tenancy: options.payload.tenancy,
+            servicePermissions: options.payload.capabilityComposition.servicePermissions
           })
         }
       );
@@ -9846,7 +9804,8 @@ function scaffoldFiles(options) {
           surfaceModel: options.payload.surfaceModel,
           containerAppId: options.payload.containerAppId,
           distributionModel: options.payload.distributionModel,
-          capabilities: options.payload.capabilities
+          capabilities: options.payload.capabilities,
+          capabilityComposition: options.payload.capabilityComposition
         })
       },
       {
@@ -9933,31 +9892,23 @@ export default defineConfig({
               "only declares an API service binding for API-backed scaffolds"
             ],
             content: webWorkerTs(application, options.api)
-          },
-          {
-            path: `${browserBase}/wrangler.toml`,
-            purpose: "Cloudflare Worker static-assets configuration for the browser surface.",
-            requiredSignals: [
-              "serves Vite assets through a Worker with assets",
-              "only binds an API Worker when the scaffold includes one"
-            ],
-            content: platformWebWranglerToml(application, options.api)
           }
         );
       }
     }
   }
   if (options.api) {
+    const capabilityAdapter = target === "platform" ? managedCapabilityAdapter(options.payload.capabilities) : null;
     files.push(
-      {
+      ...target === "platform" ? [] : [{
         path: `${apiBase}/wrangler.toml`,
         purpose: "Cloudflare Worker runtime configuration.",
         requiredSignals: [
-          "bindings match topolo.cloudcontrol.json or topolo.app.json",
+          "bindings match the declared resources",
           "secrets are referenced by name only"
         ],
-        content: target === "platform" ? platformApiWranglerToml(application, options.payload.resources, options.payload.profile) : wranglerToml(application, target, options.payload.resources, options.payload.profile)
-      },
+        content: wranglerToml(application, target, options.payload.resources, options.payload.profile)
+      }],
       {
         path: `${apiBase}/src/worker.ts`,
         purpose: "Protected service boundary.",
@@ -9972,7 +9923,13 @@ export default defineConfig({
           profile: options.payload.profile,
           resources: options.payload.resources
         })
-      }
+      },
+      ...capabilityAdapter ? [{
+        path: `${apiBase}/src/topolo-capabilities.ts`,
+        purpose: "Managed adapters for selected Topolo notification, Nexus, AI, integration, and webhook capabilities.",
+        requiredSignals: ["uses verified organization context", "uses environment-scoped gateways and keyless service identity", "verifies webhook signatures over the raw body"],
+        content: capabilityAdapter
+      }] : []
     );
     if (target === "platform") {
       files.push(
@@ -10025,6 +9982,9 @@ export default defineConfig({
       }
     }
   }
+  if (target === "platform") {
+    files.push(...deriveGeneratedConfigs(files, base));
+  }
   return files;
 }
 
@@ -10173,7 +10133,14 @@ function buildProvisioningRequest(payload, supportEmail) {
       "http://localhost:5173/auth/callback",
       payload.application.productionUrl ? `${payload.application.productionUrl.replace(/\/$/, "")}/auth/callback` : null
     ].filter(Boolean),
-    requestedScopes: payload.application.appId ? ["openid", "profile", "email", "organization:read", "entitlements:read", `${payload.application.id}:read`] : ["openid", "profile", "email", "organization:read"],
+    requestedScopes: Array.from(/* @__PURE__ */ new Set([
+      "openid",
+      "profile",
+      "email",
+      "organization:read",
+      ...payload.capabilityComposition.authScopes,
+      ...payload.application.appId ? [`${payload.application.id}:read`] : []
+    ])),
     marketplace: {
       intent: payload.distributionModel === "marketplace" ? "submit_when_ready" : "not_requested",
       status: "preview",
@@ -10182,7 +10149,7 @@ function buildProvisioningRequest(payload, supportEmail) {
       description: payload.experience.tagline,
       docsUrl: payload.application.productionUrl || "https://developers.topolo.app"
     },
-    notifications: { role: "consumer_only" },
+    notifications: payload.capabilities.includes("notification_producer") ? { role: "producer", contracts: "topolo.notification-contracts.json" } : payload.capabilities.includes("notifications") ? { role: "consumer_only" } : { role: "internal_non_producer" },
     applicationId: payload.application.id,
     name: payload.application.name,
     description: payload.experience.tagline,
@@ -10250,18 +10217,18 @@ async function applyProvisionedAppId(manifestPath, appId) {
   } catch {
     return { changed: false, previous: null };
   }
-  let json3;
+  let json2;
   try {
-    json3 = JSON.parse(raw);
+    json2 = JSON.parse(raw);
   } catch {
     return { changed: false, previous: null };
   }
-  const previous = typeof json3.appId === "string" ? json3.appId : null;
+  const previous = typeof json2.appId === "string" ? json2.appId : null;
   if (previous === appId) {
     return { changed: false, previous };
   }
-  json3.appId = appId;
-  await writeFile3(manifestPath, `${JSON.stringify(json3, null, 2)}
+  json2.appId = appId;
+  await writeFile3(manifestPath, `${JSON.stringify(json2, null, 2)}
 `, "utf8");
   return { changed: true, previous };
 }
@@ -10270,13 +10237,280 @@ async function applyProvisionedAppId(manifestPath, appId) {
 import { join as join3 } from "path";
 
 // src/commands/app-reconcile.ts
-import { readFile as readFile3, writeFile as writeFile4 } from "fs/promises";
-import path2 from "path";
+import { readFile as readFile4, writeFile as writeFile5 } from "fs/promises";
+import path4 from "path";
 import { createInterface as createInterface2 } from "readline/promises";
 import { stdin as input2, stdout as output } from "process";
+
+// src/commands/app-capability-composition.ts
+import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile4 } from "fs/promises";
+import path3 from "path";
+async function reconcileApplicationCapabilitySource(options) {
+  const manifestPath = path3.resolve(options.manifestPath || "topolo.app.json");
+  const root = path3.dirname(manifestPath);
+  const packagePath = path3.join(root, "package.json");
+  const contractPath = path3.join(root, "topolo.capability-contract.json");
+  const manifest = parseRecord(await readFile3(manifestPath, "utf8"), manifestPath);
+  const registration = record(manifest.registration);
+  if (!registration) throw new Error("topolo.app.json must declare registration before capability composition.");
+  if (registration.ownerType !== options.ownerType) {
+    throw new Error(`${String(registration.ownerType)} capabilities cannot be composed through the ${options.ownerType} command surface.`);
+  }
+  const target = options.ownerType === "topolo_first_party" ? "platform" : "developer";
+  const surfaces = resolveManifestSurfaces(manifest, registration);
+  const existing = Array.isArray(registration.capabilities) ? registration.capabilities.filter((value) => typeof value === "string") : [];
+  const capabilities = resolveApplicationCapabilities({
+    target,
+    browser: surfaces.browser,
+    api: surfaces.api,
+    mobile: surfaces.mobile,
+    distributionModel: registration.distributionModel === "marketplace" ? "marketplace" : "organization_internal",
+    requested: [...existing, ...options.additions ?? []]
+  });
+  const expectedComposition = capabilityCompositionProjection(capabilities);
+  const expectedNotifications = capabilities.selected.includes("notification_producer") ? { role: "producer", contracts: "topolo.notification-contracts.json" } : capabilities.selected.includes("notifications") ? { role: "consumer_only" } : { role: "internal_non_producer" };
+  const changes = [];
+  compareChange(changes, "topolo.app.json#capabilityComposition", manifest.capabilityComposition, expectedComposition);
+  compareChange(changes, "topolo.app.json#registration.capabilities", registration.capabilities, capabilities.selected);
+  compareChange(changes, "topolo.app.json#notifications", manifest.notifications, expectedNotifications);
+  const packageJson2 = parseRecord(await readFile3(packagePath, "utf8"), packagePath);
+  const dependencies = record(packageJson2.dependencies) ?? {};
+  const nextDependencies = { ...dependencies };
+  for (const packageName of capabilities.packages) {
+    if (typeof nextDependencies[packageName] !== "string") {
+      nextDependencies[packageName] = packageVersion(packageName, target);
+    }
+  }
+  const sortedDependencies = sortRecord(nextDependencies);
+  compareChange(changes, "package.json#dependencies", dependencies, sortedDependencies);
+  const expectedContract = capabilityContractProjection(capabilities);
+  const existingContract = await readOptionalJson(contractPath);
+  compareChange(changes, "topolo.capability-contract.json", existingContract, expectedContract);
+  const adapter = target === "platform" ? managedCapabilityAdapter(capabilities.selected) : null;
+  const apiDirectory = resolveApiDirectory(root, manifest, target);
+  const adapterPath = path3.join(apiDirectory, "src", "topolo-capabilities.ts");
+  if (adapter) compareChange(changes, relativePath(root, adapterPath), await readOptionalText(adapterPath), adapter);
+  const pricingPath = path3.join(root, "pricing-manifest.json");
+  const pricingManifest = capabilities.selected.includes("billing") ? defaultPricingManifest({
+    appId: String(manifest.appId || manifest.app_id || "").trim(),
+    displayName: String(registration.displayName || manifest.name || "Application"),
+    description: String(registration.description || `${String(registration.displayName || manifest.name || "Application")} on Topolo.`)
+  }) : null;
+  if (pricingManifest) {
+    compareChange(changes, "pricing-manifest.json", await readOptionalJson(pricingPath), pricingManifest);
+  }
+  const missingResources = capabilities.resources.filter((resource) => !manifestProvidesResource(manifest, resource));
+  const verticalConfiguration = [];
+  for (const [capability2, fileName, description] of VERTICAL_CAPABILITY_FILES) {
+    if (capabilities.selected.includes(capability2) && !await fileExists(path3.join(root, fileName))) {
+      verticalConfiguration.push(`${fileName}: ${description}`);
+    }
+  }
+  if (options.mode === "apply" && changes.length > 0) {
+    manifest.capabilityComposition = expectedComposition;
+    registration.capabilities = capabilities.selected;
+    manifest.registration = registration;
+    manifest.notifications = expectedNotifications;
+    packageJson2.dependencies = sortedDependencies;
+    await writeJson(manifestPath, manifest);
+    await writeJson(packagePath, packageJson2);
+    await writeJson(contractPath, expectedContract);
+    if (pricingManifest) await writeJson(pricingPath, pricingManifest);
+    if (adapter) {
+      await mkdir3(path3.dirname(adapterPath), { recursive: true });
+      await writeFile4(adapterPath, adapter, "utf8");
+    }
+  }
+  const blocked = missingResources.length > 0 || verticalConfiguration.length > 0;
+  return {
+    mode: options.mode,
+    applied: options.mode === "apply" && changes.length > 0,
+    status: blocked ? "blocked" : options.mode === "apply" || changes.length === 0 ? "in_sync" : "drift",
+    manifestPath,
+    packagePath,
+    contractPath,
+    capabilities,
+    changes,
+    missingResources,
+    verticalConfiguration
+  };
+}
+function registerApplicationCapabilityCommands(parent, ownerType) {
+  parent.command("add-capability <capabilities...>").description("Compose approved shared capabilities into an existing application source tree.").option("--manifest <path>", "Path to topolo.app.json", "topolo.app.json").option("--check", "Report source changes without writing").option("--apply", "Write canonical manifest, package, and managed capability artifacts").option("--json", "Output JSON").option("--no-json", "Output human-readable details").action(async (capabilities, options) => {
+    const outputMode = resolveOutputMode(options.json);
+    try {
+      if (options.check && options.apply) throw new Error("Choose exactly one of --check or --apply.");
+      const result = await reconcileApplicationCapabilitySource({
+        manifestPath: options.manifest,
+        ownerType,
+        mode: options.apply ? "apply" : "check",
+        additions: capabilities
+      });
+      emit(result, outputMode, () => formatCapabilitySource(result));
+      if (result.status !== "in_sync" && !options.apply) process.exitCode = 2;
+      if (result.status === "blocked") process.exitCode = 2;
+    } catch (error) {
+      fail(error, outputMode);
+    }
+  });
+  parent.command("doctor").description("Check declared capabilities against packages, resources, managed artifacts, and vertical insertion points.").option("--manifest <path>", "Path to topolo.app.json", "topolo.app.json").option("--json", "Output JSON").option("--no-json", "Output human-readable details").action(async (options) => {
+    const outputMode = resolveOutputMode(options.json);
+    try {
+      const result = await reconcileApplicationCapabilitySource({ manifestPath: options.manifest, ownerType, mode: "check" });
+      emit(result, outputMode, () => formatCapabilitySource(result));
+      if (result.status !== "in_sync") process.exitCode = 2;
+    } catch (error) {
+      fail(error, outputMode);
+    }
+  });
+  parent.command("upgrade").description("Upgrade an application to the current capability registry without changing its selected product capabilities.").option("--manifest <path>", "Path to topolo.app.json", "topolo.app.json").option("--check", "Report source changes without writing").option("--apply", "Apply the registry upgrade").option("--json", "Output JSON").option("--no-json", "Output human-readable details").action(async (options) => {
+    const outputMode = resolveOutputMode(options.json);
+    try {
+      if (options.check && options.apply) throw new Error("Choose exactly one of --check or --apply.");
+      const result = await reconcileApplicationCapabilitySource({
+        manifestPath: options.manifest,
+        ownerType,
+        mode: options.apply ? "apply" : "check"
+      });
+      emit(result, outputMode, () => formatCapabilitySource(result));
+      if (result.status !== "in_sync" && !options.apply) process.exitCode = 2;
+      if (result.status === "blocked") process.exitCode = 2;
+    } catch (error) {
+      fail(error, outputMode);
+    }
+  });
+}
+function formatCapabilitySource(result) {
+  const lines = [
+    `Capability source: ${result.status}`,
+    `Registry: ${result.capabilities.registryVersion}`,
+    `Selected: ${result.capabilities.selected.join(", ")}`
+  ];
+  for (const change of result.changes) lines.push(`- ${change.path}`);
+  if (result.missingResources.length > 0) lines.push(`Missing provisioned resources: ${result.missingResources.join(", ")}`);
+  for (const item of result.verticalConfiguration) lines.push(`Vertical configuration required: ${item}`);
+  return lines.join("\n");
+}
+function resolveManifestSurfaces(manifest, registration) {
+  const targets = record(manifest.targets) ?? {};
+  const targetRecords = Object.values(targets).map(record).filter((value) => Boolean(value));
+  const runtime = record(manifest.runtime);
+  return {
+    browser: targetRecords.some((target) => Boolean(target.assets) || target.dir === "apps/web" || target.kind === "web") || runtime?.browser === true,
+    api: targetRecords.some((target) => target.dir === "apps/api" || target.kind === "worker" && !target.assets) || runtime?.api === true,
+    mobile: registration.surfaceModel === "mobile_container" || registration.surfaceModel === "mobile_module"
+  };
+}
+function manifestProvidesResource(manifest, resource) {
+  const targets = record(manifest.targets) ?? {};
+  for (const value of Object.values(targets)) {
+    const target = record(value);
+    const bindings = record(target?.bindings);
+    if (!bindings) continue;
+    if (resource === "d1" && Array.isArray(bindings.d1) && bindings.d1.length > 0) {
+      return bindings.d1.every((value2) => {
+        const binding = record(value2);
+        const configurations = ["development", "staging", "production"].map((environment) => record(binding?.[environment])).filter((configuration) => Boolean(configuration));
+        return configurations.length > 0 && configurations.every((configuration) => typeof configuration.databaseId === "string" && configuration.databaseId.length > 0 && configuration.databaseId !== "provision-after-scaffold");
+      });
+    }
+    if (resource === "r2" && Array.isArray(bindings.r2) && bindings.r2.length > 0) return true;
+    if (resource === "queue" && record(bindings.queues)) return true;
+    if (resource === "workflow" && Array.isArray(bindings.workflows) && bindings.workflows.length > 0) return true;
+  }
+  return false;
+}
+function packageVersion(packageName, target) {
+  if (target === "platform") return "latest";
+  if (packageName === "@topolo/login") return "^0.1.0";
+  if (packageName === "@topolo/sdk") return "^0.8.1";
+  throw new Error(`Capability registry exposed private package ${packageName} to a third-party application.`);
+}
+function compareChange(changes, changePath, before, after) {
+  if (stableJson(before) !== stableJson(after)) changes.push({ path: changePath, before, after });
+}
 function record(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
+function parseRecord(raw, filePath) {
+  const value = JSON.parse(raw);
+  const parsed = record(value);
+  if (!parsed) throw new Error(`${filePath} must contain a JSON object.`);
+  return parsed;
+}
+async function readOptionalJson(filePath) {
+  try {
+    return JSON.parse(await readFile3(filePath, "utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+async function readOptionalText(filePath) {
+  try {
+    return await readFile3(filePath, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+async function fileExists(filePath) {
+  try {
+    await readFile3(filePath);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+}
+async function writeJson(filePath, value) {
+  await writeFile4(filePath, `${JSON.stringify(value, null, 2)}
+`, "utf8");
+}
+function sortRecord(value) {
+  return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right)));
+}
+function stableJson(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableJson(item)}`).join(",")}}`;
+  }
+  return JSON.stringify(value) ?? "undefined";
+}
+var VERTICAL_CAPABILITY_FILES = [
+  ["notification_producer", "topolo.notification-contracts.json", "define app-owned events and recipient policies"],
+  ["metering", "topolo.metering.json", "define app-owned meters and attribution semantics"],
+  ["nexus_ai", "topolo.ai.json", "define AI use cases, budget behavior, and model policy"],
+  ["integrations", "topolo.integrations.json", "define the external providers and connection purposes this app uses"],
+  ["webhooks", "topolo.webhooks.json", "define signed event routes, replay policy, and delivery ownership"],
+  ["automation", "topolo.automation.json", "define app-owned triggers and TopoloFlow actions"],
+  ["data", "topolo.data.json", "define the workspace data model and migration ownership"],
+  ["object_storage", "topolo.object-storage.json", "define object lifecycle, access, and deletion policy"],
+  ["background_jobs", "topolo.jobs.json", "define accepted job types, retry policy, and idempotency"],
+  ["durable_workflows", "topolo.workflows.json", "define workflow inputs, steps, and recovery semantics"],
+  ["privacy", "topolo.privacy.json", "define app-owned retention, export, and deletion adapters"],
+  ["chat", "topolo.chat.json", "define where the shared chat surface appears in this product"],
+  ["calendar", "topolo.calendar.json", "define the app-owned scheduling surface and resource mapping"],
+  ["mailbox", "topolo.mailbox.json", "define the app-owned mailbox surface and message context"]
+];
+function resolveApiDirectory(root, manifest, target) {
+  if (target === "developer") return root;
+  for (const value of Object.values(record(manifest.targets) ?? {})) {
+    const targetRecord = record(value);
+    if (targetRecord?.kind === "worker" && !targetRecord.assets && typeof targetRecord.dir === "string") {
+      return path3.resolve(root, targetRecord.dir);
+    }
+  }
+  return path3.join(root, "apps", "api");
+}
+function relativePath(root, filePath) {
+  return path3.relative(root, filePath).split(path3.sep).join("/");
+}
+
+// src/commands/app-reconcile.ts
+function record2(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
 function environmentValue(value, environment) {
   if (typeof value === "string") return value;
   if (!value) return null;
@@ -10301,7 +10535,7 @@ function resolveManifestApplicationUrl(manifest, environment) {
   return `https://${target.subdomain}.${domain}`;
 }
 function assertRegistration(value) {
-  const registration = record(value);
+  const registration = record2(value);
   const required = [
     "ownerType",
     "applicationId",
@@ -10330,9 +10564,9 @@ function titleFromSlug(value) {
   return value.replace(/^topolo[-_]/, "").split(/[-_]+/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
 }
 async function completeApplicationRegistrationInteractively(options) {
-  const manifestPath = path2.resolve(options.manifestPath || "topolo.app.json");
-  const manifest = JSON.parse(await readFile3(manifestPath, "utf8"));
-  const existing = record(manifest.registration) || {};
+  const manifestPath = path4.resolve(options.manifestPath || "topolo.app.json");
+  const manifest = JSON.parse(await readFile4(manifestPath, "utf8"));
+  const existing = record2(manifest.registration) || {};
   const appId = String(manifest.appId || manifest.app_id || "").trim();
   const slug = String(existing.serviceSlug || manifest.name || "").trim();
   const defaultName = titleFromSlug(slug);
@@ -10366,19 +10600,19 @@ async function completeApplicationRegistrationInteractively(options) {
       containerAppId: existing.containerAppId,
       distributionModel: existing.distributionModel || (options.expectedOwnerType === "topolo_first_party" ? "marketplace" : "organization_internal"),
       version: String(existing.version || "1.0.0"),
-      pricing: record(existing.pricing) || { type: "free", monthlyPrice: null },
+      pricing: record2(existing.pricing) || { type: "free", monthlyPrice: null },
       supportEmail,
       productionUrl,
       demoUrl: typeof existing.demoUrl === "string" ? existing.demoUrl : void 0,
       repoUrl: typeof existing.repoUrl === "string" ? existing.repoUrl : void 0,
       tags: Array.isArray(existing.tags) ? existing.tags : [],
       screenshots: Array.isArray(existing.screenshots) ? existing.screenshots : [],
-      auth: record(existing.auth) || {
+      auth: record2(existing.auth) || {
         callbackPath: "/auth/callback",
         requestedScopes: ["openid", "profile", "email", "organization:read"]
       },
       capabilities: Array.isArray(existing.capabilities) ? existing.capabilities : ["login", "launcher"],
-      marketplace: record(existing.marketplace) || {
+      marketplace: record2(existing.marketplace) || {
         intent: options.expectedOwnerType === "topolo_first_party" ? "submit_when_ready" : "not_requested",
         status: "preview",
         shortBlurb: description,
@@ -10402,7 +10636,7 @@ async function completeApplicationRegistrationInteractively(options) {
       changed = true;
     }
     if (!appId) throw new Error("topolo.app.json must declare the immutable appId before reconciliation.");
-    if (changed) await writeFile4(manifestPath, `${JSON.stringify(manifest, null, 2)}
+    if (changed) await writeFile5(manifestPath, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
     return { changed, manifestPath };
   } finally {
@@ -10410,8 +10644,8 @@ async function completeApplicationRegistrationInteractively(options) {
   }
 }
 async function loadApplicationReconcileRequest(options) {
-  const manifestPath = path2.resolve(options.manifestPath || "topolo.app.json");
-  const raw = await readFile3(manifestPath, "utf8");
+  const manifestPath = path4.resolve(options.manifestPath || "topolo.app.json");
+  const raw = await readFile4(manifestPath, "utf8");
   const manifest = JSON.parse(raw);
   assertRegistration(manifest.registration);
   const registration = manifest.registration;
@@ -10555,6 +10789,7 @@ function registerApplicationReconcileCommand(parent, ownerType, dependencies = {
   const loadRequest = dependencies.loadRequest || loadApplicationReconcileRequest;
   const reconcileRequest = dependencies.reconcileRequest || reconcileApplicationRequest;
   const confirm = dependencies.confirm || confirmApplicationReconcile;
+  const reconcileSource = dependencies.reconcileSource || reconcileApplicationCapabilitySource;
   parent.command("reconcile").description("Check or apply the declarative application registration in topolo.app.json.").option("--manifest <path>", "Path to topolo.app.json", "topolo.app.json").option("--check", "Report drift without mutating remote data").option("--dry-run", "Alias for --check").option("--apply", "Apply mutable drift and required projections").option("--interactive", "Use the human confirmation flow").option("--non-interactive", "Disable all prompts").option("--yes", "Accept the interactive apply confirmation").option("--json", "Output JSON").option("--no-json", "Output human-readable details").action(async (options) => {
     const outputMode = resolveOutputMode(options.json);
     try {
@@ -10565,6 +10800,20 @@ function registerApplicationReconcileCommand(parent, ownerType, dependencies = {
           expectedOwnerType: ownerType
         });
       }
+      const source = await reconcileSource({
+        manifestPath: options.manifest,
+        ownerType,
+        mode: selection.mode
+      });
+      if (selection.mode === "apply" && source.status === "blocked") {
+        emit(
+          { manifest: source.manifestPath, source, reconciliation: null },
+          outputMode,
+          () => formatCapabilitySource(source)
+        );
+        process.exitCode = 2;
+        return;
+      }
       const loaded = await loadRequest({
         manifestPath: options.manifest,
         expectedOwnerType: ownerType,
@@ -10582,11 +10831,11 @@ function registerApplicationReconcileCommand(parent, ownerType, dependencies = {
         }
       }
       emit(
-        { manifest: loaded.manifestPath, reconciliation: result },
+        { manifest: loaded.manifestPath, source, reconciliation: result },
         outputMode,
         () => formatApplicationReconcile(result, loaded.manifestPath)
       );
-      if (result.mode === "check" && result.plan.status !== "in_sync") process.exitCode = 2;
+      if (source.status === "blocked" || result.mode === "check" && (result.plan.status !== "in_sync" || source.status !== "in_sync")) process.exitCode = 2;
     } catch (error) {
       fail(error, outputMode);
     }
@@ -10624,6 +10873,7 @@ function registerAppsCommand(program2) {
     }
   });
   registerApplicationReconcileCommand(apps, "third_party");
+  registerApplicationCapabilityCommands(apps, "third_party");
   apps.command("get <application>").description("Show one Topolo application available to the current credential.").option("--json", "Output JSON", true).option("--no-json", "Output human-readable details").action(async (application, opts) => {
     const mode = resolveOutputMode(opts.json);
     try {
@@ -10693,7 +10943,7 @@ function registerAppsCommand(program2) {
   ).option("--json", "Output JSON").option("--no-json", "Output human-readable checklist").option("--app-dir <path>", "Application directory under the scaffold root").option("--name <name>", "Application display/package source name").option("--package-name <name>", "package.json name").option("--production-url <url>", "Production browser URL").option("--app-id <id>", "Stable SDK/Auth app id for API-backed apps").option("--audience <audience>", "Developer app audience: business or personal").option("--tenancy <tenancy>", "Developer app tenancy: organization or household").option(
     "--surface-model <surfaceModel>",
     "Developer app surface model: web_app, mobile_container, mobile_module, or messaging_surface"
-  ).option("--container-app-id <appId>", "Container app id when --surface-model mobile_module is used").option("--write", "Write the generated scaffold files to disk").option("--repo-root <path>", "Directory where scaffold files should be written").option("--force", "Overwrite existing scaffold files when --write is set").option("--with-api", "Include API/service files for developer scaffolds").option("--no-api", "Do not include API/service requirements").option("--no-browser", "Do not include browser-shell requirements").option(
+  ).option("--container-app-id <appId>", "Container app id when --surface-model mobile_module is used").option("--capability <id...>", "Compose one or more approved Topolo capabilities").option("--write", "Write the generated scaffold files to disk").option("--repo-root <path>", "Directory where scaffold files should be written").option("--force", "Overwrite existing scaffold files when --write is set").option("--with-api", "Include API/service files for developer scaffolds").option("--no-api", "Do not include API/service requirements").option("--no-browser", "Do not include browser-shell requirements").option(
     "--provision",
     "Register the app in the current Topolo developer workspace using the authenticated session"
   ).action(async (application, opts) => {
@@ -10712,7 +10962,8 @@ function registerAppsCommand(program2) {
         audience: resolveScaffoldAudience(opts.audience),
         tenancy: resolveScaffoldTenancy(opts.tenancy),
         surfaceModel: resolveScaffoldSurfaceModel(opts.surfaceModel),
-        containerAppId: opts.containerAppId
+        containerAppId: opts.containerAppId,
+        capabilities: opts.capability
       });
       const writeResult = opts.write ? await writeApplicationScaffold(payload, { repoRoot: opts.repoRoot, force: opts.force }) : null;
       const provisionResult = opts.provision ? await provisionApplicationScaffold(payload) : null;
@@ -10796,8 +11047,8 @@ function applicationAuditPayload(application, options = {}) {
 }
 function recordApplicationEvidence(application, options = {}) {
   const appId = resolveApplication(application).id;
-  const root = path3.resolve(options.appRoot ?? process.cwd());
-  if (!existsSync3(root)) {
+  const root = path5.resolve(options.appRoot ?? process.cwd());
+  if (!existsSync4(root)) {
     throw new Error(`Application root does not exist: ${root}`);
   }
   let commit = options.commit;
@@ -10808,12 +11059,12 @@ function recordApplicationEvidence(application, options = {}) {
       commit = void 0;
     }
   }
-  const evidenceDir = path3.join(root, ".topolo");
-  const evidencePath = path3.join(evidenceDir, "evidence.json");
+  const evidenceDir = path5.join(root, ".topolo");
+  const evidencePath = path5.join(evidenceDir, "evidence.json");
   let before = null;
-  if (existsSync3(evidencePath)) {
+  if (existsSync4(evidencePath)) {
     try {
-      const raw = JSON.parse(readFileSync4(evidencePath, "utf8"));
+      const raw = JSON.parse(readFileSync5(evidencePath, "utf8"));
       if (raw && typeof raw === "object" && raw.version === 1) {
         before = raw;
       }
@@ -10851,8 +11102,8 @@ function recordApplicationEvidence(application, options = {}) {
       "record-evidence: pass at least one of --build, --typecheck, --test, --docs-validate, --smoke <url>"
     );
   }
-  mkdirSync(evidenceDir, { recursive: true });
-  writeFileSync(evidencePath, JSON.stringify(after, null, 2) + "\n");
+  mkdirSync2(evidenceDir, { recursive: true });
+  writeFileSync2(evidencePath, JSON.stringify(after, null, 2) + "\n");
   return { appId, evidencePath, before, after, updatedFields };
 }
 function formatEvidence(result) {
@@ -11108,18 +11359,182 @@ function statusesAtOrWorse(threshold) {
 }
 
 // src/commands/platform.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync5, statSync as statSync2 } from "fs";
-import path4 from "path";
+import { readdirSync as readdirSync2, readFileSync as readFileSync6, statSync as statSync2 } from "fs";
+import path7 from "path";
+
+// src/commands/app-capability-provision.ts
+import { readFile as readFile5, writeFile as writeFile6 } from "fs/promises";
+import path6 from "path";
+async function provisionApplicationResources(options) {
+  const manifestPath = path6.resolve(options.manifestPath || "topolo.app.json");
+  const manifest = parseRecord2(await readFile5(manifestPath, "utf8"), manifestPath);
+  const environments = requiredRecord(manifest.environments, "topolo.app.json#environments");
+  const environment = requiredRecord(environments[options.environment], `topolo.app.json#environments.${options.environment}`);
+  const accountId = requiredString(environment.accountId, `topolo.app.json#environments.${options.environment}.accountId`);
+  const token = options.token ?? process.env.CLOUDFLARE_API_TOKEN;
+  if (!token) throw new Error("CLOUDFLARE_API_TOKEN is required to inspect or provision Cloudflare application resources.");
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const operations = [];
+  let changed = false;
+  for (const target of Object.values(record3(manifest.targets) ?? {})) {
+    const bindings = record3(record3(target)?.bindings);
+    if (!bindings) continue;
+    for (const bindingValue of array(bindings.d1)) {
+      const binding = record3(bindingValue);
+      const config = record3(binding?.[options.environment]);
+      if (!config) continue;
+      const name = requiredString(config.databaseName, `D1 ${options.environment} databaseName`);
+      const databases = await cloudflareList(fetchImpl, token, `/accounts/${accountId}/d1/database?name=${encodeURIComponent(name)}&per_page=10000`);
+      const existing = databases.find((item) => item.name === name);
+      if (existing) {
+        const id = requiredString(existing.uuid ?? existing.id, `D1 database ${name} id`);
+        const mismatched = config.databaseId !== id;
+        operations.push({ kind: "d1", name, status: mismatched && options.mode === "check" ? "mismatch" : "exists", id });
+        if (mismatched && options.mode === "apply") {
+          config.databaseId = id;
+          changed = true;
+        }
+      } else if (options.mode === "apply") {
+        const created = await cloudflareCreate(fetchImpl, token, `/accounts/${accountId}/d1/database`, { name });
+        const id = requiredString(created.uuid ?? created.id, `created D1 database ${name} id`);
+        config.databaseId = id;
+        changed = true;
+        operations.push({ kind: "d1", name, status: "created", id });
+      } else {
+        operations.push({ kind: "d1", name, status: "missing" });
+      }
+    }
+    for (const bindingValue of array(bindings.r2)) {
+      const config = record3(record3(bindingValue)?.[options.environment]);
+      if (!config) continue;
+      const name = requiredString(config.bucketName, `R2 ${options.environment} bucketName`);
+      const buckets = await cloudflareList(fetchImpl, token, `/accounts/${accountId}/r2/buckets?name_contains=${encodeURIComponent(name)}&per_page=1000`);
+      const exists = buckets.some((item) => item.name === name);
+      if (exists) operations.push({ kind: "r2", name, status: "exists" });
+      else if (options.mode === "apply") {
+        await cloudflareCreate(fetchImpl, token, `/accounts/${accountId}/r2/buckets`, { name });
+        operations.push({ kind: "r2", name, status: "created" });
+      } else operations.push({ kind: "r2", name, status: "missing" });
+    }
+    const queues = record3(bindings.queues);
+    const queueNames = /* @__PURE__ */ new Set();
+    for (const bindingValue of [...array(queues?.producers), ...array(queues?.consumers)]) {
+      const config = record3(record3(bindingValue)?.[options.environment]);
+      if (config && typeof config.queue === "string") queueNames.add(config.queue);
+    }
+    if (queueNames.size > 0) {
+      const existingQueues = await cloudflareList(fetchImpl, token, `/accounts/${accountId}/queues?page=1&per_page=1000`);
+      for (const name of queueNames) {
+        const exists = existingQueues.some((item) => item.queue_name === name || item.name === name);
+        if (exists) operations.push({ kind: "queue", name, status: "exists" });
+        else if (options.mode === "apply") {
+          await cloudflareCreate(fetchImpl, token, `/accounts/${accountId}/queues`, { queue_name: name });
+          operations.push({ kind: "queue", name, status: "created" });
+        } else operations.push({ kind: "queue", name, status: "missing" });
+      }
+    }
+  }
+  if (changed) await writeFile6(manifestPath, `${JSON.stringify(manifest, null, 2)}
+`, "utf8");
+  const drift = operations.some((operation) => operation.status === "missing" || operation.status === "mismatch");
+  return {
+    mode: options.mode,
+    environment: options.environment,
+    manifestPath,
+    accountId,
+    changed,
+    status: drift ? "drift" : "in_sync",
+    operations
+  };
+}
+function registerApplicationResourceProvisionCommand(parent) {
+  parent.command("provision-resources").description("Inspect or create declared Cloudflare resources for one explicit application environment.").requiredOption("--environment <environment>", "development, staging, or production").option("--manifest <path>", "Path to topolo.app.json", "topolo.app.json").option("--check", "Inspect without creating resources").option("--apply", "Create missing resources and write provider identifiers").option("--confirm-production", "Confirm production resource creation").option("--json", "Output JSON").option("--no-json", "Output human-readable details").action(async (options) => {
+    const outputMode = resolveOutputMode(options.json);
+    try {
+      if (!isEnvironment(options.environment)) throw new Error("Environment must be development, staging, or production.");
+      if (options.check && options.apply) throw new Error("Choose exactly one of --check or --apply.");
+      if (options.environment === "production" && options.apply && !options.confirmProduction) {
+        throw new Error("Production resource creation requires --confirm-production.");
+      }
+      const result = await provisionApplicationResources({
+        manifestPath: options.manifest,
+        environment: options.environment,
+        mode: options.apply ? "apply" : "check"
+      });
+      emit(result, outputMode, () => formatResourceProvision(result));
+      if (result.status !== "in_sync") process.exitCode = 2;
+    } catch (error) {
+      fail(error, outputMode);
+    }
+  });
+}
+function formatResourceProvision(result) {
+  return [
+    `Application resources: ${result.status}`,
+    `Environment: ${result.environment}`,
+    ...result.operations.map((operation) => `- ${operation.kind} ${operation.name}: ${operation.status}`)
+  ].join("\n");
+}
+async function cloudflareList(fetchImpl, token, resourcePath) {
+  const result = await cloudflareRequest(fetchImpl, token, resourcePath, "GET");
+  if (Array.isArray(result)) return result.map(record3).filter((value) => Boolean(value));
+  const resultRecord = record3(result);
+  const values = array(resultRecord?.buckets ?? resultRecord?.queues ?? resultRecord?.databases);
+  return values.map(record3).filter((value) => Boolean(value));
+}
+async function cloudflareCreate(fetchImpl, token, resourcePath, body) {
+  const result = await cloudflareRequest(fetchImpl, token, resourcePath, "POST", body);
+  return requiredRecord(result, `Cloudflare create response for ${resourcePath}`);
+}
+async function cloudflareRequest(fetchImpl, token, resourcePath, method, body) {
+  const response = await fetchImpl(`https://api.cloudflare.com/client/v4${resourcePath}`, {
+    method,
+    headers: { Authorization: `Bearer ${token}`, ...body ? { "Content-Type": "application/json" } : {} },
+    ...body ? { body: JSON.stringify(body) } : {}
+  });
+  const payload = await response.json().catch(() => null);
+  const envelope = record3(payload);
+  if (!response.ok || envelope?.success === false) {
+    throw new Error(`Cloudflare ${method} ${resourcePath} failed with HTTP ${response.status}.`);
+  }
+  return envelope && "result" in envelope ? envelope.result : payload;
+}
+function isEnvironment(value) {
+  return value === "development" || value === "staging" || value === "production";
+}
+function parseRecord2(raw, filePath) {
+  const value = JSON.parse(raw);
+  return requiredRecord(value, filePath);
+}
+function requiredRecord(value, label) {
+  const valueRecord = record3(value);
+  if (!valueRecord) throw new Error(`${label} must be an object.`);
+  return valueRecord;
+}
+function requiredString(value, label) {
+  if (typeof value !== "string" || !value.trim()) throw new Error(`${label} must be a non-empty string.`);
+  return value;
+}
+function record3(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function array(value) {
+  return Array.isArray(value) ? value : [];
+}
+
+// src/commands/platform.ts
 function registerPlatformCommand(program2) {
   const platform3 = program2.command("platform").description("Internal Topolo first-party platform and personal app commands");
   const platformApps = platform3.command("apps").description("Scaffold and operate first-party Topolo platform and personal applications");
   registerApplicationReconcileCommand(platformApps, "topolo_first_party");
+  registerApplicationCapabilityCommands(platformApps, "topolo_first_party");
+  registerApplicationResourceProvisionCommand(platformApps);
   platformApps.command("scaffold <application>").description(
     "Generate a first-party Topolo scaffold for the platform or personal portfolio."
   ).option("--json", "Output JSON").option("--no-json", "Output human-readable checklist").option("--app-dir <path>", "Application repo name or apps/<repo> path").option("--name <name>", "Application display/package source name").option("--package-name <name>", "package.json name").option("--production-url <url>", "Production browser URL").option("--service <id>", "Stable SDK/Auth app id for API-backed apps").option("--portfolio <portfolio>", "First-party portfolio: platform or personal").option(
     "--surface-model <surfaceModel>",
     "First-party surface model: web_app, mobile_container, mobile_module, or messaging_surface"
-  ).option("--container-app-id <appId>", "Container app id when --surface-model mobile_module is used").option("--profile <profile>", "First-party scaffold profile such as spatial-assets").option("--with-d1", "Declare a D1 binding in the first-party scaffold").option("--with-r2", "Declare an R2 binding in the first-party scaffold").option("--with-queue", "Declare a Queue binding in the first-party scaffold").option("--with-workflow", "Declare a Workflow binding in the first-party scaffold").option("--with-container-processing", "Declare container-processing metadata in CloudControl").option("--home-path <path>", "Authenticated home route (default: /dashboard)").option("--home-label <label>", "Home navigation label (default: Dashboard)").option("--navigation-mode <mode>", "Product navigation: sidebar, topbar, or none").option("--workspace-switcher <mode>", "Workspace context selector: required, optional, or off").option("--ui-template <template>", "Shared UI starter: operations, index, workbench, or minimal").option("--tagline <text>", "Product-facing landing and home description").option("--write", "Write the generated scaffold files to disk").option("--repo-root <path>", "Directory where scaffold files should be written").option("--force", "Overwrite existing scaffold files when --write is set").option("--with-api", "Include the API/service baseline").option("--no-api", "Do not include API/service requirements").option("--no-browser", "Do not include browser-shell requirements").option(
+  ).option("--container-app-id <appId>", "Container app id when --surface-model mobile_module is used").option("--profile <profile>", "First-party scaffold profile such as spatial-assets").option("--capability <id...>", "Compose one or more versioned platform capabilities").option("--home-path <path>", "Authenticated home route (default: /dashboard)").option("--home-label <label>", "Home navigation label (default: Dashboard)").option("--navigation-mode <mode>", "Product navigation: sidebar, topbar, or none").option("--workspace-switcher <mode>", "Workspace context selector: required, optional, or off").option("--ui-template <template>", "Shared UI starter: operations, index, workbench, or minimal").option("--tagline <text>", "Product-facing landing and home description").option("--write", "Write the generated scaffold files to disk").option("--repo-root <path>", "Directory where scaffold files should be written").option("--force", "Overwrite existing scaffold files when --write is set").option("--with-api", "Include the API/service baseline").option("--no-api", "Do not include API/service requirements").option("--no-browser", "Do not include browser-shell requirements").option(
     "--provision",
     "Provision the generated first-party app into Topolo Developers and Auth using the authenticated Topolo admin session"
   ).option(
@@ -11150,11 +11565,7 @@ function registerPlatformCommand(program2) {
         surfaceModel: resolvePlatformSurfaceModel(opts.surfaceModel),
         containerAppId: opts.containerAppId,
         profile: opts.profile,
-        withD1: opts.withD1,
-        withR2: opts.withR2,
-        withQueue: opts.withQueue,
-        withWorkflow: opts.withWorkflow,
-        withContainerProcessing: opts.withContainerProcessing,
+        capabilities: opts.capability,
         homePath: opts.homePath,
         homeLabel: opts.homeLabel,
         navigationMode: opts.navigationMode,
@@ -11227,12 +11638,12 @@ var SKIPPED_SCAN_DIRS = /* @__PURE__ */ new Set([
   "output"
 ]);
 function scanStagingProductionUrls(rootInput, allowPatterns) {
-  const root = path4.resolve(rootInput);
+  const root = path7.resolve(rootInput);
   const allowlist = allowPatterns.map((pattern) => new RegExp(pattern));
   const violations = [];
   function shouldSkipFile(filePath) {
-    const basename = path4.basename(filePath);
-    const relativePath = path4.relative(root, filePath);
+    const basename = path7.basename(filePath);
+    const relativePath2 = path7.relative(root, filePath);
     if (basename === "package-lock.json" || basename === "pnpm-lock.yaml" || basename === "yarn.lock") return true;
     if (basename === "topolo.cloudcontrol.json") return true;
     if (basename === "wrangler.toml" || basename === "wrangler.jsonc") return true;
@@ -11241,29 +11652,29 @@ function scanStagingProductionUrls(rootInput, allowPatterns) {
     if (basename.endsWith(".generated.ts")) return true;
     if (basename.endsWith(".test.ts") || basename.endsWith(".test.tsx") || basename.endsWith(".spec.ts")) return true;
     if (basename === ".env.production") return true;
-    if (relativePath === path4.join("src", "environment.ts") || relativePath === path4.join("src", "environmentUrls.ts") || relativePath.endsWith(path4.join("src", "environment.ts")) || relativePath.endsWith(path4.join("src", "lib", "environment.ts")) || relativePath === path4.join("packages", "topolo-ui-kit", "src", "environmentUrls.ts")) return true;
-    if (relativePath.includes(`${path4.sep}test${path4.sep}`) || relativePath.includes(`${path4.sep}tests${path4.sep}`) || relativePath.includes(`${path4.sep}e2e${path4.sep}`)) return true;
-    if (relativePath.startsWith(`scripts${path4.sep}`) || relativePath.includes(`${path4.sep}scripts${path4.sep}`)) return true;
-    return !RUNTIME_EXTENSIONS.has(path4.extname(filePath));
+    if (relativePath2 === path7.join("src", "environment.ts") || relativePath2 === path7.join("src", "environmentUrls.ts") || relativePath2.endsWith(path7.join("src", "environment.ts")) || relativePath2.endsWith(path7.join("src", "lib", "environment.ts")) || relativePath2 === path7.join("packages", "topolo-ui-kit", "src", "environmentUrls.ts")) return true;
+    if (relativePath2.includes(`${path7.sep}test${path7.sep}`) || relativePath2.includes(`${path7.sep}tests${path7.sep}`) || relativePath2.includes(`${path7.sep}e2e${path7.sep}`)) return true;
+    if (relativePath2.startsWith(`scripts${path7.sep}`) || relativePath2.includes(`${path7.sep}scripts${path7.sep}`)) return true;
+    return !RUNTIME_EXTENSIONS.has(path7.extname(filePath));
   }
   function scanFile(filePath) {
     if (shouldSkipFile(filePath)) return;
-    const relativePath = path4.relative(root, filePath);
-    const content = readFileSync5(filePath, "utf8");
+    const relativePath2 = path7.relative(root, filePath);
+    const content = readFileSync6(filePath, "utf8");
     const lines = content.split(/\r?\n/);
     lines.forEach((line, index) => {
       const matches = [...line.matchAll(PRODUCTION_TOPOLO_URL_PATTERN)].map((match) => match[0]);
       for (const url of new Set(matches)) {
-        const allowed = STAGING_TOPOLO_URL_PATTERN.test(line) || line.includes("PRODUCTION_") || line.includes("hostname ===") || line.includes(".split(") && line.includes(".join(") || allowlist.some((pattern) => pattern.test(`${relativePath}:${index + 1}:${line}`));
+        const allowed = STAGING_TOPOLO_URL_PATTERN.test(line) || line.includes("PRODUCTION_") || line.includes("hostname ===") || line.includes(".split(") && line.includes(".join(") || allowlist.some((pattern) => pattern.test(`${relativePath2}:${index + 1}:${line}`));
         if (!allowed) {
-          violations.push({ file: relativePath, line: index + 1, url, text: line.trim() });
+          violations.push({ file: relativePath2, line: index + 1, url, text: line.trim() });
         }
       }
     });
   }
   function walk(dir) {
     for (const entry of readdirSync2(dir, { withFileTypes: true })) {
-      const fullPath = path4.join(dir, entry.name);
+      const fullPath = path7.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (!SKIPPED_SCAN_DIRS.has(entry.name)) walk(fullPath);
         continue;
@@ -11431,7 +11842,7 @@ var DEFAULT_SEED_BASE_URL = "https://seed.stg.topolo.us";
 function seedBaseUrl() {
   return process.env.TOPOLO_SEED_URL || DEFAULT_SEED_BASE_URL;
 }
-async function authedFetch(path5, init = {}) {
+async function authedFetch(path8, init = {}) {
   const credential = await refreshCredentialIfNeeded("staging");
   if (!credential) {
     throw new Error("No staging credential configured. Run `topolo auth login --env staging` or set TOPOLO_STAGING_API_KEY.");
@@ -11441,7 +11852,7 @@ async function authedFetch(path5, init = {}) {
   else headers.set("Authorization", `Bearer ${credential.accessToken}`);
   headers.set("X-Topolo-Client", `topolo-cli/${CLI_VERSION}`);
   if (init.body && !headers.has("Content-Type")) headers.set("Content-Type", "application/json");
-  const response = await fetch(`${seedBaseUrl()}${path5}`, { ...init, headers });
+  const response = await fetch(`${seedBaseUrl()}${path8}`, { ...init, headers });
   const text = await response.text();
   let body;
   try {
@@ -11718,7 +12129,7 @@ function createOAuthClientPayload(options) {
     logo_url: options.logoUrl
   };
 }
-async function authFetchJson(path5, init = {}) {
+async function authFetchJson(path8, init = {}) {
   const environment = selectedEnvironment();
   const credential = await refreshCredentialIfNeeded(environment);
   if (!credential) {
@@ -11740,7 +12151,7 @@ async function authFetchJson(path5, init = {}) {
     throw err;
   }
   headers.set("Authorization", `Bearer ${credential.accessToken}`);
-  const response = await fetch(`${authBaseUrl}${path5}`, { ...init, headers });
+  const response = await fetch(`${authBaseUrl}${path8}`, { ...init, headers });
   const text = await response.text();
   const payload = text ? JSON.parse(text) : {};
   if (!response.ok || payload.success === false) {
@@ -11756,7 +12167,7 @@ function normalizeList(values, fallback = []) {
 }
 
 // src/commands/integrations.ts
-import { readdir, readFile as readFile4, stat } from "fs/promises";
+import { readdir, readFile as readFile6, stat } from "fs/promises";
 import { join as join4, relative as relative3 } from "path";
 function registerIntegrationsCommand(program2) {
   const integrations = program2.command("integrations").description("Generate and validate Topolo integration handoffs.");
@@ -11900,7 +12311,7 @@ function detectFramework(packageJson2, haystack) {
 }
 async function readPackageJson2(repoRoot) {
   try {
-    return JSON.parse(await readFile4(join4(repoRoot, "package.json"), "utf8"));
+    return JSON.parse(await readFile6(join4(repoRoot, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -11923,7 +12334,7 @@ async function collectFiles(repoRoot) {
       if (info.size > 25e4) continue;
       result.push({
         path: relative3(root, fullPath),
-        content: await readFile4(fullPath, "utf8")
+        content: await readFile6(fullPath, "utf8")
       });
     }
   }
@@ -11939,9 +12350,9 @@ function formatCheckResult(result) {
 }
 
 // src/commands/skills.ts
-import { spawnSync } from "child_process";
-import { existsSync as existsSync4 } from "fs";
-import { mkdir as mkdir3, copyFile, readFile as readFile5, writeFile as writeFile5, rm } from "fs/promises";
+import { spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync5 } from "fs";
+import { mkdir as mkdir4, copyFile, readFile as readFile7, writeFile as writeFile7, rm } from "fs/promises";
 import { homedir as homedir2 } from "os";
 import { dirname as dirname4, join as join5, resolve as resolve3 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
@@ -11952,19 +12363,19 @@ function skillsSourceDir() {
   const distCandidate = resolve3(here, "../skills");
   const srcCandidate = resolve3(here, "../../skills");
   for (const candidate of [distCandidate, srcCandidate]) {
-    if (existsSync4(join5(candidate, "topolo", "SKILL.md"))) return candidate;
+    if (existsSync5(join5(candidate, "topolo", "SKILL.md"))) return candidate;
   }
   return distCandidate;
 }
 function resolveMcpCommand() {
-  const probe = spawnSync(process.platform === "win32" ? "where" : "which", ["topolo-mcp"], {
+  const probe = spawnSync2(process.platform === "win32" ? "where" : "which", ["topolo-mcp"], {
     stdio: "ignore"
   });
   if (probe.status === 0) return { command: "topolo-mcp", args: [] };
   return { command: "npx", args: ["-y", "@topolo/mcp"] };
 }
 function agentBinaryExists(bin) {
-  const probe = spawnSync(process.platform === "win32" ? "where" : "which", [bin], {
+  const probe = spawnSync2(process.platform === "win32" ? "where" : "which", [bin], {
     stdio: "ignore"
   });
   return probe.status === 0;
@@ -11977,7 +12388,7 @@ function codexSkillDir() {
   return join5(homedir2(), ".codex", "skills", "topolo");
 }
 async function installSkillFile(sourceDir, targetDir) {
-  await mkdir3(targetDir, { recursive: true });
+  await mkdir4(targetDir, { recursive: true });
   const target = join5(targetDir, "SKILL.md");
   await copyFile(join5(sourceDir, "topolo", "SKILL.md"), target);
   return target;
@@ -11985,9 +12396,9 @@ async function installSkillFile(sourceDir, targetDir) {
 function registerViaOfficialCli(cli, mcp, agentName) {
   if (!agentBinaryExists(cli)) return false;
   const scopeArgs = cli === "claude" ? ["-s", "user"] : [];
-  spawnSync(cli, ["mcp", "remove", "topolo", ...scopeArgs], { stdio: "ignore" });
+  spawnSync2(cli, ["mcp", "remove", "topolo", ...scopeArgs], { stdio: "ignore" });
   const envArgs = cli === "claude" ? ["-e", `TOPOLO_AGENT_NAME=${agentName}`] : ["--env", `TOPOLO_AGENT_NAME=${agentName}`];
-  const result = spawnSync(
+  const result = spawnSync2(
     cli,
     ["mcp", "add", "topolo", ...scopeArgs, ...envArgs, "--", mcp.command, ...mcp.args],
     { stdio: "ignore" }
@@ -11995,11 +12406,11 @@ function registerViaOfficialCli(cli, mcp, agentName) {
   return result.status === 0;
 }
 async function registerClaudeViaConfig(mcp) {
-  const path5 = join5(homedir2(), ".claude.json");
+  const path8 = join5(homedir2(), ".claude.json");
   let config = {};
-  if (existsSync4(path5)) {
+  if (existsSync5(path8)) {
     try {
-      config = JSON.parse(await readFile5(path5, "utf8"));
+      config = JSON.parse(await readFile7(path8, "utf8"));
     } catch {
       config = {};
     }
@@ -12012,13 +12423,13 @@ async function registerClaudeViaConfig(mcp) {
     env: { TOPOLO_AGENT_NAME: AGENT_NAME_FOR.claude }
   };
   config.mcpServers = servers;
-  await writeFile5(path5, `${JSON.stringify(config, null, 2)}
+  await writeFile7(path8, `${JSON.stringify(config, null, 2)}
 `, "utf8");
 }
 async function registerCodexViaConfig(mcp) {
-  const path5 = join5(homedir2(), ".codex", "config.toml");
+  const path8 = join5(homedir2(), ".codex", "config.toml");
   let text = "";
-  if (existsSync4(path5)) text = await readFile5(path5, "utf8");
+  if (existsSync5(path8)) text = await readFile7(path8, "utf8");
   text = text.replace(
     /(^|\n)\[mcp_servers\.topolo(?:\.[a-z]+)?\][^\[]*/g,
     (match) => match.startsWith("\n") ? "\n" : ""
@@ -12034,8 +12445,8 @@ command = "${mcp.command}"${argsToml}
 [mcp_servers.topolo.env]
 TOPOLO_AGENT_NAME = "${AGENT_NAME_FOR.codex}"
 `;
-  await mkdir3(dirname4(path5), { recursive: true });
-  await writeFile5(path5, `${text}${block}`, "utf8");
+  await mkdir4(dirname4(path8), { recursive: true });
+  await writeFile7(path8, `${text}${block}`, "utf8");
 }
 async function installForAgent(agent, sourceDir, mcp, opts) {
   const skillDir = agent === "claude" ? claudeSkillDir(opts.projectDir) : codexSkillDir();
@@ -12073,7 +12484,7 @@ function registerSkillsCommand(program2) {
       const mode = resolveOutputMode(opts.json);
       try {
         const sourceDir = skillsSourceDir();
-        if (!existsSync4(join5(sourceDir, "topolo", "SKILL.md"))) {
+        if (!existsSync5(join5(sourceDir, "topolo", "SKILL.md"))) {
           throw new Error(
             "Bundled skill file not found. Reinstall the CLI: npm install -g @topolo/cli"
           );
@@ -12102,7 +12513,7 @@ function registerSkillsCommand(program2) {
         const skillDir = agent === "claude" ? claudeSkillDir() : codexSkillDir();
         return {
           agent,
-          skillInstalled: existsSync4(join5(skillDir, "SKILL.md")),
+          skillInstalled: existsSync5(join5(skillDir, "SKILL.md")),
           skillPath: join5(skillDir, "SKILL.md"),
           cliAvailable: agentBinaryExists(agent)
         };
@@ -12119,10 +12530,10 @@ function registerSkillsCommand(program2) {
       for (const agent of resolveTargets(opts)) {
         const skillDir = agent === "claude" ? claudeSkillDir() : codexSkillDir();
         const skillFile = join5(skillDir, "SKILL.md");
-        const skillRemoved = existsSync4(skillFile);
+        const skillRemoved = existsSync5(skillFile);
         if (skillRemoved) await rm(skillFile, { force: true });
         if (agentBinaryExists(agent)) {
-          spawnSync(agent, ["mcp", "remove", "topolo"], { stdio: "ignore" });
+          spawnSync2(agent, ["mcp", "remove", "topolo"], { stdio: "ignore" });
         }
         removed.push({ agent, skillRemoved });
       }