@topolo/cli 0.6.4 → 0.6.6

package/dist/index.js

@@ -37,19 +37,54 @@ var TopoloSdkError = class extends Error {
   }
 };
 var TopoloAuthError = class extends TopoloSdkError {
-  constructor(message, code = "auth_error") {
+  status;
+  body;
+  service;
+  path;
+  requestId;
+  retryAfter;
+  constructor(message, code = "auth_error", options = {}) {
     super(code, message);
     this.name = "TopoloAuthError";
+    this.status = options.status ?? 401;
+    this.body = options.body;
+    this.service = options.service;
+    this.path = options.path;
+    this.requestId = options.requestId;
+    this.retryAfter = options.retryAfter;
   }
 };
 var TopoloPermissionError = class extends TopoloSdkError {
   required;
-  constructor(message, required) {
+  status;
+  body;
+  service;
+  path;
+  requestId;
+  retryAfter;
+  constructor(message, required, options = {}) {
     super("permission_denied", message);
     this.name = "TopoloPermissionError";
     this.required = required;
+    this.status = options.status ?? 403;
+    this.body = options.body;
+    this.service = options.service;
+    this.path = options.path;
+    this.requestId = options.requestId;
+    this.retryAfter = options.retryAfter;
   }
 };
+function extractHttpErrorCode(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return "http_error";
+  const record4 = body;
+  if (typeof record4.code === "string" && record4.code.trim()) return record4.code.trim();
+  const nested = record4.error;
+  if (nested && typeof nested === "object" && !Array.isArray(nested)) {
+    const code = nested.code;
+    if (typeof code === "string" && code.trim()) return code.trim();
+  }
+  return "http_error";
+}
 var TopoloConfirmationRequiredError = class extends TopoloSdkError {
   constructor(message) {
     super("confirmation_required", message);
@@ -61,19 +96,24 @@ var TopoloHttpError = class extends TopoloSdkError {
   body;
   service;
   path;
-  constructor(service, path8, status, body, message) {
-    super("http_error", message ?? `HTTP ${status} from ${service}${path8}`);
+  requestId;
+  retryAfter;
+  constructor(service, path9, status, body, message, options = {}) {
+    super(extractHttpErrorCode(body), message ?? `HTTP ${status} from ${service}${path9}`);
     this.name = "TopoloHttpError";
     this.status = status;
     this.body = body;
     this.service = service;
-    this.path = path8;
+    this.path = path9;
+    this.requestId = options.requestId;
+    this.retryAfter = options.retryAfter;
   }
 };
 var APP_API_URLS = {
   agent: "https://agent.topolo.app",
   auth: "https://auth.topolo.app",
   backup: "https://backup.topolo.app",
+  blog: "https://blog.topolo.app",
   books: "https://books.topolo.app",
   brand: "https://brand.topolo.app",
   bugfix: "https://bugfix.topolo.app",
@@ -86,6 +126,7 @@ var APP_API_URLS = {
   compose: "https://compose.topolo.app",
   consent: "https://consent.topolo.app",
   crm: "https://crm.topolo.app",
+  design: "https://design.topolo.app",
   developers: "https://developers.topolo.app",
   director: "https://director.topolo.app",
   feed: "https://feed.topolo.app",
@@ -169,7 +210,9 @@ var APPLICATIONS = {
         "domains": [
           "agent.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "agent.topolo.app"
+        ],
         "appId": "agent"
       },
       {
@@ -230,6 +273,38 @@ var APPLICATIONS = {
       }
     ]
   },
+  "blog": {
+    "id": "blog",
+    "appDir": "TopoloBlog",
+    "name": "topolo-blog",
+    "packageName": "topolo-blog",
+    "productionUrl": "https://blog.topolo.app",
+    "services": [
+      "blog"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-blog",
+        "kind": "worker",
+        "apiUrl": "https://blog.topolo.app",
+        "domains": [
+          "blog.topolo.app"
+        ],
+        "routes": [
+          "blog.topolo.app"
+        ],
+        "appId": "blog"
+      },
+      {
+        "name": "topolo-blog-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
   "books": {
     "id": "books",
     "appDir": "TopoloBooks",
@@ -247,7 +322,9 @@ var APPLICATIONS = {
         "domains": [
           "books.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "books.topolo.app"
+        ],
         "appId": "books"
       },
       {
@@ -397,7 +474,9 @@ var APPLICATIONS = {
         "domains": [
           "campaigns.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "campaigns.topolo.app"
+        ],
         "appId": "campaigns"
       },
       {
@@ -607,11 +686,45 @@ var APPLICATIONS = {
         "domains": [
           "crm.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "crm.topolo.app"
+        ],
         "appId": "crm"
       }
     ]
   },
+  "design": {
+    "id": "design",
+    "appDir": "TopoloDesign",
+    "name": "topolo-design",
+    "packageName": "@topolo-io/design",
+    "productionUrl": "https://design.topolo.app",
+    "services": [
+      "design"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-design",
+        "kind": "worker",
+        "apiUrl": "https://design.topolo.app",
+        "domains": [
+          "design.topolo.app"
+        ],
+        "routes": [
+          "design.topolo.app"
+        ],
+        "appId": "design"
+      },
+      {
+        "name": "topolo-design-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
   "developers": {
     "id": "developers",
     "appDir": "TopoloDevelopers",
@@ -835,7 +948,9 @@ var APPLICATIONS = {
         "domains": [
           "forms.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "forms.topolo.app"
+        ],
         "appId": "forms"
       },
       {
@@ -897,7 +1012,9 @@ var APPLICATIONS = {
         "domains": [
           "insights.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "insights.topolo.app"
+        ],
         "appId": "insights"
       },
       {
@@ -1281,7 +1398,9 @@ var APPLICATIONS = {
         "domains": [
           "pay.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "pay.topolo.app"
+        ],
         "appId": "pay"
       },
       {
@@ -1366,7 +1485,9 @@ var APPLICATIONS = {
         "domains": [
           "quro.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "quro.topolo.app"
+        ],
         "appId": null
       }
     ]
@@ -1650,7 +1771,9 @@ var APPLICATIONS = {
         "domains": [
           "survey.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "survey.topolo.app"
+        ],
         "appId": "survey"
       },
       {
@@ -2232,17 +2355,17 @@ function validateTopoloActionInput(schema, input3) {
   validateNode(schema, input3, "$", schema, errors, 0);
   return { valid: errors.length === 0, errors };
 }
-function inspectSchema(schema, path8, root, depth) {
-  if (depth > 128) return { path: path8, code: "schema_depth", message: "Schema recursion exceeded 128 levels." };
+function inspectSchema(schema, path9, root, depth) {
+  if (depth > 128) return { path: path9, code: "schema_depth", message: "Schema recursion exceeded 128 levels." };
   const unsupportedKeyword = Object.keys(schema).find((keyword) => !SUPPORTED_SCHEMA_KEYWORDS.has(keyword));
   if (unsupportedKeyword) {
-    return { path: path8, code: "unsupported_schema_keyword", message: `Action schema uses unsupported keyword ${unsupportedKeyword}.` };
+    return { path: path9, code: "unsupported_schema_keyword", message: `Action schema uses unsupported keyword ${unsupportedKeyword}.` };
   }
   if (typeof schema.format === "string" && !["uri", "email", "date-time"].includes(schema.format)) {
-    return { path: path8, code: "unsupported_schema_format", message: `Action schema uses unsupported format ${schema.format}.` };
+    return { path: path9, code: "unsupported_schema_format", message: `Action schema uses unsupported format ${schema.format}.` };
   }
   if (typeof schema.$ref === "string" && !resolveLocalReference(root, schema.$ref)) {
-    return { path: path8, code: "unsupported_schema_ref", message: `Cannot resolve schema reference ${schema.$ref}.` };
+    return { path: path9, code: "unsupported_schema_ref", message: `Cannot resolve schema reference ${schema.$ref}.` };
   }
   const children = [];
   if (isRecord(schema.properties)) children.push(...Object.entries(schema.properties));
@@ -2258,7 +2381,7 @@ function inspectSchema(schema, path8, root, depth) {
   );
   for (const [key, child] of children) {
     if (!isRecord(child)) continue;
-    const issue = inspectSchema(child, `${path8}.${key}`, root, depth + 1);
+    const issue = inspectSchema(child, `${path9}.${key}`, root, depth + 1);
     if (issue) return issue;
   }
   return null;
@@ -2266,129 +2389,129 @@ function inspectSchema(schema, path8, root, depth) {
 function arraySchemaEntries(keyword, value) {
   return Array.isArray(value) ? value.map((candidate, index) => [`${keyword}[${index}]`, candidate]) : [];
 }
-function validateNode(schema, value, path8, root, errors, depth) {
+function validateNode(schema, value, path9, root, errors, depth) {
   if (depth > 128) {
-    errors.push({ path: path8, code: "schema_depth", message: "Schema recursion exceeded 128 levels." });
+    errors.push({ path: path9, code: "schema_depth", message: "Schema recursion exceeded 128 levels." });
     return;
   }
   if (typeof schema.$ref === "string") {
     const resolved = resolveLocalReference(root, schema.$ref);
     if (!resolved) {
-      errors.push({ path: path8, code: "unsupported_schema_ref", message: `Cannot resolve schema reference ${schema.$ref}.` });
+      errors.push({ path: path9, code: "unsupported_schema_ref", message: `Cannot resolve schema reference ${schema.$ref}.` });
       return;
     }
-    validateNode(resolved, value, path8, root, errors, depth + 1);
+    validateNode(resolved, value, path9, root, errors, depth + 1);
   }
   if (Array.isArray(schema.allOf)) {
     for (const candidate of schema.allOf) {
-      if (isRecord(candidate)) validateNode(candidate, value, path8, root, errors, depth + 1);
+      if (isRecord(candidate)) validateNode(candidate, value, path9, root, errors, depth + 1);
     }
   }
   if (Array.isArray(schema.anyOf) && !schema.anyOf.some((candidate) => candidateMatches(candidate, value, root, depth))) {
-    errors.push({ path: path8, code: "any_of", message: "Value does not match any allowed schema." });
+    errors.push({ path: path9, code: "any_of", message: "Value does not match any allowed schema." });
     return;
   }
   if (Array.isArray(schema.oneOf)) {
     const matches = schema.oneOf.filter((candidate) => candidateMatches(candidate, value, root, depth)).length;
     if (matches !== 1) {
-      errors.push({ path: path8, code: "one_of", message: "Value must match exactly one allowed schema." });
+      errors.push({ path: path9, code: "one_of", message: "Value must match exactly one allowed schema." });
       return;
     }
   }
   if (value === null && schema.nullable === true) return;
   if (Object.prototype.hasOwnProperty.call(schema, "const") && !sameJsonValue(value, schema.const)) {
-    errors.push({ path: path8, code: "const", message: `Value must equal ${JSON.stringify(schema.const)}.` });
+    errors.push({ path: path9, code: "const", message: `Value must equal ${JSON.stringify(schema.const)}.` });
     return;
   }
   if (Array.isArray(schema.enum) && !schema.enum.some((candidate) => sameJsonValue(value, candidate))) {
-    errors.push({ path: path8, code: "enum", message: `Value must be one of ${schema.enum.map((item) => JSON.stringify(item)).join(", ")}.` });
+    errors.push({ path: path9, code: "enum", message: `Value must be one of ${schema.enum.map((item) => JSON.stringify(item)).join(", ")}.` });
     return;
   }
   if (!matchesType(schema.type, value)) {
-    errors.push({ path: path8, code: "type", message: `Expected ${String(schema.type)}.` });
+    errors.push({ path: path9, code: "type", message: `Expected ${String(schema.type)}.` });
     return;
   }
-  if (typeof value === "string") validateString(schema, value, path8, errors);
-  if (typeof value === "number") validateNumber(schema, value, path8, errors);
-  if (Array.isArray(value)) validateArray(schema, value, path8, root, errors, depth);
-  if (isRecord(value)) validateObject(schema, value, path8, root, errors, depth);
+  if (typeof value === "string") validateString(schema, value, path9, errors);
+  if (typeof value === "number") validateNumber(schema, value, path9, errors);
+  if (Array.isArray(value)) validateArray(schema, value, path9, root, errors, depth);
+  if (isRecord(value)) validateObject(schema, value, path9, root, errors, depth);
 }
-function validateObject(schema, value, path8, root, errors, depth) {
+function validateObject(schema, value, path9, root, errors, depth) {
   if (typeof schema.minProperties === "number" && Object.keys(value).length < schema.minProperties) {
-    errors.push({ path: path8, code: "min_properties", message: `Expected at least ${schema.minProperties} properties.` });
+    errors.push({ path: path9, code: "min_properties", message: `Expected at least ${schema.minProperties} properties.` });
   }
   if (typeof schema.maxProperties === "number" && Object.keys(value).length > schema.maxProperties) {
-    errors.push({ path: path8, code: "max_properties", message: `Expected at most ${schema.maxProperties} properties.` });
+    errors.push({ path: path9, code: "max_properties", message: `Expected at most ${schema.maxProperties} properties.` });
   }
   const properties = isRecord(schema.properties) ? schema.properties : {};
   const required = Array.isArray(schema.required) ? schema.required.map(String) : [];
   for (const key of required) {
     if (!Object.prototype.hasOwnProperty.call(value, key)) {
-      errors.push({ path: `${path8}.${key}`, code: "required", message: "Required property is missing." });
+      errors.push({ path: `${path9}.${key}`, code: "required", message: "Required property is missing." });
     }
   }
   if (isRecord(schema.propertyNames)) {
     for (const key of Object.keys(value)) {
-      validateNode(schema.propertyNames, key, `${path8}.${key}`, root, errors, depth + 1);
+      validateNode(schema.propertyNames, key, `${path9}.${key}`, root, errors, depth + 1);
     }
   }
   for (const [key, child] of Object.entries(value)) {
     const childSchema = properties[key];
     if (isRecord(childSchema)) {
-      validateNode(childSchema, child, `${path8}.${key}`, root, errors, depth + 1);
+      validateNode(childSchema, child, `${path9}.${key}`, root, errors, depth + 1);
     } else if (schema.additionalProperties === false) {
-      errors.push({ path: `${path8}.${key}`, code: "additional_property", message: "Property is not declared by the action schema." });
+      errors.push({ path: `${path9}.${key}`, code: "additional_property", message: "Property is not declared by the action schema." });
     } else if (isRecord(schema.additionalProperties)) {
-      validateNode(schema.additionalProperties, child, `${path8}.${key}`, root, errors, depth + 1);
+      validateNode(schema.additionalProperties, child, `${path9}.${key}`, root, errors, depth + 1);
     }
   }
 }
-function validateArray(schema, value, path8, root, errors, depth) {
+function validateArray(schema, value, path9, root, errors, depth) {
   if (typeof schema.minItems === "number" && value.length < schema.minItems) {
-    errors.push({ path: path8, code: "min_items", message: `Expected at least ${schema.minItems} items.` });
+    errors.push({ path: path9, code: "min_items", message: `Expected at least ${schema.minItems} items.` });
   }
   if (typeof schema.maxItems === "number" && value.length > schema.maxItems) {
-    errors.push({ path: path8, code: "max_items", message: `Expected at most ${schema.maxItems} items.` });
+    errors.push({ path: path9, code: "max_items", message: `Expected at most ${schema.maxItems} items.` });
   }
   if (schema.uniqueItems === true) {
     const unique4 = new Set(value.map((item) => JSON.stringify(item)));
-    if (unique4.size !== value.length) errors.push({ path: path8, code: "unique_items", message: "Expected every item to be unique." });
+    if (unique4.size !== value.length) errors.push({ path: path9, code: "unique_items", message: "Expected every item to be unique." });
   }
   if (isRecord(schema.items)) {
-    value.forEach((item, index) => validateNode(schema.items, item, `${path8}[${index}]`, root, errors, depth + 1));
+    value.forEach((item, index) => validateNode(schema.items, item, `${path9}[${index}]`, root, errors, depth + 1));
   }
 }
-function validateString(schema, value, path8, errors) {
+function validateString(schema, value, path9, errors) {
   if (typeof schema.minLength === "number" && value.length < schema.minLength) {
-    errors.push({ path: path8, code: "min_length", message: `Expected at least ${schema.minLength} characters.` });
+    errors.push({ path: path9, code: "min_length", message: `Expected at least ${schema.minLength} characters.` });
   }
   if (typeof schema.maxLength === "number" && value.length > schema.maxLength) {
-    errors.push({ path: path8, code: "max_length", message: `Expected at most ${schema.maxLength} characters.` });
+    errors.push({ path: path9, code: "max_length", message: `Expected at most ${schema.maxLength} characters.` });
   }
   if (typeof schema.pattern === "string") {
     try {
-      if (!new RegExp(schema.pattern).test(value)) errors.push({ path: path8, code: "pattern", message: "Value does not match the required pattern." });
+      if (!new RegExp(schema.pattern).test(value)) errors.push({ path: path9, code: "pattern", message: "Value does not match the required pattern." });
     } catch {
-      errors.push({ path: path8, code: "invalid_schema_pattern", message: "Action schema contains an invalid pattern." });
+      errors.push({ path: path9, code: "invalid_schema_pattern", message: "Action schema contains an invalid pattern." });
     }
   }
-  if (schema.format === "uri" && !isUrl(value)) errors.push({ path: path8, code: "format_uri", message: "Expected an absolute URL." });
-  if (schema.format === "email" && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(value)) errors.push({ path: path8, code: "format_email", message: "Expected an email address." });
-  if (schema.format === "date-time" && !isDateTime(value)) errors.push({ path: path8, code: "format_date_time", message: "Expected an ISO-8601 date-time." });
+  if (schema.format === "uri" && !isUrl(value)) errors.push({ path: path9, code: "format_uri", message: "Expected an absolute URL." });
+  if (schema.format === "email" && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(value)) errors.push({ path: path9, code: "format_email", message: "Expected an email address." });
+  if (schema.format === "date-time" && !isDateTime(value)) errors.push({ path: path9, code: "format_date_time", message: "Expected an ISO-8601 date-time." });
 }
-function validateNumber(schema, value, path8, errors) {
-  if (typeof schema.minimum === "number" && value < schema.minimum) errors.push({ path: path8, code: "minimum", message: `Expected a value of at least ${schema.minimum}.` });
-  if (typeof schema.maximum === "number" && value > schema.maximum) errors.push({ path: path8, code: "maximum", message: `Expected a value of at most ${schema.maximum}.` });
+function validateNumber(schema, value, path9, errors) {
+  if (typeof schema.minimum === "number" && value < schema.minimum) errors.push({ path: path9, code: "minimum", message: `Expected a value of at least ${schema.minimum}.` });
+  if (typeof schema.maximum === "number" && value > schema.maximum) errors.push({ path: path9, code: "maximum", message: `Expected a value of at most ${schema.maximum}.` });
   const exclusiveMinimum = typeof schema.exclusiveMinimum === "number" ? schema.exclusiveMinimum : schema.exclusiveMinimum === true && typeof schema.minimum === "number" ? schema.minimum : null;
   const exclusiveMaximum = typeof schema.exclusiveMaximum === "number" ? schema.exclusiveMaximum : schema.exclusiveMaximum === true && typeof schema.maximum === "number" ? schema.maximum : null;
   if (exclusiveMinimum !== null && value <= exclusiveMinimum) {
-    errors.push({ path: path8, code: "exclusive_minimum", message: `Expected a value greater than ${exclusiveMinimum}.` });
+    errors.push({ path: path9, code: "exclusive_minimum", message: `Expected a value greater than ${exclusiveMinimum}.` });
   }
   if (exclusiveMaximum !== null && value >= exclusiveMaximum) {
-    errors.push({ path: path8, code: "exclusive_maximum", message: `Expected a value less than ${exclusiveMaximum}.` });
+    errors.push({ path: path9, code: "exclusive_maximum", message: `Expected a value less than ${exclusiveMaximum}.` });
   }
   if (typeof schema.multipleOf === "number" && !isMultipleOf(value, schema.multipleOf)) {
-    errors.push({ path: path8, code: "multiple_of", message: `Expected a multiple of ${schema.multipleOf}.` });
+    errors.push({ path: path9, code: "multiple_of", message: `Expected a multiple of ${schema.multipleOf}.` });
   }
 }
 function candidateMatches(candidate, value, root, depth) {
@@ -2441,6 +2564,166 @@ function isMultipleOf(value, divisor) {
   const quotient = value / divisor;
   return Math.abs(quotient - Math.round(quotient)) < Number.EPSILON * Math.max(1, Math.abs(quotient)) * 4;
 }
+function parseTopoloActionUploadContract(value) {
+  if (!isRecord2(value) || value.profile !== "inline-base64" && value.profile !== "url-session") {
+    throw new TopoloSdkError("upload_contract_unavailable", "This action does not publish a supported upload contract.");
+  }
+  const contentTypeField = requiredField(value.contentTypeField, "contentTypeField");
+  const fileNameField = requiredField(value.fileNameField, "fileNameField");
+  const maxBytes = Number(value.maxBytes);
+  const acceptedContentTypes = Array.isArray(value.acceptedContentTypes) ? value.acceptedContentTypes.map((item) => String(item).trim().toLowerCase()).filter(Boolean) : [];
+  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0 || acceptedContentTypes.length === 0) {
+    throw new TopoloSdkError("invalid_upload_contract", "The action upload contract must declare maxBytes and acceptedContentTypes.");
+  }
+  if (value.profile === "inline-base64") {
+    return {
+      profile: "inline-base64",
+      contentField: requiredField(value.contentField, "contentField"),
+      contentTypeField,
+      fileNameField,
+      maxBytes,
+      acceptedContentTypes
+    };
+  }
+  const uploadMethod = value.uploadMethod === "PUT" || value.uploadMethod === "POST" ? value.uploadMethod : null;
+  const uploadUrlPath = requiredPath(value.uploadUrlPath, "uploadUrlPath");
+  const complete = value.complete === void 0 ? void 0 : parseCompleteContract(value.complete);
+  if (!uploadMethod) throw new TopoloSdkError("invalid_upload_contract", "The action upload contract has an invalid uploadMethod.");
+  return {
+    profile: "url-session",
+    fileNameField,
+    contentTypeField,
+    sizeField: requiredField(value.sizeField, "sizeField"),
+    maxBytes,
+    acceptedContentTypes,
+    uploadUrlPath,
+    uploadMethod,
+    ...complete ? { complete } : {}
+  };
+}
+function prepareTopoloActionUploadInput(contractValue, content, input3, options) {
+  const contract = parseTopoloActionUploadContract(contractValue);
+  if (contract.profile !== "inline-base64") throw unsupportedInlineProfile();
+  const bytes = content instanceof Uint8Array ? content : new Uint8Array(content);
+  if (bytes.byteLength === 0) {
+    throw new TopoloSdkError("invalid_upload_content", "Upload content must not be empty.");
+  }
+  if (bytes.byteLength > contract.maxBytes) {
+    throw new TopoloSdkError("upload_too_large", `Upload content exceeds the ${contract.maxBytes}-byte action limit.`);
+  }
+  return mapUploadInput(contract, bytesToBase64(bytes), input3, options);
+}
+function prepareTopoloActionBase64UploadInput(contractValue, contentBase64, input3, options) {
+  const contract = parseTopoloActionUploadContract(contractValue);
+  if (contract.profile !== "inline-base64") throw unsupportedInlineProfile();
+  if (!isCanonicalBase64(contentBase64)) {
+    throw new TopoloSdkError("invalid_upload_content", "Upload content must be canonical base64.");
+  }
+  const padding = contentBase64.endsWith("==") ? 2 : contentBase64.endsWith("=") ? 1 : 0;
+  const byteLength = contentBase64.length / 4 * 3 - padding;
+  if (byteLength === 0) throw new TopoloSdkError("invalid_upload_content", "Upload content must not be empty.");
+  if (byteLength > contract.maxBytes) {
+    throw new TopoloSdkError("upload_too_large", `Upload content exceeds the ${contract.maxBytes}-byte action limit.`);
+  }
+  return mapUploadInput(contract, contentBase64, input3, options);
+}
+function prepareTopoloUrlSessionUploadInput(contractValue, byteLength, input3, options) {
+  const contract = parseTopoloActionUploadContract(contractValue);
+  if (contract.profile !== "url-session") {
+    throw new TopoloSdkError("invalid_upload_contract", "This action does not publish a URL-session upload contract.");
+  }
+  validateUploadMetadata(contract, byteLength, options);
+  return {
+    contract,
+    input: {
+      ...input3,
+      [contract.fileNameField]: options.fileName.trim(),
+      [contract.contentTypeField]: options.contentType.trim().toLowerCase(),
+      [contract.sizeField]: byteLength
+    }
+  };
+}
+function topoloUploadResponseValue(response, path9) {
+  return path9.split(".").reduce((value, segment) => isRecord2(value) ? value[segment] : void 0, response);
+}
+function decodeTopoloActionBase64(contentBase64) {
+  if (!isCanonicalBase64(contentBase64)) {
+    throw new TopoloSdkError("invalid_upload_content", "Upload content must be canonical base64.");
+  }
+  const binary = atob(contentBase64);
+  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+}
+function mapUploadInput(contract, contentBase64, input3, options) {
+  validateUploadMetadata(contract, Math.max(1, decodedBase64Size(contentBase64)), options);
+  const fileName = options.fileName.trim();
+  const contentType = options.contentType.trim().toLowerCase();
+  return {
+    ...input3,
+    [contract.contentField]: contentBase64,
+    [contract.contentTypeField]: contentType,
+    [contract.fileNameField]: fileName
+  };
+}
+function validateUploadMetadata(contract, byteLength, options) {
+  const fileName = options.fileName.trim();
+  const contentType = options.contentType.trim().toLowerCase();
+  if (!fileName) throw new TopoloSdkError("invalid_upload_file_name", "Upload fileName must not be empty.");
+  if (!Number.isSafeInteger(byteLength) || byteLength <= 0) {
+    throw new TopoloSdkError("invalid_upload_content", "Upload content must not be empty.");
+  }
+  if (byteLength > contract.maxBytes) {
+    throw new TopoloSdkError("upload_too_large", `Upload content exceeds the ${contract.maxBytes}-byte action limit.`);
+  }
+  if (!matchesContentType(contentType, contract.acceptedContentTypes)) {
+    throw new TopoloSdkError("unsupported_upload_content_type", `Content type "${contentType}" is not accepted by this action.`);
+  }
+}
+function decodedBase64Size(contentBase64) {
+  const padding = contentBase64.endsWith("==") ? 2 : contentBase64.endsWith("=") ? 1 : 0;
+  return contentBase64.length / 4 * 3 - padding;
+}
+function parseCompleteContract(value) {
+  if (!isRecord2(value)) throw new TopoloSdkError("invalid_upload_contract", "The action upload completion contract is invalid.");
+  return {
+    actionId: requiredPath(value.actionId, "complete.actionId"),
+    inputField: requiredField(value.inputField, "complete.inputField"),
+    responsePath: requiredPath(value.responsePath, "complete.responsePath")
+  };
+}
+function requiredPath(value, name) {
+  const path9 = typeof value === "string" ? value.trim() : "";
+  if (!/^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)*$/.test(path9)) {
+    throw new TopoloSdkError("invalid_upload_contract", `The action upload contract has an invalid ${name}.`);
+  }
+  return path9;
+}
+function unsupportedInlineProfile() {
+  return new TopoloSdkError("invalid_upload_contract", "This action does not publish an inline-base64 upload contract.");
+}
+function isCanonicalBase64(value) {
+  return value.length > 0 && value.length % 4 === 0 && /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value);
+}
+function requiredField(value, name) {
+  const field = typeof value === "string" ? value.trim() : "";
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(field)) {
+    throw new TopoloSdkError("invalid_upload_contract", `The action upload contract has an invalid ${name}.`);
+  }
+  return field;
+}
+function matchesContentType(contentType, accepted) {
+  return accepted.some((candidate) => candidate === "*/*" || candidate === contentType || candidate.endsWith("/*") && contentType.startsWith(candidate.slice(0, -1)));
+}
+function bytesToBase64(bytes) {
+  let binary = "";
+  const chunkSize = 32768;
+  for (let offset = 0; offset < bytes.length; offset += chunkSize) {
+    binary += String.fromCharCode(...bytes.subarray(offset, offset + chunkSize));
+  }
+  return btoa(binary);
+}
+function isRecord2(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
 var WRITE_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
 var TOPOLO_ACTION_ID_HEADER = "X-Topolo-Action-Id";
 var TOPOLO_ACTION_NAME_HEADER = "X-Topolo-Action-Name";
@@ -2517,6 +2800,9 @@ var TopoloClient = class _TopoloClient {
         if (v !== void 0) url.searchParams.set(k, String(v));
       }
     }
+    if (opts.body !== void 0 && opts.rawBody !== void 0) {
+      throw new TopoloSdkError("invalid_request_body", "body and rawBody are mutually exclusive.");
+    }
     const headers = new Headers();
     headers.set("Accept", "application/json");
     if (opts.body !== void 0) headers.set("Content-Type", "application/json");
@@ -2551,7 +2837,7 @@ var TopoloClient = class _TopoloClient {
         return await this.fetchImpl(urlStr, {
           method,
           headers: new Headers(headers),
-          body: opts.body !== void 0 ? JSON.stringify(opts.body) : null,
+          body: opts.rawBody ?? (opts.body !== void 0 ? JSON.stringify(opts.body) : null),
           signal
         });
       } finally {
@@ -2599,14 +2885,32 @@ var TopoloClient = class _TopoloClient {
         error: message,
         status: res.status
       });
-      if (res.status === 401) throw new TopoloAuthError(describeError(parsed, "Unauthorized"));
+      const errorContext = {
+        status: res.status,
+        body: parsed,
+        service: resolvedService.serviceKey,
+        path: opts.path,
+        requestId: res.headers.get("X-Topolo-Request-Id") || requestId,
+        retryAfter: res.headers.get("Retry-After") || void 0
+      };
+      if (res.status === 401) {
+        throw new TopoloAuthError(describeError(parsed, "Unauthorized"), "auth_error", errorContext);
+      }
       if (res.status === 403) {
         throw new TopoloPermissionError(
           describeError(parsed, "Permission denied"),
-          extractRequired(parsed)
+          extractRequired(parsed),
+          errorContext
         );
       }
-      throw new TopoloHttpError(resolvedService.serviceKey, opts.path, res.status, parsed);
+      throw new TopoloHttpError(
+        resolvedService.serviceKey,
+        opts.path,
+        res.status,
+        parsed,
+        message,
+        errorContext
+      );
     }
     this.emit({
       phase: "response",
@@ -2765,7 +3069,7 @@ var TopoloClient = class _TopoloClient {
     }
     const entries = [];
     for (const item of raw) {
-      if (!isRecord2(item)) continue;
+      if (!isRecord3(item)) continue;
       const s = item;
       const appId = typeof s.app_id === "string" ? s.app_id : typeof s.id === "string" ? s.id : null;
       if (!appId) continue;
@@ -2840,8 +3144,8 @@ var TopoloClient = class _TopoloClient {
       "app_topolo_auth.service_api_key_resources.list",
       { appId: service.appId }
     );
-    const payload = isRecord2(response) && isRecord2(response.data) ? response.data : response;
-    if (!isRecord2(payload) || !Array.isArray(payload.resources)) {
+    const payload = isRecord3(response) && isRecord3(response.data) ? response.data : response;
+    if (!isRecord3(payload) || !Array.isArray(payload.resources)) {
       throw new TopoloSdkError("resource_catalog_unavailable", "TopoloAuth did not return bindable resources.");
     }
     return {
@@ -2947,6 +3251,71 @@ var TopoloClient = class _TopoloClient {
     const entry = await this.getAction(action);
     return this.executeResolvedAction(entry, input3, options);
   }
+  async uploadAction(action, content, input3, options) {
+    const entry = await this.getAction(action);
+    const contract = parseTopoloActionUploadContract(entry.agentContract?.upload);
+    if (contract.profile === "url-session") {
+      const bytes = content instanceof Uint8Array ? content : new Uint8Array(content);
+      return this.executeUrlSessionUpload(entry, contract, bytes, input3, options);
+    }
+    const uploadInput = prepareTopoloActionUploadInput(entry.agentContract?.upload, content, input3, options);
+    return this.executeResolvedAction(entry, uploadInput, options);
+  }
+  async uploadActionBase64(action, contentBase64, input3, options) {
+    const entry = await this.getAction(action);
+    const contract = parseTopoloActionUploadContract(entry.agentContract?.upload);
+    if (contract.profile === "url-session") {
+      return this.executeUrlSessionUpload(entry, contract, decodeTopoloActionBase64(contentBase64), input3, options);
+    }
+    const uploadInput = prepareTopoloActionBase64UploadInput(entry.agentContract?.upload, contentBase64, input3, options);
+    return this.executeResolvedAction(entry, uploadInput, options);
+  }
+  async executeUrlSessionUpload(entry, contract, bytes, input3, options) {
+    const prepared = prepareTopoloUrlSessionUploadInput(contract, bytes.byteLength, input3, options);
+    const initiation = await this.executeResolvedAction(entry, prepared.input, options);
+    const uploadUrl = topoloUploadResponseValue(initiation, contract.uploadUrlPath);
+    if (typeof uploadUrl !== "string" || !uploadUrl.trim()) {
+      throw new TopoloSdkError("invalid_upload_response", `Upload action response is missing ${contract.uploadUrlPath}.`);
+    }
+    await this.putUrlSessionContent(entry, uploadUrl, contract.uploadMethod, bytes, options);
+    if (!contract.complete) return initiation;
+    const completionValue = topoloUploadResponseValue(initiation, contract.complete.responsePath);
+    if (typeof completionValue !== "string" || !completionValue.trim()) {
+      throw new TopoloSdkError("invalid_upload_response", `Upload action response is missing ${contract.complete.responsePath}.`);
+    }
+    const completion = await this.getAction(contract.complete.actionId);
+    return this.executeResolvedAction(completion, {
+      ...options.completionInput ?? {},
+      [contract.complete.inputField]: completionValue
+    }, options);
+  }
+  async putUrlSessionContent(entry, uploadUrl, method, bytes, options) {
+    const service = entry.appSlug || entry.appId;
+    const resolved = entry.apiBaseUrl ? { serviceKey: normalizeLookupKey(service), baseUrl: requireHttpOrigin(entry.apiBaseUrl) } : await this.resolveRequestService(service);
+    const target = new URL(uploadUrl, resolved.baseUrl.endsWith("/") ? resolved.baseUrl : `${resolved.baseUrl}/`);
+    const body = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+    if (target.origin === new URL(resolved.baseUrl).origin) {
+      await this.request({
+        service,
+        baseUrl: resolved.baseUrl,
+        path: target.toString(),
+        method,
+        rawBody: body,
+        headers: { "Content-Type": options.contentType.trim().toLowerCase() },
+        resource: options.resource,
+        confirm: options.confirm
+      });
+      return;
+    }
+    const response = await this.fetchImpl(target, {
+      method,
+      headers: { "Content-Type": options.contentType.trim().toLowerCase() },
+      body
+    });
+    if (!response.ok) {
+      throw new TopoloHttpError(service, target.pathname, response.status, await response.text(), `Upload transport failed with HTTP ${response.status}.`);
+    }
+  }
   async validateActionInput(action, input3 = {}) {
     const entry = await this.getAction(action);
     return { action: entry, validation: validateTopoloActionInput(entry.inputSchema, input3) };
@@ -3105,7 +3474,7 @@ function resolveConfiguredAppId(slug, appIds) {
   return null;
 }
 function normalizeApiKeyResourceMetadata(input3) {
-  if (!isRecord2(input3)) return null;
+  if (!isRecord3(input3)) return null;
   const resourceType = readString(input3.resourceType ?? input3.resource_type);
   const label = readString(input3.label);
   const emptyLabel = readString(input3.emptyLabel ?? input3.empty_label);
@@ -3139,7 +3508,7 @@ function normalizeApiKeyResourceMetadataList(input3) {
   return resources;
 }
 function normalizeBindableResource(input3) {
-  if (!isRecord2(input3)) return null;
+  if (!isRecord3(input3)) return null;
   const resourceType = readString(input3.resourceType ?? input3.resource_type);
   const resourceId = readString(input3.resourceId ?? input3.resource_id);
   if (!resourceType || !resourceId) return null;
@@ -3150,13 +3519,13 @@ function normalizeBindableResource(input3) {
     slug: readOptionalString(input3.slug),
     status: readOptionalString(input3.status),
     organizationId: readOptionalString(input3.organizationId ?? input3.organization_id),
-    metadata: isRecord2(input3.metadata) ? input3.metadata : {}
+    metadata: isRecord3(input3.metadata) ? input3.metadata : {}
   };
 }
 function normalizeResourceBindings(input3) {
   if (!Array.isArray(input3)) return [];
   return input3.flatMap((binding) => {
-    if (!isRecord2(binding)) return [];
+    if (!isRecord3(binding)) return [];
     const resourceType = readString(binding.resourceType ?? binding.resource_type);
     const resourceId = readString(binding.resourceId ?? binding.resource_id);
     return resourceType && resourceId ? [{ resourceType, resourceId }] : [];
@@ -3169,7 +3538,7 @@ function readOptionalString(value) {
   const normalized = readString(value);
   return normalized || null;
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function resolveConfiguredServiceUrl(slug, serviceUrls) {
@@ -3241,14 +3610,14 @@ function catalogSearchQuery(options) {
   return query;
 }
 function normalizeCatalogPage(value) {
-  if (!isRecord2(value)) return { nextCursor: null, hasMore: false };
+  if (!isRecord3(value)) return { nextCursor: null, hasMore: false };
   return {
     nextCursor: typeof value.nextCursor === "string" && value.nextCursor ? value.nextCursor : null,
     hasMore: value.hasMore === true
   };
 }
 function normalizeServiceCatalogEntry(item) {
-  if (!isRecord2(item)) return null;
+  if (!isRecord3(item)) return null;
   const appId = typeof item.app_id === "string" ? item.app_id : typeof item.id === "string" ? item.id : null;
   if (!appId) return null;
   const permissions = Array.isArray(item.granted_permissions) ? item.granted_permissions.filter(
@@ -3281,8 +3650,8 @@ function normalizeActionCatalogEntry(item) {
   const name = pickActionString(a.name);
   const appId = pickActionString(a.app_id) ?? pickActionString(a.appId);
   const method = pickActionString(a.method)?.toUpperCase();
-  const path8 = pickActionString(a.path);
-  if (!actionId || !name || !appId || !method || !path8 || !isHttpMethod(method)) {
+  const path9 = pickActionString(a.path);
+  if (!actionId || !name || !appId || !method || !path9 || !isHttpMethod(method)) {
     return null;
   }
   return {
@@ -3297,7 +3666,7 @@ function normalizeActionCatalogEntry(item) {
     appSlug: pickActionString(a.app_slug) ?? pickActionString(a.appSlug) ?? null,
     appName: pickActionString(a.app_name) ?? pickActionString(a.appName) ?? null,
     method,
-    path: path8,
+    path: path9,
     permissionName: pickActionString(a.permission_name) ?? pickActionString(a.permissionName) ?? "",
     requiredPermission: pickActionString(a.required_permission) ?? pickActionString(a.requiredPermission) ?? "",
     authorizationMode: pickAuthorizationMode(a.authorization_mode ?? a.authorizationMode),
@@ -3333,7 +3702,7 @@ function stringArray(value) {
 }
 function mapActionInput(action, input3) {
   const remaining = { ...input3 || {} };
-  const path8 = action.path.replace(/\{([a-zA-Z0-9_]+)\}/g, (_match, key) => {
+  const path9 = action.path.replace(/\{([a-zA-Z0-9_]+)\}/g, (_match, key) => {
     const value = remaining[key];
     if (value === void 0 || value === null || value === "") {
       throw new TopoloSdkError(
@@ -3350,14 +3719,14 @@ function mapActionInput(action, input3) {
   delete remaining.body;
   if (action.method === "GET") {
     return {
-      path: path8,
+      path: path9,
       query: objectToQuery({ ...remaining, ...explicitQuery })
     };
   }
   const query = objectToQuery(explicitQuery);
   const body = explicitBody !== void 0 ? explicitBody : remaining;
   return {
-    path: path8,
+    path: path9,
     ...query ? { query } : {},
     body
   };
@@ -3527,8 +3896,8 @@ var TopoloOAuth = class {
     if (params.clientSecret) body.set("client_secret", params.clientSecret);
     return this.#postForm("/api/developer-oauth/token", body);
   }
-  async #postForm(path8, body) {
-    const url = new URL(path8, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
+  async #postForm(path9, body) {
+    const url = new URL(path9, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
     const res = await this.fetchImpl(url.toString(), {
       method: "POST",
       headers: {
@@ -3544,7 +3913,7 @@ var TopoloOAuth = class {
         const err = parsed;
         throw new TopoloAuthError(err.error_description || err.error, err.error);
       }
-      throw new TopoloHttpError("auth", path8, res.status, parsed);
+      throw new TopoloHttpError("auth", path9, res.status, parsed);
     }
     return parsed;
   }
@@ -3572,29 +3941,57 @@ var TopoloSdkError2 = class extends Error {
   }
 };
 var TopoloAuthError2 = class extends TopoloSdkError2 {
-  constructor(message, code = "auth_error") {
+  status;
+  body;
+  service;
+  path;
+  requestId;
+  retryAfter;
+  constructor(message, code = "auth_error", options = {}) {
     super(code, message);
     this.name = "TopoloAuthError";
+    this.status = options.status ?? 401;
+    this.body = options.body;
+    this.service = options.service;
+    this.path = options.path;
+    this.requestId = options.requestId;
+    this.retryAfter = options.retryAfter;
   }
 };
+function extractHttpErrorCode2(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return "http_error";
+  const record4 = body;
+  if (typeof record4.code === "string" && record4.code.trim()) return record4.code.trim();
+  const nested = record4.error;
+  if (nested && typeof nested === "object" && !Array.isArray(nested)) {
+    const code = nested.code;
+    if (typeof code === "string" && code.trim()) return code.trim();
+  }
+  return "http_error";
+}
 var TopoloHttpError2 = class extends TopoloSdkError2 {
   status;
   body;
   service;
   path;
-  constructor(service, path8, status, body, message) {
-    super("http_error", message ?? `HTTP ${status} from ${service}${path8}`);
+  requestId;
+  retryAfter;
+  constructor(service, path9, status, body, message, options = {}) {
+    super(extractHttpErrorCode2(body), message ?? `HTTP ${status} from ${service}${path9}`);
     this.name = "TopoloHttpError";
     this.status = status;
     this.body = body;
     this.service = service;
-    this.path = path8;
+    this.path = path9;
+    this.requestId = options.requestId;
+    this.retryAfter = options.retryAfter;
   }
 };
 var APP_API_URLS2 = {
   agent: "https://agent.topolo.app",
   auth: "https://auth.topolo.app",
   backup: "https://backup.topolo.app",
+  blog: "https://blog.topolo.app",
   books: "https://books.topolo.app",
   brand: "https://brand.topolo.app",
   bugfix: "https://bugfix.topolo.app",
@@ -3607,6 +4004,7 @@ var APP_API_URLS2 = {
   compose: "https://compose.topolo.app",
   consent: "https://consent.topolo.app",
   crm: "https://crm.topolo.app",
+  design: "https://design.topolo.app",
   developers: "https://developers.topolo.app",
   director: "https://director.topolo.app",
   feed: "https://feed.topolo.app",
@@ -3719,8 +4117,8 @@ var TopoloOAuth2 = class {
     if (params.clientSecret) body.set("client_secret", params.clientSecret);
     return this.#postForm("/api/developer-oauth/token", body);
   }
-  async #postForm(path8, body) {
-    const url = new URL(path8, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
+  async #postForm(path9, body) {
+    const url = new URL(path9, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
     const res = await this.fetchImpl(url.toString(), {
       method: "POST",
       headers: {
@@ -3736,7 +4134,7 @@ var TopoloOAuth2 = class {
         const err = parsed;
         throw new TopoloAuthError2(err.error_description || err.error, err.error);
       }
-      throw new TopoloHttpError2("auth", path8, res.status, parsed);
+      throw new TopoloHttpError2("auth", path9, res.status, parsed);
     }
     return parsed;
   }
@@ -3766,22 +4164,22 @@ function configPath() {
   return join(base, "topolo", "config.json");
 }
 async function readConfig() {
-  const path8 = configPath();
-  if (!existsSync(path8)) return {};
+  const path9 = configPath();
+  if (!existsSync(path9)) return {};
   try {
-    const raw = await readFile(path8, "utf8");
+    const raw = await readFile(path9, "utf8");
     return JSON.parse(raw);
   } catch {
     return {};
   }
 }
 async function writeConfig(config) {
-  const path8 = configPath();
-  await mkdir(dirname(path8), { recursive: true });
-  await writeFile(path8, JSON.stringify(config, null, 2) + "\n", "utf8");
+  const path9 = configPath();
+  await mkdir(dirname(path9), { recursive: true });
+  await writeFile(path9, JSON.stringify(config, null, 2) + "\n", "utf8");
   if (platform() !== "win32") {
     try {
-      await chmod(path8, 384);
+      await chmod(path9, 384);
     } catch {
     }
   }
@@ -4065,6 +4463,10 @@ function fail(err, mode) {
     process.stderr.write(`Error: ${payload.message}
 `);
     if (payload.code) process.stderr.write(`Code:  ${payload.code}
+`);
+    if (payload.status) process.stderr.write(`HTTP:  ${payload.status}
+`);
+    if (payload.requestId) process.stderr.write(`Request: ${payload.requestId}
 `);
     if (payload.hint) process.stderr.write(`Hint:  ${payload.hint}
 `);
@@ -4083,6 +4485,12 @@ function normalizeError(err) {
     return {
       message: err.message,
       code,
+      status: err.status,
+      service: err.service,
+      path: err.path,
+      requestId: err.requestId,
+      retryAfter: err.retryAfter,
+      details: err.body,
       hint: code ? hintMap[code] : void 0,
       exitCode: code === "auth_error" || code === "confirmation_required" ? 2 : code === "permission_denied" ? 3 : code === "immutable_drift" ? 4 : 1
     };
@@ -4101,9 +4509,9 @@ function readCliVersion() {
       join2(here, "package.json"),
       join2(here, "..", "package.json")
     ];
-    for (const path8 of candidates) {
+    for (const path9 of candidates) {
       try {
-        const pkg = JSON.parse(readFileSync(path8, "utf8"));
+        const pkg = JSON.parse(readFileSync(path9, "utf8"));
         if (typeof pkg.version === "string" && pkg.version) return pkg.version;
       } catch {
       }
@@ -4451,6 +4859,7 @@ function formatPretty(info) {
 
 // src/commands/actions.ts
 import { readFileSync as readFileSync2 } from "fs";
+import { basename, extname } from "path";
 
 // src/commands/api.ts
 var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
@@ -4462,7 +4871,7 @@ function registerApiCommand(program2) {
     "-q, --query <kv...>",
     "Query params as key=value (repeatable), e.g. --query source=cli page=2"
   ).option("--resource-type <type>", "Cataloged app-local workspace resource alias for resource-scoped API keys").option("--resource-id <id>", "Workspace resource id for resource-scoped API keys").option("--confirm", "Acknowledge a mutating request").option("--json", "Output JSON", true).option("--no-json", "Output human-readable text").action(
-    async (service, method, path8, opts) => {
+    async (service, method, path9, opts) => {
       const mode = resolveOutputMode(opts.json);
       try {
         const upperMethod = method.toUpperCase();
@@ -4501,7 +4910,7 @@ function registerApiCommand(program2) {
         const result = await topolo.client.request({
           service,
           method: httpMethod,
-          path: path8,
+          path: path9,
           body,
           ...query ? { query } : {},
           ...resource ? { resource } : {},
@@ -4605,6 +5014,30 @@ function registerActionsCommand(program2) {
       fail(err, mode);
     }
   });
+  actions.command("upload <action>").description("Upload one local file through an action-declared upload contract").requiredOption("--file <path>", "Local file to upload").option("--content-type <type>", "MIME type; inferred for common file extensions").option("-d, --data <json-or-@file>", "Additional JSON action input or @path to a JSON file", "{}").option("--complete-data <json-or-@file>", "Additional input for a declared completion action", "{}").option("--resource-type <type>", "App-local resource alias, such as workspace").option("--resource-id <id>", "Resource id for the selected resource type").option("--confirm", "Acknowledge a mutating upload action").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (action, opts, command) => {
+    const mode = resolveOutputMode(opts.json ?? command.parent?.opts().json);
+    try {
+      const topolo = await requiredClient();
+      const contentType = opts.contentType?.trim().toLowerCase() || inferContentType(opts.file);
+      if (!contentType) throw new Error("--content-type is required for this file extension");
+      const resource = parseResourceOption(opts.resourceType, opts.resourceId);
+      const result = await topolo.client.uploadAction(
+        action,
+        readFileSync2(opts.file),
+        parseJsonObject(opts.data || "{}"),
+        {
+          fileName: basename(opts.file),
+          contentType,
+          completionInput: parseJsonObject(opts.completeData || "{}"),
+          confirm: opts.confirm === true,
+          ...resource ? { resource } : {}
+        }
+      );
+      emit(result, mode, () => JSON.stringify(result, null, 2));
+    } catch (err) {
+      fail(err, mode);
+    }
+  });
   actions.command("validate <action>").description("Validate action input locally against the published JSON Schema").option("-d, --data <json-or-@file>", "JSON action input or @path to a JSON file", "{}").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (action, opts, command) => {
     const mode = resolveOutputMode(opts.json ?? command.parent?.opts().json);
     try {
@@ -4665,13 +5098,13 @@ async function requiredClient() {
 function parseJsonObject(value) {
   let source = value;
   if (value.startsWith("@")) {
-    const path8 = value.slice(1);
-    if (!path8) throw new Error("--data @file path must not be empty");
+    const path9 = value.slice(1);
+    if (!path9) throw new Error("--data @file path must not be empty");
     try {
-      source = readFileSync2(path8, "utf8");
+      source = readFileSync2(path9, "utf8");
     } catch (err) {
       const detail = err instanceof Error ? err.message : String(err);
-      throw new Error(`Could not read --data file ${path8}: ${detail}`);
+      throw new Error(`Could not read --data file ${path9}: ${detail}`);
     }
   }
   let parsed;
@@ -4685,6 +5118,21 @@ function parseJsonObject(value) {
   }
   return parsed;
 }
+function inferContentType(path9) {
+  return {
+    ".avif": "image/avif",
+    ".gif": "image/gif",
+    ".heic": "image/heic",
+    ".jpeg": "image/jpeg",
+    ".jpg": "image/jpeg",
+    ".mov": "video/quicktime",
+    ".mp4": "video/mp4",
+    ".pdf": "application/pdf",
+    ".png": "image/png",
+    ".svg": "image/svg+xml",
+    ".webp": "image/webp"
+  }[extname(path9).toLowerCase()] ?? null;
+}
 function formatActionRows(rows, nextCursor = null) {
   if (rows.length === 0) return "No actions available for this credential.";
   const serviceWidth = Math.max(7, ...rows.map((row) => (row.appSlug || row.appId).length));
@@ -4745,8 +5193,8 @@ function formatActionPlan(plan) {
 
 // src/commands/apps.ts
 import { execSync } from "child_process";
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
-import path5 from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync2 } from "fs";
+import path6 from "path";
 
 // src/commands/app-audit-local.ts
 import {
@@ -5883,14 +6331,14 @@ import { constants } from "fs";
 import { access } from "fs/promises";
 import { relative, resolve } from "path";
 function normalizeHomePath(value) {
-  const path8 = String(value || "/dashboard").trim();
-  if (!path8.startsWith("/") || path8.startsWith("//") || /[?#]/.test(path8)) {
+  const path9 = String(value || "/dashboard").trim();
+  if (!path9.startsWith("/") || path9.startsWith("//") || /[?#]/.test(path9)) {
     throw new Error("Invalid home path. Use an absolute application path such as /dashboard.");
   }
-  if (["/", "/login", "/auth/callback", "/getting-started"].includes(path8)) {
+  if (["/", "/login", "/auth/callback", "/getting-started"].includes(path9)) {
     throw new Error("Home path must be a protected product route, not a reserved entry route.");
   }
-  return path8.replace(/\/$/, "") || "/dashboard";
+  return path9.replace(/\/$/, "") || "/dashboard";
 }
 function normalizeHomeLabel(value) {
   const label = String(value || "Dashboard").trim();
@@ -6021,9 +6469,9 @@ function toTitle(value) {
 function json(value) {
   return JSON.stringify(value, null, 2);
 }
-async function pathExists(path8) {
+async function pathExists(path9) {
   try {
-    await access(path8, constants.F_OK);
+    await access(path9, constants.F_OK);
     return true;
   } catch {
     return false;
@@ -6053,6 +6501,54 @@ function firstPartyAppPath(appDir, _audience) {
   return `apps/${appDir}`;
 }
 
+// src/commands/app-scaffold-platform-versions.ts
+import { readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
+import path2 from "path";
+var versionCache = /* @__PURE__ */ new Map();
+function platformPackagePin(packageName, options = {}) {
+  const workspaceRoot = resolveTopoloRepoRoot(
+    options.repoRoot ?? process.env.TOPOLO_WORKSPACE_ROOT ?? void 0,
+    options.cwd ?? process.cwd()
+  );
+  if (!workspaceRoot) {
+    throw new Error(
+      `Cannot resolve a concrete version for ${packageName}: platform-target scaffolds must run inside the Topolo workspace checkout (a directory containing apps/ and system-apps/), or receive --repo-root. The fleet pinning policy requires exact ^<latest> pins, never "latest".`
+    );
+  }
+  const version = platformPackageVersions(workspaceRoot).get(packageName);
+  if (!version) {
+    throw new Error(
+      `Unknown Topolo platform package: ${packageName} \u2014 no published package with that name under ${path2.join(workspaceRoot, "topolo-platform", "packages")}.`
+    );
+  }
+  return `^${version}`;
+}
+function platformPackageVersions(workspaceRoot) {
+  const packagesRoot = path2.join(workspaceRoot, "topolo-platform", "packages");
+  const cached = versionCache.get(packagesRoot);
+  if (cached) return cached;
+  const versions = /* @__PURE__ */ new Map();
+  let entries = [];
+  try {
+    entries = readdirSync2(packagesRoot);
+  } catch {
+  }
+  for (const entry of entries) {
+    let packageJson2;
+    try {
+      packageJson2 = JSON.parse(readFileSync4(path2.join(packagesRoot, entry, "package.json"), "utf8"));
+    } catch {
+      continue;
+    }
+    const version = packageJson2.topoloPublishedVersion || packageJson2.version;
+    if (packageJson2.name && /^@topolo(-io)?\//.test(packageJson2.name) && !packageJson2.private && version) {
+      versions.set(packageJson2.name, version);
+    }
+  }
+  versionCache.set(packagesRoot, versions);
+  return versions;
+}
+
 // src/commands/app-scaffold-cloudflare-constants.ts
 var CLOUDFLARE_ACCOUNT_ID = "49ef1ba682ad8cfd720c86699ae17521";
 var STAGING_CLOUDFLARE_ACCOUNT_ID = "4f4e1c69a3830946f9fea7b1eb7531ac";
@@ -6085,7 +6581,7 @@ function packageJson(application, target, options) {
       devDependencies.tailwindcss = "3.4.19";
       dependencies["react-router-dom"] = "^7.6.2";
     } else {
-      dependencies["@topolo/login"] = topoloPackageVersion("@topolo/login", target);
+      dependencies["@topolo/login"] = topoloPackageVersion("@topolo/login", target, options.repoRoot);
     }
   }
   if (options.api) {
@@ -6097,13 +6593,13 @@ function packageJson(application, target, options) {
       scripts["deploy:staging"] = `DEPLOY_ENVIRONMENT=staging CLOUDFLARE_ACCOUNT_ID=${STAGING_CLOUDFLARE_ACCOUNT_ID} python3 .github/scripts/standard_deploy.py local-deploy`;
       scripts["deploy:production"] = `DEPLOY_ENVIRONMENT=production CLOUDFLARE_ACCOUNT_ID=${CLOUDFLARE_ACCOUNT_ID} python3 .github/scripts/standard_deploy.py local-deploy`;
     } else {
-      dependencies["@topolo/sdk"] = topoloPackageVersion("@topolo/sdk", target);
+      dependencies["@topolo/sdk"] = topoloPackageVersion("@topolo/sdk", target, options.repoRoot);
       scripts.deploy = "npm run build && wrangler deploy";
     }
     devDependencies.wrangler = "^4.91.0";
   }
   for (const packageName of options.packages) {
-    dependencies[packageName] = topoloPackageVersion(packageName, target);
+    dependencies[packageName] = topoloPackageVersion(packageName, target, options.repoRoot);
   }
   if (target === "platform") {
     const testDirs = [];
@@ -6145,14 +6641,16 @@ function packageJson(application, target, options) {
   })}
 `;
 }
-function topoloPackageVersion(packageName, target) {
+function topoloPackageVersion(packageName, target, repoRoot) {
   if (target === "developer") {
     if (packageName === "@topolo/login") return "^0.1.0";
     if (packageName === "@topolo-io/auth-client") return "^1.0.0";
     if (packageName === "@topolo/sdk") return "^0.8.1";
     return "^0.1.0";
   }
-  if (packageName.startsWith("@topolo/") || packageName.startsWith("@topolo-io/")) return "latest";
+  if (packageName.startsWith("@topolo/") || packageName.startsWith("@topolo-io/")) {
+    return platformPackagePin(packageName, { repoRoot });
+  }
   throw new Error(`Unknown Topolo platform package: ${packageName}`);
 }
 function hasScaffoldResources(resources) {
@@ -8121,10 +8619,10 @@ function developerWorkerTs(application) {
 }
 
 // src/commands/app-scaffold-generate.ts
-import { existsSync as existsSync3, mkdirSync, mkdtempSync, readFileSync as readFileSync4, rmSync, writeFileSync } from "fs";
+import { existsSync as existsSync3, mkdirSync, mkdtempSync, readFileSync as readFileSync5, rmSync, writeFileSync } from "fs";
 import { spawnSync } from "child_process";
 import { tmpdir } from "os";
-import path2 from "path";
+import path3 from "path";
 function resolveGeneratorPath() {
   const candidates = [
     // Published CLI: vendored alongside dist/index.js at build time.
@@ -8151,18 +8649,18 @@ var GENERATED = {
 };
 function deriveGeneratedConfigs(files, base) {
   const generator = resolveGeneratorPath();
-  const root = mkdtempSync(path2.join(tmpdir(), "topolo-scaffold-generate-"));
+  const root = mkdtempSync(path3.join(tmpdir(), "topolo-scaffold-generate-"));
   try {
     const prefix = `${base}/`;
     for (const file of files) {
       if (!file.path.startsWith(prefix)) continue;
-      const abs = path2.join(root, file.path.slice(prefix.length));
-      mkdirSync(path2.dirname(abs), { recursive: true });
+      const abs = path3.join(root, file.path.slice(prefix.length));
+      mkdirSync(path3.dirname(abs), { recursive: true });
       writeFileSync(abs, file.content, "utf8");
     }
     const result = spawnSync(
       process.execPath,
-      [generator, `--manifest=${path2.join(root, "topolo.app.json")}`],
+      [generator, `--manifest=${path3.join(root, "topolo.app.json")}`],
       { cwd: root, encoding: "utf8" }
     );
     if (result.status !== 0) {
@@ -8179,7 +8677,7 @@ ${result.stdout ?? ""}`);
     return written.map((rel) => ({
       path: `${base}/${rel}`,
       ...GENERATED,
-      content: readFileSync4(path2.join(root, rel), "utf8")
+      content: readFileSync5(path3.join(root, rel), "utf8")
     }));
   } finally {
     rmSync(root, { recursive: true, force: true });
@@ -9413,7 +9911,8 @@ function applicationScaffoldPayload(application, options = {}) {
       target,
       browser,
       api,
-      ciWorkflow
+      ciWorkflow,
+      repoRoot: options.repoRoot
     }),
     commands: scaffoldCommands({
       id,
@@ -9501,7 +10000,8 @@ function scaffoldFiles(options) {
         browser: options.browser,
         api: options.api,
         resources: options.payload.resources,
-        packages: options.payload.capabilityComposition.packages
+        packages: options.payload.capabilityComposition.packages,
+        repoRoot: options.repoRoot
       })
     },
     {
@@ -10312,18 +10812,18 @@ import { join as join3 } from "path";
 
 // src/commands/app-reconcile.ts
 import { readFile as readFile4, writeFile as writeFile5 } from "fs/promises";
-import path4 from "path";
+import path5 from "path";
 import { createInterface as createInterface2 } from "readline/promises";
 import { stdin as input2, stdout as output } from "process";
 
 // src/commands/app-capability-composition.ts
 import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile4 } from "fs/promises";
-import path3 from "path";
+import path4 from "path";
 async function reconcileApplicationCapabilitySource(options) {
-  const manifestPath = path3.resolve(options.manifestPath || "topolo.app.json");
-  const root = path3.dirname(manifestPath);
-  const packagePath = path3.join(root, "package.json");
-  const contractPath = path3.join(root, "topolo.capability-contract.json");
+  const manifestPath = path4.resolve(options.manifestPath || "topolo.app.json");
+  const root = path4.dirname(manifestPath);
+  const packagePath = path4.join(root, "package.json");
+  const contractPath = path4.join(root, "topolo.capability-contract.json");
   const manifest = parseRecord(await readFile3(manifestPath, "utf8"), manifestPath);
   const registration = record(manifest.registration);
   if (!registration) throw new Error("topolo.app.json must declare registration before capability composition.");
@@ -10368,7 +10868,7 @@ async function reconcileApplicationCapabilitySource(options) {
   const nextDependencies = { ...dependencies };
   for (const packageName of capabilities.packages) {
     if (typeof nextDependencies[packageName] !== "string") {
-      nextDependencies[packageName] = packageVersion(packageName, target);
+      nextDependencies[packageName] = packageVersion(packageName, target, { repoRoot: options.repoRoot, cwd: root });
     }
   }
   const sortedDependencies = sortRecord(nextDependencies);
@@ -10378,9 +10878,9 @@ async function reconcileApplicationCapabilitySource(options) {
   compareChange(changes, "topolo.capability-contract.json", existingContract, expectedContract);
   const adapter = target === "platform" ? managedCapabilityAdapter(capabilities.selected) : null;
   const apiDirectory = resolveApiDirectory(root, manifest, target);
-  const adapterPath = path3.join(apiDirectory, "src", "topolo-capabilities.ts");
+  const adapterPath = path4.join(apiDirectory, "src", "topolo-capabilities.ts");
   if (adapter) compareChange(changes, relativePath(root, adapterPath), await readOptionalText(adapterPath), adapter);
-  const pricingPath = path3.join(root, "pricing-manifest.json");
+  const pricingPath = path4.join(root, "pricing-manifest.json");
   const pricingManifest = capabilities.selected.includes("billing") ? defaultPricingManifest({
     appId: String(manifest.appId || manifest.app_id || "").trim(),
     displayName: String(registration.displayName || manifest.name || "Application"),
@@ -10392,7 +10892,7 @@ async function reconcileApplicationCapabilitySource(options) {
   const missingResources = capabilities.resources.filter((resource) => !manifestProvidesResource(manifest, resource));
   const verticalConfiguration = [];
   for (const [capability2, fileName, description] of VERTICAL_CAPABILITY_FILES) {
-    if (capabilities.selected.includes(capability2) && !await fileExists(path3.join(root, fileName))) {
+    if (capabilities.selected.includes(capability2) && !await fileExists(path4.join(root, fileName))) {
       verticalConfiguration.push(`${fileName}: ${description}`);
     }
   }
@@ -10407,7 +10907,7 @@ async function reconcileApplicationCapabilitySource(options) {
     await writeJson(contractPath, expectedContract);
     if (pricingManifest) await writeJson(pricingPath, pricingManifest);
     if (adapter) {
-      await mkdir3(path3.dirname(adapterPath), { recursive: true });
+      await mkdir3(path4.dirname(adapterPath), { recursive: true });
       await writeFile4(adapterPath, adapter, "utf8");
     }
   }
@@ -10510,11 +11010,8 @@ function manifestProvidesResource(manifest, resource) {
   }
   return false;
 }
-function packageVersion(packageName, target) {
-  if (target === "platform") {
-    if (packageName === "@topolo-io/notifications") return "^0.6.8";
-    return "latest";
-  }
+function packageVersion(packageName, target, resolution) {
+  if (target === "platform") return platformPackagePin(packageName, resolution);
   if (packageName === "@topolo/login") return "^0.1.0";
   if (packageName === "@topolo/sdk") return "^0.8.1";
   throw new Error(`Capability registry exposed private package ${packageName} to a third-party application.`);
@@ -10591,13 +11088,13 @@ function resolveApiDirectory(root, manifest, target) {
   for (const value of Object.values(record(manifest.targets) ?? {})) {
     const targetRecord = record(value);
     if (targetRecord?.kind === "worker" && !targetRecord.assets && typeof targetRecord.dir === "string") {
-      return path3.resolve(root, targetRecord.dir);
+      return path4.resolve(root, targetRecord.dir);
     }
   }
-  return path3.join(root, "apps", "api");
+  return path4.join(root, "apps", "api");
 }
 function relativePath(root, filePath) {
-  return path3.relative(root, filePath).split(path3.sep).join("/");
+  return path4.relative(root, filePath).split(path4.sep).join("/");
 }
 
 // src/commands/app-reconcile.ts
@@ -10667,7 +11164,7 @@ function titleFromSlug(value) {
   return value.replace(/^topolo[-_]/, "").split(/[-_]+/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
 }
 async function completeApplicationRegistrationInteractively(options) {
-  const manifestPath = path4.resolve(options.manifestPath || "topolo.app.json");
+  const manifestPath = path5.resolve(options.manifestPath || "topolo.app.json");
   const manifest = JSON.parse(await readFile4(manifestPath, "utf8"));
   const existing = record2(manifest.registration) || {};
   const appId = String(manifest.appId || manifest.app_id || "").trim();
@@ -10747,7 +11244,7 @@ async function completeApplicationRegistrationInteractively(options) {
   }
 }
 async function loadApplicationReconcileRequest(options) {
-  const manifestPath = path4.resolve(options.manifestPath || "topolo.app.json");
+  const manifestPath = path5.resolve(options.manifestPath || "topolo.app.json");
   const raw = await readFile4(manifestPath, "utf8");
   const manifest = JSON.parse(raw);
   assertRegistration(manifest.registration);
@@ -11151,7 +11648,7 @@ function applicationAuditPayload(application, options = {}) {
 }
 function recordApplicationEvidence(application, options = {}) {
   const appId = resolveApplication(application).id;
-  const root = path5.resolve(options.appRoot ?? process.cwd());
+  const root = path6.resolve(options.appRoot ?? process.cwd());
   if (!existsSync4(root)) {
     throw new Error(`Application root does not exist: ${root}`);
   }
@@ -11163,12 +11660,12 @@ function recordApplicationEvidence(application, options = {}) {
       commit = void 0;
     }
   }
-  const evidenceDir = path5.join(root, ".topolo");
-  const evidencePath = path5.join(evidenceDir, "evidence.json");
+  const evidenceDir = path6.join(root, ".topolo");
+  const evidencePath = path6.join(evidenceDir, "evidence.json");
   let before = null;
   if (existsSync4(evidencePath)) {
     try {
-      const raw = JSON.parse(readFileSync5(evidencePath, "utf8"));
+      const raw = JSON.parse(readFileSync6(evidencePath, "utf8"));
       if (raw && typeof raw === "object" && raw.version === 1) {
         before = raw;
       }
@@ -11463,14 +11960,14 @@ function statusesAtOrWorse(threshold) {
 }
 
 // src/commands/platform.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync6, statSync as statSync2 } from "fs";
-import path7 from "path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync7, statSync as statSync2 } from "fs";
+import path8 from "path";
 
 // src/commands/app-capability-provision.ts
 import { readFile as readFile5, writeFile as writeFile6 } from "fs/promises";
-import path6 from "path";
+import path7 from "path";
 async function provisionApplicationResources(options) {
-  const manifestPath = path6.resolve(options.manifestPath || "topolo.app.json");
+  const manifestPath = path7.resolve(options.manifestPath || "topolo.app.json");
   const manifest = parseRecord2(await readFile5(manifestPath, "utf8"), manifestPath);
   const environments = requiredRecord(manifest.environments, "topolo.app.json#environments");
   const environment = requiredRecord(environments[options.environment], `topolo.app.json#environments.${options.environment}`);
@@ -11675,7 +12172,8 @@ function registerPlatformCommand(program2) {
         navigationMode: opts.navigationMode,
         workspaceSwitcher: opts.workspaceSwitcher,
         uiTemplate: opts.uiTemplate,
-        tagline: opts.tagline
+        tagline: opts.tagline,
+        repoRoot: opts.repoRoot
       });
       if (opts.workflowOnly && !payload.ciWorkflow) {
         throw new Error("--workflow-only is only available for first-party scaffolds.");
@@ -11742,29 +12240,29 @@ var SKIPPED_SCAN_DIRS = /* @__PURE__ */ new Set([
   "output"
 ]);
 function scanStagingProductionUrls(rootInput, allowPatterns) {
-  const root = path7.resolve(rootInput);
+  const root = path8.resolve(rootInput);
   const allowlist = allowPatterns.map((pattern) => new RegExp(pattern));
   const violations = [];
   function shouldSkipFile(filePath) {
-    const basename = path7.basename(filePath);
-    const relativePath2 = path7.relative(root, filePath);
-    if (basename === "package-lock.json" || basename === "pnpm-lock.yaml" || basename === "yarn.lock") return true;
-    if (basename === "topolo.cloudcontrol.json") return true;
-    if (basename === "wrangler.toml" || basename === "wrangler.jsonc") return true;
-    if (basename === "consumer-graph.json") return true;
-    if (/^cloudcontrol-deployment-report-.+\.json$/.test(basename)) return true;
-    if (basename.endsWith(".generated.ts")) return true;
-    if (basename.endsWith(".test.ts") || basename.endsWith(".test.tsx") || basename.endsWith(".spec.ts")) return true;
-    if (basename === ".env.production") return true;
-    if (relativePath2 === path7.join("src", "environment.ts") || relativePath2 === path7.join("src", "environmentUrls.ts") || relativePath2.endsWith(path7.join("src", "environment.ts")) || relativePath2.endsWith(path7.join("src", "lib", "environment.ts")) || relativePath2 === path7.join("packages", "topolo-ui-kit", "src", "environmentUrls.ts")) return true;
-    if (relativePath2.includes(`${path7.sep}test${path7.sep}`) || relativePath2.includes(`${path7.sep}tests${path7.sep}`) || relativePath2.includes(`${path7.sep}e2e${path7.sep}`)) return true;
-    if (relativePath2.startsWith(`scripts${path7.sep}`) || relativePath2.includes(`${path7.sep}scripts${path7.sep}`)) return true;
-    return !RUNTIME_EXTENSIONS.has(path7.extname(filePath));
+    const basename2 = path8.basename(filePath);
+    const relativePath2 = path8.relative(root, filePath);
+    if (basename2 === "package-lock.json" || basename2 === "pnpm-lock.yaml" || basename2 === "yarn.lock") return true;
+    if (basename2 === "topolo.cloudcontrol.json") return true;
+    if (basename2 === "wrangler.toml" || basename2 === "wrangler.jsonc") return true;
+    if (basename2 === "consumer-graph.json") return true;
+    if (/^cloudcontrol-deployment-report-.+\.json$/.test(basename2)) return true;
+    if (basename2.endsWith(".generated.ts")) return true;
+    if (basename2.endsWith(".test.ts") || basename2.endsWith(".test.tsx") || basename2.endsWith(".spec.ts")) return true;
+    if (basename2 === ".env.production") return true;
+    if (relativePath2 === path8.join("src", "environment.ts") || relativePath2 === path8.join("src", "environmentUrls.ts") || relativePath2.endsWith(path8.join("src", "environment.ts")) || relativePath2.endsWith(path8.join("src", "lib", "environment.ts")) || relativePath2 === path8.join("packages", "topolo-ui-kit", "src", "environmentUrls.ts")) return true;
+    if (relativePath2.includes(`${path8.sep}test${path8.sep}`) || relativePath2.includes(`${path8.sep}tests${path8.sep}`) || relativePath2.includes(`${path8.sep}e2e${path8.sep}`)) return true;
+    if (relativePath2.startsWith(`scripts${path8.sep}`) || relativePath2.includes(`${path8.sep}scripts${path8.sep}`)) return true;
+    return !RUNTIME_EXTENSIONS.has(path8.extname(filePath));
   }
   function scanFile(filePath) {
     if (shouldSkipFile(filePath)) return;
-    const relativePath2 = path7.relative(root, filePath);
-    const content = readFileSync6(filePath, "utf8");
+    const relativePath2 = path8.relative(root, filePath);
+    const content = readFileSync7(filePath, "utf8");
     const lines = content.split(/\r?\n/);
     lines.forEach((line, index) => {
       const matches = [...line.matchAll(PRODUCTION_TOPOLO_URL_PATTERN)].map((match) => match[0]);
@@ -11777,8 +12275,8 @@ function scanStagingProductionUrls(rootInput, allowPatterns) {
     });
   }
   function walk(dir) {
-    for (const entry of readdirSync2(dir, { withFileTypes: true })) {
-      const fullPath = path7.join(dir, entry.name);
+    for (const entry of readdirSync3(dir, { withFileTypes: true })) {
+      const fullPath = path8.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (!SKIPPED_SCAN_DIRS.has(entry.name)) walk(fullPath);
         continue;
@@ -11946,7 +12444,7 @@ var DEFAULT_SEED_BASE_URL = "https://seed.stg.topolo.us";
 function seedBaseUrl() {
   return process.env.TOPOLO_SEED_URL || DEFAULT_SEED_BASE_URL;
 }
-async function authedFetch(path8, init = {}) {
+async function authedFetch(path9, init = {}) {
   const credential = await refreshCredentialIfNeeded("staging");
   if (!credential) {
     throw new Error("No staging credential configured. Run `topolo auth login --env staging` or set TOPOLO_STAGING_API_KEY.");
@@ -11956,7 +12454,7 @@ async function authedFetch(path8, init = {}) {
   else headers.set("Authorization", `Bearer ${credential.accessToken}`);
   headers.set("X-Topolo-Client", `topolo-cli/${CLI_VERSION}`);
   if (init.body && !headers.has("Content-Type")) headers.set("Content-Type", "application/json");
-  const response = await fetch(`${seedBaseUrl()}${path8}`, { ...init, headers });
+  const response = await fetch(`${seedBaseUrl()}${path9}`, { ...init, headers });
   const text = await response.text();
   let body;
   try {
@@ -12233,7 +12731,7 @@ function createOAuthClientPayload(options) {
     logo_url: options.logoUrl
   };
 }
-async function authFetchJson(path8, init = {}) {
+async function authFetchJson(path9, init = {}) {
   const environment = selectedEnvironment();
   const credential = await refreshCredentialIfNeeded(environment);
   if (!credential) {
@@ -12255,7 +12753,7 @@ async function authFetchJson(path8, init = {}) {
     throw err;
   }
   headers.set("Authorization", `Bearer ${credential.accessToken}`);
-  const response = await fetch(`${authBaseUrl}${path8}`, { ...init, headers });
+  const response = await fetch(`${authBaseUrl}${path9}`, { ...init, headers });
   const text = await response.text();
   const payload = text ? JSON.parse(text) : {};
   if (!response.ok || payload.success === false) {
@@ -12510,11 +13008,11 @@ function registerViaOfficialCli(cli, mcp, agentName) {
   return result.status === 0;
 }
 async function registerClaudeViaConfig(mcp) {
-  const path8 = join5(homedir2(), ".claude.json");
+  const path9 = join5(homedir2(), ".claude.json");
   let config = {};
-  if (existsSync5(path8)) {
+  if (existsSync5(path9)) {
     try {
-      config = JSON.parse(await readFile7(path8, "utf8"));
+      config = JSON.parse(await readFile7(path9, "utf8"));
     } catch {
       config = {};
     }
@@ -12527,13 +13025,13 @@ async function registerClaudeViaConfig(mcp) {
     env: { TOPOLO_AGENT_NAME: AGENT_NAME_FOR.claude }
   };
   config.mcpServers = servers;
-  await writeFile7(path8, `${JSON.stringify(config, null, 2)}
+  await writeFile7(path9, `${JSON.stringify(config, null, 2)}
 `, "utf8");
 }
 async function registerCodexViaConfig(mcp) {
-  const path8 = join5(homedir2(), ".codex", "config.toml");
+  const path9 = join5(homedir2(), ".codex", "config.toml");
   let text = "";
-  if (existsSync5(path8)) text = await readFile7(path8, "utf8");
+  if (existsSync5(path9)) text = await readFile7(path9, "utf8");
   text = text.replace(
     /(^|\n)\[mcp_servers\.topolo(?:\.[a-z]+)?\][^\[]*/g,
     (match) => match.startsWith("\n") ? "\n" : ""
@@ -12549,8 +13047,8 @@ command = "${mcp.command}"${argsToml}
 [mcp_servers.topolo.env]
 TOPOLO_AGENT_NAME = "${AGENT_NAME_FOR.codex}"
 `;
-  await mkdir4(dirname4(path8), { recursive: true });
-  await writeFile7(path8, `${text}${block}`, "utf8");
+  await mkdir4(dirname4(path9), { recursive: true });
+  await writeFile7(path9, `${text}${block}`, "utf8");
 }
 async function installForAgent(agent, sourceDir, mcp, opts) {
   const skillDir = agent === "claude" ? claudeSkillDir(opts.projectDir) : codexSkillDir();