@topolo/cli 0.6.5 → 0.6.7

package/dist/index.js

@@ -98,13 +98,13 @@ var TopoloHttpError = class extends TopoloSdkError {
   path;
   requestId;
   retryAfter;
-  constructor(service, path8, status, body, message, options = {}) {
-    super(extractHttpErrorCode(body), message ?? `HTTP ${status} from ${service}${path8}`);
+  constructor(service, path9, status, body, message, options = {}) {
+    super(extractHttpErrorCode(body), message ?? `HTTP ${status} from ${service}${path9}`);
     this.name = "TopoloHttpError";
     this.status = status;
     this.body = body;
     this.service = service;
-    this.path = path8;
+    this.path = path9;
     this.requestId = options.requestId;
     this.retryAfter = options.retryAfter;
   }
@@ -113,6 +113,7 @@ var APP_API_URLS = {
   agent: "https://agent.topolo.app",
   auth: "https://auth.topolo.app",
   backup: "https://backup.topolo.app",
+  blog: "https://blog.topolo.app",
   books: "https://books.topolo.app",
   brand: "https://brand.topolo.app",
   bugfix: "https://bugfix.topolo.app",
@@ -125,6 +126,7 @@ var APP_API_URLS = {
   compose: "https://compose.topolo.app",
   consent: "https://consent.topolo.app",
   crm: "https://crm.topolo.app",
+  design: "https://design.topolo.app",
   developers: "https://developers.topolo.app",
   director: "https://director.topolo.app",
   feed: "https://feed.topolo.app",
@@ -208,7 +210,9 @@ var APPLICATIONS = {
         "domains": [
           "agent.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "agent.topolo.app"
+        ],
         "appId": "agent"
       },
       {
@@ -269,6 +273,38 @@ var APPLICATIONS = {
       }
     ]
   },
+  "blog": {
+    "id": "blog",
+    "appDir": "TopoloBlog",
+    "name": "topolo-blog",
+    "packageName": "topolo-blog",
+    "productionUrl": "https://blog.topolo.app",
+    "services": [
+      "blog"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-blog",
+        "kind": "worker",
+        "apiUrl": "https://blog.topolo.app",
+        "domains": [
+          "blog.topolo.app"
+        ],
+        "routes": [
+          "blog.topolo.app"
+        ],
+        "appId": "blog"
+      },
+      {
+        "name": "topolo-blog-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
   "books": {
     "id": "books",
     "appDir": "TopoloBooks",
@@ -286,7 +322,9 @@ var APPLICATIONS = {
         "domains": [
           "books.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "books.topolo.app"
+        ],
         "appId": "books"
       },
       {
@@ -436,7 +474,9 @@ var APPLICATIONS = {
         "domains": [
           "campaigns.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "campaigns.topolo.app"
+        ],
         "appId": "campaigns"
       },
       {
@@ -578,7 +618,9 @@ var APPLICATIONS = {
         "domains": [
           "compose.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "compose.topolo.app"
+        ],
         "appId": "compose"
       },
       {
@@ -608,7 +650,9 @@ var APPLICATIONS = {
         "domains": [
           "consent.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "consent.topolo.app"
+        ],
         "appId": "consent"
       },
       {
@@ -646,11 +690,45 @@ var APPLICATIONS = {
         "domains": [
           "crm.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "crm.topolo.app"
+        ],
         "appId": "crm"
       }
     ]
   },
+  "design": {
+    "id": "design",
+    "appDir": "TopoloDesign",
+    "name": "topolo-design",
+    "packageName": "@topolo-io/design",
+    "productionUrl": "https://design.topolo.app",
+    "services": [
+      "design"
+    ],
+    "deployTargets": [
+      {
+        "name": "topolo-design",
+        "kind": "worker",
+        "apiUrl": "https://design.topolo.app",
+        "domains": [
+          "design.topolo.app"
+        ],
+        "routes": [
+          "design.topolo.app"
+        ],
+        "appId": "design"
+      },
+      {
+        "name": "topolo-design-api",
+        "kind": "worker",
+        "apiUrl": null,
+        "domains": [],
+        "routes": [],
+        "appId": null
+      }
+    ]
+  },
   "developers": {
     "id": "developers",
     "appDir": "TopoloDevelopers",
@@ -706,7 +784,9 @@ var APPLICATIONS = {
         "domains": [
           "director.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "director.topolo.app"
+        ],
         "appId": "director"
       },
       {
@@ -814,7 +894,9 @@ var APPLICATIONS = {
         "domains": [
           "flow.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "flow.topolo.app"
+        ],
         "appId": "flow"
       },
       {
@@ -844,7 +926,9 @@ var APPLICATIONS = {
         "domains": [
           "forecast.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "forecast.topolo.app"
+        ],
         "appId": "forecast"
       },
       {
@@ -938,7 +1022,9 @@ var APPLICATIONS = {
         "domains": [
           "insights.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "insights.topolo.app"
+        ],
         "appId": "insights"
       },
       {
@@ -968,7 +1054,9 @@ var APPLICATIONS = {
         "domains": [
           "inventory.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "inventory.topolo.app"
+        ],
         "appId": "inventory"
       },
       {
@@ -1322,7 +1410,9 @@ var APPLICATIONS = {
         "domains": [
           "pay.topolo.app"
         ],
-        "routes": [],
+        "routes": [
+          "pay.topolo.app"
+        ],
         "appId": "pay"
       },
       {
@@ -2277,17 +2367,17 @@ function validateTopoloActionInput(schema, input3) {
   validateNode(schema, input3, "$", schema, errors, 0);
   return { valid: errors.length === 0, errors };
 }
-function inspectSchema(schema, path8, root, depth) {
-  if (depth > 128) return { path: path8, code: "schema_depth", message: "Schema recursion exceeded 128 levels." };
+function inspectSchema(schema, path9, root, depth) {
+  if (depth > 128) return { path: path9, code: "schema_depth", message: "Schema recursion exceeded 128 levels." };
   const unsupportedKeyword = Object.keys(schema).find((keyword) => !SUPPORTED_SCHEMA_KEYWORDS.has(keyword));
   if (unsupportedKeyword) {
-    return { path: path8, code: "unsupported_schema_keyword", message: `Action schema uses unsupported keyword ${unsupportedKeyword}.` };
+    return { path: path9, code: "unsupported_schema_keyword", message: `Action schema uses unsupported keyword ${unsupportedKeyword}.` };
   }
   if (typeof schema.format === "string" && !["uri", "email", "date-time"].includes(schema.format)) {
-    return { path: path8, code: "unsupported_schema_format", message: `Action schema uses unsupported format ${schema.format}.` };
+    return { path: path9, code: "unsupported_schema_format", message: `Action schema uses unsupported format ${schema.format}.` };
   }
   if (typeof schema.$ref === "string" && !resolveLocalReference(root, schema.$ref)) {
-    return { path: path8, code: "unsupported_schema_ref", message: `Cannot resolve schema reference ${schema.$ref}.` };
+    return { path: path9, code: "unsupported_schema_ref", message: `Cannot resolve schema reference ${schema.$ref}.` };
   }
   const children = [];
   if (isRecord(schema.properties)) children.push(...Object.entries(schema.properties));
@@ -2303,7 +2393,7 @@ function inspectSchema(schema, path8, root, depth) {
   );
   for (const [key, child] of children) {
     if (!isRecord(child)) continue;
-    const issue = inspectSchema(child, `${path8}.${key}`, root, depth + 1);
+    const issue = inspectSchema(child, `${path9}.${key}`, root, depth + 1);
     if (issue) return issue;
   }
   return null;
@@ -2311,129 +2401,129 @@ function inspectSchema(schema, path8, root, depth) {
 function arraySchemaEntries(keyword, value) {
   return Array.isArray(value) ? value.map((candidate, index) => [`${keyword}[${index}]`, candidate]) : [];
 }
-function validateNode(schema, value, path8, root, errors, depth) {
+function validateNode(schema, value, path9, root, errors, depth) {
   if (depth > 128) {
-    errors.push({ path: path8, code: "schema_depth", message: "Schema recursion exceeded 128 levels." });
+    errors.push({ path: path9, code: "schema_depth", message: "Schema recursion exceeded 128 levels." });
     return;
   }
   if (typeof schema.$ref === "string") {
     const resolved = resolveLocalReference(root, schema.$ref);
     if (!resolved) {
-      errors.push({ path: path8, code: "unsupported_schema_ref", message: `Cannot resolve schema reference ${schema.$ref}.` });
+      errors.push({ path: path9, code: "unsupported_schema_ref", message: `Cannot resolve schema reference ${schema.$ref}.` });
       return;
     }
-    validateNode(resolved, value, path8, root, errors, depth + 1);
+    validateNode(resolved, value, path9, root, errors, depth + 1);
   }
   if (Array.isArray(schema.allOf)) {
     for (const candidate of schema.allOf) {
-      if (isRecord(candidate)) validateNode(candidate, value, path8, root, errors, depth + 1);
+      if (isRecord(candidate)) validateNode(candidate, value, path9, root, errors, depth + 1);
     }
   }
   if (Array.isArray(schema.anyOf) && !schema.anyOf.some((candidate) => candidateMatches(candidate, value, root, depth))) {
-    errors.push({ path: path8, code: "any_of", message: "Value does not match any allowed schema." });
+    errors.push({ path: path9, code: "any_of", message: "Value does not match any allowed schema." });
     return;
   }
   if (Array.isArray(schema.oneOf)) {
     const matches = schema.oneOf.filter((candidate) => candidateMatches(candidate, value, root, depth)).length;
     if (matches !== 1) {
-      errors.push({ path: path8, code: "one_of", message: "Value must match exactly one allowed schema." });
+      errors.push({ path: path9, code: "one_of", message: "Value must match exactly one allowed schema." });
       return;
     }
   }
   if (value === null && schema.nullable === true) return;
   if (Object.prototype.hasOwnProperty.call(schema, "const") && !sameJsonValue(value, schema.const)) {
-    errors.push({ path: path8, code: "const", message: `Value must equal ${JSON.stringify(schema.const)}.` });
+    errors.push({ path: path9, code: "const", message: `Value must equal ${JSON.stringify(schema.const)}.` });
     return;
   }
   if (Array.isArray(schema.enum) && !schema.enum.some((candidate) => sameJsonValue(value, candidate))) {
-    errors.push({ path: path8, code: "enum", message: `Value must be one of ${schema.enum.map((item) => JSON.stringify(item)).join(", ")}.` });
+    errors.push({ path: path9, code: "enum", message: `Value must be one of ${schema.enum.map((item) => JSON.stringify(item)).join(", ")}.` });
     return;
   }
   if (!matchesType(schema.type, value)) {
-    errors.push({ path: path8, code: "type", message: `Expected ${String(schema.type)}.` });
+    errors.push({ path: path9, code: "type", message: `Expected ${String(schema.type)}.` });
     return;
   }
-  if (typeof value === "string") validateString(schema, value, path8, errors);
-  if (typeof value === "number") validateNumber(schema, value, path8, errors);
-  if (Array.isArray(value)) validateArray(schema, value, path8, root, errors, depth);
-  if (isRecord(value)) validateObject(schema, value, path8, root, errors, depth);
+  if (typeof value === "string") validateString(schema, value, path9, errors);
+  if (typeof value === "number") validateNumber(schema, value, path9, errors);
+  if (Array.isArray(value)) validateArray(schema, value, path9, root, errors, depth);
+  if (isRecord(value)) validateObject(schema, value, path9, root, errors, depth);
 }
-function validateObject(schema, value, path8, root, errors, depth) {
+function validateObject(schema, value, path9, root, errors, depth) {
   if (typeof schema.minProperties === "number" && Object.keys(value).length < schema.minProperties) {
-    errors.push({ path: path8, code: "min_properties", message: `Expected at least ${schema.minProperties} properties.` });
+    errors.push({ path: path9, code: "min_properties", message: `Expected at least ${schema.minProperties} properties.` });
   }
   if (typeof schema.maxProperties === "number" && Object.keys(value).length > schema.maxProperties) {
-    errors.push({ path: path8, code: "max_properties", message: `Expected at most ${schema.maxProperties} properties.` });
+    errors.push({ path: path9, code: "max_properties", message: `Expected at most ${schema.maxProperties} properties.` });
   }
   const properties = isRecord(schema.properties) ? schema.properties : {};
   const required = Array.isArray(schema.required) ? schema.required.map(String) : [];
   for (const key of required) {
     if (!Object.prototype.hasOwnProperty.call(value, key)) {
-      errors.push({ path: `${path8}.${key}`, code: "required", message: "Required property is missing." });
+      errors.push({ path: `${path9}.${key}`, code: "required", message: "Required property is missing." });
     }
   }
   if (isRecord(schema.propertyNames)) {
     for (const key of Object.keys(value)) {
-      validateNode(schema.propertyNames, key, `${path8}.${key}`, root, errors, depth + 1);
+      validateNode(schema.propertyNames, key, `${path9}.${key}`, root, errors, depth + 1);
     }
   }
   for (const [key, child] of Object.entries(value)) {
     const childSchema = properties[key];
     if (isRecord(childSchema)) {
-      validateNode(childSchema, child, `${path8}.${key}`, root, errors, depth + 1);
+      validateNode(childSchema, child, `${path9}.${key}`, root, errors, depth + 1);
     } else if (schema.additionalProperties === false) {
-      errors.push({ path: `${path8}.${key}`, code: "additional_property", message: "Property is not declared by the action schema." });
+      errors.push({ path: `${path9}.${key}`, code: "additional_property", message: "Property is not declared by the action schema." });
     } else if (isRecord(schema.additionalProperties)) {
-      validateNode(schema.additionalProperties, child, `${path8}.${key}`, root, errors, depth + 1);
+      validateNode(schema.additionalProperties, child, `${path9}.${key}`, root, errors, depth + 1);
     }
   }
 }
-function validateArray(schema, value, path8, root, errors, depth) {
+function validateArray(schema, value, path9, root, errors, depth) {
   if (typeof schema.minItems === "number" && value.length < schema.minItems) {
-    errors.push({ path: path8, code: "min_items", message: `Expected at least ${schema.minItems} items.` });
+    errors.push({ path: path9, code: "min_items", message: `Expected at least ${schema.minItems} items.` });
   }
   if (typeof schema.maxItems === "number" && value.length > schema.maxItems) {
-    errors.push({ path: path8, code: "max_items", message: `Expected at most ${schema.maxItems} items.` });
+    errors.push({ path: path9, code: "max_items", message: `Expected at most ${schema.maxItems} items.` });
   }
   if (schema.uniqueItems === true) {
     const unique4 = new Set(value.map((item) => JSON.stringify(item)));
-    if (unique4.size !== value.length) errors.push({ path: path8, code: "unique_items", message: "Expected every item to be unique." });
+    if (unique4.size !== value.length) errors.push({ path: path9, code: "unique_items", message: "Expected every item to be unique." });
   }
   if (isRecord(schema.items)) {
-    value.forEach((item, index) => validateNode(schema.items, item, `${path8}[${index}]`, root, errors, depth + 1));
+    value.forEach((item, index) => validateNode(schema.items, item, `${path9}[${index}]`, root, errors, depth + 1));
   }
 }
-function validateString(schema, value, path8, errors) {
+function validateString(schema, value, path9, errors) {
   if (typeof schema.minLength === "number" && value.length < schema.minLength) {
-    errors.push({ path: path8, code: "min_length", message: `Expected at least ${schema.minLength} characters.` });
+    errors.push({ path: path9, code: "min_length", message: `Expected at least ${schema.minLength} characters.` });
   }
   if (typeof schema.maxLength === "number" && value.length > schema.maxLength) {
-    errors.push({ path: path8, code: "max_length", message: `Expected at most ${schema.maxLength} characters.` });
+    errors.push({ path: path9, code: "max_length", message: `Expected at most ${schema.maxLength} characters.` });
   }
   if (typeof schema.pattern === "string") {
     try {
-      if (!new RegExp(schema.pattern).test(value)) errors.push({ path: path8, code: "pattern", message: "Value does not match the required pattern." });
+      if (!new RegExp(schema.pattern).test(value)) errors.push({ path: path9, code: "pattern", message: "Value does not match the required pattern." });
     } catch {
-      errors.push({ path: path8, code: "invalid_schema_pattern", message: "Action schema contains an invalid pattern." });
+      errors.push({ path: path9, code: "invalid_schema_pattern", message: "Action schema contains an invalid pattern." });
     }
   }
-  if (schema.format === "uri" && !isUrl(value)) errors.push({ path: path8, code: "format_uri", message: "Expected an absolute URL." });
-  if (schema.format === "email" && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(value)) errors.push({ path: path8, code: "format_email", message: "Expected an email address." });
-  if (schema.format === "date-time" && !isDateTime(value)) errors.push({ path: path8, code: "format_date_time", message: "Expected an ISO-8601 date-time." });
+  if (schema.format === "uri" && !isUrl(value)) errors.push({ path: path9, code: "format_uri", message: "Expected an absolute URL." });
+  if (schema.format === "email" && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(value)) errors.push({ path: path9, code: "format_email", message: "Expected an email address." });
+  if (schema.format === "date-time" && !isDateTime(value)) errors.push({ path: path9, code: "format_date_time", message: "Expected an ISO-8601 date-time." });
 }
-function validateNumber(schema, value, path8, errors) {
-  if (typeof schema.minimum === "number" && value < schema.minimum) errors.push({ path: path8, code: "minimum", message: `Expected a value of at least ${schema.minimum}.` });
-  if (typeof schema.maximum === "number" && value > schema.maximum) errors.push({ path: path8, code: "maximum", message: `Expected a value of at most ${schema.maximum}.` });
+function validateNumber(schema, value, path9, errors) {
+  if (typeof schema.minimum === "number" && value < schema.minimum) errors.push({ path: path9, code: "minimum", message: `Expected a value of at least ${schema.minimum}.` });
+  if (typeof schema.maximum === "number" && value > schema.maximum) errors.push({ path: path9, code: "maximum", message: `Expected a value of at most ${schema.maximum}.` });
   const exclusiveMinimum = typeof schema.exclusiveMinimum === "number" ? schema.exclusiveMinimum : schema.exclusiveMinimum === true && typeof schema.minimum === "number" ? schema.minimum : null;
   const exclusiveMaximum = typeof schema.exclusiveMaximum === "number" ? schema.exclusiveMaximum : schema.exclusiveMaximum === true && typeof schema.maximum === "number" ? schema.maximum : null;
   if (exclusiveMinimum !== null && value <= exclusiveMinimum) {
-    errors.push({ path: path8, code: "exclusive_minimum", message: `Expected a value greater than ${exclusiveMinimum}.` });
+    errors.push({ path: path9, code: "exclusive_minimum", message: `Expected a value greater than ${exclusiveMinimum}.` });
   }
   if (exclusiveMaximum !== null && value >= exclusiveMaximum) {
-    errors.push({ path: path8, code: "exclusive_maximum", message: `Expected a value less than ${exclusiveMaximum}.` });
+    errors.push({ path: path9, code: "exclusive_maximum", message: `Expected a value less than ${exclusiveMaximum}.` });
   }
   if (typeof schema.multipleOf === "number" && !isMultipleOf(value, schema.multipleOf)) {
-    errors.push({ path: path8, code: "multiple_of", message: `Expected a multiple of ${schema.multipleOf}.` });
+    errors.push({ path: path9, code: "multiple_of", message: `Expected a multiple of ${schema.multipleOf}.` });
   }
 }
 function candidateMatches(candidate, value, root, depth) {
@@ -2565,8 +2655,8 @@ function prepareTopoloUrlSessionUploadInput(contractValue, byteLength, input3, o
     }
   };
 }
-function topoloUploadResponseValue(response, path8) {
-  return path8.split(".").reduce((value, segment) => isRecord2(value) ? value[segment] : void 0, response);
+function topoloUploadResponseValue(response, path9) {
+  return path9.split(".").reduce((value, segment) => isRecord2(value) ? value[segment] : void 0, response);
 }
 function decodeTopoloActionBase64(contentBase64) {
   if (!isCanonicalBase64(contentBase64)) {
@@ -2613,11 +2703,11 @@ function parseCompleteContract(value) {
   };
 }
 function requiredPath(value, name) {
-  const path8 = typeof value === "string" ? value.trim() : "";
-  if (!/^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)*$/.test(path8)) {
+  const path9 = typeof value === "string" ? value.trim() : "";
+  if (!/^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)*$/.test(path9)) {
     throw new TopoloSdkError("invalid_upload_contract", `The action upload contract has an invalid ${name}.`);
   }
-  return path8;
+  return path9;
 }
 function unsupportedInlineProfile() {
   return new TopoloSdkError("invalid_upload_contract", "This action does not publish an inline-base64 upload contract.");
@@ -3572,8 +3662,8 @@ function normalizeActionCatalogEntry(item) {
   const name = pickActionString(a.name);
   const appId = pickActionString(a.app_id) ?? pickActionString(a.appId);
   const method = pickActionString(a.method)?.toUpperCase();
-  const path8 = pickActionString(a.path);
-  if (!actionId || !name || !appId || !method || !path8 || !isHttpMethod(method)) {
+  const path9 = pickActionString(a.path);
+  if (!actionId || !name || !appId || !method || !path9 || !isHttpMethod(method)) {
     return null;
   }
   return {
@@ -3588,7 +3678,7 @@ function normalizeActionCatalogEntry(item) {
     appSlug: pickActionString(a.app_slug) ?? pickActionString(a.appSlug) ?? null,
     appName: pickActionString(a.app_name) ?? pickActionString(a.appName) ?? null,
     method,
-    path: path8,
+    path: path9,
     permissionName: pickActionString(a.permission_name) ?? pickActionString(a.permissionName) ?? "",
     requiredPermission: pickActionString(a.required_permission) ?? pickActionString(a.requiredPermission) ?? "",
     authorizationMode: pickAuthorizationMode(a.authorization_mode ?? a.authorizationMode),
@@ -3624,7 +3714,7 @@ function stringArray(value) {
 }
 function mapActionInput(action, input3) {
   const remaining = { ...input3 || {} };
-  const path8 = action.path.replace(/\{([a-zA-Z0-9_]+)\}/g, (_match, key) => {
+  const path9 = action.path.replace(/\{([a-zA-Z0-9_]+)\}/g, (_match, key) => {
     const value = remaining[key];
     if (value === void 0 || value === null || value === "") {
       throw new TopoloSdkError(
@@ -3641,14 +3731,14 @@ function mapActionInput(action, input3) {
   delete remaining.body;
   if (action.method === "GET") {
     return {
-      path: path8,
+      path: path9,
       query: objectToQuery({ ...remaining, ...explicitQuery })
     };
   }
   const query = objectToQuery(explicitQuery);
   const body = explicitBody !== void 0 ? explicitBody : remaining;
   return {
-    path: path8,
+    path: path9,
     ...query ? { query } : {},
     body
   };
@@ -3818,8 +3908,8 @@ var TopoloOAuth = class {
     if (params.clientSecret) body.set("client_secret", params.clientSecret);
     return this.#postForm("/api/developer-oauth/token", body);
   }
-  async #postForm(path8, body) {
-    const url = new URL(path8, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
+  async #postForm(path9, body) {
+    const url = new URL(path9, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
     const res = await this.fetchImpl(url.toString(), {
       method: "POST",
       headers: {
@@ -3835,7 +3925,7 @@ var TopoloOAuth = class {
         const err = parsed;
         throw new TopoloAuthError(err.error_description || err.error, err.error);
       }
-      throw new TopoloHttpError("auth", path8, res.status, parsed);
+      throw new TopoloHttpError("auth", path9, res.status, parsed);
     }
     return parsed;
   }
@@ -3898,13 +3988,13 @@ var TopoloHttpError2 = class extends TopoloSdkError2 {
   path;
   requestId;
   retryAfter;
-  constructor(service, path8, status, body, message, options = {}) {
-    super(extractHttpErrorCode2(body), message ?? `HTTP ${status} from ${service}${path8}`);
+  constructor(service, path9, status, body, message, options = {}) {
+    super(extractHttpErrorCode2(body), message ?? `HTTP ${status} from ${service}${path9}`);
     this.name = "TopoloHttpError";
     this.status = status;
     this.body = body;
     this.service = service;
-    this.path = path8;
+    this.path = path9;
     this.requestId = options.requestId;
     this.retryAfter = options.retryAfter;
   }
@@ -3913,6 +4003,7 @@ var APP_API_URLS2 = {
   agent: "https://agent.topolo.app",
   auth: "https://auth.topolo.app",
   backup: "https://backup.topolo.app",
+  blog: "https://blog.topolo.app",
   books: "https://books.topolo.app",
   brand: "https://brand.topolo.app",
   bugfix: "https://bugfix.topolo.app",
@@ -3925,6 +4016,7 @@ var APP_API_URLS2 = {
   compose: "https://compose.topolo.app",
   consent: "https://consent.topolo.app",
   crm: "https://crm.topolo.app",
+  design: "https://design.topolo.app",
   developers: "https://developers.topolo.app",
   director: "https://director.topolo.app",
   feed: "https://feed.topolo.app",
@@ -4037,8 +4129,8 @@ var TopoloOAuth2 = class {
     if (params.clientSecret) body.set("client_secret", params.clientSecret);
     return this.#postForm("/api/developer-oauth/token", body);
   }
-  async #postForm(path8, body) {
-    const url = new URL(path8, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
+  async #postForm(path9, body) {
+    const url = new URL(path9, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
     const res = await this.fetchImpl(url.toString(), {
       method: "POST",
       headers: {
@@ -4054,7 +4146,7 @@ var TopoloOAuth2 = class {
         const err = parsed;
         throw new TopoloAuthError2(err.error_description || err.error, err.error);
       }
-      throw new TopoloHttpError2("auth", path8, res.status, parsed);
+      throw new TopoloHttpError2("auth", path9, res.status, parsed);
     }
     return parsed;
   }
@@ -4084,22 +4176,22 @@ function configPath() {
   return join(base, "topolo", "config.json");
 }
 async function readConfig() {
-  const path8 = configPath();
-  if (!existsSync(path8)) return {};
+  const path9 = configPath();
+  if (!existsSync(path9)) return {};
   try {
-    const raw = await readFile(path8, "utf8");
+    const raw = await readFile(path9, "utf8");
     return JSON.parse(raw);
   } catch {
     return {};
   }
 }
 async function writeConfig(config) {
-  const path8 = configPath();
-  await mkdir(dirname(path8), { recursive: true });
-  await writeFile(path8, JSON.stringify(config, null, 2) + "\n", "utf8");
+  const path9 = configPath();
+  await mkdir(dirname(path9), { recursive: true });
+  await writeFile(path9, JSON.stringify(config, null, 2) + "\n", "utf8");
   if (platform() !== "win32") {
     try {
-      await chmod(path8, 384);
+      await chmod(path9, 384);
     } catch {
     }
   }
@@ -4429,9 +4521,9 @@ function readCliVersion() {
       join2(here, "package.json"),
       join2(here, "..", "package.json")
     ];
-    for (const path8 of candidates) {
+    for (const path9 of candidates) {
       try {
-        const pkg = JSON.parse(readFileSync(path8, "utf8"));
+        const pkg = JSON.parse(readFileSync(path9, "utf8"));
         if (typeof pkg.version === "string" && pkg.version) return pkg.version;
       } catch {
       }
@@ -4791,7 +4883,7 @@ function registerApiCommand(program2) {
     "-q, --query <kv...>",
     "Query params as key=value (repeatable), e.g. --query source=cli page=2"
   ).option("--resource-type <type>", "Cataloged app-local workspace resource alias for resource-scoped API keys").option("--resource-id <id>", "Workspace resource id for resource-scoped API keys").option("--confirm", "Acknowledge a mutating request").option("--json", "Output JSON", true).option("--no-json", "Output human-readable text").action(
-    async (service, method, path8, opts) => {
+    async (service, method, path9, opts) => {
       const mode = resolveOutputMode(opts.json);
       try {
         const upperMethod = method.toUpperCase();
@@ -4830,7 +4922,7 @@ function registerApiCommand(program2) {
         const result = await topolo.client.request({
           service,
           method: httpMethod,
-          path: path8,
+          path: path9,
           body,
           ...query ? { query } : {},
           ...resource ? { resource } : {},
@@ -5018,13 +5110,13 @@ async function requiredClient() {
 function parseJsonObject(value) {
   let source = value;
   if (value.startsWith("@")) {
-    const path8 = value.slice(1);
-    if (!path8) throw new Error("--data @file path must not be empty");
+    const path9 = value.slice(1);
+    if (!path9) throw new Error("--data @file path must not be empty");
     try {
-      source = readFileSync2(path8, "utf8");
+      source = readFileSync2(path9, "utf8");
     } catch (err) {
       const detail = err instanceof Error ? err.message : String(err);
-      throw new Error(`Could not read --data file ${path8}: ${detail}`);
+      throw new Error(`Could not read --data file ${path9}: ${detail}`);
     }
   }
   let parsed;
@@ -5038,7 +5130,7 @@ function parseJsonObject(value) {
   }
   return parsed;
 }
-function inferContentType(path8) {
+function inferContentType(path9) {
   return {
     ".avif": "image/avif",
     ".gif": "image/gif",
@@ -5051,7 +5143,7 @@ function inferContentType(path8) {
     ".png": "image/png",
     ".svg": "image/svg+xml",
     ".webp": "image/webp"
-  }[extname(path8).toLowerCase()] ?? null;
+  }[extname(path9).toLowerCase()] ?? null;
 }
 function formatActionRows(rows, nextCursor = null) {
   if (rows.length === 0) return "No actions available for this credential.";
@@ -5113,8 +5205,8 @@ function formatActionPlan(plan) {
 
 // src/commands/apps.ts
 import { execSync } from "child_process";
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
-import path5 from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync2 } from "fs";
+import path6 from "path";
 
 // src/commands/app-audit-local.ts
 import {
@@ -6251,14 +6343,14 @@ import { constants } from "fs";
 import { access } from "fs/promises";
 import { relative, resolve } from "path";
 function normalizeHomePath(value) {
-  const path8 = String(value || "/dashboard").trim();
-  if (!path8.startsWith("/") || path8.startsWith("//") || /[?#]/.test(path8)) {
+  const path9 = String(value || "/dashboard").trim();
+  if (!path9.startsWith("/") || path9.startsWith("//") || /[?#]/.test(path9)) {
     throw new Error("Invalid home path. Use an absolute application path such as /dashboard.");
   }
-  if (["/", "/login", "/auth/callback", "/getting-started"].includes(path8)) {
+  if (["/", "/login", "/auth/callback", "/getting-started"].includes(path9)) {
     throw new Error("Home path must be a protected product route, not a reserved entry route.");
   }
-  return path8.replace(/\/$/, "") || "/dashboard";
+  return path9.replace(/\/$/, "") || "/dashboard";
 }
 function normalizeHomeLabel(value) {
   const label = String(value || "Dashboard").trim();
@@ -6389,9 +6481,9 @@ function toTitle(value) {
 function json(value) {
   return JSON.stringify(value, null, 2);
 }
-async function pathExists(path8) {
+async function pathExists(path9) {
   try {
-    await access(path8, constants.F_OK);
+    await access(path9, constants.F_OK);
     return true;
   } catch {
     return false;
@@ -6421,6 +6513,54 @@ function firstPartyAppPath(appDir, _audience) {
   return `apps/${appDir}`;
 }
 
+// src/commands/app-scaffold-platform-versions.ts
+import { readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
+import path2 from "path";
+var versionCache = /* @__PURE__ */ new Map();
+function platformPackagePin(packageName, options = {}) {
+  const workspaceRoot = resolveTopoloRepoRoot(
+    options.repoRoot ?? process.env.TOPOLO_WORKSPACE_ROOT ?? void 0,
+    options.cwd ?? process.cwd()
+  );
+  if (!workspaceRoot) {
+    throw new Error(
+      `Cannot resolve a concrete version for ${packageName}: platform-target scaffolds must run inside the Topolo workspace checkout (a directory containing apps/ and system-apps/), or receive --repo-root. The fleet pinning policy requires exact ^<latest> pins, never "latest".`
+    );
+  }
+  const version = platformPackageVersions(workspaceRoot).get(packageName);
+  if (!version) {
+    throw new Error(
+      `Unknown Topolo platform package: ${packageName} \u2014 no published package with that name under ${path2.join(workspaceRoot, "topolo-platform", "packages")}.`
+    );
+  }
+  return `^${version}`;
+}
+function platformPackageVersions(workspaceRoot) {
+  const packagesRoot = path2.join(workspaceRoot, "topolo-platform", "packages");
+  const cached = versionCache.get(packagesRoot);
+  if (cached) return cached;
+  const versions = /* @__PURE__ */ new Map();
+  let entries = [];
+  try {
+    entries = readdirSync2(packagesRoot);
+  } catch {
+  }
+  for (const entry of entries) {
+    let packageJson2;
+    try {
+      packageJson2 = JSON.parse(readFileSync4(path2.join(packagesRoot, entry, "package.json"), "utf8"));
+    } catch {
+      continue;
+    }
+    const version = packageJson2.topoloPublishedVersion || packageJson2.version;
+    if (packageJson2.name && /^@topolo(-io)?\//.test(packageJson2.name) && !packageJson2.private && version) {
+      versions.set(packageJson2.name, version);
+    }
+  }
+  versionCache.set(packagesRoot, versions);
+  return versions;
+}
+
 // src/commands/app-scaffold-cloudflare-constants.ts
 var CLOUDFLARE_ACCOUNT_ID = "49ef1ba682ad8cfd720c86699ae17521";
 var STAGING_CLOUDFLARE_ACCOUNT_ID = "4f4e1c69a3830946f9fea7b1eb7531ac";
@@ -6453,7 +6593,7 @@ function packageJson(application, target, options) {
       devDependencies.tailwindcss = "3.4.19";
       dependencies["react-router-dom"] = "^7.6.2";
     } else {
-      dependencies["@topolo/login"] = topoloPackageVersion("@topolo/login", target);
+      dependencies["@topolo/login"] = topoloPackageVersion("@topolo/login", target, options.repoRoot);
     }
   }
   if (options.api) {
@@ -6465,13 +6605,13 @@ function packageJson(application, target, options) {
       scripts["deploy:staging"] = `DEPLOY_ENVIRONMENT=staging CLOUDFLARE_ACCOUNT_ID=${STAGING_CLOUDFLARE_ACCOUNT_ID} python3 .github/scripts/standard_deploy.py local-deploy`;
       scripts["deploy:production"] = `DEPLOY_ENVIRONMENT=production CLOUDFLARE_ACCOUNT_ID=${CLOUDFLARE_ACCOUNT_ID} python3 .github/scripts/standard_deploy.py local-deploy`;
     } else {
-      dependencies["@topolo/sdk"] = topoloPackageVersion("@topolo/sdk", target);
+      dependencies["@topolo/sdk"] = topoloPackageVersion("@topolo/sdk", target, options.repoRoot);
       scripts.deploy = "npm run build && wrangler deploy";
     }
     devDependencies.wrangler = "^4.91.0";
   }
   for (const packageName of options.packages) {
-    dependencies[packageName] = topoloPackageVersion(packageName, target);
+    dependencies[packageName] = topoloPackageVersion(packageName, target, options.repoRoot);
   }
   if (target === "platform") {
     const testDirs = [];
@@ -6513,14 +6653,16 @@ function packageJson(application, target, options) {
   })}
 `;
 }
-function topoloPackageVersion(packageName, target) {
+function topoloPackageVersion(packageName, target, repoRoot) {
   if (target === "developer") {
     if (packageName === "@topolo/login") return "^0.1.0";
     if (packageName === "@topolo-io/auth-client") return "^1.0.0";
     if (packageName === "@topolo/sdk") return "^0.8.1";
     return "^0.1.0";
   }
-  if (packageName.startsWith("@topolo/") || packageName.startsWith("@topolo-io/")) return "latest";
+  if (packageName.startsWith("@topolo/") || packageName.startsWith("@topolo-io/")) {
+    return platformPackagePin(packageName, { repoRoot });
+  }
   throw new Error(`Unknown Topolo platform package: ${packageName}`);
 }
 function hasScaffoldResources(resources) {
@@ -7159,6 +7301,10 @@ function envDts(api) {
     "interface ImportMetaEnv {",
     "  readonly VITE_TOPOLO_AUTH_URL?: string;",
     "  readonly VITE_TOPOLO_APP_ID?: string;",
+    "  readonly VITE_TOPOLO_INSIGHTS_SITE_KEY?: string;",
+    "  readonly VITE_TOPOLO_INSIGHTS_ENDPOINT?: string;",
+    "  readonly VITE_TOPOLO_CONSENT_BASE_URL?: string;",
+    "  readonly VITE_TOPOLO_CONSENT_SDK_KEY?: string;",
     "  readonly VITE_TOPOLO_CLIENT_ID?: string;",
     "  readonly VITE_TOPOLO_REDIRECT_URI?: string;",
     "  readonly VITE_TOPOLO_SCOPES?: string;"
@@ -8489,10 +8635,10 @@ function developerWorkerTs(application) {
 }
 
 // src/commands/app-scaffold-generate.ts
-import { existsSync as existsSync3, mkdirSync, mkdtempSync, readFileSync as readFileSync4, rmSync, writeFileSync } from "fs";
+import { existsSync as existsSync3, mkdirSync, mkdtempSync, readFileSync as readFileSync5, rmSync, writeFileSync } from "fs";
 import { spawnSync } from "child_process";
 import { tmpdir } from "os";
-import path2 from "path";
+import path3 from "path";
 function resolveGeneratorPath() {
   const candidates = [
     // Published CLI: vendored alongside dist/index.js at build time.
@@ -8519,18 +8665,18 @@ var GENERATED = {
 };
 function deriveGeneratedConfigs(files, base) {
   const generator = resolveGeneratorPath();
-  const root = mkdtempSync(path2.join(tmpdir(), "topolo-scaffold-generate-"));
+  const root = mkdtempSync(path3.join(tmpdir(), "topolo-scaffold-generate-"));
   try {
     const prefix = `${base}/`;
     for (const file of files) {
       if (!file.path.startsWith(prefix)) continue;
-      const abs = path2.join(root, file.path.slice(prefix.length));
-      mkdirSync(path2.dirname(abs), { recursive: true });
+      const abs = path3.join(root, file.path.slice(prefix.length));
+      mkdirSync(path3.dirname(abs), { recursive: true });
       writeFileSync(abs, file.content, "utf8");
     }
     const result = spawnSync(
       process.execPath,
-      [generator, `--manifest=${path2.join(root, "topolo.app.json")}`],
+      [generator, `--manifest=${path3.join(root, "topolo.app.json")}`],
       { cwd: root, encoding: "utf8" }
     );
     if (result.status !== 0) {
@@ -8547,7 +8693,7 @@ ${result.stdout ?? ""}`);
     return written.map((rel) => ({
       path: `${base}/${rel}`,
       ...GENERATED,
-      content: readFileSync4(path2.join(root, rel), "utf8")
+      content: readFileSync5(path3.join(root, rel), "utf8")
     }));
   } finally {
     rmSync(root, { recursive: true, force: true });
@@ -8829,6 +8975,13 @@ function topoloAppManifestJson(application, options) {
         production: "cd ../.. && DEPLOY_ENVIRONMENT=production VITE_TOPOLO_AUTH_URL=https://auth.topolo.app pnpm run build"
       },
       healthcheckPath: options.api ? "/api/health" : "/",
+      vars: {
+        INSIGHTS_SITE_KEY: {
+          development: "",
+          staging: "",
+          production: ""
+        }
+      },
       ...options.api ? {
         bindings: {
           services: [
@@ -8887,6 +9040,7 @@ function topoloAppManifestJson(application, options) {
       version: "1.0.0",
       pricing: { type: "free", monthlyPrice: null },
       supportEmail: "support@topolo.io",
+      repoUrl: `https://github.com/Topolo-io/${application.appDir}`,
       auth: {
         callbackPath: "/auth/callback",
         requestedScopes: unique3([
@@ -8900,7 +9054,7 @@ function topoloAppManifestJson(application, options) {
       },
       capabilities: options.payload.capabilities,
       marketplace: {
-        intent: options.payload.distributionModel === "marketplace" ? "submit_when_ready" : "not_requested",
+        intent: options.payload.distributionModel === "marketplace" ? "publish" : "not_requested",
         status: "preview",
         shortBlurb: options.payload.experience.tagline,
         tagline: options.payload.experience.tagline,
@@ -9693,7 +9847,7 @@ function applicationScaffoldPayload(application, options = {}) {
   const containerAppId = normalizeContainerAppId(options.containerAppId, surfaceModel);
   const profile = normalizeScaffoldProfile(options.profile);
   const ownerType = target === "platform" ? "topolo_first_party" : "third_party";
-  const distributionModel = target === "platform" ? "marketplace" : "organization_internal";
+  const distributionModel = target === "platform" ? "marketplace" : options.distributionModel ?? "organization_internal";
   const capabilityComposition = resolveApplicationCapabilities({
     target,
     browser,
@@ -9781,7 +9935,8 @@ function applicationScaffoldPayload(application, options = {}) {
       target,
       browser,
       api,
-      ciWorkflow
+      ciWorkflow,
+      repoRoot: options.repoRoot
     }),
     commands: scaffoldCommands({
       id,
@@ -9869,7 +10024,8 @@ function scaffoldFiles(options) {
         browser: options.browser,
         api: options.api,
         resources: options.payload.resources,
-        packages: options.payload.capabilityComposition.packages
+        packages: options.payload.capabilityComposition.packages,
+        repoRoot: options.repoRoot
       })
     },
     {
@@ -10584,7 +10740,7 @@ function buildProvisioningRequest(payload, supportEmail) {
       ...payload.application.appId ? [`${payload.application.id}:read`] : []
     ])),
     marketplace: {
-      intent: payload.distributionModel === "marketplace" ? "submit_when_ready" : "not_requested",
+      intent: payload.target === "platform" && payload.distributionModel === "marketplace" ? "publish" : payload.distributionModel === "marketplace" ? "submit_when_ready" : "not_requested",
       status: "preview",
       shortBlurb: payload.experience.tagline,
       tagline: payload.experience.tagline,
@@ -10600,7 +10756,7 @@ function buildProvisioningRequest(payload, supportEmail) {
     pricingType: "free",
     monthlyPrice: null,
     demoUrl: payload.application.productionUrl,
-    repoUrl: null,
+    repoUrl: payload.target === "platform" ? `https://github.com/Topolo-io/${payload.application.appDir}` : null,
     supportEmail,
     tags: [],
     screenshots: [],
@@ -10680,18 +10836,18 @@ import { join as join3 } from "path";
 
 // src/commands/app-reconcile.ts
 import { readFile as readFile4, writeFile as writeFile5 } from "fs/promises";
-import path4 from "path";
+import path5 from "path";
 import { createInterface as createInterface2 } from "readline/promises";
 import { stdin as input2, stdout as output } from "process";
 
 // src/commands/app-capability-composition.ts
 import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile4 } from "fs/promises";
-import path3 from "path";
+import path4 from "path";
 async function reconcileApplicationCapabilitySource(options) {
-  const manifestPath = path3.resolve(options.manifestPath || "topolo.app.json");
-  const root = path3.dirname(manifestPath);
-  const packagePath = path3.join(root, "package.json");
-  const contractPath = path3.join(root, "topolo.capability-contract.json");
+  const manifestPath = path4.resolve(options.manifestPath || "topolo.app.json");
+  const root = path4.dirname(manifestPath);
+  const packagePath = path4.join(root, "package.json");
+  const contractPath = path4.join(root, "topolo.capability-contract.json");
   const manifest = parseRecord(await readFile3(manifestPath, "utf8"), manifestPath);
   const registration = record(manifest.registration);
   if (!registration) throw new Error("topolo.app.json must declare registration before capability composition.");
@@ -10701,13 +10857,15 @@ async function reconcileApplicationCapabilitySource(options) {
   const target = options.ownerType === "topolo_first_party" ? "platform" : "developer";
   const surfaces = resolveManifestSurfaces(manifest, registration);
   const existing = Array.isArray(registration.capabilities) ? registration.capabilities.filter((value) => typeof value === "string") : [];
+  const declaredNotificationRole = record(manifest.notifications)?.role;
+  const inferredCapabilities = declaredNotificationRole === "producer" ? ["notification_producer"] : [];
   const capabilities = resolveApplicationCapabilities({
     target,
     browser: surfaces.browser,
     api: surfaces.api,
     mobile: surfaces.mobile,
     distributionModel: registration.distributionModel === "marketplace" ? "marketplace" : "organization_internal",
-    requested: [...existing, ...options.additions ?? []]
+    requested: [...existing, ...inferredCapabilities, ...options.additions ?? []]
   });
   const marketplace = record(registration.marketplace);
   const unlistedNativeArtifact = options.ownerType === "topolo_first_party" && registration.surfaceModel === "mobile_container" && registration.distributionModel === "organization_internal" && marketplace?.intent === "unlisted";
@@ -10736,7 +10894,7 @@ async function reconcileApplicationCapabilitySource(options) {
   const nextDependencies = { ...dependencies };
   for (const packageName of capabilities.packages) {
     if (typeof nextDependencies[packageName] !== "string") {
-      nextDependencies[packageName] = packageVersion(packageName, target);
+      nextDependencies[packageName] = packageVersion(packageName, target, { repoRoot: options.repoRoot, cwd: root });
     }
   }
   const sortedDependencies = sortRecord(nextDependencies);
@@ -10746,9 +10904,9 @@ async function reconcileApplicationCapabilitySource(options) {
   compareChange(changes, "topolo.capability-contract.json", existingContract, expectedContract);
   const adapter = target === "platform" ? managedCapabilityAdapter(capabilities.selected) : null;
   const apiDirectory = resolveApiDirectory(root, manifest, target);
-  const adapterPath = path3.join(apiDirectory, "src", "topolo-capabilities.ts");
+  const adapterPath = path4.join(apiDirectory, "src", "topolo-capabilities.ts");
   if (adapter) compareChange(changes, relativePath(root, adapterPath), await readOptionalText(adapterPath), adapter);
-  const pricingPath = path3.join(root, "pricing-manifest.json");
+  const pricingPath = path4.join(root, "pricing-manifest.json");
   const pricingManifest = capabilities.selected.includes("billing") ? defaultPricingManifest({
     appId: String(manifest.appId || manifest.app_id || "").trim(),
     displayName: String(registration.displayName || manifest.name || "Application"),
@@ -10760,7 +10918,7 @@ async function reconcileApplicationCapabilitySource(options) {
   const missingResources = capabilities.resources.filter((resource) => !manifestProvidesResource(manifest, resource));
   const verticalConfiguration = [];
   for (const [capability2, fileName, description] of VERTICAL_CAPABILITY_FILES) {
-    if (capabilities.selected.includes(capability2) && !await fileExists(path3.join(root, fileName))) {
+    if (capabilities.selected.includes(capability2) && !await fileExists(path4.join(root, fileName))) {
       verticalConfiguration.push(`${fileName}: ${description}`);
     }
   }
@@ -10775,7 +10933,7 @@ async function reconcileApplicationCapabilitySource(options) {
     await writeJson(contractPath, expectedContract);
     if (pricingManifest) await writeJson(pricingPath, pricingManifest);
     if (adapter) {
-      await mkdir3(path3.dirname(adapterPath), { recursive: true });
+      await mkdir3(path4.dirname(adapterPath), { recursive: true });
       await writeFile4(adapterPath, adapter, "utf8");
     }
   }
@@ -10878,11 +11036,8 @@ function manifestProvidesResource(manifest, resource) {
   }
   return false;
 }
-function packageVersion(packageName, target) {
-  if (target === "platform") {
-    if (packageName === "@topolo-io/notifications") return "^0.6.8";
-    return "latest";
-  }
+function packageVersion(packageName, target, resolution) {
+  if (target === "platform") return platformPackagePin(packageName, resolution);
   if (packageName === "@topolo/login") return "^0.1.0";
   if (packageName === "@topolo/sdk") return "^0.8.1";
   throw new Error(`Capability registry exposed private package ${packageName} to a third-party application.`);
@@ -10959,13 +11114,13 @@ function resolveApiDirectory(root, manifest, target) {
   for (const value of Object.values(record(manifest.targets) ?? {})) {
     const targetRecord = record(value);
     if (targetRecord?.kind === "worker" && !targetRecord.assets && typeof targetRecord.dir === "string") {
-      return path3.resolve(root, targetRecord.dir);
+      return path4.resolve(root, targetRecord.dir);
     }
   }
-  return path3.join(root, "apps", "api");
+  return path4.join(root, "apps", "api");
 }
 function relativePath(root, filePath) {
-  return path3.relative(root, filePath).split(path3.sep).join("/");
+  return path4.relative(root, filePath).split(path4.sep).join("/");
 }
 
 // src/commands/app-reconcile.ts
@@ -11035,7 +11190,7 @@ function titleFromSlug(value) {
   return value.replace(/^topolo[-_]/, "").split(/[-_]+/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
 }
 async function completeApplicationRegistrationInteractively(options) {
-  const manifestPath = path4.resolve(options.manifestPath || "topolo.app.json");
+  const manifestPath = path5.resolve(options.manifestPath || "topolo.app.json");
   const manifest = JSON.parse(await readFile4(manifestPath, "utf8"));
   const existing = record2(manifest.registration) || {};
   const appId = String(manifest.appId || manifest.app_id || "").trim();
@@ -11084,7 +11239,7 @@ async function completeApplicationRegistrationInteractively(options) {
       },
       capabilities: Array.isArray(existing.capabilities) ? existing.capabilities : ["login", "launcher"],
       marketplace: record2(existing.marketplace) || {
-        intent: options.expectedOwnerType === "topolo_first_party" ? "submit_when_ready" : "not_requested",
+        intent: options.expectedOwnerType === "topolo_first_party" ? "publish" : "not_requested",
         status: "preview",
         shortBlurb: description,
         tagline: description,
@@ -11115,7 +11270,7 @@ async function completeApplicationRegistrationInteractively(options) {
   }
 }
 async function loadApplicationReconcileRequest(options) {
-  const manifestPath = path4.resolve(options.manifestPath || "topolo.app.json");
+  const manifestPath = path5.resolve(options.manifestPath || "topolo.app.json");
   const raw = await readFile4(manifestPath, "utf8");
   const manifest = JSON.parse(raw);
   assertRegistration(manifest.registration);
@@ -11161,7 +11316,8 @@ async function loadApplicationReconcileRequest(options) {
       requestedScopes: registration.auth?.requestedScopes ?? [],
       capabilities: registration.capabilities,
       marketplace: { ...registration.marketplace, appUrl: productionUrl },
-      notifications: manifest.notifications ?? null
+      notifications: manifest.notifications ?? null,
+      actions: manifest.actions ?? []
     }
   };
 }
@@ -11413,6 +11569,9 @@ function registerAppsCommand(program2) {
   apps.command("scaffold <application>").description(
     "Generate a third-party Topolo application scaffold for business or personal/household use."
   ).option("--json", "Output JSON").option("--no-json", "Output human-readable checklist").option("--app-dir <path>", "Application directory under the scaffold root").option("--name <name>", "Application display/package source name").option("--package-name <name>", "package.json name").option("--production-url <url>", "Production browser URL").option("--app-id <id>", "Stable SDK/Auth app id for API-backed apps").option("--audience <audience>", "Developer app audience: business or personal").option("--tenancy <tenancy>", "Developer app tenancy: organization or household").option(
+    "--distribution-model <model>",
+    "Developer app distribution: organization_internal or marketplace (marketplace requires approval)"
+  ).option(
     "--surface-model <surfaceModel>",
     "Developer app surface model: web_app, mobile_container, mobile_module, or messaging_surface"
   ).option("--container-app-id <appId>", "Container app id when --surface-model mobile_module is used").option("--capability <id...>", "Compose one or more approved Topolo capabilities").option("--write", "Write the generated scaffold files to disk").option("--repo-root <path>", "Directory where scaffold files should be written").option("--force", "Overwrite existing scaffold files when --write is set").option("--with-api", "Include API/service files for developer scaffolds").option("--no-api", "Do not include API/service requirements").option("--no-browser", "Do not include browser-shell requirements").option(
@@ -11433,6 +11592,7 @@ function registerAppsCommand(program2) {
         target: "developer",
         audience: resolveScaffoldAudience(opts.audience),
         tenancy: resolveScaffoldTenancy(opts.tenancy),
+        distributionModel: resolveScaffoldDistributionModel(opts.distributionModel),
         surfaceModel: resolveScaffoldSurfaceModel(opts.surfaceModel),
         containerAppId: opts.containerAppId,
         capabilities: opts.capability
@@ -11519,7 +11679,7 @@ function applicationAuditPayload(application, options = {}) {
 }
 function recordApplicationEvidence(application, options = {}) {
   const appId = resolveApplication(application).id;
-  const root = path5.resolve(options.appRoot ?? process.cwd());
+  const root = path6.resolve(options.appRoot ?? process.cwd());
   if (!existsSync4(root)) {
     throw new Error(`Application root does not exist: ${root}`);
   }
@@ -11531,12 +11691,12 @@ function recordApplicationEvidence(application, options = {}) {
       commit = void 0;
     }
   }
-  const evidenceDir = path5.join(root, ".topolo");
-  const evidencePath = path5.join(evidenceDir, "evidence.json");
+  const evidenceDir = path6.join(root, ".topolo");
+  const evidencePath = path6.join(evidenceDir, "evidence.json");
   let before = null;
   if (existsSync4(evidencePath)) {
     try {
-      const raw = JSON.parse(readFileSync5(evidencePath, "utf8"));
+      const raw = JSON.parse(readFileSync6(evidencePath, "utf8"));
       if (raw && typeof raw === "object" && raw.version === 1) {
         before = raw;
       }
@@ -11792,6 +11952,16 @@ function resolveScaffoldTenancy(value) {
   }
   throw new Error("Invalid --tenancy value. Use organization or household.");
 }
+function resolveScaffoldDistributionModel(value) {
+  if (!value) return void 0;
+  const normalized = value.trim().toLowerCase().replace(/-/g, "_");
+  if (normalized === "marketplace" || normalized === "organization_internal") {
+    return normalized;
+  }
+  throw new Error(
+    "Invalid --distribution-model value. Use organization_internal or marketplace."
+  );
+}
 function resolveScaffoldSurfaceModel(value) {
   if (!value) return void 0;
   const normalized = value.trim().toLowerCase();
@@ -11831,14 +12001,14 @@ function statusesAtOrWorse(threshold) {
 }
 
 // src/commands/platform.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync6, statSync as statSync2 } from "fs";
-import path7 from "path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync7, statSync as statSync2 } from "fs";
+import path8 from "path";
 
 // src/commands/app-capability-provision.ts
 import { readFile as readFile5, writeFile as writeFile6 } from "fs/promises";
-import path6 from "path";
+import path7 from "path";
 async function provisionApplicationResources(options) {
-  const manifestPath = path6.resolve(options.manifestPath || "topolo.app.json");
+  const manifestPath = path7.resolve(options.manifestPath || "topolo.app.json");
   const manifest = parseRecord2(await readFile5(manifestPath, "utf8"), manifestPath);
   const environments = requiredRecord(manifest.environments, "topolo.app.json#environments");
   const environment = requiredRecord(environments[options.environment], `topolo.app.json#environments.${options.environment}`);
@@ -12043,7 +12213,8 @@ function registerPlatformCommand(program2) {
         navigationMode: opts.navigationMode,
         workspaceSwitcher: opts.workspaceSwitcher,
         uiTemplate: opts.uiTemplate,
-        tagline: opts.tagline
+        tagline: opts.tagline,
+        repoRoot: opts.repoRoot
       });
       if (opts.workflowOnly && !payload.ciWorkflow) {
         throw new Error("--workflow-only is only available for first-party scaffolds.");
@@ -12110,12 +12281,12 @@ var SKIPPED_SCAN_DIRS = /* @__PURE__ */ new Set([
   "output"
 ]);
 function scanStagingProductionUrls(rootInput, allowPatterns) {
-  const root = path7.resolve(rootInput);
+  const root = path8.resolve(rootInput);
   const allowlist = allowPatterns.map((pattern) => new RegExp(pattern));
   const violations = [];
   function shouldSkipFile(filePath) {
-    const basename2 = path7.basename(filePath);
-    const relativePath2 = path7.relative(root, filePath);
+    const basename2 = path8.basename(filePath);
+    const relativePath2 = path8.relative(root, filePath);
     if (basename2 === "package-lock.json" || basename2 === "pnpm-lock.yaml" || basename2 === "yarn.lock") return true;
     if (basename2 === "topolo.cloudcontrol.json") return true;
     if (basename2 === "wrangler.toml" || basename2 === "wrangler.jsonc") return true;
@@ -12124,15 +12295,15 @@ function scanStagingProductionUrls(rootInput, allowPatterns) {
     if (basename2.endsWith(".generated.ts")) return true;
     if (basename2.endsWith(".test.ts") || basename2.endsWith(".test.tsx") || basename2.endsWith(".spec.ts")) return true;
     if (basename2 === ".env.production") return true;
-    if (relativePath2 === path7.join("src", "environment.ts") || relativePath2 === path7.join("src", "environmentUrls.ts") || relativePath2.endsWith(path7.join("src", "environment.ts")) || relativePath2.endsWith(path7.join("src", "lib", "environment.ts")) || relativePath2 === path7.join("packages", "topolo-ui-kit", "src", "environmentUrls.ts")) return true;
-    if (relativePath2.includes(`${path7.sep}test${path7.sep}`) || relativePath2.includes(`${path7.sep}tests${path7.sep}`) || relativePath2.includes(`${path7.sep}e2e${path7.sep}`)) return true;
-    if (relativePath2.startsWith(`scripts${path7.sep}`) || relativePath2.includes(`${path7.sep}scripts${path7.sep}`)) return true;
-    return !RUNTIME_EXTENSIONS.has(path7.extname(filePath));
+    if (relativePath2 === path8.join("src", "environment.ts") || relativePath2 === path8.join("src", "environmentUrls.ts") || relativePath2.endsWith(path8.join("src", "environment.ts")) || relativePath2.endsWith(path8.join("src", "lib", "environment.ts")) || relativePath2 === path8.join("packages", "topolo-ui-kit", "src", "environmentUrls.ts")) return true;
+    if (relativePath2.includes(`${path8.sep}test${path8.sep}`) || relativePath2.includes(`${path8.sep}tests${path8.sep}`) || relativePath2.includes(`${path8.sep}e2e${path8.sep}`)) return true;
+    if (relativePath2.startsWith(`scripts${path8.sep}`) || relativePath2.includes(`${path8.sep}scripts${path8.sep}`)) return true;
+    return !RUNTIME_EXTENSIONS.has(path8.extname(filePath));
   }
   function scanFile(filePath) {
     if (shouldSkipFile(filePath)) return;
-    const relativePath2 = path7.relative(root, filePath);
-    const content = readFileSync6(filePath, "utf8");
+    const relativePath2 = path8.relative(root, filePath);
+    const content = readFileSync7(filePath, "utf8");
     const lines = content.split(/\r?\n/);
     lines.forEach((line, index) => {
       const matches = [...line.matchAll(PRODUCTION_TOPOLO_URL_PATTERN)].map((match) => match[0]);
@@ -12145,8 +12316,8 @@ function scanStagingProductionUrls(rootInput, allowPatterns) {
     });
   }
   function walk(dir) {
-    for (const entry of readdirSync2(dir, { withFileTypes: true })) {
-      const fullPath = path7.join(dir, entry.name);
+    for (const entry of readdirSync3(dir, { withFileTypes: true })) {
+      const fullPath = path8.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (!SKIPPED_SCAN_DIRS.has(entry.name)) walk(fullPath);
         continue;
@@ -12314,7 +12485,7 @@ var DEFAULT_SEED_BASE_URL = "https://seed.stg.topolo.us";
 function seedBaseUrl() {
   return process.env.TOPOLO_SEED_URL || DEFAULT_SEED_BASE_URL;
 }
-async function authedFetch(path8, init = {}) {
+async function authedFetch(path9, init = {}) {
   const credential = await refreshCredentialIfNeeded("staging");
   if (!credential) {
     throw new Error("No staging credential configured. Run `topolo auth login --env staging` or set TOPOLO_STAGING_API_KEY.");
@@ -12324,7 +12495,7 @@ async function authedFetch(path8, init = {}) {
   else headers.set("Authorization", `Bearer ${credential.accessToken}`);
   headers.set("X-Topolo-Client", `topolo-cli/${CLI_VERSION}`);
   if (init.body && !headers.has("Content-Type")) headers.set("Content-Type", "application/json");
-  const response = await fetch(`${seedBaseUrl()}${path8}`, { ...init, headers });
+  const response = await fetch(`${seedBaseUrl()}${path9}`, { ...init, headers });
   const text = await response.text();
   let body;
   try {
@@ -12601,7 +12772,7 @@ function createOAuthClientPayload(options) {
     logo_url: options.logoUrl
   };
 }
-async function authFetchJson(path8, init = {}) {
+async function authFetchJson(path9, init = {}) {
   const environment = selectedEnvironment();
   const credential = await refreshCredentialIfNeeded(environment);
   if (!credential) {
@@ -12623,7 +12794,7 @@ async function authFetchJson(path8, init = {}) {
     throw err;
   }
   headers.set("Authorization", `Bearer ${credential.accessToken}`);
-  const response = await fetch(`${authBaseUrl}${path8}`, { ...init, headers });
+  const response = await fetch(`${authBaseUrl}${path9}`, { ...init, headers });
   const text = await response.text();
   const payload = text ? JSON.parse(text) : {};
   if (!response.ok || payload.success === false) {
@@ -12878,11 +13049,11 @@ function registerViaOfficialCli(cli, mcp, agentName) {
   return result.status === 0;
 }
 async function registerClaudeViaConfig(mcp) {
-  const path8 = join5(homedir2(), ".claude.json");
+  const path9 = join5(homedir2(), ".claude.json");
   let config = {};
-  if (existsSync5(path8)) {
+  if (existsSync5(path9)) {
     try {
-      config = JSON.parse(await readFile7(path8, "utf8"));
+      config = JSON.parse(await readFile7(path9, "utf8"));
     } catch {
       config = {};
     }
@@ -12895,13 +13066,13 @@ async function registerClaudeViaConfig(mcp) {
     env: { TOPOLO_AGENT_NAME: AGENT_NAME_FOR.claude }
   };
   config.mcpServers = servers;
-  await writeFile7(path8, `${JSON.stringify(config, null, 2)}
+  await writeFile7(path9, `${JSON.stringify(config, null, 2)}
 `, "utf8");
 }
 async function registerCodexViaConfig(mcp) {
-  const path8 = join5(homedir2(), ".codex", "config.toml");
+  const path9 = join5(homedir2(), ".codex", "config.toml");
   let text = "";
-  if (existsSync5(path8)) text = await readFile7(path8, "utf8");
+  if (existsSync5(path9)) text = await readFile7(path9, "utf8");
   text = text.replace(
     /(^|\n)\[mcp_servers\.topolo(?:\.[a-z]+)?\][^\[]*/g,
     (match) => match.startsWith("\n") ? "\n" : ""
@@ -12917,8 +13088,8 @@ command = "${mcp.command}"${argsToml}
 [mcp_servers.topolo.env]
 TOPOLO_AGENT_NAME = "${AGENT_NAME_FOR.codex}"
 `;
-  await mkdir4(dirname4(path8), { recursive: true });
-  await writeFile7(path8, `${text}${block}`, "utf8");
+  await mkdir4(dirname4(path9), { recursive: true });
+  await writeFile7(path9, `${text}${block}`, "utf8");
 }
 async function installForAgent(agent, sourceDir, mcp, opts) {
   const skillDir = agent === "claude" ? claudeSkillDir(opts.projectDir) : codexSkillDir();