diff --git a/docs/design/2026-10-29-dynamo-tapis-app-registration.md b/docs/design/2026-10-29-dynamo-tapis-app-registration.md
new file mode 100644
index 00000000..f61851d9
--- /dev/null
+++ b/docs/design/2026-10-29-dynamo-tapis-app-registration.md
@@ -0,0 +1,294 @@
+# Register a Tapis application from the model form
+
+## Status
+
+Implemented (2026-10-29). Deviations are listed under Decisions. Live end-to-end check done on the dev tenant (see Implementation notes).
+
+## Objective
+
+Let a model author create the Tapis application their model runs as without
+leaving DYNAMO, by pasting or uploading an `app.json`, from inside the model
+configuration form. The created application is made public so other users can
+run the model. After creation, it is selected and, if the author agrees, its
+inputs and parameters fill the form.
+
+## User need
+
+Model authors publish a cookbook in a separate tool (the Cookbook UI), then
+return to DYNAMO and find it in a list. That is two tools, a copy-and-paste of
+`app.json`, and a "why is my app not in the list" support path. The guide now
+documents this flow ([Make a model runnable](../../ui-react/docs/docs/data-scientist/make-model.md));
+the goal is to remove the middle step.
+
+## Current code/system summary
+
+- `ComponentLocationSection` offers two modes: **Tapis application**
+  (`TapisAppPicker`) and **Any URL**. Picking an app stores its canonical URL
+  `https://{tenant}.tapis.io/v3/apps/{id}/{version}`. `buildSeedFromTapisApp`
+  fills inputs from `fileInputs` and parameters from `appArgs`, skipping `FIXED`
+  entries and entries with no `name` (`ui-react/src/lib/tapis-apps.ts`).
+- Today the picker lists and reads apps through two model catalog API routes that
+  proxy to Tapis. This change does not use or modify those routes.
+- The deployment uses the `portals` tenant. `getTapisTenant()` derives it from
+  `AUTH_SERVER` in runtime config, so the tenant is configuration, not user input.
+- The signed-in user already holds a Tapis access token in the browser
+  (`token-store`), used today for Hasura and the Ensemble Manager.
+- Tapis allows browser calls from any origin: a preflight for `POST /v3/apps` with
+  `x-tapis-token` and `content-type` returns `access-control-allow-origin: *`
+  (checked 2026-10-29 against `portals.tapis.io`). This is how the Cookbook UI,
+  hosted on github.io, works.
+- The run path matches model input labels to `fileInput.name` and parameter labels
+  to `appArgs.name`, exactly or case-insensitively (`TapisJobService.ts`).
+- `TapisAppPicker` fetches its list once per tenant. Nothing re-fetches it.
+
+## Proposed design
+
+All of it is in the UI. No model catalog API, Hasura or database change.
+
+### Tapis client (`tapis-apps.ts`)
+
+One client for every Tapis app call, with the base URL `https://{tenant}.tapis.io`
+built from the configured tenant and the header `X-Tapis-Token` set from the
+stored token:
+- `listTapisApps`, `getTapisApp`: the existing list and read, moved from the API
+  routes to Tapis directly (`GET /v3/apps`, `GET /v3/apps/{id}/{version}`), so the
+  dialog's duplicate check and read-back use the same path as the picker and there
+  is one failure mode, not two.
+- `createTapisApp(definition)`: `POST /v3/apps`. Returns `{ tenant, id, version }`
+  from Tapis's response, falling back to the posted values.
+- `shareTapisAppPublic(id)`: `POST /v3/apps/share_public/{id}`. Tapis shares an app
+  by id, so this covers every version of that id, not only the new one. It is
+  allowed from the browser (checked 2026-10-29).
+- An error parser that reads Tapis's JSON error body and returns its `message`.
+  Today's `getJson` discards the body. Path segments go through
+  `encodeURIComponent`.
+- `parseTapisAppDefinition(text)`: returns the parsed reference and a summary (id,
+  version, image, input files, settings, time, memory and cores), or an error. It
+  reuses `buildSeedFromTapisApp`, so the review step shows exactly what will fill
+  the form. It is unit-tested without the DOM.
+
+**Checks before sending** (Tapis remains the validator, these make errors fast and
+clear):
+- A JSON object with string `id`, `version` and `containerImage`; length caps.
+- `id` and `version` must not contain `/`, and `id` must not be `share`, because
+  the stored URL would not parse.
+- No top-level `owner`, `tenant`, `isPublic` or `deleted`, so the form cannot set
+  another owner or bypass the public-sharing step below.
+- A non-empty `parameterSet.envVariables` is flagged, because the definition will
+  be visible to everyone once public. It tells the author not to put secrets in it.
+- `containerImage` must carry a tag or digest. `:latest` and untagged images are
+  refused, which keeps runs reproducible.
+- A non-`FIXED` input or setting with no `name` is warned about, because the app
+  would not run in DYNAMO. All-`FIXED` inputs say "no inputs to fill".
+- A file over a small size, or a non-JSON file, is rejected.
+
+### List and reload
+
+A small `useTapisApps()` hook with a `reload()` replaces the list state inside
+`TapisAppPicker`. The picker and the dialog share it.
+
+### Dialog (`RegisterTapisAppDialog`)
+
+Presentational. Props: `existingApps`, `onCreated(ref)`. All form writes stay in
+`ComponentLocationSection`.
+1. Provide the definition by upload or paste.
+2. Review: the summary, with the image, any `execSystemId` and unknown top-level
+   keys highlighted. Invalid or incomplete definitions block Create. A likely
+   duplicate id and version is advisory, and Tapis's 409 is the authority.
+3. Create, disabled while the request is in flight, with a line stating this
+   creates a real application under the author's account **and makes it public,
+   so anyone signed in to Tapis can see its definition and run it**, that DYNAMO
+   cannot edit or remove it afterwards, and that it exists even if the model form
+   is not saved. Nothing is sent before this click.
+4. Errors show Tapis's message and keep the pasted text. No automatic retry. After
+   a timeout, reload the list before allowing another Create.
+
+### Create, then share
+
+Create runs as two Tapis calls in order: `POST /v3/apps`, then
+`POST /v3/apps/share_public/{id}`. They are separate, so the second can fail after
+the first succeeds.
+- If sharing fails, the app exists and is private. The dialog says so plainly
+  ("created, but could not make it public, so only you can run it"), selects the
+  app, and offers a **Make public** retry that repeats only the share call. It
+  never reports the create as failed and never re-creates.
+- Sharing is by id, so a later version of an already-public id is public already
+  and the share call is harmless. If Tapis answers that it is already public, treat
+  that as success.
+
+### After create (`ComponentLocationSection`)
+
+On `onCreated(ref)`: set the component location to the canonical URL built from
+Tapis's returned id and version, `reload()` the list, then read the app back with
+`getTapisApp(ref)` so the seed reflects what Tapis stored.
+- If the form already has input or parameter rows, the success step asks
+  **Replace** or **Keep my rows** before changing anything.
+- If the read-back fails, the app is still selected and the dialog says "created,
+  but could not read it back; use Fill inputs". It never reports the create as
+  failed.
+
+The button appears only in Tapis mode when Tapis components are in use.
+
+### Guide
+
+Update **Make a model runnable** so step 5 becomes "Create the application in
+DYNAMO", with the Cookbook UI as an alternative, and add a dialog screenshot.
+
+## Files likely affected
+
+- `ui-react/src/lib/tapis-apps.ts`: direct client, parse, checks, error parser
+- `ui-react/src/hooks/useTapisApps.ts` (new)
+- `ui-react/src/components/registration/RegisterTapisAppDialog.tsx` (new),
+  `ComponentLocationSection.tsx`, `TapisAppPicker.tsx`
+- `ui-react/src/test/msw/handlers.ts` and component and library tests
+- `ui-react/docs/docs/data-scientist/make-model.md`, `troubleshooting.md`, one image
+- DSO-Architecture: the model-form integration notes for the UI (the UI now calls
+  Tapis apps directly). No service page changes, because no API changes.
+
+## API/schema changes
+
+None. The model catalog API's two Tapis routes stay in place and unused by this
+feature. They are not modified.
+
+## Data flow
+
+```text
+Dialog (paste/upload) -> parse + review (browser, no network)
+  -> POST https://portals.tapis.io/v3/apps   (X-Tapis-Token = user's token)
+  -> 201 {tenant,id,version}
+  -> UI: set component location, reload list, GET app, confirm, seed form
+```
+
+## Risks and tradeoffs
+
+- **A write to an external system.** It acts as the user and is limited by what
+  Tapis already allows that user, the same as the Cookbook UI. DYNAMO adds no
+  privilege and holds no extra credential.
+- **Public means public.** Once shared, every user in the Tapis tenant can see the
+  full definition and run the app on their own allocation. A definition can carry
+  an environment variable, a path or an image reference the author did not mean to
+  expose. The review step flags `envVariables`, `execSystemId` and the image, and
+  the Create line says the app becomes public. DYNAMO cannot make an app private
+  again. That needs Tapis (owner or administrator).
+- **Two calls can half-succeed.** Create and share are separate. A failed share
+  leaves a private app. The dialog handles this explicitly (see above).
+- **Pasted definitions are powerful.** A definition can name any image and run on
+  any system the user can reach. The real new risk is social: an author pastes a
+  definition from a tutorial and unknowingly creates a runnable app. The review
+  step highlights image, system and unknown fields.
+- **Browser holds the token.** It already does, for Hasura and the Ensemble
+  Manager. This adds one more place the token is sent, to `portals.tapis.io` only,
+  taken from configuration. Nothing in a pasted definition or the URL can change
+  the destination, and the token is never logged or shown.
+- **Checks are client-side only.** There is no server to enforce them, so they are
+  guidance. Tapis is the authority. Refusing `:latest` images and `owner` keys
+  helps honest users and does not stop a determined one, who could use the Cookbook
+  UI anyway.
+- **No in-DYNAMO edit or delete.** A mistaken app is corrected as a new version or
+  disabled in Tapis. Tapis has no hard delete for versions.
+- **Orphaned apps.** The form is saved separately, so an abandoned model form can
+  leave a created app behind. The dialog says the app is created immediately.
+- **Raw `app.json` is easy to get wrong.** The review step and Tapis's messages
+  are the safety net.
+- **Read-after-write lag.** Tapis may not list a new app immediately. The UI
+  selects by the known reference and does not retry silently.
+- **The existing API routes keep their own flaw.** They build the Tapis address
+  from an unchecked `tenant` in the URL, so a crafted value could send a token to
+  another host. This feature no longer touches them. It is recorded here as a
+  separate issue to raise, not fixed in this change.
+
+## Alternatives considered
+
+- **Through the model catalog API.** The first choice. Dropped: the API should not
+  be involved, and it added a server route, validation, logging and CORS work for
+  something Tapis already permits from the browser.
+- **Guided form from the two templates.** Easier for authors, more UI, and it
+  would drop Tapis fields advanced users need. Deferred.
+- **A separate Register Application page.** More navigation for the same result.
+- **Link out to the Cookbook UI.** No write, but keeps the two-tool step.
+- **Registry restriction.** Left to Tapis. A browser-side allowlist is trivially
+  bypassed.
+
+## Test plan
+
+- Library (unit): parse and summary; every pre-send check including the
+  `envVariables` flag; error-message extraction from a Tapis error body; path
+  segments encoded; `shareTapisAppPublic` calls the right path with the id encoded
+  and treats "already public" as success.
+- UI (MSW):
+  - Invalid or oversized JSON blocked; upload and paste both work.
+  - The review summary is correct, including the unnamed-input warning, the
+    all-`FIXED` message and a duplicate flag.
+  - No request before Create; Create disabled while in flight; cancel sends
+    nothing.
+  - The request goes to the configured tenant with the `X-Tapis-Token` header and
+    nothing else carries the token.
+  - Success selects the app, reloads the list so it includes the new app, and
+    seeds from the read-back app.
+  - Replace or Keep choice appears when rows exist.
+  - Success calls create then share, in that order, and the dialog states the app is public.
+  - A failing share after a successful create leaves the app selected, says it is
+    private, offers Make public, and Make public sends only the share call.
+  - The `envVariables` warning appears in the review step.
+  - A failing read-back after a successful create leaves the app selected and does
+    not report a create failure.
+  - A Tapis error shows its message and keeps the pasted text.
+  - The picker still lists and reads apps through the direct client.
+- Manual, dev only, with the user's confirmation at run time because it writes
+  (the user agreed on 2026-10-29, and I will name the app and ask once more
+  first): create one clearly named throwaway app (`dynamo-ui-test-<date>`),
+  confirm it appears, is public and seeds a form, then ask an owner or administrator
+  to make it private and disable it in Tapis. Because it is public, it will be
+  visible to the whole tenant until then, so use a harmless definition (for example
+  the command template).
+
+## Documentation plan
+
+Update the guide pages and screenshot above, and the DSO-Architecture notes for
+the model form's Tapis integration.
+
+## Rollout/rollback plan
+
+UI only, no deploy ordering. Rollback is reverting the UI change. Applications
+already created in Tapis stay in place, and the owner or an administrator
+disables them in Tapis.
+
+## Open questions
+
+None. Both earlier questions were answered by the user on 2026-10-29 (see Decisions).
+
+## Decisions
+
+- 2026-10-29: Create the app inside the model form, not on a separate page or via a link out.
+- 2026-10-29: Author pastes or uploads `app.json`. A guided form is deferred.
+- 2026-10-29: Writes go directly from the UI to Tapis with the user's own token. The model catalog API is not involved. This replaces the earlier choice to go through the API.
+- 2026-10-29: The deployment tenant is `portals`, taken from configuration.
+- 2026-10-29: Seed from a read-back of the created app, and ask before replacing existing rows.
+- 2026-10-29: No registry restriction (left to Tapis).
+- 2026-10-29: Manual dev test creating one throwaway app was agreed in principle by the user.
+- 2026-10-29: The picker's existing list and read calls also move to Tapis directly, so there is one path.
+- 2026-10-29: The line "this creates a real application under your account" is enough as the confirmation. No typed confirmation. The line also states the app becomes public.
+- 2026-10-29: The created app is made public through Tapis's public-share call, as a second step after create, per the user.
+
+- 2026-10-29 (deviation): `owner` is allowed when it is exactly `${apiUserId}`, and any other value is refused. The security review proposed rejecting `owner` outright, but the official Tapis templates carry `"owner": "${apiUserId}"`, which Tapis resolves to the requester, so rejecting it would have refused the templates this feature exists for.
+- 2026-10-29 (deviation, behaviour change): the picker now lists with `listType=ALL&limit=-1`. Tapis lists only the caller's own apps by default, so an app made public by someone else would never appear. On the dev tenant that moves the list from 31 apps to 164. `limit=-1` is needed because `listType=ALL` alone stops at 100 and silently drops the rest. Checked live with a signed-in token on 2026-10-29.
+- 2026-10-29 (deviation): the dialog shows the "creates a real application ... and makes it public" notice and the Create button together on the review step, and `envVariables` produce a warning but do not block Create.
+- 2026-10-29: The model catalog API's two Tapis routes were left unchanged, and the unchecked-tenant flaw in them is still open as a separate issue.
+
+## Implementation notes
+
+- `ui-react/src/lib/tapis-apps.ts`: direct Tapis client (`listTapisApps`, `getTapisApp`, `createTapisApp`, `shareTapisAppPublic`) and `parseTapisAppDefinition`.
+- `ui-react/src/hooks/useTapisApps.ts`: shared list with `reload()`. It reads nothing when the deployment does not use Tapis.
+- `ui-react/src/components/registration/RegisterTapisAppDialog.tsx`: the dialog.
+- `ComponentLocationSection.tsx` and `TapisAppPicker.tsx`: button, reload, and a picker that takes its list as a prop.
+- Tests: 13 dialog tests, library tests for every pre-send check and request, and the existing section tests moved to the direct Tapis URLs. The full suite passes (131 files, 1251 tests), and typecheck and lint are clean. A deliberate break in the share step is caught by exactly the two share tests.
+- Live check (2026-10-29, with the user's approval): this branch's UI, run locally against the real `portals` Tapis tenant with the signed-in user's token. The picker listed 164 apps straight from Tapis. The real Docker command template, with only its id and description changed (`dynamo-ui-test-20261029`, including `"owner": "${apiUserId}"`), passed the checks and reviewed correctly. Create made the app under the user's account, sharing made it public (Tapis reported `publicShare: true` and it appeared in the public list), the picker selected it, and the form filled with the `Greeting` and `Target` settings. Cleanup: the app was then made private and disabled through Tapis (owner, no administrator needed). It cannot be deleted. The create-failure, share-failure and read-back-failure paths are covered by the unit tests only, not live.
+- Not yet done: guide update (waits on the cookbook guide PR), a dialog screenshot for the guide (captured locally, held back until the guide page merges), and the DSO-Architecture note (held until this feature is merged, so the docs do not describe unmerged behaviour).
+
+## User feedback / decisions
+
+Scope and input method chosen by the user on 2026-10-29. The user then directed
+that the API must not be involved and that the UI should call Tapis directly,
+with `portals` as the tenant. The user then approved implementation. The user confirmed moving the picker's list and read
+calls to Tapis, that the "creates a real application" line is enough, and that the
+created app must be public. Awaiting explicit approval to implement.
diff --git a/ui-react/src/components/registration/ComponentLocationSection.tsx b/ui-react/src/components/registration/ComponentLocationSection.tsx
index 68424731..04697239 100644
--- a/ui-react/src/components/registration/ComponentLocationSection.tsx
+++ b/ui-react/src/components/registration/ComponentLocationSection.tsx
@@ -21,16 +21,22 @@ import { useFormContext } from 'react-hook-form';
 import { FormControl, FormField, FormItem, FormMessage } from '@/components/ui/form';
 import { Input } from '@/components/ui/input';
 import { Tabs, TabsList, TabsTrigger } from '@/components/ui/tabs';
+import { Button } from '@/components/ui/button';
 import { useToast } from '@/components/ui/use-toast';
+import { useTapisApps } from '@/hooks/useTapisApps';
 import {
   buildSeedFromTapisApp,
+  buildTapisAppUrl,
+  getTapisApp,
   getTapisTenant,
   parseTapisAppUrl,
   usesTapisComponents,
   type TapisApp,
+  type TapisAppRef,
 } from '@/lib/tapis-apps';
 import { emptyInputRow, emptyParameterRow } from '@/schemas/configuration';
 import type { CreateModelSchema } from '@/schemas/registration';
+import { RegisterTapisAppDialog } from './RegisterTapisAppDialog';
 import { TapisAppPicker } from './TapisAppPicker';
 
 type Mode = 'tapis' | 'url';
@@ -54,6 +60,9 @@ export function ComponentLocationSection() {
     initialMode(getValues('componentLocation') ?? '', tapisAvailable),
   );
 
+  const list = useTapisApps(tapisAvailable ? tenant : null);
+  const [registerOpen, setRegisterOpen] = React.useState(false);
+
   const inputCount = watch('inputs')?.length ?? 0;
   const parameterCount = watch('parameters')?.length ?? 0;
   const syncWarning =
@@ -93,6 +102,17 @@ export function ComponentLocationSection() {
     });
   };
 
+  /** A created app becomes the model's component, and joins the list. */
+  const handleCreated = (ref: TapisAppRef) => {
+    setValue('componentLocation', buildTapisAppUrl(ref), { shouldDirty: true });
+    list.reload();
+  };
+
+  /** Read the app back from Tapis, so the seed matches what Tapis stored. */
+  const handleFill = async (ref: TapisAppRef) => {
+    applySeed(await getTapisApp(ref));
+  };
+
   const handleModeChange = (next: string) => {
     setMode(next === 'tapis' ? 'tapis' : 'url');
     // Clearing on a mode switch would throw away a value the other mode cannot
@@ -124,7 +144,7 @@ export function ComponentLocationSection() {
             <FormControl>
               {tapisAvailable && mode === 'tapis' ? (
                 <TapisAppPicker
-                  tenant={tenant}
+                  list={list}
                   value={value}
                   onChange={field.onChange}
                   onSync={applySeed}
@@ -143,6 +163,23 @@ export function ComponentLocationSection() {
           </FormItem>
         )}
       />
+
+      {tapisAvailable && mode === 'tapis' && tenant && (
+        <div className="mt-2">
+          <Button type="button" variant="outline" size="sm" onClick={() => setRegisterOpen(true)}>
+            Register a new application
+          </Button>
+          <RegisterTapisAppDialog
+            open={registerOpen}
+            onOpenChange={setRegisterOpen}
+            tenant={tenant}
+            existingApps={list.apps}
+            hasRows={inputCount + parameterCount > 0}
+            onCreated={handleCreated}
+            onFill={handleFill}
+          />
+        </div>
+      )}
     </section>
   );
 }
diff --git a/ui-react/src/components/registration/RegisterTapisAppDialog.tsx b/ui-react/src/components/registration/RegisterTapisAppDialog.tsx
new file mode 100644
index 00000000..12a9c79a
--- /dev/null
+++ b/ui-react/src/components/registration/RegisterTapisAppDialog.tsx
@@ -0,0 +1,344 @@
+/**
+ * RegisterTapisAppDialog — create the Tapis application a model runs, without
+ * leaving the model form.
+ *
+ * The author pastes or uploads an app.json, reviews what it will create, and
+ * confirms. Creating is two Tapis calls: create the app, then make it public.
+ * They are separate, so the second can fail after the first succeeds; the app
+ * then exists but is private, and the dialog offers to retry only the sharing.
+ *
+ * The dialog writes nothing to the model form. It tells its caller when the app
+ * exists (`onCreated`) and, once the author agrees, to fill the form from it
+ * (`onFill`).
+ */
+import * as React from 'react';
+import { AlertTriangle, CheckCircle2, Loader2 } from 'lucide-react';
+
+import { Button } from '@/components/ui/button';
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog';
+import { Label } from '@/components/ui/label';
+import { Textarea } from '@/components/ui/textarea';
+import {
+  MAX_APP_DEFINITION_BYTES,
+  createTapisApp,
+  parseTapisAppDefinition,
+  shareTapisAppPublic,
+  type TapisAppRef,
+} from '@/lib/tapis-apps';
+
+export interface RegisterTapisAppDialogProps {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  tenant: string;
+  /** Apps already listed, so a likely duplicate can be flagged before Create. */
+  existingApps: TapisAppRef[];
+  /** True when the form already has inputs or parameters a fill would replace. */
+  hasRows: boolean;
+  /** The app exists. The caller selects it and reloads its list. */
+  onCreated: (ref: TapisAppRef) => void;
+  /** Read the app back and fill the form from it. Rejects if it cannot be read. */
+  onFill: (ref: TapisAppRef) => Promise<void>;
+}
+
+type Step = 'provide' | 'review' | 'done';
+type FillState = 'pending' | 'filled' | 'kept' | 'failed';
+
+function message(err: unknown, fallback: string): string {
+  return err instanceof Error ? err.message : fallback;
+}
+
+export function RegisterTapisAppDialog({
+  open,
+  onOpenChange,
+  tenant,
+  existingApps,
+  hasRows,
+  onCreated,
+  onFill,
+}: RegisterTapisAppDialogProps) {
+  const [step, setStep] = React.useState<Step>('provide');
+  const [text, setText] = React.useState('');
+  const [fileError, setFileError] = React.useState<string | null>(null);
+  const [busy, setBusy] = React.useState(false);
+  const [createError, setCreateError] = React.useState<string | null>(null);
+  const [created, setCreated] = React.useState<TapisAppRef | null>(null);
+  const [shareError, setShareError] = React.useState<string | null>(null);
+  const [isPublic, setIsPublic] = React.useState(false);
+  const [fill, setFill] = React.useState<FillState>('pending');
+
+  // Start clean each time the dialog opens.
+  React.useEffect(() => {
+    if (open) return;
+    setStep('provide');
+    setText('');
+    setFileError(null);
+    setBusy(false);
+    setCreateError(null);
+    setCreated(null);
+    setShareError(null);
+    setIsPublic(false);
+    setFill('pending');
+  }, [open]);
+
+  const parsed = React.useMemo(() => (text.trim() ? parseTapisAppDefinition(text) : null), [text]);
+
+  const handleFile = async (file: File | undefined) => {
+    setFileError(null);
+    if (!file) return;
+    if (file.size > MAX_APP_DEFINITION_BYTES) {
+      setFileError('That file is too large to be an app.json.');
+      return;
+    }
+    setText(await file.text());
+  };
+
+  const runFill = async (ref: TapisAppRef) => {
+    setFill('pending');
+    try {
+      await onFill(ref);
+      setFill('filled');
+    } catch {
+      setFill('failed');
+    }
+  };
+
+  const runShare = async (ref: TapisAppRef) => {
+    setShareError(null);
+    try {
+      await shareTapisAppPublic(ref.tenant, ref.id);
+      setIsPublic(true);
+    } catch (err) {
+      setShareError(message(err, 'Could not make the application public.'));
+    }
+  };
+
+  const handleCreate = async () => {
+    if (!parsed?.ok || busy) return;
+    setBusy(true);
+    setCreateError(null);
+    let ref: TapisAppRef;
+    try {
+      ref = await createTapisApp(tenant, parsed.definition);
+    } catch (err) {
+      setCreateError(message(err, 'Could not create the application.'));
+      setBusy(false);
+      return;
+    }
+    // The app exists from here on. Nothing below may report the create as failed.
+    setCreated(ref);
+    onCreated(ref);
+    setStep('done');
+    await runShare(ref);
+    if (!hasRows) await runFill(ref);
+    setBusy(false);
+  };
+
+  const duplicate =
+    parsed?.ok &&
+    existingApps.some((a) => a.id === parsed.summary.id && a.version === parsed.summary.version);
+
+  return (
+    // A create in flight cannot be taken back, so the dialog stays until it settles.
+    <Dialog open={open} onOpenChange={(next) => (busy && !next ? undefined : onOpenChange(next))}>
+      <DialogContent className="max-h-[85vh] max-w-2xl overflow-y-auto">
+        <DialogHeader>
+          <DialogTitle>Register a new application</DialogTitle>
+          <DialogDescription>
+            Create the Tapis application your model runs from its app.json.
+          </DialogDescription>
+        </DialogHeader>
+
+        {step === 'provide' && (
+          <div className="space-y-3">
+            <div className="space-y-1.5">
+              <Label htmlFor="app-json-file">Upload an app.json</Label>
+              <input
+                id="app-json-file"
+                type="file"
+                accept=".json,application/json"
+                className="block w-full text-sm"
+                onChange={(e) => void handleFile(e.target.files?.[0])}
+              />
+              {fileError && (
+                <p role="alert" className="text-xs text-destructive">
+                  {fileError}
+                </p>
+              )}
+            </div>
+            <div className="space-y-1.5">
+              <Label htmlFor="app-json-text">Or paste it here</Label>
+              <Textarea
+                id="app-json-text"
+                rows={12}
+                spellCheck={false}
+                className="font-mono text-xs"
+                placeholder='{ "id": "my-model", "version": "0.1.0", "containerImage": "docker://ghcr.io/me/my-model:0.1.0", ... }'
+                value={text}
+                onChange={(e) => setText(e.target.value)}
+              />
+              {parsed && !parsed.ok && (
+                <p role="alert" className="text-xs text-destructive">
+                  {parsed.error}
+                </p>
+              )}
+            </div>
+            <DialogFooter>
+              <Button type="button" variant="outline" onClick={() => onOpenChange(false)}>
+                Cancel
+              </Button>
+              <Button type="button" disabled={!parsed?.ok} onClick={() => setStep('review')}>
+                Review
+              </Button>
+            </DialogFooter>
+          </div>
+        )}
+
+        {step === 'review' && parsed?.ok && (
+          <div className="space-y-4">
+            <dl className="grid grid-cols-[8rem_1fr] gap-x-3 gap-y-1 text-sm">
+              <dt className="text-muted-foreground">Id</dt>
+              <dd className="font-medium">{parsed.summary.id}</dd>
+              <dt className="text-muted-foreground">Version</dt>
+              <dd>{parsed.summary.version}</dd>
+              <dt className="text-muted-foreground">Container image</dt>
+              <dd className="break-all">{parsed.summary.containerImage}</dd>
+              <dt className="text-muted-foreground">Runs on</dt>
+              <dd>{parsed.summary.execSystemId ?? 'Not stated'}</dd>
+              <dt className="text-muted-foreground">Limits</dt>
+              <dd>
+                {[
+                  parsed.summary.maxMinutes != null && `${parsed.summary.maxMinutes} min`,
+                  parsed.summary.coresPerNode != null && `${parsed.summary.coresPerNode} core(s)`,
+                  parsed.summary.memoryMB != null && `${parsed.summary.memoryMB} MB`,
+                ]
+                  .filter(Boolean)
+                  .join(', ') || 'Not stated'}
+              </dd>
+              <dt className="text-muted-foreground">Inputs</dt>
+              <dd>
+                {parsed.summary.inputs.length > 0
+                  ? parsed.summary.inputs
+                      .map((i) => `${i.label}${i.isOptional ? ' (optional)' : ''}`)
+                      .join(', ')
+                  : 'No inputs to fill'}
+              </dd>
+              <dt className="text-muted-foreground">Settings</dt>
+              <dd>
+                {parsed.summary.parameters.length > 0
+                  ? parsed.summary.parameters.map((p) => p.label).join(', ')
+                  : 'None'}
+              </dd>
+            </dl>
+
+            {duplicate && (
+              <p className="flex items-start gap-1.5 text-sm text-amber-700">
+                <AlertTriangle className="mt-0.5 h-4 w-4 shrink-0" />
+                <span>
+                  An application with this id and version already appears in your list. Tapis will
+                  refuse to create it again, so change the version.
+                </span>
+              </p>
+            )}
+            {parsed.warnings.map((w) => (
+              <p key={w} className="flex items-start gap-1.5 text-sm text-amber-700">
+                <AlertTriangle className="mt-0.5 h-4 w-4 shrink-0" />
+                <span>{w}</span>
+              </p>
+            ))}
+
+            <p className="rounded-md border bg-muted/40 p-3 text-sm">
+              This creates a real application under your account and makes it public, so anyone
+              signed in to Tapis can see its definition and run it. DYNAMO cannot edit or remove it
+              afterwards, and it exists even if you do not save the model.
+            </p>
+
+            {createError && (
+              <p role="alert" className="text-sm text-destructive">
+                {createError}
+              </p>
+            )}
+            <DialogFooter>
+              <Button
+                type="button"
+                variant="outline"
+                disabled={busy}
+                onClick={() => setStep('provide')}
+              >
+                Back
+              </Button>
+              <Button type="button" disabled={busy} onClick={() => void handleCreate()}>
+                {busy && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
+                Create application
+              </Button>
+            </DialogFooter>
+          </div>
+        )}
+
+        {step === 'done' && created && (
+          <div className="space-y-3 text-sm">
+            <p className="flex items-center gap-1.5 font-medium">
+              <CheckCircle2 className="h-4 w-4 text-emerald-600" />
+              Created {created.id} {created.version}.
+            </p>
+
+            {isPublic && <p>It is public: anyone signed in to Tapis can see it and run it.</p>}
+            {shareError && (
+              <div className="space-y-2">
+                <p role="alert" className="text-amber-700">
+                  Created, but it could not be made public, so only you can run it. {shareError}
+                </p>
+                <Button
+                  type="button"
+                  size="sm"
+                  variant="secondary"
+                  onClick={() => void runShare(created)}
+                >
+                  Make public
+                </Button>
+              </div>
+            )}
+
+            {fill === 'filled' && (
+              <p>The inputs and parameters were filled in from the application.</p>
+            )}
+            {fill === 'kept' && <p>Your inputs and parameters were left as they were.</p>}
+            {fill === 'failed' && (
+              <p role="alert" className="text-amber-700">
+                Created, but it could not be read back to fill the form. Use &ldquo;Fill inputs and
+                parameters from the application&rdquo; below.
+              </p>
+            )}
+            {hasRows && fill === 'pending' && (
+              <div className="space-y-2">
+                <p>
+                  Your form already has inputs or parameters. Replace them with this
+                  application&rsquo;s?
+                </p>
+                <div className="flex gap-2">
+                  <Button type="button" size="sm" onClick={() => void runFill(created)}>
+                    Replace
+                  </Button>
+                  <Button type="button" size="sm" variant="outline" onClick={() => setFill('kept')}>
+                    Keep my rows
+                  </Button>
+                </div>
+              </div>
+            )}
+            <DialogFooter>
+              <Button type="button" onClick={() => onOpenChange(false)}>
+                Close
+              </Button>
+            </DialogFooter>
+          </div>
+        )}
+      </DialogContent>
+    </Dialog>
+  );
+}
diff --git a/ui-react/src/components/registration/TapisAppPicker.tsx b/ui-react/src/components/registration/TapisAppPicker.tsx
index c6923d6c..e531aece 100644
--- a/ui-react/src/components/registration/TapisAppPicker.tsx
+++ b/ui-react/src/components/registration/TapisAppPicker.tsx
@@ -3,7 +3,7 @@
  *
  * The selection is stored as the canonical app URL, so `value` is the component
  * location itself and no view state duplicates it. The app list comes from the
- * model catalog API's Tapis proxy, which needs a signed-in user.
+ * user's own Tapis token, read directly from Tapis, so it needs a signed-in user.
  *
  * Ported from the legacy UI's ModelCatalogTapisApp
  * (`ui/src/screens/models/configure/resources/tapis-app.ts`), including its
@@ -23,17 +23,18 @@ import {
 } from '@/components/ui/command';
 import { Popover, PopoverContent, PopoverTrigger } from '@/components/ui/popover';
 import { cn } from '@/lib/utils';
+import type { TapisAppsList } from '@/hooks/useTapisApps';
 import {
   buildTapisAppUrl,
   getTapisApp,
-  listTapisApps,
   parseTapisAppUrl,
   type TapisApp,
   type TapisAppRef,
 } from '@/lib/tapis-apps';
 
 export interface TapisAppPickerProps {
-  tenant: string;
+  /** The applications to choose from, read by the caller so it can reload them. */
+  list: TapisAppsList;
   /** The component location URL, or '' when no app is chosen. */
   value: string;
   onChange: (url: string) => void;
@@ -48,41 +49,17 @@ function appKey(app: TapisAppRef): string {
 }
 
 export function TapisAppPicker({
-  tenant,
+  list,
   value,
   onChange,
   onSync,
   syncWarning,
 }: TapisAppPickerProps) {
   const [open, setOpen] = React.useState(false);
-  const [apps, setApps] = React.useState<TapisAppRef[]>([]);
-  const [loading, setLoading] = React.useState(true);
-  const [listError, setListError] = React.useState<string | null>(null);
+  const { apps, loading, error: listError } = list;
   const [syncing, setSyncing] = React.useState(false);
   const [syncError, setSyncError] = React.useState<string | null>(null);
 
-  React.useEffect(() => {
-    let cancelled = false;
-    setLoading(true);
-    setListError(null);
-    listTapisApps(tenant)
-      .then((rows) => {
-        if (cancelled) return;
-        rows.sort((a, b) => appKey(a).localeCompare(appKey(b)));
-        setApps(rows);
-      })
-      .catch((err: unknown) => {
-        if (cancelled) return;
-        setListError(err instanceof Error ? err.message : 'Could not list applications.');
-      })
-      .finally(() => {
-        if (!cancelled) setLoading(false);
-      });
-    return () => {
-      cancelled = true;
-    };
-  }, [tenant]);
-
   const selected = parseTapisAppUrl(value);
 
   const handleSelect = (key: string) => {
diff --git a/ui-react/src/components/registration/__tests__/ComponentLocationSection.test.tsx b/ui-react/src/components/registration/__tests__/ComponentLocationSection.test.tsx
index d8eb3fda..27f6ea85 100644
--- a/ui-react/src/components/registration/__tests__/ComponentLocationSection.test.tsx
+++ b/ui-react/src/components/registration/__tests__/ComponentLocationSection.test.tsx
@@ -37,7 +37,6 @@ function tapisDeployment() {
     AUTH_PROVIDER: 'tapis',
     AUTH_SERVER: 'https://portals.tapis.io',
     EXECUTION_ENGINE: 'tapis',
-    MODEL_CATALOG_API: 'http://localhost:3002/v2.0.0',
   });
   localStorage.setItem('mint.access_token', 'tok-123');
 }
@@ -45,7 +44,9 @@ function tapisDeployment() {
 function mockApi() {
   return vi.spyOn(globalThis, 'fetch').mockImplementation((input) => {
     const url = String(input);
-    const body = url.endsWith('/apps') ? APP_LIST : APP_DETAIL;
+    // The list is `/v3/apps?listType=...`; one app is `/v3/apps/{id}/{version}`.
+    const isList = /\/v3\/apps\?/.test(url);
+    const body = { result: isList ? APP_LIST : APP_DETAIL };
     return Promise.resolve(
       new Response(JSON.stringify(body), {
         status: 200,
diff --git a/ui-react/src/components/registration/__tests__/RegisterTapisAppDialog.test.tsx b/ui-react/src/components/registration/__tests__/RegisterTapisAppDialog.test.tsx
new file mode 100644
index 00000000..cc20803b
--- /dev/null
+++ b/ui-react/src/components/registration/__tests__/RegisterTapisAppDialog.test.tsx
@@ -0,0 +1,372 @@
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { FormProvider, useForm } from 'react-hook-form';
+
+import { renderWithProviders } from '@/test/utils/render';
+import { setMintConfig } from '@/test/utils/mint-config';
+import { Form } from '@/components/ui/form';
+import { ComponentLocationSection } from '@/components/registration/ComponentLocationSection';
+import { emptyCreateModel, type CreateModelSchema } from '@/schemas/registration';
+
+// Shaped like the Tapis command template's app.json.
+const DEFINITION = {
+  id: 'my-model',
+  version: '0.1.0',
+  description: 'A model',
+  owner: '${apiUserId}',
+  containerImage: 'docker://ghcr.io/me/my-model:0.1.0',
+  jobAttributes: {
+    execSystemId: 'ls6',
+    maxMinutes: 10,
+    fileInputs: [{ name: 'Dataset File', description: 'data', inputMode: 'REQUIRED' }],
+    parameterSet: {
+      appArgs: [{ name: 'Greeting', description: 'say hi', inputMode: 'REQUIRED', arg: 'hello' }],
+    },
+  },
+};
+
+const CREATED_URL = 'https://portals.tapis.io/v3/apps/my-model/0.1.0';
+
+interface Call {
+  method: string;
+  url: string;
+}
+
+interface Behaviour {
+  createStatus?: number;
+  shareStatus?: number;
+  readStatus?: number;
+}
+
+/** A Tapis stand-in. Records every call so a test can assert on order and content. */
+function mockTapis(calls: Call[], behaviour: Behaviour = {}) {
+  const { createStatus = 201, shareStatus = 200, readStatus = 200 } = behaviour;
+  const respond = (body: unknown, status = 200) =>
+    Promise.resolve(
+      new Response(JSON.stringify(body), {
+        status,
+        headers: { 'Content-Type': 'application/json' },
+      }),
+    );
+  return vi.spyOn(globalThis, 'fetch').mockImplementation((input, init) => {
+    const url = String(input);
+    const method = init?.method ?? 'GET';
+    calls.push({ method, url });
+    if (method === 'POST' && url.endsWith('/v3/apps')) {
+      return createStatus === 201
+        ? respond({ result: { url: CREATED_URL } }, 201)
+        : respond({ status: 'error', message: 'APPLIC_APP_EXISTS my-model 0.1.0' }, createStatus);
+    }
+    if (method === 'POST' && url.includes('/share_public/')) {
+      return shareStatus === 200
+        ? respond({})
+        : respond({ status: 'error', message: 'Not authorized to share' }, shareStatus);
+    }
+    if (/\/v3\/apps\?/.test(url)) {
+      return respond({ result: [{ id: 'other-app', version: '1.0.0' }] });
+    }
+    if (url.endsWith('/v3/apps/my-model/0.1.0')) {
+      return readStatus === 200
+        ? respond({ result: { ...DEFINITION, id: 'my-model', version: '0.1.0' } })
+        : respond({ status: 'error', message: 'not found' }, readStatus);
+    }
+    return respond({}, 404);
+  });
+}
+
+function Harness({ withRows = false }: { withRows?: boolean }) {
+  const form = useForm<CreateModelSchema>({
+    defaultValues: withRows
+      ? {
+          ...emptyCreateModel(),
+          inputs: [{ ...emptyCreateModel().inputs[0]!, label: 'My own input' }],
+        }
+      : emptyCreateModel(),
+  });
+  return (
+    <FormProvider {...form}>
+      <Form {...form}>
+        <ComponentLocationSection />
+        <output data-testid="value">{form.watch('componentLocation')}</output>
+        <output data-testid="inputs">
+          {(form.watch('inputs') ?? []).map((i) => i.label).join('|')}
+        </output>
+        <output data-testid="parameters">
+          {(form.watch('parameters') ?? []).map((p) => p.label).join('|')}
+        </output>
+      </Form>
+    </FormProvider>
+  );
+}
+
+function tapisDeployment() {
+  setMintConfig({
+    AUTH_PROVIDER: 'tapis',
+    AUTH_SERVER: 'https://portals.tapis.io',
+    EXECUTION_ENGINE: 'tapis',
+  });
+  localStorage.setItem('mint.access_token', 'tok-123');
+}
+
+async function openDialog(user: ReturnType<typeof userEvent.setup>) {
+  await user.click(await screen.findByRole('button', { name: /register a new application/i }));
+  return screen.findByRole('dialog');
+}
+
+async function paste(user: ReturnType<typeof userEvent.setup>, dialog: HTMLElement, text: string) {
+  const box = within(dialog).getByLabelText(/or paste it here/i);
+  await user.click(box);
+  // Typing JSON through userEvent mangles braces, so paste it.
+  await user.paste(text);
+}
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  localStorage.clear();
+});
+
+describe('RegisterTapisAppDialog', () => {
+  it('is offered in Tapis mode only', async () => {
+    tapisDeployment();
+    mockTapis([]);
+    const user = userEvent.setup();
+    renderWithProviders(<Harness />);
+
+    expect(
+      await screen.findByRole('button', { name: /register a new application/i }),
+    ).toBeInTheDocument();
+
+    await user.click(screen.getByRole('tab', { name: /any url/i }));
+    expect(
+      screen.queryByRole('button', { name: /register a new application/i }),
+    ).not.toBeInTheDocument();
+  });
+
+  it('is not offered on a deployment that does not run Tapis', () => {
+    setMintConfig({ AUTH_PROVIDER: 'keycloak', EXECUTION_ENGINE: 'localex' });
+    const fetchMock = vi.spyOn(globalThis, 'fetch');
+    renderWithProviders(<Harness />);
+
+    expect(
+      screen.queryByRole('button', { name: /register a new application/i }),
+    ).not.toBeInTheDocument();
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it('blocks Review on invalid JSON and explains why', async () => {
+    tapisDeployment();
+    mockTapis([]);
+    const user = userEvent.setup();
+    renderWithProviders(<Harness />);
+    const dialog = await openDialog(user);
+
+    await paste(user, dialog, '{ not json');
+
+    expect(await within(dialog).findByRole('alert')).toHaveTextContent(/not valid JSON/i);
+    expect(within(dialog).getByRole('button', { name: /^review$/i })).toBeDisabled();
+  });
+
+  it('shows what will be created, and sends nothing before Create', async () => {
+    tapisDeployment();
+    const calls: Call[] = [];
+    mockTapis(calls);
+    const user = userEvent.setup();
+    renderWithProviders(<Harness />);
+    const dialog = await openDialog(user);
+    await waitFor(() => expect(calls.length).toBeGreaterThan(0));
+    const before = calls.length;
+
+    await paste(user, dialog, JSON.stringify(DEFINITION));
+    await user.click(within(dialog).getByRole('button', { name: /^review$/i }));
+
+    expect(await within(dialog).findByText('my-model')).toBeInTheDocument();
+    expect(within(dialog).getByText(/docker:\/\/ghcr.io\/me\/my-model:0.1.0/)).toBeInTheDocument();
+    expect(within(dialog).getByText('ls6')).toBeInTheDocument();
+    expect(within(dialog).getByText(/Dataset File/)).toBeInTheDocument();
+    expect(within(dialog).getByText(/Greeting/)).toBeInTheDocument();
+    expect(within(dialog).getByText(/makes it public/i)).toBeInTheDocument();
+    expect(within(dialog).getByText(/cannot edit or remove it/i)).toBeInTheDocument();
+    // Opening, pasting and reviewing wrote nothing.
+    expect(calls.slice(before).filter((c) => c.method === 'POST')).toEqual([]);
+  });
+
+  it('flags an id and version that already appear in the list', async () => {
+    tapisDeployment();
+    mockTapis([]);
+    const user = userEvent.setup();
+    renderWithProviders(<Harness />);
+    const dialog = await openDialog(user);
+
+    await paste(user, dialog, JSON.stringify({ ...DEFINITION, id: 'other-app', version: '1.0.0' }));
+    await user.click(within(dialog).getByRole('button', { name: /^review$/i }));
+
+    expect(await within(dialog).findByText(/already appears in your list/i)).toBeInTheDocument();
+  });
+
+  it('warns that environment variables will be public', async () => {
+    tapisDeployment();
+    mockTapis([]);
+    const user = userEvent.setup();
+    renderWithProviders(<Harness />);
+    const dialog = await openDialog(user);
+
+    await paste(
+      user,
+      dialog,
+      JSON.stringify({
+        ...DEFINITION,
+        jobAttributes: {
+          ...DEFINITION.jobAttributes,
+          parameterSet: { appArgs: [], envVariables: [{ key: 'K', value: 'V' }] },
+        },
+      }),
+    );
+    await user.click(within(dialog).getByRole('button', { name: /^review$/i }));
+
+    expect(await within(dialog).findByText(/environment variables/i)).toBeInTheDocument();
+  });
+
+  it('creates, then makes public, then selects the app and fills the form', async () => {
+    tapisDeployment();
+    const calls: Call[] = [];
+    mockTapis(calls);
+    const user = userEvent.setup();
+    renderWithProviders(<Harness />);
+    const dialog = await openDialog(user);
+
+    await paste(user, dialog, JSON.stringify(DEFINITION));
+    await user.click(within(dialog).getByRole('button', { name: /^review$/i }));
+    await user.click(await within(dialog).findByRole('button', { name: /create application/i }));
+
+    expect(await within(dialog).findByText(/created my-model 0.1.0/i)).toBeInTheDocument();
+    expect(await within(dialog).findByText(/it is public/i)).toBeInTheDocument();
+
+    // Order: create, then share, then read back for the seed.
+    const writes = calls.filter((c) => c.method === 'POST').map((c) => c.url);
+    expect(writes).toEqual([
+      'https://portals.tapis.io/v3/apps',
+      'https://portals.tapis.io/v3/apps/share_public/my-model',
+    ]);
+    await waitFor(() => expect(screen.getByTestId('value')).toHaveTextContent(CREATED_URL));
+    await waitFor(() => expect(screen.getByTestId('inputs')).toHaveTextContent('Dataset File'));
+    expect(screen.getByTestId('parameters')).toHaveTextContent('Greeting');
+    // The list was read again after the create, so the new app can be listed.
+    expect(calls.filter((c) => /\/v3\/apps\?/.test(c.url)).length).toBeGreaterThanOrEqual(2);
+  });
+
+  it('shows Tapis’s message and keeps the pasted text when create fails', async () => {
+    tapisDeployment();
+    const calls: Call[] = [];
+    mockTapis(calls, { createStatus: 409 });
+    const user = userEvent.setup();
+    renderWithProviders(<Harness />);
+    const dialog = await openDialog(user);
+
+    const text = JSON.stringify(DEFINITION);
+    await paste(user, dialog, text);
+    await user.click(within(dialog).getByRole('button', { name: /^review$/i }));
+    await user.click(await within(dialog).findByRole('button', { name: /create application/i }));
+
+    expect(await within(dialog).findByRole('alert')).toHaveTextContent(/409.*APPLIC_APP_EXISTS/);
+    // Nothing was shared or selected, and the author can go back and fix it.
+    expect(calls.some((c) => c.url.includes('share_public'))).toBe(false);
+    expect(screen.getByTestId('value')).toHaveTextContent('');
+    await user.click(within(dialog).getByRole('button', { name: /^back$/i }));
+    expect(within(dialog).getByLabelText(/or paste it here/i)).toHaveValue(text);
+  });
+
+  it('keeps the app selected when sharing fails, and retries only the share', async () => {
+    tapisDeployment();
+    const calls: Call[] = [];
+    mockTapis(calls, { shareStatus: 403 });
+    const user = userEvent.setup();
+    renderWithProviders(<Harness />);
+    const dialog = await openDialog(user);
+
+    await paste(user, dialog, JSON.stringify(DEFINITION));
+    await user.click(within(dialog).getByRole('button', { name: /^review$/i }));
+    await user.click(await within(dialog).findByRole('button', { name: /create application/i }));
+
+    expect(await within(dialog).findByText(/could not be made public/i)).toBeInTheDocument();
+    // The create is never reported as a failure, and the app is selected.
+    expect(within(dialog).getByText(/created my-model 0.1.0/i)).toBeInTheDocument();
+    await waitFor(() => expect(screen.getByTestId('value')).toHaveTextContent(CREATED_URL));
+
+    const createsBefore = calls.filter(
+      (c) => c.method === 'POST' && c.url.endsWith('/v3/apps'),
+    ).length;
+    await user.click(within(dialog).getByRole('button', { name: /make public/i }));
+    await waitFor(() => expect(calls.filter((c) => c.url.includes('share_public')).length).toBe(2));
+    // Retrying never creates the app a second time.
+    expect(calls.filter((c) => c.method === 'POST' && c.url.endsWith('/v3/apps')).length).toBe(
+      createsBefore,
+    );
+  });
+
+  it('does not report a failed create when the read-back fails', async () => {
+    tapisDeployment();
+    mockTapis([], { readStatus: 404 });
+    const user = userEvent.setup();
+    renderWithProviders(<Harness />);
+    const dialog = await openDialog(user);
+
+    await paste(user, dialog, JSON.stringify(DEFINITION));
+    await user.click(within(dialog).getByRole('button', { name: /^review$/i }));
+    await user.click(await within(dialog).findByRole('button', { name: /create application/i }));
+
+    expect(await within(dialog).findByText(/could not be read back/i)).toBeInTheDocument();
+    expect(within(dialog).getByText(/created my-model 0.1.0/i)).toBeInTheDocument();
+    await waitFor(() => expect(screen.getByTestId('value')).toHaveTextContent(CREATED_URL));
+  });
+
+  it('asks before replacing rows the author already has — Keep leaves them', async () => {
+    tapisDeployment();
+    mockTapis([]);
+    const user = userEvent.setup();
+    renderWithProviders(<Harness withRows />);
+    const dialog = await openDialog(user);
+
+    await paste(user, dialog, JSON.stringify(DEFINITION));
+    await user.click(within(dialog).getByRole('button', { name: /^review$/i }));
+    await user.click(await within(dialog).findByRole('button', { name: /create application/i }));
+
+    expect(await within(dialog).findByText(/replace them/i)).toBeInTheDocument();
+    // Not replaced yet.
+    expect(screen.getByTestId('inputs')).toHaveTextContent('My own input');
+
+    await user.click(within(dialog).getByRole('button', { name: /keep my rows/i }));
+    expect(screen.getByTestId('inputs')).toHaveTextContent('My own input');
+    expect(screen.getByTestId('inputs')).not.toHaveTextContent('Dataset File');
+  });
+
+  it('replaces the rows when the author chooses Replace', async () => {
+    tapisDeployment();
+    mockTapis([]);
+    const user = userEvent.setup();
+    renderWithProviders(<Harness withRows />);
+    const dialog = await openDialog(user);
+
+    await paste(user, dialog, JSON.stringify(DEFINITION));
+    await user.click(within(dialog).getByRole('button', { name: /^review$/i }));
+    await user.click(await within(dialog).findByRole('button', { name: /create application/i }));
+    await user.click(await within(dialog).findByRole('button', { name: /^replace$/i }));
+
+    await waitFor(() => expect(screen.getByTestId('inputs')).toHaveTextContent('Dataset File'));
+    expect(screen.getByTestId('inputs')).not.toHaveTextContent('My own input');
+  });
+
+  it('sends nothing when the dialog is cancelled', async () => {
+    tapisDeployment();
+    const calls: Call[] = [];
+    mockTapis(calls);
+    const user = userEvent.setup();
+    renderWithProviders(<Harness />);
+    const dialog = await openDialog(user);
+    await paste(user, dialog, JSON.stringify(DEFINITION));
+    await user.click(within(dialog).getByRole('button', { name: /cancel/i }));
+
+    await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument());
+    expect(calls.filter((c) => c.method === 'POST')).toEqual([]);
+  });
+});
diff --git a/ui-react/src/hooks/useTapisApps.ts b/ui-react/src/hooks/useTapisApps.ts
new file mode 100644
index 00000000..49202c73
--- /dev/null
+++ b/ui-react/src/hooks/useTapisApps.ts
@@ -0,0 +1,57 @@
+import * as React from 'react';
+
+import { listTapisApps, type TapisAppRef } from '@/lib/tapis-apps';
+
+export interface TapisAppsList {
+  apps: TapisAppRef[];
+  loading: boolean;
+  /** A readable message when the list could not be read, else null. */
+  error: string | null;
+  /** Reads the list again, for example after an app was created. */
+  reload: () => void;
+}
+
+function appKey(app: TapisAppRef): string {
+  return `${app.id}/${app.version}`;
+}
+
+/**
+ * The Tapis applications the signed-in user may see in one tenant. With no
+ * tenant, which is a deployment that does not use Tapis, it reads nothing.
+ */
+export function useTapisApps(tenant: string | null): TapisAppsList {
+  const [apps, setApps] = React.useState<TapisAppRef[]>([]);
+  const [loading, setLoading] = React.useState(tenant !== null);
+  const [error, setError] = React.useState<string | null>(null);
+  const [generation, setGeneration] = React.useState(0);
+
+  React.useEffect(() => {
+    if (tenant === null) {
+      setApps([]);
+      setLoading(false);
+      return;
+    }
+    let cancelled = false;
+    setLoading(true);
+    setError(null);
+    listTapisApps(tenant)
+      .then((rows) => {
+        if (cancelled) return;
+        setApps([...rows].sort((a, b) => appKey(a).localeCompare(appKey(b))));
+      })
+      .catch((err: unknown) => {
+        if (cancelled) return;
+        setError(err instanceof Error ? err.message : 'Could not list applications.');
+      })
+      .finally(() => {
+        if (!cancelled) setLoading(false);
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, [tenant, generation]);
+
+  const reload = React.useCallback(() => setGeneration((g) => g + 1), []);
+
+  return { apps, loading, error, reload };
+}
diff --git a/ui-react/src/lib/__tests__/tapis-apps.test.ts b/ui-react/src/lib/__tests__/tapis-apps.test.ts
index fc8a26db..49530074 100644
--- a/ui-react/src/lib/__tests__/tapis-apps.test.ts
+++ b/ui-react/src/lib/__tests__/tapis-apps.test.ts
@@ -1,11 +1,16 @@
 import { afterEach, describe, expect, it, vi } from 'vitest';
 
 import {
+  MAX_APP_DEFINITION_BYTES,
   buildSeedFromTapisApp,
   buildTapisAppUrl,
+  createTapisApp,
+  getTapisApp,
   getTapisTenant,
   listTapisApps,
+  parseTapisAppDefinition,
   parseTapisAppUrl,
+  shareTapisAppPublic,
   usesTapisComponents,
   type TapisApp,
 } from '@/lib/tapis-apps';
@@ -79,59 +84,281 @@ describe('usesTapisComponents', () => {
   });
 });
 
+function json(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { 'Content-Type': 'application/json' },
+  });
+}
+
+function signedIn() {
+  localStorage.setItem('mint.access_token', 'tok-123');
+}
+
 describe('listTapisApps', () => {
-  it('calls the model catalog API with the stored bearer token', async () => {
-    setMintConfig({ MODEL_CATALOG_API: 'http://localhost:3002/v2.0.0/' });
-    localStorage.setItem('mint.access_token', 'tok-123');
-    const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
-      new Response(JSON.stringify([{ tenant: 'portals', id: 'hello', version: '0.0.5' }]), {
-        status: 200,
-        headers: { 'Content-Type': 'application/json' },
-      }),
-    );
+  it('reads every visible app straight from Tapis with the user token', async () => {
+    signedIn();
+    const fetchMock = vi
+      .spyOn(globalThis, 'fetch')
+      .mockResolvedValue(json({ result: [{ id: 'hello', version: '0.0.5' }] }));
 
     const apps = await listTapisApps('portals');
 
     expect(apps).toEqual([{ tenant: 'portals', id: 'hello', version: '0.0.5' }]);
     const [url, init] = fetchMock.mock.calls[0]!;
-    // The trailing slash of the configured base must not double up.
-    expect(url).toBe('http://localhost:3002/v2.0.0/tapis/portals/apps');
-    expect((init?.headers as Record<string, string>).Authorization).toBe('Bearer tok-123');
+    // ALL, so an app made public by someone else is listed; limit=-1, because
+    // Tapis otherwise stops at 100 and drops the rest.
+    expect(url).toBe('https://portals.tapis.io/v3/apps?listType=ALL&limit=-1&select=id,version');
+    expect((init?.headers as Record<string, string>)['X-Tapis-Token']).toBe('tok-123');
+  });
+
+  it('never sends the token to a host other than the tenant', async () => {
+    signedIn();
+    const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(json({ result: [] }));
+    await listTapisApps('portals');
+    expect(new URL(String(fetchMock.mock.calls[0]![0])).hostname).toBe('portals.tapis.io');
   });
 
-  it('throws a readable error when the API refuses the request', async () => {
-    setMintConfig({ MODEL_CATALOG_API: 'http://localhost:3002/v2.0.0' });
-    localStorage.setItem('mint.access_token', 'tok-123');
-    vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response('', { status: 401 }));
+  it('throws an error that names the status and the Tapis message', async () => {
+    signedIn();
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      json({ status: 'error', message: 'JWT expired' }, 401),
+    );
+    await expect(listTapisApps('portals')).rejects.toThrow(/401.*JWT expired/);
+  });
 
-    await expect(listTapisApps('portals')).rejects.toThrow(/401/);
+  it('falls back to the status when the error body is not JSON', async () => {
+    signedIn();
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response('', { status: 503 }));
+    await expect(listTapisApps('portals')).rejects.toThrow(/503/);
   });
 
-  it('refuses to call anonymously — the proxy always answers 401', async () => {
-    setMintConfig({ MODEL_CATALOG_API: 'http://localhost:3002/v2.0.0' });
+  it('refuses to call without a token', async () => {
     const fetchMock = vi.spyOn(globalThis, 'fetch');
-
     await expect(listTapisApps('portals')).rejects.toThrow(/sign in/i);
     expect(fetchMock).not.toHaveBeenCalled();
   });
 
   it('drops an entry with no id or no version', async () => {
-    setMintConfig({ MODEL_CATALOG_API: 'http://localhost:3002/v2.0.0' });
-    localStorage.setItem('mint.access_token', 'tok-123');
+    signedIn();
     vi.spyOn(globalThis, 'fetch').mockResolvedValue(
-      new Response(
-        JSON.stringify([
-          { tenant: 'portals', id: 'hello', version: '0.0.5' },
-          { tenant: 'portals', id: 'broken' },
-        ]),
-        { status: 200, headers: { 'Content-Type': 'application/json' } },
-      ),
+      json({ result: [{ id: 'hello', version: '0.0.5' }, { id: 'broken' }] }),
     );
-
     await expect(listTapisApps('portals')).resolves.toHaveLength(1);
   });
 });
 
+describe('getTapisApp', () => {
+  it('reads one app, encoding the id and version into the path', async () => {
+    signedIn();
+    const fetchMock = vi
+      .spyOn(globalThis, 'fetch')
+      .mockResolvedValue(json({ result: { jobAttributes: { fileInputs: [] } } }));
+
+    const app = await getTapisApp({ tenant: 'portals', id: 'a b', version: '1/2' });
+
+    expect(String(fetchMock.mock.calls[0]![0])).toBe(
+      'https://portals.tapis.io/v3/apps/a%20b/1%2F2',
+    );
+    expect(app).toMatchObject({ tenant: 'portals', id: 'a b', jobAttributes: { fileInputs: [] } });
+  });
+});
+
+describe('createTapisApp', () => {
+  it('posts the definition with the token and returns the reference Tapis reports', async () => {
+    signedIn();
+    const fetchMock = vi
+      .spyOn(globalThis, 'fetch')
+      .mockResolvedValue(
+        json({ result: { url: 'https://portals.tapis.io/v3/apps/my-model/0.1.0' } }, 201),
+      );
+    const definition = { id: 'my-model', version: '0.1.0', containerImage: 'docker://x/y:1' };
+
+    const ref = await createTapisApp('portals', definition);
+
+    expect(ref).toEqual({ tenant: 'portals', id: 'my-model', version: '0.1.0' });
+    const [url, init] = fetchMock.mock.calls[0]!;
+    expect(url).toBe('https://portals.tapis.io/v3/apps');
+    expect(init?.method).toBe('POST');
+    expect(JSON.parse(String(init?.body))).toEqual(definition);
+    expect((init?.headers as Record<string, string>)['X-Tapis-Token']).toBe('tok-123');
+  });
+
+  it('falls back to the posted id and version when Tapis returns no url', async () => {
+    signedIn();
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(json({}, 201));
+    await expect(createTapisApp('portals', { id: 'my-model', version: '0.1.0' })).resolves.toEqual({
+      tenant: 'portals',
+      id: 'my-model',
+      version: '0.1.0',
+    });
+  });
+
+  it('surfaces the Tapis message when the app already exists', async () => {
+    signedIn();
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      json({ status: 'error', message: 'APPLIC_APP_EXISTS my-model 0.1.0' }, 409),
+    );
+    await expect(createTapisApp('portals', { id: 'my-model', version: '0.1.0' })).rejects.toThrow(
+      /409.*APPLIC_APP_EXISTS/,
+    );
+  });
+});
+
+describe('shareTapisAppPublic', () => {
+  it('posts to the public-share path for the id', async () => {
+    signedIn();
+    const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(json({}));
+    await shareTapisAppPublic('portals', 'my model');
+    const [url, init] = fetchMock.mock.calls[0]!;
+    expect(url).toBe('https://portals.tapis.io/v3/apps/share_public/my%20model');
+    expect(init?.method).toBe('POST');
+  });
+
+  it('treats an app that is already public as shared', async () => {
+    signedIn();
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      json({ status: 'error', message: 'App is already publicly shared' }, 400),
+    );
+    await expect(shareTapisAppPublic('portals', 'my-model')).resolves.toBeUndefined();
+  });
+
+  it('rethrows any other failure', async () => {
+    signedIn();
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      json({ status: 'error', message: 'Not authorized' }, 403),
+    );
+    await expect(shareTapisAppPublic('portals', 'my-model')).rejects.toThrow(/403/);
+  });
+});
+
+describe('parseTapisAppDefinition', () => {
+  // Shaped like the Tapis command template's app.json.
+  const good = {
+    id: 'no-interactive-example',
+    version: '0.1.0',
+    description: 'Run a script',
+    owner: '${apiUserId}',
+    enabled: true,
+    containerImage: 'docker://ghcr.io/in-for-disaster-analytics/cookbook-docker-template:0.1.0',
+    jobAttributes: {
+      execSystemId: 'ls6',
+      nodeCount: 1,
+      coresPerNode: 1,
+      memoryMB: 1000,
+      maxMinutes: 10,
+      fileInputs: [{ name: 'Dataset File', description: 'billing data', inputMode: 'REQUIRED' }],
+      parameterSet: {
+        appArgs: [{ name: 'Greeting', description: 'say hi', inputMode: 'REQUIRED', arg: 'hello' }],
+        envVariables: [],
+      },
+    },
+  };
+  const parse = (def: unknown) => parseTapisAppDefinition(JSON.stringify(def));
+
+  it('accepts the template and summarises what it creates', () => {
+    const result = parse(good);
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+    expect(result.summary).toMatchObject({
+      id: 'no-interactive-example',
+      version: '0.1.0',
+      execSystemId: 'ls6',
+      maxMinutes: 10,
+      memoryMB: 1000,
+      coresPerNode: 1,
+    });
+    expect(result.summary.inputs.map((i) => i.label)).toEqual(['Dataset File']);
+    expect(result.summary.parameters.map((p) => p.label)).toEqual(['Greeting']);
+    expect(result.warnings).toEqual([]);
+  });
+
+  it.each([
+    ['not JSON', '{ nope', /not valid JSON/],
+    ['an array', '[]', /single JSON object/],
+    ['a string', '"x"', /single JSON object/],
+  ])('rejects %s', (_name, text, message) => {
+    const result = parseTapisAppDefinition(text);
+    expect(result).toMatchObject({ ok: false });
+    if (!result.ok) expect(result.error).toMatch(message);
+  });
+
+  it.each([
+    ['id', { ...good, id: undefined }, /"id"/],
+    ['version', { ...good, version: '' }, /"version"/],
+    ['containerImage', { ...good, containerImage: undefined }, /"containerImage"/],
+    ['an id with a slash', { ...good, id: 'a/b' }, /cannot contain/],
+    ['a version with a slash', { ...good, version: '1/2' }, /cannot contain/],
+    ['the reserved id share', { ...good, id: 'share' }, /reserved/],
+    ['an untagged image', { ...good, containerImage: 'docker://ghcr.io/x/y' }, /version tag/],
+    ['a latest image', { ...good, containerImage: 'docker://ghcr.io/x/y:latest' }, /version tag/],
+    ['a registry port but no tag', { ...good, containerImage: 'localhost:5000/y' }, /version tag/],
+    ['isPublic', { ...good, isPublic: true }, /"isPublic"/],
+    ['tenant', { ...good, tenant: 'other' }, /"tenant"/],
+    ['deleted', { ...good, deleted: true }, /"deleted"/],
+    ['another owner', { ...good, owner: 'someone-else' }, /"owner"/],
+  ])('rejects %s', (_name, def, message) => {
+    const result = parse(def);
+    expect(result).toMatchObject({ ok: false });
+    if (!result.ok) expect(result.error).toMatch(message);
+  });
+
+  it('accepts an image pinned by digest', () => {
+    expect(parse({ ...good, containerImage: 'docker://ghcr.io/x/y@sha256:abc' }).ok).toBe(true);
+  });
+
+  it('accepts a definition with no owner', () => {
+    const { owner: _owner, ...rest } = good;
+    expect(parse(rest).ok).toBe(true);
+  });
+
+  it('rejects text over the size limit', () => {
+    const result = parseTapisAppDefinition(
+      JSON.stringify({ ...good, description: 'x'.repeat(MAX_APP_DEFINITION_BYTES) }),
+    );
+    expect(result).toMatchObject({ ok: false });
+  });
+
+  it('warns about an input or setting with no name, which DYNAMO cannot match', () => {
+    const result = parse({
+      ...good,
+      jobAttributes: {
+        ...good.jobAttributes,
+        fileInputs: [{ description: 'nameless', inputMode: 'REQUIRED' }],
+      },
+    });
+    expect(result.ok && result.warnings.join(' ')).toMatch(/no "name"/);
+  });
+
+  it('does not warn about an unnamed FIXED input, which DYNAMO never matches', () => {
+    const result = parse({
+      ...good,
+      jobAttributes: {
+        ...good.jobAttributes,
+        fileInputs: [{ description: 'supplied by the app', inputMode: 'FIXED' }],
+      },
+    });
+    expect(result.ok && result.warnings).toEqual([]);
+    expect(result.ok && result.summary.inputs).toEqual([]);
+  });
+
+  it('warns that environment variables will be public', () => {
+    const result = parse({
+      ...good,
+      jobAttributes: {
+        ...good.jobAttributes,
+        parameterSet: { appArgs: [], envVariables: [{ key: 'TOKEN', value: 'secret' }] },
+      },
+    });
+    expect(result.ok && result.warnings.join(' ')).toMatch(/environment variables.*public/);
+  });
+
+  it('flags uncommon top-level fields without refusing them', () => {
+    const result = parse({ ...good, surprise: 1 });
+    expect(result.ok && result.warnings.join(' ')).toMatch(/surprise/);
+  });
+});
+
 describe('buildSeedFromTapisApp', () => {
   // Trimmed from the real hello-world-fileinput-test 0.0.5 response.
   const app: TapisApp = {
diff --git a/ui-react/src/lib/tapis-apps.ts b/ui-react/src/lib/tapis-apps.ts
index d6f2be47..a04e8031 100644
--- a/ui-react/src/lib/tapis-apps.ts
+++ b/ui-react/src/lib/tapis-apps.ts
@@ -10,12 +10,14 @@
  * version, so a URL missing either one fails the run. The sharing endpoint
  * `/v3/apps/share/{id}` carries neither and must never be stored.
  *
- * The app list comes from the model catalog API, not from Tapis directly: the
- * proxy (`custom_tapis_apps_get`) forwards the user's Bearer token as the Tapis
- * `X-Tapis-Token`, so the browser needs no Tapis CORS grant.
+ * Every call here goes from the browser straight to Tapis with the signed-in
+ * user's own token in `X-Tapis-Token`; the model catalog API is not involved.
+ * The base URL is built from the deployment's configured tenant, never from a
+ * value the user types, so a pasted definition cannot change where the token
+ * is sent. Tapis allows browser calls from any origin.
  */
 import { getAccessToken } from './auth/token-store';
-import { getModelCatalogApiUrl, getRuntimeConfig } from './config';
+import { getRuntimeConfig } from './config';
 
 /** Identity of one Tapis application version. */
 export interface TapisAppRef {
@@ -45,6 +47,7 @@ export interface TapisAppArg {
 /** The subset of a Tapis application the seed needs. */
 export interface TapisApp extends TapisAppRef {
   jobAttributes?: {
+    execSystemId?: string;
     fileInputs?: TapisFileInput[];
     parameterSet?: { appArgs?: TapisAppArg[] };
   };
@@ -112,28 +115,63 @@ export function usesTapisComponents(): boolean {
   return getRuntimeConfig().EXECUTION_ENGINE === 'tapis' && getTapisTenant() !== null;
 }
 
-/** Bearer headers for the model catalog API. Its Tapis routes answer 401 without one. */
-function authHeaders(): Record<string, string> {
+/** The Tapis base URL for a tenant. Built from configuration, not from user input. */
+function tapisBase(tenant: string): string {
+  return `https://${tenant}.tapis.io`;
+}
+
+function tapisHeaders(): Record<string, string> {
   const token = getAccessToken();
   if (!token) {
-    throw new Error('Sign in to list Tapis applications.');
+    throw new Error('Sign in to use Tapis applications.');
   }
-  return { Authorization: `Bearer ${token}` };
+  return { 'X-Tapis-Token': token };
 }
 
-async function getJson(path: string): Promise<unknown> {
-  const headers = authHeaders();
-  const resp = await fetch(`${getModelCatalogApiUrl()}${path}`, { headers });
-  if (!resp.ok) {
-    throw new Error(`Model catalog API returned ${resp.status}`);
+/**
+ * Reads the message out of a failed Tapis response. Tapis answers
+ * `{"status":"error","message":"..."}`; anything else falls back to the status.
+ */
+async function tapisError(resp: Response): Promise<Error> {
+  let detail = '';
+  try {
+    const body = (await resp.json()) as { message?: unknown };
+    if (typeof body?.message === 'string') detail = body.message;
+  } catch {
+    // Not JSON: the status alone is the message.
   }
-  return resp.json();
+  return new Error(`Tapis returned ${resp.status}${detail ? `: ${detail}` : ''}`);
 }
 
-/** Lists the applications the signed-in user can see in one tenant. */
+async function tapisRequest(
+  tenant: string,
+  path: string,
+  init: { method?: string; body?: unknown } = {},
+): Promise<unknown> {
+  const headers: Record<string, string> = { ...tapisHeaders() };
+  if (init.body !== undefined) headers['Content-Type'] = 'application/json';
+  const resp = await fetch(`${tapisBase(tenant)}${path}`, {
+    method: init.method ?? 'GET',
+    headers,
+    ...(init.body !== undefined ? { body: JSON.stringify(init.body) } : {}),
+  });
+  if (!resp.ok) throw await tapisError(resp);
+  return resp.json().catch(() => ({}));
+}
+
+/**
+ * Lists every application the signed-in user may see in one tenant: their own,
+ * those shared with them, and public ones.
+ *
+ * `listType=ALL` matters: Tapis lists only the caller's own apps by default, so
+ * an app made public by someone else would never appear. `limit=-1` matters too:
+ * Tapis stops at 100 otherwise and silently drops the rest.
+ */
 export async function listTapisApps(tenant: string): Promise<TapisAppRef[]> {
-  const body = await getJson(`/tapis/${tenant}/apps`);
-  const rows = Array.isArray(body) ? (body as Partial<TapisAppRef>[]) : [];
+  const body = (await tapisRequest(tenant, '/v3/apps?listType=ALL&limit=-1&select=id,version')) as {
+    result?: Partial<TapisAppRef>[];
+  };
+  const rows = Array.isArray(body?.result) ? body.result : [];
   // An app with no version cannot be run, so it is not offerable.
   return rows
     .filter((a): a is TapisAppRef => Boolean(a?.id && a?.version))
@@ -142,8 +180,50 @@ export async function listTapisApps(tenant: string): Promise<TapisAppRef[]> {
 
 /** Reads one application, with the job attributes the seed needs. */
 export async function getTapisApp(ref: TapisAppRef): Promise<TapisApp> {
-  const body = await getJson(`/tapis/${ref.tenant}/apps/${ref.id}/${ref.version}`);
-  return { ...ref, ...(body as Omit<TapisApp, keyof TapisAppRef>) };
+  const body = (await tapisRequest(
+    ref.tenant,
+    `/v3/apps/${encodeURIComponent(ref.id)}/${encodeURIComponent(ref.version)}`,
+  )) as { result?: Omit<TapisApp, keyof TapisAppRef> };
+  return { ...ref, ...(body?.result ?? {}) };
+}
+
+/**
+ * Creates an application from a Tapis definition. The new app belongs to the
+ * signed-in user. Returns the reference Tapis reports, falling back to the
+ * posted id and version.
+ */
+export async function createTapisApp(
+  tenant: string,
+  definition: Record<string, unknown>,
+): Promise<TapisAppRef> {
+  const body = (await tapisRequest(tenant, '/v3/apps', { method: 'POST', body: definition })) as {
+    result?: { url?: string };
+  };
+  const fromUrl = body?.result?.url ? parseTapisAppUrl(body.result.url) : null;
+  return (
+    fromUrl ?? {
+      tenant,
+      id: String(definition.id),
+      version: String(definition.version),
+    }
+  );
+}
+
+/**
+ * Makes an application public: every user in the tenant can see its definition
+ * and run it. Tapis shares by id, so this covers every version of that id, and
+ * sharing an id that is already public is not an error. DYNAMO cannot undo it;
+ * only the owner or an administrator can, in Tapis.
+ */
+export async function shareTapisAppPublic(tenant: string, id: string): Promise<void> {
+  try {
+    await tapisRequest(tenant, `/v3/apps/share_public/${encodeURIComponent(id)}`, {
+      method: 'POST',
+    });
+  } catch (err) {
+    if (err instanceof Error && /already/i.test(err.message)) return;
+    throw err;
+  }
 }
 
 /**
@@ -178,3 +258,181 @@ export function buildSeedFromTapisApp(app: TapisApp): TapisAppSeed {
 
   return { inputs, parameters };
 }
+
+// ---------------------------------------------------------------------------
+// Reading a pasted definition
+// ---------------------------------------------------------------------------
+
+/** An app.json is a few kilobytes. Anything this large is not one. */
+export const MAX_APP_DEFINITION_BYTES = 256 * 1024;
+
+/**
+ * Keys a definition may not set. Tapis takes the owner from the token, and the
+ * app is made public by its own step, so a pasted definition must not decide
+ * either. `"owner": "${apiUserId}"` is allowed: the Tapis templates carry it,
+ * and Tapis resolves that macro to the requester.
+ */
+const REJECTED_KEYS = ['tenant', 'isPublic', 'deleted'] as const;
+const OWNER_MACRO = '${apiUserId}';
+
+/** Top-level keys the Tapis templates use. Others are flagged, not refused. */
+const COMMON_KEYS = new Set([
+  'id',
+  'version',
+  'description',
+  'owner',
+  'enabled',
+  'runtime',
+  'runtimeVersion',
+  'runtimeOptions',
+  'containerImage',
+  'jobType',
+  'maxJobs',
+  'maxJobsPerUser',
+  'strictFileInputs',
+  'jobAttributes',
+  'tags',
+  'notes',
+]);
+
+export interface TapisAppSummary {
+  id: string;
+  version: string;
+  containerImage: string;
+  execSystemId: string | null;
+  inputs: TapisAppSeed['inputs'];
+  parameters: TapisAppSeed['parameters'];
+  maxMinutes: number | null;
+  memoryMB: number | null;
+  coresPerNode: number | null;
+  nodeCount: number | null;
+}
+
+export type ParsedTapisAppDefinition =
+  | {
+      ok: true;
+      definition: Record<string, unknown>;
+      summary: TapisAppSummary;
+      /** Things worth a second look. They do not block Create. */
+      warnings: string[];
+    }
+  | { ok: false; error: string };
+
+/** True when the image names a tag or digest, and the tag is not `latest`. */
+function imageIsPinned(image: string): boolean {
+  const name = image.replace(/^[a-z]+:\/\//i, '');
+  if (name.includes('@')) return true;
+  const last = name.slice(name.lastIndexOf('/') + 1);
+  const colon = last.lastIndexOf(':');
+  return colon > 0 && last.slice(colon + 1) !== 'latest' && last.slice(colon + 1) !== '';
+}
+
+function asNumber(value: unknown): number | null {
+  return typeof value === 'number' && Number.isFinite(value) ? value : null;
+}
+
+/**
+ * Reads pasted or uploaded app.json text. Tapis stays the validator; these
+ * checks only make the common mistakes fast and clear. They run in the browser,
+ * so they guide the author and are not a security boundary.
+ */
+export function parseTapisAppDefinition(text: string): ParsedTapisAppDefinition {
+  if (new Blob([text]).size > MAX_APP_DEFINITION_BYTES) {
+    return {
+      ok: false,
+      error: 'That is too large to be an app.json. Check you chose the right file.',
+    };
+  }
+  let raw: unknown;
+  try {
+    raw = JSON.parse(text);
+  } catch {
+    return { ok: false, error: 'That is not valid JSON. Paste the contents of your app.json.' };
+  }
+  if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
+    return { ok: false, error: 'An app.json is a single JSON object, wrapped in { }.' };
+  }
+  const def = raw as Record<string, unknown>;
+
+  const text_ = (key: string, max: number): string | null => {
+    const v = def[key];
+    return typeof v === 'string' && v.trim() !== '' && v.length <= max ? v.trim() : null;
+  };
+  const id = text_('id', 80);
+  const version = text_('version', 64);
+  const containerImage = text_('containerImage', 512);
+  if (!id) return { ok: false, error: 'The definition needs an "id", a short unique name.' };
+  if (!version) return { ok: false, error: 'The definition needs a "version", such as "0.1.0".' };
+  if (!containerImage) {
+    return {
+      ok: false,
+      error: 'The definition needs a "containerImage", the packaged model to run.',
+    };
+  }
+  if (id.includes('/') || version.includes('/')) {
+    return { ok: false, error: 'The "id" and "version" cannot contain a "/".' };
+  }
+  if (id === 'share')
+    return { ok: false, error: '"share" is reserved by Tapis. Choose another id.' };
+  if (!imageIsPinned(containerImage)) {
+    return {
+      ok: false,
+      error:
+        'The "containerImage" needs a version tag, such as ":0.1.0". Untagged and ":latest" images change over time, so earlier results could not be reproduced.',
+    };
+  }
+  for (const key of REJECTED_KEYS) {
+    if (key in def) {
+      return { ok: false, error: `Remove "${key}" from the definition. Tapis and DYNAMO set it.` };
+    }
+  }
+  if ('owner' in def && def.owner !== OWNER_MACRO) {
+    return {
+      ok: false,
+      error: `Remove "owner", or set it to "${OWNER_MACRO}". The app is always created under your own account.`,
+    };
+  }
+
+  const job = (def.jobAttributes ?? {}) as TapisApp['jobAttributes'] & Record<string, unknown>;
+  const asApp: TapisApp = { tenant: '', id, version, jobAttributes: job };
+  const seed = buildSeedFromTapisApp(asApp);
+
+  const warnings: string[] = [];
+  const unnamed =
+    (job.fileInputs ?? []).filter((f) => !f.name && f.inputMode !== 'FIXED').length +
+    (job.parameterSet?.appArgs ?? []).filter((a) => !a.name && a.inputMode !== 'FIXED').length;
+  if (unnamed > 0) {
+    warnings.push(
+      `${unnamed} input file(s) or setting(s) have no "name". DYNAMO matches them by name, so this app would not run from a model configuration until each has one.`,
+    );
+  }
+  const env = (job.parameterSet as { envVariables?: unknown[] } | undefined)?.envVariables;
+  if (Array.isArray(env) && env.length > 0) {
+    warnings.push(
+      'The definition sets environment variables. The app will be public, so everyone can read them. Do not put passwords or keys there.',
+    );
+  }
+  const odd = Object.keys(def).filter((k) => !COMMON_KEYS.has(k));
+  if (odd.length > 0) {
+    warnings.push(`Uncommon fields: ${odd.join(', ')}. Check you meant to include them.`);
+  }
+
+  const num = (k: string) => asNumber((job as Record<string, unknown>)[k]);
+  return {
+    ok: true,
+    definition: def,
+    summary: {
+      id,
+      version,
+      containerImage,
+      execSystemId: typeof job.execSystemId === 'string' ? job.execSystemId : null,
+      inputs: seed.inputs,
+      parameters: seed.parameters,
+      maxMinutes: num('maxMinutes'),
+      memoryMB: num('memoryMB'),
+      coresPerNode: num('coresPerNode'),
+      nodeCount: num('nodeCount'),
+    },
+    warnings,
+  };
+}