@mesh-tech/mesh-cli 0.12.7 → 0.13.0

package/dist/bin/mesh.js

@@ -890,8 +890,8 @@ ${body}${MANAGED_END}
     return existing.slice(0, startIdx) + section + existing.slice(tail);
   }
   if (existing.length === 0) return section;
-  const sep4 = existing.endsWith("\n\n") ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
-  return existing + sep4 + section;
+  const sep5 = existing.endsWith("\n\n") ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
+  return existing + sep5 + section;
 }
 function newStsClient() {
   return new STSClient({ region: DEFAULT_REGION });
@@ -11415,6 +11415,63 @@ ${raw}`;
 ${MANAGED_MARKER}
 ${raw.slice(frontmatter.length)}`;
 }
+function meshTechScopeDirs(root, maxDepth = 6) {
+  const scopes = [];
+  const walk = (dir, depth) => {
+    if (depth > maxDepth) return;
+    let entries;
+    try {
+      entries = fs21.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      if (entry.name === "node_modules") {
+        const scope = path23.join(dir, entry.name, "@mesh-tech");
+        if (fs21.existsSync(scope)) scopes.push(scope);
+        continue;
+      }
+      if (entry.name.startsWith(".")) continue;
+      walk(path23.join(dir, entry.name), depth + 1);
+    }
+  };
+  walk(root, 0);
+  return scopes;
+}
+function listPackageSkills(root) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const scopeDir of meshTechScopeDirs(root)) {
+    for (const pkg of fs21.readdirSync(scopeDir, { withFileTypes: true })) {
+      if (!pkg.isDirectory() && !pkg.isSymbolicLink()) continue;
+      if (pkg.name === BASE_SKILL_PACKAGE) continue;
+      const skillsDir = path23.join(scopeDir, pkg.name, "skills");
+      if (!fs21.existsSync(skillsDir)) continue;
+      for (const domain of fs21.readdirSync(skillsDir, { withFileTypes: true })) {
+        const source = path23.join(skillsDir, domain.name, "SKILL.md");
+        if (!fs21.existsSync(source)) continue;
+        const name = `mesh-${pkg.name}-${domain.name}`;
+        if (!byName.has(name)) byName.set(name, { name, dir: path23.join(skillsDir, domain.name), source });
+      }
+    }
+  }
+  return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+function copySkillExtras(sourceDir, targetDir) {
+  for (const entry of fs21.readdirSync(sourceDir, { withFileTypes: true })) {
+    if (entry.name === "SKILL.md") continue;
+    fs21.cpSync(path23.join(sourceDir, entry.name), path23.join(targetDir, entry.name), { recursive: true });
+  }
+}
+function seedAppSkill(root, appName, appRelPath) {
+  const target = path23.join(root, ".claude", "skills", appName, "SKILL.md");
+  if (fs21.existsSync(target)) return null;
+  const template = fs21.readFileSync(cliAsset("assets", "app-skill", "SKILL.md"), "utf-8");
+  const body = template.replaceAll("__APP_NAME__", appName).replaceAll("__APP_PATH__", appRelPath || ".");
+  fs21.mkdirSync(path23.dirname(target), { recursive: true });
+  fs21.writeFileSync(target, body);
+  return path23.relative(root, target);
+}
 function planSync(root) {
   const items = [];
   for (const skill of listBaseSkills()) {
@@ -11441,6 +11498,43 @@ function planSync(root) {
       }
     }
   }
+  const packageSkills = listPackageSkills(root);
+  for (const skill of packageSkills) {
+    const targetDir = path23.join(root, ".claude", "skills", skill.name);
+    const target = path23.join(targetDir, "SKILL.md");
+    const desired = renderManagedSkill(skill.source);
+    const label = `.claude/skills/${skill.name}/SKILL.md (platform skill)`;
+    if (!fs21.existsSync(target)) {
+      items.push({
+        label,
+        state: "write",
+        apply: () => {
+          fs21.mkdirSync(targetDir, { recursive: true });
+          fs21.writeFileSync(target, desired);
+          copySkillExtras(skill.dir, targetDir);
+        }
+      });
+    } else {
+      const current = fs21.readFileSync(target, "utf-8");
+      if (current === desired) {
+        items.push({ label, state: "ok" });
+      } else if (current.includes(MANAGED_MARKER)) {
+        items.push({
+          label,
+          state: "write",
+          apply: () => {
+            fs21.writeFileSync(target, desired);
+            copySkillExtras(skill.dir, targetDir);
+          }
+        });
+      } else {
+        items.push({ label: `${label} \u2014 exists without the managed marker, leaving as-is`, state: "skip" });
+      }
+    }
+  }
+  if (packageSkills.length === 0 && meshTechScopeDirs(root).length === 0) {
+    logInfo("No @mesh-tech packages installed yet \u2014 run `pnpm install`, then `mesh skills sync` again for the platform skills.");
+  }
   const hookSource = cliAsset("assets", "intent", "intent-claude-gate.mjs");
   const hookTarget = path23.join(root, HOOK_RELATIVE);
   const hookDesired = fs21.readFileSync(hookSource, "utf-8");
@@ -11455,6 +11549,38 @@ function planSync(root) {
       }
     }
   );
+  const rootPkgPath = path23.join(root, "package.json");
+  if (fs21.existsSync(rootPkgPath)) {
+    let rootPkg = null;
+    try {
+      rootPkg = JSON.parse(fs21.readFileSync(rootPkgPath, "utf-8"));
+    } catch {
+      rootPkg = null;
+    }
+    const label = "package.json (@tanstack/intent devDependency)";
+    if (!rootPkg) {
+      items.push({ label: `${label} \u2014 package.json is unparseable, leaving as-is`, state: "skip" });
+    } else if (rootPkg.devDependencies?.["@tanstack/intent"] || rootPkg.dependencies?.["@tanstack/intent"]) {
+      items.push({ label, state: "ok" });
+    } else {
+      items.push({
+        label,
+        // Writing the dependency does not install it. Bare `mesh skills sync`
+        // in an already-installed repo leaves `pnpm exec intent` unresolvable
+        // until the next install, so say so rather than reporting success.
+        remediation: "Added @tanstack/intent \u2014 run `pnpm install` so `pnpm exec intent` resolves.",
+        state: "write",
+        apply: () => {
+          rootPkg.devDependencies = rootPkg.devDependencies ?? {};
+          rootPkg.devDependencies["@tanstack/intent"] = INTENT_RANGE;
+          rootPkg.devDependencies = Object.fromEntries(
+            Object.entries(rootPkg.devDependencies).sort(([a], [b]) => a.localeCompare(b))
+          );
+          fs21.writeFileSync(rootPkgPath, JSON.stringify(rootPkg, null, 2) + "\n");
+        }
+      });
+    }
+  }
   const settingsPath = path23.join(root, ".claude", "settings.json");
   let settings = {};
   try {
@@ -11523,6 +11649,7 @@ function syncSkills(root, opts = {}) {
     } else {
       item.apply?.();
       logSuccess(`synced: ${item.label}`);
+      if (item.remediation) logInfo(item.remediation);
     }
   }
   if (!dirty) {
@@ -11533,7 +11660,7 @@ function syncSkills(root, opts = {}) {
 function registerSkillsCommands(program2) {
   const skills = program2.command("skills").description("Agent-skill distribution (base skills + Intent discovery)");
   skills.command("sync").description(
-    "Install the base building-with-Mesh skills into .claude/skills/ and wire TanStack-Intent discovery (hook + settings + AGENTS.md fence) for package skills"
+    "Install the base building-with-Mesh skills into .claude/skills/, fetch the platform skills shipped by the repo's installed @mesh-tech/* packages, and wire TanStack-Intent discovery (intent devDependency + hook + settings + AGENTS.md fence)"
   ).option("--check", "verify only (CI/doctor): exit 1 when anything is missing or stale", false).option("--root <path>", "target repo root (default: enclosing git root)").action((opts) => {
     const root = path23.resolve(opts.root ?? resolveTargetRoot());
     const ok = syncSkills(root, { check: opts.check });
@@ -11544,7 +11671,7 @@ function registerSkillsCommands(program2) {
     }
   });
 }
-var MANAGED_MARKER, FENCE_START, HOOK_RELATIVE;
+var MANAGED_MARKER, FENCE_START, HOOK_RELATIVE, INTENT_RANGE, BASE_SKILL_PACKAGE;
 var init_skills = __esm({
   "libs/mesh-cli/src/commands/skills.ts"() {
     "use strict";
@@ -11554,26 +11681,78 @@ var init_skills = __esm({
     MANAGED_MARKER = "<!-- managed-by: mesh skills sync \u2014 edits are overwritten; copy content elsewhere to customize -->";
     FENCE_START = "<!-- intent-skills:start -->";
     HOOK_RELATIVE = path23.join(".intent", "hooks", "intent-claude-gate.mjs");
+    INTENT_RANGE = "^0.3.6";
+    BASE_SKILL_PACKAGE = "mesh-cli";
+  }
+});
+
+// libs/mesh-cli/src/utils/scaffold-versions.ts
+import { execFileSync as execFileSync18 } from "child_process";
+function isPrerelease(range) {
+  return /[-+]/.test(range.replace(/^\^/, ""));
+}
+function toCaretRange(version) {
+  const trimmed = version.trim();
+  return /^\d+\.\d+\.\d+(?:[-+].*)?$/.test(trimmed) ? `^${trimmed}` : null;
+}
+function resolvePublishedRange(pkg, cwd) {
+  try {
+    const out = execFileSync18("npm", ["view", pkg, "version"], {
+      cwd,
+      encoding: "utf-8",
+      timeout: 15e3,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const range = toCaretRange(out);
+    if (range && !isPrerelease(range)) return { range, resolved: true };
+  } catch {
+  }
+  return { range: SCAFFOLD_PACKAGE_LINES[pkg], resolved: false };
+}
+var SCAFFOLD_PACKAGE_LINES, SCAFFOLD_TOOLCHAIN;
+var init_scaffold_versions = __esm({
+  "libs/mesh-cli/src/utils/scaffold-versions.ts"() {
+    "use strict";
+    SCAFFOLD_PACKAGE_LINES = {
+      "@mesh-tech/app-kit": "^1.45.0",
+      "@mesh-tech/esm-bundle": "^0.1.1"
+    };
+    SCAFFOLD_TOOLCHAIN = {
+      "@types/node": "^24.2.1",
+      tsx: "^4.20.4",
+      typescript: "^5.9.2"
+    };
   }
 });
 
 // libs/mesh-cli/src/commands/create-app.ts
 var create_app_exports = {};
 __export(create_app_exports, {
+  PLATFORM_MONOREPO_NAME: () => PLATFORM_MONOREPO_NAME,
   bootstrapAppsRepo: () => bootstrapAppsRepo,
   copyTemplate: () => copyTemplate,
+  ensureWorkspaceGlobs: () => ensureWorkspaceGlobs,
+  isInsidePlatformMonorepo: () => isInsidePlatformMonorepo,
   registerCreateAppCommand: () => registerCreateAppCommand,
-  shouldBootstrapAppsRepo: () => shouldBootstrapAppsRepo
+  shouldBootstrapAppsRepo: () => shouldBootstrapAppsRepo,
+  workspaceGlobForApp: () => workspaceGlobForApp
 });
 import * as fs22 from "fs";
 import * as os8 from "os";
 import * as path24 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import Handlebars from "handlebars";
-function isInsideMonorepo(dir) {
+import { parse as parseYaml2 } from "yaml";
+function isInsidePlatformMonorepo(dir) {
   let cur = path24.resolve(dir);
   while (cur !== path24.dirname(cur)) {
-    if (fs22.existsSync(path24.join(cur, "pnpm-workspace.yaml"))) return true;
+    if (fs22.existsSync(path24.join(cur, "pnpm-workspace.yaml"))) {
+      try {
+        const pkg = JSON.parse(fs22.readFileSync(path24.join(cur, "package.json"), "utf-8"));
+        if (pkg?.name === PLATFORM_MONOREPO_NAME) return true;
+      } catch {
+      }
+    }
     cur = path24.dirname(cur);
   }
   return false;
@@ -11583,7 +11762,7 @@ function resolveDeployerRoleArn(tenant, platformName, env) {
   return `arn:aws:iam::${account}:role/${tenant}-${env}-apps-deployer`;
 }
 function shouldBootstrapAppsRepo(cwd) {
-  return fs22.existsSync(path24.join(cwd, ".git")) && !isInsideMonorepo(cwd) && !fs22.existsSync(path24.join(cwd, "package.json")) && !fs22.existsSync(path24.join(cwd, "tenants")) && !fs22.existsSync(path24.join(cwd, "apps"));
+  return fs22.existsSync(path24.join(cwd, ".git")) && !isInsidePlatformMonorepo(cwd) && !fs22.existsSync(path24.join(cwd, "package.json")) && !fs22.existsSync(path24.join(cwd, "tenants")) && !fs22.existsSync(path24.join(cwd, "apps"));
 }
 function bootstrapAppsRepo(cwd, tenant) {
   const templateDir = path24.join(packageRoot, "templates", "apps-repo");
@@ -11592,7 +11771,8 @@ function bootstrapAppsRepo(cwd, tenant) {
     repoName: path24.basename(cwd),
     tenant,
     tenantTitle: tenant.split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" "),
-    registryUrl: `https://mesh-platform-${registryAccount}.d.codeartifact.us-east-2.amazonaws.com/npm/mesh-packages/`
+    registryUrl: `https://mesh-platform-${registryAccount}.d.codeartifact.us-east-2.amazonaws.com/npm/mesh-packages/`,
+    intentRange: INTENT_RANGE
   };
   const staging = fs22.mkdtempSync(path24.join(os8.tmpdir(), "mesh-apps-repo-"));
   try {
@@ -11618,6 +11798,41 @@ function bootstrapAppsRepo(cwd, tenant) {
     fs22.rmSync(staging, { recursive: true, force: true });
   }
 }
+function ensureWorkspaceGlobs(root, required) {
+  const file = path24.join(root, "pnpm-workspace.yaml");
+  if (!fs22.existsSync(file)) return [];
+  const text = fs22.readFileSync(file, "utf-8");
+  let declared;
+  try {
+    declared = parseYaml2(text)?.packages ?? [];
+  } catch {
+    return [];
+  }
+  const missing = required.filter((glob) => !declared.includes(glob));
+  if (missing.length === 0) return [];
+  const lines = text.split("\n");
+  const start = lines.findIndex((line) => /^packages:\s*$/.test(line));
+  if (start === -1) return [];
+  let end = start;
+  for (let i = start + 1; i < lines.length; i++) {
+    const line = lines[i] ?? "";
+    const isEntry = /^\s+-\s/.test(line);
+    if (isEntry || /^\s*#/.test(line) || line.trim() === "") {
+      if (isEntry) end = i;
+      continue;
+    }
+    break;
+  }
+  const indent = (lines[end] ?? "").match(/^(\s*)-/)?.[1] ?? "  ";
+  lines.splice(end + 1, 0, ...missing.map((glob) => `${indent}- ${glob}`));
+  fs22.writeFileSync(file, lines.join("\n"));
+  return missing;
+}
+function workspaceGlobForApp(root, appDir) {
+  const rel = path24.relative(root, appDir).split(path24.sep).join("/");
+  if (rel === "" || rel.split("/")[0] === "..") return null;
+  return `${path24.posix.dirname(rel)}/*/*`;
+}
 function maybeBootstrapAppsRepo(cwd, tenant, test) {
   if (test || !shouldBootstrapAppsRepo(cwd)) return;
   const created = bootstrapAppsRepo(cwd, tenant);
@@ -11858,15 +12073,22 @@ async function runLegacyTemplate(tenant, name, template, test) {
     fs22.rmSync(appDir, { recursive: true, force: true });
     process.exit(1);
   }
-  autoSyncSkills(appDir);
+  autoSyncSkills(appDir, name);
   printLegacyNextSteps(appDir, template);
 }
-function autoSyncSkills(appDir) {
+function autoSyncSkills(appDir, appName) {
+  const root = resolveTargetRoot(appDir);
   try {
-    syncSkills(resolveTargetRoot(appDir));
+    syncSkills(root);
   } catch (err) {
     logWarn(`Agent-skill sync skipped: ${err instanceof Error ? err.message : err} \u2014 run: mesh skills sync`);
   }
+  try {
+    const seeded = seedAppSkill(root, appName, path24.relative(root, appDir));
+    if (seeded) logSuccess(`seeded: ${seeded} (yours to grow \u2014 not managed by mesh skills sync)`);
+  } catch (err) {
+    logWarn(`App skill stub skipped: ${err instanceof Error ? err.message : err}`);
+  }
 }
 async function runComposable(tenant, name, primitives, test) {
   logInfo(`Creating app '${name}' for tenant '${tenant}'...`);
@@ -11883,6 +12105,15 @@ async function runComposable(tenant, name, primitives, test) {
   const region = "us-east-2";
   const platformName = "mesh";
   const platformEnv = "dev";
+  const workspaceDeps = isInsidePlatformMonorepo(appDir);
+  const repoRoot2 = resolveTargetRoot(process.cwd());
+  const mesh = workspaceDeps ? { range: "", resolved: true } : resolvePublishedRange("@mesh-tech/app-kit", repoRoot2);
+  const esmBundle = workspaceDeps ? { range: "", resolved: true } : resolvePublishedRange("@mesh-tech/esm-bundle", repoRoot2);
+  if (!workspaceDeps) {
+    logInfo(
+      mesh.resolved ? `@mesh-tech/* pinned to ${mesh.range} (current published line)` : `Registry lookup unavailable \u2014 pinning @mesh-tech/* to ${mesh.range}; run \`pnpm up @mesh-tech/*\` once you have registry auth`
+    );
+  }
   const context = {
     name,
     tenant,
@@ -11891,9 +12122,12 @@ async function runComposable(tenant, name, primitives, test) {
     temporal: primitives.includes("temporal"),
     bucket: primitives.includes("bucket"),
     region,
-    // Link local source when generating inside this monorepo; pin only for
-    // out-of-repo tenant repos that install `@mesh-tech/*` from the registry.
-    workspaceDeps: isInsideMonorepo(appDir),
+    workspaceDeps,
+    meshRange: mesh.range,
+    esmBundleRange: esmBundle.range,
+    typesNodeRange: SCAFFOLD_TOOLCHAIN["@types/node"],
+    tsxRange: SCAFFOLD_TOOLCHAIN.tsx,
+    typescriptRange: SCAFFOLD_TOOLCHAIN.typescript,
     deployerRoleArn: resolveDeployerRoleArn(tenant, platformName, platformEnv)
   };
   fs22.mkdirSync(appDir, { recursive: true });
@@ -11905,20 +12139,18 @@ async function runComposable(tenant, name, primitives, test) {
     fs22.rmSync(appDir, { recursive: true, force: true });
     process.exit(1);
   }
-  const configPath = path24.join(path24.dirname(appDir), "config.ts");
-  if (!fs22.existsSync(configPath)) {
-    logWarn(`No config.ts found at ${configPath}`);
-    logInfo("You may need to create a shared config.ts for tenant apps.");
+  const nested = fs22.readdirSync(appDir, { withFileTypes: true }).some((entry) => entry.isDirectory() && fs22.existsSync(path24.join(appDir, entry.name, "package.json")));
+  const glob = workspaceGlobForApp(repoRoot2, appDir);
+  if (nested && glob) {
+    const added = ensureWorkspaceGlobs(repoRoot2, [glob]);
+    if (added.length > 0) {
+      logInfo(`pnpm-workspace.yaml: added ${added.join(", ")} so the app's api/worker packages install`);
+    }
   }
-  autoSyncSkills(appDir);
+  autoSyncSkills(appDir, name);
   printComposableNextSteps(appDir, context);
 }
 function printLegacyNextSteps(appDir, _template) {
-  const configPath = path24.join(path24.dirname(appDir), "config.ts");
-  if (!fs22.existsSync(configPath)) {
-    logWarn(`No config.ts found at ${configPath}`);
-    logInfo("You may need to create a shared config.ts for tenant apps.");
-  }
   console.log("");
   logSuccess("App created successfully!");
   console.log("");
@@ -11955,18 +12187,21 @@ function printComposableNextSteps(appDir, context) {
   console.log("Next steps:");
   console.log(`  cd ${appDir}`);
   console.log("  pnpm install");
+  console.log("  mesh skills sync         # re-run once deps are installed: picks up package skills + Intent");
+  console.log("  pnpm install             # again only if skills sync reports it added @tanstack/intent");
   console.log("  mesh stack init          # personal dev stack (deploy: false)");
   console.log("  mesh deploy up --yes     # deploy via the stack's deployer role");
   console.log("  mesh dev                 # run locally");
   console.log("");
 }
-var __filename, __dirname, packageRoot, TEMPLATES, REMOVED_TEMPLATES, PRIMITIVES, HUB_ACCOUNTS, VALID_PRIMITIVES;
+var __filename, __dirname, packageRoot, TEMPLATES, REMOVED_TEMPLATES, PRIMITIVES, HUB_ACCOUNTS, PLATFORM_MONOREPO_NAME, VALID_PRIMITIVES;
 var init_create_app = __esm({
   "libs/mesh-cli/src/commands/create-app.ts"() {
     "use strict";
     init_utils();
     init_skills();
     init_stack();
+    init_scaffold_versions();
     __filename = fileURLToPath2(import.meta.url);
     __dirname = path24.dirname(__filename);
     packageRoot = findPackageRoot(__dirname);
@@ -11989,6 +12224,7 @@ var init_create_app = __esm({
     HUB_ACCOUNTS = {
       mesh: "159923586610"
     };
+    PLATFORM_MONOREPO_NAME = "mesh-platform";
     VALID_PRIMITIVES = Object.keys(PRIMITIVES);
     Handlebars.registerHelper("titleCase", (str) => {
       return str.split("-").map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
@@ -12600,8 +12836,8 @@ var init_db = __esm({
 
 // libs/mesh-cli/src/utils/deploy-preflight.ts
 import { existsSync as existsSync20, readFileSync as readFileSync21 } from "node:fs";
-import { dirname as dirname22, join as join25, relative as relative3 } from "node:path";
-import { parse as parseYaml2 } from "yaml";
+import { dirname as dirname22, join as join25, relative as relative5 } from "node:path";
+import { parse as parseYaml3 } from "yaml";
 function isGated(name) {
   return GATED_PREFIXES.some((p) => name.startsWith(p));
 }
@@ -12659,14 +12895,14 @@ function checkDeployDepsFresh(appRoot) {
   if (!lockPath) return null;
   let lockDoc;
   try {
-    lockDoc = parseYaml2(readFileSync21(lockPath, "utf8"));
+    lockDoc = parseYaml3(readFileSync21(lockPath, "utf8"));
   } catch {
     logWarn(
       `deploy preflight: could not parse ${lockPath} \u2014 skipping the stale-node_modules check.`
     );
     return null;
   }
-  const importerRel = relative3(dirname22(lockPath), appRoot) || ".";
+  const importerRel = relative5(dirname22(lockPath), appRoot) || ".";
   const expected = extractImporterMeshVersions(lockDoc, importerRel);
   const names = Object.keys(expected);
   if (names.length === 0) return [];
@@ -12715,7 +12951,7 @@ var init_deploy_preflight = __esm({
 });
 
 // libs/mesh-cli/src/commands/deploy.ts
-import { execFileSync as execFileSync18 } from "child_process";
+import { execFileSync as execFileSync19 } from "child_process";
 function buildPulumiArgs(pulumiArgs, stack) {
   const base = pulumiArgs.length === 0 || pulumiArgs[0]?.startsWith("-") ? ["up", ...pulumiArgs] : [...pulumiArgs];
   const op = base[0];
@@ -12778,7 +13014,7 @@ function registerDeployCommand(program2) {
     delete env.AWS_PROFILE;
     const finalArgs = buildPulumiArgs(pulumiArgs, stack);
     try {
-      execFileSync18("pulumi", finalArgs, {
+      execFileSync19("pulumi", finalArgs, {
         cwd: appRoot,
         env,
         stdio: "inherit"
@@ -13071,10 +13307,10 @@ var init_discover = __esm({
 });
 
 // libs/mesh-cli/src/docs/assemble.ts
-import { execFileSync as execFileSync19 } from "node:child_process";
+import { execFileSync as execFileSync20 } from "node:child_process";
 import { mkdirSync as mkdirSync15, readFileSync as readFileSync23, rmSync as rmSync5, writeFileSync as writeFileSync15 } from "node:fs";
 import path27 from "node:path";
-import { parse as parseYaml3 } from "yaml";
+import { parse as parseYaml4 } from "yaml";
 function splitFrontMatter(markdown) {
   const normalized = markdown.replace(/^\uFEFF/, "");
   if (!normalized.startsWith("---\n") && !normalized.startsWith("---\r\n")) {
@@ -13086,7 +13322,7 @@ function splitFrontMatter(markdown) {
   const bodyStart = normalized.indexOf("\n", end + 1);
   const body = (bodyStart === -1 ? "" : normalized.slice(bodyStart + 1)).replace(/^\r?\n/, "");
   try {
-    const data = parseYaml3(rawBlock);
+    const data = parseYaml4(rawBlock);
     if (data && typeof data === "object" && !Array.isArray(data)) {
       return {
         data,
@@ -13562,7 +13798,7 @@ function renderVersionJson(args) {
 }
 function currentCommit(repoRoot2) {
   try {
-    return execFileSync19("git", ["rev-parse", "--short", "HEAD"], {
+    return execFileSync20("git", ["rev-parse", "--short", "HEAD"], {
       cwd: repoRoot2,
       encoding: "utf-8"
     }).trim();
@@ -13581,7 +13817,7 @@ function currentBaseline(repoRoot2) {
   }
 }
 function publishSetAtRef(repoRoot2, ref) {
-  const git = (gitArgs) => execFileSync19("git", gitArgs, {
+  const git = (gitArgs) => execFileSync20("git", gitArgs, {
     cwd: repoRoot2,
     encoding: "utf-8",
     maxBuffer: 64 * 1024 * 1024
@@ -14069,7 +14305,7 @@ var init_portal = __esm({
 });
 
 // libs/mesh-cli/src/utils/build-info.ts
-import { execFileSync as execFileSync20 } from "child_process";
+import { execFileSync as execFileSync21 } from "child_process";
 import * as fs24 from "fs";
 import * as path29 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
@@ -14127,7 +14363,7 @@ function resolveCliRuntime(opts) {
   }
   if (!vcs) return info;
   try {
-    const git = (args) => execFileSync20("git", args, {
+    const git = (args) => execFileSync21("git", args, {
       cwd: root,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "pipe"]
@@ -14147,10 +14383,10 @@ var init_build_info = __esm({
 // libs/mesh-cli/src/docs/serve.ts
 import { createServer as createServer8 } from "node:http";
 import { readFile } from "node:fs/promises";
-import { extname, join as join27, normalize, sep as sep3 } from "node:path";
+import { extname, join as join27, normalize, sep as sep4 } from "node:path";
 async function serveDocsSite(args) {
   const root = normalize(args.root);
-  const rootPrefix = root.endsWith(sep3) ? root : root + sep3;
+  const rootPrefix = root.endsWith(sep4) ? root : root + sep4;
   const server = createServer8((req, res) => {
     void (async () => {
       const url = new URL(req.url ?? "/", "http://localhost");
@@ -14224,7 +14460,7 @@ var init_serve = __esm({
 });
 
 // libs/mesh-cli/src/docs/registry-docs.ts
-import { execFileSync as execFileSync21 } from "node:child_process";
+import { execFileSync as execFileSync22 } from "node:child_process";
 import { existsSync as existsSync23, mkdirSync as mkdirSync17, readFileSync as readFileSync26, renameSync as renameSync3, rmSync as rmSync6, writeFileSync as writeFileSync17 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
 import path30 from "node:path";
@@ -14316,7 +14552,7 @@ async function fetchDocsArtifact(auth, version, cacheRoot = docsCacheRoot(), fet
   rmSync6(staging, { recursive: true, force: true });
   mkdirSync17(staging, { recursive: true });
   try {
-    execFileSync21("tar", ["-xzf", tgzPath, "-C", staging, "--strip-components", "1"], {
+    execFileSync22("tar", ["-xzf", tgzPath, "-C", staging, "--strip-components", "1"], {
       stdio: ["pipe", "pipe", "pipe"]
     });
   } finally {
@@ -14354,7 +14590,7 @@ __export(start_exports, {
   tmuxInstallHint: () => tmuxInstallHint,
   tmuxServeArgs: () => tmuxServeArgs
 });
-import { execFileSync as execFileSync22 } from "node:child_process";
+import { execFileSync as execFileSync23 } from "node:child_process";
 import { appendFileSync as appendFileSync2, existsSync as existsSync24, writeFileSync as writeFileSync18 } from "node:fs";
 import path31 from "node:path";
 function registryAuthOrThrow() {
@@ -14387,7 +14623,7 @@ function tmuxInstallHint(platform = process.platform) {
 }
 function tmuxAvailable() {
   try {
-    execFileSync22("tmux", ["-V"], { stdio: ["pipe", "pipe", "pipe"] });
+    execFileSync23("tmux", ["-V"], { stdio: ["pipe", "pipe", "pipe"] });
     return true;
   } catch {
     return false;
@@ -14398,7 +14634,7 @@ function shouldDetach(args) {
 }
 function docsSessionExists() {
   try {
-    execFileSync22("tmux", ["has-session", "-t", DOCS_TMUX_SESSION], { stdio: ["pipe", "pipe", "pipe"] });
+    execFileSync23("tmux", ["has-session", "-t", DOCS_TMUX_SESSION], { stdio: ["pipe", "pipe", "pipe"] });
     return true;
   } catch {
     return false;
@@ -14422,12 +14658,12 @@ Or run in the foreground instead: mesh docs start --foreground`
   if (docsSessionExists()) {
     logInfo(`Replacing the docs server already running in tmux session "${DOCS_TMUX_SESSION}".`);
     try {
-      execFileSync22("tmux", ["kill-session", "-t", DOCS_TMUX_SESSION], { stdio: ["pipe", "pipe", "pipe"] });
+      execFileSync23("tmux", ["kill-session", "-t", DOCS_TMUX_SESSION], { stdio: ["pipe", "pipe", "pipe"] });
     } catch {
     }
   }
   const { command, cwd } = tmuxServeArgs(args);
-  execFileSync22(
+  execFileSync23(
     "tmux",
     ["new-session", "-d", "-s", DOCS_TMUX_SESSION, "-c", cwd, "--", ...command],
     { stdio: ["pipe", "pipe", "pipe"] }
@@ -14465,7 +14701,7 @@ function printReady(url, label) {
 }
 function runDocsStop() {
   try {
-    execFileSync22("tmux", ["kill-session", "-t", DOCS_TMUX_SESSION], { stdio: ["pipe", "pipe", "pipe"] });
+    execFileSync23("tmux", ["kill-session", "-t", DOCS_TMUX_SESSION], { stdio: ["pipe", "pipe", "pipe"] });
     logSuccess(`Stopped the docs server (tmux session "${DOCS_TMUX_SESSION}").`);
   } catch {
     logInfo(`No docs server is running (no tmux session named "${DOCS_TMUX_SESSION}").`);
@@ -14838,7 +15074,7 @@ var init_docs = __esm({
 });
 
 // libs/mesh-cli/src/commands/hub/index.ts
-import { execFileSync as execFileSync23 } from "node:child_process";
+import { execFileSync as execFileSync24 } from "node:child_process";
 import * as fs26 from "node:fs";
 import * as net12 from "node:net";
 import * as os10 from "node:os";
@@ -14904,7 +15140,7 @@ function parseTmuxEnv(output) {
 }
 function readTmuxSessionEnv(sessionName) {
   try {
-    const out = execFileSync23("tmux", ["show-environment", "-t", sessionName], {
+    const out = execFileSync24("tmux", ["show-environment", "-t", sessionName], {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -14915,7 +15151,7 @@ function readTmuxSessionEnv(sessionName) {
 }
 function tmuxSessionExists(sessionName) {
   try {
-    execFileSync23("tmux", ["has-session", "-t", sessionName], { stdio: "ignore" });
+    execFileSync24("tmux", ["has-session", "-t", sessionName], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -15079,7 +15315,7 @@ function redactEnv(env) {
 async function hubDevAction(opts) {
   if (opts.kill) {
     if (tmuxSessionExists(HUB_SESSION)) {
-      execFileSync23("tmux", ["kill-session", "-t", HUB_SESSION], { stdio: "ignore" });
+      execFileSync24("tmux", ["kill-session", "-t", HUB_SESSION], { stdio: "ignore" });
       fs26.rmSync(hubEnvDir(), { recursive: true, force: true });
       logSuccess(`Killed Hub session '${HUB_SESSION}'.`);
     } else {
@@ -15133,17 +15369,17 @@ async function hubDevAction(opts) {
   for (const warning of assembled.warnings) logWarn(warning);
   const apiDir = path33.join(platformDir, "apps", "hub", "api");
   const uiDir = path33.join(platformDir, "apps", "hub", "ui");
-  execFileSync23("tmux", ["new-session", "-d", "-s", HUB_SESSION, "-n", "api", "-c", apiDir]);
+  execFileSync24("tmux", ["new-session", "-d", "-s", HUB_SESSION, "-n", "api", "-c", apiDir]);
   if (!assembled.apiEnv.DEV_USER_TOKEN_URL && assembled.apiEnv.DEV_USER_ID_TOKEN) {
     const platform = session.state.devOutput.platform;
     const credContext = `mesh.${platform.env}`;
     const tokenPort = await findFreePort4();
     const tokenUrl = `http://127.0.0.1:${tokenPort}`;
-    execFileSync23("tmux", ["new-window", "-t", HUB_SESSION, "-n", "token-server", "-c", platformDir]);
-    execFileSync23("tmux", ["set-option", "-t", `${HUB_SESSION}:token-server`, "remain-on-exit", "on"], {
+    execFileSync24("tmux", ["new-window", "-t", HUB_SESSION, "-n", "token-server", "-c", platformDir]);
+    execFileSync24("tmux", ["set-option", "-t", `${HUB_SESSION}:token-server`, "remain-on-exit", "on"], {
       stdio: "ignore"
     });
-    execFileSync23("tmux", [
+    execFileSync24("tmux", [
       "send-keys",
       "-t",
       `${HUB_SESSION}:token-server`,
@@ -15161,12 +15397,12 @@ async function hubDevAction(opts) {
     const envFile = path33.join(hubEnvDir(), `${window}.env.sh`);
     writeEnvFile(envFile, env);
     if (createWindow) {
-      execFileSync23("tmux", ["new-window", "-t", HUB_SESSION, "-n", window, "-c", dir]);
+      execFileSync24("tmux", ["new-window", "-t", HUB_SESSION, "-n", window, "-c", dir]);
     }
-    execFileSync23("tmux", ["set-option", "-t", `${HUB_SESSION}:${window}`, "remain-on-exit", "on"], {
+    execFileSync24("tmux", ["set-option", "-t", `${HUB_SESSION}:${window}`, "remain-on-exit", "on"], {
       stdio: "ignore"
     });
-    execFileSync23("tmux", ["send-keys", "-t", `${HUB_SESSION}:${window}`, buildLaunchCommand(envFile, dir, cmd), "Enter"]);
+    execFileSync24("tmux", ["send-keys", "-t", `${HUB_SESSION}:${window}`, buildLaunchCommand(envFile, dir, cmd), "Enter"]);
   };
   launch("api", apiDir, assembled.apiEnv, "pnpm dev", false);
   launch("ui", uiDir, assembled.uiEnv, `pnpm dev -- --port ${uiPort} --strictPort`, true);
@@ -15492,7 +15728,7 @@ var init_init = __esm({
 });
 
 // libs/mesh-cli/src/commands/install-shim.ts
-import { execFileSync as execFileSync24 } from "child_process";
+import { execFileSync as execFileSync25 } from "child_process";
 import * as fs28 from "fs";
 import * as os11 from "os";
 import * as path35 from "path";
@@ -15605,7 +15841,7 @@ function registerInstallShimCommand(program2) {
     let status = 0;
     let ok = true;
     try {
-      stdout = execFileSync24(target, ["--help"], {
+      stdout = execFileSync25(target, ["--help"], {
         cwd: process.cwd(),
         encoding: "utf8",
         stdio: ["ignore", "pipe", "pipe"]
@@ -15652,7 +15888,7 @@ var init_install_shim = __esm({
 });
 
 // libs/mesh-cli/src/commands/local/hub-local.ts
-import { execFile as execFile3, execFileSync as execFileSync25 } from "child_process";
+import { execFile as execFile3, execFileSync as execFileSync26 } from "child_process";
 import * as fs29 from "fs";
 import * as os12 from "os";
 import * as path36 from "path";
@@ -15674,7 +15910,7 @@ function npmrcPath() {
 }
 function imageExists(tag) {
   try {
-    execFileSync25("docker", ["image", "inspect", tag], { stdio: ["ignore", "pipe", "pipe"] });
+    execFileSync26("docker", ["image", "inspect", tag], { stdio: ["ignore", "pipe", "pipe"] });
     return true;
   } catch {
     return false;
@@ -15684,7 +15920,7 @@ function ensureHubAuthImage() {
   if (imageExists(HUB_AUTH_IMAGE)) return;
   logInfo(`Building ${HUB_AUTH_IMAGE} (Hub auth proxy)\u2026`);
   const hubStackDir = path36.join(findPackageRoot(), "stack", "hub");
-  execFileSync25(
+  execFileSync26(
     "docker",
     ["build", "-f", path36.join(hubStackDir, "Dockerfile.auth"), "-t", HUB_AUTH_IMAGE, hubStackDir],
     { stdio: ["ignore", "inherit", "inherit"], env: { ...process.env, DOCKER_BUILDKIT: "1" } }
@@ -15698,7 +15934,7 @@ function hasRegistryAuth() {
 function localHubVersion() {
   const versions = HUB_IMAGES.map((name) => {
     try {
-      const out = execFileSync25("docker", ["images", name, "--format", "{{.Tag}}"], {
+      const out = execFileSync26("docker", ["images", name, "--format", "{{.Tag}}"], {
         encoding: "utf-8",
         stdio: ["ignore", "pipe", "pipe"]
       });
@@ -15777,7 +16013,7 @@ async function ensureHubImages() {
   const context = path36.join(cacheDir(), `context-${version}`);
   fs29.rmSync(context, { recursive: true, force: true });
   fs29.mkdirSync(context, { recursive: true });
-  execFileSync25("tar", ["-xzf", tarball, "-C", context, "--strip-components", "1"], {
+  execFileSync26("tar", ["-xzf", tarball, "-C", context, "--strip-components", "1"], {
     stdio: ["ignore", "pipe", "pipe"]
   });
   const hubStackDir = path36.join(findPackageRoot(), "stack", "hub");
@@ -15788,7 +16024,7 @@ async function ensureHubImages() {
     const tag = `${name}:${version}`;
     if (imageExists(tag)) continue;
     logInfo(`Building ${tag} from the published tarball\u2026`);
-    execFileSync25(
+    execFileSync26(
       "docker",
       [
         "build",
@@ -16883,10 +17119,10 @@ var init_secrets = __esm({
 });
 
 // libs/mesh-cli/src/commands/stack.ts
-import { execFileSync as execFileSync26 } from "child_process";
+import { execFileSync as execFileSync27 } from "child_process";
 import * as path37 from "path";
 import * as fs30 from "fs";
-import { parse as parseYaml4 } from "yaml";
+import { parse as parseYaml5 } from "yaml";
 function readTopLevelYamlKey(appRoot, stack, key) {
   const configFile = path37.join(appRoot, `Pulumi.${stack}.yaml`);
   if (!fs30.existsSync(configFile)) return null;
@@ -16963,7 +17199,7 @@ function readBaseConfigFromYaml(appRoot, stack) {
   if (!fs30.existsSync(file)) return {};
   let doc;
   try {
-    doc = parseYaml4(fs30.readFileSync(file, "utf-8"));
+    doc = parseYaml5(fs30.readFileSync(file, "utf-8"));
   } catch {
     return {};
   }
@@ -16976,7 +17212,7 @@ function readBaseConfigFromYaml(appRoot, stack) {
 }
 function getGitHubUsername() {
   try {
-    const result = execFileSync26("gh", ["api", "user", "--jq", ".login"], {
+    const result = execFileSync27("gh", ["api", "user", "--jq", ".login"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -16985,7 +17221,7 @@ function getGitHubUsername() {
   } catch {
   }
   try {
-    const result = execFileSync26("git", ["config", "user.email"], {
+    const result = execFileSync27("git", ["config", "user.email"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -17071,7 +17307,7 @@ Specify which to base on: mesh stack init --from <stack>`
     if (!opts.adopt) {
       let existing = [];
       try {
-        const raw = execFileSync26("pulumi", ["stack", "ls", "--json"], {
+        const raw = execFileSync27("pulumi", ["stack", "ls", "--json"], {
           cwd: appRoot,
           encoding: "utf-8",
           env: pulumiEnv,
@@ -17095,7 +17331,7 @@ Specify which to base on: mesh stack init --from <stack>`
       logInfo(`Using KMS secrets provider: ${secretsProvider}`);
     }
     try {
-      execFileSync26("pulumi", initArgs, {
+      execFileSync27("pulumi", initArgs, {
         cwd: appRoot,
         env: pulumiEnv,
         stdio: "inherit"
@@ -17112,7 +17348,7 @@ Specify which to base on: mesh stack init --from <stack>`
       }
     }
     try {
-      execFileSync26("pulumi", ["stack", "select", newStack], {
+      execFileSync27("pulumi", ["stack", "select", newStack], {
         cwd: appRoot,
         env: pulumiEnv,
         stdio: ["pipe", "pipe", "pipe"]
@@ -17122,7 +17358,7 @@ Specify which to base on: mesh stack init --from <stack>`
     if (!configExists) {
       let baseConfig = {};
       try {
-        const raw = execFileSync26(
+        const raw = execFileSync27(
           "pulumi",
           ["config", "--json", "--stack", baseStack],
           { cwd: appRoot, env: pulumiEnv, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
@@ -17140,19 +17376,19 @@ Specify which to base on: mesh stack init --from <stack>`
         if (key === "mesh:deploy") continue;
         try {
           if (entry.objectValue !== void 0) {
-            execFileSync26(
+            execFileSync27(
               "pulumi",
               ["config", "set", key, JSON.stringify(entry.objectValue)],
               { cwd: appRoot, env: pulumiEnv, stdio: ["pipe", "pipe", "pipe"] }
             );
           } else if (entry.value === "true" || entry.value === "false") {
-            execFileSync26(
+            execFileSync27(
               "pulumi",
               ["config", "set", "--type", "bool", key, entry.value],
               { cwd: appRoot, env: pulumiEnv, stdio: ["pipe", "pipe", "pipe"] }
             );
           } else {
-            execFileSync26(
+            execFileSync27(
               "pulumi",
               ["config", "set", key, entry.value],
               { cwd: appRoot, env: pulumiEnv, stdio: ["pipe", "pipe", "pipe"] }
@@ -17165,7 +17401,7 @@ Specify which to base on: mesh stack init --from <stack>`
         const baseEnv = readConfigBlockKey(appRoot, baseStack, "mesh:coreEnv") ?? (baseTenant && baseStack.startsWith(`${baseTenant}-`) ? baseStack.slice(baseTenant.length + 1) : baseStack);
         const setCfg = (args) => {
           try {
-            execFileSync26("pulumi", ["config", "set", ...args], {
+            execFileSync27("pulumi", ["config", "set", ...args], {
               cwd: appRoot,
               env: pulumiEnv,
               stdio: ["pipe", "pipe", "pipe"]
@@ -17214,7 +17450,7 @@ Specify which to base on: mesh stack init --from <stack>`
           `Configured Pulumi.${newStack}.yaml (personal platform env on core '${baseEnv}'${opts.parentZone ? `, DNS zone ${newStack.startsWith(`${baseTenant}-`) ? newStack.slice(baseTenant.length + 1) : newStack}.${opts.parentZone}` : ""})`
         );
       } else {
-        execFileSync26("pulumi", ["config", "set", "--type", "bool", "mesh:deploy", "false"], {
+        execFileSync27("pulumi", ["config", "set", "--type", "bool", "mesh:deploy", "false"], {
           cwd: appRoot,
           env: pulumiEnv,
           stdio: ["pipe", "pipe", "pipe"]
@@ -17244,7 +17480,7 @@ Specify which to base on: mesh stack init --from <stack>`
     const args = ["stack", "rm", name];
     if (opts.yes) args.push("--yes");
     try {
-      execFileSync26("pulumi", args, { cwd: appRoot, env: pulumiEnv, stdio: "inherit" });
+      execFileSync27("pulumi", args, { cwd: appRoot, env: pulumiEnv, stdio: "inherit" });
       logSuccess(`Removed stack ${name}`);
     } catch (err) {
       process.exit(err.status ?? 1);
@@ -17456,12 +17692,12 @@ var init_recover_conversation = __esm({
 });
 
 // libs/mesh-cli/src/utils/temporal-codec.ts
-import { execFileSync as execFileSync27 } from "child_process";
+import { execFileSync as execFileSync28 } from "child_process";
 import { webcrypto as crypto4 } from "node:crypto";
 function resolveTemporalEncodingKeyFromK8s(namespace) {
   const secretName = `${namespace}-temporal-encoding-key`;
   try {
-    const b64 = execFileSync27(
+    const b64 = execFileSync28(
       "kubectl",
       [
         "get",
@@ -20339,7 +20575,7 @@ var init_src3 = __esm({
 import * as fs33 from "fs";
 import * as path40 from "path";
 import { createRequire as createRequire2 } from "module";
-import { execFileSync as execFileSync28 } from "child_process";
+import { execFileSync as execFileSync29 } from "child_process";
 function resolveExtractorPath() {
   try {
     const require2 = createRequire2(import.meta.url);
@@ -20394,7 +20630,7 @@ for (const file of files) {
 process.stdout.write(JSON.stringify(results));
 `;
   try {
-    const result = execFileSync28("npx", ["tsx", "--eval", script], {
+    const result = execFileSync29("npx", ["tsx", "--eval", script], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "inherit"],
       maxBuffer: 10 * 1024 * 1024
@@ -20436,7 +20672,7 @@ for (const file of files) {
 process.stdout.write(JSON.stringify(results));
 `;
   try {
-    const result = execFileSync28("npx", ["tsx", "--eval", script], {
+    const result = execFileSync29("npx", ["tsx", "--eval", script], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "inherit"],
       maxBuffer: 10 * 1024 * 1024
@@ -20491,7 +20727,7 @@ for (const file of files) {
 process.stdout.write(JSON.stringify(results));
 `;
   try {
-    const result = execFileSync28("npx", ["tsx", "--eval", script], {
+    const result = execFileSync29("npx", ["tsx", "--eval", script], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "inherit"],
       maxBuffer: 10 * 1024 * 1024