@mesh-tech/mesh-cli 0.12.7 → 0.14.0

package/dist/bin/mesh.js

@@ -890,8 +890,8 @@ ${body}${MANAGED_END}
     return existing.slice(0, startIdx) + section + existing.slice(tail);
   }
   if (existing.length === 0) return section;
-  const sep4 = existing.endsWith("\n\n") ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
-  return existing + sep4 + section;
+  const sep5 = existing.endsWith("\n\n") ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
+  return existing + sep5 + section;
 }
 function newStsClient() {
   return new STSClient({ region: DEFAULT_REGION });
@@ -1859,8 +1859,8 @@ function resolveHubPlatformName(platform) {
   return platform?.name ?? "mesh";
 }
 async function ssmGetParameter(name) {
-  const { SSMClient: SSMClient4, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4({ region: process.env.AWS_REGION || "us-east-2" });
+  const { SSMClient: SSMClient5, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5({ region: process.env.AWS_REGION || "us-east-2" });
   const resp = await ssm.send(new GetParameterCommand2({ Name: name, WithDecryption: true }));
   return resp.Parameter?.Value;
 }
@@ -1901,8 +1901,8 @@ var init_kubeconfig = __esm({
 // libs/mesh-cli/src/utils/temporal-auth.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
 async function resolveTemporalAuth(tenant, env, platformName = tenant) {
-  const { SSMClient: SSMClient4, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4({ region: process.env.AWS_REGION || "us-east-2" });
+  const { SSMClient: SSMClient5, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5({ region: process.env.AWS_REGION || "us-east-2" });
   const results = {};
   async function trySSM(name) {
     try {
@@ -2297,8 +2297,8 @@ function buildFabricCheckPayload(targetBytes = 8e3) {
   return JSON.stringify({ ...base, pad: "x".repeat(Math.max(0, targetBytes - overhead)) });
 }
 async function verifyFabric() {
-  const { SSMClient: SSMClient4, PutParameterCommand, GetParameterCommand: GetParameterCommand2, GetParametersByPathCommand: GetParametersByPathCommand3, DeleteParametersCommand } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4(AWS_CONFIG);
+  const { SSMClient: SSMClient5, PutParameterCommand, GetParameterCommand: GetParameterCommand2, GetParametersByPathCommand: GetParametersByPathCommand3, DeleteParametersCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5(AWS_CONFIG);
   const payload = buildFabricCheckPayload();
   const mainParam = FABRIC_CHECK_PATH;
   const childParams = [`${FABRIC_CHECK_PATH}/vpc`, `${FABRIC_CHECK_PATH}/eks`];
@@ -2350,8 +2350,8 @@ async function verifyFabric() {
   }
 }
 async function registerTenantEnv(tenant, opts = {}) {
-  const { SSMClient: SSMClient4, PutParameterCommand } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4(AWS_CONFIG);
+  const { SSMClient: SSMClient5, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5(AWS_CONFIG);
   await ssm.send(
     new PutParameterCommand({
       Name: `/mesh-platform/${tenant}`,
@@ -2379,8 +2379,8 @@ async function registerTenantEnv(tenant, opts = {}) {
   );
 }
 async function seedLocalPlatform() {
-  const { SSMClient: SSMClient4, PutParameterCommand } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4(AWS_CONFIG);
+  const { SSMClient: SSMClient5, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5(AWS_CONFIG);
   await ssm.send(
     new PutParameterCommand({
       Name: APP_TENANTS_PARAM,
@@ -2434,14 +2434,14 @@ var init_seed = __esm({
 // libs/mesh-cli/src/commands/local/helpers.ts
 import * as net2 from "net";
 async function upsertLocalSecret(secretId, value, client) {
-  const { SecretsManagerClient: SecretsManagerClient8, CreateSecretCommand: CreateSecretCommand3, PutSecretValueCommand: PutSecretValueCommand3 } = await import("@aws-sdk/client-secrets-manager");
-  const sm = client ?? new SecretsManagerClient8(LOCAL_AWS_CONFIG);
+  const { SecretsManagerClient: SecretsManagerClient9, CreateSecretCommand: CreateSecretCommand4, PutSecretValueCommand: PutSecretValueCommand4 } = await import("@aws-sdk/client-secrets-manager");
+  const sm = client ?? new SecretsManagerClient9(LOCAL_AWS_CONFIG);
   const secretString = JSON.stringify(value);
   try {
-    await sm.send(new CreateSecretCommand3({ Name: secretId, SecretString: secretString }));
+    await sm.send(new CreateSecretCommand4({ Name: secretId, SecretString: secretString }));
   } catch (err) {
     if (err?.name === "ResourceExistsException") {
-      await sm.send(new PutSecretValueCommand3({ SecretId: secretId, SecretString: secretString }));
+      await sm.send(new PutSecretValueCommand4({ SecretId: secretId, SecretString: secretString }));
     } else {
       throw err;
     }
@@ -3158,12 +3158,12 @@ async function fetchRemoteExternalCredentials(tenant, env, external, profile) {
   const region = process.env.MESH_PLATFORM_REGION ?? process.env.AWS_REGION ?? "us-east-2";
   const fallbackProfile = !process.env.AWS_ACCESS_KEY_ID && !process.env.AWS_PROFILE ? process.env.MESH_AWS_PROFILE ?? profile : void 0;
   try {
-    const { SecretsManagerClient: SecretsManagerClient8, GetSecretValueCommand: GetSecretValueCommand8 } = await import("@aws-sdk/client-secrets-manager");
+    const { SecretsManagerClient: SecretsManagerClient9, GetSecretValueCommand: GetSecretValueCommand9 } = await import("@aws-sdk/client-secrets-manager");
     if (fallbackProfile) process.env.AWS_PROFILE = fallbackProfile;
-    const sm = new SecretsManagerClient8({ region });
+    const sm = new SecretsManagerClient9({ region });
     let res;
     try {
-      res = await sm.send(new GetSecretValueCommand8({ SecretId: secretId }));
+      res = await sm.send(new GetSecretValueCommand9({ SecretId: secretId }));
     } finally {
       if (fallbackProfile) delete process.env.AWS_PROFILE;
     }
@@ -3277,8 +3277,8 @@ async function seedLocalMock(args) {
     `${secretName}/.config`,
     Object.fromEntries(Object.entries(value).filter(([key]) => !SECRET_KEY_RE.test(key)))
   );
-  const { SSMClient: SSMClient4, PutParameterCommand } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4(LOCAL_AWS_CONFIG);
+  const { SSMClient: SSMClient5, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5(LOCAL_AWS_CONFIG);
   const base = `/mesh-platform/${tenant}/${LOCAL_ENV}/apps/${app}/stacks/local/external-services/${decl.external}`;
   await ssm.send(
     new PutParameterCommand({
@@ -3720,8 +3720,8 @@ async function seedHubAuth(pat) {
   return config;
 }
 async function writeRegistryParams(cliClientId, awsConfig) {
-  const { SSMClient: SSMClient4, PutParameterCommand } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4(awsConfig);
+  const { SSMClient: SSMClient5, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5(awsConfig);
   await ssm.send(
     new PutParameterCommand({
       Name: ZITADEL_SSM_PARAM,
@@ -3911,9 +3911,9 @@ async function ensureM2mCaller(pat, tenant, app, orgId, projectId, roles) {
   return false;
 }
 async function authSecretExists(tenant, app, service) {
-  const { SecretsManagerClient: SecretsManagerClient8, GetSecretValueCommand: GetSecretValueCommand8 } = await import("@aws-sdk/client-secrets-manager");
-  const sm = new SecretsManagerClient8(LOCAL_AWS_CONFIG);
-  return sm.send(new GetSecretValueCommand8({ SecretId: authSecretPath(tenant, app, service) })).then(
+  const { SecretsManagerClient: SecretsManagerClient9, GetSecretValueCommand: GetSecretValueCommand9 } = await import("@aws-sdk/client-secrets-manager");
+  const sm = new SecretsManagerClient9(LOCAL_AWS_CONFIG);
+  return sm.send(new GetSecretValueCommand9({ SecretId: authSecretPath(tenant, app, service) })).then(
     () => true,
     () => false
   );
@@ -3924,8 +3924,8 @@ async function writeAuthSecret(tenant, app, service, value) {
   logSuccess(`Stored service credentials \u2192 ${name}`);
 }
 async function registerLocalApp(args) {
-  const { SSMClient: SSMClient4, PutParameterCommand } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4(LOCAL_AWS_CONFIG);
+  const { SSMClient: SSMClient5, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5(LOCAL_AWS_CONFIG);
   const put2 = (name, value, description) => ssm.send(
     new PutParameterCommand({ Name: name, Type: "String", Overwrite: true, Value: JSON.stringify(value), Description: description })
   );
@@ -3975,8 +3975,8 @@ async function registerLocalApp(args) {
 }
 async function reconcileRegistryFromZitadel() {
   const pat = readSeederPat();
-  const { SSMClient: SSMClient4, GetParameterCommand: GetParameterCommand2, PutParameterCommand } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4(LOCAL_AWS_CONFIG);
+  const { SSMClient: SSMClient5, GetParameterCommand: GetParameterCommand2, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5(LOCAL_AWS_CONFIG);
   const orgs = await api(pat, "POST", "/admin/v1/orgs/_search", { query: { limit: 200 } });
   const tenants = [];
   let apps = 0;
@@ -7297,8 +7297,8 @@ function registerDevCommand(program2) {
   });
   dev.command("test-user [name]").description("Get Temporal test user credentials (from Pulumi-managed test users)").option("--tenant <tenant>", "Tenant name", "mesh").option("--env <env>", "Environment", "dev").option("--region <region>", "AWS region", "us-east-2").action(
     async (name, opts) => {
-      const { SSMClient: SSMClient4, GetParameterCommand: GetParameterCommand2, GetParametersByPathCommand: GetParametersByPathCommand3 } = await import("@aws-sdk/client-ssm");
-      const ssm = new SSMClient4({ region: opts.region });
+      const { SSMClient: SSMClient5, GetParameterCommand: GetParameterCommand2, GetParametersByPathCommand: GetParametersByPathCommand3 } = await import("@aws-sdk/client-ssm");
+      const ssm = new SSMClient5({ region: opts.region });
       const basePath = `/mesh-platform/${opts.tenant}/${opts.env}/temporal/test-users`;
       if (!name) {
         try {
@@ -9291,9 +9291,9 @@ function parseTenantEnv(context) {
 }
 async function getRegistrySsmExport(tenant, env) {
   try {
-    const { SSMClient: SSMClient4, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
+    const { SSMClient: SSMClient5, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
     const region = process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? CA_REGION;
-    const ssm = new SSMClient4({ region });
+    const ssm = new SSMClient5({ region });
     const ssmPath = `/mesh-platform/${tenant}/${env}/registry`;
     const response = await ssm.send(new GetParameterCommand2({ Name: ssmPath }));
     if (!response.Parameter?.Value) return null;
@@ -9883,9 +9883,9 @@ async function discoverConfigFromSsm(context) {
   const ssmPath = `/mesh-platform/${tenant}/${env}/platform/zitadel`;
   logInfo(`Attempting SSM discovery from ${ssmPath}...`);
   try {
-    const { SSMClient: SSMClient4, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
+    const { SSMClient: SSMClient5, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
     const region = process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? "us-east-2";
-    const ssm = new SSMClient4({ region });
+    const ssm = new SSMClient5({ region });
     const resp = await ssm.send(new GetParameterCommand2({ Name: ssmPath }));
     const raw = resp.Parameter?.Value;
     if (!raw) {
@@ -11415,6 +11415,63 @@ ${raw}`;
 ${MANAGED_MARKER}
 ${raw.slice(frontmatter.length)}`;
 }
+function meshTechScopeDirs(root, maxDepth = 6) {
+  const scopes = [];
+  const walk = (dir, depth) => {
+    if (depth > maxDepth) return;
+    let entries;
+    try {
+      entries = fs21.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      if (entry.name === "node_modules") {
+        const scope = path23.join(dir, entry.name, "@mesh-tech");
+        if (fs21.existsSync(scope)) scopes.push(scope);
+        continue;
+      }
+      if (entry.name.startsWith(".")) continue;
+      walk(path23.join(dir, entry.name), depth + 1);
+    }
+  };
+  walk(root, 0);
+  return scopes;
+}
+function listPackageSkills(root) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const scopeDir of meshTechScopeDirs(root)) {
+    for (const pkg of fs21.readdirSync(scopeDir, { withFileTypes: true })) {
+      if (!pkg.isDirectory() && !pkg.isSymbolicLink()) continue;
+      if (pkg.name === BASE_SKILL_PACKAGE) continue;
+      const skillsDir = path23.join(scopeDir, pkg.name, "skills");
+      if (!fs21.existsSync(skillsDir)) continue;
+      for (const domain of fs21.readdirSync(skillsDir, { withFileTypes: true })) {
+        const source = path23.join(skillsDir, domain.name, "SKILL.md");
+        if (!fs21.existsSync(source)) continue;
+        const name = `mesh-${pkg.name}-${domain.name}`;
+        if (!byName.has(name)) byName.set(name, { name, dir: path23.join(skillsDir, domain.name), source });
+      }
+    }
+  }
+  return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+function copySkillExtras(sourceDir, targetDir) {
+  for (const entry of fs21.readdirSync(sourceDir, { withFileTypes: true })) {
+    if (entry.name === "SKILL.md") continue;
+    fs21.cpSync(path23.join(sourceDir, entry.name), path23.join(targetDir, entry.name), { recursive: true });
+  }
+}
+function seedAppSkill(root, appName, appRelPath) {
+  const target = path23.join(root, ".claude", "skills", appName, "SKILL.md");
+  if (fs21.existsSync(target)) return null;
+  const template = fs21.readFileSync(cliAsset("assets", "app-skill", "SKILL.md"), "utf-8");
+  const body = template.replaceAll("__APP_NAME__", appName).replaceAll("__APP_PATH__", appRelPath || ".");
+  fs21.mkdirSync(path23.dirname(target), { recursive: true });
+  fs21.writeFileSync(target, body);
+  return path23.relative(root, target);
+}
 function planSync(root) {
   const items = [];
   for (const skill of listBaseSkills()) {
@@ -11441,6 +11498,43 @@ function planSync(root) {
       }
     }
   }
+  const packageSkills = listPackageSkills(root);
+  for (const skill of packageSkills) {
+    const targetDir = path23.join(root, ".claude", "skills", skill.name);
+    const target = path23.join(targetDir, "SKILL.md");
+    const desired = renderManagedSkill(skill.source);
+    const label = `.claude/skills/${skill.name}/SKILL.md (platform skill)`;
+    if (!fs21.existsSync(target)) {
+      items.push({
+        label,
+        state: "write",
+        apply: () => {
+          fs21.mkdirSync(targetDir, { recursive: true });
+          fs21.writeFileSync(target, desired);
+          copySkillExtras(skill.dir, targetDir);
+        }
+      });
+    } else {
+      const current = fs21.readFileSync(target, "utf-8");
+      if (current === desired) {
+        items.push({ label, state: "ok" });
+      } else if (current.includes(MANAGED_MARKER)) {
+        items.push({
+          label,
+          state: "write",
+          apply: () => {
+            fs21.writeFileSync(target, desired);
+            copySkillExtras(skill.dir, targetDir);
+          }
+        });
+      } else {
+        items.push({ label: `${label} \u2014 exists without the managed marker, leaving as-is`, state: "skip" });
+      }
+    }
+  }
+  if (packageSkills.length === 0 && meshTechScopeDirs(root).length === 0) {
+    logInfo("No @mesh-tech packages installed yet \u2014 run `pnpm install`, then `mesh skills sync` again for the platform skills.");
+  }
   const hookSource = cliAsset("assets", "intent", "intent-claude-gate.mjs");
   const hookTarget = path23.join(root, HOOK_RELATIVE);
   const hookDesired = fs21.readFileSync(hookSource, "utf-8");
@@ -11455,6 +11549,38 @@ function planSync(root) {
       }
     }
   );
+  const rootPkgPath = path23.join(root, "package.json");
+  if (fs21.existsSync(rootPkgPath)) {
+    let rootPkg = null;
+    try {
+      rootPkg = JSON.parse(fs21.readFileSync(rootPkgPath, "utf-8"));
+    } catch {
+      rootPkg = null;
+    }
+    const label = "package.json (@tanstack/intent devDependency)";
+    if (!rootPkg) {
+      items.push({ label: `${label} \u2014 package.json is unparseable, leaving as-is`, state: "skip" });
+    } else if (rootPkg.devDependencies?.["@tanstack/intent"] || rootPkg.dependencies?.["@tanstack/intent"]) {
+      items.push({ label, state: "ok" });
+    } else {
+      items.push({
+        label,
+        // Writing the dependency does not install it. Bare `mesh skills sync`
+        // in an already-installed repo leaves `pnpm exec intent` unresolvable
+        // until the next install, so say so rather than reporting success.
+        remediation: "Added @tanstack/intent \u2014 run `pnpm install` so `pnpm exec intent` resolves.",
+        state: "write",
+        apply: () => {
+          rootPkg.devDependencies = rootPkg.devDependencies ?? {};
+          rootPkg.devDependencies["@tanstack/intent"] = INTENT_RANGE;
+          rootPkg.devDependencies = Object.fromEntries(
+            Object.entries(rootPkg.devDependencies).sort(([a], [b]) => a.localeCompare(b))
+          );
+          fs21.writeFileSync(rootPkgPath, JSON.stringify(rootPkg, null, 2) + "\n");
+        }
+      });
+    }
+  }
   const settingsPath = path23.join(root, ".claude", "settings.json");
   let settings = {};
   try {
@@ -11523,6 +11649,7 @@ function syncSkills(root, opts = {}) {
     } else {
       item.apply?.();
       logSuccess(`synced: ${item.label}`);
+      if (item.remediation) logInfo(item.remediation);
     }
   }
   if (!dirty) {
@@ -11533,7 +11660,7 @@ function syncSkills(root, opts = {}) {
 function registerSkillsCommands(program2) {
   const skills = program2.command("skills").description("Agent-skill distribution (base skills + Intent discovery)");
   skills.command("sync").description(
-    "Install the base building-with-Mesh skills into .claude/skills/ and wire TanStack-Intent discovery (hook + settings + AGENTS.md fence) for package skills"
+    "Install the base building-with-Mesh skills into .claude/skills/, fetch the platform skills shipped by the repo's installed @mesh-tech/* packages, and wire TanStack-Intent discovery (intent devDependency + hook + settings + AGENTS.md fence)"
   ).option("--check", "verify only (CI/doctor): exit 1 when anything is missing or stale", false).option("--root <path>", "target repo root (default: enclosing git root)").action((opts) => {
     const root = path23.resolve(opts.root ?? resolveTargetRoot());
     const ok = syncSkills(root, { check: opts.check });
@@ -11544,7 +11671,7 @@ function registerSkillsCommands(program2) {
     }
   });
 }
-var MANAGED_MARKER, FENCE_START, HOOK_RELATIVE;
+var MANAGED_MARKER, FENCE_START, HOOK_RELATIVE, INTENT_RANGE, BASE_SKILL_PACKAGE;
 var init_skills = __esm({
   "libs/mesh-cli/src/commands/skills.ts"() {
     "use strict";
@@ -11554,26 +11681,78 @@ var init_skills = __esm({
     MANAGED_MARKER = "<!-- managed-by: mesh skills sync \u2014 edits are overwritten; copy content elsewhere to customize -->";
     FENCE_START = "<!-- intent-skills:start -->";
     HOOK_RELATIVE = path23.join(".intent", "hooks", "intent-claude-gate.mjs");
+    INTENT_RANGE = "^0.3.6";
+    BASE_SKILL_PACKAGE = "mesh-cli";
+  }
+});
+
+// libs/mesh-cli/src/utils/scaffold-versions.ts
+import { execFileSync as execFileSync18 } from "child_process";
+function isPrerelease(range) {
+  return /[-+]/.test(range.replace(/^\^/, ""));
+}
+function toCaretRange(version) {
+  const trimmed = version.trim();
+  return /^\d+\.\d+\.\d+(?:[-+].*)?$/.test(trimmed) ? `^${trimmed}` : null;
+}
+function resolvePublishedRange(pkg, cwd) {
+  try {
+    const out = execFileSync18("npm", ["view", pkg, "version"], {
+      cwd,
+      encoding: "utf-8",
+      timeout: 15e3,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const range = toCaretRange(out);
+    if (range && !isPrerelease(range)) return { range, resolved: true };
+  } catch {
+  }
+  return { range: SCAFFOLD_PACKAGE_LINES[pkg], resolved: false };
+}
+var SCAFFOLD_PACKAGE_LINES, SCAFFOLD_TOOLCHAIN;
+var init_scaffold_versions = __esm({
+  "libs/mesh-cli/src/utils/scaffold-versions.ts"() {
+    "use strict";
+    SCAFFOLD_PACKAGE_LINES = {
+      "@mesh-tech/app-kit": "^1.45.0",
+      "@mesh-tech/esm-bundle": "^0.1.1"
+    };
+    SCAFFOLD_TOOLCHAIN = {
+      "@types/node": "^24.2.1",
+      tsx: "^4.20.4",
+      typescript: "^5.9.2"
+    };
   }
 });
 
 // libs/mesh-cli/src/commands/create-app.ts
 var create_app_exports = {};
 __export(create_app_exports, {
+  PLATFORM_MONOREPO_NAME: () => PLATFORM_MONOREPO_NAME,
   bootstrapAppsRepo: () => bootstrapAppsRepo,
   copyTemplate: () => copyTemplate,
+  ensureWorkspaceGlobs: () => ensureWorkspaceGlobs,
+  isInsidePlatformMonorepo: () => isInsidePlatformMonorepo,
   registerCreateAppCommand: () => registerCreateAppCommand,
-  shouldBootstrapAppsRepo: () => shouldBootstrapAppsRepo
+  shouldBootstrapAppsRepo: () => shouldBootstrapAppsRepo,
+  workspaceGlobForApp: () => workspaceGlobForApp
 });
 import * as fs22 from "fs";
 import * as os8 from "os";
 import * as path24 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import Handlebars from "handlebars";
-function isInsideMonorepo(dir) {
+import { parse as parseYaml2 } from "yaml";
+function isInsidePlatformMonorepo(dir) {
   let cur = path24.resolve(dir);
   while (cur !== path24.dirname(cur)) {
-    if (fs22.existsSync(path24.join(cur, "pnpm-workspace.yaml"))) return true;
+    if (fs22.existsSync(path24.join(cur, "pnpm-workspace.yaml"))) {
+      try {
+        const pkg = JSON.parse(fs22.readFileSync(path24.join(cur, "package.json"), "utf-8"));
+        if (pkg?.name === PLATFORM_MONOREPO_NAME) return true;
+      } catch {
+      }
+    }
     cur = path24.dirname(cur);
   }
   return false;
@@ -11583,7 +11762,7 @@ function resolveDeployerRoleArn(tenant, platformName, env) {
   return `arn:aws:iam::${account}:role/${tenant}-${env}-apps-deployer`;
 }
 function shouldBootstrapAppsRepo(cwd) {
-  return fs22.existsSync(path24.join(cwd, ".git")) && !isInsideMonorepo(cwd) && !fs22.existsSync(path24.join(cwd, "package.json")) && !fs22.existsSync(path24.join(cwd, "tenants")) && !fs22.existsSync(path24.join(cwd, "apps"));
+  return fs22.existsSync(path24.join(cwd, ".git")) && !isInsidePlatformMonorepo(cwd) && !fs22.existsSync(path24.join(cwd, "package.json")) && !fs22.existsSync(path24.join(cwd, "tenants")) && !fs22.existsSync(path24.join(cwd, "apps"));
 }
 function bootstrapAppsRepo(cwd, tenant) {
   const templateDir = path24.join(packageRoot, "templates", "apps-repo");
@@ -11592,7 +11771,8 @@ function bootstrapAppsRepo(cwd, tenant) {
     repoName: path24.basename(cwd),
     tenant,
     tenantTitle: tenant.split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" "),
-    registryUrl: `https://mesh-platform-${registryAccount}.d.codeartifact.us-east-2.amazonaws.com/npm/mesh-packages/`
+    registryUrl: `https://mesh-platform-${registryAccount}.d.codeartifact.us-east-2.amazonaws.com/npm/mesh-packages/`,
+    intentRange: INTENT_RANGE
   };
   const staging = fs22.mkdtempSync(path24.join(os8.tmpdir(), "mesh-apps-repo-"));
   try {
@@ -11618,6 +11798,41 @@ function bootstrapAppsRepo(cwd, tenant) {
     fs22.rmSync(staging, { recursive: true, force: true });
   }
 }
+function ensureWorkspaceGlobs(root, required) {
+  const file = path24.join(root, "pnpm-workspace.yaml");
+  if (!fs22.existsSync(file)) return [];
+  const text = fs22.readFileSync(file, "utf-8");
+  let declared;
+  try {
+    declared = parseYaml2(text)?.packages ?? [];
+  } catch {
+    return [];
+  }
+  const missing = required.filter((glob) => !declared.includes(glob));
+  if (missing.length === 0) return [];
+  const lines = text.split("\n");
+  const start = lines.findIndex((line) => /^packages:\s*$/.test(line));
+  if (start === -1) return [];
+  let end = start;
+  for (let i = start + 1; i < lines.length; i++) {
+    const line = lines[i] ?? "";
+    const isEntry = /^\s+-\s/.test(line);
+    if (isEntry || /^\s*#/.test(line) || line.trim() === "") {
+      if (isEntry) end = i;
+      continue;
+    }
+    break;
+  }
+  const indent = (lines[end] ?? "").match(/^(\s*)-/)?.[1] ?? "  ";
+  lines.splice(end + 1, 0, ...missing.map((glob) => `${indent}- ${glob}`));
+  fs22.writeFileSync(file, lines.join("\n"));
+  return missing;
+}
+function workspaceGlobForApp(root, appDir) {
+  const rel = path24.relative(root, appDir).split(path24.sep).join("/");
+  if (rel === "" || rel.split("/")[0] === "..") return null;
+  return `${path24.posix.dirname(rel)}/*/*`;
+}
 function maybeBootstrapAppsRepo(cwd, tenant, test) {
   if (test || !shouldBootstrapAppsRepo(cwd)) return;
   const created = bootstrapAppsRepo(cwd, tenant);
@@ -11858,15 +12073,22 @@ async function runLegacyTemplate(tenant, name, template, test) {
     fs22.rmSync(appDir, { recursive: true, force: true });
     process.exit(1);
   }
-  autoSyncSkills(appDir);
+  autoSyncSkills(appDir, name);
   printLegacyNextSteps(appDir, template);
 }
-function autoSyncSkills(appDir) {
+function autoSyncSkills(appDir, appName) {
+  const root = resolveTargetRoot(appDir);
   try {
-    syncSkills(resolveTargetRoot(appDir));
+    syncSkills(root);
   } catch (err) {
     logWarn(`Agent-skill sync skipped: ${err instanceof Error ? err.message : err} \u2014 run: mesh skills sync`);
   }
+  try {
+    const seeded = seedAppSkill(root, appName, path24.relative(root, appDir));
+    if (seeded) logSuccess(`seeded: ${seeded} (yours to grow \u2014 not managed by mesh skills sync)`);
+  } catch (err) {
+    logWarn(`App skill stub skipped: ${err instanceof Error ? err.message : err}`);
+  }
 }
 async function runComposable(tenant, name, primitives, test) {
   logInfo(`Creating app '${name}' for tenant '${tenant}'...`);
@@ -11883,6 +12105,15 @@ async function runComposable(tenant, name, primitives, test) {
   const region = "us-east-2";
   const platformName = "mesh";
   const platformEnv = "dev";
+  const workspaceDeps = isInsidePlatformMonorepo(appDir);
+  const repoRoot2 = resolveTargetRoot(process.cwd());
+  const mesh = workspaceDeps ? { range: "", resolved: true } : resolvePublishedRange("@mesh-tech/app-kit", repoRoot2);
+  const esmBundle = workspaceDeps ? { range: "", resolved: true } : resolvePublishedRange("@mesh-tech/esm-bundle", repoRoot2);
+  if (!workspaceDeps) {
+    logInfo(
+      mesh.resolved ? `@mesh-tech/* pinned to ${mesh.range} (current published line)` : `Registry lookup unavailable \u2014 pinning @mesh-tech/* to ${mesh.range}; run \`pnpm up @mesh-tech/*\` once you have registry auth`
+    );
+  }
   const context = {
     name,
     tenant,
@@ -11891,9 +12122,12 @@ async function runComposable(tenant, name, primitives, test) {
     temporal: primitives.includes("temporal"),
     bucket: primitives.includes("bucket"),
     region,
-    // Link local source when generating inside this monorepo; pin only for
-    // out-of-repo tenant repos that install `@mesh-tech/*` from the registry.
-    workspaceDeps: isInsideMonorepo(appDir),
+    workspaceDeps,
+    meshRange: mesh.range,
+    esmBundleRange: esmBundle.range,
+    typesNodeRange: SCAFFOLD_TOOLCHAIN["@types/node"],
+    tsxRange: SCAFFOLD_TOOLCHAIN.tsx,
+    typescriptRange: SCAFFOLD_TOOLCHAIN.typescript,
     deployerRoleArn: resolveDeployerRoleArn(tenant, platformName, platformEnv)
   };
   fs22.mkdirSync(appDir, { recursive: true });
@@ -11905,20 +12139,18 @@ async function runComposable(tenant, name, primitives, test) {
     fs22.rmSync(appDir, { recursive: true, force: true });
     process.exit(1);
   }
-  const configPath = path24.join(path24.dirname(appDir), "config.ts");
-  if (!fs22.existsSync(configPath)) {
-    logWarn(`No config.ts found at ${configPath}`);
-    logInfo("You may need to create a shared config.ts for tenant apps.");
+  const nested = fs22.readdirSync(appDir, { withFileTypes: true }).some((entry) => entry.isDirectory() && fs22.existsSync(path24.join(appDir, entry.name, "package.json")));
+  const glob = workspaceGlobForApp(repoRoot2, appDir);
+  if (nested && glob) {
+    const added = ensureWorkspaceGlobs(repoRoot2, [glob]);
+    if (added.length > 0) {
+      logInfo(`pnpm-workspace.yaml: added ${added.join(", ")} so the app's api/worker packages install`);
+    }
   }
-  autoSyncSkills(appDir);
+  autoSyncSkills(appDir, name);
   printComposableNextSteps(appDir, context);
 }
 function printLegacyNextSteps(appDir, _template) {
-  const configPath = path24.join(path24.dirname(appDir), "config.ts");
-  if (!fs22.existsSync(configPath)) {
-    logWarn(`No config.ts found at ${configPath}`);
-    logInfo("You may need to create a shared config.ts for tenant apps.");
-  }
   console.log("");
   logSuccess("App created successfully!");
   console.log("");
@@ -11955,18 +12187,21 @@ function printComposableNextSteps(appDir, context) {
   console.log("Next steps:");
   console.log(`  cd ${appDir}`);
   console.log("  pnpm install");
+  console.log("  mesh skills sync         # re-run once deps are installed: picks up package skills + Intent");
+  console.log("  pnpm install             # again only if skills sync reports it added @tanstack/intent");
   console.log("  mesh stack init          # personal dev stack (deploy: false)");
   console.log("  mesh deploy up --yes     # deploy via the stack's deployer role");
   console.log("  mesh dev                 # run locally");
   console.log("");
 }
-var __filename, __dirname, packageRoot, TEMPLATES, REMOVED_TEMPLATES, PRIMITIVES, HUB_ACCOUNTS, VALID_PRIMITIVES;
+var __filename, __dirname, packageRoot, TEMPLATES, REMOVED_TEMPLATES, PRIMITIVES, HUB_ACCOUNTS, PLATFORM_MONOREPO_NAME, VALID_PRIMITIVES;
 var init_create_app = __esm({
   "libs/mesh-cli/src/commands/create-app.ts"() {
     "use strict";
     init_utils();
     init_skills();
     init_stack();
+    init_scaffold_versions();
     __filename = fileURLToPath2(import.meta.url);
     __dirname = path24.dirname(__filename);
     packageRoot = findPackageRoot(__dirname);
@@ -11989,6 +12224,7 @@ var init_create_app = __esm({
     HUB_ACCOUNTS = {
       mesh: "159923586610"
     };
+    PLATFORM_MONOREPO_NAME = "mesh-platform";
     VALID_PRIMITIVES = Object.keys(PRIMITIVES);
     Handlebars.registerHelper("titleCase", (str) => {
       return str.split("-").map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
@@ -12600,8 +12836,8 @@ var init_db = __esm({
 
 // libs/mesh-cli/src/utils/deploy-preflight.ts
 import { existsSync as existsSync20, readFileSync as readFileSync21 } from "node:fs";
-import { dirname as dirname22, join as join25, relative as relative3 } from "node:path";
-import { parse as parseYaml2 } from "yaml";
+import { dirname as dirname22, join as join25, relative as relative5 } from "node:path";
+import { parse as parseYaml3 } from "yaml";
 function isGated(name) {
   return GATED_PREFIXES.some((p) => name.startsWith(p));
 }
@@ -12659,14 +12895,14 @@ function checkDeployDepsFresh(appRoot) {
   if (!lockPath) return null;
   let lockDoc;
   try {
-    lockDoc = parseYaml2(readFileSync21(lockPath, "utf8"));
+    lockDoc = parseYaml3(readFileSync21(lockPath, "utf8"));
   } catch {
     logWarn(
       `deploy preflight: could not parse ${lockPath} \u2014 skipping the stale-node_modules check.`
     );
     return null;
   }
-  const importerRel = relative3(dirname22(lockPath), appRoot) || ".";
+  const importerRel = relative5(dirname22(lockPath), appRoot) || ".";
   const expected = extractImporterMeshVersions(lockDoc, importerRel);
   const names = Object.keys(expected);
   if (names.length === 0) return [];
@@ -12715,7 +12951,7 @@ var init_deploy_preflight = __esm({
 });
 
 // libs/mesh-cli/src/commands/deploy.ts
-import { execFileSync as execFileSync18 } from "child_process";
+import { execFileSync as execFileSync19 } from "child_process";
 function buildPulumiArgs(pulumiArgs, stack) {
   const base = pulumiArgs.length === 0 || pulumiArgs[0]?.startsWith("-") ? ["up", ...pulumiArgs] : [...pulumiArgs];
   const op = base[0];
@@ -12778,7 +13014,7 @@ function registerDeployCommand(program2) {
     delete env.AWS_PROFILE;
     const finalArgs = buildPulumiArgs(pulumiArgs, stack);
     try {
-      execFileSync18("pulumi", finalArgs, {
+      execFileSync19("pulumi", finalArgs, {
         cwd: appRoot,
         env,
         stdio: "inherit"
@@ -13071,10 +13307,10 @@ var init_discover = __esm({
 });
 
 // libs/mesh-cli/src/docs/assemble.ts
-import { execFileSync as execFileSync19 } from "node:child_process";
+import { execFileSync as execFileSync20 } from "node:child_process";
 import { mkdirSync as mkdirSync15, readFileSync as readFileSync23, rmSync as rmSync5, writeFileSync as writeFileSync15 } from "node:fs";
 import path27 from "node:path";
-import { parse as parseYaml3 } from "yaml";
+import { parse as parseYaml4 } from "yaml";
 function splitFrontMatter(markdown) {
   const normalized = markdown.replace(/^\uFEFF/, "");
   if (!normalized.startsWith("---\n") && !normalized.startsWith("---\r\n")) {
@@ -13086,7 +13322,7 @@ function splitFrontMatter(markdown) {
   const bodyStart = normalized.indexOf("\n", end + 1);
   const body = (bodyStart === -1 ? "" : normalized.slice(bodyStart + 1)).replace(/^\r?\n/, "");
   try {
-    const data = parseYaml3(rawBlock);
+    const data = parseYaml4(rawBlock);
     if (data && typeof data === "object" && !Array.isArray(data)) {
       return {
         data,
@@ -13562,7 +13798,7 @@ function renderVersionJson(args) {
 }
 function currentCommit(repoRoot2) {
   try {
-    return execFileSync19("git", ["rev-parse", "--short", "HEAD"], {
+    return execFileSync20("git", ["rev-parse", "--short", "HEAD"], {
       cwd: repoRoot2,
       encoding: "utf-8"
     }).trim();
@@ -13581,7 +13817,7 @@ function currentBaseline(repoRoot2) {
   }
 }
 function publishSetAtRef(repoRoot2, ref) {
-  const git = (gitArgs) => execFileSync19("git", gitArgs, {
+  const git = (gitArgs) => execFileSync20("git", gitArgs, {
     cwd: repoRoot2,
     encoding: "utf-8",
     maxBuffer: 64 * 1024 * 1024
@@ -14069,7 +14305,7 @@ var init_portal = __esm({
 });
 
 // libs/mesh-cli/src/utils/build-info.ts
-import { execFileSync as execFileSync20 } from "child_process";
+import { execFileSync as execFileSync21 } from "child_process";
 import * as fs24 from "fs";
 import * as path29 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
@@ -14127,7 +14363,7 @@ function resolveCliRuntime(opts) {
   }
   if (!vcs) return info;
   try {
-    const git = (args) => execFileSync20("git", args, {
+    const git = (args) => execFileSync21("git", args, {
       cwd: root,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "pipe"]
@@ -14147,10 +14383,10 @@ var init_build_info = __esm({
 // libs/mesh-cli/src/docs/serve.ts
 import { createServer as createServer8 } from "node:http";
 import { readFile } from "node:fs/promises";
-import { extname, join as join27, normalize, sep as sep3 } from "node:path";
+import { extname, join as join27, normalize, sep as sep4 } from "node:path";
 async function serveDocsSite(args) {
   const root = normalize(args.root);
-  const rootPrefix = root.endsWith(sep3) ? root : root + sep3;
+  const rootPrefix = root.endsWith(sep4) ? root : root + sep4;
   const server = createServer8((req, res) => {
     void (async () => {
       const url = new URL(req.url ?? "/", "http://localhost");
@@ -14224,7 +14460,7 @@ var init_serve = __esm({
 });
 
 // libs/mesh-cli/src/docs/registry-docs.ts
-import { execFileSync as execFileSync21 } from "node:child_process";
+import { execFileSync as execFileSync22 } from "node:child_process";
 import { existsSync as existsSync23, mkdirSync as mkdirSync17, readFileSync as readFileSync26, renameSync as renameSync3, rmSync as rmSync6, writeFileSync as writeFileSync17 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
 import path30 from "node:path";
@@ -14316,7 +14552,7 @@ async function fetchDocsArtifact(auth, version, cacheRoot = docsCacheRoot(), fet
   rmSync6(staging, { recursive: true, force: true });
   mkdirSync17(staging, { recursive: true });
   try {
-    execFileSync21("tar", ["-xzf", tgzPath, "-C", staging, "--strip-components", "1"], {
+    execFileSync22("tar", ["-xzf", tgzPath, "-C", staging, "--strip-components", "1"], {
       stdio: ["pipe", "pipe", "pipe"]
     });
   } finally {
@@ -14354,7 +14590,7 @@ __export(start_exports, {
   tmuxInstallHint: () => tmuxInstallHint,
   tmuxServeArgs: () => tmuxServeArgs
 });
-import { execFileSync as execFileSync22 } from "node:child_process";
+import { execFileSync as execFileSync23 } from "node:child_process";
 import { appendFileSync as appendFileSync2, existsSync as existsSync24, writeFileSync as writeFileSync18 } from "node:fs";
 import path31 from "node:path";
 function registryAuthOrThrow() {
@@ -14387,7 +14623,7 @@ function tmuxInstallHint(platform = process.platform) {
 }
 function tmuxAvailable() {
   try {
-    execFileSync22("tmux", ["-V"], { stdio: ["pipe", "pipe", "pipe"] });
+    execFileSync23("tmux", ["-V"], { stdio: ["pipe", "pipe", "pipe"] });
     return true;
   } catch {
     return false;
@@ -14398,7 +14634,7 @@ function shouldDetach(args) {
 }
 function docsSessionExists() {
   try {
-    execFileSync22("tmux", ["has-session", "-t", DOCS_TMUX_SESSION], { stdio: ["pipe", "pipe", "pipe"] });
+    execFileSync23("tmux", ["has-session", "-t", DOCS_TMUX_SESSION], { stdio: ["pipe", "pipe", "pipe"] });
     return true;
   } catch {
     return false;
@@ -14422,12 +14658,12 @@ Or run in the foreground instead: mesh docs start --foreground`
   if (docsSessionExists()) {
     logInfo(`Replacing the docs server already running in tmux session "${DOCS_TMUX_SESSION}".`);
     try {
-      execFileSync22("tmux", ["kill-session", "-t", DOCS_TMUX_SESSION], { stdio: ["pipe", "pipe", "pipe"] });
+      execFileSync23("tmux", ["kill-session", "-t", DOCS_TMUX_SESSION], { stdio: ["pipe", "pipe", "pipe"] });
     } catch {
     }
   }
   const { command, cwd } = tmuxServeArgs(args);
-  execFileSync22(
+  execFileSync23(
     "tmux",
     ["new-session", "-d", "-s", DOCS_TMUX_SESSION, "-c", cwd, "--", ...command],
     { stdio: ["pipe", "pipe", "pipe"] }
@@ -14465,7 +14701,7 @@ function printReady(url, label) {
 }
 function runDocsStop() {
   try {
-    execFileSync22("tmux", ["kill-session", "-t", DOCS_TMUX_SESSION], { stdio: ["pipe", "pipe", "pipe"] });
+    execFileSync23("tmux", ["kill-session", "-t", DOCS_TMUX_SESSION], { stdio: ["pipe", "pipe", "pipe"] });
     logSuccess(`Stopped the docs server (tmux session "${DOCS_TMUX_SESSION}").`);
   } catch {
     logInfo(`No docs server is running (no tmux session named "${DOCS_TMUX_SESSION}").`);
@@ -14838,7 +15074,7 @@ var init_docs = __esm({
 });
 
 // libs/mesh-cli/src/commands/hub/index.ts
-import { execFileSync as execFileSync23 } from "node:child_process";
+import { execFileSync as execFileSync24 } from "node:child_process";
 import * as fs26 from "node:fs";
 import * as net12 from "node:net";
 import * as os10 from "node:os";
@@ -14904,7 +15140,7 @@ function parseTmuxEnv(output) {
 }
 function readTmuxSessionEnv(sessionName) {
   try {
-    const out = execFileSync23("tmux", ["show-environment", "-t", sessionName], {
+    const out = execFileSync24("tmux", ["show-environment", "-t", sessionName], {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -14915,7 +15151,7 @@ function readTmuxSessionEnv(sessionName) {
 }
 function tmuxSessionExists(sessionName) {
   try {
-    execFileSync23("tmux", ["has-session", "-t", sessionName], { stdio: "ignore" });
+    execFileSync24("tmux", ["has-session", "-t", sessionName], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -15079,7 +15315,7 @@ function redactEnv(env) {
 async function hubDevAction(opts) {
   if (opts.kill) {
     if (tmuxSessionExists(HUB_SESSION)) {
-      execFileSync23("tmux", ["kill-session", "-t", HUB_SESSION], { stdio: "ignore" });
+      execFileSync24("tmux", ["kill-session", "-t", HUB_SESSION], { stdio: "ignore" });
       fs26.rmSync(hubEnvDir(), { recursive: true, force: true });
       logSuccess(`Killed Hub session '${HUB_SESSION}'.`);
     } else {
@@ -15133,17 +15369,17 @@ async function hubDevAction(opts) {
   for (const warning of assembled.warnings) logWarn(warning);
   const apiDir = path33.join(platformDir, "apps", "hub", "api");
   const uiDir = path33.join(platformDir, "apps", "hub", "ui");
-  execFileSync23("tmux", ["new-session", "-d", "-s", HUB_SESSION, "-n", "api", "-c", apiDir]);
+  execFileSync24("tmux", ["new-session", "-d", "-s", HUB_SESSION, "-n", "api", "-c", apiDir]);
   if (!assembled.apiEnv.DEV_USER_TOKEN_URL && assembled.apiEnv.DEV_USER_ID_TOKEN) {
     const platform = session.state.devOutput.platform;
     const credContext = `mesh.${platform.env}`;
     const tokenPort = await findFreePort4();
     const tokenUrl = `http://127.0.0.1:${tokenPort}`;
-    execFileSync23("tmux", ["new-window", "-t", HUB_SESSION, "-n", "token-server", "-c", platformDir]);
-    execFileSync23("tmux", ["set-option", "-t", `${HUB_SESSION}:token-server`, "remain-on-exit", "on"], {
+    execFileSync24("tmux", ["new-window", "-t", HUB_SESSION, "-n", "token-server", "-c", platformDir]);
+    execFileSync24("tmux", ["set-option", "-t", `${HUB_SESSION}:token-server`, "remain-on-exit", "on"], {
       stdio: "ignore"
     });
-    execFileSync23("tmux", [
+    execFileSync24("tmux", [
       "send-keys",
       "-t",
       `${HUB_SESSION}:token-server`,
@@ -15161,12 +15397,12 @@ async function hubDevAction(opts) {
     const envFile = path33.join(hubEnvDir(), `${window}.env.sh`);
     writeEnvFile(envFile, env);
     if (createWindow) {
-      execFileSync23("tmux", ["new-window", "-t", HUB_SESSION, "-n", window, "-c", dir]);
+      execFileSync24("tmux", ["new-window", "-t", HUB_SESSION, "-n", window, "-c", dir]);
     }
-    execFileSync23("tmux", ["set-option", "-t", `${HUB_SESSION}:${window}`, "remain-on-exit", "on"], {
+    execFileSync24("tmux", ["set-option", "-t", `${HUB_SESSION}:${window}`, "remain-on-exit", "on"], {
       stdio: "ignore"
     });
-    execFileSync23("tmux", ["send-keys", "-t", `${HUB_SESSION}:${window}`, buildLaunchCommand(envFile, dir, cmd), "Enter"]);
+    execFileSync24("tmux", ["send-keys", "-t", `${HUB_SESSION}:${window}`, buildLaunchCommand(envFile, dir, cmd), "Enter"]);
   };
   launch("api", apiDir, assembled.apiEnv, "pnpm dev", false);
   launch("ui", uiDir, assembled.uiEnv, `pnpm dev -- --port ${uiPort} --strictPort`, true);
@@ -15492,7 +15728,7 @@ var init_init = __esm({
 });
 
 // libs/mesh-cli/src/commands/install-shim.ts
-import { execFileSync as execFileSync24 } from "child_process";
+import { execFileSync as execFileSync25 } from "child_process";
 import * as fs28 from "fs";
 import * as os11 from "os";
 import * as path35 from "path";
@@ -15605,7 +15841,7 @@ function registerInstallShimCommand(program2) {
     let status = 0;
     let ok = true;
     try {
-      stdout = execFileSync24(target, ["--help"], {
+      stdout = execFileSync25(target, ["--help"], {
         cwd: process.cwd(),
         encoding: "utf8",
         stdio: ["ignore", "pipe", "pipe"]
@@ -15652,7 +15888,7 @@ var init_install_shim = __esm({
 });
 
 // libs/mesh-cli/src/commands/local/hub-local.ts
-import { execFile as execFile3, execFileSync as execFileSync25 } from "child_process";
+import { execFile as execFile3, execFileSync as execFileSync26 } from "child_process";
 import * as fs29 from "fs";
 import * as os12 from "os";
 import * as path36 from "path";
@@ -15674,7 +15910,7 @@ function npmrcPath() {
 }
 function imageExists(tag) {
   try {
-    execFileSync25("docker", ["image", "inspect", tag], { stdio: ["ignore", "pipe", "pipe"] });
+    execFileSync26("docker", ["image", "inspect", tag], { stdio: ["ignore", "pipe", "pipe"] });
     return true;
   } catch {
     return false;
@@ -15684,7 +15920,7 @@ function ensureHubAuthImage() {
   if (imageExists(HUB_AUTH_IMAGE)) return;
   logInfo(`Building ${HUB_AUTH_IMAGE} (Hub auth proxy)\u2026`);
   const hubStackDir = path36.join(findPackageRoot(), "stack", "hub");
-  execFileSync25(
+  execFileSync26(
     "docker",
     ["build", "-f", path36.join(hubStackDir, "Dockerfile.auth"), "-t", HUB_AUTH_IMAGE, hubStackDir],
     { stdio: ["ignore", "inherit", "inherit"], env: { ...process.env, DOCKER_BUILDKIT: "1" } }
@@ -15698,7 +15934,7 @@ function hasRegistryAuth() {
 function localHubVersion() {
   const versions = HUB_IMAGES.map((name) => {
     try {
-      const out = execFileSync25("docker", ["images", name, "--format", "{{.Tag}}"], {
+      const out = execFileSync26("docker", ["images", name, "--format", "{{.Tag}}"], {
         encoding: "utf-8",
         stdio: ["ignore", "pipe", "pipe"]
       });
@@ -15777,7 +16013,7 @@ async function ensureHubImages() {
   const context = path36.join(cacheDir(), `context-${version}`);
   fs29.rmSync(context, { recursive: true, force: true });
   fs29.mkdirSync(context, { recursive: true });
-  execFileSync25("tar", ["-xzf", tarball, "-C", context, "--strip-components", "1"], {
+  execFileSync26("tar", ["-xzf", tarball, "-C", context, "--strip-components", "1"], {
     stdio: ["ignore", "pipe", "pipe"]
   });
   const hubStackDir = path36.join(findPackageRoot(), "stack", "hub");
@@ -15788,7 +16024,7 @@ async function ensureHubImages() {
     const tag = `${name}:${version}`;
     if (imageExists(tag)) continue;
     logInfo(`Building ${tag} from the published tarball\u2026`);
-    execFileSync25(
+    execFileSync26(
       "docker",
       [
         "build",
@@ -16285,6 +16521,12 @@ import {
 } from "@aws-sdk/client-secrets-manager";
 import input from "@inquirer/input";
 import password from "@inquirer/password";
+import {
+  buildInstanceIndexValue,
+  instanceIndexSecretId,
+  isInstanceKey,
+  parseInstanceIndex
+} from "@mesh-tech/secrets";
 async function ensureAwsCredentialsForStack(stack) {
   if (process.env.AWS_ACCESS_KEY_ID || process.env.AWS_SESSION_TOKEN) return;
   if (!stack) return;
@@ -16469,6 +16711,12 @@ Usage: mesh secrets set external/<name>`);
     );
     process.exit(1);
   }
+  if (opts.key && !isInstanceKey(opts.key)) {
+    logError(
+      `Invalid instance key "${opts.key}": keys must not contain "/", start with ".", or end with ".config" \u2014 those names are reserved for the index and config mirrors.`
+    );
+    process.exit(1);
+  }
   let existing = {};
   try {
     const response = await smClient.send(
@@ -16493,6 +16741,9 @@ Usage: mesh secrets set external/<name>`);
     const merged2 = deepMerge(existing, values2);
     await writeSecret(smClient, secretId, merged2, svc.meta);
     await writeConfigMirror(smClient, secretId, schema, merged2, svc.meta);
+    if (opts.key) {
+      await addKeyToInstanceIndex(smClient, secretPrefix, opts.key, serviceName);
+    }
     logSuccess(`Credentials written to ${secretId}`);
     return;
   }
@@ -16508,6 +16759,9 @@ Usage: mesh secrets set external/<name>`);
   const merged = deepMerge(existing, values);
   await writeSecret(smClient, secretId, merged, svc.meta);
   await writeConfigMirror(smClient, secretId, schema, merged, svc.meta);
+  if (opts.key) {
+    await addKeyToInstanceIndex(smClient, secretPrefix, opts.key, serviceName);
+  }
   logSuccess(`Credentials written to ${secretId}`);
   console.error("\nStored fields:");
   displaySummary(schema.fields, merged);
@@ -16573,6 +16827,45 @@ function extractNonSecretFields(fields, values) {
   }
   return result;
 }
+async function addKeyToInstanceIndex(client, secretPrefix, key, serviceName) {
+  const indexId = instanceIndexSecretId(secretPrefix);
+  try {
+    let keys = [];
+    try {
+      const res = await client.send(new GetSecretValueCommand5({ SecretId: indexId }));
+      keys = parseInstanceIndex(res.SecretString ?? "");
+    } catch (err) {
+      if (!isResourceNotFound(err)) throw err;
+    }
+    if (keys.includes(key)) return;
+    const secretString = buildInstanceIndexValue([...keys, key]);
+    try {
+      await client.send(
+        new PutSecretValueCommand({ SecretId: indexId, SecretString: secretString })
+      );
+    } catch (err) {
+      if (!isResourceNotFound(err)) throw err;
+      await client.send(
+        new CreateSecretCommand({
+          Name: indexId,
+          Description: `Instance-key index for ${serviceName} (read by listInstances(); maintained by mesh secrets set/reindex and the Hub)`,
+          SecretString: secretString,
+          Tags: [
+            { Key: "mesh:type", Value: "external-service-index" },
+            { Key: "mesh:service", Value: serviceName }
+          ]
+        })
+      );
+      logInfo(
+        `Created ${indexId} OUT OF BAND \u2014 the declaring stack does not manage it. Deploy the declaring stack (it creates the index) before writing keys, or import this secret into the stack before its next deploy.`
+      );
+    }
+  } catch (err) {
+    logInfo(
+      `Warning: failed to record instance "${key}" in ${indexId} \u2014 listInstances() will not see it until you run: mesh secrets reindex external/${serviceName} (${err})`
+    );
+  }
+}
 async function writeConfigMirror(client, secretId, schema, merged, meta) {
   const configId = `${secretId}/.config`;
   const configValues = extractNonSecretFields(schema.fields, merged);
@@ -16614,17 +16907,157 @@ var init_set = __esm({
   }
 });
 
+// libs/mesh-cli/src/commands/secrets/reindex.ts
+import { SSMClient as SSMClient3 } from "@aws-sdk/client-ssm";
+import {
+  SecretsManagerClient as SecretsManagerClient6,
+  ListSecretsCommand,
+  GetSecretValueCommand as GetSecretValueCommand6,
+  PutSecretValueCommand as PutSecretValueCommand2,
+  CreateSecretCommand as CreateSecretCommand2
+} from "@aws-sdk/client-secrets-manager";
+import {
+  buildInstanceIndexValue as buildInstanceIndexValue2,
+  instanceIndexSecretId as instanceIndexSecretId2,
+  instanceKeyFromSecretName,
+  parseInstanceIndex as parseInstanceIndex2
+} from "@mesh-tech/secrets";
+async function scanInstanceKeys(client, secretPrefix) {
+  const keys = [];
+  let nextToken;
+  do {
+    const response = await client.send(
+      new ListSecretsCommand({
+        Filters: [{ Key: "name", Values: [`${secretPrefix}/`] }],
+        NextToken: nextToken
+      })
+    );
+    for (const secret of response.SecretList ?? []) {
+      const key = secret.Name ? instanceKeyFromSecretName(secretPrefix, secret.Name) : null;
+      if (key) keys.push(key);
+    }
+    nextToken = response.NextToken;
+  } while (nextToken);
+  return keys;
+}
+function indexAlreadyMatches(missing, stale, indexExists, malformed) {
+  return missing.length === 0 && stale.length === 0 && indexExists && !malformed;
+}
+async function reindexCommand(servicePath, opts) {
+  const stackOpt = resolveStackOption(opts);
+  const context = detectContext(stackOpt);
+  const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
+  await ensureAwsCredentialsForStack(stackOpt ?? context.stage);
+  const ssmClient = new SSMClient3({ region });
+  const smClient = new SecretsManagerClient6({ region });
+  const services = await discoverExternalServices(
+    ssmClient,
+    context.tenant,
+    context.platformEnv
+  );
+  const serviceName = servicePath?.replace(/^external\//, "");
+  if (!serviceName || !services.has(serviceName)) {
+    if (serviceName) {
+      logError(`External service "${serviceName}" not found.`);
+    }
+    const keyed = [...services.entries()].filter(([, s]) => s.schema?.keyedBy);
+    console.error("\nMulti-instance external services:");
+    for (const [name, svc2] of keyed) {
+      console.error(`  ${name} (keyed by ${svc2.schema.keyedBy})`);
+    }
+    if (keyed.length === 0) console.error("  (none)");
+    console.error(`
+Usage: mesh secrets reindex external/<name>`);
+    process.exit(serviceName ? 1 : 0);
+  }
+  const svc = services.get(serviceName);
+  if (!svc.schema?.keyedBy) {
+    logError(
+      `"${serviceName}" is single-instance (no keyedBy) \u2014 it has no instance index.`
+    );
+    process.exit(1);
+  }
+  const secretPrefix = svc.meta.secretPrefix;
+  const indexId = instanceIndexSecretId2(secretPrefix);
+  const actual = [...new Set(await scanInstanceKeys(smClient, secretPrefix))].sort();
+  let listed = [];
+  let indexExists = true;
+  let malformed = false;
+  try {
+    const res = await smClient.send(new GetSecretValueCommand6({ SecretId: indexId }));
+    try {
+      listed = parseInstanceIndex2(res.SecretString ?? "");
+    } catch {
+      malformed = true;
+      logInfo(`Existing index at ${indexId} is malformed \u2014 rebuilding from scratch.`);
+    }
+  } catch (err) {
+    if (!isResourceNotFound(err)) throw err;
+    indexExists = false;
+    logInfo(`No index at ${indexId} yet \u2014 it will be created.`);
+  }
+  const missing = actual.filter((k) => !listed.includes(k));
+  const stale = listed.filter((k) => !actual.includes(k));
+  logInfo(`Instances in Secrets Manager: ${actual.length ? actual.join(", ") : "(none)"}`);
+  if (missing.length > 0) logInfo(`Missing from index: ${missing.join(", ")}`);
+  if (stale.length > 0) logInfo(`Stale in index (secret gone): ${stale.join(", ")}`);
+  if (indexAlreadyMatches(missing, stale, indexExists, malformed)) {
+    logSuccess(`Index at ${indexId} already matches \u2014 nothing to do.`);
+    return;
+  }
+  if (opts.dryRun) {
+    logInfo(`Dry run \u2014 would write ${indexId} with ${actual.length} instance(s).`);
+    return;
+  }
+  await writeInstanceIndex(smClient, secretPrefix, serviceName, actual);
+  logSuccess(`Index rebuilt: ${indexId} now lists ${actual.length} instance(s).`);
+}
+async function writeInstanceIndex(client, secretPrefix, serviceName, keys) {
+  const indexId = instanceIndexSecretId2(secretPrefix);
+  const secretString = buildInstanceIndexValue2(keys);
+  try {
+    await client.send(
+      new PutSecretValueCommand2({ SecretId: indexId, SecretString: secretString })
+    );
+  } catch (err) {
+    if (!isResourceNotFound(err)) throw err;
+    await client.send(
+      new CreateSecretCommand2({
+        Name: indexId,
+        Description: `Instance-key index for ${serviceName} (read by listInstances(); maintained by mesh secrets set/reindex and the Hub)`,
+        SecretString: secretString,
+        Tags: [
+          { Key: "mesh:type", Value: "external-service-index" },
+          { Key: "mesh:service", Value: serviceName }
+        ]
+      })
+    );
+    logInfo(
+      `Created ${indexId} OUT OF BAND \u2014 the declaring stack does not manage it. Deploy the declaring stack BEFORE reindex next time, or import this secret into the stack before its next deploy.`
+    );
+  }
+}
+var init_reindex = __esm({
+  "libs/mesh-cli/src/commands/secrets/reindex.ts"() {
+    "use strict";
+    init_context();
+    init_log();
+    init_stack_flag();
+    init_set();
+  }
+});
+
 // libs/mesh-cli/src/commands/secrets/migrate-config.ts
 import {
-  SSMClient as SSMClient3,
+  SSMClient as SSMClient4,
   GetParametersByPathCommand as GetParametersByPathCommand2
 } from "@aws-sdk/client-ssm";
 import {
-  SecretsManagerClient as SecretsManagerClient6,
-  GetSecretValueCommand as GetSecretValueCommand6,
-  PutSecretValueCommand as PutSecretValueCommand2,
-  CreateSecretCommand as CreateSecretCommand2,
-  ListSecretsCommand
+  SecretsManagerClient as SecretsManagerClient7,
+  GetSecretValueCommand as GetSecretValueCommand7,
+  PutSecretValueCommand as PutSecretValueCommand3,
+  CreateSecretCommand as CreateSecretCommand3,
+  ListSecretsCommand as ListSecretsCommand2
 } from "@aws-sdk/client-secrets-manager";
 function normalizeEntry2(raw) {
   if (raw.type === "group" && raw.fields) {
@@ -16710,7 +17143,7 @@ function isResourceNotFound2(err) {
 }
 async function readSecret(client, secretId) {
   try {
-    const res = await client.send(new GetSecretValueCommand6({ SecretId: secretId }));
+    const res = await client.send(new GetSecretValueCommand7({ SecretId: secretId }));
     return res.SecretString ? JSON.parse(res.SecretString) : null;
   } catch (err) {
     if (isResourceNotFound2(err)) return null;
@@ -16720,10 +17153,10 @@ async function readSecret(client, secretId) {
 async function writeSecret2(client, secretId, values, description) {
   const secretString = JSON.stringify(values);
   try {
-    await client.send(new PutSecretValueCommand2({ SecretId: secretId, SecretString: secretString }));
+    await client.send(new PutSecretValueCommand3({ SecretId: secretId, SecretString: secretString }));
   } catch (err) {
     if (isResourceNotFound2(err)) {
-      await client.send(new CreateSecretCommand2({
+      await client.send(new CreateSecretCommand3({
         Name: secretId,
         Description: description,
         SecretString: secretString,
@@ -16736,7 +17169,7 @@ async function writeSecret2(client, secretId, values, description) {
 }
 async function secretExists(client, secretId) {
   try {
-    await client.send(new GetSecretValueCommand6({ SecretId: secretId }));
+    await client.send(new GetSecretValueCommand7({ SecretId: secretId }));
     return true;
   } catch (err) {
     if (isResourceNotFound2(err)) return false;
@@ -16749,7 +17182,7 @@ async function listInstanceKeys(client, secretPrefix) {
   let nextToken;
   do {
     const response = await client.send(
-      new ListSecretsCommand({
+      new ListSecretsCommand2({
         Filters: [{ Key: "name", Values: [prefix2] }],
         NextToken: nextToken
       })
@@ -16815,8 +17248,8 @@ async function migrateService(smClient, meta, schema, opts) {
 async function migrateConfigCommand(opts) {
   const context = detectContext(resolveStackOption(opts));
   const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
-  const ssmClient = new SSMClient3({ region });
-  const smClient = new SecretsManagerClient6({ region });
+  const ssmClient = new SSMClient4({ region });
+  const smClient = new SecretsManagerClient7({ region });
   logInfo(`Migrating .config mirrors for ${context.tenant}/${context.platformEnv}`);
   if (opts.dryRun) logInfo("DRY-RUN mode \u2014 no writes");
   if (opts.force) logInfo("FORCE mode \u2014 overwrite existing .config");
@@ -16869,6 +17302,11 @@ function registerSecretsCommands(program2) {
   secrets.command("set [service]").description("Set credentials for an external service (e.g., mesh secrets set external/symitar)").option("--key <key>", "Instance key for multi-instance services (e.g., FI ID)").option("--all", "Prompt for all fields including optional ones").option("--json <json>", "Non-interactive: provide values as JSON").option("--stack <stack>", "Pulumi stack name (override detection)").addOption(new Option2("--stage <stack>", "Deprecated alias for --stack").hideHelp()).option("--region <region>", "AWS region (default: us-east-2)").action(async (service, opts) => {
     await setCommand(service, opts);
   });
+  secrets.command("reindex [service]").description(
+    "Rebuild a multi-instance external service's instance index (the {prefix}/.index secret listInstances() reads) from the per-key secrets actually in Secrets Manager \u2014 the repair for an instance secret created or deleted out of band"
+  ).option("--dry-run", "Show what would change without writing").option("--stack <stack>", "Pulumi stack name (override detection)").addOption(new Option2("--stage <stack>", "Deprecated alias for --stack").hideHelp()).option("--region <region>", "AWS region (default: us-east-2)").action(async (service, opts) => {
+    await reindexCommand(service, opts);
+  });
   secrets.command("migrate-config").description("Backfill .config mirror secrets for all external services").option("--force", "Overwrite existing .config mirrors").option("--dry-run", "Show what would be written without writing").option("--stack <stack>", "Pulumi stack name (override detection)").addOption(new Option2("--stage <stack>", "Deprecated alias for --stack").hideHelp()).option("--region <region>", "AWS region (default: us-east-2)").action(async (opts) => {
     await migrateConfigCommand(opts);
   });
@@ -16878,15 +17316,16 @@ var init_secrets = __esm({
     "use strict";
     init_exec2();
     init_set();
+    init_reindex();
     init_migrate_config();
   }
 });
 
 // libs/mesh-cli/src/commands/stack.ts
-import { execFileSync as execFileSync26 } from "child_process";
+import { execFileSync as execFileSync27 } from "child_process";
 import * as path37 from "path";
 import * as fs30 from "fs";
-import { parse as parseYaml4 } from "yaml";
+import { parse as parseYaml5 } from "yaml";
 function readTopLevelYamlKey(appRoot, stack, key) {
   const configFile = path37.join(appRoot, `Pulumi.${stack}.yaml`);
   if (!fs30.existsSync(configFile)) return null;
@@ -16963,7 +17402,7 @@ function readBaseConfigFromYaml(appRoot, stack) {
   if (!fs30.existsSync(file)) return {};
   let doc;
   try {
-    doc = parseYaml4(fs30.readFileSync(file, "utf-8"));
+    doc = parseYaml5(fs30.readFileSync(file, "utf-8"));
   } catch {
     return {};
   }
@@ -16976,7 +17415,7 @@ function readBaseConfigFromYaml(appRoot, stack) {
 }
 function getGitHubUsername() {
   try {
-    const result = execFileSync26("gh", ["api", "user", "--jq", ".login"], {
+    const result = execFileSync27("gh", ["api", "user", "--jq", ".login"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -16985,7 +17424,7 @@ function getGitHubUsername() {
   } catch {
   }
   try {
-    const result = execFileSync26("git", ["config", "user.email"], {
+    const result = execFileSync27("git", ["config", "user.email"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -17071,7 +17510,7 @@ Specify which to base on: mesh stack init --from <stack>`
     if (!opts.adopt) {
       let existing = [];
       try {
-        const raw = execFileSync26("pulumi", ["stack", "ls", "--json"], {
+        const raw = execFileSync27("pulumi", ["stack", "ls", "--json"], {
           cwd: appRoot,
           encoding: "utf-8",
           env: pulumiEnv,
@@ -17095,7 +17534,7 @@ Specify which to base on: mesh stack init --from <stack>`
       logInfo(`Using KMS secrets provider: ${secretsProvider}`);
     }
     try {
-      execFileSync26("pulumi", initArgs, {
+      execFileSync27("pulumi", initArgs, {
         cwd: appRoot,
         env: pulumiEnv,
         stdio: "inherit"
@@ -17112,7 +17551,7 @@ Specify which to base on: mesh stack init --from <stack>`
       }
     }
     try {
-      execFileSync26("pulumi", ["stack", "select", newStack], {
+      execFileSync27("pulumi", ["stack", "select", newStack], {
         cwd: appRoot,
         env: pulumiEnv,
         stdio: ["pipe", "pipe", "pipe"]
@@ -17122,7 +17561,7 @@ Specify which to base on: mesh stack init --from <stack>`
     if (!configExists) {
       let baseConfig = {};
       try {
-        const raw = execFileSync26(
+        const raw = execFileSync27(
           "pulumi",
           ["config", "--json", "--stack", baseStack],
           { cwd: appRoot, env: pulumiEnv, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
@@ -17140,19 +17579,19 @@ Specify which to base on: mesh stack init --from <stack>`
         if (key === "mesh:deploy") continue;
         try {
           if (entry.objectValue !== void 0) {
-            execFileSync26(
+            execFileSync27(
               "pulumi",
               ["config", "set", key, JSON.stringify(entry.objectValue)],
               { cwd: appRoot, env: pulumiEnv, stdio: ["pipe", "pipe", "pipe"] }
             );
           } else if (entry.value === "true" || entry.value === "false") {
-            execFileSync26(
+            execFileSync27(
               "pulumi",
               ["config", "set", "--type", "bool", key, entry.value],
               { cwd: appRoot, env: pulumiEnv, stdio: ["pipe", "pipe", "pipe"] }
             );
           } else {
-            execFileSync26(
+            execFileSync27(
               "pulumi",
               ["config", "set", key, entry.value],
               { cwd: appRoot, env: pulumiEnv, stdio: ["pipe", "pipe", "pipe"] }
@@ -17165,7 +17604,7 @@ Specify which to base on: mesh stack init --from <stack>`
         const baseEnv = readConfigBlockKey(appRoot, baseStack, "mesh:coreEnv") ?? (baseTenant && baseStack.startsWith(`${baseTenant}-`) ? baseStack.slice(baseTenant.length + 1) : baseStack);
         const setCfg = (args) => {
           try {
-            execFileSync26("pulumi", ["config", "set", ...args], {
+            execFileSync27("pulumi", ["config", "set", ...args], {
               cwd: appRoot,
               env: pulumiEnv,
               stdio: ["pipe", "pipe", "pipe"]
@@ -17214,7 +17653,7 @@ Specify which to base on: mesh stack init --from <stack>`
           `Configured Pulumi.${newStack}.yaml (personal platform env on core '${baseEnv}'${opts.parentZone ? `, DNS zone ${newStack.startsWith(`${baseTenant}-`) ? newStack.slice(baseTenant.length + 1) : newStack}.${opts.parentZone}` : ""})`
         );
       } else {
-        execFileSync26("pulumi", ["config", "set", "--type", "bool", "mesh:deploy", "false"], {
+        execFileSync27("pulumi", ["config", "set", "--type", "bool", "mesh:deploy", "false"], {
           cwd: appRoot,
           env: pulumiEnv,
           stdio: ["pipe", "pipe", "pipe"]
@@ -17244,7 +17683,7 @@ Specify which to base on: mesh stack init --from <stack>`
     const args = ["stack", "rm", name];
     if (opts.yes) args.push("--yes");
     try {
-      execFileSync26("pulumi", args, { cwd: appRoot, env: pulumiEnv, stdio: "inherit" });
+      execFileSync27("pulumi", args, { cwd: appRoot, env: pulumiEnv, stdio: "inherit" });
       logSuccess(`Removed stack ${name}`);
     } catch (err) {
       process.exit(err.status ?? 1);
@@ -17456,12 +17895,12 @@ var init_recover_conversation = __esm({
 });
 
 // libs/mesh-cli/src/utils/temporal-codec.ts
-import { execFileSync as execFileSync27 } from "child_process";
+import { execFileSync as execFileSync28 } from "child_process";
 import { webcrypto as crypto4 } from "node:crypto";
 function resolveTemporalEncodingKeyFromK8s(namespace) {
   const secretName = `${namespace}-temporal-encoding-key`;
   try {
-    const b64 = execFileSync27(
+    const b64 = execFileSync28(
       "kubectl",
       [
         "get",
@@ -18519,8 +18958,8 @@ import * as fs32 from "fs";
 import * as os13 from "os";
 import * as path39 from "path";
 import {
-  SecretsManagerClient as SecretsManagerClient7,
-  GetSecretValueCommand as GetSecretValueCommand7
+  SecretsManagerClient as SecretsManagerClient8,
+  GetSecretValueCommand as GetSecretValueCommand8
 } from "@aws-sdk/client-secrets-manager";
 function resolveTenantEnv(options) {
   if (options.tenant && options.env) {
@@ -18783,10 +19222,10 @@ async function tunnelExternal(name, options) {
   const { appTenant, appStage } = resolveCredentialAxis(options);
   const secretId = externalSecretId(appTenant, appStage, name, key);
   const setHint = `mesh secrets set external/${name}${key ? ` --key=${key}` : ""}`;
-  const sm = new SecretsManagerClient7({});
+  const sm = new SecretsManagerClient8({});
   let creds;
   try {
-    const out = await sm.send(new GetSecretValueCommand7({ SecretId: secretId }));
+    const out = await sm.send(new GetSecretValueCommand8({ SecretId: secretId }));
     creds = JSON.parse(out.SecretString ?? "{}");
   } catch (err) {
     logError(
@@ -20339,7 +20778,7 @@ var init_src3 = __esm({
 import * as fs33 from "fs";
 import * as path40 from "path";
 import { createRequire as createRequire2 } from "module";
-import { execFileSync as execFileSync28 } from "child_process";
+import { execFileSync as execFileSync29 } from "child_process";
 function resolveExtractorPath() {
   try {
     const require2 = createRequire2(import.meta.url);
@@ -20394,7 +20833,7 @@ for (const file of files) {
 process.stdout.write(JSON.stringify(results));
 `;
   try {
-    const result = execFileSync28("npx", ["tsx", "--eval", script], {
+    const result = execFileSync29("npx", ["tsx", "--eval", script], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "inherit"],
       maxBuffer: 10 * 1024 * 1024
@@ -20436,7 +20875,7 @@ for (const file of files) {
 process.stdout.write(JSON.stringify(results));
 `;
   try {
-    const result = execFileSync28("npx", ["tsx", "--eval", script], {
+    const result = execFileSync29("npx", ["tsx", "--eval", script], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "inherit"],
       maxBuffer: 10 * 1024 * 1024
@@ -20491,7 +20930,7 @@ for (const file of files) {
 process.stdout.write(JSON.stringify(results));
 `;
   try {
-    const result = execFileSync28("npx", ["tsx", "--eval", script], {
+    const result = execFileSync29("npx", ["tsx", "--eval", script], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "inherit"],
       maxBuffer: 10 * 1024 * 1024