@mesh-tech/mesh-cli 0.15.0 → 0.17.0

package/dist/src/commands/app-check.js

@@ -0,0 +1,502 @@
+/**
+ * `mesh app check` — the Mesh app contract, enforced.
+ *
+ * Scans a tenant-apps checkout and reports every mechanical violation of the
+ * contract in `@mesh-tech/app-kit`'s `apps` skill
+ * (`skills/apps/references/app-contract.md`): a browser UI served from inside
+ * the API process, an app that never registers with the Hub, app-written
+ * browser sessions where the platform auth proxy belongs, logging that
+ * bypasses `@mesh-tech/logger`, and an app whose people, roles or keys the
+ * Hub cannot see. `mesh create-app` runs it on every scaffold, tenant CI runs
+ * it beside `mesh skills sync --check`, and the platform reviewer runs the
+ * same command — one detector, one exit code.
+ *
+ * Three layers, like `mesh dev doctor`:
+ *   1. Pure scanners (`scanApp`, `scanRepo`) — filesystem in, `Finding[]` out.
+ *   2. One `Check` per contract code, on the dev-doctor engine (`runChecks`).
+ *   3. The command: resolves the repo root, picks the apps, renders, exits.
+ *
+ * The patterns are deliberately shape-based: `apps/<app>/index.ts` (the Pulumi
+ * program) is the contract's single point of truth, and a service directory is
+ * a UI if its name says so. A hit is a fact to READ, not a verdict — the ruling
+ * detail and every gate's owning primitive live in the contract reference.
+ *
+ * @example
+ * ```bash
+ * mesh app check                        # every apps/* in this repo
+ * mesh app check apps/funding-portal    # one app
+ * mesh app check --json                 # stable shape for CI
+ * ```
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { logError, logInfo } from "../utils/index.js";
+import { MeshCliError, emitJsonPayload } from "../utils/errors.js";
+import { resolveTargetRoot } from "./skills.js";
+import { ICONS, aggregateStatus, jsonReport, renderHuman, runChecks, } from "./dev-doctor.js";
+export const APP_CHECK_RULES = {
+    UI_IN_API: {
+        gate: "0.1",
+        title: "UI is its own service",
+        severity: "block",
+        remediation: 'move the pages to apps/<app>/ui and declare new mesh.apps.Service("ui", { env, src: "./ui", … })',
+        scope: "app",
+    },
+    NO_UI_SERVICE: {
+        gate: "0.1",
+        title: "UI service declared",
+        severity: "block",
+        remediation: 'add apps/<app>/ui + new mesh.apps.Service("ui", …) in index.ts',
+        scope: "app",
+    },
+    NO_REGISTER: {
+        gate: "0.2",
+        title: "App registers with the Hub",
+        severity: "block",
+        remediation: "end index.ts with `export const app = env.register({ description })`",
+        scope: "app",
+    },
+    CUSTOM_SESSION_AUTH: {
+        gate: "0.3",
+        title: "Sign-in through the platform",
+        severity: "block",
+        remediation: 'delete the OIDC + cookie code and protect the UI service with auth: { provider: "mesh" }',
+        scope: "app",
+    },
+    NON_PLATFORM_LOGGER: {
+        gate: "0.4",
+        title: "Logs through @mesh-tech/logger",
+        severity: "block",
+        remediation: "import { createLogger } from \"@mesh-tech/logger\" and log through it (requestLogger for HTTP)",
+        scope: "app",
+    },
+    LOCAL_AUTH_LIB: {
+        gate: "0.5",
+        title: "No tenant-local auth library",
+        severity: "advisory",
+        remediation: "check whether @mesh-tech/authn already owns this; if the platform lacks it, file a platform item",
+        scope: "repo",
+    },
+    NO_AUTHZ_POINTER: {
+        gate: "H",
+        title: "Access surfaced through the Hub",
+        severity: "block",
+        remediation: 'publish ops-hub metadata and end index.ts with new mesh.auth.AppAuthzPointer("authz", { env, mode, opsHubMetadataRef })',
+        scope: "app",
+    },
+    METADATA_UNPUBLISHED: {
+        gate: "H",
+        title: "Ops-hub metadata published",
+        severity: "block",
+        remediation: "export compileOpsHubMetadata(schemaDef) with mesh.exports.Export (role-gating) or let SpiceDBSchema publish it (policy-engine)",
+        scope: "app",
+    },
+    IAC_GRANTS: {
+        gate: "H",
+        title: "No role grants in IaC",
+        severity: "block",
+        remediation: "remove the per-user grant map; grant roles from the Hub (App → Access → People)",
+        scope: "app",
+    },
+    PASSWORD_STORE: {
+        gate: "H",
+        title: "No app-side credentials",
+        severity: "block",
+        remediation: "delete the password code; the Hub creates sign-in users with a one-time temporary password",
+        scope: "app",
+    },
+    EMAIL_ALLOWLIST: {
+        gate: "H",
+        title: "No email allowlist for roles",
+        severity: "block",
+        remediation: "declare a role on the ZitadelAppIdentity and let the Hub grant it",
+        scope: "app",
+    },
+    USERS_TABLE: {
+        gate: "H",
+        title: "No hand-rolled users/roles table",
+        severity: "block",
+        remediation: "drop the table; people and roles live in Zitadel and are administered from the Hub",
+        scope: "app",
+    },
+};
+export const APP_CHECK_CODES = Object.keys(APP_CHECK_RULES);
+// ============================================================================
+// Filesystem helpers (pure over a root)
+// ============================================================================
+const SRC_EXT = new Set([".ts", ".tsx", ".js", ".mjs", ".jsx"]);
+const SKIP_DIRS = new Set(["node_modules", "dist", "build", ".generated", "test", "tests", "__tests__", "fixtures", "scripts"]);
+/** Directories under an app that are not services (docs, tooling, dev mocks, migrations). */
+const NON_SERVICE_DIRS = new Set([
+    "docs",
+    "scripts",
+    "lib",
+    "libs",
+    "migrations",
+    "test",
+    "tests",
+    "node_modules",
+    "infra",
+    "mocks",
+    "skills",
+    "prisma",
+]);
+function rel(root, abs) {
+    return path.relative(root, abs).split(path.sep).join("/");
+}
+function isDir(p) {
+    try {
+        return fs.statSync(p).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function readText(p) {
+    try {
+        return fs.readFileSync(p, "utf8");
+    }
+    catch {
+        return "";
+    }
+}
+/** Source files worth scanning: TS/JS minus tests, fixtures, generated output, tooling and dependencies. */
+export function srcFiles(dir) {
+    const out = [];
+    const walk = (d) => {
+        let entries;
+        try {
+            entries = fs.readdirSync(d, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            const p = path.join(d, e.name);
+            if (e.isDirectory()) {
+                if (SKIP_DIRS.has(e.name) || e.name.startsWith("scenario"))
+                    continue;
+                walk(p);
+                continue;
+            }
+            if (!e.isFile())
+                continue;
+            if (!SRC_EXT.has(path.extname(e.name)))
+                continue;
+            if (/\.(test|spec)\./.test(e.name) || /\.config\./.test(e.name) || e.name === "build.mjs")
+                continue;
+            out.push(p);
+        }
+    };
+    walk(dir);
+    return out.sort();
+}
+/** A `test-*` / `*-test` directory is a test harness (a browser fixture, a smoke client), not a deployed service. */
+function isTestHarness(name) {
+    return name.startsWith("test-") || name.endsWith("-test");
+}
+/** A service directory whose NAME says "browser UI". */
+export function isUiDir(name) {
+    return ["ui", "web", "frontend", "client", "portal-ui", "app"].includes(name) || name.endsWith("-ui");
+}
+/** Service directories of an app: every child dir that is not docs/tooling. */
+function serviceDirs(app) {
+    let entries;
+    try {
+        entries = fs.readdirSync(app, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    return entries
+        .filter((e) => e.isDirectory() && !NON_SERVICE_DIRS.has(e.name) && !e.name.startsWith(".") && !isTestHarness(e.name))
+        .map((e) => path.join(app, e.name))
+        .sort();
+}
+/**
+ * Grep-like scan of an app for the authorization gate: every `.ts/.tsx/.yaml/.sql`
+ * outside dependencies, build output and tests, with comment lines dropped —
+ * a comment is not a surface. Returns `path:line` + the line for each match.
+ */
+function authzSurface(app) {
+    const hits = [];
+    const walk = (d) => {
+        let entries;
+        try {
+            entries = fs.readdirSync(d, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            const p = path.join(d, e.name);
+            if (e.isDirectory()) {
+                if (["node_modules", "dist", "build"].includes(e.name))
+                    continue;
+                walk(p);
+                continue;
+            }
+            if (!e.isFile())
+                continue;
+            if (!/\.(ts|tsx|yaml|sql)$/.test(e.name) || /\.(test|spec)\.tsx?$/.test(e.name) || e.name.endsWith(".d.ts"))
+                continue;
+            const lines = readText(p).split("\n");
+            lines.forEach((text, i) => {
+                if (/^\s*(\/\/|\*|\/\*|#|--)/.test(text))
+                    return;
+                hits.push({ file: p, line: i + 1, text });
+            });
+        }
+    };
+    walk(app);
+    return hits;
+}
+// ============================================================================
+// Scanners
+// ============================================================================
+const RE_HTML = /from ["']hono\/(html|jsx)["']|react-dom\/server|\bc\.html\(|<!doctype html|<!DOCTYPE html/;
+const RE_OIDC = /openid-client|code_verifier|authorization_code|buildAuthorizeUrl|end_session/;
+const RE_COOKIE = /setCookie\(|hono\/cookie|Set-Cookie/;
+const RE_LOGGER = /from ["'](pino|hono\/logger|winston|bunyan)["']|require\(["'](pino|winston|bunyan)["']\)|^[^/*]*\bconsole\.(log|info|warn|error)\(/;
+const RE_EXPOSURE = /ZitadelAppIdentity|createOAuthMiddleware|createAuthorizationMiddleware|zitadelJwtScheme|createAuthzMiddleware|bearerAuth|type: *"oidc"|^\s+auth: *\{|_ROLES *= *\{|coarseRoles|ZITADEL_(AUDIENCE|CLIENT_ID)|OIDC_CLIENT_ID|zitadel\.(ApplicationOidc|ApplicationApi|Project|UserGrant)\(/;
+const RE_POINTER = /AppAuthzPointer/;
+const RE_METADATA = /compileOpsHubMetadata|ops-hub-metadata|SpiceDBSchema/;
+const RE_IAC_GRANT = /userId: *"[0-9]{6,}"/;
+const RE_PASSWORD = /(^|[^a-z])(bcrypt|argon2)|password_hash|passwordHash|hashPassword|temporaryPassword.*(send|mail)|(send|mail).*temporaryPassword/;
+const RE_ALLOWLIST = /ADMIN_EMAILS|ALLOWED_EMAILS|allowedEmails|adminEmails/;
+const RE_USERS_TABLE = /create table (if not exists )?"?(users|roles|user_roles|permissions)"?/i;
+/** Apps in a checkout: every `apps/<name>` with a Pulumi program, or the root when it is itself an app. */
+export function listApps(root) {
+    const apps = [];
+    const appsDir = path.join(root, "apps");
+    if (isDir(appsDir)) {
+        for (const e of fs.readdirSync(appsDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+            if (!e.isDirectory())
+                continue;
+            const d = path.join(appsDir, e.name);
+            if (fs.existsSync(path.join(d, "index.ts")) || fs.existsSync(path.join(d, "Pulumi.yaml")))
+                apps.push(rel(root, d));
+        }
+    }
+    if (fs.existsSync(path.join(root, "index.ts")) && fs.existsSync(path.join(root, "Pulumi.yaml")))
+        apps.push(".");
+    return apps;
+}
+/**
+ * Every app-scoped finding for one app (`appRel` is repo-relative). An app
+ * directory with no Pulumi program yields nothing — it is not an app.
+ */
+export function scanApp(root, appRel) {
+    const app = path.resolve(root, appRel);
+    const index = path.join(app, "index.ts");
+    const findings = [];
+    const hit = (code, p, why) => {
+        findings.push({ code, path: p, why });
+    };
+    const hasProgram = fs.existsSync(index) || fs.existsSync(path.join(app, "Pulumi.yaml"));
+    if (!hasProgram)
+        return findings;
+    // ── Check 0 (contract gates 0.1–0.4) need the Pulumi program ─────────────
+    if (fs.existsSync(index)) {
+        const indexRel = rel(root, index);
+        let servesHtml = false;
+        let hasUiService = false;
+        for (const svc of serviceDirs(app)) {
+            const svcName = path.basename(svc);
+            if (isUiDir(svcName)) {
+                hasUiService = true;
+                continue;
+            }
+            for (const f of srcFiles(svc)) {
+                let why = "";
+                if (/\.(tsx|jsx)$/.test(f))
+                    why = `JSX view file inside the ${svcName} service`;
+                else if (RE_HTML.test(readText(f)))
+                    why = `renders HTML inside the ${svcName} service`;
+                if (why) {
+                    servesHtml = true;
+                    hit("UI_IN_API", rel(root, f), `${why} — a browser UI is its own mesh.apps.Service (apps/<app>/ui)`);
+                }
+            }
+        }
+        if (servesHtml && !hasUiService) {
+            hit("NO_UI_SERVICE", indexRel, 'the app serves HTML but declares no ui/ service — add apps/<app>/ui + new mesh.apps.Service("ui", …)');
+        }
+        if (!/env\.register\(|\.annotate\(/.test(readText(index))) {
+            hit("NO_REGISTER", indexRel, "never calls env.register({…}) — the Hub cannot list this app");
+        }
+        for (const svc of serviceDirs(app)) {
+            for (const f of srcFiles(svc)) {
+                const text = readText(f);
+                if (RE_OIDC.test(text) && RE_COOKIE.test(text)) {
+                    hit("CUSTOM_SESSION_AUTH", rel(root, f), 'app-written OIDC + cookie session — protect the UI service with auth: { provider: "mesh" } instead');
+                }
+            }
+        }
+        for (const svc of serviceDirs(app)) {
+            for (const f of srcFiles(svc)) {
+                const lines = readText(f).split("\n");
+                const i = lines.findIndex((l) => RE_LOGGER.test(l) && !l.includes("mesh-tech/logger"));
+                if (i === -1)
+                    continue;
+                hit("NON_PLATFORM_LOGGER", `${rel(root, f)}:${i + 1}`, `logs outside @mesh-tech/logger (${lines[i]?.trim() ?? ""})`);
+            }
+        }
+    }
+    // ── Check H (authorization gate) ─────────────────────────────────────────
+    const surface = authzSurface(app);
+    const first = (re) => surface.find((h) => re.test(h.text));
+    const exposure = first(RE_EXPOSURE);
+    const pointer = first(RE_POINTER);
+    const metadata = first(RE_METADATA);
+    const appLabel = appRel === "." ? "(root)" : path.basename(appRel);
+    if (exposure && !pointer) {
+        const at = surface.find((h) => RE_EXPOSURE.test(h.text) && /(^|\/)index\.ts$/.test(h.file)) ?? exposure;
+        hit("NO_AUTHZ_POINTER", rel(root, at.file), `${appLabel} authenticates callers or declares roles but publishes no mesh.auth.AppAuthzPointer — the Hub's Access tab is blank for this app`);
+    }
+    else if (exposure && pointer && !metadata) {
+        hit("METADATA_UNPUBLISHED", rel(root, pointer.file), "AppAuthzPointer present but no compiled ops-hub metadata (compileOpsHubMetadata export or SpiceDBSchema) — the Hub's create-key and role catalog 409 METADATA_UNPUBLISHED");
+    }
+    const anti = (code, re, why) => {
+        const files = [...new Set(surface.filter((h) => re.test(h.text)).map((h) => h.file))].sort().slice(0, 3);
+        for (const f of files)
+            hit(code, rel(root, f), why);
+    };
+    anti("IAC_GRANTS", RE_IAC_GRANT, "per-user role grant baked into IaC — grants belong in the Hub (Access → People), not in a config redeploy");
+    anti("PASSWORD_STORE", RE_PASSWORD, "password storage or hashing — Zitadel owns credentials; the Hub creates sign-in users with a one-time temporary password");
+    anti("EMAIL_ALLOWLIST", RE_ALLOWLIST, "email allowlist standing in for roles — declare a role and let the Hub grant it");
+    anti("USERS_TABLE", RE_USERS_TABLE, "hand-rolled users/roles table — people and roles live in Zitadel and are administered from the Hub");
+    return findings;
+}
+/** True when `dir/package.json` names a `@mesh-tech/*` package (a checkout of the platform itself). */
+function isPlatformPackage(dir) {
+    try {
+        const pkg = JSON.parse(readText(path.join(dir, "package.json")));
+        return typeof pkg.name === "string" && pkg.name.startsWith("@mesh-tech/");
+    }
+    catch {
+        return false;
+    }
+}
+/** Repo-scoped findings: a tenant-local auth library that may duplicate `@mesh-tech/authn` (advisory). */
+export function scanRepo(root) {
+    const findings = [];
+    for (const parent of ["libs", "packages"]) {
+        const dir = path.join(root, parent);
+        if (!isDir(dir))
+            continue;
+        for (const e of fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+            if (!e.isDirectory() || !e.name.includes("auth"))
+                continue;
+            const lib = path.join(dir, e.name);
+            // The platform's own packages (`@mesh-tech/authn`, `@mesh-tech/authz`) are the
+            // canon, not a tenant-local copy of it — the rule is about duplicates.
+            if (isPlatformPackage(lib))
+                continue;
+            const verifies = srcFiles(lib)
+                .filter((f) => f.endsWith(".ts"))
+                .some((f) => /introspect|jwtVerify|createRemoteJWKSet|from ["']jose["']/.test(readText(f)));
+            if (verifies) {
+                findings.push({
+                    code: "LOCAL_AUTH_LIB",
+                    path: rel(root, lib),
+                    why: "tenant-local token verification — check whether @mesh-tech/authn already owns this",
+                });
+            }
+        }
+    }
+    return findings;
+}
+/** Turn a rule + its findings into the doctor-engine result shape. */
+export function resultFor(code, findings) {
+    const rule = APP_CHECK_RULES[code];
+    const mine = findings.filter((f) => f.code === code);
+    if (mine.length === 0)
+        return { status: "ok", summary: `gate ${rule.gate}: no ${code} finding` };
+    return {
+        status: rule.severity === "block" ? "error" : "warn",
+        summary: `gate ${rule.gate}: ${code} × ${mine.length}`,
+        detail: mine.map((f) => `${f.path} — ${f.why}`).join("\n    "),
+        remediation: rule.remediation,
+    };
+}
+/** The `Check`s for one scope: every app-scoped rule for an app, every repo-scoped rule for the repo. */
+export function appContractChecks(scope) {
+    return APP_CHECK_CODES.filter((code) => APP_CHECK_RULES[code].scope === scope).map((code) => ({
+        id: code,
+        title: `${APP_CHECK_RULES[code].title} (${APP_CHECK_RULES[code].gate})`,
+        phases: ["ondemand", "preflight"],
+        run: async (ctx) => resultFor(code, ctx.findings),
+    }));
+}
+/**
+ * Run the contract over a checkout. `apps` narrows the run to the named
+ * repo-relative app dirs (an unknown dir is an error, not a silent pass).
+ */
+export async function runAppCheck(root, apps) {
+    if (!isDir(root))
+        throw new MeshCliError(`no such checkout: ${root}`);
+    const targets = apps && apps.length > 0 ? apps.map((a) => a.replace(/\/+$/, "")) : listApps(root);
+    for (const a of targets) {
+        if (!isDir(path.resolve(root, a)))
+            throw new MeshCliError(`no such app dir: ${a}`);
+    }
+    const scopes = [];
+    for (const app of targets) {
+        const results = await runChecks({ root, app, findings: scanApp(root, app) }, "ondemand", appContractChecks("app"));
+        scopes.push({ scope: app, ...jsonReport(results) });
+    }
+    const repoResults = await runChecks({ root, app: null, findings: scanRepo(root) }, "ondemand", appContractChecks("repo"));
+    scopes.push({ scope: "(repo)", ...jsonReport(repoResults) });
+    return { root, status: aggregateStatus(scopes.map((s) => ({ status: s.status, summary: "" }))), scopes };
+}
+/** Human rendering: a header per scope, the doctor lines under it, failures only unless `verbose`. */
+export function renderReport(report, opts) {
+    const out = [];
+    for (const scope of report.scopes) {
+        const shown = opts.verbose ? scope.checks : scope.checks.filter((c) => c.status !== "ok");
+        if (shown.length === 0 && !opts.verbose)
+            continue;
+        out.push(`${ICONS[scope.status]} ${scope.scope}`);
+        out.push(renderHuman(shown.map((c) => ({
+            check: { id: c.id, title: `${c.id} — ${APP_CHECK_RULES[c.id]?.title ?? c.id}` },
+            result: { status: c.status, summary: c.summary, remediation: c.remediation ?? undefined, detail: c.detail ?? undefined },
+        })))
+            .split("\n")
+            .map((l) => `  ${l}`)
+            .join("\n"));
+    }
+    out.push(`${ICONS[report.status]} app contract: ${report.status}`);
+    return out.filter(Boolean).join("\n");
+}
+// ============================================================================
+// Command
+// ============================================================================
+export function registerAppCommands(program) {
+    const app = program.command("app").description("Inspect a tenant app against the Mesh app contract");
+    app
+        .command("check")
+        .description("Check tenant apps against the Mesh app contract (@mesh-tech/app-kit skills/apps/references/app-contract.md): a UI is its own service, the app registers with the Hub, sign-in goes through the platform proxy, logs go through @mesh-tech/logger, and people/roles/keys are surfaced through the Hub. Exit 1 on any blocking finding — the same gate mesh create-app, tenant CI and the platform reviewer run.")
+        .argument("[apps...]", "repo-relative app dirs to check (default: every apps/* with a Pulumi program)")
+        .option("--root <dir>", "checkout to scan (default: the enclosing git root)")
+        .option("--json", "machine-readable output (one report per app plus the repo-scoped checks)", false)
+        .option("--verbose", "also print the gates that passed", false)
+        .action(async (apps, opts) => {
+        const root = path.resolve(opts.root ?? resolveTargetRoot());
+        const report = await runAppCheck(root, apps);
+        if (opts.json) {
+            emitJsonPayload({ ok: report.status !== "error", ...report });
+        }
+        else {
+            if (report.scopes.length === 1)
+                logInfo(`no apps/* with a Pulumi program under ${root}`);
+            console.log(renderReport(report, { verbose: opts.verbose }));
+        }
+        if (report.status === "error") {
+            if (!opts.json)
+                logError("the app contract is not met — every ✗ above names the gate, the file and the replacement");
+            process.exitCode = 1;
+        }
+    });
+}
+//# sourceMappingURL=app-check.js.map

package/dist/src/commands/app-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-check.js","sourceRoot":"","sources":["../../../src/commands/app-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,KAAK,EACL,eAAe,EACf,UAAU,EACV,WAAW,EACX,SAAS,GAIV,MAAM,iBAAiB,CAAC;AAkCzB,MAAM,CAAC,MAAM,eAAe,GAAuC;IACjE,SAAS,EAAE;QACT,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,uBAAuB;QAC9B,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,kGAAkG;QAC/G,KAAK,EAAE,KAAK;KACb;IACD,aAAa,EAAE;QACb,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,qBAAqB;QAC5B,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,gEAAgE;QAC7E,KAAK,EAAE,KAAK;KACb;IACD,WAAW,EAAE;QACX,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,4BAA4B;QACnC,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,sEAAsE;QACnF,KAAK,EAAE,KAAK;KACb;IACD,mBAAmB,EAAE;QACnB,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,8BAA8B;QACrC,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,0FAA0F;QACvG,KAAK,EAAE,KAAK;KACb;IACD,mBAAmB,EAAE;QACnB,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,gCAAgC;QACvC,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,gGAAgG;QAC7G,KAAK,EAAE,KAAK;KACb;IACD,cAAc,EAAE;QACd,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,8BAA8B;QACrC,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,kGAAkG;QAC/G,KAAK,EAAE,MAAM;KACd;IACD,gBAAgB,EAAE;QAChB,IAAI,EAAE,GAAG;QACT,KAAK,EAAE,iCAAiC;QACxC,QAAQ,EAAE,OAAO;QACjB,WAAW,EACT,yHAAyH;QAC3H,KAAK,EAAE,KAAK;KACb;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,GAAG;QACT,KAAK,EAAE,4BAA4B;QACnC,QAAQ,EAAE,OAAO;QACjB,WAAW,EACT,gIAAgI;QAClI,KAAK,EAAE,KAAK;KACb;IACD,UAAU,EAAE;QACV,IAAI,EAAE,GAAG;QACT,KAAK,EAAE,uBAAuB;QAC9B,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,iFAAiF;QAC9F,KAAK,EAAE,KAAK;KACb;IACD,cAAc,EAAE;QACd,IAAI,EAAE,GAAG;QACT,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,4FAA4F;QACzG,KAAK,EAAE,KAAK;KACb;IACD,eAAe,EAAE;QACf,IAAI,EAAE,GAAG;QACT,KAAK,EAAE,8BAA8B;QACrC,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,mEAAmE;QAChF,KAAK,EAAE,KAAK;KACb;IACD,WAAW,EAAE;QACX,IAAI,EAAE,GAAG;QACT,KAAK,EAAE,kCAAkC;QACzC,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,oFAAoF;QACjG,KAAK,EAAE,KAAK;KACb;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAmB,CAAC;AAS9E,+EAA+E;AAC/E,wCAAwC;AACxC,+EAA+E;AAE/E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAChE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;AAChI,6FAA6F;AAC7F,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM;IACN,SAAS;IACT,KAAK;IACL,MAAM;IACN,YAAY;IACZ,MAAM;IACN,OAAO;IACP,cAAc;IACd,OAAO;IACP,OAAO;IACP,QAAQ;IACR,QAAQ;CACT,CAAC,CAAC;AAEH,SAAS,GAAG,CAAC,IAAY,EAAE,GAAW;IACpC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,KAAK,CAAC,CAAS;IACtB,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,CAAS,EAAQ,EAAE;QAC/B,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACpB,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;oBAAE,SAAS;gBACrE,IAAI,CAAC,CAAC,CAAC,CAAC;gBACR,SAAS;YACX,CAAC;YACD,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE;gBAAE,SAAS;YAC1B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjD,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW;gBAAE,SAAS;YACpG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,qHAAqH;AACrH,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACxG,CAAC;AAED,+EAA+E;AAC/E,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,OAAO;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SACpH,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;SAClC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,IAAI,GAAwD,EAAE,CAAC;IACrE,MAAM,IAAI,GAAG,CAAC,CAAS,EAAQ,EAAE;QAC/B,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACpB,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACjE,IAAI,CAAC,CAAC,CAAC,CAAC;gBACR,SAAS;YACX,CAAC;YACD,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE;gBAAE,SAAS;YAC1B,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,SAAS;YACtH,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACtC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;gBACxB,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO;gBACjD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,WAAW;AACX,+EAA+E;AAE/E,MAAM,OAAO,GAAG,2FAA2F,CAAC;AAC5G,MAAM,OAAO,GAAG,8EAA8E,CAAC;AAC/F,MAAM,SAAS,GAAG,qCAAqC,CAAC;AACxD,MAAM,SAAS,GACb,oIAAoI,CAAC;AAEvI,MAAM,WAAW,GACf,0RAA0R,CAAC;AAC7R,MAAM,UAAU,GAAG,iBAAiB,CAAC;AACrC,MAAM,WAAW,GAAG,sDAAsD,CAAC;AAC3E,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAC5C,MAAM,WAAW,GACf,iIAAiI,CAAC;AACpI,MAAM,YAAY,GAAG,uDAAuD,CAAC;AAC7E,MAAM,cAAc,GAAG,yEAAyE,CAAC;AAEjG,2GAA2G;AAC3G,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC9G,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;gBAAE,SAAS;YAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACrH,CAAC;IACH,CAAC;IACD,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,MAAc;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,IAAkB,EAAE,CAAS,EAAE,GAAW,EAAQ,EAAE;QAC/D,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC;IACxF,IAAI,CAAC,UAAU;QAAE,OAAO,QAAQ,CAAC;IAEjC,4EAA4E;IAC5E,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,YAAY,GAAG,KAAK,CAAC;QAEzB,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrB,YAAY,GAAG,IAAI,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;gBACb,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;oBAAE,GAAG,GAAG,4BAA4B,OAAO,UAAU,CAAC;qBAC3E,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;oBAAE,GAAG,GAAG,2BAA2B,OAAO,UAAU,CAAC;gBACvF,IAAI,GAAG,EAAE,CAAC;oBACR,UAAU,GAAG,IAAI,CAAC;oBAClB,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,8DAA8D,CAAC,CAAC;gBACvG,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;YAChC,GAAG,CAAC,eAAe,EAAE,QAAQ,EAAE,sGAAsG,CAAC,CAAC;QACzI,CAAC;QAED,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,aAAa,EAAE,QAAQ,EAAE,8DAA8D,CAAC,CAAC;QAC/F,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACzB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/C,GAAG,CAAC,qBAAqB,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,oGAAoG,CAAC,CAAC;gBACjJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACtC,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;gBACvF,IAAI,CAAC,KAAK,CAAC,CAAC;oBAAE,SAAS;gBACvB,GAAG,CAAC,qBAAqB,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,mCAAmC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACvH,CAAC;QACH,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEnE,IAAI,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,QAAQ,CAAC;QACxG,GAAG,CACD,kBAAkB,EAClB,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAClB,GAAG,QAAQ,kIAAkI,CAC9I,CAAC;IACJ,CAAC;SAAM,IAAI,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5C,GAAG,CACD,sBAAsB,EACtB,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EACvB,2KAA2K,CAC5K,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,IAAkB,EAAE,EAAU,EAAE,GAAW,EAAQ,EAAE;QACjE,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzG,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC,CAAC;IACF,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,2GAA2G,CAAC,CAAC;IAC9I,IAAI,CACF,gBAAgB,EAChB,WAAW,EACX,0HAA0H,CAC3H,CAAC;IACF,IAAI,CAAC,iBAAiB,EAAE,YAAY,EAAE,iFAAiF,CAAC,CAAC;IACzH,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,oGAAoG,CAAC,CAAC;IAE1I,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,uGAAuG;AACvG,SAAS,iBAAiB,CAAC,GAAW;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAsB,CAAC;QACtF,OAAO,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,SAAS;QAC1B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1G,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACnC,+EAA+E;YAC/E,uEAAuE;YACvE,IAAI,iBAAiB,CAAC,GAAG,CAAC;gBAAE,SAAS;YACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC;iBAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;iBAChC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,2DAA2D,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9F,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,gBAAgB;oBACtB,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC;oBACpB,GAAG,EAAE,oFAAoF;iBAC1F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAcD,sEAAsE;AACtE,MAAM,UAAU,SAAS,CAAC,IAAkB,EAAE,QAAmB;IAC/D,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACrD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,IAAI,CAAC,IAAI,QAAQ,IAAI,UAAU,EAAE,CAAC;IACjG,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;QACpD,OAAO,EAAE,QAAQ,IAAI,CAAC,IAAI,KAAK,IAAI,MAAM,IAAI,CAAC,MAAM,EAAE;QACtD,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC9D,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC;AACJ,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,iBAAiB,CAAC,KAAqB;IACrD,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5F,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG;QACvE,MAAM,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;QACjC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC;KAClD,CAAC,CAAC,CAAC;AACN,CAAC;AASD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,IAAe;IAC7D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,YAAY,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;QACnH,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1H,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;AAC3G,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,YAAY,CAAC,MAAsB,EAAE,IAA0B;IAC7E,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;QAC1F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,SAAS;QAClD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAClD,GAAG,CAAC,IAAI,CACN,WAAW,CACT,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChB,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,EAAE,MAAM,eAAe,CAAC,CAAC,CAAC,EAAkB,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;YAC/F,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,SAAS,EAAE;SACzH,CAAC,CAAC,CACJ;aACE,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;aACpB,IAAI,CAAC,IAAI,CAAC,CACd,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,oDAAoD,CAAC,CAAC;IAErG,GAAG;SACA,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CACV,gZAAgZ,CACjZ;SACA,QAAQ,CAAC,WAAW,EAAE,+EAA+E,CAAC;SACtG,MAAM,CAAC,cAAc,EAAE,oDAAoD,CAAC;SAC5E,MAAM,CAAC,QAAQ,EAAE,0EAA0E,EAAE,KAAK,CAAC;SACnG,MAAM,CAAC,WAAW,EAAE,kCAAkC,EAAE,KAAK,CAAC;SAC9D,MAAM,CAAC,KAAK,EAAE,IAAc,EAAE,IAAwD,EAAE,EAAE;QACzF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,iBAAiB,EAAE,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,eAAe,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,yCAAyC,IAAI,EAAE,CAAC,CAAC;YACzF,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,QAAQ,CAAC,0FAA0F,CAAC,CAAC;YACrH,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/create-app.d.ts

@@ -70,5 +70,29 @@ export declare function copyTemplate(srcDir: string, destDir: string, context: R
  * Resolve output directory for the app
  */
 export declare function resolveAppDir(cwd: string, tenant: string, name: string, test: boolean): string;
+/**
+ * Generate a composable app from fragments
+ */
+export declare function generateComposableApp(appDir: string, context: {
+    name: string;
+    tenant: string;
+    service: boolean;
+    database: boolean;
+    temporal: boolean;
+    bucket: boolean;
+    region: string;
+    /** True when scaffolding inside the mesh-platform monorepo → `@mesh-tech/*` = `workspace:*`. */
+    workspaceDeps: boolean;
+    /** Caret range for the lockstep `@mesh-tech/*` group (standalone repos only). */
+    meshRange: string;
+    /** Caret range for `@mesh-tech/esm-bundle`, which versions independently. */
+    esmBundleRange: string;
+    /** Literal toolchain devDep ranges for the standalone branch (no `catalog:`). */
+    typesNodeRange: string;
+    tsxRange: string;
+    typescriptRange: string;
+    /** Fully-resolved `mesh:deployerRole` ARN (or an `ACCOUNT_ID` placeholder). */
+    deployerRoleArn: string;
+}): void;
 export declare function registerCreateAppCommand(program: Command): void;
 //# sourceMappingURL=create-app.d.ts.map

package/dist/src/commands/create-app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-app.d.ts","sourceRoot":"","sources":["../../../src/commands/create-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAyDpC,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,kBAAkB,CAAC;AAEtD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAc7D;AAkBD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAQ5D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAwCvE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAiC/E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI/E;AAwFD;;GAEG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,IAAI,CAiCN;AAkBD;;GAEG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,GACZ,MAAM,CAkCR;AAgFD,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA8E/D"}
+{"version":3,"file":"create-app.d.ts","sourceRoot":"","sources":["../../../src/commands/create-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0DpC,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,kBAAkB,CAAC;AAEtD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAc7D;AAkBD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAQ5D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAwCvE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAiC/E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI/E;AAwFD;;GAEG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,IAAI,CAiCN;AAkBD;;GAEG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,GACZ,MAAM,CAkCR;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IACP,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,gGAAgG;IAChG,aAAa,EAAE,OAAO,CAAC;IACvB,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,cAAc,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,eAAe,EAAE,MAAM,CAAC;CACzB,GACA,IAAI,CAkDN;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA8E/D"}

package/dist/src/commands/create-app.js

@@ -16,6 +16,7 @@ import Handlebars from "handlebars";
 import { parse as parseYaml } from "yaml";
 import { logInfo, logSuccess, logError, logWarn } from "../utils/index.js";
 import { INTENT_RANGE, resolveTargetRoot, seedAppSkill, syncSkills } from "./skills.js";
+import { renderReport, runAppCheck } from "./app-check.js";
 import { findPackageRoot } from "./local/stack.js";
 import { SCAFFOLD_TOOLCHAIN, resolvePublishedRange } from "../utils/scaffold-versions.js";
 // Get package root by walking up until we find package.json with our package name.
@@ -368,7 +369,7 @@ export function resolveAppDir(cwd, tenant, name, test) {
 /**
  * Generate a composable app from fragments
  */
-function generateComposableApp(appDir, context) {
+export function generateComposableApp(appDir, context) {
     const fragmentsDir = path.join(packageRoot, "fragments");
     // 1. Always copy base fragment
     const baseDir = path.join(fragmentsDir, "base");
@@ -514,6 +515,7 @@ async function runLegacyTemplate(tenant, name, template, test) {
         process.exit(1);
     }
     autoSyncSkills(appDir, name);
+    await checkScaffoldContract(appDir);
     printLegacyNextSteps(appDir, template);
 }
 /** Best-effort skills sync after scaffolding (design D1): a fresh Claude
@@ -538,6 +540,29 @@ function autoSyncSkills(appDir, appName) {
         logWarn(`App skill stub skipped: ${err instanceof Error ? err.message : err}`);
     }
 }
+/**
+ * Run `mesh app check` on the app just scaffolded. A fresh scaffold satisfies
+ * the Mesh app contract by construction (the template test proves it), so a
+ * finding here is a platform defect, not the developer's: report it loudly and
+ * fail the command so it cannot be missed, but leave the files in place.
+ */
+async function checkScaffoldContract(appDir) {
+    const root = resolveTargetRoot(appDir);
+    const report = await runAppCheck(root, [path.relative(root, appDir) || "."]);
+    if (report.status === "ok") {
+        logSuccess("app contract: met (mesh app check)");
+        return;
+    }
+    console.log(renderReport(report, { verbose: false }));
+    if (report.status === "warn") {
+        logSuccess("app contract: met — the ⚠ lines above are advisories on the repo, not on this app (mesh app check)");
+        return;
+    }
+    if (report.status === "error") {
+        logError("the scaffold does not meet the Mesh app contract — this is a template defect; file a platform item and cite the ✗ lines above");
+        process.exitCode = 1;
+    }
+}
 async function runComposable(tenant, name, primitives, test) {
     logInfo(`Creating app '${name}' for tenant '${tenant}'...`);
     logInfo(`Primitives: ${primitives.join(", ")}`);
@@ -607,6 +632,7 @@ async function runComposable(tenant, name, primitives, test) {
         }
     }
     autoSyncSkills(appDir, name);
+    await checkScaffoldContract(appDir);
     printComposableNextSteps(appDir, context);
 }
 function printLegacyNextSteps(appDir, _template) {