@mesh-tech/mesh-cli 0.20.1 → 0.20.3

package/dist/src/commands/docs.d.ts

@@ -1,3 +1,2 @@
 import { Command } from "commander";
 export declare function registerDocsCommand(program: Command): void;
-//# sourceMappingURL=docs.d.ts.map

package/dist/src/commands/docs.js

@@ -122,15 +122,7 @@ async function buildDocs(configPathArg) {
     }
     logSuccess(`Docs build complete (${generatedSpecs.size} OpenAPI file${generatedSpecs.size === 1 ? "" : "s"})`);
 }
-/** Default location of the committed, reviewable CLI reference. */
 const CLI_REFERENCE_PATH = "docs/portal/generated/cli-reference.md";
-/**
- * Render the CLI reference markdown.
- *
- * `../program.js` is imported dynamically because it imports this module —
- * a static import would close the cycle. It also keeps the whole command tree
- * out of the module graph for every other `mesh` invocation.
- */
 async function renderCliReference() {
     const [{ createProgram }, { extractCliReference, renderCliReferenceMarkdown }] = await Promise.all([
         import("../program.js"),
@@ -138,7 +130,6 @@ async function renderCliReference() {
     ]);
     return renderCliReferenceMarkdown(extractCliReference(createProgram()));
 }
-/** Wrap an action so any thrown error becomes a one-line failure + exit 1. */
 function guarded(action) {
     return async () => {
         try {
@@ -241,8 +232,6 @@ export function registerDocsCommand(program) {
         const { runDocsStop } = await import("../docs/start.js");
         runDocsStop();
     })());
-    // Hidden: the tmux session re-enters through this. Not in the reference —
-    // cli-reference excludes hidden commands by design.
     docs
         .command("serve-static", { hidden: true })
         .option("--root <dir>", "built site root", "")
@@ -259,4 +248,3 @@ export function registerDocsCommand(program) {
         await runDocsList();
     })());
 }
-//# sourceMappingURL=docs.js.map

package/dist/src/commands/hub/index.d.ts

@@ -1,29 +1,5 @@
-/**
- * mesh hub dev — one-command local Hub over a running dev-local stack (MESH-2275).
- *
- * Launches the CURRENT-CODE Hub (apps/hub api + ui from a mesh-platform
- * checkout) pointed at an existing `mesh dev` session's stack, auto-assembling
- * the env that used to be hand-set (the FUB-demo runbook §6 recipe):
- *
- *   HUB_TENANT / HUB_SCOPE_ENV / HUB_SCOPE_TENANTS   from the session's platform context
- *   TEMPORAL_ADDRESS                                 from the session's tunnel (VPN or SSM)
- *   AWS_*                                            from the session's scratch credential_process profile
- *   DEV_USER_* / DEV_USER_TOKEN_URL                  from the session's injected dev identity +
- *                                                    per-session token-server (MESH-2039)
- *
- * The `mesh dev` session already resolved all of these — its tmux session
- * environment and state file (`$TMPDIR/mesh-dev-sessions/<name>.json`) are the
- * source of truth; this command only reads them and never mutates the app
- * session.
- *
- * Scoped-tenant enumeration is validated up front: HUB_SCOPE_ENV without a
- * non-empty HUB_SCOPE_TENANTS makes the Hub API silently return zero
- * registrations (apps/hub/api/src/lib/ssm/reader.ts), so that combination is
- * a loud error here, never an empty Hub.
- */
 import { Command } from "commander";
 import { type SessionState } from "../dev.js";
-/** tmux session the Hub runs in — fixed, one local Hub at a time. */
 export declare const HUB_SESSION = "mesh-hub-dev";
 export declare const DEFAULT_HUB_UI_PORT: number;
 export declare const DEFAULT_HUB_API_PORT = 3002;
@@ -32,28 +8,14 @@ export interface DiscoveredSession {
     state: SessionState;
 }
 export declare function devSessionsDir(): string;
-/** All persisted `mesh dev` session states (unparseable files skipped). */
 export declare function listDevSessions(dir?: string): DiscoveredSession[];
-/**
- * Pick the dev session to point the Hub at.
- *
- *   1. --session <name> wins (error if its state file is missing).
- *   2. The session whose appRoot equals the cwd's app root (both sides come
- *      from findAppRoot, so exact equality is the right comparison).
- *   3. A sole running session.
- *
- * Ambiguity (multiple sessions, none matching cwd) is an error listing the
- * candidates — never a silent guess.
- */
 export declare function pickDevSession(sessions: DiscoveredSession[], opts: {
     session?: string;
     cwdAppRoot?: string | null;
 }): DiscoveredSession;
-/** Parse `tmux show-environment` output (`KEY=value` lines; `-KEY` = unset). */
 export declare function parseTmuxEnv(output: string): Record<string, string>;
 export declare function forwardedSessionVars(sessionEnv: Record<string, string>): Record<string, string>;
 export interface HubDevEnvOptions {
-    /** Comma-separated tenant override (--tenants). */
     tenants?: string;
     uiPort: number;
     apiPort: number;
@@ -61,7 +23,6 @@ export interface HubDevEnvOptions {
 export interface AssembledHubEnv {
     apiEnv: Record<string, string>;
     uiEnv: Record<string, string>;
-    /** Human-readable scope summary for the launch banner. */
     scope: {
         hubTenant: string;
         scopeEnv: string;
@@ -69,31 +30,10 @@ export interface AssembledHubEnv {
     };
     temporalAddress: string;
     warnings: string[];
-    /** Informational — things the command is handling itself, not user problems. */
     notes: string[];
 }
-/**
- * Assemble the Hub api/ui env from a discovered dev session. Throws loudly on
- * the combinations that today produce a silently-empty Hub.
- */
 export declare function assembleHubEnv(session: DiscoveredSession, sessionEnv: Record<string, string>, opts: HubDevEnvOptions): AssembledHubEnv;
-/**
- * Locate the mesh-platform checkout the Hub runs from:
- * --platform-dir → $MESH_PLATFORM_DIR → walk up from cwd (monorepo case).
- *
- * An invalid `--platform-dir` is fatal (the user named it explicitly), but a
- * stale `MESH_PLATFORM_DIR` left over in the shell only warns and falls through
- * to the cwd walk-up — otherwise it would hard-fail runs made from inside a
- * perfectly good checkout.
- */
 export declare function resolvePlatformDir(explicit: string | undefined, cwd: string, env?: Record<string, string | undefined>): string;
-/**
- * Parse a port option, naming its source in the error. Without this a typo'd
- * `--port` (or a stale non-numeric `MESH_HUB_DEV_PORT` left in the shell) becomes
- * `NaN`, lands in the env file as `PORT=NaN`, and reaches `net.connect` — which
- * throws a raw `ERR_SOCKET_BAD_PORT` instead of an actionable CLI error.
- */
 export declare function parsePort(raw: string | undefined, fallback: number, source: string): number;
 export declare function redactEnv(env: Record<string, string>): Record<string, string>;
 export declare function registerHubCommands(program: Command): void;
-//# sourceMappingURL=index.d.ts.map

package/dist/src/commands/hub/index.js

@@ -1,26 +1,3 @@
-/**
- * mesh hub dev — one-command local Hub over a running dev-local stack (MESH-2275).
- *
- * Launches the CURRENT-CODE Hub (apps/hub api + ui from a mesh-platform
- * checkout) pointed at an existing `mesh dev` session's stack, auto-assembling
- * the env that used to be hand-set (the FUB-demo runbook §6 recipe):
- *
- *   HUB_TENANT / HUB_SCOPE_ENV / HUB_SCOPE_TENANTS   from the session's platform context
- *   TEMPORAL_ADDRESS                                 from the session's tunnel (VPN or SSM)
- *   AWS_*                                            from the session's scratch credential_process profile
- *   DEV_USER_* / DEV_USER_TOKEN_URL                  from the session's injected dev identity +
- *                                                    per-session token-server (MESH-2039)
- *
- * The `mesh dev` session already resolved all of these — its tmux session
- * environment and state file (`$TMPDIR/mesh-dev-sessions/<name>.json`) are the
- * source of truth; this command only reads them and never mutates the app
- * session.
- *
- * Scoped-tenant enumeration is validated up front: HUB_SCOPE_ENV without a
- * non-empty HUB_SCOPE_TENANTS makes the Hub API silently return zero
- * registrations (apps/hub/api/src/lib/ssm/reader.ts), so that combination is
- * a loud error here, never an empty Hub.
- */
 import { execFileSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as net from "node:net";
@@ -33,19 +10,12 @@ import { MeshCliError } from "../../utils/errors.js";
 import { DEFAULT_HUB_PORT } from "../local/stack.js";
 import { logInfo, logSuccess, logWarn } from "../../utils/log.js";
 import { findAppRoot } from "../../utils/pulumi.js";
-/** tmux session the Hub runs in — fixed, one local Hub at a time. */
 export const HUB_SESSION = "mesh-hub-dev";
-// Same default as the containerized Hub (local/stack.ts DEFAULT_HUB_PORT),
-// but a SEPARATE override variable: MESH_HUB_PORT moves the containerized
-// Hub's published port, MESH_HUB_DEV_PORT moves this dev-server Hub. The two
-// are built to run side by side — one shared variable would make "move the
-// containerized Hub off 9000" also move the dev server onto the same port.
 export const DEFAULT_HUB_UI_PORT = Number(DEFAULT_HUB_PORT);
 export const DEFAULT_HUB_API_PORT = 3002;
 export function devSessionsDir() {
     return path.join(os.tmpdir(), "mesh-dev-sessions");
 }
-/** All persisted `mesh dev` session states (unparseable files skipped). */
 export function listDevSessions(dir = devSessionsDir()) {
     if (!fs.existsSync(dir))
         return [];
@@ -60,22 +30,10 @@ export function listDevSessions(dir = devSessionsDir()) {
             }
         }
         catch {
-            // stale/corrupt state file — not a candidate
         }
     }
     return sessions;
 }
-/**
- * Pick the dev session to point the Hub at.
- *
- *   1. --session <name> wins (error if its state file is missing).
- *   2. The session whose appRoot equals the cwd's app root (both sides come
- *      from findAppRoot, so exact equality is the right comparison).
- *   3. A sole running session.
- *
- * Ambiguity (multiple sessions, none matching cwd) is an error listing the
- * candidates — never a silent guess.
- */
 export function pickDevSession(sessions, opts) {
     if (opts.session) {
         const match = sessions.find((s) => s.name === opts.session);
@@ -99,8 +57,6 @@ export function pickDevSession(sessions, opts) {
         .map((s) => `${s.name} (${s.state.appRoot})`)
         .join(", ")}`, { remediation: { command: "mesh hub dev --session <name>" } });
 }
-// ── tmux session env ─────────────────────────────────────────────────────────
-/** Parse `tmux show-environment` output (`KEY=value` lines; `-KEY` = unset). */
 export function parseTmuxEnv(output) {
     const env = {};
     for (const line of output.split("\n")) {
@@ -134,8 +90,6 @@ function tmuxSessionExists(sessionName) {
         return false;
     }
 }
-// ── env assembly ─────────────────────────────────────────────────────────────
-/** Vars carried over verbatim from the dev session's tmux environment. */
 const FORWARD_PREFIXES = ["AWS_", "DEV_USER_"];
 export function forwardedSessionVars(sessionEnv) {
     const out = {};
@@ -145,10 +99,6 @@ export function forwardedSessionVars(sessionEnv) {
     }
     return out;
 }
-/**
- * Assemble the Hub api/ui env from a discovered dev session. Throws loudly on
- * the combinations that today produce a silently-empty Hub.
- */
 export function assembleHubEnv(session, sessionEnv, opts) {
     const warnings = [];
     const notes = [];
@@ -158,9 +108,6 @@ export function assembleHubEnv(session, sessionEnv, opts) {
     }
     const isLocalPlatform = platform.tenant === "local";
     if (isLocalPlatform) {
-        // Supported, and deliberately so: `mesh start`'s own Hub is built from the
-        // PUBLISHED tarball, so it is the one place a Hub change cannot be tried
-        // before it ships. The backing services come from `localPlatformEnv` below.
         notes.push("Local platform session — the Hub runs from this checkout against `mesh start`. " +
             "Its containerized Hub keeps :9000, so pass --port/--api-port to run both.");
     }
@@ -171,9 +118,6 @@ export function assembleHubEnv(session, sessionEnv, opts) {
         .map((t) => t.trim())
         .filter(Boolean);
     if (scopeTenants.length === 0) {
-        // The Hub API's scoped SSM reader returns [] with no error when
-        // HUB_SCOPE_ENV is set and HUB_SCOPE_TENANTS is empty — every page renders
-        // blank with nothing in the logs. Refuse to launch into that state.
         throw new MeshCliError("Tenant scope resolved EMPTY (HUB_SCOPE_ENV set, no HUB_SCOPE_TENANTS) — the Hub would launch but show zero tenants everywhere.", { remediation: { command: "mesh hub dev --tenants <tenant>[,<tenant>…]" } });
     }
     const forwarded = forwardedSessionVars(sessionEnv);
@@ -185,16 +129,12 @@ export function assembleHubEnv(session, sessionEnv, opts) {
             `${scopeEnv}\` and relaunch \`mesh dev\`.`);
     }
     if (!forwarded.DEV_USER_TOKEN_URL) {
-        // Not a warning: the launch path starts a dedicated token-server for this
-        // case, so telling the user to restart `mesh dev` would contradict the
-        // `✔ Dev-user token-server: …` line printed moments later.
-        notes.push("Dev session predates the per-session token-server (MESH-2039) — starting a dedicated one so tokens stay fresh past ~1h.");
+        notes.push("Dev session predates the per-session token-server — starting a dedicated one so tokens stay fresh past ~1h.");
     }
     const temporalAddress = sessionEnv.TEMPORAL_ADDRESS ??
         (session.state.devOutput.tunnels["temporal"]
             ? tunnelClientAddress(session.state.devOutput.tunnels["temporal"])
-            : // The local platform runs Temporal as a published container, so there is
-                // no tunnel to record and none to demand — the address is fixed.
+            :
                 isLocalPlatform
                     ? "localhost:7233"
                     : undefined);
@@ -215,33 +155,13 @@ export function assembleHubEnv(session, sessionEnv, opts) {
         PORT: String(opts.uiPort),
         API_URL: `http://localhost:${opts.apiPort}`,
         HUB_TENANT: hubTenant,
-        // UI namespace parsing + session defaults land on the scoped tenant.
         DEFAULT_ORG: scopeTenants[0],
         DEFAULT_ENV: scopeEnv,
     };
     return { apiEnv, uiEnv, scope: { hubTenant, scopeEnv, scopeTenants }, temporalAddress, warnings, notes };
 }
-/**
- * The backing services a Hub needs when the dev session targets `mesh start`.
- *
- * A tethered session forwards these from the deployed stack, but a local one
- * cannot: the platform is a set of containers whose addresses only exist on
- * this machine. Without them the Hub comes up able to VERIFY a token and unable
- * to write anything — no ops database, so no API-key rows, and no Zitadel admin
- * key, so no machine user to attach a key to. The console renders with the
- * create affordances simply absent, which reads as a broken feature rather than
- * an unprovisioned one.
- *
- * The values mirror `stack/docker-compose.hub.yml`, translated from compose
- * service names to the ports that compose publishes on the host — `mesh hub dev`
- * runs the Hub as a host process, not inside the stack's network.
- */
 const localPlatformEnv = (sessionEnv) => ({
-    // The issuer the local `mesh login` tokens carry. Zitadel routes by Host
-    // header, so the host must stay `localhost` on both sides of the call.
     ZITADEL_ISSUER: sessionEnv.ZITADEL_ISSUER ?? "http://localhost:8080",
-    // Postgres publishes on 5433; the Hub's ops schema lives in the `hub` database
-    // alongside the per-app ones.
     OPS_DB_HOST: "localhost",
     OPS_DB_PORT: "5433",
     OPS_DB_NAME: "hub",
@@ -249,9 +169,6 @@ const localPlatformEnv = (sessionEnv) => ({
     DATABASE_PASSWORD: "postgres",
     PGSSLMODE: "disable",
     DATABASE_URL: "postgres://postgres:postgres@localhost:5433/hub?sslmode=disable",
-    // The Hub's ADMIN plane. `mesh start` seeds the machine key this names, in the
-    // platform org with IAM_OWNER, so the Hub can administer each app tenant's own
-    // Zitadel org rather than only its own.
     ZITADEL_OPSHUB_SECRET_NAME: "mesh/local/dev/zitadel/ops-hub",
     SPICEDB_ENDPOINT: "localhost:50051",
     SPICEDB_HTTP_ENDPOINT: "http://localhost:8443",
@@ -261,30 +178,13 @@ const localPlatformEnv = (sessionEnv) => ({
     TEMPO_URL: "http://localhost:3200",
     PROMETHEUS_URL: "http://localhost:9090",
     TEMPORAL_UI_URL: "http://localhost:8233",
-    // The stack's namespace. Absent, the Hub's compliance schedules fail to
-    // register with "Temporal namespace is required".
     TEMPORAL_NAMESPACE: "local-dev",
-    // Dagster discovery records written by `mesh dev --local` carry
-    // `host.docker.internal` (for the containerized `mesh start` hub). This hub
-    // runs on the host, where that name does not resolve — tell the Data
-    // section's resolver to swap it for localhost.
     MESH_DAGSTER_LOCAL_HOST: "localhost",
 });
-// ── platform checkout resolution ────────────────────────────────────────────
-/** Does `dir` look like a mesh-platform checkout root (has the Hub app)? */
 function isPlatformRoot(dir) {
     return (fs.existsSync(path.join(dir, "apps", "hub", "api", "package.json")) &&
         fs.existsSync(path.join(dir, "apps", "hub", "ui", "package.json")));
 }
-/**
- * Locate the mesh-platform checkout the Hub runs from:
- * --platform-dir → $MESH_PLATFORM_DIR → walk up from cwd (monorepo case).
- *
- * An invalid `--platform-dir` is fatal (the user named it explicitly), but a
- * stale `MESH_PLATFORM_DIR` left over in the shell only warns and falls through
- * to the cwd walk-up — otherwise it would hard-fail runs made from inside a
- * perfectly good checkout.
- */
 export function resolvePlatformDir(explicit, cwd, env = process.env) {
     if (explicit) {
         const resolved = path.resolve(explicit);
@@ -313,7 +213,6 @@ export function resolvePlatformDir(explicit, cwd, env = process.env) {
         },
     });
 }
-// ── token server ─────────────────────────────────────────────────────────────
 async function findFreePort() {
     return new Promise((resolve, reject) => {
         const server = net.createServer();
@@ -337,17 +236,9 @@ function isPortListening(port) {
         socket.once("error", () => done(false));
     });
 }
-// ── env file dir ─────────────────────────────────────────────────────────────
 function hubEnvDir() {
     return path.join(os.tmpdir(), "mesh-dev-sessions", HUB_SESSION);
 }
-// ── port parsing ─────────────────────────────────────────────────────────────
-/**
- * Parse a port option, naming its source in the error. Without this a typo'd
- * `--port` (or a stale non-numeric `MESH_HUB_DEV_PORT` left in the shell) becomes
- * `NaN`, lands in the env file as `PORT=NaN`, and reaches `net.connect` — which
- * throws a raw `ERR_SOCKET_BAD_PORT` instead of an actionable CLI error.
- */
 export function parsePort(raw, fallback, source) {
     if (raw === undefined)
         return fallback;
@@ -359,12 +250,10 @@ export function parsePort(raw, fallback, source) {
     }
     return n;
 }
-// ── redaction for --print-env ────────────────────────────────────────────────
 const SENSITIVE_RE = /TOKEN|SECRET|KEY|PASSWORD/i;
 export function redactEnv(env) {
     const out = {};
     for (const [key, value] of Object.entries(env)) {
-        // URLs named *_TOKEN_URL etc. are locators, not credentials.
         const sensitive = SENSITIVE_RE.test(key) && !key.endsWith("_URL") && !key.endsWith("_FILE");
         out[key] = sensitive ? `<redacted ${value.length} chars>` : value;
     }
@@ -386,16 +275,13 @@ async function hubDevAction(opts) {
         ? parsePort(opts.port, DEFAULT_HUB_UI_PORT, "--port")
         : parsePort(process.env.MESH_HUB_DEV_PORT, DEFAULT_HUB_UI_PORT, "MESH_HUB_DEV_PORT");
     const apiPort = parsePort(opts.apiPort, DEFAULT_HUB_API_PORT, "--api-port");
-    // 1. The Hub's source.
     const platformDir = resolvePlatformDir(opts.platformDir, process.cwd());
-    // 2. The dev-local stack session to observe.
     const cwdAppRoot = findAppRoot(process.cwd());
     const session = pickDevSession(listDevSessions(), { session: opts.session, cwdAppRoot });
     if (!tmuxSessionExists(session.name)) {
         throw new MeshCliError(`Dev session '${session.name}' has a state file but no live tmux session — its tunnels and token-server are gone.`, { remediation: { command: `mesh dev  # from ${session.state.appRoot}` } });
     }
     const sessionEnv = readTmuxSessionEnv(session.name);
-    // 3. Assemble the env (loud failures instead of a silently-empty Hub).
     const assembled = assembleHubEnv(session, sessionEnv, { tenants: opts.tenants, uiPort, apiPort });
     if (opts.printEnv) {
         console.log(chalk.bold("\nhub-api env:"));
@@ -411,13 +297,6 @@ async function hubDevAction(opts) {
             remediation: { command: "mesh hub dev --kill   # then re-run mesh hub dev" },
         });
     }
-    // Pre-flight the ports. Without this, a port already owned by ANOTHER Hub
-    // (the containerized `mesh start` one is fixed at :9000, or a plain
-    // `mesh dev` from apps/hub holds :3002) makes the post-launch waitForPort
-    // succeed against that other process: vite has no strictPort in its config
-    // so the UI silently falls forward to the next free port, and we would then
-    // print "Hub → http://localhost:9000" pointing at someone else's Hub — the
-    // exact silently-wrong-Hub failure this command exists to remove.
     for (const [label, port, flag] of [
         ["API", apiPort, "--api-port"],
         ["UI", uiPort, "--port"],
@@ -437,9 +316,6 @@ async function hubDevAction(opts) {
     const apiDir = path.join(platformDir, "apps", "hub", "api");
     const uiDir = path.join(platformDir, "apps", "hub", "ui");
     execFileSync("tmux", ["new-session", "-d", "-s", HUB_SESSION, "-n", "api", "-c", apiDir]);
-    // Fresh dev tokens: reuse the app session's token-server when it has one;
-    // otherwise run our own (MESH-2039 pattern) so the Hub survives past the
-    // ~1h Zitadel horizon either way.
     if (!assembled.apiEnv.DEV_USER_TOKEN_URL && assembled.apiEnv.DEV_USER_ID_TOKEN) {
         const platform = session.state.devOutput.platform;
         const credContext = `mesh.${platform.env}`;
@@ -475,18 +351,6 @@ async function hubDevAction(opts) {
         execFileSync("tmux", ["send-keys", "-t", `${HUB_SESSION}:${window}`, buildLaunchCommand(envFile, dir, cmd), "Enter"]);
     };
     launch("api", apiDir, assembled.apiEnv, "pnpm dev", false);
-    // --strictPort: the Hub UI's vite config sets `port` but NOT `strictPort`, so
-    // vite would silently fall forward to the next free port and we'd advertise a
-    // URL serving something else. Fail instead — the pre-flight above already
-    // rejects a taken port, this closes the race. (`host: true` is already in
-    // apps/hub/ui/vite.config.ts, so the tailnet binding needs no flag here.)
-    //
-    // No `--` separator before the flags: the script is `react-router dev`, whose
-    // first positional is the PROJECT DIRECTORY. `pnpm dev -- --port …` forwards
-    // the separator, react-router reads `--` as that directory, looks for a vite
-    // config inside it, finds none, and exits with "React Router Vite plugin not
-    // found in Vite config" — a message that points at the config rather than at
-    // the argument that caused it. pnpm passes trailing args through regardless.
     launch("ui", uiDir, assembled.uiEnv, `pnpm dev --port ${uiPort} --strictPort`, true);
     logInfo("Waiting for the Hub to come up…");
     const apiUp = await waitForPort("127.0.0.1", apiPort, 90_000);
@@ -515,4 +379,3 @@ export function registerHubCommands(program) {
         .option("--kill", "tear down the running Hub session")
         .action(hubDevAction);
 }
-//# sourceMappingURL=index.js.map

package/dist/src/commands/init/wizard.d.ts

@@ -1,103 +1,56 @@
-/**
- * Bare `mesh init` — the guided setup of a machine and a repo for one tenant.
- *
- * Four questions and four steps, in order:
- *
- *   1. tenant   — which tenant this repo belongs to
- *   2. mode     — local only (`mesh start` / `mesh dev`) or a deployed platform
- *   3. registry — package-registry access, signing in if the machine has none
- *   4. platform — (deployed only) `mesh login <tenant>.<env>` in-process
- *   5. repo     — bootstrap an empty apps repo, or check an existing one
- *   6. skills   — the agent skills the repo's packages ship
- *
- * Two identities never mix: the registry step talks to the ONE global package
- * registry and never needs a context; the platform step is the only place a
- * `<tenant>.<env>` context appears, and the local branch never mentions it.
- *
- * Every step is data (`WizardStep` → `StepResult`) so the summary, the exit
- * code and the `--json` document are one reducer over one list, and a step
- * that fails without blocking (a registry 403 — the user needs the summary to
- * know whom to ask) lets the rest run. Every prompt has a flag, so a runner
- * with `--tenant … --local --yes` sees no prompt at all.
- */
 import { probeRegistryToken } from "../../utils/auth-preflight.js";
 import { type RegistryLoginOptions } from "../registry.js";
 import { type MeshJson } from "../../utils/mesh-json.js";
-/** The flags — one per wizard answer, so a headless run needs no prompt. */
 export interface WizardOptions {
     tenant?: string;
-    /** Local only: `mesh start` / `mesh dev`, no deployed platform. */
     local?: boolean;
-    /** A deployed platform's environment (`dev`, `uat`, …) → context `<tenant>.<env>`. */
     platform?: string;
-    /** Device-code sign-in for the registry and platform steps (headless / SSH). */
     device?: boolean;
-    /** Deployers only: an AWS profile that can read the registry (skips the broker). */
     profile?: string;
-    /** Do not touch the repo (no bootstrap, no doctor, no skills). */
     skipRepo?: boolean;
-    /** Accept every default and never prompt. */
     yes?: boolean;
-    /** One JSON document on stdout; human output on stderr. */
     json?: boolean;
 }
 export type StepStatus = "pass" | "fail" | "warn" | "skip";
-/** One step's verdict — what the summary, the exit code and `--json` all read. */
 export interface StepResult {
     name: string;
     status: StepStatus;
     detail: string;
-    /** The exact command (or, for a grant, the person to ask) that fixes it. */
     fix?: string;
-    /** `false` = a failure the wizard carries on past (a registry 403). */
     blocking?: boolean;
 }
-/** Where the tenant runs. */
 export type WizardMode = "local" | {
     platform: string;
 };
-/** The wizard's answers, shared by every step. */
 export interface WizardCtx {
     cwd: string;
     tenant: string;
     mode: WizardMode;
-    /** The `<tenant>.<env>` context — only in deployed mode. */
     context: string | null;
     device?: boolean;
     profile?: string;
-    /** True when a prompt or a browser can be used on this run. */
     interactive: boolean;
-    /**
-     * True when no browser can open here (SSH, a container, no TTY), so the
-     * device code is the sign-in that works and every remediation names it.
-     */
     remote: boolean;
     yes: boolean;
     skipRepo: boolean;
     prompts: Prompts;
-    /** Test seams for the steps' side effects; production leaves them unset. */
     seams?: WizardSeams;
 }
-/** The impure calls a step makes, injectable so the real steps run under test. */
 export interface WizardSeams {
-    /** The `~/.npmrc` token probe — defaults to `probeRegistryToken`. */
     probe?: typeof probeRegistryToken;
-    /** The in-process registry login — defaults to `runRegistryLogin(undefined, opts)`. */
     runRegistryLogin?: (opts: RegistryLoginOptions) => Promise<void>;
+    gitInit?: (dir: string) => void;
 }
-/** A step: a name and a runner. */
 export interface WizardStep {
     name: "registry" | "platform" | "repo" | "skills";
     run(ctx: WizardCtx): Promise<StepResult>;
 }
-/** The final document — rendered for a terminal or emitted as `--json`. */
 export interface WizardOutcome {
     tenant: string;
     mode: WizardMode;
     steps: StepResult[];
     next: string[];
 }
-/** The prompt surface, injectable so the flow is testable without a TTY. */
 export interface Prompts {
     input(args: {
         message: string;
@@ -117,94 +70,31 @@ export interface Prompts {
         default?: boolean;
     }): Promise<boolean>;
 }
-/** Printed when the registry step has no session and no way to sign in. */
 export declare const NO_SESSION_NO_TTY_MESSAGE: string;
-/** Printed when a non-TTY run has no `--tenant`. */
 export declare const TENANT_REQUIRED_MESSAGE = "--tenant is required (no TTY for interactive mode)";
-/** Exit code for a Ctrl-C at a prompt: nothing half-written, conventional SIGINT code. */
 export declare const INTERRUPTED_EXIT_CODE = 130;
-/**
- * The exit code for a finished run: 1 when any step failed (blocking or not
- * — a registry 403 still means the machine is not set up), else 0.
- *
- * @example
- * wizardExitCode([{ name: "Registry access", status: "fail", detail: "…", blocking: false }]); // → 1
- */
 export declare function wizardExitCode(steps: ReadonlyArray<Pick<StepResult, "status">>): number;
-/**
- * The commands to run next, by mode.
- *
- * @example
- * wizardNextCommands({ platform: "dev" }); // → ["mesh create-app", "mesh deploy up   # from the app directory"]
- */
-export declare function wizardNextCommands(mode: WizardMode): string[];
-/**
- * Whether the wizard should stop after `result`: a failing step that did not
- * opt out of blocking.
- */
+export declare function wizardNextCommands(mode: WizardMode, steps?: ReadonlyArray<StepResult>): string[];
 export declare function stepBlocks(result: StepResult): boolean;
-/** The mode as a short phrase for the summary heading. */
 export declare function describeMode(mode: WizardMode): string;
-/**
- * Render the summary check-list — the same lines for a terminal and for the
- * stderr side of `--json`.
- *
- * @example
- * renderWizardSummary({ tenant: "acme", mode: "local", steps: [], next: ["mesh create-app"] });
- */
 export declare function renderWizardSummary(outcome: WizardOutcome, opts?: {
     color?: boolean;
 }): string;
-/**
- * Resolve the answers that need no prompt: flags first, then `--yes`
- * defaults, then what the repo already records. Returns the questions still
- * open so the caller prompts for exactly those.
- *
- * @example
- * resolveAnswers({ tenant: "acme", local: true }, null, false)
- * // → { tenant: "acme", mode: "local", open: [] }
- */
 export declare function resolveAnswers(opts: WizardOptions, recorded: MeshJson | null, interactive: boolean): {
     tenant?: string;
     mode?: WizardMode;
     open: Array<"tenant" | "mode">;
 };
-/** The registry step, exported so a test can drive the real thing through its seams. */
 export declare const registryStep: WizardStep;
-/** What kind of directory the wizard is standing in. */
-export type RepoKind = "platform-monorepo" | "empty-apps-repo" | "apps-repo" | "other-repo" | "no-repo";
-/**
- * Classify `cwd` for the repo step. Pure over the filesystem; exported for
- * tests.
- *
- * @example
- * classifyRepo("/tmp/empty-git-clone"); // → "empty-apps-repo"
- */
+export type RepoKind = "platform-monorepo" | "empty-apps-repo" | "apps-repo" | "other-repo" | "empty-dir" | "no-repo";
 export declare function classifyRepo(cwd: string): {
     kind: RepoKind;
     root: string;
 };
-/** The steps in run order. Exported so tests can drive the reducer with fakes. */
+export declare const INIT_REPO_FIX = "git init && mesh init";
+export declare const repoStep: WizardStep;
 export declare const WIZARD_STEPS: readonly WizardStep[];
-/**
- * Run `steps` in order, stopping after the first blocking failure. Pure over
- * the steps' results — the reducer the CLI and the tests share.
- *
- * @example
- * const steps = await runWizardSteps(ctx, WIZARD_STEPS);
- */
 export declare function runWizardSteps(ctx: WizardCtx, steps: readonly WizardStep[]): Promise<StepResult[]>;
-/**
- * The wizard entry point behind bare `mesh init`.
- *
- * Returns the process exit code instead of exiting, so the caller decides
- * (and a test can assert on it). Ctrl-C at a prompt returns 130 with nothing
- * written. All human output goes to stderr under `--json`, leaving stdout for
- * the one document.
- *
- * @example
- * process.exitCode = await runInitWizard({ tenant: "acme", local: true, yes: true });
- */
 export declare function runInitWizard(opts: WizardOptions, deps?: {
     cwd?: string;
     prompts?: Prompts;
@@ -213,4 +103,3 @@ export declare function runInitWizard(opts: WizardOptions, deps?: {
     remote?: boolean;
     seams?: WizardSeams;
 }): Promise<number>;
-//# sourceMappingURL=wizard.d.ts.map