@mesh-tech/mesh-cli 0.24.1 → 0.26.0

package/dist/src/commands/init/platform-setup.js

@@ -0,0 +1,203 @@
+import * as fs from "fs";
+import * as path from "path";
+import { execFileSync } from "child_process";
+import { MeshCliError } from "../../utils/errors.js";
+export const PLATFORM_SETUP_DEFAULTS = {
+    env: "dev",
+    region: "us-east-2",
+    profile: "default",
+};
+export const DOMAIN_REQUIRED_MESSAGE = "--domain is required: the core stack creates the public Route 53 zone <env>.<domain>, " +
+    "and a placeholder domain scaffolds a zone that can never validate (the deploy stalls on the ACM certificate).";
+export function defaultStateBucket(tenant) {
+    return `${tenant}-mesh-platform-pulumi-state`;
+}
+export function defaultPlatformDir(tenant) {
+    return `${tenant}-mesh-platform`;
+}
+export function validateEnv(value) {
+    return /^[a-z][a-z0-9-]*$/.test(value.trim())
+        ? true
+        : "lowercase letters, digits and dashes, starting with a letter";
+}
+export function validateRegion(value) {
+    return /^[a-z]{2}(-[a-z]+)+-\d$/.test(value.trim()) ? true : "an AWS region, e.g. us-east-2 or eu-west-1";
+}
+export function validateDomain(value) {
+    const domain = value.trim().toLowerCase().replace(/\.$/, "");
+    if (!domain)
+        return "a public domain you control, e.g. q2poc.pub";
+    if (!/^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}$/.test(domain)) {
+        return "a public domain you control, e.g. q2poc.pub";
+    }
+    if (/(^|\.)(example\.(com|org|net)|invalid|localhost|test)$/.test(domain)) {
+        return `${domain} is a placeholder — the deploy stalls on an ACM certificate for a zone nobody can delegate. Use a domain you control.`;
+    }
+    return true;
+}
+export function validateStateBucket(value) {
+    const bucket = value.trim();
+    return /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(bucket) && !bucket.includes("..")
+        ? true
+        : "3–63 characters: lowercase letters, digits, dots and dashes, starting and ending alphanumeric";
+}
+export function resolveTargetDir(tenant, flags, cwd) {
+    const dir = path.resolve(cwd, flags.dir ?? defaultPlatformDir(tenant));
+    if (fs.existsSync(dir) && fs.readdirSync(dir).length > 0) {
+        throw new MeshCliError(`Target directory is not empty: ${dir}`, {
+            remediation: { command: `mesh init platform ${tenant} --dir <empty-dir>` },
+        });
+    }
+    return dir;
+}
+export async function resolvePlatformSetup(tenant, flags, deps) {
+    const cwd = deps.cwd ?? process.cwd();
+    const dir = resolveTargetDir(tenant, flags, cwd);
+    const ask = deps.interactive && !flags.yes ? deps.prompts : undefined;
+    const env = flags.env ?? (ask ? await ask.input({ message: "Environment", default: PLATFORM_SETUP_DEFAULTS.env, validate: validateEnv }) : PLATFORM_SETUP_DEFAULTS.env);
+    if (validateEnv(env) !== true)
+        throw new MeshCliError(`Invalid environment '${env}' — ${validateEnv(env)}.`);
+    const region = flags.region ??
+        (ask
+            ? await ask.input({ message: "AWS region", default: PLATFORM_SETUP_DEFAULTS.region, validate: validateRegion })
+            : PLATFORM_SETUP_DEFAULTS.region);
+    if (validateRegion(region) !== true)
+        throw new MeshCliError(`Invalid region '${region}' — ${validateRegion(region)}.`);
+    let domain = flags.domain;
+    if (domain === undefined) {
+        if (!ask)
+            throw new MeshCliError(DOMAIN_REQUIRED_MESSAGE, { remediation: { command: `mesh init platform ${tenant} --domain <your-domain>` } });
+        domain = await ask.input({
+            message: `Public base domain (the core stack creates the Route 53 zone ${env}.<domain>; its NS records must be delegated from the parent before the deploy can finish)`,
+            validate: validateDomain,
+        });
+    }
+    const domainCheck = validateDomain(domain);
+    if (domainCheck !== true)
+        throw new MeshCliError(`Invalid --domain '${domain}' — ${domainCheck}`);
+    domain = domain.trim().toLowerCase().replace(/\.$/, "");
+    const profile = flags.profile ??
+        (ask
+            ? await ask.input({ message: "AWS profile the stack config references", default: PLATFORM_SETUP_DEFAULTS.profile })
+            : PLATFORM_SETUP_DEFAULTS.profile);
+    const bucketDefault = defaultStateBucket(tenant);
+    const stateBucket = flags.stateBucket ??
+        (ask
+            ? await ask.input({ message: "Pulumi state S3 bucket (holds this platform's state — created below if it does not exist)", default: bucketDefault, validate: validateStateBucket })
+            : bucketDefault);
+    const bucketCheck = validateStateBucket(stateBucket);
+    if (bucketCheck !== true)
+        throw new MeshCliError(`Invalid --state-bucket '${stateBucket}' — ${bucketCheck}`);
+    let createStateBucket = flags.createStateBucket ?? false;
+    if (flags.createStateBucket === undefined && ask) {
+        createStateBucket = await ask.confirm({
+            message: `Create s3://${stateBucket} in ${region} now (versioned), if it does not exist?`,
+            default: true,
+        });
+    }
+    return {
+        tenant,
+        env,
+        region,
+        domain,
+        profile,
+        stateBucket: stateBucket.trim(),
+        dir,
+        createStateBucket,
+    };
+}
+export function stateBucketCreateCommand(setup) {
+    const location = setup.region === "us-east-1" ? "" : ` --create-bucket-configuration LocationConstraint=${setup.region}`;
+    return `aws s3api create-bucket --bucket ${setup.stateBucket} --region ${setup.region}${location} --profile ${setup.profile}`;
+}
+function awsJson(args, profile) {
+    return execFileSync("aws", [...args, "--profile", profile], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+}
+export const realStateBucketDeps = {
+    headBucket(setup) {
+        try {
+            awsJson(["s3api", "head-bucket", "--bucket", setup.stateBucket, "--region", setup.region], setup.profile);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
+    createBucket(setup) {
+        const args = ["s3api", "create-bucket", "--bucket", setup.stateBucket, "--region", setup.region];
+        if (setup.region !== "us-east-1")
+            args.push("--create-bucket-configuration", `LocationConstraint=${setup.region}`);
+        awsJson(args, setup.profile);
+    },
+    enableVersioning(setup) {
+        awsJson(["s3api", "put-bucket-versioning", "--bucket", setup.stateBucket, "--region", setup.region, "--versioning-configuration", "Status=Enabled"], setup.profile);
+    },
+};
+export async function ensureStateBucket(setup, deps = realStateBucketDeps) {
+    if (!setup.createStateBucket) {
+        return { created: false, present: false, detail: "not requested" };
+    }
+    try {
+        if (deps.headBucket(setup)) {
+            return { created: false, present: true, detail: `s3://${setup.stateBucket} already exists` };
+        }
+    }
+    catch {
+    }
+    try {
+        deps.createBucket(setup);
+    }
+    catch (err) {
+        const why = errorDetail(err);
+        return { created: false, present: false, detail: `could not create s3://${setup.stateBucket} — ${why}` };
+    }
+    try {
+        deps.enableVersioning(setup);
+        return { created: true, present: true, detail: `created s3://${setup.stateBucket} in ${setup.region} (versioning on)` };
+    }
+    catch (err) {
+        return { created: true, present: true, detail: `created s3://${setup.stateBucket} in ${setup.region}, but versioning could not be enabled — ${errorDetail(err)}` };
+    }
+}
+function errorDetail(err) {
+    const stderr = err && typeof err === "object" && "stderr" in err ? String(err.stderr ?? "") : "";
+    const text = stderr.trim() || (err instanceof Error ? err.message : String(err));
+    return text.split("\n").filter(Boolean).slice(-1)[0] ?? "unknown error";
+}
+export function exportCredentialsCommand(profile) {
+    return (`eval "$(aws configure export-credentials --profile ${profile} --format env)"` +
+        "   # mesh deploy reads AWS_ACCESS_KEY_ID; a platform stack carries no mesh:deployerRole");
+}
+export function renderPlatformNextSteps(setup, opts = {}) {
+    const dir = opts.relativeDir ?? setup.dir;
+    const steps = [];
+    if (!opts.bucket?.present) {
+        steps.push(`${stateBucketCreateCommand(setup)}   # the Pulumi state bucket, once`);
+    }
+    steps.push(`cd ${dir}`, "pnpm install", `aws sso login --profile ${setup.profile}   # if this profile is SSO`, exportCredentialsCommand(setup.profile), `cd core && mesh deploy up        # the VPC, EKS, RDS and the public zone ${setup.env}.${setup.domain}`, `# → then delegate the NS records of ${setup.env}.${setup.domain} from ${setup.domain}; the deploy waits on the ACM certificate until you do`, "cd ../platform && mesh deploy up  # Temporal, Zitadel, the Hub  (needs Docker — it builds service images)", `mesh login ${setup.tenant}.${setup.env}      # your platform sign-in, once it is up`, "", "Then, in your apps repo, for the hello-world app:", `  mesh init --tenant ${setup.tenant} --platform ${setup.env}`, "  mesh create-app --name hello --primitives service", "  mesh deploy up                   # from the app directory");
+    return steps;
+}
+export async function scaffoldPlatformRepo(setup) {
+    if (fs.existsSync(setup.dir) && fs.readdirSync(setup.dir).length > 0) {
+        throw new MeshCliError(`Target directory is not empty: ${setup.dir}`, {
+            remediation: { command: `mesh init platform ${setup.tenant} --dir <empty-dir>` },
+        });
+    }
+    const { copyTemplate } = await import("../create-app.js");
+    const { findPackageRoot } = await import("../local/stack.js");
+    const { syncSkills } = await import("../skills.js");
+    const templateDir = path.join(findPackageRoot(), "templates", "platform-repo");
+    fs.mkdirSync(setup.dir, { recursive: true });
+    copyTemplate(templateDir, setup.dir, {
+        tenant: setup.tenant,
+        env: setup.env,
+        region: setup.region,
+        domain: setup.domain,
+        profile: setup.profile,
+        stateBucket: setup.stateBucket,
+    });
+    syncSkills(setup.dir);
+}

package/dist/src/commands/init/wizard.d.ts

@@ -1,10 +1,17 @@
 import { probeRegistryToken } from "../../utils/auth-preflight.js";
 import { type RegistryLoginOptions } from "../registry.js";
 import { type MeshJson } from "../../utils/mesh-json.js";
+import { scaffoldPlatformRepo, type PlatformSetupFlags, type StateBucketDeps } from "./platform-setup.js";
 export interface WizardOptions {
     tenant?: string;
     local?: boolean;
     platform?: string;
+    newPlatform?: string | boolean;
+    region?: string;
+    domain?: string;
+    stateBucket?: string;
+    createStateBucket?: boolean;
+    dir?: string;
     device?: boolean;
     profile?: string;
     skipRepo?: boolean;
@@ -18,9 +25,15 @@ export interface StepResult {
     detail: string;
     fix?: string;
     blocking?: boolean;
+    next?: string[];
 }
 export type WizardMode = "local" | {
     platform: string;
+} | {
+    newPlatform: PlatformSetupFlags;
+};
+export declare function isNewPlatform(mode: WizardMode): mode is {
+    newPlatform: PlatformSetupFlags;
 };
 export interface WizardCtx {
     cwd: string;
@@ -40,6 +53,8 @@ export interface WizardSeams {
     probe?: typeof probeRegistryToken;
     runRegistryLogin?: (opts: RegistryLoginOptions) => Promise<void>;
     gitInit?: (dir: string) => void;
+    scaffoldPlatform?: typeof scaffoldPlatformRepo;
+    stateBucket?: StateBucketDeps;
 }
 export interface WizardStep {
     name: "registry" | "platform" | "repo" | "skills";
@@ -72,7 +87,9 @@ export interface Prompts {
 }
 export declare const NO_SESSION_NO_TTY_MESSAGE: string;
 export declare const TENANT_REQUIRED_MESSAGE = "--tenant is required (no TTY for interactive mode)";
+export declare const REGISTRY_WHY: string;
 export declare const INTERRUPTED_EXIT_CODE = 130;
+export declare const PLATFORM_SETUP_LABEL = "Platform setup";
 export declare function wizardExitCode(steps: ReadonlyArray<Pick<StepResult, "status">>): number;
 export declare function wizardNextCommands(mode: WizardMode, steps?: ReadonlyArray<StepResult>): string[];
 export declare function stepBlocks(result: StepResult): boolean;
@@ -85,7 +102,9 @@ export declare function resolveAnswers(opts: WizardOptions, recorded: MeshJson |
     mode?: WizardMode;
     open: Array<"tenant" | "mode">;
 };
+export declare function platformSetupFlags(opts: WizardOptions): PlatformSetupFlags;
 export declare const registryStep: WizardStep;
+export declare const newPlatformStep: WizardStep;
 export type RepoKind = "platform-monorepo" | "empty-apps-repo" | "apps-repo" | "other-repo" | "empty-dir" | "no-repo";
 export declare function classifyRepo(cwd: string): {
     kind: RepoKind;
@@ -93,6 +112,7 @@ export declare function classifyRepo(cwd: string): {
 };
 export declare const INIT_REPO_FIX = "git init && mesh init";
 export declare const repoStep: WizardStep;
+export declare const skillsStep: WizardStep;
 export declare const WIZARD_STEPS: readonly WizardStep[];
 export declare function runWizardSteps(ctx: WizardCtx, steps: readonly WizardStep[]): Promise<StepResult[]>;
 export declare function runInitWizard(opts: WizardOptions, deps?: {

package/dist/src/commands/init/wizard.js

@@ -12,10 +12,17 @@ import { discoverConfigForContext, isRemoteEnvironment, readCredentials, renderN
 import { bootstrapAppsRepo, isInsidePlatformMonorepo, shouldBootstrapAppsRepo } from "../create-app.js";
 import { resolveTargetRoot, syncSkills } from "../skills.js";
 import { detectLocalTenant } from "../local/dev-local.js";
+import { PLATFORM_SETUP_DEFAULTS, ensureStateBucket, renderPlatformNextSteps, resolvePlatformSetup, scaffoldPlatformRepo, } from "./platform-setup.js";
+export function isNewPlatform(mode) {
+    return typeof mode === "object" && "newPlatform" in mode;
+}
 export const NO_SESSION_NO_TTY_MESSAGE = "No registry session and no terminal to sign in with.\n" +
     "  On a headless box: mesh registry login --device   (one-time, prints a code)\n" +
     "  In CI with AWS creds: mesh registry login --ci";
 export const TENANT_REQUIRED_MESSAGE = "--tenant is required (no TTY for interactive mode)";
+export const REGISTRY_WHY = "Package access — a sign-in to the Mesh package REGISTRY, which is what makes `@mesh-tech/*` installable.\n" +
+    "  It is one global identity: no AWS account, no platform, no <tenant>.<env> context.\n" +
+    "  (`mesh login <tenant>.<env>` is the other sign-in — that one is only for deploying to, or operating, a platform.)";
 export const INTERRUPTED_EXIT_CODE = 130;
 const STEP_LABELS = {
     registry: "Registry access",
@@ -23,10 +30,14 @@ const STEP_LABELS = {
     repo: "Repo",
     skills: "Agent skills",
 };
+export const PLATFORM_SETUP_LABEL = "Platform setup";
 export function wizardExitCode(steps) {
     return steps.some((s) => s.status === "fail") ? 1 : 0;
 }
 export function wizardNextCommands(mode, steps = []) {
+    const owned = steps.find((s) => s.next?.length)?.next;
+    if (owned)
+        return owned;
     const repo = steps.find((s) => s.name === STEP_LABELS.repo);
     const first = repo && repo.status !== "pass" && repo.fix ? repo.fix : "mesh create-app";
     return mode === "local" ? [first] : [first, "mesh deploy up   # from the app directory, once it exists"];
@@ -35,7 +46,11 @@ export function stepBlocks(result) {
     return result.status === "fail" && result.blocking !== false;
 }
 export function describeMode(mode) {
-    return mode === "local" ? "local only" : `deployed platform (${mode.platform})`;
+    if (mode === "local")
+        return "local only";
+    if (isNewPlatform(mode))
+        return `a new platform (${mode.newPlatform.env ?? PLATFORM_SETUP_DEFAULTS.env})`;
+    return `deployed platform (${mode.platform})`;
 }
 export function renderWizardSummary(outcome, opts = {}) {
     const paint = opts.color === false ? { green: (s) => s, red: (s) => s, yellow: (s) => s, dim: (s) => s, cyan: (s) => s } : chalk;
@@ -65,10 +80,13 @@ export function resolveAnswers(opts, recorded, interactive) {
         open.push("tenant");
     }
     let mode;
-    if (opts.local && opts.platform) {
-        throw new MeshCliError("--local and --platform are mutually exclusive.");
+    const chosen = [opts.local && "--local", opts.platform && "--platform", opts.newPlatform && "--new-platform"].filter(Boolean);
+    if (chosen.length > 1) {
+        throw new MeshCliError(`${chosen.join(", ")} are mutually exclusive — a tenant runs in exactly one of those three places.`);
     }
-    if (opts.platform)
+    if (opts.newPlatform)
+        mode = { newPlatform: platformSetupFlags(opts) };
+    else if (opts.platform)
         mode = { platform: opts.platform };
     else if (opts.local)
         mode = "local";
@@ -80,6 +98,18 @@ export function resolveAnswers(opts, recorded, interactive) {
     }
     return { tenant, mode, open };
 }
+export function platformSetupFlags(opts) {
+    return {
+        env: typeof opts.newPlatform === "string" ? opts.newPlatform : undefined,
+        region: opts.region,
+        domain: opts.domain,
+        profile: opts.profile,
+        stateBucket: opts.stateBucket,
+        createStateBucket: opts.createStateBucket,
+        dir: opts.dir,
+        yes: opts.yes,
+    };
+}
 export const registryStep = {
     name: "registry",
     async run(ctx) {
@@ -102,6 +132,7 @@ export const registryStep = {
             return { name, status: "fail", detail: NO_SESSION_NO_TTY_MESSAGE.split("\n")[0], fix: "mesh registry login --device", blocking: true };
         }
         try {
+            logInfo(REGISTRY_WHY);
             const login = ctx.seams?.runRegistryLogin ??
                 (async (opts) => {
                     const { runRegistryLogin } = await import("../registry.js");
@@ -132,10 +163,51 @@ export const registryStep = {
         return { name, status: "pass", detail: `Registry access OK (${session ? `signed in as ${session.email}` : "token written"})` };
     },
 };
+export const newPlatformStep = {
+    name: "platform",
+    async run(ctx) {
+        const name = PLATFORM_SETUP_LABEL;
+        if (!isNewPlatform(ctx.mode))
+            return { name, status: "skip", detail: "no new platform requested" };
+        let setup;
+        try {
+            setup = await resolvePlatformSetup(ctx.tenant, { ...ctx.mode.newPlatform, yes: ctx.yes }, {
+                prompts: ctx.prompts,
+                interactive: ctx.interactive,
+                cwd: ctx.cwd,
+            });
+        }
+        catch (err) {
+            return {
+                name,
+                status: "fail",
+                detail: err.message.split("\n")[0],
+                fix: `mesh init --tenant ${ctx.tenant} --new-platform --domain <your-domain>`,
+            };
+        }
+        try {
+            await (ctx.seams?.scaffoldPlatform ?? scaffoldPlatformRepo)(setup);
+        }
+        catch (err) {
+            return { name, status: "fail", detail: `platform repo not scaffolded: ${err.message.split("\n")[0]}`, fix: `mesh init platform ${ctx.tenant} --dir <empty-dir>` };
+        }
+        const bucket = await ensureStateBucket(setup, ctx.seams?.stateBucket);
+        const next = renderPlatformNextSteps(setup, { bucket, relativeDir: path.relative(ctx.cwd, setup.dir) || "." });
+        return {
+            name,
+            status: setup.createStateBucket && !bucket.present ? "warn" : "pass",
+            detail: `platform repo scaffolded at ${setup.dir} (${setup.tenant}.${setup.env}, ${setup.region}, zone ${setup.env}.${setup.domain})` +
+                (setup.createStateBucket ? ` — state bucket: ${bucket.detail}` : ` — state bucket ${setup.stateBucket} not created (see Next)`),
+            next,
+        };
+    },
+};
 const platformStep = {
     name: "platform",
     async run(ctx) {
         const name = STEP_LABELS.platform;
+        if (isNewPlatform(ctx.mode))
+            return newPlatformStep.run(ctx);
         if (!ctx.context)
             return { name, status: "skip", detail: "local only — no platform to sign in to" };
         const context = ctx.context;
@@ -192,6 +264,9 @@ export const repoStep = {
         const name = STEP_LABELS.repo;
         if (ctx.skipRepo)
             return { name, status: "skip", detail: "--skip-repo" };
+        if (isNewPlatform(ctx.mode)) {
+            return { name, status: "skip", detail: "setting up a platform — the apps repo comes after the first deploy (see Next)" };
+        }
         const { kind, root } = classifyRepo(ctx.cwd);
         switch (kind) {
             case "platform-monorepo":
@@ -259,12 +334,15 @@ export const repoStep = {
         }
     },
 };
-const skillsStep = {
+export const skillsStep = {
     name: "skills",
     async run(ctx) {
         const name = STEP_LABELS.skills;
         if (ctx.skipRepo)
             return { name, status: "skip", detail: "--skip-repo" };
+        if (isNewPlatform(ctx.mode)) {
+            return { name, status: "skip", detail: "synced into the new platform repo by the scaffold" };
+        }
         const { kind, root } = classifyRepo(ctx.cwd);
         if (kind !== "apps-repo" && kind !== "empty-apps-repo") {
             return { name, status: "skip", detail: "no apps repo to install skills into" };
@@ -341,11 +419,15 @@ export async function runInitWizard(opts, deps = {}) {
                 choices: [
                     { name: "Local only (mesh start / mesh dev — no deployed platform yet)", value: "local" },
                     { name: `A deployed Mesh platform (I have a ${tenant}.<env> context)`, value: "deployed" },
+                    { name: "Nothing yet — set up a new Mesh platform in my AWS account", value: "new" },
                 ],
                 default: recorded && recorded.platform !== "local" ? "deployed" : "local",
             });
             if (choice === "local")
                 mode = "local";
+            else if (choice === "new") {
+                mode = { newPlatform: platformSetupFlags({ ...opts, newPlatform: true }) };
+            }
             else {
                 const env = await prompts.input({
                     message: "Environment",
@@ -359,7 +441,7 @@ export async function runInitWizard(opts, deps = {}) {
             cwd,
             tenant,
             mode,
-            context: mode === "local" ? null : `${tenant}.${mode.platform}`,
+            context: mode === "local" || isNewPlatform(mode) ? null : `${tenant}.${mode.platform}`,
             device: opts.device,
             profile: opts.profile,
             interactive,
@@ -372,7 +454,7 @@ export async function runInitWizard(opts, deps = {}) {
         logInfo(`Setting up tenant '${tenant}' (${describeMode(mode)})…`);
         const steps = await runWizardSteps(ctx, deps.steps ?? WIZARD_STEPS);
         const { kind, root } = classifyRepo(cwd);
-        if (!opts.skipRepo && (kind === "apps-repo" || kind === "empty-apps-repo")) {
+        if (!opts.skipRepo && !isNewPlatform(mode) && (kind === "apps-repo" || kind === "empty-apps-repo")) {
             const written = writeMeshJson(root, { tenant, platform: mode === "local" ? "local" : mode.platform });
             logInfo(`Recorded tenant + mode in ${written}`);
         }

package/dist/src/commands/init.js

@@ -8,6 +8,14 @@ import { readCredentials } from "./login.js";
 import { resolveTargetRoot, syncSkills } from "./skills.js";
 import { detectLocalTenant } from "./local/dev-local.js";
 import { LOGIN_CONTEXT } from "./local/seed-zitadel.js";
+import { PLATFORM_SETUP_DEFAULTS } from "./init/platform-setup.js";
+async function setupPrompts() {
+    const [{ default: input }, { default: confirm }] = await Promise.all([
+        import("@inquirer/input"),
+        import("@inquirer/confirm"),
+    ]);
+    return { input: (args) => input(args), confirm: (args) => confirm(args) };
+}
 const LOCAL_HUB_API = "http://localhost:4568";
 function isLocalContext(context) {
     return context === LOGIN_CONTEXT;
@@ -211,12 +219,19 @@ export function registerInitCommands(program) {
     const init = program
         .command("init")
         .enablePositionalOptions()
-        .description("Set up this machine and repo for a tenant — a guided wizard with no subcommand (tenant, local or deployed, package-registry sign-in, repo, skills); `init platform` scaffolds a platform repo, `init app-tenant` is the apps-repo doctor")
+        .description("Set up this machine and repo for a tenant — a guided wizard with no subcommand. It starts from nothing: it asks where the tenant runs, and 'nowhere yet' is one of the answers (it scaffolds you a platform). Then package-registry sign-in, repo, skills. `init platform` is the same scaffold on its own; `init app-tenant` is the apps-repo doctor")
         .option("--tenant <name>", "app tenant this repo belongs to (prompted when omitted on a TTY)")
         .option("--local", "local only — mesh start / mesh dev, no deployed platform (the default)")
-        .option("--platform <env>", "a deployed platform's environment; signs in to <tenant>.<env>")
+        .option("--platform <env>", "a deployed platform's environment; signs in to `<tenant>.<env>`")
+        .option("--new-platform [env]", `nothing deployed yet — scaffold a tenant platform repo for \`<tenant>.<env>\` (default env: ${PLATFORM_SETUP_DEFAULTS.env}) and print its deploy sequence`)
+        .option("--region <region>", `--new-platform: AWS region (default: ${PLATFORM_SETUP_DEFAULTS.region})`)
+        .option("--domain <domain>", "--new-platform: base public domain you control; the core stack creates the zone {env}.{domain}. No default — a placeholder scaffolds a zone that can never validate")
+        .option("--state-bucket <bucket>", "--new-platform: Pulumi state S3 bucket (default: {tenant}-mesh-platform-pulumi-state)")
+        .option("--create-state-bucket", "--new-platform: create the state bucket (versioned) if it does not exist")
+        .option("--no-create-state-bucket", "--new-platform: never create the state bucket; print the aws command instead")
+        .option("--dir <path>", "--new-platform: where to scaffold the platform repo (default: ./{tenant}-mesh-platform)")
         .option("--device", "device-code sign-in for the registry and platform steps (headless / SSH)")
-        .option("--profile <aws-profile>", "deployers only: AWS profile that can read the registry (skips the broker)")
+        .option("--profile <aws-profile>", "AWS profile this machine uses: read the registry without the broker (deployers only), and the profile a --new-platform stack config references")
         .option("--skip-repo", "do not bootstrap, check or record anything in the current repo", false)
         .option("--yes", "accept every default and never prompt", false)
         .option("--json", "one JSON document on stdout ({tenant, mode, steps, next}); human output on stderr", false)
@@ -228,47 +243,38 @@ export function registerInitCommands(program) {
     });
     init
         .command("platform <tenant>")
-        .description("Scaffold a tenant PLATFORM repo (core + platform Pulumi layers on @mesh-tech/infra-components) that deploys with `mesh deploy` unmodified — the proven mesh-sandbox shape, annotated.")
-        .option("--env <env>", "environment the first stack targets", "dev")
-        .option("--region <region>", "AWS region", "us-east-2")
-        .option("--domain <domain>", "base public domain (ingress zone becomes {env}.{domain})", "example.com")
-        .option("--profile <profile>", "AWS profile the stack config references", "default")
-        .option("--state-bucket <bucket>", "Pulumi state S3 bucket (created by an operator)", undefined)
+        .description("Scaffold a tenant PLATFORM repo (core + platform Pulumi layers on @mesh-tech/infra-components) that deploys with `mesh deploy` unmodified — the proven mesh-sandbox shape, annotated. On a terminal it ASKS for the values that differ per install (env, region, domain, state bucket, AWS profile), each pre-filled with its default; every answer is also a flag.")
+        .option("--env <env>", `environment the first stack targets (default: ${PLATFORM_SETUP_DEFAULTS.env})`)
+        .option("--region <region>", `AWS region (default: ${PLATFORM_SETUP_DEFAULTS.region})`)
+        .option("--domain <domain>", "base public domain you control — the core stack creates the Route 53 zone {env}.{domain} and waits on its NS delegation. Required: it has no default, because a placeholder scaffolds a zone that can never validate")
+        .option("--profile <profile>", `AWS profile the stack config references (default: ${PLATFORM_SETUP_DEFAULTS.profile})`)
+        .option("--state-bucket <bucket>", "Pulumi state S3 bucket (default: {tenant}-mesh-platform-pulumi-state)")
+        .option("--create-state-bucket", "create the state bucket (versioned) if it does not exist — prompted on a terminal")
+        .option("--no-create-state-bucket", "never create the state bucket; print the aws command instead")
         .option("--dir <path>", "target directory (default: ./{tenant}-mesh-platform)")
+        .option("--yes", "accept every default and never prompt", false)
         .action(async (tenant, opts) => {
         if (!/^[a-z][a-z0-9-]*$/.test(tenant)) {
             throw new MeshCliError(`Invalid tenant name '${tenant}' (lowercase alphanumeric + dashes).`);
         }
-        const targetDir = path.resolve(opts.dir ?? `${tenant}-mesh-platform`);
-        if (fs.existsSync(targetDir) && fs.readdirSync(targetDir).length > 0) {
-            throw new MeshCliError(`Target directory is not empty: ${targetDir}`, {
-                remediation: { command: `mesh init platform ${tenant} --dir <empty-dir>` },
-            });
-        }
-        const { copyTemplate } = await import("./create-app.js");
-        const { findPackageRoot } = await import("./local/stack.js");
-        const templateDir = path.join(findPackageRoot(), "templates", "platform-repo");
-        const context = {
-            tenant,
-            env: opts.env,
-            region: opts.region,
-            domain: opts.domain,
-            profile: opts.profile,
-            stateBucket: opts.stateBucket ?? `${tenant}-mesh-platform-pulumi-state`,
-        };
-        fs.mkdirSync(targetDir, { recursive: true });
-        copyTemplate(templateDir, targetDir, context);
-        syncSkills(targetDir);
-        logInfo(`Platform repo scaffolded at ${targetDir}`);
+        const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+        const { resolvePlatformSetup, scaffoldPlatformRepo, ensureStateBucket, renderPlatformNextSteps } = await import("./init/platform-setup.js");
+        const setup = await resolvePlatformSetup(tenant, opts, {
+            prompts: interactive && !opts.yes ? await setupPrompts() : undefined,
+            interactive,
+        });
+        await scaffoldPlatformRepo(setup);
+        logInfo(`Platform repo scaffolded at ${setup.dir}`);
+        const bucket = await ensureStateBucket(setup);
+        if (bucket.detail !== "not requested")
+            logInfo(`Pulumi state bucket: ${bucket.detail}`);
         console.log("");
         console.log("Next steps:");
-        console.log(`  cd ${path.relative(process.cwd(), targetDir) || "."}`);
-        console.log(`  mesh login ${tenant}.${opts.env}     # or an operator context with access`);
-        console.log("  pnpm install");
-        console.log("  cd core && mesh deploy up");
-        console.log("  cd ../platform && mesh deploy up");
+        for (const line of renderPlatformNextSteps(setup, { bucket, relativeDir: path.relative(process.cwd(), setup.dir) || "." })) {
+            console.log(line ? `  ${line}` : "");
+        }
         console.log("");
-        logInfo(`Review the annotated stack configs (Pulumi.${tenant}-${opts.env}.yaml) before the first deploy.`);
+        logInfo(`Review the annotated stack configs (Pulumi.${tenant}-${setup.env}.yaml) before the first deploy.`);
     });
     init
         .command("app-tenant")

package/dist/src/commands/login.d.ts

@@ -50,6 +50,10 @@ export declare function registerLoginCommand(program: Command): void;
 export declare const RESERVED_REGISTRY_CONTEXT = "registry";
 export declare const NO_REGISTRY_DEPRECATED = "--no-registry is deprecated and ignored: mesh login no longer touches the registry.";
 export declare const REGISTRY_SEPARATE_HINT = "Package registry access is separate from platform sign-in \u2014 run: mesh registry login";
+export declare function shorthandContext(context: string): {
+    tenant: string;
+    env: string;
+} | null;
 export declare function renderNoConfigHelp(context: string): string;
 export declare function tokenStillValid(expiresAt: string, marginMs?: number, now?: number): boolean;
 declare function getValidToken(context: string, opts?: {

package/dist/src/commands/login.js

@@ -622,7 +622,7 @@ async function showStatus(context, config) {
 export function registerLoginCommand(program) {
     program
         .command("login")
-        .description("Authenticate with Zitadel (OIDC PKCE or Device Code)")
+        .description("PLATFORM access: sign in to a deployed Mesh platform (`<tenant>.<env>`) — what `mesh deploy`, `mesh stack`, the Hub and the VPN use. It never touches your ~/.npmrc, and you do not need it to install packages: that is `mesh registry login`. OIDC PKCE, or device code with --device.")
         .argument("<context>", 'Platform context (e.g., "mesh.dev")')
         .option("--status", "Show current authentication status — the Zitadel session if one is cached, otherwise the AWS identity the credential chain resolves (SSO profile or key pair). Exits non-zero only when neither works.")
         .option("--device", "Force device code flow (no callback server needed)")
@@ -668,7 +668,7 @@ export function registerLoginCommand(program) {
     });
     program
         .command("logout")
-        .description("Clear cached Zitadel credentials")
+        .description("Clear a platform context's cached credentials (the package-registry session under `mesh registry` is untouched)")
         .argument("<context>", 'Platform context (e.g., "mesh.dev")')
         .action((context) => {
         refuseReservedRegistryContext(context, "logout");
@@ -698,8 +698,20 @@ async function hintRegistryIfMissing() {
     catch {
     }
 }
+export function shorthandContext(context) {
+    const parts = context.split(".");
+    if (parts.length !== 2)
+        return null;
+    const [tenant, env] = parts;
+    return tenant && env ? { tenant, env } : null;
+}
 export function renderNoConfigHelp(context) {
     const pinned = firstPartyDomainFor(context);
+    const shorthand = shorthandContext(context);
+    const createOne = shorthand
+        ? `mesh init --tenant ${shorthand.tenant} --new-platform ${shorthand.env}`
+        : "mesh init --tenant <tenant> --new-platform <env>";
+    const scaffoldOne = `mesh init platform ${shorthand?.tenant ?? "<tenant>"} --domain <a domain you control>`;
     return (`No configuration found for "${context}".\n\n` +
         `Tried:\n` +
         `  1. SSM: /mesh-platform/${context.split(".")[0]}/${context.split(".")[1]}/platform/zitadel\n` +
@@ -709,6 +721,8 @@ export function renderNoConfigHelp(context) {
             : `  2. HTTPS: https://cli.${context}/.well-known/mesh.json\n` +
                 `     (only attempted for a full domain, or a known first-party context)\n\n`) +
         `To fix:\n` +
+        `  - No platform deployed yet? Create one: ${createOne}\n` +
+        `    (or the scaffold on its own: ${scaffoldOne})\n` +
         `  - Use the platform's full domain: mesh login <env>.<tenant>.meshtech.io\n` +
         `  - Or, if you have AWS access, ensure SSO is active: aws sso login --profile <profile>\n` +
         `  - Or add config manually to ${CONFIG_FILE}:\n\n` +