@mesh-tech/mesh-cli 0.25.0 → 0.26.0

package/dist/bin/mesh.js

@@ -126,99 +126,373 @@ var init_log = __esm({
   }
 });
 
-// libs/mesh-cli/src/utils/context.ts
+// libs/mesh-cli/src/utils/mesh-json.ts
 import * as fs from "fs";
 import * as path from "path";
-function findFileUpward(filename, startDir = process.cwd()) {
+function isValidTenantName(value) {
+  return /^[a-z][a-z0-9-]*$/.test(value);
+}
+function parseMeshJson(content) {
+  try {
+    const data = JSON.parse(content);
+    if (typeof data?.tenant !== "string" || !isValidTenantName(data.tenant)) return null;
+    const platform = typeof data.platform === "string" && data.platform ? data.platform : "local";
+    return { tenant: data.tenant, platform };
+  } catch {
+    return null;
+  }
+}
+function findMeshJson(startDir) {
+  let dir = path.resolve(startDir);
+  while (true) {
+    const candidate = path.join(dir, MESH_JSON);
+    if (fs.existsSync(candidate)) {
+      let content = "";
+      try {
+        content = fs.readFileSync(candidate, "utf-8");
+      } catch {
+        return null;
+      }
+      const data = parseMeshJson(content);
+      return data ? { path: candidate, data } : null;
+    }
+    if (fs.existsSync(path.join(dir, ".git"))) return null;
+    const parent = path.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function writeMeshJson(rootDir, data) {
+  const target = path.join(rootDir, MESH_JSON);
+  fs.writeFileSync(target, `${JSON.stringify({ tenant: data.tenant, platform: data.platform }, null, 2)}
+`);
+  return target;
+}
+var MESH_JSON;
+var init_mesh_json = __esm({
+  "libs/mesh-cli/src/utils/mesh-json.ts"() {
+    "use strict";
+    MESH_JSON = "mesh.json";
+  }
+});
+
+// libs/mesh-cli/src/utils/context.ts
+import * as fs2 from "fs";
+import * as path2 from "path";
+function findFileUpwardInRepo(filename, startDir = process.cwd()) {
   let currentDir = startDir;
-  const root = path.parse(currentDir).root;
-  while (currentDir !== root) {
-    const filePath = path.join(currentDir, filename);
-    if (fs.existsSync(filePath)) {
+  const root = path2.parse(currentDir).root;
+  for (; ; ) {
+    const filePath = path2.join(currentDir, filename);
+    if (fs2.existsSync(filePath)) {
       return filePath;
     }
-    currentDir = path.dirname(currentDir);
+    if (fs2.existsSync(path2.join(currentDir, ".git")) || fs2.existsSync(path2.join(currentDir, "pnpm-workspace.yaml")) || currentDir === root) {
+      return void 0;
+    }
+    currentDir = path2.dirname(currentDir);
+  }
+}
+function findRepoRoot(startDir) {
+  let currentDir = startDir;
+  const root = path2.parse(currentDir).root;
+  for (; ; ) {
+    if (fs2.existsSync(path2.join(currentDir, ".git")) || fs2.existsSync(path2.join(currentDir, "pnpm-workspace.yaml"))) {
+      return currentDir;
+    }
+    if (currentDir === root) {
+      return void 0;
+    }
+    currentDir = path2.dirname(currentDir);
+  }
+}
+function stripComments(source) {
+  let out = "";
+  for (let i = 0; i < source.length; i++) {
+    const ch = source[i];
+    if (ch === '"' || ch === "'" || ch === "`") {
+      const start = i;
+      i++;
+      while (i < source.length && source[i] !== ch) {
+        if (source[i] === "\\") i++;
+        i++;
+      }
+      out += source.slice(start, i + 1);
+    } else if (ch === "/" && source[i + 1] === "/") {
+      while (i < source.length && source[i] !== "\n") i++;
+      i--;
+    } else if (ch === "/" && source[i + 1] === "*") {
+      i += 2;
+      while (i < source.length && !(source[i] === "*" && source[i + 1] === "/")) i++;
+      i++;
+    } else {
+      out += ch;
+    }
+  }
+  return out;
+}
+function findExportedConfigStart(source) {
+  const declMatch = /export\s+(const\s+config\b|default\b)/.exec(source);
+  if (!declMatch) return void 0;
+  const start = source.indexOf("{", declMatch.index);
+  if (start === -1) return void 0;
+  const gap = source.slice(declMatch.index + declMatch[0].length, start);
+  if (!/^[\s=]*(:[^;{]*)?$/.test(gap)) return void 0;
+  return start;
+}
+function scanDepth1(source, start, visit) {
+  let depth = 0;
+  for (let i = start; i < source.length; i++) {
+    const ch = source[i];
+    if (ch === '"' || ch === "'" || ch === "`") {
+      i++;
+      while (i < source.length && source[i] !== ch) {
+        if (source[i] === "\\") i++;
+        i++;
+      }
+    } else if (ch === "{") {
+      depth++;
+    } else if (ch === "}") {
+      depth--;
+      if (depth === 0) return void 0;
+    } else if (depth === 1 && !/[\w$.]/.test(source[i - 1] ?? "")) {
+      const found = visit(i);
+      if (found !== void 0) return found;
+    }
+  }
+  return void 0;
+}
+function extractConfigTenant(rawSource) {
+  const source = stripComments(rawSource);
+  const start = findExportedConfigStart(source);
+  if (start === void 0) return void 0;
+  const tenantRe = /tenant\s*:\s*(["'])([^"'\n]+)\1/y;
+  return scanDepth1(source, start, (i) => {
+    tenantRe.lastIndex = i;
+    return tenantRe.exec(source)?.[2];
+  });
+}
+function matchBlock(source, open) {
+  let depth = 0;
+  for (let i = open; i < source.length; i++) {
+    const ch = source[i];
+    if (ch === '"' || ch === "'" || ch === "`") {
+      i++;
+      while (i < source.length && source[i] !== ch) {
+        if (source[i] === "\\") i++;
+        i++;
+      }
+    } else if (ch === "{") {
+      depth++;
+    } else if (ch === "}") {
+      depth--;
+      if (depth === 0) return source.slice(open, i + 1);
+    }
   }
   return void 0;
 }
-function detectContext(stageArg) {
+function extractExportedConfigSource(cleanedSource) {
+  const start = findExportedConfigStart(cleanedSource);
+  return start === void 0 ? void 0 : matchBlock(cleanedSource, start);
+}
+function extractPlatformBlock(cleanedSource) {
+  const start = findExportedConfigStart(cleanedSource);
+  if (start === void 0) return void 0;
+  const platformRe = /platform\s*:\s*\{/y;
+  let open;
+  scanDepth1(cleanedSource, start, (i) => {
+    platformRe.lastIndex = i;
+    if (platformRe.exec(cleanedSource)) {
+      open = platformRe.lastIndex - 1;
+      return true;
+    }
+    return void 0;
+  });
+  if (open === void 0) return void 0;
+  return matchBlock(cleanedSource, open);
+}
+function pickStackFile(files, hint, explicitStack) {
+  if (explicitStack !== void 0) {
+    const wanted = `Pulumi.${explicitStack}.yaml`;
+    return { file: files.includes(wanted) ? wanted : void 0, qualified: true };
+  }
+  if (hint) {
+    const wanted = `Pulumi.${hint}.yaml`;
+    if (files.includes(wanted)) return { file: wanted, qualified: true };
+  }
+  const stageOf = (f) => f.slice("Pulumi.".length, -".yaml".length);
+  const byBaseFirst = [...files].sort(
+    (a, b) => stageOf(a).length - stageOf(b).length || a.localeCompare(b)
+  );
+  return { file: byBaseFirst[0], qualified: false };
+}
+function tenantNotDeclared(cwd, found) {
+  const looked = found.stackFile ? `${found.stackFile} in ${cwd} does not declare mesh:tenant` : found.hasProjectFile ? `${cwd} has a Pulumi.yaml but no Pulumi.<stack>.yaml to read mesh:tenant from` : `${cwd} is not a Pulumi project directory (no Pulumi.yaml)`;
+  return new MeshCliError(
+    `No tenant declared: ${looked}, and MESH_TENANT is not set. There is no default tenant \u2014 "mesh" is the live hub and is never assumed. Run from a directory whose Pulumi.<stack>.yaml declares mesh:tenant, set MESH_TENANT, or pass --tenant where the command accepts one.`,
+    {
+      remediation: {
+        command: "MESH_TENANT=<tenant> mesh \u2026   # or --tenant <tenant> where accepted, or run from a directory whose Pulumi.<stack>.yaml declares mesh:tenant"
+      }
+    }
+  );
+}
+function detectContext(stageArg, options = {}) {
   let tenant;
   let stage;
   const cwd = process.cwd();
-  if (fs.existsSync("Pulumi.yaml")) {
-    const files = fs.readdirSync(".").filter(
-      (f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml"
-    );
-    const configFile = files[0];
-    if (configFile) {
-      const content = fs.readFileSync(configFile, "utf-8");
-      const tenantMatch = content.match(/^\s*mesh:tenant:\s*["']?([^"'\n]+)["']?/m);
+  const stageHint = stageArg || process.env.MESH_STAGE || process.env.SST_STAGE;
+  let hasProjectFile = false;
+  let stackFile;
+  let stackFilesHere = [];
+  let namedStackMissing = false;
+  if (fs2.existsSync("Pulumi.yaml")) {
+    hasProjectFile = true;
+    const files = fs2.readdirSync(".").filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml").sort();
+    const picked = pickStackFile(files, stageHint, options.stack);
+    stackFile = picked.file;
+    namedStackMissing = options.stack !== void 0 && picked.file === void 0;
+    stackFilesHere = files;
+    if (!picked.qualified && files.length > 1) {
+      const lengths = files.map((f) => f.length - "Pulumi..yaml".length).sort((a, b) => a - b);
+      if (lengths[0] === lengths[1]) {
+        logWarn(
+          `Several Pulumi stack configs here (${files.join(", ")}); using ${stackFile}. Pass --stack to choose one.`
+        );
+      }
+    }
+    if (stackFile) {
+      const content = fs2.readFileSync(stackFile, "utf-8");
+      const tenantMatch = content.match(/^\s*mesh:tenant:\s*["']?([^"'#\n]+)["']?/m);
       if (tenantMatch?.[1]) {
         tenant = tenantMatch[1].trim();
       }
-      const stageMatch = configFile.match(/Pulumi\.(.+)\.yaml/);
+      const stageMatch = stackFile.match(/Pulumi\.(.+)\.yaml/);
       if (stageMatch?.[1]) {
         stage = stageMatch[1];
       }
     }
   }
-  const sstConfigPath = findFileUpward("sst.config.ts");
+  const sstConfigPath = findFileUpwardInRepo("sst.config.ts");
   let sstDir;
   if (sstConfigPath) {
-    sstDir = path.dirname(sstConfigPath);
-    const parentConfigPath = path.join(sstDir, "..", "config.ts");
-    if (fs.existsSync(parentConfigPath)) {
-      const configContent = fs.readFileSync(parentConfigPath, "utf-8");
-      const tenantMatch = configContent.match(/tenant:\s*["']([^"']+)["']/);
-      if (tenantMatch) {
-        tenant = tenantMatch[1];
-      }
-    }
-    const sstStagePath = path.join(sstDir, ".sst", "stage");
-    if (fs.existsSync(sstStagePath)) {
-      stage = fs.readFileSync(sstStagePath, "utf-8").trim();
-    }
-  }
-  if (!tenant) {
-    const pathMatch = cwd.match(/tenants\/([^/]+)/);
+    sstDir = path2.dirname(sstConfigPath);
+    const sstStagePath = path2.join(sstDir, ".sst", "stage");
+    if (fs2.existsSync(sstStagePath)) {
+      stage = fs2.readFileSync(sstStagePath, "utf-8").trim();
+    }
+  }
+  const repoRoot2 = findRepoRoot(cwd);
+  const parentConfigPath = (sstDir ? [path2.join(sstDir, "config.ts"), path2.join(sstDir, "..", "config.ts")] : hasProjectFile ? [path2.resolve(cwd, "..", "config.ts")] : []).filter(
+    // Fail closed when no checkout root is found — same stance as the
+    // no-tenant throw: an arbitrary config.ts is not a context source.
+    (p) => repoRoot2 !== void 0 && !path2.relative(repoRoot2, p).startsWith("..")
+  ).find((p) => fs2.existsSync(p));
+  const parentConfig = parentConfigPath ? fs2.readFileSync(parentConfigPath, "utf-8") : void 0;
+  if (parentConfig && !tenant) {
+    tenant = extractConfigTenant(parentConfig);
+  }
+  if (!tenant && repoRoot2) {
+    const pathMatch = path2.relative(repoRoot2, cwd).match(/(?:^|\/)tenants\/([^/]+)/);
     if (pathMatch) {
       tenant = pathMatch[1];
     }
   }
-  stage = stageArg || process.env.MESH_STAGE || process.env.SST_STAGE || stage || "dev";
-  tenant = process.env.MESH_TENANT || tenant || "mesh";
+  if (!tenant) {
+    tenant = findMeshJson(cwd)?.data.tenant;
+  }
+  stage = stageHint || stage || "dev";
+  const detectedTenant = tenant;
+  tenant = options.tenant || process.env.MESH_TENANT || tenant;
+  if (!tenant) {
+    throw tenantNotDeclared(cwd, { stackFile, hasProjectFile });
+  }
+  if (!/^[a-z0-9][a-z0-9-]*$/.test(tenant)) {
+    throw new MeshCliError(
+      `Invalid tenant "${tenant}": expected lowercase alphanumerics and hyphens. This usually means a config file was misparsed.`,
+      { remediation: { command: "mesh <command> --tenant <tenant>" } }
+    );
+  }
+  const overrideSource = options.tenant ? "--tenant" : "MESH_TENANT";
+  const tenantOverridden = detectedTenant !== void 0 && detectedTenant !== tenant;
+  if (tenantOverridden) {
+    logWarn(
+      `${overrideSource}=${tenant} overrides the tenant detected here (${detectedTenant}); paths will use ${tenant} while implicit AWS credentials still come from the ${detectedTenant} app's deployer role`
+    );
+  }
   let platformEnv = stage;
-  let platformEnvMap = {};
+  const platformEnvMap = /* @__PURE__ */ Object.create(null);
   let defaultPlatformEnv;
-  const configPath = sstDir ? path.join(sstDir, "..", "config.ts") : "../config.ts";
-  if (fs.existsSync(configPath)) {
-    const configContent = fs.readFileSync(configPath, "utf-8");
-    const mapMatch = configContent.match(/platformEnvMap:\s*\{([^}]+)\}/);
-    if (mapMatch?.[1]) {
-      const entries = mapMatch[1].matchAll(/(\w+):\s*["']([^"']+)["']/g);
+  if (parentConfig) {
+    const cleaned = stripComments(parentConfig);
+    const platformScope = extractPlatformBlock(cleaned);
+    const legacyScope = extractExportedConfigSource(cleaned);
+    const mapSource = (scope, key) => {
+      if (!scope) return void 0;
+      const at = scope.search(new RegExp(`${key}\\s*:\\s*\\{`));
+      if (at === -1) return void 0;
+      return matchBlock(scope, scope.indexOf("{", at));
+    };
+    const mapBody = mapSource(platformScope, "envMap") ?? mapSource(legacyScope, "platformEnvMap");
+    if (mapBody) {
+      const entries = mapBody.matchAll(/(?:"([^"]+)"|'([^']+)'|([\w-]+))\s*:\s*["']([^"']+)["']/g);
       for (const entry of entries) {
-        const key = entry[1];
-        const value = entry[2];
+        const key = entry[1] ?? entry[2] ?? entry[3];
+        const value = entry[4];
         if (key && value) {
           platformEnvMap[key] = value;
         }
       }
     }
-    const defaultMatch = configContent.match(/defaultPlatformEnv:\s*["']([^"']+)["']/);
+    const defaultMatch = platformScope?.match(/defaultEnv:\s*["']([^"']+)["']/) ?? legacyScope?.match(/defaultPlatformEnv:\s*["']([^"']+)["']/);
     if (defaultMatch?.[1]) {
       defaultPlatformEnv = defaultMatch[1];
     }
   }
-  const tenantPrefix = `${tenant}-`;
-  const parsedEnv = stage.startsWith(tenantPrefix) ? stage.slice(tenantPrefix.length) : stage;
-  platformEnv = platformEnvMap[parsedEnv] ?? platformEnvMap[stage] ?? defaultPlatformEnv ?? parsedEnv;
+  const tenantPrefix = [detectedTenant, tenant].filter((t) => Boolean(t)).map((t) => `${t}-`).sort((a, b) => b.length - a.length).find((p) => stage.startsWith(p));
+  const parsedEnv = tenantPrefix ? stage.slice(tenantPrefix.length) : stage;
+  const mapApplies = !tenantOverridden;
+  if (tenantOverridden && (Object.keys(platformEnvMap).length > 0 || defaultPlatformEnv)) {
+    logWarn(
+      `${overrideSource}=${tenant} also leaves the ${detectedTenant} config's envMap unapplied \u2014 it maps ${detectedTenant}'s stages, not ${tenant}'s \u2014 so the platform env is the stage itself ("${parsedEnv}"). Pass -e/--env where the command takes one, or run from the ${tenant} app's own directory.`
+    );
+  }
+  const mapped = mapApplies ? platformEnvMap[stage] ?? platformEnvMap[parsedEnv] : void 0;
+  if (mapped) {
+    platformEnv = mapped;
+  } else if (mapApplies && defaultPlatformEnv) {
+    if (namedStackMissing) {
+      const known = [
+        ...stackFilesHere.map((f) => f.slice("Pulumi.".length, -".yaml".length)),
+        ...Object.keys(platformEnvMap)
+      ].filter((v, i, a) => a.indexOf(v) === i);
+      throw new MeshCliError(
+        `No such stack "${options.stack}": ${cwd} has no Pulumi.${options.stack}.yaml, and the app's config.ts does not map it to a platform env \u2014 it would address defaultEnv "${defaultPlatformEnv}", not the stack you asked for.`,
+        {
+          remediation: {
+            command: `mesh <command> --stack <${known.join("|") || "stack"}>`
+          }
+        }
+      );
+    }
+    platformEnv = defaultPlatformEnv;
+    if (Object.keys(platformEnvMap).length > 0) {
+      logWarn(
+        `Stage "${stage}" is not in the config's envMap (${Object.keys(platformEnvMap).join(", ")}); using defaultEnv "${defaultPlatformEnv}".`
+      );
+    }
+  } else {
+    platformEnv = parsedEnv;
+  }
   logInfo(`Stage: ${stage}, Platform: ${platformEnv}, Tenant: ${tenant}`);
-  return { tenant, stage, platformEnv };
+  return { tenant, stage, platformEnv, detectedTenant };
 }
 var init_context = __esm({
   "libs/mesh-cli/src/utils/context.ts"() {
     "use strict";
+    init_errors();
     init_log();
+    init_mesh_json();
   }
 });
 
@@ -367,19 +641,19 @@ var init_credentials = __esm({
 
 // libs/mesh-cli/src/utils/pulumi.ts
 import { execFileSync } from "child_process";
-import * as path2 from "path";
-import * as fs2 from "fs";
+import * as path3 from "path";
+import * as fs3 from "fs";
 function findAppRoot(startDir) {
   let dir = startDir;
   while (true) {
-    if (fs2.existsSync(path2.join(dir, "Pulumi.yaml"))) return dir;
-    const parent = path2.dirname(dir);
+    if (fs3.existsSync(path3.join(dir, "Pulumi.yaml"))) return dir;
+    const parent = path3.dirname(dir);
     if (parent === dir) return null;
     dir = parent;
   }
 }
 function findStackConfigs(appRoot) {
-  return fs2.readdirSync(appRoot).filter((f) => /^Pulumi\..+\.yaml$/.test(f) && f !== "Pulumi.yaml").map((f) => f.replace(/^Pulumi\./, "").replace(/\.yaml$/, ""));
+  return fs3.readdirSync(appRoot).filter((f) => /^Pulumi\..+\.yaml$/.test(f) && f !== "Pulumi.yaml").map((f) => f.replace(/^Pulumi\./, "").replace(/\.yaml$/, ""));
 }
 function getCurrentStack(appRoot) {
   try {
@@ -394,9 +668,9 @@ function getCurrentStack(appRoot) {
   }
 }
 function readStackConfig(appRoot, stack, key) {
-  const configFile = path2.join(appRoot, `Pulumi.${stack}.yaml`);
-  if (!fs2.existsSync(configFile)) return null;
-  const content = fs2.readFileSync(configFile, "utf-8");
+  const configFile = path3.join(appRoot, `Pulumi.${stack}.yaml`);
+  if (!fs3.existsSync(configFile)) return null;
+  const content = fs3.readFileSync(configFile, "utf-8");
   const pattern = new RegExp(`^\\s+${key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}:\\s*(.+)$`, "m");
   const match = content.match(pattern);
   if (!match) return null;
@@ -438,7 +712,7 @@ var init_pulumi = __esm({
 
 // libs/mesh-cli/src/utils/vpn.ts
 import { execFile, execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync3 } from "node:fs";
+import { existsSync as existsSync4 } from "node:fs";
 async function isVpnConnected() {
   try {
     const stdout = await execTailscaleCmd(["status", "--json"]);
@@ -458,7 +732,7 @@ function headscaleDnsConfig(tenant = "mesh", env = "dev", overrides) {
   };
 }
 function execTailscaleCmd(args) {
-  const socketPath2 = TAILSCALE_SOCKET_PATHS.find(existsSync3);
+  const socketPath2 = TAILSCALE_SOCKET_PATHS.find(existsSync4);
   const attempts = [];
   for (const binary of TAILSCALE_PATHS) {
     if (socketPath2) {
@@ -466,7 +740,7 @@ function execTailscaleCmd(args) {
     }
     attempts.push({ binary, args });
   }
-  return new Promise((resolve19, reject) => {
+  return new Promise((resolve20, reject) => {
     let index = 0;
     function tryNext() {
       if (index >= attempts.length) {
@@ -478,7 +752,7 @@ function execTailscaleCmd(args) {
         if (error) {
           tryNext();
         } else {
-          resolve19(stdout);
+          resolve20(stdout);
         }
       });
     }
@@ -652,7 +926,7 @@ async function ensureTemporalNamespace(namespace, description) {
         });
         break;
       } catch {
-        await new Promise((resolve19) => setTimeout(resolve19, 1e3));
+        await new Promise((resolve20) => setTimeout(resolve20, 1e3));
       }
     }
     logSuccess(`Temporal namespace '${namespace}' is active`);
@@ -855,16 +1129,16 @@ async function upsertLocalSecret(secretId, value, client) {
 }
 function probeTcp(port, opts = {}) {
   const { host = "127.0.0.1", timeoutMs = 2e3 } = opts;
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     const socket = net.connect({ host, port, timeout: timeoutMs });
     socket.once("connect", () => {
       socket.destroy();
-      resolve19(true);
+      resolve20(true);
     });
-    socket.once("error", () => resolve19(false));
+    socket.once("error", () => resolve20(false));
     socket.once("timeout", () => {
       socket.destroy();
-      resolve19(false);
+      resolve20(false);
     });
   });
 }
@@ -957,15 +1231,15 @@ var init_helpers = __esm({
 });
 
 // libs/mesh-cli/src/utils/cache-home.ts
-import fs3 from "node:fs";
+import fs4 from "node:fs";
 import os from "node:os";
-import path3 from "node:path";
+import path4 from "node:path";
 function meshCacheHome() {
-  return process.env.MESH_CACHE_HOME || path3.join(os.homedir(), ".cache", "mesh");
+  return process.env.MESH_CACHE_HOME || path4.join(os.homedir(), ".cache", "mesh");
 }
 function meshCacheDir(...segments) {
-  const dir = path3.join(meshCacheHome(), ...segments);
-  fs3.mkdirSync(dir, { recursive: true });
+  const dir = path4.join(meshCacheHome(), ...segments);
+  fs4.mkdirSync(dir, { recursive: true });
   return dir;
 }
 var init_cache_home = __esm({
@@ -1005,8 +1279,8 @@ __export(stack_exports, {
   writeAppServiceProbes: () => writeAppServiceProbes
 });
 import { execFileSync as execFileSync4, spawn, spawnSync } from "child_process";
-import * as fs4 from "fs";
-import * as path4 from "path";
+import * as fs5 from "fs";
+import * as path5 from "path";
 import { fileURLToPath } from "url";
 import { parse as parseYaml } from "yaml";
 function localLogsDir() {
@@ -1030,8 +1304,8 @@ function writeAppServiceProbes(args) {
       target: name
     }
   }));
-  const file = path4.join(localProbesDir(), `${args.tenant}-${args.app}-services.json`);
-  fs4.writeFileSync(file, `${JSON.stringify(targets, null, 2)}
+  const file = path5.join(localProbesDir(), `${args.tenant}-${args.app}-services.json`);
+  fs5.writeFileSync(file, `${JSON.stringify(targets, null, 2)}
 `);
   return file;
 }
@@ -1063,17 +1337,17 @@ function hubEndpoints() {
   ];
 }
 function findPackageRoot(startDir) {
-  let dir = startDir ?? path4.dirname(fileURLToPath(import.meta.url));
+  let dir = startDir ?? path5.dirname(fileURLToPath(import.meta.url));
   for (let i = 0; i < 8; i++) {
-    const pkgPath = path4.join(dir, "package.json");
-    if (fs4.existsSync(pkgPath)) {
+    const pkgPath = path5.join(dir, "package.json");
+    if (fs5.existsSync(pkgPath)) {
       try {
-        const pkg = JSON.parse(fs4.readFileSync(pkgPath, "utf-8"));
+        const pkg = JSON.parse(fs5.readFileSync(pkgPath, "utf-8"));
         if (pkg.name === "@mesh-tech/mesh-cli") return dir;
       } catch {
       }
     }
-    const parent = path4.dirname(dir);
+    const parent = path5.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -1082,8 +1356,8 @@ function findPackageRoot(startDir) {
   });
 }
 function stackDir() {
-  const dir = path4.join(findPackageRoot(), "stack");
-  if (!fs4.existsSync(path4.join(dir, "docker-compose.yml"))) {
+  const dir = path5.join(findPackageRoot(), "stack");
+  if (!fs5.existsSync(path5.join(dir, "docker-compose.yml"))) {
     throw new MeshCliError(`Local stack assets not found at ${dir}.`, {
       remediation: { command: "npm install -g @mesh-tech/mesh-cli" }
     });
@@ -1096,13 +1370,13 @@ function parseComposeServiceNames(yamlText) {
 }
 function hubOverlayServices() {
   if (!hubOverlayServicesCache) {
-    const file = path4.join(stackDir(), HUB_OVERLAY_FILE);
-    if (!fs4.existsSync(file)) {
+    const file = path5.join(stackDir(), HUB_OVERLAY_FILE);
+    if (!fs5.existsSync(file)) {
       throw new MeshCliError(`Local stack assets are incomplete: ${file} is missing.`, {
         remediation: { command: "npm install -g @mesh-tech/mesh-cli" }
       });
     }
-    hubOverlayServicesCache = new Set(parseComposeServiceNames(fs4.readFileSync(file, "utf-8")));
+    hubOverlayServicesCache = new Set(parseComposeServiceNames(fs5.readFileSync(file, "utf-8")));
   }
   return hubOverlayServicesCache;
 }
@@ -1118,9 +1392,9 @@ function stackOwnedElsewhere() {
     if (!label) return void 0;
     const real = (p) => {
       try {
-        return fs4.realpathSync(p);
+        return fs5.realpathSync(p);
       } catch {
-        return path4.resolve(p);
+        return path5.resolve(p);
       }
     };
     return real(label) === real(stackDir()) ? void 0 : label;
@@ -1140,8 +1414,8 @@ function ensureDockerAvailable() {
 }
 function compose(args, opts = {}) {
   const dir = stackDir();
-  const files = ["-f", path4.join(dir, "docker-compose.yml")];
-  if (opts.hub) files.push("-f", path4.join(dir, "docker-compose.hub.yml"));
+  const files = ["-f", path5.join(dir, "docker-compose.yml")];
+  if (opts.hub) files.push("-f", path5.join(dir, "docker-compose.hub.yml"));
   const fullArgs = ["compose", "-p", COMPOSE_PROJECT, ...files, ...args];
   return execFileSync4("docker", fullArgs, {
     cwd: dir,
@@ -1171,12 +1445,12 @@ function summarizeComposeFailure(output) {
 }
 function composeLogPath(op) {
   const dir = meshCacheDir("mesh-local");
-  return path4.join(dir, `compose-${op.replace(/[^a-z0-9-]/gi, "_")}.log`);
+  return path5.join(dir, `compose-${op.replace(/[^a-z0-9-]/gi, "_")}.log`);
 }
 async function composeStreamed(args, opts = {}) {
   const dir = stackDir();
-  const files = ["-f", path4.join(dir, "docker-compose.yml")];
-  if (opts.hub) files.push("-f", path4.join(dir, "docker-compose.hub.yml"));
+  const files = ["-f", path5.join(dir, "docker-compose.yml")];
+  if (opts.hub) files.push("-f", path5.join(dir, "docker-compose.hub.yml"));
   const fullArgs = ["compose", "-p", COMPOSE_PROJECT, ...files, ...args];
   const env = {
     ...process.env,
@@ -1205,12 +1479,12 @@ async function composeStreamed(args, opts = {}) {
     return;
   }
   const logPath2 = composeLogPath(op);
-  const logStream = fs4.createWriteStream(logPath2);
+  const logStream = fs5.createWriteStream(logPath2);
   const heartbeat = startHeartbeat(`docker compose ${args.join(" ")}`);
   let captured = "";
   let exitCode;
   try {
-    exitCode = await new Promise((resolve19, reject) => {
+    exitCode = await new Promise((resolve20, reject) => {
       const child = spawn("docker", fullArgs, {
         cwd: dir,
         env,
@@ -1226,11 +1500,11 @@ async function composeStreamed(args, opts = {}) {
       child.stdout.on("data", consume);
       child.stderr.on("data", consume);
       child.on("error", reject);
-      child.on("close", (code) => resolve19(code ?? 1));
+      child.on("close", (code) => resolve20(code ?? 1));
     });
   } finally {
     heartbeat.stop();
-    await new Promise((resolve19) => logStream.end(resolve19));
+    await new Promise((resolve20) => logStream.end(resolve20));
   }
   if (exitCode !== 0) {
     throw new MeshCliError(
@@ -1400,8 +1674,17 @@ var init_stack = __esm({
 });
 
 // libs/mesh-cli/src/commands/skills.ts
-import * as fs5 from "fs";
-import * as path5 from "path";
+var skills_exports = {};
+__export(skills_exports, {
+  INTENT_RANGE: () => INTENT_RANGE,
+  listPackageSkills: () => listPackageSkills,
+  registerSkillsCommands: () => registerSkillsCommands,
+  resolveTargetRoot: () => resolveTargetRoot,
+  seedAppSkill: () => seedAppSkill,
+  syncSkills: () => syncSkills
+});
+import * as fs6 from "fs";
+import * as path6 from "path";
 import { execFileSync as execFileSync5 } from "child_process";
 function resolveTargetRoot(startDir = process.cwd()) {
   try {
@@ -1415,15 +1698,15 @@ function resolveTargetRoot(startDir = process.cwd()) {
   }
 }
 function cliAsset(...segments) {
-  return path5.join(findPackageRoot(), ...segments);
+  return path6.join(findPackageRoot(), ...segments);
 }
 function listBaseSkills() {
   const dir = cliAsset("skills");
-  if (!fs5.existsSync(dir)) return [];
-  return fs5.readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && fs5.existsSync(path5.join(dir, entry.name, "SKILL.md"))).map((entry) => ({ name: entry.name, source: path5.join(dir, entry.name, "SKILL.md") }));
+  if (!fs6.existsSync(dir)) return [];
+  return fs6.readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && fs6.existsSync(path6.join(dir, entry.name, "SKILL.md"))).map((entry) => ({ name: entry.name, source: path6.join(dir, entry.name, "SKILL.md") }));
 }
 function renderManagedSkill(source) {
-  const raw = fs5.readFileSync(source, "utf-8");
+  const raw = fs6.readFileSync(source, "utf-8");
   const frontmatter = raw.match(/^(---\n[\s\S]*?\n---\n)/)?.[1];
   if (!frontmatter) return `${MANAGED_MARKER}
 
@@ -1438,19 +1721,19 @@ function meshTechScopeDirs(root, maxDepth = 6) {
     if (depth > maxDepth) return;
     let entries;
     try {
-      entries = fs5.readdirSync(dir, { withFileTypes: true });
+      entries = fs6.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       if (entry.name === "node_modules") {
-        const scope = path5.join(dir, entry.name, "@mesh-tech");
-        if (fs5.existsSync(scope)) scopes.push(scope);
+        const scope = path6.join(dir, entry.name, "@mesh-tech");
+        if (fs6.existsSync(scope)) scopes.push(scope);
         continue;
       }
       if (entry.name.startsWith(".")) continue;
-      walk2(path5.join(dir, entry.name), depth + 1);
+      walk2(path6.join(dir, entry.name), depth + 1);
     }
   };
   walk2(root, 0);
@@ -1459,57 +1742,57 @@ function meshTechScopeDirs(root, maxDepth = 6) {
 function listPackageSkills(root) {
   const byName = /* @__PURE__ */ new Map();
   for (const scopeDir of meshTechScopeDirs(root)) {
-    for (const pkg of fs5.readdirSync(scopeDir, { withFileTypes: true })) {
+    for (const pkg of fs6.readdirSync(scopeDir, { withFileTypes: true })) {
       if (!pkg.isDirectory() && !pkg.isSymbolicLink()) continue;
       if (pkg.name === BASE_SKILL_PACKAGE) continue;
-      const skillsDir = path5.join(scopeDir, pkg.name, "skills");
-      if (!fs5.existsSync(skillsDir)) continue;
-      for (const domain of fs5.readdirSync(skillsDir, { withFileTypes: true })) {
-        const source = path5.join(skillsDir, domain.name, "SKILL.md");
-        if (!fs5.existsSync(source)) continue;
+      const skillsDir = path6.join(scopeDir, pkg.name, "skills");
+      if (!fs6.existsSync(skillsDir)) continue;
+      for (const domain of fs6.readdirSync(skillsDir, { withFileTypes: true })) {
+        const source = path6.join(skillsDir, domain.name, "SKILL.md");
+        if (!fs6.existsSync(source)) continue;
         const name = `mesh-${pkg.name}-${domain.name}`;
-        if (!byName.has(name)) byName.set(name, { name, dir: path5.join(skillsDir, domain.name), source });
+        if (!byName.has(name)) byName.set(name, { name, dir: path6.join(skillsDir, domain.name), source });
       }
     }
   }
   return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
 }
 function copySkillExtras(sourceDir, targetDir) {
-  for (const entry of fs5.readdirSync(sourceDir, { withFileTypes: true })) {
+  for (const entry of fs6.readdirSync(sourceDir, { withFileTypes: true })) {
     if (entry.name === "SKILL.md") continue;
-    fs5.cpSync(path5.join(sourceDir, entry.name), path5.join(targetDir, entry.name), { recursive: true });
+    fs6.cpSync(path6.join(sourceDir, entry.name), path6.join(targetDir, entry.name), { recursive: true });
   }
 }
 function seedAppSkill(root, appName, appRelPath) {
-  const target = path5.join(root, ".claude", "skills", appName, "SKILL.md");
-  if (fs5.existsSync(target)) return null;
-  const template = fs5.readFileSync(cliAsset("assets", "app-skill", "SKILL.md"), "utf-8");
+  const target = path6.join(root, ".claude", "skills", appName, "SKILL.md");
+  if (fs6.existsSync(target)) return null;
+  const template = fs6.readFileSync(cliAsset("assets", "app-skill", "SKILL.md"), "utf-8");
   const body = template.replaceAll("__APP_NAME__", appName).replaceAll("__APP_PATH__", appRelPath || ".");
-  fs5.mkdirSync(path5.dirname(target), { recursive: true });
-  fs5.writeFileSync(target, body);
-  return path5.relative(root, target);
+  fs6.mkdirSync(path6.dirname(target), { recursive: true });
+  fs6.writeFileSync(target, body);
+  return path6.relative(root, target);
 }
 function planSync(root) {
   const items = [];
   for (const skill of listBaseSkills()) {
-    const target = path5.join(root, ".claude", "skills", `mesh-${skill.name}`, "SKILL.md");
+    const target = path6.join(root, ".claude", "skills", `mesh-${skill.name}`, "SKILL.md");
     const desired = renderManagedSkill(skill.source);
     const label = `.claude/skills/mesh-${skill.name}/SKILL.md (base skill)`;
-    if (!fs5.existsSync(target)) {
+    if (!fs6.existsSync(target)) {
       items.push({
         label,
         state: "write",
         apply: () => {
-          fs5.mkdirSync(path5.dirname(target), { recursive: true });
-          fs5.writeFileSync(target, desired);
+          fs6.mkdirSync(path6.dirname(target), { recursive: true });
+          fs6.writeFileSync(target, desired);
         }
       });
     } else {
-      const current = fs5.readFileSync(target, "utf-8");
+      const current = fs6.readFileSync(target, "utf-8");
       if (current === desired) {
         items.push({ label, state: "ok" });
       } else if (current.includes(MANAGED_MARKER)) {
-        items.push({ label, state: "write", apply: () => fs5.writeFileSync(target, desired) });
+        items.push({ label, state: "write", apply: () => fs6.writeFileSync(target, desired) });
       } else {
         items.push({ label: `${label} \u2014 exists without the managed marker, leaving as-is`, state: "skip" });
       }
@@ -1517,22 +1800,22 @@ function planSync(root) {
   }
   const packageSkills = listPackageSkills(root);
   for (const skill of packageSkills) {
-    const targetDir = path5.join(root, ".claude", "skills", skill.name);
-    const target = path5.join(targetDir, "SKILL.md");
+    const targetDir = path6.join(root, ".claude", "skills", skill.name);
+    const target = path6.join(targetDir, "SKILL.md");
     const desired = renderManagedSkill(skill.source);
     const label = `.claude/skills/${skill.name}/SKILL.md (platform skill)`;
-    if (!fs5.existsSync(target)) {
+    if (!fs6.existsSync(target)) {
       items.push({
         label,
         state: "write",
         apply: () => {
-          fs5.mkdirSync(targetDir, { recursive: true });
-          fs5.writeFileSync(target, desired);
+          fs6.mkdirSync(targetDir, { recursive: true });
+          fs6.writeFileSync(target, desired);
           copySkillExtras(skill.dir, targetDir);
         }
       });
     } else {
-      const current = fs5.readFileSync(target, "utf-8");
+      const current = fs6.readFileSync(target, "utf-8");
       if (current === desired) {
         items.push({ label, state: "ok" });
       } else if (current.includes(MANAGED_MARKER)) {
@@ -1540,7 +1823,7 @@ function planSync(root) {
           label,
           state: "write",
           apply: () => {
-            fs5.writeFileSync(target, desired);
+            fs6.writeFileSync(target, desired);
             copySkillExtras(skill.dir, targetDir);
           }
         });
@@ -1553,24 +1836,24 @@ function planSync(root) {
     logInfo("No @mesh-tech packages installed yet \u2014 run `pnpm install`, then `mesh skills sync` again for the platform skills.");
   }
   const hookSource = cliAsset("assets", "intent", "intent-claude-gate.mjs");
-  const hookTarget = path5.join(root, HOOK_RELATIVE);
-  const hookDesired = fs5.readFileSync(hookSource, "utf-8");
-  const hookCurrent = fs5.existsSync(hookTarget) ? fs5.readFileSync(hookTarget, "utf-8") : null;
+  const hookTarget = path6.join(root, HOOK_RELATIVE);
+  const hookDesired = fs6.readFileSync(hookSource, "utf-8");
+  const hookCurrent = fs6.existsSync(hookTarget) ? fs6.readFileSync(hookTarget, "utf-8") : null;
   items.push(
     hookCurrent === hookDesired ? { label: `${HOOK_RELATIVE} (Intent gate)`, state: "ok" } : {
       label: `${HOOK_RELATIVE} (Intent gate)`,
       state: "write",
       apply: () => {
-        fs5.mkdirSync(path5.dirname(hookTarget), { recursive: true });
-        fs5.writeFileSync(hookTarget, hookDesired, { mode: 493 });
+        fs6.mkdirSync(path6.dirname(hookTarget), { recursive: true });
+        fs6.writeFileSync(hookTarget, hookDesired, { mode: 493 });
       }
     }
   );
-  const rootPkgPath = path5.join(root, "package.json");
-  if (fs5.existsSync(rootPkgPath)) {
+  const rootPkgPath = path6.join(root, "package.json");
+  if (fs6.existsSync(rootPkgPath)) {
     let rootPkg = null;
     try {
-      rootPkg = JSON.parse(fs5.readFileSync(rootPkgPath, "utf-8"));
+      rootPkg = JSON.parse(fs6.readFileSync(rootPkgPath, "utf-8"));
     } catch {
       rootPkg = null;
     }
@@ -1593,15 +1876,15 @@ function planSync(root) {
           rootPkg.devDependencies = Object.fromEntries(
             Object.entries(rootPkg.devDependencies).sort(([a], [b]) => a.localeCompare(b))
           );
-          fs5.writeFileSync(rootPkgPath, JSON.stringify(rootPkg, null, 2) + "\n");
+          fs6.writeFileSync(rootPkgPath, JSON.stringify(rootPkg, null, 2) + "\n");
         }
       });
     }
   }
-  const settingsPath = path5.join(root, ".claude", "settings.json");
+  const settingsPath = path6.join(root, ".claude", "settings.json");
   let settings = {};
   try {
-    settings = JSON.parse(fs5.readFileSync(settingsPath, "utf-8"));
+    settings = JSON.parse(fs6.readFileSync(settingsPath, "utf-8"));
   } catch {
     settings = {};
   }
@@ -1628,14 +1911,14 @@ function planSync(root) {
             }
           ]
         });
-        fs5.mkdirSync(path5.dirname(settingsPath), { recursive: true });
-        fs5.writeFileSync(settingsPath, JSON.stringify(settings, null, 1) + "\n");
+        fs6.mkdirSync(path6.dirname(settingsPath), { recursive: true });
+        fs6.writeFileSync(settingsPath, JSON.stringify(settings, null, 1) + "\n");
       }
     }
   );
-  const agentsPath = path5.join(root, "AGENTS.md");
-  const fence2 = fs5.readFileSync(cliAsset("assets", "intent", "agents-fence.md"), "utf-8");
-  const agentsCurrent = fs5.existsSync(agentsPath) ? fs5.readFileSync(agentsPath, "utf-8") : null;
+  const agentsPath = path6.join(root, "AGENTS.md");
+  const fence2 = fs6.readFileSync(cliAsset("assets", "intent", "agents-fence.md"), "utf-8");
+  const agentsCurrent = fs6.existsSync(agentsPath) ? fs6.readFileSync(agentsPath, "utf-8") : null;
   items.push(
     agentsCurrent?.includes(FENCE_START) ? { label: "AGENTS.md (intent-skills fence)", state: "ok" } : {
       label: "AGENTS.md (intent-skills fence)",
@@ -1645,7 +1928,7 @@ function planSync(root) {
 ${agentsCurrent}` : `${fence2}
 # Agent Instructions
 `;
-        fs5.writeFileSync(agentsPath, next);
+        fs6.writeFileSync(agentsPath, next);
       }
     }
   );
@@ -1679,7 +1962,7 @@ function registerSkillsCommands(program2) {
   skills.command("sync").description(
     "Install the base building-with-Mesh skills into .claude/skills/, fetch the platform skills shipped by the repo's installed @mesh-tech/* packages, and wire TanStack-Intent discovery (intent devDependency + hook + settings + AGENTS.md fence)"
   ).option("--check", "verify only (CI/doctor): exit 1 when anything is missing or stale", false).option("--root <path>", "target repo root (default: enclosing git root)").action((opts) => {
-    const root = path5.resolve(opts.root ?? resolveTargetRoot());
+    const root = path6.resolve(opts.root ?? resolveTargetRoot());
     const ok = syncSkills(root, { check: opts.check });
     if (opts.check && !ok) {
       throw new MeshCliError("Agent skills are missing or stale.", {
@@ -1697,7 +1980,7 @@ var init_skills = __esm({
     init_stack();
     MANAGED_MARKER = "<!-- managed-by: mesh skills sync \u2014 edits are overwritten; copy content elsewhere to customize -->";
     FENCE_START = "<!-- intent-skills:start -->";
-    HOOK_RELATIVE = path5.join(".intent", "hooks", "intent-claude-gate.mjs");
+    HOOK_RELATIVE = path6.join(".intent", "hooks", "intent-claude-gate.mjs");
     INTENT_RANGE = "^0.3.6";
     BASE_SKILL_PACKAGE = "mesh-cli";
   }
@@ -1769,20 +2052,20 @@ var init_pid = __esm({
 
 // libs/mesh-cli/src/utils/tailscale-targets.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
-import * as fs6 from "node:fs";
-import * as path6 from "node:path";
+import * as fs7 from "node:fs";
+import * as path7 from "node:path";
 function tenantPortIndex(tenant, registryPath) {
-  const p = registryPath ?? path6.join(CONFIG_DIR, "tailscale", "port-registry.json");
+  const p = registryPath ?? path7.join(CONFIG_DIR, "tailscale", "port-registry.json");
   let reg;
   try {
-    reg = JSON.parse(fs6.readFileSync(p, "utf8"));
+    reg = JSON.parse(fs7.readFileSync(p, "utf8"));
   } catch {
     reg = { mesh: 0 };
   }
   if (tenant in reg) return reg[tenant];
   const idx = Math.max(-1, ...Object.values(reg)) + 1;
   reg[tenant] = idx;
-  fs6.mkdirSync(path6.dirname(p), { recursive: true });
+  fs7.mkdirSync(path7.dirname(p), { recursive: true });
   atomicWriteFileSync(p, JSON.stringify(reg, null, 2), 384);
   return idx;
 }
@@ -1909,29 +2192,29 @@ var init_socks_forward = __esm({
 
 // libs/mesh-cli/src/utils/tunnel-ownership.ts
 import * as crypto from "node:crypto";
-import * as fs7 from "node:fs";
+import * as fs8 from "node:fs";
 import * as net3 from "node:net";
-import * as path7 from "node:path";
+import * as path8 from "node:path";
 import { execFileSync as execFileSync7 } from "node:child_process";
 function mintRunnerToken() {
   return crypto.randomBytes(16).toString("hex");
 }
 function readRunnerManifest(file) {
-  if (!fs7.existsSync(file)) return null;
+  if (!fs8.existsSync(file)) return null;
   try {
-    return JSON.parse(fs7.readFileSync(file, "utf8"));
+    return JSON.parse(fs8.readFileSync(file, "utf8"));
   } catch {
     return null;
   }
 }
 function writeRunnerManifest(file, manifest) {
-  fs7.mkdirSync(path7.dirname(file), { recursive: true });
-  fs7.writeFileSync(file, JSON.stringify(manifest, null, 2), { mode: 384 });
+  fs8.mkdirSync(path8.dirname(file), { recursive: true });
+  fs8.writeFileSync(file, JSON.stringify(manifest, null, 2), { mode: 384 });
 }
 function clearRunnerManifest(file, token) {
   if (token !== void 0 && readRunnerManifest(file)?.token !== token) return;
   try {
-    fs7.unlinkSync(file);
+    fs8.unlinkSync(file);
   } catch {
   }
 }
@@ -1973,7 +2256,7 @@ function discoverRunnerPids(tenant, exclude) {
   }
 }
 function startControlServer(payload) {
-  return new Promise((resolve19, reject) => {
+  return new Promise((resolve20, reject) => {
     const server = net3.createServer((socket) => {
       socket.on("error", () => {
       });
@@ -1986,12 +2269,12 @@ function startControlServer(payload) {
     });
     server.on("error", reject);
     server.listen(0, "127.0.0.1", () => {
-      resolve19({ server, port: server.address().port });
+      resolve20({ server, port: server.address().port });
     });
   });
 }
 function queryControl(port, timeoutMs = 700) {
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     const s = new net3.Socket();
     let buf = "";
     let done = false;
@@ -1999,7 +2282,7 @@ function queryControl(port, timeoutMs = 700) {
       if (done) return;
       done = true;
       s.destroy();
-      resolve19(v);
+      resolve20(v);
     };
     s.setTimeout(timeoutMs);
     s.once("timeout", () => fin(null));
@@ -2100,64 +2383,64 @@ var init_tunnel_ownership = __esm({
 });
 
 // libs/mesh-cli/src/utils/tailscale.ts
-import * as fs8 from "node:fs";
+import * as fs9 from "node:fs";
 import * as net4 from "node:net";
 import * as os2 from "node:os";
-import * as path8 from "node:path";
+import * as path9 from "node:path";
 import { spawn as spawn2, execFileSync as execFileSync8 } from "node:child_process";
 function tenantStateDir(tenant) {
-  return path8.join(CONFIG_DIR, "tailscale", tenant);
+  return path9.join(CONFIG_DIR, "tailscale", tenant);
 }
 function socketPath(tenant) {
-  return path8.join(tenantStateDir(tenant), "tailscaled.sock");
+  return path9.join(tenantStateDir(tenant), "tailscaled.sock");
 }
 function logPath(tenant) {
-  return path8.join(tenantStateDir(tenant), "tailscaled.log");
+  return path9.join(tenantStateDir(tenant), "tailscaled.log");
 }
 function statePath(tenant) {
-  return path8.join(tenantStateDir(tenant), "tunnel-state.json");
+  return path9.join(tenantStateDir(tenant), "tunnel-state.json");
 }
 function daemonMetaPath(tenant) {
-  return path8.join(tenantStateDir(tenant), "daemon.json");
+  return path9.join(tenantStateDir(tenant), "daemon.json");
 }
 function runnerManifestPath(tenant) {
-  return path8.join(tenantStateDir(tenant), "runner.json");
+  return path9.join(tenantStateDir(tenant), "runner.json");
 }
 function readTunnelState(tenant) {
   const p = statePath(tenant);
-  if (!fs8.existsSync(p)) return null;
+  if (!fs9.existsSync(p)) return null;
   try {
-    return JSON.parse(fs8.readFileSync(p, "utf8"));
+    return JSON.parse(fs9.readFileSync(p, "utf8"));
   } catch {
     return null;
   }
 }
 function writeTunnelState(tenant, state) {
-  fs8.mkdirSync(tenantStateDir(tenant), { recursive: true });
+  fs9.mkdirSync(tenantStateDir(tenant), { recursive: true });
   atomicWriteFileSync(statePath(tenant), JSON.stringify(state, null, 2), 384);
 }
 function clearTunnelState(tenant) {
   try {
-    fs8.unlinkSync(statePath(tenant));
+    fs9.unlinkSync(statePath(tenant));
   } catch {
   }
 }
 function readDaemonMeta(tenant) {
   const p = daemonMetaPath(tenant);
-  if (!fs8.existsSync(p)) return null;
+  if (!fs9.existsSync(p)) return null;
   try {
-    return JSON.parse(fs8.readFileSync(p, "utf8"));
+    return JSON.parse(fs9.readFileSync(p, "utf8"));
   } catch {
     return null;
   }
 }
 function writeDaemonMeta(tenant, meta) {
-  fs8.mkdirSync(tenantStateDir(tenant), { recursive: true });
+  fs9.mkdirSync(tenantStateDir(tenant), { recursive: true });
   atomicWriteFileSync(daemonMetaPath(tenant), JSON.stringify(meta, null, 2), 384);
 }
 function clearDaemonMeta(tenant) {
   try {
-    fs8.unlinkSync(daemonMetaPath(tenant));
+    fs9.unlinkSync(daemonMetaPath(tenant));
   } catch {
   }
 }
@@ -2177,7 +2460,7 @@ function tailscaleBinPath() {
 }
 function resolveBrewBin(name) {
   const brew = `/opt/homebrew/bin/${name}`;
-  if (fs8.existsSync(brew)) return brew;
+  if (fs9.existsSync(brew)) return brew;
   try {
     const p = execFileSync8("which", [name], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
     if (p) return p;
@@ -2186,7 +2469,7 @@ function resolveBrewBin(name) {
   throw new Error(`${name} not found \u2014 install the standalone binary: brew install tailscale`);
 }
 function daemonState(tenant) {
-  if (!fs8.existsSync(socketPath(tenant))) return { backendState: "Down" };
+  if (!fs9.existsSync(socketPath(tenant))) return { backendState: "Down" };
   try {
     const out = execFileSync8(
       tailscaleBinPath(),
@@ -2224,14 +2507,14 @@ function findRunningDaemon(tenant) {
   return null;
 }
 function portAccepts(port, timeoutMs = 400) {
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     const s = new net4.Socket();
     let done = false;
     const fin = (v) => {
       if (done) return;
       done = true;
       s.destroy();
-      resolve19(v);
+      resolve20(v);
     };
     s.setTimeout(timeoutMs);
     s.once("connect", () => fin(true));
@@ -2260,8 +2543,8 @@ async function ensureDaemon(tenant, opts) {
     }
   }
   const dir = tenantStateDir(tenant);
-  fs8.mkdirSync(dir, { recursive: true });
-  const log = fs8.openSync(logPath(tenant), "a");
+  fs9.mkdirSync(dir, { recursive: true });
+  const log = fs9.openSync(logPath(tenant), "a");
   try {
     const child = spawn2(
       tailscaledBinPath(),
@@ -2281,7 +2564,7 @@ async function ensureDaemon(tenant, opts) {
     child.unref();
     if (child.pid) writeDaemonMeta(tenant, { socksPort: opts.socksPort, pid: child.pid });
   } finally {
-    fs8.closeSync(log);
+    fs9.closeSync(log);
   }
   for (let i = 0; i < 40; i++) {
     await sleep(250);
@@ -2307,7 +2590,7 @@ function stopDaemon(tenant) {
   }
   for (const p of [socketPath(tenant)]) {
     try {
-      fs8.unlinkSync(p);
+      fs9.unlinkSync(p);
     } catch {
     }
   }
@@ -2452,7 +2735,7 @@ async function assertTunnelPortsFree(tenant, ports) {
 async function ensureForwarders(state) {
   const prior = readTunnelState(state.tenant);
   const expected = { socksPort: state.socksPort, ports: state.tunnels.map((t) => t.localPort) };
-  const runnerAlive = prior?.managed === "launchd" ? fs8.existsSync(launchAgentPath(state.tenant)) : pidAlive(prior?.supervisorPid);
+  const runnerAlive = prior?.managed === "launchd" ? fs9.existsSync(launchAgentPath(state.tenant)) : pidAlive(prior?.supervisorPid);
   if (prior && runnerAlive && tunnelTargetsEqual(prior.tunnels, state.tunnels) && // A prior supervisor spawned for a DIFFERENT SOCKS port still binds the same
   // local ports but dials a dead upstream — reusing it silently strands every
   // tunnel. The port must match, and the runner must PROVE it is
@@ -2477,7 +2760,7 @@ async function ensureForwarders(state) {
   if (launchdAvailable()) {
     state.managed = "launchd";
     writeTunnelState(state.tenant, state);
-    if (path8.isAbsolute(meshBin) && installLaunchAgent(state.tenant, meshBin)) {
+    if (path9.isAbsolute(meshBin) && installLaunchAgent(state.tenant, meshBin)) {
       if ((await awaitOwnership(state.tenant, expected, 8e3)).ok) return 0;
       uninstallLaunchAgent(state.tenant);
       await assertTunnelPortsFree(state.tenant, expected.ports);
@@ -2605,7 +2888,7 @@ function forwardersNeedingRebind(targets, listening) {
   return targets.filter((t) => !listening.has(t.localPort));
 }
 function launchAgentPath(tenant) {
-  return path8.join(os2.homedir(), "Library", "LaunchAgents", `${launchAgentLabel(tenant)}.plist`);
+  return path9.join(os2.homedir(), "Library", "LaunchAgents", `${launchAgentLabel(tenant)}.plist`);
 }
 function guiDomain() {
   return `gui/${process.getuid?.() ?? 0}`;
@@ -2626,22 +2909,22 @@ function installLaunchAgent(tenant, meshBin) {
   try {
     let realMeshBin = meshBin;
     try {
-      realMeshBin = fs8.realpathSync(meshBin);
+      realMeshBin = fs9.realpathSync(meshBin);
     } catch {
     }
     let pathEnv = "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin";
     try {
-      pathEnv = `${path8.dirname(tailscaledBinPath())}:${pathEnv}`;
+      pathEnv = `${path9.dirname(tailscaledBinPath())}:${pathEnv}`;
     } catch {
     }
-    fs8.mkdirSync(path8.dirname(plistPath), { recursive: true });
-    fs8.writeFileSync(
+    fs9.mkdirSync(path9.dirname(plistPath), { recursive: true });
+    fs9.writeFileSync(
       plistPath,
       renderLaunchAgentPlist({
         tenant,
         meshBin: realMeshBin,
         nodeBin: process.execPath,
-        logPath: path8.join(tenantStateDir(tenant), "runner.log"),
+        logPath: path9.join(tenantStateDir(tenant), "runner.log"),
         pathEnv
       })
     );
@@ -2662,7 +2945,7 @@ function uninstallLaunchAgent(tenant) {
   } catch {
   }
   try {
-    fs8.unlinkSync(plistPath);
+    fs9.unlinkSync(plistPath);
   } catch {
   }
 }
@@ -2769,24 +3052,24 @@ function deriveLoginServer(context) {
   return `https://${parts.join(".")}`;
 }
 function findFreePort() {
-  return new Promise((resolve19, reject) => {
+  return new Promise((resolve20, reject) => {
     const s = net5.createServer();
     s.on("error", reject);
     s.listen(0, "127.0.0.1", () => {
       const port = s.address().port;
-      s.close(() => resolve19(port));
+      s.close(() => resolve20(port));
     });
   });
 }
 function canConnect(port) {
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     const s = new net5.Socket();
     let settled = false;
     const done = (ok) => {
       if (settled) return;
       settled = true;
       s.destroy();
-      resolve19(ok);
+      resolve20(ok);
     };
     s.setTimeout(500);
     s.once("connect", () => done(true));
@@ -3145,13 +3428,13 @@ function parseContextTenantEnv(context) {
   return { tenant: tenant || "mesh", env: env || "dev" };
 }
 function findFreePort2() {
-  return new Promise((resolve19, reject) => {
+  return new Promise((resolve20, reject) => {
     const srv = net6.createServer();
     srv.on("error", reject);
     srv.listen(0, "127.0.0.1", () => {
       const addr = srv.address();
       const port = typeof addr === "object" && addr ? addr.port : 0;
-      srv.close(() => resolve19(port));
+      srv.close(() => resolve20(port));
     });
   });
 }
@@ -3374,18 +3657,19 @@ __export(login_exports, {
   resolveRoleOrExplain: () => resolveRoleOrExplain,
   resolveUserAwsConfigPath: () => resolveUserAwsConfigPath,
   runLoginFlow: () => runLoginFlow,
+  shorthandContext: () => shorthandContext,
   tokenStillValid: () => tokenStillValid,
   writeContextConfig: () => writeContextConfig
 });
 import * as http from "http";
 import * as crypto2 from "crypto";
-import * as fs9 from "fs";
-import * as path9 from "path";
+import * as fs10 from "fs";
+import * as path10 from "path";
 import { execFileSync as execFileSync10 } from "child_process";
 function readConfig() {
-  if (!fs9.existsSync(CONFIG_FILE)) return {};
+  if (!fs10.existsSync(CONFIG_FILE)) return {};
   try {
-    return JSON.parse(fs9.readFileSync(CONFIG_FILE, "utf-8"));
+    return JSON.parse(fs10.readFileSync(CONFIG_FILE, "utf-8"));
   } catch {
     return {};
   }
@@ -3393,15 +3677,15 @@ function readConfig() {
 function writeContextConfig(context, config) {
   const existing = readConfig();
   existing[context] = config;
-  fs9.mkdirSync(CONFIG_DIR, { recursive: true });
-  fs9.writeFileSync(CONFIG_FILE, JSON.stringify(existing, null, 2));
+  fs10.mkdirSync(CONFIG_DIR, { recursive: true });
+  fs10.writeFileSync(CONFIG_FILE, JSON.stringify(existing, null, 2));
 }
 function clearContextConfig(context) {
   const existing = readConfig();
   if (!(context in existing)) return;
   delete existing[context];
-  fs9.mkdirSync(CONFIG_DIR, { recursive: true });
-  fs9.writeFileSync(CONFIG_FILE, JSON.stringify(existing, null, 2));
+  fs10.mkdirSync(CONFIG_DIR, { recursive: true });
+  fs10.writeFileSync(CONFIG_FILE, JSON.stringify(existing, null, 2));
 }
 function getContextConfig(context) {
   const config = readConfig();
@@ -3509,9 +3793,9 @@ function discoverConfigFromWellKnown(domain, contextKey = domain, opts = {}) {
   return discoverConfig(domain, contextKey, opts);
 }
 function readAllCredentials() {
-  if (!fs9.existsSync(CREDENTIALS_FILE)) return {};
+  if (!fs10.existsSync(CREDENTIALS_FILE)) return {};
   try {
-    return JSON.parse(fs9.readFileSync(CREDENTIALS_FILE, "utf-8"));
+    return JSON.parse(fs10.readFileSync(CREDENTIALS_FILE, "utf-8"));
   } catch {
     return {};
   }
@@ -3519,21 +3803,21 @@ function readAllCredentials() {
 function readCredentials(context) {
   return readAllCredentials()[context] ?? null;
 }
-function atomicWriteFileSync(path46, data, mode) {
-  const tmpPath = `${path46}.${process.pid}.${atomicWriteCounter++}.tmp`;
+function atomicWriteFileSync(path47, data, mode) {
+  const tmpPath = `${path47}.${process.pid}.${atomicWriteCounter++}.tmp`;
   try {
-    fs9.writeFileSync(tmpPath, data, { mode });
-    fs9.renameSync(tmpPath, path46);
+    fs10.writeFileSync(tmpPath, data, { mode });
+    fs10.renameSync(tmpPath, path47);
   } catch (err) {
     try {
-      fs9.unlinkSync(tmpPath);
+      fs10.unlinkSync(tmpPath);
     } catch {
     }
     throw err;
   }
 }
 function writeCredentials(context, creds) {
-  fs9.mkdirSync(CONFIG_DIR, { recursive: true });
+  fs10.mkdirSync(CONFIG_DIR, { recursive: true });
   const all = readAllCredentials();
   all[context] = creds;
   atomicWriteFileSync(CREDENTIALS_FILE, JSON.stringify(all, null, 2), 384);
@@ -3541,8 +3825,8 @@ function writeCredentials(context, creds) {
 function clearCredentials(context) {
   const all = readAllCredentials();
   delete all[context];
-  fs9.mkdirSync(CONFIG_DIR, { recursive: true });
-  fs9.writeFileSync(CREDENTIALS_FILE, JSON.stringify(all, null, 2), {
+  fs10.mkdirSync(CONFIG_DIR, { recursive: true });
+  fs10.writeFileSync(CREDENTIALS_FILE, JSON.stringify(all, null, 2), {
     mode: 384
   });
 }
@@ -3596,7 +3880,7 @@ async function refreshTokens(issuer, clientId, refreshToken) {
   return resp.json();
 }
 function login(context, config) {
-  return new Promise((resolve19, reject) => {
+  return new Promise((resolve20, reject) => {
     const codeVerifier = generateCodeVerifier();
     const codeChallenge = generateCodeChallenge(codeVerifier);
     const state = base64url(crypto2.randomBytes(16));
@@ -3680,7 +3964,7 @@ function login(context, config) {
         }
         hintVpnIfDisconnected(context);
         teardown();
-        resolve19();
+        resolve20();
       } catch (err) {
         teardown();
         reject(err);
@@ -3821,7 +4105,7 @@ function loginTimeoutMessage(context) {
 }
 function isRemoteEnvironment() {
   if (process.env.REMOTE_CONTAINERS || process.env.CODESPACES) return true;
-  if (fs9.existsSync("/.dockerenv")) return true;
+  if (fs10.existsSync("/.dockerenv")) return true;
   if (process.env.SSH_CLIENT || process.env.SSH_TTY) return true;
   if (!process.stdout.isTTY || !process.stdin.isTTY) return true;
   return false;
@@ -3967,7 +4251,9 @@ async function showStatus(context, config) {
   }
 }
 function registerLoginCommand(program2) {
-  program2.command("login").description("Authenticate with Zitadel (OIDC PKCE or Device Code)").argument("<context>", 'Platform context (e.g., "mesh.dev")').option(
+  program2.command("login").description(
+    "PLATFORM access: sign in to a deployed Mesh platform (`<tenant>.<env>`) \u2014 what `mesh deploy`, `mesh stack`, the Hub and the VPN use. It never touches your ~/.npmrc, and you do not need it to install packages: that is `mesh registry login`. OIDC PKCE, or device code with --device."
+  ).argument("<context>", 'Platform context (e.g., "mesh.dev")').option(
     "--status",
     "Show current authentication status \u2014 the Zitadel session if one is cached, otherwise the AWS identity the credential chain resolves (SSO profile or key pair). Exits non-zero only when neither works."
   ).option("--device", "Force device code flow (no callback server needed)").option(
@@ -4021,7 +4307,7 @@ function registerLoginCommand(program2) {
     }
     await hintRegistryIfMissing();
   });
-  program2.command("logout").description("Clear cached Zitadel credentials").argument("<context>", 'Platform context (e.g., "mesh.dev")').action((context) => {
+  program2.command("logout").description("Clear a platform context's cached credentials (the package-registry session under `mesh registry` is untouched)").argument("<context>", 'Platform context (e.g., "mesh.dev")').action((context) => {
     refuseReservedRegistryContext(context, "logout");
     clearCredentials(context);
     logSuccess(`Logged out of ${context}. Credentials cleared.`);
@@ -4046,8 +4332,17 @@ async function hintRegistryIfMissing() {
   } catch {
   }
 }
+function shorthandContext(context) {
+  const parts = context.split(".");
+  if (parts.length !== 2) return null;
+  const [tenant, env] = parts;
+  return tenant && env ? { tenant, env } : null;
+}
 function renderNoConfigHelp(context) {
   const pinned = firstPartyDomainFor(context);
+  const shorthand = shorthandContext(context);
+  const createOne = shorthand ? `mesh init --tenant ${shorthand.tenant} --new-platform ${shorthand.env}` : "mesh init --tenant <tenant> --new-platform <env>";
+  const scaffoldOne = `mesh init platform ${shorthand?.tenant ?? "<tenant>"} --domain <a domain you control>`;
   return `No configuration found for "${context}".
 
 Tried:
@@ -4059,6 +4354,8 @@ Tried:
      (only attempted for a full domain, or a known first-party context)
 
 `) + `To fix:
+  - No platform deployed yet? Create one: ${createOne}
+    (or the scaffold on its own: ${scaffoldOne})
   - Use the platform's full domain: mesh login <env>.<tenant>.meshtech.io
   - Or, if you have AWS access, ensure SSO is active: aws sso login --profile <profile>
   - Or add config manually to ${CONFIG_FILE}:
@@ -4159,12 +4456,12 @@ export AWS_REGION=${shellSingleQuote(args.region)}
 `;
 }
 function resolveUserAwsConfigPath(env = process.env) {
-  return env.AWS_CONFIG_FILE ?? path9.join(env.HOME ?? "~", ".aws", "config");
+  return env.AWS_CONFIG_FILE ?? path10.join(env.HOME ?? "~", ".aws", "config");
 }
 function canWriteDir(dir) {
   try {
-    fs9.mkdirSync(dir, { recursive: true });
-    fs9.accessSync(dir, fs9.constants.W_OK);
+    fs10.mkdirSync(dir, { recursive: true });
+    fs10.accessSync(dir, fs10.constants.W_OK);
     return true;
   } catch {
     return false;
@@ -4172,9 +4469,9 @@ function canWriteDir(dir) {
 }
 function resolveAwsConfigTarget(env = process.env) {
   if (env.AWS_CONFIG_FILE) return { configPath: env.AWS_CONFIG_FILE, redirected: false };
-  const real = path9.join(env.HOME ?? "~", ".aws", "config");
-  if (canWriteDir(path9.dirname(real))) return { configPath: real, redirected: false };
-  return { configPath: path9.join(CONFIG_DIR, "aws-config"), redirected: true };
+  const real = path10.join(env.HOME ?? "~", ".aws", "config");
+  if (canWriteDir(path10.dirname(real))) return { configPath: real, redirected: false };
+  return { configPath: path10.join(CONFIG_DIR, "aws-config"), redirected: true };
 }
 function resolveRoleOrExplain(opts, config) {
   const role = opts.role ?? process.env.MESH_AWS_ROLE ?? config.defaultRole;
@@ -4294,10 +4591,10 @@ async function exportAwsCredentials(context, config, opts) {
   const sanitized = context.replace(/[^A-Za-z0-9_-]/g, "-");
   const profileName = `mesh-${sanitized}`;
   const { configPath, redirected } = resolveAwsConfigTarget();
-  fs9.mkdirSync(path9.dirname(configPath), { recursive: true });
-  const existedBefore = fs9.existsSync(configPath);
-  const existing = existedBefore ? fs9.readFileSync(configPath, "utf-8") : "";
-  const mode = existedBefore ? fs9.statSync(configPath).mode & 511 : 384;
+  fs10.mkdirSync(path10.dirname(configPath), { recursive: true });
+  const existedBefore = fs10.existsSync(configPath);
+  const existing = existedBefore ? fs10.readFileSync(configPath, "utf-8") : "";
+  const mode = existedBefore ? fs10.statSync(configPath).mode & 511 : 384;
   atomicWriteFileSync(
     configPath,
     upsertManagedAwsConfigSection(
@@ -4365,12 +4662,12 @@ var init_login = __esm({
     init_aws_auth();
     init_first_party_contexts();
     init_vpn2();
-    CONFIG_DIR = path9.join(
-      process.env.XDG_CONFIG_HOME ?? path9.join(process.env.HOME ?? "~", ".config"),
+    CONFIG_DIR = path10.join(
+      process.env.XDG_CONFIG_HOME ?? path10.join(process.env.HOME ?? "~", ".config"),
       "mesh"
     );
-    CONFIG_FILE = path9.join(CONFIG_DIR, "config.json");
-    CREDENTIALS_FILE = path9.join(CONFIG_DIR, "credentials.json");
+    CONFIG_FILE = path10.join(CONFIG_DIR, "config.json");
+    CREDENTIALS_FILE = path10.join(CONFIG_DIR, "credentials.json");
     REDIRECT_PORT = 9876;
     REDIRECT_URI = `http://localhost:${REDIRECT_PORT}/callback`;
     SCOPES = "openid email profile offline_access urn:zitadel:iam:org:project:id:zitadel:aud";
@@ -4487,6 +4784,7 @@ __export(registry_identity_exports, {
   logRegistryIdentity: () => logRegistryIdentity,
   readRegistrySession: () => readRegistrySession,
   refreshRegistrySession: () => refreshRegistrySession,
+  registryAccountState: () => registryAccountState,
   registrySessionCandidates: () => registrySessionCandidates,
   registryTokenRoles: () => registryTokenRoles,
   resolveRegistryIdentity: () => resolveRegistryIdentity
@@ -4600,6 +4898,19 @@ function registryTokenRoles(idToken) {
     return [];
   }
 }
+function registryAccountState(idToken) {
+  if (!idToken) return {};
+  let claims = null;
+  try {
+    claims = decodeJwtPayload(idToken);
+  } catch {
+    return {};
+  }
+  if (!claims) return {};
+  const email = typeof claims.email === "string" ? claims.email : void 0;
+  const verified = claims.email_verified;
+  return { email, emailVerified: typeof verified === "boolean" ? verified : void 0 };
+}
 async function refreshRegistrySession(context) {
   const before = registryTokenRoles(readCredentials(context)?.idToken);
   const idToken = await forceRefreshToken(context);
@@ -4689,14 +5000,14 @@ __export(auth_preflight_exports, {
   stripUnscopedCodeArtifactRegistry: () => stripUnscopedCodeArtifactRegistry,
   upsertNpmrcLines: () => upsertNpmrcLines
 });
-import * as fs10 from "fs";
+import * as fs11 from "fs";
 import * as os3 from "os";
-import * as path10 from "path";
+import * as path11 from "path";
 function registryLoginFix() {
   return REGISTRY_LOGIN_FIX;
 }
 function homeNpmrcPath() {
-  return path10.join(os3.homedir(), ".npmrc");
+  return path11.join(os3.homedir(), ".npmrc");
 }
 function parseNpmrcRegistryAuth(content) {
   for (const line of content.split("\n")) {
@@ -4761,7 +5072,7 @@ async function probeRegistryToken(opts) {
   const fetchFn = opts?.fetchFn ?? fetch;
   let auth = null;
   try {
-    auth = parseNpmrcRegistryAuth(fs10.readFileSync(npmrcPath2, "utf-8"));
+    auth = parseNpmrcRegistryAuth(fs11.readFileSync(npmrcPath2, "utf-8"));
   } catch {
   }
   if (!auth) return { state: "missing" };
@@ -4826,16 +5137,16 @@ function awsConfigHasProfile(content, profile) {
   return content.split("\n").some((line) => pattern.test(line.trim()));
 }
 function readAwsConfig() {
-  const file = process.env.AWS_CONFIG_FILE ?? path10.join(os3.homedir(), ".aws", "config");
+  const file = process.env.AWS_CONFIG_FILE ?? path11.join(os3.homedir(), ".aws", "config");
   try {
-    return fs10.readFileSync(file, "utf-8");
+    return fs11.readFileSync(file, "utf-8");
   } catch {
     return "";
   }
 }
 function appUsesMeshPackages(appRoot) {
   try {
-    const pkg = JSON.parse(fs10.readFileSync(path10.join(appRoot, "package.json"), "utf-8"));
+    const pkg = JSON.parse(fs11.readFileSync(path11.join(appRoot, "package.json"), "utf-8"));
     return [pkg.dependencies, pkg.devDependencies, pkg.optionalDependencies].some(
       (deps) => deps && Object.keys(deps).some((name) => name.startsWith("@mesh-tech/"))
     );
@@ -4858,8 +5169,8 @@ sso_registration_scopes = sso:account:access`;
 });
 
 // libs/mesh-cli/src/utils/aws-auth.ts
-import * as fs11 from "fs";
-import * as path11 from "path";
+import * as fs12 from "fs";
+import * as path12 from "path";
 import {
   AssumeRoleCommand,
   AssumeRoleWithWebIdentityCommand,
@@ -4867,9 +5178,9 @@ import {
   STSClient
 } from "@aws-sdk/client-sts";
 function derivePlatformContext(appRoot, stack) {
-  const configFile = path11.join(appRoot, `Pulumi.${stack}.yaml`);
-  if (!fs11.existsSync(configFile)) return null;
-  const content = fs11.readFileSync(configFile, "utf-8");
+  const configFile = path12.join(appRoot, `Pulumi.${stack}.yaml`);
+  if (!fs12.existsSync(configFile)) return null;
+  const content = fs12.readFileSync(configFile, "utf-8");
   const jsonMatch = content.match(/mesh:platform:\s*'(\{[^']+\})'/);
   if (jsonMatch) {
     try {
@@ -4889,11 +5200,11 @@ function quoteCredProcessToken(token) {
   return /\s/.test(token) ? `"${token}"` : token;
 }
 function resolveStableMeshBin(argv1, deps = {}) {
-  const exists = deps.exists ?? fs11.existsSync;
+  const exists = deps.exists ?? fs12.existsSync;
   const warn = deps.warn ?? logWarn;
-  let resolved = argv1 ? path11.resolve(argv1) : void 0;
+  let resolved = argv1 ? path12.resolve(argv1) : void 0;
   if (resolved && /\.ts$/.test(resolved)) {
-    resolved = path11.join(path11.dirname(resolved), path11.basename(resolved, ".ts") + ".mjs");
+    resolved = path12.join(path12.dirname(resolved), path12.basename(resolved, ".ts") + ".mjs");
   }
   const transient = resolved !== void 0 && (/[\\/]_npx[\\/]/.test(resolved) || /^\/(?:private\/)?(?:tmp|var\/folders)\//.test(resolved));
   if (!resolved || !exists(resolved) || transient) {
@@ -5315,9 +5626,9 @@ var init_pulumi_run = __esm({
 });
 
 // libs/mesh-cli/src/utils/kubeconfig.ts
-import * as fs12 from "fs";
+import * as fs13 from "fs";
 import * as os4 from "os";
-import * as path12 from "path";
+import * as path13 from "path";
 function buildKubeconfig(cluster, region) {
   return `apiVersion: v1
 kind: Config
@@ -5348,7 +5659,7 @@ users:
 `;
 }
 function sessionKubeconfigPath(sessionName) {
-  return path12.join(os4.tmpdir(), "mesh-dev-sessions", `${sessionName}.kubeconfig`);
+  return path13.join(os4.tmpdir(), "mesh-dev-sessions", `${sessionName}.kubeconfig`);
 }
 function resolveHubPlatformName(platform) {
   return platform?.name ?? "mesh";
@@ -5381,10 +5692,10 @@ async function ensureKubeconfig(platformName, env, sessionName, deps = {}) {
   }
   const region = process.env.AWS_REGION || "us-east-2";
   const kubeconfigPath = sessionKubeconfigPath(sessionName);
-  if (!fs12.existsSync(path12.dirname(kubeconfigPath))) {
-    fs12.mkdirSync(path12.dirname(kubeconfigPath), { recursive: true });
+  if (!fs13.existsSync(path13.dirname(kubeconfigPath))) {
+    fs13.mkdirSync(path13.dirname(kubeconfigPath), { recursive: true });
   }
-  fs12.writeFileSync(kubeconfigPath, buildKubeconfig(cluster, region), { mode: 384 });
+  fs13.writeFileSync(kubeconfigPath, buildKubeconfig(cluster, region), { mode: 384 });
   return kubeconfigPath;
 }
 var init_kubeconfig = __esm({
@@ -5529,14 +5840,14 @@ var init_temporal_auth = __esm({
 // libs/mesh-cli/src/utils/reachability.ts
 import { createConnection } from "node:net";
 function probeTcpReachable(host, port, timeoutMs = 1500) {
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     let settled = false;
     const socket = createConnection({ host, port });
     const finish = (ok) => {
       if (settled) return;
       settled = true;
       socket.destroy();
-      resolve19(ok);
+      resolve20(ok);
     };
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => finish(true));
@@ -5545,7 +5856,7 @@ function probeTcpReachable(host, port, timeoutMs = 1500) {
   });
 }
 function probeConnectionHolds(host, port, timeoutMs = 800, holdMs = 25) {
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     let settled = false;
     let holdTimer;
     const socket = createConnection({ host, port });
@@ -5554,7 +5865,7 @@ function probeConnectionHolds(host, port, timeoutMs = 800, holdMs = 25) {
       settled = true;
       if (holdTimer) clearTimeout(holdTimer);
       socket.destroy();
-      resolve19(ok);
+      resolve20(ok);
     };
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
@@ -5573,27 +5884,27 @@ var init_reachability = __esm({
 
 // libs/mesh-cli/src/utils/workflow-fingerprint.ts
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync11, readFileSync as readFileSync11, readdirSync as readdirSync4 } from "node:fs";
-import { dirname as dirname11, isAbsolute as isAbsolute2, join as join11, relative as relative2 } from "node:path";
-function findRepoRoot(startDir) {
+import { existsSync as existsSync12, readFileSync as readFileSync12, readdirSync as readdirSync4 } from "node:fs";
+import { dirname as dirname12, isAbsolute as isAbsolute2, join as join12, relative as relative3 } from "node:path";
+function findRepoRoot2(startDir) {
   let dir = startDir;
   for (; ; ) {
-    if (existsSync11(join11(dir, "pnpm-workspace.yaml"))) return dir;
-    const parent = dirname11(dir);
+    if (existsSync12(join12(dir, "pnpm-workspace.yaml"))) return dir;
+    const parent = dirname12(dir);
     if (parent === dir) return startDir;
     dir = parent;
   }
 }
 function workflowSourceDirs(repoRoot2, extraDirs = []) {
-  const pkgDirs = WORKFLOW_PACKAGE_DIRS.map((d) => join11(repoRoot2, d)).filter((d) => existsSync11(d));
+  const pkgDirs = WORKFLOW_PACKAGE_DIRS.map((d) => join12(repoRoot2, d)).filter((d) => existsSync12(d));
   if (pkgDirs.length > 0) return pkgDirs;
-  return extraDirs.filter((d) => existsSync11(d));
+  return extraDirs.filter((d) => existsSync12(d));
 }
 function resolveWorkerSourceDirs(repoRoot2, services = {}) {
   const dirs = [];
   for (const [name, svc] of Object.entries(services)) {
     if (/worker/i.test(name) && svc?.src) {
-      dirs.push(isAbsolute2(svc.src) ? svc.src : join11(repoRoot2, svc.src));
+      dirs.push(isAbsolute2(svc.src) ? svc.src : join12(repoRoot2, svc.src));
     }
   }
   return dirs;
@@ -5609,7 +5920,7 @@ function computeWorkflowFingerprint(dirs, relativeTo) {
     }
     for (const rel2 of rels) {
       const p = String(rel2);
-      if (/\.(ts|tsx)$/.test(p) && !EXCLUDE.test(p)) files.push(join11(dir, p));
+      if (/\.(ts|tsx)$/.test(p) && !EXCLUDE.test(p)) files.push(join12(dir, p));
     }
   }
   files.sort();
@@ -5617,8 +5928,8 @@ function computeWorkflowFingerprint(dirs, relativeTo) {
   const h = createHash2("sha256");
   for (const f of files) {
     try {
-      const content = readFileSync11(f);
-      h.update(relativeTo ? relative2(relativeTo, f) : f);
+      const content = readFileSync12(f);
+      h.update(relativeTo ? relative3(relativeTo, f) : f);
       h.update("\0");
       h.update(content);
       h.update("\0");
@@ -5628,7 +5939,7 @@ function computeWorkflowFingerprint(dirs, relativeTo) {
   return h.digest("hex").slice(0, 16);
 }
 function fingerprintWorkflowSource(appRoot, services = {}) {
-  const repoRoot2 = findRepoRoot(appRoot);
+  const repoRoot2 = findRepoRoot2(appRoot);
   const workerDirs = resolveWorkerSourceDirs(repoRoot2, services);
   return computeWorkflowFingerprint(workflowSourceDirs(repoRoot2, workerDirs), repoRoot2);
 }
@@ -5646,9 +5957,9 @@ var init_workflow_fingerprint = __esm({
 });
 
 // libs/mesh-cli/src/commands/dev-launch.ts
-import * as fs13 from "fs";
+import * as fs14 from "fs";
 import * as net7 from "net";
-import * as path13 from "path";
+import * as path14 from "path";
 function quoteShellValue(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
@@ -5670,9 +5981,9 @@ function envFileName(serviceName) {
   return `${serviceName.replace(/[^A-Za-z0-9._-]/g, "-")}.env.sh`;
 }
 function writeEnvFile(filePath, env) {
-  fs13.mkdirSync(path13.dirname(filePath), { recursive: true });
-  fs13.writeFileSync(filePath, renderEnvFile(env), { mode: ENV_FILE_MODE });
-  fs13.chmodSync(filePath, ENV_FILE_MODE);
+  fs14.mkdirSync(path14.dirname(filePath), { recursive: true });
+  fs14.writeFileSync(filePath, renderEnvFile(env), { mode: ENV_FILE_MODE });
+  fs14.chmodSync(filePath, ENV_FILE_MODE);
 }
 function buildLaunchCommand(envFilePath, dir, command, logShipper) {
   const base = `cd ${quoteShellValue(dir)} && source ${quoteShellValue(envFilePath)} && `;
@@ -5686,16 +5997,16 @@ async function waitForPort(host, port, timeoutMs, intervalMs = 500) {
     const attemptTimeout = Math.max(250, Math.min(1e3, remaining));
     if (await tryConnect(host, port, attemptTimeout)) return true;
     if (Date.now() + intervalMs >= deadline) return false;
-    await new Promise((resolve19) => setTimeout(resolve19, intervalMs));
+    await new Promise((resolve20) => setTimeout(resolve20, intervalMs));
   }
 }
 function tryConnect(host, port, timeoutMs) {
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     const socket = net7.connect({ host, port });
     const done = (ok) => {
       socket.removeAllListeners();
       socket.destroy();
-      resolve19(ok);
+      resolve20(ok);
     };
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => done(true));
@@ -5714,8 +6025,8 @@ var init_dev_launch = __esm({
 
 // libs/mesh-cli/src/commands/local/mocks.ts
 import { execFileSync as execFileSync12 } from "child_process";
-import * as fs14 from "fs";
-import * as path14 from "path";
+import * as fs15 from "fs";
+import * as path15 from "path";
 function externalMode(name, decl) {
   const mode = decl.mode ?? (decl.compose ? "local" : decl.openapi || decl.src ? "mock" : decl.sandbox || decl.credentials || decl.remote ? "remote" : void 0);
   if (!mode || !EXTERNAL_MODES.includes(mode)) {
@@ -5839,8 +6150,8 @@ async function planComposeExternal(composeFile, project, port, probes) {
   return { action: "up" };
 }
 async function composeExternalUp(appRoot, sessionName, name, decl, probes = dockerProbes) {
-  const composeFile = path14.resolve(appRoot, decl.compose);
-  if (!fs14.existsSync(composeFile)) {
+  const composeFile = path15.resolve(appRoot, decl.compose);
+  if (!fs15.existsSync(composeFile)) {
     throw new MeshCliError(`External '${name}': compose file not found at ${composeFile}.`, {
       remediation: { docs: 'package.json \u2192 "mesh": { "externals": { \u2026 } }' }
     });
@@ -5980,7 +6291,7 @@ function composeExternalsDown(refs) {
 }
 function readLocalMocks(appRoot) {
   try {
-    const pkg = JSON.parse(fs14.readFileSync(path14.join(appRoot, "package.json"), "utf-8"));
+    const pkg = JSON.parse(fs15.readFileSync(path15.join(appRoot, "package.json"), "utf-8"));
     const mocks = pkg?.mesh?.mocks;
     const externals = pkg?.mesh?.externals;
     return {
@@ -6075,12 +6386,12 @@ function externalDocs(decl) {
   return typeof decl.docs === "string" ? { url: decl.docs } : decl.docs;
 }
 function localProbeFile(tenant, app, external) {
-  return path14.join(localProbesDir(), `${tenant}-${app}-${external}.json`);
+  return path15.join(localProbesDir(), `${tenant}-${app}-${external}.json`);
 }
 function localProbesRemove(files) {
   for (const file of files ?? []) {
     try {
-      fs14.rmSync(file, { force: true });
+      fs15.rmSync(file, { force: true });
     } catch {
     }
   }
@@ -6169,7 +6480,7 @@ async function seedLocalMock(args) {
   );
   const probeFile = localProbeFile(tenant, app, decl.external);
   if (probe) {
-    fs14.writeFileSync(
+    fs15.writeFileSync(
       probeFile,
       JSON.stringify(
         [
@@ -6278,7 +6589,7 @@ var init_hub_roles = __esm({
 
 // libs/api-registry/src/index.ts
 import { z } from "zod";
-var rateLimitSpecSchema, rateLimitDefaultsSchema, integrationHealthSchema, apiSurfaceKindSchema, apiDocsSiteAudienceSchema, apiSurfaceSchema, apiRegistryEntrySchema, integrationStatusSchema;
+var rateLimitSpecSchema, rateLimitDefaultsSchema, integrationHealthSchema, apiSurfaceKindSchema, apiDocsSiteAudienceSchema, apiSurfaceSchema, apiRegistryEntrySchema, integrationStatusSchema, hubActAsExportsSchema;
 var init_src = __esm({
   "libs/api-registry/src/index.ts"() {
     "use strict";
@@ -6314,6 +6625,7 @@ var init_src = __esm({
       docs: z.object({
         url: z.string().min(1),
         contentHash: z.string().min(1),
+        trimmed: z.object({ url: z.string().min(1), contentHash: z.string().min(1) }).optional(),
         siteUrl: z.string().min(1).optional(),
         audience: apiDocsSiteAudienceSchema.optional()
       }),
@@ -6321,6 +6633,7 @@ var init_src = __esm({
       // The consumer schema strips unknown keys, so a producer-side field that is
       // not mirrored here never reaches a consumer — mirror every addition.
       status: z.object({ url: z.string().min(1) }).optional(),
+      actAs: z.object({ url: z.string().min(1) }).optional(),
       appVersion: z.string().min(1).optional(),
       rateLimits: rateLimitDefaultsSchema.optional(),
       health: integrationHealthSchema.optional(),
@@ -6345,13 +6658,26 @@ var init_src = __esm({
       health: integrationHealthSchema.optional(),
       startedAt: z.string().min(1)
     });
+    hubActAsExportsSchema = z.object({
+      issuer: z.string().min(1),
+      keys: z.array(
+        z.object({
+          kid: z.string().min(1),
+          kty: z.literal("RSA"),
+          n: z.string().min(1),
+          e: z.string().min(1),
+          alg: z.string().optional(),
+          use: z.string().optional()
+        })
+      ).min(1)
+    });
   }
 });
 
 // libs/mesh-cli/src/commands/local/seed-zitadel.ts
-import * as fs15 from "fs";
+import * as fs16 from "fs";
 import * as os5 from "os";
-import * as path15 from "path";
+import * as path16 from "path";
 function buildCliAppPayload() {
   return {
     name: CLI_APP_NAME,
@@ -6368,10 +6694,10 @@ function buildCliAppPayload() {
   };
 }
 function readSeederPat() {
-  const tmp = path15.join(fs15.mkdtempSync(path15.join(os5.tmpdir(), "mesh-zitadel-")), "pat.txt");
+  const tmp = path16.join(fs16.mkdtempSync(path16.join(os5.tmpdir(), "mesh-zitadel-")), "pat.txt");
   try {
     compose(["cp", "zitadel:/machinekey/pat.txt", tmp]);
-    const pat = fs15.readFileSync(tmp, "utf-8").trim();
+    const pat = fs16.readFileSync(tmp, "utf-8").trim();
     if (!pat) throw new Error("empty PAT file");
     return pat;
   } catch {
@@ -6380,7 +6706,7 @@ function readSeederPat() {
       { remediation: { command: "mesh stop --destroy && mesh start" } }
     );
   } finally {
-    fs15.rmSync(path15.dirname(tmp), { recursive: true, force: true });
+    fs16.rmSync(path16.dirname(tmp), { recursive: true, force: true });
   }
 }
 async function api(pat, method, apiPath, body, orgId) {
@@ -6479,11 +6805,11 @@ async function ensureTestUsers(pat) {
   }
 }
 function hubAuthPath() {
-  return path15.join(meshCacheDir("mesh-local"), "hub-auth.json");
+  return path16.join(meshCacheDir("mesh-local"), "hub-auth.json");
 }
 function readHubAuth() {
   try {
-    const parsed = JSON.parse(fs15.readFileSync(hubAuthPath(), "utf-8"));
+    const parsed = JSON.parse(fs16.readFileSync(hubAuthPath(), "utf-8"));
     if (parsed?.clientId && parsed?.clientSecret && parsed?.cookieSecret) return parsed;
     return null;
   } catch {
@@ -6622,7 +6948,7 @@ async function seedHubAuth(pat) {
     clientSecret: app.clientSecret ?? persisted?.clientSecret ?? "",
     cookieSecret: persistedCookie ?? (await import("crypto")).randomBytes(16).toString("hex")
   };
-  fs15.writeFileSync(hubAuthPath(), JSON.stringify(config, null, 2), { mode: 384 });
+  fs16.writeFileSync(hubAuthPath(), JSON.stringify(config, null, 2), { mode: 384 });
   return config;
 }
 async function publishHubAuthzPointer(projectId, orgId, awsConfig) {
@@ -7206,56 +7532,6 @@ var init_auth_provision = __esm({
   }
 });
 
-// libs/mesh-cli/src/utils/mesh-json.ts
-import * as fs16 from "fs";
-import * as path16 from "path";
-function isValidTenantName(value) {
-  return /^[a-z][a-z0-9-]*$/.test(value);
-}
-function parseMeshJson(content) {
-  try {
-    const data = JSON.parse(content);
-    if (typeof data?.tenant !== "string" || !isValidTenantName(data.tenant)) return null;
-    const platform = typeof data.platform === "string" && data.platform ? data.platform : "local";
-    return { tenant: data.tenant, platform };
-  } catch {
-    return null;
-  }
-}
-function findMeshJson(startDir) {
-  let dir = path16.resolve(startDir);
-  while (true) {
-    const candidate = path16.join(dir, MESH_JSON);
-    if (fs16.existsSync(candidate)) {
-      let content = "";
-      try {
-        content = fs16.readFileSync(candidate, "utf-8");
-      } catch {
-        return null;
-      }
-      const data = parseMeshJson(content);
-      return data ? { path: candidate, data } : null;
-    }
-    if (fs16.existsSync(path16.join(dir, ".git"))) return null;
-    const parent = path16.dirname(dir);
-    if (parent === dir) return null;
-    dir = parent;
-  }
-}
-function writeMeshJson(rootDir, data) {
-  const target = path16.join(rootDir, MESH_JSON);
-  fs16.writeFileSync(target, `${JSON.stringify({ tenant: data.tenant, platform: data.platform }, null, 2)}
-`);
-  return target;
-}
-var MESH_JSON;
-var init_mesh_json = __esm({
-  "libs/mesh-cli/src/utils/mesh-json.ts"() {
-    "use strict";
-    MESH_JSON = "mesh.json";
-  }
-});
-
 // libs/mesh-cli/src/commands/local/dev-local.ts
 import * as fs17 from "fs";
 import * as path17 from "path";
@@ -7780,7 +8056,7 @@ async function startTokenServer(port, context) {
     })();
   });
   server.on("error", (e) => logWarn(`token-server error: ${e.message}`));
-  await new Promise((resolve19) => server.listen(port, "127.0.0.1", resolve19));
+  await new Promise((resolve20) => server.listen(port, "127.0.0.1", resolve20));
   logInfo(`dev-user token-server on http://127.0.0.1:${port} (context ${context})`);
   await new Promise(() => {
   });
@@ -7910,10 +8186,10 @@ function removeSessionState(sessionName) {
   }
 }
 async function isPortFree(port) {
-  const bindSucceeds = (host) => new Promise((resolve19) => {
+  const bindSucceeds = (host) => new Promise((resolve20) => {
     const server = net8.createServer();
-    server.once("error", () => resolve19(false));
-    const onListening = () => server.close(() => resolve19(true));
+    server.once("error", () => resolve20(false));
+    const onListening = () => server.close(() => resolve20(true));
     if (host === void 0) server.listen(port, onListening);
     else server.listen(port, host, onListening);
   });
@@ -7921,24 +8197,24 @@ async function isPortFree(port) {
   return bindSucceeds("127.0.0.1");
 }
 async function findFreePort3() {
-  return new Promise((resolve19, reject) => {
+  return new Promise((resolve20, reject) => {
     const server = net8.createServer();
     server.once("error", reject);
     server.listen(0, "127.0.0.1", () => {
       const { port } = server.address();
-      server.close(() => resolve19(port));
+      server.close(() => resolve20(port));
     });
   });
 }
 function isPortListening(port) {
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     const s = new net8.Socket();
     let done = false;
     const fin = (ok) => {
       if (done) return;
       done = true;
       s.destroy();
-      resolve19(ok);
+      resolve20(ok);
     };
     s.setTimeout(300);
     s.once("connect", () => fin(true));
@@ -10372,14 +10648,14 @@ function isConfigStale(configMtimeMs, startedAtIso) {
   return configMtimeMs > Date.parse(startedAtIso);
 }
 function canConnect2(host, port, timeoutMs = 800) {
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     const socket = new net9.Socket();
     let settled = false;
     const done = (ok) => {
       if (settled) return;
       settled = true;
       socket.destroy();
-      resolve19(ok);
+      resolve20(ok);
     };
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => done(true));
@@ -11982,11 +12258,11 @@ function createVcsFolderReader(opts) {
     }
     return p;
   };
-  const readPath = async (repo, path46) => {
+  const readPath = async (repo, path47) => {
     const dir = await cloneRepo(repo);
-    const ref = await resolveFolderRef(dir, path46);
-    if (!ref) throw new Error(`path "${path46}" not found on any ref of ${repo}`);
-    const files = await readFolderAtRef(dir, ref, path46);
+    const ref = await resolveFolderRef(dir, path47);
+    if (!ref) throw new Error(`path "${path47}" not found on any ref of ${repo}`);
+    const files = await readFolderAtRef(dir, ref, path47);
     return { ref, files };
   };
   const cleanup = async () => {
@@ -13280,25 +13556,50 @@ var init_create_app = __esm({
   }
 });
 
+// libs/mesh-cli/src/commands/db/axes.ts
+function platformAxis(options, usage, detect = detectContext) {
+  if (options.tenant && !options.env || !options.tenant && options.env) {
+    throw new MeshCliError("Both --tenant and --env are required", {
+      remediation: { command: usage }
+    });
+  }
+  let resolved;
+  return () => {
+    if (resolved) return resolved;
+    if (options.tenant && options.env) {
+      resolved = { tenant: options.tenant, env: options.env };
+      logInfo(`Platform: Tenant=${resolved.tenant}, Env=${resolved.env}`);
+    } else {
+      const ctx = detect();
+      resolved = { tenant: ctx.tenant, env: ctx.platformEnv };
+      logInfo(`Auto-detected: Tenant=${resolved.tenant}, Env=${resolved.env}`);
+    }
+    return resolved;
+  };
+}
+function appAxis(options, platform) {
+  if (options.appTenant && options.appStage) {
+    return { tenant: options.appTenant, stage: options.appStage };
+  }
+  const resolved = platform();
+  return {
+    tenant: options.appTenant ?? resolved.tenant,
+    stage: options.appStage ?? resolved.env
+  };
+}
+var init_axes = __esm({
+  "libs/mesh-cli/src/commands/db/axes.ts"() {
+    "use strict";
+    init_context();
+    init_errors();
+    init_log();
+  }
+});
+
 // libs/mesh-cli/src/commands/db/connect.ts
 import { spawn as spawn4 } from "child_process";
 async function connectCommand(options) {
-  let tenant;
-  let platformEnv;
-  if (options.tenant && options.env) {
-    tenant = options.tenant;
-    platformEnv = options.env;
-    logInfo(`Explicit mode: Tenant=${tenant}, Env=${platformEnv}`);
-  } else if (options.tenant || options.env) {
-    logError("Both --tenant and --env are required");
-    logInfo("Usage: mesh db connect --tenant mesh --env dev-temporal");
-    process.exit(1);
-  } else {
-    const ctx = detectContext();
-    tenant = ctx.tenant;
-    platformEnv = ctx.platformEnv;
-    logInfo(`Auto-detected: Tenant=${tenant}, Env=${platformEnv}`);
-  }
+  const { tenant, env: platformEnv } = platformAxis(options, USAGE)();
   const bastion = await getPlatformBastionInfo(tenant, platformEnv);
   const rdsService = bastion.services.rds;
   if (!rdsService) {
@@ -13341,38 +13642,25 @@ async function connectCommand(options) {
     process.exit(code ?? 0);
   });
 }
+var USAGE;
 var init_connect = __esm({
   "libs/mesh-cli/src/commands/db/connect.ts"() {
     "use strict";
     init_utils();
+    init_axes();
+    USAGE = "mesh db connect --tenant mesh --env dev-temporal";
   }
 });
 
 // libs/mesh-cli/src/commands/db/credentials.ts
 async function credentialsCommand(options) {
-  let platformTenant;
-  let platformEnv;
-  if (options.tenant && options.env) {
-    platformTenant = options.tenant;
-    platformEnv = options.env;
-    logInfo(`Platform: Tenant=${platformTenant}, Env=${platformEnv}`);
-  } else if (options.tenant || options.env) {
-    logError("Both --tenant and --env are required");
-    logInfo("Usage: mesh db credentials --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev");
-    process.exit(1);
-  } else {
-    const ctx = detectContext();
-    platformTenant = ctx.tenant;
-    platformEnv = ctx.platformEnv;
-    logInfo(`Auto-detected: Tenant=${platformTenant}, Env=${platformEnv}`);
-  }
-  const appTenant = options.appTenant ?? platformTenant;
-  const appStage = options.appStage ?? platformEnv;
+  const platform = platformAxis(options, USAGE2);
+  const app = appAxis(options, platform);
   const appName = options.app;
   if (appName) {
-    logInfo(`App credentials: tenant=${appTenant}, stage=${appStage}, app=${appName}`);
+    logInfo(`App credentials: tenant=${app.tenant}, stage=${app.stage}, app=${appName}`);
   }
-  const databaseUrl = await getDatabaseUrl(appTenant, appStage, { app: appName });
+  const databaseUrl = await getDatabaseUrl(app.tenant, app.stage, { app: appName });
   const parsed = new URL(databaseUrl);
   console.log("");
   console.log("Database Credentials:");
@@ -13392,38 +13680,25 @@ async function credentialsCommand(options) {
   console.log(`  ${tunnelUrl.toString()}`);
   console.log("");
 }
+var USAGE2;
 var init_credentials2 = __esm({
   "libs/mesh-cli/src/commands/db/credentials.ts"() {
     "use strict";
     init_utils();
+    init_axes();
+    USAGE2 = "mesh db credentials --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev";
   }
 });
 
 // libs/mesh-cli/src/commands/db/env.ts
 async function envCommand(options) {
-  let platformTenant;
-  let platformEnv;
-  if (options.tenant && options.env) {
-    platformTenant = options.tenant;
-    platformEnv = options.env;
-    console.error(`\u2139 Platform: Tenant=${platformTenant}, Env=${platformEnv}`);
-  } else if (options.tenant || options.env) {
-    logError("Both --tenant and --env are required");
-    logInfo("Usage: eval $(mesh db env --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev)");
-    process.exit(1);
-  } else {
-    const ctx = detectContext();
-    platformTenant = ctx.tenant;
-    platformEnv = ctx.platformEnv;
-    console.error(`\u2139 Auto-detected: Tenant=${platformTenant}, Env=${platformEnv}`);
-  }
-  const appTenant = options.appTenant ?? platformTenant;
-  const appStage = options.appStage ?? platformEnv;
+  const platform = platformAxis(options, USAGE3);
+  const app = appAxis(options, platform);
   const appName = options.app;
   if (appName) {
-    console.error(`\u2139 App credentials: tenant=${appTenant}, stage=${appStage}, app=${appName}`);
+    console.error(`\u2139 App credentials: tenant=${app.tenant}, stage=${app.stage}, app=${appName}`);
   }
-  const rawUrl = await getDatabaseUrl(appTenant, appStage, { app: appName });
+  const rawUrl = await getDatabaseUrl(app.tenant, app.stage, { app: appName });
   const tunnelUrl = rewriteDatabaseUrl(rawUrl, { endpoint: "localhost:5432" });
   const parsed = new URL(tunnelUrl);
   console.log(`export DATABASE_URL="${tunnelUrl}"`);
@@ -13433,10 +13708,13 @@ async function envCommand(options) {
   console.log(`export DB_USERNAME="${parsed.username}"`);
   console.log(`export DB_PASSWORD="${decodeURIComponent(parsed.password)}"`);
 }
+var USAGE3;
 var init_env = __esm({
   "libs/mesh-cli/src/commands/db/env.ts"() {
     "use strict";
     init_utils();
+    init_axes();
+    USAGE3 = "eval $(mesh db env --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev)";
   }
 });
 
@@ -13479,58 +13757,43 @@ async function startTunnelBackground(instanceId, rdsHost, rdsPort, localPort) {
   throw new Error(`Tunnel failed to start after ${maxAttempts} seconds`);
 }
 function checkPort(port) {
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     const socket = new net10.Socket();
     socket.setTimeout(500);
     socket.on("connect", () => {
       socket.destroy();
-      resolve19(true);
+      resolve20(true);
     });
     socket.on("timeout", () => {
       socket.destroy();
-      resolve19(false);
+      resolve20(false);
     });
     socket.on("error", () => {
       socket.destroy();
-      resolve19(false);
+      resolve20(false);
     });
     socket.connect(port, "localhost");
   });
 }
 function sleep2(ms) {
-  return new Promise((resolve19) => setTimeout(resolve19, ms));
+  return new Promise((resolve20) => setTimeout(resolve20, ms));
 }
 async function psqlCommand(options) {
-  let platformTenant;
-  let platformEnv;
-  if (options.tenant && options.env) {
-    platformTenant = options.tenant;
-    platformEnv = options.env;
-    logInfo(`Platform: Tenant=${platformTenant}, Env=${platformEnv}`);
-  } else if (options.tenant || options.env) {
-    logError("Both --tenant and --env are required");
-    logInfo("Usage: mesh db psql --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev");
-    process.exit(1);
-  } else {
-    const ctx = detectContext();
-    platformTenant = ctx.tenant;
-    platformEnv = ctx.platformEnv;
-    logInfo(`Auto-detected: Tenant=${platformTenant}, Env=${platformEnv}`);
-  }
-  const appTenant = options.appTenant ?? platformTenant;
-  const appStage = options.appStage ?? platformEnv;
+  const platform = platformAxis(options, USAGE4);
+  const { tenant: platformTenant, env: platformEnv } = platform();
+  const app = appAxis(options, platform);
   const appName = options.app;
   if (appName) {
-    logInfo(`App credentials: tenant=${appTenant}, stage=${appStage}, app=${appName}`);
+    logInfo(`App credentials: tenant=${app.tenant}, stage=${app.stage}, app=${appName}`);
   }
   const psqlCheck = spawn5("which", ["psql"]);
-  await new Promise((resolve19, reject) => {
+  await new Promise((resolve20, reject) => {
     psqlCheck.on("exit", (code) => {
       if (code !== 0) {
         logError("psql not found. Install with: brew install postgresql");
         reject(new Error("psql not found"));
       } else {
-        resolve19();
+        resolve20();
       }
     });
   });
@@ -13553,7 +13816,7 @@ async function psqlCommand(options) {
   process.on("exit", cleanup);
   process.on("SIGINT", cleanup);
   process.on("SIGTERM", cleanup);
-  const databaseUrl = await getDatabaseUrl(appTenant, appStage, { app: appName });
+  const databaseUrl = await getDatabaseUrl(app.tenant, app.stage, { app: appName });
   const parsed = new URL(databaseUrl);
   const username = parsed.username;
   const password2 = decodeURIComponent(parsed.password);
@@ -13574,10 +13837,13 @@ async function psqlCommand(options) {
     process.exit(code ?? 0);
   });
 }
+var USAGE4;
 var init_psql = __esm({
   "libs/mesh-cli/src/commands/db/psql.ts"() {
     "use strict";
     init_utils();
+    init_axes();
+    USAGE4 = "mesh db psql --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev";
   }
 });
 
@@ -13617,26 +13883,26 @@ function findSstOutputs() {
   return null;
 }
 function checkPort2(port) {
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     const socket = new net11.Socket();
     socket.setTimeout(500);
     socket.on("connect", () => {
       socket.destroy();
-      resolve19(true);
+      resolve20(true);
     });
     socket.on("timeout", () => {
       socket.destroy();
-      resolve19(false);
+      resolve20(false);
     });
     socket.on("error", () => {
       socket.destroy();
-      resolve19(false);
+      resolve20(false);
     });
     socket.connect(port, "localhost");
   });
 }
 function sleep3(ms) {
-  return new Promise((resolve19) => setTimeout(resolve19, ms));
+  return new Promise((resolve20) => setTimeout(resolve20, ms));
 }
 async function startTunnelBackground2(instanceId, rdsEndpoint, rdsPort, localPort) {
   logInfo("Starting database tunnel...");
@@ -13760,28 +14026,14 @@ async function execCommand(commandArgs, options) {
       logWarn("Could not parse DATABASE_URL for rewriting");
     }
   } else {
-    let platformTenant;
-    let platformEnv;
-    if (options.tenant && options.env) {
-      platformTenant = options.tenant;
-      platformEnv = options.env;
-      logInfo(`Explicit mode: Platform Tenant=${platformTenant}, Platform Env=${platformEnv}`);
-    } else if (options.tenant || options.env) {
-      logError("Both --tenant and --env are required when using explicit mode");
-      logInfo("Usage: mesh db exec --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev -- <command>");
-      logInfo("Or omit both to use auto-detection");
-      process.exit(1);
-    } else {
-      const ctx = detectContext();
-      platformTenant = ctx.tenant;
-      platformEnv = ctx.platformEnv;
-      logInfo(`Discovery mode: Platform=${platformEnv}, Tenant=${platformTenant}`);
-    }
-    const appTenant = options.appTenant ?? platformTenant;
-    const appStage = options.appStage ?? platformEnv;
+    const platform = platformAxis(
+      options,
+      "mesh db exec --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev -- <command>"
+    );
+    const app = appAxis(options, platform);
     const appName = options.app;
     if (appName) {
-      logInfo(`App credentials: tenant=${appTenant}, stage=${appStage}, app=${appName}`);
+      logInfo(`App credentials: tenant=${app.tenant}, stage=${app.stage}, app=${appName}`);
     }
     const tunnelExists = await checkPort2(localPort);
     const sstOutputs = findSstOutputs();
@@ -13802,6 +14054,7 @@ async function execCommand(commandArgs, options) {
     }
     if (!databaseUrl) {
       if (!tunnelExists) {
+        const { tenant: platformTenant, env: platformEnv } = platform();
         const bastion = await getPlatformBastionInfo(platformTenant, platformEnv);
         const rdsService = bastion.services.rds;
         if (!rdsService) {
@@ -13816,7 +14069,7 @@ async function execCommand(commandArgs, options) {
       } else {
         logSuccess(`Using existing tunnel on port ${localPort}`);
       }
-      const rawUrl = await getDatabaseUrl(appTenant, appStage, { app: appName });
+      const rawUrl = await getDatabaseUrl(app.tenant, app.stage, { app: appName });
       databaseUrl = rewriteDatabaseUrl(rawUrl, {
         endpoint: `localhost:${localPort}`,
         sslMode: options.ssl
@@ -13856,6 +14109,7 @@ var init_exec = __esm({
   "libs/mesh-cli/src/commands/db/exec.ts"() {
     "use strict";
     init_utils();
+    init_axes();
     DEFAULT_LOCAL_PORT = 5432;
     MAX_RETRIES = 12;
     RETRY_DELAY_MS = 5e3;
@@ -13884,7 +14138,7 @@ var init_db = __esm({
 
 // libs/mesh-cli/src/utils/deploy-preflight.ts
 import { existsSync as existsSync20, readFileSync as readFileSync21 } from "node:fs";
-import { dirname as dirname22, join as join25, relative as relative6 } from "node:path";
+import { dirname as dirname22, join as join25, relative as relative7 } from "node:path";
 import { parse as parseYaml3 } from "yaml";
 function isGated(name) {
   return GATED_PREFIXES.some((p) => name.startsWith(p));
@@ -13950,7 +14204,7 @@ function checkDeployDepsFresh(appRoot) {
     );
     return null;
   }
-  const importerRel = relative6(dirname22(lockPath), appRoot) || ".";
+  const importerRel = relative7(dirname22(lockPath), appRoot) || ".";
   const expected = extractImporterMeshVersions(lockDoc, importerRel);
   const names = Object.keys(expected);
   if (names.length === 0) return [];
@@ -14976,8 +15230,8 @@ function formatDefault(value, paths = currentMachinePaths()) {
   if (typeof value === "boolean" || typeof value === "number") return String(value);
   return normalizeMachinePaths(JSON.stringify(value), paths);
 }
-function slugifyCommandPath(path46) {
-  return path46.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+function slugifyCommandPath(path47) {
+  return path47.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
 function extractOptions(command) {
   const options = command.options ?? [];
@@ -15011,17 +15265,17 @@ function isUndocumented(command) {
 function extractCommand(command, parentPath, depth) {
   const internals = command;
   const name = internals._name ?? "";
-  const path46 = parentPath ? `${parentPath} ${name}` : name;
+  const path47 = parentPath ? `${parentPath} ${name}` : name;
   return {
-    path: path46,
+    path: path47,
     name,
     aliases: [...internals._aliases ?? []],
     description: internals._description ?? "",
     args: extractArgs(command),
     options: extractOptions(command),
-    slug: slugifyCommandPath(path46),
+    slug: slugifyCommandPath(path47),
     depth,
-    subcommands: (internals.commands ?? []).filter((child) => !isUndocumented(child)).map((child) => extractCommand(child, path46, depth + 1))
+    subcommands: (internals.commands ?? []).filter((child) => !isUndocumented(child)).map((child) => extractCommand(child, path47, depth + 1))
   };
 }
 function extractCliReference(program2) {
@@ -15249,14 +15503,14 @@ ${summary}`);
 function runZudoku(args) {
   const cliArgs = args.mode === "dev" ? ["dev", "--port", String(args.port ?? 3e3)] : ["build"];
   logInfo(`Running \`zudoku ${cliArgs.join(" ")}\` in ${args.appDir}`);
-  return new Promise((resolve19, reject) => {
+  return new Promise((resolve20, reject) => {
     const child = spawn7("pnpm", ["exec", "zudoku", ...cliArgs], {
       cwd: args.appDir,
       stdio: "inherit",
       env: process.env
     });
     child.on("error", reject);
-    child.on("close", (code) => resolve19(code ?? 1));
+    child.on("close", (code) => resolve20(code ?? 1));
   });
 }
 async function runPortalCommand(opts, deps) {
@@ -15467,17 +15721,17 @@ async function serveDocsSite(args) {
       res.writeHead(500).end("internal error");
     });
   });
-  await new Promise((resolve19, reject) => {
+  await new Promise((resolve20, reject) => {
     server.once("error", reject);
-    server.listen(args.port, "127.0.0.1", () => resolve19());
+    server.listen(args.port, "127.0.0.1", () => resolve20());
   });
   const address = server.address();
   const port = typeof address === "object" && address ? address.port : args.port;
   return {
     url: `http://127.0.0.1:${port}`,
     port,
-    close: () => new Promise((resolve19, reject) => {
-      server.close((error) => error ? reject(error) : resolve19());
+    close: () => new Promise((resolve20, reject) => {
+      server.close((error) => error ? reject(error) : resolve20());
     })
   };
 }
@@ -15730,7 +15984,7 @@ Or run in the foreground instead: mesh docs start --foreground`
     } catch (error) {
       lastError = error instanceof Error ? error.message : String(error);
     }
-    await new Promise((resolve19) => setTimeout(resolve19, 500));
+    await new Promise((resolve20) => setTimeout(resolve20, 500));
   }
   throw new Error(
     `the docs server did not answer at ${url} within 60s (${lastError || "no response"}).
@@ -15767,8 +16021,8 @@ async function runDocsServeStatic(args) {
   }
   const server = await serveDocsSite({ root: args.root, port: requestedPort });
   logSuccess(`Mesh docs serving at ${server.url} (from ${args.root})`);
-  await new Promise((resolve19) => {
-    const stop = () => void server.close().finally(() => resolve19());
+  await new Promise((resolve20) => {
+    const stop = () => void server.close().finally(() => resolve20());
     process.once("SIGINT", stop);
     process.once("SIGTERM", stop);
   });
@@ -15822,8 +16076,8 @@ async function runDocsStart(args) {
         stdio: "inherit",
         env: process.env
       });
-      await new Promise((resolve19) => {
-        child.on("close", () => resolve19());
+      await new Promise((resolve20) => {
+        child.on("close", () => resolve20());
         process.once("SIGINT", () => child.kill("SIGINT"));
         process.once("SIGTERM", () => child.kill("SIGTERM"));
       });
@@ -15839,7 +16093,7 @@ async function runDocsStart(args) {
     reportAssembly(result);
     const { spawn: spawn10 } = await import("node:child_process");
     writeFileSync18(buildLog, "");
-    const code = await new Promise((resolve19) => {
+    const code = await new Promise((resolve20) => {
       const child = spawn10("pnpm", ["exec", "zudoku", "build"], {
         cwd: appDir,
         stdio: ["ignore", "pipe", "pipe"],
@@ -15847,8 +16101,8 @@ async function runDocsStart(args) {
       });
       child.stdout?.on("data", (chunk) => appendFileSync2(buildLog, chunk));
       child.stderr?.on("data", (chunk) => appendFileSync2(buildLog, chunk));
-      child.on("error", () => resolve19(1));
-      child.on("close", (exitCode) => resolve19(exitCode ?? 1));
+      child.on("error", () => resolve20(1));
+      child.on("close", (exitCode) => resolve20(exitCode ?? 1));
     });
     if (code !== 0) throw new Error(`zudoku build exited with code ${code} \u2014 see ${buildLog}`);
     serveRoot = path32.join(appDir, "dist");
@@ -15868,9 +16122,9 @@ async function runDocsStart(args) {
   const server = await serveDocsSite({ root: serveRoot, port: requestedPort });
   logSuccess(`Mesh docs (${label}) serving at ${server.url}`);
   logInfo("Press Ctrl-C to stop");
-  await new Promise((resolve19) => {
+  await new Promise((resolve20) => {
     const stop = () => {
-      void server.close().finally(() => resolve19());
+      void server.close().finally(() => resolve20());
     };
     process.once("SIGINT", stop);
     process.once("SIGTERM", stop);
@@ -16025,7 +16279,7 @@ function guarded(action) {
   };
 }
 async function runCliReference(opts) {
-  const repoRoot2 = findRepoRoot(process.cwd());
+  const repoRoot2 = findRepoRoot2(process.cwd());
   const outPath = resolvePath(repoRoot2, opts.out);
   const markdown = await renderCliReference();
   if (opts.check) {
@@ -16045,7 +16299,7 @@ async function runCliReference(opts) {
   logSuccess(`CLI reference \u2192 ${path33.relative(repoRoot2, outPath)}`);
 }
 async function runPortal(opts) {
-  const repoRoot2 = findRepoRoot(process.cwd());
+  const repoRoot2 = findRepoRoot2(process.cwd());
   await runPortalCommand(
     {
       out: opts.out,
@@ -16083,7 +16337,7 @@ function registerDocsCommand(program2) {
     (opts) => guarded(async () => {
       const { runDocsStart: runDocsStart2 } = await Promise.resolve().then(() => (init_start(), start_exports));
       await runDocsStart2({
-        repoRoot: findRepoRoot(process.cwd()),
+        repoRoot: findRepoRoot2(process.cwd()),
         version: opts.version,
         port: opts.port,
         dev: opts.dev,
@@ -16320,24 +16574,24 @@ function resolvePlatformDir(explicit, cwd, env = process.env) {
   );
 }
 async function findFreePort4() {
-  return new Promise((resolve19, reject) => {
+  return new Promise((resolve20, reject) => {
     const server = net12.createServer();
     server.listen(0, "127.0.0.1", () => {
       const address = server.address();
       server.close(
-        () => typeof address === "object" && address ? resolve19(address.port) : reject(new Error("no port"))
+        () => typeof address === "object" && address ? resolve20(address.port) : reject(new Error("no port"))
       );
     });
     server.on("error", reject);
   });
 }
 function isPortListening2(port) {
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     const socket = net12.connect({ host: "127.0.0.1", port, timeout: 400 });
     const done = (ok) => {
       socket.removeAllListeners();
       socket.destroy();
-      resolve19(ok);
+      resolve20(ok);
     };
     socket.once("connect", () => done(true));
     socket.once("timeout", () => done(false));
@@ -16533,10 +16787,231 @@ var init_hub = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/registry-publish.ts
-import { execFileSync as execFileSync24, execSync } from "child_process";
+// libs/mesh-cli/src/commands/init/platform-setup.ts
+var platform_setup_exports = {};
+__export(platform_setup_exports, {
+  DOMAIN_REQUIRED_MESSAGE: () => DOMAIN_REQUIRED_MESSAGE,
+  PLATFORM_SETUP_DEFAULTS: () => PLATFORM_SETUP_DEFAULTS,
+  defaultPlatformDir: () => defaultPlatformDir,
+  defaultStateBucket: () => defaultStateBucket,
+  ensureStateBucket: () => ensureStateBucket,
+  exportCredentialsCommand: () => exportCredentialsCommand,
+  realStateBucketDeps: () => realStateBucketDeps,
+  renderPlatformNextSteps: () => renderPlatformNextSteps,
+  resolvePlatformSetup: () => resolvePlatformSetup,
+  resolveTargetDir: () => resolveTargetDir,
+  scaffoldPlatformRepo: () => scaffoldPlatformRepo,
+  stateBucketCreateCommand: () => stateBucketCreateCommand,
+  validateDomain: () => validateDomain,
+  validateEnv: () => validateEnv,
+  validateRegion: () => validateRegion,
+  validateStateBucket: () => validateStateBucket
+});
 import * as fs28 from "fs";
 import * as path35 from "path";
+import { execFileSync as execFileSync24 } from "child_process";
+function defaultStateBucket(tenant) {
+  return `${tenant}-mesh-platform-pulumi-state`;
+}
+function defaultPlatformDir(tenant) {
+  return `${tenant}-mesh-platform`;
+}
+function validateEnv(value) {
+  return /^[a-z][a-z0-9-]*$/.test(value.trim()) ? true : "lowercase letters, digits and dashes, starting with a letter";
+}
+function validateRegion(value) {
+  return /^[a-z]{2}(-[a-z]+)+-\d$/.test(value.trim()) ? true : "an AWS region, e.g. us-east-2 or eu-west-1";
+}
+function validateDomain(value) {
+  const domain = value.trim().toLowerCase().replace(/\.$/, "");
+  if (!domain) return "a public domain you control, e.g. q2poc.pub";
+  if (!/^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}$/.test(domain)) {
+    return "a public domain you control, e.g. q2poc.pub";
+  }
+  if (/(^|\.)(example\.(com|org|net)|invalid|localhost|test)$/.test(domain)) {
+    return `${domain} is a placeholder \u2014 the deploy stalls on an ACM certificate for a zone nobody can delegate. Use a domain you control.`;
+  }
+  return true;
+}
+function validateStateBucket(value) {
+  const bucket = value.trim();
+  return /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(bucket) && !bucket.includes("..") ? true : "3\u201363 characters: lowercase letters, digits, dots and dashes, starting and ending alphanumeric";
+}
+function resolveTargetDir(tenant, flags, cwd) {
+  const dir = path35.resolve(cwd, flags.dir ?? defaultPlatformDir(tenant));
+  if (fs28.existsSync(dir) && fs28.readdirSync(dir).length > 0) {
+    throw new MeshCliError(`Target directory is not empty: ${dir}`, {
+      remediation: { command: `mesh init platform ${tenant} --dir <empty-dir>` }
+    });
+  }
+  return dir;
+}
+async function resolvePlatformSetup(tenant, flags, deps) {
+  const cwd = deps.cwd ?? process.cwd();
+  const dir = resolveTargetDir(tenant, flags, cwd);
+  const ask = deps.interactive && !flags.yes ? deps.prompts : void 0;
+  const env = flags.env ?? (ask ? await ask.input({ message: "Environment", default: PLATFORM_SETUP_DEFAULTS.env, validate: validateEnv }) : PLATFORM_SETUP_DEFAULTS.env);
+  if (validateEnv(env) !== true) throw new MeshCliError(`Invalid environment '${env}' \u2014 ${validateEnv(env)}.`);
+  const region = flags.region ?? (ask ? await ask.input({ message: "AWS region", default: PLATFORM_SETUP_DEFAULTS.region, validate: validateRegion }) : PLATFORM_SETUP_DEFAULTS.region);
+  if (validateRegion(region) !== true) throw new MeshCliError(`Invalid region '${region}' \u2014 ${validateRegion(region)}.`);
+  let domain = flags.domain;
+  if (domain === void 0) {
+    if (!ask) throw new MeshCliError(DOMAIN_REQUIRED_MESSAGE, { remediation: { command: `mesh init platform ${tenant} --domain <your-domain>` } });
+    domain = await ask.input({
+      message: `Public base domain (the core stack creates the Route 53 zone ${env}.<domain>; its NS records must be delegated from the parent before the deploy can finish)`,
+      validate: validateDomain
+    });
+  }
+  const domainCheck = validateDomain(domain);
+  if (domainCheck !== true) throw new MeshCliError(`Invalid --domain '${domain}' \u2014 ${domainCheck}`);
+  domain = domain.trim().toLowerCase().replace(/\.$/, "");
+  const profile = flags.profile ?? (ask ? await ask.input({ message: "AWS profile the stack config references", default: PLATFORM_SETUP_DEFAULTS.profile }) : PLATFORM_SETUP_DEFAULTS.profile);
+  const bucketDefault = defaultStateBucket(tenant);
+  const stateBucket = flags.stateBucket ?? (ask ? await ask.input({ message: "Pulumi state S3 bucket (holds this platform's state \u2014 created below if it does not exist)", default: bucketDefault, validate: validateStateBucket }) : bucketDefault);
+  const bucketCheck = validateStateBucket(stateBucket);
+  if (bucketCheck !== true) throw new MeshCliError(`Invalid --state-bucket '${stateBucket}' \u2014 ${bucketCheck}`);
+  let createStateBucket = flags.createStateBucket ?? false;
+  if (flags.createStateBucket === void 0 && ask) {
+    createStateBucket = await ask.confirm({
+      message: `Create s3://${stateBucket} in ${region} now (versioned), if it does not exist?`,
+      default: true
+    });
+  }
+  return {
+    tenant,
+    env,
+    region,
+    domain,
+    profile,
+    stateBucket: stateBucket.trim(),
+    dir,
+    createStateBucket
+  };
+}
+function stateBucketCreateCommand(setup) {
+  const location = setup.region === "us-east-1" ? "" : ` --create-bucket-configuration LocationConstraint=${setup.region}`;
+  return `aws s3api create-bucket --bucket ${setup.stateBucket} --region ${setup.region}${location} --profile ${setup.profile}`;
+}
+function awsJson(args, profile) {
+  return execFileSync24("aws", [...args, "--profile", profile], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+}
+async function ensureStateBucket(setup, deps = realStateBucketDeps) {
+  if (!setup.createStateBucket) {
+    return { created: false, present: false, detail: "not requested" };
+  }
+  try {
+    if (deps.headBucket(setup)) {
+      return { created: false, present: true, detail: `s3://${setup.stateBucket} already exists` };
+    }
+  } catch {
+  }
+  try {
+    deps.createBucket(setup);
+  } catch (err) {
+    const why = errorDetail(err);
+    return { created: false, present: false, detail: `could not create s3://${setup.stateBucket} \u2014 ${why}` };
+  }
+  try {
+    deps.enableVersioning(setup);
+    return { created: true, present: true, detail: `created s3://${setup.stateBucket} in ${setup.region} (versioning on)` };
+  } catch (err) {
+    return { created: true, present: true, detail: `created s3://${setup.stateBucket} in ${setup.region}, but versioning could not be enabled \u2014 ${errorDetail(err)}` };
+  }
+}
+function errorDetail(err) {
+  const stderr = err && typeof err === "object" && "stderr" in err ? String(err.stderr ?? "") : "";
+  const text = stderr.trim() || (err instanceof Error ? err.message : String(err));
+  return text.split("\n").filter(Boolean).slice(-1)[0] ?? "unknown error";
+}
+function exportCredentialsCommand(profile) {
+  return `eval "$(aws configure export-credentials --profile ${profile} --format env)"   # mesh deploy reads AWS_ACCESS_KEY_ID; a platform stack carries no mesh:deployerRole`;
+}
+function renderPlatformNextSteps(setup, opts = {}) {
+  const dir = opts.relativeDir ?? setup.dir;
+  const steps = [];
+  if (!opts.bucket?.present) {
+    steps.push(`${stateBucketCreateCommand(setup)}   # the Pulumi state bucket, once`);
+  }
+  steps.push(
+    `cd ${dir}`,
+    "pnpm install",
+    `aws sso login --profile ${setup.profile}   # if this profile is SSO`,
+    exportCredentialsCommand(setup.profile),
+    `cd core && mesh deploy up        # the VPC, EKS, RDS and the public zone ${setup.env}.${setup.domain}`,
+    `# \u2192 then delegate the NS records of ${setup.env}.${setup.domain} from ${setup.domain}; the deploy waits on the ACM certificate until you do`,
+    "cd ../platform && mesh deploy up  # Temporal, Zitadel, the Hub  (needs Docker \u2014 it builds service images)",
+    `mesh login ${setup.tenant}.${setup.env}      # your platform sign-in, once it is up`,
+    "",
+    "Then, in your apps repo, for the hello-world app:",
+    `  mesh init --tenant ${setup.tenant} --platform ${setup.env}`,
+    "  mesh create-app --name hello --primitives service",
+    "  mesh deploy up                   # from the app directory"
+  );
+  return steps;
+}
+async function scaffoldPlatformRepo(setup) {
+  if (fs28.existsSync(setup.dir) && fs28.readdirSync(setup.dir).length > 0) {
+    throw new MeshCliError(`Target directory is not empty: ${setup.dir}`, {
+      remediation: { command: `mesh init platform ${setup.tenant} --dir <empty-dir>` }
+    });
+  }
+  const { copyTemplate: copyTemplate2 } = await Promise.resolve().then(() => (init_create_app(), create_app_exports));
+  const { findPackageRoot: findPackageRoot2 } = await Promise.resolve().then(() => (init_stack(), stack_exports));
+  const { syncSkills: syncSkills2 } = await Promise.resolve().then(() => (init_skills(), skills_exports));
+  const templateDir = path35.join(findPackageRoot2(), "templates", "platform-repo");
+  fs28.mkdirSync(setup.dir, { recursive: true });
+  copyTemplate2(templateDir, setup.dir, {
+    tenant: setup.tenant,
+    env: setup.env,
+    region: setup.region,
+    domain: setup.domain,
+    profile: setup.profile,
+    stateBucket: setup.stateBucket
+  });
+  syncSkills2(setup.dir);
+}
+var PLATFORM_SETUP_DEFAULTS, DOMAIN_REQUIRED_MESSAGE, realStateBucketDeps;
+var init_platform_setup = __esm({
+  "libs/mesh-cli/src/commands/init/platform-setup.ts"() {
+    "use strict";
+    init_errors();
+    PLATFORM_SETUP_DEFAULTS = {
+      env: "dev",
+      region: "us-east-2",
+      profile: "default"
+    };
+    DOMAIN_REQUIRED_MESSAGE = "--domain is required: the core stack creates the public Route 53 zone <env>.<domain>, and a placeholder domain scaffolds a zone that can never validate (the deploy stalls on the ACM certificate).";
+    realStateBucketDeps = {
+      headBucket(setup) {
+        try {
+          awsJson(["s3api", "head-bucket", "--bucket", setup.stateBucket, "--region", setup.region], setup.profile);
+          return true;
+        } catch {
+          return false;
+        }
+      },
+      createBucket(setup) {
+        const args = ["s3api", "create-bucket", "--bucket", setup.stateBucket, "--region", setup.region];
+        if (setup.region !== "us-east-1") args.push("--create-bucket-configuration", `LocationConstraint=${setup.region}`);
+        awsJson(args, setup.profile);
+      },
+      enableVersioning(setup) {
+        awsJson(
+          ["s3api", "put-bucket-versioning", "--bucket", setup.stateBucket, "--region", setup.region, "--versioning-configuration", "Status=Enabled"],
+          setup.profile
+        );
+      }
+    };
+  }
+});
+
+// libs/mesh-cli/src/commands/registry-publish.ts
+import { execFileSync as execFileSync25, execSync } from "child_process";
+import * as fs29 from "fs";
+import * as path36 from "path";
 function repoRoot() {
   return execSync("git rev-parse --show-toplevel", { encoding: "utf-8" }).trim();
 }
@@ -16546,9 +17021,9 @@ function computeSnapshotVersion(root) {
   return `0.0.0-dev.${stamp}.${sha}`;
 }
 function setPackageVersion(file, version) {
-  const content = fs28.readFileSync(file, "utf-8");
+  const content = fs29.readFileSync(file, "utf-8");
   const next = content.replace(/"version"(\s*:\s*)"[^"]*"/, `"version"$1"${version}"`);
-  fs28.writeFileSync(file, next);
+  fs29.writeFileSync(file, next);
 }
 function dirtyPackageJsons(root) {
   const out = execSync("git diff --name-only", { cwd: root, encoding: "utf-8" });
@@ -16581,8 +17056,8 @@ function registerRegistryPublish(registry) {
       logError("CodeArtifact login failed. Run: mesh registry login <context>");
       process.exit(1);
     }
-    const listPath = path35.join(root, "scripts/lib/publishable-packages.json");
-    const all = JSON.parse(fs28.readFileSync(listPath, "utf-8"));
+    const listPath = path36.join(root, "scripts/lib/publishable-packages.json");
+    const all = JSON.parse(fs29.readFileSync(listPath, "utf-8"));
     const patterns = (opts.only ?? "").split(",").map((s) => s.trim()).filter(Boolean);
     const selected = patterns.length ? all.filter((p) => patterns.some((pat) => p.dir.includes(pat) || p.name.includes(pat))) : all;
     if (selected.length === 0) {
@@ -16594,16 +17069,16 @@ function registerRegistryPublish(registry) {
     const preDirty = dirtyPackageJsons(root);
     const backups = [];
     const stamp = (dir) => {
-      const file = path35.join(root, dir, "package.json");
-      if (!fs28.existsSync(file)) return;
-      backups.push({ file, content: fs28.readFileSync(file, "utf-8") });
+      const file = path36.join(root, dir, "package.json");
+      if (!fs29.existsSync(file)) return;
+      backups.push({ file, content: fs29.readFileSync(file, "utf-8") });
       setPackageVersion(file, version);
     };
     try {
       for (const p of selected) {
         stamp(p.dir);
         for (const sub of p.subPackages ?? []) {
-          stamp(path35.join(p.dir, typeof sub === "string" ? sub : sub.dir));
+          stamp(path36.join(p.dir, typeof sub === "string" ? sub : sub.dir));
         }
       }
       const args = [
@@ -16618,14 +17093,14 @@ function registerRegistryPublish(registry) {
         ...opts.dryRun ? ["--dry-run"] : []
       ];
       logInfo(`Publishing ${selected.length} package(s)...`);
-      execFileSync24("bash", args, { cwd: root, stdio: "inherit", env: env ?? process.env });
+      execFileSync25("bash", args, { cwd: root, stdio: "inherit", env: env ?? process.env });
     } finally {
-      for (const b of backups) fs28.writeFileSync(b.file, b.content);
+      for (const b of backups) fs29.writeFileSync(b.file, b.content);
       logInfo("Restored source package.json versions.");
       const collateral = [...dirtyPackageJsons(root)].filter((f) => !preDirty.has(f));
       if (collateral.length) {
         try {
-          execFileSync24("git", ["checkout", "--", ...collateral], { cwd: root, stdio: "inherit" });
+          execFileSync25("git", ["checkout", "--", ...collateral], { cwd: root, stdio: "inherit" });
           logInfo(`Reverted ${collateral.length} package.json file(s) re-vendored by build:publish.`);
         } catch {
           logError(
@@ -16677,12 +17152,12 @@ __export(registry_exports, {
   shouldRemintAfter: () => shouldRemintAfter,
   shouldRepairUserNpmrc: () => shouldRepairUserNpmrc
 });
-import { execFileSync as execFileSync25 } from "child_process";
-import * as fs29 from "fs";
-import * as path36 from "path";
+import { execFileSync as execFileSync26 } from "child_process";
+import * as fs30 from "fs";
+import * as path37 from "path";
 function getEndpoint(env) {
   try {
-    const result = execFileSync25("aws", [
+    const result = execFileSync26("aws", [
       "codeartifact",
       "get-repository-endpoint",
       "--domain",
@@ -16709,7 +17184,7 @@ function getEndpoint(env) {
 }
 function codeartifactLogin(env) {
   try {
-    execFileSync25("aws", [
+    execFileSync26("aws", [
       "codeartifact",
       "login",
       "--tool",
@@ -16764,7 +17239,7 @@ function resolvePublisherRoleArn({
 }
 function assumeRole2(roleArn) {
   try {
-    const result = execFileSync25("aws", [
+    const result = execFileSync26("aws", [
       "sts",
       "assume-role",
       "--role-arn",
@@ -16786,7 +17261,7 @@ function assumeRole2(roleArn) {
 }
 function assumeRoleWithWebIdentity2(roleArn, idToken, sessionName) {
   try {
-    const result = execFileSync25("aws", [
+    const result = execFileSync26("aws", [
       "sts",
       "assume-role-with-web-identity",
       "--role-arn",
@@ -16850,55 +17325,58 @@ function resolveCredentials(context, roleArn) {
 function findProjectRoot2() {
   let dir = process.cwd();
   while (true) {
-    if (fs29.existsSync(path36.join(dir, "pnpm-workspace.yaml")) || fs29.existsSync(path36.join(dir, "pnpm-lock.yaml")) || fs29.existsSync(path36.join(dir, "Pulumi.yaml")) || fs29.existsSync(path36.join(dir, ".npmrc"))) {
+    if (fs30.existsSync(path37.join(dir, "pnpm-workspace.yaml")) || fs30.existsSync(path37.join(dir, "pnpm-lock.yaml")) || fs30.existsSync(path37.join(dir, "Pulumi.yaml")) || fs30.existsSync(path37.join(dir, ".npmrc"))) {
       return dir;
     }
-    const parent = path36.dirname(dir);
+    const parent = path37.dirname(dir);
     if (parent === dir) return null;
     dir = parent;
   }
 }
 function ensureProjectNpmrc(endpoint) {
   const projectRoot = findProjectRoot2() ?? process.cwd();
-  const npmrcPath2 = path36.join(projectRoot, ".npmrc");
+  const npmrcPath2 = path37.join(projectRoot, ".npmrc");
   const scopeLine = `${CA_NAMESPACE}:registry=${endpoint}`;
-  if (!fs29.existsSync(npmrcPath2)) {
-    fs29.writeFileSync(npmrcPath2, scopeLine + "\n", "utf-8");
+  if (!fs30.existsSync(npmrcPath2)) {
+    fs30.writeFileSync(npmrcPath2, scopeLine + "\n", "utf-8");
     return { created: true, updated: false, path: npmrcPath2 };
   }
-  const content = fs29.readFileSync(npmrcPath2, "utf-8");
+  const content = fs30.readFileSync(npmrcPath2, "utf-8");
   const scopeRegex = new RegExp(`^${CA_NAMESPACE.replace("/", "\\/")}:registry=.+$`, "m");
   if (scopeRegex.test(content)) {
     if (content.includes(scopeLine)) {
       return { created: false, updated: false, path: npmrcPath2 };
     }
     const updated = content.replace(scopeRegex, scopeLine);
-    fs29.writeFileSync(npmrcPath2, updated, "utf-8");
+    fs30.writeFileSync(npmrcPath2, updated, "utf-8");
     return { created: false, updated: true, path: npmrcPath2 };
   }
   const separator = content.endsWith("\n") ? "" : "\n";
-  fs29.writeFileSync(npmrcPath2, content + separator + scopeLine + "\n", "utf-8");
+  fs30.writeFileSync(npmrcPath2, content + separator + scopeLine + "\n", "utf-8");
   return { created: false, updated: true, path: npmrcPath2 };
 }
 function applyGrantToUserNpmrc(grant, npmrcPath2 = homeNpmrcPath()) {
   let existing = "";
   try {
-    existing = fs29.readFileSync(npmrcPath2, "utf-8");
+    existing = fs30.readFileSync(npmrcPath2, "utf-8");
   } catch {
   }
   const content = upsertNpmrcLines(existing, [
     { key: `${grant.scope}:registry`, value: grant.endpoint },
     { key: `${npmrcAuthKeyForEndpoint(grant.endpoint)}:_authToken`, value: grant.authorizationToken }
   ]);
-  fs29.mkdirSync(path36.dirname(npmrcPath2), { recursive: true });
-  fs29.writeFileSync(npmrcPath2, content, { mode: 384 });
+  fs30.mkdirSync(path37.dirname(npmrcPath2), { recursive: true });
+  fs30.writeFileSync(npmrcPath2, content, { mode: 384 });
   try {
-    fs29.chmodSync(npmrcPath2, 384);
+    fs30.chmodSync(npmrcPath2, 384);
   } catch {
   }
   return { path: npmrcPath2 };
 }
-function describeBrokerFailure(failure) {
+function describeBrokerFailure(failure, account = {}) {
+  const unverified = account.emailVerified === false ? `
+  Your Mesh account${account.email ? ` (${account.email})` : ""} has never confirmed its email address, and an unconfirmed account cannot hold a registry grant.
+  This is not something a role fixes: ask your Mesh contact to verify the address on your account (a self-registered, passkey-only sign-up lands here), then run: mesh registry logout && mesh registry login` : "";
   switch (failure.kind) {
     case "no-broker":
       return {
@@ -16913,7 +17391,7 @@ function describeBrokerFailure(failure) {
       };
     case "unauthenticated":
       return {
-        message: "The registry broker rejected your session (expired or wrong audience).",
+        message: "The registry broker rejected your session (expired or wrong audience)." + unverified,
         hint: "mesh registry logout && mesh registry login",
         fatal: false
       };
@@ -16925,7 +17403,7 @@ function describeBrokerFailure(failure) {
         message: `Your Mesh account${failure.email ? ` (${failure.email})` : ""} is not authorized to read ${CA_NAMESPACE} packages.` + (failure.requiredRoles?.length ? `
   Needs one of these Zitadel roles: ${failure.requiredRoles.join(", ")}` : "") + (failure.requestUrl ? `
   Request access: ${failure.requestUrl}` : "\n  Ask a Mesh platform admin to grant your account registry access.") + `
-  ${NOT_AUTHORIZED_RERUN}`,
+  ${NOT_AUTHORIZED_RERUN}` + unverified,
         fatal: true
       };
     case "unavailable":
@@ -16988,7 +17466,10 @@ async function tryBrokerLogin(opts) {
     }
   }
   if (result.ok) return { grant: result.grant };
-  const { message, hint, fatal } = describeBrokerFailure(result.failure);
+  const { message, hint, fatal } = describeBrokerFailure(
+    result.failure,
+    registryAccountState(readCredentials(session.context)?.idToken)
+  );
   if (fatal) {
     throw new RegistryNotAuthorizedError(message);
   }
@@ -17010,7 +17491,7 @@ function shouldRepairUserNpmrc(opts) {
 function repairUnscopedRegistry(npmrcPath2 = homeNpmrcPath()) {
   let original;
   try {
-    original = fs29.readFileSync(npmrcPath2, "utf-8");
+    original = fs30.readFileSync(npmrcPath2, "utf-8");
   } catch {
     return { removed: null };
   }
@@ -17018,8 +17499,8 @@ function repairUnscopedRegistry(npmrcPath2 = homeNpmrcPath()) {
   if (!removed) return { removed: null };
   const backupPath = `${npmrcPath2}.bak-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
   try {
-    fs29.writeFileSync(backupPath, original, "utf-8");
-    fs29.writeFileSync(npmrcPath2, content, "utf-8");
+    fs30.writeFileSync(backupPath, original, "utf-8");
+    fs30.writeFileSync(npmrcPath2, content, "utf-8");
   } catch (err) {
     return { removed: null, error: err instanceof Error ? err.message : String(err) };
   }
@@ -17031,9 +17512,9 @@ function renderRegistrySessionLine(session, now = Date.now()) {
 }
 async function checkExistingToken() {
   const npmrcPath2 = homeNpmrcPath();
-  if (!fs29.existsSync(npmrcPath2)) return { valid: false, state: "missing", reason: "no ~/.npmrc" };
+  if (!fs30.existsSync(npmrcPath2)) return { valid: false, state: "missing", reason: "no ~/.npmrc" };
   const hijackLine = findUnscopedCodeArtifactRegistry(
-    fs29.readFileSync(npmrcPath2, "utf-8")
+    fs30.readFileSync(npmrcPath2, "utf-8")
   ) ?? void 0;
   const probe = await probeRegistryToken({ npmrcPath: npmrcPath2 });
   if (probe.state === "missing") {
@@ -17086,9 +17567,9 @@ async function runRegistryStatus(opts) {
   logInfo(renderRegistrySessionLine(opts?.session ?? readRegistrySession()));
   const projectRoot = findProjectRoot2();
   if (projectRoot) {
-    const npmrcPath2 = path36.join(projectRoot, ".npmrc");
-    if (fs29.existsSync(npmrcPath2)) {
-      const content = fs29.readFileSync(npmrcPath2, "utf-8");
+    const npmrcPath2 = path37.join(projectRoot, ".npmrc");
+    if (fs30.existsSync(npmrcPath2)) {
+      const content = fs30.readFileSync(npmrcPath2, "utf-8");
       if (content.includes(`${CA_NAMESPACE}:registry=`)) {
         logSuccess(`Project .npmrc configured (${npmrcPath2})`);
       } else {
@@ -17122,7 +17603,7 @@ region = us-east-2`,
       { remediation: { command: `aws configure sso --profile ${profile}` } }
     );
   }
-  const probe = () => execFileSync25("aws", ["sts", "get-caller-identity", "--profile", profile], {
+  const probe = () => execFileSync26("aws", ["sts", "get-caller-identity", "--profile", profile], {
     stdio: ["ignore", "pipe", "pipe"],
     timeout: 2e4
   });
@@ -17133,7 +17614,7 @@ region = us-east-2`,
   } catch {
     logInfo(`AWS SSO session for profile '${profile}' is stale \u2014 opening browser login\u2026`);
   }
-  execFileSync25("aws", ["sso", "login", "--profile", profile], { stdio: "inherit" });
+  execFileSync26("aws", ["sso", "login", "--profile", profile], { stdio: "inherit" });
   try {
     probe();
   } catch (err) {
@@ -17289,7 +17770,9 @@ To install packages you do not need AWS at all \u2014 drop the flag:
   }
 }
 function registerRegistryCommands(program2) {
-  const registry = program2.command("registry").description("Manage npm registry auth for @mesh-tech packages");
+  const registry = program2.command("registry").description(
+    "PACKAGE access: the sign-in that makes @mesh-tech/* installable. One global identity \u2014 no AWS account, no platform, no `<tenant>.<env>` context. (`mesh login <tenant>.<env>` is the other one; that is for deploying to or operating a platform.)"
+  );
   registry.command("login").description(
     "Sign in to the Mesh package registry (browser, or device code with --device) and configure ~/.npmrc + the project .npmrc. Needs no platform context and no AWS account."
   ).argument(
@@ -17347,28 +17830,39 @@ __export(wizard_exports, {
   INIT_REPO_FIX: () => INIT_REPO_FIX,
   INTERRUPTED_EXIT_CODE: () => INTERRUPTED_EXIT_CODE,
   NO_SESSION_NO_TTY_MESSAGE: () => NO_SESSION_NO_TTY_MESSAGE,
+  PLATFORM_SETUP_LABEL: () => PLATFORM_SETUP_LABEL,
+  REGISTRY_WHY: () => REGISTRY_WHY,
   TENANT_REQUIRED_MESSAGE: () => TENANT_REQUIRED_MESSAGE,
   WIZARD_STEPS: () => WIZARD_STEPS,
   classifyRepo: () => classifyRepo,
   describeMode: () => describeMode,
+  isNewPlatform: () => isNewPlatform,
+  newPlatformStep: () => newPlatformStep,
+  platformSetupFlags: () => platformSetupFlags,
   registryStep: () => registryStep,
   renderWizardSummary: () => renderWizardSummary,
   repoStep: () => repoStep,
   resolveAnswers: () => resolveAnswers,
   runInitWizard: () => runInitWizard,
   runWizardSteps: () => runWizardSteps,
+  skillsStep: () => skillsStep,
   stepBlocks: () => stepBlocks,
   wizardExitCode: () => wizardExitCode,
   wizardNextCommands: () => wizardNextCommands
 });
-import * as fs30 from "fs";
-import * as path37 from "path";
-import { execFileSync as execFileSync26 } from "child_process";
+import * as fs31 from "fs";
+import * as path38 from "path";
+import { execFileSync as execFileSync27 } from "child_process";
 import chalk4 from "chalk";
+function isNewPlatform(mode) {
+  return typeof mode === "object" && "newPlatform" in mode;
+}
 function wizardExitCode(steps) {
   return steps.some((s) => s.status === "fail") ? 1 : 0;
 }
 function wizardNextCommands(mode, steps = []) {
+  const owned = steps.find((s) => s.next?.length)?.next;
+  if (owned) return owned;
   const repo = steps.find((s) => s.name === STEP_LABELS.repo);
   const first = repo && repo.status !== "pass" && repo.fix ? repo.fix : "mesh create-app";
   return mode === "local" ? [first] : [first, "mesh deploy up   # from the app directory, once it exists"];
@@ -17377,7 +17871,9 @@ function stepBlocks(result) {
   return result.status === "fail" && result.blocking !== false;
 }
 function describeMode(mode) {
-  return mode === "local" ? "local only" : `deployed platform (${mode.platform})`;
+  if (mode === "local") return "local only";
+  if (isNewPlatform(mode)) return `a new platform (${mode.newPlatform.env ?? PLATFORM_SETUP_DEFAULTS.env})`;
+  return `deployed platform (${mode.platform})`;
 }
 function renderWizardSummary(outcome, opts = {}) {
   const paint = opts.color === false ? { green: (s) => s, red: (s) => s, yellow: (s) => s, dim: (s) => s, cyan: (s) => s } : chalk4;
@@ -17403,10 +17899,12 @@ function resolveAnswers(opts, recorded, interactive) {
     open.push("tenant");
   }
   let mode;
-  if (opts.local && opts.platform) {
-    throw new MeshCliError("--local and --platform are mutually exclusive.");
+  const chosen = [opts.local && "--local", opts.platform && "--platform", opts.newPlatform && "--new-platform"].filter(Boolean);
+  if (chosen.length > 1) {
+    throw new MeshCliError(`${chosen.join(", ")} are mutually exclusive \u2014 a tenant runs in exactly one of those three places.`);
   }
-  if (opts.platform) mode = { platform: opts.platform };
+  if (opts.newPlatform) mode = { newPlatform: platformSetupFlags(opts) };
+  else if (opts.platform) mode = { platform: opts.platform };
   else if (opts.local) mode = "local";
   else if (opts.yes || !interactive) {
     mode = recorded && recorded.platform !== "local" ? { platform: recorded.platform } : "local";
@@ -17415,22 +17913,34 @@ function resolveAnswers(opts, recorded, interactive) {
   }
   return { tenant, mode, open };
 }
+function platformSetupFlags(opts) {
+  return {
+    env: typeof opts.newPlatform === "string" ? opts.newPlatform : void 0,
+    region: opts.region,
+    domain: opts.domain,
+    profile: opts.profile,
+    stateBucket: opts.stateBucket,
+    createStateBucket: opts.createStateBucket,
+    dir: opts.dir,
+    yes: opts.yes
+  };
+}
 function classifyRepo(cwd) {
   if (isInsidePlatformMonorepo(cwd)) return { kind: "platform-monorepo", root: resolveTargetRoot(cwd) };
   if (shouldBootstrapAppsRepo(cwd)) return { kind: "empty-apps-repo", root: cwd };
   const root = resolveTargetRoot(cwd);
-  const inRepo = fs30.existsSync(path37.join(root, ".git"));
+  const inRepo = fs31.existsSync(path38.join(root, ".git"));
   if (!inRepo) {
-    const hasContent = fs30.readdirSync(cwd).some((entry) => !entry.startsWith("."));
+    const hasContent = fs31.readdirSync(cwd).some((entry) => !entry.startsWith("."));
     return { kind: hasContent ? "no-repo" : "empty-dir", root: cwd };
   }
-  const hasWorkspace = fs30.existsSync(path37.join(root, "pnpm-workspace.yaml")) || fs30.existsSync(path37.join(root, "pnpm-lock.yaml"));
-  const hasApps = fs30.existsSync(path37.join(root, "apps")) || fs30.existsSync(path37.join(root, "tenants"));
+  const hasWorkspace = fs31.existsSync(path38.join(root, "pnpm-workspace.yaml")) || fs31.existsSync(path38.join(root, "pnpm-lock.yaml"));
+  const hasApps = fs31.existsSync(path38.join(root, "apps")) || fs31.existsSync(path38.join(root, "tenants"));
   if (hasWorkspace || hasApps) return { kind: "apps-repo", root };
   return { kind: "other-repo", root };
 }
 function gitInit(dir) {
-  execFileSync26("git", ["init", "-q"], { cwd: dir, stdio: ["ignore", "ignore", "pipe"] });
+  execFileSync27("git", ["init", "-q"], { cwd: dir, stdio: ["ignore", "ignore", "pipe"] });
 }
 async function runWizardSteps(ctx, steps) {
   const results = [];
@@ -17488,12 +17998,15 @@ async function runInitWizard(opts, deps = {}) {
         message: "Where does this tenant run?",
         choices: [
           { name: "Local only (mesh start / mesh dev \u2014 no deployed platform yet)", value: "local" },
-          { name: `A deployed Mesh platform (I have a ${tenant}.<env> context)`, value: "deployed" }
+          { name: `A deployed Mesh platform (I have a ${tenant}.<env> context)`, value: "deployed" },
+          { name: "Nothing yet \u2014 set up a new Mesh platform in my AWS account", value: "new" }
         ],
         default: recorded && recorded.platform !== "local" ? "deployed" : "local"
       });
       if (choice === "local") mode = "local";
-      else {
+      else if (choice === "new") {
+        mode = { newPlatform: platformSetupFlags({ ...opts, newPlatform: true }) };
+      } else {
         const env = await prompts.input({
           message: "Environment",
           default: recorded && recorded.platform !== "local" ? recorded.platform : "dev",
@@ -17506,7 +18019,7 @@ async function runInitWizard(opts, deps = {}) {
       cwd,
       tenant,
       mode,
-      context: mode === "local" ? null : `${tenant}.${mode.platform}`,
+      context: mode === "local" || isNewPlatform(mode) ? null : `${tenant}.${mode.platform}`,
       device: opts.device,
       profile: opts.profile,
       interactive,
@@ -17519,7 +18032,7 @@ async function runInitWizard(opts, deps = {}) {
     logInfo(`Setting up tenant '${tenant}' (${describeMode(mode)})\u2026`);
     const steps = await runWizardSteps(ctx, deps.steps ?? WIZARD_STEPS);
     const { kind, root } = classifyRepo(cwd);
-    if (!opts.skipRepo && (kind === "apps-repo" || kind === "empty-apps-repo")) {
+    if (!opts.skipRepo && !isNewPlatform(mode) && (kind === "apps-repo" || kind === "empty-apps-repo")) {
       const written = writeMeshJson(root, { tenant, platform: mode === "local" ? "local" : mode.platform });
       logInfo(`Recorded tenant + mode in ${written}`);
     }
@@ -17545,7 +18058,7 @@ async function runInitWizard(opts, deps = {}) {
     console.log = origLog;
   }
 }
-var NO_SESSION_NO_TTY_MESSAGE, TENANT_REQUIRED_MESSAGE, INTERRUPTED_EXIT_CODE, STEP_LABELS, registryStep, platformStep, INIT_REPO_FIX, repoStep, skillsStep, WIZARD_STEPS;
+var NO_SESSION_NO_TTY_MESSAGE, TENANT_REQUIRED_MESSAGE, REGISTRY_WHY, INTERRUPTED_EXIT_CODE, STEP_LABELS, PLATFORM_SETUP_LABEL, registryStep, newPlatformStep, platformStep, INIT_REPO_FIX, repoStep, skillsStep, WIZARD_STEPS;
 var init_wizard = __esm({
   "libs/mesh-cli/src/commands/init/wizard.ts"() {
     "use strict";
@@ -17559,8 +18072,10 @@ var init_wizard = __esm({
     init_create_app();
     init_skills();
     init_dev_local();
+    init_platform_setup();
     NO_SESSION_NO_TTY_MESSAGE = "No registry session and no terminal to sign in with.\n  On a headless box: mesh registry login --device   (one-time, prints a code)\n  In CI with AWS creds: mesh registry login --ci";
     TENANT_REQUIRED_MESSAGE = "--tenant is required (no TTY for interactive mode)";
+    REGISTRY_WHY = "Package access \u2014 a sign-in to the Mesh package REGISTRY, which is what makes `@mesh-tech/*` installable.\n  It is one global identity: no AWS account, no platform, no <tenant>.<env> context.\n  (`mesh login <tenant>.<env>` is the other sign-in \u2014 that one is only for deploying to, or operating, a platform.)";
     INTERRUPTED_EXIT_CODE = 130;
     STEP_LABELS = {
       registry: "Registry access",
@@ -17568,6 +18083,7 @@ var init_wizard = __esm({
       repo: "Repo",
       skills: "Agent skills"
     };
+    PLATFORM_SETUP_LABEL = "Platform setup";
     registryStep = {
       name: "registry",
       async run(ctx) {
@@ -17590,6 +18106,7 @@ var init_wizard = __esm({
           return { name, status: "fail", detail: NO_SESSION_NO_TTY_MESSAGE.split("\n")[0], fix: "mesh registry login --device", blocking: true };
         }
         try {
+          logInfo(REGISTRY_WHY);
           const login2 = ctx.seams?.runRegistryLogin ?? (async (opts) => {
             const { runRegistryLogin: runRegistryLogin2 } = await Promise.resolve().then(() => (init_registry(), registry_exports));
             await runRegistryLogin2(void 0, opts);
@@ -17618,10 +18135,46 @@ var init_wizard = __esm({
         return { name, status: "pass", detail: `Registry access OK (${session ? `signed in as ${session.email}` : "token written"})` };
       }
     };
+    newPlatformStep = {
+      name: "platform",
+      async run(ctx) {
+        const name = PLATFORM_SETUP_LABEL;
+        if (!isNewPlatform(ctx.mode)) return { name, status: "skip", detail: "no new platform requested" };
+        let setup;
+        try {
+          setup = await resolvePlatformSetup(ctx.tenant, { ...ctx.mode.newPlatform, yes: ctx.yes }, {
+            prompts: ctx.prompts,
+            interactive: ctx.interactive,
+            cwd: ctx.cwd
+          });
+        } catch (err) {
+          return {
+            name,
+            status: "fail",
+            detail: err.message.split("\n")[0],
+            fix: `mesh init --tenant ${ctx.tenant} --new-platform --domain <your-domain>`
+          };
+        }
+        try {
+          await (ctx.seams?.scaffoldPlatform ?? scaffoldPlatformRepo)(setup);
+        } catch (err) {
+          return { name, status: "fail", detail: `platform repo not scaffolded: ${err.message.split("\n")[0]}`, fix: `mesh init platform ${ctx.tenant} --dir <empty-dir>` };
+        }
+        const bucket = await ensureStateBucket(setup, ctx.seams?.stateBucket);
+        const next = renderPlatformNextSteps(setup, { bucket, relativeDir: path38.relative(ctx.cwd, setup.dir) || "." });
+        return {
+          name,
+          status: setup.createStateBucket && !bucket.present ? "warn" : "pass",
+          detail: `platform repo scaffolded at ${setup.dir} (${setup.tenant}.${setup.env}, ${setup.region}, zone ${setup.env}.${setup.domain})` + (setup.createStateBucket ? ` \u2014 state bucket: ${bucket.detail}` : ` \u2014 state bucket ${setup.stateBucket} not created (see Next)`),
+          next
+        };
+      }
+    };
     platformStep = {
       name: "platform",
       async run(ctx) {
         const name = STEP_LABELS.platform;
+        if (isNewPlatform(ctx.mode)) return newPlatformStep.run(ctx);
         if (!ctx.context) return { name, status: "skip", detail: "local only \u2014 no platform to sign in to" };
         const context = ctx.context;
         const cached = readCredentials(context);
@@ -17655,6 +18208,9 @@ var init_wizard = __esm({
       async run(ctx) {
         const name = STEP_LABELS.repo;
         if (ctx.skipRepo) return { name, status: "skip", detail: "--skip-repo" };
+        if (isNewPlatform(ctx.mode)) {
+          return { name, status: "skip", detail: "setting up a platform \u2014 the apps repo comes after the first deploy (see Next)" };
+        }
         const { kind, root } = classifyRepo(ctx.cwd);
         switch (kind) {
           case "platform-monorepo":
@@ -17703,8 +18259,8 @@ var init_wizard = __esm({
           }
           case "apps-repo": {
             const missing = [];
-            if (!fs30.existsSync(path37.join(root, "package.json"))) missing.push("package.json");
-            if (!fs30.existsSync(path37.join(root, "pnpm-workspace.yaml")) && !fs30.existsSync(path37.join(root, "pnpm-lock.yaml"))) {
+            if (!fs31.existsSync(path38.join(root, "package.json"))) missing.push("package.json");
+            if (!fs31.existsSync(path38.join(root, "pnpm-workspace.yaml")) && !fs31.existsSync(path38.join(root, "pnpm-lock.yaml"))) {
               missing.push("pnpm-workspace.yaml");
             }
             if (missing.length) {
@@ -17720,6 +18276,9 @@ var init_wizard = __esm({
       async run(ctx) {
         const name = STEP_LABELS.skills;
         if (ctx.skipRepo) return { name, status: "skip", detail: "--skip-repo" };
+        if (isNewPlatform(ctx.mode)) {
+          return { name, status: "skip", detail: "synced into the new platform repo by the scaffold" };
+        }
         const { kind, root } = classifyRepo(ctx.cwd);
         if (kind !== "apps-repo" && kind !== "empty-apps-repo") {
           return { name, status: "skip", detail: "no apps repo to install skills into" };
@@ -17738,8 +18297,15 @@ var init_wizard = __esm({
 
 // libs/mesh-cli/src/commands/init.ts
 import chalk5 from "chalk";
-import * as fs31 from "fs";
-import * as path38 from "path";
+import * as fs32 from "fs";
+import * as path39 from "path";
+async function setupPrompts() {
+  const [{ default: input2 }, { default: confirm }] = await Promise.all([
+    import("@inquirer/input"),
+    import("@inquirer/confirm")
+  ]);
+  return { input: (args) => input2(args), confirm: (args) => confirm(args) };
+}
 function isLocalContext(context) {
   return context === LOGIN_CONTEXT;
 }
@@ -17758,7 +18324,7 @@ async function probeHubTenants(hubUrl, accessToken) {
 }
 function readHomeNpmrc() {
   try {
-    return fs31.readFileSync(homeNpmrcPath(), "utf-8");
+    return fs32.readFileSync(homeNpmrcPath(), "utf-8");
   } catch {
     return "";
   }
@@ -17882,9 +18448,9 @@ async function runChecks2(args) {
   if (local) {
     checks.push({ name: "Deployer role", status: "pass", detail: "local context \u2014 no deployer role required" });
   } else {
-    const stackFiles = fs31.existsSync(root) ? fs31.readdirSync(root).filter((f) => /^Pulumi\..*\.yaml$/.test(f)) : [];
+    const stackFiles = fs32.existsSync(root) ? fs32.readdirSync(root).filter((f) => /^Pulumi\..*\.yaml$/.test(f)) : [];
     const hasRole = stackFiles.some(
-      (f) => /mesh:deployerRole/.test(fs31.readFileSync(path38.join(root, f), "utf-8"))
+      (f) => /mesh:deployerRole/.test(fs32.readFileSync(path39.join(root, f), "utf-8"))
     );
     checks.push(
       hasRole ? { name: "Deployer role", status: "pass", detail: "mesh:deployerRole configured in stack config" } : {
@@ -17896,8 +18462,8 @@ async function runChecks2(args) {
     );
   }
   const shapeProblems = [];
-  if (!fs31.existsSync(path38.join(root, "package.json"))) shapeProblems.push("package.json");
-  const hasWorkspace = fs31.existsSync(path38.join(root, "pnpm-workspace.yaml")) || fs31.existsSync(path38.join(root, "pnpm-lock.yaml"));
+  if (!fs32.existsSync(path39.join(root, "package.json"))) shapeProblems.push("package.json");
+  const hasWorkspace = fs32.existsSync(path39.join(root, "pnpm-workspace.yaml")) || fs32.existsSync(path39.join(root, "pnpm-lock.yaml"));
   if (!hasWorkspace) shapeProblems.push("pnpm-workspace.yaml");
   checks.push(
     shapeProblems.length === 0 ? { name: "Repo shape", status: "pass", detail: "pnpm workspace layout present" } : {
@@ -17920,8 +18486,11 @@ async function runChecks2(args) {
 }
 function registerInitCommands(program2) {
   const init = program2.command("init").enablePositionalOptions().description(
-    "Set up this machine and repo for a tenant \u2014 a guided wizard with no subcommand (tenant, local or deployed, package-registry sign-in, repo, skills); `init platform` scaffolds a platform repo, `init app-tenant` is the apps-repo doctor"
-  ).option("--tenant <name>", "app tenant this repo belongs to (prompted when omitted on a TTY)").option("--local", "local only \u2014 mesh start / mesh dev, no deployed platform (the default)").option("--platform <env>", "a deployed platform's environment; signs in to <tenant>.<env>").option("--device", "device-code sign-in for the registry and platform steps (headless / SSH)").option("--profile <aws-profile>", "deployers only: AWS profile that can read the registry (skips the broker)").option("--skip-repo", "do not bootstrap, check or record anything in the current repo", false).option("--yes", "accept every default and never prompt", false).option("--json", "one JSON document on stdout ({tenant, mode, steps, next}); human output on stderr", false).action(
+    "Set up this machine and repo for a tenant \u2014 a guided wizard with no subcommand. It starts from nothing: it asks where the tenant runs, and 'nowhere yet' is one of the answers (it scaffolds you a platform). Then package-registry sign-in, repo, skills. `init platform` is the same scaffold on its own; `init app-tenant` is the apps-repo doctor"
+  ).option("--tenant <name>", "app tenant this repo belongs to (prompted when omitted on a TTY)").option("--local", "local only \u2014 mesh start / mesh dev, no deployed platform (the default)").option("--platform <env>", "a deployed platform's environment; signs in to `<tenant>.<env>`").option(
+    "--new-platform [env]",
+    `nothing deployed yet \u2014 scaffold a tenant platform repo for \`<tenant>.<env>\` (default env: ${PLATFORM_SETUP_DEFAULTS.env}) and print its deploy sequence`
+  ).option("--region <region>", `--new-platform: AWS region (default: ${PLATFORM_SETUP_DEFAULTS.region})`).option("--domain <domain>", "--new-platform: base public domain you control; the core stack creates the zone {env}.{domain}. No default \u2014 a placeholder scaffolds a zone that can never validate").option("--state-bucket <bucket>", "--new-platform: Pulumi state S3 bucket (default: {tenant}-mesh-platform-pulumi-state)").option("--create-state-bucket", "--new-platform: create the state bucket (versioned) if it does not exist").option("--no-create-state-bucket", "--new-platform: never create the state bucket; print the aws command instead").option("--dir <path>", "--new-platform: where to scaffold the platform repo (default: ./{tenant}-mesh-platform)").option("--device", "device-code sign-in for the registry and platform steps (headless / SSH)").option("--profile <aws-profile>", "AWS profile this machine uses: read the registry without the broker (deployers only), and the profile a --new-platform stack config references").option("--skip-repo", "do not bootstrap, check or record anything in the current repo", false).option("--yes", "accept every default and never prompt", false).option("--json", "one JSON document on stdout ({tenant, mode, steps, next}); human output on stderr", false).action(
     async (opts) => {
       const { runInitWizard: runInitWizard2 } = await Promise.resolve().then(() => (init_wizard(), wizard_exports));
       const code = await runInitWizard2(opts);
@@ -17929,42 +18498,34 @@ function registerInitCommands(program2) {
     }
   );
   init.command("platform <tenant>").description(
-    "Scaffold a tenant PLATFORM repo (core + platform Pulumi layers on @mesh-tech/infra-components) that deploys with `mesh deploy` unmodified \u2014 the proven mesh-sandbox shape, annotated."
-  ).option("--env <env>", "environment the first stack targets", "dev").option("--region <region>", "AWS region", "us-east-2").option("--domain <domain>", "base public domain (ingress zone becomes {env}.{domain})", "example.com").option("--profile <profile>", "AWS profile the stack config references", "default").option("--state-bucket <bucket>", "Pulumi state S3 bucket (created by an operator)", void 0).option("--dir <path>", "target directory (default: ./{tenant}-mesh-platform)").action(async (tenant, opts) => {
-    if (!/^[a-z][a-z0-9-]*$/.test(tenant)) {
-      throw new MeshCliError(`Invalid tenant name '${tenant}' (lowercase alphanumeric + dashes).`);
-    }
-    const targetDir = path38.resolve(opts.dir ?? `${tenant}-mesh-platform`);
-    if (fs31.existsSync(targetDir) && fs31.readdirSync(targetDir).length > 0) {
-      throw new MeshCliError(`Target directory is not empty: ${targetDir}`, {
-        remediation: { command: `mesh init platform ${tenant} --dir <empty-dir>` }
+    "Scaffold a tenant PLATFORM repo (core + platform Pulumi layers on @mesh-tech/infra-components) that deploys with `mesh deploy` unmodified \u2014 the proven mesh-sandbox shape, annotated. On a terminal it ASKS for the values that differ per install (env, region, domain, state bucket, AWS profile), each pre-filled with its default; every answer is also a flag."
+  ).option("--env <env>", `environment the first stack targets (default: ${PLATFORM_SETUP_DEFAULTS.env})`).option("--region <region>", `AWS region (default: ${PLATFORM_SETUP_DEFAULTS.region})`).option(
+    "--domain <domain>",
+    "base public domain you control \u2014 the core stack creates the Route 53 zone {env}.{domain} and waits on its NS delegation. Required: it has no default, because a placeholder scaffolds a zone that can never validate"
+  ).option("--profile <profile>", `AWS profile the stack config references (default: ${PLATFORM_SETUP_DEFAULTS.profile})`).option("--state-bucket <bucket>", "Pulumi state S3 bucket (default: {tenant}-mesh-platform-pulumi-state)").option("--create-state-bucket", "create the state bucket (versioned) if it does not exist \u2014 prompted on a terminal").option("--no-create-state-bucket", "never create the state bucket; print the aws command instead").option("--dir <path>", "target directory (default: ./{tenant}-mesh-platform)").option("--yes", "accept every default and never prompt", false).action(
+    async (tenant, opts) => {
+      if (!/^[a-z][a-z0-9-]*$/.test(tenant)) {
+        throw new MeshCliError(`Invalid tenant name '${tenant}' (lowercase alphanumeric + dashes).`);
+      }
+      const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+      const { resolvePlatformSetup: resolvePlatformSetup2, scaffoldPlatformRepo: scaffoldPlatformRepo2, ensureStateBucket: ensureStateBucket2, renderPlatformNextSteps: renderPlatformNextSteps2 } = await Promise.resolve().then(() => (init_platform_setup(), platform_setup_exports));
+      const setup = await resolvePlatformSetup2(tenant, opts, {
+        prompts: interactive && !opts.yes ? await setupPrompts() : void 0,
+        interactive
       });
+      await scaffoldPlatformRepo2(setup);
+      logInfo(`Platform repo scaffolded at ${setup.dir}`);
+      const bucket = await ensureStateBucket2(setup);
+      if (bucket.detail !== "not requested") logInfo(`Pulumi state bucket: ${bucket.detail}`);
+      console.log("");
+      console.log("Next steps:");
+      for (const line of renderPlatformNextSteps2(setup, { bucket, relativeDir: path39.relative(process.cwd(), setup.dir) || "." })) {
+        console.log(line ? `  ${line}` : "");
+      }
+      console.log("");
+      logInfo(`Review the annotated stack configs (Pulumi.${tenant}-${setup.env}.yaml) before the first deploy.`);
     }
-    const { copyTemplate: copyTemplate2 } = await Promise.resolve().then(() => (init_create_app(), create_app_exports));
-    const { findPackageRoot: findPackageRoot2 } = await Promise.resolve().then(() => (init_stack(), stack_exports));
-    const templateDir = path38.join(findPackageRoot2(), "templates", "platform-repo");
-    const context = {
-      tenant,
-      env: opts.env,
-      region: opts.region,
-      domain: opts.domain,
-      profile: opts.profile,
-      stateBucket: opts.stateBucket ?? `${tenant}-mesh-platform-pulumi-state`
-    };
-    fs31.mkdirSync(targetDir, { recursive: true });
-    copyTemplate2(templateDir, targetDir, context);
-    syncSkills(targetDir);
-    logInfo(`Platform repo scaffolded at ${targetDir}`);
-    console.log("");
-    console.log("Next steps:");
-    console.log(`  cd ${path38.relative(process.cwd(), targetDir) || "."}`);
-    console.log(`  mesh login ${tenant}.${opts.env}     # or an operator context with access`);
-    console.log("  pnpm install");
-    console.log("  cd core && mesh deploy up");
-    console.log("  cd ../platform && mesh deploy up");
-    console.log("");
-    logInfo(`Review the annotated stack configs (Pulumi.${tenant}-${opts.env}.yaml) before the first deploy.`);
-  });
+  );
   init.command("app-tenant").description(
     "Check (and with --fix, repair) everything an app-tenant repo needs: auth, registry, tenant registration, repo shape, agent skills. Re-run any time \u2014 it is the doctor."
   ).option("--tenant <name>", "app tenant (default: mesh:tenant from Pulumi config, else 'local')").option("--context <ctx>", "login context to check against (default: 'local' when the local platform is targeted)", LOGIN_CONTEXT).option("--hub-url <url>", "platform Hub API base URL", LOCAL_HUB_API).option("--fix", "apply developer-scope fixes (registry token, skills sync)", false).option("--profile <profile>", "AWS SSO profile --fix logs into CodeArtifact with (e.g. mesh-dev)").option("--json", "machine-readable output", false).action(async (opts) => {
@@ -18020,15 +18581,16 @@ var init_init = __esm({
     init_skills();
     init_dev_local();
     init_seed_zitadel();
+    init_platform_setup();
     LOCAL_HUB_API = "http://localhost:4568";
   }
 });
 
 // libs/mesh-cli/src/commands/install-shim.ts
-import { execFileSync as execFileSync27 } from "child_process";
-import * as fs32 from "fs";
+import { execFileSync as execFileSync28 } from "child_process";
+import * as fs33 from "fs";
 import * as os10 from "os";
-import * as path39 from "path";
+import * as path40 from "path";
 function shimScript() {
   return `#!/bin/sh
 # mesh \u2014 canonical launcher shim (installed by \`mesh install-shim\`).
@@ -18101,25 +18663,25 @@ exit 1
 `;
 }
 function defaultShimDir() {
-  return path39.join(os10.homedir(), ".local", "bin");
+  return path40.join(os10.homedir(), ".local", "bin");
 }
 function dirOnPath(dir, pathEnv) {
   if (!pathEnv) return false;
-  return pathEnv.split(path39.delimiter).some((p) => p === dir);
+  return pathEnv.split(path40.delimiter).some((p) => p === dir);
 }
 function registerInstallShimCommand(program2) {
   program2.command("install-shim").description("Install a build-free `mesh` shim on your PATH so bare `mesh` runs the local source").option("--dir <dir>", "Directory to install into (must be on your PATH)", defaultShimDir()).option("-f, --force", "Overwrite an existing file at the target path", false).action((opts) => {
-    const dir = path39.resolve(opts.dir);
-    const target = path39.join(dir, "mesh");
-    if (fs32.existsSync(target) && !opts.force) {
+    const dir = path40.resolve(opts.dir);
+    const target = path40.join(dir, "mesh");
+    if (fs33.existsSync(target) && !opts.force) {
       logWarn(`A file already exists at ${target}.`);
       logInfo("Re-run with --force to overwrite it, or pass --dir <other-path-on-PATH>.");
       return;
     }
     try {
-      fs32.mkdirSync(dir, { recursive: true });
-      fs32.writeFileSync(target, shimScript(), { mode: 493 });
-      fs32.chmodSync(target, 493);
+      fs33.mkdirSync(dir, { recursive: true });
+      fs33.writeFileSync(target, shimScript(), { mode: 493 });
+      fs33.chmodSync(target, 493);
     } catch (err) {
       logError(`Could not write the shim to ${target}: ${err.message}`);
       process.exitCode = 1;
@@ -18132,13 +18694,13 @@ function registerInstallShimCommand(program2) {
     } else {
       logInfo("Bare `mesh <cmd>` now runs the local source of whatever workspace you're in.");
     }
-    const diagPath = path39.join(os10.tmpdir(), "mesh-shim-selftest.log");
+    const diagPath = path40.join(os10.tmpdir(), "mesh-shim-selftest.log");
     let stdout = "";
     let stderr = "";
     let status = 0;
     let ok = true;
     try {
-      stdout = execFileSync27(target, ["--help"], {
+      stdout = execFileSync28(target, ["--help"], {
         cwd: process.cwd(),
         encoding: "utf8",
         stdio: ["ignore", "pipe", "pipe"]
@@ -18165,7 +18727,7 @@ function registerInstallShimCommand(program2) {
       ""
     ].join("\n");
     try {
-      fs32.writeFileSync(diagPath, diag);
+      fs33.writeFileSync(diagPath, diag);
     } catch {
     }
     if (ok && /Commands:|Usage:/.test(stdout)) {
@@ -18185,17 +18747,17 @@ var init_install_shim = __esm({
 });
 
 // libs/mesh-cli/src/commands/local/hub-local.ts
-import { execFile as execFile3, execFileSync as execFileSync28 } from "child_process";
-import * as fs33 from "fs";
+import { execFile as execFile3, execFileSync as execFileSync29 } from "child_process";
+import * as fs34 from "fs";
 import * as os11 from "os";
-import * as path40 from "path";
+import * as path41 from "path";
 import { promisify as promisify2 } from "util";
 function cacheDir() {
   return meshCacheDir("hub-local");
 }
 function npmrcPath() {
-  const p = path40.join(os11.homedir(), ".npmrc");
-  if (!fs33.existsSync(p) || !fs33.readFileSync(p, "utf-8").includes("codeartifact")) {
+  const p = path41.join(os11.homedir(), ".npmrc");
+  if (!fs34.existsSync(p) || !fs34.readFileSync(p, "utf-8").includes("codeartifact")) {
     throw new MeshCliError(
       "The local Hub builds from the published @mesh-tech/hub tarball, which needs registry auth.",
       { remediation: { command: REGISTRY_LOGIN_FIX } }
@@ -18205,7 +18767,7 @@ function npmrcPath() {
 }
 function imageExists(tag) {
   try {
-    execFileSync28("docker", ["image", "inspect", tag], { stdio: ["ignore", "pipe", "pipe"] });
+    execFileSync29("docker", ["image", "inspect", tag], { stdio: ["ignore", "pipe", "pipe"] });
     return true;
   } catch {
     return false;
@@ -18214,22 +18776,22 @@ function imageExists(tag) {
 function ensureHubAuthImage() {
   if (imageExists(HUB_AUTH_IMAGE)) return;
   logInfo(`Building ${HUB_AUTH_IMAGE} (Hub auth proxy)\u2026`);
-  const hubStackDir = path40.join(findPackageRoot(), "stack", "hub");
-  execFileSync28(
+  const hubStackDir = path41.join(findPackageRoot(), "stack", "hub");
+  execFileSync29(
     "docker",
-    ["build", "-f", path40.join(hubStackDir, "Dockerfile.auth"), "-t", HUB_AUTH_IMAGE, hubStackDir],
+    ["build", "-f", path41.join(hubStackDir, "Dockerfile.auth"), "-t", HUB_AUTH_IMAGE, hubStackDir],
     { stdio: ["ignore", "inherit", "inherit"], env: { ...process.env, DOCKER_BUILDKIT: "1" } }
   );
   logSuccess(`Built ${HUB_AUTH_IMAGE}`);
 }
 function hasRegistryAuth() {
-  const p = path40.join(os11.homedir(), ".npmrc");
-  return fs33.existsSync(p) && fs33.readFileSync(p, "utf-8").includes("codeartifact");
+  const p = path41.join(os11.homedir(), ".npmrc");
+  return fs34.existsSync(p) && fs34.readFileSync(p, "utf-8").includes("codeartifact");
 }
 function localHubVersion() {
   const versions = HUB_IMAGES.map((name) => {
     try {
-      const out = execFileSync28("docker", ["images", name, "--format", "{{.Tag}}"], {
+      const out = execFileSync29("docker", ["images", name, "--format", "{{.Tag}}"], {
         encoding: "utf-8",
         stdio: ["ignore", "pipe", "pipe"]
       });
@@ -18255,10 +18817,10 @@ async function fetchTarball() {
       { encoding: "utf-8" }
     );
     const info = JSON.parse(stdout)[0];
-    return { tarball: path40.join(dir, info.filename), version: info.version };
+    return { tarball: path41.join(dir, info.filename), version: info.version };
   } catch (err) {
     const authFailure = isNpmAuthError(err);
-    const cached = fs33.readdirSync(dir).filter((f) => f.startsWith("mesh-tech-hub-") && f.endsWith(".tgz")).sort((a, b) => a.localeCompare(b, void 0, { numeric: true })).at(-1);
+    const cached = fs34.readdirSync(dir).filter((f) => f.startsWith("mesh-tech-hub-") && f.endsWith(".tgz")).sort((a, b) => a.localeCompare(b, void 0, { numeric: true })).at(-1);
     if (!cached) {
       if (authFailure) {
         throw new MeshCliError(
@@ -18276,7 +18838,7 @@ async function fetchTarball() {
     } else {
       logInfo(`Registry unavailable \u2014 using the cached hub tarball v${version}`);
     }
-    return { tarball: path40.join(dir, cached), version };
+    return { tarball: path41.join(dir, cached), version };
   } finally {
     heartbeat.stop();
   }
@@ -18305,13 +18867,13 @@ async function ensureHubImages() {
     logInfo(`Local Hub images ready (v${version})`);
     return version;
   }
-  const context = path40.join(cacheDir(), `context-${version}`);
-  fs33.rmSync(context, { recursive: true, force: true });
-  fs33.mkdirSync(context, { recursive: true });
-  execFileSync28("tar", ["-xzf", tarball, "-C", context, "--strip-components", "1"], {
+  const context = path41.join(cacheDir(), `context-${version}`);
+  fs34.rmSync(context, { recursive: true, force: true });
+  fs34.mkdirSync(context, { recursive: true });
+  execFileSync29("tar", ["-xzf", tarball, "-C", context, "--strip-components", "1"], {
     stdio: ["ignore", "pipe", "pipe"]
   });
-  const hubStackDir = path40.join(findPackageRoot(), "stack", "hub");
+  const hubStackDir = path41.join(findPackageRoot(), "stack", "hub");
   for (const [name, dockerfile] of [
     ["mesh-local-hub-api", "Dockerfile.api"],
     ["mesh-local-hub-ui", "Dockerfile.ui"]
@@ -18319,12 +18881,12 @@ async function ensureHubImages() {
     const tag = `${name}:${version}`;
     if (imageExists(tag)) continue;
     logInfo(`Building ${tag} from the published tarball\u2026`);
-    execFileSync28(
+    execFileSync29(
       "docker",
       [
         "build",
         "-f",
-        path40.join(hubStackDir, dockerfile),
+        path41.join(hubStackDir, dockerfile),
         "-t",
         tag,
         "--secret",
@@ -18342,29 +18904,29 @@ function tarballNameForImageVersion(version) {
   return `mesh-tech-hub-${version.replace(/-r\d+$/, "")}.tgz`;
 }
 function readHubCompiledAuthz(version) {
-  const context = path40.join(cacheDir(), `context-${version}`);
-  const file = path40.join(context, HUB_COMPILED_AUTHZ_REL);
-  if (!fs33.existsSync(file)) {
+  const context = path41.join(cacheDir(), `context-${version}`);
+  const file = path41.join(context, HUB_COMPILED_AUTHZ_REL);
+  if (!fs34.existsSync(file)) {
     const tarball = tarballNameForImageVersion(version);
-    if (!tarball || !fs33.existsSync(path40.join(cacheDir(), tarball))) return null;
-    fs33.mkdirSync(context, { recursive: true });
+    if (!tarball || !fs34.existsSync(path41.join(cacheDir(), tarball))) return null;
+    fs34.mkdirSync(context, { recursive: true });
     try {
-      execFileSync28(
+      execFileSync29(
         "tar",
-        ["-xzf", path40.join(cacheDir(), tarball), "-C", context, "--strip-components", "1", `package/${HUB_COMPILED_AUTHZ_REL}`],
+        ["-xzf", path41.join(cacheDir(), tarball), "-C", context, "--strip-components", "1", `package/${HUB_COMPILED_AUTHZ_REL}`],
         { stdio: ["ignore", "pipe", "pipe"] }
       );
     } catch {
       return null;
     }
-    if (!fs33.existsSync(file)) return null;
+    if (!fs34.existsSync(file)) return null;
   }
-  const parsed = JSON.parse(fs33.readFileSync(file, "utf-8"));
+  const parsed = JSON.parse(fs34.readFileSync(file, "utf-8"));
   if (typeof parsed.zed !== "string" || !parsed.metadata || typeof parsed.metadata !== "object") return null;
   return { zed: parsed.zed, metadata: parsed.metadata };
 }
 function readWorkspaceCatalog(repoRoot2) {
-  const text = fs33.readFileSync(path40.join(repoRoot2, "pnpm-workspace.yaml"), "utf-8");
+  const text = fs34.readFileSync(path41.join(repoRoot2, "pnpm-workspace.yaml"), "utf-8");
   const marker = "\ncatalog:\n";
   const at = text.indexOf(marker);
   if (at === -1) return {};
@@ -18379,11 +18941,11 @@ function readWorkspaceCatalog(repoRoot2) {
 function normalizeHubManifests(contextDir, catalog) {
   const DEP_FIELDS = ["dependencies", "optionalDependencies", "peerDependencies"];
   const touched = [];
-  for (const entry of fs33.readdirSync(contextDir, { withFileTypes: true })) {
+  for (const entry of fs34.readdirSync(contextDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    const manifest = path40.join(contextDir, entry.name, "package.json");
-    if (!fs33.existsSync(manifest)) continue;
-    const pkg = JSON.parse(fs33.readFileSync(manifest, "utf-8"));
+    const manifest = path41.join(contextDir, entry.name, "package.json");
+    if (!fs34.existsSync(manifest)) continue;
+    const pkg = JSON.parse(fs34.readFileSync(manifest, "utf-8"));
     let changed = false;
     if (pkg.devDependencies) {
       delete pkg.devDependencies;
@@ -18412,7 +18974,7 @@ function normalizeHubManifests(contextDir, catalog) {
       }
     }
     if (changed) {
-      fs33.writeFileSync(manifest, `${JSON.stringify(pkg, null, 2)}
+      fs34.writeFileSync(manifest, `${JSON.stringify(pkg, null, 2)}
 `);
       touched.push(`${entry.name}/package.json`);
     }
@@ -18420,15 +18982,15 @@ function normalizeHubManifests(contextDir, catalog) {
   return touched;
 }
 async function buildHubImagesFromSource(repoRoot2) {
-  const hubDir = path40.join(repoRoot2, "apps", "hub");
-  if (!fs33.existsSync(path40.join(hubDir, "package.json"))) {
+  const hubDir = path41.join(repoRoot2, "apps", "hub");
+  if (!fs34.existsSync(path41.join(hubDir, "package.json"))) {
     throw new MeshCliError(
       `--hub-from-source needs a mesh-platform checkout; no apps/hub under ${repoRoot2}.`,
       { remediation: { command: "Run mesh start from a mesh-platform checkout, or drop --hub-from-source" } }
     );
   }
   const npmrc = npmrcPath();
-  const version = `${JSON.parse(fs33.readFileSync(path40.join(hubDir, "package.json"), "utf-8")).version}-src`;
+  const version = `${JSON.parse(fs34.readFileSync(path41.join(hubDir, "package.json"), "utf-8")).version}-src`;
   const build = startHeartbeat("building apps/hub (api + ui) from source");
   try {
     for (const pkg of ["@mesh-tech/hub-api", "@mesh-tech/hub-ui"]) {
@@ -18437,27 +18999,27 @@ async function buildHubImagesFromSource(repoRoot2) {
   } finally {
     build.stop();
   }
-  const context = path40.join(cacheDir(), `context-${version}`);
-  fs33.rmSync(context, { recursive: true, force: true });
-  fs33.mkdirSync(context, { recursive: true });
+  const context = path41.join(cacheDir(), `context-${version}`);
+  fs34.rmSync(context, { recursive: true, force: true });
+  fs34.mkdirSync(context, { recursive: true });
   await execFileAsync2("pnpm", ["pack", "--pack-destination", context], { cwd: hubDir, maxBuffer: 64 * 1024 * 1024 });
-  const tarball = fs33.readdirSync(context).find((f) => f.endsWith(".tgz"));
+  const tarball = fs34.readdirSync(context).find((f) => f.endsWith(".tgz"));
   if (!tarball) throw new MeshCliError("pnpm pack produced no tarball for apps/hub");
-  execFileSync28("tar", ["-xzf", path40.join(context, tarball), "-C", context, "--strip-components", "1"], {
+  execFileSync29("tar", ["-xzf", path41.join(context, tarball), "-C", context, "--strip-components", "1"], {
     stdio: ["ignore", "pipe", "pipe"]
   });
   const rewritten = normalizeHubManifests(context, readWorkspaceCatalog(repoRoot2));
   if (rewritten.length > 0) logInfo(`Normalized ${rewritten.length} manifest(s) for npm: ${rewritten.join(", ")}`);
-  const hubStackDir = path40.join(findPackageRoot(), "stack", "hub");
+  const hubStackDir = path41.join(findPackageRoot(), "stack", "hub");
   for (const [name, dockerfile] of [
     ["mesh-local-hub-api", "Dockerfile.api"],
     ["mesh-local-hub-ui", "Dockerfile.ui"]
   ]) {
     const tag = `${name}:${version}`;
     logInfo(`Building ${tag} from source\u2026`);
-    execFileSync28(
+    execFileSync29(
       "docker",
-      ["build", "-f", path40.join(hubStackDir, dockerfile), "-t", tag, "--secret", `id=npmrc,src=${npmrc}`, context],
+      ["build", "-f", path41.join(hubStackDir, dockerfile), "-t", tag, "--secret", `id=npmrc,src=${npmrc}`, context],
       { stdio: ["ignore", "inherit", "inherit"], env: { ...process.env, DOCKER_BUILDKIT: "1" } }
     );
     logSuccess(`Built ${tag}`);
@@ -18542,8 +19104,8 @@ var init_seed_hub_catalog = __esm({
 });
 
 // libs/mesh-cli/src/commands/local/index.ts
-import * as fs34 from "fs";
-import * as path41 from "path";
+import * as fs35 from "fs";
+import * as path42 from "path";
 import chalk6 from "chalk";
 function crashError(crashed) {
   return new MeshCliError(
@@ -18586,7 +19148,7 @@ async function waitForStack(io = {
       );
     }
     logInfo(`Waiting for ${pending.map((e) => e.label).join(", ")} \u2026`);
-    await new Promise((resolve19) => setTimeout(resolve19, WAIT_POLL_MS));
+    await new Promise((resolve20) => setTimeout(resolve20, WAIT_POLL_MS));
   }
 }
 function printEndpoints(hubRunning) {
@@ -18665,12 +19227,12 @@ function portMoveHints() {
 }
 function repoRootForHubSource() {
   for (let dir = process.cwd(); ; ) {
-    if (fs34.existsSync(path41.join(dir, "apps", "hub", "package.json"))) return dir;
-    const parent = path41.dirname(dir);
+    if (fs35.existsSync(path42.join(dir, "apps", "hub", "package.json"))) return dir;
+    const parent = path42.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
-  return path41.resolve(findPackageRoot(), "..", "..");
+  return path42.resolve(findPackageRoot(), "..", "..");
 }
 function registerLocalCommands(program2) {
   program2.command("start").description("Start the full-local Mesh platform (Docker only \u2014 no AWS, no VPN)").option("--no-seed", "skip first-boot seeding (tenant registry, artifacts bucket)").option("--no-hub", "start without the Hub (API + UI)").option(
@@ -18817,7 +19379,7 @@ Re-running start from here may recreate shared containers with this checkout's c
             overlayStarted: true
           });
           if (crashed.length > 0) throw crashError(crashed);
-          await new Promise((resolve19) => setTimeout(resolve19, 2e3));
+          await new Promise((resolve20) => setTimeout(resolve20, 2e3));
           up = await probeEndpoint(endpoint);
         }
         if (!up) {
@@ -19112,6 +19674,18 @@ var init_src3 = __esm({
   }
 });
 
+// libs/mesh-cli/src/commands/secrets/context.ts
+function resolveSecretsContext(opts, stackOpt = resolveStackOption(opts)) {
+  return detectContext(stackOpt, { tenant: opts.tenant, stack: stackOpt });
+}
+var init_context2 = __esm({
+  "libs/mesh-cli/src/commands/secrets/context.ts"() {
+    "use strict";
+    init_context();
+    init_stack_flag();
+  }
+});
+
 // libs/mesh-cli/src/commands/secrets/set.ts
 import {
   SSMClient as SSMClient2,
@@ -19260,7 +19834,7 @@ function displaySummary(fields, values, depth = 0) {
 }
 async function setCommand(servicePath, opts) {
   const stackOpt = resolveStackOption(opts);
-  const context = detectContext(stackOpt);
+  const context = resolveSecretsContext(opts, stackOpt);
   const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
   await ensureAwsCredentialsForStack(stackOpt ?? context.stage);
   const ssmClient = new SSMClient2({ region });
@@ -19498,9 +20072,9 @@ var init_set = __esm({
   "libs/mesh-cli/src/commands/secrets/set.ts"() {
     "use strict";
     init_src3();
-    init_context();
     init_log();
     init_stack_flag();
+    init_context2();
     init_pulumi();
     init_aws_auth();
   }
@@ -19538,7 +20112,7 @@ function indexAlreadyMatches(missing, stale, indexExists, malformed) {
 }
 async function reindexCommand(servicePath, opts) {
   const stackOpt = resolveStackOption(opts);
-  const context = detectContext(stackOpt);
+  const context = resolveSecretsContext(opts, stackOpt);
   const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
   await ensureAwsCredentialsForStack(stackOpt ?? context.stage);
   const ssmClient = new SSMClient3({ region });
@@ -19634,9 +20208,9 @@ var init_reindex = __esm({
   "libs/mesh-cli/src/commands/secrets/reindex.ts"() {
     "use strict";
     init_src3();
-    init_context();
     init_log();
     init_stack_flag();
+    init_context2();
     init_set();
   }
 });
@@ -19840,7 +20414,7 @@ async function migrateService(smClient, meta, schema, opts) {
   return { migrated, skipped, errors };
 }
 async function migrateConfigCommand(opts) {
-  const context = detectContext(resolveStackOption(opts));
+  const context = resolveSecretsContext(opts);
   const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
   const ssmClient = new SSMClient4({ region });
   const smClient = new SecretsManagerClient8({ region });
@@ -19879,9 +20453,8 @@ Migrating: ${name}`);
 var init_migrate_config = __esm({
   "libs/mesh-cli/src/commands/secrets/migrate-config.ts"() {
     "use strict";
-    init_context();
     init_log();
-    init_stack_flag();
+    init_context2();
   }
 });
 
@@ -19893,15 +20466,15 @@ function registerSecretsCommands(program2) {
     const args = cmd.args;
     await execCommand2(args);
   });
-  secrets.command("set [service]").description("Set credentials for an external service (e.g., mesh secrets set external/symitar)").option("--key <key>", "Instance key for multi-instance services (e.g., FI ID)").option("--all", "Prompt for all fields including optional ones").option("--json <json>", "Non-interactive: provide values as JSON").option("--stack <stack>", "Pulumi stack name (override detection)").addOption(new Option2("--stage <stack>", "Deprecated alias for --stack").hideHelp()).option("--region <region>", "AWS region (default: us-east-2)").action(async (service, opts) => {
+  secrets.command("set [service]").description("Set credentials for an external service (e.g., mesh secrets set external/symitar)").option("--key <key>", "Instance key for multi-instance services (e.g., FI ID)").option("--all", "Prompt for all fields including optional ones").option("--json <json>", "Non-interactive: provide values as JSON").option("-t, --tenant <tenant>", "Tenant to address (override detection)").option("--stack <stack>", "Pulumi stack name (override detection)").addOption(new Option2("--stage <stack>", "Deprecated alias for --stack").hideHelp()).option("--region <region>", "AWS region (default: us-east-2)").action(async (service, opts) => {
     await setCommand(service, opts);
   });
   secrets.command("reindex [service]").description(
     "Rebuild a multi-instance external service's instance index (the {prefix}/.index secret listInstances() reads) from the per-key secrets actually in Secrets Manager \u2014 the repair for an instance secret created or deleted out of band"
-  ).option("--dry-run", "Show what would change without writing").option("--stack <stack>", "Pulumi stack name (override detection)").addOption(new Option2("--stage <stack>", "Deprecated alias for --stack").hideHelp()).option("--region <region>", "AWS region (default: us-east-2)").action(async (service, opts) => {
+  ).option("--dry-run", "Show what would change without writing").option("-t, --tenant <tenant>", "Tenant to address (override detection)").option("--stack <stack>", "Pulumi stack name (override detection)").addOption(new Option2("--stage <stack>", "Deprecated alias for --stack").hideHelp()).option("--region <region>", "AWS region (default: us-east-2)").action(async (service, opts) => {
     await reindexCommand(service, opts);
   });
-  secrets.command("migrate-config").description("Backfill .config mirror secrets for all external services").option("--force", "Overwrite existing .config mirrors").option("--dry-run", "Show what would be written without writing").option("--stack <stack>", "Pulumi stack name (override detection)").addOption(new Option2("--stage <stack>", "Deprecated alias for --stack").hideHelp()).option("--region <region>", "AWS region (default: us-east-2)").action(async (opts) => {
+  secrets.command("migrate-config").description("Backfill .config mirror secrets for all external services").option("--force", "Overwrite existing .config mirrors").option("--dry-run", "Show what would be written without writing").option("-t, --tenant <tenant>", "Tenant to address (override detection)").option("--stack <stack>", "Pulumi stack name (override detection)").addOption(new Option2("--stage <stack>", "Deprecated alias for --stack").hideHelp()).option("--region <region>", "AWS region (default: us-east-2)").action(async (opts) => {
     await migrateConfigCommand(opts);
   });
 }
@@ -19919,7 +20492,7 @@ var init_secrets = __esm({
 import { createHash as createHash4 } from "node:crypto";
 import { createReadStream } from "node:fs";
 import { readdir, readFile as readFile2, stat } from "node:fs/promises";
-import { join as join37, relative as relative9, resolve as resolve16, sep as sep6 } from "node:path";
+import { join as join38, relative as relative11, resolve as resolve17, sep as sep6 } from "node:path";
 async function describeSiteHttpError(res, target, site) {
   if (res.status === 403) {
     return `not allowed to publish "${site}" \u2014 you are authenticated but lack the grant. Need one of: sites:${site}:publish, sites:*:publish, or studio-admin.`;
@@ -19941,9 +20514,9 @@ async function walk(root) {
   async function visit(dir) {
     for (const entry of await readdir(dir, { withFileTypes: true })) {
       if (SKIP_ENTRIES.has(entry.name)) continue;
-      const absolute = join37(dir, entry.name);
+      const absolute = join38(dir, entry.name);
       if (entry.isSymbolicLink()) {
-        logWarn(`skipping symlink ${relative9(root, absolute)}`);
+        logWarn(`skipping symlink ${relative11(root, absolute)}`);
         continue;
       }
       if (entry.isDirectory()) {
@@ -19955,7 +20528,7 @@ async function walk(root) {
       out.push({
         // Manifest paths are always forward-slashed, whatever the host OS uses,
         // so a site published from Windows resolves identically to one from a Mac.
-        path: relative9(root, absolute).split(sep6).join("/"),
+        path: relative11(root, absolute).split(sep6).join("/"),
         absolute,
         hash: await hashFile(absolute),
         size: info.size
@@ -19984,7 +20557,7 @@ async function pooled(items, limit, worker) {
   await Promise.all(runners);
 }
 async function publish(name, dir, opts, target) {
-  const root = resolve16(dir);
+  const root = resolve17(dir);
   const info = await stat(root).catch(() => null);
   if (!info?.isDirectory()) throw new Error(`${root} is not a directory`);
   logInfo(`Hashing ${root}\u2026`);
@@ -20136,23 +20709,23 @@ var init_site = __esm({
 });
 
 // libs/mesh-cli/src/commands/stack.ts
-import { execFileSync as execFileSync29 } from "child_process";
-import * as path42 from "path";
-import * as fs35 from "fs";
+import { execFileSync as execFileSync30 } from "child_process";
+import * as path43 from "path";
+import * as fs36 from "fs";
 import { parse as parseYaml5 } from "yaml";
 function readTopLevelYamlKey(appRoot, stack, key) {
-  const configFile = path42.join(appRoot, `Pulumi.${stack}.yaml`);
-  if (!fs35.existsSync(configFile)) return null;
-  const content = fs35.readFileSync(configFile, "utf-8");
+  const configFile = path43.join(appRoot, `Pulumi.${stack}.yaml`);
+  if (!fs36.existsSync(configFile)) return null;
+  const content = fs36.readFileSync(configFile, "utf-8");
   const pattern = new RegExp(`^${key}:\\s*(.+)$`, "m");
   const match = content.match(pattern);
   if (!match) return null;
   return match[1].trim().replace(/^["']|["']$/g, "");
 }
 function readConfigBlockKey(appRoot, stack, key) {
-  const configFile = path42.join(appRoot, `Pulumi.${stack}.yaml`);
-  if (!fs35.existsSync(configFile)) return null;
-  const content = fs35.readFileSync(configFile, "utf-8");
+  const configFile = path43.join(appRoot, `Pulumi.${stack}.yaml`);
+  if (!fs36.existsSync(configFile)) return null;
+  const content = fs36.readFileSync(configFile, "utf-8");
   const pattern = new RegExp(`^\\s{2}${key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}:\\s*(.+)$`, "m");
   const match = content.match(pattern);
   if (!match) return null;
@@ -20212,11 +20785,11 @@ ${records}
   }
 }
 function readBaseConfigFromYaml(appRoot, stack) {
-  const file = path42.join(appRoot, `Pulumi.${stack}.yaml`);
-  if (!fs35.existsSync(file)) return {};
+  const file = path43.join(appRoot, `Pulumi.${stack}.yaml`);
+  if (!fs36.existsSync(file)) return {};
   let doc;
   try {
-    doc = parseYaml5(fs35.readFileSync(file, "utf-8"));
+    doc = parseYaml5(fs36.readFileSync(file, "utf-8"));
   } catch {
     return {};
   }
@@ -20229,7 +20802,7 @@ function readBaseConfigFromYaml(appRoot, stack) {
 }
 function getGitHubUsername() {
   try {
-    const result = execFileSync29("gh", ["api", "user", "--jq", ".login"], {
+    const result = execFileSync30("gh", ["api", "user", "--jq", ".login"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -20238,7 +20811,7 @@ function getGitHubUsername() {
   } catch {
   }
   try {
-    const result = execFileSync29("git", ["config", "user.email"], {
+    const result = execFileSync30("git", ["config", "user.email"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -20293,7 +20866,7 @@ Specify which to base on: mesh stack init --from <stack>`
       }
     }
     const baseConfigPath = `${appRoot}/Pulumi.${baseStack}.yaml`;
-    if (!fs35.existsSync(baseConfigPath)) {
+    if (!fs36.existsSync(baseConfigPath)) {
       logError(`Stack config not found: Pulumi.${baseStack}.yaml`);
       process.exit(1);
     }
@@ -20315,8 +20888,8 @@ Specify which to base on: mesh stack init --from <stack>`
         );
       }
     }
-    const newConfigPath = path42.join(appRoot, `Pulumi.${newStack}.yaml`);
-    const configExists = fs35.existsSync(newConfigPath);
+    const newConfigPath = path43.join(appRoot, `Pulumi.${newStack}.yaml`);
+    const configExists = fs36.existsSync(newConfigPath);
     const secretsProvider = readTopLevelYamlKey(appRoot, baseStack, "secretsprovider");
     const credEnv = await resolvePulumiEnv({ appRoot, stack: baseStack });
     const pulumiEnv = { ...process.env, ...credEnv };
@@ -20324,7 +20897,7 @@ Specify which to base on: mesh stack init --from <stack>`
     if (!opts.adopt) {
       let existing = [];
       try {
-        const raw = execFileSync29("pulumi", ["stack", "ls", "--json"], {
+        const raw = execFileSync30("pulumi", ["stack", "ls", "--json"], {
           cwd: appRoot,
           encoding: "utf-8",
           env: pulumiEnv,
@@ -20348,7 +20921,7 @@ Specify which to base on: mesh stack init --from <stack>`
       logInfo(`Using KMS secrets provider: ${secretsProvider}`);
     }
     try {
-      execFileSync29("pulumi", initArgs, {
+      execFileSync30("pulumi", initArgs, {
         cwd: appRoot,
         env: pulumiEnv,
         stdio: "inherit"
@@ -20365,7 +20938,7 @@ Specify which to base on: mesh stack init --from <stack>`
       }
     }
     try {
-      execFileSync29("pulumi", ["stack", "select", newStack], {
+      execFileSync30("pulumi", ["stack", "select", newStack], {
         cwd: appRoot,
         env: pulumiEnv,
         stdio: ["pipe", "pipe", "pipe"]
@@ -20375,7 +20948,7 @@ Specify which to base on: mesh stack init --from <stack>`
     if (!configExists) {
       let baseConfig = {};
       try {
-        const raw = execFileSync29(
+        const raw = execFileSync30(
           "pulumi",
           ["config", "--json", "--stack", baseStack],
           { cwd: appRoot, env: pulumiEnv, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
@@ -20393,19 +20966,19 @@ Specify which to base on: mesh stack init --from <stack>`
         if (key === "mesh:deploy") continue;
         try {
           if (entry.objectValue !== void 0) {
-            execFileSync29(
+            execFileSync30(
               "pulumi",
               ["config", "set", key, JSON.stringify(entry.objectValue)],
               { cwd: appRoot, env: pulumiEnv, stdio: ["pipe", "pipe", "pipe"] }
             );
           } else if (entry.value === "true" || entry.value === "false") {
-            execFileSync29(
+            execFileSync30(
               "pulumi",
               ["config", "set", "--type", "bool", key, entry.value],
               { cwd: appRoot, env: pulumiEnv, stdio: ["pipe", "pipe", "pipe"] }
             );
           } else {
-            execFileSync29(
+            execFileSync30(
               "pulumi",
               ["config", "set", key, entry.value],
               { cwd: appRoot, env: pulumiEnv, stdio: ["pipe", "pipe", "pipe"] }
@@ -20418,7 +20991,7 @@ Specify which to base on: mesh stack init --from <stack>`
         const baseEnv = readConfigBlockKey(appRoot, baseStack, "mesh:coreEnv") ?? (baseTenant && baseStack.startsWith(`${baseTenant}-`) ? baseStack.slice(baseTenant.length + 1) : baseStack);
         const setCfg = (args) => {
           try {
-            execFileSync29("pulumi", ["config", "set", ...args], {
+            execFileSync30("pulumi", ["config", "set", ...args], {
               cwd: appRoot,
               env: pulumiEnv,
               stdio: ["pipe", "pipe", "pipe"]
@@ -20467,7 +21040,7 @@ Specify which to base on: mesh stack init --from <stack>`
           `Configured Pulumi.${newStack}.yaml (personal platform env on core '${baseEnv}'${opts.parentZone ? `, DNS zone ${newStack.startsWith(`${baseTenant}-`) ? newStack.slice(baseTenant.length + 1) : newStack}.${opts.parentZone}` : ""})`
         );
       } else {
-        execFileSync29("pulumi", ["config", "set", "--type", "bool", "mesh:deploy", "false"], {
+        execFileSync30("pulumi", ["config", "set", "--type", "bool", "mesh:deploy", "false"], {
           cwd: appRoot,
           env: pulumiEnv,
           stdio: ["pipe", "pipe", "pipe"]
@@ -20497,7 +21070,7 @@ Specify which to base on: mesh stack init --from <stack>`
     const args = ["stack", "rm", name];
     if (opts.yes) args.push("--yes");
     try {
-      execFileSync29("pulumi", args, { cwd: appRoot, env: pulumiEnv, stdio: "inherit" });
+      execFileSync30("pulumi", args, { cwd: appRoot, env: pulumiEnv, stdio: "inherit" });
       logSuccess(`Removed stack ${name}`);
     } catch (err) {
       process.exit(err.status ?? 1);
@@ -20709,12 +21282,12 @@ var init_recover_conversation = __esm({
 });
 
 // libs/mesh-cli/src/utils/temporal-codec.ts
-import { execFileSync as execFileSync30 } from "child_process";
+import { execFileSync as execFileSync31 } from "child_process";
 import { webcrypto as crypto4 } from "node:crypto";
 function resolveTemporalEncodingKeyFromK8s(namespace) {
   const secretName = `${namespace}-temporal-encoding-key`;
   try {
-    const b64 = execFileSync30(
+    const b64 = execFileSync31(
       "kubectl",
       [
         "get",
@@ -20965,7 +21538,7 @@ var init_capture_history = __esm({
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { writeFileSync as writeFileSync24, mkdirSync as mkdirSync19 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { dirname as dirname28, join as join39, resolve as resolve17 } from "node:path";
+import { dirname as dirname28, join as join40, resolve as resolve18 } from "node:path";
 async function resolveConnection(options) {
   if (options.address && options.namespace) {
     return { address: options.address, namespace: options.namespace };
@@ -21393,7 +21966,7 @@ async function captureHistory(workflowId, runId, options) {
     }
     const { serializeHistoryToFixture: serializeHistoryToFixture2 } = await Promise.resolve().then(() => (init_capture_history(), capture_history_exports));
     const { fixture, eventCount, decryptedPayloads } = await serializeHistoryToFixture2(events, decrypter);
-    const outPath = options.out ?? join39(homedir6(), ".mesh", "replay-histories", `${sanitizeFileId(workflowId)}.json`);
+    const outPath = options.out ?? join40(homedir6(), ".mesh", "replay-histories", `${sanitizeFileId(workflowId)}.json`);
     mkdirSync19(dirname28(outPath), { recursive: true });
     if (options.out) warnIfNotGitIgnored(options.out);
     writeFileSync24(outPath, JSON.stringify(fixture, null, 2) + "\n");
@@ -21411,7 +21984,7 @@ function sanitizeFileId(id) {
   return id.replace(/[^A-Za-z0-9._-]/g, "_");
 }
 function warnIfNotGitIgnored(outPath) {
-  const abs = resolve17(outPath);
+  const abs = resolve18(outPath);
   try {
     const res = spawnSync4("git", ["-C", dirname28(abs), "check-ignore", "-q", abs], {
       stdio: "ignore"
@@ -21585,8 +22158,8 @@ var init_temporal = __esm({
 
 // libs/mesh-cli/src/commands/tenant.ts
 import chalk7 from "chalk";
-import * as fs36 from "fs";
-import * as path43 from "path";
+import * as fs37 from "fs";
+import * as path44 from "path";
 import { parseDocument, YAMLMap, isMap } from "yaml";
 function validateTenantName(name) {
   return /^[a-z][a-z0-9-]*$/.test(name) && !name.endsWith("-");
@@ -21654,16 +22227,16 @@ function resolveStackConfig(explicitStack) {
       { remediation: { command: "mesh tenant add <name> --stack <stack>" } }
     );
   }
-  const file = path43.join(appRoot, `Pulumi.${stack}.yaml`);
-  if (!fs36.existsSync(file)) {
+  const file = path44.join(appRoot, `Pulumi.${stack}.yaml`);
+  if (!fs37.existsSync(file)) {
     throw new MeshCliError(`Stack config not found: ${file}`, {
       remediation: { command: "mesh tenant add <name> --stack <stack>" }
     });
   }
-  return { appRoot, stack, file, content: fs36.readFileSync(file, "utf-8") };
+  return { appRoot, stack, file, content: fs37.readFileSync(file, "utf-8") };
 }
 function readProjectName(appRoot) {
-  const projectDoc = parseDocument(fs36.readFileSync(path43.join(appRoot, "Pulumi.yaml"), "utf-8"));
+  const projectDoc = parseDocument(fs37.readFileSync(path44.join(appRoot, "Pulumi.yaml"), "utf-8"));
   return String(projectDoc.get("name") ?? "");
 }
 function looksLikePlatformLayer(projectName) {
@@ -21706,12 +22279,12 @@ function registerTenantCommands(program2) {
       if (!result.ok) {
         if (result.reason === "exists") {
           throw new MeshCliError(
-            `${result.detail} (${path43.basename(resolved.file)}). Edit the existing entry instead of re-adding it.`
+            `${result.detail} (${path44.basename(resolved.file)}). Edit the existing entry instead of re-adding it.`
           );
         }
         throw new MeshCliError(`${resolved.file}: ${result.detail}`);
       }
-      atomicWriteFileSync(resolved.file, result.yaml, fs36.statSync(resolved.file).mode & 511);
+      atomicWriteFileSync(resolved.file, result.yaml, fs37.statSync(resolved.file).mode & 511);
       if (opts.json) {
         emitJsonPayload({
           ok: true,
@@ -21724,7 +22297,7 @@ function registerTenantCommands(program2) {
         return;
       }
       logInfo(
-        `Tenant '${name}' registered in ${path43.basename(resolved.file)} (mesh:tenants, subdomain '${subdomain}')${result.createdTenantsBlock ? " \u2014 created the mesh:tenants block" : ""}`
+        `Tenant '${name}' registered in ${path44.basename(resolved.file)} (mesh:tenants, subdomain '${subdomain}')${result.createdTenantsBlock ? " \u2014 created the mesh:tenants block" : ""}`
       );
       console.log("");
       console.log("Next steps:");
@@ -21750,7 +22323,7 @@ function registerTenantCommands(program2) {
           `Project '${projectName}' does not look like a platform layer \u2014 tenants are declared on the tenant platform repo's PLATFORM stack (e.g. mesh-sandbox/platform).`
         );
       }
-      logInfo(`No tenants declared in ${path43.basename(resolved.file)}.`);
+      logInfo(`No tenants declared in ${path44.basename(resolved.file)}.`);
       return;
     }
     logInfo(`Tenants on stack '${resolved.stack}':`);
@@ -21772,9 +22345,9 @@ var init_tenant = __esm({
 
 // libs/mesh-cli/src/commands/tunnel/index.ts
 import { spawn as spawn9 } from "child_process";
-import * as fs37 from "fs";
+import * as fs38 from "fs";
 import * as os12 from "os";
-import * as path44 from "path";
+import * as path45 from "path";
 import {
   SecretsManagerClient as SecretsManagerClient9,
   GetSecretValueCommand as GetSecretValueCommand9
@@ -21783,7 +22356,7 @@ function resolveTenantEnv(options) {
   if (options.tenant && options.env) {
     return { tenant: options.tenant, env: options.env };
   }
-  const ctx = detectContext(options.env);
+  const ctx = detectContext(void 0, { tenant: options.tenant });
   return {
     tenant: options.tenant ?? ctx.tenant,
     env: options.env ?? ctx.platformEnv,
@@ -21794,9 +22367,9 @@ function readPulumiAwsRegion(stage) {
   const preferred = stage ? `Pulumi.${stage}.yaml` : void 0;
   const rank = (f) => f === preferred ? 0 : f === "Pulumi.yaml" ? 2 : 1;
   try {
-    const files = fs37.readdirSync(".").filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml")).sort((a, b) => rank(a) - rank(b));
+    const files = fs38.readdirSync(".").filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml")).sort((a, b) => rank(a) - rank(b));
     for (const f of files) {
-      const m = fs37.readFileSync(f, "utf-8").match(/^\s*aws:region:\s*["']?([^"'\n]+)["']?/m);
+      const m = fs38.readFileSync(f, "utf-8").match(/^\s*aws:region:\s*["']?([^"'\n]+)["']?/m);
       if (m?.[1]) return m[1].trim();
     }
   } catch {
@@ -21805,14 +22378,14 @@ function readPulumiAwsRegion(stage) {
 }
 function awsProfileSections(name) {
   return [
-    [path44.join(os12.homedir(), ".aws", "config"), `[profile ${name}]`],
-    [path44.join(os12.homedir(), ".aws", "credentials"), `[${name}]`]
+    [path45.join(os12.homedir(), ".aws", "config"), `[profile ${name}]`],
+    [path45.join(os12.homedir(), ".aws", "credentials"), `[${name}]`]
   ];
 }
 function awsProfileExists(name) {
   for (const [file, header] of awsProfileSections(name)) {
     try {
-      const lines = fs37.readFileSync(file, "utf-8").split("\n");
+      const lines = fs38.readFileSync(file, "utf-8").split("\n");
       if (lines.some((l) => l.trim() === header)) return true;
     } catch {
     }
@@ -21838,7 +22411,7 @@ function awsProfileRegion(profile) {
   if (!profile) return void 0;
   for (const [file, header] of awsProfileSections(profile)) {
     try {
-      const region = parseProfileRegion(fs37.readFileSync(file, "utf-8"), header);
+      const region = parseProfileRegion(fs38.readFileSync(file, "utf-8"), header);
       if (region) return region;
     } catch {
     }
@@ -21847,14 +22420,14 @@ function awsProfileRegion(profile) {
 }
 function awsDefaultProfileSections() {
   return [
-    [path44.join(os12.homedir(), ".aws", "config"), "[default]"],
-    [path44.join(os12.homedir(), ".aws", "credentials"), "[default]"]
+    [path45.join(os12.homedir(), ".aws", "config"), "[default]"],
+    [path45.join(os12.homedir(), ".aws", "credentials"), "[default]"]
   ];
 }
 function awsDefaultProfileRegion() {
   for (const [file, header] of awsDefaultProfileSections()) {
     try {
-      const region = parseProfileRegion(fs37.readFileSync(file, "utf-8"), header);
+      const region = parseProfileRegion(fs38.readFileSync(file, "utf-8"), header);
       if (region) return region;
     } catch {
     }
@@ -21995,9 +22568,9 @@ async function tunnelServices(serviceNames, options) {
   process.on("SIGTERM", cleanup);
   await Promise.race(
     processes.map(
-      (proc) => new Promise((resolve19) => {
-        proc.on("exit", () => resolve19());
-        proc.on("error", () => resolve19());
+      (proc) => new Promise((resolve20) => {
+        proc.on("exit", () => resolve20());
+        proc.on("error", () => resolve20());
       })
     )
   );
@@ -22094,9 +22667,9 @@ async function tunnelExternal(name, options) {
   };
   process.on("SIGINT", cleanup);
   process.on("SIGTERM", cleanup);
-  await new Promise((resolve19) => {
-    proc.on("exit", () => resolve19());
-    proc.on("error", () => resolve19());
+  await new Promise((resolve20) => {
+    proc.on("exit", () => resolve20());
+    proc.on("error", () => resolve20());
   });
   cleanup();
 }
@@ -22141,7 +22714,7 @@ function registerTunnelCommands(program2) {
     "Tenant for the external service's credentials (default: --tenant)"
   ).option(
     "--app-stage <stage>",
-    "Stage for the external service's credentials (default: --env)"
+    "Stage for the external service's credentials (default: the detected app stage, else --env)"
   ).option(
     "-k, --key <key>",
     "Instance key for a multi-instance external (credentials.keyedBy)"
@@ -22241,8 +22814,8 @@ async function resolveToken(opts) {
     "no token: pass --token, set VCS_TOKEN, or pass --context <platform-context> (after mesh login)"
   );
 }
-async function vcsApi(baseUrl, token, path46, method = "GET", body) {
-  const res = await fetch(`${baseUrl}${path46}`, {
+async function vcsApi(baseUrl, token, path47, method = "GET", body) {
+  const res = await fetch(`${baseUrl}${path47}`, {
     method,
     headers: {
       authorization: `Bearer ${token}`,
@@ -22253,7 +22826,7 @@ async function vcsApi(baseUrl, token, path46, method = "GET", body) {
   const data = await res.json().catch(() => ({}));
   if (!res.ok) {
     throw new Error(
-      `${method} ${path46} failed (${res.status}): ${String(data.error ?? "unknown error")}`
+      `${method} ${path47} failed (${res.status}): ${String(data.error ?? "unknown error")}`
     );
   }
   return data;
@@ -22299,8 +22872,8 @@ var init_clone = __esm({
 
 // libs/mesh-cli/src/commands/vcs/get.ts
 import { writeFile as writeFile2, mkdir as mkdir2 } from "node:fs/promises";
-import { join as join42, dirname as dirname29 } from "node:path";
-async function getCommand(repo, path46, opts) {
+import { join as join43, dirname as dirname29 } from "node:path";
+async function getCommand(repo, path47, opts) {
   let vcsBaseUrl;
   let token;
   if (opts.target) {
@@ -22315,18 +22888,18 @@ async function getCommand(repo, path46, opts) {
   if (!token) throw new Error("no token: pass --target (after mesh login), or --token / --context");
   const reader = createVcsFolderReader({ vcsBaseUrl, token });
   try {
-    const { ref, files } = await reader.readPath(repo, path46);
+    const { ref, files } = await reader.readPath(repo, path47);
     if (files.length === 0) {
-      logInfo(`no files at ${repo}:${path46}`);
+      logInfo(`no files at ${repo}:${path47}`);
       return;
     }
     if (opts.output) {
       for (const f of files) {
-        const abs = join42(opts.output, f.path);
+        const abs = join43(opts.output, f.path);
         await mkdir2(dirname29(abs), { recursive: true });
         await writeFile2(abs, f.contents);
       }
-      logInfo(`wrote ${files.length} file(s) from ${repo}:${path46} (${ref}) \u2192 ${opts.output}`);
+      logInfo(`wrote ${files.length} file(s) from ${repo}:${path47} (${ref}) \u2192 ${opts.output}`);
     } else {
       for (const f of files) {
         if (files.length > 1) process.stdout.write(`
@@ -22351,10 +22924,10 @@ var init_get = __esm({
 });
 
 // libs/mesh-cli/src/commands/vcs/drafts.ts
-async function call(opts, repo, path46, method = "GET", body) {
+async function call(opts, repo, path47, method = "GET", body) {
   const target = await resolveTarget2({ ...opts, repo });
   const token = await resolveToken(opts);
-  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path46}`, method, body);
+  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path47}`, method, body);
 }
 async function draftsListCommand(repo, opts) {
   const data = await call(opts, repo, `/drafts${opts.all ? "?all=true" : ""}`);
@@ -22409,7 +22982,7 @@ var init_drafts = __esm({
 
 // libs/mesh-cli/src/commands/vcs/propose.ts
 import { readFile as readFile3 } from "node:fs/promises";
-import { join as join43 } from "node:path";
+import { join as join44 } from "node:path";
 function parseStatus(out) {
   const tokens = out.split("\0");
   const changes = [];
@@ -22442,13 +23015,13 @@ function parseStatus(out) {
   }
   return changes;
 }
-async function writeOp(cwd, path46) {
-  const buf = await readFile3(join43(cwd, path46));
+async function writeOp(cwd, path47) {
+  const buf = await readFile3(join44(cwd, path47));
   const asUtf8 = buf.toString("utf8");
   if (Buffer.from(asUtf8, "utf8").equals(buf)) {
-    return { op: "write", path: path46, content: asUtf8 };
+    return { op: "write", path: path47, content: asUtf8 };
   }
-  return { op: "write", path: path46, content: buf.toString("base64"), encoding: "base64" };
+  return { op: "write", path: path47, content: buf.toString("base64"), encoding: "base64" };
 }
 async function proposeCommand(opts) {
   const cwd = process.cwd();
@@ -22492,8 +23065,8 @@ async function proposeCommand(opts) {
     operations,
     ...opts.mergeParent ? { mergeParent: opts.mergeParent } : {}
   };
-  const path46 = opts.revise ? `/v1/repos/${target.repo}/proposals/${opts.revise}/revisions` : `/v1/repos/${target.repo}/proposals`;
-  const data = await vcsApi(target.baseUrl, token, path46, "POST", body);
+  const path47 = opts.revise ? `/v1/repos/${target.repo}/proposals/${opts.revise}/revisions` : `/v1/repos/${target.repo}/proposals`;
+  const data = await vcsApi(target.baseUrl, token, path47, "POST", body);
   console.log(
     `proposal ${data.proposalId} @ ${data.sha.slice(0, 8)} \u2014 review: mesh vcs show ${target.repo} ${data.proposalId} --url ${target.baseUrl}`
   );
@@ -22508,28 +23081,28 @@ var init_propose = __esm({
 // libs/mesh-cli/src/commands/vcs/rm.ts
 import { mkdtemp as mkdtemp2, rm as rmrf } from "node:fs/promises";
 import { tmpdir as tmpdir10 } from "node:os";
-import { join as join44 } from "node:path";
+import { join as join45 } from "node:path";
 function normalize2(p) {
   return p.trim().replace(/^\.\//, "").replace(/\/+$/, "");
 }
 function expandPathsToDeletions(repoFiles, requested) {
   const out = /* @__PURE__ */ new Set();
   for (const raw of requested) {
-    const path46 = normalize2(raw);
-    if (path46.startsWith("/") || path46.split("/").includes("..")) {
+    const path47 = normalize2(raw);
+    if (path47.startsWith("/") || path47.split("/").includes("..")) {
       throw new Error(
         `"${raw}" is not a repo-relative path \u2014 vcs paths never start with "/" or traverse with "..".`
       );
     }
-    const exact = repoFiles.filter((f) => f === path46);
+    const exact = repoFiles.filter((f) => f === path47);
     if (exact.length > 0) {
       for (const f of exact) out.add(f);
       continue;
     }
-    const under = repoFiles.filter((f) => f.startsWith(`${path46}/`));
+    const under = repoFiles.filter((f) => f.startsWith(`${path47}/`));
     if (under.length === 0) {
       throw new Error(
-        `"${raw}" matched no files in the repo \u2014 nothing was proposed. Check the path with: mesh vcs get <repo> ${path46}`
+        `"${raw}" matched no files in the repo \u2014 nothing was proposed. Check the path with: mesh vcs get <repo> ${path47}`
       );
     }
     for (const f of under) out.add(f);
@@ -22540,7 +23113,7 @@ async function rmCommand(repo, paths, opts) {
   const baseUrl = (opts.url ?? process.env.VCS_URL)?.replace(/\/$/, "");
   if (!baseUrl) throw new Error("rm requires --url or VCS_URL");
   const token = await resolveToken(opts);
-  const dir = await mkdtemp2(join44(tmpdir10(), "mesh-vcs-rm-"));
+  const dir = await mkdtemp2(join45(tmpdir10(), "mesh-vcs-rm-"));
   try {
     const git = (args, cwd) => gitWithAuth(args, token, cwd);
     await git([
@@ -22565,7 +23138,7 @@ async function rmCommand(repo, paths, opts) {
     const body = {
       baseCommit: head.trim(),
       message: opts.message ?? `Delete ${doomed.length} file(s)`,
-      operations: doomed.map((path46) => ({ op: "delete", path: path46 }))
+      operations: doomed.map((path47) => ({ op: "delete", path: path47 }))
     };
     const data = await vcsApi(
       baseUrl,
@@ -22591,10 +23164,10 @@ var init_rm = __esm({
 });
 
 // libs/mesh-cli/src/commands/vcs/review.ts
-async function call2(opts, repo, path46, method = "GET", body) {
+async function call2(opts, repo, path47, method = "GET", body) {
   const target = await resolveTarget2({ ...opts, repo });
   const token = await resolveToken(opts);
-  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path46}`, method, body);
+  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path47}`, method, body);
 }
 async function proposalsCommand(repo, opts) {
   console.log(JSON.stringify(await call2(opts, repo, "/proposals"), null, 2));
@@ -22741,8 +23314,8 @@ function computeHappyPath(nodes, edges) {
     ];
     const visited = /* @__PURE__ */ new Set([startNode.id]);
     while (queue.length > 0) {
-      const { id, path: path46 } = queue.shift();
-      if (targetIds.has(id)) return path46;
+      const { id, path: path47 } = queue.shift();
+      if (targetIds.has(id)) return path47;
       const neighbors = adjacency.get(id) ?? [];
       const hasMainEdge = neighbors.some((e) => e.isMainPath);
       const candidates = hasMainEdge ? neighbors.filter((e) => e.isMainPath) : neighbors;
@@ -22762,7 +23335,7 @@ function computeHappyPath(nodes, edges) {
         if (!allowExceptional && (neighbor.isExceptional || neighbor.isTimeout || failureEndIds.has(neighbor.to)))
           continue;
         visited.add(neighbor.to);
-        queue.push({ id: neighbor.to, path: [...path46, neighbor.to] });
+        queue.push({ id: neighbor.to, path: [...path47, neighbor.to] });
       }
     }
     return null;
@@ -23047,11 +23620,11 @@ function wrapIntoGroup(workflow, nodeIds, groupId, label, groupType) {
         }
       }
       if (found) {
-        const path46 = [];
-        for (let c = found; c !== void 0; c = prev.get(c)) path46.unshift(c);
-        for (let i = 0; i < path46.length - 1; i++) mainEdgeKeys.add(edgeKey(path46[i], path46[i + 1]));
+        const path47 = [];
+        for (let c = found; c !== void 0; c = prev.get(c)) path47.unshift(c);
+        for (let i = 0; i < path47.length - 1; i++) mainEdgeKeys.add(edgeKey(path47[i], path47[i + 1]));
         mainEdgeKeys.add(edgeKey(found, successExit.id));
-        mainBody = path46;
+        mainBody = path47;
         mainTail = [successExit.id];
       }
     }
@@ -23587,11 +24160,11 @@ function buildProcessManifest(artifact, outcomeNodeIds) {
     ...pointOfNoReturnStage ? { pointOfNoReturnStageId: pointOfNoReturnStage.id } : {}
   };
 }
-function formatPath(path46) {
-  return path46.length > 0 ? z4.core.toDotPath(path46) : "(root)";
+function formatPath(path47) {
+  return path47.length > 0 ? z4.core.toDotPath(path47) : "(root)";
 }
 function issueToDiagnostic(issue) {
-  const path46 = formatPath(issue.path);
+  const path47 = formatPath(issue.path);
   let code = "SCHEMA_INVALID";
   if (issue.code === "custom") {
     const paramCode = issue.params?.code;
@@ -23602,8 +24175,8 @@ function issueToDiagnostic(issue) {
   return {
     severity: "error",
     code,
-    message: `${path46}: ${issue.message}`,
-    path: path46
+    message: `${path47}: ${issue.message}`,
+    path: path47
   };
 }
 function upgradeV1(artifact) {
@@ -23770,24 +24343,24 @@ var init_process_artifact = __esm({
         });
       }
       const declaredSelectors = new Set(Object.keys(process2.selectors ?? {}));
-      const checkActor = (actorId, path46) => {
+      const checkActor = (actorId, path47) => {
         if (actorId === void 0) return;
         if (!Object.prototype.hasOwnProperty.call(process2.actors, actorId)) {
           ctx.addIssue({
             code: "custom",
-            path: path46,
-            message: `Actor "${actorId}" is referenced at ${z4.core.toDotPath(path46)} but not declared in process.actors. Declare the actor (label, and optionally category/selector) or fix the reference.`,
+            path: path47,
+            message: `Actor "${actorId}" is referenced at ${z4.core.toDotPath(path47)} but not declared in process.actors. Declare the actor (label, and optionally category/selector) or fix the reference.`,
             params: { code: "UNDECLARED_ACTOR" }
           });
         }
       };
-      const checkSelector = (selector, path46) => {
+      const checkSelector = (selector, path47) => {
         if (selector === void 0) return;
         if (!declaredSelectors.has(selector)) {
           ctx.addIssue({
             code: "custom",
-            path: path46,
-            message: `Selector "${selector}" is referenced at ${z4.core.toDotPath(path46)} but not declared in process.selectors. Declare the selector or fix the reference.`,
+            path: path47,
+            message: `Selector "${selector}" is referenced at ${z4.core.toDotPath(path47)} but not declared in process.selectors. Declare the selector or fix the reference.`,
             params: { code: "UNDECLARED_SELECTOR" }
           });
         }
@@ -23801,20 +24374,20 @@ var init_process_artifact = __esm({
         outcome: "DUPLICATE_OUTCOME_ID"
       };
       const idFirstSeenAt = /* @__PURE__ */ new Map();
-      const checkId = (id, kind, path46) => {
+      const checkId = (id, kind, path47) => {
         const first = idFirstSeenAt.get(id);
         if (first) {
           const kindLabel = kind === first.kind ? kind : "process";
           ctx.addIssue({
             code: "custom",
-            path: path46,
-            message: `Duplicate ${kindLabel} id "${id}": ${kind} at ${z4.core.toDotPath(path46)} collides with ${first.kind} at ${z4.core.toDotPath(first.path)}.`,
+            path: path47,
+            message: `Duplicate ${kindLabel} id "${id}": ${kind} at ${z4.core.toDotPath(path47)} collides with ${first.kind} at ${z4.core.toDotPath(first.path)}.`,
             params: {
               code: kind === first.kind ? SAME_KIND_CODE[kind] : "DUPLICATE_PROCESS_ID"
             }
           });
         } else {
-          idFirstSeenAt.set(id, { kind, path: path46 });
+          idFirstSeenAt.set(id, { kind, path: path47 });
         }
       };
       process2.stages.forEach((stage, stageIndex) => {
@@ -23861,13 +24434,13 @@ function lintProcess(artifact, inventory, predicateNames, options = {}) {
   const internalCommands = process2.internalCommands ?? [];
   const internalSet = new Set(internalCommands);
   const boundCommandPaths = /* @__PURE__ */ new Map();
-  const checkPredicate = (predicate, path46) => {
+  const checkPredicate = (predicate, path47) => {
     if (!predicateSet.has(predicate)) {
       diagnostics.push({
         severity: "error",
         code: "UNKNOWN_PREDICATE",
-        message: `Predicate "${predicate}" referenced at ${path46} is not in the predicate registry.`,
-        path: path46
+        message: `Predicate "${predicate}" referenced at ${path47} is not in the predicate registry.`,
+        path: path47
       });
     }
   };
@@ -23927,19 +24500,19 @@ function lintProcess(artifact, inventory, predicateNames, options = {}) {
   process2.outcomes.forEach((outcome, outcomeIndex) => {
     const whenPath = `process.outcomes[${outcomeIndex}].when`;
     outcomeTriggers(outcome).forEach((trigger, triggerIndex) => {
-      const path46 = Array.isArray(outcome.when) ? `${whenPath}[${triggerIndex}]` : whenPath;
+      const path47 = Array.isArray(outcome.when) ? `${whenPath}[${triggerIndex}]` : whenPath;
       if (trigger.kind === "predicate") {
-        checkPredicate(trigger.name, `${path46}.predicate`);
+        checkPredicate(trigger.name, `${path47}.predicate`);
       } else if (trigger.kind === "command") {
         if (!boundCommandPaths.has(trigger.name)) {
-          boundCommandPaths.set(trigger.name, `${path46}.command`);
+          boundCommandPaths.set(trigger.name, `${path47}.command`);
         }
         if (!commandNames.has(trigger.name)) {
           diagnostics.push({
             severity: "error",
             code: "BOUND_COMMAND_NOT_IN_INVENTORY",
-            message: `Command "${trigger.name}" triggering outcome "${outcome.id}" (${path46}.command) does not exist in the inventory.`,
-            path: `${path46}.command`
+            message: `Command "${trigger.name}" triggering outcome "${outcome.id}" (${path47}.command) does not exist in the inventory.`,
+            path: `${path47}.command`
           });
         }
       }
@@ -24051,10 +24624,10 @@ var init_src4 = __esm({
 });
 
 // libs/mesh-cli/src/commands/workflow.ts
-import * as fs38 from "fs";
-import * as path45 from "path";
+import * as fs39 from "fs";
+import * as path46 from "path";
 import { createRequire as createRequire2 } from "module";
-import { execFileSync as execFileSync31 } from "child_process";
+import { execFileSync as execFileSync32 } from "child_process";
 function resolveExtractorPath() {
   try {
     const require2 = createRequire2(import.meta.url);
@@ -24068,7 +24641,7 @@ function runExtraction(targetPath, extractorPath, explicitProcessPath) {
   let explicitProcessArtifact;
   if (explicitProcessPath) {
     try {
-      explicitProcessArtifact = JSON.parse(fs38.readFileSync(explicitProcessPath, "utf-8"));
+      explicitProcessArtifact = JSON.parse(fs39.readFileSync(explicitProcessPath, "utf-8"));
     } catch (err) {
       logError(
         `Could not read/parse --process ${explicitProcessPath}: ${err instanceof Error ? err.message : String(err)}`
@@ -24109,7 +24682,7 @@ for (const file of files) {
 process.stdout.write(JSON.stringify(results));
 `;
   try {
-    const result = execFileSync31("npx", ["tsx", "--eval", script], {
+    const result = execFileSync32("npx", ["tsx", "--eval", script], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "inherit"],
       maxBuffer: 10 * 1024 * 1024
@@ -24151,7 +24724,7 @@ for (const file of files) {
 process.stdout.write(JSON.stringify(results));
 `;
   try {
-    const result = execFileSync31("npx", ["tsx", "--eval", script], {
+    const result = execFileSync32("npx", ["tsx", "--eval", script], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "inherit"],
       maxBuffer: 10 * 1024 * 1024
@@ -24168,7 +24741,7 @@ function runLintExtraction(targetPath, extractorPath, explicitProcessPath) {
   let explicitProcessArtifact;
   if (explicitProcessPath) {
     try {
-      explicitProcessArtifact = JSON.parse(fs38.readFileSync(explicitProcessPath, "utf-8"));
+      explicitProcessArtifact = JSON.parse(fs39.readFileSync(explicitProcessPath, "utf-8"));
     } catch (err) {
       logError(
         `Could not read/parse --process ${explicitProcessPath}: ${err instanceof Error ? err.message : String(err)}`
@@ -24206,7 +24779,7 @@ for (const file of files) {
 process.stdout.write(JSON.stringify(results));
 `;
   try {
-    const result = execFileSync31("npx", ["tsx", "--eval", script], {
+    const result = execFileSync32("npx", ["tsx", "--eval", script], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "inherit"],
       maxBuffer: 10 * 1024 * 1024
@@ -24276,16 +24849,16 @@ function registerWorkflowCommands(program2) {
   ).action(
     async (targetPath, opts) => {
       try {
-        const resolvedPath = path45.resolve(targetPath);
-        if (!fs38.existsSync(resolvedPath)) {
+        const resolvedPath = path46.resolve(targetPath);
+        if (!fs39.existsSync(resolvedPath)) {
           logError(`Path does not exist: ${resolvedPath}`);
           process.exitCode = 1;
           return;
         }
         let resolvedProcessPath;
         if (opts.process) {
-          resolvedProcessPath = path45.resolve(opts.process);
-          if (!fs38.existsSync(resolvedProcessPath)) {
+          resolvedProcessPath = path46.resolve(opts.process);
+          if (!fs39.existsSync(resolvedProcessPath)) {
             logError(`--process path does not exist: ${resolvedProcessPath}`);
             process.exitCode = 1;
             return;
@@ -24334,8 +24907,8 @@ function registerWorkflowCommands(program2) {
     "Extract the as-built command/query/activity inventory from Temporal workflow source\n\nThe inventory ({ workflowType, commands, queries, activities }) is the process-\nconformance lint's code-side input \u2014 it is never hand-edited. Supports single\nfiles or directories."
   ).action(async (targetPath) => {
     try {
-      const resolvedPath = path45.resolve(targetPath);
-      if (!fs38.existsSync(resolvedPath)) {
+      const resolvedPath = path46.resolve(targetPath);
+      if (!fs39.existsSync(resolvedPath)) {
         logError(`Path does not exist: ${resolvedPath}`);
         process.exitCode = 1;
         return;
@@ -24381,16 +24954,16 @@ function registerWorkflowCommands(program2) {
     "Comma-separated named-selector registry (enables UNKNOWN_SELECTOR checks)"
   ).action(async (targetPath, opts) => {
     try {
-      const resolvedPath = path45.resolve(targetPath);
-      if (!fs38.existsSync(resolvedPath)) {
+      const resolvedPath = path46.resolve(targetPath);
+      if (!fs39.existsSync(resolvedPath)) {
         logError(`Path does not exist: ${resolvedPath}`);
         process.exitCode = 1;
         return;
       }
       let resolvedProcessPath;
       if (opts.process) {
-        resolvedProcessPath = path45.resolve(opts.process);
-        if (!fs38.existsSync(resolvedProcessPath)) {
+        resolvedProcessPath = path46.resolve(opts.process);
+        if (!fs39.existsSync(resolvedProcessPath)) {
           logError(`--process path does not exist: ${resolvedProcessPath}`);
           process.exitCode = 1;
           return;