@mesh-tech/mesh-cli 0.25.0 → 0.26.0

package/dist/src/commands/init/wizard.d.ts

@@ -1,10 +1,17 @@
 import { probeRegistryToken } from "../../utils/auth-preflight.js";
 import { type RegistryLoginOptions } from "../registry.js";
 import { type MeshJson } from "../../utils/mesh-json.js";
+import { scaffoldPlatformRepo, type PlatformSetupFlags, type StateBucketDeps } from "./platform-setup.js";
 export interface WizardOptions {
     tenant?: string;
     local?: boolean;
     platform?: string;
+    newPlatform?: string | boolean;
+    region?: string;
+    domain?: string;
+    stateBucket?: string;
+    createStateBucket?: boolean;
+    dir?: string;
     device?: boolean;
     profile?: string;
     skipRepo?: boolean;
@@ -18,9 +25,15 @@ export interface StepResult {
     detail: string;
     fix?: string;
     blocking?: boolean;
+    next?: string[];
 }
 export type WizardMode = "local" | {
     platform: string;
+} | {
+    newPlatform: PlatformSetupFlags;
+};
+export declare function isNewPlatform(mode: WizardMode): mode is {
+    newPlatform: PlatformSetupFlags;
 };
 export interface WizardCtx {
     cwd: string;
@@ -40,6 +53,8 @@ export interface WizardSeams {
     probe?: typeof probeRegistryToken;
     runRegistryLogin?: (opts: RegistryLoginOptions) => Promise<void>;
     gitInit?: (dir: string) => void;
+    scaffoldPlatform?: typeof scaffoldPlatformRepo;
+    stateBucket?: StateBucketDeps;
 }
 export interface WizardStep {
     name: "registry" | "platform" | "repo" | "skills";
@@ -72,7 +87,9 @@ export interface Prompts {
 }
 export declare const NO_SESSION_NO_TTY_MESSAGE: string;
 export declare const TENANT_REQUIRED_MESSAGE = "--tenant is required (no TTY for interactive mode)";
+export declare const REGISTRY_WHY: string;
 export declare const INTERRUPTED_EXIT_CODE = 130;
+export declare const PLATFORM_SETUP_LABEL = "Platform setup";
 export declare function wizardExitCode(steps: ReadonlyArray<Pick<StepResult, "status">>): number;
 export declare function wizardNextCommands(mode: WizardMode, steps?: ReadonlyArray<StepResult>): string[];
 export declare function stepBlocks(result: StepResult): boolean;
@@ -85,7 +102,9 @@ export declare function resolveAnswers(opts: WizardOptions, recorded: MeshJson |
     mode?: WizardMode;
     open: Array<"tenant" | "mode">;
 };
+export declare function platformSetupFlags(opts: WizardOptions): PlatformSetupFlags;
 export declare const registryStep: WizardStep;
+export declare const newPlatformStep: WizardStep;
 export type RepoKind = "platform-monorepo" | "empty-apps-repo" | "apps-repo" | "other-repo" | "empty-dir" | "no-repo";
 export declare function classifyRepo(cwd: string): {
     kind: RepoKind;
@@ -93,6 +112,7 @@ export declare function classifyRepo(cwd: string): {
 };
 export declare const INIT_REPO_FIX = "git init && mesh init";
 export declare const repoStep: WizardStep;
+export declare const skillsStep: WizardStep;
 export declare const WIZARD_STEPS: readonly WizardStep[];
 export declare function runWizardSteps(ctx: WizardCtx, steps: readonly WizardStep[]): Promise<StepResult[]>;
 export declare function runInitWizard(opts: WizardOptions, deps?: {

package/dist/src/commands/init/wizard.js

@@ -12,10 +12,17 @@ import { discoverConfigForContext, isRemoteEnvironment, readCredentials, renderN
 import { bootstrapAppsRepo, isInsidePlatformMonorepo, shouldBootstrapAppsRepo } from "../create-app.js";
 import { resolveTargetRoot, syncSkills } from "../skills.js";
 import { detectLocalTenant } from "../local/dev-local.js";
+import { PLATFORM_SETUP_DEFAULTS, ensureStateBucket, renderPlatformNextSteps, resolvePlatformSetup, scaffoldPlatformRepo, } from "./platform-setup.js";
+export function isNewPlatform(mode) {
+    return typeof mode === "object" && "newPlatform" in mode;
+}
 export const NO_SESSION_NO_TTY_MESSAGE = "No registry session and no terminal to sign in with.\n" +
     "  On a headless box: mesh registry login --device   (one-time, prints a code)\n" +
     "  In CI with AWS creds: mesh registry login --ci";
 export const TENANT_REQUIRED_MESSAGE = "--tenant is required (no TTY for interactive mode)";
+export const REGISTRY_WHY = "Package access — a sign-in to the Mesh package REGISTRY, which is what makes `@mesh-tech/*` installable.\n" +
+    "  It is one global identity: no AWS account, no platform, no <tenant>.<env> context.\n" +
+    "  (`mesh login <tenant>.<env>` is the other sign-in — that one is only for deploying to, or operating, a platform.)";
 export const INTERRUPTED_EXIT_CODE = 130;
 const STEP_LABELS = {
     registry: "Registry access",
@@ -23,10 +30,14 @@ const STEP_LABELS = {
     repo: "Repo",
     skills: "Agent skills",
 };
+export const PLATFORM_SETUP_LABEL = "Platform setup";
 export function wizardExitCode(steps) {
     return steps.some((s) => s.status === "fail") ? 1 : 0;
 }
 export function wizardNextCommands(mode, steps = []) {
+    const owned = steps.find((s) => s.next?.length)?.next;
+    if (owned)
+        return owned;
     const repo = steps.find((s) => s.name === STEP_LABELS.repo);
     const first = repo && repo.status !== "pass" && repo.fix ? repo.fix : "mesh create-app";
     return mode === "local" ? [first] : [first, "mesh deploy up   # from the app directory, once it exists"];
@@ -35,7 +46,11 @@ export function stepBlocks(result) {
     return result.status === "fail" && result.blocking !== false;
 }
 export function describeMode(mode) {
-    return mode === "local" ? "local only" : `deployed platform (${mode.platform})`;
+    if (mode === "local")
+        return "local only";
+    if (isNewPlatform(mode))
+        return `a new platform (${mode.newPlatform.env ?? PLATFORM_SETUP_DEFAULTS.env})`;
+    return `deployed platform (${mode.platform})`;
 }
 export function renderWizardSummary(outcome, opts = {}) {
     const paint = opts.color === false ? { green: (s) => s, red: (s) => s, yellow: (s) => s, dim: (s) => s, cyan: (s) => s } : chalk;
@@ -65,10 +80,13 @@ export function resolveAnswers(opts, recorded, interactive) {
         open.push("tenant");
     }
     let mode;
-    if (opts.local && opts.platform) {
-        throw new MeshCliError("--local and --platform are mutually exclusive.");
+    const chosen = [opts.local && "--local", opts.platform && "--platform", opts.newPlatform && "--new-platform"].filter(Boolean);
+    if (chosen.length > 1) {
+        throw new MeshCliError(`${chosen.join(", ")} are mutually exclusive — a tenant runs in exactly one of those three places.`);
     }
-    if (opts.platform)
+    if (opts.newPlatform)
+        mode = { newPlatform: platformSetupFlags(opts) };
+    else if (opts.platform)
         mode = { platform: opts.platform };
     else if (opts.local)
         mode = "local";
@@ -80,6 +98,18 @@ export function resolveAnswers(opts, recorded, interactive) {
     }
     return { tenant, mode, open };
 }
+export function platformSetupFlags(opts) {
+    return {
+        env: typeof opts.newPlatform === "string" ? opts.newPlatform : undefined,
+        region: opts.region,
+        domain: opts.domain,
+        profile: opts.profile,
+        stateBucket: opts.stateBucket,
+        createStateBucket: opts.createStateBucket,
+        dir: opts.dir,
+        yes: opts.yes,
+    };
+}
 export const registryStep = {
     name: "registry",
     async run(ctx) {
@@ -102,6 +132,7 @@ export const registryStep = {
             return { name, status: "fail", detail: NO_SESSION_NO_TTY_MESSAGE.split("\n")[0], fix: "mesh registry login --device", blocking: true };
         }
         try {
+            logInfo(REGISTRY_WHY);
             const login = ctx.seams?.runRegistryLogin ??
                 (async (opts) => {
                     const { runRegistryLogin } = await import("../registry.js");
@@ -132,10 +163,51 @@ export const registryStep = {
         return { name, status: "pass", detail: `Registry access OK (${session ? `signed in as ${session.email}` : "token written"})` };
     },
 };
+export const newPlatformStep = {
+    name: "platform",
+    async run(ctx) {
+        const name = PLATFORM_SETUP_LABEL;
+        if (!isNewPlatform(ctx.mode))
+            return { name, status: "skip", detail: "no new platform requested" };
+        let setup;
+        try {
+            setup = await resolvePlatformSetup(ctx.tenant, { ...ctx.mode.newPlatform, yes: ctx.yes }, {
+                prompts: ctx.prompts,
+                interactive: ctx.interactive,
+                cwd: ctx.cwd,
+            });
+        }
+        catch (err) {
+            return {
+                name,
+                status: "fail",
+                detail: err.message.split("\n")[0],
+                fix: `mesh init --tenant ${ctx.tenant} --new-platform --domain <your-domain>`,
+            };
+        }
+        try {
+            await (ctx.seams?.scaffoldPlatform ?? scaffoldPlatformRepo)(setup);
+        }
+        catch (err) {
+            return { name, status: "fail", detail: `platform repo not scaffolded: ${err.message.split("\n")[0]}`, fix: `mesh init platform ${ctx.tenant} --dir <empty-dir>` };
+        }
+        const bucket = await ensureStateBucket(setup, ctx.seams?.stateBucket);
+        const next = renderPlatformNextSteps(setup, { bucket, relativeDir: path.relative(ctx.cwd, setup.dir) || "." });
+        return {
+            name,
+            status: setup.createStateBucket && !bucket.present ? "warn" : "pass",
+            detail: `platform repo scaffolded at ${setup.dir} (${setup.tenant}.${setup.env}, ${setup.region}, zone ${setup.env}.${setup.domain})` +
+                (setup.createStateBucket ? ` — state bucket: ${bucket.detail}` : ` — state bucket ${setup.stateBucket} not created (see Next)`),
+            next,
+        };
+    },
+};
 const platformStep = {
     name: "platform",
     async run(ctx) {
         const name = STEP_LABELS.platform;
+        if (isNewPlatform(ctx.mode))
+            return newPlatformStep.run(ctx);
         if (!ctx.context)
             return { name, status: "skip", detail: "local only — no platform to sign in to" };
         const context = ctx.context;
@@ -192,6 +264,9 @@ export const repoStep = {
         const name = STEP_LABELS.repo;
         if (ctx.skipRepo)
             return { name, status: "skip", detail: "--skip-repo" };
+        if (isNewPlatform(ctx.mode)) {
+            return { name, status: "skip", detail: "setting up a platform — the apps repo comes after the first deploy (see Next)" };
+        }
         const { kind, root } = classifyRepo(ctx.cwd);
         switch (kind) {
             case "platform-monorepo":
@@ -259,12 +334,15 @@ export const repoStep = {
         }
     },
 };
-const skillsStep = {
+export const skillsStep = {
     name: "skills",
     async run(ctx) {
         const name = STEP_LABELS.skills;
         if (ctx.skipRepo)
             return { name, status: "skip", detail: "--skip-repo" };
+        if (isNewPlatform(ctx.mode)) {
+            return { name, status: "skip", detail: "synced into the new platform repo by the scaffold" };
+        }
         const { kind, root } = classifyRepo(ctx.cwd);
         if (kind !== "apps-repo" && kind !== "empty-apps-repo") {
             return { name, status: "skip", detail: "no apps repo to install skills into" };
@@ -341,11 +419,15 @@ export async function runInitWizard(opts, deps = {}) {
                 choices: [
                     { name: "Local only (mesh start / mesh dev — no deployed platform yet)", value: "local" },
                     { name: `A deployed Mesh platform (I have a ${tenant}.<env> context)`, value: "deployed" },
+                    { name: "Nothing yet — set up a new Mesh platform in my AWS account", value: "new" },
                 ],
                 default: recorded && recorded.platform !== "local" ? "deployed" : "local",
             });
             if (choice === "local")
                 mode = "local";
+            else if (choice === "new") {
+                mode = { newPlatform: platformSetupFlags({ ...opts, newPlatform: true }) };
+            }
             else {
                 const env = await prompts.input({
                     message: "Environment",
@@ -359,7 +441,7 @@ export async function runInitWizard(opts, deps = {}) {
             cwd,
             tenant,
             mode,
-            context: mode === "local" ? null : `${tenant}.${mode.platform}`,
+            context: mode === "local" || isNewPlatform(mode) ? null : `${tenant}.${mode.platform}`,
             device: opts.device,
             profile: opts.profile,
             interactive,
@@ -372,7 +454,7 @@ export async function runInitWizard(opts, deps = {}) {
         logInfo(`Setting up tenant '${tenant}' (${describeMode(mode)})…`);
         const steps = await runWizardSteps(ctx, deps.steps ?? WIZARD_STEPS);
         const { kind, root } = classifyRepo(cwd);
-        if (!opts.skipRepo && (kind === "apps-repo" || kind === "empty-apps-repo")) {
+        if (!opts.skipRepo && !isNewPlatform(mode) && (kind === "apps-repo" || kind === "empty-apps-repo")) {
             const written = writeMeshJson(root, { tenant, platform: mode === "local" ? "local" : mode.platform });
             logInfo(`Recorded tenant + mode in ${written}`);
         }

package/dist/src/commands/init.js

@@ -8,6 +8,14 @@ import { readCredentials } from "./login.js";
 import { resolveTargetRoot, syncSkills } from "./skills.js";
 import { detectLocalTenant } from "./local/dev-local.js";
 import { LOGIN_CONTEXT } from "./local/seed-zitadel.js";
+import { PLATFORM_SETUP_DEFAULTS } from "./init/platform-setup.js";
+async function setupPrompts() {
+    const [{ default: input }, { default: confirm }] = await Promise.all([
+        import("@inquirer/input"),
+        import("@inquirer/confirm"),
+    ]);
+    return { input: (args) => input(args), confirm: (args) => confirm(args) };
+}
 const LOCAL_HUB_API = "http://localhost:4568";
 function isLocalContext(context) {
     return context === LOGIN_CONTEXT;
@@ -211,12 +219,19 @@ export function registerInitCommands(program) {
     const init = program
         .command("init")
         .enablePositionalOptions()
-        .description("Set up this machine and repo for a tenant — a guided wizard with no subcommand (tenant, local or deployed, package-registry sign-in, repo, skills); `init platform` scaffolds a platform repo, `init app-tenant` is the apps-repo doctor")
+        .description("Set up this machine and repo for a tenant — a guided wizard with no subcommand. It starts from nothing: it asks where the tenant runs, and 'nowhere yet' is one of the answers (it scaffolds you a platform). Then package-registry sign-in, repo, skills. `init platform` is the same scaffold on its own; `init app-tenant` is the apps-repo doctor")
         .option("--tenant <name>", "app tenant this repo belongs to (prompted when omitted on a TTY)")
         .option("--local", "local only — mesh start / mesh dev, no deployed platform (the default)")
-        .option("--platform <env>", "a deployed platform's environment; signs in to <tenant>.<env>")
+        .option("--platform <env>", "a deployed platform's environment; signs in to `<tenant>.<env>`")
+        .option("--new-platform [env]", `nothing deployed yet — scaffold a tenant platform repo for \`<tenant>.<env>\` (default env: ${PLATFORM_SETUP_DEFAULTS.env}) and print its deploy sequence`)
+        .option("--region <region>", `--new-platform: AWS region (default: ${PLATFORM_SETUP_DEFAULTS.region})`)
+        .option("--domain <domain>", "--new-platform: base public domain you control; the core stack creates the zone {env}.{domain}. No default — a placeholder scaffolds a zone that can never validate")
+        .option("--state-bucket <bucket>", "--new-platform: Pulumi state S3 bucket (default: {tenant}-mesh-platform-pulumi-state)")
+        .option("--create-state-bucket", "--new-platform: create the state bucket (versioned) if it does not exist")
+        .option("--no-create-state-bucket", "--new-platform: never create the state bucket; print the aws command instead")
+        .option("--dir <path>", "--new-platform: where to scaffold the platform repo (default: ./{tenant}-mesh-platform)")
         .option("--device", "device-code sign-in for the registry and platform steps (headless / SSH)")
-        .option("--profile <aws-profile>", "deployers only: AWS profile that can read the registry (skips the broker)")
+        .option("--profile <aws-profile>", "AWS profile this machine uses: read the registry without the broker (deployers only), and the profile a --new-platform stack config references")
         .option("--skip-repo", "do not bootstrap, check or record anything in the current repo", false)
         .option("--yes", "accept every default and never prompt", false)
         .option("--json", "one JSON document on stdout ({tenant, mode, steps, next}); human output on stderr", false)
@@ -228,47 +243,38 @@ export function registerInitCommands(program) {
     });
     init
         .command("platform <tenant>")
-        .description("Scaffold a tenant PLATFORM repo (core + platform Pulumi layers on @mesh-tech/infra-components) that deploys with `mesh deploy` unmodified — the proven mesh-sandbox shape, annotated.")
-        .option("--env <env>", "environment the first stack targets", "dev")
-        .option("--region <region>", "AWS region", "us-east-2")
-        .option("--domain <domain>", "base public domain (ingress zone becomes {env}.{domain})", "example.com")
-        .option("--profile <profile>", "AWS profile the stack config references", "default")
-        .option("--state-bucket <bucket>", "Pulumi state S3 bucket (created by an operator)", undefined)
+        .description("Scaffold a tenant PLATFORM repo (core + platform Pulumi layers on @mesh-tech/infra-components) that deploys with `mesh deploy` unmodified — the proven mesh-sandbox shape, annotated. On a terminal it ASKS for the values that differ per install (env, region, domain, state bucket, AWS profile), each pre-filled with its default; every answer is also a flag.")
+        .option("--env <env>", `environment the first stack targets (default: ${PLATFORM_SETUP_DEFAULTS.env})`)
+        .option("--region <region>", `AWS region (default: ${PLATFORM_SETUP_DEFAULTS.region})`)
+        .option("--domain <domain>", "base public domain you control — the core stack creates the Route 53 zone {env}.{domain} and waits on its NS delegation. Required: it has no default, because a placeholder scaffolds a zone that can never validate")
+        .option("--profile <profile>", `AWS profile the stack config references (default: ${PLATFORM_SETUP_DEFAULTS.profile})`)
+        .option("--state-bucket <bucket>", "Pulumi state S3 bucket (default: {tenant}-mesh-platform-pulumi-state)")
+        .option("--create-state-bucket", "create the state bucket (versioned) if it does not exist — prompted on a terminal")
+        .option("--no-create-state-bucket", "never create the state bucket; print the aws command instead")
         .option("--dir <path>", "target directory (default: ./{tenant}-mesh-platform)")
+        .option("--yes", "accept every default and never prompt", false)
         .action(async (tenant, opts) => {
         if (!/^[a-z][a-z0-9-]*$/.test(tenant)) {
             throw new MeshCliError(`Invalid tenant name '${tenant}' (lowercase alphanumeric + dashes).`);
         }
-        const targetDir = path.resolve(opts.dir ?? `${tenant}-mesh-platform`);
-        if (fs.existsSync(targetDir) && fs.readdirSync(targetDir).length > 0) {
-            throw new MeshCliError(`Target directory is not empty: ${targetDir}`, {
-                remediation: { command: `mesh init platform ${tenant} --dir <empty-dir>` },
-            });
-        }
-        const { copyTemplate } = await import("./create-app.js");
-        const { findPackageRoot } = await import("./local/stack.js");
-        const templateDir = path.join(findPackageRoot(), "templates", "platform-repo");
-        const context = {
-            tenant,
-            env: opts.env,
-            region: opts.region,
-            domain: opts.domain,
-            profile: opts.profile,
-            stateBucket: opts.stateBucket ?? `${tenant}-mesh-platform-pulumi-state`,
-        };
-        fs.mkdirSync(targetDir, { recursive: true });
-        copyTemplate(templateDir, targetDir, context);
-        syncSkills(targetDir);
-        logInfo(`Platform repo scaffolded at ${targetDir}`);
+        const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+        const { resolvePlatformSetup, scaffoldPlatformRepo, ensureStateBucket, renderPlatformNextSteps } = await import("./init/platform-setup.js");
+        const setup = await resolvePlatformSetup(tenant, opts, {
+            prompts: interactive && !opts.yes ? await setupPrompts() : undefined,
+            interactive,
+        });
+        await scaffoldPlatformRepo(setup);
+        logInfo(`Platform repo scaffolded at ${setup.dir}`);
+        const bucket = await ensureStateBucket(setup);
+        if (bucket.detail !== "not requested")
+            logInfo(`Pulumi state bucket: ${bucket.detail}`);
         console.log("");
         console.log("Next steps:");
-        console.log(`  cd ${path.relative(process.cwd(), targetDir) || "."}`);
-        console.log(`  mesh login ${tenant}.${opts.env}     # or an operator context with access`);
-        console.log("  pnpm install");
-        console.log("  cd core && mesh deploy up");
-        console.log("  cd ../platform && mesh deploy up");
+        for (const line of renderPlatformNextSteps(setup, { bucket, relativeDir: path.relative(process.cwd(), setup.dir) || "." })) {
+            console.log(line ? `  ${line}` : "");
+        }
         console.log("");
-        logInfo(`Review the annotated stack configs (Pulumi.${tenant}-${opts.env}.yaml) before the first deploy.`);
+        logInfo(`Review the annotated stack configs (Pulumi.${tenant}-${setup.env}.yaml) before the first deploy.`);
     });
     init
         .command("app-tenant")

package/dist/src/commands/login.d.ts

@@ -50,6 +50,10 @@ export declare function registerLoginCommand(program: Command): void;
 export declare const RESERVED_REGISTRY_CONTEXT = "registry";
 export declare const NO_REGISTRY_DEPRECATED = "--no-registry is deprecated and ignored: mesh login no longer touches the registry.";
 export declare const REGISTRY_SEPARATE_HINT = "Package registry access is separate from platform sign-in \u2014 run: mesh registry login";
+export declare function shorthandContext(context: string): {
+    tenant: string;
+    env: string;
+} | null;
 export declare function renderNoConfigHelp(context: string): string;
 export declare function tokenStillValid(expiresAt: string, marginMs?: number, now?: number): boolean;
 declare function getValidToken(context: string, opts?: {

package/dist/src/commands/login.js

@@ -622,7 +622,7 @@ async function showStatus(context, config) {
 export function registerLoginCommand(program) {
     program
         .command("login")
-        .description("Authenticate with Zitadel (OIDC PKCE or Device Code)")
+        .description("PLATFORM access: sign in to a deployed Mesh platform (`<tenant>.<env>`) — what `mesh deploy`, `mesh stack`, the Hub and the VPN use. It never touches your ~/.npmrc, and you do not need it to install packages: that is `mesh registry login`. OIDC PKCE, or device code with --device.")
         .argument("<context>", 'Platform context (e.g., "mesh.dev")')
         .option("--status", "Show current authentication status — the Zitadel session if one is cached, otherwise the AWS identity the credential chain resolves (SSO profile or key pair). Exits non-zero only when neither works.")
         .option("--device", "Force device code flow (no callback server needed)")
@@ -668,7 +668,7 @@ export function registerLoginCommand(program) {
     });
     program
         .command("logout")
-        .description("Clear cached Zitadel credentials")
+        .description("Clear a platform context's cached credentials (the package-registry session under `mesh registry` is untouched)")
         .argument("<context>", 'Platform context (e.g., "mesh.dev")')
         .action((context) => {
         refuseReservedRegistryContext(context, "logout");
@@ -698,8 +698,20 @@ async function hintRegistryIfMissing() {
     catch {
     }
 }
+export function shorthandContext(context) {
+    const parts = context.split(".");
+    if (parts.length !== 2)
+        return null;
+    const [tenant, env] = parts;
+    return tenant && env ? { tenant, env } : null;
+}
 export function renderNoConfigHelp(context) {
     const pinned = firstPartyDomainFor(context);
+    const shorthand = shorthandContext(context);
+    const createOne = shorthand
+        ? `mesh init --tenant ${shorthand.tenant} --new-platform ${shorthand.env}`
+        : "mesh init --tenant <tenant> --new-platform <env>";
+    const scaffoldOne = `mesh init platform ${shorthand?.tenant ?? "<tenant>"} --domain <a domain you control>`;
     return (`No configuration found for "${context}".\n\n` +
         `Tried:\n` +
         `  1. SSM: /mesh-platform/${context.split(".")[0]}/${context.split(".")[1]}/platform/zitadel\n` +
@@ -709,6 +721,8 @@ export function renderNoConfigHelp(context) {
             : `  2. HTTPS: https://cli.${context}/.well-known/mesh.json\n` +
                 `     (only attempted for a full domain, or a known first-party context)\n\n`) +
         `To fix:\n` +
+        `  - No platform deployed yet? Create one: ${createOne}\n` +
+        `    (or the scaffold on its own: ${scaffoldOne})\n` +
         `  - Use the platform's full domain: mesh login <env>.<tenant>.meshtech.io\n` +
         `  - Or, if you have AWS access, ensure SSO is active: aws sso login --profile <profile>\n` +
         `  - Or add config manually to ${CONFIG_FILE}:\n\n` +

package/dist/src/commands/registry.d.ts

@@ -2,7 +2,7 @@ import { Command } from "commander";
 import { MeshCliError } from "../utils/errors.js";
 import type { RegistryTokenState } from "../utils/auth-preflight.js";
 import { type RegistryBrokerFailure, type RegistryGrant } from "../utils/registry-broker.js";
-import { readRegistrySession } from "../utils/registry-identity.js";
+import { readRegistrySession, type RegistryAccountState } from "../utils/registry-identity.js";
 export declare function codeartifactLogin(env?: Record<string, string>): boolean;
 export declare function resolvePublisherRoleArn({ roleArnFlag, ssmArn, }: {
     roleArnFlag?: string;
@@ -12,7 +12,7 @@ export declare function resolveCredentials(context?: string, roleArn?: string):
 export declare function applyGrantToUserNpmrc(grant: RegistryGrant, npmrcPath?: string): {
     path: string;
 };
-export declare function describeBrokerFailure(failure: RegistryBrokerFailure): {
+export declare function describeBrokerFailure(failure: RegistryBrokerFailure, account?: RegistryAccountState): {
     message: string;
     hint?: string;
     fatal: boolean;

package/dist/src/commands/registry.js

@@ -5,7 +5,7 @@ import { logInfo, logSuccess, logWarn } from "../utils/log.js";
 import { MeshCliError } from "../utils/errors.js";
 import { awsConfigHasProfile, findUnscopedCodeArtifactRegistry, homeNpmrcPath, npmrcAuthKeyForEndpoint, probeRegistryToken, readAwsConfig, SSO_SESSION_SNIPPET, stripUnscopedCodeArtifactRegistry, upsertNpmrcLines, } from "../utils/auth-preflight.js";
 import { fetchRegistryGrant, realGrantDeps, PUBLISHED_BROKER_TIMEOUT_MS, } from "../utils/registry-broker.js";
-import { clearRegistrySession, describeSessionExpiry, ensureRegistrySession, identityChanged, logRegistryIdentity, readRegistrySession, refreshRegistrySession, resolveRegistryIdentity, } from "../utils/registry-identity.js";
+import { clearRegistrySession, describeSessionExpiry, ensureRegistrySession, identityChanged, logRegistryIdentity, readRegistrySession, refreshRegistrySession, registryAccountState, resolveRegistryIdentity, } from "../utils/registry-identity.js";
 import { readCredentials } from "./login.js";
 import { registerRegistryPublish } from "./registry-publish.js";
 const CA_DOMAIN = "mesh-platform";
@@ -222,7 +222,11 @@ export function applyGrantToUserNpmrc(grant, npmrcPath = homeNpmrcPath()) {
     }
     return { path: npmrcPath };
 }
-export function describeBrokerFailure(failure) {
+export function describeBrokerFailure(failure, account = {}) {
+    const unverified = account.emailVerified === false
+        ? `\n  Your Mesh account${account.email ? ` (${account.email})` : ""} has never confirmed its email address, and an unconfirmed account cannot hold a registry grant.` +
+            `\n  This is not something a role fixes: ask your Mesh contact to verify the address on your account (a self-registered, passkey-only sign-up lands here), then run: mesh registry logout && mesh registry login`
+        : "";
     switch (failure.kind) {
         case "no-broker":
             return {
@@ -237,7 +241,7 @@ export function describeBrokerFailure(failure) {
             };
         case "unauthenticated":
             return {
-                message: "The registry broker rejected your session (expired or wrong audience).",
+                message: "The registry broker rejected your session (expired or wrong audience)." + unverified,
                 hint: "mesh registry logout && mesh registry login",
                 fatal: false,
             };
@@ -251,7 +255,8 @@ export function describeBrokerFailure(failure) {
                     (failure.requestUrl
                         ? `\n  Request access: ${failure.requestUrl}`
                         : "\n  Ask a Mesh platform admin to grant your account registry access.") +
-                    `\n  ${NOT_AUTHORIZED_RERUN}`,
+                    `\n  ${NOT_AUTHORIZED_RERUN}` +
+                    unverified,
                 fatal: true,
             };
         case "unavailable":
@@ -327,7 +332,7 @@ async function tryBrokerLogin(opts) {
     }
     if (result.ok)
         return { grant: result.grant };
-    const { message, hint, fatal } = describeBrokerFailure(result.failure);
+    const { message, hint, fatal } = describeBrokerFailure(result.failure, registryAccountState(readCredentials(session.context)?.idToken));
     if (fatal) {
         throw new RegistryNotAuthorizedError(message);
     }
@@ -627,7 +632,7 @@ export function describeAwsChainFailure(outcome) {
 export function registerRegistryCommands(program) {
     const registry = program
         .command("registry")
-        .description("Manage npm registry auth for @mesh-tech packages");
+        .description("PACKAGE access: the sign-in that makes @mesh-tech/* installable. One global identity — no AWS account, no platform, no `<tenant>.<env>` context. (`mesh login <tenant>.<env>` is the other one; that is for deploying to or operating a platform.)");
     registry
         .command("login")
         .description("Sign in to the Mesh package registry (browser, or device code with --device) and configure ~/.npmrc + the project .npmrc. Needs no platform context and no AWS account.")

package/dist/src/commands/secrets/context.d.ts

@@ -0,0 +1,5 @@
+import { type MeshContext } from "../../utils/context.js";
+import { type StackSelector } from "../../utils/stack-flag.js";
+export declare function resolveSecretsContext(opts: StackSelector & {
+    tenant?: string;
+}, stackOpt?: string | undefined): MeshContext;

package/dist/src/commands/secrets/context.js

@@ -0,0 +1,5 @@
+import { detectContext } from "../../utils/context.js";
+import { resolveStackOption } from "../../utils/stack-flag.js";
+export function resolveSecretsContext(opts, stackOpt = resolveStackOption(opts)) {
+    return detectContext(stackOpt, { tenant: opts.tenant, stack: stackOpt });
+}

package/dist/src/commands/secrets/index.js

@@ -21,6 +21,7 @@ export function registerSecretsCommands(program) {
         .option("--key <key>", "Instance key for multi-instance services (e.g., FI ID)")
         .option("--all", "Prompt for all fields including optional ones")
         .option("--json <json>", "Non-interactive: provide values as JSON")
+        .option("-t, --tenant <tenant>", "Tenant to address (override detection)")
         .option("--stack <stack>", "Pulumi stack name (override detection)")
         .addOption(new Option("--stage <stack>", "Deprecated alias for --stack").hideHelp())
         .option("--region <region>", "AWS region (default: us-east-2)")
@@ -31,6 +32,7 @@ export function registerSecretsCommands(program) {
         .command("reindex [service]")
         .description("Rebuild a multi-instance external service's instance index (the {prefix}/.index secret listInstances() reads) from the per-key secrets actually in Secrets Manager — the repair for an instance secret created or deleted out of band")
         .option("--dry-run", "Show what would change without writing")
+        .option("-t, --tenant <tenant>", "Tenant to address (override detection)")
         .option("--stack <stack>", "Pulumi stack name (override detection)")
         .addOption(new Option("--stage <stack>", "Deprecated alias for --stack").hideHelp())
         .option("--region <region>", "AWS region (default: us-east-2)")
@@ -42,6 +44,7 @@ export function registerSecretsCommands(program) {
         .description("Backfill .config mirror secrets for all external services")
         .option("--force", "Overwrite existing .config mirrors")
         .option("--dry-run", "Show what would be written without writing")
+        .option("-t, --tenant <tenant>", "Tenant to address (override detection)")
         .option("--stack <stack>", "Pulumi stack name (override detection)")
         .addOption(new Option("--stage <stack>", "Deprecated alias for --stack").hideHelp())
         .option("--region <region>", "AWS region (default: us-east-2)")

package/dist/src/commands/secrets/migrate-config.d.ts

@@ -1,6 +1,7 @@
 export declare function migrateConfigCommand(opts: {
     force?: boolean;
     dryRun?: boolean;
+    tenant?: string;
     stack?: string;
     stage?: string;
     region?: string;

package/dist/src/commands/secrets/migrate-config.js

@@ -1,8 +1,7 @@
 import { SSMClient, GetParametersByPathCommand, } from "@aws-sdk/client-ssm";
 import { SecretsManagerClient, GetSecretValueCommand, PutSecretValueCommand, CreateSecretCommand, ListSecretsCommand, } from "@aws-sdk/client-secrets-manager";
-import { detectContext } from "../../utils/context.js";
 import { logInfo, logSuccess, logError } from "../../utils/log.js";
-import { resolveStackOption } from "../../utils/stack-flag.js";
+import { resolveSecretsContext } from "./context.js";
 function normalizeEntry(raw) {
     if (raw.type === "group" && raw.fields) {
         return {
@@ -198,7 +197,7 @@ async function migrateService(smClient, meta, schema, opts) {
     return { migrated, skipped, errors };
 }
 export async function migrateConfigCommand(opts) {
-    const context = detectContext(resolveStackOption(opts));
+    const context = resolveSecretsContext(opts);
     const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
     const ssmClient = new SSMClient({ region });
     const smClient = new SecretsManagerClient({ region });

package/dist/src/commands/secrets/reindex.d.ts

@@ -2,6 +2,7 @@ import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
 export declare function scanInstanceKeys(client: SecretsManagerClient, secretPrefix: string): Promise<string[]>;
 export declare function indexAlreadyMatches(missing: string[], stale: string[], indexExists: boolean, malformed: boolean): boolean;
 export declare function reindexCommand(servicePath: string | undefined, opts: {
+    tenant?: string;
     stack?: string;
     stage?: string;
     region?: string;

package/dist/src/commands/secrets/reindex.js

@@ -1,9 +1,9 @@
 import { SSMClient } from "@aws-sdk/client-ssm";
 import { SecretsManagerClient, ListSecretsCommand, GetSecretValueCommand, PutSecretValueCommand, CreateSecretCommand, } from "@aws-sdk/client-secrets-manager";
 import { buildInstanceIndexValue, instanceIndexSecretId, instanceKeyFromSecretName, parseInstanceIndex, } from "@mesh-tech/secrets";
-import { detectContext } from "../../utils/context.js";
 import { logInfo, logSuccess, logError } from "../../utils/log.js";
 import { resolveStackOption } from "../../utils/stack-flag.js";
+import { resolveSecretsContext } from "./context.js";
 import { discoverExternalServices, ensureAwsCredentialsForStack, isResourceNotFound, } from "./set.js";
 export async function scanInstanceKeys(client, secretPrefix) {
     const keys = [];
@@ -27,7 +27,7 @@ export function indexAlreadyMatches(missing, stale, indexExists, malformed) {
 }
 export async function reindexCommand(servicePath, opts) {
     const stackOpt = resolveStackOption(opts);
-    const context = detectContext(stackOpt);
+    const context = resolveSecretsContext(opts, stackOpt);
     const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
     await ensureAwsCredentialsForStack(stackOpt ?? context.stage);
     const ssmClient = new SSMClient({ region });

package/dist/src/commands/secrets/set.d.ts

@@ -33,6 +33,7 @@ export declare function setCommand(servicePath: string | undefined, opts: {
     key?: string;
     all?: boolean;
     json?: string;
+    tenant?: string;
     stack?: string;
     stage?: string;
     region?: string;