@mesh-tech/mesh-cli 0.25.0 → 0.27.0

package/dist/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "b025309d4",
-  "builtAt": "2026-09-15T21:09:36.948Z"
+  "commit": "5b8435e57",
+  "builtAt": "2026-09-17T20:26:45.360Z"
 }

package/dist/src/commands/db/axes.d.ts

@@ -0,0 +1,19 @@
+export interface DbAxisOptions {
+    tenant?: string;
+    env?: string;
+    appTenant?: string;
+    appStage?: string;
+}
+export interface PlatformAxis {
+    tenant: string;
+    env: string;
+}
+export interface AppAxis {
+    tenant: string;
+    stage: string;
+}
+export declare function platformAxis(options: DbAxisOptions, usage: string, detect?: () => {
+    tenant: string;
+    platformEnv: string;
+}): () => PlatformAxis;
+export declare function appAxis(options: DbAxisOptions, platform: () => PlatformAxis): AppAxis;

package/dist/src/commands/db/axes.js

@@ -0,0 +1,35 @@
+import { detectContext } from "../../utils/context.js";
+import { MeshCliError } from "../../utils/errors.js";
+import { logInfo } from "../../utils/log.js";
+export function platformAxis(options, usage, detect = detectContext) {
+    if ((options.tenant && !options.env) || (!options.tenant && options.env)) {
+        throw new MeshCliError("Both --tenant and --env are required", {
+            remediation: { command: usage },
+        });
+    }
+    let resolved;
+    return () => {
+        if (resolved)
+            return resolved;
+        if (options.tenant && options.env) {
+            resolved = { tenant: options.tenant, env: options.env };
+            logInfo(`Platform: Tenant=${resolved.tenant}, Env=${resolved.env}`);
+        }
+        else {
+            const ctx = detect();
+            resolved = { tenant: ctx.tenant, env: ctx.platformEnv };
+            logInfo(`Auto-detected: Tenant=${resolved.tenant}, Env=${resolved.env}`);
+        }
+        return resolved;
+    };
+}
+export function appAxis(options, platform) {
+    if (options.appTenant && options.appStage) {
+        return { tenant: options.appTenant, stage: options.appStage };
+    }
+    const resolved = platform();
+    return {
+        tenant: options.appTenant ?? resolved.tenant,
+        stage: options.appStage ?? resolved.env,
+    };
+}

package/dist/src/commands/db/connect.d.ts

@@ -1,6 +1,4 @@
-interface ConnectOptions {
-    tenant?: string;
-    env?: string;
-}
+import { type DbAxisOptions } from "./axes.js";
+type ConnectOptions = Pick<DbAxisOptions, "tenant" | "env">;
 export declare function connectCommand(options: ConnectOptions): Promise<void>;
 export {};

package/dist/src/commands/db/connect.js

@@ -1,24 +1,9 @@
 import { spawn } from "child_process";
-import { detectContext, getPlatformBastionInfo, logInfo, logError, } from "../../utils/index.js";
+import { getPlatformBastionInfo, logInfo, logError } from "../../utils/index.js";
+import { platformAxis } from "./axes.js";
+const USAGE = "mesh db connect --tenant mesh --env dev-temporal";
 export async function connectCommand(options) {
-    let tenant;
-    let platformEnv;
-    if (options.tenant && options.env) {
-        tenant = options.tenant;
-        platformEnv = options.env;
-        logInfo(`Explicit mode: Tenant=${tenant}, Env=${platformEnv}`);
-    }
-    else if (options.tenant || options.env) {
-        logError("Both --tenant and --env are required");
-        logInfo("Usage: mesh db connect --tenant mesh --env dev-temporal");
-        process.exit(1);
-    }
-    else {
-        const ctx = detectContext();
-        tenant = ctx.tenant;
-        platformEnv = ctx.platformEnv;
-        logInfo(`Auto-detected: Tenant=${tenant}, Env=${platformEnv}`);
-    }
+    const { tenant, env: platformEnv } = platformAxis(options, USAGE)();
     const bastion = await getPlatformBastionInfo(tenant, platformEnv);
     const rdsService = bastion.services.rds;
     if (!rdsService) {

package/dist/src/commands/db/credentials.d.ts

@@ -1,9 +1,6 @@
-interface CredentialsOptions {
-    tenant?: string;
-    env?: string;
+import { type DbAxisOptions } from "./axes.js";
+interface CredentialsOptions extends DbAxisOptions {
     app?: string;
-    appTenant?: string;
-    appStage?: string;
 }
 export declare function credentialsCommand(options: CredentialsOptions): Promise<void>;
 export {};

package/dist/src/commands/db/credentials.js

@@ -1,30 +1,14 @@
-import { detectContext, getDatabaseUrl, logInfo, logError, } from "../../utils/index.js";
+import { getDatabaseUrl, logInfo } from "../../utils/index.js";
+import { appAxis, platformAxis } from "./axes.js";
+const USAGE = "mesh db credentials --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev";
 export async function credentialsCommand(options) {
-    let platformTenant;
-    let platformEnv;
-    if (options.tenant && options.env) {
-        platformTenant = options.tenant;
-        platformEnv = options.env;
-        logInfo(`Platform: Tenant=${platformTenant}, Env=${platformEnv}`);
-    }
-    else if (options.tenant || options.env) {
-        logError("Both --tenant and --env are required");
-        logInfo("Usage: mesh db credentials --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev");
-        process.exit(1);
-    }
-    else {
-        const ctx = detectContext();
-        platformTenant = ctx.tenant;
-        platformEnv = ctx.platformEnv;
-        logInfo(`Auto-detected: Tenant=${platformTenant}, Env=${platformEnv}`);
-    }
-    const appTenant = options.appTenant ?? platformTenant;
-    const appStage = options.appStage ?? platformEnv;
+    const platform = platformAxis(options, USAGE);
+    const app = appAxis(options, platform);
     const appName = options.app;
     if (appName) {
-        logInfo(`App credentials: tenant=${appTenant}, stage=${appStage}, app=${appName}`);
+        logInfo(`App credentials: tenant=${app.tenant}, stage=${app.stage}, app=${appName}`);
     }
-    const databaseUrl = await getDatabaseUrl(appTenant, appStage, { app: appName });
+    const databaseUrl = await getDatabaseUrl(app.tenant, app.stage, { app: appName });
     const parsed = new URL(databaseUrl);
     console.log("");
     console.log("Database Credentials:");

package/dist/src/commands/db/env.d.ts

@@ -1,9 +1,6 @@
-interface EnvOptions {
-    tenant?: string;
-    env?: string;
+import { type DbAxisOptions } from "./axes.js";
+interface EnvOptions extends DbAxisOptions {
     app?: string;
-    appTenant?: string;
-    appStage?: string;
 }
 export declare function envCommand(options: EnvOptions): Promise<void>;
 export {};

package/dist/src/commands/db/env.js

@@ -1,30 +1,14 @@
-import { detectContext, getDatabaseUrl, rewriteDatabaseUrl, logInfo, logError, } from "../../utils/index.js";
+import { getDatabaseUrl, rewriteDatabaseUrl } from "../../utils/index.js";
+import { appAxis, platformAxis } from "./axes.js";
+const USAGE = "eval $(mesh db env --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev)";
 export async function envCommand(options) {
-    let platformTenant;
-    let platformEnv;
-    if (options.tenant && options.env) {
-        platformTenant = options.tenant;
-        platformEnv = options.env;
-        console.error(`ℹ Platform: Tenant=${platformTenant}, Env=${platformEnv}`);
-    }
-    else if (options.tenant || options.env) {
-        logError("Both --tenant and --env are required");
-        logInfo("Usage: eval $(mesh db env --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev)");
-        process.exit(1);
-    }
-    else {
-        const ctx = detectContext();
-        platformTenant = ctx.tenant;
-        platformEnv = ctx.platformEnv;
-        console.error(`ℹ Auto-detected: Tenant=${platformTenant}, Env=${platformEnv}`);
-    }
-    const appTenant = options.appTenant ?? platformTenant;
-    const appStage = options.appStage ?? platformEnv;
+    const platform = platformAxis(options, USAGE);
+    const app = appAxis(options, platform);
     const appName = options.app;
     if (appName) {
-        console.error(`ℹ App credentials: tenant=${appTenant}, stage=${appStage}, app=${appName}`);
+        console.error(`ℹ App credentials: tenant=${app.tenant}, stage=${app.stage}, app=${appName}`);
     }
-    const rawUrl = await getDatabaseUrl(appTenant, appStage, { app: appName });
+    const rawUrl = await getDatabaseUrl(app.tenant, app.stage, { app: appName });
     const tunnelUrl = rewriteDatabaseUrl(rawUrl, { endpoint: "localhost:5432" });
     const parsed = new URL(tunnelUrl);
     console.log(`export DATABASE_URL="${tunnelUrl}"`);

package/dist/src/commands/db/exec.js

@@ -3,7 +3,8 @@ import * as net from "net";
 import * as fs from "fs";
 import * as path from "path";
 import { SecretsManagerClient, GetSecretValueCommand, } from "@aws-sdk/client-secrets-manager";
-import { detectContext, getPlatformBastionInfo, getDatabaseUrl, rewriteDatabaseUrl, logInfo, logSuccess, logError, logWarn, } from "../../utils/index.js";
+import { getPlatformBastionInfo, getDatabaseUrl, rewriteDatabaseUrl, logInfo, logSuccess, logError, logWarn, } from "../../utils/index.js";
+import { appAxis, platformAxis } from "./axes.js";
 const DEFAULT_LOCAL_PORT = 5432;
 const MAX_RETRIES = 12;
 const RETRY_DELAY_MS = 5000;
@@ -170,30 +171,11 @@ export async function execCommand(commandArgs, options) {
         }
     }
     else {
-        let platformTenant;
-        let platformEnv;
-        if (options.tenant && options.env) {
-            platformTenant = options.tenant;
-            platformEnv = options.env;
-            logInfo(`Explicit mode: Platform Tenant=${platformTenant}, Platform Env=${platformEnv}`);
-        }
-        else if (options.tenant || options.env) {
-            logError("Both --tenant and --env are required when using explicit mode");
-            logInfo("Usage: mesh db exec --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev -- <command>");
-            logInfo("Or omit both to use auto-detection");
-            process.exit(1);
-        }
-        else {
-            const ctx = detectContext();
-            platformTenant = ctx.tenant;
-            platformEnv = ctx.platformEnv;
-            logInfo(`Discovery mode: Platform=${platformEnv}, Tenant=${platformTenant}`);
-        }
-        const appTenant = options.appTenant ?? platformTenant;
-        const appStage = options.appStage ?? platformEnv;
+        const platform = platformAxis(options, "mesh db exec --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev -- <command>");
+        const app = appAxis(options, platform);
         const appName = options.app;
         if (appName) {
-            logInfo(`App credentials: tenant=${appTenant}, stage=${appStage}, app=${appName}`);
+            logInfo(`App credentials: tenant=${app.tenant}, stage=${app.stage}, app=${appName}`);
         }
         const tunnelExists = await checkPort(localPort);
         const sstOutputs = findSstOutputs();
@@ -215,6 +197,7 @@ export async function execCommand(commandArgs, options) {
         }
         if (!databaseUrl) {
             if (!tunnelExists) {
+                const { tenant: platformTenant, env: platformEnv } = platform();
                 const bastion = await getPlatformBastionInfo(platformTenant, platformEnv);
                 const rdsService = bastion.services.rds;
                 if (!rdsService) {
@@ -225,7 +208,7 @@ export async function execCommand(commandArgs, options) {
             else {
                 logSuccess(`Using existing tunnel on port ${localPort}`);
             }
-            const rawUrl = await getDatabaseUrl(appTenant, appStage, { app: appName });
+            const rawUrl = await getDatabaseUrl(app.tenant, app.stage, { app: appName });
             databaseUrl = rewriteDatabaseUrl(rawUrl, {
                 endpoint: `localhost:${localPort}`,
                 sslMode: options.ssl,

package/dist/src/commands/db/psql.d.ts

@@ -1,9 +1,6 @@
-interface PsqlOptions {
-    tenant?: string;
-    env?: string;
+import { type DbAxisOptions } from "./axes.js";
+interface PsqlOptions extends DbAxisOptions {
     app?: string;
-    appTenant?: string;
-    appStage?: string;
 }
 export declare function psqlCommand(options: PsqlOptions): Promise<void>;
 export {};

package/dist/src/commands/db/psql.js

@@ -1,6 +1,8 @@
 import { spawn } from "child_process";
 import * as net from "net";
-import { detectContext, getPlatformBastionInfo, getDatabaseUrl, logInfo, logSuccess, logError, } from "../../utils/index.js";
+import { getPlatformBastionInfo, getDatabaseUrl, logInfo, logSuccess, logError, } from "../../utils/index.js";
+import { appAxis, platformAxis } from "./axes.js";
+const USAGE = "mesh db psql --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev";
 async function startTunnelBackground(instanceId, rdsHost, rdsPort, localPort) {
     logInfo("Starting tunnel in background...");
     const tunnel = spawn("aws", [
@@ -46,29 +48,12 @@ function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
 export async function psqlCommand(options) {
-    let platformTenant;
-    let platformEnv;
-    if (options.tenant && options.env) {
-        platformTenant = options.tenant;
-        platformEnv = options.env;
-        logInfo(`Platform: Tenant=${platformTenant}, Env=${platformEnv}`);
-    }
-    else if (options.tenant || options.env) {
-        logError("Both --tenant and --env are required");
-        logInfo("Usage: mesh db psql --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev");
-        process.exit(1);
-    }
-    else {
-        const ctx = detectContext();
-        platformTenant = ctx.tenant;
-        platformEnv = ctx.platformEnv;
-        logInfo(`Auto-detected: Tenant=${platformTenant}, Env=${platformEnv}`);
-    }
-    const appTenant = options.appTenant ?? platformTenant;
-    const appStage = options.appStage ?? platformEnv;
+    const platform = platformAxis(options, USAGE);
+    const { tenant: platformTenant, env: platformEnv } = platform();
+    const app = appAxis(options, platform);
     const appName = options.app;
     if (appName) {
-        logInfo(`App credentials: tenant=${appTenant}, stage=${appStage}, app=${appName}`);
+        logInfo(`App credentials: tenant=${app.tenant}, stage=${app.stage}, app=${appName}`);
     }
     const psqlCheck = spawn("which", ["psql"]);
     await new Promise((resolve, reject) => {
@@ -96,7 +81,7 @@ export async function psqlCommand(options) {
     process.on("exit", cleanup);
     process.on("SIGINT", cleanup);
     process.on("SIGTERM", cleanup);
-    const databaseUrl = await getDatabaseUrl(appTenant, appStage, { app: appName });
+    const databaseUrl = await getDatabaseUrl(app.tenant, app.stage, { app: appName });
     const parsed = new URL(databaseUrl);
     const username = parsed.username;
     const password = decodeURIComponent(parsed.password);

package/dist/src/commands/init/platform-setup.d.ts

@@ -0,0 +1,68 @@
+export interface SetupPrompts {
+    input(args: {
+        message: string;
+        default?: string;
+        validate?: (v: string) => true | string;
+    }): Promise<string>;
+    confirm(args: {
+        message: string;
+        default?: boolean;
+    }): Promise<boolean>;
+}
+export interface PlatformSetupFlags {
+    env?: string;
+    region?: string;
+    domain?: string;
+    profile?: string;
+    stateBucket?: string;
+    dir?: string;
+    createStateBucket?: boolean;
+    yes?: boolean;
+}
+export interface PlatformSetup {
+    tenant: string;
+    env: string;
+    region: string;
+    domain: string;
+    profile: string;
+    stateBucket: string;
+    dir: string;
+    createStateBucket: boolean;
+}
+export declare const PLATFORM_SETUP_DEFAULTS: {
+    readonly env: "dev";
+    readonly region: "us-east-2";
+    readonly profile: "default";
+};
+export declare const DOMAIN_REQUIRED_MESSAGE: string;
+export declare function defaultStateBucket(tenant: string): string;
+export declare function defaultPlatformDir(tenant: string): string;
+export declare function validateEnv(value: string): true | string;
+export declare function validateRegion(value: string): true | string;
+export declare function validateDomain(value: string): true | string;
+export declare function validateStateBucket(value: string): true | string;
+export declare function resolveTargetDir(tenant: string, flags: PlatformSetupFlags, cwd: string): string;
+export declare function resolvePlatformSetup(tenant: string, flags: PlatformSetupFlags, deps: {
+    prompts?: SetupPrompts;
+    interactive: boolean;
+    cwd?: string;
+}): Promise<PlatformSetup>;
+export declare function stateBucketCreateCommand(setup: Pick<PlatformSetup, "stateBucket" | "region" | "profile">): string;
+export interface StateBucketOutcome {
+    created: boolean;
+    present: boolean;
+    detail: string;
+}
+export interface StateBucketDeps {
+    headBucket(setup: PlatformSetup): boolean;
+    createBucket(setup: PlatformSetup): void;
+    enableVersioning(setup: PlatformSetup): void;
+}
+export declare const realStateBucketDeps: StateBucketDeps;
+export declare function ensureStateBucket(setup: PlatformSetup, deps?: StateBucketDeps): Promise<StateBucketOutcome>;
+export declare function exportCredentialsCommand(profile: string): string;
+export declare function renderPlatformNextSteps(setup: PlatformSetup, opts?: {
+    bucket?: StateBucketOutcome;
+    relativeDir?: string;
+}): string[];
+export declare function scaffoldPlatformRepo(setup: PlatformSetup): Promise<void>;

package/dist/src/commands/init/platform-setup.js

@@ -0,0 +1,203 @@
+import * as fs from "fs";
+import * as path from "path";
+import { execFileSync } from "child_process";
+import { MeshCliError } from "../../utils/errors.js";
+export const PLATFORM_SETUP_DEFAULTS = {
+    env: "dev",
+    region: "us-east-2",
+    profile: "default",
+};
+export const DOMAIN_REQUIRED_MESSAGE = "--domain is required: the core stack creates the public Route 53 zone <env>.<domain>, " +
+    "and a placeholder domain scaffolds a zone that can never validate (the deploy stalls on the ACM certificate).";
+export function defaultStateBucket(tenant) {
+    return `${tenant}-mesh-platform-pulumi-state`;
+}
+export function defaultPlatformDir(tenant) {
+    return `${tenant}-mesh-platform`;
+}
+export function validateEnv(value) {
+    return /^[a-z][a-z0-9-]*$/.test(value.trim())
+        ? true
+        : "lowercase letters, digits and dashes, starting with a letter";
+}
+export function validateRegion(value) {
+    return /^[a-z]{2}(-[a-z]+)+-\d$/.test(value.trim()) ? true : "an AWS region, e.g. us-east-2 or eu-west-1";
+}
+export function validateDomain(value) {
+    const domain = value.trim().toLowerCase().replace(/\.$/, "");
+    if (!domain)
+        return "a public domain you control, e.g. q2poc.pub";
+    if (!/^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}$/.test(domain)) {
+        return "a public domain you control, e.g. q2poc.pub";
+    }
+    if (/(^|\.)(example\.(com|org|net)|invalid|localhost|test)$/.test(domain)) {
+        return `${domain} is a placeholder — the deploy stalls on an ACM certificate for a zone nobody can delegate. Use a domain you control.`;
+    }
+    return true;
+}
+export function validateStateBucket(value) {
+    const bucket = value.trim();
+    return /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(bucket) && !bucket.includes("..")
+        ? true
+        : "3–63 characters: lowercase letters, digits, dots and dashes, starting and ending alphanumeric";
+}
+export function resolveTargetDir(tenant, flags, cwd) {
+    const dir = path.resolve(cwd, flags.dir ?? defaultPlatformDir(tenant));
+    if (fs.existsSync(dir) && fs.readdirSync(dir).length > 0) {
+        throw new MeshCliError(`Target directory is not empty: ${dir}`, {
+            remediation: { command: `mesh init platform ${tenant} --dir <empty-dir>` },
+        });
+    }
+    return dir;
+}
+export async function resolvePlatformSetup(tenant, flags, deps) {
+    const cwd = deps.cwd ?? process.cwd();
+    const dir = resolveTargetDir(tenant, flags, cwd);
+    const ask = deps.interactive && !flags.yes ? deps.prompts : undefined;
+    const env = flags.env ?? (ask ? await ask.input({ message: "Environment", default: PLATFORM_SETUP_DEFAULTS.env, validate: validateEnv }) : PLATFORM_SETUP_DEFAULTS.env);
+    if (validateEnv(env) !== true)
+        throw new MeshCliError(`Invalid environment '${env}' — ${validateEnv(env)}.`);
+    const region = flags.region ??
+        (ask
+            ? await ask.input({ message: "AWS region", default: PLATFORM_SETUP_DEFAULTS.region, validate: validateRegion })
+            : PLATFORM_SETUP_DEFAULTS.region);
+    if (validateRegion(region) !== true)
+        throw new MeshCliError(`Invalid region '${region}' — ${validateRegion(region)}.`);
+    let domain = flags.domain;
+    if (domain === undefined) {
+        if (!ask)
+            throw new MeshCliError(DOMAIN_REQUIRED_MESSAGE, { remediation: { command: `mesh init platform ${tenant} --domain <your-domain>` } });
+        domain = await ask.input({
+            message: `Public base domain (the core stack creates the Route 53 zone ${env}.<domain>; its NS records must be delegated from the parent before the deploy can finish)`,
+            validate: validateDomain,
+        });
+    }
+    const domainCheck = validateDomain(domain);
+    if (domainCheck !== true)
+        throw new MeshCliError(`Invalid --domain '${domain}' — ${domainCheck}`);
+    domain = domain.trim().toLowerCase().replace(/\.$/, "");
+    const profile = flags.profile ??
+        (ask
+            ? await ask.input({ message: "AWS profile the stack config references", default: PLATFORM_SETUP_DEFAULTS.profile })
+            : PLATFORM_SETUP_DEFAULTS.profile);
+    const bucketDefault = defaultStateBucket(tenant);
+    const stateBucket = flags.stateBucket ??
+        (ask
+            ? await ask.input({ message: "Pulumi state S3 bucket (holds this platform's state — created below if it does not exist)", default: bucketDefault, validate: validateStateBucket })
+            : bucketDefault);
+    const bucketCheck = validateStateBucket(stateBucket);
+    if (bucketCheck !== true)
+        throw new MeshCliError(`Invalid --state-bucket '${stateBucket}' — ${bucketCheck}`);
+    let createStateBucket = flags.createStateBucket ?? false;
+    if (flags.createStateBucket === undefined && ask) {
+        createStateBucket = await ask.confirm({
+            message: `Create s3://${stateBucket} in ${region} now (versioned), if it does not exist?`,
+            default: true,
+        });
+    }
+    return {
+        tenant,
+        env,
+        region,
+        domain,
+        profile,
+        stateBucket: stateBucket.trim(),
+        dir,
+        createStateBucket,
+    };
+}
+export function stateBucketCreateCommand(setup) {
+    const location = setup.region === "us-east-1" ? "" : ` --create-bucket-configuration LocationConstraint=${setup.region}`;
+    return `aws s3api create-bucket --bucket ${setup.stateBucket} --region ${setup.region}${location} --profile ${setup.profile}`;
+}
+function awsJson(args, profile) {
+    return execFileSync("aws", [...args, "--profile", profile], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+}
+export const realStateBucketDeps = {
+    headBucket(setup) {
+        try {
+            awsJson(["s3api", "head-bucket", "--bucket", setup.stateBucket, "--region", setup.region], setup.profile);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
+    createBucket(setup) {
+        const args = ["s3api", "create-bucket", "--bucket", setup.stateBucket, "--region", setup.region];
+        if (setup.region !== "us-east-1")
+            args.push("--create-bucket-configuration", `LocationConstraint=${setup.region}`);
+        awsJson(args, setup.profile);
+    },
+    enableVersioning(setup) {
+        awsJson(["s3api", "put-bucket-versioning", "--bucket", setup.stateBucket, "--region", setup.region, "--versioning-configuration", "Status=Enabled"], setup.profile);
+    },
+};
+export async function ensureStateBucket(setup, deps = realStateBucketDeps) {
+    if (!setup.createStateBucket) {
+        return { created: false, present: false, detail: "not requested" };
+    }
+    try {
+        if (deps.headBucket(setup)) {
+            return { created: false, present: true, detail: `s3://${setup.stateBucket} already exists` };
+        }
+    }
+    catch {
+    }
+    try {
+        deps.createBucket(setup);
+    }
+    catch (err) {
+        const why = errorDetail(err);
+        return { created: false, present: false, detail: `could not create s3://${setup.stateBucket} — ${why}` };
+    }
+    try {
+        deps.enableVersioning(setup);
+        return { created: true, present: true, detail: `created s3://${setup.stateBucket} in ${setup.region} (versioning on)` };
+    }
+    catch (err) {
+        return { created: true, present: true, detail: `created s3://${setup.stateBucket} in ${setup.region}, but versioning could not be enabled — ${errorDetail(err)}` };
+    }
+}
+function errorDetail(err) {
+    const stderr = err && typeof err === "object" && "stderr" in err ? String(err.stderr ?? "") : "";
+    const text = stderr.trim() || (err instanceof Error ? err.message : String(err));
+    return text.split("\n").filter(Boolean).slice(-1)[0] ?? "unknown error";
+}
+export function exportCredentialsCommand(profile) {
+    return (`eval "$(aws configure export-credentials --profile ${profile} --format env)"` +
+        "   # mesh deploy reads AWS_ACCESS_KEY_ID; a platform stack carries no mesh:deployerRole");
+}
+export function renderPlatformNextSteps(setup, opts = {}) {
+    const dir = opts.relativeDir ?? setup.dir;
+    const steps = [];
+    if (!opts.bucket?.present) {
+        steps.push(`${stateBucketCreateCommand(setup)}   # the Pulumi state bucket, once`);
+    }
+    steps.push(`cd ${dir}`, "pnpm install", `aws sso login --profile ${setup.profile}   # if this profile is SSO`, exportCredentialsCommand(setup.profile), `cd core && mesh deploy up        # the VPC, EKS, RDS and the public zone ${setup.env}.${setup.domain}`, `# → then delegate the NS records of ${setup.env}.${setup.domain} from ${setup.domain}; the deploy waits on the ACM certificate until you do`, "cd ../platform && mesh deploy up  # Temporal, Zitadel, the Hub  (needs Docker — it builds service images)", `mesh login ${setup.tenant}.${setup.env}      # your platform sign-in, once it is up`, "", "Then, in your apps repo, for the hello-world app:", `  mesh init --tenant ${setup.tenant} --platform ${setup.env}`, "  mesh create-app --name hello --primitives service", "  mesh deploy up                   # from the app directory");
+    return steps;
+}
+export async function scaffoldPlatformRepo(setup) {
+    if (fs.existsSync(setup.dir) && fs.readdirSync(setup.dir).length > 0) {
+        throw new MeshCliError(`Target directory is not empty: ${setup.dir}`, {
+            remediation: { command: `mesh init platform ${setup.tenant} --dir <empty-dir>` },
+        });
+    }
+    const { copyTemplate } = await import("../create-app.js");
+    const { findPackageRoot } = await import("../local/stack.js");
+    const { syncSkills } = await import("../skills.js");
+    const templateDir = path.join(findPackageRoot(), "templates", "platform-repo");
+    fs.mkdirSync(setup.dir, { recursive: true });
+    copyTemplate(templateDir, setup.dir, {
+        tenant: setup.tenant,
+        env: setup.env,
+        region: setup.region,
+        domain: setup.domain,
+        profile: setup.profile,
+        stateBucket: setup.stateBucket,
+    });
+    syncSkills(setup.dir);
+}