@mesh-tech/mesh-cli 0.25.0 → 0.27.0

package/dist/src/commands/local/mock-idps.js

@@ -0,0 +1,119 @@
+import { execFileSync } from "child_process";
+import * as fs from "fs";
+import * as path from "path";
+import { meshCacheDir } from "../../utils/cache-home.js";
+import { MeshCliError } from "../../utils/errors.js";
+export const MOCK_SAML_PORT = 4569;
+export const MOCK_OIDC_PORT = 5556;
+const MOCK_OIDC_SERVICE = "mock-oidc";
+export const idpEndpoints = () => [
+    {
+        service: "mock-saml",
+        label: "Mock SAML IdP",
+        url: `http://localhost:${MOCK_SAML_PORT}`,
+        probe: { kind: "http", url: mockSamlMetadataUrl() },
+        hint: "sign in as any email you type; federation metadata at /api/saml/metadata",
+    },
+    {
+        service: MOCK_OIDC_SERVICE,
+        label: "Mock OIDC IdP",
+        url: `http://localhost:${MOCK_OIDC_PORT}/dex`,
+        probe: {
+            kind: "http",
+            url: `http://localhost:${MOCK_OIDC_PORT}/dex/.well-known/openid-configuration`,
+        },
+        hint: "dev@local.mesh or ops@local.mesh / password",
+    },
+];
+export const MOCK_SAML_IDP_NAME = "Mock SAML (local)";
+export const MOCK_OIDC_IDP_NAME = "Mock OIDC (local)";
+const MOCK_OIDC_CLIENT_ID = "mesh-local";
+const MOCK_OIDC_CLIENT_SECRET = "mesh-local-secret";
+export const mockSamlMetadataUrl = () => `http://localhost:${MOCK_SAML_PORT}/api/saml/metadata`;
+export const mockOidcEndpoints = () => ({
+    authorization: `http://localhost:${MOCK_OIDC_PORT}/dex/auth`,
+    token: `http://${MOCK_OIDC_SERVICE}:${MOCK_OIDC_PORT}/dex/token`,
+    user: `http://${MOCK_OIDC_SERVICE}:${MOCK_OIDC_PORT}/dex/userinfo`,
+});
+const keyDir = () => path.join(meshCacheDir("mesh-local"), "mock-idp");
+export function ensureMockSamlSigningKey() {
+    const dir = keyDir();
+    const certPath = path.join(dir, "cert.pem");
+    const keyPath = path.join(dir, "key.pem");
+    if (!fs.existsSync(certPath) || !fs.existsSync(keyPath)) {
+        fs.mkdirSync(dir, { recursive: true });
+        try {
+            execFileSync("openssl", [
+                "req",
+                "-x509",
+                "-newkey",
+                "rsa:2048",
+                "-keyout",
+                keyPath,
+                "-out",
+                certPath,
+                "-days",
+                "3650",
+                "-nodes",
+                "-subj",
+                "/CN=mesh-local-mock-saml",
+            ], { stdio: "ignore" });
+        }
+        catch (cause) {
+            throw new MeshCliError("Could not generate the mock SAML signing key.", {
+                remediation: {
+                    command: "openssl version   # openssl must be on PATH for --with-idps",
+                },
+                cause,
+            });
+        }
+    }
+    return {
+        publicKeyB64: fs.readFileSync(certPath).toString("base64"),
+        privateKeyB64: fs.readFileSync(keyPath).toString("base64"),
+    };
+}
+export const mockIdpComposeEnv = () => {
+    const { publicKeyB64, privateKeyB64 } = ensureMockSamlSigningKey();
+    return {
+        MESH_MOCK_SAML_PUBLIC_KEY: publicKeyB64,
+        MESH_MOCK_SAML_PRIVATE_KEY: privateKeyB64,
+    };
+};
+export const buildMockSamlIdpBody = (metadataXml) => ({
+    name: MOCK_SAML_IDP_NAME,
+    metadataXml: Buffer.from(metadataXml, "utf-8").toString("base64"),
+    binding: "SAML_BINDING_POST",
+    withSignedRequest: true,
+    providerOptions: {
+        isLinkingAllowed: true,
+        isCreationAllowed: true,
+        isAutoCreation: true,
+        isAutoUpdate: true,
+        autoLinking: "AUTO_LINKING_OPTION_EMAIL",
+    },
+});
+export const buildMockOauthIdpBody = () => {
+    const endpoints = mockOidcEndpoints();
+    return {
+        name: MOCK_OIDC_IDP_NAME,
+        clientId: MOCK_OIDC_CLIENT_ID,
+        clientSecret: MOCK_OIDC_CLIENT_SECRET,
+        authorizationEndpoint: endpoints.authorization,
+        tokenEndpoint: endpoints.token,
+        userEndpoint: endpoints.user,
+        scopes: ["openid", "profile", "email"],
+        idAttribute: "sub",
+        providerOptions: {
+            isLinkingAllowed: true,
+            isCreationAllowed: true,
+            isAutoCreation: true,
+            isAutoUpdate: true,
+            autoLinking: "AUTO_LINKING_OPTION_EMAIL",
+        },
+    };
+};
+export const missingLoginPolicyIdps = (attached, wanted) => {
+    const have = new Set(attached);
+    return [...new Set(wanted)].filter((id) => !have.has(id));
+};

package/dist/src/commands/local/seed-zitadel.d.ts

@@ -73,4 +73,10 @@ export interface ZitadelSeedResult {
     hubAuth: HubAuthConfig;
 }
 export declare function seedZitadel(awsConfig: object): Promise<ZitadelSeedResult>;
+export declare const IDP_SEARCH_PATH = "/admin/v1/idps/templates/_search";
+export declare const pickIdpIdByName: (searchResult: any, name: string) => string | undefined;
+export declare function seedMockIdps(): Promise<{
+    samlIdpId: string;
+    oidcIdpId: string;
+}>;
 export {};

package/dist/src/commands/local/seed-zitadel.js

@@ -8,6 +8,7 @@ import { writeContextConfig } from "../login.js";
 import { compose, hubPort, DEFAULT_HUB_PORT } from "./stack.js";
 import { LOCAL_TENANT, LOCAL_ENV } from "./seed.js";
 import { meshCacheDir } from "../../utils/cache-home.js";
+import { buildMockOauthIdpBody, buildMockSamlIdpBody, missingLoginPolicyIdps, MOCK_OIDC_IDP_NAME, MOCK_SAML_IDP_NAME, mockSamlMetadataUrl, } from "./mock-idps.js";
 export const ZITADEL_ISSUER = "http://localhost:8080";
 export const LOGIN_CONTEXT = "local";
 export const PLATFORM_ORG = "mesh";
@@ -441,3 +442,78 @@ export async function seedZitadel(awsConfig) {
     logSuccess(`Login context '${LOGIN_CONTEXT}' configured → try: mesh login ${LOGIN_CONTEXT}`);
     return { projectId, cliClientId, hubAuth };
 }
+async function fetchMockSamlMetadata() {
+    const url = mockSamlMetadataUrl();
+    let lastError = "no attempt made";
+    for (let attempt = 0; attempt < 30; attempt++) {
+        try {
+            const res = await fetch(url, { signal: AbortSignal.timeout(5_000) });
+            const body = await res.text();
+            if (res.ok && body.includes("EntityDescriptor")) {
+                if (/<ds:X509Certificate\s*\/>|<ds:X509Certificate>\s*<\/ds:X509Certificate>/.test(body)) {
+                    throw new MeshCliError("The mock SAML IdP served metadata with an empty signing certificate.", {
+                        remediation: {
+                            command: "rm -rf ~/.cache/mesh/mesh-local/mock-idp && mesh stop && mesh start --with-idps",
+                        },
+                    });
+                }
+                return body;
+            }
+            lastError = `HTTP ${res.status}`;
+        }
+        catch (cause) {
+            if (cause instanceof MeshCliError)
+                throw cause;
+            lastError = String(cause);
+        }
+        await new Promise((resolve) => setTimeout(resolve, 2_000));
+    }
+    throw new MeshCliError(`Could not read mock SAML metadata from ${url} (${lastError}).`, {
+        remediation: { command: "mesh status   # is mock-saml running?" },
+    });
+}
+async function attachedLoginPolicyIdps(pat) {
+    const res = await api(pat, "POST", "/admin/v1/policies/login/idps/_search", {});
+    return (res?.result ?? []).map((idp) => String(idp.idpId ?? idp.id)).filter(Boolean);
+}
+export const IDP_SEARCH_PATH = "/admin/v1/idps/templates/_search";
+export const pickIdpIdByName = (searchResult, name) => {
+    const hit = (searchResult?.result ?? []).find((idp) => idp?.name === name);
+    return hit?.id ? String(hit.id) : undefined;
+};
+async function findIdpByName(pat, name) {
+    return pickIdpIdByName(await api(pat, "POST", IDP_SEARCH_PATH, {}), name);
+}
+export async function seedMockIdps() {
+    const pat = readSeederPat();
+    const metadataXml = await fetchMockSamlMetadata();
+    let samlIdpId = await findIdpByName(pat, MOCK_SAML_IDP_NAME);
+    if (!samlIdpId) {
+        const created = await api(pat, "POST", "/admin/v1/idps/saml", buildMockSamlIdpBody(metadataXml));
+        samlIdpId = String(created.id);
+    }
+    logSuccess(`Mock SAML IdP ready (${MOCK_SAML_IDP_NAME}, id ${samlIdpId})`);
+    let oidcIdpId = await findIdpByName(pat, MOCK_OIDC_IDP_NAME);
+    if (!oidcIdpId) {
+        const created = await api(pat, "POST", "/admin/v1/idps/oauth", buildMockOauthIdpBody());
+        oidcIdpId = String(created.id);
+    }
+    logSuccess(`Mock OIDC IdP ready (${MOCK_OIDC_IDP_NAME}, id ${oidcIdpId})`);
+    const policy = await api(pat, "GET", "/admin/v1/policies/login");
+    if (policy?.policy?.allowExternalIdp !== true) {
+        await api(pat, "PUT", "/admin/v1/policies/login", {
+            ...policy.policy,
+            allowExternalIdp: true,
+        });
+        logInfo("Instance login policy: allowExternalIdp turned on (federation buttons were hidden)");
+    }
+    const attached = await attachedLoginPolicyIdps(pat);
+    const toAttach = missingLoginPolicyIdps(attached, [samlIdpId, oidcIdpId]);
+    for (const idpId of toAttach) {
+        await api(pat, "POST", "/admin/v1/policies/login/idps", { idpId, ownerType: "IDP_OWNER_TYPE_SYSTEM" });
+    }
+    const finalIdps = await attachedLoginPolicyIdps(pat);
+    logSuccess(`Login policy carries ${finalIdps.length} federation(s) — both mocks attached, ` +
+        "which is the state a login-policy change has to preserve");
+    return { samlIdpId, oidcIdpId };
+}

package/dist/src/commands/local/stack.d.ts

@@ -29,20 +29,25 @@ export declare function hubPort(): string;
 export declare function hubEndpoints(): StackEndpoint[];
 export declare function findPackageRoot(startDir?: string): string;
 export declare function stackDir(): string;
+export declare const BASE_COMPOSE_FILE = "docker-compose.yml";
 export declare const HUB_OVERLAY_FILE = "docker-compose.hub.yml";
+export declare const IDPS_OVERLAY_FILE = "docker-compose.idps.yml";
 export declare function parseComposeServiceNames(yamlText: string): string[];
 export declare function hubOverlayServices(): ReadonlySet<string>;
+export declare function idpsOverlayServices(): ReadonlySet<string>;
 export declare function stackOwnedElsewhere(): string | undefined;
 export declare function ensureDockerAvailable(): void;
 export declare function compose(args: string[], opts?: {
     inherit?: boolean;
     hub?: boolean;
+    idps?: boolean;
     env?: Record<string, string>;
 }): string;
 export declare function summarizeComposeFailure(output: string): string;
 export declare function composeLogPath(op: string): string;
 export declare function composeStreamed(args: string[], opts?: {
     hub?: boolean;
+    idps?: boolean;
     env?: Record<string, string>;
 }): Promise<void>;
 export interface ServiceStatus {
@@ -53,10 +58,13 @@ export interface ServiceStatus {
 export declare function parseComposePs(output: string): ServiceStatus[];
 export declare function stackServices(): ServiceStatus[];
 export declare const ONE_SHOT_SERVICES: Set<string>;
+export interface OverlayState {
+    services: ReadonlySet<string>;
+    started: boolean;
+}
 export declare function crashedServices(services: ServiceStatus[], opts: {
-    overlayServices: ReadonlySet<string>;
-    overlayStarted: boolean;
+    overlays: readonly OverlayState[];
 }): ServiceStatus[];
-export declare function hubOverlayRunning(services: ServiceStatus[], overlayServices: ReadonlySet<string>): boolean;
+export declare function overlayRunning(services: ServiceStatus[], overlayServices: ReadonlySet<string>): boolean;
 export declare function hubApiRunning(services: ServiceStatus[]): boolean;
 export declare function probeEndpoint(endpoint: StackEndpoint): Promise<boolean>;

package/dist/src/commands/local/stack.js

@@ -189,23 +189,34 @@ export function stackDir() {
     }
     return dir;
 }
+export const BASE_COMPOSE_FILE = "docker-compose.yml";
 export const HUB_OVERLAY_FILE = "docker-compose.hub.yml";
+export const IDPS_OVERLAY_FILE = "docker-compose.idps.yml";
 export function parseComposeServiceNames(yamlText) {
     const doc = parseYaml(yamlText);
     return Object.keys(doc?.services ?? {});
 }
-let hubOverlayServicesCache;
-export function hubOverlayServices() {
-    if (!hubOverlayServicesCache) {
-        const file = path.join(stackDir(), HUB_OVERLAY_FILE);
-        if (!fs.existsSync(file)) {
-            throw new MeshCliError(`Local stack assets are incomplete: ${file} is missing.`, {
-                remediation: { command: "npm install -g @mesh-tech/mesh-cli" },
-            });
-        }
-        hubOverlayServicesCache = new Set(parseComposeServiceNames(fs.readFileSync(file, "utf-8")));
+const overlayServicesCache = new Map();
+function overlayServicesOf(overlayFile) {
+    const cached = overlayServicesCache.get(overlayFile);
+    if (cached)
+        return cached;
+    const file = path.join(stackDir(), overlayFile);
+    if (!fs.existsSync(file)) {
+        throw new MeshCliError(`Local stack assets are incomplete: ${file} is missing.`, {
+            remediation: { command: "npm install -g @mesh-tech/mesh-cli" },
+        });
     }
-    return hubOverlayServicesCache;
+    const base = new Set(parseComposeServiceNames(fs.readFileSync(path.join(stackDir(), BASE_COMPOSE_FILE), "utf-8")));
+    const names = new Set(parseComposeServiceNames(fs.readFileSync(file, "utf-8")).filter((n) => !base.has(n)));
+    overlayServicesCache.set(overlayFile, names);
+    return names;
+}
+export function hubOverlayServices() {
+    return overlayServicesOf(HUB_OVERLAY_FILE);
+}
+export function idpsOverlayServices() {
+    return overlayServicesOf(IDPS_OVERLAY_FILE);
 }
 export function stackOwnedElsewhere() {
     try {
@@ -244,6 +255,8 @@ export function compose(args, opts = {}) {
     const files = ["-f", path.join(dir, "docker-compose.yml")];
     if (opts.hub)
         files.push("-f", path.join(dir, "docker-compose.hub.yml"));
+    if (opts.idps)
+        files.push("-f", path.join(dir, IDPS_OVERLAY_FILE));
     const fullArgs = ["compose", "-p", COMPOSE_PROJECT, ...files, ...args];
     return execFileSync("docker", fullArgs, {
         cwd: dir,
@@ -276,6 +289,8 @@ export async function composeStreamed(args, opts = {}) {
     const files = ["-f", path.join(dir, "docker-compose.yml")];
     if (opts.hub)
         files.push("-f", path.join(dir, "docker-compose.hub.yml"));
+    if (opts.idps)
+        files.push("-f", path.join(dir, IDPS_OVERLAY_FILE));
     const fullArgs = ["compose", "-p", COMPOSE_PROJECT, ...files, ...args];
     const env = {
         ...process.env,
@@ -362,11 +377,10 @@ export function stackServices() {
 }
 export const ONE_SHOT_SERVICES = new Set(["spicedb-migrate", "zitadel-machinekey-init"]);
 export function crashedServices(services, opts) {
-    return services.filter((s) => s.state === "exited" &&
-        !ONE_SHOT_SERVICES.has(s.name) &&
-        (opts.overlayStarted || !opts.overlayServices.has(s.name)));
+    const dormant = new Set(opts.overlays.filter((o) => !o.started).flatMap((o) => [...o.services]));
+    return services.filter((s) => s.state === "exited" && !ONE_SHOT_SERVICES.has(s.name) && !dormant.has(s.name));
 }
-export function hubOverlayRunning(services, overlayServices) {
+export function overlayRunning(services, overlayServices) {
     return services.some((s) => overlayServices.has(s.name) && s.state === "running");
 }
 export function hubApiRunning(services) {

package/dist/src/commands/login.d.ts

@@ -50,6 +50,10 @@ export declare function registerLoginCommand(program: Command): void;
 export declare const RESERVED_REGISTRY_CONTEXT = "registry";
 export declare const NO_REGISTRY_DEPRECATED = "--no-registry is deprecated and ignored: mesh login no longer touches the registry.";
 export declare const REGISTRY_SEPARATE_HINT = "Package registry access is separate from platform sign-in \u2014 run: mesh registry login";
+export declare function shorthandContext(context: string): {
+    tenant: string;
+    env: string;
+} | null;
 export declare function renderNoConfigHelp(context: string): string;
 export declare function tokenStillValid(expiresAt: string, marginMs?: number, now?: number): boolean;
 declare function getValidToken(context: string, opts?: {

package/dist/src/commands/login.js

@@ -622,7 +622,7 @@ async function showStatus(context, config) {
 export function registerLoginCommand(program) {
     program
         .command("login")
-        .description("Authenticate with Zitadel (OIDC PKCE or Device Code)")
+        .description("PLATFORM access: sign in to a deployed Mesh platform (`<tenant>.<env>`) — what `mesh deploy`, `mesh stack`, the Hub and the VPN use. It never touches your ~/.npmrc, and you do not need it to install packages: that is `mesh registry login`. OIDC PKCE, or device code with --device.")
         .argument("<context>", 'Platform context (e.g., "mesh.dev")')
         .option("--status", "Show current authentication status — the Zitadel session if one is cached, otherwise the AWS identity the credential chain resolves (SSO profile or key pair). Exits non-zero only when neither works.")
         .option("--device", "Force device code flow (no callback server needed)")
@@ -668,7 +668,7 @@ export function registerLoginCommand(program) {
     });
     program
         .command("logout")
-        .description("Clear cached Zitadel credentials")
+        .description("Clear a platform context's cached credentials (the package-registry session under `mesh registry` is untouched)")
         .argument("<context>", 'Platform context (e.g., "mesh.dev")')
         .action((context) => {
         refuseReservedRegistryContext(context, "logout");
@@ -698,8 +698,20 @@ async function hintRegistryIfMissing() {
     catch {
     }
 }
+export function shorthandContext(context) {
+    const parts = context.split(".");
+    if (parts.length !== 2)
+        return null;
+    const [tenant, env] = parts;
+    return tenant && env ? { tenant, env } : null;
+}
 export function renderNoConfigHelp(context) {
     const pinned = firstPartyDomainFor(context);
+    const shorthand = shorthandContext(context);
+    const createOne = shorthand
+        ? `mesh init --tenant ${shorthand.tenant} --new-platform ${shorthand.env}`
+        : "mesh init --tenant <tenant> --new-platform <env>";
+    const scaffoldOne = `mesh init platform ${shorthand?.tenant ?? "<tenant>"} --domain <a domain you control>`;
     return (`No configuration found for "${context}".\n\n` +
         `Tried:\n` +
         `  1. SSM: /mesh-platform/${context.split(".")[0]}/${context.split(".")[1]}/platform/zitadel\n` +
@@ -709,6 +721,8 @@ export function renderNoConfigHelp(context) {
             : `  2. HTTPS: https://cli.${context}/.well-known/mesh.json\n` +
                 `     (only attempted for a full domain, or a known first-party context)\n\n`) +
         `To fix:\n` +
+        `  - No platform deployed yet? Create one: ${createOne}\n` +
+        `    (or the scaffold on its own: ${scaffoldOne})\n` +
         `  - Use the platform's full domain: mesh login <env>.<tenant>.meshtech.io\n` +
         `  - Or, if you have AWS access, ensure SSO is active: aws sso login --profile <profile>\n` +
         `  - Or add config manually to ${CONFIG_FILE}:\n\n` +

package/dist/src/commands/registry.d.ts

@@ -2,7 +2,7 @@ import { Command } from "commander";
 import { MeshCliError } from "../utils/errors.js";
 import type { RegistryTokenState } from "../utils/auth-preflight.js";
 import { type RegistryBrokerFailure, type RegistryGrant } from "../utils/registry-broker.js";
-import { readRegistrySession } from "../utils/registry-identity.js";
+import { readRegistrySession, type RegistryAccountState } from "../utils/registry-identity.js";
 export declare function codeartifactLogin(env?: Record<string, string>): boolean;
 export declare function resolvePublisherRoleArn({ roleArnFlag, ssmArn, }: {
     roleArnFlag?: string;
@@ -12,7 +12,7 @@ export declare function resolveCredentials(context?: string, roleArn?: string):
 export declare function applyGrantToUserNpmrc(grant: RegistryGrant, npmrcPath?: string): {
     path: string;
 };
-export declare function describeBrokerFailure(failure: RegistryBrokerFailure): {
+export declare function describeBrokerFailure(failure: RegistryBrokerFailure, account?: RegistryAccountState): {
     message: string;
     hint?: string;
     fatal: boolean;

package/dist/src/commands/registry.js

@@ -5,7 +5,7 @@ import { logInfo, logSuccess, logWarn } from "../utils/log.js";
 import { MeshCliError } from "../utils/errors.js";
 import { awsConfigHasProfile, findUnscopedCodeArtifactRegistry, homeNpmrcPath, npmrcAuthKeyForEndpoint, probeRegistryToken, readAwsConfig, SSO_SESSION_SNIPPET, stripUnscopedCodeArtifactRegistry, upsertNpmrcLines, } from "../utils/auth-preflight.js";
 import { fetchRegistryGrant, realGrantDeps, PUBLISHED_BROKER_TIMEOUT_MS, } from "../utils/registry-broker.js";
-import { clearRegistrySession, describeSessionExpiry, ensureRegistrySession, identityChanged, logRegistryIdentity, readRegistrySession, refreshRegistrySession, resolveRegistryIdentity, } from "../utils/registry-identity.js";
+import { clearRegistrySession, describeSessionExpiry, ensureRegistrySession, identityChanged, logRegistryIdentity, readRegistrySession, refreshRegistrySession, registryAccountState, resolveRegistryIdentity, } from "../utils/registry-identity.js";
 import { readCredentials } from "./login.js";
 import { registerRegistryPublish } from "./registry-publish.js";
 const CA_DOMAIN = "mesh-platform";
@@ -222,7 +222,11 @@ export function applyGrantToUserNpmrc(grant, npmrcPath = homeNpmrcPath()) {
     }
     return { path: npmrcPath };
 }
-export function describeBrokerFailure(failure) {
+export function describeBrokerFailure(failure, account = {}) {
+    const unverified = account.emailVerified === false
+        ? `\n  Your Mesh account${account.email ? ` (${account.email})` : ""} has never confirmed its email address, and an unconfirmed account cannot hold a registry grant.` +
+            `\n  This is not something a role fixes: ask your Mesh contact to verify the address on your account (a self-registered, passkey-only sign-up lands here), then run: mesh registry logout && mesh registry login`
+        : "";
     switch (failure.kind) {
         case "no-broker":
             return {
@@ -237,7 +241,7 @@ export function describeBrokerFailure(failure) {
             };
         case "unauthenticated":
             return {
-                message: "The registry broker rejected your session (expired or wrong audience).",
+                message: "The registry broker rejected your session (expired or wrong audience)." + unverified,
                 hint: "mesh registry logout && mesh registry login",
                 fatal: false,
             };
@@ -251,7 +255,8 @@ export function describeBrokerFailure(failure) {
                     (failure.requestUrl
                         ? `\n  Request access: ${failure.requestUrl}`
                         : "\n  Ask a Mesh platform admin to grant your account registry access.") +
-                    `\n  ${NOT_AUTHORIZED_RERUN}`,
+                    `\n  ${NOT_AUTHORIZED_RERUN}` +
+                    unverified,
                 fatal: true,
             };
         case "unavailable":
@@ -327,7 +332,7 @@ async function tryBrokerLogin(opts) {
     }
     if (result.ok)
         return { grant: result.grant };
-    const { message, hint, fatal } = describeBrokerFailure(result.failure);
+    const { message, hint, fatal } = describeBrokerFailure(result.failure, registryAccountState(readCredentials(session.context)?.idToken));
     if (fatal) {
         throw new RegistryNotAuthorizedError(message);
     }
@@ -627,7 +632,7 @@ export function describeAwsChainFailure(outcome) {
 export function registerRegistryCommands(program) {
     const registry = program
         .command("registry")
-        .description("Manage npm registry auth for @mesh-tech packages");
+        .description("PACKAGE access: the sign-in that makes @mesh-tech/* installable. One global identity — no AWS account, no platform, no `<tenant>.<env>` context. (`mesh login <tenant>.<env>` is the other one; that is for deploying to or operating a platform.)");
     registry
         .command("login")
         .description("Sign in to the Mesh package registry (browser, or device code with --device) and configure ~/.npmrc + the project .npmrc. Needs no platform context and no AWS account.")

package/dist/src/commands/secrets/context.d.ts

@@ -0,0 +1,5 @@
+import { type MeshContext } from "../../utils/context.js";
+import { type StackSelector } from "../../utils/stack-flag.js";
+export declare function resolveSecretsContext(opts: StackSelector & {
+    tenant?: string;
+}, stackOpt?: string | undefined): MeshContext;

package/dist/src/commands/secrets/context.js

@@ -0,0 +1,5 @@
+import { detectContext } from "../../utils/context.js";
+import { resolveStackOption } from "../../utils/stack-flag.js";
+export function resolveSecretsContext(opts, stackOpt = resolveStackOption(opts)) {
+    return detectContext(stackOpt, { tenant: opts.tenant, stack: stackOpt });
+}

package/dist/src/commands/secrets/index.js

@@ -21,6 +21,7 @@ export function registerSecretsCommands(program) {
         .option("--key <key>", "Instance key for multi-instance services (e.g., FI ID)")
         .option("--all", "Prompt for all fields including optional ones")
         .option("--json <json>", "Non-interactive: provide values as JSON")
+        .option("-t, --tenant <tenant>", "Tenant to address (override detection)")
         .option("--stack <stack>", "Pulumi stack name (override detection)")
         .addOption(new Option("--stage <stack>", "Deprecated alias for --stack").hideHelp())
         .option("--region <region>", "AWS region (default: us-east-2)")
@@ -31,6 +32,7 @@ export function registerSecretsCommands(program) {
         .command("reindex [service]")
         .description("Rebuild a multi-instance external service's instance index (the {prefix}/.index secret listInstances() reads) from the per-key secrets actually in Secrets Manager — the repair for an instance secret created or deleted out of band")
         .option("--dry-run", "Show what would change without writing")
+        .option("-t, --tenant <tenant>", "Tenant to address (override detection)")
         .option("--stack <stack>", "Pulumi stack name (override detection)")
         .addOption(new Option("--stage <stack>", "Deprecated alias for --stack").hideHelp())
         .option("--region <region>", "AWS region (default: us-east-2)")
@@ -42,6 +44,7 @@ export function registerSecretsCommands(program) {
         .description("Backfill .config mirror secrets for all external services")
         .option("--force", "Overwrite existing .config mirrors")
         .option("--dry-run", "Show what would be written without writing")
+        .option("-t, --tenant <tenant>", "Tenant to address (override detection)")
         .option("--stack <stack>", "Pulumi stack name (override detection)")
         .addOption(new Option("--stage <stack>", "Deprecated alias for --stack").hideHelp())
         .option("--region <region>", "AWS region (default: us-east-2)")

package/dist/src/commands/secrets/migrate-config.d.ts

@@ -1,6 +1,7 @@
 export declare function migrateConfigCommand(opts: {
     force?: boolean;
     dryRun?: boolean;
+    tenant?: string;
     stack?: string;
     stage?: string;
     region?: string;

package/dist/src/commands/secrets/migrate-config.js

@@ -1,8 +1,7 @@
 import { SSMClient, GetParametersByPathCommand, } from "@aws-sdk/client-ssm";
 import { SecretsManagerClient, GetSecretValueCommand, PutSecretValueCommand, CreateSecretCommand, ListSecretsCommand, } from "@aws-sdk/client-secrets-manager";
-import { detectContext } from "../../utils/context.js";
 import { logInfo, logSuccess, logError } from "../../utils/log.js";
-import { resolveStackOption } from "../../utils/stack-flag.js";
+import { resolveSecretsContext } from "./context.js";
 function normalizeEntry(raw) {
     if (raw.type === "group" && raw.fields) {
         return {
@@ -198,7 +197,7 @@ async function migrateService(smClient, meta, schema, opts) {
     return { migrated, skipped, errors };
 }
 export async function migrateConfigCommand(opts) {
-    const context = detectContext(resolveStackOption(opts));
+    const context = resolveSecretsContext(opts);
     const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
     const ssmClient = new SSMClient({ region });
     const smClient = new SecretsManagerClient({ region });

package/dist/src/commands/secrets/reindex.d.ts

@@ -2,6 +2,7 @@ import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
 export declare function scanInstanceKeys(client: SecretsManagerClient, secretPrefix: string): Promise<string[]>;
 export declare function indexAlreadyMatches(missing: string[], stale: string[], indexExists: boolean, malformed: boolean): boolean;
 export declare function reindexCommand(servicePath: string | undefined, opts: {
+    tenant?: string;
     stack?: string;
     stage?: string;
     region?: string;

package/dist/src/commands/secrets/reindex.js

@@ -1,9 +1,9 @@
 import { SSMClient } from "@aws-sdk/client-ssm";
 import { SecretsManagerClient, ListSecretsCommand, GetSecretValueCommand, PutSecretValueCommand, CreateSecretCommand, } from "@aws-sdk/client-secrets-manager";
 import { buildInstanceIndexValue, instanceIndexSecretId, instanceKeyFromSecretName, parseInstanceIndex, } from "@mesh-tech/secrets";
-import { detectContext } from "../../utils/context.js";
 import { logInfo, logSuccess, logError } from "../../utils/log.js";
 import { resolveStackOption } from "../../utils/stack-flag.js";
+import { resolveSecretsContext } from "./context.js";
 import { discoverExternalServices, ensureAwsCredentialsForStack, isResourceNotFound, } from "./set.js";
 export async function scanInstanceKeys(client, secretPrefix) {
     const keys = [];
@@ -27,7 +27,7 @@ export function indexAlreadyMatches(missing, stale, indexExists, malformed) {
 }
 export async function reindexCommand(servicePath, opts) {
     const stackOpt = resolveStackOption(opts);
-    const context = detectContext(stackOpt);
+    const context = resolveSecretsContext(opts, stackOpt);
     const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
     await ensureAwsCredentialsForStack(stackOpt ?? context.stage);
     const ssmClient = new SSMClient({ region });

package/dist/src/commands/secrets/set.d.ts

@@ -33,6 +33,7 @@ export declare function setCommand(servicePath: string | undefined, opts: {
     key?: string;
     all?: boolean;
     json?: string;
+    tenant?: string;
     stack?: string;
     stage?: string;
     region?: string;

package/dist/src/commands/secrets/set.js

@@ -3,9 +3,9 @@ import { SecretsManagerClient, GetSecretValueCommand, PutSecretValueCommand, Cre
 import input from "@inquirer/input";
 import password from "@inquirer/password";
 import { buildInstanceIndexValue, instanceIndexSecretId, isInstanceKey, parseInstanceIndex, } from "@mesh-tech/secrets";
-import { detectContext } from "../../utils/context.js";
 import { logInfo, logSuccess, logError } from "../../utils/log.js";
 import { resolveStackOption } from "../../utils/stack-flag.js";
+import { resolveSecretsContext } from "./context.js";
 import { findAppRoot, readStackConfig } from "../../utils/pulumi.js";
 import { resolveAwsCredentials } from "../../utils/aws-auth.js";
 export async function ensureAwsCredentialsForStack(stack) {
@@ -147,7 +147,7 @@ function displaySummary(fields, values, depth = 0) {
 }
 export async function setCommand(servicePath, opts) {
     const stackOpt = resolveStackOption(opts);
-    const context = detectContext(stackOpt);
+    const context = resolveSecretsContext(opts, stackOpt);
     const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
     await ensureAwsCredentialsForStack(stackOpt ?? context.stage);
     const ssmClient = new SSMClient({ region });