@mesh-tech/mesh-cli 0.34.3 → 0.35.0

package/dist/bin/mesh.js

@@ -1712,8 +1712,10 @@ var init_stack = __esm({
 var skills_exports = {};
 __export(skills_exports, {
   INTENT_RANGE: () => INTENT_RANGE,
+  installedSkillName: () => installedSkillName,
   listPackageSkills: () => listPackageSkills,
   registerSkillsCommands: () => registerSkillsCommands,
+  renderManagedSkill: () => renderManagedSkill,
   resolveTargetRoot: () => resolveTargetRoot,
   seedAppSkill: () => seedAppSkill,
   syncSkills: () => syncSkills
@@ -1738,15 +1740,36 @@ function cliAsset(...segments) {
 function listBaseSkills() {
   const dir = cliAsset("skills");
   if (!fs6.existsSync(dir)) return [];
-  return fs6.readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && fs6.existsSync(path6.join(dir, entry.name, "SKILL.md"))).map((entry) => ({ name: entry.name, source: path6.join(dir, entry.name, "SKILL.md") }));
+  return fs6.readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && fs6.existsSync(path6.join(dir, entry.name, "SKILL.md"))).map((entry) => ({
+    name: installedSkillName([entry.name]),
+    // The CLI's own skill shipped as `skills/core/` and installed as `mesh-core/`.
+    legacyName: entry.name === "mesh" ? "mesh-core" : `mesh-${entry.name}`,
+    source: path6.join(dir, entry.name, "SKILL.md")
+  }));
+}
+function installedSkillName(segments) {
+  const parts = ["mesh"];
+  for (const segment of segments) {
+    if (segment === "core") continue;
+    if (segment === parts[parts.length - 1]) continue;
+    parts.push(segment);
+  }
+  return parts.join("-");
 }
-function renderManagedSkill(source) {
+function renderManagedSkill(source, name) {
   const raw = fs6.readFileSync(source, "utf-8");
   const frontmatter = raw.match(/^(---\n[\s\S]*?\n---\n)/)?.[1];
-  if (!frontmatter) return `${MANAGED_MARKER}
+  if (!frontmatter) return `---
+name: ${name}
+---
+
+${MANAGED_MARKER}
 
 ${raw}`;
-  return `${frontmatter}
+  const named = /^name:.*$/m.test(frontmatter) ? frontmatter.replace(/^name:.*$/m, `name: ${name}`) : frontmatter.replace(/^---\n/, `---
+name: ${name}
+`);
+  return `${named}
 ${MANAGED_MARKER}
 ${raw.slice(frontmatter.length)}`;
 }
@@ -1785,13 +1808,31 @@ function listPackageSkills(root) {
       for (const domain of fs6.readdirSync(skillsDir, { withFileTypes: true })) {
         const source = path6.join(skillsDir, domain.name, "SKILL.md");
         if (!fs6.existsSync(source)) continue;
-        const name = `mesh-${pkg.name}-${domain.name}`;
-        if (!byName.has(name)) byName.set(name, { name, dir: path6.join(skillsDir, domain.name), source });
+        const name = installedSkillName([pkg.name, domain.name]);
+        if (!byName.has(name)) {
+          byName.set(name, {
+            name,
+            legacyName: `mesh-${pkg.name}-${domain.name}`,
+            dir: path6.join(skillsDir, domain.name),
+            source
+          });
+        }
       }
     }
   }
   return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
 }
+function extrasInSync(sourceDir, targetDir) {
+  for (const entry of fs6.readdirSync(sourceDir, { withFileTypes: true, recursive: true })) {
+    if (!entry.isFile()) continue;
+    const rel2 = path6.relative(sourceDir, path6.join(entry.parentPath, entry.name));
+    if (rel2 === "SKILL.md") continue;
+    const installed = path6.join(targetDir, rel2);
+    if (!fs6.existsSync(installed)) return false;
+    if (!fs6.readFileSync(installed).equals(fs6.readFileSync(path6.join(sourceDir, rel2)))) return false;
+  }
+  return true;
+}
 function copySkillExtras(sourceDir, targetDir) {
   for (const entry of fs6.readdirSync(sourceDir, { withFileTypes: true })) {
     if (entry.name === "SKILL.md") continue;
@@ -1809,25 +1850,36 @@ function seedAppSkill(root, appName, appRelPath) {
 }
 function planSync(root) {
   const items = [];
-  for (const skill of listBaseSkills()) {
-    const target = path6.join(root, ".claude", "skills", `mesh-${skill.name}`, "SKILL.md");
-    const desired = renderManagedSkill(skill.source);
-    const label = `.claude/skills/mesh-${skill.name}/SKILL.md (base skill)`;
+  const baseSkills = listBaseSkills();
+  for (const skill of baseSkills) {
+    const targetDir = path6.join(root, ".claude", "skills", skill.name);
+    const target = path6.join(targetDir, "SKILL.md");
+    const sourceDir = path6.dirname(skill.source);
+    const desired = renderManagedSkill(skill.source, skill.name);
+    const label = `.claude/skills/${skill.name}/SKILL.md (base skill)`;
     if (!fs6.existsSync(target)) {
       items.push({
         label,
         state: "write",
         apply: () => {
-          fs6.mkdirSync(path6.dirname(target), { recursive: true });
+          fs6.mkdirSync(targetDir, { recursive: true });
           fs6.writeFileSync(target, desired);
+          copySkillExtras(sourceDir, targetDir);
         }
       });
     } else {
       const current = fs6.readFileSync(target, "utf-8");
-      if (current === desired) {
+      if (current === desired && extrasInSync(sourceDir, targetDir)) {
         items.push({ label, state: "ok" });
       } else if (current.includes(MANAGED_MARKER)) {
-        items.push({ label, state: "write", apply: () => fs6.writeFileSync(target, desired) });
+        items.push({
+          label,
+          state: "write",
+          apply: () => {
+            fs6.writeFileSync(target, desired);
+            copySkillExtras(sourceDir, targetDir);
+          }
+        });
       } else {
         items.push({ label: `${label} \u2014 exists without the managed marker, leaving as-is`, state: "skip" });
       }
@@ -1837,7 +1889,7 @@ function planSync(root) {
   for (const skill of packageSkills) {
     const targetDir = path6.join(root, ".claude", "skills", skill.name);
     const target = path6.join(targetDir, "SKILL.md");
-    const desired = renderManagedSkill(skill.source);
+    const desired = renderManagedSkill(skill.source, skill.name);
     const label = `.claude/skills/${skill.name}/SKILL.md (platform skill)`;
     if (!fs6.existsSync(target)) {
       items.push({
@@ -1870,6 +1922,22 @@ function planSync(root) {
   if (packageSkills.length === 0 && meshTechScopeDirs(root).length === 0) {
     logInfo("No @mesh-tech packages installed yet \u2014 run `pnpm install`, then `mesh skills sync` again for the platform skills.");
   }
+  for (const skill of [...baseSkills, ...packageSkills]) {
+    if (skill.legacyName === skill.name) continue;
+    const legacyDir = path6.join(root, ".claude", "skills", skill.legacyName);
+    const legacyFile = path6.join(legacyDir, "SKILL.md");
+    if (!fs6.existsSync(legacyFile)) continue;
+    const label = `.claude/skills/${skill.legacyName}/ (renamed to ${skill.name})`;
+    if (fs6.readFileSync(legacyFile, "utf-8").includes(MANAGED_MARKER)) {
+      items.push({
+        label: `${label} \u2014 removing the old copy`,
+        state: "write",
+        apply: () => fs6.rmSync(legacyDir, { recursive: true, force: true })
+      });
+    } else {
+      items.push({ label: `${label} \u2014 exists without the managed marker, leaving as-is`, state: "skip" });
+    }
+  }
   const hookSource = cliAsset("assets", "intent", "intent-claude-gate.mjs");
   const hookTarget = path6.join(root, HOOK_RELATIVE);
   const hookDesired = fs6.readFileSync(hookSource, "utf-8");
@@ -2260,12 +2328,19 @@ var init_app_check_resolve = __esm({
 });
 
 // packages/mesh-cli/src/utils/first-party-contexts.ts
+function loginContextForPlatform(platform) {
+  if (!Object.hasOwn(FIRST_PARTY_PLATFORM_CONTEXTS, platform)) return platform;
+  return FIRST_PARTY_PLATFORM_CONTEXTS[platform] || platform;
+}
 function firstPartyDomainFor(context) {
   if (!Object.hasOwn(FIRST_PARTY_CONTEXTS, context)) return null;
   const domain = FIRST_PARTY_CONTEXTS[context];
   return typeof domain === "string" && domain ? domain : null;
 }
-var FIRST_PARTY_CONTEXTS;
+function isPlatformLoginAlias(context) {
+  return Object.values(FIRST_PARTY_PLATFORM_CONTEXTS).includes(context);
+}
+var FIRST_PARTY_CONTEXTS, FIRST_PARTY_PLATFORM_CONTEXTS;
 var init_first_party_contexts = __esm({
   "packages/mesh-cli/src/utils/first-party-contexts.ts"() {
     "use strict";
@@ -2276,7 +2351,15 @@ var init_first_party_contexts = __esm({
       // platform lives in a different AWS account with no registry; the
       // platform-dev stack in the registry-owning account is the developer front
       // door. mesh-sandbox#32 / #3587.)
-      "mesh.dev": "dev.platform.meshtech.io"
+      "mesh.dev": "dev.platform.meshtech.io",
+      // Verified 2026-09-25: https://cli.dev.mesh-platform.trabian.com/.well-known/mesh.json
+      // answers anonymously with the `mesh` tenant's dev platform issuer
+      // (identity.dev.mesh-platform.trabian.com) — the platform every `mesh`/dev
+      // tenant environment and its `*-apps-deployer` role live on.
+      "mesh-platform.dev": "dev.mesh-platform.trabian.com"
+    });
+    FIRST_PARTY_PLATFORM_CONTEXTS = Object.freeze({
+      "mesh.dev": "mesh-platform.dev"
     });
   }
 });
@@ -3909,6 +3992,7 @@ __export(login_exports, {
   clearContextConfig: () => clearContextConfig,
   clearCredentials: () => clearCredentials,
   decodeJwtPayload: () => decodeJwtPayload,
+  deployableTenants: () => deployableTenants,
   deviceLoginWithReissue: () => deviceLoginWithReissue,
   discoverConfigForContext: () => discoverConfigForContext,
   discoverConfigFromWellKnown: () => discoverConfigFromWellKnown,
@@ -4090,11 +4174,11 @@ function readAllCredentials() {
 function readCredentials(context) {
   return readAllCredentials()[context] ?? null;
 }
-function atomicWriteFileSync(path49, data, mode) {
-  const tmpPath = `${path49}.${process.pid}.${atomicWriteCounter++}.tmp`;
+function atomicWriteFileSync(path50, data, mode) {
+  const tmpPath = `${path50}.${process.pid}.${atomicWriteCounter++}.tmp`;
   try {
     fs11.writeFileSync(tmpPath, data, { mode });
-    fs11.renameSync(tmpPath, path49);
+    fs11.renameSync(tmpPath, path50);
   } catch (err) {
     try {
       fs11.unlinkSync(tmpPath);
@@ -4225,12 +4309,7 @@ function login(context, config) {
         const idPayload = decodeJwtPayload(tokens.id_token);
         const email = idPayload.email ?? idPayload.preferred_username ?? "unknown";
         const sub = idPayload.sub;
-        let tenants = [];
-        try {
-          const accessPayload = decodeJwtPayload(tokens.access_token);
-          tenants = accessPayload["urn:mesh:tenants"] ?? [];
-        } catch {
-        }
+        const tenants = deployableTenants(tokens.id_token, tokens.access_token);
         writeCredentials(context, {
           idToken: tokens.id_token,
           accessToken: tokens.access_token,
@@ -4346,12 +4425,7 @@ async function attemptDeviceCode(context, config) {
       const idPayload = decodeJwtPayload(tokens.id_token);
       const email = idPayload.email ?? idPayload.preferred_username ?? "unknown";
       const sub = idPayload.sub;
-      let tenants = [];
-      try {
-        const accessPayload = decodeJwtPayload(tokens.access_token);
-        tenants = accessPayload["urn:mesh:tenants"] ?? [];
-      } catch {
-      }
+      const tenants = deployableTenants(tokens.id_token, tokens.access_token);
       writeCredentials(context, {
         idToken: tokens.id_token,
         accessToken: tokens.access_token,
@@ -4524,12 +4598,10 @@ async function showStatus(context, config) {
     );
     return;
   }
-  let tenants = [];
+  const tenants = deployableTenants(creds.idToken, creds.accessToken);
   let audience = [];
   try {
-    const accessPayload = decodeJwtPayload(creds.accessToken);
-    tenants = accessPayload["urn:mesh:tenants"] ?? [];
-    audience = tokenAudience(accessPayload);
+    audience = tokenAudience(decodeJwtPayload(creds.accessToken));
   } catch {
   }
   logSuccess(`Logged in as ${creds.email ?? "unknown"} (${context})`);
@@ -4552,6 +4624,19 @@ async function showStatus(context, config) {
     );
   }
 }
+function deployableTenants(idToken, accessToken) {
+  for (const token of [idToken, accessToken]) {
+    if (!token) continue;
+    let claim;
+    try {
+      claim = decodeJwtPayload(token)[DEPLOY_TENANTS_CLAIM];
+    } catch {
+      continue;
+    }
+    if (Array.isArray(claim)) return claim.filter((t) => typeof t === "string");
+  }
+  return [];
+}
 function tokenAudience(payload) {
   const aud = payload.aud;
   if (typeof aud === "string") return [aud];
@@ -4828,7 +4913,7 @@ async function ensureLogin(context, opts = {}) {
 }
 async function discoverConfigGuarded(context, opts = {}) {
   let config = null;
-  if (parseTenantEnv(context)) {
+  if (parseTenantEnv(context) && !isPlatformLoginAlias(context)) {
     config = await discoverConfigFromSsm(context, opts);
   }
   if (!config) {
@@ -4974,7 +5059,7 @@ function readAllContextConfigs() {
 async function discoverConfigForContext(context) {
   return getContextConfig(context) ?? await discoverConfigGuarded(context);
 }
-var CONFIG_DIR, CONFIG_FILE, CREDENTIALS_FILE, REDIRECT_PORT, REDIRECT_URI, BASE_SCOPES, atomicWriteCounter, MAX_DEVICE_CODES, RESERVED_REGISTRY_CONTEXT, NO_REGISTRY_DEPRECATED, REGISTRY_SEPARATE_HINT;
+var CONFIG_DIR, CONFIG_FILE, CREDENTIALS_FILE, REDIRECT_PORT, REDIRECT_URI, BASE_SCOPES, atomicWriteCounter, MAX_DEVICE_CODES, DEPLOY_TENANTS_CLAIM, RESERVED_REGISTRY_CONTEXT, NO_REGISTRY_DEPRECATED, REGISTRY_SEPARATE_HINT;
 var init_login = __esm({
   "packages/mesh-cli/src/commands/login.ts"() {
     "use strict";
@@ -4994,6 +5079,7 @@ var init_login = __esm({
     BASE_SCOPES = "openid email profile offline_access urn:zitadel:iam:org:project:id:zitadel:aud";
     atomicWriteCounter = 0;
     MAX_DEVICE_CODES = 3;
+    DEPLOY_TENANTS_CLAIM = "urn:mesh:tenants";
     RESERVED_REGISTRY_CONTEXT = "registry";
     NO_REGISTRY_DEPRECATED = "--no-registry is deprecated and ignored: mesh login no longer touches the registry.";
     REGISTRY_SEPARATE_HINT = "Package registry access is separate from platform sign-in \u2014 run: mesh registry login";
@@ -5498,7 +5584,7 @@ import {
   GetCallerIdentityCommand,
   STSClient
 } from "@aws-sdk/client-sts";
-function derivePlatformContext(appRoot, stack) {
+function readStackPlatform(appRoot, stack) {
   const configFile = path13.join(appRoot, `Pulumi.${stack}.yaml`);
   if (!fs13.existsSync(configFile)) return null;
   const content = fs13.readFileSync(configFile, "utf-8");
@@ -5517,6 +5603,12 @@ function derivePlatformContext(appRoot, stack) {
   }
   return null;
 }
+function derivePlatformContext(appRoot, stack) {
+  const explicit = readStackConfig(appRoot, stack, "mesh:loginContext");
+  if (explicit) return explicit;
+  const platform = readStackPlatform(appRoot, stack);
+  return platform ? loginContextForPlatform(platform) : null;
+}
 function quoteCredProcessToken(token) {
   return /\s/.test(token) ? `"${token}"` : token;
 }
@@ -5818,6 +5910,8 @@ var init_aws_auth = __esm({
     init_log();
     init_auth_preflight();
     init_login();
+    init_first_party_contexts();
+    init_pulumi();
     DEFAULT_REGION = process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? "us-east-2";
     MANAGED_START_PREFIX = `# >>> mesh-cli managed profile `;
     MANAGED_START = (context) => `${MANAGED_START_PREFIX}${context} >>>`;
@@ -5868,7 +5962,9 @@ var init_vpn_join = __esm({
 });
 
 // packages/mesh-cli/src/utils/pulumi-run.ts
-function credProbeToPreflightError(probe, context) {
+function credProbeToPreflightError(probe, context, platform) {
+  const aliasNote = platform && platform !== context && loginContextForPlatform(platform) === context ? `
+  This stack deploys to platform ${platform}, which signs in as ${context} \u2014 a \`mesh login ${platform}\` session is a different platform and is not trusted here.` : "";
   switch (probe.state) {
     case "ok":
       return null;
@@ -5876,19 +5972,21 @@ function credProbeToPreflightError(probe, context) {
       return {
         fatal: true,
         message: `Not logged in for ${context}. Run:
-    mesh login ${context} --device`
+    mesh login ${context} --device` + aliasNote
       };
     case "expired-session":
       return {
         fatal: true,
         message: `Your mesh login session for ${context} expired. Run:
-    mesh login ${context} --device`
+    mesh login ${context} --device` + aliasNote
       };
     case "assume-denied":
       return {
         fatal: true,
         message: `Logged in, but couldn't assume the deployer role \u2014 ${probe.detail}
-  Check mesh:deployerRole in the stack config and your IAM access.`
+  If you signed in to another platform, sign in to this stack's:
+    mesh login ${context} --device
+  Otherwise check mesh:deployerRole in the stack config and your IAM access.` + aliasNote
       };
     case "stale-env-override":
       return {
@@ -5918,7 +6016,7 @@ async function resolvePulumiEnv(opts) {
   const context = derivePlatformContext(appRoot, stack);
   if (!hasAmbientCreds && context) {
     const probe = await probeCredentials(context, roleArn);
-    const preflight = credProbeToPreflightError(probe, context);
+    const preflight = credProbeToPreflightError(probe, context, readStackPlatform(appRoot, stack));
     if (preflight?.fatal) {
       logError(preflight.message);
       process.exit(1);
@@ -5942,6 +6040,7 @@ var init_pulumi_run = __esm({
     init_log();
     init_pulumi();
     init_aws_auth();
+    init_first_party_contexts();
     init_login();
   }
 });
@@ -10777,7 +10876,7 @@ function registerDevCommand(program2) {
       }
       const resolved = deployerRole ? await resolveAwsCredentials(deployerRole, appRoot, stack) : null;
       if (deployerRole && !resolved && !process.env.AWS_ACCESS_KEY_ID) {
-        const pf = ctx ? credProbeToPreflightError(await probeCredentials(ctx, deployerRole), ctx) : null;
+        const pf = ctx ? credProbeToPreflightError(await probeCredentials(ctx, deployerRole), ctx, readStackPlatform(appRoot, stack)) : null;
         logError(
           pf?.message ?? `Couldn't resolve AWS credentials to restart '${service}'. Run: mesh login ${ctx ?? "mesh.dev"} --device`
         );
@@ -12870,11 +12969,11 @@ function createVcsFolderReader(opts) {
     }
     return p;
   };
-  const readPath = async (repo, path49) => {
+  const readPath = async (repo, path50) => {
     const dir = await cloneRepo(repo);
-    const ref = await resolveFolderRef(dir, path49);
-    if (!ref) throw new Error(`path "${path49}" not found on any ref of ${repo}`);
-    const files = await readFolderAtRef(dir, ref, path49);
+    const ref = await resolveFolderRef(dir, path50);
+    if (!ref) throw new Error(`path "${path50}" not found on any ref of ${repo}`);
+    const files = await readFolderAtRef(dir, ref, path50);
     return { ref, files };
   };
   const cleanup = async () => {
@@ -13194,7 +13293,7 @@ Use --stack <name> (the deployed stack, e.g. dev).` : "No stack configs found in
   const ctx = derivePlatformContext(appRoot, stack);
   const resolved = deployerRole ? await resolveAwsCredentials(deployerRole, appRoot, stack) : null;
   if (deployerRole && !resolved && !process.env.AWS_ACCESS_KEY_ID) {
-    const pf = ctx ? credProbeToPreflightError(await probeCredentials(ctx, deployerRole), ctx) : null;
+    const pf = ctx ? credProbeToPreflightError(await probeCredentials(ctx, deployerRole), ctx, readStackPlatform(appRoot, stack)) : null;
     throw new Error(
       pf?.message ?? `Couldn't resolve AWS credentials. Run: mesh login ${ctx ?? "mesh.dev"} --device`
     );
@@ -15249,7 +15348,7 @@ var init_discover = __esm({
 
 // packages/mesh-cli/src/docs/assemble.ts
 import { execFileSync as execFileSync20 } from "node:child_process";
-import { mkdirSync as mkdirSync12, readFileSync as readFileSync25, rmSync as rmSync5, writeFileSync as writeFileSync15 } from "node:fs";
+import { mkdirSync as mkdirSync12, readFileSync as readFileSync25, rmSync as rmSync6, writeFileSync as writeFileSync15 } from "node:fs";
 import path30 from "node:path";
 import { parse as parseYaml5 } from "yaml";
 function splitFrontMatter(markdown) {
@@ -15531,7 +15630,7 @@ function assemblePortal(options) {
   const routes = new Set(pages.map((p) => p.route));
   const brokenLinks = [];
   const externalLinks = [];
-  rmSync5(outDir, { recursive: true, force: true });
+  rmSync6(outDir, { recursive: true, force: true });
   mkdirSync12(outDir, { recursive: true });
   for (const page of pages) {
     const raw = readFileSync25(path30.join(repoRoot2, page.source), "utf-8");
@@ -15869,8 +15968,8 @@ function formatDefault(value, paths = currentMachinePaths()) {
   if (typeof value === "boolean" || typeof value === "number") return String(value);
   return normalizeMachinePaths(JSON.stringify(value), paths);
 }
-function slugifyCommandPath(path49) {
-  return path49.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+function slugifyCommandPath(path50) {
+  return path50.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
 function extractOptions(command) {
   const options = command.options ?? [];
@@ -15904,17 +16003,17 @@ function isUndocumented(command) {
 function extractCommand(command, parentPath, depth) {
   const internals = command;
   const name = internals._name ?? "";
-  const path49 = parentPath ? `${parentPath} ${name}` : name;
+  const path50 = parentPath ? `${parentPath} ${name}` : name;
   return {
-    path: path49,
+    path: path50,
     name,
     aliases: [...internals._aliases ?? []],
     description: internals._description ?? "",
     args: extractArgs(command),
     options: extractOptions(command),
-    slug: slugifyCommandPath(path49),
+    slug: slugifyCommandPath(path50),
     depth,
-    subcommands: (internals.commands ?? []).filter((child) => !isUndocumented(child)).map((child) => extractCommand(child, path49, depth + 1))
+    subcommands: (internals.commands ?? []).filter((child) => !isUndocumented(child)).map((child) => extractCommand(child, path50, depth + 1))
   };
 }
 function extractCliReference(program2) {
@@ -16402,7 +16501,7 @@ var init_serve = __esm({
 
 // packages/mesh-cli/src/docs/registry-docs.ts
 import { execFileSync as execFileSync22 } from "node:child_process";
-import { existsSync as existsSync25, mkdirSync as mkdirSync14, readFileSync as readFileSync28, renameSync as renameSync3, rmSync as rmSync6, writeFileSync as writeFileSync17 } from "node:fs";
+import { existsSync as existsSync25, mkdirSync as mkdirSync14, readFileSync as readFileSync28, renameSync as renameSync3, rmSync as rmSync7, writeFileSync as writeFileSync17 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
 import path33 from "node:path";
 function readDocsRegistryAuth(npmrcPath2 = homeNpmrcPath()) {
@@ -16490,20 +16589,20 @@ async function fetchDocsArtifact(auth, version, cacheRoot = docsCacheRoot(), fet
   const tgzPath = path33.join(cacheRoot, `.${version}.tgz`);
   writeFileSync17(tgzPath, Buffer.from(await tgzResponse.arrayBuffer()));
   const staging = path33.join(cacheRoot, `.staging-${version}`);
-  rmSync6(staging, { recursive: true, force: true });
+  rmSync7(staging, { recursive: true, force: true });
   mkdirSync14(staging, { recursive: true });
   try {
     execFileSync22("tar", ["-xzf", tgzPath, "-C", staging, "--strip-components", "1"], {
       stdio: ["pipe", "pipe", "pipe"]
     });
   } finally {
-    rmSync6(tgzPath, { force: true });
+    rmSync7(tgzPath, { force: true });
   }
   if (!existsSync25(path33.join(staging, "dist", "index.html"))) {
-    rmSync6(staging, { recursive: true, force: true });
+    rmSync7(staging, { recursive: true, force: true });
     throw new Error(`${DOCS_PACKAGE}@${version} unpacked without a dist/index.html \u2014 the artifact is malformed`);
   }
-  rmSync6(targetDir, { recursive: true, force: true });
+  rmSync7(targetDir, { recursive: true, force: true });
   renameSync3(staging, targetDir);
   return targetDir;
 }
@@ -21455,24 +21554,290 @@ var init_site = __esm({
   }
 });
 
-// packages/mesh-cli/src/commands/stack.ts
-import { execFileSync as execFileSync31 } from "child_process";
-import * as path45 from "path";
+// packages/mesh-cli/src/commands/stack-status.ts
 import * as fs38 from "fs";
+import * as path45 from "path";
+import { execFileSync as execFileSync31 } from "child_process";
+function splitLayerStack(stack, tenant) {
+  if (tenant && stack.startsWith(`${tenant}-`)) return { tenant, env: stack.slice(tenant.length + 1) };
+  const cut = stack.indexOf("-");
+  if (cut <= 0) return { tenant: tenant ?? stack, env: stack };
+  return { tenant: tenant ?? stack.slice(0, cut), env: stack.slice(cut + 1) };
+}
+function targetForStack(projectDir, stack) {
+  const platform = readStackPlatform(projectDir, stack);
+  if (platform) {
+    const [tenant2, env2] = platform.split(".");
+    return { stack, kind: "app", tenant: tenant2, env: env2, coreTenant: tenant2, coreEnv: env2 };
+  }
+  const declared = readStackConfig(projectDir, stack, "mesh:tenant");
+  const layerDir = ["core", "platform"].includes(path45.basename(projectDir));
+  if (!declared && !layerDir) return null;
+  const { tenant, env } = splitLayerStack(stack, declared);
+  const isCore = path45.basename(projectDir) === "core";
+  return {
+    stack,
+    kind: "layer",
+    tenant,
+    env,
+    coreTenant: readStackConfig(projectDir, stack, "mesh:coreTenant") ?? tenant,
+    coreEnv: readStackConfig(projectDir, stack, "mesh:coreEnv") ?? env,
+    ...isCore ? { coreDir: projectDir } : { platformDir: projectDir }
+  };
+}
+function findStatusTargets(cwd, stack) {
+  const project = findAppRoot(cwd);
+  let projectDir = project;
+  let repoRoot2 = null;
+  if (!projectDir) {
+    const platformDir = path45.join(cwd, "platform");
+    if (fs38.existsSync(path45.join(platformDir, "Pulumi.yaml"))) {
+      projectDir = platformDir;
+      repoRoot2 = cwd;
+    }
+  } else if (["core", "platform"].includes(path45.basename(projectDir))) {
+    repoRoot2 = path45.dirname(projectDir);
+  }
+  if (!projectDir) return [];
+  const stacks = stack ? [stack] : findStackConfigs(projectDir);
+  const targets = [];
+  for (const name of stacks) {
+    const target = targetForStack(projectDir, name);
+    if (!target) continue;
+    if (repoRoot2 && target.kind === "layer") {
+      const core = path45.join(repoRoot2, "core");
+      const platform = path45.join(repoRoot2, "platform");
+      if (fs38.existsSync(path45.join(core, "package.json"))) target.coreDir = core;
+      if (fs38.existsSync(path45.join(platform, "package.json"))) target.platformDir = platform;
+    }
+    targets.push(target);
+  }
+  return targets;
+}
+function pinnedVersion(dir, pkg) {
+  if (!dir) return null;
+  try {
+    const manifest = JSON.parse(fs38.readFileSync(path45.join(dir, "package.json"), "utf-8"));
+    const spec = manifest.dependencies?.[pkg] ?? manifest.devDependencies?.[pkg];
+    return typeof spec === "string" ? spec.replace(/^[\^~=v]+/, "") : null;
+  } catch {
+    return null;
+  }
+}
+function compareVersions2(a, b) {
+  const parse4 = (v) => v.split(/[.+-]/).slice(0, 3).map((n) => Number.parseInt(n, 10) || 0);
+  const [x, y] = [parse4(a), parse4(b)];
+  for (let i = 0; i < 3; i++) {
+    const diff = (x[i] ?? 0) - (y[i] ?? 0);
+    if (diff) return diff;
+  }
+  return 0;
+}
+function layerState(deployed, latest) {
+  if (!deployed) return "not-deployed";
+  if (!latest) return "unknown";
+  return compareVersions2(deployed, latest) < 0 ? "behind" : "current";
+}
+function parseRegistration(raw) {
+  try {
+    const data = JSON.parse(raw);
+    const out = {};
+    if (typeof data.build?.infraVersion === "string") out.infraVersion = data.build.infraVersion;
+    if (typeof data.hub?.hubVersion === "string") out.hubVersion = data.hub.hubVersion;
+    return out;
+  } catch {
+    return {};
+  }
+}
+function buildRows(target, deployed, latest) {
+  const corePath = `/mesh-platform/${target.coreTenant}/${target.coreEnv}/core`;
+  const platformPath = `/mesh-platform/${target.tenant}/${target.env}/platform`;
+  const row = (layer, registration, source, field, pinned, latestVersion) => {
+    const value = source && !(source instanceof Error) ? source[field] ?? null : null;
+    const predatesExport = !!source && !(source instanceof Error) && value === null;
+    const note = source instanceof Error ? source.message : source === null ? "no registration \u2014 never deployed, or not readable with these credentials" : predatesExport ? "registration predates version export \u2014 last deployed with an infra-components older than any current release" : void 0;
+    return {
+      layer,
+      registration,
+      pinned,
+      deployed: value,
+      latest: latestVersion,
+      state: source instanceof Error ? "unknown" : predatesExport ? "behind" : layerState(value, latestVersion),
+      undeployedPin: !!pinned && !!value && pinned !== value,
+      ...note ? { note } : {}
+    };
+  };
+  return [
+    row("core", corePath, deployed.core, "infraVersion", pinnedVersion(target.coreDir, INFRA_PACKAGE), latest.infra),
+    row(
+      "platform",
+      platformPath,
+      deployed.platform,
+      "infraVersion",
+      pinnedVersion(target.platformDir, INFRA_PACKAGE),
+      latest.infra
+    ),
+    row("hub", platformPath, deployed.platform, "hubVersion", pinnedVersion(target.platformDir, HUB_PACKAGE2), latest.hub)
+  ];
+}
+function renderStatus(reports, cli) {
+  const lines = [];
+  const show = (v) => v ?? "\u2014";
+  for (const { target, rows } of reports) {
+    const what = target.kind === "app" ? `App stack ${target.stack} \u2192 platform ${target.tenant}/${target.env}` : `Platform ${target.tenant}/${target.env} (stack ${target.stack}) on core ${target.coreTenant}/${target.coreEnv}`;
+    lines.push(what);
+    lines.push(`  ${"layer".padEnd(9)} ${"pinned".padEnd(10)} ${"deployed".padEnd(10)} ${"latest".padEnd(10)} state`);
+    for (const r of rows) {
+      const flag = r.undeployedPin ? " (pin not deployed)" : "";
+      lines.push(
+        `  ${r.layer.padEnd(9)} ${show(r.pinned).padEnd(10)} ${show(r.deployed).padEnd(10)} ${show(r.latest).padEnd(10)} ${r.state}${flag}`
+      );
+      if (r.note) lines.push(`            ${r.registration}: ${r.note}`);
+    }
+    if (rows.some((r) => r.state === "behind" || r.undeployedPin)) {
+      lines.push(...upgradeSteps(target, rows));
+    }
+    lines.push("");
+  }
+  lines.push(
+    `CLI  ${CLI_PACKAGE} ${cli.running}` + (cli.latest ? ` (latest ${cli.latest})${cli.behind ? " \u2014 behind: pnpm add -D @mesh-tech/mesh-cli@latest" : ""}` : " (latest unknown)")
+  );
+  return lines.join("\n");
+}
+function upgradeSteps(target, rows) {
+  const latest = rows.find((r) => r.latest)?.latest;
+  if (target.kind === "app") {
+    return [
+      "  This platform is behind. Its operator upgrades it from the org's platform repo:",
+      "  run `mesh stack status` there, then upgrade core and platform together."
+    ];
+  }
+  const to = latest ? `@${latest}` : "@latest";
+  return [
+    "  To upgrade (both layers \u2014 deploying platform/ alone leaves core on the old version):",
+    `    1. core/ and platform/: set ${INFRA_PACKAGE}${to} (and ${HUB_PACKAGE2}${to} in platform/), then pnpm install`,
+    `    2. cd core && mesh deploy preview --stack ${target.coreTenant}-${target.coreEnv}   # review: this layer is the VPC/EKS/RDS`,
+    `    3. mesh deploy up --stack ${target.coreTenant}-${target.coreEnv} && cd ../platform && mesh deploy up --stack ${target.stack}`,
+    "    4. mesh stack status   # both layers now report the new version"
+  ];
+}
+function latestPublished(pkg, cwd) {
+  try {
+    const out = execFileSync31("npm", ["view", pkg, "version"], {
+      cwd,
+      encoding: "utf-8",
+      timeout: 2e4,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    return /^\d+\.\d+\.\d+$/.test(out) ? out : null;
+  } catch {
+    return null;
+  }
+}
+async function readRegistration(name, region, auth) {
+  const { credentials, profile, signInHint } = auth;
+  try {
+    const { SSMClient: SSMClient5, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
+    const client = new SSMClient5({
+      region,
+      ...profile && !credentials?.AWS_ACCESS_KEY_ID ? { profile } : {},
+      ...credentials?.AWS_ACCESS_KEY_ID ? {
+        credentials: {
+          accessKeyId: credentials.AWS_ACCESS_KEY_ID,
+          secretAccessKey: credentials.AWS_SECRET_ACCESS_KEY ?? "",
+          sessionToken: credentials.AWS_SESSION_TOKEN
+        }
+      } : {}
+    });
+    const resp = await client.send(new GetParameterCommand2({ Name: name }));
+    return resp.Parameter?.Value ? parseRegistration(resp.Parameter.Value) : null;
+  } catch (err) {
+    const e = err;
+    const kind = e.name || e.__type || e.message || String(err);
+    if (/ParameterNotFound/.test(kind)) return null;
+    if (/credential|ExpiredToken|AccessDenied|UnrecognizedClient|security token/i.test(`${kind} ${e.message ?? ""}`)) {
+      return new Error(`could not read \u2014 no AWS credentials for this account (${signInHint})`);
+    }
+    return new Error(`could not read \u2014 ${e.message ?? kind}`);
+  }
+}
+async function runStackStatus(cwd, opts) {
+  const targets = findStatusTargets(cwd, opts.stack);
+  if (targets.length === 0) {
+    logWarn(
+      "No Mesh stack found here. Run from an app directory (a Pulumi.<stack>.yaml naming mesh:platform),\n  or from your org's Mesh platform repo (its root, core/ or platform/)."
+    );
+    return true;
+  }
+  const infraLatest = latestPublished(INFRA_PACKAGE, cwd);
+  const hubLatest = latestPublished(HUB_PACKAGE2, cwd);
+  const running = resolveCliRuntime({ vcs: false }).version;
+  const cliLatest = latestPublished(CLI_PACKAGE, cwd);
+  const cli = { running, latest: cliLatest, behind: !!cliLatest && compareVersions2(running, cliLatest) < 0 };
+  if (!infraLatest) logInfo("Registry lookup failed \u2014 `latest` is unknown. Run `mesh registry login` and retry.");
+  const reports = [];
+  for (const target of targets) {
+    const projectDir = findAppRoot(cwd) ?? target.platformDir ?? cwd;
+    const region = opts.region ?? readStackConfig(projectDir, target.stack, "aws:region") ?? "us-east-2";
+    const ambient = !!process.env.AWS_ACCESS_KEY_ID || !!process.env.AWS_PROFILE;
+    let profile = opts.profile;
+    let credentials;
+    if (!profile && !ambient) {
+      profile = readStackConfig(projectDir, target.stack, "aws:profile") ?? void 0;
+      if (!profile && target.kind === "app") {
+        const role = readStackConfig(projectDir, target.stack, "mesh:deployerRole");
+        if (role) credentials = (await resolveAwsCredentials(role, projectDir, target.stack))?.env;
+      }
+    }
+    const loginContext = target.kind === "app" ? derivePlatformContext(projectDir, target.stack) : null;
+    const signInHint = loginContext ? `sign in with \`mesh login ${loginContext} --device\`, or pass --profile` : "set AWS_PROFILE or pass --profile with access to the core's account";
+    const auth = { credentials, profile, signInHint };
+    const [core, platform] = await Promise.all([
+      readRegistration(`/mesh-platform/${target.coreTenant}/${target.coreEnv}/core`, region, auth),
+      readRegistration(`/mesh-platform/${target.tenant}/${target.env}/platform`, region, auth)
+    ]);
+    reports.push({ target, rows: buildRows(target, { core, platform }, { infra: infraLatest, hub: hubLatest }) });
+  }
+  if (opts.json) {
+    process.stdout.write(JSON.stringify({ platforms: reports, cli }, null, 2) + "\n");
+  } else {
+    process.stdout.write(renderStatus(reports, cli) + "\n");
+  }
+  const behind = cli.behind || reports.some((r) => r.rows.some((row) => row.state === "behind" || row.undeployedPin));
+  return !behind;
+}
+var INFRA_PACKAGE, HUB_PACKAGE2, CLI_PACKAGE;
+var init_stack_status = __esm({
+  "packages/mesh-cli/src/commands/stack-status.ts"() {
+    "use strict";
+    init_log();
+    init_pulumi();
+    init_aws_auth();
+    init_build_info();
+    INFRA_PACKAGE = "@mesh-tech/infra-components";
+    HUB_PACKAGE2 = "@mesh-tech/hub";
+    CLI_PACKAGE = "@mesh-tech/mesh-cli";
+  }
+});
+
+// packages/mesh-cli/src/commands/stack.ts
+import { execFileSync as execFileSync32 } from "child_process";
+import * as path46 from "path";
+import * as fs39 from "fs";
 import { parse as parseYaml6 } from "yaml";
 function readTopLevelYamlKey(appRoot, stack, key) {
-  const configFile = path45.join(appRoot, `Pulumi.${stack}.yaml`);
-  if (!fs38.existsSync(configFile)) return null;
-  const content = fs38.readFileSync(configFile, "utf-8");
+  const configFile = path46.join(appRoot, `Pulumi.${stack}.yaml`);
+  if (!fs39.existsSync(configFile)) return null;
+  const content = fs39.readFileSync(configFile, "utf-8");
   const pattern = new RegExp(`^${key}:\\s*(.+)$`, "m");
   const match = content.match(pattern);
   if (!match) return null;
   return match[1].trim().replace(/^["']|["']$/g, "");
 }
 function readConfigBlockKey(appRoot, stack, key) {
-  const configFile = path45.join(appRoot, `Pulumi.${stack}.yaml`);
-  if (!fs38.existsSync(configFile)) return null;
-  const content = fs38.readFileSync(configFile, "utf-8");
+  const configFile = path46.join(appRoot, `Pulumi.${stack}.yaml`);
+  if (!fs39.existsSync(configFile)) return null;
+  const content = fs39.readFileSync(configFile, "utf-8");
   const pattern = new RegExp(`^\\s{2}${key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}:\\s*(.+)$`, "m");
   const match = content.match(pattern);
   if (!match) return null;
@@ -21532,11 +21897,11 @@ ${records}
   }
 }
 function readBaseConfigFromYaml(appRoot, stack) {
-  const file = path45.join(appRoot, `Pulumi.${stack}.yaml`);
-  if (!fs38.existsSync(file)) return {};
+  const file = path46.join(appRoot, `Pulumi.${stack}.yaml`);
+  if (!fs39.existsSync(file)) return {};
   let doc;
   try {
-    doc = parseYaml6(fs38.readFileSync(file, "utf-8"));
+    doc = parseYaml6(fs39.readFileSync(file, "utf-8"));
   } catch {
     return {};
   }
@@ -21549,7 +21914,7 @@ function readBaseConfigFromYaml(appRoot, stack) {
 }
 function getGitHubUsername() {
   try {
-    const result = execFileSync31("gh", ["api", "user", "--jq", ".login"], {
+    const result = execFileSync32("gh", ["api", "user", "--jq", ".login"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -21558,7 +21923,7 @@ function getGitHubUsername() {
   } catch {
   }
   try {
-    const result = execFileSync31("git", ["config", "user.email"], {
+    const result = execFileSync32("git", ["config", "user.email"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -21570,7 +21935,7 @@ function getGitHubUsername() {
   return null;
 }
 function registerStackCommand(program2) {
-  const stack = program2.command("stack").description("Manage personal Pulumi stacks");
+  const stack = program2.command("stack").description("Manage personal Pulumi stacks and check a Mesh instance against the latest release");
   stack.command("init").description("Create a personal dev stack (dev-{github-username})").option("--from <stack>", "Base stack to copy config from").option("--name <name>", "Override stack name (default: dev-{username})").option("--adopt", "resume an EXISTING stack with this name (skips the availability check)", false).option(
     "--worktree",
     "Isolate this stack per git worktree \u2014 append the worktree token to the name so concurrent worktrees deploy to distinct stacks (no SSM/namespace collisions)"
@@ -21613,7 +21978,7 @@ Specify which to base on: mesh stack init --from <stack>`
       }
     }
     const baseConfigPath = `${appRoot}/Pulumi.${baseStack}.yaml`;
-    if (!fs38.existsSync(baseConfigPath)) {
+    if (!fs39.existsSync(baseConfigPath)) {
       logError(`Stack config not found: Pulumi.${baseStack}.yaml`);
       process.exit(1);
     }
@@ -21635,8 +22000,8 @@ Specify which to base on: mesh stack init --from <stack>`
         );
       }
     }
-    const newConfigPath = path45.join(appRoot, `Pulumi.${newStack}.yaml`);
-    const configExists = fs38.existsSync(newConfigPath);
+    const newConfigPath = path46.join(appRoot, `Pulumi.${newStack}.yaml`);
+    const configExists = fs39.existsSync(newConfigPath);
     const secretsProvider = readTopLevelYamlKey(appRoot, baseStack, "secretsprovider");
     const credEnv = await resolvePulumiEnv({ appRoot, stack: baseStack });
     const pulumiEnv = { ...process.env, ...credEnv };
@@ -21644,7 +22009,7 @@ Specify which to base on: mesh stack init --from <stack>`
     if (!opts.adopt) {
       let existing = [];
       try {
-        const raw = execFileSync31("pulumi", ["stack", "ls", "--json"], {
+        const raw = execFileSync32("pulumi", ["stack", "ls", "--json"], {
           cwd: appRoot,
           encoding: "utf-8",
           env: pulumiEnv,
@@ -21668,7 +22033,7 @@ Specify which to base on: mesh stack init --from <stack>`
       logInfo(`Using KMS secrets provider: ${secretsProvider}`);
     }
     try {
-      execFileSync31("pulumi", initArgs, {
+      execFileSync32("pulumi", initArgs, {
         cwd: appRoot,
         env: pulumiEnv,
         stdio: "inherit"
@@ -21685,7 +22050,7 @@ Specify which to base on: mesh stack init --from <stack>`
       }
     }
     try {
-      execFileSync31("pulumi", ["stack", "select", newStack], {
+      execFileSync32("pulumi", ["stack", "select", newStack], {
         cwd: appRoot,
         env: pulumiEnv,
         stdio: ["pipe", "pipe", "pipe"]
@@ -21695,7 +22060,7 @@ Specify which to base on: mesh stack init --from <stack>`
     if (!configExists) {
       let baseConfig = {};
       try {
-        const raw = execFileSync31(
+        const raw = execFileSync32(
           "pulumi",
           ["config", "--json", "--stack", baseStack],
           { cwd: appRoot, env: pulumiEnv, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
@@ -21713,19 +22078,19 @@ Specify which to base on: mesh stack init --from <stack>`
         if (key === "mesh:deploy") continue;
         try {
           if (entry.objectValue !== void 0) {
-            execFileSync31(
+            execFileSync32(
               "pulumi",
               ["config", "set", key, JSON.stringify(entry.objectValue)],
               { cwd: appRoot, env: pulumiEnv, stdio: ["pipe", "pipe", "pipe"] }
             );
           } else if (entry.value === "true" || entry.value === "false") {
-            execFileSync31(
+            execFileSync32(
               "pulumi",
               ["config", "set", "--type", "bool", key, entry.value],
               { cwd: appRoot, env: pulumiEnv, stdio: ["pipe", "pipe", "pipe"] }
             );
           } else {
-            execFileSync31(
+            execFileSync32(
               "pulumi",
               ["config", "set", key, entry.value],
               { cwd: appRoot, env: pulumiEnv, stdio: ["pipe", "pipe", "pipe"] }
@@ -21738,7 +22103,7 @@ Specify which to base on: mesh stack init --from <stack>`
         const baseEnv = readConfigBlockKey(appRoot, baseStack, "mesh:coreEnv") ?? (baseTenant && baseStack.startsWith(`${baseTenant}-`) ? baseStack.slice(baseTenant.length + 1) : baseStack);
         const setCfg = (args) => {
           try {
-            execFileSync31("pulumi", ["config", "set", ...args], {
+            execFileSync32("pulumi", ["config", "set", ...args], {
               cwd: appRoot,
               env: pulumiEnv,
               stdio: ["pipe", "pipe", "pipe"]
@@ -21787,7 +22152,7 @@ Specify which to base on: mesh stack init --from <stack>`
           `Configured Pulumi.${newStack}.yaml (personal platform env on core '${baseEnv}'${opts.parentZone ? `, DNS zone ${newStack.startsWith(`${baseTenant}-`) ? newStack.slice(baseTenant.length + 1) : newStack}.${opts.parentZone}` : ""})`
         );
       } else {
-        execFileSync31("pulumi", ["config", "set", "--type", "bool", "mesh:deploy", "false"], {
+        execFileSync32("pulumi", ["config", "set", "--type", "bool", "mesh:deploy", "false"], {
           cwd: appRoot,
           env: pulumiEnv,
           stdio: ["pipe", "pipe", "pipe"]
@@ -21817,12 +22182,18 @@ Specify which to base on: mesh stack init --from <stack>`
     const args = ["stack", "rm", name];
     if (opts.yes) args.push("--yes");
     try {
-      execFileSync31("pulumi", args, { cwd: appRoot, env: pulumiEnv, stdio: "inherit" });
+      execFileSync32("pulumi", args, { cwd: appRoot, env: pulumiEnv, stdio: "inherit" });
       logSuccess(`Removed stack ${name}`);
     } catch (err) {
       process.exit(err.status ?? 1);
     }
   });
+  stack.command("status").description(
+    "Read-only drift check: for each platform this directory deploys (a platform repo's core/platform stacks) or deploys apps to (an app's mesh:platform), compare the pinned, deployed (the core and platform SSM registrations written by the last successful deploy) and latest published @mesh-tech/infra-components and @mesh-tech/hub, plus this CLI against the latest @mesh-tech/mesh-cli, and print the upgrade steps when anything is behind. Changes nothing."
+  ).option("--stack <name>", "check one stack (default: every Pulumi.<stack>.yaml here)").option("--profile <profile>", "AWS profile to read the SSM registrations with (default: AWS_PROFILE, else the stack's aws:profile, else an app stack's deployer role)").option("--region <region>", "AWS region of the registrations (default: the stack's aws:region, else us-east-2)").option("--json", "print the report as JSON", false).option("--check", "exit 1 when any layer or the CLI is behind, or a pin is not deployed", false).action(async (opts) => {
+    const ok = await runStackStatus(process.cwd(), opts);
+    if (opts.check && !ok) process.exit(1);
+  });
 }
 var init_stack2 = __esm({
   "packages/mesh-cli/src/commands/stack.ts"() {
@@ -21831,6 +22202,7 @@ var init_stack2 = __esm({
     init_pulumi();
     init_worktree_identity();
     init_pulumi_run();
+    init_stack_status();
   }
 });
 
@@ -22029,12 +22401,12 @@ var init_recover_conversation = __esm({
 });
 
 // packages/mesh-cli/src/utils/temporal-codec.ts
-import { execFileSync as execFileSync32 } from "child_process";
+import { execFileSync as execFileSync33 } from "child_process";
 import { webcrypto as crypto4 } from "node:crypto";
 function resolveTemporalEncodingKeyFromK8s(namespace) {
   const secretName = `${namespace}-temporal-encoding-key`;
   try {
-    const b64 = execFileSync32(
+    const b64 = execFileSync33(
       "kubectl",
       [
         "get",
@@ -22285,7 +22657,7 @@ var init_capture_history = __esm({
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { writeFileSync as writeFileSync24, mkdirSync as mkdirSync20 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { dirname as dirname29, join as join42, resolve as resolve19 } from "node:path";
+import { dirname as dirname30, join as join43, resolve as resolve19 } from "node:path";
 async function resolveConnection(options) {
   if (options.address && options.namespace) {
     return { address: options.address, namespace: options.namespace };
@@ -22713,8 +23085,8 @@ async function captureHistory(workflowId, runId, options) {
     }
     const { serializeHistoryToFixture: serializeHistoryToFixture2 } = await Promise.resolve().then(() => (init_capture_history(), capture_history_exports));
     const { fixture, eventCount, decryptedPayloads } = await serializeHistoryToFixture2(events, decrypter);
-    const outPath = options.out ?? join42(homedir6(), ".mesh", "replay-histories", `${sanitizeFileId(workflowId)}.json`);
-    mkdirSync20(dirname29(outPath), { recursive: true });
+    const outPath = options.out ?? join43(homedir6(), ".mesh", "replay-histories", `${sanitizeFileId(workflowId)}.json`);
+    mkdirSync20(dirname30(outPath), { recursive: true });
     if (options.out) warnIfNotGitIgnored(options.out);
     writeFileSync24(outPath, JSON.stringify(fixture, null, 2) + "\n");
     logSuccess(
@@ -22733,7 +23105,7 @@ function sanitizeFileId(id) {
 function warnIfNotGitIgnored(outPath) {
   const abs = resolve19(outPath);
   try {
-    const res = spawnSync4("git", ["-C", dirname29(abs), "check-ignore", "-q", abs], {
+    const res = spawnSync4("git", ["-C", dirname30(abs), "check-ignore", "-q", abs], {
       stdio: "ignore"
     });
     if (res.status !== 1) return;
@@ -22905,8 +23277,8 @@ var init_temporal = __esm({
 
 // packages/mesh-cli/src/commands/tenant.ts
 import chalk7 from "chalk";
-import * as fs39 from "fs";
-import * as path46 from "path";
+import * as fs40 from "fs";
+import * as path47 from "path";
 import { parseDocument, YAMLMap, isMap } from "yaml";
 function validateTenantName(name) {
   return /^[a-z][a-z0-9-]*$/.test(name) && !name.endsWith("-");
@@ -22974,16 +23346,16 @@ function resolveStackConfig(explicitStack) {
       { remediation: { command: "mesh tenant add <name> --stack <stack>" } }
     );
   }
-  const file = path46.join(appRoot, `Pulumi.${stack}.yaml`);
-  if (!fs39.existsSync(file)) {
+  const file = path47.join(appRoot, `Pulumi.${stack}.yaml`);
+  if (!fs40.existsSync(file)) {
     throw new MeshCliError(`Stack config not found: ${file}`, {
       remediation: { command: "mesh tenant add <name> --stack <stack>" }
     });
   }
-  return { appRoot, stack, file, content: fs39.readFileSync(file, "utf-8") };
+  return { appRoot, stack, file, content: fs40.readFileSync(file, "utf-8") };
 }
 function readProjectName(appRoot) {
-  const projectDoc = parseDocument(fs39.readFileSync(path46.join(appRoot, "Pulumi.yaml"), "utf-8"));
+  const projectDoc = parseDocument(fs40.readFileSync(path47.join(appRoot, "Pulumi.yaml"), "utf-8"));
   return String(projectDoc.get("name") ?? "");
 }
 function looksLikePlatformLayer(projectName) {
@@ -23026,12 +23398,12 @@ function registerTenantCommands(program2) {
       if (!result.ok) {
         if (result.reason === "exists") {
           throw new MeshCliError(
-            `${result.detail} (${path46.basename(resolved.file)}). Edit the existing entry instead of re-adding it.`
+            `${result.detail} (${path47.basename(resolved.file)}). Edit the existing entry instead of re-adding it.`
           );
         }
         throw new MeshCliError(`${resolved.file}: ${result.detail}`);
       }
-      atomicWriteFileSync(resolved.file, result.yaml, fs39.statSync(resolved.file).mode & 511);
+      atomicWriteFileSync(resolved.file, result.yaml, fs40.statSync(resolved.file).mode & 511);
       if (opts.json) {
         emitJsonPayload({
           ok: true,
@@ -23044,7 +23416,7 @@ function registerTenantCommands(program2) {
         return;
       }
       logInfo(
-        `Tenant '${name}' registered in ${path46.basename(resolved.file)} (mesh:tenants, subdomain '${subdomain}')${result.createdTenantsBlock ? " \u2014 created the mesh:tenants block" : ""}`
+        `Tenant '${name}' registered in ${path47.basename(resolved.file)} (mesh:tenants, subdomain '${subdomain}')${result.createdTenantsBlock ? " \u2014 created the mesh:tenants block" : ""}`
       );
       console.log("");
       console.log("Next steps:");
@@ -23070,7 +23442,7 @@ function registerTenantCommands(program2) {
           `Project '${projectName}' does not look like a platform layer \u2014 tenants are declared on the tenant platform repo's PLATFORM stack (e.g. mesh-sandbox/platform).`
         );
       }
-      logInfo(`No tenants declared in ${path46.basename(resolved.file)}.`);
+      logInfo(`No tenants declared in ${path47.basename(resolved.file)}.`);
       return;
     }
     logInfo(`Tenants on stack '${resolved.stack}':`);
@@ -23092,9 +23464,9 @@ var init_tenant = __esm({
 
 // packages/mesh-cli/src/commands/tunnel/index.ts
 import { spawn as spawn9 } from "child_process";
-import * as fs40 from "fs";
+import * as fs41 from "fs";
 import * as os12 from "os";
-import * as path47 from "path";
+import * as path48 from "path";
 import {
   SecretsManagerClient as SecretsManagerClient9,
   GetSecretValueCommand as GetSecretValueCommand9
@@ -23114,9 +23486,9 @@ function readPulumiAwsRegion(stage) {
   const preferred = stage ? `Pulumi.${stage}.yaml` : void 0;
   const rank = (f) => f === preferred ? 0 : f === "Pulumi.yaml" ? 2 : 1;
   try {
-    const files = fs40.readdirSync(".").filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml")).sort((a, b) => rank(a) - rank(b));
+    const files = fs41.readdirSync(".").filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml")).sort((a, b) => rank(a) - rank(b));
     for (const f of files) {
-      const m = fs40.readFileSync(f, "utf-8").match(/^\s*aws:region:\s*["']?([^"'\n]+)["']?/m);
+      const m = fs41.readFileSync(f, "utf-8").match(/^\s*aws:region:\s*["']?([^"'\n]+)["']?/m);
       if (m?.[1]) return m[1].trim();
     }
   } catch {
@@ -23125,14 +23497,14 @@ function readPulumiAwsRegion(stage) {
 }
 function awsProfileSections(name) {
   return [
-    [path47.join(os12.homedir(), ".aws", "config"), `[profile ${name}]`],
-    [path47.join(os12.homedir(), ".aws", "credentials"), `[${name}]`]
+    [path48.join(os12.homedir(), ".aws", "config"), `[profile ${name}]`],
+    [path48.join(os12.homedir(), ".aws", "credentials"), `[${name}]`]
   ];
 }
 function awsProfileExists(name) {
   for (const [file, header] of awsProfileSections(name)) {
     try {
-      const lines = fs40.readFileSync(file, "utf-8").split("\n");
+      const lines = fs41.readFileSync(file, "utf-8").split("\n");
       if (lines.some((l) => l.trim() === header)) return true;
     } catch {
     }
@@ -23158,7 +23530,7 @@ function awsProfileRegion(profile) {
   if (!profile) return void 0;
   for (const [file, header] of awsProfileSections(profile)) {
     try {
-      const region = parseProfileRegion(fs40.readFileSync(file, "utf-8"), header);
+      const region = parseProfileRegion(fs41.readFileSync(file, "utf-8"), header);
       if (region) return region;
     } catch {
     }
@@ -23167,14 +23539,14 @@ function awsProfileRegion(profile) {
 }
 function awsDefaultProfileSections() {
   return [
-    [path47.join(os12.homedir(), ".aws", "config"), "[default]"],
-    [path47.join(os12.homedir(), ".aws", "credentials"), "[default]"]
+    [path48.join(os12.homedir(), ".aws", "config"), "[default]"],
+    [path48.join(os12.homedir(), ".aws", "credentials"), "[default]"]
   ];
 }
 function awsDefaultProfileRegion() {
   for (const [file, header] of awsDefaultProfileSections()) {
     try {
-      const region = parseProfileRegion(fs40.readFileSync(file, "utf-8"), header);
+      const region = parseProfileRegion(fs41.readFileSync(file, "utf-8"), header);
       if (region) return region;
     } catch {
     }
@@ -23561,8 +23933,8 @@ async function resolveToken(opts) {
     "no token: pass --token, set VCS_TOKEN, or pass --context <platform-context> (after mesh login)"
   );
 }
-async function vcsApi(baseUrl, token, path49, method = "GET", body) {
-  const res = await fetch(`${baseUrl}${path49}`, {
+async function vcsApi(baseUrl, token, path50, method = "GET", body) {
+  const res = await fetch(`${baseUrl}${path50}`, {
     method,
     headers: {
       authorization: `Bearer ${token}`,
@@ -23573,7 +23945,7 @@ async function vcsApi(baseUrl, token, path49, method = "GET", body) {
   const data = await res.json().catch(() => ({}));
   if (!res.ok) {
     throw new Error(
-      `${method} ${path49} failed (${res.status}): ${String(data.error ?? "unknown error")}`
+      `${method} ${path50} failed (${res.status}): ${String(data.error ?? "unknown error")}`
     );
   }
   return data;
@@ -23619,8 +23991,8 @@ var init_clone = __esm({
 
 // packages/mesh-cli/src/commands/vcs/get.ts
 import { writeFile as writeFile2, mkdir as mkdir2 } from "node:fs/promises";
-import { join as join45, dirname as dirname30 } from "node:path";
-async function getCommand(repo, path49, opts) {
+import { join as join46, dirname as dirname31 } from "node:path";
+async function getCommand(repo, path50, opts) {
   let vcsBaseUrl;
   let token;
   if (opts.target) {
@@ -23635,18 +24007,18 @@ async function getCommand(repo, path49, opts) {
   if (!token) throw new Error("no token: pass --target (after mesh login), or --token / --context");
   const reader = createVcsFolderReader({ vcsBaseUrl, token });
   try {
-    const { ref, files } = await reader.readPath(repo, path49);
+    const { ref, files } = await reader.readPath(repo, path50);
     if (files.length === 0) {
-      logInfo(`no files at ${repo}:${path49}`);
+      logInfo(`no files at ${repo}:${path50}`);
       return;
     }
     if (opts.output) {
       for (const f of files) {
-        const abs = join45(opts.output, f.path);
-        await mkdir2(dirname30(abs), { recursive: true });
+        const abs = join46(opts.output, f.path);
+        await mkdir2(dirname31(abs), { recursive: true });
         await writeFile2(abs, f.contents);
       }
-      logInfo(`wrote ${files.length} file(s) from ${repo}:${path49} (${ref}) \u2192 ${opts.output}`);
+      logInfo(`wrote ${files.length} file(s) from ${repo}:${path50} (${ref}) \u2192 ${opts.output}`);
     } else {
       for (const f of files) {
         if (files.length > 1) process.stdout.write(`
@@ -23671,10 +24043,10 @@ var init_get = __esm({
 });
 
 // packages/mesh-cli/src/commands/vcs/drafts.ts
-async function call(opts, repo, path49, method = "GET", body) {
+async function call(opts, repo, path50, method = "GET", body) {
   const target = await resolveTarget2({ ...opts, repo });
   const token = await resolveToken(opts);
-  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path49}`, method, body);
+  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path50}`, method, body);
 }
 async function draftsListCommand(repo, opts) {
   const data = await call(opts, repo, `/drafts${opts.all ? "?all=true" : ""}`);
@@ -23729,7 +24101,7 @@ var init_drafts = __esm({
 
 // packages/mesh-cli/src/commands/vcs/propose.ts
 import { readFile as readFile3 } from "node:fs/promises";
-import { join as join46 } from "node:path";
+import { join as join47 } from "node:path";
 function parseStatus(out) {
   const tokens = out.split("\0");
   const changes = [];
@@ -23762,13 +24134,13 @@ function parseStatus(out) {
   }
   return changes;
 }
-async function writeOp(cwd, path49) {
-  const buf = await readFile3(join46(cwd, path49));
+async function writeOp(cwd, path50) {
+  const buf = await readFile3(join47(cwd, path50));
   const asUtf8 = buf.toString("utf8");
   if (Buffer.from(asUtf8, "utf8").equals(buf)) {
-    return { op: "write", path: path49, content: asUtf8 };
+    return { op: "write", path: path50, content: asUtf8 };
   }
-  return { op: "write", path: path49, content: buf.toString("base64"), encoding: "base64" };
+  return { op: "write", path: path50, content: buf.toString("base64"), encoding: "base64" };
 }
 async function proposeCommand(opts) {
   const cwd = process.cwd();
@@ -23812,8 +24184,8 @@ async function proposeCommand(opts) {
     operations,
     ...opts.mergeParent ? { mergeParent: opts.mergeParent } : {}
   };
-  const path49 = opts.revise ? `/v1/repos/${target.repo}/proposals/${opts.revise}/revisions` : `/v1/repos/${target.repo}/proposals`;
-  const data = await vcsApi(target.baseUrl, token, path49, "POST", body);
+  const path50 = opts.revise ? `/v1/repos/${target.repo}/proposals/${opts.revise}/revisions` : `/v1/repos/${target.repo}/proposals`;
+  const data = await vcsApi(target.baseUrl, token, path50, "POST", body);
   console.log(
     `proposal ${data.proposalId} @ ${data.sha.slice(0, 8)} \u2014 review: mesh vcs show ${target.repo} ${data.proposalId} --url ${target.baseUrl}`
   );
@@ -23828,28 +24200,28 @@ var init_propose = __esm({
 // packages/mesh-cli/src/commands/vcs/rm.ts
 import { mkdtemp as mkdtemp2, rm as rmrf } from "node:fs/promises";
 import { tmpdir as tmpdir10 } from "node:os";
-import { join as join47 } from "node:path";
+import { join as join48 } from "node:path";
 function normalize2(p) {
   return p.trim().replace(/^\.\//, "").replace(/\/+$/, "");
 }
 function expandPathsToDeletions(repoFiles, requested) {
   const out = /* @__PURE__ */ new Set();
   for (const raw of requested) {
-    const path49 = normalize2(raw);
-    if (path49.startsWith("/") || path49.split("/").includes("..")) {
+    const path50 = normalize2(raw);
+    if (path50.startsWith("/") || path50.split("/").includes("..")) {
       throw new Error(
         `"${raw}" is not a repo-relative path \u2014 vcs paths never start with "/" or traverse with "..".`
       );
     }
-    const exact = repoFiles.filter((f) => f === path49);
+    const exact = repoFiles.filter((f) => f === path50);
     if (exact.length > 0) {
       for (const f of exact) out.add(f);
       continue;
     }
-    const under = repoFiles.filter((f) => f.startsWith(`${path49}/`));
+    const under = repoFiles.filter((f) => f.startsWith(`${path50}/`));
     if (under.length === 0) {
       throw new Error(
-        `"${raw}" matched no files in the repo \u2014 nothing was proposed. Check the path with: mesh vcs get <repo> ${path49}`
+        `"${raw}" matched no files in the repo \u2014 nothing was proposed. Check the path with: mesh vcs get <repo> ${path50}`
       );
     }
     for (const f of under) out.add(f);
@@ -23860,7 +24232,7 @@ async function rmCommand(repo, paths, opts) {
   const baseUrl = (opts.url ?? process.env.VCS_URL)?.replace(/\/$/, "");
   if (!baseUrl) throw new Error("rm requires --url or VCS_URL");
   const token = await resolveToken(opts);
-  const dir = await mkdtemp2(join47(tmpdir10(), "mesh-vcs-rm-"));
+  const dir = await mkdtemp2(join48(tmpdir10(), "mesh-vcs-rm-"));
   try {
     const git = (args, cwd) => gitWithAuth(args, token, cwd);
     await git([
@@ -23885,7 +24257,7 @@ async function rmCommand(repo, paths, opts) {
     const body = {
       baseCommit: head.trim(),
       message: opts.message ?? `Delete ${doomed.length} file(s)`,
-      operations: doomed.map((path49) => ({ op: "delete", path: path49 }))
+      operations: doomed.map((path50) => ({ op: "delete", path: path50 }))
     };
     const data = await vcsApi(
       baseUrl,
@@ -23911,10 +24283,10 @@ var init_rm = __esm({
 });
 
 // packages/mesh-cli/src/commands/vcs/review.ts
-async function call2(opts, repo, path49, method = "GET", body) {
+async function call2(opts, repo, path50, method = "GET", body) {
   const target = await resolveTarget2({ ...opts, repo });
   const token = await resolveToken(opts);
-  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path49}`, method, body);
+  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path50}`, method, body);
 }
 async function proposalsCommand(repo, opts) {
   console.log(JSON.stringify(await call2(opts, repo, "/proposals"), null, 2));
@@ -24061,8 +24433,8 @@ function computeHappyPath(nodes, edges) {
     ];
     const visited = /* @__PURE__ */ new Set([startNode.id]);
     while (queue.length > 0) {
-      const { id, path: path49 } = queue.shift();
-      if (targetIds.has(id)) return path49;
+      const { id, path: path50 } = queue.shift();
+      if (targetIds.has(id)) return path50;
       const neighbors = adjacency.get(id) ?? [];
       const hasMainEdge = neighbors.some((e) => e.isMainPath);
       const candidates = hasMainEdge ? neighbors.filter((e) => e.isMainPath) : neighbors;
@@ -24082,7 +24454,7 @@ function computeHappyPath(nodes, edges) {
         if (!allowExceptional && (neighbor.isExceptional || neighbor.isTimeout || failureEndIds.has(neighbor.to)))
           continue;
         visited.add(neighbor.to);
-        queue.push({ id: neighbor.to, path: [...path49, neighbor.to] });
+        queue.push({ id: neighbor.to, path: [...path50, neighbor.to] });
       }
     }
     return null;
@@ -24367,11 +24739,11 @@ function wrapIntoGroup(workflow, nodeIds, groupId, label, groupType) {
         }
       }
       if (found) {
-        const path49 = [];
-        for (let c = found; c !== void 0; c = prev.get(c)) path49.unshift(c);
-        for (let i = 0; i < path49.length - 1; i++) mainEdgeKeys.add(edgeKey(path49[i], path49[i + 1]));
+        const path50 = [];
+        for (let c = found; c !== void 0; c = prev.get(c)) path50.unshift(c);
+        for (let i = 0; i < path50.length - 1; i++) mainEdgeKeys.add(edgeKey(path50[i], path50[i + 1]));
         mainEdgeKeys.add(edgeKey(found, successExit.id));
-        mainBody = path49;
+        mainBody = path50;
         mainTail = [successExit.id];
       }
     }
@@ -24907,11 +25279,11 @@ function buildProcessManifest(artifact, outcomeNodeIds) {
     ...pointOfNoReturnStage ? { pointOfNoReturnStageId: pointOfNoReturnStage.id } : {}
   };
 }
-function formatPath(path49) {
-  return path49.length > 0 ? z4.core.toDotPath(path49) : "(root)";
+function formatPath(path50) {
+  return path50.length > 0 ? z4.core.toDotPath(path50) : "(root)";
 }
 function issueToDiagnostic(issue) {
-  const path49 = formatPath(issue.path);
+  const path50 = formatPath(issue.path);
   let code = "SCHEMA_INVALID";
   if (issue.code === "custom") {
     const paramCode = issue.params?.code;
@@ -24922,8 +25294,8 @@ function issueToDiagnostic(issue) {
   return {
     severity: "error",
     code,
-    message: `${path49}: ${issue.message}`,
-    path: path49
+    message: `${path50}: ${issue.message}`,
+    path: path50
   };
 }
 function upgradeV1(artifact) {
@@ -25090,24 +25462,24 @@ var init_process_artifact = __esm({
         });
       }
       const declaredSelectors = new Set(Object.keys(process2.selectors ?? {}));
-      const checkActor = (actorId, path49) => {
+      const checkActor = (actorId, path50) => {
         if (actorId === void 0) return;
         if (!Object.prototype.hasOwnProperty.call(process2.actors, actorId)) {
           ctx.addIssue({
             code: "custom",
-            path: path49,
-            message: `Actor "${actorId}" is referenced at ${z4.core.toDotPath(path49)} but not declared in process.actors. Declare the actor (label, and optionally category/selector) or fix the reference.`,
+            path: path50,
+            message: `Actor "${actorId}" is referenced at ${z4.core.toDotPath(path50)} but not declared in process.actors. Declare the actor (label, and optionally category/selector) or fix the reference.`,
             params: { code: "UNDECLARED_ACTOR" }
           });
         }
       };
-      const checkSelector = (selector, path49) => {
+      const checkSelector = (selector, path50) => {
         if (selector === void 0) return;
         if (!declaredSelectors.has(selector)) {
           ctx.addIssue({
             code: "custom",
-            path: path49,
-            message: `Selector "${selector}" is referenced at ${z4.core.toDotPath(path49)} but not declared in process.selectors. Declare the selector or fix the reference.`,
+            path: path50,
+            message: `Selector "${selector}" is referenced at ${z4.core.toDotPath(path50)} but not declared in process.selectors. Declare the selector or fix the reference.`,
             params: { code: "UNDECLARED_SELECTOR" }
           });
         }
@@ -25121,20 +25493,20 @@ var init_process_artifact = __esm({
         outcome: "DUPLICATE_OUTCOME_ID"
       };
       const idFirstSeenAt = /* @__PURE__ */ new Map();
-      const checkId = (id, kind, path49) => {
+      const checkId = (id, kind, path50) => {
         const first = idFirstSeenAt.get(id);
         if (first) {
           const kindLabel = kind === first.kind ? kind : "process";
           ctx.addIssue({
             code: "custom",
-            path: path49,
-            message: `Duplicate ${kindLabel} id "${id}": ${kind} at ${z4.core.toDotPath(path49)} collides with ${first.kind} at ${z4.core.toDotPath(first.path)}.`,
+            path: path50,
+            message: `Duplicate ${kindLabel} id "${id}": ${kind} at ${z4.core.toDotPath(path50)} collides with ${first.kind} at ${z4.core.toDotPath(first.path)}.`,
             params: {
               code: kind === first.kind ? SAME_KIND_CODE[kind] : "DUPLICATE_PROCESS_ID"
             }
           });
         } else {
-          idFirstSeenAt.set(id, { kind, path: path49 });
+          idFirstSeenAt.set(id, { kind, path: path50 });
         }
       };
       process2.stages.forEach((stage, stageIndex) => {
@@ -25181,13 +25553,13 @@ function lintProcess(artifact, inventory, predicateNames, options = {}) {
   const internalCommands = process2.internalCommands ?? [];
   const internalSet = new Set(internalCommands);
   const boundCommandPaths = /* @__PURE__ */ new Map();
-  const checkPredicate = (predicate, path49) => {
+  const checkPredicate = (predicate, path50) => {
     if (!predicateSet.has(predicate)) {
       diagnostics.push({
         severity: "error",
         code: "UNKNOWN_PREDICATE",
-        message: `Predicate "${predicate}" referenced at ${path49} is not in the predicate registry.`,
-        path: path49
+        message: `Predicate "${predicate}" referenced at ${path50} is not in the predicate registry.`,
+        path: path50
       });
     }
   };
@@ -25247,19 +25619,19 @@ function lintProcess(artifact, inventory, predicateNames, options = {}) {
   process2.outcomes.forEach((outcome, outcomeIndex) => {
     const whenPath = `process.outcomes[${outcomeIndex}].when`;
     outcomeTriggers(outcome).forEach((trigger, triggerIndex) => {
-      const path49 = Array.isArray(outcome.when) ? `${whenPath}[${triggerIndex}]` : whenPath;
+      const path50 = Array.isArray(outcome.when) ? `${whenPath}[${triggerIndex}]` : whenPath;
       if (trigger.kind === "predicate") {
-        checkPredicate(trigger.name, `${path49}.predicate`);
+        checkPredicate(trigger.name, `${path50}.predicate`);
       } else if (trigger.kind === "command") {
         if (!boundCommandPaths.has(trigger.name)) {
-          boundCommandPaths.set(trigger.name, `${path49}.command`);
+          boundCommandPaths.set(trigger.name, `${path50}.command`);
         }
         if (!commandNames.has(trigger.name)) {
           diagnostics.push({
             severity: "error",
             code: "BOUND_COMMAND_NOT_IN_INVENTORY",
-            message: `Command "${trigger.name}" triggering outcome "${outcome.id}" (${path49}.command) does not exist in the inventory.`,
-            path: `${path49}.command`
+            message: `Command "${trigger.name}" triggering outcome "${outcome.id}" (${path50}.command) does not exist in the inventory.`,
+            path: `${path50}.command`
           });
         }
       }
@@ -25371,10 +25743,10 @@ var init_src4 = __esm({
 });
 
 // packages/mesh-cli/src/commands/workflow.ts
-import * as fs41 from "fs";
-import * as path48 from "path";
+import * as fs42 from "fs";
+import * as path49 from "path";
 import { createRequire as createRequire2 } from "module";
-import { execFileSync as execFileSync33 } from "child_process";
+import { execFileSync as execFileSync34 } from "child_process";
 function resolveExtractorPath() {
   try {
     const require2 = createRequire2(import.meta.url);
@@ -25388,7 +25760,7 @@ function runExtraction(targetPath, extractorPath, explicitProcessPath) {
   let explicitProcessArtifact;
   if (explicitProcessPath) {
     try {
-      explicitProcessArtifact = JSON.parse(fs41.readFileSync(explicitProcessPath, "utf-8"));
+      explicitProcessArtifact = JSON.parse(fs42.readFileSync(explicitProcessPath, "utf-8"));
     } catch (err) {
       logError(
         `Could not read/parse --process ${explicitProcessPath}: ${err instanceof Error ? err.message : String(err)}`
@@ -25429,7 +25801,7 @@ for (const file of files) {
 process.stdout.write(JSON.stringify(results));
 `;
   try {
-    const result = execFileSync33("npx", ["tsx", "--eval", script], {
+    const result = execFileSync34("npx", ["tsx", "--eval", script], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "inherit"],
       maxBuffer: 10 * 1024 * 1024
@@ -25471,7 +25843,7 @@ for (const file of files) {
 process.stdout.write(JSON.stringify(results));
 `;
   try {
-    const result = execFileSync33("npx", ["tsx", "--eval", script], {
+    const result = execFileSync34("npx", ["tsx", "--eval", script], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "inherit"],
       maxBuffer: 10 * 1024 * 1024
@@ -25488,7 +25860,7 @@ function runLintExtraction(targetPath, extractorPath, explicitProcessPath) {
   let explicitProcessArtifact;
   if (explicitProcessPath) {
     try {
-      explicitProcessArtifact = JSON.parse(fs41.readFileSync(explicitProcessPath, "utf-8"));
+      explicitProcessArtifact = JSON.parse(fs42.readFileSync(explicitProcessPath, "utf-8"));
     } catch (err) {
       logError(
         `Could not read/parse --process ${explicitProcessPath}: ${err instanceof Error ? err.message : String(err)}`
@@ -25526,7 +25898,7 @@ for (const file of files) {
 process.stdout.write(JSON.stringify(results));
 `;
   try {
-    const result = execFileSync33("npx", ["tsx", "--eval", script], {
+    const result = execFileSync34("npx", ["tsx", "--eval", script], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "inherit"],
       maxBuffer: 10 * 1024 * 1024
@@ -25596,16 +25968,16 @@ function registerWorkflowCommands(program2) {
   ).action(
     async (targetPath, opts) => {
       try {
-        const resolvedPath = path48.resolve(targetPath);
-        if (!fs41.existsSync(resolvedPath)) {
+        const resolvedPath = path49.resolve(targetPath);
+        if (!fs42.existsSync(resolvedPath)) {
           logError(`Path does not exist: ${resolvedPath}`);
           process.exitCode = 1;
           return;
         }
         let resolvedProcessPath;
         if (opts.process) {
-          resolvedProcessPath = path48.resolve(opts.process);
-          if (!fs41.existsSync(resolvedProcessPath)) {
+          resolvedProcessPath = path49.resolve(opts.process);
+          if (!fs42.existsSync(resolvedProcessPath)) {
             logError(`--process path does not exist: ${resolvedProcessPath}`);
             process.exitCode = 1;
             return;
@@ -25654,8 +26026,8 @@ function registerWorkflowCommands(program2) {
     "Extract the as-built command/query/activity inventory from Temporal workflow source\n\nThe inventory ({ workflowType, commands, queries, activities }) is the process-\nconformance lint's code-side input \u2014 it is never hand-edited. Supports single\nfiles or directories."
   ).action(async (targetPath) => {
     try {
-      const resolvedPath = path48.resolve(targetPath);
-      if (!fs41.existsSync(resolvedPath)) {
+      const resolvedPath = path49.resolve(targetPath);
+      if (!fs42.existsSync(resolvedPath)) {
         logError(`Path does not exist: ${resolvedPath}`);
         process.exitCode = 1;
         return;
@@ -25701,16 +26073,16 @@ function registerWorkflowCommands(program2) {
     "Comma-separated named-selector registry (enables UNKNOWN_SELECTOR checks)"
   ).action(async (targetPath, opts) => {
     try {
-      const resolvedPath = path48.resolve(targetPath);
-      if (!fs41.existsSync(resolvedPath)) {
+      const resolvedPath = path49.resolve(targetPath);
+      if (!fs42.existsSync(resolvedPath)) {
         logError(`Path does not exist: ${resolvedPath}`);
         process.exitCode = 1;
         return;
       }
       let resolvedProcessPath;
       if (opts.process) {
-        resolvedProcessPath = path48.resolve(opts.process);
-        if (!fs41.existsSync(resolvedProcessPath)) {
+        resolvedProcessPath = path49.resolve(opts.process);
+        if (!fs42.existsSync(resolvedProcessPath)) {
           logError(`--process path does not exist: ${resolvedProcessPath}`);
           process.exitCode = 1;
           return;
@@ -25964,7 +26336,7 @@ var init_program = __esm({
     init_vpn2();
     init_workflow();
     CLI_NAME = "mesh";
-    CLI_DESCRIPTION = "CLI for Mesh Lab development utilities";
+    CLI_DESCRIPTION = "Build, run and deploy apps on a Mesh platform";
   }
 });