@mesh-tech/mesh-cli 0.34.4 → 0.35.1

package/dist/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "bfebd7328",
-  "builtAt": "2026-09-25T04:08:06.365Z"
+  "commit": "7e553d060",
+  "builtAt": "2026-09-29T02:18:34.716Z"
 }

package/dist/src/commands/app-check.js

@@ -75,7 +75,7 @@ export const APP_CHECK_RULES = {
         gate: "H",
         title: "No role grants in IaC",
         severity: "block",
-        remediation: "remove the per-user grant map; grant roles from the Hub (App → Access → People)",
+        remediation: "remove the per-user grant map; grant roles from the Hub (App → Access → Users)",
         scope: "app",
     },
     POINTER_PROJECT_OVERRIDE: {
@@ -762,7 +762,7 @@ export function scanApp(root, appRel, resolution = probeResolution(root, appRel)
         for (const f of files)
             hit(code, rel(root, f), why);
     };
-    anti("IAC_GRANTS", RE_IAC_GRANT, "per-user role grant baked into IaC — grants belong in the Hub (Access → People), not in a config redeploy");
+    anti("IAC_GRANTS", RE_IAC_GRANT, "per-user role grant baked into IaC — grants belong in the Hub (Access → Users), not in a config redeploy");
     anti("POINTER_PROJECT_OVERRIDE", RE_POINTER_OVERRIDE, "AppAuthzPointer is given a `zitadel:` override — an app binds its project with AppEnvironment's zitadelAppProjectId so every consumer of env.zitadel agrees; the override is reserved for the Hub");
     anti("PASSWORD_STORE", RE_PASSWORD, "password storage or hashing — Zitadel owns credentials; the Hub creates sign-in users with a one-time temporary password");
     anti("EMAIL_ALLOWLIST", RE_ALLOWLIST, "email allowlist standing in for roles — declare a role and let the Hub grant it");

package/dist/src/commands/cluster.js

@@ -1,7 +1,7 @@
 import { spawnSync } from "node:child_process";
 import { logError, logInfo } from "../utils/log.js";
 import { findAppRoot, findStackConfigs, getCurrentStack, pulumiStackOutput, readStackConfig, } from "../utils/pulumi.js";
-import { resolveAwsCredentials, derivePlatformContext } from "../utils/aws-auth.js";
+import { resolveAwsCredentials, derivePlatformContext, readStackPlatform } from "../utils/aws-auth.js";
 import { ensureKubeconfig, resolveHubPlatformName, } from "../utils/kubeconfig.js";
 import { probeCredentials } from "./login.js";
 import { credProbeToPreflightError } from "../utils/pulumi-run.js";
@@ -26,7 +26,7 @@ async function resolveClusterAccess(opts) {
         : null;
     if (deployerRole && !resolved && !process.env.AWS_ACCESS_KEY_ID) {
         const pf = ctx
-            ? credProbeToPreflightError(await probeCredentials(ctx, deployerRole), ctx)
+            ? credProbeToPreflightError(await probeCredentials(ctx, deployerRole), ctx, readStackPlatform(appRoot, stack))
             : null;
         throw new Error(pf?.message ??
             `Couldn't resolve AWS credentials. Run: mesh login ${ctx ?? "mesh.dev"} --device`);

package/dist/src/commands/dev.js

@@ -6,7 +6,7 @@ import * as path from 'path';
 import { Option } from 'commander';
 import { SecretsManagerClient, GetSecretValueCommand } from '@aws-sdk/client-secrets-manager';
 import { logInfo, logSuccess, logError, logWarn, isVpnConnected, getTailscaleInfo, headscaleDnsConfig, registerDnsRecords, unregisterDnsRecords, readDnsRecords, getPlatformBastionInfo, } from '../utils/index.js';
-import { derivePlatformContext, renderCredentialProcessProfile, resolveAwsCredentials, resolveStableMeshBin, selectRoleForCaller, stripBareProfile, upsertManagedAwsConfigSection, } from '../utils/aws-auth.js';
+import { derivePlatformContext, readStackPlatform, renderCredentialProcessProfile, resolveAwsCredentials, resolveStableMeshBin, selectRoleForCaller, stripBareProfile, upsertManagedAwsConfigSection, } from '../utils/aws-auth.js';
 import { atomicWriteFileSync, readCredentials, getContextConfig, probeCredentials, getValidToken } from './login.js';
 import { resolveVpnJoinBroker, mintPreAuthKey } from '../utils/vpn-join.js';
 import { credProbeToPreflightError } from '../utils/pulumi-run.js';
@@ -2218,7 +2218,9 @@ export function registerDevCommand(program) {
             }
             const resolved = deployerRole ? await resolveAwsCredentials(deployerRole, appRoot, stack) : null;
             if (deployerRole && !resolved && !process.env.AWS_ACCESS_KEY_ID) {
-                const pf = ctx ? credProbeToPreflightError(await probeCredentials(ctx, deployerRole), ctx) : null;
+                const pf = ctx
+                    ? credProbeToPreflightError(await probeCredentials(ctx, deployerRole), ctx, readStackPlatform(appRoot, stack))
+                    : null;
                 logError(pf?.message ??
                     `Couldn't resolve AWS credentials to restart '${service}'. Run: mesh login ${ctx ?? 'mesh.dev'} --device`);
                 process.exit(1);

package/dist/src/commands/login.js

@@ -6,7 +6,7 @@ import { execFileSync } from "child_process";
 import { logError, logInfo, logSuccess, logWarn } from "../utils/log.js";
 import { MeshCliError } from "../utils/errors.js";
 import { assumeRoleCredentials, assumeRoleWithWebIdentity, describeAssumeFailure, probeAwsIdentity, renderCredentialProcessProfile, tokenIssuer, resolveStableMeshBin, selectRoleForCaller, toCredentialProcessJson, upsertManagedAwsConfigSection, } from "../utils/aws-auth.js";
-import { firstPartyDomainFor } from "../utils/first-party-contexts.js";
+import { firstPartyDomainFor, isPlatformLoginAlias } from "../utils/first-party-contexts.js";
 import { tailscaleBackendState } from "./vpn/index.js";
 const CONFIG_DIR = path.join(process.env.XDG_CONFIG_HOME ?? path.join(process.env.HOME ?? "~", ".config"), "mesh");
 const CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
@@ -941,7 +941,7 @@ export async function ensureLogin(context, opts = {}) {
 }
 async function discoverConfigGuarded(context, opts = {}) {
     let config = null;
-    if (parseTenantEnv(context)) {
+    if (parseTenantEnv(context) && !isPlatformLoginAlias(context)) {
         config = await discoverConfigFromSsm(context, opts);
     }
     if (!config) {

package/dist/src/commands/skills.d.ts

@@ -1,13 +1,18 @@
 import { Command } from "commander";
 export declare const INTENT_RANGE = "^0.3.6";
 export declare function resolveTargetRoot(startDir?: string): string;
-export declare function listPackageSkills(root: string): Array<{
+export declare function installedSkillName(segments: string[]): string;
+export declare function renderManagedSkill(source: string, name: string): string;
+interface PackageSkill {
     name: string;
+    legacyName: string;
     dir: string;
     source: string;
-}>;
+}
+export declare function listPackageSkills(root: string): Array<PackageSkill>;
 export declare function seedAppSkill(root: string, appName: string, appRelPath: string): string | null;
 export declare function syncSkills(root: string, opts?: {
     check?: boolean;
 }): boolean;
 export declare function registerSkillsCommands(program: Command): void;
+export {};

package/dist/src/commands/skills.js

@@ -30,14 +30,32 @@ function listBaseSkills() {
     return fs
         .readdirSync(dir, { withFileTypes: true })
         .filter((entry) => entry.isDirectory() && fs.existsSync(path.join(dir, entry.name, "SKILL.md")))
-        .map((entry) => ({ name: entry.name, source: path.join(dir, entry.name, "SKILL.md") }));
+        .map((entry) => ({
+        name: installedSkillName([entry.name]),
+        legacyName: entry.name === "mesh" ? "mesh-core" : `mesh-${entry.name}`,
+        source: path.join(dir, entry.name, "SKILL.md"),
+    }));
 }
-function renderManagedSkill(source) {
+export function installedSkillName(segments) {
+    const parts = ["mesh"];
+    for (const segment of segments) {
+        if (segment === "core")
+            continue;
+        if (segment === parts[parts.length - 1])
+            continue;
+        parts.push(segment);
+    }
+    return parts.join("-");
+}
+export function renderManagedSkill(source, name) {
     const raw = fs.readFileSync(source, "utf-8");
     const frontmatter = raw.match(/^(---\n[\s\S]*?\n---\n)/)?.[1];
     if (!frontmatter)
-        return `${MANAGED_MARKER}\n\n${raw}`;
-    return `${frontmatter}\n${MANAGED_MARKER}\n${raw.slice(frontmatter.length)}`;
+        return `---\nname: ${name}\n---\n\n${MANAGED_MARKER}\n\n${raw}`;
+    const named = /^name:.*$/m.test(frontmatter)
+        ? frontmatter.replace(/^name:.*$/m, `name: ${name}`)
+        : frontmatter.replace(/^---\n/, `---\nname: ${name}\n`);
+    return `${named}\n${MANAGED_MARKER}\n${raw.slice(frontmatter.length)}`;
 }
 const BASE_SKILL_PACKAGE = "mesh-cli";
 function meshTechScopeDirs(root, maxDepth = 6) {
@@ -84,14 +102,35 @@ export function listPackageSkills(root) {
                 const source = path.join(skillsDir, domain.name, "SKILL.md");
                 if (!fs.existsSync(source))
                     continue;
-                const name = `mesh-${pkg.name}-${domain.name}`;
-                if (!byName.has(name))
-                    byName.set(name, { name, dir: path.join(skillsDir, domain.name), source });
+                const name = installedSkillName([pkg.name, domain.name]);
+                if (!byName.has(name)) {
+                    byName.set(name, {
+                        name,
+                        legacyName: `mesh-${pkg.name}-${domain.name}`,
+                        dir: path.join(skillsDir, domain.name),
+                        source,
+                    });
+                }
             }
         }
     }
     return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
 }
+function extrasInSync(sourceDir, targetDir) {
+    for (const entry of fs.readdirSync(sourceDir, { withFileTypes: true, recursive: true })) {
+        if (!entry.isFile())
+            continue;
+        const rel = path.relative(sourceDir, path.join(entry.parentPath, entry.name));
+        if (rel === "SKILL.md")
+            continue;
+        const installed = path.join(targetDir, rel);
+        if (!fs.existsSync(installed))
+            return false;
+        if (!fs.readFileSync(installed).equals(fs.readFileSync(path.join(sourceDir, rel))))
+            return false;
+    }
+    return true;
+}
 function copySkillExtras(sourceDir, targetDir) {
     for (const entry of fs.readdirSync(sourceDir, { withFileTypes: true })) {
         if (entry.name === "SKILL.md")
@@ -111,27 +150,38 @@ export function seedAppSkill(root, appName, appRelPath) {
 }
 function planSync(root) {
     const items = [];
-    for (const skill of listBaseSkills()) {
-        const target = path.join(root, ".claude", "skills", `mesh-${skill.name}`, "SKILL.md");
-        const desired = renderManagedSkill(skill.source);
-        const label = `.claude/skills/mesh-${skill.name}/SKILL.md (base skill)`;
+    const baseSkills = listBaseSkills();
+    for (const skill of baseSkills) {
+        const targetDir = path.join(root, ".claude", "skills", skill.name);
+        const target = path.join(targetDir, "SKILL.md");
+        const sourceDir = path.dirname(skill.source);
+        const desired = renderManagedSkill(skill.source, skill.name);
+        const label = `.claude/skills/${skill.name}/SKILL.md (base skill)`;
         if (!fs.existsSync(target)) {
             items.push({
                 label,
                 state: "write",
                 apply: () => {
-                    fs.mkdirSync(path.dirname(target), { recursive: true });
+                    fs.mkdirSync(targetDir, { recursive: true });
                     fs.writeFileSync(target, desired);
+                    copySkillExtras(sourceDir, targetDir);
                 },
             });
         }
         else {
             const current = fs.readFileSync(target, "utf-8");
-            if (current === desired) {
+            if (current === desired && extrasInSync(sourceDir, targetDir)) {
                 items.push({ label, state: "ok" });
             }
             else if (current.includes(MANAGED_MARKER)) {
-                items.push({ label, state: "write", apply: () => fs.writeFileSync(target, desired) });
+                items.push({
+                    label,
+                    state: "write",
+                    apply: () => {
+                        fs.writeFileSync(target, desired);
+                        copySkillExtras(sourceDir, targetDir);
+                    },
+                });
             }
             else {
                 items.push({ label: `${label} — exists without the managed marker, leaving as-is`, state: "skip" });
@@ -142,7 +192,7 @@ function planSync(root) {
     for (const skill of packageSkills) {
         const targetDir = path.join(root, ".claude", "skills", skill.name);
         const target = path.join(targetDir, "SKILL.md");
-        const desired = renderManagedSkill(skill.source);
+        const desired = renderManagedSkill(skill.source, skill.name);
         const label = `.claude/skills/${skill.name}/SKILL.md (platform skill)`;
         if (!fs.existsSync(target)) {
             items.push({
@@ -178,6 +228,25 @@ function planSync(root) {
     if (packageSkills.length === 0 && meshTechScopeDirs(root).length === 0) {
         logInfo("No @mesh-tech packages installed yet — run `pnpm install`, then `mesh skills sync` again for the platform skills.");
     }
+    for (const skill of [...baseSkills, ...packageSkills]) {
+        if (skill.legacyName === skill.name)
+            continue;
+        const legacyDir = path.join(root, ".claude", "skills", skill.legacyName);
+        const legacyFile = path.join(legacyDir, "SKILL.md");
+        if (!fs.existsSync(legacyFile))
+            continue;
+        const label = `.claude/skills/${skill.legacyName}/ (renamed to ${skill.name})`;
+        if (fs.readFileSync(legacyFile, "utf-8").includes(MANAGED_MARKER)) {
+            items.push({
+                label: `${label} — removing the old copy`,
+                state: "write",
+                apply: () => fs.rmSync(legacyDir, { recursive: true, force: true }),
+            });
+        }
+        else {
+            items.push({ label: `${label} — exists without the managed marker, leaving as-is`, state: "skip" });
+        }
+    }
     const hookSource = cliAsset("assets", "intent", "intent-claude-gate.mjs");
     const hookTarget = path.join(root, HOOK_RELATIVE);
     const hookDesired = fs.readFileSync(hookSource, "utf-8");

package/dist/src/commands/stack-status.d.ts

@@ -0,0 +1,65 @@
+export declare const INFRA_PACKAGE = "@mesh-tech/infra-components";
+export declare const HUB_PACKAGE = "@mesh-tech/hub";
+export declare const CLI_PACKAGE = "@mesh-tech/mesh-cli";
+export interface StatusTarget {
+    stack: string;
+    kind: "layer" | "app";
+    tenant: string;
+    env: string;
+    coreTenant: string;
+    coreEnv: string;
+    platformDir?: string;
+    coreDir?: string;
+}
+export declare function splitLayerStack(stack: string, tenant: string | null): {
+    tenant: string;
+    env: string;
+};
+export declare function targetForStack(projectDir: string, stack: string): StatusTarget | null;
+export declare function findStatusTargets(cwd: string, stack?: string): StatusTarget[];
+export declare function pinnedVersion(dir: string | undefined, pkg: string): string | null;
+export declare function compareVersions(a: string, b: string): number;
+export type LayerState = "current" | "behind" | "not-deployed" | "unknown";
+export interface LayerRow {
+    layer: "core" | "platform" | "hub";
+    registration: string;
+    pinned: string | null;
+    deployed: string | null;
+    latest: string | null;
+    state: LayerState;
+    undeployedPin: boolean;
+    note?: string;
+}
+export declare function layerState(deployed: string | null, latest: string | null): LayerState;
+export interface StatusReport {
+    target: StatusTarget;
+    rows: LayerRow[];
+}
+export interface CliStatus {
+    running: string;
+    latest: string | null;
+    behind: boolean;
+}
+export interface Registration {
+    infraVersion?: string;
+    hubVersion?: string;
+}
+export declare function parseRegistration(raw: string): Registration;
+export declare function buildRows(target: StatusTarget, deployed: {
+    core: Registration | Error | null;
+    platform: Registration | Error | null;
+}, latest: {
+    infra: string | null;
+    hub: string | null;
+}): LayerRow[];
+export declare function renderStatus(reports: StatusReport[], cli: CliStatus): string;
+export declare function upgradeSteps(target: StatusTarget, rows: LayerRow[]): string[];
+export declare function latestPublished(pkg: string, cwd: string): string | null;
+export interface StatusOptions {
+    stack?: string;
+    profile?: string;
+    region?: string;
+    json?: boolean;
+    check?: boolean;
+}
+export declare function runStackStatus(cwd: string, opts: StatusOptions): Promise<boolean>;

package/dist/src/commands/stack-status.js

@@ -0,0 +1,285 @@
+import * as fs from "fs";
+import * as path from "path";
+import { execFileSync } from "child_process";
+import { logInfo, logWarn } from "../utils/log.js";
+import { findAppRoot, findStackConfigs, readStackConfig } from "../utils/pulumi.js";
+import { derivePlatformContext, readStackPlatform, resolveAwsCredentials } from "../utils/aws-auth.js";
+import { resolveCliRuntime } from "../utils/build-info.js";
+export const INFRA_PACKAGE = "@mesh-tech/infra-components";
+export const HUB_PACKAGE = "@mesh-tech/hub";
+export const CLI_PACKAGE = "@mesh-tech/mesh-cli";
+export function splitLayerStack(stack, tenant) {
+    if (tenant && stack.startsWith(`${tenant}-`))
+        return { tenant, env: stack.slice(tenant.length + 1) };
+    const cut = stack.indexOf("-");
+    if (cut <= 0)
+        return { tenant: tenant ?? stack, env: stack };
+    return { tenant: tenant ?? stack.slice(0, cut), env: stack.slice(cut + 1) };
+}
+export function targetForStack(projectDir, stack) {
+    const platform = readStackPlatform(projectDir, stack);
+    if (platform) {
+        const [tenant, env] = platform.split(".");
+        return { stack, kind: "app", tenant, env, coreTenant: tenant, coreEnv: env };
+    }
+    const declared = readStackConfig(projectDir, stack, "mesh:tenant");
+    const layerDir = ["core", "platform"].includes(path.basename(projectDir));
+    if (!declared && !layerDir)
+        return null;
+    const { tenant, env } = splitLayerStack(stack, declared);
+    const isCore = path.basename(projectDir) === "core";
+    return {
+        stack,
+        kind: "layer",
+        tenant,
+        env,
+        coreTenant: readStackConfig(projectDir, stack, "mesh:coreTenant") ?? tenant,
+        coreEnv: readStackConfig(projectDir, stack, "mesh:coreEnv") ?? env,
+        ...(isCore ? { coreDir: projectDir } : { platformDir: projectDir }),
+    };
+}
+export function findStatusTargets(cwd, stack) {
+    const project = findAppRoot(cwd);
+    let projectDir = project;
+    let repoRoot = null;
+    if (!projectDir) {
+        const platformDir = path.join(cwd, "platform");
+        if (fs.existsSync(path.join(platformDir, "Pulumi.yaml"))) {
+            projectDir = platformDir;
+            repoRoot = cwd;
+        }
+    }
+    else if (["core", "platform"].includes(path.basename(projectDir))) {
+        repoRoot = path.dirname(projectDir);
+    }
+    if (!projectDir)
+        return [];
+    const stacks = stack ? [stack] : findStackConfigs(projectDir);
+    const targets = [];
+    for (const name of stacks) {
+        const target = targetForStack(projectDir, name);
+        if (!target)
+            continue;
+        if (repoRoot && target.kind === "layer") {
+            const core = path.join(repoRoot, "core");
+            const platform = path.join(repoRoot, "platform");
+            if (fs.existsSync(path.join(core, "package.json")))
+                target.coreDir = core;
+            if (fs.existsSync(path.join(platform, "package.json")))
+                target.platformDir = platform;
+        }
+        targets.push(target);
+    }
+    return targets;
+}
+export function pinnedVersion(dir, pkg) {
+    if (!dir)
+        return null;
+    try {
+        const manifest = JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf-8"));
+        const spec = manifest.dependencies?.[pkg] ?? manifest.devDependencies?.[pkg];
+        return typeof spec === "string" ? spec.replace(/^[\^~=v]+/, "") : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function compareVersions(a, b) {
+    const parse = (v) => v.split(/[.+-]/).slice(0, 3).map((n) => Number.parseInt(n, 10) || 0);
+    const [x, y] = [parse(a), parse(b)];
+    for (let i = 0; i < 3; i++) {
+        const diff = (x[i] ?? 0) - (y[i] ?? 0);
+        if (diff)
+            return diff;
+    }
+    return 0;
+}
+export function layerState(deployed, latest) {
+    if (!deployed)
+        return "not-deployed";
+    if (!latest)
+        return "unknown";
+    return compareVersions(deployed, latest) < 0 ? "behind" : "current";
+}
+export function parseRegistration(raw) {
+    try {
+        const data = JSON.parse(raw);
+        const out = {};
+        if (typeof data.build?.infraVersion === "string")
+            out.infraVersion = data.build.infraVersion;
+        if (typeof data.hub?.hubVersion === "string")
+            out.hubVersion = data.hub.hubVersion;
+        return out;
+    }
+    catch {
+        return {};
+    }
+}
+export function buildRows(target, deployed, latest) {
+    const corePath = `/mesh-platform/${target.coreTenant}/${target.coreEnv}/core`;
+    const platformPath = `/mesh-platform/${target.tenant}/${target.env}/platform`;
+    const row = (layer, registration, source, field, pinned, latestVersion) => {
+        const value = source && !(source instanceof Error) ? (source[field] ?? null) : null;
+        const predatesExport = !!source && !(source instanceof Error) && value === null;
+        const note = source instanceof Error
+            ? source.message
+            : source === null
+                ? "no registration — never deployed, or not readable with these credentials"
+                : predatesExport
+                    ? "registration predates version export — last deployed with an infra-components older than any current release"
+                    : undefined;
+        return {
+            layer,
+            registration,
+            pinned,
+            deployed: value,
+            latest: latestVersion,
+            state: source instanceof Error ? "unknown" : predatesExport ? "behind" : layerState(value, latestVersion),
+            undeployedPin: !!pinned && !!value && pinned !== value,
+            ...(note ? { note } : {}),
+        };
+    };
+    return [
+        row("core", corePath, deployed.core, "infraVersion", pinnedVersion(target.coreDir, INFRA_PACKAGE), latest.infra),
+        row("platform", platformPath, deployed.platform, "infraVersion", pinnedVersion(target.platformDir, INFRA_PACKAGE), latest.infra),
+        row("hub", platformPath, deployed.platform, "hubVersion", pinnedVersion(target.platformDir, HUB_PACKAGE), latest.hub),
+    ];
+}
+export function renderStatus(reports, cli) {
+    const lines = [];
+    const show = (v) => v ?? "—";
+    for (const { target, rows } of reports) {
+        const what = target.kind === "app"
+            ? `App stack ${target.stack} → platform ${target.tenant}/${target.env}`
+            : `Platform ${target.tenant}/${target.env} (stack ${target.stack}) on core ${target.coreTenant}/${target.coreEnv}`;
+        lines.push(what);
+        lines.push(`  ${"layer".padEnd(9)} ${"pinned".padEnd(10)} ${"deployed".padEnd(10)} ${"latest".padEnd(10)} state`);
+        for (const r of rows) {
+            const flag = r.undeployedPin ? " (pin not deployed)" : "";
+            lines.push(`  ${r.layer.padEnd(9)} ${show(r.pinned).padEnd(10)} ${show(r.deployed).padEnd(10)} ${show(r.latest).padEnd(10)} ${r.state}${flag}`);
+            if (r.note)
+                lines.push(`            ${r.registration}: ${r.note}`);
+        }
+        if (rows.some((r) => r.state === "behind" || r.undeployedPin)) {
+            lines.push(...upgradeSteps(target, rows));
+        }
+        lines.push("");
+    }
+    lines.push(`CLI  ${CLI_PACKAGE} ${cli.running}` +
+        (cli.latest ? ` (latest ${cli.latest})${cli.behind ? " — behind: pnpm add -D @mesh-tech/mesh-cli@latest" : ""}` : " (latest unknown)"));
+    return lines.join("\n");
+}
+export function upgradeSteps(target, rows) {
+    const latest = rows.find((r) => r.latest)?.latest;
+    if (target.kind === "app") {
+        return [
+            "  This platform is behind. Its operator upgrades it from the org's platform repo:",
+            "  run `mesh stack status` there, then upgrade core and platform together.",
+        ];
+    }
+    const to = latest ? `@${latest}` : "@latest";
+    return [
+        "  To upgrade (both layers — deploying platform/ alone leaves core on the old version):",
+        `    1. core/ and platform/: set ${INFRA_PACKAGE}${to}` +
+            ` (and ${HUB_PACKAGE}${to} in platform/), then pnpm install`,
+        `    2. cd core && mesh deploy preview --stack ${target.coreTenant}-${target.coreEnv}` +
+            "   # review: this layer is the VPC/EKS/RDS",
+        `    3. mesh deploy up --stack ${target.coreTenant}-${target.coreEnv}` +
+            ` && cd ../platform && mesh deploy up --stack ${target.stack}`,
+        "    4. mesh stack status   # both layers now report the new version",
+    ];
+}
+export function latestPublished(pkg, cwd) {
+    try {
+        const out = execFileSync("npm", ["view", pkg, "version"], {
+            cwd,
+            encoding: "utf-8",
+            timeout: 20_000,
+            stdio: ["ignore", "pipe", "ignore"],
+        }).trim();
+        return /^\d+\.\d+\.\d+$/.test(out) ? out : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function readRegistration(name, region, auth) {
+    const { credentials, profile, signInHint } = auth;
+    try {
+        const { SSMClient, GetParameterCommand } = await import("@aws-sdk/client-ssm");
+        const client = new SSMClient({
+            region,
+            ...(profile && !credentials?.AWS_ACCESS_KEY_ID ? { profile } : {}),
+            ...(credentials?.AWS_ACCESS_KEY_ID
+                ? {
+                    credentials: {
+                        accessKeyId: credentials.AWS_ACCESS_KEY_ID,
+                        secretAccessKey: credentials.AWS_SECRET_ACCESS_KEY ?? "",
+                        sessionToken: credentials.AWS_SESSION_TOKEN,
+                    },
+                }
+                : {}),
+        });
+        const resp = await client.send(new GetParameterCommand({ Name: name }));
+        return resp.Parameter?.Value ? parseRegistration(resp.Parameter.Value) : null;
+    }
+    catch (err) {
+        const e = err;
+        const kind = e.name || e.__type || e.message || String(err);
+        if (/ParameterNotFound/.test(kind))
+            return null;
+        if (/credential|ExpiredToken|AccessDenied|UnrecognizedClient|security token/i.test(`${kind} ${e.message ?? ""}`)) {
+            return new Error(`could not read — no AWS credentials for this account (${signInHint})`);
+        }
+        return new Error(`could not read — ${e.message ?? kind}`);
+    }
+}
+export async function runStackStatus(cwd, opts) {
+    const targets = findStatusTargets(cwd, opts.stack);
+    if (targets.length === 0) {
+        logWarn("No Mesh stack found here. Run from an app directory (a Pulumi.<stack>.yaml naming mesh:platform),\n" +
+            "  or from your org's Mesh platform repo (its root, core/ or platform/).");
+        return true;
+    }
+    const infraLatest = latestPublished(INFRA_PACKAGE, cwd);
+    const hubLatest = latestPublished(HUB_PACKAGE, cwd);
+    const running = resolveCliRuntime({ vcs: false }).version;
+    const cliLatest = latestPublished(CLI_PACKAGE, cwd);
+    const cli = { running, latest: cliLatest, behind: !!cliLatest && compareVersions(running, cliLatest) < 0 };
+    if (!infraLatest)
+        logInfo("Registry lookup failed — `latest` is unknown. Run `mesh registry login` and retry.");
+    const reports = [];
+    for (const target of targets) {
+        const projectDir = findAppRoot(cwd) ?? target.platformDir ?? cwd;
+        const region = opts.region ?? readStackConfig(projectDir, target.stack, "aws:region") ?? "us-east-2";
+        const ambient = !!process.env.AWS_ACCESS_KEY_ID || !!process.env.AWS_PROFILE;
+        let profile = opts.profile;
+        let credentials;
+        if (!profile && !ambient) {
+            profile = readStackConfig(projectDir, target.stack, "aws:profile") ?? undefined;
+            if (!profile && target.kind === "app") {
+                const role = readStackConfig(projectDir, target.stack, "mesh:deployerRole");
+                if (role)
+                    credentials = (await resolveAwsCredentials(role, projectDir, target.stack))?.env;
+            }
+        }
+        const loginContext = target.kind === "app" ? derivePlatformContext(projectDir, target.stack) : null;
+        const signInHint = loginContext
+            ? `sign in with \`mesh login ${loginContext} --device\`, or pass --profile`
+            : "set AWS_PROFILE or pass --profile with access to the core's account";
+        const auth = { credentials, profile, signInHint };
+        const [core, platform] = await Promise.all([
+            readRegistration(`/mesh-platform/${target.coreTenant}/${target.coreEnv}/core`, region, auth),
+            readRegistration(`/mesh-platform/${target.tenant}/${target.env}/platform`, region, auth),
+        ]);
+        reports.push({ target, rows: buildRows(target, { core, platform }, { infra: infraLatest, hub: hubLatest }) });
+    }
+    if (opts.json) {
+        process.stdout.write(JSON.stringify({ platforms: reports, cli }, null, 2) + "\n");
+    }
+    else {
+        process.stdout.write(renderStatus(reports, cli) + "\n");
+    }
+    const behind = cli.behind || reports.some((r) => r.rows.some((row) => row.state === "behind" || row.undeployedPin));
+    return !behind;
+}

package/dist/src/commands/stack.js

@@ -6,6 +6,7 @@ import { logError, logInfo, logSuccess, logWarn } from "../utils/log.js";
 import { findAppRoot, findStackConfigs, getCurrentStack, readStackConfig } from "../utils/pulumi.js";
 import { resolveWorktreeIdentity, worktreeStackName } from "../utils/worktree-identity.js";
 import { resolvePulumiEnv } from "../utils/pulumi-run.js";
+import { runStackStatus } from "./stack-status.js";
 function readTopLevelYamlKey(appRoot, stack, key) {
     const configFile = path.join(appRoot, `Pulumi.${stack}.yaml`);
     if (!fs.existsSync(configFile))
@@ -130,7 +131,7 @@ function getGitHubUsername() {
 export function registerStackCommand(program) {
     const stack = program
         .command("stack")
-        .description("Manage personal Pulumi stacks");
+        .description("Manage personal Pulumi stacks and check a Mesh instance against the latest release");
     stack
         .command("init")
         .description("Create a personal dev stack (dev-{github-username})")
@@ -383,4 +384,17 @@ export function registerStackCommand(program) {
             process.exit(err.status ?? 1);
         }
     });
+    stack
+        .command("status")
+        .description("Read-only drift check: for each platform this directory deploys (a platform repo's core/platform stacks) or deploys apps to (an app's mesh:platform), compare the pinned, deployed (the core and platform SSM registrations written by the last successful deploy) and latest published @mesh-tech/infra-components and @mesh-tech/hub, plus this CLI against the latest @mesh-tech/mesh-cli, and print the upgrade steps when anything is behind. Changes nothing.")
+        .option("--stack <name>", "check one stack (default: every Pulumi.<stack>.yaml here)")
+        .option("--profile <profile>", "AWS profile to read the SSM registrations with (default: AWS_PROFILE, else the stack's aws:profile, else an app stack's deployer role)")
+        .option("--region <region>", "AWS region of the registrations (default: the stack's aws:region, else us-east-2)")
+        .option("--json", "print the report as JSON", false)
+        .option("--check", "exit 1 when any layer or the CLI is behind, or a pin is not deployed", false)
+        .action(async (opts) => {
+        const ok = await runStackStatus(process.cwd(), opts);
+        if (opts.check && !ok)
+            process.exit(1);
+    });
 }