@mesh-tech/mesh-cli 0.36.0 → 0.37.0

package/dist/bin/mesh.chunk-JB7FWYSP.js

@@ -0,0 +1,1751 @@
+import {
+  INTENT_RANGE,
+  resolveTargetRoot,
+  seedAppSkill,
+  syncSkills
+} from "./mesh.chunk-F4654EPX.js";
+import {
+  ICONS,
+  aggregateStatus,
+  findMeshJson,
+  jsonReport,
+  renderHuman,
+  runChecks
+} from "./mesh.chunk-R5VVTXG4.js";
+import {
+  findPackageRoot
+} from "./mesh.chunk-MCBMHWXP.js";
+import {
+  logError,
+  logInfo,
+  logSuccess,
+  logWarn
+} from "./mesh.chunk-WFFDF346.js";
+import {
+  MeshCliError,
+  emitJsonPayload
+} from "./mesh.chunk-IQOBTL42.js";
+import {
+  registryPreflight
+} from "./mesh.chunk-5A5OFSYR.js";
+
+// packages/mesh-cli/src/commands/create-app.ts
+import * as fs3 from "fs";
+import * as os from "os";
+import * as path3 from "path";
+import { fileURLToPath } from "url";
+import Handlebars from "handlebars";
+import { parse as parseYaml2 } from "yaml";
+
+// packages/mesh-cli/src/commands/app-check.ts
+import * as fs2 from "node:fs";
+import * as path2 from "node:path";
+
+// packages/mesh-cli/src/commands/app-check-resolve.ts
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { builtinModules } from "node:module";
+import { parse as parseYaml } from "yaml";
+var CONDITIONS = /* @__PURE__ */ new Set(["source", "node", "import", "require", "module", "module-sync", "default"]);
+var EXTENSIONS = ["", ".ts", ".tsx", ".js", ".mjs", ".cjs", "/index.ts", "/index.js", "/index.mjs"];
+var SCOPE = "@mesh-tech/";
+var FILE_BUDGET = 1500;
+var BUILTINS = new Set(builtinModules);
+function stripComments(source) {
+  return source.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:"'`\\])\/\/[^\n]*/g, "$1");
+}
+function moduleSpecifiers(source) {
+  const text = stripComments(source);
+  const out = [];
+  for (const m of text.matchAll(/(?<![.\w$])(?:import|export)\b([^;]*?)\bfrom\s*["']([^"']+)["']/g)) {
+    if (/^\s*type\s/.test(m[1] ?? "")) continue;
+    out.push(m[2] ?? "");
+  }
+  for (const m of text.matchAll(/(?<![.\w$])import\s*["']([^"']+)["']/g)) out.push(m[1] ?? "");
+  for (const m of text.matchAll(/(?<![.\w$])import\s*\(\s*["']([^"']+)["']\s*\)/g)) out.push(m[1] ?? "");
+  for (const m of text.matchAll(/(?<![.\w$])require\s*\(\s*["']([^"']+)["']\s*\)/g)) out.push(m[1] ?? "");
+  return [...new Set(out)].filter(Boolean);
+}
+function splitSpecifier(specifier) {
+  if (!specifier || specifier.startsWith(".") || specifier.startsWith("/") || specifier.startsWith("#")) return null;
+  if (specifier.includes(":")) return null;
+  if (BUILTINS.has(specifier)) return null;
+  const parts = specifier.split("/");
+  const depth = specifier.startsWith("@") ? 2 : 1;
+  if (parts.length < depth || parts.some((p) => p === "")) return null;
+  const pkg = parts.slice(0, depth).join("/");
+  const rest = parts.slice(depth);
+  return { pkg, sub: rest.length > 0 ? `./${rest.join("/")}` : "." };
+}
+function findPackageDir(fromDir, pkg) {
+  let dir = path.resolve(fromDir);
+  for (; ; ) {
+    const candidate = path.join(dir, "node_modules", ...pkg.split("/"));
+    if (fs.existsSync(path.join(candidate, "package.json"))) {
+      try {
+        return fs.realpathSync(candidate);
+      } catch {
+        return candidate;
+      }
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function conditionTargets(node, acc = []) {
+  if (typeof node === "string") {
+    acc.push(node);
+    return acc;
+  }
+  if (Array.isArray(node)) {
+    for (const entry of node) conditionTargets(entry, acc);
+    return acc;
+  }
+  if (!node || typeof node !== "object") return acc;
+  for (const [key, value] of Object.entries(node)) {
+    if (!CONDITIONS.has(key)) continue;
+    conditionTargets(value, acc);
+  }
+  return acc;
+}
+function exportTargets(exportsField, sub) {
+  if (typeof exportsField === "string") return sub === "." ? [exportsField] : [];
+  if (Array.isArray(exportsField)) return exportsField.flatMap((entry) => exportTargets(entry, sub));
+  if (!exportsField || typeof exportsField !== "object") return [];
+  const map = exportsField;
+  const keys = Object.keys(map);
+  if (keys.length > 0 && !keys.some((k) => k.startsWith("."))) return sub === "." ? conditionTargets(map) : [];
+  if (sub in map) return conditionTargets(map[sub]);
+  let best = [];
+  let bestPrefix = -1;
+  for (const key of keys) {
+    const star = key.indexOf("*");
+    if (star === -1) continue;
+    const prefix = key.slice(0, star);
+    const suffix = key.slice(star + 1);
+    if (sub.length < prefix.length + suffix.length) continue;
+    if (!sub.startsWith(prefix) || !sub.endsWith(suffix)) continue;
+    if (prefix.length <= bestPrefix) continue;
+    const segment = sub.slice(prefix.length, sub.length - suffix.length);
+    bestPrefix = prefix.length;
+    best = conditionTargets(map[key]).map((target) => target.replaceAll("*", segment));
+  }
+  return best;
+}
+function isDirectory(p) {
+  try {
+    return fs.statSync(p).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function firstFile(base) {
+  for (const ext of EXTENSIONS) {
+    const candidate = base + ext;
+    try {
+      if (fs.statSync(candidate).isFile()) return candidate;
+    } catch {
+    }
+  }
+  return null;
+}
+function resolveSubpath(pkgDir, sub) {
+  let manifest = {};
+  try {
+    manifest = JSON.parse(fs.readFileSync(path.join(pkgDir, "package.json"), "utf8"));
+  } catch {
+    return null;
+  }
+  if (manifest.exports !== void 0) {
+    for (const target of exportTargets(manifest.exports, sub)) {
+      const file = firstFile(path.resolve(pkgDir, target));
+      if (file) return file;
+    }
+    return null;
+  }
+  if (sub === ".") return firstFile(path.resolve(pkgDir, manifest.main ?? "index.js"));
+  return firstFile(path.resolve(pkgDir, sub));
+}
+function programEntry(appDir) {
+  const app = path.resolve(appDir);
+  const index = path.join(app, "index.ts");
+  if (fs.existsSync(index)) return index;
+  let main;
+  try {
+    main = parseYaml(fs.readFileSync(path.join(app, "Pulumi.yaml"), "utf8"))?.main;
+  } catch {
+    return null;
+  }
+  if (typeof main !== "string" || !main) return null;
+  const target = path.resolve(app, main);
+  return isDirectory(target) ? firstFile(path.join(target, "index")) : firstFile(target);
+}
+function dependenciesInstalled(dir, stopAt) {
+  const root = stopAt === void 0 ? null : path.resolve(stopAt);
+  let at = path.resolve(dir);
+  for (; ; ) {
+    if (fs.existsSync(path.join(at, "node_modules"))) return true;
+    if (at === root) return false;
+    const parent = path.dirname(at);
+    if (parent === at) return false;
+    at = parent;
+  }
+}
+function suggestedRange(appDir, parentDir) {
+  try {
+    const manifest = JSON.parse(fs.readFileSync(path.join(appDir, "package.json"), "utf8"));
+    for (const section of [manifest.dependencies, manifest.devDependencies]) {
+      for (const [name, range] of Object.entries(section ?? {})) {
+        if (name.startsWith(SCOPE) && range) return range;
+      }
+    }
+  } catch {
+  }
+  if (!parentDir) return null;
+  try {
+    const version = JSON.parse(fs.readFileSync(path.join(parentDir, "package.json"), "utf8")).version;
+    return version ? `^${version}` : null;
+  } catch {
+    return null;
+  }
+}
+function displayPath(app, visit) {
+  const within = path.relative(visit.pkg === null ? app : visit.pkgDir, visit.file).split(path.sep).join("/");
+  return visit.pkg === null ? within : `${visit.pkg}/${within}`;
+}
+function resolveProgramImports(appDir, options = {}) {
+  const app = path.resolve(appDir);
+  const label = options.label ?? path.basename(app);
+  const entryFile = options.entry ? firstFile(path.resolve(app, options.entry)) : programEntry(app);
+  if (!dependenciesInstalled(app, options.root)) {
+    return { findings: [], unchecked: "dependencies are not installed (run the install, then re-run)" };
+  }
+  if (!entryFile) {
+    return { findings: [], unchecked: "no Pulumi program found (index.ts, or the file Pulumi.yaml's `main` names)" };
+  }
+  const findings = [];
+  const reported = /* @__PURE__ */ new Set();
+  const seen = /* @__PURE__ */ new Set([entryFile]);
+  const queue = [{ file: entryFile, pkgDir: app, pkg: null, via: [] }];
+  let budget = FILE_BUDGET;
+  while (queue.length > 0 && budget-- > 0) {
+    const here = queue.shift();
+    let source;
+    try {
+      source = fs.readFileSync(here.file, "utf8");
+    } catch {
+      continue;
+    }
+    const fromDir = path.dirname(here.file);
+    for (const specifier of moduleSpecifiers(source)) {
+      if (specifier.startsWith(".")) {
+        if (here.pkg === null) continue;
+        const next = firstFile(path.resolve(fromDir, specifier));
+        if (next && !seen.has(next) && next.startsWith(here.pkgDir)) {
+          seen.add(next);
+          queue.push({ ...here, file: next });
+        }
+        continue;
+      }
+      const split = splitSpecifier(specifier);
+      if (!split) continue;
+      const inScope = split.pkg.startsWith(SCOPE);
+      if (here.pkg !== null && !inScope) continue;
+      const pkgDir = findPackageDir(fromDir, split.pkg);
+      const target = pkgDir ? resolveSubpath(pkgDir, split.sub) : null;
+      if (!pkgDir || !target) {
+        if (reported.has(specifier)) continue;
+        reported.add(specifier);
+        const range = inScope ? suggestedRange(app, here.pkg === null ? null : here.pkgDir) : null;
+        const line = `"${split.pkg}": "${range ?? (inScope ? "<the version your other @mesh-tech packages use>" : "<the version you need>")}"`;
+        const fix = pkgDir ? `${split.pkg} is installed but ships no ${split.sub} \u2014 the installed version predates the subpath; raise ${line} in ${label}/package.json` : `add ${line} to ${label}/package.json dependencies`;
+        findings.push({ pkg: split.pkg, specifier, file: here.file, importer: displayPath(app, here), via: here.via, fix });
+        continue;
+      }
+      if (!inScope || seen.has(target)) continue;
+      seen.add(target);
+      queue.push({ file: target, pkgDir, pkg: split.pkg, via: [...here.via, specifier] });
+    }
+  }
+  findings.sort((a, b) => a.pkg.localeCompare(b.pkg) || a.specifier.localeCompare(b.specifier));
+  const unchecked = queue.length > 0 ? `the import graph exceeded ${FILE_BUDGET} files` : null;
+  return { findings, unchecked };
+}
+
+// packages/mesh-cli/src/commands/app-check.ts
+var APP_CHECK_RULES = {
+  UNRESOLVABLE_IMPORT: {
+    gate: "0.6",
+    title: "The Pulumi program's imports resolve",
+    severity: "block",
+    // The package is missing from the app's OWN manifest, which is why the
+    // remediation names that file: it is an optional peer of a @mesh-tech
+    // package, so the installer had nothing to complain about.
+    remediation: "declare the package in apps/<app>/package.json dependencies, at the range the app's other @mesh-tech/* packages use, and re-install \u2014 an optional peer that nothing names installs silently and fails at `mesh deploy`",
+    scope: "app"
+  },
+  UI_IN_API: {
+    gate: "0.1",
+    title: "UI is its own service",
+    severity: "block",
+    remediation: 'move the pages to apps/<app>/ui and declare new mesh.apps.Service("ui", { env, src: "./ui", \u2026 })',
+    scope: "app"
+  },
+  NO_UI_SERVICE: {
+    gate: "0.1",
+    title: "UI service declared",
+    severity: "block",
+    remediation: 'add apps/<app>/ui + new mesh.apps.Service("ui", \u2026) in index.ts',
+    scope: "app"
+  },
+  NO_REGISTER: {
+    gate: "0.2",
+    title: "App registers with the Hub",
+    severity: "block",
+    // The registration's prose is read by the CLIENT's operators, so the
+    // remediation names the split rather than one field: `description` is one
+    // sentence for them, `operatorNote` is where the engineering material goes
+    // (a tenant-audience Hub drops that key from the response entirely).
+    remediation: "end index.ts with `export const app = env.register({ displayName, description })` \u2014 one sentence a non-technical operator can act on; put the caveats in `operatorNote`",
+    scope: "app"
+  },
+  CUSTOM_SESSION_AUTH: {
+    gate: "0.3",
+    title: "Sign-in through the platform",
+    severity: "block",
+    remediation: 'delete the OIDC + cookie code and protect the UI service with auth: { provider: "mesh" }',
+    scope: "app"
+  },
+  NON_PLATFORM_LOGGER: {
+    gate: "0.4",
+    title: "Logs through @mesh-tech/logger",
+    severity: "block",
+    remediation: 'import { createLogger } from "@mesh-tech/logger" and log through it (requestLogger for HTTP)',
+    scope: "app"
+  },
+  LOCAL_AUTH_LIB: {
+    gate: "0.5",
+    title: "No tenant-local auth library",
+    severity: "advisory",
+    remediation: "check whether @mesh-tech/authn already owns this; if the platform lacks it, file a platform item",
+    scope: "repo"
+  },
+  NO_AUTHZ_POINTER: {
+    gate: "H",
+    title: "Access surfaced through the Hub",
+    severity: "block",
+    remediation: 'end index.ts with new mesh.auth.AppAuthzPointer("authz", { env, mode, opsHubMetadata: compileOpsHubMetadata(schemaDef) }) (role-gating) or { env, mode, opsHubMetadataRef: schema.opsHubMetadataRef } (policy-engine)',
+    scope: "app"
+  },
+  METADATA_UNPUBLISHED: {
+    gate: "H",
+    title: "Ops-hub metadata published",
+    severity: "block",
+    remediation: "export compileOpsHubMetadata(schemaDef) with mesh.exports.Export (role-gating) or let SpiceDBSchema publish it (policy-engine)",
+    scope: "app"
+  },
+  IAC_GRANTS: {
+    gate: "H",
+    title: "No role grants in IaC",
+    severity: "block",
+    remediation: "remove the per-user grant map; grant roles from the Hub (App \u2192 Access \u2192 Users)",
+    scope: "app"
+  },
+  POINTER_PROJECT_OVERRIDE: {
+    gate: "H",
+    title: "Pointer publishes the env's project",
+    severity: "advisory",
+    remediation: "drop `zitadel:` from AppAuthzPointer and pass `zitadelAppProjectId: identity.projectId` to AppEnvironment \u2014 the override is the Hub's",
+    scope: "app"
+  },
+  PASSWORD_STORE: {
+    gate: "H",
+    title: "No app-side credentials",
+    severity: "block",
+    remediation: "delete the password code; the Hub creates sign-in users with a one-time temporary password",
+    scope: "app"
+  },
+  EMAIL_ALLOWLIST: {
+    gate: "H",
+    title: "No email allowlist for roles",
+    severity: "block",
+    remediation: "declare a role on the ZitadelAppIdentity and let the Hub grant it",
+    scope: "app"
+  },
+  USERS_TABLE: {
+    gate: "H",
+    title: "No hand-rolled users/roles table",
+    severity: "block",
+    remediation: "drop the table; people and roles live in Zitadel and are administered from the Hub",
+    scope: "app"
+  },
+  DOCS_SITE_PUBLIC: {
+    gate: "0.3",
+    title: "Docs site published through the Hub docs door",
+    // Advisory because the public shape is the compatibility path, not a
+    // fault: a site on it keeps deploying, and its tenant CI should read the
+    // route without going red.
+    severity: "advisory",
+    remediation: "publish the site through the Hub docs door \u2014 declare the API as a mesh.apps.AppApiSurface whose docs block builds this same site (docs: { spec, pages }), declare its readers' role on the ZitadelAppIdentity and grant it from the Hub's Access tab; then drop the hostname (docs.ingress on an API surface, where docs.auth, docs.basePath and docs.hubDoor do nothing either; the ingress with its auth and authentication on a mesh.apps.ApiDocs). The public shape keeps deploying until you do",
+    scope: "app"
+  },
+  DOCS_SITE_DEPRECATED: {
+    gate: "0.3",
+    title: "API docs published as a native docs source",
+    // Advisory for the deprecation window: the site keeps deploying unchanged
+    // (with a preview warning) until the minor that removes it with the door,
+    // so tenant CI reads the route without going red.
+    severity: "advisory",
+    remediation: 'run the `mesh docs convert` command the finding names (filled from the docs block) \u2014 it writes a starter docs.yaml beside the guides, moves each page\'s leading # heading into its front-matter title with --fix-pages, and prints every problem the deploy would refuse plus the exact edit; then declare docs: { spec, config: "<dir>/docs.yaml" } and drop pages, landingPage, playground, audience, site, split, zudoku and port. The Hub renders the source itself \u2014 no docs site, container or door \u2014 and `mesh docs preview <dir>` shows it locally. The site keeps deploying, with a preview warning, for one more minor release and is removed with the Hub docs door in the next',
+    scope: "app"
+  },
+  DOCS_AUDIENCE_IMPLICIT: {
+    gate: "H",
+    title: "Docs audience stated, not derived",
+    severity: "block",
+    remediation: 'declare the surface as mesh.apps.AppApiSurface or VendorApiSurface (or pass kind: "app" | "vendor"), or state docs: { audience: { roles: [\u2026] } }',
+    scope: "app"
+  },
+  DOCS_AUDIENCE_UNGRANTABLE: {
+    gate: "H",
+    title: "Docs audience grantable from the Hub",
+    severity: "block",
+    remediation: `declare every audience role on the ZitadelAppIdentity (roles: ["docs"]) so the Hub can grant it from the app's Access tab \u2014 the audience is published on the surface's registry entry as the reader set for the Hub to admit by, and a role nobody can be granted admits nobody`,
+    scope: "app"
+  },
+  EVENTS_ROLES_UNDECLARED: {
+    gate: "H",
+    title: "Events roles grantable from the Hub",
+    severity: "block",
+    remediation: "spread mesh.apps.EVENTS_PROJECT_ROLES into the ZitadelAppIdentity's roles (roles: [...schemaDef.coarseRoles, ...mesh.apps.EVENTS_PROJECT_ROLES]) so events:subscriber and events:admin are project roles the Hub's Access tab can grant \u2014 the primitive cannot add them, because the identity builds its roles before the events service exists and a role added afterwards is absent from the coarseRoles the Hub reads",
+    scope: "app"
+  },
+  DOCS_VENDOR_AUDIENCE_PARTNER: {
+    gate: "H",
+    title: "Vendor reference never partner-readable",
+    // The same declaration fails `pulumi up` (the primitive refuses it); the
+    // check says so where the program is written, not at the deploy.
+    severity: "block",
+    remediation: "drop docs.audience from the vendor surface \u2014 a vendor surface's site is the raw core API reference, read inside the Hub by holders of the vendor-docs add-on only; audience: { roles: [] } would declare it readable by every docs-role user of the tenant, which the Hub never honours and the deploy refuses",
+    scope: "app"
+  }
+};
+var APP_CHECK_CODES = Object.keys(APP_CHECK_RULES);
+var SRC_EXT = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".mjs", ".jsx"]);
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".generated", "test", "tests", "__tests__", "fixtures", "scripts"]);
+var NON_SERVICE_DIRS = /* @__PURE__ */ new Set([
+  "docs",
+  "scripts",
+  "lib",
+  "libs",
+  "migrations",
+  "test",
+  "tests",
+  "node_modules",
+  "infra",
+  "mocks",
+  "skills",
+  "prisma"
+]);
+function rel(root, abs) {
+  return path2.relative(root, abs).split(path2.sep).join("/");
+}
+function isDir(p) {
+  try {
+    return fs2.statSync(p).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function readText(p) {
+  try {
+    return fs2.readFileSync(p, "utf8");
+  } catch {
+    return "";
+  }
+}
+function srcFiles(dir) {
+  const out = [];
+  const walk = (d) => {
+    let entries;
+    try {
+      entries = fs2.readdirSync(d, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      const p = path2.join(d, e.name);
+      if (e.isDirectory()) {
+        if (SKIP_DIRS.has(e.name) || e.name.startsWith("scenario")) continue;
+        walk(p);
+        continue;
+      }
+      if (!e.isFile()) continue;
+      if (!SRC_EXT.has(path2.extname(e.name))) continue;
+      if (/\.(test|spec)\./.test(e.name) || /\.config\./.test(e.name) || e.name === "build.mjs") continue;
+      out.push(p);
+    }
+  };
+  walk(dir);
+  return out.sort();
+}
+function isTestHarness(name) {
+  return name.startsWith("test-") || name.endsWith("-test");
+}
+function isUiDir(name) {
+  return ["ui", "web", "frontend", "client", "portal-ui", "app"].includes(name) || name.endsWith("-ui");
+}
+function serviceDirs(app) {
+  let entries;
+  try {
+    entries = fs2.readdirSync(app, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  return entries.filter((e) => e.isDirectory() && !NON_SERVICE_DIRS.has(e.name) && !e.name.startsWith(".") && !isTestHarness(e.name)).map((e) => path2.join(app, e.name)).sort();
+}
+function authzSurface(app) {
+  const hits = [];
+  const walk = (d) => {
+    let entries;
+    try {
+      entries = fs2.readdirSync(d, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      const p = path2.join(d, e.name);
+      if (e.isDirectory()) {
+        if (["node_modules", "dist", "build"].includes(e.name)) continue;
+        walk(p);
+        continue;
+      }
+      if (!e.isFile()) continue;
+      if (!/\.(ts|tsx|yaml|sql)$/.test(e.name) || /\.(test|spec)\.tsx?$/.test(e.name) || e.name.endsWith(".d.ts")) continue;
+      const lines = readText(p).split("\n");
+      lines.forEach((text, i) => {
+        if (/^\s*(\/\/|\*|\/\*|#|--)/.test(text)) return;
+        hits.push({ file: p, line: i + 1, text });
+      });
+    }
+  };
+  walk(app);
+  return hits;
+}
+var RE_HTML = /from ["']hono\/(html|jsx)["']|react-dom\/server|\bc\.html\(|<!doctype html|<!DOCTYPE html/;
+var RE_OIDC = /openid-client|code_verifier|authorization_code|buildAuthorizeUrl|end_session/;
+var RE_COOKIE = /setCookie\(|hono\/cookie|Set-Cookie/;
+var RE_LOGGER = /from ["'](pino|hono\/logger|winston|bunyan)["']|require\(["'](pino|winston|bunyan)["']\)|^[^/*]*\bconsole\.(log|info|warn|error)\(/;
+var RE_EXPOSURE = /ZitadelAppIdentity|createOAuthMiddleware|createAuthorizationMiddleware|zitadelJwtScheme|createAuthzMiddleware|bearerAuth|type: *"oidc"|^\s+auth: *\{|_ROLES *= *\{|coarseRoles|ZITADEL_(AUDIENCE|CLIENT_ID)|OIDC_CLIENT_ID|zitadel\.(ApplicationOidc|ApplicationApi|Project|UserGrant)\(|mesh\.apps\.EventsService\(/;
+var RE_POINTER = /AppAuthzPointer/;
+var RE_METADATA = /compileOpsHubMetadata|ops-hub-metadata|SpiceDBSchema/;
+var RE_IAC_GRANT = /userId: *"[0-9]{6,}"/;
+var RE_POINTER_OVERRIDE = /\bzitadel: *\{\s*projectId\b/;
+var RE_PASSWORD = /(^|[^a-z])(bcrypt|argon2)|password_hash|passwordHash|hashPassword|temporaryPassword.*(send|mail)|(send|mail).*temporaryPassword/;
+var RE_ALLOWLIST = /ADMIN_EMAILS|ALLOWED_EMAILS|allowedEmails|adminEmails/;
+var RE_USERS_TABLE = /create table (if not exists )?"?(users|roles|user_roles|permissions)"?/i;
+var RE_SURFACE_NEW = /new\s+mesh\.apps\.(ApiSurface|AppApiSurface|VendorApiSurface|Integration)\s*\(/g;
+var RE_APIDOCS_NEW = /new\s+mesh\.apps\.ApiDocs\s*\(/g;
+var RE_IDENTITY_NEW = /new\s+mesh\.auth\.(ZitadelAppIdentity)\s*\(/g;
+var RE_EVENTS_NEW = /new\s+mesh\.apps\.(EventsService)\s*\(/g;
+var EVENTS_PROJECT_ROLES = ["events:subscriber", "events:admin"];
+var RE_IDENTITY_BINDING = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::[^=]+)?=\s*new\s+mesh\.auth\.ZitadelAppIdentity\s*\(/g;
+var DEFAULT_PARTNER_DOCS_ROLES = ["docs"];
+function stringList(value) {
+  if (!value) return void 0;
+  const text = value.trim();
+  if (!text.startsWith("[") || !text.endsWith("]")) return void 0;
+  const out = [];
+  for (const entry of splitTopLevel(text.slice(1, -1))) {
+    const item = stripLeadingComments(entry).trim();
+    if (!item) continue;
+    const m = /^(["'])((?:(?!\1).)*)\1$/.exec(stripTrailingComments(item));
+    if (!m) return void 0;
+    out.push(m[2]);
+  }
+  return out;
+}
+var DOCS_SITE_FIELDS = ["pages", "playground", "audience", "basePath", "ingress", "auth"];
+var DOCS_SITE_RETIRED_FIELDS = ["auth", "ingress", "basePath", "hubDoor"];
+function balancedSpan(text, open) {
+  const closers = { "(": ")", "{": "}", "[": "]" };
+  const stack = [];
+  let quote;
+  for (let i = open; i < text.length; i++) {
+    const ch = text[i];
+    if (quote) {
+      if (ch === "\\") i++;
+      else if (ch === quote) quote = void 0;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      quote = ch;
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "/") {
+      const eol = text.indexOf("\n", i);
+      if (eol === -1) return "";
+      i = eol;
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "*") {
+      const end = text.indexOf("*/", i + 2);
+      if (end === -1) return "";
+      i = end + 1;
+      continue;
+    }
+    if (closers[ch]) stack.push(closers[ch]);
+    else if (ch === ")" || ch === "}" || ch === "]") {
+      if (stack.pop() !== ch) return "";
+      if (stack.length === 0) return text.slice(open, i + 1);
+    }
+  }
+  return "";
+}
+function splitTopLevel(inner) {
+  const parts = [];
+  let depth = 0;
+  let quote;
+  let start = 0;
+  for (let i = 0; i < inner.length; i++) {
+    const ch = inner[i];
+    if (quote) {
+      if (ch === "\\") i++;
+      else if (ch === quote) quote = void 0;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      quote = ch;
+      continue;
+    }
+    if (ch === "/" && inner[i + 1] === "/") {
+      const eol = inner.indexOf("\n", i);
+      if (eol === -1) break;
+      i = eol;
+      continue;
+    }
+    if (ch === "/" && inner[i + 1] === "*") {
+      const end = inner.indexOf("*/", i + 2);
+      if (end === -1) break;
+      i = end + 1;
+      continue;
+    }
+    if (ch === "(" || ch === "{" || ch === "[") depth++;
+    else if (ch === ")" || ch === "}" || ch === "]") depth--;
+    else if (ch === "," && depth === 0) {
+      parts.push(inner.slice(start, i));
+      start = i + 1;
+    }
+  }
+  const last = inner.slice(start);
+  if (last.trim()) parts.push(last);
+  return parts;
+}
+var RE_PROPERTY = /^(?:"([^"]+)"|'([^']+)'|([A-Za-z_$][\w$]*))\s*(?::\s*([\s\S]*))?$/;
+function stripLeadingComments(entry) {
+  let text = entry;
+  for (; ; ) {
+    const next = text.replace(/^\s*(?:\/\/[^\n]*(?:\n|$)|\/\*[\s\S]*?\*\/)/, "");
+    if (next === text) return text;
+    text = next;
+  }
+}
+function stripTrailingComments(value) {
+  let out = "";
+  let depth = 0;
+  let quote;
+  for (let i = 0; i < value.length; i++) {
+    const ch = value[i];
+    if (quote) {
+      out += ch;
+      if (ch === "\\") {
+        out += value[i + 1] ?? "";
+        i++;
+      } else if (ch === quote) quote = void 0;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      quote = ch;
+      out += ch;
+      continue;
+    }
+    if (depth === 0 && ch === "/" && value[i + 1] === "/") {
+      const eol = value.indexOf("\n", i);
+      if (eol === -1) break;
+      i = eol;
+      out += "\n";
+      continue;
+    }
+    if (depth === 0 && ch === "/" && value[i + 1] === "*") {
+      const end = value.indexOf("*/", i + 2);
+      if (end === -1) break;
+      i = end + 1;
+      continue;
+    }
+    if (ch === "(" || ch === "{" || ch === "[") depth++;
+    else if (ch === ")" || ch === "}" || ch === "]") depth--;
+    out += ch;
+  }
+  return out.trim();
+}
+function topLevelProperties(objectText) {
+  const props = /* @__PURE__ */ new Map();
+  if (!objectText.startsWith("{") || !objectText.endsWith("}")) return props;
+  for (const entry of splitTopLevel(objectText.slice(1, -1))) {
+    const text = stripLeadingComments(entry).trim();
+    if (!text || text.startsWith("...")) continue;
+    const m = RE_PROPERTY.exec(text);
+    if (!m) continue;
+    const key = m[1] ?? m[2] ?? m[3];
+    props.set(key, stripTrailingComments(m[4] ?? key));
+  }
+  return props;
+}
+function objectLiteralOf(value, program) {
+  if (!value) return void 0;
+  if (value.startsWith("{")) return balancedSpan(value, 0) || void 0;
+  const id = /^[A-Za-z_$][\w$]*$/.exec(value)?.[0];
+  if (!id) return void 0;
+  const decl = new RegExp(`\\bconst\\s+${id}\\s*(?::[^=]+)?=\\s*\\{`).exec(program);
+  return decl ? balancedSpan(program, decl.index + decl[0].length - 1) || void 0 : void 0;
+}
+function optionsObject(body, program) {
+  for (const arg of splitTopLevel(body.slice(1, -1))) {
+    const trimmed = stripTrailingComments(stripLeadingComments(arg).trim());
+    if (trimmed.startsWith("{")) return balancedSpan(trimmed, 0) || void 0;
+    if (/^[A-Za-z_$][\w$]*$/.test(trimmed)) {
+      const resolved = objectLiteralOf(trimmed, program);
+      if (resolved) return resolved;
+    }
+  }
+  return void 0;
+}
+function surfaceDeclarations(text, pattern = RE_SURFACE_NEW) {
+  const out = [];
+  for (const m of text.matchAll(pattern)) {
+    const body = balancedSpan(text, m.index + m[0].length - 1);
+    if (!body) continue;
+    out.push({ ctor: m[1] ?? "ApiDocs", body, line: text.slice(0, m.index).split("\n").length });
+  }
+  return out;
+}
+function isWritten(value) {
+  return value !== void 0 && value !== "undefined";
+}
+function hasIngress(value) {
+  return isWritten(value) && !/^(null|false)$/.test(value);
+}
+function stringLiteral(value) {
+  const m = /^(["'`])((?:(?!\1)[^\\$]|\\.)*)\1$/.exec(stripTrailingComments(value?.trim() ?? ""));
+  return m ? m[2] : void 0;
+}
+function docsConvertCommand(docs, program) {
+  const words = ["mesh docs convert --spec", stringLiteral(docs.get("spec")) ?? "<spec>"];
+  const pagesValue = docs.get("pages");
+  if (isWritten(pagesValue)) {
+    const list = pagesValue.trim().startsWith("[") ? splitTopLevel(pagesValue.trim().slice(1, -1)) : [pagesValue];
+    const first = list.map((e) => stripLeadingComments(e).trim()).find((e) => e !== "") ?? "";
+    const dir = first.startsWith("{") ? topLevelProperties(objectLiteralOf(first, program) ?? first).get("dir") : first;
+    words.push("--pages", stringLiteral(dir) ?? "<pages>");
+  }
+  const landing = docs.get("landingPage");
+  if (isWritten(landing) && landing.trim() !== "false") words.push("--landing", stringLiteral(landing) ?? "<landing>");
+  return words.join(" ");
+}
+function docsSiteFindings(text) {
+  const findings = [];
+  for (const decl of surfaceDeclarations(text)) {
+    const options = optionsObject(decl.body, text);
+    if (!options) continue;
+    const args = topLevelProperties(options);
+    const docsText = objectLiteralOf(args.get("docs"), text);
+    if (!docsText) continue;
+    const docs = topLevelProperties(docsText);
+    if (isWritten(docs.get("config"))) continue;
+    if (docs.get("site") === "false") continue;
+    if (docs.get("site") !== "true" && !DOCS_SITE_FIELDS.some((f) => docs.has(f))) continue;
+    findings.push({
+      code: "DOCS_SITE_DEPRECATED",
+      line: decl.line,
+      why: `mesh.apps.${decl.ctor} builds a docs site from its docs block \u2014 deprecated for a native docs source the Hub renders itself (docs.config, a docs.yaml); convert with \`${docsConvertCommand(docs, text)}\``
+    });
+    const retired = DOCS_SITE_RETIRED_FIELDS.filter((f) => isWritten(docs.get(f)));
+    if (retired.length > 0) {
+      const named = retired.map((f) => `docs.${f}`).join(", ");
+      findings.push({
+        code: "DOCS_SITE_PUBLIC",
+        line: decl.line,
+        why: `mesh.apps.${decl.ctor} declares a docs site with ${named} \u2014 deprecated: the Hub docs door is the path this site is published on, and it is already built for it (no hostname, no sign-in and no door switch of its own), so the primitive ignores ${retired.length > 1 ? "them" : "it"}`
+      });
+    }
+    const kindStated = decl.ctor === "AppApiSurface" || decl.ctor === "VendorApiSurface" || args.has("kind");
+    if (!kindStated && !docs.has("audience")) {
+      findings.push({
+        code: "DOCS_AUDIENCE_IMPLICIT",
+        line: decl.line,
+        why: `mesh.apps.${decl.ctor} declares a docs site but neither its kind nor its audience \u2014 who the Hub admits through the door would fall out of the name heuristic, and a vendor surface must never default to partner-readable that way`
+      });
+    }
+    if (statedKind(decl, args) === "vendor" && docs.has("audience")) {
+      const audience = objectLiteralOf(docs.get("audience"), text);
+      const roles = audience ? stringList(topLevelProperties(audience).get("roles")) : void 0;
+      if (roles !== void 0 && roles.length === 0) {
+        findings.push({
+          code: "DOCS_VENDOR_AUDIENCE_PARTNER",
+          line: decl.line,
+          why: `mesh.apps.${decl.ctor} declares a vendor surface's docs site with audience: { roles: [] } \u2014 partner-readable by every docs-role user of the tenant; a vendor's spec is the raw core API, its site is read by holders of the Hub's vendor-docs add-on only, and the deploy refuses this declaration`
+        });
+      }
+    }
+    const httpText = objectLiteralOf(topLevelProperties(objectLiteralOf(args.get("surfaces"), text) ?? "{}").get("http"), text);
+    for (const f of docsAudienceUngrantable(text, decl, args, docs, httpText)) findings.push(f);
+  }
+  for (const decl of surfaceDeclarations(text, RE_APIDOCS_NEW)) {
+    const options = optionsObject(decl.body, text);
+    if (!options) continue;
+    const args = topLevelProperties(options);
+    if (!hasIngress(args.get("ingress"))) continue;
+    findings.push({
+      code: "DOCS_SITE_PUBLIC",
+      line: decl.line,
+      why: `mesh.apps.ApiDocs is published on an ingress \u2014 deprecated: the Hub docs door is the path a docs site is published on, and it opens for the API surface that declares the site. The hostname still deploys, with a preview warning, as the compatibility path`
+    });
+  }
+  return findings;
+}
+function statedKind(decl, args) {
+  if (decl.ctor === "AppApiSurface") return "app";
+  if (decl.ctor === "VendorApiSurface") return "vendor";
+  return /^["']([a-z]+)["']$/.exec(args.get("kind") ?? "")?.[1];
+}
+function programIdentities(text) {
+  const identities = [];
+  for (const d of surfaceDeclarations(text, RE_IDENTITY_NEW)) {
+    const options = optionsObject(d.body, text);
+    if (!options) continue;
+    const binding = [...text.matchAll(RE_IDENTITY_BINDING)].find(
+      (m) => text.indexOf(d.body, m.index) === m.index + m[0].length - 1
+    )?.[1];
+    identities.push({ binding, options: topLevelProperties(options) });
+  }
+  return identities;
+}
+function declaredProjectRoles(identity) {
+  const rolesText = identity.options.get("roles");
+  const coarseText = identity.options.get("coarseRoles");
+  if (rolesText !== void 0) return stringList(rolesText);
+  if (coarseText !== void 0) return stringList(coarseText);
+  return [];
+}
+function eventsRoleFindings(text) {
+  const findings = [];
+  const identities = programIdentities(text);
+  for (const decl of surfaceDeclarations(text, RE_EVENTS_NEW)) {
+    const options = optionsObject(decl.body, text);
+    if (!options) continue;
+    const args = topLevelProperties(options);
+    if (args.get("enabled") === "false") continue;
+    if (identities.length === 0) {
+      continue;
+    }
+    const identityText = objectLiteralOf(args.get("identity"), text);
+    const projectExpr = identityText ? topLevelProperties(identityText).get("projectId") : void 0;
+    const projectRoot = projectExpr ? /^([A-Za-z_$][\w$]*)\.projectId\b/.exec(projectExpr.trim())?.[1] : void 0;
+    const identity = (projectRoot ? identities.find((id) => id.binding === projectRoot) : void 0) ?? (identities.length === 1 ? identities[0] : void 0);
+    if (!identity) continue;
+    const declared = declaredProjectRoles(identity);
+    if (!declared) continue;
+    const missing = EVENTS_PROJECT_ROLES.filter((r) => !declared.includes(r));
+    if (missing.length === 0) continue;
+    findings.push({
+      code: "EVENTS_ROLES_UNDECLARED",
+      line: decl.line,
+      why: `mesh.apps.EventsService is declared but the app's ZitadelAppIdentity does not declare ${missing.map((r) => `"${r}"`).join(" or ")} \u2014 the events service authorizes bearer callers by these project roles, and a role the identity never declares cannot be granted from the Hub's Access tab, so no subscriber can be admitted`
+    });
+  }
+  return findings;
+}
+function docsAudienceUngrantable(text, decl, args, docs, httpText) {
+  const findings = [];
+  let roles;
+  if (docs.has("audience")) {
+    const audience = objectLiteralOf(docs.get("audience"), text);
+    roles = audience ? stringList(topLevelProperties(audience).get("roles")) : void 0;
+  } else if (statedKind(decl, args) === "app") {
+    roles = DEFAULT_PARTNER_DOCS_ROLES;
+  }
+  if (!roles || roles.length === 0) return findings;
+  const identities = programIdentities(text);
+  if (identities.length === 0) return findings;
+  const docsAuth = objectLiteralOf(docs.get("auth"), text);
+  const clientExpr = (docsAuth ? topLevelProperties(docsAuth).get("clientId") : void 0) ?? (httpText ? topLevelProperties(objectLiteralOf(topLevelProperties(httpText).get("auth"), text) ?? "{}").get("clientId") : void 0);
+  const clientRoot = clientExpr ? /^([A-Za-z_$][\w$]*)\.(?:clientIds|applications)\./.exec(clientExpr.trim())?.[1] : void 0;
+  const identity = (clientRoot ? identities.find((id) => id.binding === clientRoot) : void 0) ?? (identities.length === 1 ? identities[0] : void 0);
+  if (!identity) return findings;
+  const declared = declaredProjectRoles(identity);
+  if (declared) {
+    for (const role of roles) {
+      if (declared.includes(role)) continue;
+      findings.push({
+        code: "DOCS_AUDIENCE_UNGRANTABLE",
+        line: decl.line,
+        why: `the docs audience gates on role "${role}", which the app's ZitadelAppIdentity does not declare in roles \u2014 the Hub cannot grant it, so no one can read the site`
+      });
+    }
+  }
+  return findings;
+}
+function listApps(root) {
+  const apps = [];
+  const appsDir = path2.join(root, "apps");
+  if (isDir(appsDir)) {
+    for (const e of fs2.readdirSync(appsDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      if (!e.isDirectory()) continue;
+      const d = path2.join(appsDir, e.name);
+      if (fs2.existsSync(path2.join(d, "index.ts")) || fs2.existsSync(path2.join(d, "Pulumi.yaml"))) apps.push(rel(root, d));
+    }
+  }
+  if (fs2.existsSync(path2.join(root, "index.ts")) && fs2.existsSync(path2.join(root, "Pulumi.yaml"))) apps.push(".");
+  return apps;
+}
+function probeResolution(root, appRel) {
+  return resolveProgramImports(path2.resolve(root, appRel), { root, label: appRel === "." ? "this app" : appRel });
+}
+function scanApp(root, appRel, resolution = probeResolution(root, appRel)) {
+  const app = path2.resolve(root, appRel);
+  const index = path2.join(app, "index.ts");
+  const findings = [];
+  const hit = (code, p, why) => {
+    findings.push({ code, path: p, why });
+  };
+  const hasProgram = fs2.existsSync(index) || fs2.existsSync(path2.join(app, "Pulumi.yaml"));
+  if (!hasProgram) return findings;
+  const entry = programEntry(app);
+  for (const bad of resolution.findings) {
+    const chain = [...bad.via, bad.specifier].join(" \u2192 ");
+    const at = rel(root, entry ?? index);
+    hit("UNRESOLVABLE_IMPORT", at, `${chain} does not resolve from this app (imported by ${bad.importer}) \u2014 ${bad.fix}`);
+  }
+  if (fs2.existsSync(index)) {
+    const indexRel = rel(root, index);
+    let servesHtml = false;
+    let hasUiService = false;
+    for (const svc of serviceDirs(app)) {
+      const svcName = path2.basename(svc);
+      if (isUiDir(svcName)) {
+        hasUiService = true;
+        continue;
+      }
+      for (const f of srcFiles(svc)) {
+        let why = "";
+        if (/\.(tsx|jsx)$/.test(f)) why = `JSX view file inside the ${svcName} service`;
+        else if (RE_HTML.test(readText(f))) why = `renders HTML inside the ${svcName} service`;
+        if (why) {
+          servesHtml = true;
+          hit("UI_IN_API", rel(root, f), `${why} \u2014 a browser UI is its own mesh.apps.Service (apps/<app>/ui)`);
+        }
+      }
+    }
+    if (servesHtml && !hasUiService) {
+      hit("NO_UI_SERVICE", indexRel, 'the app serves HTML but declares no ui/ service \u2014 add apps/<app>/ui + new mesh.apps.Service("ui", \u2026)');
+    }
+    if (!/env\.register\(|\.annotate\(/.test(readText(index))) {
+      hit("NO_REGISTER", indexRel, "never calls env.register({\u2026}) \u2014 the Hub cannot list this app");
+    }
+    for (const f of docsSiteFindings(readText(index))) hit(f.code, `${indexRel}:${f.line}`, f.why);
+    for (const f of eventsRoleFindings(readText(index))) hit(f.code, `${indexRel}:${f.line}`, f.why);
+    for (const svc of serviceDirs(app)) {
+      for (const f of srcFiles(svc)) {
+        const text = readText(f);
+        if (RE_OIDC.test(text) && RE_COOKIE.test(text)) {
+          hit("CUSTOM_SESSION_AUTH", rel(root, f), 'app-written OIDC + cookie session \u2014 protect the UI service with auth: { provider: "mesh" } instead');
+        }
+      }
+    }
+    for (const svc of serviceDirs(app)) {
+      for (const f of srcFiles(svc)) {
+        const lines = readText(f).split("\n");
+        const i = lines.findIndex((l) => RE_LOGGER.test(l) && !l.includes("mesh-tech/logger"));
+        if (i === -1) continue;
+        hit("NON_PLATFORM_LOGGER", `${rel(root, f)}:${i + 1}`, `logs outside @mesh-tech/logger (${lines[i]?.trim() ?? ""})`);
+      }
+    }
+  }
+  const surface = authzSurface(app);
+  const first = (re) => surface.find((h) => re.test(h.text));
+  const exposure = first(RE_EXPOSURE);
+  const pointer = first(RE_POINTER);
+  const metadata = first(RE_METADATA);
+  const appLabel = appRel === "." ? "(root)" : path2.basename(appRel);
+  if (exposure && !pointer) {
+    const at = surface.find((h) => RE_EXPOSURE.test(h.text) && /(^|\/)index\.ts$/.test(h.file)) ?? exposure;
+    hit(
+      "NO_AUTHZ_POINTER",
+      rel(root, at.file),
+      `${appLabel} authenticates callers or declares roles but publishes no mesh.auth.AppAuthzPointer \u2014 the Hub's Access tab is blank for this app`
+    );
+  } else if (exposure && pointer && !metadata) {
+    hit(
+      "METADATA_UNPUBLISHED",
+      rel(root, pointer.file),
+      "AppAuthzPointer present but no compiled ops-hub metadata (opsHubMetadata: compileOpsHubMetadata(schemaDef) on the pointer, or a SpiceDBSchema) \u2014 the Hub's create-key and role catalog 409 METADATA_UNPUBLISHED"
+    );
+  }
+  const anti = (code, re, why) => {
+    const files = [...new Set(surface.filter((h) => re.test(h.text)).map((h) => h.file))].sort().slice(0, 3);
+    for (const f of files) hit(code, rel(root, f), why);
+  };
+  anti("IAC_GRANTS", RE_IAC_GRANT, "per-user role grant baked into IaC \u2014 grants belong in the Hub (Access \u2192 Users), not in a config redeploy");
+  anti(
+    "POINTER_PROJECT_OVERRIDE",
+    RE_POINTER_OVERRIDE,
+    "AppAuthzPointer is given a `zitadel:` override \u2014 an app binds its project with AppEnvironment's zitadelAppProjectId so every consumer of env.zitadel agrees; the override is reserved for the Hub"
+  );
+  anti(
+    "PASSWORD_STORE",
+    RE_PASSWORD,
+    "password storage or hashing \u2014 Zitadel owns credentials; the Hub creates sign-in users with a one-time temporary password"
+  );
+  anti("EMAIL_ALLOWLIST", RE_ALLOWLIST, "email allowlist standing in for roles \u2014 declare a role and let the Hub grant it");
+  anti("USERS_TABLE", RE_USERS_TABLE, "hand-rolled users/roles table \u2014 people and roles live in Zitadel and are administered from the Hub");
+  return findings;
+}
+function isPlatformPackage(dir) {
+  try {
+    const pkg = JSON.parse(readText(path2.join(dir, "package.json")));
+    return typeof pkg.name === "string" && pkg.name.startsWith("@mesh-tech/");
+  } catch {
+    return false;
+  }
+}
+function scanRepo(root) {
+  const findings = [];
+  for (const parent of ["libs", "packages"]) {
+    const dir = path2.join(root, parent);
+    if (!isDir(dir)) continue;
+    for (const e of fs2.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      if (!e.isDirectory() || !e.name.includes("auth")) continue;
+      const lib = path2.join(dir, e.name);
+      if (isPlatformPackage(lib)) continue;
+      const verifies = srcFiles(lib).filter((f) => f.endsWith(".ts")).some((f) => /introspect|jwtVerify|createRemoteJWKSet|from ["']jose["']/.test(readText(f)));
+      if (verifies) {
+        findings.push({
+          code: "LOCAL_AUTH_LIB",
+          path: rel(root, lib),
+          why: "tenant-local token verification \u2014 check whether @mesh-tech/authn already owns this"
+        });
+      }
+    }
+  }
+  return findings;
+}
+function resultFor(code, findings, unchecked = null) {
+  const rule = APP_CHECK_RULES[code];
+  const mine = findings.filter((f) => f.code === code);
+  if (code === "UNRESOLVABLE_IMPORT" && unchecked) {
+    return { status: "ok", summary: `gate ${rule.gate}: not checked \u2014 ${unchecked}` };
+  }
+  if (mine.length === 0) return { status: "ok", summary: `gate ${rule.gate}: no ${code} finding` };
+  return {
+    status: rule.severity === "block" ? "error" : "warn",
+    summary: `gate ${rule.gate}: ${code} \xD7 ${mine.length}`,
+    detail: mine.map((f) => `${f.path} \u2014 ${f.why}`).join("\n    "),
+    remediation: rule.remediation
+  };
+}
+function appContractChecks(scope) {
+  return APP_CHECK_CODES.filter((code) => APP_CHECK_RULES[code].scope === scope).map((code) => ({
+    id: code,
+    title: `${APP_CHECK_RULES[code].title} (${APP_CHECK_RULES[code].gate})`,
+    phases: ["ondemand", "preflight"],
+    run: async (ctx) => resultFor(code, ctx.findings, ctx.unchecked)
+  }));
+}
+async function runAppCheck(root, apps) {
+  if (!isDir(root)) throw new MeshCliError(`no such checkout: ${root}`);
+  const targets = apps && apps.length > 0 ? apps.map((a) => a.replace(/\/+$/, "")) : listApps(root);
+  for (const a of targets) {
+    if (!isDir(path2.resolve(root, a))) throw new MeshCliError(`no such app dir: ${a}`);
+  }
+  const scopes = [];
+  for (const app of targets) {
+    const resolution = probeResolution(root, app);
+    const ctx = { root, app, findings: scanApp(root, app, resolution), unchecked: resolution.unchecked };
+    const results = await runChecks(ctx, "ondemand", appContractChecks("app"));
+    scopes.push({ scope: app, ...jsonReport(results) });
+  }
+  const repoResults = await runChecks({ root, app: null, findings: scanRepo(root), unchecked: null }, "ondemand", appContractChecks("repo"));
+  scopes.push({ scope: "(repo)", ...jsonReport(repoResults) });
+  return { root, status: aggregateStatus(scopes.map((s) => ({ status: s.status, summary: "" }))), scopes };
+}
+function renderReport(report, opts) {
+  const out = [];
+  for (const scope of report.scopes) {
+    const shown = opts.verbose ? scope.checks : scope.checks.filter((c) => c.status !== "ok");
+    if (shown.length === 0 && !opts.verbose) continue;
+    out.push(`${ICONS[scope.status]} ${scope.scope}`);
+    out.push(
+      renderHuman(
+        shown.map((c) => ({
+          check: { id: c.id, title: `${c.id} \u2014 ${APP_CHECK_RULES[c.id]?.title ?? c.id}` },
+          result: { status: c.status, summary: c.summary, remediation: c.remediation ?? void 0, detail: c.detail ?? void 0 }
+        }))
+      ).split("\n").map((l) => `  ${l}`).join("\n")
+    );
+  }
+  out.push(`${ICONS[report.status]} app contract: ${report.status}`);
+  return out.filter(Boolean).join("\n");
+}
+function registerAppCommands(program) {
+  const app = program.command("app").description("Inspect a tenant app against the Mesh app contract");
+  app.command("check").description(
+    "Check tenant apps against the Mesh app contract (@mesh-tech/app-kit skills/apps/references/app-contract.md): a UI is its own service, the app registers with the Hub, sign-in goes through the platform proxy, logs go through @mesh-tech/logger, people/roles/keys are surfaced through the Hub, and the Pulumi program's imports resolve from the app directory. Exit 1 on any blocking finding \u2014 the same gate mesh create-app, tenant CI and the platform reviewer run. The import gate reads the installed dependency tree, so run it after the install; with no node_modules it reports itself not checked rather than met."
+  ).argument("[apps...]", "repo-relative app dirs to check (default: every apps/* with a Pulumi program)").option("--root <dir>", "checkout to scan (default: the enclosing git root)").option("--json", "machine-readable output (one report per app plus the repo-scoped checks)", false).option("--verbose", "also print the gates that passed", false).action(async (apps, opts) => {
+    const root = path2.resolve(opts.root ?? resolveTargetRoot());
+    const report = await runAppCheck(root, apps);
+    if (opts.json) {
+      emitJsonPayload({ ok: report.status !== "error", ...report });
+    } else {
+      if (report.scopes.length === 1) logInfo(`no apps/* with a Pulumi program under ${root}`);
+      console.log(renderReport(report, { verbose: opts.verbose }));
+    }
+    if (report.status === "error") {
+      if (!opts.json) logError("the app contract is not met \u2014 every \u2717 above names the gate, the file and the replacement");
+      process.exitCode = 1;
+    }
+  });
+}
+
+// packages/mesh-cli/src/utils/scaffold-versions.ts
+import { execFileSync } from "child_process";
+var SCAFFOLD_PACKAGE_LINES = {
+  "@mesh-tech/app-kit": "^1.45.0",
+  "@mesh-tech/esm-bundle": "^0.1.1",
+  // The events service versions with the primitive that deploys it, not with
+  // the lockstep group, so it carries its own floor.
+  "@mesh-tech/events-service": "^0.1.0",
+  // The operator UI EventsService deploys when it is installed; its own line.
+  "@mesh-tech/events-ui": "^0.1.0",
+  // Likewise authz: it is not in the `fixed` group in .changeset/config.json,
+  // so the lockstep range resolves to a major line it has never published.
+  "@mesh-tech/authz": "^1.19.0"
+};
+var SCAFFOLD_TOOLCHAIN = {
+  "@types/node": "^24.2.1",
+  tsx: "^4.20.4",
+  typescript: "^5.9.2"
+};
+function isPrerelease(range) {
+  return /[-+]/.test(range.replace(/^\^/, ""));
+}
+function toCaretRange(version) {
+  const trimmed = version.trim();
+  return /^\d+\.\d+\.\d+(?:[-+].*)?$/.test(trimmed) ? `^${trimmed}` : null;
+}
+function resolvePublishedRange(pkg, cwd) {
+  try {
+    const out = execFileSync("npm", ["view", pkg, "version"], {
+      cwd,
+      encoding: "utf-8",
+      timeout: 15e3,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const range = toCaretRange(out);
+    if (range && !isPrerelease(range)) return { range, resolved: true };
+  } catch {
+  }
+  return { range: SCAFFOLD_PACKAGE_LINES[pkg], resolved: false };
+}
+
+// packages/mesh-cli/src/commands/create-app.ts
+var __filename = fileURLToPath(import.meta.url);
+var __dirname = path3.dirname(__filename);
+var packageRoot = findPackageRoot(__dirname);
+var TEMPLATES = {
+  workflow: "Hono API + Temporal worker + hello workflow (Pulumi/app-kit)",
+  "api-auth": "Hono API with platform auth: authn (Zitadel JWT) + authz (SpiceDB)",
+  "api-role-gating": "Hono API with role-gating authz: authn (Zitadel JWT) + coarse-role checks on Zitadel project roles, in-process (no SpiceDB)",
+  "external-service": "Hono API calling a third-party vendor via platform-managed credentials (ExternalService + mock for `mesh dev --externals`)"
+};
+var REMOVED_TEMPLATES = {
+  "temporal-api-worker": "renamed to 'workflow'",
+  "api-web-db": "removed (SST-based) \u2014 use --primitives service,database"
+};
+var PRIMITIVES = {
+  service: "HTTP Service (API with Hono)",
+  database: "Database (PostgreSQL via Prisma)",
+  temporal: "Temporal (workflow orchestration)",
+  bucket: "S3 Bucket (file storage)",
+  events: "Events and webhooks (publish, subscriptions, signed delivery)"
+};
+var HUB_ACCOUNTS = {
+  mesh: "159923586610"
+};
+var PLATFORM_MONOREPO_NAME = "mesh-platform";
+function isInsidePlatformMonorepo(dir) {
+  let cur = path3.resolve(dir);
+  while (cur !== path3.dirname(cur)) {
+    if (fs3.existsSync(path3.join(cur, "pnpm-workspace.yaml"))) {
+      try {
+        const pkg = JSON.parse(fs3.readFileSync(path3.join(cur, "package.json"), "utf-8"));
+        if (pkg?.name === PLATFORM_MONOREPO_NAME) return true;
+      } catch {
+      }
+    }
+    cur = path3.dirname(cur);
+  }
+  return false;
+}
+function resolveDeployerRoleArn(tenant, platformName, env) {
+  const account = HUB_ACCOUNTS[platformName] ?? "ACCOUNT_ID";
+  return `arn:aws:iam::${account}:role/${tenant}-${env}-apps-deployer`;
+}
+var VALID_PRIMITIVES = Object.keys(PRIMITIVES);
+function shouldBootstrapAppsRepo(cwd) {
+  return fs3.existsSync(path3.join(cwd, ".git")) && !isInsidePlatformMonorepo(cwd) && !fs3.existsSync(path3.join(cwd, "package.json")) && !fs3.existsSync(path3.join(cwd, "tenants")) && !fs3.existsSync(path3.join(cwd, "apps"));
+}
+function bootstrapAppsRepo(cwd, tenant) {
+  const templateDir = path3.join(packageRoot, "templates", "apps-repo");
+  const registryAccount = HUB_ACCOUNTS.mesh;
+  const context = {
+    repoName: path3.basename(cwd),
+    tenant,
+    tenantTitle: tenant.split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" "),
+    registryUrl: `https://mesh-platform-${registryAccount}.d.codeartifact.us-east-2.amazonaws.com/npm/mesh-packages/`,
+    intentRange: INTENT_RANGE
+  };
+  const staging = fs3.mkdtempSync(path3.join(os.tmpdir(), "mesh-apps-repo-"));
+  try {
+    copyTemplate(templateDir, staging, context);
+    for (const [from, to] of [
+      ["gitignore", ".gitignore"],
+      ["npmrc", ".npmrc"]
+    ]) {
+      const p = path3.join(staging, from);
+      if (fs3.existsSync(p)) fs3.renameSync(p, path3.join(staging, to));
+    }
+    const created = [];
+    for (const entry of fs3.readdirSync(staging)) {
+      const dest = path3.join(cwd, entry);
+      if (fs3.existsSync(dest)) continue;
+      fs3.cpSync(path3.join(staging, entry), dest, { recursive: true });
+      created.push(entry);
+    }
+    fs3.mkdirSync(path3.join(cwd, "apps"), { recursive: true });
+    created.push("apps/");
+    return created;
+  } finally {
+    fs3.rmSync(staging, { recursive: true, force: true });
+  }
+}
+function ensureWorkspaceGlobs(root, required) {
+  const file = path3.join(root, "pnpm-workspace.yaml");
+  if (!fs3.existsSync(file)) return [];
+  const text = fs3.readFileSync(file, "utf-8");
+  let declared;
+  try {
+    declared = parseYaml2(text)?.packages ?? [];
+  } catch {
+    return [];
+  }
+  const missing = required.filter((glob) => !declared.includes(glob));
+  if (missing.length === 0) return [];
+  const lines = text.split("\n");
+  const start = lines.findIndex((line) => /^packages:\s*$/.test(line));
+  if (start === -1) return [];
+  let end = start;
+  for (let i = start + 1; i < lines.length; i++) {
+    const line = lines[i] ?? "";
+    const isEntry = /^\s+-\s/.test(line);
+    if (isEntry || /^\s*#/.test(line) || line.trim() === "") {
+      if (isEntry) end = i;
+      continue;
+    }
+    break;
+  }
+  const indent = (lines[end] ?? "").match(/^(\s*)-/)?.[1] ?? "  ";
+  lines.splice(end + 1, 0, ...missing.map((glob) => `${indent}- ${glob}`));
+  fs3.writeFileSync(file, lines.join("\n"));
+  return missing;
+}
+function workspaceGlobForApp(root, appDir) {
+  const rel2 = path3.relative(root, appDir).split(path3.sep).join("/");
+  if (rel2 === "" || rel2.split("/")[0] === "..") return null;
+  return `${path3.posix.dirname(rel2)}/*/*`;
+}
+function maybeBootstrapAppsRepo(cwd, tenant, test) {
+  if (test || !shouldBootstrapAppsRepo(cwd)) return;
+  const created = bootstrapAppsRepo(cwd, tenant);
+  logInfo(`Standalone apps repo detected \u2014 bootstrapped workspace files: ${created.join(", ")}`);
+}
+Handlebars.registerHelper("titleCase", (str) => {
+  return str.split("-").map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
+});
+function isInteractive() {
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY);
+}
+async function promptForOptions(options) {
+  const { default: input } = await import("@inquirer/input");
+  const { default: checkbox } = await import("@inquirer/checkbox");
+  const tenant = options.tenant ?? await input({
+    message: "Tenant name",
+    default: findMeshJson(process.cwd())?.data.tenant,
+    validate: (v) => v.length > 0 ? true : "Tenant name is required"
+  });
+  const name = options.name ?? await input({
+    message: "App name",
+    validate: (v) => v.length > 0 ? true : "App name is required"
+  });
+  let primitives;
+  if (options.primitives) {
+    primitives = parsePrimitives(options.primitives);
+  } else {
+    primitives = await checkbox({
+      message: "Select primitives",
+      choices: VALID_PRIMITIVES.map((p) => ({
+        name: PRIMITIVES[p],
+        value: p,
+        checked: p === "service"
+        // service checked by default
+      }))
+    });
+    if (primitives.length === 0) {
+      primitives = ["service"];
+    }
+  }
+  if (primitives.includes("database") && !primitives.includes("service")) {
+    primitives.push("service");
+    logInfo("Added 'service' \u2014 database files live in the api/ directory.");
+  }
+  if (primitives.includes("bucket") && !primitives.includes("service")) {
+    primitives.push("service");
+    logInfo("Added 'service' \u2014 bucket requires an API service for S3 helpers.");
+  }
+  if (primitives.includes("events") && !primitives.includes("service")) {
+    primitives.push("service");
+    logInfo("Added 'service' \u2014 the events publisher lives in the api/ directory.");
+  }
+  return { tenant, name, primitives };
+}
+function copyTemplate(srcDir, destDir, context) {
+  const entries = fs3.readdirSync(srcDir, { withFileTypes: true });
+  for (const entry of entries) {
+    const srcPath = path3.join(srcDir, entry.name);
+    let destName = entry.name;
+    if (destName.endsWith(".hbs")) {
+      destName = destName.slice(0, -4);
+    }
+    if (destName.includes("{{")) {
+      destName = Handlebars.compile(destName)(context);
+    }
+    const destPath = path3.join(destDir, destName);
+    if (entry.isDirectory()) {
+      fs3.mkdirSync(destPath, { recursive: true });
+      copyTemplate(srcPath, destPath, context);
+    } else if (entry.name.endsWith(".hbs")) {
+      const templateContent = fs3.readFileSync(srcPath, "utf-8");
+      const template = Handlebars.compile(templateContent);
+      const output = template(context);
+      fs3.writeFileSync(destPath, output);
+    } else {
+      fs3.copyFileSync(srcPath, destPath);
+    }
+  }
+}
+function parsePrimitives(input) {
+  const selected = input.split(",").map((s) => s.trim().toLowerCase());
+  const invalid = selected.filter(
+    (s) => !VALID_PRIMITIVES.includes(s)
+  );
+  if (invalid.length > 0) {
+    logError(`Unknown primitives: ${invalid.join(", ")}`);
+    logInfo(`Available primitives: ${VALID_PRIMITIVES.join(", ")}`);
+    process.exit(1);
+  }
+  return selected;
+}
+function describeNoAppsHome(cwd, tenant, baseDir, test) {
+  if (test || isInsidePlatformMonorepo(cwd)) {
+    return {
+      message: `Tenant directory not found: ${baseDir}/${tenant}/`,
+      hint: "Create the tenant directory first, or run from within it."
+    };
+  }
+  return {
+    message: `This directory is not a Mesh apps repo \u2014 no apps/ here${fs3.existsSync(path3.join(cwd, ".git")) ? "" : " and it is not a git repo"}.`,
+    hint: `Run: mesh init   (turns this folder into your ${tenant}-mesh-apps repo), or cd into that repo and re-run mesh create-app.`
+  };
+}
+function resolveAppDir(cwd, tenant, name, test) {
+  const baseDir = test ? "tests/tenants" : "tenants";
+  const possiblePaths = test ? [path3.join(cwd, baseDir, tenant, "apps")] : [
+    path3.join(cwd, baseDir, tenant, "apps"),
+    path3.join(cwd, "..", tenant, "apps"),
+    path3.join(cwd, "apps")
+  ];
+  let appsDir = possiblePaths.find((p) => fs3.existsSync(p));
+  if (!appsDir) {
+    appsDir = path3.join(cwd, baseDir, tenant, "apps");
+    if (!fs3.existsSync(path3.join(cwd, baseDir, tenant))) {
+      const { message, hint } = describeNoAppsHome(cwd, tenant, baseDir, test);
+      logError(message);
+      logInfo(hint);
+      process.exit(1);
+    }
+    if (!fs3.existsSync(appsDir)) {
+      logInfo(`Creating apps directory: ${appsDir}`);
+      fs3.mkdirSync(appsDir, { recursive: true });
+    }
+  }
+  return path3.join(appsDir, name);
+}
+function generateComposableApp(appDir, context) {
+  const fragmentsDir = path3.join(packageRoot, "fragments");
+  const baseDir = path3.join(fragmentsDir, "base");
+  if (!fs3.existsSync(baseDir)) {
+    logError(`Fragments directory not found: ${baseDir}`);
+    logInfo("Make sure the mesh-cli package is installed correctly.");
+    process.exit(1);
+  }
+  copyTemplate(baseDir, appDir, context);
+  if (context.service) {
+    const serviceDir = path3.join(fragmentsDir, "service");
+    if (!fs3.existsSync(serviceDir)) {
+      throw new Error(`Fragment directory not found: ${serviceDir}`);
+    }
+    copyTemplate(serviceDir, appDir, context);
+  }
+  if (context.database) {
+    const dbDir = path3.join(fragmentsDir, "database");
+    if (!fs3.existsSync(dbDir)) {
+      throw new Error(`Fragment directory not found: ${dbDir}`);
+    }
+    copyTemplate(dbDir, appDir, context);
+  }
+  if (context.temporal) {
+    const temporalDir = path3.join(fragmentsDir, "temporal");
+    if (!fs3.existsSync(temporalDir)) {
+      throw new Error(`Fragment directory not found: ${temporalDir}`);
+    }
+    copyTemplate(temporalDir, appDir, context);
+  }
+  if (context.bucket) {
+    const bucketDir = path3.join(fragmentsDir, "bucket");
+    if (!fs3.existsSync(bucketDir)) {
+      throw new Error(`Fragment directory not found: ${bucketDir}`);
+    }
+    copyTemplate(bucketDir, appDir, context);
+  }
+  if (context.events) {
+    const eventsDir = path3.join(fragmentsDir, "events");
+    if (!fs3.existsSync(eventsDir)) {
+      throw new Error(`Fragment directory not found: ${eventsDir}`);
+    }
+    copyTemplate(eventsDir, appDir, context);
+  }
+  const agentsDir = path3.join(fragmentsDir, "agents");
+  if (fs3.existsSync(agentsDir)) {
+    copyTemplate(agentsDir, appDir, context);
+  }
+}
+function registerCreateAppCommand(program) {
+  program.command("create-app").description("Scaffold a new tenant application").option("--tenant <tenant>", "Tenant name (e.g., acme)").option("--name <name>", "Application name (e.g., billing)").option(
+    "--template <template>",
+    `Legacy template: ${Object.keys(TEMPLATES).join(", ")}`
+  ).option(
+    "--primitives <primitives>",
+    `Comma-separated primitives: ${VALID_PRIMITIVES.join(", ")} (default: service)`
+  ).option("--test", "Create in tests/tenants/ directory", false).option(
+    "--skip-registry-check",
+    "Scaffold without checking that this machine can install @mesh-tech packages (offline use; run `mesh registry login` before `pnpm install`)",
+    false
+  ).action(async (options) => {
+    await ensureRegistryAccess(process.cwd(), options);
+    if (options.template) {
+      if (!options.tenant || !options.name) {
+        logError("--tenant and --name are required with --template");
+        process.exit(1);
+      }
+      await runLegacyTemplate(
+        options.tenant,
+        options.name,
+        options.template,
+        options.test
+      );
+      return;
+    }
+    let tenant;
+    let name;
+    let primitives;
+    const needsPrompt = !options.tenant || !options.name || !options.primitives;
+    if (needsPrompt && isInteractive()) {
+      const prompted = await promptForOptions(options);
+      tenant = prompted.tenant;
+      name = prompted.name;
+      primitives = prompted.primitives;
+    } else if (needsPrompt) {
+      options.tenant ??= findMeshJson(process.cwd())?.data.tenant;
+      if (!options.tenant) {
+        logError("--tenant is required (no TTY for interactive mode)");
+        process.exit(1);
+      }
+      if (!options.name) {
+        logError("--name is required (no TTY for interactive mode)");
+        process.exit(1);
+      }
+      tenant = options.tenant;
+      name = options.name;
+      primitives = options.primitives ? parsePrimitives(options.primitives) : ["service"];
+    } else {
+      tenant = options.tenant;
+      name = options.name;
+      primitives = parsePrimitives(options.primitives);
+    }
+    if (primitives.includes("database") && !primitives.includes("service")) {
+      primitives.push("service");
+      logInfo("Added 'service' \u2014 database files live in the api/ directory.");
+    }
+    if (primitives.includes("bucket") && !primitives.includes("service")) {
+      primitives.push("service");
+      logInfo("Added 'service' \u2014 bucket requires an API service for S3 helpers.");
+    }
+    if (primitives.includes("events") && !primitives.includes("service")) {
+      primitives.push("service");
+      logInfo("Added 'service' \u2014 the events publisher lives in the api/ directory.");
+    }
+    await runComposable(tenant, name, primitives, options.test);
+  });
+}
+var NO_REGISTRY_ACCESS_MESSAGE = "No registry access on this machine \u2014 @mesh-tech packages cannot be installed.\n  Run: mesh init\n       (sets up your tenant and signs you in to the package registry)\n  Scaffolding offline anyway? add --skip-registry-check";
+async function ensureRegistryAccess(cwd, options, preflight = registryPreflight) {
+  if (isInsidePlatformMonorepo(cwd)) return;
+  if (options.skipRegistryCheck) {
+    logWarn("Skipping the registry check \u2014 `pnpm install` will need `mesh registry login` first.");
+    return;
+  }
+  const pf = await preflight();
+  if (pf.state === "unreachable") {
+    logWarn(`Could not reach the package registry to verify access (${pf.detail ?? "unknown error"}) \u2014 continuing.`);
+    return;
+  }
+  if (pf.state !== "valid") {
+    throw new MeshCliError(NO_REGISTRY_ACCESS_MESSAGE);
+  }
+  logSuccess(`Registry access OK (${pf.email ?? "token valid"})`);
+}
+async function runLegacyTemplate(tenant, name, template, test) {
+  if (!Object.keys(TEMPLATES).includes(template)) {
+    const removed = REMOVED_TEMPLATES[template];
+    logError(`Unknown template: ${template}${removed ? ` (${removed})` : ""}`);
+    logInfo(`Available templates:`);
+    for (const [tplName, desc] of Object.entries(TEMPLATES)) {
+      console.log(`  ${tplName.padEnd(20)} - ${desc}`);
+    }
+    process.exit(1);
+  }
+  logInfo(`Creating app '${name}' for tenant '${tenant}'...`);
+  logInfo(`Template: ${template} (${TEMPLATES[template]})`);
+  if (test) {
+    logInfo("Creating in tests/ directory");
+  }
+  maybeBootstrapAppsRepo(process.cwd(), tenant, test);
+  const appDir = resolveAppDir(process.cwd(), tenant, name, test);
+  if (fs3.existsSync(appDir)) {
+    logError(`App directory already exists: ${appDir}`);
+    process.exit(1);
+  }
+  const templateDir = path3.join(packageRoot, "templates", template);
+  if (!fs3.existsSync(templateDir)) {
+    logError(`Template not found: ${templateDir}`);
+    process.exit(1);
+  }
+  fs3.mkdirSync(appDir, { recursive: true });
+  try {
+    copyTemplate(templateDir, appDir, { name, tenant });
+    logSuccess(`Created app at ${appDir}`);
+  } catch (error) {
+    logError(`Failed to create app: ${error}`);
+    fs3.rmSync(appDir, { recursive: true, force: true });
+    process.exit(1);
+  }
+  autoSyncSkills(appDir, name);
+  await checkScaffoldContract(appDir);
+  printLegacyNextSteps(appDir, template);
+}
+function autoSyncSkills(appDir, appName) {
+  const root = resolveTargetRoot(appDir);
+  try {
+    syncSkills(root);
+  } catch (err) {
+    logWarn(`Agent-skill sync skipped: ${err instanceof Error ? err.message : err} \u2014 run: mesh skills sync`);
+  }
+  try {
+    const seeded = seedAppSkill(root, appName, path3.relative(root, appDir));
+    if (seeded) logSuccess(`seeded: ${seeded} (yours to grow \u2014 not managed by mesh skills sync)`);
+  } catch (err) {
+    logWarn(`App skill stub skipped: ${err instanceof Error ? err.message : err}`);
+  }
+}
+async function checkScaffoldContract(appDir) {
+  const root = resolveTargetRoot(appDir);
+  const report = await runAppCheck(root, [path3.relative(root, appDir) || "."]);
+  if (report.status === "ok") {
+    logSuccess("app contract: met (mesh app check)");
+    return;
+  }
+  console.log(renderReport(report, { verbose: false }));
+  if (report.status === "warn") {
+    logSuccess("app contract: met \u2014 the \u26A0 lines above are advisories, not blocking findings (mesh app check)");
+    return;
+  }
+  if (report.status === "error") {
+    logError("the scaffold does not meet the Mesh app contract \u2014 this is a template defect; file a platform item and cite the \u2717 lines above");
+    process.exitCode = 1;
+  }
+}
+async function runComposable(tenant, name, primitives, test) {
+  logInfo(`Creating app '${name}' for tenant '${tenant}'...`);
+  logInfo(`Primitives: ${primitives.join(", ")}`);
+  if (test) {
+    logInfo("Creating in tests/ directory");
+  }
+  maybeBootstrapAppsRepo(process.cwd(), tenant, test);
+  const appDir = resolveAppDir(process.cwd(), tenant, name, test);
+  if (fs3.existsSync(appDir)) {
+    logError(`App directory already exists: ${appDir}`);
+    process.exit(1);
+  }
+  const region = "us-east-2";
+  const platformName = "mesh";
+  const platformEnv = "dev";
+  const workspaceDeps = isInsidePlatformMonorepo(appDir);
+  const repoRoot = resolveTargetRoot(process.cwd());
+  const mesh = workspaceDeps ? { range: "", resolved: true } : resolvePublishedRange("@mesh-tech/app-kit", repoRoot);
+  const esmBundle = workspaceDeps ? { range: "", resolved: true } : resolvePublishedRange("@mesh-tech/esm-bundle", repoRoot);
+  const eventsService = workspaceDeps || !primitives.includes("events") ? { range: "", resolved: true } : resolvePublishedRange("@mesh-tech/events-service", repoRoot);
+  const eventsUi = workspaceDeps || !primitives.includes("events") ? { range: "", resolved: true } : resolvePublishedRange("@mesh-tech/events-ui", repoRoot);
+  const authz = workspaceDeps || !primitives.includes("events") ? { range: "", resolved: true } : resolvePublishedRange("@mesh-tech/authz", repoRoot);
+  if (!workspaceDeps) {
+    logInfo(
+      mesh.resolved ? `@mesh-tech/* pinned to ${mesh.range} (current published line)` : `Registry lookup unavailable \u2014 pinning @mesh-tech/* to ${mesh.range}; run \`pnpm up @mesh-tech/*\` once you have registry auth`
+    );
+  }
+  const context = {
+    name,
+    tenant,
+    service: primitives.includes("service"),
+    database: primitives.includes("database"),
+    temporal: primitives.includes("temporal"),
+    bucket: primitives.includes("bucket"),
+    events: primitives.includes("events"),
+    region,
+    workspaceDeps,
+    meshRange: mesh.range,
+    esmBundleRange: esmBundle.range,
+    eventsServiceRange: eventsService.range,
+    eventsUiRange: eventsUi.range,
+    authzRange: authz.range,
+    typesNodeRange: SCAFFOLD_TOOLCHAIN["@types/node"],
+    tsxRange: SCAFFOLD_TOOLCHAIN.tsx,
+    typescriptRange: SCAFFOLD_TOOLCHAIN.typescript,
+    deployerRoleArn: resolveDeployerRoleArn(tenant, platformName, platformEnv)
+  };
+  fs3.mkdirSync(appDir, { recursive: true });
+  try {
+    generateComposableApp(appDir, context);
+    logSuccess(`Created app at ${appDir}`);
+  } catch (error) {
+    logError(`Failed to create app: ${error}`);
+    fs3.rmSync(appDir, { recursive: true, force: true });
+    process.exit(1);
+  }
+  const nested = fs3.readdirSync(appDir, { withFileTypes: true }).some((entry) => entry.isDirectory() && fs3.existsSync(path3.join(appDir, entry.name, "package.json")));
+  const glob = workspaceGlobForApp(repoRoot, appDir);
+  if (nested && glob) {
+    const added = ensureWorkspaceGlobs(repoRoot, [glob]);
+    if (added.length > 0) {
+      logInfo(`pnpm-workspace.yaml: added ${added.join(", ")} so the app's api/worker packages install`);
+    }
+  }
+  autoSyncSkills(appDir, name);
+  await checkScaffoldContract(appDir);
+  printComposableNextSteps(appDir, context);
+}
+function printLegacyNextSteps(appDir, _template) {
+  console.log("");
+  logSuccess("App created successfully!");
+  console.log("");
+  console.log("Next steps:");
+  console.log(`  cd ${appDir}`);
+  console.log("  pnpm install");
+  console.log("  pnpm mesh dev");
+  console.log("");
+  console.log("To deploy:");
+  console.log("  pnpm mesh deploy up");
+  console.log("");
+}
+function printComposableNextSteps(appDir, context) {
+  console.log("");
+  logSuccess("App created successfully!");
+  console.log("");
+  console.log("Generated:");
+  console.log("  index.ts          Pulumi app definition");
+  console.log("  AGENTS.md         AI agent instructions");
+  console.log("  CLAUDE.md         Bridges AGENTS.md into Claude Code (@AGENTS.md)");
+  if (context.service) {
+    console.log("  api/              HTTP service (Hono)");
+  }
+  if (context.temporal) {
+    console.log("  worker/           Temporal worker");
+  }
+  if (context.database) {
+    console.log("  prisma/           Database schema");
+  }
+  if (context.bucket) {
+    console.log("  api/src/storage.ts  S3 helpers");
+  }
+  console.log("");
+  for (const line of composableNextSteps(appDir, findMeshJson(process.cwd())?.data.platform ?? null)) {
+    console.log(line);
+  }
+}
+function composableNextSteps(appDir, platform) {
+  const common = [
+    "Next steps:",
+    `  cd ${appDir}`,
+    "  pnpm install",
+    "  mesh skills sync         # re-run once deps are installed: picks up package skills + Intent",
+    "  pnpm install             # again only if skills sync reports it added @tanstack/intent"
+  ];
+  const local = [
+    "  mesh start               # the local Mesh platform (once; Docker \u2014 from anywhere)",
+    "  mesh dev                 # run the app against it"
+  ];
+  const deploy = [
+    "  mesh stack init          # personal dev stack (deploy: false)",
+    "  mesh deploy up --yes     # deploy via the stack's deployer role"
+  ];
+  if (platform === null || platform === "local") {
+    return [...common, ...local, "", "When you deploy to a Mesh platform:", ...deploy];
+  }
+  return [...common, ...deploy, "  mesh dev                 # run locally against the platform"];
+}
+
+export {
+  registerAppCommands,
+  PLATFORM_MONOREPO_NAME,
+  isInsidePlatformMonorepo,
+  shouldBootstrapAppsRepo,
+  bootstrapAppsRepo,
+  ensureWorkspaceGlobs,
+  workspaceGlobForApp,
+  copyTemplate,
+  describeNoAppsHome,
+  resolveAppDir,
+  generateComposableApp,
+  registerCreateAppCommand,
+  NO_REGISTRY_ACCESS_MESSAGE,
+  ensureRegistryAccess,
+  composableNextSteps
+};