@mesh-tech/mesh-cli 0.38.1 → 0.40.0

package/dist/bin/{mesh.chunk-I6NXLXGC.js → mesh.chunk-2ASXJ5DO.js}

@@ -1,18 +1,28 @@
+import {
+  buildInstanceIndexValue,
+  discoverStackExternalServices,
+  instanceIndexSecretId,
+  instanceKeyFromSecretName,
+  isResourceNotFound,
+  parseInstanceIndex,
+  resolveSecretsContext,
+  setCommand
+} from "./mesh.chunk-YE2WIY3Y.js";
 import {
   cliReferenceStaleness,
   resolveCliRuntime,
   runPortalCommand
-} from "./mesh.chunk-HPYZWPRM.js";
+} from "./mesh.chunk-PZVI7V3J.js";
 import {
   registerAppCommands,
   registerCreateAppCommand
-} from "./mesh.chunk-2YRWJH5X.js";
+} from "./mesh.chunk-F44A3ACW.js";
 import {
   PLATFORM_SETUP_DEFAULTS
-} from "./mesh.chunk-TZAGJTKU.js";
+} from "./mesh.chunk-NSQJEX36.js";
 import {
   registerRegistryCommands
-} from "./mesh.chunk-IU2IWH6O.js";
+} from "./mesh.chunk-6AIG5OJM.js";
 import {
   registerSkillsCommands,
   resolveTargetRoot,
@@ -30,6 +40,7 @@ import {
   derivePlatformContext,
   detectContext,
   detectLocalTenant,
+  devSessionsRoot,
   ensureKubeconfig,
   findAppRoot,
   findRepoRoot,
@@ -40,6 +51,7 @@ import {
   getValidToken,
   idpEndpoints,
   mockIdpComposeEnv,
+  pickLaunchHostEnv,
   probeCredentials,
   pulumiStackOutput,
   readCredentials,
@@ -51,10 +63,10 @@ import {
   registerLoginCommand,
   registerVpnCommands,
   removeAllAliasContainers,
+  removeLocalAppSpiceDBs,
   resolveAwsCredentials,
   resolveHubPlatformName,
   resolvePulumiEnv,
-  resolveStackOption,
   resolveTemporalAuth,
   resolveWorktreeIdentity,
   rewriteDatabaseUrl,
@@ -65,7 +77,7 @@ import {
   waitForPort,
   worktreeStackName,
   writeEnvFile
-} from "./mesh.chunk-LMYPTJ2F.js";
+} from "./mesh.chunk-7HTKSUWR.js";
 import {
   COMPOSE_PROJECT,
   DEFAULT_HUB_PORT,
@@ -114,7 +126,7 @@ import {
   homeNpmrcPath,
   isNpmAuthError,
   probeRegistryToken
-} from "./mesh.chunk-KN4BZOYH.js";
+} from "./mesh.chunk-6SSOVZOI.js";
 import {
   createVcsFolderReader,
   deriveVcsBaseUrl,
@@ -913,7 +925,7 @@ async function psqlCommand(options) {
   const databaseUrl = await getDatabaseUrl(app.tenant, app.stage, { app: appName });
   const parsed = new URL(databaseUrl);
   const username = parsed.username;
-  const password2 = decodeURIComponent(parsed.password);
+  const password = decodeURIComponent(parsed.password);
   const database = parsed.pathname.slice(1);
   console.log("");
   logInfo(`Connecting to ${database} as ${username}...`);
@@ -923,7 +935,7 @@ async function psqlCommand(options) {
     ["-h", "localhost", "-p", "5432", "-U", username, "-d", database],
     {
       stdio: "inherit",
-      env: { ...process.env, PGPASSWORD: password2 }
+      env: { ...process.env, PGPASSWORD: password }
     }
   );
   psql.on("exit", (code) => {
@@ -1529,7 +1541,7 @@ var DOCS_PREVIEW_PORT = "4410";
 var CLI_REFERENCE_PATH = "docs/portal/generated/cli-reference.md";
 async function renderCliReference() {
   const [{ createProgram: createProgram2 }, { extractCliReference, renderCliReferenceMarkdown }] = await Promise.all([
-    import("./mesh.program-BIDQBSSI.js"),
+    import("./mesh.program-K5JQXEHX.js"),
     import("./mesh.cli-reference-H3TOPIET.js")
   ]);
   return renderCliReferenceMarkdown(extractCliReference(createProgram2()));
@@ -1601,7 +1613,7 @@ function registerDocsCommand(program) {
     "Serve the Mesh docs locally \u2014 detached in a tmux session by default; the working tree in a mesh-platform checkout, or the published @mesh-tech/docs artifact (role-gated registry) anywhere else"
   ).option("-v, --version <version>", "docs version to serve (== the @mesh-tech/* baseline it describes); default: latest", void 0).option("-p, --port <port>", "port to serve on (0 picks a free one)", "4400").option("--dev", "in a checkout: run the Zudoku dev server (HMR) in the foreground, for authoring", false).option("--foreground", "serve in the foreground (the agent/CI path; automatic when not a TTY)", false).action(
     (opts) => guarded(async () => {
-      const { runDocsStart } = await import("./mesh.start-MPQFIEMH.js");
+      const { runDocsStart } = await import("./mesh.start-KZ5L6SOJ.js");
       await runDocsStart({
         repoRoot: findRepoRoot(process.cwd()),
         version: opts.version,
@@ -1613,13 +1625,13 @@ function registerDocsCommand(program) {
   );
   docs.command("stop").description(`Stop the detached docs server (the tmux session "${"mesh-docs"}")`).action(
     () => guarded(async () => {
-      const { runDocsStop } = await import("./mesh.start-MPQFIEMH.js");
+      const { runDocsStop } = await import("./mesh.start-KZ5L6SOJ.js");
       runDocsStop();
     })()
   );
   docs.command("serve-static", { hidden: true }).option("--root <dir>", "built site root", "").option("--port <port>", "port", "4400").action(
     (opts) => guarded(async () => {
-      const { runDocsServeStatic } = await import("./mesh.start-MPQFIEMH.js");
+      const { runDocsServeStatic } = await import("./mesh.start-KZ5L6SOJ.js");
       await runDocsServeStatic(opts);
     })()
   );
@@ -1662,7 +1674,7 @@ function registerDocsCommand(program) {
   );
   docs.command("list").description("List the published docs versions (each is an @mesh-tech/* baseline)").action(
     () => guarded(async () => {
-      const { runDocsList } = await import("./mesh.start-MPQFIEMH.js");
+      const { runDocsList } = await import("./mesh.start-KZ5L6SOJ.js");
       await runDocsList();
     })()
   );
@@ -1672,7 +1684,6 @@ function registerDocsCommand(program) {
 import { execFileSync as execFileSync2 } from "node:child_process";
 import * as fs4 from "node:fs";
 import * as net3 from "node:net";
-import * as os from "node:os";
 import * as path4 from "node:path";
 import chalk from "chalk";
 var HUB_SESSION_PREFIX = "mesh-hub-dev";
@@ -1705,7 +1716,7 @@ function killInstructions(targets) {
 var DEFAULT_HUB_UI_PORT = Number(DEFAULT_HUB_PORT);
 var DEFAULT_HUB_API_PORT = 3002;
 function devSessionsDir() {
-  return path4.join(os.tmpdir(), "mesh-dev-sessions");
+  return devSessionsRoot();
 }
 function listDevSessions(dir = devSessionsDir()) {
   if (!fs4.existsSync(dir)) return [];
@@ -1967,7 +1978,7 @@ function isPortListening(port) {
   });
 }
 function hubEnvDir(sessionName) {
-  return path4.join(os.tmpdir(), "mesh-dev-sessions", sessionName);
+  return path4.join(devSessionsRoot(), sessionName);
 }
 function parsePort(raw, fallback, source) {
   if (raw === void 0) return fallback;
@@ -2067,6 +2078,7 @@ ${killInstructions(targets).join("\n")}`,
   const apiDir = path4.join(platformDir, "apps", "hub", "api");
   const uiDir = path4.join(platformDir, "apps", "hub", "ui");
   execFileSync2("tmux", ["new-session", "-d", "-s", hubSession, "-n", "api", "-c", apiDir]);
+  const hostEnv = pickLaunchHostEnv(process.env);
   if (!assembled.apiEnv.DEV_USER_TOKEN_URL && assembled.apiEnv.DEV_USER_ID_TOKEN) {
     const platform = session.state.devOutput.platform;
     const credContext = `mesh.${platform.env}`;
@@ -2076,11 +2088,19 @@ ${killInstructions(targets).join("\n")}`,
     execFileSync2("tmux", ["set-option", "-t", `${hubSession}:token-server`, "remain-on-exit", "on"], {
       stdio: "ignore"
     });
+    const tokenServerEnvFile = path4.join(hubEnvDir(hubSession), "token-server.env.sh");
+    writeEnvFile(tokenServerEnvFile, hostEnv);
     execFileSync2("tmux", [
       "send-keys",
       "-t",
       `${hubSession}:token-server`,
-      `npx mesh dev __token-server ${tokenPort} ${credContext}`,
+      buildLaunchCommand(
+        tokenServerEnvFile,
+        platformDir,
+        `npx mesh dev __token-server ${tokenPort} ${credContext}`,
+        void 0,
+        hostEnv
+      ),
       "Enter"
     ]);
     for (let i = 0; i < 15 && !await isPortListening(tokenPort); i++) {
@@ -2092,14 +2112,14 @@ ${killInstructions(targets).join("\n")}`,
   }
   const launch = (window, dir, env, cmd, createWindow) => {
     const envFile = path4.join(hubEnvDir(hubSession), `${window}.env.sh`);
-    writeEnvFile(envFile, env);
+    writeEnvFile(envFile, { ...hostEnv, ...env });
     if (createWindow) {
       execFileSync2("tmux", ["new-window", "-t", hubSession, "-n", window, "-c", dir]);
     }
     execFileSync2("tmux", ["set-option", "-t", `${hubSession}:${window}`, "remain-on-exit", "on"], {
       stdio: "ignore"
     });
-    execFileSync2("tmux", ["send-keys", "-t", `${hubSession}:${window}`, buildLaunchCommand(envFile, dir, cmd), "Enter"]);
+    execFileSync2("tmux", ["send-keys", "-t", `${hubSession}:${window}`, buildLaunchCommand(envFile, dir, cmd, void 0, hostEnv), "Enter"]);
   };
   launch("api", apiDir, assembled.apiEnv, "pnpm dev", false);
   launch("ui", uiDir, assembled.uiEnv, `pnpm dev --port ${uiPort} --strictPort`, true);
@@ -2140,11 +2160,11 @@ import chalk2 from "chalk";
 import * as fs5 from "fs";
 import * as path5 from "path";
 async function setupPrompts() {
-  const [{ default: input2 }, { default: confirm }] = await Promise.all([
+  const [{ default: input }, { default: confirm }] = await Promise.all([
     import("@inquirer/input"),
     import("@inquirer/confirm")
   ]);
-  return { input: (args) => input2(args), confirm: (args) => confirm(args) };
+  return { input: (args) => input(args), confirm: (args) => confirm(args) };
 }
 var LOCAL_HUB_API = "http://localhost:4568";
 function isLocalContext(context) {
@@ -2177,7 +2197,7 @@ async function registryChecks(args) {
   const { fix, profile } = args;
   const probe = args.probe ?? probeRegistryToken;
   const login = args.login ?? (async () => {
-    const { runRegistryLogin } = await import("./mesh.registry-7P4MGXEK.js");
+    const { runRegistryLogin } = await import("./mesh.registry-JLQYFUNN.js");
     await runRegistryLogin(void 0, profile ? { profile } : {});
   });
   const REGISTRY_FIX = registryFixCommand(profile);
@@ -2333,7 +2353,7 @@ function registerInitCommands(program) {
     `nothing deployed yet \u2014 scaffold a tenant platform repo for \`<tenant>.<env>\` (default env: ${PLATFORM_SETUP_DEFAULTS.env}) and print its deploy sequence`
   ).option("--region <region>", `--new-platform: AWS region (default: ${PLATFORM_SETUP_DEFAULTS.region})`).option("--domain <domain>", "--new-platform: base public domain you control; the core stack creates the zone {env}.{domain} and stops at the mesh-gateway Ingress until you delegate its NS records. No default \u2014 a placeholder scaffolds a zone that can never validate").option("--state-bucket <bucket>", "--new-platform: Pulumi state S3 bucket (default: {tenant}-mesh-platform-pulumi-state)").option("--create-state-bucket", "--new-platform: create the state bucket (versioned) if it does not exist").option("--no-create-state-bucket", "--new-platform: never create the state bucket; print the aws command instead").option("--dir <path>", "--new-platform: where to scaffold the platform repo (default: ./{tenant}-mesh-platform)").option("--device", "device-code sign-in for the registry and platform steps (headless / SSH)").option("--profile <aws-profile>", "AWS profile this machine uses: read the registry without the broker (deployers only), and the profile a --new-platform stack config references").option("--skip-repo", "do not bootstrap, check or record anything in the current repo", false).option("--yes", "accept every default and never prompt", false).option("--json", "one JSON document on stdout ({tenant, mode, steps, next}); human output on stderr", false).action(
     async (opts) => {
-      const { runInitWizard } = await import("./mesh.wizard-ZJE4S6PC.js");
+      const { runInitWizard } = await import("./mesh.wizard-FCTT55KI.js");
       const code = await runInitWizard(opts);
       if (code !== 0) process.exitCode = code;
     }
@@ -2349,7 +2369,7 @@ function registerInitCommands(program) {
         throw new MeshCliError(`Invalid tenant name '${tenant}' (lowercase alphanumeric + dashes).`);
       }
       const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
-      const { resolvePlatformSetup, scaffoldPlatformRepo, ensureStateBucket, renderPlatformNextSteps } = await import("./mesh.platform-setup-CJXE3BCP.js");
+      const { resolvePlatformSetup, scaffoldPlatformRepo, ensureStateBucket, renderPlatformNextSteps } = await import("./mesh.platform-setup-2ZDMHRCI.js");
       const setup = await resolvePlatformSetup(tenant, opts, {
         prompts: interactive && !opts.yes ? await setupPrompts() : void 0,
         interactive
@@ -2415,7 +2435,7 @@ function registerInitCommands(program) {
 // packages/mesh-cli/src/commands/install-shim.ts
 import { execFileSync as execFileSync3 } from "child_process";
 import * as fs6 from "fs";
-import * as os2 from "os";
+import * as os from "os";
 import * as path6 from "path";
 function shimScript() {
   return `#!/bin/sh
@@ -2489,7 +2509,7 @@ exit 1
 `;
 }
 function defaultShimDir() {
-  return path6.join(os2.homedir(), ".local", "bin");
+  return path6.join(os.homedir(), ".local", "bin");
 }
 function dirOnPath(dir, pathEnv) {
   if (!pathEnv) return false;
@@ -2520,7 +2540,7 @@ function registerInstallShimCommand(program) {
     } else {
       logInfo("Bare `mesh <cmd>` now runs the local source of whatever workspace you're in.");
     }
-    const diagPath = path6.join(os2.tmpdir(), "mesh-shim-selftest.log");
+    const diagPath = path6.join(os.tmpdir(), "mesh-shim-selftest.log");
     let stdout = "";
     let stderr = "";
     let status = 0;
@@ -2574,7 +2594,7 @@ import chalk3 from "chalk";
 // packages/mesh-cli/src/commands/local/hub-local.ts
 import { execFile, execFileSync as execFileSync4 } from "child_process";
 import * as fs7 from "fs";
-import * as os3 from "os";
+import * as os2 from "os";
 import * as path7 from "path";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
@@ -2585,7 +2605,7 @@ function cacheDir() {
   return meshCacheDir("hub-local");
 }
 function npmrcPath() {
-  const p = path7.join(os3.homedir(), ".npmrc");
+  const p = path7.join(os2.homedir(), ".npmrc");
   if (!fs7.existsSync(p) || !fs7.readFileSync(p, "utf-8").includes("codeartifact")) {
     throw new MeshCliError(
       "The local Hub builds from the published @mesh-tech/hub tarball, which needs registry auth.",
@@ -2615,7 +2635,7 @@ function ensureHubAuthImage() {
   logSuccess(`Built ${HUB_AUTH_IMAGE}`);
 }
 function hasRegistryAuth() {
-  const p = path7.join(os3.homedir(), ".npmrc");
+  const p = path7.join(os2.homedir(), ".npmrc");
   return fs7.existsSync(p) && fs7.readFileSync(p, "utf-8").includes("codeartifact");
 }
 function localHubVersion() {
@@ -2870,8 +2890,8 @@ function withHubCatalogRefs(pointer, metadataRef) {
   };
 }
 async function publishHubAuthzCatalog(compiled, awsConfig) {
-  const { SSMClient: SSMClient4, GetParameterCommand, PutParameterCommand } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4(awsConfig);
+  const { SSMClient: SSMClient3, GetParameterCommand, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient3(awsConfig);
   await ssm.send(
     new PutParameterCommand({
       Name: HUB_OPS_HUB_METADATA_PARAM,
@@ -3238,6 +3258,7 @@ Re-running start from here may recreate shared containers with this checkout's c
         { remediation: { command: "mesh stop --force   # stop it anyway" } }
       );
     }
+    removeLocalAppSpiceDBs();
     const aliases = removeAllAliasContainers();
     if (aliases.length > 0) logInfo(`Removed ${aliases.length} local docs alias container(s).`);
     const args = ["down"];
@@ -3342,6 +3363,72 @@ Re-running start from here may recreate shared containers with this checkout's c
   });
 }
 
+// packages/mesh-cli/src/commands/mcp/index.ts
+import * as path9 from "node:path";
+function registerMcpCommands(program) {
+  const mcp = program.command("mcp").description("Manifest-driven MCP Integrations (reviewed tool catalogs)");
+  mcp.command("review <manifest>").description(
+    "Fetch a manifest's MCP server tools/list with the Integration's credential, diff it against the checked-in snapshot, and write the snapshot on confirmation"
+  ).option("--yes", "Write without prompting").option("--dry-run", "Report the diff and write nothing").option("--stack <stack>", "Pulumi stack name (override detection)").option("-t, --tenant <tenant>", "Tenant to address (override detection)").option("--region <region>", "AWS region (default: us-east-2)").option(
+    "--secret <id>",
+    "Secrets Manager secret holding the Integration credential (default: the deployed ExternalService's own secret)"
+  ).action(async (manifest, opts) => {
+    const { runMcpReviewCommand } = await import("./mesh.review-command-LUVZQN2T.js");
+    try {
+      await runMcpReviewCommand(manifest, opts);
+    } catch (error) {
+      logError(error instanceof Error ? error.message : String(error));
+      process.exit(1);
+    }
+  });
+  mcp.command("generate <manifest>").description(
+    "Write the worker package mesh.apps.McpIntegration deploys (package.json, main.ts, openapi.json) from a manifest and its reviewed snapshot; commit it with the lockfile"
+  ).option("--out <dir>", "Package directory (default: <manifest dir>/.mesh-mcp/<name>)").option(
+    "--refresh-versions",
+    "Re-resolve every dependency version instead of keeping the committed ones"
+  ).action(async (manifest, opts) => {
+    const { generateMcpServeDir } = await import("./mesh.generate-XSM4C6FQ.js");
+    const { workspaceMembership } = await import("./mesh.workspace-membership-DI3YQGEK.js");
+    try {
+      const { serveDir, written } = generateMcpServeDir(manifest, {
+        ...opts.out ? { out: opts.out } : {},
+        ...opts.refreshVersions ? { refreshVersions: true } : {}
+      });
+      if (written.length === 0) {
+        logInfo(`${serveDir} is current.`);
+      } else {
+        logInfo(`Wrote ${written.join(", ")} in ${serveDir}.`);
+        if (written.includes("package.json")) {
+          logInfo("Run `pnpm install` so the lockfile records it, then commit both.");
+        }
+      }
+      const membership = workspaceMembership(serveDir);
+      if (!membership.workspaceFile) {
+        logWarn(
+          `No pnpm-workspace.yaml above ${serveDir}: the worker image installs this package from a pnpm workspace, so it must be in one.`
+        );
+      } else if (!membership.member && membership.suggestedGlob) {
+        const { ensureWorkspaceGlobs } = await import("./mesh.create-app-Z3RKSTBO.js");
+        const added = ensureWorkspaceGlobs(path9.dirname(membership.workspaceFile), [
+          membership.suggestedGlob
+        ]);
+        if (added.length > 0) {
+          logInfo(
+            `${membership.workspaceFile}: added ${added.join(", ")} so \`pnpm install\` records the package.`
+          );
+        } else {
+          logWarn(
+            `${serveDir} is not a member of the workspace in ${membership.workspaceFile}, so \`pnpm install\` will not record it. Add "${membership.suggestedGlob}" to its packages.`
+          );
+        }
+      }
+    } catch (error) {
+      logError(error instanceof Error ? error.message : String(error));
+      process.exit(1);
+    }
+  });
+}
+
 // packages/mesh-cli/src/commands/secrets/index.ts
 import { Option } from "commander";
 
@@ -3461,441 +3548,14 @@ async function execCommand2(args) {
   });
 }
 
-// packages/mesh-cli/src/commands/secrets/set.ts
-import {
-  SSMClient,
-  GetParametersByPathCommand
-} from "@aws-sdk/client-ssm";
-import {
-  SecretsManagerClient as SecretsManagerClient4,
-  GetSecretValueCommand as GetSecretValueCommand4,
-  PutSecretValueCommand,
-  CreateSecretCommand
-} from "@aws-sdk/client-secrets-manager";
-import input from "@inquirer/input";
-import password from "@inquirer/password";
-
-// packages/secrets/src/index.ts
-import {
-  SecretsManagerClient as SecretsManagerClient3,
-  GetSecretValueCommand as GetSecretValueCommand3
-} from "@aws-sdk/client-secrets-manager";
-var INSTANCE_INDEX_SUFFIX = ".index";
-function instanceIndexSecretId(secretPrefix) {
-  return `${secretPrefix}/${INSTANCE_INDEX_SUFFIX}`;
-}
-function isInstanceKey(key) {
-  return key.length > 0 && !key.includes("/") && !key.startsWith(".") && !key.endsWith(".config");
-}
-function instanceKeyFromSecretName(secretPrefix, secretName) {
-  if (!secretName.startsWith(`${secretPrefix}/`)) return null;
-  const key = secretName.slice(secretPrefix.length + 1);
-  return isInstanceKey(key) ? key : null;
-}
-function parseInstanceIndex(secretString) {
-  let parsed;
-  try {
-    parsed = JSON.parse(secretString);
-  } catch {
-    parsed = void 0;
-  }
-  const instances = parsed?.instances;
-  if (!Array.isArray(instances) || !instances.every((k) => typeof k === "string")) {
-    throw new Error(
-      `Malformed instance index (expected {"instances": string[]}). Rebuild it with: mesh secrets reindex external/<name>`
-    );
-  }
-  return instances.filter(isInstanceKey);
-}
-function buildInstanceIndexValue(keys) {
-  const instances = [...new Set([...keys].filter(isInstanceKey))].sort();
-  const index = { version: 1, instances };
-  return JSON.stringify(index);
-}
-
-// packages/mesh-cli/src/commands/secrets/context.ts
-function resolveSecretsContext(opts, stackOpt = resolveStackOption(opts)) {
-  return detectContext(stackOpt, { tenant: opts.tenant, stack: stackOpt });
-}
-
-// packages/mesh-cli/src/commands/secrets/set.ts
-async function ensureAwsCredentialsForStack(stack) {
-  if (process.env.AWS_ACCESS_KEY_ID || process.env.AWS_SESSION_TOKEN) return;
-  if (!stack) return;
-  const appRoot = findAppRoot(process.cwd());
-  if (!appRoot) return;
-  const roleArn = readStackConfig(appRoot, stack, "mesh:deployerRole");
-  if (!roleArn) return;
-  const resolved = await resolveAwsCredentials(roleArn, appRoot, stack);
-  if (resolved) {
-    Object.assign(process.env, resolved.env);
-    delete process.env.AWS_PROFILE;
-  }
-}
-function normalizeEntry(raw) {
-  if (raw.type === "group" && raw.fields) {
-    return {
-      type: "group",
-      name: raw.name ?? "",
-      description: raw.description ?? "",
-      fields: normalizeFields(raw.fields)
-    };
-  }
-  return {
-    type: "field",
-    name: raw.name ?? "",
-    description: raw.description ?? "",
-    secret: raw.secret ?? false,
-    optional: raw.optional ?? false
-  };
-}
-function normalizeFields(raw) {
-  return Object.fromEntries(
-    Object.entries(raw).map(([key, value]) => [key, normalizeEntry(value)])
-  );
-}
-async function discoverExternalServices(ssmClient, tenant, platformEnv) {
-  const services = /* @__PURE__ */ new Map();
-  const basePath = `/mesh-platform/${tenant}/${platformEnv}`;
-  let nextToken;
-  do {
-    const response = await ssmClient.send(
-      new GetParametersByPathCommand({
-        Path: basePath,
-        Recursive: true,
-        NextToken: nextToken
-      })
-    );
-    for (const param of response.Parameters ?? []) {
-      if (!param.Name || !param.Value) continue;
-      const metaMatch = param.Name.match(
-        /\/external-services\/([^/]+)\/meta$/
-      );
-      if (metaMatch?.[1]) {
-        const serviceName = metaMatch[1];
-        const meta = JSON.parse(param.Value);
-        const existing = services.get(serviceName);
-        services.set(serviceName, { ...existing, meta });
-      }
-      const credMatch = param.Name.match(
-        /\/external-services\/([^/]+)\/credentials$/
-      );
-      if (credMatch?.[1]) {
-        const serviceName = credMatch[1];
-        const raw = JSON.parse(param.Value);
-        const schema = {
-          fields: normalizeFields(raw.fields),
-          keyedBy: raw.keyedBy
-        };
-        const existing = services.get(serviceName);
-        if (existing) {
-          existing.schema = schema;
-        } else {
-          services.set(serviceName, { meta: {}, schema });
-        }
-      }
-    }
-    nextToken = response.NextToken;
-  } while (nextToken);
-  return services;
-}
-async function promptFields(fields, existing, result, opts, depth = 0) {
-  for (const [fieldKey, entry] of Object.entries(fields)) {
-    if (entry.type === "group") {
-      const indent = "  ".repeat(depth);
-      console.error("");
-      console.error(`${indent}\u2500\u2500 ${entry.name} \u2500\u2500`);
-      const existingGroup = existing[fieldKey] ?? {};
-      const resultGroup = {};
-      await promptFields(entry.fields, existingGroup, resultGroup, opts, depth + 1);
-      result[fieldKey] = resultGroup;
-    } else {
-      if (entry.optional && !opts.all) {
-        const existingVal2 = existing[fieldKey];
-        if (existingVal2 !== void 0 && existingVal2 !== "") {
-          result[fieldKey] = existingVal2;
-        }
-        continue;
-      }
-      const existingVal = existing[fieldKey];
-      const hasExisting = !!existingVal && existingVal !== "";
-      const message = entry.description ? `${entry.name} (${entry.description})` : entry.name;
-      const label = entry.optional ? `${message} [optional]` : message;
-      let value;
-      if (entry.secret) {
-        value = await password({ message: label, mask: "*" });
-        if (!value && hasExisting) {
-          value = existingVal;
-        }
-      } else {
-        value = await input({
-          message: label,
-          default: hasExisting ? existingVal : void 0
-        });
-      }
-      result[fieldKey] = value || (hasExisting ? existingVal : "");
-    }
-  }
-}
-function displaySummary(fields, values, depth = 0) {
-  const indent = "  ".repeat(depth);
-  for (const [key, entry] of Object.entries(fields)) {
-    if (entry.type === "group") {
-      console.error(`${indent}${entry.name}:`);
-      const group = values[key] ?? {};
-      displaySummary(entry.fields, group, depth + 1);
-    } else {
-      const val = values[key];
-      if (!val) continue;
-      const display = entry.secret ? "********" : String(val);
-      console.error(`${indent}${entry.name}: ${display}`);
-    }
-  }
-}
-async function setCommand(servicePath, opts) {
-  const stackOpt = resolveStackOption(opts);
-  const context = resolveSecretsContext(opts, stackOpt);
-  const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
-  await ensureAwsCredentialsForStack(stackOpt ?? context.stage);
-  const ssmClient = new SSMClient({ region });
-  const smClient = new SecretsManagerClient4({ region });
-  const services = await discoverExternalServices(
-    ssmClient,
-    context.tenant,
-    context.platformEnv
-  );
-  if (services.size === 0) {
-    logError(
-      'No external services found. Deploy an ExternalService first:\n  new mesh.apps.ExternalService("symitar", { env, credentials: { ... } })'
-    );
-    process.exit(1);
-  }
-  let serviceName;
-  if (servicePath) {
-    serviceName = servicePath.replace(/^external\//, "");
-  }
-  if (!serviceName || !services.has(serviceName)) {
-    if (serviceName) {
-      logError(`External service "${serviceName}" not found.`);
-    }
-    console.error("\nAvailable external services:");
-    for (const [name, svc2] of services) {
-      const desc = svc2.meta?.description ? ` \u2014 ${svc2.meta.description}` : "";
-      const type = svc2.meta?.type ? ` (${svc2.meta.type})` : "";
-      console.error(`  ${name}${type}${desc}`);
-    }
-    console.error(`
-Usage: mesh secrets set external/<name>`);
-    process.exit(serviceName ? 1 : 0);
-  }
-  const svc = services.get(serviceName);
-  const schema = svc.schema;
-  if (!schema) {
-    logError(`No credential schema found for "${serviceName}".`);
-    process.exit(1);
-  }
-  const secretPrefix = svc.meta.secretPrefix;
-  const secretId = opts.key ? `${secretPrefix}/${opts.key}` : secretPrefix;
-  if (schema.keyedBy && !opts.key) {
-    logError(
-      `"${serviceName}" is multi-instance (keyed by ${schema.keyedBy}). Specify an instance:
-  mesh secrets set external/${serviceName} --key=<${schema.keyedBy}>`
-    );
-    process.exit(1);
-  }
-  if (opts.key && !isInstanceKey(opts.key)) {
-    logError(
-      `Invalid instance key "${opts.key}": keys must not contain "/", start with ".", or end with ".config" \u2014 those names are reserved for the index and config mirrors.`
-    );
-    process.exit(1);
-  }
-  let existing = {};
-  try {
-    const response = await smClient.send(
-      new GetSecretValueCommand4({ SecretId: secretId })
-    );
-    if (response.SecretString) {
-      existing = JSON.parse(response.SecretString);
-    }
-  } catch (err) {
-    if (!isResourceNotFound(err)) {
-      throw err;
-    }
-  }
-  if (opts.json) {
-    let values2;
-    try {
-      values2 = JSON.parse(opts.json);
-    } catch {
-      logError(`Invalid JSON input. Provide valid JSON, e.g.: --json='{"key": "value"}'`);
-      return;
-    }
-    const merged2 = deepMerge(existing, values2);
-    await writeSecret(smClient, secretId, merged2, svc.meta);
-    await writeConfigMirror(smClient, secretId, schema, merged2, svc.meta);
-    if (opts.key) {
-      await addKeyToInstanceIndex(smClient, secretPrefix, opts.key, serviceName);
-    }
-    logSuccess(`Credentials written to ${secretId}`);
-    return;
-  }
-  console.error("");
-  logInfo(`Setting credentials for: ${svc.meta.description || serviceName}`);
-  if (opts.key) {
-    logInfo(`Instance: ${opts.key}`);
-  }
-  logInfo(`Secret: ${secretId}`);
-  const values = {};
-  await promptFields(schema.fields, existing, values, { all: !!opts.all });
-  console.error("");
-  const merged = deepMerge(existing, values);
-  await writeSecret(smClient, secretId, merged, svc.meta);
-  await writeConfigMirror(smClient, secretId, schema, merged, svc.meta);
-  if (opts.key) {
-    await addKeyToInstanceIndex(smClient, secretPrefix, opts.key, serviceName);
-  }
-  logSuccess(`Credentials written to ${secretId}`);
-  console.error("\nStored fields:");
-  displaySummary(schema.fields, merged);
-  console.error("");
-}
-function isResourceNotFound(err) {
-  return isAwsErrorCode(err, "ResourceNotFoundException");
-}
-function deepMerge(target, source) {
-  const result = { ...target };
-  for (const [key, value] of Object.entries(source)) {
-    if (value !== null && typeof value === "object" && !Array.isArray(value) && typeof result[key] === "object" && result[key] !== null && !Array.isArray(result[key])) {
-      result[key] = deepMerge(
-        result[key],
-        value
-      );
-    } else {
-      result[key] = value;
-    }
-  }
-  return result;
-}
-async function writeSecret(client, secretId, values, meta) {
-  const secretString = JSON.stringify(values);
-  try {
-    await client.send(
-      new PutSecretValueCommand({
-        SecretId: secretId,
-        SecretString: secretString
-      })
-    );
-  } catch (err) {
-    if (isResourceNotFound(err)) {
-      await client.send(
-        new CreateSecretCommand({
-          Name: secretId,
-          Description: `External service credentials for ${meta.name} (instance)`,
-          SecretString: secretString,
-          Tags: [
-            { Key: "mesh:type", Value: "external-service" },
-            { Key: "mesh:service", Value: meta.name }
-          ]
-        })
-      );
-    } else {
-      throw err;
-    }
-  }
-}
-function extractNonSecretFields(fields, values) {
-  const result = {};
-  for (const [key, entry] of Object.entries(fields)) {
-    if (entry.type === "group") {
-      const groupValues = values[key] ?? {};
-      const filtered = extractNonSecretFields(entry.fields, groupValues);
-      if (Object.keys(filtered).length > 0) {
-        result[key] = filtered;
-      }
-    } else if (!entry.secret && values[key] !== void 0) {
-      result[key] = values[key];
-    }
-  }
-  return result;
-}
-async function addKeyToInstanceIndex(client, secretPrefix, key, serviceName) {
-  const indexId = instanceIndexSecretId(secretPrefix);
-  try {
-    let keys = [];
-    try {
-      const res = await client.send(new GetSecretValueCommand4({ SecretId: indexId }));
-      keys = parseInstanceIndex(res.SecretString ?? "");
-    } catch (err) {
-      if (!isResourceNotFound(err)) throw err;
-    }
-    if (keys.includes(key)) return;
-    const secretString = buildInstanceIndexValue([...keys, key]);
-    try {
-      await client.send(
-        new PutSecretValueCommand({ SecretId: indexId, SecretString: secretString })
-      );
-    } catch (err) {
-      if (!isResourceNotFound(err)) throw err;
-      await client.send(
-        new CreateSecretCommand({
-          Name: indexId,
-          Description: `Instance-key index for ${serviceName} (read by listInstances(); maintained by mesh secrets set/reindex and the Hub)`,
-          SecretString: secretString,
-          Tags: [
-            { Key: "mesh:type", Value: "external-service-index" },
-            { Key: "mesh:service", Value: serviceName }
-          ]
-        })
-      );
-      logInfo(
-        `Created ${indexId} OUT OF BAND \u2014 the declaring stack does not manage it. Deploy the declaring stack (it creates the index) before writing keys, or import this secret into the stack before its next deploy.`
-      );
-    }
-  } catch (err) {
-    logInfo(
-      `Warning: failed to record instance "${key}" in ${indexId} \u2014 listInstances() will not see it until you run: mesh secrets reindex external/${serviceName} (${err})`
-    );
-  }
-}
-async function writeConfigMirror(client, secretId, schema, merged, meta) {
-  const configId = `${secretId}/.config`;
-  const configValues = extractNonSecretFields(schema.fields, merged);
-  const secretString = JSON.stringify(configValues);
-  try {
-    try {
-      await client.send(
-        new PutSecretValueCommand({
-          SecretId: configId,
-          SecretString: secretString
-        })
-      );
-    } catch (err) {
-      if (isResourceNotFound(err)) {
-        await client.send(
-          new CreateSecretCommand({
-            Name: configId,
-            Description: `Non-secret credential fields for ${meta.name} (Hub display)`,
-            SecretString: secretString,
-            Tags: [{ Key: "mesh:type", Value: "external-service-config" }]
-          })
-        );
-      } else {
-        throw err;
-      }
-    }
-  } catch (err) {
-    logInfo(`Warning: failed to write .config mirror to ${configId}: ${err}`);
-  }
-}
-
 // packages/mesh-cli/src/commands/secrets/reindex.ts
-import { SSMClient as SSMClient2 } from "@aws-sdk/client-ssm";
+import { SSMClient } from "@aws-sdk/client-ssm";
 import {
-  SecretsManagerClient as SecretsManagerClient5,
+  SecretsManagerClient as SecretsManagerClient3,
   ListSecretsCommand,
-  GetSecretValueCommand as GetSecretValueCommand5,
-  PutSecretValueCommand as PutSecretValueCommand2,
-  CreateSecretCommand as CreateSecretCommand2
+  GetSecretValueCommand as GetSecretValueCommand3,
+  PutSecretValueCommand,
+  CreateSecretCommand
 } from "@aws-sdk/client-secrets-manager";
 async function scanInstanceKeys(client, secretPrefix) {
   const keys = [];
@@ -3919,17 +3579,10 @@ function indexAlreadyMatches(missing, stale, indexExists, malformed) {
   return missing.length === 0 && stale.length === 0 && indexExists && !malformed;
 }
 async function reindexCommand(servicePath, opts) {
-  const stackOpt = resolveStackOption(opts);
-  const context = resolveSecretsContext(opts, stackOpt);
   const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
-  await ensureAwsCredentialsForStack(stackOpt ?? context.stage);
-  const ssmClient = new SSMClient2({ region });
-  const smClient = new SecretsManagerClient5({ region });
-  const services = await discoverExternalServices(
-    ssmClient,
-    context.tenant,
-    context.platformEnv
-  );
+  const ssmClient = new SSMClient({ region });
+  const { services } = await discoverStackExternalServices(opts, ssmClient);
+  const smClient = new SecretsManagerClient3({ region });
   const serviceName = servicePath?.replace(/^external\//, "");
   if (!serviceName || !services.has(serviceName)) {
     if (serviceName) {
@@ -3959,7 +3612,7 @@ Usage: mesh secrets reindex external/<name>`);
   let indexExists = true;
   let malformed = false;
   try {
-    const res = await smClient.send(new GetSecretValueCommand5({ SecretId: indexId }));
+    const res = await smClient.send(new GetSecretValueCommand3({ SecretId: indexId }));
     try {
       listed = parseInstanceIndex(res.SecretString ?? "");
     } catch {
@@ -3992,12 +3645,12 @@ async function writeInstanceIndex(client, secretPrefix, serviceName, keys) {
   const secretString = buildInstanceIndexValue(keys);
   try {
     await client.send(
-      new PutSecretValueCommand2({ SecretId: indexId, SecretString: secretString })
+      new PutSecretValueCommand({ SecretId: indexId, SecretString: secretString })
     );
   } catch (err) {
     if (!isResourceNotFound(err)) throw err;
     await client.send(
-      new CreateSecretCommand2({
+      new CreateSecretCommand({
         Name: indexId,
         Description: `Instance-key index for ${serviceName} (read by listInstances(); maintained by mesh secrets set/reindex and the Hub)`,
         SecretString: secretString,
@@ -4015,23 +3668,23 @@ async function writeInstanceIndex(client, secretPrefix, serviceName, keys) {
 
 // packages/mesh-cli/src/commands/secrets/migrate-config.ts
 import {
-  SSMClient as SSMClient3,
-  GetParametersByPathCommand as GetParametersByPathCommand2
+  SSMClient as SSMClient2,
+  GetParametersByPathCommand
 } from "@aws-sdk/client-ssm";
 import {
-  SecretsManagerClient as SecretsManagerClient6,
-  GetSecretValueCommand as GetSecretValueCommand6,
-  PutSecretValueCommand as PutSecretValueCommand3,
-  CreateSecretCommand as CreateSecretCommand3,
+  SecretsManagerClient as SecretsManagerClient4,
+  GetSecretValueCommand as GetSecretValueCommand4,
+  PutSecretValueCommand as PutSecretValueCommand2,
+  CreateSecretCommand as CreateSecretCommand2,
   ListSecretsCommand as ListSecretsCommand2
 } from "@aws-sdk/client-secrets-manager";
-function normalizeEntry2(raw) {
+function normalizeEntry(raw) {
   if (raw.type === "group" && raw.fields) {
     return {
       type: "group",
       name: raw.name ?? "",
       description: raw.description ?? "",
-      fields: normalizeFields2(raw.fields)
+      fields: normalizeFields(raw.fields)
     };
   }
   return {
@@ -4042,18 +3695,18 @@ function normalizeEntry2(raw) {
     optional: raw.optional ?? false
   };
 }
-function normalizeFields2(raw) {
+function normalizeFields(raw) {
   return Object.fromEntries(
-    Object.entries(raw).map(([key, value]) => [key, normalizeEntry2(value)])
+    Object.entries(raw).map(([key, value]) => [key, normalizeEntry(value)])
   );
 }
-async function discoverExternalServices2(ssmClient, tenant, platformEnv) {
+async function discoverExternalServices(ssmClient, tenant, platformEnv) {
   const services = /* @__PURE__ */ new Map();
   const basePath = `/mesh-platform/${tenant}/${platformEnv}`;
   let nextToken;
   do {
     const response = await ssmClient.send(
-      new GetParametersByPathCommand2({
+      new GetParametersByPathCommand({
         Path: basePath,
         Recursive: true,
         NextToken: nextToken
@@ -4073,7 +3726,7 @@ async function discoverExternalServices2(ssmClient, tenant, platformEnv) {
         const serviceName = credMatch[1];
         const raw = JSON.parse(param.Value);
         const schema = {
-          fields: normalizeFields2(raw.fields),
+          fields: normalizeFields(raw.fields),
           keyedBy: raw.keyedBy
         };
         const existing = services.get(serviceName);
@@ -4088,12 +3741,12 @@ async function discoverExternalServices2(ssmClient, tenant, platformEnv) {
   } while (nextToken);
   return services;
 }
-function extractNonSecretFields2(fields, values) {
+function extractNonSecretFields(fields, values) {
   const result = {};
   for (const [key, entry] of Object.entries(fields)) {
     if (entry.type === "group") {
       const groupValues = values[key] ?? {};
-      const filtered = extractNonSecretFields2(entry.fields, groupValues);
+      const filtered = extractNonSecretFields(entry.fields, groupValues);
       if (Object.keys(filtered).length > 0) {
         result[key] = filtered;
       }
@@ -4105,20 +3758,20 @@ function extractNonSecretFields2(fields, values) {
 }
 async function readSecret(client, secretId) {
   try {
-    const res = await client.send(new GetSecretValueCommand6({ SecretId: secretId }));
+    const res = await client.send(new GetSecretValueCommand4({ SecretId: secretId }));
     return res.SecretString ? JSON.parse(res.SecretString) : null;
   } catch (err) {
     if (isAwsErrorCode(err, "ResourceNotFoundException")) return null;
     throw err;
   }
 }
-async function writeSecret2(client, secretId, values, description) {
+async function writeSecret(client, secretId, values, description) {
   const secretString = JSON.stringify(values);
   try {
-    await client.send(new PutSecretValueCommand3({ SecretId: secretId, SecretString: secretString }));
+    await client.send(new PutSecretValueCommand2({ SecretId: secretId, SecretString: secretString }));
   } catch (err) {
     if (isAwsErrorCode(err, "ResourceNotFoundException")) {
-      await client.send(new CreateSecretCommand3({
+      await client.send(new CreateSecretCommand2({
         Name: secretId,
         Description: description,
         SecretString: secretString,
@@ -4131,7 +3784,7 @@ async function writeSecret2(client, secretId, values, description) {
 }
 async function secretExists(client, secretId) {
   try {
-    await client.send(new GetSecretValueCommand6({ SecretId: secretId }));
+    await client.send(new GetSecretValueCommand4({ SecretId: secretId }));
     return true;
   } catch (err) {
     if (isAwsErrorCode(err, "ResourceNotFoundException")) return false;
@@ -4182,7 +3835,7 @@ async function migrateService(smClient, meta, schema, opts) {
         skipped++;
         return;
       }
-      const configValues = extractNonSecretFields2(schema.fields, values);
+      const configValues = extractNonSecretFields(schema.fields, values);
       if (opts.dryRun) {
         const fieldCount = Object.keys(configValues).length;
         logInfo(`  DRY-RUN ${label} \u2192 ${configId} (${fieldCount} non-secret fields)`);
@@ -4190,7 +3843,7 @@ async function migrateService(smClient, meta, schema, opts) {
         return;
       }
       const desc = `Non-secret credential fields for ${meta.name} (Hub display)`;
-      await writeSecret2(smClient, configId, configValues, desc);
+      await writeSecret(smClient, configId, configValues, desc);
       logSuccess(`  OK ${label} \u2192 ${configId}`);
       migrated++;
     } catch (err) {
@@ -4210,12 +3863,12 @@ async function migrateService(smClient, meta, schema, opts) {
 async function migrateConfigCommand(opts) {
   const context = resolveSecretsContext(opts);
   const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
-  const ssmClient = new SSMClient3({ region });
-  const smClient = new SecretsManagerClient6({ region });
+  const ssmClient = new SSMClient2({ region });
+  const smClient = new SecretsManagerClient4({ region });
   logInfo(`Migrating .config mirrors for ${context.tenant}/${context.platformEnv}`);
   if (opts.dryRun) logInfo("DRY-RUN mode \u2014 no writes");
   if (opts.force) logInfo("FORCE mode \u2014 overwrite existing .config");
-  const services = await discoverExternalServices2(ssmClient, context.tenant, context.platformEnv);
+  const services = await discoverExternalServices(ssmClient, context.tenant, context.platformEnv);
   if (services.size === 0) {
     logInfo("No external services found.");
     return;
@@ -4479,13 +4132,13 @@ function registerSiteCommands(program) {
 
 // packages/mesh-cli/src/commands/stack.ts
 import { execFileSync as execFileSync6 } from "child_process";
-import * as path10 from "path";
+import * as path11 from "path";
 import * as fs10 from "fs";
 import { parse as parseYaml2 } from "yaml";
 
 // packages/mesh-cli/src/commands/stack-status.ts
 import * as fs9 from "fs";
-import * as path9 from "path";
+import * as path10 from "path";
 import { execFileSync as execFileSync5 } from "child_process";
 var INFRA_PACKAGE = "@mesh-tech/infra-components";
 var HUB_PACKAGE2 = "@mesh-tech/hub";
@@ -4503,10 +4156,10 @@ function targetForStack(projectDir, stack) {
     return { stack, kind: "app", tenant: tenant2, env: env2, coreTenant: tenant2, coreEnv: env2 };
   }
   const declared = readStackConfig(projectDir, stack, "mesh:tenant");
-  const layerDir = ["core", "platform"].includes(path9.basename(projectDir));
+  const layerDir = ["core", "platform"].includes(path10.basename(projectDir));
   if (!declared && !layerDir) return null;
   const { tenant, env } = splitLayerStack(stack, declared);
-  const isCore = path9.basename(projectDir) === "core";
+  const isCore = path10.basename(projectDir) === "core";
   return {
     stack,
     kind: "layer",
@@ -4522,13 +4175,13 @@ function findStatusTargets(cwd, stack) {
   let projectDir = project;
   let repoRoot = null;
   if (!projectDir) {
-    const platformDir = path9.join(cwd, "platform");
-    if (fs9.existsSync(path9.join(platformDir, "Pulumi.yaml"))) {
+    const platformDir = path10.join(cwd, "platform");
+    if (fs9.existsSync(path10.join(platformDir, "Pulumi.yaml"))) {
       projectDir = platformDir;
       repoRoot = cwd;
     }
-  } else if (["core", "platform"].includes(path9.basename(projectDir))) {
-    repoRoot = path9.dirname(projectDir);
+  } else if (["core", "platform"].includes(path10.basename(projectDir))) {
+    repoRoot = path10.dirname(projectDir);
   }
   if (!projectDir) return [];
   const stacks = stack ? [stack] : findStackConfigs(projectDir);
@@ -4537,10 +4190,10 @@ function findStatusTargets(cwd, stack) {
     const target = targetForStack(projectDir, name);
     if (!target) continue;
     if (repoRoot && target.kind === "layer") {
-      const core = path9.join(repoRoot, "core");
-      const platform = path9.join(repoRoot, "platform");
-      if (fs9.existsSync(path9.join(core, "package.json"))) target.coreDir = core;
-      if (fs9.existsSync(path9.join(platform, "package.json"))) target.platformDir = platform;
+      const core = path10.join(repoRoot, "core");
+      const platform = path10.join(repoRoot, "platform");
+      if (fs9.existsSync(path10.join(core, "package.json"))) target.coreDir = core;
+      if (fs9.existsSync(path10.join(platform, "package.json"))) target.platformDir = platform;
     }
     targets.push(target);
   }
@@ -4549,7 +4202,7 @@ function findStatusTargets(cwd, stack) {
 function pinnedVersion(dir, pkg) {
   if (!dir) return null;
   try {
-    const manifest = JSON.parse(fs9.readFileSync(path9.join(dir, "package.json"), "utf-8"));
+    const manifest = JSON.parse(fs9.readFileSync(path10.join(dir, "package.json"), "utf-8"));
     const spec = manifest.dependencies?.[pkg] ?? manifest.devDependencies?.[pkg];
     return typeof spec === "string" ? spec.replace(/^[\^~=v]+/, "") : null;
   } catch {
@@ -4669,8 +4322,8 @@ function latestPublished(pkg, cwd) {
 async function readRegistration(name, region, auth) {
   const { credentials, profile, signInHint } = auth;
   try {
-    const { SSMClient: SSMClient4, GetParameterCommand } = await import("@aws-sdk/client-ssm");
-    const client = new SSMClient4({
+    const { SSMClient: SSMClient3, GetParameterCommand } = await import("@aws-sdk/client-ssm");
+    const client = new SSMClient3({
       region,
       ...profile && !credentials?.AWS_ACCESS_KEY_ID ? { profile } : {},
       ...credentials?.AWS_ACCESS_KEY_ID ? {
@@ -4741,7 +4394,7 @@ async function runStackStatus(cwd, opts) {
 
 // packages/mesh-cli/src/commands/stack.ts
 function readTopLevelYamlKey(appRoot, stack, key) {
-  const configFile = path10.join(appRoot, `Pulumi.${stack}.yaml`);
+  const configFile = path11.join(appRoot, `Pulumi.${stack}.yaml`);
   if (!fs10.existsSync(configFile)) return null;
   const content = fs10.readFileSync(configFile, "utf-8");
   const pattern = new RegExp(`^${key}:\\s*(.+)$`, "m");
@@ -4750,7 +4403,7 @@ function readTopLevelYamlKey(appRoot, stack, key) {
   return match[1].trim().replace(/^["']|["']$/g, "");
 }
 function readConfigBlockKey(appRoot, stack, key) {
-  const configFile = path10.join(appRoot, `Pulumi.${stack}.yaml`);
+  const configFile = path11.join(appRoot, `Pulumi.${stack}.yaml`);
   if (!fs10.existsSync(configFile)) return null;
   const content = fs10.readFileSync(configFile, "utf-8");
   const pattern = new RegExp(`^\\s{2}${key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}:\\s*(.+)$`, "m");
@@ -4812,7 +4465,7 @@ ${records}
   }
 }
 function readBaseConfigFromYaml(appRoot, stack) {
-  const file = path10.join(appRoot, `Pulumi.${stack}.yaml`);
+  const file = path11.join(appRoot, `Pulumi.${stack}.yaml`);
   if (!fs10.existsSync(file)) return {};
   let doc;
   try {
@@ -4915,7 +4568,7 @@ Specify which to base on: mesh stack init --from <stack>`
         );
       }
     }
-    const newConfigPath = path10.join(appRoot, `Pulumi.${newStack}.yaml`);
+    const newConfigPath = path11.join(appRoot, `Pulumi.${newStack}.yaml`);
     const configExists = fs10.existsSync(newConfigPath);
     const secretsProvider = readTopLevelYamlKey(appRoot, baseStack, "secretsprovider");
     const credEnv = await resolvePulumiEnv({ appRoot, stack: baseStack });
@@ -5115,7 +4768,7 @@ Specify which to base on: mesh stack init --from <stack>`
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { writeFileSync as writeFileSync5, mkdirSync as mkdirSync5 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { dirname as dirname7, join as join13, resolve as resolve6 } from "node:path";
+import { dirname as dirname8, join as join13, resolve as resolve6 } from "node:path";
 
 // packages/mesh-cli/src/utils/recover-conversation.ts
 async function classifyHistoryEvents(rawEvents, decodePayload) {
@@ -5803,8 +5456,8 @@ function extractEventPayloads(event) {
     if (failure?.message) groups.push({ label: "failure", payloads: [{ __failure: failure }] });
   }
   if (event.nexusOperationScheduledEventAttributes) {
-    const input2 = event.nexusOperationScheduledEventAttributes.input;
-    if (input2) pushIfAny("input", [input2]);
+    const input = event.nexusOperationScheduledEventAttributes.input;
+    if (input) pushIfAny("input", [input]);
   }
   if (event.nexusOperationCompletedEventAttributes) {
     const result = event.nexusOperationCompletedEventAttributes.result;
@@ -5987,7 +5640,7 @@ async function captureHistory(workflowId, runId, options) {
     const { serializeHistoryToFixture } = await import("./mesh.capture-history-A4IAVVIR.js");
     const { fixture, eventCount, decryptedPayloads } = await serializeHistoryToFixture(events, decrypter);
     const outPath = options.out ?? join13(homedir3(), ".mesh", "replay-histories", `${sanitizeFileId(workflowId)}.json`);
-    mkdirSync5(dirname7(outPath), { recursive: true });
+    mkdirSync5(dirname8(outPath), { recursive: true });
     if (options.out) warnIfNotGitIgnored(options.out);
     writeFileSync5(outPath, JSON.stringify(fixture, null, 2) + "\n");
     logSuccess(
@@ -6006,7 +5659,7 @@ function sanitizeFileId(id) {
 function warnIfNotGitIgnored(outPath) {
   const abs = resolve6(outPath);
   try {
-    const res = spawnSync2("git", ["-C", dirname7(abs), "check-ignore", "-q", abs], {
+    const res = spawnSync2("git", ["-C", dirname8(abs), "check-ignore", "-q", abs], {
       stdio: "ignore"
     });
     if (res.status !== 1) return;
@@ -6116,7 +5769,7 @@ function registerTemporalCommands(program) {
 // packages/mesh-cli/src/commands/tenant.ts
 import chalk4 from "chalk";
 import * as fs11 from "fs";
-import * as path11 from "path";
+import * as path12 from "path";
 import { parseDocument, YAMLMap, isMap } from "yaml";
 function validateTenantName(name) {
   return /^[a-z][a-z0-9-]*$/.test(name) && !name.endsWith("-");
@@ -6184,7 +5837,7 @@ function resolveStackConfig(explicitStack) {
       { remediation: { command: "mesh tenant add <name> --stack <stack>" } }
     );
   }
-  const file = path11.join(appRoot, `Pulumi.${stack}.yaml`);
+  const file = path12.join(appRoot, `Pulumi.${stack}.yaml`);
   if (!fs11.existsSync(file)) {
     throw new MeshCliError(`Stack config not found: ${file}`, {
       remediation: { command: "mesh tenant add <name> --stack <stack>" }
@@ -6193,7 +5846,7 @@ function resolveStackConfig(explicitStack) {
   return { appRoot, stack, file, content: fs11.readFileSync(file, "utf-8") };
 }
 function readProjectName(appRoot) {
-  const projectDoc = parseDocument(fs11.readFileSync(path11.join(appRoot, "Pulumi.yaml"), "utf-8"));
+  const projectDoc = parseDocument(fs11.readFileSync(path12.join(appRoot, "Pulumi.yaml"), "utf-8"));
   return String(projectDoc.get("name") ?? "");
 }
 function looksLikePlatformLayer(projectName) {
@@ -6236,7 +5889,7 @@ function registerTenantCommands(program) {
       if (!result.ok) {
         if (result.reason === "exists") {
           throw new MeshCliError(
-            `${result.detail} (${path11.basename(resolved.file)}). Edit the existing entry instead of re-adding it.`
+            `${result.detail} (${path12.basename(resolved.file)}). Edit the existing entry instead of re-adding it.`
           );
         }
         throw new MeshCliError(`${resolved.file}: ${result.detail}`);
@@ -6254,7 +5907,7 @@ function registerTenantCommands(program) {
         return;
       }
       logInfo(
-        `Tenant '${name}' registered in ${path11.basename(resolved.file)} (mesh:tenants, subdomain '${subdomain}')${result.createdTenantsBlock ? " \u2014 created the mesh:tenants block" : ""}`
+        `Tenant '${name}' registered in ${path12.basename(resolved.file)} (mesh:tenants, subdomain '${subdomain}')${result.createdTenantsBlock ? " \u2014 created the mesh:tenants block" : ""}`
       );
       console.log("");
       console.log("Next steps:");
@@ -6280,7 +5933,7 @@ function registerTenantCommands(program) {
           `Project '${projectName}' does not look like a platform layer \u2014 tenants are declared on the tenant platform repo's PLATFORM stack (e.g. mesh-sandbox/platform).`
         );
       }
-      logInfo(`No tenants declared in ${path11.basename(resolved.file)}.`);
+      logInfo(`No tenants declared in ${path12.basename(resolved.file)}.`);
       return;
     }
     logInfo(`Tenants on stack '${resolved.stack}':`);
@@ -6294,11 +5947,11 @@ function registerTenantCommands(program) {
 // packages/mesh-cli/src/commands/tunnel/index.ts
 import { spawn as spawn5 } from "child_process";
 import * as fs12 from "fs";
-import * as os4 from "os";
-import * as path12 from "path";
+import * as os3 from "os";
+import * as path13 from "path";
 import {
-  SecretsManagerClient as SecretsManagerClient7,
-  GetSecretValueCommand as GetSecretValueCommand7
+  SecretsManagerClient as SecretsManagerClient5,
+  GetSecretValueCommand as GetSecretValueCommand5
 } from "@aws-sdk/client-secrets-manager";
 function resolveTenantEnv(options) {
   if (options.tenant && options.env) {
@@ -6326,8 +5979,8 @@ function readPulumiAwsRegion(stage) {
 }
 function awsProfileSections(name) {
   return [
-    [path12.join(os4.homedir(), ".aws", "config"), `[profile ${name}]`],
-    [path12.join(os4.homedir(), ".aws", "credentials"), `[${name}]`]
+    [path13.join(os3.homedir(), ".aws", "config"), `[profile ${name}]`],
+    [path13.join(os3.homedir(), ".aws", "credentials"), `[${name}]`]
   ];
 }
 function awsProfileExists(name) {
@@ -6368,8 +6021,8 @@ function awsProfileRegion(profile) {
 }
 function awsDefaultProfileSections() {
   return [
-    [path12.join(os4.homedir(), ".aws", "config"), "[default]"],
-    [path12.join(os4.homedir(), ".aws", "credentials"), "[default]"]
+    [path13.join(os3.homedir(), ".aws", "config"), "[default]"],
+    [path13.join(os3.homedir(), ".aws", "credentials"), "[default]"]
   ];
 }
 function awsDefaultProfileRegion() {
@@ -6431,11 +6084,11 @@ function getEffectivePort(serviceName, options) {
       return config.localPort;
   }
 }
-function parseServices(input2) {
-  if (SERVICE_GROUPS[input2]) {
-    return SERVICE_GROUPS[input2];
+function parseServices(input) {
+  if (SERVICE_GROUPS[input]) {
+    return SERVICE_GROUPS[input];
   }
-  return input2.split(",").map((s) => s.trim());
+  return input.split(",").map((s) => s.trim());
 }
 function spawnSsmTunnel(instanceId, service, localPort) {
   return spawn5(
@@ -6582,10 +6235,10 @@ async function tunnelExternal(name, options) {
   const { appTenant, appStage } = resolveCredentialAxis(options);
   const secretId = externalSecretId(appTenant, appStage, name, key);
   const setHint = `mesh secrets set external/${name}${key ? ` --key=${key}` : ""}`;
-  const sm = new SecretsManagerClient7({});
+  const sm = new SecretsManagerClient5({});
   let creds;
   try {
-    const out = await sm.send(new GetSecretValueCommand7({ SecretId: secretId }));
+    const out = await sm.send(new GetSecretValueCommand5({ SecretId: secretId }));
     creds = JSON.parse(out.SecretString ?? "{}");
   } catch (err) {
     logError(
@@ -6748,7 +6401,7 @@ async function resolveToken(opts) {
   if (opts.token) return opts.token;
   if (process.env.VCS_TOKEN) return process.env.VCS_TOKEN;
   if (opts.context) {
-    const { getValidToken: getValidToken2 } = await import("./mesh.login-7SIAKFXJ.js");
+    const { getValidToken: getValidToken2 } = await import("./mesh.login-3AWVGPCM.js");
     const token = await getValidToken2(opts.context);
     if (token) return token;
   }
@@ -6756,8 +6409,8 @@ async function resolveToken(opts) {
     "no token: pass --token, set VCS_TOKEN, or pass --context <platform-context> (after mesh login)"
   );
 }
-async function vcsApi(baseUrl, token, path14, method = "GET", body) {
-  const res = await fetch(`${baseUrl}${path14}`, {
+async function vcsApi(baseUrl, token, path15, method = "GET", body) {
+  const res = await fetch(`${baseUrl}${path15}`, {
     method,
     headers: {
       authorization: `Bearer ${token}`,
@@ -6768,7 +6421,7 @@ async function vcsApi(baseUrl, token, path14, method = "GET", body) {
   const data = await res.json().catch(() => ({}));
   if (!res.ok) {
     throw new Error(
-      `${method} ${path14} failed (${res.status}): ${String(data.error ?? "unknown error")}`
+      `${method} ${path15} failed (${res.status}): ${String(data.error ?? "unknown error")}`
     );
   }
   return data;
@@ -6801,8 +6454,8 @@ async function cloneCommand(repo, dest, opts) {
 
 // packages/mesh-cli/src/commands/vcs/get.ts
 import { writeFile, mkdir } from "node:fs/promises";
-import { join as join16, dirname as dirname8 } from "node:path";
-async function getCommand(repo, path14, opts) {
+import { join as join16, dirname as dirname9 } from "node:path";
+async function getCommand(repo, path15, opts) {
   let vcsBaseUrl;
   let token;
   if (opts.target) {
@@ -6817,18 +6470,18 @@ async function getCommand(repo, path14, opts) {
   if (!token) throw new Error("no token: pass --target (after mesh login), or --token / --context");
   const reader = createVcsFolderReader({ vcsBaseUrl, token });
   try {
-    const { ref, files } = await reader.readPath(repo, path14);
+    const { ref, files } = await reader.readPath(repo, path15);
     if (files.length === 0) {
-      logInfo(`no files at ${repo}:${path14}`);
+      logInfo(`no files at ${repo}:${path15}`);
       return;
     }
     if (opts.output) {
       for (const f of files) {
         const abs = join16(opts.output, f.path);
-        await mkdir(dirname8(abs), { recursive: true });
+        await mkdir(dirname9(abs), { recursive: true });
         await writeFile(abs, f.contents);
       }
-      logInfo(`wrote ${files.length} file(s) from ${repo}:${path14} (${ref}) \u2192 ${opts.output}`);
+      logInfo(`wrote ${files.length} file(s) from ${repo}:${path15} (${ref}) \u2192 ${opts.output}`);
     } else {
       for (const f of files) {
         if (files.length > 1) process.stdout.write(`
@@ -6843,10 +6496,10 @@ async function getCommand(repo, path14, opts) {
 }
 
 // packages/mesh-cli/src/commands/vcs/drafts.ts
-async function call(opts, repo, path14, method = "GET", body) {
+async function call(opts, repo, path15, method = "GET", body) {
   const target = await resolveTarget2({ ...opts, repo });
   const token = await resolveToken(opts);
-  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path14}`, method, body);
+  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path15}`, method, body);
 }
 async function draftsListCommand(repo, opts) {
   const data = await call(opts, repo, `/drafts${opts.all ? "?all=true" : ""}`);
@@ -6928,13 +6581,13 @@ function parseStatus(out) {
   }
   return changes;
 }
-async function writeOp(cwd, path14) {
-  const buf = await readFile2(join17(cwd, path14));
+async function writeOp(cwd, path15) {
+  const buf = await readFile2(join17(cwd, path15));
   const asUtf8 = buf.toString("utf8");
   if (Buffer.from(asUtf8, "utf8").equals(buf)) {
-    return { op: "write", path: path14, content: asUtf8 };
+    return { op: "write", path: path15, content: asUtf8 };
   }
-  return { op: "write", path: path14, content: buf.toString("base64"), encoding: "base64" };
+  return { op: "write", path: path15, content: buf.toString("base64"), encoding: "base64" };
 }
 async function proposeCommand(opts) {
   const cwd = process.cwd();
@@ -6978,8 +6631,8 @@ async function proposeCommand(opts) {
     operations,
     ...opts.mergeParent ? { mergeParent: opts.mergeParent } : {}
   };
-  const path14 = opts.revise ? `/v1/repos/${target.repo}/proposals/${opts.revise}/revisions` : `/v1/repos/${target.repo}/proposals`;
-  const data = await vcsApi(target.baseUrl, token, path14, "POST", body);
+  const path15 = opts.revise ? `/v1/repos/${target.repo}/proposals/${opts.revise}/revisions` : `/v1/repos/${target.repo}/proposals`;
+  const data = await vcsApi(target.baseUrl, token, path15, "POST", body);
   console.log(
     `proposal ${data.proposalId} @ ${data.sha.slice(0, 8)} \u2014 review: mesh vcs show ${target.repo} ${data.proposalId} --url ${target.baseUrl}`
   );
@@ -6987,7 +6640,7 @@ async function proposeCommand(opts) {
 
 // packages/mesh-cli/src/commands/vcs/rm.ts
 import { mkdtemp, rm as rmrf } from "node:fs/promises";
-import { tmpdir as tmpdir3 } from "node:os";
+import { tmpdir as tmpdir2 } from "node:os";
 import { join as join18 } from "node:path";
 function normalize(p) {
   return p.trim().replace(/^\.\//, "").replace(/\/+$/, "");
@@ -6995,21 +6648,21 @@ function normalize(p) {
 function expandPathsToDeletions(repoFiles, requested) {
   const out = /* @__PURE__ */ new Set();
   for (const raw of requested) {
-    const path14 = normalize(raw);
-    if (path14.startsWith("/") || path14.split("/").includes("..")) {
+    const path15 = normalize(raw);
+    if (path15.startsWith("/") || path15.split("/").includes("..")) {
       throw new Error(
         `"${raw}" is not a repo-relative path \u2014 vcs paths never start with "/" or traverse with "..".`
       );
     }
-    const exact = repoFiles.filter((f) => f === path14);
+    const exact = repoFiles.filter((f) => f === path15);
     if (exact.length > 0) {
       for (const f of exact) out.add(f);
       continue;
     }
-    const under = repoFiles.filter((f) => f.startsWith(`${path14}/`));
+    const under = repoFiles.filter((f) => f.startsWith(`${path15}/`));
     if (under.length === 0) {
       throw new Error(
-        `"${raw}" matched no files in the repo \u2014 nothing was proposed. Check the path with: mesh vcs get <repo> ${path14}`
+        `"${raw}" matched no files in the repo \u2014 nothing was proposed. Check the path with: mesh vcs get <repo> ${path15}`
       );
     }
     for (const f of under) out.add(f);
@@ -7020,7 +6673,7 @@ async function rmCommand(repo, paths, opts) {
   const baseUrl = (opts.url ?? process.env.VCS_URL)?.replace(/\/$/, "");
   if (!baseUrl) throw new Error("rm requires --url or VCS_URL");
   const token = await resolveToken(opts);
-  const dir = await mkdtemp(join18(tmpdir3(), "mesh-vcs-rm-"));
+  const dir = await mkdtemp(join18(tmpdir2(), "mesh-vcs-rm-"));
   try {
     const git = (args, cwd) => gitWithAuth(args, token, cwd);
     await git([
@@ -7045,7 +6698,7 @@ async function rmCommand(repo, paths, opts) {
     const body = {
       baseCommit: head.trim(),
       message: opts.message ?? `Delete ${doomed.length} file(s)`,
-      operations: doomed.map((path14) => ({ op: "delete", path: path14 }))
+      operations: doomed.map((path15) => ({ op: "delete", path: path15 }))
     };
     const data = await vcsApi(
       baseUrl,
@@ -7065,10 +6718,10 @@ async function rmCommand(repo, paths, opts) {
 }
 
 // packages/mesh-cli/src/commands/vcs/review.ts
-async function call2(opts, repo, path14, method = "GET", body) {
+async function call2(opts, repo, path15, method = "GET", body) {
   const target = await resolveTarget2({ ...opts, repo });
   const token = await resolveToken(opts);
-  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path14}`, method, body);
+  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path15}`, method, body);
 }
 async function proposalsCommand(repo, opts) {
   console.log(JSON.stringify(await call2(opts, repo, "/proposals"), null, 2));
@@ -7157,7 +6810,7 @@ function registerVcsCommands(program) {
 
 // packages/mesh-cli/src/commands/workflow.ts
 import * as fs13 from "fs";
-import * as path13 from "path";
+import * as path14 from "path";
 import { createRequire as createRequire2 } from "module";
 import { execFileSync as execFileSync8 } from "child_process";
 var DISCOVERY_HELPERS_SRC = `
@@ -7471,7 +7124,7 @@ function registerWorkflowCommands(program) {
   ).action(
     async (targetPath, opts) => {
       try {
-        const resolvedPath = path13.resolve(targetPath);
+        const resolvedPath = path14.resolve(targetPath);
         if (!fs13.existsSync(resolvedPath)) {
           logError(`Path does not exist: ${resolvedPath}`);
           process.exitCode = 1;
@@ -7479,7 +7132,7 @@ function registerWorkflowCommands(program) {
         }
         let resolvedProcessPath;
         if (opts.process) {
-          resolvedProcessPath = path13.resolve(opts.process);
+          resolvedProcessPath = path14.resolve(opts.process);
           if (!fs13.existsSync(resolvedProcessPath)) {
             logError(`--process path does not exist: ${resolvedProcessPath}`);
             process.exitCode = 1;
@@ -7529,7 +7182,7 @@ function registerWorkflowCommands(program) {
     "Extract the as-built command/query/activity inventory from Temporal workflow source\n\nThe inventory ({ workflowType, commands, queries, activities }) is the process-\nconformance lint's code-side input \u2014 it is never hand-edited. Supports single\nfiles or directories."
   ).action(async (targetPath) => {
     try {
-      const resolvedPath = path13.resolve(targetPath);
+      const resolvedPath = path14.resolve(targetPath);
       if (!fs13.existsSync(resolvedPath)) {
         logError(`Path does not exist: ${resolvedPath}`);
         process.exitCode = 1;
@@ -7576,7 +7229,7 @@ function registerWorkflowCommands(program) {
     "Comma-separated named-selector registry (enables UNKNOWN_SELECTOR checks)"
   ).action(async (targetPath, opts) => {
     try {
-      const resolvedPath = path13.resolve(targetPath);
+      const resolvedPath = path14.resolve(targetPath);
       if (!fs13.existsSync(resolvedPath)) {
         logError(`Path does not exist: ${resolvedPath}`);
         process.exitCode = 1;
@@ -7584,7 +7237,7 @@ function registerWorkflowCommands(program) {
       }
       let resolvedProcessPath;
       if (opts.process) {
-        resolvedProcessPath = path13.resolve(opts.process);
+        resolvedProcessPath = path14.resolve(opts.process);
         if (!fs13.existsSync(resolvedProcessPath)) {
           logError(`--process path does not exist: ${resolvedProcessPath}`);
           process.exitCode = 1;
@@ -7691,6 +7344,7 @@ function createProgram(options = {}) {
   registerStackCommand(program);
   registerTunnelCommands(program);
   registerSecretsCommands(program);
+  registerMcpCommands(program);
   registerArtifactsCommands(program);
   registerConversationsCommands(program);
   registerVpnCommands(program);