@mesh-tech/mesh-cli 0.40.8 → 0.40.10

package/dist/bin/{mesh.chunk-F44A3ACW.js → mesh.chunk-TG4FBJK3.js}

@@ -11,7 +11,7 @@ import {
   jsonReport,
   renderHuman,
   runChecks
-} from "./mesh.chunk-7HTKSUWR.js";
+} from "./mesh.chunk-TFOKVJ34.js";
 import {
   findPackageRoot
 } from "./mesh.chunk-MCBMHWXP.js";
@@ -27,7 +27,7 @@ import {
 } from "./mesh.chunk-IQOBTL42.js";
 import {
   registryPreflight
-} from "./mesh.chunk-6SSOVZOI.js";
+} from "./mesh.chunk-SEIVILJR.js";
 
 // packages/mesh-cli/src/commands/create-app.ts
 import * as fs3 from "fs";

package/dist/bin/{mesh.create-app-Z3RKSTBO.js → mesh.create-app-QRAZVRA3.js}

@@ -13,14 +13,14 @@ import {
   resolveAppDir,
   shouldBootstrapAppsRepo,
   workspaceGlobForApp
-} from "./mesh.chunk-F44A3ACW.js";
+} from "./mesh.chunk-TG4FBJK3.js";
 import "./mesh.chunk-F4654EPX.js";
-import "./mesh.chunk-7HTKSUWR.js";
+import "./mesh.chunk-TFOKVJ34.js";
 import "./mesh.chunk-2QIVBQX5.js";
 import "./mesh.chunk-MCBMHWXP.js";
 import "./mesh.chunk-WFFDF346.js";
 import "./mesh.chunk-IQOBTL42.js";
-import "./mesh.chunk-6SSOVZOI.js";
+import "./mesh.chunk-SEIVILJR.js";
 export {
   NO_REGISTRY_ACCESS_MESSAGE,
   PLATFORM_MONOREPO_NAME,

package/dist/bin/{mesh.dev-token-server-XG26C6IQ.js → mesh.dev-token-server-DIECW5KC.js}

@@ -2,7 +2,7 @@ import {
   decodeJwtPayload,
   getValidToken,
   readCredentials
-} from "./mesh.chunk-7HTKSUWR.js";
+} from "./mesh.chunk-TFOKVJ34.js";
 import "./mesh.chunk-2QIVBQX5.js";
 import "./mesh.chunk-MCBMHWXP.js";
 import {
@@ -10,7 +10,7 @@ import {
   logWarn
 } from "./mesh.chunk-WFFDF346.js";
 import "./mesh.chunk-IQOBTL42.js";
-import "./mesh.chunk-6SSOVZOI.js";
+import "./mesh.chunk-SEIVILJR.js";
 
 // packages/mesh-cli/src/commands/dev-token-server.ts
 import * as http from "node:http";

package/dist/bin/mesh.js

@@ -1,25 +1,25 @@
 #!/usr/bin/env node
 import {
   createProgram
-} from "./mesh.chunk-HYXH4YMU.js";
-import "./mesh.chunk-YE2WIY3Y.js";
+} from "./mesh.chunk-M23VKWSF.js";
+import "./mesh.chunk-N55Y3YII.js";
 import {
   formatVersionLine,
   resolveCliRuntime
-} from "./mesh.chunk-QPGAPLPU.js";
-import "./mesh.chunk-F44A3ACW.js";
-import "./mesh.chunk-NSQJEX36.js";
-import "./mesh.chunk-6AIG5OJM.js";
+} from "./mesh.chunk-NT2NPR7J.js";
+import "./mesh.chunk-TG4FBJK3.js";
+import "./mesh.chunk-CA4LI762.js";
+import "./mesh.chunk-CN6PMHQ5.js";
 import "./mesh.chunk-F4654EPX.js";
-import "./mesh.chunk-HJGMOEUG.js";
-import "./mesh.chunk-7HTKSUWR.js";
+import "./mesh.chunk-SOX2CJMU.js";
+import "./mesh.chunk-TFOKVJ34.js";
 import "./mesh.chunk-2QIVBQX5.js";
 import "./mesh.chunk-MCBMHWXP.js";
 import "./mesh.chunk-WFFDF346.js";
 import {
   handleCliError
 } from "./mesh.chunk-IQOBTL42.js";
-import "./mesh.chunk-6SSOVZOI.js";
+import "./mesh.chunk-SEIVILJR.js";
 import "./mesh.chunk-OW5EMVG5.js";
 
 // packages/mesh-cli/bin/mesh.ts

package/dist/bin/{mesh.login-3AWVGPCM.js → mesh.login-J3QPALUS.js}

@@ -40,12 +40,12 @@ import {
   tokenStillValid,
   withDiscoveredFields,
   writeContextConfig
-} from "./mesh.chunk-7HTKSUWR.js";
+} from "./mesh.chunk-TFOKVJ34.js";
 import "./mesh.chunk-2QIVBQX5.js";
 import "./mesh.chunk-MCBMHWXP.js";
 import "./mesh.chunk-WFFDF346.js";
 import "./mesh.chunk-IQOBTL42.js";
-import "./mesh.chunk-6SSOVZOI.js";
+import "./mesh.chunk-SEIVILJR.js";
 export {
   CONFIG_DIR,
   CONFIG_FILE,

package/dist/bin/{mesh.platform-setup-2ZDMHRCI.js → mesh.platform-setup-SNIAJTWJ.js}

@@ -15,7 +15,7 @@ import {
   validateEnv,
   validateRegion,
   validateStateBucket
-} from "./mesh.chunk-NSQJEX36.js";
+} from "./mesh.chunk-CA4LI762.js";
 import "./mesh.chunk-IQOBTL42.js";
 export {
   DOMAIN_REQUIRED_MESSAGE,

package/dist/bin/{mesh.program-UKPDHRVX.js → mesh.program-T57YYRF5.js}

@@ -2,20 +2,20 @@ import {
   CLI_DESCRIPTION,
   CLI_NAME,
   createProgram
-} from "./mesh.chunk-HYXH4YMU.js";
-import "./mesh.chunk-YE2WIY3Y.js";
-import "./mesh.chunk-QPGAPLPU.js";
-import "./mesh.chunk-F44A3ACW.js";
-import "./mesh.chunk-NSQJEX36.js";
-import "./mesh.chunk-6AIG5OJM.js";
+} from "./mesh.chunk-M23VKWSF.js";
+import "./mesh.chunk-N55Y3YII.js";
+import "./mesh.chunk-NT2NPR7J.js";
+import "./mesh.chunk-TG4FBJK3.js";
+import "./mesh.chunk-CA4LI762.js";
+import "./mesh.chunk-CN6PMHQ5.js";
 import "./mesh.chunk-F4654EPX.js";
-import "./mesh.chunk-HJGMOEUG.js";
-import "./mesh.chunk-7HTKSUWR.js";
+import "./mesh.chunk-SOX2CJMU.js";
+import "./mesh.chunk-TFOKVJ34.js";
 import "./mesh.chunk-2QIVBQX5.js";
 import "./mesh.chunk-MCBMHWXP.js";
 import "./mesh.chunk-WFFDF346.js";
 import "./mesh.chunk-IQOBTL42.js";
-import "./mesh.chunk-6SSOVZOI.js";
+import "./mesh.chunk-SEIVILJR.js";
 import "./mesh.chunk-OW5EMVG5.js";
 export {
   CLI_DESCRIPTION,

package/dist/bin/{mesh.registry-JLQYFUNN.js → mesh.registry-UTIC3OY2.js}

@@ -17,14 +17,14 @@ import {
   runRegistryStatus,
   shouldRemintAfter,
   shouldRepairUserNpmrc
-} from "./mesh.chunk-6AIG5OJM.js";
-import "./mesh.chunk-HJGMOEUG.js";
-import "./mesh.chunk-7HTKSUWR.js";
+} from "./mesh.chunk-CN6PMHQ5.js";
+import "./mesh.chunk-SOX2CJMU.js";
+import "./mesh.chunk-TFOKVJ34.js";
 import "./mesh.chunk-2QIVBQX5.js";
 import "./mesh.chunk-MCBMHWXP.js";
 import "./mesh.chunk-WFFDF346.js";
 import "./mesh.chunk-IQOBTL42.js";
-import "./mesh.chunk-6SSOVZOI.js";
+import "./mesh.chunk-SEIVILJR.js";
 export {
   CONTEXT_IGNORED_NOTICE,
   NOT_AUTHORIZED_RERUN,

package/dist/bin/{mesh.registry-identity-3AR27UGO.js → mesh.registry-identity-Y4Y5WFQ3.js}

@@ -15,13 +15,13 @@ import {
   registrySessionCandidates,
   registryTokenRoles,
   resolveRegistryIdentity
-} from "./mesh.chunk-HJGMOEUG.js";
-import "./mesh.chunk-7HTKSUWR.js";
+} from "./mesh.chunk-SOX2CJMU.js";
+import "./mesh.chunk-TFOKVJ34.js";
 import "./mesh.chunk-2QIVBQX5.js";
 import "./mesh.chunk-MCBMHWXP.js";
 import "./mesh.chunk-WFFDF346.js";
 import "./mesh.chunk-IQOBTL42.js";
-import "./mesh.chunk-6SSOVZOI.js";
+import "./mesh.chunk-SEIVILJR.js";
 export {
   REGISTRY_ALIAS,
   REGISTRY_CREDENTIAL_KEY,

package/dist/bin/{mesh.review-command-LUVZQN2T.js → mesh.review-command-LYTUNZ5G.js}

@@ -10,15 +10,15 @@ import {
   discoverStackExternalServices,
   ensureAwsCredentialsForStack,
   resolveExternalServiceScope
-} from "./mesh.chunk-YE2WIY3Y.js";
-import "./mesh.chunk-7HTKSUWR.js";
+} from "./mesh.chunk-N55Y3YII.js";
+import "./mesh.chunk-TFOKVJ34.js";
 import "./mesh.chunk-2QIVBQX5.js";
 import "./mesh.chunk-MCBMHWXP.js";
 import {
   logInfo
 } from "./mesh.chunk-WFFDF346.js";
 import "./mesh.chunk-IQOBTL42.js";
-import "./mesh.chunk-6SSOVZOI.js";
+import "./mesh.chunk-SEIVILJR.js";
 
 // packages/mesh-cli/src/commands/mcp/review-command.ts
 import { SSMClient } from "@aws-sdk/client-ssm";

package/dist/bin/{mesh.start-OU2V6C7B.js → mesh.start-OWIKVKN6.js}

@@ -4,7 +4,7 @@ import {
   reportAssembly,
   resolveCliRuntime,
   runAssemble
-} from "./mesh.chunk-QPGAPLPU.js";
+} from "./mesh.chunk-NT2NPR7J.js";
 import {
   logError,
   logInfo,
@@ -13,7 +13,7 @@ import {
 import {
   homeNpmrcPath,
   parseNpmrcRegistryAuth
-} from "./mesh.chunk-6SSOVZOI.js";
+} from "./mesh.chunk-SEIVILJR.js";
 
 // packages/mesh-cli/src/docs/start.ts
 import { execFileSync as execFileSync2 } from "node:child_process";

package/dist/bin/{mesh.wizard-FCTT55KI.js → mesh.wizard-QL5SQ47K.js}

@@ -2,24 +2,24 @@ import {
   bootstrapAppsRepo,
   isInsidePlatformMonorepo,
   shouldBootstrapAppsRepo
-} from "./mesh.chunk-F44A3ACW.js";
+} from "./mesh.chunk-TG4FBJK3.js";
 import {
   PLATFORM_SETUP_DEFAULTS,
   ensureStateBucket,
   renderPlatformNextSteps,
   resolvePlatformSetup,
   scaffoldPlatformRepo
-} from "./mesh.chunk-NSQJEX36.js";
+} from "./mesh.chunk-CA4LI762.js";
 import {
   RegistryNotAuthorizedError
-} from "./mesh.chunk-6AIG5OJM.js";
+} from "./mesh.chunk-CN6PMHQ5.js";
 import {
   resolveTargetRoot,
   syncSkills
 } from "./mesh.chunk-F4654EPX.js";
 import {
   readRegistrySession
-} from "./mesh.chunk-HJGMOEUG.js";
+} from "./mesh.chunk-SOX2CJMU.js";
 import {
   detectLocalTenant,
   discoverConfigForContext,
@@ -31,7 +31,7 @@ import {
   runLoginFlow,
   tokenStillValid,
   writeMeshJson
-} from "./mesh.chunk-7HTKSUWR.js";
+} from "./mesh.chunk-TFOKVJ34.js";
 import "./mesh.chunk-2QIVBQX5.js";
 import "./mesh.chunk-MCBMHWXP.js";
 import {
@@ -44,7 +44,7 @@ import {
 } from "./mesh.chunk-IQOBTL42.js";
 import {
   probeRegistryToken
-} from "./mesh.chunk-6SSOVZOI.js";
+} from "./mesh.chunk-SEIVILJR.js";
 
 // packages/mesh-cli/src/commands/init/wizard.ts
 import * as fs from "fs";
@@ -157,7 +157,7 @@ var registryStep = {
     try {
       logInfo(REGISTRY_WHY);
       const login = ctx.seams?.runRegistryLogin ?? (async (opts) => {
-        const { runRegistryLogin } = await import("./mesh.registry-JLQYFUNN.js");
+        const { runRegistryLogin } = await import("./mesh.registry-UTIC3OY2.js");
         await runRegistryLogin(void 0, opts);
       });
       await login({ device: ctx.device, profile: ctx.profile });

package/dist/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "5aae56b1b",
-  "builtAt": "2026-10-23T21:01:47.691Z"
+  "commit": "772a007d6",
+  "builtAt": "2026-10-25T03:35:13.360Z"
 }

package/dist/src/commands/temporal.js

@@ -275,9 +275,9 @@ var init_kubeconfig = __esm({
 
 // packages/mesh-cli/src/utils/temporal-auth.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-async function resolveTemporalAuth(tenant, env, platformName = tenant) {
+async function resolveTemporalAuth(tenant, env, platformName = tenant, deps = {}) {
   const { SSMClient: SSMClient2, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient2({ region: process.env.AWS_REGION || "us-east-2" });
+  const ssm = deps.ssm ?? new SSMClient2({ region: process.env.AWS_REGION || "us-east-2" });
   const results = {};
   async function trySSM(name) {
     try {
@@ -287,16 +287,25 @@ async function resolveTemporalAuth(tenant, env, platformName = tenant) {
       return void 0;
     }
   }
+  async function tryFirstSSM(names) {
+    for (const name of names) {
+      const value = await trySSM(name);
+      if (value !== void 0) return value;
+    }
+    return void 0;
+  }
   try {
-    const workerPath = `/mesh-platform/${tenant}/${env}/temporal/worker-service-account-key`;
-    const exchangePath = `/mesh-platform/${tenant}/${env}/temporal/token-exchange-app`;
-    const workerJson = await trySSM(workerPath);
+    const temporalSecret = (name) => [
+      `/platform-secrets/${tenant}/${env}/temporal/${name}`,
+      `/mesh-platform/${tenant}/${env}/temporal/${name}`
+    ];
+    const workerJson = await tryFirstSSM(temporalSecret("worker-service-account-key"));
     if (workerJson) {
       const worker = JSON.parse(workerJson);
       results.TEMPORAL_AUTH_CLIENT_ID = worker.clientId;
       results.TEMPORAL_AUTH_CLIENT_SECRET = worker.clientSecret;
     }
-    const exchangeJson = await trySSM(exchangePath);
+    const exchangeJson = await tryFirstSSM(temporalSecret("token-exchange-app"));
     if (exchangeJson) {
       const exchange = JSON.parse(exchangeJson);
       results.ZITADEL_TOKEN_EXCHANGE_CLIENT_ID = exchange.clientId;