@mesh-tech/mesh-cli 0.40.9 → 0.40.10

package/dist/bin/{mesh.auth-preflight-AUFQ2FGD.js → mesh.auth-preflight-RCZH7V34.js}

@@ -21,7 +21,7 @@ import {
   registryPreflight,
   stripUnscopedCodeArtifactRegistry,
   upsertNpmrcLines
-} from "./mesh.chunk-6SSOVZOI.js";
+} from "./mesh.chunk-SEIVILJR.js";
 export {
   REGISTRY_LOGIN_FIX,
   REGISTRY_LOGIN_FIX_AWS,

package/dist/bin/{mesh.chunk-NSQJEX36.js → mesh.chunk-CA4LI762.js}

@@ -181,7 +181,7 @@ async function scaffoldPlatformRepo(setup) {
       remediation: { command: `mesh init platform ${setup.tenant} --dir <empty-dir>` }
     });
   }
-  const { copyTemplate } = await import("./mesh.create-app-Z3RKSTBO.js");
+  const { copyTemplate } = await import("./mesh.create-app-QRAZVRA3.js");
   const { findPackageRoot } = await import("./mesh.stack-EFTFAOCV.js");
   const { syncSkills } = await import("./mesh.skills-MNDSMBIE.js");
   const templateDir = path.join(findPackageRoot(), "templates", "platform-repo");

package/dist/bin/{mesh.chunk-6AIG5OJM.js → mesh.chunk-CN6PMHQ5.js}

@@ -11,10 +11,10 @@ import {
   refreshRegistrySession,
   registryAccountState,
   resolveRegistryIdentity
-} from "./mesh.chunk-HJGMOEUG.js";
+} from "./mesh.chunk-SOX2CJMU.js";
 import {
   readCredentials
-} from "./mesh.chunk-7HTKSUWR.js";
+} from "./mesh.chunk-TFOKVJ34.js";
 import {
   logError,
   logInfo,
@@ -34,7 +34,7 @@ import {
   readAwsConfig,
   stripUnscopedCodeArtifactRegistry,
   upsertNpmrcLines
-} from "./mesh.chunk-6SSOVZOI.js";
+} from "./mesh.chunk-SEIVILJR.js";
 
 // packages/mesh-cli/src/commands/registry.ts
 import { execFileSync as execFileSync2 } from "child_process";

package/dist/bin/{mesh.chunk-HYXH4YMU.js → mesh.chunk-M23VKWSF.js}

@@ -7,22 +7,22 @@ import {
   parseInstanceIndex,
   resolveSecretsContext,
   setCommand
-} from "./mesh.chunk-YE2WIY3Y.js";
+} from "./mesh.chunk-N55Y3YII.js";
 import {
   cliReferenceStaleness,
   resolveCliRuntime,
   runPortalCommand
-} from "./mesh.chunk-QPGAPLPU.js";
+} from "./mesh.chunk-NT2NPR7J.js";
 import {
   registerAppCommands,
   registerCreateAppCommand
-} from "./mesh.chunk-F44A3ACW.js";
+} from "./mesh.chunk-TG4FBJK3.js";
 import {
   PLATFORM_SETUP_DEFAULTS
-} from "./mesh.chunk-NSQJEX36.js";
+} from "./mesh.chunk-CA4LI762.js";
 import {
   registerRegistryCommands
-} from "./mesh.chunk-6AIG5OJM.js";
+} from "./mesh.chunk-CN6PMHQ5.js";
 import {
   registerSkillsCommands,
   resolveTargetRoot,
@@ -77,7 +77,7 @@ import {
   waitForPort,
   worktreeStackName,
   writeEnvFile
-} from "./mesh.chunk-7HTKSUWR.js";
+} from "./mesh.chunk-TFOKVJ34.js";
 import {
   COMPOSE_PROJECT,
   DEFAULT_HUB_PORT,
@@ -126,7 +126,7 @@ import {
   homeNpmrcPath,
   isNpmAuthError,
   probeRegistryToken
-} from "./mesh.chunk-6SSOVZOI.js";
+} from "./mesh.chunk-SEIVILJR.js";
 import {
   createVcsFolderReader,
   deriveVcsBaseUrl,
@@ -1541,7 +1541,7 @@ var DOCS_PREVIEW_PORT = "4410";
 var CLI_REFERENCE_PATH = "docs/portal/generated/cli-reference.md";
 async function renderCliReference() {
   const [{ createProgram: createProgram2 }, { extractCliReference, renderCliReferenceMarkdown }] = await Promise.all([
-    import("./mesh.program-UKPDHRVX.js"),
+    import("./mesh.program-T57YYRF5.js"),
     import("./mesh.cli-reference-H3TOPIET.js")
   ]);
   return renderCliReferenceMarkdown(extractCliReference(createProgram2()));
@@ -1613,7 +1613,7 @@ function registerDocsCommand(program) {
     "Serve the Mesh docs locally \u2014 detached in a tmux session by default; the working tree in a mesh-platform checkout, or the published @mesh-tech/docs artifact (role-gated registry) anywhere else"
   ).option("-v, --version <version>", "docs version to serve (== the @mesh-tech/* baseline it describes); default: latest", void 0).option("-p, --port <port>", "port to serve on (0 picks a free one)", "4400").option("--dev", "in a checkout: run the Zudoku dev server (HMR) in the foreground, for authoring", false).option("--foreground", "serve in the foreground (the agent/CI path; automatic when not a TTY)", false).action(
     (opts) => guarded(async () => {
-      const { runDocsStart } = await import("./mesh.start-OU2V6C7B.js");
+      const { runDocsStart } = await import("./mesh.start-OWIKVKN6.js");
       await runDocsStart({
         repoRoot: findRepoRoot(process.cwd()),
         version: opts.version,
@@ -1625,13 +1625,13 @@ function registerDocsCommand(program) {
   );
   docs.command("stop").description(`Stop the detached docs server (the tmux session "${"mesh-docs"}")`).action(
     () => guarded(async () => {
-      const { runDocsStop } = await import("./mesh.start-OU2V6C7B.js");
+      const { runDocsStop } = await import("./mesh.start-OWIKVKN6.js");
       runDocsStop();
     })()
   );
   docs.command("serve-static", { hidden: true }).option("--root <dir>", "built site root", "").option("--port <port>", "port", "4400").action(
     (opts) => guarded(async () => {
-      const { runDocsServeStatic } = await import("./mesh.start-OU2V6C7B.js");
+      const { runDocsServeStatic } = await import("./mesh.start-OWIKVKN6.js");
       await runDocsServeStatic(opts);
     })()
   );
@@ -1674,7 +1674,7 @@ function registerDocsCommand(program) {
   );
   docs.command("list").description("List the published docs versions (each is an @mesh-tech/* baseline)").action(
     () => guarded(async () => {
-      const { runDocsList } = await import("./mesh.start-OU2V6C7B.js");
+      const { runDocsList } = await import("./mesh.start-OWIKVKN6.js");
       await runDocsList();
     })()
   );
@@ -2197,7 +2197,7 @@ async function registryChecks(args) {
   const { fix, profile } = args;
   const probe = args.probe ?? probeRegistryToken;
   const login = args.login ?? (async () => {
-    const { runRegistryLogin } = await import("./mesh.registry-JLQYFUNN.js");
+    const { runRegistryLogin } = await import("./mesh.registry-UTIC3OY2.js");
     await runRegistryLogin(void 0, profile ? { profile } : {});
   });
   const REGISTRY_FIX = registryFixCommand(profile);
@@ -2353,7 +2353,7 @@ function registerInitCommands(program) {
     `nothing deployed yet \u2014 scaffold a tenant platform repo for \`<tenant>.<env>\` (default env: ${PLATFORM_SETUP_DEFAULTS.env}) and print its deploy sequence`
   ).option("--region <region>", `--new-platform: AWS region (default: ${PLATFORM_SETUP_DEFAULTS.region})`).option("--domain <domain>", "--new-platform: base public domain you control; the core stack creates the zone {env}.{domain} and stops at the mesh-gateway Ingress until you delegate its NS records. No default \u2014 a placeholder scaffolds a zone that can never validate").option("--state-bucket <bucket>", "--new-platform: Pulumi state S3 bucket (default: {tenant}-mesh-platform-pulumi-state)").option("--create-state-bucket", "--new-platform: create the state bucket (versioned) if it does not exist").option("--no-create-state-bucket", "--new-platform: never create the state bucket; print the aws command instead").option("--dir <path>", "--new-platform: where to scaffold the platform repo (default: ./{tenant}-mesh-platform)").option("--device", "device-code sign-in for the registry and platform steps (headless / SSH)").option("--profile <aws-profile>", "AWS profile this machine uses: read the registry without the broker (deployers only), and the profile a --new-platform stack config references").option("--skip-repo", "do not bootstrap, check or record anything in the current repo", false).option("--yes", "accept every default and never prompt", false).option("--json", "one JSON document on stdout ({tenant, mode, steps, next}); human output on stderr", false).action(
     async (opts) => {
-      const { runInitWizard } = await import("./mesh.wizard-FCTT55KI.js");
+      const { runInitWizard } = await import("./mesh.wizard-QL5SQ47K.js");
       const code = await runInitWizard(opts);
       if (code !== 0) process.exitCode = code;
     }
@@ -2369,7 +2369,7 @@ function registerInitCommands(program) {
         throw new MeshCliError(`Invalid tenant name '${tenant}' (lowercase alphanumeric + dashes).`);
       }
       const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
-      const { resolvePlatformSetup, scaffoldPlatformRepo, ensureStateBucket, renderPlatformNextSteps } = await import("./mesh.platform-setup-2ZDMHRCI.js");
+      const { resolvePlatformSetup, scaffoldPlatformRepo, ensureStateBucket, renderPlatformNextSteps } = await import("./mesh.platform-setup-SNIAJTWJ.js");
       const setup = await resolvePlatformSetup(tenant, opts, {
         prompts: interactive && !opts.yes ? await setupPrompts() : void 0,
         interactive
@@ -3373,7 +3373,7 @@ function registerMcpCommands(program) {
     "--secret <id>",
     "Secrets Manager secret holding the Integration credential (default: the deployed ExternalService's own secret)"
   ).action(async (manifest, opts) => {
-    const { runMcpReviewCommand } = await import("./mesh.review-command-LUVZQN2T.js");
+    const { runMcpReviewCommand } = await import("./mesh.review-command-LYTUNZ5G.js");
     try {
       await runMcpReviewCommand(manifest, opts);
     } catch (error) {
@@ -3408,7 +3408,7 @@ function registerMcpCommands(program) {
           `No pnpm-workspace.yaml above ${serveDir}: the worker image installs this package from a pnpm workspace, so it must be in one.`
         );
       } else if (!membership.member && membership.suggestedGlob) {
-        const { ensureWorkspaceGlobs } = await import("./mesh.create-app-Z3RKSTBO.js");
+        const { ensureWorkspaceGlobs } = await import("./mesh.create-app-QRAZVRA3.js");
         const added = ensureWorkspaceGlobs(path9.dirname(membership.workspaceFile), [
           membership.suggestedGlob
         ]);
@@ -6401,7 +6401,7 @@ async function resolveToken(opts) {
   if (opts.token) return opts.token;
   if (process.env.VCS_TOKEN) return process.env.VCS_TOKEN;
   if (opts.context) {
-    const { getValidToken: getValidToken2 } = await import("./mesh.login-3AWVGPCM.js");
+    const { getValidToken: getValidToken2 } = await import("./mesh.login-J3QPALUS.js");
     const token = await getValidToken2(opts.context);
     if (token) return token;
   }

package/dist/bin/{mesh.chunk-YE2WIY3Y.js → mesh.chunk-N55Y3YII.js}

@@ -5,7 +5,7 @@ import {
   readStackConfig,
   resolveAwsCredentials,
   resolveStackOption
-} from "./mesh.chunk-7HTKSUWR.js";
+} from "./mesh.chunk-TFOKVJ34.js";
 import {
   isAwsErrorCode
 } from "./mesh.chunk-MCBMHWXP.js";

package/dist/bin/{mesh.chunk-QPGAPLPU.js → mesh.chunk-NT2NPR7J.js}

@@ -1051,7 +1051,7 @@ async function cliReferenceStaleness(repoRoot) {
     { createProgram },
     { extractCliReference, renderCliReferenceMarkdown }
   ] = await Promise.all([
-    import("./mesh.program-UKPDHRVX.js"),
+    import("./mesh.program-T57YYRF5.js"),
     import("./mesh.cli-reference-H3TOPIET.js")
   ]);
   const outPath = path3.join(repoRoot, "docs/portal/generated/cli-reference.md");

package/dist/bin/{mesh.chunk-6SSOVZOI.js → mesh.chunk-SEIVILJR.js}

@@ -107,7 +107,7 @@ async function registryPreflight(opts) {
   const probe = await probeRegistryToken(opts);
   let session = null;
   try {
-    const { readRegistrySession } = await import("./mesh.registry-identity-3AR27UGO.js");
+    const { readRegistrySession } = await import("./mesh.registry-identity-Y4Y5WFQ3.js");
     session = readRegistrySession();
   } catch {
   }

package/dist/bin/{mesh.chunk-HJGMOEUG.js → mesh.chunk-SOX2CJMU.js}

@@ -15,7 +15,7 @@ import {
   runLoginFlow,
   tokenStillValid,
   writeContextConfig
-} from "./mesh.chunk-7HTKSUWR.js";
+} from "./mesh.chunk-TFOKVJ34.js";
 import {
   logInfo
 } from "./mesh.chunk-WFFDF346.js";

package/dist/bin/{mesh.chunk-7HTKSUWR.js → mesh.chunk-TFOKVJ34.js}

@@ -49,7 +49,7 @@ import {
   isExpiredAwsTokenMessage,
   probeRegistryToken,
   registryLoginFix
-} from "./mesh.chunk-6SSOVZOI.js";
+} from "./mesh.chunk-SEIVILJR.js";
 
 // packages/mesh-cli/src/commands/login.ts
 import * as http from "http";
@@ -1478,9 +1478,9 @@ async function ensureKubeconfig(platformName, env, sessionName, deps = {}) {
 
 // packages/mesh-cli/src/utils/temporal-auth.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
-async function resolveTemporalAuth(tenant, env, platformName = tenant) {
+async function resolveTemporalAuth(tenant, env, platformName = tenant, deps = {}) {
   const { SSMClient: SSMClient2, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient2({ region: process.env.AWS_REGION || "us-east-2" });
+  const ssm = deps.ssm ?? new SSMClient2({ region: process.env.AWS_REGION || "us-east-2" });
   const results = {};
   async function trySSM(name) {
     try {
@@ -1490,16 +1490,25 @@ async function resolveTemporalAuth(tenant, env, platformName = tenant) {
       return void 0;
     }
   }
+  async function tryFirstSSM(names) {
+    for (const name of names) {
+      const value = await trySSM(name);
+      if (value !== void 0) return value;
+    }
+    return void 0;
+  }
   try {
-    const workerPath = `/mesh-platform/${tenant}/${env}/temporal/worker-service-account-key`;
-    const exchangePath = `/mesh-platform/${tenant}/${env}/temporal/token-exchange-app`;
-    const workerJson = await trySSM(workerPath);
+    const temporalSecret = (name) => [
+      `/platform-secrets/${tenant}/${env}/temporal/${name}`,
+      `/mesh-platform/${tenant}/${env}/temporal/${name}`
+    ];
+    const workerJson = await tryFirstSSM(temporalSecret("worker-service-account-key"));
     if (workerJson) {
       const worker = JSON.parse(workerJson);
       results.TEMPORAL_AUTH_CLIENT_ID = worker.clientId;
       results.TEMPORAL_AUTH_CLIENT_SECRET = worker.clientSecret;
     }
-    const exchangeJson = await trySSM(exchangePath);
+    const exchangeJson = await tryFirstSSM(temporalSecret("token-exchange-app"));
     if (exchangeJson) {
       const exchange = JSON.parse(exchangeJson);
       results.ZITADEL_TOKEN_EXCHANGE_CLIENT_ID = exchange.clientId;
@@ -7833,7 +7842,7 @@ function registerDevCommand(program) {
     "tmux"
   );
   dev.command("__token-server <port> <context>", { hidden: true }).action(async (port, context) => {
-    const { startTokenServer } = await import("./mesh.dev-token-server-XG26C6IQ.js");
+    const { startTokenServer } = await import("./mesh.dev-token-server-DIECW5KC.js");
     await startTokenServer(Number(port), context);
   });
   dev.action(async (options) => {
@@ -10971,9 +10980,9 @@ function refuseReservedRegistryContext(context, verb) {
 }
 async function hintRegistryIfMissing() {
   try {
-    const { readRegistrySession } = await import("./mesh.registry-identity-3AR27UGO.js");
+    const { readRegistrySession } = await import("./mesh.registry-identity-Y4Y5WFQ3.js");
     if (readRegistrySession()) return;
-    const { probeRegistryToken: probeRegistryToken2 } = await import("./mesh.auth-preflight-AUFQ2FGD.js");
+    const { probeRegistryToken: probeRegistryToken2 } = await import("./mesh.auth-preflight-RCZH7V34.js");
     const probe = await probeRegistryToken2();
     if (probe.state === "missing" || probe.state === "expired") {
       logInfo(REGISTRY_SEPARATE_HINT);