refactor: rename cli-v2 → cli, archive legacy cli, plus broker-side grants + auto-migrate

- apps/cli/ is now the canonical CLI (was apps/cli-v2/).
- apps/cli/ legacy v0 archived as branch 'legacy-cli-archive' and tag
  'cli-v0-legacy-final' before deletion; git history preserves it too.
- .github/workflows/release-cli.yml paths updated.
- pnpm-lock.yaml regenerated.

Broker-side peer-grant enforcement (spec: 2026-04-15-per-peer-capabilities):
- 0020_peer-grants.sql adds peer_grants jsonb + GIN index on mesh.member.
- handleSend in broker fetches recipient grant maps once per send, drops
  messages silently when sender lacks the required capability.
- POST /cli/mesh/:slug/grants to update from CLI; broker_messages_dropped_by_grant_total metric.
- CLI grant/revoke/block now mirror to broker via syncToBroker.

Auto-migrate on broker startup:
- apps/broker/src/migrate.ts runs drizzle migrate with pg_advisory_lock
  before the HTTP server binds. Exits non-zero on failure so Coolify
  healthcheck fails closed.
- Dockerfile copies packages/db/migrations into /app/migrations.
- postgres 3.4.5 added as direct broker dep.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/cli/src/commands/welcome.ts

@@ -1,111 +1,72 @@
 /**
- * Stateful welcome screen — shown when the user runs `claudemesh`
- * with no arguments. Detects install state + joined meshes + prints
- * the next action they should take.
+ * `claudemesh` with no args + no joined meshes → unified onboarding.
  *
- * States, in priority order:
- *   1. MCP not registered in ~/.claude.json       → run install
- *   2. Config dir exists but no meshes joined     → run join
- *   3. Meshes joined, all reachable               → run launch
- *   4. Meshes joined, broker unreachable          → run status / doctor
+ * One flow, one keystroke per decision. Collapses the old three-branch
+ * picker (signup / login / join) into a linear path:
+ *
+ *   1. Already have an invite URL? → paste it, run the bare-URL join+launch.
+ *      (no account needed — invites are self-signed capabilities)
+ *   2. Else: open the browser for sign-in + mesh creation at claudemesh.com
+ *      and fall back to paste-sync when the browser hand-off lands.
+ *
+ * The branch that used to be "register" collapses into the browser flow
+ * (the web handles signup + mesh creation as one wizard there).
  */
 
-import { existsSync, readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { loadConfig } from "../state/config";
-import { VERSION } from "../version";
+import { createInterface } from "node:readline";
+import { readConfig } from "~/services/config/facade.js";
+import { renderWelcome } from "~/ui/welcome/index.js";
+import { login } from "./login.js";
+import { render } from "~/ui/render.js";
+import { isInviteUrl, normaliseInviteUrl } from "~/utils/url.js";
+import { EXIT } from "~/constants/exit-codes.js";
 
-type State = "no-install" | "no-meshes" | "ready" | "broken-config";
-
-function detectState(): State {
-  // 1. MCP registered?
-  const claudeConfig = join(homedir(), ".claude.json");
-  let mcpRegistered = false;
-  if (existsSync(claudeConfig)) {
-    try {
-      const cfg = JSON.parse(readFileSync(claudeConfig, "utf-8")) as {
-        mcpServers?: Record<string, unknown>;
-      };
-      mcpRegistered = Boolean(cfg.mcpServers?.["claudemesh"]);
-    } catch {
-      /* treat parse errors as not-registered */
-    }
-  }
-  if (!mcpRegistered) return "no-install";
-
-  // 2. Config parseable + has meshes?
-  try {
-    const cfg = loadConfig();
-    return cfg.meshes.length === 0 ? "no-meshes" : "ready";
-  } catch {
-    return "broken-config";
-  }
+function prompt(q: string): Promise<string> {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) => {
+    rl.question(q, (a) => { rl.close(); resolve(a.trim()); });
+  });
 }
 
-export function runWelcome(): void {
-  const useColor =
-    !process.env.NO_COLOR && process.env.TERM !== "dumb" && process.stdout.isTTY;
-  const bold = (s: string): string => (useColor ? `\x1b[1m${s}\x1b[22m` : s);
-  const dim = (s: string): string => (useColor ? `\x1b[2m${s}\x1b[22m` : s);
-  const green = (s: string): string => (useColor ? `\x1b[32m${s}\x1b[39m` : s);
-  const yellow = (s: string): string => (useColor ? `\x1b[33m${s}\x1b[39m` : s);
+export async function runWelcome(): Promise<number> {
+  const config = readConfig();
+  if (config.meshes.length > 0) return EXIT.SUCCESS;
 
-  console.log(bold(`claudemesh v${VERSION}`) + dim(" — peer mesh for Claude Code"));
-  console.log("─".repeat(60));
+  renderWelcome();
 
-  const state = detectState();
+  render.info("Do you already have an invite link? (y/n) [n]");
+  const hasInvite = (await prompt("  > ")).toLowerCase().startsWith("y");
 
-  switch (state) {
-    case "no-install":
-      console.log("Welcome. Let's get you set up.");
-      console.log("");
-      console.log(bold("Step 1:") + " register the MCP server + status hooks");
-      console.log(`  ${green("$")} claudemesh install`);
-      console.log("");
-      console.log(dim("Step 2 (after restart): claudemesh join <invite-url>"));
-      console.log(dim("Step 3:                 claudemesh launch"));
-      break;
-
-    case "no-meshes":
-      console.log(green("✓") + " MCP registered. Now join a mesh.");
-      console.log("");
-      console.log(bold("Step 2:") + " join a mesh");
-      console.log(`  ${green("$")} claudemesh join https://claudemesh.com/join/<token>`);
-      console.log("");
-      console.log(
-        dim("  Don't have an invite? Create one at ") +
-          bold("https://claudemesh.com") +
-          dim(" or ask a mesh owner."),
-      );
-      console.log("");
-      console.log(dim("Step 3 (after joining): claudemesh launch"));
-      break;
-
-    case "ready": {
-      const cfg = loadConfig();
-      const meshNames = cfg.meshes.map((m) => m.slug).join(", ");
-      console.log(green("✓") + " MCP registered.");
-      console.log(green("✓") + ` ${cfg.meshes.length} mesh(es) joined: ${meshNames}`);
-      console.log("");
-      console.log(bold("You're ready.") + " Launch Claude Code with real-time peer messages:");
-      console.log(`  ${green("$")} claudemesh launch`);
-      console.log("");
-      console.log(dim("  (Plain `claude` works too — messages pull-only via check_messages.)"));
-      console.log("");
-      console.log(dim("Health check:  claudemesh status"));
-      console.log(dim("Diagnostics:   claudemesh doctor"));
-      console.log(dim("All commands:  claudemesh --help"));
-      break;
+  if (hasInvite) {
+    render.blank();
+    render.info("Paste your invite link (claudemesh.com/i/... or claudemesh://...)");
+    const raw = await prompt("  > ");
+    if (!raw || !isInviteUrl(raw)) {
+      render.err("That doesn't look like a claudemesh invite URL.");
+      render.hint("Check your email — the link starts with https://claudemesh.com/i/");
+      return EXIT.INVALID_ARGS;
     }
-
-    case "broken-config":
-      console.log(yellow("⚠") + "  Your ~/.claudemesh/config.json is unreadable.");
-      console.log("");
-      console.log("Run diagnostics to see what's wrong:");
-      console.log(`  ${green("$")} claudemesh doctor`);
-      break;
+    const normalised = normaliseInviteUrl(raw);
+    render.blank();
+    render.ok(`Joining via ${normalised}`);
+    const { runLaunch } = await import("./launch.js");
+    await runLaunch(
+      {
+        join: normalised,
+        name: process.env.USER ?? process.env.USERNAME ?? undefined,
+        yes: false,
+      },
+      [],
+    );
+    return EXIT.SUCCESS;
   }
 
-  console.log("");
+  // No invite → browser-first sign-in + mesh creation.
+  render.blank();
+  render.info("Opening claudemesh.com so you can sign in and create your first mesh.");
+  render.hint("After sign-in, paste the sync token back here when prompted.");
+  render.blank();
+  return await login();
 }
+
+export { runWelcome as _stub };