@mesh-tech/mesh-cli 0.13.0 → 0.15.0

package/dist/bin/mesh.js

@@ -580,11 +580,11 @@ function createVcsFolderReader(opts) {
     }
     return p;
   };
-  const readPath = async (repo, path41) => {
+  const readPath = async (repo, path42) => {
     const dir = await cloneRepo(repo);
-    const ref = await resolveFolderRef(dir, path41);
-    if (!ref) throw new Error(`path "${path41}" not found on any ref of ${repo}`);
-    const files = await readFolderAtRef(dir, ref, path41);
+    const ref = await resolveFolderRef(dir, path42);
+    if (!ref) throw new Error(`path "${path42}" not found on any ref of ${repo}`);
+    const files = await readFolderAtRef(dir, ref, path42);
     return { ref, files };
   };
   const cleanup = async () => {
@@ -1530,7 +1530,7 @@ function execTailscaleCmd(args) {
     }
     attempts.push({ binary, args });
   }
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve16, reject) => {
     let index = 0;
     function tryNext() {
       if (index >= attempts.length) {
@@ -1542,7 +1542,7 @@ function execTailscaleCmd(args) {
         if (error) {
           tryNext();
         } else {
-          resolve15(stdout);
+          resolve16(stdout);
         }
       });
     }
@@ -1859,8 +1859,8 @@ function resolveHubPlatformName(platform) {
   return platform?.name ?? "mesh";
 }
 async function ssmGetParameter(name) {
-  const { SSMClient: SSMClient4, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4({ region: process.env.AWS_REGION || "us-east-2" });
+  const { SSMClient: SSMClient5, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5({ region: process.env.AWS_REGION || "us-east-2" });
   const resp = await ssm.send(new GetParameterCommand2({ Name: name, WithDecryption: true }));
   return resp.Parameter?.Value;
 }
@@ -1901,8 +1901,8 @@ var init_kubeconfig = __esm({
 // libs/mesh-cli/src/utils/temporal-auth.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
 async function resolveTemporalAuth(tenant, env, platformName = tenant) {
-  const { SSMClient: SSMClient4, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4({ region: process.env.AWS_REGION || "us-east-2" });
+  const { SSMClient: SSMClient5, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5({ region: process.env.AWS_REGION || "us-east-2" });
   const results = {};
   async function trySSM(name) {
     try {
@@ -2034,14 +2034,14 @@ var init_temporal_auth = __esm({
 // libs/mesh-cli/src/utils/reachability.ts
 import { createConnection } from "node:net";
 function probeTcpReachable(host, port, timeoutMs = 1500) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     let settled = false;
     const socket = createConnection({ host, port });
     const finish = (ok) => {
       if (settled) return;
       settled = true;
       socket.destroy();
-      resolve15(ok);
+      resolve16(ok);
     };
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => finish(true));
@@ -2050,7 +2050,7 @@ function probeTcpReachable(host, port, timeoutMs = 1500) {
   });
 }
 function probeConnectionHolds(host, port, timeoutMs = 800, holdMs = 25) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     let settled = false;
     let holdTimer;
     const socket = createConnection({ host, port });
@@ -2059,7 +2059,7 @@ function probeConnectionHolds(host, port, timeoutMs = 800, holdMs = 25) {
       settled = true;
       if (holdTimer) clearTimeout(holdTimer);
       socket.destroy();
-      resolve15(ok);
+      resolve16(ok);
     };
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
@@ -2191,16 +2191,16 @@ async function waitForPort(host, port, timeoutMs, intervalMs = 500) {
     const attemptTimeout = Math.max(250, Math.min(1e3, remaining));
     if (await tryConnect(host, port, attemptTimeout)) return true;
     if (Date.now() + intervalMs >= deadline) return false;
-    await new Promise((resolve15) => setTimeout(resolve15, intervalMs));
+    await new Promise((resolve16) => setTimeout(resolve16, intervalMs));
   }
 }
 function tryConnect(host, port, timeoutMs) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const socket = net.connect({ host, port });
     const done = (ok) => {
       socket.removeAllListeners();
       socket.destroy();
-      resolve15(ok);
+      resolve16(ok);
     };
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => done(true));
@@ -2277,7 +2277,7 @@ async function ensureTemporalNamespace(namespace, description) {
         });
         break;
       } catch {
-        await new Promise((resolve15) => setTimeout(resolve15, 1e3));
+        await new Promise((resolve16) => setTimeout(resolve16, 1e3));
       }
     }
     logSuccess(`Temporal namespace '${namespace}' is active`);
@@ -2297,8 +2297,8 @@ function buildFabricCheckPayload(targetBytes = 8e3) {
   return JSON.stringify({ ...base, pad: "x".repeat(Math.max(0, targetBytes - overhead)) });
 }
 async function verifyFabric() {
-  const { SSMClient: SSMClient4, PutParameterCommand, GetParameterCommand: GetParameterCommand2, GetParametersByPathCommand: GetParametersByPathCommand3, DeleteParametersCommand } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4(AWS_CONFIG);
+  const { SSMClient: SSMClient5, PutParameterCommand, GetParameterCommand: GetParameterCommand2, GetParametersByPathCommand: GetParametersByPathCommand3, DeleteParametersCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5(AWS_CONFIG);
   const payload = buildFabricCheckPayload();
   const mainParam = FABRIC_CHECK_PATH;
   const childParams = [`${FABRIC_CHECK_PATH}/vpc`, `${FABRIC_CHECK_PATH}/eks`];
@@ -2350,8 +2350,8 @@ async function verifyFabric() {
   }
 }
 async function registerTenantEnv(tenant, opts = {}) {
-  const { SSMClient: SSMClient4, PutParameterCommand } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4(AWS_CONFIG);
+  const { SSMClient: SSMClient5, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5(AWS_CONFIG);
   await ssm.send(
     new PutParameterCommand({
       Name: `/mesh-platform/${tenant}`,
@@ -2379,8 +2379,8 @@ async function registerTenantEnv(tenant, opts = {}) {
   );
 }
 async function seedLocalPlatform() {
-  const { SSMClient: SSMClient4, PutParameterCommand } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4(AWS_CONFIG);
+  const { SSMClient: SSMClient5, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5(AWS_CONFIG);
   await ssm.send(
     new PutParameterCommand({
       Name: APP_TENANTS_PARAM,
@@ -2434,14 +2434,14 @@ var init_seed = __esm({
 // libs/mesh-cli/src/commands/local/helpers.ts
 import * as net2 from "net";
 async function upsertLocalSecret(secretId, value, client) {
-  const { SecretsManagerClient: SecretsManagerClient8, CreateSecretCommand: CreateSecretCommand3, PutSecretValueCommand: PutSecretValueCommand3 } = await import("@aws-sdk/client-secrets-manager");
-  const sm = client ?? new SecretsManagerClient8(LOCAL_AWS_CONFIG);
+  const { SecretsManagerClient: SecretsManagerClient9, CreateSecretCommand: CreateSecretCommand4, PutSecretValueCommand: PutSecretValueCommand4 } = await import("@aws-sdk/client-secrets-manager");
+  const sm = client ?? new SecretsManagerClient9(LOCAL_AWS_CONFIG);
   const secretString = JSON.stringify(value);
   try {
-    await sm.send(new CreateSecretCommand3({ Name: secretId, SecretString: secretString }));
+    await sm.send(new CreateSecretCommand4({ Name: secretId, SecretString: secretString }));
   } catch (err) {
     if (err?.name === "ResourceExistsException") {
-      await sm.send(new PutSecretValueCommand3({ SecretId: secretId, SecretString: secretString }));
+      await sm.send(new PutSecretValueCommand4({ SecretId: secretId, SecretString: secretString }));
     } else {
       throw err;
     }
@@ -2449,16 +2449,16 @@ async function upsertLocalSecret(secretId, value, client) {
 }
 function probeTcp(port, opts = {}) {
   const { host = "127.0.0.1", timeoutMs = 2e3 } = opts;
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const socket = net2.connect({ host, port, timeout: timeoutMs });
     socket.once("connect", () => {
       socket.destroy();
-      resolve15(true);
+      resolve16(true);
     });
-    socket.once("error", () => resolve15(false));
+    socket.once("error", () => resolve16(false));
     socket.once("timeout", () => {
       socket.destroy();
-      resolve15(false);
+      resolve16(false);
     });
   });
 }
@@ -2496,7 +2496,8 @@ __export(stack_exports, {
   stackDir: () => stackDir,
   stackOwnedElsewhere: () => stackOwnedElsewhere,
   stackServices: () => stackServices,
-  summarizeComposeFailure: () => summarizeComposeFailure
+  summarizeComposeFailure: () => summarizeComposeFailure,
+  writeAppServiceProbes: () => writeAppServiceProbes
 });
 import { execFileSync as execFileSync4, spawn, spawnSync } from "child_process";
 import * as fs7 from "fs";
@@ -2514,6 +2515,26 @@ function localProbesDir() {
   fs7.mkdirSync(dir, { recursive: true });
   return dir;
 }
+function writeAppServiceProbes(args) {
+  const entries = Object.entries(args.services);
+  if (entries.length === 0) return void 0;
+  const healthPath = args.healthPath ?? "/health";
+  const targets = entries.map(([name, port]) => ({
+    targets: [`http://host.docker.internal:${port}${healthPath}`],
+    labels: {
+      type: "service",
+      tenant: args.tenant,
+      env: args.env,
+      app: args.app,
+      service: name,
+      target: name
+    }
+  }));
+  const file = path8.join(localProbesDir(), `${args.tenant}-${args.app}-services.json`);
+  fs7.writeFileSync(file, `${JSON.stringify(targets, null, 2)}
+`);
+  return file;
+}
 function hubPort() {
   const raw = process.env.MESH_HUB_PORT?.trim();
   if (!raw) return DEFAULT_HUB_PORT;
@@ -2690,7 +2711,7 @@ async function composeStreamed(args, opts = {}) {
   let captured = "";
   let exitCode;
   try {
-    exitCode = await new Promise((resolve15, reject) => {
+    exitCode = await new Promise((resolve16, reject) => {
       const child = spawn("docker", fullArgs, {
         cwd: dir,
         env,
@@ -2706,11 +2727,11 @@ async function composeStreamed(args, opts = {}) {
       child.stdout.on("data", consume);
       child.stderr.on("data", consume);
       child.on("error", reject);
-      child.on("close", (code) => resolve15(code ?? 1));
+      child.on("close", (code) => resolve16(code ?? 1));
     });
   } finally {
     heartbeat.stop();
-    await new Promise((resolve15) => logStream.end(resolve15));
+    await new Promise((resolve16) => logStream.end(resolve16));
   }
   if (exitCode !== 0) {
     throw new MeshCliError(
@@ -2798,6 +2819,13 @@ var init_stack = __esm({
         probe: { kind: "http", url: "http://localhost:8080/debug/healthz" },
         hint: "admin@local.mesh / LocalDev1!"
       },
+      {
+        service: "mailpit",
+        label: "Mailbox (local mail)",
+        url: "http://localhost:8025",
+        probe: { kind: "http", url: "http://localhost:8025/readyz" },
+        hint: "every activation + password-reset mail Zitadel sends locally lands here"
+      },
       {
         service: "database",
         label: "Postgres",
@@ -3158,12 +3186,12 @@ async function fetchRemoteExternalCredentials(tenant, env, external, profile) {
   const region = process.env.MESH_PLATFORM_REGION ?? process.env.AWS_REGION ?? "us-east-2";
   const fallbackProfile = !process.env.AWS_ACCESS_KEY_ID && !process.env.AWS_PROFILE ? process.env.MESH_AWS_PROFILE ?? profile : void 0;
   try {
-    const { SecretsManagerClient: SecretsManagerClient8, GetSecretValueCommand: GetSecretValueCommand8 } = await import("@aws-sdk/client-secrets-manager");
+    const { SecretsManagerClient: SecretsManagerClient9, GetSecretValueCommand: GetSecretValueCommand9 } = await import("@aws-sdk/client-secrets-manager");
     if (fallbackProfile) process.env.AWS_PROFILE = fallbackProfile;
-    const sm = new SecretsManagerClient8({ region });
+    const sm = new SecretsManagerClient9({ region });
     let res;
     try {
-      res = await sm.send(new GetSecretValueCommand8({ SecretId: secretId }));
+      res = await sm.send(new GetSecretValueCommand9({ SecretId: secretId }));
     } finally {
       if (fallbackProfile) delete process.env.AWS_PROFILE;
     }
@@ -3277,8 +3305,8 @@ async function seedLocalMock(args) {
     `${secretName}/.config`,
     Object.fromEntries(Object.entries(value).filter(([key]) => !SECRET_KEY_RE.test(key)))
   );
-  const { SSMClient: SSMClient4, PutParameterCommand } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4(LOCAL_AWS_CONFIG);
+  const { SSMClient: SSMClient5, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5(LOCAL_AWS_CONFIG);
   const base = `/mesh-platform/${tenant}/${LOCAL_ENV}/apps/${app}/stacks/local/external-services/${decl.external}`;
   await ssm.send(
     new PutParameterCommand({
@@ -3382,16 +3410,48 @@ var init_mocks = __esm({
 });
 
 // libs/api-registry/src/hub-roles.ts
-var HUB_STAFF_ROLES, HUB_RESTRICTED_ROLES, HUB_BASE_ROLES, RESTRICTED;
+function restrictedRoleBase(roleKey) {
+  const sep5 = roleKey.indexOf(HUB_ROLE_KEY_SEPARATOR);
+  const base = sep5 === -1 ? roleKey : roleKey.slice(0, sep5);
+  return RESTRICTED.has(base) ? base : null;
+}
+function hubRoleKeyTenant(roleKey) {
+  const sep5 = roleKey.indexOf(HUB_ROLE_KEY_SEPARATOR);
+  if (sep5 === -1) return null;
+  const scope = roleKey.slice(sep5 + 1);
+  const appSep = scope.indexOf(HUB_ROLE_APP_SEPARATOR);
+  return appSep === -1 ? scope : scope.slice(0, appSep);
+}
+function hubOperatorRoleKeys(tenants) {
+  const cleaned = [...new Set(tenants.filter((t) => t !== ""))].sort();
+  for (const tenant of cleaned) {
+    for (const sep5 of [HUB_ROLE_KEY_SEPARATOR, HUB_ROLE_APP_SEPARATOR]) {
+      if (tenant.includes(sep5)) {
+        throw new Error(
+          `hubOperatorRoleKeys: tenant name "${tenant}" contains the role-key separator "${sep5}" \u2014 it would parse as a different tenant's or app's grant`
+        );
+      }
+    }
+  }
+  return [
+    ...HUB_BASE_ROLES,
+    ...cleaned.flatMap(
+      (tenant) => HUB_RESTRICTED_ROLES.map((role) => `${role}${HUB_ROLE_KEY_SEPARATOR}${tenant}`)
+    )
+  ];
+}
+var HUB_STAFF_ROLES, HUB_RESTRICTED_ROLES, HUB_BASE_ROLES, HUB_ROLE_KEY_SEPARATOR, HUB_ROLE_APP_SEPARATOR, RESTRICTED;
 var init_hub_roles = __esm({
   "libs/api-registry/src/hub-roles.ts"() {
     "use strict";
-    HUB_STAFF_ROLES = ["ops", "admin", "developer"];
-    HUB_RESTRICTED_ROLES = ["auditor", "vendor"];
+    HUB_STAFF_ROLES = ["ops", "admin"];
+    HUB_RESTRICTED_ROLES = ["developer", "auditor", "vendor"];
     HUB_BASE_ROLES = [
       ...HUB_STAFF_ROLES,
       ...HUB_RESTRICTED_ROLES
     ];
+    HUB_ROLE_KEY_SEPARATOR = ":";
+    HUB_ROLE_APP_SEPARATOR = "/";
     RESTRICTED = new Set(HUB_RESTRICTED_ROLES);
   }
 });
@@ -3506,7 +3566,9 @@ async function api(pat, method, apiPath, body, orgId) {
   const text = await res.text();
   const data = text ? JSON.parse(text) : {};
   if (!res.ok) {
-    const err = new Error(`Zitadel ${method} ${apiPath} \u2192 ${res.status}: ${data?.message ?? text}`);
+    const err = new Error(
+      `Zitadel ${method} ${apiPath} \u2192 ${res.status}: ${data?.message ?? text}`
+    );
     err.status = res.status;
     err.zitadelCode = data?.code;
     throw err;
@@ -3552,7 +3614,12 @@ async function ensureCliApp(pat, projectId) {
     logInfo(`Zitadel app '${CLI_APP_NAME}' already exists`);
     return existing;
   }
-  const created = await api(pat, "POST", `/management/v1/projects/${projectId}/apps/oidc`, buildCliAppPayload());
+  const created = await api(
+    pat,
+    "POST",
+    `/management/v1/projects/${projectId}/apps/oidc`,
+    buildCliAppPayload()
+  );
   logSuccess(`Created Zitadel application '${CLI_APP_NAME}' (PKCE + device code)`);
   return created.clientId;
 }
@@ -3594,12 +3661,16 @@ function readHubAuth() {
     return null;
   }
 }
+function hubRoleDisplayName(roleKey) {
+  const tenant = hubRoleKeyTenant(roleKey);
+  return tenant === null ? roleKey : `${restrictedRoleBase(roleKey) ?? roleKey} (${tenant})`;
+}
 async function ensureHubRoles(pat, projectId) {
   for (const role of HUB_ROLES) {
     try {
       await api(pat, "POST", `/management/v1/projects/${projectId}/roles`, {
         roleKey: role,
-        displayName: role
+        displayName: hubRoleDisplayName(role)
       });
       logSuccess(`Created Hub role '${role}'`);
     } catch (err) {
@@ -3628,7 +3699,10 @@ async function reconcileHubRedirectUris(pat, projectId, app) {
     redirectUris,
     postLogoutRedirectUris,
     responseTypes: cfg.responseTypes ?? ["OIDC_RESPONSE_TYPE_CODE"],
-    grantTypes: cfg.grantTypes ?? ["OIDC_GRANT_TYPE_AUTHORIZATION_CODE", "OIDC_GRANT_TYPE_REFRESH_TOKEN"],
+    grantTypes: cfg.grantTypes ?? [
+      "OIDC_GRANT_TYPE_AUTHORIZATION_CODE",
+      "OIDC_GRANT_TYPE_REFRESH_TOKEN"
+    ],
     appType: "OIDC_APP_TYPE_WEB",
     authMethodType: "OIDC_AUTH_METHOD_TYPE_BASIC",
     accessTokenType: cfg.accessTokenType ?? "OIDC_TOKEN_TYPE_JWT",
@@ -3637,7 +3711,9 @@ async function reconcileHubRedirectUris(pat, projectId, app) {
     idTokenUserinfoAssertion: cfg.idTokenUserinfoAssertion ?? true,
     devMode: cfg.devMode ?? true
   });
-  logSuccess(`Registered Hub redirect URI http://localhost:${hubPort()}/oauth2/callback (MESH_HUB_PORT)`);
+  logSuccess(
+    `Registered Hub redirect URI http://localhost:${hubPort()}/oauth2/callback (MESH_HUB_PORT)`
+  );
 }
 async function ensureHubApp(pat, projectId) {
   const existing = await searchZitadelApp(pat, projectId, HUB_APP_NAME);
@@ -3713,15 +3789,42 @@ async function seedHubAuth(pat) {
   const persistedCookie = persisted?.cookieSecret && [16, 24, 32].includes(persisted.cookieSecret.length) ? persisted.cookieSecret : void 0;
   const config = {
     clientId: app.clientId,
+    projectId,
     clientSecret: app.clientSecret ?? persisted?.clientSecret ?? "",
     cookieSecret: persistedCookie ?? (await import("crypto")).randomBytes(16).toString("hex")
   };
   fs9.writeFileSync(hubAuthPath(), JSON.stringify(config, null, 2), { mode: 384 });
   return config;
 }
+async function publishHubAuthzPointer(projectId, orgId, awsConfig) {
+  const { SSMClient: SSMClient5, GetParameterCommand: GetParameterCommand2, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5(awsConfig);
+  const name = `/mesh-platform/${LOCAL_TENANT}/${LOCAL_ENV}/apps/hub/stacks/local/authz`;
+  let current = {};
+  try {
+    const existing = await ssm.send(new GetParameterCommand2({ Name: name }));
+    current = JSON.parse(existing.Parameter?.Value ?? "{}");
+  } catch {
+  }
+  const value = {
+    spicedb: { instanceRefs: [] },
+    ...current,
+    zitadel: { projectId, orgId, issuer: ZITADEL_ISSUER }
+  };
+  await ssm.send(
+    new PutParameterCommand({
+      Name: name,
+      Type: "String",
+      Overwrite: true,
+      Value: JSON.stringify(value),
+      Description: "Hub authz pointer (local analog of the platform Pulumi program)"
+    })
+  );
+  logSuccess(`Hub authz pointer published \u2192 project ${projectId} in org ${orgId}`);
+}
 async function writeRegistryParams(cliClientId, awsConfig) {
-  const { SSMClient: SSMClient4, PutParameterCommand } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4(awsConfig);
+  const { SSMClient: SSMClient5, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5(awsConfig);
   await ssm.send(
     new PutParameterCommand({
       Name: ZITADEL_SSM_PARAM,
@@ -3743,6 +3846,77 @@ async function writeRegistryParams(cliClientId, awsConfig) {
     );
   }
 }
+async function ensureOpsHubAdmin(pat, awsConfig) {
+  const {
+    SecretsManagerClient: SecretsManagerClient9,
+    GetSecretValueCommand: GetSecretValueCommand9,
+    CreateSecretCommand: CreateSecretCommand4,
+    PutSecretValueCommand: PutSecretValueCommand4
+  } = await import("@aws-sdk/client-secrets-manager");
+  const sm = new SecretsManagerClient9(awsConfig);
+  const existing = await sm.send(new GetSecretValueCommand9({ SecretId: OPS_HUB_SECRET_ID })).catch(() => null);
+  if (existing?.SecretString) {
+    logSuccess("Hub admin key already provisioned (Zitadel writes enabled)");
+    return;
+  }
+  const userName = "hub-opshub";
+  const found = await api(pat, "POST", "/management/v1/users/_search", {
+    queries: [{ userNameQuery: { userName, method: "TEXT_QUERY_METHOD_EQUALS" } }]
+  });
+  let userId = found?.result?.[0]?.id;
+  if (!userId) {
+    const created = await api(pat, "POST", "/management/v1/users/machine", {
+      userName,
+      name: "Hub Ops Hub admin",
+      description: "Local Hub Zitadel admin plane (seeded by mesh start)"
+    });
+    userId = created?.userId;
+  }
+  if (!userId) throw new MeshCliError("could not create the Hub's Zitadel admin user");
+  await api(pat, "POST", "/admin/v1/members", { userId, roles: ["IAM_OWNER"] }).catch(
+    () => void 0
+  );
+  const key = await api(pat, "POST", `/management/v1/users/${userId}/keys`, {
+    type: "KEY_TYPE_JSON"
+  });
+  if (!key?.keyDetails)
+    throw new MeshCliError("Zitadel did not return a machine key for the Hub admin user");
+  const raw = JSON.parse(Buffer.from(key.keyDetails, "base64").toString("utf8"));
+  const secretString = JSON.stringify({ keyId: raw.keyId, key: raw.key, userId: raw.userId });
+  await sm.send(new CreateSecretCommand4({ Name: OPS_HUB_SECRET_ID, SecretString: secretString })).catch(async () => {
+    await sm.send(
+      new PutSecretValueCommand4({ SecretId: OPS_HUB_SECRET_ID, SecretString: secretString })
+    );
+  });
+  logSuccess(`Hub admin key provisioned \u2192 ${OPS_HUB_SECRET_ID} (Zitadel writes enabled)`);
+}
+async function ensureLocalSmtp(pat) {
+  try {
+    const existing = await api(pat, "POST", "/admin/v1/smtp/_search", {}).catch(() => null);
+    const configs = existing?.result ?? [];
+    const match = configs.find((c) => c.host === LOCAL_SMTP.host);
+    if (!match) {
+      const created = await api(pat, "POST", "/admin/v1/smtp", {
+        senderAddress: LOCAL_SMTP.from,
+        senderName: LOCAL_SMTP.fromName,
+        tls: false,
+        host: LOCAL_SMTP.host,
+        user: "",
+        password: ""
+      });
+      if (created?.id) await api(pat, "POST", `/admin/v1/smtp/${created.id}/_activate`, {});
+      logSuccess(`Local mailbox wired to Zitadel \u2192 ${LOCAL_SMTP.host} (view at http://localhost:8025)`);
+      return;
+    }
+    if (match.state !== "SMTP_CONFIG_ACTIVE" && match.id) {
+      await api(pat, "POST", `/admin/v1/smtp/${match.id}/_activate`, {});
+    }
+  } catch (err) {
+    logWarn(
+      `Could not wire the local mailbox to Zitadel (${err.message}). Activation and password-reset mail will not be delivered locally.`
+    );
+  }
+}
 async function seedZitadel(awsConfig) {
   const pat = readSeederPat();
   const org = await api(pat, "POST", "/admin/v1/orgs/_search", {
@@ -3754,21 +3928,26 @@ async function seedZitadel(awsConfig) {
       { remediation: { command: "mesh stop --destroy && mesh start" } }
     );
   }
-  logSuccess(`Platform org '${PLATFORM_ORG}' ready (platform tenant root \u2014 holds platform-service auth config)`);
+  logSuccess(
+    `Platform org '${PLATFORM_ORG}' ready (platform tenant root \u2014 holds platform-service auth config)`
+  );
   try {
     await api(pat, "PUT", "/v2/features/instance", { loginV2: { required: false } });
   } catch {
   }
+  await ensureLocalSmtp(pat);
   const projectId = await ensureCliProject(pat);
   const cliClientId = await ensureCliApp(pat, projectId);
   await ensureTestUsers(pat);
   const hubAuth = await seedHubAuth(pat);
+  await publishHubAuthzPointer(hubAuth.projectId, org.result[0].id, awsConfig);
   await writeRegistryParams(cliClientId, awsConfig);
+  await ensureOpsHubAdmin(pat, awsConfig);
   writeContextConfig(LOGIN_CONTEXT, { issuer: ZITADEL_ISSUER, clientId: cliClientId });
   logSuccess(`Login context '${LOGIN_CONTEXT}' configured \u2192 try: mesh login ${LOGIN_CONTEXT}`);
   return { projectId, cliClientId, hubAuth };
 }
-var ZITADEL_ISSUER, LOGIN_CONTEXT, PLATFORM_ORG, CLI_PROJECT_NAME, CLI_APP_NAME, CLI_REDIRECT_URI, HUB_PROJECT_NAME, HUB_APP_NAME, hubRedirectUri, HUB_DEFAULT_REDIRECT_URI, HUB_ROLES, ZITADEL_SSM_PARAM, TEST_USERS_SSM_PREFIX, TEST_USERS, isAlreadyExists, ensureCliProject, ensureHubProject;
+var ZITADEL_ISSUER, LOGIN_CONTEXT, PLATFORM_ORG, CLI_PROJECT_NAME, CLI_APP_NAME, CLI_REDIRECT_URI, HUB_PROJECT_NAME, HUB_APP_NAME, hubRedirectUri, HUB_DEFAULT_REDIRECT_URI, HUB_ROLES, ZITADEL_SSM_PARAM, TEST_USERS_SSM_PREFIX, TEST_USERS, isAlreadyExists, ensureCliProject, ensureHubProject, OPS_HUB_SECRET_ID, LOCAL_SMTP;
 var init_seed_zitadel = __esm({
   "libs/mesh-cli/src/commands/local/seed-zitadel.ts"() {
     "use strict";
@@ -3788,16 +3967,37 @@ var init_seed_zitadel = __esm({
     HUB_APP_NAME = "ui";
     hubRedirectUri = () => `http://localhost:${hubPort()}/oauth2/callback`;
     HUB_DEFAULT_REDIRECT_URI = `http://localhost:${DEFAULT_HUB_PORT}/oauth2/callback`;
-    HUB_ROLES = HUB_BASE_ROLES;
+    HUB_ROLES = hubOperatorRoleKeys([LOCAL_TENANT]);
     ZITADEL_SSM_PARAM = `/mesh-platform/${LOCAL_TENANT}/${LOCAL_ENV}/platform/zitadel`;
     TEST_USERS_SSM_PREFIX = `/mesh-platform/${LOCAL_TENANT}/${LOCAL_ENV}/temporal/test-users`;
     TEST_USERS = [
-      { name: "dev", email: "dev@local.mesh", firstName: "Dev", lastName: "User", password: "LocalDev1!" },
-      { name: "ops", email: "ops@local.mesh", firstName: "Ops", lastName: "User", password: "LocalDev1!" }
+      {
+        name: "dev",
+        email: "dev@local.mesh",
+        firstName: "Dev",
+        lastName: "User",
+        password: "LocalDev1!"
+      },
+      {
+        name: "ops",
+        email: "ops@local.mesh",
+        firstName: "Ops",
+        lastName: "User",
+        password: "LocalDev1!"
+      }
     ];
     isAlreadyExists = (err) => err?.status === 409 || err?.zitadelCode === 6 || /already exists/i.test(err?.message ?? "");
-    ensureCliProject = (pat) => ensureZitadelProject(pat, CLI_PROJECT_NAME, { describe: "platform client feature", logExisting: true });
+    ensureCliProject = (pat) => ensureZitadelProject(pat, CLI_PROJECT_NAME, {
+      describe: "platform client feature",
+      logExisting: true
+    });
     ensureHubProject = (pat) => ensureZitadelProject(pat, HUB_PROJECT_NAME, { describe: "Hub platform app" });
+    OPS_HUB_SECRET_ID = "mesh/local/dev/zitadel/ops-hub";
+    LOCAL_SMTP = {
+      host: "mailpit:1025",
+      from: "no-reply@local.mesh",
+      fromName: "Mesh (local)"
+    };
   }
 });
 
@@ -3911,9 +4111,9 @@ async function ensureM2mCaller(pat, tenant, app, orgId, projectId, roles) {
   return false;
 }
 async function authSecretExists(tenant, app, service) {
-  const { SecretsManagerClient: SecretsManagerClient8, GetSecretValueCommand: GetSecretValueCommand8 } = await import("@aws-sdk/client-secrets-manager");
-  const sm = new SecretsManagerClient8(LOCAL_AWS_CONFIG);
-  return sm.send(new GetSecretValueCommand8({ SecretId: authSecretPath(tenant, app, service) })).then(
+  const { SecretsManagerClient: SecretsManagerClient9, GetSecretValueCommand: GetSecretValueCommand9 } = await import("@aws-sdk/client-secrets-manager");
+  const sm = new SecretsManagerClient9(LOCAL_AWS_CONFIG);
+  return sm.send(new GetSecretValueCommand9({ SecretId: authSecretPath(tenant, app, service) })).then(
     () => true,
     () => false
   );
@@ -3924,8 +4124,8 @@ async function writeAuthSecret(tenant, app, service, value) {
   logSuccess(`Stored service credentials \u2192 ${name}`);
 }
 async function registerLocalApp(args) {
-  const { SSMClient: SSMClient4, PutParameterCommand } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4(LOCAL_AWS_CONFIG);
+  const { SSMClient: SSMClient5, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5(LOCAL_AWS_CONFIG);
   const put2 = (name, value, description) => ssm.send(
     new PutParameterCommand({ Name: name, Type: "String", Overwrite: true, Value: JSON.stringify(value), Description: description })
   );
@@ -3967,7 +4167,18 @@ async function registerLocalApp(args) {
   }
   await put2(
     `${base}/meta`,
-    { runtime: "mesh-dev-local", services: args.services, ports: args.ports ?? {} },
+    {
+      runtime: "mesh-dev-local",
+      services: args.services,
+      ports: args.ports ?? {},
+      // The same two fields a deployed stack stamps, so the Hub's app list and
+      // its activity timeline read a local run exactly as they read a deploy —
+      // which version of this app is running here, and since when. Without them
+      // a local app shows a blank version and never appears on the timeline,
+      // and "deployments aren't tracked" is indistinguishable from "no deploys".
+      ...args.version ? { version: args.version } : {},
+      deployedAt: (/* @__PURE__ */ new Date()).toISOString()
+    },
     "Local run metadata (mesh dev --local)"
   );
   logSuccess(`Registered app in the local registry \u2192 ${base}`);
@@ -3975,8 +4186,8 @@ async function registerLocalApp(args) {
 }
 async function reconcileRegistryFromZitadel() {
   const pat = readSeederPat();
-  const { SSMClient: SSMClient4, GetParameterCommand: GetParameterCommand2, PutParameterCommand } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4(LOCAL_AWS_CONFIG);
+  const { SSMClient: SSMClient5, GetParameterCommand: GetParameterCommand2, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5(LOCAL_AWS_CONFIG);
   const orgs = await api(pat, "POST", "/admin/v1/orgs/_search", { query: { limit: 200 } });
   const tenants = [];
   let apps = 0;
@@ -4041,6 +4252,57 @@ async function reconcileRegistryFromZitadel() {
   }
   return { tenants, apps };
 }
+async function ensureSignInApp(args) {
+  const pat = readSeederPat();
+  const orgId = await ensureOrg(pat, args.tenant);
+  const projectId = await ensureProject(pat, orgId, args.app);
+  const name = `${args.service}-web`;
+  const base = args.baseUrl.replace(/\/+$/, "");
+  const redirectUris = [`${base}/oauth2/callback`];
+  const postLogoutRedirectUris = [base, `${base}/`];
+  const config = {
+    redirectUris,
+    postLogoutRedirectUris,
+    responseTypes: ["OIDC_RESPONSE_TYPE_CODE"],
+    grantTypes: ["OIDC_GRANT_TYPE_AUTHORIZATION_CODE", "OIDC_GRANT_TYPE_REFRESH_TOKEN"],
+    appType: "OIDC_APP_TYPE_WEB",
+    authMethodType: "OIDC_AUTH_METHOD_TYPE_BASIC",
+    // Roles must ride in the token: the app authorizes on them, and the Hub
+    // shows which roles a person holds by reading the same grants.
+    accessTokenType: "OIDC_TOKEN_TYPE_JWT",
+    accessTokenRoleAssertion: true,
+    idTokenRoleAssertion: true,
+    idTokenUserinfoAssertion: true,
+    // http:// callbacks are only permitted in dev mode.
+    devMode: true
+  };
+  const existing = await searchZitadelApp(pat, projectId, name, orgId);
+  if (existing) {
+    await api(
+      pat,
+      "PUT",
+      `/management/v1/projects/${projectId}/apps/${existing.id}/oidc_config`,
+      config,
+      orgId
+    );
+    return;
+  }
+  const created = await api(
+    pat,
+    "POST",
+    `/management/v1/projects/${projectId}/apps/oidc`,
+    { name, ...config },
+    orgId
+  );
+  await writeAuthSecret(args.tenant, args.app, name, {
+    clientId: created.clientId,
+    clientSecret: created.clientSecret,
+    issuer: "http://localhost:8080",
+    orgId,
+    projectId
+  });
+  logSuccess(`Created Zitadel application '${name}' (browser sign-in \u2192 ${base}/oauth2/callback)`);
+}
 async function ensureAppTenantAuth(args) {
   const pat = readSeederPat();
   const orgId = await ensureOrg(pat, args.tenant);
@@ -4652,14 +4914,14 @@ function isConfigStale(configMtimeMs, startedAtIso) {
   return configMtimeMs > Date.parse(startedAtIso);
 }
 function canConnect(host, port, timeoutMs = 800) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const socket = new net3.Socket();
     let settled = false;
     const done = (ok) => {
       if (settled) return;
       settled = true;
       socket.destroy();
-      resolve15(ok);
+      resolve16(ok);
     };
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => done(true));
@@ -5118,7 +5380,7 @@ async function startTokenServer(port, context) {
     })();
   });
   server.on("error", (e) => logWarn(`token-server error: ${e.message}`));
-  await new Promise((resolve15) => server.listen(port, "127.0.0.1", resolve15));
+  await new Promise((resolve16) => server.listen(port, "127.0.0.1", resolve16));
   logInfo(`dev-user token-server on http://127.0.0.1:${port} (context ${context})`);
   await new Promise(() => {
   });
@@ -5141,6 +5403,26 @@ import * as os6 from "os";
 import * as path15 from "path";
 import { Option } from "commander";
 import { SecretsManagerClient as SecretsManagerClient2, GetSecretValueCommand as GetSecretValueCommand2 } from "@aws-sdk/client-secrets-manager";
+function registerServiceProbes(devOutput, tenant, probeFiles) {
+  const services = {};
+  for (const [name, service] of Object.entries(devOutput.services)) {
+    if (name.startsWith("mock-")) continue;
+    services[name] = service.port;
+  }
+  try {
+    const file = writeAppServiceProbes({
+      tenant,
+      env: devOutput.platform?.env ?? "dev",
+      app: devOutput.app ?? "",
+      services
+    });
+    if (file) probeFiles.push(file);
+  } catch (err) {
+    logWarn(
+      `Could not register uptime probes for this session (${err instanceof Error ? err.message : err}) \u2014 the Hub will show no uptime for these services.`
+    );
+  }
+}
 function deriveSessionName(projectName, wt) {
   return wt.isPrimary ? `${projectName}-dev` : `${projectName}-${wt.slug}`;
 }
@@ -5228,10 +5510,10 @@ function removeSessionState(sessionName) {
   }
 }
 async function isPortFree(port) {
-  const bindSucceeds = (host) => new Promise((resolve15) => {
+  const bindSucceeds = (host) => new Promise((resolve16) => {
     const server = net4.createServer();
-    server.once("error", () => resolve15(false));
-    const onListening = () => server.close(() => resolve15(true));
+    server.once("error", () => resolve16(false));
+    const onListening = () => server.close(() => resolve16(true));
     if (host === void 0) server.listen(port, onListening);
     else server.listen(port, host, onListening);
   });
@@ -5239,24 +5521,24 @@ async function isPortFree(port) {
   return bindSucceeds("127.0.0.1");
 }
 async function findFreePort() {
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve16, reject) => {
     const server = net4.createServer();
     server.once("error", reject);
     server.listen(0, "127.0.0.1", () => {
       const { port } = server.address();
-      server.close(() => resolve15(port));
+      server.close(() => resolve16(port));
     });
   });
 }
 function isPortListening(port) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const s = new net4.Socket();
     let done = false;
     const fin = (ok) => {
       if (done) return;
       done = true;
       s.destroy();
-      resolve15(ok);
+      resolve16(ok);
     };
     s.setTimeout(300);
     s.once("connect", () => fin(true));
@@ -6789,6 +7071,8 @@ function registerDevCommand(program2) {
         }
         return;
       }
+      let signInServices = [];
+      let appVersion;
       try {
         const tenant = localTenant;
         const app = rawDevOutput2.app ?? projectName;
@@ -6796,6 +7080,7 @@ function registerDevCommand(program2) {
         const services = Object.keys(rawDevOutput2.services);
         const authServices = services.filter((name) => !name.startsWith("mock-"));
         let authRoles = [];
+        signInServices = [];
         try {
           const appPkg = JSON.parse(
             fs13.readFileSync(path15.join(appRoot, "package.json"), "utf-8")
@@ -6803,6 +7088,10 @@ function registerDevCommand(program2) {
           if (Array.isArray(appPkg?.mesh?.auth?.roles)) {
             authRoles = appPkg.mesh.auth.roles.filter((r) => typeof r === "string");
           }
+          if (Array.isArray(appPkg?.mesh?.auth?.signIn)) {
+            signInServices = appPkg.mesh.auth.signIn.filter((r) => typeof r === "string");
+          }
+          if (typeof appPkg?.version === "string") appVersion = appPkg.version;
         } catch {
         }
         await ensureAppTenantAuth({ tenant, app, services: authServices, roles: authRoles });
@@ -6813,10 +7102,30 @@ function registerDevCommand(program2) {
         );
       }
       const devOutput2 = await allocatePorts(rawDevOutput2, worktree);
+      for (const service of signInServices) {
+        const port = devOutput2.services[service]?.port;
+        if (!port) {
+          logWarn(`mesh.auth.signIn names '${service}', which this app does not run \u2014 no sign-in app registered.`);
+          continue;
+        }
+        try {
+          await ensureSignInApp({
+            tenant: localTenant,
+            app: devOutput2.app ?? projectName,
+            service,
+            baseUrl: `http://localhost:${port}`
+          });
+        } catch (err) {
+          logWarn(
+            `Could not register the browser sign-in for '${service}' (${err instanceof Error ? err.message : err}) \u2014 the Hub's Access \u2192 Sign-in tab will report this app has no login.`
+          );
+        }
+      }
       try {
         await registerLocalApp({
           tenant: localTenant,
           app: devOutput2.app ?? projectName,
+          version: appVersion,
           services: Object.keys(devOutput2.services),
           ports: Object.fromEntries(
             Object.entries(devOutput2.services).map(([name, svc]) => [name, svc.port])
@@ -6893,6 +7202,7 @@ function registerDevCommand(program2) {
         );
         logInfo(`Docker runner: ${composePath}`);
         dockerDevUp(sessionName);
+        registerServiceProbes(devOutput2, localTenant, externalProbeFiles);
         saveSessionState(sessionName, {
           appRoot,
           stack: "local",
@@ -6924,6 +7234,7 @@ function registerDevCommand(program2) {
         { transport: "vpn-direct" }
         // local mode: no tunnels
       );
+      registerServiceProbes(finalDevOutput2, localTenant, externalProbeFiles);
       saveSessionState(sessionName, {
         appRoot,
         stack: "local",
@@ -7297,8 +7608,8 @@ function registerDevCommand(program2) {
   });
   dev.command("test-user [name]").description("Get Temporal test user credentials (from Pulumi-managed test users)").option("--tenant <tenant>", "Tenant name", "mesh").option("--env <env>", "Environment", "dev").option("--region <region>", "AWS region", "us-east-2").action(
     async (name, opts) => {
-      const { SSMClient: SSMClient4, GetParameterCommand: GetParameterCommand2, GetParametersByPathCommand: GetParametersByPathCommand3 } = await import("@aws-sdk/client-ssm");
-      const ssm = new SSMClient4({ region: opts.region });
+      const { SSMClient: SSMClient5, GetParameterCommand: GetParameterCommand2, GetParametersByPathCommand: GetParametersByPathCommand3 } = await import("@aws-sdk/client-ssm");
+      const ssm = new SSMClient5({ region: opts.region });
       const basePath = `/mesh-platform/${opts.tenant}/${opts.env}/temporal/test-users`;
       if (!name) {
         try {
@@ -7395,6 +7706,7 @@ var init_dev = __esm({
     init_seed();
     init_mocks();
     init_dev_local();
+    init_stack();
     init_docker_runner();
     init_errors();
     init_stack_flag();
@@ -7626,7 +7938,7 @@ function discoverRunnerPids(tenant, exclude) {
   }
 }
 function startControlServer(payload) {
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve16, reject) => {
     const server = net6.createServer((socket) => {
       socket.on("error", () => {
       });
@@ -7639,12 +7951,12 @@ function startControlServer(payload) {
     });
     server.on("error", reject);
     server.listen(0, "127.0.0.1", () => {
-      resolve15({ server, port: server.address().port });
+      resolve16({ server, port: server.address().port });
     });
   });
 }
 function queryControl(port, timeoutMs = 700) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const s = new net6.Socket();
     let buf = "";
     let done = false;
@@ -7652,7 +7964,7 @@ function queryControl(port, timeoutMs = 700) {
       if (done) return;
       done = true;
       s.destroy();
-      resolve15(v);
+      resolve16(v);
     };
     s.setTimeout(timeoutMs);
     s.once("timeout", () => fin(null));
@@ -7877,14 +8189,14 @@ function findRunningDaemon(tenant) {
   return null;
 }
 function portAccepts(port, timeoutMs = 400) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const s = new net7.Socket();
     let done = false;
     const fin = (v) => {
       if (done) return;
       done = true;
       s.destroy();
-      resolve15(v);
+      resolve16(v);
     };
     s.setTimeout(timeoutMs);
     s.once("connect", () => fin(true));
@@ -8422,24 +8734,24 @@ function deriveLoginServer2(context) {
   return `https://${parts.join(".")}`;
 }
 function findFreePort2() {
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve16, reject) => {
     const s = net8.createServer();
     s.on("error", reject);
     s.listen(0, "127.0.0.1", () => {
       const port = s.address().port;
-      s.close(() => resolve15(port));
+      s.close(() => resolve16(port));
     });
   });
 }
 function canConnect2(port) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const s = new net8.Socket();
     let settled = false;
     const done = (ok) => {
       if (settled) return;
       settled = true;
       s.destroy();
-      resolve15(ok);
+      resolve16(ok);
     };
     s.setTimeout(500);
     s.once("connect", () => done(true));
@@ -8798,13 +9110,13 @@ function parseContextTenantEnv(context) {
   return { tenant: tenant || "mesh", env: env || "dev" };
 }
 function findFreePort3() {
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve16, reject) => {
     const srv = net9.createServer();
     srv.on("error", reject);
     srv.listen(0, "127.0.0.1", () => {
       const addr = srv.address();
       const port = typeof addr === "object" && addr ? addr.port : 0;
-      srv.close(() => resolve15(port));
+      srv.close(() => resolve16(port));
     });
   });
 }
@@ -9291,9 +9603,9 @@ function parseTenantEnv(context) {
 }
 async function getRegistrySsmExport(tenant, env) {
   try {
-    const { SSMClient: SSMClient4, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
+    const { SSMClient: SSMClient5, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
     const region = process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? CA_REGION;
-    const ssm = new SSMClient4({ region });
+    const ssm = new SSMClient5({ region });
     const ssmPath = `/mesh-platform/${tenant}/${env}/registry`;
     const response = await ssm.send(new GetParameterCommand2({ Name: ssmPath }));
     if (!response.Parameter?.Value) return null;
@@ -9883,9 +10195,9 @@ async function discoverConfigFromSsm(context) {
   const ssmPath = `/mesh-platform/${tenant}/${env}/platform/zitadel`;
   logInfo(`Attempting SSM discovery from ${ssmPath}...`);
   try {
-    const { SSMClient: SSMClient4, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
+    const { SSMClient: SSMClient5, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
     const region = process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? "us-east-2";
-    const ssm = new SSMClient4({ region });
+    const ssm = new SSMClient5({ region });
     const resp = await ssm.send(new GetParameterCommand2({ Name: ssmPath }));
     const raw = resp.Parameter?.Value;
     if (!raw) {
@@ -9978,11 +10290,11 @@ function readAllCredentials() {
 function readCredentials(context) {
   return readAllCredentials()[context] ?? null;
 }
-function atomicWriteFileSync(path41, data, mode) {
-  const tmpPath = `${path41}.${process.pid}.${atomicWriteCounter++}.tmp`;
+function atomicWriteFileSync(path42, data, mode) {
+  const tmpPath = `${path42}.${process.pid}.${atomicWriteCounter++}.tmp`;
   try {
     fs19.writeFileSync(tmpPath, data, { mode });
-    fs19.renameSync(tmpPath, path41);
+    fs19.renameSync(tmpPath, path42);
   } catch (err) {
     try {
       fs19.unlinkSync(tmpPath);
@@ -10055,7 +10367,7 @@ async function refreshTokens(issuer, clientId, refreshToken) {
   return resp.json();
 }
 function login(context, config) {
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve16, reject) => {
     const codeVerifier = generateCodeVerifier();
     const codeChallenge = generateCodeChallenge(codeVerifier);
     const state = base64url(crypto3.randomBytes(16));
@@ -10139,7 +10451,7 @@ function login(context, config) {
         }
         hintVpnIfDisconnected(context);
         teardown();
-        resolve15();
+        resolve16();
       } catch (err) {
         teardown();
         reject(err);
@@ -11734,6 +12046,7 @@ __export(create_app_exports, {
   ensureWorkspaceGlobs: () => ensureWorkspaceGlobs,
   isInsidePlatformMonorepo: () => isInsidePlatformMonorepo,
   registerCreateAppCommand: () => registerCreateAppCommand,
+  resolveAppDir: () => resolveAppDir,
   shouldBootstrapAppsRepo: () => shouldBootstrapAppsRepo,
   workspaceGlobForApp: () => workspaceGlobForApp
 });
@@ -11918,7 +12231,7 @@ function parsePrimitives(input2) {
 }
 function resolveAppDir(cwd, tenant, name, test) {
   const baseDir = test ? "tests/tenants" : "tenants";
-  const possiblePaths = [
+  const possiblePaths = test ? [path24.join(cwd, baseDir, tenant, "apps")] : [
     path24.join(cwd, baseDir, tenant, "apps"),
     path24.join(cwd, "..", tenant, "apps"),
     path24.join(cwd, "apps")
@@ -12431,26 +12744,26 @@ async function startTunnelBackground(instanceId, rdsHost, rdsPort, localPort) {
   throw new Error(`Tunnel failed to start after ${maxAttempts} seconds`);
 }
 function checkPort(port) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const socket = new net10.Socket();
     socket.setTimeout(500);
     socket.on("connect", () => {
       socket.destroy();
-      resolve15(true);
+      resolve16(true);
     });
     socket.on("timeout", () => {
       socket.destroy();
-      resolve15(false);
+      resolve16(false);
     });
     socket.on("error", () => {
       socket.destroy();
-      resolve15(false);
+      resolve16(false);
     });
     socket.connect(port, "localhost");
   });
 }
 function sleep2(ms) {
-  return new Promise((resolve15) => setTimeout(resolve15, ms));
+  return new Promise((resolve16) => setTimeout(resolve16, ms));
 }
 async function psqlCommand(options) {
   let platformTenant;
@@ -12476,13 +12789,13 @@ async function psqlCommand(options) {
     logInfo(`App credentials: tenant=${appTenant}, stage=${appStage}, app=${appName}`);
   }
   const psqlCheck = spawn5("which", ["psql"]);
-  await new Promise((resolve15, reject) => {
+  await new Promise((resolve16, reject) => {
     psqlCheck.on("exit", (code) => {
       if (code !== 0) {
         logError("psql not found. Install with: brew install postgresql");
         reject(new Error("psql not found"));
       } else {
-        resolve15();
+        resolve16();
       }
     });
   });
@@ -12569,26 +12882,26 @@ function findSstOutputs() {
   return null;
 }
 function checkPort2(port) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const socket = new net11.Socket();
     socket.setTimeout(500);
     socket.on("connect", () => {
       socket.destroy();
-      resolve15(true);
+      resolve16(true);
     });
     socket.on("timeout", () => {
       socket.destroy();
-      resolve15(false);
+      resolve16(false);
     });
     socket.on("error", () => {
       socket.destroy();
-      resolve15(false);
+      resolve16(false);
     });
     socket.connect(port, "localhost");
   });
 }
 function sleep3(ms) {
-  return new Promise((resolve15) => setTimeout(resolve15, ms));
+  return new Promise((resolve16) => setTimeout(resolve16, ms));
 }
 async function startTunnelBackground2(instanceId, rdsEndpoint, rdsPort, localPort) {
   logInfo("Starting database tunnel...");
@@ -13308,7 +13621,7 @@ var init_discover = __esm({
 
 // libs/mesh-cli/src/docs/assemble.ts
 import { execFileSync as execFileSync20 } from "node:child_process";
-import { mkdirSync as mkdirSync15, readFileSync as readFileSync23, rmSync as rmSync5, writeFileSync as writeFileSync15 } from "node:fs";
+import { mkdirSync as mkdirSync15, readFileSync as readFileSync23, rmSync as rmSync5, writeFileSync as writeFileSync16 } from "node:fs";
 import path27 from "node:path";
 import { parse as parseYaml4 } from "yaml";
 function splitFrontMatter(markdown) {
@@ -13621,7 +13934,7 @@ function assemblePortal(options) {
 `;
     const outFile = path27.join(outDir, page.filePath);
     mkdirSync15(path27.dirname(outFile), { recursive: true });
-    writeFileSync15(
+    writeFileSync16(
       outFile,
       joinFrontMatter(outData, rewritten.body.trimEnd() + sourceNote)
     );
@@ -13928,8 +14241,8 @@ function formatDefault(value, paths = currentMachinePaths()) {
   if (typeof value === "boolean" || typeof value === "number") return String(value);
   return normalizeMachinePaths(JSON.stringify(value), paths);
 }
-function slugifyCommandPath(path41) {
-  return path41.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+function slugifyCommandPath(path42) {
+  return path42.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
 function extractOptions(command) {
   const options = command.options ?? [];
@@ -13963,17 +14276,17 @@ function isUndocumented(command) {
 function extractCommand(command, parentPath, depth) {
   const internals = command;
   const name = internals._name ?? "";
-  const path41 = parentPath ? `${parentPath} ${name}` : name;
+  const path42 = parentPath ? `${parentPath} ${name}` : name;
   return {
-    path: path41,
+    path: path42,
     name,
     aliases: [...internals._aliases ?? []],
     description: internals._description ?? "",
     args: extractArgs(command),
     options: extractOptions(command),
-    slug: slugifyCommandPath(path41),
+    slug: slugifyCommandPath(path42),
     depth,
-    subcommands: (internals.commands ?? []).filter((child) => !isUndocumented(child)).map((child) => extractCommand(child, path41, depth + 1))
+    subcommands: (internals.commands ?? []).filter((child) => !isUndocumented(child)).map((child) => extractCommand(child, path42, depth + 1))
   };
 }
 function extractCliReference(program2) {
@@ -14069,7 +14382,7 @@ import {
   mkdirSync as mkdirSync16,
   mkdtempSync as mkdtempSync3,
   readFileSync as readFileSync24,
-  writeFileSync as writeFileSync16
+  writeFileSync as writeFileSync17
 } from "node:fs";
 import { tmpdir as tmpdir6 } from "node:os";
 import path28 from "node:path";
@@ -14085,13 +14398,13 @@ function runAssemble(args) {
   const errors = [...discovery.errors];
   if (args.writeFiles !== false) {
     const manifestPath = args.outDir.includes(tmpdir6()) ? path28.join(args.outDir, PUBLISH_MANIFEST) : path28.join(args.outDir, "..", PUBLISH_MANIFEST);
-    writeFileSync16(
+    writeFileSync17(
       manifestPath,
       `${JSON.stringify(assembled.publishManifest, null, 2)}
 `
     );
     if (args.configOut) {
-      writeFileSync16(
+      writeFileSync17(
         args.configOut,
         renderZudokuConfig({
           navigation: assembled.navigation,
@@ -14106,7 +14419,7 @@ function runAssemble(args) {
         VERSION_JSON_DIR
       );
       mkdirSync16(versionDir, { recursive: true });
-      writeFileSync16(
+      writeFileSync17(
         path28.join(versionDir, VERSION_JSON),
         renderVersionJson({
           baseline: currentBaseline(args.repoRoot),
@@ -14161,7 +14474,7 @@ async function checkPortal(args) {
   }
   if (args.manifestOut) {
     mkdirSync16(path28.dirname(args.manifestOut), { recursive: true });
-    writeFileSync16(
+    writeFileSync17(
       args.manifestOut,
       `${JSON.stringify(result.assembled.publishManifest, null, 2)}
 `
@@ -14201,14 +14514,14 @@ ${summary}`);
 function runZudoku(args) {
   const cliArgs = args.mode === "dev" ? ["dev", "--port", String(args.port ?? 3e3)] : ["build"];
   logInfo(`Running \`zudoku ${cliArgs.join(" ")}\` in ${args.appDir}`);
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve16, reject) => {
     const child = spawn7("pnpm", ["exec", "zudoku", ...cliArgs], {
       cwd: args.appDir,
       stdio: "inherit",
       env: process.env
     });
     child.on("error", reject);
-    child.on("close", (code) => resolve15(code ?? 1));
+    child.on("close", (code) => resolve16(code ?? 1));
   });
 }
 async function runPortalCommand(opts, deps) {
@@ -14419,17 +14732,17 @@ async function serveDocsSite(args) {
       res.writeHead(500).end("internal error");
     });
   });
-  await new Promise((resolve15, reject) => {
+  await new Promise((resolve16, reject) => {
     server.once("error", reject);
-    server.listen(args.port, "127.0.0.1", () => resolve15());
+    server.listen(args.port, "127.0.0.1", () => resolve16());
   });
   const address = server.address();
   const port = typeof address === "object" && address ? address.port : args.port;
   return {
     url: `http://127.0.0.1:${port}`,
     port,
-    close: () => new Promise((resolve15, reject) => {
-      server.close((error) => error ? reject(error) : resolve15());
+    close: () => new Promise((resolve16, reject) => {
+      server.close((error) => error ? reject(error) : resolve16());
     })
   };
 }
@@ -14461,7 +14774,7 @@ var init_serve = __esm({
 
 // libs/mesh-cli/src/docs/registry-docs.ts
 import { execFileSync as execFileSync22 } from "node:child_process";
-import { existsSync as existsSync23, mkdirSync as mkdirSync17, readFileSync as readFileSync26, renameSync as renameSync3, rmSync as rmSync6, writeFileSync as writeFileSync17 } from "node:fs";
+import { existsSync as existsSync23, mkdirSync as mkdirSync17, readFileSync as readFileSync26, renameSync as renameSync3, rmSync as rmSync6, writeFileSync as writeFileSync18 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
 import path30 from "node:path";
 function readDocsRegistryAuth(npmrcPath2 = homeNpmrcPath()) {
@@ -14547,7 +14860,7 @@ async function fetchDocsArtifact(auth, version, cacheRoot = docsCacheRoot(), fet
   }
   mkdirSync17(cacheRoot, { recursive: true });
   const tgzPath = path30.join(cacheRoot, `.${version}.tgz`);
-  writeFileSync17(tgzPath, Buffer.from(await tgzResponse.arrayBuffer()));
+  writeFileSync18(tgzPath, Buffer.from(await tgzResponse.arrayBuffer()));
   const staging = path30.join(cacheRoot, `.staging-${version}`);
   rmSync6(staging, { recursive: true, force: true });
   mkdirSync17(staging, { recursive: true });
@@ -14591,7 +14904,7 @@ __export(start_exports, {
   tmuxServeArgs: () => tmuxServeArgs
 });
 import { execFileSync as execFileSync23 } from "node:child_process";
-import { appendFileSync as appendFileSync2, existsSync as existsSync24, writeFileSync as writeFileSync18 } from "node:fs";
+import { appendFileSync as appendFileSync2, existsSync as existsSync24, writeFileSync as writeFileSync19 } from "node:fs";
 import path31 from "node:path";
 function registryAuthOrThrow() {
   const auth = readDocsRegistryAuth();
@@ -14682,7 +14995,7 @@ Or run in the foreground instead: mesh docs start --foreground`
     } catch (error) {
       lastError = error instanceof Error ? error.message : String(error);
     }
-    await new Promise((resolve15) => setTimeout(resolve15, 500));
+    await new Promise((resolve16) => setTimeout(resolve16, 500));
   }
   throw new Error(
     `the docs server did not answer at ${url} within 60s (${lastError || "no response"}).
@@ -14719,8 +15032,8 @@ async function runDocsServeStatic(args) {
   }
   const server = await serveDocsSite({ root: args.root, port: requestedPort });
   logSuccess(`Mesh docs serving at ${server.url} (from ${args.root})`);
-  await new Promise((resolve15) => {
-    const stop = () => void server.close().finally(() => resolve15());
+  await new Promise((resolve16) => {
+    const stop = () => void server.close().finally(() => resolve16());
     process.once("SIGINT", stop);
     process.once("SIGTERM", stop);
   });
@@ -14774,8 +15087,8 @@ async function runDocsStart(args) {
         stdio: "inherit",
         env: process.env
       });
-      await new Promise((resolve15) => {
-        child.on("close", () => resolve15());
+      await new Promise((resolve16) => {
+        child.on("close", () => resolve16());
         process.once("SIGINT", () => child.kill("SIGINT"));
         process.once("SIGTERM", () => child.kill("SIGTERM"));
       });
@@ -14790,8 +15103,8 @@ async function runDocsStart(args) {
     });
     reportAssembly(result);
     const { spawn: spawn10 } = await import("node:child_process");
-    writeFileSync18(buildLog, "");
-    const code = await new Promise((resolve15) => {
+    writeFileSync19(buildLog, "");
+    const code = await new Promise((resolve16) => {
       const child = spawn10("pnpm", ["exec", "zudoku", "build"], {
         cwd: appDir,
         stdio: ["ignore", "pipe", "pipe"],
@@ -14799,8 +15112,8 @@ async function runDocsStart(args) {
       });
       child.stdout?.on("data", (chunk) => appendFileSync2(buildLog, chunk));
       child.stderr?.on("data", (chunk) => appendFileSync2(buildLog, chunk));
-      child.on("error", () => resolve15(1));
-      child.on("close", (exitCode) => resolve15(exitCode ?? 1));
+      child.on("error", () => resolve16(1));
+      child.on("close", (exitCode) => resolve16(exitCode ?? 1));
     });
     if (code !== 0) throw new Error(`zudoku build exited with code ${code} \u2014 see ${buildLog}`);
     serveRoot = path31.join(appDir, "dist");
@@ -14820,9 +15133,9 @@ async function runDocsStart(args) {
   const server = await serveDocsSite({ root: serveRoot, port: requestedPort });
   logSuccess(`Mesh docs (${label}) serving at ${server.url}`);
   logInfo("Press Ctrl-C to stop");
-  await new Promise((resolve15) => {
+  await new Promise((resolve16) => {
     const stop = () => {
-      void server.close().finally(() => resolve15());
+      void server.close().finally(() => resolve16());
     };
     process.once("SIGINT", stop);
     process.once("SIGTERM", stop);
@@ -15174,10 +15487,10 @@ function assembleHubEnv(session, sessionEnv, opts) {
       { remediation: { command: "mesh dev --kill && mesh dev  # relaunch to refresh session state" } }
     );
   }
-  if (platform.tenant === "local") {
-    throw new MeshCliError(
-      "This session runs on the full-local platform (`mesh start`) \u2014 use its containerized Hub instead of `mesh hub dev`.",
-      { remediation: { command: "mesh start --with-hub  # MESH_HUB_PORT=<port> publishes it off 9000" } }
+  const isLocalPlatform = platform.tenant === "local";
+  if (isLocalPlatform) {
+    notes.push(
+      "Local platform session \u2014 the Hub runs from this checkout against `mesh start`. Its containerized Hub keeps :9000, so pass --port/--api-port to run both."
     );
   }
   const hubTenant = platform.name ?? "mesh";
@@ -15205,7 +15518,11 @@ function assembleHubEnv(session, sessionEnv, opts) {
       "Dev session predates the per-session token-server (MESH-2039) \u2014 starting a dedicated one so tokens stay fresh past ~1h."
     );
   }
-  const temporalAddress = sessionEnv.TEMPORAL_ADDRESS ?? (session.state.devOutput.tunnels["temporal"] ? tunnelClientAddress(session.state.devOutput.tunnels["temporal"]) : void 0);
+  const temporalAddress = sessionEnv.TEMPORAL_ADDRESS ?? (session.state.devOutput.tunnels["temporal"] ? tunnelClientAddress(session.state.devOutput.tunnels["temporal"]) : (
+    // The local platform runs Temporal as a published container, so there is
+    // no tunnel to record and none to demand — the address is fixed.
+    isLocalPlatform ? "localhost:7233" : void 0
+  ));
   if (!temporalAddress) {
     throw new MeshCliError(
       `Dev session '${session.name}' exposes no Temporal tunnel \u2014 the Hub can't reach the stack's Temporal.`,
@@ -15218,7 +15535,8 @@ function assembleHubEnv(session, sessionEnv, opts) {
     TEMPORAL_ADDRESS: temporalAddress,
     HUB_TENANT: hubTenant,
     HUB_SCOPE_ENV: scopeEnv,
-    HUB_SCOPE_TENANTS: scopeTenants.join(",")
+    HUB_SCOPE_TENANTS: scopeTenants.join(","),
+    ...isLocalPlatform ? localPlatformEnv2(sessionEnv) : {}
   };
   const uiEnv = {
     ...forwarded,
@@ -15267,24 +15585,24 @@ function resolvePlatformDir(explicit, cwd, env = process.env) {
   );
 }
 async function findFreePort4() {
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve16, reject) => {
     const server = net12.createServer();
     server.listen(0, "127.0.0.1", () => {
       const address = server.address();
       server.close(
-        () => typeof address === "object" && address ? resolve15(address.port) : reject(new Error("no port"))
+        () => typeof address === "object" && address ? resolve16(address.port) : reject(new Error("no port"))
       );
     });
     server.on("error", reject);
   });
 }
 function isPortListening2(port) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const socket = net12.connect({ host: "127.0.0.1", port, timeout: 400 });
     const done = (ok) => {
       socket.removeAllListeners();
       socket.destroy();
-      resolve15(ok);
+      resolve16(ok);
     };
     socket.once("connect", () => done(true));
     socket.once("timeout", () => done(false));
@@ -15405,7 +15723,7 @@ async function hubDevAction(opts) {
     execFileSync24("tmux", ["send-keys", "-t", `${HUB_SESSION}:${window}`, buildLaunchCommand(envFile, dir, cmd), "Enter"]);
   };
   launch("api", apiDir, assembled.apiEnv, "pnpm dev", false);
-  launch("ui", uiDir, assembled.uiEnv, `pnpm dev -- --port ${uiPort} --strictPort`, true);
+  launch("ui", uiDir, assembled.uiEnv, `pnpm dev --port ${uiPort} --strictPort`, true);
   logInfo("Waiting for the Hub to come up\u2026");
   const apiUp = await waitForPort("127.0.0.1", apiPort, 9e4);
   const uiUp = apiUp && await waitForPort("127.0.0.1", uiPort, 9e4);
@@ -15428,7 +15746,7 @@ function registerHubCommands(program2) {
     "Launch the current-code Hub (api + ui) against a running `mesh dev` session \u2014 env auto-assembled, zero hand-set vars"
   ).option("--session <name>", "dev session to observe (default: auto-detect from cwd)").option("--tenants <list>", "comma-separated HUB_SCOPE_TENANTS override (default: the session's tenant)").option("--port <port>", `Hub UI host port (default: $MESH_HUB_DEV_PORT or ${DEFAULT_HUB_UI_PORT})`).option("--api-port <port>", `Hub API port (default: ${DEFAULT_HUB_API_PORT})`).option("--platform-dir <dir>", "mesh-platform checkout to run the Hub from (default: $MESH_PLATFORM_DIR or walk up from cwd)").option("--print-env", "print the assembled env (secrets redacted) and exit without launching").option("--kill", "tear down the running Hub session").action(hubDevAction);
 }
-var HUB_SESSION, DEFAULT_HUB_UI_PORT, DEFAULT_HUB_API_PORT, FORWARD_PREFIXES, SENSITIVE_RE;
+var HUB_SESSION, DEFAULT_HUB_UI_PORT, DEFAULT_HUB_API_PORT, FORWARD_PREFIXES, localPlatformEnv2, SENSITIVE_RE;
 var init_hub = __esm({
   "libs/mesh-cli/src/commands/hub/index.ts"() {
     "use strict";
@@ -15442,6 +15760,35 @@ var init_hub = __esm({
     DEFAULT_HUB_UI_PORT = Number(DEFAULT_HUB_PORT);
     DEFAULT_HUB_API_PORT = 3002;
     FORWARD_PREFIXES = ["AWS_", "DEV_USER_"];
+    localPlatformEnv2 = (sessionEnv) => ({
+      // The issuer the local `mesh login` tokens carry. Zitadel routes by Host
+      // header, so the host must stay `localhost` on both sides of the call.
+      ZITADEL_ISSUER: sessionEnv.ZITADEL_ISSUER ?? "http://localhost:8080",
+      // Postgres publishes on 5433; the Hub's ops schema lives in the `hub` database
+      // alongside the per-app ones.
+      OPS_DB_HOST: "localhost",
+      OPS_DB_PORT: "5433",
+      OPS_DB_NAME: "hub",
+      OPS_DB_USER: "postgres",
+      DATABASE_PASSWORD: "postgres",
+      PGSSLMODE: "disable",
+      DATABASE_URL: "postgres://postgres:postgres@localhost:5433/hub?sslmode=disable",
+      // The Hub's ADMIN plane. `mesh start` seeds the machine key this names, in the
+      // platform org with IAM_OWNER, so the Hub can administer each app tenant's own
+      // Zitadel org rather than only its own.
+      ZITADEL_OPSHUB_SECRET_NAME: "mesh/local/dev/zitadel/ops-hub",
+      SPICEDB_ENDPOINT: "localhost:50051",
+      SPICEDB_HTTP_ENDPOINT: "http://localhost:8443",
+      SPICEDB_HTTP_SCHEME: "http",
+      SPICEDB_PRESHARED_KEY: "local-dev-key",
+      LOKI_URL: "http://localhost:3100",
+      TEMPO_URL: "http://localhost:3200",
+      PROMETHEUS_URL: "http://localhost:9090",
+      TEMPORAL_UI_URL: "http://localhost:8233",
+      // The stack's namespace. Absent, the Hub's compliance schedules fail to
+      // register with "Temporal namespace is required".
+      TEMPORAL_NAMESPACE: "local-dev"
+    });
     SENSITIVE_RE = /TOKEN|SECRET|KEY|PASSWORD/i;
   }
 });
@@ -16042,6 +16389,103 @@ async function ensureHubImages() {
   }
   return version;
 }
+function readWorkspaceCatalog(repoRoot2) {
+  const text = fs29.readFileSync(path36.join(repoRoot2, "pnpm-workspace.yaml"), "utf-8");
+  const marker = "\ncatalog:\n";
+  const at = text.indexOf(marker);
+  if (at === -1) return {};
+  const catalog = {};
+  for (const line of text.slice(at + marker.length).split("\n")) {
+    if (line.trim() !== "" && !/^\s/.test(line)) break;
+    const m = /^\s+"?([^":\s]+)"?:\s*"?([^"\s#]+)"?/.exec(line);
+    if (m) catalog[m[1]] = m[2];
+  }
+  return catalog;
+}
+function normalizeHubManifests(contextDir, catalog) {
+  const DEP_FIELDS = ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"];
+  const touched = [];
+  for (const entry of fs29.readdirSync(contextDir, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const manifest = path36.join(contextDir, entry.name, "package.json");
+    if (!fs29.existsSync(manifest)) continue;
+    const pkg = JSON.parse(fs29.readFileSync(manifest, "utf-8"));
+    let changed = false;
+    for (const field of DEP_FIELDS) {
+      const deps = pkg[field];
+      if (!deps) continue;
+      for (const [name, spec] of Object.entries(deps)) {
+        if (typeof spec !== "string") continue;
+        if (spec.startsWith("workspace:")) {
+          delete deps[name];
+          changed = true;
+        } else if (spec.startsWith("catalog:")) {
+          const key = spec.slice("catalog:".length) || name;
+          const range = catalog[name] ?? catalog[key];
+          if (!range) {
+            throw new MeshCliError(
+              `${entry.name}/package.json depends on "${name}": "${spec}", which the workspace catalog does not define.`,
+              { remediation: { command: "Add the dependency to the `catalog:` block in pnpm-workspace.yaml" } }
+            );
+          }
+          deps[name] = range;
+          changed = true;
+        }
+      }
+    }
+    if (changed) {
+      fs29.writeFileSync(manifest, `${JSON.stringify(pkg, null, 2)}
+`);
+      touched.push(`${entry.name}/package.json`);
+    }
+  }
+  return touched;
+}
+async function buildHubImagesFromSource(repoRoot2) {
+  const hubDir = path36.join(repoRoot2, "apps", "hub");
+  if (!fs29.existsSync(path36.join(hubDir, "package.json"))) {
+    throw new MeshCliError(
+      `--hub-from-source needs a mesh-platform checkout; no apps/hub under ${repoRoot2}.`,
+      { remediation: { command: "Run mesh start from a mesh-platform checkout, or drop --hub-from-source" } }
+    );
+  }
+  const npmrc = npmrcPath();
+  const version = `${JSON.parse(fs29.readFileSync(path36.join(hubDir, "package.json"), "utf-8")).version}-src`;
+  const build = startHeartbeat("building apps/hub (api + ui) from source");
+  try {
+    for (const pkg of ["@mesh-tech/hub-api", "@mesh-tech/hub-ui"]) {
+      await execFileAsync2("pnpm", ["--filter", pkg, "build"], { cwd: repoRoot2, maxBuffer: 64 * 1024 * 1024 });
+    }
+  } finally {
+    build.stop();
+  }
+  const context = path36.join(cacheDir(), `context-${version}`);
+  fs29.rmSync(context, { recursive: true, force: true });
+  fs29.mkdirSync(context, { recursive: true });
+  await execFileAsync2("pnpm", ["pack", "--pack-destination", context], { cwd: hubDir, maxBuffer: 64 * 1024 * 1024 });
+  const tarball = fs29.readdirSync(context).find((f) => f.endsWith(".tgz"));
+  if (!tarball) throw new MeshCliError("pnpm pack produced no tarball for apps/hub");
+  execFileSync26("tar", ["-xzf", path36.join(context, tarball), "-C", context, "--strip-components", "1"], {
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  const rewritten = normalizeHubManifests(context, readWorkspaceCatalog(repoRoot2));
+  if (rewritten.length > 0) logInfo(`Normalized ${rewritten.length} manifest(s) for npm: ${rewritten.join(", ")}`);
+  const hubStackDir = path36.join(findPackageRoot(), "stack", "hub");
+  for (const [name, dockerfile] of [
+    ["mesh-local-hub-api", "Dockerfile.api"],
+    ["mesh-local-hub-ui", "Dockerfile.ui"]
+  ]) {
+    const tag = `${name}:${version}`;
+    logInfo(`Building ${tag} from source\u2026`);
+    execFileSync26(
+      "docker",
+      ["build", "-f", path36.join(hubStackDir, dockerfile), "-t", tag, "--secret", `id=npmrc,src=${npmrc}`, context],
+      { stdio: ["ignore", "inherit", "inherit"], env: { ...process.env, DOCKER_BUILDKIT: "1" } }
+    );
+    logSuccess(`Built ${tag}`);
+  }
+  return version;
+}
 var execFileAsync2, HUB_PACKAGE, HUB_IMAGES, LOCAL_IMAGE_REV, HUB_AUTH_IMAGE;
 var init_hub_local = __esm({
   "libs/mesh-cli/src/commands/local/hub-local.ts"() {
@@ -16059,6 +16503,8 @@ var init_hub_local = __esm({
 });
 
 // libs/mesh-cli/src/commands/local/index.ts
+import * as fs30 from "fs";
+import * as path37 from "path";
 import chalk5 from "chalk";
 function crashError(crashed) {
   return new MeshCliError(
@@ -16101,7 +16547,7 @@ async function waitForStack(io = {
       );
     }
     logInfo(`Waiting for ${pending.map((e) => e.label).join(", ")} \u2026`);
-    await new Promise((resolve15) => setTimeout(resolve15, WAIT_POLL_MS));
+    await new Promise((resolve16) => setTimeout(resolve16, WAIT_POLL_MS));
   }
 }
 function printEndpoints(hubRunning) {
@@ -16144,10 +16590,22 @@ function printEndpoints(hubRunning) {
   console.log("");
   logInfo("Next: `mesh dev` in an apps repo wires services to this stack automatically.");
 }
+function repoRootForHubSource() {
+  for (let dir = process.cwd(); ; ) {
+    if (fs30.existsSync(path37.join(dir, "apps", "hub", "package.json"))) return dir;
+    const parent = path37.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return path37.resolve(findPackageRoot(), "..", "..");
+}
 function registerLocalCommands(program2) {
   program2.command("start").description("Start the full-local Mesh platform (Docker only \u2014 no AWS, no VPN)").option("--no-seed", "skip first-boot seeding (tenant registry, artifacts bucket)").option("--no-hub", "start without the Hub (API + UI)").option(
     "--with-hub",
     "force-refresh the Hub to the latest published @mesh-tech/hub (the Hub is included by default when its images exist or registry auth is available)"
+  ).option(
+    "--hub-from-source",
+    "build the Hub images from THIS checkout's apps/hub instead of the published tarball (the only way to exercise a Hub change locally)"
   ).option(
     "--takeover",
     "re-own a stack that another checkout started (may recreate shared containers with THIS checkout's config)",
@@ -16172,7 +16630,9 @@ Re-running start from here may recreate shared containers with this checkout's c
     }
     let hubVersion;
     if (opts.hub) {
-      if (opts.withHub) {
+      if (opts.hubFromSource) {
+        hubVersion = await buildHubImagesFromSource(repoRootForHubSource());
+      } else if (opts.withHub) {
         const probe = await probeRegistryToken();
         const plan = planWithHubRefresh(probe.state, localHubVersion());
         if (plan.action === "fail") {
@@ -16260,7 +16720,7 @@ Re-running start from here may recreate shared containers with this checkout's c
             overlayStarted: true
           });
           if (crashed.length > 0) throw crashError(crashed);
-          await new Promise((resolve15) => setTimeout(resolve15, 2e3));
+          await new Promise((resolve16) => setTimeout(resolve16, 2e3));
           up = await probeEndpoint(endpoint);
         }
         if (!up) {
@@ -16521,6 +16981,12 @@ import {
 } from "@aws-sdk/client-secrets-manager";
 import input from "@inquirer/input";
 import password from "@inquirer/password";
+import {
+  buildInstanceIndexValue,
+  instanceIndexSecretId,
+  isInstanceKey,
+  parseInstanceIndex
+} from "@mesh-tech/secrets";
 async function ensureAwsCredentialsForStack(stack) {
   if (process.env.AWS_ACCESS_KEY_ID || process.env.AWS_SESSION_TOKEN) return;
   if (!stack) return;
@@ -16705,6 +17171,12 @@ Usage: mesh secrets set external/<name>`);
     );
     process.exit(1);
   }
+  if (opts.key && !isInstanceKey(opts.key)) {
+    logError(
+      `Invalid instance key "${opts.key}": keys must not contain "/", start with ".", or end with ".config" \u2014 those names are reserved for the index and config mirrors.`
+    );
+    process.exit(1);
+  }
   let existing = {};
   try {
     const response = await smClient.send(
@@ -16729,6 +17201,9 @@ Usage: mesh secrets set external/<name>`);
     const merged2 = deepMerge(existing, values2);
     await writeSecret(smClient, secretId, merged2, svc.meta);
     await writeConfigMirror(smClient, secretId, schema, merged2, svc.meta);
+    if (opts.key) {
+      await addKeyToInstanceIndex(smClient, secretPrefix, opts.key, serviceName);
+    }
     logSuccess(`Credentials written to ${secretId}`);
     return;
   }
@@ -16744,6 +17219,9 @@ Usage: mesh secrets set external/<name>`);
   const merged = deepMerge(existing, values);
   await writeSecret(smClient, secretId, merged, svc.meta);
   await writeConfigMirror(smClient, secretId, schema, merged, svc.meta);
+  if (opts.key) {
+    await addKeyToInstanceIndex(smClient, secretPrefix, opts.key, serviceName);
+  }
   logSuccess(`Credentials written to ${secretId}`);
   console.error("\nStored fields:");
   displaySummary(schema.fields, merged);
@@ -16809,6 +17287,45 @@ function extractNonSecretFields(fields, values) {
   }
   return result;
 }
+async function addKeyToInstanceIndex(client, secretPrefix, key, serviceName) {
+  const indexId = instanceIndexSecretId(secretPrefix);
+  try {
+    let keys = [];
+    try {
+      const res = await client.send(new GetSecretValueCommand5({ SecretId: indexId }));
+      keys = parseInstanceIndex(res.SecretString ?? "");
+    } catch (err) {
+      if (!isResourceNotFound(err)) throw err;
+    }
+    if (keys.includes(key)) return;
+    const secretString = buildInstanceIndexValue([...keys, key]);
+    try {
+      await client.send(
+        new PutSecretValueCommand({ SecretId: indexId, SecretString: secretString })
+      );
+    } catch (err) {
+      if (!isResourceNotFound(err)) throw err;
+      await client.send(
+        new CreateSecretCommand({
+          Name: indexId,
+          Description: `Instance-key index for ${serviceName} (read by listInstances(); maintained by mesh secrets set/reindex and the Hub)`,
+          SecretString: secretString,
+          Tags: [
+            { Key: "mesh:type", Value: "external-service-index" },
+            { Key: "mesh:service", Value: serviceName }
+          ]
+        })
+      );
+      logInfo(
+        `Created ${indexId} OUT OF BAND \u2014 the declaring stack does not manage it. Deploy the declaring stack (it creates the index) before writing keys, or import this secret into the stack before its next deploy.`
+      );
+    }
+  } catch (err) {
+    logInfo(
+      `Warning: failed to record instance "${key}" in ${indexId} \u2014 listInstances() will not see it until you run: mesh secrets reindex external/${serviceName} (${err})`
+    );
+  }
+}
 async function writeConfigMirror(client, secretId, schema, merged, meta) {
   const configId = `${secretId}/.config`;
   const configValues = extractNonSecretFields(schema.fields, merged);
@@ -16850,17 +17367,157 @@ var init_set = __esm({
   }
 });
 
+// libs/mesh-cli/src/commands/secrets/reindex.ts
+import { SSMClient as SSMClient3 } from "@aws-sdk/client-ssm";
+import {
+  SecretsManagerClient as SecretsManagerClient6,
+  ListSecretsCommand,
+  GetSecretValueCommand as GetSecretValueCommand6,
+  PutSecretValueCommand as PutSecretValueCommand2,
+  CreateSecretCommand as CreateSecretCommand2
+} from "@aws-sdk/client-secrets-manager";
+import {
+  buildInstanceIndexValue as buildInstanceIndexValue2,
+  instanceIndexSecretId as instanceIndexSecretId2,
+  instanceKeyFromSecretName,
+  parseInstanceIndex as parseInstanceIndex2
+} from "@mesh-tech/secrets";
+async function scanInstanceKeys(client, secretPrefix) {
+  const keys = [];
+  let nextToken;
+  do {
+    const response = await client.send(
+      new ListSecretsCommand({
+        Filters: [{ Key: "name", Values: [`${secretPrefix}/`] }],
+        NextToken: nextToken
+      })
+    );
+    for (const secret of response.SecretList ?? []) {
+      const key = secret.Name ? instanceKeyFromSecretName(secretPrefix, secret.Name) : null;
+      if (key) keys.push(key);
+    }
+    nextToken = response.NextToken;
+  } while (nextToken);
+  return keys;
+}
+function indexAlreadyMatches(missing, stale, indexExists, malformed) {
+  return missing.length === 0 && stale.length === 0 && indexExists && !malformed;
+}
+async function reindexCommand(servicePath, opts) {
+  const stackOpt = resolveStackOption(opts);
+  const context = detectContext(stackOpt);
+  const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
+  await ensureAwsCredentialsForStack(stackOpt ?? context.stage);
+  const ssmClient = new SSMClient3({ region });
+  const smClient = new SecretsManagerClient6({ region });
+  const services = await discoverExternalServices(
+    ssmClient,
+    context.tenant,
+    context.platformEnv
+  );
+  const serviceName = servicePath?.replace(/^external\//, "");
+  if (!serviceName || !services.has(serviceName)) {
+    if (serviceName) {
+      logError(`External service "${serviceName}" not found.`);
+    }
+    const keyed = [...services.entries()].filter(([, s]) => s.schema?.keyedBy);
+    console.error("\nMulti-instance external services:");
+    for (const [name, svc2] of keyed) {
+      console.error(`  ${name} (keyed by ${svc2.schema.keyedBy})`);
+    }
+    if (keyed.length === 0) console.error("  (none)");
+    console.error(`
+Usage: mesh secrets reindex external/<name>`);
+    process.exit(serviceName ? 1 : 0);
+  }
+  const svc = services.get(serviceName);
+  if (!svc.schema?.keyedBy) {
+    logError(
+      `"${serviceName}" is single-instance (no keyedBy) \u2014 it has no instance index.`
+    );
+    process.exit(1);
+  }
+  const secretPrefix = svc.meta.secretPrefix;
+  const indexId = instanceIndexSecretId2(secretPrefix);
+  const actual = [...new Set(await scanInstanceKeys(smClient, secretPrefix))].sort();
+  let listed = [];
+  let indexExists = true;
+  let malformed = false;
+  try {
+    const res = await smClient.send(new GetSecretValueCommand6({ SecretId: indexId }));
+    try {
+      listed = parseInstanceIndex2(res.SecretString ?? "");
+    } catch {
+      malformed = true;
+      logInfo(`Existing index at ${indexId} is malformed \u2014 rebuilding from scratch.`);
+    }
+  } catch (err) {
+    if (!isResourceNotFound(err)) throw err;
+    indexExists = false;
+    logInfo(`No index at ${indexId} yet \u2014 it will be created.`);
+  }
+  const missing = actual.filter((k) => !listed.includes(k));
+  const stale = listed.filter((k) => !actual.includes(k));
+  logInfo(`Instances in Secrets Manager: ${actual.length ? actual.join(", ") : "(none)"}`);
+  if (missing.length > 0) logInfo(`Missing from index: ${missing.join(", ")}`);
+  if (stale.length > 0) logInfo(`Stale in index (secret gone): ${stale.join(", ")}`);
+  if (indexAlreadyMatches(missing, stale, indexExists, malformed)) {
+    logSuccess(`Index at ${indexId} already matches \u2014 nothing to do.`);
+    return;
+  }
+  if (opts.dryRun) {
+    logInfo(`Dry run \u2014 would write ${indexId} with ${actual.length} instance(s).`);
+    return;
+  }
+  await writeInstanceIndex(smClient, secretPrefix, serviceName, actual);
+  logSuccess(`Index rebuilt: ${indexId} now lists ${actual.length} instance(s).`);
+}
+async function writeInstanceIndex(client, secretPrefix, serviceName, keys) {
+  const indexId = instanceIndexSecretId2(secretPrefix);
+  const secretString = buildInstanceIndexValue2(keys);
+  try {
+    await client.send(
+      new PutSecretValueCommand2({ SecretId: indexId, SecretString: secretString })
+    );
+  } catch (err) {
+    if (!isResourceNotFound(err)) throw err;
+    await client.send(
+      new CreateSecretCommand2({
+        Name: indexId,
+        Description: `Instance-key index for ${serviceName} (read by listInstances(); maintained by mesh secrets set/reindex and the Hub)`,
+        SecretString: secretString,
+        Tags: [
+          { Key: "mesh:type", Value: "external-service-index" },
+          { Key: "mesh:service", Value: serviceName }
+        ]
+      })
+    );
+    logInfo(
+      `Created ${indexId} OUT OF BAND \u2014 the declaring stack does not manage it. Deploy the declaring stack BEFORE reindex next time, or import this secret into the stack before its next deploy.`
+    );
+  }
+}
+var init_reindex = __esm({
+  "libs/mesh-cli/src/commands/secrets/reindex.ts"() {
+    "use strict";
+    init_context();
+    init_log();
+    init_stack_flag();
+    init_set();
+  }
+});
+
 // libs/mesh-cli/src/commands/secrets/migrate-config.ts
 import {
-  SSMClient as SSMClient3,
+  SSMClient as SSMClient4,
   GetParametersByPathCommand as GetParametersByPathCommand2
 } from "@aws-sdk/client-ssm";
 import {
-  SecretsManagerClient as SecretsManagerClient6,
-  GetSecretValueCommand as GetSecretValueCommand6,
-  PutSecretValueCommand as PutSecretValueCommand2,
-  CreateSecretCommand as CreateSecretCommand2,
-  ListSecretsCommand
+  SecretsManagerClient as SecretsManagerClient7,
+  GetSecretValueCommand as GetSecretValueCommand7,
+  PutSecretValueCommand as PutSecretValueCommand3,
+  CreateSecretCommand as CreateSecretCommand3,
+  ListSecretsCommand as ListSecretsCommand2
 } from "@aws-sdk/client-secrets-manager";
 function normalizeEntry2(raw) {
   if (raw.type === "group" && raw.fields) {
@@ -16946,7 +17603,7 @@ function isResourceNotFound2(err) {
 }
 async function readSecret(client, secretId) {
   try {
-    const res = await client.send(new GetSecretValueCommand6({ SecretId: secretId }));
+    const res = await client.send(new GetSecretValueCommand7({ SecretId: secretId }));
     return res.SecretString ? JSON.parse(res.SecretString) : null;
   } catch (err) {
     if (isResourceNotFound2(err)) return null;
@@ -16956,10 +17613,10 @@ async function readSecret(client, secretId) {
 async function writeSecret2(client, secretId, values, description) {
   const secretString = JSON.stringify(values);
   try {
-    await client.send(new PutSecretValueCommand2({ SecretId: secretId, SecretString: secretString }));
+    await client.send(new PutSecretValueCommand3({ SecretId: secretId, SecretString: secretString }));
   } catch (err) {
     if (isResourceNotFound2(err)) {
-      await client.send(new CreateSecretCommand2({
+      await client.send(new CreateSecretCommand3({
         Name: secretId,
         Description: description,
         SecretString: secretString,
@@ -16972,7 +17629,7 @@ async function writeSecret2(client, secretId, values, description) {
 }
 async function secretExists(client, secretId) {
   try {
-    await client.send(new GetSecretValueCommand6({ SecretId: secretId }));
+    await client.send(new GetSecretValueCommand7({ SecretId: secretId }));
     return true;
   } catch (err) {
     if (isResourceNotFound2(err)) return false;
@@ -16985,7 +17642,7 @@ async function listInstanceKeys(client, secretPrefix) {
   let nextToken;
   do {
     const response = await client.send(
-      new ListSecretsCommand({
+      new ListSecretsCommand2({
         Filters: [{ Key: "name", Values: [prefix2] }],
         NextToken: nextToken
       })
@@ -17051,8 +17708,8 @@ async function migrateService(smClient, meta, schema, opts) {
 async function migrateConfigCommand(opts) {
   const context = detectContext(resolveStackOption(opts));
   const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
-  const ssmClient = new SSMClient3({ region });
-  const smClient = new SecretsManagerClient6({ region });
+  const ssmClient = new SSMClient4({ region });
+  const smClient = new SecretsManagerClient7({ region });
   logInfo(`Migrating .config mirrors for ${context.tenant}/${context.platformEnv}`);
   if (opts.dryRun) logInfo("DRY-RUN mode \u2014 no writes");
   if (opts.force) logInfo("FORCE mode \u2014 overwrite existing .config");
@@ -17105,6 +17762,11 @@ function registerSecretsCommands(program2) {
   secrets.command("set [service]").description("Set credentials for an external service (e.g., mesh secrets set external/symitar)").option("--key <key>", "Instance key for multi-instance services (e.g., FI ID)").option("--all", "Prompt for all fields including optional ones").option("--json <json>", "Non-interactive: provide values as JSON").option("--stack <stack>", "Pulumi stack name (override detection)").addOption(new Option2("--stage <stack>", "Deprecated alias for --stack").hideHelp()).option("--region <region>", "AWS region (default: us-east-2)").action(async (service, opts) => {
     await setCommand(service, opts);
   });
+  secrets.command("reindex [service]").description(
+    "Rebuild a multi-instance external service's instance index (the {prefix}/.index secret listInstances() reads) from the per-key secrets actually in Secrets Manager \u2014 the repair for an instance secret created or deleted out of band"
+  ).option("--dry-run", "Show what would change without writing").option("--stack <stack>", "Pulumi stack name (override detection)").addOption(new Option2("--stage <stack>", "Deprecated alias for --stack").hideHelp()).option("--region <region>", "AWS region (default: us-east-2)").action(async (service, opts) => {
+    await reindexCommand(service, opts);
+  });
   secrets.command("migrate-config").description("Backfill .config mirror secrets for all external services").option("--force", "Overwrite existing .config mirrors").option("--dry-run", "Show what would be written without writing").option("--stack <stack>", "Pulumi stack name (override detection)").addOption(new Option2("--stage <stack>", "Deprecated alias for --stack").hideHelp()).option("--region <region>", "AWS region (default: us-east-2)").action(async (opts) => {
     await migrateConfigCommand(opts);
   });
@@ -17114,28 +17776,29 @@ var init_secrets = __esm({
     "use strict";
     init_exec2();
     init_set();
+    init_reindex();
     init_migrate_config();
   }
 });
 
 // libs/mesh-cli/src/commands/stack.ts
 import { execFileSync as execFileSync27 } from "child_process";
-import * as path37 from "path";
-import * as fs30 from "fs";
+import * as path38 from "path";
+import * as fs31 from "fs";
 import { parse as parseYaml5 } from "yaml";
 function readTopLevelYamlKey(appRoot, stack, key) {
-  const configFile = path37.join(appRoot, `Pulumi.${stack}.yaml`);
-  if (!fs30.existsSync(configFile)) return null;
-  const content = fs30.readFileSync(configFile, "utf-8");
+  const configFile = path38.join(appRoot, `Pulumi.${stack}.yaml`);
+  if (!fs31.existsSync(configFile)) return null;
+  const content = fs31.readFileSync(configFile, "utf-8");
   const pattern = new RegExp(`^${key}:\\s*(.+)$`, "m");
   const match = content.match(pattern);
   if (!match) return null;
   return match[1].trim().replace(/^["']|["']$/g, "");
 }
 function readConfigBlockKey(appRoot, stack, key) {
-  const configFile = path37.join(appRoot, `Pulumi.${stack}.yaml`);
-  if (!fs30.existsSync(configFile)) return null;
-  const content = fs30.readFileSync(configFile, "utf-8");
+  const configFile = path38.join(appRoot, `Pulumi.${stack}.yaml`);
+  if (!fs31.existsSync(configFile)) return null;
+  const content = fs31.readFileSync(configFile, "utf-8");
   const pattern = new RegExp(`^\\s{2}${key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}:\\s*(.+)$`, "m");
   const match = content.match(pattern);
   if (!match) return null;
@@ -17195,11 +17858,11 @@ ${records}
   }
 }
 function readBaseConfigFromYaml(appRoot, stack) {
-  const file = path37.join(appRoot, `Pulumi.${stack}.yaml`);
-  if (!fs30.existsSync(file)) return {};
+  const file = path38.join(appRoot, `Pulumi.${stack}.yaml`);
+  if (!fs31.existsSync(file)) return {};
   let doc;
   try {
-    doc = parseYaml5(fs30.readFileSync(file, "utf-8"));
+    doc = parseYaml5(fs31.readFileSync(file, "utf-8"));
   } catch {
     return {};
   }
@@ -17276,7 +17939,7 @@ Specify which to base on: mesh stack init --from <stack>`
       }
     }
     const baseConfigPath = `${appRoot}/Pulumi.${baseStack}.yaml`;
-    if (!fs30.existsSync(baseConfigPath)) {
+    if (!fs31.existsSync(baseConfigPath)) {
       logError(`Stack config not found: Pulumi.${baseStack}.yaml`);
       process.exit(1);
     }
@@ -17298,8 +17961,8 @@ Specify which to base on: mesh stack init --from <stack>`
         );
       }
     }
-    const newConfigPath = path37.join(appRoot, `Pulumi.${newStack}.yaml`);
-    const configExists = fs30.existsSync(newConfigPath);
+    const newConfigPath = path38.join(appRoot, `Pulumi.${newStack}.yaml`);
+    const configExists = fs31.existsSync(newConfigPath);
     const secretsProvider = readTopLevelYamlKey(appRoot, baseStack, "secretsprovider");
     const credEnv = await resolvePulumiEnv({ appRoot, stack: baseStack });
     const pulumiEnv = { ...process.env, ...credEnv };
@@ -17946,9 +18609,9 @@ var init_capture_history = __esm({
 
 // libs/mesh-cli/src/commands/temporal.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { writeFileSync as writeFileSync21, mkdirSync as mkdirSync22 } from "node:fs";
+import { writeFileSync as writeFileSync23, mkdirSync as mkdirSync22 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
-import { dirname as dirname26, join as join34, resolve as resolve13 } from "node:path";
+import { dirname as dirname27, join as join35, resolve as resolve14 } from "node:path";
 async function resolveConnection(options) {
   if (options.address && options.namespace) {
     return { address: options.address, namespace: options.namespace };
@@ -18318,7 +18981,7 @@ async function recoverConversation(workflowId, runId, options) {
       };
       const output2 = JSON.stringify(blob, null, 2) + "\n";
       if (options.out) {
-        writeFileSync21(options.out, output2);
+        writeFileSync23(options.out, output2);
         logSuccess(
           `Wrote snapshot (${messages.length} messages) to ${options.out}`
         );
@@ -18341,7 +19004,7 @@ async function recoverConversation(workflowId, runId, options) {
       2
     ) + "\n" : renderTranscriptMarkdown(turns);
     if (options.out) {
-      writeFileSync21(options.out, output);
+      writeFileSync23(options.out, output);
       logSuccess(`Wrote ${turns.length} turns to ${options.out}`);
     } else {
       process.stdout.write(output);
@@ -18376,10 +19039,10 @@ async function captureHistory(workflowId, runId, options) {
     }
     const { serializeHistoryToFixture: serializeHistoryToFixture2 } = await Promise.resolve().then(() => (init_capture_history(), capture_history_exports));
     const { fixture, eventCount, decryptedPayloads } = await serializeHistoryToFixture2(events, decrypter);
-    const outPath = options.out ?? join34(homedir9(), ".mesh", "replay-histories", `${sanitizeFileId(workflowId)}.json`);
-    mkdirSync22(dirname26(outPath), { recursive: true });
+    const outPath = options.out ?? join35(homedir9(), ".mesh", "replay-histories", `${sanitizeFileId(workflowId)}.json`);
+    mkdirSync22(dirname27(outPath), { recursive: true });
     if (options.out) warnIfNotGitIgnored(options.out);
-    writeFileSync21(outPath, JSON.stringify(fixture, null, 2) + "\n");
+    writeFileSync23(outPath, JSON.stringify(fixture, null, 2) + "\n");
     logSuccess(
       `Wrote replay history (${eventCount} events, ${decryptedPayloads} payloads decrypted) to ${outPath}`
     );
@@ -18394,9 +19057,9 @@ function sanitizeFileId(id) {
   return id.replace(/[^A-Za-z0-9._-]/g, "_");
 }
 function warnIfNotGitIgnored(outPath) {
-  const abs = resolve13(outPath);
+  const abs = resolve14(outPath);
   try {
-    const res = spawnSync4("git", ["-C", dirname26(abs), "check-ignore", "-q", abs], {
+    const res = spawnSync4("git", ["-C", dirname27(abs), "check-ignore", "-q", abs], {
       stdio: "ignore"
     });
     if (res.status !== 1) return;
@@ -18564,8 +19227,8 @@ var init_temporal = __esm({
 
 // libs/mesh-cli/src/commands/tenant.ts
 import chalk6 from "chalk";
-import * as fs31 from "fs";
-import * as path38 from "path";
+import * as fs32 from "fs";
+import * as path39 from "path";
 import { parseDocument, YAMLMap, isMap } from "yaml";
 function validateTenantName(name) {
   return /^[a-z][a-z0-9-]*$/.test(name) && !name.endsWith("-");
@@ -18633,16 +19296,16 @@ function resolveStackConfig(explicitStack) {
       { remediation: { command: "mesh tenant add <name> --stack <stack>" } }
     );
   }
-  const file = path38.join(appRoot, `Pulumi.${stack}.yaml`);
-  if (!fs31.existsSync(file)) {
+  const file = path39.join(appRoot, `Pulumi.${stack}.yaml`);
+  if (!fs32.existsSync(file)) {
     throw new MeshCliError(`Stack config not found: ${file}`, {
       remediation: { command: "mesh tenant add <name> --stack <stack>" }
     });
   }
-  return { appRoot, stack, file, content: fs31.readFileSync(file, "utf-8") };
+  return { appRoot, stack, file, content: fs32.readFileSync(file, "utf-8") };
 }
 function readProjectName(appRoot) {
-  const projectDoc = parseDocument(fs31.readFileSync(path38.join(appRoot, "Pulumi.yaml"), "utf-8"));
+  const projectDoc = parseDocument(fs32.readFileSync(path39.join(appRoot, "Pulumi.yaml"), "utf-8"));
   return String(projectDoc.get("name") ?? "");
 }
 function looksLikePlatformLayer(projectName) {
@@ -18685,12 +19348,12 @@ function registerTenantCommands(program2) {
       if (!result.ok) {
         if (result.reason === "exists") {
           throw new MeshCliError(
-            `${result.detail} (${path38.basename(resolved.file)}). Edit the existing entry instead of re-adding it.`
+            `${result.detail} (${path39.basename(resolved.file)}). Edit the existing entry instead of re-adding it.`
           );
         }
         throw new MeshCliError(`${resolved.file}: ${result.detail}`);
       }
-      atomicWriteFileSync(resolved.file, result.yaml, fs31.statSync(resolved.file).mode & 511);
+      atomicWriteFileSync(resolved.file, result.yaml, fs32.statSync(resolved.file).mode & 511);
       if (opts.json) {
         emitJsonPayload({
           ok: true,
@@ -18703,7 +19366,7 @@ function registerTenantCommands(program2) {
         return;
       }
       logInfo(
-        `Tenant '${name}' registered in ${path38.basename(resolved.file)} (mesh:tenants, subdomain '${subdomain}')${result.createdTenantsBlock ? " \u2014 created the mesh:tenants block" : ""}`
+        `Tenant '${name}' registered in ${path39.basename(resolved.file)} (mesh:tenants, subdomain '${subdomain}')${result.createdTenantsBlock ? " \u2014 created the mesh:tenants block" : ""}`
       );
       console.log("");
       console.log("Next steps:");
@@ -18729,7 +19392,7 @@ function registerTenantCommands(program2) {
           `Project '${projectName}' does not look like a platform layer \u2014 tenants are declared on the tenant platform repo's PLATFORM stack (e.g. mesh-sandbox/platform).`
         );
       }
-      logInfo(`No tenants declared in ${path38.basename(resolved.file)}.`);
+      logInfo(`No tenants declared in ${path39.basename(resolved.file)}.`);
       return;
     }
     logInfo(`Tenants on stack '${resolved.stack}':`);
@@ -18751,12 +19414,12 @@ var init_tenant = __esm({
 
 // libs/mesh-cli/src/commands/tunnel/index.ts
 import { spawn as spawn9 } from "child_process";
-import * as fs32 from "fs";
+import * as fs33 from "fs";
 import * as os13 from "os";
-import * as path39 from "path";
+import * as path40 from "path";
 import {
-  SecretsManagerClient as SecretsManagerClient7,
-  GetSecretValueCommand as GetSecretValueCommand7
+  SecretsManagerClient as SecretsManagerClient8,
+  GetSecretValueCommand as GetSecretValueCommand8
 } from "@aws-sdk/client-secrets-manager";
 function resolveTenantEnv(options) {
   if (options.tenant && options.env) {
@@ -18773,9 +19436,9 @@ function readPulumiAwsRegion(stage) {
   const preferred = stage ? `Pulumi.${stage}.yaml` : void 0;
   const rank = (f) => f === preferred ? 0 : f === "Pulumi.yaml" ? 2 : 1;
   try {
-    const files = fs32.readdirSync(".").filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml")).sort((a, b) => rank(a) - rank(b));
+    const files = fs33.readdirSync(".").filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml")).sort((a, b) => rank(a) - rank(b));
     for (const f of files) {
-      const m = fs32.readFileSync(f, "utf-8").match(/^\s*aws:region:\s*["']?([^"'\n]+)["']?/m);
+      const m = fs33.readFileSync(f, "utf-8").match(/^\s*aws:region:\s*["']?([^"'\n]+)["']?/m);
       if (m?.[1]) return m[1].trim();
     }
   } catch {
@@ -18784,14 +19447,14 @@ function readPulumiAwsRegion(stage) {
 }
 function awsProfileSections(name) {
   return [
-    [path39.join(os13.homedir(), ".aws", "config"), `[profile ${name}]`],
-    [path39.join(os13.homedir(), ".aws", "credentials"), `[${name}]`]
+    [path40.join(os13.homedir(), ".aws", "config"), `[profile ${name}]`],
+    [path40.join(os13.homedir(), ".aws", "credentials"), `[${name}]`]
   ];
 }
 function awsProfileExists(name) {
   for (const [file, header] of awsProfileSections(name)) {
     try {
-      const lines = fs32.readFileSync(file, "utf-8").split("\n");
+      const lines = fs33.readFileSync(file, "utf-8").split("\n");
       if (lines.some((l) => l.trim() === header)) return true;
     } catch {
     }
@@ -18817,7 +19480,7 @@ function awsProfileRegion(profile) {
   if (!profile) return void 0;
   for (const [file, header] of awsProfileSections(profile)) {
     try {
-      const region = parseProfileRegion(fs32.readFileSync(file, "utf-8"), header);
+      const region = parseProfileRegion(fs33.readFileSync(file, "utf-8"), header);
       if (region) return region;
     } catch {
     }
@@ -18826,14 +19489,14 @@ function awsProfileRegion(profile) {
 }
 function awsDefaultProfileSections() {
   return [
-    [path39.join(os13.homedir(), ".aws", "config"), "[default]"],
-    [path39.join(os13.homedir(), ".aws", "credentials"), "[default]"]
+    [path40.join(os13.homedir(), ".aws", "config"), "[default]"],
+    [path40.join(os13.homedir(), ".aws", "credentials"), "[default]"]
   ];
 }
 function awsDefaultProfileRegion() {
   for (const [file, header] of awsDefaultProfileSections()) {
     try {
-      const region = parseProfileRegion(fs32.readFileSync(file, "utf-8"), header);
+      const region = parseProfileRegion(fs33.readFileSync(file, "utf-8"), header);
       if (region) return region;
     } catch {
     }
@@ -18974,9 +19637,9 @@ async function tunnelServices(serviceNames, options) {
   process.on("SIGTERM", cleanup);
   await Promise.race(
     processes.map(
-      (proc) => new Promise((resolve15) => {
-        proc.on("exit", () => resolve15());
-        proc.on("error", () => resolve15());
+      (proc) => new Promise((resolve16) => {
+        proc.on("exit", () => resolve16());
+        proc.on("error", () => resolve16());
       })
     )
   );
@@ -19019,10 +19682,10 @@ async function tunnelExternal(name, options) {
   const { appTenant, appStage } = resolveCredentialAxis(options);
   const secretId = externalSecretId(appTenant, appStage, name, key);
   const setHint = `mesh secrets set external/${name}${key ? ` --key=${key}` : ""}`;
-  const sm = new SecretsManagerClient7({});
+  const sm = new SecretsManagerClient8({});
   let creds;
   try {
-    const out = await sm.send(new GetSecretValueCommand7({ SecretId: secretId }));
+    const out = await sm.send(new GetSecretValueCommand8({ SecretId: secretId }));
     creds = JSON.parse(out.SecretString ?? "{}");
   } catch (err) {
     logError(
@@ -19073,9 +19736,9 @@ async function tunnelExternal(name, options) {
   };
   process.on("SIGINT", cleanup);
   process.on("SIGTERM", cleanup);
-  await new Promise((resolve15) => {
-    proc.on("exit", () => resolve15());
-    proc.on("error", () => resolve15());
+  await new Promise((resolve16) => {
+    proc.on("exit", () => resolve16());
+    proc.on("error", () => resolve16());
   });
   cleanup();
 }
@@ -19202,8 +19865,8 @@ async function resolveToken(opts) {
     "no token: pass --token, set VCS_TOKEN, or pass --context <platform-context> (after mesh login)"
   );
 }
-async function vcsApi(baseUrl, token, path41, method = "GET", body) {
-  const res = await fetch(`${baseUrl}${path41}`, {
+async function vcsApi(baseUrl, token, path42, method = "GET", body) {
+  const res = await fetch(`${baseUrl}${path42}`, {
     method,
     headers: {
       authorization: `Bearer ${token}`,
@@ -19214,7 +19877,7 @@ async function vcsApi(baseUrl, token, path41, method = "GET", body) {
   const data = await res.json().catch(() => ({}));
   if (!res.ok) {
     throw new Error(
-      `${method} ${path41} failed (${res.status}): ${String(data.error ?? "unknown error")}`
+      `${method} ${path42} failed (${res.status}): ${String(data.error ?? "unknown error")}`
     );
   }
   return data;
@@ -19257,8 +19920,8 @@ var init_clone = __esm({
 
 // libs/mesh-cli/src/commands/vcs/get.ts
 import { writeFile as writeFile2, mkdir as mkdir2 } from "node:fs/promises";
-import { join as join37, dirname as dirname27 } from "node:path";
-async function getCommand(repo, path41, opts) {
+import { join as join38, dirname as dirname28 } from "node:path";
+async function getCommand(repo, path42, opts) {
   let vcsBaseUrl;
   let token;
   if (opts.target) {
@@ -19273,18 +19936,18 @@ async function getCommand(repo, path41, opts) {
   if (!token) throw new Error("no token: pass --target (after mesh login), or --token / --context");
   const reader = createVcsFolderReader({ vcsBaseUrl, token });
   try {
-    const { ref, files } = await reader.readPath(repo, path41);
+    const { ref, files } = await reader.readPath(repo, path42);
     if (files.length === 0) {
-      logInfo(`no files at ${repo}:${path41}`);
+      logInfo(`no files at ${repo}:${path42}`);
       return;
     }
     if (opts.output) {
       for (const f of files) {
-        const abs = join37(opts.output, f.path);
-        await mkdir2(dirname27(abs), { recursive: true });
+        const abs = join38(opts.output, f.path);
+        await mkdir2(dirname28(abs), { recursive: true });
         await writeFile2(abs, f.contents);
       }
-      logInfo(`wrote ${files.length} file(s) from ${repo}:${path41} (${ref}) \u2192 ${opts.output}`);
+      logInfo(`wrote ${files.length} file(s) from ${repo}:${path42} (${ref}) \u2192 ${opts.output}`);
     } else {
       for (const f of files) {
         if (files.length > 1) process.stdout.write(`
@@ -19309,10 +19972,10 @@ var init_get = __esm({
 });
 
 // libs/mesh-cli/src/commands/vcs/drafts.ts
-async function call(opts, repo, path41, method = "GET", body) {
+async function call(opts, repo, path42, method = "GET", body) {
   const target = await resolveTarget2({ ...opts, repo });
   const token = await resolveToken(opts);
-  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path41}`, method, body);
+  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path42}`, method, body);
 }
 async function draftsListCommand(repo, opts) {
   const data = await call(opts, repo, `/drafts${opts.all ? "?all=true" : ""}`);
@@ -19367,7 +20030,7 @@ var init_drafts = __esm({
 
 // libs/mesh-cli/src/commands/vcs/propose.ts
 import { readFile as readFile2 } from "node:fs/promises";
-import { join as join38 } from "node:path";
+import { join as join39 } from "node:path";
 function parseStatus(out) {
   const tokens = out.split("\0");
   const changes = [];
@@ -19422,7 +20085,7 @@ async function proposeCommand(opts) {
       async (c) => c.status.startsWith("D") ? { op: "delete", path: c.path } : {
         op: "write",
         path: c.path,
-        content: await readFile2(join38(cwd, c.path), "utf8")
+        content: await readFile2(join39(cwd, c.path), "utf8")
       }
     )
   );
@@ -19446,8 +20109,8 @@ async function proposeCommand(opts) {
     operations,
     ...opts.mergeParent ? { mergeParent: opts.mergeParent } : {}
   };
-  const path41 = opts.revise ? `/v1/repos/${target.repo}/proposals/${opts.revise}/revisions` : `/v1/repos/${target.repo}/proposals`;
-  const data = await vcsApi(target.baseUrl, token, path41, "POST", body);
+  const path42 = opts.revise ? `/v1/repos/${target.repo}/proposals/${opts.revise}/revisions` : `/v1/repos/${target.repo}/proposals`;
+  const data = await vcsApi(target.baseUrl, token, path42, "POST", body);
   console.log(
     `proposal ${data.proposalId} @ ${data.sha.slice(0, 8)} \u2014 review: mesh vcs show ${target.repo} ${data.proposalId} --url ${target.baseUrl}`
   );
@@ -19460,10 +20123,10 @@ var init_propose = __esm({
 });
 
 // libs/mesh-cli/src/commands/vcs/review.ts
-async function call2(opts, repo, path41, method = "GET", body) {
+async function call2(opts, repo, path42, method = "GET", body) {
   const target = await resolveTarget2({ ...opts, repo });
   const token = await resolveToken(opts);
-  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path41}`, method, body);
+  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path42}`, method, body);
 }
 async function proposalsCommand(repo, opts) {
   console.log(JSON.stringify(await call2(opts, repo, "/proposals"), null, 2));
@@ -19604,8 +20267,8 @@ function computeHappyPath(nodes, edges) {
     const queue = [{ id: startNode.id, path: [startNode.id] }];
     const visited = /* @__PURE__ */ new Set([startNode.id]);
     while (queue.length > 0) {
-      const { id, path: path41 } = queue.shift();
-      if (targetIds.has(id)) return path41;
+      const { id, path: path42 } = queue.shift();
+      if (targetIds.has(id)) return path42;
       const neighbors = adjacency.get(id) ?? [];
       const hasMainEdge = neighbors.some((e) => e.isMainPath);
       const candidates = hasMainEdge ? neighbors.filter((e) => e.isMainPath) : neighbors;
@@ -19624,7 +20287,7 @@ function computeHappyPath(nodes, edges) {
         if (visited.has(neighbor.to)) continue;
         if (!allowExceptional && (neighbor.isExceptional || neighbor.isTimeout || failureEndIds.has(neighbor.to))) continue;
         visited.add(neighbor.to);
-        queue.push({ id: neighbor.to, path: [...path41, neighbor.to] });
+        queue.push({ id: neighbor.to, path: [...path42, neighbor.to] });
       }
     }
     return null;
@@ -19872,11 +20535,11 @@ function wrapIntoGroup(workflow, nodeIds, groupId, label, groupType) {
         }
       }
       if (found) {
-        const path41 = [];
-        for (let c = found; c !== void 0; c = prev.get(c)) path41.unshift(c);
-        for (let i = 0; i < path41.length - 1; i++) mainEdgeKeys.add(edgeKey(path41[i], path41[i + 1]));
+        const path42 = [];
+        for (let c = found; c !== void 0; c = prev.get(c)) path42.unshift(c);
+        for (let i = 0; i < path42.length - 1; i++) mainEdgeKeys.add(edgeKey(path42[i], path42[i + 1]));
         mainEdgeKeys.add(edgeKey(found, successExit.id));
-        mainBody = path41;
+        mainBody = path42;
         mainTail = [successExit.id];
       }
     }
@@ -20278,11 +20941,11 @@ var init_apply_preview_patch = __esm({
 
 // libs/workflow-model/src/process-artifact.ts
 import { z as z4 } from "zod";
-function formatPath(path41) {
-  return path41.length > 0 ? z4.core.toDotPath(path41) : "(root)";
+function formatPath(path42) {
+  return path42.length > 0 ? z4.core.toDotPath(path42) : "(root)";
 }
 function issueToDiagnostic(issue) {
-  const path41 = formatPath(issue.path);
+  const path42 = formatPath(issue.path);
   let code = "SCHEMA_INVALID";
   if (issue.code === "custom") {
     const paramCode = issue.params?.code;
@@ -20293,8 +20956,8 @@ function issueToDiagnostic(issue) {
   return {
     severity: "error",
     code,
-    message: `${path41}: ${issue.message}`,
-    path: path41
+    message: `${path42}: ${issue.message}`,
+    path: path42
   };
 }
 function parseProcessArtifact(json) {
@@ -20374,20 +21037,20 @@ var init_process_artifact = __esm({
         outcome: "DUPLICATE_OUTCOME_ID"
       };
       const idFirstSeenAt = /* @__PURE__ */ new Map();
-      const checkId = (id, kind, path41) => {
+      const checkId = (id, kind, path42) => {
         const first = idFirstSeenAt.get(id);
         if (first) {
           const kindLabel = kind === first.kind ? kind : "process";
           ctx.addIssue({
             code: "custom",
-            path: path41,
-            message: `Duplicate ${kindLabel} id "${id}": ${kind} at ${z4.core.toDotPath(path41)} collides with ${first.kind} at ${z4.core.toDotPath(first.path)}.`,
+            path: path42,
+            message: `Duplicate ${kindLabel} id "${id}": ${kind} at ${z4.core.toDotPath(path42)} collides with ${first.kind} at ${z4.core.toDotPath(first.path)}.`,
             params: {
               code: kind === first.kind ? SAME_KIND_CODE[kind] : "DUPLICATE_PROCESS_ID"
             }
           });
         } else {
-          idFirstSeenAt.set(id, { kind, path: path41 });
+          idFirstSeenAt.set(id, { kind, path: path42 });
         }
       };
       process2.stages.forEach((stage, stageIndex) => {
@@ -20425,13 +21088,13 @@ function lintProcess(artifact, inventory, predicateNames) {
   const internalCommands = process2.internalCommands ?? [];
   const internalSet = new Set(internalCommands);
   const boundCommandPaths = /* @__PURE__ */ new Map();
-  const checkPredicate = (predicate, path41) => {
+  const checkPredicate = (predicate, path42) => {
     if (!predicateSet.has(predicate)) {
       diagnostics.push({
         severity: "error",
         code: "UNKNOWN_PREDICATE",
-        message: `Predicate "${predicate}" referenced at ${path41} is not in the predicate registry.`,
-        path: path41
+        message: `Predicate "${predicate}" referenced at ${path42} is not in the predicate registry.`,
+        path: path42
       });
     }
   };
@@ -20572,8 +21235,8 @@ var init_src3 = __esm({
 });
 
 // libs/mesh-cli/src/commands/workflow.ts
-import * as fs33 from "fs";
-import * as path40 from "path";
+import * as fs34 from "fs";
+import * as path41 from "path";
 import { createRequire as createRequire2 } from "module";
 import { execFileSync as execFileSync29 } from "child_process";
 function resolveExtractorPath() {
@@ -20589,7 +21252,7 @@ function runExtraction(targetPath, extractorPath, explicitProcessPath) {
   let explicitProcessArtifact;
   if (explicitProcessPath) {
     try {
-      explicitProcessArtifact = JSON.parse(fs33.readFileSync(explicitProcessPath, "utf-8"));
+      explicitProcessArtifact = JSON.parse(fs34.readFileSync(explicitProcessPath, "utf-8"));
     } catch (err) {
       logError(
         `Could not read/parse --process ${explicitProcessPath}: ${err instanceof Error ? err.message : String(err)}`
@@ -20689,7 +21352,7 @@ function runLintExtraction(targetPath, extractorPath, explicitProcessPath) {
   let explicitProcessArtifact;
   if (explicitProcessPath) {
     try {
-      explicitProcessArtifact = JSON.parse(fs33.readFileSync(explicitProcessPath, "utf-8"));
+      explicitProcessArtifact = JSON.parse(fs34.readFileSync(explicitProcessPath, "utf-8"));
     } catch (err) {
       logError(
         `Could not read/parse --process ${explicitProcessPath}: ${err instanceof Error ? err.message : String(err)}`
@@ -20794,16 +21457,16 @@ function registerWorkflowCommands(program2) {
   ).action(
     async (targetPath, opts) => {
       try {
-        const resolvedPath = path40.resolve(targetPath);
-        if (!fs33.existsSync(resolvedPath)) {
+        const resolvedPath = path41.resolve(targetPath);
+        if (!fs34.existsSync(resolvedPath)) {
           logError(`Path does not exist: ${resolvedPath}`);
           process.exitCode = 1;
           return;
         }
         let resolvedProcessPath;
         if (opts.process) {
-          resolvedProcessPath = path40.resolve(opts.process);
-          if (!fs33.existsSync(resolvedProcessPath)) {
+          resolvedProcessPath = path41.resolve(opts.process);
+          if (!fs34.existsSync(resolvedProcessPath)) {
             logError(`--process path does not exist: ${resolvedProcessPath}`);
             process.exitCode = 1;
             return;
@@ -20852,8 +21515,8 @@ function registerWorkflowCommands(program2) {
     "Extract the as-built command/query/activity inventory from Temporal workflow source\n\nThe inventory ({ workflowType, commands, queries, activities }) is the process-\nconformance lint's code-side input \u2014 it is never hand-edited. Supports single\nfiles or directories."
   ).action(async (targetPath) => {
     try {
-      const resolvedPath = path40.resolve(targetPath);
-      if (!fs33.existsSync(resolvedPath)) {
+      const resolvedPath = path41.resolve(targetPath);
+      if (!fs34.existsSync(resolvedPath)) {
         logError(`Path does not exist: ${resolvedPath}`);
         process.exitCode = 1;
         return;
@@ -20896,16 +21559,16 @@ function registerWorkflowCommands(program2) {
     "Comma-separated named-predicate registry (enables UNKNOWN_PREDICATE checks)"
   ).action(async (targetPath, opts) => {
     try {
-      const resolvedPath = path40.resolve(targetPath);
-      if (!fs33.existsSync(resolvedPath)) {
+      const resolvedPath = path41.resolve(targetPath);
+      if (!fs34.existsSync(resolvedPath)) {
         logError(`Path does not exist: ${resolvedPath}`);
         process.exitCode = 1;
         return;
       }
       let resolvedProcessPath;
       if (opts.process) {
-        resolvedProcessPath = path40.resolve(opts.process);
-        if (!fs33.existsSync(resolvedProcessPath)) {
+        resolvedProcessPath = path41.resolve(opts.process);
+        if (!fs34.existsSync(resolvedProcessPath)) {
           logError(`--process path does not exist: ${resolvedProcessPath}`);
           process.exitCode = 1;
           return;