@mesh-tech/mesh-cli 0.14.0 → 0.15.0

package/dist/bin/mesh.js

@@ -580,11 +580,11 @@ function createVcsFolderReader(opts) {
     }
     return p;
   };
-  const readPath = async (repo, path41) => {
+  const readPath = async (repo, path42) => {
     const dir = await cloneRepo(repo);
-    const ref = await resolveFolderRef(dir, path41);
-    if (!ref) throw new Error(`path "${path41}" not found on any ref of ${repo}`);
-    const files = await readFolderAtRef(dir, ref, path41);
+    const ref = await resolveFolderRef(dir, path42);
+    if (!ref) throw new Error(`path "${path42}" not found on any ref of ${repo}`);
+    const files = await readFolderAtRef(dir, ref, path42);
     return { ref, files };
   };
   const cleanup = async () => {
@@ -1530,7 +1530,7 @@ function execTailscaleCmd(args) {
     }
     attempts.push({ binary, args });
   }
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve16, reject) => {
     let index = 0;
     function tryNext() {
       if (index >= attempts.length) {
@@ -1542,7 +1542,7 @@ function execTailscaleCmd(args) {
         if (error) {
           tryNext();
         } else {
-          resolve15(stdout);
+          resolve16(stdout);
         }
       });
     }
@@ -2034,14 +2034,14 @@ var init_temporal_auth = __esm({
 // libs/mesh-cli/src/utils/reachability.ts
 import { createConnection } from "node:net";
 function probeTcpReachable(host, port, timeoutMs = 1500) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     let settled = false;
     const socket = createConnection({ host, port });
     const finish = (ok) => {
       if (settled) return;
       settled = true;
       socket.destroy();
-      resolve15(ok);
+      resolve16(ok);
     };
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => finish(true));
@@ -2050,7 +2050,7 @@ function probeTcpReachable(host, port, timeoutMs = 1500) {
   });
 }
 function probeConnectionHolds(host, port, timeoutMs = 800, holdMs = 25) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     let settled = false;
     let holdTimer;
     const socket = createConnection({ host, port });
@@ -2059,7 +2059,7 @@ function probeConnectionHolds(host, port, timeoutMs = 800, holdMs = 25) {
       settled = true;
       if (holdTimer) clearTimeout(holdTimer);
       socket.destroy();
-      resolve15(ok);
+      resolve16(ok);
     };
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
@@ -2191,16 +2191,16 @@ async function waitForPort(host, port, timeoutMs, intervalMs = 500) {
     const attemptTimeout = Math.max(250, Math.min(1e3, remaining));
     if (await tryConnect(host, port, attemptTimeout)) return true;
     if (Date.now() + intervalMs >= deadline) return false;
-    await new Promise((resolve15) => setTimeout(resolve15, intervalMs));
+    await new Promise((resolve16) => setTimeout(resolve16, intervalMs));
   }
 }
 function tryConnect(host, port, timeoutMs) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const socket = net.connect({ host, port });
     const done = (ok) => {
       socket.removeAllListeners();
       socket.destroy();
-      resolve15(ok);
+      resolve16(ok);
     };
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => done(true));
@@ -2277,7 +2277,7 @@ async function ensureTemporalNamespace(namespace, description) {
         });
         break;
       } catch {
-        await new Promise((resolve15) => setTimeout(resolve15, 1e3));
+        await new Promise((resolve16) => setTimeout(resolve16, 1e3));
       }
     }
     logSuccess(`Temporal namespace '${namespace}' is active`);
@@ -2449,16 +2449,16 @@ async function upsertLocalSecret(secretId, value, client) {
 }
 function probeTcp(port, opts = {}) {
   const { host = "127.0.0.1", timeoutMs = 2e3 } = opts;
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const socket = net2.connect({ host, port, timeout: timeoutMs });
     socket.once("connect", () => {
       socket.destroy();
-      resolve15(true);
+      resolve16(true);
     });
-    socket.once("error", () => resolve15(false));
+    socket.once("error", () => resolve16(false));
     socket.once("timeout", () => {
       socket.destroy();
-      resolve15(false);
+      resolve16(false);
     });
   });
 }
@@ -2496,7 +2496,8 @@ __export(stack_exports, {
   stackDir: () => stackDir,
   stackOwnedElsewhere: () => stackOwnedElsewhere,
   stackServices: () => stackServices,
-  summarizeComposeFailure: () => summarizeComposeFailure
+  summarizeComposeFailure: () => summarizeComposeFailure,
+  writeAppServiceProbes: () => writeAppServiceProbes
 });
 import { execFileSync as execFileSync4, spawn, spawnSync } from "child_process";
 import * as fs7 from "fs";
@@ -2514,6 +2515,26 @@ function localProbesDir() {
   fs7.mkdirSync(dir, { recursive: true });
   return dir;
 }
+function writeAppServiceProbes(args) {
+  const entries = Object.entries(args.services);
+  if (entries.length === 0) return void 0;
+  const healthPath = args.healthPath ?? "/health";
+  const targets = entries.map(([name, port]) => ({
+    targets: [`http://host.docker.internal:${port}${healthPath}`],
+    labels: {
+      type: "service",
+      tenant: args.tenant,
+      env: args.env,
+      app: args.app,
+      service: name,
+      target: name
+    }
+  }));
+  const file = path8.join(localProbesDir(), `${args.tenant}-${args.app}-services.json`);
+  fs7.writeFileSync(file, `${JSON.stringify(targets, null, 2)}
+`);
+  return file;
+}
 function hubPort() {
   const raw = process.env.MESH_HUB_PORT?.trim();
   if (!raw) return DEFAULT_HUB_PORT;
@@ -2690,7 +2711,7 @@ async function composeStreamed(args, opts = {}) {
   let captured = "";
   let exitCode;
   try {
-    exitCode = await new Promise((resolve15, reject) => {
+    exitCode = await new Promise((resolve16, reject) => {
       const child = spawn("docker", fullArgs, {
         cwd: dir,
         env,
@@ -2706,11 +2727,11 @@ async function composeStreamed(args, opts = {}) {
       child.stdout.on("data", consume);
       child.stderr.on("data", consume);
       child.on("error", reject);
-      child.on("close", (code) => resolve15(code ?? 1));
+      child.on("close", (code) => resolve16(code ?? 1));
     });
   } finally {
     heartbeat.stop();
-    await new Promise((resolve15) => logStream.end(resolve15));
+    await new Promise((resolve16) => logStream.end(resolve16));
   }
   if (exitCode !== 0) {
     throw new MeshCliError(
@@ -2798,6 +2819,13 @@ var init_stack = __esm({
         probe: { kind: "http", url: "http://localhost:8080/debug/healthz" },
         hint: "admin@local.mesh / LocalDev1!"
       },
+      {
+        service: "mailpit",
+        label: "Mailbox (local mail)",
+        url: "http://localhost:8025",
+        probe: { kind: "http", url: "http://localhost:8025/readyz" },
+        hint: "every activation + password-reset mail Zitadel sends locally lands here"
+      },
       {
         service: "database",
         label: "Postgres",
@@ -3382,16 +3410,48 @@ var init_mocks = __esm({
 });
 
 // libs/api-registry/src/hub-roles.ts
-var HUB_STAFF_ROLES, HUB_RESTRICTED_ROLES, HUB_BASE_ROLES, RESTRICTED;
+function restrictedRoleBase(roleKey) {
+  const sep5 = roleKey.indexOf(HUB_ROLE_KEY_SEPARATOR);
+  const base = sep5 === -1 ? roleKey : roleKey.slice(0, sep5);
+  return RESTRICTED.has(base) ? base : null;
+}
+function hubRoleKeyTenant(roleKey) {
+  const sep5 = roleKey.indexOf(HUB_ROLE_KEY_SEPARATOR);
+  if (sep5 === -1) return null;
+  const scope = roleKey.slice(sep5 + 1);
+  const appSep = scope.indexOf(HUB_ROLE_APP_SEPARATOR);
+  return appSep === -1 ? scope : scope.slice(0, appSep);
+}
+function hubOperatorRoleKeys(tenants) {
+  const cleaned = [...new Set(tenants.filter((t) => t !== ""))].sort();
+  for (const tenant of cleaned) {
+    for (const sep5 of [HUB_ROLE_KEY_SEPARATOR, HUB_ROLE_APP_SEPARATOR]) {
+      if (tenant.includes(sep5)) {
+        throw new Error(
+          `hubOperatorRoleKeys: tenant name "${tenant}" contains the role-key separator "${sep5}" \u2014 it would parse as a different tenant's or app's grant`
+        );
+      }
+    }
+  }
+  return [
+    ...HUB_BASE_ROLES,
+    ...cleaned.flatMap(
+      (tenant) => HUB_RESTRICTED_ROLES.map((role) => `${role}${HUB_ROLE_KEY_SEPARATOR}${tenant}`)
+    )
+  ];
+}
+var HUB_STAFF_ROLES, HUB_RESTRICTED_ROLES, HUB_BASE_ROLES, HUB_ROLE_KEY_SEPARATOR, HUB_ROLE_APP_SEPARATOR, RESTRICTED;
 var init_hub_roles = __esm({
   "libs/api-registry/src/hub-roles.ts"() {
     "use strict";
-    HUB_STAFF_ROLES = ["ops", "admin", "developer"];
-    HUB_RESTRICTED_ROLES = ["auditor", "vendor"];
+    HUB_STAFF_ROLES = ["ops", "admin"];
+    HUB_RESTRICTED_ROLES = ["developer", "auditor", "vendor"];
     HUB_BASE_ROLES = [
       ...HUB_STAFF_ROLES,
       ...HUB_RESTRICTED_ROLES
     ];
+    HUB_ROLE_KEY_SEPARATOR = ":";
+    HUB_ROLE_APP_SEPARATOR = "/";
     RESTRICTED = new Set(HUB_RESTRICTED_ROLES);
   }
 });
@@ -3506,7 +3566,9 @@ async function api(pat, method, apiPath, body, orgId) {
   const text = await res.text();
   const data = text ? JSON.parse(text) : {};
   if (!res.ok) {
-    const err = new Error(`Zitadel ${method} ${apiPath} \u2192 ${res.status}: ${data?.message ?? text}`);
+    const err = new Error(
+      `Zitadel ${method} ${apiPath} \u2192 ${res.status}: ${data?.message ?? text}`
+    );
     err.status = res.status;
     err.zitadelCode = data?.code;
     throw err;
@@ -3552,7 +3614,12 @@ async function ensureCliApp(pat, projectId) {
     logInfo(`Zitadel app '${CLI_APP_NAME}' already exists`);
     return existing;
   }
-  const created = await api(pat, "POST", `/management/v1/projects/${projectId}/apps/oidc`, buildCliAppPayload());
+  const created = await api(
+    pat,
+    "POST",
+    `/management/v1/projects/${projectId}/apps/oidc`,
+    buildCliAppPayload()
+  );
   logSuccess(`Created Zitadel application '${CLI_APP_NAME}' (PKCE + device code)`);
   return created.clientId;
 }
@@ -3594,12 +3661,16 @@ function readHubAuth() {
     return null;
   }
 }
+function hubRoleDisplayName(roleKey) {
+  const tenant = hubRoleKeyTenant(roleKey);
+  return tenant === null ? roleKey : `${restrictedRoleBase(roleKey) ?? roleKey} (${tenant})`;
+}
 async function ensureHubRoles(pat, projectId) {
   for (const role of HUB_ROLES) {
     try {
       await api(pat, "POST", `/management/v1/projects/${projectId}/roles`, {
         roleKey: role,
-        displayName: role
+        displayName: hubRoleDisplayName(role)
       });
       logSuccess(`Created Hub role '${role}'`);
     } catch (err) {
@@ -3628,7 +3699,10 @@ async function reconcileHubRedirectUris(pat, projectId, app) {
     redirectUris,
     postLogoutRedirectUris,
     responseTypes: cfg.responseTypes ?? ["OIDC_RESPONSE_TYPE_CODE"],
-    grantTypes: cfg.grantTypes ?? ["OIDC_GRANT_TYPE_AUTHORIZATION_CODE", "OIDC_GRANT_TYPE_REFRESH_TOKEN"],
+    grantTypes: cfg.grantTypes ?? [
+      "OIDC_GRANT_TYPE_AUTHORIZATION_CODE",
+      "OIDC_GRANT_TYPE_REFRESH_TOKEN"
+    ],
     appType: "OIDC_APP_TYPE_WEB",
     authMethodType: "OIDC_AUTH_METHOD_TYPE_BASIC",
     accessTokenType: cfg.accessTokenType ?? "OIDC_TOKEN_TYPE_JWT",
@@ -3637,7 +3711,9 @@ async function reconcileHubRedirectUris(pat, projectId, app) {
     idTokenUserinfoAssertion: cfg.idTokenUserinfoAssertion ?? true,
     devMode: cfg.devMode ?? true
   });
-  logSuccess(`Registered Hub redirect URI http://localhost:${hubPort()}/oauth2/callback (MESH_HUB_PORT)`);
+  logSuccess(
+    `Registered Hub redirect URI http://localhost:${hubPort()}/oauth2/callback (MESH_HUB_PORT)`
+  );
 }
 async function ensureHubApp(pat, projectId) {
   const existing = await searchZitadelApp(pat, projectId, HUB_APP_NAME);
@@ -3713,12 +3789,39 @@ async function seedHubAuth(pat) {
   const persistedCookie = persisted?.cookieSecret && [16, 24, 32].includes(persisted.cookieSecret.length) ? persisted.cookieSecret : void 0;
   const config = {
     clientId: app.clientId,
+    projectId,
     clientSecret: app.clientSecret ?? persisted?.clientSecret ?? "",
     cookieSecret: persistedCookie ?? (await import("crypto")).randomBytes(16).toString("hex")
   };
   fs9.writeFileSync(hubAuthPath(), JSON.stringify(config, null, 2), { mode: 384 });
   return config;
 }
+async function publishHubAuthzPointer(projectId, orgId, awsConfig) {
+  const { SSMClient: SSMClient5, GetParameterCommand: GetParameterCommand2, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5(awsConfig);
+  const name = `/mesh-platform/${LOCAL_TENANT}/${LOCAL_ENV}/apps/hub/stacks/local/authz`;
+  let current = {};
+  try {
+    const existing = await ssm.send(new GetParameterCommand2({ Name: name }));
+    current = JSON.parse(existing.Parameter?.Value ?? "{}");
+  } catch {
+  }
+  const value = {
+    spicedb: { instanceRefs: [] },
+    ...current,
+    zitadel: { projectId, orgId, issuer: ZITADEL_ISSUER }
+  };
+  await ssm.send(
+    new PutParameterCommand({
+      Name: name,
+      Type: "String",
+      Overwrite: true,
+      Value: JSON.stringify(value),
+      Description: "Hub authz pointer (local analog of the platform Pulumi program)"
+    })
+  );
+  logSuccess(`Hub authz pointer published \u2192 project ${projectId} in org ${orgId}`);
+}
 async function writeRegistryParams(cliClientId, awsConfig) {
   const { SSMClient: SSMClient5, PutParameterCommand } = await import("@aws-sdk/client-ssm");
   const ssm = new SSMClient5(awsConfig);
@@ -3743,6 +3846,77 @@ async function writeRegistryParams(cliClientId, awsConfig) {
     );
   }
 }
+async function ensureOpsHubAdmin(pat, awsConfig) {
+  const {
+    SecretsManagerClient: SecretsManagerClient9,
+    GetSecretValueCommand: GetSecretValueCommand9,
+    CreateSecretCommand: CreateSecretCommand4,
+    PutSecretValueCommand: PutSecretValueCommand4
+  } = await import("@aws-sdk/client-secrets-manager");
+  const sm = new SecretsManagerClient9(awsConfig);
+  const existing = await sm.send(new GetSecretValueCommand9({ SecretId: OPS_HUB_SECRET_ID })).catch(() => null);
+  if (existing?.SecretString) {
+    logSuccess("Hub admin key already provisioned (Zitadel writes enabled)");
+    return;
+  }
+  const userName = "hub-opshub";
+  const found = await api(pat, "POST", "/management/v1/users/_search", {
+    queries: [{ userNameQuery: { userName, method: "TEXT_QUERY_METHOD_EQUALS" } }]
+  });
+  let userId = found?.result?.[0]?.id;
+  if (!userId) {
+    const created = await api(pat, "POST", "/management/v1/users/machine", {
+      userName,
+      name: "Hub Ops Hub admin",
+      description: "Local Hub Zitadel admin plane (seeded by mesh start)"
+    });
+    userId = created?.userId;
+  }
+  if (!userId) throw new MeshCliError("could not create the Hub's Zitadel admin user");
+  await api(pat, "POST", "/admin/v1/members", { userId, roles: ["IAM_OWNER"] }).catch(
+    () => void 0
+  );
+  const key = await api(pat, "POST", `/management/v1/users/${userId}/keys`, {
+    type: "KEY_TYPE_JSON"
+  });
+  if (!key?.keyDetails)
+    throw new MeshCliError("Zitadel did not return a machine key for the Hub admin user");
+  const raw = JSON.parse(Buffer.from(key.keyDetails, "base64").toString("utf8"));
+  const secretString = JSON.stringify({ keyId: raw.keyId, key: raw.key, userId: raw.userId });
+  await sm.send(new CreateSecretCommand4({ Name: OPS_HUB_SECRET_ID, SecretString: secretString })).catch(async () => {
+    await sm.send(
+      new PutSecretValueCommand4({ SecretId: OPS_HUB_SECRET_ID, SecretString: secretString })
+    );
+  });
+  logSuccess(`Hub admin key provisioned \u2192 ${OPS_HUB_SECRET_ID} (Zitadel writes enabled)`);
+}
+async function ensureLocalSmtp(pat) {
+  try {
+    const existing = await api(pat, "POST", "/admin/v1/smtp/_search", {}).catch(() => null);
+    const configs = existing?.result ?? [];
+    const match = configs.find((c) => c.host === LOCAL_SMTP.host);
+    if (!match) {
+      const created = await api(pat, "POST", "/admin/v1/smtp", {
+        senderAddress: LOCAL_SMTP.from,
+        senderName: LOCAL_SMTP.fromName,
+        tls: false,
+        host: LOCAL_SMTP.host,
+        user: "",
+        password: ""
+      });
+      if (created?.id) await api(pat, "POST", `/admin/v1/smtp/${created.id}/_activate`, {});
+      logSuccess(`Local mailbox wired to Zitadel \u2192 ${LOCAL_SMTP.host} (view at http://localhost:8025)`);
+      return;
+    }
+    if (match.state !== "SMTP_CONFIG_ACTIVE" && match.id) {
+      await api(pat, "POST", `/admin/v1/smtp/${match.id}/_activate`, {});
+    }
+  } catch (err) {
+    logWarn(
+      `Could not wire the local mailbox to Zitadel (${err.message}). Activation and password-reset mail will not be delivered locally.`
+    );
+  }
+}
 async function seedZitadel(awsConfig) {
   const pat = readSeederPat();
   const org = await api(pat, "POST", "/admin/v1/orgs/_search", {
@@ -3754,21 +3928,26 @@ async function seedZitadel(awsConfig) {
       { remediation: { command: "mesh stop --destroy && mesh start" } }
     );
   }
-  logSuccess(`Platform org '${PLATFORM_ORG}' ready (platform tenant root \u2014 holds platform-service auth config)`);
+  logSuccess(
+    `Platform org '${PLATFORM_ORG}' ready (platform tenant root \u2014 holds platform-service auth config)`
+  );
   try {
     await api(pat, "PUT", "/v2/features/instance", { loginV2: { required: false } });
   } catch {
   }
+  await ensureLocalSmtp(pat);
   const projectId = await ensureCliProject(pat);
   const cliClientId = await ensureCliApp(pat, projectId);
   await ensureTestUsers(pat);
   const hubAuth = await seedHubAuth(pat);
+  await publishHubAuthzPointer(hubAuth.projectId, org.result[0].id, awsConfig);
   await writeRegistryParams(cliClientId, awsConfig);
+  await ensureOpsHubAdmin(pat, awsConfig);
   writeContextConfig(LOGIN_CONTEXT, { issuer: ZITADEL_ISSUER, clientId: cliClientId });
   logSuccess(`Login context '${LOGIN_CONTEXT}' configured \u2192 try: mesh login ${LOGIN_CONTEXT}`);
   return { projectId, cliClientId, hubAuth };
 }
-var ZITADEL_ISSUER, LOGIN_CONTEXT, PLATFORM_ORG, CLI_PROJECT_NAME, CLI_APP_NAME, CLI_REDIRECT_URI, HUB_PROJECT_NAME, HUB_APP_NAME, hubRedirectUri, HUB_DEFAULT_REDIRECT_URI, HUB_ROLES, ZITADEL_SSM_PARAM, TEST_USERS_SSM_PREFIX, TEST_USERS, isAlreadyExists, ensureCliProject, ensureHubProject;
+var ZITADEL_ISSUER, LOGIN_CONTEXT, PLATFORM_ORG, CLI_PROJECT_NAME, CLI_APP_NAME, CLI_REDIRECT_URI, HUB_PROJECT_NAME, HUB_APP_NAME, hubRedirectUri, HUB_DEFAULT_REDIRECT_URI, HUB_ROLES, ZITADEL_SSM_PARAM, TEST_USERS_SSM_PREFIX, TEST_USERS, isAlreadyExists, ensureCliProject, ensureHubProject, OPS_HUB_SECRET_ID, LOCAL_SMTP;
 var init_seed_zitadel = __esm({
   "libs/mesh-cli/src/commands/local/seed-zitadel.ts"() {
     "use strict";
@@ -3788,16 +3967,37 @@ var init_seed_zitadel = __esm({
     HUB_APP_NAME = "ui";
     hubRedirectUri = () => `http://localhost:${hubPort()}/oauth2/callback`;
     HUB_DEFAULT_REDIRECT_URI = `http://localhost:${DEFAULT_HUB_PORT}/oauth2/callback`;
-    HUB_ROLES = HUB_BASE_ROLES;
+    HUB_ROLES = hubOperatorRoleKeys([LOCAL_TENANT]);
     ZITADEL_SSM_PARAM = `/mesh-platform/${LOCAL_TENANT}/${LOCAL_ENV}/platform/zitadel`;
     TEST_USERS_SSM_PREFIX = `/mesh-platform/${LOCAL_TENANT}/${LOCAL_ENV}/temporal/test-users`;
     TEST_USERS = [
-      { name: "dev", email: "dev@local.mesh", firstName: "Dev", lastName: "User", password: "LocalDev1!" },
-      { name: "ops", email: "ops@local.mesh", firstName: "Ops", lastName: "User", password: "LocalDev1!" }
+      {
+        name: "dev",
+        email: "dev@local.mesh",
+        firstName: "Dev",
+        lastName: "User",
+        password: "LocalDev1!"
+      },
+      {
+        name: "ops",
+        email: "ops@local.mesh",
+        firstName: "Ops",
+        lastName: "User",
+        password: "LocalDev1!"
+      }
     ];
     isAlreadyExists = (err) => err?.status === 409 || err?.zitadelCode === 6 || /already exists/i.test(err?.message ?? "");
-    ensureCliProject = (pat) => ensureZitadelProject(pat, CLI_PROJECT_NAME, { describe: "platform client feature", logExisting: true });
+    ensureCliProject = (pat) => ensureZitadelProject(pat, CLI_PROJECT_NAME, {
+      describe: "platform client feature",
+      logExisting: true
+    });
     ensureHubProject = (pat) => ensureZitadelProject(pat, HUB_PROJECT_NAME, { describe: "Hub platform app" });
+    OPS_HUB_SECRET_ID = "mesh/local/dev/zitadel/ops-hub";
+    LOCAL_SMTP = {
+      host: "mailpit:1025",
+      from: "no-reply@local.mesh",
+      fromName: "Mesh (local)"
+    };
   }
 });
 
@@ -3967,7 +4167,18 @@ async function registerLocalApp(args) {
   }
   await put2(
     `${base}/meta`,
-    { runtime: "mesh-dev-local", services: args.services, ports: args.ports ?? {} },
+    {
+      runtime: "mesh-dev-local",
+      services: args.services,
+      ports: args.ports ?? {},
+      // The same two fields a deployed stack stamps, so the Hub's app list and
+      // its activity timeline read a local run exactly as they read a deploy —
+      // which version of this app is running here, and since when. Without them
+      // a local app shows a blank version and never appears on the timeline,
+      // and "deployments aren't tracked" is indistinguishable from "no deploys".
+      ...args.version ? { version: args.version } : {},
+      deployedAt: (/* @__PURE__ */ new Date()).toISOString()
+    },
     "Local run metadata (mesh dev --local)"
   );
   logSuccess(`Registered app in the local registry \u2192 ${base}`);
@@ -4041,6 +4252,57 @@ async function reconcileRegistryFromZitadel() {
   }
   return { tenants, apps };
 }
+async function ensureSignInApp(args) {
+  const pat = readSeederPat();
+  const orgId = await ensureOrg(pat, args.tenant);
+  const projectId = await ensureProject(pat, orgId, args.app);
+  const name = `${args.service}-web`;
+  const base = args.baseUrl.replace(/\/+$/, "");
+  const redirectUris = [`${base}/oauth2/callback`];
+  const postLogoutRedirectUris = [base, `${base}/`];
+  const config = {
+    redirectUris,
+    postLogoutRedirectUris,
+    responseTypes: ["OIDC_RESPONSE_TYPE_CODE"],
+    grantTypes: ["OIDC_GRANT_TYPE_AUTHORIZATION_CODE", "OIDC_GRANT_TYPE_REFRESH_TOKEN"],
+    appType: "OIDC_APP_TYPE_WEB",
+    authMethodType: "OIDC_AUTH_METHOD_TYPE_BASIC",
+    // Roles must ride in the token: the app authorizes on them, and the Hub
+    // shows which roles a person holds by reading the same grants.
+    accessTokenType: "OIDC_TOKEN_TYPE_JWT",
+    accessTokenRoleAssertion: true,
+    idTokenRoleAssertion: true,
+    idTokenUserinfoAssertion: true,
+    // http:// callbacks are only permitted in dev mode.
+    devMode: true
+  };
+  const existing = await searchZitadelApp(pat, projectId, name, orgId);
+  if (existing) {
+    await api(
+      pat,
+      "PUT",
+      `/management/v1/projects/${projectId}/apps/${existing.id}/oidc_config`,
+      config,
+      orgId
+    );
+    return;
+  }
+  const created = await api(
+    pat,
+    "POST",
+    `/management/v1/projects/${projectId}/apps/oidc`,
+    { name, ...config },
+    orgId
+  );
+  await writeAuthSecret(args.tenant, args.app, name, {
+    clientId: created.clientId,
+    clientSecret: created.clientSecret,
+    issuer: "http://localhost:8080",
+    orgId,
+    projectId
+  });
+  logSuccess(`Created Zitadel application '${name}' (browser sign-in \u2192 ${base}/oauth2/callback)`);
+}
 async function ensureAppTenantAuth(args) {
   const pat = readSeederPat();
   const orgId = await ensureOrg(pat, args.tenant);
@@ -4652,14 +4914,14 @@ function isConfigStale(configMtimeMs, startedAtIso) {
   return configMtimeMs > Date.parse(startedAtIso);
 }
 function canConnect(host, port, timeoutMs = 800) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const socket = new net3.Socket();
     let settled = false;
     const done = (ok) => {
       if (settled) return;
       settled = true;
       socket.destroy();
-      resolve15(ok);
+      resolve16(ok);
     };
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => done(true));
@@ -5118,7 +5380,7 @@ async function startTokenServer(port, context) {
     })();
   });
   server.on("error", (e) => logWarn(`token-server error: ${e.message}`));
-  await new Promise((resolve15) => server.listen(port, "127.0.0.1", resolve15));
+  await new Promise((resolve16) => server.listen(port, "127.0.0.1", resolve16));
   logInfo(`dev-user token-server on http://127.0.0.1:${port} (context ${context})`);
   await new Promise(() => {
   });
@@ -5141,6 +5403,26 @@ import * as os6 from "os";
 import * as path15 from "path";
 import { Option } from "commander";
 import { SecretsManagerClient as SecretsManagerClient2, GetSecretValueCommand as GetSecretValueCommand2 } from "@aws-sdk/client-secrets-manager";
+function registerServiceProbes(devOutput, tenant, probeFiles) {
+  const services = {};
+  for (const [name, service] of Object.entries(devOutput.services)) {
+    if (name.startsWith("mock-")) continue;
+    services[name] = service.port;
+  }
+  try {
+    const file = writeAppServiceProbes({
+      tenant,
+      env: devOutput.platform?.env ?? "dev",
+      app: devOutput.app ?? "",
+      services
+    });
+    if (file) probeFiles.push(file);
+  } catch (err) {
+    logWarn(
+      `Could not register uptime probes for this session (${err instanceof Error ? err.message : err}) \u2014 the Hub will show no uptime for these services.`
+    );
+  }
+}
 function deriveSessionName(projectName, wt) {
   return wt.isPrimary ? `${projectName}-dev` : `${projectName}-${wt.slug}`;
 }
@@ -5228,10 +5510,10 @@ function removeSessionState(sessionName) {
   }
 }
 async function isPortFree(port) {
-  const bindSucceeds = (host) => new Promise((resolve15) => {
+  const bindSucceeds = (host) => new Promise((resolve16) => {
     const server = net4.createServer();
-    server.once("error", () => resolve15(false));
-    const onListening = () => server.close(() => resolve15(true));
+    server.once("error", () => resolve16(false));
+    const onListening = () => server.close(() => resolve16(true));
     if (host === void 0) server.listen(port, onListening);
     else server.listen(port, host, onListening);
   });
@@ -5239,24 +5521,24 @@ async function isPortFree(port) {
   return bindSucceeds("127.0.0.1");
 }
 async function findFreePort() {
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve16, reject) => {
     const server = net4.createServer();
     server.once("error", reject);
     server.listen(0, "127.0.0.1", () => {
       const { port } = server.address();
-      server.close(() => resolve15(port));
+      server.close(() => resolve16(port));
     });
   });
 }
 function isPortListening(port) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const s = new net4.Socket();
     let done = false;
     const fin = (ok) => {
       if (done) return;
       done = true;
       s.destroy();
-      resolve15(ok);
+      resolve16(ok);
     };
     s.setTimeout(300);
     s.once("connect", () => fin(true));
@@ -6789,6 +7071,8 @@ function registerDevCommand(program2) {
         }
         return;
       }
+      let signInServices = [];
+      let appVersion;
       try {
         const tenant = localTenant;
         const app = rawDevOutput2.app ?? projectName;
@@ -6796,6 +7080,7 @@ function registerDevCommand(program2) {
         const services = Object.keys(rawDevOutput2.services);
         const authServices = services.filter((name) => !name.startsWith("mock-"));
         let authRoles = [];
+        signInServices = [];
         try {
           const appPkg = JSON.parse(
             fs13.readFileSync(path15.join(appRoot, "package.json"), "utf-8")
@@ -6803,6 +7088,10 @@ function registerDevCommand(program2) {
           if (Array.isArray(appPkg?.mesh?.auth?.roles)) {
             authRoles = appPkg.mesh.auth.roles.filter((r) => typeof r === "string");
           }
+          if (Array.isArray(appPkg?.mesh?.auth?.signIn)) {
+            signInServices = appPkg.mesh.auth.signIn.filter((r) => typeof r === "string");
+          }
+          if (typeof appPkg?.version === "string") appVersion = appPkg.version;
         } catch {
         }
         await ensureAppTenantAuth({ tenant, app, services: authServices, roles: authRoles });
@@ -6813,10 +7102,30 @@ function registerDevCommand(program2) {
         );
       }
       const devOutput2 = await allocatePorts(rawDevOutput2, worktree);
+      for (const service of signInServices) {
+        const port = devOutput2.services[service]?.port;
+        if (!port) {
+          logWarn(`mesh.auth.signIn names '${service}', which this app does not run \u2014 no sign-in app registered.`);
+          continue;
+        }
+        try {
+          await ensureSignInApp({
+            tenant: localTenant,
+            app: devOutput2.app ?? projectName,
+            service,
+            baseUrl: `http://localhost:${port}`
+          });
+        } catch (err) {
+          logWarn(
+            `Could not register the browser sign-in for '${service}' (${err instanceof Error ? err.message : err}) \u2014 the Hub's Access \u2192 Sign-in tab will report this app has no login.`
+          );
+        }
+      }
       try {
         await registerLocalApp({
           tenant: localTenant,
           app: devOutput2.app ?? projectName,
+          version: appVersion,
           services: Object.keys(devOutput2.services),
           ports: Object.fromEntries(
             Object.entries(devOutput2.services).map(([name, svc]) => [name, svc.port])
@@ -6893,6 +7202,7 @@ function registerDevCommand(program2) {
         );
         logInfo(`Docker runner: ${composePath}`);
         dockerDevUp(sessionName);
+        registerServiceProbes(devOutput2, localTenant, externalProbeFiles);
         saveSessionState(sessionName, {
           appRoot,
           stack: "local",
@@ -6924,6 +7234,7 @@ function registerDevCommand(program2) {
         { transport: "vpn-direct" }
         // local mode: no tunnels
       );
+      registerServiceProbes(finalDevOutput2, localTenant, externalProbeFiles);
       saveSessionState(sessionName, {
         appRoot,
         stack: "local",
@@ -7395,6 +7706,7 @@ var init_dev = __esm({
     init_seed();
     init_mocks();
     init_dev_local();
+    init_stack();
     init_docker_runner();
     init_errors();
     init_stack_flag();
@@ -7626,7 +7938,7 @@ function discoverRunnerPids(tenant, exclude) {
   }
 }
 function startControlServer(payload) {
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve16, reject) => {
     const server = net6.createServer((socket) => {
       socket.on("error", () => {
       });
@@ -7639,12 +7951,12 @@ function startControlServer(payload) {
     });
     server.on("error", reject);
     server.listen(0, "127.0.0.1", () => {
-      resolve15({ server, port: server.address().port });
+      resolve16({ server, port: server.address().port });
     });
   });
 }
 function queryControl(port, timeoutMs = 700) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const s = new net6.Socket();
     let buf = "";
     let done = false;
@@ -7652,7 +7964,7 @@ function queryControl(port, timeoutMs = 700) {
       if (done) return;
       done = true;
       s.destroy();
-      resolve15(v);
+      resolve16(v);
     };
     s.setTimeout(timeoutMs);
     s.once("timeout", () => fin(null));
@@ -7877,14 +8189,14 @@ function findRunningDaemon(tenant) {
   return null;
 }
 function portAccepts(port, timeoutMs = 400) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const s = new net7.Socket();
     let done = false;
     const fin = (v) => {
       if (done) return;
       done = true;
       s.destroy();
-      resolve15(v);
+      resolve16(v);
     };
     s.setTimeout(timeoutMs);
     s.once("connect", () => fin(true));
@@ -8422,24 +8734,24 @@ function deriveLoginServer2(context) {
   return `https://${parts.join(".")}`;
 }
 function findFreePort2() {
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve16, reject) => {
     const s = net8.createServer();
     s.on("error", reject);
     s.listen(0, "127.0.0.1", () => {
       const port = s.address().port;
-      s.close(() => resolve15(port));
+      s.close(() => resolve16(port));
     });
   });
 }
 function canConnect2(port) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const s = new net8.Socket();
     let settled = false;
     const done = (ok) => {
       if (settled) return;
       settled = true;
       s.destroy();
-      resolve15(ok);
+      resolve16(ok);
     };
     s.setTimeout(500);
     s.once("connect", () => done(true));
@@ -8798,13 +9110,13 @@ function parseContextTenantEnv(context) {
   return { tenant: tenant || "mesh", env: env || "dev" };
 }
 function findFreePort3() {
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve16, reject) => {
     const srv = net9.createServer();
     srv.on("error", reject);
     srv.listen(0, "127.0.0.1", () => {
       const addr = srv.address();
       const port = typeof addr === "object" && addr ? addr.port : 0;
-      srv.close(() => resolve15(port));
+      srv.close(() => resolve16(port));
     });
   });
 }
@@ -9978,11 +10290,11 @@ function readAllCredentials() {
 function readCredentials(context) {
   return readAllCredentials()[context] ?? null;
 }
-function atomicWriteFileSync(path41, data, mode) {
-  const tmpPath = `${path41}.${process.pid}.${atomicWriteCounter++}.tmp`;
+function atomicWriteFileSync(path42, data, mode) {
+  const tmpPath = `${path42}.${process.pid}.${atomicWriteCounter++}.tmp`;
   try {
     fs19.writeFileSync(tmpPath, data, { mode });
-    fs19.renameSync(tmpPath, path41);
+    fs19.renameSync(tmpPath, path42);
   } catch (err) {
     try {
       fs19.unlinkSync(tmpPath);
@@ -10055,7 +10367,7 @@ async function refreshTokens(issuer, clientId, refreshToken) {
   return resp.json();
 }
 function login(context, config) {
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve16, reject) => {
     const codeVerifier = generateCodeVerifier();
     const codeChallenge = generateCodeChallenge(codeVerifier);
     const state = base64url(crypto3.randomBytes(16));
@@ -10139,7 +10451,7 @@ function login(context, config) {
         }
         hintVpnIfDisconnected(context);
         teardown();
-        resolve15();
+        resolve16();
       } catch (err) {
         teardown();
         reject(err);
@@ -11734,6 +12046,7 @@ __export(create_app_exports, {
   ensureWorkspaceGlobs: () => ensureWorkspaceGlobs,
   isInsidePlatformMonorepo: () => isInsidePlatformMonorepo,
   registerCreateAppCommand: () => registerCreateAppCommand,
+  resolveAppDir: () => resolveAppDir,
   shouldBootstrapAppsRepo: () => shouldBootstrapAppsRepo,
   workspaceGlobForApp: () => workspaceGlobForApp
 });
@@ -11918,7 +12231,7 @@ function parsePrimitives(input2) {
 }
 function resolveAppDir(cwd, tenant, name, test) {
   const baseDir = test ? "tests/tenants" : "tenants";
-  const possiblePaths = [
+  const possiblePaths = test ? [path24.join(cwd, baseDir, tenant, "apps")] : [
     path24.join(cwd, baseDir, tenant, "apps"),
     path24.join(cwd, "..", tenant, "apps"),
     path24.join(cwd, "apps")
@@ -12431,26 +12744,26 @@ async function startTunnelBackground(instanceId, rdsHost, rdsPort, localPort) {
   throw new Error(`Tunnel failed to start after ${maxAttempts} seconds`);
 }
 function checkPort(port) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const socket = new net10.Socket();
     socket.setTimeout(500);
     socket.on("connect", () => {
       socket.destroy();
-      resolve15(true);
+      resolve16(true);
     });
     socket.on("timeout", () => {
       socket.destroy();
-      resolve15(false);
+      resolve16(false);
     });
     socket.on("error", () => {
       socket.destroy();
-      resolve15(false);
+      resolve16(false);
     });
     socket.connect(port, "localhost");
   });
 }
 function sleep2(ms) {
-  return new Promise((resolve15) => setTimeout(resolve15, ms));
+  return new Promise((resolve16) => setTimeout(resolve16, ms));
 }
 async function psqlCommand(options) {
   let platformTenant;
@@ -12476,13 +12789,13 @@ async function psqlCommand(options) {
     logInfo(`App credentials: tenant=${appTenant}, stage=${appStage}, app=${appName}`);
   }
   const psqlCheck = spawn5("which", ["psql"]);
-  await new Promise((resolve15, reject) => {
+  await new Promise((resolve16, reject) => {
     psqlCheck.on("exit", (code) => {
       if (code !== 0) {
         logError("psql not found. Install with: brew install postgresql");
         reject(new Error("psql not found"));
       } else {
-        resolve15();
+        resolve16();
       }
     });
   });
@@ -12569,26 +12882,26 @@ function findSstOutputs() {
   return null;
 }
 function checkPort2(port) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const socket = new net11.Socket();
     socket.setTimeout(500);
     socket.on("connect", () => {
       socket.destroy();
-      resolve15(true);
+      resolve16(true);
     });
     socket.on("timeout", () => {
       socket.destroy();
-      resolve15(false);
+      resolve16(false);
     });
     socket.on("error", () => {
       socket.destroy();
-      resolve15(false);
+      resolve16(false);
     });
     socket.connect(port, "localhost");
   });
 }
 function sleep3(ms) {
-  return new Promise((resolve15) => setTimeout(resolve15, ms));
+  return new Promise((resolve16) => setTimeout(resolve16, ms));
 }
 async function startTunnelBackground2(instanceId, rdsEndpoint, rdsPort, localPort) {
   logInfo("Starting database tunnel...");
@@ -13308,7 +13621,7 @@ var init_discover = __esm({
 
 // libs/mesh-cli/src/docs/assemble.ts
 import { execFileSync as execFileSync20 } from "node:child_process";
-import { mkdirSync as mkdirSync15, readFileSync as readFileSync23, rmSync as rmSync5, writeFileSync as writeFileSync15 } from "node:fs";
+import { mkdirSync as mkdirSync15, readFileSync as readFileSync23, rmSync as rmSync5, writeFileSync as writeFileSync16 } from "node:fs";
 import path27 from "node:path";
 import { parse as parseYaml4 } from "yaml";
 function splitFrontMatter(markdown) {
@@ -13621,7 +13934,7 @@ function assemblePortal(options) {
 `;
     const outFile = path27.join(outDir, page.filePath);
     mkdirSync15(path27.dirname(outFile), { recursive: true });
-    writeFileSync15(
+    writeFileSync16(
       outFile,
       joinFrontMatter(outData, rewritten.body.trimEnd() + sourceNote)
     );
@@ -13928,8 +14241,8 @@ function formatDefault(value, paths = currentMachinePaths()) {
   if (typeof value === "boolean" || typeof value === "number") return String(value);
   return normalizeMachinePaths(JSON.stringify(value), paths);
 }
-function slugifyCommandPath(path41) {
-  return path41.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+function slugifyCommandPath(path42) {
+  return path42.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
 function extractOptions(command) {
   const options = command.options ?? [];
@@ -13963,17 +14276,17 @@ function isUndocumented(command) {
 function extractCommand(command, parentPath, depth) {
   const internals = command;
   const name = internals._name ?? "";
-  const path41 = parentPath ? `${parentPath} ${name}` : name;
+  const path42 = parentPath ? `${parentPath} ${name}` : name;
   return {
-    path: path41,
+    path: path42,
     name,
     aliases: [...internals._aliases ?? []],
     description: internals._description ?? "",
     args: extractArgs(command),
     options: extractOptions(command),
-    slug: slugifyCommandPath(path41),
+    slug: slugifyCommandPath(path42),
     depth,
-    subcommands: (internals.commands ?? []).filter((child) => !isUndocumented(child)).map((child) => extractCommand(child, path41, depth + 1))
+    subcommands: (internals.commands ?? []).filter((child) => !isUndocumented(child)).map((child) => extractCommand(child, path42, depth + 1))
   };
 }
 function extractCliReference(program2) {
@@ -14069,7 +14382,7 @@ import {
   mkdirSync as mkdirSync16,
   mkdtempSync as mkdtempSync3,
   readFileSync as readFileSync24,
-  writeFileSync as writeFileSync16
+  writeFileSync as writeFileSync17
 } from "node:fs";
 import { tmpdir as tmpdir6 } from "node:os";
 import path28 from "node:path";
@@ -14085,13 +14398,13 @@ function runAssemble(args) {
   const errors = [...discovery.errors];
   if (args.writeFiles !== false) {
     const manifestPath = args.outDir.includes(tmpdir6()) ? path28.join(args.outDir, PUBLISH_MANIFEST) : path28.join(args.outDir, "..", PUBLISH_MANIFEST);
-    writeFileSync16(
+    writeFileSync17(
       manifestPath,
       `${JSON.stringify(assembled.publishManifest, null, 2)}
 `
     );
     if (args.configOut) {
-      writeFileSync16(
+      writeFileSync17(
         args.configOut,
         renderZudokuConfig({
           navigation: assembled.navigation,
@@ -14106,7 +14419,7 @@ function runAssemble(args) {
         VERSION_JSON_DIR
       );
       mkdirSync16(versionDir, { recursive: true });
-      writeFileSync16(
+      writeFileSync17(
         path28.join(versionDir, VERSION_JSON),
         renderVersionJson({
           baseline: currentBaseline(args.repoRoot),
@@ -14161,7 +14474,7 @@ async function checkPortal(args) {
   }
   if (args.manifestOut) {
     mkdirSync16(path28.dirname(args.manifestOut), { recursive: true });
-    writeFileSync16(
+    writeFileSync17(
       args.manifestOut,
       `${JSON.stringify(result.assembled.publishManifest, null, 2)}
 `
@@ -14201,14 +14514,14 @@ ${summary}`);
 function runZudoku(args) {
   const cliArgs = args.mode === "dev" ? ["dev", "--port", String(args.port ?? 3e3)] : ["build"];
   logInfo(`Running \`zudoku ${cliArgs.join(" ")}\` in ${args.appDir}`);
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve16, reject) => {
     const child = spawn7("pnpm", ["exec", "zudoku", ...cliArgs], {
       cwd: args.appDir,
       stdio: "inherit",
       env: process.env
     });
     child.on("error", reject);
-    child.on("close", (code) => resolve15(code ?? 1));
+    child.on("close", (code) => resolve16(code ?? 1));
   });
 }
 async function runPortalCommand(opts, deps) {
@@ -14419,17 +14732,17 @@ async function serveDocsSite(args) {
       res.writeHead(500).end("internal error");
     });
   });
-  await new Promise((resolve15, reject) => {
+  await new Promise((resolve16, reject) => {
     server.once("error", reject);
-    server.listen(args.port, "127.0.0.1", () => resolve15());
+    server.listen(args.port, "127.0.0.1", () => resolve16());
   });
   const address = server.address();
   const port = typeof address === "object" && address ? address.port : args.port;
   return {
     url: `http://127.0.0.1:${port}`,
     port,
-    close: () => new Promise((resolve15, reject) => {
-      server.close((error) => error ? reject(error) : resolve15());
+    close: () => new Promise((resolve16, reject) => {
+      server.close((error) => error ? reject(error) : resolve16());
     })
   };
 }
@@ -14461,7 +14774,7 @@ var init_serve = __esm({
 
 // libs/mesh-cli/src/docs/registry-docs.ts
 import { execFileSync as execFileSync22 } from "node:child_process";
-import { existsSync as existsSync23, mkdirSync as mkdirSync17, readFileSync as readFileSync26, renameSync as renameSync3, rmSync as rmSync6, writeFileSync as writeFileSync17 } from "node:fs";
+import { existsSync as existsSync23, mkdirSync as mkdirSync17, readFileSync as readFileSync26, renameSync as renameSync3, rmSync as rmSync6, writeFileSync as writeFileSync18 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
 import path30 from "node:path";
 function readDocsRegistryAuth(npmrcPath2 = homeNpmrcPath()) {
@@ -14547,7 +14860,7 @@ async function fetchDocsArtifact(auth, version, cacheRoot = docsCacheRoot(), fet
   }
   mkdirSync17(cacheRoot, { recursive: true });
   const tgzPath = path30.join(cacheRoot, `.${version}.tgz`);
-  writeFileSync17(tgzPath, Buffer.from(await tgzResponse.arrayBuffer()));
+  writeFileSync18(tgzPath, Buffer.from(await tgzResponse.arrayBuffer()));
   const staging = path30.join(cacheRoot, `.staging-${version}`);
   rmSync6(staging, { recursive: true, force: true });
   mkdirSync17(staging, { recursive: true });
@@ -14591,7 +14904,7 @@ __export(start_exports, {
   tmuxServeArgs: () => tmuxServeArgs
 });
 import { execFileSync as execFileSync23 } from "node:child_process";
-import { appendFileSync as appendFileSync2, existsSync as existsSync24, writeFileSync as writeFileSync18 } from "node:fs";
+import { appendFileSync as appendFileSync2, existsSync as existsSync24, writeFileSync as writeFileSync19 } from "node:fs";
 import path31 from "node:path";
 function registryAuthOrThrow() {
   const auth = readDocsRegistryAuth();
@@ -14682,7 +14995,7 @@ Or run in the foreground instead: mesh docs start --foreground`
     } catch (error) {
       lastError = error instanceof Error ? error.message : String(error);
     }
-    await new Promise((resolve15) => setTimeout(resolve15, 500));
+    await new Promise((resolve16) => setTimeout(resolve16, 500));
   }
   throw new Error(
     `the docs server did not answer at ${url} within 60s (${lastError || "no response"}).
@@ -14719,8 +15032,8 @@ async function runDocsServeStatic(args) {
   }
   const server = await serveDocsSite({ root: args.root, port: requestedPort });
   logSuccess(`Mesh docs serving at ${server.url} (from ${args.root})`);
-  await new Promise((resolve15) => {
-    const stop = () => void server.close().finally(() => resolve15());
+  await new Promise((resolve16) => {
+    const stop = () => void server.close().finally(() => resolve16());
     process.once("SIGINT", stop);
     process.once("SIGTERM", stop);
   });
@@ -14774,8 +15087,8 @@ async function runDocsStart(args) {
         stdio: "inherit",
         env: process.env
       });
-      await new Promise((resolve15) => {
-        child.on("close", () => resolve15());
+      await new Promise((resolve16) => {
+        child.on("close", () => resolve16());
         process.once("SIGINT", () => child.kill("SIGINT"));
         process.once("SIGTERM", () => child.kill("SIGTERM"));
       });
@@ -14790,8 +15103,8 @@ async function runDocsStart(args) {
     });
     reportAssembly(result);
     const { spawn: spawn10 } = await import("node:child_process");
-    writeFileSync18(buildLog, "");
-    const code = await new Promise((resolve15) => {
+    writeFileSync19(buildLog, "");
+    const code = await new Promise((resolve16) => {
       const child = spawn10("pnpm", ["exec", "zudoku", "build"], {
         cwd: appDir,
         stdio: ["ignore", "pipe", "pipe"],
@@ -14799,8 +15112,8 @@ async function runDocsStart(args) {
       });
       child.stdout?.on("data", (chunk) => appendFileSync2(buildLog, chunk));
       child.stderr?.on("data", (chunk) => appendFileSync2(buildLog, chunk));
-      child.on("error", () => resolve15(1));
-      child.on("close", (exitCode) => resolve15(exitCode ?? 1));
+      child.on("error", () => resolve16(1));
+      child.on("close", (exitCode) => resolve16(exitCode ?? 1));
     });
     if (code !== 0) throw new Error(`zudoku build exited with code ${code} \u2014 see ${buildLog}`);
     serveRoot = path31.join(appDir, "dist");
@@ -14820,9 +15133,9 @@ async function runDocsStart(args) {
   const server = await serveDocsSite({ root: serveRoot, port: requestedPort });
   logSuccess(`Mesh docs (${label}) serving at ${server.url}`);
   logInfo("Press Ctrl-C to stop");
-  await new Promise((resolve15) => {
+  await new Promise((resolve16) => {
     const stop = () => {
-      void server.close().finally(() => resolve15());
+      void server.close().finally(() => resolve16());
     };
     process.once("SIGINT", stop);
     process.once("SIGTERM", stop);
@@ -15174,10 +15487,10 @@ function assembleHubEnv(session, sessionEnv, opts) {
       { remediation: { command: "mesh dev --kill && mesh dev  # relaunch to refresh session state" } }
     );
   }
-  if (platform.tenant === "local") {
-    throw new MeshCliError(
-      "This session runs on the full-local platform (`mesh start`) \u2014 use its containerized Hub instead of `mesh hub dev`.",
-      { remediation: { command: "mesh start --with-hub  # MESH_HUB_PORT=<port> publishes it off 9000" } }
+  const isLocalPlatform = platform.tenant === "local";
+  if (isLocalPlatform) {
+    notes.push(
+      "Local platform session \u2014 the Hub runs from this checkout against `mesh start`. Its containerized Hub keeps :9000, so pass --port/--api-port to run both."
     );
   }
   const hubTenant = platform.name ?? "mesh";
@@ -15205,7 +15518,11 @@ function assembleHubEnv(session, sessionEnv, opts) {
       "Dev session predates the per-session token-server (MESH-2039) \u2014 starting a dedicated one so tokens stay fresh past ~1h."
     );
   }
-  const temporalAddress = sessionEnv.TEMPORAL_ADDRESS ?? (session.state.devOutput.tunnels["temporal"] ? tunnelClientAddress(session.state.devOutput.tunnels["temporal"]) : void 0);
+  const temporalAddress = sessionEnv.TEMPORAL_ADDRESS ?? (session.state.devOutput.tunnels["temporal"] ? tunnelClientAddress(session.state.devOutput.tunnels["temporal"]) : (
+    // The local platform runs Temporal as a published container, so there is
+    // no tunnel to record and none to demand — the address is fixed.
+    isLocalPlatform ? "localhost:7233" : void 0
+  ));
   if (!temporalAddress) {
     throw new MeshCliError(
       `Dev session '${session.name}' exposes no Temporal tunnel \u2014 the Hub can't reach the stack's Temporal.`,
@@ -15218,7 +15535,8 @@ function assembleHubEnv(session, sessionEnv, opts) {
     TEMPORAL_ADDRESS: temporalAddress,
     HUB_TENANT: hubTenant,
     HUB_SCOPE_ENV: scopeEnv,
-    HUB_SCOPE_TENANTS: scopeTenants.join(",")
+    HUB_SCOPE_TENANTS: scopeTenants.join(","),
+    ...isLocalPlatform ? localPlatformEnv2(sessionEnv) : {}
   };
   const uiEnv = {
     ...forwarded,
@@ -15267,24 +15585,24 @@ function resolvePlatformDir(explicit, cwd, env = process.env) {
   );
 }
 async function findFreePort4() {
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve16, reject) => {
     const server = net12.createServer();
     server.listen(0, "127.0.0.1", () => {
       const address = server.address();
       server.close(
-        () => typeof address === "object" && address ? resolve15(address.port) : reject(new Error("no port"))
+        () => typeof address === "object" && address ? resolve16(address.port) : reject(new Error("no port"))
       );
     });
     server.on("error", reject);
   });
 }
 function isPortListening2(port) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const socket = net12.connect({ host: "127.0.0.1", port, timeout: 400 });
     const done = (ok) => {
       socket.removeAllListeners();
       socket.destroy();
-      resolve15(ok);
+      resolve16(ok);
     };
     socket.once("connect", () => done(true));
     socket.once("timeout", () => done(false));
@@ -15405,7 +15723,7 @@ async function hubDevAction(opts) {
     execFileSync24("tmux", ["send-keys", "-t", `${HUB_SESSION}:${window}`, buildLaunchCommand(envFile, dir, cmd), "Enter"]);
   };
   launch("api", apiDir, assembled.apiEnv, "pnpm dev", false);
-  launch("ui", uiDir, assembled.uiEnv, `pnpm dev -- --port ${uiPort} --strictPort`, true);
+  launch("ui", uiDir, assembled.uiEnv, `pnpm dev --port ${uiPort} --strictPort`, true);
   logInfo("Waiting for the Hub to come up\u2026");
   const apiUp = await waitForPort("127.0.0.1", apiPort, 9e4);
   const uiUp = apiUp && await waitForPort("127.0.0.1", uiPort, 9e4);
@@ -15428,7 +15746,7 @@ function registerHubCommands(program2) {
     "Launch the current-code Hub (api + ui) against a running `mesh dev` session \u2014 env auto-assembled, zero hand-set vars"
   ).option("--session <name>", "dev session to observe (default: auto-detect from cwd)").option("--tenants <list>", "comma-separated HUB_SCOPE_TENANTS override (default: the session's tenant)").option("--port <port>", `Hub UI host port (default: $MESH_HUB_DEV_PORT or ${DEFAULT_HUB_UI_PORT})`).option("--api-port <port>", `Hub API port (default: ${DEFAULT_HUB_API_PORT})`).option("--platform-dir <dir>", "mesh-platform checkout to run the Hub from (default: $MESH_PLATFORM_DIR or walk up from cwd)").option("--print-env", "print the assembled env (secrets redacted) and exit without launching").option("--kill", "tear down the running Hub session").action(hubDevAction);
 }
-var HUB_SESSION, DEFAULT_HUB_UI_PORT, DEFAULT_HUB_API_PORT, FORWARD_PREFIXES, SENSITIVE_RE;
+var HUB_SESSION, DEFAULT_HUB_UI_PORT, DEFAULT_HUB_API_PORT, FORWARD_PREFIXES, localPlatformEnv2, SENSITIVE_RE;
 var init_hub = __esm({
   "libs/mesh-cli/src/commands/hub/index.ts"() {
     "use strict";
@@ -15442,6 +15760,35 @@ var init_hub = __esm({
     DEFAULT_HUB_UI_PORT = Number(DEFAULT_HUB_PORT);
     DEFAULT_HUB_API_PORT = 3002;
     FORWARD_PREFIXES = ["AWS_", "DEV_USER_"];
+    localPlatformEnv2 = (sessionEnv) => ({
+      // The issuer the local `mesh login` tokens carry. Zitadel routes by Host
+      // header, so the host must stay `localhost` on both sides of the call.
+      ZITADEL_ISSUER: sessionEnv.ZITADEL_ISSUER ?? "http://localhost:8080",
+      // Postgres publishes on 5433; the Hub's ops schema lives in the `hub` database
+      // alongside the per-app ones.
+      OPS_DB_HOST: "localhost",
+      OPS_DB_PORT: "5433",
+      OPS_DB_NAME: "hub",
+      OPS_DB_USER: "postgres",
+      DATABASE_PASSWORD: "postgres",
+      PGSSLMODE: "disable",
+      DATABASE_URL: "postgres://postgres:postgres@localhost:5433/hub?sslmode=disable",
+      // The Hub's ADMIN plane. `mesh start` seeds the machine key this names, in the
+      // platform org with IAM_OWNER, so the Hub can administer each app tenant's own
+      // Zitadel org rather than only its own.
+      ZITADEL_OPSHUB_SECRET_NAME: "mesh/local/dev/zitadel/ops-hub",
+      SPICEDB_ENDPOINT: "localhost:50051",
+      SPICEDB_HTTP_ENDPOINT: "http://localhost:8443",
+      SPICEDB_HTTP_SCHEME: "http",
+      SPICEDB_PRESHARED_KEY: "local-dev-key",
+      LOKI_URL: "http://localhost:3100",
+      TEMPO_URL: "http://localhost:3200",
+      PROMETHEUS_URL: "http://localhost:9090",
+      TEMPORAL_UI_URL: "http://localhost:8233",
+      // The stack's namespace. Absent, the Hub's compliance schedules fail to
+      // register with "Temporal namespace is required".
+      TEMPORAL_NAMESPACE: "local-dev"
+    });
     SENSITIVE_RE = /TOKEN|SECRET|KEY|PASSWORD/i;
   }
 });
@@ -16042,6 +16389,103 @@ async function ensureHubImages() {
   }
   return version;
 }
+function readWorkspaceCatalog(repoRoot2) {
+  const text = fs29.readFileSync(path36.join(repoRoot2, "pnpm-workspace.yaml"), "utf-8");
+  const marker = "\ncatalog:\n";
+  const at = text.indexOf(marker);
+  if (at === -1) return {};
+  const catalog = {};
+  for (const line of text.slice(at + marker.length).split("\n")) {
+    if (line.trim() !== "" && !/^\s/.test(line)) break;
+    const m = /^\s+"?([^":\s]+)"?:\s*"?([^"\s#]+)"?/.exec(line);
+    if (m) catalog[m[1]] = m[2];
+  }
+  return catalog;
+}
+function normalizeHubManifests(contextDir, catalog) {
+  const DEP_FIELDS = ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"];
+  const touched = [];
+  for (const entry of fs29.readdirSync(contextDir, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const manifest = path36.join(contextDir, entry.name, "package.json");
+    if (!fs29.existsSync(manifest)) continue;
+    const pkg = JSON.parse(fs29.readFileSync(manifest, "utf-8"));
+    let changed = false;
+    for (const field of DEP_FIELDS) {
+      const deps = pkg[field];
+      if (!deps) continue;
+      for (const [name, spec] of Object.entries(deps)) {
+        if (typeof spec !== "string") continue;
+        if (spec.startsWith("workspace:")) {
+          delete deps[name];
+          changed = true;
+        } else if (spec.startsWith("catalog:")) {
+          const key = spec.slice("catalog:".length) || name;
+          const range = catalog[name] ?? catalog[key];
+          if (!range) {
+            throw new MeshCliError(
+              `${entry.name}/package.json depends on "${name}": "${spec}", which the workspace catalog does not define.`,
+              { remediation: { command: "Add the dependency to the `catalog:` block in pnpm-workspace.yaml" } }
+            );
+          }
+          deps[name] = range;
+          changed = true;
+        }
+      }
+    }
+    if (changed) {
+      fs29.writeFileSync(manifest, `${JSON.stringify(pkg, null, 2)}
+`);
+      touched.push(`${entry.name}/package.json`);
+    }
+  }
+  return touched;
+}
+async function buildHubImagesFromSource(repoRoot2) {
+  const hubDir = path36.join(repoRoot2, "apps", "hub");
+  if (!fs29.existsSync(path36.join(hubDir, "package.json"))) {
+    throw new MeshCliError(
+      `--hub-from-source needs a mesh-platform checkout; no apps/hub under ${repoRoot2}.`,
+      { remediation: { command: "Run mesh start from a mesh-platform checkout, or drop --hub-from-source" } }
+    );
+  }
+  const npmrc = npmrcPath();
+  const version = `${JSON.parse(fs29.readFileSync(path36.join(hubDir, "package.json"), "utf-8")).version}-src`;
+  const build = startHeartbeat("building apps/hub (api + ui) from source");
+  try {
+    for (const pkg of ["@mesh-tech/hub-api", "@mesh-tech/hub-ui"]) {
+      await execFileAsync2("pnpm", ["--filter", pkg, "build"], { cwd: repoRoot2, maxBuffer: 64 * 1024 * 1024 });
+    }
+  } finally {
+    build.stop();
+  }
+  const context = path36.join(cacheDir(), `context-${version}`);
+  fs29.rmSync(context, { recursive: true, force: true });
+  fs29.mkdirSync(context, { recursive: true });
+  await execFileAsync2("pnpm", ["pack", "--pack-destination", context], { cwd: hubDir, maxBuffer: 64 * 1024 * 1024 });
+  const tarball = fs29.readdirSync(context).find((f) => f.endsWith(".tgz"));
+  if (!tarball) throw new MeshCliError("pnpm pack produced no tarball for apps/hub");
+  execFileSync26("tar", ["-xzf", path36.join(context, tarball), "-C", context, "--strip-components", "1"], {
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  const rewritten = normalizeHubManifests(context, readWorkspaceCatalog(repoRoot2));
+  if (rewritten.length > 0) logInfo(`Normalized ${rewritten.length} manifest(s) for npm: ${rewritten.join(", ")}`);
+  const hubStackDir = path36.join(findPackageRoot(), "stack", "hub");
+  for (const [name, dockerfile] of [
+    ["mesh-local-hub-api", "Dockerfile.api"],
+    ["mesh-local-hub-ui", "Dockerfile.ui"]
+  ]) {
+    const tag = `${name}:${version}`;
+    logInfo(`Building ${tag} from source\u2026`);
+    execFileSync26(
+      "docker",
+      ["build", "-f", path36.join(hubStackDir, dockerfile), "-t", tag, "--secret", `id=npmrc,src=${npmrc}`, context],
+      { stdio: ["ignore", "inherit", "inherit"], env: { ...process.env, DOCKER_BUILDKIT: "1" } }
+    );
+    logSuccess(`Built ${tag}`);
+  }
+  return version;
+}
 var execFileAsync2, HUB_PACKAGE, HUB_IMAGES, LOCAL_IMAGE_REV, HUB_AUTH_IMAGE;
 var init_hub_local = __esm({
   "libs/mesh-cli/src/commands/local/hub-local.ts"() {
@@ -16059,6 +16503,8 @@ var init_hub_local = __esm({
 });
 
 // libs/mesh-cli/src/commands/local/index.ts
+import * as fs30 from "fs";
+import * as path37 from "path";
 import chalk5 from "chalk";
 function crashError(crashed) {
   return new MeshCliError(
@@ -16101,7 +16547,7 @@ async function waitForStack(io = {
       );
     }
     logInfo(`Waiting for ${pending.map((e) => e.label).join(", ")} \u2026`);
-    await new Promise((resolve15) => setTimeout(resolve15, WAIT_POLL_MS));
+    await new Promise((resolve16) => setTimeout(resolve16, WAIT_POLL_MS));
   }
 }
 function printEndpoints(hubRunning) {
@@ -16144,10 +16590,22 @@ function printEndpoints(hubRunning) {
   console.log("");
   logInfo("Next: `mesh dev` in an apps repo wires services to this stack automatically.");
 }
+function repoRootForHubSource() {
+  for (let dir = process.cwd(); ; ) {
+    if (fs30.existsSync(path37.join(dir, "apps", "hub", "package.json"))) return dir;
+    const parent = path37.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return path37.resolve(findPackageRoot(), "..", "..");
+}
 function registerLocalCommands(program2) {
   program2.command("start").description("Start the full-local Mesh platform (Docker only \u2014 no AWS, no VPN)").option("--no-seed", "skip first-boot seeding (tenant registry, artifacts bucket)").option("--no-hub", "start without the Hub (API + UI)").option(
     "--with-hub",
     "force-refresh the Hub to the latest published @mesh-tech/hub (the Hub is included by default when its images exist or registry auth is available)"
+  ).option(
+    "--hub-from-source",
+    "build the Hub images from THIS checkout's apps/hub instead of the published tarball (the only way to exercise a Hub change locally)"
   ).option(
     "--takeover",
     "re-own a stack that another checkout started (may recreate shared containers with THIS checkout's config)",
@@ -16172,7 +16630,9 @@ Re-running start from here may recreate shared containers with this checkout's c
     }
     let hubVersion;
     if (opts.hub) {
-      if (opts.withHub) {
+      if (opts.hubFromSource) {
+        hubVersion = await buildHubImagesFromSource(repoRootForHubSource());
+      } else if (opts.withHub) {
         const probe = await probeRegistryToken();
         const plan = planWithHubRefresh(probe.state, localHubVersion());
         if (plan.action === "fail") {
@@ -16260,7 +16720,7 @@ Re-running start from here may recreate shared containers with this checkout's c
             overlayStarted: true
           });
           if (crashed.length > 0) throw crashError(crashed);
-          await new Promise((resolve15) => setTimeout(resolve15, 2e3));
+          await new Promise((resolve16) => setTimeout(resolve16, 2e3));
           up = await probeEndpoint(endpoint);
         }
         if (!up) {
@@ -17323,22 +17783,22 @@ var init_secrets = __esm({
 
 // libs/mesh-cli/src/commands/stack.ts
 import { execFileSync as execFileSync27 } from "child_process";
-import * as path37 from "path";
-import * as fs30 from "fs";
+import * as path38 from "path";
+import * as fs31 from "fs";
 import { parse as parseYaml5 } from "yaml";
 function readTopLevelYamlKey(appRoot, stack, key) {
-  const configFile = path37.join(appRoot, `Pulumi.${stack}.yaml`);
-  if (!fs30.existsSync(configFile)) return null;
-  const content = fs30.readFileSync(configFile, "utf-8");
+  const configFile = path38.join(appRoot, `Pulumi.${stack}.yaml`);
+  if (!fs31.existsSync(configFile)) return null;
+  const content = fs31.readFileSync(configFile, "utf-8");
   const pattern = new RegExp(`^${key}:\\s*(.+)$`, "m");
   const match = content.match(pattern);
   if (!match) return null;
   return match[1].trim().replace(/^["']|["']$/g, "");
 }
 function readConfigBlockKey(appRoot, stack, key) {
-  const configFile = path37.join(appRoot, `Pulumi.${stack}.yaml`);
-  if (!fs30.existsSync(configFile)) return null;
-  const content = fs30.readFileSync(configFile, "utf-8");
+  const configFile = path38.join(appRoot, `Pulumi.${stack}.yaml`);
+  if (!fs31.existsSync(configFile)) return null;
+  const content = fs31.readFileSync(configFile, "utf-8");
   const pattern = new RegExp(`^\\s{2}${key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}:\\s*(.+)$`, "m");
   const match = content.match(pattern);
   if (!match) return null;
@@ -17398,11 +17858,11 @@ ${records}
   }
 }
 function readBaseConfigFromYaml(appRoot, stack) {
-  const file = path37.join(appRoot, `Pulumi.${stack}.yaml`);
-  if (!fs30.existsSync(file)) return {};
+  const file = path38.join(appRoot, `Pulumi.${stack}.yaml`);
+  if (!fs31.existsSync(file)) return {};
   let doc;
   try {
-    doc = parseYaml5(fs30.readFileSync(file, "utf-8"));
+    doc = parseYaml5(fs31.readFileSync(file, "utf-8"));
   } catch {
     return {};
   }
@@ -17479,7 +17939,7 @@ Specify which to base on: mesh stack init --from <stack>`
       }
     }
     const baseConfigPath = `${appRoot}/Pulumi.${baseStack}.yaml`;
-    if (!fs30.existsSync(baseConfigPath)) {
+    if (!fs31.existsSync(baseConfigPath)) {
       logError(`Stack config not found: Pulumi.${baseStack}.yaml`);
       process.exit(1);
     }
@@ -17501,8 +17961,8 @@ Specify which to base on: mesh stack init --from <stack>`
         );
       }
     }
-    const newConfigPath = path37.join(appRoot, `Pulumi.${newStack}.yaml`);
-    const configExists = fs30.existsSync(newConfigPath);
+    const newConfigPath = path38.join(appRoot, `Pulumi.${newStack}.yaml`);
+    const configExists = fs31.existsSync(newConfigPath);
     const secretsProvider = readTopLevelYamlKey(appRoot, baseStack, "secretsprovider");
     const credEnv = await resolvePulumiEnv({ appRoot, stack: baseStack });
     const pulumiEnv = { ...process.env, ...credEnv };
@@ -18149,9 +18609,9 @@ var init_capture_history = __esm({
 
 // libs/mesh-cli/src/commands/temporal.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { writeFileSync as writeFileSync21, mkdirSync as mkdirSync22 } from "node:fs";
+import { writeFileSync as writeFileSync23, mkdirSync as mkdirSync22 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
-import { dirname as dirname26, join as join34, resolve as resolve13 } from "node:path";
+import { dirname as dirname27, join as join35, resolve as resolve14 } from "node:path";
 async function resolveConnection(options) {
   if (options.address && options.namespace) {
     return { address: options.address, namespace: options.namespace };
@@ -18521,7 +18981,7 @@ async function recoverConversation(workflowId, runId, options) {
       };
       const output2 = JSON.stringify(blob, null, 2) + "\n";
       if (options.out) {
-        writeFileSync21(options.out, output2);
+        writeFileSync23(options.out, output2);
         logSuccess(
           `Wrote snapshot (${messages.length} messages) to ${options.out}`
         );
@@ -18544,7 +19004,7 @@ async function recoverConversation(workflowId, runId, options) {
       2
     ) + "\n" : renderTranscriptMarkdown(turns);
     if (options.out) {
-      writeFileSync21(options.out, output);
+      writeFileSync23(options.out, output);
       logSuccess(`Wrote ${turns.length} turns to ${options.out}`);
     } else {
       process.stdout.write(output);
@@ -18579,10 +19039,10 @@ async function captureHistory(workflowId, runId, options) {
     }
     const { serializeHistoryToFixture: serializeHistoryToFixture2 } = await Promise.resolve().then(() => (init_capture_history(), capture_history_exports));
     const { fixture, eventCount, decryptedPayloads } = await serializeHistoryToFixture2(events, decrypter);
-    const outPath = options.out ?? join34(homedir9(), ".mesh", "replay-histories", `${sanitizeFileId(workflowId)}.json`);
-    mkdirSync22(dirname26(outPath), { recursive: true });
+    const outPath = options.out ?? join35(homedir9(), ".mesh", "replay-histories", `${sanitizeFileId(workflowId)}.json`);
+    mkdirSync22(dirname27(outPath), { recursive: true });
     if (options.out) warnIfNotGitIgnored(options.out);
-    writeFileSync21(outPath, JSON.stringify(fixture, null, 2) + "\n");
+    writeFileSync23(outPath, JSON.stringify(fixture, null, 2) + "\n");
     logSuccess(
       `Wrote replay history (${eventCount} events, ${decryptedPayloads} payloads decrypted) to ${outPath}`
     );
@@ -18597,9 +19057,9 @@ function sanitizeFileId(id) {
   return id.replace(/[^A-Za-z0-9._-]/g, "_");
 }
 function warnIfNotGitIgnored(outPath) {
-  const abs = resolve13(outPath);
+  const abs = resolve14(outPath);
   try {
-    const res = spawnSync4("git", ["-C", dirname26(abs), "check-ignore", "-q", abs], {
+    const res = spawnSync4("git", ["-C", dirname27(abs), "check-ignore", "-q", abs], {
       stdio: "ignore"
     });
     if (res.status !== 1) return;
@@ -18767,8 +19227,8 @@ var init_temporal = __esm({
 
 // libs/mesh-cli/src/commands/tenant.ts
 import chalk6 from "chalk";
-import * as fs31 from "fs";
-import * as path38 from "path";
+import * as fs32 from "fs";
+import * as path39 from "path";
 import { parseDocument, YAMLMap, isMap } from "yaml";
 function validateTenantName(name) {
   return /^[a-z][a-z0-9-]*$/.test(name) && !name.endsWith("-");
@@ -18836,16 +19296,16 @@ function resolveStackConfig(explicitStack) {
       { remediation: { command: "mesh tenant add <name> --stack <stack>" } }
     );
   }
-  const file = path38.join(appRoot, `Pulumi.${stack}.yaml`);
-  if (!fs31.existsSync(file)) {
+  const file = path39.join(appRoot, `Pulumi.${stack}.yaml`);
+  if (!fs32.existsSync(file)) {
     throw new MeshCliError(`Stack config not found: ${file}`, {
       remediation: { command: "mesh tenant add <name> --stack <stack>" }
     });
   }
-  return { appRoot, stack, file, content: fs31.readFileSync(file, "utf-8") };
+  return { appRoot, stack, file, content: fs32.readFileSync(file, "utf-8") };
 }
 function readProjectName(appRoot) {
-  const projectDoc = parseDocument(fs31.readFileSync(path38.join(appRoot, "Pulumi.yaml"), "utf-8"));
+  const projectDoc = parseDocument(fs32.readFileSync(path39.join(appRoot, "Pulumi.yaml"), "utf-8"));
   return String(projectDoc.get("name") ?? "");
 }
 function looksLikePlatformLayer(projectName) {
@@ -18888,12 +19348,12 @@ function registerTenantCommands(program2) {
       if (!result.ok) {
         if (result.reason === "exists") {
           throw new MeshCliError(
-            `${result.detail} (${path38.basename(resolved.file)}). Edit the existing entry instead of re-adding it.`
+            `${result.detail} (${path39.basename(resolved.file)}). Edit the existing entry instead of re-adding it.`
           );
         }
         throw new MeshCliError(`${resolved.file}: ${result.detail}`);
       }
-      atomicWriteFileSync(resolved.file, result.yaml, fs31.statSync(resolved.file).mode & 511);
+      atomicWriteFileSync(resolved.file, result.yaml, fs32.statSync(resolved.file).mode & 511);
       if (opts.json) {
         emitJsonPayload({
           ok: true,
@@ -18906,7 +19366,7 @@ function registerTenantCommands(program2) {
         return;
       }
       logInfo(
-        `Tenant '${name}' registered in ${path38.basename(resolved.file)} (mesh:tenants, subdomain '${subdomain}')${result.createdTenantsBlock ? " \u2014 created the mesh:tenants block" : ""}`
+        `Tenant '${name}' registered in ${path39.basename(resolved.file)} (mesh:tenants, subdomain '${subdomain}')${result.createdTenantsBlock ? " \u2014 created the mesh:tenants block" : ""}`
       );
       console.log("");
       console.log("Next steps:");
@@ -18932,7 +19392,7 @@ function registerTenantCommands(program2) {
           `Project '${projectName}' does not look like a platform layer \u2014 tenants are declared on the tenant platform repo's PLATFORM stack (e.g. mesh-sandbox/platform).`
         );
       }
-      logInfo(`No tenants declared in ${path38.basename(resolved.file)}.`);
+      logInfo(`No tenants declared in ${path39.basename(resolved.file)}.`);
       return;
     }
     logInfo(`Tenants on stack '${resolved.stack}':`);
@@ -18954,9 +19414,9 @@ var init_tenant = __esm({
 
 // libs/mesh-cli/src/commands/tunnel/index.ts
 import { spawn as spawn9 } from "child_process";
-import * as fs32 from "fs";
+import * as fs33 from "fs";
 import * as os13 from "os";
-import * as path39 from "path";
+import * as path40 from "path";
 import {
   SecretsManagerClient as SecretsManagerClient8,
   GetSecretValueCommand as GetSecretValueCommand8
@@ -18976,9 +19436,9 @@ function readPulumiAwsRegion(stage) {
   const preferred = stage ? `Pulumi.${stage}.yaml` : void 0;
   const rank = (f) => f === preferred ? 0 : f === "Pulumi.yaml" ? 2 : 1;
   try {
-    const files = fs32.readdirSync(".").filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml")).sort((a, b) => rank(a) - rank(b));
+    const files = fs33.readdirSync(".").filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml")).sort((a, b) => rank(a) - rank(b));
     for (const f of files) {
-      const m = fs32.readFileSync(f, "utf-8").match(/^\s*aws:region:\s*["']?([^"'\n]+)["']?/m);
+      const m = fs33.readFileSync(f, "utf-8").match(/^\s*aws:region:\s*["']?([^"'\n]+)["']?/m);
       if (m?.[1]) return m[1].trim();
     }
   } catch {
@@ -18987,14 +19447,14 @@ function readPulumiAwsRegion(stage) {
 }
 function awsProfileSections(name) {
   return [
-    [path39.join(os13.homedir(), ".aws", "config"), `[profile ${name}]`],
-    [path39.join(os13.homedir(), ".aws", "credentials"), `[${name}]`]
+    [path40.join(os13.homedir(), ".aws", "config"), `[profile ${name}]`],
+    [path40.join(os13.homedir(), ".aws", "credentials"), `[${name}]`]
   ];
 }
 function awsProfileExists(name) {
   for (const [file, header] of awsProfileSections(name)) {
     try {
-      const lines = fs32.readFileSync(file, "utf-8").split("\n");
+      const lines = fs33.readFileSync(file, "utf-8").split("\n");
       if (lines.some((l) => l.trim() === header)) return true;
     } catch {
     }
@@ -19020,7 +19480,7 @@ function awsProfileRegion(profile) {
   if (!profile) return void 0;
   for (const [file, header] of awsProfileSections(profile)) {
     try {
-      const region = parseProfileRegion(fs32.readFileSync(file, "utf-8"), header);
+      const region = parseProfileRegion(fs33.readFileSync(file, "utf-8"), header);
       if (region) return region;
     } catch {
     }
@@ -19029,14 +19489,14 @@ function awsProfileRegion(profile) {
 }
 function awsDefaultProfileSections() {
   return [
-    [path39.join(os13.homedir(), ".aws", "config"), "[default]"],
-    [path39.join(os13.homedir(), ".aws", "credentials"), "[default]"]
+    [path40.join(os13.homedir(), ".aws", "config"), "[default]"],
+    [path40.join(os13.homedir(), ".aws", "credentials"), "[default]"]
   ];
 }
 function awsDefaultProfileRegion() {
   for (const [file, header] of awsDefaultProfileSections()) {
     try {
-      const region = parseProfileRegion(fs32.readFileSync(file, "utf-8"), header);
+      const region = parseProfileRegion(fs33.readFileSync(file, "utf-8"), header);
       if (region) return region;
     } catch {
     }
@@ -19177,9 +19637,9 @@ async function tunnelServices(serviceNames, options) {
   process.on("SIGTERM", cleanup);
   await Promise.race(
     processes.map(
-      (proc) => new Promise((resolve15) => {
-        proc.on("exit", () => resolve15());
-        proc.on("error", () => resolve15());
+      (proc) => new Promise((resolve16) => {
+        proc.on("exit", () => resolve16());
+        proc.on("error", () => resolve16());
       })
     )
   );
@@ -19276,9 +19736,9 @@ async function tunnelExternal(name, options) {
   };
   process.on("SIGINT", cleanup);
   process.on("SIGTERM", cleanup);
-  await new Promise((resolve15) => {
-    proc.on("exit", () => resolve15());
-    proc.on("error", () => resolve15());
+  await new Promise((resolve16) => {
+    proc.on("exit", () => resolve16());
+    proc.on("error", () => resolve16());
   });
   cleanup();
 }
@@ -19405,8 +19865,8 @@ async function resolveToken(opts) {
     "no token: pass --token, set VCS_TOKEN, or pass --context <platform-context> (after mesh login)"
   );
 }
-async function vcsApi(baseUrl, token, path41, method = "GET", body) {
-  const res = await fetch(`${baseUrl}${path41}`, {
+async function vcsApi(baseUrl, token, path42, method = "GET", body) {
+  const res = await fetch(`${baseUrl}${path42}`, {
     method,
     headers: {
       authorization: `Bearer ${token}`,
@@ -19417,7 +19877,7 @@ async function vcsApi(baseUrl, token, path41, method = "GET", body) {
   const data = await res.json().catch(() => ({}));
   if (!res.ok) {
     throw new Error(
-      `${method} ${path41} failed (${res.status}): ${String(data.error ?? "unknown error")}`
+      `${method} ${path42} failed (${res.status}): ${String(data.error ?? "unknown error")}`
     );
   }
   return data;
@@ -19460,8 +19920,8 @@ var init_clone = __esm({
 
 // libs/mesh-cli/src/commands/vcs/get.ts
 import { writeFile as writeFile2, mkdir as mkdir2 } from "node:fs/promises";
-import { join as join37, dirname as dirname27 } from "node:path";
-async function getCommand(repo, path41, opts) {
+import { join as join38, dirname as dirname28 } from "node:path";
+async function getCommand(repo, path42, opts) {
   let vcsBaseUrl;
   let token;
   if (opts.target) {
@@ -19476,18 +19936,18 @@ async function getCommand(repo, path41, opts) {
   if (!token) throw new Error("no token: pass --target (after mesh login), or --token / --context");
   const reader = createVcsFolderReader({ vcsBaseUrl, token });
   try {
-    const { ref, files } = await reader.readPath(repo, path41);
+    const { ref, files } = await reader.readPath(repo, path42);
     if (files.length === 0) {
-      logInfo(`no files at ${repo}:${path41}`);
+      logInfo(`no files at ${repo}:${path42}`);
       return;
     }
     if (opts.output) {
       for (const f of files) {
-        const abs = join37(opts.output, f.path);
-        await mkdir2(dirname27(abs), { recursive: true });
+        const abs = join38(opts.output, f.path);
+        await mkdir2(dirname28(abs), { recursive: true });
         await writeFile2(abs, f.contents);
       }
-      logInfo(`wrote ${files.length} file(s) from ${repo}:${path41} (${ref}) \u2192 ${opts.output}`);
+      logInfo(`wrote ${files.length} file(s) from ${repo}:${path42} (${ref}) \u2192 ${opts.output}`);
     } else {
       for (const f of files) {
         if (files.length > 1) process.stdout.write(`
@@ -19512,10 +19972,10 @@ var init_get = __esm({
 });
 
 // libs/mesh-cli/src/commands/vcs/drafts.ts
-async function call(opts, repo, path41, method = "GET", body) {
+async function call(opts, repo, path42, method = "GET", body) {
   const target = await resolveTarget2({ ...opts, repo });
   const token = await resolveToken(opts);
-  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path41}`, method, body);
+  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path42}`, method, body);
 }
 async function draftsListCommand(repo, opts) {
   const data = await call(opts, repo, `/drafts${opts.all ? "?all=true" : ""}`);
@@ -19570,7 +20030,7 @@ var init_drafts = __esm({
 
 // libs/mesh-cli/src/commands/vcs/propose.ts
 import { readFile as readFile2 } from "node:fs/promises";
-import { join as join38 } from "node:path";
+import { join as join39 } from "node:path";
 function parseStatus(out) {
   const tokens = out.split("\0");
   const changes = [];
@@ -19625,7 +20085,7 @@ async function proposeCommand(opts) {
       async (c) => c.status.startsWith("D") ? { op: "delete", path: c.path } : {
         op: "write",
         path: c.path,
-        content: await readFile2(join38(cwd, c.path), "utf8")
+        content: await readFile2(join39(cwd, c.path), "utf8")
       }
     )
   );
@@ -19649,8 +20109,8 @@ async function proposeCommand(opts) {
     operations,
     ...opts.mergeParent ? { mergeParent: opts.mergeParent } : {}
   };
-  const path41 = opts.revise ? `/v1/repos/${target.repo}/proposals/${opts.revise}/revisions` : `/v1/repos/${target.repo}/proposals`;
-  const data = await vcsApi(target.baseUrl, token, path41, "POST", body);
+  const path42 = opts.revise ? `/v1/repos/${target.repo}/proposals/${opts.revise}/revisions` : `/v1/repos/${target.repo}/proposals`;
+  const data = await vcsApi(target.baseUrl, token, path42, "POST", body);
   console.log(
     `proposal ${data.proposalId} @ ${data.sha.slice(0, 8)} \u2014 review: mesh vcs show ${target.repo} ${data.proposalId} --url ${target.baseUrl}`
   );
@@ -19663,10 +20123,10 @@ var init_propose = __esm({
 });
 
 // libs/mesh-cli/src/commands/vcs/review.ts
-async function call2(opts, repo, path41, method = "GET", body) {
+async function call2(opts, repo, path42, method = "GET", body) {
   const target = await resolveTarget2({ ...opts, repo });
   const token = await resolveToken(opts);
-  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path41}`, method, body);
+  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path42}`, method, body);
 }
 async function proposalsCommand(repo, opts) {
   console.log(JSON.stringify(await call2(opts, repo, "/proposals"), null, 2));
@@ -19807,8 +20267,8 @@ function computeHappyPath(nodes, edges) {
     const queue = [{ id: startNode.id, path: [startNode.id] }];
     const visited = /* @__PURE__ */ new Set([startNode.id]);
     while (queue.length > 0) {
-      const { id, path: path41 } = queue.shift();
-      if (targetIds.has(id)) return path41;
+      const { id, path: path42 } = queue.shift();
+      if (targetIds.has(id)) return path42;
       const neighbors = adjacency.get(id) ?? [];
       const hasMainEdge = neighbors.some((e) => e.isMainPath);
       const candidates = hasMainEdge ? neighbors.filter((e) => e.isMainPath) : neighbors;
@@ -19827,7 +20287,7 @@ function computeHappyPath(nodes, edges) {
         if (visited.has(neighbor.to)) continue;
         if (!allowExceptional && (neighbor.isExceptional || neighbor.isTimeout || failureEndIds.has(neighbor.to))) continue;
         visited.add(neighbor.to);
-        queue.push({ id: neighbor.to, path: [...path41, neighbor.to] });
+        queue.push({ id: neighbor.to, path: [...path42, neighbor.to] });
       }
     }
     return null;
@@ -20075,11 +20535,11 @@ function wrapIntoGroup(workflow, nodeIds, groupId, label, groupType) {
         }
       }
       if (found) {
-        const path41 = [];
-        for (let c = found; c !== void 0; c = prev.get(c)) path41.unshift(c);
-        for (let i = 0; i < path41.length - 1; i++) mainEdgeKeys.add(edgeKey(path41[i], path41[i + 1]));
+        const path42 = [];
+        for (let c = found; c !== void 0; c = prev.get(c)) path42.unshift(c);
+        for (let i = 0; i < path42.length - 1; i++) mainEdgeKeys.add(edgeKey(path42[i], path42[i + 1]));
         mainEdgeKeys.add(edgeKey(found, successExit.id));
-        mainBody = path41;
+        mainBody = path42;
         mainTail = [successExit.id];
       }
     }
@@ -20481,11 +20941,11 @@ var init_apply_preview_patch = __esm({
 
 // libs/workflow-model/src/process-artifact.ts
 import { z as z4 } from "zod";
-function formatPath(path41) {
-  return path41.length > 0 ? z4.core.toDotPath(path41) : "(root)";
+function formatPath(path42) {
+  return path42.length > 0 ? z4.core.toDotPath(path42) : "(root)";
 }
 function issueToDiagnostic(issue) {
-  const path41 = formatPath(issue.path);
+  const path42 = formatPath(issue.path);
   let code = "SCHEMA_INVALID";
   if (issue.code === "custom") {
     const paramCode = issue.params?.code;
@@ -20496,8 +20956,8 @@ function issueToDiagnostic(issue) {
   return {
     severity: "error",
     code,
-    message: `${path41}: ${issue.message}`,
-    path: path41
+    message: `${path42}: ${issue.message}`,
+    path: path42
   };
 }
 function parseProcessArtifact(json) {
@@ -20577,20 +21037,20 @@ var init_process_artifact = __esm({
         outcome: "DUPLICATE_OUTCOME_ID"
       };
       const idFirstSeenAt = /* @__PURE__ */ new Map();
-      const checkId = (id, kind, path41) => {
+      const checkId = (id, kind, path42) => {
         const first = idFirstSeenAt.get(id);
         if (first) {
           const kindLabel = kind === first.kind ? kind : "process";
           ctx.addIssue({
             code: "custom",
-            path: path41,
-            message: `Duplicate ${kindLabel} id "${id}": ${kind} at ${z4.core.toDotPath(path41)} collides with ${first.kind} at ${z4.core.toDotPath(first.path)}.`,
+            path: path42,
+            message: `Duplicate ${kindLabel} id "${id}": ${kind} at ${z4.core.toDotPath(path42)} collides with ${first.kind} at ${z4.core.toDotPath(first.path)}.`,
             params: {
               code: kind === first.kind ? SAME_KIND_CODE[kind] : "DUPLICATE_PROCESS_ID"
             }
           });
         } else {
-          idFirstSeenAt.set(id, { kind, path: path41 });
+          idFirstSeenAt.set(id, { kind, path: path42 });
         }
       };
       process2.stages.forEach((stage, stageIndex) => {
@@ -20628,13 +21088,13 @@ function lintProcess(artifact, inventory, predicateNames) {
   const internalCommands = process2.internalCommands ?? [];
   const internalSet = new Set(internalCommands);
   const boundCommandPaths = /* @__PURE__ */ new Map();
-  const checkPredicate = (predicate, path41) => {
+  const checkPredicate = (predicate, path42) => {
     if (!predicateSet.has(predicate)) {
       diagnostics.push({
         severity: "error",
         code: "UNKNOWN_PREDICATE",
-        message: `Predicate "${predicate}" referenced at ${path41} is not in the predicate registry.`,
-        path: path41
+        message: `Predicate "${predicate}" referenced at ${path42} is not in the predicate registry.`,
+        path: path42
       });
     }
   };
@@ -20775,8 +21235,8 @@ var init_src3 = __esm({
 });
 
 // libs/mesh-cli/src/commands/workflow.ts
-import * as fs33 from "fs";
-import * as path40 from "path";
+import * as fs34 from "fs";
+import * as path41 from "path";
 import { createRequire as createRequire2 } from "module";
 import { execFileSync as execFileSync29 } from "child_process";
 function resolveExtractorPath() {
@@ -20792,7 +21252,7 @@ function runExtraction(targetPath, extractorPath, explicitProcessPath) {
   let explicitProcessArtifact;
   if (explicitProcessPath) {
     try {
-      explicitProcessArtifact = JSON.parse(fs33.readFileSync(explicitProcessPath, "utf-8"));
+      explicitProcessArtifact = JSON.parse(fs34.readFileSync(explicitProcessPath, "utf-8"));
     } catch (err) {
       logError(
         `Could not read/parse --process ${explicitProcessPath}: ${err instanceof Error ? err.message : String(err)}`
@@ -20892,7 +21352,7 @@ function runLintExtraction(targetPath, extractorPath, explicitProcessPath) {
   let explicitProcessArtifact;
   if (explicitProcessPath) {
     try {
-      explicitProcessArtifact = JSON.parse(fs33.readFileSync(explicitProcessPath, "utf-8"));
+      explicitProcessArtifact = JSON.parse(fs34.readFileSync(explicitProcessPath, "utf-8"));
     } catch (err) {
       logError(
         `Could not read/parse --process ${explicitProcessPath}: ${err instanceof Error ? err.message : String(err)}`
@@ -20997,16 +21457,16 @@ function registerWorkflowCommands(program2) {
   ).action(
     async (targetPath, opts) => {
       try {
-        const resolvedPath = path40.resolve(targetPath);
-        if (!fs33.existsSync(resolvedPath)) {
+        const resolvedPath = path41.resolve(targetPath);
+        if (!fs34.existsSync(resolvedPath)) {
           logError(`Path does not exist: ${resolvedPath}`);
           process.exitCode = 1;
           return;
         }
         let resolvedProcessPath;
         if (opts.process) {
-          resolvedProcessPath = path40.resolve(opts.process);
-          if (!fs33.existsSync(resolvedProcessPath)) {
+          resolvedProcessPath = path41.resolve(opts.process);
+          if (!fs34.existsSync(resolvedProcessPath)) {
             logError(`--process path does not exist: ${resolvedProcessPath}`);
             process.exitCode = 1;
             return;
@@ -21055,8 +21515,8 @@ function registerWorkflowCommands(program2) {
     "Extract the as-built command/query/activity inventory from Temporal workflow source\n\nThe inventory ({ workflowType, commands, queries, activities }) is the process-\nconformance lint's code-side input \u2014 it is never hand-edited. Supports single\nfiles or directories."
   ).action(async (targetPath) => {
     try {
-      const resolvedPath = path40.resolve(targetPath);
-      if (!fs33.existsSync(resolvedPath)) {
+      const resolvedPath = path41.resolve(targetPath);
+      if (!fs34.existsSync(resolvedPath)) {
         logError(`Path does not exist: ${resolvedPath}`);
         process.exitCode = 1;
         return;
@@ -21099,16 +21559,16 @@ function registerWorkflowCommands(program2) {
     "Comma-separated named-predicate registry (enables UNKNOWN_PREDICATE checks)"
   ).action(async (targetPath, opts) => {
     try {
-      const resolvedPath = path40.resolve(targetPath);
-      if (!fs33.existsSync(resolvedPath)) {
+      const resolvedPath = path41.resolve(targetPath);
+      if (!fs34.existsSync(resolvedPath)) {
         logError(`Path does not exist: ${resolvedPath}`);
         process.exitCode = 1;
         return;
       }
       let resolvedProcessPath;
       if (opts.process) {
-        resolvedProcessPath = path40.resolve(opts.process);
-        if (!fs33.existsSync(resolvedProcessPath)) {
+        resolvedProcessPath = path41.resolve(opts.process);
+        if (!fs34.existsSync(resolvedProcessPath)) {
           logError(`--process path does not exist: ${resolvedProcessPath}`);
           process.exitCode = 1;
           return;