@mesh-tech/mesh-cli 0.15.0 → 0.17.0

package/dist/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "13af00894",
-  "builtAt": "2026-09-03T22:33:49.590Z"
+  "commit": "d8d15e7b8",
+  "builtAt": "2026-09-04T23:16:27.739Z"
 }

package/dist/src/commands/agent-api-client.d.ts

@@ -43,6 +43,23 @@ export declare function resolveTarget(opts: {
  * to the "auth did not reach the agent" message.
  */
 export declare function agentApiFetch(target: AgentApiTarget, apiPath: string): Promise<Response>;
+export interface AgentApiSendInit {
+    method: "POST" | "PUT" | "PATCH" | "DELETE";
+    /** JSON body — sets `content-type: application/json`. Mutually exclusive with `body`. */
+    json?: unknown;
+    /** Raw body, for uploads that are not JSON. */
+    body?: Uint8Array | string;
+    contentType?: string;
+}
+/**
+ * Like {@link agentApiFetch}, but with a method and a body — the write half.
+ *
+ * Shares `authHeaders` and `redirect: "manual"` with the read path for the same
+ * reasons documented there; the redirect handling matters MORE here, because a
+ * write that silently followed a 302 to Zitadel would report the login page's
+ * 200 as a successful publish.
+ */
+export declare function agentApiSend(target: AgentApiTarget, apiPath: string, init: AgentApiSendInit): Promise<Response>;
 /**
  * Turn a thrown fetch error into local-vs-remote-aware guidance. A bare
  * `ECONNREFUSED`/`fetch failed` (also `ENOTFOUND`/`EAI_AGAIN`) means

package/dist/src/commands/agent-api-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-api-client.d.ts","sourceRoot":"","sources":["../../../src/commands/agent-api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAYH,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,qBAAsB,SAAQ,KAAK;CAAG;AAKnD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAuD1G;AAWD;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAG9F;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,GAAG,MAAM,CAajF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,cAAc,EACtB,GAAG,CAAC,EAAE;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,GACpB,OAAO,CAAC,MAAM,CAAC,CA4BjB"}
+{"version":3,"file":"agent-api-client.d.ts","sourceRoot":"","sources":["../../../src/commands/agent-api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAYH,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,qBAAsB,SAAQ,KAAK;CAAG;AAKnD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAuD1G;AAWD;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAG9F;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC5C,yFAAyF;IACzF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,+CAA+C;IAC/C,IAAI,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,QAAQ,CAAC,CAenB;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,GAAG,MAAM,CAajF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,cAAc,EACtB,GAAG,CAAC,EAAE;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,GACpB,OAAO,CAAC,MAAM,CAAC,CA4BjB"}

package/dist/src/commands/agent-api-client.js

@@ -100,6 +100,28 @@ export async function agentApiFetch(target, apiPath) {
     const headers = await authHeaders(target);
     return fetch(`${target.apiBaseUrl}${apiPath}`, { headers, redirect: "manual" });
 }
+/**
+ * Like {@link agentApiFetch}, but with a method and a body — the write half.
+ *
+ * Shares `authHeaders` and `redirect: "manual"` with the read path for the same
+ * reasons documented there; the redirect handling matters MORE here, because a
+ * write that silently followed a 302 to Zitadel would report the login page's
+ * 200 as a successful publish.
+ */
+export async function agentApiSend(target, apiPath, init) {
+    const headers = await authHeaders(target);
+    const body = init.json !== undefined ? JSON.stringify(init.json) : init.body;
+    const contentType = init.json !== undefined ? "application/json" : (init.contentType ?? "application/octet-stream");
+    return fetch(`${target.apiBaseUrl}${apiPath}`, {
+        method: init.method,
+        headers: { ...headers, ...(body === undefined ? {} : { "content-type": contentType }) },
+        // `as never` rather than `as BodyInit`: this package's lib config does not
+        // pull in DOM types, so the global name is unavailable even though Node's
+        // fetch accepts exactly these shapes at runtime.
+        ...(body === undefined ? {} : { body: body }),
+        redirect: "manual",
+    });
+}
 const NETWORK_ERROR_PATTERN = /ECONNREFUSED|fetch failed|ENOTFOUND|EAI_AGAIN/;
 /**
  * Turn a thrown fetch error into local-vs-remote-aware guidance. A bare

package/dist/src/commands/agent-api-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-api-client.js","sourceRoot":"","sources":["../../../src/commands/agent-api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C,MAAM,oBAAoB,GAAG,UAAU,CAAC;AAExC;6EAC6E;AAC7E,MAAM,YAAY,GAAG,uDAAuD,CAAC;AAU7E,MAAM,OAAO,qBAAsB,SAAQ,KAAK;CAAG;AAEnD,MAAM,oBAAoB,GACxB,qEAAqE,CAAC;AAExE;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,IAA4D;IACxF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,IAAI,oBAAoB,EAAE,CAAC;IACrG,CAAC;IAED,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;IAE9B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,qBAAqB,CAC7B,eAAe,GAAG,CAAC,IAAI,gBAAgB,GAAG,CAAC,OAAO,oCAAoC,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,qBAAqB,CAAC,6BAA6B,oBAAoB,GAAG,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,qBAAqB,CAC7B,mBAAmB,IAAI,CAAC,MAAM,iBAAiB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,IAAI;gBAChG,uCAAuC,IAAI,CAAC,MAAM,sBAAsB,CAC3E,CAAC;QACJ,CAAC;QACD,OAAO;YACL,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5B,8EAA8E;QAC9E,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAE,CAAC;QAC9C,OAAO;YACL,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,wEAAwE;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,OAAO,CAAC,6BAA6B,GAAG,CAAC,IAAI,gBAAgB,GAAG,CAAC,OAAO,kCAAkC,CAAC,CAAC;IAC9G,CAAC;IAED,mEAAmE;IACnE,4DAA4D;IAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAuB,CAAC;IAChG,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,IAAI,oBAAoB,EAAE,CAAC;AACrG,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAsB;IAC/C,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;IACrE,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,IAAI,oBAAoB,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,KAAK;QAAE,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;IACvD,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAE,eAAe,EAAE,CAAC;IAC1H,MAAM,IAAI,qBAAqB,CAAC,qCAAqC,GAAG,sBAAsB,GAAG,EAAE,CAAC,CAAC;AACvG,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAsB,EAAE,OAAe;IACzE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,GAAG,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,qBAAqB,GAAG,+CAA+C,CAAC;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY,EAAE,MAAsB;IACvE,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAEzD,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACzC,OAAO,mDAAmD,CAAC;IAC7D,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,oBAAoB,CAAC;IACjE,OAAO,CACL,kBAAkB,MAAM,CAAC,UAAU,kCAAkC;QACrE,mBAAmB,YAAY,8BAA8B,CAC9D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAa,EACb,MAAsB,EACtB,GAAqB;IAErB,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;IACzF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,EAAE,CAAC;QAC3D,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,oBAAoB,CAAC;QACjE,OAAO,mDAAmD,YAAY,IAAI,CAAC;IAC7E,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,OAAO,kCAAkC,MAAM,qFAAqF,CAAC;IACvI,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAElC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAwC,CAAC;YAC3E,IAAI,MAAM,CAAC,KAAK,KAAK,0BAA0B,EAAE,CAAC;gBAChD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC;gBAC1C,MAAM,WAAW,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,6CAA6C,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzF,OAAO,GAAG,OAAO,GAAG,WAAW,EAAE,CAAC;YACpC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8EAA8E;QAChF,CAAC;IACH,CAAC;IAED,OAAO,mBAAmB,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,GAAG,CAAC;AAC/F,CAAC"}
+{"version":3,"file":"agent-api-client.js","sourceRoot":"","sources":["../../../src/commands/agent-api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C,MAAM,oBAAoB,GAAG,UAAU,CAAC;AAExC;6EAC6E;AAC7E,MAAM,YAAY,GAAG,uDAAuD,CAAC;AAU7E,MAAM,OAAO,qBAAsB,SAAQ,KAAK;CAAG;AAEnD,MAAM,oBAAoB,GACxB,qEAAqE,CAAC;AAExE;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,IAA4D;IACxF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,IAAI,oBAAoB,EAAE,CAAC;IACrG,CAAC;IAED,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;IAE9B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,qBAAqB,CAC7B,eAAe,GAAG,CAAC,IAAI,gBAAgB,GAAG,CAAC,OAAO,oCAAoC,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,qBAAqB,CAAC,6BAA6B,oBAAoB,GAAG,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,qBAAqB,CAC7B,mBAAmB,IAAI,CAAC,MAAM,iBAAiB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,IAAI;gBAChG,uCAAuC,IAAI,CAAC,MAAM,sBAAsB,CAC3E,CAAC;QACJ,CAAC;QACD,OAAO;YACL,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5B,8EAA8E;QAC9E,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAE,CAAC;QAC9C,OAAO;YACL,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,wEAAwE;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,OAAO,CAAC,6BAA6B,GAAG,CAAC,IAAI,gBAAgB,GAAG,CAAC,OAAO,kCAAkC,CAAC,CAAC;IAC9G,CAAC;IAED,mEAAmE;IACnE,4DAA4D;IAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAuB,CAAC;IAChG,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,IAAI,oBAAoB,EAAE,CAAC;AACrG,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAsB;IAC/C,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;IACrE,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,IAAI,oBAAoB,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,KAAK;QAAE,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;IACvD,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAE,eAAe,EAAE,CAAC;IAC1H,MAAM,IAAI,qBAAqB,CAAC,qCAAqC,GAAG,sBAAsB,GAAG,EAAE,CAAC,CAAC;AACvG,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAsB,EAAE,OAAe;IACzE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,GAAG,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;AAClF,CAAC;AAWD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAsB,EACtB,OAAe,EACf,IAAsB;IAEtB,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC7E,MAAM,WAAW,GACf,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,0BAA0B,CAAC,CAAC;IAElG,OAAO,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,GAAG,OAAO,EAAE,EAAE;QAC7C,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,EAAE;QACvF,2EAA2E;QAC3E,0EAA0E;QAC1E,iDAAiD;QACjD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAa,EAAE,CAAC;QACtD,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,qBAAqB,GAAG,+CAA+C,CAAC;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY,EAAE,MAAsB;IACvE,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAEzD,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACzC,OAAO,mDAAmD,CAAC;IAC7D,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,oBAAoB,CAAC;IACjE,OAAO,CACL,kBAAkB,MAAM,CAAC,UAAU,kCAAkC;QACrE,mBAAmB,YAAY,8BAA8B,CAC9D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAa,EACb,MAAsB,EACtB,GAAqB;IAErB,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;IACzF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,EAAE,CAAC;QAC3D,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,oBAAoB,CAAC;QACjE,OAAO,mDAAmD,YAAY,IAAI,CAAC;IAC7E,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,OAAO,kCAAkC,MAAM,qFAAqF,CAAC;IACvI,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAElC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAwC,CAAC;YAC3E,IAAI,MAAM,CAAC,KAAK,KAAK,0BAA0B,EAAE,CAAC;gBAChD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC;gBAC1C,MAAM,WAAW,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,6CAA6C,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzF,OAAO,GAAG,OAAO,GAAG,WAAW,EAAE,CAAC;YACpC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8EAA8E;QAChF,CAAC;IACH,CAAC;IAED,OAAO,mBAAmB,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,GAAG,CAAC;AAC/F,CAAC"}

package/dist/src/commands/app-check.d.ts

@@ -0,0 +1,97 @@
+/**
+ * `mesh app check` — the Mesh app contract, enforced.
+ *
+ * Scans a tenant-apps checkout and reports every mechanical violation of the
+ * contract in `@mesh-tech/app-kit`'s `apps` skill
+ * (`skills/apps/references/app-contract.md`): a browser UI served from inside
+ * the API process, an app that never registers with the Hub, app-written
+ * browser sessions where the platform auth proxy belongs, logging that
+ * bypasses `@mesh-tech/logger`, and an app whose people, roles or keys the
+ * Hub cannot see. `mesh create-app` runs it on every scaffold, tenant CI runs
+ * it beside `mesh skills sync --check`, and the platform reviewer runs the
+ * same command — one detector, one exit code.
+ *
+ * Three layers, like `mesh dev doctor`:
+ *   1. Pure scanners (`scanApp`, `scanRepo`) — filesystem in, `Finding[]` out.
+ *   2. One `Check` per contract code, on the dev-doctor engine (`runChecks`).
+ *   3. The command: resolves the repo root, picks the apps, renders, exits.
+ *
+ * The patterns are deliberately shape-based: `apps/<app>/index.ts` (the Pulumi
+ * program) is the contract's single point of truth, and a service directory is
+ * a UI if its name says so. A hit is a fact to READ, not a verdict — the ruling
+ * detail and every gate's owning primitive live in the contract reference.
+ *
+ * @example
+ * ```bash
+ * mesh app check                        # every apps/* in this repo
+ * mesh app check apps/funding-portal    # one app
+ * mesh app check --json                 # stable shape for CI
+ * ```
+ */
+import { Command } from "commander";
+import { jsonReport, type Check, type CheckResult, type CheckStatus } from "./dev-doctor.js";
+/** Every code the contract defines. The contract reference lists the same set; a test keeps them equal. */
+export type AppCheckCode = "UI_IN_API" | "NO_UI_SERVICE" | "NO_REGISTER" | "CUSTOM_SESSION_AUTH" | "NON_PLATFORM_LOGGER" | "LOCAL_AUTH_LIB" | "NO_AUTHZ_POINTER" | "METADATA_UNPUBLISHED" | "IAC_GRANTS" | "PASSWORD_STORE" | "EMAIL_ALLOWLIST" | "USERS_TABLE";
+export interface AppCheckRule {
+    /** Contract gate the code enforces (`0.1` … `0.5`, `H`). */
+    gate: string;
+    /** Human label, present tense. */
+    title: string;
+    /** `block` exits 1; `advisory` reports and exits 0. */
+    severity: "block" | "advisory";
+    /** The concrete replacement — what the author writes instead. */
+    remediation: string;
+    /** `repo` rules scan the checkout once; `app` rules run per app. */
+    scope: "app" | "repo";
+}
+export declare const APP_CHECK_RULES: Record<AppCheckCode, AppCheckRule>;
+export declare const APP_CHECK_CODES: AppCheckCode[];
+/** One mechanical hit. `path` is repo-relative (`apps/x/api/src/y.ts[:line]`). */
+export interface Finding {
+    code: AppCheckCode;
+    path: string;
+    why: string;
+}
+/** Source files worth scanning: TS/JS minus tests, fixtures, generated output, tooling and dependencies. */
+export declare function srcFiles(dir: string): string[];
+/** A service directory whose NAME says "browser UI". */
+export declare function isUiDir(name: string): boolean;
+/** Apps in a checkout: every `apps/<name>` with a Pulumi program, or the root when it is itself an app. */
+export declare function listApps(root: string): string[];
+/**
+ * Every app-scoped finding for one app (`appRel` is repo-relative). An app
+ * directory with no Pulumi program yields nothing — it is not an app.
+ */
+export declare function scanApp(root: string, appRel: string): Finding[];
+/** Repo-scoped findings: a tenant-local auth library that may duplicate `@mesh-tech/authn` (advisory). */
+export declare function scanRepo(root: string): Finding[];
+/** What every app-contract `Check` reads: the findings for ONE scope (an app, or the repo). */
+export interface AppCheckContext {
+    root: string;
+    /** Repo-relative app dir, or `null` for the repo-scoped checks. */
+    app: string | null;
+    findings: Finding[];
+}
+/** Turn a rule + its findings into the doctor-engine result shape. */
+export declare function resultFor(code: AppCheckCode, findings: Finding[]): CheckResult;
+/** The `Check`s for one scope: every app-scoped rule for an app, every repo-scoped rule for the repo. */
+export declare function appContractChecks(scope: "app" | "repo"): Check<AppCheckContext>[];
+export interface AppCheckReport {
+    root: string;
+    status: CheckStatus;
+    /** Per-app reports, in `listApps` order; the repo-scoped checks ride under `"(repo)"`. */
+    scopes: Array<{
+        scope: string;
+    } & ReturnType<typeof jsonReport>>;
+}
+/**
+ * Run the contract over a checkout. `apps` narrows the run to the named
+ * repo-relative app dirs (an unknown dir is an error, not a silent pass).
+ */
+export declare function runAppCheck(root: string, apps?: string[]): Promise<AppCheckReport>;
+/** Human rendering: a header per scope, the doctor lines under it, failures only unless `verbose`. */
+export declare function renderReport(report: AppCheckReport, opts: {
+    verbose: boolean;
+}): string;
+export declare function registerAppCommands(program: Command): void;
+//# sourceMappingURL=app-check.d.ts.map

package/dist/src/commands/app-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-check.d.ts","sourceRoot":"","sources":["../../../src/commands/app-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,OAAO,EAGL,UAAU,EAGV,KAAK,KAAK,EACV,KAAK,WAAW,EAChB,KAAK,WAAW,EACjB,MAAM,iBAAiB,CAAC;AAMzB,2GAA2G;AAC3G,MAAM,MAAM,YAAY,GACpB,WAAW,GACX,eAAe,GACf,aAAa,GACb,qBAAqB,GACrB,qBAAqB,GACrB,gBAAgB,GAChB,kBAAkB,GAClB,sBAAsB,GACtB,YAAY,GACZ,gBAAgB,GAChB,iBAAiB,GACjB,aAAa,CAAC;AAElB,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,QAAQ,EAAE,OAAO,GAAG,UAAU,CAAC;IAC/B,iEAAiE;IACjE,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,YAAY,EAAE,YAAY,CAuF9D,CAAC;AAEF,eAAO,MAAM,eAAe,EAAmC,YAAY,EAAE,CAAC;AAE9E,kFAAkF;AAClF,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AA4CD,4GAA4G;AAC5G,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAwB9C;AAOD,wDAAwD;AACxD,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7C;AAsED,2GAA2G;AAC3G,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAY/C;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,EAAE,CAgG/D;AAYD,0GAA0G;AAC1G,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE,CAwBhD;AAMD,+FAA+F;AAC/F,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,sEAAsE;AACtE,wBAAgB,SAAS,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,WAAW,CAU9E;AAED,yGAAyG;AACzG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC,eAAe,CAAC,EAAE,CAOjF;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,CAAC;IACpB,0FAA0F;IAC1F,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC;CAClE;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAcxF;AAED,sGAAsG;AACtG,wBAAgB,YAAY,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAoBvF;AAMD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA0B1D"}