@mesh-tech/mesh-cli 0.17.0 → 0.18.1

package/dist/bin/mesh.js

@@ -809,8 +809,8 @@ var init_seed = __esm({
 // libs/mesh-cli/src/commands/local/helpers.ts
 import * as net from "net";
 async function upsertLocalSecret(secretId, value, client) {
-  const { SecretsManagerClient: SecretsManagerClient9, CreateSecretCommand: CreateSecretCommand4, PutSecretValueCommand: PutSecretValueCommand4 } = await import("@aws-sdk/client-secrets-manager");
-  const sm = client ?? new SecretsManagerClient9(LOCAL_AWS_CONFIG);
+  const { SecretsManagerClient: SecretsManagerClient10, CreateSecretCommand: CreateSecretCommand4, PutSecretValueCommand: PutSecretValueCommand4 } = await import("@aws-sdk/client-secrets-manager");
+  const sm = client ?? new SecretsManagerClient10(LOCAL_AWS_CONFIG);
   const secretString = JSON.stringify(value);
   try {
     await sm.send(new CreateSecretCommand4({ Name: secretId, SecretString: secretString }));
@@ -6316,12 +6316,12 @@ async function fetchRemoteExternalCredentials(tenant, env, external, profile) {
   const region = process.env.MESH_PLATFORM_REGION ?? process.env.AWS_REGION ?? "us-east-2";
   const fallbackProfile = !process.env.AWS_ACCESS_KEY_ID && !process.env.AWS_PROFILE ? process.env.MESH_AWS_PROFILE ?? profile : void 0;
   try {
-    const { SecretsManagerClient: SecretsManagerClient9, GetSecretValueCommand: GetSecretValueCommand9 } = await import("@aws-sdk/client-secrets-manager");
+    const { SecretsManagerClient: SecretsManagerClient10, GetSecretValueCommand: GetSecretValueCommand10 } = await import("@aws-sdk/client-secrets-manager");
     if (fallbackProfile) process.env.AWS_PROFILE = fallbackProfile;
-    const sm = new SecretsManagerClient9({ region });
+    const sm = new SecretsManagerClient10({ region });
     let res;
     try {
-      res = await sm.send(new GetSecretValueCommand9({ SecretId: secretId }));
+      res = await sm.send(new GetSecretValueCommand10({ SecretId: secretId }));
     } finally {
       if (fallbackProfile) delete process.env.AWS_PROFILE;
     }
@@ -6976,13 +6976,13 @@ async function writeRegistryParams(cliClientId, awsConfig) {
 }
 async function ensureOpsHubAdmin(pat, awsConfig) {
   const {
-    SecretsManagerClient: SecretsManagerClient9,
-    GetSecretValueCommand: GetSecretValueCommand9,
+    SecretsManagerClient: SecretsManagerClient10,
+    GetSecretValueCommand: GetSecretValueCommand10,
     CreateSecretCommand: CreateSecretCommand4,
     PutSecretValueCommand: PutSecretValueCommand4
   } = await import("@aws-sdk/client-secrets-manager");
-  const sm = new SecretsManagerClient9(awsConfig);
-  const existing = await sm.send(new GetSecretValueCommand9({ SecretId: OPS_HUB_SECRET_ID })).catch(() => null);
+  const sm = new SecretsManagerClient10(awsConfig);
+  const existing = await sm.send(new GetSecretValueCommand10({ SecretId: OPS_HUB_SECRET_ID })).catch(() => null);
   if (existing?.SecretString) {
     logSuccess("Hub admin key already provisioned (Zitadel writes enabled)");
     return;
@@ -7242,9 +7242,9 @@ async function ensureM2mCaller(pat, tenant, app, orgId, projectId, roles) {
   return false;
 }
 async function authSecretExists(tenant, app, service) {
-  const { SecretsManagerClient: SecretsManagerClient9, GetSecretValueCommand: GetSecretValueCommand9 } = await import("@aws-sdk/client-secrets-manager");
-  const sm = new SecretsManagerClient9(LOCAL_AWS_CONFIG);
-  return sm.send(new GetSecretValueCommand9({ SecretId: authSecretPath(tenant, app, service) })).then(
+  const { SecretsManagerClient: SecretsManagerClient10, GetSecretValueCommand: GetSecretValueCommand10 } = await import("@aws-sdk/client-secrets-manager");
+  const sm = new SecretsManagerClient10(LOCAL_AWS_CONFIG);
+  return sm.send(new GetSecretValueCommand10({ SecretId: authSecretPath(tenant, app, service) })).then(
     () => true,
     () => false
   );
@@ -17500,25 +17500,63 @@ var init_exec2 = __esm({
   }
 });
 
+// libs/secrets/src/index.ts
+import {
+  SecretsManagerClient as SecretsManagerClient5,
+  GetSecretValueCommand as GetSecretValueCommand5
+} from "@aws-sdk/client-secrets-manager";
+function instanceIndexSecretId(secretPrefix) {
+  return `${secretPrefix}/${INSTANCE_INDEX_SUFFIX}`;
+}
+function isInstanceKey(key) {
+  return key.length > 0 && !key.includes("/") && !key.startsWith(".") && !key.endsWith(".config");
+}
+function instanceKeyFromSecretName(secretPrefix, secretName) {
+  if (!secretName.startsWith(`${secretPrefix}/`)) return null;
+  const key = secretName.slice(secretPrefix.length + 1);
+  return isInstanceKey(key) ? key : null;
+}
+function parseInstanceIndex(secretString) {
+  let parsed;
+  try {
+    parsed = JSON.parse(secretString);
+  } catch {
+    parsed = void 0;
+  }
+  const instances = parsed?.instances;
+  if (!Array.isArray(instances) || !instances.every((k) => typeof k === "string")) {
+    throw new Error(
+      `Malformed instance index (expected {"instances": string[]}). Rebuild it with: mesh secrets reindex external/<name>`
+    );
+  }
+  return instances.filter(isInstanceKey);
+}
+function buildInstanceIndexValue(keys) {
+  const instances = [...new Set([...keys].filter(isInstanceKey))].sort();
+  const index = { version: 1, instances };
+  return JSON.stringify(index);
+}
+var INSTANCE_INDEX_SUFFIX;
+var init_src3 = __esm({
+  "libs/secrets/src/index.ts"() {
+    "use strict";
+    INSTANCE_INDEX_SUFFIX = ".index";
+  }
+});
+
 // libs/mesh-cli/src/commands/secrets/set.ts
 import {
   SSMClient as SSMClient2,
   GetParametersByPathCommand
 } from "@aws-sdk/client-ssm";
 import {
-  SecretsManagerClient as SecretsManagerClient5,
-  GetSecretValueCommand as GetSecretValueCommand5,
+  SecretsManagerClient as SecretsManagerClient6,
+  GetSecretValueCommand as GetSecretValueCommand6,
   PutSecretValueCommand,
   CreateSecretCommand
 } from "@aws-sdk/client-secrets-manager";
 import input from "@inquirer/input";
 import password from "@inquirer/password";
-import {
-  buildInstanceIndexValue,
-  instanceIndexSecretId,
-  isInstanceKey,
-  parseInstanceIndex
-} from "@mesh-tech/secrets";
 async function ensureAwsCredentialsForStack(stack) {
   if (process.env.AWS_ACCESS_KEY_ID || process.env.AWS_SESSION_TOKEN) return;
   if (!stack) return;
@@ -17658,7 +17696,7 @@ async function setCommand(servicePath, opts) {
   const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
   await ensureAwsCredentialsForStack(stackOpt ?? context.stage);
   const ssmClient = new SSMClient2({ region });
-  const smClient = new SecretsManagerClient5({ region });
+  const smClient = new SecretsManagerClient6({ region });
   const services = await discoverExternalServices(
     ssmClient,
     context.tenant,
@@ -17712,7 +17750,7 @@ Usage: mesh secrets set external/<name>`);
   let existing = {};
   try {
     const response = await smClient.send(
-      new GetSecretValueCommand5({ SecretId: secretId })
+      new GetSecretValueCommand6({ SecretId: secretId })
     );
     if (response.SecretString) {
       existing = JSON.parse(response.SecretString);
@@ -17824,7 +17862,7 @@ async function addKeyToInstanceIndex(client, secretPrefix, key, serviceName) {
   try {
     let keys = [];
     try {
-      const res = await client.send(new GetSecretValueCommand5({ SecretId: indexId }));
+      const res = await client.send(new GetSecretValueCommand6({ SecretId: indexId }));
       keys = parseInstanceIndex(res.SecretString ?? "");
     } catch (err) {
       if (!isResourceNotFound(err)) throw err;
@@ -17891,6 +17929,7 @@ async function writeConfigMirror(client, secretId, schema, merged, meta) {
 var init_set = __esm({
   "libs/mesh-cli/src/commands/secrets/set.ts"() {
     "use strict";
+    init_src3();
     init_context();
     init_log();
     init_stack_flag();
@@ -17902,18 +17941,12 @@ var init_set = __esm({
 // libs/mesh-cli/src/commands/secrets/reindex.ts
 import { SSMClient as SSMClient3 } from "@aws-sdk/client-ssm";
 import {
-  SecretsManagerClient as SecretsManagerClient6,
+  SecretsManagerClient as SecretsManagerClient7,
   ListSecretsCommand,
-  GetSecretValueCommand as GetSecretValueCommand6,
+  GetSecretValueCommand as GetSecretValueCommand7,
   PutSecretValueCommand as PutSecretValueCommand2,
   CreateSecretCommand as CreateSecretCommand2
 } from "@aws-sdk/client-secrets-manager";
-import {
-  buildInstanceIndexValue as buildInstanceIndexValue2,
-  instanceIndexSecretId as instanceIndexSecretId2,
-  instanceKeyFromSecretName,
-  parseInstanceIndex as parseInstanceIndex2
-} from "@mesh-tech/secrets";
 async function scanInstanceKeys(client, secretPrefix) {
   const keys = [];
   let nextToken;
@@ -17941,7 +17974,7 @@ async function reindexCommand(servicePath, opts) {
   const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
   await ensureAwsCredentialsForStack(stackOpt ?? context.stage);
   const ssmClient = new SSMClient3({ region });
-  const smClient = new SecretsManagerClient6({ region });
+  const smClient = new SecretsManagerClient7({ region });
   const services = await discoverExternalServices(
     ssmClient,
     context.tenant,
@@ -17970,15 +18003,15 @@ Usage: mesh secrets reindex external/<name>`);
     process.exit(1);
   }
   const secretPrefix = svc.meta.secretPrefix;
-  const indexId = instanceIndexSecretId2(secretPrefix);
+  const indexId = instanceIndexSecretId(secretPrefix);
   const actual = [...new Set(await scanInstanceKeys(smClient, secretPrefix))].sort();
   let listed = [];
   let indexExists = true;
   let malformed = false;
   try {
-    const res = await smClient.send(new GetSecretValueCommand6({ SecretId: indexId }));
+    const res = await smClient.send(new GetSecretValueCommand7({ SecretId: indexId }));
     try {
-      listed = parseInstanceIndex2(res.SecretString ?? "");
+      listed = parseInstanceIndex(res.SecretString ?? "");
     } catch {
       malformed = true;
       logInfo(`Existing index at ${indexId} is malformed \u2014 rebuilding from scratch.`);
@@ -18005,8 +18038,8 @@ Usage: mesh secrets reindex external/<name>`);
   logSuccess(`Index rebuilt: ${indexId} now lists ${actual.length} instance(s).`);
 }
 async function writeInstanceIndex(client, secretPrefix, serviceName, keys) {
-  const indexId = instanceIndexSecretId2(secretPrefix);
-  const secretString = buildInstanceIndexValue2(keys);
+  const indexId = instanceIndexSecretId(secretPrefix);
+  const secretString = buildInstanceIndexValue(keys);
   try {
     await client.send(
       new PutSecretValueCommand2({ SecretId: indexId, SecretString: secretString })
@@ -18032,6 +18065,7 @@ async function writeInstanceIndex(client, secretPrefix, serviceName, keys) {
 var init_reindex = __esm({
   "libs/mesh-cli/src/commands/secrets/reindex.ts"() {
     "use strict";
+    init_src3();
     init_context();
     init_log();
     init_stack_flag();
@@ -18045,8 +18079,8 @@ import {
   GetParametersByPathCommand as GetParametersByPathCommand2
 } from "@aws-sdk/client-ssm";
 import {
-  SecretsManagerClient as SecretsManagerClient7,
-  GetSecretValueCommand as GetSecretValueCommand7,
+  SecretsManagerClient as SecretsManagerClient8,
+  GetSecretValueCommand as GetSecretValueCommand8,
   PutSecretValueCommand as PutSecretValueCommand3,
   CreateSecretCommand as CreateSecretCommand3,
   ListSecretsCommand as ListSecretsCommand2
@@ -18135,7 +18169,7 @@ function isResourceNotFound2(err) {
 }
 async function readSecret(client, secretId) {
   try {
-    const res = await client.send(new GetSecretValueCommand7({ SecretId: secretId }));
+    const res = await client.send(new GetSecretValueCommand8({ SecretId: secretId }));
     return res.SecretString ? JSON.parse(res.SecretString) : null;
   } catch (err) {
     if (isResourceNotFound2(err)) return null;
@@ -18161,7 +18195,7 @@ async function writeSecret2(client, secretId, values, description) {
 }
 async function secretExists(client, secretId) {
   try {
-    await client.send(new GetSecretValueCommand7({ SecretId: secretId }));
+    await client.send(new GetSecretValueCommand8({ SecretId: secretId }));
     return true;
   } catch (err) {
     if (isResourceNotFound2(err)) return false;
@@ -18241,7 +18275,7 @@ async function migrateConfigCommand(opts) {
   const context = detectContext(resolveStackOption(opts));
   const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
   const ssmClient = new SSMClient4({ region });
-  const smClient = new SecretsManagerClient7({ region });
+  const smClient = new SecretsManagerClient8({ region });
   logInfo(`Migrating .config mirrors for ${context.tenant}/${context.platformEnv}`);
   if (opts.dryRun) logInfo("DRY-RUN mode \u2014 no writes");
   if (opts.force) logInfo("FORCE mode \u2014 overwrite existing .config");
@@ -20174,8 +20208,8 @@ import * as fs35 from "fs";
 import * as os12 from "os";
 import * as path42 from "path";
 import {
-  SecretsManagerClient as SecretsManagerClient8,
-  GetSecretValueCommand as GetSecretValueCommand8
+  SecretsManagerClient as SecretsManagerClient9,
+  GetSecretValueCommand as GetSecretValueCommand9
 } from "@aws-sdk/client-secrets-manager";
 function resolveTenantEnv(options) {
   if (options.tenant && options.env) {
@@ -20438,10 +20472,10 @@ async function tunnelExternal(name, options) {
   const { appTenant, appStage } = resolveCredentialAxis(options);
   const secretId = externalSecretId(appTenant, appStage, name, key);
   const setHint = `mesh secrets set external/${name}${key ? ` --key=${key}` : ""}`;
-  const sm = new SecretsManagerClient8({});
+  const sm = new SecretsManagerClient9({});
   let creds;
   try {
-    const out = await sm.send(new GetSecretValueCommand8({ SecretId: secretId }));
+    const out = await sm.send(new GetSecretValueCommand9({ SecretId: secretId }));
     creds = JSON.parse(out.SecretString ?? "{}");
   } catch (err) {
     logError(
@@ -21134,7 +21168,9 @@ function computeHappyPath(nodes, edges) {
   );
   const allEndIds = new Set(endNodes.map((n) => n.id));
   function bfs(targetIds, allowExceptional) {
-    const queue = [{ id: startNode.id, path: [startNode.id] }];
+    const queue = [
+      { id: startNode.id, path: [startNode.id] }
+    ];
     const visited = /* @__PURE__ */ new Set([startNode.id]);
     while (queue.length > 0) {
       const { id, path: path44 } = queue.shift();
@@ -21155,7 +21191,8 @@ function computeHappyPath(nodes, edges) {
       });
       for (const neighbor of sorted) {
         if (visited.has(neighbor.to)) continue;
-        if (!allowExceptional && (neighbor.isExceptional || neighbor.isTimeout || failureEndIds.has(neighbor.to))) continue;
+        if (!allowExceptional && (neighbor.isExceptional || neighbor.isTimeout || failureEndIds.has(neighbor.to)))
+          continue;
         visited.add(neighbor.to);
         queue.push({ id: neighbor.to, path: [...path44, neighbor.to] });
       }
@@ -21164,6 +21201,37 @@ function computeHappyPath(nodes, edges) {
   }
   return bfs(successEndIds, false) ?? bfs(allEndIds, false) ?? bfs(allEndIds, true) ?? [];
 }
+function isProcessArtifactProvenance(value) {
+  return typeof value === "object" && value !== null && value.source === "process-artifact";
+}
+function childGraphsOf(node) {
+  const graphs = [];
+  const withChild = node;
+  if (withChild.childGraph) graphs.push(withChild.childGraph);
+  const withBacking = node;
+  if (withBacking.backing?.backingGraph) graphs.push(withBacking.backing.backingGraph);
+  return graphs;
+}
+function walkProcessNodes(ir, scope = []) {
+  const out = [];
+  for (const node of ir.nodes) {
+    if (isProcessArtifactProvenance(node.provenance)) {
+      out.push({ nodeId: node.id, scope, node, provenance: node.provenance });
+    }
+    for (const child of childGraphsOf(node)) {
+      out.push(...walkProcessNodes(child, [...scope, node.id]));
+    }
+  }
+  return out;
+}
+function findProcessNodesByCommand(ir, command) {
+  return walkProcessNodes(ir).filter((m) => m.provenance.bind?.commands?.includes(command));
+}
+function findProcessNodesByElementId(ir, elementId, element) {
+  return walkProcessNodes(ir).filter(
+    (m) => m.provenance.elementId === elementId && (element === void 0 || m.provenance.element === element)
+  );
+}
 function cloneWorkflow(workflow) {
   return JSON.parse(JSON.stringify(workflow));
 }
@@ -21215,13 +21283,17 @@ function sanitizeMainPath(workflow, mainPath) {
 }
 function getChildGraph(node) {
   if ("childGraph" in node && node.childGraph) return node.childGraph;
-  if ("backing" in node && node.backing?.backingGraph) return node.backing.backingGraph;
+  if ("backing" in node && node.backing?.backingGraph)
+    return node.backing.backingGraph;
   return null;
 }
 function setChildGraph(node, childGraph) {
   if ("childGraph" in node) return { ...node, childGraph };
   if ("backing" in node && node.backing?.backingGraph) {
-    return { ...node, backing: { ...node.backing, backingGraph: childGraph } };
+    return {
+      ...node,
+      backing: { ...node.backing, backingGraph: childGraph }
+    };
   }
   return { ...node, childGraph };
 }
@@ -21378,7 +21450,9 @@ function wrapIntoGroup(workflow, nodeIds, groupId, label, groupType) {
     let mainBody = inParentMain.length ? inParentMain : nodeIds;
     let mainTail = [];
     if (successExit) {
-      const exitSources = new Set(exitChildEdges.filter((e) => e.to === successExit.id).map((e) => e.from));
+      const exitSources = new Set(
+        exitChildEdges.filter((e) => e.to === successExit.id).map((e) => e.from)
+      );
       const adj = /* @__PURE__ */ new Map();
       for (const e of internal) {
         if (e.isExceptional || e.isTimeout) continue;
@@ -21417,7 +21491,11 @@ function wrapIntoGroup(workflow, nodeIds, groupId, label, groupType) {
     childGraph = {
       name: label,
       description: "",
-      nodes: [{ id: startId, type: "start", label: "Start" }, ...groupedNodes, ...extraChildNodes],
+      nodes: [
+        { id: startId, type: "start", label: "Start" },
+        ...groupedNodes,
+        ...extraChildNodes
+      ],
       edges: [
         { from: startId, to: entry, isMainPath: true },
         ...internal.map(markMain),
@@ -21426,7 +21504,13 @@ function wrapIntoGroup(workflow, nodeIds, groupId, label, groupType) {
       mainPath: [startId, ...mainBody, ...mainTail]
     };
   }
-  const groupNode = { id: groupId, type: "group", groupType, label, childGraph };
+  const groupNode = {
+    id: groupId,
+    type: "group",
+    groupType,
+    label,
+    childGraph
+  };
   const newNodes = [];
   let placed = false;
   for (const n of workflow.nodes) {
@@ -21472,7 +21556,10 @@ function applyWorkflowPatch(workflow, patch) {
     return applyScopedPatch(workflow, patch.scope, patch);
   }
   if (patch.op === "batch") {
-    return patch.patches.reduce((current, operation) => applyWorkflowPatch(current, operation), workflow);
+    return patch.patches.reduce(
+      (current, operation) => applyWorkflowPatch(current, operation),
+      workflow
+    );
   }
   if (patch.op === "replace") {
     return cloneWorkflow(patch.workflow);
@@ -21506,7 +21593,9 @@ function applyWorkflowPatch(workflow, patch) {
       next.mainPath = next.mainPath.filter((nodeId) => nodeId !== patch.nodeId);
       const shouldRemoveEdges = patch.removeAttachedEdges ?? true;
       if (shouldRemoveEdges) {
-        next.edges = next.edges.filter((edge) => edge.from !== patch.nodeId && edge.to !== patch.nodeId);
+        next.edges = next.edges.filter(
+          (edge) => edge.from !== patch.nodeId && edge.to !== patch.nodeId
+        );
       }
       return next;
     }
@@ -21554,7 +21643,13 @@ function applyWorkflowPatch(workflow, patch) {
       return next;
     }
     case "group": {
-      return wrapIntoGroup(next, patch.nodeIds, patch.groupId, patch.label, patch.groupType ?? "function");
+      return wrapIntoGroup(
+        next,
+        patch.nodeIds,
+        patch.groupId,
+        patch.label,
+        patch.groupType ?? "function"
+      );
     }
     case "setMainPath": {
       next.mainPath = sanitizeMainPath(next, patch.mainPath);
@@ -21852,6 +21947,78 @@ var init_change_counts = __esm({
 
 // libs/workflow-model/src/process-artifact.ts
 import { z as z4 } from "zod";
+function outcomeTriggers(outcome) {
+  const raw = Array.isArray(outcome.when) ? outcome.when : [outcome.when];
+  return raw.map((trigger) => {
+    if ("predicate" in trigger) return { kind: "predicate", name: trigger.predicate };
+    if ("timeoutOf" in trigger) return { kind: "timeout", name: trigger.timeoutOf };
+    return { kind: "command", name: trigger.command };
+  });
+}
+function resolveSubstepActor(artifact, stage, substep) {
+  const actorId = substep.actor ?? stage.actor;
+  if (!actorId) return void 0;
+  const actor = artifact.process.actors[actorId];
+  if (!actor) return void 0;
+  return {
+    id: actorId,
+    label: actor.label,
+    ...actor.category ? { category: actor.category } : {},
+    ...substep.selector ?? actor.selector ? { selector: substep.selector ?? actor.selector } : {},
+    ...actor.cardinality ? { cardinality: actor.cardinality } : {}
+  };
+}
+function resolveActorRef(artifact, actorId) {
+  const actor = artifact.process.actors[actorId];
+  if (!actor) return void 0;
+  return {
+    id: actorId,
+    label: actor.label,
+    ...actor.category ? { category: actor.category } : {},
+    ...actor.selector ? { selector: actor.selector } : {},
+    ...actor.cardinality ? { cardinality: actor.cardinality } : {}
+  };
+}
+function buildProcessManifest(artifact, outcomeNodeIds) {
+  const { process: process2 } = artifact;
+  const actors = {};
+  for (const actorId of Object.keys(process2.actors)) {
+    actors[actorId] = resolveActorRef(artifact, actorId);
+  }
+  let selectors;
+  if (process2.selectors) {
+    selectors = {};
+    for (const [name, selector] of Object.entries(process2.selectors)) {
+      selectors[name] = {
+        name,
+        label: selector.label,
+        ...selector.description ? { description: selector.description } : {}
+      };
+    }
+  }
+  const outcomes = process2.outcomes.map((outcome) => {
+    const nodeId = outcomeNodeIds?.get(outcome.id);
+    return {
+      id: outcome.id,
+      label: outcome.label,
+      kind: outcome.kind,
+      triggers: outcomeTriggers(outcome),
+      ...outcome.description ? { description: outcome.description } : {},
+      ...nodeId ? { nodeId } : {}
+    };
+  });
+  const pointOfNoReturnStage = process2.stages.find((stage) => stage.pointOfNoReturn);
+  return {
+    source: "process-artifact",
+    artifactVersion: process2.version,
+    revision: process2.revision,
+    workflowType: process2.workflowType,
+    actors,
+    ...selectors ? { selectors } : {},
+    outcomes,
+    ...pointOfNoReturnStage ? { pointOfNoReturnStageId: pointOfNoReturnStage.id } : {}
+  };
+}
 function formatPath(path44) {
   return path44.length > 0 ? z4.core.toDotPath(path44) : "(root)";
 }
@@ -21871,19 +22038,74 @@ function issueToDiagnostic(issue) {
     path: path44
   };
 }
+function upgradeV1(artifact) {
+  const diagnostics = [
+    {
+      severity: "warning",
+      code: "DEPRECATED_ARTIFACT_VERSION",
+      message: `process.version: artifact is version 1; upgraded in memory to version ${CURRENT_PROCESS_VERSION}. Migrate the file (add process.revision, declare actor categories/selectors) \u2014 version 1 is a deprecated input, not a second authoring format.`,
+      path: "process.version"
+    },
+    {
+      severity: "warning",
+      code: "MISSING_PROCESS_REVISION",
+      message: `process.revision: version 1 has no revision; recorded as "${UNVERSIONED_REVISION}". Anything pinned to this artifact cannot name which version of the process it ran.`,
+      path: "process.revision"
+    }
+  ];
+  const process2 = artifact.process;
+  const actors = {};
+  for (const [actorId, actor] of Object.entries(process2.actors)) {
+    const legacyCategory = LEGACY_V1_ACTOR_CATEGORY[actorId];
+    actors[actorId] = {
+      ...actor,
+      ...actor.category === void 0 && legacyCategory ? { category: legacyCategory } : {}
+    };
+  }
+  return {
+    artifact: {
+      ...artifact,
+      process: {
+        ...process2,
+        version: CURRENT_PROCESS_VERSION,
+        revision: UNVERSIONED_REVISION,
+        actors
+      }
+    },
+    diagnostics
+  };
+}
 function parseProcessArtifact(json) {
   const result = processArtifactSchema.safeParse(json);
-  if (result.success) {
-    return { artifact: result.data, diagnostics: [] };
+  if (!result.success) {
+    return { diagnostics: result.error.issues.map(issueToDiagnostic) };
+  }
+  if (result.data.process.version < CURRENT_PROCESS_VERSION) {
+    return upgradeV1(result.data);
   }
-  return { diagnostics: result.error.issues.map(issueToDiagnostic) };
+  return { artifact: result.data, diagnostics: [] };
 }
-var actorSchema, substepBindSchema, substepSchema, outcomeWhenSchema, outcomeSchema, stageCompleteSchema, stageSchema, processBlockSchema, processArtifactSchema;
+var CURRENT_PROCESS_VERSION, SUPPORTED_PROCESS_VERSIONS, UNVERSIONED_REVISION, LEGACY_V1_ACTOR_CATEGORY, actorSchema, selectorSchema, substepBindSchema, substepSchema, outcomeTriggerSchema, outcomeWhenSchema, outcomeSchema, stageCompleteSchema, stageSchema, processBlockSchema, processArtifactSchema;
 var init_process_artifact = __esm({
   "libs/workflow-model/src/process-artifact.ts"() {
     "use strict";
+    CURRENT_PROCESS_VERSION = 2;
+    SUPPORTED_PROCESS_VERSIONS = [1, 2];
+    UNVERSIONED_REVISION = "unversioned";
+    LEGACY_V1_ACTOR_CATEGORY = {
+      customer: "human",
+      banker: "approval",
+      system: "data"
+    };
     actorSchema = z4.object({
-      label: z4.string()
+      label: z4.string(),
+      category: z4.string().min(1).optional(),
+      selector: z4.string().min(1).optional(),
+      cardinality: z4.enum(["one", "many"]).optional()
+    }).strict();
+    selectorSchema = z4.object({
+      label: z4.string(),
+      description: z4.string().optional()
     }).strict();
     substepBindSchema = z4.object({
       commands: z4.array(z4.string()).optional(),
@@ -21901,11 +22123,30 @@ var init_process_artifact = __esm({
       id: z4.string(),
       label: z4.string(),
       actor: z4.string().optional(),
+      /**
+       * Overrides the actor's own `selector` for this substep only — the case
+       * where one cast entry is resolved differently at one step (a handoff
+       * target, an escalation pool). Must be declared in `process.selectors`.
+       */
+      selector: z4.string().min(1).optional(),
       bind: substepBindSchema
     }).strict();
+    outcomeTriggerSchema = z4.union([
+      z4.object({ predicate: z4.string().min(1) }).strict(),
+      z4.object({ timeoutOf: z4.string().min(1) }).strict(),
+      z4.object({ command: z4.string().min(1) }).strict()
+    ]);
     outcomeWhenSchema = z4.union([
-      z4.object({ predicate: z4.string() }).strict(),
-      z4.object({ timeoutOf: z4.string() }).strict()
+      outcomeTriggerSchema,
+      z4.array(outcomeTriggerSchema).superRefine((triggers, ctx) => {
+        if (triggers.length === 0) {
+          ctx.addIssue({
+            code: "custom",
+            message: "when must declare at least one trigger",
+            params: { code: "EMPTY_OUTCOME_TRIGGER" }
+          });
+        }
+      })
     ]);
     outcomeSchema = z4.object({
       id: z4.string(),
@@ -21928,20 +22169,64 @@ var init_process_artifact = __esm({
     }).strict();
     processBlockSchema = z4.object({
       version: z4.number(),
+      /**
+       * Pinned identity of this authored content. Opaque to the platform —
+       * a date, a semver, a content hash, a monotonic counter all work. What
+       * matters is that changing the process changes it, so an execution can
+       * be pinned to the revision it started under. Required from V2; a V1
+       * artifact is upgraded with {@link UNVERSIONED_REVISION} and a warning.
+       */
+      revision: z4.string().min(1).optional(),
       workflowType: z4.string(),
       actors: z4.record(z4.string(), actorSchema),
+      /** Named selector registry — every `selector` reference resolves here. */
+      selectors: z4.record(z4.string(), selectorSchema).optional(),
       stages: z4.array(stageSchema),
       outcomes: z4.array(outcomeSchema),
       internalCommands: z4.array(z4.string()).optional()
     }).strict().superRefine((process2, ctx) => {
-      if (process2.version !== 1) {
+      if (!SUPPORTED_PROCESS_VERSIONS.includes(process2.version)) {
         ctx.addIssue({
           code: "custom",
           path: ["version"],
-          message: `Unsupported process.version ${JSON.stringify(process2.version)}; this parser only understands version 1. Upgrade the parser or downgrade the artifact.`,
+          message: `Unsupported process.version ${JSON.stringify(process2.version)}; this parser understands ${SUPPORTED_PROCESS_VERSIONS.join(" and ")}. Upgrade the parser or downgrade the artifact.`,
           params: { code: "UNSUPPORTED_VERSION" }
         });
       }
+      if (process2.version >= CURRENT_PROCESS_VERSION && process2.revision === void 0) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["revision"],
+          message: `process.revision is required from version ${CURRENT_PROCESS_VERSION}. Give this authored content a pinned identity (a date, a semver, or a content hash) so an execution can name the revision it is running.`,
+          params: { code: "MISSING_PROCESS_REVISION" }
+        });
+      }
+      const declaredSelectors = new Set(Object.keys(process2.selectors ?? {}));
+      const checkActor = (actorId, path44) => {
+        if (actorId === void 0) return;
+        if (!Object.prototype.hasOwnProperty.call(process2.actors, actorId)) {
+          ctx.addIssue({
+            code: "custom",
+            path: path44,
+            message: `Actor "${actorId}" is referenced at ${z4.core.toDotPath(path44)} but not declared in process.actors. Declare the actor (label, and optionally category/selector) or fix the reference.`,
+            params: { code: "UNDECLARED_ACTOR" }
+          });
+        }
+      };
+      const checkSelector = (selector, path44) => {
+        if (selector === void 0) return;
+        if (!declaredSelectors.has(selector)) {
+          ctx.addIssue({
+            code: "custom",
+            path: path44,
+            message: `Selector "${selector}" is referenced at ${z4.core.toDotPath(path44)} but not declared in process.selectors. Declare the selector or fix the reference.`,
+            params: { code: "UNDECLARED_SELECTOR" }
+          });
+        }
+      };
+      for (const [actorId, actor] of Object.entries(process2.actors)) {
+        checkSelector(actor.selector, ["actors", actorId, "selector"]);
+      }
       const SAME_KIND_CODE = {
         stage: "DUPLICATE_STAGE_ID",
         substep: "DUPLICATE_SUBSTEP_ID",
@@ -21966,8 +22251,17 @@ var init_process_artifact = __esm({
       };
       process2.stages.forEach((stage, stageIndex) => {
         checkId(stage.id, "stage", ["stages", stageIndex, "id"]);
+        checkActor(stage.actor, ["stages", stageIndex, "actor"]);
         stage.substeps?.forEach((substep, substepIndex) => {
           checkId(substep.id, "substep", ["stages", stageIndex, "substeps", substepIndex, "id"]);
+          checkActor(substep.actor, ["stages", stageIndex, "substeps", substepIndex, "actor"]);
+          checkSelector(substep.selector, [
+            "stages",
+            stageIndex,
+            "substeps",
+            substepIndex,
+            "selector"
+          ]);
         });
       });
       process2.outcomes.forEach((outcome, outcomeIndex) => {
@@ -21990,7 +22284,7 @@ function stagePath(stageIndex) {
 function substepPath(stageIndex, substepIndex) {
   return `${stagePath(stageIndex)}.substeps[${substepIndex}]`;
 }
-function lintProcess(artifact, inventory, predicateNames) {
+function lintProcess(artifact, inventory, predicateNames, options = {}) {
   const diagnostics = [];
   const process2 = artifact.process;
   const commandNames = new Set(inventory.commands.map((c) => c.name));
@@ -22009,6 +22303,19 @@ function lintProcess(artifact, inventory, predicateNames) {
       });
     }
   };
+  if (options.selectorNames) {
+    const selectorSet = new Set(options.selectorNames);
+    for (const [name] of Object.entries(process2.selectors ?? {})) {
+      if (!selectorSet.has(name)) {
+        diagnostics.push({
+          severity: "error",
+          code: "UNKNOWN_SELECTOR",
+          message: `Selector "${name}" declared at process.selectors.${name} is not in the selector registry; the application has no rule resolving it to subjects.`,
+          path: `process.selectors.${name}`
+        });
+      }
+    }
+  }
   process2.stages.forEach((stage, stageIndex) => {
     const predicatePath = `${stagePath(stageIndex)}.complete.predicate`;
     const predicate = stage.complete?.predicate;
@@ -22050,9 +22357,25 @@ function lintProcess(artifact, inventory, predicateNames) {
     });
   });
   process2.outcomes.forEach((outcome, outcomeIndex) => {
-    if ("predicate" in outcome.when) {
-      checkPredicate(outcome.when.predicate, `process.outcomes[${outcomeIndex}].when.predicate`);
-    }
+    const whenPath = `process.outcomes[${outcomeIndex}].when`;
+    outcomeTriggers(outcome).forEach((trigger, triggerIndex) => {
+      const path44 = Array.isArray(outcome.when) ? `${whenPath}[${triggerIndex}]` : whenPath;
+      if (trigger.kind === "predicate") {
+        checkPredicate(trigger.name, `${path44}.predicate`);
+      } else if (trigger.kind === "command") {
+        if (!boundCommandPaths.has(trigger.name)) {
+          boundCommandPaths.set(trigger.name, `${path44}.command`);
+        }
+        if (!commandNames.has(trigger.name)) {
+          diagnostics.push({
+            severity: "error",
+            code: "BOUND_COMMAND_NOT_IN_INVENTORY",
+            message: `Command "${trigger.name}" triggering outcome "${outcome.id}" (${path44}.command) does not exist in the inventory.`,
+            path: `${path44}.command`
+          });
+        }
+      }
+    });
   });
   const hasSuccessOutcome = process2.outcomes.some((o) => o.kind === "success");
   const hasFailureOutcome = process2.outcomes.some((o) => o.kind === "failure");
@@ -22097,7 +22420,7 @@ function lintProcess(artifact, inventory, predicateNames) {
       diagnostics.push({
         severity: "error",
         code: "UNBOUND_INVENTORY_COMMAND",
-        message: `Inventory command "${command.name}" is neither bound by any substep nor listed in process.internalCommands.`,
+        message: `Inventory command "${command.name}" is neither bound by any substep, nor named as an outcome trigger, nor listed in process.internalCommands.`,
         path: "process.internalCommands"
       });
     }
@@ -22115,28 +22438,39 @@ function lintProcess(artifact, inventory, predicateNames) {
 var init_process_lint = __esm({
   "libs/workflow-model/src/process-lint.ts"() {
     "use strict";
+    init_process_artifact();
   }
 });
 
 // libs/workflow-model/src/index.ts
 var src_exports2 = {};
 __export(src_exports2, {
+  CURRENT_PROCESS_VERSION: () => CURRENT_PROCESS_VERSION,
+  SUPPORTED_PROCESS_VERSIONS: () => SUPPORTED_PROCESS_VERSIONS,
+  UNVERSIONED_REVISION: () => UNVERSIONED_REVISION,
   WorkflowPatchError: () => WorkflowPatchError,
   WorkflowPatchStream: () => WorkflowPatchStream,
   applyPreviewPatch: () => applyPreviewPatch,
   applyWorkflowPatch: () => applyWorkflowPatch,
   applyWorkflowPatches: () => applyWorkflowPatches,
+  buildProcessManifest: () => buildProcessManifest,
   computeHappyPath: () => computeHappyPath,
   countChanges: () => countChanges,
   describeChanges: () => describeChanges,
   emptyWorkflowIR: () => emptyWorkflowIR,
+  findProcessNodesByCommand: () => findProcessNodesByCommand,
+  findProcessNodesByElementId: () => findProcessNodesByElementId,
   lintProcess: () => lintProcess,
+  outcomeTriggers: () => outcomeTriggers,
   parseProcessArtifact: () => parseProcessArtifact,
   processArtifactSchema: () => processArtifactSchema,
+  resolveActorRef: () => resolveActorRef,
+  resolveSubstepActor: () => resolveSubstepActor,
   validateWorkflowIR: () => validateWorkflowIR,
-  validateWorkflowPatches: () => validateWorkflowPatches
+  validateWorkflowPatches: () => validateWorkflowPatches,
+  walkProcessNodes: () => walkProcessNodes
 });
-var init_src3 = __esm({
+var init_src4 = __esm({
   "libs/workflow-model/src/index.ts"() {
     "use strict";
     init_workflow_ir();
@@ -22358,6 +22692,9 @@ async function uploadToS3(bucket, appName, workflows) {
     })
   );
 }
+function parseNameList(value) {
+  return value ? value.split(",").map((name) => name.trim()).filter((name) => name.length > 0) : void 0;
+}
 function registerWorkflowCommands(program2) {
   const workflow = program2.command("workflow").description("Workflow tooling \u2014 IR extraction, visualization");
   workflow.command("extract-ir <path>").description(
@@ -22464,13 +22801,16 @@ function registerWorkflowCommands(program2) {
     }
   });
   workflow.command("lint-process <path>").description(
-    "Lint a process artifact's bindings against the as-built code inventory\n\nReuses the inventory extraction's aux/activity discovery, resolves the process\nartifact (--process, or the same sibling process/*.process.json discovery\nextract-ir uses), then runs parseProcessArtifact + lintProcess against it.\n\nWithout --predicates, the CLI cannot verify predicate names against the worker's\nregistry (it has no way to execute it) \u2014 predicate-existence findings are skipped\nand a note is printed; every other rule (bindings, coverage, ids, outcomes,\nworkflowType) still runs. Pass --predicates for full conformance, or rely on the\nworker's own process-conformance test which has the registry in-process."
+    "Lint a process artifact's bindings against the as-built code inventory\n\nReuses the inventory extraction's aux/activity discovery, resolves the process\nartifact (--process, or the same sibling process/*.process.json discovery\nextract-ir uses), then runs parseProcessArtifact + lintProcess against it.\n\nWithout --predicates / --selectors, the CLI cannot verify those names against the\nworker's registries (it has no way to execute them) \u2014 the corresponding findings\nare skipped and a note is printed; every other rule (bindings, coverage, ids,\nactors, outcomes, workflowType) still runs. Pass both for full conformance, or rely\non the worker's own process-conformance test which has the registries in-process."
   ).option(
     "--process <path>",
     "Path to a process artifact JSON file. Absent this flag, a sibling process/*.process.json is auto-discovered per workflow file."
   ).option(
     "--predicates <names>",
     "Comma-separated named-predicate registry (enables UNKNOWN_PREDICATE checks)"
+  ).option(
+    "--selectors <names>",
+    "Comma-separated named-selector registry (enables UNKNOWN_SELECTOR checks)"
   ).action(async (targetPath, opts) => {
     try {
       const resolvedPath = path43.resolve(targetPath);
@@ -22499,8 +22839,8 @@ function registerWorkflowCommands(program2) {
       let parseProcessArtifact2;
       let lintProcess2;
       try {
-        ({ parseProcessArtifact: parseProcessArtifact2 } = await Promise.resolve().then(() => (init_src3(), src_exports2)));
-        ({ lintProcess: lintProcess2 } = await Promise.resolve().then(() => (init_src3(), src_exports2)));
+        ({ parseProcessArtifact: parseProcessArtifact2 } = await Promise.resolve().then(() => (init_src4(), src_exports2)));
+        ({ lintProcess: lintProcess2 } = await Promise.resolve().then(() => (init_src4(), src_exports2)));
       } catch {
         logError(
           "Cannot resolve @mesh-tech/workflow-model (parseProcessArtifact / lintProcess).\nIt is bundled into the published CLI \u2014 on a registry install this means a broken install; reinstall the CLI. In the monorepo, run the scoped install (pnpm bootstrap:worktree @mesh-tech/mesh-cli)."
@@ -22508,12 +22848,16 @@ function registerWorkflowCommands(program2) {
         process.exitCode = 1;
         return;
       }
-      const predicateNames = opts.predicates ? opts.predicates.split(",").map((s) => s.trim()).filter((s) => s.length > 0) : void 0;
+      const predicateNames = parseNameList(opts.predicates);
+      const selectorNames = parseNameList(opts.selectors);
       if (!predicateNames) {
         logWarn(
           "predicate checks skipped \u2014 pass --predicates or run the worker conformance test"
         );
       }
+      if (!selectorNames) {
+        logWarn("selector checks skipped \u2014 pass --selectors or run the worker conformance test");
+      }
       logInfo(`Linting process artifact(s) against ${resolvedPath}`);
       const results = runLintExtraction(resolvedPath, extractorPath, resolvedProcessPath);
       if (!results || results.length === 0) {
@@ -22535,7 +22879,12 @@ ${inventory.workflowType} (${sourceFile})`);
         const { artifact, diagnostics: parseDiagnostics } = parseProcessArtifact2(processArtifact);
         let diagnostics = parseDiagnostics;
         if (artifact) {
-          const lintDiagnostics = lintProcess2(artifact, inventory, predicateNames ?? []);
+          const lintDiagnostics = lintProcess2(
+            artifact,
+            inventory,
+            predicateNames ?? [],
+            selectorNames ? { selectorNames } : {}
+          );
           const reportable = predicateNames ? lintDiagnostics : lintDiagnostics.filter((d) => d.code !== "UNKNOWN_PREDICATE");
           diagnostics = diagnostics.concat(reportable);
         }