@mesh-tech/mesh-cli 0.19.0 → 0.20.1

package/README.md

@@ -64,7 +64,9 @@ trip).
 **If your account does not hold the grant yet**, the command tells you so and
 prints the access-request URL the platform returned (or names the admin to
 ask). Contact your Mesh contact to have **registry access granted to your
-user**, then run `mesh registry login` again.
+user**, then run `mesh registry login` again — it re-mints your sign-in so the
+new role is in the token the broker sees. If it still says not authorized,
+start a fresh sign-in: `mesh registry logout && mesh registry login`.
 
 Everything after this point — installing `@mesh-tech/*` packages, scaffolding
 an app, and the local docs server — depends on this step. `mesh init` (next)
@@ -241,8 +243,10 @@ everywhere else.
 
 Your account and session are fine; you don't hold the registry grant yet. The
 message names the request URL (or the admin to ask) — see
-[step 2](#2-get-registry-access). Once granted, `mesh registry login` again;
-your sign-in is kept.
+[step 2](#2-get-registry-access). Once granted, `mesh registry login` again —
+it re-mints your sign-in so the new role reaches the broker (a role only rides
+in tokens issued after it was granted). Still refused?
+`mesh registry logout && mesh registry login` starts a fresh sign-in.
 
 ### `No registry access on this machine — @mesh-tech packages cannot be installed.`
 

package/dist/bin/mesh.js

@@ -767,22 +767,35 @@ async function seedLocalPlatform() {
   );
   await registerTenantEnv(LOCAL_TENANT, { tier: "hub" });
   logSuccess(`Registered tenant '${LOCAL_TENANT}' env '${LOCAL_ENV}' \u2192 ${APP_TENANTS_PARAM}`);
-  const { S3Client, CreateBucketCommand } = await import("@aws-sdk/client-s3");
+  const { S3Client, CreateBucketCommand, PutObjectCommand } = await import("@aws-sdk/client-s3");
   const s3 = new S3Client({ ...AWS_CONFIG, forcePathStyle: true });
-  try {
-    await s3.send(new CreateBucketCommand({ Bucket: ARTIFACTS_BUCKET }));
-    logSuccess(`Created artifacts bucket s3://${ARTIFACTS_BUCKET}`);
-  } catch (err) {
-    if (err?.name === "BucketAlreadyOwnedByYou" || err?.name === "BucketAlreadyExists") {
-      logInfo(`Artifacts bucket s3://${ARTIFACTS_BUCKET} already exists`);
-    } else {
-      throw err;
+  for (const bucket of [ARTIFACTS_BUCKET, DATA_BUCKET]) {
+    try {
+      await s3.send(new CreateBucketCommand({ Bucket: bucket }));
+      logSuccess(`Created bucket s3://${bucket}`);
+    } catch (err) {
+      if (err?.name === "BucketAlreadyOwnedByYou" || err?.name === "BucketAlreadyExists") {
+        logInfo(`Bucket s3://${bucket} already exists`);
+      } else {
+        throw err;
+      }
     }
   }
+  for (const seed of DATA_BUCKET_SEEDS) {
+    await s3.send(
+      new PutObjectCommand({
+        Bucket: DATA_BUCKET,
+        Key: seed.key,
+        Body: seed.body,
+        ContentType: "application/json"
+      })
+    );
+  }
+  logSuccess(`Seeded s3://${DATA_BUCKET} with ${DATA_BUCKET_SEEDS.length} sample object(s)`);
   await seedTemporalNamespace();
   return { parameter: APP_TENANTS_PARAM, bucket: ARTIFACTS_BUCKET };
 }
-var LOCAL_TENANT, LOCAL_ENV, LOCAL_AWS_ENDPOINT, LOCAL_AWS_REGION, ARTIFACTS_BUCKET, APP_TENANTS_PARAM, LOCAL_AWS_CONFIG, AWS_CONFIG, FABRIC_CHECK_PATH, TEMPORAL_NAMESPACE, TEMPORAL_ADDRESS;
+var LOCAL_TENANT, LOCAL_ENV, LOCAL_AWS_ENDPOINT, LOCAL_AWS_REGION, ARTIFACTS_BUCKET, DATA_BUCKET, APP_TENANTS_PARAM, DATA_BUCKET_SEEDS, LOCAL_AWS_CONFIG, AWS_CONFIG, FABRIC_CHECK_PATH, TEMPORAL_NAMESPACE, TEMPORAL_ADDRESS;
 var init_seed = __esm({
   "libs/mesh-cli/src/commands/local/seed.ts"() {
     "use strict";
@@ -793,7 +806,24 @@ var init_seed = __esm({
     LOCAL_AWS_ENDPOINT = "http://localhost:4566";
     LOCAL_AWS_REGION = "us-east-2";
     ARTIFACTS_BUCKET = "mesh-local-artifacts";
+    DATA_BUCKET = "mesh-local-data";
     APP_TENANTS_PARAM = `/mesh-platform/${LOCAL_TENANT}/${LOCAL_ENV}/app-tenants`;
+    DATA_BUCKET_SEEDS = [
+      {
+        key: "samples/pipes/fragment-0001.json",
+        body: JSON.stringify(
+          {
+            id: "sample-0001",
+            kind: "pipes-fragment",
+            account: "0001",
+            asOf: "2026-01-01",
+            lines: [{ amount: "125.00", currency: "USD", description: "Sample credit" }]
+          },
+          null,
+          2
+        )
+      }
+    ];
     LOCAL_AWS_CONFIG = {
       endpoint: LOCAL_AWS_ENDPOINT,
       region: LOCAL_AWS_REGION,
@@ -3244,6 +3274,7 @@ __export(login_exports, {
   discoverConfigForContext: () => discoverConfigForContext,
   discoverConfigFromWellKnown: () => discoverConfigFromWellKnown,
   ensureLogin: () => ensureLogin,
+  forceRefreshToken: () => forceRefreshToken,
   getContextConfig: () => getContextConfig,
   getValidToken: () => getValidToken,
   isRemoteEnvironment: () => isRemoteEnvironment,
@@ -3963,22 +3994,43 @@ async function getValidToken(context, opts = {}) {
   if (tokenStillValid(creds.expiresAt, opts.marginMs ?? 0)) {
     return creds.idToken;
   }
+  return remintToken(context, config, creds);
+}
+async function remintToken(context, config, creds) {
   if (!creds.refreshToken) return null;
+  let tokens;
+  try {
+    tokens = await refreshTokens(config.issuer, config.clientId, creds.refreshToken);
+  } catch {
+    return null;
+  }
+  let email = creds.email;
+  try {
+    email = decodeJwtPayload(tokens.id_token).email ?? creds.email;
+  } catch {
+  }
   try {
-    const tokens = await refreshTokens(config.issuer, config.clientId, creds.refreshToken);
-    const idPayload = decodeJwtPayload(tokens.id_token);
     writeCredentials(context, {
       ...creds,
       idToken: tokens.id_token,
       accessToken: tokens.access_token,
       refreshToken: tokens.refresh_token ?? creds.refreshToken,
       expiresAt: new Date(Date.now() + tokens.expires_in * 1e3).toISOString(),
-      email: idPayload.email ?? creds.email
+      email
     });
-    return tokens.id_token;
-  } catch {
-    return null;
+  } catch (err) {
+    logWarn(
+      `The refreshed ${context} session could not be cached (${err instanceof Error ? err.message : String(err)}) \u2014 this run continues on the new token, but the next one may need a fresh sign-in.`
+    );
   }
+  return tokens.id_token;
+}
+async function forceRefreshToken(context) {
+  const config = getContextConfig(context);
+  if (!config) return null;
+  const creds = readCredentials(context);
+  if (!creds) return null;
+  return remintToken(context, config, creds);
 }
 async function probeCredentials(context, roleArn) {
   const cached = readCredentials(context);
@@ -4346,7 +4398,9 @@ __export(registry_identity_exports, {
   isReservedRegistryContext: () => isReservedRegistryContext,
   logRegistryIdentity: () => logRegistryIdentity,
   readRegistrySession: () => readRegistrySession,
+  refreshRegistrySession: () => refreshRegistrySession,
   registrySessionCandidates: () => registrySessionCandidates,
+  registryTokenRoles: () => registryTokenRoles,
   resolveRegistryIdentity: () => resolveRegistryIdentity
 });
 function isReservedRegistryContext(context) {
@@ -4450,6 +4504,22 @@ async function ensureRegistrySession(opts) {
     expiresAt: creds.expiresAt
   };
 }
+function registryTokenRoles(idToken) {
+  if (!idToken) return [];
+  try {
+    return projectRoleKeys(decodeJwtPayload(idToken)).sort();
+  } catch {
+    return [];
+  }
+}
+async function refreshRegistrySession(context) {
+  const before = registryTokenRoles(readCredentials(context)?.idToken);
+  const idToken = await forceRefreshToken(context);
+  if (!idToken) return { reminted: false, rolesChanged: false };
+  const after = registryTokenRoles(idToken);
+  const same = after.length === before.length && after.every((role, i) => role === before[i]);
+  return { reminted: true, rolesChanged: !same };
+}
 function clearRegistrySession() {
   clearCredentials(REGISTRY_CREDENTIAL_KEY);
   clearContextConfig(REGISTRY_CREDENTIAL_KEY);
@@ -4478,6 +4548,7 @@ var init_registry_identity = __esm({
   "libs/mesh-cli/src/utils/registry-identity.ts"() {
     "use strict";
     init_login();
+    init_aws_auth();
     init_first_party_contexts();
     init_registry_broker();
     init_errors();
@@ -4955,16 +5026,20 @@ function selectRoleForCaller(idToken, options) {
   const adminRoles = options.adminClaimRoles ?? ["mesh.platform:admin"];
   const claims = decodeJwtPayload2(idToken);
   if (!claims) return options.defaultRole;
+  const claimedRoles = projectRoleKeys(claims);
+  return adminRoles.some((target) => claimedRoles.includes(target)) ? options.adminRole : options.defaultRole;
+}
+function projectRoleKeys(claims) {
+  const names = /* @__PURE__ */ new Set();
   for (const [key, value] of Object.entries(claims)) {
     if (!key.startsWith("urn:zitadel:iam:org:project:")) continue;
     if (!key.endsWith(":roles")) continue;
-    if (!value || typeof value !== "object") continue;
-    const claimedRoles = Object.keys(value);
-    for (const target of adminRoles) {
-      if (claimedRoles.includes(target)) return options.adminRole;
+    if (!value || typeof value !== "object" || Array.isArray(value)) continue;
+    for (const name of Object.keys(value)) {
+      if (name) names.add(name);
     }
   }
-  return options.defaultRole;
+  return [...names];
 }
 async function resolveAwsCredentials(roleArn, appRoot, stack) {
   const roleName = roleArn.split("/").pop() ?? roleArn;
@@ -6808,6 +6883,20 @@ async function registerLocalApp(args) {
       `Local service registration (${service})`
     );
   }
+  for (const service of args.services) {
+    if (args.kinds?.[service] !== "dagster") continue;
+    const port = args.ports?.[service];
+    if (!port) continue;
+    await put2(
+      `${base}/dagster`,
+      {
+        kind: "dagster",
+        graphqlUrl: `http://host.docker.internal:${port}/graphql`,
+        uiUrl: `http://localhost:${port}`
+      },
+      `Local Dagster discovery record (${service})`
+    );
+  }
   for (const service of args.services) {
     if (!/worker/i.test(service)) continue;
     await put2(
@@ -7127,6 +7216,22 @@ function localPlatformEnv(tenant, appName, serviceName) {
   }
   return env;
 }
+function isDagsterWorkspaceRoot(appRoot) {
+  if (fs17.existsSync(path17.join(appRoot, "dg.toml"))) return true;
+  const pyproject = path17.join(appRoot, "pyproject.toml");
+  if (!fs17.existsSync(pyproject)) return false;
+  try {
+    return /^\s*\[tool\.dg[\].]/m.test(fs17.readFileSync(pyproject, "utf-8"));
+  } catch {
+    return false;
+  }
+}
+function resolveDgBinary(appRoot) {
+  for (const candidate of ["deployments/local/.venv/bin/dg", ".venv/bin/dg"]) {
+    if (fs17.existsSync(path17.join(appRoot, candidate))) return candidate;
+  }
+  return "dg";
+}
 function hasDevScript(dir) {
   const pkgPath = path17.join(dir, "package.json");
   if (!fs17.existsSync(pkgPath)) return false;
@@ -7153,9 +7258,10 @@ function detectLocalServices(appRoot) {
 function buildLocalDevOutput(appRoot, tenant, opts = {}) {
   const detected = detectLocalServices(appRoot);
   const names = Object.keys(detected);
-  if (names.length === 0) {
+  const isDagsterWorkspace = isDagsterWorkspaceRoot(appRoot);
+  if (names.length === 0 && !isDagsterWorkspace) {
     throw new MeshCliError(
-      `No runnable services found under ${appRoot} \u2014 expected subdirectories (api/, worker/, \u2026) with a package.json 'dev' script.`,
+      `No runnable services found under ${appRoot} \u2014 expected subdirectories (api/, worker/, \u2026) with a package.json 'dev' script, or a Dagster workspace (dg.toml, or [tool.dg] in pyproject.toml).`,
       { remediation: { command: "mesh create-app" } }
     );
   }
@@ -7203,6 +7309,25 @@ function buildLocalDevOutput(appRoot, tenant, opts = {}) {
       services[other].env[key] = { value: url };
     }
   }
+  if (isDagsterWorkspace) {
+    const port = BASE_PORT + names.length + mockNames.length;
+    services["dagster"] = {
+      // Absolute on purpose: a relative src is MONOREPO-ROOT-relative by the
+      // ServiceDevOutput contract (rebaseServiceSrc), which for an app nested
+      // in the monorepo would cd the launch shell to the repo root — where
+      // neither dg.toml nor the venv path resolves. The absolute app root
+      // survives rebasing in both the monorepo and standalone-repo shapes.
+      src: appRoot,
+      kind: "dagster",
+      port,
+      command: [resolveDgBinary(appRoot), "dev", "-h", "127.0.0.1", "-p", '"$PORT"'],
+      env: {
+        PORT: { value: String(port) },
+        DAGSTER_HOME: { value: path17.join(appRoot, ".dagster") },
+        ...localPlatformEnv(tenant, appName, "dagster")
+      }
+    };
+  }
   mockNames.forEach((name, i) => {
     const decl = mocks[name];
     const serviceName = `mock-${name}`;
@@ -9349,6 +9474,11 @@ function registerDevCommand(program2) {
           ports: Object.fromEntries(
             Object.entries(devOutput2.services).map(([name, svc]) => [name, svc.port])
           ),
+          kinds: Object.fromEntries(
+            Object.entries(devOutput2.services).flatMap(
+              ([name, svc]) => svc.kind ? [[name, svc.kind]] : []
+            )
+          ),
           // ExternalService.link() parity: consuming services carry the
           // external names, so the Hub shows consumers + per-app uptime.
           links: Object.values(selectedMocks).map((decl) => decl.external).filter((n) => !!n)
@@ -10663,6 +10793,11 @@ function scanApp(root, appRel) {
     for (const f of files) hit(code, rel(root, f), why);
   };
   anti("IAC_GRANTS", RE_IAC_GRANT, "per-user role grant baked into IaC \u2014 grants belong in the Hub (Access \u2192 People), not in a config redeploy");
+  anti(
+    "POINTER_PROJECT_OVERRIDE",
+    RE_POINTER_OVERRIDE,
+    "AppAuthzPointer is given a `zitadel:` override \u2014 an app binds its project with AppEnvironment's zitadelAppProjectId so every consumer of env.zitadel agrees; the override is reserved for the Hub"
+  );
   anti(
     "PASSWORD_STORE",
     RE_PASSWORD,
@@ -10772,7 +10907,7 @@ function registerAppCommands(program2) {
     }
   });
 }
-var APP_CHECK_RULES, APP_CHECK_CODES, SRC_EXT, SKIP_DIRS, NON_SERVICE_DIRS, RE_HTML, RE_OIDC, RE_COOKIE, RE_LOGGER, RE_EXPOSURE, RE_POINTER, RE_METADATA, RE_IAC_GRANT, RE_PASSWORD, RE_ALLOWLIST, RE_USERS_TABLE;
+var APP_CHECK_RULES, APP_CHECK_CODES, SRC_EXT, SKIP_DIRS, NON_SERVICE_DIRS, RE_HTML, RE_OIDC, RE_COOKIE, RE_LOGGER, RE_EXPOSURE, RE_POINTER, RE_METADATA, RE_IAC_GRANT, RE_POINTER_OVERRIDE, RE_PASSWORD, RE_ALLOWLIST, RE_USERS_TABLE;
 var init_app_check = __esm({
   "libs/mesh-cli/src/commands/app-check.ts"() {
     "use strict";
@@ -10844,6 +10979,13 @@ var init_app_check = __esm({
         remediation: "remove the per-user grant map; grant roles from the Hub (App \u2192 Access \u2192 People)",
         scope: "app"
       },
+      POINTER_PROJECT_OVERRIDE: {
+        gate: "H",
+        title: "Pointer publishes the env's project",
+        severity: "advisory",
+        remediation: "drop `zitadel:` from AppAuthzPointer and pass `zitadelAppProjectId: identity.projectId` to AppEnvironment \u2014 the override is the Hub's",
+        scope: "app"
+      },
       PASSWORD_STORE: {
         gate: "H",
         title: "No app-side credentials",
@@ -10891,6 +11033,7 @@ var init_app_check = __esm({
     RE_POINTER = /AppAuthzPointer/;
     RE_METADATA = /compileOpsHubMetadata|ops-hub-metadata|SpiceDBSchema/;
     RE_IAC_GRANT = /userId: *"[0-9]{6,}"/;
+    RE_POINTER_OVERRIDE = /\bzitadel: *\{\s*projectId\b/;
     RE_PASSWORD = /(^|[^a-z])(bcrypt|argon2)|password_hash|passwordHash|hashPassword|temporaryPassword.*(send|mail)|(send|mail).*temporaryPassword/;
     RE_ALLOWLIST = /ADMIN_EMAILS|ALLOWED_EMAILS|allowedEmails|adminEmails/;
     RE_USERS_TABLE = /create table (if not exists )?"?(users|roles|user_roles|permissions)"?/i;
@@ -15922,7 +16065,12 @@ var init_hub = __esm({
       TEMPORAL_UI_URL: "http://localhost:8233",
       // The stack's namespace. Absent, the Hub's compliance schedules fail to
       // register with "Temporal namespace is required".
-      TEMPORAL_NAMESPACE: "local-dev"
+      TEMPORAL_NAMESPACE: "local-dev",
+      // Dagster discovery records written by `mesh dev --local` carry
+      // `host.docker.internal` (for the containerized `mesh start` hub). This hub
+      // runs on the host, where that name does not resolve — tell the Data
+      // section's resolver to swap it for localhost.
+      MESH_DAGSTER_LOCAL_HOST: "localhost"
     });
     SENSITIVE_RE = /TOKEN|SECRET|KEY|PASSWORD/i;
   }
@@ -16069,6 +16217,7 @@ __export(registry_exports, {
   resolvePublisherRoleArn: () => resolvePublisherRoleArn,
   runRegistryLogin: () => runRegistryLogin,
   runRegistryStatus: () => runRegistryStatus,
+  shouldRemintAfter: () => shouldRemintAfter,
   shouldRepairUserNpmrc: () => shouldRepairUserNpmrc
 });
 import { execFileSync as execFileSync24 } from "child_process";
@@ -16332,6 +16481,9 @@ function describeBrokerFailure(failure) {
 function registrySignInAllowed(opts, hasTty = Boolean(process.stdin.isTTY && process.stdout.isTTY)) {
   return Boolean(opts.device) || hasTty;
 }
+function shouldRemintAfter(failure) {
+  return failure.kind === "not-authorized";
+}
 async function tryBrokerLogin(opts) {
   if (opts.broker === false) return { outcome: { kind: "skipped-flag", flag: "--no-broker" } };
   if (opts.ci) return { outcome: { kind: "skipped-flag", flag: "--ci" } };
@@ -16371,6 +16523,13 @@ async function tryBrokerLogin(opts) {
       result = await requestGrant(session.context, identity);
     }
   }
+  if (!result.ok && shouldRemintAfter(result.failure)) {
+    const { rolesChanged } = await refreshRegistrySession(session.context);
+    if (rolesChanged) {
+      logInfo("Your sign-in now carries a role it did not have \u2014 retrying\u2026");
+      result = await requestGrant(session.context, identity);
+    }
+  }
   if (result.ok) return { grant: result.grant };
   const { message, hint, fatal } = describeBrokerFailure(result.failure);
   if (fatal) {
@@ -16720,7 +16879,7 @@ var init_registry = __esm({
         this.name = "RegistryNotAuthorizedError";
       }
     };
-    NOT_AUTHORIZED_RERUN = "Once granted, run: mesh registry login   (your sign-in is kept; no second browser trip)";
+    NOT_AUTHORIZED_RERUN = "Once granted, run: mesh registry login   (it re-mints your sign-in; still refused? mesh registry logout && mesh registry login)";
     CONTEXT_IGNORED_NOTICE = "The registry is global \u2014 the context argument is no longer needed (ignored).";
   }
 });
@@ -17686,6 +17845,32 @@ async function ensureHubImages() {
   }
   return version;
 }
+function tarballNameForImageVersion(version) {
+  if (version.endsWith("-src")) return null;
+  return `mesh-tech-hub-${version.replace(/-r\d+$/, "")}.tgz`;
+}
+function readHubCompiledAuthz(version) {
+  const context = path40.join(cacheDir(), `context-${version}`);
+  const file = path40.join(context, HUB_COMPILED_AUTHZ_REL);
+  if (!fs33.existsSync(file)) {
+    const tarball = tarballNameForImageVersion(version);
+    if (!tarball || !fs33.existsSync(path40.join(cacheDir(), tarball))) return null;
+    fs33.mkdirSync(context, { recursive: true });
+    try {
+      execFileSync26(
+        "tar",
+        ["-xzf", path40.join(cacheDir(), tarball), "-C", context, "--strip-components", "1", `package/${HUB_COMPILED_AUTHZ_REL}`],
+        { stdio: ["ignore", "pipe", "pipe"] }
+      );
+    } catch {
+      return null;
+    }
+    if (!fs33.existsSync(file)) return null;
+  }
+  const parsed = JSON.parse(fs33.readFileSync(file, "utf-8"));
+  if (typeof parsed.zed !== "string" || !parsed.metadata || typeof parsed.metadata !== "object") return null;
+  return { zed: parsed.zed, metadata: parsed.metadata };
+}
 function readWorkspaceCatalog(repoRoot2) {
   const text = fs33.readFileSync(path40.join(repoRoot2, "pnpm-workspace.yaml"), "utf-8");
   const marker = "\ncatalog:\n";
@@ -17700,7 +17885,7 @@ function readWorkspaceCatalog(repoRoot2) {
   return catalog;
 }
 function normalizeHubManifests(contextDir, catalog) {
-  const DEP_FIELDS = ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"];
+  const DEP_FIELDS = ["dependencies", "optionalDependencies", "peerDependencies"];
   const touched = [];
   for (const entry of fs33.readdirSync(contextDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
@@ -17708,6 +17893,10 @@ function normalizeHubManifests(contextDir, catalog) {
     if (!fs33.existsSync(manifest)) continue;
     const pkg = JSON.parse(fs33.readFileSync(manifest, "utf-8"));
     let changed = false;
+    if (pkg.devDependencies) {
+      delete pkg.devDependencies;
+      changed = true;
+    }
     for (const field of DEP_FIELDS) {
       const deps = pkg[field];
       if (!deps) continue;
@@ -17783,7 +17972,7 @@ async function buildHubImagesFromSource(repoRoot2) {
   }
   return version;
 }
-var execFileAsync2, HUB_PACKAGE, HUB_IMAGES, LOCAL_IMAGE_REV, HUB_AUTH_IMAGE;
+var execFileAsync2, HUB_PACKAGE, HUB_IMAGES, LOCAL_IMAGE_REV, HUB_AUTH_IMAGE, HUB_COMPILED_AUTHZ_REL;
 var init_hub_local = __esm({
   "libs/mesh-cli/src/commands/local/hub-local.ts"() {
     "use strict";
@@ -17797,6 +17986,66 @@ var init_hub_local = __esm({
     HUB_IMAGES = ["mesh-local-hub-api", "mesh-local-hub-ui"];
     LOCAL_IMAGE_REV = "r2";
     HUB_AUTH_IMAGE = "mesh-local-hub-auth:v7.7.1-r1";
+    HUB_COMPILED_AUTHZ_REL = "api/dist/authz/compiled.json";
+  }
+});
+
+// libs/mesh-cli/src/commands/local/seed-hub-catalog.ts
+function withHubCatalogRefs(pointer, metadataRef) {
+  return {
+    spicedb: { instanceRefs: [] },
+    ...pointer,
+    opsHubMetadataRef: metadataRef,
+    mode: typeof pointer.mode === "string" ? pointer.mode : "policy-engine"
+  };
+}
+async function publishHubAuthzCatalog(compiled, awsConfig) {
+  const { SSMClient: SSMClient5, GetParameterCommand: GetParameterCommand2, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5(awsConfig);
+  await ssm.send(
+    new PutParameterCommand({
+      Name: HUB_OPS_HUB_METADATA_PARAM,
+      Type: "String",
+      // The blob is ~7.5 KB — past the 4 KB standard tier, within Advanced (8 KB),
+      // the tier the platform's Export uses for the same param.
+      Tier: "Advanced",
+      Overwrite: true,
+      Value: JSON.stringify(compiled.metadata),
+      Description: "Hub role catalog \u2014 ops-hub-metadata (local analog of MeshHub's SpiceDBSchema export)"
+    })
+  );
+  let current = {};
+  try {
+    const existing = await ssm.send(new GetParameterCommand2({ Name: HUB_AUTHZ_POINTER_PARAM }));
+    current = JSON.parse(existing.Parameter?.Value ?? "{}");
+  } catch {
+  }
+  await ssm.send(
+    new PutParameterCommand({
+      Name: HUB_AUTHZ_POINTER_PARAM,
+      Type: "String",
+      Overwrite: true,
+      Value: JSON.stringify(withHubCatalogRefs(current, HUB_OPS_HUB_METADATA_PARAM)),
+      Description: "Hub authz pointer (local analog of the platform Pulumi program)"
+    })
+  );
+  return { bundles: catalogBundleNames(compiled.metadata) };
+}
+function catalogBundleNames(metadata) {
+  const bundles = metadata.bundles;
+  if (Array.isArray(bundles)) {
+    return bundles.map((b) => b && typeof b === "object" && typeof b.name === "string" ? b.name : null).filter((n) => n !== null);
+  }
+  if (bundles && typeof bundles === "object") return Object.keys(bundles);
+  return [];
+}
+var HUB_AUTHZ_POINTER_PARAM, HUB_OPS_HUB_METADATA_PARAM;
+var init_seed_hub_catalog = __esm({
+  "libs/mesh-cli/src/commands/local/seed-hub-catalog.ts"() {
+    "use strict";
+    init_seed();
+    HUB_AUTHZ_POINTER_PARAM = `/mesh-platform/${LOCAL_TENANT}/${LOCAL_ENV}/apps/hub/stacks/local/authz`;
+    HUB_OPS_HUB_METADATA_PARAM = `${HUB_AUTHZ_POINTER_PARAM}/ops-hub-metadata`;
   }
 });
 
@@ -17973,6 +18222,17 @@ Re-running start from here may recreate shared containers with this checkout's c
       logInfo("Seeding Zitadel (Platform project, Mesh CLI app, Hub auth, test users)\u2026");
       const zitadel = await seedZitadel(LOCAL_AWS_CONFIG);
       hubAuth = zitadel.hubAuth;
+      if (hubVersion) {
+        const compiled = readHubCompiledAuthz(hubVersion);
+        if (compiled) {
+          const { bundles } = await publishHubAuthzCatalog(compiled, LOCAL_AWS_CONFIG);
+          logSuccess(`Hub role catalog seeded: ${bundles.length} role(s) (${bundles.join(", ")})`);
+        } else {
+          logWarn(
+            `Hub v${hubVersion} ships no compiled role catalog (api/dist/authz/compiled.json) \u2014 Users \u2192 Roles will be empty. Hub \u2265 2.1.0 publishes one.`
+          );
+        }
+      }
       try {
         const reconciled = await reconcileRegistryFromZitadel();
         if (reconciled.tenants.length > 0) {
@@ -18140,6 +18400,7 @@ var init_local = __esm({
     init_auth_provision();
     init_seed();
     init_seed_zitadel();
+    init_seed_hub_catalog();
     WAIT_TIMEOUT_MS = 18e4;
     WAIT_POLL_MS = 3e3;
   }