@mesh-tech/mesh-cli 0.20.0 → 0.20.2

package/dist/bin/mesh.js

@@ -3274,6 +3274,7 @@ __export(login_exports, {
   discoverConfigForContext: () => discoverConfigForContext,
   discoverConfigFromWellKnown: () => discoverConfigFromWellKnown,
   ensureLogin: () => ensureLogin,
+  forceRefreshToken: () => forceRefreshToken,
   getContextConfig: () => getContextConfig,
   getValidToken: () => getValidToken,
   isRemoteEnvironment: () => isRemoteEnvironment,
@@ -3993,22 +3994,43 @@ async function getValidToken(context, opts = {}) {
   if (tokenStillValid(creds.expiresAt, opts.marginMs ?? 0)) {
     return creds.idToken;
   }
+  return remintToken(context, config, creds);
+}
+async function remintToken(context, config, creds) {
   if (!creds.refreshToken) return null;
+  let tokens;
+  try {
+    tokens = await refreshTokens(config.issuer, config.clientId, creds.refreshToken);
+  } catch {
+    return null;
+  }
+  let email = creds.email;
+  try {
+    email = decodeJwtPayload(tokens.id_token).email ?? creds.email;
+  } catch {
+  }
   try {
-    const tokens = await refreshTokens(config.issuer, config.clientId, creds.refreshToken);
-    const idPayload = decodeJwtPayload(tokens.id_token);
     writeCredentials(context, {
       ...creds,
       idToken: tokens.id_token,
       accessToken: tokens.access_token,
       refreshToken: tokens.refresh_token ?? creds.refreshToken,
       expiresAt: new Date(Date.now() + tokens.expires_in * 1e3).toISOString(),
-      email: idPayload.email ?? creds.email
+      email
     });
-    return tokens.id_token;
-  } catch {
-    return null;
+  } catch (err) {
+    logWarn(
+      `The refreshed ${context} session could not be cached (${err instanceof Error ? err.message : String(err)}) \u2014 this run continues on the new token, but the next one may need a fresh sign-in.`
+    );
   }
+  return tokens.id_token;
+}
+async function forceRefreshToken(context) {
+  const config = getContextConfig(context);
+  if (!config) return null;
+  const creds = readCredentials(context);
+  if (!creds) return null;
+  return remintToken(context, config, creds);
 }
 async function probeCredentials(context, roleArn) {
   const cached = readCredentials(context);
@@ -4376,7 +4398,9 @@ __export(registry_identity_exports, {
   isReservedRegistryContext: () => isReservedRegistryContext,
   logRegistryIdentity: () => logRegistryIdentity,
   readRegistrySession: () => readRegistrySession,
+  refreshRegistrySession: () => refreshRegistrySession,
   registrySessionCandidates: () => registrySessionCandidates,
+  registryTokenRoles: () => registryTokenRoles,
   resolveRegistryIdentity: () => resolveRegistryIdentity
 });
 function isReservedRegistryContext(context) {
@@ -4480,6 +4504,22 @@ async function ensureRegistrySession(opts) {
     expiresAt: creds.expiresAt
   };
 }
+function registryTokenRoles(idToken) {
+  if (!idToken) return [];
+  try {
+    return projectRoleKeys(decodeJwtPayload(idToken)).sort();
+  } catch {
+    return [];
+  }
+}
+async function refreshRegistrySession(context) {
+  const before = registryTokenRoles(readCredentials(context)?.idToken);
+  const idToken = await forceRefreshToken(context);
+  if (!idToken) return { reminted: false, rolesChanged: false };
+  const after = registryTokenRoles(idToken);
+  const same = after.length === before.length && after.every((role, i) => role === before[i]);
+  return { reminted: true, rolesChanged: !same };
+}
 function clearRegistrySession() {
   clearCredentials(REGISTRY_CREDENTIAL_KEY);
   clearContextConfig(REGISTRY_CREDENTIAL_KEY);
@@ -4508,6 +4548,7 @@ var init_registry_identity = __esm({
   "libs/mesh-cli/src/utils/registry-identity.ts"() {
     "use strict";
     init_login();
+    init_aws_auth();
     init_first_party_contexts();
     init_registry_broker();
     init_errors();
@@ -4985,16 +5026,20 @@ function selectRoleForCaller(idToken, options) {
   const adminRoles = options.adminClaimRoles ?? ["mesh.platform:admin"];
   const claims = decodeJwtPayload2(idToken);
   if (!claims) return options.defaultRole;
+  const claimedRoles = projectRoleKeys(claims);
+  return adminRoles.some((target) => claimedRoles.includes(target)) ? options.adminRole : options.defaultRole;
+}
+function projectRoleKeys(claims) {
+  const names = /* @__PURE__ */ new Set();
   for (const [key, value] of Object.entries(claims)) {
     if (!key.startsWith("urn:zitadel:iam:org:project:")) continue;
     if (!key.endsWith(":roles")) continue;
-    if (!value || typeof value !== "object") continue;
-    const claimedRoles = Object.keys(value);
-    for (const target of adminRoles) {
-      if (claimedRoles.includes(target)) return options.adminRole;
+    if (!value || typeof value !== "object" || Array.isArray(value)) continue;
+    for (const name of Object.keys(value)) {
+      if (name) names.add(name);
     }
   }
-  return options.defaultRole;
+  return [...names];
 }
 async function resolveAwsCredentials(roleArn, appRoot, stack) {
   const roleName = roleArn.split("/").pop() ?? roleArn;
@@ -10748,6 +10793,11 @@ function scanApp(root, appRel) {
     for (const f of files) hit(code, rel(root, f), why);
   };
   anti("IAC_GRANTS", RE_IAC_GRANT, "per-user role grant baked into IaC \u2014 grants belong in the Hub (Access \u2192 People), not in a config redeploy");
+  anti(
+    "POINTER_PROJECT_OVERRIDE",
+    RE_POINTER_OVERRIDE,
+    "AppAuthzPointer is given a `zitadel:` override \u2014 an app binds its project with AppEnvironment's zitadelAppProjectId so every consumer of env.zitadel agrees; the override is reserved for the Hub"
+  );
   anti(
     "PASSWORD_STORE",
     RE_PASSWORD,
@@ -10857,7 +10907,7 @@ function registerAppCommands(program2) {
     }
   });
 }
-var APP_CHECK_RULES, APP_CHECK_CODES, SRC_EXT, SKIP_DIRS, NON_SERVICE_DIRS, RE_HTML, RE_OIDC, RE_COOKIE, RE_LOGGER, RE_EXPOSURE, RE_POINTER, RE_METADATA, RE_IAC_GRANT, RE_PASSWORD, RE_ALLOWLIST, RE_USERS_TABLE;
+var APP_CHECK_RULES, APP_CHECK_CODES, SRC_EXT, SKIP_DIRS, NON_SERVICE_DIRS, RE_HTML, RE_OIDC, RE_COOKIE, RE_LOGGER, RE_EXPOSURE, RE_POINTER, RE_METADATA, RE_IAC_GRANT, RE_POINTER_OVERRIDE, RE_PASSWORD, RE_ALLOWLIST, RE_USERS_TABLE;
 var init_app_check = __esm({
   "libs/mesh-cli/src/commands/app-check.ts"() {
     "use strict";
@@ -10929,6 +10979,13 @@ var init_app_check = __esm({
         remediation: "remove the per-user grant map; grant roles from the Hub (App \u2192 Access \u2192 People)",
         scope: "app"
       },
+      POINTER_PROJECT_OVERRIDE: {
+        gate: "H",
+        title: "Pointer publishes the env's project",
+        severity: "advisory",
+        remediation: "drop `zitadel:` from AppAuthzPointer and pass `zitadelAppProjectId: identity.projectId` to AppEnvironment \u2014 the override is the Hub's",
+        scope: "app"
+      },
       PASSWORD_STORE: {
         gate: "H",
         title: "No app-side credentials",
@@ -10976,6 +11033,7 @@ var init_app_check = __esm({
     RE_POINTER = /AppAuthzPointer/;
     RE_METADATA = /compileOpsHubMetadata|ops-hub-metadata|SpiceDBSchema/;
     RE_IAC_GRANT = /userId: *"[0-9]{6,}"/;
+    RE_POINTER_OVERRIDE = /\bzitadel: *\{\s*projectId\b/;
     RE_PASSWORD = /(^|[^a-z])(bcrypt|argon2)|password_hash|passwordHash|hashPassword|temporaryPassword.*(send|mail)|(send|mail).*temporaryPassword/;
     RE_ALLOWLIST = /ADMIN_EMAILS|ALLOWED_EMAILS|allowedEmails|adminEmails/;
     RE_USERS_TABLE = /create table (if not exists )?"?(users|roles|user_roles|permissions)"?/i;
@@ -12214,6 +12272,7 @@ __export(create_app_exports, {
   PLATFORM_MONOREPO_NAME: () => PLATFORM_MONOREPO_NAME,
   bootstrapAppsRepo: () => bootstrapAppsRepo,
   copyTemplate: () => copyTemplate,
+  describeNoAppsHome: () => describeNoAppsHome,
   ensureRegistryAccess: () => ensureRegistryAccess,
   ensureWorkspaceGlobs: () => ensureWorkspaceGlobs,
   generateComposableApp: () => generateComposableApp,
@@ -12403,6 +12462,18 @@ function parsePrimitives(input2) {
   }
   return selected;
 }
+function describeNoAppsHome(cwd, tenant, baseDir, test) {
+  if (test || isInsidePlatformMonorepo(cwd)) {
+    return {
+      message: `Tenant directory not found: ${baseDir}/${tenant}/`,
+      hint: "Create the tenant directory first, or run from within it."
+    };
+  }
+  return {
+    message: `This directory is not a Mesh apps repo \u2014 no apps/ here${fs23.existsSync(path25.join(cwd, ".git")) ? "" : " and it is not a git repo"}.`,
+    hint: `Run: mesh init   (turns this folder into your ${tenant}-mesh-apps repo), or cd into that repo and re-run mesh create-app.`
+  };
+}
 function resolveAppDir(cwd, tenant, name, test) {
   const baseDir = test ? "tests/tenants" : "tenants";
   const possiblePaths = test ? [path25.join(cwd, baseDir, tenant, "apps")] : [
@@ -12414,8 +12485,9 @@ function resolveAppDir(cwd, tenant, name, test) {
   if (!appsDir) {
     appsDir = path25.join(cwd, baseDir, tenant, "apps");
     if (!fs23.existsSync(path25.join(cwd, baseDir, tenant))) {
-      logError(`Tenant directory not found: ${baseDir}/${tenant}/`);
-      logInfo("Create the tenant directory first, or run from within it.");
+      const { message, hint } = describeNoAppsHome(cwd, tenant, baseDir, test);
+      logError(message);
+      logInfo(hint);
       process.exit(1);
     }
     if (!fs23.existsSync(appsDir)) {
@@ -16159,6 +16231,7 @@ __export(registry_exports, {
   resolvePublisherRoleArn: () => resolvePublisherRoleArn,
   runRegistryLogin: () => runRegistryLogin,
   runRegistryStatus: () => runRegistryStatus,
+  shouldRemintAfter: () => shouldRemintAfter,
   shouldRepairUserNpmrc: () => shouldRepairUserNpmrc
 });
 import { execFileSync as execFileSync24 } from "child_process";
@@ -16422,6 +16495,9 @@ function describeBrokerFailure(failure) {
 function registrySignInAllowed(opts, hasTty = Boolean(process.stdin.isTTY && process.stdout.isTTY)) {
   return Boolean(opts.device) || hasTty;
 }
+function shouldRemintAfter(failure) {
+  return failure.kind === "not-authorized";
+}
 async function tryBrokerLogin(opts) {
   if (opts.broker === false) return { outcome: { kind: "skipped-flag", flag: "--no-broker" } };
   if (opts.ci) return { outcome: { kind: "skipped-flag", flag: "--ci" } };
@@ -16461,6 +16537,13 @@ async function tryBrokerLogin(opts) {
       result = await requestGrant(session.context, identity);
     }
   }
+  if (!result.ok && shouldRemintAfter(result.failure)) {
+    const { rolesChanged } = await refreshRegistrySession(session.context);
+    if (rolesChanged) {
+      logInfo("Your sign-in now carries a role it did not have \u2014 retrying\u2026");
+      result = await requestGrant(session.context, identity);
+    }
+  }
   if (result.ok) return { grant: result.grant };
   const { message, hint, fatal } = describeBrokerFailure(result.failure);
   if (fatal) {
@@ -16810,7 +16893,7 @@ var init_registry = __esm({
         this.name = "RegistryNotAuthorizedError";
       }
     };
-    NOT_AUTHORIZED_RERUN = "Once granted, run: mesh registry login   (your sign-in is kept; no second browser trip)";
+    NOT_AUTHORIZED_RERUN = "Once granted, run: mesh registry login   (it re-mints your sign-in; still refused? mesh registry logout && mesh registry login)";
     CONTEXT_IGNORED_NOTICE = "The registry is global \u2014 the context argument is no longer needed (ignored).";
   }
 });
@@ -16818,6 +16901,7 @@ var init_registry = __esm({
 // libs/mesh-cli/src/commands/init/wizard.ts
 var wizard_exports = {};
 __export(wizard_exports, {
+  INIT_REPO_FIX: () => INIT_REPO_FIX,
   INTERRUPTED_EXIT_CODE: () => INTERRUPTED_EXIT_CODE,
   NO_SESSION_NO_TTY_MESSAGE: () => NO_SESSION_NO_TTY_MESSAGE,
   TENANT_REQUIRED_MESSAGE: () => TENANT_REQUIRED_MESSAGE,
@@ -16826,6 +16910,7 @@ __export(wizard_exports, {
   describeMode: () => describeMode,
   registryStep: () => registryStep,
   renderWizardSummary: () => renderWizardSummary,
+  repoStep: () => repoStep,
   resolveAnswers: () => resolveAnswers,
   runInitWizard: () => runInitWizard,
   runWizardSteps: () => runWizardSteps,
@@ -16835,12 +16920,15 @@ __export(wizard_exports, {
 });
 import * as fs30 from "fs";
 import * as path37 from "path";
+import { execFileSync as execFileSync25 } from "child_process";
 import chalk4 from "chalk";
 function wizardExitCode(steps) {
   return steps.some((s) => s.status === "fail") ? 1 : 0;
 }
-function wizardNextCommands(mode) {
-  return mode === "local" ? ["mesh create-app"] : ["mesh create-app", "mesh deploy up   # from the app directory, once it exists"];
+function wizardNextCommands(mode, steps = []) {
+  const repo = steps.find((s) => s.name === STEP_LABELS.repo);
+  const first = repo && repo.status !== "pass" && repo.fix ? repo.fix : "mesh create-app";
+  return mode === "local" ? [first] : [first, "mesh deploy up   # from the app directory, once it exists"];
 }
 function stepBlocks(result) {
   return result.status === "fail" && result.blocking !== false;
@@ -16889,12 +16977,18 @@ function classifyRepo(cwd) {
   if (shouldBootstrapAppsRepo(cwd)) return { kind: "empty-apps-repo", root: cwd };
   const root = resolveTargetRoot(cwd);
   const inRepo = fs30.existsSync(path37.join(root, ".git"));
-  if (!inRepo) return { kind: "no-repo", root };
+  if (!inRepo) {
+    const hasContent = fs30.readdirSync(cwd).some((entry) => !entry.startsWith("."));
+    return { kind: hasContent ? "no-repo" : "empty-dir", root: cwd };
+  }
   const hasWorkspace = fs30.existsSync(path37.join(root, "pnpm-workspace.yaml")) || fs30.existsSync(path37.join(root, "pnpm-lock.yaml"));
   const hasApps = fs30.existsSync(path37.join(root, "apps")) || fs30.existsSync(path37.join(root, "tenants"));
   if (hasWorkspace || hasApps) return { kind: "apps-repo", root };
   return { kind: "other-repo", root };
 }
+function gitInit(dir) {
+  execFileSync25("git", ["init", "-q"], { cwd: dir, stdio: ["ignore", "ignore", "pipe"] });
+}
 async function runWizardSteps(ctx, steps) {
   const results = [];
   for (const step of steps) {
@@ -16986,7 +17080,7 @@ async function runInitWizard(opts, deps = {}) {
       const written = writeMeshJson(root, { tenant, platform: mode === "local" ? "local" : mode.platform });
       logInfo(`Recorded tenant + mode in ${written}`);
     }
-    const outcome = { tenant, mode, steps, next: wizardNextCommands(mode) };
+    const outcome = { tenant, mode, steps, next: wizardNextCommands(mode, steps) };
     const code = wizardExitCode(steps);
     if (opts.json) {
       console.log = origLog;
@@ -17008,7 +17102,7 @@ async function runInitWizard(opts, deps = {}) {
     console.log = origLog;
   }
 }
-var NO_SESSION_NO_TTY_MESSAGE, TENANT_REQUIRED_MESSAGE, INTERRUPTED_EXIT_CODE, STEP_LABELS, registryStep, platformStep, repoStep, skillsStep, WIZARD_STEPS;
+var NO_SESSION_NO_TTY_MESSAGE, TENANT_REQUIRED_MESSAGE, INTERRUPTED_EXIT_CODE, STEP_LABELS, registryStep, platformStep, INIT_REPO_FIX, repoStep, skillsStep, WIZARD_STEPS;
 var init_wizard = __esm({
   "libs/mesh-cli/src/commands/init/wizard.ts"() {
     "use strict";
@@ -17112,6 +17206,7 @@ var init_wizard = __esm({
         };
       }
     };
+    INIT_REPO_FIX = "git init && mesh init";
     repoStep = {
       name: "repo",
       async run(ctx) {
@@ -17121,11 +17216,34 @@ var init_wizard = __esm({
         switch (kind) {
           case "platform-monorepo":
             return { name, status: "skip", detail: "inside mesh-platform \u2014 apps here link workspace packages; nothing to set up" };
+          case "empty-dir": {
+            const go = ctx.yes || !ctx.interactive ? true : await ctx.prompts.confirm({
+              message: `This folder is not a git repo \u2014 initialize ${root} as your ${ctx.tenant}-mesh-apps repo here?`,
+              default: true
+            });
+            if (!go) {
+              return { name, status: "skip", detail: "folder left as is", fix: `cd <your ${ctx.tenant}-mesh-apps clone> && mesh init` };
+            }
+            try {
+              (ctx.seams?.gitInit ?? gitInit)(root);
+            } catch (err) {
+              const why = err instanceof Error && "stderr" in err && err.stderr ? String(err.stderr).trim() : "";
+              return {
+                name,
+                status: "fail",
+                detail: `git init failed \u2014 is git installed and ${root} writable?${why ? ` (${why})` : ""}`,
+                fix: INIT_REPO_FIX
+              };
+            }
+            const created = bootstrapAppsRepo(root, ctx.tenant);
+            return { name, status: "pass", detail: `initialized a git repo and bootstrapped the apps repo: ${created.join(", ")}` };
+          }
           case "no-repo":
             return {
               name,
               status: "skip",
-              detail: `not in a git repo \u2014 clone (or git init) your ${ctx.tenant}-mesh-apps repo and re-run mesh init there`
+              detail: `not in a git repo, and this folder already holds files \u2014 clone (or git init) your ${ctx.tenant}-mesh-apps repo and re-run mesh init there`,
+              fix: INIT_REPO_FIX
             };
           case "other-repo":
             return {
@@ -17464,7 +17582,7 @@ var init_init = __esm({
 });
 
 // libs/mesh-cli/src/commands/install-shim.ts
-import { execFileSync as execFileSync25 } from "child_process";
+import { execFileSync as execFileSync26 } from "child_process";
 import * as fs32 from "fs";
 import * as os10 from "os";
 import * as path39 from "path";
@@ -17577,7 +17695,7 @@ function registerInstallShimCommand(program2) {
     let status = 0;
     let ok = true;
     try {
-      stdout = execFileSync25(target, ["--help"], {
+      stdout = execFileSync26(target, ["--help"], {
         cwd: process.cwd(),
         encoding: "utf8",
         stdio: ["ignore", "pipe", "pipe"]
@@ -17624,7 +17742,7 @@ var init_install_shim = __esm({
 });
 
 // libs/mesh-cli/src/commands/local/hub-local.ts
-import { execFile as execFile3, execFileSync as execFileSync26 } from "child_process";
+import { execFile as execFile3, execFileSync as execFileSync27 } from "child_process";
 import * as fs33 from "fs";
 import * as os11 from "os";
 import * as path40 from "path";
@@ -17644,7 +17762,7 @@ function npmrcPath() {
 }
 function imageExists(tag) {
   try {
-    execFileSync26("docker", ["image", "inspect", tag], { stdio: ["ignore", "pipe", "pipe"] });
+    execFileSync27("docker", ["image", "inspect", tag], { stdio: ["ignore", "pipe", "pipe"] });
     return true;
   } catch {
     return false;
@@ -17654,7 +17772,7 @@ function ensureHubAuthImage() {
   if (imageExists(HUB_AUTH_IMAGE)) return;
   logInfo(`Building ${HUB_AUTH_IMAGE} (Hub auth proxy)\u2026`);
   const hubStackDir = path40.join(findPackageRoot(), "stack", "hub");
-  execFileSync26(
+  execFileSync27(
     "docker",
     ["build", "-f", path40.join(hubStackDir, "Dockerfile.auth"), "-t", HUB_AUTH_IMAGE, hubStackDir],
     { stdio: ["ignore", "inherit", "inherit"], env: { ...process.env, DOCKER_BUILDKIT: "1" } }
@@ -17668,7 +17786,7 @@ function hasRegistryAuth() {
 function localHubVersion() {
   const versions = HUB_IMAGES.map((name) => {
     try {
-      const out = execFileSync26("docker", ["images", name, "--format", "{{.Tag}}"], {
+      const out = execFileSync27("docker", ["images", name, "--format", "{{.Tag}}"], {
         encoding: "utf-8",
         stdio: ["ignore", "pipe", "pipe"]
       });
@@ -17747,7 +17865,7 @@ async function ensureHubImages() {
   const context = path40.join(cacheDir(), `context-${version}`);
   fs33.rmSync(context, { recursive: true, force: true });
   fs33.mkdirSync(context, { recursive: true });
-  execFileSync26("tar", ["-xzf", tarball, "-C", context, "--strip-components", "1"], {
+  execFileSync27("tar", ["-xzf", tarball, "-C", context, "--strip-components", "1"], {
     stdio: ["ignore", "pipe", "pipe"]
   });
   const hubStackDir = path40.join(findPackageRoot(), "stack", "hub");
@@ -17758,7 +17876,7 @@ async function ensureHubImages() {
     const tag = `${name}:${version}`;
     if (imageExists(tag)) continue;
     logInfo(`Building ${tag} from the published tarball\u2026`);
-    execFileSync26(
+    execFileSync27(
       "docker",
       [
         "build",
@@ -17776,6 +17894,32 @@ async function ensureHubImages() {
   }
   return version;
 }
+function tarballNameForImageVersion(version) {
+  if (version.endsWith("-src")) return null;
+  return `mesh-tech-hub-${version.replace(/-r\d+$/, "")}.tgz`;
+}
+function readHubCompiledAuthz(version) {
+  const context = path40.join(cacheDir(), `context-${version}`);
+  const file = path40.join(context, HUB_COMPILED_AUTHZ_REL);
+  if (!fs33.existsSync(file)) {
+    const tarball = tarballNameForImageVersion(version);
+    if (!tarball || !fs33.existsSync(path40.join(cacheDir(), tarball))) return null;
+    fs33.mkdirSync(context, { recursive: true });
+    try {
+      execFileSync27(
+        "tar",
+        ["-xzf", path40.join(cacheDir(), tarball), "-C", context, "--strip-components", "1", `package/${HUB_COMPILED_AUTHZ_REL}`],
+        { stdio: ["ignore", "pipe", "pipe"] }
+      );
+    } catch {
+      return null;
+    }
+    if (!fs33.existsSync(file)) return null;
+  }
+  const parsed = JSON.parse(fs33.readFileSync(file, "utf-8"));
+  if (typeof parsed.zed !== "string" || !parsed.metadata || typeof parsed.metadata !== "object") return null;
+  return { zed: parsed.zed, metadata: parsed.metadata };
+}
 function readWorkspaceCatalog(repoRoot2) {
   const text = fs33.readFileSync(path40.join(repoRoot2, "pnpm-workspace.yaml"), "utf-8");
   const marker = "\ncatalog:\n";
@@ -17790,7 +17934,7 @@ function readWorkspaceCatalog(repoRoot2) {
   return catalog;
 }
 function normalizeHubManifests(contextDir, catalog) {
-  const DEP_FIELDS = ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"];
+  const DEP_FIELDS = ["dependencies", "optionalDependencies", "peerDependencies"];
   const touched = [];
   for (const entry of fs33.readdirSync(contextDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
@@ -17798,6 +17942,10 @@ function normalizeHubManifests(contextDir, catalog) {
     if (!fs33.existsSync(manifest)) continue;
     const pkg = JSON.parse(fs33.readFileSync(manifest, "utf-8"));
     let changed = false;
+    if (pkg.devDependencies) {
+      delete pkg.devDependencies;
+      changed = true;
+    }
     for (const field of DEP_FIELDS) {
       const deps = pkg[field];
       if (!deps) continue;
@@ -17852,7 +18000,7 @@ async function buildHubImagesFromSource(repoRoot2) {
   await execFileAsync2("pnpm", ["pack", "--pack-destination", context], { cwd: hubDir, maxBuffer: 64 * 1024 * 1024 });
   const tarball = fs33.readdirSync(context).find((f) => f.endsWith(".tgz"));
   if (!tarball) throw new MeshCliError("pnpm pack produced no tarball for apps/hub");
-  execFileSync26("tar", ["-xzf", path40.join(context, tarball), "-C", context, "--strip-components", "1"], {
+  execFileSync27("tar", ["-xzf", path40.join(context, tarball), "-C", context, "--strip-components", "1"], {
     stdio: ["ignore", "pipe", "pipe"]
   });
   const rewritten = normalizeHubManifests(context, readWorkspaceCatalog(repoRoot2));
@@ -17864,7 +18012,7 @@ async function buildHubImagesFromSource(repoRoot2) {
   ]) {
     const tag = `${name}:${version}`;
     logInfo(`Building ${tag} from source\u2026`);
-    execFileSync26(
+    execFileSync27(
       "docker",
       ["build", "-f", path40.join(hubStackDir, dockerfile), "-t", tag, "--secret", `id=npmrc,src=${npmrc}`, context],
       { stdio: ["ignore", "inherit", "inherit"], env: { ...process.env, DOCKER_BUILDKIT: "1" } }
@@ -17873,7 +18021,7 @@ async function buildHubImagesFromSource(repoRoot2) {
   }
   return version;
 }
-var execFileAsync2, HUB_PACKAGE, HUB_IMAGES, LOCAL_IMAGE_REV, HUB_AUTH_IMAGE;
+var execFileAsync2, HUB_PACKAGE, HUB_IMAGES, LOCAL_IMAGE_REV, HUB_AUTH_IMAGE, HUB_COMPILED_AUTHZ_REL;
 var init_hub_local = __esm({
   "libs/mesh-cli/src/commands/local/hub-local.ts"() {
     "use strict";
@@ -17887,6 +18035,66 @@ var init_hub_local = __esm({
     HUB_IMAGES = ["mesh-local-hub-api", "mesh-local-hub-ui"];
     LOCAL_IMAGE_REV = "r2";
     HUB_AUTH_IMAGE = "mesh-local-hub-auth:v7.7.1-r1";
+    HUB_COMPILED_AUTHZ_REL = "api/dist/authz/compiled.json";
+  }
+});
+
+// libs/mesh-cli/src/commands/local/seed-hub-catalog.ts
+function withHubCatalogRefs(pointer, metadataRef) {
+  return {
+    spicedb: { instanceRefs: [] },
+    ...pointer,
+    opsHubMetadataRef: metadataRef,
+    mode: typeof pointer.mode === "string" ? pointer.mode : "policy-engine"
+  };
+}
+async function publishHubAuthzCatalog(compiled, awsConfig) {
+  const { SSMClient: SSMClient5, GetParameterCommand: GetParameterCommand2, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5(awsConfig);
+  await ssm.send(
+    new PutParameterCommand({
+      Name: HUB_OPS_HUB_METADATA_PARAM,
+      Type: "String",
+      // The blob is ~7.5 KB — past the 4 KB standard tier, within Advanced (8 KB),
+      // the tier the platform's Export uses for the same param.
+      Tier: "Advanced",
+      Overwrite: true,
+      Value: JSON.stringify(compiled.metadata),
+      Description: "Hub role catalog \u2014 ops-hub-metadata (local analog of MeshHub's SpiceDBSchema export)"
+    })
+  );
+  let current = {};
+  try {
+    const existing = await ssm.send(new GetParameterCommand2({ Name: HUB_AUTHZ_POINTER_PARAM }));
+    current = JSON.parse(existing.Parameter?.Value ?? "{}");
+  } catch {
+  }
+  await ssm.send(
+    new PutParameterCommand({
+      Name: HUB_AUTHZ_POINTER_PARAM,
+      Type: "String",
+      Overwrite: true,
+      Value: JSON.stringify(withHubCatalogRefs(current, HUB_OPS_HUB_METADATA_PARAM)),
+      Description: "Hub authz pointer (local analog of the platform Pulumi program)"
+    })
+  );
+  return { bundles: catalogBundleNames(compiled.metadata) };
+}
+function catalogBundleNames(metadata) {
+  const bundles = metadata.bundles;
+  if (Array.isArray(bundles)) {
+    return bundles.map((b) => b && typeof b === "object" && typeof b.name === "string" ? b.name : null).filter((n) => n !== null);
+  }
+  if (bundles && typeof bundles === "object") return Object.keys(bundles);
+  return [];
+}
+var HUB_AUTHZ_POINTER_PARAM, HUB_OPS_HUB_METADATA_PARAM;
+var init_seed_hub_catalog = __esm({
+  "libs/mesh-cli/src/commands/local/seed-hub-catalog.ts"() {
+    "use strict";
+    init_seed();
+    HUB_AUTHZ_POINTER_PARAM = `/mesh-platform/${LOCAL_TENANT}/${LOCAL_ENV}/apps/hub/stacks/local/authz`;
+    HUB_OPS_HUB_METADATA_PARAM = `${HUB_AUTHZ_POINTER_PARAM}/ops-hub-metadata`;
   }
 });
 
@@ -18063,6 +18271,17 @@ Re-running start from here may recreate shared containers with this checkout's c
       logInfo("Seeding Zitadel (Platform project, Mesh CLI app, Hub auth, test users)\u2026");
       const zitadel = await seedZitadel(LOCAL_AWS_CONFIG);
       hubAuth = zitadel.hubAuth;
+      if (hubVersion) {
+        const compiled = readHubCompiledAuthz(hubVersion);
+        if (compiled) {
+          const { bundles } = await publishHubAuthzCatalog(compiled, LOCAL_AWS_CONFIG);
+          logSuccess(`Hub role catalog seeded: ${bundles.length} role(s) (${bundles.join(", ")})`);
+        } else {
+          logWarn(
+            `Hub v${hubVersion} ships no compiled role catalog (api/dist/authz/compiled.json) \u2014 Users \u2192 Roles will be empty. Hub \u2265 2.1.0 publishes one.`
+          );
+        }
+      }
       try {
         const reconciled = await reconcileRegistryFromZitadel();
         if (reconciled.tenants.length > 0) {
@@ -18230,6 +18449,7 @@ var init_local = __esm({
     init_auth_provision();
     init_seed();
     init_seed_zitadel();
+    init_seed_hub_catalog();
     WAIT_TIMEOUT_MS = 18e4;
     WAIT_POLL_MS = 3e3;
   }
@@ -19424,7 +19644,7 @@ var init_site = __esm({
 });
 
 // libs/mesh-cli/src/commands/stack.ts
-import { execFileSync as execFileSync27 } from "child_process";
+import { execFileSync as execFileSync28 } from "child_process";
 import * as path42 from "path";
 import * as fs35 from "fs";
 import { parse as parseYaml5 } from "yaml";
@@ -19517,7 +19737,7 @@ function readBaseConfigFromYaml(appRoot, stack) {
 }
 function getGitHubUsername() {
   try {
-    const result = execFileSync27("gh", ["api", "user", "--jq", ".login"], {
+    const result = execFileSync28("gh", ["api", "user", "--jq", ".login"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -19526,7 +19746,7 @@ function getGitHubUsername() {
   } catch {
   }
   try {
-    const result = execFileSync27("git", ["config", "user.email"], {
+    const result = execFileSync28("git", ["config", "user.email"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -19612,7 +19832,7 @@ Specify which to base on: mesh stack init --from <stack>`
     if (!opts.adopt) {
       let existing = [];
       try {
-        const raw = execFileSync27("pulumi", ["stack", "ls", "--json"], {
+        const raw = execFileSync28("pulumi", ["stack", "ls", "--json"], {
           cwd: appRoot,
           encoding: "utf-8",
           env: pulumiEnv,
@@ -19636,7 +19856,7 @@ Specify which to base on: mesh stack init --from <stack>`
       logInfo(`Using KMS secrets provider: ${secretsProvider}`);
     }
     try {
-      execFileSync27("pulumi", initArgs, {
+      execFileSync28("pulumi", initArgs, {
         cwd: appRoot,
         env: pulumiEnv,
         stdio: "inherit"
@@ -19653,7 +19873,7 @@ Specify which to base on: mesh stack init --from <stack>`
       }
     }
     try {
-      execFileSync27("pulumi", ["stack", "select", newStack], {
+      execFileSync28("pulumi", ["stack", "select", newStack], {
         cwd: appRoot,
         env: pulumiEnv,
         stdio: ["pipe", "pipe", "pipe"]
@@ -19663,7 +19883,7 @@ Specify which to base on: mesh stack init --from <stack>`
     if (!configExists) {
       let baseConfig = {};
       try {
-        const raw = execFileSync27(
+        const raw = execFileSync28(
           "pulumi",
           ["config", "--json", "--stack", baseStack],
           { cwd: appRoot, env: pulumiEnv, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
@@ -19681,19 +19901,19 @@ Specify which to base on: mesh stack init --from <stack>`
         if (key === "mesh:deploy") continue;
         try {
           if (entry.objectValue !== void 0) {
-            execFileSync27(
+            execFileSync28(
               "pulumi",
               ["config", "set", key, JSON.stringify(entry.objectValue)],
               { cwd: appRoot, env: pulumiEnv, stdio: ["pipe", "pipe", "pipe"] }
             );
           } else if (entry.value === "true" || entry.value === "false") {
-            execFileSync27(
+            execFileSync28(
               "pulumi",
               ["config", "set", "--type", "bool", key, entry.value],
               { cwd: appRoot, env: pulumiEnv, stdio: ["pipe", "pipe", "pipe"] }
             );
           } else {
-            execFileSync27(
+            execFileSync28(
               "pulumi",
               ["config", "set", key, entry.value],
               { cwd: appRoot, env: pulumiEnv, stdio: ["pipe", "pipe", "pipe"] }
@@ -19706,7 +19926,7 @@ Specify which to base on: mesh stack init --from <stack>`
         const baseEnv = readConfigBlockKey(appRoot, baseStack, "mesh:coreEnv") ?? (baseTenant && baseStack.startsWith(`${baseTenant}-`) ? baseStack.slice(baseTenant.length + 1) : baseStack);
         const setCfg = (args) => {
           try {
-            execFileSync27("pulumi", ["config", "set", ...args], {
+            execFileSync28("pulumi", ["config", "set", ...args], {
               cwd: appRoot,
               env: pulumiEnv,
               stdio: ["pipe", "pipe", "pipe"]
@@ -19755,7 +19975,7 @@ Specify which to base on: mesh stack init --from <stack>`
           `Configured Pulumi.${newStack}.yaml (personal platform env on core '${baseEnv}'${opts.parentZone ? `, DNS zone ${newStack.startsWith(`${baseTenant}-`) ? newStack.slice(baseTenant.length + 1) : newStack}.${opts.parentZone}` : ""})`
         );
       } else {
-        execFileSync27("pulumi", ["config", "set", "--type", "bool", "mesh:deploy", "false"], {
+        execFileSync28("pulumi", ["config", "set", "--type", "bool", "mesh:deploy", "false"], {
           cwd: appRoot,
           env: pulumiEnv,
           stdio: ["pipe", "pipe", "pipe"]
@@ -19785,7 +20005,7 @@ Specify which to base on: mesh stack init --from <stack>`
     const args = ["stack", "rm", name];
     if (opts.yes) args.push("--yes");
     try {
-      execFileSync27("pulumi", args, { cwd: appRoot, env: pulumiEnv, stdio: "inherit" });
+      execFileSync28("pulumi", args, { cwd: appRoot, env: pulumiEnv, stdio: "inherit" });
       logSuccess(`Removed stack ${name}`);
     } catch (err) {
       process.exit(err.status ?? 1);
@@ -19997,12 +20217,12 @@ var init_recover_conversation = __esm({
 });
 
 // libs/mesh-cli/src/utils/temporal-codec.ts
-import { execFileSync as execFileSync28 } from "child_process";
+import { execFileSync as execFileSync29 } from "child_process";
 import { webcrypto as crypto4 } from "node:crypto";
 function resolveTemporalEncodingKeyFromK8s(namespace) {
   const secretName = `${namespace}-temporal-encoding-key`;
   try {
-    const b64 = execFileSync28(
+    const b64 = execFileSync29(
       "kubectl",
       [
         "get",
@@ -23342,7 +23562,7 @@ var init_src4 = __esm({
 import * as fs38 from "fs";
 import * as path45 from "path";
 import { createRequire as createRequire2 } from "module";
-import { execFileSync as execFileSync29 } from "child_process";
+import { execFileSync as execFileSync30 } from "child_process";
 function resolveExtractorPath() {
   try {
     const require2 = createRequire2(import.meta.url);
@@ -23397,7 +23617,7 @@ for (const file of files) {
 process.stdout.write(JSON.stringify(results));
 `;
   try {
-    const result = execFileSync29("npx", ["tsx", "--eval", script], {
+    const result = execFileSync30("npx", ["tsx", "--eval", script], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "inherit"],
       maxBuffer: 10 * 1024 * 1024
@@ -23439,7 +23659,7 @@ for (const file of files) {
 process.stdout.write(JSON.stringify(results));
 `;
   try {
-    const result = execFileSync29("npx", ["tsx", "--eval", script], {
+    const result = execFileSync30("npx", ["tsx", "--eval", script], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "inherit"],
       maxBuffer: 10 * 1024 * 1024
@@ -23494,7 +23714,7 @@ for (const file of files) {
 process.stdout.write(JSON.stringify(results));
 `;
   try {
-    const result = execFileSync29("npx", ["tsx", "--eval", script], {
+    const result = execFileSync30("npx", ["tsx", "--eval", script], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "inherit"],
       maxBuffer: 10 * 1024 * 1024