@mesh-tech/mesh-cli 0.25.0 → 0.27.0

package/dist/src/commands/init/wizard.d.ts

@@ -1,10 +1,17 @@
 import { probeRegistryToken } from "../../utils/auth-preflight.js";
 import { type RegistryLoginOptions } from "../registry.js";
 import { type MeshJson } from "../../utils/mesh-json.js";
+import { scaffoldPlatformRepo, type PlatformSetupFlags, type StateBucketDeps } from "./platform-setup.js";
 export interface WizardOptions {
     tenant?: string;
     local?: boolean;
     platform?: string;
+    newPlatform?: string | boolean;
+    region?: string;
+    domain?: string;
+    stateBucket?: string;
+    createStateBucket?: boolean;
+    dir?: string;
     device?: boolean;
     profile?: string;
     skipRepo?: boolean;
@@ -18,9 +25,15 @@ export interface StepResult {
     detail: string;
     fix?: string;
     blocking?: boolean;
+    next?: string[];
 }
 export type WizardMode = "local" | {
     platform: string;
+} | {
+    newPlatform: PlatformSetupFlags;
+};
+export declare function isNewPlatform(mode: WizardMode): mode is {
+    newPlatform: PlatformSetupFlags;
 };
 export interface WizardCtx {
     cwd: string;
@@ -40,6 +53,8 @@ export interface WizardSeams {
     probe?: typeof probeRegistryToken;
     runRegistryLogin?: (opts: RegistryLoginOptions) => Promise<void>;
     gitInit?: (dir: string) => void;
+    scaffoldPlatform?: typeof scaffoldPlatformRepo;
+    stateBucket?: StateBucketDeps;
 }
 export interface WizardStep {
     name: "registry" | "platform" | "repo" | "skills";
@@ -72,7 +87,9 @@ export interface Prompts {
 }
 export declare const NO_SESSION_NO_TTY_MESSAGE: string;
 export declare const TENANT_REQUIRED_MESSAGE = "--tenant is required (no TTY for interactive mode)";
+export declare const REGISTRY_WHY: string;
 export declare const INTERRUPTED_EXIT_CODE = 130;
+export declare const PLATFORM_SETUP_LABEL = "Platform setup";
 export declare function wizardExitCode(steps: ReadonlyArray<Pick<StepResult, "status">>): number;
 export declare function wizardNextCommands(mode: WizardMode, steps?: ReadonlyArray<StepResult>): string[];
 export declare function stepBlocks(result: StepResult): boolean;
@@ -85,7 +102,9 @@ export declare function resolveAnswers(opts: WizardOptions, recorded: MeshJson |
     mode?: WizardMode;
     open: Array<"tenant" | "mode">;
 };
+export declare function platformSetupFlags(opts: WizardOptions): PlatformSetupFlags;
 export declare const registryStep: WizardStep;
+export declare const newPlatformStep: WizardStep;
 export type RepoKind = "platform-monorepo" | "empty-apps-repo" | "apps-repo" | "other-repo" | "empty-dir" | "no-repo";
 export declare function classifyRepo(cwd: string): {
     kind: RepoKind;
@@ -93,6 +112,7 @@ export declare function classifyRepo(cwd: string): {
 };
 export declare const INIT_REPO_FIX = "git init && mesh init";
 export declare const repoStep: WizardStep;
+export declare const skillsStep: WizardStep;
 export declare const WIZARD_STEPS: readonly WizardStep[];
 export declare function runWizardSteps(ctx: WizardCtx, steps: readonly WizardStep[]): Promise<StepResult[]>;
 export declare function runInitWizard(opts: WizardOptions, deps?: {

package/dist/src/commands/init/wizard.js

@@ -12,10 +12,17 @@ import { discoverConfigForContext, isRemoteEnvironment, readCredentials, renderN
 import { bootstrapAppsRepo, isInsidePlatformMonorepo, shouldBootstrapAppsRepo } from "../create-app.js";
 import { resolveTargetRoot, syncSkills } from "../skills.js";
 import { detectLocalTenant } from "../local/dev-local.js";
+import { PLATFORM_SETUP_DEFAULTS, ensureStateBucket, renderPlatformNextSteps, resolvePlatformSetup, scaffoldPlatformRepo, } from "./platform-setup.js";
+export function isNewPlatform(mode) {
+    return typeof mode === "object" && "newPlatform" in mode;
+}
 export const NO_SESSION_NO_TTY_MESSAGE = "No registry session and no terminal to sign in with.\n" +
     "  On a headless box: mesh registry login --device   (one-time, prints a code)\n" +
     "  In CI with AWS creds: mesh registry login --ci";
 export const TENANT_REQUIRED_MESSAGE = "--tenant is required (no TTY for interactive mode)";
+export const REGISTRY_WHY = "Package access — a sign-in to the Mesh package REGISTRY, which is what makes `@mesh-tech/*` installable.\n" +
+    "  It is one global identity: no AWS account, no platform, no <tenant>.<env> context.\n" +
+    "  (`mesh login <tenant>.<env>` is the other sign-in — that one is only for deploying to, or operating, a platform.)";
 export const INTERRUPTED_EXIT_CODE = 130;
 const STEP_LABELS = {
     registry: "Registry access",
@@ -23,10 +30,14 @@ const STEP_LABELS = {
     repo: "Repo",
     skills: "Agent skills",
 };
+export const PLATFORM_SETUP_LABEL = "Platform setup";
 export function wizardExitCode(steps) {
     return steps.some((s) => s.status === "fail") ? 1 : 0;
 }
 export function wizardNextCommands(mode, steps = []) {
+    const owned = steps.find((s) => s.next?.length)?.next;
+    if (owned)
+        return owned;
     const repo = steps.find((s) => s.name === STEP_LABELS.repo);
     const first = repo && repo.status !== "pass" && repo.fix ? repo.fix : "mesh create-app";
     return mode === "local" ? [first] : [first, "mesh deploy up   # from the app directory, once it exists"];
@@ -35,7 +46,11 @@ export function stepBlocks(result) {
     return result.status === "fail" && result.blocking !== false;
 }
 export function describeMode(mode) {
-    return mode === "local" ? "local only" : `deployed platform (${mode.platform})`;
+    if (mode === "local")
+        return "local only";
+    if (isNewPlatform(mode))
+        return `a new platform (${mode.newPlatform.env ?? PLATFORM_SETUP_DEFAULTS.env})`;
+    return `deployed platform (${mode.platform})`;
 }
 export function renderWizardSummary(outcome, opts = {}) {
     const paint = opts.color === false ? { green: (s) => s, red: (s) => s, yellow: (s) => s, dim: (s) => s, cyan: (s) => s } : chalk;
@@ -65,10 +80,13 @@ export function resolveAnswers(opts, recorded, interactive) {
         open.push("tenant");
     }
     let mode;
-    if (opts.local && opts.platform) {
-        throw new MeshCliError("--local and --platform are mutually exclusive.");
+    const chosen = [opts.local && "--local", opts.platform && "--platform", opts.newPlatform && "--new-platform"].filter(Boolean);
+    if (chosen.length > 1) {
+        throw new MeshCliError(`${chosen.join(", ")} are mutually exclusive — a tenant runs in exactly one of those three places.`);
     }
-    if (opts.platform)
+    if (opts.newPlatform)
+        mode = { newPlatform: platformSetupFlags(opts) };
+    else if (opts.platform)
         mode = { platform: opts.platform };
     else if (opts.local)
         mode = "local";
@@ -80,6 +98,18 @@ export function resolveAnswers(opts, recorded, interactive) {
     }
     return { tenant, mode, open };
 }
+export function platformSetupFlags(opts) {
+    return {
+        env: typeof opts.newPlatform === "string" ? opts.newPlatform : undefined,
+        region: opts.region,
+        domain: opts.domain,
+        profile: opts.profile,
+        stateBucket: opts.stateBucket,
+        createStateBucket: opts.createStateBucket,
+        dir: opts.dir,
+        yes: opts.yes,
+    };
+}
 export const registryStep = {
     name: "registry",
     async run(ctx) {
@@ -102,6 +132,7 @@ export const registryStep = {
             return { name, status: "fail", detail: NO_SESSION_NO_TTY_MESSAGE.split("\n")[0], fix: "mesh registry login --device", blocking: true };
         }
         try {
+            logInfo(REGISTRY_WHY);
             const login = ctx.seams?.runRegistryLogin ??
                 (async (opts) => {
                     const { runRegistryLogin } = await import("../registry.js");
@@ -132,10 +163,51 @@ export const registryStep = {
         return { name, status: "pass", detail: `Registry access OK (${session ? `signed in as ${session.email}` : "token written"})` };
     },
 };
+export const newPlatformStep = {
+    name: "platform",
+    async run(ctx) {
+        const name = PLATFORM_SETUP_LABEL;
+        if (!isNewPlatform(ctx.mode))
+            return { name, status: "skip", detail: "no new platform requested" };
+        let setup;
+        try {
+            setup = await resolvePlatformSetup(ctx.tenant, { ...ctx.mode.newPlatform, yes: ctx.yes }, {
+                prompts: ctx.prompts,
+                interactive: ctx.interactive,
+                cwd: ctx.cwd,
+            });
+        }
+        catch (err) {
+            return {
+                name,
+                status: "fail",
+                detail: err.message.split("\n")[0],
+                fix: `mesh init --tenant ${ctx.tenant} --new-platform --domain <your-domain>`,
+            };
+        }
+        try {
+            await (ctx.seams?.scaffoldPlatform ?? scaffoldPlatformRepo)(setup);
+        }
+        catch (err) {
+            return { name, status: "fail", detail: `platform repo not scaffolded: ${err.message.split("\n")[0]}`, fix: `mesh init platform ${ctx.tenant} --dir <empty-dir>` };
+        }
+        const bucket = await ensureStateBucket(setup, ctx.seams?.stateBucket);
+        const next = renderPlatformNextSteps(setup, { bucket, relativeDir: path.relative(ctx.cwd, setup.dir) || "." });
+        return {
+            name,
+            status: setup.createStateBucket && !bucket.present ? "warn" : "pass",
+            detail: `platform repo scaffolded at ${setup.dir} (${setup.tenant}.${setup.env}, ${setup.region}, zone ${setup.env}.${setup.domain})` +
+                (setup.createStateBucket ? ` — state bucket: ${bucket.detail}` : ` — state bucket ${setup.stateBucket} not created (see Next)`),
+            next,
+        };
+    },
+};
 const platformStep = {
     name: "platform",
     async run(ctx) {
         const name = STEP_LABELS.platform;
+        if (isNewPlatform(ctx.mode))
+            return newPlatformStep.run(ctx);
         if (!ctx.context)
             return { name, status: "skip", detail: "local only — no platform to sign in to" };
         const context = ctx.context;
@@ -192,6 +264,9 @@ export const repoStep = {
         const name = STEP_LABELS.repo;
         if (ctx.skipRepo)
             return { name, status: "skip", detail: "--skip-repo" };
+        if (isNewPlatform(ctx.mode)) {
+            return { name, status: "skip", detail: "setting up a platform — the apps repo comes after the first deploy (see Next)" };
+        }
         const { kind, root } = classifyRepo(ctx.cwd);
         switch (kind) {
             case "platform-monorepo":
@@ -259,12 +334,15 @@ export const repoStep = {
         }
     },
 };
-const skillsStep = {
+export const skillsStep = {
     name: "skills",
     async run(ctx) {
         const name = STEP_LABELS.skills;
         if (ctx.skipRepo)
             return { name, status: "skip", detail: "--skip-repo" };
+        if (isNewPlatform(ctx.mode)) {
+            return { name, status: "skip", detail: "synced into the new platform repo by the scaffold" };
+        }
         const { kind, root } = classifyRepo(ctx.cwd);
         if (kind !== "apps-repo" && kind !== "empty-apps-repo") {
             return { name, status: "skip", detail: "no apps repo to install skills into" };
@@ -341,11 +419,15 @@ export async function runInitWizard(opts, deps = {}) {
                 choices: [
                     { name: "Local only (mesh start / mesh dev — no deployed platform yet)", value: "local" },
                     { name: `A deployed Mesh platform (I have a ${tenant}.<env> context)`, value: "deployed" },
+                    { name: "Nothing yet — set up a new Mesh platform in my AWS account", value: "new" },
                 ],
                 default: recorded && recorded.platform !== "local" ? "deployed" : "local",
             });
             if (choice === "local")
                 mode = "local";
+            else if (choice === "new") {
+                mode = { newPlatform: platformSetupFlags({ ...opts, newPlatform: true }) };
+            }
             else {
                 const env = await prompts.input({
                     message: "Environment",
@@ -359,7 +441,7 @@ export async function runInitWizard(opts, deps = {}) {
             cwd,
             tenant,
             mode,
-            context: mode === "local" ? null : `${tenant}.${mode.platform}`,
+            context: mode === "local" || isNewPlatform(mode) ? null : `${tenant}.${mode.platform}`,
             device: opts.device,
             profile: opts.profile,
             interactive,
@@ -372,7 +454,7 @@ export async function runInitWizard(opts, deps = {}) {
         logInfo(`Setting up tenant '${tenant}' (${describeMode(mode)})…`);
         const steps = await runWizardSteps(ctx, deps.steps ?? WIZARD_STEPS);
         const { kind, root } = classifyRepo(cwd);
-        if (!opts.skipRepo && (kind === "apps-repo" || kind === "empty-apps-repo")) {
+        if (!opts.skipRepo && !isNewPlatform(mode) && (kind === "apps-repo" || kind === "empty-apps-repo")) {
             const written = writeMeshJson(root, { tenant, platform: mode === "local" ? "local" : mode.platform });
             logInfo(`Recorded tenant + mode in ${written}`);
         }

package/dist/src/commands/init.js

@@ -8,6 +8,14 @@ import { readCredentials } from "./login.js";
 import { resolveTargetRoot, syncSkills } from "./skills.js";
 import { detectLocalTenant } from "./local/dev-local.js";
 import { LOGIN_CONTEXT } from "./local/seed-zitadel.js";
+import { PLATFORM_SETUP_DEFAULTS } from "./init/platform-setup.js";
+async function setupPrompts() {
+    const [{ default: input }, { default: confirm }] = await Promise.all([
+        import("@inquirer/input"),
+        import("@inquirer/confirm"),
+    ]);
+    return { input: (args) => input(args), confirm: (args) => confirm(args) };
+}
 const LOCAL_HUB_API = "http://localhost:4568";
 function isLocalContext(context) {
     return context === LOGIN_CONTEXT;
@@ -211,12 +219,19 @@ export function registerInitCommands(program) {
     const init = program
         .command("init")
         .enablePositionalOptions()
-        .description("Set up this machine and repo for a tenant — a guided wizard with no subcommand (tenant, local or deployed, package-registry sign-in, repo, skills); `init platform` scaffolds a platform repo, `init app-tenant` is the apps-repo doctor")
+        .description("Set up this machine and repo for a tenant — a guided wizard with no subcommand. It starts from nothing: it asks where the tenant runs, and 'nowhere yet' is one of the answers (it scaffolds you a platform). Then package-registry sign-in, repo, skills. `init platform` is the same scaffold on its own; `init app-tenant` is the apps-repo doctor")
         .option("--tenant <name>", "app tenant this repo belongs to (prompted when omitted on a TTY)")
         .option("--local", "local only — mesh start / mesh dev, no deployed platform (the default)")
-        .option("--platform <env>", "a deployed platform's environment; signs in to <tenant>.<env>")
+        .option("--platform <env>", "a deployed platform's environment; signs in to `<tenant>.<env>`")
+        .option("--new-platform [env]", `nothing deployed yet — scaffold a tenant platform repo for \`<tenant>.<env>\` (default env: ${PLATFORM_SETUP_DEFAULTS.env}) and print its deploy sequence`)
+        .option("--region <region>", `--new-platform: AWS region (default: ${PLATFORM_SETUP_DEFAULTS.region})`)
+        .option("--domain <domain>", "--new-platform: base public domain you control; the core stack creates the zone {env}.{domain}. No default — a placeholder scaffolds a zone that can never validate")
+        .option("--state-bucket <bucket>", "--new-platform: Pulumi state S3 bucket (default: {tenant}-mesh-platform-pulumi-state)")
+        .option("--create-state-bucket", "--new-platform: create the state bucket (versioned) if it does not exist")
+        .option("--no-create-state-bucket", "--new-platform: never create the state bucket; print the aws command instead")
+        .option("--dir <path>", "--new-platform: where to scaffold the platform repo (default: ./{tenant}-mesh-platform)")
         .option("--device", "device-code sign-in for the registry and platform steps (headless / SSH)")
-        .option("--profile <aws-profile>", "deployers only: AWS profile that can read the registry (skips the broker)")
+        .option("--profile <aws-profile>", "AWS profile this machine uses: read the registry without the broker (deployers only), and the profile a --new-platform stack config references")
         .option("--skip-repo", "do not bootstrap, check or record anything in the current repo", false)
         .option("--yes", "accept every default and never prompt", false)
         .option("--json", "one JSON document on stdout ({tenant, mode, steps, next}); human output on stderr", false)
@@ -228,47 +243,38 @@ export function registerInitCommands(program) {
     });
     init
         .command("platform <tenant>")
-        .description("Scaffold a tenant PLATFORM repo (core + platform Pulumi layers on @mesh-tech/infra-components) that deploys with `mesh deploy` unmodified — the proven mesh-sandbox shape, annotated.")
-        .option("--env <env>", "environment the first stack targets", "dev")
-        .option("--region <region>", "AWS region", "us-east-2")
-        .option("--domain <domain>", "base public domain (ingress zone becomes {env}.{domain})", "example.com")
-        .option("--profile <profile>", "AWS profile the stack config references", "default")
-        .option("--state-bucket <bucket>", "Pulumi state S3 bucket (created by an operator)", undefined)
+        .description("Scaffold a tenant PLATFORM repo (core + platform Pulumi layers on @mesh-tech/infra-components) that deploys with `mesh deploy` unmodified — the proven mesh-sandbox shape, annotated. On a terminal it ASKS for the values that differ per install (env, region, domain, state bucket, AWS profile), each pre-filled with its default; every answer is also a flag.")
+        .option("--env <env>", `environment the first stack targets (default: ${PLATFORM_SETUP_DEFAULTS.env})`)
+        .option("--region <region>", `AWS region (default: ${PLATFORM_SETUP_DEFAULTS.region})`)
+        .option("--domain <domain>", "base public domain you control — the core stack creates the Route 53 zone {env}.{domain} and waits on its NS delegation. Required: it has no default, because a placeholder scaffolds a zone that can never validate")
+        .option("--profile <profile>", `AWS profile the stack config references (default: ${PLATFORM_SETUP_DEFAULTS.profile})`)
+        .option("--state-bucket <bucket>", "Pulumi state S3 bucket (default: {tenant}-mesh-platform-pulumi-state)")
+        .option("--create-state-bucket", "create the state bucket (versioned) if it does not exist — prompted on a terminal")
+        .option("--no-create-state-bucket", "never create the state bucket; print the aws command instead")
         .option("--dir <path>", "target directory (default: ./{tenant}-mesh-platform)")
+        .option("--yes", "accept every default and never prompt", false)
         .action(async (tenant, opts) => {
         if (!/^[a-z][a-z0-9-]*$/.test(tenant)) {
             throw new MeshCliError(`Invalid tenant name '${tenant}' (lowercase alphanumeric + dashes).`);
         }
-        const targetDir = path.resolve(opts.dir ?? `${tenant}-mesh-platform`);
-        if (fs.existsSync(targetDir) && fs.readdirSync(targetDir).length > 0) {
-            throw new MeshCliError(`Target directory is not empty: ${targetDir}`, {
-                remediation: { command: `mesh init platform ${tenant} --dir <empty-dir>` },
-            });
-        }
-        const { copyTemplate } = await import("./create-app.js");
-        const { findPackageRoot } = await import("./local/stack.js");
-        const templateDir = path.join(findPackageRoot(), "templates", "platform-repo");
-        const context = {
-            tenant,
-            env: opts.env,
-            region: opts.region,
-            domain: opts.domain,
-            profile: opts.profile,
-            stateBucket: opts.stateBucket ?? `${tenant}-mesh-platform-pulumi-state`,
-        };
-        fs.mkdirSync(targetDir, { recursive: true });
-        copyTemplate(templateDir, targetDir, context);
-        syncSkills(targetDir);
-        logInfo(`Platform repo scaffolded at ${targetDir}`);
+        const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+        const { resolvePlatformSetup, scaffoldPlatformRepo, ensureStateBucket, renderPlatformNextSteps } = await import("./init/platform-setup.js");
+        const setup = await resolvePlatformSetup(tenant, opts, {
+            prompts: interactive && !opts.yes ? await setupPrompts() : undefined,
+            interactive,
+        });
+        await scaffoldPlatformRepo(setup);
+        logInfo(`Platform repo scaffolded at ${setup.dir}`);
+        const bucket = await ensureStateBucket(setup);
+        if (bucket.detail !== "not requested")
+            logInfo(`Pulumi state bucket: ${bucket.detail}`);
         console.log("");
         console.log("Next steps:");
-        console.log(`  cd ${path.relative(process.cwd(), targetDir) || "."}`);
-        console.log(`  mesh login ${tenant}.${opts.env}     # or an operator context with access`);
-        console.log("  pnpm install");
-        console.log("  cd core && mesh deploy up");
-        console.log("  cd ../platform && mesh deploy up");
+        for (const line of renderPlatformNextSteps(setup, { bucket, relativeDir: path.relative(process.cwd(), setup.dir) || "." })) {
+            console.log(line ? `  ${line}` : "");
+        }
         console.log("");
-        logInfo(`Review the annotated stack configs (Pulumi.${tenant}-${opts.env}.yaml) before the first deploy.`);
+        logInfo(`Review the annotated stack configs (Pulumi.${tenant}-${setup.env}.yaml) before the first deploy.`);
     });
     init
         .command("app-tenant")

package/dist/src/commands/local/index.d.ts

@@ -1,10 +1,12 @@
 import { Command } from "commander";
-import { type ServiceStatus, type StackEndpoint } from "./stack.js";
+import { type OverlayState, type ServiceStatus, type StackEndpoint } from "./stack.js";
 export interface WaitForStackIo {
     probe: (endpoint: StackEndpoint) => Promise<boolean>;
     services: () => ServiceStatus[];
-    overlayServices: () => ReadonlySet<string>;
+    overlays: () => readonly OverlayState[];
 }
-export declare function waitForStack(io?: WaitForStackIo): Promise<void>;
+export declare function waitForStack(opts: {
+    idpsStarted: boolean;
+}, io?: WaitForStackIo): Promise<void>;
 export declare function startHereLines(hubRunning: boolean, up?: ReadonlyMap<string, boolean>): string[];
 export declare function registerLocalCommands(program: Command): void;

package/dist/src/commands/local/index.js

@@ -3,12 +3,13 @@ import * as path from "path";
 import chalk from "chalk";
 import { logError, logInfo, logSuccess, logWarn } from "../../utils/log.js";
 import { MeshCliError } from "../../utils/errors.js";
-import { compose, COMPOSE_PROJECT, composeStreamed, crashedServices, DEFAULT_HUB_PORT, ensureDockerAvailable, findPackageRoot, hubApiRunning, hubEndpoints, hubOverlayRunning, hubOverlayServices, hubPort, ONE_SHOT_SERVICES, probeEndpoint, STACK_ENDPOINTS, stackOwnedElsewhere, stackServices, } from "./stack.js";
+import { compose, COMPOSE_PROJECT, composeStreamed, crashedServices, DEFAULT_HUB_PORT, ensureDockerAvailable, findPackageRoot, hubApiRunning, hubEndpoints, hubOverlayServices, hubPort, idpsOverlayServices, ONE_SHOT_SERVICES, overlayRunning, probeEndpoint, STACK_ENDPOINTS, stackOwnedElsewhere, stackServices, } from "./stack.js";
 import { probeRegistryToken, REGISTRY_LOGIN_FIX } from "../../utils/auth-preflight.js";
 import { ensureHubAuthImage, ensureHubImages, buildHubImagesFromSource, readHubCompiledAuthz, hasRegistryAuth, localHubVersion, planWithHubRefresh, } from "./hub-local.js";
 import { reconcileRegistryFromZitadel } from "./auth-provision.js";
 import { LOCAL_AWS_CONFIG, localAwsEnv, seedLocalPlatform, verifyFabric } from "./seed.js";
-import { LOGIN_CONTEXT, readHubAuth, seedZitadel, TEST_USERS } from "./seed-zitadel.js";
+import { LOGIN_CONTEXT, readHubAuth, seedMockIdps, seedZitadel, TEST_USERS } from "./seed-zitadel.js";
+import { idpEndpoints, mockIdpComposeEnv, MOCK_OIDC_PORT, MOCK_SAML_PORT } from "./mock-idps.js";
 import { publishHubAuthzCatalog } from "./seed-hub-catalog.js";
 import { describePortConflicts, findPortConflicts, hostPortsOf } from "./helpers.js";
 const WAIT_TIMEOUT_MS = 180_000;
@@ -20,10 +21,13 @@ function crashError(crashed) {
         },
     });
 }
-export async function waitForStack(io = {
+export async function waitForStack(opts, io = {
     probe: probeEndpoint,
     services: stackServices,
-    overlayServices: hubOverlayServices,
+    overlays: () => [
+        { services: hubOverlayServices(), started: false },
+        { services: idpsOverlayServices(), started: opts.idpsStarted },
+    ],
 }) {
     const deadline = Date.now() + WAIT_TIMEOUT_MS;
     let pending = STACK_ENDPOINTS.filter((e) => e.probe.kind !== "none");
@@ -39,10 +43,7 @@ export async function waitForStack(io = {
             }
         }
         pending = stillDown;
-        const crashed = crashedServices(io.services(), {
-            overlayServices: io.overlayServices(),
-            overlayStarted: false,
-        });
+        const crashed = crashedServices(io.services(), { overlays: io.overlays() });
         if (crashed.length > 0)
             throw crashError(crashed);
         if (pending.length === 0)
@@ -112,6 +113,11 @@ function portMoveHints() {
             Number(hubPort()),
             "MESH_HUB_PORT=<free port> mesh start   (or mesh start --no-hub, which starts everything else)",
         ],
+        [MOCK_SAML_PORT, "mesh start   (without --with-idps — the mock identity providers are opt-in)"],
+        [
+            MOCK_OIDC_PORT,
+            "mesh start   (without --with-idps; 5556 is Dex's own default port, so a Dex of your own is the usual holder)",
+        ],
     ]);
 }
 function repoRootForHubSource() {
@@ -133,6 +139,7 @@ export function registerLocalCommands(program) {
         .option("--no-hub", "start without the Hub (API + UI)")
         .option("--with-hub", "force-refresh the Hub to the latest published @mesh-tech/hub (the Hub is included by default when its images exist or registry auth is available)")
         .option("--hub-from-source", "build the Hub images from THIS checkout's apps/hub instead of the published tarball (the only way to exercise a Hub change locally)")
+        .option("--with-idps", "also run mock SAML and OIDC identity providers, and federate the local Zitadel with both (for testing enterprise SSO without a cloud tenant or an IdP admin)", false)
         .option("--takeover", "re-own a stack that another checkout started (may recreate shared containers with THIS checkout's config)", false)
         .option("--skip-port-check", "start even though a host port the stack wants is already held (the service that loses the bind will be broken — use when the holder is something you cannot stop)", false)
         .action(async (opts) => {
@@ -151,7 +158,11 @@ export function registerLocalCommands(program) {
             logWarn(`Taking over the running stack (previously driven from ${foreign}).`);
         }
         if (!opts.skipPortCheck && !stackServices().some((s) => s.state === "running")) {
-            const ports = hostPortsOf([...STACK_ENDPOINTS, ...(opts.hub ? hubEndpoints() : [])]);
+            const ports = hostPortsOf([
+                ...STACK_ENDPOINTS,
+                ...(opts.hub ? hubEndpoints() : []),
+                ...(opts.withIdps ? idpEndpoints() : []),
+            ]);
             const conflicts = await findPortConflicts(ports, `${COMPOSE_PROJECT}-`);
             if (conflicts.length > 0) {
                 throw new MeshCliError(describePortConflicts(conflicts, portMoveHints()), {
@@ -197,9 +208,10 @@ export function registerLocalCommands(program) {
             }
         }
         logInfo("Starting the local Mesh platform (docker compose project: mesh-local)…");
-        await composeStreamed(["up", "-d"]);
+        const idpEnv = opts.withIdps ? mockIdpComposeEnv() : undefined;
+        await composeStreamed(["up", "-d"], { idps: opts.withIdps, env: idpEnv });
         compose(["restart", "prometheus", "blackbox-exporter"], { inherit: true });
-        await waitForStack();
+        await waitForStack({ idpsStarted: opts.withIdps });
         let hubAuth = readHubAuth();
         if (opts.seed) {
             logInfo("Seeding local platform (tenant registry, artifacts bucket)…");
@@ -207,6 +219,15 @@ export function registerLocalCommands(program) {
             logInfo("Seeding Zitadel (Platform project, Mesh CLI app, Hub auth, test users)…");
             const zitadel = await seedZitadel(LOCAL_AWS_CONFIG);
             hubAuth = zitadel.hubAuth;
+            if (opts.withIdps) {
+                logInfo("Federating local Zitadel with the mock SAML and OIDC identity providers…");
+                await seedMockIdps();
+                logInfo(`Mock SAML IdP: http://localhost:${MOCK_SAML_PORT}  ·  ` +
+                    `mock OIDC IdP: http://localhost:${MOCK_OIDC_PORT}/dex  ·  ` +
+                    "sign in at http://localhost:8080 and both federation buttons are offered");
+                logInfo("Both are listed in the Zitadel console under Settings → Identity Providers (owner: Instance): " +
+                    "http://localhost:8080/ui/console/org-settings?id=idp");
+            }
             if (hubVersion) {
                 const compiled = readHubCompiledAuthz(hubVersion);
                 if (compiled) {
@@ -246,19 +267,23 @@ export function registerLocalCommands(program) {
                 hubEnv.MESH_HUB_OAUTH2_CLIENT_SECRET = hubAuth.clientSecret;
                 hubEnv.MESH_HUB_OAUTH2_COOKIE_SECRET = hubAuth.cookieSecret;
             }
-            await composeStreamed(["up", "-d"], { hub: true, env: hubEnv });
+            await composeStreamed(["up", "-d"], {
+                hub: true,
+                idps: opts.withIdps,
+                env: { ...idpEnv, ...hubEnv },
+            });
             if (opts.seed) {
                 compose(["restart", "hub-api"], { hub: true, env: hubEnv });
             }
-            const overlayServices = hubOverlayServices();
+            const overlays = [
+                { services: hubOverlayServices(), started: true },
+                { services: idpsOverlayServices(), started: opts.withIdps },
+            ];
             for (const endpoint of hubEndpoints()) {
                 logInfo(`Waiting for ${endpoint.label}…`);
                 let up = await probeEndpoint(endpoint);
                 for (let i = 0; i < 60 && !up; i++) {
-                    const crashed = crashedServices(stackServices(), {
-                        overlayServices,
-                        overlayStarted: true,
-                    });
+                    const crashed = crashedServices(stackServices(), { overlays });
                     if (crashed.length > 0)
                         throw crashError(crashed);
                     await new Promise((resolve) => setTimeout(resolve, 2000));
@@ -310,11 +335,20 @@ export function registerLocalCommands(program) {
                 remediation: { command: "mesh start" },
             });
         }
-        const overlayServices = hubOverlayServices();
-        const overlayStarted = hubOverlayRunning(services, overlayServices);
-        const notStarted = (s) => !overlayStarted && overlayServices.has(s.name) && s.state === "exited";
+        const hubOverlay = hubOverlayServices();
+        const idpsOverlay = idpsOverlayServices();
+        const idpsStarted = overlayRunning(services, idpsOverlay);
+        const overlays = [
+            { services: hubOverlay, started: overlayRunning(services, hubOverlay) },
+            { services: idpsOverlay, started: idpsStarted },
+        ];
+        const notStarted = (s) => s.state === "exited" && overlays.some((o) => !o.started && o.services.has(s.name));
         const hasHub = hubApiRunning(services);
-        const endpoints = hasHub ? [...STACK_ENDPOINTS, ...hubEndpoints()] : STACK_ENDPOINTS;
+        const endpoints = [
+            ...STACK_ENDPOINTS,
+            ...(hasHub ? hubEndpoints() : []),
+            ...(idpsStarted ? idpEndpoints() : []),
+        ];
         const probes = await Promise.all(endpoints.map(async (endpoint) => ({
             service: endpoint.service,
             label: endpoint.label,
@@ -337,6 +371,7 @@ export function registerLocalCommands(program) {
                 services,
                 endpoints: probes,
                 fabric,
+                mockIdps: idpsStarted,
                 awsEnv: localAwsEnv(),
             }));
             if (fabric && !fabric.ok)
@@ -352,7 +387,7 @@ export function registerLocalCommands(program) {
             const idle = notStarted(service);
             const icon = ok || oneShotDone ? chalk.green("●") : idle ? chalk.dim("○") : chalk.red("●");
             const health = service.health ? ` (${service.health})` : "";
-            const note = idle ? chalk.dim("  (Hub not started this run)") : "";
+            const note = idle ? chalk.dim("  (not started this run)") : "";
             console.log(`  ${icon} ${service.name.padEnd(22)} ${service.state}${health}${note}`);
         }
         console.log("");
@@ -366,8 +401,11 @@ export function registerLocalCommands(program) {
             const detail = fabric.ok ? "8 KB Advanced-tier round-trip OK" : fabric.error;
             console.log(`  ${icon} ${"AWS fabric check".padEnd(34)} ${chalk.dim(detail ?? "")}`);
         }
+        if (!idpsStarted) {
+            console.log(`  ${chalk.dim("○")} ${"Mock IdPs (SAML + OIDC)".padEnd(34)} ${chalk.dim("not started — mesh start --with-idps")}`);
+        }
         const down = probes.filter((p) => !p.up);
-        const crashed = crashedServices(services, { overlayServices, overlayStarted });
+        const crashed = crashedServices(services, { overlays });
         if (fabric && !fabric.ok)
             process.exitCode = 1;
         if (down.length > 0 || crashed.length > 0) {

package/dist/src/commands/local/mock-idps.d.ts

@@ -0,0 +1,48 @@
+import type { StackEndpoint } from "./stack.js";
+export declare const MOCK_SAML_PORT = 4569;
+export declare const MOCK_OIDC_PORT = 5556;
+export declare const idpEndpoints: () => StackEndpoint[];
+export declare const MOCK_SAML_IDP_NAME = "Mock SAML (local)";
+export declare const MOCK_OIDC_IDP_NAME = "Mock OIDC (local)";
+export declare const mockSamlMetadataUrl: () => string;
+export declare const mockOidcEndpoints: () => {
+    authorization: string;
+    token: string;
+    user: string;
+};
+export declare function ensureMockSamlSigningKey(): {
+    publicKeyB64: string;
+    privateKeyB64: string;
+};
+export declare const mockIdpComposeEnv: () => Record<string, string>;
+export declare const buildMockSamlIdpBody: (metadataXml: string) => {
+    name: string;
+    metadataXml: string;
+    binding: string;
+    withSignedRequest: boolean;
+    providerOptions: {
+        isLinkingAllowed: boolean;
+        isCreationAllowed: boolean;
+        isAutoCreation: boolean;
+        isAutoUpdate: boolean;
+        autoLinking: string;
+    };
+};
+export declare const buildMockOauthIdpBody: () => {
+    name: string;
+    clientId: string;
+    clientSecret: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    userEndpoint: string;
+    scopes: string[];
+    idAttribute: string;
+    providerOptions: {
+        isLinkingAllowed: boolean;
+        isCreationAllowed: boolean;
+        isAutoCreation: boolean;
+        isAutoUpdate: boolean;
+        autoLinking: string;
+    };
+};
+export declare const missingLoginPolicyIdps: (attached: readonly string[], wanted: readonly string[]) => string[];