@mesh-tech/mesh-cli 0.26.0 → 0.28.0

package/dist/bin/mesh.js

@@ -1251,9 +1251,11 @@ var init_cache_home = __esm({
 // libs/mesh-cli/src/commands/local/stack.ts
 var stack_exports = {};
 __export(stack_exports, {
+  BASE_COMPOSE_FILE: () => BASE_COMPOSE_FILE,
   COMPOSE_PROJECT: () => COMPOSE_PROJECT,
   DEFAULT_HUB_PORT: () => DEFAULT_HUB_PORT,
   HUB_OVERLAY_FILE: () => HUB_OVERLAY_FILE,
+  IDPS_OVERLAY_FILE: () => IDPS_OVERLAY_FILE,
   ONE_SHOT_SERVICES: () => ONE_SHOT_SERVICES,
   STACK_ENDPOINTS: () => STACK_ENDPOINTS,
   compose: () => compose,
@@ -1264,11 +1266,12 @@ __export(stack_exports, {
   findPackageRoot: () => findPackageRoot,
   hubApiRunning: () => hubApiRunning,
   hubEndpoints: () => hubEndpoints,
-  hubOverlayRunning: () => hubOverlayRunning,
   hubOverlayServices: () => hubOverlayServices,
   hubPort: () => hubPort,
+  idpsOverlayServices: () => idpsOverlayServices,
   localLogsDir: () => localLogsDir,
   localProbesDir: () => localProbesDir,
+  overlayRunning: () => overlayRunning,
   parseComposePs: () => parseComposePs,
   parseComposeServiceNames: () => parseComposeServiceNames,
   probeEndpoint: () => probeEndpoint,
@@ -1368,17 +1371,29 @@ function parseComposeServiceNames(yamlText) {
   const doc = parseYaml(yamlText);
   return Object.keys(doc?.services ?? {});
 }
-function hubOverlayServices() {
-  if (!hubOverlayServicesCache) {
-    const file = path5.join(stackDir(), HUB_OVERLAY_FILE);
-    if (!fs5.existsSync(file)) {
-      throw new MeshCliError(`Local stack assets are incomplete: ${file} is missing.`, {
-        remediation: { command: "npm install -g @mesh-tech/mesh-cli" }
-      });
-    }
-    hubOverlayServicesCache = new Set(parseComposeServiceNames(fs5.readFileSync(file, "utf-8")));
+function overlayServicesOf(overlayFile) {
+  const cached = overlayServicesCache.get(overlayFile);
+  if (cached) return cached;
+  const file = path5.join(stackDir(), overlayFile);
+  if (!fs5.existsSync(file)) {
+    throw new MeshCliError(`Local stack assets are incomplete: ${file} is missing.`, {
+      remediation: { command: "npm install -g @mesh-tech/mesh-cli" }
+    });
   }
-  return hubOverlayServicesCache;
+  const base = new Set(
+    parseComposeServiceNames(fs5.readFileSync(path5.join(stackDir(), BASE_COMPOSE_FILE), "utf-8"))
+  );
+  const names = new Set(
+    parseComposeServiceNames(fs5.readFileSync(file, "utf-8")).filter((n) => !base.has(n))
+  );
+  overlayServicesCache.set(overlayFile, names);
+  return names;
+}
+function hubOverlayServices() {
+  return overlayServicesOf(HUB_OVERLAY_FILE);
+}
+function idpsOverlayServices() {
+  return overlayServicesOf(IDPS_OVERLAY_FILE);
 }
 function stackOwnedElsewhere() {
   try {
@@ -1416,6 +1431,7 @@ function compose(args, opts = {}) {
   const dir = stackDir();
   const files = ["-f", path5.join(dir, "docker-compose.yml")];
   if (opts.hub) files.push("-f", path5.join(dir, "docker-compose.hub.yml"));
+  if (opts.idps) files.push("-f", path5.join(dir, IDPS_OVERLAY_FILE));
   const fullArgs = ["compose", "-p", COMPOSE_PROJECT, ...files, ...args];
   return execFileSync4("docker", fullArgs, {
     cwd: dir,
@@ -1451,6 +1467,7 @@ async function composeStreamed(args, opts = {}) {
   const dir = stackDir();
   const files = ["-f", path5.join(dir, "docker-compose.yml")];
   if (opts.hub) files.push("-f", path5.join(dir, "docker-compose.hub.yml"));
+  if (opts.idps) files.push("-f", path5.join(dir, IDPS_OVERLAY_FILE));
   const fullArgs = ["compose", "-p", COMPOSE_PROJECT, ...files, ...args];
   const env = {
     ...process.env,
@@ -1539,11 +1556,14 @@ function stackServices() {
   return parseComposePs(compose(["ps", "-a", "--format", "json"], { hub: true }));
 }
 function crashedServices(services, opts) {
+  const dormant = new Set(
+    opts.overlays.filter((o) => !o.started).flatMap((o) => [...o.services])
+  );
   return services.filter(
-    (s) => s.state === "exited" && !ONE_SHOT_SERVICES.has(s.name) && (opts.overlayStarted || !opts.overlayServices.has(s.name))
+    (s) => s.state === "exited" && !ONE_SHOT_SERVICES.has(s.name) && !dormant.has(s.name)
   );
 }
-function hubOverlayRunning(services, overlayServices) {
+function overlayRunning(services, overlayServices) {
   return services.some((s) => overlayServices.has(s.name) && s.state === "running");
 }
 function hubApiRunning(services) {
@@ -1563,7 +1583,7 @@ async function probeEndpoint(endpoint) {
   }
   return true;
 }
-var COMPOSE_PROJECT, STACK_ENDPOINTS, DEFAULT_HUB_PORT, HUB_OVERLAY_FILE, hubOverlayServicesCache, ONE_SHOT_SERVICES;
+var COMPOSE_PROJECT, STACK_ENDPOINTS, DEFAULT_HUB_PORT, BASE_COMPOSE_FILE, HUB_OVERLAY_FILE, IDPS_OVERLAY_FILE, overlayServicesCache, ONE_SHOT_SERVICES;
 var init_stack = __esm({
   "libs/mesh-cli/src/commands/local/stack.ts"() {
     "use strict";
@@ -1668,7 +1688,10 @@ var init_stack = __esm({
       }
     ];
     DEFAULT_HUB_PORT = "9000";
+    BASE_COMPOSE_FILE = "docker-compose.yml";
     HUB_OVERLAY_FILE = "docker-compose.hub.yml";
+    IDPS_OVERLAY_FILE = "docker-compose.idps.yml";
+    overlayServicesCache = /* @__PURE__ */ new Map();
     ONE_SHOT_SERVICES = /* @__PURE__ */ new Set(["spicedb-migrate", "zitadel-machinekey-init"]);
   }
 });
@@ -3803,11 +3826,11 @@ function readAllCredentials() {
 function readCredentials(context) {
   return readAllCredentials()[context] ?? null;
 }
-function atomicWriteFileSync(path47, data, mode) {
-  const tmpPath = `${path47}.${process.pid}.${atomicWriteCounter++}.tmp`;
+function atomicWriteFileSync(path48, data, mode) {
+  const tmpPath = `${path48}.${process.pid}.${atomicWriteCounter++}.tmp`;
   try {
     fs10.writeFileSync(tmpPath, data, { mode });
-    fs10.renameSync(tmpPath, path47);
+    fs10.renameSync(tmpPath, path48);
   } catch (err) {
     try {
       fs10.unlinkSync(tmpPath);
@@ -6674,10 +6697,143 @@ var init_src = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/local/seed-zitadel.ts
+// libs/mesh-cli/src/commands/local/mock-idps.ts
+import { execFileSync as execFileSync13 } from "child_process";
 import * as fs16 from "fs";
-import * as os5 from "os";
 import * as path16 from "path";
+function ensureMockSamlSigningKey() {
+  const dir = keyDir();
+  const certPath = path16.join(dir, "cert.pem");
+  const keyPath = path16.join(dir, "key.pem");
+  if (!fs16.existsSync(certPath) || !fs16.existsSync(keyPath)) {
+    fs16.mkdirSync(dir, { recursive: true });
+    try {
+      execFileSync13(
+        "openssl",
+        [
+          "req",
+          "-x509",
+          "-newkey",
+          "rsa:2048",
+          "-keyout",
+          keyPath,
+          "-out",
+          certPath,
+          "-days",
+          "3650",
+          "-nodes",
+          "-subj",
+          "/CN=mesh-local-mock-saml"
+        ],
+        { stdio: "ignore" }
+      );
+    } catch (cause) {
+      throw new MeshCliError("Could not generate the mock SAML signing key.", {
+        remediation: {
+          command: "openssl version   # openssl must be on PATH for --with-idps"
+        },
+        cause
+      });
+    }
+  }
+  return {
+    publicKeyB64: fs16.readFileSync(certPath).toString("base64"),
+    privateKeyB64: fs16.readFileSync(keyPath).toString("base64")
+  };
+}
+var MOCK_SAML_PORT, MOCK_OIDC_PORT, MOCK_OIDC_SERVICE, idpEndpoints, MOCK_SAML_IDP_NAME, MOCK_OIDC_IDP_NAME, MOCK_OIDC_CLIENT_ID, MOCK_OIDC_CLIENT_SECRET, mockSamlMetadataUrl, mockOidcEndpoints, keyDir, mockIdpComposeEnv, buildMockSamlIdpBody, buildMockOauthIdpBody, missingLoginPolicyIdps;
+var init_mock_idps = __esm({
+  "libs/mesh-cli/src/commands/local/mock-idps.ts"() {
+    "use strict";
+    init_cache_home();
+    init_errors();
+    MOCK_SAML_PORT = 4569;
+    MOCK_OIDC_PORT = 5556;
+    MOCK_OIDC_SERVICE = "mock-oidc";
+    idpEndpoints = () => [
+      {
+        service: "mock-saml",
+        label: "Mock SAML IdP",
+        url: `http://localhost:${MOCK_SAML_PORT}`,
+        probe: { kind: "http", url: mockSamlMetadataUrl() },
+        hint: "sign in as any email you type; federation metadata at /api/saml/metadata"
+      },
+      {
+        service: MOCK_OIDC_SERVICE,
+        label: "Mock OIDC IdP",
+        url: `http://localhost:${MOCK_OIDC_PORT}/dex`,
+        probe: {
+          kind: "http",
+          url: `http://localhost:${MOCK_OIDC_PORT}/dex/.well-known/openid-configuration`
+        },
+        hint: "dev@local.mesh or ops@local.mesh / password"
+      }
+    ];
+    MOCK_SAML_IDP_NAME = "Mock SAML (local)";
+    MOCK_OIDC_IDP_NAME = "Mock OIDC (local)";
+    MOCK_OIDC_CLIENT_ID = "mesh-local";
+    MOCK_OIDC_CLIENT_SECRET = "mesh-local-secret";
+    mockSamlMetadataUrl = () => `http://localhost:${MOCK_SAML_PORT}/api/saml/metadata`;
+    mockOidcEndpoints = () => ({
+      authorization: `http://localhost:${MOCK_OIDC_PORT}/dex/auth`,
+      token: `http://${MOCK_OIDC_SERVICE}:${MOCK_OIDC_PORT}/dex/token`,
+      user: `http://${MOCK_OIDC_SERVICE}:${MOCK_OIDC_PORT}/dex/userinfo`
+    });
+    keyDir = () => path16.join(meshCacheDir("mesh-local"), "mock-idp");
+    mockIdpComposeEnv = () => {
+      const { publicKeyB64, privateKeyB64 } = ensureMockSamlSigningKey();
+      return {
+        MESH_MOCK_SAML_PUBLIC_KEY: publicKeyB64,
+        MESH_MOCK_SAML_PRIVATE_KEY: privateKeyB64
+      };
+    };
+    buildMockSamlIdpBody = (metadataXml) => ({
+      name: MOCK_SAML_IDP_NAME,
+      metadataXml: Buffer.from(metadataXml, "utf-8").toString("base64"),
+      binding: "SAML_BINDING_POST",
+      withSignedRequest: true,
+      providerOptions: {
+        isLinkingAllowed: true,
+        isCreationAllowed: true,
+        isAutoCreation: true,
+        isAutoUpdate: true,
+        // Matches the component's default: without it a federated sign-in for an
+        // address that already has a Zitadel account fails as a duplicate
+        // instead of linking, which is the behaviour worth being able to see.
+        autoLinking: "AUTO_LINKING_OPTION_EMAIL"
+      }
+    });
+    buildMockOauthIdpBody = () => {
+      const endpoints = mockOidcEndpoints();
+      return {
+        name: MOCK_OIDC_IDP_NAME,
+        clientId: MOCK_OIDC_CLIENT_ID,
+        clientSecret: MOCK_OIDC_CLIENT_SECRET,
+        authorizationEndpoint: endpoints.authorization,
+        tokenEndpoint: endpoints.token,
+        userEndpoint: endpoints.user,
+        scopes: ["openid", "profile", "email"],
+        idAttribute: "sub",
+        providerOptions: {
+          isLinkingAllowed: true,
+          isCreationAllowed: true,
+          isAutoCreation: true,
+          isAutoUpdate: true,
+          autoLinking: "AUTO_LINKING_OPTION_EMAIL"
+        }
+      };
+    };
+    missingLoginPolicyIdps = (attached, wanted) => {
+      const have = new Set(attached);
+      return [...new Set(wanted)].filter((id) => !have.has(id));
+    };
+  }
+});
+
+// libs/mesh-cli/src/commands/local/seed-zitadel.ts
+import * as fs17 from "fs";
+import * as os5 from "os";
+import * as path17 from "path";
 function buildCliAppPayload() {
   return {
     name: CLI_APP_NAME,
@@ -6694,10 +6850,10 @@ function buildCliAppPayload() {
   };
 }
 function readSeederPat() {
-  const tmp = path16.join(fs16.mkdtempSync(path16.join(os5.tmpdir(), "mesh-zitadel-")), "pat.txt");
+  const tmp = path17.join(fs17.mkdtempSync(path17.join(os5.tmpdir(), "mesh-zitadel-")), "pat.txt");
   try {
     compose(["cp", "zitadel:/machinekey/pat.txt", tmp]);
-    const pat = fs16.readFileSync(tmp, "utf-8").trim();
+    const pat = fs17.readFileSync(tmp, "utf-8").trim();
     if (!pat) throw new Error("empty PAT file");
     return pat;
   } catch {
@@ -6706,7 +6862,7 @@ function readSeederPat() {
       { remediation: { command: "mesh stop --destroy && mesh start" } }
     );
   } finally {
-    fs16.rmSync(path16.dirname(tmp), { recursive: true, force: true });
+    fs17.rmSync(path17.dirname(tmp), { recursive: true, force: true });
   }
 }
 async function api(pat, method, apiPath, body, orgId) {
@@ -6805,11 +6961,11 @@ async function ensureTestUsers(pat) {
   }
 }
 function hubAuthPath() {
-  return path16.join(meshCacheDir("mesh-local"), "hub-auth.json");
+  return path17.join(meshCacheDir("mesh-local"), "hub-auth.json");
 }
 function readHubAuth() {
   try {
-    const parsed = JSON.parse(fs16.readFileSync(hubAuthPath(), "utf-8"));
+    const parsed = JSON.parse(fs17.readFileSync(hubAuthPath(), "utf-8"));
     if (parsed?.clientId && parsed?.clientSecret && parsed?.cookieSecret) return parsed;
     return null;
   } catch {
@@ -6948,7 +7104,7 @@ async function seedHubAuth(pat) {
     clientSecret: app.clientSecret ?? persisted?.clientSecret ?? "",
     cookieSecret: persistedCookie ?? (await import("crypto")).randomBytes(16).toString("hex")
   };
-  fs16.writeFileSync(hubAuthPath(), JSON.stringify(config, null, 2), { mode: 384 });
+  fs17.writeFileSync(hubAuthPath(), JSON.stringify(config, null, 2), { mode: 384 });
   return config;
 }
 async function publishHubAuthzPointer(projectId, orgId, awsConfig) {
@@ -7104,7 +7260,79 @@ async function seedZitadel(awsConfig) {
   logSuccess(`Login context '${LOGIN_CONTEXT}' configured \u2192 try: mesh login ${LOGIN_CONTEXT}`);
   return { projectId, cliClientId, hubAuth };
 }
-var ZITADEL_ISSUER, LOGIN_CONTEXT, PLATFORM_ORG, CLI_PROJECT_NAME, CLI_APP_NAME, CLI_REDIRECT_URI, HUB_PROJECT_NAME, HUB_APP_NAME, hubRedirectUri, HUB_DEFAULT_REDIRECT_URI, HUB_ROLES, ZITADEL_SSM_PARAM, TEST_USERS_SSM_PREFIX, TEST_USERS, isAlreadyExists, ensureCliProject, ensureHubProject, OPS_HUB_SECRET_ID, LOCAL_SMTP;
+async function fetchMockSamlMetadata() {
+  const url = mockSamlMetadataUrl();
+  let lastError = "no attempt made";
+  for (let attempt = 0; attempt < 30; attempt++) {
+    try {
+      const res = await fetch(url, { signal: AbortSignal.timeout(5e3) });
+      const body = await res.text();
+      if (res.ok && body.includes("EntityDescriptor")) {
+        if (/<ds:X509Certificate\s*\/>|<ds:X509Certificate>\s*<\/ds:X509Certificate>/.test(body)) {
+          throw new MeshCliError(
+            "The mock SAML IdP served metadata with an empty signing certificate.",
+            {
+              remediation: {
+                command: "rm -rf ~/.cache/mesh/mesh-local/mock-idp && mesh stop && mesh start --with-idps"
+              }
+            }
+          );
+        }
+        return body;
+      }
+      lastError = `HTTP ${res.status}`;
+    } catch (cause) {
+      if (cause instanceof MeshCliError) throw cause;
+      lastError = String(cause);
+    }
+    await new Promise((resolve20) => setTimeout(resolve20, 2e3));
+  }
+  throw new MeshCliError(`Could not read mock SAML metadata from ${url} (${lastError}).`, {
+    remediation: { command: "mesh status   # is mock-saml running?" }
+  });
+}
+async function attachedLoginPolicyIdps(pat) {
+  const res = await api(pat, "POST", "/admin/v1/policies/login/idps/_search", {});
+  return (res?.result ?? []).map((idp) => String(idp.idpId ?? idp.id)).filter(Boolean);
+}
+async function findIdpByName(pat, name) {
+  return pickIdpIdByName(await api(pat, "POST", IDP_SEARCH_PATH, {}), name);
+}
+async function seedMockIdps() {
+  const pat = readSeederPat();
+  const metadataXml = await fetchMockSamlMetadata();
+  let samlIdpId = await findIdpByName(pat, MOCK_SAML_IDP_NAME);
+  if (!samlIdpId) {
+    const created = await api(pat, "POST", "/admin/v1/idps/saml", buildMockSamlIdpBody(metadataXml));
+    samlIdpId = String(created.id);
+  }
+  logSuccess(`Mock SAML IdP ready (${MOCK_SAML_IDP_NAME}, id ${samlIdpId})`);
+  let oidcIdpId = await findIdpByName(pat, MOCK_OIDC_IDP_NAME);
+  if (!oidcIdpId) {
+    const created = await api(pat, "POST", "/admin/v1/idps/oauth", buildMockOauthIdpBody());
+    oidcIdpId = String(created.id);
+  }
+  logSuccess(`Mock OIDC IdP ready (${MOCK_OIDC_IDP_NAME}, id ${oidcIdpId})`);
+  const policy = await api(pat, "GET", "/admin/v1/policies/login");
+  if (policy?.policy?.allowExternalIdp !== true) {
+    await api(pat, "PUT", "/admin/v1/policies/login", {
+      ...policy.policy,
+      allowExternalIdp: true
+    });
+    logInfo("Instance login policy: allowExternalIdp turned on (federation buttons were hidden)");
+  }
+  const attached = await attachedLoginPolicyIdps(pat);
+  const toAttach = missingLoginPolicyIdps(attached, [samlIdpId, oidcIdpId]);
+  for (const idpId of toAttach) {
+    await api(pat, "POST", "/admin/v1/policies/login/idps", { idpId, ownerType: "IDP_OWNER_TYPE_SYSTEM" });
+  }
+  const finalIdps = await attachedLoginPolicyIdps(pat);
+  logSuccess(
+    `Login policy carries ${finalIdps.length} federation(s) \u2014 both mocks attached, which is the state a login-policy change has to preserve`
+  );
+  return { samlIdpId, oidcIdpId };
+}
+var ZITADEL_ISSUER, LOGIN_CONTEXT, PLATFORM_ORG, CLI_PROJECT_NAME, CLI_APP_NAME, CLI_REDIRECT_URI, HUB_PROJECT_NAME, HUB_APP_NAME, hubRedirectUri, HUB_DEFAULT_REDIRECT_URI, HUB_ROLES, ZITADEL_SSM_PARAM, TEST_USERS_SSM_PREFIX, TEST_USERS, isAlreadyExists, ensureCliProject, ensureHubProject, OPS_HUB_SECRET_ID, LOCAL_SMTP, IDP_SEARCH_PATH, pickIdpIdByName;
 var init_seed_zitadel = __esm({
   "libs/mesh-cli/src/commands/local/seed-zitadel.ts"() {
     "use strict";
@@ -7115,6 +7343,7 @@ var init_seed_zitadel = __esm({
     init_stack();
     init_seed();
     init_cache_home();
+    init_mock_idps();
     ZITADEL_ISSUER = "http://localhost:8080";
     LOGIN_CONTEXT = "local";
     PLATFORM_ORG = "mesh";
@@ -7156,6 +7385,11 @@ var init_seed_zitadel = __esm({
       from: "no-reply@local.mesh",
       fromName: "Mesh (local)"
     };
+    IDP_SEARCH_PATH = "/admin/v1/idps/templates/_search";
+    pickIdpIdByName = (searchResult, name) => {
+      const hit = (searchResult?.result ?? []).find((idp) => idp?.name === name);
+      return hit?.id ? String(hit.id) : void 0;
+    };
   }
 });
 
@@ -7533,17 +7767,17 @@ var init_auth_provision = __esm({
 });
 
 // libs/mesh-cli/src/commands/local/dev-local.ts
-import * as fs17 from "fs";
-import * as path17 from "path";
+import * as fs18 from "fs";
+import * as path18 from "path";
 function localAppNamespace(tenant, appName) {
   return `${tenant}-${LOCAL_ENV}-${appName}`;
 }
 function logShipperPath() {
-  return path17.join(findPackageRoot(), "assets", "log-shipper.mjs");
+  return path18.join(findPackageRoot(), "assets", "log-shipper.mjs");
 }
 function autoInstrumentationEnv(appRoot, src) {
-  const pkgDir = path17.join("node_modules", "@opentelemetry", "auto-instrumentations-node");
-  const present = fs17.existsSync(path17.join(appRoot, src, pkgDir)) || fs17.existsSync(path17.join(appRoot, pkgDir));
+  const pkgDir = path18.join("node_modules", "@opentelemetry", "auto-instrumentations-node");
+  const present = fs18.existsSync(path18.join(appRoot, src, pkgDir)) || fs18.existsSync(path18.join(appRoot, pkgDir));
   if (!present) return {};
   return {
     NODE_OPTIONS: { value: "--import @opentelemetry/auto-instrumentations-node/register" },
@@ -7599,26 +7833,26 @@ function localPlatformEnv(tenant, appName, serviceName) {
   return env;
 }
 function isDagsterWorkspaceRoot(appRoot) {
-  if (fs17.existsSync(path17.join(appRoot, "dg.toml"))) return true;
-  const pyproject = path17.join(appRoot, "pyproject.toml");
-  if (!fs17.existsSync(pyproject)) return false;
+  if (fs18.existsSync(path18.join(appRoot, "dg.toml"))) return true;
+  const pyproject = path18.join(appRoot, "pyproject.toml");
+  if (!fs18.existsSync(pyproject)) return false;
   try {
-    return /^\s*\[tool\.dg[\].]/m.test(fs17.readFileSync(pyproject, "utf-8"));
+    return /^\s*\[tool\.dg[\].]/m.test(fs18.readFileSync(pyproject, "utf-8"));
   } catch {
     return false;
   }
 }
 function resolveDgBinary(appRoot) {
   for (const candidate of ["deployments/local/.venv/bin/dg", ".venv/bin/dg"]) {
-    if (fs17.existsSync(path17.join(appRoot, candidate))) return candidate;
+    if (fs18.existsSync(path18.join(appRoot, candidate))) return candidate;
   }
   return "dg";
 }
 function hasDevScript(dir) {
-  const pkgPath = path17.join(dir, "package.json");
-  if (!fs17.existsSync(pkgPath)) return false;
+  const pkgPath = path18.join(dir, "package.json");
+  if (!fs18.existsSync(pkgPath)) return false;
   try {
-    const pkg = JSON.parse(fs17.readFileSync(pkgPath, "utf-8"));
+    const pkg = JSON.parse(fs18.readFileSync(pkgPath, "utf-8"));
     return typeof pkg?.scripts?.dev === "string";
   } catch {
     return false;
@@ -7626,14 +7860,14 @@ function hasDevScript(dir) {
 }
 function detectLocalServices(appRoot) {
   const services = {};
-  for (const entry of fs17.readdirSync(appRoot, { withFileTypes: true })) {
+  for (const entry of fs18.readdirSync(appRoot, { withFileTypes: true })) {
     if (!entry.isDirectory() || entry.name.startsWith(".") || entry.name === "node_modules") continue;
-    if (hasDevScript(path17.join(appRoot, entry.name))) {
+    if (hasDevScript(path18.join(appRoot, entry.name))) {
       services[entry.name] = { src: entry.name };
     }
   }
   if (Object.keys(services).length === 0 && hasDevScript(appRoot)) {
-    services[path17.basename(appRoot)] = { src: "." };
+    services[path18.basename(appRoot)] = { src: "." };
   }
   return services;
 }
@@ -7647,15 +7881,15 @@ function buildLocalDevOutput(appRoot, tenant, opts = {}) {
       { remediation: { command: "mesh create-app" } }
     );
   }
-  let appName = path17.basename(appRoot);
+  let appName = path18.basename(appRoot);
   try {
-    const pkg = JSON.parse(fs17.readFileSync(path17.join(appRoot, "package.json"), "utf-8"));
+    const pkg = JSON.parse(fs18.readFileSync(path18.join(appRoot, "package.json"), "utf-8"));
     if (typeof pkg?.name === "string" && pkg.name) appName = pkg.name.replace(/^@[^/]+\//, "");
   } catch {
   }
-  const pulumiYaml = path17.join(appRoot, "Pulumi.yaml");
-  if (fs17.existsSync(pulumiYaml)) {
-    const match = fs17.readFileSync(pulumiYaml, "utf-8").match(/^name:\s*(.+)$/m);
+  const pulumiYaml = path18.join(appRoot, "Pulumi.yaml");
+  if (fs18.existsSync(pulumiYaml)) {
+    const match = fs18.readFileSync(pulumiYaml, "utf-8").match(/^name:\s*(.+)$/m);
     if (match?.[1]?.trim()) appName = match[1].trim();
   }
   const services = {};
@@ -7705,7 +7939,7 @@ function buildLocalDevOutput(appRoot, tenant, opts = {}) {
       command: [resolveDgBinary(appRoot), "dev", "-h", "127.0.0.1", "-p", '"$PORT"'],
       env: {
         PORT: { value: String(port) },
-        DAGSTER_HOME: { value: path17.join(appRoot, ".dagster") },
+        DAGSTER_HOME: { value: path18.join(appRoot, ".dagster") },
         ...localPlatformEnv(tenant, appName, "dagster")
       }
     };
@@ -7737,23 +7971,23 @@ function buildLocalDevOutput(appRoot, tenant, opts = {}) {
   };
 }
 function hasStackBacking(appRoot) {
-  const hasOwn = fs17.existsSync(path17.join(appRoot, "Pulumi.yaml")) || fs17.readdirSync(appRoot).some((f) => /^Pulumi\..+\.yaml$/.test(f));
+  const hasOwn = fs18.existsSync(path18.join(appRoot, "Pulumi.yaml")) || fs18.readdirSync(appRoot).some((f) => /^Pulumi\..+\.yaml$/.test(f));
   if (hasOwn) return true;
-  let dir = path17.dirname(appRoot);
+  let dir = path18.dirname(appRoot);
   while (true) {
-    if (fs17.existsSync(path17.join(dir, "Pulumi.yaml"))) return true;
-    if (fs17.existsSync(path17.join(dir, ".git")) || fs17.existsSync(path17.join(dir, "pnpm-workspace.yaml"))) {
-      return fs17.existsSync(path17.join(dir, "Pulumi.yaml"));
+    if (fs18.existsSync(path18.join(dir, "Pulumi.yaml"))) return true;
+    if (fs18.existsSync(path18.join(dir, ".git")) || fs18.existsSync(path18.join(dir, "pnpm-workspace.yaml"))) {
+      return fs18.existsSync(path18.join(dir, "Pulumi.yaml"));
     }
-    const parent = path17.dirname(dir);
+    const parent = path18.dirname(dir);
     if (parent === dir) return false;
     dir = parent;
   }
 }
 function detectLocalTenant(appRoot) {
-  for (const file of fs17.readdirSync(appRoot)) {
+  for (const file of fs18.readdirSync(appRoot)) {
     if (!/^Pulumi\..*\.yaml$/.test(file)) continue;
-    const match = fs17.readFileSync(path17.join(appRoot, file), "utf-8").match(/^\s*mesh:tenant:\s*["']?([A-Za-z0-9-]+)["']?\s*$/m);
+    const match = fs18.readFileSync(path18.join(appRoot, file), "utf-8").match(/^\s*mesh:tenant:\s*["']?([A-Za-z0-9-]+)["']?\s*$/m);
     if (match) return match[1];
   }
   const recorded = findMeshJson(appRoot);
@@ -7789,9 +8023,9 @@ var init_dev_local = __esm({
 });
 
 // libs/mesh-cli/src/commands/local/docker-runner.ts
-import { execFileSync as execFileSync13 } from "child_process";
-import * as fs18 from "fs";
-import * as path18 from "path";
+import { execFileSync as execFileSync14 } from "child_process";
+import * as fs19 from "fs";
+import * as path19 from "path";
 function sessionDir(sessionName) {
   return meshCacheDir("mesh-local", "dev", sessionName);
 }
@@ -7813,8 +8047,8 @@ function writeDevCompose(sessionName, appRoot, services) {
   ];
   for (const [name, service] of Object.entries(services)) {
     const env = service.env ?? {};
-    fs18.writeFileSync(path18.join(dir, `${name}.env`), renderDockerEnvFile(env), { mode: 384 });
-    const workdir = path18.posix.join("/workspace", service.src === "." ? "" : service.src);
+    fs19.writeFileSync(path19.join(dir, `${name}.env`), renderDockerEnvFile(env), { mode: 384 });
+    const workdir = path19.posix.join("/workspace", service.src === "." ? "" : service.src);
     const ship = env.OTEL_RESOURCE_ATTRIBUTES ? ` 2>&1 | NODE_OPTIONS= node /mesh-assets/log-shipper.mjs` : "";
     blocks.push(
       `  ${name}:`,
@@ -7823,7 +8057,7 @@ function writeDevCompose(sessionName, appRoot, services) {
       `    working_dir: ${workdir}`,
       `    volumes:`,
       `      - '${appRoot}:/workspace'`,
-      `      - '${path18.dirname(shipper)}:/mesh-assets:ro'`,
+      `      - '${path19.dirname(shipper)}:/mesh-assets:ro'`,
       `    environment:`,
       // node_modules is the HOST's bind-mounted install — pnpm inside the
       // container must never "verify" it and try a purge/reinstall (pnpm
@@ -7839,37 +8073,37 @@ function writeDevCompose(sessionName, appRoot, services) {
       `    restart: unless-stopped`
     );
   }
-  const composePath = path18.join(dir, "compose.yml");
-  fs18.writeFileSync(composePath, blocks.join("\n") + "\n");
+  const composePath = path19.join(dir, "compose.yml");
+  fs19.writeFileSync(composePath, blocks.join("\n") + "\n");
   return composePath;
 }
 function composeArgs(sessionName, args) {
-  return ["compose", "-p", sessionName, "-f", path18.join(sessionDir(sessionName), "compose.yml"), ...args];
+  return ["compose", "-p", sessionName, "-f", path19.join(sessionDir(sessionName), "compose.yml"), ...args];
 }
 function dockerDevUp(sessionName) {
-  execFileSync13("docker", composeArgs(sessionName, ["up", "-d"]), {
+  execFileSync14("docker", composeArgs(sessionName, ["up", "-d"]), {
     stdio: ["ignore", "inherit", "inherit"]
   });
 }
 function dockerDevDown(sessionName) {
-  execFileSync13("docker", composeArgs(sessionName, ["down", "--remove-orphans"]), {
+  execFileSync14("docker", composeArgs(sessionName, ["down", "--remove-orphans"]), {
     stdio: ["ignore", "inherit", "inherit"]
   });
 }
 function dockerDevPs(sessionName) {
-  return execFileSync13("docker", composeArgs(sessionName, ["ps", "--format", "table {{.Service}}	{{.State}}	{{.Status}}"]), {
+  return execFileSync14("docker", composeArgs(sessionName, ["ps", "--format", "table {{.Service}}	{{.State}}	{{.Status}}"]), {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"]
   });
 }
 function dockerDevLogs(sessionName, service, tail) {
-  return execFileSync13("docker", composeArgs(sessionName, ["logs", "--tail", String(tail), service]), {
+  return execFileSync14("docker", composeArgs(sessionName, ["logs", "--tail", String(tail), service]), {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"]
   });
 }
 function dockerDevRestart(sessionName, service) {
-  execFileSync13("docker", composeArgs(sessionName, ["restart", service]), {
+  execFileSync14("docker", composeArgs(sessionName, ["restart", service]), {
     stdio: ["ignore", "inherit", "inherit"]
   });
 }
@@ -7938,9 +8172,9 @@ var init_peer_addressing = __esm({
 });
 
 // libs/mesh-cli/src/utils/worktree-identity.ts
-import { execFileSync as execFileSync14 } from "node:child_process";
+import { execFileSync as execFileSync15 } from "node:child_process";
 import * as crypto3 from "node:crypto";
-import * as path19 from "node:path";
+import * as path20 from "node:path";
 function sanitizeSlug(name) {
   const s = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
   return s || "wt";
@@ -7958,7 +8192,7 @@ function blockBasePort(block) {
 }
 function withAppScopedPortBlock(wt, appRoot) {
   if (wt.isPrimary) return wt;
-  const appHash = worktreeHash(`${wt.worktreeRoot}#${path19.resolve(appRoot)}`);
+  const appHash = worktreeHash(`${wt.worktreeRoot}#${path20.resolve(appRoot)}`);
   return { ...wt, portBlock: portBlockFor(appHash, false) };
 }
 function worktreeStackName(baseName, wt) {
@@ -7973,22 +8207,22 @@ function resolveWorktreeIdentity(cwd = process.cwd(), gitRunner = defaultGitRunn
   let worktreeRoot;
   let isPrimary = true;
   try {
-    worktreeRoot = path19.resolve(gitRunner(["rev-parse", "--show-toplevel"], cwd));
+    worktreeRoot = path20.resolve(gitRunner(["rev-parse", "--show-toplevel"], cwd));
     const commonDir = gitRunner(["rev-parse", "--git-common-dir"], cwd);
-    const primaryRoot = path19.resolve(path19.dirname(path19.resolve(cwd, commonDir)));
+    const primaryRoot = path20.resolve(path20.dirname(path20.resolve(cwd, commonDir)));
     isPrimary = worktreeRoot === primaryRoot;
   } catch {
     return {
-      worktreeRoot: path19.resolve(cwd),
+      worktreeRoot: path20.resolve(cwd),
       isPrimary: true,
-      slug: sanitizeSlug(path19.basename(path19.resolve(cwd))),
-      hash: worktreeHash(path19.resolve(cwd)),
+      slug: sanitizeSlug(path20.basename(path20.resolve(cwd))),
+      hash: worktreeHash(path20.resolve(cwd)),
       token: "",
       portBlock: 0,
       taskQueueSuffix: ""
     };
   }
-  const slug = sanitizeSlug(path19.basename(worktreeRoot));
+  const slug = sanitizeSlug(path20.basename(worktreeRoot));
   const hash = worktreeHash(worktreeRoot);
   const token = isPrimary ? "" : `${slug}-${hash}`;
   return {
@@ -8010,7 +8244,7 @@ var init_worktree_identity = __esm({
     PORT_BLOCK_SIZE = 40;
     PORT_BLOCK_SERVICE_SUBRANGE = 24;
     STACK_SLUG_MAX = 16;
-    defaultGitRunner = (args, cwd) => execFileSync14("git", args, { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    defaultGitRunner = (args, cwd) => execFileSync15("git", args, { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   }
 });
 
@@ -8072,11 +8306,11 @@ var init_dev_token_server = __esm({
 });
 
 // libs/mesh-cli/src/commands/dev.ts
-import { execFileSync as execFileSync15, spawn as spawn3, spawnSync as spawnSync2 } from "child_process";
-import * as fs19 from "fs";
+import { execFileSync as execFileSync16, spawn as spawn3, spawnSync as spawnSync2 } from "child_process";
+import * as fs20 from "fs";
 import * as net8 from "net";
 import * as os6 from "os";
-import * as path20 from "path";
+import * as path21 from "path";
 import { Option } from "commander";
 import { SecretsManagerClient as SecretsManagerClient2, GetSecretValueCommand as GetSecretValueCommand2 } from "@aws-sdk/client-secrets-manager";
 function registerServiceProbes(devOutput, tenant, probeFiles) {
@@ -8124,9 +8358,9 @@ mesh dev plan \u2014 ${kind}
     console.log(`    (none \u2014 all services are deployed/K8s)`);
   } else {
     const monorepoRoot = findMonorepoRoot();
-    const wtWithSep = wt.worktreeRoot.endsWith(path20.sep) ? wt.worktreeRoot : wt.worktreeRoot + path20.sep;
+    const wtWithSep = wt.worktreeRoot.endsWith(path21.sep) ? wt.worktreeRoot : wt.worktreeRoot + path21.sep;
     for (const [name, s] of locals) {
-      const dir = path20.resolve(appRoot, rebaseServiceSrc(s.src, monorepoRoot));
+      const dir = path21.resolve(appRoot, rebaseServiceSrc(s.src, monorepoRoot));
       const outside = dir !== wt.worktreeRoot && !dir.startsWith(wtWithSep);
       const port = s.port > 0 ? `:${s.port}` : "(no port)";
       console.log(`    ${name.padEnd(18)} ${port.padEnd(7)} ${dir}${outside ? "  \u26A0 OUTSIDE worktree" : ""}`);
@@ -8135,18 +8369,18 @@ mesh dev plan \u2014 ${kind}
   console.log("");
 }
 function getSessionStatePath(sessionName) {
-  const dir = path20.join(os6.tmpdir(), "mesh-dev-sessions");
-  if (!fs19.existsSync(dir)) fs19.mkdirSync(dir, { recursive: true });
-  return path20.join(dir, `${sessionName}.json`);
+  const dir = path21.join(os6.tmpdir(), "mesh-dev-sessions");
+  if (!fs20.existsSync(dir)) fs20.mkdirSync(dir, { recursive: true });
+  return path21.join(dir, `${sessionName}.json`);
 }
 function saveSessionState(sessionName, state) {
-  fs19.writeFileSync(getSessionStatePath(sessionName), JSON.stringify(state, null, 2));
+  fs20.writeFileSync(getSessionStatePath(sessionName), JSON.stringify(state, null, 2));
 }
 function loadSessionState(sessionName) {
   const filePath = getSessionStatePath(sessionName);
-  if (!fs19.existsSync(filePath)) return null;
+  if (!fs20.existsSync(filePath)) return null;
   try {
-    return JSON.parse(fs19.readFileSync(filePath, "utf-8"));
+    return JSON.parse(fs20.readFileSync(filePath, "utf-8"));
   } catch {
     return null;
   }
@@ -8170,18 +8404,18 @@ function workflowChangeWouldStrand(priorState, appRoot, force) {
   return true;
 }
 function getSessionEnvDir(sessionName) {
-  return path20.join(os6.tmpdir(), "mesh-dev-sessions", sessionName);
+  return path21.join(os6.tmpdir(), "mesh-dev-sessions", sessionName);
 }
 function getServiceEnvFilePath(sessionName, serviceName) {
-  return path20.join(getSessionEnvDir(sessionName), envFileName(serviceName));
+  return path21.join(getSessionEnvDir(sessionName), envFileName(serviceName));
 }
 function removeSessionState(sessionName) {
   try {
-    fs19.unlinkSync(getSessionStatePath(sessionName));
+    fs20.unlinkSync(getSessionStatePath(sessionName));
   } catch {
   }
   try {
-    fs19.rmSync(getSessionEnvDir(sessionName), { recursive: true, force: true });
+    fs20.rmSync(getSessionEnvDir(sessionName), { recursive: true, force: true });
   } catch {
   }
 }
@@ -8309,16 +8543,16 @@ function mergePinnedPorts(fresh, pinned) {
 }
 function findMonorepoRoot() {
   let dir = process.cwd();
-  const root = path20.parse(dir).root;
+  const root = path21.parse(dir).root;
   while (dir !== root) {
-    if (fs19.existsSync(path20.join(dir, "pnpm-workspace.yaml")) || fs19.existsSync(path20.join(dir, "turbo.json"))) {
+    if (fs20.existsSync(path21.join(dir, "pnpm-workspace.yaml")) || fs20.existsSync(path21.join(dir, "turbo.json"))) {
       return dir;
     }
-    const gitPath = path20.join(dir, ".git");
-    if (fs19.existsSync(gitPath)) {
+    const gitPath = path21.join(dir, ".git");
+    if (fs20.existsSync(gitPath)) {
       return dir;
     }
-    dir = path20.dirname(dir);
+    dir = path21.dirname(dir);
   }
   return null;
 }
@@ -8326,40 +8560,40 @@ function discoverApps(monorepoRoot) {
   const apps = [];
   function addApp(appDir, tenant) {
     const projectName = getProjectName(appDir);
-    const stacks = fs19.readdirSync(appDir).filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml").map((f) => f.replace(/^Pulumi\./, "").replace(/\.yaml$/, ""));
+    const stacks = fs20.readdirSync(appDir).filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml").map((f) => f.replace(/^Pulumi\./, "").replace(/\.yaml$/, ""));
     apps.push({
       name: projectName,
       tenant,
       appPath: appDir,
-      relativePath: path20.relative(monorepoRoot, appDir),
+      relativePath: path21.relative(monorepoRoot, appDir),
       stacks
     });
   }
   const searchDirs = ["tenants", "tests/tenants"];
   for (const searchDir of searchDirs) {
-    const base = path20.join(monorepoRoot, searchDir);
-    if (!fs19.existsSync(base)) continue;
-    for (const tenant of fs19.readdirSync(base)) {
-      const appsDir = path20.join(base, tenant, "apps");
-      if (!fs19.existsSync(appsDir) || !fs19.statSync(appsDir).isDirectory()) continue;
-      for (const app of fs19.readdirSync(appsDir)) {
-        const appDir = path20.join(appsDir, app);
-        if (!fs19.existsSync(path20.join(appDir, "Pulumi.yaml"))) continue;
+    const base = path21.join(monorepoRoot, searchDir);
+    if (!fs20.existsSync(base)) continue;
+    for (const tenant of fs20.readdirSync(base)) {
+      const appsDir = path21.join(base, tenant, "apps");
+      if (!fs20.existsSync(appsDir) || !fs20.statSync(appsDir).isDirectory()) continue;
+      for (const app of fs20.readdirSync(appsDir)) {
+        const appDir = path21.join(appsDir, app);
+        if (!fs20.existsSync(path21.join(appDir, "Pulumi.yaml"))) continue;
         addApp(appDir, tenant);
       }
     }
   }
-  const flatAppsDir = path20.join(monorepoRoot, "apps");
-  if (fs19.existsSync(flatAppsDir) && fs19.statSync(flatAppsDir).isDirectory()) {
-    for (const app of fs19.readdirSync(flatAppsDir)) {
-      const appDir = path20.join(flatAppsDir, app);
-      if (!fs19.statSync(appDir).isDirectory()) continue;
-      if (!fs19.existsSync(path20.join(appDir, "Pulumi.yaml"))) continue;
+  const flatAppsDir = path21.join(monorepoRoot, "apps");
+  if (fs20.existsSync(flatAppsDir) && fs20.statSync(flatAppsDir).isDirectory()) {
+    for (const app of fs20.readdirSync(flatAppsDir)) {
+      const appDir = path21.join(flatAppsDir, app);
+      if (!fs20.statSync(appDir).isDirectory()) continue;
+      if (!fs20.existsSync(path21.join(appDir, "Pulumi.yaml"))) continue;
       let tenant = "unknown";
-      const stackConfigs = fs19.readdirSync(appDir).filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml");
+      const stackConfigs = fs20.readdirSync(appDir).filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml");
       if (stackConfigs.length > 0) {
         try {
-          const content = fs19.readFileSync(path20.join(appDir, stackConfigs[0]), "utf-8");
+          const content = fs20.readFileSync(path21.join(appDir, stackConfigs[0]), "utf-8");
           const tenantMatch = content.match(/mesh:tenant:\s*(\S+)/);
           if (tenantMatch) tenant = tenantMatch[1];
         } catch {
@@ -8372,38 +8606,38 @@ function discoverApps(monorepoRoot) {
 }
 function findAppRoot2(appPath) {
   if (appPath) {
-    const resolved = path20.resolve(appPath);
-    if (fs19.existsSync(path20.join(resolved, "Pulumi.yaml"))) return resolved;
+    const resolved = path21.resolve(appPath);
+    if (fs20.existsSync(path21.join(resolved, "Pulumi.yaml"))) return resolved;
     const mono = findMonorepoRoot();
     if (mono) {
-      const fromMono = path20.resolve(mono, appPath);
-      if (fs19.existsSync(path20.join(fromMono, "Pulumi.yaml"))) return fromMono;
+      const fromMono = path21.resolve(mono, appPath);
+      if (fs20.existsSync(path21.join(fromMono, "Pulumi.yaml"))) return fromMono;
     }
     logError(`No Pulumi.yaml found at: ${appPath}`);
     process.exit(1);
   }
   let dir = process.cwd();
-  const root = path20.parse(dir).root;
+  const root = path21.parse(dir).root;
   while (dir !== root) {
-    if (fs19.existsSync(path20.join(dir, "Pulumi.yaml"))) {
+    if (fs20.existsSync(path21.join(dir, "Pulumi.yaml"))) {
       return dir;
     }
-    dir = path20.dirname(dir);
+    dir = path21.dirname(dir);
   }
   return process.cwd();
 }
 function getProjectName(appRoot) {
-  const yamlPath = path20.join(appRoot, "Pulumi.yaml");
-  if (!fs19.existsSync(yamlPath)) return path20.basename(appRoot);
-  const content = fs19.readFileSync(yamlPath, "utf-8");
+  const yamlPath = path21.join(appRoot, "Pulumi.yaml");
+  if (!fs20.existsSync(yamlPath)) return path21.basename(appRoot);
+  const content = fs20.readFileSync(yamlPath, "utf-8");
   const match = content.match(/^name:\s*(.+)$/m);
-  return match?.[1]?.trim() ?? path20.basename(appRoot);
+  return match?.[1]?.trim() ?? path21.basename(appRoot);
 }
 function detectStack(appRoot, stageArg) {
   if (stageArg) return stageArg;
   if (process.env.MESH_STAGE) return process.env.MESH_STAGE;
   try {
-    const result = execFileSync15("pulumi", ["stack", "--show-name"], {
+    const result = execFileSync16("pulumi", ["stack", "--show-name"], {
       cwd: appRoot,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
@@ -8412,7 +8646,7 @@ function detectStack(appRoot, stageArg) {
   } catch {
   }
   try {
-    const files = fs19.readdirSync(appRoot).filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml");
+    const files = fs20.readdirSync(appRoot).filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml");
     if (files.length === 1) {
       const match = files[0].match(/^Pulumi\.(.+)\.yaml$/);
       if (match?.[1]) {
@@ -8426,7 +8660,7 @@ function detectStack(appRoot, stageArg) {
 }
 function stackArgs(appRoot, stack) {
   try {
-    const selected = execFileSync15("pulumi", ["stack", "--show-name"], {
+    const selected = execFileSync16("pulumi", ["stack", "--show-name"], {
       cwd: appRoot,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
@@ -8435,7 +8669,7 @@ function stackArgs(appRoot, stack) {
   } catch {
   }
   try {
-    execFileSync15("pulumi", ["stack", "select", stack], {
+    execFileSync16("pulumi", ["stack", "select", stack], {
       cwd: appRoot,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
@@ -8464,7 +8698,7 @@ function getDevOutput(appRoot, stack, awsEnv) {
 }
 function hasTmux() {
   try {
-    execFileSync15("which", ["tmux"], { stdio: "ignore" });
+    execFileSync16("which", ["tmux"], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -8472,7 +8706,7 @@ function hasTmux() {
 }
 function sessionExists(name) {
   try {
-    execFileSync15("tmux", ["has-session", "-t", name], { stdio: "ignore" });
+    execFileSync16("tmux", ["has-session", "-t", name], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -8480,7 +8714,7 @@ function sessionExists(name) {
 }
 function killSession(name) {
   try {
-    execFileSync15("tmux", ["kill-session", "-t", name], { stdio: "ignore" });
+    execFileSync16("tmux", ["kill-session", "-t", name], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -8519,9 +8753,9 @@ function buildChildAwsEnv(awsEnv, method, profile, opts) {
   if (method === "zitadel" && opts) {
     const sanitizedContext = opts.context.replace(/[^A-Za-z0-9_-]/g, "-");
     const profileName = `mesh-dev-${sanitizedContext}`;
-    const configPath = path20.join(opts.sessionScratchDir, "aws-config");
+    const configPath = path21.join(opts.sessionScratchDir, "aws-config");
     const region = awsEnv.AWS_REGION ?? awsEnv.AWS_DEFAULT_REGION ?? "";
-    fs19.mkdirSync(opts.sessionScratchDir, { recursive: true });
+    fs20.mkdirSync(opts.sessionScratchDir, { recursive: true });
     const profileBlock = renderCredentialProcessProfile({
       profileName,
       context: opts.context,
@@ -8529,7 +8763,7 @@ function buildChildAwsEnv(awsEnv, method, profile, opts) {
       region,
       meshBin: opts.meshBin
     });
-    const existing = fs19.existsSync(configPath) ? fs19.readFileSync(configPath, "utf8") : "";
+    const existing = fs20.existsSync(configPath) ? fs20.readFileSync(configPath, "utf8") : "";
     const next = upsertManagedAwsConfigSection(
       stripBareProfile(existing, profileName),
       `${opts.context} (mesh dev)`,
@@ -8555,15 +8789,15 @@ function rebaseServiceSrc(src, monorepoRoot) {
   if (!monorepoRoot) return src;
   const rel2 = monorepoRelativeSrc(src);
   if (rel2 === null) return src;
-  const rebased = path20.join(monorepoRoot, rel2);
-  return fs19.existsSync(rebased) ? rebased : src;
+  const rebased = path21.join(monorepoRoot, rel2);
+  return fs20.existsSync(rebased) ? rebased : src;
 }
 function isLinkedDependencyDir(serviceDir, appRoot) {
   let pkgRoot = null;
   let name = "";
-  for (let dir = serviceDir; ; dir = path20.dirname(dir)) {
+  for (let dir = serviceDir; ; dir = path21.dirname(dir)) {
     try {
-      const manifest = JSON.parse(fs19.readFileSync(path20.join(dir, "package.json"), "utf8"));
+      const manifest = JSON.parse(fs20.readFileSync(path21.join(dir, "package.json"), "utf8"));
       if (typeof manifest?.name === "string" && manifest.name) {
         pkgRoot = dir;
         name = manifest.name;
@@ -8571,21 +8805,21 @@ function isLinkedDependencyDir(serviceDir, appRoot) {
       }
     } catch {
     }
-    const parent = path20.dirname(dir);
+    const parent = path21.dirname(dir);
     if (parent === dir) break;
   }
   if (!pkgRoot) return false;
-  for (let dir = appRoot; ; dir = path20.dirname(dir)) {
+  for (let dir = appRoot; ; dir = path21.dirname(dir)) {
     try {
-      if (fs19.realpathSync(path20.join(dir, "node_modules", name)) === pkgRoot) return true;
+      if (fs20.realpathSync(path21.join(dir, "node_modules", name)) === pkgRoot) return true;
     } catch {
     }
-    const parent = path20.dirname(dir);
+    const parent = path21.dirname(dir);
     if (parent === dir) return false;
   }
 }
 function monorepoRelativeSrc(src) {
-  if (!path20.isAbsolute(src)) return src.replace(/^\.\//, "") || ".";
+  if (!path21.isAbsolute(src)) return src.replace(/^\.\//, "") || ".";
   const m = src.match(/^.*\/mesh-platform(?:\/(.*))?$/);
   if (!m) return null;
   const rest = (m[1] ?? "").replace(/^\.worktrees\/[^/]+(?:\/|$)/, "");
@@ -8620,7 +8854,7 @@ function getServiceEnvVars(service, tunnels) {
 }
 function setTmuxEnv(sessionName, vars) {
   for (const [key, value] of Object.entries(vars)) {
-    execFileSync15("tmux", ["set-environment", "-t", sessionName, key, value], { stdio: "ignore" });
+    execFileSync16("tmux", ["set-environment", "-t", sessionName, key, value], { stdio: "ignore" });
   }
 }
 function envPrefix(vars) {
@@ -8661,7 +8895,7 @@ function resolveTemporalEncodingKey(tenant, env, appName) {
   const namespace = `${tenant}-${env}-${appName}`;
   const secretName = `${namespace}-temporal-encoding-key`;
   try {
-    const b64 = execFileSync15(
+    const b64 = execFileSync16(
       "kubectl",
       [
         "get",
@@ -8697,7 +8931,7 @@ async function resolveTemporalAuthVars(sessionName, devOutput) {
     setTmuxEnv(sessionName, { KUBECONFIG: kubeconfigPath });
   } else if (!process.env.KUBECONFIG) {
     const existing = sessionKubeconfigPath(sessionName);
-    if (fs19.existsSync(existing)) {
+    if (fs20.existsSync(existing)) {
       process.env.KUBECONFIG = existing;
     }
   }
@@ -8866,7 +9100,7 @@ async function allocateSsmLocalPort(remotePort, reservedPorts) {
 }
 function hasSessionManagerPlugin() {
   try {
-    execFileSync15("which", ["session-manager-plugin"], { stdio: "ignore" });
+    execFileSync16("which", ["session-manager-plugin"], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -8965,13 +9199,13 @@ async function startSsmTunnels(sessionName, devOutput) {
         localPortNumber: [String(localPort)]
       })}'`
     ].join(" ");
-    execFileSync15("tmux", ["new-window", "-t", sessionName, "-n", windowName]);
-    execFileSync15(
+    execFileSync16("tmux", ["new-window", "-t", sessionName, "-n", windowName]);
+    execFileSync16(
       "tmux",
       ["set-option", "-t", `${sessionName}:${windowName}`, "remain-on-exit", "on"],
       { stdio: "ignore" }
     );
-    execFileSync15("tmux", ["send-keys", "-t", `${sessionName}:${windowName}`, ssmCmd, "Enter"]);
+    execFileSync16("tmux", ["send-keys", "-t", `${sessionName}:${windowName}`, ssmCmd, "Enter"]);
     rewritten.tunnels[tunnelName] = {
       host: "localhost",
       port: localPort
@@ -8983,7 +9217,7 @@ async function startSsmTunnels(sessionName, devOutput) {
   return rewritten;
 }
 async function updateDevboxProxy(devOutput, appRoot) {
-  const appName = devOutput.app ?? path20.basename(appRoot);
+  const appName = devOutput.app ?? path21.basename(appRoot);
   const tenant = devOutput.platform?.tenant ?? "mesh";
   const env = devOutput.platform?.env ?? "dev";
   const stack = devOutput.stack ?? "dev";
@@ -9015,7 +9249,7 @@ async function updateDevboxProxy(devOutput, appRoot) {
     lines.push("");
   }
   const caddyfile = lines.join("\n");
-  execFileSync15(
+  execFileSync16(
     "docker",
     [
       "run",
@@ -9031,7 +9265,7 @@ CADDYEOF`
     ],
     { stdio: "pipe" }
   );
-  execFileSync15(
+  execFileSync16(
     "docker",
     [
       "run",
@@ -9061,7 +9295,7 @@ CADDYEOF`
 async function setupSubdomainRouting(devOutput, appRoot) {
   const tsInfo = await getTailscaleInfo();
   if (!tsInfo) return null;
-  const appName = devOutput.app ?? path20.basename(appRoot);
+  const appName = devOutput.app ?? path21.basename(appRoot);
   const stack = devOutput.stack ?? "dev";
   const baseDomain = `${appName}.${stack}.${tsInfo.hostname}.vpn.internal`;
   const platform = devOutput.platform ?? { tenant: "mesh", env: "dev" };
@@ -9080,8 +9314,8 @@ async function setupSubdomainRouting(devOutput, appRoot) {
   } catch {
   }
   const caddyDir = "/tmp/mesh-dev-caddy";
-  const caddyfile = path20.join(caddyDir, "Caddyfile");
-  if (!fs19.existsSync(caddyDir)) fs19.mkdirSync(caddyDir, { recursive: true });
+  const caddyfile = path21.join(caddyDir, "Caddyfile");
+  if (!fs20.existsSync(caddyDir)) fs20.mkdirSync(caddyDir, { recursive: true });
   const caddyLines = [`# mesh-dev: ${appName}/${stack} (${tsInfo.hostname})`, ""];
   for (const [name, service] of Object.entries(devOutput.services)) {
     if (service.port) {
@@ -9099,16 +9333,16 @@ async function setupSubdomainRouting(devOutput, appRoot) {
     caddyLines.push("}");
     caddyLines.push("");
   }
-  fs19.writeFileSync(caddyfile, caddyLines.join("\n"));
+  fs20.writeFileSync(caddyfile, caddyLines.join("\n"));
   let caddyRunning = false;
   try {
-    execFileSync15("pgrep", ["-f", "caddy run.*mesh-dev-caddy"], { stdio: "pipe" });
+    execFileSync16("pgrep", ["-f", "caddy run.*mesh-dev-caddy"], { stdio: "pipe" });
     caddyRunning = true;
   } catch {
   }
   if (caddyRunning) {
     try {
-      execFileSync15("caddy", ["reload", "--config", caddyfile, "--adapter", "caddyfile"], {
+      execFileSync16("caddy", ["reload", "--config", caddyfile, "--adapter", "caddyfile"], {
         stdio: "pipe"
       });
     } catch {
@@ -9117,7 +9351,7 @@ async function setupSubdomainRouting(devOutput, appRoot) {
     }
   } else {
     try {
-      execFileSync15("which", ["caddy"], { stdio: "pipe" });
+      execFileSync16("which", ["caddy"], { stdio: "pipe" });
     } catch {
       logWarn(
         "Caddy not found. Install for subdomain routing: curl -fsSL https://caddyserver.com/api/download?os=linux&arch=arm64 -o /usr/local/bin/caddy && chmod +x /usr/local/bin/caddy"
@@ -9159,7 +9393,7 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
     return devOutput;
   }
   logInfo(`Creating tmux session: ${sessionName}`);
-  execFileSync15("tmux", ["new-session", "-d", "-s", sessionName, "-n", "status", "-c", appRoot]);
+  execFileSync16("tmux", ["new-session", "-d", "-s", sessionName, "-n", "status", "-c", appRoot]);
   setTmuxEnv(sessionName, awsEnv);
   const hasTunnels = Object.keys(devOutput.tunnels).length > 0;
   let effectiveTransport = tunnelPlan.transport;
@@ -9270,13 +9504,13 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
     const tokenPort = await findFreePort3();
     const tokenUrl = `http://127.0.0.1:${tokenPort}`;
     setTmuxEnv(sessionName, { DEV_USER_TOKEN_URL: tokenUrl });
-    execFileSync15("tmux", ["new-window", "-t", sessionName, "-n", "token-server"]);
-    execFileSync15(
+    execFileSync16("tmux", ["new-window", "-t", sessionName, "-n", "token-server"]);
+    execFileSync16(
       "tmux",
       ["set-option", "-t", `${sessionName}:token-server`, "remain-on-exit", "on"],
       { stdio: "ignore" }
     );
-    execFileSync15("tmux", [
+    execFileSync16("tmux", [
       "send-keys",
       "-t",
       `${sessionName}:token-server`,
@@ -9299,9 +9533,9 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
       logInfo(`Skipped: ${name} (no dev command, deployed to K8s)`);
       continue;
     }
-    const serviceDir = path20.resolve(appRoot, rebaseServiceSrc(service.src, monorepoRoot));
-    if (worktreeRoot && fs19.existsSync(serviceDir)) {
-      const wtRootWithSep = worktreeRoot.endsWith(path20.sep) ? worktreeRoot : worktreeRoot + path20.sep;
+    const serviceDir = path21.resolve(appRoot, rebaseServiceSrc(service.src, monorepoRoot));
+    if (worktreeRoot && fs20.existsSync(serviceDir)) {
+      const wtRootWithSep = worktreeRoot.endsWith(path21.sep) ? worktreeRoot : worktreeRoot + path21.sep;
       const outside = serviceDir !== worktreeRoot && !serviceDir.startsWith(wtRootWithSep);
       if (outside && isLinkedDependencyDir(serviceDir, appRoot)) {
         logInfo(`${name}: source is a dev-linked package (${serviceDir})`);
@@ -9312,7 +9546,7 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
         process.exit(1);
       }
     }
-    if (!fs19.existsSync(serviceDir)) {
+    if (!fs20.existsSync(serviceDir)) {
       logWarn(
         `Skipped: ${name} (source directory not found: ${serviceDir}${serviceDir !== service.src ? ` \u2014 rebased from ${service.src}` : ""})`
       );
@@ -9352,11 +9586,11 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
       cmd,
       service.env?.OTEL_RESOURCE_ATTRIBUTES ? logShipperPath() : void 0
     );
-    execFileSync15("tmux", ["new-window", "-t", sessionName, "-n", name, "-c", serviceDir]);
-    execFileSync15("tmux", ["set-option", "-t", `${sessionName}:${name}`, "remain-on-exit", "on"], {
+    execFileSync16("tmux", ["new-window", "-t", sessionName, "-n", name, "-c", serviceDir]);
+    execFileSync16("tmux", ["set-option", "-t", `${sessionName}:${name}`, "remain-on-exit", "on"], {
       stdio: "ignore"
     });
-    execFileSync15("tmux", ["send-keys", "-t", `${sessionName}:${name}`, launchCmd, "Enter"]);
+    execFileSync16("tmux", ["send-keys", "-t", `${sessionName}:${name}`, launchCmd, "Enter"]);
     logSuccess(`Started: ${name} (${serviceDir}, port ${service.port})`);
   }
   if (process.env.DEVCONTAINER === "1") {
@@ -9367,7 +9601,7 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
     }
   }
   const statusCmd = `watch -n2 -t npx mesh dev --status --session '${sessionName}'`;
-  execFileSync15("tmux", ["send-keys", "-t", `${sessionName}:status`, statusCmd, "Enter"]);
+  execFileSync16("tmux", ["send-keys", "-t", `${sessionName}:status`, statusCmd, "Enter"]);
   console.log("");
   logSuccess(`Dev session started: ${sessionName}`);
   console.log("");
@@ -9424,7 +9658,7 @@ async function showStatus2(sessionName, devOutput, asJson) {
   }
   let windows = [];
   try {
-    const raw = execFileSync15(
+    const raw = execFileSync16(
       "tmux",
       ["list-windows", "-t", sessionName, "-F", "#{window_name} #{pane_dead}"],
       { encoding: "utf-8" }
@@ -9546,7 +9780,7 @@ async function restartService(sessionName, serviceName, appRoot, devOutput, awsE
   }
   const target = `${sessionName}:${serviceName}`;
   try {
-    execFileSync15("tmux", ["respawn-pane", "-k", "-t", target], { stdio: "ignore" });
+    execFileSync16("tmux", ["respawn-pane", "-k", "-t", target], { stdio: "ignore" });
   } catch {
     logError(`Window '${serviceName}' not found in session.`);
     process.exit(1);
@@ -9555,8 +9789,8 @@ async function restartService(sessionName, serviceName, appRoot, devOutput, awsE
   const cmd = service.command.join(" ");
   const envFilePath = getServiceEnvFilePath(sessionName, serviceName);
   let restartCmd;
-  if (fs19.existsSync(envFilePath)) {
-    const serviceDir = path20.resolve(appRoot, rebaseServiceSrc(service.src, findMonorepoRoot()));
+  if (fs20.existsSync(envFilePath)) {
+    const serviceDir = path21.resolve(appRoot, rebaseServiceSrc(service.src, findMonorepoRoot()));
     restartCmd = buildLaunchCommand(
       envFilePath,
       serviceDir,
@@ -9571,7 +9805,7 @@ async function restartService(sessionName, serviceName, appRoot, devOutput, awsE
     const serviceVars = getServiceEnvVars(service, devOutput.tunnels);
     restartCmd = `${envPrefix(serviceVars)}${cmd}`;
   }
-  execFileSync15("tmux", ["send-keys", "-t", target, restartCmd, "Enter"]);
+  execFileSync16("tmux", ["send-keys", "-t", target, restartCmd, "Enter"]);
   logSuccess(`Restarted: ${serviceName}`);
 }
 function showLogs(sessionName, serviceName, tail) {
@@ -9581,7 +9815,7 @@ function showLogs(sessionName, serviceName, tail) {
   }
   const target = `${sessionName}:${serviceName}`;
   try {
-    const result = execFileSync15("tmux", ["capture-pane", "-t", target, "-p", "-S", `-${tail}`], {
+    const result = execFileSync16("tmux", ["capture-pane", "-t", target, "-p", "-S", `-${tail}`], {
       encoding: "utf-8"
     });
     process.stdout.write(result);
@@ -9809,7 +10043,7 @@ function registerDevCommand(program2) {
         signInServices = [];
         try {
           const appPkg = JSON.parse(
-            fs19.readFileSync(path20.join(appRoot, "package.json"), "utf-8")
+            fs20.readFileSync(path21.join(appRoot, "package.json"), "utf-8")
           );
           if (Array.isArray(appPkg?.mesh?.auth?.roles)) {
             authRoles = appPkg.mesh.auth.roles.filter((r) => typeof r === "string");
@@ -9986,9 +10220,9 @@ function registerDevCommand(program2) {
     logInfo(`Project: ${projectName}, Stack: ${stack}`);
     const monorepoRoot = findMonorepoRoot();
     const looksLikeStandaloneApp = ["api", "worker", "web"].some(
-      (dir) => fs19.existsSync(path20.join(appRoot, dir, "package.json"))
+      (dir) => fs20.existsSync(path21.join(appRoot, dir, "package.json"))
     );
-    if (monorepoRoot && path20.resolve(appRoot) === path20.resolve(monorepoRoot) && !looksLikeStandaloneApp) {
+    if (monorepoRoot && path21.resolve(appRoot) === path21.resolve(monorepoRoot) && !looksLikeStandaloneApp) {
       logError(`mesh dev should be run from an app directory, not the monorepo root.
 `);
       logInfo("Try:");
@@ -10464,10 +10698,10 @@ var init_dev = __esm({
 });
 
 // libs/mesh-cli/src/commands/dev-doctor.ts
-import { execFileSync as execFileSync16 } from "node:child_process";
-import * as fs20 from "node:fs";
+import { execFileSync as execFileSync17 } from "node:child_process";
+import * as fs21 from "node:fs";
 import * as net9 from "node:net";
-import * as path21 from "node:path";
+import * as path22 from "node:path";
 function aggregateStatus(results) {
   if (results.some((r) => r.status === "error")) return "error";
   if (results.some((r) => r.status === "warn")) return "warn";
@@ -10570,9 +10804,9 @@ function parsePortSquatter(lsofOut, psOut) {
   return { pid, command };
 }
 function sharesWorktreeRoot(serviceSrc, repoRoot2) {
-  const src = path21.resolve(serviceSrc);
-  const root = path21.resolve(repoRoot2);
-  return src === root || src.startsWith(root + path21.sep);
+  const src = path22.resolve(serviceSrc);
+  const root = path22.resolve(repoRoot2);
+  return src === root || src.startsWith(root + path22.sep);
 }
 function classifyPortListener(listenerPid, sessionPids) {
   if (listenerPid === null) return "dead";
@@ -10601,7 +10835,7 @@ function collectSessionPids(panePids, psOut) {
 }
 function whoHasPort(port) {
   try {
-    const lsof = execFileSync16("lsof", ["-ti", `:${port}`], {
+    const lsof = execFileSync17("lsof", ["-ti", `:${port}`], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -10609,7 +10843,7 @@ function whoHasPort(port) {
     if (!pid) return null;
     let ps = "";
     try {
-      ps = execFileSync16("ps", ["-o", "comm=", "-p", pid], {
+      ps = execFileSync17("ps", ["-o", "comm=", "-p", pid], {
         encoding: "utf8",
         stdio: ["ignore", "pipe", "ignore"]
       });
@@ -10623,7 +10857,7 @@ function whoHasPort(port) {
 function sessionProcessTree(sessionName) {
   let panePids;
   try {
-    const out = execFileSync16(
+    const out = execFileSync17(
       "tmux",
       ["list-panes", "-s", "-t", sessionName, "-F", "#{pane_pid}"],
       { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }
@@ -10635,7 +10869,7 @@ function sessionProcessTree(sessionName) {
   if (panePids.length === 0) return /* @__PURE__ */ new Set();
   let psOut = "";
   try {
-    psOut = execFileSync16("ps", ["-eo", "pid=,ppid="], {
+    psOut = execFileSync17("ps", ["-eo", "pid=,ppid="], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -10757,7 +10991,7 @@ var init_dev_doctor = __esm({
       phases: ["preflight", "ondemand"],
       async run() {
         try {
-          execFileSync16("which", ["tmux"], { stdio: "ignore" });
+          execFileSync17("which", ["tmux"], { stdio: "ignore" });
           return { status: "ok", summary: "installed" };
         } catch {
           return {
@@ -10832,14 +11066,14 @@ var init_dev_doctor = __esm({
         if (!state) {
           return { status: "ok", summary: "no session \u2014 config read fresh at launch" };
         }
-        const configPath = path21.join(ctx.appRoot, `Pulumi.${ctx.stack}.yaml`);
-        if (!fs20.existsSync(configPath)) {
+        const configPath = path22.join(ctx.appRoot, `Pulumi.${ctx.stack}.yaml`);
+        if (!fs21.existsSync(configPath)) {
           return {
             status: "ok",
             summary: `no Pulumi.${ctx.stack}.yaml to compare`
           };
         }
-        const mtimeMs = fs20.statSync(configPath).mtimeMs;
+        const mtimeMs = fs21.statSync(configPath).mtimeMs;
         if (isConfigStale(mtimeMs, state.startedAt)) {
           return {
             status: "warn",
@@ -10862,7 +11096,7 @@ var init_dev_doctor = __esm({
         }
         let repoRoot2;
         try {
-          repoRoot2 = execFileSync16("git", ["rev-parse", "--show-toplevel"], {
+          repoRoot2 = execFileSync17("git", ["rev-parse", "--show-toplevel"], {
             cwd: ctx.appRoot,
             encoding: "utf8",
             stdio: ["ignore", "pipe", "ignore"]
@@ -10998,21 +11232,21 @@ var init_dev_doctor = __esm({
 });
 
 // libs/mesh-cli/src/commands/app-check.ts
-import * as fs21 from "node:fs";
-import * as path22 from "node:path";
+import * as fs22 from "node:fs";
+import * as path23 from "node:path";
 function rel(root, abs) {
-  return path22.relative(root, abs).split(path22.sep).join("/");
+  return path23.relative(root, abs).split(path23.sep).join("/");
 }
 function isDir(p) {
   try {
-    return fs21.statSync(p).isDirectory();
+    return fs22.statSync(p).isDirectory();
   } catch {
     return false;
   }
 }
 function readText(p) {
   try {
-    return fs21.readFileSync(p, "utf8");
+    return fs22.readFileSync(p, "utf8");
   } catch {
     return "";
   }
@@ -11022,19 +11256,19 @@ function srcFiles(dir) {
   const walk2 = (d) => {
     let entries;
     try {
-      entries = fs21.readdirSync(d, { withFileTypes: true });
+      entries = fs22.readdirSync(d, { withFileTypes: true });
     } catch {
       return;
     }
     for (const e of entries) {
-      const p = path22.join(d, e.name);
+      const p = path23.join(d, e.name);
       if (e.isDirectory()) {
         if (SKIP_DIRS.has(e.name) || e.name.startsWith("scenario")) continue;
         walk2(p);
         continue;
       }
       if (!e.isFile()) continue;
-      if (!SRC_EXT.has(path22.extname(e.name))) continue;
+      if (!SRC_EXT.has(path23.extname(e.name))) continue;
       if (/\.(test|spec)\./.test(e.name) || /\.config\./.test(e.name) || e.name === "build.mjs") continue;
       out.push(p);
     }
@@ -11051,23 +11285,23 @@ function isUiDir(name) {
 function serviceDirs(app) {
   let entries;
   try {
-    entries = fs21.readdirSync(app, { withFileTypes: true });
+    entries = fs22.readdirSync(app, { withFileTypes: true });
   } catch {
     return [];
   }
-  return entries.filter((e) => e.isDirectory() && !NON_SERVICE_DIRS.has(e.name) && !e.name.startsWith(".") && !isTestHarness(e.name)).map((e) => path22.join(app, e.name)).sort();
+  return entries.filter((e) => e.isDirectory() && !NON_SERVICE_DIRS.has(e.name) && !e.name.startsWith(".") && !isTestHarness(e.name)).map((e) => path23.join(app, e.name)).sort();
 }
 function authzSurface(app) {
   const hits = [];
   const walk2 = (d) => {
     let entries;
     try {
-      entries = fs21.readdirSync(d, { withFileTypes: true });
+      entries = fs22.readdirSync(d, { withFileTypes: true });
     } catch {
       return;
     }
     for (const e of entries) {
-      const p = path22.join(d, e.name);
+      const p = path23.join(d, e.name);
       if (e.isDirectory()) {
         if (["node_modules", "dist", "build"].includes(e.name)) continue;
         walk2(p);
@@ -11366,32 +11600,32 @@ function docsAudienceUngrantable(text, decl, args, docs, httpText) {
 }
 function listApps(root) {
   const apps = [];
-  const appsDir = path22.join(root, "apps");
+  const appsDir = path23.join(root, "apps");
   if (isDir(appsDir)) {
-    for (const e of fs21.readdirSync(appsDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+    for (const e of fs22.readdirSync(appsDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
       if (!e.isDirectory()) continue;
-      const d = path22.join(appsDir, e.name);
-      if (fs21.existsSync(path22.join(d, "index.ts")) || fs21.existsSync(path22.join(d, "Pulumi.yaml"))) apps.push(rel(root, d));
+      const d = path23.join(appsDir, e.name);
+      if (fs22.existsSync(path23.join(d, "index.ts")) || fs22.existsSync(path23.join(d, "Pulumi.yaml"))) apps.push(rel(root, d));
     }
   }
-  if (fs21.existsSync(path22.join(root, "index.ts")) && fs21.existsSync(path22.join(root, "Pulumi.yaml"))) apps.push(".");
+  if (fs22.existsSync(path23.join(root, "index.ts")) && fs22.existsSync(path23.join(root, "Pulumi.yaml"))) apps.push(".");
   return apps;
 }
 function scanApp(root, appRel) {
-  const app = path22.resolve(root, appRel);
-  const index = path22.join(app, "index.ts");
+  const app = path23.resolve(root, appRel);
+  const index = path23.join(app, "index.ts");
   const findings = [];
   const hit = (code, p, why) => {
     findings.push({ code, path: p, why });
   };
-  const hasProgram = fs21.existsSync(index) || fs21.existsSync(path22.join(app, "Pulumi.yaml"));
+  const hasProgram = fs22.existsSync(index) || fs22.existsSync(path23.join(app, "Pulumi.yaml"));
   if (!hasProgram) return findings;
-  if (fs21.existsSync(index)) {
+  if (fs22.existsSync(index)) {
     const indexRel = rel(root, index);
     let servesHtml = false;
     let hasUiService = false;
     for (const svc of serviceDirs(app)) {
-      const svcName = path22.basename(svc);
+      const svcName = path23.basename(svc);
       if (isUiDir(svcName)) {
         hasUiService = true;
         continue;
@@ -11435,7 +11669,7 @@ function scanApp(root, appRel) {
   const exposure = first(RE_EXPOSURE);
   const pointer = first(RE_POINTER);
   const metadata = first(RE_METADATA);
-  const appLabel = appRel === "." ? "(root)" : path22.basename(appRel);
+  const appLabel = appRel === "." ? "(root)" : path23.basename(appRel);
   if (exposure && !pointer) {
     const at = surface.find((h) => RE_EXPOSURE.test(h.text) && /(^|\/)index\.ts$/.test(h.file)) ?? exposure;
     hit(
@@ -11471,7 +11705,7 @@ function scanApp(root, appRel) {
 }
 function isPlatformPackage(dir) {
   try {
-    const pkg = JSON.parse(readText(path22.join(dir, "package.json")));
+    const pkg = JSON.parse(readText(path23.join(dir, "package.json")));
     return typeof pkg.name === "string" && pkg.name.startsWith("@mesh-tech/");
   } catch {
     return false;
@@ -11480,11 +11714,11 @@ function isPlatformPackage(dir) {
 function scanRepo(root) {
   const findings = [];
   for (const parent of ["libs", "packages"]) {
-    const dir = path22.join(root, parent);
+    const dir = path23.join(root, parent);
     if (!isDir(dir)) continue;
-    for (const e of fs21.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+    for (const e of fs22.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
       if (!e.isDirectory() || !e.name.includes("auth")) continue;
-      const lib = path22.join(dir, e.name);
+      const lib = path23.join(dir, e.name);
       if (isPlatformPackage(lib)) continue;
       const verifies = srcFiles(lib).filter((f) => f.endsWith(".ts")).some((f) => /introspect|jwtVerify|createRemoteJWKSet|from ["']jose["']/.test(readText(f)));
       if (verifies) {
@@ -11521,7 +11755,7 @@ async function runAppCheck(root, apps) {
   if (!isDir(root)) throw new MeshCliError(`no such checkout: ${root}`);
   const targets = apps && apps.length > 0 ? apps.map((a) => a.replace(/\/+$/, "")) : listApps(root);
   for (const a of targets) {
-    if (!isDir(path22.resolve(root, a))) throw new MeshCliError(`no such app dir: ${a}`);
+    if (!isDir(path23.resolve(root, a))) throw new MeshCliError(`no such app dir: ${a}`);
   }
   const scopes = [];
   for (const app of targets) {
@@ -11555,7 +11789,7 @@ function registerAppCommands(program2) {
   app.command("check").description(
     "Check tenant apps against the Mesh app contract (@mesh-tech/app-kit skills/apps/references/app-contract.md): a UI is its own service, the app registers with the Hub, sign-in goes through the platform proxy, logs go through @mesh-tech/logger, and people/roles/keys are surfaced through the Hub. Exit 1 on any blocking finding \u2014 the same gate mesh create-app, tenant CI and the platform reviewer run."
   ).argument("[apps...]", "repo-relative app dirs to check (default: every apps/* with a Pulumi program)").option("--root <dir>", "checkout to scan (default: the enclosing git root)").option("--json", "machine-readable output (one report per app plus the repo-scoped checks)", false).option("--verbose", "also print the gates that passed", false).action(async (apps, opts) => {
-    const root = path22.resolve(opts.root ?? resolveTargetRoot());
+    const root = path23.resolve(opts.root ?? resolveTargetRoot());
     const report = await runAppCheck(root, apps);
     if (opts.json) {
       emitJsonPayload({ ok: report.status !== "error", ...report });
@@ -11596,7 +11830,11 @@ var init_app_check = __esm({
         gate: "0.2",
         title: "App registers with the Hub",
         severity: "block",
-        remediation: "end index.ts with `export const app = env.register({ description })`",
+        // The registration's prose is read by the CLIENT's operators, so the
+        // remediation names the split rather than one field: `description` is one
+        // sentence for them, `operatorNote` is where the engineering material goes
+        // (a tenant-audience Hub drops that key from the response entirely).
+        remediation: "end index.ts with `export const app = env.register({ displayName, description })` \u2014 one sentence a non-technical operator can act on; put the caveats in `operatorNote`",
         scope: "app"
       },
       CUSTOM_SESSION_AUTH: {
@@ -11795,14 +12033,14 @@ var init_resolve = __esm({
 });
 
 // packages/agent-targets/src/load.ts
-import { readFileSync as readFileSync18 } from "node:fs";
+import { readFileSync as readFileSync19 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import path23 from "node:path";
+import path24 from "node:path";
 function loadTargetsFile(env = process.env) {
   const file = env.MESH_AGENT_TARGETS || DEFAULT_REGISTRY_PATH;
   let raw;
   try {
-    raw = readFileSync18(file, "utf8");
+    raw = readFileSync19(file, "utf8");
   } catch {
     return { status: "absent", path: file };
   }
@@ -11821,7 +12059,7 @@ var init_load = __esm({
     "use strict";
     init_schema();
     init_resolve();
-    DEFAULT_REGISTRY_PATH = path23.join(homedir3(), ".config", "mesh", "agent-targets.json");
+    DEFAULT_REGISTRY_PATH = path24.join(homedir3(), ".config", "mesh", "agent-targets.json");
   }
 });
 
@@ -12053,9 +12291,9 @@ var init_pull = __esm({
 
 // packages/agent-targets/src/pull/write.ts
 import { mkdir, writeFile } from "node:fs/promises";
-import { join as join20, dirname as dirname19 } from "node:path";
+import { join as join21, dirname as dirname19 } from "node:path";
 async function put(dir, rel2, contents, written) {
-  const abs = join20(dir, rel2);
+  const abs = join21(dir, rel2);
   await mkdir(dirname19(abs), { recursive: true });
   await writeFile(abs, contents);
   written.push(rel2);
@@ -12182,7 +12420,7 @@ import { execFile as execFile2 } from "node:child_process";
 import { promisify } from "node:util";
 import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir as tmpdir4 } from "node:os";
-import { join as join21 } from "node:path";
+import { join as join22 } from "node:path";
 function deriveVcsBaseUrl(apiBaseUrl) {
   try {
     const u = new URL(apiBaseUrl);
@@ -12241,7 +12479,7 @@ function createVcsFolderReader(opts) {
     let p = clones.get(repo);
     if (!p) {
       p = (async () => {
-        const dir = await mkdtemp(join21(tmpdir4(), "mesh-vcs-"));
+        const dir = await mkdtemp(join22(tmpdir4(), "mesh-vcs-"));
         await execFileAsync("git", [
           "clone",
           "--filter=blob:none",
@@ -12258,11 +12496,11 @@ function createVcsFolderReader(opts) {
     }
     return p;
   };
-  const readPath = async (repo, path47) => {
+  const readPath = async (repo, path48) => {
     const dir = await cloneRepo(repo);
-    const ref = await resolveFolderRef(dir, path47);
-    if (!ref) throw new Error(`path "${path47}" not found on any ref of ${repo}`);
-    const files = await readFolderAtRef(dir, ref, path47);
+    const ref = await resolveFolderRef(dir, path48);
+    if (!ref) throw new Error(`path "${path48}" not found on any ref of ${repo}`);
+    const files = await readFolderAtRef(dir, ref, path48);
     return { ref, files };
   };
   const cleanup = async () => {
@@ -12453,8 +12691,8 @@ var init_agent_api_client = __esm({
 });
 
 // libs/mesh-cli/src/commands/artifacts.ts
-import * as fs22 from "fs";
-import * as path24 from "path";
+import * as fs23 from "fs";
+import * as path25 from "path";
 function parseRef(ref) {
   const colonIdx = ref.indexOf(":");
   if (colonIdx === -1) {
@@ -12477,28 +12715,28 @@ async function getArtifact(ref, options, target) {
   const { conversationId, artifactId } = parseRef(ref);
   logInfo(`Fetching ${conversationId}:${artifactId} from ${target.apiBaseUrl}\u2026`);
   const bundle = await fetchExportBundle(target, conversationId, artifactId);
-  const outputDir = options.output ?? path24.join("workflows", bundle.primaryWorkflow);
-  fs22.mkdirSync(outputDir, { recursive: true });
+  const outputDir = options.output ?? path25.join("workflows", bundle.primaryWorkflow);
+  fs23.mkdirSync(outputDir, { recursive: true });
   let filesWritten = 0;
   for (const file of bundle.files) {
-    const filePath = path24.join(outputDir, file.filename);
-    fs22.writeFileSync(filePath, file.code, "utf-8");
+    const filePath = path25.join(outputDir, file.filename);
+    fs23.writeFileSync(filePath, file.code, "utf-8");
     logSuccess(`  ${file.filename}`);
     filesWritten++;
   }
   if (bundle.overview) {
-    const readmePath = path24.join(outputDir, "README.md");
-    fs22.writeFileSync(readmePath, bundle.overview, "utf-8");
+    const readmePath = path25.join(outputDir, "README.md");
+    fs23.writeFileSync(readmePath, bundle.overview, "utf-8");
     logSuccess(`  README.md`);
     filesWritten++;
   }
   if (bundle.ir) {
-    const irPath = path24.join(outputDir, "workflow-ir.json");
-    fs22.writeFileSync(irPath, JSON.stringify(bundle.ir, null, 2), "utf-8");
+    const irPath = path25.join(outputDir, "workflow-ir.json");
+    fs23.writeFileSync(irPath, JSON.stringify(bundle.ir, null, 2), "utf-8");
     logSuccess(`  workflow-ir.json`);
     filesWritten++;
   }
-  const metaPath = path24.join(outputDir, ".workflow-meta.json");
+  const metaPath = path25.join(outputDir, ".workflow-meta.json");
   const meta = {
     conversationId: bundle.conversationId,
     artifactId,
@@ -12506,7 +12744,7 @@ async function getArtifact(ref, options, target) {
     exportedAt: bundle.exportedAt,
     files: bundle.files.map((f) => f.filename)
   };
-  fs22.writeFileSync(metaPath, JSON.stringify(meta, null, 2), "utf-8");
+  fs23.writeFileSync(metaPath, JSON.stringify(meta, null, 2), "utf-8");
   console.log();
   logSuccess(
     `Exported ${filesWritten} files to ${outputDir}/`
@@ -12930,7 +13168,7 @@ var init_conversations = __esm({
 });
 
 // libs/mesh-cli/src/utils/scaffold-versions.ts
-import { execFileSync as execFileSync17 } from "child_process";
+import { execFileSync as execFileSync18 } from "child_process";
 function isPrerelease(range) {
   return /[-+]/.test(range.replace(/^\^/, ""));
 }
@@ -12940,7 +13178,7 @@ function toCaretRange(version) {
 }
 function resolvePublishedRange(pkg, cwd) {
   try {
-    const out = execFileSync17("npm", ["view", pkg, "version"], {
+    const out = execFileSync18("npm", ["view", pkg, "version"], {
       cwd,
       encoding: "utf-8",
       timeout: 15e3,
@@ -12986,23 +13224,23 @@ __export(create_app_exports, {
   shouldBootstrapAppsRepo: () => shouldBootstrapAppsRepo,
   workspaceGlobForApp: () => workspaceGlobForApp
 });
-import * as fs23 from "fs";
+import * as fs24 from "fs";
 import * as os7 from "os";
-import * as path25 from "path";
+import * as path26 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import Handlebars from "handlebars";
 import { parse as parseYaml2 } from "yaml";
 function isInsidePlatformMonorepo(dir) {
-  let cur = path25.resolve(dir);
-  while (cur !== path25.dirname(cur)) {
-    if (fs23.existsSync(path25.join(cur, "pnpm-workspace.yaml"))) {
+  let cur = path26.resolve(dir);
+  while (cur !== path26.dirname(cur)) {
+    if (fs24.existsSync(path26.join(cur, "pnpm-workspace.yaml"))) {
       try {
-        const pkg = JSON.parse(fs23.readFileSync(path25.join(cur, "package.json"), "utf-8"));
+        const pkg = JSON.parse(fs24.readFileSync(path26.join(cur, "package.json"), "utf-8"));
         if (pkg?.name === PLATFORM_MONOREPO_NAME) return true;
       } catch {
       }
     }
-    cur = path25.dirname(cur);
+    cur = path26.dirname(cur);
   }
   return false;
 }
@@ -13011,46 +13249,46 @@ function resolveDeployerRoleArn(tenant, platformName, env) {
   return `arn:aws:iam::${account}:role/${tenant}-${env}-apps-deployer`;
 }
 function shouldBootstrapAppsRepo(cwd) {
-  return fs23.existsSync(path25.join(cwd, ".git")) && !isInsidePlatformMonorepo(cwd) && !fs23.existsSync(path25.join(cwd, "package.json")) && !fs23.existsSync(path25.join(cwd, "tenants")) && !fs23.existsSync(path25.join(cwd, "apps"));
+  return fs24.existsSync(path26.join(cwd, ".git")) && !isInsidePlatformMonorepo(cwd) && !fs24.existsSync(path26.join(cwd, "package.json")) && !fs24.existsSync(path26.join(cwd, "tenants")) && !fs24.existsSync(path26.join(cwd, "apps"));
 }
 function bootstrapAppsRepo(cwd, tenant) {
-  const templateDir = path25.join(packageRoot, "templates", "apps-repo");
+  const templateDir = path26.join(packageRoot, "templates", "apps-repo");
   const registryAccount = HUB_ACCOUNTS.mesh;
   const context = {
-    repoName: path25.basename(cwd),
+    repoName: path26.basename(cwd),
     tenant,
     tenantTitle: tenant.split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" "),
     registryUrl: `https://mesh-platform-${registryAccount}.d.codeartifact.us-east-2.amazonaws.com/npm/mesh-packages/`,
     intentRange: INTENT_RANGE
   };
-  const staging = fs23.mkdtempSync(path25.join(os7.tmpdir(), "mesh-apps-repo-"));
+  const staging = fs24.mkdtempSync(path26.join(os7.tmpdir(), "mesh-apps-repo-"));
   try {
     copyTemplate(templateDir, staging, context);
     for (const [from, to] of [
       ["gitignore", ".gitignore"],
       ["npmrc", ".npmrc"]
     ]) {
-      const p = path25.join(staging, from);
-      if (fs23.existsSync(p)) fs23.renameSync(p, path25.join(staging, to));
+      const p = path26.join(staging, from);
+      if (fs24.existsSync(p)) fs24.renameSync(p, path26.join(staging, to));
     }
     const created = [];
-    for (const entry of fs23.readdirSync(staging)) {
-      const dest = path25.join(cwd, entry);
-      if (fs23.existsSync(dest)) continue;
-      fs23.cpSync(path25.join(staging, entry), dest, { recursive: true });
+    for (const entry of fs24.readdirSync(staging)) {
+      const dest = path26.join(cwd, entry);
+      if (fs24.existsSync(dest)) continue;
+      fs24.cpSync(path26.join(staging, entry), dest, { recursive: true });
       created.push(entry);
     }
-    fs23.mkdirSync(path25.join(cwd, "apps"), { recursive: true });
+    fs24.mkdirSync(path26.join(cwd, "apps"), { recursive: true });
     created.push("apps/");
     return created;
   } finally {
-    fs23.rmSync(staging, { recursive: true, force: true });
+    fs24.rmSync(staging, { recursive: true, force: true });
   }
 }
 function ensureWorkspaceGlobs(root, required) {
-  const file = path25.join(root, "pnpm-workspace.yaml");
-  if (!fs23.existsSync(file)) return [];
-  const text = fs23.readFileSync(file, "utf-8");
+  const file = path26.join(root, "pnpm-workspace.yaml");
+  if (!fs24.existsSync(file)) return [];
+  const text = fs24.readFileSync(file, "utf-8");
   let declared;
   try {
     declared = parseYaml2(text)?.packages ?? [];
@@ -13074,13 +13312,13 @@ function ensureWorkspaceGlobs(root, required) {
   }
   const indent = (lines[end] ?? "").match(/^(\s*)-/)?.[1] ?? "  ";
   lines.splice(end + 1, 0, ...missing.map((glob) => `${indent}- ${glob}`));
-  fs23.writeFileSync(file, lines.join("\n"));
+  fs24.writeFileSync(file, lines.join("\n"));
   return missing;
 }
 function workspaceGlobForApp(root, appDir) {
-  const rel2 = path25.relative(root, appDir).split(path25.sep).join("/");
+  const rel2 = path26.relative(root, appDir).split(path26.sep).join("/");
   if (rel2 === "" || rel2.split("/")[0] === "..") return null;
-  return `${path25.posix.dirname(rel2)}/*/*`;
+  return `${path26.posix.dirname(rel2)}/*/*`;
 }
 function maybeBootstrapAppsRepo(cwd, tenant, test) {
   if (test || !shouldBootstrapAppsRepo(cwd)) return;
@@ -13130,9 +13368,9 @@ async function promptForOptions(options) {
   return { tenant, name, primitives };
 }
 function copyTemplate(srcDir, destDir, context) {
-  const entries = fs23.readdirSync(srcDir, { withFileTypes: true });
+  const entries = fs24.readdirSync(srcDir, { withFileTypes: true });
   for (const entry of entries) {
-    const srcPath = path25.join(srcDir, entry.name);
+    const srcPath = path26.join(srcDir, entry.name);
     let destName = entry.name;
     if (destName.endsWith(".hbs")) {
       destName = destName.slice(0, -4);
@@ -13140,17 +13378,17 @@ function copyTemplate(srcDir, destDir, context) {
     if (destName.includes("{{")) {
       destName = Handlebars.compile(destName)(context);
     }
-    const destPath = path25.join(destDir, destName);
+    const destPath = path26.join(destDir, destName);
     if (entry.isDirectory()) {
-      fs23.mkdirSync(destPath, { recursive: true });
+      fs24.mkdirSync(destPath, { recursive: true });
       copyTemplate(srcPath, destPath, context);
     } else if (entry.name.endsWith(".hbs")) {
-      const templateContent = fs23.readFileSync(srcPath, "utf-8");
+      const templateContent = fs24.readFileSync(srcPath, "utf-8");
       const template = Handlebars.compile(templateContent);
       const output = template(context);
-      fs23.writeFileSync(destPath, output);
+      fs24.writeFileSync(destPath, output);
     } else {
-      fs23.copyFileSync(srcPath, destPath);
+      fs24.copyFileSync(srcPath, destPath);
     }
   }
 }
@@ -13174,72 +13412,72 @@ function describeNoAppsHome(cwd, tenant, baseDir, test) {
     };
   }
   return {
-    message: `This directory is not a Mesh apps repo \u2014 no apps/ here${fs23.existsSync(path25.join(cwd, ".git")) ? "" : " and it is not a git repo"}.`,
+    message: `This directory is not a Mesh apps repo \u2014 no apps/ here${fs24.existsSync(path26.join(cwd, ".git")) ? "" : " and it is not a git repo"}.`,
     hint: `Run: mesh init   (turns this folder into your ${tenant}-mesh-apps repo), or cd into that repo and re-run mesh create-app.`
   };
 }
 function resolveAppDir(cwd, tenant, name, test) {
   const baseDir = test ? "tests/tenants" : "tenants";
-  const possiblePaths = test ? [path25.join(cwd, baseDir, tenant, "apps")] : [
-    path25.join(cwd, baseDir, tenant, "apps"),
-    path25.join(cwd, "..", tenant, "apps"),
-    path25.join(cwd, "apps")
+  const possiblePaths = test ? [path26.join(cwd, baseDir, tenant, "apps")] : [
+    path26.join(cwd, baseDir, tenant, "apps"),
+    path26.join(cwd, "..", tenant, "apps"),
+    path26.join(cwd, "apps")
   ];
-  let appsDir = possiblePaths.find((p) => fs23.existsSync(p));
+  let appsDir = possiblePaths.find((p) => fs24.existsSync(p));
   if (!appsDir) {
-    appsDir = path25.join(cwd, baseDir, tenant, "apps");
-    if (!fs23.existsSync(path25.join(cwd, baseDir, tenant))) {
+    appsDir = path26.join(cwd, baseDir, tenant, "apps");
+    if (!fs24.existsSync(path26.join(cwd, baseDir, tenant))) {
       const { message, hint } = describeNoAppsHome(cwd, tenant, baseDir, test);
       logError(message);
       logInfo(hint);
       process.exit(1);
     }
-    if (!fs23.existsSync(appsDir)) {
+    if (!fs24.existsSync(appsDir)) {
       logInfo(`Creating apps directory: ${appsDir}`);
-      fs23.mkdirSync(appsDir, { recursive: true });
+      fs24.mkdirSync(appsDir, { recursive: true });
     }
   }
-  return path25.join(appsDir, name);
+  return path26.join(appsDir, name);
 }
 function generateComposableApp(appDir, context) {
-  const fragmentsDir = path25.join(packageRoot, "fragments");
-  const baseDir = path25.join(fragmentsDir, "base");
-  if (!fs23.existsSync(baseDir)) {
+  const fragmentsDir = path26.join(packageRoot, "fragments");
+  const baseDir = path26.join(fragmentsDir, "base");
+  if (!fs24.existsSync(baseDir)) {
     logError(`Fragments directory not found: ${baseDir}`);
     logInfo("Make sure the mesh-cli package is installed correctly.");
     process.exit(1);
   }
   copyTemplate(baseDir, appDir, context);
   if (context.service) {
-    const serviceDir = path25.join(fragmentsDir, "service");
-    if (!fs23.existsSync(serviceDir)) {
+    const serviceDir = path26.join(fragmentsDir, "service");
+    if (!fs24.existsSync(serviceDir)) {
       throw new Error(`Fragment directory not found: ${serviceDir}`);
     }
     copyTemplate(serviceDir, appDir, context);
   }
   if (context.database) {
-    const dbDir = path25.join(fragmentsDir, "database");
-    if (!fs23.existsSync(dbDir)) {
+    const dbDir = path26.join(fragmentsDir, "database");
+    if (!fs24.existsSync(dbDir)) {
       throw new Error(`Fragment directory not found: ${dbDir}`);
     }
     copyTemplate(dbDir, appDir, context);
   }
   if (context.temporal) {
-    const temporalDir = path25.join(fragmentsDir, "temporal");
-    if (!fs23.existsSync(temporalDir)) {
+    const temporalDir = path26.join(fragmentsDir, "temporal");
+    if (!fs24.existsSync(temporalDir)) {
       throw new Error(`Fragment directory not found: ${temporalDir}`);
     }
     copyTemplate(temporalDir, appDir, context);
   }
   if (context.bucket) {
-    const bucketDir = path25.join(fragmentsDir, "bucket");
-    if (!fs23.existsSync(bucketDir)) {
+    const bucketDir = path26.join(fragmentsDir, "bucket");
+    if (!fs24.existsSync(bucketDir)) {
       throw new Error(`Fragment directory not found: ${bucketDir}`);
     }
     copyTemplate(bucketDir, appDir, context);
   }
-  const agentsDir = path25.join(fragmentsDir, "agents");
-  if (fs23.existsSync(agentsDir)) {
+  const agentsDir = path26.join(fragmentsDir, "agents");
+  if (fs24.existsSync(agentsDir)) {
     copyTemplate(agentsDir, appDir, context);
   }
 }
@@ -13340,22 +13578,22 @@ async function runLegacyTemplate(tenant, name, template, test) {
   }
   maybeBootstrapAppsRepo(process.cwd(), tenant, test);
   const appDir = resolveAppDir(process.cwd(), tenant, name, test);
-  if (fs23.existsSync(appDir)) {
+  if (fs24.existsSync(appDir)) {
     logError(`App directory already exists: ${appDir}`);
     process.exit(1);
   }
-  const templateDir = path25.join(packageRoot, "templates", template);
-  if (!fs23.existsSync(templateDir)) {
+  const templateDir = path26.join(packageRoot, "templates", template);
+  if (!fs24.existsSync(templateDir)) {
     logError(`Template not found: ${templateDir}`);
     process.exit(1);
   }
-  fs23.mkdirSync(appDir, { recursive: true });
+  fs24.mkdirSync(appDir, { recursive: true });
   try {
     copyTemplate(templateDir, appDir, { name, tenant });
     logSuccess(`Created app at ${appDir}`);
   } catch (error) {
     logError(`Failed to create app: ${error}`);
-    fs23.rmSync(appDir, { recursive: true, force: true });
+    fs24.rmSync(appDir, { recursive: true, force: true });
     process.exit(1);
   }
   autoSyncSkills(appDir, name);
@@ -13370,7 +13608,7 @@ function autoSyncSkills(appDir, appName) {
     logWarn(`Agent-skill sync skipped: ${err instanceof Error ? err.message : err} \u2014 run: mesh skills sync`);
   }
   try {
-    const seeded = seedAppSkill(root, appName, path25.relative(root, appDir));
+    const seeded = seedAppSkill(root, appName, path26.relative(root, appDir));
     if (seeded) logSuccess(`seeded: ${seeded} (yours to grow \u2014 not managed by mesh skills sync)`);
   } catch (err) {
     logWarn(`App skill stub skipped: ${err instanceof Error ? err.message : err}`);
@@ -13378,7 +13616,7 @@ function autoSyncSkills(appDir, appName) {
 }
 async function checkScaffoldContract(appDir) {
   const root = resolveTargetRoot(appDir);
-  const report = await runAppCheck(root, [path25.relative(root, appDir) || "."]);
+  const report = await runAppCheck(root, [path26.relative(root, appDir) || "."]);
   if (report.status === "ok") {
     logSuccess("app contract: met (mesh app check)");
     return;
@@ -13401,7 +13639,7 @@ async function runComposable(tenant, name, primitives, test) {
   }
   maybeBootstrapAppsRepo(process.cwd(), tenant, test);
   const appDir = resolveAppDir(process.cwd(), tenant, name, test);
-  if (fs23.existsSync(appDir)) {
+  if (fs24.existsSync(appDir)) {
     logError(`App directory already exists: ${appDir}`);
     process.exit(1);
   }
@@ -13433,16 +13671,16 @@ async function runComposable(tenant, name, primitives, test) {
     typescriptRange: SCAFFOLD_TOOLCHAIN.typescript,
     deployerRoleArn: resolveDeployerRoleArn(tenant, platformName, platformEnv)
   };
-  fs23.mkdirSync(appDir, { recursive: true });
+  fs24.mkdirSync(appDir, { recursive: true });
   try {
     generateComposableApp(appDir, context);
     logSuccess(`Created app at ${appDir}`);
   } catch (error) {
     logError(`Failed to create app: ${error}`);
-    fs23.rmSync(appDir, { recursive: true, force: true });
+    fs24.rmSync(appDir, { recursive: true, force: true });
     process.exit(1);
   }
-  const nested = fs23.readdirSync(appDir, { withFileTypes: true }).some((entry) => entry.isDirectory() && fs23.existsSync(path25.join(appDir, entry.name, "package.json")));
+  const nested = fs24.readdirSync(appDir, { withFileTypes: true }).some((entry) => entry.isDirectory() && fs24.existsSync(path26.join(appDir, entry.name, "package.json")));
   const glob = workspaceGlobForApp(repoRoot2, appDir);
   if (nested && glob) {
     const added = ensureWorkspaceGlobs(repoRoot2, [glob]);
@@ -13526,7 +13764,7 @@ var init_create_app = __esm({
     init_errors();
     init_mesh_json();
     __filename = fileURLToPath2(import.meta.url);
-    __dirname = path25.dirname(__filename);
+    __dirname = path26.dirname(__filename);
     packageRoot = findPackageRoot(__dirname);
     TEMPLATES = {
       workflow: "Hono API + Temporal worker + hello workflow (Pulumi/app-kit)",
@@ -13850,20 +14088,20 @@ var init_psql = __esm({
 // libs/mesh-cli/src/commands/db/exec.ts
 import { spawn as spawn6 } from "child_process";
 import * as net11 from "net";
-import * as fs24 from "fs";
-import * as path26 from "path";
+import * as fs25 from "fs";
+import * as path27 from "path";
 import {
   SecretsManagerClient as SecretsManagerClient3,
   GetSecretValueCommand as GetSecretValueCommand3
 } from "@aws-sdk/client-secrets-manager";
 function findSstOutputs() {
   let dir = process.cwd();
-  const root = path26.parse(dir).root;
+  const root = path27.parse(dir).root;
   while (dir !== root) {
-    const outputsPath = path26.join(dir, ".sst", "outputs.json");
-    if (fs24.existsSync(outputsPath)) {
+    const outputsPath = path27.join(dir, ".sst", "outputs.json");
+    if (fs25.existsSync(outputsPath)) {
       try {
-        const content = fs24.readFileSync(outputsPath, "utf-8");
+        const content = fs25.readFileSync(outputsPath, "utf-8");
         const outputs = JSON.parse(content);
         if (outputs.databaseUrl) {
           const secretArnMatch = outputs.databaseUrl.match(/secretArn=([^&]+)/);
@@ -13878,7 +14116,7 @@ function findSstOutputs() {
       } catch {
       }
     }
-    dir = path26.dirname(dir);
+    dir = path27.dirname(dir);
   }
   return null;
 }
@@ -14137,8 +14375,8 @@ var init_db = __esm({
 });
 
 // libs/mesh-cli/src/utils/deploy-preflight.ts
-import { existsSync as existsSync20, readFileSync as readFileSync21 } from "node:fs";
-import { dirname as dirname22, join as join25, relative as relative7 } from "node:path";
+import { existsSync as existsSync21, readFileSync as readFileSync22 } from "node:fs";
+import { dirname as dirname22, join as join26, relative as relative7 } from "node:path";
 import { parse as parseYaml3 } from "yaml";
 function isGated(name) {
   return GATED_PREFIXES.some((p) => name.startsWith(p));
@@ -14176,8 +14414,8 @@ function diffLockVsInstalled(expected, installed) {
 function findPnpmLock(startDir) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = join25(dir, "pnpm-lock.yaml");
-    if (existsSync20(candidate)) return candidate;
+    const candidate = join26(dir, "pnpm-lock.yaml");
+    if (existsSync21(candidate)) return candidate;
     const parent = dirname22(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -14185,8 +14423,8 @@ function findPnpmLock(startDir) {
 }
 function readInstalledVersion(fromDir, name) {
   try {
-    const pkgPath = join25(fromDir, "node_modules", name, "package.json");
-    const version = JSON.parse(readFileSync21(pkgPath, "utf8")).version;
+    const pkgPath = join26(fromDir, "node_modules", name, "package.json");
+    const version = JSON.parse(readFileSync22(pkgPath, "utf8")).version;
     return typeof version === "string" ? version : null;
   } catch {
     return null;
@@ -14197,7 +14435,7 @@ function checkDeployDepsFresh(appRoot) {
   if (!lockPath) return null;
   let lockDoc;
   try {
-    lockDoc = parseYaml3(readFileSync21(lockPath, "utf8"));
+    lockDoc = parseYaml3(readFileSync22(lockPath, "utf8"));
   } catch {
     logWarn(
       `deploy preflight: could not parse ${lockPath} \u2014 skipping the stale-node_modules check.`
@@ -14253,7 +14491,7 @@ var init_deploy_preflight = __esm({
 });
 
 // libs/mesh-cli/src/commands/deploy.ts
-import { execFileSync as execFileSync18 } from "child_process";
+import { execFileSync as execFileSync19 } from "child_process";
 function buildPulumiArgs(pulumiArgs, stack) {
   const base = pulumiArgs.length === 0 || pulumiArgs[0]?.startsWith("-") ? ["up", ...pulumiArgs] : [...pulumiArgs];
   const op = base[0];
@@ -14316,7 +14554,7 @@ function registerDeployCommand(program2) {
     delete env.AWS_PROFILE;
     const finalArgs = buildPulumiArgs(pulumiArgs, stack);
     try {
-      execFileSync18("pulumi", finalArgs, {
+      execFileSync19("pulumi", finalArgs, {
         cwd: appRoot,
         env,
         stdio: "inherit"
@@ -14421,8 +14659,8 @@ var init_schema2 = __esm({
 });
 
 // libs/mesh-cli/src/docs/discover.ts
-import { existsSync as existsSync21, readdirSync as readdirSync9, readFileSync as readFileSync22, statSync as statSync5 } from "node:fs";
-import path27 from "node:path";
+import { existsSync as existsSync22, readdirSync as readdirSync9, readFileSync as readFileSync23, statSync as statSync5 } from "node:fs";
+import path28 from "node:path";
 function routePathFor(relPath) {
   const withoutExt = relPath.replace(/\.md$/i, "");
   const parts = withoutExt.split("/").map(slugify2);
@@ -14442,7 +14680,7 @@ function walkMarkdown(absDir, relDir, errors, rootDir) {
     if (hasReservedSegment(entry.name)) {
       continue;
     }
-    const abs = path27.join(absDir, entry.name);
+    const abs = path28.join(absDir, entry.name);
     if (entry.isDirectory()) {
       if (entry.name === "node_modules" || entry.name.startsWith(".")) continue;
       out.push(...walkMarkdown(abs, rel2, errors, rootDir));
@@ -14488,7 +14726,7 @@ function discoverDocRoots(repoRoot2) {
       if (entry.name.startsWith(".")) continue;
       const rel2 = relDir ? `${relDir}/${entry.name}` : entry.name;
       findRoots(
-        path27.join(absDir, entry.name),
+        path28.join(absDir, entry.name),
         rel2,
         insideReserved || hasReservedSegment(entry.name)
       );
@@ -14497,7 +14735,7 @@ function discoverDocRoots(repoRoot2) {
   findRoots(repoRoot2, "", false);
   const pages = [];
   for (const root of roots) {
-    const absRoot = path27.join(repoRoot2, root.dir);
+    const absRoot = path28.join(repoRoot2, root.dir);
     const relFiles = walkMarkdown(absRoot, "", errors, root.dir);
     for (const relPath of relFiles.sort()) {
       pages.push({
@@ -14521,14 +14759,14 @@ function discoverDocRoots(repoRoot2) {
         );
         continue;
       }
-      if (!existsSync21(path27.join(repoRoot2, normalized))) {
+      if (!existsSync22(path28.join(repoRoot2, normalized))) {
         errors.push(
           `${root.dir}/docs.json includes ${normalized}, which does not exist`
         );
         continue;
       }
       if (pages.some((p) => p.source === normalized)) continue;
-      const stem = path27.posix.basename(normalized).replace(/\.md$/i, "");
+      const stem = path28.posix.basename(normalized).replace(/\.md$/i, "");
       pages.push({
         source: normalized,
         root,
@@ -14556,10 +14794,10 @@ function discoverDocRoots(repoRoot2) {
   return { roots, pages, errors };
 }
 function loadRoot(absDir, relDir, errors) {
-  const configPath = path27.join(absDir, "docs.json");
+  const configPath = path28.join(absDir, "docs.json");
   let raw;
   try {
-    raw = JSON.parse(readFileSync22(configPath, "utf-8"));
+    raw = JSON.parse(readFileSync23(configPath, "utf-8"));
   } catch (error) {
     errors.push(
       `${relDir}/docs.json is not valid JSON: ${error instanceof Error ? error.message : String(error)}`
@@ -14609,9 +14847,9 @@ var init_discover = __esm({
 });
 
 // libs/mesh-cli/src/docs/assemble.ts
-import { execFileSync as execFileSync19 } from "node:child_process";
-import { mkdirSync as mkdirSync11, readFileSync as readFileSync23, rmSync as rmSync5, writeFileSync as writeFileSync15 } from "node:fs";
-import path28 from "node:path";
+import { execFileSync as execFileSync20 } from "node:child_process";
+import { mkdirSync as mkdirSync12, readFileSync as readFileSync24, rmSync as rmSync5, writeFileSync as writeFileSync15 } from "node:fs";
+import path29 from "node:path";
 import { parse as parseYaml4 } from "yaml";
 function splitFrontMatter(markdown) {
   const normalized = markdown.replace(/^\uFEFF/, "");
@@ -14671,7 +14909,7 @@ function deriveTitle(frontMatter, body, source) {
   if (typeof fmTitle === "string" && fmTitle.trim()) return fmTitle.trim();
   const heading = firstHeading(body);
   if (heading) return heading;
-  const stem = path28.posix.basename(source).replace(/\.md$/i, "");
+  const stem = path29.posix.basename(source).replace(/\.md$/i, "");
   return titleizeStem(stem);
 }
 function scanLinks(markdown) {
@@ -14803,7 +15041,7 @@ function isAbsoluteHref(href) {
   return /^(?:[a-z][a-z0-9+.-]*:|\/\/)/i.test(href);
 }
 function normalizeRepoPath(value) {
-  return path28.posix.normalize(value.replace(/\\/g, "/")).replace(/^\.\//, "").replace(/\/+$/, "");
+  return path29.posix.normalize(value.replace(/\\/g, "/")).replace(/^\.\//, "").replace(/\/+$/, "");
 }
 function splitHash(href) {
   const index = href.indexOf("#");
@@ -14821,7 +15059,7 @@ function resolveLink(args) {
     const route = rawTarget.replace(/\/$/, "") || "/";
     return routes.has(route) ? { href: `${route}${hash}` } : { href, issue: { kind: "broken", page: pageRoute2, href } };
   }
-  const repoPath = normalizeRepoPath(path28.posix.join(sourceDir, rawTarget));
+  const repoPath = normalizeRepoPath(path29.posix.join(sourceDir, rawTarget));
   const page = sourceIndex.get(repoPath);
   if (page) return { href: `${page.route}${hash}` };
   for (const candidate of [`${repoPath}/index.md`]) {
@@ -14842,7 +15080,7 @@ function rewriteLinks(args) {
   const issues = [];
   const hits = scanLinks(args.body);
   if (hits.length === 0) return { body: args.body, issues };
-  const sourceDir = path28.posix.dirname(args.page.source);
+  const sourceDir = path29.posix.dirname(args.page.source);
   let out = "";
   let cursor = 0;
   for (const hit of hits) {
@@ -14893,9 +15131,9 @@ function assemblePortal(options) {
   const brokenLinks = [];
   const externalLinks = [];
   rmSync5(outDir, { recursive: true, force: true });
-  mkdirSync11(outDir, { recursive: true });
+  mkdirSync12(outDir, { recursive: true });
   for (const page of pages) {
-    const raw = readFileSync23(path28.join(repoRoot2, page.source), "utf-8");
+    const raw = readFileSync24(path29.join(repoRoot2, page.source), "utf-8");
     const frontMatter = splitFrontMatter(raw);
     const title = deriveTitle(frontMatter.data, frontMatter.body, page.source);
     page.title = title;
@@ -14907,7 +15145,7 @@ function assemblePortal(options) {
       sourceIndex,
       routes,
       ignoreLinkPrefixes,
-      pathKind: (rel2) => pathKind(path28.join(repoRoot2, rel2)),
+      pathKind: (rel2) => pathKind(path29.join(repoRoot2, rel2)),
       repoUrl
     });
     for (const issue of rewritten.issues) {
@@ -14921,8 +15159,8 @@ function assemblePortal(options) {
 
 <sub>Source: [\`${page.source}\`](${blobBase}/blob/main/${page.source}) \u2014 edit that file, not this page.</sub>
 `;
-    const outFile = path28.join(outDir, page.filePath);
-    mkdirSync11(path28.dirname(outFile), { recursive: true });
+    const outFile = path29.join(outDir, page.filePath);
+    mkdirSync12(path29.dirname(outFile), { recursive: true });
     writeFileSync15(
       outFile,
       joinFrontMatter(outData, rewritten.body.trimEnd() + sourceNote)
@@ -15100,7 +15338,7 @@ function renderVersionJson(args) {
 }
 function currentCommit(repoRoot2) {
   try {
-    return execFileSync19("git", ["rev-parse", "--short", "HEAD"], {
+    return execFileSync20("git", ["rev-parse", "--short", "HEAD"], {
       cwd: repoRoot2,
       encoding: "utf-8"
     }).trim();
@@ -15111,7 +15349,7 @@ function currentCommit(repoRoot2) {
 function currentBaseline(repoRoot2) {
   try {
     const pkg = JSON.parse(
-      readFileSync23(path28.join(repoRoot2, "libs/app-kit/package.json"), "utf-8")
+      readFileSync24(path29.join(repoRoot2, "libs/app-kit/package.json"), "utf-8")
     );
     return pkg.version;
   } catch {
@@ -15119,7 +15357,7 @@ function currentBaseline(repoRoot2) {
   }
 }
 function publishSetAtRef(repoRoot2, ref) {
-  const git = (gitArgs) => execFileSync19("git", gitArgs, {
+  const git = (gitArgs) => execFileSync20("git", gitArgs, {
     cwd: repoRoot2,
     encoding: "utf-8",
     maxBuffer: 64 * 1024 * 1024
@@ -15144,7 +15382,7 @@ function publishSetAtRef(repoRoot2, ref) {
         continue;
       const rel2 = file.slice(prefix2.length);
       if (hasReservedSegment(rel2)) continue;
-      if (path28.posix.basename(file).toLowerCase() === "readme.md") continue;
+      if (path29.posix.basename(file).toLowerCase() === "readme.md") continue;
       published.add(file);
     }
     for (const include of config.include ?? []) {
@@ -15230,8 +15468,8 @@ function formatDefault(value, paths = currentMachinePaths()) {
   if (typeof value === "boolean" || typeof value === "number") return String(value);
   return normalizeMachinePaths(JSON.stringify(value), paths);
 }
-function slugifyCommandPath(path47) {
-  return path47.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+function slugifyCommandPath(path48) {
+  return path48.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
 function extractOptions(command) {
   const options = command.options ?? [];
@@ -15265,17 +15503,17 @@ function isUndocumented(command) {
 function extractCommand(command, parentPath, depth) {
   const internals = command;
   const name = internals._name ?? "";
-  const path47 = parentPath ? `${parentPath} ${name}` : name;
+  const path48 = parentPath ? `${parentPath} ${name}` : name;
   return {
-    path: path47,
+    path: path48,
     name,
     aliases: [...internals._aliases ?? []],
     description: internals._description ?? "",
     args: extractArgs(command),
     options: extractOptions(command),
-    slug: slugifyCommandPath(path47),
+    slug: slugifyCommandPath(path48),
     depth,
-    subcommands: (internals.commands ?? []).filter((child) => !isUndocumented(child)).map((child) => extractCommand(child, path47, depth + 1))
+    subcommands: (internals.commands ?? []).filter((child) => !isUndocumented(child)).map((child) => extractCommand(child, path48, depth + 1))
   };
 }
 function extractCliReference(program2) {
@@ -15367,14 +15605,14 @@ var init_cli_reference = __esm({
 import { spawn as spawn7 } from "node:child_process";
 import {
   appendFileSync,
-  existsSync as existsSync22,
-  mkdirSync as mkdirSync12,
+  existsSync as existsSync23,
+  mkdirSync as mkdirSync13,
   mkdtempSync as mkdtempSync3,
-  readFileSync as readFileSync24,
+  readFileSync as readFileSync25,
   writeFileSync as writeFileSync16
 } from "node:fs";
 import { tmpdir as tmpdir6 } from "node:os";
-import path29 from "node:path";
+import path30 from "node:path";
 function runAssemble(args) {
   const discovery = discoverDocRoots(args.repoRoot);
   const assembled = assemblePortal({
@@ -15386,7 +15624,7 @@ function runAssemble(args) {
   });
   const errors = [...discovery.errors];
   if (args.writeFiles !== false) {
-    const manifestPath = args.outDir.includes(tmpdir6()) ? path29.join(args.outDir, PUBLISH_MANIFEST) : path29.join(args.outDir, "..", PUBLISH_MANIFEST);
+    const manifestPath = args.outDir.includes(tmpdir6()) ? path30.join(args.outDir, PUBLISH_MANIFEST) : path30.join(args.outDir, "..", PUBLISH_MANIFEST);
     writeFileSync16(
       manifestPath,
       `${JSON.stringify(assembled.publishManifest, null, 2)}
@@ -15403,13 +15641,13 @@ function runAssemble(args) {
           commit: currentCommit(args.repoRoot)
         })
       );
-      const versionDir = path29.join(
-        path29.dirname(args.configOut),
+      const versionDir = path30.join(
+        path30.dirname(args.configOut),
         VERSION_JSON_DIR
       );
-      mkdirSync12(versionDir, { recursive: true });
+      mkdirSync13(versionDir, { recursive: true });
       writeFileSync16(
-        path29.join(versionDir, VERSION_JSON),
+        path30.join(versionDir, VERSION_JSON),
         renderVersionJson({
           baseline: currentBaseline(args.repoRoot),
           commit: currentCommit(args.repoRoot),
@@ -15441,7 +15679,7 @@ function reportAssembly(result) {
   }
 }
 async function checkPortal(args) {
-  const scratch = mkdtempSync3(path29.join(tmpdir6(), "mesh-docs-check-"));
+  const scratch = mkdtempSync3(path30.join(tmpdir6(), "mesh-docs-check-"));
   const result = runAssemble({ repoRoot: args.repoRoot, outDir: scratch });
   const failures = [...result.errors];
   for (const violation of result.assembled.reservedViolations) {
@@ -15462,7 +15700,7 @@ async function checkPortal(args) {
     );
   }
   if (args.manifestOut) {
-    mkdirSync12(path29.dirname(args.manifestOut), { recursive: true });
+    mkdirSync13(path30.dirname(args.manifestOut), { recursive: true });
     writeFileSync16(
       args.manifestOut,
       `${JSON.stringify(result.assembled.publishManifest, null, 2)}
@@ -15532,12 +15770,12 @@ async function runPortalCommand(opts, deps) {
     logSuccess("Docs portal check passed");
     return;
   }
-  const appDir = path29.join(repoRoot2, DOCS_APP_DIR);
-  const outDir = opts.out ? path29.resolve(repoRoot2, opts.out) : path29.join(appDir, CONTENT_DIR);
+  const appDir = path30.join(repoRoot2, DOCS_APP_DIR);
+  const outDir = opts.out ? path30.resolve(repoRoot2, opts.out) : path30.join(appDir, CONTENT_DIR);
   const result = runAssemble({
     repoRoot: repoRoot2,
     outDir,
-    configOut: path29.join(appDir, GENERATED_CONFIG)
+    configOut: path30.join(appDir, GENERATED_CONFIG)
   });
   reportAssembly(result);
   if (result.errors.length > 0) {
@@ -15548,7 +15786,7 @@ async function runPortalCommand(opts, deps) {
   }
   if (opts.assembleOnly || opts.out) {
     logInfo(
-      `Assembled content at ${path29.relative(repoRoot2, outDir)} \u2014 build with: pnpm --filter @mesh-tech/docs build`
+      `Assembled content at ${path30.relative(repoRoot2, outDir)} \u2014 build with: pnpm --filter @mesh-tech/docs build`
     );
     return;
   }
@@ -15568,7 +15806,7 @@ async function runPortalCommand(opts, deps) {
   if (code !== 0) throw new Error(`zudoku ${mode} exited with code ${code}`);
   if (mode === "build") {
     logSuccess(
-      `Portal built \u2192 ${path29.join(path29.relative(repoRoot2, appDir), "dist")}`
+      `Portal built \u2192 ${path30.join(path30.relative(repoRoot2, appDir), "dist")}`
     );
   }
 }
@@ -15580,11 +15818,11 @@ async function cliReferenceStaleness(repoRoot2) {
     Promise.resolve().then(() => (init_program(), program_exports)),
     Promise.resolve().then(() => (init_cli_reference(), cli_reference_exports))
   ]);
-  const outPath = path29.join(repoRoot2, "docs/portal/generated/cli-reference.md");
+  const outPath = path30.join(repoRoot2, "docs/portal/generated/cli-reference.md");
   const markdown = renderCliReferenceMarkdown2(
     extractCliReference2(createProgram2())
   );
-  const existing = existsSync22(outPath) ? readFileSync24(outPath, "utf-8") : null;
+  const existing = existsSync23(outPath) ? readFileSync25(outPath, "utf-8") : null;
   if (existing === markdown) return null;
   return `${existing === null ? "CLI reference is missing" : "CLI reference is stale"}: docs/portal/generated/cli-reference.md \u2014 the commander tree changed; regenerate and commit with \`pnpm exec mesh docs cli-reference\``;
 }
@@ -15607,9 +15845,9 @@ var init_portal = __esm({
 });
 
 // libs/mesh-cli/src/utils/build-info.ts
-import { execFileSync as execFileSync20 } from "child_process";
-import * as fs25 from "fs";
-import * as path30 from "path";
+import { execFileSync as execFileSync21 } from "child_process";
+import * as fs26 from "fs";
+import * as path31 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function detectRuntimeMode(modulePath) {
   return modulePath.split(/[\\/]/).includes("dist") ? "dist" : "source";
@@ -15628,11 +15866,11 @@ function findCliPackageRoot(startDir) {
   let dir = startDir;
   for (let i = 0; i < 8; i++) {
     try {
-      const pkg = JSON.parse(fs25.readFileSync(path30.join(dir, "package.json"), "utf-8"));
+      const pkg = JSON.parse(fs26.readFileSync(path31.join(dir, "package.json"), "utf-8"));
       if (pkg.name === "@mesh-tech/mesh-cli") return dir;
     } catch {
     }
-    const parent = path30.dirname(dir);
+    const parent = path31.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -15640,13 +15878,13 @@ function findCliPackageRoot(startDir) {
 }
 function resolveCliRuntime(opts) {
   const vcs = opts?.vcs ?? true;
-  const here = path30.dirname(fileURLToPath3(import.meta.url));
+  const here = path31.dirname(fileURLToPath3(import.meta.url));
   const mode = detectRuntimeMode(here);
   const root = findCliPackageRoot(here);
   let version = "0.0.0";
   if (root) {
     try {
-      version = JSON.parse(fs25.readFileSync(path30.join(root, "package.json"), "utf-8")).version ?? version;
+      version = JSON.parse(fs26.readFileSync(path31.join(root, "package.json"), "utf-8")).version ?? version;
     } catch {
     }
   }
@@ -15655,7 +15893,7 @@ function resolveCliRuntime(opts) {
   if (mode === "dist") {
     try {
       const meta = JSON.parse(
-        fs25.readFileSync(path30.join(root, "dist", "build-info.json"), "utf-8")
+        fs26.readFileSync(path31.join(root, "dist", "build-info.json"), "utf-8")
       );
       info.commit = meta.commit;
       info.builtAt = meta.builtAt;
@@ -15665,7 +15903,7 @@ function resolveCliRuntime(opts) {
   }
   if (!vcs) return info;
   try {
-    const git = (args) => execFileSync20("git", args, {
+    const git = (args) => execFileSync21("git", args, {
       cwd: root,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "pipe"]
@@ -15685,7 +15923,7 @@ var init_build_info = __esm({
 // libs/mesh-cli/src/docs/serve.ts
 import { createServer as createServer8 } from "node:http";
 import { readFile } from "node:fs/promises";
-import { extname as extname2, join as join27, normalize, sep as sep5 } from "node:path";
+import { extname as extname2, join as join28, normalize, sep as sep5 } from "node:path";
 async function serveDocsSite(args) {
   const root = normalize(args.root);
   const rootPrefix = root.endsWith(sep5) ? root : root + sep5;
@@ -15704,7 +15942,7 @@ async function serveDocsSite(args) {
       ];
       if (pathname !== "/") candidates.push("/index.html");
       for (const candidate of candidates) {
-        const filePath = normalize(join27(root, candidate));
+        const filePath = normalize(join28(root, candidate));
         if (filePath !== root && !filePath.startsWith(rootPrefix)) continue;
         try {
           const body = await readFile(filePath);
@@ -15762,13 +16000,13 @@ var init_serve = __esm({
 });
 
 // libs/mesh-cli/src/docs/registry-docs.ts
-import { execFileSync as execFileSync21 } from "node:child_process";
-import { existsSync as existsSync23, mkdirSync as mkdirSync13, readFileSync as readFileSync26, renameSync as renameSync3, rmSync as rmSync6, writeFileSync as writeFileSync17 } from "node:fs";
+import { execFileSync as execFileSync22 } from "node:child_process";
+import { existsSync as existsSync24, mkdirSync as mkdirSync14, readFileSync as readFileSync27, renameSync as renameSync3, rmSync as rmSync6, writeFileSync as writeFileSync17 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
-import path31 from "node:path";
+import path32 from "node:path";
 function readDocsRegistryAuth(npmrcPath2 = homeNpmrcPath()) {
-  if (!existsSync23(npmrcPath2)) return null;
-  return parseNpmrcRegistryAuth(readFileSync26(npmrcPath2, "utf-8"));
+  if (!existsSync24(npmrcPath2)) return null;
+  return parseNpmrcRegistryAuth(readFileSync27(npmrcPath2, "utf-8"));
 }
 function packumentUrl(endpoint, pkg) {
   return `${endpoint.replace(/\/+$/, "")}/${pkg.replace(/\//g, "%2f")}`;
@@ -15818,15 +16056,15 @@ async function listDocsVersions(auth, fetchImpl = fetch) {
   return { versions, latest: packument["dist-tags"]?.latest };
 }
 function docsCacheRoot() {
-  const base = process.env.XDG_CACHE_HOME ?? path31.join(homeDir(), ".cache");
-  return path31.join(base, "mesh", "docs");
+  const base = process.env.XDG_CACHE_HOME ?? path32.join(homeDir(), ".cache");
+  return path32.join(base, "mesh", "docs");
 }
 function homeDir() {
   return process.env.HOME ?? tmpdir7();
 }
 async function fetchDocsArtifact(auth, version, cacheRoot = docsCacheRoot(), fetchImpl = fetch) {
-  const targetDir = path31.join(cacheRoot, version);
-  if (existsSync23(path31.join(targetDir, "dist", "index.html"))) return targetDir;
+  const targetDir = path32.join(cacheRoot, version);
+  if (existsSync24(path32.join(targetDir, "dist", "index.html"))) return targetDir;
   const listResponse = await registryFetch(auth, packumentUrl(auth.endpoint, DOCS_PACKAGE), fetchImpl);
   if (!listResponse.ok) {
     throw new Error(`registry returned ${listResponse.status} for ${DOCS_PACKAGE}`);
@@ -15847,20 +16085,20 @@ async function fetchDocsArtifact(auth, version, cacheRoot = docsCacheRoot(), fet
   if (!tgzResponse.ok) {
     throw new Error(`downloading ${DOCS_PACKAGE}@${version} failed: ${tgzResponse.status}`);
   }
-  mkdirSync13(cacheRoot, { recursive: true });
-  const tgzPath = path31.join(cacheRoot, `.${version}.tgz`);
+  mkdirSync14(cacheRoot, { recursive: true });
+  const tgzPath = path32.join(cacheRoot, `.${version}.tgz`);
   writeFileSync17(tgzPath, Buffer.from(await tgzResponse.arrayBuffer()));
-  const staging = path31.join(cacheRoot, `.staging-${version}`);
+  const staging = path32.join(cacheRoot, `.staging-${version}`);
   rmSync6(staging, { recursive: true, force: true });
-  mkdirSync13(staging, { recursive: true });
+  mkdirSync14(staging, { recursive: true });
   try {
-    execFileSync21("tar", ["-xzf", tgzPath, "-C", staging, "--strip-components", "1"], {
+    execFileSync22("tar", ["-xzf", tgzPath, "-C", staging, "--strip-components", "1"], {
       stdio: ["pipe", "pipe", "pipe"]
     });
   } finally {
     rmSync6(tgzPath, { force: true });
   }
-  if (!existsSync23(path31.join(staging, "dist", "index.html"))) {
+  if (!existsSync24(path32.join(staging, "dist", "index.html"))) {
     rmSync6(staging, { recursive: true, force: true });
     throw new Error(`${DOCS_PACKAGE}@${version} unpacked without a dist/index.html \u2014 the artifact is malformed`);
   }
@@ -15892,9 +16130,9 @@ __export(start_exports, {
   tmuxInstallHint: () => tmuxInstallHint,
   tmuxServeArgs: () => tmuxServeArgs
 });
-import { execFileSync as execFileSync22 } from "node:child_process";
-import { appendFileSync as appendFileSync2, existsSync as existsSync24, writeFileSync as writeFileSync18 } from "node:fs";
-import path32 from "node:path";
+import { execFileSync as execFileSync23 } from "node:child_process";
+import { appendFileSync as appendFileSync2, existsSync as existsSync25, writeFileSync as writeFileSync18 } from "node:fs";
+import path33 from "node:path";
 function registryAuthOrThrow() {
   const auth = readDocsRegistryAuth();
   if (!auth) {
@@ -15925,7 +16163,7 @@ function tmuxInstallHint(platform = process.platform) {
 }
 function tmuxAvailable() {
   try {
-    execFileSync22("tmux", ["-V"], { stdio: ["pipe", "pipe", "pipe"] });
+    execFileSync23("tmux", ["-V"], { stdio: ["pipe", "pipe", "pipe"] });
     return true;
   } catch {
     return false;
@@ -15936,7 +16174,7 @@ function shouldDetach(args) {
 }
 function docsSessionExists() {
   try {
-    execFileSync22("tmux", ["has-session", "-t", DOCS_TMUX_SESSION], { stdio: ["pipe", "pipe", "pipe"] });
+    execFileSync23("tmux", ["has-session", "-t", DOCS_TMUX_SESSION], { stdio: ["pipe", "pipe", "pipe"] });
     return true;
   } catch {
     return false;
@@ -15960,12 +16198,12 @@ Or run in the foreground instead: mesh docs start --foreground`
   if (docsSessionExists()) {
     logInfo(`Replacing the docs server already running in tmux session "${DOCS_TMUX_SESSION}".`);
     try {
-      execFileSync22("tmux", ["kill-session", "-t", DOCS_TMUX_SESSION], { stdio: ["pipe", "pipe", "pipe"] });
+      execFileSync23("tmux", ["kill-session", "-t", DOCS_TMUX_SESSION], { stdio: ["pipe", "pipe", "pipe"] });
     } catch {
     }
   }
   const { command, cwd } = tmuxServeArgs(args);
-  execFileSync22(
+  execFileSync23(
     "tmux",
     ["new-session", "-d", "-s", DOCS_TMUX_SESSION, "-c", cwd, "--", ...command],
     { stdio: ["pipe", "pipe", "pipe"] }
@@ -16003,7 +16241,7 @@ function printReady(url, label) {
 }
 function runDocsStop() {
   try {
-    execFileSync22("tmux", ["kill-session", "-t", DOCS_TMUX_SESSION], { stdio: ["pipe", "pipe", "pipe"] });
+    execFileSync23("tmux", ["kill-session", "-t", DOCS_TMUX_SESSION], { stdio: ["pipe", "pipe", "pipe"] });
     logSuccess(`Stopped the docs server (tmux session "${DOCS_TMUX_SESSION}").`);
   } catch {
     logInfo(`No docs server is running (no tmux session named "${DOCS_TMUX_SESSION}").`);
@@ -16014,7 +16252,7 @@ async function runDocsServeStatic(args) {
   if (!Number.isInteger(requestedPort) || requestedPort < 0 || requestedPort > 65535) {
     throw new Error(`Invalid --port: ${args.port}`);
   }
-  if (!args.root || !existsSync24(path32.join(args.root, "index.html"))) {
+  if (!args.root || !existsSync25(path33.join(args.root, "index.html"))) {
     throw new Error(
       `--root ${args.root || "(empty)"} does not hold a built site (no index.html). This command exists so the detached tmux session can re-enter; you probably want \`mesh docs start\`.`
     );
@@ -16055,19 +16293,19 @@ async function runDocsStart(args) {
     }
     logInfo(`Fetching ${DOCS_PACKAGE}@${version} from the registry\u2026`);
     const artifactDir = await fetchDocsArtifact(auth, version);
-    serveRoot = path32.join(artifactDir, "dist");
+    serveRoot = path33.join(artifactDir, "dist");
     label = `@mesh-tech/* ${version} (published artifact)`;
   } else {
     if (localRoots.errors.length > 0) {
       for (const error of localRoots.errors) logError(error);
       throw new Error(`docs discovery failed with ${localRoots.errors.length} problem(s)`);
     }
-    const appDir = path32.join(args.repoRoot, DOCS_APP_DIR);
+    const appDir = path33.join(args.repoRoot, DOCS_APP_DIR);
     if (args.dev) {
       const result2 = runAssemble({
         repoRoot: args.repoRoot,
-        outDir: path32.join(appDir, "content"),
-        configOut: path32.join(appDir, "zudoku.config.ts")
+        outDir: path33.join(appDir, "content"),
+        configOut: path33.join(appDir, "zudoku.config.ts")
       });
       reportAssembly(result2);
       const { spawn: spawn11 } = await import("node:child_process");
@@ -16083,12 +16321,12 @@ async function runDocsStart(args) {
       });
       return;
     }
-    const buildLog = path32.join(args.repoRoot, DOCS_APP_DIR, "build.log");
-    logInfo(`Preparing the docs from this checkout (assemble + build \u2014 log: ${path32.relative(args.repoRoot, buildLog)})\u2026`);
+    const buildLog = path33.join(args.repoRoot, DOCS_APP_DIR, "build.log");
+    logInfo(`Preparing the docs from this checkout (assemble + build \u2014 log: ${path33.relative(args.repoRoot, buildLog)})\u2026`);
     const result = runAssemble({
       repoRoot: args.repoRoot,
-      outDir: path32.join(appDir, "content"),
-      configOut: path32.join(appDir, "zudoku.config.ts")
+      outDir: path33.join(appDir, "content"),
+      configOut: path33.join(appDir, "zudoku.config.ts")
     });
     reportAssembly(result);
     const { spawn: spawn10 } = await import("node:child_process");
@@ -16105,7 +16343,7 @@ async function runDocsStart(args) {
       child.on("close", (exitCode) => resolve20(exitCode ?? 1));
     });
     if (code !== 0) throw new Error(`zudoku build exited with code ${code} \u2014 see ${buildLog}`);
-    serveRoot = path32.join(appDir, "dist");
+    serveRoot = path33.join(appDir, "dist");
     label = "this checkout";
   }
   if (detached) {
@@ -16145,30 +16383,30 @@ var init_start = __esm({
 });
 
 // libs/mesh-cli/src/commands/docs.ts
-import * as fs26 from "fs";
-import * as path33 from "path";
+import * as fs27 from "fs";
+import * as path34 from "path";
 import { createRequire } from "module";
 import { pathToFileURL } from "url";
 function findProjectRoot(start = process.cwd()) {
   let dir = start;
   while (true) {
-    if (fs26.existsSync(path33.join(dir, "package.json"))) return dir;
-    const parent = path33.dirname(dir);
+    if (fs27.existsSync(path34.join(dir, "package.json"))) return dir;
+    const parent = path34.dirname(dir);
     if (parent === dir) return start;
     dir = parent;
   }
 }
 function resolvePath(projectRoot, candidate) {
-  return path33.isAbsolute(candidate) ? candidate : path33.join(projectRoot, candidate);
+  return path34.isAbsolute(candidate) ? candidate : path34.join(projectRoot, candidate);
 }
 function ensureParentDir(filePath) {
-  fs26.mkdirSync(path33.dirname(filePath), { recursive: true });
+  fs27.mkdirSync(path34.dirname(filePath), { recursive: true });
 }
 function readConfig2(configPath) {
-  if (!fs26.existsSync(configPath)) {
+  if (!fs27.existsSync(configPath)) {
     throw new Error(`Docs config not found: ${configPath}`);
   }
-  const raw = fs26.readFileSync(configPath, "utf-8");
+  const raw = fs27.readFileSync(configPath, "utf-8");
   const parsed = JSON.parse(raw);
   if (parsed.openapi && !Array.isArray(parsed.openapi)) {
     throw new Error(`Invalid docs config: 'openapi' must be an array`);
@@ -16176,7 +16414,7 @@ function readConfig2(configPath) {
   return parsed;
 }
 function validateOpenApiSpec(specPath) {
-  const content = fs26.readFileSync(specPath, "utf-8");
+  const content = fs27.readFileSync(specPath, "utf-8");
   const parsed = JSON.parse(content);
   if (typeof parsed.openapi !== "string") {
     throw new Error(`Invalid OpenAPI spec (${specPath}): missing 'openapi'`);
@@ -16189,7 +16427,7 @@ function validateOpenApiSpec(specPath) {
   }
 }
 async function loadSymxchangeGenerator(projectRoot) {
-  const requireFromProject = createRequire(path33.join(projectRoot, "package.json"));
+  const requireFromProject = createRequire(path34.join(projectRoot, "package.json"));
   const entryPath = requireFromProject.resolve("@mesh-tech/jh-symitar-api");
   const mod = await import(pathToFileURL(entryPath).href);
   const fn = mod.generateSymxchangeOpenApi;
@@ -16202,8 +16440,8 @@ async function loadSymxchangeGenerator(projectRoot) {
 }
 async function buildDocs(configPathArg) {
   const cwd = process.cwd();
-  const configPath = path33.isAbsolute(configPathArg ?? "") ? configPathArg : path33.resolve(cwd, configPathArg ?? "docs/docs.config.json");
-  const projectRoot = findProjectRoot(path33.dirname(configPath));
+  const configPath = path34.isAbsolute(configPathArg ?? "") ? configPathArg : path34.resolve(cwd, configPathArg ?? "docs/docs.config.json");
+  const projectRoot = findProjectRoot(path34.dirname(configPath));
   const config = readConfig2(configPath);
   logInfo(`Using docs config: ${configPath}`);
   const generatedSpecs = /* @__PURE__ */ new Set();
@@ -16211,15 +16449,15 @@ async function buildDocs(configPathArg) {
     if (task.kind === "file") {
       const inputPath = resolvePath(projectRoot, task.input);
       const outputPath = resolvePath(projectRoot, task.output ?? task.input);
-      if (!fs26.existsSync(inputPath)) {
+      if (!fs27.existsSync(inputPath)) {
         throw new Error(`OpenAPI source file not found: ${inputPath}`);
       }
       if (inputPath !== outputPath) {
         ensureParentDir(outputPath);
-        fs26.copyFileSync(inputPath, outputPath);
-        logSuccess(`Copied OpenAPI spec \u2192 ${path33.relative(projectRoot, outputPath)}`);
+        fs27.copyFileSync(inputPath, outputPath);
+        logSuccess(`Copied OpenAPI spec \u2192 ${path34.relative(projectRoot, outputPath)}`);
       } else {
-        logInfo(`Using OpenAPI spec: ${path33.relative(projectRoot, inputPath)}`);
+        logInfo(`Using OpenAPI spec: ${path34.relative(projectRoot, inputPath)}`);
       }
       validateOpenApiSpec(outputPath);
       generatedSpecs.add(outputPath);
@@ -16237,10 +16475,10 @@ async function buildDocs(configPathArg) {
         servers: task.servers
       });
       ensureParentDir(outputPath);
-      fs26.writeFileSync(outputPath, JSON.stringify(spec, null, 2));
+      fs27.writeFileSync(outputPath, JSON.stringify(spec, null, 2));
       validateOpenApiSpec(outputPath);
       generatedSpecs.add(outputPath);
-      logSuccess(`Generated SymXchange OpenAPI \u2192 ${path33.relative(projectRoot, outputPath)}`);
+      logSuccess(`Generated SymXchange OpenAPI \u2192 ${path34.relative(projectRoot, outputPath)}`);
       continue;
     }
     const exhaustive = task;
@@ -16248,12 +16486,12 @@ async function buildDocs(configPathArg) {
   }
   for (const relPath of config.validate ?? []) {
     const abs = resolvePath(projectRoot, relPath);
-    if (!fs26.existsSync(abs)) {
+    if (!fs27.existsSync(abs)) {
       throw new Error(`OpenAPI spec to validate not found: ${abs}`);
     }
     validateOpenApiSpec(abs);
     generatedSpecs.add(abs);
-    logSuccess(`Validated OpenAPI spec: ${path33.relative(projectRoot, abs)}`);
+    logSuccess(`Validated OpenAPI spec: ${path34.relative(projectRoot, abs)}`);
   }
   if (generatedSpecs.size === 0) {
     logInfo("No docs tasks configured (nothing to do)");
@@ -16283,20 +16521,20 @@ async function runCliReference(opts) {
   const outPath = resolvePath(repoRoot2, opts.out);
   const markdown = await renderCliReference();
   if (opts.check) {
-    const existing = fs26.existsSync(outPath) ? fs26.readFileSync(outPath, "utf-8") : null;
+    const existing = fs27.existsSync(outPath) ? fs27.readFileSync(outPath, "utf-8") : null;
     if (existing === markdown) {
-      logSuccess(`CLI reference is up to date (${path33.relative(repoRoot2, outPath)})`);
+      logSuccess(`CLI reference is up to date (${path34.relative(repoRoot2, outPath)})`);
       return;
     }
     throw new Error(
-      `${existing === null ? "CLI reference is missing" : "CLI reference is stale"}: ${path33.relative(repoRoot2, outPath)}
+      `${existing === null ? "CLI reference is missing" : "CLI reference is stale"}: ${path34.relative(repoRoot2, outPath)}
   The commander tree changed. Regenerate and commit:
     pnpm exec mesh docs cli-reference`
     );
   }
   ensureParentDir(outPath);
-  fs26.writeFileSync(outPath, markdown);
-  logSuccess(`CLI reference \u2192 ${path33.relative(repoRoot2, outPath)}`);
+  fs27.writeFileSync(outPath, markdown);
+  logSuccess(`CLI reference \u2192 ${path34.relative(repoRoot2, outPath)}`);
 }
 async function runPortal(opts) {
   const repoRoot2 = findRepoRoot2(process.cwd());
@@ -16376,23 +16614,23 @@ var init_docs = __esm({
 });
 
 // libs/mesh-cli/src/commands/hub/index.ts
-import { execFileSync as execFileSync23 } from "node:child_process";
-import * as fs27 from "node:fs";
+import { execFileSync as execFileSync24 } from "node:child_process";
+import * as fs28 from "node:fs";
 import * as net12 from "node:net";
 import * as os9 from "node:os";
-import * as path34 from "node:path";
+import * as path35 from "node:path";
 import chalk3 from "chalk";
 function devSessionsDir() {
-  return path34.join(os9.tmpdir(), "mesh-dev-sessions");
+  return path35.join(os9.tmpdir(), "mesh-dev-sessions");
 }
 function listDevSessions(dir = devSessionsDir()) {
-  if (!fs27.existsSync(dir)) return [];
+  if (!fs28.existsSync(dir)) return [];
   const sessions = [];
-  for (const entry of fs27.readdirSync(dir)) {
+  for (const entry of fs28.readdirSync(dir)) {
     if (!entry.endsWith(".json")) continue;
     try {
       const state = JSON.parse(
-        fs27.readFileSync(path34.join(dir, entry), "utf-8")
+        fs28.readFileSync(path35.join(dir, entry), "utf-8")
       );
       if (state && typeof state === "object" && state.devOutput) {
         sessions.push({ name: entry.slice(0, -".json".length), state });
@@ -16420,8 +16658,8 @@ function pickDevSession(sessions, opts) {
     );
   }
   if (opts.cwdAppRoot) {
-    const root = path34.resolve(opts.cwdAppRoot);
-    const match = sessions.find((s) => path34.resolve(s.state.appRoot) === root);
+    const root = path35.resolve(opts.cwdAppRoot);
+    const match = sessions.find((s) => path35.resolve(s.state.appRoot) === root);
     if (match) return match;
   }
   if (sessions.length === 1) return sessions[0];
@@ -16442,7 +16680,7 @@ function parseTmuxEnv(output) {
 }
 function readTmuxSessionEnv(sessionName) {
   try {
-    const out = execFileSync23("tmux", ["show-environment", "-t", sessionName], {
+    const out = execFileSync24("tmux", ["show-environment", "-t", sessionName], {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -16453,7 +16691,7 @@ function readTmuxSessionEnv(sessionName) {
 }
 function tmuxSessionExists(sessionName) {
   try {
-    execFileSync23("tmux", ["has-session", "-t", sessionName], { stdio: "ignore" });
+    execFileSync24("tmux", ["has-session", "-t", sessionName], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -16466,6 +16704,10 @@ function forwardedSessionVars(sessionEnv) {
   }
   return out;
 }
+function resolveHubAudience(raw) {
+  if (raw === void 0 || raw === "") return "operator";
+  return raw.trim().toLowerCase() === "operator" ? "operator" : "tenant";
+}
 function assembleHubEnv(session, sessionEnv, opts) {
   const warnings = [];
   const notes = [];
@@ -16518,6 +16760,7 @@ function assembleHubEnv(session, sessionEnv, opts) {
       { remediation: { command: "mesh dev  # relaunch; the session records tunnels.temporal in its state" } }
     );
   }
+  const audienceEnv = { HUB_AUDIENCE: resolveHubAudience(opts.audience) };
   const apiEnv = {
     ...forwarded,
     PORT: String(opts.apiPort),
@@ -16525,6 +16768,7 @@ function assembleHubEnv(session, sessionEnv, opts) {
     HUB_TENANT: hubTenant,
     HUB_SCOPE_ENV: scopeEnv,
     HUB_SCOPE_TENANTS: scopeTenants.join(","),
+    ...audienceEnv,
     ...isLocalPlatform ? localPlatformEnv2(sessionEnv) : {}
   };
   const uiEnv = {
@@ -16534,16 +16778,17 @@ function assembleHubEnv(session, sessionEnv, opts) {
     HUB_TENANT: hubTenant,
     // UI namespace parsing + session defaults land on the scoped tenant.
     DEFAULT_ORG: scopeTenants[0],
-    DEFAULT_ENV: scopeEnv
+    DEFAULT_ENV: scopeEnv,
+    ...audienceEnv
   };
   return { apiEnv, uiEnv, scope: { hubTenant, scopeEnv, scopeTenants }, temporalAddress, warnings, notes };
 }
 function isPlatformRoot(dir) {
-  return fs27.existsSync(path34.join(dir, "apps", "hub", "api", "package.json")) && fs27.existsSync(path34.join(dir, "apps", "hub", "ui", "package.json"));
+  return fs28.existsSync(path35.join(dir, "apps", "hub", "api", "package.json")) && fs28.existsSync(path35.join(dir, "apps", "hub", "ui", "package.json"));
 }
 function resolvePlatformDir(explicit, cwd, env = process.env) {
   if (explicit) {
-    const resolved = path34.resolve(explicit);
+    const resolved = path35.resolve(explicit);
     if (isPlatformRoot(resolved)) return resolved;
     throw new MeshCliError(
       `'${resolved}' is not a mesh-platform checkout (apps/hub/{api,ui} not found).`,
@@ -16551,16 +16796,16 @@ function resolvePlatformDir(explicit, cwd, env = process.env) {
     );
   }
   if (env.MESH_PLATFORM_DIR) {
-    const resolved = path34.resolve(env.MESH_PLATFORM_DIR);
+    const resolved = path35.resolve(env.MESH_PLATFORM_DIR);
     if (isPlatformRoot(resolved)) return resolved;
     logWarn(
       `MESH_PLATFORM_DIR='${resolved}' is not a mesh-platform checkout (apps/hub/{api,ui} not found) \u2014 ignoring it.`
     );
   }
-  let dir = path34.resolve(cwd);
+  let dir = path35.resolve(cwd);
   for (; ; ) {
     if (isPlatformRoot(dir)) return dir;
-    const parent = path34.dirname(dir);
+    const parent = path35.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -16599,7 +16844,7 @@ function isPortListening2(port) {
   });
 }
 function hubEnvDir() {
-  return path34.join(os9.tmpdir(), "mesh-dev-sessions", HUB_SESSION);
+  return path35.join(os9.tmpdir(), "mesh-dev-sessions", HUB_SESSION);
 }
 function parsePort(raw, fallback, source) {
   if (raw === void 0) return fallback;
@@ -16622,8 +16867,8 @@ function redactEnv(env) {
 async function hubDevAction(opts) {
   if (opts.kill) {
     if (tmuxSessionExists(HUB_SESSION)) {
-      execFileSync23("tmux", ["kill-session", "-t", HUB_SESSION], { stdio: "ignore" });
-      fs27.rmSync(hubEnvDir(), { recursive: true, force: true });
+      execFileSync24("tmux", ["kill-session", "-t", HUB_SESSION], { stdio: "ignore" });
+      fs28.rmSync(hubEnvDir(), { recursive: true, force: true });
       logSuccess(`Killed Hub session '${HUB_SESSION}'.`);
     } else {
       logInfo(`No '${HUB_SESSION}' tmux session running.`);
@@ -16642,7 +16887,15 @@ async function hubDevAction(opts) {
     );
   }
   const sessionEnv = readTmuxSessionEnv(session.name);
-  const assembled = assembleHubEnv(session, sessionEnv, { tenants: opts.tenants, uiPort, apiPort });
+  const assembled = assembleHubEnv(session, sessionEnv, {
+    tenants: opts.tenants,
+    uiPort,
+    apiPort,
+    // The flag wins; the ambient variable is the fallback, so an exported
+    // HUB_AUDIENCE reaches a Hub this command spawns rather than being
+    // dropped on the way.
+    audience: opts.audience ?? process.env.HUB_AUDIENCE
+  });
   if (opts.printEnv) {
     console.log(chalk3.bold("\nhub-api env:"));
     for (const [k, v] of Object.entries(redactEnv(assembled.apiEnv))) console.log(`  ${k}=${v}`);
@@ -16671,22 +16924,23 @@ async function hubDevAction(opts) {
   logInfo(
     `Scope       : HUB_TENANT=${assembled.scope.hubTenant} HUB_SCOPE_ENV=${assembled.scope.scopeEnv} HUB_SCOPE_TENANTS=${assembled.scope.scopeTenants.join(",")}`
   );
+  logInfo(`Audience    : ${assembled.apiEnv.HUB_AUDIENCE} (--audience tenant for a client's view)`);
   logInfo(`Temporal    : ${assembled.temporalAddress}`);
   for (const note of assembled.notes) logInfo(note);
   for (const warning of assembled.warnings) logWarn(warning);
-  const apiDir = path34.join(platformDir, "apps", "hub", "api");
-  const uiDir = path34.join(platformDir, "apps", "hub", "ui");
-  execFileSync23("tmux", ["new-session", "-d", "-s", HUB_SESSION, "-n", "api", "-c", apiDir]);
+  const apiDir = path35.join(platformDir, "apps", "hub", "api");
+  const uiDir = path35.join(platformDir, "apps", "hub", "ui");
+  execFileSync24("tmux", ["new-session", "-d", "-s", HUB_SESSION, "-n", "api", "-c", apiDir]);
   if (!assembled.apiEnv.DEV_USER_TOKEN_URL && assembled.apiEnv.DEV_USER_ID_TOKEN) {
     const platform = session.state.devOutput.platform;
     const credContext = `mesh.${platform.env}`;
     const tokenPort = await findFreePort4();
     const tokenUrl = `http://127.0.0.1:${tokenPort}`;
-    execFileSync23("tmux", ["new-window", "-t", HUB_SESSION, "-n", "token-server", "-c", platformDir]);
-    execFileSync23("tmux", ["set-option", "-t", `${HUB_SESSION}:token-server`, "remain-on-exit", "on"], {
+    execFileSync24("tmux", ["new-window", "-t", HUB_SESSION, "-n", "token-server", "-c", platformDir]);
+    execFileSync24("tmux", ["set-option", "-t", `${HUB_SESSION}:token-server`, "remain-on-exit", "on"], {
       stdio: "ignore"
     });
-    execFileSync23("tmux", [
+    execFileSync24("tmux", [
       "send-keys",
       "-t",
       `${HUB_SESSION}:token-server`,
@@ -16701,15 +16955,15 @@ async function hubDevAction(opts) {
     logSuccess(`Dev-user token-server: ${tokenUrl} (context ${credContext})`);
   }
   const launch = (window, dir, env, cmd, createWindow) => {
-    const envFile = path34.join(hubEnvDir(), `${window}.env.sh`);
+    const envFile = path35.join(hubEnvDir(), `${window}.env.sh`);
     writeEnvFile(envFile, env);
     if (createWindow) {
-      execFileSync23("tmux", ["new-window", "-t", HUB_SESSION, "-n", window, "-c", dir]);
+      execFileSync24("tmux", ["new-window", "-t", HUB_SESSION, "-n", window, "-c", dir]);
     }
-    execFileSync23("tmux", ["set-option", "-t", `${HUB_SESSION}:${window}`, "remain-on-exit", "on"], {
+    execFileSync24("tmux", ["set-option", "-t", `${HUB_SESSION}:${window}`, "remain-on-exit", "on"], {
       stdio: "ignore"
     });
-    execFileSync23("tmux", ["send-keys", "-t", `${HUB_SESSION}:${window}`, buildLaunchCommand(envFile, dir, cmd), "Enter"]);
+    execFileSync24("tmux", ["send-keys", "-t", `${HUB_SESSION}:${window}`, buildLaunchCommand(envFile, dir, cmd), "Enter"]);
   };
   launch("api", apiDir, assembled.apiEnv, "pnpm dev", false);
   launch("ui", uiDir, assembled.uiEnv, `pnpm dev --port ${uiPort} --strictPort`, true);
@@ -16733,7 +16987,10 @@ function registerHubCommands(program2) {
   const hub = program2.command("hub").description("Local Hub over dev-local stacks");
   hub.command("dev").description(
     "Launch the current-code Hub (api + ui) against a running `mesh dev` session \u2014 env auto-assembled, zero hand-set vars"
-  ).option("--session <name>", "dev session to observe (default: auto-detect from cwd)").option("--tenants <list>", "comma-separated HUB_SCOPE_TENANTS override (default: the session's tenant)").option("--port <port>", `Hub UI host port (default: $MESH_HUB_DEV_PORT or ${DEFAULT_HUB_UI_PORT})`).option("--api-port <port>", `Hub API port (default: ${DEFAULT_HUB_API_PORT})`).option("--platform-dir <dir>", "mesh-platform checkout to run the Hub from (default: $MESH_PLATFORM_DIR or walk up from cwd)").option("--print-env", "print the assembled env (secrets redacted) and exit without launching").option("--kill", "tear down the running Hub session").action(hubDevAction);
+  ).option("--session <name>", "dev session to observe (default: auto-detect from cwd)").option("--tenants <list>", "comma-separated HUB_SCOPE_TENANTS override (default: the session's tenant)").option(
+    "--audience <who>",
+    "who the Hub renders for: `operator` (platform staff \u2014 the default here) or `tenant` (a client's operators). Anything else reads as `tenant`"
+  ).option("--port <port>", `Hub UI host port (default: $MESH_HUB_DEV_PORT or ${DEFAULT_HUB_UI_PORT})`).option("--api-port <port>", `Hub API port (default: ${DEFAULT_HUB_API_PORT})`).option("--platform-dir <dir>", "mesh-platform checkout to run the Hub from (default: $MESH_PLATFORM_DIR or walk up from cwd)").option("--print-env", "print the assembled env (secrets redacted) and exit without launching").option("--kill", "tear down the running Hub session").action(hubDevAction);
 }
 var HUB_SESSION, DEFAULT_HUB_UI_PORT, DEFAULT_HUB_API_PORT, FORWARD_PREFIXES, localPlatformEnv2, SENSITIVE_RE;
 var init_hub = __esm({
@@ -16807,9 +17064,9 @@ __export(platform_setup_exports, {
   validateRegion: () => validateRegion,
   validateStateBucket: () => validateStateBucket
 });
-import * as fs28 from "fs";
-import * as path35 from "path";
-import { execFileSync as execFileSync24 } from "child_process";
+import * as fs29 from "fs";
+import * as path36 from "path";
+import { execFileSync as execFileSync25 } from "child_process";
 function defaultStateBucket(tenant) {
   return `${tenant}-mesh-platform-pulumi-state`;
 }
@@ -16838,8 +17095,8 @@ function validateStateBucket(value) {
   return /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(bucket) && !bucket.includes("..") ? true : "3\u201363 characters: lowercase letters, digits, dots and dashes, starting and ending alphanumeric";
 }
 function resolveTargetDir(tenant, flags, cwd) {
-  const dir = path35.resolve(cwd, flags.dir ?? defaultPlatformDir(tenant));
-  if (fs28.existsSync(dir) && fs28.readdirSync(dir).length > 0) {
+  const dir = path36.resolve(cwd, flags.dir ?? defaultPlatformDir(tenant));
+  if (fs29.existsSync(dir) && fs29.readdirSync(dir).length > 0) {
     throw new MeshCliError(`Target directory is not empty: ${dir}`, {
       remediation: { command: `mesh init platform ${tenant} --dir <empty-dir>` }
     });
@@ -16893,7 +17150,7 @@ function stateBucketCreateCommand(setup) {
   return `aws s3api create-bucket --bucket ${setup.stateBucket} --region ${setup.region}${location} --profile ${setup.profile}`;
 }
 function awsJson(args, profile) {
-  return execFileSync24("aws", [...args, "--profile", profile], {
+  return execFileSync25("aws", [...args, "--profile", profile], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -16953,7 +17210,7 @@ function renderPlatformNextSteps(setup, opts = {}) {
   return steps;
 }
 async function scaffoldPlatformRepo(setup) {
-  if (fs28.existsSync(setup.dir) && fs28.readdirSync(setup.dir).length > 0) {
+  if (fs29.existsSync(setup.dir) && fs29.readdirSync(setup.dir).length > 0) {
     throw new MeshCliError(`Target directory is not empty: ${setup.dir}`, {
       remediation: { command: `mesh init platform ${setup.tenant} --dir <empty-dir>` }
     });
@@ -16961,8 +17218,8 @@ async function scaffoldPlatformRepo(setup) {
   const { copyTemplate: copyTemplate2 } = await Promise.resolve().then(() => (init_create_app(), create_app_exports));
   const { findPackageRoot: findPackageRoot2 } = await Promise.resolve().then(() => (init_stack(), stack_exports));
   const { syncSkills: syncSkills2 } = await Promise.resolve().then(() => (init_skills(), skills_exports));
-  const templateDir = path35.join(findPackageRoot2(), "templates", "platform-repo");
-  fs28.mkdirSync(setup.dir, { recursive: true });
+  const templateDir = path36.join(findPackageRoot2(), "templates", "platform-repo");
+  fs29.mkdirSync(setup.dir, { recursive: true });
   copyTemplate2(templateDir, setup.dir, {
     tenant: setup.tenant,
     env: setup.env,
@@ -17009,9 +17266,9 @@ var init_platform_setup = __esm({
 });
 
 // libs/mesh-cli/src/commands/registry-publish.ts
-import { execFileSync as execFileSync25, execSync } from "child_process";
-import * as fs29 from "fs";
-import * as path36 from "path";
+import { execFileSync as execFileSync26, execSync } from "child_process";
+import * as fs30 from "fs";
+import * as path37 from "path";
 function repoRoot() {
   return execSync("git rev-parse --show-toplevel", { encoding: "utf-8" }).trim();
 }
@@ -17021,9 +17278,9 @@ function computeSnapshotVersion(root) {
   return `0.0.0-dev.${stamp}.${sha}`;
 }
 function setPackageVersion(file, version) {
-  const content = fs29.readFileSync(file, "utf-8");
+  const content = fs30.readFileSync(file, "utf-8");
   const next = content.replace(/"version"(\s*:\s*)"[^"]*"/, `"version"$1"${version}"`);
-  fs29.writeFileSync(file, next);
+  fs30.writeFileSync(file, next);
 }
 function dirtyPackageJsons(root) {
   const out = execSync("git diff --name-only", { cwd: root, encoding: "utf-8" });
@@ -17056,8 +17313,8 @@ function registerRegistryPublish(registry) {
       logError("CodeArtifact login failed. Run: mesh registry login <context>");
       process.exit(1);
     }
-    const listPath = path36.join(root, "scripts/lib/publishable-packages.json");
-    const all = JSON.parse(fs29.readFileSync(listPath, "utf-8"));
+    const listPath = path37.join(root, "scripts/lib/publishable-packages.json");
+    const all = JSON.parse(fs30.readFileSync(listPath, "utf-8"));
     const patterns = (opts.only ?? "").split(",").map((s) => s.trim()).filter(Boolean);
     const selected = patterns.length ? all.filter((p) => patterns.some((pat) => p.dir.includes(pat) || p.name.includes(pat))) : all;
     if (selected.length === 0) {
@@ -17069,16 +17326,16 @@ function registerRegistryPublish(registry) {
     const preDirty = dirtyPackageJsons(root);
     const backups = [];
     const stamp = (dir) => {
-      const file = path36.join(root, dir, "package.json");
-      if (!fs29.existsSync(file)) return;
-      backups.push({ file, content: fs29.readFileSync(file, "utf-8") });
+      const file = path37.join(root, dir, "package.json");
+      if (!fs30.existsSync(file)) return;
+      backups.push({ file, content: fs30.readFileSync(file, "utf-8") });
       setPackageVersion(file, version);
     };
     try {
       for (const p of selected) {
         stamp(p.dir);
         for (const sub of p.subPackages ?? []) {
-          stamp(path36.join(p.dir, typeof sub === "string" ? sub : sub.dir));
+          stamp(path37.join(p.dir, typeof sub === "string" ? sub : sub.dir));
         }
       }
       const args = [
@@ -17093,14 +17350,14 @@ function registerRegistryPublish(registry) {
         ...opts.dryRun ? ["--dry-run"] : []
       ];
       logInfo(`Publishing ${selected.length} package(s)...`);
-      execFileSync25("bash", args, { cwd: root, stdio: "inherit", env: env ?? process.env });
+      execFileSync26("bash", args, { cwd: root, stdio: "inherit", env: env ?? process.env });
     } finally {
-      for (const b of backups) fs29.writeFileSync(b.file, b.content);
+      for (const b of backups) fs30.writeFileSync(b.file, b.content);
       logInfo("Restored source package.json versions.");
       const collateral = [...dirtyPackageJsons(root)].filter((f) => !preDirty.has(f));
       if (collateral.length) {
         try {
-          execFileSync25("git", ["checkout", "--", ...collateral], { cwd: root, stdio: "inherit" });
+          execFileSync26("git", ["checkout", "--", ...collateral], { cwd: root, stdio: "inherit" });
           logInfo(`Reverted ${collateral.length} package.json file(s) re-vendored by build:publish.`);
         } catch {
           logError(
@@ -17152,12 +17409,12 @@ __export(registry_exports, {
   shouldRemintAfter: () => shouldRemintAfter,
   shouldRepairUserNpmrc: () => shouldRepairUserNpmrc
 });
-import { execFileSync as execFileSync26 } from "child_process";
-import * as fs30 from "fs";
-import * as path37 from "path";
+import { execFileSync as execFileSync27 } from "child_process";
+import * as fs31 from "fs";
+import * as path38 from "path";
 function getEndpoint(env) {
   try {
-    const result = execFileSync26("aws", [
+    const result = execFileSync27("aws", [
       "codeartifact",
       "get-repository-endpoint",
       "--domain",
@@ -17184,7 +17441,7 @@ function getEndpoint(env) {
 }
 function codeartifactLogin(env) {
   try {
-    execFileSync26("aws", [
+    execFileSync27("aws", [
       "codeartifact",
       "login",
       "--tool",
@@ -17239,7 +17496,7 @@ function resolvePublisherRoleArn({
 }
 function assumeRole2(roleArn) {
   try {
-    const result = execFileSync26("aws", [
+    const result = execFileSync27("aws", [
       "sts",
       "assume-role",
       "--role-arn",
@@ -17261,7 +17518,7 @@ function assumeRole2(roleArn) {
 }
 function assumeRoleWithWebIdentity2(roleArn, idToken, sessionName) {
   try {
-    const result = execFileSync26("aws", [
+    const result = execFileSync27("aws", [
       "sts",
       "assume-role-with-web-identity",
       "--role-arn",
@@ -17325,50 +17582,50 @@ function resolveCredentials(context, roleArn) {
 function findProjectRoot2() {
   let dir = process.cwd();
   while (true) {
-    if (fs30.existsSync(path37.join(dir, "pnpm-workspace.yaml")) || fs30.existsSync(path37.join(dir, "pnpm-lock.yaml")) || fs30.existsSync(path37.join(dir, "Pulumi.yaml")) || fs30.existsSync(path37.join(dir, ".npmrc"))) {
+    if (fs31.existsSync(path38.join(dir, "pnpm-workspace.yaml")) || fs31.existsSync(path38.join(dir, "pnpm-lock.yaml")) || fs31.existsSync(path38.join(dir, "Pulumi.yaml")) || fs31.existsSync(path38.join(dir, ".npmrc"))) {
       return dir;
     }
-    const parent = path37.dirname(dir);
+    const parent = path38.dirname(dir);
     if (parent === dir) return null;
     dir = parent;
   }
 }
 function ensureProjectNpmrc(endpoint) {
   const projectRoot = findProjectRoot2() ?? process.cwd();
-  const npmrcPath2 = path37.join(projectRoot, ".npmrc");
+  const npmrcPath2 = path38.join(projectRoot, ".npmrc");
   const scopeLine = `${CA_NAMESPACE}:registry=${endpoint}`;
-  if (!fs30.existsSync(npmrcPath2)) {
-    fs30.writeFileSync(npmrcPath2, scopeLine + "\n", "utf-8");
+  if (!fs31.existsSync(npmrcPath2)) {
+    fs31.writeFileSync(npmrcPath2, scopeLine + "\n", "utf-8");
     return { created: true, updated: false, path: npmrcPath2 };
   }
-  const content = fs30.readFileSync(npmrcPath2, "utf-8");
+  const content = fs31.readFileSync(npmrcPath2, "utf-8");
   const scopeRegex = new RegExp(`^${CA_NAMESPACE.replace("/", "\\/")}:registry=.+$`, "m");
   if (scopeRegex.test(content)) {
     if (content.includes(scopeLine)) {
       return { created: false, updated: false, path: npmrcPath2 };
     }
     const updated = content.replace(scopeRegex, scopeLine);
-    fs30.writeFileSync(npmrcPath2, updated, "utf-8");
+    fs31.writeFileSync(npmrcPath2, updated, "utf-8");
     return { created: false, updated: true, path: npmrcPath2 };
   }
   const separator = content.endsWith("\n") ? "" : "\n";
-  fs30.writeFileSync(npmrcPath2, content + separator + scopeLine + "\n", "utf-8");
+  fs31.writeFileSync(npmrcPath2, content + separator + scopeLine + "\n", "utf-8");
   return { created: false, updated: true, path: npmrcPath2 };
 }
 function applyGrantToUserNpmrc(grant, npmrcPath2 = homeNpmrcPath()) {
   let existing = "";
   try {
-    existing = fs30.readFileSync(npmrcPath2, "utf-8");
+    existing = fs31.readFileSync(npmrcPath2, "utf-8");
   } catch {
   }
   const content = upsertNpmrcLines(existing, [
     { key: `${grant.scope}:registry`, value: grant.endpoint },
     { key: `${npmrcAuthKeyForEndpoint(grant.endpoint)}:_authToken`, value: grant.authorizationToken }
   ]);
-  fs30.mkdirSync(path37.dirname(npmrcPath2), { recursive: true });
-  fs30.writeFileSync(npmrcPath2, content, { mode: 384 });
+  fs31.mkdirSync(path38.dirname(npmrcPath2), { recursive: true });
+  fs31.writeFileSync(npmrcPath2, content, { mode: 384 });
   try {
-    fs30.chmodSync(npmrcPath2, 384);
+    fs31.chmodSync(npmrcPath2, 384);
   } catch {
   }
   return { path: npmrcPath2 };
@@ -17491,7 +17748,7 @@ function shouldRepairUserNpmrc(opts) {
 function repairUnscopedRegistry(npmrcPath2 = homeNpmrcPath()) {
   let original;
   try {
-    original = fs30.readFileSync(npmrcPath2, "utf-8");
+    original = fs31.readFileSync(npmrcPath2, "utf-8");
   } catch {
     return { removed: null };
   }
@@ -17499,8 +17756,8 @@ function repairUnscopedRegistry(npmrcPath2 = homeNpmrcPath()) {
   if (!removed) return { removed: null };
   const backupPath = `${npmrcPath2}.bak-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
   try {
-    fs30.writeFileSync(backupPath, original, "utf-8");
-    fs30.writeFileSync(npmrcPath2, content, "utf-8");
+    fs31.writeFileSync(backupPath, original, "utf-8");
+    fs31.writeFileSync(npmrcPath2, content, "utf-8");
   } catch (err) {
     return { removed: null, error: err instanceof Error ? err.message : String(err) };
   }
@@ -17512,9 +17769,9 @@ function renderRegistrySessionLine(session, now = Date.now()) {
 }
 async function checkExistingToken() {
   const npmrcPath2 = homeNpmrcPath();
-  if (!fs30.existsSync(npmrcPath2)) return { valid: false, state: "missing", reason: "no ~/.npmrc" };
+  if (!fs31.existsSync(npmrcPath2)) return { valid: false, state: "missing", reason: "no ~/.npmrc" };
   const hijackLine = findUnscopedCodeArtifactRegistry(
-    fs30.readFileSync(npmrcPath2, "utf-8")
+    fs31.readFileSync(npmrcPath2, "utf-8")
   ) ?? void 0;
   const probe = await probeRegistryToken({ npmrcPath: npmrcPath2 });
   if (probe.state === "missing") {
@@ -17567,9 +17824,9 @@ async function runRegistryStatus(opts) {
   logInfo(renderRegistrySessionLine(opts?.session ?? readRegistrySession()));
   const projectRoot = findProjectRoot2();
   if (projectRoot) {
-    const npmrcPath2 = path37.join(projectRoot, ".npmrc");
-    if (fs30.existsSync(npmrcPath2)) {
-      const content = fs30.readFileSync(npmrcPath2, "utf-8");
+    const npmrcPath2 = path38.join(projectRoot, ".npmrc");
+    if (fs31.existsSync(npmrcPath2)) {
+      const content = fs31.readFileSync(npmrcPath2, "utf-8");
       if (content.includes(`${CA_NAMESPACE}:registry=`)) {
         logSuccess(`Project .npmrc configured (${npmrcPath2})`);
       } else {
@@ -17603,7 +17860,7 @@ region = us-east-2`,
       { remediation: { command: `aws configure sso --profile ${profile}` } }
     );
   }
-  const probe = () => execFileSync26("aws", ["sts", "get-caller-identity", "--profile", profile], {
+  const probe = () => execFileSync27("aws", ["sts", "get-caller-identity", "--profile", profile], {
     stdio: ["ignore", "pipe", "pipe"],
     timeout: 2e4
   });
@@ -17614,7 +17871,7 @@ region = us-east-2`,
   } catch {
     logInfo(`AWS SSO session for profile '${profile}' is stale \u2014 opening browser login\u2026`);
   }
-  execFileSync26("aws", ["sso", "login", "--profile", profile], { stdio: "inherit" });
+  execFileSync27("aws", ["sso", "login", "--profile", profile], { stdio: "inherit" });
   try {
     probe();
   } catch (err) {
@@ -17850,9 +18107,9 @@ __export(wizard_exports, {
   wizardExitCode: () => wizardExitCode,
   wizardNextCommands: () => wizardNextCommands
 });
-import * as fs31 from "fs";
-import * as path38 from "path";
-import { execFileSync as execFileSync27 } from "child_process";
+import * as fs32 from "fs";
+import * as path39 from "path";
+import { execFileSync as execFileSync28 } from "child_process";
 import chalk4 from "chalk";
 function isNewPlatform(mode) {
   return typeof mode === "object" && "newPlatform" in mode;
@@ -17929,18 +18186,18 @@ function classifyRepo(cwd) {
   if (isInsidePlatformMonorepo(cwd)) return { kind: "platform-monorepo", root: resolveTargetRoot(cwd) };
   if (shouldBootstrapAppsRepo(cwd)) return { kind: "empty-apps-repo", root: cwd };
   const root = resolveTargetRoot(cwd);
-  const inRepo = fs31.existsSync(path38.join(root, ".git"));
+  const inRepo = fs32.existsSync(path39.join(root, ".git"));
   if (!inRepo) {
-    const hasContent = fs31.readdirSync(cwd).some((entry) => !entry.startsWith("."));
+    const hasContent = fs32.readdirSync(cwd).some((entry) => !entry.startsWith("."));
     return { kind: hasContent ? "no-repo" : "empty-dir", root: cwd };
   }
-  const hasWorkspace = fs31.existsSync(path38.join(root, "pnpm-workspace.yaml")) || fs31.existsSync(path38.join(root, "pnpm-lock.yaml"));
-  const hasApps = fs31.existsSync(path38.join(root, "apps")) || fs31.existsSync(path38.join(root, "tenants"));
+  const hasWorkspace = fs32.existsSync(path39.join(root, "pnpm-workspace.yaml")) || fs32.existsSync(path39.join(root, "pnpm-lock.yaml"));
+  const hasApps = fs32.existsSync(path39.join(root, "apps")) || fs32.existsSync(path39.join(root, "tenants"));
   if (hasWorkspace || hasApps) return { kind: "apps-repo", root };
   return { kind: "other-repo", root };
 }
 function gitInit(dir) {
-  execFileSync27("git", ["init", "-q"], { cwd: dir, stdio: ["ignore", "ignore", "pipe"] });
+  execFileSync28("git", ["init", "-q"], { cwd: dir, stdio: ["ignore", "ignore", "pipe"] });
 }
 async function runWizardSteps(ctx, steps) {
   const results = [];
@@ -18161,7 +18418,7 @@ var init_wizard = __esm({
           return { name, status: "fail", detail: `platform repo not scaffolded: ${err.message.split("\n")[0]}`, fix: `mesh init platform ${ctx.tenant} --dir <empty-dir>` };
         }
         const bucket = await ensureStateBucket(setup, ctx.seams?.stateBucket);
-        const next = renderPlatformNextSteps(setup, { bucket, relativeDir: path38.relative(ctx.cwd, setup.dir) || "." });
+        const next = renderPlatformNextSteps(setup, { bucket, relativeDir: path39.relative(ctx.cwd, setup.dir) || "." });
         return {
           name,
           status: setup.createStateBucket && !bucket.present ? "warn" : "pass",
@@ -18259,8 +18516,8 @@ var init_wizard = __esm({
           }
           case "apps-repo": {
             const missing = [];
-            if (!fs31.existsSync(path38.join(root, "package.json"))) missing.push("package.json");
-            if (!fs31.existsSync(path38.join(root, "pnpm-workspace.yaml")) && !fs31.existsSync(path38.join(root, "pnpm-lock.yaml"))) {
+            if (!fs32.existsSync(path39.join(root, "package.json"))) missing.push("package.json");
+            if (!fs32.existsSync(path39.join(root, "pnpm-workspace.yaml")) && !fs32.existsSync(path39.join(root, "pnpm-lock.yaml"))) {
               missing.push("pnpm-workspace.yaml");
             }
             if (missing.length) {
@@ -18297,8 +18554,8 @@ var init_wizard = __esm({
 
 // libs/mesh-cli/src/commands/init.ts
 import chalk5 from "chalk";
-import * as fs32 from "fs";
-import * as path39 from "path";
+import * as fs33 from "fs";
+import * as path40 from "path";
 async function setupPrompts() {
   const [{ default: input2 }, { default: confirm }] = await Promise.all([
     import("@inquirer/input"),
@@ -18324,7 +18581,7 @@ async function probeHubTenants(hubUrl, accessToken) {
 }
 function readHomeNpmrc() {
   try {
-    return fs32.readFileSync(homeNpmrcPath(), "utf-8");
+    return fs33.readFileSync(homeNpmrcPath(), "utf-8");
   } catch {
     return "";
   }
@@ -18448,9 +18705,9 @@ async function runChecks2(args) {
   if (local) {
     checks.push({ name: "Deployer role", status: "pass", detail: "local context \u2014 no deployer role required" });
   } else {
-    const stackFiles = fs32.existsSync(root) ? fs32.readdirSync(root).filter((f) => /^Pulumi\..*\.yaml$/.test(f)) : [];
+    const stackFiles = fs33.existsSync(root) ? fs33.readdirSync(root).filter((f) => /^Pulumi\..*\.yaml$/.test(f)) : [];
     const hasRole = stackFiles.some(
-      (f) => /mesh:deployerRole/.test(fs32.readFileSync(path39.join(root, f), "utf-8"))
+      (f) => /mesh:deployerRole/.test(fs33.readFileSync(path40.join(root, f), "utf-8"))
     );
     checks.push(
       hasRole ? { name: "Deployer role", status: "pass", detail: "mesh:deployerRole configured in stack config" } : {
@@ -18462,8 +18719,8 @@ async function runChecks2(args) {
     );
   }
   const shapeProblems = [];
-  if (!fs32.existsSync(path39.join(root, "package.json"))) shapeProblems.push("package.json");
-  const hasWorkspace = fs32.existsSync(path39.join(root, "pnpm-workspace.yaml")) || fs32.existsSync(path39.join(root, "pnpm-lock.yaml"));
+  if (!fs33.existsSync(path40.join(root, "package.json"))) shapeProblems.push("package.json");
+  const hasWorkspace = fs33.existsSync(path40.join(root, "pnpm-workspace.yaml")) || fs33.existsSync(path40.join(root, "pnpm-lock.yaml"));
   if (!hasWorkspace) shapeProblems.push("pnpm-workspace.yaml");
   checks.push(
     shapeProblems.length === 0 ? { name: "Repo shape", status: "pass", detail: "pnpm workspace layout present" } : {
@@ -18519,7 +18776,7 @@ function registerInitCommands(program2) {
       if (bucket.detail !== "not requested") logInfo(`Pulumi state bucket: ${bucket.detail}`);
       console.log("");
       console.log("Next steps:");
-      for (const line of renderPlatformNextSteps2(setup, { bucket, relativeDir: path39.relative(process.cwd(), setup.dir) || "." })) {
+      for (const line of renderPlatformNextSteps2(setup, { bucket, relativeDir: path40.relative(process.cwd(), setup.dir) || "." })) {
         console.log(line ? `  ${line}` : "");
       }
       console.log("");
@@ -18587,10 +18844,10 @@ var init_init = __esm({
 });
 
 // libs/mesh-cli/src/commands/install-shim.ts
-import { execFileSync as execFileSync28 } from "child_process";
-import * as fs33 from "fs";
+import { execFileSync as execFileSync29 } from "child_process";
+import * as fs34 from "fs";
 import * as os10 from "os";
-import * as path40 from "path";
+import * as path41 from "path";
 function shimScript() {
   return `#!/bin/sh
 # mesh \u2014 canonical launcher shim (installed by \`mesh install-shim\`).
@@ -18663,25 +18920,25 @@ exit 1
 `;
 }
 function defaultShimDir() {
-  return path40.join(os10.homedir(), ".local", "bin");
+  return path41.join(os10.homedir(), ".local", "bin");
 }
 function dirOnPath(dir, pathEnv) {
   if (!pathEnv) return false;
-  return pathEnv.split(path40.delimiter).some((p) => p === dir);
+  return pathEnv.split(path41.delimiter).some((p) => p === dir);
 }
 function registerInstallShimCommand(program2) {
   program2.command("install-shim").description("Install a build-free `mesh` shim on your PATH so bare `mesh` runs the local source").option("--dir <dir>", "Directory to install into (must be on your PATH)", defaultShimDir()).option("-f, --force", "Overwrite an existing file at the target path", false).action((opts) => {
-    const dir = path40.resolve(opts.dir);
-    const target = path40.join(dir, "mesh");
-    if (fs33.existsSync(target) && !opts.force) {
+    const dir = path41.resolve(opts.dir);
+    const target = path41.join(dir, "mesh");
+    if (fs34.existsSync(target) && !opts.force) {
       logWarn(`A file already exists at ${target}.`);
       logInfo("Re-run with --force to overwrite it, or pass --dir <other-path-on-PATH>.");
       return;
     }
     try {
-      fs33.mkdirSync(dir, { recursive: true });
-      fs33.writeFileSync(target, shimScript(), { mode: 493 });
-      fs33.chmodSync(target, 493);
+      fs34.mkdirSync(dir, { recursive: true });
+      fs34.writeFileSync(target, shimScript(), { mode: 493 });
+      fs34.chmodSync(target, 493);
     } catch (err) {
       logError(`Could not write the shim to ${target}: ${err.message}`);
       process.exitCode = 1;
@@ -18694,13 +18951,13 @@ function registerInstallShimCommand(program2) {
     } else {
       logInfo("Bare `mesh <cmd>` now runs the local source of whatever workspace you're in.");
     }
-    const diagPath = path40.join(os10.tmpdir(), "mesh-shim-selftest.log");
+    const diagPath = path41.join(os10.tmpdir(), "mesh-shim-selftest.log");
     let stdout = "";
     let stderr = "";
     let status = 0;
     let ok = true;
     try {
-      stdout = execFileSync28(target, ["--help"], {
+      stdout = execFileSync29(target, ["--help"], {
         cwd: process.cwd(),
         encoding: "utf8",
         stdio: ["ignore", "pipe", "pipe"]
@@ -18727,7 +18984,7 @@ function registerInstallShimCommand(program2) {
       ""
     ].join("\n");
     try {
-      fs33.writeFileSync(diagPath, diag);
+      fs34.writeFileSync(diagPath, diag);
     } catch {
     }
     if (ok && /Commands:|Usage:/.test(stdout)) {
@@ -18747,17 +19004,17 @@ var init_install_shim = __esm({
 });
 
 // libs/mesh-cli/src/commands/local/hub-local.ts
-import { execFile as execFile3, execFileSync as execFileSync29 } from "child_process";
-import * as fs34 from "fs";
+import { execFile as execFile3, execFileSync as execFileSync30 } from "child_process";
+import * as fs35 from "fs";
 import * as os11 from "os";
-import * as path41 from "path";
+import * as path42 from "path";
 import { promisify as promisify2 } from "util";
 function cacheDir() {
   return meshCacheDir("hub-local");
 }
 function npmrcPath() {
-  const p = path41.join(os11.homedir(), ".npmrc");
-  if (!fs34.existsSync(p) || !fs34.readFileSync(p, "utf-8").includes("codeartifact")) {
+  const p = path42.join(os11.homedir(), ".npmrc");
+  if (!fs35.existsSync(p) || !fs35.readFileSync(p, "utf-8").includes("codeartifact")) {
     throw new MeshCliError(
       "The local Hub builds from the published @mesh-tech/hub tarball, which needs registry auth.",
       { remediation: { command: REGISTRY_LOGIN_FIX } }
@@ -18767,7 +19024,7 @@ function npmrcPath() {
 }
 function imageExists(tag) {
   try {
-    execFileSync29("docker", ["image", "inspect", tag], { stdio: ["ignore", "pipe", "pipe"] });
+    execFileSync30("docker", ["image", "inspect", tag], { stdio: ["ignore", "pipe", "pipe"] });
     return true;
   } catch {
     return false;
@@ -18776,22 +19033,22 @@ function imageExists(tag) {
 function ensureHubAuthImage() {
   if (imageExists(HUB_AUTH_IMAGE)) return;
   logInfo(`Building ${HUB_AUTH_IMAGE} (Hub auth proxy)\u2026`);
-  const hubStackDir = path41.join(findPackageRoot(), "stack", "hub");
-  execFileSync29(
+  const hubStackDir = path42.join(findPackageRoot(), "stack", "hub");
+  execFileSync30(
     "docker",
-    ["build", "-f", path41.join(hubStackDir, "Dockerfile.auth"), "-t", HUB_AUTH_IMAGE, hubStackDir],
+    ["build", "-f", path42.join(hubStackDir, "Dockerfile.auth"), "-t", HUB_AUTH_IMAGE, hubStackDir],
     { stdio: ["ignore", "inherit", "inherit"], env: { ...process.env, DOCKER_BUILDKIT: "1" } }
   );
   logSuccess(`Built ${HUB_AUTH_IMAGE}`);
 }
 function hasRegistryAuth() {
-  const p = path41.join(os11.homedir(), ".npmrc");
-  return fs34.existsSync(p) && fs34.readFileSync(p, "utf-8").includes("codeartifact");
+  const p = path42.join(os11.homedir(), ".npmrc");
+  return fs35.existsSync(p) && fs35.readFileSync(p, "utf-8").includes("codeartifact");
 }
 function localHubVersion() {
   const versions = HUB_IMAGES.map((name) => {
     try {
-      const out = execFileSync29("docker", ["images", name, "--format", "{{.Tag}}"], {
+      const out = execFileSync30("docker", ["images", name, "--format", "{{.Tag}}"], {
         encoding: "utf-8",
         stdio: ["ignore", "pipe", "pipe"]
       });
@@ -18817,10 +19074,10 @@ async function fetchTarball() {
       { encoding: "utf-8" }
     );
     const info = JSON.parse(stdout)[0];
-    return { tarball: path41.join(dir, info.filename), version: info.version };
+    return { tarball: path42.join(dir, info.filename), version: info.version };
   } catch (err) {
     const authFailure = isNpmAuthError(err);
-    const cached = fs34.readdirSync(dir).filter((f) => f.startsWith("mesh-tech-hub-") && f.endsWith(".tgz")).sort((a, b) => a.localeCompare(b, void 0, { numeric: true })).at(-1);
+    const cached = fs35.readdirSync(dir).filter((f) => f.startsWith("mesh-tech-hub-") && f.endsWith(".tgz")).sort((a, b) => a.localeCompare(b, void 0, { numeric: true })).at(-1);
     if (!cached) {
       if (authFailure) {
         throw new MeshCliError(
@@ -18838,7 +19095,7 @@ async function fetchTarball() {
     } else {
       logInfo(`Registry unavailable \u2014 using the cached hub tarball v${version}`);
     }
-    return { tarball: path41.join(dir, cached), version };
+    return { tarball: path42.join(dir, cached), version };
   } finally {
     heartbeat.stop();
   }
@@ -18867,13 +19124,13 @@ async function ensureHubImages() {
     logInfo(`Local Hub images ready (v${version})`);
     return version;
   }
-  const context = path41.join(cacheDir(), `context-${version}`);
-  fs34.rmSync(context, { recursive: true, force: true });
-  fs34.mkdirSync(context, { recursive: true });
-  execFileSync29("tar", ["-xzf", tarball, "-C", context, "--strip-components", "1"], {
+  const context = path42.join(cacheDir(), `context-${version}`);
+  fs35.rmSync(context, { recursive: true, force: true });
+  fs35.mkdirSync(context, { recursive: true });
+  execFileSync30("tar", ["-xzf", tarball, "-C", context, "--strip-components", "1"], {
     stdio: ["ignore", "pipe", "pipe"]
   });
-  const hubStackDir = path41.join(findPackageRoot(), "stack", "hub");
+  const hubStackDir = path42.join(findPackageRoot(), "stack", "hub");
   for (const [name, dockerfile] of [
     ["mesh-local-hub-api", "Dockerfile.api"],
     ["mesh-local-hub-ui", "Dockerfile.ui"]
@@ -18881,12 +19138,12 @@ async function ensureHubImages() {
     const tag = `${name}:${version}`;
     if (imageExists(tag)) continue;
     logInfo(`Building ${tag} from the published tarball\u2026`);
-    execFileSync29(
+    execFileSync30(
       "docker",
       [
         "build",
         "-f",
-        path41.join(hubStackDir, dockerfile),
+        path42.join(hubStackDir, dockerfile),
         "-t",
         tag,
         "--secret",
@@ -18904,29 +19161,29 @@ function tarballNameForImageVersion(version) {
   return `mesh-tech-hub-${version.replace(/-r\d+$/, "")}.tgz`;
 }
 function readHubCompiledAuthz(version) {
-  const context = path41.join(cacheDir(), `context-${version}`);
-  const file = path41.join(context, HUB_COMPILED_AUTHZ_REL);
-  if (!fs34.existsSync(file)) {
+  const context = path42.join(cacheDir(), `context-${version}`);
+  const file = path42.join(context, HUB_COMPILED_AUTHZ_REL);
+  if (!fs35.existsSync(file)) {
     const tarball = tarballNameForImageVersion(version);
-    if (!tarball || !fs34.existsSync(path41.join(cacheDir(), tarball))) return null;
-    fs34.mkdirSync(context, { recursive: true });
+    if (!tarball || !fs35.existsSync(path42.join(cacheDir(), tarball))) return null;
+    fs35.mkdirSync(context, { recursive: true });
     try {
-      execFileSync29(
+      execFileSync30(
         "tar",
-        ["-xzf", path41.join(cacheDir(), tarball), "-C", context, "--strip-components", "1", `package/${HUB_COMPILED_AUTHZ_REL}`],
+        ["-xzf", path42.join(cacheDir(), tarball), "-C", context, "--strip-components", "1", `package/${HUB_COMPILED_AUTHZ_REL}`],
         { stdio: ["ignore", "pipe", "pipe"] }
       );
     } catch {
       return null;
     }
-    if (!fs34.existsSync(file)) return null;
+    if (!fs35.existsSync(file)) return null;
   }
-  const parsed = JSON.parse(fs34.readFileSync(file, "utf-8"));
+  const parsed = JSON.parse(fs35.readFileSync(file, "utf-8"));
   if (typeof parsed.zed !== "string" || !parsed.metadata || typeof parsed.metadata !== "object") return null;
   return { zed: parsed.zed, metadata: parsed.metadata };
 }
 function readWorkspaceCatalog(repoRoot2) {
-  const text = fs34.readFileSync(path41.join(repoRoot2, "pnpm-workspace.yaml"), "utf-8");
+  const text = fs35.readFileSync(path42.join(repoRoot2, "pnpm-workspace.yaml"), "utf-8");
   const marker = "\ncatalog:\n";
   const at = text.indexOf(marker);
   if (at === -1) return {};
@@ -18941,11 +19198,11 @@ function readWorkspaceCatalog(repoRoot2) {
 function normalizeHubManifests(contextDir, catalog) {
   const DEP_FIELDS = ["dependencies", "optionalDependencies", "peerDependencies"];
   const touched = [];
-  for (const entry of fs34.readdirSync(contextDir, { withFileTypes: true })) {
+  for (const entry of fs35.readdirSync(contextDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    const manifest = path41.join(contextDir, entry.name, "package.json");
-    if (!fs34.existsSync(manifest)) continue;
-    const pkg = JSON.parse(fs34.readFileSync(manifest, "utf-8"));
+    const manifest = path42.join(contextDir, entry.name, "package.json");
+    if (!fs35.existsSync(manifest)) continue;
+    const pkg = JSON.parse(fs35.readFileSync(manifest, "utf-8"));
     let changed = false;
     if (pkg.devDependencies) {
       delete pkg.devDependencies;
@@ -18974,7 +19231,7 @@ function normalizeHubManifests(contextDir, catalog) {
       }
     }
     if (changed) {
-      fs34.writeFileSync(manifest, `${JSON.stringify(pkg, null, 2)}
+      fs35.writeFileSync(manifest, `${JSON.stringify(pkg, null, 2)}
 `);
       touched.push(`${entry.name}/package.json`);
     }
@@ -18982,15 +19239,15 @@ function normalizeHubManifests(contextDir, catalog) {
   return touched;
 }
 async function buildHubImagesFromSource(repoRoot2) {
-  const hubDir = path41.join(repoRoot2, "apps", "hub");
-  if (!fs34.existsSync(path41.join(hubDir, "package.json"))) {
+  const hubDir = path42.join(repoRoot2, "apps", "hub");
+  if (!fs35.existsSync(path42.join(hubDir, "package.json"))) {
     throw new MeshCliError(
       `--hub-from-source needs a mesh-platform checkout; no apps/hub under ${repoRoot2}.`,
       { remediation: { command: "Run mesh start from a mesh-platform checkout, or drop --hub-from-source" } }
     );
   }
   const npmrc = npmrcPath();
-  const version = `${JSON.parse(fs34.readFileSync(path41.join(hubDir, "package.json"), "utf-8")).version}-src`;
+  const version = `${JSON.parse(fs35.readFileSync(path42.join(hubDir, "package.json"), "utf-8")).version}-src`;
   const build = startHeartbeat("building apps/hub (api + ui) from source");
   try {
     for (const pkg of ["@mesh-tech/hub-api", "@mesh-tech/hub-ui"]) {
@@ -18999,27 +19256,27 @@ async function buildHubImagesFromSource(repoRoot2) {
   } finally {
     build.stop();
   }
-  const context = path41.join(cacheDir(), `context-${version}`);
-  fs34.rmSync(context, { recursive: true, force: true });
-  fs34.mkdirSync(context, { recursive: true });
+  const context = path42.join(cacheDir(), `context-${version}`);
+  fs35.rmSync(context, { recursive: true, force: true });
+  fs35.mkdirSync(context, { recursive: true });
   await execFileAsync2("pnpm", ["pack", "--pack-destination", context], { cwd: hubDir, maxBuffer: 64 * 1024 * 1024 });
-  const tarball = fs34.readdirSync(context).find((f) => f.endsWith(".tgz"));
+  const tarball = fs35.readdirSync(context).find((f) => f.endsWith(".tgz"));
   if (!tarball) throw new MeshCliError("pnpm pack produced no tarball for apps/hub");
-  execFileSync29("tar", ["-xzf", path41.join(context, tarball), "-C", context, "--strip-components", "1"], {
+  execFileSync30("tar", ["-xzf", path42.join(context, tarball), "-C", context, "--strip-components", "1"], {
     stdio: ["ignore", "pipe", "pipe"]
   });
   const rewritten = normalizeHubManifests(context, readWorkspaceCatalog(repoRoot2));
   if (rewritten.length > 0) logInfo(`Normalized ${rewritten.length} manifest(s) for npm: ${rewritten.join(", ")}`);
-  const hubStackDir = path41.join(findPackageRoot(), "stack", "hub");
+  const hubStackDir = path42.join(findPackageRoot(), "stack", "hub");
   for (const [name, dockerfile] of [
     ["mesh-local-hub-api", "Dockerfile.api"],
     ["mesh-local-hub-ui", "Dockerfile.ui"]
   ]) {
     const tag = `${name}:${version}`;
     logInfo(`Building ${tag} from source\u2026`);
-    execFileSync29(
+    execFileSync30(
       "docker",
-      ["build", "-f", path41.join(hubStackDir, dockerfile), "-t", tag, "--secret", `id=npmrc,src=${npmrc}`, context],
+      ["build", "-f", path42.join(hubStackDir, dockerfile), "-t", tag, "--secret", `id=npmrc,src=${npmrc}`, context],
       { stdio: ["ignore", "inherit", "inherit"], env: { ...process.env, DOCKER_BUILDKIT: "1" } }
     );
     logSuccess(`Built ${tag}`);
@@ -19104,8 +19361,8 @@ var init_seed_hub_catalog = __esm({
 });
 
 // libs/mesh-cli/src/commands/local/index.ts
-import * as fs35 from "fs";
-import * as path42 from "path";
+import * as fs36 from "fs";
+import * as path43 from "path";
 import chalk6 from "chalk";
 function crashError(crashed) {
   return new MeshCliError(
@@ -19117,10 +19374,13 @@ function crashError(crashed) {
     }
   );
 }
-async function waitForStack(io = {
+async function waitForStack(opts, io = {
   probe: probeEndpoint,
   services: stackServices,
-  overlayServices: hubOverlayServices
+  overlays: () => [
+    { services: hubOverlayServices(), started: false },
+    { services: idpsOverlayServices(), started: opts.idpsStarted }
+  ]
 }) {
   const deadline = Date.now() + WAIT_TIMEOUT_MS;
   let pending = STACK_ENDPOINTS.filter((e) => e.probe.kind !== "none");
@@ -19135,10 +19395,7 @@ async function waitForStack(io = {
       }
     }
     pending = stillDown;
-    const crashed = crashedServices(io.services(), {
-      overlayServices: io.overlayServices(),
-      overlayStarted: false
-    });
+    const crashed = crashedServices(io.services(), { overlays: io.overlays() });
     if (crashed.length > 0) throw crashError(crashed);
     if (pending.length === 0) break;
     if (Date.now() > deadline) {
@@ -19222,17 +19479,22 @@ function portMoveHints() {
     [
       Number(hubPort()),
       "MESH_HUB_PORT=<free port> mesh start   (or mesh start --no-hub, which starts everything else)"
+    ],
+    [MOCK_SAML_PORT, "mesh start   (without --with-idps \u2014 the mock identity providers are opt-in)"],
+    [
+      MOCK_OIDC_PORT,
+      "mesh start   (without --with-idps; 5556 is Dex's own default port, so a Dex of your own is the usual holder)"
     ]
   ]);
 }
 function repoRootForHubSource() {
   for (let dir = process.cwd(); ; ) {
-    if (fs35.existsSync(path42.join(dir, "apps", "hub", "package.json"))) return dir;
-    const parent = path42.dirname(dir);
+    if (fs36.existsSync(path43.join(dir, "apps", "hub", "package.json"))) return dir;
+    const parent = path43.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
-  return path42.resolve(findPackageRoot(), "..", "..");
+  return path43.resolve(findPackageRoot(), "..", "..");
 }
 function registerLocalCommands(program2) {
   program2.command("start").description("Start the full-local Mesh platform (Docker only \u2014 no AWS, no VPN)").option("--no-seed", "skip first-boot seeding (tenant registry, artifacts bucket)").option("--no-hub", "start without the Hub (API + UI)").option(
@@ -19241,6 +19503,10 @@ function registerLocalCommands(program2) {
   ).option(
     "--hub-from-source",
     "build the Hub images from THIS checkout's apps/hub instead of the published tarball (the only way to exercise a Hub change locally)"
+  ).option(
+    "--with-idps",
+    "also run mock SAML and OIDC identity providers, and federate the local Zitadel with both (for testing enterprise SSO without a cloud tenant or an IdP admin)",
+    false
   ).option(
     "--takeover",
     "re-own a stack that another checkout started (may recreate shared containers with THIS checkout's config)",
@@ -19268,7 +19534,11 @@ Re-running start from here may recreate shared containers with this checkout's c
       logWarn(`Taking over the running stack (previously driven from ${foreign}).`);
     }
     if (!opts.skipPortCheck && !stackServices().some((s) => s.state === "running")) {
-      const ports = hostPortsOf([...STACK_ENDPOINTS, ...opts.hub ? hubEndpoints() : []]);
+      const ports = hostPortsOf([
+        ...STACK_ENDPOINTS,
+        ...opts.hub ? hubEndpoints() : [],
+        ...opts.withIdps ? idpEndpoints() : []
+      ]);
       const conflicts = await findPortConflicts(ports, `${COMPOSE_PROJECT}-`);
       if (conflicts.length > 0) {
         throw new MeshCliError(describePortConflicts(conflicts, portMoveHints()), {
@@ -19313,9 +19583,10 @@ Re-running start from here may recreate shared containers with this checkout's c
       }
     }
     logInfo("Starting the local Mesh platform (docker compose project: mesh-local)\u2026");
-    await composeStreamed(["up", "-d"]);
+    const idpEnv = opts.withIdps ? mockIdpComposeEnv() : void 0;
+    await composeStreamed(["up", "-d"], { idps: opts.withIdps, env: idpEnv });
     compose(["restart", "prometheus", "blackbox-exporter"], { inherit: true });
-    await waitForStack();
+    await waitForStack({ idpsStarted: opts.withIdps });
     let hubAuth = readHubAuth();
     if (opts.seed) {
       logInfo("Seeding local platform (tenant registry, artifacts bucket)\u2026");
@@ -19323,6 +19594,16 @@ Re-running start from here may recreate shared containers with this checkout's c
       logInfo("Seeding Zitadel (Platform project, Mesh CLI app, Hub auth, test users)\u2026");
       const zitadel = await seedZitadel(LOCAL_AWS_CONFIG);
       hubAuth = zitadel.hubAuth;
+      if (opts.withIdps) {
+        logInfo("Federating local Zitadel with the mock SAML and OIDC identity providers\u2026");
+        await seedMockIdps();
+        logInfo(
+          `Mock SAML IdP: http://localhost:${MOCK_SAML_PORT}  \xB7  mock OIDC IdP: http://localhost:${MOCK_OIDC_PORT}/dex  \xB7  sign in at http://localhost:8080 and both federation buttons are offered`
+        );
+        logInfo(
+          "Both are listed in the Zitadel console under Settings \u2192 Identity Providers (owner: Instance): http://localhost:8080/ui/console/org-settings?id=idp"
+        );
+      }
       if (hubVersion) {
         const compiled = readHubCompiledAuthz(hubVersion);
         if (compiled) {
@@ -19365,19 +19646,23 @@ Re-running start from here may recreate shared containers with this checkout's c
         hubEnv.MESH_HUB_OAUTH2_CLIENT_SECRET = hubAuth.clientSecret;
         hubEnv.MESH_HUB_OAUTH2_COOKIE_SECRET = hubAuth.cookieSecret;
       }
-      await composeStreamed(["up", "-d"], { hub: true, env: hubEnv });
+      await composeStreamed(["up", "-d"], {
+        hub: true,
+        idps: opts.withIdps,
+        env: { ...idpEnv, ...hubEnv }
+      });
       if (opts.seed) {
         compose(["restart", "hub-api"], { hub: true, env: hubEnv });
       }
-      const overlayServices = hubOverlayServices();
+      const overlays = [
+        { services: hubOverlayServices(), started: true },
+        { services: idpsOverlayServices(), started: opts.withIdps }
+      ];
       for (const endpoint of hubEndpoints()) {
         logInfo(`Waiting for ${endpoint.label}\u2026`);
         let up = await probeEndpoint(endpoint);
         for (let i = 0; i < 60 && !up; i++) {
-          const crashed = crashedServices(stackServices(), {
-            overlayServices,
-            overlayStarted: true
-          });
+          const crashed = crashedServices(stackServices(), { overlays });
           if (crashed.length > 0) throw crashError(crashed);
           await new Promise((resolve20) => setTimeout(resolve20, 2e3));
           up = await probeEndpoint(endpoint);
@@ -19421,11 +19706,20 @@ Re-running start from here may recreate shared containers with this checkout's c
         remediation: { command: "mesh start" }
       });
     }
-    const overlayServices = hubOverlayServices();
-    const overlayStarted = hubOverlayRunning(services, overlayServices);
-    const notStarted = (s) => !overlayStarted && overlayServices.has(s.name) && s.state === "exited";
+    const hubOverlay = hubOverlayServices();
+    const idpsOverlay = idpsOverlayServices();
+    const idpsStarted = overlayRunning(services, idpsOverlay);
+    const overlays = [
+      { services: hubOverlay, started: overlayRunning(services, hubOverlay) },
+      { services: idpsOverlay, started: idpsStarted }
+    ];
+    const notStarted = (s) => s.state === "exited" && overlays.some((o) => !o.started && o.services.has(s.name));
     const hasHub = hubApiRunning(services);
-    const endpoints = hasHub ? [...STACK_ENDPOINTS, ...hubEndpoints()] : STACK_ENDPOINTS;
+    const endpoints = [
+      ...STACK_ENDPOINTS,
+      ...hasHub ? hubEndpoints() : [],
+      ...idpsStarted ? idpEndpoints() : []
+    ];
     const probes = await Promise.all(
       endpoints.map(async (endpoint) => ({
         service: endpoint.service,
@@ -19450,6 +19744,7 @@ Re-running start from here may recreate shared containers with this checkout's c
           services,
           endpoints: probes,
           fabric,
+          mockIdps: idpsStarted,
           awsEnv: localAwsEnv()
         })
       );
@@ -19464,7 +19759,7 @@ Re-running start from here may recreate shared containers with this checkout's c
       const idle = notStarted(service);
       const icon = ok || oneShotDone ? chalk6.green("\u25CF") : idle ? chalk6.dim("\u25CB") : chalk6.red("\u25CF");
       const health = service.health ? ` (${service.health})` : "";
-      const note = idle ? chalk6.dim("  (Hub not started this run)") : "";
+      const note = idle ? chalk6.dim("  (not started this run)") : "";
       console.log(`  ${icon} ${service.name.padEnd(22)} ${service.state}${health}${note}`);
     }
     console.log("");
@@ -19478,8 +19773,13 @@ Re-running start from here may recreate shared containers with this checkout's c
       const detail = fabric.ok ? "8 KB Advanced-tier round-trip OK" : fabric.error;
       console.log(`  ${icon} ${"AWS fabric check".padEnd(34)} ${chalk6.dim(detail ?? "")}`);
     }
+    if (!idpsStarted) {
+      console.log(
+        `  ${chalk6.dim("\u25CB")} ${"Mock IdPs (SAML + OIDC)".padEnd(34)} ${chalk6.dim("not started \u2014 mesh start --with-idps")}`
+      );
+    }
     const down = probes.filter((p) => !p.up);
-    const crashed = crashedServices(services, { overlayServices, overlayStarted });
+    const crashed = crashedServices(services, { overlays });
     if (fabric && !fabric.ok) process.exitCode = 1;
     if (down.length > 0 || crashed.length > 0) {
       console.log("");
@@ -19502,6 +19802,7 @@ var init_local = __esm({
     init_auth_provision();
     init_seed();
     init_seed_zitadel();
+    init_mock_idps();
     init_seed_hub_catalog();
     init_helpers();
     WAIT_TIMEOUT_MS = 18e4;
@@ -20492,7 +20793,7 @@ var init_secrets = __esm({
 import { createHash as createHash4 } from "node:crypto";
 import { createReadStream } from "node:fs";
 import { readdir, readFile as readFile2, stat } from "node:fs/promises";
-import { join as join38, relative as relative11, resolve as resolve17, sep as sep6 } from "node:path";
+import { join as join39, relative as relative11, resolve as resolve17, sep as sep6 } from "node:path";
 async function describeSiteHttpError(res, target, site) {
   if (res.status === 403) {
     return `not allowed to publish "${site}" \u2014 you are authenticated but lack the grant. Need one of: sites:${site}:publish, sites:*:publish, or studio-admin.`;
@@ -20514,7 +20815,7 @@ async function walk(root) {
   async function visit(dir) {
     for (const entry of await readdir(dir, { withFileTypes: true })) {
       if (SKIP_ENTRIES.has(entry.name)) continue;
-      const absolute = join38(dir, entry.name);
+      const absolute = join39(dir, entry.name);
       if (entry.isSymbolicLink()) {
         logWarn(`skipping symlink ${relative11(root, absolute)}`);
         continue;
@@ -20709,23 +21010,23 @@ var init_site = __esm({
 });
 
 // libs/mesh-cli/src/commands/stack.ts
-import { execFileSync as execFileSync30 } from "child_process";
-import * as path43 from "path";
-import * as fs36 from "fs";
+import { execFileSync as execFileSync31 } from "child_process";
+import * as path44 from "path";
+import * as fs37 from "fs";
 import { parse as parseYaml5 } from "yaml";
 function readTopLevelYamlKey(appRoot, stack, key) {
-  const configFile = path43.join(appRoot, `Pulumi.${stack}.yaml`);
-  if (!fs36.existsSync(configFile)) return null;
-  const content = fs36.readFileSync(configFile, "utf-8");
+  const configFile = path44.join(appRoot, `Pulumi.${stack}.yaml`);
+  if (!fs37.existsSync(configFile)) return null;
+  const content = fs37.readFileSync(configFile, "utf-8");
   const pattern = new RegExp(`^${key}:\\s*(.+)$`, "m");
   const match = content.match(pattern);
   if (!match) return null;
   return match[1].trim().replace(/^["']|["']$/g, "");
 }
 function readConfigBlockKey(appRoot, stack, key) {
-  const configFile = path43.join(appRoot, `Pulumi.${stack}.yaml`);
-  if (!fs36.existsSync(configFile)) return null;
-  const content = fs36.readFileSync(configFile, "utf-8");
+  const configFile = path44.join(appRoot, `Pulumi.${stack}.yaml`);
+  if (!fs37.existsSync(configFile)) return null;
+  const content = fs37.readFileSync(configFile, "utf-8");
   const pattern = new RegExp(`^\\s{2}${key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}:\\s*(.+)$`, "m");
   const match = content.match(pattern);
   if (!match) return null;
@@ -20785,11 +21086,11 @@ ${records}
   }
 }
 function readBaseConfigFromYaml(appRoot, stack) {
-  const file = path43.join(appRoot, `Pulumi.${stack}.yaml`);
-  if (!fs36.existsSync(file)) return {};
+  const file = path44.join(appRoot, `Pulumi.${stack}.yaml`);
+  if (!fs37.existsSync(file)) return {};
   let doc;
   try {
-    doc = parseYaml5(fs36.readFileSync(file, "utf-8"));
+    doc = parseYaml5(fs37.readFileSync(file, "utf-8"));
   } catch {
     return {};
   }
@@ -20802,7 +21103,7 @@ function readBaseConfigFromYaml(appRoot, stack) {
 }
 function getGitHubUsername() {
   try {
-    const result = execFileSync30("gh", ["api", "user", "--jq", ".login"], {
+    const result = execFileSync31("gh", ["api", "user", "--jq", ".login"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -20811,7 +21112,7 @@ function getGitHubUsername() {
   } catch {
   }
   try {
-    const result = execFileSync30("git", ["config", "user.email"], {
+    const result = execFileSync31("git", ["config", "user.email"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -20866,7 +21167,7 @@ Specify which to base on: mesh stack init --from <stack>`
       }
     }
     const baseConfigPath = `${appRoot}/Pulumi.${baseStack}.yaml`;
-    if (!fs36.existsSync(baseConfigPath)) {
+    if (!fs37.existsSync(baseConfigPath)) {
       logError(`Stack config not found: Pulumi.${baseStack}.yaml`);
       process.exit(1);
     }
@@ -20888,8 +21189,8 @@ Specify which to base on: mesh stack init --from <stack>`
         );
       }
     }
-    const newConfigPath = path43.join(appRoot, `Pulumi.${newStack}.yaml`);
-    const configExists = fs36.existsSync(newConfigPath);
+    const newConfigPath = path44.join(appRoot, `Pulumi.${newStack}.yaml`);
+    const configExists = fs37.existsSync(newConfigPath);
     const secretsProvider = readTopLevelYamlKey(appRoot, baseStack, "secretsprovider");
     const credEnv = await resolvePulumiEnv({ appRoot, stack: baseStack });
     const pulumiEnv = { ...process.env, ...credEnv };
@@ -20897,7 +21198,7 @@ Specify which to base on: mesh stack init --from <stack>`
     if (!opts.adopt) {
       let existing = [];
       try {
-        const raw = execFileSync30("pulumi", ["stack", "ls", "--json"], {
+        const raw = execFileSync31("pulumi", ["stack", "ls", "--json"], {
           cwd: appRoot,
           encoding: "utf-8",
           env: pulumiEnv,
@@ -20921,7 +21222,7 @@ Specify which to base on: mesh stack init --from <stack>`
       logInfo(`Using KMS secrets provider: ${secretsProvider}`);
     }
     try {
-      execFileSync30("pulumi", initArgs, {
+      execFileSync31("pulumi", initArgs, {
         cwd: appRoot,
         env: pulumiEnv,
         stdio: "inherit"
@@ -20938,7 +21239,7 @@ Specify which to base on: mesh stack init --from <stack>`
       }
     }
     try {
-      execFileSync30("pulumi", ["stack", "select", newStack], {
+      execFileSync31("pulumi", ["stack", "select", newStack], {
         cwd: appRoot,
         env: pulumiEnv,
         stdio: ["pipe", "pipe", "pipe"]
@@ -20948,7 +21249,7 @@ Specify which to base on: mesh stack init --from <stack>`
     if (!configExists) {
       let baseConfig = {};
       try {
-        const raw = execFileSync30(
+        const raw = execFileSync31(
           "pulumi",
           ["config", "--json", "--stack", baseStack],
           { cwd: appRoot, env: pulumiEnv, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
@@ -20966,19 +21267,19 @@ Specify which to base on: mesh stack init --from <stack>`
         if (key === "mesh:deploy") continue;
         try {
           if (entry.objectValue !== void 0) {
-            execFileSync30(
+            execFileSync31(
               "pulumi",
               ["config", "set", key, JSON.stringify(entry.objectValue)],
               { cwd: appRoot, env: pulumiEnv, stdio: ["pipe", "pipe", "pipe"] }
             );
           } else if (entry.value === "true" || entry.value === "false") {
-            execFileSync30(
+            execFileSync31(
               "pulumi",
               ["config", "set", "--type", "bool", key, entry.value],
               { cwd: appRoot, env: pulumiEnv, stdio: ["pipe", "pipe", "pipe"] }
             );
           } else {
-            execFileSync30(
+            execFileSync31(
               "pulumi",
               ["config", "set", key, entry.value],
               { cwd: appRoot, env: pulumiEnv, stdio: ["pipe", "pipe", "pipe"] }
@@ -20991,7 +21292,7 @@ Specify which to base on: mesh stack init --from <stack>`
         const baseEnv = readConfigBlockKey(appRoot, baseStack, "mesh:coreEnv") ?? (baseTenant && baseStack.startsWith(`${baseTenant}-`) ? baseStack.slice(baseTenant.length + 1) : baseStack);
         const setCfg = (args) => {
           try {
-            execFileSync30("pulumi", ["config", "set", ...args], {
+            execFileSync31("pulumi", ["config", "set", ...args], {
               cwd: appRoot,
               env: pulumiEnv,
               stdio: ["pipe", "pipe", "pipe"]
@@ -21040,7 +21341,7 @@ Specify which to base on: mesh stack init --from <stack>`
           `Configured Pulumi.${newStack}.yaml (personal platform env on core '${baseEnv}'${opts.parentZone ? `, DNS zone ${newStack.startsWith(`${baseTenant}-`) ? newStack.slice(baseTenant.length + 1) : newStack}.${opts.parentZone}` : ""})`
         );
       } else {
-        execFileSync30("pulumi", ["config", "set", "--type", "bool", "mesh:deploy", "false"], {
+        execFileSync31("pulumi", ["config", "set", "--type", "bool", "mesh:deploy", "false"], {
           cwd: appRoot,
           env: pulumiEnv,
           stdio: ["pipe", "pipe", "pipe"]
@@ -21070,7 +21371,7 @@ Specify which to base on: mesh stack init --from <stack>`
     const args = ["stack", "rm", name];
     if (opts.yes) args.push("--yes");
     try {
-      execFileSync30("pulumi", args, { cwd: appRoot, env: pulumiEnv, stdio: "inherit" });
+      execFileSync31("pulumi", args, { cwd: appRoot, env: pulumiEnv, stdio: "inherit" });
       logSuccess(`Removed stack ${name}`);
     } catch (err) {
       process.exit(err.status ?? 1);
@@ -21282,12 +21583,12 @@ var init_recover_conversation = __esm({
 });
 
 // libs/mesh-cli/src/utils/temporal-codec.ts
-import { execFileSync as execFileSync31 } from "child_process";
+import { execFileSync as execFileSync32 } from "child_process";
 import { webcrypto as crypto4 } from "node:crypto";
 function resolveTemporalEncodingKeyFromK8s(namespace) {
   const secretName = `${namespace}-temporal-encoding-key`;
   try {
-    const b64 = execFileSync31(
+    const b64 = execFileSync32(
       "kubectl",
       [
         "get",
@@ -21536,9 +21837,9 @@ var init_capture_history = __esm({
 
 // libs/mesh-cli/src/commands/temporal.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { writeFileSync as writeFileSync24, mkdirSync as mkdirSync19 } from "node:fs";
+import { writeFileSync as writeFileSync24, mkdirSync as mkdirSync20 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { dirname as dirname28, join as join40, resolve as resolve18 } from "node:path";
+import { dirname as dirname28, join as join41, resolve as resolve18 } from "node:path";
 async function resolveConnection(options) {
   if (options.address && options.namespace) {
     return { address: options.address, namespace: options.namespace };
@@ -21966,8 +22267,8 @@ async function captureHistory(workflowId, runId, options) {
     }
     const { serializeHistoryToFixture: serializeHistoryToFixture2 } = await Promise.resolve().then(() => (init_capture_history(), capture_history_exports));
     const { fixture, eventCount, decryptedPayloads } = await serializeHistoryToFixture2(events, decrypter);
-    const outPath = options.out ?? join40(homedir6(), ".mesh", "replay-histories", `${sanitizeFileId(workflowId)}.json`);
-    mkdirSync19(dirname28(outPath), { recursive: true });
+    const outPath = options.out ?? join41(homedir6(), ".mesh", "replay-histories", `${sanitizeFileId(workflowId)}.json`);
+    mkdirSync20(dirname28(outPath), { recursive: true });
     if (options.out) warnIfNotGitIgnored(options.out);
     writeFileSync24(outPath, JSON.stringify(fixture, null, 2) + "\n");
     logSuccess(
@@ -22158,8 +22459,8 @@ var init_temporal = __esm({
 
 // libs/mesh-cli/src/commands/tenant.ts
 import chalk7 from "chalk";
-import * as fs37 from "fs";
-import * as path44 from "path";
+import * as fs38 from "fs";
+import * as path45 from "path";
 import { parseDocument, YAMLMap, isMap } from "yaml";
 function validateTenantName(name) {
   return /^[a-z][a-z0-9-]*$/.test(name) && !name.endsWith("-");
@@ -22227,16 +22528,16 @@ function resolveStackConfig(explicitStack) {
       { remediation: { command: "mesh tenant add <name> --stack <stack>" } }
     );
   }
-  const file = path44.join(appRoot, `Pulumi.${stack}.yaml`);
-  if (!fs37.existsSync(file)) {
+  const file = path45.join(appRoot, `Pulumi.${stack}.yaml`);
+  if (!fs38.existsSync(file)) {
     throw new MeshCliError(`Stack config not found: ${file}`, {
       remediation: { command: "mesh tenant add <name> --stack <stack>" }
     });
   }
-  return { appRoot, stack, file, content: fs37.readFileSync(file, "utf-8") };
+  return { appRoot, stack, file, content: fs38.readFileSync(file, "utf-8") };
 }
 function readProjectName(appRoot) {
-  const projectDoc = parseDocument(fs37.readFileSync(path44.join(appRoot, "Pulumi.yaml"), "utf-8"));
+  const projectDoc = parseDocument(fs38.readFileSync(path45.join(appRoot, "Pulumi.yaml"), "utf-8"));
   return String(projectDoc.get("name") ?? "");
 }
 function looksLikePlatformLayer(projectName) {
@@ -22279,12 +22580,12 @@ function registerTenantCommands(program2) {
       if (!result.ok) {
         if (result.reason === "exists") {
           throw new MeshCliError(
-            `${result.detail} (${path44.basename(resolved.file)}). Edit the existing entry instead of re-adding it.`
+            `${result.detail} (${path45.basename(resolved.file)}). Edit the existing entry instead of re-adding it.`
           );
         }
         throw new MeshCliError(`${resolved.file}: ${result.detail}`);
       }
-      atomicWriteFileSync(resolved.file, result.yaml, fs37.statSync(resolved.file).mode & 511);
+      atomicWriteFileSync(resolved.file, result.yaml, fs38.statSync(resolved.file).mode & 511);
       if (opts.json) {
         emitJsonPayload({
           ok: true,
@@ -22297,7 +22598,7 @@ function registerTenantCommands(program2) {
         return;
       }
       logInfo(
-        `Tenant '${name}' registered in ${path44.basename(resolved.file)} (mesh:tenants, subdomain '${subdomain}')${result.createdTenantsBlock ? " \u2014 created the mesh:tenants block" : ""}`
+        `Tenant '${name}' registered in ${path45.basename(resolved.file)} (mesh:tenants, subdomain '${subdomain}')${result.createdTenantsBlock ? " \u2014 created the mesh:tenants block" : ""}`
       );
       console.log("");
       console.log("Next steps:");
@@ -22323,7 +22624,7 @@ function registerTenantCommands(program2) {
           `Project '${projectName}' does not look like a platform layer \u2014 tenants are declared on the tenant platform repo's PLATFORM stack (e.g. mesh-sandbox/platform).`
         );
       }
-      logInfo(`No tenants declared in ${path44.basename(resolved.file)}.`);
+      logInfo(`No tenants declared in ${path45.basename(resolved.file)}.`);
       return;
     }
     logInfo(`Tenants on stack '${resolved.stack}':`);
@@ -22345,9 +22646,9 @@ var init_tenant = __esm({
 
 // libs/mesh-cli/src/commands/tunnel/index.ts
 import { spawn as spawn9 } from "child_process";
-import * as fs38 from "fs";
+import * as fs39 from "fs";
 import * as os12 from "os";
-import * as path45 from "path";
+import * as path46 from "path";
 import {
   SecretsManagerClient as SecretsManagerClient9,
   GetSecretValueCommand as GetSecretValueCommand9
@@ -22367,9 +22668,9 @@ function readPulumiAwsRegion(stage) {
   const preferred = stage ? `Pulumi.${stage}.yaml` : void 0;
   const rank = (f) => f === preferred ? 0 : f === "Pulumi.yaml" ? 2 : 1;
   try {
-    const files = fs38.readdirSync(".").filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml")).sort((a, b) => rank(a) - rank(b));
+    const files = fs39.readdirSync(".").filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml")).sort((a, b) => rank(a) - rank(b));
     for (const f of files) {
-      const m = fs38.readFileSync(f, "utf-8").match(/^\s*aws:region:\s*["']?([^"'\n]+)["']?/m);
+      const m = fs39.readFileSync(f, "utf-8").match(/^\s*aws:region:\s*["']?([^"'\n]+)["']?/m);
       if (m?.[1]) return m[1].trim();
     }
   } catch {
@@ -22378,14 +22679,14 @@ function readPulumiAwsRegion(stage) {
 }
 function awsProfileSections(name) {
   return [
-    [path45.join(os12.homedir(), ".aws", "config"), `[profile ${name}]`],
-    [path45.join(os12.homedir(), ".aws", "credentials"), `[${name}]`]
+    [path46.join(os12.homedir(), ".aws", "config"), `[profile ${name}]`],
+    [path46.join(os12.homedir(), ".aws", "credentials"), `[${name}]`]
   ];
 }
 function awsProfileExists(name) {
   for (const [file, header] of awsProfileSections(name)) {
     try {
-      const lines = fs38.readFileSync(file, "utf-8").split("\n");
+      const lines = fs39.readFileSync(file, "utf-8").split("\n");
       if (lines.some((l) => l.trim() === header)) return true;
     } catch {
     }
@@ -22411,7 +22712,7 @@ function awsProfileRegion(profile) {
   if (!profile) return void 0;
   for (const [file, header] of awsProfileSections(profile)) {
     try {
-      const region = parseProfileRegion(fs38.readFileSync(file, "utf-8"), header);
+      const region = parseProfileRegion(fs39.readFileSync(file, "utf-8"), header);
       if (region) return region;
     } catch {
     }
@@ -22420,14 +22721,14 @@ function awsProfileRegion(profile) {
 }
 function awsDefaultProfileSections() {
   return [
-    [path45.join(os12.homedir(), ".aws", "config"), "[default]"],
-    [path45.join(os12.homedir(), ".aws", "credentials"), "[default]"]
+    [path46.join(os12.homedir(), ".aws", "config"), "[default]"],
+    [path46.join(os12.homedir(), ".aws", "credentials"), "[default]"]
   ];
 }
 function awsDefaultProfileRegion() {
   for (const [file, header] of awsDefaultProfileSections()) {
     try {
-      const region = parseProfileRegion(fs38.readFileSync(file, "utf-8"), header);
+      const region = parseProfileRegion(fs39.readFileSync(file, "utf-8"), header);
       if (region) return region;
     } catch {
     }
@@ -22814,8 +23115,8 @@ async function resolveToken(opts) {
     "no token: pass --token, set VCS_TOKEN, or pass --context <platform-context> (after mesh login)"
   );
 }
-async function vcsApi(baseUrl, token, path47, method = "GET", body) {
-  const res = await fetch(`${baseUrl}${path47}`, {
+async function vcsApi(baseUrl, token, path48, method = "GET", body) {
+  const res = await fetch(`${baseUrl}${path48}`, {
     method,
     headers: {
       authorization: `Bearer ${token}`,
@@ -22826,7 +23127,7 @@ async function vcsApi(baseUrl, token, path47, method = "GET", body) {
   const data = await res.json().catch(() => ({}));
   if (!res.ok) {
     throw new Error(
-      `${method} ${path47} failed (${res.status}): ${String(data.error ?? "unknown error")}`
+      `${method} ${path48} failed (${res.status}): ${String(data.error ?? "unknown error")}`
     );
   }
   return data;
@@ -22872,8 +23173,8 @@ var init_clone = __esm({
 
 // libs/mesh-cli/src/commands/vcs/get.ts
 import { writeFile as writeFile2, mkdir as mkdir2 } from "node:fs/promises";
-import { join as join43, dirname as dirname29 } from "node:path";
-async function getCommand(repo, path47, opts) {
+import { join as join44, dirname as dirname29 } from "node:path";
+async function getCommand(repo, path48, opts) {
   let vcsBaseUrl;
   let token;
   if (opts.target) {
@@ -22888,18 +23189,18 @@ async function getCommand(repo, path47, opts) {
   if (!token) throw new Error("no token: pass --target (after mesh login), or --token / --context");
   const reader = createVcsFolderReader({ vcsBaseUrl, token });
   try {
-    const { ref, files } = await reader.readPath(repo, path47);
+    const { ref, files } = await reader.readPath(repo, path48);
     if (files.length === 0) {
-      logInfo(`no files at ${repo}:${path47}`);
+      logInfo(`no files at ${repo}:${path48}`);
       return;
     }
     if (opts.output) {
       for (const f of files) {
-        const abs = join43(opts.output, f.path);
+        const abs = join44(opts.output, f.path);
         await mkdir2(dirname29(abs), { recursive: true });
         await writeFile2(abs, f.contents);
       }
-      logInfo(`wrote ${files.length} file(s) from ${repo}:${path47} (${ref}) \u2192 ${opts.output}`);
+      logInfo(`wrote ${files.length} file(s) from ${repo}:${path48} (${ref}) \u2192 ${opts.output}`);
     } else {
       for (const f of files) {
         if (files.length > 1) process.stdout.write(`
@@ -22924,10 +23225,10 @@ var init_get = __esm({
 });
 
 // libs/mesh-cli/src/commands/vcs/drafts.ts
-async function call(opts, repo, path47, method = "GET", body) {
+async function call(opts, repo, path48, method = "GET", body) {
   const target = await resolveTarget2({ ...opts, repo });
   const token = await resolveToken(opts);
-  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path47}`, method, body);
+  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path48}`, method, body);
 }
 async function draftsListCommand(repo, opts) {
   const data = await call(opts, repo, `/drafts${opts.all ? "?all=true" : ""}`);
@@ -22982,7 +23283,7 @@ var init_drafts = __esm({
 
 // libs/mesh-cli/src/commands/vcs/propose.ts
 import { readFile as readFile3 } from "node:fs/promises";
-import { join as join44 } from "node:path";
+import { join as join45 } from "node:path";
 function parseStatus(out) {
   const tokens = out.split("\0");
   const changes = [];
@@ -23015,13 +23316,13 @@ function parseStatus(out) {
   }
   return changes;
 }
-async function writeOp(cwd, path47) {
-  const buf = await readFile3(join44(cwd, path47));
+async function writeOp(cwd, path48) {
+  const buf = await readFile3(join45(cwd, path48));
   const asUtf8 = buf.toString("utf8");
   if (Buffer.from(asUtf8, "utf8").equals(buf)) {
-    return { op: "write", path: path47, content: asUtf8 };
+    return { op: "write", path: path48, content: asUtf8 };
   }
-  return { op: "write", path: path47, content: buf.toString("base64"), encoding: "base64" };
+  return { op: "write", path: path48, content: buf.toString("base64"), encoding: "base64" };
 }
 async function proposeCommand(opts) {
   const cwd = process.cwd();
@@ -23065,8 +23366,8 @@ async function proposeCommand(opts) {
     operations,
     ...opts.mergeParent ? { mergeParent: opts.mergeParent } : {}
   };
-  const path47 = opts.revise ? `/v1/repos/${target.repo}/proposals/${opts.revise}/revisions` : `/v1/repos/${target.repo}/proposals`;
-  const data = await vcsApi(target.baseUrl, token, path47, "POST", body);
+  const path48 = opts.revise ? `/v1/repos/${target.repo}/proposals/${opts.revise}/revisions` : `/v1/repos/${target.repo}/proposals`;
+  const data = await vcsApi(target.baseUrl, token, path48, "POST", body);
   console.log(
     `proposal ${data.proposalId} @ ${data.sha.slice(0, 8)} \u2014 review: mesh vcs show ${target.repo} ${data.proposalId} --url ${target.baseUrl}`
   );
@@ -23081,28 +23382,28 @@ var init_propose = __esm({
 // libs/mesh-cli/src/commands/vcs/rm.ts
 import { mkdtemp as mkdtemp2, rm as rmrf } from "node:fs/promises";
 import { tmpdir as tmpdir10 } from "node:os";
-import { join as join45 } from "node:path";
+import { join as join46 } from "node:path";
 function normalize2(p) {
   return p.trim().replace(/^\.\//, "").replace(/\/+$/, "");
 }
 function expandPathsToDeletions(repoFiles, requested) {
   const out = /* @__PURE__ */ new Set();
   for (const raw of requested) {
-    const path47 = normalize2(raw);
-    if (path47.startsWith("/") || path47.split("/").includes("..")) {
+    const path48 = normalize2(raw);
+    if (path48.startsWith("/") || path48.split("/").includes("..")) {
       throw new Error(
         `"${raw}" is not a repo-relative path \u2014 vcs paths never start with "/" or traverse with "..".`
       );
     }
-    const exact = repoFiles.filter((f) => f === path47);
+    const exact = repoFiles.filter((f) => f === path48);
     if (exact.length > 0) {
       for (const f of exact) out.add(f);
       continue;
     }
-    const under = repoFiles.filter((f) => f.startsWith(`${path47}/`));
+    const under = repoFiles.filter((f) => f.startsWith(`${path48}/`));
     if (under.length === 0) {
       throw new Error(
-        `"${raw}" matched no files in the repo \u2014 nothing was proposed. Check the path with: mesh vcs get <repo> ${path47}`
+        `"${raw}" matched no files in the repo \u2014 nothing was proposed. Check the path with: mesh vcs get <repo> ${path48}`
       );
     }
     for (const f of under) out.add(f);
@@ -23113,7 +23414,7 @@ async function rmCommand(repo, paths, opts) {
   const baseUrl = (opts.url ?? process.env.VCS_URL)?.replace(/\/$/, "");
   if (!baseUrl) throw new Error("rm requires --url or VCS_URL");
   const token = await resolveToken(opts);
-  const dir = await mkdtemp2(join45(tmpdir10(), "mesh-vcs-rm-"));
+  const dir = await mkdtemp2(join46(tmpdir10(), "mesh-vcs-rm-"));
   try {
     const git = (args, cwd) => gitWithAuth(args, token, cwd);
     await git([
@@ -23138,7 +23439,7 @@ async function rmCommand(repo, paths, opts) {
     const body = {
       baseCommit: head.trim(),
       message: opts.message ?? `Delete ${doomed.length} file(s)`,
-      operations: doomed.map((path47) => ({ op: "delete", path: path47 }))
+      operations: doomed.map((path48) => ({ op: "delete", path: path48 }))
     };
     const data = await vcsApi(
       baseUrl,
@@ -23164,10 +23465,10 @@ var init_rm = __esm({
 });
 
 // libs/mesh-cli/src/commands/vcs/review.ts
-async function call2(opts, repo, path47, method = "GET", body) {
+async function call2(opts, repo, path48, method = "GET", body) {
   const target = await resolveTarget2({ ...opts, repo });
   const token = await resolveToken(opts);
-  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path47}`, method, body);
+  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path48}`, method, body);
 }
 async function proposalsCommand(repo, opts) {
   console.log(JSON.stringify(await call2(opts, repo, "/proposals"), null, 2));
@@ -23314,8 +23615,8 @@ function computeHappyPath(nodes, edges) {
     ];
     const visited = /* @__PURE__ */ new Set([startNode.id]);
     while (queue.length > 0) {
-      const { id, path: path47 } = queue.shift();
-      if (targetIds.has(id)) return path47;
+      const { id, path: path48 } = queue.shift();
+      if (targetIds.has(id)) return path48;
       const neighbors = adjacency.get(id) ?? [];
       const hasMainEdge = neighbors.some((e) => e.isMainPath);
       const candidates = hasMainEdge ? neighbors.filter((e) => e.isMainPath) : neighbors;
@@ -23335,7 +23636,7 @@ function computeHappyPath(nodes, edges) {
         if (!allowExceptional && (neighbor.isExceptional || neighbor.isTimeout || failureEndIds.has(neighbor.to)))
           continue;
         visited.add(neighbor.to);
-        queue.push({ id: neighbor.to, path: [...path47, neighbor.to] });
+        queue.push({ id: neighbor.to, path: [...path48, neighbor.to] });
       }
     }
     return null;
@@ -23620,11 +23921,11 @@ function wrapIntoGroup(workflow, nodeIds, groupId, label, groupType) {
         }
       }
       if (found) {
-        const path47 = [];
-        for (let c = found; c !== void 0; c = prev.get(c)) path47.unshift(c);
-        for (let i = 0; i < path47.length - 1; i++) mainEdgeKeys.add(edgeKey(path47[i], path47[i + 1]));
+        const path48 = [];
+        for (let c = found; c !== void 0; c = prev.get(c)) path48.unshift(c);
+        for (let i = 0; i < path48.length - 1; i++) mainEdgeKeys.add(edgeKey(path48[i], path48[i + 1]));
         mainEdgeKeys.add(edgeKey(found, successExit.id));
-        mainBody = path47;
+        mainBody = path48;
         mainTail = [successExit.id];
       }
     }
@@ -24160,11 +24461,11 @@ function buildProcessManifest(artifact, outcomeNodeIds) {
     ...pointOfNoReturnStage ? { pointOfNoReturnStageId: pointOfNoReturnStage.id } : {}
   };
 }
-function formatPath(path47) {
-  return path47.length > 0 ? z4.core.toDotPath(path47) : "(root)";
+function formatPath(path48) {
+  return path48.length > 0 ? z4.core.toDotPath(path48) : "(root)";
 }
 function issueToDiagnostic(issue) {
-  const path47 = formatPath(issue.path);
+  const path48 = formatPath(issue.path);
   let code = "SCHEMA_INVALID";
   if (issue.code === "custom") {
     const paramCode = issue.params?.code;
@@ -24175,8 +24476,8 @@ function issueToDiagnostic(issue) {
   return {
     severity: "error",
     code,
-    message: `${path47}: ${issue.message}`,
-    path: path47
+    message: `${path48}: ${issue.message}`,
+    path: path48
   };
 }
 function upgradeV1(artifact) {
@@ -24343,24 +24644,24 @@ var init_process_artifact = __esm({
         });
       }
       const declaredSelectors = new Set(Object.keys(process2.selectors ?? {}));
-      const checkActor = (actorId, path47) => {
+      const checkActor = (actorId, path48) => {
         if (actorId === void 0) return;
         if (!Object.prototype.hasOwnProperty.call(process2.actors, actorId)) {
           ctx.addIssue({
             code: "custom",
-            path: path47,
-            message: `Actor "${actorId}" is referenced at ${z4.core.toDotPath(path47)} but not declared in process.actors. Declare the actor (label, and optionally category/selector) or fix the reference.`,
+            path: path48,
+            message: `Actor "${actorId}" is referenced at ${z4.core.toDotPath(path48)} but not declared in process.actors. Declare the actor (label, and optionally category/selector) or fix the reference.`,
             params: { code: "UNDECLARED_ACTOR" }
           });
         }
       };
-      const checkSelector = (selector, path47) => {
+      const checkSelector = (selector, path48) => {
         if (selector === void 0) return;
         if (!declaredSelectors.has(selector)) {
           ctx.addIssue({
             code: "custom",
-            path: path47,
-            message: `Selector "${selector}" is referenced at ${z4.core.toDotPath(path47)} but not declared in process.selectors. Declare the selector or fix the reference.`,
+            path: path48,
+            message: `Selector "${selector}" is referenced at ${z4.core.toDotPath(path48)} but not declared in process.selectors. Declare the selector or fix the reference.`,
             params: { code: "UNDECLARED_SELECTOR" }
           });
         }
@@ -24374,20 +24675,20 @@ var init_process_artifact = __esm({
         outcome: "DUPLICATE_OUTCOME_ID"
       };
       const idFirstSeenAt = /* @__PURE__ */ new Map();
-      const checkId = (id, kind, path47) => {
+      const checkId = (id, kind, path48) => {
         const first = idFirstSeenAt.get(id);
         if (first) {
           const kindLabel = kind === first.kind ? kind : "process";
           ctx.addIssue({
             code: "custom",
-            path: path47,
-            message: `Duplicate ${kindLabel} id "${id}": ${kind} at ${z4.core.toDotPath(path47)} collides with ${first.kind} at ${z4.core.toDotPath(first.path)}.`,
+            path: path48,
+            message: `Duplicate ${kindLabel} id "${id}": ${kind} at ${z4.core.toDotPath(path48)} collides with ${first.kind} at ${z4.core.toDotPath(first.path)}.`,
             params: {
               code: kind === first.kind ? SAME_KIND_CODE[kind] : "DUPLICATE_PROCESS_ID"
             }
           });
         } else {
-          idFirstSeenAt.set(id, { kind, path: path47 });
+          idFirstSeenAt.set(id, { kind, path: path48 });
         }
       };
       process2.stages.forEach((stage, stageIndex) => {
@@ -24434,13 +24735,13 @@ function lintProcess(artifact, inventory, predicateNames, options = {}) {
   const internalCommands = process2.internalCommands ?? [];
   const internalSet = new Set(internalCommands);
   const boundCommandPaths = /* @__PURE__ */ new Map();
-  const checkPredicate = (predicate, path47) => {
+  const checkPredicate = (predicate, path48) => {
     if (!predicateSet.has(predicate)) {
       diagnostics.push({
         severity: "error",
         code: "UNKNOWN_PREDICATE",
-        message: `Predicate "${predicate}" referenced at ${path47} is not in the predicate registry.`,
-        path: path47
+        message: `Predicate "${predicate}" referenced at ${path48} is not in the predicate registry.`,
+        path: path48
       });
     }
   };
@@ -24500,19 +24801,19 @@ function lintProcess(artifact, inventory, predicateNames, options = {}) {
   process2.outcomes.forEach((outcome, outcomeIndex) => {
     const whenPath = `process.outcomes[${outcomeIndex}].when`;
     outcomeTriggers(outcome).forEach((trigger, triggerIndex) => {
-      const path47 = Array.isArray(outcome.when) ? `${whenPath}[${triggerIndex}]` : whenPath;
+      const path48 = Array.isArray(outcome.when) ? `${whenPath}[${triggerIndex}]` : whenPath;
       if (trigger.kind === "predicate") {
-        checkPredicate(trigger.name, `${path47}.predicate`);
+        checkPredicate(trigger.name, `${path48}.predicate`);
       } else if (trigger.kind === "command") {
         if (!boundCommandPaths.has(trigger.name)) {
-          boundCommandPaths.set(trigger.name, `${path47}.command`);
+          boundCommandPaths.set(trigger.name, `${path48}.command`);
         }
         if (!commandNames.has(trigger.name)) {
           diagnostics.push({
             severity: "error",
             code: "BOUND_COMMAND_NOT_IN_INVENTORY",
-            message: `Command "${trigger.name}" triggering outcome "${outcome.id}" (${path47}.command) does not exist in the inventory.`,
-            path: `${path47}.command`
+            message: `Command "${trigger.name}" triggering outcome "${outcome.id}" (${path48}.command) does not exist in the inventory.`,
+            path: `${path48}.command`
           });
         }
       }
@@ -24624,10 +24925,10 @@ var init_src4 = __esm({
 });
 
 // libs/mesh-cli/src/commands/workflow.ts
-import * as fs39 from "fs";
-import * as path46 from "path";
+import * as fs40 from "fs";
+import * as path47 from "path";
 import { createRequire as createRequire2 } from "module";
-import { execFileSync as execFileSync32 } from "child_process";
+import { execFileSync as execFileSync33 } from "child_process";
 function resolveExtractorPath() {
   try {
     const require2 = createRequire2(import.meta.url);
@@ -24641,7 +24942,7 @@ function runExtraction(targetPath, extractorPath, explicitProcessPath) {
   let explicitProcessArtifact;
   if (explicitProcessPath) {
     try {
-      explicitProcessArtifact = JSON.parse(fs39.readFileSync(explicitProcessPath, "utf-8"));
+      explicitProcessArtifact = JSON.parse(fs40.readFileSync(explicitProcessPath, "utf-8"));
     } catch (err) {
       logError(
         `Could not read/parse --process ${explicitProcessPath}: ${err instanceof Error ? err.message : String(err)}`
@@ -24682,7 +24983,7 @@ for (const file of files) {
 process.stdout.write(JSON.stringify(results));
 `;
   try {
-    const result = execFileSync32("npx", ["tsx", "--eval", script], {
+    const result = execFileSync33("npx", ["tsx", "--eval", script], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "inherit"],
       maxBuffer: 10 * 1024 * 1024
@@ -24724,7 +25025,7 @@ for (const file of files) {
 process.stdout.write(JSON.stringify(results));
 `;
   try {
-    const result = execFileSync32("npx", ["tsx", "--eval", script], {
+    const result = execFileSync33("npx", ["tsx", "--eval", script], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "inherit"],
       maxBuffer: 10 * 1024 * 1024
@@ -24741,7 +25042,7 @@ function runLintExtraction(targetPath, extractorPath, explicitProcessPath) {
   let explicitProcessArtifact;
   if (explicitProcessPath) {
     try {
-      explicitProcessArtifact = JSON.parse(fs39.readFileSync(explicitProcessPath, "utf-8"));
+      explicitProcessArtifact = JSON.parse(fs40.readFileSync(explicitProcessPath, "utf-8"));
     } catch (err) {
       logError(
         `Could not read/parse --process ${explicitProcessPath}: ${err instanceof Error ? err.message : String(err)}`
@@ -24779,7 +25080,7 @@ for (const file of files) {
 process.stdout.write(JSON.stringify(results));
 `;
   try {
-    const result = execFileSync32("npx", ["tsx", "--eval", script], {
+    const result = execFileSync33("npx", ["tsx", "--eval", script], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "inherit"],
       maxBuffer: 10 * 1024 * 1024
@@ -24849,16 +25150,16 @@ function registerWorkflowCommands(program2) {
   ).action(
     async (targetPath, opts) => {
       try {
-        const resolvedPath = path46.resolve(targetPath);
-        if (!fs39.existsSync(resolvedPath)) {
+        const resolvedPath = path47.resolve(targetPath);
+        if (!fs40.existsSync(resolvedPath)) {
           logError(`Path does not exist: ${resolvedPath}`);
           process.exitCode = 1;
           return;
         }
         let resolvedProcessPath;
         if (opts.process) {
-          resolvedProcessPath = path46.resolve(opts.process);
-          if (!fs39.existsSync(resolvedProcessPath)) {
+          resolvedProcessPath = path47.resolve(opts.process);
+          if (!fs40.existsSync(resolvedProcessPath)) {
             logError(`--process path does not exist: ${resolvedProcessPath}`);
             process.exitCode = 1;
             return;
@@ -24907,8 +25208,8 @@ function registerWorkflowCommands(program2) {
     "Extract the as-built command/query/activity inventory from Temporal workflow source\n\nThe inventory ({ workflowType, commands, queries, activities }) is the process-\nconformance lint's code-side input \u2014 it is never hand-edited. Supports single\nfiles or directories."
   ).action(async (targetPath) => {
     try {
-      const resolvedPath = path46.resolve(targetPath);
-      if (!fs39.existsSync(resolvedPath)) {
+      const resolvedPath = path47.resolve(targetPath);
+      if (!fs40.existsSync(resolvedPath)) {
         logError(`Path does not exist: ${resolvedPath}`);
         process.exitCode = 1;
         return;
@@ -24954,16 +25255,16 @@ function registerWorkflowCommands(program2) {
     "Comma-separated named-selector registry (enables UNKNOWN_SELECTOR checks)"
   ).action(async (targetPath, opts) => {
     try {
-      const resolvedPath = path46.resolve(targetPath);
-      if (!fs39.existsSync(resolvedPath)) {
+      const resolvedPath = path47.resolve(targetPath);
+      if (!fs40.existsSync(resolvedPath)) {
         logError(`Path does not exist: ${resolvedPath}`);
         process.exitCode = 1;
         return;
       }
       let resolvedProcessPath;
       if (opts.process) {
-        resolvedProcessPath = path46.resolve(opts.process);
-        if (!fs39.existsSync(resolvedProcessPath)) {
+        resolvedProcessPath = path47.resolve(opts.process);
+        if (!fs40.existsSync(resolvedProcessPath)) {
           logError(`--process path does not exist: ${resolvedProcessPath}`);
           process.exitCode = 1;
           return;