@mesh-tech/mesh-cli 0.36.0 → 0.37.0

package/dist/src/commands/local/publish-docs.js

@@ -0,0 +1,328 @@
+import { createHash } from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { execFileSync } from "node:child_process";
+import { pathToFileURL } from "node:url";
+import { API_REGISTRY_SCHEMA_VERSION, apiEntryPath, docsSourceKey, parseDocsConfig, sandboxModeSchema, } from "@mesh-tech/api-registry";
+import { buildDocsSource } from "@mesh-tech/api-registry/docs-source-build";
+import { ARTIFACTS_BUCKET, LOCAL_ENV } from "./seed.js";
+import { localAppNamespace } from "./dev-local.js";
+import { connectLocalSpicedb, localSpicedbIo } from "./local-spicedb.js";
+export function readLocalPublishDeclaration(pkg, appRoot) {
+    const problems = [];
+    const mesh = pkg?.mesh;
+    const out = { problems };
+    const docs = mesh?.docs;
+    if (docs !== undefined) {
+        if (typeof docs?.config !== "string" || !docs.config)
+            problems.push("mesh.docs.config must name the docs.yaml");
+        const sandbox = docs?.sandbox === undefined ? undefined : sandboxModeSchema.safeParse(docs.sandbox);
+        if (sandbox && !sandbox.success)
+            problems.push("mesh.docs.sandbox must be live, mock or vendor-sandbox");
+        if (docs?.local !== undefined && (typeof docs.local !== "string" || !docs.local.includes("#"))) {
+            problems.push("mesh.docs.local must be module#export");
+        }
+        const integrationTryIt = Array.isArray(docs?.integrationTryIt)
+            ? [...new Set(docs.integrationTryIt.filter((n) => typeof n === "string" && n.length > 0))].sort()
+            : [];
+        if (docs?.integrationTryIt !== undefined && !Array.isArray(docs.integrationTryIt)) {
+            problems.push("mesh.docs.integrationTryIt must list integration names");
+        }
+        if (integrationTryIt.length > 0 && docs?.actAs !== true) {
+            problems.push("mesh.docs.integrationTryIt needs mesh.docs.actAs: true");
+        }
+        if (typeof docs?.config === "string" && docs.config) {
+            out.docs = {
+                config: path.resolve(appRoot, docs.config),
+                actAs: docs.actAs === true,
+                ...(sandbox?.success ? { sandbox: sandbox.data } : {}),
+                ...(typeof docs.local === "string" && docs.local.includes("#") ? { local: docs.local } : {}),
+                ...(typeof docs.service === "string" && docs.service ? { service: docs.service } : {}),
+                ...(integrationTryIt.length > 0 ? { integrationTryIt } : {}),
+            };
+        }
+    }
+    const metadata = mesh?.authz?.metadata;
+    if (metadata !== undefined) {
+        if (typeof metadata !== "string" || !metadata.includes("#"))
+            problems.push("mesh.authz.metadata must be module#export");
+        else
+            out.authzMetadata = metadata;
+    }
+    const spicedbSchema = mesh?.authz?.spicedbSchema;
+    if (spicedbSchema !== undefined) {
+        if (typeof spicedbSchema !== "string" || !spicedbSchema.includes("#"))
+            problems.push("mesh.authz.spicedbSchema must be module#export");
+        else if (!out.authzMetadata)
+            problems.push("mesh.authz.spicedbSchema needs mesh.authz.metadata");
+        else
+            out.authzSpicedbSchema = spicedbSchema;
+    }
+    const spicedbSeed = mesh?.authz?.spicedbSeed;
+    if (spicedbSeed !== undefined) {
+        if (typeof spicedbSeed !== "string" || !spicedbSeed.includes("#"))
+            problems.push("mesh.authz.spicedbSeed must be module#export");
+        else if (!out.authzSpicedbSchema)
+            problems.push("mesh.authz.spicedbSeed needs mesh.authz.spicedbSchema");
+        else
+            out.authzSpicedbSeed = spicedbSeed;
+    }
+    return out;
+}
+export async function callExport(appRoot, spec, arg) {
+    const [modulePath, exportName] = spec.split("#");
+    const file = path.resolve(appRoot, modulePath);
+    let mod;
+    if (/\.m?js$/.test(file)) {
+        mod = (await import(pathToFileURL(file).href));
+    }
+    else {
+        let tsImport;
+        try {
+            ({ tsImport } = await import("tsx/esm/api"));
+        }
+        catch (err) {
+            throw new Error(`${spec}: loading a TypeScript module needs tsx, which the mesh CLI ships as a dependency and could not load (${err.message}). ` +
+                "Reinstall @mesh-tech/mesh-cli, or point the declaration at a built .js/.mjs file.");
+        }
+        mod = (await tsImport(file, import.meta.url));
+    }
+    const value = mod[exportName];
+    if (typeof value !== "function")
+        throw new Error(`${spec} is not an exported function`);
+    return value(arg);
+}
+export function localDocsEntry(input) {
+    return {
+        schemaVersion: API_REGISTRY_SCHEMA_VERSION,
+        name: input.name,
+        kind: "app",
+        title: input.title,
+        ...(input.description ? { description: input.description } : {}),
+        surfaces: { http: { url: `http://localhost:${input.httpPort}` } },
+        docs: {
+            url: input.docs.url,
+            contentHash: input.docs.contentHash,
+            source: { url: input.docs.sourceUrl, contentHash: input.docs.sourceContentHash },
+        },
+        enabledOps: [],
+        ...(input.actAs
+            ? {
+                actAs: {
+                    url: `http://${input.name}.${input.namespace}:${input.httpPort}`,
+                    ...(input.integrations?.length ? { integrations: [...input.integrations] } : {}),
+                },
+            }
+            : {}),
+        ...(input.sandbox ? { sandbox: input.sandbox } : {}),
+        ...(input.eventsEntry ? { events: { entry: input.eventsEntry } } : {}),
+    };
+}
+export const LOCAL_PLATFORM_NETWORK = "mesh-local_mesh_network";
+export function aliasContainerArgs(input) {
+    return [
+        "run",
+        "-d",
+        "--rm",
+        "--name",
+        `mesh-local-alias-${input.namespace}`,
+        "--network",
+        LOCAL_PLATFORM_NETWORK,
+        "--network-alias",
+        `${input.name}.${input.namespace}`,
+        "--add-host",
+        "host.docker.internal:host-gateway",
+        "alpine/socat",
+        `TCP-LISTEN:${input.port},fork,reuseaddr`,
+        `TCP:host.docker.internal:${input.port}`,
+    ];
+}
+export function aliasContainerName(namespace) {
+    return `mesh-local-alias-${namespace}`;
+}
+function docker(args) {
+    try {
+        return execFileSync("docker", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    }
+    catch (err) {
+        const stderr = err.stderr?.trim();
+        throw new Error(`docker ${args[0]} failed${stderr ? `: ${stderr}` : ""}`);
+    }
+}
+export function removeAllAliasContainers() {
+    let names = [];
+    try {
+        names = docker(["ps", "-aq", "--filter", "name=^mesh-local-alias-", "--format", "{{.Names}}"])
+            .split("\n")
+            .map((n) => n.trim())
+            .filter(Boolean);
+    }
+    catch {
+        return [];
+    }
+    for (const name of names) {
+        try {
+            docker(["rm", "-f", name]);
+        }
+        catch {
+        }
+    }
+    return names;
+}
+function ensureAliasContainer(input) {
+    try {
+        docker(["rm", "-f", aliasContainerName(input.namespace)]);
+    }
+    catch {
+    }
+    docker(aliasContainerArgs(input));
+}
+export function resolveLocalSandbox(local, declared) {
+    const notes = [];
+    const parsed = local.sandbox === undefined ? undefined : sandboxModeSchema.safeParse(local.sandbox);
+    if (parsed && !parsed.success)
+        notes.push("the local export returned a sandbox that is not live, mock or vendor-sandbox");
+    const pins = {};
+    for (const [key, value] of Object.entries(local.env ?? {}))
+        if (typeof value === "string")
+            pins[key] = value;
+    const wanted = parsed?.success ? parsed.data : declared;
+    if (!wanted || wanted === "live")
+        return { sandbox: "live", pins, notes };
+    if (!parsed?.success || Object.keys(pins).length === 0) {
+        notes.push(`sandbox '${wanted}' is published as 'live': nothing pins the service env that would make it true, so try-it runs reads only`);
+        return { sandbox: "live", pins, notes };
+    }
+    return { sandbox: wanted, pins, notes };
+}
+export async function publishLocalDocs(input) {
+    const { declaration, appRoot, tenant, app, awsConfig } = input;
+    const docs = declaration.docs;
+    const result = {
+        problems: [...declaration.problems],
+        notes: [],
+        pins: {},
+        authzPublished: false,
+        authzEnv: {},
+        docsPublished: false,
+        actAs: false,
+    };
+    const { SSMClient, PutParameterCommand, GetParameterCommand } = await import("@aws-sdk/client-ssm");
+    const ssm = new SSMClient(awsConfig);
+    const namespace = localAppNamespace(tenant, app);
+    if (declaration.authzMetadata && input.zitadel) {
+        const metadata = await callExport(appRoot, declaration.authzMetadata);
+        const pointerPath = localAuthzPointerPath(tenant, app);
+        const metadataPath = `${pointerPath}/ops-hub-metadata`;
+        await ssm.send(new PutParameterCommand({ Name: metadataPath, Type: "String", Tier: "Advanced", Overwrite: true, Value: JSON.stringify(metadata) }));
+        let current = {};
+        try {
+            const existing = await ssm.send(new GetParameterCommand({ Name: pointerPath }));
+            current = JSON.parse(existing.Parameter?.Value ?? "{}");
+        }
+        catch {
+        }
+        let instanceRefs = [];
+        const { authzSpicedbSchema: schemaExport, authzSpicedbSeed: seedExport } = declaration;
+        if (schemaExport) {
+            const connection = await connectLocalSpicedb({
+                app,
+                tenant,
+                schema: () => callExport(appRoot, schemaExport),
+                ...(seedExport ? { seed: () => callExport(appRoot, seedExport) } : {}),
+                io: localSpicedbIo(tenant, awsConfig),
+            });
+            instanceRefs = connection.instanceRefs;
+            result.authzEnv = connection.env;
+            result.notes.push(...connection.notes);
+        }
+        const pointer = {
+            ...current,
+            spicedb: { instanceRefs },
+            zitadel: input.zitadel,
+            opsHubMetadataRef: metadataPath,
+            mode: typeof current.mode === "string" ? current.mode : "policy-engine",
+        };
+        await ssm.send(new PutParameterCommand({ Name: pointerPath, Type: "String", Overwrite: true, Value: JSON.stringify(pointer) }));
+        result.authzPublished = true;
+    }
+    else if (declaration.authzMetadata) {
+        result.notes.push("the app has no local Zitadel project yet, so its API-key metadata was not published");
+    }
+    if (!docs)
+        return result;
+    const local = docs.local ? (await callExport(appRoot, docs.local, { ...input.serviceEnv })) : {};
+    const sandbox = resolveLocalSandbox(local, docs.sandbox);
+    result.pins = sandbox.pins;
+    result.notes.push(...sandbox.notes);
+    result.sandbox = sandbox.sandbox;
+    const built = buildDocsSource({
+        configPath: docs.config,
+        ...(local.availability ? { availability: local.availability } : {}),
+        ...(local.events ? { events: local.events } : {}),
+    });
+    result.problems.push(...built.problems);
+    const config = parseDocsConfig(fs.readFileSync(docs.config, "utf8"), docs.config);
+    const { S3Client, PutObjectCommand } = await import("@aws-sdk/client-s3");
+    const s3 = new S3Client({ ...awsConfig, forcePathStyle: true });
+    const specKey = `api-docs/${app}/openapi.json`;
+    const sourceKey = docsSourceKey(app);
+    const specText = fs.readFileSync(built.specPath, "utf8");
+    await s3.send(new PutObjectCommand({ Bucket: ARTIFACTS_BUCKET, Key: specKey, Body: specText, ContentType: "application/json" }));
+    await s3.send(new PutObjectCommand({ Bucket: ARTIFACTS_BUCKET, Key: sourceKey, Body: built.json, ContentType: "application/json" }));
+    if (docs.actAs) {
+        try {
+            ensureAliasContainer({ name: app, namespace, port: input.httpPort });
+            result.actAs = true;
+        }
+        catch (err) {
+            result.notes.push(`try-it is off: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    const entry = localDocsEntry({
+        name: app,
+        title: config.title,
+        ...(config.description ? { description: config.description } : {}),
+        docs: {
+            url: `s3://${ARTIFACTS_BUCKET}/${specKey}`,
+            contentHash: createHash("sha256").update(specText).digest("hex"),
+            sourceUrl: `s3://${ARTIFACTS_BUCKET}/${sourceKey}`,
+            sourceContentHash: built.contentHash,
+        },
+        httpPort: input.httpPort,
+        namespace,
+        actAs: result.actAs,
+        ...(docs.integrationTryIt?.length ? { integrations: docs.integrationTryIt } : {}),
+        sandbox: sandbox.sandbox,
+        ...(local.events?.service ? { eventsEntry: local.events.service } : {}),
+    });
+    await ssm.send(new PutParameterCommand({
+        Name: apiEntryPath(tenant, LOCAL_ENV, app),
+        Type: "String",
+        Tier: "Advanced",
+        Overwrite: true,
+        Value: JSON.stringify(entry),
+    }));
+    result.docsPublished = true;
+    return result;
+}
+export function localAuthzPointerPath(tenant, app) {
+    return `/mesh-platform/${tenant}/${LOCAL_ENV}/apps/${app}/stacks/local/authz`;
+}
+export async function unpublishLocalDocs(tenant, app, awsConfig) {
+    const removed = [];
+    try {
+        docker(["rm", "-f", aliasContainerName(localAppNamespace(tenant, app))]);
+        removed.push("alias container");
+    }
+    catch {
+    }
+    try {
+        const { SSMClient, DeleteParameterCommand } = await import("@aws-sdk/client-ssm");
+        await new SSMClient(awsConfig).send(new DeleteParameterCommand({ Name: apiEntryPath(tenant, LOCAL_ENV, app) }));
+        removed.push("registry entry");
+    }
+    catch {
+    }
+    return removed;
+}

package/dist/src/commands/local/seed-zitadel.js

@@ -1,4 +1,5 @@
 import * as fs from "fs";
+import { publishLocalHubActAsKey } from "./act-as-local.js";
 import * as os from "os";
 import * as path from "path";
 import { hubOperatorRoleKeys, hubRoleKeyTenant, restrictedRoleBase } from "@mesh-tech/api-registry";
@@ -438,6 +439,7 @@ export async function seedZitadel(awsConfig) {
     await publishHubAuthzPointer(hubAuth.projectId, org.result[0].id, awsConfig);
     await writeRegistryParams(cliClientId, awsConfig);
     await ensureOpsHubAdmin(pat, awsConfig);
+    await publishLocalHubActAsKey(awsConfig).catch((err) => logWarn(`Hub act-as key not published: ${err instanceof Error ? err.message : err} — local try-it will be refused`));
     writeContextConfig(LOGIN_CONTEXT, { issuer: ZITADEL_ISSUER, clientId: cliClientId });
     logSuccess(`Login context '${LOGIN_CONTEXT}' configured → try: mesh login ${LOGIN_CONTEXT}`);
     return { projectId, cliClientId, hubAuth };

package/dist/src/commands/temporal.js

@@ -499,6 +499,90 @@ var init_mocks = __esm({
   }
 });
 
+// packages/api-registry/src/docs-source.ts
+import { parse as parseYaml2 } from "yaml";
+import { z } from "zod";
+function isReaderFacingServerUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") return false;
+  const host = url.hostname.toLowerCase();
+  if (host.startsWith("[") || /^\d+(\.\d+){3}$/.test(host)) return false;
+  const labels = host.split(".");
+  if (labels.length < 2) return false;
+  const tld = labels[labels.length - 1];
+  if (["svc", "local", "internal", "localhost", "cluster"].includes(tld)) return false;
+  if (host.endsWith(".svc.cluster.local") || host.endsWith(".cluster.local")) return false;
+  return /^[a-z]{2,63}$/.test(tld) || /^xn--[a-z0-9-]{1,59}$/.test(tld);
+}
+var PAGE_ID_PATTERN, pageIdSchema, docsConfigSchema, OPERATION_AVAILABILITY_STATES, operationAvailabilitySchema, docsEventsCatalogSchema, SANDBOX_MODES, sandboxModeSchema, MAX_DOCS_IMAGE_BYTES, MAX_DOCS_IMAGES_TOTAL_BYTES, IMAGE_KEY_PATTERN, BASE64_PATTERN, docsSourceBundleSchema;
+var init_docs_source = __esm({
+  "packages/api-registry/src/docs-source.ts"() {
+    "use strict";
+    PAGE_ID_PATTERN = /^[a-z0-9][a-z0-9_-]*(?:\/[a-z0-9][a-z0-9_-]*)*$/;
+    pageIdSchema = z.string().regex(PAGE_ID_PATTERN, "a page id is a lower-case path under pages/, without .md");
+    docsConfigSchema = z.object({
+      title: z.string().min(1),
+      description: z.string().min(1).optional(),
+      spec: z.string().min(1).optional(),
+      pages: z.string().min(1).optional(),
+      landing: pageIdSchema.optional(),
+      serverUrl: z.string().url().refine(isReaderFacingServerUrl, "serverUrl must be a reader-facing http(s) URL, never an in-cluster or local address").optional(),
+      nav: z.array(z.object({ group: z.string().min(1), pages: z.array(pageIdSchema).min(1) }).strict()).optional(),
+      reference: z.union([z.object({ label: z.string().min(1).optional() }).strict(), z.literal(false)]).optional(),
+      events: z.string().min(1).optional()
+    }).strict();
+    OPERATION_AVAILABILITY_STATES = ["available", "not_enabled", "not_implemented", "not_supported"];
+    operationAvailabilitySchema = z.object({
+      state: z.enum(OPERATION_AVAILABILITY_STATES),
+      reason: z.string().min(1).optional()
+    });
+    docsEventsCatalogSchema = z.object({
+      service: z.string().min(1),
+      types: z.array(
+        z.object({
+          name: z.string().min(1),
+          description: z.string().optional(),
+          schemaVersion: z.number().int().positive().optional(),
+          payloadSchema: z.record(z.string(), z.unknown()).optional()
+        })
+      ),
+      delivery: z.object({
+        payload: z.enum(["thin", "full"]).optional(),
+        retry: z.object({ maxAttempts: z.number().int().positive().optional() }).optional(),
+        signing: z.array(z.string().min(1)).optional()
+      }).optional()
+    });
+    SANDBOX_MODES = ["live", "mock", "vendor-sandbox"];
+    sandboxModeSchema = z.enum(SANDBOX_MODES);
+    MAX_DOCS_IMAGE_BYTES = 1024 * 1024;
+    MAX_DOCS_IMAGES_TOTAL_BYTES = 4 * 1024 * 1024;
+    IMAGE_KEY_PATTERN = /^[A-Za-z0-9_-][A-Za-z0-9._-]*(?:\/[A-Za-z0-9_-][A-Za-z0-9._-]*)*$/;
+    BASE64_PATTERN = /^[A-Za-z0-9+/]*={0,2}$/;
+    docsSourceBundleSchema = z.object({
+      bundleVersion: z.number().int().positive(),
+      config: docsConfigSchema,
+      pages: z.record(
+        pageIdSchema,
+        z.object({ title: z.string().min(1), description: z.string().optional(), markdown: z.string() })
+      ),
+      availability: z.record(z.string().min(1), operationAvailabilitySchema).optional(),
+      events: docsEventsCatalogSchema.optional(),
+      images: z.record(
+        z.string().regex(IMAGE_KEY_PATTERN, "an image key is a path under pages/"),
+        z.object({
+          contentType: z.enum(["image/png", "image/jpeg", "image/gif", "image/webp"]),
+          data: z.string().regex(BASE64_PATTERN, "image data is base64")
+        }).strict()
+      ).optional()
+    });
+  }
+});
+
 // packages/api-registry/src/hub-roles.ts
 function hubOperatorRoleKeys(tenants) {
   const cleaned = [...new Set(tenants.filter((t) => t !== ""))].sort();
@@ -542,93 +626,106 @@ var init_hub_roles = __esm({
 });
 
 // packages/api-registry/src/index.ts
-import { z } from "zod";
+import { z as z2 } from "zod";
 var rateLimitSpecSchema, rateLimitDefaultsSchema, integrationHealthSchema, apiSurfaceKindSchema, apiDocsSiteAudienceSchema, apiSurfaceSchema, apiRegistryEntrySchema, integrationStatusSchema, hubActAsExportsSchema;
 var init_src = __esm({
   "packages/api-registry/src/index.ts"() {
     "use strict";
+    init_docs_source();
     init_hub_roles();
-    rateLimitSpecSchema = z.object({
-      rps: z.number().int().min(1),
-      burst: z.number().int().min(1)
+    init_docs_source();
+    rateLimitSpecSchema = z2.object({
+      rps: z2.number().int().min(1),
+      burst: z2.number().int().min(1)
     });
-    rateLimitDefaultsSchema = z.record(z.string().min(1), rateLimitSpecSchema);
-    integrationHealthSchema = z.union([
-      z.object({ op: z.string().trim().min(1) }),
-      z.object({ unavailable: z.string().trim().min(1) })
+    rateLimitDefaultsSchema = z2.record(z2.string().min(1), rateLimitSpecSchema);
+    integrationHealthSchema = z2.union([
+      z2.object({ op: z2.string().trim().min(1) }),
+      z2.object({ unavailable: z2.string().trim().min(1) })
     ]);
-    apiSurfaceKindSchema = z.enum(["app", "vendor", "events"]);
-    apiDocsSiteAudienceSchema = z.discriminatedUnion("readers", [
-      z.object({ readers: z.literal("partner"), roles: z.array(z.string().min(1)) }),
-      z.object({ readers: z.literal("operator") })
+    apiSurfaceKindSchema = z2.enum(["app", "vendor", "events"]);
+    apiDocsSiteAudienceSchema = z2.discriminatedUnion("readers", [
+      z2.object({ readers: z2.literal("partner"), roles: z2.array(z2.string().min(1)) }),
+      z2.object({ readers: z2.literal("operator") })
     ]);
-    apiSurfaceSchema = z.object({
-      http: z.object({ url: z.string().min(1) }).optional(),
-      nexus: z.object({ endpoint: z.string().min(1), taskQueue: z.string().min(1) }).optional()
+    apiSurfaceSchema = z2.object({
+      http: z2.object({ url: z2.string().min(1) }).optional(),
+      nexus: z2.object({ endpoint: z2.string().min(1), taskQueue: z2.string().min(1) }).optional()
     });
-    apiRegistryEntrySchema = z.object({
-      schemaVersion: z.number().int().positive().default(1),
-      name: z.string().min(1),
+    apiRegistryEntrySchema = z2.object({
+      schemaVersion: z2.number().int().positive().default(1),
+      name: z2.string().min(1),
       kind: apiSurfaceKindSchema.optional(),
-      provider: z.string().optional(),
-      externalService: z.string().min(1).optional(),
-      version: z.string().optional(),
-      title: z.string().optional(),
-      description: z.string().optional(),
+      provider: z2.string().optional(),
+      externalService: z2.string().min(1).optional(),
+      version: z2.string().optional(),
+      title: z2.string().optional(),
+      description: z2.string().optional(),
       surfaces: apiSurfaceSchema,
-      credentials: z.object({ keyedBy: z.string().nullish() }).optional(),
-      docs: z.object({
-        url: z.string().min(1),
-        contentHash: z.string().min(1),
-        trimmed: z.object({ url: z.string().min(1), contentHash: z.string().min(1) }).optional(),
-        siteUrl: z.string().min(1).optional(),
-        audience: apiDocsSiteAudienceSchema.optional()
+      credentials: z2.object({ keyedBy: z2.string().nullish() }).optional(),
+      docs: z2.object({
+        url: z2.string().min(1),
+        contentHash: z2.string().min(1),
+        trimmed: z2.object({ url: z2.string().min(1), contentHash: z2.string().min(1) }).optional(),
+        siteUrl: z2.string().min(1).optional(),
+        audience: apiDocsSiteAudienceSchema.optional(),
+        source: z2.object({ url: z2.string().min(1), contentHash: z2.string().min(1) }).optional()
       }),
-      enabledOps: z.array(z.string()),
+      enabledOps: z2.array(z2.string()),
       // The consumer schema strips unknown keys, so a producer-side field that is
       // not mirrored here never reaches a consumer — mirror every addition.
-      status: z.object({ url: z.string().min(1) }).optional(),
-      actAs: z.object({ url: z.string().min(1) }).optional(),
-      appVersion: z.string().min(1).optional(),
+      status: z2.object({ url: z2.string().min(1) }).optional(),
+      actAs: z2.object({ url: z2.string().min(1), integrations: z2.array(z2.string().min(1)).optional() }).optional(),
+      appVersion: z2.string().min(1).optional(),
       rateLimits: rateLimitDefaultsSchema.optional(),
       health: integrationHealthSchema.optional(),
-      producedRateClasses: z.array(z.string().min(1)).optional()
+      producedRateClasses: z2.array(z2.string().min(1)).optional(),
+      sandbox: sandboxModeSchema.optional(),
+      events: z2.object({ entry: z2.string().min(1) }).optional()
     });
-    integrationStatusSchema = z.object({
-      contract: z.literal("v1"),
-      name: z.string().min(1),
-      provider: z.string().optional(),
-      type: z.string().optional(),
-      title: z.string().optional(),
-      definitionVersion: z.string().optional(),
-      packageVersion: z.string().min(1).optional(),
-      tenant: z.string().min(1),
-      instanceKey: z.string().optional(),
-      surfaces: z.array(z.enum(["http", "nexus"])),
-      coreMode: z.enum(["mock", "live"]),
-      coreModeSource: z.string().optional(),
-      enabledOps: z.array(z.string()),
-      credentialsWired: z.boolean(),
+    integrationStatusSchema = z2.object({
+      contract: z2.literal("v1"),
+      name: z2.string().min(1),
+      provider: z2.string().optional(),
+      type: z2.string().optional(),
+      title: z2.string().optional(),
+      definitionVersion: z2.string().optional(),
+      packageVersion: z2.string().min(1).optional(),
+      tenant: z2.string().min(1),
+      instanceKey: z2.string().optional(),
+      surfaces: z2.array(z2.enum(["http", "nexus"])),
+      coreMode: z2.enum(["mock", "live"]),
+      coreModeSource: z2.string().optional(),
+      enabledOps: z2.array(z2.string()),
+      credentialsWired: z2.boolean(),
       rateLimits: rateLimitDefaultsSchema.optional(),
       health: integrationHealthSchema.optional(),
-      startedAt: z.string().min(1)
+      startedAt: z2.string().min(1)
     });
-    hubActAsExportsSchema = z.object({
-      issuer: z.string().min(1),
-      keys: z.array(
-        z.object({
-          kid: z.string().min(1),
-          kty: z.literal("RSA"),
-          n: z.string().min(1),
-          e: z.string().min(1),
-          alg: z.string().optional(),
-          use: z.string().optional()
+    hubActAsExportsSchema = z2.object({
+      issuer: z2.string().min(1),
+      keys: z2.array(
+        z2.object({
+          kid: z2.string().min(1),
+          kty: z2.literal("RSA"),
+          n: z2.string().min(1),
+          e: z2.string().min(1),
+          alg: z2.string().optional(),
+          use: z2.string().optional()
         })
       ).min(1)
     });
   }
 });
 
+// packages/mesh-cli/src/commands/local/act-as-local.ts
+var init_act_as_local = __esm({
+  "packages/mesh-cli/src/commands/local/act-as-local.ts"() {
+    "use strict";
+    init_seed();
+  }
+});
+
 // packages/mesh-cli/src/commands/local/mock-idps.ts
 var init_mock_idps = __esm({
   "packages/mesh-cli/src/commands/local/mock-idps.ts"() {
@@ -643,6 +740,7 @@ var HUB_DEFAULT_REDIRECT_URI, HUB_ROLES, ZITADEL_SSM_PARAM, TEST_USERS_SSM_PREFI
 var init_seed_zitadel = __esm({
   "packages/mesh-cli/src/commands/local/seed-zitadel.ts"() {
     "use strict";
+    init_act_as_local();
     init_src();
     init_log();
     init_errors();
@@ -686,6 +784,34 @@ var init_dev_local = __esm({
   }
 });
 
+// packages/mesh-cli/src/commands/local/local-spicedb.ts
+var init_local_spicedb = __esm({
+  "packages/mesh-cli/src/commands/local/local-spicedb.ts"() {
+    "use strict";
+    init_seed();
+    init_aws_errors();
+    init_dev_local();
+  }
+});
+
+// packages/mesh-cli/src/commands/local/publish-docs.ts
+var init_publish_docs = __esm({
+  "packages/mesh-cli/src/commands/local/publish-docs.ts"() {
+    "use strict";
+    init_seed();
+    init_dev_local();
+    init_local_spicedb();
+  }
+});
+
+// packages/mesh-cli/src/commands/local/local-api-key.ts
+var init_local_api_key = __esm({
+  "packages/mesh-cli/src/commands/local/local-api-key.ts"() {
+    "use strict";
+    init_seed();
+  }
+});
+
 // packages/mesh-cli/src/commands/local/docker-runner.ts
 var init_docker_runner = __esm({
   "packages/mesh-cli/src/commands/local/docker-runner.ts"() {
@@ -748,6 +874,10 @@ var init_dev = __esm({
     init_dev_local();
     init_auth_provision();
     init_seed();
+    init_publish_docs();
+    init_act_as_local();
+    init_local_api_key();
+    init_seed_zitadel();
     init_mocks();
     init_dev_local();
     init_stack();