@mesh-tech/mesh-cli 0.38.0 → 0.39.0

package/dist/bin/{mesh.chunk-LMYPTJ2F.js → mesh.chunk-2ZJR5LGN.js}

@@ -14,6 +14,7 @@ import {
 } from "./mesh.chunk-2QIVBQX5.js";
 import {
   ARTIFACTS_BUCKET,
+  COMPOSE_PROJECT,
   DEFAULT_HUB_PORT,
   LOCAL_AWS_CONFIG,
   LOCAL_ENV,
@@ -48,13 +49,13 @@ import {
   isExpiredAwsTokenMessage,
   probeRegistryToken,
   registryLoginFix
-} from "./mesh.chunk-KN4BZOYH.js";
+} from "./mesh.chunk-OSV3EZQ3.js";
 
 // packages/mesh-cli/src/commands/login.ts
 import * as http from "http";
 import * as crypto3 from "crypto";
-import * as fs18 from "fs";
-import * as path19 from "path";
+import * as fs19 from "fs";
+import * as path20 from "path";
 import { execFileSync as execFileSync15 } from "child_process";
 
 // packages/mesh-cli/src/utils/aws-auth.ts
@@ -1193,10 +1194,10 @@ function unregisterDnsRecords(cfg, suffix) {
 import * as net7 from "node:net";
 
 // packages/mesh-cli/src/utils/tailscale.ts
-import * as fs17 from "node:fs";
+import * as fs18 from "node:fs";
 import * as net6 from "node:net";
 import * as os4 from "node:os";
-import * as path18 from "node:path";
+import * as path19 from "node:path";
 import { spawn as spawn2, execFileSync as execFileSync13 } from "node:child_process";
 
 // packages/mesh-cli/src/utils/pid.ts
@@ -1236,15 +1237,15 @@ function assertSignalablePid(pid, source) {
 
 // packages/mesh-cli/src/utils/tailscale-targets.ts
 import { execFileSync as execFileSync11 } from "node:child_process";
-import * as fs15 from "node:fs";
-import * as path16 from "node:path";
+import * as fs16 from "node:fs";
+import * as path17 from "node:path";
 
 // packages/mesh-cli/src/commands/dev.ts
-import { execFileSync as execFileSync10, spawn, spawnSync } from "child_process";
-import * as fs14 from "fs";
+import { execFileSync as execFileSync10, spawn, spawnSync as spawnSync2 } from "child_process";
+import * as fs15 from "fs";
 import * as net3 from "net";
 import * as os3 from "os";
-import * as path15 from "path";
+import * as path16 from "path";
 import { Option } from "commander";
 import { SecretsManagerClient as SecretsManagerClient2, GetSecretValueCommand as GetSecretValueCommand2 } from "@aws-sdk/client-secrets-manager";
 
@@ -3218,6 +3219,10 @@ async function reconcileRegistryFromZitadel() {
   }
   return { tenants, apps };
 }
+function isZitadelNoChanges(err) {
+  if (!(err instanceof Error)) return false;
+  return err.status === 400 && /No changes|COMMAND-1m88i/.test(err.message);
+}
 async function ensureSignInApp(args) {
   const pat = readSeederPat();
   const orgId = await ensureOrg(pat, args.tenant);
@@ -3244,13 +3249,17 @@ async function ensureSignInApp(args) {
   };
   const existing = await searchZitadelApp(pat, projectId, name, orgId);
   if (existing) {
-    await api(
-      pat,
-      "PUT",
-      `/management/v1/projects/${projectId}/apps/${existing.id}/oidc_config`,
-      config,
-      orgId
-    );
+    try {
+      await api(
+        pat,
+        "PUT",
+        `/management/v1/projects/${projectId}/apps/${existing.id}/oidc_config`,
+        config,
+        orgId
+      );
+    } catch (err) {
+      if (!isZitadelNoChanges(err)) throw err;
+    }
     return;
   }
   const created = await api(
@@ -3553,12 +3562,335 @@ async function ensureLocalPlatformRunning() {
   }
 }
 
-// packages/mesh-cli/src/commands/local/publish-docs.ts
+// packages/mesh-cli/src/commands/local/app-authz.ts
+import { spawnSync } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
-import * as fs11 from "node:fs";
-import * as path11 from "node:path";
-import { execFileSync as execFileSync6 } from "node:child_process";
+import { createRequire } from "node:module";
+import fs11 from "node:fs";
+import path11 from "node:path";
 import { pathToFileURL } from "node:url";
+var LOCAL_APP_SPICEDB_IMAGE = "authzed/spicedb:v1.42.1";
+var LOCAL_APP_SPICEDB_KEY = "local-dev-key";
+var LOCAL_APP_SPICEDB_LABEL = "mesh.local.app-spicedb";
+var LOCAL_STACK_NETWORK = `${COMPOSE_PROJECT}_mesh_network`;
+var STACK = "local";
+var GRPC_PORT_BASE = 50100;
+var HTTP_PORT_BASE = 18100;
+var PORT_SLOTS = 100;
+function readLocalAuthzConfig(appRoot) {
+  try {
+    const pkg = JSON.parse(fs11.readFileSync(path11.join(appRoot, "package.json"), "utf-8"));
+    const schema = pkg?.mesh?.authz?.schema;
+    if (typeof schema !== "string" || !schema.trim()) return null;
+    return { schema: schema.trim(), prebuilt: pkg?.mesh?.authz?.metadata !== void 0 };
+  } catch {
+    return null;
+  }
+}
+var slug = (name, sep3) => name.toLowerCase().replace(/[^a-z0-9]+/g, sep3).replace(new RegExp(`^\\${sep3}+|\\${sep3}+$`, "g"), "");
+function appSpiceDBSlot(app) {
+  return createHash2("sha256").update(app).digest().readUInt32BE(0) % PORT_SLOTS;
+}
+function appSpiceDBPorts(slot) {
+  const s = (slot % PORT_SLOTS + PORT_SLOTS) % PORT_SLOTS;
+  return { grpc: GRPC_PORT_BASE + s, http: HTTP_PORT_BASE + s };
+}
+var appSpiceDBContainerName = (app) => `mesh-local-spicedb-${slug(app, "-")}`;
+var appSpiceDBDatabase = (app) => `spicedb_${slug(app, "_")}`.slice(0, 63);
+var appSpiceDBSecretName = (tenant, env, app) => `mesh/${tenant}/${env}/${app}/spicedb/preshared-key`;
+var spicedbInstanceParam = (tenant, env, instanceId) => `/mesh-platform/${tenant}/${env}/authz/spicedb-instances/${instanceId}`;
+var appAuthzParam = (tenant, env, app) => `/mesh-platform/${tenant}/${env}/apps/${app}/stacks/${STACK}/authz`;
+function instanceRegistryValue(args) {
+  const secret = appSpiceDBSecretName(args.tenant, args.env, args.app);
+  return {
+    grpcEndpoint: `localhost:${args.grpcPort}`,
+    httpEndpoint: `localhost:${args.httpPort}`,
+    namespace: args.app,
+    presharedKeySecretName: secret,
+    configSecretName: secret,
+    owner: { kind: "app", name: args.app }
+  };
+}
+function buildAppAuthzPointer(args) {
+  const existingZitadel = args.existing.zitadel && typeof args.existing.zitadel === "object" ? args.existing.zitadel : {};
+  return {
+    ...args.existing,
+    spicedb: {
+      instanceRefs: args.mode === "policy-engine" && args.instanceId ? [{ instanceId: args.instanceId }] : []
+    },
+    ...args.zitadel || Object.keys(existingZitadel).length > 0 ? { zitadel: { ...existingZitadel, ...args.zitadel ?? {} } } : {},
+    opsHubMetadataRef: args.metadataRef,
+    mode: args.mode
+  };
+}
+function appSpiceDBEnv(args) {
+  return {
+    SPICEDB_ENDPOINT: `localhost:${args.grpcPort}`,
+    SPICEDB_HTTP_ENDPOINT: `http://localhost:${args.httpPort}`,
+    SPICEDB_PRESHARED_KEY: LOCAL_APP_SPICEDB_KEY,
+    SPICEDB_TOKEN: LOCAL_APP_SPICEDB_KEY,
+    AUTHZ_METADATA_SSM_PATH: args.metadataPath
+  };
+}
+var datastoreUri = (app) => `postgres://postgres:postgres@database:5432/${appSpiceDBDatabase(app)}?sslmode=disable`;
+function spicedbMigrateArgs(app) {
+  return [
+    "run",
+    "--rm",
+    "--network",
+    LOCAL_STACK_NETWORK,
+    "-e",
+    "SPICEDB_DATASTORE_ENGINE=postgres",
+    "-e",
+    `SPICEDB_DATASTORE_CONN_URI=${datastoreUri(app)}`,
+    LOCAL_APP_SPICEDB_IMAGE,
+    "datastore",
+    "migrate",
+    "head"
+  ];
+}
+function spicedbServeArgs(app, ports) {
+  return [
+    "run",
+    "-d",
+    "--name",
+    appSpiceDBContainerName(app),
+    "--label",
+    `${LOCAL_APP_SPICEDB_LABEL}=${app}`,
+    "--restart",
+    "unless-stopped",
+    "--network",
+    LOCAL_STACK_NETWORK,
+    "-p",
+    `127.0.0.1:${ports.grpc}:50051`,
+    "-p",
+    `127.0.0.1:${ports.http}:8443`,
+    "-e",
+    `SPICEDB_GRPC_PRESHARED_KEY=${LOCAL_APP_SPICEDB_KEY}`,
+    "-e",
+    "SPICEDB_DATASTORE_ENGINE=postgres",
+    "-e",
+    `SPICEDB_DATASTORE_CONN_URI=${datastoreUri(app)}`,
+    "-e",
+    "SPICEDB_HTTP_ENABLED=true",
+    // SpiceDB opens 30 datastore connections by default, and every app's
+    // instance shares the stack's Postgres (100 connections in all): a local
+    // app needs a handful.
+    "-e",
+    "SPICEDB_DATASTORE_CONN_POOL_READ_MAX_OPEN=4",
+    "-e",
+    "SPICEDB_DATASTORE_CONN_POOL_READ_MIN_OPEN=1",
+    "-e",
+    "SPICEDB_DATASTORE_CONN_POOL_WRITE_MAX_OPEN=2",
+    "-e",
+    "SPICEDB_DATASTORE_CONN_POOL_WRITE_MIN_OPEN=1",
+    LOCAL_APP_SPICEDB_IMAGE,
+    "serve"
+  ];
+}
+function parseDockerPort(output) {
+  const match = output.trim().split("\n")[0]?.match(/:(\d+)\s*$/);
+  return match ? Number(match[1]) : null;
+}
+var defaultDocker = (args) => {
+  const r = spawnSync("docker", args, { encoding: "utf-8" });
+  return { status: r.status, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+};
+var mustDocker = (docker2, args, what) => {
+  const r = docker2(args);
+  if (r.status !== 0) {
+    throw new MeshCliError(`${what} failed: ${(r.stderr || r.stdout).trim() || `docker exited ${r.status}`}`);
+  }
+  return r.stdout;
+};
+function ensureDatabase(docker2, app) {
+  const container = mustDocker(
+    docker2,
+    [
+      "ps",
+      "-q",
+      "--filter",
+      `label=com.docker.compose.project=${COMPOSE_PROJECT}`,
+      "--filter",
+      "label=com.docker.compose.service=database"
+    ],
+    "Finding the local Postgres"
+  ).trim().split("\n")[0];
+  if (!container) {
+    throw new MeshCliError("The local platform's Postgres is not running.", {
+      remediation: { command: "mesh start" }
+    });
+  }
+  const db = appSpiceDBDatabase(app);
+  const exists = mustDocker(
+    docker2,
+    ["exec", container, "psql", "-U", "postgres", "-tAc", `SELECT 1 FROM pg_database WHERE datname = '${db}'`],
+    `Checking database ${db}`
+  ).trim();
+  if (exists !== "1") {
+    mustDocker(docker2, ["exec", container, "psql", "-U", "postgres", "-c", `CREATE DATABASE "${db}"`], `Creating database ${db}`);
+  }
+}
+async function ensureLocalAppSpiceDB(app, deps = {}) {
+  const docker2 = deps.docker ?? defaultDocker;
+  const portFree = deps.portFree ?? (async (port) => !await probeTcp(port, { timeoutMs: 300 }));
+  const name = appSpiceDBContainerName(app);
+  const state = docker2(["inspect", "-f", "{{.State.Running}}", name]);
+  if (state.status === 0) {
+    if (state.stdout.trim() !== "true") mustDocker(docker2, ["start", name], `Starting ${name}`);
+    const grpcPort = parseDockerPort(mustDocker(docker2, ["port", name, "50051/tcp"], `Reading ${name}'s ports`));
+    const httpPort = parseDockerPort(mustDocker(docker2, ["port", name, "8443/tcp"], `Reading ${name}'s ports`));
+    if (grpcPort && httpPort) return { grpcPort, httpPort, created: false };
+    mustDocker(docker2, ["rm", "-f", name], `Removing ${name}`);
+  }
+  ensureDatabase(docker2, app);
+  mustDocker(docker2, spicedbMigrateArgs(app), `Migrating ${name}'s datastore`);
+  const first = appSpiceDBSlot(app);
+  for (let i = 0; i < PORT_SLOTS; i++) {
+    const ports = appSpiceDBPorts(first + i);
+    if (!await portFree(ports.grpc) || !await portFree(ports.http)) continue;
+    mustDocker(docker2, spicedbServeArgs(app, ports), `Starting ${name}`);
+    return { grpcPort: ports.grpc, httpPort: ports.http, created: true };
+  }
+  throw new MeshCliError(`No free port pair for ${name} in ${GRPC_PORT_BASE}-${GRPC_PORT_BASE + PORT_SLOTS - 1}.`);
+}
+async function writeSpiceDBSchema(httpUrl, zed, opts = {}) {
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const attempts = opts.attempts ?? 30;
+  let last = "";
+  for (let i = 0; i < attempts; i++) {
+    try {
+      const res = await fetchImpl(`${httpUrl}/v1/schema/write`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${LOCAL_APP_SPICEDB_KEY}`, "content-type": "application/json" },
+        body: JSON.stringify({ schema: zed })
+      });
+      if (res.ok) return;
+      last = `${res.status} ${await res.text()}`;
+      if (res.status >= 400 && res.status < 500) break;
+    } catch (err) {
+      last = err instanceof Error ? err.message : String(err);
+    }
+    await new Promise((r) => setTimeout(r, opts.delayMs ?? 500));
+  }
+  throw new MeshCliError(`SpiceDB at ${httpUrl} did not accept the app's schema: ${last}`);
+}
+function removeLocalAppSpiceDBs(docker2 = defaultDocker) {
+  const ids = docker2(["ps", "-aq", "--filter", `label=${LOCAL_APP_SPICEDB_LABEL}`]).stdout.trim().split("\n").filter(Boolean);
+  if (ids.length > 0) docker2(["rm", "-f", ...ids]);
+  return ids;
+}
+var tsxImporter = async (specifier, parentFile) => {
+  let api2;
+  try {
+    api2 = createRequire(parentFile).resolve("tsx/esm/api");
+  } catch {
+    throw new MeshCliError(
+      `Cannot load the app's authz schema: \`tsx\` is not installed in ${path11.dirname(parentFile)}. Add it to the app's devDependencies (\`pnpm add -D tsx\`).`
+    );
+  }
+  const { tsImport } = await import(pathToFileURL(api2).href);
+  return tsImport(specifier, pathToFileURL(parentFile).href);
+};
+var unwrapDefault = (mod) => {
+  const d = mod.default ?? mod.schema;
+  return d && typeof d === "object" && "default" in d && !("namespace" in d) ? d.default : d;
+};
+async function loadAppAuthz(appRoot, schemaRel, importer = tsxImporter) {
+  const file = path11.resolve(appRoot, schemaRel);
+  if (!fs11.existsSync(file)) {
+    throw new MeshCliError(`mesh.authz.schema names ${schemaRel}, which does not exist under ${appRoot}.`);
+  }
+  const schema = unwrapDefault(await importer(pathToFileURL(file).href, file));
+  if (!schema || typeof schema.namespace !== "string") {
+    throw new MeshCliError(`${schemaRel} must export the app's defineSchema(...) result as its default export.`);
+  }
+  const compilers = await importer("@mesh-tech/authz/compilers", file);
+  let chunk;
+  try {
+    const ssm = await importer("@mesh-tech/authz/metadata/ssm", file);
+    if (typeof ssm.chunkSsmValue === "function") chunk = ssm.chunkSsmValue;
+  } catch {
+  }
+  return { schema, compilers, chunk };
+}
+var localParamStore = async () => {
+  const { SSMClient: SSMClient2, GetParameterCommand: GetParameterCommand2, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient2(LOCAL_AWS_CONFIG);
+  return {
+    async get(name) {
+      try {
+        return (await ssm.send(new GetParameterCommand2({ Name: name }))).Parameter?.Value;
+      } catch {
+        return void 0;
+      }
+    },
+    async put(name, value) {
+      await ssm.send(new PutParameterCommand({ Name: name, Value: value, Type: "String", Tier: "Advanced", Overwrite: true }));
+    }
+  };
+};
+async function publishLocalAppAuthz(args, deps = {}) {
+  const env = LOCAL_ENV;
+  const { schema, compilers, chunk } = await loadAppAuthz(args.appRoot, args.schema, deps.importer);
+  const mode = schema.mode === "role-gating" ? "role-gating" : "policy-engine";
+  const params = deps.params ?? await localParamStore();
+  const base = appAuthzParam(args.tenant, env, args.app);
+  const metadataRef = `${base}/ops-hub-metadata`;
+  let instance;
+  if (mode === "policy-engine") {
+    const running = await (deps.ensureSpiceDB ?? ensureLocalAppSpiceDB)(args.app);
+    instance = { grpcPort: running.grpcPort, httpPort: running.httpPort };
+    await (deps.writeSchema ?? writeSpiceDBSchema)(
+      `http://localhost:${instance.httpPort}`,
+      compilers.compileSpiceDBSchema(schema).zed
+    );
+    await (deps.putSecret ?? upsertLocalSecret)(appSpiceDBSecretName(args.tenant, env, args.app), {
+      PRESHARED_KEY: LOCAL_APP_SPICEDB_KEY
+    });
+    await params.put(
+      spicedbInstanceParam(args.tenant, env, args.app),
+      JSON.stringify(instanceRegistryValue({ app: args.app, tenant: args.tenant, env, ...instance }))
+    );
+  }
+  const body = JSON.stringify(compilers.compileOpsHubMetadata(schema));
+  const split = chunk ? chunk(body) : { value: body, parts: [] };
+  for (const [i, part] of split.parts.entries()) await params.put(`${metadataRef}/part-${i}`, part);
+  await params.put(metadataRef, split.value);
+  let existing = {};
+  const raw = await params.get(base);
+  if (raw) {
+    try {
+      const parsed = JSON.parse(raw);
+      if (parsed && typeof parsed === "object") existing = parsed;
+    } catch {
+    }
+  }
+  await params.put(
+    base,
+    JSON.stringify(
+      buildAppAuthzPointer({
+        existing,
+        mode,
+        instanceId: instance ? args.app : void 0,
+        zitadel: args.zitadel,
+        metadataRef
+      })
+    )
+  );
+  return {
+    mode,
+    env: instance ? appSpiceDBEnv({ ...instance, metadataPath: `${base}/metadata` }) : {},
+    ...instance ? { instance } : {}
+  };
+}
+
+// packages/mesh-cli/src/commands/local/publish-docs.ts
+import { createHash as createHash3 } from "node:crypto";
+import * as fs12 from "node:fs";
+import * as path12 from "node:path";
+import { execFileSync as execFileSync6 } from "node:child_process";
+import { pathToFileURL as pathToFileURL2 } from "node:url";
 
 // packages/mesh-cli/src/commands/local/local-spicedb.ts
 var LOCAL_SPICEDB_INSTANCE_ID = "mesh-local";
@@ -3709,14 +4041,14 @@ function zedOf(value) {
   if (typeof zed !== "string" || !zed.trim()) throw new Error("the spicedbSchema export returned no zed schema");
   return zed;
 }
-async function spicedbHttp(path20, body) {
-  const res = await fetch(`${HOST_HTTP}${path20}`, {
+async function spicedbHttp(path21, body) {
+  const res = await fetch(`${HOST_HTTP}${path21}`, {
     method: "POST",
     headers: { Authorization: `Bearer ${LOCAL_SPICEDB_KEY}`, "Content-Type": "application/json" },
     body: JSON.stringify(body)
   });
   const parsed = await res.json().catch(() => ({}));
-  if (!res.ok) throw Object.assign(new Error(`SpiceDB ${path20}: ${res.status} ${parsed.message ?? ""}`.trim()), { status: res.status });
+  if (!res.ok) throw Object.assign(new Error(`SpiceDB ${path21}: ${res.status} ${parsed.message ?? ""}`.trim()), { status: res.status });
   return parsed;
 }
 async function readLocalSpicedbSchema() {
@@ -3853,7 +4185,7 @@ function readLocalPublishDeclaration(pkg, appRoot) {
     }
     if (typeof docs?.config === "string" && docs.config) {
       out.docs = {
-        config: path11.resolve(appRoot, docs.config),
+        config: path12.resolve(appRoot, docs.config),
         actAs: docs.actAs === true,
         ...sandbox?.success ? { sandbox: sandbox.data } : {},
         ...typeof docs.local === "string" && docs.local.includes("#") ? { local: docs.local } : {},
@@ -3883,10 +4215,10 @@ function readLocalPublishDeclaration(pkg, appRoot) {
 }
 async function callExport(appRoot, spec, arg) {
   const [modulePath, exportName] = spec.split("#");
-  const file = path11.resolve(appRoot, modulePath);
+  const file = path12.resolve(appRoot, modulePath);
   let mod;
   if (/\.m?js$/.test(file)) {
-    mod = await import(pathToFileURL(file).href);
+    mod = await import(pathToFileURL2(file).href);
   } else {
     let tsImport;
     try {
@@ -4062,12 +4394,12 @@ async function publishLocalDocs(input) {
     ...local.events ? { events: local.events } : {}
   });
   result.problems.push(...built.problems);
-  const config = parseDocsConfig(fs11.readFileSync(docs.config, "utf8"), docs.config);
+  const config = parseDocsConfig(fs12.readFileSync(docs.config, "utf8"), docs.config);
   const { S3Client, PutObjectCommand } = await import("@aws-sdk/client-s3");
   const s3 = new S3Client({ ...awsConfig, forcePathStyle: true });
   const specKey = `api-docs/${app}/openapi.json`;
   const sourceKey = docsSourceKey(app);
-  const specText = fs11.readFileSync(built.specPath, "utf8");
+  const specText = fs12.readFileSync(built.specPath, "utf8");
   await s3.send(new PutObjectCommand({ Bucket: ARTIFACTS_BUCKET, Key: specKey, Body: specText, ContentType: "application/json" }));
   await s3.send(new PutObjectCommand({ Bucket: ARTIFACTS_BUCKET, Key: sourceKey, Body: built.json, ContentType: "application/json" }));
   if (docs.actAs) {
@@ -4084,7 +4416,7 @@ async function publishLocalDocs(input) {
     ...config.description ? { description: config.description } : {},
     docs: {
       url: `s3://${ARTIFACTS_BUCKET}/${specKey}`,
-      contentHash: createHash2("sha256").update(specText).digest("hex"),
+      contentHash: createHash3("sha256").update(specText).digest("hex"),
       sourceUrl: `s3://${ARTIFACTS_BUCKET}/${sourceKey}`,
       sourceContentHash: built.contentHash
     },
@@ -4233,8 +4565,8 @@ async function ensureLocalApiKey(input) {
 
 // packages/mesh-cli/src/commands/local/docker-runner.ts
 import { execFileSync as execFileSync7 } from "child_process";
-import * as fs12 from "fs";
-import * as path12 from "path";
+import * as fs13 from "fs";
+import * as path13 from "path";
 var DEV_RUNNER_IMAGE = "node:22-bookworm@sha256:5647be709086c696ff32edaaf1c70cd26d1da6ab2b39c32f3c7b4c4a31957e37";
 function sessionDir(sessionName) {
   return meshCacheDir("mesh-local", "dev", sessionName);
@@ -4257,8 +4589,8 @@ function writeDevCompose(sessionName, appRoot, services) {
   ];
   for (const [name, service] of Object.entries(services)) {
     const env = service.env ?? {};
-    fs12.writeFileSync(path12.join(dir, `${name}.env`), renderDockerEnvFile(env), { mode: 384 });
-    const workdir = path12.posix.join("/workspace", service.src === "." ? "" : service.src);
+    fs13.writeFileSync(path13.join(dir, `${name}.env`), renderDockerEnvFile(env), { mode: 384 });
+    const workdir = path13.posix.join("/workspace", service.src === "." ? "" : service.src);
     const ship = env.OTEL_RESOURCE_ATTRIBUTES ? ` 2>&1 | NODE_OPTIONS= node /mesh-assets/log-shipper.mjs` : "";
     blocks.push(
       `  ${name}:`,
@@ -4267,7 +4599,7 @@ function writeDevCompose(sessionName, appRoot, services) {
       `    working_dir: ${workdir}`,
       `    volumes:`,
       `      - '${appRoot}:/workspace'`,
-      `      - '${path12.dirname(shipper)}:/mesh-assets:ro'`,
+      `      - '${path13.dirname(shipper)}:/mesh-assets:ro'`,
       `    environment:`,
       // node_modules is the HOST's bind-mounted install — pnpm inside the
       // container must never "verify" it and try a purge/reinstall (pnpm
@@ -4283,12 +4615,12 @@ function writeDevCompose(sessionName, appRoot, services) {
       `    restart: unless-stopped`
     );
   }
-  const composePath = path12.join(dir, "compose.yml");
-  fs12.writeFileSync(composePath, blocks.join("\n") + "\n");
+  const composePath = path13.join(dir, "compose.yml");
+  fs13.writeFileSync(composePath, blocks.join("\n") + "\n");
   return composePath;
 }
 function composeArgs(sessionName, args) {
-  return ["compose", "-p", sessionName, "-f", path12.join(sessionDir(sessionName), "compose.yml"), ...args];
+  return ["compose", "-p", sessionName, "-f", path13.join(sessionDir(sessionName), "compose.yml"), ...args];
 }
 function dockerDevUp(sessionName) {
   execFileSync7("docker", composeArgs(sessionName, ["up", "-d"]), {
@@ -4362,9 +4694,9 @@ function rewriteClusterHostsToLocal(devOutput) {
 
 // packages/mesh-cli/src/commands/dev-doctor.ts
 import { execFileSync as execFileSync8 } from "node:child_process";
-import * as fs13 from "node:fs";
+import * as fs14 from "node:fs";
 import * as net2 from "node:net";
-import * as path13 from "node:path";
+import * as path14 from "node:path";
 function aggregateStatus(results) {
   if (results.some((r) => r.status === "error")) return "error";
   if (results.some((r) => r.status === "warn")) return "warn";
@@ -4532,9 +4864,9 @@ function parsePortSquatter(lsofOut, psOut) {
   return { pid, command };
 }
 function sharesWorktreeRoot(serviceSrc, repoRoot) {
-  const src = path13.resolve(serviceSrc);
-  const root = path13.resolve(repoRoot);
-  return src === root || src.startsWith(root + path13.sep);
+  const src = path14.resolve(serviceSrc);
+  const root = path14.resolve(repoRoot);
+  return src === root || src.startsWith(root + path14.sep);
 }
 function classifyPortListener(listenerPid, sessionPids) {
   if (listenerPid === null) return "dead";
@@ -4690,14 +5022,14 @@ var configStalenessCheck = {
     if (!state) {
       return { status: "ok", summary: "no session \u2014 config read fresh at launch" };
     }
-    const configPath = path13.join(ctx.appRoot, `Pulumi.${ctx.stack}.yaml`);
-    if (!fs13.existsSync(configPath)) {
+    const configPath = path14.join(ctx.appRoot, `Pulumi.${ctx.stack}.yaml`);
+    if (!fs14.existsSync(configPath)) {
       return {
         status: "ok",
         summary: `no Pulumi.${ctx.stack}.yaml to compare`
       };
     }
-    const mtimeMs = fs13.statSync(configPath).mtimeMs;
+    const mtimeMs = fs14.statSync(configPath).mtimeMs;
     if (isConfigStale(mtimeMs, state.startedAt)) {
       return {
         status: "warn",
@@ -4888,7 +5220,7 @@ ${ICONS[status]} overall: ${status}`);
 // packages/mesh-cli/src/utils/worktree-identity.ts
 import { execFileSync as execFileSync9 } from "node:child_process";
 import * as crypto from "node:crypto";
-import * as path14 from "node:path";
+import * as path15 from "node:path";
 var NUM_PORT_BLOCKS = 64;
 var PORT_BLOCK_BASE = 4e4;
 var PORT_BLOCK_SIZE = 40;
@@ -4910,7 +5242,7 @@ function blockBasePort(block) {
 }
 function withAppScopedPortBlock(wt, appRoot) {
   if (wt.isPrimary) return wt;
-  const appHash = worktreeHash(`${wt.worktreeRoot}#${path14.resolve(appRoot)}`);
+  const appHash = worktreeHash(`${wt.worktreeRoot}#${path15.resolve(appRoot)}`);
   return { ...wt, portBlock: portBlockFor(appHash, false) };
 }
 var STACK_SLUG_MAX = 16;
@@ -4927,28 +5259,28 @@ function resolveWorktreeIdentity(cwd = process.cwd(), gitRunner = defaultGitRunn
   let worktreeRoot;
   let isPrimary = true;
   try {
-    worktreeRoot = path14.resolve(gitRunner(["rev-parse", "--show-toplevel"], cwd));
+    worktreeRoot = path15.resolve(gitRunner(["rev-parse", "--show-toplevel"], cwd));
     const commonDir = gitRunner(["rev-parse", "--git-common-dir"], cwd);
-    const primaryRoot = path14.resolve(path14.dirname(path14.resolve(cwd, commonDir)));
+    const primaryRoot = path15.resolve(path15.dirname(path15.resolve(cwd, commonDir)));
     isPrimary = worktreeRoot === primaryRoot;
   } catch {
     return {
-      worktreeRoot: path14.resolve(cwd),
+      worktreeRoot: path15.resolve(cwd),
       isPrimary: true,
-      slug: sanitizeSlug(path14.basename(path14.resolve(cwd))),
-      hash: worktreeHash(path14.resolve(cwd)),
+      slug: sanitizeSlug(path15.basename(path15.resolve(cwd))),
+      hash: worktreeHash(path15.resolve(cwd)),
       token: "",
       portBlock: 0,
       taskQueueSuffix: ""
     };
   }
-  const slug = sanitizeSlug(path14.basename(worktreeRoot));
+  const slug2 = sanitizeSlug(path15.basename(worktreeRoot));
   const hash = worktreeHash(worktreeRoot);
-  const token = isPrimary ? "" : `${slug}-${hash}`;
+  const token = isPrimary ? "" : `${slug2}-${hash}`;
   return {
     worktreeRoot,
     isPrimary,
-    slug,
+    slug: slug2,
     hash,
     token,
     portBlock: portBlockFor(hash, isPrimary),
@@ -5002,9 +5334,9 @@ mesh dev plan \u2014 ${kind}
     console.log(`    (none \u2014 all services are deployed/K8s)`);
   } else {
     const monorepoRoot = findMonorepoRoot();
-    const wtWithSep = wt.worktreeRoot.endsWith(path15.sep) ? wt.worktreeRoot : wt.worktreeRoot + path15.sep;
+    const wtWithSep = wt.worktreeRoot.endsWith(path16.sep) ? wt.worktreeRoot : wt.worktreeRoot + path16.sep;
     for (const [name, s] of locals) {
-      const dir = path15.resolve(appRoot, rebaseServiceSrc(s.src, monorepoRoot));
+      const dir = path16.resolve(appRoot, rebaseServiceSrc(s.src, monorepoRoot));
       const outside = dir !== wt.worktreeRoot && !dir.startsWith(wtWithSep);
       const port = s.port > 0 ? `:${s.port}` : "(no port)";
       console.log(`    ${name.padEnd(18)} ${port.padEnd(7)} ${dir}${outside ? "  \u26A0 OUTSIDE worktree" : ""}`);
@@ -5013,18 +5345,18 @@ mesh dev plan \u2014 ${kind}
   console.log("");
 }
 function getSessionStatePath(sessionName) {
-  const dir = path15.join(os3.tmpdir(), "mesh-dev-sessions");
-  if (!fs14.existsSync(dir)) fs14.mkdirSync(dir, { recursive: true });
-  return path15.join(dir, `${sessionName}.json`);
+  const dir = path16.join(os3.tmpdir(), "mesh-dev-sessions");
+  if (!fs15.existsSync(dir)) fs15.mkdirSync(dir, { recursive: true });
+  return path16.join(dir, `${sessionName}.json`);
 }
 function saveSessionState(sessionName, state) {
-  fs14.writeFileSync(getSessionStatePath(sessionName), JSON.stringify(state, null, 2));
+  fs15.writeFileSync(getSessionStatePath(sessionName), JSON.stringify(state, null, 2));
 }
 function loadSessionState(sessionName) {
   const filePath = getSessionStatePath(sessionName);
-  if (!fs14.existsSync(filePath)) return null;
+  if (!fs15.existsSync(filePath)) return null;
   try {
-    return JSON.parse(fs14.readFileSync(filePath, "utf-8"));
+    return JSON.parse(fs15.readFileSync(filePath, "utf-8"));
   } catch {
     return null;
   }
@@ -5048,18 +5380,18 @@ function workflowChangeWouldStrand(priorState, appRoot, force) {
   return true;
 }
 function getSessionEnvDir(sessionName) {
-  return path15.join(os3.tmpdir(), "mesh-dev-sessions", sessionName);
+  return path16.join(os3.tmpdir(), "mesh-dev-sessions", sessionName);
 }
 function getServiceEnvFilePath(sessionName, serviceName) {
-  return path15.join(getSessionEnvDir(sessionName), envFileName(serviceName));
+  return path16.join(getSessionEnvDir(sessionName), envFileName(serviceName));
 }
 function removeSessionState(sessionName) {
   try {
-    fs14.unlinkSync(getSessionStatePath(sessionName));
+    fs15.unlinkSync(getSessionStatePath(sessionName));
   } catch {
   }
   try {
-    fs14.rmSync(getSessionEnvDir(sessionName), { recursive: true, force: true });
+    fs15.rmSync(getSessionEnvDir(sessionName), { recursive: true, force: true });
   } catch {
   }
 }
@@ -5187,16 +5519,16 @@ function mergePinnedPorts(fresh, pinned) {
 }
 function findMonorepoRoot() {
   let dir = process.cwd();
-  const root = path15.parse(dir).root;
+  const root = path16.parse(dir).root;
   while (dir !== root) {
-    if (fs14.existsSync(path15.join(dir, "pnpm-workspace.yaml")) || fs14.existsSync(path15.join(dir, "turbo.json"))) {
+    if (fs15.existsSync(path16.join(dir, "pnpm-workspace.yaml")) || fs15.existsSync(path16.join(dir, "turbo.json"))) {
       return dir;
     }
-    const gitPath = path15.join(dir, ".git");
-    if (fs14.existsSync(gitPath)) {
+    const gitPath = path16.join(dir, ".git");
+    if (fs15.existsSync(gitPath)) {
       return dir;
     }
-    dir = path15.dirname(dir);
+    dir = path16.dirname(dir);
   }
   return null;
 }
@@ -5204,40 +5536,40 @@ function discoverApps(monorepoRoot) {
   const apps = [];
   function addApp(appDir, tenant) {
     const projectName = getProjectName(appDir);
-    const stacks = fs14.readdirSync(appDir).filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml").map((f) => f.replace(/^Pulumi\./, "").replace(/\.yaml$/, ""));
+    const stacks = fs15.readdirSync(appDir).filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml").map((f) => f.replace(/^Pulumi\./, "").replace(/\.yaml$/, ""));
     apps.push({
       name: projectName,
       tenant,
       appPath: appDir,
-      relativePath: path15.relative(monorepoRoot, appDir),
+      relativePath: path16.relative(monorepoRoot, appDir),
       stacks
     });
   }
   const searchDirs = ["tenants", "tests/tenants"];
   for (const searchDir of searchDirs) {
-    const base = path15.join(monorepoRoot, searchDir);
-    if (!fs14.existsSync(base)) continue;
-    for (const tenant of fs14.readdirSync(base)) {
-      const appsDir = path15.join(base, tenant, "apps");
-      if (!fs14.existsSync(appsDir) || !fs14.statSync(appsDir).isDirectory()) continue;
-      for (const app of fs14.readdirSync(appsDir)) {
-        const appDir = path15.join(appsDir, app);
-        if (!fs14.existsSync(path15.join(appDir, "Pulumi.yaml"))) continue;
+    const base = path16.join(monorepoRoot, searchDir);
+    if (!fs15.existsSync(base)) continue;
+    for (const tenant of fs15.readdirSync(base)) {
+      const appsDir = path16.join(base, tenant, "apps");
+      if (!fs15.existsSync(appsDir) || !fs15.statSync(appsDir).isDirectory()) continue;
+      for (const app of fs15.readdirSync(appsDir)) {
+        const appDir = path16.join(appsDir, app);
+        if (!fs15.existsSync(path16.join(appDir, "Pulumi.yaml"))) continue;
         addApp(appDir, tenant);
       }
     }
   }
-  const flatAppsDir = path15.join(monorepoRoot, "apps");
-  if (fs14.existsSync(flatAppsDir) && fs14.statSync(flatAppsDir).isDirectory()) {
-    for (const app of fs14.readdirSync(flatAppsDir)) {
-      const appDir = path15.join(flatAppsDir, app);
-      if (!fs14.statSync(appDir).isDirectory()) continue;
-      if (!fs14.existsSync(path15.join(appDir, "Pulumi.yaml"))) continue;
+  const flatAppsDir = path16.join(monorepoRoot, "apps");
+  if (fs15.existsSync(flatAppsDir) && fs15.statSync(flatAppsDir).isDirectory()) {
+    for (const app of fs15.readdirSync(flatAppsDir)) {
+      const appDir = path16.join(flatAppsDir, app);
+      if (!fs15.statSync(appDir).isDirectory()) continue;
+      if (!fs15.existsSync(path16.join(appDir, "Pulumi.yaml"))) continue;
       let tenant = "unknown";
-      const stackConfigs = fs14.readdirSync(appDir).filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml");
+      const stackConfigs = fs15.readdirSync(appDir).filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml");
       if (stackConfigs.length > 0) {
         try {
-          const content = fs14.readFileSync(path15.join(appDir, stackConfigs[0]), "utf-8");
+          const content = fs15.readFileSync(path16.join(appDir, stackConfigs[0]), "utf-8");
           const tenantMatch = content.match(/mesh:tenant:\s*(\S+)/);
           if (tenantMatch) tenant = tenantMatch[1];
         } catch {
@@ -5250,32 +5582,32 @@ function discoverApps(monorepoRoot) {
 }
 function findAppRoot2(appPath) {
   if (appPath) {
-    const resolved = path15.resolve(appPath);
-    if (fs14.existsSync(path15.join(resolved, "Pulumi.yaml"))) return resolved;
+    const resolved = path16.resolve(appPath);
+    if (fs15.existsSync(path16.join(resolved, "Pulumi.yaml"))) return resolved;
     const mono = findMonorepoRoot();
     if (mono) {
-      const fromMono = path15.resolve(mono, appPath);
-      if (fs14.existsSync(path15.join(fromMono, "Pulumi.yaml"))) return fromMono;
+      const fromMono = path16.resolve(mono, appPath);
+      if (fs15.existsSync(path16.join(fromMono, "Pulumi.yaml"))) return fromMono;
     }
     logError(`No Pulumi.yaml found at: ${appPath}`);
     process.exit(1);
   }
   let dir = process.cwd();
-  const root = path15.parse(dir).root;
+  const root = path16.parse(dir).root;
   while (dir !== root) {
-    if (fs14.existsSync(path15.join(dir, "Pulumi.yaml"))) {
+    if (fs15.existsSync(path16.join(dir, "Pulumi.yaml"))) {
       return dir;
     }
-    dir = path15.dirname(dir);
+    dir = path16.dirname(dir);
   }
   return process.cwd();
 }
 function getProjectName(appRoot) {
-  const yamlPath = path15.join(appRoot, "Pulumi.yaml");
-  if (!fs14.existsSync(yamlPath)) return path15.basename(appRoot);
-  const content = fs14.readFileSync(yamlPath, "utf-8");
+  const yamlPath = path16.join(appRoot, "Pulumi.yaml");
+  if (!fs15.existsSync(yamlPath)) return path16.basename(appRoot);
+  const content = fs15.readFileSync(yamlPath, "utf-8");
   const match = content.match(/^name:\s*(.+)$/m);
-  return match?.[1]?.trim() ?? path15.basename(appRoot);
+  return match?.[1]?.trim() ?? path16.basename(appRoot);
 }
 function detectStack(appRoot, stageArg) {
   if (stageArg) return stageArg;
@@ -5290,7 +5622,7 @@ function detectStack(appRoot, stageArg) {
   } catch {
   }
   try {
-    const files = fs14.readdirSync(appRoot).filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml");
+    const files = fs15.readdirSync(appRoot).filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml");
     if (files.length === 1) {
       const match = files[0].match(/^Pulumi\.(.+)\.yaml$/);
       if (match?.[1]) {
@@ -5411,9 +5743,9 @@ function buildChildAwsEnv(awsEnv, method, profile, opts) {
   if (method === "zitadel" && opts) {
     const sanitizedContext = opts.context.replace(/[^A-Za-z0-9_-]/g, "-");
     const profileName = `mesh-dev-${sanitizedContext}`;
-    const configPath = path15.join(opts.sessionScratchDir, "aws-config");
+    const configPath = path16.join(opts.sessionScratchDir, "aws-config");
     const region = awsEnv.AWS_REGION ?? awsEnv.AWS_DEFAULT_REGION ?? "";
-    fs14.mkdirSync(opts.sessionScratchDir, { recursive: true });
+    fs15.mkdirSync(opts.sessionScratchDir, { recursive: true });
     const profileBlock = renderCredentialProcessProfile({
       profileName,
       context: opts.context,
@@ -5421,7 +5753,7 @@ function buildChildAwsEnv(awsEnv, method, profile, opts) {
       region,
       meshBin: opts.meshBin
     });
-    const existing = fs14.existsSync(configPath) ? fs14.readFileSync(configPath, "utf8") : "";
+    const existing = fs15.existsSync(configPath) ? fs15.readFileSync(configPath, "utf8") : "";
     const next = upsertManagedAwsConfigSection(
       stripBareProfile(existing, profileName),
       `${opts.context} (mesh dev)`,
@@ -5446,7 +5778,7 @@ function buildChildAwsEnv(awsEnv, method, profile, opts) {
 function readDotEnvFile(file) {
   let text;
   try {
-    text = fs14.readFileSync(file, "utf-8");
+    text = fs15.readFileSync(file, "utf-8");
   } catch {
     return {};
   }
@@ -5479,15 +5811,15 @@ function rebaseServiceSrc(src, monorepoRoot) {
   if (src === "." || src === "./") return src;
   const rel = monorepoRelativeSrc(src);
   if (rel === null) return src;
-  const rebased = path15.join(monorepoRoot, rel);
-  return fs14.existsSync(rebased) ? rebased : src;
+  const rebased = path16.join(monorepoRoot, rel);
+  return fs15.existsSync(rebased) ? rebased : src;
 }
 function isLinkedDependencyDir(serviceDir, appRoot) {
   let pkgRoot = null;
   let name = "";
-  for (let dir = serviceDir; ; dir = path15.dirname(dir)) {
+  for (let dir = serviceDir; ; dir = path16.dirname(dir)) {
     try {
-      const manifest = JSON.parse(fs14.readFileSync(path15.join(dir, "package.json"), "utf8"));
+      const manifest = JSON.parse(fs15.readFileSync(path16.join(dir, "package.json"), "utf8"));
       if (typeof manifest?.name === "string" && manifest.name) {
         pkgRoot = dir;
         name = manifest.name;
@@ -5495,21 +5827,21 @@ function isLinkedDependencyDir(serviceDir, appRoot) {
       }
     } catch {
     }
-    const parent = path15.dirname(dir);
+    const parent = path16.dirname(dir);
     if (parent === dir) break;
   }
   if (!pkgRoot) return false;
-  for (let dir = appRoot; ; dir = path15.dirname(dir)) {
+  for (let dir = appRoot; ; dir = path16.dirname(dir)) {
     try {
-      if (fs14.realpathSync(path15.join(dir, "node_modules", name)) === pkgRoot) return true;
+      if (fs15.realpathSync(path16.join(dir, "node_modules", name)) === pkgRoot) return true;
     } catch {
     }
-    const parent = path15.dirname(dir);
+    const parent = path16.dirname(dir);
     if (parent === dir) return false;
   }
 }
 function monorepoRelativeSrc(src) {
-  if (!path15.isAbsolute(src)) return src.replace(/^\.\//, "") || ".";
+  if (!path16.isAbsolute(src)) return src.replace(/^\.\//, "") || ".";
   const m = src.match(/^.*\/mesh-platform(?:\/(.*))?$/);
   if (!m) return null;
   const rest = (m[1] ?? "").replace(/^\.worktrees\/[^/]+(?:\/|$)/, "");
@@ -5621,7 +5953,7 @@ async function resolveTemporalAuthVars(sessionName, devOutput) {
     setTmuxEnv(sessionName, { KUBECONFIG: kubeconfigPath });
   } else if (!process.env.KUBECONFIG) {
     const existing = sessionKubeconfigPath(sessionName);
-    if (fs14.existsSync(existing)) {
+    if (fs15.existsSync(existing)) {
       process.env.KUBECONFIG = existing;
     }
   }
@@ -5909,7 +6241,7 @@ async function startSsmTunnels(sessionName, devOutput) {
   return rewritten;
 }
 async function updateDevboxProxy(devOutput, appRoot) {
-  const appName = devOutput.app ?? path15.basename(appRoot);
+  const appName = devOutput.app ?? path16.basename(appRoot);
   const tenant = devOutput.platform?.tenant ?? "mesh";
   const env = devOutput.platform?.env ?? "dev";
   const stack = devOutput.stack ?? "dev";
@@ -5987,7 +6319,7 @@ CADDYEOF`
 async function setupSubdomainRouting(devOutput, appRoot) {
   const tsInfo = await getTailscaleInfo();
   if (!tsInfo) return null;
-  const appName = devOutput.app ?? path15.basename(appRoot);
+  const appName = devOutput.app ?? path16.basename(appRoot);
   const stack = devOutput.stack ?? "dev";
   const baseDomain = `${appName}.${stack}.${tsInfo.hostname}.vpn.internal`;
   const platform = devOutput.platform ?? { tenant: "mesh", env: "dev" };
@@ -6006,8 +6338,8 @@ async function setupSubdomainRouting(devOutput, appRoot) {
   } catch {
   }
   const caddyDir = "/tmp/mesh-dev-caddy";
-  const caddyfile = path15.join(caddyDir, "Caddyfile");
-  if (!fs14.existsSync(caddyDir)) fs14.mkdirSync(caddyDir, { recursive: true });
+  const caddyfile = path16.join(caddyDir, "Caddyfile");
+  if (!fs15.existsSync(caddyDir)) fs15.mkdirSync(caddyDir, { recursive: true });
   const caddyLines = [`# mesh-dev: ${appName}/${stack} (${tsInfo.hostname})`, ""];
   for (const [name, service] of Object.entries(devOutput.services)) {
     if (service.port) {
@@ -6025,7 +6357,7 @@ async function setupSubdomainRouting(devOutput, appRoot) {
     caddyLines.push("}");
     caddyLines.push("");
   }
-  fs14.writeFileSync(caddyfile, caddyLines.join("\n"));
+  fs15.writeFileSync(caddyfile, caddyLines.join("\n"));
   let caddyRunning = false;
   try {
     execFileSync10("pgrep", ["-f", "caddy run.*mesh-dev-caddy"], { stdio: "pipe" });
@@ -6225,9 +6557,9 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
       logInfo(`Skipped: ${name} (no dev command, deployed to K8s)`);
       continue;
     }
-    const serviceDir = path15.resolve(appRoot, rebaseServiceSrc(service.src, monorepoRoot));
-    if (worktreeRoot && fs14.existsSync(serviceDir)) {
-      const wtRootWithSep = worktreeRoot.endsWith(path15.sep) ? worktreeRoot : worktreeRoot + path15.sep;
+    const serviceDir = path16.resolve(appRoot, rebaseServiceSrc(service.src, monorepoRoot));
+    if (worktreeRoot && fs15.existsSync(serviceDir)) {
+      const wtRootWithSep = worktreeRoot.endsWith(path16.sep) ? worktreeRoot : worktreeRoot + path16.sep;
       const outside = serviceDir !== worktreeRoot && !serviceDir.startsWith(wtRootWithSep);
       if (outside && isLinkedDependencyDir(serviceDir, appRoot)) {
         logInfo(`${name}: source is a dev-linked package (${serviceDir})`);
@@ -6238,7 +6570,7 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
         process.exit(1);
       }
     }
-    if (!fs14.existsSync(serviceDir)) {
+    if (!fs15.existsSync(serviceDir)) {
       logWarn(
         `Skipped: ${name} (source directory not found: ${serviceDir}${serviceDir !== service.src ? ` \u2014 rebased from ${service.src}` : ""})`
       );
@@ -6328,9 +6660,9 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
   if (!headless) {
     logInfo("Attaching to tmux session...");
     if (process.env.TMUX) {
-      spawnSync("tmux", ["switch-client", "-t", sessionName], { stdio: "inherit" });
+      spawnSync2("tmux", ["switch-client", "-t", sessionName], { stdio: "inherit" });
     } else {
-      spawnSync("tmux", ["attach", "-t", sessionName], { stdio: "inherit" });
+      spawnSync2("tmux", ["attach", "-t", sessionName], { stdio: "inherit" });
     }
   } else {
     console.log(`Attach with:  tmux attach -t ${sessionName}`);
@@ -6481,8 +6813,8 @@ async function restartService(sessionName, serviceName, appRoot, devOutput, awsE
   const cmd = service.command.join(" ");
   const envFilePath = getServiceEnvFilePath(sessionName, serviceName);
   let restartCmd;
-  if (fs14.existsSync(envFilePath)) {
-    const serviceDir = path15.resolve(appRoot, rebaseServiceSrc(service.src, findMonorepoRoot()));
+  if (fs15.existsSync(envFilePath)) {
+    const serviceDir = path16.resolve(appRoot, rebaseServiceSrc(service.src, findMonorepoRoot()));
     restartCmd = buildLaunchCommand(
       envFilePath,
       serviceDir,
@@ -6562,7 +6894,7 @@ function registerDevCommand(program) {
     "tmux"
   );
   dev.command("__token-server <port> <context>", { hidden: true }).action(async (port, context) => {
-    const { startTokenServer } = await import("./mesh.dev-token-server-YP2VBP2S.js");
+    const { startTokenServer } = await import("./mesh.dev-token-server-SS7QEQOQ.js");
     await startTokenServer(Number(port), context);
   });
   dev.action(async (options) => {
@@ -6740,7 +7072,7 @@ function registerDevCommand(program) {
         signInServices = [];
         try {
           const appPkg = JSON.parse(
-            fs14.readFileSync(path15.join(appRoot, "package.json"), "utf-8")
+            fs15.readFileSync(path16.join(appRoot, "package.json"), "utf-8")
           );
           if (Array.isArray(appPkg?.mesh?.auth?.roles)) {
             authRoles = appPkg.mesh.auth.roles.filter((r) => typeof r === "string");
@@ -6761,6 +7093,37 @@ function registerDevCommand(program) {
           `Auth auto-provisioning skipped: ${err instanceof Error ? err.message : err} \u2014 if the local Zitadel predates seeding, run: mesh stop --destroy && mesh start`
         );
       }
+      const authzConfig = readLocalAuthzConfig(appRoot);
+      if (authzConfig?.prebuilt) {
+        logWarn(
+          `package.json declares both mesh.authz.schema and mesh.authz.metadata \u2014 both publish this app's authorization. Using mesh.authz.metadata; remove one of them.`
+        );
+      } else if (authzConfig) {
+        const app = rawDevOutput2.app ?? projectName;
+        try {
+          const published = await publishLocalAppAuthz({
+            appRoot,
+            schema: authzConfig.schema,
+            tenant: localTenant,
+            app,
+            ...provisioned ? { zitadel: { projectId: provisioned.projectId, orgId: provisioned.orgId } } : {}
+          });
+          for (const [name, svc] of Object.entries(rawDevOutput2.services)) {
+            if (name.startsWith("mock-")) continue;
+            svc.env = {
+              ...svc.env ?? {},
+              ...Object.fromEntries(Object.entries(published.env).map(([k, value]) => [k, { value }]))
+            };
+          }
+          logSuccess(
+            published.instance ? `Authz (${published.mode}) published for '${app}' \u2014 its SpiceDB on localhost:${published.instance.grpcPort} (HTTP ${published.instance.httpPort})` : `Authz (${published.mode}) published for '${app}'`
+          );
+        } catch (err) {
+          logWarn(
+            `Could not publish '${app}'s authorization (${err instanceof Error ? err.message : err}) \u2014 the Hub cannot author its roles, and a policy-engine app denies every check.`
+          );
+        }
+      }
       const devOutput2 = await allocatePorts(rawDevOutput2, worktree);
       for (const service of signInServices) {
         const port = devOutput2.services[service]?.port;
@@ -6805,7 +7168,7 @@ function registerDevCommand(program) {
       }
       let localDocs;
       try {
-        const appPkg = JSON.parse(fs14.readFileSync(path15.join(appRoot, "package.json"), "utf-8"));
+        const appPkg = JSON.parse(fs15.readFileSync(path16.join(appRoot, "package.json"), "utf-8"));
         const declaration = readLocalPublishDeclaration(appPkg, appRoot);
         if (declaration.docs || declaration.authzMetadata || declaration.problems.length > 0) {
           const app = devOutput2.app ?? projectName;
@@ -6815,10 +7178,10 @@ function registerDevCommand(program) {
           if (!httpService || !service?.port) {
             logWarn(`mesh.docs names service '${httpService ?? ""}', which this app does not run \u2014 docs not published.`);
           } else {
-            const serviceDir = path15.resolve(appRoot, service.src);
+            const serviceDir = path16.resolve(appRoot, service.src);
             const env = service.env ?? (service.env = {});
             const serviceEnv = {
-              ...readDotEnvFile(path15.join(serviceDir, ".env")),
+              ...readDotEnvFile(path16.join(serviceDir, ".env")),
               ...Object.fromEntries(Object.entries(process.env).filter((e) => typeof e[1] === "string")),
               ...Object.fromEntries(Object.entries(env).map(([k, v]) => [k, v.value]))
             };
@@ -7007,9 +7370,9 @@ function registerDevCommand(program) {
     logInfo(`Project: ${projectName}, Stack: ${stack}`);
     const monorepoRoot = findMonorepoRoot();
     const looksLikeStandaloneApp = ["api", "worker", "web"].some(
-      (dir) => fs14.existsSync(path15.join(appRoot, dir, "package.json"))
+      (dir) => fs15.existsSync(path16.join(appRoot, dir, "package.json"))
     );
-    if (monorepoRoot && path15.resolve(appRoot) === path15.resolve(monorepoRoot) && !looksLikeStandaloneApp) {
+    if (monorepoRoot && path16.resolve(appRoot) === path16.resolve(monorepoRoot) && !looksLikeStandaloneApp) {
       logError(`mesh dev should be run from an app directory, not the monorepo root.
 `);
       logInfo("Try:");
@@ -7441,17 +7804,17 @@ function registerDevCommand(program) {
 // packages/mesh-cli/src/utils/tailscale-targets.ts
 var PORT_BLOCK = 3e3;
 function tenantPortIndex(tenant, registryPath) {
-  const p = registryPath ?? path16.join(CONFIG_DIR, "tailscale", "port-registry.json");
+  const p = registryPath ?? path17.join(CONFIG_DIR, "tailscale", "port-registry.json");
   let reg;
   try {
-    reg = JSON.parse(fs15.readFileSync(p, "utf8"));
+    reg = JSON.parse(fs16.readFileSync(p, "utf8"));
   } catch {
     reg = { mesh: 0 };
   }
   if (tenant in reg) return reg[tenant];
   const idx = Math.max(-1, ...Object.values(reg)) + 1;
   reg[tenant] = idx;
-  fs15.mkdirSync(path16.dirname(p), { recursive: true });
+  fs16.mkdirSync(path17.dirname(p), { recursive: true });
   atomicWriteFileSync(p, JSON.stringify(reg, null, 2), 384);
   return idx;
 }
@@ -7563,29 +7926,29 @@ function createForwarder(opts) {
 
 // packages/mesh-cli/src/utils/tunnel-ownership.ts
 import * as crypto2 from "node:crypto";
-import * as fs16 from "node:fs";
+import * as fs17 from "node:fs";
 import * as net5 from "node:net";
-import * as path17 from "node:path";
+import * as path18 from "node:path";
 import { execFileSync as execFileSync12 } from "node:child_process";
 function mintRunnerToken() {
   return crypto2.randomBytes(16).toString("hex");
 }
 function readRunnerManifest(file) {
-  if (!fs16.existsSync(file)) return null;
+  if (!fs17.existsSync(file)) return null;
   try {
-    return JSON.parse(fs16.readFileSync(file, "utf8"));
+    return JSON.parse(fs17.readFileSync(file, "utf8"));
   } catch {
     return null;
   }
 }
 function writeRunnerManifest(file, manifest) {
-  fs16.mkdirSync(path17.dirname(file), { recursive: true });
-  fs16.writeFileSync(file, JSON.stringify(manifest, null, 2), { mode: 384 });
+  fs17.mkdirSync(path18.dirname(file), { recursive: true });
+  fs17.writeFileSync(file, JSON.stringify(manifest, null, 2), { mode: 384 });
 }
 function clearRunnerManifest(file, token) {
   if (token !== void 0 && readRunnerManifest(file)?.token !== token) return;
   try {
-    fs16.unlinkSync(file);
+    fs17.unlinkSync(file);
   } catch {
   }
 }
@@ -7751,58 +8114,58 @@ function buildSquatterError(tenant, squatted, detail) {
 // packages/mesh-cli/src/utils/tailscale.ts
 var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 function tenantStateDir(tenant) {
-  return path18.join(CONFIG_DIR, "tailscale", tenant);
+  return path19.join(CONFIG_DIR, "tailscale", tenant);
 }
 function socketPath(tenant) {
-  return path18.join(tenantStateDir(tenant), "tailscaled.sock");
+  return path19.join(tenantStateDir(tenant), "tailscaled.sock");
 }
 function logPath(tenant) {
-  return path18.join(tenantStateDir(tenant), "tailscaled.log");
+  return path19.join(tenantStateDir(tenant), "tailscaled.log");
 }
 function statePath(tenant) {
-  return path18.join(tenantStateDir(tenant), "tunnel-state.json");
+  return path19.join(tenantStateDir(tenant), "tunnel-state.json");
 }
 function daemonMetaPath(tenant) {
-  return path18.join(tenantStateDir(tenant), "daemon.json");
+  return path19.join(tenantStateDir(tenant), "daemon.json");
 }
 function runnerManifestPath(tenant) {
-  return path18.join(tenantStateDir(tenant), "runner.json");
+  return path19.join(tenantStateDir(tenant), "runner.json");
 }
 function readTunnelState(tenant) {
   const p = statePath(tenant);
-  if (!fs17.existsSync(p)) return null;
+  if (!fs18.existsSync(p)) return null;
   try {
-    return JSON.parse(fs17.readFileSync(p, "utf8"));
+    return JSON.parse(fs18.readFileSync(p, "utf8"));
   } catch {
     return null;
   }
 }
 function writeTunnelState(tenant, state) {
-  fs17.mkdirSync(tenantStateDir(tenant), { recursive: true });
+  fs18.mkdirSync(tenantStateDir(tenant), { recursive: true });
   atomicWriteFileSync(statePath(tenant), JSON.stringify(state, null, 2), 384);
 }
 function clearTunnelState(tenant) {
   try {
-    fs17.unlinkSync(statePath(tenant));
+    fs18.unlinkSync(statePath(tenant));
   } catch {
   }
 }
 function readDaemonMeta(tenant) {
   const p = daemonMetaPath(tenant);
-  if (!fs17.existsSync(p)) return null;
+  if (!fs18.existsSync(p)) return null;
   try {
-    return JSON.parse(fs17.readFileSync(p, "utf8"));
+    return JSON.parse(fs18.readFileSync(p, "utf8"));
   } catch {
     return null;
   }
 }
 function writeDaemonMeta(tenant, meta) {
-  fs17.mkdirSync(tenantStateDir(tenant), { recursive: true });
+  fs18.mkdirSync(tenantStateDir(tenant), { recursive: true });
   atomicWriteFileSync(daemonMetaPath(tenant), JSON.stringify(meta, null, 2), 384);
 }
 function clearDaemonMeta(tenant) {
   try {
-    fs17.unlinkSync(daemonMetaPath(tenant));
+    fs18.unlinkSync(daemonMetaPath(tenant));
   } catch {
   }
 }
@@ -7822,7 +8185,7 @@ function tailscaleBinPath() {
 }
 function resolveBrewBin(name) {
   const brew = `/opt/homebrew/bin/${name}`;
-  if (fs17.existsSync(brew)) return brew;
+  if (fs18.existsSync(brew)) return brew;
   try {
     const p = execFileSync13("which", [name], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
     if (p) return p;
@@ -7831,7 +8194,7 @@ function resolveBrewBin(name) {
   throw new Error(`${name} not found \u2014 install the standalone binary: brew install tailscale`);
 }
 function daemonState(tenant) {
-  if (!fs17.existsSync(socketPath(tenant))) return { backendState: "Down" };
+  if (!fs18.existsSync(socketPath(tenant))) return { backendState: "Down" };
   try {
     const out = execFileSync13(
       tailscaleBinPath(),
@@ -7905,8 +8268,8 @@ async function ensureDaemon(tenant, opts) {
     }
   }
   const dir = tenantStateDir(tenant);
-  fs17.mkdirSync(dir, { recursive: true });
-  const log = fs17.openSync(logPath(tenant), "a");
+  fs18.mkdirSync(dir, { recursive: true });
+  const log = fs18.openSync(logPath(tenant), "a");
   try {
     const child = spawn2(
       tailscaledBinPath(),
@@ -7926,7 +8289,7 @@ async function ensureDaemon(tenant, opts) {
     child.unref();
     if (child.pid) writeDaemonMeta(tenant, { socksPort: opts.socksPort, pid: child.pid });
   } finally {
-    fs17.closeSync(log);
+    fs18.closeSync(log);
   }
   for (let i = 0; i < 40; i++) {
     await sleep(250);
@@ -7952,7 +8315,7 @@ function stopDaemon(tenant) {
   }
   for (const p of [socketPath(tenant)]) {
     try {
-      fs17.unlinkSync(p);
+      fs18.unlinkSync(p);
     } catch {
     }
   }
@@ -8097,7 +8460,7 @@ async function assertTunnelPortsFree(tenant, ports) {
 async function ensureForwarders(state) {
   const prior = readTunnelState(state.tenant);
   const expected = { socksPort: state.socksPort, ports: state.tunnels.map((t) => t.localPort) };
-  const runnerAlive = prior?.managed === "launchd" ? fs17.existsSync(launchAgentPath(state.tenant)) : pidAlive(prior?.supervisorPid);
+  const runnerAlive = prior?.managed === "launchd" ? fs18.existsSync(launchAgentPath(state.tenant)) : pidAlive(prior?.supervisorPid);
   if (prior && runnerAlive && tunnelTargetsEqual(prior.tunnels, state.tunnels) && // A prior supervisor spawned for a DIFFERENT SOCKS port still binds the same
   // local ports but dials a dead upstream — reusing it silently strands every
   // tunnel. The port must match, and the runner must PROVE it is
@@ -8122,7 +8485,7 @@ async function ensureForwarders(state) {
   if (launchdAvailable()) {
     state.managed = "launchd";
     writeTunnelState(state.tenant, state);
-    if (path18.isAbsolute(meshBin) && installLaunchAgent(state.tenant, meshBin)) {
+    if (path19.isAbsolute(meshBin) && installLaunchAgent(state.tenant, meshBin)) {
       if ((await awaitOwnership(state.tenant, expected, 8e3)).ok) return 0;
       uninstallLaunchAgent(state.tenant);
       await assertTunnelPortsFree(state.tenant, expected.ports);
@@ -8250,7 +8613,7 @@ function forwardersNeedingRebind(targets, listening) {
   return targets.filter((t) => !listening.has(t.localPort));
 }
 function launchAgentPath(tenant) {
-  return path18.join(os4.homedir(), "Library", "LaunchAgents", `${launchAgentLabel(tenant)}.plist`);
+  return path19.join(os4.homedir(), "Library", "LaunchAgents", `${launchAgentLabel(tenant)}.plist`);
 }
 function guiDomain() {
   return `gui/${process.getuid?.() ?? 0}`;
@@ -8272,22 +8635,22 @@ function installLaunchAgent(tenant, meshBin) {
   try {
     let realMeshBin = meshBin;
     try {
-      realMeshBin = fs17.realpathSync(meshBin);
+      realMeshBin = fs18.realpathSync(meshBin);
     } catch {
     }
     let pathEnv = "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin";
     try {
-      pathEnv = `${path18.dirname(tailscaledBinPath())}:${pathEnv}`;
+      pathEnv = `${path19.dirname(tailscaledBinPath())}:${pathEnv}`;
     } catch {
     }
-    fs17.mkdirSync(path18.dirname(plistPath), { recursive: true });
-    fs17.writeFileSync(
+    fs18.mkdirSync(path19.dirname(plistPath), { recursive: true });
+    fs18.writeFileSync(
       plistPath,
       renderLaunchAgentPlist({
         tenant,
         meshBin: realMeshBin,
         nodeBin: process.execPath,
-        logPath: path18.join(tenantStateDir(tenant), "runner.log"),
+        logPath: path19.join(tenantStateDir(tenant), "runner.log"),
         pathEnv
       })
     );
@@ -8308,7 +8671,7 @@ function uninstallLaunchAgent(tenant) {
   } catch {
   }
   try {
-    fs17.unlinkSync(plistPath);
+    fs18.unlinkSync(plistPath);
   } catch {
   }
 }
@@ -8948,12 +9311,12 @@ function registerVpnCommands(program) {
 }
 
 // packages/mesh-cli/src/commands/login.ts
-var CONFIG_DIR = path19.join(
-  process.env.XDG_CONFIG_HOME ?? path19.join(process.env.HOME ?? "~", ".config"),
+var CONFIG_DIR = path20.join(
+  process.env.XDG_CONFIG_HOME ?? path20.join(process.env.HOME ?? "~", ".config"),
   "mesh"
 );
-var CONFIG_FILE = path19.join(CONFIG_DIR, "config.json");
-var CREDENTIALS_FILE = path19.join(CONFIG_DIR, "credentials.json");
+var CONFIG_FILE = path20.join(CONFIG_DIR, "config.json");
+var CREDENTIALS_FILE = path20.join(CONFIG_DIR, "credentials.json");
 var REDIRECT_PORT = 9876;
 var REDIRECT_URI = `http://localhost:${REDIRECT_PORT}/callback`;
 var BASE_SCOPES = "openid email profile offline_access urn:zitadel:iam:org:project:id:zitadel:aud";
@@ -8969,9 +9332,9 @@ function withDiscoveredFields(config, data) {
   return out;
 }
 function readConfig() {
-  if (!fs18.existsSync(CONFIG_FILE)) return {};
+  if (!fs19.existsSync(CONFIG_FILE)) return {};
   try {
-    return JSON.parse(fs18.readFileSync(CONFIG_FILE, "utf-8"));
+    return JSON.parse(fs19.readFileSync(CONFIG_FILE, "utf-8"));
   } catch {
     return {};
   }
@@ -8979,15 +9342,15 @@ function readConfig() {
 function writeContextConfig(context, config) {
   const existing = readConfig();
   existing[context] = config;
-  fs18.mkdirSync(CONFIG_DIR, { recursive: true });
-  fs18.writeFileSync(CONFIG_FILE, JSON.stringify(existing, null, 2));
+  fs19.mkdirSync(CONFIG_DIR, { recursive: true });
+  fs19.writeFileSync(CONFIG_FILE, JSON.stringify(existing, null, 2));
 }
 function clearContextConfig(context) {
   const existing = readConfig();
   if (!(context in existing)) return;
   delete existing[context];
-  fs18.mkdirSync(CONFIG_DIR, { recursive: true });
-  fs18.writeFileSync(CONFIG_FILE, JSON.stringify(existing, null, 2));
+  fs19.mkdirSync(CONFIG_DIR, { recursive: true });
+  fs19.writeFileSync(CONFIG_FILE, JSON.stringify(existing, null, 2));
 }
 function getContextConfig(context) {
   const config = readConfig();
@@ -9094,9 +9457,9 @@ function discoverConfigFromWellKnown(domain, contextKey = domain, opts = {}) {
   return discoverConfig(domain, contextKey, opts);
 }
 function readAllCredentials() {
-  if (!fs18.existsSync(CREDENTIALS_FILE)) return {};
+  if (!fs19.existsSync(CREDENTIALS_FILE)) return {};
   try {
-    return JSON.parse(fs18.readFileSync(CREDENTIALS_FILE, "utf-8"));
+    return JSON.parse(fs19.readFileSync(CREDENTIALS_FILE, "utf-8"));
   } catch {
     return {};
   }
@@ -9105,21 +9468,21 @@ function readCredentials(context) {
   return readAllCredentials()[context] ?? null;
 }
 var atomicWriteCounter = 0;
-function atomicWriteFileSync(path20, data, mode) {
-  const tmpPath = `${path20}.${process.pid}.${atomicWriteCounter++}.tmp`;
+function atomicWriteFileSync(path21, data, mode) {
+  const tmpPath = `${path21}.${process.pid}.${atomicWriteCounter++}.tmp`;
   try {
-    fs18.writeFileSync(tmpPath, data, { mode });
-    fs18.renameSync(tmpPath, path20);
+    fs19.writeFileSync(tmpPath, data, { mode });
+    fs19.renameSync(tmpPath, path21);
   } catch (err) {
     try {
-      fs18.unlinkSync(tmpPath);
+      fs19.unlinkSync(tmpPath);
     } catch {
     }
     throw err;
   }
 }
 function writeCredentials(context, creds) {
-  fs18.mkdirSync(CONFIG_DIR, { recursive: true });
+  fs19.mkdirSync(CONFIG_DIR, { recursive: true });
   const all = readAllCredentials();
   all[context] = creds;
   atomicWriteFileSync(CREDENTIALS_FILE, JSON.stringify(all, null, 2), 384);
@@ -9127,8 +9490,8 @@ function writeCredentials(context, creds) {
 function clearCredentials(context) {
   const all = readAllCredentials();
   delete all[context];
-  fs18.mkdirSync(CONFIG_DIR, { recursive: true });
-  fs18.writeFileSync(CREDENTIALS_FILE, JSON.stringify(all, null, 2), {
+  fs19.mkdirSync(CONFIG_DIR, { recursive: true });
+  fs19.writeFileSync(CREDENTIALS_FILE, JSON.stringify(all, null, 2), {
     mode: 384
   });
 }
@@ -9398,7 +9761,7 @@ function loginTimeoutMessage(context) {
 }
 function isRemoteEnvironment() {
   if (process.env.REMOTE_CONTAINERS || process.env.CODESPACES) return true;
-  if (fs18.existsSync("/.dockerenv")) return true;
+  if (fs19.existsSync("/.dockerenv")) return true;
   if (process.env.SSH_CLIENT || process.env.SSH_TTY) return true;
   if (!process.stdout.isTTY || !process.stdin.isTTY) return true;
   return false;
@@ -9652,9 +10015,9 @@ function refuseReservedRegistryContext(context, verb) {
 }
 async function hintRegistryIfMissing() {
   try {
-    const { readRegistrySession } = await import("./mesh.registry-identity-JW4KO7N7.js");
+    const { readRegistrySession } = await import("./mesh.registry-identity-ONGUJQAY.js");
     if (readRegistrySession()) return;
-    const { probeRegistryToken: probeRegistryToken2 } = await import("./mesh.auth-preflight-AQJ5TQES.js");
+    const { probeRegistryToken: probeRegistryToken2 } = await import("./mesh.auth-preflight-JO5G7SOF.js");
     const probe = await probeRegistryToken2();
     if (probe.state === "missing" || probe.state === "expired") {
       logInfo(REGISTRY_SEPARATE_HINT);
@@ -9786,12 +10149,12 @@ export AWS_REGION=${shellSingleQuote(args.region)}
 `;
 }
 function resolveUserAwsConfigPath(env = process.env) {
-  return env.AWS_CONFIG_FILE ?? path19.join(env.HOME ?? "~", ".aws", "config");
+  return env.AWS_CONFIG_FILE ?? path20.join(env.HOME ?? "~", ".aws", "config");
 }
 function canWriteDir(dir) {
   try {
-    fs18.mkdirSync(dir, { recursive: true });
-    fs18.accessSync(dir, fs18.constants.W_OK);
+    fs19.mkdirSync(dir, { recursive: true });
+    fs19.accessSync(dir, fs19.constants.W_OK);
     return true;
   } catch {
     return false;
@@ -9799,9 +10162,9 @@ function canWriteDir(dir) {
 }
 function resolveAwsConfigTarget(env = process.env) {
   if (env.AWS_CONFIG_FILE) return { configPath: env.AWS_CONFIG_FILE, redirected: false };
-  const real = path19.join(env.HOME ?? "~", ".aws", "config");
-  if (canWriteDir(path19.dirname(real))) return { configPath: real, redirected: false };
-  return { configPath: path19.join(CONFIG_DIR, "aws-config"), redirected: true };
+  const real = path20.join(env.HOME ?? "~", ".aws", "config");
+  if (canWriteDir(path20.dirname(real))) return { configPath: real, redirected: false };
+  return { configPath: path20.join(CONFIG_DIR, "aws-config"), redirected: true };
 }
 function resolveRoleOrExplain(opts, config) {
   const role = opts.role ?? process.env.MESH_AWS_ROLE ?? config.defaultRole;
@@ -9933,10 +10296,10 @@ async function exportAwsCredentials(context, config, opts) {
   const sanitized = context.replace(/[^A-Za-z0-9_-]/g, "-");
   const profileName = `mesh-${sanitized}`;
   const { configPath, redirected } = resolveAwsConfigTarget();
-  fs18.mkdirSync(path19.dirname(configPath), { recursive: true });
-  const existedBefore = fs18.existsSync(configPath);
-  const existing = existedBefore ? fs18.readFileSync(configPath, "utf-8") : "";
-  const mode = existedBefore ? fs18.statSync(configPath).mode & 511 : 384;
+  fs19.mkdirSync(path20.dirname(configPath), { recursive: true });
+  const existedBefore = fs19.existsSync(configPath);
+  const existing = existedBefore ? fs19.readFileSync(configPath, "utf-8") : "";
+  const mode = existedBefore ? fs19.statSync(configPath).mode & 511 : 384;
   atomicWriteFileSync(
     configPath,
     upsertManagedAwsConfigSection(
@@ -10077,6 +10440,7 @@ export {
   seedMockIdps,
   reconcileRegistryFromZitadel,
   detectLocalTenant,
+  removeLocalAppSpiceDBs,
   removeAllAliasContainers,
   resolveStackOption,
   worktreeStackName,