@mesh-tech/mesh-cli 0.38.1 → 0.40.0

package/dist/src/commands/hub/index.js

@@ -1,15 +1,15 @@
 import { execFileSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as net from "node:net";
-import * as os from "node:os";
 import * as path from "node:path";
 import chalk from "chalk";
-import { buildLaunchCommand, waitForPort, writeEnvFile } from "../dev-launch.js";
+import { buildLaunchCommand, pickLaunchHostEnv, waitForPort, writeEnvFile } from "../dev-launch.js";
 import { tunnelClientAddress } from "../dev.js";
 import { MeshCliError } from "../../utils/errors.js";
 import { DEFAULT_HUB_PORT } from "../local/stack.js";
 import { logInfo, logSuccess, logWarn } from "../../utils/log.js";
 import { findAppRoot } from "../../utils/pulumi.js";
+import { devSessionsRoot } from "../../utils/dev-sessions-root.js";
 export const HUB_SESSION_PREFIX = "mesh-hub-dev";
 export function hubSessionName(apiPort) {
     return `${HUB_SESSION_PREFIX}-${apiPort}`;
@@ -44,7 +44,7 @@ export function killInstructions(targets) {
 export const DEFAULT_HUB_UI_PORT = Number(DEFAULT_HUB_PORT);
 export const DEFAULT_HUB_API_PORT = 3002;
 export function devSessionsDir() {
-    return path.join(os.tmpdir(), "mesh-dev-sessions");
+    return devSessionsRoot();
 }
 export function listDevSessions(dir = devSessionsDir()) {
     if (!fs.existsSync(dir))
@@ -279,7 +279,7 @@ function isPortListening(port) {
     });
 }
 function hubEnvDir(sessionName) {
-    return path.join(os.tmpdir(), "mesh-dev-sessions", sessionName);
+    return path.join(devSessionsRoot(), sessionName);
 }
 export function parsePort(raw, fallback, source) {
     if (raw === undefined)
@@ -375,6 +375,7 @@ async function hubDevAction(opts) {
     const apiDir = path.join(platformDir, "apps", "hub", "api");
     const uiDir = path.join(platformDir, "apps", "hub", "ui");
     execFileSync("tmux", ["new-session", "-d", "-s", hubSession, "-n", "api", "-c", apiDir]);
+    const hostEnv = pickLaunchHostEnv(process.env);
     if (!assembled.apiEnv.DEV_USER_TOKEN_URL && assembled.apiEnv.DEV_USER_ID_TOKEN) {
         const platform = session.state.devOutput.platform;
         const credContext = `mesh.${platform.env}`;
@@ -384,11 +385,13 @@ async function hubDevAction(opts) {
         execFileSync("tmux", ["set-option", "-t", `${hubSession}:token-server`, "remain-on-exit", "on"], {
             stdio: "ignore",
         });
+        const tokenServerEnvFile = path.join(hubEnvDir(hubSession), "token-server.env.sh");
+        writeEnvFile(tokenServerEnvFile, hostEnv);
         execFileSync("tmux", [
             "send-keys",
             "-t",
             `${hubSession}:token-server`,
-            `npx mesh dev __token-server ${tokenPort} ${credContext}`,
+            buildLaunchCommand(tokenServerEnvFile, platformDir, `npx mesh dev __token-server ${tokenPort} ${credContext}`, undefined, hostEnv),
             "Enter",
         ]);
         for (let i = 0; i < 15 && !(await isPortListening(tokenPort)); i++) {
@@ -400,14 +403,14 @@ async function hubDevAction(opts) {
     }
     const launch = (window, dir, env, cmd, createWindow) => {
         const envFile = path.join(hubEnvDir(hubSession), `${window}.env.sh`);
-        writeEnvFile(envFile, env);
+        writeEnvFile(envFile, { ...hostEnv, ...env });
         if (createWindow) {
             execFileSync("tmux", ["new-window", "-t", hubSession, "-n", window, "-c", dir]);
         }
         execFileSync("tmux", ["set-option", "-t", `${hubSession}:${window}`, "remain-on-exit", "on"], {
             stdio: "ignore",
         });
-        execFileSync("tmux", ["send-keys", "-t", `${hubSession}:${window}`, buildLaunchCommand(envFile, dir, cmd), "Enter"]);
+        execFileSync("tmux", ["send-keys", "-t", `${hubSession}:${window}`, buildLaunchCommand(envFile, dir, cmd, undefined, hostEnv), "Enter"]);
     };
     launch("api", apiDir, assembled.apiEnv, "pnpm dev", false);
     launch("ui", uiDir, assembled.uiEnv, `pnpm dev --port ${uiPort} --strictPort`, true);

package/dist/src/commands/local/app-authz.d.ts

@@ -0,0 +1,118 @@
+export declare const LOCAL_APP_SPICEDB_IMAGE = "authzed/spicedb:v1.42.1";
+export declare const LOCAL_APP_SPICEDB_KEY = "local-dev-key";
+export declare const LOCAL_APP_SPICEDB_LABEL = "mesh.local.app-spicedb";
+export declare const LOCAL_STACK_NETWORK = "mesh-local_mesh_network";
+export type AuthzMode = "policy-engine" | "role-gating";
+export declare function readLocalAuthzConfig(appRoot: string): {
+    schema: string;
+    prebuilt: boolean;
+} | null;
+export declare function appSpiceDBSlot(app: string): number;
+export declare function appSpiceDBPorts(slot: number): {
+    grpc: number;
+    http: number;
+};
+export declare const appSpiceDBContainerName: (app: string) => string;
+export declare const appSpiceDBDatabase: (app: string) => string;
+export declare const appSpiceDBSecretName: (tenant: string, env: string, app: string) => string;
+export declare const spicedbInstanceParam: (tenant: string, env: string, instanceId: string) => string;
+export declare const appAuthzParam: (tenant: string, env: string, app: string) => string;
+export declare function instanceRegistryValue(args: {
+    app: string;
+    tenant: string;
+    env: string;
+    grpcPort: number;
+    httpPort: number;
+}): Record<string, unknown>;
+export declare function buildAppAuthzPointer(args: {
+    existing: Record<string, unknown>;
+    mode: AuthzMode;
+    instanceId?: string;
+    zitadel?: {
+        projectId: string;
+        orgId: string;
+    };
+    metadataRef: string;
+}): Record<string, unknown>;
+export declare function appSpiceDBEnv(args: {
+    grpcPort: number;
+    httpPort: number;
+    metadataPath: string;
+}): Record<string, string>;
+export declare function spicedbMigrateArgs(app: string): string[];
+export declare function spicedbServeArgs(app: string, ports: {
+    grpc: number;
+    http: number;
+}): string[];
+export declare function parseDockerPort(output: string): number | null;
+export type DockerResult = {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+};
+export type DockerRunner = (args: string[]) => DockerResult;
+export declare const defaultDocker: DockerRunner;
+export declare function ensureLocalAppSpiceDB(app: string, deps?: {
+    docker?: DockerRunner;
+    portFree?: (port: number) => Promise<boolean>;
+}): Promise<{
+    grpcPort: number;
+    httpPort: number;
+    created: boolean;
+}>;
+export declare function writeSpiceDBSchema(httpUrl: string, zed: string, opts?: {
+    fetchImpl?: typeof fetch;
+    attempts?: number;
+    delayMs?: number;
+}): Promise<void>;
+export declare function removeLocalAppSpiceDBs(docker?: DockerRunner): string[];
+export type ModuleImporter = (specifier: string, parentFile: string) => Promise<Record<string, any>>;
+export declare const tsxImporter: ModuleImporter;
+export type AppSchema = {
+    namespace: string;
+    mode?: AuthzMode;
+} & Record<string, unknown>;
+type Compilers = {
+    compileOpsHubMetadata: (schema: AppSchema) => unknown;
+    compileSpiceDBSchema: (schema: AppSchema) => {
+        zed: string;
+    };
+};
+export declare function loadAppAuthz(appRoot: string, schemaRel: string, importer?: ModuleImporter): Promise<{
+    schema: AppSchema;
+    compilers: Compilers;
+    chunk?: (body: string) => {
+        value: string;
+        parts: readonly string[];
+    };
+}>;
+export type ParamStore = {
+    get(name: string): Promise<string | undefined>;
+    put(name: string, value: string): Promise<void>;
+};
+export declare const localParamStore: () => Promise<ParamStore>;
+export type PublishLocalAppAuthzDeps = {
+    importer?: ModuleImporter;
+    params?: ParamStore;
+    putSecret?: (name: string, value: Record<string, string>) => Promise<void>;
+    ensureSpiceDB?: typeof ensureLocalAppSpiceDB;
+    writeSchema?: typeof writeSpiceDBSchema;
+};
+export declare function publishLocalAppAuthz(args: {
+    appRoot: string;
+    schema: string;
+    tenant: string;
+    app: string;
+    zitadel?: {
+        projectId: string;
+        orgId: string;
+    };
+}, deps?: PublishLocalAppAuthzDeps): Promise<{
+    mode: AuthzMode;
+    env: Record<string, string>;
+    instance?: {
+        grpcPort: number;
+        httpPort: number;
+    };
+}>;
+export {};

package/dist/src/commands/local/app-authz.js

@@ -0,0 +1,295 @@
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { createRequire } from "node:module";
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { MeshCliError } from "../../utils/errors.js";
+import { upsertLocalSecret, probeTcp } from "./helpers.js";
+import { LOCAL_AWS_CONFIG, LOCAL_ENV } from "./seed.js";
+import { COMPOSE_PROJECT } from "./stack.js";
+export const LOCAL_APP_SPICEDB_IMAGE = "authzed/spicedb:v1.42.1";
+export const LOCAL_APP_SPICEDB_KEY = "local-dev-key";
+export const LOCAL_APP_SPICEDB_LABEL = "mesh.local.app-spicedb";
+export const LOCAL_STACK_NETWORK = `${COMPOSE_PROJECT}_mesh_network`;
+const STACK = "local";
+const GRPC_PORT_BASE = 50100;
+const HTTP_PORT_BASE = 18100;
+const PORT_SLOTS = 100;
+export function readLocalAuthzConfig(appRoot) {
+    try {
+        const pkg = JSON.parse(fs.readFileSync(path.join(appRoot, "package.json"), "utf-8"));
+        const schema = pkg?.mesh?.authz?.schema;
+        if (typeof schema !== "string" || !schema.trim())
+            return null;
+        return { schema: schema.trim(), prebuilt: pkg?.mesh?.authz?.metadata !== undefined };
+    }
+    catch {
+        return null;
+    }
+}
+const slug = (name, sep) => name.toLowerCase().replace(/[^a-z0-9]+/g, sep).replace(new RegExp(`^\\${sep}+|\\${sep}+$`, "g"), "");
+export function appSpiceDBSlot(app) {
+    return createHash("sha256").update(app).digest().readUInt32BE(0) % PORT_SLOTS;
+}
+export function appSpiceDBPorts(slot) {
+    const s = ((slot % PORT_SLOTS) + PORT_SLOTS) % PORT_SLOTS;
+    return { grpc: GRPC_PORT_BASE + s, http: HTTP_PORT_BASE + s };
+}
+export const appSpiceDBContainerName = (app) => `mesh-local-spicedb-${slug(app, "-")}`;
+export const appSpiceDBDatabase = (app) => `spicedb_${slug(app, "_")}`.slice(0, 63);
+export const appSpiceDBSecretName = (tenant, env, app) => `mesh/${tenant}/${env}/${app}/spicedb/preshared-key`;
+export const spicedbInstanceParam = (tenant, env, instanceId) => `/mesh-platform/${tenant}/${env}/authz/spicedb-instances/${instanceId}`;
+export const appAuthzParam = (tenant, env, app) => `/mesh-platform/${tenant}/${env}/apps/${app}/stacks/${STACK}/authz`;
+export function instanceRegistryValue(args) {
+    const secret = appSpiceDBSecretName(args.tenant, args.env, args.app);
+    return {
+        grpcEndpoint: `localhost:${args.grpcPort}`,
+        httpEndpoint: `localhost:${args.httpPort}`,
+        namespace: args.app,
+        presharedKeySecretName: secret,
+        configSecretName: secret,
+        owner: { kind: "app", name: args.app },
+    };
+}
+export function buildAppAuthzPointer(args) {
+    const existingZitadel = args.existing.zitadel && typeof args.existing.zitadel === "object"
+        ? args.existing.zitadel
+        : {};
+    return {
+        ...args.existing,
+        spicedb: {
+            instanceRefs: args.mode === "policy-engine" && args.instanceId ? [{ instanceId: args.instanceId }] : [],
+        },
+        ...(args.zitadel || Object.keys(existingZitadel).length > 0
+            ? { zitadel: { ...existingZitadel, ...(args.zitadel ?? {}) } }
+            : {}),
+        opsHubMetadataRef: args.metadataRef,
+        mode: args.mode,
+    };
+}
+export function appSpiceDBEnv(args) {
+    return {
+        SPICEDB_ENDPOINT: `localhost:${args.grpcPort}`,
+        SPICEDB_HTTP_ENDPOINT: `http://localhost:${args.httpPort}`,
+        SPICEDB_PRESHARED_KEY: LOCAL_APP_SPICEDB_KEY,
+        SPICEDB_TOKEN: LOCAL_APP_SPICEDB_KEY,
+        AUTHZ_METADATA_SSM_PATH: args.metadataPath,
+    };
+}
+const datastoreUri = (app) => `postgres://postgres:postgres@database:5432/${appSpiceDBDatabase(app)}?sslmode=disable`;
+export function spicedbMigrateArgs(app) {
+    return [
+        "run", "--rm", "--network", LOCAL_STACK_NETWORK,
+        "-e", "SPICEDB_DATASTORE_ENGINE=postgres",
+        "-e", `SPICEDB_DATASTORE_CONN_URI=${datastoreUri(app)}`,
+        LOCAL_APP_SPICEDB_IMAGE, "datastore", "migrate", "head",
+    ];
+}
+export function spicedbServeArgs(app, ports) {
+    return [
+        "run", "-d",
+        "--name", appSpiceDBContainerName(app),
+        "--label", `${LOCAL_APP_SPICEDB_LABEL}=${app}`,
+        "--restart", "unless-stopped",
+        "--network", LOCAL_STACK_NETWORK,
+        "-p", `127.0.0.1:${ports.grpc}:50051`,
+        "-p", `127.0.0.1:${ports.http}:8443`,
+        "-e", `SPICEDB_GRPC_PRESHARED_KEY=${LOCAL_APP_SPICEDB_KEY}`,
+        "-e", "SPICEDB_DATASTORE_ENGINE=postgres",
+        "-e", `SPICEDB_DATASTORE_CONN_URI=${datastoreUri(app)}`,
+        "-e", "SPICEDB_HTTP_ENABLED=true",
+        "-e", "SPICEDB_DATASTORE_CONN_POOL_READ_MAX_OPEN=4",
+        "-e", "SPICEDB_DATASTORE_CONN_POOL_READ_MIN_OPEN=1",
+        "-e", "SPICEDB_DATASTORE_CONN_POOL_WRITE_MAX_OPEN=2",
+        "-e", "SPICEDB_DATASTORE_CONN_POOL_WRITE_MIN_OPEN=1",
+        LOCAL_APP_SPICEDB_IMAGE, "serve",
+    ];
+}
+export function parseDockerPort(output) {
+    const match = output.trim().split("\n")[0]?.match(/:(\d+)\s*$/);
+    return match ? Number(match[1]) : null;
+}
+export const defaultDocker = (args) => {
+    const r = spawnSync("docker", args, { encoding: "utf-8" });
+    return { status: r.status, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+};
+const mustDocker = (docker, args, what) => {
+    const r = docker(args);
+    if (r.status !== 0) {
+        throw new MeshCliError(`${what} failed: ${(r.stderr || r.stdout).trim() || `docker exited ${r.status}`}`);
+    }
+    return r.stdout;
+};
+function ensureDatabase(docker, app) {
+    const container = mustDocker(docker, [
+        "ps", "-q",
+        "--filter", `label=com.docker.compose.project=${COMPOSE_PROJECT}`,
+        "--filter", "label=com.docker.compose.service=database",
+    ], "Finding the local Postgres").trim().split("\n")[0];
+    if (!container) {
+        throw new MeshCliError("The local platform's Postgres is not running.", {
+            remediation: { command: "mesh start" },
+        });
+    }
+    const db = appSpiceDBDatabase(app);
+    const exists = mustDocker(docker, ["exec", container, "psql", "-U", "postgres", "-tAc", `SELECT 1 FROM pg_database WHERE datname = '${db}'`], `Checking database ${db}`).trim();
+    if (exists !== "1") {
+        mustDocker(docker, ["exec", container, "psql", "-U", "postgres", "-c", `CREATE DATABASE "${db}"`], `Creating database ${db}`);
+    }
+}
+export async function ensureLocalAppSpiceDB(app, deps = {}) {
+    const docker = deps.docker ?? defaultDocker;
+    const portFree = deps.portFree ?? (async (port) => !(await probeTcp(port, { timeoutMs: 300 })));
+    const name = appSpiceDBContainerName(app);
+    const state = docker(["inspect", "-f", "{{.State.Running}}", name]);
+    if (state.status === 0) {
+        if (state.stdout.trim() !== "true")
+            mustDocker(docker, ["start", name], `Starting ${name}`);
+        const grpcPort = parseDockerPort(mustDocker(docker, ["port", name, "50051/tcp"], `Reading ${name}'s ports`));
+        const httpPort = parseDockerPort(mustDocker(docker, ["port", name, "8443/tcp"], `Reading ${name}'s ports`));
+        if (grpcPort && httpPort)
+            return { grpcPort, httpPort, created: false };
+        mustDocker(docker, ["rm", "-f", name], `Removing ${name}`);
+    }
+    ensureDatabase(docker, app);
+    mustDocker(docker, spicedbMigrateArgs(app), `Migrating ${name}'s datastore`);
+    const first = appSpiceDBSlot(app);
+    for (let i = 0; i < PORT_SLOTS; i++) {
+        const ports = appSpiceDBPorts(first + i);
+        if (!(await portFree(ports.grpc)) || !(await portFree(ports.http)))
+            continue;
+        mustDocker(docker, spicedbServeArgs(app, ports), `Starting ${name}`);
+        return { grpcPort: ports.grpc, httpPort: ports.http, created: true };
+    }
+    throw new MeshCliError(`No free port pair for ${name} in ${GRPC_PORT_BASE}-${GRPC_PORT_BASE + PORT_SLOTS - 1}.`);
+}
+export async function writeSpiceDBSchema(httpUrl, zed, opts = {}) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const attempts = opts.attempts ?? 30;
+    let last = "";
+    for (let i = 0; i < attempts; i++) {
+        try {
+            const res = await fetchImpl(`${httpUrl}/v1/schema/write`, {
+                method: "POST",
+                headers: { Authorization: `Bearer ${LOCAL_APP_SPICEDB_KEY}`, "content-type": "application/json" },
+                body: JSON.stringify({ schema: zed }),
+            });
+            if (res.ok)
+                return;
+            last = `${res.status} ${await res.text()}`;
+            if (res.status >= 400 && res.status < 500)
+                break;
+        }
+        catch (err) {
+            last = err instanceof Error ? err.message : String(err);
+        }
+        await new Promise((r) => setTimeout(r, opts.delayMs ?? 500));
+    }
+    throw new MeshCliError(`SpiceDB at ${httpUrl} did not accept the app's schema: ${last}`);
+}
+export function removeLocalAppSpiceDBs(docker = defaultDocker) {
+    const ids = docker(["ps", "-aq", "--filter", `label=${LOCAL_APP_SPICEDB_LABEL}`]).stdout.trim().split("\n").filter(Boolean);
+    if (ids.length > 0)
+        docker(["rm", "-f", ...ids]);
+    return ids;
+}
+export const tsxImporter = async (specifier, parentFile) => {
+    let api;
+    try {
+        api = createRequire(parentFile).resolve("tsx/esm/api");
+    }
+    catch {
+        throw new MeshCliError(`Cannot load the app's authz schema: \`tsx\` is not installed in ${path.dirname(parentFile)}. ` +
+            "Add it to the app's devDependencies (`pnpm add -D tsx`).");
+    }
+    const { tsImport } = (await import(pathToFileURL(api).href));
+    return tsImport(specifier, pathToFileURL(parentFile).href);
+};
+const unwrapDefault = (mod) => {
+    const d = mod.default ?? mod.schema;
+    return d && typeof d === "object" && "default" in d && !("namespace" in d) ? d.default : d;
+};
+export async function loadAppAuthz(appRoot, schemaRel, importer = tsxImporter) {
+    const file = path.resolve(appRoot, schemaRel);
+    if (!fs.existsSync(file)) {
+        throw new MeshCliError(`mesh.authz.schema names ${schemaRel}, which does not exist under ${appRoot}.`);
+    }
+    const schema = unwrapDefault(await importer(pathToFileURL(file).href, file));
+    if (!schema || typeof schema.namespace !== "string") {
+        throw new MeshCliError(`${schemaRel} must export the app's defineSchema(...) result as its default export.`);
+    }
+    const compilers = (await importer("@mesh-tech/authz/compilers", file));
+    let chunk;
+    try {
+        const ssm = await importer("@mesh-tech/authz/metadata/ssm", file);
+        if (typeof ssm.chunkSsmValue === "function")
+            chunk = ssm.chunkSsmValue;
+    }
+    catch {
+    }
+    return { schema, compilers, chunk };
+}
+export const localParamStore = async () => {
+    const { SSMClient, GetParameterCommand, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+    const ssm = new SSMClient(LOCAL_AWS_CONFIG);
+    return {
+        async get(name) {
+            try {
+                return (await ssm.send(new GetParameterCommand({ Name: name }))).Parameter?.Value;
+            }
+            catch {
+                return undefined;
+            }
+        },
+        async put(name, value) {
+            await ssm.send(new PutParameterCommand({ Name: name, Value: value, Type: "String", Tier: "Advanced", Overwrite: true }));
+        },
+    };
+};
+export async function publishLocalAppAuthz(args, deps = {}) {
+    const env = LOCAL_ENV;
+    const { schema, compilers, chunk } = await loadAppAuthz(args.appRoot, args.schema, deps.importer);
+    const mode = schema.mode === "role-gating" ? "role-gating" : "policy-engine";
+    const params = deps.params ?? (await localParamStore());
+    const base = appAuthzParam(args.tenant, env, args.app);
+    const metadataRef = `${base}/ops-hub-metadata`;
+    let instance;
+    if (mode === "policy-engine") {
+        const running = await (deps.ensureSpiceDB ?? ensureLocalAppSpiceDB)(args.app);
+        instance = { grpcPort: running.grpcPort, httpPort: running.httpPort };
+        await (deps.writeSchema ?? writeSpiceDBSchema)(`http://localhost:${instance.httpPort}`, compilers.compileSpiceDBSchema(schema).zed);
+        await (deps.putSecret ?? upsertLocalSecret)(appSpiceDBSecretName(args.tenant, env, args.app), {
+            PRESHARED_KEY: LOCAL_APP_SPICEDB_KEY,
+        });
+        await params.put(spicedbInstanceParam(args.tenant, env, args.app), JSON.stringify(instanceRegistryValue({ app: args.app, tenant: args.tenant, env, ...instance })));
+    }
+    const body = JSON.stringify(compilers.compileOpsHubMetadata(schema));
+    const split = chunk ? chunk(body) : { value: body, parts: [] };
+    for (const [i, part] of split.parts.entries())
+        await params.put(`${metadataRef}/part-${i}`, part);
+    await params.put(metadataRef, split.value);
+    let existing = {};
+    const raw = await params.get(base);
+    if (raw) {
+        try {
+            const parsed = JSON.parse(raw);
+            if (parsed && typeof parsed === "object")
+                existing = parsed;
+        }
+        catch {
+        }
+    }
+    await params.put(base, JSON.stringify(buildAppAuthzPointer({
+        existing,
+        mode,
+        instanceId: instance ? args.app : undefined,
+        zitadel: args.zitadel,
+        metadataRef,
+    })));
+    return {
+        mode,
+        env: instance ? appSpiceDBEnv({ ...instance, metadataPath: `${base}/metadata` }) : {},
+        ...(instance ? { instance } : {}),
+    };
+}

package/dist/src/commands/local/auth-provision.d.ts

@@ -21,6 +21,7 @@ export declare function reconcileRegistryFromZitadel(): Promise<{
     tenants: string[];
     apps: number;
 }>;
+export declare function isZitadelNoChanges(err: unknown): boolean;
 export declare function ensureSignInApp(args: {
     tenant: string;
     app: string;

package/dist/src/commands/local/auth-provision.js

@@ -197,6 +197,11 @@ export async function reconcileRegistryFromZitadel() {
     }
     return { tenants, apps };
 }
+export function isZitadelNoChanges(err) {
+    if (!(err instanceof Error))
+        return false;
+    return err.status === 400 && /No changes|COMMAND-1m88i/.test(err.message);
+}
 export async function ensureSignInApp(args) {
     const pat = readSeederPat();
     const orgId = await ensureOrg(pat, args.tenant);
@@ -220,7 +225,13 @@ export async function ensureSignInApp(args) {
     };
     const existing = await searchZitadelApp(pat, projectId, name, orgId);
     if (existing) {
-        await api(pat, "PUT", `/management/v1/projects/${projectId}/apps/${existing.id}/oidc_config`, config, orgId);
+        try {
+            await api(pat, "PUT", `/management/v1/projects/${projectId}/apps/${existing.id}/oidc_config`, config, orgId);
+        }
+        catch (err) {
+            if (!isZitadelNoChanges(err))
+                throw err;
+        }
         return;
     }
     const created = await api(pat, "POST", `/management/v1/projects/${projectId}/apps/oidc`, { name, ...config }, orgId);

package/dist/src/commands/local/index.js

@@ -3,6 +3,7 @@ import * as path from "path";
 import chalk from "chalk";
 import { logError, logInfo, logSuccess, logWarn } from "../../utils/log.js";
 import { MeshCliError } from "../../utils/errors.js";
+import { removeLocalAppSpiceDBs } from "./app-authz.js";
 import { compose, COMPOSE_PROJECT, composeStreamed, crashedServices, DEFAULT_HUB_PORT, ensureDockerAvailable, findPackageRoot, hubApiRunning, hubEndpoints, hubOverlayServices, hubPort, idpsOverlayServices, ONE_SHOT_SERVICES, overlayRunning, probeEndpoint, STACK_ENDPOINTS, stackOwnedElsewhere, stackServices, } from "./stack.js";
 import { probeRegistryToken, REGISTRY_LOGIN_FIX } from "../../utils/auth-preflight.js";
 import { ensureHubAuthImage, ensureHubImages, buildHubImagesFromSource, readHubCompiledAuthz, hasRegistryAuth, localHubVersion, planWithHubRefresh, } from "./hub-local.js";
@@ -314,6 +315,7 @@ export function registerLocalCommands(program) {
         if (foreign && !opts.force) {
             throw new MeshCliError(`The running local platform was started from a different checkout (${foreign}) — another project may be using it.`, { remediation: { command: "mesh stop --force   # stop it anyway" } });
         }
+        removeLocalAppSpiceDBs();
         const aliases = removeAllAliasContainers();
         if (aliases.length > 0)
             logInfo(`Removed ${aliases.length} local docs alias container(s).`);

package/dist/src/commands/mcp/generate.d.ts

@@ -0,0 +1,11 @@
+export declare function resolveServeDependencies(from: string, pinned?: Readonly<Record<string, string>>, declared?: Readonly<Record<string, string>>): Record<string, string>;
+export declare function defaultServeDir(manifestPath: string, name: string): string;
+export interface GeneratedMcpServeDir {
+    serveDir: string;
+    written: string[];
+}
+export declare function generateMcpServeDir(manifestPath: string, opts?: {
+    out?: string;
+    refreshVersions?: boolean;
+    dependencies?: Record<string, string>;
+}): GeneratedMcpServeDir;

package/dist/src/commands/mcp/generate.js

@@ -0,0 +1,78 @@
+import * as fs from "node:fs";
+import { createRequire } from "node:module";
+import * as path from "node:path";
+import { MCP_SERVE_DEPENDENCIES, MCP_SERVE_ENTRY, MCP_SERVE_SPEC, mcpServeEntrySource, mcpServePackageJson, mcpServeSpecSource, } from "@mesh-tech/api-registry/mcp-manifest";
+import { readMcpManifestFile } from "./manifest-file.js";
+const SERVE_HOST_PACKAGE = "@mesh-tech/app-kit";
+function installedManifest(require_, from, name) {
+    try {
+        return require_(`${name}/package.json`);
+    }
+    catch {
+    }
+    let dir = path.resolve(from);
+    for (;;) {
+        const file = path.join(dir, "node_modules", ...name.split("/"), "package.json");
+        if (fs.existsSync(file)) {
+            try {
+                return JSON.parse(fs.readFileSync(file, "utf8"));
+            }
+            catch {
+                return undefined;
+            }
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return undefined;
+        dir = parent;
+    }
+}
+export function resolveServeDependencies(from, pinned = {}, declared = MCP_SERVE_DEPENDENCIES) {
+    const require_ = createRequire(path.join(path.resolve(from), "noop.js"));
+    const host = installedManifest(require_, from, SERVE_HOST_PACKAGE);
+    const peers = host?.peerDependencies ?? {};
+    const out = {};
+    for (const [name, fallback] of Object.entries(declared)) {
+        const peer = name === SERVE_HOST_PACKAGE ? undefined : peers[name];
+        const usablePeer = peer && !peer.startsWith("workspace:") ? peer : undefined;
+        out[name] =
+            pinned[name] ?? usablePeer ?? installedManifest(require_, from, name)?.version ?? fallback;
+    }
+    return out;
+}
+export function defaultServeDir(manifestPath, name) {
+    return path.join(path.dirname(path.resolve(manifestPath)), ".mesh-mcp", name);
+}
+function readPinned(packageJsonPath) {
+    if (!fs.existsSync(packageJsonPath))
+        return {};
+    try {
+        const pkg = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
+        return Object.fromEntries(Object.entries(pkg.dependencies ?? {}).filter((entry) => typeof entry[1] === "string"));
+    }
+    catch {
+        return {};
+    }
+}
+export function generateMcpServeDir(manifestPath, opts = {}) {
+    const loaded = readMcpManifestFile(manifestPath);
+    const serveDir = path.resolve(opts.out ?? defaultServeDir(manifestPath, loaded.manifest.name));
+    fs.mkdirSync(serveDir, { recursive: true });
+    const packageJsonPath = path.join(serveDir, "package.json");
+    const dependencies = opts.dependencies ??
+        resolveServeDependencies(serveDir, opts.refreshVersions ? {} : readPinned(packageJsonPath));
+    const files = {
+        "package.json": `${JSON.stringify(mcpServePackageJson(loaded.manifest.name, dependencies), null, 2)}\n`,
+        [MCP_SERVE_ENTRY]: mcpServeEntrySource(loaded.manifest, loaded.tools),
+        [MCP_SERVE_SPEC]: mcpServeSpecSource(loaded),
+    };
+    const written = [];
+    for (const [name, content] of Object.entries(files)) {
+        const file = path.join(serveDir, name);
+        if (fs.existsSync(file) && fs.readFileSync(file, "utf8") === content)
+            continue;
+        fs.writeFileSync(file, content);
+        written.push(name);
+    }
+    return { serveDir, written };
+}

package/dist/src/commands/mcp/index.d.ts

@@ -0,0 +1,2 @@
+import { Command } from "commander";
+export declare function registerMcpCommands(program: Command): void;