@mesh-tech/mesh-cli 0.38.1 → 0.40.0

package/dist/bin/{mesh.chunk-LMYPTJ2F.js → mesh.chunk-7HTKSUWR.js}

@@ -14,6 +14,7 @@ import {
 } from "./mesh.chunk-2QIVBQX5.js";
 import {
   ARTIFACTS_BUCKET,
+  COMPOSE_PROJECT,
   DEFAULT_HUB_PORT,
   LOCAL_AWS_CONFIG,
   LOCAL_ENV,
@@ -48,14 +49,14 @@ import {
   isExpiredAwsTokenMessage,
   probeRegistryToken,
   registryLoginFix
-} from "./mesh.chunk-KN4BZOYH.js";
+} from "./mesh.chunk-6SSOVZOI.js";
 
 // packages/mesh-cli/src/commands/login.ts
 import * as http from "http";
 import * as crypto3 from "crypto";
-import * as fs18 from "fs";
-import * as path19 from "path";
-import { execFileSync as execFileSync15 } from "child_process";
+import * as fs21 from "fs";
+import * as path22 from "path";
+import { execFileSync as execFileSync16 } from "child_process";
 
 // packages/mesh-cli/src/utils/aws-auth.ts
 import * as fs2 from "fs";
@@ -166,7 +167,7 @@ function pulumiStackOutput(appRoot, key, extraArgs, env) {
 
 // packages/mesh-cli/src/utils/aws-auth.ts
 var DEFAULT_REGION = process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? "us-east-2";
-function readStackPlatform(appRoot, stack) {
+function derivePlatformRef(appRoot, stack) {
   const configFile = path2.join(appRoot, `Pulumi.${stack}.yaml`);
   if (!fs2.existsSync(configFile)) return null;
   const content = fs2.readFileSync(configFile, "utf-8");
@@ -174,17 +175,21 @@ function readStackPlatform(appRoot, stack) {
   if (jsonMatch) {
     try {
       const parsed = JSON.parse(jsonMatch[1]);
-      if (parsed.name && parsed.env) return `${parsed.name}.${parsed.env}`;
+      if (parsed.name && parsed.env) return { name: parsed.name, env: parsed.env };
     } catch {
     }
   }
   const nameMatch = content.match(/mesh:platform:[\s\S]*?name:\s*(\S+)/);
   const envMatch = content.match(/mesh:platform:[\s\S]*?env:\s*(\S+)/);
   if (nameMatch && envMatch) {
-    return `${nameMatch[1]}.${envMatch[1]}`;
+    return { name: nameMatch[1], env: envMatch[1] };
   }
   return null;
 }
+function readStackPlatform(appRoot, stack) {
+  const ref = derivePlatformRef(appRoot, stack);
+  return ref ? `${ref.name}.${ref.env}` : null;
+}
 function derivePlatformContext(appRoot, stack) {
   const explicit = readStackConfig(appRoot, stack, "mesh:loginContext");
   if (explicit) return explicit;
@@ -561,7 +566,7 @@ async function resolveAwsCredentials(roleArn, appRoot, stack) {
 }
 
 // packages/mesh-cli/src/commands/vpn/index.ts
-import { execFileSync as execFileSync14 } from "child_process";
+import { execFileSync as execFileSync15 } from "child_process";
 import * as net8 from "node:net";
 
 // packages/mesh-cli/src/utils/context.ts
@@ -1193,11 +1198,11 @@ function unregisterDnsRecords(cfg, suffix) {
 import * as net7 from "node:net";
 
 // packages/mesh-cli/src/utils/tailscale.ts
-import * as fs17 from "node:fs";
+import * as fs20 from "node:fs";
 import * as net6 from "node:net";
-import * as os4 from "node:os";
-import * as path18 from "node:path";
-import { spawn as spawn2, execFileSync as execFileSync13 } from "node:child_process";
+import * as os3 from "node:os";
+import * as path21 from "node:path";
+import { spawn as spawn2, execFileSync as execFileSync14 } from "node:child_process";
 
 // packages/mesh-cli/src/utils/pid.ts
 var MIN_SIGNALABLE_PID = 2;
@@ -1235,16 +1240,16 @@ function assertSignalablePid(pid, source) {
 }
 
 // packages/mesh-cli/src/utils/tailscale-targets.ts
-import { execFileSync as execFileSync11 } from "node:child_process";
-import * as fs15 from "node:fs";
-import * as path16 from "node:path";
+import { execFileSync as execFileSync12 } from "node:child_process";
+import * as fs18 from "node:fs";
+import * as path19 from "node:path";
 
 // packages/mesh-cli/src/commands/dev.ts
-import { execFileSync as execFileSync10, spawn, spawnSync } from "child_process";
-import * as fs14 from "fs";
+import { execFileSync as execFileSync11, spawn, spawnSync as spawnSync2 } from "child_process";
+import { createHash as createHash5 } from "crypto";
+import * as fs17 from "fs";
 import * as net3 from "net";
-import * as os3 from "os";
-import * as path15 from "path";
+import * as path18 from "path";
 import { Option } from "commander";
 import { SecretsManagerClient as SecretsManagerClient2, GetSecretValueCommand as GetSecretValueCommand2 } from "@aws-sdk/client-secrets-manager";
 
@@ -1359,9 +1364,48 @@ async function resolvePulumiEnv(opts) {
 }
 
 // packages/mesh-cli/src/utils/kubeconfig.ts
-import * as fs5 from "fs";
-import * as os from "os";
-import * as path5 from "path";
+import * as fs6 from "fs";
+import * as path6 from "path";
+
+// packages/mesh-cli/src/utils/dev-sessions-root.ts
+import fs5 from "node:fs";
+import os from "node:os";
+import path5 from "node:path";
+var migrated = false;
+function devSessionsRoot(env = process.env) {
+  const configured = env.MESH_DEV_SESSIONS_DIR?.trim();
+  const root = configured || path5.join(env.XDG_CONFIG_HOME?.trim() || path5.join(os.homedir(), ".config"), "mesh", "dev-sessions");
+  fs5.mkdirSync(root, { recursive: true });
+  if (!configured && !migrated) {
+    migrated = true;
+    migrateLegacySessionsDir(path5.join(env.TMPDIR?.trim() || os.tmpdir(), "mesh-dev-sessions"), root);
+  }
+  return root;
+}
+function migrateLegacySessionsDir(legacy, root) {
+  try {
+    if (path5.resolve(legacy) === path5.resolve(root)) return;
+    let stat;
+    try {
+      stat = fs5.lstatSync(legacy);
+    } catch {
+      stat = void 0;
+    }
+    if (stat?.isSymbolicLink()) return;
+    if (stat?.isDirectory()) {
+      for (const entry of fs5.readdirSync(legacy)) {
+        const to = path5.join(root, entry);
+        if (!fs5.existsSync(to)) fs5.cpSync(path5.join(legacy, entry), to, { recursive: true, preserveTimestamps: true });
+      }
+      fs5.renameSync(legacy, `${legacy}.migrated-${Date.now()}`);
+    }
+    fs5.mkdirSync(path5.dirname(legacy), { recursive: true });
+    fs5.symlinkSync(root, legacy, "dir");
+  } catch {
+  }
+}
+
+// packages/mesh-cli/src/utils/kubeconfig.ts
 function buildKubeconfig(cluster, region) {
   return `apiVersion: v1
 kind: Config
@@ -1392,7 +1436,7 @@ users:
 `;
 }
 function sessionKubeconfigPath(sessionName) {
-  return path5.join(os.tmpdir(), "mesh-dev-sessions", `${sessionName}.kubeconfig`);
+  return path6.join(devSessionsRoot(), `${sessionName}.kubeconfig`);
 }
 function resolveHubPlatformName(platform) {
   return platform?.name ?? "mesh";
@@ -1425,10 +1469,10 @@ async function ensureKubeconfig(platformName, env, sessionName, deps = {}) {
   }
   const region = process.env.AWS_REGION || "us-east-2";
   const kubeconfigPath = sessionKubeconfigPath(sessionName);
-  if (!fs5.existsSync(path5.dirname(kubeconfigPath))) {
-    fs5.mkdirSync(path5.dirname(kubeconfigPath), { recursive: true });
+  if (!fs6.existsSync(path6.dirname(kubeconfigPath))) {
+    fs6.mkdirSync(path6.dirname(kubeconfigPath), { recursive: true });
   }
-  fs5.writeFileSync(kubeconfigPath, buildKubeconfig(cluster, region), { mode: 384 });
+  fs6.writeFileSync(kubeconfigPath, buildKubeconfig(cluster, region), { mode: 384 });
   return kubeconfigPath;
 }
 
@@ -1507,7 +1551,7 @@ async function resolveTemporalAuth(tenant, env, platformName = tenant) {
         const stderr = String(err?.stderr ?? "");
         if (/\.kube[/\\]config|error loading config file/i.test(`${detail} ${stderr}`)) {
           logWarn(
-            "kubectl could not read a kubeconfig and fell back to ~/.kube/config (macOS blocks it for shells without Full Disk Access). Run inside the mesh dev tmux session, or export KUBECONFIG=$TMPDIR/mesh-dev-sessions/<session>.kubeconfig."
+            "kubectl could not read a kubeconfig and fell back to ~/.kube/config (macOS blocks it for shells without Full Disk Access). Run inside the mesh dev tmux session, or export KUBECONFIG=~/.config/mesh/dev-sessions/<session>.kubeconfig ($MESH_DEV_SESSIONS_DIR/<session>.kubeconfig when that is set)."
           );
         }
       }
@@ -1609,6 +1653,7 @@ var WORKFLOW_PACKAGE_DIRS = [
   "packages/agent-contracts/src"
 ];
 var EXCLUDE = /(^|\/)(node_modules|dist|__tests__)(\/|$)|\.(test|spec)\.[cm]?tsx?$/;
+var EXCLUDED_DIR_NAMES = /* @__PURE__ */ new Set(["node_modules", "dist", "__tests__"]);
 function findRepoRoot2(startDir) {
   let dir = startDir;
   for (; ; ) {
@@ -1632,19 +1677,27 @@ function resolveWorkerSourceDirs(repoRoot, services = {}) {
   }
   return dirs;
 }
+function listDir(dir) {
+  try {
+    return readdirSync3(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+}
+function collectSourceFiles(dir, files) {
+  for (const entry of listDir(dir)) {
+    if (entry.isSymbolicLink()) continue;
+    if (entry.isDirectory()) {
+      if (!EXCLUDED_DIR_NAMES.has(entry.name)) collectSourceFiles(join6(dir, entry.name), files);
+    } else if (entry.isFile() && /\.(ts|tsx)$/.test(entry.name) && !EXCLUDE.test(entry.name)) {
+      files.push(join6(dir, entry.name));
+    }
+  }
+}
 function computeWorkflowFingerprint(dirs, relativeTo) {
   const files = [];
   for (const dir of dirs) {
-    let rels;
-    try {
-      rels = readdirSync3(dir, { recursive: true });
-    } catch {
-      continue;
-    }
-    for (const rel of rels) {
-      const p = String(rel);
-      if (/\.(ts|tsx)$/.test(p) && !EXCLUDE.test(p)) files.push(join6(dir, p));
-    }
+    collectSourceFiles(dir, files);
   }
   files.sort();
   if (files.length === 0) return "";
@@ -1668,9 +1721,9 @@ function fingerprintWorkflowSource(appRoot, services = {}) {
 }
 
 // packages/mesh-cli/src/commands/dev-launch.ts
-import * as fs6 from "fs";
+import * as fs7 from "fs";
 import * as net from "net";
-import * as path6 from "path";
+import * as path7 from "path";
 var ENV_FILE_MODE = 384;
 var ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 function quoteShellValue(value) {
@@ -1693,15 +1746,158 @@ function renderEnvFile(env) {
 function envFileName(serviceName) {
   return `${serviceName.replace(/[^A-Za-z0-9._-]/g, "-")}.env.sh`;
 }
+function getSessionEnvDir(sessionName) {
+  return path7.join(devSessionsRoot(), sessionName);
+}
+function serviceOverridesPaths(sessionName, serviceName) {
+  const dir = getSessionEnvDir(sessionName);
+  return [path7.join(dir, "_all.overrides.env.sh"), path7.join(dir, `${serviceName}.overrides.env.sh`)];
+}
+function readServiceOverrides(sessionName, serviceName) {
+  const merged = {};
+  for (const file of serviceOverridesPaths(sessionName, serviceName)) {
+    try {
+      Object.assign(merged, parseEnvFile(fs7.readFileSync(file, "utf8")));
+    } catch {
+    }
+  }
+  return merged;
+}
 function writeEnvFile(filePath, env) {
-  fs6.mkdirSync(path6.dirname(filePath), { recursive: true });
-  fs6.writeFileSync(filePath, renderEnvFile(env), { mode: ENV_FILE_MODE });
-  fs6.chmodSync(filePath, ENV_FILE_MODE);
+  fs7.mkdirSync(path7.dirname(filePath), { recursive: true });
+  fs7.writeFileSync(filePath, renderEnvFile(env), { mode: ENV_FILE_MODE });
+  fs7.chmodSync(filePath, ENV_FILE_MODE);
+}
+var LAUNCH_HOST_ENV_ALLOW_LIST = [
+  // Who the process is. Without HOME nothing finds ~/.aws (the SSO profile
+  // `buildChildAwsEnv` hands over by name), ~/.npmrc (the registry token the
+  // service's `pnpm dev` needs), ~/.config/mesh (the credentials the
+  // token-server window reads), ~/.ssh, ~/.cache, or the user's shell rc files.
+  "HOME",
+  "USER",
+  "LOGNAME",
+  // The launching shell's PATH — the one that found `mesh` — so `node`, `pnpm`,
+  // `npx`, `aws` and whatever the dev command names resolve the same way they
+  // did for the launcher, not the way a bare tmux pane's login shell would.
+  "PATH",
+  // The interpreter the launch runs under (see `launchShell`) and what tools
+  // that spawn `$SHELL` get.
+  "SHELL",
+  // macOS gives each user a private temp dir; pnpm, node, and the AWS CLI's
+  // session manager plugin read it.
+  "TMPDIR",
+  // Where `mesh dev` keeps session state and env files (`devSessionsRoot`). A
+  // `mesh` command run inside a window (the token-server, `mesh dev restart`
+  // from a pane) must resolve the same root the launcher used.
+  "MESH_DEV_SESSIONS_DIR",
+  // Locale and timezone: text encoding for the service's stdout, and the
+  // timestamps in its logs.
+  "LANG",
+  "LANGUAGE",
+  "TZ",
+  // XDG base dirs: `mesh login` stores credentials under XDG_CONFIG_HOME
+  // (login.ts), the docs cache under XDG_CACHE_HOME — the token-server window
+  // and any `npx mesh …` a service runs must agree with the launcher on where
+  // those are. LC_* is matched by prefix below.
+  "XDG_CONFIG_HOME",
+  "XDG_CACHE_HOME",
+  "XDG_DATA_HOME",
+  "XDG_STATE_HOME",
+  "XDG_RUNTIME_DIR",
+  // The CLI's own cache-root override (cache-home.ts): the status and
+  // token-server windows run `npx mesh`, and must read the same cache the
+  // launcher wrote.
+  "MESH_CACHE_HOME",
+  // ssh-agent, for a service that runs git over ssh (the workspaces manager
+  // cloning its mirrors). tmux's own `update-environment` default forwards
+  // this into new sessions for the same reason.
+  "SSH_AUTH_SOCK",
+  // Docker: a service that drives the daemon (the workspaces manager starting
+  // sidecars) must reach the SAME daemon the launcher's `docker` did — Colima
+  // and Docker Desktop are selected by these, not by anything on disk.
+  "DOCKER_HOST",
+  "DOCKER_CONTEXT",
+  "DOCKER_CONFIG",
+  "DOCKER_CERT_PATH",
+  "DOCKER_TLS_VERIFY",
+  // Egress: corporate proxies and the extra CA they terminate TLS with. Both
+  // casings, because Node reads the lower-case ones and curl/aws either.
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "NO_PROXY",
+  "http_proxy",
+  "https_proxy",
+  "no_proxy",
+  "NODE_EXTRA_CA_CERTS",
+  "SSL_CERT_FILE",
+  "SSL_CERT_DIR"
+];
+var LAUNCH_HOST_ENV_ALLOW_PREFIXES = [
+  // LC_ALL, LC_CTYPE, LC_TIME, … — the locale family, alongside LANG.
+  "LC_"
+];
+var LAUNCH_PANE_ENV_FORWARDED = ["TERM", "TMUX", "TMUX_PANE"];
+function isAllowedLaunchHostVar(name) {
+  return LAUNCH_HOST_ENV_ALLOW_LIST.includes(name) || LAUNCH_HOST_ENV_ALLOW_PREFIXES.some((prefix) => name.startsWith(prefix));
+}
+function pickLaunchHostEnv(env) {
+  const picked = {};
+  for (const name of Object.keys(env).sort()) {
+    const value = env[name];
+    if (value && isAllowedLaunchHostVar(name)) picked[name] = value;
+  }
+  return picked;
+}
+function launchShell(hostEnv) {
+  const shell = hostEnv.SHELL;
+  if (shell && path7.isAbsolute(shell) && /^(bash|zsh)$/.test(path7.basename(shell))) return shell;
+  return "/bin/sh";
+}
+function buildLaunchCommand(envFilePath, dir, command, logShipper, hostEnv) {
+  const sourced = `. ${quoteShellValue(envFilePath)} && `;
+  const script = logShipper ? `${sourced}{ ${command}; } 2>&1 | NODE_OPTIONS= node ${quoteShellValue(logShipper)}` : `${sourced}${command}`;
+  const forwarded = LAUNCH_PANE_ENV_FORWARDED.map((name) => `${name}="$${name}"`).join(" ");
+  return `cd ${quoteShellValue(dir)} && env -i ${forwarded} ${quoteShellValue(launchShell(hostEnv))} -c ${quoteShellValue(script)}`;
+}
+function envFileKeys(content) {
+  const keys = [];
+  for (const line of content.split("\n")) {
+    const match = /^export ([A-Za-z_][A-Za-z0-9_]*)=/.exec(line);
+    if (match) keys.push(match[1]);
+  }
+  return keys;
+}
+function parseEnvFile(content) {
+  const env = {};
+  const entry = /^export ([A-Za-z_][A-Za-z0-9_]*)='((?:[^']|'\\'')*)'$/gm;
+  for (const match of content.matchAll(entry)) {
+    env[match[1]] = match[2].replace(/'\\''/g, "'");
+  }
+  return env;
 }
-function buildLaunchCommand(envFilePath, dir, command, logShipper) {
-  const base = `cd ${quoteShellValue(dir)} && source ${quoteShellValue(envFilePath)} && `;
-  if (!logShipper) return `${base}${command}`;
-  return `${base}{ ${command}; } 2>&1 | NODE_OPTIONS= node ${quoteShellValue(logShipper)}`;
+var SECRET_KEY_RE = /TOKEN|SECRET|KEY|PASSWORD|PASSWD|CREDENTIAL|COOKIE|AUTH/i;
+var PRINTABLE_VALUE_MAX = 80;
+function diffEnvFiles(before, after) {
+  const show = (key, value) => {
+    if (SECRET_KEY_RE.test(key)) return "(secret)";
+    if (value.length > PRINTABLE_VALUE_MAX) return `(${value.length} chars)`;
+    return JSON.stringify(value);
+  };
+  const changes = [];
+  const keys = [.../* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)])].sort();
+  for (const key of keys) {
+    const was = before[key];
+    const now = after[key];
+    if (was === void 0 && now !== void 0) {
+      changes.push({ key, kind: "added", detail: `+ ${key} = ${show(key, now)}` });
+    } else if (was !== void 0 && now === void 0) {
+      changes.push({ key, kind: "removed", detail: `- ${key} (was ${show(key, was)})` });
+    } else if (was !== void 0 && now !== void 0 && was !== now) {
+      const detail = SECRET_KEY_RE.test(key) ? `~ ${key} (secret; value changed)` : `~ ${key}: ${show(key, was)} \u2192 ${show(key, now)}`;
+      changes.push({ key, kind: "changed", detail });
+    }
+  }
+  return changes;
 }
 async function waitForPort(host, port, timeoutMs, intervalMs = 500) {
   const deadline = Date.now() + timeoutMs;
@@ -1729,13 +1925,13 @@ function tryConnect(host, port, timeoutMs) {
 }
 
 // packages/mesh-cli/src/commands/local/dev-local.ts
-import * as fs10 from "fs";
-import * as path10 from "path";
+import * as fs11 from "fs";
+import * as path11 from "path";
 
 // packages/mesh-cli/src/commands/local/mocks.ts
 import { execFileSync as execFileSync4 } from "child_process";
-import * as fs7 from "fs";
-import * as path7 from "path";
+import * as fs8 from "fs";
+import * as path8 from "path";
 var EXTERNAL_MODES = ["mock", "local", "remote"];
 var DECL_DOCS = { docs: 'package.json \u2192 "mesh": { "externals": { \u2026 } }' };
 function externalMode(name, decl) {
@@ -1867,8 +2063,8 @@ var dockerProbes = {
   portPublisher: composeFilePortPublisher
 };
 async function composeExternalUp(appRoot, sessionName, name, decl, probes = dockerProbes) {
-  const composeFile = path7.resolve(appRoot, decl.compose);
-  if (!fs7.existsSync(composeFile)) {
+  const composeFile = path8.resolve(appRoot, decl.compose);
+  if (!fs8.existsSync(composeFile)) {
     throw new MeshCliError(`External '${name}': compose file not found at ${composeFile}.`, {
       remediation: { docs: 'package.json \u2192 "mesh": { "externals": { \u2026 } }' }
     });
@@ -2006,10 +2202,10 @@ function composeExternalsDown(refs) {
     }
   }
 }
-var SECRET_KEY_RE = /key|secret|password|token/i;
+var SECRET_KEY_RE2 = /key|secret|password|token/i;
 function readLocalMocks(appRoot) {
   try {
-    const pkg = JSON.parse(fs7.readFileSync(path7.join(appRoot, "package.json"), "utf-8"));
+    const pkg = JSON.parse(fs8.readFileSync(path8.join(appRoot, "package.json"), "utf-8"));
     const mocks = pkg?.mesh?.mocks;
     const externals = pkg?.mesh?.externals;
     return {
@@ -2104,12 +2300,12 @@ function externalDocs(decl) {
   return typeof decl.docs === "string" ? { url: decl.docs } : decl.docs;
 }
 function localProbeFile(tenant, app, external) {
-  return path7.join(localProbesDir(), `${tenant}-${app}-${external}.json`);
+  return path8.join(localProbesDir(), `${tenant}-${app}-${external}.json`);
 }
 function localProbesRemove(files) {
   for (const file of files ?? []) {
     try {
-      fs7.rmSync(file, { force: true });
+      fs8.rmSync(file, { force: true });
     } catch {
     }
   }
@@ -2145,7 +2341,7 @@ async function seedLocalMock(args) {
   await upsertLocalSecret(secretName, value);
   await upsertLocalSecret(
     `${secretName}/.config`,
-    Object.fromEntries(Object.entries(value).filter(([key]) => !SECRET_KEY_RE.test(key)))
+    Object.fromEntries(Object.entries(value).filter(([key]) => !SECRET_KEY_RE2.test(key)))
   );
   const { SSMClient: SSMClient2, PutParameterCommand } = await import("@aws-sdk/client-ssm");
   const ssm = new SSMClient2(LOCAL_AWS_CONFIG);
@@ -2178,7 +2374,7 @@ async function seedLocalMock(args) {
         fields: Object.fromEntries(
           Object.keys(value).map((key) => [
             key,
-            { type: "field", name: key, description: "", secret: SECRET_KEY_RE.test(key), optional: false }
+            { type: "field", name: key, description: "", secret: SECRET_KEY_RE2.test(key), optional: false }
           ])
         ),
         keyedBy: null
@@ -2198,7 +2394,7 @@ async function seedLocalMock(args) {
   );
   const probeFile = localProbeFile(tenant, app, decl.external);
   if (probe) {
-    fs7.writeFileSync(
+    fs8.writeFileSync(
       probeFile,
       JSON.stringify(
         [
@@ -2232,7 +2428,7 @@ async function seedLocalMock(args) {
 }
 
 // packages/mesh-cli/src/commands/local/seed-zitadel.ts
-import * as fs9 from "fs";
+import * as fs10 from "fs";
 
 // packages/mesh-cli/src/commands/local/act-as-local.ts
 import { createPublicKey } from "node:crypto";
@@ -2275,12 +2471,12 @@ function actAsEnv(publication, tenant, env, surface) {
 
 // packages/mesh-cli/src/commands/local/seed-zitadel.ts
 import * as os2 from "os";
-import * as path9 from "path";
+import * as path10 from "path";
 
 // packages/mesh-cli/src/commands/local/mock-idps.ts
 import { execFileSync as execFileSync5 } from "child_process";
-import * as fs8 from "fs";
-import * as path8 from "path";
+import * as fs9 from "fs";
+import * as path9 from "path";
 var MOCK_SAML_PORT = 4569;
 var MOCK_OIDC_PORT = 5556;
 var MOCK_OIDC_SERVICE = "mock-oidc";
@@ -2313,13 +2509,13 @@ var mockOidcEndpoints = () => ({
   token: `http://${MOCK_OIDC_SERVICE}:${MOCK_OIDC_PORT}/dex/token`,
   user: `http://${MOCK_OIDC_SERVICE}:${MOCK_OIDC_PORT}/dex/userinfo`
 });
-var keyDir = () => path8.join(meshCacheDir("mesh-local"), "mock-idp");
+var keyDir = () => path9.join(meshCacheDir("mesh-local"), "mock-idp");
 function ensureMockSamlSigningKey() {
   const dir = keyDir();
-  const certPath = path8.join(dir, "cert.pem");
-  const keyPath = path8.join(dir, "key.pem");
-  if (!fs8.existsSync(certPath) || !fs8.existsSync(keyPath)) {
-    fs8.mkdirSync(dir, { recursive: true });
+  const certPath = path9.join(dir, "cert.pem");
+  const keyPath = path9.join(dir, "key.pem");
+  if (!fs9.existsSync(certPath) || !fs9.existsSync(keyPath)) {
+    fs9.mkdirSync(dir, { recursive: true });
     try {
       execFileSync5(
         "openssl",
@@ -2350,8 +2546,8 @@ function ensureMockSamlSigningKey() {
     }
   }
   return {
-    publicKeyB64: fs8.readFileSync(certPath).toString("base64"),
-    privateKeyB64: fs8.readFileSync(keyPath).toString("base64")
+    publicKeyB64: fs9.readFileSync(certPath).toString("base64"),
+    privateKeyB64: fs9.readFileSync(keyPath).toString("base64")
   };
 }
 var mockIdpComposeEnv = () => {
@@ -2448,10 +2644,10 @@ function buildCliAppPayload() {
   };
 }
 function readSeederPat() {
-  const tmp = path9.join(fs9.mkdtempSync(path9.join(os2.tmpdir(), "mesh-zitadel-")), "pat.txt");
+  const tmp = path10.join(fs10.mkdtempSync(path10.join(os2.tmpdir(), "mesh-zitadel-")), "pat.txt");
   try {
     compose(["cp", "zitadel:/machinekey/pat.txt", tmp]);
-    const pat = fs9.readFileSync(tmp, "utf-8").trim();
+    const pat = fs10.readFileSync(tmp, "utf-8").trim();
     if (!pat) throw new Error("empty PAT file");
     return pat;
   } catch {
@@ -2460,7 +2656,7 @@ function readSeederPat() {
       { remediation: { command: "mesh stop --destroy && mesh start" } }
     );
   } finally {
-    fs9.rmSync(path9.dirname(tmp), { recursive: true, force: true });
+    fs10.rmSync(path10.dirname(tmp), { recursive: true, force: true });
   }
 }
 async function api(pat, method, apiPath, body, orgId) {
@@ -2564,11 +2760,11 @@ async function ensureTestUsers(pat) {
   }
 }
 function hubAuthPath() {
-  return path9.join(meshCacheDir("mesh-local"), "hub-auth.json");
+  return path10.join(meshCacheDir("mesh-local"), "hub-auth.json");
 }
 function readHubAuth() {
   try {
-    const parsed = JSON.parse(fs9.readFileSync(hubAuthPath(), "utf-8"));
+    const parsed = JSON.parse(fs10.readFileSync(hubAuthPath(), "utf-8"));
     if (parsed?.clientId && parsed?.clientSecret && parsed?.cookieSecret) return parsed;
     return null;
   } catch {
@@ -2708,7 +2904,7 @@ async function seedHubAuth(pat) {
     clientSecret: app.clientSecret ?? persisted?.clientSecret ?? "",
     cookieSecret: persistedCookie ?? (await import("crypto")).randomBytes(16).toString("hex")
   };
-  fs9.writeFileSync(hubAuthPath(), JSON.stringify(config, null, 2), { mode: 384 });
+  fs10.writeFileSync(hubAuthPath(), JSON.stringify(config, null, 2), { mode: 384 });
   return config;
 }
 async function publishHubAuthzPointer(projectId, orgId, awsConfig) {
@@ -3218,6 +3414,10 @@ async function reconcileRegistryFromZitadel() {
   }
   return { tenants, apps };
 }
+function isZitadelNoChanges(err) {
+  if (!(err instanceof Error)) return false;
+  return err.status === 400 && /No changes|COMMAND-1m88i/.test(err.message);
+}
 async function ensureSignInApp(args) {
   const pat = readSeederPat();
   const orgId = await ensureOrg(pat, args.tenant);
@@ -3244,13 +3444,17 @@ async function ensureSignInApp(args) {
   };
   const existing = await searchZitadelApp(pat, projectId, name, orgId);
   if (existing) {
-    await api(
-      pat,
-      "PUT",
-      `/management/v1/projects/${projectId}/apps/${existing.id}/oidc_config`,
-      config,
-      orgId
-    );
+    try {
+      await api(
+        pat,
+        "PUT",
+        `/management/v1/projects/${projectId}/apps/${existing.id}/oidc_config`,
+        config,
+        orgId
+      );
+    } catch (err) {
+      if (!isZitadelNoChanges(err)) throw err;
+    }
     return;
   }
   const created = await api(
@@ -3322,11 +3526,11 @@ function localAppNamespace(tenant, appName) {
   return `${tenant}-${LOCAL_ENV}-${appName}`;
 }
 function logShipperPath() {
-  return path10.join(findPackageRoot(), "assets", "log-shipper.mjs");
+  return path11.join(findPackageRoot(), "assets", "log-shipper.mjs");
 }
 function autoInstrumentationEnv(appRoot, src) {
-  const pkgDir = path10.join("node_modules", "@opentelemetry", "auto-instrumentations-node");
-  const present = fs10.existsSync(path10.join(appRoot, src, pkgDir)) || fs10.existsSync(path10.join(appRoot, pkgDir));
+  const pkgDir = path11.join("node_modules", "@opentelemetry", "auto-instrumentations-node");
+  const present = fs11.existsSync(path11.join(appRoot, src, pkgDir)) || fs11.existsSync(path11.join(appRoot, pkgDir));
   if (!present) return {};
   return {
     NODE_OPTIONS: { value: "--import @opentelemetry/auto-instrumentations-node/register" },
@@ -3382,26 +3586,26 @@ function localPlatformEnv(tenant, appName, serviceName) {
   return env;
 }
 function isDagsterWorkspaceRoot(appRoot) {
-  if (fs10.existsSync(path10.join(appRoot, "dg.toml"))) return true;
-  const pyproject = path10.join(appRoot, "pyproject.toml");
-  if (!fs10.existsSync(pyproject)) return false;
+  if (fs11.existsSync(path11.join(appRoot, "dg.toml"))) return true;
+  const pyproject = path11.join(appRoot, "pyproject.toml");
+  if (!fs11.existsSync(pyproject)) return false;
   try {
-    return /^\s*\[tool\.dg[\].]/m.test(fs10.readFileSync(pyproject, "utf-8"));
+    return /^\s*\[tool\.dg[\].]/m.test(fs11.readFileSync(pyproject, "utf-8"));
   } catch {
     return false;
   }
 }
 function resolveDgBinary(appRoot) {
   for (const candidate of ["deployments/local/.venv/bin/dg", ".venv/bin/dg"]) {
-    if (fs10.existsSync(path10.join(appRoot, candidate))) return candidate;
+    if (fs11.existsSync(path11.join(appRoot, candidate))) return candidate;
   }
   return "dg";
 }
 function hasDevScript(dir) {
-  const pkgPath = path10.join(dir, "package.json");
-  if (!fs10.existsSync(pkgPath)) return false;
+  const pkgPath = path11.join(dir, "package.json");
+  if (!fs11.existsSync(pkgPath)) return false;
   try {
-    const pkg = JSON.parse(fs10.readFileSync(pkgPath, "utf-8"));
+    const pkg = JSON.parse(fs11.readFileSync(pkgPath, "utf-8"));
     return typeof pkg?.scripts?.dev === "string";
   } catch {
     return false;
@@ -3409,14 +3613,14 @@ function hasDevScript(dir) {
 }
 function detectLocalServices(appRoot) {
   const services = {};
-  for (const entry of fs10.readdirSync(appRoot, { withFileTypes: true })) {
+  for (const entry of fs11.readdirSync(appRoot, { withFileTypes: true })) {
     if (!entry.isDirectory() || entry.name.startsWith(".") || entry.name === "node_modules") continue;
-    if (hasDevScript(path10.join(appRoot, entry.name))) {
+    if (hasDevScript(path11.join(appRoot, entry.name))) {
       services[entry.name] = { src: entry.name };
     }
   }
   if (Object.keys(services).length === 0 && hasDevScript(appRoot)) {
-    services[path10.basename(appRoot)] = { src: "." };
+    services[path11.basename(appRoot)] = { src: "." };
   }
   return services;
 }
@@ -3430,15 +3634,15 @@ function buildLocalDevOutput(appRoot, tenant, opts = {}) {
       { remediation: { command: "mesh create-app" } }
     );
   }
-  let appName = path10.basename(appRoot);
+  let appName = path11.basename(appRoot);
   try {
-    const pkg = JSON.parse(fs10.readFileSync(path10.join(appRoot, "package.json"), "utf-8"));
+    const pkg = JSON.parse(fs11.readFileSync(path11.join(appRoot, "package.json"), "utf-8"));
     if (typeof pkg?.name === "string" && pkg.name) appName = pkg.name.replace(/^@[^/]+\//, "");
   } catch {
   }
-  const pulumiYaml = path10.join(appRoot, "Pulumi.yaml");
-  if (fs10.existsSync(pulumiYaml)) {
-    const match = fs10.readFileSync(pulumiYaml, "utf-8").match(/^name:\s*(.+)$/m);
+  const pulumiYaml = path11.join(appRoot, "Pulumi.yaml");
+  if (fs11.existsSync(pulumiYaml)) {
+    const match = fs11.readFileSync(pulumiYaml, "utf-8").match(/^name:\s*(.+)$/m);
     if (match?.[1]?.trim()) appName = match[1].trim();
   }
   const services = {};
@@ -3488,7 +3692,7 @@ function buildLocalDevOutput(appRoot, tenant, opts = {}) {
       command: [resolveDgBinary(appRoot), "dev", "-h", "127.0.0.1", "-p", '"$PORT"'],
       env: {
         PORT: { value: String(port) },
-        DAGSTER_HOME: { value: path10.join(appRoot, ".dagster") },
+        DAGSTER_HOME: { value: path11.join(appRoot, ".dagster") },
         ...localPlatformEnv(tenant, appName, "dagster")
       }
     };
@@ -3520,23 +3724,23 @@ function buildLocalDevOutput(appRoot, tenant, opts = {}) {
   };
 }
 function hasStackBacking(appRoot) {
-  const hasOwn = fs10.existsSync(path10.join(appRoot, "Pulumi.yaml")) || fs10.readdirSync(appRoot).some((f) => /^Pulumi\..+\.yaml$/.test(f));
+  const hasOwn = fs11.existsSync(path11.join(appRoot, "Pulumi.yaml")) || fs11.readdirSync(appRoot).some((f) => /^Pulumi\..+\.yaml$/.test(f));
   if (hasOwn) return true;
-  let dir = path10.dirname(appRoot);
+  let dir = path11.dirname(appRoot);
   while (true) {
-    if (fs10.existsSync(path10.join(dir, "Pulumi.yaml"))) return true;
-    if (fs10.existsSync(path10.join(dir, ".git")) || fs10.existsSync(path10.join(dir, "pnpm-workspace.yaml"))) {
-      return fs10.existsSync(path10.join(dir, "Pulumi.yaml"));
+    if (fs11.existsSync(path11.join(dir, "Pulumi.yaml"))) return true;
+    if (fs11.existsSync(path11.join(dir, ".git")) || fs11.existsSync(path11.join(dir, "pnpm-workspace.yaml"))) {
+      return fs11.existsSync(path11.join(dir, "Pulumi.yaml"));
     }
-    const parent = path10.dirname(dir);
+    const parent = path11.dirname(dir);
     if (parent === dir) return false;
     dir = parent;
   }
 }
 function detectLocalTenant(appRoot) {
-  for (const file of fs10.readdirSync(appRoot)) {
+  for (const file of fs11.readdirSync(appRoot)) {
     if (!/^Pulumi\..*\.yaml$/.test(file)) continue;
-    const match = fs10.readFileSync(path10.join(appRoot, file), "utf-8").match(/^\s*mesh:tenant:\s*["']?([A-Za-z0-9-]+)["']?\s*$/m);
+    const match = fs11.readFileSync(path11.join(appRoot, file), "utf-8").match(/^\s*mesh:tenant:\s*["']?([A-Za-z0-9-]+)["']?\s*$/m);
     if (match) return match[1];
   }
   const recorded = findMeshJson(appRoot);
@@ -3553,12 +3757,335 @@ async function ensureLocalPlatformRunning() {
   }
 }
 
-// packages/mesh-cli/src/commands/local/publish-docs.ts
+// packages/mesh-cli/src/commands/local/app-authz.ts
+import { spawnSync } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
-import * as fs11 from "node:fs";
-import * as path11 from "node:path";
-import { execFileSync as execFileSync6 } from "node:child_process";
+import { createRequire } from "node:module";
+import fs12 from "node:fs";
+import path12 from "node:path";
 import { pathToFileURL } from "node:url";
+var LOCAL_APP_SPICEDB_IMAGE = "authzed/spicedb:v1.42.1";
+var LOCAL_APP_SPICEDB_KEY = "local-dev-key";
+var LOCAL_APP_SPICEDB_LABEL = "mesh.local.app-spicedb";
+var LOCAL_STACK_NETWORK = `${COMPOSE_PROJECT}_mesh_network`;
+var STACK = "local";
+var GRPC_PORT_BASE = 50100;
+var HTTP_PORT_BASE = 18100;
+var PORT_SLOTS = 100;
+function readLocalAuthzConfig(appRoot) {
+  try {
+    const pkg = JSON.parse(fs12.readFileSync(path12.join(appRoot, "package.json"), "utf-8"));
+    const schema = pkg?.mesh?.authz?.schema;
+    if (typeof schema !== "string" || !schema.trim()) return null;
+    return { schema: schema.trim(), prebuilt: pkg?.mesh?.authz?.metadata !== void 0 };
+  } catch {
+    return null;
+  }
+}
+var slug = (name, sep3) => name.toLowerCase().replace(/[^a-z0-9]+/g, sep3).replace(new RegExp(`^\\${sep3}+|\\${sep3}+$`, "g"), "");
+function appSpiceDBSlot(app) {
+  return createHash2("sha256").update(app).digest().readUInt32BE(0) % PORT_SLOTS;
+}
+function appSpiceDBPorts(slot) {
+  const s = (slot % PORT_SLOTS + PORT_SLOTS) % PORT_SLOTS;
+  return { grpc: GRPC_PORT_BASE + s, http: HTTP_PORT_BASE + s };
+}
+var appSpiceDBContainerName = (app) => `mesh-local-spicedb-${slug(app, "-")}`;
+var appSpiceDBDatabase = (app) => `spicedb_${slug(app, "_")}`.slice(0, 63);
+var appSpiceDBSecretName = (tenant, env, app) => `mesh/${tenant}/${env}/${app}/spicedb/preshared-key`;
+var spicedbInstanceParam = (tenant, env, instanceId) => `/mesh-platform/${tenant}/${env}/authz/spicedb-instances/${instanceId}`;
+var appAuthzParam = (tenant, env, app) => `/mesh-platform/${tenant}/${env}/apps/${app}/stacks/${STACK}/authz`;
+function instanceRegistryValue(args) {
+  const secret = appSpiceDBSecretName(args.tenant, args.env, args.app);
+  return {
+    grpcEndpoint: `localhost:${args.grpcPort}`,
+    httpEndpoint: `localhost:${args.httpPort}`,
+    namespace: args.app,
+    presharedKeySecretName: secret,
+    configSecretName: secret,
+    owner: { kind: "app", name: args.app }
+  };
+}
+function buildAppAuthzPointer(args) {
+  const existingZitadel = args.existing.zitadel && typeof args.existing.zitadel === "object" ? args.existing.zitadel : {};
+  return {
+    ...args.existing,
+    spicedb: {
+      instanceRefs: args.mode === "policy-engine" && args.instanceId ? [{ instanceId: args.instanceId }] : []
+    },
+    ...args.zitadel || Object.keys(existingZitadel).length > 0 ? { zitadel: { ...existingZitadel, ...args.zitadel ?? {} } } : {},
+    opsHubMetadataRef: args.metadataRef,
+    mode: args.mode
+  };
+}
+function appSpiceDBEnv(args) {
+  return {
+    SPICEDB_ENDPOINT: `localhost:${args.grpcPort}`,
+    SPICEDB_HTTP_ENDPOINT: `http://localhost:${args.httpPort}`,
+    SPICEDB_PRESHARED_KEY: LOCAL_APP_SPICEDB_KEY,
+    SPICEDB_TOKEN: LOCAL_APP_SPICEDB_KEY,
+    AUTHZ_METADATA_SSM_PATH: args.metadataPath
+  };
+}
+var datastoreUri = (app) => `postgres://postgres:postgres@database:5432/${appSpiceDBDatabase(app)}?sslmode=disable`;
+function spicedbMigrateArgs(app) {
+  return [
+    "run",
+    "--rm",
+    "--network",
+    LOCAL_STACK_NETWORK,
+    "-e",
+    "SPICEDB_DATASTORE_ENGINE=postgres",
+    "-e",
+    `SPICEDB_DATASTORE_CONN_URI=${datastoreUri(app)}`,
+    LOCAL_APP_SPICEDB_IMAGE,
+    "datastore",
+    "migrate",
+    "head"
+  ];
+}
+function spicedbServeArgs(app, ports) {
+  return [
+    "run",
+    "-d",
+    "--name",
+    appSpiceDBContainerName(app),
+    "--label",
+    `${LOCAL_APP_SPICEDB_LABEL}=${app}`,
+    "--restart",
+    "unless-stopped",
+    "--network",
+    LOCAL_STACK_NETWORK,
+    "-p",
+    `127.0.0.1:${ports.grpc}:50051`,
+    "-p",
+    `127.0.0.1:${ports.http}:8443`,
+    "-e",
+    `SPICEDB_GRPC_PRESHARED_KEY=${LOCAL_APP_SPICEDB_KEY}`,
+    "-e",
+    "SPICEDB_DATASTORE_ENGINE=postgres",
+    "-e",
+    `SPICEDB_DATASTORE_CONN_URI=${datastoreUri(app)}`,
+    "-e",
+    "SPICEDB_HTTP_ENABLED=true",
+    // SpiceDB opens 30 datastore connections by default, and every app's
+    // instance shares the stack's Postgres (100 connections in all): a local
+    // app needs a handful.
+    "-e",
+    "SPICEDB_DATASTORE_CONN_POOL_READ_MAX_OPEN=4",
+    "-e",
+    "SPICEDB_DATASTORE_CONN_POOL_READ_MIN_OPEN=1",
+    "-e",
+    "SPICEDB_DATASTORE_CONN_POOL_WRITE_MAX_OPEN=2",
+    "-e",
+    "SPICEDB_DATASTORE_CONN_POOL_WRITE_MIN_OPEN=1",
+    LOCAL_APP_SPICEDB_IMAGE,
+    "serve"
+  ];
+}
+function parseDockerPort(output) {
+  const match = output.trim().split("\n")[0]?.match(/:(\d+)\s*$/);
+  return match ? Number(match[1]) : null;
+}
+var defaultDocker = (args) => {
+  const r = spawnSync("docker", args, { encoding: "utf-8" });
+  return { status: r.status, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+};
+var mustDocker = (docker2, args, what) => {
+  const r = docker2(args);
+  if (r.status !== 0) {
+    throw new MeshCliError(`${what} failed: ${(r.stderr || r.stdout).trim() || `docker exited ${r.status}`}`);
+  }
+  return r.stdout;
+};
+function ensureDatabase(docker2, app) {
+  const container = mustDocker(
+    docker2,
+    [
+      "ps",
+      "-q",
+      "--filter",
+      `label=com.docker.compose.project=${COMPOSE_PROJECT}`,
+      "--filter",
+      "label=com.docker.compose.service=database"
+    ],
+    "Finding the local Postgres"
+  ).trim().split("\n")[0];
+  if (!container) {
+    throw new MeshCliError("The local platform's Postgres is not running.", {
+      remediation: { command: "mesh start" }
+    });
+  }
+  const db = appSpiceDBDatabase(app);
+  const exists = mustDocker(
+    docker2,
+    ["exec", container, "psql", "-U", "postgres", "-tAc", `SELECT 1 FROM pg_database WHERE datname = '${db}'`],
+    `Checking database ${db}`
+  ).trim();
+  if (exists !== "1") {
+    mustDocker(docker2, ["exec", container, "psql", "-U", "postgres", "-c", `CREATE DATABASE "${db}"`], `Creating database ${db}`);
+  }
+}
+async function ensureLocalAppSpiceDB(app, deps = {}) {
+  const docker2 = deps.docker ?? defaultDocker;
+  const portFree = deps.portFree ?? (async (port) => !await probeTcp(port, { timeoutMs: 300 }));
+  const name = appSpiceDBContainerName(app);
+  const state = docker2(["inspect", "-f", "{{.State.Running}}", name]);
+  if (state.status === 0) {
+    if (state.stdout.trim() !== "true") mustDocker(docker2, ["start", name], `Starting ${name}`);
+    const grpcPort = parseDockerPort(mustDocker(docker2, ["port", name, "50051/tcp"], `Reading ${name}'s ports`));
+    const httpPort = parseDockerPort(mustDocker(docker2, ["port", name, "8443/tcp"], `Reading ${name}'s ports`));
+    if (grpcPort && httpPort) return { grpcPort, httpPort, created: false };
+    mustDocker(docker2, ["rm", "-f", name], `Removing ${name}`);
+  }
+  ensureDatabase(docker2, app);
+  mustDocker(docker2, spicedbMigrateArgs(app), `Migrating ${name}'s datastore`);
+  const first = appSpiceDBSlot(app);
+  for (let i = 0; i < PORT_SLOTS; i++) {
+    const ports = appSpiceDBPorts(first + i);
+    if (!await portFree(ports.grpc) || !await portFree(ports.http)) continue;
+    mustDocker(docker2, spicedbServeArgs(app, ports), `Starting ${name}`);
+    return { grpcPort: ports.grpc, httpPort: ports.http, created: true };
+  }
+  throw new MeshCliError(`No free port pair for ${name} in ${GRPC_PORT_BASE}-${GRPC_PORT_BASE + PORT_SLOTS - 1}.`);
+}
+async function writeSpiceDBSchema(httpUrl, zed, opts = {}) {
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const attempts = opts.attempts ?? 30;
+  let last = "";
+  for (let i = 0; i < attempts; i++) {
+    try {
+      const res = await fetchImpl(`${httpUrl}/v1/schema/write`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${LOCAL_APP_SPICEDB_KEY}`, "content-type": "application/json" },
+        body: JSON.stringify({ schema: zed })
+      });
+      if (res.ok) return;
+      last = `${res.status} ${await res.text()}`;
+      if (res.status >= 400 && res.status < 500) break;
+    } catch (err) {
+      last = err instanceof Error ? err.message : String(err);
+    }
+    await new Promise((r) => setTimeout(r, opts.delayMs ?? 500));
+  }
+  throw new MeshCliError(`SpiceDB at ${httpUrl} did not accept the app's schema: ${last}`);
+}
+function removeLocalAppSpiceDBs(docker2 = defaultDocker) {
+  const ids = docker2(["ps", "-aq", "--filter", `label=${LOCAL_APP_SPICEDB_LABEL}`]).stdout.trim().split("\n").filter(Boolean);
+  if (ids.length > 0) docker2(["rm", "-f", ...ids]);
+  return ids;
+}
+var tsxImporter = async (specifier, parentFile) => {
+  let api2;
+  try {
+    api2 = createRequire(parentFile).resolve("tsx/esm/api");
+  } catch {
+    throw new MeshCliError(
+      `Cannot load the app's authz schema: \`tsx\` is not installed in ${path12.dirname(parentFile)}. Add it to the app's devDependencies (\`pnpm add -D tsx\`).`
+    );
+  }
+  const { tsImport } = await import(pathToFileURL(api2).href);
+  return tsImport(specifier, pathToFileURL(parentFile).href);
+};
+var unwrapDefault = (mod) => {
+  const d = mod.default ?? mod.schema;
+  return d && typeof d === "object" && "default" in d && !("namespace" in d) ? d.default : d;
+};
+async function loadAppAuthz(appRoot, schemaRel, importer = tsxImporter) {
+  const file = path12.resolve(appRoot, schemaRel);
+  if (!fs12.existsSync(file)) {
+    throw new MeshCliError(`mesh.authz.schema names ${schemaRel}, which does not exist under ${appRoot}.`);
+  }
+  const schema = unwrapDefault(await importer(pathToFileURL(file).href, file));
+  if (!schema || typeof schema.namespace !== "string") {
+    throw new MeshCliError(`${schemaRel} must export the app's defineSchema(...) result as its default export.`);
+  }
+  const compilers = await importer("@mesh-tech/authz/compilers", file);
+  let chunk;
+  try {
+    const ssm = await importer("@mesh-tech/authz/metadata/ssm", file);
+    if (typeof ssm.chunkSsmValue === "function") chunk = ssm.chunkSsmValue;
+  } catch {
+  }
+  return { schema, compilers, chunk };
+}
+var localParamStore = async () => {
+  const { SSMClient: SSMClient2, GetParameterCommand: GetParameterCommand2, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient2(LOCAL_AWS_CONFIG);
+  return {
+    async get(name) {
+      try {
+        return (await ssm.send(new GetParameterCommand2({ Name: name }))).Parameter?.Value;
+      } catch {
+        return void 0;
+      }
+    },
+    async put(name, value) {
+      await ssm.send(new PutParameterCommand({ Name: name, Value: value, Type: "String", Tier: "Advanced", Overwrite: true }));
+    }
+  };
+};
+async function publishLocalAppAuthz(args, deps = {}) {
+  const env = LOCAL_ENV;
+  const { schema, compilers, chunk } = await loadAppAuthz(args.appRoot, args.schema, deps.importer);
+  const mode = schema.mode === "role-gating" ? "role-gating" : "policy-engine";
+  const params = deps.params ?? await localParamStore();
+  const base = appAuthzParam(args.tenant, env, args.app);
+  const metadataRef = `${base}/ops-hub-metadata`;
+  let instance;
+  if (mode === "policy-engine") {
+    const running = await (deps.ensureSpiceDB ?? ensureLocalAppSpiceDB)(args.app);
+    instance = { grpcPort: running.grpcPort, httpPort: running.httpPort };
+    await (deps.writeSchema ?? writeSpiceDBSchema)(
+      `http://localhost:${instance.httpPort}`,
+      compilers.compileSpiceDBSchema(schema).zed
+    );
+    await (deps.putSecret ?? upsertLocalSecret)(appSpiceDBSecretName(args.tenant, env, args.app), {
+      PRESHARED_KEY: LOCAL_APP_SPICEDB_KEY
+    });
+    await params.put(
+      spicedbInstanceParam(args.tenant, env, args.app),
+      JSON.stringify(instanceRegistryValue({ app: args.app, tenant: args.tenant, env, ...instance }))
+    );
+  }
+  const body = JSON.stringify(compilers.compileOpsHubMetadata(schema));
+  const split = chunk ? chunk(body) : { value: body, parts: [] };
+  for (const [i, part] of split.parts.entries()) await params.put(`${metadataRef}/part-${i}`, part);
+  await params.put(metadataRef, split.value);
+  let existing = {};
+  const raw = await params.get(base);
+  if (raw) {
+    try {
+      const parsed = JSON.parse(raw);
+      if (parsed && typeof parsed === "object") existing = parsed;
+    } catch {
+    }
+  }
+  await params.put(
+    base,
+    JSON.stringify(
+      buildAppAuthzPointer({
+        existing,
+        mode,
+        instanceId: instance ? args.app : void 0,
+        zitadel: args.zitadel,
+        metadataRef
+      })
+    )
+  );
+  return {
+    mode,
+    env: instance ? appSpiceDBEnv({ ...instance, metadataPath: `${base}/metadata` }) : {},
+    ...instance ? { instance } : {}
+  };
+}
+
+// packages/mesh-cli/src/commands/local/publish-docs.ts
+import { createHash as createHash3 } from "node:crypto";
+import * as fs13 from "node:fs";
+import * as path13 from "node:path";
+import { execFileSync as execFileSync6 } from "node:child_process";
+import { pathToFileURL as pathToFileURL2 } from "node:url";
 
 // packages/mesh-cli/src/commands/local/local-spicedb.ts
 var LOCAL_SPICEDB_INSTANCE_ID = "mesh-local";
@@ -3709,14 +4236,14 @@ function zedOf(value) {
   if (typeof zed !== "string" || !zed.trim()) throw new Error("the spicedbSchema export returned no zed schema");
   return zed;
 }
-async function spicedbHttp(path20, body) {
-  const res = await fetch(`${HOST_HTTP}${path20}`, {
+async function spicedbHttp(path23, body) {
+  const res = await fetch(`${HOST_HTTP}${path23}`, {
     method: "POST",
     headers: { Authorization: `Bearer ${LOCAL_SPICEDB_KEY}`, "Content-Type": "application/json" },
     body: JSON.stringify(body)
   });
   const parsed = await res.json().catch(() => ({}));
-  if (!res.ok) throw Object.assign(new Error(`SpiceDB ${path20}: ${res.status} ${parsed.message ?? ""}`.trim()), { status: res.status });
+  if (!res.ok) throw Object.assign(new Error(`SpiceDB ${path23}: ${res.status} ${parsed.message ?? ""}`.trim()), { status: res.status });
   return parsed;
 }
 async function readLocalSpicedbSchema() {
@@ -3853,7 +4380,7 @@ function readLocalPublishDeclaration(pkg, appRoot) {
     }
     if (typeof docs?.config === "string" && docs.config) {
       out.docs = {
-        config: path11.resolve(appRoot, docs.config),
+        config: path13.resolve(appRoot, docs.config),
         actAs: docs.actAs === true,
         ...sandbox?.success ? { sandbox: sandbox.data } : {},
         ...typeof docs.local === "string" && docs.local.includes("#") ? { local: docs.local } : {},
@@ -3883,10 +4410,10 @@ function readLocalPublishDeclaration(pkg, appRoot) {
 }
 async function callExport(appRoot, spec, arg) {
   const [modulePath, exportName] = spec.split("#");
-  const file = path11.resolve(appRoot, modulePath);
+  const file = path13.resolve(appRoot, modulePath);
   let mod;
   if (/\.m?js$/.test(file)) {
-    mod = await import(pathToFileURL(file).href);
+    mod = await import(pathToFileURL2(file).href);
   } else {
     let tsImport;
     try {
@@ -4062,12 +4589,12 @@ async function publishLocalDocs(input) {
     ...local.events ? { events: local.events } : {}
   });
   result.problems.push(...built.problems);
-  const config = parseDocsConfig(fs11.readFileSync(docs.config, "utf8"), docs.config);
+  const config = parseDocsConfig(fs13.readFileSync(docs.config, "utf8"), docs.config);
   const { S3Client, PutObjectCommand } = await import("@aws-sdk/client-s3");
   const s3 = new S3Client({ ...awsConfig, forcePathStyle: true });
   const specKey = `api-docs/${app}/openapi.json`;
   const sourceKey = docsSourceKey(app);
-  const specText = fs11.readFileSync(built.specPath, "utf8");
+  const specText = fs13.readFileSync(built.specPath, "utf8");
   await s3.send(new PutObjectCommand({ Bucket: ARTIFACTS_BUCKET, Key: specKey, Body: specText, ContentType: "application/json" }));
   await s3.send(new PutObjectCommand({ Bucket: ARTIFACTS_BUCKET, Key: sourceKey, Body: built.json, ContentType: "application/json" }));
   if (docs.actAs) {
@@ -4084,7 +4611,7 @@ async function publishLocalDocs(input) {
     ...config.description ? { description: config.description } : {},
     docs: {
       url: `s3://${ARTIFACTS_BUCKET}/${specKey}`,
-      contentHash: createHash2("sha256").update(specText).digest("hex"),
+      contentHash: createHash3("sha256").update(specText).digest("hex"),
       sourceUrl: `s3://${ARTIFACTS_BUCKET}/${sourceKey}`,
       sourceContentHash: built.contentHash
     },
@@ -4233,8 +4760,8 @@ async function ensureLocalApiKey(input) {
 
 // packages/mesh-cli/src/commands/local/docker-runner.ts
 import { execFileSync as execFileSync7 } from "child_process";
-import * as fs12 from "fs";
-import * as path12 from "path";
+import * as fs14 from "fs";
+import * as path14 from "path";
 var DEV_RUNNER_IMAGE = "node:22-bookworm@sha256:5647be709086c696ff32edaaf1c70cd26d1da6ab2b39c32f3c7b4c4a31957e37";
 function sessionDir(sessionName) {
   return meshCacheDir("mesh-local", "dev", sessionName);
@@ -4257,8 +4784,8 @@ function writeDevCompose(sessionName, appRoot, services) {
   ];
   for (const [name, service] of Object.entries(services)) {
     const env = service.env ?? {};
-    fs12.writeFileSync(path12.join(dir, `${name}.env`), renderDockerEnvFile(env), { mode: 384 });
-    const workdir = path12.posix.join("/workspace", service.src === "." ? "" : service.src);
+    fs14.writeFileSync(path14.join(dir, `${name}.env`), renderDockerEnvFile(env), { mode: 384 });
+    const workdir = path14.posix.join("/workspace", service.src === "." ? "" : service.src);
     const ship = env.OTEL_RESOURCE_ATTRIBUTES ? ` 2>&1 | NODE_OPTIONS= node /mesh-assets/log-shipper.mjs` : "";
     blocks.push(
       `  ${name}:`,
@@ -4267,7 +4794,7 @@ function writeDevCompose(sessionName, appRoot, services) {
       `    working_dir: ${workdir}`,
       `    volumes:`,
       `      - '${appRoot}:/workspace'`,
-      `      - '${path12.dirname(shipper)}:/mesh-assets:ro'`,
+      `      - '${path14.dirname(shipper)}:/mesh-assets:ro'`,
       `    environment:`,
       // node_modules is the HOST's bind-mounted install — pnpm inside the
       // container must never "verify" it and try a purge/reinstall (pnpm
@@ -4283,12 +4810,12 @@ function writeDevCompose(sessionName, appRoot, services) {
       `    restart: unless-stopped`
     );
   }
-  const composePath = path12.join(dir, "compose.yml");
-  fs12.writeFileSync(composePath, blocks.join("\n") + "\n");
+  const composePath = path14.join(dir, "compose.yml");
+  fs14.writeFileSync(composePath, blocks.join("\n") + "\n");
   return composePath;
 }
 function composeArgs(sessionName, args) {
-  return ["compose", "-p", sessionName, "-f", path12.join(sessionDir(sessionName), "compose.yml"), ...args];
+  return ["compose", "-p", sessionName, "-f", path14.join(sessionDir(sessionName), "compose.yml"), ...args];
 }
 function dockerDevUp(sessionName) {
   execFileSync7("docker", composeArgs(sessionName, ["up", "-d"]), {
@@ -4361,10 +4888,173 @@ function rewriteClusterHostsToLocal(devOutput) {
 }
 
 // packages/mesh-cli/src/commands/dev-doctor.ts
-import { execFileSync as execFileSync8 } from "node:child_process";
-import * as fs13 from "node:fs";
+import { execFileSync as execFileSync9 } from "node:child_process";
+import * as fs16 from "node:fs";
 import * as net2 from "node:net";
-import * as path13 from "node:path";
+import * as path16 from "node:path";
+
+// packages/mesh-cli/src/commands/dev-env-leaks.ts
+import { execFileSync as execFileSync8 } from "node:child_process";
+import * as fs15 from "node:fs";
+import * as path15 from "node:path";
+var LEAK_NAME_PATTERNS = [
+  /^WORKSPACES_/,
+  /^AWS_/,
+  /^TEMPORAL_/,
+  /^VCS_/,
+  /_TOKEN$/,
+  /_SECRET$/,
+  /_KEY$/,
+  /_PASSWORD$/
+];
+function matchesLeakPattern(name) {
+  return LEAK_NAME_PATTERNS.some((re) => re.test(name));
+}
+function parseTmuxEnvironment(text) {
+  const out = {};
+  for (const line of text.split("\n")) {
+    if (!line || line.startsWith("-")) continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    const name = line.slice(0, eq);
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) continue;
+    out[name] = line.slice(eq + 1);
+  }
+  return out;
+}
+function classifyLeak(name, envFileKeysByService, cleanLaunch) {
+  const services = Object.keys(envFileKeysByService).sort();
+  const shadowedIn = services.filter((svc) => envFileKeysByService[svc].includes(name));
+  const unshadowedIn = services.filter((svc) => !shadowedIn.includes(svc));
+  if (cleanLaunch === false) {
+    if (services.length > 0 && unshadowedIn.length === 0) return { fate: "shadowed", shadowedIn, unshadowedIn };
+    return { fate: "reaches", shadowedIn, unshadowedIn };
+  }
+  if (isAllowedLaunchHostVar(name)) return { fate: "reaches", shadowedIn, unshadowedIn };
+  if (services.length === 0) return { fate: "dropped", shadowedIn, unshadowedIn };
+  if (unshadowedIn.length === 0) return { fate: "shadowed", shadowedIn, unshadowedIn };
+  if (shadowedIn.length === 0) return { fate: "dropped", shadowedIn, unshadowedIn };
+  return { fate: "partial", shadowedIn, unshadowedIn };
+}
+function collectLeakCandidates(input) {
+  const names = /* @__PURE__ */ new Map();
+  for (const name of Object.keys(input.tmuxGlobal)) {
+    if (matchesLeakPattern(name)) names.set(name, ["tmux-global"]);
+  }
+  for (const [name, value] of Object.entries(input.shell)) {
+    if (value === void 0 || !matchesLeakPattern(name)) continue;
+    const sources = names.get(name) ?? [];
+    if (!sources.includes("shell")) sources.push("shell");
+    names.set(name, sources);
+  }
+  return [...names.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([name, sources]) => ({
+    name,
+    sources,
+    ...classifyLeak(name, input.envFileKeysByService, input.cleanLaunch)
+  }));
+}
+function redactValue(value) {
+  if (value.length === 0) return "(empty)";
+  if (value.length <= 8) return "\u2022\u2022\u2022\u2022";
+  return `${value.slice(0, 4)}\u2026(${value.length} chars)`;
+}
+var FATE_LABEL = {
+  reaches: "REACHES SERVICES",
+  shadowed: "shadowed by the env file",
+  dropped: "dropped by the clean launch",
+  partial: "shadowed for some services, dropped for others"
+};
+var SOURCE_LABEL = {
+  "tmux-global": "tmux -g",
+  shell: "shell"
+};
+function renderLeakLines(candidates, input) {
+  return candidates.map((c) => {
+    const values = c.sources.map((src) => {
+      const value = src === "tmux-global" ? input.tmuxGlobal[c.name] : input.shell[c.name];
+      return `${SOURCE_LABEL[src]}: ${redactValue(value ?? "")}`;
+    });
+    let fate = FATE_LABEL[c.fate];
+    if (c.fate === "partial") {
+      fate = `shadowed for ${c.shadowedIn.join(", ")}; dropped for ${c.unshadowedIn.join(", ")}`;
+    } else if (c.fate === "reaches" && input.cleanLaunch !== false && isAllowedLaunchHostVar(c.name)) {
+      fate = `${fate} (allow-listed host variable)`;
+    }
+    return `${c.name}  [${values.join("; ")}]  \u2192 ${fate}`;
+  });
+}
+function readTmuxGlobalEnvironment() {
+  try {
+    const text = execFileSync8("tmux", ["show-environment", "-g"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    return parseTmuxEnvironment(text);
+  } catch {
+    return {};
+  }
+}
+function readSessionEnvFileKeys(sessionName, serviceNames) {
+  const dir = getSessionEnvDir(sessionName);
+  const out = {};
+  for (const name of serviceNames) {
+    const file = path15.join(dir, envFileName(name));
+    if (!fs15.existsSync(file)) continue;
+    out[name] = envFileKeys(fs15.readFileSync(file, "utf8"));
+  }
+  return out;
+}
+var envLeaksCheck = {
+  id: "env-leaks",
+  title: "Inherited environment",
+  // On demand only: launch preflight has no env files yet, and the launch is
+  // clean regardless — the question this answers is "what would a service
+  // have seen", which is worth asking when something looks wrong, not on
+  // every start.
+  phases: ["ondemand"],
+  async run(ctx) {
+    const state = ctx.sessionState;
+    const services = state?.devOutput.services ? Object.entries(state.devOutput.services).filter(([, svc]) => svc.command && svc.command.length > 0).map(([name]) => name) : [];
+    const input = {
+      tmuxGlobal: readTmuxGlobalEnvironment(),
+      shell: process.env,
+      envFileKeysByService: state ? readSessionEnvFileKeys(ctx.sessionName, services) : {},
+      cleanLaunch: state ? state.cleanEnv === true : null
+    };
+    const candidates = collectLeakCandidates(input);
+    if (candidates.length === 0) {
+      return {
+        status: "ok",
+        summary: "no WORKSPACES_*/AWS_*/TEMPORAL_*/VCS_*/*_TOKEN/*_SECRET/*_KEY in the tmux global env or this shell"
+      };
+    }
+    const detail = renderLeakLines(candidates, input).join("\n    ");
+    const reaching = candidates.filter((c) => c.fate === "reaches");
+    if (reaching.length > 0 && input.cleanLaunch === false) {
+      return {
+        status: "warn",
+        summary: `${reaching.length} of ${candidates.length} inherited variable(s) reach the services \u2014 this session predates the clean launch`,
+        detail,
+        remediation: "mesh dev   # relaunch: services then start under env -i with only their env file"
+      };
+    }
+    if (reaching.length > 0) {
+      return {
+        status: "warn",
+        summary: `${reaching.length} of ${candidates.length} inherited variable(s) reach the services via the host allow-list`,
+        detail
+      };
+    }
+    const where = state ? "services launched clean" : "no session; the next launch is clean";
+    return {
+      status: "ok",
+      summary: `${candidates.length} inherited variable(s) found, none reach the services (${where}) \u2014 each is shadowed by the env file or dropped by env -i`,
+      detail
+    };
+  }
+};
+
+// packages/mesh-cli/src/commands/dev-doctor.ts
 function aggregateStatus(results) {
   if (results.some((r) => r.status === "error")) return "error";
   if (results.some((r) => r.status === "warn")) return "warn";
@@ -4532,9 +5222,9 @@ function parsePortSquatter(lsofOut, psOut) {
   return { pid, command };
 }
 function sharesWorktreeRoot(serviceSrc, repoRoot) {
-  const src = path13.resolve(serviceSrc);
-  const root = path13.resolve(repoRoot);
-  return src === root || src.startsWith(root + path13.sep);
+  const src = path16.resolve(serviceSrc);
+  const root = path16.resolve(repoRoot);
+  return src === root || src.startsWith(root + path16.sep);
 }
 function classifyPortListener(listenerPid, sessionPids) {
   if (listenerPid === null) return "dead";
@@ -4563,7 +5253,7 @@ function collectSessionPids(panePids, psOut) {
 }
 function whoHasPort(port) {
   try {
-    const lsof = execFileSync8("lsof", ["-ti", `:${port}`], {
+    const lsof = execFileSync9("lsof", ["-ti", `:${port}`], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -4571,7 +5261,7 @@ function whoHasPort(port) {
     if (!pid) return null;
     let ps = "";
     try {
-      ps = execFileSync8("ps", ["-o", "comm=", "-p", pid], {
+      ps = execFileSync9("ps", ["-o", "comm=", "-p", pid], {
         encoding: "utf8",
         stdio: ["ignore", "pipe", "ignore"]
       });
@@ -4585,7 +5275,7 @@ function whoHasPort(port) {
 function sessionProcessTree(sessionName) {
   let panePids;
   try {
-    const out = execFileSync8(
+    const out = execFileSync9(
       "tmux",
       ["list-panes", "-s", "-t", sessionName, "-F", "#{pane_pid}"],
       { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }
@@ -4597,7 +5287,7 @@ function sessionProcessTree(sessionName) {
   if (panePids.length === 0) return /* @__PURE__ */ new Set();
   let psOut = "";
   try {
-    psOut = execFileSync8("ps", ["-eo", "pid=,ppid="], {
+    psOut = execFileSync9("ps", ["-eo", "pid=,ppid="], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -4606,28 +5296,159 @@ function sessionProcessTree(sessionName) {
   }
   return collectSessionPids(panePids, psOut);
 }
-var tmuxCheck = {
-  id: "tmux",
-  title: "tmux",
-  phases: ["preflight", "ondemand"],
-  async run() {
-    try {
-      execFileSync8("which", ["tmux"], { stdio: "ignore" });
-      return { status: "ok", summary: "installed" };
-    } catch {
-      return {
-        status: "error",
-        summary: "tmux is not installed",
-        remediation: "brew install tmux"
-      };
-    }
+function paneProcessQuery(command, args) {
+  return execFileSync9(command, args, {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"]
+  });
+}
+function listSessionWindowNames(sessionName, query) {
+  try {
+    const raw = query("tmux", ["list-windows", "-t", sessionName, "-F", "#{window_name}"]);
+    return new Set(
+      raw.trim().split("\n").map((line) => line.trim()).filter(Boolean)
+    );
+  } catch {
+    return null;
   }
-};
-var portsCheck = {
-  id: "ports",
-  title: "Ports",
-  phases: ["preflight", "ondemand"],
-  async run(ctx) {
+}
+function parseOptionalNumber(field) {
+  if (field === void 0 || field === "") return null;
+  const n = Number(field);
+  return Number.isFinite(n) ? n : null;
+}
+function classifyPaneLiveness(target, query) {
+  let raw;
+  try {
+    raw = query("tmux", [
+      "display",
+      "-p",
+      "-t",
+      target,
+      "#{pane_dead}|#{pane_dead_status}|#{pane_pid}|#{window_activity}"
+    ]);
+  } catch {
+    return { state: "unknown", reason: `tmux could not report the pane at '${target}'` };
+  }
+  const [dead, deadStatus, pidStr, activityStr] = raw.trim().split("|");
+  const lastActivityEpoch = parseOptionalNumber(activityStr);
+  if (dead === "1") {
+    return { state: "exited", exitCode: parseOptionalNumber(deadStatus), lastActivityEpoch };
+  }
+  const pid = Number(pidStr);
+  if (!Number.isInteger(pid) || pid <= 0) {
+    return { state: "unknown", reason: `tmux reported no pane pid for '${target}'` };
+  }
+  let psOut;
+  try {
+    psOut = query("ps", ["-eo", "pid=,ppid="]);
+  } catch {
+    return paneChildrenViaPgrep(pid, lastActivityEpoch, query);
+  }
+  return collectSessionPids([pid], psOut).size > 1 ? { state: "running" } : { state: "exited", exitCode: null, lastActivityEpoch };
+}
+function paneChildrenViaPgrep(pid, lastActivityEpoch, query) {
+  try {
+    return query("pgrep", ["-P", String(pid)]).trim().length > 0 ? { state: "running" } : { state: "exited", exitCode: null, lastActivityEpoch };
+  } catch (err) {
+    if (err.status === 1) {
+      return { state: "exited", exitCode: null, lastActivityEpoch };
+    }
+    return { state: "unknown", reason: "could not read the process table (ps, pgrep)" };
+  }
+}
+function classifySessionServices(sessionName, services, query) {
+  const windows = listSessionWindowNames(sessionName, query);
+  const result = /* @__PURE__ */ new Map();
+  for (const [name, svc] of Object.entries(services)) {
+    if (!svc.command || svc.command.length === 0) continue;
+    if (windows === null) {
+      result.set(name, {
+        state: "unknown",
+        reason: `could not list the windows of session '${sessionName}' (tmux)`
+      });
+      continue;
+    }
+    if (!windows.has(name)) {
+      result.set(name, { state: "exited", exitCode: null, lastActivityEpoch: null });
+      continue;
+    }
+    result.set(name, classifyPaneLiveness(`${sessionName}:${name}`, query));
+  }
+  return result;
+}
+function describePaneExit(liveness) {
+  if (liveness.exitCode !== null) return `exit ${liveness.exitCode}`;
+  if (liveness.lastActivityEpoch !== null) {
+    return `no live process (last output ${new Date(liveness.lastActivityEpoch * 1e3).toISOString()})`;
+  }
+  return "no live process";
+}
+function servicesLivenessToResult(liveness) {
+  const total = liveness.size;
+  const dead = [];
+  const unknown = [];
+  for (const [name, l] of liveness.entries()) {
+    if (l.state === "exited") dead.push([name, l]);
+    else if (l.state === "unknown") unknown.push([name, l]);
+  }
+  if (dead.length === 0 && unknown.length === 0) {
+    return { status: "ok", summary: `all ${total} service process(es) running` };
+  }
+  if (dead.length > 0) {
+    return {
+      status: "error",
+      summary: `${dead.length} of ${total} service process(es) not running`,
+      detail: dead.map(([name, l]) => `${name} \u2014 ${describePaneExit(l)}`).join("; "),
+      remediation: dead.length === 1 ? `mesh dev logs ${dead[0][0]}` : "mesh dev logs <svc> for each service above, then mesh dev restart <svc>"
+    };
+  }
+  return {
+    status: "warn",
+    summary: `could not determine liveness for ${unknown.length} of ${total} service(s)`,
+    detail: unknown.map(([name, l]) => `${name} \u2014 ${l.reason}`).join("; ")
+  };
+}
+var servicesCheck = {
+  // On-demand only: at preflight (launch) the services are only starting, and
+  // their liveness is what `mesh dev --status` reports live.
+  id: "services",
+  title: "Service processes",
+  phases: ["ondemand"],
+  async run(ctx) {
+    const services = ctx.sessionState?.devOutput.services;
+    if (!services || Object.keys(services).length === 0) {
+      return { status: "ok", summary: "no session \u2014 services start at launch" };
+    }
+    const liveness = classifySessionServices(ctx.sessionName, services, paneProcessQuery);
+    if (liveness.size === 0) {
+      return { status: "ok", summary: "no locally-run services in this session" };
+    }
+    return servicesLivenessToResult(liveness);
+  }
+};
+var tmuxCheck = {
+  id: "tmux",
+  title: "tmux",
+  phases: ["preflight", "ondemand"],
+  async run() {
+    try {
+      execFileSync9("which", ["tmux"], { stdio: "ignore" });
+      return { status: "ok", summary: "installed" };
+    } catch {
+      return {
+        status: "error",
+        summary: "tmux is not installed",
+        remediation: "brew install tmux"
+      };
+    }
+  }
+};
+var portsCheck = {
+  id: "ports",
+  title: "Ports",
+  phases: ["preflight", "ondemand"],
+  async run(ctx) {
     const services = ctx.sessionState?.devOutput.services;
     if (!services || Object.keys(services).length === 0) {
       return {
@@ -4690,14 +5511,14 @@ var configStalenessCheck = {
     if (!state) {
       return { status: "ok", summary: "no session \u2014 config read fresh at launch" };
     }
-    const configPath = path13.join(ctx.appRoot, `Pulumi.${ctx.stack}.yaml`);
-    if (!fs13.existsSync(configPath)) {
+    const configPath = path16.join(ctx.appRoot, `Pulumi.${ctx.stack}.yaml`);
+    if (!fs16.existsSync(configPath)) {
       return {
         status: "ok",
         summary: `no Pulumi.${ctx.stack}.yaml to compare`
       };
     }
-    const mtimeMs = fs13.statSync(configPath).mtimeMs;
+    const mtimeMs = fs16.statSync(configPath).mtimeMs;
     if (isConfigStale(mtimeMs, state.startedAt)) {
       return {
         status: "warn",
@@ -4720,7 +5541,7 @@ var worktreeCheck = {
     }
     let repoRoot;
     try {
-      repoRoot = execFileSync8("git", ["rev-parse", "--show-toplevel"], {
+      repoRoot = execFileSync9("git", ["rev-parse", "--show-toplevel"], {
         cwd: ctx.appRoot,
         encoding: "utf8",
         stdio: ["ignore", "pipe", "ignore"]
@@ -4868,9 +5689,11 @@ var ALL_CHECKS = [
   registryCheck,
   configStalenessCheck,
   portsCheck,
+  servicesCheck,
   worktreeCheck,
   tunnelsCheck,
-  temporalCheck
+  temporalCheck,
+  envLeaksCheck
 ];
 async function runDoctor(ctx, opts) {
   const results = await runChecks(ctx, "ondemand", ALL_CHECKS);
@@ -4885,10 +5708,75 @@ ${ICONS[status]} overall: ${status}`);
   return status;
 }
 
+// packages/mesh-cli/src/commands/dev-readiness.ts
+var TEMPORAL_WORKER_RUNNING = /Worker state changed[\s\S]{0,400}?state: 'RUNNING'/;
+var RESTART_READY_TIMEOUT_MS = 6e4;
+var RESTART_ALIVE_GRACE_MS = 1e4;
+var RESTART_START_WINDOW_MS = 5e3;
+async function awaitServiceReadiness(target, probe) {
+  const timeoutMs = target.timeoutMs ?? RESTART_READY_TIMEOUT_MS;
+  const intervalMs = target.intervalMs ?? 500;
+  const graceMs = Math.min(target.graceMs ?? RESTART_ALIVE_GRACE_MS, timeoutMs);
+  const startWindowMs = Math.min(target.startWindowMs ?? RESTART_START_WINDOW_MS, timeoutMs);
+  const portIsSignal = target.port > 0 && !target.portHeldBeforeStart;
+  const hasSignal = portIsSignal || target.readyMarker !== void 0;
+  const start = probe.now();
+  for (; ; ) {
+    const afterMs = probe.now() - start;
+    const liveness = probe.liveness();
+    if (liveness.state === "exited") {
+      if (afterMs >= startWindowMs) {
+        return { state: "exited", liveness, afterMs, output: probe.paneOutput() };
+      }
+      await probe.sleep(Math.min(intervalMs, startWindowMs - afterMs));
+      continue;
+    }
+    const blind = liveness.state === "unknown";
+    if (portIsSignal && await probe.portAccepts(target.port)) {
+      return { state: "ready", via: "port", afterMs };
+    }
+    if (target.readyMarker && target.readyMarker.test(probe.paneOutput())) {
+      return { state: "ready", via: "marker", afterMs };
+    }
+    if (!hasSignal) {
+      if (blind) return { state: "unknown", reason: liveness.reason };
+      if (afterMs >= graceMs) {
+        return target.portHeldBeforeStart ? { state: "port-held", afterMs, output: probe.paneOutput() } : { state: "ready", via: "alive", afterMs };
+      }
+    }
+    if (afterMs >= timeoutMs) {
+      if (blind && liveness.state === "unknown") {
+        return { state: "unknown", reason: `${liveness.reason}; and no readiness signal in ${timeoutMs}ms` };
+      }
+      return hasSignal ? { state: "pending", afterMs, output: probe.paneOutput() } : { state: "ready", via: "alive", afterMs };
+    }
+    await probe.sleep(Math.min(intervalMs, timeoutMs - afterMs));
+  }
+}
+async function portHeldByAnother(port, probe, settleMs = 3e3, intervalMs = 250) {
+  if (port <= 0) return false;
+  const start = probe.now();
+  for (; ; ) {
+    if (!await probe.portAccepts(port)) return false;
+    if (probe.now() - start >= settleMs) return true;
+    await probe.sleep(intervalMs);
+  }
+}
+function paneTail(output, n = 20) {
+  return output.split("\n").map((line) => line.trimEnd()).filter((line) => line.length > 0).slice(-n);
+}
+function parseWaitSeconds(raw, defaultSeconds) {
+  if (raw === false) return 0;
+  if (raw === void 0 || raw === true) return defaultSeconds;
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n < 0) return defaultSeconds;
+  return n;
+}
+
 // packages/mesh-cli/src/utils/worktree-identity.ts
-import { execFileSync as execFileSync9 } from "node:child_process";
+import { execFileSync as execFileSync10 } from "node:child_process";
 import * as crypto from "node:crypto";
-import * as path14 from "node:path";
+import * as path17 from "node:path";
 var NUM_PORT_BLOCKS = 64;
 var PORT_BLOCK_BASE = 4e4;
 var PORT_BLOCK_SIZE = 40;
@@ -4910,7 +5798,7 @@ function blockBasePort(block) {
 }
 function withAppScopedPortBlock(wt, appRoot) {
   if (wt.isPrimary) return wt;
-  const appHash = worktreeHash(`${wt.worktreeRoot}#${path14.resolve(appRoot)}`);
+  const appHash = worktreeHash(`${wt.worktreeRoot}#${path17.resolve(appRoot)}`);
   return { ...wt, portBlock: portBlockFor(appHash, false) };
 }
 var STACK_SLUG_MAX = 16;
@@ -4922,33 +5810,33 @@ function worktreeStackName(baseName, wt) {
 function stackNeedsWorktreeIsolation(stackName, wt) {
   return !!wt.token && !stackName.endsWith(`-${wt.hash}`);
 }
-var defaultGitRunner = (args, cwd) => execFileSync9("git", args, { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+var defaultGitRunner = (args, cwd) => execFileSync10("git", args, { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim();
 function resolveWorktreeIdentity(cwd = process.cwd(), gitRunner = defaultGitRunner) {
   let worktreeRoot;
   let isPrimary = true;
   try {
-    worktreeRoot = path14.resolve(gitRunner(["rev-parse", "--show-toplevel"], cwd));
+    worktreeRoot = path17.resolve(gitRunner(["rev-parse", "--show-toplevel"], cwd));
     const commonDir = gitRunner(["rev-parse", "--git-common-dir"], cwd);
-    const primaryRoot = path14.resolve(path14.dirname(path14.resolve(cwd, commonDir)));
+    const primaryRoot = path17.resolve(path17.dirname(path17.resolve(cwd, commonDir)));
     isPrimary = worktreeRoot === primaryRoot;
   } catch {
     return {
-      worktreeRoot: path14.resolve(cwd),
+      worktreeRoot: path17.resolve(cwd),
       isPrimary: true,
-      slug: sanitizeSlug(path14.basename(path14.resolve(cwd))),
-      hash: worktreeHash(path14.resolve(cwd)),
+      slug: sanitizeSlug(path17.basename(path17.resolve(cwd))),
+      hash: worktreeHash(path17.resolve(cwd)),
       token: "",
       portBlock: 0,
       taskQueueSuffix: ""
     };
   }
-  const slug = sanitizeSlug(path14.basename(worktreeRoot));
+  const slug2 = sanitizeSlug(path17.basename(worktreeRoot));
   const hash = worktreeHash(worktreeRoot);
-  const token = isPrimary ? "" : `${slug}-${hash}`;
+  const token = isPrimary ? "" : `${slug2}-${hash}`;
   return {
     worktreeRoot,
     isPrimary,
-    slug,
+    slug: slug2,
     hash,
     token,
     portBlock: portBlockFor(hash, isPrimary),
@@ -4980,6 +5868,9 @@ function registerServiceProbes(devOutput, tenant, probeFiles) {
 function deriveSessionName(projectName, wt) {
   return wt.isPrimary ? `${projectName}-dev` : `${projectName}-${wt.slug}`;
 }
+function sessionNameFor(appRoot, explicit) {
+  return explicit ?? deriveSessionName(getProjectName(appRoot), resolveWorktreeIdentity(appRoot));
+}
 function printDevPlan(sessionName, appRoot, wt, devOutput) {
   const kind = wt.isPrimary ? "primary checkout" : `linked worktree (block ${wt.portBlock})`;
   console.log(`
@@ -5002,9 +5893,9 @@ mesh dev plan \u2014 ${kind}
     console.log(`    (none \u2014 all services are deployed/K8s)`);
   } else {
     const monorepoRoot = findMonorepoRoot();
-    const wtWithSep = wt.worktreeRoot.endsWith(path15.sep) ? wt.worktreeRoot : wt.worktreeRoot + path15.sep;
+    const wtWithSep = wt.worktreeRoot.endsWith(path18.sep) ? wt.worktreeRoot : wt.worktreeRoot + path18.sep;
     for (const [name, s] of locals) {
-      const dir = path15.resolve(appRoot, rebaseServiceSrc(s.src, monorepoRoot));
+      const dir = path18.resolve(appRoot, rebaseServiceSrc(s.src, monorepoRoot));
       const outside = dir !== wt.worktreeRoot && !dir.startsWith(wtWithSep);
       const port = s.port > 0 ? `:${s.port}` : "(no port)";
       console.log(`    ${name.padEnd(18)} ${port.padEnd(7)} ${dir}${outside ? "  \u26A0 OUTSIDE worktree" : ""}`);
@@ -5013,18 +5904,17 @@ mesh dev plan \u2014 ${kind}
   console.log("");
 }
 function getSessionStatePath(sessionName) {
-  const dir = path15.join(os3.tmpdir(), "mesh-dev-sessions");
-  if (!fs14.existsSync(dir)) fs14.mkdirSync(dir, { recursive: true });
-  return path15.join(dir, `${sessionName}.json`);
+  const dir = devSessionsRoot();
+  return path18.join(dir, `${sessionName}.json`);
 }
 function saveSessionState(sessionName, state) {
-  fs14.writeFileSync(getSessionStatePath(sessionName), JSON.stringify(state, null, 2));
+  fs17.writeFileSync(getSessionStatePath(sessionName), JSON.stringify(state, null, 2));
 }
 function loadSessionState(sessionName) {
   const filePath = getSessionStatePath(sessionName);
-  if (!fs14.existsSync(filePath)) return null;
+  if (!fs17.existsSync(filePath)) return null;
   try {
-    return JSON.parse(fs14.readFileSync(filePath, "utf-8"));
+    return JSON.parse(fs17.readFileSync(filePath, "utf-8"));
   } catch {
     return null;
   }
@@ -5038,7 +5928,7 @@ function workflowChangeWouldStrand(priorState, appRoot, force) {
   const current = fingerprintWorkflowSource(appRoot, priorState?.devOutput?.services);
   if (!workflowChanged(prior, current)) return false;
   logWarn(
-    "Workflow code changed since this session started.\n  Restarting the worker replays any in-flight conversations against the NEW code \u2014\n  a replay-incompatible change strands them (they get stuck and become unviewable).\n  Keep it replay-compatible: gate the change with wf.patched() and regenerate the replay\n  goldens (see the temporal-workflow-safety skill), or accept the risk."
+    "Workflow code changed since this session started.\n  Restarting the worker replays any in-flight conversations against the NEW code \u2014\n  a replay-incompatible change strands them (they get stuck and become unviewable).\n  Keep it replay-compatible: gate the change with wf.patched() and commit a frozen\n  taken/not-taken fixture pair for the gate (the temporal-replay skill's patch rule;\n  never regenerate an existing golden), or accept the risk."
   );
   if (force) {
     logWarn("  Proceeding anyway (--force).");
@@ -5047,19 +5937,56 @@ function workflowChangeWouldStrand(priorState, appRoot, force) {
   logError("  Refusing to restart the worker. Re-run with --force once the change is replay-safe.");
   return true;
 }
-function getSessionEnvDir(sessionName) {
-  return path15.join(os3.tmpdir(), "mesh-dev-sessions", sessionName);
-}
 function getServiceEnvFilePath(sessionName, serviceName) {
-  return path15.join(getSessionEnvDir(sessionName), envFileName(serviceName));
+  return path18.join(getSessionEnvDir(sessionName), envFileName(serviceName));
 }
 function removeSessionState(sessionName) {
   try {
-    fs14.unlinkSync(getSessionStatePath(sessionName));
+    fs17.unlinkSync(getSessionStatePath(sessionName));
   } catch {
   }
   try {
-    fs14.rmSync(getSessionEnvDir(sessionName), { recursive: true, force: true });
+    fs17.rmSync(getSessionEnvDir(sessionName), { recursive: true, force: true });
+  } catch {
+  }
+}
+function getSessionPortMemoryPath(sessionName) {
+  return path18.join(path18.dirname(getSessionStatePath(sessionName)), `${sessionName}.ports.json`);
+}
+function loadSessionPortMemory(sessionName) {
+  try {
+    const raw = JSON.parse(fs17.readFileSync(getSessionPortMemoryPath(sessionName), "utf-8"));
+    return rememberedPortsOf(raw);
+  } catch {
+    return {};
+  }
+}
+function sessionPortPlan(sessionName) {
+  const remembered = loadSessionPortMemory(sessionName);
+  const ownPorts = /* @__PURE__ */ new Set();
+  if (sessionExists(sessionName)) {
+    const running = loadSessionState(sessionName)?.devOutput?.services ?? {};
+    for (const [name, port] of Object.entries(remembered)) {
+      if (running[name]?.port === port) ownPorts.add(port);
+    }
+  }
+  return { remembered, ownPorts };
+}
+function rememberedPortsOf(memory) {
+  const out = {};
+  for (const [name, port] of Object.entries(memory?.services ?? {})) {
+    if (Number.isInteger(port) && port > 0) out[name] = port;
+  }
+  return out;
+}
+function saveSessionPortMemory(sessionName, devOutput) {
+  const services = {};
+  for (const [name, svc] of Object.entries(devOutput.services)) {
+    if (svc.port > 0 && svc.command && svc.command.length > 0) services[name] = svc.port;
+  }
+  const memory = { services, savedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  try {
+    fs17.writeFileSync(getSessionPortMemoryPath(sessionName), JSON.stringify(memory, null, 2));
   } catch {
   }
 }
@@ -5108,7 +6035,7 @@ function rewriteOwnServicePort(service, oldPort, newPort) {
     }
   }
 }
-async function allocatePorts(devOutput, worktree) {
+async function allocatePorts(devOutput, worktree, remembered = {}, probes = { isPortFree, findFreePort }, ownPorts = /* @__PURE__ */ new Set()) {
   const allocated = JSON.parse(JSON.stringify(devOutput));
   const usedPorts = /* @__PURE__ */ new Set();
   const portRemaps = /* @__PURE__ */ new Map();
@@ -5118,25 +6045,35 @@ async function allocatePorts(devOutput, worktree) {
     if (service.port <= 0) continue;
     if (!service.command || service.command.length === 0) continue;
     const preferred = service.port;
+    const last = remembered[name];
+    const lastIsUsable = async () => last !== void 0 && last !== preferred && !usedPorts.has(last) && (ownPorts.has(last) || await probes.isPortFree(last));
     let target = -1;
     if (worktree.isPrimary) {
-      if (!usedPorts.has(preferred) && await isPortFree(preferred)) {
+      if (!usedPorts.has(preferred) && await probes.isPortFree(preferred)) {
         target = preferred;
+      } else if (await lastIsUsable()) {
+        target = last;
+        logInfo(`Port ${preferred} busy for service '${name}', reusing last launch's ${target}`);
       } else {
-        target = await findFreePort();
+        target = await probes.findFreePort();
         logWarn(`Port ${preferred} busy for service '${name}', using ${target}`);
       }
+    } else if (await lastIsUsable()) {
+      target = last;
     } else {
+      if (last !== void 0 && last !== preferred) {
+        logWarn(`Port ${last} (this session's last launch) is not available for service '${name}'; allocating another`);
+      }
       for (let i = blockCursor; i < PORT_BLOCK_SERVICE_SUBRANGE; i++) {
         const candidate = blockBase + i;
-        if (!usedPorts.has(candidate) && await isPortFree(candidate)) {
+        if (!usedPorts.has(candidate) && await probes.isPortFree(candidate)) {
           target = candidate;
           blockCursor = i + 1;
           break;
         }
       }
       if (target < 0) {
-        target = await findFreePort();
+        target = await probes.findFreePort();
         logWarn(`Worktree port block exhausted for '${name}', using ${target}`);
       }
     }
@@ -5174,12 +6111,15 @@ function mergePinnedPorts(fresh, pinned) {
     if (!pinnedSvc || typeof pinnedSvc.port !== "number") continue;
     const freshPort = mergedSvc.port;
     mergedSvc.port = pinnedSvc.port;
+    if (typeof freshPort === "number" && freshPort > 0) {
+      rewriteOwnServicePort(mergedSvc, freshPort, pinnedSvc.port);
+      if (freshPort !== pinnedSvc.port) {
+        portRemaps.set(freshPort, pinnedSvc.port);
+      }
+    }
     if (mergedSvc.env?.PORT) {
       mergedSvc.env.PORT.value = String(pinnedSvc.port);
     }
-    if (typeof freshPort === "number" && freshPort > 0 && freshPort !== pinnedSvc.port) {
-      portRemaps.set(freshPort, pinnedSvc.port);
-    }
   }
   rewriteCrossServicePorts(merged, portRemaps);
   rewriteClusterHostsToLocal(merged);
@@ -5187,16 +6127,16 @@ function mergePinnedPorts(fresh, pinned) {
 }
 function findMonorepoRoot() {
   let dir = process.cwd();
-  const root = path15.parse(dir).root;
+  const root = path18.parse(dir).root;
   while (dir !== root) {
-    if (fs14.existsSync(path15.join(dir, "pnpm-workspace.yaml")) || fs14.existsSync(path15.join(dir, "turbo.json"))) {
+    if (fs17.existsSync(path18.join(dir, "pnpm-workspace.yaml")) || fs17.existsSync(path18.join(dir, "turbo.json"))) {
       return dir;
     }
-    const gitPath = path15.join(dir, ".git");
-    if (fs14.existsSync(gitPath)) {
+    const gitPath = path18.join(dir, ".git");
+    if (fs17.existsSync(gitPath)) {
       return dir;
     }
-    dir = path15.dirname(dir);
+    dir = path18.dirname(dir);
   }
   return null;
 }
@@ -5204,40 +6144,40 @@ function discoverApps(monorepoRoot) {
   const apps = [];
   function addApp(appDir, tenant) {
     const projectName = getProjectName(appDir);
-    const stacks = fs14.readdirSync(appDir).filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml").map((f) => f.replace(/^Pulumi\./, "").replace(/\.yaml$/, ""));
+    const stacks = fs17.readdirSync(appDir).filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml").map((f) => f.replace(/^Pulumi\./, "").replace(/\.yaml$/, ""));
     apps.push({
       name: projectName,
       tenant,
       appPath: appDir,
-      relativePath: path15.relative(monorepoRoot, appDir),
+      relativePath: path18.relative(monorepoRoot, appDir),
       stacks
     });
   }
   const searchDirs = ["tenants", "tests/tenants"];
   for (const searchDir of searchDirs) {
-    const base = path15.join(monorepoRoot, searchDir);
-    if (!fs14.existsSync(base)) continue;
-    for (const tenant of fs14.readdirSync(base)) {
-      const appsDir = path15.join(base, tenant, "apps");
-      if (!fs14.existsSync(appsDir) || !fs14.statSync(appsDir).isDirectory()) continue;
-      for (const app of fs14.readdirSync(appsDir)) {
-        const appDir = path15.join(appsDir, app);
-        if (!fs14.existsSync(path15.join(appDir, "Pulumi.yaml"))) continue;
+    const base = path18.join(monorepoRoot, searchDir);
+    if (!fs17.existsSync(base)) continue;
+    for (const tenant of fs17.readdirSync(base)) {
+      const appsDir = path18.join(base, tenant, "apps");
+      if (!fs17.existsSync(appsDir) || !fs17.statSync(appsDir).isDirectory()) continue;
+      for (const app of fs17.readdirSync(appsDir)) {
+        const appDir = path18.join(appsDir, app);
+        if (!fs17.existsSync(path18.join(appDir, "Pulumi.yaml"))) continue;
         addApp(appDir, tenant);
       }
     }
   }
-  const flatAppsDir = path15.join(monorepoRoot, "apps");
-  if (fs14.existsSync(flatAppsDir) && fs14.statSync(flatAppsDir).isDirectory()) {
-    for (const app of fs14.readdirSync(flatAppsDir)) {
-      const appDir = path15.join(flatAppsDir, app);
-      if (!fs14.statSync(appDir).isDirectory()) continue;
-      if (!fs14.existsSync(path15.join(appDir, "Pulumi.yaml"))) continue;
+  const flatAppsDir = path18.join(monorepoRoot, "apps");
+  if (fs17.existsSync(flatAppsDir) && fs17.statSync(flatAppsDir).isDirectory()) {
+    for (const app of fs17.readdirSync(flatAppsDir)) {
+      const appDir = path18.join(flatAppsDir, app);
+      if (!fs17.statSync(appDir).isDirectory()) continue;
+      if (!fs17.existsSync(path18.join(appDir, "Pulumi.yaml"))) continue;
       let tenant = "unknown";
-      const stackConfigs = fs14.readdirSync(appDir).filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml");
+      const stackConfigs = fs17.readdirSync(appDir).filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml");
       if (stackConfigs.length > 0) {
         try {
-          const content = fs14.readFileSync(path15.join(appDir, stackConfigs[0]), "utf-8");
+          const content = fs17.readFileSync(path18.join(appDir, stackConfigs[0]), "utf-8");
           const tenantMatch = content.match(/mesh:tenant:\s*(\S+)/);
           if (tenantMatch) tenant = tenantMatch[1];
         } catch {
@@ -5250,38 +6190,38 @@ function discoverApps(monorepoRoot) {
 }
 function findAppRoot2(appPath) {
   if (appPath) {
-    const resolved = path15.resolve(appPath);
-    if (fs14.existsSync(path15.join(resolved, "Pulumi.yaml"))) return resolved;
+    const resolved = path18.resolve(appPath);
+    if (fs17.existsSync(path18.join(resolved, "Pulumi.yaml"))) return resolved;
     const mono = findMonorepoRoot();
     if (mono) {
-      const fromMono = path15.resolve(mono, appPath);
-      if (fs14.existsSync(path15.join(fromMono, "Pulumi.yaml"))) return fromMono;
+      const fromMono = path18.resolve(mono, appPath);
+      if (fs17.existsSync(path18.join(fromMono, "Pulumi.yaml"))) return fromMono;
     }
     logError(`No Pulumi.yaml found at: ${appPath}`);
     process.exit(1);
   }
   let dir = process.cwd();
-  const root = path15.parse(dir).root;
+  const root = path18.parse(dir).root;
   while (dir !== root) {
-    if (fs14.existsSync(path15.join(dir, "Pulumi.yaml"))) {
+    if (fs17.existsSync(path18.join(dir, "Pulumi.yaml"))) {
       return dir;
     }
-    dir = path15.dirname(dir);
+    dir = path18.dirname(dir);
   }
   return process.cwd();
 }
 function getProjectName(appRoot) {
-  const yamlPath = path15.join(appRoot, "Pulumi.yaml");
-  if (!fs14.existsSync(yamlPath)) return path15.basename(appRoot);
-  const content = fs14.readFileSync(yamlPath, "utf-8");
+  const yamlPath = path18.join(appRoot, "Pulumi.yaml");
+  if (!fs17.existsSync(yamlPath)) return path18.basename(appRoot);
+  const content = fs17.readFileSync(yamlPath, "utf-8");
   const match = content.match(/^name:\s*(.+)$/m);
-  return match?.[1]?.trim() ?? path15.basename(appRoot);
+  return match?.[1]?.trim() ?? path18.basename(appRoot);
 }
 function detectStack(appRoot, stageArg) {
   if (stageArg) return stageArg;
   if (process.env.MESH_STAGE) return process.env.MESH_STAGE;
   try {
-    const result = execFileSync10("pulumi", ["stack", "--show-name"], {
+    const result = execFileSync11("pulumi", ["stack", "--show-name"], {
       cwd: appRoot,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
@@ -5290,7 +6230,7 @@ function detectStack(appRoot, stageArg) {
   } catch {
   }
   try {
-    const files = fs14.readdirSync(appRoot).filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml");
+    const files = fs17.readdirSync(appRoot).filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml");
     if (files.length === 1) {
       const match = files[0].match(/^Pulumi\.(.+)\.yaml$/);
       if (match?.[1]) {
@@ -5304,7 +6244,7 @@ function detectStack(appRoot, stageArg) {
 }
 function stackArgs(appRoot, stack) {
   try {
-    const selected = execFileSync10("pulumi", ["stack", "--show-name"], {
+    const selected = execFileSync11("pulumi", ["stack", "--show-name"], {
       cwd: appRoot,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
@@ -5313,7 +6253,7 @@ function stackArgs(appRoot, stack) {
   } catch {
   }
   try {
-    execFileSync10("pulumi", ["stack", "select", stack], {
+    execFileSync11("pulumi", ["stack", "select", stack], {
       cwd: appRoot,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
@@ -5347,9 +6287,85 @@ function getDevOutput(appRoot, stack, awsEnv) {
     throw new MissingStackOutputError(stack, err);
   }
 }
+function gitCommitOfDir(dir) {
+  const run = (...args) => execFileSync11("git", ["-C", dir, ...args], {
+    encoding: "utf-8",
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: 2e3
+  }).trim();
+  try {
+    const commit = run("rev-parse", "--short=12", "HEAD");
+    if (!commit) return null;
+    const dirty = run("status", "--porcelain").length > 0;
+    return dirty ? `${commit}-dirty` : commit;
+  } catch {
+    return null;
+  }
+}
+function worktreeDigestOfDir(dir) {
+  const run = (cwd, ...args) => execFileSync11("git", ["-C", cwd, ...args], {
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: 1e4,
+    maxBuffer: 256 * 1024 * 1024
+  });
+  try {
+    const top = run(dir, "rev-parse", "--show-toplevel").toString().trim();
+    if (!top) return null;
+    const diff = run(top, "diff", "HEAD", "--no-color", "--no-ext-diff");
+    const untracked = run(top, "ls-files", "--others", "--exclude-standard", "-z").toString().split("\0").filter((f) => f.length > 0).sort();
+    if (diff.length === 0 && untracked.length === 0) return null;
+    const hash = createHash5("sha256").update(diff);
+    for (const file of untracked) {
+      hash.update("\0").update(file).update("\0");
+      try {
+        hash.update(fs17.readFileSync(path18.join(top, file)));
+      } catch {
+      }
+    }
+    return hash.digest("hex").slice(0, 16);
+  } catch {
+    return null;
+  }
+}
+function currentProgramProvenance(appRoot, stack) {
+  let configSha256 = null;
+  try {
+    configSha256 = createHash5("sha256").update(fs17.readFileSync(path18.join(appRoot, `Pulumi.${stack}.yaml`))).digest("hex");
+  } catch {
+  }
+  const gitCommit = gitCommitOfDir(appRoot);
+  const worktreeDigest = gitCommit?.endsWith("-dirty") ? worktreeDigestOfDir(appRoot) : null;
+  return { gitCommit, configSha256, worktreeDigest };
+}
+function devOutputStaleness(recorded, current) {
+  const reasons = [];
+  if (recorded?.gitCommit && current.gitCommit && recorded.gitCommit !== current.gitCommit) {
+    reasons.push(
+      `program is at ${current.gitCommit} but the outputs were deployed from ${recorded.gitCommit}`
+    );
+  } else if (recorded?.gitCommit && current.gitCommit && recorded.worktreeDigest && current.worktreeDigest && recorded.worktreeDigest !== current.worktreeDigest) {
+    reasons.push(
+      `program is at ${current.gitCommit} with different uncommitted changes than the outputs were deployed from`
+    );
+  }
+  if (recorded?.configSha256 && current.configSha256 && recorded.configSha256 !== current.configSha256) {
+    reasons.push("the stack config (Pulumi.<stack>.yaml) changed since the deploy");
+  }
+  return reasons;
+}
+function warnIfDevOutputStale(devOutput, appRoot, stack) {
+  const reasons = devOutputStaleness(
+    devOutput.provenance,
+    currentProgramProvenance(appRoot, stack)
+  );
+  if (reasons.length === 0) return;
+  logWarn(
+    `Stack outputs are older than the program (${reasons.join("; ")}); run \`mesh deploy up --stack ${stack}\` to refresh the dev env.`
+  );
+}
 function hasTmux() {
   try {
-    execFileSync10("which", ["tmux"], { stdio: "ignore" });
+    execFileSync11("which", ["tmux"], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -5357,7 +6373,7 @@ function hasTmux() {
 }
 function sessionExists(name) {
   try {
-    execFileSync10("tmux", ["has-session", "-t", name], { stdio: "ignore" });
+    execFileSync11("tmux", ["has-session", "-t", name], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -5365,7 +6381,7 @@ function sessionExists(name) {
 }
 function killSession(name) {
   try {
-    execFileSync10("tmux", ["kill-session", "-t", name], { stdio: "ignore" });
+    execFileSync11("tmux", ["kill-session", "-t", name], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -5411,9 +6427,9 @@ function buildChildAwsEnv(awsEnv, method, profile, opts) {
   if (method === "zitadel" && opts) {
     const sanitizedContext = opts.context.replace(/[^A-Za-z0-9_-]/g, "-");
     const profileName = `mesh-dev-${sanitizedContext}`;
-    const configPath = path15.join(opts.sessionScratchDir, "aws-config");
+    const configPath = path18.join(opts.sessionScratchDir, "aws-config");
     const region = awsEnv.AWS_REGION ?? awsEnv.AWS_DEFAULT_REGION ?? "";
-    fs14.mkdirSync(opts.sessionScratchDir, { recursive: true });
+    fs17.mkdirSync(opts.sessionScratchDir, { recursive: true });
     const profileBlock = renderCredentialProcessProfile({
       profileName,
       context: opts.context,
@@ -5421,7 +6437,7 @@ function buildChildAwsEnv(awsEnv, method, profile, opts) {
       region,
       meshBin: opts.meshBin
     });
-    const existing = fs14.existsSync(configPath) ? fs14.readFileSync(configPath, "utf8") : "";
+    const existing = fs17.existsSync(configPath) ? fs17.readFileSync(configPath, "utf8") : "";
     const next = upsertManagedAwsConfigSection(
       stripBareProfile(existing, profileName),
       `${opts.context} (mesh dev)`,
@@ -5446,7 +6462,7 @@ function buildChildAwsEnv(awsEnv, method, profile, opts) {
 function readDotEnvFile(file) {
   let text;
   try {
-    text = fs14.readFileSync(file, "utf-8");
+    text = fs17.readFileSync(file, "utf-8");
   } catch {
     return {};
   }
@@ -5479,37 +6495,42 @@ function rebaseServiceSrc(src, monorepoRoot) {
   if (src === "." || src === "./") return src;
   const rel = monorepoRelativeSrc(src);
   if (rel === null) return src;
-  const rebased = path15.join(monorepoRoot, rel);
-  return fs14.existsSync(rebased) ? rebased : src;
+  const rebased = path18.join(monorepoRoot, rel);
+  return fs17.existsSync(rebased) ? rebased : src;
 }
 function isLinkedDependencyDir(serviceDir, appRoot) {
-  let pkgRoot = null;
-  let name = "";
-  for (let dir = serviceDir; ; dir = path15.dirname(dir)) {
+  const pkg = enclosingPackage(serviceDir);
+  return Boolean(pkg && appResolvedPackageDir(pkg.name, appRoot) === pkg.root);
+}
+function enclosingPackage(dir) {
+  for (let at = dir; ; at = path18.dirname(at)) {
     try {
-      const manifest = JSON.parse(fs14.readFileSync(path15.join(dir, "package.json"), "utf8"));
-      if (typeof manifest?.name === "string" && manifest.name) {
-        pkgRoot = dir;
-        name = manifest.name;
-        break;
-      }
+      const manifest = JSON.parse(fs17.readFileSync(path18.join(at, "package.json"), "utf8"));
+      if (typeof manifest?.name === "string" && manifest.name) return { root: at, name: manifest.name };
     } catch {
     }
-    const parent = path15.dirname(dir);
-    if (parent === dir) break;
+    if (path18.dirname(at) === at) return null;
   }
-  if (!pkgRoot) return false;
-  for (let dir = appRoot; ; dir = path15.dirname(dir)) {
+}
+function appResolvedPackageDir(name, appRoot) {
+  for (let dir = appRoot; ; dir = path18.dirname(dir)) {
     try {
-      if (fs14.realpathSync(path15.join(dir, "node_modules", name)) === pkgRoot) return true;
+      return fs17.realpathSync(path18.join(dir, "node_modules", name));
     } catch {
     }
-    const parent = path15.dirname(dir);
-    if (parent === dir) return false;
+    if (path18.dirname(dir) === dir) return null;
   }
 }
+function relinkedServiceDir(serviceDir, appRoot) {
+  const pkg = enclosingPackage(serviceDir);
+  if (!pkg) return null;
+  const own = appResolvedPackageDir(pkg.name, appRoot);
+  if (!own || own === pkg.root) return null;
+  const candidate = path18.join(own, path18.relative(pkg.root, serviceDir));
+  return fs17.existsSync(candidate) ? candidate : null;
+}
 function monorepoRelativeSrc(src) {
-  if (!path15.isAbsolute(src)) return src.replace(/^\.\//, "") || ".";
+  if (!path18.isAbsolute(src)) return src.replace(/^\.\//, "") || ".";
   const m = src.match(/^.*\/mesh-platform(?:\/(.*))?$/);
   if (!m) return null;
   const rest = (m[1] ?? "").replace(/^\.worktrees\/[^/]+(?:\/|$)/, "");
@@ -5523,30 +6544,51 @@ function getServiceEnvVars(service, tunnels) {
       if (spec.tunnel) {
         const tunnel = tunnels[spec.tunnel];
         if (tunnel) {
-          try {
-            const url = new URL(value);
-            if (url.hostname) {
-              url.hostname = tunnel.host;
-              url.port = String(tunnel.port);
-              value = url.toString();
-            } else {
-              value = `${tunnel.host}:${tunnel.port}`;
-            }
-          } catch {
-            value = `${tunnel.host}:${tunnel.port}`;
-          }
+          value = pointAtTunnel(key, value, tunnel);
+          const portKey = portSiblingOf(key);
+          if (portKey && service.env[portKey]) result[portKey] = String(tunnel.port);
         }
       }
-      result[key] = value;
+      if (!(key in result)) result[key] = value;
     }
   }
   return result;
 }
+function portSiblingOf(key) {
+  return key.endsWith("_HOST") ? `${key.slice(0, -"_HOST".length)}_PORT` : void 0;
+}
+function pointAtTunnel(key, value, tunnel) {
+  try {
+    const url = new URL(value);
+    if (url.hostname) {
+      url.hostname = tunnel.host;
+      url.port = String(tunnel.port);
+      return url.toString();
+    }
+  } catch {
+  }
+  if (key.endsWith("_HOST") && !value.includes(":")) return tunnel.host;
+  return `${tunnel.host}:${tunnel.port}`;
+}
 function setTmuxEnv(sessionName, vars) {
   for (const [key, value] of Object.entries(vars)) {
-    execFileSync10("tmux", ["set-environment", "-t", sessionName, key, value], { stdio: "ignore" });
+    execFileSync11("tmux", ["set-environment", "-t", sessionName, key, value], { stdio: "ignore" });
   }
 }
+function readTmuxSessionEnv(sessionName, keys) {
+  const out = {};
+  for (const key of keys) {
+    try {
+      const line = execFileSync11("tmux", ["show-environment", "-t", sessionName, key], {
+        encoding: "utf-8",
+        stdio: ["ignore", "pipe", "ignore"]
+      }).trim();
+      if (line.startsWith(`${key}=`)) out[key] = line.slice(key.length + 1);
+    } catch {
+    }
+  }
+  return out;
+}
 function envPrefix(vars) {
   const entries = Object.entries(vars);
   if (entries.length === 0) return "";
@@ -5557,7 +6599,32 @@ function shellEscape(s) {
   if (/^[a-zA-Z0-9_./:@=+,-]+$/.test(s)) return s;
   return `'${s.replace(/'/g, "'\\''")}'`;
 }
-async function resolveSecrets(secrets) {
+function tunnelForSecret(secretName, tunnels) {
+  return tunnels[secretName] ?? (secretName === "database" ? tunnels["db"] : void 0);
+}
+function pointSecretUrlsAtTunnel(values, tunnel) {
+  if (!tunnel) return values;
+  const out = {};
+  for (const [key, value] of Object.entries(values)) {
+    let rewritten = value;
+    try {
+      const url = new URL(value);
+      if (url.hostname) {
+        url.hostname = tunnel.host === "localhost" ? "127.0.0.1" : tunnel.host;
+        url.port = String(tunnel.port);
+        if (/^postgres(ql)?:$/.test(url.protocol) && !url.searchParams.has("sslmode")) {
+          url.searchParams.set("sslmode", "no-verify");
+          url.searchParams.set("sslaccept", "accept_invalid_certs");
+        }
+        rewritten = url.toString();
+      }
+    } catch {
+    }
+    out[key] = rewritten;
+  }
+  return out;
+}
+async function resolveSecrets(secrets, tunnels) {
   const client = new SecretsManagerClient2({});
   const resolved = {};
   for (const [name, secret] of Object.entries(secrets)) {
@@ -5567,11 +6634,13 @@ async function resolveSecrets(secrets) {
       );
       if (!response.SecretString) continue;
       const values = JSON.parse(response.SecretString);
+      const mapped = {};
       for (const [secretKey, envVar] of Object.entries(secret.envMapping)) {
         const value = values[secretKey];
         if (value === void 0) continue;
-        resolved[envVar] = value;
+        mapped[envVar] = value;
       }
+      Object.assign(resolved, pointSecretUrlsAtTunnel(mapped, tunnelForSecret(name, tunnels)));
       logSuccess(`Secret resolved: ${name} (${secret.secretName})`);
     } catch (err) {
       logWarn(
@@ -5581,11 +6650,15 @@ async function resolveSecrets(secrets) {
   }
   return resolved;
 }
-function resolveTemporalEncodingKey(tenant, env, appName) {
-  const namespace = `${tenant}-${env}-${appName}`;
+function stackNamespace(devOutput) {
+  const tenant = devOutput.platform?.tenant ?? "mesh";
+  const stack = devOutput.stack ?? devOutput.platform?.env ?? "dev";
+  return devOutput.app ? `${tenant}-${stack}-${devOutput.app}` : void 0;
+}
+function resolveTemporalEncodingKey(namespace) {
   const secretName = `${namespace}-temporal-encoding-key`;
   try {
-    const b64 = execFileSync10(
+    const b64 = execFileSync11(
       "kubectl",
       [
         "get",
@@ -5621,18 +6694,20 @@ async function resolveTemporalAuthVars(sessionName, devOutput) {
     setTmuxEnv(sessionName, { KUBECONFIG: kubeconfigPath });
   } else if (!process.env.KUBECONFIG) {
     const existing = sessionKubeconfigPath(sessionName);
-    if (fs14.existsSync(existing)) {
+    if (fs17.existsSync(existing)) {
       process.env.KUBECONFIG = existing;
     }
   }
   let temporalAuthVars = {};
   if (devOutput.tunnels["temporal"]) {
     temporalAuthVars = await resolveTemporalAuth(tenant, platformEnv, devOutput.platform?.name ?? tenant);
-    const appName = devOutput.app ?? "";
-    if (appName) {
-      const encodingKey = resolveTemporalEncodingKey(tenant, platformEnv, appName);
+    const namespace = stackNamespace(devOutput);
+    if (namespace) {
+      const encodingKey = resolveTemporalEncodingKey(namespace);
       if (encodingKey) {
         temporalAuthVars.TEMPORAL_ENCODING_KEY = encodingKey;
+      } else {
+        logInfo(`No deployed encoding key in ${namespace} \u2014 using the stack's dev key from the dev block.`);
       }
     }
     const temporalTunnel = devOutput.tunnels["temporal"];
@@ -5792,13 +6867,29 @@ async function allocateSsmLocalPort(remotePort, reservedPorts) {
 }
 function hasSessionManagerPlugin() {
   try {
-    execFileSync10("which", ["session-manager-plugin"], { stdio: "ignore" });
+    execFileSync11("which", ["session-manager-plugin"], { stdio: "ignore" });
     return true;
   } catch {
     return false;
   }
 }
-async function startSsmTunnels(sessionName, devOutput) {
+var TUNNEL_TO_BASTION_KEY = {
+  temporal: "temporal-frontend",
+  "temporal-ui": "temporal-ui",
+  rds: "rds",
+  db: "rds",
+  database: "rds"
+};
+function bastionServiceForTunnel(tunnelName, tunnel, services) {
+  for (const key of [TUNNEL_TO_BASTION_KEY[tunnelName], tunnelName]) {
+    if (key && services[key]) return { key, endpoint: services[key] };
+  }
+  const byEndpoint = Object.entries(services).find(
+    ([, svc]) => svc.host === tunnel.host && svc.port === tunnel.port
+  );
+  return byEndpoint ? { key: byEndpoint[0], endpoint: byEndpoint[1] } : void 0;
+}
+async function startSsmTunnels(sessionName, devOutput, appRoot, awsEnv) {
   const platformEnv = devOutput.platform?.env ?? "dev";
   const bastionTenant = devOutput.platform?.name ?? "mesh";
   const bastion = await getPlatformBastionInfo(bastionTenant, platformEnv).catch(() => null);
@@ -5815,13 +6906,6 @@ async function startSsmTunnels(sessionName, devOutput) {
     return rewritten;
   }
   logInfo(`Starting ${tunnelCount} SSM tunnel(s) via bastion ${bastion.instanceId}...`);
-  const tunnelToBastionKey = {
-    temporal: "temporal-frontend",
-    "temporal-ui": "temporal-ui",
-    rds: "rds",
-    db: "rds",
-    database: "rds"
-  };
   const OPTIONAL_TUNNEL_NAMES = /* @__PURE__ */ new Set([
     "loki",
     "prometheus",
@@ -5833,9 +6917,10 @@ async function startSsmTunnels(sessionName, devOutput) {
   const skippedOptional = [];
   const reservedPorts = /* @__PURE__ */ new Set();
   const plannedTunnels = [];
-  for (const [tunnelName] of Object.entries(devOutput.tunnels)) {
-    const bastionKey = tunnelToBastionKey[tunnelName] ?? tunnelName;
-    const endpoint = bastion.services[bastionKey];
+  for (const [tunnelName, tunnel] of Object.entries(devOutput.tunnels)) {
+    const matched = bastionServiceForTunnel(tunnelName, tunnel, bastion.services);
+    const bastionKey = matched?.key ?? tunnelName;
+    const endpoint = matched?.endpoint;
     if (!endpoint) {
       if (OPTIONAL_TUNNEL_NAMES.has(tunnelName)) {
         skippedOptional.push(`${tunnelName} (bastion key: ${bastionKey})`);
@@ -5874,6 +6959,7 @@ async function startSsmTunnels(sessionName, devOutput) {
     );
     throw new Error("SSM tunnel fallback unavailable: missing bastion endpoints");
   }
+  const hostEnv = pickLaunchHostEnv(process.env);
   for (const { tunnelName, endpoint, localPort } of plannedTunnels) {
     const windowName = `tunnel-${tunnelName}`;
     const ssmCmd = [
@@ -5891,13 +6977,21 @@ async function startSsmTunnels(sessionName, devOutput) {
         localPortNumber: [String(localPort)]
       })}'`
     ].join(" ");
-    execFileSync10("tmux", ["new-window", "-t", sessionName, "-n", windowName]);
-    execFileSync10(
+    execFileSync11("tmux", ["new-window", "-t", sessionName, "-n", windowName]);
+    execFileSync11(
       "tmux",
       ["set-option", "-t", `${sessionName}:${windowName}`, "remain-on-exit", "on"],
       { stdio: "ignore" }
     );
-    execFileSync10("tmux", ["send-keys", "-t", `${sessionName}:${windowName}`, ssmCmd, "Enter"]);
+    const envFilePath = getServiceEnvFilePath(sessionName, windowName);
+    writeEnvFile(envFilePath, { ...hostEnv, ...awsEnv });
+    execFileSync11("tmux", [
+      "send-keys",
+      "-t",
+      `${sessionName}:${windowName}`,
+      buildLaunchCommand(envFilePath, appRoot, ssmCmd, void 0, hostEnv),
+      "Enter"
+    ]);
     rewritten.tunnels[tunnelName] = {
       host: "localhost",
       port: localPort
@@ -5909,7 +7003,7 @@ async function startSsmTunnels(sessionName, devOutput) {
   return rewritten;
 }
 async function updateDevboxProxy(devOutput, appRoot) {
-  const appName = devOutput.app ?? path15.basename(appRoot);
+  const appName = devOutput.app ?? path18.basename(appRoot);
   const tenant = devOutput.platform?.tenant ?? "mesh";
   const env = devOutput.platform?.env ?? "dev";
   const stack = devOutput.stack ?? "dev";
@@ -5941,7 +7035,7 @@ async function updateDevboxProxy(devOutput, appRoot) {
     lines.push("");
   }
   const caddyfile = lines.join("\n");
-  execFileSync10(
+  execFileSync11(
     "docker",
     [
       "run",
@@ -5957,7 +7051,7 @@ CADDYEOF`
     ],
     { stdio: "pipe" }
   );
-  execFileSync10(
+  execFileSync11(
     "docker",
     [
       "run",
@@ -5987,7 +7081,7 @@ CADDYEOF`
 async function setupSubdomainRouting(devOutput, appRoot) {
   const tsInfo = await getTailscaleInfo();
   if (!tsInfo) return null;
-  const appName = devOutput.app ?? path15.basename(appRoot);
+  const appName = devOutput.app ?? path18.basename(appRoot);
   const stack = devOutput.stack ?? "dev";
   const baseDomain = `${appName}.${stack}.${tsInfo.hostname}.vpn.internal`;
   const platform = devOutput.platform ?? { tenant: "mesh", env: "dev" };
@@ -6006,8 +7100,8 @@ async function setupSubdomainRouting(devOutput, appRoot) {
   } catch {
   }
   const caddyDir = "/tmp/mesh-dev-caddy";
-  const caddyfile = path15.join(caddyDir, "Caddyfile");
-  if (!fs14.existsSync(caddyDir)) fs14.mkdirSync(caddyDir, { recursive: true });
+  const caddyfile = path18.join(caddyDir, "Caddyfile");
+  if (!fs17.existsSync(caddyDir)) fs17.mkdirSync(caddyDir, { recursive: true });
   const caddyLines = [`# mesh-dev: ${appName}/${stack} (${tsInfo.hostname})`, ""];
   for (const [name, service] of Object.entries(devOutput.services)) {
     if (service.port) {
@@ -6025,16 +7119,16 @@ async function setupSubdomainRouting(devOutput, appRoot) {
     caddyLines.push("}");
     caddyLines.push("");
   }
-  fs14.writeFileSync(caddyfile, caddyLines.join("\n"));
+  fs17.writeFileSync(caddyfile, caddyLines.join("\n"));
   let caddyRunning = false;
   try {
-    execFileSync10("pgrep", ["-f", "caddy run.*mesh-dev-caddy"], { stdio: "pipe" });
+    execFileSync11("pgrep", ["-f", "caddy run.*mesh-dev-caddy"], { stdio: "pipe" });
     caddyRunning = true;
   } catch {
   }
   if (caddyRunning) {
     try {
-      execFileSync10("caddy", ["reload", "--config", caddyfile, "--adapter", "caddyfile"], {
+      execFileSync11("caddy", ["reload", "--config", caddyfile, "--adapter", "caddyfile"], {
         stdio: "pipe"
       });
     } catch {
@@ -6043,7 +7137,7 @@ async function setupSubdomainRouting(devOutput, appRoot) {
     }
   } else {
     try {
-      execFileSync10("which", ["caddy"], { stdio: "pipe" });
+      execFileSync11("which", ["caddy"], { stdio: "pipe" });
     } catch {
       logWarn(
         "Caddy not found. Install for subdomain routing: curl -fsSL https://caddyserver.com/api/download?os=linux&arch=arm64 -o /usr/local/bin/caddy && chmod +x /usr/local/bin/caddy"
@@ -6085,8 +7179,14 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
     return devOutput;
   }
   logInfo(`Creating tmux session: ${sessionName}`);
-  execFileSync10("tmux", ["new-session", "-d", "-s", sessionName, "-n", "status", "-c", appRoot]);
-  setTmuxEnv(sessionName, awsEnv);
+  execFileSync11("tmux", ["new-session", "-d", "-s", sessionName, "-n", "status", "-c", appRoot]);
+  const sessionEnv = {};
+  const shareOnSession = (vars) => {
+    Object.assign(sessionEnv, vars);
+    setTmuxEnv(sessionName, vars);
+  };
+  const hostEnv = pickLaunchHostEnv(process.env);
+  shareOnSession(awsEnv);
   const hasTunnels = Object.keys(devOutput.tunnels).length > 0;
   let effectiveTransport = tunnelPlan.transport;
   if (hasTunnels && effectiveTransport === "tailscale" && tunnelPlan.tailscale) {
@@ -6116,7 +7216,7 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
     }
   }
   if (hasTunnels && effectiveTransport === "ssm") {
-    devOutput = await startSsmTunnels(sessionName, devOutput);
+    devOutput = await startSsmTunnels(sessionName, devOutput, appRoot, awsEnv);
   }
   if (hasTunnels && effectiveTransport !== "vpn-direct") {
     for (const [tName, tunnel] of Object.entries(devOutput.tunnels)) {
@@ -6153,7 +7253,7 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
   }
   let secretEnvVars = {};
   if (devOutput.secrets && Object.keys(devOutput.secrets).length > 0) {
-    secretEnvVars = await resolveSecrets(devOutput.secrets);
+    secretEnvVars = await resolveSecrets(devOutput.secrets, devOutput.tunnels);
   }
   const tenant = devOutput.platform?.tenant ?? "mesh";
   const platformEnv = devOutput.platform?.env ?? "dev";
@@ -6167,7 +7267,7 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
     });
     if (kubeconfigPath) {
       process.env.KUBECONFIG = kubeconfigPath;
-      setTmuxEnv(sessionName, { KUBECONFIG: kubeconfigPath });
+      shareOnSession({ KUBECONFIG: kubeconfigPath });
       logSuccess(`Kubeconfig resolved from SSM (hub ${platformName}/${platformEnv}) \u2192 ${kubeconfigPath}`);
     } else {
       logWarn("Could not resolve EKS kubeconfig from SSM; kubectl calls will use ambient config (if any).");
@@ -6176,37 +7276,47 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
   let temporalAuthVars = {};
   if (devOutput.tunnels["temporal"]) {
     temporalAuthVars = await resolveTemporalAuth(tenant, platformEnv, devOutput.platform?.name ?? tenant);
-    const appName = devOutput.app ?? "";
-    if (appName) {
-      const encodingKey = resolveTemporalEncodingKey(tenant, platformEnv, appName);
+    const namespace = stackNamespace(devOutput);
+    if (namespace) {
+      const encodingKey = resolveTemporalEncodingKey(namespace);
       if (encodingKey) {
         temporalAuthVars.TEMPORAL_ENCODING_KEY = encodingKey;
+      } else {
+        logInfo(`No deployed encoding key in ${namespace} \u2014 using the stack's dev key from the dev block.`);
       }
     }
     const temporalTunnel = devOutput.tunnels["temporal"];
     temporalAuthVars.TEMPORAL_ADDRESS = tunnelClientAddress(temporalTunnel);
   }
-  setTmuxEnv(sessionName, secretEnvVars);
-  setTmuxEnv(sessionName, temporalAuthVars);
+  shareOnSession(secretEnvVars);
+  shareOnSession(temporalAuthVars);
   const credContext = devOutput.platform ? isLocalPlatform ? "local" : loginContextFor(devOutput.platform) : null;
   const devUserVars = resolveDevUserVars(devOutput);
   if (Object.keys(devUserVars).length > 0) {
-    setTmuxEnv(sessionName, devUserVars);
+    shareOnSession(devUserVars);
     logSuccess(`Dev user injected from mesh login: ${credContext}`);
     const tokenPort = await findFreePort();
     const tokenUrl = `http://127.0.0.1:${tokenPort}`;
-    setTmuxEnv(sessionName, { DEV_USER_TOKEN_URL: tokenUrl });
-    execFileSync10("tmux", ["new-window", "-t", sessionName, "-n", "token-server"]);
-    execFileSync10(
+    shareOnSession({ DEV_USER_TOKEN_URL: tokenUrl });
+    execFileSync11("tmux", ["new-window", "-t", sessionName, "-n", "token-server"]);
+    execFileSync11(
       "tmux",
       ["set-option", "-t", `${sessionName}:token-server`, "remain-on-exit", "on"],
       { stdio: "ignore" }
     );
-    execFileSync10("tmux", [
+    const tokenServerEnvFile = getServiceEnvFilePath(sessionName, "token-server");
+    writeEnvFile(tokenServerEnvFile, hostEnv);
+    execFileSync11("tmux", [
       "send-keys",
       "-t",
       `${sessionName}:token-server`,
-      `npx mesh dev __token-server ${tokenPort} ${credContext}`,
+      buildLaunchCommand(
+        tokenServerEnvFile,
+        appRoot,
+        `npx mesh dev __token-server ${tokenPort} ${credContext}`,
+        void 0,
+        hostEnv
+      ),
       "Enter"
     ]);
     for (let i = 0; i < 15 && !await isPortListening(tokenPort); i++) {
@@ -6219,33 +7329,55 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
     logInfo("  Hub UI will show unauthenticated state without valid credentials.");
   }
   const monorepoRoot = findMonorepoRoot();
+  const notLaunched = [];
   for (const [name, service] of Object.entries(devOutput.services)) {
     const cmd = service.command.join(" ");
     if (!cmd) {
       logInfo(`Skipped: ${name} (no dev command, deployed to K8s)`);
       continue;
     }
-    const serviceDir = path15.resolve(appRoot, rebaseServiceSrc(service.src, monorepoRoot));
-    if (worktreeRoot && fs14.existsSync(serviceDir)) {
-      const wtRootWithSep = worktreeRoot.endsWith(path15.sep) ? worktreeRoot : worktreeRoot + path15.sep;
+    let serviceDir = path18.resolve(appRoot, rebaseServiceSrc(service.src, monorepoRoot));
+    if (worktreeRoot && fs17.existsSync(serviceDir)) {
+      const wtRootWithSep = worktreeRoot.endsWith(path18.sep) ? worktreeRoot : worktreeRoot + path18.sep;
       const outside = serviceDir !== worktreeRoot && !serviceDir.startsWith(wtRootWithSep);
       if (outside && isLinkedDependencyDir(serviceDir, appRoot)) {
         logInfo(`${name}: source is a dev-linked package (${serviceDir})`);
       } else if (outside) {
-        logError(
-          `Refusing to launch '${name}': its source resolved to ${serviceDir}, outside this worktree (${worktreeRoot}), and it is not a package this app resolves there. The stack was likely deployed from another worktree. Re-run \`mesh deploy up\` here, or pass --app.`
-        );
-        process.exit(1);
+        const own = relinkedServiceDir(serviceDir, appRoot);
+        if (own) {
+          logWarn(
+            `${name}: the stack recorded its source in another copy of its package (${serviceDir}); running this app's own copy (${own}).`
+          );
+          serviceDir = own;
+        } else {
+          logError(
+            `Not launching '${name}': its source resolved to ${serviceDir}, outside this worktree (${worktreeRoot}), and it is not a package this app resolves. The stack was likely deployed from another worktree; re-run \`mesh deploy up\` here, or pass --app. Every other service still starts.`
+          );
+          notLaunched.push(name);
+          continue;
+        }
       }
     }
-    if (!fs14.existsSync(serviceDir)) {
+    if (!fs17.existsSync(serviceDir)) {
       logWarn(
         `Skipped: ${name} (source directory not found: ${serviceDir}${serviceDir !== service.src ? ` \u2014 rebased from ${service.src}` : ""})`
       );
       continue;
     }
     const serviceVars = {
+      // The allow-listed host variables come FIRST, so anything below wins over
+      // them; they are in the file rather than on the launch command so that a
+      // restart (which sources this same file) reproduces the launch PATH and
+      // HOME byte for byte, and so the send-keys string stays short — inlining
+      // a long PATH is the same truncation hazard that moved the env into a
+      // file in the first place.
+      ...hostEnv,
       ...getServiceEnvVars(service, devOutput.tunnels),
+      // The resolved secrets — DATABASE_URL, DATABASE_PASSWORD — for the same reason as
+      // every overlay below: the service starts from its env file alone. Without them a
+      // service gets DATABASE_HOST/PORT/NAME/USER from its link and no DATABASE_URL, and
+      // Prisma falls back to localhost:5432, whatever happens to listen there.
+      ...secretEnvVars,
       ...temporalAuthVars,
       // Overlay the resolved dev-user identity for the same reason as the
       // Temporal vars: the dev output may carry a placeholder (e.g. hub ui's
@@ -6268,21 +7400,31 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
       // no AWS_* here it silently has none to give. `buildChildAwsEnv` has already
       // chosen the SELF-REFRESHING shape (a profile with `credential_process`, not a
       // frozen STS triple), which is exactly what a long-lived child needs.
-      ...awsEnv
+      ...awsEnv,
+      // Whatever else was shared on the session (KUBECONFIG and
+      // DEV_USER_TOKEN_URL), everything above being already overlaid — because
+      // under `env -i` the session environment no longer reaches the service.
+      // The explicit overlays above stay: each names the failure
+      // it prevents, and this catch-all must not be the only thing carrying them.
+      ...sessionEnv
     };
     const envFilePath = getServiceEnvFilePath(sessionName, name);
-    writeEnvFile(envFilePath, serviceVars);
+    const overrides = readServiceOverrides(sessionName, name);
+    if (Object.keys(overrides).length)
+      logInfo(`${name}: applying ${Object.keys(overrides).length} override(s) from ${serviceOverridesPaths(sessionName, name).join(" / ")}`);
+    writeEnvFile(envFilePath, { ...serviceVars, ...overrides });
     const launchCmd = buildLaunchCommand(
       envFilePath,
       serviceDir,
       cmd,
-      service.env?.OTEL_RESOURCE_ATTRIBUTES ? logShipperPath() : void 0
+      service.env?.OTEL_RESOURCE_ATTRIBUTES ? logShipperPath() : void 0,
+      hostEnv
     );
-    execFileSync10("tmux", ["new-window", "-t", sessionName, "-n", name, "-c", serviceDir]);
-    execFileSync10("tmux", ["set-option", "-t", `${sessionName}:${name}`, "remain-on-exit", "on"], {
+    execFileSync11("tmux", ["new-window", "-t", sessionName, "-n", name, "-c", serviceDir]);
+    execFileSync11("tmux", ["set-option", "-t", `${sessionName}:${name}`, "remain-on-exit", "on"], {
       stdio: "ignore"
     });
-    execFileSync10("tmux", ["send-keys", "-t", `${sessionName}:${name}`, launchCmd, "Enter"]);
+    execFileSync11("tmux", ["send-keys", "-t", `${sessionName}:${name}`, launchCmd, "Enter"]);
     logSuccess(`Started: ${name} (${serviceDir}, port ${service.port})`);
   }
   if (process.env.DEVCONTAINER === "1") {
@@ -6293,9 +7435,13 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
     }
   }
   const statusCmd = `watch -n2 -t npx mesh dev --status --session '${sessionName}'`;
-  execFileSync10("tmux", ["send-keys", "-t", `${sessionName}:status`, statusCmd, "Enter"]);
+  execFileSync11("tmux", ["send-keys", "-t", `${sessionName}:status`, statusCmd, "Enter"]);
   console.log("");
   logSuccess(`Dev session started: ${sessionName}`);
+  if (notLaunched.length > 0)
+    logWarn(
+      `Not launched (source outside this worktree, see above): ${notLaunched.join(", ")}. The rest of the session is up.`
+    );
   console.log("");
   if (tunnelNames.length > 0) {
     console.log("Connections (VPN direct):");
@@ -6328,9 +7474,9 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
   if (!headless) {
     logInfo("Attaching to tmux session...");
     if (process.env.TMUX) {
-      spawnSync("tmux", ["switch-client", "-t", sessionName], { stdio: "inherit" });
+      spawnSync2("tmux", ["switch-client", "-t", sessionName], { stdio: "inherit" });
     } else {
-      spawnSync("tmux", ["attach", "-t", sessionName], { stdio: "inherit" });
+      spawnSync2("tmux", ["attach", "-t", sessionName], { stdio: "inherit" });
     }
   } else {
     console.log(`Attach with:  tmux attach -t ${sessionName}`);
@@ -6348,31 +7494,20 @@ async function showStatus(sessionName, devOutput, asJson) {
     }
     return;
   }
-  let windows = [];
-  try {
-    const raw = execFileSync10(
-      "tmux",
-      ["list-windows", "-t", sessionName, "-F", "#{window_name} #{pane_dead}"],
-      { encoding: "utf-8" }
-    );
-    windows = raw.trim().split("\n");
-  } catch {
-  }
-  const windowStatus = {};
-  for (const line of windows) {
-    const [name, dead] = line.split(" ");
-    if (name) windowStatus[name] = dead === "1" ? "exited" : "running";
-  }
+  const liveness = classifySessionServices(sessionName, devOutput.services, paneProcessQuery);
   const tunnelNames = Object.keys(devOutput.tunnels);
   const tunnelHealth = await probeTunnelHealth(devOutput.tunnels);
   const healthByName = new Map(tunnelHealth.map((h) => [h.name, h]));
   if (asJson) {
     const services = {};
     for (const [name, svc] of Object.entries(devOutput.services)) {
+      const l = liveness.get(name);
       services[name] = {
-        status: windowStatus[name] ?? "unknown",
+        status: l?.state ?? "unknown",
         port: svc.port,
-        src: svc.src
+        src: svc.src,
+        ...l?.state === "exited" && l.exitCode !== null ? { exitCode: l.exitCode } : {},
+        ...l?.state === "exited" && l.lastActivityEpoch !== null ? { lastActivity: new Date(l.lastActivityEpoch * 1e3).toISOString() } : {}
       };
     }
     const tunnels = {};
@@ -6402,10 +7537,16 @@ async function showStatus(sessionName, devOutput, asJson) {
         console.log(`  \u2601 ${name.padEnd(16)} deployed                ${svc.src}`);
         continue;
       }
-      const status = windowStatus[name] ?? "unknown";
+      const l = liveness.get(name);
+      const status = l?.state ?? "unknown";
       const icon = status === "running" ? "\u25CF" : status === "exited" ? "\u2717" : "?";
+      const statusCol = l?.state === "exited" && l.exitCode !== null ? `exited(${l.exitCode})` : status;
       const addr = svc.port ? `:${svc.port}` : "";
-      console.log(`  ${icon} ${name.padEnd(16)} ${status.padEnd(10)} ${addr.padEnd(8)} ${svc.src}`);
+      let line = `  ${icon} ${name.padEnd(16)} ${statusCol.padEnd(10)} ${addr.padEnd(8)} ${svc.src}`;
+      if (l?.state === "exited" && l.lastActivityEpoch !== null) {
+        line += `  (last output ${new Date(l.lastActivityEpoch * 1e3).toLocaleTimeString()})`;
+      }
+      console.log(line);
     }
     console.log("");
     console.log("Commands:");
@@ -6427,10 +7568,15 @@ async function restartService(sessionName, serviceName, appRoot, devOutput, awsE
     logError(`No active session: ${sessionName}. Run 'mesh dev' first.`);
     process.exit(1);
   }
-  if (opts?.refreshEnv) {
+  const waitMs = opts?.waitMs ?? RESTART_READY_TIMEOUT_MS;
+  const neverLaunched = !fs17.existsSync(getServiceEnvFilePath(sessionName, serviceName));
+  if (neverLaunched && !opts?.refreshEnv && opts?.stack)
+    logInfo(`'${serviceName}' has no launch env file (never started) \u2014 rendering it from the stack.`);
+  const refreshEnv = opts?.refreshEnv || neverLaunched && Boolean(opts?.stack);
+  if (refreshEnv && opts) {
     if (!opts.stack) {
       logError("--refresh-env: no stack resolved; keeping existing env and NOT restarting.");
-      return;
+      return null;
     }
     const pinned = opts.sessionState?.devOutput ?? devOutput;
     let fresh;
@@ -6441,20 +7587,26 @@ async function restartService(sessionName, serviceName, appRoot, devOutput, awsE
         `--refresh-env: failed to read stack output for '${opts.stack}'. Keeping the existing env file for '${serviceName}' and NOT restarting.`
       );
       logInfo(String(err?.message ?? err));
-      return;
+      return null;
     }
+    warnIfDevOutputStale(fresh, appRoot, opts.stack);
     const merged = mergePinnedPorts(fresh, pinned);
     const mergedService = merged.services[serviceName];
     if (!mergedService) {
       logError(
         `--refresh-env: service '${serviceName}' is absent from the fresh stack output. Keeping the existing env file and NOT restarting.`
       );
-      return;
+      return null;
     }
     const temporalAuthVars = await resolveTemporalAuthVars(sessionName, merged);
+    const secretEnvVars = merged.secrets && Object.keys(merged.secrets).length > 0 ? await resolveSecrets(merged.secrets, merged.tunnels) : {};
     const { taskQueueSuffix } = resolveWorktreeIdentity(appRoot);
     const serviceVars = {
+      // The allow-listed host variables first, as at launch: the rewritten
+      // file is the whole environment the restarted service gets.
+      ...pickLaunchHostEnv(process.env),
       ...getServiceEnvVars(mergedService, merged.tunnels),
+      ...secretEnvVars,
       ...temporalAuthVars,
       // Same overlay as launch: without it, --refresh-env rewrites the env
       // file from dev output and its DEV_USER_* placeholders clobber the real
@@ -6464,30 +7616,75 @@ async function restartService(sessionName, serviceName, appRoot, devOutput, awsE
       // Same overlay as launch — a refresh that dropped these would take a working
       // service's credentials away on restart, which is the hardest kind of change to
       // attribute afterwards.
-      ...awsEnv
+      ...awsEnv,
+      // The two launch set on the session and nowhere the refresh can re-derive
+      // them from: the token-server's URL (its port was picked at launch) and the
+      // session kubeconfig. Before the clean launch the window's shell inherited
+      // them from the session; now only the file reaches the service.
+      ...readTmuxSessionEnv(sessionName, ["KUBECONFIG", "DEV_USER_TOKEN_URL"])
     };
-    writeEnvFile(getServiceEnvFilePath(sessionName, serviceName), serviceVars);
+    const envFilePathToRefresh = getServiceEnvFilePath(sessionName, serviceName);
+    let previousVars = null;
+    try {
+      previousVars = parseEnvFile(fs17.readFileSync(envFilePathToRefresh, "utf-8"));
+    } catch {
+    }
+    if (previousVars) {
+      const changes = diffEnvFiles(previousVars, { ...serviceVars, ...readServiceOverrides(sessionName, serviceName) });
+      if (changes.length === 0) {
+        logInfo(`--refresh-env: the regenerated env for '${serviceName}' is identical to the running one.`);
+      } else {
+        logInfo(`--refresh-env: '${serviceName}' env changes (${changes.length}):`);
+        for (const change of changes) console.log(`    ${change.detail}`);
+      }
+    }
+    const overrides = readServiceOverrides(sessionName, serviceName);
+    if (Object.keys(overrides).length)
+      logInfo(`'${serviceName}': applying ${Object.keys(overrides).length} override(s).`);
+    writeEnvFile(envFilePathToRefresh, { ...serviceVars, ...overrides });
     service = mergedService;
     logSuccess(`Regenerated env for '${serviceName}' from current stack/SSM outputs.`);
   }
   const target = `${sessionName}:${serviceName}`;
   try {
-    execFileSync10("tmux", ["respawn-pane", "-k", "-t", target], { stdio: "ignore" });
+    execFileSync11("tmux", ["respawn-pane", "-k", "-t", target], { stdio: "ignore" });
+  } catch {
+    try {
+      execFileSync11("tmux", ["new-window", "-d", "-t", sessionName, "-n", serviceName], { stdio: "ignore" });
+      logInfo(`Window '${serviceName}' did not exist \u2014 created it.`);
+    } catch {
+      logError(`Window '${serviceName}' not found in session, and could not be created.`);
+      process.exit(1);
+    }
+  }
+  try {
+    execFileSync11("tmux", ["clear-history", "-t", target], { stdio: "ignore" });
   } catch {
-    logError(`Window '${serviceName}' not found in session.`);
-    process.exit(1);
+  }
+  const portHeldBeforeStart = waitMs > 0 && await portHeldByAnother(service.port, {
+    portAccepts: isPortListening,
+    now: () => Date.now(),
+    sleep: (ms) => new Promise((resolve9) => setTimeout(resolve9, ms))
+  });
+  if (portHeldBeforeStart) {
+    logWarn(
+      `Port :${service.port} is still accepting connections with '${serviceName}' stopped \u2014 another process holds it. The restarted service cannot bind it; whatever answers on :${service.port} is not this session's ${serviceName}.`
+    );
+    logInfo(`Find the holder: lsof -nP -iTCP:${service.port} -sTCP:LISTEN`);
   }
   setTmuxEnv(sessionName, awsEnv);
   const cmd = service.command.join(" ");
   const envFilePath = getServiceEnvFilePath(sessionName, serviceName);
   let restartCmd;
-  if (fs14.existsSync(envFilePath)) {
-    const serviceDir = path15.resolve(appRoot, rebaseServiceSrc(service.src, findMonorepoRoot()));
+  if (fs17.existsSync(envFilePath)) {
+    let serviceDir = path18.resolve(appRoot, rebaseServiceSrc(service.src, findMonorepoRoot()));
+    if (!isLinkedDependencyDir(serviceDir, appRoot)) serviceDir = relinkedServiceDir(serviceDir, appRoot) ?? serviceDir;
     restartCmd = buildLaunchCommand(
       envFilePath,
       serviceDir,
       cmd,
-      service.env?.OTEL_RESOURCE_ATTRIBUTES ? logShipperPath() : void 0
+      service.env?.OTEL_RESOURCE_ATTRIBUTES ? logShipperPath() : void 0,
+      pickLaunchHostEnv(process.env)
     );
   } else {
     logWarn(
@@ -6497,8 +7694,80 @@ async function restartService(sessionName, serviceName, appRoot, devOutput, awsE
     const serviceVars = getServiceEnvVars(service, devOutput.tunnels);
     restartCmd = `${envPrefix(serviceVars)}${cmd}`;
   }
-  execFileSync10("tmux", ["send-keys", "-t", target, restartCmd, "Enter"]);
-  logSuccess(`Restarted: ${serviceName}`);
+  execFileSync11("tmux", ["send-keys", "-t", target, restartCmd, "Enter"]);
+  if (waitMs <= 0) {
+    logSuccess(`Restarted: ${serviceName} (not waiting for readiness \u2014 check \`mesh dev --status\`)`);
+    return null;
+  }
+  const readiness = await awaitServiceReadiness(
+    {
+      port: service.port,
+      portHeldBeforeStart,
+      readyMarker: service.port > 0 ? void 0 : TEMPORAL_WORKER_RUNNING,
+      timeoutMs: waitMs
+    },
+    {
+      liveness: () => classifyPaneLiveness(target, paneProcessQuery),
+      portAccepts: isPortListening,
+      paneOutput: () => capturePane(target),
+      now: () => Date.now(),
+      sleep: (ms) => new Promise((resolve9) => setTimeout(resolve9, ms))
+    }
+  );
+  reportRestartReadiness(serviceName, service.port, readiness);
+  return readiness;
+}
+function capturePane(target, lines = 2e3) {
+  try {
+    return execFileSync11("tmux", ["capture-pane", "-p", "-t", target, "-S", `-${lines}`], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+  } catch {
+    return "";
+  }
+}
+function reportRestartReadiness(serviceName, port, readiness) {
+  const secs = (ms) => `${(ms / 1e3).toFixed(1)}s`;
+  switch (readiness.state) {
+    case "ready": {
+      const how = readiness.via === "port" ? `listening on :${port}` : readiness.via === "marker" ? "worker RUNNING" : "process up";
+      logSuccess(`Restarted: ${serviceName} (${how} after ${secs(readiness.afterMs)})`);
+      return;
+    }
+    case "exited": {
+      logError(
+        `Restart FAILED: '${serviceName}' ${describePaneExit(readiness.liveness)} ${secs(readiness.afterMs)} after its command was typed.`
+      );
+      const tail = paneTail(readiness.output);
+      if (tail.length > 0) {
+        logInfo(`Last output from '${serviceName}':`);
+        for (const line of tail) console.log(`    ${line}`);
+      }
+      logInfo(`Full output: mesh dev logs ${serviceName}`);
+      return;
+    }
+    case "pending": {
+      const what = port > 0 ? `:${port} is not accepting connections` : "no ready marker printed";
+      logWarn(
+        `Restarted: ${serviceName}, but readiness is UNCONFIRMED \u2014 ${what} after ${secs(readiness.afterMs)} (process still up).`
+      );
+      logInfo(`Watch it: mesh dev logs ${serviceName}   \xB7   mesh dev --status`);
+      return;
+    }
+    case "port-held": {
+      logError(
+        `Restart NOT confirmed: '${serviceName}' is up ${secs(readiness.afterMs)} after its command was typed, but :${port} was already held by another process \u2014 it either failed to bind and is exiting, or moved to a port nothing dials.`
+      );
+      const tail = paneTail(readiness.output, 8);
+      for (const line of tail) console.log(`    ${line}`);
+      logInfo(`Free :${port} (lsof -nP -iTCP:${port} -sTCP:LISTEN) and restart again, or relaunch: mesh dev --kill && mesh dev`);
+      return;
+    }
+    case "unknown":
+      logWarn(`Restarted: ${serviceName}, but readiness could not be checked (${readiness.reason}).`);
+      return;
+  }
 }
 function showLogs(sessionName, serviceName, tail) {
   if (!sessionExists(sessionName)) {
@@ -6507,7 +7776,7 @@ function showLogs(sessionName, serviceName, tail) {
   }
   const target = `${sessionName}:${serviceName}`;
   try {
-    const result = execFileSync10("tmux", ["capture-pane", "-t", target, "-p", "-S", `-${tail}`], {
+    const result = execFileSync11("tmux", ["capture-pane", "-t", target, "-p", "-S", `-${tail}`], {
       encoding: "utf-8"
     });
     process.stdout.write(result);
@@ -6542,7 +7811,9 @@ function buildDoctorContext(appRoot, stack, sessionName) {
   };
 }
 function registerDevCommand(program) {
-  const dev = program.command("dev").description("Start local dev environment (reads Pulumi stack outputs)").option("--app <path>", "Path to a Pulumi app (relative to monorepo root or cwd)").option("--stack <stack>", "Pulumi stack name (default: auto-detect)").addOption(new Option("--stage <stack>", "Deprecated alias for --stack").hideHelp()).option("--headless", "Start without attaching to tmux").option("--kill", "Kill existing dev session").option("--status", "Show service status").option("--json", "Output status as JSON (with --status)").option(
+  const dev = program.command("dev").description(
+    "Start local dev environment (reads Pulumi stack outputs). The env is rendered from the stack's STORED outputs \u2014 when they are older than the program (git HEAD) or the stack config, mesh dev warns to run `mesh deploy up --stack <stack>` first"
+  ).option("--app <path>", "Path to a Pulumi app (relative to monorepo root or cwd)").option("--stack <stack>", "Pulumi stack name (default: auto-detect)").addOption(new Option("--stage <stack>", "Deprecated alias for --stack").hideHelp()).option("--headless", "Start without attaching to tmux").option("--kill", "Kill existing dev session").option("--status", "Show service status").option("--json", "Output status as JSON (with --status)").option(
     "--session <name>",
     "Override the tmux session name (auto-derived per git worktree by default \u2014 omit to keep concurrent worktrees isolated)"
   ).option("--dry-run", "Print the resolved worktree/session/port plan and exit without launching").option("--force", "Relaunch even if workflow code changed since launch (may strand in-flight conversations)").option("--profile <name>", "AWS SSO profile to use (e.g., mesh-dev)").addOption(
@@ -6562,7 +7833,7 @@ function registerDevCommand(program) {
     "tmux"
   );
   dev.command("__token-server <port> <context>", { hidden: true }).action(async (port, context) => {
-    const { startTokenServer } = await import("./mesh.dev-token-server-YP2VBP2S.js");
+    const { startTokenServer } = await import("./mesh.dev-token-server-XG26C6IQ.js");
     await startTokenServer(Number(port), context);
   });
   dev.action(async (options) => {
@@ -6715,7 +7986,13 @@ function registerDevCommand(program) {
         mocks: selectedMocks
       });
       if (options.dryRun) {
-        printDevPlan(sessionName, appRoot, worktree, await allocatePorts(rawDevOutput2, worktree));
+        const plan3 = sessionPortPlan(sessionName);
+        printDevPlan(
+          sessionName,
+          appRoot,
+          worktree,
+          await allocatePorts(rawDevOutput2, worktree, plan3.remembered, void 0, plan3.ownPorts)
+        );
         for (const [name, decl] of Object.entries(selectedMocks)) {
           const mode = externalMode(name, decl);
           if (mode === "local") {
@@ -6740,7 +8017,7 @@ function registerDevCommand(program) {
         signInServices = [];
         try {
           const appPkg = JSON.parse(
-            fs14.readFileSync(path15.join(appRoot, "package.json"), "utf-8")
+            fs17.readFileSync(path18.join(appRoot, "package.json"), "utf-8")
           );
           if (Array.isArray(appPkg?.mesh?.auth?.roles)) {
             authRoles = appPkg.mesh.auth.roles.filter((r) => typeof r === "string");
@@ -6761,7 +8038,39 @@ function registerDevCommand(program) {
           `Auth auto-provisioning skipped: ${err instanceof Error ? err.message : err} \u2014 if the local Zitadel predates seeding, run: mesh stop --destroy && mesh start`
         );
       }
-      const devOutput2 = await allocatePorts(rawDevOutput2, worktree);
+      const authzConfig = readLocalAuthzConfig(appRoot);
+      if (authzConfig?.prebuilt) {
+        logWarn(
+          `package.json declares both mesh.authz.schema and mesh.authz.metadata \u2014 both publish this app's authorization. Using mesh.authz.metadata; remove one of them.`
+        );
+      } else if (authzConfig) {
+        const app = rawDevOutput2.app ?? projectName;
+        try {
+          const published = await publishLocalAppAuthz({
+            appRoot,
+            schema: authzConfig.schema,
+            tenant: localTenant,
+            app,
+            ...provisioned ? { zitadel: { projectId: provisioned.projectId, orgId: provisioned.orgId } } : {}
+          });
+          for (const [name, svc] of Object.entries(rawDevOutput2.services)) {
+            if (name.startsWith("mock-")) continue;
+            svc.env = {
+              ...svc.env ?? {},
+              ...Object.fromEntries(Object.entries(published.env).map(([k, value]) => [k, { value }]))
+            };
+          }
+          logSuccess(
+            published.instance ? `Authz (${published.mode}) published for '${app}' \u2014 its SpiceDB on localhost:${published.instance.grpcPort} (HTTP ${published.instance.httpPort})` : `Authz (${published.mode}) published for '${app}'`
+          );
+        } catch (err) {
+          logWarn(
+            `Could not publish '${app}'s authorization (${err instanceof Error ? err.message : err}) \u2014 the Hub cannot author its roles, and a policy-engine app denies every check.`
+          );
+        }
+      }
+      const plan2 = sessionPortPlan(sessionName);
+      const devOutput2 = await allocatePorts(rawDevOutput2, worktree, plan2.remembered, void 0, plan2.ownPorts);
       for (const service of signInServices) {
         const port = devOutput2.services[service]?.port;
         if (!port) {
@@ -6805,7 +8114,7 @@ function registerDevCommand(program) {
       }
       let localDocs;
       try {
-        const appPkg = JSON.parse(fs14.readFileSync(path15.join(appRoot, "package.json"), "utf-8"));
+        const appPkg = JSON.parse(fs17.readFileSync(path18.join(appRoot, "package.json"), "utf-8"));
         const declaration = readLocalPublishDeclaration(appPkg, appRoot);
         if (declaration.docs || declaration.authzMetadata || declaration.problems.length > 0) {
           const app = devOutput2.app ?? projectName;
@@ -6815,10 +8124,10 @@ function registerDevCommand(program) {
           if (!httpService || !service?.port) {
             logWarn(`mesh.docs names service '${httpService ?? ""}', which this app does not run \u2014 docs not published.`);
           } else {
-            const serviceDir = path15.resolve(appRoot, service.src);
+            const serviceDir = path18.resolve(appRoot, service.src);
             const env = service.env ?? (service.env = {});
             const serviceEnv = {
-              ...readDotEnvFile(path15.join(serviceDir, ".env")),
+              ...readDotEnvFile(path18.join(serviceDir, ".env")),
               ...Object.fromEntries(Object.entries(process.env).filter((e) => typeof e[1] === "string")),
               ...Object.fromEntries(Object.entries(env).map(([k, v]) => [k, v.value]))
             };
@@ -6963,6 +8272,7 @@ function registerDevCommand(program) {
           externalProbeFiles,
           ...localDocs ? { localDocs } : {}
         });
+        saveSessionPortMemory(sessionName, devOutput2);
         console.log("");
         logSuccess(`Dev session started (docker): ${sessionName}`);
         console.log("");
@@ -6992,10 +8302,12 @@ function registerDevCommand(program) {
         devOutput: finalDevOutput2,
         startedAt: (/* @__PURE__ */ new Date()).toISOString(),
         runner: "tmux",
+        cleanEnv: true,
         composeExternals,
         externalProbeFiles,
         ...localDocs ? { localDocs } : {}
       });
+      saveSessionPortMemory(sessionName, finalDevOutput2);
       return;
     }
     if (options.mock || options.externals) {
@@ -7007,9 +8319,9 @@ function registerDevCommand(program) {
     logInfo(`Project: ${projectName}, Stack: ${stack}`);
     const monorepoRoot = findMonorepoRoot();
     const looksLikeStandaloneApp = ["api", "worker", "web"].some(
-      (dir) => fs14.existsSync(path15.join(appRoot, dir, "package.json"))
+      (dir) => fs17.existsSync(path18.join(appRoot, dir, "package.json"))
     );
-    if (monorepoRoot && path15.resolve(appRoot) === path15.resolve(monorepoRoot) && !looksLikeStandaloneApp) {
+    if (monorepoRoot && path18.resolve(appRoot) === path18.resolve(monorepoRoot) && !looksLikeStandaloneApp) {
       logError(`mesh dev should be run from an app directory, not the monorepo root.
 `);
       logInfo("Try:");
@@ -7140,7 +8452,9 @@ function registerDevCommand(program) {
       await showStatus(sessionName, state?.devOutput ?? rawDevOutput, !!options.json);
       return;
     }
-    const devOutput = await allocatePorts(rawDevOutput, worktree);
+    warnIfDevOutputStale(rawDevOutput, appRoot, stack);
+    const plan = sessionPortPlan(sessionName);
+    const devOutput = await allocatePorts(rawDevOutput, worktree, plan.remembered, void 0, plan.ownPorts);
     transport = await gateVpnDirectReachability(transport, devOutput);
     if (options.dryRun) {
       printDevPlan(sessionName, appRoot, worktree, devOutput);
@@ -7208,112 +8522,113 @@ function registerDevCommand(program) {
       stack,
       devOutput: finalDevOutput,
       startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      cleanEnv: true,
       workflowFingerprint: fingerprintWorkflowSource(appRoot, finalDevOutput.services)
     });
+    saveSessionPortMemory(sessionName, finalDevOutput);
   });
   dev.command("logs <service>").description("Show logs for a service").option("--tail <lines>", "Number of lines", "100").action((service, opts) => {
-    const sessionName = dev.opts().session;
-    const resolvedSession = sessionName ?? `${getProjectName(findAppRoot2())}-dev`;
-    if (loadSessionState(resolvedSession)?.runner === "docker") {
-      console.log(dockerDevLogs(resolvedSession, service, parseInt(opts.tail, 10)));
+    const sessionName = sessionNameFor(findAppRoot2(), dev.opts().session);
+    if (loadSessionState(sessionName)?.runner === "docker") {
+      console.log(dockerDevLogs(sessionName, service, parseInt(opts.tail, 10)));
       return;
     }
-    if (sessionName) {
-      showLogs(sessionName, service, parseInt(opts.tail, 10));
-    } else {
-      const appRoot = findAppRoot2();
-      const projectName = getProjectName(appRoot);
-      showLogs(`${projectName}-dev`, service, parseInt(opts.tail, 10));
-    }
+    showLogs(sessionName, service, parseInt(opts.tail, 10));
   });
   dev.command("restart <service>").description("Restart a service").option("--stack <stack>", "Pulumi stack name").addOption(new Option("--stage <stack>", "Deprecated alias for --stack").hideHelp()).option(
     "--refresh-env",
     "Regenerate this service's env from current stack/SSM outputs before restarting (for config/deploy changes)"
-  ).option("--force", "Restart the worker even if workflow code changed since launch (may strand in-flight conversations)").action(async (service, opts) => {
-    let ctx = null;
-    try {
-      const parentSession = dev.opts().session;
-      const parentProfile = dev.opts().profile;
-      if (parentProfile) {
-        applyAwsProfileOverride(parentProfile);
-      }
-      const appRoot = findAppRoot2();
-      const projectName = getProjectName(appRoot);
-      const sessionName = parentSession ?? `${projectName}-dev`;
-      const state = loadSessionState(sessionName);
-      if (state?.runner === "docker") {
-        dockerDevRestart(sessionName, service);
-        logSuccess(`Restarted: ${service}`);
-        return;
-      }
-      if (/worker/i.test(service) && workflowChangeWouldStrand(state, appRoot, !!opts.force)) {
-        process.exit(1);
-      }
-      const stack = state?.stack ?? detectStack(appRoot, resolveStackOption(opts));
-      ctx = derivePlatformContext(appRoot, stack);
-      const defaultDeployerRole = readStackConfig(appRoot, stack, "mesh:deployerRole");
-      const adminDeployerRole = readStackConfig(appRoot, stack, "mesh:adminDeployerRole");
-      let deployerRole = defaultDeployerRole;
-      if (defaultDeployerRole) {
-        const meshCreds = ctx ? readCredentials(ctx) : null;
-        const idToken = meshCreds && new Date(meshCreds.expiresAt) > /* @__PURE__ */ new Date() ? meshCreds.idToken : null;
-        deployerRole = selectRoleForCaller(idToken, {
-          defaultRole: defaultDeployerRole,
-          adminRole: adminDeployerRole ?? void 0
+  ).option("--force", "Restart the worker even if workflow code changed since launch (may strand in-flight conversations)").option(
+    "--wait <seconds>",
+    "How long to wait for the service to prove ready (port accepting, or a Temporal worker RUNNING) before reporting; an exit in that window fails the restart",
+    String(RESTART_READY_TIMEOUT_MS / 1e3)
+  ).option("--no-wait", "Return as soon as the command is typed, without checking readiness").action(
+    async (service, opts) => {
+      let ctx = null;
+      try {
+        const parentSession = dev.opts().session;
+        const parentProfile = dev.opts().profile;
+        if (parentProfile) {
+          applyAwsProfileOverride(parentProfile);
+        }
+        const appRoot = findAppRoot2();
+        const sessionName = sessionNameFor(appRoot, parentSession);
+        const state = loadSessionState(sessionName);
+        if (state?.runner === "docker") {
+          dockerDevRestart(sessionName, service);
+          logSuccess(`Restarted: ${service}`);
+          return;
+        }
+        if (/worker/i.test(service) && workflowChangeWouldStrand(state, appRoot, !!opts.force)) {
+          process.exit(1);
+        }
+        const stack = state?.stack ?? detectStack(appRoot, resolveStackOption(opts));
+        ctx = derivePlatformContext(appRoot, stack);
+        const defaultDeployerRole = readStackConfig(appRoot, stack, "mesh:deployerRole");
+        const adminDeployerRole = readStackConfig(appRoot, stack, "mesh:adminDeployerRole");
+        let deployerRole = defaultDeployerRole;
+        if (defaultDeployerRole) {
+          const meshCreds = ctx ? readCredentials(ctx) : null;
+          const idToken = meshCreds && new Date(meshCreds.expiresAt) > /* @__PURE__ */ new Date() ? meshCreds.idToken : null;
+          deployerRole = selectRoleForCaller(idToken, {
+            defaultRole: defaultDeployerRole,
+            adminRole: adminDeployerRole ?? void 0
+          });
+        }
+        const resolved = deployerRole ? await resolveAwsCredentials(deployerRole, appRoot, stack) : null;
+        if (deployerRole && !resolved && !process.env.AWS_ACCESS_KEY_ID) {
+          const pf = ctx ? credProbeToPreflightError(await probeCredentials(ctx, deployerRole), ctx, readStackPlatform(appRoot, stack)) : null;
+          logError(
+            pf?.message ?? `Couldn't resolve AWS credentials to restart '${service}'. Run: mesh login ${ctx ?? "mesh.dev"} --device`
+          );
+          process.exit(1);
+        }
+        const baseAwsEnv = resolved?.env ?? getAwsEnvVars();
+        const awsRegion = readStackConfig(appRoot, stack, "aws:region");
+        if (awsRegion && !baseAwsEnv.AWS_REGION) {
+          baseAwsEnv.AWS_REGION = awsRegion;
+        }
+        Object.assign(process.env, baseAwsEnv);
+        const profileHint = parentProfile ?? process.env.AWS_PROFILE ?? "mesh-dev";
+        const zitadelOpts = resolved?.method === "zitadel" && deployerRole && ctx ? {
+          context: ctx,
+          roleArn: deployerRole,
+          sessionScratchDir: getSessionEnvDir(sessionName),
+          meshBin: resolveStableMeshBin(process.argv[1])
+        } : void 0;
+        const awsEnv = buildChildAwsEnv(baseAwsEnv, resolved?.method ?? "ambient", profileHint, zitadelOpts);
+        const devOutput = state?.devOutput ?? getDevOutput(appRoot, stack, baseAwsEnv);
+        const readiness = await restartService(sessionName, service, appRoot, devOutput, awsEnv, {
+          refreshEnv: !!opts.refreshEnv,
+          stack,
+          sessionState: state,
+          waitMs: parseWaitSeconds(opts.wait, RESTART_READY_TIMEOUT_MS / 1e3) * 1e3
         });
-      }
-      const resolved = deployerRole ? await resolveAwsCredentials(deployerRole, appRoot, stack) : null;
-      if (deployerRole && !resolved && !process.env.AWS_ACCESS_KEY_ID) {
-        const pf = ctx ? credProbeToPreflightError(await probeCredentials(ctx, deployerRole), ctx, readStackPlatform(appRoot, stack)) : null;
-        logError(
-          pf?.message ?? `Couldn't resolve AWS credentials to restart '${service}'. Run: mesh login ${ctx ?? "mesh.dev"} --device`
+        if (/worker/i.test(service) && state) {
+          saveSessionState(sessionName, {
+            ...state,
+            workflowFingerprint: fingerprintWorkflowSource(appRoot, state.devOutput?.services)
+          });
+        }
+        if (readiness?.state === "exited" || readiness?.state === "port-held") process.exit(1);
+      } catch (err) {
+        logError(`Failed to restart '${service}': ${err?.message ?? String(err)}`);
+        logInfo(
+          `If this is a credential/kubeconfig issue, run \`mesh login ${ctx ?? "<your platform context>"} --device\`, or \`mesh dev\` to relaunch the session cleanly.`
         );
         process.exit(1);
       }
-      const baseAwsEnv = resolved?.env ?? getAwsEnvVars();
-      const awsRegion = readStackConfig(appRoot, stack, "aws:region");
-      if (awsRegion && !baseAwsEnv.AWS_REGION) {
-        baseAwsEnv.AWS_REGION = awsRegion;
-      }
-      Object.assign(process.env, baseAwsEnv);
-      const profileHint = parentProfile ?? process.env.AWS_PROFILE ?? "mesh-dev";
-      const zitadelOpts = resolved?.method === "zitadel" && deployerRole && ctx ? {
-        context: ctx,
-        roleArn: deployerRole,
-        sessionScratchDir: getSessionEnvDir(sessionName),
-        meshBin: resolveStableMeshBin(process.argv[1])
-      } : void 0;
-      const awsEnv = buildChildAwsEnv(baseAwsEnv, resolved?.method ?? "ambient", profileHint, zitadelOpts);
-      const devOutput = state?.devOutput ?? getDevOutput(appRoot, stack, baseAwsEnv);
-      await restartService(sessionName, service, appRoot, devOutput, awsEnv, {
-        refreshEnv: !!opts.refreshEnv,
-        stack,
-        sessionState: state
-      });
-      if (/worker/i.test(service) && state) {
-        saveSessionState(sessionName, {
-          ...state,
-          workflowFingerprint: fingerprintWorkflowSource(appRoot, state.devOutput?.services)
-        });
-      }
-    } catch (err) {
-      logError(`Failed to restart '${service}': ${err?.message ?? String(err)}`);
-      logInfo(
-        `If this is a credential/kubeconfig issue, run \`mesh login ${ctx ?? "<your platform context>"} --device\`, or \`mesh dev\` to relaunch the session cleanly.`
-      );
-      process.exit(1);
     }
-  });
+  );
   dev.command("doctor").description(
-    "Diagnose the dev session (creds, tunnels, config, ports, worktree, Temporal) \u2014 names the fix"
+    "Diagnose the dev session (creds, registry, config, ports, service processes, worktree, tunnels, Temporal) \u2014 names the fix"
   ).option("--stack <stack>", "Pulumi stack name").addOption(new Option("--stage <stack>", "Deprecated alias for --stack").hideHelp()).option("--json", "Machine-readable output").action(async (opts) => {
     const parentProfile = dev.opts().profile;
     if (parentProfile) {
       applyAwsProfileOverride(parentProfile);
     }
     const appRoot = findAppRoot2();
-    const projectName = getProjectName(appRoot);
-    const sessionName = dev.opts().session ?? `${projectName}-dev`;
+    const sessionName = sessionNameFor(appRoot, dev.opts().session);
     const state = loadSessionState(sessionName);
     const stack = state?.stack ?? detectStack(appRoot, resolveStackOption(opts));
     const asJson = !!opts.json || !!dev.opts().json;
@@ -7441,17 +8756,17 @@ function registerDevCommand(program) {
 // packages/mesh-cli/src/utils/tailscale-targets.ts
 var PORT_BLOCK = 3e3;
 function tenantPortIndex(tenant, registryPath) {
-  const p = registryPath ?? path16.join(CONFIG_DIR, "tailscale", "port-registry.json");
+  const p = registryPath ?? path19.join(CONFIG_DIR, "tailscale", "port-registry.json");
   let reg;
   try {
-    reg = JSON.parse(fs15.readFileSync(p, "utf8"));
+    reg = JSON.parse(fs18.readFileSync(p, "utf8"));
   } catch {
     reg = { mesh: 0 };
   }
   if (tenant in reg) return reg[tenant];
   const idx = Math.max(-1, ...Object.values(reg)) + 1;
   reg[tenant] = idx;
-  fs15.mkdirSync(path16.dirname(p), { recursive: true });
+  fs18.mkdirSync(path19.dirname(p), { recursive: true });
   atomicWriteFileSync(p, JSON.stringify(reg, null, 2), 384);
   return idx;
 }
@@ -7479,7 +8794,7 @@ function resolveTunnelTargets(services, resolveIp, portOffset = 0) {
 }
 function resolveElbIp(host) {
   try {
-    const out = execFileSync11("dig", ["+short", host, "@1.1.1.1"], {
+    const out = execFileSync12("dig", ["+short", host, "@1.1.1.1"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -7563,35 +8878,35 @@ function createForwarder(opts) {
 
 // packages/mesh-cli/src/utils/tunnel-ownership.ts
 import * as crypto2 from "node:crypto";
-import * as fs16 from "node:fs";
+import * as fs19 from "node:fs";
 import * as net5 from "node:net";
-import * as path17 from "node:path";
-import { execFileSync as execFileSync12 } from "node:child_process";
+import * as path20 from "node:path";
+import { execFileSync as execFileSync13 } from "node:child_process";
 function mintRunnerToken() {
   return crypto2.randomBytes(16).toString("hex");
 }
 function readRunnerManifest(file) {
-  if (!fs16.existsSync(file)) return null;
+  if (!fs19.existsSync(file)) return null;
   try {
-    return JSON.parse(fs16.readFileSync(file, "utf8"));
+    return JSON.parse(fs19.readFileSync(file, "utf8"));
   } catch {
     return null;
   }
 }
 function writeRunnerManifest(file, manifest) {
-  fs16.mkdirSync(path17.dirname(file), { recursive: true });
-  fs16.writeFileSync(file, JSON.stringify(manifest, null, 2), { mode: 384 });
+  fs19.mkdirSync(path20.dirname(file), { recursive: true });
+  fs19.writeFileSync(file, JSON.stringify(manifest, null, 2), { mode: 384 });
 }
 function clearRunnerManifest(file, token) {
   if (token !== void 0 && readRunnerManifest(file)?.token !== token) return;
   try {
-    fs16.unlinkSync(file);
+    fs19.unlinkSync(file);
   } catch {
   }
 }
 function getProcessGroupId(pid) {
   try {
-    const out = execFileSync12("ps", ["-o", "pgid=", "-p", String(pid)], {
+    const out = execFileSync13("ps", ["-o", "pgid=", "-p", String(pid)], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     }).trim();
@@ -7617,7 +8932,7 @@ function parseRunnerPidsFromPs(psOutput, tenant, exclude) {
 }
 function discoverRunnerPids(tenant, exclude) {
   try {
-    const out = execFileSync12("ps", ["ax", "-o", "pid=,command="], {
+    const out = execFileSync13("ps", ["ax", "-o", "pid=,command="], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -7709,7 +9024,7 @@ async function pollOwnership(check, deadlineMs) {
 }
 function describePortOwner(port) {
   try {
-    const out = execFileSync12("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN", "-Fcp"], {
+    const out = execFileSync13("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN", "-Fcp"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -7751,58 +9066,58 @@ function buildSquatterError(tenant, squatted, detail) {
 // packages/mesh-cli/src/utils/tailscale.ts
 var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 function tenantStateDir(tenant) {
-  return path18.join(CONFIG_DIR, "tailscale", tenant);
+  return path21.join(CONFIG_DIR, "tailscale", tenant);
 }
 function socketPath(tenant) {
-  return path18.join(tenantStateDir(tenant), "tailscaled.sock");
+  return path21.join(tenantStateDir(tenant), "tailscaled.sock");
 }
 function logPath(tenant) {
-  return path18.join(tenantStateDir(tenant), "tailscaled.log");
+  return path21.join(tenantStateDir(tenant), "tailscaled.log");
 }
 function statePath(tenant) {
-  return path18.join(tenantStateDir(tenant), "tunnel-state.json");
+  return path21.join(tenantStateDir(tenant), "tunnel-state.json");
 }
 function daemonMetaPath(tenant) {
-  return path18.join(tenantStateDir(tenant), "daemon.json");
+  return path21.join(tenantStateDir(tenant), "daemon.json");
 }
 function runnerManifestPath(tenant) {
-  return path18.join(tenantStateDir(tenant), "runner.json");
+  return path21.join(tenantStateDir(tenant), "runner.json");
 }
 function readTunnelState(tenant) {
   const p = statePath(tenant);
-  if (!fs17.existsSync(p)) return null;
+  if (!fs20.existsSync(p)) return null;
   try {
-    return JSON.parse(fs17.readFileSync(p, "utf8"));
+    return JSON.parse(fs20.readFileSync(p, "utf8"));
   } catch {
     return null;
   }
 }
 function writeTunnelState(tenant, state) {
-  fs17.mkdirSync(tenantStateDir(tenant), { recursive: true });
+  fs20.mkdirSync(tenantStateDir(tenant), { recursive: true });
   atomicWriteFileSync(statePath(tenant), JSON.stringify(state, null, 2), 384);
 }
 function clearTunnelState(tenant) {
   try {
-    fs17.unlinkSync(statePath(tenant));
+    fs20.unlinkSync(statePath(tenant));
   } catch {
   }
 }
 function readDaemonMeta(tenant) {
   const p = daemonMetaPath(tenant);
-  if (!fs17.existsSync(p)) return null;
+  if (!fs20.existsSync(p)) return null;
   try {
-    return JSON.parse(fs17.readFileSync(p, "utf8"));
+    return JSON.parse(fs20.readFileSync(p, "utf8"));
   } catch {
     return null;
   }
 }
 function writeDaemonMeta(tenant, meta) {
-  fs17.mkdirSync(tenantStateDir(tenant), { recursive: true });
+  fs20.mkdirSync(tenantStateDir(tenant), { recursive: true });
   atomicWriteFileSync(daemonMetaPath(tenant), JSON.stringify(meta, null, 2), 384);
 }
 function clearDaemonMeta(tenant) {
   try {
-    fs17.unlinkSync(daemonMetaPath(tenant));
+    fs20.unlinkSync(daemonMetaPath(tenant));
   } catch {
   }
 }
@@ -7822,18 +9137,18 @@ function tailscaleBinPath() {
 }
 function resolveBrewBin(name) {
   const brew = `/opt/homebrew/bin/${name}`;
-  if (fs17.existsSync(brew)) return brew;
+  if (fs20.existsSync(brew)) return brew;
   try {
-    const p = execFileSync13("which", [name], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    const p = execFileSync14("which", [name], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
     if (p) return p;
   } catch {
   }
   throw new Error(`${name} not found \u2014 install the standalone binary: brew install tailscale`);
 }
 function daemonState(tenant) {
-  if (!fs17.existsSync(socketPath(tenant))) return { backendState: "Down" };
+  if (!fs20.existsSync(socketPath(tenant))) return { backendState: "Down" };
   try {
-    const out = execFileSync13(
+    const out = execFileSync14(
       tailscaleBinPath(),
       ["--socket", socketPath(tenant), "status", "--json"],
       { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }
@@ -7853,7 +9168,7 @@ function findRunningDaemon(tenant) {
   const sock = socketPath(tenant);
   let out;
   try {
-    out = execFileSync13("ps", ["ax", "-o", "pid=,command="], {
+    out = execFileSync14("ps", ["ax", "-o", "pid=,command="], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -7905,8 +9220,8 @@ async function ensureDaemon(tenant, opts) {
     }
   }
   const dir = tenantStateDir(tenant);
-  fs17.mkdirSync(dir, { recursive: true });
-  const log = fs17.openSync(logPath(tenant), "a");
+  fs20.mkdirSync(dir, { recursive: true });
+  const log = fs20.openSync(logPath(tenant), "a");
   try {
     const child = spawn2(
       tailscaledBinPath(),
@@ -7926,7 +9241,7 @@ async function ensureDaemon(tenant, opts) {
     child.unref();
     if (child.pid) writeDaemonMeta(tenant, { socksPort: opts.socksPort, pid: child.pid });
   } finally {
-    fs17.closeSync(log);
+    fs20.closeSync(log);
   }
   for (let i = 0; i < 40; i++) {
     await sleep(250);
@@ -7952,7 +9267,7 @@ function stopDaemon(tenant) {
   }
   for (const p of [socketPath(tenant)]) {
     try {
-      fs17.unlinkSync(p);
+      fs20.unlinkSync(p);
     } catch {
     }
   }
@@ -7974,7 +9289,7 @@ function buildTailscaleUpArgs(opts) {
 }
 async function joinHeadscale(tenant, loginServer, opts = {}) {
   if (daemonState(tenant).backendState === "Running") return;
-  const hostname2 = `mesh-${tenant}-${os4.hostname().split(".")[0]}`;
+  const hostname2 = `mesh-${tenant}-${os3.hostname().split(".")[0]}`;
   const child = spawn2(
     tailscaleBinPath(),
     buildTailscaleUpArgs({ socket: socketPath(tenant), loginServer, hostname: hostname2, preAuthKey: opts.preAuthKey }),
@@ -8017,7 +9332,7 @@ async function joinHeadscale(tenant, loginServer, opts = {}) {
 }
 function logout(tenant) {
   try {
-    execFileSync13(tailscaleBinPath(), ["--socket", socketPath(tenant), "logout"], { stdio: "ignore" });
+    execFileSync14(tailscaleBinPath(), ["--socket", socketPath(tenant), "logout"], { stdio: "ignore" });
   } catch {
   }
 }
@@ -8097,7 +9412,7 @@ async function assertTunnelPortsFree(tenant, ports) {
 async function ensureForwarders(state) {
   const prior = readTunnelState(state.tenant);
   const expected = { socksPort: state.socksPort, ports: state.tunnels.map((t) => t.localPort) };
-  const runnerAlive = prior?.managed === "launchd" ? fs17.existsSync(launchAgentPath(state.tenant)) : pidAlive(prior?.supervisorPid);
+  const runnerAlive = prior?.managed === "launchd" ? fs20.existsSync(launchAgentPath(state.tenant)) : pidAlive(prior?.supervisorPid);
   if (prior && runnerAlive && tunnelTargetsEqual(prior.tunnels, state.tunnels) && // A prior supervisor spawned for a DIFFERENT SOCKS port still binds the same
   // local ports but dials a dead upstream — reusing it silently strands every
   // tunnel. The port must match, and the runner must PROVE it is
@@ -8122,7 +9437,7 @@ async function ensureForwarders(state) {
   if (launchdAvailable()) {
     state.managed = "launchd";
     writeTunnelState(state.tenant, state);
-    if (path18.isAbsolute(meshBin) && installLaunchAgent(state.tenant, meshBin)) {
+    if (path21.isAbsolute(meshBin) && installLaunchAgent(state.tenant, meshBin)) {
       if ((await awaitOwnership(state.tenant, expected, 8e3)).ok) return 0;
       uninstallLaunchAgent(state.tenant);
       await assertTunnelPortsFree(state.tenant, expected.ports);
@@ -8157,8 +9472,12 @@ async function ensureForwarders(state) {
 }
 function rewriteTunnelsForTargets(devOutput, targets) {
   const tunnels = { ...devOutput.tunnels };
+  for (const [name, tunnel] of Object.entries(devOutput.tunnels)) {
+    const target = targets.find((t) => t.name === name) ?? targets.find((t) => t.targetHost === tunnel.host && t.remotePort === tunnel.port);
+    if (target) tunnels[name] = { host: "localhost", port: target.localPort };
+  }
   for (const t of targets) {
-    tunnels[t.name] = { host: "localhost", port: t.localPort };
+    tunnels[t.name] ??= { host: "localhost", port: t.localPort };
   }
   return { ...devOutput, tunnels };
 }
@@ -8250,7 +9569,7 @@ function forwardersNeedingRebind(targets, listening) {
   return targets.filter((t) => !listening.has(t.localPort));
 }
 function launchAgentPath(tenant) {
-  return path18.join(os4.homedir(), "Library", "LaunchAgents", `${launchAgentLabel(tenant)}.plist`);
+  return path21.join(os3.homedir(), "Library", "LaunchAgents", `${launchAgentLabel(tenant)}.plist`);
 }
 function guiDomain() {
   return `gui/${process.getuid?.() ?? 0}`;
@@ -8259,8 +9578,8 @@ var _launchdAvailable;
 function launchdAvailable() {
   if (_launchdAvailable !== void 0) return _launchdAvailable;
   try {
-    execFileSync13("which", ["launchctl"], { stdio: "ignore" });
-    execFileSync13("launchctl", ["print", guiDomain()], { stdio: "ignore" });
+    execFileSync14("which", ["launchctl"], { stdio: "ignore" });
+    execFileSync14("launchctl", ["print", guiDomain()], { stdio: "ignore" });
     _launchdAvailable = true;
   } catch {
     _launchdAvailable = false;
@@ -8272,30 +9591,30 @@ function installLaunchAgent(tenant, meshBin) {
   try {
     let realMeshBin = meshBin;
     try {
-      realMeshBin = fs17.realpathSync(meshBin);
+      realMeshBin = fs20.realpathSync(meshBin);
     } catch {
     }
     let pathEnv = "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin";
     try {
-      pathEnv = `${path18.dirname(tailscaledBinPath())}:${pathEnv}`;
+      pathEnv = `${path21.dirname(tailscaledBinPath())}:${pathEnv}`;
     } catch {
     }
-    fs17.mkdirSync(path18.dirname(plistPath), { recursive: true });
-    fs17.writeFileSync(
+    fs20.mkdirSync(path21.dirname(plistPath), { recursive: true });
+    fs20.writeFileSync(
       plistPath,
       renderLaunchAgentPlist({
         tenant,
         meshBin: realMeshBin,
         nodeBin: process.execPath,
-        logPath: path18.join(tenantStateDir(tenant), "runner.log"),
+        logPath: path21.join(tenantStateDir(tenant), "runner.log"),
         pathEnv
       })
     );
     try {
-      execFileSync13("launchctl", ["bootout", guiDomain(), plistPath], { stdio: "ignore" });
+      execFileSync14("launchctl", ["bootout", guiDomain(), plistPath], { stdio: "ignore" });
     } catch {
     }
-    execFileSync13("launchctl", ["bootstrap", guiDomain(), plistPath], { stdio: "ignore" });
+    execFileSync14("launchctl", ["bootstrap", guiDomain(), plistPath], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -8304,11 +9623,11 @@ function installLaunchAgent(tenant, meshBin) {
 function uninstallLaunchAgent(tenant) {
   const plistPath = launchAgentPath(tenant);
   try {
-    execFileSync13("launchctl", ["bootout", guiDomain(), plistPath], { stdio: "ignore" });
+    execFileSync14("launchctl", ["bootout", guiDomain(), plistPath], { stdio: "ignore" });
   } catch {
   }
   try {
-    fs17.unlinkSync(plistPath);
+    fs20.unlinkSync(plistPath);
   } catch {
   }
 }
@@ -8537,7 +9856,7 @@ function headscaleExec(namespace, args, opts) {
     stdio: ["pipe", "pipe", "pipe"]
   };
   try {
-    const result = execFileSync14(
+    const result = execFileSync15(
       "kubectl",
       [
         "exec",
@@ -8566,7 +9885,7 @@ function clusterName(tenant, env) {
 }
 function assertPodReady(namespace, options) {
   try {
-    const output = execFileSync14(
+    const output = execFileSync15(
       "kubectl",
       [
         "get",
@@ -8601,7 +9920,7 @@ async function vpnStatus(options) {
   const ns = resolveNamespace(options);
   logInfo(`Checking Headscale in namespace ${ns}...`);
   assertPodReady(ns, options);
-  const podJson = execFileSync14(
+  const podJson = execFileSync15(
     "kubectl",
     [
       "get",
@@ -8623,7 +9942,7 @@ async function vpnStatus(options) {
   const restarts = container?.restartCount ?? 0;
   let endpoint = "unknown";
   try {
-    endpoint = execFileSync14(
+    endpoint = execFileSync15(
       "kubectl",
       [
         "get",
@@ -8778,7 +10097,7 @@ function findFreePort3() {
 }
 function findTailscale() {
   try {
-    return execFileSync14("which", ["tailscale"], {
+    return execFileSync15("which", ["tailscale"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     }).trim() || null;
@@ -8788,7 +10107,7 @@ function findTailscale() {
 }
 function tailscaleStatus() {
   try {
-    const json = execFileSync14("tailscale", ["status", "--json"], {
+    const json = execFileSync15("tailscale", ["status", "--json"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -8869,7 +10188,7 @@ async function vpnConnectSystem(endpoint) {
     "--accept-routes"
   ];
   try {
-    execFileSync14("tailscale", upArgs, { stdio: "inherit" });
+    execFileSync15("tailscale", upArgs, { stdio: "inherit" });
     console.log("");
     logSuccess("VPN connected.");
   } catch (error) {
@@ -8896,7 +10215,7 @@ async function vpnDisconnect(opts) {
     }
     logInfo("Disconnecting system VPN\u2026");
     try {
-      execFileSync14("tailscale", ["down"], { stdio: "inherit" });
+      execFileSync15("tailscale", ["down"], { stdio: "inherit" });
       logSuccess("VPN disconnected.");
     } catch (error) {
       const code = error.status;
@@ -8948,12 +10267,12 @@ function registerVpnCommands(program) {
 }
 
 // packages/mesh-cli/src/commands/login.ts
-var CONFIG_DIR = path19.join(
-  process.env.XDG_CONFIG_HOME ?? path19.join(process.env.HOME ?? "~", ".config"),
+var CONFIG_DIR = path22.join(
+  process.env.XDG_CONFIG_HOME ?? path22.join(process.env.HOME ?? "~", ".config"),
   "mesh"
 );
-var CONFIG_FILE = path19.join(CONFIG_DIR, "config.json");
-var CREDENTIALS_FILE = path19.join(CONFIG_DIR, "credentials.json");
+var CONFIG_FILE = path22.join(CONFIG_DIR, "config.json");
+var CREDENTIALS_FILE = path22.join(CONFIG_DIR, "credentials.json");
 var REDIRECT_PORT = 9876;
 var REDIRECT_URI = `http://localhost:${REDIRECT_PORT}/callback`;
 var BASE_SCOPES = "openid email profile offline_access urn:zitadel:iam:org:project:id:zitadel:aud";
@@ -8969,9 +10288,9 @@ function withDiscoveredFields(config, data) {
   return out;
 }
 function readConfig() {
-  if (!fs18.existsSync(CONFIG_FILE)) return {};
+  if (!fs21.existsSync(CONFIG_FILE)) return {};
   try {
-    return JSON.parse(fs18.readFileSync(CONFIG_FILE, "utf-8"));
+    return JSON.parse(fs21.readFileSync(CONFIG_FILE, "utf-8"));
   } catch {
     return {};
   }
@@ -8979,15 +10298,15 @@ function readConfig() {
 function writeContextConfig(context, config) {
   const existing = readConfig();
   existing[context] = config;
-  fs18.mkdirSync(CONFIG_DIR, { recursive: true });
-  fs18.writeFileSync(CONFIG_FILE, JSON.stringify(existing, null, 2));
+  fs21.mkdirSync(CONFIG_DIR, { recursive: true });
+  fs21.writeFileSync(CONFIG_FILE, JSON.stringify(existing, null, 2));
 }
 function clearContextConfig(context) {
   const existing = readConfig();
   if (!(context in existing)) return;
   delete existing[context];
-  fs18.mkdirSync(CONFIG_DIR, { recursive: true });
-  fs18.writeFileSync(CONFIG_FILE, JSON.stringify(existing, null, 2));
+  fs21.mkdirSync(CONFIG_DIR, { recursive: true });
+  fs21.writeFileSync(CONFIG_FILE, JSON.stringify(existing, null, 2));
 }
 function getContextConfig(context) {
   const config = readConfig();
@@ -9094,9 +10413,9 @@ function discoverConfigFromWellKnown(domain, contextKey = domain, opts = {}) {
   return discoverConfig(domain, contextKey, opts);
 }
 function readAllCredentials() {
-  if (!fs18.existsSync(CREDENTIALS_FILE)) return {};
+  if (!fs21.existsSync(CREDENTIALS_FILE)) return {};
   try {
-    return JSON.parse(fs18.readFileSync(CREDENTIALS_FILE, "utf-8"));
+    return JSON.parse(fs21.readFileSync(CREDENTIALS_FILE, "utf-8"));
   } catch {
     return {};
   }
@@ -9105,21 +10424,21 @@ function readCredentials(context) {
   return readAllCredentials()[context] ?? null;
 }
 var atomicWriteCounter = 0;
-function atomicWriteFileSync(path20, data, mode) {
-  const tmpPath = `${path20}.${process.pid}.${atomicWriteCounter++}.tmp`;
+function atomicWriteFileSync(path23, data, mode) {
+  const tmpPath = `${path23}.${process.pid}.${atomicWriteCounter++}.tmp`;
   try {
-    fs18.writeFileSync(tmpPath, data, { mode });
-    fs18.renameSync(tmpPath, path20);
+    fs21.writeFileSync(tmpPath, data, { mode });
+    fs21.renameSync(tmpPath, path23);
   } catch (err) {
     try {
-      fs18.unlinkSync(tmpPath);
+      fs21.unlinkSync(tmpPath);
     } catch {
     }
     throw err;
   }
 }
 function writeCredentials(context, creds) {
-  fs18.mkdirSync(CONFIG_DIR, { recursive: true });
+  fs21.mkdirSync(CONFIG_DIR, { recursive: true });
   const all = readAllCredentials();
   all[context] = creds;
   atomicWriteFileSync(CREDENTIALS_FILE, JSON.stringify(all, null, 2), 384);
@@ -9127,8 +10446,8 @@ function writeCredentials(context, creds) {
 function clearCredentials(context) {
   const all = readAllCredentials();
   delete all[context];
-  fs18.mkdirSync(CONFIG_DIR, { recursive: true });
-  fs18.writeFileSync(CREDENTIALS_FILE, JSON.stringify(all, null, 2), {
+  fs21.mkdirSync(CONFIG_DIR, { recursive: true });
+  fs21.writeFileSync(CREDENTIALS_FILE, JSON.stringify(all, null, 2), {
     mode: 384
   });
 }
@@ -9277,9 +10596,9 @@ function login(context, config) {
       const url = authUrl.toString();
       try {
         if (process.platform === "darwin") {
-          execFileSync15("open", [url], { stdio: "ignore" });
+          execFileSync16("open", [url], { stdio: "ignore" });
         } else if (process.platform === "linux") {
-          execFileSync15("xdg-open", [url], { stdio: "ignore" });
+          execFileSync16("xdg-open", [url], { stdio: "ignore" });
         } else {
           logInfo(`Open this URL in your browser:
 ${url}`);
@@ -9333,9 +10652,9 @@ async function attemptDeviceCode(context, config) {
   logInfo("Waiting for authorization...");
   try {
     if (process.platform === "darwin") {
-      execFileSync15("open", [openUrl], { stdio: "ignore" });
+      execFileSync16("open", [openUrl], { stdio: "ignore" });
     } else if (process.platform === "linux") {
-      execFileSync15("xdg-open", [openUrl], { stdio: "ignore" });
+      execFileSync16("xdg-open", [openUrl], { stdio: "ignore" });
     }
   } catch {
   }
@@ -9398,7 +10717,7 @@ function loginTimeoutMessage(context) {
 }
 function isRemoteEnvironment() {
   if (process.env.REMOTE_CONTAINERS || process.env.CODESPACES) return true;
-  if (fs18.existsSync("/.dockerenv")) return true;
+  if (fs21.existsSync("/.dockerenv")) return true;
   if (process.env.SSH_CLIENT || process.env.SSH_TTY) return true;
   if (!process.stdout.isTTY || !process.stdin.isTTY) return true;
   return false;
@@ -9652,9 +10971,9 @@ function refuseReservedRegistryContext(context, verb) {
 }
 async function hintRegistryIfMissing() {
   try {
-    const { readRegistrySession } = await import("./mesh.registry-identity-JW4KO7N7.js");
+    const { readRegistrySession } = await import("./mesh.registry-identity-3AR27UGO.js");
     if (readRegistrySession()) return;
-    const { probeRegistryToken: probeRegistryToken2 } = await import("./mesh.auth-preflight-AQJ5TQES.js");
+    const { probeRegistryToken: probeRegistryToken2 } = await import("./mesh.auth-preflight-AUFQ2FGD.js");
     const probe = await probeRegistryToken2();
     if (probe.state === "missing" || probe.state === "expired") {
       logInfo(REGISTRY_SEPARATE_HINT);
@@ -9786,12 +11105,12 @@ export AWS_REGION=${shellSingleQuote(args.region)}
 `;
 }
 function resolveUserAwsConfigPath(env = process.env) {
-  return env.AWS_CONFIG_FILE ?? path19.join(env.HOME ?? "~", ".aws", "config");
+  return env.AWS_CONFIG_FILE ?? path22.join(env.HOME ?? "~", ".aws", "config");
 }
 function canWriteDir(dir) {
   try {
-    fs18.mkdirSync(dir, { recursive: true });
-    fs18.accessSync(dir, fs18.constants.W_OK);
+    fs21.mkdirSync(dir, { recursive: true });
+    fs21.accessSync(dir, fs21.constants.W_OK);
     return true;
   } catch {
     return false;
@@ -9799,9 +11118,9 @@ function canWriteDir(dir) {
 }
 function resolveAwsConfigTarget(env = process.env) {
   if (env.AWS_CONFIG_FILE) return { configPath: env.AWS_CONFIG_FILE, redirected: false };
-  const real = path19.join(env.HOME ?? "~", ".aws", "config");
-  if (canWriteDir(path19.dirname(real))) return { configPath: real, redirected: false };
-  return { configPath: path19.join(CONFIG_DIR, "aws-config"), redirected: true };
+  const real = path22.join(env.HOME ?? "~", ".aws", "config");
+  if (canWriteDir(path22.dirname(real))) return { configPath: real, redirected: false };
+  return { configPath: path22.join(CONFIG_DIR, "aws-config"), redirected: true };
 }
 function resolveRoleOrExplain(opts, config) {
   const role = opts.role ?? process.env.MESH_AWS_ROLE ?? config.defaultRole;
@@ -9933,10 +11252,10 @@ async function exportAwsCredentials(context, config, opts) {
   const sanitized = context.replace(/[^A-Za-z0-9_-]/g, "-");
   const profileName = `mesh-${sanitized}`;
   const { configPath, redirected } = resolveAwsConfigTarget();
-  fs18.mkdirSync(path19.dirname(configPath), { recursive: true });
-  const existedBefore = fs18.existsSync(configPath);
-  const existing = existedBefore ? fs18.readFileSync(configPath, "utf-8") : "";
-  const mode = existedBefore ? fs18.statSync(configPath).mode & 511 : 384;
+  fs21.mkdirSync(path22.dirname(configPath), { recursive: true });
+  const existedBefore = fs21.existsSync(configPath);
+  const existing = existedBefore ? fs21.readFileSync(configPath, "utf-8") : "";
+  const mode = existedBefore ? fs21.statSync(configPath).mode & 511 : 384;
   atomicWriteFileSync(
     configPath,
     upsertManagedAwsConfigSection(
@@ -10052,18 +11371,21 @@ export {
   adoptPublishedHubProject,
   readAllContextConfigs,
   discoverConfigForContext,
+  derivePlatformRef,
   readStackPlatform,
   derivePlatformContext,
   projectRoleKeys,
   resolveAwsCredentials,
   credProbeToPreflightError,
   resolvePulumiEnv,
+  devSessionsRoot,
   resolveHubPlatformName,
   ensureKubeconfig,
   resolveTemporalAuth,
   acquireTemporalBearer,
   findRepoRoot2 as findRepoRoot,
   writeEnvFile,
+  pickLaunchHostEnv,
   buildLaunchCommand,
   waitForPort,
   MOCK_SAML_PORT,
@@ -10077,6 +11399,7 @@ export {
   seedMockIdps,
   reconcileRegistryFromZitadel,
   detectLocalTenant,
+  removeLocalAppSpiceDBs,
   removeAllAliasContainers,
   resolveStackOption,
   worktreeStackName,