@mesh-tech/mesh-cli 0.40.10 → 0.40.11

package/dist/bin/{mesh.auth-preflight-RCZH7V34.js → mesh.auth-preflight-BGI5LPLN.js}

@@ -21,7 +21,7 @@ import {
   registryPreflight,
   stripUnscopedCodeArtifactRegistry,
   upsertNpmrcLines
-} from "./mesh.chunk-SEIVILJR.js";
+} from "./mesh.chunk-4XX62O6Z.js";
 export {
   REGISTRY_LOGIN_FIX,
   REGISTRY_LOGIN_FIX_AWS,

package/dist/bin/{mesh.chunk-TFOKVJ34.js → mesh.chunk-3WJGDNHA.js}

@@ -49,7 +49,7 @@ import {
   isExpiredAwsTokenMessage,
   probeRegistryToken,
   registryLoginFix
-} from "./mesh.chunk-SEIVILJR.js";
+} from "./mesh.chunk-4XX62O6Z.js";
 
 // packages/mesh-cli/src/commands/login.ts
 import * as http from "http";
@@ -2700,16 +2700,33 @@ async function ensureZitadelProject(pat, name, opts = {}) {
     { queries: [{ nameQuery: { name, method: "TEXT_QUERY_METHOD_EQUALS" } }] },
     opts.orgId
   );
-  const existing = search?.result?.[0]?.id;
-  if (existing) {
+  const existing = search?.result?.[0];
+  if (existing?.id) {
     if (opts.logExisting) logInfo(`Zitadel project '${name}' already exists`);
-    return existing;
+    const wanted = opts.projectRoleAssertion;
+    if (wanted !== void 0 && (existing.projectRoleAssertion ?? false) !== wanted) {
+      await api(
+        pat,
+        "PUT",
+        `/management/v1/projects/${existing.id}`,
+        {
+          name: existing.name ?? name,
+          projectRoleAssertion: wanted,
+          projectRoleCheck: existing.projectRoleCheck ?? false,
+          hasProjectCheck: existing.hasProjectCheck ?? false,
+          ...existing.privateLabelingSetting ? { privateLabelingSetting: existing.privateLabelingSetting } : {}
+        },
+        opts.orgId
+      );
+      logSuccess(`Zitadel project '${name}': role assertion turned ${wanted ? "on" : "off"}`);
+    }
+    return existing.id;
   }
   const created = await api(
     pat,
     "POST",
     "/management/v1/projects",
-    { name, projectRoleAssertion: true },
+    { name, projectRoleAssertion: opts.projectRoleAssertion ?? true },
     opts.orgId
   );
   logSuccess(`Created Zitadel project '${name}'${opts.describe ? ` (${opts.describe})` : ""}`);
@@ -2771,6 +2788,21 @@ async function ensureTestUsers(pat) {
 function hubAuthPath() {
   return path10.join(meshCacheDir("mesh-local"), "hub-auth.json");
 }
+function hubSignInScope(projectId) {
+  return [
+    "openid email profile",
+    "urn:zitadel:iam:org:projects:roles",
+    `urn:zitadel:iam:org:project:id:${projectId}:aud`
+  ].join(" ");
+}
+function hubAuthComposeEnv(auth) {
+  return {
+    MESH_HUB_OAUTH2_CLIENT_ID: auth.clientId,
+    MESH_HUB_OAUTH2_CLIENT_SECRET: auth.clientSecret,
+    MESH_HUB_OAUTH2_COOKIE_SECRET: auth.cookieSecret,
+    ...auth.projectId ? { MESH_HUB_OAUTH2_SCOPE: hubSignInScope(auth.projectId) } : {}
+  };
+}
 function readHubAuth() {
   try {
     const parsed = JSON.parse(fs10.readFileSync(hubAuthPath(), "utf-8"));
@@ -2780,7 +2812,10 @@ function readHubAuth() {
     return null;
   }
 }
-var ensureHubProject = (pat) => ensureZitadelProject(pat, HUB_PROJECT_NAME, { describe: "Hub platform app" });
+var ensureHubProject = (pat) => ensureZitadelProject(pat, HUB_PROJECT_NAME, {
+  describe: "Hub platform app",
+  projectRoleAssertion: false
+});
 function hubRoleDisplayName(roleKey) {
   const tenant = hubRoleKeyTenant(roleKey);
   return tenant === null ? roleKey : `${restrictedRoleBase(roleKey) ?? roleKey} (${tenant})`;
@@ -2835,23 +2870,8 @@ async function reconcileHubRedirectUris(pat, projectId, app) {
     `Registered Hub redirect URI http://localhost:${hubPort()}/oauth2/callback (MESH_HUB_PORT)`
   );
 }
-async function ensureHubApp(pat, projectId) {
-  const existing = await searchZitadelApp(pat, projectId, HUB_APP_NAME);
-  if (existing) {
-    await reconcileHubRedirectUris(pat, projectId, existing);
-    const clientId = existing?.oidcConfig?.clientId;
-    const persisted = readHubAuth();
-    if (persisted && persisted.clientId === clientId) return { clientId };
-    const regenerated = await api(
-      pat,
-      "POST",
-      `/management/v1/projects/${projectId}/apps/${existing.id}/oidc_config/_generate_client_secret`,
-      {}
-    );
-    logSuccess(`Regenerated Hub UI client secret (local copy was missing)`);
-    return { clientId, clientSecret: regenerated.clientSecret };
-  }
-  const created = await api(pat, "POST", `/management/v1/projects/${projectId}/apps/oidc`, {
+function buildHubAppPayload() {
+  return {
     name: HUB_APP_NAME,
     redirectUris: [.../* @__PURE__ */ new Set([hubRedirectUri(), HUB_DEFAULT_REDIRECT_URI])],
     postLogoutRedirectUris: [
@@ -2873,7 +2893,30 @@ async function ensureHubApp(pat, projectId) {
     idTokenRoleAssertion: true,
     idTokenUserinfoAssertion: true,
     devMode: true
-  });
+  };
+}
+async function ensureHubApp(pat, projectId) {
+  const existing = await searchZitadelApp(pat, projectId, HUB_APP_NAME);
+  if (existing) {
+    await reconcileHubRedirectUris(pat, projectId, existing);
+    const clientId = existing?.oidcConfig?.clientId;
+    const persisted = readHubAuth();
+    if (persisted && persisted.clientId === clientId) return { clientId };
+    const regenerated = await api(
+      pat,
+      "POST",
+      `/management/v1/projects/${projectId}/apps/${existing.id}/oidc_config/_generate_client_secret`,
+      {}
+    );
+    logSuccess(`Regenerated Hub UI client secret (local copy was missing)`);
+    return { clientId, clientSecret: regenerated.clientSecret };
+  }
+  const created = await api(
+    pat,
+    "POST",
+    `/management/v1/projects/${projectId}/apps/oidc`,
+    buildHubAppPayload()
+  );
   logSuccess(`Created Zitadel application '${HUB_APP_NAME}' (Hub UI web client, code flow)`);
   return { clientId: created.clientId, clientSecret: created.clientSecret };
 }
@@ -7842,7 +7885,7 @@ function registerDevCommand(program) {
     "tmux"
   );
   dev.command("__token-server <port> <context>", { hidden: true }).action(async (port, context) => {
-    const { startTokenServer } = await import("./mesh.dev-token-server-DIECW5KC.js");
+    const { startTokenServer } = await import("./mesh.dev-token-server-IJUVRBWI.js");
     await startTokenServer(Number(port), context);
   });
   dev.action(async (options) => {
@@ -10980,9 +11023,9 @@ function refuseReservedRegistryContext(context, verb) {
 }
 async function hintRegistryIfMissing() {
   try {
-    const { readRegistrySession } = await import("./mesh.registry-identity-Y4Y5WFQ3.js");
+    const { readRegistrySession } = await import("./mesh.registry-identity-6UPUHKO2.js");
     if (readRegistrySession()) return;
-    const { probeRegistryToken: probeRegistryToken2 } = await import("./mesh.auth-preflight-RCZH7V34.js");
+    const { probeRegistryToken: probeRegistryToken2 } = await import("./mesh.auth-preflight-BGI5LPLN.js");
     const probe = await probeRegistryToken2();
     if (probe.state === "missing" || probe.state === "expired") {
       logInfo(REGISTRY_SEPARATE_HINT);
@@ -11403,6 +11446,7 @@ export {
   mockIdpComposeEnv,
   LOGIN_CONTEXT,
   TEST_USERS,
+  hubAuthComposeEnv,
   readHubAuth,
   seedZitadel,
   seedMockIdps,