@mesh-tech/mesh-cli 0.40.10 → 0.40.11

package/dist/bin/{mesh.program-T57YYRF5.js → mesh.program-WSFVQU7P.js}

@@ -2,20 +2,20 @@ import {
   CLI_DESCRIPTION,
   CLI_NAME,
   createProgram
-} from "./mesh.chunk-M23VKWSF.js";
-import "./mesh.chunk-N55Y3YII.js";
-import "./mesh.chunk-NT2NPR7J.js";
-import "./mesh.chunk-TG4FBJK3.js";
-import "./mesh.chunk-CA4LI762.js";
-import "./mesh.chunk-CN6PMHQ5.js";
+} from "./mesh.chunk-GLG5JBI7.js";
+import "./mesh.chunk-EHLBX24J.js";
+import "./mesh.chunk-O677AU5E.js";
+import "./mesh.chunk-O5CP4NPZ.js";
+import "./mesh.chunk-WT27GBE4.js";
+import "./mesh.chunk-YKW256CK.js";
 import "./mesh.chunk-F4654EPX.js";
-import "./mesh.chunk-SOX2CJMU.js";
-import "./mesh.chunk-TFOKVJ34.js";
+import "./mesh.chunk-DYWR76EO.js";
+import "./mesh.chunk-3WJGDNHA.js";
 import "./mesh.chunk-2QIVBQX5.js";
 import "./mesh.chunk-MCBMHWXP.js";
 import "./mesh.chunk-WFFDF346.js";
 import "./mesh.chunk-IQOBTL42.js";
-import "./mesh.chunk-SEIVILJR.js";
+import "./mesh.chunk-4XX62O6Z.js";
 import "./mesh.chunk-OW5EMVG5.js";
 export {
   CLI_DESCRIPTION,

package/dist/bin/{mesh.registry-UTIC3OY2.js → mesh.registry-5U4L6256.js}

@@ -17,14 +17,14 @@ import {
   runRegistryStatus,
   shouldRemintAfter,
   shouldRepairUserNpmrc
-} from "./mesh.chunk-CN6PMHQ5.js";
-import "./mesh.chunk-SOX2CJMU.js";
-import "./mesh.chunk-TFOKVJ34.js";
+} from "./mesh.chunk-YKW256CK.js";
+import "./mesh.chunk-DYWR76EO.js";
+import "./mesh.chunk-3WJGDNHA.js";
 import "./mesh.chunk-2QIVBQX5.js";
 import "./mesh.chunk-MCBMHWXP.js";
 import "./mesh.chunk-WFFDF346.js";
 import "./mesh.chunk-IQOBTL42.js";
-import "./mesh.chunk-SEIVILJR.js";
+import "./mesh.chunk-4XX62O6Z.js";
 export {
   CONTEXT_IGNORED_NOTICE,
   NOT_AUTHORIZED_RERUN,

package/dist/bin/{mesh.registry-identity-Y4Y5WFQ3.js → mesh.registry-identity-6UPUHKO2.js}

@@ -15,13 +15,13 @@ import {
   registrySessionCandidates,
   registryTokenRoles,
   resolveRegistryIdentity
-} from "./mesh.chunk-SOX2CJMU.js";
-import "./mesh.chunk-TFOKVJ34.js";
+} from "./mesh.chunk-DYWR76EO.js";
+import "./mesh.chunk-3WJGDNHA.js";
 import "./mesh.chunk-2QIVBQX5.js";
 import "./mesh.chunk-MCBMHWXP.js";
 import "./mesh.chunk-WFFDF346.js";
 import "./mesh.chunk-IQOBTL42.js";
-import "./mesh.chunk-SEIVILJR.js";
+import "./mesh.chunk-4XX62O6Z.js";
 export {
   REGISTRY_ALIAS,
   REGISTRY_CREDENTIAL_KEY,

package/dist/bin/{mesh.review-command-LYTUNZ5G.js → mesh.review-command-MLBWVHF7.js}

@@ -10,15 +10,15 @@ import {
   discoverStackExternalServices,
   ensureAwsCredentialsForStack,
   resolveExternalServiceScope
-} from "./mesh.chunk-N55Y3YII.js";
-import "./mesh.chunk-TFOKVJ34.js";
+} from "./mesh.chunk-EHLBX24J.js";
+import "./mesh.chunk-3WJGDNHA.js";
 import "./mesh.chunk-2QIVBQX5.js";
 import "./mesh.chunk-MCBMHWXP.js";
 import {
   logInfo
 } from "./mesh.chunk-WFFDF346.js";
 import "./mesh.chunk-IQOBTL42.js";
-import "./mesh.chunk-SEIVILJR.js";
+import "./mesh.chunk-4XX62O6Z.js";
 
 // packages/mesh-cli/src/commands/mcp/review-command.ts
 import { SSMClient } from "@aws-sdk/client-ssm";

package/dist/bin/{mesh.start-OWIKVKN6.js → mesh.start-24YIFB4O.js}

@@ -4,7 +4,7 @@ import {
   reportAssembly,
   resolveCliRuntime,
   runAssemble
-} from "./mesh.chunk-NT2NPR7J.js";
+} from "./mesh.chunk-O677AU5E.js";
 import {
   logError,
   logInfo,
@@ -13,7 +13,7 @@ import {
 import {
   homeNpmrcPath,
   parseNpmrcRegistryAuth
-} from "./mesh.chunk-SEIVILJR.js";
+} from "./mesh.chunk-4XX62O6Z.js";
 
 // packages/mesh-cli/src/docs/start.ts
 import { execFileSync as execFileSync2 } from "node:child_process";

package/dist/bin/{mesh.wizard-QL5SQ47K.js → mesh.wizard-6HMOBC5L.js}

@@ -2,24 +2,24 @@ import {
   bootstrapAppsRepo,
   isInsidePlatformMonorepo,
   shouldBootstrapAppsRepo
-} from "./mesh.chunk-TG4FBJK3.js";
+} from "./mesh.chunk-O5CP4NPZ.js";
 import {
   PLATFORM_SETUP_DEFAULTS,
   ensureStateBucket,
   renderPlatformNextSteps,
   resolvePlatformSetup,
   scaffoldPlatformRepo
-} from "./mesh.chunk-CA4LI762.js";
+} from "./mesh.chunk-WT27GBE4.js";
 import {
   RegistryNotAuthorizedError
-} from "./mesh.chunk-CN6PMHQ5.js";
+} from "./mesh.chunk-YKW256CK.js";
 import {
   resolveTargetRoot,
   syncSkills
 } from "./mesh.chunk-F4654EPX.js";
 import {
   readRegistrySession
-} from "./mesh.chunk-SOX2CJMU.js";
+} from "./mesh.chunk-DYWR76EO.js";
 import {
   detectLocalTenant,
   discoverConfigForContext,
@@ -31,7 +31,7 @@ import {
   runLoginFlow,
   tokenStillValid,
   writeMeshJson
-} from "./mesh.chunk-TFOKVJ34.js";
+} from "./mesh.chunk-3WJGDNHA.js";
 import "./mesh.chunk-2QIVBQX5.js";
 import "./mesh.chunk-MCBMHWXP.js";
 import {
@@ -44,7 +44,7 @@ import {
 } from "./mesh.chunk-IQOBTL42.js";
 import {
   probeRegistryToken
-} from "./mesh.chunk-SEIVILJR.js";
+} from "./mesh.chunk-4XX62O6Z.js";
 
 // packages/mesh-cli/src/commands/init/wizard.ts
 import * as fs from "fs";
@@ -157,7 +157,7 @@ var registryStep = {
     try {
       logInfo(REGISTRY_WHY);
       const login = ctx.seams?.runRegistryLogin ?? (async (opts) => {
-        const { runRegistryLogin } = await import("./mesh.registry-UTIC3OY2.js");
+        const { runRegistryLogin } = await import("./mesh.registry-5U4L6256.js");
         await runRegistryLogin(void 0, opts);
       });
       await login({ device: ctx.device, profile: ctx.profile });

package/dist/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "772a007d6",
-  "builtAt": "2026-10-25T03:35:13.360Z"
+  "commit": "3c7a4caed",
+  "builtAt": "2026-10-25T07:07:10.710Z"
 }

package/dist/src/commands/local/index.js

@@ -9,7 +9,7 @@ import { probeRegistryToken, REGISTRY_LOGIN_FIX } from "../../utils/auth-preflig
 import { ensureHubAuthImage, ensureHubImages, buildHubImagesFromSource, readHubCompiledAuthz, hasRegistryAuth, localHubVersion, planWithHubRefresh, } from "./hub-local.js";
 import { reconcileRegistryFromZitadel } from "./auth-provision.js";
 import { LOCAL_AWS_CONFIG, localAwsEnv, seedLocalPlatform, verifyFabric } from "./seed.js";
-import { LOGIN_CONTEXT, readHubAuth, seedMockIdps, seedZitadel, TEST_USERS } from "./seed-zitadel.js";
+import { hubAuthComposeEnv, LOGIN_CONTEXT, readHubAuth, seedMockIdps, seedZitadel, TEST_USERS, } from "./seed-zitadel.js";
 import { idpEndpoints, mockIdpComposeEnv, MOCK_OIDC_PORT, MOCK_SAML_PORT } from "./mock-idps.js";
 import { publishHubAuthzCatalog } from "./seed-hub-catalog.js";
 import { removeAllAliasContainers } from "./publish-docs.js";
@@ -263,12 +263,10 @@ export function registerLocalCommands(program) {
                 logWarn(`--no-seed with MESH_HUB_PORT=${hubPort()}: this port's redirect URI is registered during seeding — if Hub sign-in fails with "redirect_uri is missing in the client configuration", re-run without --no-seed.`);
             }
             ensureHubAuthImage();
-            const hubEnv = { MESH_HUB_VERSION: hubVersion };
-            if (hubAuth) {
-                hubEnv.MESH_HUB_OAUTH2_CLIENT_ID = hubAuth.clientId;
-                hubEnv.MESH_HUB_OAUTH2_CLIENT_SECRET = hubAuth.clientSecret;
-                hubEnv.MESH_HUB_OAUTH2_COOKIE_SECRET = hubAuth.cookieSecret;
-            }
+            const hubEnv = {
+                MESH_HUB_VERSION: hubVersion,
+                ...(hubAuth ? hubAuthComposeEnv(hubAuth) : {}),
+            };
             await composeStreamed(["up", "-d"], {
                 hub: true,
                 idps: opts.withIdps,

package/dist/src/commands/local/seed-zitadel.d.ts

@@ -39,6 +39,7 @@ export declare function ensureZitadelProject(pat: string, name: string, opts?: {
     orgId?: string;
     describe?: string;
     logExisting?: boolean;
+    projectRoleAssertion?: boolean;
 }): Promise<string>;
 export declare function searchZitadelApp(pat: string, projectId: string, name: string, orgId?: string): Promise<any | undefined>;
 export interface HubAuthConfig {
@@ -48,7 +49,10 @@ export interface HubAuthConfig {
     projectId: string;
 }
 export declare function hubAuthPath(): string;
+export declare function hubSignInScope(projectId: string): string;
+export declare function hubAuthComposeEnv(auth: HubAuthConfig): Record<string, string>;
 export declare function readHubAuth(): HubAuthConfig | null;
+export declare const ensureHubProject: (pat: string) => Promise<string>;
 interface HubOidcApp {
     id: string;
     oidcConfig?: {
@@ -65,6 +69,20 @@ interface HubOidcApp {
     };
 }
 export declare function reconcileHubRedirectUris(pat: string, projectId: string, app: HubOidcApp): Promise<void>;
+export declare function buildHubAppPayload(): {
+    name: string;
+    redirectUris: string[];
+    postLogoutRedirectUris: string[];
+    responseTypes: string[];
+    grantTypes: string[];
+    appType: string;
+    authMethodType: string;
+    accessTokenType: string;
+    accessTokenRoleAssertion: boolean;
+    idTokenRoleAssertion: boolean;
+    idTokenUserinfoAssertion: boolean;
+    devMode: boolean;
+};
 export declare function seedHubAuth(pat: string): Promise<HubAuthConfig>;
 export declare const OPS_HUB_SECRET_ID = "mesh/local/dev/zitadel/ops-hub";
 export interface ZitadelSeedResult {

package/dist/src/commands/local/seed-zitadel.js

@@ -94,13 +94,26 @@ export async function api(pat, method, apiPath, body, orgId) {
 export const isAlreadyExists = (err) => err?.status === 409 || err?.zitadelCode === 6 || /already exists/i.test(err?.message ?? "");
 export async function ensureZitadelProject(pat, name, opts = {}) {
     const search = await api(pat, "POST", "/management/v1/projects/_search", { queries: [{ nameQuery: { name, method: "TEXT_QUERY_METHOD_EQUALS" } }] }, opts.orgId);
-    const existing = search?.result?.[0]?.id;
-    if (existing) {
+    const existing = search?.result?.[0];
+    if (existing?.id) {
         if (opts.logExisting)
             logInfo(`Zitadel project '${name}' already exists`);
-        return existing;
+        const wanted = opts.projectRoleAssertion;
+        if (wanted !== undefined && (existing.projectRoleAssertion ?? false) !== wanted) {
+            await api(pat, "PUT", `/management/v1/projects/${existing.id}`, {
+                name: existing.name ?? name,
+                projectRoleAssertion: wanted,
+                projectRoleCheck: existing.projectRoleCheck ?? false,
+                hasProjectCheck: existing.hasProjectCheck ?? false,
+                ...(existing.privateLabelingSetting
+                    ? { privateLabelingSetting: existing.privateLabelingSetting }
+                    : {}),
+            }, opts.orgId);
+            logSuccess(`Zitadel project '${name}': role assertion turned ${wanted ? "on" : "off"}`);
+        }
+        return existing.id;
     }
-    const created = await api(pat, "POST", "/management/v1/projects", { name, projectRoleAssertion: true }, opts.orgId);
+    const created = await api(pat, "POST", "/management/v1/projects", { name, projectRoleAssertion: opts.projectRoleAssertion ?? true }, opts.orgId);
     logSuccess(`Created Zitadel project '${name}'${opts.describe ? ` (${opts.describe})` : ""}`);
     return created.id;
 }
@@ -151,6 +164,21 @@ async function ensureTestUsers(pat) {
 export function hubAuthPath() {
     return path.join(meshCacheDir("mesh-local"), "hub-auth.json");
 }
+export function hubSignInScope(projectId) {
+    return [
+        "openid email profile",
+        "urn:zitadel:iam:org:projects:roles",
+        `urn:zitadel:iam:org:project:id:${projectId}:aud`,
+    ].join(" ");
+}
+export function hubAuthComposeEnv(auth) {
+    return {
+        MESH_HUB_OAUTH2_CLIENT_ID: auth.clientId,
+        MESH_HUB_OAUTH2_CLIENT_SECRET: auth.clientSecret,
+        MESH_HUB_OAUTH2_COOKIE_SECRET: auth.cookieSecret,
+        ...(auth.projectId ? { MESH_HUB_OAUTH2_SCOPE: hubSignInScope(auth.projectId) } : {}),
+    };
+}
 export function readHubAuth() {
     try {
         const parsed = JSON.parse(fs.readFileSync(hubAuthPath(), "utf-8"));
@@ -162,7 +190,10 @@ export function readHubAuth() {
         return null;
     }
 }
-const ensureHubProject = (pat) => ensureZitadelProject(pat, HUB_PROJECT_NAME, { describe: "Hub platform app" });
+export const ensureHubProject = (pat) => ensureZitadelProject(pat, HUB_PROJECT_NAME, {
+    describe: "Hub platform app",
+    projectRoleAssertion: false,
+});
 function hubRoleDisplayName(roleKey) {
     const tenant = hubRoleKeyTenant(roleKey);
     return tenant === null ? roleKey : `${restrictedRoleBase(roleKey) ?? roleKey} (${tenant})`;
@@ -218,19 +249,8 @@ export async function reconcileHubRedirectUris(pat, projectId, app) {
     });
     logSuccess(`Registered Hub redirect URI http://localhost:${hubPort()}/oauth2/callback (MESH_HUB_PORT)`);
 }
-async function ensureHubApp(pat, projectId) {
-    const existing = await searchZitadelApp(pat, projectId, HUB_APP_NAME);
-    if (existing) {
-        await reconcileHubRedirectUris(pat, projectId, existing);
-        const clientId = existing?.oidcConfig?.clientId;
-        const persisted = readHubAuth();
-        if (persisted && persisted.clientId === clientId)
-            return { clientId };
-        const regenerated = await api(pat, "POST", `/management/v1/projects/${projectId}/apps/${existing.id}/oidc_config/_generate_client_secret`, {});
-        logSuccess(`Regenerated Hub UI client secret (local copy was missing)`);
-        return { clientId, clientSecret: regenerated.clientSecret };
-    }
-    const created = await api(pat, "POST", `/management/v1/projects/${projectId}/apps/oidc`, {
+export function buildHubAppPayload() {
+    return {
         name: HUB_APP_NAME,
         redirectUris: [...new Set([hubRedirectUri(), HUB_DEFAULT_REDIRECT_URI])],
         postLogoutRedirectUris: [
@@ -250,7 +270,21 @@ async function ensureHubApp(pat, projectId) {
         idTokenRoleAssertion: true,
         idTokenUserinfoAssertion: true,
         devMode: true,
-    });
+    };
+}
+async function ensureHubApp(pat, projectId) {
+    const existing = await searchZitadelApp(pat, projectId, HUB_APP_NAME);
+    if (existing) {
+        await reconcileHubRedirectUris(pat, projectId, existing);
+        const clientId = existing?.oidcConfig?.clientId;
+        const persisted = readHubAuth();
+        if (persisted && persisted.clientId === clientId)
+            return { clientId };
+        const regenerated = await api(pat, "POST", `/management/v1/projects/${projectId}/apps/${existing.id}/oidc_config/_generate_client_secret`, {});
+        logSuccess(`Regenerated Hub UI client secret (local copy was missing)`);
+        return { clientId, clientSecret: regenerated.clientSecret };
+    }
+    const created = await api(pat, "POST", `/management/v1/projects/${projectId}/apps/oidc`, buildHubAppPayload());
     logSuccess(`Created Zitadel application '${HUB_APP_NAME}' (Hub UI web client, code flow)`);
     return { clientId: created.clientId, clientSecret: created.clientSecret };
 }