@mesh-tech/mesh-cli 0.44.0 → 0.45.0

package/dist/bin/{mesh.chunk-HB2IZKLP.js → mesh.chunk-SFIJZF3S.js}

@@ -49,14 +49,14 @@ import {
   isExpiredAwsTokenMessage,
   probeRegistryToken,
   registryLoginFix
-} from "./mesh.chunk-HC7V75J3.js";
+} from "./mesh.chunk-UJAPUO2W.js";
 
 // packages/mesh-cli/src/commands/login.ts
 import * as http from "http";
 import * as crypto3 from "crypto";
-import * as fs21 from "fs";
-import * as path22 from "path";
-import { execFileSync as execFileSync16 } from "child_process";
+import * as fs23 from "fs";
+import * as path24 from "path";
+import { execFileSync as execFileSync17 } from "child_process";
 
 // packages/mesh-cli/src/utils/aws-auth.ts
 import * as fs2 from "fs";
@@ -263,8 +263,8 @@ ${body}${MANAGED_END}
     return existing.slice(0, startIdx) + section + existing.slice(tail);
   }
   if (existing.length === 0) return section;
-  const sep3 = existing.endsWith("\n\n") ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
-  return existing + sep3 + section;
+  const sep4 = existing.endsWith("\n\n") ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
+  return existing + sep4 + section;
 }
 function stripBareProfile(existing, profileName) {
   const header = `[profile ${profileName}]`;
@@ -566,7 +566,7 @@ async function resolveAwsCredentials(roleArn, appRoot, stack) {
 }
 
 // packages/mesh-cli/src/commands/vpn/index.ts
-import { execFileSync as execFileSync15 } from "child_process";
+import { execFileSync as execFileSync16 } from "child_process";
 import * as net8 from "node:net";
 
 // packages/mesh-cli/src/utils/context.ts
@@ -1093,7 +1093,7 @@ function execTailscaleCmd(args) {
     }
     attempts.push({ binary, args });
   }
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve10, reject) => {
     let index = 0;
     function tryNext() {
       if (index >= attempts.length) {
@@ -1105,7 +1105,7 @@ function execTailscaleCmd(args) {
         if (error) {
           tryNext();
         } else {
-          resolve9(stdout);
+          resolve10(stdout);
         }
       });
     }
@@ -1198,11 +1198,11 @@ function unregisterDnsRecords(cfg, suffix) {
 import * as net7 from "node:net";
 
 // packages/mesh-cli/src/utils/tailscale.ts
-import * as fs20 from "node:fs";
+import * as fs22 from "node:fs";
 import * as net6 from "node:net";
-import * as os3 from "node:os";
-import * as path21 from "node:path";
-import { spawn as spawn2, execFileSync as execFileSync14 } from "node:child_process";
+import * as os5 from "node:os";
+import * as path23 from "node:path";
+import { spawn as spawn2, execFileSync as execFileSync15 } from "node:child_process";
 
 // packages/mesh-cli/src/utils/pid.ts
 var MIN_SIGNALABLE_PID = 2;
@@ -1240,16 +1240,16 @@ function assertSignalablePid(pid, source) {
 }
 
 // packages/mesh-cli/src/utils/tailscale-targets.ts
-import { execFileSync as execFileSync12 } from "node:child_process";
-import * as fs18 from "node:fs";
-import * as path19 from "node:path";
+import { execFileSync as execFileSync13 } from "node:child_process";
+import * as fs20 from "node:fs";
+import * as path21 from "node:path";
 
 // packages/mesh-cli/src/commands/dev.ts
-import { execFileSync as execFileSync11, spawn, spawnSync as spawnSync2 } from "child_process";
+import { execFileSync as execFileSync12, spawn, spawnSync as spawnSync2 } from "child_process";
 import { createHash as createHash5 } from "crypto";
-import * as fs17 from "fs";
+import * as fs19 from "fs";
 import * as net3 from "net";
-import * as path18 from "path";
+import * as path20 from "path";
 import { Option } from "commander";
 import { SecretsManagerClient as SecretsManagerClient2, GetSecretValueCommand as GetSecretValueCommand2 } from "@aws-sdk/client-secrets-manager";
 
@@ -1615,14 +1615,14 @@ async function acquireTemporalBearer(vars = {}) {
 // packages/mesh-cli/src/utils/reachability.ts
 import { createConnection } from "node:net";
 function probeTcpReachable(host, port, timeoutMs = 1500) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     let settled = false;
     const socket = createConnection({ host, port });
     const finish = (ok) => {
       if (settled) return;
       settled = true;
       socket.destroy();
-      resolve9(ok);
+      resolve10(ok);
     };
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => finish(true));
@@ -1631,7 +1631,7 @@ function probeTcpReachable(host, port, timeoutMs = 1500) {
   });
 }
 function probeConnectionHolds(host, port, timeoutMs = 800, holdMs = 25) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     let settled = false;
     let holdTimer;
     const socket = createConnection({ host, port });
@@ -1640,7 +1640,7 @@ function probeConnectionHolds(host, port, timeoutMs = 800, holdMs = 25) {
       settled = true;
       if (holdTimer) clearTimeout(holdTimer);
       socket.destroy();
-      resolve9(ok);
+      resolve10(ok);
     };
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
@@ -1915,16 +1915,16 @@ async function waitForPort(host, port, timeoutMs, intervalMs = 500) {
     const attemptTimeout = Math.max(250, Math.min(1e3, remaining));
     if (await tryConnect(host, port, attemptTimeout)) return true;
     if (Date.now() + intervalMs >= deadline) return false;
-    await new Promise((resolve9) => setTimeout(resolve9, intervalMs));
+    await new Promise((resolve10) => setTimeout(resolve10, intervalMs));
   }
 }
 function tryConnect(host, port, timeoutMs) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     const socket = net.connect({ host, port });
     const done = (ok) => {
       socket.removeAllListeners();
       socket.destroy();
-      resolve9(ok);
+      resolve10(ok);
     };
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => done(true));
@@ -3146,7 +3146,7 @@ async function fetchMockSamlMetadata() {
       if (cause instanceof MeshCliError) throw cause;
       lastError = String(cause);
     }
-    await new Promise((resolve9) => setTimeout(resolve9, 2e3));
+    await new Promise((resolve10) => setTimeout(resolve10, 2e3));
   }
   throw new MeshCliError(`Could not read mock SAML metadata from ${url} (${lastError}).`, {
     remediation: { command: "mesh status   # is mock-saml running?" }
@@ -3834,7 +3834,7 @@ function readLocalAuthzConfig(appRoot) {
     return null;
   }
 }
-var slug = (name, sep3) => name.toLowerCase().replace(/[^a-z0-9]+/g, sep3).replace(new RegExp(`^\\${sep3}+|\\${sep3}+$`, "g"), "");
+var slug = (name, sep4) => name.toLowerCase().replace(/[^a-z0-9]+/g, sep4).replace(new RegExp(`^\\${sep4}+|\\${sep4}+$`, "g"), "");
 function appSpiceDBSlot(app) {
   return createHash2("sha256").update(app).digest().readUInt32BE(0) % PORT_SLOTS;
 }
@@ -4288,14 +4288,14 @@ function zedOf(value) {
   if (typeof zed !== "string" || !zed.trim()) throw new Error("the spicedbSchema export returned no zed schema");
   return zed;
 }
-async function spicedbHttp(path23, body) {
-  const res = await fetch(`${HOST_HTTP}${path23}`, {
+async function spicedbHttp(path25, body) {
+  const res = await fetch(`${HOST_HTTP}${path25}`, {
     method: "POST",
     headers: { Authorization: `Bearer ${LOCAL_SPICEDB_KEY}`, "Content-Type": "application/json" },
     body: JSON.stringify(body)
   });
   const parsed = await res.json().catch(() => ({}));
-  if (!res.ok) throw Object.assign(new Error(`SpiceDB ${path23}: ${res.status} ${parsed.message ?? ""}`.trim()), { status: res.status });
+  if (!res.ok) throw Object.assign(new Error(`SpiceDB ${path25}: ${res.status} ${parsed.message ?? ""}`.trim()), { status: res.status });
   return parsed;
 }
 async function readLocalSpicedbSchema() {
@@ -5622,14 +5622,14 @@ var worktreeCheck = {
   }
 };
 function canConnect(host, port, timeoutMs = 800) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     const socket = new net2.Socket();
     let settled = false;
     const done = (ok) => {
       if (settled) return;
       settled = true;
       socket.destroy();
-      resolve9(ok);
+      resolve10(ok);
     };
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => done(true));
@@ -5896,6 +5896,438 @@ function resolveWorktreeIdentity(cwd = process.cwd(), gitRunner = defaultGitRunn
   };
 }
 
+// packages/mesh-cli/src/utils/workstation-machine.ts
+import { execFileSync as execFileSync11 } from "node:child_process";
+import { X509Certificate } from "node:crypto";
+import * as fs18 from "node:fs";
+import * as os4 from "node:os";
+import * as path19 from "node:path";
+
+// packages/mesh-cli/src/utils/workstation-routes.ts
+import * as fs17 from "node:fs";
+import * as os3 from "node:os";
+import * as path18 from "node:path";
+var LABEL_MAX = 63;
+var SESSION_MARKER = "# mesh dev session: ";
+function workstationDir() {
+  return process.env.MESH_WORKSTATION_DIR || path18.join(os3.homedir(), ".config", "mesh", "workstation");
+}
+function readWorkstationIdentity(dir = workstationDir()) {
+  const file = path18.join(dir, "workstation.json");
+  let raw;
+  try {
+    raw = fs17.readFileSync(file, "utf8");
+  } catch {
+    return void 0;
+  }
+  const identity = JSON.parse(raw);
+  if (typeof identity.name !== "string" || typeof identity.domain !== "string" || !identity.domain.startsWith(`${identity.name}.`)) {
+    throw new Error(`${file}: needs a name and a domain under it, e.g. {"name":"mbp","domain":"mbp.example.com"}`);
+  }
+  return identity;
+}
+function toLabel(raw) {
+  return raw.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
+}
+function serviceRouteLabel(args) {
+  if (args.route === false) return void 0;
+  const named = args.service === args.app || args.service.startsWith(`${args.app}-`);
+  return toLabel(args.route ?? (named ? args.service : `${args.app}-${args.service}`)) || void 0;
+}
+function worktreeRouteSuffix(wt, explicit) {
+  if (explicit !== void 0) return toLabel(explicit);
+  if (wt.isPrimary) return "";
+  const short = wt.slug.replace(/^(feature|feat|fix|chore|bugfix|hotfix|refactor|lab|spike)-/, "").replace(/(-[0-9a-f]{8,})+$/, "");
+  return toLabel(short) || toLabel(wt.slug);
+}
+function sessionRouteLabel(label, suffix) {
+  if (!suffix) return label.slice(0, LABEL_MAX).replace(/-+$/, "");
+  const room = LABEL_MAX - label.length - 1;
+  if (room < 1) return label.slice(0, LABEL_MAX).replace(/-+$/, "");
+  return `${label}-${suffix.slice(0, room).replace(/-+$/, "")}`;
+}
+function planSessionRoutes(args) {
+  const routes = [];
+  for (const [service, s] of Object.entries(args.services)) {
+    if (!s.port || !s.command?.length) continue;
+    const label = serviceRouteLabel({ app: args.app, service, route: s.route });
+    if (!label) continue;
+    routes.push({ service, hostname: `${sessionRouteLabel(label, args.suffix)}.${args.identity.domain}`, port: s.port });
+  }
+  return routes;
+}
+function renderRouteFile(route) {
+  const matcher = `route-${route.hostname.replaceAll(".", "_")}`;
+  return [
+    route.session ? `${SESSION_MARKER}${route.session}` : "# Written by WorkstationRoute (Pulumi). Removed on destroy; edits are overwritten on up.",
+    `@${matcher} host ${route.hostname}`,
+    `handle @${matcher} {`,
+    `	reverse_proxy 127.0.0.1:${route.port}`,
+    "}",
+    ""
+  ].join("\n");
+}
+function parseRouteFile(text) {
+  const hostname2 = /^@\S+ host (\S+)$/m.exec(text)?.[1];
+  const port = Number(/reverse_proxy 127\.0\.0\.1:(\d+)/.exec(text)?.[1]);
+  if (!hostname2 || !port) return void 0;
+  const session = text.split("\n").find((l) => l.startsWith(SESSION_MARKER))?.slice(SESSION_MARKER.length).trim();
+  return { hostname: hostname2, port, ...session ? { session } : {} };
+}
+function routesDir(dir) {
+  return path18.join(dir, "routes");
+}
+function listRoutes(dir = workstationDir()) {
+  let names;
+  try {
+    names = fs17.readdirSync(routesDir(dir)).filter((n) => n.endsWith(".caddy"));
+  } catch {
+    return [];
+  }
+  return names.flatMap((name) => {
+    const file = path18.join(routesDir(dir), name);
+    const route = parseRouteFile(fs17.readFileSync(file, "utf8"));
+    return route ? [{ ...route, file }] : [];
+  });
+}
+function removeSessionRoutes(session, dir = workstationDir()) {
+  const removed = [];
+  for (const route of listRoutes(dir)) {
+    if (route.session !== session) continue;
+    fs17.rmSync(route.file, { force: true });
+    removed.push(route.hostname);
+  }
+  return removed;
+}
+function writeSessionRoutes(session, planned, dir = workstationDir()) {
+  removeSessionRoutes(session, dir);
+  const held = new Map(listRoutes(dir).map((r) => [r.hostname, r]));
+  const result = { urls: {}, written: [], conflicts: [] };
+  fs17.mkdirSync(routesDir(dir), { recursive: true });
+  for (const route of planned) {
+    const other = held.get(route.hostname);
+    if (other) {
+      if (other.port === route.port) result.urls[route.service] = `https://${route.hostname}`;
+      else
+        result.conflicts.push({
+          ...route,
+          heldBy: other.session ? `session ${other.session}` : "the stack",
+          heldPort: other.port
+        });
+      continue;
+    }
+    const file = path18.join(routesDir(dir), `${route.hostname}.caddy`);
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs17.writeFileSync(tmp, renderRouteFile({ hostname: route.hostname, port: route.port, session }));
+    fs17.renameSync(tmp, file);
+    result.written.push(route);
+    result.urls[route.service] = `https://${route.hostname}`;
+  }
+  return result;
+}
+function renderWorkstationCaddyfile(identity, dir) {
+  return [
+    "# Written by `mesh workstation init`. Routes live in routes/; this file rarely changes.",
+    "{",
+    "	admin 127.0.0.1:2119",
+    `	storage file_system ${path18.join(dir, "caddy")}`,
+    "	skip_install_trust",
+    "	auto_https disable_redirects",
+    "	servers {",
+    "		protocols h1 h2",
+    "	}",
+    "}",
+    "",
+    // macOS lets a user bind 443 only on the wildcard address, and SNI and Host are the
+    // client's choice, so the site refuses any client outside the tailnet (100.64.0.0/10,
+    // fd7a:115c:a1e0::/48) and loopback before any route.
+    `*.${identity.domain}:443 {`,
+    "	tls {",
+    "		dns route53 {",
+    `			hosted_zone_id ${identity.proxy.zoneId}`,
+    `			region ${identity.proxy.region}`,
+    "			wait_for_route53_sync true",
+    "		}",
+    // Route 53 takes up to a minute to reach all its name servers; ACME checks from several places.
+    "		propagation_delay 60s",
+    "		propagation_timeout 5m",
+    "	}",
+    "	@offnet not remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48 127.0.0.0/8 ::1",
+    "	handle @offnet {",
+    "		abort",
+    "	}",
+    `	import ${path18.join(routesDir(dir), "*.caddy")}`,
+    "	handle {",
+    '		respond "No service is routed at {host}" 404',
+    "	}",
+    "}",
+    ""
+  ].join("\n");
+}
+function usableRouteUrls(planned, dir = workstationDir()) {
+  const byHost = new Map(listRoutes(dir).map((r) => [r.hostname, r]));
+  return Object.fromEntries(
+    planned.filter((p) => byHost.get(p.hostname)?.port === p.port).map((p) => [p.service, `https://${p.hostname}`])
+  );
+}
+
+// packages/mesh-cli/src/utils/workstation-machine.ts
+function readCredentialProcess(configText, profile) {
+  let inSection = false;
+  for (const line of configText.split("\n")) {
+    const header = /^\s*\[(.+)\]\s*$/.exec(line);
+    if (header) {
+      inSection = header[1].trim() === `profile ${profile}` || header[1].trim() === profile;
+      continue;
+    }
+    const kv = /^\s*credential_process\s*=\s*(.+?)\s*$/.exec(line);
+    if (inSection && kv) return kv[1];
+  }
+  return void 0;
+}
+function credentialProgram(command) {
+  return command.split(/\s+/)[0];
+}
+function credentialProcessProblem(command, deps) {
+  if (!command) return "the profile has no credential_process (run mesh login <platform> --export --role <roleArn>)";
+  const program = credentialProgram(command);
+  if (!path19.isAbsolute(program)) return `its program "${program}" is not an absolute path`;
+  if (!deps.exists(program)) return `its program ${program} does not exist`;
+  if (deps.isInsideGitTree(program)) {
+    return `its program ${program} is inside a git checkout, and stops working when that checkout is removed`;
+  }
+  return void 0;
+}
+function isInsideGitTree(p) {
+  let dir = path19.dirname(path19.resolve(p));
+  for (; ; ) {
+    if (fs18.existsSync(path19.join(dir, ".git"))) return true;
+    const parent = path19.dirname(dir);
+    if (parent === dir) return false;
+    dir = parent;
+  }
+}
+function rewriteCredentialProgram(configText, profile, cli) {
+  let inSection = false;
+  let rewritten = false;
+  const lines = configText.split("\n").map((line) => {
+    const header = /^\s*\[(.+)\]\s*$/.exec(line);
+    if (header) {
+      inSection = header[1].trim() === `profile ${profile}` || header[1].trim() === profile;
+      return line;
+    }
+    const kv = /^(\s*credential_process\s*=\s*)(\S+)(.*)$/.exec(line);
+    if (inSection && kv) {
+      rewritten = true;
+      return `${kv[1]}${cli}${kv[3]}`;
+    }
+    return line;
+  });
+  if (!rewritten) throw new Error(`no credential_process in [profile ${profile}]`);
+  return lines.join("\n");
+}
+var LAUNCH_AGENT_LABEL = "tech.mesh.workstation-proxy";
+var LAUNCH_AGENTS_MACOS_ONLY = "LaunchAgents are macOS-only; run mesh workstation proxy in the foreground (or under your own service manager)";
+function launchAgentsSupported(platform = process.platform) {
+  return platform === "darwin";
+}
+function launchAgentSearchPath(installerPath, execPath) {
+  const entries = [
+    ...(installerPath ?? "").split(":"),
+    path19.dirname(execPath),
+    "/usr/local/bin",
+    "/usr/bin",
+    "/bin",
+    "/usr/sbin",
+    "/sbin"
+  ].filter((p) => path19.isAbsolute(p) && !p.split(path19.sep).includes("node_modules"));
+  return [...new Set(entries)].join(":");
+}
+function xml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function renderLaunchAgent(args) {
+  const program = [args.caddy, "run", "--watch", "--config", args.caddyfile, "--adapter", "caddyfile"];
+  const env = Object.entries(args.env).map(([k, v]) => `		<key>${xml(k)}</key>
+		<string>${xml(v)}</string>`).join("\n");
+  return [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+    '<plist version="1.0">',
+    "<dict>",
+    `	<key>Label</key>
+	<string>${LAUNCH_AGENT_LABEL}</string>`,
+    `	<key>ProgramArguments</key>
+	<array>
+${program.map((a) => `		<string>${xml(a)}</string>`).join("\n")}
+	</array>`,
+    `	<key>WorkingDirectory</key>
+	<string>${xml(args.dir)}</string>`,
+    `	<key>EnvironmentVariables</key>
+	<dict>
+${env}
+	</dict>`,
+    "	<key>RunAtLoad</key>\n	<true/>",
+    "	<key>KeepAlive</key>\n	<true/>",
+    `	<key>StandardOutPath</key>
+	<string>${xml(path19.join(args.dir, "proxy.log"))}</string>`,
+    `	<key>StandardErrorPath</key>
+	<string>${xml(path19.join(args.dir, "proxy.log"))}</string>`,
+    "</dict>",
+    "</plist>",
+    ""
+  ].join("\n");
+}
+function certificateExpiry(dir, domain) {
+  const certs = path19.join(dir, "caddy", "certificates");
+  let best;
+  const walk = (d) => {
+    let entries;
+    try {
+      entries = fs18.readdirSync(d, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      const p = path19.join(d, e.name);
+      if (e.isDirectory()) walk(p);
+      else if (e.name === `wildcard_.${domain}.crt`) {
+        const expiry = new Date(new X509Certificate(fs18.readFileSync(p)).validTo);
+        if (!best || expiry > best) best = expiry;
+      }
+    }
+  };
+  walk(certs);
+  return best;
+}
+function workstationWarnings(args) {
+  const warnings = [];
+  if (args.certExpiry) {
+    const days = Math.floor((args.certExpiry.getTime() - args.now.getTime()) / 864e5);
+    if (days < 14) warnings.push(`The certificate expires in ${days} day(s) and has not renewed: check proxy.log.`);
+  }
+  if (args.credentialProblem) warnings.push(`The proxy's AWS profile will not renew the certificate: ${args.credentialProblem}.`);
+  else if (!args.credentialOk) {
+    warnings.push("The proxy's AWS profile yields no credentials (mesh login expired?): renewals fail until you log in again.");
+  }
+  return warnings;
+}
+function discoveryRecordName(name, platform) {
+  return `_mesh-workstation.${name}.${platform.replace(/\.$/, "")}`.toLowerCase();
+}
+function parseDiscoveryRecord(text) {
+  const fields = /* @__PURE__ */ new Map();
+  for (const part of text.trim().split(/\s+/)) {
+    const eq = part.indexOf("=");
+    if (eq > 0) fields.set(part.slice(0, eq), part.slice(eq + 1));
+  }
+  if (fields.get("v") !== "1") return `unknown discovery record version (${fields.get("v") ?? "none"})`;
+  const roleArn = fields.get("role") ?? "";
+  const zoneId = fields.get("zone") ?? "";
+  const region = fields.get("region") ?? "";
+  if (!/^arn:aws:iam::\d{12}:role\/[\w+=,.@/-]+$/.test(roleArn)) return `"${roleArn}" is not an IAM role ARN`;
+  if (!/^Z[A-Z0-9]{1,32}$/.test(zoneId)) return `"${zoneId}" is not a Route 53 zone id`;
+  if (!/^[a-z]{2}(-[a-z]+)+-\d$/.test(region)) return `"${region}" is not an AWS region`;
+  return { roleArn, zoneId, region };
+}
+function caddyDownloadUrl(platform, arch) {
+  const goArch = arch === "x64" ? "amd64" : arch;
+  return `https://caddyserver.com/api/download?os=${platform}&arch=${goArch}&p=${encodeURIComponent("github.com/caddy-dns/route53")}`;
+}
+function caddyHasRoute53(listModulesOutput) {
+  return listModulesOutput.split("\n").some((l) => l.trim() === "dns.providers.route53");
+}
+function shimFallsBackToGlobal(shimText) {
+  return shimText.includes("canonical launcher shim") && shimText.includes("Not in a workspace: exec the next");
+}
+function zoneCandidates(platform) {
+  const labels = platform.replace(/\.$/, "").toLowerCase().split(".");
+  return labels.slice(0, -1).map((_, i) => labels.slice(i).join("."));
+}
+var RENEWAL_OVERDUE_DAYS = 28;
+function healthCheckDue(stamp, now) {
+  if (!stamp) return true;
+  const at = Date.parse(stamp.checkedAt);
+  return !Number.isFinite(at) || now.getTime() - at >= 864e5;
+}
+function loginContextOf(command) {
+  return command ? /\slogin\s+("?)([^\s"]+)\1/.exec(command)?.[2] : void 0;
+}
+function renewalWarnings(args) {
+  const days = args.certExpiry ? Math.floor((args.certExpiry.getTime() - args.now.getTime()) / 864e5) : void 0;
+  const expires = days === void 0 ? "" : ` (certificate expires in ${days} day${days === 1 ? "" : "s"})`;
+  const login2 = args.loginContext ? `mesh login ${args.loginContext}` : "the profile's mesh login";
+  if (!args.credentialOk) return [`Workstation certificate renewal is failing: run ${login2}${expires}`];
+  if (days !== void 0 && days < RENEWAL_OVERDUE_DAYS) {
+    return [`Workstation certificate has not renewed${expires}: check ~/.config/mesh/workstation/proxy.log`];
+  }
+  return [];
+}
+var STATIC_AWS_VARS = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN"];
+function proxyEnv(base, proxy) {
+  const env = { ...base };
+  for (const key of STATIC_AWS_VARS) delete env[key];
+  env.AWS_REGION = proxy.region;
+  if (proxy.awsProfile) env.AWS_PROFILE = proxy.awsProfile;
+  if (proxy.awsConfigFile) env.AWS_CONFIG_FILE = proxy.awsConfigFile;
+  return env;
+}
+function awsConfigFileOf(proxy) {
+  return proxy.awsConfigFile ?? path19.join(os4.homedir(), ".aws", "config");
+}
+function profileYieldsCredentials(proxy, timeoutMs = 6e4) {
+  if (!proxy.awsProfile) return true;
+  const command = readCredentialProcess(fs18.readFileSync(awsConfigFileOf(proxy), "utf8"), proxy.awsProfile);
+  if (!command) return false;
+  try {
+    const out = execFileSync11("/bin/sh", ["-c", command], {
+      env: proxyEnv(process.env, proxy),
+      cwd: os4.homedir(),
+      timeout: timeoutMs,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    return typeof JSON.parse(out.toString()).AccessKeyId === "string";
+  } catch {
+    return false;
+  }
+}
+function workstationRenewalWarnings(now = /* @__PURE__ */ new Date()) {
+  try {
+    const dir = workstationDir();
+    const identity = readWorkstationIdentity(dir);
+    if (!identity?.proxy) return [];
+    const proxy = identity.proxy;
+    const stampFile = path19.join(dir, "health.json");
+    let stamp;
+    try {
+      stamp = JSON.parse(fs18.readFileSync(stampFile, "utf8"));
+    } catch {
+      stamp = void 0;
+    }
+    if (healthCheckDue(stamp, now)) {
+      logInfo("Checking the workstation's certificate credentials\u2026");
+      stamp = { checkedAt: now.toISOString(), credentialOk: profileYieldsCredentials(proxy, 2e4) };
+      fs18.writeFileSync(stampFile, JSON.stringify(stamp) + "\n");
+    }
+    let command;
+    if (proxy.awsProfile) {
+      try {
+        command = readCredentialProcess(fs18.readFileSync(awsConfigFileOf(proxy), "utf8"), proxy.awsProfile);
+      } catch {
+        command = void 0;
+      }
+    }
+    return renewalWarnings({
+      now,
+      certExpiry: certificateExpiry(dir, identity.domain),
+      credentialOk: stamp.credentialOk,
+      loginContext: loginContextOf(command)
+    });
+  } catch {
+    return [];
+  }
+}
+
 // packages/mesh-cli/src/commands/dev.ts
 function registerServiceProbes(devOutput, tenant, probeFiles) {
   const services = {};
@@ -5945,9 +6377,9 @@ mesh dev plan \u2014 ${kind}
     console.log(`    (none \u2014 all services are deployed/K8s)`);
   } else {
     const monorepoRoot = findMonorepoRoot();
-    const wtWithSep = wt.worktreeRoot.endsWith(path18.sep) ? wt.worktreeRoot : wt.worktreeRoot + path18.sep;
+    const wtWithSep = wt.worktreeRoot.endsWith(path20.sep) ? wt.worktreeRoot : wt.worktreeRoot + path20.sep;
     for (const [name, s] of locals) {
-      const dir = path18.resolve(appRoot, rebaseServiceSrc(s.src, monorepoRoot));
+      const dir = path20.resolve(appRoot, rebaseServiceSrc(s.src, monorepoRoot));
       const outside = dir !== wt.worktreeRoot && !dir.startsWith(wtWithSep);
       const port = s.port > 0 ? `:${s.port}` : "(no port)";
       console.log(`    ${name.padEnd(18)} ${port.padEnd(7)} ${dir}${outside ? "  \u26A0 OUTSIDE worktree" : ""}`);
@@ -5957,16 +6389,16 @@ mesh dev plan \u2014 ${kind}
 }
 function getSessionStatePath(sessionName) {
   const dir = devSessionsRoot();
-  return path18.join(dir, `${sessionName}.json`);
+  return path20.join(dir, `${sessionName}.json`);
 }
 function saveSessionState(sessionName, state) {
-  fs17.writeFileSync(getSessionStatePath(sessionName), JSON.stringify(state, null, 2));
+  fs19.writeFileSync(getSessionStatePath(sessionName), JSON.stringify(state, null, 2));
 }
 function loadSessionState(sessionName) {
   const filePath = getSessionStatePath(sessionName);
-  if (!fs17.existsSync(filePath)) return null;
+  if (!fs19.existsSync(filePath)) return null;
   try {
-    return JSON.parse(fs17.readFileSync(filePath, "utf-8"));
+    return JSON.parse(fs19.readFileSync(filePath, "utf-8"));
   } catch {
     return null;
   }
@@ -5990,24 +6422,29 @@ function workflowChangeWouldStrand(priorState, appRoot, force) {
   return true;
 }
 function getServiceEnvFilePath(sessionName, serviceName) {
-  return path18.join(getSessionEnvDir(sessionName), envFileName(serviceName));
+  return path20.join(getSessionEnvDir(sessionName), envFileName(serviceName));
 }
 function removeSessionState(sessionName) {
   try {
-    fs17.unlinkSync(getSessionStatePath(sessionName));
+    fs19.unlinkSync(getSessionStatePath(sessionName));
+  } catch {
+  }
+  try {
+    const removed = removeSessionRoutes(sessionName);
+    if (removed.length > 0) logInfo(`Removed workstation routes: ${removed.join(", ")}`);
   } catch {
   }
   try {
-    fs17.rmSync(getSessionEnvDir(sessionName), { recursive: true, force: true });
+    fs19.rmSync(getSessionEnvDir(sessionName), { recursive: true, force: true });
   } catch {
   }
 }
 function getSessionPortMemoryPath(sessionName) {
-  return path18.join(path18.dirname(getSessionStatePath(sessionName)), `${sessionName}.ports.json`);
+  return path20.join(path20.dirname(getSessionStatePath(sessionName)), `${sessionName}.ports.json`);
 }
 function loadSessionPortMemory(sessionName) {
   try {
-    const raw = JSON.parse(fs17.readFileSync(getSessionPortMemoryPath(sessionName), "utf-8"));
+    const raw = JSON.parse(fs19.readFileSync(getSessionPortMemoryPath(sessionName), "utf-8"));
     return rememberedPortsOf(raw);
   } catch {
     return {};
@@ -6038,15 +6475,15 @@ function saveSessionPortMemory(sessionName, devOutput) {
   }
   const memory = { services, savedAt: (/* @__PURE__ */ new Date()).toISOString() };
   try {
-    fs17.writeFileSync(getSessionPortMemoryPath(sessionName), JSON.stringify(memory, null, 2));
+    fs19.writeFileSync(getSessionPortMemoryPath(sessionName), JSON.stringify(memory, null, 2));
   } catch {
   }
 }
 async function isPortFree(port) {
-  const bindSucceeds = (host) => new Promise((resolve9) => {
+  const bindSucceeds = (host) => new Promise((resolve10) => {
     const server = net3.createServer();
-    server.once("error", () => resolve9(false));
-    const onListening = () => server.close(() => resolve9(true));
+    server.once("error", () => resolve10(false));
+    const onListening = () => server.close(() => resolve10(true));
     if (host === void 0) server.listen(port, onListening);
     else server.listen(port, host, onListening);
   });
@@ -6054,24 +6491,24 @@ async function isPortFree(port) {
   return bindSucceeds("127.0.0.1");
 }
 async function findFreePort() {
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve10, reject) => {
     const server = net3.createServer();
     server.once("error", reject);
     server.listen(0, "127.0.0.1", () => {
       const { port } = server.address();
-      server.close(() => resolve9(port));
+      server.close(() => resolve10(port));
     });
   });
 }
 function isPortListening(port) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     const s = new net3.Socket();
     let done = false;
     const fin = (ok) => {
       if (done) return;
       done = true;
       s.destroy();
-      resolve9(ok);
+      resolve10(ok);
     };
     s.setTimeout(300);
     s.once("connect", () => fin(true));
@@ -6179,16 +6616,16 @@ function mergePinnedPorts(fresh, pinned) {
 }
 function findMonorepoRoot() {
   let dir = process.cwd();
-  const root = path18.parse(dir).root;
+  const root = path20.parse(dir).root;
   while (dir !== root) {
-    if (fs17.existsSync(path18.join(dir, "pnpm-workspace.yaml")) || fs17.existsSync(path18.join(dir, "turbo.json"))) {
+    if (fs19.existsSync(path20.join(dir, "pnpm-workspace.yaml")) || fs19.existsSync(path20.join(dir, "turbo.json"))) {
       return dir;
     }
-    const gitPath = path18.join(dir, ".git");
-    if (fs17.existsSync(gitPath)) {
+    const gitPath = path20.join(dir, ".git");
+    if (fs19.existsSync(gitPath)) {
       return dir;
     }
-    dir = path18.dirname(dir);
+    dir = path20.dirname(dir);
   }
   return null;
 }
@@ -6196,40 +6633,40 @@ function discoverApps(monorepoRoot) {
   const apps = [];
   function addApp(appDir, tenant) {
     const projectName = getProjectName(appDir);
-    const stacks = fs17.readdirSync(appDir).filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml").map((f) => f.replace(/^Pulumi\./, "").replace(/\.yaml$/, ""));
+    const stacks = fs19.readdirSync(appDir).filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml").map((f) => f.replace(/^Pulumi\./, "").replace(/\.yaml$/, ""));
     apps.push({
       name: projectName,
       tenant,
       appPath: appDir,
-      relativePath: path18.relative(monorepoRoot, appDir),
+      relativePath: path20.relative(monorepoRoot, appDir),
       stacks
     });
   }
   const searchDirs = ["tenants", "tests/tenants"];
   for (const searchDir of searchDirs) {
-    const base = path18.join(monorepoRoot, searchDir);
-    if (!fs17.existsSync(base)) continue;
-    for (const tenant of fs17.readdirSync(base)) {
-      const appsDir = path18.join(base, tenant, "apps");
-      if (!fs17.existsSync(appsDir) || !fs17.statSync(appsDir).isDirectory()) continue;
-      for (const app of fs17.readdirSync(appsDir)) {
-        const appDir = path18.join(appsDir, app);
-        if (!fs17.existsSync(path18.join(appDir, "Pulumi.yaml"))) continue;
+    const base = path20.join(monorepoRoot, searchDir);
+    if (!fs19.existsSync(base)) continue;
+    for (const tenant of fs19.readdirSync(base)) {
+      const appsDir = path20.join(base, tenant, "apps");
+      if (!fs19.existsSync(appsDir) || !fs19.statSync(appsDir).isDirectory()) continue;
+      for (const app of fs19.readdirSync(appsDir)) {
+        const appDir = path20.join(appsDir, app);
+        if (!fs19.existsSync(path20.join(appDir, "Pulumi.yaml"))) continue;
         addApp(appDir, tenant);
       }
     }
   }
-  const flatAppsDir = path18.join(monorepoRoot, "apps");
-  if (fs17.existsSync(flatAppsDir) && fs17.statSync(flatAppsDir).isDirectory()) {
-    for (const app of fs17.readdirSync(flatAppsDir)) {
-      const appDir = path18.join(flatAppsDir, app);
-      if (!fs17.statSync(appDir).isDirectory()) continue;
-      if (!fs17.existsSync(path18.join(appDir, "Pulumi.yaml"))) continue;
+  const flatAppsDir = path20.join(monorepoRoot, "apps");
+  if (fs19.existsSync(flatAppsDir) && fs19.statSync(flatAppsDir).isDirectory()) {
+    for (const app of fs19.readdirSync(flatAppsDir)) {
+      const appDir = path20.join(flatAppsDir, app);
+      if (!fs19.statSync(appDir).isDirectory()) continue;
+      if (!fs19.existsSync(path20.join(appDir, "Pulumi.yaml"))) continue;
       let tenant = "unknown";
-      const stackConfigs = fs17.readdirSync(appDir).filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml");
+      const stackConfigs = fs19.readdirSync(appDir).filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml");
       if (stackConfigs.length > 0) {
         try {
-          const content = fs17.readFileSync(path18.join(appDir, stackConfigs[0]), "utf-8");
+          const content = fs19.readFileSync(path20.join(appDir, stackConfigs[0]), "utf-8");
           const tenantMatch = content.match(/mesh:tenant:\s*(\S+)/);
           if (tenantMatch) tenant = tenantMatch[1];
         } catch {
@@ -6242,38 +6679,38 @@ function discoverApps(monorepoRoot) {
 }
 function findAppRoot2(appPath) {
   if (appPath) {
-    const resolved = path18.resolve(appPath);
-    if (fs17.existsSync(path18.join(resolved, "Pulumi.yaml"))) return resolved;
+    const resolved = path20.resolve(appPath);
+    if (fs19.existsSync(path20.join(resolved, "Pulumi.yaml"))) return resolved;
     const mono = findMonorepoRoot();
     if (mono) {
-      const fromMono = path18.resolve(mono, appPath);
-      if (fs17.existsSync(path18.join(fromMono, "Pulumi.yaml"))) return fromMono;
+      const fromMono = path20.resolve(mono, appPath);
+      if (fs19.existsSync(path20.join(fromMono, "Pulumi.yaml"))) return fromMono;
     }
     logError(`No Pulumi.yaml found at: ${appPath}`);
     process.exit(1);
   }
   let dir = process.cwd();
-  const root = path18.parse(dir).root;
+  const root = path20.parse(dir).root;
   while (dir !== root) {
-    if (fs17.existsSync(path18.join(dir, "Pulumi.yaml"))) {
+    if (fs19.existsSync(path20.join(dir, "Pulumi.yaml"))) {
       return dir;
     }
-    dir = path18.dirname(dir);
+    dir = path20.dirname(dir);
   }
   return process.cwd();
 }
 function getProjectName(appRoot) {
-  const yamlPath = path18.join(appRoot, "Pulumi.yaml");
-  if (!fs17.existsSync(yamlPath)) return path18.basename(appRoot);
-  const content = fs17.readFileSync(yamlPath, "utf-8");
+  const yamlPath = path20.join(appRoot, "Pulumi.yaml");
+  if (!fs19.existsSync(yamlPath)) return path20.basename(appRoot);
+  const content = fs19.readFileSync(yamlPath, "utf-8");
   const match = content.match(/^name:\s*(.+)$/m);
-  return match?.[1]?.trim() ?? path18.basename(appRoot);
+  return match?.[1]?.trim() ?? path20.basename(appRoot);
 }
 function detectStack(appRoot, stageArg) {
   if (stageArg) return stageArg;
   if (process.env.MESH_STAGE) return process.env.MESH_STAGE;
   try {
-    const result = execFileSync11("pulumi", ["stack", "--show-name"], {
+    const result = execFileSync12("pulumi", ["stack", "--show-name"], {
       cwd: appRoot,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
@@ -6282,7 +6719,7 @@ function detectStack(appRoot, stageArg) {
   } catch {
   }
   try {
-    const files = fs17.readdirSync(appRoot).filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml");
+    const files = fs19.readdirSync(appRoot).filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml");
     if (files.length === 1) {
       const match = files[0].match(/^Pulumi\.(.+)\.yaml$/);
       if (match?.[1]) {
@@ -6296,7 +6733,7 @@ function detectStack(appRoot, stageArg) {
 }
 function stackArgs(appRoot, stack) {
   try {
-    const selected = execFileSync11("pulumi", ["stack", "--show-name"], {
+    const selected = execFileSync12("pulumi", ["stack", "--show-name"], {
       cwd: appRoot,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
@@ -6305,7 +6742,7 @@ function stackArgs(appRoot, stack) {
   } catch {
   }
   try {
-    execFileSync11("pulumi", ["stack", "select", stack], {
+    execFileSync12("pulumi", ["stack", "select", stack], {
       cwd: appRoot,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
@@ -6340,7 +6777,7 @@ function getDevOutput(appRoot, stack, awsEnv) {
   }
 }
 function gitCommitOfDir(dir) {
-  const run = (...args) => execFileSync11("git", ["-C", dir, ...args], {
+  const run = (...args) => execFileSync12("git", ["-C", dir, ...args], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "ignore"],
     timeout: 2e3
@@ -6355,7 +6792,7 @@ function gitCommitOfDir(dir) {
   }
 }
 function worktreeDigestOfDir(dir) {
-  const run = (cwd, ...args) => execFileSync11("git", ["-C", cwd, ...args], {
+  const run = (cwd, ...args) => execFileSync12("git", ["-C", cwd, ...args], {
     stdio: ["ignore", "pipe", "ignore"],
     timeout: 1e4,
     maxBuffer: 256 * 1024 * 1024
@@ -6370,7 +6807,7 @@ function worktreeDigestOfDir(dir) {
     for (const file of untracked) {
       hash.update("\0").update(file).update("\0");
       try {
-        hash.update(fs17.readFileSync(path18.join(top, file)));
+        hash.update(fs19.readFileSync(path20.join(top, file)));
       } catch {
       }
     }
@@ -6382,7 +6819,7 @@ function worktreeDigestOfDir(dir) {
 function currentProgramProvenance(appRoot, stack) {
   let configSha256 = null;
   try {
-    configSha256 = createHash5("sha256").update(fs17.readFileSync(path18.join(appRoot, `Pulumi.${stack}.yaml`))).digest("hex");
+    configSha256 = createHash5("sha256").update(fs19.readFileSync(path20.join(appRoot, `Pulumi.${stack}.yaml`))).digest("hex");
   } catch {
   }
   const gitCommit = gitCommitOfDir(appRoot);
@@ -6417,7 +6854,7 @@ function warnIfDevOutputStale(devOutput, appRoot, stack) {
 }
 function hasTmux() {
   try {
-    execFileSync11("which", ["tmux"], { stdio: "ignore" });
+    execFileSync12("which", ["tmux"], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -6425,7 +6862,7 @@ function hasTmux() {
 }
 function sessionExists(name) {
   try {
-    execFileSync11("tmux", ["has-session", "-t", name], { stdio: "ignore" });
+    execFileSync12("tmux", ["has-session", "-t", name], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -6433,7 +6870,7 @@ function sessionExists(name) {
 }
 function killSession(name) {
   try {
-    execFileSync11("tmux", ["kill-session", "-t", name], { stdio: "ignore" });
+    execFileSync12("tmux", ["kill-session", "-t", name], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -6479,9 +6916,9 @@ function buildChildAwsEnv(awsEnv, method, profile, opts) {
   if (method === "zitadel" && opts) {
     const sanitizedContext = opts.context.replace(/[^A-Za-z0-9_-]/g, "-");
     const profileName = `mesh-dev-${sanitizedContext}`;
-    const configPath = path18.join(opts.sessionScratchDir, "aws-config");
+    const configPath = path20.join(opts.sessionScratchDir, "aws-config");
     const region = awsEnv.AWS_REGION ?? awsEnv.AWS_DEFAULT_REGION ?? "";
-    fs17.mkdirSync(opts.sessionScratchDir, { recursive: true });
+    fs19.mkdirSync(opts.sessionScratchDir, { recursive: true });
     const profileBlock = renderCredentialProcessProfile({
       profileName,
       context: opts.context,
@@ -6489,7 +6926,7 @@ function buildChildAwsEnv(awsEnv, method, profile, opts) {
       region,
       meshBin: opts.meshBin
     });
-    const existing = fs17.existsSync(configPath) ? fs17.readFileSync(configPath, "utf8") : "";
+    const existing = fs19.existsSync(configPath) ? fs19.readFileSync(configPath, "utf8") : "";
     const next = upsertManagedAwsConfigSection(
       stripBareProfile(existing, profileName),
       `${opts.context} (mesh dev)`,
@@ -6514,7 +6951,7 @@ function buildChildAwsEnv(awsEnv, method, profile, opts) {
 function readDotEnvFile(file) {
   let text;
   try {
-    text = fs17.readFileSync(file, "utf-8");
+    text = fs19.readFileSync(file, "utf-8");
   } catch {
     return {};
   }
@@ -6547,30 +6984,30 @@ function rebaseServiceSrc(src, monorepoRoot) {
   if (src === "." || src === "./") return src;
   const rel = monorepoRelativeSrc(src);
   if (rel === null) return src;
-  const rebased = path18.join(monorepoRoot, rel);
-  return fs17.existsSync(rebased) ? rebased : src;
+  const rebased = path20.join(monorepoRoot, rel);
+  return fs19.existsSync(rebased) ? rebased : src;
 }
 function isLinkedDependencyDir(serviceDir, appRoot) {
   const pkg = enclosingPackage(serviceDir);
   return Boolean(pkg && appResolvedPackageDir(pkg.name, appRoot) === pkg.root);
 }
 function enclosingPackage(dir) {
-  for (let at = dir; ; at = path18.dirname(at)) {
+  for (let at = dir; ; at = path20.dirname(at)) {
     try {
-      const manifest = JSON.parse(fs17.readFileSync(path18.join(at, "package.json"), "utf8"));
+      const manifest = JSON.parse(fs19.readFileSync(path20.join(at, "package.json"), "utf8"));
       if (typeof manifest?.name === "string" && manifest.name) return { root: at, name: manifest.name };
     } catch {
     }
-    if (path18.dirname(at) === at) return null;
+    if (path20.dirname(at) === at) return null;
   }
 }
 function appResolvedPackageDir(name, appRoot) {
-  for (let dir = appRoot; ; dir = path18.dirname(dir)) {
+  for (let dir = appRoot; ; dir = path20.dirname(dir)) {
     try {
-      return fs17.realpathSync(path18.join(dir, "node_modules", name));
+      return fs19.realpathSync(path20.join(dir, "node_modules", name));
     } catch {
     }
-    if (path18.dirname(dir) === dir) return null;
+    if (path20.dirname(dir) === dir) return null;
   }
 }
 function relinkedServiceDir(serviceDir, appRoot) {
@@ -6578,11 +7015,11 @@ function relinkedServiceDir(serviceDir, appRoot) {
   if (!pkg) return null;
   const own = appResolvedPackageDir(pkg.name, appRoot);
   if (!own || own === pkg.root) return null;
-  const candidate = path18.join(own, path18.relative(pkg.root, serviceDir));
-  return fs17.existsSync(candidate) ? candidate : null;
+  const candidate = path20.join(own, path20.relative(pkg.root, serviceDir));
+  return fs19.existsSync(candidate) ? candidate : null;
 }
 function monorepoRelativeSrc(src) {
-  if (!path18.isAbsolute(src)) return src.replace(/^\.\//, "") || ".";
+  if (!path20.isAbsolute(src)) return src.replace(/^\.\//, "") || ".";
   const m = src.match(/^.*\/mesh-platform(?:\/(.*))?$/);
   if (!m) return null;
   const rest = (m[1] ?? "").replace(/^\.worktrees\/[^/]+(?:\/|$)/, "");
@@ -6624,14 +7061,14 @@ function pointAtTunnel(key, value, tunnel) {
 }
 function setTmuxEnv(sessionName, vars) {
   for (const [key, value] of Object.entries(vars)) {
-    execFileSync11("tmux", ["set-environment", "-t", sessionName, key, value], { stdio: "ignore" });
+    execFileSync12("tmux", ["set-environment", "-t", sessionName, key, value], { stdio: "ignore" });
   }
 }
 function readTmuxSessionEnv(sessionName, keys) {
   const out = {};
   for (const key of keys) {
     try {
-      const line = execFileSync11("tmux", ["show-environment", "-t", sessionName, key], {
+      const line = execFileSync12("tmux", ["show-environment", "-t", sessionName, key], {
         encoding: "utf-8",
         stdio: ["ignore", "pipe", "ignore"]
       }).trim();
@@ -6710,7 +7147,7 @@ function stackNamespace(devOutput) {
 function resolveTemporalEncodingKey(namespace) {
   const secretName = `${namespace}-temporal-encoding-key`;
   try {
-    const b64 = execFileSync11(
+    const b64 = execFileSync12(
       "kubectl",
       [
         "get",
@@ -6746,7 +7183,7 @@ async function resolveTemporalAuthVars(sessionName, devOutput) {
     setTmuxEnv(sessionName, { KUBECONFIG: kubeconfigPath });
   } else if (!process.env.KUBECONFIG) {
     const existing = sessionKubeconfigPath(sessionName);
-    if (fs17.existsSync(existing)) {
+    if (fs19.existsSync(existing)) {
       process.env.KUBECONFIG = existing;
     }
   }
@@ -6919,7 +7356,7 @@ async function allocateSsmLocalPort(remotePort, reservedPorts) {
 }
 function hasSessionManagerPlugin() {
   try {
-    execFileSync11("which", ["session-manager-plugin"], { stdio: "ignore" });
+    execFileSync12("which", ["session-manager-plugin"], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -7029,15 +7466,15 @@ async function startSsmTunnels(sessionName, devOutput, appRoot, awsEnv) {
         localPortNumber: [String(localPort)]
       })}'`
     ].join(" ");
-    execFileSync11("tmux", ["new-window", "-t", sessionName, "-n", windowName]);
-    execFileSync11(
+    execFileSync12("tmux", ["new-window", "-t", sessionName, "-n", windowName]);
+    execFileSync12(
       "tmux",
       ["set-option", "-t", `${sessionName}:${windowName}`, "remain-on-exit", "on"],
       { stdio: "ignore" }
     );
     const envFilePath = getServiceEnvFilePath(sessionName, windowName);
     writeEnvFile(envFilePath, { ...hostEnv, ...awsEnv });
-    execFileSync11("tmux", [
+    execFileSync12("tmux", [
       "send-keys",
       "-t",
       `${sessionName}:${windowName}`,
@@ -7055,7 +7492,7 @@ async function startSsmTunnels(sessionName, devOutput, appRoot, awsEnv) {
   return rewritten;
 }
 async function updateDevboxProxy(devOutput, appRoot) {
-  const appName = devOutput.app ?? path18.basename(appRoot);
+  const appName = devOutput.app ?? path20.basename(appRoot);
   const tenant = devOutput.platform?.tenant ?? "mesh";
   const env = devOutput.platform?.env ?? "dev";
   const stack = devOutput.stack ?? "dev";
@@ -7087,7 +7524,7 @@ async function updateDevboxProxy(devOutput, appRoot) {
     lines.push("");
   }
   const caddyfile = lines.join("\n");
-  execFileSync11(
+  execFileSync12(
     "docker",
     [
       "run",
@@ -7103,7 +7540,7 @@ CADDYEOF`
     ],
     { stdio: "pipe" }
   );
-  execFileSync11(
+  execFileSync12(
     "docker",
     [
       "run",
@@ -7130,10 +7567,45 @@ CADDYEOF`
     logInfo(`  http://${hostname2} \u2192 localhost:${port}`);
   }
 }
+function planWorkstationRoutes(appRoot, devOutput) {
+  const identity = readWorkstationIdentity();
+  if (!identity) return [];
+  return planSessionRoutes({
+    identity,
+    app: devOutput.app ?? path20.basename(appRoot),
+    services: devOutput.services,
+    suffix: worktreeRouteSuffix(resolveWorktreeIdentity(appRoot), process.env.MESH_DEV_ROUTE_SUFFIX)
+  });
+}
+function workstationUrlVar(appRoot, devOutput, serviceName) {
+  try {
+    const url = usableRouteUrls(planWorkstationRoutes(appRoot, devOutput))[serviceName];
+    return url ? { MESH_DEV_PUBLIC_URL: url } : {};
+  } catch {
+    return {};
+  }
+}
+function applyWorkstationRoutes(sessionName, appRoot, devOutput) {
+  try {
+    const planned = planWorkstationRoutes(appRoot, devOutput);
+    if (planned.length === 0) return {};
+    const result = writeSessionRoutes(sessionName, planned);
+    for (const warning of workstationRenewalWarnings()) logWarn(warning);
+    for (const c of result.conflicts) {
+      logWarn(
+        `Workstation route ${c.hostname} is held by ${c.heldBy} (port ${c.heldPort}); ${c.service} (port ${c.port}) is not routed. Pick another name with --route-suffix <name>.`
+      );
+    }
+    return result.urls;
+  } catch (e) {
+    logWarn(`Workstation routes skipped: ${e.message}`);
+    return {};
+  }
+}
 async function setupSubdomainRouting(devOutput, appRoot) {
   const tsInfo = await getTailscaleInfo();
   if (!tsInfo) return null;
-  const appName = devOutput.app ?? path18.basename(appRoot);
+  const appName = devOutput.app ?? path20.basename(appRoot);
   const stack = devOutput.stack ?? "dev";
   const baseDomain = `${appName}.${stack}.${tsInfo.hostname}.vpn.internal`;
   const platform = devOutput.platform ?? { tenant: "mesh", env: "dev" };
@@ -7152,8 +7624,8 @@ async function setupSubdomainRouting(devOutput, appRoot) {
   } catch {
   }
   const caddyDir = "/tmp/mesh-dev-caddy";
-  const caddyfile = path18.join(caddyDir, "Caddyfile");
-  if (!fs17.existsSync(caddyDir)) fs17.mkdirSync(caddyDir, { recursive: true });
+  const caddyfile = path20.join(caddyDir, "Caddyfile");
+  if (!fs19.existsSync(caddyDir)) fs19.mkdirSync(caddyDir, { recursive: true });
   const caddyLines = [`# mesh-dev: ${appName}/${stack} (${tsInfo.hostname})`, ""];
   for (const [name, service] of Object.entries(devOutput.services)) {
     if (service.port) {
@@ -7171,16 +7643,16 @@ async function setupSubdomainRouting(devOutput, appRoot) {
     caddyLines.push("}");
     caddyLines.push("");
   }
-  fs17.writeFileSync(caddyfile, caddyLines.join("\n"));
+  fs19.writeFileSync(caddyfile, caddyLines.join("\n"));
   let caddyRunning = false;
   try {
-    execFileSync11("pgrep", ["-f", "caddy run.*mesh-dev-caddy"], { stdio: "pipe" });
+    execFileSync12("pgrep", ["-f", "caddy run.*mesh-dev-caddy"], { stdio: "pipe" });
     caddyRunning = true;
   } catch {
   }
   if (caddyRunning) {
     try {
-      execFileSync11("caddy", ["reload", "--config", caddyfile, "--adapter", "caddyfile"], {
+      execFileSync12("caddy", ["reload", "--config", caddyfile, "--adapter", "caddyfile"], {
         stdio: "pipe"
       });
     } catch {
@@ -7189,7 +7661,7 @@ async function setupSubdomainRouting(devOutput, appRoot) {
     }
   } else {
     try {
-      execFileSync11("which", ["caddy"], { stdio: "pipe" });
+      execFileSync12("which", ["caddy"], { stdio: "pipe" });
     } catch {
       logWarn(
         "Caddy not found. Install for subdomain routing: curl -fsSL https://caddyserver.com/api/download?os=linux&arch=arm64 -o /usr/local/bin/caddy && chmod +x /usr/local/bin/caddy"
@@ -7231,7 +7703,7 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
     return devOutput;
   }
   logInfo(`Creating tmux session: ${sessionName}`);
-  execFileSync11("tmux", ["new-session", "-d", "-s", sessionName, "-n", "status", "-c", appRoot]);
+  execFileSync12("tmux", ["new-session", "-d", "-s", sessionName, "-n", "status", "-c", appRoot]);
   const sessionEnv = {};
   const shareOnSession = (vars) => {
     Object.assign(sessionEnv, vars);
@@ -7350,15 +7822,15 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
     const tokenPort = await findFreePort();
     const tokenUrl = `http://127.0.0.1:${tokenPort}`;
     shareOnSession({ DEV_USER_TOKEN_URL: tokenUrl });
-    execFileSync11("tmux", ["new-window", "-t", sessionName, "-n", "token-server"]);
-    execFileSync11(
+    execFileSync12("tmux", ["new-window", "-t", sessionName, "-n", "token-server"]);
+    execFileSync12(
       "tmux",
       ["set-option", "-t", `${sessionName}:token-server`, "remain-on-exit", "on"],
       { stdio: "ignore" }
     );
     const tokenServerEnvFile = getServiceEnvFilePath(sessionName, "token-server");
     writeEnvFile(tokenServerEnvFile, hostEnv);
-    execFileSync11("tmux", [
+    execFileSync12("tmux", [
       "send-keys",
       "-t",
       `${sessionName}:token-server`,
@@ -7381,6 +7853,7 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
     logInfo("  Hub UI will show unauthenticated state without valid credentials.");
   }
   const monorepoRoot = findMonorepoRoot();
+  const routeUrls = applyWorkstationRoutes(sessionName, appRoot, devOutput);
   const notLaunched = [];
   for (const [name, service] of Object.entries(devOutput.services)) {
     const cmd = service.command.join(" ");
@@ -7388,9 +7861,9 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
       logInfo(`Skipped: ${name} (no dev command, deployed to K8s)`);
       continue;
     }
-    let serviceDir = path18.resolve(appRoot, rebaseServiceSrc(service.src, monorepoRoot));
-    if (worktreeRoot && fs17.existsSync(serviceDir)) {
-      const wtRootWithSep = worktreeRoot.endsWith(path18.sep) ? worktreeRoot : worktreeRoot + path18.sep;
+    let serviceDir = path20.resolve(appRoot, rebaseServiceSrc(service.src, monorepoRoot));
+    if (worktreeRoot && fs19.existsSync(serviceDir)) {
+      const wtRootWithSep = worktreeRoot.endsWith(path20.sep) ? worktreeRoot : worktreeRoot + path20.sep;
       const outside = serviceDir !== worktreeRoot && !serviceDir.startsWith(wtRootWithSep);
       if (outside && isLinkedDependencyDir(serviceDir, appRoot)) {
         logInfo(`${name}: source is a dev-linked package (${serviceDir})`);
@@ -7410,7 +7883,7 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
         }
       }
     }
-    if (!fs17.existsSync(serviceDir)) {
+    if (!fs19.existsSync(serviceDir)) {
       logWarn(
         `Skipped: ${name} (source directory not found: ${serviceDir}${serviceDir !== service.src ? ` \u2014 rebased from ${service.src}` : ""})`
       );
@@ -7442,6 +7915,9 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
       // worktrees don't steal each other's workflow tasks. Empty on the primary
       // checkout → omitted → unchanged historical behavior.
       ...taskQueueSuffix ? { MESH_TASK_QUEUE_SUFFIX: taskQueueSuffix } : {},
+      // The service's workstation route, when it has one: what a dev server needs to
+      // accept its public host (Vite allowedHosts, a framework's action origins).
+      ...routeUrls[name] ? { MESH_DEV_PUBLIC_URL: routeUrls[name] } : {},
       // AWS, for the same reason as the Temporal and dev-user overlays above: the
       // sourced env file WINS over the tmux session env, so a service that reads this
       // file gets whatever the file says and nothing else.
@@ -7472,11 +7948,11 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
       service.env?.OTEL_RESOURCE_ATTRIBUTES ? logShipperPath() : void 0,
       hostEnv
     );
-    execFileSync11("tmux", ["new-window", "-t", sessionName, "-n", name, "-c", serviceDir]);
-    execFileSync11("tmux", ["set-option", "-t", `${sessionName}:${name}`, "remain-on-exit", "on"], {
+    execFileSync12("tmux", ["new-window", "-t", sessionName, "-n", name, "-c", serviceDir]);
+    execFileSync12("tmux", ["set-option", "-t", `${sessionName}:${name}`, "remain-on-exit", "on"], {
       stdio: "ignore"
     });
-    execFileSync11("tmux", ["send-keys", "-t", `${sessionName}:${name}`, launchCmd, "Enter"]);
+    execFileSync12("tmux", ["send-keys", "-t", `${sessionName}:${name}`, launchCmd, "Enter"]);
     logSuccess(`Started: ${name} (${serviceDir}, port ${service.port})`);
   }
   if (process.env.DEVCONTAINER === "1") {
@@ -7487,7 +7963,7 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
     }
   }
   const statusCmd = `watch -n2 -t npx mesh dev --status --session '${sessionName}'`;
-  execFileSync11("tmux", ["send-keys", "-t", `${sessionName}:status`, statusCmd, "Enter"]);
+  execFileSync12("tmux", ["send-keys", "-t", `${sessionName}:status`, statusCmd, "Enter"]);
   console.log("");
   logSuccess(`Dev session started: ${sessionName}`);
   if (notLaunched.length > 0)
@@ -7512,7 +7988,9 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
     const s = devOutput.services[name];
     const hasCmd = s.command && s.command.length > 0;
     if (hasCmd) {
-      if (subdomainCtx && s.port) {
+      if (routeUrls[name]) {
+        console.log(`  ${name.padEnd(20)} ${routeUrls[name]}  (localhost:${s.port})`);
+      } else if (subdomainCtx && s.port) {
         console.log(`  ${name.padEnd(20)} http://${name}.${subdomainCtx.baseDomain}`);
       } else {
         const addr = s.port ? `http://localhost:${s.port}` : "(no port)";
@@ -7621,7 +8099,7 @@ async function restartService(sessionName, serviceName, appRoot, devOutput, awsE
     process.exit(1);
   }
   const waitMs = opts?.waitMs ?? RESTART_READY_TIMEOUT_MS;
-  const neverLaunched = !fs17.existsSync(getServiceEnvFilePath(sessionName, serviceName));
+  const neverLaunched = !fs19.existsSync(getServiceEnvFilePath(sessionName, serviceName));
   if (neverLaunched && !opts?.refreshEnv && opts?.stack)
     logInfo(`'${serviceName}' has no launch env file (never started) \u2014 rendering it from the stack.`);
   const refreshEnv = opts?.refreshEnv || neverLaunched && Boolean(opts?.stack);
@@ -7665,6 +8143,8 @@ async function restartService(sessionName, serviceName, appRoot, devOutput, awsE
       // token from `mesh login` (the "restart silently 401s the Hub" trap).
       ...resolveDevUserVars(merged),
       ...taskQueueSuffix ? { MESH_TASK_QUEUE_SUFFIX: taskQueueSuffix } : {},
+      // Same as launch: the workstation route the session holds for this service.
+      ...workstationUrlVar(appRoot, merged, serviceName),
       // Same overlay as launch — a refresh that dropped these would take a working
       // service's credentials away on restart, which is the hardest kind of change to
       // attribute afterwards.
@@ -7678,7 +8158,7 @@ async function restartService(sessionName, serviceName, appRoot, devOutput, awsE
     const envFilePathToRefresh = getServiceEnvFilePath(sessionName, serviceName);
     let previousVars = null;
     try {
-      previousVars = parseEnvFile(fs17.readFileSync(envFilePathToRefresh, "utf-8"));
+      previousVars = parseEnvFile(fs19.readFileSync(envFilePathToRefresh, "utf-8"));
     } catch {
     }
     if (previousVars) {
@@ -7699,10 +8179,10 @@ async function restartService(sessionName, serviceName, appRoot, devOutput, awsE
   }
   const target = `${sessionName}:${serviceName}`;
   try {
-    execFileSync11("tmux", ["respawn-pane", "-k", "-t", target], { stdio: "ignore" });
+    execFileSync12("tmux", ["respawn-pane", "-k", "-t", target], { stdio: "ignore" });
   } catch {
     try {
-      execFileSync11("tmux", ["new-window", "-d", "-t", sessionName, "-n", serviceName], { stdio: "ignore" });
+      execFileSync12("tmux", ["new-window", "-d", "-t", sessionName, "-n", serviceName], { stdio: "ignore" });
       logInfo(`Window '${serviceName}' did not exist \u2014 created it.`);
     } catch {
       logError(`Window '${serviceName}' not found in session, and could not be created.`);
@@ -7710,13 +8190,13 @@ async function restartService(sessionName, serviceName, appRoot, devOutput, awsE
     }
   }
   try {
-    execFileSync11("tmux", ["clear-history", "-t", target], { stdio: "ignore" });
+    execFileSync12("tmux", ["clear-history", "-t", target], { stdio: "ignore" });
   } catch {
   }
   const portHeldBeforeStart = waitMs > 0 && await portHeldByAnother(service.port, {
     portAccepts: isPortListening,
     now: () => Date.now(),
-    sleep: (ms) => new Promise((resolve9) => setTimeout(resolve9, ms))
+    sleep: (ms) => new Promise((resolve10) => setTimeout(resolve10, ms))
   });
   if (portHeldBeforeStart) {
     logWarn(
@@ -7728,8 +8208,8 @@ async function restartService(sessionName, serviceName, appRoot, devOutput, awsE
   const cmd = service.command.join(" ");
   const envFilePath = getServiceEnvFilePath(sessionName, serviceName);
   let restartCmd;
-  if (fs17.existsSync(envFilePath)) {
-    let serviceDir = path18.resolve(appRoot, rebaseServiceSrc(service.src, findMonorepoRoot()));
+  if (fs19.existsSync(envFilePath)) {
+    let serviceDir = path20.resolve(appRoot, rebaseServiceSrc(service.src, findMonorepoRoot()));
     if (!isLinkedDependencyDir(serviceDir, appRoot)) serviceDir = relinkedServiceDir(serviceDir, appRoot) ?? serviceDir;
     restartCmd = buildLaunchCommand(
       envFilePath,
@@ -7746,7 +8226,7 @@ async function restartService(sessionName, serviceName, appRoot, devOutput, awsE
     const serviceVars = getServiceEnvVars(service, devOutput.tunnels);
     restartCmd = `${envPrefix(serviceVars)}${cmd}`;
   }
-  execFileSync11("tmux", ["send-keys", "-t", target, restartCmd, "Enter"]);
+  execFileSync12("tmux", ["send-keys", "-t", target, restartCmd, "Enter"]);
   if (waitMs <= 0) {
     logSuccess(`Restarted: ${serviceName} (not waiting for readiness \u2014 check \`mesh dev --status\`)`);
     return null;
@@ -7763,7 +8243,7 @@ async function restartService(sessionName, serviceName, appRoot, devOutput, awsE
       portAccepts: isPortListening,
       paneOutput: () => capturePane(target),
       now: () => Date.now(),
-      sleep: (ms) => new Promise((resolve9) => setTimeout(resolve9, ms))
+      sleep: (ms) => new Promise((resolve10) => setTimeout(resolve10, ms))
     }
   );
   reportRestartReadiness(serviceName, service.port, readiness);
@@ -7771,7 +8251,7 @@ async function restartService(sessionName, serviceName, appRoot, devOutput, awsE
 }
 function capturePane(target, lines = 2e3) {
   try {
-    return execFileSync11("tmux", ["capture-pane", "-p", "-t", target, "-S", `-${lines}`], {
+    return execFileSync12("tmux", ["capture-pane", "-p", "-t", target, "-S", `-${lines}`], {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -7828,7 +8308,7 @@ function showLogs(sessionName, serviceName, tail) {
   }
   const target = `${sessionName}:${serviceName}`;
   try {
-    const result = execFileSync11("tmux", ["capture-pane", "-t", target, "-p", "-S", `-${tail}`], {
+    const result = execFileSync12("tmux", ["capture-pane", "-t", target, "-p", "-S", `-${tail}`], {
       encoding: "utf-8"
     });
     process.stdout.write(result);
@@ -7865,7 +8345,10 @@ function buildDoctorContext(appRoot, stack, sessionName) {
 function registerDevCommand(program) {
   const dev = program.command("dev").description(
     "Start local dev environment (reads Pulumi stack outputs). The env is rendered from the stack's STORED outputs \u2014 when they are older than the program (git HEAD) or the stack config, mesh dev warns to run `mesh deploy up --stack <stack>` first"
-  ).option("--app <path>", "Path to a Pulumi app (relative to monorepo root or cwd)").option("--stack <stack>", "Pulumi stack name (default: auto-detect)").addOption(new Option("--stage <stack>", "Deprecated alias for --stack").hideHelp()).option("--headless", "Start without attaching to tmux").option("--kill", "Kill existing dev session").option("--status", "Show service status").option("--json", "Output status as JSON (with --status)").option(
+  ).option("--app <path>", "Path to a Pulumi app (relative to monorepo root or cwd)").option("--stack <stack>", "Pulumi stack name (default: auto-detect)").addOption(new Option("--stage <stack>", "Deprecated alias for --stack").hideHelp()).option("--headless", "Start without attaching to tmux").option(
+    "--route-suffix <name>",
+    "On a workstation: the suffix of this session's HTTPS names (default: the worktree's name; '' for none)"
+  ).option("--kill", "Kill existing dev session").option("--status", "Show service status").option("--json", "Output status as JSON (with --status)").option(
     "--session <name>",
     "Override the tmux session name (auto-derived per git worktree by default \u2014 omit to keep concurrent worktrees isolated)"
   ).option("--dry-run", "Print the resolved worktree/session/port plan and exit without launching").option("--force", "Relaunch even if workflow code changed since launch (may strand in-flight conversations)").option("--profile <name>", "AWS SSO profile to use (e.g., mesh-dev)").addOption(
@@ -7885,10 +8368,11 @@ function registerDevCommand(program) {
     "tmux"
   );
   dev.command("__token-server <port> <context>", { hidden: true }).action(async (port, context) => {
-    const { startTokenServer } = await import("./mesh.dev-token-server-4N6HGQAF.js");
+    const { startTokenServer } = await import("./mesh.dev-token-server-6TNWX5TY.js");
     await startTokenServer(Number(port), context);
   });
   dev.action(async (options) => {
+    if (options.routeSuffix !== void 0) process.env.MESH_DEV_ROUTE_SUFFIX = options.routeSuffix;
     if (options.profile) {
       applyAwsProfileOverride(options.profile);
     }
@@ -8069,7 +8553,7 @@ function registerDevCommand(program) {
         signInServices = [];
         try {
           const appPkg = JSON.parse(
-            fs17.readFileSync(path18.join(appRoot, "package.json"), "utf-8")
+            fs19.readFileSync(path20.join(appRoot, "package.json"), "utf-8")
           );
           if (Array.isArray(appPkg?.mesh?.auth?.roles)) {
             authRoles = appPkg.mesh.auth.roles.filter((r) => typeof r === "string");
@@ -8166,7 +8650,7 @@ function registerDevCommand(program) {
       }
       let localDocs;
       try {
-        const appPkg = JSON.parse(fs17.readFileSync(path18.join(appRoot, "package.json"), "utf-8"));
+        const appPkg = JSON.parse(fs19.readFileSync(path20.join(appRoot, "package.json"), "utf-8"));
         const declaration = readLocalPublishDeclaration(appPkg, appRoot);
         if (declaration.docs || declaration.authzMetadata || declaration.problems.length > 0) {
           const app = devOutput2.app ?? projectName;
@@ -8176,10 +8660,10 @@ function registerDevCommand(program) {
           if (!httpService || !service?.port) {
             logWarn(`mesh.docs names service '${httpService ?? ""}', which this app does not run \u2014 docs not published.`);
           } else {
-            const serviceDir = path18.resolve(appRoot, service.src);
+            const serviceDir = path20.resolve(appRoot, service.src);
             const env = service.env ?? (service.env = {});
             const serviceEnv = {
-              ...readDotEnvFile(path18.join(serviceDir, ".env")),
+              ...readDotEnvFile(path20.join(serviceDir, ".env")),
               ...Object.fromEntries(Object.entries(process.env).filter((e) => typeof e[1] === "string")),
               ...Object.fromEntries(Object.entries(env).map(([k, v]) => [k, v.value]))
             };
@@ -8371,9 +8855,9 @@ function registerDevCommand(program) {
     logInfo(`Project: ${projectName}, Stack: ${stack}`);
     const monorepoRoot = findMonorepoRoot();
     const looksLikeStandaloneApp = ["api", "worker", "web"].some(
-      (dir) => fs17.existsSync(path18.join(appRoot, dir, "package.json"))
+      (dir) => fs19.existsSync(path20.join(appRoot, dir, "package.json"))
     );
-    if (monorepoRoot && path18.resolve(appRoot) === path18.resolve(monorepoRoot) && !looksLikeStandaloneApp) {
+    if (monorepoRoot && path20.resolve(appRoot) === path20.resolve(monorepoRoot) && !looksLikeStandaloneApp) {
       logError(`mesh dev should be run from an app directory, not the monorepo root.
 `);
       logInfo("Try:");
@@ -8808,17 +9292,17 @@ function registerDevCommand(program) {
 // packages/mesh-cli/src/utils/tailscale-targets.ts
 var PORT_BLOCK = 3e3;
 function tenantPortIndex(tenant, registryPath) {
-  const p = registryPath ?? path19.join(CONFIG_DIR, "tailscale", "port-registry.json");
+  const p = registryPath ?? path21.join(CONFIG_DIR, "tailscale", "port-registry.json");
   let reg;
   try {
-    reg = JSON.parse(fs18.readFileSync(p, "utf8"));
+    reg = JSON.parse(fs20.readFileSync(p, "utf8"));
   } catch {
     reg = { mesh: 0 };
   }
   if (tenant in reg) return reg[tenant];
   const idx = Math.max(-1, ...Object.values(reg)) + 1;
   reg[tenant] = idx;
-  fs18.mkdirSync(path19.dirname(p), { recursive: true });
+  fs20.mkdirSync(path21.dirname(p), { recursive: true });
   atomicWriteFileSync(p, JSON.stringify(reg, null, 2), 384);
   return idx;
 }
@@ -8846,7 +9330,7 @@ function resolveTunnelTargets(services, resolveIp, portOffset = 0) {
 }
 function resolveElbIp(host) {
   try {
-    const out = execFileSync12("dig", ["+short", host, "@1.1.1.1"], {
+    const out = execFileSync13("dig", ["+short", host, "@1.1.1.1"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -8930,35 +9414,35 @@ function createForwarder(opts) {
 
 // packages/mesh-cli/src/utils/tunnel-ownership.ts
 import * as crypto2 from "node:crypto";
-import * as fs19 from "node:fs";
+import * as fs21 from "node:fs";
 import * as net5 from "node:net";
-import * as path20 from "node:path";
-import { execFileSync as execFileSync13 } from "node:child_process";
+import * as path22 from "node:path";
+import { execFileSync as execFileSync14 } from "node:child_process";
 function mintRunnerToken() {
   return crypto2.randomBytes(16).toString("hex");
 }
 function readRunnerManifest(file) {
-  if (!fs19.existsSync(file)) return null;
+  if (!fs21.existsSync(file)) return null;
   try {
-    return JSON.parse(fs19.readFileSync(file, "utf8"));
+    return JSON.parse(fs21.readFileSync(file, "utf8"));
   } catch {
     return null;
   }
 }
 function writeRunnerManifest(file, manifest) {
-  fs19.mkdirSync(path20.dirname(file), { recursive: true });
-  fs19.writeFileSync(file, JSON.stringify(manifest, null, 2), { mode: 384 });
+  fs21.mkdirSync(path22.dirname(file), { recursive: true });
+  fs21.writeFileSync(file, JSON.stringify(manifest, null, 2), { mode: 384 });
 }
 function clearRunnerManifest(file, token) {
   if (token !== void 0 && readRunnerManifest(file)?.token !== token) return;
   try {
-    fs19.unlinkSync(file);
+    fs21.unlinkSync(file);
   } catch {
   }
 }
 function getProcessGroupId(pid) {
   try {
-    const out = execFileSync13("ps", ["-o", "pgid=", "-p", String(pid)], {
+    const out = execFileSync14("ps", ["-o", "pgid=", "-p", String(pid)], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     }).trim();
@@ -8984,7 +9468,7 @@ function parseRunnerPidsFromPs(psOutput, tenant, exclude) {
 }
 function discoverRunnerPids(tenant, exclude) {
   try {
-    const out = execFileSync13("ps", ["ax", "-o", "pid=,command="], {
+    const out = execFileSync14("ps", ["ax", "-o", "pid=,command="], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -8994,7 +9478,7 @@ function discoverRunnerPids(tenant, exclude) {
   }
 }
 function startControlServer(payload) {
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve10, reject) => {
     const server = net5.createServer((socket) => {
       socket.on("error", () => {
       });
@@ -9007,12 +9491,12 @@ function startControlServer(payload) {
     });
     server.on("error", reject);
     server.listen(0, "127.0.0.1", () => {
-      resolve9({ server, port: server.address().port });
+      resolve10({ server, port: server.address().port });
     });
   });
 }
 function queryControl(port, timeoutMs = 700) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     const s = new net5.Socket();
     let buf = "";
     let done = false;
@@ -9020,7 +9504,7 @@ function queryControl(port, timeoutMs = 700) {
       if (done) return;
       done = true;
       s.destroy();
-      resolve9(v);
+      resolve10(v);
     };
     s.setTimeout(timeoutMs);
     s.once("timeout", () => fin(null));
@@ -9076,7 +9560,7 @@ async function pollOwnership(check, deadlineMs) {
 }
 function describePortOwner(port) {
   try {
-    const out = execFileSync13("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN", "-Fcp"], {
+    const out = execFileSync14("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN", "-Fcp"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -9118,58 +9602,58 @@ function buildSquatterError(tenant, squatted, detail) {
 // packages/mesh-cli/src/utils/tailscale.ts
 var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 function tenantStateDir(tenant) {
-  return path21.join(CONFIG_DIR, "tailscale", tenant);
+  return path23.join(CONFIG_DIR, "tailscale", tenant);
 }
 function socketPath(tenant) {
-  return path21.join(tenantStateDir(tenant), "tailscaled.sock");
+  return path23.join(tenantStateDir(tenant), "tailscaled.sock");
 }
 function logPath(tenant) {
-  return path21.join(tenantStateDir(tenant), "tailscaled.log");
+  return path23.join(tenantStateDir(tenant), "tailscaled.log");
 }
 function statePath(tenant) {
-  return path21.join(tenantStateDir(tenant), "tunnel-state.json");
+  return path23.join(tenantStateDir(tenant), "tunnel-state.json");
 }
 function daemonMetaPath(tenant) {
-  return path21.join(tenantStateDir(tenant), "daemon.json");
+  return path23.join(tenantStateDir(tenant), "daemon.json");
 }
 function runnerManifestPath(tenant) {
-  return path21.join(tenantStateDir(tenant), "runner.json");
+  return path23.join(tenantStateDir(tenant), "runner.json");
 }
 function readTunnelState(tenant) {
   const p = statePath(tenant);
-  if (!fs20.existsSync(p)) return null;
+  if (!fs22.existsSync(p)) return null;
   try {
-    return JSON.parse(fs20.readFileSync(p, "utf8"));
+    return JSON.parse(fs22.readFileSync(p, "utf8"));
   } catch {
     return null;
   }
 }
 function writeTunnelState(tenant, state) {
-  fs20.mkdirSync(tenantStateDir(tenant), { recursive: true });
+  fs22.mkdirSync(tenantStateDir(tenant), { recursive: true });
   atomicWriteFileSync(statePath(tenant), JSON.stringify(state, null, 2), 384);
 }
 function clearTunnelState(tenant) {
   try {
-    fs20.unlinkSync(statePath(tenant));
+    fs22.unlinkSync(statePath(tenant));
   } catch {
   }
 }
 function readDaemonMeta(tenant) {
   const p = daemonMetaPath(tenant);
-  if (!fs20.existsSync(p)) return null;
+  if (!fs22.existsSync(p)) return null;
   try {
-    return JSON.parse(fs20.readFileSync(p, "utf8"));
+    return JSON.parse(fs22.readFileSync(p, "utf8"));
   } catch {
     return null;
   }
 }
 function writeDaemonMeta(tenant, meta) {
-  fs20.mkdirSync(tenantStateDir(tenant), { recursive: true });
+  fs22.mkdirSync(tenantStateDir(tenant), { recursive: true });
   atomicWriteFileSync(daemonMetaPath(tenant), JSON.stringify(meta, null, 2), 384);
 }
 function clearDaemonMeta(tenant) {
   try {
-    fs20.unlinkSync(daemonMetaPath(tenant));
+    fs22.unlinkSync(daemonMetaPath(tenant));
   } catch {
   }
 }
@@ -9189,18 +9673,18 @@ function tailscaleBinPath() {
 }
 function resolveBrewBin(name) {
   const brew = `/opt/homebrew/bin/${name}`;
-  if (fs20.existsSync(brew)) return brew;
+  if (fs22.existsSync(brew)) return brew;
   try {
-    const p = execFileSync14("which", [name], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    const p = execFileSync15("which", [name], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
     if (p) return p;
   } catch {
   }
   throw new Error(`${name} not found \u2014 install the standalone binary: brew install tailscale`);
 }
 function daemonState(tenant) {
-  if (!fs20.existsSync(socketPath(tenant))) return { backendState: "Down" };
+  if (!fs22.existsSync(socketPath(tenant))) return { backendState: "Down" };
   try {
-    const out = execFileSync14(
+    const out = execFileSync15(
       tailscaleBinPath(),
       ["--socket", socketPath(tenant), "status", "--json"],
       { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }
@@ -9220,7 +9704,7 @@ function findRunningDaemon(tenant) {
   const sock = socketPath(tenant);
   let out;
   try {
-    out = execFileSync14("ps", ["ax", "-o", "pid=,command="], {
+    out = execFileSync15("ps", ["ax", "-o", "pid=,command="], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -9236,14 +9720,14 @@ function findRunningDaemon(tenant) {
   return null;
 }
 function portAccepts(port, timeoutMs = 400) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     const s = new net6.Socket();
     let done = false;
     const fin = (v) => {
       if (done) return;
       done = true;
       s.destroy();
-      resolve9(v);
+      resolve10(v);
     };
     s.setTimeout(timeoutMs);
     s.once("connect", () => fin(true));
@@ -9272,8 +9756,8 @@ async function ensureDaemon(tenant, opts) {
     }
   }
   const dir = tenantStateDir(tenant);
-  fs20.mkdirSync(dir, { recursive: true });
-  const log = fs20.openSync(logPath(tenant), "a");
+  fs22.mkdirSync(dir, { recursive: true });
+  const log = fs22.openSync(logPath(tenant), "a");
   try {
     const child = spawn2(
       tailscaledBinPath(),
@@ -9293,7 +9777,7 @@ async function ensureDaemon(tenant, opts) {
     child.unref();
     if (child.pid) writeDaemonMeta(tenant, { socksPort: opts.socksPort, pid: child.pid });
   } finally {
-    fs20.closeSync(log);
+    fs22.closeSync(log);
   }
   for (let i = 0; i < 40; i++) {
     await sleep(250);
@@ -9319,7 +9803,7 @@ function stopDaemon(tenant) {
   }
   for (const p of [socketPath(tenant)]) {
     try {
-      fs20.unlinkSync(p);
+      fs22.unlinkSync(p);
     } catch {
     }
   }
@@ -9341,7 +9825,7 @@ function buildTailscaleUpArgs(opts) {
 }
 async function joinHeadscale(tenant, loginServer, opts = {}) {
   if (daemonState(tenant).backendState === "Running") return;
-  const hostname2 = `mesh-${tenant}-${os3.hostname().split(".")[0]}`;
+  const hostname2 = `mesh-${tenant}-${os5.hostname().split(".")[0]}`;
   const child = spawn2(
     tailscaleBinPath(),
     buildTailscaleUpArgs({ socket: socketPath(tenant), loginServer, hostname: hostname2, preAuthKey: opts.preAuthKey }),
@@ -9384,7 +9868,7 @@ async function joinHeadscale(tenant, loginServer, opts = {}) {
 }
 function logout(tenant) {
   try {
-    execFileSync14(tailscaleBinPath(), ["--socket", socketPath(tenant), "logout"], { stdio: "ignore" });
+    execFileSync15(tailscaleBinPath(), ["--socket", socketPath(tenant), "logout"], { stdio: "ignore" });
   } catch {
   }
 }
@@ -9464,7 +9948,7 @@ async function assertTunnelPortsFree(tenant, ports) {
 async function ensureForwarders(state) {
   const prior = readTunnelState(state.tenant);
   const expected = { socksPort: state.socksPort, ports: state.tunnels.map((t) => t.localPort) };
-  const runnerAlive = prior?.managed === "launchd" ? fs20.existsSync(launchAgentPath(state.tenant)) : pidAlive(prior?.supervisorPid);
+  const runnerAlive = prior?.managed === "launchd" ? fs22.existsSync(launchAgentPath(state.tenant)) : pidAlive(prior?.supervisorPid);
   if (prior && runnerAlive && tunnelTargetsEqual(prior.tunnels, state.tunnels) && // A prior supervisor spawned for a DIFFERENT SOCKS port still binds the same
   // local ports but dials a dead upstream — reusing it silently strands every
   // tunnel. The port must match, and the runner must PROVE it is
@@ -9489,7 +9973,7 @@ async function ensureForwarders(state) {
   if (launchdAvailable()) {
     state.managed = "launchd";
     writeTunnelState(state.tenant, state);
-    if (path21.isAbsolute(meshBin) && installLaunchAgent(state.tenant, meshBin)) {
+    if (path23.isAbsolute(meshBin) && installLaunchAgent(state.tenant, meshBin)) {
       if ((await awaitOwnership(state.tenant, expected, 8e3)).ok) return 0;
       uninstallLaunchAgent(state.tenant);
       await assertTunnelPortsFree(state.tenant, expected.ports);
@@ -9621,7 +10105,7 @@ function forwardersNeedingRebind(targets, listening) {
   return targets.filter((t) => !listening.has(t.localPort));
 }
 function launchAgentPath(tenant) {
-  return path21.join(os3.homedir(), "Library", "LaunchAgents", `${launchAgentLabel(tenant)}.plist`);
+  return path23.join(os5.homedir(), "Library", "LaunchAgents", `${launchAgentLabel(tenant)}.plist`);
 }
 function guiDomain() {
   return `gui/${process.getuid?.() ?? 0}`;
@@ -9630,8 +10114,8 @@ var _launchdAvailable;
 function launchdAvailable() {
   if (_launchdAvailable !== void 0) return _launchdAvailable;
   try {
-    execFileSync14("which", ["launchctl"], { stdio: "ignore" });
-    execFileSync14("launchctl", ["print", guiDomain()], { stdio: "ignore" });
+    execFileSync15("which", ["launchctl"], { stdio: "ignore" });
+    execFileSync15("launchctl", ["print", guiDomain()], { stdio: "ignore" });
     _launchdAvailable = true;
   } catch {
     _launchdAvailable = false;
@@ -9643,30 +10127,30 @@ function installLaunchAgent(tenant, meshBin) {
   try {
     let realMeshBin = meshBin;
     try {
-      realMeshBin = fs20.realpathSync(meshBin);
+      realMeshBin = fs22.realpathSync(meshBin);
     } catch {
     }
     let pathEnv = "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin";
     try {
-      pathEnv = `${path21.dirname(tailscaledBinPath())}:${pathEnv}`;
+      pathEnv = `${path23.dirname(tailscaledBinPath())}:${pathEnv}`;
     } catch {
     }
-    fs20.mkdirSync(path21.dirname(plistPath), { recursive: true });
-    fs20.writeFileSync(
+    fs22.mkdirSync(path23.dirname(plistPath), { recursive: true });
+    fs22.writeFileSync(
       plistPath,
       renderLaunchAgentPlist({
         tenant,
         meshBin: realMeshBin,
         nodeBin: process.execPath,
-        logPath: path21.join(tenantStateDir(tenant), "runner.log"),
+        logPath: path23.join(tenantStateDir(tenant), "runner.log"),
         pathEnv
       })
     );
     try {
-      execFileSync14("launchctl", ["bootout", guiDomain(), plistPath], { stdio: "ignore" });
+      execFileSync15("launchctl", ["bootout", guiDomain(), plistPath], { stdio: "ignore" });
     } catch {
     }
-    execFileSync14("launchctl", ["bootstrap", guiDomain(), plistPath], { stdio: "ignore" });
+    execFileSync15("launchctl", ["bootstrap", guiDomain(), plistPath], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -9675,11 +10159,11 @@ function installLaunchAgent(tenant, meshBin) {
 function uninstallLaunchAgent(tenant) {
   const plistPath = launchAgentPath(tenant);
   try {
-    execFileSync14("launchctl", ["bootout", guiDomain(), plistPath], { stdio: "ignore" });
+    execFileSync15("launchctl", ["bootout", guiDomain(), plistPath], { stdio: "ignore" });
   } catch {
   }
   try {
-    fs20.unlinkSync(plistPath);
+    fs22.unlinkSync(plistPath);
   } catch {
   }
 }
@@ -9769,24 +10253,24 @@ function deriveLoginServer2(context) {
   return `https://${parts.join(".")}`;
 }
 function findFreePort2() {
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve10, reject) => {
     const s = net7.createServer();
     s.on("error", reject);
     s.listen(0, "127.0.0.1", () => {
       const port = s.address().port;
-      s.close(() => resolve9(port));
+      s.close(() => resolve10(port));
     });
   });
 }
 function canConnect2(port) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     const s = new net7.Socket();
     let settled = false;
     const done = (ok) => {
       if (settled) return;
       settled = true;
       s.destroy();
-      resolve9(ok);
+      resolve10(ok);
     };
     s.setTimeout(500);
     s.once("connect", () => done(true));
@@ -9908,7 +10392,7 @@ function headscaleExec(namespace, args, opts) {
     stdio: ["pipe", "pipe", "pipe"]
   };
   try {
-    const result = execFileSync15(
+    const result = execFileSync16(
       "kubectl",
       [
         "exec",
@@ -9937,7 +10421,7 @@ function clusterName(tenant, env) {
 }
 function assertPodReady(namespace, options) {
   try {
-    const output = execFileSync15(
+    const output = execFileSync16(
       "kubectl",
       [
         "get",
@@ -9972,7 +10456,7 @@ async function vpnStatus(options) {
   const ns = resolveNamespace(options);
   logInfo(`Checking Headscale in namespace ${ns}...`);
   assertPodReady(ns, options);
-  const podJson = execFileSync15(
+  const podJson = execFileSync16(
     "kubectl",
     [
       "get",
@@ -9994,7 +10478,7 @@ async function vpnStatus(options) {
   const restarts = container?.restartCount ?? 0;
   let endpoint = "unknown";
   try {
-    endpoint = execFileSync15(
+    endpoint = execFileSync16(
       "kubectl",
       [
         "get",
@@ -10137,19 +10621,19 @@ function parseContextTenantEnv(context) {
   return { tenant: tenant || "mesh", env: env || "dev" };
 }
 function findFreePort3() {
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve10, reject) => {
     const srv = net8.createServer();
     srv.on("error", reject);
     srv.listen(0, "127.0.0.1", () => {
       const addr = srv.address();
       const port = typeof addr === "object" && addr ? addr.port : 0;
-      srv.close(() => resolve9(port));
+      srv.close(() => resolve10(port));
     });
   });
 }
 function findTailscale() {
   try {
-    return execFileSync15("which", ["tailscale"], {
+    return execFileSync16("which", ["tailscale"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     }).trim() || null;
@@ -10159,7 +10643,7 @@ function findTailscale() {
 }
 function tailscaleStatus() {
   try {
-    const json = execFileSync15("tailscale", ["status", "--json"], {
+    const json = execFileSync16("tailscale", ["status", "--json"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -10240,7 +10724,7 @@ async function vpnConnectSystem(endpoint) {
     "--accept-routes"
   ];
   try {
-    execFileSync15("tailscale", upArgs, { stdio: "inherit" });
+    execFileSync16("tailscale", upArgs, { stdio: "inherit" });
     console.log("");
     logSuccess("VPN connected.");
   } catch (error) {
@@ -10267,7 +10751,7 @@ async function vpnDisconnect(opts) {
     }
     logInfo("Disconnecting system VPN\u2026");
     try {
-      execFileSync15("tailscale", ["down"], { stdio: "inherit" });
+      execFileSync16("tailscale", ["down"], { stdio: "inherit" });
       logSuccess("VPN disconnected.");
     } catch (error) {
       const code = error.status;
@@ -10319,12 +10803,12 @@ function registerVpnCommands(program) {
 }
 
 // packages/mesh-cli/src/commands/login.ts
-var CONFIG_DIR = path22.join(
-  process.env.XDG_CONFIG_HOME ?? path22.join(process.env.HOME ?? "~", ".config"),
+var CONFIG_DIR = path24.join(
+  process.env.XDG_CONFIG_HOME ?? path24.join(process.env.HOME ?? "~", ".config"),
   "mesh"
 );
-var CONFIG_FILE = path22.join(CONFIG_DIR, "config.json");
-var CREDENTIALS_FILE = path22.join(CONFIG_DIR, "credentials.json");
+var CONFIG_FILE = path24.join(CONFIG_DIR, "config.json");
+var CREDENTIALS_FILE = path24.join(CONFIG_DIR, "credentials.json");
 var REDIRECT_PORT = 9876;
 var REDIRECT_URI = `http://localhost:${REDIRECT_PORT}/callback`;
 var BASE_SCOPES = "openid email profile offline_access urn:zitadel:iam:org:project:id:zitadel:aud";
@@ -10340,9 +10824,9 @@ function withDiscoveredFields(config, data) {
   return out;
 }
 function readConfig() {
-  if (!fs21.existsSync(CONFIG_FILE)) return {};
+  if (!fs23.existsSync(CONFIG_FILE)) return {};
   try {
-    return JSON.parse(fs21.readFileSync(CONFIG_FILE, "utf-8"));
+    return JSON.parse(fs23.readFileSync(CONFIG_FILE, "utf-8"));
   } catch {
     return {};
   }
@@ -10350,15 +10834,15 @@ function readConfig() {
 function writeContextConfig(context, config) {
   const existing = readConfig();
   existing[context] = config;
-  fs21.mkdirSync(CONFIG_DIR, { recursive: true });
-  fs21.writeFileSync(CONFIG_FILE, JSON.stringify(existing, null, 2));
+  fs23.mkdirSync(CONFIG_DIR, { recursive: true });
+  fs23.writeFileSync(CONFIG_FILE, JSON.stringify(existing, null, 2));
 }
 function clearContextConfig(context) {
   const existing = readConfig();
   if (!(context in existing)) return;
   delete existing[context];
-  fs21.mkdirSync(CONFIG_DIR, { recursive: true });
-  fs21.writeFileSync(CONFIG_FILE, JSON.stringify(existing, null, 2));
+  fs23.mkdirSync(CONFIG_DIR, { recursive: true });
+  fs23.writeFileSync(CONFIG_FILE, JSON.stringify(existing, null, 2));
 }
 function getContextConfig(context) {
   const config = readConfig();
@@ -10465,9 +10949,9 @@ function discoverConfigFromWellKnown(domain, contextKey = domain, opts = {}) {
   return discoverConfig(domain, contextKey, opts);
 }
 function readAllCredentials() {
-  if (!fs21.existsSync(CREDENTIALS_FILE)) return {};
+  if (!fs23.existsSync(CREDENTIALS_FILE)) return {};
   try {
-    return JSON.parse(fs21.readFileSync(CREDENTIALS_FILE, "utf-8"));
+    return JSON.parse(fs23.readFileSync(CREDENTIALS_FILE, "utf-8"));
   } catch {
     return {};
   }
@@ -10476,21 +10960,21 @@ function readCredentials(context) {
   return readAllCredentials()[context] ?? null;
 }
 var atomicWriteCounter = 0;
-function atomicWriteFileSync(path23, data, mode) {
-  const tmpPath = `${path23}.${process.pid}.${atomicWriteCounter++}.tmp`;
+function atomicWriteFileSync(path25, data, mode) {
+  const tmpPath = `${path25}.${process.pid}.${atomicWriteCounter++}.tmp`;
   try {
-    fs21.writeFileSync(tmpPath, data, { mode });
-    fs21.renameSync(tmpPath, path23);
+    fs23.writeFileSync(tmpPath, data, { mode });
+    fs23.renameSync(tmpPath, path25);
   } catch (err) {
     try {
-      fs21.unlinkSync(tmpPath);
+      fs23.unlinkSync(tmpPath);
     } catch {
     }
     throw err;
   }
 }
 function writeCredentials(context, creds) {
-  fs21.mkdirSync(CONFIG_DIR, { recursive: true });
+  fs23.mkdirSync(CONFIG_DIR, { recursive: true });
   const all = readAllCredentials();
   all[context] = creds;
   atomicWriteFileSync(CREDENTIALS_FILE, JSON.stringify(all, null, 2), 384);
@@ -10498,8 +10982,8 @@ function writeCredentials(context, creds) {
 function clearCredentials(context) {
   const all = readAllCredentials();
   delete all[context];
-  fs21.mkdirSync(CONFIG_DIR, { recursive: true });
-  fs21.writeFileSync(CREDENTIALS_FILE, JSON.stringify(all, null, 2), {
+  fs23.mkdirSync(CONFIG_DIR, { recursive: true });
+  fs23.writeFileSync(CREDENTIALS_FILE, JSON.stringify(all, null, 2), {
     mode: 384
   });
 }
@@ -10553,7 +11037,7 @@ async function refreshTokens(issuer, clientId, refreshToken) {
   return resp.json();
 }
 function login(context, config) {
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve10, reject) => {
     const codeVerifier = generateCodeVerifier();
     const codeChallenge = generateCodeChallenge(codeVerifier);
     const state = base64url(crypto3.randomBytes(16));
@@ -10632,7 +11116,7 @@ function login(context, config) {
         }
         hintVpnIfDisconnected(context);
         teardown();
-        resolve9();
+        resolve10();
       } catch (err) {
         teardown();
         reject(err);
@@ -10648,9 +11132,9 @@ function login(context, config) {
       const url = authUrl.toString();
       try {
         if (process.platform === "darwin") {
-          execFileSync16("open", [url], { stdio: "ignore" });
+          execFileSync17("open", [url], { stdio: "ignore" });
         } else if (process.platform === "linux") {
-          execFileSync16("xdg-open", [url], { stdio: "ignore" });
+          execFileSync17("xdg-open", [url], { stdio: "ignore" });
         } else {
           logInfo(`Open this URL in your browser:
 ${url}`);
@@ -10704,9 +11188,9 @@ async function attemptDeviceCode(context, config) {
   logInfo("Waiting for authorization...");
   try {
     if (process.platform === "darwin") {
-      execFileSync16("open", [openUrl], { stdio: "ignore" });
+      execFileSync17("open", [openUrl], { stdio: "ignore" });
     } else if (process.platform === "linux") {
-      execFileSync16("xdg-open", [openUrl], { stdio: "ignore" });
+      execFileSync17("xdg-open", [openUrl], { stdio: "ignore" });
     }
   } catch {
   }
@@ -10769,7 +11253,7 @@ function loginTimeoutMessage(context) {
 }
 function isRemoteEnvironment() {
   if (process.env.REMOTE_CONTAINERS || process.env.CODESPACES) return true;
-  if (fs21.existsSync("/.dockerenv")) return true;
+  if (fs23.existsSync("/.dockerenv")) return true;
   if (process.env.SSH_CLIENT || process.env.SSH_TTY) return true;
   if (!process.stdout.isTTY || !process.stdin.isTTY) return true;
   return false;
@@ -11023,9 +11507,9 @@ function refuseReservedRegistryContext(context, verb) {
 }
 async function hintRegistryIfMissing() {
   try {
-    const { readRegistrySession } = await import("./mesh.registry-identity-DSTAHXUS.js");
+    const { readRegistrySession } = await import("./mesh.registry-identity-QOGDEMZO.js");
     if (readRegistrySession()) return;
-    const { probeRegistryToken: probeRegistryToken2 } = await import("./mesh.auth-preflight-JTUNS42O.js");
+    const { probeRegistryToken: probeRegistryToken2 } = await import("./mesh.auth-preflight-3ASNYA3I.js");
     const probe = await probeRegistryToken2();
     if (probe.state === "missing" || probe.state === "expired") {
       logInfo(REGISTRY_SEPARATE_HINT);
@@ -11157,12 +11641,12 @@ export AWS_REGION=${shellSingleQuote(args.region)}
 `;
 }
 function resolveUserAwsConfigPath(env = process.env) {
-  return env.AWS_CONFIG_FILE ?? path22.join(env.HOME ?? "~", ".aws", "config");
+  return env.AWS_CONFIG_FILE ?? path24.join(env.HOME ?? "~", ".aws", "config");
 }
 function canWriteDir(dir) {
   try {
-    fs21.mkdirSync(dir, { recursive: true });
-    fs21.accessSync(dir, fs21.constants.W_OK);
+    fs23.mkdirSync(dir, { recursive: true });
+    fs23.accessSync(dir, fs23.constants.W_OK);
     return true;
   } catch {
     return false;
@@ -11170,9 +11654,9 @@ function canWriteDir(dir) {
 }
 function resolveAwsConfigTarget(env = process.env) {
   if (env.AWS_CONFIG_FILE) return { configPath: env.AWS_CONFIG_FILE, redirected: false };
-  const real = path22.join(env.HOME ?? "~", ".aws", "config");
-  if (canWriteDir(path22.dirname(real))) return { configPath: real, redirected: false };
-  return { configPath: path22.join(CONFIG_DIR, "aws-config"), redirected: true };
+  const real = path24.join(env.HOME ?? "~", ".aws", "config");
+  if (canWriteDir(path24.dirname(real))) return { configPath: real, redirected: false };
+  return { configPath: path24.join(CONFIG_DIR, "aws-config"), redirected: true };
 }
 function resolveRoleOrExplain(opts, config) {
   const role = opts.role ?? process.env.MESH_AWS_ROLE ?? config.defaultRole;
@@ -11304,10 +11788,10 @@ async function exportAwsCredentials(context, config, opts) {
   const sanitized = context.replace(/[^A-Za-z0-9_-]/g, "-");
   const profileName = `mesh-${sanitized}`;
   const { configPath, redirected } = resolveAwsConfigTarget();
-  fs21.mkdirSync(path22.dirname(configPath), { recursive: true });
-  const existedBefore = fs21.existsSync(configPath);
-  const existing = existedBefore ? fs21.readFileSync(configPath, "utf-8") : "";
-  const mode = existedBefore ? fs21.statSync(configPath).mode & 511 : 384;
+  fs23.mkdirSync(path24.dirname(configPath), { recursive: true });
+  const existedBefore = fs23.existsSync(configPath);
+  const existing = existedBefore ? fs23.readFileSync(configPath, "utf-8") : "";
+  const mode = existedBefore ? fs23.statSync(configPath).mode & 511 : 384;
   atomicWriteFileSync(
     configPath,
     upsertManagedAwsConfigSection(
@@ -11426,6 +11910,8 @@ export {
   derivePlatformRef,
   readStackPlatform,
   derivePlatformContext,
+  renderCredentialProcessProfile,
+  upsertManagedAwsConfigSection,
   projectRoleKeys,
   resolveAwsCredentials,
   credProbeToPreflightError,
@@ -11458,6 +11944,30 @@ export {
   worktreeStackName,
   stackNeedsWorktreeIsolation,
   resolveWorktreeIdentity,
+  workstationDir,
+  readWorkstationIdentity,
+  listRoutes,
+  renderWorkstationCaddyfile,
+  readCredentialProcess,
+  credentialProcessProblem,
+  isInsideGitTree,
+  rewriteCredentialProgram,
+  LAUNCH_AGENT_LABEL,
+  LAUNCH_AGENTS_MACOS_ONLY,
+  launchAgentsSupported,
+  launchAgentSearchPath,
+  renderLaunchAgent,
+  certificateExpiry,
+  workstationWarnings,
+  discoveryRecordName,
+  parseDiscoveryRecord,
+  caddyDownloadUrl,
+  caddyHasRoute53,
+  shimFallsBackToGlobal,
+  zoneCandidates,
+  proxyEnv,
+  awsConfigFileOf,
+  profileYieldsCredentials,
   tunnelClientAddress,
   registerDevCommand,
   aggregateStatus,