@mesh-tech/mesh-cli 0.1.0 → 0.12.0

package/dist/src/commands/local/hub-local.js

@@ -0,0 +1,197 @@
+/**
+ * Local Hub image builder (`mesh start --with-hub`) — the interim path
+ * until the hub pipeline publishes pullable container images (design §11).
+ *
+ * Resolves the published @mesh-tech/hub tarball with the user's registry
+ * auth (mesh registry login), extracts it, and docker-builds two images
+ * from the prebuilt dists it ships (api/dist → mesh-local-hub-api,
+ * ui/build → mesh-local-hub-ui). The CodeArtifact token enters the build
+ * as a BuildKit secret and never lands in a layer. Idempotent: images are
+ * keyed by the package version and rebuilt only when missing.
+ */
+import { execFile, execFileSync } from "child_process";
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { promisify } from "util";
+import { logInfo, logSuccess, logWarn, startHeartbeat } from "../../utils/log.js";
+import { MeshCliError } from "../../utils/errors.js";
+import { isNpmAuthError, REGISTRY_LOGIN_FIX } from "../../utils/auth-preflight.js";
+import { findPackageRoot } from "./stack.js";
+const execFileAsync = promisify(execFile);
+const HUB_PACKAGE = "@mesh-tech/hub";
+export const HUB_IMAGES = ["mesh-local-hub-api", "mesh-local-hub-ui"];
+/** Bump when stack/hub/Dockerfile.* change — forces a rebuild of images
+ * already cached for the same published hub version. */
+const LOCAL_IMAGE_REV = "r2";
+function cacheDir() {
+    const dir = path.join(os.homedir(), ".cache", "mesh", "hub-local");
+    fs.mkdirSync(dir, { recursive: true });
+    return dir;
+}
+function npmrcPath() {
+    const p = path.join(os.homedir(), ".npmrc");
+    if (!fs.existsSync(p) || !fs.readFileSync(p, "utf-8").includes("codeartifact")) {
+        throw new MeshCliError("The local Hub builds from the published @mesh-tech/hub tarball, which needs registry auth.", { remediation: { command: REGISTRY_LOGIN_FIX } });
+    }
+    return p;
+}
+function imageExists(tag) {
+    try {
+        execFileSync("docker", ["image", "inspect", tag], { stdio: ["ignore", "pipe", "pipe"] });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Tag referenced by docker-compose.hub.yml — bump alongside Dockerfile.auth. */
+const HUB_AUTH_IMAGE = "mesh-local-hub-auth:v7.7.1-r1";
+/**
+ * Build the Hub's oauth2-proxy image (hosted sidecar + loopback issuer
+ * forward). Public base images only — no registry auth involved.
+ */
+export function ensureHubAuthImage() {
+    if (imageExists(HUB_AUTH_IMAGE))
+        return;
+    logInfo(`Building ${HUB_AUTH_IMAGE} (Hub auth proxy)…`);
+    const hubStackDir = path.join(findPackageRoot(), "stack", "hub");
+    execFileSync("docker", ["build", "-f", path.join(hubStackDir, "Dockerfile.auth"), "-t", HUB_AUTH_IMAGE, hubStackDir], { stdio: ["ignore", "inherit", "inherit"], env: { ...process.env, DOCKER_BUILDKIT: "1" } });
+    logSuccess(`Built ${HUB_AUTH_IMAGE}`);
+}
+/** Registry auth present? (Needed only to BUILD hub images, not to run them.) */
+export function hasRegistryAuth() {
+    const p = path.join(os.homedir(), ".npmrc");
+    return fs.existsSync(p) && fs.readFileSync(p, "utf-8").includes("codeartifact");
+}
+/**
+ * Newest hub version whose images already exist locally — lets `mesh start`
+ * include the Hub by default with no network and no registry auth. Returns
+ * undefined when no built images are present.
+ */
+export function localHubVersion() {
+    const versions = HUB_IMAGES.map((name) => {
+        try {
+            const out = execFileSync("docker", ["images", name, "--format", "{{.Tag}}"], {
+                encoding: "utf-8",
+                stdio: ["ignore", "pipe", "pipe"],
+            });
+            return out.split("\n").map((t) => t.trim()).filter((t) => t && t !== "<none>");
+        }
+        catch {
+            return [];
+        }
+    });
+    const shared = versions[0].filter((v) => v.endsWith(`-${LOCAL_IMAGE_REV}`) && versions.every((list) => list.includes(v)));
+    if (shared.length === 0)
+        return undefined;
+    // Highest semver wins (numeric-aware compare handles the -rN suffix).
+    return shared.sort((a, b) => a.localeCompare(b, undefined, { numeric: true })).at(-1);
+}
+/** `npm pack` the published hub tarball into the cache; returns its path +
+ * version. Falls back to the newest cached tarball when the registry is
+ * unreachable (offline / expired token). Async so the heartbeat can fill
+ * silence during the fetch — a first run's slowest, quietest step. */
+async function fetchTarball() {
+    const dir = cacheDir();
+    logInfo(`Resolving ${HUB_PACKAGE} from the registry…`);
+    const heartbeat = startHeartbeat(`fetching the ${HUB_PACKAGE} tarball from CodeArtifact`);
+    try {
+        const { stdout } = await execFileAsync("npm", ["pack", `${HUB_PACKAGE}@latest`, "--pack-destination", dir, "--json"], { encoding: "utf-8" });
+        const info = JSON.parse(stdout)[0];
+        return { tarball: path.join(dir, info.filename), version: info.version };
+    }
+    catch (err) {
+        const authFailure = isNpmAuthError(err);
+        const cached = fs
+            .readdirSync(dir)
+            .filter((f) => f.startsWith("mesh-tech-hub-") && f.endsWith(".tgz"))
+            .sort((a, b) => a.localeCompare(b, undefined, { numeric: true }))
+            .at(-1);
+        if (!cached) {
+            // Map npm's E401 ("try npm login") to the Mesh fix — npm login can
+            // never mint a CodeArtifact token (MESH-2479).
+            if (authFailure) {
+                throw new MeshCliError(`The registry rejected the ${HUB_PACKAGE} tarball fetch (E401 Unauthorized) — your CodeArtifact token is expired or invalid. (npm's "try npm login" advice does not apply to this registry.)`, { remediation: { command: REGISTRY_LOGIN_FIX }, cause: err });
+            }
+            throw err;
+        }
+        const version = cached.replace("mesh-tech-hub-", "").replace(/\.tgz$/, "");
+        if (authFailure) {
+            logWarn(`Registry rejected the fetch (E401 — CodeArtifact token expired). Using the cached hub tarball v${version}; refresh with: ${REGISTRY_LOGIN_FIX}`);
+        }
+        else {
+            logInfo(`Registry unavailable — using the cached hub tarball v${version}`);
+        }
+        return { tarball: path.join(dir, cached), version };
+    }
+    finally {
+        heartbeat.stop();
+    }
+}
+/**
+ * Pure: decide what `mesh start --with-hub` does given the registry probe
+ * and any already-built local images. Only a *refresh* needs the registry —
+ * already-built images run without it, so an expired/missing token degrades
+ * to those (with the fixing command) instead of hard-failing a path that
+ * works offline (MESH-2479).
+ */
+export function planWithHubRefresh(probeState, builtVersion) {
+    if (probeState !== "expired" && probeState !== "missing")
+        return { action: "refresh" };
+    if (builtVersion) {
+        return {
+            action: "use-local",
+            version: builtVersion,
+            warning: `CodeArtifact token is ${probeState} — using the already-built local Hub images (v${builtVersion}). ` +
+                `To pick up a newer published Hub: ${REGISTRY_LOGIN_FIX}, then re-run mesh start --with-hub.`,
+        };
+    }
+    return {
+        action: "fail",
+        message: probeState === "expired"
+            ? "Your CodeArtifact token is expired or rejected — the Hub build would fail minutes in with E401."
+            : "No CodeArtifact registry auth found in ~/.npmrc — the Hub builds from the published @mesh-tech/hub tarball.",
+        remediation: REGISTRY_LOGIN_FIX,
+    };
+}
+/**
+ * Ensure the two local hub images exist; build them from the tarball when
+ * missing. Returns the hub version (used as the compose image tag).
+ */
+export async function ensureHubImages() {
+    const npmrc = npmrcPath();
+    const { tarball, version: packageVersion } = await fetchTarball();
+    const version = `${packageVersion}-${LOCAL_IMAGE_REV}`;
+    const tags = HUB_IMAGES.map((name) => `${name}:${version}`);
+    if (tags.every(imageExists)) {
+        logInfo(`Local Hub images ready (v${version})`);
+        return version;
+    }
+    const context = path.join(cacheDir(), `context-${version}`);
+    fs.rmSync(context, { recursive: true, force: true });
+    fs.mkdirSync(context, { recursive: true });
+    execFileSync("tar", ["-xzf", tarball, "-C", context, "--strip-components", "1"], {
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    const hubStackDir = path.join(findPackageRoot(), "stack", "hub");
+    for (const [name, dockerfile] of [
+        ["mesh-local-hub-api", "Dockerfile.api"],
+        ["mesh-local-hub-ui", "Dockerfile.ui"],
+    ]) {
+        const tag = `${name}:${version}`;
+        if (imageExists(tag))
+            continue;
+        logInfo(`Building ${tag} from the published tarball…`);
+        execFileSync("docker", [
+            "build",
+            "-f", path.join(hubStackDir, dockerfile),
+            "-t", tag,
+            "--secret", `id=npmrc,src=${npmrc}`,
+            context,
+        ], { stdio: ["ignore", "inherit", "inherit"], env: { ...process.env, DOCKER_BUILDKIT: "1" } });
+        logSuccess(`Built ${tag}`);
+    }
+    return version;
+}
+//# sourceMappingURL=hub-local.js.map

package/dist/src/commands/local/hub-local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-local.js","sourceRoot":"","sources":["../../../../src/commands/local/hub-local.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAA2B,MAAM,+BAA+B,CAAC;AAC5G,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,WAAW,GAAG,gBAAgB,CAAC;AACrC,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,oBAAoB,EAAE,mBAAmB,CAAU,CAAC;AAC/E;wDACwD;AACxD,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B,SAAS,QAAQ;IACf,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IACnE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,YAAY,CACpB,4FAA4F,EAC5F,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CACjD,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,cAAc,GAAG,+BAA+B,CAAC;AAEvD;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,WAAW,CAAC,cAAc,CAAC;QAAE,OAAO;IACxC,OAAO,CAAC,YAAY,cAAc,oBAAoB,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACjE,YAAY,CACV,QAAQ,EACR,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,CAAC,EAC7F,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,EAAE,CAC3F,CAAC;IACF,UAAU,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,eAAe;IAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC5C,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE;gBAC3E,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAc,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC,MAAM,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,eAAe,EAAE,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CACvF,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,sEAAsE;IACtE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;;;sEAGsE;AACtE,KAAK,UAAU,YAAY;IACzB,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;IACvB,OAAO,CAAC,aAAa,WAAW,qBAAqB,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,cAAc,CAAC,gBAAgB,WAAW,4BAA4B,CAAC,CAAC;IAC1F,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CACpC,KAAK,EACL,CAAC,MAAM,EAAE,GAAG,WAAW,SAAS,EAAE,oBAAoB,EAAE,GAAG,EAAE,QAAQ,CAAC,EACtE,EAAE,QAAQ,EAAE,OAAO,EAAE,CACtB,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,EAAE;aACd,WAAW,CAAC,GAAG,CAAC;aAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aACnE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;aAChE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACV,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,mEAAmE;YACnE,+CAA+C;YAC/C,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,IAAI,YAAY,CACpB,6BAA6B,WAAW,qJAAqJ,EAC7L,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAC7D,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC3E,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CACL,kGAAkG,OAAO,mBAAmB,kBAAkB,EAAE,CACjJ,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,wDAAwD,OAAO,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACtD,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,IAAI,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAA8B,EAC9B,YAAgC;IAEhC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACvF,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,YAAY;YACrB,OAAO,EACL,yBAAyB,UAAU,iDAAiD,YAAY,KAAK;gBACrG,qCAAqC,kBAAkB,sCAAsC;SAChG,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,MAAM;QACd,OAAO,EACL,UAAU,KAAK,SAAS;YACtB,CAAC,CAAC,iGAAiG;YACnG,CAAC,CAAC,6GAA6G;QACnH,WAAW,EAAE,kBAAkB;KAChC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,GAAG,cAAc,IAAI,eAAe,EAAE,CAAC;IACvD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,4BAA4B,OAAO,GAAG,CAAC,CAAC;QAChD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,WAAW,OAAO,EAAE,CAAC,CAAC;IAC5D,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,oBAAoB,EAAE,GAAG,CAAC,EAAE;QAC/E,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACjE,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI;QAC/B,CAAC,oBAAoB,EAAE,gBAAgB,CAAC;QACxC,CAAC,mBAAmB,EAAE,eAAe,CAAC;KAC9B,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;QACjC,IAAI,WAAW,CAAC,GAAG,CAAC;YAAE,SAAS;QAC/B,OAAO,CAAC,YAAY,GAAG,8BAA8B,CAAC,CAAC;QACvD,YAAY,CACV,QAAQ,EACR;YACE,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC;YACxC,IAAI,EAAE,GAAG;YACT,UAAU,EAAE,gBAAgB,KAAK,EAAE;YACnC,OAAO;SACR,EACD,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,EAAE,CAC3F,CAAC;QACF,UAAU,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/src/commands/local/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * mesh start / stop / status — the full-local Mesh platform.
+ *
+ * mesh start [--no-seed]   Bring up the local platform (docker compose) and
+ *                          seed tenant `local` / env `dev` on first boot.
+ * mesh stop [--destroy]    Stop the stack; --destroy also removes volumes
+ *                          (resets databases and seeds).
+ * mesh status [--json]     Per-service health, endpoints, and ports.
+ *
+ * Everything here works with zero AWS credentials, zero VPN, and zero Pulumi
+ * state — Docker is the only prerequisite.
+ */
+import { Command } from "commander";
+import { type ServiceStatus, type StackEndpoint } from "./stack.js";
+/** Injectable seams so tests can drive the wait loop without Docker. */
+export interface WaitForStackIo {
+    probe: (endpoint: StackEndpoint) => Promise<boolean>;
+    services: () => ServiceStatus[];
+    overlayServices: () => ReadonlySet<string>;
+}
+export declare function waitForStack(io?: WaitForStackIo): Promise<void>;
+export declare function registerLocalCommands(program: Command): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/src/commands/local/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/local/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,OAAO,EAiBL,KAAK,aAAa,EAClB,KAAK,aAAa,EACnB,MAAM,YAAY,CAAC;AA4BpB,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,QAAQ,EAAE,MAAM,aAAa,EAAE,CAAC;IAChC,eAAe,EAAE,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;CAC5C;AAED,wBAAsB,YAAY,CAChC,EAAE,GAAE,cAIH,GACA,OAAO,CAAC,IAAI,CAAC,CAwCf;AA6CD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAkT5D"}

package/dist/src/commands/local/index.js

@@ -0,0 +1,386 @@
+/**
+ * mesh start / stop / status — the full-local Mesh platform.
+ *
+ * mesh start [--no-seed]   Bring up the local platform (docker compose) and
+ *                          seed tenant `local` / env `dev` on first boot.
+ * mesh stop [--destroy]    Stop the stack; --destroy also removes volumes
+ *                          (resets databases and seeds).
+ * mesh status [--json]     Per-service health, endpoints, and ports.
+ *
+ * Everything here works with zero AWS credentials, zero VPN, and zero Pulumi
+ * state — Docker is the only prerequisite.
+ */
+import chalk from "chalk";
+import { logError, logInfo, logSuccess, logWarn } from "../../utils/log.js";
+import { MeshCliError } from "../../utils/errors.js";
+import { COMPOSE_PROJECT, DEFAULT_HUB_PORT, ONE_SHOT_SERVICES, STACK_ENDPOINTS, compose, composeStreamed, crashedServices, ensureDockerAvailable, hubApiRunning, hubEndpoints, hubOverlayRunning, hubOverlayServices, hubPort, probeEndpoint, stackOwnedElsewhere, stackServices, } from "./stack.js";
+import { probeRegistryToken, REGISTRY_LOGIN_FIX } from "../../utils/auth-preflight.js";
+import { ensureHubAuthImage, ensureHubImages, hasRegistryAuth, localHubVersion, planWithHubRefresh, } from "./hub-local.js";
+import { reconcileRegistryFromZitadel } from "./auth-provision.js";
+import { LOCAL_AWS_CONFIG, localAwsEnv, seedLocalPlatform, verifyFabric } from "./seed.js";
+import { LOGIN_CONTEXT, readHubAuth, seedZitadel, TEST_USERS } from "./seed-zitadel.js";
+const WAIT_TIMEOUT_MS = 180_000;
+const WAIT_POLL_MS = 3_000;
+/** The one crash message, so both wait loops stay on the same remediation. */
+function crashError(crashed) {
+    return new MeshCliError(`Service(s) exited during startup: ${crashed.map((s) => s.name).join(", ")}`, {
+        remediation: {
+            command: `docker compose -p ${COMPOSE_PROJECT} logs ${crashed[0].name}`,
+        },
+    });
+}
+export async function waitForStack(io = {
+    probe: probeEndpoint,
+    services: stackServices,
+    overlayServices: hubOverlayServices,
+}) {
+    const deadline = Date.now() + WAIT_TIMEOUT_MS;
+    let pending = STACK_ENDPOINTS.filter((e) => e.probe.kind !== "none");
+    while (true) {
+        const results = await Promise.all(pending.map((e) => io.probe(e)));
+        const stillDown = [];
+        for (let i = 0; i < pending.length; i++) {
+            if (results[i]) {
+                logSuccess(`${pending[i].label} is up (${pending[i].url})`);
+            }
+            else {
+                stillDown.push(pending[i]);
+            }
+        }
+        pending = stillDown;
+        // Surface hard failures on EVERY round, including the one that would end
+        // the wait: not every container has a STACK_ENDPOINTS entry, so with all
+        // probes answering first try an endpoint-less service (blackbox-exporter,
+        // temporal-admin-tools) could exit during startup unseen.
+        // The Hub overlay has not been brought up yet (that happens after the
+        // seed, below), so its containers are excluded — an `exited` hub-api
+        // here is a leftover from a previous run, not this run's crash.
+        const crashed = crashedServices(io.services(), {
+            overlayServices: io.overlayServices(),
+            overlayStarted: false,
+        });
+        if (crashed.length > 0)
+            throw crashError(crashed);
+        if (pending.length === 0)
+            break;
+        if (Date.now() > deadline) {
+            throw new MeshCliError(`Timed out waiting for: ${pending.map((e) => e.label).join(", ")}`, { remediation: { command: "mesh status" } });
+        }
+        logInfo(`Waiting for ${pending.map((e) => e.label).join(", ")} …`);
+        await new Promise((resolve) => setTimeout(resolve, WAIT_POLL_MS));
+    }
+}
+function printEndpoints(hubRunning) {
+    console.log("");
+    if (hubRunning) {
+        // The Hub is the front door — the same operations dashboard customers
+        // use against the hosted platform. Everything else is plumbing.
+        console.log(chalk.bold.cyan("★ Mesh Hub — your operations dashboard (start here)"));
+        console.log(`  ${"Hub UI".padEnd(34)} ${chalk.bold.cyan(`http://localhost:${hubPort()}`)}`);
+        console.log(`  ${"".padEnd(34)} ${chalk.dim("sign in: admin@local.mesh or dev@local.mesh / LocalDev1!")}`);
+        console.log(`  ${"Hub API".padEnd(34)} ${chalk.cyan("http://localhost:4568")}`);
+        console.log(`  ${"".padEnd(34)} ${chalk.dim("tenants, apps, workflows, logs, traces — local runs self-register here")}`);
+    }
+    else {
+        logWarn("Hub is not running — it is the platform's front door. Enable it with:");
+        logInfo(`  ${REGISTRY_LOGIN_FIX}   (one-time, to build the Hub images — no AWS account needed)`);
+        logInfo("  mesh start                                (the Hub joins automatically)");
+    }
+    console.log("");
+    console.log(chalk.bold("Local platform endpoints"));
+    for (const endpoint of STACK_ENDPOINTS) {
+        console.log(`  ${endpoint.label.padEnd(34)} ${chalk.cyan(endpoint.url)}`);
+        if (endpoint.hint) {
+            console.log(`  ${"".padEnd(34)} ${chalk.dim(endpoint.hint)}`);
+        }
+    }
+    console.log("");
+    console.log(chalk.bold("AWS SDK wiring (local fabric)"));
+    console.log(chalk.dim("  Point any AWS SDK process at the local registry — no code changes:"));
+    for (const [key, value] of Object.entries(localAwsEnv())) {
+        console.log(`  export ${key}=${chalk.cyan(value)}`);
+    }
+    console.log("");
+    console.log(chalk.bold("Login"));
+    console.log(`  mesh login ${LOGIN_CONTEXT}`);
+    console.log(`  ${chalk.dim(`test users: ${TEST_USERS.map((u) => u.email).join(", ")} (password: ${TEST_USERS[0].password})`)}`);
+    console.log("");
+    logInfo("Next: `mesh dev` in an apps repo wires services to this stack automatically.");
+}
+export function registerLocalCommands(program) {
+    program
+        .command("start")
+        .description("Start the full-local Mesh platform (Docker only — no AWS, no VPN)")
+        .option("--no-seed", "skip first-boot seeding (tenant registry, artifacts bucket)")
+        .option("--no-hub", "start without the Hub (API + UI)")
+        .option("--with-hub", "force-refresh the Hub to the latest published @mesh-tech/hub (the Hub is included by default when its images exist or registry auth is available)")
+        .option("--takeover", "re-own a stack that another checkout started (may recreate shared containers with THIS checkout's config)", false)
+        .action(async (opts) => {
+        ensureDockerAvailable();
+        // The stack is machine-wide; a `start` from a checkout whose compose
+        // config differs recreates shared containers out from under whatever
+        // is running against them (another project's `mesh dev` session, a
+        // Hub under development, …). Tenant/app work never needs `start`
+        // against an already-running stack — `mesh dev --local` deploys
+        // tenant-scoped only.
+        const foreign = stackOwnedElsewhere();
+        if (foreign && !opts.takeover) {
+            throw new MeshCliError(`The local platform is already running, started from a different checkout:\n  ${foreign}\n` +
+                `Re-running start from here may recreate shared containers with this checkout's config and disrupt work using the current stack.`, {
+                remediation: {
+                    command: "mesh status              # inspect the running stack (apps deploy tenant-scoped via `mesh dev --local`)\n" +
+                        "  mesh start --takeover    # intentionally re-own the stack from this checkout",
+                },
+            });
+        }
+        if (foreign && opts.takeover) {
+            logWarn(`Taking over the running stack (previously driven from ${foreign}).`);
+        }
+        // The Hub is the platform's front door, so it's part of the default
+        // stack: use already-built images when present; build from the
+        // published tarball when registry auth allows; otherwise start
+        // without it and say exactly how to enable it. --with-hub forces a
+        // registry resolve (picks up newly published hub versions).
+        let hubVersion;
+        if (opts.hub) {
+            if (opts.withHub) {
+                // Auth preflight (MESH-2479): the tarball fetch + image build run
+                // for minutes — verify the CodeArtifact token BEFORE that work.
+                // Only a refresh needs the registry: with already-built images a
+                // bad token degrades to them instead of failing an offline path.
+                const probe = await probeRegistryToken();
+                const plan = planWithHubRefresh(probe.state, localHubVersion());
+                if (plan.action === "fail") {
+                    throw new MeshCliError(plan.message, { remediation: { command: plan.remediation } });
+                }
+                if (plan.action === "use-local") {
+                    logWarn(plan.warning);
+                    hubVersion = plan.version;
+                }
+                else {
+                    hubVersion = await ensureHubImages();
+                }
+            }
+            else {
+                hubVersion = localHubVersion();
+                if (!hubVersion && hasRegistryAuth()) {
+                    const probe = await probeRegistryToken();
+                    if (probe.state === "expired") {
+                        // Keep `mesh start`'s Docker-only promise: degrade to a
+                        // hub-less stack, but say exactly how to get the Hub back.
+                        logWarn(`CodeArtifact token is expired — starting without the Hub. Fix: ${REGISTRY_LOGIN_FIX}, then: mesh start --with-hub`);
+                    }
+                    else {
+                        try {
+                            hubVersion = await ensureHubImages();
+                        }
+                        catch (err) {
+                            logWarn(`Hub image build failed (${err instanceof Error ? err.message : err}) — starting without the Hub.`);
+                        }
+                    }
+                }
+            }
+        }
+        logInfo("Starting the local Mesh platform (docker compose project: mesh-local)…");
+        // Base stack first; the Hub joins AFTER seeding so its oauth2-proxy
+        // gets the seeded client credentials and hub-api never caches a
+        // pre-seed (empty) registry view.
+        await composeStreamed(["up", "-d"]);
+        // Deterministic cache bust for the bind-mounted observability configs:
+        // `up -d` only recreates a container whose compose spec changed, and
+        // Prometheus re-reads prometheus.yml on restart/SIGHUP only. A CLI
+        // upgrade that edits observability/*.yml would otherwise leave a
+        // running stack on the OLD scrape config (and blackbox on old modules)
+        // — silently, since a misrouted probe just reports probe_success 0.
+        compose(["restart", "prometheus", "blackbox-exporter"], { inherit: true });
+        await waitForStack();
+        let hubAuth = readHubAuth();
+        if (opts.seed) {
+            logInfo("Seeding local platform (tenant registry, artifacts bucket)…");
+            await seedLocalPlatform();
+            logInfo("Seeding Zitadel (Platform project, Mesh CLI app, Hub auth, test users)…");
+            const zitadel = await seedZitadel(LOCAL_AWS_CONFIG);
+            hubAuth = zitadel.hubAuth;
+            // Zitadel is the auth source of truth — mirror every provisioned
+            // app tenant/app into the registry so the Hub shows them even if
+            // the app hasn't been run since it was provisioned.
+            try {
+                const reconciled = await reconcileRegistryFromZitadel();
+                if (reconciled.tenants.length > 0) {
+                    logSuccess(`Hub registry reconciled from Zitadel: ${reconciled.tenants.length} app tenant(s) (${reconciled.tenants.join(", ")}), ${reconciled.apps} app(s)`);
+                }
+            }
+            catch (err) {
+                logWarn(`Registry reconcile skipped: ${err instanceof Error ? err.message : err}`);
+            }
+            logInfo("Verifying the local AWS fabric (8 KB Advanced-tier round-trip)…");
+            await verifyFabric();
+        }
+        else {
+            logWarn("Skipping seed (--no-seed).");
+        }
+        if (hubVersion) {
+            if (!hubAuth) {
+                logWarn("Hub auth is not seeded yet (started with --no-seed?) — Hub sign-in needs one seeded run: mesh start");
+            }
+            // The redirect URI for a non-default port is registered during
+            // seeding (reconcileHubRedirectUris) — skipping the seed with a new
+            // port reproduces the "redirect_uri is missing in the client
+            // configuration" login failure.
+            if (!opts.seed && hubPort() !== DEFAULT_HUB_PORT) {
+                logWarn(`--no-seed with MESH_HUB_PORT=${hubPort()}: this port's redirect URI is registered during seeding — if Hub sign-in fails with "redirect_uri is missing in the client configuration", re-run without --no-seed.`);
+            }
+            ensureHubAuthImage();
+            const hubEnv = { MESH_HUB_VERSION: hubVersion };
+            if (hubAuth) {
+                hubEnv.MESH_HUB_OAUTH2_CLIENT_ID = hubAuth.clientId;
+                hubEnv.MESH_HUB_OAUTH2_CLIENT_SECRET = hubAuth.clientSecret;
+                hubEnv.MESH_HUB_OAUTH2_COOKIE_SECRET = hubAuth.cookieSecret;
+            }
+            await composeStreamed(["up", "-d"], { hub: true, env: hubEnv });
+            if (opts.seed) {
+                // Deterministic cache bust: hub-api holds its tenants view for 5
+                // minutes and this run's seed/reconcile may have changed it.
+                compose(["restart", "hub-api"], { hub: true, env: hubEnv });
+            }
+            // From here the overlay HAS been started, so an exited hub service is
+            // a real crash again — same message, same remediation as the base
+            // stack's. (Without this the loop would spin out its 60 attempts and
+            // then claim the endpoint was up.)
+            const overlayServices = hubOverlayServices();
+            for (const endpoint of hubEndpoints()) {
+                logInfo(`Waiting for ${endpoint.label}…`);
+                let up = await probeEndpoint(endpoint);
+                for (let i = 0; i < 60 && !up; i++) {
+                    const crashed = crashedServices(stackServices(), {
+                        overlayServices,
+                        overlayStarted: true,
+                    });
+                    if (crashed.length > 0)
+                        throw crashError(crashed);
+                    await new Promise((resolve) => setTimeout(resolve, 2000));
+                    up = await probeEndpoint(endpoint);
+                }
+                if (!up) {
+                    throw new MeshCliError(`Timed out waiting for ${endpoint.label} (${endpoint.url}).`, {
+                        remediation: {
+                            command: `docker compose -p ${COMPOSE_PROJECT} logs ${endpoint.service}`,
+                        },
+                    });
+                }
+                logSuccess(`${endpoint.label} is up (${endpoint.url})`);
+            }
+        }
+        logSuccess("Local Mesh platform is running.");
+        printEndpoints(!!hubVersion);
+    });
+    program
+        .command("stop")
+        .description("Stop the local Mesh platform")
+        .option("--destroy", "also remove volumes (resets databases and seeds)", false)
+        .option("--force", "stop even when the stack was started from a different checkout", false)
+        .action((opts) => {
+        ensureDockerAvailable();
+        const foreign = stackOwnedElsewhere();
+        if (foreign && !opts.force) {
+            throw new MeshCliError(`The running local platform was started from a different checkout (${foreign}) — another project may be using it.`, { remediation: { command: "mesh stop --force   # stop it anyway" } });
+        }
+        const args = ["down"];
+        if (opts.destroy)
+            args.push("-v");
+        compose(args, { inherit: true, hub: true });
+        logSuccess(opts.destroy ? "Local platform stopped and volumes destroyed." : "Local platform stopped.");
+    });
+    program
+        .command("status")
+        .description("Show local platform component health, endpoints, and ports")
+        .option("--json", "machine-readable output", false)
+        .action(async (opts) => {
+        ensureDockerAvailable();
+        const services = stackServices();
+        if (services.length === 0) {
+            if (opts.json) {
+                console.log(JSON.stringify({ running: false, services: [], endpoints: [] }));
+                return;
+            }
+            throw new MeshCliError("The local Mesh platform is not running.", {
+                remediation: { command: "mesh start" },
+            });
+        }
+        // `status` never started anything, so "is the Hub overlay part of this
+        // run?" can only be read off the containers: at least one overlay
+        // service actually running. Everything Hub-related keys off that — an
+        // overlay container left `exited` by a previous run (a Docker restart,
+        // a laptop sleep) is "not started", not "crashed".
+        const overlayServices = hubOverlayServices();
+        const overlayStarted = hubOverlayRunning(services, overlayServices);
+        const notStarted = (s) => !overlayStarted && overlayServices.has(s.name) && s.state === "exited";
+        // A *running* hub-api, not merely a hub-api container: a leftover
+        // exited one from a previous run would otherwise make status probe Hub
+        // endpoints that were never meant to be up and report them down.
+        const hasHub = hubApiRunning(services);
+        const endpoints = hasHub ? [...STACK_ENDPOINTS, ...hubEndpoints()] : STACK_ENDPOINTS;
+        const probes = await Promise.all(endpoints.map(async (endpoint) => ({
+            service: endpoint.service,
+            label: endpoint.label,
+            url: endpoint.url,
+            up: await probeEndpoint(endpoint),
+        })));
+        // The P0 gate: with the fabric up, the 8 KB Advanced-tier round-trip
+        // must pass on every status check, not just at seed time.
+        let fabric = null;
+        if (probes.find((p) => p.service === "ministack")?.up) {
+            try {
+                await verifyFabric();
+                fabric = { ok: true };
+            }
+            catch (err) {
+                fabric = { ok: false, error: err instanceof Error ? err.message : String(err) };
+            }
+        }
+        if (opts.json) {
+            console.log(JSON.stringify({
+                running: true,
+                services,
+                endpoints: probes,
+                fabric,
+                awsEnv: localAwsEnv(),
+            }));
+            if (fabric && !fabric.ok)
+                process.exitCode = 1;
+            return;
+        }
+        console.log(chalk.bold("Containers"));
+        for (const service of services) {
+            const ok = service.state === "running" &&
+                (service.health === undefined || service.health === "healthy");
+            const oneShotDone = ONE_SHOT_SERVICES.has(service.name) && service.state === "exited";
+            const idle = notStarted(service);
+            const icon = ok || oneShotDone ? chalk.green("●") : idle ? chalk.dim("○") : chalk.red("●");
+            const health = service.health ? ` (${service.health})` : "";
+            const note = idle ? chalk.dim("  (Hub not started this run)") : "";
+            console.log(`  ${icon} ${service.name.padEnd(22)} ${service.state}${health}${note}`);
+        }
+        console.log("");
+        console.log(chalk.bold("Endpoints"));
+        for (const probe of probes) {
+            const icon = probe.up ? chalk.green("●") : chalk.red("●");
+            console.log(`  ${icon} ${probe.label.padEnd(34)} ${chalk.cyan(probe.url)}`);
+        }
+        if (fabric) {
+            const icon = fabric.ok ? chalk.green("●") : chalk.red("●");
+            const detail = fabric.ok ? "8 KB Advanced-tier round-trip OK" : fabric.error;
+            console.log(`  ${icon} ${"AWS fabric check".padEnd(34)} ${chalk.dim(detail ?? "")}`);
+        }
+        const down = probes.filter((p) => !p.up);
+        const crashed = crashedServices(services, { overlayServices, overlayStarted });
+        if (fabric && !fabric.ok)
+            process.exitCode = 1;
+        if (down.length > 0 || crashed.length > 0) {
+            console.log("");
+            logError(`${down.length + crashed.length} component(s) unhealthy — inspect with: docker compose -p mesh-local logs <service>`);
+            process.exitCode = 1;
+        }
+    });
+}
+//# sourceMappingURL=index.js.map