@mesh-tech/mesh-cli 0.1.0 → 0.12.0

package/dist/src/commands/vpn/tunnel.js

@@ -0,0 +1,188 @@
+/**
+ * `mesh vpn tunnel` — userspace-Tailscale tunnels to a tenant's VPC services.
+ *
+ * Stands up the tenant's `localhost:PORT` set (drop-in for the SSM tunnels)
+ * backed by a per-tenant userspace `tailscaled` + SOCKS5 forwarders. Detached
+ * and managed: `up` starts everything and returns; `down`/`status` manage it.
+ * (MESH-2040 / Slice 1 of MESH-2014; graduates the MESH-2036 spike.)
+ */
+import * as net from "node:net";
+import { logInfo, logError, logSuccess } from "../../utils/log.js";
+import { getContextConfig } from "../login.js";
+import { ensureTailscaleTunnels, stopDaemon, logout, daemonState, readTunnelState, clearTunnelState, readDaemonMeta, runTunnels, stopTunnelRunners, verifyTunnelOwnership, } from "../../utils/tailscale.js";
+/**
+ * Derive the Headscale login-server URL from the login context's issuer
+ * (`identity.<env>.<domain>` → `vpn.<env>.<domain>`). Mirrors
+ * `vpnEndpointFromContext` in index.ts (kept local to avoid a circular import;
+ * Slice 2 can unify).
+ */
+function deriveLoginServer(context) {
+    const cfg = getContextConfig(context);
+    if (!cfg?.issuer) {
+        throw new Error(`No login config for context '${context}'. Run: mesh login ${context}`);
+    }
+    const u = new URL(cfg.issuer);
+    const parts = u.hostname.split(".");
+    parts[0] = "vpn";
+    return `https://${parts.join(".")}`;
+}
+function findFreePort() {
+    return new Promise((resolve, reject) => {
+        const s = net.createServer();
+        s.on("error", reject);
+        s.listen(0, "127.0.0.1", () => {
+            const port = s.address().port;
+            s.close(() => resolve(port));
+        });
+    });
+}
+function canConnect(port) {
+    return new Promise((resolve) => {
+        const s = new net.Socket();
+        let settled = false;
+        const done = (ok) => {
+            if (settled)
+                return;
+            settled = true;
+            s.destroy();
+            resolve(ok);
+        };
+        s.setTimeout(500);
+        s.once("connect", () => done(true));
+        s.once("timeout", () => done(false));
+        s.once("error", () => done(false));
+        s.connect(port, "127.0.0.1");
+    });
+}
+// ── up ──────────────────────────────────────────────────────────────────────
+async function tunnelUp(vpn, cmdOpts) {
+    const { tenant, env } = vpn;
+    const context = cmdOpts.context ?? `${tenant}.${env}`;
+    const region = process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? "us-east-2";
+    const loginServer = deriveLoginServer(context);
+    const prior = readTunnelState(tenant);
+    const daemonUp = daemonState(tenant).backendState !== "Down";
+    // When the daemon is already up, reuse the SOCKS port IT is listening on
+    // (from daemon.json, which `down` doesn't clear) — not `prior` (cleared by
+    // `down`) and never a fresh port the daemon isn't bound to.
+    const socksPort = daemonUp
+        ? (readDaemonMeta(tenant)?.socksPort ?? prior?.socksPort ?? (await findFreePort()))
+        : await findFreePort();
+    logInfo(`Bringing up userspace VPN tunnels for tenant '${tenant}'...`);
+    const targets = await ensureTailscaleTunnels(tenant, env, { region, loginServer, socksPort });
+    logSuccess(`VPN tunnels up for '${tenant}' (${targets.length}):`);
+    for (const t of targets) {
+        logInfo(`  ${t.name.padEnd(14)} 127.0.0.1:${t.localPort}  →  ${t.targetHost}:${t.remotePort}`);
+    }
+}
+// The __run / __supervise runner lives in utils/tailscale.ts (runTunnels) —
+// forwarders + a continuous self-heal loop, used under launchd or detached.
+// ── down ────────────────────────────────────────────────────────────────────
+function tunnelDown(vpn, cmdOpts) {
+    const { tenant } = vpn;
+    const st = readTunnelState(tenant);
+    // Nothing to tear down for the forwarders — but still honor an explicit
+    // --stop/--logout so a leaked daemon (state file already gone) can be killed.
+    if (!st && !cmdOpts.stop && !cmdOpts.logout) {
+        logInfo(`No tunnels running for tenant '${tenant}'.`);
+        return;
+    }
+    // One teardown path for every runner shape (state pid group, launchd agent,
+    // manifest process group, argv-discovered strays) — no kill path may leave a
+    // grandchild with ports still bound (MESH-2407).
+    stopTunnelRunners(tenant, st);
+    if (cmdOpts.logout) {
+        logout(tenant);
+        logInfo("Logged the VPN daemon out of Headscale.");
+    }
+    // By default the daemon persists (join-once / reuse). --stop or --logout
+    // (after which the daemon is useless) tear it down too.
+    if (cmdOpts.stop || cmdOpts.logout) {
+        stopDaemon(tenant);
+        logInfo("Stopped the userspace VPN daemon.");
+    }
+    clearTunnelState(tenant);
+    logSuccess(`VPN tunnels down for '${tenant}'.`);
+}
+// ── status ────────────────────────────────────────────────────────────────────
+async function tunnelStatus(vpn, cmdOpts) {
+    const { tenant } = vpn;
+    const st = readTunnelState(tenant);
+    const ds = daemonState(tenant);
+    // Ownership handshake against the runner's manifest — status must distinguish
+    // "our runner owns the ports" from "something answers the port" (MESH-2407).
+    const owned = st
+        ? await verifyTunnelOwnership(tenant, {
+            socksPort: st.socksPort,
+            ports: st.tunnels.map((t) => t.localPort),
+        })
+        : null;
+    if (cmdOpts.json) {
+        console.log(JSON.stringify({
+            tenant,
+            daemon: ds,
+            up: !!st,
+            managed: st?.managed ?? null,
+            owned: owned?.ok ?? false,
+            ownership: owned ? (owned.ok ? "owned" : owned.reason) : "no-state",
+            tunnels: st?.tunnels ?? [],
+        }, null, 2));
+        return;
+    }
+    logInfo(`Daemon: ${ds.backendState}${ds.selfName ? ` (${ds.selfName})` : ""}`);
+    if (!st) {
+        logInfo(`No tunnels running for tenant '${tenant}'.`);
+        return;
+    }
+    logInfo(`Managed: ${st.managed ?? "detached"}`);
+    logInfo(owned?.ok
+        ? `Runner: owned (verified)`
+        : `Runner: NOT OWNED (${owned?.reason}) — ports below may be foreign listeners`);
+    const listening = owned?.ok ? new Set(owned.resp?.listening ?? []) : null;
+    for (const t of st.tunnels) {
+        // When ownership holds, report from the runner's in-process listening set
+        // (no data-plane dial); otherwise fall back to a dial, flagged above.
+        const up = listening ? listening.has(t.localPort) : await canConnect(t.localPort);
+        logInfo(`  ${up ? "✓" : "✗"} ${t.name.padEnd(14)} 127.0.0.1:${t.localPort}  →  ${t.targetHost}:${t.remotePort}`);
+    }
+}
+// ── registration ──────────────────────────────────────────────────────────────
+/** Run an action, printing a clean error (not a stack trace) + exit 1 on failure. */
+async function guard(fn) {
+    try {
+        await fn();
+    }
+    catch (e) {
+        logError(e instanceof Error ? e.message : String(e));
+        process.exit(1);
+    }
+}
+export function registerTunnelSubcommands(vpn) {
+    const tunnel = vpn
+        .command("tunnel")
+        .description("Userspace-Tailscale tunnels to VPC services (localhost:PORT set)");
+    tunnel
+        .command("up", { isDefault: true })
+        .description("Start the tenant's VPC tunnels over userspace Tailscale")
+        .option("--context <ctx>", "Login context for the VPN (default: <tenant>.<env>)")
+        .action((cmdOpts) => guard(() => tunnelUp(vpn.opts(), cmdOpts)));
+    tunnel
+        .command("down")
+        .description("Stop the tenant's VPC tunnels")
+        .option("--stop", "Also stop the userspace tailscaled daemon (keeps VPN login)")
+        .option("--logout", "Log the daemon out of Headscale and stop it")
+        .action((cmdOpts) => guard(() => tunnelDown(vpn.opts(), cmdOpts)));
+    tunnel
+        .command("status")
+        .description("Show daemon + tunnel status")
+        .option("--json", "Machine-readable output")
+        .action((cmdOpts) => guard(() => tunnelStatus(vpn.opts(), cmdOpts)));
+    tunnel
+        .command("__run <tenant>", { hidden: true })
+        .action((tenant) => runTunnels(tenant));
+    // Back-compat alias for any launchd/detached runner referencing the old name.
+    tunnel
+        .command("__supervise <tenant>", { hidden: true })
+        .action((tenant) => runTunnels(tenant));
+}
+//# sourceMappingURL=tunnel.js.map

package/dist/src/commands/vpn/tunnel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnel.js","sourceRoot":"","sources":["../../../../src/commands/vpn/tunnel.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,sBAAsB,EACtB,UAAU,EACV,MAAM,EACN,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAOlC;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACxC,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,OAAO,sBAAsB,OAAO,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;IACjB,OAAO,WAAW,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QAC7B,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtB,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YAC5B,MAAM,IAAI,GAAI,CAAC,CAAC,OAAO,EAAsB,CAAC,IAAI,CAAC;YACnD,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,EAAW,EAAE,EAAE;YAC3B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,CAAC,CAAC,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,EAAE,CAAC,CAAC;QACd,CAAC,CAAC;QACF,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACnC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAE/E,KAAK,UAAU,QAAQ,CAAC,GAAY,EAAE,OAA6B;IACjE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC;IACtD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,WAAW,CAAC;IACvF,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAE/C,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC;IAC7D,yEAAyE;IACzE,2EAA2E;IAC3E,4DAA4D;IAC5D,MAAM,SAAS,GAAG,QAAQ;QACxB,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,SAAS,IAAI,KAAK,EAAE,SAAS,IAAI,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC;QACnF,CAAC,CAAC,MAAM,YAAY,EAAE,CAAC;IAEzB,OAAO,CAAC,iDAAiD,MAAM,MAAM,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;IAE9F,UAAU,CAAC,uBAAuB,MAAM,MAAM,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;IAClE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,SAAS,QAAQ,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,4EAA4E;AAE5E,+EAA+E;AAE/E,SAAS,UAAU,CAAC,GAAY,EAAE,OAA6C;IAC7E,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IACvB,MAAM,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACnC,wEAAwE;IACxE,8EAA8E;IAC9E,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QAC5C,OAAO,CAAC,kCAAkC,MAAM,IAAI,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,iDAAiD;IACjD,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,CAAC,MAAM,CAAC,CAAC;QACf,OAAO,CAAC,yCAAyC,CAAC,CAAC;IACrD,CAAC;IACD,yEAAyE;IACzE,wDAAwD;IACxD,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnC,UAAU,CAAC,MAAM,CAAC,CAAC;QACnB,OAAO,CAAC,mCAAmC,CAAC,CAAC;IAC/C,CAAC;IACD,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,UAAU,CAAC,yBAAyB,MAAM,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,iFAAiF;AAEjF,KAAK,UAAU,YAAY,CAAC,GAAY,EAAE,OAA2B;IACnE,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IACvB,MAAM,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/B,8EAA8E;IAC9E,6EAA6E;IAC7E,MAAM,KAAK,GAAG,EAAE;QACd,CAAC,CAAC,MAAM,qBAAqB,CAAC,MAAM,EAAE;YAClC,SAAS,EAAE,EAAE,CAAC,SAAS;YACvB,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;SAC1C,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;YACE,MAAM;YACN,MAAM,EAAE,EAAE;YACV,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,OAAO,EAAE,EAAE,EAAE,OAAO,IAAI,IAAI;YAC5B,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,KAAK;YACzB,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU;YACnE,OAAO,EAAE,EAAE,EAAE,OAAO,IAAI,EAAE;SAC3B,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;QACF,OAAO;IACT,CAAC;IACD,OAAO,CAAC,WAAW,EAAE,CAAC,YAAY,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,CAAC,kCAAkC,MAAM,IAAI,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IACD,OAAO,CAAC,YAAY,EAAE,CAAC,OAAO,IAAI,UAAU,EAAE,CAAC,CAAC;IAChD,OAAO,CACL,KAAK,EAAE,EAAE;QACP,CAAC,CAAC,0BAA0B;QAC5B,CAAC,CAAC,sBAAsB,KAAK,EAAE,MAAM,0CAA0C,CAClF,CAAC;IACF,MAAM,SAAS,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;QAC3B,0EAA0E;QAC1E,sEAAsE;QACtE,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAClF,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,SAAS,QAAQ,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACnH,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,qFAAqF;AACrF,KAAK,UAAU,KAAK,CAAC,EAA8B;IACjD,IAAI,CAAC;QACH,MAAM,EAAE,EAAE,CAAC;IACb,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,GAAY;IACpD,MAAM,MAAM,GAAG,GAAG;SACf,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,kEAAkE,CAAC,CAAC;IAEnF,MAAM;SACH,OAAO,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;SAClC,WAAW,CAAC,yDAAyD,CAAC;SACtE,MAAM,CAAC,iBAAiB,EAAE,qDAAqD,CAAC;SAChF,MAAM,CAAC,CAAC,OAA6B,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAa,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAEpG,MAAM;SACH,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,+BAA+B,CAAC;SAC5C,MAAM,CAAC,QAAQ,EAAE,6DAA6D,CAAC;SAC/E,MAAM,CAAC,UAAU,EAAE,6CAA6C,CAAC;SACjE,MAAM,CAAC,CAAC,OAA6C,EAAE,EAAE,CACxD,KAAK,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAa,EAAE,OAAO,CAAC,CAAC,CACxD,CAAC;IAEJ,MAAM;SACH,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,6BAA6B,CAAC;SAC1C,MAAM,CAAC,QAAQ,EAAE,yBAAyB,CAAC;SAC3C,MAAM,CAAC,CAAC,OAA2B,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAa,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAEtG,MAAM;SACH,OAAO,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SAC3C,MAAM,CAAC,CAAC,MAAc,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAElD,8EAA8E;IAC9E,MAAM;SACH,OAAO,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SACjD,MAAM,CAAC,CAAC,MAAc,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACpD,CAAC"}

package/dist/src/commands/workflow.d.ts

@@ -0,0 +1,24 @@
+/**
+ * mesh workflow — workflow tooling commands
+ *
+ * Commands:
+ *   mesh workflow extract-ir <path>       Extract WorkflowIR from Temporal workflow source
+ *   mesh workflow inventory <path>        Extract the as-built command/query/activity inventory
+ *   mesh workflow lint-process <path>     Lint a process artifact's bindings against the code inventory
+ *
+ * Examples:
+ *   # Extract and print to stdout
+ *   mesh workflow extract-ir apps/ops/worker/src/workflows/
+ *
+ *   # Extract and upload to S3
+ *   mesh workflow extract-ir apps/ops/worker/src/workflows/ --app ops --upload mesh-trabian-dev-artifacts
+ *
+ *   # Print the as-built inventory (lint's code-side input)
+ *   mesh workflow inventory apps/ops/worker/src/workflows/workflows.ts
+ *
+ *   # Lint a process artifact (conformance) — sibling process/*.process.json auto-discovered
+ *   mesh workflow lint-process apps/ops/worker/src/workflows.ts --predicates engagementComplete,accountNumbersComplete
+ */
+import { Command } from "commander";
+export declare function registerWorkflowCommands(program: Command): void;
+//# sourceMappingURL=workflow.d.ts.map

package/dist/src/commands/workflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../../src/commands/workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAmZpC,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAqR/D"}