@mesh-tech/mesh-cli 0.1.0 → 0.12.0

package/dist/src/commands/cluster.js

@@ -0,0 +1,259 @@
+/**
+ * mesh cluster access — `mesh kubectl` / `mesh logs` / `mesh exec` against a
+ * deployed app's EKS cluster, authenticated as the app's Zitadel deployer role
+ * (MESH-2060).
+ *
+ * Reuses exactly what `mesh dev` already does internally: assume the app's
+ * deployer role, build a session kubeconfig from the platform `eks` SSM export
+ * (`aws eks get-token` — needs neither `eks:DescribeCluster` nor a readable
+ * `~/.kube/config`, which macOS TCC blocks for non-FDA shells), and shell out to
+ * kubectl with `KUBECONFIG` set.
+ *
+ * The deployer role's cluster RBAC is namespace-scoped to the tenant's
+ * namespaces (verified live: the `<tenant>-<env>-deployers` group grants
+ * pods/log/exec read in the app's namespace), so every command defaults to the
+ * app's own namespace and callers can still `-n <other>` within the tenant.
+ */
+import { spawnSync } from "node:child_process";
+import { logError, logInfo } from "../utils/log.js";
+import { findAppRoot, findStackConfigs, getCurrentStack, pulumiStackOutput, readStackConfig, } from "../utils/pulumi.js";
+import { resolveAwsCredentials, derivePlatformContext } from "../utils/aws-auth.js";
+import { ensureKubeconfig, resolveHubPlatformName, } from "../utils/kubeconfig.js";
+import { probeCredentials } from "./login.js";
+import { credProbeToPreflightError } from "../utils/pulumi-run.js";
+/**
+ * Assume the app's deployer role, resolve the deployed app's platform env +
+ * namespace from stack output, and materialize a session kubeconfig. Throws with
+ * an actionable message on any failure (missing app dir, unresolved creds,
+ * undeployed stack, unresolvable cluster).
+ */
+async function resolveClusterAccess(opts) {
+    const appRoot = findAppRoot(process.cwd());
+    if (!appRoot) {
+        throw new Error("Not in a Mesh app directory (no Pulumi.yaml found). Run from an app directory.");
+    }
+    const stack = opts.stack ?? getCurrentStack(appRoot);
+    if (!stack) {
+        const stacks = findStackConfigs(appRoot);
+        throw new Error("No Pulumi stack selected.\n" +
+            (stacks.length > 0
+                ? `Available: ${stacks.join(", ")}\nUse --stack <name> (the deployed stack, e.g. dev).`
+                : "No stack configs found in this directory."));
+    }
+    const sa = ["--stack", stack];
+    // Assume the app's deployer role — same path as `mesh dev` / `mesh temporal`.
+    const deployerRole = readStackConfig(appRoot, stack, "mesh:deployerRole");
+    const ctx = derivePlatformContext(appRoot, stack);
+    const resolved = deployerRole
+        ? await resolveAwsCredentials(deployerRole, appRoot, stack)
+        : null;
+    // Login preflight: name the credential problem up front instead of failing
+    // deep inside the kubectl `aws eks get-token` exec plugin.
+    if (deployerRole && !resolved && !process.env.AWS_ACCESS_KEY_ID) {
+        const pf = ctx
+            ? credProbeToPreflightError(await probeCredentials(ctx, deployerRole), ctx)
+            : null;
+        throw new Error(pf?.message ??
+            `Couldn't resolve AWS credentials. Run: mesh login ${ctx ?? "mesh.dev"} --device`);
+    }
+    const awsEnv = resolved?.env;
+    const region = readStackConfig(appRoot, stack, "aws:region");
+    if (awsEnv && region && !awsEnv.AWS_REGION)
+        awsEnv.AWS_REGION = region;
+    // Thread the resolved creds into this process so ensureKubeconfig's SSM read
+    // and the kubectl `aws eks get-token` exec plugin run credentialed.
+    if (awsEnv)
+        Object.assign(process.env, awsEnv);
+    // Read the deployed app output for platform env + namespace (mirrors the
+    // reader in `mesh temporal`; the `app` struct's `dev` field is secret-tainted,
+    // and pulumiStackOutput transparently retries with --show-secrets).
+    let appOutput;
+    let devOutput;
+    try {
+        appOutput = JSON.parse(pulumiStackOutput(appRoot, "app", sa, awsEnv));
+        devOutput = appOutput.dev ?? appOutput;
+    }
+    catch {
+        try {
+            devOutput = JSON.parse(pulumiStackOutput(appRoot, "dev", sa, awsEnv));
+            appOutput = devOutput;
+        }
+        catch {
+            throw new Error(`Could not read stack output for '${stack}'. Ensure the app is deployed: mesh deploy up`);
+        }
+    }
+    const platformEnv = devOutput?.platform?.env ?? "dev";
+    // The HUB platform name (e.g. "trabian") — cluster data lives under it, not
+    // under a hardcoded "mesh" (MESH-2515). Same axis `mesh dev` uses for the
+    // bastion; "mesh" is only the default hub.
+    const platformName = resolveHubPlatformName(devOutput?.platform);
+    const namespace = appOutput?.namespace ?? devOutput?.namespace;
+    if (!namespace) {
+        throw new Error(`No namespace found in stack output for '${stack}'.`);
+    }
+    // Build a session kubeconfig from the platform eks SSM export. Key the session
+    // file on platformName + platformEnv too, so two apps on DIFFERENT platforms
+    // that share a stack name (e.g. both "dev") don't race on the same kubeconfig
+    // path.
+    let failure;
+    const kubeconfigPath = await ensureKubeconfig(platformName, platformEnv, `mesh-cluster-${platformName}-${platformEnv}-${stack}`, { onError: (f) => (failure = f) });
+    if (!kubeconfigPath) {
+        throw new Error(clusterResolveErrorMessage(platformName, platformEnv, failure));
+    }
+    return { kubeconfigPath, namespace, stack };
+}
+/**
+ * Render the "couldn't resolve the EKS cluster" failure with the parameter
+ * tried and the real exception. The pre-MESH-2515 message guessed "you have
+ * SSM read access" at every failure — which sent three investigations after a
+ * permission that was never missing when the actual cause was the wrong
+ * platform name in the SSM path.
+ */
+export function clusterResolveErrorMessage(platformName, platformEnv, failure) {
+    const parameter = failure?.parameter ?? `/mesh-platform/${platformName}/${platformEnv}/core/eks`;
+    const err = failure?.error;
+    const detail = err instanceof Error
+        ? `${err.name}: ${err.message}`
+        : err !== undefined
+            ? String(err)
+            : "no cluster data returned";
+    return (`Could not resolve the EKS cluster for platform '${platformName}/${platformEnv}' from SSM.\n` +
+        `  Parameter tried: ${parameter}\n` +
+        `  Failure: ${detail}\n` +
+        "If this platform name is wrong, check the app's `mesh:platform` stack config " +
+        "(the hub platform name, e.g. `trabian`) — an AccessDeniedException here usually " +
+        "means the WRONG platform path, not missing SSM permissions.");
+}
+const NS_FLAGS = new Set(["-n", "--namespace", "-A", "--all-namespaces"]);
+/**
+ * Whether the user already scoped the namespace. Deliberately only detects the
+ * split forms (`-n foo`, `--namespace foo`, `--namespace=foo`, `-A`), NOT the
+ * smashed short form `-nfoo`: our default `-n <ns>` is PREPENDED, and kubectl's
+ * pflag lets the later (user-supplied) `-nfoo` win, so a missed detection here is
+ * harmless. Do not "fix" this into an append — that would let our default win
+ * over the user's intent.
+ */
+export function hasNamespaceFlag(args) {
+    return args.some((a) => NS_FLAGS.has(a) || a.startsWith("--namespace="));
+}
+/**
+ * Run kubectl with the session kubeconfig, defaulting the namespace to the app's
+ * own unless the caller already scoped it. Returns the child exit code.
+ */
+function runKubectl(access, args, opts = {}) {
+    const finalArgs = opts.defaultNamespace !== false && !hasNamespaceFlag(args)
+        ? ["-n", access.namespace, ...args]
+        : args;
+    const res = spawnSync("kubectl", finalArgs, {
+        stdio: "inherit",
+        env: { ...process.env, KUBECONFIG: access.kubeconfigPath },
+    });
+    if (res.error) {
+        const e = res.error;
+        if (e.code === "ENOENT") {
+            logError("kubectl not found on PATH. Install kubectl to use mesh cluster commands.");
+        }
+        else {
+            logError(`Failed to run kubectl: ${e.message}`);
+        }
+        return 1;
+    }
+    return res.status ?? 0;
+}
+/**
+ * Translate an ergonomic log/exec target into kubectl selector args.
+ *  - `deployment/x` / `pod/x` (contains `/`) → passed through
+ *  - `k=v` (contains `=`)                    → label selector `-l k=v`
+ *  - bare `<service>`                        → `-l app=<service>` (the reliable
+ *    per-service label; deployment names == service names)
+ */
+export function targetToSelector(target) {
+    if (target.includes("/"))
+        return [target];
+    if (target.includes("="))
+        return ["-l", target];
+    return ["-l", `app=${target}`];
+}
+export function registerClusterCommands(program) {
+    // `mesh kubectl [args…]` — passthrough. Help is delegated to kubectl so
+    // `mesh kubectl get --help` works; run `mesh kubectl` with no args to see it.
+    program
+        .command("kubectl")
+        .description("Run kubectl against the app's cluster (deployer role + SSM kubeconfig)")
+        .option("--stack <stack>", "Deployed Pulumi stack (default: current selection)")
+        .allowUnknownOption(true)
+        // Forward every positional (kubectl subcommand + args) verbatim. Commander
+        // v13 flips the default to ERROR on excess args, so declare it explicitly —
+        // a routine dependency bump must not silently break the passthrough.
+        .allowExcessArguments(true)
+        .helpOption(false)
+        .action(async (opts, cmd) => {
+        try {
+            const access = await resolveClusterAccess({ stack: opts.stack });
+            // Context line to stderr so stdout stays clean for piping.
+            process.stderr.write(`→ kubectl · ns ${access.namespace} · stack ${access.stack}\n`);
+            process.exit(runKubectl(access, cmd.args));
+        }
+        catch (e) {
+            logError(e.message);
+            process.exit(1);
+        }
+    });
+    // `mesh logs [target]` — ergonomic kubectl logs against the app's namespace.
+    program
+        .command("logs [target]")
+        .description("Tail logs from the app's pods (kubectl logs; target = service, deployment/x, or k=v)")
+        .option("--stack <stack>", "Deployed Pulumi stack (default: current selection)")
+        .option("-f, --follow", "Stream new logs")
+        .option("--tail <n>", "Lines from the end of the logs", "200")
+        .option("-c, --container <name>", "Container name")
+        .option("--previous", "Logs from the previous container instance (crash debugging)")
+        .action(async (target, opts) => {
+        try {
+            const access = await resolveClusterAccess({ stack: opts.stack });
+            if (!target) {
+                logInfo(`Which service? Pods in ${access.namespace}:\n` +
+                    "Then: mesh logs <service>  (e.g. mesh logs demo-agent-worker)\n");
+                process.exit(runKubectl(access, ["get", "pods"]));
+            }
+            const kargs = ["logs", ...targetToSelector(target), "--prefix", "--tail", opts.tail ?? "200"];
+            if (opts.follow)
+                kargs.push("-f");
+            if (opts.container)
+                kargs.push("-c", opts.container);
+            if (opts.previous)
+                kargs.push("--previous");
+            process.exit(runKubectl(access, kargs));
+        }
+        catch (e) {
+            logError(e.message);
+            process.exit(1);
+        }
+    });
+    // `mesh exec <target> -- <cmd…>` — exec into one of the app's pods.
+    program
+        .command("exec <target> [cmd...]")
+        .description("Exec a command in the app's pod (kubectl exec; target = service or deployment/x)")
+        .option("--stack <stack>", "Deployed Pulumi stack (default: current selection)")
+        .option("-c, --container <name>", "Container name")
+        .action(async (target, cmdParts, opts) => {
+        try {
+            const access = await resolveClusterAccess({ stack: opts.stack });
+            // exec needs a single pod; a bare service resolves to its deployment.
+            const podRef = target.includes("/") ? target : `deployment/${target}`;
+            const command = cmdParts.length > 0 ? cmdParts : ["sh"];
+            const kargs = ["exec"];
+            kargs.push(process.stdout.isTTY ? "-it" : "-i");
+            kargs.push(podRef);
+            if (opts.container)
+                kargs.push("-c", opts.container);
+            kargs.push("--", ...command);
+            process.exit(runKubectl(access, kargs));
+        }
+        catch (e) {
+            logError(e.message);
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=cluster.js.map

package/dist/src/commands/cluster.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cluster.js","sourceRoot":"","sources":["../../../src/commands/cluster.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,GAEvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAQnE;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CAAC,IAAwB;IAC1D,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,gFAAgF,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,6BAA6B;YAC3B,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;gBAChB,CAAC,CAAC,cAAc,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,sDAAsD;gBACvF,CAAC,CAAC,2CAA2C,CAAC,CACnD,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAE9B,8EAA8E;IAC9E,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,mBAAmB,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,YAAY;QAC3B,CAAC,CAAC,MAAM,qBAAqB,CAAC,YAAY,EAAE,OAAO,EAAE,KAAK,CAAC;QAC3D,CAAC,CAAC,IAAI,CAAC;IACT,2EAA2E;IAC3E,2DAA2D;IAC3D,IAAI,YAAY,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QAChE,MAAM,EAAE,GAAG,GAAG;YACZ,CAAC,CAAC,yBAAyB,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,GAAG,CAAC;YAC3E,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,IAAI,KAAK,CACb,EAAE,EAAE,OAAO;YACT,qDAAqD,GAAG,IAAI,UAAU,WAAW,CACpF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,EAAE,GAAG,CAAC;IAC7B,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IAC7D,IAAI,MAAM,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU;QAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC;IACvE,6EAA6E;IAC7E,oEAAoE;IACpE,IAAI,MAAM;QAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAE/C,yEAAyE;IACzE,+EAA+E;IAC/E,oEAAoE;IACpE,IAAI,SAAkF,CAAC;IACvF,IAAI,SAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QACtE,SAAS,GAAG,SAAS,CAAC,GAAG,IAAI,SAAS,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;YACtE,SAAS,GAAG,SAAS,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,+CAA+C,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,KAAK,CAAC;IACtD,4EAA4E;IAC5E,0EAA0E;IAC1E,2CAA2C;IAC3C,MAAM,YAAY,GAAG,sBAAsB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,SAAS,EAAE,SAAS,IAAI,SAAS,EAAE,SAAS,CAAC;IAC/D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,2CAA2C,KAAK,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,QAAQ;IACR,IAAI,OAA4C,CAAC;IACjD,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAC3C,YAAY,EACZ,WAAW,EACX,gBAAgB,YAAY,IAAI,WAAW,IAAI,KAAK,EAAE,EACtD,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,CAClC,CAAC;IACF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,YAAY,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,YAAoB,EACpB,WAAmB,EACnB,OAAiC;IAEjC,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,kBAAkB,YAAY,IAAI,WAAW,WAAW,CAAC;IACjG,MAAM,GAAG,GAAG,OAAO,EAAE,KAAK,CAAC;IAC3B,MAAM,MAAM,GACV,GAAG,YAAY,KAAK;QAClB,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE;QAC/B,CAAC,CAAC,GAAG,KAAK,SAAS;YACjB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACb,CAAC,CAAC,0BAA0B,CAAC;IACnC,OAAO,CACL,mDAAmD,YAAY,IAAI,WAAW,eAAe;QAC7F,sBAAsB,SAAS,IAAI;QACnC,cAAc,MAAM,IAAI;QACxB,+EAA+E;QAC/E,kFAAkF;QAClF,6DAA6D,CAC9D,CAAC;AACJ,CAAC;AAQD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAC1E;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAc;IAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CACjB,MAAqB,EACrB,IAAc,EACd,OAAuC,EAAE;IAEzC,MAAM,SAAS,GACb,IAAI,CAAC,gBAAgB,KAAK,KAAK,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;QACxD,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC;QACnC,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;QAC1C,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,cAAc,EAAE;KAC3D,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,GAAG,CAAC,KAA8B,CAAC;QAC7C,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxB,QAAQ,CAAC,0EAA0E,CAAC,CAAC;QACvF,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,0BAA0B,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,EAAE,OAAO,MAAM,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,wEAAwE;IACxE,8EAA8E;IAC9E,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,wEAAwE,CAAC;SACrF,MAAM,CAAC,iBAAiB,EAAE,oDAAoD,CAAC;SAC/E,kBAAkB,CAAC,IAAI,CAAC;QACzB,2EAA2E;QAC3E,4EAA4E;QAC5E,qEAAqE;SACpE,oBAAoB,CAAC,IAAI,CAAC;SAC1B,UAAU,CAAC,KAAK,CAAC;SACjB,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,GAAY,EAAE,EAAE;QACvD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACjE,2DAA2D;YAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kBAAkB,MAAM,CAAC,SAAS,YAAY,MAAM,CAAC,KAAK,IAAI,CAC/D,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,6EAA6E;IAC7E,OAAO;SACJ,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,sFAAsF,CAAC;SACnG,MAAM,CAAC,iBAAiB,EAAE,oDAAoD,CAAC;SAC/E,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC;SACzC,MAAM,CAAC,YAAY,EAAE,gCAAgC,EAAE,KAAK,CAAC;SAC7D,MAAM,CAAC,wBAAwB,EAAE,gBAAgB,CAAC;SAClD,MAAM,CAAC,YAAY,EAAE,6DAA6D,CAAC;SACnF,MAAM,CACL,KAAK,EACH,MAA0B,EAC1B,IAAiG,EACjG,EAAE;QACF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CACL,0BAA0B,MAAM,CAAC,SAAS,KAAK;oBAC7C,iEAAiE,CACpE,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC;YAC9F,IAAI,IAAI,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,IAAI,CAAC,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACrD,IAAI,IAAI,CAAC,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CACF,CAAC;IAEJ,oEAAoE;IACpE,OAAO;SACJ,OAAO,CAAC,wBAAwB,CAAC;SACjC,WAAW,CAAC,kFAAkF,CAAC;SAC/F,MAAM,CAAC,iBAAiB,EAAE,oDAAoD,CAAC;SAC/E,MAAM,CAAC,wBAAwB,EAAE,gBAAgB,CAAC;SAClD,MAAM,CACL,KAAK,EACH,MAAc,EACd,QAAkB,EAClB,IAA4C,EAC5C,EAAE;QACF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACjE,sEAAsE;YACtE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,MAAM,EAAE,CAAC;YACtE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAChD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACnB,IAAI,IAAI,CAAC,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACrD,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CACF,CAAC;AACN,CAAC"}

package/dist/src/commands/conversations.d.ts

@@ -0,0 +1,61 @@
+/**
+ * mesh conversations — read a deployed Mesh agent's conversations
+ *
+ * Commands:
+ *   mesh conversations list             List conversations visible to the caller
+ *   mesh conversations show <id>        Render a conversation's transcript
+ *   mesh conversations artifacts <id>   List a conversation's artifacts
+ *
+ * Discovery-first: resolves a target (registry name, --api-url, or
+ * fallback) via `resolveTarget`/`agentApiFetch` (Task 3) and renders a
+ * table (TTY) or JSON (piped / --json).
+ */
+import { Command } from "commander";
+export interface ConversationSummary {
+    id: string;
+    title?: string;
+    updatedAt?: string;
+    lastUpdated?: string;
+}
+/**
+ * Pure formatter: JSON verbatim (compact — agents parse this, so it's kept
+ * dense rather than pretty-printed) when `asJson`, else a simple aligned
+ * ID/TITLE/UPDATED table. Tolerant of missing title/updatedAt/lastUpdated
+ * and an empty list.
+ */
+export declare function formatConversations(list: ConversationSummary[], asJson: boolean): string;
+export interface TranscriptMessage {
+    role: string;
+    /** Plain string, or an AI SDK array of content parts (rendered via renderMessageContent). */
+    content?: unknown;
+    /** Present on assistant turns that invoked tools; shape varies by agent-sdk version. */
+    toolCalls?: unknown[];
+    /** Artifact ids/refs produced or referenced by this turn. */
+    artifactRefs?: unknown[];
+}
+export interface TranscriptBody {
+    messages?: TranscriptMessage[];
+}
+/**
+ * Pure formatter: JSON verbatim (compact) when `asJson`, else one `role:
+ * content` block per message (blank-line separated). Tolerant of a missing
+ * `content` (renders `role: ` with nothing after it) and an empty/missing
+ * `messages` array. When a message carries `toolCalls`/`artifactRefs`, notes
+ * them compactly on an indented line beneath the block.
+ */
+export declare function formatTranscript(body: TranscriptBody, asJson: boolean): string;
+export interface ArtifactSummary {
+    id: string;
+    kind?: string;
+    title?: string;
+}
+/**
+ * Pure formatter: JSON verbatim (compact) when `asJson`, else an
+ * `ARTIFACT-ID · KIND · TITLE` table plus a trailing download hint (using
+ * `refHint` — the conversation id — and the first artifact's id as the
+ * copy-pasteable example). Tolerant of missing kind/title and an empty list
+ * (no download hint when there's nothing to download).
+ */
+export declare function formatArtifacts(list: ArtifactSummary[], asJson: boolean, refHint: string): string;
+export declare function registerConversationsCommands(program: Command): void;
+//# sourceMappingURL=conversations.d.ts.map

package/dist/src/commands/conversations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conversations.d.ts","sourceRoot":"","sources":["../../../src/commands/conversations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgBpC,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAQD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAwBxF;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wFAAwF;IACxF,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;IACtB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAChC;AAiBD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAsB9E;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAwBjG;AAiFD,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAsFpE"}

package/dist/src/commands/conversations.js

@@ -0,0 +1,239 @@
+/**
+ * mesh conversations — read a deployed Mesh agent's conversations
+ *
+ * Commands:
+ *   mesh conversations list             List conversations visible to the caller
+ *   mesh conversations show <id>        Render a conversation's transcript
+ *   mesh conversations artifacts <id>   List a conversation's artifacts
+ *
+ * Discovery-first: resolves a target (registry name, --api-url, or
+ * fallback) via `resolveTarget`/`agentApiFetch` (Task 3) and renders a
+ * table (TTY) or JSON (piped / --json).
+ */
+// renderMessageContent is needed synchronously by the exported formatter;
+// safe at top level since agent-targets' exports are source-mapped. The
+// heavy pull/writeBundle pair stays lazily imported in the pull action.
+import { renderMessageContent } from "@mesh-tech/agent-targets";
+import { buildVcsEnricher } from "./vcs-enrich.js";
+import { logError, logInfo, logWarn } from "../utils/log.js";
+import { agentApiFetch, describeHttpError, describeNetworkError, resolveTarget, TargetResolutionError, } from "./agent-api-client.js";
+const MAX_TITLE_LEN = 40;
+function truncate(s, max) {
+    return s.length > max ? s.slice(0, max - 1) + "…" : s;
+}
+/**
+ * Pure formatter: JSON verbatim (compact — agents parse this, so it's kept
+ * dense rather than pretty-printed) when `asJson`, else a simple aligned
+ * ID/TITLE/UPDATED table. Tolerant of missing title/updatedAt/lastUpdated
+ * and an empty list.
+ */
+export function formatConversations(list, asJson) {
+    if (asJson) {
+        return JSON.stringify(list);
+    }
+    if (list.length === 0) {
+        return "(no conversations)";
+    }
+    const rows = list.map((c) => ({
+        id: c.id ?? "",
+        title: truncate(c.title ?? "", MAX_TITLE_LEN),
+        updated: c.updatedAt ?? c.lastUpdated ?? "",
+    }));
+    const idWidth = Math.max("ID".length, ...rows.map((r) => r.id.length));
+    const titleWidth = Math.max("TITLE".length, ...rows.map((r) => r.title.length));
+    const pad = (s, width) => s.padEnd(width);
+    const header = `${pad("ID", idWidth)}  ${pad("TITLE", titleWidth)}  UPDATED`;
+    const lines = rows.map((r) => `${pad(r.id, idWidth)}  ${pad(r.title, titleWidth)}  ${r.updated}`);
+    return [header, ...lines].join("\n");
+}
+/** Compact a list of tool-call/artifact-ref entries to a comma-joined summary. */
+function summarizeRefs(items) {
+    return items
+        .map((item) => {
+        if (typeof item === "string")
+            return item;
+        if (item && typeof item === "object") {
+            const rec = item;
+            const label = rec.id ?? rec.name ?? rec.toolName;
+            if (typeof label === "string")
+                return label;
+        }
+        return "?";
+    })
+        .join(", ");
+}
+/**
+ * Pure formatter: JSON verbatim (compact) when `asJson`, else one `role:
+ * content` block per message (blank-line separated). Tolerant of a missing
+ * `content` (renders `role: ` with nothing after it) and an empty/missing
+ * `messages` array. When a message carries `toolCalls`/`artifactRefs`, notes
+ * them compactly on an indented line beneath the block.
+ */
+export function formatTranscript(body, asJson) {
+    if (asJson) {
+        return JSON.stringify(body);
+    }
+    const messages = body.messages ?? [];
+    if (messages.length === 0) {
+        return "(no messages)";
+    }
+    return messages
+        .map((m) => {
+        const lines = [`${m.role}: ${renderMessageContent(m.content)}`];
+        if (Array.isArray(m.toolCalls) && m.toolCalls.length > 0) {
+            lines.push(`  tool-calls: ${summarizeRefs(m.toolCalls)}`);
+        }
+        if (Array.isArray(m.artifactRefs) && m.artifactRefs.length > 0) {
+            lines.push(`  artifacts: ${summarizeRefs(m.artifactRefs)}`);
+        }
+        return lines.join("\n");
+    })
+        .join("\n\n");
+}
+/**
+ * Pure formatter: JSON verbatim (compact) when `asJson`, else an
+ * `ARTIFACT-ID · KIND · TITLE` table plus a trailing download hint (using
+ * `refHint` — the conversation id — and the first artifact's id as the
+ * copy-pasteable example). Tolerant of missing kind/title and an empty list
+ * (no download hint when there's nothing to download).
+ */
+export function formatArtifacts(list, asJson, refHint) {
+    if (asJson) {
+        return JSON.stringify(list);
+    }
+    if (list.length === 0) {
+        return "(no artifacts)";
+    }
+    const rows = list.map((a) => ({
+        id: a.id ?? "",
+        kind: a.kind ?? "",
+        title: a.title ?? "",
+    }));
+    const idWidth = Math.max("ARTIFACT-ID".length, ...rows.map((r) => r.id.length));
+    const kindWidth = Math.max("KIND".length, ...rows.map((r) => r.kind.length));
+    const pad = (s, width) => s.padEnd(width);
+    const header = `${pad("ARTIFACT-ID", idWidth)} · ${pad("KIND", kindWidth)} · TITLE`;
+    const lines = rows.map((r) => `${pad(r.id, idWidth)} · ${pad(r.kind, kindWidth)} · ${r.title}`);
+    const exampleId = rows[0]?.id ?? "";
+    return [header, ...lines, "", `Download: mesh artifacts get ${refHint}:${exampleId}`].join("\n");
+}
+/** Add the shared `--target/--api-url/--context/--json` option set (same across list/show/artifacts). */
+function withTargetOptions(cmd) {
+    return cmd
+        .option("--target <name>", "Named agent target from the agent-targets registry")
+        .option("--api-url <url>", "Agent API URL (overrides --target; ad-hoc, no registry lookup)")
+        .option("--context <ctx>", "Zitadel auth context, used with --api-url (default: mesh.dev)")
+        .option("--json", "Emit JSON (default when stdout is not a TTY)");
+}
+/**
+ * Shared resolve → fetch → format → print flow for a conversations verb.
+ * `ctx.id` (the conversation id, when the verb has one) is passed through to
+ * `describeHttpError` so it can echo it in the 404 message and offer the
+ * `mesh temporal recover-conversation <id>` hint on a 503
+ * `conversation_unavailable` response (formerly `show`'s own special-case;
+ * now folded into the one shared renderer).
+ */
+async function runConversationsVerb(opts, apiPath, format, ctx) {
+    // Declared outside the try so a network-error catch can give
+    // local-vs-remote-aware guidance (`describeNetworkError` needs the
+    // target); stays undefined if `resolveTarget` itself is what threw.
+    let target;
+    try {
+        target = resolveTarget(opts);
+        const res = await agentApiFetch(target, apiPath);
+        if (!res.ok) {
+            throw new Error(await describeHttpError(res, target, ctx));
+        }
+        const body = (await res.json());
+        const asJson = opts.json ?? !process.stdout.isTTY;
+        process.stdout.write(format(body, asJson) + "\n");
+    }
+    catch (error) {
+        reportCliError(error, target);
+    }
+}
+/**
+ * Symmetric with `mesh artifacts get`'s catch: `describeHttpError` failures
+ * already carry target-aware guidance in their message (so `hint === message`
+ * and nothing further is logged), while a genuine network throw
+ * (ECONNREFUSED/"fetch failed"/ENOTFOUND/EAI_AGAIN) gets an extra
+ * local-vs-remote hint via `describeNetworkError`.
+ */
+function reportCliError(error, target) {
+    if (error instanceof TargetResolutionError) {
+        logError(error.message);
+    }
+    else {
+        const message = error instanceof Error ? error.message : String(error);
+        logError(message);
+        if (target) {
+            const hint = describeNetworkError(error, target);
+            if (hint !== message)
+                logWarn(hint);
+        }
+    }
+    process.exitCode = 1;
+}
+export function registerConversationsCommands(program) {
+    const group = program
+        .command("conversations")
+        .alias("conv")
+        .description("Read a deployed Mesh agent's conversations (list, show, artifacts)");
+    withTargetOptions(group
+        .command("list")
+        .description("List the caller's conversations on an agent target")).action(async (opts) => {
+        await runConversationsVerb(opts, "/v1/conversations", (body, asJson) => formatConversations(body.conversations ?? [], asJson));
+    });
+    withTargetOptions(group
+        .command("show <id>")
+        .description("Render a conversation's transcript")).action(async (id, opts) => {
+        await runConversationsVerb(opts, `/v1/conversations/${encodeURIComponent(id)}`, (body, asJson) => formatTranscript(body, asJson), { id });
+    });
+    withTargetOptions(group
+        .command("artifacts <id>")
+        .description("List a conversation's artifacts")).action(async (id, opts) => {
+        await runConversationsVerb(opts, `/v1/conversations/${encodeURIComponent(id)}/artifacts`, (body, asJson) => formatArtifacts(body.artifacts ?? [], asJson, id), { id });
+    });
+    group
+        .command("pull <id>")
+        .description("Pull a conversation + its designs/UI + recursive subagent transcripts into a bundle")
+        .option("--target <name>", "Named agent target from the agent-targets registry")
+        .option("--api-url <url>", "Agent API URL (overrides --target)")
+        .option("--context <ctx>", "Zitadel auth context (default: mesh.dev)")
+        .option("-o, --output <dir>", "Write the bundle directory here (prints JSON when omitted)")
+        .option("--no-recursive", "Only pull direct subagents (default: recurse the delegate tree)")
+        .option("--no-vcs", "Skip pulling each design's own vcs folder (docs/manifest); IR-only")
+        .action(async (id, opts) => {
+        // Lazy: an unbuilt/unresolvable agent-targets must degrade only this
+        // command, never brick the whole CLI at boot (src/program.ts imports all
+        // command modules eagerly).
+        const { pullConversation, writeBundle } = await import("@mesh-tech/agent-targets");
+        let target;
+        let enricher;
+        try {
+            target = resolveTarget(opts);
+            const resolved = target;
+            enricher = opts.vcs === false ? undefined : await buildVcsEnricher(resolved);
+            const bundle = await pullConversation({ fetchApi: (apiPath) => agentApiFetch(resolved, apiPath), enrichVcs: enricher?.enrichVcs }, id, { recursive: opts.recursive !== false, hintTarget: opts.target });
+            if (opts.output) {
+                const written = await writeBundle(bundle, opts.output);
+                logInfo(`wrote ${written.length} files → ${opts.output}`);
+                if (bundle.warnings.length) {
+                    logWarn(`${bundle.warnings.length} warning(s): ${bundle.warnings
+                        .map((w) => `${w.stage}:${w.ref ?? ""}`)
+                        .join(", ")}`);
+                }
+            }
+            else {
+                process.stdout.write(JSON.stringify(bundle) + "\n");
+            }
+        }
+        catch (error) {
+            reportCliError(error, target);
+        }
+        finally {
+            await enricher?.cleanup();
+        }
+    });
+}
+//# sourceMappingURL=conversations.js.map

package/dist/src/commands/conversations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conversations.js","sourceRoot":"","sources":["../../../src/commands/conversations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,0EAA0E;AAC1E,wEAAwE;AACxE,wEAAwE;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,EACb,qBAAqB,GAEtB,MAAM,uBAAuB,CAAC;AAS/B,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB,SAAS,QAAQ,CAAC,CAAS,EAAE,GAAW;IACtC,OAAO,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAA2B,EAAE,MAAe;IAC9E,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5B,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE;QACd,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,aAAa,CAAC;QAC7C,OAAO,EAAE,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,WAAW,IAAI,EAAE;KAC5C,CAAC,CAAC,CAAC;IAEJ,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhF,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,KAAa,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE1D,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC;IAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAElG,OAAO,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAgBD,kFAAkF;AAClF,SAAS,aAAa,CAAC,KAAgB;IACrC,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC1C,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,IAA+B,CAAC;YAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC;YACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;QAC9C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAoB,EAAE,MAAe;IACpE,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,OAAO,QAAQ;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,iBAAiB,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/D,KAAK,CAAC,IAAI,CAAC,gBAAgB,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC;SACD,IAAI,CAAC,MAAM,CAAC,CAAC;AAClB,CAAC;AAQD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAuB,EAAE,MAAe,EAAE,OAAe;IACvF,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5B,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE;QACd,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;QAClB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;KACrB,CAAC,CAAC,CAAC;IAEJ,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,KAAa,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE1D,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,UAAU,CAAC;IACpF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAChG,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;IAEpC,OAAO,CAAC,MAAM,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,gCAAgC,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnG,CAAC;AAgBD,yGAAyG;AACzG,SAAS,iBAAiB,CAAC,GAAY;IACrC,OAAO,GAAG;SACP,MAAM,CAAC,iBAAiB,EAAE,oDAAoD,CAAC;SAC/E,MAAM,CAAC,iBAAiB,EAAE,gEAAgE,CAAC;SAC3F,MAAM,CAAC,iBAAiB,EAAE,+DAA+D,CAAC;SAC1F,MAAM,CAAC,QAAQ,EAAE,8CAA8C,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAAyB,EACzB,OAAe,EACf,MAA4C,EAC5C,GAAqB;IAErB,6DAA6D;IAC7D,mEAAmE;IACnE,oEAAoE;IACpE,IAAI,MAAkC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAEjD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,KAAc,EAAE,MAAuB;IAC7D,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;QAC3C,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAElB,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACjD,IAAI,IAAI,KAAK,OAAO;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,OAAgB;IAC5D,MAAM,KAAK,GAAG,OAAO;SAClB,OAAO,CAAC,eAAe,CAAC;SACxB,KAAK,CAAC,MAAM,CAAC;SACb,WAAW,CAAC,oEAAoE,CAAC,CAAC;IAErF,iBAAiB,CACf,KAAK;SACF,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,oDAAoD,CAAC,CACrE,CAAC,MAAM,CAAC,KAAK,EAAE,IAAyB,EAAE,EAAE;QAC3C,MAAM,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,EAAE,CAAC,IAA+C,EAAE,MAAM,EAAE,EAAE,CAChH,mBAAmB,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,EAAE,MAAM,CAAC,CACtD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,iBAAiB,CACf,KAAK;SACF,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,oCAAoC,CAAC,CACrD,CAAC,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAyB,EAAE,EAAE;QACvD,MAAM,oBAAoB,CACxB,IAAI,EACJ,qBAAqB,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAC7C,CAAC,IAAoB,EAAE,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,EAChE,EAAE,EAAE,EAAE,CACP,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,iBAAiB,CACf,KAAK;SACF,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CAAC,iCAAiC,CAAC,CAClD,CAAC,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAyB,EAAE,EAAE;QACvD,MAAM,oBAAoB,CACxB,IAAI,EACJ,qBAAqB,kBAAkB,CAAC,EAAE,CAAC,YAAY,EACvD,CAAC,IAAuC,EAAE,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EACtG,EAAE,EAAE,EAAE,CACP,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,KAAK;SACF,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,qFAAqF,CAAC;SAClG,MAAM,CAAC,iBAAiB,EAAE,oDAAoD,CAAC;SAC/E,MAAM,CAAC,iBAAiB,EAAE,oCAAoC,CAAC;SAC/D,MAAM,CAAC,iBAAiB,EAAE,0CAA0C,CAAC;SACrE,MAAM,CAAC,oBAAoB,EAAE,4DAA4D,CAAC;SAC1F,MAAM,CAAC,gBAAgB,EAAE,iEAAiE,CAAC;SAC3F,MAAM,CAAC,UAAU,EAAE,oEAAoE,CAAC;SACxF,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAiB,EAAE,EAAE;QAC9C,qEAAqE;QACrE,yEAAyE;QACzE,4BAA4B;QAC5B,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACnF,IAAI,MAAkC,CAAC;QACvC,IAAI,QAAsD,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC;YACxB,QAAQ,GAAG,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,EAAE,QAAQ,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,EACnG,EAAE,EACF,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CACjE,CAAC;YACF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBACvD,OAAO,CAAC,SAAS,OAAO,CAAC,MAAM,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC1D,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;oBAC3B,OAAO,CACL,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,gBAAgB,MAAM,CAAC,QAAQ;yBACrD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC;yBACvC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;gBAAS,CAAC;YACT,MAAM,QAAQ,EAAE,OAAO,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/create-app.d.ts

@@ -1,10 +1,33 @@
 /**
  * mesh create-app - Scaffold a new tenant application
  *
- * Creates a new application using one of the available templates:
- * - api-web-db: API + Web + Database (default)
- * - temporal-api-worker: Temporal Worker + API for workflows
+ * Three modes:
+ * 1. Legacy: `mesh create-app --template workflow --tenant x --name y`
+ * 2. Composable (flags): `mesh create-app --tenant x --name y --primitives service,database`
+ * 3. Interactive: `mesh create-app` (prompts when TTY detected and flags missing)
+ *
+ * All options can be passed as flags for agent/CI usage (no TTY required).
  */
 import { Command } from "commander";
+/**
+ * A fresh standalone tenant-apps repo (empty clone of {tenant}-mesh-apps) is
+ * bootstrappable when the cwd is a git repo root that has none of the layouts
+ * `resolveAppDir` looks for. Previously create-app exited with "Tenant
+ * directory not found: tenants/<t>/" here — even though the app-tenant
+ * doctor's Repo-shape check names create-app as the fix ("workspace files
+ * included"), so the command must actually deliver them.
+ */
+export declare function shouldBootstrapAppsRepo(cwd: string): boolean;
+/**
+ * Generate the repo-level files of a standalone tenant-apps repo (the
+ * trabian-mesh-apps shape): pnpm workspace over apps/*, private root
+ * package.json, scoped CodeArtifact .npmrc, base tsconfig, .gitignore, README.
+ * Only writes files that don't already exist; returns what it created.
+ */
+export declare function bootstrapAppsRepo(cwd: string, tenant: string): string[];
+/**
+ * Recursively copy a directory, processing .hbs templates
+ */
+export declare function copyTemplate(srcDir: string, destDir: string, context: Record<string, unknown>): void;
 export declare function registerCreateAppCommand(program: Command): void;
 //# sourceMappingURL=create-app.d.ts.map

package/dist/src/commands/create-app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-app.d.ts","sourceRoot":"","sources":["../../../src/commands/create-app.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAyEpC,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAuI/D"}
+{"version":3,"file":"create-app.d.ts","sourceRoot":"","sources":["../../../src/commands/create-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqFpC;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAQ5D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAuCvE;AAwFD;;GAEG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,IAAI,CAiCN;AA6HD,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA8E/D"}