@mesh-tech/mesh-cli 0.1.0 → 0.12.0

package/dist/src/commands/dev-doctor.js

@@ -0,0 +1,671 @@
+/**
+ * `mesh dev doctor` — preflight + on-demand diagnosis for `mesh dev`.
+ *
+ * Three layers kept deliberately separate so the bug-prone logic stays pure and
+ * unit-testable without network/AWS:
+ *   1. Engine + renderers (this section): `aggregateStatus`, `runChecks`,
+ *      `renderHuman`, `renderJson`.
+ *   2. `DoctorContext` builder (resolves role/context/session once).
+ *   3. The individual `Check`s (creds, tunnels, ports, …), each returning data.
+ *
+ * Both `mesh dev doctor` and the `mesh dev` launch preflight call `runChecks`;
+ * see MESH-2015 (docs/superpowers/specs/2026-07-08-mesh-dev-doctor-design.md).
+ */
+import { execFileSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as net from "node:net";
+import * as path from "node:path";
+import { isPortFree } from "./dev.js";
+import { appUsesMeshPackages, probeRegistryToken, registryLoginFix, } from "../utils/auth-preflight.js";
+import { probeCredentials, isRemoteEnvironment } from "./login.js";
+// ============================================================================
+// Engine + renderers (pure)
+// ============================================================================
+/** `error` if any error, else `warn` if any warn, else `ok` (empty → `ok`). */
+export function aggregateStatus(results) {
+    if (results.some((r) => r.status === "error"))
+        return "error";
+    if (results.some((r) => r.status === "warn"))
+        return "warn";
+    return "ok";
+}
+/**
+ * Run every check whose `phases` includes `phase`, concurrently. A check that
+ * throws is captured as an `error` result rather than aborting the run — the
+ * whole point of doctor is to report, never to crash.
+ */
+export async function runChecks(ctx, phase, checks) {
+    const applicable = checks.filter((c) => c.phases.includes(phase));
+    return Promise.all(applicable.map(async (check) => {
+        try {
+            return { check, result: await check.run(ctx, phase) };
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            return {
+                check,
+                result: {
+                    status: "error",
+                    summary: `check '${check.id}' threw: ${msg}`,
+                },
+            };
+        }
+    }));
+}
+const ICONS = { ok: "✓", warn: "⚠", error: "✗" };
+/** Human-readable: one line per check + indented remediation when present. */
+export function renderHuman(results) {
+    const lines = [];
+    for (const { check, result } of results) {
+        lines.push(`${ICONS[result.status]} ${check.title} — ${result.summary}`);
+        if (result.detail)
+            lines.push(`    ${result.detail}`);
+        if (result.remediation)
+            lines.push(`    Fix: ${result.remediation}`);
+    }
+    return lines.join("\n");
+}
+/** Machine-readable: stable key shape for tooling / future CI. */
+export function renderJson(results) {
+    return JSON.stringify({
+        status: aggregateStatus(results.map((r) => r.result)),
+        checks: results.map(({ check, result }) => ({
+            id: check.id,
+            status: result.status,
+            summary: result.summary,
+            // Stable keys for tooling: always present, `null` when absent
+            // (JSON.stringify would otherwise drop `undefined`).
+            remediation: result.remediation ?? null,
+            detail: result.detail ?? null,
+        })),
+    }, null, 2);
+}
+// ============================================================================
+// Check: credentials + TTL (creds)
+// ============================================================================
+/** Render a TTL in seconds as a compact human string ("47m", "1h 10m"). */
+function fmtTtl(seconds) {
+    if (seconds <= 0)
+        return "expired";
+    // Round to whole minutes first, then split — so 11h59.5m carries to "12h"
+    // rather than rendering "11h 60m".
+    const totalMin = Math.round(seconds / 60);
+    const h = Math.floor(totalMin / 60);
+    const m = totalMin % 60;
+    if (h > 0)
+        return m > 0 ? `${h}h ${m}m` : `${h}h`;
+    return `${m}m`;
+}
+/**
+ * Pure mapper: a `CredProbe` → a `CheckResult` with the exact remediation.
+ * `headless` selects the device-flow `mesh login` variant (browser flow times
+ * out over SSH/tailscale — see the credential runbook).
+ */
+export function credProbeToResult(probe, context, headless) {
+    const loginCmd = `mesh login ${context}${headless ? " --device" : ""}`;
+    switch (probe.state) {
+        case "ok":
+            return {
+                status: probe.ttlSeconds < 300 ? "warn" : "ok",
+                summary: `deployer creds valid ${fmtTtl(probe.ttlSeconds)}${probe.email ? ` (${probe.email})` : ""}`,
+                detail: `expires ${probe.expiresAt}`,
+            };
+        case "no-session":
+            return {
+                status: "error",
+                summary: `no Zitadel session for ${context}`,
+                remediation: loginCmd,
+            };
+        case "expired-session":
+            return {
+                status: "error",
+                summary: `Zitadel session for ${context} expired and could not refresh`,
+                remediation: loginCmd,
+            };
+        case "assume-denied":
+            return {
+                status: "error",
+                summary: "session valid but AssumeRole denied — wrong IAM role/policy",
+                detail: probe.detail,
+                remediation: `check mesh:deployerRole in the stack config and the role's trust/permissions; re-login if role changed: ${loginCmd}`,
+            };
+        case "stale-env-override":
+            return {
+                status: "error",
+                summary: "stale AWS_* env vars would override the self-refreshing login profile",
+                remediation: "unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN",
+            };
+    }
+}
+export const credsCheck = {
+    id: "creds",
+    title: "Credentials",
+    phases: ["preflight", "ondemand"],
+    async run(ctx) {
+        // When creds were already resolved (launch preflight passes the method),
+        // trust that result — avoids a second AssumeRole call, and correctly
+        // reports the SSO/environment paths that `probeCredentials` (Zitadel-only)
+        // would otherwise misdiagnose.
+        switch (ctx.credMethod) {
+            case "sso":
+                return {
+                    status: "ok",
+                    summary: "using AWS SSO credentials (auto-refresh from SSO cache)",
+                };
+            case "environment":
+                return { status: "ok", summary: "using AWS credentials from environment" };
+            case "zitadel":
+                return {
+                    status: "ok",
+                    summary: "using Zitadel deployer credentials (credential_process auto-refresh)",
+                };
+        }
+        // credMethod null (on-demand doctor, or a failed launch resolution) or
+        // 'ambient': determine the real state by probing.
+        if (!ctx.platformContext || !ctx.deployerRole) {
+            return {
+                status: "warn",
+                summary: "no deployer role/context resolved — using ambient AWS credentials",
+                detail: "add mesh:deployerRole to the Pulumi stack config to use mesh login credentials",
+            };
+        }
+        const probe = await probeCredentials(ctx.platformContext, ctx.deployerRole);
+        return credProbeToResult(probe, ctx.platformContext, isRemoteEnvironment());
+    },
+};
+// ============================================================================
+// Check: CodeArtifact registry token (registry) — MESH-2479
+// ============================================================================
+/**
+ * Verify the @mesh-tech CodeArtifact token actually works BEFORE long work —
+ * an expired token otherwise surfaces minutes later as npm's generic E401
+ * ("try npm login", which cannot fix a CodeArtifact registry). Warn-level:
+ * `mesh dev` itself runs installed code, so a stale token shouldn't block
+ * launch — it should name the fix.
+ */
+export const registryCheck = {
+    id: "registry",
+    title: "Registry auth",
+    phases: ["preflight", "ondemand"],
+    async run(ctx, phase) {
+        // The other preflight checks are fast — don't let an unreachable
+        // registry (offline / VPN off) hold the whole launch for the full
+        // on-demand bound. The zero-access local loop must stay snappy.
+        const probe = await probeRegistryToken(phase === "preflight" ? { timeoutMs: 3_000 } : undefined);
+        switch (probe.state) {
+            case "fresh":
+                return { status: "ok", summary: "CodeArtifact token accepted by the @mesh-tech registry" };
+            case "expired":
+                return {
+                    status: "warn",
+                    summary: "CodeArtifact token expired/rejected — installing @mesh-tech packages will fail with E401",
+                    detail: probe.detail,
+                    remediation: registryLoginFix(ctx.platformContext ?? undefined),
+                };
+            case "unreachable":
+                return {
+                    status: "ok",
+                    summary: "registry unreachable — CodeArtifact token not verified (offline?)",
+                    detail: probe.detail,
+                };
+            case "missing":
+                return appUsesMeshPackages(ctx.appRoot)
+                    ? {
+                        status: "warn",
+                        summary: "no CodeArtifact auth in ~/.npmrc, but this app depends on @mesh-tech packages — pnpm install will fail with E401",
+                        remediation: registryLoginFix(ctx.platformContext ?? undefined),
+                    }
+                    : {
+                        status: "ok",
+                        summary: "no CodeArtifact auth configured (needed only to install @mesh-tech packages)",
+                    };
+        }
+    },
+};
+// ============================================================================
+// Checks: tmux, ports, worktree
+// ============================================================================
+/**
+ * Parse `lsof -ti :PORT` + `ps -o comm= -p PID` output into the squatting
+ * process. `lsof` may list several PIDs (one per line); we name the first.
+ */
+export function parsePortSquatter(lsofOut, psOut) {
+    const firstLine = lsofOut.trim().split("\n")[0]?.trim();
+    const pid = Number(firstLine);
+    if (!firstLine || !Number.isInteger(pid))
+        return null;
+    const command = psOut.trim().split("\n")[0]?.trim() || "unknown";
+    return { pid, command };
+}
+/** True when `serviceSrc` lives under (or equals) `repoRoot`. */
+export function sharesWorktreeRoot(serviceSrc, repoRoot) {
+    const src = path.resolve(serviceSrc);
+    const root = path.resolve(repoRoot);
+    return src === root || src.startsWith(root + path.sep);
+}
+/**
+ * Pure classification for the on-demand ports check. Given the PID currently
+ * listening on a service port (`null` when nothing is) and the set of PIDs in
+ * the live session's tmux process tree:
+ *   - `null` listener            → `dead`    (the service isn't running)
+ *   - listener in the session    → `owned`   (healthy — the session's own svc)
+ *   - listener outside it        → `foreign` (a real squatter)
+ * Mid-session the session's services are *supposed* to hold their ports, so a
+ * naive "occupied ⇒ squatted" test misreports a healthy session (MESH-2015).
+ */
+export function classifyPortListener(listenerPid, sessionPids) {
+    if (listenerPid === null)
+        return "dead";
+    return sessionPids.has(listenerPid) ? "owned" : "foreign";
+}
+/**
+ * Pure: expand tmux pane PIDs to the full set of PIDs in their process
+ * subtrees, using the output of `ps -eo pid=,ppid=` (each line "PID PPID").
+ * The roots themselves are included; unparseable lines are skipped.
+ */
+export function collectSessionPids(panePids, psOut) {
+    const children = new Map();
+    for (const line of psOut.trim().split("\n")) {
+        const [pidStr, ppidStr] = line.trim().split(/\s+/);
+        const pid = Number(pidStr);
+        const ppid = Number(ppidStr);
+        if (!Number.isInteger(pid) || !Number.isInteger(ppid))
+            continue;
+        const kids = children.get(ppid) ?? [];
+        kids.push(pid);
+        children.set(ppid, kids);
+    }
+    const result = new Set();
+    const queue = panePids.filter((p) => Number.isInteger(p));
+    while (queue.length > 0) {
+        const pid = queue.shift();
+        if (result.has(pid))
+            continue;
+        result.add(pid);
+        for (const child of children.get(pid) ?? [])
+            queue.push(child);
+    }
+    return result;
+}
+/** Identify the process squatting a port; null if it can't be determined. */
+function whoHasPort(port) {
+    try {
+        const lsof = execFileSync("lsof", ["-ti", `:${port}`], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        const pid = lsof.trim().split("\n")[0]?.trim();
+        if (!pid)
+            return null;
+        let ps = "";
+        try {
+            ps = execFileSync("ps", ["-o", "comm=", "-p", pid], {
+                encoding: "utf8",
+                stdio: ["ignore", "pipe", "ignore"],
+            });
+        }
+        catch {
+            /* ps failed — parsePortSquatter falls back to "unknown" */
+        }
+        return parsePortSquatter(lsof, ps);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Gather every PID in the live session's tmux process trees (pane PIDs plus
+ * their descendants). Used to tell the session's own service processes apart
+ * from foreign squatters. Returns an empty set when tmux/ps are unavailable or
+ * the session has no panes — the caller then treats occupied ports as
+ * unidentified rather than owned.
+ */
+function sessionProcessTree(sessionName) {
+    let panePids;
+    try {
+        const out = execFileSync("tmux", ["list-panes", "-s", "-t", sessionName, "-F", "#{pane_pid}"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+        panePids = out
+            .trim()
+            .split("\n")
+            .map((l) => Number(l.trim()))
+            .filter((n) => Number.isInteger(n));
+    }
+    catch {
+        return new Set();
+    }
+    if (panePids.length === 0)
+        return new Set();
+    let psOut = "";
+    try {
+        psOut = execFileSync("ps", ["-eo", "pid=,ppid="], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+    }
+    catch {
+        // No process table — the pane PIDs themselves are still session-owned.
+        return new Set(panePids);
+    }
+    return collectSessionPids(panePids, psOut);
+}
+export const tmuxCheck = {
+    id: "tmux",
+    title: "tmux",
+    phases: ["preflight", "ondemand"],
+    async run() {
+        try {
+            execFileSync("which", ["tmux"], { stdio: "ignore" });
+            return { status: "ok", summary: "installed" };
+        }
+        catch {
+            return {
+                status: "error",
+                summary: "tmux is not installed",
+                remediation: "brew install tmux",
+            };
+        }
+    },
+};
+export const portsCheck = {
+    id: "ports",
+    title: "Ports",
+    phases: ["preflight", "ondemand"],
+    async run(ctx) {
+        const services = ctx.sessionState?.devOutput.services;
+        if (!services || Object.keys(services).length === 0) {
+            // Preflight (no session): ports are validated at allocation/launch time.
+            return {
+                status: "ok",
+                summary: "no session — ports are checked at allocation time",
+            };
+        }
+        // Mid-session the session's OWN services should be listening on their
+        // allocated ports. Classify each port against the session's process tree so
+        // healthy self-owned ports don't read as squatters (MESH-2015).
+        const sessionPids = sessionProcessTree(ctx.sessionName);
+        const foreign = []; // held by a process outside the session
+        const dead = []; // nothing listening — service died/isn't up
+        const unknown = []; // occupied but the owner couldn't be resolved
+        for (const [name, svc] of Object.entries(services)) {
+            const free = await isPortFree(svc.port);
+            const who = free ? null : whoHasPort(svc.port);
+            const ownership = classifyPortListener(who?.pid ?? null, sessionPids);
+            if (ownership === "owned")
+                continue;
+            if (ownership === "foreign") {
+                foreign.push(`${name} :${svc.port} held by ${who.command} (pid ${who.pid})`);
+                continue;
+            }
+            // `dead` from the helper (null listener pid): either the port is
+            // genuinely free (service down) or it's occupied but the owner couldn't
+            // be resolved via lsof.
+            if (free) {
+                dead.push(`${name} :${svc.port} not listening`);
+            }
+            else {
+                unknown.push(`${name} :${svc.port} in use (owner unknown)`);
+            }
+        }
+        const total = Object.keys(services).length;
+        if (foreign.length === 0 && dead.length === 0 && unknown.length === 0) {
+            return {
+                status: "ok",
+                summary: `all ${total} service port(s) owned by this session`,
+            };
+        }
+        const parts = [];
+        if (foreign.length)
+            parts.push(`${foreign.length} squatted by another process`);
+        if (dead.length)
+            parts.push(`${dead.length} not listening (service down)`);
+        if (unknown.length)
+            parts.push(`${unknown.length} in use by an unidentified process`);
+        const remediation = foreign.length > 0
+            ? "stop the squatting process (or its SSH tunnel), then `mesh dev restart <svc>`"
+            : dead.length > 0
+                ? "restart the stopped service: `mesh dev restart <svc>`"
+                : "identify the port owner (`lsof -i :<port>`), then `mesh dev restart <svc>`";
+        return {
+            // A real squatter or a down service is actionable → error; an
+            // unidentifiable occupant alone is only a warning.
+            status: foreign.length > 0 || dead.length > 0 ? "error" : "warn",
+            summary: `service ports: ${parts.join(", ")}`,
+            detail: [...foreign, ...dead, ...unknown].join("; "),
+            remediation,
+        };
+    },
+};
+// ============================================================================
+// Check: config staleness (config-staleness)
+// ============================================================================
+/** True when the stack config file changed after the session was launched. */
+export function isConfigStale(configMtimeMs, startedAtIso) {
+    return configMtimeMs > Date.parse(startedAtIso);
+}
+export const configStalenessCheck = {
+    // Preflight runs *at* launch, so nothing can be stale-relative-to-launch yet
+    // — this only makes sense mid-session.
+    id: "config-staleness",
+    title: "Config freshness",
+    phases: ["ondemand"],
+    async run(ctx) {
+        const state = ctx.sessionState;
+        if (!state) {
+            return { status: "ok", summary: "no session — config read fresh at launch" };
+        }
+        const configPath = path.join(ctx.appRoot, `Pulumi.${ctx.stack}.yaml`);
+        if (!fs.existsSync(configPath)) {
+            return {
+                status: "ok",
+                summary: `no Pulumi.${ctx.stack}.yaml to compare`,
+            };
+        }
+        const mtimeMs = fs.statSync(configPath).mtimeMs;
+        if (isConfigStale(mtimeMs, state.startedAt)) {
+            return {
+                status: "warn",
+                summary: `Pulumi.${ctx.stack}.yaml changed since launch — a restart won't pick this up`,
+                detail: `config mtime ${new Date(mtimeMs).toISOString()} > session start ${state.startedAt}`,
+                remediation: `mesh deploy up --stack ${ctx.stack} && mesh dev`,
+            };
+        }
+        return { status: "ok", summary: "stack config unchanged since launch" };
+    },
+};
+export const worktreeCheck = {
+    id: "worktree",
+    title: "Worktree",
+    phases: ["preflight", "ondemand"],
+    async run(ctx) {
+        const services = ctx.sessionState?.devOutput.services;
+        if (!services) {
+            return { status: "ok", summary: "no session — worktree checked at launch" };
+        }
+        let repoRoot;
+        try {
+            repoRoot = execFileSync("git", ["rev-parse", "--show-toplevel"], {
+                cwd: ctx.appRoot,
+                encoding: "utf8",
+                stdio: ["ignore", "pipe", "ignore"],
+            }).trim();
+        }
+        catch {
+            return {
+                status: "warn",
+                summary: "could not resolve git worktree root for the app",
+            };
+        }
+        const foreign = Object.entries(services)
+            .filter(([, svc]) => svc.src && !sharesWorktreeRoot(svc.src, repoRoot))
+            .map(([name, svc]) => `${name} → ${svc.src}`);
+        if (foreign.length === 0) {
+            return {
+                status: "ok",
+                summary: `all services resolve under ${repoRoot}`,
+            };
+        }
+        return {
+            status: "warn",
+            summary: `${foreign.length} service(s) resolve outside this worktree — you may be running another worktree's code`,
+            detail: foreign.join("; "),
+            remediation: "relaunch from this worktree: `mesh dev` (re-reads stack output paths)",
+        };
+    },
+};
+// ============================================================================
+// Checks: tunnels + temporal (connectivity)
+// ============================================================================
+/** Resolve `true` iff a TCP connection to host:port succeeds within `timeoutMs`. */
+export function canConnect(host, port, timeoutMs = 800) {
+    return new Promise((resolve) => {
+        const socket = new net.Socket();
+        let settled = false;
+        const done = (ok) => {
+            if (settled)
+                return;
+            settled = true;
+            socket.destroy();
+            resolve(ok);
+        };
+        socket.setTimeout(timeoutMs);
+        socket.once("connect", () => done(true));
+        socket.once("timeout", () => done(false));
+        socket.once("error", () => done(false));
+        socket.connect(port, host);
+    });
+}
+function isLocalHost(host) {
+    return host === "localhost" || host === "127.0.0.1" || host === "::1";
+}
+export const tunnelsCheck = {
+    // On-demand only: pre-launch the tunnels don't exist yet, and dialing the
+    // VPC endpoints they'll use would false-positive on an SSM-only machine.
+    id: "tunnels",
+    title: "Tunnels",
+    phases: ["ondemand"],
+    async run(ctx) {
+        const tunnels = ctx.sessionState?.devOutput.tunnels;
+        if (!tunnels || Object.keys(tunnels).length === 0) {
+            return { status: "ok", summary: "no tunnels in this session" };
+        }
+        // Only dial the SSM-forwarded (localhost) tunnels — those are the ones that
+        // die with "broken pipe → ECONNREFUSED". VPC-direct tunnels are reachable
+        // only over VPN and would false-positive here.
+        const local = Object.entries(tunnels).filter(([, t]) => isLocalHost(t.host));
+        if (local.length === 0) {
+            return {
+                status: "ok",
+                summary: `${Object.keys(tunnels).length} tunnel(s), all VPC-direct (not dialed)`,
+            };
+        }
+        const dead = [];
+        for (const [name, t] of local) {
+            if (!(await canConnect(t.host, t.port)))
+                dead.push(`${name} (${t.host}:${t.port})`);
+        }
+        if (dead.length === 0) {
+            return { status: "ok", summary: `${local.length} SSM tunnel(s) live` };
+        }
+        return {
+            status: "error",
+            summary: `${dead.length} SSM tunnel(s) down`,
+            detail: dead.join("; "),
+            remediation: "relaunch to re-establish tunnels: `mesh dev`",
+        };
+    },
+};
+export const temporalCheck = {
+    // On-demand only: reachability depends on the session's tunnel being up.
+    id: "temporal",
+    title: "Temporal",
+    phases: ["ondemand"],
+    async run(ctx) {
+        const state = ctx.sessionState;
+        const t = state?.devOutput.tunnels["temporal"];
+        if (!state || !t) {
+            return { status: "ok", summary: "no temporal tunnel in this session" };
+        }
+        const addr = `${t.host}:${t.port}`;
+        if (!(await canConnect(t.host, t.port))) {
+            return {
+                status: "error",
+                summary: `Temporal frontend unreachable at ${addr}`,
+                remediation: "tunnel likely down — relaunch: `mesh dev`",
+            };
+        }
+        const p = state.devOutput.platform;
+        const app = state.devOutput.app;
+        if (!p || !app) {
+            return { status: "ok", summary: `frontend reachable at ${addr} (namespace unknown)` };
+        }
+        const namespace = `${p.tenant}-${p.env}-${app}`;
+        try {
+            const { Connection } = await import("@temporalio/client");
+            const connection = await Connection.connect({
+                address: addr,
+                connectTimeout: "3s",
+            });
+            try {
+                await connection.workflowService.describeNamespace({ namespace });
+                return { status: "ok", summary: `frontend reachable; namespace ${namespace} present` };
+            }
+            finally {
+                await connection.close().catch(() => { });
+            }
+        }
+        catch (err) {
+            const code = err.code;
+            // gRPC status: 5 NOT_FOUND, 7 PERMISSION_DENIED, 16 UNAUTHENTICATED.
+            if (code === 5) {
+                return {
+                    status: "error",
+                    summary: `namespace ${namespace} not found on the server`,
+                    remediation: `verify the app is deployed to this env (mesh deploy up --stack ${ctx.stack})`,
+                };
+            }
+            if (code === 7 || code === 16) {
+                return {
+                    status: "ok",
+                    summary: `frontend reachable; namespace ${namespace} auth-gated (not verified)`,
+                };
+            }
+            return {
+                status: "warn",
+                summary: "frontend reachable but namespace check errored",
+                detail: err instanceof Error ? err.message : String(err),
+            };
+        }
+    },
+};
+// ============================================================================
+// Registry + runner
+// ============================================================================
+/** All checks, in display order. */
+export const ALL_CHECKS = [
+    tmuxCheck,
+    credsCheck,
+    registryCheck,
+    configStalenessCheck,
+    portsCheck,
+    worktreeCheck,
+    tunnelsCheck,
+    temporalCheck,
+];
+/**
+ * Run the full on-demand doctor against a prebuilt context, print the report,
+ * and return the aggregate status. The caller (the `mesh dev doctor`
+ * subcommand) owns process exit.
+ */
+export async function runDoctor(ctx, opts) {
+    const results = await runChecks(ctx, "ondemand", ALL_CHECKS);
+    const status = aggregateStatus(results.map((r) => r.result));
+    if (opts.json) {
+        console.log(renderJson(results));
+    }
+    else {
+        console.log(renderHuman(results));
+        console.log(`\n${ICONS[status]} overall: ${status}`);
+    }
+    return status;
+}
+//# sourceMappingURL=dev-doctor.js.map