@mesh-tech/mesh-cli 0.1.0

package/dist/src/utils/credentials.js

@@ -0,0 +1,145 @@
+/**
+ * Database credential utilities
+ */
+import { SecretsManagerClient, GetSecretValueCommand, } from "@aws-sdk/client-secrets-manager";
+import { logInfo, logSuccess } from "./log.js";
+/**
+ * Get DATABASE_URL from Secrets Manager.
+ *
+ * Credential path patterns:
+ *   - With app:    mesh/{tenant}/{stage}/{app}/db-credentials
+ *   - Without app: mesh/{tenant}/{stage}/db-credentials
+ *
+ * Returns the DATABASE_URL string directly. Use rewriteDatabaseUrl() to
+ * modify host/port for tunnel usage.
+ */
+export async function getDatabaseUrl(tenant, stage, options) {
+    const secretsManager = new SecretsManagerClient({});
+    // Build secret path - with or without app name
+    const secretName = options?.app
+        ? `mesh/${tenant}/${stage}/${options.app}/db-credentials`
+        : `mesh/${tenant}/${stage}/db-credentials`;
+    logInfo(`Looking up credentials at ${secretName}...`);
+    try {
+        const response = await secretsManager.send(new GetSecretValueCommand({ SecretId: secretName }));
+        if (response.SecretString) {
+            const secret = JSON.parse(response.SecretString);
+            // Handle DATABASE_URL format (preferred)
+            if (secret.DATABASE_URL) {
+                const parsed = new URL(secret.DATABASE_URL);
+                logSuccess(`Got credentials for user: ${parsed.username}`);
+                return secret.DATABASE_URL;
+            }
+            // Handle individual fields format (legacy)
+            if (secret.username && secret.password) {
+                logSuccess(`Got credentials for user: ${secret.username}`);
+                const database = secret.dbname ?? secret.database ?? "postgres";
+                return `postgresql://${secret.username}:${encodeURIComponent(secret.password)}@${secret.host ?? "localhost"}:${secret.port ?? 5432}/${database}`;
+            }
+            throw new Error(`Secret ${secretName} has unexpected format (needs DATABASE_URL or username/password)`);
+        }
+    }
+    catch (error) {
+        if (error.message?.includes("unexpected format")) {
+            throw error;
+        }
+        // Secret not found - will be caught by caller
+    }
+    throw new Error(`Could not find credentials at ${secretName}`);
+}
+/**
+ * @deprecated Use getDatabaseUrl instead - returns DATABASE_URL directly
+ */
+export async function getDbCredentials(tenant, stage, _platformEnv, rdsHost, rdsPort, options) {
+    const databaseUrl = await getDatabaseUrl(tenant, stage, options);
+    const parsed = new URL(databaseUrl);
+    return {
+        username: parsed.username,
+        password: decodeURIComponent(parsed.password),
+        host: rdsHost,
+        port: rdsPort,
+        database: parsed.pathname.slice(1),
+    };
+}
+/**
+ * Rewrite DATABASE_URL with new endpoint and/or SSL mode.
+ * Preserves username, password, database name, and other query params.
+ *
+ * Used by both mesh-env-exec (for sst dev) and mesh db exec (for ad-hoc commands).
+ */
+export function rewriteDatabaseUrl(url, options) {
+    try {
+        const parsed = new URL(url);
+        // Rewrite endpoint if provided
+        if (options.endpoint) {
+            if (options.endpoint.includes(":")) {
+                const colonIndex = options.endpoint.lastIndexOf(":");
+                parsed.hostname = options.endpoint.slice(0, colonIndex);
+                parsed.port = options.endpoint.slice(colonIndex + 1);
+            }
+            else {
+                parsed.hostname = options.endpoint;
+                parsed.port = parsed.port || "5432";
+            }
+        }
+        // Set SSL mode if provided
+        if (options.sslMode) {
+            parsed.searchParams.set("sslmode", options.sslMode);
+            // For Prisma: accept invalid/self-signed certificates through tunnels
+            if (options.sslMode === "require" || options.sslMode === "no-verify") {
+                parsed.searchParams.set("sslaccept", "accept_invalid_certs");
+            }
+        }
+        return parsed.toString();
+    }
+    catch {
+        // If URL parsing fails, return original
+        return url;
+    }
+}
+/**
+ * Build a DATABASE_URL from credentials.
+ */
+export function buildDatabaseUrl(creds, options) {
+    const host = options?.endpoint?.split(":")[0] ?? creds.host;
+    const port = options?.endpoint?.split(":")[1] ?? String(creds.port);
+    let url = `postgresql://${creds.username}:${encodeURIComponent(creds.password)}@${host}:${port}/${creds.database}`;
+    if (options?.sslMode) {
+        url += `?sslmode=${options.sslMode}`;
+        if (options.sslMode === "require" || options.sslMode === "no-verify") {
+            url += "&sslaccept=accept_invalid_certs";
+        }
+    }
+    return url;
+}
+/**
+ * Try to read database info from SST outputs (when sst dev has run).
+ */
+export async function readSstOutputs() {
+    const fs = await import("fs");
+    if (!fs.existsSync(".sst/outputs.json")) {
+        return null;
+    }
+    try {
+        const content = fs.readFileSync(".sst/outputs.json", "utf-8");
+        const outputs = JSON.parse(content);
+        if (outputs.databaseUrl) {
+            logInfo("Found SST outputs with database config");
+            // Extract secret ARN from URL if present
+            const secretArnMatch = outputs.databaseUrl.match(/secretArn=([^&]+)/);
+            const secretArn = secretArnMatch
+                ? decodeURIComponent(secretArnMatch[1])
+                : undefined;
+            return {
+                databaseUrl: outputs.databaseUrl,
+                databaseName: outputs.databaseName,
+                secretArn,
+            };
+        }
+    }
+    catch {
+        // Ignore parse errors
+    }
+    return null;
+}
+//# sourceMappingURL=credentials.js.map

package/dist/src/utils/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/utils/credentials.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAkB/C;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,KAAa,EACb,OAAiC;IAEjC,MAAM,cAAc,GAAG,IAAI,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAEpD,+CAA+C;IAC/C,MAAM,UAAU,GAAG,OAAO,EAAE,GAAG;QAC7B,CAAC,CAAC,QAAQ,MAAM,IAAI,KAAK,IAAI,OAAO,CAAC,GAAG,iBAAiB;QACzD,CAAC,CAAC,QAAQ,MAAM,IAAI,KAAK,iBAAiB,CAAC;IAC7C,OAAO,CAAC,6BAA6B,UAAU,KAAK,CAAC,CAAC;IAEtD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,CACxC,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CACpD,CAAC;QAEF,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAEjD,yCAAyC;YACzC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBAC5C,UAAU,CAAC,6BAA6B,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC3D,OAAO,MAAM,CAAC,YAAY,CAAC;YAC7B,CAAC;YAED,2CAA2C;YAC3C,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACvC,UAAU,CAAC,6BAA6B,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,IAAI,UAAU,CAAC;gBAChE,OAAO,gBAAgB,MAAM,CAAC,QAAQ,IAAI,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,IAAI,WAAW,IAAI,MAAM,CAAC,IAAI,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;YACnJ,CAAC;YAED,MAAM,IAAI,KAAK,CAAC,UAAU,UAAU,kEAAkE,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC5D,MAAM,KAAK,CAAC;QACd,CAAC;QACD,8CAA8C;IAChD,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,iCAAiC,UAAU,EAAE,CAAC,CAAC;AACjE,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,KAAa,EACb,YAAoB,EACpB,OAAe,EACf,OAAe,EACf,OAAiC;IAEjC,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAEpC,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC7C,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;KACnC,CAAC;AACJ,CAAC;AAYD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAW,EACX,OAAkC;IAElC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAE5B,+BAA+B;QAC/B,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBACrD,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;gBACxD,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;gBACnC,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC;YACtC,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YACpD,sEAAsE;YACtE,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;gBACrE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;QACxC,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAA0B,EAC1B,OAAmC;IAEnC,MAAM,IAAI,GAAG,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC;IAC5D,MAAM,IAAI,GAAG,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEpE,IAAI,GAAG,GAAG,gBAAgB,KAAK,CAAC,QAAQ,IAAI,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;IAEnH,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,GAAG,IAAI,YAAY,OAAO,CAAC,OAAO,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;YACrE,GAAG,IAAI,iCAAiC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAKlC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAE9B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEpC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,OAAO,CAAC,wCAAwC,CAAC,CAAC;YAElD,yCAAyC;YACzC,MAAM,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACtE,MAAM,SAAS,GAAG,cAAc;gBAC9B,CAAC,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;gBACvC,CAAC,CAAC,SAAS,CAAC;YAEd,OAAO;gBACL,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,SAAS;aACV,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/utils/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Utility exports
+ */
+export * from "./log.js";
+export * from "./context.js";
+export * from "./bastion.js";
+export * from "./credentials.js";
+export * from "./pulumi.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/src/utils/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,aAAa,CAAC"}

package/dist/src/utils/index.js

@@ -0,0 +1,9 @@
+/**
+ * Utility exports
+ */
+export * from "./log.js";
+export * from "./context.js";
+export * from "./bastion.js";
+export * from "./credentials.js";
+export * from "./pulumi.js";
+//# sourceMappingURL=index.js.map

package/dist/src/utils/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,aAAa,CAAC"}

package/dist/src/utils/log.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Logging utilities with colored output
+ */
+export declare function logInfo(message: string): void;
+export declare function logSuccess(message: string): void;
+export declare function logWarn(message: string): void;
+export declare function logError(message: string): void;
+//# sourceMappingURL=log.d.ts.map

package/dist/src/utils/log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../../../src/utils/log.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE7C;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEhD;AAED,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE7C;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE9C"}

package/dist/src/utils/log.js

@@ -0,0 +1,17 @@
+/**
+ * Logging utilities with colored output
+ */
+import chalk from "chalk";
+export function logInfo(message) {
+    console.error(chalk.blue("ℹ"), message);
+}
+export function logSuccess(message) {
+    console.error(chalk.green("✓"), message);
+}
+export function logWarn(message) {
+    console.error(chalk.yellow("⚠"), message);
+}
+export function logError(message) {
+    console.error(chalk.red("✗"), message);
+}
+//# sourceMappingURL=log.js.map

package/dist/src/utils/log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../../../src/utils/log.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,UAAU,OAAO,CAAC,OAAe;IACrC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,OAAe;IACrC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC"}

package/dist/src/utils/pulumi.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Pulumi-related utilities shared across CLI commands.
+ */
+/**
+ * Find the Pulumi app root by walking up from a starting directory.
+ * Returns the first directory containing `Pulumi.yaml`, or null.
+ */
+export declare function findAppRoot(startDir: string): string | null;
+/**
+ * Find Pulumi.<stack>.yaml files in a directory.
+ * Returns an array of stack names (without the Pulumi. prefix and .yaml suffix).
+ */
+export declare function findStackConfigs(appRoot: string): string[];
+/**
+ * Get the currently selected Pulumi stack name, or null.
+ */
+export declare function getCurrentStack(appRoot: string): string | null;
+/**
+ * Read a config value from Pulumi.<stack>.yaml.
+ * Simple regex-based parser — handles single-line string values.
+ * For complex values, use `pulumi config` CLI instead.
+ */
+export declare function readStackConfig(appRoot: string, stack: string, key: string): string | null;
+//# sourceMappingURL=pulumi.d.ts.map

package/dist/src/utils/pulumi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pulumi.d.ts","sourceRoot":"","sources":["../../../src/utils/pulumi.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH;;;GAGG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ3D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAI1D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW9D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU1F"}

package/dist/src/utils/pulumi.js

@@ -0,0 +1,63 @@
+/**
+ * Pulumi-related utilities shared across CLI commands.
+ */
+import { execFileSync } from "child_process";
+import * as path from "path";
+import * as fs from "fs";
+/**
+ * Find the Pulumi app root by walking up from a starting directory.
+ * Returns the first directory containing `Pulumi.yaml`, or null.
+ */
+export function findAppRoot(startDir) {
+    let dir = startDir;
+    while (true) {
+        if (fs.existsSync(path.join(dir, "Pulumi.yaml")))
+            return dir;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+/**
+ * Find Pulumi.<stack>.yaml files in a directory.
+ * Returns an array of stack names (without the Pulumi. prefix and .yaml suffix).
+ */
+export function findStackConfigs(appRoot) {
+    return fs.readdirSync(appRoot)
+        .filter((f) => /^Pulumi\..+\.yaml$/.test(f) && f !== "Pulumi.yaml")
+        .map((f) => f.replace(/^Pulumi\./, "").replace(/\.yaml$/, ""));
+}
+/**
+ * Get the currently selected Pulumi stack name, or null.
+ */
+export function getCurrentStack(appRoot) {
+    try {
+        const result = execFileSync("pulumi", ["stack", "--show-name"], {
+            encoding: "utf-8",
+            cwd: appRoot,
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        return result.trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Read a config value from Pulumi.<stack>.yaml.
+ * Simple regex-based parser — handles single-line string values.
+ * For complex values, use `pulumi config` CLI instead.
+ */
+export function readStackConfig(appRoot, stack, key) {
+    const configFile = path.join(appRoot, `Pulumi.${stack}.yaml`);
+    if (!fs.existsSync(configFile))
+        return null;
+    const content = fs.readFileSync(configFile, "utf-8");
+    const pattern = new RegExp(`^\\s+${key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}:\\s*(.+)$`, "m");
+    const match = content.match(pattern);
+    if (!match)
+        return null;
+    return match[1].trim().replace(/^["']|["']$/g, "");
+}
+//# sourceMappingURL=pulumi.js.map

package/dist/src/utils/pulumi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pulumi.js","sourceRoot":"","sources":["../../../src/utils/pulumi.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,aAAa,CAAC;SAClE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE;YAC9D,QAAQ,EAAE,OAAO;YACjB,GAAG,EAAE,OAAO;YACZ,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,KAAa,EAAE,GAAW;IACzE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC;IAC9D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,OAAO,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC"}

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "@mesh-tech/mesh-cli",
+  "version": "0.1.0",
+  "description": "CLI for Mesh platform development — auth, deploy, registry, tunnels, and more",
+  "type": "module",
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/mesh-tech/mesh-platform.git",
+    "directory": "libs/mesh-cli"
+  },
+  "bin": {
+    "mesh": "./dist/bin/mesh.js"
+  },
+  "files": [
+    "dist",
+    "templates"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "tsc"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/src/index.d.ts",
+      "default": "./dist/src/index.js"
+    }
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0"
+  },
+  "dependencies": {
+    "@aws-sdk/client-secrets-manager": "^3.700.0",
+    "@aws-sdk/client-ssm": "^3.700.0",
+    "@inquirer/input": "^5.0.8",
+    "@inquirer/password": "^5.0.8",
+    "chalk": "^5.3.0",
+    "commander": "^12.1.0",
+    "handlebars": "^4.7.8"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  }
+}

package/templates/api-web-db/api/.dockerignore

@@ -0,0 +1,2 @@
+node_modules
+dist

package/templates/api-web-db/api/Dockerfile

@@ -0,0 +1,16 @@
+FROM node:22-alpine AS builder
+WORKDIR /app
+COPY package.json ./
+RUN npm install
+COPY tsconfig.json ./
+COPY src ./src
+RUN npm run build
+
+FROM node:22-alpine
+WORKDIR /app
+COPY package.json ./
+RUN npm install --omit=dev
+COPY --from=builder /app/dist ./dist
+ENV NODE_ENV=production PORT=3001
+EXPOSE 3001
+CMD ["node", "dist/index.js"]

package/templates/api-web-db/api/package.json.hbs

@@ -0,0 +1,21 @@
+{
+  "name": "{{name}}-api",
+  "type": "module",
+  "scripts": {
+    "dev": "tsx watch src/index.ts",
+    "build": "tsc",
+    "start": "node dist/index.js"
+  },
+  "dependencies": {
+    "@aws-sdk/client-secrets-manager": "^3.964.0",
+    "@hono/node-server": "^1.13.7",
+    "hono": "^4.6.14",
+    "pg": "^8.16.3"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.5",
+    "@types/pg": "^8.16.0",
+    "tsx": "^4.19.2",
+    "typescript": "^5.7.2"
+  }
+}

package/templates/api-web-db/api/src/index.ts.hbs

@@ -0,0 +1,123 @@
+import { serve } from "@hono/node-server";
+import { Hono } from "hono";
+import { cors } from "hono/cors";
+import { logger } from "hono/logger";
+import { Pool } from "pg";
+import {
+  SecretsManagerClient,
+  GetSecretValueCommand,
+} from "@aws-sdk/client-secrets-manager";
+
+const app = new Hono();
+
+// Middleware
+app.use("*", logger());
+app.use("*", cors());
+
+// =============================================================================
+// Database Connection
+// =============================================================================
+
+let dbPool: Pool | null = null;
+
+async function getDbPassword(): Promise<string> {
+  const secretArn = process.env.DB_SECRET_ARN;
+  if (!secretArn) {
+    throw new Error("DB_SECRET_ARN not configured");
+  }
+
+  const client = new SecretsManagerClient({ region: "us-east-1" });
+  const response = await client.send(
+    new GetSecretValueCommand({ SecretId: secretArn })
+  );
+
+  if (!response.SecretString) {
+    throw new Error("No secret value found");
+  }
+
+  const secret = JSON.parse(response.SecretString);
+  return secret.password;
+}
+
+async function getDbPool(): Promise<Pool> {
+  if (dbPool) return dbPool;
+
+  const password = await getDbPassword();
+
+  dbPool = new Pool({
+    host: process.env.DB_HOST || "localhost",
+    port: parseInt(process.env.DB_PORT || "5432", 10),
+    database: process.env.DB_NAME || "postgres",
+    user: process.env.DB_USER || "postgres",
+    password,
+    ssl: { rejectUnauthorized: false },
+    max: 10,
+    idleTimeoutMillis: 30000,
+    connectionTimeoutMillis: 5000,
+  });
+
+  return dbPool;
+}
+
+// =============================================================================
+// Routes
+// =============================================================================
+
+// Root - API info
+app.get("/", (c) =>
+  c.json({
+    name: "{{name}}-api",
+    version: "1.0.0",
+    endpoints: ["/health", "/hello", "/db"],
+  })
+);
+
+// Health check (required for ALB)
+app.get("/health", (c) => c.json({ status: "ok" }));
+
+// Hello endpoint
+app.get("/hello", (c) => {
+  return c.json({
+    message: "Hello from {{name}} API!",
+    stage: process.env.STAGE || "unknown",
+    timestamp: new Date().toISOString(),
+  });
+});
+
+// Database endpoint
+app.get("/db", async (c) => {
+  try {
+    const pool = await getDbPool();
+    const result = await pool.query(
+      "SELECT version(), current_database(), current_user"
+    );
+    const row = result.rows[0];
+
+    return c.json({
+      status: "connected",
+      database: row.current_database,
+      user: row.current_user,
+      version: row.version,
+      timestamp: new Date().toISOString(),
+    });
+  } catch (error) {
+    return c.json(
+      {
+        status: "error",
+        message: error instanceof Error ? error.message : "Unknown error",
+      },
+      500
+    );
+  }
+});
+
+// =============================================================================
+// Start Server
+// =============================================================================
+
+const port = parseInt(process.env.PORT || "3001", 10);
+console.log(`API server starting on port ${port}...`);
+
+serve({ fetch: app.fetch, port });
+
+console.log(`API server running at http://localhost:${port}`);

package/templates/api-web-db/api/tsconfig.json

@@ -0,0 +1,13 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "esModuleInterop": true,
+    "strict": true,
+    "skipLibCheck": true,
+    "outDir": "./dist",
+    "rootDir": "./src"
+  },
+  "include": ["src/**/*"]
+}

package/templates/api-web-db/package.json.hbs

@@ -0,0 +1,27 @@
+{
+  "name": "{{name}}",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "sst:patch": "patch-sst-pulumi .",
+    "dev": "pnpm run sst:patch && sst dev",
+    "deploy": "pnpm run sst:patch && sst deploy",
+    "deploy:dev": "pnpm run sst:patch && sst deploy --stage dev",
+    "deploy:prod": "pnpm run sst:patch && sst deploy --stage prod",
+    "remove": "sst remove"
+  },
+  "dependencies": {
+    "@mesh-tech/infra-components": "workspace:*",
+    "@pulumi/aws": "6.66.2",
+    "@pulumi/docker-build": "^0.0.15",
+    "@pulumi/eks": "4.2.0",
+    "@pulumi/kubernetes": "4.24.1",
+    "@pulumi/pulumi": "3.214.1",
+    "sst": "^3.3.61"
+  },
+  "devDependencies": {
+    "@aws-sdk/credential-providers": "^3.964.0",
+    "typescript": "^5.7.2"
+  }
+}