@mesh-tech/mesh-cli 0.1.0

package/dist/src/commands/db/exec.js

@@ -0,0 +1,331 @@
+/**
+ * mesh db exec - Run any command with database connection
+ *
+ * Three modes of operation:
+ *
+ * 1. Explicit mode (recommended for ad-hoc use):
+ *    mesh db exec --tenant=<tenant> --env=<env> [--ssl=require] -- <command>
+ *    - Uses explicit tenant/env to find platform bastion
+ *    - Starts tunnel if needed
+ *    - Similar to: mesh tunnel --tenant mesh --env dev
+ *
+ * 2. Direct mode (for sst dev integration):
+ *    mesh db exec --secret=<arn> [--ssl=require] -- <command>
+ *    - Uses secret ARN directly, expects tunnel already running
+ *    - Ideal for sst.config.ts devCommand
+ *
+ * 3. Discovery mode (legacy, auto-detection):
+ *    mesh db exec [--stage=<stage>] -- <command>
+ *    - Auto-discovers tenant/env from filesystem and config files
+ *    - Can be fragile if project structure doesn't match expected patterns
+ *    - Starts tunnel if needed
+ *
+ * Examples:
+ *   # Explicit mode (recommended)
+ *   mesh db exec --tenant mesh --env dev --ssl=require -- npx prisma db push
+ *   mesh db exec -t mesh -e dev -- npx prisma migrate dev
+ *
+ *   # Direct mode (in sst.config.ts)
+ *   mesh db exec --secret=arn:aws:secretsmanager:... --ssl=require -- pnpm dev
+ *
+ *   # Discovery mode (legacy)
+ *   mesh db exec -- npx prisma db push
+ *   mesh db exec --stage=dev -- npx prisma migrate dev
+ */
+import { spawn } from "child_process";
+import * as net from "net";
+import * as fs from "fs";
+import * as path from "path";
+import { SecretsManagerClient, GetSecretValueCommand, } from "@aws-sdk/client-secrets-manager";
+import { detectContext, getPlatformBastionInfo, getDatabaseUrl, rewriteDatabaseUrl, logInfo, logSuccess, logError, logWarn, } from "../../utils/index.js";
+const DEFAULT_LOCAL_PORT = 5432;
+const MAX_RETRIES = 12;
+const RETRY_DELAY_MS = 5000;
+/**
+ * Find SST outputs by looking in current and parent directories.
+ */
+function findSstOutputs() {
+    let dir = process.cwd();
+    const root = path.parse(dir).root;
+    while (dir !== root) {
+        const outputsPath = path.join(dir, ".sst", "outputs.json");
+        if (fs.existsSync(outputsPath)) {
+            try {
+                const content = fs.readFileSync(outputsPath, "utf-8");
+                const outputs = JSON.parse(content);
+                if (outputs.databaseUrl) {
+                    const secretArnMatch = outputs.databaseUrl.match(/secretArn=([^&]+)/);
+                    const secretArn = secretArnMatch
+                        ? decodeURIComponent(secretArnMatch[1])
+                        : undefined;
+                    return {
+                        databaseUrl: outputs.databaseUrl,
+                        databaseName: outputs.databaseName,
+                        secretArn,
+                        rootDir: dir,
+                    };
+                }
+            }
+            catch {
+                // Ignore parse errors, continue searching
+            }
+        }
+        dir = path.dirname(dir);
+    }
+    return null;
+}
+function checkPort(port) {
+    return new Promise((resolve) => {
+        const socket = new net.Socket();
+        socket.setTimeout(500);
+        socket.on("connect", () => { socket.destroy(); resolve(true); });
+        socket.on("timeout", () => { socket.destroy(); resolve(false); });
+        socket.on("error", () => { socket.destroy(); resolve(false); });
+        socket.connect(port, "localhost");
+    });
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function startTunnelBackground(instanceId, rdsEndpoint, rdsPort, localPort) {
+    logInfo("Starting database tunnel...");
+    const tunnel = spawn("aws", [
+        "ssm",
+        "start-session",
+        "--target",
+        instanceId,
+        "--document-name",
+        "AWS-StartPortForwardingSessionToRemoteHost",
+        "--parameters",
+        JSON.stringify({
+            host: [rdsEndpoint],
+            portNumber: [String(rdsPort)],
+            localPortNumber: [String(localPort)],
+        }),
+    ], { stdio: ["ignore", "ignore", "ignore"] });
+    const maxAttempts = 15;
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+        if (tunnel.exitCode !== null) {
+            throw new Error("Tunnel process died");
+        }
+        if (await checkPort(localPort)) {
+            logSuccess(`Tunnel started (PID: ${tunnel.pid})`);
+            return tunnel;
+        }
+        await sleep(1000);
+    }
+    tunnel.kill();
+    throw new Error(`Tunnel failed to start after ${maxAttempts} seconds`);
+}
+/**
+ * Fetch secret from Secrets Manager with retry logic for provisioning delays.
+ */
+async function fetchSecretWithRetry(client, secretId) {
+    let lastError;
+    for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) {
+        try {
+            const response = await client.send(new GetSecretValueCommand({ SecretId: secretId }));
+            if (!response.SecretString) {
+                throw new Error(`Secret ${secretId} has no string value`);
+            }
+            return JSON.parse(response.SecretString);
+        }
+        catch (error) {
+            lastError = error;
+            const isNotFound = error.name === "ResourceNotFoundException";
+            if (isNotFound && attempt < MAX_RETRIES) {
+                logWarn(`Secret not found (attempt ${attempt}/${MAX_RETRIES}), waiting...`);
+                await sleep(RETRY_DELAY_MS);
+                continue;
+            }
+            throw error;
+        }
+    }
+    throw lastError;
+}
+export async function execCommand(commandArgs, options) {
+    if (commandArgs.length === 0) {
+        logError("No command specified");
+        logInfo("Usage: mesh db exec [options] -- <command> [args...]");
+        logInfo("");
+        logInfo("Options:");
+        logInfo("  -t, --tenant <tenant>  Platform tenant (e.g., mesh)");
+        logInfo("  -e, --env <env>        Platform environment (e.g., dev)");
+        logInfo("  --secret <arn>         Use secret ARN directly (skips SSM discovery)");
+        logInfo("  --db-host <host>       Database host (skips SSM lookup)");
+        logInfo("  --ssl <mode>           SSL mode: require, no-verify, disable");
+        logInfo("  --port <port>          Local port for tunnel (default: 5432)");
+        logInfo("  --stage <stage>        Stage for legacy discovery mode");
+        logInfo("");
+        logInfo("Examples:");
+        logInfo("  # Explicit mode (recommended)");
+        logInfo("  mesh db exec --tenant mesh --env dev --ssl=require -- npx prisma db push");
+        logInfo("");
+        logInfo("  # Direct mode (with existing tunnel)");
+        logInfo("  mesh db exec --secret=arn:aws:... --ssl=require -- pnpm dev");
+        process.exit(1);
+    }
+    const localPort = options.port ? parseInt(options.port, 10) : DEFAULT_LOCAL_PORT;
+    const secretsManager = new SecretsManagerClient({});
+    let tunnel = null;
+    let databaseUrl;
+    // ==========================================================================
+    // Direct mode: --secret provided, use it directly
+    // ==========================================================================
+    if (options.secret) {
+        logInfo(`Direct mode: using secret ${options.secret}`);
+        // Check if tunnel is running
+        const tunnelExists = await checkPort(localPort);
+        if (!tunnelExists) {
+            logError(`No tunnel found on port ${localPort}`);
+            logInfo("In direct mode, start a tunnel first with: mesh db connect");
+            logInfo("Or use discovery mode (without --secret) to auto-start tunnel");
+            process.exit(1);
+        }
+        logSuccess(`Using existing tunnel on port ${localPort}`);
+        // Fetch secret
+        logInfo(`Fetching credentials from secret...`);
+        const secret = await fetchSecretWithRetry(secretsManager, options.secret);
+        // Secret should contain DATABASE_URL directly (new format)
+        if (secret.DATABASE_URL) {
+            databaseUrl = secret.DATABASE_URL;
+            logSuccess("Got DATABASE_URL from secret");
+        }
+        else if (secret.username && secret.password) {
+            // Legacy format with individual fields
+            const dbName = secret.dbname ?? secret.database ?? "postgres";
+            databaseUrl = `postgresql://${secret.username}:${encodeURIComponent(secret.password)}@localhost:${localPort}/${dbName}`;
+            logSuccess(`Got credentials for user: ${secret.username}`);
+        }
+        else {
+            logError("Secret must contain DATABASE_URL or username/password fields");
+            process.exit(1);
+        }
+        // Rewrite DATABASE_URL for local tunnel
+        try {
+            const parsed = new URL(databaseUrl);
+            parsed.hostname = "localhost";
+            parsed.port = String(localPort);
+            // Apply SSL mode if specified
+            if (options.ssl) {
+                parsed.searchParams.set("sslmode", options.ssl);
+                if (options.ssl === "require" || options.ssl === "no-verify") {
+                    parsed.searchParams.set("sslaccept", "accept_invalid_certs");
+                }
+            }
+            databaseUrl = parsed.toString();
+        }
+        catch {
+            logWarn("Could not parse DATABASE_URL for rewriting");
+        }
+    }
+    // ==========================================================================
+    // Discovery mode: find credentials via SSM lookups
+    // ==========================================================================
+    else {
+        // Use explicit --tenant/--env if provided, otherwise fall back to detectContext
+        let platformTenant;
+        let platformEnv;
+        if (options.tenant && options.env) {
+            // Explicit mode: use provided tenant/env directly (like tunnel command)
+            platformTenant = options.tenant;
+            platformEnv = options.env;
+            logInfo(`Explicit mode: Platform Tenant=${platformTenant}, Platform Env=${platformEnv}`);
+        }
+        else if (options.tenant || options.env) {
+            // Partial explicit mode - warn and require both
+            logError("Both --tenant and --env are required when using explicit mode");
+            logInfo("Usage: mesh db exec --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev -- <command>");
+            logInfo("Or omit both to use auto-detection");
+            process.exit(1);
+        }
+        else {
+            // Auto-detection mode (legacy behavior)
+            const ctx = detectContext();
+            platformTenant = ctx.tenant;
+            platformEnv = ctx.platformEnv;
+            logInfo(`Discovery mode: Platform=${platformEnv}, Tenant=${platformTenant}`);
+        }
+        // For credentials, use app-specific options if provided, else fall back to platform values
+        const appTenant = options.appTenant ?? platformTenant;
+        const appStage = options.appStage ?? platformEnv;
+        const appName = options.app;
+        if (appName) {
+            logInfo(`App credentials: tenant=${appTenant}, stage=${appStage}, app=${appName}`);
+        }
+        const tunnelExists = await checkPort(localPort);
+        // Try SST outputs first (fast path when sst dev is running)
+        const sstOutputs = findSstOutputs();
+        if (sstOutputs?.secretArn && tunnelExists) {
+            logInfo(`Found SST outputs in: ${sstOutputs.rootDir}`);
+            try {
+                const secret = await fetchSecretWithRetry(secretsManager, sstOutputs.secretArn);
+                if (secret.DATABASE_URL) {
+                    databaseUrl = rewriteDatabaseUrl(secret.DATABASE_URL, {
+                        endpoint: `localhost:${localPort}`,
+                        sslMode: options.ssl,
+                    });
+                    logSuccess(`Using DATABASE_URL from SST outputs`);
+                }
+            }
+            catch {
+                logWarn("Could not fetch from SST outputs, falling back to credential lookup");
+            }
+        }
+        // Lookup credentials from Secrets Manager if not found in SST outputs
+        if (!databaseUrl) {
+            // Start tunnel if needed
+            if (!tunnelExists) {
+                const bastion = await getPlatformBastionInfo(platformTenant, platformEnv);
+                const rdsService = bastion.services.rds;
+                if (!rdsService) {
+                    throw new Error("RDS service not available in platform bastion");
+                }
+                tunnel = await startTunnelBackground(bastion.instanceId, rdsService.host, rdsService.port, localPort);
+            }
+            else {
+                logSuccess(`Using existing tunnel on port ${localPort}`);
+            }
+            // Get DATABASE_URL and rewrite for tunnel
+            const rawUrl = await getDatabaseUrl(appTenant, appStage, { app: appName });
+            databaseUrl = rewriteDatabaseUrl(rawUrl, {
+                endpoint: `localhost:${localPort}`,
+                sslMode: options.ssl,
+            });
+        }
+    }
+    // ==========================================================================
+    // Set NODE_TLS_REJECT_UNAUTHORIZED for SSL through tunnels
+    // ==========================================================================
+    const env = { ...process.env, DATABASE_URL: databaseUrl };
+    if (options.ssl === "require" || options.ssl === "no-verify") {
+        env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
+        logInfo("Set NODE_TLS_REJECT_UNAUTHORIZED=0 for SSL through tunnel");
+    }
+    // ==========================================================================
+    // Cleanup and run command
+    // ==========================================================================
+    const cleanup = () => {
+        if (tunnel) {
+            logInfo("Stopping tunnel...");
+            tunnel.kill();
+        }
+    };
+    process.on("exit", cleanup);
+    process.on("SIGINT", cleanup);
+    process.on("SIGTERM", cleanup);
+    const [cmd, ...args] = commandArgs;
+    logInfo(`Running: ${commandArgs.join(" ")}`);
+    console.log("");
+    const child = spawn(cmd, args, { stdio: "inherit", env });
+    child.on("exit", (code) => {
+        cleanup();
+        process.exit(code ?? 0);
+    });
+    child.on("error", (err) => {
+        logError(`Failed to run command: ${err.message}`);
+        cleanup();
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=exec.js.map

package/dist/src/commands/db/exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../../../src/commands/db/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,KAAK,EAAgB,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,GAAG,MAAM,KAAK,CAAC;AAC3B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,cAAc,EACd,kBAAkB,EAClB,OAAO,EACP,UAAU,EACV,QAAQ,EACR,OAAO,GACR,MAAM,sBAAsB,CAAC;AAE9B,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B;;GAEG;AACH,SAAS,cAAc;IAMrB,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAElC,OAAO,GAAG,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;QAC3D,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;gBACtD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAEpC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;oBACxB,MAAM,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;oBACtE,MAAM,SAAS,GAAG,cAAc;wBAC9B,CAAC,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;wBACvC,CAAC,CAAC,SAAS,CAAC;oBAEd,OAAO;wBACL,WAAW,EAAE,OAAO,CAAC,WAAW;wBAChC,YAAY,EAAE,OAAO,CAAC,YAAY;wBAClC,SAAS;wBACT,OAAO,EAAE,GAAG;qBACb,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;QACH,CAAC;QACD,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAqBD,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,UAAkB,EAClB,WAAmB,EACnB,OAAe,EACf,SAAiB;IAEjB,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAEvC,MAAM,MAAM,GAAG,KAAK,CAClB,KAAK,EACL;QACE,KAAK;QACL,eAAe;QACf,UAAU;QACV,UAAU;QACV,iBAAiB;QACjB,4CAA4C;QAC5C,cAAc;QACd,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,UAAU,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7B,eAAe,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;SACrC,CAAC;KACH,EACD,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAC1C,CAAC;IAEF,MAAM,WAAW,GAAG,EAAE,CAAC;IACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,MAAM,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,UAAU,CAAC,wBAAwB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,CAAC,IAAI,EAAE,CAAC;IACd,MAAM,IAAI,KAAK,CAAC,gCAAgC,WAAW,UAAU,CAAC,CAAC;AACzE,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,oBAAoB,CACjC,MAA4B,EAC5B,QAAgB;IAEhB,IAAI,SAA4B,CAAC;IAEjC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAClD,CAAC;YAEF,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,UAAU,QAAQ,sBAAsB,CAAC,CAAC;YAC5D,CAAC;YAED,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAc,CAAC;YAC3B,MAAM,UAAU,GAAI,KAA2B,CAAC,IAAI,KAAK,2BAA2B,CAAC;YAErF,IAAI,UAAU,IAAI,OAAO,GAAG,WAAW,EAAE,CAAC;gBACxC,OAAO,CAAC,6BAA6B,OAAO,IAAI,WAAW,eAAe,CAAC,CAAC;gBAC5E,MAAM,KAAK,CAAC,cAAc,CAAC,CAAC;gBAC5B,SAAS;YACX,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,SAAS,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,WAAqB,EACrB,OAAoB;IAEpB,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,sBAAsB,CAAC,CAAC;QACjC,OAAO,CAAC,sDAAsD,CAAC,CAAC;QAChE,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,OAAO,CAAC,UAAU,CAAC,CAAC;QACpB,OAAO,CAAC,uDAAuD,CAAC,CAAC;QACjE,OAAO,CAAC,2DAA2D,CAAC,CAAC;QACrE,OAAO,CAAC,wEAAwE,CAAC,CAAC;QAClF,OAAO,CAAC,2DAA2D,CAAC,CAAC;QACrE,OAAO,CAAC,gEAAgE,CAAC,CAAC;QAC1E,OAAO,CAAC,gEAAgE,CAAC,CAAC;QAC1E,OAAO,CAAC,0DAA0D,CAAC,CAAC;QACpE,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,OAAO,CAAC,WAAW,CAAC,CAAC;QACrB,OAAO,CAAC,iCAAiC,CAAC,CAAC;QAC3C,OAAO,CAAC,4EAA4E,CAAC,CAAC;QACtF,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,OAAO,CAAC,wCAAwC,CAAC,CAAC;QAClD,OAAO,CAAC,+DAA+D,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACjF,MAAM,cAAc,GAAG,IAAI,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACpD,IAAI,MAAM,GAAwB,IAAI,CAAC;IACvC,IAAI,WAA+B,CAAC;IAEpC,6EAA6E;IAC7E,kDAAkD;IAClD,6EAA6E;IAC7E,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,6BAA6B,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAEvD,6BAA6B;QAC7B,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,QAAQ,CAAC,2BAA2B,SAAS,EAAE,CAAC,CAAC;YACjD,OAAO,CAAC,4DAA4D,CAAC,CAAC;YACtE,OAAO,CAAC,+DAA+D,CAAC,CAAC;YACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,UAAU,CAAC,iCAAiC,SAAS,EAAE,CAAC,CAAC;QAEzD,eAAe;QACf,OAAO,CAAC,qCAAqC,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAE1E,2DAA2D;QAC3D,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;YAClC,UAAU,CAAC,8BAA8B,CAAC,CAAC;QAC7C,CAAC;aAAM,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC9C,uCAAuC;YACvC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,IAAI,UAAU,CAAC;YAC9D,WAAW,GAAG,gBAAgB,MAAM,CAAC,QAAQ,IAAI,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,SAAS,IAAI,MAAM,EAAE,CAAC;YACxH,UAAU,CAAC,6BAA6B,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,8DAA8D,CAAC,CAAC;YACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,CAAC,QAAQ,GAAG,WAAW,CAAC;YAC9B,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;YAEhC,8BAA8B;YAC9B,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChB,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;gBAChD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;oBAC7D,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;YAED,WAAW,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,4CAA4C,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,mDAAmD;IACnD,6EAA6E;SACxE,CAAC;QACJ,gFAAgF;QAChF,IAAI,cAAsB,CAAC;QAC3B,IAAI,WAAmB,CAAC;QAExB,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAClC,wEAAwE;YACxE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;YAChC,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC;YAC1B,OAAO,CAAC,kCAAkC,cAAc,kBAAkB,WAAW,EAAE,CAAC,CAAC;QAC3F,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YACzC,gDAAgD;YAChD,QAAQ,CAAC,+DAA+D,CAAC,CAAC;YAC1E,OAAO,CAAC,iHAAiH,CAAC,CAAC;YAC3H,OAAO,CAAC,oCAAoC,CAAC,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,wCAAwC;YACxC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;YAC5B,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC;YAC5B,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;YAC9B,OAAO,CAAC,4BAA4B,WAAW,YAAY,cAAc,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,2FAA2F;QAC3F,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,cAAc,CAAC;QACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC;QACjD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;QAE5B,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,2BAA2B,SAAS,WAAW,QAAQ,SAAS,OAAO,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;QAEhD,4DAA4D;QAC5D,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;QAEpC,IAAI,UAAU,EAAE,SAAS,IAAI,YAAY,EAAE,CAAC;YAC1C,OAAO,CAAC,yBAAyB,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;YAEvD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,cAAc,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;gBAEhF,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;oBACxB,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,EAAE;wBACpD,QAAQ,EAAE,aAAa,SAAS,EAAE;wBAClC,OAAO,EAAE,OAAO,CAAC,GAAG;qBACrB,CAAC,CAAC;oBACH,UAAU,CAAC,qCAAqC,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,qEAAqE,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,yBAAyB;YACzB,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;gBAC1E,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACxC,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;gBACnE,CAAC;gBACD,MAAM,GAAG,MAAM,qBAAqB,CAClC,OAAO,CAAC,UAAU,EAClB,UAAU,CAAC,IAAI,EACf,UAAU,CAAC,IAAI,EACf,SAAS,CACV,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,iCAAiC,SAAS,EAAE,CAAC,CAAC;YAC3D,CAAC;YAED,0CAA0C;YAC1C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YAC3E,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE;gBACvC,QAAQ,EAAE,aAAa,SAAS,EAAE;gBAClC,OAAO,EAAE,OAAO,CAAC,GAAG;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,2DAA2D;IAC3D,6EAA6E;IAC7E,MAAM,GAAG,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;IAE7E,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;QAC7D,GAAG,CAAC,4BAA4B,GAAG,GAAG,CAAC;QACvC,OAAO,CAAC,2DAA2D,CAAC,CAAC;IACvE,CAAC;IAED,6EAA6E;IAC7E,0BAA0B;IAC1B,6EAA6E;IAC7E,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,oBAAoB,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,CAAC;IACH,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAE/B,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,WAAW,CAAC;IACnC,OAAO,CAAC,YAAY,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAE3D,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAmB,EAAE,EAAE;QACvC,OAAO,EAAE,CAAC;QACV,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;QAC/B,QAAQ,CAAC,0BAA0B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAClD,OAAO,EAAE,CAAC;QACV,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/commands/db/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Database commands
+ *
+ * mesh db connect     - Start tunnel for manual psql access
+ * mesh db credentials - Print database credentials
+ * mesh db env         - Export DATABASE_URL for shell
+ * mesh db psql        - Connect to database via psql
+ * mesh db exec        - Run any command with database connection
+ */
+import { Command } from "commander";
+export declare function registerDbCommands(program: Command): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/src/commands/db/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOpC,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAmDzD"}

package/dist/src/commands/db/index.js

@@ -0,0 +1,62 @@
+/**
+ * Database commands
+ *
+ * mesh db connect     - Start tunnel for manual psql access
+ * mesh db credentials - Print database credentials
+ * mesh db env         - Export DATABASE_URL for shell
+ * mesh db psql        - Connect to database via psql
+ * mesh db exec        - Run any command with database connection
+ */
+import { connectCommand } from "./connect.js";
+import { credentialsCommand } from "./credentials.js";
+import { envCommand } from "./env.js";
+import { psqlCommand } from "./psql.js";
+import { execCommand } from "./exec.js";
+export function registerDbCommands(program) {
+    const db = program
+        .command("db")
+        .description("Database utilities");
+    db.command("connect")
+        .description("Start DB tunnel for manual psql access")
+        .option("-t, --tenant <tenant>", "Platform tenant (e.g., mesh)")
+        .option("-e, --env <env>", "Platform environment (e.g., dev-temporal)")
+        .action(connectCommand);
+    db.command("credentials")
+        .alias("creds")
+        .description("Print database credentials")
+        .option("-t, --tenant <tenant>", "Platform tenant (e.g., mesh)")
+        .option("-e, --env <env>", "Platform environment (e.g., dev-temporal)")
+        .option("-a, --app <app>", "App name for credentials path (e.g., rdc)")
+        .option("--app-tenant <tenant>", "Tenant for app credentials (e.g., encore)")
+        .option("--app-stage <stage>", "Stage for app credentials (e.g., dev)")
+        .action(credentialsCommand);
+    db.command("env")
+        .description("Export DATABASE_URL for current shell (use with eval)")
+        .option("-t, --tenant <tenant>", "Platform tenant (e.g., mesh)")
+        .option("-e, --env <env>", "Platform environment (e.g., dev-temporal)")
+        .option("-a, --app <app>", "App name for credentials path (e.g., rdc)")
+        .option("--app-tenant <tenant>", "Tenant for app credentials (e.g., encore)")
+        .option("--app-stage <stage>", "Stage for app credentials (e.g., dev)")
+        .action(envCommand);
+    db.command("psql")
+        .description("Connect to database with psql")
+        .option("-t, --tenant <tenant>", "Platform tenant (e.g., mesh)")
+        .option("-e, --env <env>", "Platform environment (e.g., dev-temporal)")
+        .option("-a, --app <app>", "App name for credentials path (e.g., rdc)")
+        .option("--app-tenant <tenant>", "Tenant for app credentials (e.g., encore)")
+        .option("--app-stage <stage>", "Stage for app credentials (e.g., dev)")
+        .action(psqlCommand);
+    db.command("exec")
+        .description("Run any command with database connection")
+        .option("-t, --tenant <tenant>", "Platform tenant for bastion lookup (e.g., mesh)")
+        .option("-e, --env <env>", "Platform environment for bastion lookup (e.g., dev-temporal)")
+        .option("-a, --app <app>", "App name for credentials path (e.g., rdc)")
+        .option("--app-tenant <tenant>", "Tenant for app credentials if different from platform (e.g., encore)")
+        .option("--app-stage <stage>", "Stage for app credentials (e.g., dev)")
+        .option("--secret <arn>", "Use secret ARN directly (skips SSM discovery)")
+        .option("--ssl <mode>", "SSL mode: require, no-verify, disable")
+        .option("--port <port>", "Local tunnel port (default: 5432)")
+        .argument("<command...>", "Command and arguments to run")
+        .action(execCommand);
+}
+//# sourceMappingURL=index.js.map

package/dist/src/commands/db/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/commands/db/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,MAAM,UAAU,kBAAkB,CAAC,OAAgB;IACjD,MAAM,EAAE,GAAG,OAAO;SACf,OAAO,CAAC,IAAI,CAAC;SACb,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAErC,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,wCAAwC,CAAC;SACrD,MAAM,CAAC,uBAAuB,EAAE,8BAA8B,CAAC;SAC/D,MAAM,CAAC,iBAAiB,EAAE,2CAA2C,CAAC;SACtE,MAAM,CAAC,cAAc,CAAC,CAAC;IAE1B,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;SACtB,KAAK,CAAC,OAAO,CAAC;SACd,WAAW,CAAC,4BAA4B,CAAC;SACzC,MAAM,CAAC,uBAAuB,EAAE,8BAA8B,CAAC;SAC/D,MAAM,CAAC,iBAAiB,EAAE,2CAA2C,CAAC;SACtE,MAAM,CAAC,iBAAiB,EAAE,2CAA2C,CAAC;SACtE,MAAM,CAAC,uBAAuB,EAAE,2CAA2C,CAAC;SAC5E,MAAM,CAAC,qBAAqB,EAAE,uCAAuC,CAAC;SACtE,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAE9B,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,uDAAuD,CAAC;SACpE,MAAM,CAAC,uBAAuB,EAAE,8BAA8B,CAAC;SAC/D,MAAM,CAAC,iBAAiB,EAAE,2CAA2C,CAAC;SACtE,MAAM,CAAC,iBAAiB,EAAE,2CAA2C,CAAC;SACtE,MAAM,CAAC,uBAAuB,EAAE,2CAA2C,CAAC;SAC5E,MAAM,CAAC,qBAAqB,EAAE,uCAAuC,CAAC;SACtE,MAAM,CAAC,UAAU,CAAC,CAAC;IAEtB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,+BAA+B,CAAC;SAC5C,MAAM,CAAC,uBAAuB,EAAE,8BAA8B,CAAC;SAC/D,MAAM,CAAC,iBAAiB,EAAE,2CAA2C,CAAC;SACtE,MAAM,CAAC,iBAAiB,EAAE,2CAA2C,CAAC;SACtE,MAAM,CAAC,uBAAuB,EAAE,2CAA2C,CAAC;SAC5E,MAAM,CAAC,qBAAqB,EAAE,uCAAuC,CAAC;SACtE,MAAM,CAAC,WAAW,CAAC,CAAC;IAEvB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,0CAA0C,CAAC;SACvD,MAAM,CAAC,uBAAuB,EAAE,iDAAiD,CAAC;SAClF,MAAM,CAAC,iBAAiB,EAAE,8DAA8D,CAAC;SACzF,MAAM,CAAC,iBAAiB,EAAE,2CAA2C,CAAC;SACtE,MAAM,CAAC,uBAAuB,EAAE,sEAAsE,CAAC;SACvG,MAAM,CAAC,qBAAqB,EAAE,uCAAuC,CAAC;SACtE,MAAM,CAAC,gBAAgB,EAAE,+CAA+C,CAAC;SACzE,MAAM,CAAC,cAAc,EAAE,uCAAuC,CAAC;SAC/D,MAAM,CAAC,eAAe,EAAE,mCAAmC,CAAC;SAC5D,QAAQ,CAAC,cAAc,EAAE,8BAA8B,CAAC;SACxD,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC"}

package/dist/src/commands/db/psql.d.ts

@@ -0,0 +1,16 @@
+/**
+ * mesh db psql - Connect to database with psql
+ *
+ * Usage:
+ *   mesh db psql --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev
+ */
+interface PsqlOptions {
+    tenant?: string;
+    env?: string;
+    app?: string;
+    appTenant?: string;
+    appStage?: string;
+}
+export declare function psqlCommand(options: PsqlOptions): Promise<void>;
+export {};
+//# sourceMappingURL=psql.d.ts.map

package/dist/src/commands/db/psql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"psql.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/psql.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAaH,UAAU,WAAW;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAmED,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA4FrE"}

package/dist/src/commands/db/psql.js

@@ -0,0 +1,133 @@
+/**
+ * mesh db psql - Connect to database with psql
+ *
+ * Usage:
+ *   mesh db psql --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev
+ */
+import { spawn } from "child_process";
+import * as net from "net";
+import { detectContext, getPlatformBastionInfo, getDatabaseUrl, logInfo, logSuccess, logError, } from "../../utils/index.js";
+/**
+ * Start SSM tunnel in background and wait for it to be ready.
+ */
+async function startTunnelBackground(instanceId, rdsHost, rdsPort, localPort) {
+    logInfo("Starting tunnel in background...");
+    const tunnel = spawn("aws", [
+        "ssm",
+        "start-session",
+        "--target",
+        instanceId,
+        "--document-name",
+        "AWS-StartPortForwardingSessionToRemoteHost",
+        "--parameters",
+        JSON.stringify({
+            host: [rdsHost],
+            portNumber: [String(rdsPort)],
+            localPortNumber: [String(localPort)],
+        }),
+    ], { stdio: ["ignore", "ignore", "ignore"] });
+    // Wait for tunnel to be ready (port listening)
+    const maxAttempts = 15;
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+        if (tunnel.exitCode !== null) {
+            throw new Error("Tunnel process died");
+        }
+        const isListening = await checkPort(localPort);
+        if (isListening) {
+            logSuccess(`Tunnel started (PID: ${tunnel.pid})`);
+            return tunnel;
+        }
+        await sleep(1000);
+    }
+    tunnel.kill();
+    throw new Error(`Tunnel failed to start after ${maxAttempts} seconds`);
+}
+function checkPort(port) {
+    return new Promise((resolve) => {
+        const socket = new net.Socket();
+        socket.setTimeout(500);
+        socket.on("connect", () => { socket.destroy(); resolve(true); });
+        socket.on("timeout", () => { socket.destroy(); resolve(false); });
+        socket.on("error", () => { socket.destroy(); resolve(false); });
+        socket.connect(port, "localhost");
+    });
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+export async function psqlCommand(options) {
+    // Resolve platform tenant/env
+    let platformTenant;
+    let platformEnv;
+    if (options.tenant && options.env) {
+        platformTenant = options.tenant;
+        platformEnv = options.env;
+        logInfo(`Platform: Tenant=${platformTenant}, Env=${platformEnv}`);
+    }
+    else if (options.tenant || options.env) {
+        logError("Both --tenant and --env are required");
+        logInfo("Usage: mesh db psql --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev");
+        process.exit(1);
+    }
+    else {
+        const ctx = detectContext();
+        platformTenant = ctx.tenant;
+        platformEnv = ctx.platformEnv;
+        logInfo(`Auto-detected: Tenant=${platformTenant}, Env=${platformEnv}`);
+    }
+    // Resolve app credentials
+    const appTenant = options.appTenant ?? platformTenant;
+    const appStage = options.appStage ?? platformEnv;
+    const appName = options.app;
+    if (appName) {
+        logInfo(`App credentials: tenant=${appTenant}, stage=${appStage}, app=${appName}`);
+    }
+    // Check for psql
+    const psqlCheck = spawn("which", ["psql"]);
+    await new Promise((resolve, reject) => {
+        psqlCheck.on("exit", (code) => {
+            if (code !== 0) {
+                logError("psql not found. Install with: brew install postgresql");
+                reject(new Error("psql not found"));
+            }
+            else {
+                resolve();
+            }
+        });
+    });
+    // Get bastion and start tunnel
+    const bastion = await getPlatformBastionInfo(platformTenant, platformEnv);
+    const rdsService = bastion.services.rds;
+    if (!rdsService) {
+        logError("RDS service not available in platform bastion");
+        process.exit(1);
+    }
+    const tunnel = await startTunnelBackground(bastion.instanceId, rdsService.host, rdsService.port, 5432);
+    // Cleanup on exit
+    const cleanup = () => {
+        logInfo("Stopping tunnel...");
+        tunnel.kill();
+    };
+    process.on("exit", cleanup);
+    process.on("SIGINT", cleanup);
+    process.on("SIGTERM", cleanup);
+    // Get DATABASE_URL and parse credentials
+    const databaseUrl = await getDatabaseUrl(appTenant, appStage, { app: appName });
+    const parsed = new URL(databaseUrl);
+    const username = parsed.username;
+    const password = decodeURIComponent(parsed.password);
+    const database = parsed.pathname.slice(1);
+    console.log("");
+    logInfo(`Connecting to ${database} as ${username}...`);
+    console.log("");
+    // Run psql
+    const psql = spawn("psql", ["-h", "localhost", "-p", "5432", "-U", username, "-d", database], {
+        stdio: "inherit",
+        env: { ...process.env, PGPASSWORD: password },
+    });
+    psql.on("exit", (code) => {
+        cleanup();
+        process.exit(code ?? 0);
+    });
+}
+//# sourceMappingURL=psql.js.map

package/dist/src/commands/db/psql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"psql.js","sourceRoot":"","sources":["../../../../src/commands/db/psql.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,EAAgB,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,GAAG,MAAM,KAAK,CAAC;AAC3B,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,cAAc,EACd,OAAO,EACP,UAAU,EACV,QAAQ,GACT,MAAM,sBAAsB,CAAC;AAU9B;;GAEG;AACH,KAAK,UAAU,qBAAqB,CAClC,UAAkB,EAClB,OAAe,EACf,OAAe,EACf,SAAiB;IAEjB,OAAO,CAAC,kCAAkC,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,KAAK,CAClB,KAAK,EACL;QACE,KAAK;QACL,eAAe;QACf,UAAU;QACV,UAAU;QACV,iBAAiB;QACjB,4CAA4C;QAC5C,cAAc;QACd,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,CAAC,OAAO,CAAC;YACf,UAAU,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7B,eAAe,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;SACrC,CAAC;KACH,EACD,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAC1C,CAAC;IAEF,+CAA+C;IAC/C,MAAM,WAAW,GAAG,EAAE,CAAC;IACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,WAAW,EAAE,CAAC;YAChB,UAAU,CAAC,wBAAwB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,CAAC,IAAI,EAAE,CAAC;IACd,MAAM,IAAI,KAAK,CAAC,gCAAgC,WAAW,UAAU,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAoB;IACpD,8BAA8B;IAC9B,IAAI,cAAsB,CAAC;IAC3B,IAAI,WAAmB,CAAC;IAExB,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAClC,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;QAChC,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC;QAC1B,OAAO,CAAC,oBAAoB,cAAc,SAAS,WAAW,EAAE,CAAC,CAAC;IACpE,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACzC,QAAQ,CAAC,sCAAsC,CAAC,CAAC;QACjD,OAAO,CAAC,oGAAoG,CAAC,CAAC;QAC9G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC;QAC5B,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;QAC9B,OAAO,CAAC,yBAAyB,cAAc,SAAS,WAAW,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,0BAA0B;IAC1B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,cAAc,CAAC;IACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;IAE5B,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,2BAA2B,SAAS,WAAW,QAAQ,SAAS,OAAO,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,iBAAiB;IACjB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC5B,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,QAAQ,CAAC,uDAAuD,CAAC,CAAC;gBAClE,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACtC,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,+BAA+B;IAC/B,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAC1E,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;IAExC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,QAAQ,CAAC,+CAA+C,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,qBAAqB,CACxC,OAAO,CAAC,UAAU,EAClB,UAAU,CAAC,IAAI,EACf,UAAU,CAAC,IAAI,EACf,IAAI,CACL,CAAC;IAEF,kBAAkB;IAClB,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAE/B,yCAAyC;IACzC,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAChF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE1C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,iBAAiB,QAAQ,OAAO,QAAQ,KAAK,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,WAAW;IACX,MAAM,IAAI,GAAG,KAAK,CAChB,MAAM,EACN,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,EACjE;QACE,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE;KAC9C,CACF,CAAC;IAEF,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QACvB,OAAO,EAAE,CAAC;QACV,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/commands/deploy.d.ts

@@ -0,0 +1,24 @@
+/**
+ * mesh deploy — Pulumi passthrough with automatic deployer role assumption.
+ *
+ * Credential resolution order:
+ *   1. If AWS credentials already in environment (CI/CD) → use directly
+ *   2. If ~/.config/mesh/credentials.json has a valid token for the
+ *      platform context → AssumeRoleWithWebIdentity (Zitadel JWT)
+ *   3. Fallback → AssumeRole via current AWS session (SSO)
+ *
+ * The platform context (e.g., "mesh.dev") is derived from `mesh:platform`
+ * in the Pulumi stack config file (read directly from YAML, no AWS needed).
+ *
+ * Setup:
+ *   pulumi config set mesh:deployerRole arn:aws:iam::123456789012:role/acme-dev-apps-deployer
+ *
+ * Examples:
+ *   mesh deploy preview
+ *   mesh deploy up --yes
+ *   mesh deploy stack output dev --json
+ *   mesh deploy destroy
+ */
+import { Command } from "commander";
+export declare function registerDeployCommand(program: Command): void;
+//# sourceMappingURL=deploy.d.ts.map

package/dist/src/commands/deploy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../../src/commands/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0HpC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAsH5D"}