@mesh-tech/mesh-cli 0.1.0

package/dist/src/commands/deploy.js

@@ -0,0 +1,228 @@
+/**
+ * mesh deploy — Pulumi passthrough with automatic deployer role assumption.
+ *
+ * Credential resolution order:
+ *   1. If AWS credentials already in environment (CI/CD) → use directly
+ *   2. If ~/.config/mesh/credentials.json has a valid token for the
+ *      platform context → AssumeRoleWithWebIdentity (Zitadel JWT)
+ *   3. Fallback → AssumeRole via current AWS session (SSO)
+ *
+ * The platform context (e.g., "mesh.dev") is derived from `mesh:platform`
+ * in the Pulumi stack config file (read directly from YAML, no AWS needed).
+ *
+ * Setup:
+ *   pulumi config set mesh:deployerRole arn:aws:iam::123456789012:role/acme-dev-apps-deployer
+ *
+ * Examples:
+ *   mesh deploy preview
+ *   mesh deploy up --yes
+ *   mesh deploy stack output dev --json
+ *   mesh deploy destroy
+ */
+import { execFileSync } from "child_process";
+import * as fs from "fs";
+import * as path from "path";
+import { logError, logInfo, logSuccess, logWarn } from "../utils/log.js";
+import { findAppRoot, getCurrentStack, readStackConfig } from "../utils/pulumi.js";
+import { readCredentials } from "./login.js";
+// =============================================================================
+// Helpers
+// =============================================================================
+/**
+ * Parse --stack or -s from the args array.
+ */
+function parseStackFromArgs(args) {
+    for (let i = 0; i < args.length; i++) {
+        if (args[i] === "--stack" || args[i] === "-s") {
+            return args[i + 1] ?? null;
+        }
+        if (args[i]?.startsWith("--stack=")) {
+            return args[i].split("=")[1] ?? null;
+        }
+    }
+    return null;
+}
+/**
+ * Derive the platform context key (e.g., "mesh.dev") from stack config.
+ *
+ * Reads `mesh:platform` from Pulumi.<stack>.yaml. Supports both formats:
+ *   mesh:platform: '{"env":"dev","name":"mesh"}'    → "mesh.dev"
+ *   mesh:platform:
+ *     name: mesh
+ *     env: dev                                       → "mesh.dev"
+ */
+function derivePlatformContext(appRoot, stack) {
+    const configFile = path.join(appRoot, `Pulumi.${stack}.yaml`);
+    if (!fs.existsSync(configFile))
+        return null;
+    const content = fs.readFileSync(configFile, "utf-8");
+    // Try JSON-encoded string first (e.g., mesh:platform: '{"env":"dev","name":"mesh"}')
+    const jsonMatch = content.match(/mesh:platform:\s*'(\{[^']+\})'/);
+    if (jsonMatch) {
+        try {
+            const parsed = JSON.parse(jsonMatch[1]);
+            if (parsed.name && parsed.env)
+                return `${parsed.name}.${parsed.env}`;
+        }
+        catch {
+            // fall through
+        }
+    }
+    // Try YAML block format
+    const nameMatch = content.match(/mesh:platform:[\s\S]*?name:\s*(\S+)/);
+    const envMatch = content.match(/mesh:platform:[\s\S]*?env:\s*(\S+)/);
+    if (nameMatch && envMatch) {
+        return `${nameMatch[1]}.${envMatch[1]}`;
+    }
+    return null;
+}
+/**
+ * Assume an IAM role and return credentials as env vars.
+ */
+function assumeRole(roleArn) {
+    try {
+        const result = execFileSync("aws", [
+            "sts", "assume-role",
+            "--role-arn", roleArn,
+            "--role-session-name", "mesh-deploy",
+            "--output", "json",
+        ], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
+        const parsed = JSON.parse(result);
+        const creds = parsed.Credentials;
+        return {
+            AWS_ACCESS_KEY_ID: creds.AccessKeyId,
+            AWS_SECRET_ACCESS_KEY: creds.SecretAccessKey,
+            AWS_SESSION_TOKEN: creds.SessionToken,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Assume role using Zitadel JWT via AssumeRoleWithWebIdentity.
+ */
+function assumeRoleWithWebIdentity(roleArn, idToken, sessionName) {
+    try {
+        const result = execFileSync("aws", [
+            "sts", "assume-role-with-web-identity",
+            "--role-arn", roleArn,
+            "--web-identity-token", idToken,
+            "--role-session-name", sessionName,
+            "--output", "json",
+        ], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
+        const parsed = JSON.parse(result);
+        const creds = parsed.Credentials;
+        return {
+            AWS_ACCESS_KEY_ID: creds.AccessKeyId,
+            AWS_SECRET_ACCESS_KEY: creds.SecretAccessKey,
+            AWS_SESSION_TOKEN: creds.SessionToken,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+// =============================================================================
+// Command
+// =============================================================================
+export function registerDeployCommand(program) {
+    program
+        .command("deploy")
+        .description("Run pulumi with the app's deployer role (passthrough)")
+        .allowUnknownOption(true)
+        .allowExcessArguments(true)
+        .helpOption(false) // Don't consume --help, pass it to pulumi
+        .action((_opts, cmd) => {
+        const pulumiArgs = cmd.args;
+        // Find app root
+        const appRoot = findAppRoot(process.cwd());
+        if (!appRoot) {
+            logError("No Pulumi.yaml found. Run from within a Pulumi app directory.");
+            process.exit(1);
+        }
+        // Determine stack
+        const stack = parseStackFromArgs(pulumiArgs) ?? getCurrentStack(appRoot);
+        if (!stack) {
+            logError("Could not determine stack. Either:\n" +
+                "  - Pass --stack <name> (e.g., mesh deploy preview --stack dev)\n" +
+                "  - Select a stack first: pulumi stack select <name>");
+            process.exit(1);
+        }
+        // Read deployer role from stack config
+        const roleArn = readStackConfig(appRoot, stack, "mesh:deployerRole");
+        if (!roleArn) {
+            logError(`No mesh:deployerRole found in Pulumi.${stack}.yaml.\n` +
+                "Add it with:\n" +
+                "  pulumi config set mesh:deployerRole arn:aws:iam::<account>:role/<tenant>-<stage>-apps-deployer");
+            process.exit(1);
+        }
+        const roleName = roleArn.split("/").pop() ?? roleArn;
+        // =====================================================================
+        // Credential resolution
+        // =====================================================================
+        let awsCreds = null;
+        // Path 1: Existing AWS credentials in environment (CI/CD)
+        if (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SESSION_TOKEN) {
+            logInfo(`Using existing AWS credentials from environment`);
+            // No role assumption needed — run pulumi directly
+            try {
+                execFileSync("pulumi", pulumiArgs, {
+                    cwd: appRoot,
+                    stdio: "inherit",
+                });
+            }
+            catch (err) {
+                process.exit(err.status ?? 1);
+            }
+            return;
+        }
+        // Path 2: Zitadel JWT via AssumeRoleWithWebIdentity
+        const platformContext = derivePlatformContext(appRoot, stack);
+        if (platformContext) {
+            const meshCreds = readCredentials(platformContext);
+            if (meshCreds && new Date(meshCreds.expiresAt) > new Date()) {
+                const sessionName = (meshCreds.email ?? "mesh-deploy")
+                    .replace(/[^a-zA-Z0-9=,.@-]/g, "_")
+                    .slice(0, 64);
+                logInfo(`Assuming ${roleName} via Zitadel (${meshCreds.email ?? platformContext})`);
+                awsCreds = assumeRoleWithWebIdentity(roleArn, meshCreds.idToken, sessionName);
+                if (awsCreds) {
+                    logSuccess(`Assumed ${roleName} via Zitadel`);
+                }
+                else {
+                    logWarn("Zitadel JWT auth failed — falling back to AWS SSO.\n" +
+                        `  (Try: mesh login ${platformContext})`);
+                }
+            }
+        }
+        // Path 3: Fallback — AssumeRole via current AWS session (SSO)
+        if (!awsCreds) {
+            logInfo(`Assuming ${roleName} via AWS SSO`);
+            awsCreds = assumeRole(roleArn);
+            if (!awsCreds) {
+                logError(`Failed to assume role: ${roleArn}`);
+                process.exit(1);
+            }
+            logSuccess(`Assumed ${roleName}`);
+        }
+        // Build environment — inherit current env, override AWS creds,
+        // remove AWS_PROFILE so the assumed creds are used
+        const env = { ...process.env, ...awsCreds };
+        delete env.AWS_PROFILE;
+        // Exec pulumi with the assumed role
+        try {
+            execFileSync("pulumi", pulumiArgs, {
+                cwd: appRoot,
+                env,
+                stdio: "inherit",
+            });
+        }
+        catch (err) {
+            // execFileSync throws on non-zero exit. The output was already
+            // printed via stdio: "inherit", so just exit with the same code.
+            process.exit(err.status ?? 1);
+        }
+    });
+}
+//# sourceMappingURL=deploy.js.map

package/dist/src/commands/deploy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy.js","sourceRoot":"","sources":["../../../src/commands/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF;;GAEG;AACH,SAAS,kBAAkB,CAAC,IAAc;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;QAC7B,CAAC;QACD,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAAC,OAAe,EAAE,KAAa;IAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC;IAC9D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAErD,qFAAqF;IACrF,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAC7B,gCAAgC,CACjC,CAAC;IACF,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC;YACzC,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG;gBAAE,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACrE,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;QAC1B,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1C,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE;YACjC,KAAK,EAAE,aAAa;YACpB,YAAY,EAAE,OAAO;YACrB,qBAAqB,EAAE,aAAa;YACpC,UAAU,EAAE,MAAM;SACnB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC;QACjC,OAAO;YACL,iBAAiB,EAAE,KAAK,CAAC,WAAW;YACpC,qBAAqB,EAAE,KAAK,CAAC,eAAe;YAC5C,iBAAiB,EAAE,KAAK,CAAC,YAAY;SACtC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAChC,OAAe,EACf,OAAe,EACf,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE;YACjC,KAAK,EAAE,+BAA+B;YACtC,YAAY,EAAE,OAAO;YACrB,sBAAsB,EAAE,OAAO;YAC/B,qBAAqB,EAAE,WAAW;YAClC,UAAU,EAAE,MAAM;SACnB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC;QACjC,OAAO;YACL,iBAAiB,EAAE,KAAK,CAAC,WAAW;YACpC,qBAAqB,EAAE,KAAK,CAAC,eAAe;YAC5C,iBAAiB,EAAE,KAAK,CAAC,YAAY;SACtC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,uDAAuD,CAAC;SACpE,kBAAkB,CAAC,IAAI,CAAC;SACxB,oBAAoB,CAAC,IAAI,CAAC;SAC1B,UAAU,CAAC,KAAK,CAAC,CAAC,0CAA0C;SAC5D,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACrB,MAAM,UAAU,GAAG,GAAG,CAAC,IAAgB,CAAC;QAExC,gBAAgB;QAChB,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,CAAC,+DAA+D,CAAC,CAAC;YAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,kBAAkB;QAClB,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,QAAQ,CACN,sCAAsC;gBACtC,mEAAmE;gBACnE,sDAAsD,CACvD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,uCAAuC;QACvC,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,mBAAmB,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,CACN,wCAAwC,KAAK,UAAU;gBACvD,gBAAgB;gBAChB,kGAAkG,CACnG,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC;QAErD,wEAAwE;QACxE,wBAAwB;QACxB,wEAAwE;QAExE,IAAI,QAAQ,GAAkC,IAAI,CAAC;QAEnD,0DAA0D;QAC1D,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;YACnE,OAAO,CAAC,iDAAiD,CAAC,CAAC;YAC3D,kDAAkD;YAClD,IAAI,CAAC;gBACH,YAAY,CAAC,QAAQ,EAAE,UAAU,EAAE;oBACjC,GAAG,EAAE,OAAO;oBACZ,KAAK,EAAE,SAAS;iBACjB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;YAChC,CAAC;YACD,OAAO;QACT,CAAC;QAED,oDAAoD;QACpD,MAAM,eAAe,GAAG,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;YACnD,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;gBAC5D,MAAM,WAAW,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,aAAa,CAAC;qBACnD,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC;qBAClC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChB,OAAO,CAAC,YAAY,QAAQ,iBAAiB,SAAS,CAAC,KAAK,IAAI,eAAe,GAAG,CAAC,CAAC;gBAEpF,QAAQ,GAAG,yBAAyB,CAClC,OAAO,EACP,SAAS,CAAC,OAAO,EACjB,WAAW,CACZ,CAAC;gBAEF,IAAI,QAAQ,EAAE,CAAC;oBACb,UAAU,CAAC,WAAW,QAAQ,cAAc,CAAC,CAAC;gBAChD,CAAC;qBAAM,CAAC;oBACN,OAAO,CACL,sDAAsD;wBACtD,sBAAsB,eAAe,GAAG,CACzC,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,8DAA8D;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,YAAY,QAAQ,cAAc,CAAC,CAAC;YAC5C,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;YAC/B,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;gBAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,UAAU,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,+DAA+D;QAC/D,mDAAmD;QACnD,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC5C,OAAO,GAAG,CAAC,WAAW,CAAC;QAEvB,oCAAoC;QACpC,IAAI,CAAC;YACH,YAAY,CAAC,QAAQ,EAAE,UAAU,EAAE;gBACjC,GAAG,EAAE,OAAO;gBACZ,GAAG;gBACH,KAAK,EAAE,SAAS;aACjB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,+DAA+D;YAC/D,iEAAiE;YACjE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QAChC,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/dev.d.ts

@@ -0,0 +1,17 @@
+/**
+ * mesh dev — Pulumi-output-driven local development orchestrator
+ *
+ * Reads `pulumi stack output dev --json` to discover services and tunnels,
+ * then launches each service's dev command in a tmux window.
+ *
+ * Usage:
+ *   mesh dev                  Start all services, attach tmux
+ *   mesh dev --headless       Start without attaching
+ *   mesh dev --kill           Stop everything
+ *   mesh dev --status         Show service health (--json for structured)
+ *   mesh dev logs <service>   Tail a service's output
+ *   mesh dev restart <svc>    Restart a single service
+ */
+import { Command } from "commander";
+export declare function registerDevCommand(program: Command): void;
+//# sourceMappingURL=dev.d.ts.map

package/dist/src/commands/dev.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev.d.ts","sourceRoot":"","sources":["../../../src/commands/dev.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAOH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8yCpC,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAiLzD"}