@mesh-tech/mesh-cli 0.1.0

package/dist/src/commands/registry.js

@@ -0,0 +1,336 @@
+/**
+ * mesh registry — Manage npm registry authentication for @mesh-tech packages.
+ *
+ * Handles CodeArtifact token refresh and project .npmrc setup so that
+ * `pnpm install` can resolve @mesh-tech/* packages from the private registry.
+ *
+ * Credential resolution (same as mesh deploy):
+ *   1. Existing AWS credentials in environment (CI/CD) → use directly
+ *   2. Zitadel JWT from `mesh login` → AssumeRoleWithWebIdentity
+ *   3. AWS SSO / current profile → use directly
+ *
+ * Usage:
+ *   mesh registry login                 — refresh token, ensure .npmrc
+ *   mesh registry login mesh.dev        — use Zitadel JWT for role assumption
+ *   mesh registry login --ci            — CI mode (skip .npmrc creation)
+ *   mesh registry status                — show current auth state
+ */
+import { execFileSync } from "child_process";
+import * as fs from "fs";
+import * as path from "path";
+import { logError, logInfo, logSuccess, logWarn } from "../utils/log.js";
+import { readCredentials } from "./login.js";
+// =============================================================================
+// Constants — platform CodeArtifact registry
+// =============================================================================
+const CA_DOMAIN = "mesh-platform";
+const CA_REPOSITORY = "mesh-packages";
+const CA_NAMESPACE = "@mesh-tech";
+const CA_REGION = "us-east-2";
+// Default registry role — tenants get read access via their deployer role,
+// but a dedicated read-only role can be configured here.
+const DEFAULT_REGISTRY_ROLE = null;
+// =============================================================================
+// Helpers
+// =============================================================================
+/**
+ * Get the CodeArtifact repository endpoint URL.
+ */
+function getEndpoint(env) {
+    try {
+        const result = execFileSync("aws", [
+            "codeartifact", "get-repository-endpoint",
+            "--domain", CA_DOMAIN,
+            "--repository", CA_REPOSITORY,
+            "--format", "npm",
+            "--region", CA_REGION,
+            "--output", "text",
+            "--query", "repositoryEndpoint",
+        ], {
+            encoding: "utf-8",
+            env: env ? { ...process.env, ...env } : undefined,
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        return result.trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Run `aws codeartifact login` to set the auth token in ~/.npmrc.
+ */
+function codeartifactLogin(env) {
+    try {
+        execFileSync("aws", [
+            "codeartifact", "login",
+            "--tool", "npm",
+            "--domain", CA_DOMAIN,
+            "--repository", CA_REPOSITORY,
+            "--namespace", CA_NAMESPACE,
+            "--region", CA_REGION,
+        ], {
+            encoding: "utf-8",
+            env: env ? { ...process.env, ...env } : undefined,
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Assume an IAM role, return credential env vars.
+ */
+function assumeRole(roleArn) {
+    try {
+        const result = execFileSync("aws", [
+            "sts", "assume-role",
+            "--role-arn", roleArn,
+            "--role-session-name", "mesh-registry",
+            "--output", "json",
+        ], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
+        const creds = JSON.parse(result).Credentials;
+        return {
+            AWS_ACCESS_KEY_ID: creds.AccessKeyId,
+            AWS_SECRET_ACCESS_KEY: creds.SecretAccessKey,
+            AWS_SESSION_TOKEN: creds.SessionToken,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Assume role via Zitadel JWT (AssumeRoleWithWebIdentity).
+ */
+function assumeRoleWithWebIdentity(roleArn, idToken, sessionName) {
+    try {
+        const result = execFileSync("aws", [
+            "sts", "assume-role-with-web-identity",
+            "--role-arn", roleArn,
+            "--web-identity-token", idToken,
+            "--role-session-name", sessionName,
+            "--output", "json",
+        ], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
+        const creds = JSON.parse(result).Credentials;
+        return {
+            AWS_ACCESS_KEY_ID: creds.AccessKeyId,
+            AWS_SECRET_ACCESS_KEY: creds.SecretAccessKey,
+            AWS_SESSION_TOKEN: creds.SessionToken,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve AWS credentials for registry access.
+ *
+ * Returns env var overrides (or empty object if current env is fine).
+ */
+function resolveCredentials(context, roleArn) {
+    // Path 1: Existing AWS credentials in environment
+    if (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SESSION_TOKEN) {
+        logInfo("Using existing AWS credentials from environment");
+        return {};
+    }
+    // Path 2: Zitadel JWT → AssumeRoleWithWebIdentity
+    if (context) {
+        const meshCreds = readCredentials(context);
+        if (meshCreds && new Date(meshCreds.expiresAt) > new Date()) {
+            const targetRole = roleArn || DEFAULT_REGISTRY_ROLE;
+            if (targetRole) {
+                const sessionName = (meshCreds.email ?? "mesh-registry")
+                    .replace(/[^a-zA-Z0-9=,.@-]/g, "_")
+                    .slice(0, 64);
+                logInfo(`Assuming registry role via Zitadel (${meshCreds.email ?? context})`);
+                const creds = assumeRoleWithWebIdentity(targetRole, meshCreds.idToken, sessionName);
+                if (creds) {
+                    logSuccess("Assumed registry role via Zitadel");
+                    return creds;
+                }
+                logWarn("Zitadel JWT role assumption failed — falling back to AWS profile");
+            }
+            else {
+                logInfo(`Zitadel auth available (${meshCreds.email}) but no registry role configured — using AWS profile`);
+            }
+        }
+        else if (meshCreds) {
+            logWarn(`Zitadel token expired for ${context}. Run: mesh login ${context}`);
+        }
+        else {
+            logWarn(`No Zitadel credentials for ${context}. Run: mesh login ${context}`);
+        }
+    }
+    // Path 3: AssumeRole via current AWS session (if a role was specified)
+    if (roleArn) {
+        logInfo(`Assuming ${roleArn.split("/").pop()} via AWS SSO`);
+        const creds = assumeRole(roleArn);
+        if (creds) {
+            logSuccess("Assumed registry role via AWS SSO");
+            return creds;
+        }
+        logWarn("Role assumption failed — trying current credentials directly");
+    }
+    // Path 4: Current AWS profile/credentials as-is
+    logInfo("Using current AWS profile");
+    return {};
+}
+/**
+ * Find project root by looking for pnpm-workspace.yaml, package.json, or .git
+ * walking up from cwd.
+ */
+function findProjectRoot() {
+    let dir = process.cwd();
+    while (true) {
+        if (fs.existsSync(path.join(dir, "pnpm-workspace.yaml")) ||
+            fs.existsSync(path.join(dir, "pnpm-lock.yaml")) ||
+            fs.existsSync(path.join(dir, "Pulumi.yaml")) ||
+            fs.existsSync(path.join(dir, ".npmrc"))) {
+            return dir;
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+/**
+ * Ensure project .npmrc has the @mesh-tech registry scope entry.
+ * Creates the file if it doesn't exist. Doesn't touch auth tokens
+ * (those live in ~/.npmrc via `aws codeartifact login`).
+ */
+function ensureProjectNpmrc(endpoint) {
+    const projectRoot = findProjectRoot() ?? process.cwd();
+    const npmrcPath = path.join(projectRoot, ".npmrc");
+    const scopeLine = `${CA_NAMESPACE}:registry=${endpoint}`;
+    if (!fs.existsSync(npmrcPath)) {
+        fs.writeFileSync(npmrcPath, scopeLine + "\n", "utf-8");
+        return { created: true, updated: false, path: npmrcPath };
+    }
+    const content = fs.readFileSync(npmrcPath, "utf-8");
+    // Check if scope already configured (with any endpoint)
+    const scopeRegex = new RegExp(`^${CA_NAMESPACE.replace("/", "\\/")}:registry=.+$`, "m");
+    if (scopeRegex.test(content)) {
+        // Check if it's the right endpoint
+        if (content.includes(scopeLine)) {
+            return { created: false, updated: false, path: npmrcPath };
+        }
+        // Update existing line
+        const updated = content.replace(scopeRegex, scopeLine);
+        fs.writeFileSync(npmrcPath, updated, "utf-8");
+        return { created: false, updated: true, path: npmrcPath };
+    }
+    // Append scope line
+    const separator = content.endsWith("\n") ? "" : "\n";
+    fs.writeFileSync(npmrcPath, content + separator + scopeLine + "\n", "utf-8");
+    return { created: false, updated: true, path: npmrcPath };
+}
+/**
+ * Check if the current ~/.npmrc has a valid CodeArtifact token for our registry.
+ */
+function checkExistingToken() {
+    const homeNpmrc = path.join(process.env.HOME ?? "~", ".npmrc");
+    if (!fs.existsSync(homeNpmrc))
+        return { valid: false };
+    const content = fs.readFileSync(homeNpmrc, "utf-8");
+    // Look for a CodeArtifact token line for our domain
+    const hasToken = content.includes("mesh-platform") && content.includes("_authToken=");
+    if (!hasToken)
+        return { valid: false };
+    // Try a quick endpoint lookup to verify the token works
+    const endpoint = getEndpoint();
+    if (!endpoint)
+        return { valid: false };
+    return { valid: true, endpoint };
+}
+// =============================================================================
+// Commands
+// =============================================================================
+export function registerRegistryCommands(program) {
+    const registry = program
+        .command("registry")
+        .description("Manage npm registry auth for @mesh-tech packages");
+    registry
+        .command("login")
+        .description("Authenticate with CodeArtifact and configure .npmrc")
+        .argument("[context]", 'Platform context for Zitadel auth (e.g., "mesh.dev")')
+        .option("--role <arn>", "IAM role ARN for registry access")
+        .option("--ci", "CI mode — refresh token only, skip project .npmrc setup")
+        .option("--skip-npmrc", "Skip project .npmrc setup")
+        .action(async (context, opts) => {
+        // Resolve AWS credentials
+        const awsCreds = resolveCredentials(context, opts.role);
+        const env = Object.keys(awsCreds).length > 0
+            ? { ...process.env, ...awsCreds }
+            : undefined;
+        // Step 1: Run `aws codeartifact login` (sets token in ~/.npmrc)
+        logInfo("Authenticating with CodeArtifact...");
+        if (!codeartifactLogin(env)) {
+            logError("CodeArtifact login failed.\n\n" +
+                "Check that your AWS credentials have codeartifact:GetAuthorizationToken permission.\n" +
+                "If using AWS SSO, run: aws sso login\n" +
+                "If using Zitadel: mesh login <context>");
+            process.exit(1);
+        }
+        logSuccess("CodeArtifact token refreshed (valid for 12 hours)");
+        // Step 2: Get endpoint URL
+        const endpoint = getEndpoint(env);
+        if (!endpoint) {
+            logWarn("Could not retrieve registry endpoint — .npmrc scope not configured");
+            logInfo("You may need to manually add to .npmrc:");
+            logInfo(`  ${CA_NAMESPACE}:registry=https://mesh-platform-<ACCOUNT>.d.codeartifact.${CA_REGION}.amazonaws.com/npm/${CA_REPOSITORY}/`);
+            process.exit(0);
+        }
+        // Step 3: Ensure project .npmrc (unless --ci or --skip-npmrc)
+        if (!opts.ci && !opts.skipNpmrc) {
+            const result = ensureProjectNpmrc(endpoint);
+            if (result.created) {
+                logSuccess(`Created ${result.path} with ${CA_NAMESPACE} registry scope`);
+            }
+            else if (result.updated) {
+                logSuccess(`Updated ${CA_NAMESPACE} registry in ${result.path}`);
+            }
+            else {
+                logInfo(`${result.path} already configured`);
+            }
+        }
+        logSuccess(`Ready — run pnpm install to fetch ${CA_NAMESPACE} packages`);
+    });
+    registry
+        .command("status")
+        .description("Check current registry authentication status")
+        .action(() => {
+        const { valid, endpoint } = checkExistingToken();
+        if (!valid) {
+            logWarn("No valid CodeArtifact token found. Run: mesh registry login");
+            process.exit(1);
+        }
+        logSuccess("CodeArtifact token found in ~/.npmrc");
+        if (endpoint) {
+            logInfo(`Endpoint: ${endpoint}`);
+        }
+        // Check project .npmrc
+        const projectRoot = findProjectRoot();
+        if (projectRoot) {
+            const npmrcPath = path.join(projectRoot, ".npmrc");
+            if (fs.existsSync(npmrcPath)) {
+                const content = fs.readFileSync(npmrcPath, "utf-8");
+                if (content.includes(`${CA_NAMESPACE}:registry=`)) {
+                    logSuccess(`Project .npmrc configured (${npmrcPath})`);
+                }
+                else {
+                    logWarn(`Project .npmrc exists but missing ${CA_NAMESPACE} scope (${npmrcPath})`);
+                    logInfo("Run: mesh registry login");
+                }
+            }
+            else {
+                logWarn(`No .npmrc in project root (${projectRoot})`);
+                logInfo("Run: mesh registry login");
+            }
+        }
+    });
+}
+//# sourceMappingURL=registry.js.map

package/dist/src/commands/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/commands/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,gFAAgF;AAChF,6CAA6C;AAC7C,gFAAgF;AAEhF,MAAM,SAAS,GAAG,eAAe,CAAC;AAClC,MAAM,aAAa,GAAG,eAAe,CAAC;AACtC,MAAM,YAAY,GAAG,YAAY,CAAC;AAClC,MAAM,SAAS,GAAG,WAAW,CAAC;AAE9B,2EAA2E;AAC3E,yDAAyD;AACzD,MAAM,qBAAqB,GAAkB,IAAI,CAAC;AAElD,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF;;GAEG;AACH,SAAS,WAAW,CAAC,GAA4B;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE;YACjC,cAAc,EAAE,yBAAyB;YACzC,UAAU,EAAE,SAAS;YACrB,cAAc,EAAE,aAAa;YAC7B,UAAU,EAAE,KAAK;YACjB,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,oBAAoB;SAChC,EAAE;YACD,QAAQ,EAAE,OAAO;YACjB,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS;YACjD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,GAA4B;IACrD,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,EAAE;YAClB,cAAc,EAAE,OAAO;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,SAAS;YACrB,cAAc,EAAE,aAAa;YAC7B,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,SAAS;SACtB,EAAE;YACD,QAAQ,EAAE,OAAO;YACjB,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS;YACjD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE;YACjC,KAAK,EAAE,aAAa;YACpB,YAAY,EAAE,OAAO;YACrB,qBAAqB,EAAE,eAAe;YACtC,UAAU,EAAE,MAAM;SACnB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAE3D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC;QAC7C,OAAO;YACL,iBAAiB,EAAE,KAAK,CAAC,WAAW;YACpC,qBAAqB,EAAE,KAAK,CAAC,eAAe;YAC5C,iBAAiB,EAAE,KAAK,CAAC,YAAY;SACtC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAChC,OAAe,EACf,OAAe,EACf,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE;YACjC,KAAK,EAAE,+BAA+B;YACtC,YAAY,EAAE,OAAO;YACrB,sBAAsB,EAAE,OAAO;YAC/B,qBAAqB,EAAE,WAAW;YAClC,UAAU,EAAE,MAAM;SACnB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAE3D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC;QAC7C,OAAO;YACL,iBAAiB,EAAE,KAAK,CAAC,WAAW;YACpC,qBAAqB,EAAE,KAAK,CAAC,eAAe;YAC5C,iBAAiB,EAAE,KAAK,CAAC,YAAY;SACtC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,OAAgB,EAChB,OAAgB;IAEhB,kDAAkD;IAClD,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QACnE,OAAO,CAAC,iDAAiD,CAAC,CAAC;QAC3D,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,kDAAkD;IAClD,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAC5D,MAAM,UAAU,GAAG,OAAO,IAAI,qBAAqB,CAAC;YACpD,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,WAAW,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,eAAe,CAAC;qBACrD,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC;qBAClC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChB,OAAO,CAAC,uCAAuC,SAAS,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,CAAC;gBAE9E,MAAM,KAAK,GAAG,yBAAyB,CAAC,UAAU,EAAE,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBACpF,IAAI,KAAK,EAAE,CAAC;oBACV,UAAU,CAAC,mCAAmC,CAAC,CAAC;oBAChD,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,CAAC,kEAAkE,CAAC,CAAC;YAC9E,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,2BAA2B,SAAS,CAAC,KAAK,uDAAuD,CAAC,CAAC;YAC7G,CAAC;QACH,CAAC;aAAM,IAAI,SAAS,EAAE,CAAC;YACrB,OAAO,CAAC,6BAA6B,OAAO,qBAAqB,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,8BAA8B,OAAO,qBAAqB,OAAO,EAAE,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,YAAY,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,CAAC;YACV,UAAU,CAAC,mCAAmC,CAAC,CAAC;YAChD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,CAAC,8DAA8D,CAAC,CAAC;IAC1E,CAAC;IAED,gDAAgD;IAChD,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACrC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe;IACtB,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACxB,OAAO,IAAI,EAAE,CAAC;QACZ,IACE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;YACpD,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YAC/C,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;YAC5C,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EACvC,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,WAAW,GAAG,eAAe,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACvD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,GAAG,YAAY,aAAa,QAAQ,EAAE,CAAC;IAEzD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QACvD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAEpD,wDAAwD;IACxD,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;IACxF,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,mCAAmC;QACnC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7D,CAAC;QACD,uBAAuB;QACvB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACvD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5D,CAAC;IAED,oBAAoB;IACpB,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC5D,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB;IACzB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAEvD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAEpD,oDAAoD;IACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACtF,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAEvC,wDAAwD;IACxD,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAEvC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED,gFAAgF;AAChF,WAAW;AACX,gFAAgF;AAEhF,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,MAAM,QAAQ,GAAG,OAAO;SACrB,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,kDAAkD,CAAC,CAAC;IAEnE,QAAQ;SACL,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,qDAAqD,CAAC;SAClE,QAAQ,CAAC,WAAW,EAAE,sDAAsD,CAAC;SAC7E,MAAM,CAAC,cAAc,EAAE,kCAAkC,CAAC;SAC1D,MAAM,CAAC,MAAM,EAAE,yDAAyD,CAAC;SACzE,MAAM,CAAC,cAAc,EAAE,2BAA2B,CAAC;SACnD,MAAM,CAAC,KAAK,EAAE,OAA2B,EAAE,IAA0D,EAAE,EAAE;QACxG,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;YAC1C,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,QAAQ,EAA4B;YAC3D,CAAC,CAAC,SAAS,CAAC;QAEd,gEAAgE;QAChE,OAAO,CAAC,qCAAqC,CAAC,CAAC;QAC/C,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,QAAQ,CACN,gCAAgC;gBAChC,uFAAuF;gBACvF,wCAAwC;gBACxC,wCAAwC,CACzC,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,UAAU,CAAC,mDAAmD,CAAC,CAAC;QAEhE,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,oEAAoE,CAAC,CAAC;YAC9E,OAAO,CAAC,yCAAyC,CAAC,CAAC;YACnD,OAAO,CAAC,KAAK,YAAY,4DAA4D,SAAS,sBAAsB,aAAa,GAAG,CAAC,CAAC;YACtI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,8DAA8D;QAC9D,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,UAAU,CAAC,WAAW,MAAM,CAAC,IAAI,SAAS,YAAY,iBAAiB,CAAC,CAAC;YAC3E,CAAC;iBAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC1B,UAAU,CAAC,WAAW,YAAY,gBAAgB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACnE,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,MAAM,CAAC,IAAI,qBAAqB,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,UAAU,CAAC,qCAAqC,YAAY,WAAW,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEL,QAAQ;SACL,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,8CAA8C,CAAC;SAC3D,MAAM,CAAC,GAAG,EAAE;QACX,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,kBAAkB,EAAE,CAAC;QAEjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,6DAA6D,CAAC,CAAC;YACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,UAAU,CAAC,sCAAsC,CAAC,CAAC;QACnD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,aAAa,QAAQ,EAAE,CAAC,CAAC;QACnC,CAAC;QAED,uBAAuB;QACvB,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACnD,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBACpD,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,YAAY,YAAY,CAAC,EAAE,CAAC;oBAClD,UAAU,CAAC,8BAA8B,SAAS,GAAG,CAAC,CAAC;gBACzD,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,qCAAqC,YAAY,WAAW,SAAS,GAAG,CAAC,CAAC;oBAClF,OAAO,CAAC,0BAA0B,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,8BAA8B,WAAW,GAAG,CAAC,CAAC;gBACtD,OAAO,CAAC,0BAA0B,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/secrets/exec.d.ts

@@ -0,0 +1,17 @@
+/**
+ * mesh secrets exec - Execute command with secrets from AWS Secrets Manager
+ *
+ * Fetches a JSON secret from Secrets Manager and injects all key-value pairs
+ * as environment variables before running the specified command.
+ *
+ * Usage:
+ *   mesh secrets exec --secret=<name-or-arn> [--db-host=<host>] -- <command>
+ *
+ * Options:
+ *   --db-host=<host>  Rewrite DATABASE_URL host (for dev mode tunneling)
+ *
+ * Example:
+ *   mesh secrets exec --secret=mesh/encore/dev/rdc/db-credentials --db-host=localhost -- pnpm dev
+ */
+export declare function execCommand(args: string[]): Promise<void>;
+//# sourceMappingURL=exec.d.ts.map

package/dist/src/commands/secrets/exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../../../src/commands/secrets/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA4FH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA+D/D"}

package/dist/src/commands/secrets/exec.js

@@ -0,0 +1,132 @@
+/**
+ * mesh secrets exec - Execute command with secrets from AWS Secrets Manager
+ *
+ * Fetches a JSON secret from Secrets Manager and injects all key-value pairs
+ * as environment variables before running the specified command.
+ *
+ * Usage:
+ *   mesh secrets exec --secret=<name-or-arn> [--db-host=<host>] -- <command>
+ *
+ * Options:
+ *   --db-host=<host>  Rewrite DATABASE_URL host (for dev mode tunneling)
+ *
+ * Example:
+ *   mesh secrets exec --secret=mesh/encore/dev/rdc/db-credentials --db-host=localhost -- pnpm dev
+ */
+import { spawn } from "child_process";
+import { SecretsManagerClient, GetSecretValueCommand, } from "@aws-sdk/client-secrets-manager";
+// Simple logging helpers
+function logInfo(msg) {
+    console.log(`\u001b[36mℹ\u001b[0m ${msg}`);
+}
+function logSuccess(msg) {
+    console.log(`\u001b[32m✓\u001b[0m ${msg}`);
+}
+function logError(msg) {
+    console.error(`\u001b[31m✗\u001b[0m ${msg}`);
+}
+function parseArgs(args) {
+    const options = {};
+    let commandArgs = [];
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === "--") {
+            commandArgs = args.slice(i + 1);
+            break;
+        }
+        if (arg.startsWith("--secret=")) {
+            options.secret = arg.substring("--secret=".length);
+        }
+        else if (arg === "--secret" && args[i + 1]) {
+            options.secret = args[++i];
+        }
+        else if (arg.startsWith("--db-host=")) {
+            options.dbHost = arg.substring("--db-host=".length);
+        }
+        else if (arg === "--db-host" && args[i + 1]) {
+            options.dbHost = args[++i];
+        }
+    }
+    return { options, commandArgs };
+}
+async function fetchSecret(client, secretId) {
+    const response = await client.send(new GetSecretValueCommand({ SecretId: secretId }));
+    if (!response.SecretString) {
+        throw new Error("Secret has no string value");
+    }
+    try {
+        return JSON.parse(response.SecretString);
+    }
+    catch {
+        throw new Error("Secret is not valid JSON");
+    }
+}
+/**
+ * Rewrite the host in a DATABASE_URL
+ * Useful for dev mode where we tunnel to the database via localhost
+ */
+function rewriteDatabaseHost(databaseUrl, newHost) {
+    try {
+        const url = new URL(databaseUrl);
+        const originalHost = url.host;
+        url.hostname = newHost;
+        // Keep the original port if the new host doesn't include one
+        if (!newHost.includes(":")) {
+            url.port = url.port || "5432";
+        }
+        logInfo(`Rewrote DATABASE_URL host: ${originalHost} → ${url.host}`);
+        return url.toString();
+    }
+    catch {
+        logError(`Failed to parse DATABASE_URL for host rewrite`);
+        return databaseUrl;
+    }
+}
+export async function execCommand(args) {
+    const { options, commandArgs } = parseArgs(args);
+    if (!options.secret || commandArgs.length === 0) {
+        logError("Usage: mesh secrets exec --secret=<name-or-arn> [options] -- <command>");
+        logInfo("");
+        logInfo("Options:");
+        logInfo("  --secret=<name-or-arn>  Secret name or ARN in Secrets Manager");
+        logInfo("  --db-host=<host>        Rewrite DATABASE_URL host (for dev tunneling)");
+        logInfo("");
+        logInfo("Examples:");
+        logInfo("  mesh secrets exec --secret=mesh/tenant/stage/app/secret -- pnpm dev");
+        logInfo("  mesh secrets exec --secret=mesh/tenant/stage/app/db --db-host=localhost -- pnpm dev");
+        process.exit(1);
+    }
+    const secretsManager = new SecretsManagerClient({});
+    logInfo(`Fetching secret: ${options.secret}`);
+    let secretValues;
+    try {
+        secretValues = await fetchSecret(secretsManager, options.secret);
+    }
+    catch (error) {
+        logError(`Failed to fetch secret: ${error}`);
+        process.exit(1);
+    }
+    const envKeys = Object.keys(secretValues);
+    logSuccess(`Loaded ${envKeys.length} environment variable(s) from secret`);
+    // Rewrite DATABASE_URL host for dev mode tunneling
+    if (options.dbHost && secretValues.DATABASE_URL) {
+        secretValues.DATABASE_URL = rewriteDatabaseHost(secretValues.DATABASE_URL, options.dbHost);
+    }
+    // Build environment with secret values injected
+    const env = {
+        ...process.env,
+        ...secretValues,
+    };
+    const [cmd, ...cmdArgs] = commandArgs;
+    logInfo(`Running: ${commandArgs.join(" ")}`);
+    console.log("");
+    const child = spawn(cmd, cmdArgs, { stdio: "inherit", env });
+    child.on("exit", (code) => {
+        process.exit(code ?? 0);
+    });
+    child.on("error", (error) => {
+        logError(`Failed to start command: ${error.message}`);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=exec.js.map

package/dist/src/commands/secrets/exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../../../src/commands/secrets/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AAEzC,yBAAyB;AACzB,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,CAAC,GAAG,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,CAAC,GAAG,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,OAAO,CAAC,KAAK,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAC;AAC/C,CAAC;AAOD,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,OAAO,GAAY,EAAE,CAAC;IAC5B,IAAI,WAAW,GAAa,EAAE,CAAC;IAE/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QAErB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAChC,MAAM;QACR,CAAC;QAED,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC;aAAM,IAAI,GAAG,KAAK,UAAU,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACxC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC;aAAM,IAAI,GAAG,KAAK,WAAW,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC9C,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,MAA4B,EAC5B,QAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAClD,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAA2B,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,WAAmB,EAAE,OAAe;IAC/D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC;QAC9B,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC;QACvB,6DAA6D;QAC7D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC;QAChC,CAAC;QACD,OAAO,CAAC,8BAA8B,YAAY,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACpE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,+CAA+C,CAAC,CAAC;QAC1D,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAc;IAC9C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAEjD,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,QAAQ,CAAC,wEAAwE,CAAC,CAAC;QACnF,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,OAAO,CAAC,UAAU,CAAC,CAAC;QACpB,OAAO,CAAC,iEAAiE,CAAC,CAAC;QAC3E,OAAO,CAAC,yEAAyE,CAAC,CAAC;QACnF,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,OAAO,CAAC,WAAW,CAAC,CAAC;QACrB,OAAO,CACL,uEAAuE,CACxE,CAAC;QACF,OAAO,CACL,uFAAuF,CACxF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAEpD,OAAO,CAAC,oBAAoB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE9C,IAAI,YAAoC,CAAC;IACzC,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,WAAW,CAAC,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1C,UAAU,CAAC,UAAU,OAAO,CAAC,MAAM,sCAAsC,CAAC,CAAC;IAE3E,mDAAmD;IACnD,IAAI,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,YAAY,EAAE,CAAC;QAChD,YAAY,CAAC,YAAY,GAAG,mBAAmB,CAC7C,YAAY,CAAC,YAAY,EACzB,OAAO,CAAC,MAAM,CACf,CAAC;IACJ,CAAC;IAED,gDAAgD;IAChD,MAAM,GAAG,GAAsB;QAC7B,GAAG,OAAO,CAAC,GAAG;QACd,GAAG,YAAY;KAChB,CAAC;IAEF,MAAM,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,WAAW,CAAC;IACtC,OAAO,CAAC,YAAY,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAE9D,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAmB,EAAE,EAAE;QACvC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;QACjC,QAAQ,CAAC,4BAA4B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/commands/secrets/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * mesh secrets - Commands for working with AWS Secrets Manager
+ *
+ * Commands:
+ * mesh secrets exec    - Run command with secrets injected as environment variables
+ * mesh secrets set     - Set credentials for an external service
+ */
+import { Command } from "commander";
+export declare function registerSecretsCommands(program: Command): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/src/commands/secrets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/secrets/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA0B9D"}

package/dist/src/commands/secrets/index.js

@@ -0,0 +1,35 @@
+/**
+ * mesh secrets - Commands for working with AWS Secrets Manager
+ *
+ * Commands:
+ * mesh secrets exec    - Run command with secrets injected as environment variables
+ * mesh secrets set     - Set credentials for an external service
+ */
+import { execCommand } from "./exec.js";
+import { setCommand } from "./set.js";
+export function registerSecretsCommands(program) {
+    const secrets = program
+        .command("secrets")
+        .description("AWS Secrets Manager utilities");
+    secrets
+        .command("exec")
+        .description("Run command with secrets as environment variables")
+        .allowUnknownOption(true)
+        .action(async (_opts, cmd) => {
+        // Get all args after "secrets exec"
+        const args = cmd.args;
+        await execCommand(args);
+    });
+    secrets
+        .command("set [service]")
+        .description("Set credentials for an external service (e.g., mesh secrets set external/symitar)")
+        .option("--key <key>", "Instance key for multi-instance services (e.g., FI ID)")
+        .option("--all", "Prompt for all fields including optional ones")
+        .option("--json <json>", "Non-interactive: provide values as JSON")
+        .option("--stage <stage>", "Override stage detection")
+        .option("--region <region>", "AWS region (default: us-east-2)")
+        .action(async (service, opts) => {
+        await setCommand(service, opts);
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/src/commands/secrets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/commands/secrets/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEtC,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,+BAA+B,CAAC,CAAC;IAEhD,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,mDAAmD,CAAC;SAChE,kBAAkB,CAAC,IAAI,CAAC;SACxB,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3B,oCAAoC;QACpC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,mFAAmF,CAAC;SAChG,MAAM,CAAC,aAAa,EAAE,wDAAwD,CAAC;SAC/E,MAAM,CAAC,OAAO,EAAE,+CAA+C,CAAC;SAChE,MAAM,CAAC,eAAe,EAAE,yCAAyC,CAAC;SAClE,MAAM,CAAC,iBAAiB,EAAE,0BAA0B,CAAC;SACrD,MAAM,CAAC,mBAAmB,EAAE,iCAAiC,CAAC;SAC9D,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/secrets/set.d.ts

@@ -0,0 +1,22 @@
+/**
+ * mesh secrets set — Set credentials for an external service.
+ *
+ * Reads the credential field schema from SSM (written by ExternalService),
+ * prompts interactively for each field, and writes to Secrets Manager.
+ *
+ * Usage:
+ *   mesh secrets set external/symitar                  # single-instance
+ *   mesh secrets set external/symitar --key=12345      # multi-instance (specific key)
+ *   mesh secrets set external/symitar --all            # include optional fields
+ *   mesh secrets set external/symitar --non-interactive --json='{"baseUrl":"..."}'
+ *
+ * The command detects tenant/stage from Pulumi config in the current directory.
+ */
+export declare function setCommand(servicePath: string | undefined, opts: {
+    key?: string;
+    all?: boolean;
+    json?: string;
+    stage?: string;
+    region?: string;
+}): Promise<void>;
+//# sourceMappingURL=set.d.ts.map

package/dist/src/commands/secrets/set.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"set.d.ts","sourceRoot":"","sources":["../../../../src/commands/secrets/set.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AA4GH,wBAAsB,UAAU,CAC9B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACA,OAAO,CAAC,IAAI,CAAC,CAkKf"}