@mesh-tech/mesh-cli 0.1.0

package/dist/src/commands/secrets/set.js

@@ -0,0 +1,234 @@
+/**
+ * mesh secrets set — Set credentials for an external service.
+ *
+ * Reads the credential field schema from SSM (written by ExternalService),
+ * prompts interactively for each field, and writes to Secrets Manager.
+ *
+ * Usage:
+ *   mesh secrets set external/symitar                  # single-instance
+ *   mesh secrets set external/symitar --key=12345      # multi-instance (specific key)
+ *   mesh secrets set external/symitar --all            # include optional fields
+ *   mesh secrets set external/symitar --non-interactive --json='{"baseUrl":"..."}'
+ *
+ * The command detects tenant/stage from Pulumi config in the current directory.
+ */
+import { SSMClient, GetParametersByPathCommand, } from "@aws-sdk/client-ssm";
+import { SecretsManagerClient, GetSecretValueCommand, PutSecretValueCommand, CreateSecretCommand, } from "@aws-sdk/client-secrets-manager";
+import input from "@inquirer/input";
+import password from "@inquirer/password";
+import { detectContext } from "../../utils/context.js";
+import { logInfo, logSuccess, logError } from "../../utils/log.js";
+// =============================================================================
+// Interactive prompt (using @inquirer/input and @inquirer/password)
+// =============================================================================
+// =============================================================================
+// SSM discovery
+// =============================================================================
+async function discoverExternalServices(ssmClient, tenant, platformEnv) {
+    const services = new Map();
+    // Scan all apps for external-services
+    const basePath = `/mesh-platform/${tenant}/${platformEnv}`;
+    let nextToken;
+    do {
+        const response = await ssmClient.send(new GetParametersByPathCommand({
+            Path: basePath,
+            Recursive: true,
+            NextToken: nextToken,
+        }));
+        for (const param of response.Parameters ?? []) {
+            if (!param.Name || !param.Value)
+                continue;
+            // Match: .../apps/{app}/stacks/{stack}/external-services/{name}/meta
+            const metaMatch = param.Name.match(/\/external-services\/([^/]+)\/meta$/);
+            if (metaMatch?.[1]) {
+                const serviceName = metaMatch[1];
+                const meta = JSON.parse(param.Value);
+                const existing = services.get(serviceName);
+                services.set(serviceName, { ...existing, meta });
+            }
+            // Match: .../external-services/{name}/credentials
+            const credMatch = param.Name.match(/\/external-services\/([^/]+)\/credentials$/);
+            if (credMatch?.[1]) {
+                const serviceName = credMatch[1];
+                const schema = JSON.parse(param.Value);
+                const existing = services.get(serviceName);
+                if (existing) {
+                    existing.schema = schema;
+                }
+                else {
+                    services.set(serviceName, { meta: {}, schema });
+                }
+            }
+        }
+        nextToken = response.NextToken;
+    } while (nextToken);
+    return services;
+}
+// =============================================================================
+// Main command
+// =============================================================================
+export async function setCommand(servicePath, opts) {
+    const context = detectContext(opts.stage);
+    const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
+    const ssmClient = new SSMClient({ region });
+    const smClient = new SecretsManagerClient({ region });
+    // Discover all external services
+    const services = await discoverExternalServices(ssmClient, context.tenant, context.platformEnv);
+    if (services.size === 0) {
+        logError("No external services found. Deploy an ExternalService first:\n" +
+            "  new mesh.apps.ExternalService(\"symitar\", { env, credentials: { ... } })");
+        process.exit(1);
+    }
+    // Parse service name from path (e.g., "external/symitar" → "symitar")
+    let serviceName;
+    if (servicePath) {
+        serviceName = servicePath.replace(/^external\//, "");
+    }
+    // If no service specified or not found, list available
+    if (!serviceName || !services.has(serviceName)) {
+        if (serviceName) {
+            logError(`External service "${serviceName}" not found.`);
+        }
+        console.error("\nAvailable external services:");
+        for (const [name, svc] of services) {
+            const desc = svc.meta?.description ? ` — ${svc.meta.description}` : "";
+            const type = svc.meta?.type ? ` (${svc.meta.type})` : "";
+            console.error(`  ${name}${type}${desc}`);
+        }
+        console.error(`\nUsage: mesh secrets set external/<name>`);
+        process.exit(serviceName ? 1 : 0);
+    }
+    const svc = services.get(serviceName);
+    const schema = svc.schema;
+    if (!schema) {
+        logError(`No credential schema found for "${serviceName}".`);
+        process.exit(1);
+    }
+    // Determine secret path
+    const secretPrefix = svc.meta.secretPrefix;
+    const secretId = opts.key ? `${secretPrefix}/${opts.key}` : secretPrefix;
+    if (schema.keyedBy && !opts.key) {
+        logError(`"${serviceName}" is multi-instance (keyed by ${schema.keyedBy}). ` +
+            `Specify an instance:\n  mesh secrets set external/${serviceName} --key=<${schema.keyedBy}>`);
+        process.exit(1);
+    }
+    // Read existing values (if any)
+    let existing = {};
+    try {
+        const response = await smClient.send(new GetSecretValueCommand({ SecretId: secretId }));
+        if (response.SecretString) {
+            existing = JSON.parse(response.SecretString);
+        }
+    }
+    catch (err) {
+        if (err.name !== "ResourceNotFoundException") {
+            throw err;
+        }
+        // Secret doesn't exist yet (multi-instance key) — will create
+    }
+    // Non-interactive mode: JSON input
+    if (opts.json) {
+        const values = JSON.parse(opts.json);
+        const merged = { ...existing, ...values };
+        await writeSecret(smClient, secretId, merged, svc.meta);
+        logSuccess(`Credentials written to ${secretId}`);
+        return;
+    }
+    // Interactive mode
+    console.error("");
+    logInfo(`Setting credentials for: ${svc.meta.description || serviceName}`);
+    if (opts.key) {
+        logInfo(`Instance: ${opts.key}`);
+    }
+    logInfo(`Secret: ${secretId}`);
+    console.error("");
+    const values = {};
+    for (const [fieldKey, field] of Object.entries(schema.fields)) {
+        // Skip optional fields unless --all
+        if (field.optional && !opts.all) {
+            const existingVal = existing[fieldKey];
+            if (existingVal) {
+                values[fieldKey] = existingVal;
+            }
+            continue;
+        }
+        const existingVal = existing[fieldKey];
+        const hasExisting = existingVal && existingVal !== "";
+        const message = field.description
+            ? `${field.name} (${field.description})`
+            : field.name;
+        let value;
+        if (field.secret) {
+            // Masked input via @inquirer/password — shows * per character
+            value = await password({
+                message: field.optional ? `${message} [optional]` : message,
+                mask: "*",
+            });
+            // For secret fields, keep existing if user just pressed Enter
+            if (!value && hasExisting) {
+                value = existingVal;
+            }
+        }
+        else {
+            // Normal input with optional default
+            value = await input({
+                message: field.optional ? `${message} [optional]` : message,
+                default: hasExisting ? existingVal : undefined,
+            });
+        }
+        if (value) {
+            values[fieldKey] = value;
+        }
+        else if (hasExisting) {
+            values[fieldKey] = existingVal;
+        }
+        else {
+            values[fieldKey] = "";
+        }
+    }
+    console.error("");
+    // Merge and write
+    const merged = { ...existing, ...values };
+    await writeSecret(smClient, secretId, merged, svc.meta);
+    logSuccess(`Credentials written to ${secretId}`);
+    // Show summary (mask secret fields)
+    console.error("\nStored fields:");
+    for (const [key, field] of Object.entries(schema.fields)) {
+        const val = merged[key];
+        if (!val)
+            continue;
+        const display = field.secret ? "********" : val;
+        console.error(`  ${field.name}: ${display}`);
+    }
+    console.error("");
+}
+// =============================================================================
+// Write to Secrets Manager
+// =============================================================================
+async function writeSecret(client, secretId, values, meta) {
+    const secretString = JSON.stringify(values);
+    try {
+        await client.send(new PutSecretValueCommand({
+            SecretId: secretId,
+            SecretString: secretString,
+        }));
+    }
+    catch (err) {
+        if (err.name === "ResourceNotFoundException") {
+            // Multi-instance: create the per-key secret
+            await client.send(new CreateSecretCommand({
+                Name: secretId,
+                Description: `External service credentials for ${meta.name} (instance)`,
+                SecretString: secretString,
+                Tags: [
+                    { Key: "mesh:type", Value: "external-service" },
+                    { Key: "mesh:service", Value: meta.name },
+                ],
+            }));
+        }
+        else {
+            throw err;
+        }
+    }
+}
+//# sourceMappingURL=set.js.map

package/dist/src/commands/secrets/set.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set.js","sourceRoot":"","sources":["../../../../src/commands/secrets/set.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,SAAS,EACT,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,MAAM,iBAAiB,CAAC;AACpC,OAAO,QAAQ,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAyBnE,gFAAgF;AAChF,oEAAoE;AACpE,gFAAgF;AAEhF,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF,KAAK,UAAU,wBAAwB,CACrC,SAAoB,EACpB,MAAc,EACd,WAAmB;IAEnB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoE,CAAC;IAE7F,sCAAsC;IACtC,MAAM,QAAQ,GAAG,kBAAkB,MAAM,IAAI,WAAW,EAAE,CAAC;IAC3D,IAAI,SAA6B,CAAC;IAElC,GAAG,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CACnC,IAAI,0BAA0B,CAAC;YAC7B,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,SAAS;SACrB,CAAC,CACH,CAAC;QAEF,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK;gBAAE,SAAS;YAE1C,qEAAqE;YACrE,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAChC,qCAAqC,CACtC,CAAC;YACF,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnB,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;gBACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAwB,CAAC;gBAC5D,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC3C,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,CAAC;YAED,kDAAkD;YAClD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAChC,4CAA4C,CAC7C,CAAC;YACF,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnB,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;gBACjC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAqB,CAAC;gBAC3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC3C,IAAI,QAAQ,EAAE,CAAC;oBACb,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;gBAC3B,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,EAAyB,EAAE,MAAM,EAAE,CAAC,CAAC;gBACzE,CAAC;YACH,CAAC;QACH,CAAC;QAED,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACjC,CAAC,QAAQ,SAAS,EAAE;IAEpB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,WAA+B,EAC/B,IAMC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW,CAAC;IAEpE,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAEtD,iCAAiC;IACjC,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAC7C,SAAS,EACT,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,WAAW,CACpB,CAAC;IAEF,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACxB,QAAQ,CACN,gEAAgE;YAC9D,6EAA6E,CAChF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,sEAAsE;IACtE,IAAI,WAA+B,CAAC;IACpC,IAAI,WAAW,EAAE,CAAC;QAChB,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,uDAAuD;IACvD,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,IAAI,WAAW,EAAE,CAAC;YAChB,QAAQ,CAAC,qBAAqB,WAAW,cAAc,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC3D,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;IACvC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAE1B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,QAAQ,CAAC,mCAAmC,WAAW,IAAI,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,wBAAwB;IACxB,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;IAEzE,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,QAAQ,CACN,IAAI,WAAW,iCAAiC,MAAM,CAAC,OAAO,KAAK;YACjE,qDAAqD,WAAW,WAAW,MAAM,CAAC,OAAO,GAAG,CAC/F,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,gCAAgC;IAChC,IAAI,QAAQ,GAA2B,EAAE,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAClC,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAClD,CAAC;QACF,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC1B,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,CAAC,IAAI,KAAK,2BAA2B,EAAE,CAAC;YAC7C,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,8DAA8D;IAChE,CAAC;IAED,mCAAmC;IACnC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,EAAE,CAAC;QAC1C,MAAM,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACxD,UAAU,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IAED,mBAAmB;IACnB,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,4BAA4B,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,WAAW,EAAE,CAAC,CAAC;IAC3E,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,aAAa,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;IAC/B,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAElB,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,oCAAoC;QACpC,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAChC,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC;YACjC,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,WAAW,IAAI,WAAW,KAAK,EAAE,CAAC;QAEtD,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW;YAC/B,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,WAAW,GAAG;YACxC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAEf,IAAI,KAAa,CAAC;QAElB,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,8DAA8D;YAC9D,KAAK,GAAG,MAAM,QAAQ,CAAC;gBACrB,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,aAAa,CAAC,CAAC,CAAC,OAAO;gBAC3D,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;YACH,8DAA8D;YAC9D,IAAI,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;gBAC1B,KAAK,GAAG,WAAY,CAAC;YACvB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,qCAAqC;YACrC,KAAK,GAAG,MAAM,KAAK,CAAC;gBAClB,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,aAAa,CAAC,CAAC,CAAC,OAAO;gBAC3D,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;aAC/C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;QAC3B,CAAC;aAAM,IAAI,WAAW,EAAE,CAAC;YACvB,MAAM,CAAC,QAAQ,CAAC,GAAG,WAAY,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAElB,kBAAkB;IAClB,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,EAAE,CAAC;IAC1C,MAAM,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAExD,UAAU,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;IAEjD,oCAAoC;IACpC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAClC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC;QAChD,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACpB,CAAC;AAED,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,KAAK,UAAU,WAAW,CACxB,MAA4B,EAC5B,QAAgB,EAChB,MAA8B,EAC9B,IAAyB;IAEzB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAE5C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,qBAAqB,CAAC;YACxB,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,YAAY;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,CAAC,IAAI,KAAK,2BAA2B,EAAE,CAAC;YAC7C,4CAA4C;YAC5C,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,mBAAmB,CAAC;gBACtB,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,oCAAoC,IAAI,CAAC,IAAI,aAAa;gBACvE,YAAY,EAAE,YAAY;gBAC1B,IAAI,EAAE;oBACJ,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,kBAAkB,EAAE;oBAC/C,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;iBAC1C;aACF,CAAC,CACH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/src/commands/stack.d.ts

@@ -0,0 +1,17 @@
+/**
+ * mesh stack — Manage personal Pulumi stacks.
+ *
+ * mesh stack init             Create a personal dev stack (dev-{github-user})
+ * mesh stack init --from uat  Base on a different stack
+ *
+ * Creates Pulumi.<stack>.yaml with:
+ *   - mesh:deploy: false (skip K8s deployments — dev-only stack)
+ *   - mesh:deployerRole copied from the base stack
+ *   - aws:region copied from the base stack
+ */
+import { Command } from "commander";
+/**
+ * Find Pulumi.<stack>.yaml files in the app root.
+ */
+export declare function registerStackCommand(program: Command): void;
+//# sourceMappingURL=stack.d.ts.map

package/dist/src/commands/stack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stack.d.ts","sourceRoot":"","sources":["../../../src/commands/stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAyCpC;;GAEG;AAKH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA4I3D"}

package/dist/src/commands/stack.js

@@ -0,0 +1,175 @@
+/**
+ * mesh stack — Manage personal Pulumi stacks.
+ *
+ * mesh stack init             Create a personal dev stack (dev-{github-user})
+ * mesh stack init --from uat  Base on a different stack
+ *
+ * Creates Pulumi.<stack>.yaml with:
+ *   - mesh:deploy: false (skip K8s deployments — dev-only stack)
+ *   - mesh:deployerRole copied from the base stack
+ *   - aws:region copied from the base stack
+ */
+import { execFileSync } from "child_process";
+import * as path from "path";
+import * as fs from "fs";
+import { logError, logInfo, logSuccess, logWarn } from "../utils/log.js";
+import { findAppRoot, findStackConfigs } from "../utils/pulumi.js";
+// =============================================================================
+// Helpers
+// =============================================================================
+/**
+ * Get GitHub username from gh CLI, falling back to git config.
+ */
+function getGitHubUsername() {
+    // Try gh CLI first
+    try {
+        const result = execFileSync("gh", ["api", "user", "--jq", ".login"], {
+            encoding: "utf-8",
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        const login = result.trim();
+        if (login)
+            return login;
+    }
+    catch { }
+    // Fallback: git config
+    try {
+        const result = execFileSync("git", ["config", "user.email"], {
+            encoding: "utf-8",
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        const email = result.trim();
+        // Extract username from GitHub email patterns
+        // e.g., user@users.noreply.github.com or user@example.com
+        const match = email.match(/^(\d+\+)?([^@]+)@/);
+        if (match)
+            return match[2];
+    }
+    catch { }
+    return null;
+}
+/**
+ * Find Pulumi.<stack>.yaml files in the app root.
+ */
+// =============================================================================
+// Command
+// =============================================================================
+export function registerStackCommand(program) {
+    const stack = program
+        .command("stack")
+        .description("Manage personal Pulumi stacks");
+    stack
+        .command("init")
+        .description("Create a personal dev stack (dev-{github-username})")
+        .option("--from <stack>", "Base stack to copy config from")
+        .option("--name <name>", "Override stack name (default: dev-{username})")
+        .action((opts) => {
+        const appRoot = findAppRoot(process.cwd());
+        if (!appRoot) {
+            logError("No Pulumi.yaml found. Run from within a Pulumi app directory.");
+            process.exit(1);
+        }
+        // Get GitHub username
+        const username = getGitHubUsername();
+        if (!username) {
+            logError("Could not determine GitHub username.\n" +
+                "Install gh CLI (https://cli.github.com) and run: gh auth login");
+            process.exit(1);
+        }
+        // Determine base stack
+        let baseStack = opts.from;
+        if (!baseStack) {
+            const stacks = findStackConfigs(appRoot);
+            if (stacks.includes("dev")) {
+                baseStack = "dev";
+            }
+            else if (stacks.length === 1) {
+                baseStack = stacks[0];
+            }
+            else if (stacks.length > 1) {
+                logError(`Multiple stacks found: ${stacks.join(", ")}\n` +
+                    "Specify which to base on: mesh stack init --from <stack>");
+                process.exit(1);
+            }
+            else {
+                logError("No stack configs found (Pulumi.<stack>.yaml).");
+                process.exit(1);
+            }
+        }
+        // Verify base config exists
+        const baseConfigPath = `${appRoot}/Pulumi.${baseStack}.yaml`;
+        if (!fs.existsSync(baseConfigPath)) {
+            logError(`Stack config not found: Pulumi.${baseStack}.yaml`);
+            process.exit(1);
+        }
+        // Determine new stack name
+        const newStack = opts.name ?? `dev-${username}`;
+        const newConfigPath = path.join(appRoot, `Pulumi.${newStack}.yaml`);
+        const configExists = fs.existsSync(newConfigPath);
+        // Initialize the Pulumi stack (creates encryptionsalt in the config file)
+        try {
+            execFileSync("pulumi", ["stack", "init", newStack], {
+                cwd: appRoot,
+                stdio: "inherit",
+            });
+            logSuccess(`Stack initialized: ${newStack}`);
+        }
+        catch (err) {
+            if (err.stderr?.includes("already exists")) {
+                logWarn(`Stack ${newStack} already exists.`);
+            }
+            else {
+                process.exit(err.status ?? 1);
+            }
+        }
+        // Select the new stack
+        try {
+            execFileSync("pulumi", ["stack", "select", newStack], {
+                cwd: appRoot,
+                stdio: ["pipe", "pipe", "pipe"],
+            });
+        }
+        catch { }
+        // Copy config from base stack + add mesh:deploy false
+        if (!configExists) {
+            // Read base stack config as JSON
+            let baseConfig = {};
+            try {
+                const raw = execFileSync("pulumi", ["config", "--json", "--stack", baseStack], { cwd: appRoot, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
+                baseConfig = JSON.parse(raw);
+            }
+            catch {
+                logWarn("Could not read base stack config as JSON; falling back to manual setup.");
+            }
+            // Copy all config keys except mesh:deploy (we'll set that explicitly)
+            for (const [key, entry] of Object.entries(baseConfig)) {
+                if (key === "mesh:deploy")
+                    continue;
+                try {
+                    if (entry.objectValue !== undefined) {
+                        // Structured value — set as JSON (Pulumi parses it back to object)
+                        execFileSync("pulumi", ["config", "set", key, JSON.stringify(entry.objectValue)], { cwd: appRoot, stdio: ["pipe", "pipe", "pipe"] });
+                    }
+                    else if (entry.value === "true" || entry.value === "false") {
+                        execFileSync("pulumi", ["config", "set", "--type", "bool", key, entry.value], { cwd: appRoot, stdio: ["pipe", "pipe", "pipe"] });
+                    }
+                    else {
+                        execFileSync("pulumi", ["config", "set", key, entry.value], { cwd: appRoot, stdio: ["pipe", "pipe", "pipe"] });
+                    }
+                }
+                catch { }
+            }
+            // Set mesh:deploy to false — personal stacks skip K8s deployments
+            execFileSync("pulumi", ["config", "set", "--type", "bool", "mesh:deploy", "false"], {
+                cwd: appRoot,
+                stdio: ["pipe", "pipe", "pipe"],
+            });
+            logSuccess(`Configured Pulumi.${newStack}.yaml (based on ${baseStack}, deploy: false)`);
+        }
+        console.log("");
+        logInfo(`Your personal stack is ready.`);
+        logInfo(`Run: mesh deploy up --yes`);
+        logInfo(`Then: mesh dev`);
+    });
+}
+//# sourceMappingURL=stack.js.map

package/dist/src/commands/stack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stack.js","sourceRoot":"","sources":["../../../src/commands/stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEnE,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF;;GAEG;AACH,SAAS,iBAAiB;IACxB,mBAAmB;IACnB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;YACnE,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,uBAAuB;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE;YAC3D,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5B,8CAA8C;QAC9C,0DAA0D;QAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC/C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,CAAC,CAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,KAAK,GAAG,OAAO;SAClB,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,+BAA+B,CAAC,CAAC;IAEhD,KAAK;SACF,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,qDAAqD,CAAC;SAClE,MAAM,CAAC,gBAAgB,EAAE,gCAAgC,CAAC;SAC1D,MAAM,CAAC,eAAe,EAAE,+CAA+C,CAAC;SACxE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QACf,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,CAAC,+DAA+D,CAAC,CAAC;YAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,sBAAsB;QACtB,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;QACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,CACN,wCAAwC;gBACxC,gEAAgE,CACjE,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,uBAAuB;QACvB,IAAI,SAAS,GAAG,IAAI,CAAC,IAA0B,CAAC;QAChD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,SAAS,GAAG,KAAK,CAAC;YACpB,CAAC;iBAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,SAAS,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;YACzB,CAAC;iBAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,QAAQ,CACN,0BAA0B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBAC/C,0DAA0D,CAC3D,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,+CAA+C,CAAC,CAAC;gBAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,MAAM,cAAc,GAAG,GAAG,OAAO,WAAW,SAAS,OAAO,CAAC;QAC7D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,QAAQ,CAAC,kCAAkC,SAAS,OAAO,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,2BAA2B;QAC3B,MAAM,QAAQ,GAAI,IAAI,CAAC,IAAe,IAAI,OAAO,QAAQ,EAAE,CAAC;QAC5D,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,QAAQ,OAAO,CAAC,CAAC;QAEpE,MAAM,YAAY,GAAG,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAElD,0EAA0E;QAC1E,IAAI,CAAC;YACH,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;gBAClD,GAAG,EAAE,OAAO;gBACZ,KAAK,EAAE,SAAS;aACjB,CAAC,CAAC;YACH,UAAU,CAAC,sBAAsB,QAAQ,EAAE,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC3C,OAAO,CAAC,SAAS,QAAQ,kBAAkB,CAAC,CAAC;YAC/C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC;YACH,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE;gBACpD,GAAG,EAAE,OAAO;gBACZ,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QAEV,sDAAsD;QACtD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,iCAAiC;YACjC,IAAI,UAAU,GAA+E,EAAE,CAAC;YAChG,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,YAAY,CACtB,QAAQ,EACR,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,EAC1C,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACrE,CAAC;gBACF,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,yEAAyE,CAAC,CAAC;YACrF,CAAC;YAED,sEAAsE;YACtE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtD,IAAI,GAAG,KAAK,aAAa;oBAAE,SAAS;gBAEpC,IAAI,CAAC;oBACH,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;wBACpC,mEAAmE;wBACnE,YAAY,CACV,QAAQ,EACR,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EACzD,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAClD,CAAC;oBACJ,CAAC;yBAAM,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;wBAC7D,YAAY,CACV,QAAQ,EACR,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,EACrD,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAClD,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACN,YAAY,CACV,QAAQ,EACR,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,EACnC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAClD,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;YAED,kEAAkE;YAClE,YAAY,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE;gBAClF,GAAG,EAAE,OAAO;gBACZ,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CAAC,CAAC;YAEH,UAAU,CAAC,qBAAqB,QAAQ,mBAAmB,SAAS,kBAAkB,CAAC,CAAC;QAC1F,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,+BAA+B,CAAC,CAAC;QACzC,OAAO,CAAC,2BAA2B,CAAC,CAAC;QACrC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/tunnel/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * mesh tunnel - SSM tunneling to platform services
+ *
+ * Commands:
+ *   mesh tunnel dev          Start all dev tunnels (temporal + db)
+ *   mesh tunnel --services   Start specific services
+ *   mesh tunnel --list       List available services
+ */
+import { Command } from "commander";
+/**
+ * Register tunnel commands with the CLI
+ */
+export declare function registerTunnelCommands(program: Command): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/src/commands/tunnel/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/tunnel/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8OpC;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAoC7D"}