@mesh-tech/mesh-cli 0.1.0

package/dist/src/commands/tunnel/index.js

@@ -0,0 +1,217 @@
+/**
+ * mesh tunnel - SSM tunneling to platform services
+ *
+ * Commands:
+ *   mesh tunnel dev          Start all dev tunnels (temporal + db)
+ *   mesh tunnel --services   Start specific services
+ *   mesh tunnel --list       List available services
+ */
+import { spawn } from "child_process";
+import { getPlatformBastionInfo, logInfo, logError, } from "../../utils/index.js";
+/**
+ * Service definitions with their local ports and display names
+ */
+const SERVICE_CONFIG = {
+    "temporal-frontend": {
+        bastionKey: "temporal-frontend",
+        localPort: 7233,
+        displayName: "Temporal Frontend (gRPC)",
+    },
+    "temporal-ui": {
+        bastionKey: "temporal-ui",
+        localPort: 8080,
+        displayName: "Temporal Web UI",
+    },
+    db: {
+        bastionKey: "rds",
+        localPort: 5432,
+        displayName: "Database (PostgreSQL)",
+    },
+};
+/**
+ * Service groups for convenience commands
+ */
+const SERVICE_GROUPS = {
+    dev: ["temporal-frontend", "temporal-ui", "db"],
+    temporal: ["temporal-frontend", "temporal-ui"],
+};
+/**
+ * Get the effective local port for a service, using custom port if provided
+ */
+function getEffectivePort(serviceName, options) {
+    const config = SERVICE_CONFIG[serviceName];
+    if (!config)
+        return 0;
+    switch (serviceName) {
+        case "db":
+            return options.dbPort ? parseInt(options.dbPort, 10) : config.localPort;
+        case "temporal-ui":
+            return options.temporalUiPort
+                ? parseInt(options.temporalUiPort, 10)
+                : config.localPort;
+        case "temporal-frontend":
+            return options.temporalFrontendPort
+                ? parseInt(options.temporalFrontendPort, 10)
+                : config.localPort;
+        default:
+            return config.localPort;
+    }
+}
+/**
+ * Parse services from --services flag or group name
+ */
+function parseServices(input) {
+    // Check if it's a group name
+    if (SERVICE_GROUPS[input]) {
+        return SERVICE_GROUPS[input];
+    }
+    // Otherwise parse as comma-separated list
+    return input.split(",").map((s) => s.trim());
+}
+/**
+ * Spawn an SSM tunnel to a service endpoint
+ */
+function spawnSsmTunnel(instanceId, service, localPort) {
+    return spawn("aws", [
+        "ssm",
+        "start-session",
+        "--target",
+        instanceId,
+        "--document-name",
+        "AWS-StartPortForwardingSessionToRemoteHost",
+        "--parameters",
+        JSON.stringify({
+            host: [service.host],
+            portNumber: [String(service.port)],
+            localPortNumber: [String(localPort)],
+        }),
+    ], { stdio: "inherit" });
+}
+/**
+ * List available services
+ */
+async function listServices(options) {
+    const { tenant, env } = options;
+    const bastion = await getPlatformBastionInfo(tenant, env);
+    console.log("");
+    logInfo(`Tenant: ${tenant}, Platform Env: ${env}`);
+    console.log("");
+    console.log("Available services:");
+    console.log("");
+    for (const [name, config] of Object.entries(SERVICE_CONFIG)) {
+        const endpoint = bastion.services[config.bastionKey];
+        const status = endpoint ? "✓" : "✗";
+        const localPort = getEffectivePort(name, options);
+        console.log(`  ${status} ${name.padEnd(20)} localhost:${localPort} → ${endpoint?.host ?? "not available"}:${endpoint?.port ?? ""}`);
+    }
+    console.log("");
+    console.log("Service groups:");
+    for (const [group, services] of Object.entries(SERVICE_GROUPS)) {
+        console.log(`  ${group.padEnd(20)} ${services.join(", ")}`);
+    }
+    console.log("");
+    logInfo("Usage:");
+    console.log("  mesh tunnel dev                    # All dev services");
+    console.log("  mesh tunnel --services temporal    # Just temporal services");
+    console.log("  mesh tunnel --services db          # Just database");
+    console.log("");
+}
+/**
+ * Start tunnels to multiple services
+ */
+async function tunnelServices(serviceNames, options) {
+    const { tenant, env } = options;
+    const bastion = await getPlatformBastionInfo(tenant, env);
+    // Resolve service names to configs and endpoints
+    const servicesToStart = [];
+    for (const name of serviceNames) {
+        const config = SERVICE_CONFIG[name];
+        if (!config) {
+            logError(`Unknown service: ${name}`);
+            logInfo(`Available services: ${Object.keys(SERVICE_CONFIG).join(", ")}`);
+            process.exit(1);
+        }
+        const endpoint = bastion.services[config.bastionKey];
+        if (!endpoint) {
+            logError(`Service '${name}' not available in platform bastion.`);
+            logInfo("Make sure the service is enabled and deployed.");
+            process.exit(1);
+        }
+        servicesToStart.push({ name, config, endpoint });
+    }
+    if (servicesToStart.length === 0) {
+        logError("No services specified.");
+        process.exit(1);
+    }
+    console.log("");
+    logInfo(`Tenant: ${tenant}, Platform Env: ${env}`);
+    console.log("");
+    logInfo("Starting tunnels...");
+    for (const { name, config, endpoint } of servicesToStart) {
+        const localPort = getEffectivePort(name, options);
+        console.log(`  ${config.displayName.padEnd(25)} localhost:${localPort} → ${endpoint.host}:${endpoint.port}`);
+    }
+    console.log("");
+    logInfo("Press Ctrl+C to stop the tunnels");
+    console.log("");
+    const processes = [];
+    for (const { name, endpoint } of servicesToStart) {
+        const localPort = getEffectivePort(name, options);
+        processes.push(spawnSsmTunnel(bastion.instanceId, endpoint, localPort));
+    }
+    // Handle cleanup on exit
+    const cleanup = () => {
+        for (const proc of processes) {
+            proc.kill();
+        }
+        process.exit(0);
+    };
+    process.on("SIGINT", cleanup);
+    process.on("SIGTERM", cleanup);
+    // Wait for any process to exit
+    await Promise.race(processes.map((proc) => new Promise((resolve) => {
+        proc.on("exit", () => resolve());
+        proc.on("error", () => resolve());
+    })));
+    cleanup();
+}
+/**
+ * Register tunnel commands with the CLI
+ */
+export function registerTunnelCommands(program) {
+    program
+        .command("tunnel")
+        .description("Start SSM tunnel to platform services")
+        .requiredOption("-t, --tenant <tenant>", "Platform tenant (e.g., mesh)")
+        .requiredOption("-e, --env <env>", "Platform environment (e.g., dev)")
+        .option("-l, --list", "List available services")
+        .option("-s, --services <services>", "Services to tunnel (comma-separated or group name)")
+        .option("--db-port <port>", "Custom local port for database (default: 5432)")
+        .option("--temporal-ui-port <port>", "Custom local port for Temporal UI (default: 8080)")
+        .option("--temporal-frontend-port <port>", "Custom local port for Temporal Frontend (default: 7233)")
+        .argument("[group]", "Service group to tunnel (e.g., dev, temporal)")
+        .action(async (group, options) => {
+        // Handle --list
+        if (options.list) {
+            await listServices(options);
+            return;
+        }
+        // Determine which services to start
+        let services;
+        if (options.services) {
+            // Explicit --services flag
+            services = parseServices(options.services);
+        }
+        else if (group) {
+            // Positional group argument
+            services = parseServices(group);
+        }
+        else {
+            // No services specified - show help
+            await listServices(options);
+            return;
+        }
+        await tunnelServices(services, options);
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/src/commands/tunnel/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/commands/tunnel/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,KAAK,EAAgB,MAAM,eAAe,CAAC;AACpD,OAAO,EACL,sBAAsB,EACtB,OAAO,EACP,QAAQ,GACT,MAAM,sBAAsB,CAAC;AAa9B;;GAEG;AACH,MAAM,cAAc,GAGhB;IACF,mBAAmB,EAAE;QACnB,UAAU,EAAE,mBAAmB;QAC/B,SAAS,EAAE,IAAI;QACf,WAAW,EAAE,0BAA0B;KACxC;IACD,aAAa,EAAE;QACb,UAAU,EAAE,aAAa;QACzB,SAAS,EAAE,IAAI;QACf,WAAW,EAAE,iBAAiB;KAC/B;IACD,EAAE,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,SAAS,EAAE,IAAI;QACf,WAAW,EAAE,uBAAuB;KACrC;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,cAAc,GAA6B;IAC/C,GAAG,EAAE,CAAC,mBAAmB,EAAE,aAAa,EAAE,IAAI,CAAC;IAC/C,QAAQ,EAAE,CAAC,mBAAmB,EAAE,aAAa,CAAC;CAC/C,CAAC;AAEF;;GAEG;AACH,SAAS,gBAAgB,CAAC,WAAmB,EAAE,OAAsB;IACnE,MAAM,MAAM,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IAEtB,QAAQ,WAAW,EAAE,CAAC;QACpB,KAAK,IAAI;YACP,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;QAC1E,KAAK,aAAa;YAChB,OAAO,OAAO,CAAC,cAAc;gBAC3B,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;gBACtC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;QACvB,KAAK,mBAAmB;YACtB,OAAO,OAAO,CAAC,oBAAoB;gBACjC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC;gBAC5C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;QACvB;YACE,OAAO,MAAM,CAAC,SAAS,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,6BAA6B;IAC7B,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,0CAA0C;IAC1C,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CACrB,UAAkB,EAClB,OAAwB,EACxB,SAAiB;IAEjB,OAAO,KAAK,CACV,KAAK,EACL;QACE,KAAK;QACL,eAAe;QACf,UAAU;QACV,UAAU;QACV,iBAAiB;QACjB,4CAA4C;QAC5C,cAAc;QACd,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YACpB,UAAU,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAClC,eAAe,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;SACrC,CAAC;KACH,EACD,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,YAAY,CAAC,OAAsB;IAChD,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE1D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,WAAW,MAAM,mBAAmB,GAAG,EAAE,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACpC,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CACT,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,cAAc,SAAS,MAAM,QAAQ,EAAE,IAAI,IAAI,eAAe,IAAI,QAAQ,EAAE,IAAI,IAAI,EAAE,EAAE,CACvH,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClB,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,cAAc,CAC3B,YAAsB,EACtB,OAAsB;IAEtB,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE1D,iDAAiD;IACjD,MAAM,eAAe,GAIhB,EAAE,CAAC;IAER,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,QAAQ,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;YACrC,OAAO,CAAC,uBAAuB,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,CAAC,YAAY,IAAI,sCAAsC,CAAC,CAAC;YACjE,OAAO,CAAC,gDAAgD,CAAC,CAAC;YAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,WAAW,MAAM,mBAAmB,GAAG,EAAE,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAE/B,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,eAAe,EAAE,CAAC;QACzD,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CACT,KAAK,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,cAAc,SAAS,MAAM,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,CAChG,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,kCAAkC,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,MAAM,SAAS,GAAmB,EAAE,CAAC;IAErC,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,eAAe,EAAE,CAAC;QACjD,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAClD,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,yBAAyB;IACzB,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAE/B,+BAA+B;IAC/B,MAAM,OAAO,CAAC,IAAI,CAChB,SAAS,CAAC,GAAG,CACX,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC5B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CACL,CACF,CAAC;IAEF,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,uCAAuC,CAAC;SACpD,cAAc,CAAC,uBAAuB,EAAE,8BAA8B,CAAC;SACvE,cAAc,CAAC,iBAAiB,EAAE,kCAAkC,CAAC;SACrE,MAAM,CAAC,YAAY,EAAE,yBAAyB,CAAC;SAC/C,MAAM,CAAC,2BAA2B,EAAE,oDAAoD,CAAC;SACzF,MAAM,CAAC,kBAAkB,EAAE,gDAAgD,CAAC;SAC5E,MAAM,CAAC,2BAA2B,EAAE,mDAAmD,CAAC;SACxF,MAAM,CAAC,iCAAiC,EAAE,yDAAyD,CAAC;SACpG,QAAQ,CAAC,SAAS,EAAE,+CAA+C,CAAC;SACpE,MAAM,CAAC,KAAK,EAAE,KAAyB,EAAE,OAAsB,EAAE,EAAE;QAClE,gBAAgB;QAChB,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,oCAAoC;QACpC,IAAI,QAAkB,CAAC;QAEvB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,2BAA2B;YAC3B,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;aAAM,IAAI,KAAK,EAAE,CAAC;YACjB,4BAA4B;YAC5B,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,oCAAoC;YACpC,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,MAAM,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * @mesh-tech/mesh-cli
+ *
+ * CLI utilities for Mesh Lab development.
+ */
+export * from "./utils/index.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,kBAAkB,CAAC"}

package/dist/src/index.js

@@ -0,0 +1,7 @@
+/**
+ * @mesh-tech/mesh-cli
+ *
+ * CLI utilities for Mesh Lab development.
+ */
+export * from "./utils/index.js";
+//# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,kBAAkB,CAAC"}

package/dist/src/utils/bastion.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Bastion utilities for SSM tunneling to platform services
+ */
+/**
+ * Service endpoint info
+ */
+export interface ServiceEndpoint {
+    host: string;
+    port: number;
+}
+/**
+ * Platform bastion info from SSM
+ */
+export interface PlatformBastionInfo {
+    instanceId: string;
+    securityGroupId: string;
+    services: Record<string, ServiceEndpoint>;
+}
+/**
+ * Legacy bastion info (for backward compatibility with db commands)
+ */
+export interface BastionInfo {
+    instanceId: string;
+    rdsEndpoint: string;
+    rdsPort: number;
+}
+/**
+ * Get platform bastion info from SSM parameter store.
+ *
+ * Reads the platformBastion key from the platform export at
+ * /mesh-platform/{tenant}/{platformEnv}/platform. Falls back to the legacy
+ * separate parameter at /mesh-platform/{tenant}/{platformEnv}/platform-bastion
+ * for backward compatibility.
+ */
+export declare function getPlatformBastionInfo(tenant: string, platformEnv: string): Promise<PlatformBastionInfo>;
+/**
+ * Get bastion info from SSM parameter store (legacy format).
+ * Reads from /mesh/{tenant}/{platformEnv}/platform-bastion and extracts RDS info.
+ *
+ * @deprecated Use getPlatformBastionInfo instead
+ */
+export declare function getBastionInfo(tenant: string, platformEnv: string): Promise<BastionInfo>;
+//# sourceMappingURL=bastion.d.ts.map

package/dist/src/utils/bastion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bastion.d.ts","sourceRoot":"","sources":["../../../src/utils/bastion.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,mBAAmB,CAAC,CAyD9B;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,WAAW,CAAC,CAatB"}

package/dist/src/utils/bastion.js

@@ -0,0 +1,77 @@
+/**
+ * Bastion utilities for SSM tunneling to platform services
+ */
+import { SSMClient, GetParameterCommand } from "@aws-sdk/client-ssm";
+import { logInfo, logSuccess, logError } from "./log.js";
+/**
+ * Get platform bastion info from SSM parameter store.
+ *
+ * Reads the platformBastion key from the platform export at
+ * /mesh-platform/{tenant}/{platformEnv}/platform. Falls back to the legacy
+ * separate parameter at /mesh-platform/{tenant}/{platformEnv}/platform-bastion
+ * for backward compatibility.
+ */
+export async function getPlatformBastionInfo(tenant, platformEnv) {
+    const ssm = new SSMClient({});
+    // Primary: read from the platform export (platformBastion is a nested key)
+    const platformPath = `/mesh-platform/${tenant}/${platformEnv}/platform`;
+    logInfo(`Looking up platform bastion from ${platformPath}...`);
+    try {
+        const response = await ssm.send(new GetParameterCommand({ Name: platformPath }));
+        if (response.Parameter?.Value) {
+            const platform = JSON.parse(response.Parameter.Value);
+            if (platform.platformBastion) {
+                const info = platform.platformBastion;
+                logSuccess(`Found bastion: ${info.instanceId}`);
+                const serviceNames = Object.keys(info.services);
+                if (serviceNames.length > 0) {
+                    logInfo(`Available services: ${serviceNames.join(", ")}`);
+                }
+                return info;
+            }
+        }
+    }
+    catch {
+        // Platform param not found or unreadable, try legacy path
+    }
+    // Fallback: legacy separate parameter
+    const legacyPath = `/mesh-platform/${tenant}/${platformEnv}/platform-bastion`;
+    logInfo(`Trying legacy path ${legacyPath}...`);
+    try {
+        const response = await ssm.send(new GetParameterCommand({ Name: legacyPath }));
+        if (!response.Parameter?.Value) {
+            throw new Error(`Platform bastion not found`);
+        }
+        const info = JSON.parse(response.Parameter.Value);
+        logSuccess(`Found bastion: ${info.instanceId}`);
+        const serviceNames = Object.keys(info.services);
+        if (serviceNames.length > 0) {
+            logInfo(`Available services: ${serviceNames.join(", ")}`);
+        }
+        return info;
+    }
+    catch (error) {
+        logError(`Platform bastion not found in ${platformPath} or ${legacyPath}`);
+        logInfo("Make sure platformBastion is enabled in your platform config and deployed.");
+        throw error;
+    }
+}
+/**
+ * Get bastion info from SSM parameter store (legacy format).
+ * Reads from /mesh/{tenant}/{platformEnv}/platform-bastion and extracts RDS info.
+ *
+ * @deprecated Use getPlatformBastionInfo instead
+ */
+export async function getBastionInfo(tenant, platformEnv) {
+    const info = await getPlatformBastionInfo(tenant, platformEnv);
+    const rdsService = info.services["rds"];
+    if (!rdsService) {
+        throw new Error("RDS service not available in platform bastion. Is RDS enabled?");
+    }
+    return {
+        instanceId: info.instanceId,
+        rdsEndpoint: rdsService.host,
+        rdsPort: rdsService.port,
+    };
+}
+//# sourceMappingURL=bastion.js.map

package/dist/src/utils/bastion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bastion.js","sourceRoot":"","sources":["../../../src/utils/bastion.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AA4BzD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAc,EACd,WAAmB;IAEnB,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;IAE9B,2EAA2E;IAC3E,MAAM,YAAY,GAAG,kBAAkB,MAAM,IAAI,WAAW,WAAW,CAAC;IACxE,OAAO,CAAC,oCAAoC,YAAY,KAAK,CAAC,CAAC;IAE/D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAC7B,IAAI,mBAAmB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAChD,CAAC;QAEF,IAAI,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,eAAsC,CAAC;gBAC7D,UAAU,CAAC,kBAAkB,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;gBAEhD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAChD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC5B,OAAO,CAAC,uBAAuB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC5D,CAAC;gBAED,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IAED,sCAAsC;IACtC,MAAM,UAAU,GAAG,kBAAkB,MAAM,IAAI,WAAW,mBAAmB,CAAC;IAC9E,OAAO,CAAC,sBAAsB,UAAU,KAAK,CAAC,CAAC;IAE/C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAC7B,IAAI,mBAAmB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAC9C,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAwB,CAAC;QACzE,UAAU,CAAC,kBAAkB,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAEhD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,uBAAuB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,iCAAiC,YAAY,OAAO,UAAU,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,4EAA4E,CAAC,CAAC;QACtF,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,WAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE/D,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IAED,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,UAAU,CAAC,IAAI;QAC5B,OAAO,EAAE,UAAU,CAAC,IAAI;KACzB,CAAC;AACJ,CAAC"}

package/dist/src/utils/context.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Context detection - determines tenant, stage, and platform environment
+ * from the current directory and environment variables.
+ */
+export interface MeshContext {
+    tenant: string;
+    stage: string;
+    platformEnv: string;
+}
+/**
+ * Detect tenant and stage from current directory and environment.
+ *
+ * Priority for stage:
+ *   1. --stage flag (passed as stageArg)
+ *   2. MESH_STAGE env var
+ *   3. SST_STAGE env var
+ *   4. .sst/stage file
+ *   5. Pulumi config file name
+ *   6. Default: "dev"
+ *
+ * Priority for tenant:
+ *   1. MESH_TENANT env var
+ *   2. config.ts tenant field
+ *   3. Pulumi config mesh:tenant
+ *   4. Directory path (tenants/{tenant}/...)
+ *   5. Default: "mesh"
+ */
+export declare function detectContext(stageArg?: string): MeshContext;
+//# sourceMappingURL=context.d.ts.map

package/dist/src/utils/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../src/utils/context.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAoBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,WAAW,CA8G5D"}

package/dist/src/utils/context.js

@@ -0,0 +1,132 @@
+/**
+ * Context detection - determines tenant, stage, and platform environment
+ * from the current directory and environment variables.
+ */
+import * as fs from "fs";
+import * as path from "path";
+import { logInfo } from "./log.js";
+/**
+ * Find a file by walking up directories from the starting directory.
+ * Returns the full path to the file if found, undefined otherwise.
+ */
+function findFileUpward(filename, startDir = process.cwd()) {
+    let currentDir = startDir;
+    const root = path.parse(currentDir).root;
+    while (currentDir !== root) {
+        const filePath = path.join(currentDir, filename);
+        if (fs.existsSync(filePath)) {
+            return filePath;
+        }
+        currentDir = path.dirname(currentDir);
+    }
+    return undefined;
+}
+/**
+ * Detect tenant and stage from current directory and environment.
+ *
+ * Priority for stage:
+ *   1. --stage flag (passed as stageArg)
+ *   2. MESH_STAGE env var
+ *   3. SST_STAGE env var
+ *   4. .sst/stage file
+ *   5. Pulumi config file name
+ *   6. Default: "dev"
+ *
+ * Priority for tenant:
+ *   1. MESH_TENANT env var
+ *   2. config.ts tenant field
+ *   3. Pulumi config mesh:tenant
+ *   4. Directory path (tenants/{tenant}/...)
+ *   5. Default: "mesh"
+ */
+export function detectContext(stageArg) {
+    let tenant;
+    let stage;
+    const cwd = process.cwd();
+    // Try to detect from Pulumi.yaml
+    if (fs.existsSync("Pulumi.yaml")) {
+        // Look for Pulumi.*.yaml config files
+        const files = fs.readdirSync(".").filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml");
+        const configFile = files[0];
+        if (configFile) {
+            const content = fs.readFileSync(configFile, "utf-8");
+            // Extract tenant from mesh:tenant config
+            const tenantMatch = content.match(/^\s*mesh:tenant:\s*["']?([^"'\n]+)["']?/m);
+            if (tenantMatch?.[1]) {
+                tenant = tenantMatch[1].trim();
+            }
+            // Extract stage from filename: Pulumi.<stage>.yaml
+            const stageMatch = configFile.match(/Pulumi\.(.+)\.yaml/);
+            if (stageMatch?.[1]) {
+                stage = stageMatch[1];
+            }
+        }
+    }
+    // Try to detect from SST config (walk up directories to find it)
+    const sstConfigPath = findFileUpward("sst.config.ts");
+    let sstDir;
+    if (sstConfigPath) {
+        sstDir = path.dirname(sstConfigPath);
+        // Check parent config.ts for tenant (relative to sst.config.ts location)
+        const parentConfigPath = path.join(sstDir, "..", "config.ts");
+        if (fs.existsSync(parentConfigPath)) {
+            const configContent = fs.readFileSync(parentConfigPath, "utf-8");
+            const tenantMatch = configContent.match(/tenant:\s*["']([^"']+)["']/);
+            if (tenantMatch) {
+                tenant = tenantMatch[1];
+            }
+        }
+        // Check .sst/stage for current stage (relative to sst.config.ts location)
+        const sstStagePath = path.join(sstDir, ".sst", "stage");
+        if (fs.existsSync(sstStagePath)) {
+            stage = fs.readFileSync(sstStagePath, "utf-8").trim();
+        }
+    }
+    // Fallback: infer tenant from directory path
+    if (!tenant) {
+        const pathMatch = cwd.match(/tenants\/([^/]+)/);
+        if (pathMatch) {
+            tenant = pathMatch[1];
+        }
+    }
+    // Apply priority: stageArg > MESH_STAGE > SST_STAGE > detected > default
+    stage = stageArg || process.env.MESH_STAGE || process.env.SST_STAGE || stage || "dev";
+    tenant = process.env.MESH_TENANT || tenant || "mesh";
+    // Resolve platform environment from config.ts if available
+    let platformEnv = stage;
+    let platformEnvMap = {};
+    let defaultPlatformEnv;
+    // Try to read platformEnvMap and defaultPlatformEnv from config.ts (relative to sst.config.ts location)
+    const configPath = sstDir ? path.join(sstDir, "..", "config.ts") : "../config.ts";
+    if (fs.existsSync(configPath)) {
+        const configContent = fs.readFileSync(configPath, "utf-8");
+        // Parse platformEnvMap object
+        const mapMatch = configContent.match(/platformEnvMap:\s*\{([^}]+)\}/);
+        if (mapMatch?.[1]) {
+            const entries = mapMatch[1].matchAll(/(\w+):\s*["']([^"']+)["']/g);
+            for (const entry of entries) {
+                const key = entry[1];
+                const value = entry[2];
+                if (key && value) {
+                    platformEnvMap[key] = value;
+                }
+            }
+        }
+        // Parse defaultPlatformEnv
+        const defaultMatch = configContent.match(/defaultPlatformEnv:\s*["']([^"']+)["']/);
+        if (defaultMatch?.[1]) {
+            defaultPlatformEnv = defaultMatch[1];
+        }
+    }
+    // Parse env from stage by stripping tenant prefix (matches Pulumi pattern)
+    // e.g., "mesh-dev-temporal" → env "dev-temporal"
+    const tenantPrefix = `${tenant}-`;
+    const parsedEnv = stage.startsWith(tenantPrefix)
+        ? stage.slice(tenantPrefix.length)
+        : stage;
+    // Use config mapping if available, then defaultPlatformEnv, otherwise use parsed env directly
+    platformEnv = platformEnvMap[parsedEnv] ?? platformEnvMap[stage] ?? defaultPlatformEnv ?? parsedEnv;
+    logInfo(`Stage: ${stage}, Platform: ${platformEnv}, Tenant: ${tenant}`);
+    return { tenant, stage, platformEnv };
+}
+//# sourceMappingURL=context.js.map

package/dist/src/utils/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../../src/utils/context.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAQnC;;;GAGG;AACH,SAAS,cAAc,CAAC,QAAgB,EAAE,WAAmB,OAAO,CAAC,GAAG,EAAE;IACxE,IAAI,UAAU,GAAG,QAAQ,CAAC;IAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;IAEzC,OAAO,UAAU,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACjD,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,aAAa,CAAC,QAAiB;IAC7C,IAAI,MAA0B,CAAC;IAC/B,IAAI,KAAyB,CAAC;IAE9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAE1B,iCAAiC;IACjC,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,sCAAsC;QACtC,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,aAAa,CAC7E,CAAC;QAEF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAErD,yCAAyC;YACzC,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9E,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACjC,CAAC;YAED,mDAAmD;YACnD,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAC1D,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpB,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,MAAM,aAAa,GAAG,cAAc,CAAC,eAAe,CAAC,CAAC;IACtD,IAAI,MAA0B,CAAC;IAE/B,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAErC,yEAAyE;QACzE,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAC9D,IAAI,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpC,MAAM,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;YACjE,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;YACtE,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACxD,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAChD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,KAAK,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,KAAK,IAAI,KAAK,CAAC;IACtF,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,MAAM,IAAI,MAAM,CAAC;IAErD,2DAA2D;IAC3D,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,cAAc,GAA2B,EAAE,CAAC;IAChD,IAAI,kBAAsC,CAAC;IAE3C,wGAAwG;IACxG,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;IAClF,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAE3D,8BAA8B;QAC9B,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACtE,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC;YACnE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACrB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACvB,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC;oBACjB,cAAc,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACnF,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtB,kBAAkB,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,iDAAiD;IACjD,MAAM,YAAY,GAAG,GAAG,MAAM,GAAG,CAAC;IAClC,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAC9C,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC;QAClC,CAAC,CAAC,KAAK,CAAC;IAEV,8FAA8F;IAC9F,WAAW,GAAG,cAAc,CAAC,SAAS,CAAC,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,kBAAkB,IAAI,SAAS,CAAC;IAEpG,OAAO,CAAC,UAAU,KAAK,eAAe,WAAW,aAAa,MAAM,EAAE,CAAC,CAAC;IAExE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AACxC,CAAC"}

package/dist/src/utils/credentials.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Database credential utilities
+ */
+export interface DatabaseCredentials {
+    username: string;
+    password: string;
+    host: string;
+    port: number;
+    database: string;
+}
+/**
+ * Options for credential lookup
+ */
+export interface CredentialLookupOptions {
+    /** App name (e.g., "rdc") - if provided, uses path mesh/{tenant}/{stage}/{app}/db-credentials */
+    app?: string;
+}
+/**
+ * Get DATABASE_URL from Secrets Manager.
+ *
+ * Credential path patterns:
+ *   - With app:    mesh/{tenant}/{stage}/{app}/db-credentials
+ *   - Without app: mesh/{tenant}/{stage}/db-credentials
+ *
+ * Returns the DATABASE_URL string directly. Use rewriteDatabaseUrl() to
+ * modify host/port for tunnel usage.
+ */
+export declare function getDatabaseUrl(tenant: string, stage: string, options?: CredentialLookupOptions): Promise<string>;
+/**
+ * @deprecated Use getDatabaseUrl instead - returns DATABASE_URL directly
+ */
+export declare function getDbCredentials(tenant: string, stage: string, _platformEnv: string, rdsHost: string, rdsPort: number, options?: CredentialLookupOptions): Promise<DatabaseCredentials>;
+/**
+ * Options for rewriting DATABASE_URL
+ */
+export interface DatabaseUrlRewriteOptions {
+    /** New host:port endpoint (e.g., "localhost:5432") */
+    endpoint?: string;
+    /** SSL mode (require, no-verify, disable) */
+    sslMode?: string;
+}
+/**
+ * Rewrite DATABASE_URL with new endpoint and/or SSL mode.
+ * Preserves username, password, database name, and other query params.
+ *
+ * Used by both mesh-env-exec (for sst dev) and mesh db exec (for ad-hoc commands).
+ */
+export declare function rewriteDatabaseUrl(url: string, options: DatabaseUrlRewriteOptions): string;
+/**
+ * Build a DATABASE_URL from credentials.
+ */
+export declare function buildDatabaseUrl(creds: DatabaseCredentials, options?: DatabaseUrlRewriteOptions): string;
+/**
+ * Try to read database info from SST outputs (when sst dev has run).
+ */
+export declare function readSstOutputs(): Promise<{
+    databaseUrl?: string;
+    databaseName?: string;
+    secretArn?: string;
+} | null>;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/src/utils/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/utils/credentials.ts"],"names":[],"mappings":"AAAA;;GAEG;AAQH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,iGAAiG;IACjG,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,uBAAuB,GAChC,OAAO,CAAC,MAAM,CAAC,CAyCjB;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,uBAAuB,GAChC,OAAO,CAAC,mBAAmB,CAAC,CAW9B;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,yBAAyB,GACjC,MAAM,CA8BR;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,mBAAmB,EAC1B,OAAO,CAAC,EAAE,yBAAyB,GAClC,MAAM,CAcR;AAED;;GAEG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,IAAI,CAAC,CA+BR"}