@mesh-tech/mesh-cli 0.1.1 → 0.12.1

package/dist/src/commands/local/dev-local.js

@@ -0,0 +1,306 @@
+/**
+ * Local DevOutput source for `mesh dev` (design §5.2, AC C1/C3).
+ *
+ * Instead of reading a deployed Pulumi stack, synthesize the same DevOutput
+ * shape from repo conventions and point every service at the running
+ * `mesh start` platform. Zero AWS credentials, zero VPN, zero Pulumi state —
+ * the app's code never knows it's local:
+ *   - Temporal → localhost:7233, namespace local-dev (seeded)
+ *   - Postgres → the local `app` database
+ *   - Zitadel  → http://localhost:8080 (seeded org/app/users)
+ *   - SpiceDB  → localhost:50051 (preshared key)
+ *   - AWS SDK  → ministack via AWS_ENDPOINT_URL (SSM/Secrets/S3 registry)
+ *
+ * Detection convention = what `mesh create-app` templates emit: immediate
+ * subdirectories of the app root whose package.json has a `dev` script
+ * (api/, worker/, web/, …); a single-package app root with its own `dev`
+ * script becomes one service.
+ */
+import * as fs from "fs";
+import * as path from "path";
+import { isServiceMode, openapiMockCommand } from "./mocks.js";
+import { probeTcp } from "./helpers.js";
+import { MeshCliError } from "../../utils/errors.js";
+import { localAwsEnv, LOCAL_ENV } from "./seed.js";
+import { TEMPORAL_ADDRESS } from "./seed.js";
+import { LOGIN_CONTEXT, ZITADEL_ISSUER } from "./seed-zitadel.js";
+import { authSecretPath } from "./auth-provision.js";
+import { findPackageRoot } from "./stack.js";
+import { getContextConfig } from "../login.js";
+export const LOCAL_STACK_NAME = "local";
+const BASE_PORT = 3000;
+/**
+ * The app's namespace, exactly the name the cloud gives it in K8s AND
+ * Temporal ({tenant}-{env}-{app}) — the Hub resolves both from this one
+ * convention, so local runs are addressable with zero translation.
+ */
+export function localAppNamespace(tenant, appName) {
+    return `${tenant}-${LOCAL_ENV}-${appName}`;
+}
+/** The OTLP log shipper (assets/log-shipper.mjs) each local service's
+ * launch pipeline pipes through — ships stdout to the stack's collector
+ * with the hosted k8s_* attribution. */
+export function logShipperPath() {
+    return path.join(findPackageRoot(), "assets", "log-shipper.mjs");
+}
+/**
+ * OTel SDK bootstrap — the local analog of the OTel Operator's pod
+ * injection: when the service ships `@opentelemetry/auto-instrumentations-
+ * node` (the templates declare it), the platform injects the `--import`
+ * register hook + exporter env, and HTTP/fetch/gRPC spans flow to the
+ * stack's collector → Tempo → the Hub's Traces views. Apps without the
+ * package run untouched.
+ */
+export function autoInstrumentationEnv(appRoot, src) {
+    const pkgDir = path.join("node_modules", "@opentelemetry", "auto-instrumentations-node");
+    const present = fs.existsSync(path.join(appRoot, src, pkgDir)) || fs.existsSync(path.join(appRoot, pkgDir));
+    if (!present)
+        return {};
+    return {
+        NODE_OPTIONS: { value: "--import @opentelemetry/auto-instrumentations-node/register" },
+        OTEL_TRACES_EXPORTER: { value: "otlp" },
+        // Logs ship via the launch pipeline; metrics locally come from
+        // Prometheus scrapes — keep the SDK to traces.
+        OTEL_METRICS_EXPORTER: { value: "none" },
+        OTEL_LOGS_EXPORTER: { value: "none" },
+        OTEL_NODE_DISABLED_INSTRUMENTATIONS: { value: "fs,dns,net" },
+    };
+}
+/** Hosted-parity resource attribution for a local service — what the
+ * in-cluster k8sattributes processor stamps. */
+export function otelEnv(tenant, appName, serviceName) {
+    const namespace = localAppNamespace(tenant, appName);
+    return {
+        OTEL_EXPORTER_OTLP_ENDPOINT: { value: "http://localhost:4318" },
+        OTEL_SERVICE_NAME: { value: serviceName },
+        OTEL_RESOURCE_ATTRIBUTES: {
+            value: `k8s.namespace.name=${namespace},k8s.deployment.name=${serviceName},k8s.container.name=${serviceName},service.namespace=${appName}`,
+        },
+    };
+}
+/** Endpoints of the running `mesh start` platform, as service env. */
+export function localPlatformEnv(tenant, appName, serviceName) {
+    const namespace = localAppNamespace(tenant, appName);
+    const env = {
+        TEMPORAL_ADDRESS: { value: TEMPORAL_ADDRESS },
+        TEMPORAL_NAMESPACE: { value: namespace },
+        TEMPORAL_TASK_QUEUE: { value: appName },
+        // OTel wiring, two consumers: instrumented services ship traces/metrics
+        // themselves, and the launch pipeline's log shipper reads these to ship
+        // stdout logs — both with the in-cluster k8sattributes attribution.
+        ...otelEnv(tenant, appName, serviceName),
+        DATABASE_URL: { value: "postgres://postgres:postgres@localhost:5433/app" },
+        ZITADEL_ISSUER: { value: ZITADEL_ISSUER },
+        // The service's own Zitadel M2M credentials (created by ensureAppTenantAuth
+        // on session start) — resolveCredentials("zitadel") picks this up, so apps
+        // can hydrate introspection/M2M config the same way they resolve
+        // ExternalService links instead of hand-carrying client ids in env files.
+        ZITADEL_SECRET_PREFIX: { value: authSecretPath(tenant, appName, serviceName) },
+        SPICEDB_ENDPOINT: { value: "localhost:50051" },
+        SPICEDB_HTTP_ENDPOINT: { value: "http://localhost:8443" },
+        SPICEDB_PRESHARED_KEY: { value: "local-dev-key" },
+        MEMCACHED_SERVERS: { value: "localhost:11211" },
+        MESH_LOCAL: { value: "1" },
+        MESH_SERVICE: { value: serviceName },
+    };
+    // Local tokens come from `mesh login local` (the seeded CLI app), so that
+    // app's clientId is the audience local APIs should verify. In the cloud,
+    // consumers request the API project's audience scope instead.
+    const cliClientId = getContextConfig(LOGIN_CONTEXT)?.clientId;
+    if (cliClientId) {
+        env.AUTH_AUDIENCE = { value: cliClientId };
+    }
+    for (const [key, value] of Object.entries(localAwsEnv())) {
+        env[key] = { value };
+    }
+    return env;
+}
+function hasDevScript(dir) {
+    const pkgPath = path.join(dir, "package.json");
+    if (!fs.existsSync(pkgPath))
+        return false;
+    try {
+        const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+        return typeof pkg?.scripts?.dev === "string";
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Detect runnable services by template convention: immediate subdirectories
+ * with a package.json `dev` script; falls back to the app root itself when
+ * it is a single-package app.
+ */
+export function detectLocalServices(appRoot) {
+    const services = {};
+    for (const entry of fs.readdirSync(appRoot, { withFileTypes: true })) {
+        if (!entry.isDirectory() || entry.name.startsWith(".") || entry.name === "node_modules")
+            continue;
+        if (hasDevScript(path.join(appRoot, entry.name))) {
+            services[entry.name] = { src: entry.name };
+        }
+    }
+    if (Object.keys(services).length === 0 && hasDevScript(appRoot)) {
+        services[path.basename(appRoot)] = { src: "." };
+    }
+    return services;
+}
+/** Synthesize the DevOutput `mesh dev` would otherwise read from Pulumi.
+ * `tenant` is the app tenant (detectLocalTenant) — it scopes the app's
+ * namespace ({tenant}-{env}-{app}) for Temporal, logs, and traces.
+ * `opts.mocks` (mesh dev --externals) appends declared mock services and injects
+ * their ExternalService credential prefixes into every app service. */
+export function buildLocalDevOutput(appRoot, tenant, opts = {}) {
+    const detected = detectLocalServices(appRoot);
+    const names = Object.keys(detected);
+    if (names.length === 0) {
+        throw new MeshCliError(`No runnable services found under ${appRoot} — expected subdirectories (api/, worker/, …) with a package.json 'dev' script.`, { remediation: { command: "mesh create-app" } });
+    }
+    // App name = project name = authz namespace. Pulumi.yaml `name:` wins
+    // (matches getProjectName — a stack-backed app run with --local must keep
+    // its deployed identity), then package.json name, then the basename.
+    // Scoped package names (@scu-apps/plaid) are unusable as Temporal/K8s
+    // namespaces — drop the scope.
+    let appName = path.basename(appRoot);
+    try {
+        const pkg = JSON.parse(fs.readFileSync(path.join(appRoot, "package.json"), "utf-8"));
+        if (typeof pkg?.name === "string" && pkg.name)
+            appName = pkg.name.replace(/^@[^/]+\//, "");
+    }
+    catch {
+        // no root package.json — keep the basename
+    }
+    const pulumiYaml = path.join(appRoot, "Pulumi.yaml");
+    if (fs.existsSync(pulumiYaml)) {
+        const match = fs.readFileSync(pulumiYaml, "utf-8").match(/^name:\s*(.+)$/m);
+        if (match?.[1]?.trim())
+            appName = match[1].trim();
+    }
+    const services = {};
+    const mocks = opts.mocks ?? {};
+    // Only process/openapi declarations run as mock-{name} services in this
+    // orchestration; compose externals are docker-managed and sandbox
+    // declarations spawn nothing (dev.ts seeds their credentials directly).
+    const mockNames = Object.keys(mocks).filter((name) => isServiceMode(name, mocks[name]));
+    // The ExternalService link() contract, synthesized: every app service gets
+    // {EXT}_SECRET_PREFIX for each mocked external, so resolveCredentials()
+    // runs the exact deployed code path against the locally seeded secret.
+    const externalEnv = {};
+    for (const decl of Object.values(mocks)) {
+        if (!decl.external)
+            continue;
+        const prefix = decl.external.toUpperCase().replace(/-/g, "_");
+        externalEnv[`${prefix}_SECRET_PREFIX`] = {
+            value: `mesh/${tenant}/${LOCAL_ENV}/external/${decl.external}`,
+        };
+    }
+    names.forEach((name, i) => {
+        const port = BASE_PORT + i;
+        services[name] = {
+            src: detected[name].src,
+            port,
+            command: ["pnpm", "dev"],
+            env: {
+                // allocatePorts keeps service.port and env.PORT in sync on reallocation
+                PORT: { value: String(port) },
+                ...localPlatformEnv(tenant, appName, name),
+                ...autoInstrumentationEnv(appRoot, detected[name].src),
+                ...externalEnv,
+            },
+        };
+    });
+    // Sibling-service URLs — the local analog of the deployed cross-service
+    // wiring (http://{svc}.{namespace}.svc.cluster.local:{port} in-cluster):
+    // every app service gets SERVICE_{NAME}_URL for each app service, so code
+    // can wire cross-service clients locally without knowing allocated ports.
+    // allocatePorts' cross-service localhost:{port} rewrite keeps them in sync
+    // when ports are reallocated.
+    //
+    // This is a PUBLIC, app-facing env contract — {NAME} is the service's
+    // directory name upper-cased, non-[A-Z0-9] → "_". Apps that name their
+    // link the same way (events.link({ environmentPrefix: "SERVICE_EVENTS" }))
+    // read ONE variable deployed and locally, with no isLocal branch.
+    // See docs/guides/mesh-dev-local-env.md.
+    for (const name of names) {
+        const key = `SERVICE_${name.toUpperCase().replace(/[^A-Z0-9]/g, "_")}_URL`;
+        const url = `http://localhost:${services[name].port}`;
+        for (const other of names) {
+            services[other].env[key] = { value: url };
+        }
+    }
+    // Declared mocks join the same orchestration (ports, env file, tmux
+    // window, log pipeline) as first-class services named mock-{name}.
+    mockNames.forEach((name, i) => {
+        const decl = mocks[name];
+        const serviceName = `mock-${name}`;
+        const port = decl.port ?? BASE_PORT + names.length + i;
+        services[serviceName] = {
+            // openapi mode runs Prism from the app root against the spec path.
+            src: decl.src ?? ".",
+            port,
+            command: decl.openapi ? openapiMockCommand(decl) : (decl.command ?? ["pnpm", "dev"]),
+            env: {
+                PORT: { value: String(port) },
+                ...otelEnv(tenant, appName, serviceName),
+                ...Object.fromEntries(Object.entries(decl.env ?? {}).map(([key, value]) => [key, { value }])),
+            },
+        };
+    });
+    return {
+        platform: { tenant: "local", env: "dev" },
+        app: appName,
+        stack: LOCAL_STACK_NAME,
+        services,
+        tunnels: {},
+    };
+}
+/**
+ * Whether the app is backed by a Pulumi program: its own (Pulumi.yaml or a
+ * Pulumi.<stack>.yaml stack config in the app dir), or a monorepo ROOT
+ * program above it (walk up to the repo boundary — .git/pnpm-workspace).
+ * Apps like apps/hub deploy via a root program and have no per-app
+ * Pulumi.yaml; they must NOT default into `mesh dev` local mode.
+ */
+export function hasStackBacking(appRoot) {
+    const hasOwn = fs.existsSync(path.join(appRoot, "Pulumi.yaml")) ||
+        fs.readdirSync(appRoot).some((f) => /^Pulumi\..+\.yaml$/.test(f));
+    if (hasOwn)
+        return true;
+    let dir = path.dirname(appRoot);
+    while (true) {
+        if (fs.existsSync(path.join(dir, "Pulumi.yaml")))
+            return true;
+        if (fs.existsSync(path.join(dir, ".git")) || fs.existsSync(path.join(dir, "pnpm-workspace.yaml"))) {
+            return fs.existsSync(path.join(dir, "Pulumi.yaml"));
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return false;
+        dir = parent;
+    }
+}
+/**
+ * The app's tenant, for auth provisioning: `mesh:tenant` from the app's
+ * Pulumi stack config when present (templates write it), else "local".
+ */
+export function detectLocalTenant(appRoot) {
+    for (const file of fs.readdirSync(appRoot)) {
+        if (!/^Pulumi\..*\.yaml$/.test(file))
+            continue;
+        const match = fs
+            .readFileSync(path.join(appRoot, file), "utf-8")
+            .match(/^\s*mesh:tenant:\s*["']?([A-Za-z0-9-]+)["']?\s*$/m);
+        if (match)
+            return match[1];
+    }
+    return "local";
+}
+/** The local platform must be up before `mesh dev` can wire services to it. */
+export async function ensureLocalPlatformRunning() {
+    const [temporalUp, fabricUp] = await Promise.all([probeTcp(7233), probeTcp(4566)]);
+    if (!temporalUp || !fabricUp) {
+        throw new MeshCliError("The local Mesh platform is not running (mesh dev local mode wires services to it).", { remediation: { command: "mesh start" } });
+    }
+}
+//# sourceMappingURL=dev-local.js.map

package/dist/src/commands/local/dev-local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-local.js","sourceRoot":"","sources":["../../../../src/commands/local/dev-local.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAqB/C,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACxC,MAAM,SAAS,GAAG,IAAI,CAAC;AAEvB;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,OAAe;IAC/D,OAAO,GAAG,MAAM,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;AAC7C,CAAC;AAED;;wCAEwC;AACxC,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,GAAW;IACjE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,gBAAgB,EAAE,4BAA4B,CAAC,CAAC;IACzF,MAAM,OAAO,GACX,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9F,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,OAAO;QACL,YAAY,EAAE,EAAE,KAAK,EAAE,6DAA6D,EAAE;QACtF,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;QACvC,+DAA+D;QAC/D,+CAA+C;QAC/C,qBAAqB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;QACxC,kBAAkB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;QACrC,mCAAmC,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;KAC7D,CAAC;AACJ,CAAC;AAED;gDACgD;AAChD,MAAM,UAAU,OAAO,CACrB,MAAc,EACd,OAAe,EACf,WAAmB;IAEnB,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrD,OAAO;QACL,2BAA2B,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE;QAC/D,iBAAiB,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE;QACzC,wBAAwB,EAAE;YACxB,KAAK,EAAE,sBAAsB,SAAS,wBAAwB,WAAW,uBAAuB,WAAW,sBAAsB,OAAO,EAAE;SAC3I;KACF,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,OAAe,EACf,WAAmB;IAEnB,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,GAAG,GAAmC;QAC1C,gBAAgB,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE;QAC7C,kBAAkB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;QACxC,mBAAmB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QACvC,wEAAwE;QACxE,wEAAwE;QACxE,oEAAoE;QACpE,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC;QACxC,YAAY,EAAE,EAAE,KAAK,EAAE,iDAAiD,EAAE;QAC1E,cAAc,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE;QACzC,4EAA4E;QAC5E,2EAA2E;QAC3E,iEAAiE;QACjE,0EAA0E;QAC1E,qBAAqB,EAAE,EAAE,KAAK,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE;QAC9E,gBAAgB,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE;QAC9C,qBAAqB,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE;QACzD,qBAAqB,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE;QACjD,iBAAiB,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE;QAC/C,UAAU,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;QAC1B,YAAY,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE;KACrC,CAAC;IACF,0EAA0E;IAC1E,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,WAAW,GAAG,gBAAgB,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC;IAC9D,IAAI,WAAW,EAAE,CAAC;QAChB,GAAG,CAAC,aAAa,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC7C,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,OAAO,OAAO,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,QAAQ,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,QAAQ,GAAoC,EAAE,CAAC;IACrD,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;YAAE,SAAS;QAClG,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACjD,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;uEAIuE;AACvE,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,MAAc,EACd,OAAuE,EAAE;IAEzE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,YAAY,CACpB,oCAAoC,OAAO,iFAAiF,EAC5H,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,CAChD,CAAC;IACJ,CAAC;IACD,sEAAsE;IACtE,0EAA0E;IAC1E,qEAAqE;IACrE,sEAAsE;IACtE,+BAA+B;IAC/B,IAAI,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACrF,IAAI,OAAO,GAAG,EAAE,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC7F,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACrD,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC5E,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;YAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,QAAQ,GAAoC,EAAE,CAAC;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,wEAAwE;IACxE,kEAAkE;IAClE,wEAAwE;IACxE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAE,CAAC,CAAC,CAAC;IAEzF,2EAA2E;IAC3E,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,WAAW,GAAmC,EAAE,CAAC;IACvD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,SAAS;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9D,WAAW,CAAC,GAAG,MAAM,gBAAgB,CAAC,GAAG;YACvC,KAAK,EAAE,QAAQ,MAAM,IAAI,SAAS,aAAa,IAAI,CAAC,QAAQ,EAAE;SAC/D,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxB,MAAM,IAAI,GAAG,SAAS,GAAG,CAAC,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,GAAG;YACf,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAE,CAAC,GAAG;YACxB,IAAI;YACJ,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;YACxB,GAAG,EAAE;gBACH,wEAAwE;gBACxE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;gBAC7B,GAAG,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;gBAC1C,GAAG,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAE,CAAC,GAAG,CAAC;gBACvD,GAAG,WAAW;aACf;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,8BAA8B;IAC9B,EAAE;IACF,sEAAsE;IACtE,uEAAuE;IACvE,2EAA2E;IAC3E,kEAAkE;IAClE,yCAAyC;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC;QAC3E,MAAM,GAAG,GAAG,oBAAoB,QAAQ,CAAC,IAAI,CAAE,CAAC,IAAI,EAAE,CAAC;QACvD,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,QAAQ,CAAC,KAAK,CAAE,CAAC,GAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,mEAAmE;IACnE,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,QAAQ,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACvD,QAAQ,CAAC,WAAW,CAAC,GAAG;YACtB,mEAAmE;YACnE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,GAAG;YACpB,IAAI;YACJ,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACpF,GAAG,EAAE;gBACH,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;gBAC7B,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC;gBACxC,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CACvE;aACF;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE;QACzC,GAAG,EAAE,OAAO;QACZ,KAAK,EAAE,gBAAgB;QACvB,QAAQ;QACR,OAAO,EAAE,EAAE;KACZ,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,MAAM,GACV,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAChD,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9D,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,EAAE,CAAC;YAClG,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACjC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/C,MAAM,KAAK,GAAG,EAAE;aACb,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC;aAC/C,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAC9D,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,CAAC,CAAE,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,0BAA0B;IAC9C,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnF,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,oFAAoF,EACpF,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,CAC3C,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/src/commands/local/docker-runner.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Docker runner for `mesh dev --local` (design §5.3, AC C2).
+ *
+ * The tmux runner stays the default on dev machines; `--runner docker` is
+ * for environments where tmux isn't sensible — CI (the golden-path
+ * workflow), headless agents, non-macOS boxes. It renders the SAME
+ * synthesized DevOutput into a docker compose project:
+ *
+ *   - one service per DevOutput service, `node:22-bookworm`, the app
+ *     bind-mounted at /workspace, `pnpm dev` in the service dir
+ *   - `network_mode: host` — services reach the `mesh start` platform on
+ *     localhost exactly like the tmux runner (Linux/CI semantics; on macOS
+ *     Docker Desktop host networking must be enabled, and host-installed
+ *     node_modules are platform-specific — tmux is the right runner there)
+ *   - per-service env files carrying the identical env contract
+ *   - logs ship through the same OTLP shipper (mounted from the CLI)
+ *
+ * Parity: `mesh dev --status|--kill|logs|restart` map to
+ * `docker compose ps|down|logs|restart` via the session state's runner.
+ */
+interface RunnerService {
+    src: string;
+    port: number;
+    command: string[];
+    env?: Record<string, {
+        value: string;
+    }>;
+}
+/** Write the compose project for a dev session; returns the compose file path. */
+export declare function writeDevCompose(sessionName: string, appRoot: string, services: Record<string, RunnerService>): string;
+export declare function dockerDevUp(sessionName: string): void;
+export declare function dockerDevDown(sessionName: string): void;
+export declare function dockerDevPs(sessionName: string): string;
+export declare function dockerDevLogs(sessionName: string, service: string, tail: number): string;
+export declare function dockerDevRestart(sessionName: string, service: string): void;
+export {};
+//# sourceMappingURL=docker-runner.d.ts.map

package/dist/src/commands/local/docker-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-runner.d.ts","sourceRoot":"","sources":["../../../../src/commands/local/docker-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAaH,UAAU,aAAa;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzC;AAkBD,kFAAkF;AAClF,wBAAgB,eAAe,CAC7B,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GACtC,MAAM,CA0CR;AAMD,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAIrD;AAED,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAIvD;AAED,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAKvD;AAED,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAKxF;AAED,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAI3E"}

package/dist/src/commands/local/docker-runner.js

@@ -0,0 +1,104 @@
+/**
+ * Docker runner for `mesh dev --local` (design §5.3, AC C2).
+ *
+ * The tmux runner stays the default on dev machines; `--runner docker` is
+ * for environments where tmux isn't sensible — CI (the golden-path
+ * workflow), headless agents, non-macOS boxes. It renders the SAME
+ * synthesized DevOutput into a docker compose project:
+ *
+ *   - one service per DevOutput service, `node:22-bookworm`, the app
+ *     bind-mounted at /workspace, `pnpm dev` in the service dir
+ *   - `network_mode: host` — services reach the `mesh start` platform on
+ *     localhost exactly like the tmux runner (Linux/CI semantics; on macOS
+ *     Docker Desktop host networking must be enabled, and host-installed
+ *     node_modules are platform-specific — tmux is the right runner there)
+ *   - per-service env files carrying the identical env contract
+ *   - logs ship through the same OTLP shipper (mounted from the CLI)
+ *
+ * Parity: `mesh dev --status|--kill|logs|restart` map to
+ * `docker compose ps|down|logs|restart` via the session state's runner.
+ */
+import { execFileSync } from "child_process";
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { logShipperPath } from "./dev-local.js";
+// Digest-pinned so dev-runner containers are reproducible (matches the
+// pinning of the stack's third-party images).
+const DEV_RUNNER_IMAGE = "node:22-bookworm@sha256:5647be709086c696ff32edaaf1c70cd26d1da6ab2b39c32f3c7b4c4a31957e37";
+function sessionDir(sessionName) {
+    const dir = path.join(os.homedir(), ".cache", "mesh", "mesh-local", "dev", sessionName);
+    fs.mkdirSync(dir, { recursive: true });
+    return dir;
+}
+/** docker env-file format: KEY=VALUE, no quoting, single-line values only. */
+function renderDockerEnvFile(env) {
+    const lines = [];
+    for (const [key, entry] of Object.entries(env)) {
+        if (entry.value.includes("\n"))
+            continue; // multi-line values unsupported by env_file
+        lines.push(`${key}=${entry.value}`);
+    }
+    return lines.join("\n") + "\n";
+}
+/** Write the compose project for a dev session; returns the compose file path. */
+export function writeDevCompose(sessionName, appRoot, services) {
+    const dir = sessionDir(sessionName);
+    const shipper = logShipperPath();
+    const blocks = [
+        `# Generated by \`mesh dev --local --runner docker\` — do not edit.`,
+        `name: ${sessionName}`,
+        `services:`,
+    ];
+    for (const [name, service] of Object.entries(services)) {
+        const env = service.env ?? {};
+        fs.writeFileSync(path.join(dir, `${name}.env`), renderDockerEnvFile(env), { mode: 0o600 });
+        const workdir = path.posix.join("/workspace", service.src === "." ? "" : service.src);
+        const ship = env.OTEL_RESOURCE_ATTRIBUTES
+            ? ` 2>&1 | NODE_OPTIONS= node /mesh-assets/log-shipper.mjs`
+            : "";
+        blocks.push(`  ${name}:`, `    image: ${DEV_RUNNER_IMAGE}`, `    network_mode: host`, `    working_dir: ${workdir}`, `    volumes:`, `      - '${appRoot}:/workspace'`, `      - '${path.dirname(shipper)}:/mesh-assets:ro'`, `    environment:`, 
+        // node_modules is the HOST's bind-mounted install — pnpm inside the
+        // container must never "verify" it and try a purge/reinstall (pnpm
+        // ≥10.9's verify-deps-before-run prompts and dies headless; worse, a
+        // purge would clobber the host install).
+        `      CI: 'true'`, `      npm_config_verify_deps_before_run: 'false'`, `    env_file:`, `      - './${name}.env'`, 
+        // pipefail: the container's exit code must be the SERVICE's, not the
+        // log-shipper's — otherwise a crashed service reports success (CI).
+        `    command: ["bash", "-lc", "set -o pipefail; corepack enable >/dev/null 2>&1; { ${service.command.join(" ")}; }${ship}"]`, `    restart: unless-stopped`);
+    }
+    const composePath = path.join(dir, "compose.yml");
+    fs.writeFileSync(composePath, blocks.join("\n") + "\n");
+    return composePath;
+}
+function composeArgs(sessionName, args) {
+    return ["compose", "-p", sessionName, "-f", path.join(sessionDir(sessionName), "compose.yml"), ...args];
+}
+export function dockerDevUp(sessionName) {
+    execFileSync("docker", composeArgs(sessionName, ["up", "-d"]), {
+        stdio: ["ignore", "inherit", "inherit"],
+    });
+}
+export function dockerDevDown(sessionName) {
+    execFileSync("docker", composeArgs(sessionName, ["down", "--remove-orphans"]), {
+        stdio: ["ignore", "inherit", "inherit"],
+    });
+}
+export function dockerDevPs(sessionName) {
+    return execFileSync("docker", composeArgs(sessionName, ["ps", "--format", "table {{.Service}}\t{{.State}}\t{{.Status}}"]), {
+        encoding: "utf-8",
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+}
+export function dockerDevLogs(sessionName, service, tail) {
+    return execFileSync("docker", composeArgs(sessionName, ["logs", "--tail", String(tail), service]), {
+        encoding: "utf-8",
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+}
+export function dockerDevRestart(sessionName, service) {
+    execFileSync("docker", composeArgs(sessionName, ["restart", service]), {
+        stdio: ["ignore", "inherit", "inherit"],
+    });
+}
+//# sourceMappingURL=docker-runner.js.map

package/dist/src/commands/local/docker-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-runner.js","sourceRoot":"","sources":["../../../../src/commands/local/docker-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,uEAAuE;AACvE,8CAA8C;AAC9C,MAAM,gBAAgB,GACpB,0FAA0F,CAAC;AAS7F,SAAS,UAAU,CAAC,WAAmB;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IACxF,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,SAAS,mBAAmB,CAAC,GAAsC;IACjE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS,CAAC,4CAA4C;QACtF,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAC7B,WAAmB,EACnB,OAAe,EACf,QAAuC;IAEvC,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IAEjC,MAAM,MAAM,GAAa;QACvB,oEAAoE;QACpE,SAAS,WAAW,EAAE;QACtB,WAAW;KACZ,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QAC9B,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,MAAM,CAAC,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtF,MAAM,IAAI,GAAG,GAAG,CAAC,wBAAwB;YACvC,CAAC,CAAC,yDAAyD;YAC3D,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,CAAC,IAAI,CACT,KAAK,IAAI,GAAG,EACZ,cAAc,gBAAgB,EAAE,EAChC,wBAAwB,EACxB,oBAAoB,OAAO,EAAE,EAC7B,cAAc,EACd,YAAY,OAAO,cAAc,EACjC,YAAY,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,EACpD,kBAAkB;QAClB,oEAAoE;QACpE,mEAAmE;QACnE,qEAAqE;QACrE,yCAAyC;QACzC,kBAAkB,EAClB,kDAAkD,EAClD,eAAe,EACf,cAAc,IAAI,OAAO;QACzB,qEAAqE;QACrE,oEAAoE;QACpE,qFAAqF,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,IAAI,EAC5H,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAClD,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IACxD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,WAAW,CAAC,WAAmB,EAAE,IAAc;IACtD,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;AAC1G,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,WAAmB;IAC7C,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE;QAC7D,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;KACxC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,WAAmB;IAC/C,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,EAAE;QAC7E,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;KACxC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,WAAmB;IAC7C,OAAO,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,6CAA6C,CAAC,CAAC,EAAE;QACzH,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAsB,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,WAAmB,EAAE,OAAe,EAAE,IAAY;IAC9E,OAAO,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE;QACjG,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAsB,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,OAAe;IACnE,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,EAAE;QACrE,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;KACxC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/commands/local/helpers.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Small shared helpers for the local-platform commands — extracted from the
+ * copies that had grown in auth-provision/mocks (secret upsert) and
+ * dev-local/stack (TCP probe).
+ */
+/** The subset of SecretsManagerClient upsertLocalSecret depends on. */
+export interface SecretsSender {
+    send(command: unknown): Promise<unknown>;
+}
+/**
+ * Create-or-update a Secrets Manager secret in the local AWS fabric
+ * (ministack). Create first; on ResourceExistsException, put a new value.
+ * `client` is injectable for tests; defaults to a client against the local
+ * fabric.
+ */
+export declare function upsertLocalSecret(secretId: string, value: Record<string, string>, client?: SecretsSender): Promise<void>;
+/** True when a TCP connect to host:port succeeds within timeoutMs. */
+export declare function probeTcp(port: number, opts?: {
+    host?: string;
+    timeoutMs?: number;
+}): Promise<boolean>;
+//# sourceMappingURL=helpers.d.ts.map

package/dist/src/commands/local/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/commands/local/helpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1C;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,IAAI,CAAC,CAef;AAED,sEAAsE;AACtE,wBAAgB,QAAQ,CACtB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/C,OAAO,CAAC,OAAO,CAAC,CAclB"}

package/dist/src/commands/local/helpers.js

@@ -0,0 +1,46 @@
+/**
+ * Small shared helpers for the local-platform commands — extracted from the
+ * copies that had grown in auth-provision/mocks (secret upsert) and
+ * dev-local/stack (TCP probe).
+ */
+import * as net from "net";
+import { LOCAL_AWS_CONFIG } from "./seed.js";
+/**
+ * Create-or-update a Secrets Manager secret in the local AWS fabric
+ * (ministack). Create first; on ResourceExistsException, put a new value.
+ * `client` is injectable for tests; defaults to a client against the local
+ * fabric.
+ */
+export async function upsertLocalSecret(secretId, value, client) {
+    const { SecretsManagerClient, CreateSecretCommand, PutSecretValueCommand } = await import("@aws-sdk/client-secrets-manager");
+    const sm = client ?? new SecretsManagerClient(LOCAL_AWS_CONFIG);
+    const secretString = JSON.stringify(value);
+    try {
+        await sm.send(new CreateSecretCommand({ Name: secretId, SecretString: secretString }));
+    }
+    catch (err) {
+        if (err?.name === "ResourceExistsException") {
+            await sm.send(new PutSecretValueCommand({ SecretId: secretId, SecretString: secretString }));
+        }
+        else {
+            throw err;
+        }
+    }
+}
+/** True when a TCP connect to host:port succeeds within timeoutMs. */
+export function probeTcp(port, opts = {}) {
+    const { host = "127.0.0.1", timeoutMs = 2000 } = opts;
+    return new Promise((resolve) => {
+        const socket = net.connect({ host, port, timeout: timeoutMs });
+        socket.once("connect", () => {
+            socket.destroy();
+            resolve(true);
+        });
+        socket.once("error", () => resolve(false));
+        socket.once("timeout", () => {
+            socket.destroy();
+            resolve(false);
+        });
+    });
+}
+//# sourceMappingURL=helpers.js.map

package/dist/src/commands/local/helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../../../src/commands/local/helpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,GAAG,MAAM,KAAK,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAO7C;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAgB,EAChB,KAA6B,EAC7B,MAAsB;IAEtB,MAAM,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CACvF,iCAAiC,CAClC,CAAC;IACF,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IACzF,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,IAAI,KAAK,yBAAyB,EAAE,CAAC;YAC5C,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;QAC/F,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,QAAQ,CACtB,IAAY,EACZ,OAA8C,EAAE;IAEhD,MAAM,EAAE,IAAI,GAAG,WAAW,EAAE,SAAS,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACtD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YAC1B,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YAC1B,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/commands/local/hub-local.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Local Hub image builder (`mesh start --with-hub`) — the interim path
+ * until the hub pipeline publishes pullable container images (design §11).
+ *
+ * Resolves the published @mesh-tech/hub tarball with the user's registry
+ * auth (mesh registry login), extracts it, and docker-builds two images
+ * from the prebuilt dists it ships (api/dist → mesh-local-hub-api,
+ * ui/build → mesh-local-hub-ui). The CodeArtifact token enters the build
+ * as a BuildKit secret and never lands in a layer. Idempotent: images are
+ * keyed by the package version and rebuilt only when missing.
+ */
+import { type RegistryTokenState } from "../../utils/auth-preflight.js";
+export declare const HUB_IMAGES: readonly ["mesh-local-hub-api", "mesh-local-hub-ui"];
+/**
+ * Build the Hub's oauth2-proxy image (hosted sidecar + loopback issuer
+ * forward). Public base images only — no registry auth involved.
+ */
+export declare function ensureHubAuthImage(): void;
+/** Registry auth present? (Needed only to BUILD hub images, not to run them.) */
+export declare function hasRegistryAuth(): boolean;
+/**
+ * Newest hub version whose images already exist locally — lets `mesh start`
+ * include the Hub by default with no network and no registry auth. Returns
+ * undefined when no built images are present.
+ */
+export declare function localHubVersion(): string | undefined;
+export type WithHubPlan = {
+    action: "refresh";
+} | {
+    action: "use-local";
+    version: string;
+    warning: string;
+} | {
+    action: "fail";
+    message: string;
+    remediation: string;
+};
+/**
+ * Pure: decide what `mesh start --with-hub` does given the registry probe
+ * and any already-built local images. Only a *refresh* needs the registry —
+ * already-built images run without it, so an expired/missing token degrades
+ * to those (with the fixing command) instead of hard-failing a path that
+ * works offline (MESH-2479).
+ */
+export declare function planWithHubRefresh(probeState: RegistryTokenState, builtVersion: string | undefined): WithHubPlan;
+/**
+ * Ensure the two local hub images exist; build them from the tarball when
+ * missing. Returns the hub version (used as the compose image tag).
+ */
+export declare function ensureHubImages(): Promise<string>;
+//# sourceMappingURL=hub-local.d.ts.map

package/dist/src/commands/local/hub-local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-local.d.ts","sourceRoot":"","sources":["../../../../src/commands/local/hub-local.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,OAAO,EAAsC,KAAK,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAM5G,eAAO,MAAM,UAAU,sDAAuD,CAAC;AAkC/E;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAUzC;AAED,iFAAiF;AACjF,wBAAgB,eAAe,IAAI,OAAO,CAGzC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,MAAM,GAAG,SAAS,CAkBpD;AAkDD,MAAM,MAAM,WAAW,GACnB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7D;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,kBAAkB,EAC9B,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,WAAW,CAmBb;AAED;;;GAGG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,CAuCvD"}