@mesh-tech/mesh-cli 0.1.1 → 0.12.1

package/dist/src/index.js.map

@@ -1 +1,7 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,kBAAkB,CAAC"}
+{
+  "version": 3,
+  "sources": ["../../src/utils/errors.ts", "../../src/utils/log.ts", "../../src/utils/context.ts", "../../src/utils/bastion.ts", "../../src/utils/credentials.ts", "../../src/utils/pulumi.ts", "../../src/utils/vpn.ts"],
+  "sourcesContent": ["/**\n * Shared CLI error type with structured remediation.\n *\n * Every failure along the golden path should tell the user the exact `mesh`\n * command (or doc) that fixes it. Remediation strings must be commands or\n * docs \u2014 never \"ask <person>\".\n */\n\nimport chalk from \"chalk\";\n\nexport interface Remediation {\n  /** Exact command that fixes the failure, e.g. \"mesh login trabian-dev\" */\n  command?: string;\n  /** Documentation URL or repo-relative doc path with more context */\n  docs?: string;\n  /** Whether the owning command can apply this fix itself via --fix */\n  autoFixable?: boolean;\n}\n\nexport interface MeshCliErrorOptions {\n  remediation?: Remediation;\n  /** Process exit code (default 1) */\n  exitCode?: number;\n  cause?: unknown;\n}\n\nexport class MeshCliError extends Error {\n  readonly remediation?: Remediation;\n  readonly exitCode: number;\n\n  constructor(message: string, options: MeshCliErrorOptions = {}) {\n    super(message, options.cause !== undefined ? { cause: options.cause } : undefined);\n    this.name = \"MeshCliError\";\n    this.remediation = options.remediation;\n    this.exitCode = options.exitCode ?? 1;\n  }\n}\n\n/**\n * Render an error's BODY \u2014 the message plus its \"\u2192 run: <command>\" /\n * \"\u2192 see: <docs>\" remediation lines, with no leading severity glyph.\n *\n * Use this when the caller supplies its own glyph: a recovery path that logs a\n * refusal through `logWarn` (which prefixes \u26A0) and carries on would otherwise\n * print \"\u26A0 \u2717 \u2026\". The remediation lines are the part that must survive \u2014 they\n * name the corrupt file to delete.\n */\nexport function renderErrorBody(err: unknown): string {\n  const message = err instanceof Error ? err.message : String(err);\n  if (!(err instanceof MeshCliError)) return message;\n  const lines = [message];\n  if (err.remediation?.command) {\n    lines.push(chalk.cyan(\"  \u2192 run: \") + err.remediation.command);\n  }\n  if (err.remediation?.docs) {\n    lines.push(chalk.cyan(\"  \u2192 see: \") + err.remediation.docs);\n  }\n  return lines.join(\"\\n\");\n}\n\n/**\n * Render an error for humans. MeshCliError gets its remediation appended as\n * \"\u2192 run: <command>\" / \"\u2192 see: <docs>\" lines; anything else renders its message.\n */\nexport function renderError(err: unknown): string {\n  return chalk.red(\"\u2717\") + \" \" + renderErrorBody(err);\n}\n\n/**\n * Render an error as JSON for agents. Same structure as the human output:\n * { error, remediation?: { command?, docs?, autoFixable? } }.\n */\nexport function renderErrorJson(err: unknown): string {\n  if (err instanceof MeshCliError) {\n    return JSON.stringify({\n      error: err.message,\n      ...(err.remediation ? { remediation: err.remediation } : {}),\n    });\n  }\n  return JSON.stringify({ error: err instanceof Error ? err.message : String(err) });\n}\n\nlet jsonPayloadEmitted = false;\n\n/**\n * Print a command's `--json` payload \u2014 the single machine-readable document on\n * stdout \u2014 and record that it happened.\n *\n * A command that emits a payload and *then* throws (the `mesh init` doctor\n * throws by design whenever a check fails) used to produce TWO concatenated\n * JSON documents on stdout, because `handleCliError` appended `{\"error\":\u2026}`.\n * Two documents is not JSON: `mesh init app-tenant --json | jq` failed to parse\n * on exactly the failure path a script cares about. Routing every payload\n * through here lets the handler know stdout is already spoken for.\n */\nexport function emitJsonPayload(payload: unknown): void {\n  console.log(JSON.stringify(payload, null, 2));\n  jsonPayloadEmitted = true;\n}\n\n/** True once a command has written its `--json` payload to stdout. */\nexport function hasEmittedJsonPayload(): boolean {\n  return jsonPayloadEmitted;\n}\n\n/** Test seam \u2014 the flag is module state, so specs have to be able to clear it. */\nexport function resetJsonPayloadEmitted(): void {\n  jsonPayloadEmitted = false;\n}\n\n/**\n * Top-level handler for bin/mesh.ts. Prints the error (JSON when the\n * invocation asked for --json anywhere, since per-command flags aren't\n * parsed once dispatch has failed) and exits with the error's code.\n *\n * When the command already emitted a `--json` payload, that payload IS the\n * machine surface \u2014 and it says strictly more than this error would (the\n * doctor's payload carries `ok:false` plus a per-check `fix` command). So the\n * error goes to stderr as human diagnostics and stdout keeps exactly one\n * parseable document.\n */\nexport function handleCliError(err: unknown): never {\n  const wantsJson = process.argv.includes(\"--json\");\n  if (wantsJson && !hasEmittedJsonPayload()) {\n    console.log(renderErrorJson(err));\n  } else {\n    console.error(renderError(err));\n  }\n  process.exit(err instanceof MeshCliError ? err.exitCode : 1);\n}\n", "/**\n * Logging utilities with colored output.\n *\n * Non-TTY streams (CI, agent runs, piped output) get an [HH:MM:SS] prefix on\n * every line so long quiet stretches are attributable after the fact\n * (MESH-2479); interactive terminals stay clean. Override with\n * MESH_LOG_TIMESTAMPS=1 (force on) / =0 (force off).\n */\n\nimport chalk from \"chalk\";\n\n/**\n * Pure prefix decision, exported for tests: timestamps when the env flag says\n * so, else whenever stderr is not a TTY.\n */\nexport function logPrefix(opts: {\n  isTTY: boolean;\n  envFlag: string | undefined;\n  now: Date;\n}): string {\n  const enabled = opts.envFlag === \"1\" || (opts.envFlag !== \"0\" && !opts.isTTY);\n  return enabled ? `[${opts.now.toISOString().slice(11, 19)}] ` : \"\";\n}\n\nfunction prefix(): string {\n  return chalk.dim(\n    logPrefix({\n      isTTY: !!process.stderr.isTTY,\n      envFlag: process.env.MESH_LOG_TIMESTAMPS,\n      now: new Date(),\n    }),\n  );\n}\n\nexport function logInfo(message: string): void {\n  console.error(prefix() + chalk.blue(\"\u2139\"), message);\n}\n\nexport function logSuccess(message: string): void {\n  console.error(prefix() + chalk.green(\"\u2713\"), message);\n}\n\nexport function logWarn(message: string): void {\n  console.error(prefix() + chalk.yellow(\"\u26A0\"), message);\n}\n\nexport function logError(message: string): void {\n  console.error(prefix() + chalk.red(\"\u2717\"), message);\n}\n\n/** Render elapsed milliseconds compactly: \"45s\", \"2m 30s\", \"1h 5m\". */\nexport function formatElapsed(ms: number): string {\n  const totalSec = Math.max(0, Math.round(ms / 1000));\n  const h = Math.floor(totalSec / 3600);\n  const m = Math.floor((totalSec % 3600) / 60);\n  const s = totalSec % 60;\n  if (h > 0) return `${h}h ${m}m`;\n  if (m > 0) return `${m}m ${s}s`;\n  return `${s}s`;\n}\n\n/**\n * Periodic \"still working\" line during a long silent operation (registry\n * fetches, image builds) so a non-TTY first run never sits at 0 bytes of\n * output for minutes (MESH-2479). `touch()` marks recent real output, which\n * suppresses the next beat \u2014 the heartbeat only fills silence.\n */\nexport function startHeartbeat(\n  label: string,\n  intervalMs = 15_000,\n): { stop: () => void; touch: () => void } {\n  const startedAt = Date.now();\n  let lastOutputAt = startedAt;\n  const timer = setInterval(() => {\n    if (Date.now() - lastOutputAt < intervalMs) return;\n    logInfo(`\u2026 still working: ${label} (${formatElapsed(Date.now() - startedAt)} elapsed)`);\n  }, intervalMs);\n  timer.unref?.();\n  return {\n    stop: () => clearInterval(timer),\n    touch: () => {\n      lastOutputAt = Date.now();\n    },\n  };\n}\n", "/**\n * Context detection - determines tenant, stage, and platform environment\n * from the current directory and environment variables.\n */\n\nimport * as fs from \"fs\";\nimport * as path from \"path\";\nimport { logInfo } from \"./log.js\";\n\nexport interface MeshContext {\n  tenant: string;\n  stage: string;\n  platformEnv: string;\n}\n\n/**\n * Find a file by walking up directories from the starting directory.\n * Returns the full path to the file if found, undefined otherwise.\n */\nfunction findFileUpward(filename: string, startDir: string = process.cwd()): string | undefined {\n  let currentDir = startDir;\n  const root = path.parse(currentDir).root;\n\n  while (currentDir !== root) {\n    const filePath = path.join(currentDir, filename);\n    if (fs.existsSync(filePath)) {\n      return filePath;\n    }\n    currentDir = path.dirname(currentDir);\n  }\n  return undefined;\n}\n\n/**\n * Detect tenant and stage from current directory and environment.\n *\n * Priority for stage:\n *   1. --stage flag (passed as stageArg)\n *   2. MESH_STAGE env var\n *   3. SST_STAGE env var\n *   4. .sst/stage file\n *   5. Pulumi config file name\n *   6. Default: \"dev\"\n *\n * Priority for tenant:\n *   1. MESH_TENANT env var\n *   2. config.ts tenant field\n *   3. Pulumi config mesh:tenant\n *   4. Directory path (tenants/{tenant}/...)\n *   5. Default: \"mesh\"\n */\nexport function detectContext(stageArg?: string): MeshContext {\n  let tenant: string | undefined;\n  let stage: string | undefined;\n\n  const cwd = process.cwd();\n\n  // Try to detect from Pulumi.yaml\n  if (fs.existsSync(\"Pulumi.yaml\")) {\n    // Look for Pulumi.*.yaml config files\n    const files = fs.readdirSync(\".\").filter(\n      (f) => f.startsWith(\"Pulumi.\") && f.endsWith(\".yaml\") && f !== \"Pulumi.yaml\"\n    );\n\n    const configFile = files[0];\n    if (configFile) {\n      const content = fs.readFileSync(configFile, \"utf-8\");\n\n      // Extract tenant from mesh:tenant config\n      const tenantMatch = content.match(/^\\s*mesh:tenant:\\s*[\"']?([^\"'\\n]+)[\"']?/m);\n      if (tenantMatch?.[1]) {\n        tenant = tenantMatch[1].trim();\n      }\n\n      // Extract stage from filename: Pulumi.<stage>.yaml\n      const stageMatch = configFile.match(/Pulumi\\.(.+)\\.yaml/);\n      if (stageMatch?.[1]) {\n        stage = stageMatch[1];\n      }\n    }\n  }\n\n  // Try to detect from SST config (walk up directories to find it)\n  const sstConfigPath = findFileUpward(\"sst.config.ts\");\n  let sstDir: string | undefined;\n\n  if (sstConfigPath) {\n    sstDir = path.dirname(sstConfigPath);\n\n    // Check parent config.ts for tenant (relative to sst.config.ts location)\n    const parentConfigPath = path.join(sstDir, \"..\", \"config.ts\");\n    if (fs.existsSync(parentConfigPath)) {\n      const configContent = fs.readFileSync(parentConfigPath, \"utf-8\");\n      const tenantMatch = configContent.match(/tenant:\\s*[\"']([^\"']+)[\"']/);\n      if (tenantMatch) {\n        tenant = tenantMatch[1];\n      }\n    }\n\n    // Check .sst/stage for current stage (relative to sst.config.ts location)\n    const sstStagePath = path.join(sstDir, \".sst\", \"stage\");\n    if (fs.existsSync(sstStagePath)) {\n      stage = fs.readFileSync(sstStagePath, \"utf-8\").trim();\n    }\n  }\n\n  // Fallback: infer tenant from directory path\n  if (!tenant) {\n    const pathMatch = cwd.match(/tenants\\/([^/]+)/);\n    if (pathMatch) {\n      tenant = pathMatch[1];\n    }\n  }\n\n  // Apply priority: stageArg > MESH_STAGE > SST_STAGE > detected > default\n  stage = stageArg || process.env.MESH_STAGE || process.env.SST_STAGE || stage || \"dev\";\n  tenant = process.env.MESH_TENANT || tenant || \"mesh\";\n\n  // Resolve platform environment from config.ts if available\n  let platformEnv = stage;\n  let platformEnvMap: Record<string, string> = {};\n  let defaultPlatformEnv: string | undefined;\n\n  // Try to read platformEnvMap and defaultPlatformEnv from config.ts (relative to sst.config.ts location)\n  const configPath = sstDir ? path.join(sstDir, \"..\", \"config.ts\") : \"../config.ts\";\n  if (fs.existsSync(configPath)) {\n    const configContent = fs.readFileSync(configPath, \"utf-8\");\n\n    // Parse platformEnvMap object\n    const mapMatch = configContent.match(/platformEnvMap:\\s*\\{([^}]+)\\}/);\n    if (mapMatch?.[1]) {\n      const entries = mapMatch[1].matchAll(/(\\w+):\\s*[\"']([^\"']+)[\"']/g);\n      for (const entry of entries) {\n        const key = entry[1];\n        const value = entry[2];\n        if (key && value) {\n          platformEnvMap[key] = value;\n        }\n      }\n    }\n\n    // Parse defaultPlatformEnv\n    const defaultMatch = configContent.match(/defaultPlatformEnv:\\s*[\"']([^\"']+)[\"']/);\n    if (defaultMatch?.[1]) {\n      defaultPlatformEnv = defaultMatch[1];\n    }\n  }\n\n  // Parse env from stage by stripping tenant prefix (matches Pulumi pattern)\n  // e.g., \"mesh-dev-temporal\" \u2192 env \"dev-temporal\"\n  const tenantPrefix = `${tenant}-`;\n  const parsedEnv = stage.startsWith(tenantPrefix)\n    ? stage.slice(tenantPrefix.length)\n    : stage;\n\n  // Use config mapping if available, then defaultPlatformEnv, otherwise use parsed env directly\n  platformEnv = platformEnvMap[parsedEnv] ?? platformEnvMap[stage] ?? defaultPlatformEnv ?? parsedEnv;\n\n  logInfo(`Stage: ${stage}, Platform: ${platformEnv}, Tenant: ${tenant}`);\n\n  return { tenant, stage, platformEnv };\n}\n", "/**\n * Bastion utilities for SSM tunneling to platform services\n */\n\nimport { SSMClient, GetParameterCommand } from \"@aws-sdk/client-ssm\";\nimport { logInfo, logSuccess, logError } from \"./log.js\";\n\n/**\n * Service endpoint info\n */\nexport interface ServiceEndpoint {\n  host: string;\n  port: number;\n}\n\n/**\n * Platform bastion info from SSM\n */\nexport interface PlatformBastionInfo {\n  instanceId: string;\n  securityGroupId: string;\n  services: Record<string, ServiceEndpoint>;\n}\n\n/**\n * Legacy bastion info (for backward compatibility with db commands)\n */\nexport interface BastionInfo {\n  instanceId: string;\n  rdsEndpoint: string;\n  rdsPort: number;\n}\n\n/**\n * Get platform bastion info from SSM parameter store.\n *\n * Reads the platformBastion key from the platform export at\n * /mesh-platform/{tenant}/{platformEnv}/platform. Falls back to the legacy\n * separate parameter at /mesh-platform/{tenant}/{platformEnv}/platform-bastion\n * for backward compatibility.\n */\nexport async function getPlatformBastionInfo(\n  tenant: string,\n  platformEnv: string,\n  region?: string\n): Promise<PlatformBastionInfo> {\n  const ssm = new SSMClient(region ? { region } : {});\n\n  // Captured so the final error can distinguish a CREDS failure (the common\n  // case \u2014 stale/expired ambient AWS creds, or creds lacking cross-tenant read\n  // on the hub param) from a genuinely missing bastion. Without this the read\n  // error is swallowed and every failure looks like \"bastion not deployed\".\n  let primaryError: unknown;\n\n  // Primary: read from the platform export (platformBastion is a nested key)\n  const platformPath = `/mesh-platform/${tenant}/${platformEnv}/platform`;\n  logInfo(`Looking up platform bastion from ${platformPath}...`);\n\n  try {\n    const response = await ssm.send(\n      new GetParameterCommand({ Name: platformPath })\n    );\n\n    if (response.Parameter?.Value) {\n      const platform = JSON.parse(response.Parameter.Value);\n      if (platform.platformBastion) {\n        const info = platform.platformBastion as PlatformBastionInfo;\n        logSuccess(`Found bastion: ${info.instanceId}`);\n\n        const serviceNames = Object.keys(info.services);\n        if (serviceNames.length > 0) {\n          logInfo(`Available services: ${serviceNames.join(\", \")}`);\n        }\n\n        return info;\n      }\n    }\n  } catch (err) {\n    // Don't swallow: keep the real reason (AccessDenied / ExpiredToken / \u2026) so\n    // the final error can be actionable. Then try the legacy path.\n    primaryError = err;\n  }\n\n  // Fallback: legacy separate parameter\n  const legacyPath = `/mesh-platform/${tenant}/${platformEnv}/platform-bastion`;\n  logInfo(`Trying legacy path ${legacyPath}...`);\n\n  try {\n    const response = await ssm.send(\n      new GetParameterCommand({ Name: legacyPath })\n    );\n\n    if (!response.Parameter?.Value) {\n      throw new Error(`Platform bastion not found`);\n    }\n\n    const info = JSON.parse(response.Parameter.Value) as PlatformBastionInfo;\n    logSuccess(`Found bastion: ${info.instanceId}`);\n\n    const serviceNames = Object.keys(info.services);\n    if (serviceNames.length > 0) {\n      logInfo(`Available services: ${serviceNames.join(\", \")}`);\n    }\n\n    return info;\n  } catch (legacyError) {\n    // Classify on the PRIMARY read's error (the meaningful one) \u2014 the legacy\n    // path is usually just ParameterNotFound and hides the real cause.\n    const cause = primaryError ?? legacyError;\n    const name = (cause as { name?: string })?.name ?? \"\";\n    const credsProblem = /Expired|UnrecognizedClient|InvalidClientTokenId|InvalidSignature|CredentialsProviderError|AccessDenied/i.test(\n      name\n    );\n\n    if (credsProblem) {\n      logError(\n        `Could not read the platform bastion from ${platformPath} \u2014 AWS error: ${name}.`\n      );\n      logInfo(\n        \"This is almost always a CREDENTIALS problem, not a missing bastion.\"\n      );\n      logInfo(\n        \"  \u2022 The read uses the ambient AWS creds of this process; they must be valid AND able to read the HUB param above.\"\n      );\n      logInfo(\n        \"  \u2022 Check: `aws sts get-caller-identity` (ExpiredToken \u2192 refresh; AccessDenied \u2192 those creds lack hub read \u2014 use InfraAdmin-grade creds).\"\n      );\n      logInfo(\n        \"  \u2022 Stale creds often hide in the tmux GLOBAL env (`tmux show-environment -g | grep AWS_`); a per-shell `unset` won't clear them.\"\n      );\n    } else {\n      logError(`Platform bastion not found in ${platformPath} or ${legacyPath}`);\n      logInfo(\"Make sure platformBastion is enabled in your platform config and deployed.\");\n    }\n    throw cause;\n  }\n}\n\n/**\n * Get bastion info from SSM parameter store (legacy format).\n * Reads from /mesh/{tenant}/{platformEnv}/platform-bastion and extracts RDS info.\n *\n * @deprecated Use getPlatformBastionInfo instead\n */\nexport async function getBastionInfo(\n  tenant: string,\n  platformEnv: string\n): Promise<BastionInfo> {\n  const info = await getPlatformBastionInfo(tenant, platformEnv);\n\n  const rdsService = info.services[\"rds\"];\n  if (!rdsService) {\n    throw new Error(\"RDS service not available in platform bastion. Is RDS enabled?\");\n  }\n\n  return {\n    instanceId: info.instanceId,\n    rdsEndpoint: rdsService.host,\n    rdsPort: rdsService.port,\n  };\n}\n", "/**\n * Database credential utilities\n */\n\nimport {\n  SecretsManagerClient,\n  GetSecretValueCommand,\n} from \"@aws-sdk/client-secrets-manager\";\nimport { logInfo, logSuccess } from \"./log.js\";\n\nexport interface DatabaseCredentials {\n  username: string;\n  password: string;\n  host: string;\n  port: number;\n  database: string;\n}\n\n/**\n * Options for credential lookup\n */\nexport interface CredentialLookupOptions {\n  /** App name (e.g., \"rdc\") - if provided, uses path mesh/{tenant}/{stage}/{app}/db-credentials */\n  app?: string;\n}\n\n/**\n * Get DATABASE_URL from Secrets Manager.\n *\n * Credential path patterns:\n *   - With app:    mesh/{tenant}/{stage}/{app}/db-credentials\n *   - Without app: mesh/{tenant}/{stage}/db-credentials\n *\n * Returns the DATABASE_URL string directly. Use rewriteDatabaseUrl() to\n * modify host/port for tunnel usage.\n */\nexport async function getDatabaseUrl(\n  tenant: string,\n  stage: string,\n  options?: CredentialLookupOptions\n): Promise<string> {\n  const secretsManager = new SecretsManagerClient({});\n\n  // Build secret path - with or without app name\n  const secretName = options?.app\n    ? `mesh/${tenant}/${stage}/${options.app}/db-credentials`\n    : `mesh/${tenant}/${stage}/db-credentials`;\n  logInfo(`Looking up credentials at ${secretName}...`);\n\n  try {\n    const response = await secretsManager.send(\n      new GetSecretValueCommand({ SecretId: secretName })\n    );\n\n    if (response.SecretString) {\n      const secret = JSON.parse(response.SecretString);\n\n      // Handle DATABASE_URL format (preferred)\n      if (secret.DATABASE_URL) {\n        const parsed = new URL(secret.DATABASE_URL);\n        logSuccess(`Got credentials for user: ${parsed.username}`);\n        return secret.DATABASE_URL;\n      }\n\n      // Handle individual fields format (legacy)\n      if (secret.username && secret.password) {\n        logSuccess(`Got credentials for user: ${secret.username}`);\n        const database = secret.dbname ?? secret.database ?? \"postgres\";\n        return `postgresql://${secret.username}:${encodeURIComponent(secret.password)}@${secret.host ?? \"localhost\"}:${secret.port ?? 5432}/${database}`;\n      }\n\n      throw new Error(`Secret ${secretName} has unexpected format (needs DATABASE_URL or username/password)`);\n    }\n  } catch (error) {\n    if ((error as Error).message?.includes(\"unexpected format\")) {\n      throw error;\n    }\n    // Secret not found - will be caught by caller\n  }\n\n  throw new Error(`Could not find credentials at ${secretName}`);\n}\n\n/**\n * @deprecated Use getDatabaseUrl instead - returns DATABASE_URL directly\n */\nexport async function getDbCredentials(\n  tenant: string,\n  stage: string,\n  _platformEnv: string,\n  rdsHost: string,\n  rdsPort: number,\n  options?: CredentialLookupOptions\n): Promise<DatabaseCredentials> {\n  const databaseUrl = await getDatabaseUrl(tenant, stage, options);\n  const parsed = new URL(databaseUrl);\n\n  return {\n    username: parsed.username,\n    password: decodeURIComponent(parsed.password),\n    host: rdsHost,\n    port: rdsPort,\n    database: parsed.pathname.slice(1),\n  };\n}\n\n/**\n * Options for rewriting DATABASE_URL\n */\nexport interface DatabaseUrlRewriteOptions {\n  /** New host:port endpoint (e.g., \"localhost:5432\") */\n  endpoint?: string;\n  /** SSL mode (require, no-verify, disable) */\n  sslMode?: string;\n}\n\n/**\n * Rewrite DATABASE_URL with new endpoint and/or SSL mode.\n * Preserves username, password, database name, and other query params.\n *\n * Used by both mesh-env-exec (for sst dev) and mesh db exec (for ad-hoc commands).\n */\nexport function rewriteDatabaseUrl(\n  url: string,\n  options: DatabaseUrlRewriteOptions\n): string {\n  try {\n    const parsed = new URL(url);\n\n    // Rewrite endpoint if provided\n    if (options.endpoint) {\n      if (options.endpoint.includes(\":\")) {\n        const colonIndex = options.endpoint.lastIndexOf(\":\");\n        parsed.hostname = options.endpoint.slice(0, colonIndex);\n        parsed.port = options.endpoint.slice(colonIndex + 1);\n      } else {\n        parsed.hostname = options.endpoint;\n        parsed.port = parsed.port || \"5432\";\n      }\n    }\n\n    // Set SSL mode if provided\n    if (options.sslMode) {\n      parsed.searchParams.set(\"sslmode\", options.sslMode);\n      // For Prisma: accept invalid/self-signed certificates through tunnels\n      if (options.sslMode === \"require\" || options.sslMode === \"no-verify\") {\n        parsed.searchParams.set(\"sslaccept\", \"accept_invalid_certs\");\n      }\n    }\n\n    return parsed.toString();\n  } catch {\n    // If URL parsing fails, return original\n    return url;\n  }\n}\n\n/**\n * Build a DATABASE_URL from credentials.\n */\nexport function buildDatabaseUrl(\n  creds: DatabaseCredentials,\n  options?: DatabaseUrlRewriteOptions\n): string {\n  const host = options?.endpoint?.split(\":\")[0] ?? creds.host;\n  const port = options?.endpoint?.split(\":\")[1] ?? String(creds.port);\n\n  let url = `postgresql://${creds.username}:${encodeURIComponent(creds.password)}@${host}:${port}/${creds.database}`;\n\n  if (options?.sslMode) {\n    url += `?sslmode=${options.sslMode}`;\n    if (options.sslMode === \"require\" || options.sslMode === \"no-verify\") {\n      url += \"&sslaccept=accept_invalid_certs\";\n    }\n  }\n\n  return url;\n}\n\n/**\n * Try to read database info from SST outputs (when sst dev has run).\n */\nexport async function readSstOutputs(): Promise<{\n  databaseUrl?: string;\n  databaseName?: string;\n  secretArn?: string;\n} | null> {\n  const fs = await import(\"fs\");\n\n  if (!fs.existsSync(\".sst/outputs.json\")) {\n    return null;\n  }\n\n  try {\n    const content = fs.readFileSync(\".sst/outputs.json\", \"utf-8\");\n    const outputs = JSON.parse(content);\n\n    if (outputs.databaseUrl) {\n      logInfo(\"Found SST outputs with database config\");\n\n      // Extract secret ARN from URL if present\n      const secretArnMatch = outputs.databaseUrl.match(/secretArn=([^&]+)/);\n      const secretArn = secretArnMatch\n        ? decodeURIComponent(secretArnMatch[1])\n        : undefined;\n\n      return {\n        databaseUrl: outputs.databaseUrl,\n        databaseName: outputs.databaseName,\n        secretArn,\n      };\n    }\n  } catch {\n    // Ignore parse errors\n  }\n\n  return null;\n}\n", "/**\n * Pulumi-related utilities shared across CLI commands.\n */\n\nimport { execFileSync } from \"child_process\";\nimport * as path from \"path\";\nimport * as fs from \"fs\";\n\n/**\n * Find the Pulumi app root by walking up from a starting directory.\n * Returns the first directory containing `Pulumi.yaml`, or null.\n */\nexport function findAppRoot(startDir: string): string | null {\n  let dir = startDir;\n  while (true) {\n    if (fs.existsSync(path.join(dir, \"Pulumi.yaml\"))) return dir;\n    const parent = path.dirname(dir);\n    if (parent === dir) return null;\n    dir = parent;\n  }\n}\n\n/**\n * Find Pulumi.<stack>.yaml files in a directory.\n * Returns an array of stack names (without the Pulumi. prefix and .yaml suffix).\n */\nexport function findStackConfigs(appRoot: string): string[] {\n  return fs.readdirSync(appRoot)\n    .filter((f) => /^Pulumi\\..+\\.yaml$/.test(f) && f !== \"Pulumi.yaml\")\n    .map((f) => f.replace(/^Pulumi\\./, \"\").replace(/\\.yaml$/, \"\"));\n}\n\n/**\n * Get the currently selected Pulumi stack name, or null.\n */\nexport function getCurrentStack(appRoot: string): string | null {\n  try {\n    const result = execFileSync(\"pulumi\", [\"stack\", \"--show-name\"], {\n      encoding: \"utf-8\",\n      cwd: appRoot,\n      stdio: [\"pipe\", \"pipe\", \"pipe\"],\n    });\n    return result.trim() || null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Read a config value from Pulumi.<stack>.yaml.\n * Simple regex-based parser \u2014 handles single-line string values.\n * For complex values, use `pulumi config` CLI instead.\n */\nexport function readStackConfig(appRoot: string, stack: string, key: string): string | null {\n  const configFile = path.join(appRoot, `Pulumi.${stack}.yaml`);\n  if (!fs.existsSync(configFile)) return null;\n\n  const content = fs.readFileSync(configFile, \"utf-8\");\n  const pattern = new RegExp(`^\\\\s+${key.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\")}:\\\\s*(.+)$`, \"m\");\n  const match = content.match(pattern);\n  if (!match) return null;\n\n  return match[1]!.trim().replace(/^[\"']|[\"']$/g, \"\");\n}\n\n/**\n * Run `pulumi stack output <key> --json` with the given extra args.\n *\n * Pulumi redacts secret-tainted outputs as the literal string `\"[secret]\"`.\n * Outputs like `env.register()`'s `dev` blob are tainted because they transitively\n * include secret values (e.g. `TEMPORAL_ENCODING_KEY`, DB passwords), even though\n * much of the blob (tunnels, namespace, service scaffolding) is non-secret.\n *\n * This helper tries without `--show-secrets` first \u2014 which avoids requiring\n * the local machine to have the stack's secrets provider configured (KMS access\n * etc.) \u2014 and retries with `--show-secrets` only if the first call returns a\n * `\"[secret]\"` placeholder. KMS/secrets-provider errors are not retried because\n * they will fail the same way with the flag set.\n */\nexport function pulumiStackOutput(\n  appRoot: string,\n  key: string,\n  extraArgs: string[],\n  env?: Record<string, string>,\n): string {\n  const execEnv = env ? { ...process.env, ...env } : undefined;\n  // First attempt: no --show-secrets (works without PULUMI_CONFIG_PASSPHRASE / KMS)\n  try {\n    const result = execFileSync(\n      \"pulumi\",\n      [\"stack\", \"output\", key, \"--json\", ...extraArgs],\n      { cwd: appRoot, encoding: \"utf-8\", stdio: [\"ignore\", \"pipe\", \"pipe\"], env: execEnv }\n    );\n    // If the output contains \"[secret]\" placeholders, retry with --show-secrets\n    if (result.includes('\"[secret]\"')) {\n      return execFileSync(\n        \"pulumi\",\n        [\"stack\", \"output\", key, \"--json\", \"--show-secrets\", ...extraArgs],\n        { cwd: appRoot, encoding: \"utf-8\", stdio: [\"ignore\", \"pipe\", \"pipe\"], env: execEnv }\n      );\n    }\n    return result;\n  } catch (err: unknown) {\n    // If the error is a secrets/KMS issue, don't retry with --show-secrets\n    // (it will fail the same way). Only retry for other Pulumi errors.\n    const errMsg = (err as { stderr?: string })?.stderr ?? \"\";\n    if (errMsg.includes(\"kms:\") || errMsg.includes(\"KMS\") || errMsg.includes(\"secrets manager\")) {\n      throw err;\n    }\n    return execFileSync(\n      \"pulumi\",\n      [\"stack\", \"output\", key, \"--json\", \"--show-secrets\", ...extraArgs],\n      { cwd: appRoot, encoding: \"utf-8\", stdio: [\"ignore\", \"pipe\", \"pipe\"], env: execEnv }\n    );\n  }\n}\n", "/**\n * VPN detection utilities\n */\n\nimport { execFile, execFileSync } from \"node:child_process\";\nimport { existsSync } from \"node:fs\";\nconst TAILSCALE_PATHS = [\n  \"tailscale\",\n  \"/Applications/Tailscale.app/Contents/MacOS/Tailscale\",\n];\n\n/**\n * Detect whether a Tailscale VPN connection is active.\n *\n * Uses socket-aware `execTailscaleCmd` so it works in both kernel tun mode\n * (standard socket) and legacy userspace networking (/tmp/tailscale.sock).\n * Returns `true` only when BackendState is \"Running\" and Self.Online is true.\n * Returns `false` silently on any failure (binary missing, daemon stopped,\n * parse error, missing fields).\n */\nexport async function isVpnConnected(): Promise<boolean> {\n  try {\n    const stdout = await execTailscaleCmd([\"status\", \"--json\"]);\n    const status: TailscaleDetailedStatus = JSON.parse(stdout);\n    return status.BackendState === \"Running\" && status.Self?.Online === true;\n  } catch {\n    return false;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// DNS record management & Tailscale info\n// ---------------------------------------------------------------------------\n\n/** Standard socket (kernel tun mode), then legacy (userspace mode). */\nconst TAILSCALE_SOCKET_PATHS = [\"/var/run/tailscale/tailscaled.sock\", \"/tmp/tailscale.sock\"];\n\n/** Connection details for the Headscale DNS writer sidecar. */\nexport interface HeadscaleDnsConfig {\n  namespace: string;\n  pod: string;\n  container: string;\n  filePath: string;\n}\n\n/**\n * Build a HeadscaleDnsConfig from tenant/env, following the same naming\n * convention as `mesh vpn` (\u2060{tenant}-{env}-headscale).\n *\n * Pod name, container, and file path are infrastructure conventions that\n * rarely change \u2014 override via the optional parameter if they do.\n */\nexport function headscaleDnsConfig(\n  tenant = \"mesh\",\n  env = \"dev\",\n  overrides?: Partial<HeadscaleDnsConfig>,\n): HeadscaleDnsConfig {\n  return {\n    namespace: `${tenant}-${env}-headscale`,\n    pod: \"headscale-0\",\n    container: \"dns-writer\",\n    filePath: \"/var/lib/headscale/dns/extra-records.json\",\n    ...overrides,\n  };\n}\n\nexport interface DnsRecord {\n  name: string;\n  type: \"A\";\n  value: string;\n}\n\ninterface TailscaleDetailedStatus {\n  BackendState?: string;\n  Self?: {\n    Online?: boolean;\n    HostName?: string;\n    TailscaleIPs?: string[];\n  };\n}\n\n/**\n * Execute a tailscale CLI command, trying each known binary path.\n * Automatically appends `--socket <path>` when a tailscale socket is found.\n */\nfunction execTailscaleCmd(args: string[]): Promise<string> {\n  const socketPath = TAILSCALE_SOCKET_PATHS.find(existsSync);\n\n  interface Attempt {\n    binary: string;\n    args: string[];\n  }\n\n  const attempts: Attempt[] = [];\n  for (const binary of TAILSCALE_PATHS) {\n    if (socketPath) {\n      attempts.push({ binary, args: [\"--socket\", socketPath, ...args] });\n    }\n    attempts.push({ binary, args });\n  }\n\n  return new Promise((resolve, reject) => {\n    let index = 0;\n\n    function tryNext(): void {\n      if (index >= attempts.length) {\n        reject(new Error(\"All tailscale binary attempts failed\"));\n        return;\n      }\n\n      const attempt = attempts[index++]!;\n      execFile(attempt.binary, attempt.args, (error, stdout) => {\n        if (error) {\n          tryNext();\n        } else {\n          resolve(stdout);\n        }\n      });\n    }\n\n    tryNext();\n  });\n}\n\n/**\n * Retrieve the current Tailscale hostname and IP address.\n *\n * Returns `null` when Tailscale is not installed, not running, or not online.\n */\nexport async function getTailscaleInfo(): Promise<{ hostname: string; ip: string } | null> {\n  try {\n    const stdout = await execTailscaleCmd([\"status\", \"--json\"]);\n    const status: TailscaleDetailedStatus = JSON.parse(stdout);\n\n    if (\n      status.BackendState === \"Running\" &&\n      status.Self?.Online === true &&\n      status.Self.HostName &&\n      status.Self.TailscaleIPs?.length\n    ) {\n      return {\n        hostname: status.Self.HostName,\n        ip: status.Self.TailscaleIPs[0]!,\n      };\n    }\n\n    return null;\n  } catch {\n    return null;\n  }\n}\n\n/** Helper: build kubectl exec args for the dns-writer sidecar. */\nfunction dnsWriterExec(cfg: HeadscaleDnsConfig, cmd: string[], interactive = false): string[] {\n  return [\n    \"exec\", ...(interactive ? [\"-i\"] : []),\n    \"-n\", cfg.namespace, cfg.pod, \"-c\", cfg.container, \"--\", ...cmd,\n  ];\n}\n\n/**\n * Read DNS records from the dns-writer sidecar in the Headscale pod.\n *\n * Throws with an actionable message if kubectl can't reach the pod.\n * Returns an empty array when the file is missing or contains invalid JSON.\n */\nexport function readDnsRecords(cfg: HeadscaleDnsConfig): DnsRecord[] {\n  try {\n    const raw = execFileSync(\"kubectl\", dnsWriterExec(cfg, [\"cat\", cfg.filePath]), {\n      encoding: \"utf-8\",\n      stdio: [\"ignore\", \"pipe\", \"pipe\"],\n    });\n    const trimmed = raw.trim();\n    if (!trimmed || trimmed === \"[]\") return [];\n    try {\n      return JSON.parse(trimmed);\n    } catch {\n      console.warn(`[vpn] DNS records file contains invalid JSON, treating as empty`);\n      return [];\n    }\n  } catch (err) {\n    const msg = (err as Error).message ?? String(err);\n    if (msg.includes(\"not found\") || msg.includes(\"Unable to connect\")) {\n      throw new Error(\n        `Cannot reach Headscale DNS writer (namespace=${cfg.namespace}, pod=${cfg.pod}).\\n` +\n        `Verify kubectl context and that the Headscale pod is running:\\n` +\n        `  kubectl get pods -n ${cfg.namespace}`,\n      );\n    }\n    if (msg.includes(\"No such file\")) {\n      return [];\n    }\n    // Unexpected error \u2014 rethrow\n    throw err;\n  }\n}\n\n/**\n * Write DNS A records to the dns-writer sidecar in the Headscale pod.\n *\n * Pipes JSON via stdin to avoid shell-escaping issues.\n * Throws with an actionable message if kubectl can't reach the pod.\n */\nexport function registerDnsRecords(cfg: HeadscaleDnsConfig, records: DnsRecord[]): void {\n  const json = JSON.stringify(records);\n  try {\n    execFileSync(\n      \"kubectl\",\n      dnsWriterExec(cfg, [\"sh\", \"-c\", `cat > '${cfg.filePath}'`], true),\n      { input: json, stdio: [\"pipe\", \"pipe\", \"pipe\"] },\n    );\n  } catch (err) {\n    const msg = (err as Error).message ?? String(err);\n    throw new Error(\n      `Failed to write DNS records to Headscale (namespace=${cfg.namespace}, pod=${cfg.pod}).\\n` +\n      `${msg.includes(\"not found\") ? \"Pod not found. \" : \"\"}` +\n      `Verify kubectl context: kubectl get pods -n ${cfg.namespace}`,\n    );\n  }\n}\n\n/**\n * Remove DNS records whose `name` ends with `suffix` from the Headscale pod.\n * Best-effort: logs a warning on failure instead of throwing.\n */\nexport function unregisterDnsRecords(cfg: HeadscaleDnsConfig, suffix: string): void {\n  try {\n    const records = readDnsRecords(cfg);\n    const filtered = records.filter((r) => !r.name.endsWith(suffix));\n    registerDnsRecords(cfg, filtered);\n  } catch {\n    // Best-effort cleanup \u2014 silent on failure\n  }\n}\n"],
+  "mappings": ";AAQA,OAAO,WAAW;AAkBX,IAAM,eAAN,cAA2B,MAAM;AAAA,EAC7B;AAAA,EACA;AAAA,EAET,YAAY,SAAiB,UAA+B,CAAC,GAAG;AAC9D,UAAM,SAAS,QAAQ,UAAU,SAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,MAAS;AACjF,SAAK,OAAO;AACZ,SAAK,cAAc,QAAQ;AAC3B,SAAK,WAAW,QAAQ,YAAY;AAAA,EACtC;AACF;AAWO,SAAS,gBAAgB,KAAsB;AACpD,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,MAAI,EAAE,eAAe,cAAe,QAAO;AAC3C,QAAM,QAAQ,CAAC,OAAO;AACtB,MAAI,IAAI,aAAa,SAAS;AAC5B,UAAM,KAAK,MAAM,KAAK,gBAAW,IAAI,IAAI,YAAY,OAAO;AAAA,EAC9D;AACA,MAAI,IAAI,aAAa,MAAM;AACzB,UAAM,KAAK,MAAM,KAAK,gBAAW,IAAI,IAAI,YAAY,IAAI;AAAA,EAC3D;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAMO,SAAS,YAAY,KAAsB;AAChD,SAAO,MAAM,IAAI,QAAG,IAAI,MAAM,gBAAgB,GAAG;AACnD;AAMO,SAAS,gBAAgB,KAAsB;AACpD,MAAI,eAAe,cAAc;AAC/B,WAAO,KAAK,UAAU;AAAA,MACpB,OAAO,IAAI;AAAA,MACX,GAAI,IAAI,cAAc,EAAE,aAAa,IAAI,YAAY,IAAI,CAAC;AAAA,IAC5D,CAAC;AAAA,EACH;AACA,SAAO,KAAK,UAAU,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE,CAAC;AACnF;AAEA,IAAI,qBAAqB;AAalB,SAAS,gBAAgB,SAAwB;AACtD,UAAQ,IAAI,KAAK,UAAU,SAAS,MAAM,CAAC,CAAC;AAC5C,uBAAqB;AACvB;AAGO,SAAS,wBAAiC;AAC/C,SAAO;AACT;AAGO,SAAS,0BAAgC;AAC9C,uBAAqB;AACvB;AAaO,SAAS,eAAe,KAAqB;AAClD,QAAM,YAAY,QAAQ,KAAK,SAAS,QAAQ;AAChD,MAAI,aAAa,CAAC,sBAAsB,GAAG;AACzC,YAAQ,IAAI,gBAAgB,GAAG,CAAC;AAAA,EAClC,OAAO;AACL,YAAQ,MAAM,YAAY,GAAG,CAAC;AAAA,EAChC;AACA,UAAQ,KAAK,eAAe,eAAe,IAAI,WAAW,CAAC;AAC7D;;;ACxHA,OAAOA,YAAW;AAMX,SAAS,UAAU,MAIf;AACT,QAAM,UAAU,KAAK,YAAY,OAAQ,KAAK,YAAY,OAAO,CAAC,KAAK;AACvE,SAAO,UAAU,IAAI,KAAK,IAAI,YAAY,EAAE,MAAM,IAAI,EAAE,CAAC,OAAO;AAClE;AAEA,SAAS,SAAiB;AACxB,SAAOA,OAAM;AAAA,IACX,UAAU;AAAA,MACR,OAAO,CAAC,CAAC,QAAQ,OAAO;AAAA,MACxB,SAAS,QAAQ,IAAI;AAAA,MACrB,KAAK,oBAAI,KAAK;AAAA,IAChB,CAAC;AAAA,EACH;AACF;AAEO,SAAS,QAAQ,SAAuB;AAC7C,UAAQ,MAAM,OAAO,IAAIA,OAAM,KAAK,QAAG,GAAG,OAAO;AACnD;AAEO,SAAS,WAAW,SAAuB;AAChD,UAAQ,MAAM,OAAO,IAAIA,OAAM,MAAM,QAAG,GAAG,OAAO;AACpD;AAEO,SAAS,QAAQ,SAAuB;AAC7C,UAAQ,MAAM,OAAO,IAAIA,OAAM,OAAO,QAAG,GAAG,OAAO;AACrD;AAEO,SAAS,SAAS,SAAuB;AAC9C,UAAQ,MAAM,OAAO,IAAIA,OAAM,IAAI,QAAG,GAAG,OAAO;AAClD;AAGO,SAAS,cAAc,IAAoB;AAChD,QAAM,WAAW,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,GAAI,CAAC;AAClD,QAAM,IAAI,KAAK,MAAM,WAAW,IAAI;AACpC,QAAM,IAAI,KAAK,MAAO,WAAW,OAAQ,EAAE;AAC3C,QAAM,IAAI,WAAW;AACrB,MAAI,IAAI,EAAG,QAAO,GAAG,CAAC,KAAK,CAAC;AAC5B,MAAI,IAAI,EAAG,QAAO,GAAG,CAAC,KAAK,CAAC;AAC5B,SAAO,GAAG,CAAC;AACb;AAQO,SAAS,eACd,OACA,aAAa,MAC4B;AACzC,QAAM,YAAY,KAAK,IAAI;AAC3B,MAAI,eAAe;AACnB,QAAM,QAAQ,YAAY,MAAM;AAC9B,QAAI,KAAK,IAAI,IAAI,eAAe,WAAY;AAC5C,YAAQ,yBAAoB,KAAK,KAAK,cAAc,KAAK,IAAI,IAAI,SAAS,CAAC,WAAW;AAAA,EACxF,GAAG,UAAU;AACb,QAAM,QAAQ;AACd,SAAO;AAAA,IACL,MAAM,MAAM,cAAc,KAAK;AAAA,IAC/B,OAAO,MAAM;AACX,qBAAe,KAAK,IAAI;AAAA,IAC1B;AAAA,EACF;AACF;;;AC/EA,YAAY,QAAQ;AACpB,YAAY,UAAU;AAatB,SAAS,eAAe,UAAkB,WAAmB,QAAQ,IAAI,GAAuB;AAC9F,MAAI,aAAa;AACjB,QAAM,OAAY,WAAM,UAAU,EAAE;AAEpC,SAAO,eAAe,MAAM;AAC1B,UAAM,WAAgB,UAAK,YAAY,QAAQ;AAC/C,QAAO,cAAW,QAAQ,GAAG;AAC3B,aAAO;AAAA,IACT;AACA,iBAAkB,aAAQ,UAAU;AAAA,EACtC;AACA,SAAO;AACT;AAoBO,SAAS,cAAc,UAAgC;AAC5D,MAAI;AACJ,MAAI;AAEJ,QAAM,MAAM,QAAQ,IAAI;AAGxB,MAAO,cAAW,aAAa,GAAG;AAEhC,UAAM,QAAW,eAAY,GAAG,EAAE;AAAA,MAChC,CAAC,MAAM,EAAE,WAAW,SAAS,KAAK,EAAE,SAAS,OAAO,KAAK,MAAM;AAAA,IACjE;AAEA,UAAM,aAAa,MAAM,CAAC;AAC1B,QAAI,YAAY;AACd,YAAM,UAAa,gBAAa,YAAY,OAAO;AAGnD,YAAM,cAAc,QAAQ,MAAM,0CAA0C;AAC5E,UAAI,cAAc,CAAC,GAAG;AACpB,iBAAS,YAAY,CAAC,EAAE,KAAK;AAAA,MAC/B;AAGA,YAAM,aAAa,WAAW,MAAM,oBAAoB;AACxD,UAAI,aAAa,CAAC,GAAG;AACnB,gBAAQ,WAAW,CAAC;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAGA,QAAM,gBAAgB,eAAe,eAAe;AACpD,MAAI;AAEJ,MAAI,eAAe;AACjB,aAAc,aAAQ,aAAa;AAGnC,UAAM,mBAAwB,UAAK,QAAQ,MAAM,WAAW;AAC5D,QAAO,cAAW,gBAAgB,GAAG;AACnC,YAAM,gBAAmB,gBAAa,kBAAkB,OAAO;AAC/D,YAAM,cAAc,cAAc,MAAM,4BAA4B;AACpE,UAAI,aAAa;AACf,iBAAS,YAAY,CAAC;AAAA,MACxB;AAAA,IACF;AAGA,UAAM,eAAoB,UAAK,QAAQ,QAAQ,OAAO;AACtD,QAAO,cAAW,YAAY,GAAG;AAC/B,cAAW,gBAAa,cAAc,OAAO,EAAE,KAAK;AAAA,IACtD;AAAA,EACF;AAGA,MAAI,CAAC,QAAQ;AACX,UAAM,YAAY,IAAI,MAAM,kBAAkB;AAC9C,QAAI,WAAW;AACb,eAAS,UAAU,CAAC;AAAA,IACtB;AAAA,EACF;AAGA,UAAQ,YAAY,QAAQ,IAAI,cAAc,QAAQ,IAAI,aAAa,SAAS;AAChF,WAAS,QAAQ,IAAI,eAAe,UAAU;AAG9C,MAAI,cAAc;AAClB,MAAI,iBAAyC,CAAC;AAC9C,MAAI;AAGJ,QAAM,aAAa,SAAc,UAAK,QAAQ,MAAM,WAAW,IAAI;AACnE,MAAO,cAAW,UAAU,GAAG;AAC7B,UAAM,gBAAmB,gBAAa,YAAY,OAAO;AAGzD,UAAM,WAAW,cAAc,MAAM,+BAA+B;AACpE,QAAI,WAAW,CAAC,GAAG;AACjB,YAAM,UAAU,SAAS,CAAC,EAAE,SAAS,4BAA4B;AACjE,iBAAW,SAAS,SAAS;AAC3B,cAAM,MAAM,MAAM,CAAC;AACnB,cAAM,QAAQ,MAAM,CAAC;AACrB,YAAI,OAAO,OAAO;AAChB,yBAAe,GAAG,IAAI;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAGA,UAAM,eAAe,cAAc,MAAM,wCAAwC;AACjF,QAAI,eAAe,CAAC,GAAG;AACrB,2BAAqB,aAAa,CAAC;AAAA,IACrC;AAAA,EACF;AAIA,QAAM,eAAe,GAAG,MAAM;AAC9B,QAAM,YAAY,MAAM,WAAW,YAAY,IAC3C,MAAM,MAAM,aAAa,MAAM,IAC/B;AAGJ,gBAAc,eAAe,SAAS,KAAK,eAAe,KAAK,KAAK,sBAAsB;AAE1F,UAAQ,UAAU,KAAK,eAAe,WAAW,aAAa,MAAM,EAAE;AAEtE,SAAO,EAAE,QAAQ,OAAO,YAAY;AACtC;;;AC7JA,SAAS,WAAW,2BAA2B;AAqC/C,eAAsB,uBACpB,QACA,aACA,QAC8B;AAC9B,QAAM,MAAM,IAAI,UAAU,SAAS,EAAE,OAAO,IAAI,CAAC,CAAC;AAMlD,MAAI;AAGJ,QAAM,eAAe,kBAAkB,MAAM,IAAI,WAAW;AAC5D,UAAQ,oCAAoC,YAAY,KAAK;AAE7D,MAAI;AACF,UAAM,WAAW,MAAM,IAAI;AAAA,MACzB,IAAI,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAAA,IAChD;AAEA,QAAI,SAAS,WAAW,OAAO;AAC7B,YAAM,WAAW,KAAK,MAAM,SAAS,UAAU,KAAK;AACpD,UAAI,SAAS,iBAAiB;AAC5B,cAAM,OAAO,SAAS;AACtB,mBAAW,kBAAkB,KAAK,UAAU,EAAE;AAE9C,cAAM,eAAe,OAAO,KAAK,KAAK,QAAQ;AAC9C,YAAI,aAAa,SAAS,GAAG;AAC3B,kBAAQ,uBAAuB,aAAa,KAAK,IAAI,CAAC,EAAE;AAAA,QAC1D;AAEA,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AAGZ,mBAAe;AAAA,EACjB;AAGA,QAAM,aAAa,kBAAkB,MAAM,IAAI,WAAW;AAC1D,UAAQ,sBAAsB,UAAU,KAAK;AAE7C,MAAI;AACF,UAAM,WAAW,MAAM,IAAI;AAAA,MACzB,IAAI,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAAA,IAC9C;AAEA,QAAI,CAAC,SAAS,WAAW,OAAO;AAC9B,YAAM,IAAI,MAAM,4BAA4B;AAAA,IAC9C;AAEA,UAAM,OAAO,KAAK,MAAM,SAAS,UAAU,KAAK;AAChD,eAAW,kBAAkB,KAAK,UAAU,EAAE;AAE9C,UAAM,eAAe,OAAO,KAAK,KAAK,QAAQ;AAC9C,QAAI,aAAa,SAAS,GAAG;AAC3B,cAAQ,uBAAuB,aAAa,KAAK,IAAI,CAAC,EAAE;AAAA,IAC1D;AAEA,WAAO;AAAA,EACT,SAAS,aAAa;AAGpB,UAAM,QAAQ,gBAAgB;AAC9B,UAAM,OAAQ,OAA6B,QAAQ;AACnD,UAAM,eAAe,0GAA0G;AAAA,MAC7H;AAAA,IACF;AAEA,QAAI,cAAc;AAChB;AAAA,QACE,4CAA4C,YAAY,sBAAiB,IAAI;AAAA,MAC/E;AACA;AAAA,QACE;AAAA,MACF;AACA;AAAA,QACE;AAAA,MACF;AACA;AAAA,QACE;AAAA,MACF;AACA;AAAA,QACE;AAAA,MACF;AAAA,IACF,OAAO;AACL,eAAS,iCAAiC,YAAY,OAAO,UAAU,EAAE;AACzE,cAAQ,4EAA4E;AAAA,IACtF;AACA,UAAM;AAAA,EACR;AACF;AAQA,eAAsB,eACpB,QACA,aACsB;AACtB,QAAM,OAAO,MAAM,uBAAuB,QAAQ,WAAW;AAE7D,QAAM,aAAa,KAAK,SAAS,KAAK;AACtC,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AAEA,SAAO;AAAA,IACL,YAAY,KAAK;AAAA,IACjB,aAAa,WAAW;AAAA,IACxB,SAAS,WAAW;AAAA,EACtB;AACF;;;AC5JA;AAAA,EACE;AAAA,EACA;AAAA,OACK;AA6BP,eAAsB,eACpB,QACA,OACA,SACiB;AACjB,QAAM,iBAAiB,IAAI,qBAAqB,CAAC,CAAC;AAGlD,QAAM,aAAa,SAAS,MACxB,QAAQ,MAAM,IAAI,KAAK,IAAI,QAAQ,GAAG,oBACtC,QAAQ,MAAM,IAAI,KAAK;AAC3B,UAAQ,6BAA6B,UAAU,KAAK;AAEpD,MAAI;AACF,UAAM,WAAW,MAAM,eAAe;AAAA,MACpC,IAAI,sBAAsB,EAAE,UAAU,WAAW,CAAC;AAAA,IACpD;AAEA,QAAI,SAAS,cAAc;AACzB,YAAM,SAAS,KAAK,MAAM,SAAS,YAAY;AAG/C,UAAI,OAAO,cAAc;AACvB,cAAM,SAAS,IAAI,IAAI,OAAO,YAAY;AAC1C,mBAAW,6BAA6B,OAAO,QAAQ,EAAE;AACzD,eAAO,OAAO;AAAA,MAChB;AAGA,UAAI,OAAO,YAAY,OAAO,UAAU;AACtC,mBAAW,6BAA6B,OAAO,QAAQ,EAAE;AACzD,cAAM,WAAW,OAAO,UAAU,OAAO,YAAY;AACrD,eAAO,gBAAgB,OAAO,QAAQ,IAAI,mBAAmB,OAAO,QAAQ,CAAC,IAAI,OAAO,QAAQ,WAAW,IAAI,OAAO,QAAQ,IAAI,IAAI,QAAQ;AAAA,MAChJ;AAEA,YAAM,IAAI,MAAM,UAAU,UAAU,kEAAkE;AAAA,IACxG;AAAA,EACF,SAAS,OAAO;AACd,QAAK,MAAgB,SAAS,SAAS,mBAAmB,GAAG;AAC3D,YAAM;AAAA,IACR;AAAA,EAEF;AAEA,QAAM,IAAI,MAAM,iCAAiC,UAAU,EAAE;AAC/D;AAKA,eAAsB,iBACpB,QACA,OACA,cACA,SACA,SACA,SAC8B;AAC9B,QAAM,cAAc,MAAM,eAAe,QAAQ,OAAO,OAAO;AAC/D,QAAM,SAAS,IAAI,IAAI,WAAW;AAElC,SAAO;AAAA,IACL,UAAU,OAAO;AAAA,IACjB,UAAU,mBAAmB,OAAO,QAAQ;AAAA,IAC5C,MAAM;AAAA,IACN,MAAM;AAAA,IACN,UAAU,OAAO,SAAS,MAAM,CAAC;AAAA,EACnC;AACF;AAkBO,SAAS,mBACd,KACA,SACQ;AACR,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,GAAG;AAG1B,QAAI,QAAQ,UAAU;AACpB,UAAI,QAAQ,SAAS,SAAS,GAAG,GAAG;AAClC,cAAM,aAAa,QAAQ,SAAS,YAAY,GAAG;AACnD,eAAO,WAAW,QAAQ,SAAS,MAAM,GAAG,UAAU;AACtD,eAAO,OAAO,QAAQ,SAAS,MAAM,aAAa,CAAC;AAAA,MACrD,OAAO;AACL,eAAO,WAAW,QAAQ;AAC1B,eAAO,OAAO,OAAO,QAAQ;AAAA,MAC/B;AAAA,IACF;AAGA,QAAI,QAAQ,SAAS;AACnB,aAAO,aAAa,IAAI,WAAW,QAAQ,OAAO;AAElD,UAAI,QAAQ,YAAY,aAAa,QAAQ,YAAY,aAAa;AACpE,eAAO,aAAa,IAAI,aAAa,sBAAsB;AAAA,MAC7D;AAAA,IACF;AAEA,WAAO,OAAO,SAAS;AAAA,EACzB,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAKO,SAAS,iBACd,OACA,SACQ;AACR,QAAM,OAAO,SAAS,UAAU,MAAM,GAAG,EAAE,CAAC,KAAK,MAAM;AACvD,QAAM,OAAO,SAAS,UAAU,MAAM,GAAG,EAAE,CAAC,KAAK,OAAO,MAAM,IAAI;AAElE,MAAI,MAAM,gBAAgB,MAAM,QAAQ,IAAI,mBAAmB,MAAM,QAAQ,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,MAAM,QAAQ;AAEhH,MAAI,SAAS,SAAS;AACpB,WAAO,YAAY,QAAQ,OAAO;AAClC,QAAI,QAAQ,YAAY,aAAa,QAAQ,YAAY,aAAa;AACpE,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AACT;AAKA,eAAsB,iBAIZ;AACR,QAAMC,MAAK,MAAM,OAAO,IAAI;AAE5B,MAAI,CAACA,IAAG,WAAW,mBAAmB,GAAG;AACvC,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,UAAUA,IAAG,aAAa,qBAAqB,OAAO;AAC5D,UAAM,UAAU,KAAK,MAAM,OAAO;AAElC,QAAI,QAAQ,aAAa;AACvB,cAAQ,wCAAwC;AAGhD,YAAM,iBAAiB,QAAQ,YAAY,MAAM,mBAAmB;AACpE,YAAM,YAAY,iBACd,mBAAmB,eAAe,CAAC,CAAC,IACpC;AAEJ,aAAO;AAAA,QACL,aAAa,QAAQ;AAAA,QACrB,cAAc,QAAQ;AAAA,QACtB;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,SAAO;AACT;;;ACrNA,SAAS,oBAAoB;AAC7B,YAAYC,WAAU;AACtB,YAAYC,SAAQ;AAMb,SAAS,YAAY,UAAiC;AAC3D,MAAI,MAAM;AACV,SAAO,MAAM;AACX,QAAO,eAAgB,WAAK,KAAK,aAAa,CAAC,EAAG,QAAO;AACzD,UAAM,SAAc,cAAQ,GAAG;AAC/B,QAAI,WAAW,IAAK,QAAO;AAC3B,UAAM;AAAA,EACR;AACF;AAMO,SAAS,iBAAiB,SAA2B;AAC1D,SAAU,gBAAY,OAAO,EAC1B,OAAO,CAAC,MAAM,qBAAqB,KAAK,CAAC,KAAK,MAAM,aAAa,EACjE,IAAI,CAAC,MAAM,EAAE,QAAQ,aAAa,EAAE,EAAE,QAAQ,WAAW,EAAE,CAAC;AACjE;AAKO,SAAS,gBAAgB,SAAgC;AAC9D,MAAI;AACF,UAAM,SAAS,aAAa,UAAU,CAAC,SAAS,aAAa,GAAG;AAAA,MAC9D,UAAU;AAAA,MACV,KAAK;AAAA,MACL,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,IAChC,CAAC;AACD,WAAO,OAAO,KAAK,KAAK;AAAA,EAC1B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOO,SAAS,gBAAgB,SAAiB,OAAe,KAA4B;AAC1F,QAAM,aAAkB,WAAK,SAAS,UAAU,KAAK,OAAO;AAC5D,MAAI,CAAI,eAAW,UAAU,EAAG,QAAO;AAEvC,QAAM,UAAa,iBAAa,YAAY,OAAO;AACnD,QAAM,UAAU,IAAI,OAAO,QAAQ,IAAI,QAAQ,uBAAuB,MAAM,CAAC,cAAc,GAAG;AAC9F,QAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,MAAI,CAAC,MAAO,QAAO;AAEnB,SAAO,MAAM,CAAC,EAAG,KAAK,EAAE,QAAQ,gBAAgB,EAAE;AACpD;AAgBO,SAAS,kBACd,SACA,KACA,WACA,KACQ;AACR,QAAM,UAAU,MAAM,EAAE,GAAG,QAAQ,KAAK,GAAG,IAAI,IAAI;AAEnD,MAAI;AACF,UAAM,SAAS;AAAA,MACb;AAAA,MACA,CAAC,SAAS,UAAU,KAAK,UAAU,GAAG,SAAS;AAAA,MAC/C,EAAE,KAAK,SAAS,UAAU,SAAS,OAAO,CAAC,UAAU,QAAQ,MAAM,GAAG,KAAK,QAAQ;AAAA,IACrF;AAEA,QAAI,OAAO,SAAS,YAAY,GAAG;AACjC,aAAO;AAAA,QACL;AAAA,QACA,CAAC,SAAS,UAAU,KAAK,UAAU,kBAAkB,GAAG,SAAS;AAAA,QACjE,EAAE,KAAK,SAAS,UAAU,SAAS,OAAO,CAAC,UAAU,QAAQ,MAAM,GAAG,KAAK,QAAQ;AAAA,MACrF;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAc;AAGrB,UAAM,SAAU,KAA6B,UAAU;AACvD,QAAI,OAAO,SAAS,MAAM,KAAK,OAAO,SAAS,KAAK,KAAK,OAAO,SAAS,iBAAiB,GAAG;AAC3F,YAAM;AAAA,IACR;AACA,WAAO;AAAA,MACL;AAAA,MACA,CAAC,SAAS,UAAU,KAAK,UAAU,kBAAkB,GAAG,SAAS;AAAA,MACjE,EAAE,KAAK,SAAS,UAAU,SAAS,OAAO,CAAC,UAAU,QAAQ,MAAM,GAAG,KAAK,QAAQ;AAAA,IACrF;AAAA,EACF;AACF;;;AC/GA,SAAS,UAAU,gBAAAC,qBAAoB;AACvC,SAAS,cAAAC,mBAAkB;AAC3B,IAAM,kBAAkB;AAAA,EACtB;AAAA,EACA;AACF;AAWA,eAAsB,iBAAmC;AACvD,MAAI;AACF,UAAM,SAAS,MAAM,iBAAiB,CAAC,UAAU,QAAQ,CAAC;AAC1D,UAAM,SAAkC,KAAK,MAAM,MAAM;AACzD,WAAO,OAAO,iBAAiB,aAAa,OAAO,MAAM,WAAW;AAAA,EACtE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOA,IAAM,yBAAyB,CAAC,sCAAsC,qBAAqB;AAiBpF,SAAS,mBACd,SAAS,QACT,MAAM,OACN,WACoB;AACpB,SAAO;AAAA,IACL,WAAW,GAAG,MAAM,IAAI,GAAG;AAAA,IAC3B,KAAK;AAAA,IACL,WAAW;AAAA,IACX,UAAU;AAAA,IACV,GAAG;AAAA,EACL;AACF;AAqBA,SAAS,iBAAiB,MAAiC;AACzD,QAAM,aAAa,uBAAuB,KAAKA,WAAU;AAOzD,QAAM,WAAsB,CAAC;AAC7B,aAAW,UAAU,iBAAiB;AACpC,QAAI,YAAY;AACd,eAAS,KAAK,EAAE,QAAQ,MAAM,CAAC,YAAY,YAAY,GAAG,IAAI,EAAE,CAAC;AAAA,IACnE;AACA,aAAS,KAAK,EAAE,QAAQ,KAAK,CAAC;AAAA,EAChC;AAEA,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,QAAI,QAAQ;AAEZ,aAAS,UAAgB;AACvB,UAAI,SAAS,SAAS,QAAQ;AAC5B,eAAO,IAAI,MAAM,sCAAsC,CAAC;AACxD;AAAA,MACF;AAEA,YAAM,UAAU,SAAS,OAAO;AAChC,eAAS,QAAQ,QAAQ,QAAQ,MAAM,CAAC,OAAO,WAAW;AACxD,YAAI,OAAO;AACT,kBAAQ;AAAA,QACV,OAAO;AACL,kBAAQ,MAAM;AAAA,QAChB;AAAA,MACF,CAAC;AAAA,IACH;AAEA,YAAQ;AAAA,EACV,CAAC;AACH;AAOA,eAAsB,mBAAqE;AACzF,MAAI;AACF,UAAM,SAAS,MAAM,iBAAiB,CAAC,UAAU,QAAQ,CAAC;AAC1D,UAAM,SAAkC,KAAK,MAAM,MAAM;AAEzD,QACE,OAAO,iBAAiB,aACxB,OAAO,MAAM,WAAW,QACxB,OAAO,KAAK,YACZ,OAAO,KAAK,cAAc,QAC1B;AACA,aAAO;AAAA,QACL,UAAU,OAAO,KAAK;AAAA,QACtB,IAAI,OAAO,KAAK,aAAa,CAAC;AAAA,MAChC;AAAA,IACF;AAEA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,cAAc,KAAyB,KAAe,cAAc,OAAiB;AAC5F,SAAO;AAAA,IACL;AAAA,IAAQ,GAAI,cAAc,CAAC,IAAI,IAAI,CAAC;AAAA,IACpC;AAAA,IAAM,IAAI;AAAA,IAAW,IAAI;AAAA,IAAK;AAAA,IAAM,IAAI;AAAA,IAAW;AAAA,IAAM,GAAG;AAAA,EAC9D;AACF;AAQO,SAAS,eAAe,KAAsC;AACnE,MAAI;AACF,UAAM,MAAMD,cAAa,WAAW,cAAc,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,GAAG;AAAA,MAC7E,UAAU;AAAA,MACV,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAClC,CAAC;AACD,UAAM,UAAU,IAAI,KAAK;AACzB,QAAI,CAAC,WAAW,YAAY,KAAM,QAAO,CAAC;AAC1C,QAAI;AACF,aAAO,KAAK,MAAM,OAAO;AAAA,IAC3B,QAAQ;AACN,cAAQ,KAAK,iEAAiE;AAC9E,aAAO,CAAC;AAAA,IACV;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,MAAO,IAAc,WAAW,OAAO,GAAG;AAChD,QAAI,IAAI,SAAS,WAAW,KAAK,IAAI,SAAS,mBAAmB,GAAG;AAClE,YAAM,IAAI;AAAA,QACR,gDAAgD,IAAI,SAAS,SAAS,IAAI,GAAG;AAAA;AAAA,wBAEpD,IAAI,SAAS;AAAA,MACxC;AAAA,IACF;AACA,QAAI,IAAI,SAAS,cAAc,GAAG;AAChC,aAAO,CAAC;AAAA,IACV;AAEA,UAAM;AAAA,EACR;AACF;AAQO,SAAS,mBAAmB,KAAyB,SAA4B;AACtF,QAAM,OAAO,KAAK,UAAU,OAAO;AACnC,MAAI;AACF,IAAAA;AAAA,MACE;AAAA,MACA,cAAc,KAAK,CAAC,MAAM,MAAM,UAAU,IAAI,QAAQ,GAAG,GAAG,IAAI;AAAA,MAChE,EAAE,OAAO,MAAM,OAAO,CAAC,QAAQ,QAAQ,MAAM,EAAE;AAAA,IACjD;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,MAAO,IAAc,WAAW,OAAO,GAAG;AAChD,UAAM,IAAI;AAAA,MACR,uDAAuD,IAAI,SAAS,SAAS,IAAI,GAAG;AAAA,EACjF,IAAI,SAAS,WAAW,IAAI,oBAAoB,EAAE,+CACN,IAAI,SAAS;AAAA,IAC9D;AAAA,EACF;AACF;AAMO,SAAS,qBAAqB,KAAyB,QAAsB;AAClF,MAAI;AACF,UAAM,UAAU,eAAe,GAAG;AAClC,UAAM,WAAW,QAAQ,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,SAAS,MAAM,CAAC;AAC/D,uBAAmB,KAAK,QAAQ;AAAA,EAClC,QAAQ;AAAA,EAER;AACF;",
+  "names": ["chalk", "fs", "path", "fs", "execFileSync", "existsSync"]
+}

package/dist/src/program.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The `mesh` command tree, as data.
+ *
+ * `bin/mesh.ts` used to build the commander program inline and immediately
+ * parse it, which meant the tree only existed inside a running CLI process.
+ * The docs generator needs to *walk* the tree without executing anything, so
+ * construction lives here and the bin is a thin runner.
+ *
+ * Nothing in this module may perform I/O or read credentials at import time —
+ * `mesh docs cli-reference` imports it in a plain node process with no AWS
+ * config, no Docker, and no TTY.
+ */
+import { Command } from "commander";
+export declare const CLI_NAME = "mesh";
+export declare const CLI_DESCRIPTION = "CLI for Mesh Lab development utilities";
+/**
+ * Build a fresh `mesh` program.
+ *
+ * @param options.version version string for `--version`. Resolving the real
+ *   one costs git spawns, so callers that don't need it (the docs generator)
+ *   pass nothing and get a placeholder that never reaches generated output.
+ */
+export declare function createProgram(options?: {
+    version?: string;
+}): Command;
+//# sourceMappingURL=program.d.ts.map

package/dist/src/program.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"program.d.ts","sourceRoot":"","sources":["../../src/program.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0BpC,eAAO,MAAM,QAAQ,SAAS,CAAC;AAC/B,eAAO,MAAM,eAAe,2CAA2C,CAAC;AAExE;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CA+BzE"}

package/dist/src/program.js

@@ -0,0 +1,76 @@
+/**
+ * The `mesh` command tree, as data.
+ *
+ * `bin/mesh.ts` used to build the commander program inline and immediately
+ * parse it, which meant the tree only existed inside a running CLI process.
+ * The docs generator needs to *walk* the tree without executing anything, so
+ * construction lives here and the bin is a thin runner.
+ *
+ * Nothing in this module may perform I/O or read credentials at import time —
+ * `mesh docs cli-reference` imports it in a plain node process with no AWS
+ * config, no Docker, and no TTY.
+ */
+import { Command } from "commander";
+import { registerArtifactsCommands } from "./commands/artifacts.js";
+import { registerClusterCommands } from "./commands/cluster.js";
+import { registerConversationsCommands } from "./commands/conversations.js";
+import { registerCreateAppCommand } from "./commands/create-app.js";
+import { registerDbCommands } from "./commands/db/index.js";
+import { registerDeployCommand } from "./commands/deploy.js";
+import { registerDevCommand } from "./commands/dev.js";
+import { registerDocsCommand } from "./commands/docs.js";
+import { registerHubCommands } from "./commands/hub/index.js";
+import { registerInitCommands } from "./commands/init.js";
+import { registerInstallShimCommand } from "./commands/install-shim.js";
+import { registerLocalCommands } from "./commands/local/index.js";
+import { registerLoginCommand } from "./commands/login.js";
+import { registerRegistryCommands } from "./commands/registry.js";
+import { registerSecretsCommands } from "./commands/secrets/index.js";
+import { registerSkillsCommands } from "./commands/skills.js";
+import { registerStackCommand } from "./commands/stack.js";
+import { registerTemporalCommands } from "./commands/temporal.js";
+import { registerTenantCommands } from "./commands/tenant.js";
+import { registerTunnelCommands } from "./commands/tunnel/index.js";
+import { registerVcsCommands } from "./commands/vcs/index.js";
+import { registerVpnCommands } from "./commands/vpn/index.js";
+import { registerWorkflowCommands } from "./commands/workflow.js";
+export const CLI_NAME = "mesh";
+export const CLI_DESCRIPTION = "CLI for Mesh Lab development utilities";
+/**
+ * Build a fresh `mesh` program.
+ *
+ * @param options.version version string for `--version`. Resolving the real
+ *   one costs git spawns, so callers that don't need it (the docs generator)
+ *   pass nothing and get a placeholder that never reaches generated output.
+ */
+export function createProgram(options = {}) {
+    const program = new Command();
+    program.name(CLI_NAME).description(CLI_DESCRIPTION);
+    if (options.version !== undefined)
+        program.version(options.version);
+    registerLoginCommand(program);
+    registerRegistryCommands(program);
+    registerDbCommands(program);
+    registerDeployCommand(program);
+    registerDevCommand(program);
+    registerCreateAppCommand(program);
+    registerDocsCommand(program);
+    registerStackCommand(program);
+    registerTunnelCommands(program);
+    registerSecretsCommands(program);
+    registerArtifactsCommands(program);
+    registerConversationsCommands(program);
+    registerVpnCommands(program);
+    registerWorkflowCommands(program);
+    registerTemporalCommands(program);
+    registerClusterCommands(program);
+    registerVcsCommands(program);
+    registerLocalCommands(program);
+    registerHubCommands(program);
+    registerSkillsCommands(program);
+    registerInitCommands(program);
+    registerTenantCommands(program);
+    registerInstallShimCommand(program);
+    return program;
+}
+//# sourceMappingURL=program.js.map

package/dist/src/program.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"program.js","sourceRoot":"","sources":["../../src/program.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAElE,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC;AAC/B,MAAM,CAAC,MAAM,eAAe,GAAG,wCAAwC,CAAC;AAExE;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,UAAgC,EAAE;IAC9D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAE9B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpE,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5B,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5B,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7B,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACnC,6BAA6B,CAAC,OAAO,CAAC,CAAC;IACvC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7B,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClC,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7B,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7B,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAEpC,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/src/utils/auth-preflight.d.ts

@@ -0,0 +1,159 @@
+/**
+ * First-run auth preflight helpers (MESH-2479).
+ *
+ * `mesh start`/`mesh dev` do long work (registry tarball fetches, docker
+ * builds, pnpm installs) that fails minutes in — with npm's generic advice —
+ * when the CodeArtifact token or AWS SSO session is stale. These helpers
+ * verify auth BEFORE the long work and name the exact fixing command.
+ *
+ * Pure parsers/classifiers are exported separately from the impure probes so
+ * the branch logic is unit-testable without network or a home directory.
+ */
+/**
+ * The context that owns the `@mesh-tech` registry. There is exactly one — the
+ * `mesh-platform` CodeArtifact domain every tenant pulls from — so this is the
+ * context whose broker can mint a read token for anybody, and it is what a
+ * printed remediation should name.
+ *
+ * Safe to hardcode for the same reason `--profile mesh-dev` already was: it
+ * identifies the registry, not the reader's own platform. It also resolves on a
+ * machine with no AWS at all, via the pinned first-party alias.
+ */
+export declare const REGISTRY_CONTEXT = "mesh.dev";
+/**
+ * The command that fixes a stale/missing CodeArtifact token — **broker-first**,
+ * so it works for someone with no AWS account at all.
+ *
+ * Prefer `registryLoginFix(context)` at any call site that knows a better
+ * context than the registry's own.
+ */
+export declare const REGISTRY_LOGIN_FIX = "mesh registry login mesh.dev";
+/**
+ * The AWS-profile form. Only correct for people who **deploy**, or when the
+ * platform publishes no registry broker.
+ *
+ * Kept as a separate named constant rather than the default: `--profile`
+ * deliberately skips the broker, so printing it as the generic fix sends a
+ * developer with no AWS account to a command that cannot work for them.
+ */
+export declare const REGISTRY_LOGIN_FIX_AWS = "mesh registry login --profile mesh-dev";
+/**
+ * Render the registry fix for a known context, falling back to the registry's
+ * own context when the caller has none. Always returns a command that can be
+ * run as printed — a remediation the reader has to edit first is half a
+ * remediation.
+ */
+export declare function registryLoginFix(context?: string): string;
+/** The documented AWS SSO login form (root package.json `sso` script). */
+export declare const SSO_LOGIN_FIX = "aws sso login --sso-session=mesh   # or: pnpm sso";
+/**
+ * The `aws configure sso-session` snippet `pnpm sso` depends on. Printed
+ * verbatim when ~/.aws/config has no [sso-session mesh] section — kept here
+ * so the CLI and scripts/sso-login.sh describe the same setup.
+ */
+export declare const SSO_SESSION_SNIPPET = "[sso-session mesh]\nsso_start_url = https://trabian.awsapps.com/start\nsso_region = us-east-1\nsso_registration_scopes = sso:account:access";
+/**
+ * The user-level npmrc `aws codeartifact login` writes into — the token line
+ * and, when the namespace flag is omitted, the unscoped `registry=` line.
+ *
+ * One definition for the whole CLI: the doctor, the probe, and the repair have
+ * to be looking at the same file or they disagree about the same machine.
+ * `os.homedir()` reads `$HOME` on POSIX, so a scratch-`HOME` test still works.
+ */
+export declare function homeNpmrcPath(): string;
+export interface NpmrcRegistryAuth {
+    /** Registry base URL, e.g. https://mesh-platform-…codeartifact…/npm/mesh-packages/ */
+    endpoint: string;
+    token: string;
+}
+/**
+ * Extract the CodeArtifact registry endpoint + auth token from npmrc content.
+ * `aws codeartifact login` writes a line shaped like:
+ *   //mesh-platform-…d.codeartifact.<region>.amazonaws.com/npm/<repo>/:_authToken=<tok>
+ * Returns null when no CodeArtifact token line is present.
+ */
+export declare function parseNpmrcRegistryAuth(content: string): NpmrcRegistryAuth | null;
+/**
+ * Find an **unscoped** `registry=` line in npmrc content that points at
+ * CodeArtifact — the line `aws codeartifact login` writes when it is run
+ * WITHOUT `--namespace @mesh-tech`.
+ *
+ * That line makes CodeArtifact the *default* registry, so every public package
+ * (lodash, react, …) is fetched through it with the CodeArtifact token. When
+ * the token expires 12 hours later, `npm install` of anything at all fails
+ * with E401 — the private-scope breakage everyone expects, plus a total public
+ * npm outage nobody does.
+ *
+ * Deliberately narrow — it must only match a line that is BOTH unscoped AND a
+ * CodeArtifact host, so it never touches:
+ *   - `@mesh-tech:registry=…`      (scoped: the line we WANT)
+ *   - `//…:_authToken=…`           (auth, unaffected by the default registry)
+ *   - `registry=https://npm.acme.internal/`  (a team's legitimate private mirror)
+ *
+ * Returns the offending line verbatim (as it appears in the file), or null.
+ */
+export declare function findUnscopedCodeArtifactRegistry(content: string): string | null;
+/**
+ * Remove every unscoped CodeArtifact `registry=` line from npmrc content.
+ * Pure: returns the rewritten content plus the first line removed (null when
+ * the content was already clean, in which case `content` is returned
+ * unchanged and callers should skip the write entirely).
+ */
+export declare function stripUnscopedCodeArtifactRegistry(content: string): {
+    content: string;
+    removed: string | null;
+};
+/**
+ * The `//host/path/:_authToken=` key `aws codeartifact login` writes for a
+ * registry endpoint — the endpoint with its scheme stripped and a leading `//`.
+ *
+ * Pure and shared so the broker path writes byte-identical lines to the AWS CLI
+ * path. Two spellings of the same key would leave a stale token line behind
+ * that npm might prefer, and the symptom (E401 hours later) points nowhere
+ * near the cause.
+ */
+export declare function npmrcAuthKeyForEndpoint(endpoint: string): string;
+/**
+ * Upsert `key=value` lines into npmrc content: replace the existing line for a
+ * key when present, append it otherwise, and leave every other line untouched.
+ *
+ * Pure. Always emits a trailing newline, and never reorders lines a
+ * user put there themselves — an npmrc is a config file people hand-edit, and
+ * a token refresh that rewrites the whole thing is how unrelated settings
+ * silently disappear.
+ */
+export declare function upsertNpmrcLines(content: string, entries: ReadonlyArray<{
+    key: string;
+    value: string;
+}>): string;
+export type RegistryTokenState = "fresh" | "expired" | "missing" | "unreachable";
+/** Map an HTTP status from an authenticated registry request to a token state. */
+export declare function classifyRegistryStatus(status: number): "fresh" | "expired";
+export interface RegistryProbe {
+    state: RegistryTokenState;
+    detail?: string;
+}
+/**
+ * Verify the CodeArtifact token in ~/.npmrc actually works, with one small
+ * authenticated metadata request (bounded by `timeoutMs`). Never throws.
+ */
+export declare function probeRegistryToken(opts?: {
+    npmrcPath?: string;
+    timeoutMs?: number;
+    fetchFn?: typeof fetch;
+}): Promise<RegistryProbe>;
+/** True when npm output/an error message is an auth failure (E401/E403). */
+export declare function isNpmAuthErrorText(text: string): boolean;
+/** True when an npm exec error (with stderr/message) is an auth failure. */
+export declare function isNpmAuthError(err: unknown): boolean;
+/** True when an AWS SDK/CLI error message means the ambient session expired. */
+export declare function isExpiredAwsTokenMessage(message: string): boolean;
+/** Names of `[sso-session <name>]` sections in an AWS config file. */
+export declare function parseSsoSessionNames(content: string): string[];
+/** True when the AWS config file declares the named profile. */
+export declare function awsConfigHasProfile(content: string, profile: string): boolean;
+/** Read ~/.aws/config (honoring AWS_CONFIG_FILE); "" when unreadable. */
+export declare function readAwsConfig(): string;
+/** True when the app's package.json depends on any @mesh-tech/* package. */
+export declare function appUsesMeshPackages(appRoot: string): boolean;
+//# sourceMappingURL=auth-preflight.d.ts.map

package/dist/src/utils/auth-preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-preflight.d.ts","sourceRoot":"","sources":["../../../src/utils/auth-preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,aAAa,CAAC;AAE3C;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,iCAA4C,CAAC;AAE5E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,2CAA2C,CAAC;AAE/E;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,0EAA0E;AAC1E,eAAO,MAAM,aAAa,sDAAsD,CAAC;AAEjF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,gJAGa,CAAC;AAM9C;;;;;;;GAOG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,MAAM,WAAW,iBAAiB;IAChC,sFAAsF;IACtF,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAShF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW/E;AAaD;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,MAAM,GAAG;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,CASA;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GACrD,MAAM,CAkBR;AAMD,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;AAEjF,kFAAkF;AAClF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAI1E;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,CAAC,EAAE;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB,GAAG,OAAO,CAAC,aAAa,CAAC,CA6BzB;AAMD,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIxD;AAED,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAMpD;AAED,gFAAgF;AAChF,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAIjE;AAMD,sEAAsE;AACtE,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAO9D;AAED,gEAAgE;AAChE,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAK7E;AAED,yEAAyE;AACzE,wBAAgB,aAAa,IAAI,MAAM,CAOtC;AAMD,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAa5D"}