@mesh-tech/mesh-cli 0.1.1 → 0.12.1

package/dist/src/utils/socks-forward.d.ts

@@ -0,0 +1,40 @@
+/**
+ * A minimal SOCKS5 CONNECT forwarder: listens on a local TCP port and pipes
+ * each client connection through a SOCKS5 proxy (no-auth) to a fixed target.
+ *
+ * Presents the same plain `localhost:PORT` contract the SSM tunnels give today,
+ * so an app (e.g. a Temporal gRPC client) connects with no proxy awareness —
+ * the SOCKS5 proxy is the userspace-Tailscale daemon (MESH-2040 / MESH-2036).
+ */
+import * as net from "node:net";
+/** `"10.0.137.203"` → `[10,0,137,203]`; throws on anything that isn't IPv4. */
+export declare function ipv4ToBytes(ip: string): number[];
+/** SOCKS5 CONNECT request for an IPv4 target (VER, CMD=CONNECT, RSV, ATYP=IPv4, addr, port). */
+export declare function socks5ConnectRequest(ip: string, port: number): Buffer;
+/** Interpret the SOCKS5 reply code (byte 1 of the CONNECT reply). */
+export declare function interpretSocksReply(code: number): {
+    ok: boolean;
+    message: string;
+};
+export interface ForwarderOptions {
+    /** Local TCP port to listen on (0 = ephemeral, useful in tests). */
+    listenPort: number;
+    socksHost?: string;
+    socksPort: number;
+    targetIp: string;
+    targetPort: number;
+    /**
+     * Observes server errors — above all a bind failure (`EADDRINUSE`). The
+     * forwarder still never crashes the process, but the error must not be
+     * INVISIBLE: an unbound forwarder whose port is held by a foreign process is
+     * the silent-dead-tunnel class (MESH-2407), so callers record it and the
+     * ownership handshake reports the port as not-listening.
+     */
+    onError?: (err: NodeJS.ErrnoException) => void;
+}
+/**
+ * Create (and start) a forwarder server. Each inbound client is spliced to
+ * `targetIp:targetPort` via a SOCKS5 CONNECT through `socksHost:socksPort`.
+ */
+export declare function createForwarder(opts: ForwarderOptions): net.Server;
+//# sourceMappingURL=socks-forward.d.ts.map

package/dist/src/utils/socks-forward.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"socks-forward.d.ts","sourceRoot":"","sources":["../../../src/utils/socks-forward.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAEhC,+EAA+E;AAC/E,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAUhD;AAED,gGAAgG;AAChG,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAErE;AAcD,qEAAqE;AACrE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAElF;AAED,MAAM,WAAW,gBAAgB;IAC/B,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC;CAChD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG,GAAG,CAAC,MAAM,CA8ClE"}

package/dist/src/utils/socks-forward.js

@@ -0,0 +1,97 @@
+/**
+ * A minimal SOCKS5 CONNECT forwarder: listens on a local TCP port and pipes
+ * each client connection through a SOCKS5 proxy (no-auth) to a fixed target.
+ *
+ * Presents the same plain `localhost:PORT` contract the SSM tunnels give today,
+ * so an app (e.g. a Temporal gRPC client) connects with no proxy awareness —
+ * the SOCKS5 proxy is the userspace-Tailscale daemon (MESH-2040 / MESH-2036).
+ */
+import * as net from "node:net";
+/** `"10.0.137.203"` → `[10,0,137,203]`; throws on anything that isn't IPv4. */
+export function ipv4ToBytes(ip) {
+    const parts = ip.split(".");
+    if (parts.length !== 4)
+        throw new Error(`not an IPv4 address: ${ip}`);
+    return parts.map((p) => {
+        const n = Number(p);
+        if (!Number.isInteger(n) || n < 0 || n > 255 || !/^\d+$/.test(p)) {
+            throw new Error(`not an IPv4 address: ${ip}`);
+        }
+        return n;
+    });
+}
+/** SOCKS5 CONNECT request for an IPv4 target (VER, CMD=CONNECT, RSV, ATYP=IPv4, addr, port). */
+export function socks5ConnectRequest(ip, port) {
+    return Buffer.from([0x05, 0x01, 0x00, 0x01, ...ipv4ToBytes(ip), (port >> 8) & 0xff, port & 0xff]);
+}
+const SOCKS_REPLY_MESSAGES = {
+    0: "succeeded",
+    1: "general SOCKS server failure",
+    2: "connection not allowed by ruleset",
+    3: "network unreachable",
+    4: "host unreachable",
+    5: "connection refused",
+    6: "TTL expired",
+    7: "command not supported",
+    8: "address type not supported",
+};
+/** Interpret the SOCKS5 reply code (byte 1 of the CONNECT reply). */
+export function interpretSocksReply(code) {
+    return { ok: code === 0, message: SOCKS_REPLY_MESSAGES[code] ?? `unknown SOCKS reply ${code}` };
+}
+/**
+ * Create (and start) a forwarder server. Each inbound client is spliced to
+ * `targetIp:targetPort` via a SOCKS5 CONNECT through `socksHost:socksPort`.
+ */
+export function createForwarder(opts) {
+    const socksHost = opts.socksHost ?? "127.0.0.1";
+    const server = net.createServer((client) => {
+        const up = net.connect(opts.socksPort, socksHost);
+        let buf = Buffer.alloc(0);
+        let phase = 0; // 0=await method-select, 1=await connect reply, 2=streaming
+        up.on("connect", () => up.write(Buffer.from([0x05, 0x01, 0x00]))); // greet, no-auth
+        up.on("data", (d) => {
+            if (phase === 2)
+                return;
+            buf = Buffer.concat([buf, d]);
+            if (phase === 0) {
+                if (buf.length < 2)
+                    return;
+                buf = buf.subarray(2);
+                phase = 1;
+                up.write(socks5ConnectRequest(opts.targetIp, opts.targetPort));
+            }
+            if (phase === 1) {
+                if (buf.length < 10)
+                    return;
+                const reply = interpretSocksReply(buf[1]);
+                const leftover = buf.subarray(10);
+                phase = 2;
+                if (!reply.ok) {
+                    up.destroy();
+                    client.destroy();
+                    return;
+                }
+                if (leftover.length)
+                    client.write(leftover);
+                client.pipe(up);
+                up.pipe(client);
+            }
+        });
+        client.on("error", () => up.destroy());
+        up.on("error", () => client.destroy());
+        // A cleanly-closed client (clean FIN, no "error") must still tear down the
+        // upstream SOCKS→target leg — otherwise a probe that connects then closes
+        // strands a real VPC-target connection until the target times out.
+        client.on("close", () => up.destroy());
+        up.on("close", () => client.destroy());
+    });
+    // A bind failure (e.g. the port is already held by an SSM tunnel) must not
+    // crash the process running this forwarder — but it must be OBSERVED, not
+    // swallowed: the runner records it and ownership checks fail the port.
+    // Attach before listen() so the error is caught.
+    server.on("error", (err) => opts.onError?.(err));
+    server.listen(opts.listenPort, "127.0.0.1");
+    return server;
+}
+//# sourceMappingURL=socks-forward.js.map

package/dist/src/utils/socks-forward.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"socks-forward.js","sourceRoot":"","sources":["../../../src/utils/socks-forward.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAEhC,+EAA+E;AAC/E,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;IACtE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACrB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,oBAAoB,CAAC,EAAU,EAAE,IAAY;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,oBAAoB,GAA2B;IACnD,CAAC,EAAE,WAAW;IACd,CAAC,EAAE,8BAA8B;IACjC,CAAC,EAAE,mCAAmC;IACtC,CAAC,EAAE,qBAAqB;IACxB,CAAC,EAAE,kBAAkB;IACrB,CAAC,EAAE,oBAAoB;IACvB,CAAC,EAAE,aAAa;IAChB,CAAC,EAAE,uBAAuB;IAC1B,CAAC,EAAE,4BAA4B;CAChC,CAAC;AAEF,qEAAqE;AACrE,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,KAAK,CAAC,EAAE,OAAO,EAAE,oBAAoB,CAAC,IAAI,CAAC,IAAI,uBAAuB,IAAI,EAAE,EAAE,CAAC;AAClG,CAAC;AAmBD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAsB;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,WAAW,CAAC;IAChD,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE;QACzC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,4DAA4D;QAC3E,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB;QACpF,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;YAClB,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO;YACxB,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAChB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO;gBAC3B,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACtB,KAAK,GAAG,CAAC,CAAC;gBACV,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAChB,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE;oBAAE,OAAO;gBAC5B,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;gBAC3C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAClC,KAAK,GAAG,CAAC,CAAC;gBACV,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;oBACd,EAAE,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,OAAO;gBACT,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM;oBAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC5C,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAChB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACvC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACvC,2EAA2E;QAC3E,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACvC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IACH,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,iDAAiD;IACjD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/utils/stack-flag.d.ts

@@ -0,0 +1,23 @@
+export interface StackSelector {
+    /** Canonical Pulumi stack name. */
+    stack?: string;
+    /** @deprecated SST-era alias for {@link StackSelector.stack}; still accepted. */
+    stage?: string;
+}
+/**
+ * Resolve the stack selector, preferring the canonical `--stack` over the
+ * deprecated `--stage` alias. Pure: reports whether the deprecated alias supplied
+ * the value so the caller can warn. `--stack` wins when both are present.
+ */
+export declare function resolveStackSelector(opts: StackSelector): {
+    stack: string | undefined;
+    usedDeprecatedStage: boolean;
+};
+/** Test-only: reset the once-per-process deprecation-warning latch. */
+export declare function resetStackFlagWarning(): void;
+/**
+ * Resolve `--stack`/`--stage` to the effective stack for use at a consumption
+ * site, warning ONCE per process when the deprecated `--stage` alias supplied it.
+ */
+export declare function resolveStackOption(opts: StackSelector): string | undefined;
+//# sourceMappingURL=stack-flag.d.ts.map

package/dist/src/utils/stack-flag.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stack-flag.d.ts","sourceRoot":"","sources":["../../../src/utils/stack-flag.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,aAAa;IAC5B,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,aAAa,GAAG;IACzD,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;CAC9B,CAIA;AAID,uEAAuE;AACvE,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS,CAS1E"}

package/dist/src/utils/stack-flag.js

@@ -0,0 +1,41 @@
+/**
+ * Stack-selection flag resolution (MESH-2154).
+ *
+ * `mesh` subcommands historically disagreed on the stack-selection flag:
+ * `deploy`/`cluster` use `--stack` (Pulumi-native), while `dev`/`secrets` used
+ * `--stage` (the SST-era term the platform has moved off). So `mesh kubectl
+ * --stage dev` and `mesh dev --stack …` each errored on muscle memory. We
+ * consolidate on `--stack` everywhere and keep `--stage` as a HIDDEN, deprecated
+ * alias that still works but warns — removable after a transition window.
+ */
+import { logWarn } from './log.js';
+/**
+ * Resolve the stack selector, preferring the canonical `--stack` over the
+ * deprecated `--stage` alias. Pure: reports whether the deprecated alias supplied
+ * the value so the caller can warn. `--stack` wins when both are present.
+ */
+export function resolveStackSelector(opts) {
+    if (opts.stack != null)
+        return { stack: opts.stack, usedDeprecatedStage: false };
+    if (opts.stage != null)
+        return { stack: opts.stage, usedDeprecatedStage: true };
+    return { stack: undefined, usedDeprecatedStage: false };
+}
+let warnedOnce = false;
+/** Test-only: reset the once-per-process deprecation-warning latch. */
+export function resetStackFlagWarning() {
+    warnedOnce = false;
+}
+/**
+ * Resolve `--stack`/`--stage` to the effective stack for use at a consumption
+ * site, warning ONCE per process when the deprecated `--stage` alias supplied it.
+ */
+export function resolveStackOption(opts) {
+    const { stack, usedDeprecatedStage } = resolveStackSelector(opts);
+    if (usedDeprecatedStage && !warnedOnce) {
+        warnedOnce = true;
+        logWarn('--stage is deprecated; use --stack (the Pulumi-native name). --stage still works for now.');
+    }
+    return stack;
+}
+//# sourceMappingURL=stack-flag.js.map

package/dist/src/utils/stack-flag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stack-flag.js","sourceRoot":"","sources":["../../../src/utils/stack-flag.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AASnC;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAmB;IAItD,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC;IACjF,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC;IAChF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC;AAC1D,CAAC;AAED,IAAI,UAAU,GAAG,KAAK,CAAC;AAEvB,uEAAuE;AACvE,MAAM,UAAU,qBAAqB;IACnC,UAAU,GAAG,KAAK,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAmB;IACpD,MAAM,EAAE,KAAK,EAAE,mBAAmB,EAAE,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAClE,IAAI,mBAAmB,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,UAAU,GAAG,IAAI,CAAC;QAClB,OAAO,CACL,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/src/utils/tailscale-targets.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Resolve a tenant's VPC tunnel targets from the platform bastion's service
+ * map — the same source `startSsmTunnels` reads — mapping bastion service keys
+ * to the app's tunnel names, resolving each ELB/RDS hostname to its private IP,
+ * and assigning collision-free localhost ports via the SSM port convention.
+ * (MESH-2040 / Slice 1 of MESH-2014.)
+ */
+/** Local-port block width per tenant — wider than the canonical port span so
+ * two tenants' port blocks never overlap. */
+export declare const PORT_BLOCK = 3000;
+/**
+ * Deterministic per-tenant index for local-port offsetting. Reads a machine-global
+ * registry (`~/.config/mesh/tailscale/port-registry.json`), seeded `{ mesh: 0 }` so
+ * the hub's canonical ports are grandfathered regardless of registration order.
+ * Assigns the next index to an unseen tenant and persists it. `registryPath` is
+ * injectable for tests.
+ */
+export declare function tenantPortIndex(tenant: string, registryPath?: string): number;
+export interface TunnelTarget {
+    /** App-facing tunnel name (e.g. "temporal"). */
+    name: string;
+    /** Local port the forwarder listens on (SSM convention: base + remotePort). */
+    localPort: number;
+    /** VPC hostname (internal ELB / RDS endpoint). */
+    targetHost: string;
+    /** Resolved private IP of `targetHost`. */
+    targetIp: string;
+    /** Port on the VPC service. */
+    remotePort: number;
+}
+/**
+ * Bastion service key → app tunnel name. Mirrors `tunnelToBastionKey` in dev.ts
+ * (inverted): the bastion exposes `temporal-frontend`; the app calls it `temporal`.
+ */
+export declare const TUNNEL_NAME_BY_BASTION_KEY: Record<string, string>;
+/**
+ * Build the tunnel target set. `resolveIp` is injected for testability (the
+ * command passes `resolveElbIp`). Services not in the name map are skipped;
+ * services whose host can't be resolved are skipped (the forwarder needs an IP).
+ */
+export declare function resolveTunnelTargets(services: Record<string, {
+    host: string;
+    port: number;
+}>, resolveIp: (host: string) => string | null, portOffset?: number): TunnelTarget[];
+/**
+ * Resolve an AWS-internal ELB/RDS hostname to its private IP via a public
+ * resolver — these names publish their private (10.x) address to public DNS
+ * but the host's default resolver may not answer for them. Returns null on
+ * failure (caller skips that tunnel).
+ */
+export declare function resolveElbIp(host: string): string | null;
+//# sourceMappingURL=tailscale-targets.d.ts.map

package/dist/src/utils/tailscale-targets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tailscale-targets.d.ts","sourceRoot":"","sources":["../../../src/utils/tailscale-targets.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH;6CAC6C;AAC7C,eAAO,MAAM,UAAU,OAAO,CAAC;AAE/B;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAc7E;AAED,MAAM,WAAW,YAAY;IAC3B,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,+BAA+B;IAC/B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAI7D,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EACxD,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,EAC1C,UAAU,SAAI,GACb,YAAY,EAAE,CAiBhB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAexD"}

package/dist/src/utils/tailscale-targets.js

@@ -0,0 +1,93 @@
+/**
+ * Resolve a tenant's VPC tunnel targets from the platform bastion's service
+ * map — the same source `startSsmTunnels` reads — mapping bastion service keys
+ * to the app's tunnel names, resolving each ELB/RDS hostname to its private IP,
+ * and assigning collision-free localhost ports via the SSM port convention.
+ * (MESH-2040 / Slice 1 of MESH-2014.)
+ */
+import { execFileSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { reserveSsmLocalPortCandidate, preferredSsmLocalPort } from "../commands/dev.js";
+import { CONFIG_DIR, atomicWriteFileSync } from "../commands/login.js";
+/** Local-port block width per tenant — wider than the canonical port span so
+ * two tenants' port blocks never overlap. */
+export const PORT_BLOCK = 3000;
+/**
+ * Deterministic per-tenant index for local-port offsetting. Reads a machine-global
+ * registry (`~/.config/mesh/tailscale/port-registry.json`), seeded `{ mesh: 0 }` so
+ * the hub's canonical ports are grandfathered regardless of registration order.
+ * Assigns the next index to an unseen tenant and persists it. `registryPath` is
+ * injectable for tests.
+ */
+export function tenantPortIndex(tenant, registryPath) {
+    const p = registryPath ?? path.join(CONFIG_DIR, "tailscale", "port-registry.json");
+    let reg;
+    try {
+        reg = JSON.parse(fs.readFileSync(p, "utf8"));
+    }
+    catch {
+        reg = { mesh: 0 };
+    }
+    if (tenant in reg)
+        return reg[tenant];
+    const idx = Math.max(-1, ...Object.values(reg)) + 1;
+    reg[tenant] = idx;
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    atomicWriteFileSync(p, JSON.stringify(reg, null, 2), 0o600);
+    return idx;
+}
+/**
+ * Bastion service key → app tunnel name. Mirrors `tunnelToBastionKey` in dev.ts
+ * (inverted): the bastion exposes `temporal-frontend`; the app calls it `temporal`.
+ */
+export const TUNNEL_NAME_BY_BASTION_KEY = {
+    "temporal-frontend": "temporal",
+    "temporal-ui": "temporal-ui",
+    rds: "rds",
+};
+/**
+ * Build the tunnel target set. `resolveIp` is injected for testability (the
+ * command passes `resolveElbIp`). Services not in the name map are skipped;
+ * services whose host can't be resolved are skipped (the forwarder needs an IP).
+ */
+export function resolveTunnelTargets(services, resolveIp, portOffset = 0) {
+    const reserved = new Set();
+    const targets = [];
+    for (const [key, svc] of Object.entries(services)) {
+        const name = TUNNEL_NAME_BY_BASTION_KEY[key];
+        if (!name)
+            continue;
+        const targetIp = resolveIp(svc.host);
+        if (!targetIp)
+            continue;
+        // Per-tenant offset keeps concurrent platform tenants off each other's ports.
+        const localPort = reserveSsmLocalPortCandidate(svc.port, reserved, preferredSsmLocalPort(svc.port) + portOffset);
+        targets.push({ name, localPort, targetHost: svc.host, targetIp, remotePort: svc.port });
+    }
+    return targets;
+}
+/**
+ * Resolve an AWS-internal ELB/RDS hostname to its private IP via a public
+ * resolver — these names publish their private (10.x) address to public DNS
+ * but the host's default resolver may not answer for them. Returns null on
+ * failure (caller skips that tunnel).
+ */
+export function resolveElbIp(host) {
+    try {
+        const out = execFileSync("dig", ["+short", host, "@1.1.1.1"], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        const ip = out
+            .trim()
+            .split("\n")
+            .map((l) => l.trim())
+            .find((l) => /^\d+\.\d+\.\d+\.\d+$/.test(l));
+        return ip ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=tailscale-targets.js.map

package/dist/src/utils/tailscale-targets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tailscale-targets.js","sourceRoot":"","sources":["../../../src/utils/tailscale-targets.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACzF,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEvE;6CAC6C;AAC7C,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,YAAqB;IACnE,MAAM,CAAC,GAAG,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,oBAAoB,CAAC,CAAC;IACnF,IAAI,GAA2B,CAAC;IAChC,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAA2B,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACpB,CAAC;IACD,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC,MAAM,CAAE,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACpD,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC;IAClB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,mBAAmB,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5D,OAAO,GAAG,CAAC;AACb,CAAC;AAeD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA2B;IAChE,mBAAmB,EAAE,UAAU;IAC/B,aAAa,EAAE,aAAa;IAC5B,GAAG,EAAE,KAAK;CACX,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAwD,EACxD,SAA0C,EAC1C,UAAU,GAAG,CAAC;IAEd,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,8EAA8E;QAC9E,MAAM,SAAS,GAAG,4BAA4B,CAC5C,GAAG,CAAC,IAAI,EACR,QAAQ,EACR,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU,CAC7C,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE;YAC5D,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,GAAG;aACX,IAAI,EAAE;aACN,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,OAAO,EAAE,IAAI,IAAI,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/src/utils/tailscale.d.ts

@@ -0,0 +1,277 @@
+/**
+ * Userspace-Tailscale daemon management + tunnel-session state for
+ * `mesh vpn tunnel` (MESH-2040 / Slice 1 of MESH-2014).
+ *
+ * A per-tenant `tailscaled` runs in userspace-networking mode (brew formula,
+ * NOT the GUI app) exposing a SOCKS5 proxy; forwarders bridge `localhost:PORT`
+ * to VPC services through it. State lives under `~/.config/mesh/tailscale/<tenant>/`
+ * (r+w-granted under safehouse — see the MESH-2036 spike).
+ */
+import type { PidSource } from "./pid.js";
+import type { OwnershipCheck } from "./tunnel-ownership.js";
+import type { TunnelTarget } from "./tailscale-targets.js";
+import type { DevOutput } from "../commands/dev.js";
+export declare function tenantStateDir(tenant: string): string;
+export declare function socketPath(tenant: string): string;
+export declare function logPath(tenant: string): string;
+export declare function statePath(tenant: string): string;
+/**
+ * Daemon-scoped metadata, written by `ensureDaemon` when it actually spawns the
+ * daemon. Unlike `tunnel-state.json` (which `down` clears), this survives `down`
+ * so a later `up` reuses the RUNNING daemon's SOCKS port instead of minting a
+ * fresh one the daemon isn't listening on (which would leave every forwarder
+ * dialing a dead port). Also records the daemon pid so `stopDaemon` can kill it.
+ */
+export declare function daemonMetaPath(tenant: string): string;
+/**
+ * Ownership manifest written by the RUNNER (the process that binds the
+ * forwarder ports) — pid, process-group id, per-run token, control port. The
+ * ownership handshake (MESH-2407) verifies against it; teardown signals the
+ * recorded process group.
+ */
+export declare function runnerManifestPath(tenant: string): string;
+export interface TunnelState {
+    tenant: string;
+    env: string;
+    socksPort: number;
+    loginServer: string;
+    /** PID of the detached forwarder supervisor (null until spawned). */
+    supervisorPid: number | null;
+    /** How the runner is supervised. Defaults to "detached" when absent. */
+    managed?: "launchd" | "detached";
+    startedAt: string;
+    tunnels: TunnelTarget[];
+}
+export declare function readTunnelState(tenant: string): TunnelState | null;
+export declare function writeTunnelState(tenant: string, state: TunnelState): void;
+export declare function clearTunnelState(tenant: string): void;
+export interface DaemonMeta {
+    /** The `--socks5-server` port the running daemon actually listens on. */
+    socksPort: number;
+    /** PID of the detached `tailscaled` process (for `stopDaemon`). */
+    pid: number;
+}
+export declare function readDaemonMeta(tenant: string): DaemonMeta | null;
+export declare function writeDaemonMeta(tenant: string, meta: DaemonMeta): void;
+export declare function clearDaemonMeta(tenant: string): void;
+/** Parse `tailscale status --json` → the fields we care about. */
+export declare function parseDaemonState(statusJson: string): {
+    backendState: string;
+    selfName?: string;
+};
+/** The brew `tailscaled` (NOT the GUI app, which ships no standalone daemon). */
+export declare function tailscaledBinPath(): string;
+/** The brew `tailscale` CLI (prefer it over the GUI shim, which aborts under sandbox). */
+export declare function tailscaleBinPath(): string;
+/** Backend state via the tenant's control socket; "Down" when no daemon answers. */
+export declare function daemonState(tenant: string): {
+    backendState: string;
+    selfName?: string;
+};
+/**
+ * Extract the `--socks5-server` port from a `tailscaled` command line. Pure so
+ * it's unit-testable. Accepts both `--socks5-server=127.0.0.1:PORT` and the
+ * space-separated form, and a `localhost` host literal. Returns null if absent
+ * or malformed.
+ */
+export declare function parseSocksPortFromArgv(argv: string): number | null;
+/**
+ * Find the running userspace `tailscaled` for a tenant by its unique
+ * `--socket=<path>` argument, returning its pid and the SOCKS port it ACTUALLY
+ * bound (parsed from argv). Authoritative when `daemon.json` is missing or stale
+ * (e.g. a daemon left by an older build that predates the meta file). Returns
+ * null when no matching process is found or `ps` is unavailable.
+ */
+export declare function findRunningDaemon(tenant: string): {
+    pid: number;
+    socksPort: number | null;
+} | null;
+/** True if something accepts TCP on 127.0.0.1:port within `timeoutMs`. */
+export declare function portAccepts(port: number, timeoutMs?: number): Promise<boolean>;
+/**
+ * Ensure a userspace `tailscaled` is running for the tenant and return the SOCKS
+ * port the forwarders should dial. Idempotent — reuses a live daemon, but
+ * RECONCILES the port: a daemon that's up on a different port than requested
+ * (older build with no `daemon.json`, or stale meta) would otherwise leave every
+ * forwarder dialing a dead port (MESH-2169). Trust `opts.socksPort` only if it
+ * truly accepts; else adopt the running daemon's real port; else restart fresh.
+ */
+export declare function ensureDaemon(tenant: string, opts: {
+    region: string;
+    socksPort: number;
+}): Promise<number>;
+/**
+ * Stop the detached `tailscaled` for a tenant (SIGTERM its pid) and remove the
+ * socket + daemon metadata. Leaves the Headscale node identity in `tailscaled.state`
+ * so a later `up` re-spawns and rejoins without an interactive re-login — unless
+ * the caller logged out first.
+ *
+ * Best-effort, and that includes a corrupt `daemon.json`: an unsignalable
+ * recorded pid is REFUSED (never handed to `kill`) but only warns — the socket
+ * and meta are still cleared. `ensureDaemon` calls this on the UP path to
+ * recycle a daemon it can't verify, so throwing here would dead-end
+ * `mesh vpn tunnel up` / `mesh dev` on the very file this function deletes.
+ * Safe to call when nothing is running.
+ */
+export declare function stopDaemon(tenant: string): void;
+/**
+ * Build the `tailscale up` argument vector. Pure so it can be unit-tested and so
+ * the interactive (browser-register) and zero-touch (pre-auth key) forms differ
+ * only by the trailing `--authkey`.
+ */
+export declare function buildTailscaleUpArgs(opts: {
+    socket: string;
+    loginServer: string;
+    hostname: string;
+    preAuthKey?: string;
+}): string[];
+/**
+ * Join the tenant's Headscale tailnet via Zitadel OIDC if not already Running.
+ * Prints the device-flow registration URL and polls until registered. When a
+ * pre-auth key is supplied the join is non-interactive: no `/register/` URL is
+ * emitted, so the scrape/relay is skipped and we just wait for Running.
+ */
+export declare function joinHeadscale(tenant: string, loginServer: string, opts?: {
+    preAuthKey?: string;
+}): Promise<void>;
+/** Log the tenant daemon out of Headscale (disconnect). Daemon process persists. */
+export declare function logout(tenant: string): void;
+/**
+ * True iff two target sets are identical down to targetIp + remotePort. A live
+ * runner pins each forwarder's target at startup, so if the ELB IP rotated (or a
+ * port changed) the running forwarders point at a dead address and must be
+ * respawned, not reused. Pid-agnostic (a launchd runner records no supervisor pid).
+ */
+export declare function tunnelTargetsEqual(a: TunnelTarget[], b: TunnelTarget[]): boolean;
+/** True iff `state` has a supervisor pid and its target set equals `targets`. */
+export declare function supervisorTargetsMatch(state: TunnelState | null, targets: TunnelTarget[]): boolean;
+/**
+ * SIGTERM the supervisor's whole process GROUP, not the bare pid.
+ *
+ * `state.supervisorPid` is the pid of the detached spawn — which, under the
+ * canonical source launcher, is `bin/mesh.mjs`. That launcher blocks in
+ * `execFileSync` around the *real* runner (a `node --import tsx … mesh.ts`
+ * grandchild that actually binds the forwarder ports), and `execFileSync` does
+ * not forward signals. So signalling the bare pid kills only the launcher and
+ * ORPHANS the runner, which keeps its ports bound — the orphan then answers
+ * `allForwardersListening`'s ownership-less liveness dial and silently pins
+ * every tunnel to a stale target (the MESH-2169 / MESH-2014 failure class).
+ *
+ * The launcher is spawned `detached: true`, so it is a process-group leader
+ * (`pgid === pid`); `process.kill(-pid, …)` reaps the launcher and the runner
+ * together. Falls back to the bare pid for a legacy state file whose pid was
+ * not a group leader, and tolerates ESRCH (already gone).
+ *
+ * `pid` is always recovered — from `tunnel-state.json`, `runner.json`, or a
+ * `ps` scan — never constructed here, so it is guarded first. The guard rejects
+ * anything below 2, which is what makes the NEGATED form safe: `pid >= 2` ⇒
+ * `-pid <= -2`, a real process group, never `kill(0)` (this shell's own group)
+ * or `kill(-1)` (broadcast to everything the user can signal). See utils/pid.ts.
+ *
+ * @throws {MeshCliError} when `pid` is unsignalable. Callers reaping SEVERAL
+ * independently-recovered pids must catch per-pid (see `stopTunnelRunners`) —
+ * letting one refusal propagate would skip the other pids and leave a live
+ * runner holding ports.
+ */
+export declare function killSupervisor(pid: number, source?: PidSource): void;
+/**
+ * The ownership handshake for a tenant's tunnel runner (MESH-2407): manifest →
+ * live pid → control endpoint → token + SOCKS port + port coverage. This is
+ * the ONLY readiness/reuse signal — a bare TCP dial proves a listener exists,
+ * not that it is ours, and adopting a foreign listener is exactly the
+ * silent-dead-tunnel class (MESH-2169 / MESH-2014 / #2991). As a bonus the
+ * handshake reads listening state from the runner's in-process servers, so it
+ * opens no SOCKS→VPC data connection the way port dials do.
+ */
+export declare function verifyTunnelOwnership(tenant: string, expected: {
+    socksPort: number;
+    ports: number[];
+}): Promise<OwnershipCheck>;
+/**
+ * Tear down EVERY runner we can attribute to the tenant: the recorded
+ * supervisor pid (as a process group — see `killSupervisor`), the launchd
+ * agent, the manifest's process group, and any `__run`/`__supervise` process
+ * discovered from argv (a runner from an older build, or one whose state file
+ * was lost). This is the single teardown path — the #2991 lesson generalized:
+ * no kill path may leave a grandchild with ports still bound.
+ */
+export declare function stopTunnelRunners(tenant: string, prior: TunnelState | null): void;
+/**
+ * Ensure the per-tenant forwarder supervisor is running for `state.tunnels`.
+ * Idempotent: reuses a live runner ONLY when it passes the ownership handshake
+ * (our manifest token, our SOCKS port, every target port listening in-process);
+ * otherwise tears down every attributable runner, verifies the ports actually
+ * freed (a still-held port is a foreign squatter → loud failure, never spawn
+ * over it), and (re)spawns a fresh runner — whose readiness is again the
+ * handshake, not a bare port dial. Persists the state and returns the pid.
+ */
+export declare function ensureForwarders(state: TunnelState): Promise<number>;
+/**
+ * Rewrite `devOutput.tunnels` so each resolved target points at its local
+ * forwarder (`localhost:localPort`) — the same shape `startSsmTunnels`
+ * produces. Unmatched tunnels are left untouched. Pure (no mutation of input).
+ */
+export declare function rewriteTunnelsForTargets(devOutput: DevOutput, targets: TunnelTarget[]): DevOutput;
+/** True when the brew `tailscaled` binary is resolvable (Tailscale transport is usable). */
+export declare function tailscaleAvailable(): boolean;
+/**
+ * Ensure the tenant's Tailscale tunnels are fully up: the shared per-tenant
+ * daemon (started + OIDC-joined if needed), the resolved VPC targets, and the
+ * forwarder supervisor. Idempotent (shared across worktrees/invocations of the
+ * same tenant). Returns the resolved targets. Used by both `mesh vpn tunnel up`
+ * and `mesh dev --transport=tailscale`.
+ */
+export declare function ensureTailscaleTunnels(tenant: string, env: string, opts: {
+    region: string;
+    loginServer: string;
+    socksPort: number;
+    preAuthKey?: string;
+}): Promise<TunnelTarget[]>;
+/**
+ * `startSsmTunnels` drop-in for `mesh dev`: ensure the tenant's Tailscale
+ * tunnels, then rewrite `devOutput.tunnels` to the local forwarder ports.
+ */
+export declare function startTailscaleTunnels(devOutput: DevOutput, ctx: {
+    tenant: string;
+    env: string;
+    region: string;
+    loginServer: string;
+    socksPort: number;
+    preAuthKey?: string;
+}): Promise<DevOutput>;
+export declare function launchAgentLabel(tenant: string): string;
+/** Render the per-tenant LaunchAgent plist (pure). */
+export declare function renderLaunchAgentPlist(args: {
+    tenant: string;
+    meshBin: string;
+    nodeBin: string;
+    logPath: string;
+    /** PATH for the agent — must include the dir of `tailscaled` so daemon reheal
+     * works under launchd's minimal PATH (esp. Intel `/usr/local/bin`). */
+    pathEnv?: string;
+}): string;
+/** Targets whose local forwarder port isn't currently accepting connections. */
+export declare function forwardersNeedingRebind(targets: TunnelTarget[], listening: Set<number>): TunnelTarget[];
+export declare function launchAgentPath(tenant: string): string;
+/** True when launchctl works for this user (blocked under the seatbelt sandbox → false). */
+export declare function launchdAvailable(): boolean;
+/**
+ * Write + (re)load the per-tenant LaunchAgent. Returns true iff it fully
+ * succeeded — any failure (plist write blocked by the sandbox, `launchctl`
+ * bootstrap denied, …) returns false so the caller falls back to a detached
+ * runner. Never throws.
+ */
+export declare function installLaunchAgent(tenant: string, meshBin: string): boolean;
+/** Unload + remove the per-tenant LaunchAgent (best-effort). */
+export declare function uninstallLaunchAgent(tenant: string): void;
+/**
+ * Long-lived runner for a tenant's tunnels — used both under launchd and as the
+ * detached fallback. Runs a forwarder per target and, every ~5s, self-heals:
+ * respawns the daemon if its process died, and rebinds any forwarder whose port
+ * stopped listening. As the process that actually binds the ports, it is the
+ * sole author of the ownership manifest + control endpoint (MESH-2407) that
+ * callers verify against. Needs no AWS (targets come from tunnel-state). Never
+ * returns.
+ */
+export declare function runTunnels(tenant: string): Promise<never>;
+//# sourceMappingURL=tailscale.d.ts.map