@mesh-tech/mesh-cli 0.13.0 → 0.14.0

package/dist/bin/mesh.js

@@ -1859,8 +1859,8 @@ function resolveHubPlatformName(platform) {
   return platform?.name ?? "mesh";
 }
 async function ssmGetParameter(name) {
-  const { SSMClient: SSMClient4, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4({ region: process.env.AWS_REGION || "us-east-2" });
+  const { SSMClient: SSMClient5, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5({ region: process.env.AWS_REGION || "us-east-2" });
   const resp = await ssm.send(new GetParameterCommand2({ Name: name, WithDecryption: true }));
   return resp.Parameter?.Value;
 }
@@ -1901,8 +1901,8 @@ var init_kubeconfig = __esm({
 // libs/mesh-cli/src/utils/temporal-auth.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
 async function resolveTemporalAuth(tenant, env, platformName = tenant) {
-  const { SSMClient: SSMClient4, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4({ region: process.env.AWS_REGION || "us-east-2" });
+  const { SSMClient: SSMClient5, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5({ region: process.env.AWS_REGION || "us-east-2" });
   const results = {};
   async function trySSM(name) {
     try {
@@ -2297,8 +2297,8 @@ function buildFabricCheckPayload(targetBytes = 8e3) {
   return JSON.stringify({ ...base, pad: "x".repeat(Math.max(0, targetBytes - overhead)) });
 }
 async function verifyFabric() {
-  const { SSMClient: SSMClient4, PutParameterCommand, GetParameterCommand: GetParameterCommand2, GetParametersByPathCommand: GetParametersByPathCommand3, DeleteParametersCommand } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4(AWS_CONFIG);
+  const { SSMClient: SSMClient5, PutParameterCommand, GetParameterCommand: GetParameterCommand2, GetParametersByPathCommand: GetParametersByPathCommand3, DeleteParametersCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5(AWS_CONFIG);
   const payload = buildFabricCheckPayload();
   const mainParam = FABRIC_CHECK_PATH;
   const childParams = [`${FABRIC_CHECK_PATH}/vpc`, `${FABRIC_CHECK_PATH}/eks`];
@@ -2350,8 +2350,8 @@ async function verifyFabric() {
   }
 }
 async function registerTenantEnv(tenant, opts = {}) {
-  const { SSMClient: SSMClient4, PutParameterCommand } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4(AWS_CONFIG);
+  const { SSMClient: SSMClient5, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5(AWS_CONFIG);
   await ssm.send(
     new PutParameterCommand({
       Name: `/mesh-platform/${tenant}`,
@@ -2379,8 +2379,8 @@ async function registerTenantEnv(tenant, opts = {}) {
   );
 }
 async function seedLocalPlatform() {
-  const { SSMClient: SSMClient4, PutParameterCommand } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4(AWS_CONFIG);
+  const { SSMClient: SSMClient5, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5(AWS_CONFIG);
   await ssm.send(
     new PutParameterCommand({
       Name: APP_TENANTS_PARAM,
@@ -2434,14 +2434,14 @@ var init_seed = __esm({
 // libs/mesh-cli/src/commands/local/helpers.ts
 import * as net2 from "net";
 async function upsertLocalSecret(secretId, value, client) {
-  const { SecretsManagerClient: SecretsManagerClient8, CreateSecretCommand: CreateSecretCommand3, PutSecretValueCommand: PutSecretValueCommand3 } = await import("@aws-sdk/client-secrets-manager");
-  const sm = client ?? new SecretsManagerClient8(LOCAL_AWS_CONFIG);
+  const { SecretsManagerClient: SecretsManagerClient9, CreateSecretCommand: CreateSecretCommand4, PutSecretValueCommand: PutSecretValueCommand4 } = await import("@aws-sdk/client-secrets-manager");
+  const sm = client ?? new SecretsManagerClient9(LOCAL_AWS_CONFIG);
   const secretString = JSON.stringify(value);
   try {
-    await sm.send(new CreateSecretCommand3({ Name: secretId, SecretString: secretString }));
+    await sm.send(new CreateSecretCommand4({ Name: secretId, SecretString: secretString }));
   } catch (err) {
     if (err?.name === "ResourceExistsException") {
-      await sm.send(new PutSecretValueCommand3({ SecretId: secretId, SecretString: secretString }));
+      await sm.send(new PutSecretValueCommand4({ SecretId: secretId, SecretString: secretString }));
     } else {
       throw err;
     }
@@ -3158,12 +3158,12 @@ async function fetchRemoteExternalCredentials(tenant, env, external, profile) {
   const region = process.env.MESH_PLATFORM_REGION ?? process.env.AWS_REGION ?? "us-east-2";
   const fallbackProfile = !process.env.AWS_ACCESS_KEY_ID && !process.env.AWS_PROFILE ? process.env.MESH_AWS_PROFILE ?? profile : void 0;
   try {
-    const { SecretsManagerClient: SecretsManagerClient8, GetSecretValueCommand: GetSecretValueCommand8 } = await import("@aws-sdk/client-secrets-manager");
+    const { SecretsManagerClient: SecretsManagerClient9, GetSecretValueCommand: GetSecretValueCommand9 } = await import("@aws-sdk/client-secrets-manager");
     if (fallbackProfile) process.env.AWS_PROFILE = fallbackProfile;
-    const sm = new SecretsManagerClient8({ region });
+    const sm = new SecretsManagerClient9({ region });
     let res;
     try {
-      res = await sm.send(new GetSecretValueCommand8({ SecretId: secretId }));
+      res = await sm.send(new GetSecretValueCommand9({ SecretId: secretId }));
     } finally {
       if (fallbackProfile) delete process.env.AWS_PROFILE;
     }
@@ -3277,8 +3277,8 @@ async function seedLocalMock(args) {
     `${secretName}/.config`,
     Object.fromEntries(Object.entries(value).filter(([key]) => !SECRET_KEY_RE.test(key)))
   );
-  const { SSMClient: SSMClient4, PutParameterCommand } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4(LOCAL_AWS_CONFIG);
+  const { SSMClient: SSMClient5, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5(LOCAL_AWS_CONFIG);
   const base = `/mesh-platform/${tenant}/${LOCAL_ENV}/apps/${app}/stacks/local/external-services/${decl.external}`;
   await ssm.send(
     new PutParameterCommand({
@@ -3720,8 +3720,8 @@ async function seedHubAuth(pat) {
   return config;
 }
 async function writeRegistryParams(cliClientId, awsConfig) {
-  const { SSMClient: SSMClient4, PutParameterCommand } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4(awsConfig);
+  const { SSMClient: SSMClient5, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5(awsConfig);
   await ssm.send(
     new PutParameterCommand({
       Name: ZITADEL_SSM_PARAM,
@@ -3911,9 +3911,9 @@ async function ensureM2mCaller(pat, tenant, app, orgId, projectId, roles) {
   return false;
 }
 async function authSecretExists(tenant, app, service) {
-  const { SecretsManagerClient: SecretsManagerClient8, GetSecretValueCommand: GetSecretValueCommand8 } = await import("@aws-sdk/client-secrets-manager");
-  const sm = new SecretsManagerClient8(LOCAL_AWS_CONFIG);
-  return sm.send(new GetSecretValueCommand8({ SecretId: authSecretPath(tenant, app, service) })).then(
+  const { SecretsManagerClient: SecretsManagerClient9, GetSecretValueCommand: GetSecretValueCommand9 } = await import("@aws-sdk/client-secrets-manager");
+  const sm = new SecretsManagerClient9(LOCAL_AWS_CONFIG);
+  return sm.send(new GetSecretValueCommand9({ SecretId: authSecretPath(tenant, app, service) })).then(
     () => true,
     () => false
   );
@@ -3924,8 +3924,8 @@ async function writeAuthSecret(tenant, app, service, value) {
   logSuccess(`Stored service credentials \u2192 ${name}`);
 }
 async function registerLocalApp(args) {
-  const { SSMClient: SSMClient4, PutParameterCommand } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4(LOCAL_AWS_CONFIG);
+  const { SSMClient: SSMClient5, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5(LOCAL_AWS_CONFIG);
   const put2 = (name, value, description) => ssm.send(
     new PutParameterCommand({ Name: name, Type: "String", Overwrite: true, Value: JSON.stringify(value), Description: description })
   );
@@ -3975,8 +3975,8 @@ async function registerLocalApp(args) {
 }
 async function reconcileRegistryFromZitadel() {
   const pat = readSeederPat();
-  const { SSMClient: SSMClient4, GetParameterCommand: GetParameterCommand2, PutParameterCommand } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient4(LOCAL_AWS_CONFIG);
+  const { SSMClient: SSMClient5, GetParameterCommand: GetParameterCommand2, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5(LOCAL_AWS_CONFIG);
   const orgs = await api(pat, "POST", "/admin/v1/orgs/_search", { query: { limit: 200 } });
   const tenants = [];
   let apps = 0;
@@ -7297,8 +7297,8 @@ function registerDevCommand(program2) {
   });
   dev.command("test-user [name]").description("Get Temporal test user credentials (from Pulumi-managed test users)").option("--tenant <tenant>", "Tenant name", "mesh").option("--env <env>", "Environment", "dev").option("--region <region>", "AWS region", "us-east-2").action(
     async (name, opts) => {
-      const { SSMClient: SSMClient4, GetParameterCommand: GetParameterCommand2, GetParametersByPathCommand: GetParametersByPathCommand3 } = await import("@aws-sdk/client-ssm");
-      const ssm = new SSMClient4({ region: opts.region });
+      const { SSMClient: SSMClient5, GetParameterCommand: GetParameterCommand2, GetParametersByPathCommand: GetParametersByPathCommand3 } = await import("@aws-sdk/client-ssm");
+      const ssm = new SSMClient5({ region: opts.region });
       const basePath = `/mesh-platform/${opts.tenant}/${opts.env}/temporal/test-users`;
       if (!name) {
         try {
@@ -9291,9 +9291,9 @@ function parseTenantEnv(context) {
 }
 async function getRegistrySsmExport(tenant, env) {
   try {
-    const { SSMClient: SSMClient4, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
+    const { SSMClient: SSMClient5, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
     const region = process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? CA_REGION;
-    const ssm = new SSMClient4({ region });
+    const ssm = new SSMClient5({ region });
     const ssmPath = `/mesh-platform/${tenant}/${env}/registry`;
     const response = await ssm.send(new GetParameterCommand2({ Name: ssmPath }));
     if (!response.Parameter?.Value) return null;
@@ -9883,9 +9883,9 @@ async function discoverConfigFromSsm(context) {
   const ssmPath = `/mesh-platform/${tenant}/${env}/platform/zitadel`;
   logInfo(`Attempting SSM discovery from ${ssmPath}...`);
   try {
-    const { SSMClient: SSMClient4, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
+    const { SSMClient: SSMClient5, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
     const region = process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? "us-east-2";
-    const ssm = new SSMClient4({ region });
+    const ssm = new SSMClient5({ region });
     const resp = await ssm.send(new GetParameterCommand2({ Name: ssmPath }));
     const raw = resp.Parameter?.Value;
     if (!raw) {
@@ -16521,6 +16521,12 @@ import {
 } from "@aws-sdk/client-secrets-manager";
 import input from "@inquirer/input";
 import password from "@inquirer/password";
+import {
+  buildInstanceIndexValue,
+  instanceIndexSecretId,
+  isInstanceKey,
+  parseInstanceIndex
+} from "@mesh-tech/secrets";
 async function ensureAwsCredentialsForStack(stack) {
   if (process.env.AWS_ACCESS_KEY_ID || process.env.AWS_SESSION_TOKEN) return;
   if (!stack) return;
@@ -16705,6 +16711,12 @@ Usage: mesh secrets set external/<name>`);
     );
     process.exit(1);
   }
+  if (opts.key && !isInstanceKey(opts.key)) {
+    logError(
+      `Invalid instance key "${opts.key}": keys must not contain "/", start with ".", or end with ".config" \u2014 those names are reserved for the index and config mirrors.`
+    );
+    process.exit(1);
+  }
   let existing = {};
   try {
     const response = await smClient.send(
@@ -16729,6 +16741,9 @@ Usage: mesh secrets set external/<name>`);
     const merged2 = deepMerge(existing, values2);
     await writeSecret(smClient, secretId, merged2, svc.meta);
     await writeConfigMirror(smClient, secretId, schema, merged2, svc.meta);
+    if (opts.key) {
+      await addKeyToInstanceIndex(smClient, secretPrefix, opts.key, serviceName);
+    }
     logSuccess(`Credentials written to ${secretId}`);
     return;
   }
@@ -16744,6 +16759,9 @@ Usage: mesh secrets set external/<name>`);
   const merged = deepMerge(existing, values);
   await writeSecret(smClient, secretId, merged, svc.meta);
   await writeConfigMirror(smClient, secretId, schema, merged, svc.meta);
+  if (opts.key) {
+    await addKeyToInstanceIndex(smClient, secretPrefix, opts.key, serviceName);
+  }
   logSuccess(`Credentials written to ${secretId}`);
   console.error("\nStored fields:");
   displaySummary(schema.fields, merged);
@@ -16809,6 +16827,45 @@ function extractNonSecretFields(fields, values) {
   }
   return result;
 }
+async function addKeyToInstanceIndex(client, secretPrefix, key, serviceName) {
+  const indexId = instanceIndexSecretId(secretPrefix);
+  try {
+    let keys = [];
+    try {
+      const res = await client.send(new GetSecretValueCommand5({ SecretId: indexId }));
+      keys = parseInstanceIndex(res.SecretString ?? "");
+    } catch (err) {
+      if (!isResourceNotFound(err)) throw err;
+    }
+    if (keys.includes(key)) return;
+    const secretString = buildInstanceIndexValue([...keys, key]);
+    try {
+      await client.send(
+        new PutSecretValueCommand({ SecretId: indexId, SecretString: secretString })
+      );
+    } catch (err) {
+      if (!isResourceNotFound(err)) throw err;
+      await client.send(
+        new CreateSecretCommand({
+          Name: indexId,
+          Description: `Instance-key index for ${serviceName} (read by listInstances(); maintained by mesh secrets set/reindex and the Hub)`,
+          SecretString: secretString,
+          Tags: [
+            { Key: "mesh:type", Value: "external-service-index" },
+            { Key: "mesh:service", Value: serviceName }
+          ]
+        })
+      );
+      logInfo(
+        `Created ${indexId} OUT OF BAND \u2014 the declaring stack does not manage it. Deploy the declaring stack (it creates the index) before writing keys, or import this secret into the stack before its next deploy.`
+      );
+    }
+  } catch (err) {
+    logInfo(
+      `Warning: failed to record instance "${key}" in ${indexId} \u2014 listInstances() will not see it until you run: mesh secrets reindex external/${serviceName} (${err})`
+    );
+  }
+}
 async function writeConfigMirror(client, secretId, schema, merged, meta) {
   const configId = `${secretId}/.config`;
   const configValues = extractNonSecretFields(schema.fields, merged);
@@ -16850,17 +16907,157 @@ var init_set = __esm({
   }
 });
 
+// libs/mesh-cli/src/commands/secrets/reindex.ts
+import { SSMClient as SSMClient3 } from "@aws-sdk/client-ssm";
+import {
+  SecretsManagerClient as SecretsManagerClient6,
+  ListSecretsCommand,
+  GetSecretValueCommand as GetSecretValueCommand6,
+  PutSecretValueCommand as PutSecretValueCommand2,
+  CreateSecretCommand as CreateSecretCommand2
+} from "@aws-sdk/client-secrets-manager";
+import {
+  buildInstanceIndexValue as buildInstanceIndexValue2,
+  instanceIndexSecretId as instanceIndexSecretId2,
+  instanceKeyFromSecretName,
+  parseInstanceIndex as parseInstanceIndex2
+} from "@mesh-tech/secrets";
+async function scanInstanceKeys(client, secretPrefix) {
+  const keys = [];
+  let nextToken;
+  do {
+    const response = await client.send(
+      new ListSecretsCommand({
+        Filters: [{ Key: "name", Values: [`${secretPrefix}/`] }],
+        NextToken: nextToken
+      })
+    );
+    for (const secret of response.SecretList ?? []) {
+      const key = secret.Name ? instanceKeyFromSecretName(secretPrefix, secret.Name) : null;
+      if (key) keys.push(key);
+    }
+    nextToken = response.NextToken;
+  } while (nextToken);
+  return keys;
+}
+function indexAlreadyMatches(missing, stale, indexExists, malformed) {
+  return missing.length === 0 && stale.length === 0 && indexExists && !malformed;
+}
+async function reindexCommand(servicePath, opts) {
+  const stackOpt = resolveStackOption(opts);
+  const context = detectContext(stackOpt);
+  const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
+  await ensureAwsCredentialsForStack(stackOpt ?? context.stage);
+  const ssmClient = new SSMClient3({ region });
+  const smClient = new SecretsManagerClient6({ region });
+  const services = await discoverExternalServices(
+    ssmClient,
+    context.tenant,
+    context.platformEnv
+  );
+  const serviceName = servicePath?.replace(/^external\//, "");
+  if (!serviceName || !services.has(serviceName)) {
+    if (serviceName) {
+      logError(`External service "${serviceName}" not found.`);
+    }
+    const keyed = [...services.entries()].filter(([, s]) => s.schema?.keyedBy);
+    console.error("\nMulti-instance external services:");
+    for (const [name, svc2] of keyed) {
+      console.error(`  ${name} (keyed by ${svc2.schema.keyedBy})`);
+    }
+    if (keyed.length === 0) console.error("  (none)");
+    console.error(`
+Usage: mesh secrets reindex external/<name>`);
+    process.exit(serviceName ? 1 : 0);
+  }
+  const svc = services.get(serviceName);
+  if (!svc.schema?.keyedBy) {
+    logError(
+      `"${serviceName}" is single-instance (no keyedBy) \u2014 it has no instance index.`
+    );
+    process.exit(1);
+  }
+  const secretPrefix = svc.meta.secretPrefix;
+  const indexId = instanceIndexSecretId2(secretPrefix);
+  const actual = [...new Set(await scanInstanceKeys(smClient, secretPrefix))].sort();
+  let listed = [];
+  let indexExists = true;
+  let malformed = false;
+  try {
+    const res = await smClient.send(new GetSecretValueCommand6({ SecretId: indexId }));
+    try {
+      listed = parseInstanceIndex2(res.SecretString ?? "");
+    } catch {
+      malformed = true;
+      logInfo(`Existing index at ${indexId} is malformed \u2014 rebuilding from scratch.`);
+    }
+  } catch (err) {
+    if (!isResourceNotFound(err)) throw err;
+    indexExists = false;
+    logInfo(`No index at ${indexId} yet \u2014 it will be created.`);
+  }
+  const missing = actual.filter((k) => !listed.includes(k));
+  const stale = listed.filter((k) => !actual.includes(k));
+  logInfo(`Instances in Secrets Manager: ${actual.length ? actual.join(", ") : "(none)"}`);
+  if (missing.length > 0) logInfo(`Missing from index: ${missing.join(", ")}`);
+  if (stale.length > 0) logInfo(`Stale in index (secret gone): ${stale.join(", ")}`);
+  if (indexAlreadyMatches(missing, stale, indexExists, malformed)) {
+    logSuccess(`Index at ${indexId} already matches \u2014 nothing to do.`);
+    return;
+  }
+  if (opts.dryRun) {
+    logInfo(`Dry run \u2014 would write ${indexId} with ${actual.length} instance(s).`);
+    return;
+  }
+  await writeInstanceIndex(smClient, secretPrefix, serviceName, actual);
+  logSuccess(`Index rebuilt: ${indexId} now lists ${actual.length} instance(s).`);
+}
+async function writeInstanceIndex(client, secretPrefix, serviceName, keys) {
+  const indexId = instanceIndexSecretId2(secretPrefix);
+  const secretString = buildInstanceIndexValue2(keys);
+  try {
+    await client.send(
+      new PutSecretValueCommand2({ SecretId: indexId, SecretString: secretString })
+    );
+  } catch (err) {
+    if (!isResourceNotFound(err)) throw err;
+    await client.send(
+      new CreateSecretCommand2({
+        Name: indexId,
+        Description: `Instance-key index for ${serviceName} (read by listInstances(); maintained by mesh secrets set/reindex and the Hub)`,
+        SecretString: secretString,
+        Tags: [
+          { Key: "mesh:type", Value: "external-service-index" },
+          { Key: "mesh:service", Value: serviceName }
+        ]
+      })
+    );
+    logInfo(
+      `Created ${indexId} OUT OF BAND \u2014 the declaring stack does not manage it. Deploy the declaring stack BEFORE reindex next time, or import this secret into the stack before its next deploy.`
+    );
+  }
+}
+var init_reindex = __esm({
+  "libs/mesh-cli/src/commands/secrets/reindex.ts"() {
+    "use strict";
+    init_context();
+    init_log();
+    init_stack_flag();
+    init_set();
+  }
+});
+
 // libs/mesh-cli/src/commands/secrets/migrate-config.ts
 import {
-  SSMClient as SSMClient3,
+  SSMClient as SSMClient4,
   GetParametersByPathCommand as GetParametersByPathCommand2
 } from "@aws-sdk/client-ssm";
 import {
-  SecretsManagerClient as SecretsManagerClient6,
-  GetSecretValueCommand as GetSecretValueCommand6,
-  PutSecretValueCommand as PutSecretValueCommand2,
-  CreateSecretCommand as CreateSecretCommand2,
-  ListSecretsCommand
+  SecretsManagerClient as SecretsManagerClient7,
+  GetSecretValueCommand as GetSecretValueCommand7,
+  PutSecretValueCommand as PutSecretValueCommand3,
+  CreateSecretCommand as CreateSecretCommand3,
+  ListSecretsCommand as ListSecretsCommand2
 } from "@aws-sdk/client-secrets-manager";
 function normalizeEntry2(raw) {
   if (raw.type === "group" && raw.fields) {
@@ -16946,7 +17143,7 @@ function isResourceNotFound2(err) {
 }
 async function readSecret(client, secretId) {
   try {
-    const res = await client.send(new GetSecretValueCommand6({ SecretId: secretId }));
+    const res = await client.send(new GetSecretValueCommand7({ SecretId: secretId }));
     return res.SecretString ? JSON.parse(res.SecretString) : null;
   } catch (err) {
     if (isResourceNotFound2(err)) return null;
@@ -16956,10 +17153,10 @@ async function readSecret(client, secretId) {
 async function writeSecret2(client, secretId, values, description) {
   const secretString = JSON.stringify(values);
   try {
-    await client.send(new PutSecretValueCommand2({ SecretId: secretId, SecretString: secretString }));
+    await client.send(new PutSecretValueCommand3({ SecretId: secretId, SecretString: secretString }));
   } catch (err) {
     if (isResourceNotFound2(err)) {
-      await client.send(new CreateSecretCommand2({
+      await client.send(new CreateSecretCommand3({
         Name: secretId,
         Description: description,
         SecretString: secretString,
@@ -16972,7 +17169,7 @@ async function writeSecret2(client, secretId, values, description) {
 }
 async function secretExists(client, secretId) {
   try {
-    await client.send(new GetSecretValueCommand6({ SecretId: secretId }));
+    await client.send(new GetSecretValueCommand7({ SecretId: secretId }));
     return true;
   } catch (err) {
     if (isResourceNotFound2(err)) return false;
@@ -16985,7 +17182,7 @@ async function listInstanceKeys(client, secretPrefix) {
   let nextToken;
   do {
     const response = await client.send(
-      new ListSecretsCommand({
+      new ListSecretsCommand2({
         Filters: [{ Key: "name", Values: [prefix2] }],
         NextToken: nextToken
       })
@@ -17051,8 +17248,8 @@ async function migrateService(smClient, meta, schema, opts) {
 async function migrateConfigCommand(opts) {
   const context = detectContext(resolveStackOption(opts));
   const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
-  const ssmClient = new SSMClient3({ region });
-  const smClient = new SecretsManagerClient6({ region });
+  const ssmClient = new SSMClient4({ region });
+  const smClient = new SecretsManagerClient7({ region });
   logInfo(`Migrating .config mirrors for ${context.tenant}/${context.platformEnv}`);
   if (opts.dryRun) logInfo("DRY-RUN mode \u2014 no writes");
   if (opts.force) logInfo("FORCE mode \u2014 overwrite existing .config");
@@ -17105,6 +17302,11 @@ function registerSecretsCommands(program2) {
   secrets.command("set [service]").description("Set credentials for an external service (e.g., mesh secrets set external/symitar)").option("--key <key>", "Instance key for multi-instance services (e.g., FI ID)").option("--all", "Prompt for all fields including optional ones").option("--json <json>", "Non-interactive: provide values as JSON").option("--stack <stack>", "Pulumi stack name (override detection)").addOption(new Option2("--stage <stack>", "Deprecated alias for --stack").hideHelp()).option("--region <region>", "AWS region (default: us-east-2)").action(async (service, opts) => {
     await setCommand(service, opts);
   });
+  secrets.command("reindex [service]").description(
+    "Rebuild a multi-instance external service's instance index (the {prefix}/.index secret listInstances() reads) from the per-key secrets actually in Secrets Manager \u2014 the repair for an instance secret created or deleted out of band"
+  ).option("--dry-run", "Show what would change without writing").option("--stack <stack>", "Pulumi stack name (override detection)").addOption(new Option2("--stage <stack>", "Deprecated alias for --stack").hideHelp()).option("--region <region>", "AWS region (default: us-east-2)").action(async (service, opts) => {
+    await reindexCommand(service, opts);
+  });
   secrets.command("migrate-config").description("Backfill .config mirror secrets for all external services").option("--force", "Overwrite existing .config mirrors").option("--dry-run", "Show what would be written without writing").option("--stack <stack>", "Pulumi stack name (override detection)").addOption(new Option2("--stage <stack>", "Deprecated alias for --stack").hideHelp()).option("--region <region>", "AWS region (default: us-east-2)").action(async (opts) => {
     await migrateConfigCommand(opts);
   });
@@ -17114,6 +17316,7 @@ var init_secrets = __esm({
     "use strict";
     init_exec2();
     init_set();
+    init_reindex();
     init_migrate_config();
   }
 });
@@ -18755,8 +18958,8 @@ import * as fs32 from "fs";
 import * as os13 from "os";
 import * as path39 from "path";
 import {
-  SecretsManagerClient as SecretsManagerClient7,
-  GetSecretValueCommand as GetSecretValueCommand7
+  SecretsManagerClient as SecretsManagerClient8,
+  GetSecretValueCommand as GetSecretValueCommand8
 } from "@aws-sdk/client-secrets-manager";
 function resolveTenantEnv(options) {
   if (options.tenant && options.env) {
@@ -19019,10 +19222,10 @@ async function tunnelExternal(name, options) {
   const { appTenant, appStage } = resolveCredentialAxis(options);
   const secretId = externalSecretId(appTenant, appStage, name, key);
   const setHint = `mesh secrets set external/${name}${key ? ` --key=${key}` : ""}`;
-  const sm = new SecretsManagerClient7({});
+  const sm = new SecretsManagerClient8({});
   let creds;
   try {
-    const out = await sm.send(new GetSecretValueCommand7({ SecretId: secretId }));
+    const out = await sm.send(new GetSecretValueCommand8({ SecretId: secretId }));
     creds = JSON.parse(out.SecretString ?? "{}");
   } catch (err) {
     logError(