@mesh-tech/mesh-cli 0.13.0 → 0.14.0

package/dist/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "d15985415",
-  "builtAt": "2026-08-28T13:48:03.762Z"
+  "commit": "c9c8801dc",
+  "builtAt": "2026-09-01T15:06:04.467Z"
 }

package/dist/src/commands/secrets/index.d.ts

@@ -4,6 +4,7 @@
  * Commands:
  * mesh secrets exec    - Run command with secrets injected as environment variables
  * mesh secrets set     - Set credentials for an external service
+ * mesh secrets reindex - Rebuild a keyed service's instance index from Secrets Manager
  */
 import { Command } from "commander";
 export declare function registerSecretsCommands(program: Command): void;

package/dist/src/commands/secrets/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/secrets/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAK5C,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAuC9D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/secrets/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAM5C,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAoD9D"}

package/dist/src/commands/secrets/index.js

@@ -4,10 +4,12 @@
  * Commands:
  * mesh secrets exec    - Run command with secrets injected as environment variables
  * mesh secrets set     - Set credentials for an external service
+ * mesh secrets reindex - Rebuild a keyed service's instance index from Secrets Manager
  */
 import { Option } from "commander";
 import { execCommand } from "./exec.js";
 import { setCommand } from "./set.js";
+import { reindexCommand } from "./reindex.js";
 import { migrateConfigCommand } from "./migrate-config.js";
 export function registerSecretsCommands(program) {
     const secrets = program
@@ -34,6 +36,16 @@ export function registerSecretsCommands(program) {
         .action(async (service, opts) => {
         await setCommand(service, opts);
     });
+    secrets
+        .command("reindex [service]")
+        .description("Rebuild a multi-instance external service's instance index (the {prefix}/.index secret listInstances() reads) from the per-key secrets actually in Secrets Manager — the repair for an instance secret created or deleted out of band")
+        .option("--dry-run", "Show what would change without writing")
+        .option("--stack <stack>", "Pulumi stack name (override detection)")
+        .addOption(new Option("--stage <stack>", "Deprecated alias for --stack").hideHelp())
+        .option("--region <region>", "AWS region (default: us-east-2)")
+        .action(async (service, opts) => {
+        await reindexCommand(service, opts);
+    });
     secrets
         .command("migrate-config")
         .description("Backfill .config mirror secrets for all external services")

package/dist/src/commands/secrets/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/commands/secrets/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAW,MAAM,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3D,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,+BAA+B,CAAC,CAAC;IAEhD,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,mDAAmD,CAAC;SAChE,kBAAkB,CAAC,IAAI,CAAC;SACxB,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3B,oCAAoC;QACpC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,mFAAmF,CAAC;SAChG,MAAM,CAAC,aAAa,EAAE,wDAAwD,CAAC;SAC/E,MAAM,CAAC,OAAO,EAAE,+CAA+C,CAAC;SAChE,MAAM,CAAC,eAAe,EAAE,yCAAyC,CAAC;SAClE,MAAM,CAAC,iBAAiB,EAAE,wCAAwC,CAAC;SACnE,SAAS,CAAC,IAAI,MAAM,CAAC,iBAAiB,EAAE,8BAA8B,CAAC,CAAC,QAAQ,EAAE,CAAC;SACnF,MAAM,CAAC,mBAAmB,EAAE,iCAAiC,CAAC;SAC9D,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CAAC,2DAA2D,CAAC;SACxE,MAAM,CAAC,SAAS,EAAE,oCAAoC,CAAC;SACvD,MAAM,CAAC,WAAW,EAAE,4CAA4C,CAAC;SACjE,MAAM,CAAC,iBAAiB,EAAE,wCAAwC,CAAC;SACnE,SAAS,CAAC,IAAI,MAAM,CAAC,iBAAiB,EAAE,8BAA8B,CAAC,CAAC,QAAQ,EAAE,CAAC;SACnF,MAAM,CAAC,mBAAmB,EAAE,iCAAiC,CAAC;SAC9D,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/commands/secrets/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAW,MAAM,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3D,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,+BAA+B,CAAC,CAAC;IAEhD,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,mDAAmD,CAAC;SAChE,kBAAkB,CAAC,IAAI,CAAC;SACxB,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3B,oCAAoC;QACpC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,mFAAmF,CAAC;SAChG,MAAM,CAAC,aAAa,EAAE,wDAAwD,CAAC;SAC/E,MAAM,CAAC,OAAO,EAAE,+CAA+C,CAAC;SAChE,MAAM,CAAC,eAAe,EAAE,yCAAyC,CAAC;SAClE,MAAM,CAAC,iBAAiB,EAAE,wCAAwC,CAAC;SACnE,SAAS,CAAC,IAAI,MAAM,CAAC,iBAAiB,EAAE,8BAA8B,CAAC,CAAC,QAAQ,EAAE,CAAC;SACnF,MAAM,CAAC,mBAAmB,EAAE,iCAAiC,CAAC;SAC9D,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CACV,uOAAuO,CACxO;SACA,MAAM,CAAC,WAAW,EAAE,wCAAwC,CAAC;SAC7D,MAAM,CAAC,iBAAiB,EAAE,wCAAwC,CAAC;SACnE,SAAS,CAAC,IAAI,MAAM,CAAC,iBAAiB,EAAE,8BAA8B,CAAC,CAAC,QAAQ,EAAE,CAAC;SACnF,MAAM,CAAC,mBAAmB,EAAE,iCAAiC,CAAC;SAC9D,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CAAC,2DAA2D,CAAC;SACxE,MAAM,CAAC,SAAS,EAAE,oCAAoC,CAAC;SACvD,MAAM,CAAC,WAAW,EAAE,4CAA4C,CAAC;SACjE,MAAM,CAAC,iBAAiB,EAAE,wCAAwC,CAAC;SACnE,SAAS,CAAC,IAAI,MAAM,CAAC,iBAAiB,EAAE,8BAA8B,CAAC,CAAC,QAAQ,EAAE,CAAC;SACnF,MAAM,CAAC,mBAAmB,EAAE,iCAAiC,CAAC;SAC9D,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/secrets/reindex.d.ts

@@ -0,0 +1,48 @@
+/**
+ * mesh secrets reindex — Rebuild a keyed external service's instance index.
+ *
+ * The instance index (`{secretPrefix}/.index`) is what `listInstances()`
+ * reads, and it is only as correct as its writers: `mesh secrets set --key`
+ * and the Hub maintain it as they create and delete instance secrets, but a
+ * per-key secret created or deleted OUT OF BAND (the AWS console, a raw SDK
+ * call) leaves it stale — the instance exists but is invisible, or is listed
+ * but gone. This command is the repair: it scans the real per-key secrets
+ * under the prefix with `secretsmanager:ListSecrets` (an operator-credential
+ * call — pods cannot make it, which is why the index exists at all) and
+ * rewrites the index to match.
+ *
+ * Usage:
+ *   mesh secrets reindex external/symitar
+ *   mesh secrets reindex external/symitar --dry-run
+ *
+ * The command detects tenant/stage from Pulumi config in the current
+ * directory, like `mesh secrets set`.
+ */
+import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+/**
+ * Scan the per-key secrets actually present under the prefix. Uses the shared
+ * `instanceKeyFromSecretName` filter, so "which secrets are instances" cannot
+ * drift from what `mesh secrets set` and the Hub consider an instance.
+ */
+export declare function scanInstanceKeys(client: SecretsManagerClient, secretPrefix: string): Promise<string[]>;
+/**
+ * Whether the index can be left untouched. A malformed index never counts as
+ * matching — even when the diff is empty (zero per-key secrets): the whole
+ * point of the repair is to leave a well-formed index behind.
+ */
+export declare function indexAlreadyMatches(missing: string[], stale: string[], indexExists: boolean, malformed: boolean): boolean;
+export declare function reindexCommand(servicePath: string | undefined, opts: {
+    stack?: string;
+    stage?: string;
+    region?: string;
+    dryRun?: boolean;
+}): Promise<void>;
+/**
+ * Write the canonical index value for `keys`, creating the index secret when
+ * it does not exist. The create path warns that the secret is not
+ * stack-managed: the declaring stack also declares it, and created here
+ * first it is not in the stack's state, so the stack's next deploy fails on
+ * the name collision until the secret is imported or deleted.
+ */
+export declare function writeInstanceIndex(client: SecretsManagerClient, secretPrefix: string, serviceName: string, keys: string[]): Promise<void>;
+//# sourceMappingURL=reindex.d.ts.map

package/dist/src/commands/secrets/reindex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reindex.d.ts","sourceRoot":"","sources":["../../../../src/commands/secrets/reindex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EACL,oBAAoB,EAKrB,MAAM,iCAAiC,CAAC;AAgBzC;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,oBAAoB,EAC5B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,EAAE,CAAC,CAiBnB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EAAE,EACjB,KAAK,EAAE,MAAM,EAAE,EACf,WAAW,EAAE,OAAO,EACpB,SAAS,EAAE,OAAO,GACjB,OAAO,CAET;AAED,wBAAsB,cAAc,CAClC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GACA,OAAO,CAAC,IAAI,CAAC,CA+Ef;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,oBAAoB,EAC5B,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,IAAI,CAAC,CA0Bf"}

package/dist/src/commands/secrets/reindex.js

@@ -0,0 +1,157 @@
+/**
+ * mesh secrets reindex — Rebuild a keyed external service's instance index.
+ *
+ * The instance index (`{secretPrefix}/.index`) is what `listInstances()`
+ * reads, and it is only as correct as its writers: `mesh secrets set --key`
+ * and the Hub maintain it as they create and delete instance secrets, but a
+ * per-key secret created or deleted OUT OF BAND (the AWS console, a raw SDK
+ * call) leaves it stale — the instance exists but is invisible, or is listed
+ * but gone. This command is the repair: it scans the real per-key secrets
+ * under the prefix with `secretsmanager:ListSecrets` (an operator-credential
+ * call — pods cannot make it, which is why the index exists at all) and
+ * rewrites the index to match.
+ *
+ * Usage:
+ *   mesh secrets reindex external/symitar
+ *   mesh secrets reindex external/symitar --dry-run
+ *
+ * The command detects tenant/stage from Pulumi config in the current
+ * directory, like `mesh secrets set`.
+ */
+import { SSMClient } from "@aws-sdk/client-ssm";
+import { SecretsManagerClient, ListSecretsCommand, GetSecretValueCommand, PutSecretValueCommand, CreateSecretCommand, } from "@aws-sdk/client-secrets-manager";
+import { buildInstanceIndexValue, instanceIndexSecretId, instanceKeyFromSecretName, parseInstanceIndex, } from "@mesh-tech/secrets";
+import { detectContext } from "../../utils/context.js";
+import { logInfo, logSuccess, logError } from "../../utils/log.js";
+import { resolveStackOption } from "../../utils/stack-flag.js";
+import { discoverExternalServices, ensureAwsCredentialsForStack, isResourceNotFound, } from "./set.js";
+/**
+ * Scan the per-key secrets actually present under the prefix. Uses the shared
+ * `instanceKeyFromSecretName` filter, so "which secrets are instances" cannot
+ * drift from what `mesh secrets set` and the Hub consider an instance.
+ */
+export async function scanInstanceKeys(client, secretPrefix) {
+    const keys = [];
+    let nextToken;
+    do {
+        const response = await client.send(new ListSecretsCommand({
+            Filters: [{ Key: "name", Values: [`${secretPrefix}/`] }],
+            NextToken: nextToken,
+        }));
+        for (const secret of response.SecretList ?? []) {
+            const key = secret.Name ? instanceKeyFromSecretName(secretPrefix, secret.Name) : null;
+            if (key)
+                keys.push(key);
+        }
+        nextToken = response.NextToken;
+    } while (nextToken);
+    return keys;
+}
+/**
+ * Whether the index can be left untouched. A malformed index never counts as
+ * matching — even when the diff is empty (zero per-key secrets): the whole
+ * point of the repair is to leave a well-formed index behind.
+ */
+export function indexAlreadyMatches(missing, stale, indexExists, malformed) {
+    return missing.length === 0 && stale.length === 0 && indexExists && !malformed;
+}
+export async function reindexCommand(servicePath, opts) {
+    const stackOpt = resolveStackOption(opts);
+    const context = detectContext(stackOpt);
+    const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
+    await ensureAwsCredentialsForStack(stackOpt ?? context.stage);
+    const ssmClient = new SSMClient({ region });
+    const smClient = new SecretsManagerClient({ region });
+    const services = await discoverExternalServices(ssmClient, context.tenant, context.platformEnv);
+    const serviceName = servicePath?.replace(/^external\//, "");
+    if (!serviceName || !services.has(serviceName)) {
+        if (serviceName) {
+            logError(`External service "${serviceName}" not found.`);
+        }
+        const keyed = [...services.entries()].filter(([, s]) => s.schema?.keyedBy);
+        console.error("\nMulti-instance external services:");
+        for (const [name, svc] of keyed) {
+            console.error(`  ${name} (keyed by ${svc.schema.keyedBy})`);
+        }
+        if (keyed.length === 0)
+            console.error("  (none)");
+        console.error(`\nUsage: mesh secrets reindex external/<name>`);
+        process.exit(serviceName ? 1 : 0);
+    }
+    const svc = services.get(serviceName);
+    if (!svc.schema?.keyedBy) {
+        logError(`"${serviceName}" is single-instance (no keyedBy) — it has no instance index.`);
+        process.exit(1);
+    }
+    const secretPrefix = svc.meta.secretPrefix;
+    const indexId = instanceIndexSecretId(secretPrefix);
+    // What the account actually holds vs what the index claims.
+    const actual = [...new Set(await scanInstanceKeys(smClient, secretPrefix))].sort();
+    let listed = [];
+    let indexExists = true;
+    let malformed = false;
+    try {
+        const res = await smClient.send(new GetSecretValueCommand({ SecretId: indexId }));
+        try {
+            listed = parseInstanceIndex(res.SecretString ?? "");
+        }
+        catch {
+            malformed = true;
+            logInfo(`Existing index at ${indexId} is malformed — rebuilding from scratch.`);
+        }
+    }
+    catch (err) {
+        if (!isResourceNotFound(err))
+            throw err;
+        indexExists = false;
+        logInfo(`No index at ${indexId} yet — it will be created.`);
+    }
+    const missing = actual.filter((k) => !listed.includes(k));
+    const stale = listed.filter((k) => !actual.includes(k));
+    logInfo(`Instances in Secrets Manager: ${actual.length ? actual.join(", ") : "(none)"}`);
+    if (missing.length > 0)
+        logInfo(`Missing from index: ${missing.join(", ")}`);
+    if (stale.length > 0)
+        logInfo(`Stale in index (secret gone): ${stale.join(", ")}`);
+    if (indexAlreadyMatches(missing, stale, indexExists, malformed)) {
+        logSuccess(`Index at ${indexId} already matches — nothing to do.`);
+        return;
+    }
+    if (opts.dryRun) {
+        logInfo(`Dry run — would write ${indexId} with ${actual.length} instance(s).`);
+        return;
+    }
+    await writeInstanceIndex(smClient, secretPrefix, serviceName, actual);
+    logSuccess(`Index rebuilt: ${indexId} now lists ${actual.length} instance(s).`);
+}
+/**
+ * Write the canonical index value for `keys`, creating the index secret when
+ * it does not exist. The create path warns that the secret is not
+ * stack-managed: the declaring stack also declares it, and created here
+ * first it is not in the stack's state, so the stack's next deploy fails on
+ * the name collision until the secret is imported or deleted.
+ */
+export async function writeInstanceIndex(client, secretPrefix, serviceName, keys) {
+    const indexId = instanceIndexSecretId(secretPrefix);
+    const secretString = buildInstanceIndexValue(keys);
+    try {
+        await client.send(new PutSecretValueCommand({ SecretId: indexId, SecretString: secretString }));
+    }
+    catch (err) {
+        if (!isResourceNotFound(err))
+            throw err;
+        await client.send(new CreateSecretCommand({
+            Name: indexId,
+            Description: `Instance-key index for ${serviceName} (read by listInstances(); maintained by mesh secrets set/reindex and the Hub)`,
+            SecretString: secretString,
+            Tags: [
+                { Key: "mesh:type", Value: "external-service-index" },
+                { Key: "mesh:service", Value: serviceName },
+            ],
+        }));
+        logInfo(`Created ${indexId} OUT OF BAND — the declaring stack does not manage it. ` +
+            `Deploy the declaring stack BEFORE reindex next time, or import this ` +
+            `secret into the stack before its next deploy.`);
+    }
+}
+//# sourceMappingURL=reindex.js.map

package/dist/src/commands/secrets/reindex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reindex.js","sourceRoot":"","sources":["../../../../src/commands/secrets/reindex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,kBAAkB,GACnB,MAAM,UAAU,CAAC;AAElB;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAA4B,EAC5B,YAAoB;IAEpB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,SAA6B,CAAC;IAClC,GAAG,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,IAAI,kBAAkB,CAAC;YACrB,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,YAAY,GAAG,CAAC,EAAE,CAAC;YACxD,SAAS,EAAE,SAAS;SACrB,CAAC,CACH,CAAC;QACF,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACtF,IAAI,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACjC,CAAC,QAAQ,SAAS,EAAE;IACpB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAiB,EACjB,KAAe,EACf,WAAoB,EACpB,SAAkB;IAElB,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,IAAI,CAAC,SAAS,CAAC;AACjF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,WAA+B,EAC/B,IAKC;IAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW,CAAC;IAEpE,MAAM,4BAA4B,CAAC,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IAE9D,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAEtD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAC7C,SAAS,EACT,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,WAAW,CACpB,CAAC;IAEF,MAAM,WAAW,GAAG,WAAW,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,IAAI,WAAW,EAAE,CAAC;YAChB,QAAQ,CAAC,qBAAqB,WAAW,cAAc,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3E,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,cAAc,GAAG,CAAC,MAAO,CAAC,OAAO,GAAG,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAClD,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;IACvC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACzB,QAAQ,CACN,IAAI,WAAW,+DAA+D,CAC/E,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;IAC3C,MAAM,OAAO,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IAEpD,4DAA4D;IAC5D,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,gBAAgB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnF,IAAI,MAAM,GAAa,EAAE,CAAC;IAC1B,IAAI,WAAW,GAAG,IAAI,CAAC;IACvB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC;YACH,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,IAAI,CAAC;YACjB,OAAO,CAAC,qBAAqB,OAAO,0CAA0C,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;QACxC,WAAW,GAAG,KAAK,CAAC;QACpB,OAAO,CAAC,eAAe,OAAO,4BAA4B,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAExD,OAAO,CAAC,iCAAiC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,iCAAiC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnF,IAAI,mBAAmB,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;QAChE,UAAU,CAAC,YAAY,OAAO,mCAAmC,CAAC,CAAC;QACnE,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,CAAC,yBAAyB,OAAO,SAAS,MAAM,CAAC,MAAM,eAAe,CAAC,CAAC;QAC/E,OAAO;IACT,CAAC;IAED,MAAM,kBAAkB,CAAC,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IACtE,UAAU,CAAC,kBAAkB,OAAO,cAAc,MAAM,CAAC,MAAM,eAAe,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAA4B,EAC5B,YAAoB,EACpB,WAAmB,EACnB,IAAc;IAEd,MAAM,OAAO,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAC7E,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;QACxC,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,mBAAmB,CAAC;YACtB,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,0BAA0B,WAAW,gFAAgF;YAClI,YAAY,EAAE,YAAY;YAC1B,IAAI,EAAE;gBACJ,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,wBAAwB,EAAE;gBACrD,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE;aAC5C;SACF,CAAC,CACH,CAAC;QACF,OAAO,CACL,WAAW,OAAO,yDAAyD;YACzE,sEAAsE;YACtE,+CAA+C,CAClD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/src/commands/secrets/set.d.ts

@@ -15,6 +15,50 @@
  *
  * The command detects tenant/stage from Pulumi config in the current directory.
  */
+import { SSMClient } from "@aws-sdk/client-ssm";
+import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+/**
+ * Ensure AWS credentials are available for the SSM/Secrets Manager calls. If the
+ * environment has none, assume the stack's `mesh:deployerRole` — which triggers
+ * `mesh login` automatically when there's no active session. No-op when
+ * credentials are already present or the stack/role can't be resolved.
+ *
+ * The stack is the locally-detected stage (from the `Pulumi.<stage>.yaml`
+ * filename) — NOT `pulumi stack --show-name`, which would itself need creds to
+ * read the backend (the chicken-and-egg this is meant to avoid).
+ */
+export declare function ensureAwsCredentialsForStack(stack: string | undefined): Promise<void>;
+/** Leaf field in the credential schema */
+interface SchemaField {
+    type: "field";
+    name: string;
+    description: string;
+    secret: boolean;
+    optional: boolean;
+}
+/** Group of fields (may nest further) */
+interface SchemaGroup {
+    type: "group";
+    name: string;
+    description: string;
+    fields: Record<string, SchemaField | SchemaGroup>;
+}
+/** A schema entry is either a leaf field or a nested group */
+type SchemaEntry = SchemaField | SchemaGroup;
+export interface CredentialSchema {
+    fields: Record<string, SchemaEntry>;
+    keyedBy: string | null;
+}
+export interface ExternalServiceMeta {
+    name: string;
+    type: string;
+    description: string;
+    secretPrefix: string;
+}
+export declare function discoverExternalServices(ssmClient: SSMClient, tenant: string, platformEnv: string): Promise<Map<string, {
+    meta: ExternalServiceMeta;
+    schema?: CredentialSchema;
+}>>;
 export declare function setCommand(servicePath: string | undefined, opts: {
     key?: string;
     all?: boolean;
@@ -23,4 +67,23 @@ export declare function setCommand(servicePath: string | undefined, opts: {
     stage?: string;
     region?: string;
 }): Promise<void>;
+export declare function isResourceNotFound(err: unknown): boolean;
+/**
+ * Add an instance key to the service's instance index at
+ * `{secretPrefix}/.index` — the list `listInstances()` reads. Read-modify-
+ * write: a MISSING index is created from just this key (the deploy normally
+ * seeds an empty one), an already-listed key is a no-op. A MALFORMED index
+ * is deliberately left alone (warn only): rebuilding it from just this key
+ * would silently drop the rest of the fleet from the list, so the full
+ * repair belongs to `mesh secrets reindex`. The read-modify-write itself is
+ * unguarded — Secrets Manager has no conditional put — so two concurrent
+ * writers to the same service can drop a key; same repair.
+ *
+ * Non-fatal by design, like the `.config` mirror: the credential itself is
+ * already written, so failing the whole command here would report a write
+ * that succeeded as failed. The cost of skipping is an instance invisible to
+ * `listInstances()` until repaired — the warning names the repair.
+ */
+export declare function addKeyToInstanceIndex(client: SecretsManagerClient, secretPrefix: string, key: string, serviceName: string): Promise<void>;
+export {};
 //# sourceMappingURL=set.d.ts.map

package/dist/src/commands/secrets/set.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"set.d.ts","sourceRoot":"","sources":["../../../../src/commands/secrets/set.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA4RH,wBAAsB,UAAU,CAC9B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACA,OAAO,CAAC,IAAI,CAAC,CA6Hf"}
+{"version":3,"file":"set.d.ts","sourceRoot":"","sources":["../../../../src/commands/secrets/set.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,SAAS,EAEV,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EAIrB,MAAM,iCAAiC,CAAC;AAezC;;;;;;;;;GASG;AACH,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAY3F;AAMD,0CAA0C;AAC1C,UAAU,WAAW;IACnB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,yCAAyC;AACzC,UAAU,WAAW;IACnB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CAAC,CAAC;CACnD;AAED,8DAA8D;AAC9D,KAAK,WAAW,GAAG,WAAW,GAAG,WAAW,CAAC;AAE7C,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AA2CD,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;CAAE,CAAC,CAAC,CAwDhF;AAuGD,wBAAsB,UAAU,CAC9B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACA,OAAO,CAAC,IAAI,CAAC,CA6If;AAMD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAgBxD;AAsFD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,oBAAoB,EAC5B,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CA8Cf"}

package/dist/src/commands/secrets/set.js

@@ -19,6 +19,7 @@ import { SSMClient, GetParametersByPathCommand, } from "@aws-sdk/client-ssm";
 import { SecretsManagerClient, GetSecretValueCommand, PutSecretValueCommand, CreateSecretCommand, } from "@aws-sdk/client-secrets-manager";
 import input from "@inquirer/input";
 import password from "@inquirer/password";
+import { buildInstanceIndexValue, instanceIndexSecretId, isInstanceKey, parseInstanceIndex, } from "@mesh-tech/secrets";
 import { detectContext } from "../../utils/context.js";
 import { logInfo, logSuccess, logError } from "../../utils/log.js";
 import { resolveStackOption } from "../../utils/stack-flag.js";
@@ -34,7 +35,7 @@ import { resolveAwsCredentials } from "../../utils/aws-auth.js";
  * filename) — NOT `pulumi stack --show-name`, which would itself need creds to
  * read the backend (the chicken-and-egg this is meant to avoid).
  */
-async function ensureAwsCredentialsForStack(stack) {
+export async function ensureAwsCredentialsForStack(stack) {
     if (process.env.AWS_ACCESS_KEY_ID || process.env.AWS_SESSION_TOKEN)
         return;
     if (!stack)
@@ -83,7 +84,7 @@ function normalizeFields(raw) {
 // =============================================================================
 // SSM discovery
 // =============================================================================
-async function discoverExternalServices(ssmClient, tenant, platformEnv) {
+export async function discoverExternalServices(ssmClient, tenant, platformEnv) {
     const services = new Map();
     const basePath = `/mesh-platform/${tenant}/${platformEnv}`;
     let nextToken;
@@ -255,6 +256,13 @@ export async function setCommand(servicePath, opts) {
             `Specify an instance:\n  mesh secrets set external/${serviceName} --key=<${schema.keyedBy}>`);
         process.exit(1);
     }
+    // A reserved dot-name (`.index`, `.config`) or a path-bearing key would
+    // write credential JSON over the service's bookkeeping secrets.
+    if (opts.key && !isInstanceKey(opts.key)) {
+        logError(`Invalid instance key "${opts.key}": keys must not contain "/", start with ".", ` +
+            `or end with ".config" — those names are reserved for the index and config mirrors.`);
+        process.exit(1);
+    }
     // Read existing values (if any)
     let existing = {};
     try {
@@ -282,6 +290,9 @@ export async function setCommand(servicePath, opts) {
         const merged = deepMerge(existing, values);
         await writeSecret(smClient, secretId, merged, svc.meta);
         await writeConfigMirror(smClient, secretId, schema, merged, svc.meta);
+        if (opts.key) {
+            await addKeyToInstanceIndex(smClient, secretPrefix, opts.key, serviceName);
+        }
         logSuccess(`Credentials written to ${secretId}`);
         return;
     }
@@ -299,6 +310,9 @@ export async function setCommand(servicePath, opts) {
     const merged = deepMerge(existing, values);
     await writeSecret(smClient, secretId, merged, svc.meta);
     await writeConfigMirror(smClient, secretId, schema, merged, svc.meta);
+    if (opts.key) {
+        await addKeyToInstanceIndex(smClient, secretPrefix, opts.key, serviceName);
+    }
     logSuccess(`Credentials written to ${secretId}`);
     // Show summary
     console.error("\nStored fields:");
@@ -308,7 +322,7 @@ export async function setCommand(servicePath, opts) {
 // =============================================================================
 // Helpers
 // =============================================================================
-function isResourceNotFound(err) {
+export function isResourceNotFound(err) {
     const e = err;
     return (e?.name === "ResourceNotFoundException" ||
         e?.__type === "ResourceNotFoundException" ||
@@ -380,6 +394,67 @@ function extractNonSecretFields(fields, values) {
     }
     return result;
 }
+/**
+ * Add an instance key to the service's instance index at
+ * `{secretPrefix}/.index` — the list `listInstances()` reads. Read-modify-
+ * write: a MISSING index is created from just this key (the deploy normally
+ * seeds an empty one), an already-listed key is a no-op. A MALFORMED index
+ * is deliberately left alone (warn only): rebuilding it from just this key
+ * would silently drop the rest of the fleet from the list, so the full
+ * repair belongs to `mesh secrets reindex`. The read-modify-write itself is
+ * unguarded — Secrets Manager has no conditional put — so two concurrent
+ * writers to the same service can drop a key; same repair.
+ *
+ * Non-fatal by design, like the `.config` mirror: the credential itself is
+ * already written, so failing the whole command here would report a write
+ * that succeeded as failed. The cost of skipping is an instance invisible to
+ * `listInstances()` until repaired — the warning names the repair.
+ */
+export async function addKeyToInstanceIndex(client, secretPrefix, key, serviceName) {
+    const indexId = instanceIndexSecretId(secretPrefix);
+    try {
+        let keys = [];
+        try {
+            const res = await client.send(new GetSecretValueCommand({ SecretId: indexId }));
+            keys = parseInstanceIndex(res.SecretString ?? "");
+        }
+        catch (err) {
+            if (!isResourceNotFound(err))
+                throw err;
+            // Pre-index deployment: the write below creates the index.
+        }
+        if (keys.includes(key))
+            return;
+        const secretString = buildInstanceIndexValue([...keys, key]);
+        try {
+            await client.send(new PutSecretValueCommand({ SecretId: indexId, SecretString: secretString }));
+        }
+        catch (err) {
+            if (!isResourceNotFound(err))
+                throw err;
+            await client.send(new CreateSecretCommand({
+                Name: indexId,
+                Description: `Instance-key index for ${serviceName} (read by listInstances(); maintained by mesh secrets set/reindex and the Hub)`,
+                SecretString: secretString,
+                Tags: [
+                    { Key: "mesh:type", Value: "external-service-index" },
+                    { Key: "mesh:service", Value: serviceName },
+                ],
+            }));
+            // The declaring stack also declares this secret; created here first,
+            // it is not in the stack's state, and the stack's next deploy fails on
+            // the name collision until the secret is imported or deleted.
+            logInfo(`Created ${indexId} OUT OF BAND — the declaring stack does not manage it. ` +
+                `Deploy the declaring stack (it creates the index) before writing keys, or ` +
+                `import this secret into the stack before its next deploy.`);
+        }
+    }
+    catch (err) {
+        logInfo(`Warning: failed to record instance "${key}" in ${indexId} — ` +
+            `listInstances() will not see it until you run: ` +
+            `mesh secrets reindex external/${serviceName} (${err})`);
+    }
+}
 async function writeConfigMirror(client, secretId, schema, merged, meta) {
     const configId = `${secretId}/.config`;
     const configValues = extractNonSecretFields(schema.fields, merged);

package/dist/src/commands/secrets/set.js.map

@@ -1 +1 @@
-{"version":3,"file":"set.js","sourceRoot":"","sources":["../../../../src/commands/secrets/set.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,SAAS,EACT,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,MAAM,iBAAiB,CAAC;AACpC,OAAO,QAAQ,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE;;;;;;;;;GASG;AACH,KAAK,UAAU,4BAA4B,CAAC,KAAyB;IACnE,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAAE,OAAO;IAC3E,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,mBAAmB,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACtE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACjC,CAAC;AACH,CAAC;AAsCD,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAA4B;IAClD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACvC,OAAO;YACL,IAAI,EAAE,OAAO;YACb,IAAI,EAAG,GAAG,CAAC,IAAe,IAAI,EAAE;YAChC,WAAW,EAAG,GAAG,CAAC,WAAsB,IAAI,EAAE;YAC9C,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,MAAiD,CAAC;SAC/E,CAAC;IACJ,CAAC;IAED,6DAA6D;IAC7D,OAAO;QACL,IAAI,EAAE,OAAO;QACb,IAAI,EAAG,GAAG,CAAC,IAAe,IAAI,EAAE;QAChC,WAAW,EAAG,GAAG,CAAC,WAAsB,IAAI,EAAE;QAC9C,MAAM,EAAG,GAAG,CAAC,MAAkB,IAAI,KAAK;QACxC,QAAQ,EAAG,GAAG,CAAC,QAAoB,IAAI,KAAK;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,GAA4C;IAE5C,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF,KAAK,UAAU,wBAAwB,CACrC,SAAoB,EACpB,MAAc,EACd,WAAmB;IAEnB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoE,CAAC;IAE7F,MAAM,QAAQ,GAAG,kBAAkB,MAAM,IAAI,WAAW,EAAE,CAAC;IAC3D,IAAI,SAA6B,CAAC;IAElC,GAAG,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CACnC,IAAI,0BAA0B,CAAC;YAC7B,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,SAAS;SACrB,CAAC,CACH,CAAC;QAEF,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK;gBAAE,SAAS;YAE1C,2CAA2C;YAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAChC,qCAAqC,CACtC,CAAC;YACF,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnB,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;gBACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAwB,CAAC;gBAC5D,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC3C,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,CAAC;YAED,kDAAkD;YAClD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAChC,4CAA4C,CAC7C,CAAC;YACF,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnB,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;gBACjC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAGjC,CAAC;gBACF,MAAM,MAAM,GAAqB;oBAC/B,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;oBACnC,OAAO,EAAE,GAAG,CAAC,OAAO;iBACrB,CAAC;gBACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC3C,IAAI,QAAQ,EAAE,CAAC;oBACb,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;gBAC3B,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,EAAyB,EAAE,MAAM,EAAE,CAAC,CAAC;gBACzE,CAAC;YACH,CAAC;QACH,CAAC;QAED,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACjC,CAAC,QAAQ,SAAS,EAAE;IAEpB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF,gFAAgF;AAChF,kCAAkC;AAClC,gFAAgF;AAEhF;;;GAGG;AACH,KAAK,UAAU,YAAY,CACzB,MAAmC,EACnC,QAAiC,EACjC,MAA+B,EAC/B,IAAsB,EACtB,QAAgB,CAAC;IAEjB,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3B,iBAAiB;YACjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC;YAE9C,8BAA8B;YAC9B,MAAM,aAAa,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC5E,MAAM,WAAW,GAA4B,EAAE,CAAC;YAEhD,MAAM,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAE9E,MAAM,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,aAAa;YACb,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;gBAChC,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACvC,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;oBACpD,MAAM,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC;gBACjC,CAAC;gBACD,SAAS;YACX,CAAC;YAED,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAuB,CAAC;YAC7D,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,IAAI,WAAW,KAAK,EAAE,CAAC;YAExD,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW;gBAC/B,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,WAAW,GAAG;gBACxC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;YAEf,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;YAEjE,IAAI,KAAa,CAAC;YAElB,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,KAAK,GAAG,MAAM,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;gBACtD,2CAA2C;gBAC3C,IAAI,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;oBAC1B,KAAK,GAAG,WAAY,CAAC;gBACvB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,MAAM,KAAK,CAAC;oBAClB,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;iBAC/C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,WAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF,SAAS,cAAc,CACrB,MAAmC,EACnC,MAA+B,EAC/B,QAAgB,CAAC;IAEjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAElC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;YACzC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC7D,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxD,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,WAA+B,EAC/B,IAOC;IAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW,CAAC;IAEpE,yEAAyE;IACzE,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,4BAA4B,CAAC,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IAE9D,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAEtD,iCAAiC;IACjC,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAC7C,SAAS,EACT,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,WAAW,CACpB,CAAC;IAEF,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACxB,QAAQ,CACN,gEAAgE;YAC9D,6EAA6E,CAChF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,sEAAsE;IACtE,IAAI,WAA+B,CAAC;IACpC,IAAI,WAAW,EAAE,CAAC;QAChB,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,uDAAuD;IACvD,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,IAAI,WAAW,EAAE,CAAC;YAChB,QAAQ,CAAC,qBAAqB,WAAW,cAAc,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC3D,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;IACvC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAE1B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,QAAQ,CAAC,mCAAmC,WAAW,IAAI,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,wBAAwB;IACxB,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;IAEzE,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,QAAQ,CACN,IAAI,WAAW,iCAAiC,MAAM,CAAC,OAAO,KAAK;YACjE,qDAAqD,WAAW,WAAW,MAAM,CAAC,OAAO,GAAG,CAC/F,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,gCAAgC;IAChC,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAClC,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAClD,CAAC;QACF,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC1B,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,8DAA8D;IAChE,CAAC;IAED,iDAAiD;IACjD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,6EAA6E,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACtE,UAAU,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IAED,mBAAmB;IACnB,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,4BAA4B,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,WAAW,EAAE,CAAC,CAAC;IAC3E,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,aAAa,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;IAE/B,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAEzE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAElB,kBAAkB;IAClB,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAEtE,UAAU,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;IAEjD,eAAe;IACf,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAClC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACpB,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,SAAS,kBAAkB,CAAC,GAAY;IACtC,MAAM,CAAC,GAAG,GAMT,CAAC;IAEF,OAAO,CACL,CAAC,EAAE,IAAI,KAAK,2BAA2B;QACvC,CAAC,EAAE,MAAM,KAAK,2BAA2B;QACzC,CAAC,EAAE,IAAI,KAAK,2BAA2B;QACvC,CAAC,EAAE,IAAI,KAAK,2BAA2B;QACvC,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC,CACpF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAS,SAAS,CAChB,MAA+B,EAC/B,MAA+B;IAE/B,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IACE,KAAK,KAAK,IAAI;YACd,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACrB,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ;YAC/B,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI;YACpB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAC3B,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CACrB,MAAM,CAAC,GAAG,CAA4B,EACtC,KAAgC,CACjC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,MAA4B,EAC5B,QAAgB,EAChB,MAA+B,EAC/B,IAAyB;IAEzB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAE5C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,qBAAqB,CAAC;YACxB,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,YAAY;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,4CAA4C;YAC5C,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,mBAAmB,CAAC;gBACtB,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,oCAAoC,IAAI,CAAC,IAAI,aAAa;gBACvE,YAAY,EAAE,YAAY;gBAC1B,IAAI,EAAE;oBACJ,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,kBAAkB,EAAE;oBAC/C,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;iBAC1C;aACF,CAAC,CACH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAC7B,MAAmC,EACnC,MAA+B;IAE/B,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YACnE,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACnE,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrC,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;YACzB,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YACtD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,MAA4B,EAC5B,QAAgB,EAChB,MAAwB,EACxB,MAA+B,EAC/B,IAAyB;IAEzB,MAAM,QAAQ,GAAG,GAAG,QAAQ,UAAU,CAAC;IACvC,MAAM,YAAY,GAAG,sBAAsB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,qBAAqB,CAAC;gBACxB,QAAQ,EAAE,QAAQ;gBAClB,YAAY,EAAE,YAAY;aAC3B,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,mBAAmB,CAAC;oBACtB,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,oCAAoC,IAAI,CAAC,IAAI,gBAAgB;oBAC1E,YAAY,EAAE,YAAY;oBAC1B,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;iBAC/D,CAAC,CACH,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uDAAuD;QACvD,OAAO,CAAC,8CAA8C,QAAQ,KAAK,GAAG,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC"}
+{"version":3,"file":"set.js","sourceRoot":"","sources":["../../../../src/commands/secrets/set.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,SAAS,EACT,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,MAAM,iBAAiB,CAAC;AACpC,OAAO,QAAQ,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAAyB;IAC1E,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAAE,OAAO;IAC3E,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,mBAAmB,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACtE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACjC,CAAC;AACH,CAAC;AAsCD,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAA4B;IAClD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACvC,OAAO;YACL,IAAI,EAAE,OAAO;YACb,IAAI,EAAG,GAAG,CAAC,IAAe,IAAI,EAAE;YAChC,WAAW,EAAG,GAAG,CAAC,WAAsB,IAAI,EAAE;YAC9C,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,MAAiD,CAAC;SAC/E,CAAC;IACJ,CAAC;IAED,6DAA6D;IAC7D,OAAO;QACL,IAAI,EAAE,OAAO;QACb,IAAI,EAAG,GAAG,CAAC,IAAe,IAAI,EAAE;QAChC,WAAW,EAAG,GAAG,CAAC,WAAsB,IAAI,EAAE;QAC9C,MAAM,EAAG,GAAG,CAAC,MAAkB,IAAI,KAAK;QACxC,QAAQ,EAAG,GAAG,CAAC,QAAoB,IAAI,KAAK;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,GAA4C;IAE5C,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,SAAoB,EACpB,MAAc,EACd,WAAmB;IAEnB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoE,CAAC;IAE7F,MAAM,QAAQ,GAAG,kBAAkB,MAAM,IAAI,WAAW,EAAE,CAAC;IAC3D,IAAI,SAA6B,CAAC;IAElC,GAAG,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CACnC,IAAI,0BAA0B,CAAC;YAC7B,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,SAAS;SACrB,CAAC,CACH,CAAC;QAEF,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK;gBAAE,SAAS;YAE1C,2CAA2C;YAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAChC,qCAAqC,CACtC,CAAC;YACF,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnB,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;gBACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAwB,CAAC;gBAC5D,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC3C,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,CAAC;YAED,kDAAkD;YAClD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAChC,4CAA4C,CAC7C,CAAC;YACF,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnB,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;gBACjC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAGjC,CAAC;gBACF,MAAM,MAAM,GAAqB;oBAC/B,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;oBACnC,OAAO,EAAE,GAAG,CAAC,OAAO;iBACrB,CAAC;gBACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC3C,IAAI,QAAQ,EAAE,CAAC;oBACb,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;gBAC3B,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,EAAyB,EAAE,MAAM,EAAE,CAAC,CAAC;gBACzE,CAAC;YACH,CAAC;QACH,CAAC;QAED,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACjC,CAAC,QAAQ,SAAS,EAAE;IAEpB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF,gFAAgF;AAChF,kCAAkC;AAClC,gFAAgF;AAEhF;;;GAGG;AACH,KAAK,UAAU,YAAY,CACzB,MAAmC,EACnC,QAAiC,EACjC,MAA+B,EAC/B,IAAsB,EACtB,QAAgB,CAAC;IAEjB,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3B,iBAAiB;YACjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC;YAE9C,8BAA8B;YAC9B,MAAM,aAAa,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC5E,MAAM,WAAW,GAA4B,EAAE,CAAC;YAEhD,MAAM,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAE9E,MAAM,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,aAAa;YACb,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;gBAChC,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACvC,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;oBACpD,MAAM,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC;gBACjC,CAAC;gBACD,SAAS;YACX,CAAC;YAED,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAuB,CAAC;YAC7D,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,IAAI,WAAW,KAAK,EAAE,CAAC;YAExD,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW;gBAC/B,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,WAAW,GAAG;gBACxC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;YAEf,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;YAEjE,IAAI,KAAa,CAAC;YAElB,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,KAAK,GAAG,MAAM,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;gBACtD,2CAA2C;gBAC3C,IAAI,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;oBAC1B,KAAK,GAAG,WAAY,CAAC;gBACvB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,MAAM,KAAK,CAAC;oBAClB,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;iBAC/C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,WAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF,SAAS,cAAc,CACrB,MAAmC,EACnC,MAA+B,EAC/B,QAAgB,CAAC;IAEjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAElC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;YACzC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC7D,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxD,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,WAA+B,EAC/B,IAOC;IAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW,CAAC;IAEpE,yEAAyE;IACzE,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,4BAA4B,CAAC,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IAE9D,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAEtD,iCAAiC;IACjC,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAC7C,SAAS,EACT,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,WAAW,CACpB,CAAC;IAEF,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACxB,QAAQ,CACN,gEAAgE;YAC9D,6EAA6E,CAChF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,sEAAsE;IACtE,IAAI,WAA+B,CAAC;IACpC,IAAI,WAAW,EAAE,CAAC;QAChB,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,uDAAuD;IACvD,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,IAAI,WAAW,EAAE,CAAC;YAChB,QAAQ,CAAC,qBAAqB,WAAW,cAAc,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC3D,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;IACvC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAE1B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,QAAQ,CAAC,mCAAmC,WAAW,IAAI,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,wBAAwB;IACxB,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;IAEzE,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,QAAQ,CACN,IAAI,WAAW,iCAAiC,MAAM,CAAC,OAAO,KAAK;YACjE,qDAAqD,WAAW,WAAW,MAAM,CAAC,OAAO,GAAG,CAC/F,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,wEAAwE;IACxE,gEAAgE;IAChE,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,QAAQ,CACN,yBAAyB,IAAI,CAAC,GAAG,gDAAgD;YAC/E,oFAAoF,CACvF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,gCAAgC;IAChC,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAClC,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAClD,CAAC;QACF,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC1B,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,8DAA8D;IAChE,CAAC;IAED,iDAAiD;IACjD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,6EAA6E,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,MAAM,qBAAqB,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7E,CAAC;QACD,UAAU,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IAED,mBAAmB;IACnB,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,4BAA4B,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,WAAW,EAAE,CAAC,CAAC;IAC3E,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,aAAa,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;IAE/B,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAEzE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAElB,kBAAkB;IAClB,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACtE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,MAAM,qBAAqB,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC7E,CAAC;IAED,UAAU,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;IAEjD,eAAe;IACf,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAClC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACpB,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,CAAC,GAAG,GAMT,CAAC;IAEF,OAAO,CACL,CAAC,EAAE,IAAI,KAAK,2BAA2B;QACvC,CAAC,EAAE,MAAM,KAAK,2BAA2B;QACzC,CAAC,EAAE,IAAI,KAAK,2BAA2B;QACvC,CAAC,EAAE,IAAI,KAAK,2BAA2B;QACvC,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC,CACpF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAS,SAAS,CAChB,MAA+B,EAC/B,MAA+B;IAE/B,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IACE,KAAK,KAAK,IAAI;YACd,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACrB,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ;YAC/B,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI;YACpB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAC3B,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CACrB,MAAM,CAAC,GAAG,CAA4B,EACtC,KAAgC,CACjC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,MAA4B,EAC5B,QAAgB,EAChB,MAA+B,EAC/B,IAAyB;IAEzB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAE5C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,qBAAqB,CAAC;YACxB,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,YAAY;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,4CAA4C;YAC5C,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,mBAAmB,CAAC;gBACtB,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,oCAAoC,IAAI,CAAC,IAAI,aAAa;gBACvE,YAAY,EAAE,YAAY;gBAC1B,IAAI,EAAE;oBACJ,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,kBAAkB,EAAE;oBAC/C,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;iBAC1C;aACF,CAAC,CACH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAC7B,MAAmC,EACnC,MAA+B;IAE/B,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YACnE,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACnE,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrC,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;YACzB,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YACtD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAA4B,EAC5B,YAAoB,EACpB,GAAW,EACX,WAAmB;IAEnB,MAAM,OAAO,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,IAAI,IAAI,GAAa,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAChF,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YACxC,2DAA2D;QAC7D,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO;QAC/B,MAAM,YAAY,GAAG,uBAAuB,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAC7E,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YACxC,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,mBAAmB,CAAC;gBACtB,IAAI,EAAE,OAAO;gBACb,WAAW,EAAE,0BAA0B,WAAW,gFAAgF;gBAClI,YAAY,EAAE,YAAY;gBAC1B,IAAI,EAAE;oBACJ,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,wBAAwB,EAAE;oBACrD,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE;iBAC5C;aACF,CAAC,CACH,CAAC;YACF,qEAAqE;YACrE,uEAAuE;YACvE,8DAA8D;YAC9D,OAAO,CACL,WAAW,OAAO,yDAAyD;gBACzE,4EAA4E;gBAC5E,2DAA2D,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CACL,uCAAuC,GAAG,QAAQ,OAAO,KAAK;YAC5D,iDAAiD;YACjD,iCAAiC,WAAW,KAAK,GAAG,GAAG,CAC1D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,MAA4B,EAC5B,QAAgB,EAChB,MAAwB,EACxB,MAA+B,EAC/B,IAAyB;IAEzB,MAAM,QAAQ,GAAG,GAAG,QAAQ,UAAU,CAAC;IACvC,MAAM,YAAY,GAAG,sBAAsB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,qBAAqB,CAAC;gBACxB,QAAQ,EAAE,QAAQ;gBAClB,YAAY,EAAE,YAAY;aAC3B,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,mBAAmB,CAAC;oBACtB,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,oCAAoC,IAAI,CAAC,IAAI,gBAAgB;oBAC1E,YAAY,EAAE,YAAY;oBAC1B,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;iBAC/D,CAAC,CACH,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uDAAuD;QACvD,OAAO,CAAC,8CAA8C,QAAQ,KAAK,GAAG,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mesh-tech/mesh-cli",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "CLI for Mesh platform development utilities",
   "type": "module",
   "license": "UNLICENSED",
@@ -33,7 +33,7 @@
     "./package.json": "./package.json"
   },
   "devDependencies": {
-    "@mesh-tech/tsconfig": "1.47.1",
+    "@mesh-tech/tsconfig": "1.50.1",
     "@mesh-tech/workflow-viz": "0.2.1",
     "@tanstack/intent": "^0.3.6",
     "@types/node": "^20.0.0",
@@ -48,6 +48,7 @@
     "@inquirer/input": "^4.2.1",
     "@inquirer/password": "^4.0.17",
     "@inquirer/select": "^4.3.1",
+    "@mesh-tech/secrets": "0.1.0",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
     "handlebars": "^4.7.8",

package/skills/core/SKILL.md

@@ -102,7 +102,7 @@ Top-level commands (each `register*` is wired in `src/program.ts`, which `bin/me
 | `mesh stack` | `init`, `rm <name>` | `init` creates a personal dev stack `dev-{github-user}`, copying base-stack config, setting `mesh:deploy: false`, inheriting KMS secrets provider; `--worktree` appends the git-worktree token (`dev-{user}-{token}`) so concurrent worktrees deploy to **distinct** stacks (SSM paths, Temporal namespace, Nexus endpoint all derive from the stack name → one discriminator isolates all three; no-op on the primary checkout). `rm <name>` removes a personal stack (backend state + local config), credentialed. Both assume the deployer role — no raw `pulumi` / manual creds needed. | `init`: `--from <stack>`, `--name <stack>`, `--worktree`; `rm`: `--yes` |
 | `mesh tenant` | `add <name>`, `list` | Register/inspect app tenants on a platform stack. Run from the **platform layer** of a tenant platform repo (e.g. `mesh-sandbox/platform`). `add` inserts the tenant under `mesh:tenants` in `Pulumi.<stack>.yaml` via a comment-preserving YAML round-trip (untouched lines don't reformat), refuses a tenant that is already declared (an existing entry may carry fields a re-add would drop), derives the `{name}-{env}` subdomain from the stack name (echoed in the success line), and guards against running on the core layer or an app dir; it then prints the deploy + verify sequence — `mesh deploy up` is what makes the registration live. `list` prints what the stack config declares, so "is it registered?" is answerable without opening YAML (warns when the project doesn't look like a platform layer, so an empty result isn't mistaken for "no tenants"). | `add`: `--display-name <name>`, `--subdomain <sub>`, `--zitadel-org-id <id>`, `--stack <stack>`, `--json`; `list`: `--stack <stack>`, `--json` |
 | `mesh tunnel [group]` | `external <name>` | SSM port-forward to platform services. Groups: `dev` (temporal+db), `temporal`. **`external <name>`** tunnels to a *registered* `ExternalService`: host/port are read from its credential secret (`mesh/{app-tenant}/{app-stage}/external/{name}`) — the same values deployed apps resolve at runtime — so anything the bastion can reach is tunnelable with no per-service CLI entry and no bastion services-map change. `-t/-e` are **optional everywhere** — they fall back to the same Pulumi/SST context detection `mesh dev` uses, and `AWS_REGION`/`AWS_PROFILE` default from the nearest Pulumi config + the `{tenant}-{env}` profile convention (region falls back to the effective profile's own `region` — the `[default]` profile when none was resolved — before the platform default us-east-2). | root: `-t/--tenant`, `-e/--env`, `-l/--list`, `-s/--services <csv\|group>`, `--db-port`, `--temporal-ui-port`, `--temporal-frontend-port`; `external`: `-p/--port` (default: the remote port), `-k/--key <key>` (multi-instance `credentials.keyedBy` externals), `--app-tenant`/`--app-stage` (credential axis; default to `-t`/`-e`) |
-| `mesh secrets` | `exec <command...>`, `set [service]`, `migrate-config` | Manage external-service creds in Secrets Manager. `exec` injects secrets as env; `set` reads field schema from SSM and prompts (or `--json`). | `set`: `--key <id>` (multi-instance), `--all`, `--json <str>`, `--stage`, `--region`; `migrate-config`: `--force`, `--dry-run`, `--stage`, `--region` |
+| `mesh secrets` | `exec <command...>`, `set [service]`, `reindex [service]`, `migrate-config` | Manage external-service creds in Secrets Manager. `exec` injects secrets as env; `set` reads field schema from SSM and prompts (or `--json`) — with `--key` it also records the instance in the service's instance index (`{prefix}/.index`, what `listInstances()` reads). `reindex` rebuilds that index from the per-key secrets actually in Secrets Manager (operator-credential `ListSecrets`) — the repair for an index that drifted (out-of-band secret create/delete, concurrent writers, malformed value) and the populate step when rolling the index out to an estate: **deploy the declaring stack first** (creates the managed, empty index), then `reindex`. | `set`: `--key <id>` (multi-instance), `--all`, `--json <str>`, `--stack`, `--region`; `reindex`: `--dry-run`, `--stack`, `--region`; `migrate-config`: `--force`, `--dry-run`, `--stack`, `--region` |
 | `mesh artifacts` | `get <ref>` | Download workflow artifact files from an AI-agent conversation. Ref `<conversationId>:<artifactId>` (artifactId defaults to `workflow-artifact`). | `-o/--output <dir>`, `--target <name>`, `--api-url <url>`, `--context <ctx>` (default `mesh.dev`) |
 | `mesh conversations` (alias `conv`) | `list`, `show <id>`, `artifacts <id>` | Read a deployed Mesh agent's conversations: list the caller's conversations, render a transcript, or list a conversation's artifacts. Resolves against the same `agent-targets` registry the MCP `agent_*` tools use. | all three: `--target <name>`, `--api-url <url>` (overrides `--target`), `--context <ctx>` (used with `--api-url`, default `mesh.dev`), `--json` (default when stdout isn't a TTY) |
 | `mesh vpn` | `connect <context>`, `disconnect`, `status`, `tunnel <up\|down\|status>`, `api-key`, `pre-auth-key`, `users` | Headscale VPN mgmt via Tailscale + kubectl. **`connect` now defaults to the userspace `tailscaled`** (brew formula, NOT the GUI Tailscale.app) — the same daemon `mesh dev --transport tailscale` / `mesh vpn tunnel` use, so it **runs headless / under the sandbox** and exposes a local SOCKS5 proxy (route a tool via `ALL_PROXY=socks5://127.0.0.1:<port>`). It relays a one-time browser-register URL for Zitadel auth. `--system` opts into the whole-machine GUI Tailscale.app (system TUN) — needs the app installed and **cannot run headless/sandboxed** (Sparkle.framework abort). For auto-forwarded VPC services (Temporal/RDS) prefer **`mesh vpn tunnel up`** or `mesh dev`. `tunnel status` reports runner **ownership** (`Runner: owned (verified)` vs `NOT OWNED (<reason>)` — a port answering a dial is not proof it's mesh's, MESH-2407); `--json` adds `owned` (bool) + `ownership` (reason string). Admin subcommands `exec` into the `headscale-0` pod. | root: `-t/--tenant` (default `mesh`), `-e/--env` (default `dev`), `-n/--namespace`; `connect`/`disconnect`: `--system`; `tunnel up`: `--context <ctx>`; `tunnel down`: `--stop` (stop daemon, keep login), `--logout`; `tunnel status`: `--json`; `pre-auth-key`: `-u/--user` (**required**), `--expiration <24h>`, `--reusable`, `--ephemeral` |
@@ -283,6 +283,8 @@ mesh db exec --secret <arn> -- node seed.js   # direct mode, skips SSM discovery
 mesh secrets set external/symitar                         # interactive (schema from SSM)
 mesh secrets set external/symitar --json '{"baseUrl":"…"}'
 mesh secrets set external/symitar --key 12345 --json '{…}'  # multi-instance (key = FI id)
+mesh secrets reindex external/symitar --dry-run           # show instance-index drift, write nothing
+mesh secrets reindex external/symitar                     # rebuild {prefix}/.index from real secrets
 mesh secrets exec -- node ./script.js                     # secrets injected as env
 ```