@mesh-tech/mesh-cli 0.18.0 → 0.18.2

package/dist/bin/mesh.js

@@ -809,8 +809,8 @@ var init_seed = __esm({
 // libs/mesh-cli/src/commands/local/helpers.ts
 import * as net from "net";
 async function upsertLocalSecret(secretId, value, client) {
-  const { SecretsManagerClient: SecretsManagerClient9, CreateSecretCommand: CreateSecretCommand4, PutSecretValueCommand: PutSecretValueCommand4 } = await import("@aws-sdk/client-secrets-manager");
-  const sm = client ?? new SecretsManagerClient9(LOCAL_AWS_CONFIG);
+  const { SecretsManagerClient: SecretsManagerClient10, CreateSecretCommand: CreateSecretCommand4, PutSecretValueCommand: PutSecretValueCommand4 } = await import("@aws-sdk/client-secrets-manager");
+  const sm = client ?? new SecretsManagerClient10(LOCAL_AWS_CONFIG);
   const secretString = JSON.stringify(value);
   try {
     await sm.send(new CreateSecretCommand4({ Name: secretId, SecretString: secretString }));
@@ -6316,12 +6316,12 @@ async function fetchRemoteExternalCredentials(tenant, env, external, profile) {
   const region = process.env.MESH_PLATFORM_REGION ?? process.env.AWS_REGION ?? "us-east-2";
   const fallbackProfile = !process.env.AWS_ACCESS_KEY_ID && !process.env.AWS_PROFILE ? process.env.MESH_AWS_PROFILE ?? profile : void 0;
   try {
-    const { SecretsManagerClient: SecretsManagerClient9, GetSecretValueCommand: GetSecretValueCommand9 } = await import("@aws-sdk/client-secrets-manager");
+    const { SecretsManagerClient: SecretsManagerClient10, GetSecretValueCommand: GetSecretValueCommand10 } = await import("@aws-sdk/client-secrets-manager");
     if (fallbackProfile) process.env.AWS_PROFILE = fallbackProfile;
-    const sm = new SecretsManagerClient9({ region });
+    const sm = new SecretsManagerClient10({ region });
     let res;
     try {
-      res = await sm.send(new GetSecretValueCommand9({ SecretId: secretId }));
+      res = await sm.send(new GetSecretValueCommand10({ SecretId: secretId }));
     } finally {
       if (fallbackProfile) delete process.env.AWS_PROFILE;
     }
@@ -6976,13 +6976,13 @@ async function writeRegistryParams(cliClientId, awsConfig) {
 }
 async function ensureOpsHubAdmin(pat, awsConfig) {
   const {
-    SecretsManagerClient: SecretsManagerClient9,
-    GetSecretValueCommand: GetSecretValueCommand9,
+    SecretsManagerClient: SecretsManagerClient10,
+    GetSecretValueCommand: GetSecretValueCommand10,
     CreateSecretCommand: CreateSecretCommand4,
     PutSecretValueCommand: PutSecretValueCommand4
   } = await import("@aws-sdk/client-secrets-manager");
-  const sm = new SecretsManagerClient9(awsConfig);
-  const existing = await sm.send(new GetSecretValueCommand9({ SecretId: OPS_HUB_SECRET_ID })).catch(() => null);
+  const sm = new SecretsManagerClient10(awsConfig);
+  const existing = await sm.send(new GetSecretValueCommand10({ SecretId: OPS_HUB_SECRET_ID })).catch(() => null);
   if (existing?.SecretString) {
     logSuccess("Hub admin key already provisioned (Zitadel writes enabled)");
     return;
@@ -7242,9 +7242,9 @@ async function ensureM2mCaller(pat, tenant, app, orgId, projectId, roles) {
   return false;
 }
 async function authSecretExists(tenant, app, service) {
-  const { SecretsManagerClient: SecretsManagerClient9, GetSecretValueCommand: GetSecretValueCommand9 } = await import("@aws-sdk/client-secrets-manager");
-  const sm = new SecretsManagerClient9(LOCAL_AWS_CONFIG);
-  return sm.send(new GetSecretValueCommand9({ SecretId: authSecretPath(tenant, app, service) })).then(
+  const { SecretsManagerClient: SecretsManagerClient10, GetSecretValueCommand: GetSecretValueCommand10 } = await import("@aws-sdk/client-secrets-manager");
+  const sm = new SecretsManagerClient10(LOCAL_AWS_CONFIG);
+  return sm.send(new GetSecretValueCommand10({ SecretId: authSecretPath(tenant, app, service) })).then(
     () => true,
     () => false
   );
@@ -17500,25 +17500,63 @@ var init_exec2 = __esm({
   }
 });
 
+// libs/secrets/src/index.ts
+import {
+  SecretsManagerClient as SecretsManagerClient5,
+  GetSecretValueCommand as GetSecretValueCommand5
+} from "@aws-sdk/client-secrets-manager";
+function instanceIndexSecretId(secretPrefix) {
+  return `${secretPrefix}/${INSTANCE_INDEX_SUFFIX}`;
+}
+function isInstanceKey(key) {
+  return key.length > 0 && !key.includes("/") && !key.startsWith(".") && !key.endsWith(".config");
+}
+function instanceKeyFromSecretName(secretPrefix, secretName) {
+  if (!secretName.startsWith(`${secretPrefix}/`)) return null;
+  const key = secretName.slice(secretPrefix.length + 1);
+  return isInstanceKey(key) ? key : null;
+}
+function parseInstanceIndex(secretString) {
+  let parsed;
+  try {
+    parsed = JSON.parse(secretString);
+  } catch {
+    parsed = void 0;
+  }
+  const instances = parsed?.instances;
+  if (!Array.isArray(instances) || !instances.every((k) => typeof k === "string")) {
+    throw new Error(
+      `Malformed instance index (expected {"instances": string[]}). Rebuild it with: mesh secrets reindex external/<name>`
+    );
+  }
+  return instances.filter(isInstanceKey);
+}
+function buildInstanceIndexValue(keys) {
+  const instances = [...new Set([...keys].filter(isInstanceKey))].sort();
+  const index = { version: 1, instances };
+  return JSON.stringify(index);
+}
+var INSTANCE_INDEX_SUFFIX;
+var init_src3 = __esm({
+  "libs/secrets/src/index.ts"() {
+    "use strict";
+    INSTANCE_INDEX_SUFFIX = ".index";
+  }
+});
+
 // libs/mesh-cli/src/commands/secrets/set.ts
 import {
   SSMClient as SSMClient2,
   GetParametersByPathCommand
 } from "@aws-sdk/client-ssm";
 import {
-  SecretsManagerClient as SecretsManagerClient5,
-  GetSecretValueCommand as GetSecretValueCommand5,
+  SecretsManagerClient as SecretsManagerClient6,
+  GetSecretValueCommand as GetSecretValueCommand6,
   PutSecretValueCommand,
   CreateSecretCommand
 } from "@aws-sdk/client-secrets-manager";
 import input from "@inquirer/input";
 import password from "@inquirer/password";
-import {
-  buildInstanceIndexValue,
-  instanceIndexSecretId,
-  isInstanceKey,
-  parseInstanceIndex
-} from "@mesh-tech/secrets";
 async function ensureAwsCredentialsForStack(stack) {
   if (process.env.AWS_ACCESS_KEY_ID || process.env.AWS_SESSION_TOKEN) return;
   if (!stack) return;
@@ -17658,7 +17696,7 @@ async function setCommand(servicePath, opts) {
   const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
   await ensureAwsCredentialsForStack(stackOpt ?? context.stage);
   const ssmClient = new SSMClient2({ region });
-  const smClient = new SecretsManagerClient5({ region });
+  const smClient = new SecretsManagerClient6({ region });
   const services = await discoverExternalServices(
     ssmClient,
     context.tenant,
@@ -17712,7 +17750,7 @@ Usage: mesh secrets set external/<name>`);
   let existing = {};
   try {
     const response = await smClient.send(
-      new GetSecretValueCommand5({ SecretId: secretId })
+      new GetSecretValueCommand6({ SecretId: secretId })
     );
     if (response.SecretString) {
       existing = JSON.parse(response.SecretString);
@@ -17824,7 +17862,7 @@ async function addKeyToInstanceIndex(client, secretPrefix, key, serviceName) {
   try {
     let keys = [];
     try {
-      const res = await client.send(new GetSecretValueCommand5({ SecretId: indexId }));
+      const res = await client.send(new GetSecretValueCommand6({ SecretId: indexId }));
       keys = parseInstanceIndex(res.SecretString ?? "");
     } catch (err) {
       if (!isResourceNotFound(err)) throw err;
@@ -17891,6 +17929,7 @@ async function writeConfigMirror(client, secretId, schema, merged, meta) {
 var init_set = __esm({
   "libs/mesh-cli/src/commands/secrets/set.ts"() {
     "use strict";
+    init_src3();
     init_context();
     init_log();
     init_stack_flag();
@@ -17902,18 +17941,12 @@ var init_set = __esm({
 // libs/mesh-cli/src/commands/secrets/reindex.ts
 import { SSMClient as SSMClient3 } from "@aws-sdk/client-ssm";
 import {
-  SecretsManagerClient as SecretsManagerClient6,
+  SecretsManagerClient as SecretsManagerClient7,
   ListSecretsCommand,
-  GetSecretValueCommand as GetSecretValueCommand6,
+  GetSecretValueCommand as GetSecretValueCommand7,
   PutSecretValueCommand as PutSecretValueCommand2,
   CreateSecretCommand as CreateSecretCommand2
 } from "@aws-sdk/client-secrets-manager";
-import {
-  buildInstanceIndexValue as buildInstanceIndexValue2,
-  instanceIndexSecretId as instanceIndexSecretId2,
-  instanceKeyFromSecretName,
-  parseInstanceIndex as parseInstanceIndex2
-} from "@mesh-tech/secrets";
 async function scanInstanceKeys(client, secretPrefix) {
   const keys = [];
   let nextToken;
@@ -17941,7 +17974,7 @@ async function reindexCommand(servicePath, opts) {
   const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
   await ensureAwsCredentialsForStack(stackOpt ?? context.stage);
   const ssmClient = new SSMClient3({ region });
-  const smClient = new SecretsManagerClient6({ region });
+  const smClient = new SecretsManagerClient7({ region });
   const services = await discoverExternalServices(
     ssmClient,
     context.tenant,
@@ -17970,15 +18003,15 @@ Usage: mesh secrets reindex external/<name>`);
     process.exit(1);
   }
   const secretPrefix = svc.meta.secretPrefix;
-  const indexId = instanceIndexSecretId2(secretPrefix);
+  const indexId = instanceIndexSecretId(secretPrefix);
   const actual = [...new Set(await scanInstanceKeys(smClient, secretPrefix))].sort();
   let listed = [];
   let indexExists = true;
   let malformed = false;
   try {
-    const res = await smClient.send(new GetSecretValueCommand6({ SecretId: indexId }));
+    const res = await smClient.send(new GetSecretValueCommand7({ SecretId: indexId }));
     try {
-      listed = parseInstanceIndex2(res.SecretString ?? "");
+      listed = parseInstanceIndex(res.SecretString ?? "");
     } catch {
       malformed = true;
       logInfo(`Existing index at ${indexId} is malformed \u2014 rebuilding from scratch.`);
@@ -18005,8 +18038,8 @@ Usage: mesh secrets reindex external/<name>`);
   logSuccess(`Index rebuilt: ${indexId} now lists ${actual.length} instance(s).`);
 }
 async function writeInstanceIndex(client, secretPrefix, serviceName, keys) {
-  const indexId = instanceIndexSecretId2(secretPrefix);
-  const secretString = buildInstanceIndexValue2(keys);
+  const indexId = instanceIndexSecretId(secretPrefix);
+  const secretString = buildInstanceIndexValue(keys);
   try {
     await client.send(
       new PutSecretValueCommand2({ SecretId: indexId, SecretString: secretString })
@@ -18032,6 +18065,7 @@ async function writeInstanceIndex(client, secretPrefix, serviceName, keys) {
 var init_reindex = __esm({
   "libs/mesh-cli/src/commands/secrets/reindex.ts"() {
     "use strict";
+    init_src3();
     init_context();
     init_log();
     init_stack_flag();
@@ -18045,8 +18079,8 @@ import {
   GetParametersByPathCommand as GetParametersByPathCommand2
 } from "@aws-sdk/client-ssm";
 import {
-  SecretsManagerClient as SecretsManagerClient7,
-  GetSecretValueCommand as GetSecretValueCommand7,
+  SecretsManagerClient as SecretsManagerClient8,
+  GetSecretValueCommand as GetSecretValueCommand8,
   PutSecretValueCommand as PutSecretValueCommand3,
   CreateSecretCommand as CreateSecretCommand3,
   ListSecretsCommand as ListSecretsCommand2
@@ -18135,7 +18169,7 @@ function isResourceNotFound2(err) {
 }
 async function readSecret(client, secretId) {
   try {
-    const res = await client.send(new GetSecretValueCommand7({ SecretId: secretId }));
+    const res = await client.send(new GetSecretValueCommand8({ SecretId: secretId }));
     return res.SecretString ? JSON.parse(res.SecretString) : null;
   } catch (err) {
     if (isResourceNotFound2(err)) return null;
@@ -18161,7 +18195,7 @@ async function writeSecret2(client, secretId, values, description) {
 }
 async function secretExists(client, secretId) {
   try {
-    await client.send(new GetSecretValueCommand7({ SecretId: secretId }));
+    await client.send(new GetSecretValueCommand8({ SecretId: secretId }));
     return true;
   } catch (err) {
     if (isResourceNotFound2(err)) return false;
@@ -18241,7 +18275,7 @@ async function migrateConfigCommand(opts) {
   const context = detectContext(resolveStackOption(opts));
   const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
   const ssmClient = new SSMClient4({ region });
-  const smClient = new SecretsManagerClient7({ region });
+  const smClient = new SecretsManagerClient8({ region });
   logInfo(`Migrating .config mirrors for ${context.tenant}/${context.platformEnv}`);
   if (opts.dryRun) logInfo("DRY-RUN mode \u2014 no writes");
   if (opts.force) logInfo("FORCE mode \u2014 overwrite existing .config");
@@ -20174,8 +20208,8 @@ import * as fs35 from "fs";
 import * as os12 from "os";
 import * as path42 from "path";
 import {
-  SecretsManagerClient as SecretsManagerClient8,
-  GetSecretValueCommand as GetSecretValueCommand8
+  SecretsManagerClient as SecretsManagerClient9,
+  GetSecretValueCommand as GetSecretValueCommand9
 } from "@aws-sdk/client-secrets-manager";
 function resolveTenantEnv(options) {
   if (options.tenant && options.env) {
@@ -20438,10 +20472,10 @@ async function tunnelExternal(name, options) {
   const { appTenant, appStage } = resolveCredentialAxis(options);
   const secretId = externalSecretId(appTenant, appStage, name, key);
   const setHint = `mesh secrets set external/${name}${key ? ` --key=${key}` : ""}`;
-  const sm = new SecretsManagerClient8({});
+  const sm = new SecretsManagerClient9({});
   let creds;
   try {
-    const out = await sm.send(new GetSecretValueCommand8({ SecretId: secretId }));
+    const out = await sm.send(new GetSecretValueCommand9({ SecretId: secretId }));
     creds = JSON.parse(out.SecretString ?? "{}");
   } catch (err) {
     logError(
@@ -22436,7 +22470,7 @@ __export(src_exports2, {
   validateWorkflowPatches: () => validateWorkflowPatches,
   walkProcessNodes: () => walkProcessNodes
 });
-var init_src3 = __esm({
+var init_src4 = __esm({
   "libs/workflow-model/src/index.ts"() {
     "use strict";
     init_workflow_ir();
@@ -22805,8 +22839,8 @@ function registerWorkflowCommands(program2) {
       let parseProcessArtifact2;
       let lintProcess2;
       try {
-        ({ parseProcessArtifact: parseProcessArtifact2 } = await Promise.resolve().then(() => (init_src3(), src_exports2)));
-        ({ lintProcess: lintProcess2 } = await Promise.resolve().then(() => (init_src3(), src_exports2)));
+        ({ parseProcessArtifact: parseProcessArtifact2 } = await Promise.resolve().then(() => (init_src4(), src_exports2)));
+        ({ lintProcess: lintProcess2 } = await Promise.resolve().then(() => (init_src4(), src_exports2)));
       } catch {
         logError(
           "Cannot resolve @mesh-tech/workflow-model (parseProcessArtifact / lintProcess).\nIt is bundled into the published CLI \u2014 on a registry install this means a broken install; reinstall the CLI. In the monorepo, run the scoped install (pnpm bootstrap:worktree @mesh-tech/mesh-cli)."