@mesh-tech/mesh-cli 0.20.1 → 0.20.3

package/dist/src/commands/local/auth-provision.d.ts

@@ -1,109 +1,29 @@
-/**
- * App-tenant auth auto-provisioning for the local platform — the local analog
- * of what the Pulumi components do in the cloud, per the approved Zitadel
- * tenant-auth pattern (Org / Project / Application / Service User):
- *
- *   Org         = app tenant                  (ZitadelTenantIdentity parity)
- *   Project     = one per app,                 (ZitadelAppIdentity parity —
- *                 name = authz schema namespace  the app IS the authz boundary)
- *   Application = one per service inside it    (API app, Basic creds)
- *   Secret      = mesh/{tenant}/{env}/apps/{app}/zitadel/{service}
- *                 (ministack Secrets Manager — same canonical path as cloud)
- *
- * `mesh dev --local` calls this on startup so scaffolding + running an app
- * auto-creates its auth config — no Pulumi deploy, no manual Zitadel steps.
- * Idempotent: search-before-create everywhere; the credential secret is only
- * written when the application is first created (Zitadel returns the secret
- * once).
- */
 export interface AppTenantAuthArgs {
-    /** App tenant (org name), e.g. "acme" */
     tenant: string;
-    /** App name = project name = authz schema namespace */
     app: string;
-    /** Service names → one API application each (api, worker, …) */
     services: string[];
-    /**
-     * App-declared project roles (package.json → mesh.auth.roles). Created on
-     * the app's Zitadel project and granted to the local `{app}-m2m` caller so
-     * role-scoped services (roles claim → scopes) accept its tokens.
-     */
     roles?: string[];
 }
 export interface ProvisionedAuth {
     orgId: string;
     projectId: string;
-    /** Services whose application (and secret) was created this run */
     created: string[];
 }
 export declare function authSecretPath(tenant: string, app: string, service: string): string;
-/**
- * Register the running app in the local platform registry — the same
- * self-registration path deployed apps use (/mesh-platform/{tenant}/{env}/
- * apps/{app}/meta), so StackPort (and the local Hub once its images land)
- * can visualize local apps.
- */
 export declare function registerLocalApp(args: AppTenantAuthArgs & {
     ports?: Record<string, number>;
-    /** ExternalService names the app's services consume (ExternalService.link()
-     * parity) — the Hub derives Integrations consumers + uptime from these. */
     links?: string[];
-    /** The app's own version (its package.json), stamped like a deploy. */
     version?: string;
-    /** Service kind discriminators from the session's dev output. A
-     * `"dagster"` entry makes this registration also write the Dagster
-     * discovery record the Hub's Data section reads. */
     kinds?: Record<string, string>;
 }): Promise<string>;
-/**
- * Reconcile the platform registry from Zitadel — every app-tenant org (and
- * its projects = apps, applications = services) provisioned in Zitadel gets
- * a Hub-readable registration, even if the app hasn't been run since it was
- * provisioned. Zitadel is the auth source of truth; the registry mirrors it,
- * exactly like the cloud where ZitadelTenantIdentity/ZitadelAppIdentity and
- * the app's self-registration both flow from the same deploy. Idempotent:
- * existing per-stack registrations (which carry live ports/URLs from
- * `mesh dev --local`) are never overwritten.
- */
 export declare function reconcileRegistryFromZitadel(): Promise<{
     tenants: string[];
     apps: number;
 }>;
-/**
- * Ensure a service has a BROWSER sign-in, not just an API client.
- *
- * `ensureServiceApp` gives every service a Zitadel **API** application, which is
- * what a machine caller authenticates with. A person cannot sign in to one:
- * there is no authorization endpoint and no redirect URI, so the Hub's
- * Access → Sign-in tab reports the app has no browser login and refuses to
- * create a user — correctly, since the account would have nowhere to log in.
- *
- * An app declares which of its services carry a login in `package.json`:
- *
- * ```json
- * { "mesh": { "auth": { "signIn": ["ui"] } } }
- * ```
- *
- * which mirrors what the Pulumi program expresses as a `web` OIDC application
- * on `ZitadelAppIdentity`. Deployed, the redirect URI comes from the service's
- * public hostname; locally it is the port `mesh dev` allocated, so this runs
- * AFTER port allocation and re-asserts the URIs on every launch — a session
- * that lands on a different port must not leave the previous one registered as
- * the only valid callback.
- *
- * Idempotent, and best-effort at the call site: a missing sign-in app degrades
- * the Access tab, it does not stop the dev loop.
- */
 export declare function ensureSignInApp(args: {
     tenant: string;
     app: string;
     service: string;
-    /** Origin the service is reachable at, e.g. `http://localhost:40881`. */
     baseUrl: string;
 }): Promise<void>;
-/**
- * Ensure the app tenant's full auth config exists (org → project →
- * application-per-service → credential secrets).
- */
 export declare function ensureAppTenantAuth(args: AppTenantAuthArgs): Promise<ProvisionedAuth>;
-//# sourceMappingURL=auth-provision.d.ts.map

package/dist/src/commands/local/auth-provision.js

@@ -1,21 +1,3 @@
-/**
- * App-tenant auth auto-provisioning for the local platform — the local analog
- * of what the Pulumi components do in the cloud, per the approved Zitadel
- * tenant-auth pattern (Org / Project / Application / Service User):
- *
- *   Org         = app tenant                  (ZitadelTenantIdentity parity)
- *   Project     = one per app,                 (ZitadelAppIdentity parity —
- *                 name = authz schema namespace  the app IS the authz boundary)
- *   Application = one per service inside it    (API app, Basic creds)
- *   Secret      = mesh/{tenant}/{env}/apps/{app}/zitadel/{service}
- *                 (ministack Secrets Manager — same canonical path as cloud)
- *
- * `mesh dev --local` calls this on startup so scaffolding + running an app
- * auto-creates its auth config — no Pulumi deploy, no manual Zitadel steps.
- * Idempotent: search-before-create everywhere; the credential secret is only
- * written when the application is first created (Zitadel returns the secret
- * once).
- */
 import { logInfo, logSuccess } from "../../utils/log.js";
 import { LOCAL_ENV, LOCAL_AWS_CONFIG, registerTenantEnv } from "./seed.js";
 import { api, readSeederPat, PLATFORM_ORG, ensureZitadelProject, searchZitadelApp } from "./seed-zitadel.js";
@@ -35,8 +17,6 @@ async function ensureOrg(pat, name) {
     return created.organizationId;
 }
 const ensureProject = (pat, orgId, name) => ensureZitadelProject(pat, name, { orgId, describe: "app" });
-/** Ensure the service's API application exists; returns fresh credentials
- * when it was created this run. */
 async function ensureServiceApp(pat, orgId, projectId, service) {
     const existing = await searchZitadelApp(pat, projectId, service, orgId);
     if (existing) {
@@ -46,7 +26,6 @@ async function ensureServiceApp(pat, orgId, projectId, service) {
     logSuccess(`Created Zitadel application '${service}' (service)`);
     return { created: true, clientId: created.clientId, clientSecret: created.clientSecret };
 }
-/** Ensure the app-declared project roles exist (idempotent). */
 async function ensureProjectRoles(pat, orgId, projectId, roles) {
     if (roles.length === 0)
         return;
@@ -59,13 +38,6 @@ async function ensureProjectRoles(pat, orgId, projectId, roles) {
         logSuccess(`Created project role '${key}'`);
     }
 }
-/**
- * Ensure the app's LOCAL M2M caller: a machine user (`{app}-m2m`) with a
- * client-credentials secret, granted the app project (+ declared roles).
- * API applications are resource servers — they cannot obtain tokens — so
- * without this there is no way to mint a caller token against the local
- * Zitadel at all. Secret stored at mesh/{tenant}/dev/apps/{app}/zitadel/m2m.
- */
 async function ensureM2mCaller(pat, tenant, app, orgId, projectId, roles) {
     const userName = `${app}-m2m`;
     const search = await api(pat, "POST", "/management/v1/users/_search", { queries: [{ userNameQuery: { userName, method: "TEXT_QUERY_METHOD_EQUALS" } }] }, orgId);
@@ -77,8 +49,6 @@ async function ensureM2mCaller(pat, tenant, app, orgId, projectId, roles) {
         createdUser = true;
         logSuccess(`Created machine user '${userName}' (local M2M caller)`);
     }
-    // Grant the project (+ declared roles); on re-runs update the existing
-    // grant so newly-declared roles apply.
     try {
         await api(pat, "POST", `/management/v1/users/${userId}/grants`, { projectId, roleKeys: roles }, orgId);
     }
@@ -93,10 +63,6 @@ async function ensureM2mCaller(pat, tenant, app, orgId, projectId, roles) {
                 await api(pat, "PUT", `/management/v1/users/${userId}/grants/${grantId}`, { roleKeys: roles }, orgId);
             }
             catch (updateErr) {
-                // Zitadel 400s a no-op update ("User grant has not been changed",
-                // COMMAND-Rs8fy) — the grant already carries the declared roles.
-                // Anything else is real. Must not throw here: aborting mid-provision
-                // skips the secret (re-)mint below and leaves callers without creds.
                 const ue = updateErr;
                 if (!/has not been changed/i.test(String(ue.message)))
                     throw updateErr;
@@ -126,20 +92,11 @@ async function writeAuthSecret(tenant, app, service, value) {
     await upsertLocalSecret(name, value);
     logSuccess(`Stored service credentials → ${name}`);
 }
-/**
- * Register the running app in the local platform registry — the same
- * self-registration path deployed apps use (/mesh-platform/{tenant}/{env}/
- * apps/{app}/meta), so StackPort (and the local Hub once its images land)
- * can visualize local apps.
- */
 export async function registerLocalApp(args) {
     const { SSMClient, PutParameterCommand } = await import("@aws-sdk/client-ssm");
     const ssm = new SSMClient(LOCAL_AWS_CONFIG);
     const put = (name, value, description) => ssm.send(new PutParameterCommand({ Name: name, Type: "String", Overwrite: true, Value: JSON.stringify(value), Description: description }));
-    // The app's tenant + env must be registered for the Hub to list the app.
     await registerTenantEnv(args.tenant);
-    // Per-stack registration in the exact shape hub-api's SSM assembler reads
-    // (stack "local" = the mesh dev --local runtime).
     const namespace = `${args.tenant}-${LOCAL_ENV}-${args.app}`;
     const base = `/mesh-platform/${args.tenant}/${LOCAL_ENV}/apps/${args.app}/stacks/local`;
     await put(base, {
@@ -159,14 +116,6 @@ export async function registerLocalApp(args) {
             ...(!isMock && args.links?.length ? { links: args.links } : {}),
         }, `Local service registration (${service})`);
     }
-    // Dagster registration — the local counterpart of the SSM Export a deployed
-    // DagsterInstance writes ({kind, graphqlUrl, uiUrl} at …/stacks/{stack}/dagster),
-    // which is the record hub-api's discoverDagsterInstances() filters on; the
-    // plain services/{name} entry above is invisible to Dagster discovery.
-    // graphqlUrl uses host.docker.internal: the consumer is the CONTAINERIZED
-    // hub-api (`mesh start`), which must cross the Docker boundary to reach the
-    // host `dg dev` process. uiUrl stays localhost — it is opened in the
-    // developer's browser, where host.docker.internal does not resolve.
     for (const service of args.services) {
         if (args.kinds?.[service] !== "dagster")
             continue;
@@ -179,10 +128,6 @@ export async function registerLocalApp(args) {
             uiUrl: `http://localhost:${port}`,
         }, `Local Dagster discovery record (${service})`);
     }
-    // Worker registration — the shape deployed TemporalWorker components
-    // write; hub-api discovers a tenant's Temporal namespaces from these, so
-    // the tenant-wide workflows view finds local runs without an explicit
-    // namespace filter. Template convention: worker services are named so.
     for (const service of args.services) {
         if (!/worker/i.test(service))
             continue;
@@ -192,27 +137,12 @@ export async function registerLocalApp(args) {
         runtime: "mesh-dev-local",
         services: args.services,
         ports: args.ports ?? {},
-        // The same two fields a deployed stack stamps, so the Hub's app list and
-        // its activity timeline read a local run exactly as they read a deploy —
-        // which version of this app is running here, and since when. Without them
-        // a local app shows a blank version and never appears on the timeline,
-        // and "deployments aren't tracked" is indistinguishable from "no deploys".
         ...(args.version ? { version: args.version } : {}),
         deployedAt: new Date().toISOString(),
     }, "Local run metadata (mesh dev --local)");
     logSuccess(`Registered app in the local registry → ${base}`);
     return base;
 }
-/**
- * Reconcile the platform registry from Zitadel — every app-tenant org (and
- * its projects = apps, applications = services) provisioned in Zitadel gets
- * a Hub-readable registration, even if the app hasn't been run since it was
- * provisioned. Zitadel is the auth source of truth; the registry mirrors it,
- * exactly like the cloud where ZitadelTenantIdentity/ZitadelAppIdentity and
- * the app's self-registration both flow from the same deploy. Idempotent:
- * existing per-stack registrations (which carry live ports/URLs from
- * `mesh dev --local`) are never overwritten.
- */
 export async function reconcileRegistryFromZitadel() {
     const pat = readSeederPat();
     const { SSMClient, GetParameterCommand, PutParameterCommand } = await import("@aws-sdk/client-ssm");
@@ -222,7 +152,6 @@ export async function reconcileRegistryFromZitadel() {
     let apps = 0;
     for (const org of orgs?.result ?? []) {
         const tenant = org?.name;
-        // The platform org holds platform-service auth config, not an app tenant.
         if (!tenant || tenant === PLATFORM_ORG)
             continue;
         await registerTenantEnv(tenant);
@@ -267,39 +196,12 @@ export async function reconcileRegistryFromZitadel() {
     }
     return { tenants, apps };
 }
-/**
- * Ensure a service has a BROWSER sign-in, not just an API client.
- *
- * `ensureServiceApp` gives every service a Zitadel **API** application, which is
- * what a machine caller authenticates with. A person cannot sign in to one:
- * there is no authorization endpoint and no redirect URI, so the Hub's
- * Access → Sign-in tab reports the app has no browser login and refuses to
- * create a user — correctly, since the account would have nowhere to log in.
- *
- * An app declares which of its services carry a login in `package.json`:
- *
- * ```json
- * { "mesh": { "auth": { "signIn": ["ui"] } } }
- * ```
- *
- * which mirrors what the Pulumi program expresses as a `web` OIDC application
- * on `ZitadelAppIdentity`. Deployed, the redirect URI comes from the service's
- * public hostname; locally it is the port `mesh dev` allocated, so this runs
- * AFTER port allocation and re-asserts the URIs on every launch — a session
- * that lands on a different port must not leave the previous one registered as
- * the only valid callback.
- *
- * Idempotent, and best-effort at the call site: a missing sign-in app degrades
- * the Access tab, it does not stop the dev loop.
- */
 export async function ensureSignInApp(args) {
     const pat = readSeederPat();
     const orgId = await ensureOrg(pat, args.tenant);
     const projectId = await ensureProject(pat, orgId, args.app);
     const name = `${args.service}-web`;
     const base = args.baseUrl.replace(/\/+$/, "");
-    // oauth2-proxy's callback, and both slash forms for post-logout — Zitadel
-    // exact-matches the latter, and proxies differ on the trailing slash.
     const redirectUris = [`${base}/oauth2/callback`];
     const postLogoutRedirectUris = [base, `${base}/`];
     const config = {
@@ -309,13 +211,10 @@ export async function ensureSignInApp(args) {
         grantTypes: ["OIDC_GRANT_TYPE_AUTHORIZATION_CODE", "OIDC_GRANT_TYPE_REFRESH_TOKEN"],
         appType: "OIDC_APP_TYPE_WEB",
         authMethodType: "OIDC_AUTH_METHOD_TYPE_BASIC",
-        // Roles must ride in the token: the app authorizes on them, and the Hub
-        // shows which roles a person holds by reading the same grants.
         accessTokenType: "OIDC_TOKEN_TYPE_JWT",
         accessTokenRoleAssertion: true,
         idTokenRoleAssertion: true,
         idTokenUserinfoAssertion: true,
-        // http:// callbacks are only permitted in dev mode.
         devMode: true,
     };
     const existing = await searchZitadelApp(pat, projectId, name, orgId);
@@ -333,10 +232,6 @@ export async function ensureSignInApp(args) {
     });
     logSuccess(`Created Zitadel application '${name}' (browser sign-in → ${base}/oauth2/callback)`);
 }
-/**
- * Ensure the app tenant's full auth config exists (org → project →
- * application-per-service → credential secrets).
- */
 export async function ensureAppTenantAuth(args) {
     const pat = readSeederPat();
     const orgId = await ensureOrg(pat, args.tenant);
@@ -357,9 +252,6 @@ export async function ensureAppTenantAuth(args) {
             created.push(service);
         }
         else if (!(await authSecretExists(args.tenant, args.app, service))) {
-            // Zitadel persists across stack restarts but the local secret store is
-            // in-memory — heal the gap by regenerating the application's secret
-            // (Zitadel returns it only once, so a lost secret can't be re-read).
             const regenerated = await api(pat, "POST", `/management/v1/projects/${projectId}/apps/${result.appId}/api_config/_generate_client_secret`, {}, orgId);
             await writeAuthSecret(args.tenant, args.app, service, {
                 clientId: result.clientId ?? "",
@@ -380,4 +272,3 @@ export async function ensureAppTenantAuth(args) {
     }
     return { orgId, projectId, created };
 }
-//# sourceMappingURL=auth-provision.js.map

package/dist/src/commands/local/dev-local.d.ts

@@ -1,23 +1,3 @@
-/**
- * Local DevOutput source for `mesh dev` (design §5.2, AC C1/C3).
- *
- * Instead of reading a deployed Pulumi stack, synthesize the same DevOutput
- * shape from repo conventions and point every service at the running
- * `mesh start` platform. Zero AWS credentials, zero VPN, zero Pulumi state —
- * the app's code never knows it's local:
- *   - Temporal → localhost:7233, namespace local-dev (seeded)
- *   - Postgres → the local `app` database
- *   - Zitadel  → http://localhost:8080 (seeded org/app/users)
- *   - SpiceDB  → localhost:50051 (preshared key)
- *   - AWS SDK  → ministack via AWS_ENDPOINT_URL (SSM/Secrets/S3 registry)
- *
- * Detection convention = what `mesh create-app` templates emit: immediate
- * subdirectories of the app root whose package.json has a `dev` script
- * (api/, worker/, web/, …); a single-package app root with its own `dev`
- * script becomes one service.
- */
-/** Matches dev.ts's DevEnvVar/DevService/DevOutput shapes (kept structural —
- * dev.ts owns the canonical interfaces). */
 interface LocalDevEnvVar {
     value: string;
 }
@@ -26,9 +6,6 @@ interface LocalDevService {
     port: number;
     command: string[];
     env?: Record<string, LocalDevEnvVar>;
-    /** Service kind discriminator (see dev.ts DevService). `"dagster"` marks the
-     * synthesized `dg dev` webserver so local registration writes the Dagster
-     * discovery record the Hub's Data section reads. */
     kind?: "dagster";
 }
 export interface LocalDevOutput {
@@ -42,88 +19,20 @@ export interface LocalDevOutput {
     tunnels: Record<string, never>;
 }
 export declare const LOCAL_STACK_NAME = "local";
-/**
- * The app's namespace, exactly the name the cloud gives it in K8s AND
- * Temporal ({tenant}-{env}-{app}) — the Hub resolves both from this one
- * convention, so local runs are addressable with zero translation.
- */
 export declare function localAppNamespace(tenant: string, appName: string): string;
-/** The OTLP log shipper (assets/log-shipper.mjs) each local service's
- * launch pipeline pipes through — ships stdout to the stack's collector
- * with the hosted k8s_* attribution. */
 export declare function logShipperPath(): string;
-/**
- * OTel SDK bootstrap — the local analog of the OTel Operator's pod
- * injection: when the service ships `@opentelemetry/auto-instrumentations-
- * node` (the templates declare it), the platform injects the `--import`
- * register hook + exporter env, and HTTP/fetch/gRPC spans flow to the
- * stack's collector → Tempo → the Hub's Traces views. Apps without the
- * package run untouched.
- */
 export declare function autoInstrumentationEnv(appRoot: string, src: string): Record<string, LocalDevEnvVar>;
-/** Hosted-parity resource attribution for a local service — what the
- * in-cluster k8sattributes processor stamps. */
 export declare function otelEnv(tenant: string, appName: string, serviceName: string): Record<string, LocalDevEnvVar>;
-/** Endpoints of the running `mesh start` platform, as service env. */
 export declare function localPlatformEnv(tenant: string, appName: string, serviceName: string): Record<string, LocalDevEnvVar>;
-/**
- * A Dagster workspace announces itself in one of the two shapes `dg dev`
- * accepts: a `dg.toml` at the root (workspace convention — one file listing
- * one or more projects), or a root `pyproject.toml` carrying a `[tool.dg]`
- * table (single-project convention). Either earns the synthesized `dg dev`
- * service.
- *
- * @example
- * isDagsterWorkspaceRoot("/repos/acme-dagster");      // true — has dg.toml
- * isDagsterWorkspaceRoot("/repos/bank-statements");   // true — pyproject.toml has [tool.dg]
- * isDagsterWorkspaceRoot("/repos/plain-hono-api");    // false
- */
 export declare function isDagsterWorkspaceRoot(appRoot: string): boolean;
-/**
- * Locate the `dg` binary for a workspace, by layout convention:
- * `deployments/local/.venv` (a workspace keeping its dev CLI venv separate
- * from per-project venvs) first, then a root `.venv` (single-project
- * workspaces where one `uv sync` at the root covers everything). Falls back
- * to `dg` on PATH (uv tool install / pipx) when neither venv exists yet —
- * the launch window then shows dg's own error, which names the missing venv
- * more usefully than a failed path lookup would.
- *
- * @example
- * resolveDgBinary("/repos/acme-dagster");     // "deployments/local/.venv/bin/dg"
- * resolveDgBinary("/repos/bank-statements");  // ".venv/bin/dg" (root uv sync)
- * resolveDgBinary("/repos/fresh-clone");      // "dg" (no venv built yet)
- */
 export declare function resolveDgBinary(appRoot: string): string;
-/**
- * Detect runnable services by template convention: immediate subdirectories
- * with a package.json `dev` script; falls back to the app root itself when
- * it is a single-package app.
- */
 export declare function detectLocalServices(appRoot: string): Record<string, {
     src: string;
 }>;
-/** Synthesize the DevOutput `mesh dev` would otherwise read from Pulumi.
- * `tenant` is the app tenant (detectLocalTenant) — it scopes the app's
- * namespace ({tenant}-{env}-{app}) for Temporal, logs, and traces.
- * `opts.mocks` (mesh dev --externals) appends declared mock services and injects
- * their ExternalService credential prefixes into every app service. */
 export declare function buildLocalDevOutput(appRoot: string, tenant: string, opts?: {
     mocks?: Record<string, import("./mocks.js").LocalMockDecl>;
 }): LocalDevOutput;
-/**
- * Whether the app is backed by a Pulumi program: its own (Pulumi.yaml or a
- * Pulumi.<stack>.yaml stack config in the app dir), or a monorepo ROOT
- * program above it (walk up to the repo boundary — .git/pnpm-workspace).
- * Apps like apps/hub deploy via a root program and have no per-app
- * Pulumi.yaml; they must NOT default into `mesh dev` local mode.
- */
 export declare function hasStackBacking(appRoot: string): boolean;
-/**
- * The app's tenant, for auth provisioning: `mesh:tenant` from the app's
- * Pulumi stack config when present (templates write it), else "local".
- */
 export declare function detectLocalTenant(appRoot: string): string;
-/** The local platform must be up before `mesh dev` can wire services to it. */
 export declare function ensureLocalPlatformRunning(): Promise<void>;
 export {};
-//# sourceMappingURL=dev-local.d.ts.map