@mesh-tech/mesh-cli 0.20.1 → 0.20.3

package/dist/src/commands/local/dev-local.js

@@ -1,21 +1,3 @@
-/**
- * Local DevOutput source for `mesh dev` (design §5.2, AC C1/C3).
- *
- * Instead of reading a deployed Pulumi stack, synthesize the same DevOutput
- * shape from repo conventions and point every service at the running
- * `mesh start` platform. Zero AWS credentials, zero VPN, zero Pulumi state —
- * the app's code never knows it's local:
- *   - Temporal → localhost:7233, namespace local-dev (seeded)
- *   - Postgres → the local `app` database
- *   - Zitadel  → http://localhost:8080 (seeded org/app/users)
- *   - SpiceDB  → localhost:50051 (preshared key)
- *   - AWS SDK  → ministack via AWS_ENDPOINT_URL (SSM/Secrets/S3 registry)
- *
- * Detection convention = what `mesh create-app` templates emit: immediate
- * subdirectories of the app root whose package.json has a `dev` script
- * (api/, worker/, web/, …); a single-package app root with its own `dev`
- * script becomes one service.
- */
 import * as fs from "fs";
 import * as path from "path";
 import { isServiceMode, openapiMockCommand } from "./mocks.js";
@@ -30,28 +12,12 @@ import { getContextConfig } from "../login.js";
 import { findMeshJson } from "../../utils/mesh-json.js";
 export const LOCAL_STACK_NAME = "local";
 const BASE_PORT = 3000;
-/**
- * The app's namespace, exactly the name the cloud gives it in K8s AND
- * Temporal ({tenant}-{env}-{app}) — the Hub resolves both from this one
- * convention, so local runs are addressable with zero translation.
- */
 export function localAppNamespace(tenant, appName) {
     return `${tenant}-${LOCAL_ENV}-${appName}`;
 }
-/** The OTLP log shipper (assets/log-shipper.mjs) each local service's
- * launch pipeline pipes through — ships stdout to the stack's collector
- * with the hosted k8s_* attribution. */
 export function logShipperPath() {
     return path.join(findPackageRoot(), "assets", "log-shipper.mjs");
 }
-/**
- * OTel SDK bootstrap — the local analog of the OTel Operator's pod
- * injection: when the service ships `@opentelemetry/auto-instrumentations-
- * node` (the templates declare it), the platform injects the `--import`
- * register hook + exporter env, and HTTP/fetch/gRPC spans flow to the
- * stack's collector → Tempo → the Hub's Traces views. Apps without the
- * package run untouched.
- */
 export function autoInstrumentationEnv(appRoot, src) {
     const pkgDir = path.join("node_modules", "@opentelemetry", "auto-instrumentations-node");
     const present = fs.existsSync(path.join(appRoot, src, pkgDir)) || fs.existsSync(path.join(appRoot, pkgDir));
@@ -60,15 +26,11 @@ export function autoInstrumentationEnv(appRoot, src) {
     return {
         NODE_OPTIONS: { value: "--import @opentelemetry/auto-instrumentations-node/register" },
         OTEL_TRACES_EXPORTER: { value: "otlp" },
-        // Logs ship via the launch pipeline; metrics locally come from
-        // Prometheus scrapes — keep the SDK to traces.
         OTEL_METRICS_EXPORTER: { value: "none" },
         OTEL_LOGS_EXPORTER: { value: "none" },
         OTEL_NODE_DISABLED_INSTRUMENTATIONS: { value: "fs,dns,net" },
     };
 }
-/** Hosted-parity resource attribution for a local service — what the
- * in-cluster k8sattributes processor stamps. */
 export function otelEnv(tenant, appName, serviceName) {
     const namespace = localAppNamespace(tenant, appName);
     return {
@@ -79,23 +41,15 @@ export function otelEnv(tenant, appName, serviceName) {
         },
     };
 }
-/** Endpoints of the running `mesh start` platform, as service env. */
 export function localPlatformEnv(tenant, appName, serviceName) {
     const namespace = localAppNamespace(tenant, appName);
     const env = {
         TEMPORAL_ADDRESS: { value: TEMPORAL_ADDRESS },
         TEMPORAL_NAMESPACE: { value: namespace },
         TEMPORAL_TASK_QUEUE: { value: appName },
-        // OTel wiring, two consumers: instrumented services ship traces/metrics
-        // themselves, and the launch pipeline's log shipper reads these to ship
-        // stdout logs — both with the in-cluster k8sattributes attribution.
         ...otelEnv(tenant, appName, serviceName),
         DATABASE_URL: { value: "postgres://postgres:postgres@localhost:5433/app" },
         ZITADEL_ISSUER: { value: ZITADEL_ISSUER },
-        // The service's own Zitadel M2M credentials (created by ensureAppTenantAuth
-        // on session start) — resolveCredentials("zitadel") picks this up, so apps
-        // can hydrate introspection/M2M config the same way they resolve
-        // ExternalService links instead of hand-carrying client ids in env files.
         ZITADEL_SECRET_PREFIX: { value: authSecretPath(tenant, appName, serviceName) },
         SPICEDB_ENDPOINT: { value: "localhost:50051" },
         SPICEDB_HTTP_ENDPOINT: { value: "http://localhost:8443" },
@@ -104,9 +58,6 @@ export function localPlatformEnv(tenant, appName, serviceName) {
         MESH_LOCAL: { value: "1" },
         MESH_SERVICE: { value: serviceName },
     };
-    // Local tokens come from `mesh login local` (the seeded CLI app), so that
-    // app's clientId is the audience local APIs should verify. In the cloud,
-    // consumers request the API project's audience scope instead.
     const cliClientId = getContextConfig(LOGIN_CONTEXT)?.clientId;
     if (cliClientId) {
         env.AUTH_AUDIENCE = { value: cliClientId };
@@ -116,18 +67,6 @@ export function localPlatformEnv(tenant, appName, serviceName) {
     }
     return env;
 }
-/**
- * A Dagster workspace announces itself in one of the two shapes `dg dev`
- * accepts: a `dg.toml` at the root (workspace convention — one file listing
- * one or more projects), or a root `pyproject.toml` carrying a `[tool.dg]`
- * table (single-project convention). Either earns the synthesized `dg dev`
- * service.
- *
- * @example
- * isDagsterWorkspaceRoot("/repos/acme-dagster");      // true — has dg.toml
- * isDagsterWorkspaceRoot("/repos/bank-statements");   // true — pyproject.toml has [tool.dg]
- * isDagsterWorkspaceRoot("/repos/plain-hono-api");    // false
- */
 export function isDagsterWorkspaceRoot(appRoot) {
     if (fs.existsSync(path.join(appRoot, "dg.toml")))
         return true;
@@ -141,20 +80,6 @@ export function isDagsterWorkspaceRoot(appRoot) {
         return false;
     }
 }
-/**
- * Locate the `dg` binary for a workspace, by layout convention:
- * `deployments/local/.venv` (a workspace keeping its dev CLI venv separate
- * from per-project venvs) first, then a root `.venv` (single-project
- * workspaces where one `uv sync` at the root covers everything). Falls back
- * to `dg` on PATH (uv tool install / pipx) when neither venv exists yet —
- * the launch window then shows dg's own error, which names the missing venv
- * more usefully than a failed path lookup would.
- *
- * @example
- * resolveDgBinary("/repos/acme-dagster");     // "deployments/local/.venv/bin/dg"
- * resolveDgBinary("/repos/bank-statements");  // ".venv/bin/dg" (root uv sync)
- * resolveDgBinary("/repos/fresh-clone");      // "dg" (no venv built yet)
- */
 export function resolveDgBinary(appRoot) {
     for (const candidate of ["deployments/local/.venv/bin/dg", ".venv/bin/dg"]) {
         if (fs.existsSync(path.join(appRoot, candidate)))
@@ -174,11 +99,6 @@ function hasDevScript(dir) {
         return false;
     }
 }
-/**
- * Detect runnable services by template convention: immediate subdirectories
- * with a package.json `dev` script; falls back to the app root itself when
- * it is a single-package app.
- */
 export function detectLocalServices(appRoot) {
     const services = {};
     for (const entry of fs.readdirSync(appRoot, { withFileTypes: true })) {
@@ -193,26 +113,13 @@ export function detectLocalServices(appRoot) {
     }
     return services;
 }
-/** Synthesize the DevOutput `mesh dev` would otherwise read from Pulumi.
- * `tenant` is the app tenant (detectLocalTenant) — it scopes the app's
- * namespace ({tenant}-{env}-{app}) for Temporal, logs, and traces.
- * `opts.mocks` (mesh dev --externals) appends declared mock services and injects
- * their ExternalService credential prefixes into every app service. */
 export function buildLocalDevOutput(appRoot, tenant, opts = {}) {
     const detected = detectLocalServices(appRoot);
     const names = Object.keys(detected);
-    // A Dagster workspace (dg.toml, or [tool.dg] in a root pyproject.toml) is
-    // runnable even with zero package.json services — the common shape: the
-    // pipelines are Python, the only Node artifact is the Pulumi program.
     const isDagsterWorkspace = isDagsterWorkspaceRoot(appRoot);
     if (names.length === 0 && !isDagsterWorkspace) {
         throw new MeshCliError(`No runnable services found under ${appRoot} — expected subdirectories (api/, worker/, …) with a package.json 'dev' script, or a Dagster workspace (dg.toml, or [tool.dg] in pyproject.toml).`, { remediation: { command: "mesh create-app" } });
     }
-    // App name = project name = authz namespace. Pulumi.yaml `name:` wins
-    // (matches getProjectName — a stack-backed app run with --local must keep
-    // its deployed identity), then package.json name, then the basename.
-    // Scoped package names (@scu-apps/plaid) are unusable as Temporal/K8s
-    // namespaces — drop the scope.
     let appName = path.basename(appRoot);
     try {
         const pkg = JSON.parse(fs.readFileSync(path.join(appRoot, "package.json"), "utf-8"));
@@ -220,7 +127,6 @@ export function buildLocalDevOutput(appRoot, tenant, opts = {}) {
             appName = pkg.name.replace(/^@[^/]+\//, "");
     }
     catch {
-        // no root package.json — keep the basename
     }
     const pulumiYaml = path.join(appRoot, "Pulumi.yaml");
     if (fs.existsSync(pulumiYaml)) {
@@ -230,13 +136,7 @@ export function buildLocalDevOutput(appRoot, tenant, opts = {}) {
     }
     const services = {};
     const mocks = opts.mocks ?? {};
-    // Only process/openapi declarations run as mock-{name} services in this
-    // orchestration; compose externals are docker-managed and sandbox
-    // declarations spawn nothing (dev.ts seeds their credentials directly).
     const mockNames = Object.keys(mocks).filter((name) => isServiceMode(name, mocks[name]));
-    // The ExternalService link() contract, synthesized: every app service gets
-    // {EXT}_SECRET_PREFIX for each mocked external, so resolveCredentials()
-    // runs the exact deployed code path against the locally seeded secret.
     const externalEnv = {};
     for (const decl of Object.values(mocks)) {
         if (!decl.external)
@@ -253,7 +153,6 @@ export function buildLocalDevOutput(appRoot, tenant, opts = {}) {
             port,
             command: ["pnpm", "dev"],
             env: {
-                // allocatePorts keeps service.port and env.PORT in sync on reallocation
                 PORT: { value: String(port) },
                 ...localPlatformEnv(tenant, appName, name),
                 ...autoInstrumentationEnv(appRoot, detected[name].src),
@@ -261,18 +160,6 @@ export function buildLocalDevOutput(appRoot, tenant, opts = {}) {
             },
         };
     });
-    // Sibling-service URLs — the local analog of the deployed cross-service
-    // wiring (http://{svc}.{namespace}.svc.cluster.local:{port} in-cluster):
-    // every app service gets SERVICE_{NAME}_URL for each app service, so code
-    // can wire cross-service clients locally without knowing allocated ports.
-    // allocatePorts' cross-service localhost:{port} rewrite keeps them in sync
-    // when ports are reallocated.
-    //
-    // This is a PUBLIC, app-facing env contract — {NAME} is the service's
-    // directory name upper-cased, non-[A-Z0-9] → "_". Apps that name their
-    // link the same way (events.link({ environmentPrefix: "SERVICE_EVENTS" }))
-    // read ONE variable deployed and locally, with no isLocal branch.
-    // See docs/guides/mesh-dev-local-env.md.
     for (const name of names) {
         const key = `SERVICE_${name.toUpperCase().replace(/[^A-Z0-9]/g, "_")}_URL`;
         const url = `http://localhost:${services[name].port}`;
@@ -280,25 +167,9 @@ export function buildLocalDevOutput(appRoot, tenant, opts = {}) {
             services[other].env[key] = { value: url };
         }
     }
-    // Dagster workspace: synthesize the `dg dev` webserver as a first-class
-    // service — the local counterpart of the dev service a DagsterInstance
-    // registers from its Pulumi program. The binary is resolved by layout
-    // convention (resolveDgBinary). `-p "$PORT"` is expanded by the launch
-    // shell from the sourced env file, so a reallocated port
-    // (rewriteOwnServicePort keeps env.PORT in sync) still binds correctly — a
-    // literal port in the argv would go stale. DAGSTER_HOME pins instance
-    // state under the app root so `dg dev` doesn't scatter
-    // .tmp_dagster_home_* directories. The service inherits localPlatformEnv,
-    // so pipelines reach ministack S3 (AWS_ENDPOINT_URL) with no credential
-    // setup.
     if (isDagsterWorkspace) {
         const port = BASE_PORT + names.length + mockNames.length;
         services["dagster"] = {
-            // Absolute on purpose: a relative src is MONOREPO-ROOT-relative by the
-            // ServiceDevOutput contract (rebaseServiceSrc), which for an app nested
-            // in the monorepo would cd the launch shell to the repo root — where
-            // neither dg.toml nor the venv path resolves. The absolute app root
-            // survives rebasing in both the monorepo and standalone-repo shapes.
             src: appRoot,
             kind: "dagster",
             port,
@@ -310,14 +181,11 @@ export function buildLocalDevOutput(appRoot, tenant, opts = {}) {
             },
         };
     }
-    // Declared mocks join the same orchestration (ports, env file, tmux
-    // window, log pipeline) as first-class services named mock-{name}.
     mockNames.forEach((name, i) => {
         const decl = mocks[name];
         const serviceName = `mock-${name}`;
         const port = decl.port ?? BASE_PORT + names.length + i;
         services[serviceName] = {
-            // openapi mode runs Prism from the app root against the spec path.
             src: decl.src ?? ".",
             port,
             command: decl.openapi ? openapiMockCommand(decl) : (decl.command ?? ["pnpm", "dev"]),
@@ -336,13 +204,6 @@ export function buildLocalDevOutput(appRoot, tenant, opts = {}) {
         tunnels: {},
     };
 }
-/**
- * Whether the app is backed by a Pulumi program: its own (Pulumi.yaml or a
- * Pulumi.<stack>.yaml stack config in the app dir), or a monorepo ROOT
- * program above it (walk up to the repo boundary — .git/pnpm-workspace).
- * Apps like apps/hub deploy via a root program and have no per-app
- * Pulumi.yaml; they must NOT default into `mesh dev` local mode.
- */
 export function hasStackBacking(appRoot) {
     const hasOwn = fs.existsSync(path.join(appRoot, "Pulumi.yaml")) ||
         fs.readdirSync(appRoot).some((f) => /^Pulumi\..+\.yaml$/.test(f));
@@ -361,10 +222,6 @@ export function hasStackBacking(appRoot) {
         dir = parent;
     }
 }
-/**
- * The app's tenant, for auth provisioning: `mesh:tenant` from the app's
- * Pulumi stack config when present (templates write it), else "local".
- */
 export function detectLocalTenant(appRoot) {
     for (const file of fs.readdirSync(appRoot)) {
         if (!/^Pulumi\..*\.yaml$/.test(file))
@@ -375,18 +232,14 @@ export function detectLocalTenant(appRoot) {
         if (match)
             return match[1];
     }
-    // No per-app stack config names a tenant: fall back to the repo-level
-    // record `mesh init` writes, then to the local default.
     const recorded = findMeshJson(appRoot);
     if (recorded)
         return recorded.data.tenant;
     return "local";
 }
-/** The local platform must be up before `mesh dev` can wire services to it. */
 export async function ensureLocalPlatformRunning() {
     const [temporalUp, fabricUp] = await Promise.all([probeTcp(7233), probeTcp(4566)]);
     if (!temporalUp || !fabricUp) {
         throw new MeshCliError("The local Mesh platform is not running (mesh dev local mode wires services to it).", { remediation: { command: "mesh start" } });
     }
 }
-//# sourceMappingURL=dev-local.js.map

package/dist/src/commands/local/docker-runner.d.ts

@@ -1,23 +1,3 @@
-/**
- * Docker runner for `mesh dev --local` (design §5.3, AC C2).
- *
- * The tmux runner stays the default on dev machines; `--runner docker` is
- * for environments where tmux isn't sensible — CI (the golden-path
- * workflow), headless agents, non-macOS boxes. It renders the SAME
- * synthesized DevOutput into a docker compose project:
- *
- *   - one service per DevOutput service, `node:22-bookworm`, the app
- *     bind-mounted at /workspace, `pnpm dev` in the service dir
- *   - `network_mode: host` — services reach the `mesh start` platform on
- *     localhost exactly like the tmux runner (Linux/CI semantics; on macOS
- *     Docker Desktop host networking must be enabled, and host-installed
- *     node_modules are platform-specific — tmux is the right runner there)
- *   - per-service env files carrying the identical env contract
- *   - logs ship through the same OTLP shipper (mounted from the CLI)
- *
- * Parity: `mesh dev --status|--kill|logs|restart` map to
- * `docker compose ps|down|logs|restart` via the session state's runner.
- */
 interface RunnerService {
     src: string;
     port: number;
@@ -26,7 +6,6 @@ interface RunnerService {
         value: string;
     }>;
 }
-/** Write the compose project for a dev session; returns the compose file path. */
 export declare function writeDevCompose(sessionName: string, appRoot: string, services: Record<string, RunnerService>): string;
 export declare function dockerDevUp(sessionName: string): void;
 export declare function dockerDevDown(sessionName: string): void;
@@ -34,4 +13,3 @@ export declare function dockerDevPs(sessionName: string): string;
 export declare function dockerDevLogs(sessionName: string, service: string, tail: number): string;
 export declare function dockerDevRestart(sessionName: string, service: string): void;
 export {};
-//# sourceMappingURL=docker-runner.d.ts.map

package/dist/src/commands/local/docker-runner.js

@@ -1,45 +1,21 @@
-/**
- * Docker runner for `mesh dev --local` (design §5.3, AC C2).
- *
- * The tmux runner stays the default on dev machines; `--runner docker` is
- * for environments where tmux isn't sensible — CI (the golden-path
- * workflow), headless agents, non-macOS boxes. It renders the SAME
- * synthesized DevOutput into a docker compose project:
- *
- *   - one service per DevOutput service, `node:22-bookworm`, the app
- *     bind-mounted at /workspace, `pnpm dev` in the service dir
- *   - `network_mode: host` — services reach the `mesh start` platform on
- *     localhost exactly like the tmux runner (Linux/CI semantics; on macOS
- *     Docker Desktop host networking must be enabled, and host-installed
- *     node_modules are platform-specific — tmux is the right runner there)
- *   - per-service env files carrying the identical env contract
- *   - logs ship through the same OTLP shipper (mounted from the CLI)
- *
- * Parity: `mesh dev --status|--kill|logs|restart` map to
- * `docker compose ps|down|logs|restart` via the session state's runner.
- */
 import { execFileSync } from "child_process";
 import * as fs from "fs";
 import * as path from "path";
 import { logShipperPath } from "./dev-local.js";
 import { meshCacheDir } from "../../utils/cache-home.js";
-// Digest-pinned so dev-runner containers are reproducible (matches the
-// pinning of the stack's third-party images).
 const DEV_RUNNER_IMAGE = "node:22-bookworm@sha256:5647be709086c696ff32edaaf1c70cd26d1da6ab2b39c32f3c7b4c4a31957e37";
 function sessionDir(sessionName) {
     return meshCacheDir("mesh-local", "dev", sessionName);
 }
-/** docker env-file format: KEY=VALUE, no quoting, single-line values only. */
 function renderDockerEnvFile(env) {
     const lines = [];
     for (const [key, entry] of Object.entries(env)) {
         if (entry.value.includes("\n"))
-            continue; // multi-line values unsupported by env_file
+            continue;
         lines.push(`${key}=${entry.value}`);
     }
     return lines.join("\n") + "\n";
 }
-/** Write the compose project for a dev session; returns the compose file path. */
 export function writeDevCompose(sessionName, appRoot, services) {
     const dir = sessionDir(sessionName);
     const shipper = logShipperPath();
@@ -55,15 +31,7 @@ export function writeDevCompose(sessionName, appRoot, services) {
         const ship = env.OTEL_RESOURCE_ATTRIBUTES
             ? ` 2>&1 | NODE_OPTIONS= node /mesh-assets/log-shipper.mjs`
             : "";
-        blocks.push(`  ${name}:`, `    image: ${DEV_RUNNER_IMAGE}`, `    network_mode: host`, `    working_dir: ${workdir}`, `    volumes:`, `      - '${appRoot}:/workspace'`, `      - '${path.dirname(shipper)}:/mesh-assets:ro'`, `    environment:`, 
-        // node_modules is the HOST's bind-mounted install — pnpm inside the
-        // container must never "verify" it and try a purge/reinstall (pnpm
-        // ≥10.9's verify-deps-before-run prompts and dies headless; worse, a
-        // purge would clobber the host install).
-        `      CI: 'true'`, `      npm_config_verify_deps_before_run: 'false'`, `    env_file:`, `      - './${name}.env'`, 
-        // pipefail: the container's exit code must be the SERVICE's, not the
-        // log-shipper's — otherwise a crashed service reports success (CI).
-        `    command: ["bash", "-lc", "set -o pipefail; corepack enable >/dev/null 2>&1; { ${service.command.join(" ")}; }${ship}"]`, `    restart: unless-stopped`);
+        blocks.push(`  ${name}:`, `    image: ${DEV_RUNNER_IMAGE}`, `    network_mode: host`, `    working_dir: ${workdir}`, `    volumes:`, `      - '${appRoot}:/workspace'`, `      - '${path.dirname(shipper)}:/mesh-assets:ro'`, `    environment:`, `      CI: 'true'`, `      npm_config_verify_deps_before_run: 'false'`, `    env_file:`, `      - './${name}.env'`, `    command: ["bash", "-lc", "set -o pipefail; corepack enable >/dev/null 2>&1; { ${service.command.join(" ")}; }${ship}"]`, `    restart: unless-stopped`);
     }
     const composePath = path.join(dir, "compose.yml");
     fs.writeFileSync(composePath, blocks.join("\n") + "\n");
@@ -99,4 +67,3 @@ export function dockerDevRestart(sessionName, service) {
         stdio: ["ignore", "inherit", "inherit"],
     });
 }
-//# sourceMappingURL=docker-runner.js.map

package/dist/src/commands/local/helpers.d.ts

@@ -1,22 +1,8 @@
-/**
- * Small shared helpers for the local-platform commands — extracted from the
- * copies that had grown in auth-provision/mocks (secret upsert) and
- * dev-local/stack (TCP probe).
- */
-/** The subset of SecretsManagerClient upsertLocalSecret depends on. */
 export interface SecretsSender {
     send(command: unknown): Promise<unknown>;
 }
-/**
- * Create-or-update a Secrets Manager secret in the local AWS fabric
- * (ministack). Create first; on ResourceExistsException, put a new value.
- * `client` is injectable for tests; defaults to a client against the local
- * fabric.
- */
 export declare function upsertLocalSecret(secretId: string, value: Record<string, string>, client?: SecretsSender): Promise<void>;
-/** True when a TCP connect to host:port succeeds within timeoutMs. */
 export declare function probeTcp(port: number, opts?: {
     host?: string;
     timeoutMs?: number;
 }): Promise<boolean>;
-//# sourceMappingURL=helpers.d.ts.map

package/dist/src/commands/local/helpers.js

@@ -1,16 +1,5 @@
-/**
- * Small shared helpers for the local-platform commands — extracted from the
- * copies that had grown in auth-provision/mocks (secret upsert) and
- * dev-local/stack (TCP probe).
- */
 import * as net from "net";
 import { LOCAL_AWS_CONFIG } from "./seed.js";
-/**
- * Create-or-update a Secrets Manager secret in the local AWS fabric
- * (ministack). Create first; on ResourceExistsException, put a new value.
- * `client` is injectable for tests; defaults to a client against the local
- * fabric.
- */
 export async function upsertLocalSecret(secretId, value, client) {
     const { SecretsManagerClient, CreateSecretCommand, PutSecretValueCommand } = await import("@aws-sdk/client-secrets-manager");
     const sm = client ?? new SecretsManagerClient(LOCAL_AWS_CONFIG);
@@ -27,7 +16,6 @@ export async function upsertLocalSecret(secretId, value, client) {
         }
     }
 }
-/** True when a TCP connect to host:port succeeds within timeoutMs. */
 export function probeTcp(port, opts = {}) {
     const { host = "127.0.0.1", timeoutMs = 2000 } = opts;
     return new Promise((resolve) => {
@@ -43,4 +31,3 @@ export function probeTcp(port, opts = {}) {
         });
     });
 }
-//# sourceMappingURL=helpers.js.map

package/dist/src/commands/local/hub-local.d.ts

@@ -1,28 +1,7 @@
-/**
- * Local Hub image builder (`mesh start --with-hub`) — the interim path
- * until the hub pipeline publishes pullable container images (design §11).
- *
- * Resolves the published @mesh-tech/hub tarball with the user's registry
- * auth (mesh registry login), extracts it, and docker-builds two images
- * from the prebuilt dists it ships (api/dist → mesh-local-hub-api,
- * ui/build → mesh-local-hub-ui). The CodeArtifact token enters the build
- * as a BuildKit secret and never lands in a layer. Idempotent: images are
- * keyed by the package version and rebuilt only when missing.
- */
 import { type RegistryTokenState } from "../../utils/auth-preflight.js";
 export declare const HUB_IMAGES: readonly ["mesh-local-hub-api", "mesh-local-hub-ui"];
-/**
- * Build the Hub's oauth2-proxy image (hosted sidecar + loopback issuer
- * forward). Public base images only — no registry auth involved.
- */
 export declare function ensureHubAuthImage(): void;
-/** Registry auth present? (Needed only to BUILD hub images, not to run them.) */
 export declare function hasRegistryAuth(): boolean;
-/**
- * Newest hub version whose images already exist locally — lets `mesh start`
- * include the Hub by default with no network and no registry auth. Returns
- * undefined when no built images are present.
- */
 export declare function localHubVersion(): string | undefined;
 export type WithHubPlan = {
     action: "refresh";
@@ -35,90 +14,15 @@ export type WithHubPlan = {
     message: string;
     remediation: string;
 };
-/**
- * Pure: decide what `mesh start --with-hub` does given the registry probe
- * and any already-built local images. Only a *refresh* needs the registry —
- * already-built images run without it, so an expired/missing token degrades
- * to those (with the fixing command) instead of hard-failing a path that
- * works offline (MESH-2479).
- */
 export declare function planWithHubRefresh(probeState: RegistryTokenState, builtVersion: string | undefined): WithHubPlan;
-/**
- * Ensure the two local hub images exist; build them from the tarball when
- * missing. Returns the hub version (used as the compose image tag).
- */
 export declare function ensureHubImages(): Promise<string>;
-/** Where the packed Hub ships its compiled authz catalog (`compile-authz.ts`). */
 export declare const HUB_COMPILED_AUTHZ_REL = "api/dist/authz/compiled.json";
-/** The compiled catalog artifact: `{ zed, metadata }`, the shape `SpiceDBSchema` takes. */
 export type HubCompiledAuthz = {
     zed: string;
     metadata: Record<string, unknown>;
 };
-/**
- * The cached tarball a local image version was built from, or null for a
- * from-source build (`<version>-src`), which never has one.
- *
- * @example
- * ```typescript
- * tarballNameForImageVersion("2.2.0-r2"); // => "mesh-tech-hub-2.2.0.tgz"
- * tarballNameForImageVersion("2.2.0-src"); // => null
- * ```
- */
 export declare function tarballNameForImageVersion(version: string): string | null;
-/**
- * Read the compiled authz catalog of the Hub whose images `mesh start` runs.
- *
- * The staged build context (`context-<version>/`) carries it after a build; when
- * the images already existed nothing was staged, so the one file is extracted
- * from the cached tarball on demand. Returns null for a Hub that ships no
- * catalog (published before 2.1.0) — the caller says so and moves on.
- */
 export declare function readHubCompiledAuthz(version: string): HubCompiledAuthz | null;
-/**
- * The workspace's default pnpm catalog, as `{ dependency: range }`.
- *
- * Nested manifests inside the packed Hub (`api/package.json`, `ui/package.json`)
- * reference shared versions as `catalog:`. pnpm resolves that on publish for the
- * package's OWN manifest only — the nested ones ship the literal `catalog:`, and
- * `npm install` inside the image rejects it with `EUNSUPPORTEDPROTOCOL`.
- */
 export declare function readWorkspaceCatalog(repoRoot: string): Record<string, string>;
-/**
- * Make an extracted Hub tarball installable by plain `npm` inside the image.
- *
- * Two rewrites, both on the NESTED manifests the Dockerfiles copy:
- *
- *  - `catalog:` → the range the workspace catalog pins.
- *  - `workspace:*` dependencies are DROPPED. Every deployed Hub entrypoint is
- *    bundled by `esm-bundle`, so no `@mesh-tech/*`
- *    or `@libs/*` import survives into `api/dist` / `ui/build` — installing them
- *    would fetch PUBLISHED copies that nothing imports, and for a package being
- *    changed in this checkout that published copy is precisely the wrong code.
- *  - `devDependencies` are DROPPED wholesale. Both Dockerfiles install with
- *    `--omit=dev`, so nothing in the image ever needs them — but npm still
- *    resolves them into the ideal tree before omitting, and the Hub's dev set
- *    (vitest, tsx, the React Router toolchain) trips a peer-conflict crash in
- *    the image's npm 10 (`Cannot read properties of null (reading 'edgesOut')`
- *    in arborist's `#loadPeerSet`) that fails the build before a single layer
- *    is written. Reproduced on the normalized `api/package.json` alone; the
- *    same manifest installs clean without the block.
- *
- * Returns the manifests it touched, for the caller to log.
- */
 export declare function normalizeHubManifests(contextDir: string, catalog: Record<string, string>): string[];
-/**
- * Build the local Hub images from THIS checkout instead of the registry.
- *
- * `mesh start`'s Hub normally comes from the published `@mesh-tech/hub` tarball,
- * which makes it the one environment where a Hub change cannot be exercised
- * before it ships. This packs `apps/hub` exactly as a release would — same
- * `files` allowlist, same Dockerfiles — so the containerized Hub, its auth proxy
- * and its login flow all stay identical; only the code inside changes.
- *
- * Images are tagged `<version>-src` so they can never be mistaken for, or reused
- * as, a published build, and are rebuilt every call: the whole point is to pick
- * up working-tree changes.
- */
 export declare function buildHubImagesFromSource(repoRoot: string): Promise<string>;
-//# sourceMappingURL=hub-local.d.ts.map