@mesh-tech/mesh-cli 0.20.1 → 0.20.3

package/dist/src/commands/local/seed-zitadel.d.ts

@@ -1,66 +1,11 @@
-/**
- * Zitadel seeding for the `mesh start` local platform — the `mesh login local`
- * path (P1 critical path, design §2.1 seeding).
- *
- * Mirrors what ZitadelPlatformIdentity provisions in the cloud, via the
- * management REST API using the first-instance machine user's PAT (written to
- * the zitadel_machinekey volume by the compose bootstrap). Org structure
- * follows the approved Zitadel tenant-auth pattern: everything here lives in
- * the PLATFORM org (`mesh` — platform-layer creds home, named by the
- * compose first-instance config); app tenants get their own orgs, created by
- * `mesh dev --local` (see auth-provision.ts):
- *   - project "mesh-cli" (pattern naming: project per app — the CLI is a
- *     platform-level client feature)
- *   - native OIDC application "cli" inside it (PKCE + device code, no
- *     secret — the same shape as ZitadelPlatformIdentity's cliApp, plus
- *     devMode for http)
- *   - two human test users (dev@local.mesh, ops@local.mesh)
- *   - registry parity: /mesh-platform/local/dev/platform/zitadel in the local
- *     AWS fabric ({endpoint, cliClientId} — what `mesh login` SSM discovery
- *     reads) and temporal/test-users entries (what `mesh dev test-user` reads)
- *   - the `local` CLI login context in ~/.config/mesh/config.json, so
- *     `mesh login local` works with zero discovery.
- *
- * Idempotent: search-before-create for project/app, "already exists" is
- * success for users, SSM params overwrite.
- */
 export declare const ZITADEL_ISSUER = "http://localhost:8080";
 export declare const LOGIN_CONTEXT = "local";
-/** The platform org — home of platform-layer creds, same name as the cloud
- * platform tenant. Set by ZITADEL_FIRSTINSTANCE_ORG_NAME in the compose;
- * app tenants (incl. the default `local`) get their own orgs on demand. */
 export declare const PLATFORM_ORG = "mesh";
-/**
- * Approved-pattern naming inside the platform org: project per app
- * (lowercase), application per service/client inside it. The CLI is a
- * platform-level client feature → project `mesh-cli`, application `cli`.
- * (The cloud's legacy catch-all "Platform" project is being retired by the
- * pattern doc's spec items; local starts pattern-true.)
- */
 export declare const CLI_PROJECT_NAME = "mesh-cli";
 export declare const CLI_APP_NAME = "cli";
 export declare const CLI_REDIRECT_URI = "http://localhost:9876/callback";
-/**
- * The Hub's own auth config (pattern-true: the Hub is a platform app →
- * project `hub` in the platform org, application per service). The `ui`
- * application backs the oauth2-proxy that fronts the Hub UI — the same
- * sidecar topology `mesh.apps.Service` deploys with `auth.provider: "mesh"`.
- * Roles ARE the Hub's vocabulary — imported from the module the deployed Hub's
- * infra declares them from, so a role that exists in the cloud is grantable
- * locally too (MESH-2504), including the tenant-keyed restricted keys
- * (`vendor:<tenant>`, `auditor:<tenant>`) that carry the only scope the policy
- * actually reads. The bare keys alone are not a usable local vocabulary: a bare
- * restricted grant names no tenant, so `checkPolicy` matches it against nothing
- * and it authorizes no tenant-scoped read.
- */
 export declare const HUB_PROJECT_NAME = "hub";
 export declare const HUB_APP_NAME = "ui";
-/** Registered on the seeded Hub app; the default-port URI is always included
- * so a later port switch never strands the app config. Zitadel's devMode only
- * relaxes the https requirement — every redirect URI must still be registered
- * exactly, so an existing app is RECONCILED (union-merged) on each seed run.
- * Functions, not constants: hubPort() must be read at call time so tests and
- * programmatic callers that set MESH_HUB_PORT after import see the override. */
 export declare const hubRedirectUri: () => string;
 export declare const HUB_DEFAULT_REDIRECT_URI = "http://localhost:9000/oauth2/callback";
 export declare const HUB_ROLES: string[];
@@ -73,13 +18,7 @@ export interface LocalTestUser {
     lastName: string;
     password: string;
 }
-/** Seeded human test users — plainly-labeled dev-grade credentials. */
 export declare const TEST_USERS: LocalTestUser[];
-/**
- * The CLI OIDC app payload — the same shape ZitadelPlatformIdentity creates in
- * the cloud (native, PKCE, device code, JWT access tokens, role assertions),
- * plus devMode so Zitadel accepts the http:// redirect locally.
- */
 export declare function buildCliAppPayload(): {
     name: string;
     redirectUris: string[];
@@ -93,35 +32,23 @@ export declare function buildCliAppPayload(): {
     idTokenUserinfoAssertion: boolean;
     devMode: boolean;
 };
-/** Read the seeder PAT the compose bootstrap wrote to the machinekey volume. */
 export declare function readSeederPat(): string;
-/** Call the local Zitadel REST API; `orgId` sets the org context header. */
 export declare function api(pat: string, method: string, apiPath: string, body?: unknown, orgId?: string): Promise<any>;
 export declare const isAlreadyExists: (err: any) => boolean;
-/**
- * Shared search-before-create for Zitadel projects: return the existing
- * project's id, else create it. Every ensure*Project in the local seeding
- * and auth-provisioning goes through this.
- */
 export declare function ensureZitadelProject(pat: string, name: string, opts?: {
     orgId?: string;
     describe?: string;
     logExisting?: boolean;
 }): Promise<string>;
-/** Shared name-equals application search; returns the raw app or undefined. */
 export declare function searchZitadelApp(pat: string, projectId: string, name: string, orgId?: string): Promise<any | undefined>;
 export interface HubAuthConfig {
     clientId: string;
     clientSecret: string;
     cookieSecret: string;
-    /** The Hub's own Zitadel project — what its authz pointer names (§7.1). */
     projectId: string;
 }
-/** Where the Hub's oauth2-proxy credentials persist between runs (the local
- * analog of the K8s Secret the Service component creates for the sidecar). */
 export declare function hubAuthPath(): string;
 export declare function readHubAuth(): HubAuthConfig | null;
-/** The slice of Zitadel's OIDC app shape the reconcile below reads. */
 interface HubOidcApp {
     id: string;
     oidcConfig?: {
@@ -137,16 +64,8 @@ interface HubOidcApp {
         devMode?: boolean;
     };
 }
-/** Union-merge the current-port redirect URIs into an existing Hub app's OIDC
- * config. Needed whenever the app was seeded under a different MESH_HUB_PORT:
- * devMode does NOT exempt an unregistered redirect_uri (Zitadel rejects the
- * authorize call with "redirect_uri is missing in the client configuration"),
- * it only permits http://. No-op when everything is already registered.
- * Exported for tests. */
 export declare function reconcileHubRedirectUris(pat: string, projectId: string, app: HubOidcApp): Promise<void>;
-/** Seed the Hub's auth config; persists oauth2-proxy credentials locally. */
 export declare function seedHubAuth(pat: string): Promise<HubAuthConfig>;
-/** Secrets Manager id the Hub reads its Zitadel admin key from (opsHubSecretName). */
 export declare const OPS_HUB_SECRET_ID = "mesh/local/dev/zitadel/ops-hub";
 export interface ZitadelSeedResult {
     projectId: string;
@@ -155,4 +74,3 @@ export interface ZitadelSeedResult {
 }
 export declare function seedZitadel(awsConfig: object): Promise<ZitadelSeedResult>;
 export {};
-//# sourceMappingURL=seed-zitadel.d.ts.map

package/dist/src/commands/local/seed-zitadel.js

@@ -1,29 +1,3 @@
-/**
- * Zitadel seeding for the `mesh start` local platform — the `mesh login local`
- * path (P1 critical path, design §2.1 seeding).
- *
- * Mirrors what ZitadelPlatformIdentity provisions in the cloud, via the
- * management REST API using the first-instance machine user's PAT (written to
- * the zitadel_machinekey volume by the compose bootstrap). Org structure
- * follows the approved Zitadel tenant-auth pattern: everything here lives in
- * the PLATFORM org (`mesh` — platform-layer creds home, named by the
- * compose first-instance config); app tenants get their own orgs, created by
- * `mesh dev --local` (see auth-provision.ts):
- *   - project "mesh-cli" (pattern naming: project per app — the CLI is a
- *     platform-level client feature)
- *   - native OIDC application "cli" inside it (PKCE + device code, no
- *     secret — the same shape as ZitadelPlatformIdentity's cliApp, plus
- *     devMode for http)
- *   - two human test users (dev@local.mesh, ops@local.mesh)
- *   - registry parity: /mesh-platform/local/dev/platform/zitadel in the local
- *     AWS fabric ({endpoint, cliClientId} — what `mesh login` SSM discovery
- *     reads) and temporal/test-users entries (what `mesh dev test-user` reads)
- *   - the `local` CLI login context in ~/.config/mesh/config.json, so
- *     `mesh login local` works with zero discovery.
- *
- * Idempotent: search-before-create for project/app, "already exists" is
- * success for users, SSM params overwrite.
- */
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
@@ -36,47 +10,17 @@ import { LOCAL_TENANT, LOCAL_ENV } from "./seed.js";
 import { meshCacheDir } from "../../utils/cache-home.js";
 export const ZITADEL_ISSUER = "http://localhost:8080";
 export const LOGIN_CONTEXT = "local";
-/** The platform org — home of platform-layer creds, same name as the cloud
- * platform tenant. Set by ZITADEL_FIRSTINSTANCE_ORG_NAME in the compose;
- * app tenants (incl. the default `local`) get their own orgs on demand. */
 export const PLATFORM_ORG = "mesh";
-/**
- * Approved-pattern naming inside the platform org: project per app
- * (lowercase), application per service/client inside it. The CLI is a
- * platform-level client feature → project `mesh-cli`, application `cli`.
- * (The cloud's legacy catch-all "Platform" project is being retired by the
- * pattern doc's spec items; local starts pattern-true.)
- */
 export const CLI_PROJECT_NAME = "mesh-cli";
 export const CLI_APP_NAME = "cli";
 export const CLI_REDIRECT_URI = "http://localhost:9876/callback";
-/**
- * The Hub's own auth config (pattern-true: the Hub is a platform app →
- * project `hub` in the platform org, application per service). The `ui`
- * application backs the oauth2-proxy that fronts the Hub UI — the same
- * sidecar topology `mesh.apps.Service` deploys with `auth.provider: "mesh"`.
- * Roles ARE the Hub's vocabulary — imported from the module the deployed Hub's
- * infra declares them from, so a role that exists in the cloud is grantable
- * locally too (MESH-2504), including the tenant-keyed restricted keys
- * (`vendor:<tenant>`, `auditor:<tenant>`) that carry the only scope the policy
- * actually reads. The bare keys alone are not a usable local vocabulary: a bare
- * restricted grant names no tenant, so `checkPolicy` matches it against nothing
- * and it authorizes no tenant-scoped read.
- */
 export const HUB_PROJECT_NAME = "hub";
 export const HUB_APP_NAME = "ui";
-/** Registered on the seeded Hub app; the default-port URI is always included
- * so a later port switch never strands the app config. Zitadel's devMode only
- * relaxes the https requirement — every redirect URI must still be registered
- * exactly, so an existing app is RECONCILED (union-merged) on each seed run.
- * Functions, not constants: hubPort() must be read at call time so tests and
- * programmatic callers that set MESH_HUB_PORT after import see the override. */
 export const hubRedirectUri = () => `http://localhost:${hubPort()}/oauth2/callback`;
 export const HUB_DEFAULT_REDIRECT_URI = `http://localhost:${DEFAULT_HUB_PORT}/oauth2/callback`;
 export const HUB_ROLES = hubOperatorRoleKeys([LOCAL_TENANT]);
 export const ZITADEL_SSM_PARAM = `/mesh-platform/${LOCAL_TENANT}/${LOCAL_ENV}/platform/zitadel`;
 export const TEST_USERS_SSM_PREFIX = `/mesh-platform/${LOCAL_TENANT}/${LOCAL_ENV}/temporal/test-users`;
-/** Seeded human test users — plainly-labeled dev-grade credentials. */
 export const TEST_USERS = [
     {
         name: "dev",
@@ -93,11 +37,6 @@ export const TEST_USERS = [
         password: "LocalDev1!",
     },
 ];
-/**
- * The CLI OIDC app payload — the same shape ZitadelPlatformIdentity creates in
- * the cloud (native, PKCE, device code, JWT access tokens, role assertions),
- * plus devMode so Zitadel accepts the http:// redirect locally.
- */
 export function buildCliAppPayload() {
     return {
         name: CLI_APP_NAME,
@@ -113,7 +52,6 @@ export function buildCliAppPayload() {
         devMode: true,
     };
 }
-/** Read the seeder PAT the compose bootstrap wrote to the machinekey volume. */
 export function readSeederPat() {
     const tmp = path.join(fs.mkdtempSync(path.join(os.tmpdir(), "mesh-zitadel-")), "pat.txt");
     try {
@@ -130,7 +68,6 @@ export function readSeederPat() {
         fs.rmSync(path.dirname(tmp), { recursive: true, force: true });
     }
 }
-/** Call the local Zitadel REST API; `orgId` sets the org context header. */
 export async function api(pat, method, apiPath, body, orgId) {
     const res = await fetch(`${ZITADEL_ISSUER}${apiPath}`, {
         method,
@@ -153,11 +90,6 @@ export async function api(pat, method, apiPath, body, orgId) {
     return data;
 }
 export const isAlreadyExists = (err) => err?.status === 409 || err?.zitadelCode === 6 || /already exists/i.test(err?.message ?? "");
-/**
- * Shared search-before-create for Zitadel projects: return the existing
- * project's id, else create it. Every ensure*Project in the local seeding
- * and auth-provisioning goes through this.
- */
 export async function ensureZitadelProject(pat, name, opts = {}) {
     const search = await api(pat, "POST", "/management/v1/projects/_search", { queries: [{ nameQuery: { name, method: "TEXT_QUERY_METHOD_EQUALS" } }] }, opts.orgId);
     const existing = search?.result?.[0]?.id;
@@ -170,7 +102,6 @@ export async function ensureZitadelProject(pat, name, opts = {}) {
     logSuccess(`Created Zitadel project '${name}'${opts.describe ? ` (${opts.describe})` : ""}`);
     return created.id;
 }
-/** Shared name-equals application search; returns the raw app or undefined. */
 export async function searchZitadelApp(pat, projectId, name, orgId) {
     const search = await api(pat, "POST", `/management/v1/projects/${projectId}/apps/_search`, { queries: [{ nameQuery: { name, method: "TEXT_QUERY_METHOD_EQUALS" } }] }, orgId);
     return search?.result?.[0];
@@ -215,8 +146,6 @@ async function ensureTestUsers(pat) {
         }
     }
 }
-/** Where the Hub's oauth2-proxy credentials persist between runs (the local
- * analog of the K8s Secret the Service component creates for the sidecar). */
 export function hubAuthPath() {
     return path.join(meshCacheDir("mesh-local"), "hub-auth.json");
 }
@@ -232,13 +161,6 @@ export function readHubAuth() {
     }
 }
 const ensureHubProject = (pat) => ensureZitadelProject(pat, HUB_PROJECT_NAME, { describe: "Hub platform app" });
-/**
- * What a role key is called in Zitadel's own UI and in the Hub's role picker.
- *
- * A tenant-keyed key reads as the base role plus the tenant it is scoped to, so
- * that `vendor:local` is not offered to an administrator as an opaque string
- * sitting next to a bare `vendor` that grants something entirely different.
- */
 function hubRoleDisplayName(roleKey) {
     const tenant = hubRoleKeyTenant(roleKey);
     return tenant === null ? roleKey : `${restrictedRoleBase(roleKey) ?? roleKey} (${tenant})`;
@@ -258,21 +180,11 @@ async function ensureHubRoles(pat, projectId) {
         }
     }
 }
-/** Union-merge the current-port redirect URIs into an existing Hub app's OIDC
- * config. Needed whenever the app was seeded under a different MESH_HUB_PORT:
- * devMode does NOT exempt an unregistered redirect_uri (Zitadel rejects the
- * authorize call with "redirect_uri is missing in the client configuration"),
- * it only permits http://. No-op when everything is already registered.
- * Exported for tests. */
 export async function reconcileHubRedirectUris(pat, projectId, app) {
     const cfg = app?.oidcConfig ?? {};
     const redirectUris = [
         ...new Set([...(cfg.redirectUris ?? []), hubRedirectUri(), HUB_DEFAULT_REDIRECT_URI]),
     ];
-    // Both slash forms: the Hub's /logout sends `${origin}/` (trailing slash —
-    // matching the deployed platform, which registers `${baseUrl}/`), and
-    // Zitadel exact-matches post_logout_redirect_uri. Seeding only the bare
-    // form made local sign-out fail with "post_logout_redirect_uri invalid".
     const postLogoutRedirectUris = [
         ...new Set([
             ...(cfg.postLogoutRedirectUris ?? []),
@@ -286,12 +198,6 @@ export async function reconcileHubRedirectUris(pat, projectId, app) {
         postLogoutRedirectUris.length === (cfg.postLogoutRedirectUris ?? []).length) {
         return;
     }
-    // UpdateOIDCAppConfig replaces the whole config — carry the fields we seed
-    // (falling back to the create-time shape; appType/authMethodType are
-    // re-asserted to the seeded values). Fields we never seed — e.g.
-    // additionalOrigins, clockSkew, backChannelLogoutUri — are NOT carried, so
-    // anything set out-of-band in the Zitadel console is dropped here. Fine for
-    // the local dev app; revisit before reusing against a shared instance.
     await api(pat, "PUT", `/management/v1/projects/${projectId}/apps/${app.id}/oidc_config`, {
         redirectUris,
         postLogoutRedirectUris,
@@ -310,9 +216,6 @@ export async function reconcileHubRedirectUris(pat, projectId, app) {
     });
     logSuccess(`Registered Hub redirect URI http://localhost:${hubPort()}/oauth2/callback (MESH_HUB_PORT)`);
 }
-/** Ensure the Hub `ui` web application; heals a lost client secret (Zitadel
- * returns it once — regenerate when the persisted copy is gone) and keeps the
- * redirect URIs in sync with the configured Hub port. */
 async function ensureHubApp(pat, projectId) {
     const existing = await searchZitadelApp(pat, projectId, HUB_APP_NAME);
     if (existing) {
@@ -329,8 +232,6 @@ async function ensureHubApp(pat, projectId) {
         name: HUB_APP_NAME,
         redirectUris: [...new Set([hubRedirectUri(), HUB_DEFAULT_REDIRECT_URI])],
         postLogoutRedirectUris: [
-            // Both slash forms — see reconcileHubRedirectUris; Zitadel exact-matches
-            // and the Hub's /logout sends the trailing-slash form.
             ...new Set([
                 `http://localhost:${hubPort()}`,
                 `http://localhost:${hubPort()}/`,
@@ -351,8 +252,6 @@ async function ensureHubApp(pat, projectId) {
     logSuccess(`Created Zitadel application '${HUB_APP_NAME}' (Hub UI web client, code flow)`);
     return { clientId: created.clientId, clientSecret: created.clientSecret };
 }
-/** Grant Hub roles: admin@local.mesh + dev get `ops` (full dashboard),
- * ops@local.mesh gets `developer` — proves per-user role claims. */
 async function ensureHubGrants(pat, projectId) {
     const grants = [
         { email: "admin@local.mesh", roles: ["ops"] },
@@ -379,15 +278,12 @@ async function ensureHubGrants(pat, projectId) {
         }
     }
 }
-/** Seed the Hub's auth config; persists oauth2-proxy credentials locally. */
 export async function seedHubAuth(pat) {
     const projectId = await ensureHubProject(pat);
     await ensureHubRoles(pat, projectId);
     const app = await ensureHubApp(pat, projectId);
     await ensureHubGrants(pat, projectId);
     const persisted = readHubAuth();
-    // oauth2-proxy wants a RAW 16/24/32-byte cookie secret — the hosted
-    // sidecar uses a 32-char RandomPassword; mirror that.
     const persistedCookie = persisted?.cookieSecret && [16, 24, 32].includes(persisted.cookieSecret.length)
         ? persisted.cookieSecret
         : undefined;
@@ -400,20 +296,6 @@ export async function seedHubAuth(pat) {
     fs.writeFileSync(hubAuthPath(), JSON.stringify(config, null, 2), { mode: 0o600 });
     return config;
 }
-/**
- * Publish the Hub's OWN authz pointer — the local stand-in for what the platform
- * Pulumi program publishes (Hub RBAC design §7.1).
- *
- * The Hub administers every app's identity through
- * `identity/apps/{app}/users`, which resolves the app's Zitadel project and org
- * from its published pointer. Without a pointer of its own the Hub is the one
- * app it cannot administer: its Users page has no project to create people in
- * and no role vocabulary to grant, which is why that page could only ever be a
- * mock. Locally there is no Pulumi run to publish it, so seeding does.
- *
- * Read-modify-write: the compiled-schema keys (`opsHubMetadataRef`, `mode`) are
- * published by the Hub itself and must survive this.
- */
 async function publishHubAuthzPointer(projectId, orgId, awsConfig) {
     const { SSMClient, GetParameterCommand, PutParameterCommand } = await import("@aws-sdk/client-ssm");
     const ssm = new SSMClient(awsConfig);
@@ -424,7 +306,6 @@ async function publishHubAuthzPointer(projectId, orgId, awsConfig) {
         current = JSON.parse(existing.Parameter?.Value ?? "{}");
     }
     catch {
-        // First run — nothing published yet.
     }
     const value = {
         spicedb: { instanceRefs: [] },
@@ -440,7 +321,6 @@ async function publishHubAuthzPointer(projectId, orgId, awsConfig) {
     }));
     logSuccess(`Hub authz pointer published → project ${projectId} in org ${orgId}`);
 }
-/** Registry parity: what SSM discovery and `mesh dev test-user` read in the cloud. */
 async function writeRegistryParams(cliClientId, awsConfig) {
     const { SSMClient, PutParameterCommand } = await import("@aws-sdk/client-ssm");
     const ssm = new SSMClient(awsConfig);
@@ -461,21 +341,7 @@ async function writeRegistryParams(cliClientId, awsConfig) {
         }));
     }
 }
-/** Secrets Manager id the Hub reads its Zitadel admin key from (opsHubSecretName). */
 export const OPS_HUB_SECRET_ID = "mesh/local/dev/zitadel/ops-hub";
-/**
- * Give the local Hub an ADMIN plane.
- *
- * The Hub verifies tokens with `ZITADEL_ISSUER`, but every WRITE — creating a
- * user, minting an API key — goes through a machine key it loads from Secrets
- * Manager. Without that key the local Hub silently offers no create affordance
- * and nothing reaches the IdP, which reads as "the feature is broken" rather
- * than "the credential was never provisioned".
- *
- * The key is a Zitadel machine key (private_key_jwt): `{ keyId, key, userId }`.
- * Idempotent — an existing user is reused, and a fresh key is minted only when
- * the secret is absent, because Zitadel returns the private half exactly once.
- */
 async function ensureOpsHubAdmin(pat, awsConfig) {
     const { SecretsManagerClient, GetSecretValueCommand, CreateSecretCommand, PutSecretValueCommand, } = await import("@aws-sdk/client-secrets-manager");
     const sm = new SecretsManagerClient(awsConfig);
@@ -501,8 +367,6 @@ async function ensureOpsHubAdmin(pat, awsConfig) {
     }
     if (!userId)
         throw new MeshCliError("could not create the Hub's Zitadel admin user");
-    // IAM_OWNER because the Hub administers every org on the instance — each app
-    // tenant gets its own org, and a key is minted in the app's org, not the Hub's.
     await api(pat, "POST", "/admin/v1/members", { userId, roles: ["IAM_OWNER"] }).catch(() => undefined);
     const key = await api(pat, "POST", `/management/v1/users/${userId}/keys`, {
         type: "KEY_TYPE_JSON",
@@ -518,25 +382,11 @@ async function ensureOpsHubAdmin(pat, awsConfig) {
     });
     logSuccess(`Hub admin key provisioned → ${OPS_HUB_SECRET_ID} (Zitadel writes enabled)`);
 }
-/** Where the local stack's mail goes — the `mailpit` service in docker-compose. */
 const LOCAL_SMTP = {
     host: "mailpit:1025",
     from: "no-reply@local.mesh",
     fromName: "Mesh (local)",
 };
-/**
- * Point the instance's mail at the local mailbox, on every start.
- *
- * The compose file sets the same thing via `ZITADEL_DEFAULTINSTANCE_SMTP…`,
- * but those apply at FIRST INIT only — so every stack that existed before the
- * mailbox was added would keep no SMTP config at all, and activation and
- * password-reset mail would go on silently going nowhere. Reconciling here
- * covers those without asking anyone to `mesh stop --destroy`.
- *
- * Idempotent: reads the configured providers first and only writes when the
- * host differs. Best-effort — a stack whose mail is misconfigured is worth a
- * warning, not a failed `mesh start`.
- */
 async function ensureLocalSmtp(pat) {
     try {
         const existing = await api(pat, "POST", "/admin/v1/smtp/_search", {}).catch(() => null);
@@ -551,7 +401,6 @@ async function ensureLocalSmtp(pat) {
                 user: "",
                 password: "",
             });
-            // A provider that exists but is not active still sends nothing.
             if (created?.id)
                 await api(pat, "POST", `/admin/v1/smtp/${created.id}/_activate`, {});
             logSuccess(`Local mailbox wired to Zitadel → ${LOCAL_SMTP.host} (view at http://localhost:8025)`);
@@ -575,21 +424,15 @@ export async function seedZitadel(awsConfig) {
         throw new MeshCliError(`Platform org '${PLATFORM_ORG}' not found — the zitadel volume predates the org naming.`, { remediation: { command: "mesh stop --destroy && mesh start" } });
     }
     logSuccess(`Platform org '${PLATFORM_ORG}' ready (platform tenant root — holds platform-service auth config)`);
-    // Zitadel v4 defaults new instances to the login-v2 UI — a separate
-    // container this stack doesn't run. Pin the built-in v1 login so the
-    // authorize flow has a page to land on (idempotent; compose sets the
-    // same default at first-instance time).
     try {
         await api(pat, "PUT", "/v2/features/instance", { loginV2: { required: false } });
     }
     catch {
-        // pre-v4 instance or endpoint drift — v1 login is already the default
     }
     await ensureLocalSmtp(pat);
     const projectId = await ensureCliProject(pat);
     const cliClientId = await ensureCliApp(pat, projectId);
     await ensureTestUsers(pat);
-    // Hub auth AFTER test users exist (role grants target them).
     const hubAuth = await seedHubAuth(pat);
     await publishHubAuthzPointer(hubAuth.projectId, org.result[0].id, awsConfig);
     await writeRegistryParams(cliClientId, awsConfig);
@@ -598,4 +441,3 @@ export async function seedZitadel(awsConfig) {
     logSuccess(`Login context '${LOGIN_CONTEXT}' configured → try: mesh login ${LOGIN_CONTEXT}`);
     return { projectId, cliClientId, hubAuth };
 }
-//# sourceMappingURL=seed-zitadel.js.map

package/dist/src/commands/local/seed.d.ts

@@ -1,28 +1,8 @@
-/**
- * First-boot seeding for the `mesh start` local platform.
- *
- * Registers tenant `local` / env `dev` in the local AWS fabric's (ministack)
- * SSM registry with the same shape TenantEnvironments writes in the cloud
- * (/mesh-platform/{tenant}/{env}/app-tenants → TenantEnvironmentsExports), and
- * creates the tenant artifacts bucket. Idempotent — parameters are overwritten,
- * the bucket create tolerates "already owned by you".
- *
- * Zitadel org/project/CLI-app + test-user seeding (the `mesh login local`
- * path) is tracked as a follow-up on the mesh start epic.
- */
 export declare const LOCAL_TENANT = "local";
 export declare const LOCAL_ENV = "dev";
 export declare const LOCAL_AWS_ENDPOINT = "http://localhost:4566";
 export declare const LOCAL_AWS_REGION = "us-east-2";
 export declare const ARTIFACTS_BUCKET = "mesh-local-artifacts";
-/**
- * General-purpose local data bucket for pipeline development. A `mesh dev
- * --local` session inherits `AWS_ENDPOINT_URL`, so a pipeline's S3 resource
- * (a Dagster pipes-message reader, a sample-input loader) pointed at this
- * bucket round-trips against ministack with no AWS account. Seeded with a
- * sample pipes fragment under `samples/` so a fresh stack has something to
- * materialize from.
- */
 export declare const DATA_BUCKET = "mesh-local-data";
 export declare const APP_TENANTS_PARAM = "/mesh-platform/local/dev/app-tenants";
 export declare const LOCAL_AWS_CONFIG: {
@@ -33,21 +13,7 @@ export declare const LOCAL_AWS_CONFIG: {
         secretAccessKey: string;
     };
 };
-/**
- * Env vars that point any AWS SDK process on the host at the local fabric —
- * the SDK-native endpoint override (AWS_ENDPOINT_URL, supported since SDK JS
- * v3 ~3.428), so no client-code changes are needed. `mesh dev` local mode
- * injects these into app processes; humans can `eval` them from the
- * `mesh start` output. In-network services get the same wiring with
- * http://ministack:4566 (see the compose file's x-local-aws-env anchor).
- */
 export declare function localAwsEnv(): Record<string, string>;
-/**
- * The local tenant registration, shaped like TenantEnvironmentsExports
- * (libs/infra-components …/platform/TenantEnvironments.ts) so consumers of the
- * registry (Hub API, init checks) read local and cloud identically. AWS-only
- * fields carry inert local placeholders.
- */
 export declare function buildAppTenantsSeed(): {
     hubTenant: string;
     primaryTenant: {
@@ -73,43 +39,13 @@ export interface SeedResult {
     bucket: string;
 }
 export declare const FABRIC_CHECK_PATH = "/mesh-platform/local/dev/.fabric-check";
-/** The tenant's Temporal namespace, matching the cloud convention
- * TemporalNamespaceProvisioner uses ({tenant}-{env}, e.g. "acme-dev"). */
 export declare const TEMPORAL_NAMESPACE = "local-dev";
 export declare const TEMPORAL_ADDRESS = "localhost:7233";
-/**
- * Register the local tenant's Temporal namespace ({tenant}-{env} — the same
- * name TemporalNamespaceProvisioner would create in the cloud). Idempotent:
- * "already exists" is success. Dynamic import — @temporalio/client is an
- * optionalDependency (same pattern as commands/temporal.ts).
- */
 export declare function seedTemporalNamespace(): Promise<void>;
-/**
- * Idempotently register a Temporal namespace. `mesh dev --local` uses this
- * for the per-app namespaces ({tenant}-{env}-{app}) the cloud provisioner
- * creates — the Hub's per-app workflow views resolve exactly that name.
- */
 export declare function ensureTemporalNamespace(namespace: string, description?: string): Promise<void>;
-/**
- * A deterministic >4 KB payload for the Advanced-tier round-trip. Standard
- * SSM params cap at 4 KB; mesh.exports.Export writes tier "Advanced" values
- * up to 8 KB (Export.ts), and the emulator's fidelity there is the one open
- * question the design (§2.5) requires this check to answer on every boot.
- */
 export declare function buildFabricCheckPayload(targetBytes?: number): string;
-/**
- * Verify the local AWS fabric behaves like real SSM where the platform
- * depends on it: an 8 KB Advanced-tier parameter round-trips intact, and
- * child parameters under a path come back via GetParametersByPath (the
- * shape mesh.exports.Export's splitKeys mode reads). Check params are
- * removed afterwards.
- */
 export declare function verifyFabric(): Promise<void>;
-/** Write the Hub-readable tenant + environment registrations (the shapes
- * hub-api's SSM assembler requires: RawTenant at /{tenant}, RawEnvironment
- * at /{tenant}/{env}). Exported for reuse by app-tenant provisioning. */
 export declare function registerTenantEnv(tenant: string, opts?: {
     tier?: "hub" | "dedicated" | "shared";
 }): Promise<void>;
 export declare function seedLocalPlatform(): Promise<SeedResult>;
-//# sourceMappingURL=seed.d.ts.map