@mesh-tech/mesh-cli 0.20.1 → 0.20.3

package/dist/src/commands/secrets/index.d.ts

@@ -1,11 +1,2 @@
-/**
- * mesh secrets - Commands for working with AWS Secrets Manager
- *
- * Commands:
- * mesh secrets exec    - Run command with secrets injected as environment variables
- * mesh secrets set     - Set credentials for an external service
- * mesh secrets reindex - Rebuild a keyed service's instance index from Secrets Manager
- */
 import { Command } from "commander";
 export declare function registerSecretsCommands(program: Command): void;
-//# sourceMappingURL=index.d.ts.map

package/dist/src/commands/secrets/index.js

@@ -1,11 +1,3 @@
-/**
- * mesh secrets - Commands for working with AWS Secrets Manager
- *
- * Commands:
- * mesh secrets exec    - Run command with secrets injected as environment variables
- * mesh secrets set     - Set credentials for an external service
- * mesh secrets reindex - Rebuild a keyed service's instance index from Secrets Manager
- */
 import { Option } from "commander";
 import { execCommand } from "./exec.js";
 import { setCommand } from "./set.js";
@@ -20,7 +12,6 @@ export function registerSecretsCommands(program) {
         .description("Run command with secrets as environment variables")
         .allowUnknownOption(true)
         .action(async (_opts, cmd) => {
-        // Get all args after "secrets exec"
         const args = cmd.args;
         await execCommand(args);
     });
@@ -58,4 +49,3 @@ export function registerSecretsCommands(program) {
         await migrateConfigCommand(opts);
     });
 }
-//# sourceMappingURL=index.js.map

package/dist/src/commands/secrets/migrate-config.d.ts

@@ -1,19 +1,3 @@
-/**
- * mesh secrets migrate-config — Backfill .config mirror secrets.
- *
- * For each external service discovered in SSM, reads the main secret from
- * Secrets Manager, extracts non-secret fields using the credential schema,
- * and writes them to {secretPrefix}/.config.
- *
- * Idempotent: skips services where .config already exists (unless --force).
- * Handles multi-instance services by iterating instance keys.
- *
- * Usage:
- *   mesh secrets migrate-config                 # migrate all services
- *   mesh secrets migrate-config --force         # overwrite existing .config
- *   mesh secrets migrate-config --dry-run       # show what would be written
- *   mesh secrets migrate-config --stage dev     # override stage detection
- */
 export declare function migrateConfigCommand(opts: {
     force?: boolean;
     dryRun?: boolean;
@@ -21,4 +5,3 @@ export declare function migrateConfigCommand(opts: {
     stage?: string;
     region?: string;
 }): Promise<void>;
-//# sourceMappingURL=migrate-config.d.ts.map

package/dist/src/commands/secrets/migrate-config.js

@@ -1,27 +1,8 @@
-/**
- * mesh secrets migrate-config — Backfill .config mirror secrets.
- *
- * For each external service discovered in SSM, reads the main secret from
- * Secrets Manager, extracts non-secret fields using the credential schema,
- * and writes them to {secretPrefix}/.config.
- *
- * Idempotent: skips services where .config already exists (unless --force).
- * Handles multi-instance services by iterating instance keys.
- *
- * Usage:
- *   mesh secrets migrate-config                 # migrate all services
- *   mesh secrets migrate-config --force         # overwrite existing .config
- *   mesh secrets migrate-config --dry-run       # show what would be written
- *   mesh secrets migrate-config --stage dev     # override stage detection
- */
 import { SSMClient, GetParametersByPathCommand, } from "@aws-sdk/client-ssm";
 import { SecretsManagerClient, GetSecretValueCommand, PutSecretValueCommand, CreateSecretCommand, ListSecretsCommand, } from "@aws-sdk/client-secrets-manager";
 import { detectContext } from "../../utils/context.js";
 import { logInfo, logSuccess, logError } from "../../utils/log.js";
 import { resolveStackOption } from "../../utils/stack-flag.js";
-// =============================================================================
-// Schema normalization (same as set.ts)
-// =============================================================================
 function normalizeEntry(raw) {
     if (raw.type === "group" && raw.fields) {
         return {
@@ -42,9 +23,6 @@ function normalizeEntry(raw) {
 function normalizeFields(raw) {
     return Object.fromEntries(Object.entries(raw).map(([key, value]) => [key, normalizeEntry(value)]));
 }
-// =============================================================================
-// Discovery (same logic as set.ts)
-// =============================================================================
 async function discoverExternalServices(ssmClient, tenant, platformEnv) {
     const services = new Map();
     const basePath = `/mesh-platform/${tenant}/${platformEnv}`;
@@ -86,9 +64,6 @@ async function discoverExternalServices(ssmClient, tenant, platformEnv) {
     } while (nextToken);
     return services;
 }
-// =============================================================================
-// Non-secret field extraction
-// =============================================================================
 function extractNonSecretFields(fields, values) {
     const result = {};
     for (const [key, entry] of Object.entries(fields)) {
@@ -105,9 +80,6 @@ function extractNonSecretFields(fields, values) {
     }
     return result;
 }
-// =============================================================================
-// SM helpers
-// =============================================================================
 function isResourceNotFound(err) {
     const e = err;
     return (e?.name === "ResourceNotFoundException" ||
@@ -178,9 +150,6 @@ async function listInstanceKeys(client, secretPrefix) {
     } while (nextToken);
     return keys;
 }
-// =============================================================================
-// Migration logic
-// =============================================================================
 async function migrateService(smClient, meta, schema, opts) {
     let migrated = 0;
     let skipped = 0;
@@ -188,7 +157,6 @@ async function migrateService(smClient, meta, schema, opts) {
     async function migrateOneSecret(secretId, label) {
         const configId = `${secretId}/.config`;
         try {
-            // Check if .config already exists
             if (!opts.force) {
                 const exists = await secretExists(smClient, configId);
                 if (exists) {
@@ -197,14 +165,12 @@ async function migrateService(smClient, meta, schema, opts) {
                     return;
                 }
             }
-            // Read the main secret
             const values = await readSecret(smClient, secretId);
             if (!values) {
                 logInfo(`  SKIP ${label} — main secret empty or missing`);
                 skipped++;
                 return;
             }
-            // Extract non-secret fields
             const configValues = extractNonSecretFields(schema.fields, values);
             if (opts.dryRun) {
                 const fieldCount = Object.keys(configValues).length;
@@ -222,9 +188,7 @@ async function migrateService(smClient, meta, schema, opts) {
             errors++;
         }
     }
-    // Migrate the base secret
     await migrateOneSecret(meta.secretPrefix, meta.name);
-    // Migrate multi-instance keys
     if (schema.keyedBy) {
         const keys = await listInstanceKeys(smClient, meta.secretPrefix);
         for (const key of keys) {
@@ -233,9 +197,6 @@ async function migrateService(smClient, meta, schema, opts) {
     }
     return { migrated, skipped, errors };
 }
-// =============================================================================
-// Main command
-// =============================================================================
 export async function migrateConfigCommand(opts) {
     const context = detectContext(resolveStackOption(opts));
     const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
@@ -274,4 +235,3 @@ export async function migrateConfigCommand(opts) {
         process.exit(1);
     }
 }
-//# sourceMappingURL=migrate-config.js.map

package/dist/src/commands/secrets/reindex.d.ts

@@ -1,35 +1,5 @@
-/**
- * mesh secrets reindex — Rebuild a keyed external service's instance index.
- *
- * The instance index (`{secretPrefix}/.index`) is what `listInstances()`
- * reads, and it is only as correct as its writers: `mesh secrets set --key`
- * and the Hub maintain it as they create and delete instance secrets, but a
- * per-key secret created or deleted OUT OF BAND (the AWS console, a raw SDK
- * call) leaves it stale — the instance exists but is invisible, or is listed
- * but gone. This command is the repair: it scans the real per-key secrets
- * under the prefix with `secretsmanager:ListSecrets` (an operator-credential
- * call — pods cannot make it, which is why the index exists at all) and
- * rewrites the index to match.
- *
- * Usage:
- *   mesh secrets reindex external/symitar
- *   mesh secrets reindex external/symitar --dry-run
- *
- * The command detects tenant/stage from Pulumi config in the current
- * directory, like `mesh secrets set`.
- */
 import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
-/**
- * Scan the per-key secrets actually present under the prefix. Uses the shared
- * `instanceKeyFromSecretName` filter, so "which secrets are instances" cannot
- * drift from what `mesh secrets set` and the Hub consider an instance.
- */
 export declare function scanInstanceKeys(client: SecretsManagerClient, secretPrefix: string): Promise<string[]>;
-/**
- * Whether the index can be left untouched. A malformed index never counts as
- * matching — even when the diff is empty (zero per-key secrets): the whole
- * point of the repair is to leave a well-formed index behind.
- */
 export declare function indexAlreadyMatches(missing: string[], stale: string[], indexExists: boolean, malformed: boolean): boolean;
 export declare function reindexCommand(servicePath: string | undefined, opts: {
     stack?: string;
@@ -37,12 +7,4 @@ export declare function reindexCommand(servicePath: string | undefined, opts: {
     region?: string;
     dryRun?: boolean;
 }): Promise<void>;
-/**
- * Write the canonical index value for `keys`, creating the index secret when
- * it does not exist. The create path warns that the secret is not
- * stack-managed: the declaring stack also declares it, and created here
- * first it is not in the stack's state, so the stack's next deploy fails on
- * the name collision until the secret is imported or deleted.
- */
 export declare function writeInstanceIndex(client: SecretsManagerClient, secretPrefix: string, serviceName: string, keys: string[]): Promise<void>;
-//# sourceMappingURL=reindex.d.ts.map

package/dist/src/commands/secrets/reindex.js

@@ -1,23 +1,3 @@
-/**
- * mesh secrets reindex — Rebuild a keyed external service's instance index.
- *
- * The instance index (`{secretPrefix}/.index`) is what `listInstances()`
- * reads, and it is only as correct as its writers: `mesh secrets set --key`
- * and the Hub maintain it as they create and delete instance secrets, but a
- * per-key secret created or deleted OUT OF BAND (the AWS console, a raw SDK
- * call) leaves it stale — the instance exists but is invisible, or is listed
- * but gone. This command is the repair: it scans the real per-key secrets
- * under the prefix with `secretsmanager:ListSecrets` (an operator-credential
- * call — pods cannot make it, which is why the index exists at all) and
- * rewrites the index to match.
- *
- * Usage:
- *   mesh secrets reindex external/symitar
- *   mesh secrets reindex external/symitar --dry-run
- *
- * The command detects tenant/stage from Pulumi config in the current
- * directory, like `mesh secrets set`.
- */
 import { SSMClient } from "@aws-sdk/client-ssm";
 import { SecretsManagerClient, ListSecretsCommand, GetSecretValueCommand, PutSecretValueCommand, CreateSecretCommand, } from "@aws-sdk/client-secrets-manager";
 import { buildInstanceIndexValue, instanceIndexSecretId, instanceKeyFromSecretName, parseInstanceIndex, } from "@mesh-tech/secrets";
@@ -25,11 +5,6 @@ import { detectContext } from "../../utils/context.js";
 import { logInfo, logSuccess, logError } from "../../utils/log.js";
 import { resolveStackOption } from "../../utils/stack-flag.js";
 import { discoverExternalServices, ensureAwsCredentialsForStack, isResourceNotFound, } from "./set.js";
-/**
- * Scan the per-key secrets actually present under the prefix. Uses the shared
- * `instanceKeyFromSecretName` filter, so "which secrets are instances" cannot
- * drift from what `mesh secrets set` and the Hub consider an instance.
- */
 export async function scanInstanceKeys(client, secretPrefix) {
     const keys = [];
     let nextToken;
@@ -47,11 +22,6 @@ export async function scanInstanceKeys(client, secretPrefix) {
     } while (nextToken);
     return keys;
 }
-/**
- * Whether the index can be left untouched. A malformed index never counts as
- * matching — even when the diff is empty (zero per-key secrets): the whole
- * point of the repair is to leave a well-formed index behind.
- */
 export function indexAlreadyMatches(missing, stale, indexExists, malformed) {
     return missing.length === 0 && stale.length === 0 && indexExists && !malformed;
 }
@@ -85,7 +55,6 @@ export async function reindexCommand(servicePath, opts) {
     }
     const secretPrefix = svc.meta.secretPrefix;
     const indexId = instanceIndexSecretId(secretPrefix);
-    // What the account actually holds vs what the index claims.
     const actual = [...new Set(await scanInstanceKeys(smClient, secretPrefix))].sort();
     let listed = [];
     let indexExists = true;
@@ -124,13 +93,6 @@ export async function reindexCommand(servicePath, opts) {
     await writeInstanceIndex(smClient, secretPrefix, serviceName, actual);
     logSuccess(`Index rebuilt: ${indexId} now lists ${actual.length} instance(s).`);
 }
-/**
- * Write the canonical index value for `keys`, creating the index secret when
- * it does not exist. The create path warns that the secret is not
- * stack-managed: the declaring stack also declares it, and created here
- * first it is not in the stack's state, so the stack's next deploy fails on
- * the name collision until the secret is imported or deleted.
- */
 export async function writeInstanceIndex(client, secretPrefix, serviceName, keys) {
     const indexId = instanceIndexSecretId(secretPrefix);
     const secretString = buildInstanceIndexValue(keys);
@@ -154,4 +116,3 @@ export async function writeInstanceIndex(client, secretPrefix, serviceName, keys
             `secret into the stack before its next deploy.`);
     }
 }
-//# sourceMappingURL=reindex.js.map

package/dist/src/commands/secrets/set.d.ts

@@ -1,34 +1,6 @@
-/**
- * mesh secrets set — Set credentials for an external service.
- *
- * Reads the credential field schema from SSM (written by ExternalService),
- * prompts interactively for each field, and writes to Secrets Manager.
- *
- * Supports nested credential schemas: groups render as sections with headers,
- * and the stored JSON mirrors the nested structure exactly.
- *
- * Usage:
- *   mesh secrets set external/symitar                  # single-instance
- *   mesh secrets set external/symitar --key=12345      # multi-instance (specific key)
- *   mesh secrets set external/symitar --all            # include optional fields
- *   mesh secrets set external/symitar --non-interactive --json='{"baseUrl":"..."}'
- *
- * The command detects tenant/stage from Pulumi config in the current directory.
- */
 import { SSMClient } from "@aws-sdk/client-ssm";
 import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
-/**
- * Ensure AWS credentials are available for the SSM/Secrets Manager calls. If the
- * environment has none, assume the stack's `mesh:deployerRole` — which triggers
- * `mesh login` automatically when there's no active session. No-op when
- * credentials are already present or the stack/role can't be resolved.
- *
- * The stack is the locally-detected stage (from the `Pulumi.<stage>.yaml`
- * filename) — NOT `pulumi stack --show-name`, which would itself need creds to
- * read the backend (the chicken-and-egg this is meant to avoid).
- */
 export declare function ensureAwsCredentialsForStack(stack: string | undefined): Promise<void>;
-/** Leaf field in the credential schema */
 interface SchemaField {
     type: "field";
     name: string;
@@ -36,14 +8,12 @@ interface SchemaField {
     secret: boolean;
     optional: boolean;
 }
-/** Group of fields (may nest further) */
 interface SchemaGroup {
     type: "group";
     name: string;
     description: string;
     fields: Record<string, SchemaField | SchemaGroup>;
 }
-/** A schema entry is either a leaf field or a nested group */
 type SchemaEntry = SchemaField | SchemaGroup;
 export interface CredentialSchema {
     fields: Record<string, SchemaEntry>;
@@ -68,22 +38,5 @@ export declare function setCommand(servicePath: string | undefined, opts: {
     region?: string;
 }): Promise<void>;
 export declare function isResourceNotFound(err: unknown): boolean;
-/**
- * Add an instance key to the service's instance index at
- * `{secretPrefix}/.index` — the list `listInstances()` reads. Read-modify-
- * write: a MISSING index is created from just this key (the deploy normally
- * seeds an empty one), an already-listed key is a no-op. A MALFORMED index
- * is deliberately left alone (warn only): rebuilding it from just this key
- * would silently drop the rest of the fleet from the list, so the full
- * repair belongs to `mesh secrets reindex`. The read-modify-write itself is
- * unguarded — Secrets Manager has no conditional put — so two concurrent
- * writers to the same service can drop a key; same repair.
- *
- * Non-fatal by design, like the `.config` mirror: the credential itself is
- * already written, so failing the whole command here would report a write
- * that succeeded as failed. The cost of skipping is an instance invisible to
- * `listInstances()` until repaired — the warning names the repair.
- */
 export declare function addKeyToInstanceIndex(client: SecretsManagerClient, secretPrefix: string, key: string, serviceName: string): Promise<void>;
 export {};
-//# sourceMappingURL=set.d.ts.map

package/dist/src/commands/secrets/set.js

@@ -1,20 +1,3 @@
-/**
- * mesh secrets set — Set credentials for an external service.
- *
- * Reads the credential field schema from SSM (written by ExternalService),
- * prompts interactively for each field, and writes to Secrets Manager.
- *
- * Supports nested credential schemas: groups render as sections with headers,
- * and the stored JSON mirrors the nested structure exactly.
- *
- * Usage:
- *   mesh secrets set external/symitar                  # single-instance
- *   mesh secrets set external/symitar --key=12345      # multi-instance (specific key)
- *   mesh secrets set external/symitar --all            # include optional fields
- *   mesh secrets set external/symitar --non-interactive --json='{"baseUrl":"..."}'
- *
- * The command detects tenant/stage from Pulumi config in the current directory.
- */
 import { SSMClient, GetParametersByPathCommand, } from "@aws-sdk/client-ssm";
 import { SecretsManagerClient, GetSecretValueCommand, PutSecretValueCommand, CreateSecretCommand, } from "@aws-sdk/client-secrets-manager";
 import input from "@inquirer/input";
@@ -25,16 +8,6 @@ import { logInfo, logSuccess, logError } from "../../utils/log.js";
 import { resolveStackOption } from "../../utils/stack-flag.js";
 import { findAppRoot, readStackConfig } from "../../utils/pulumi.js";
 import { resolveAwsCredentials } from "../../utils/aws-auth.js";
-/**
- * Ensure AWS credentials are available for the SSM/Secrets Manager calls. If the
- * environment has none, assume the stack's `mesh:deployerRole` — which triggers
- * `mesh login` automatically when there's no active session. No-op when
- * credentials are already present or the stack/role can't be resolved.
- *
- * The stack is the locally-detected stage (from the `Pulumi.<stage>.yaml`
- * filename) — NOT `pulumi stack --show-name`, which would itself need creds to
- * read the backend (the chicken-and-egg this is meant to avoid).
- */
 export async function ensureAwsCredentialsForStack(stack) {
     if (process.env.AWS_ACCESS_KEY_ID || process.env.AWS_SESSION_TOKEN)
         return;
@@ -52,14 +25,6 @@ export async function ensureAwsCredentialsForStack(stack) {
         delete process.env.AWS_PROFILE;
     }
 }
-// =============================================================================
-// Schema compatibility
-// =============================================================================
-/**
- * Normalize a schema entry from SSM. Handles both:
- * - New format: `{ type: "field"|"group", ... }`
- * - Legacy format: `{ name, description, secret, optional }` (no type marker)
- */
 function normalizeEntry(raw) {
     if (raw.type === "group" && raw.fields) {
         return {
@@ -69,7 +34,6 @@ function normalizeEntry(raw) {
             fields: normalizeFields(raw.fields),
         };
     }
-    // Leaf field (explicit type: "field" or legacy without type)
     return {
         type: "field",
         name: raw.name ?? "",
@@ -81,9 +45,6 @@ function normalizeEntry(raw) {
 function normalizeFields(raw) {
     return Object.fromEntries(Object.entries(raw).map(([key, value]) => [key, normalizeEntry(value)]));
 }
-// =============================================================================
-// SSM discovery
-// =============================================================================
 export async function discoverExternalServices(ssmClient, tenant, platformEnv) {
     const services = new Map();
     const basePath = `/mesh-platform/${tenant}/${platformEnv}`;
@@ -97,7 +58,6 @@ export async function discoverExternalServices(ssmClient, tenant, platformEnv) {
         for (const param of response.Parameters ?? []) {
             if (!param.Name || !param.Value)
                 continue;
-            // Match: .../external-services/{name}/meta
             const metaMatch = param.Name.match(/\/external-services\/([^/]+)\/meta$/);
             if (metaMatch?.[1]) {
                 const serviceName = metaMatch[1];
@@ -105,7 +65,6 @@ export async function discoverExternalServices(ssmClient, tenant, platformEnv) {
                 const existing = services.get(serviceName);
                 services.set(serviceName, { ...existing, meta });
             }
-            // Match: .../external-services/{name}/credentials
             const credMatch = param.Name.match(/\/external-services\/([^/]+)\/credentials$/);
             if (credMatch?.[1]) {
                 const serviceName = credMatch[1];
@@ -127,31 +86,18 @@ export async function discoverExternalServices(ssmClient, tenant, platformEnv) {
     } while (nextToken);
     return services;
 }
-// =============================================================================
-// Nested value helpers
-// =============================================================================
-// =============================================================================
-// Interactive prompts (recursive)
-// =============================================================================
-/**
- * Recursively prompt for all fields in the schema.
- * Groups render as section headers; leaf fields get input prompts.
- */
 async function promptFields(fields, existing, result, opts, depth = 0) {
     for (const [fieldKey, entry] of Object.entries(fields)) {
         if (entry.type === "group") {
-            // Section header
             const indent = "  ".repeat(depth);
             console.error("");
             console.error(`${indent}── ${entry.name} ──`);
-            // Ensure nested object exists
             const existingGroup = (existing[fieldKey] ?? {});
             const resultGroup = {};
             await promptFields(entry.fields, existingGroup, resultGroup, opts, depth + 1);
             result[fieldKey] = resultGroup;
         }
         else {
-            // Leaf field
             if (entry.optional && !opts.all) {
                 const existingVal = existing[fieldKey];
                 if (existingVal !== undefined && existingVal !== "") {
@@ -168,7 +114,6 @@ async function promptFields(fields, existing, result, opts, depth = 0) {
             let value;
             if (entry.secret) {
                 value = await password({ message: label, mask: "*" });
-                // Keep existing if user just pressed Enter
                 if (!value && hasExisting) {
                     value = existingVal;
                 }
@@ -183,9 +128,6 @@ async function promptFields(fields, existing, result, opts, depth = 0) {
         }
     }
 }
-// =============================================================================
-// Summary display (recursive)
-// =============================================================================
 function displaySummary(fields, values, depth = 0) {
     const indent = "  ".repeat(depth);
     for (const [key, entry] of Object.entries(fields)) {
@@ -203,32 +145,23 @@ function displaySummary(fields, values, depth = 0) {
         }
     }
 }
-// =============================================================================
-// Main command
-// =============================================================================
 export async function setCommand(servicePath, opts) {
     const stackOpt = resolveStackOption(opts);
     const context = detectContext(stackOpt);
     const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
-    // Ensure AWS credentials: if none in the environment, assume the stack's
-    // deployer role — which triggers `mesh login` automatically when there's no
-    // active session (instead of failing with a credentials error).
     await ensureAwsCredentialsForStack(stackOpt ?? context.stage);
     const ssmClient = new SSMClient({ region });
     const smClient = new SecretsManagerClient({ region });
-    // Discover all external services
     const services = await discoverExternalServices(ssmClient, context.tenant, context.platformEnv);
     if (services.size === 0) {
         logError("No external services found. Deploy an ExternalService first:\n" +
             "  new mesh.apps.ExternalService(\"symitar\", { env, credentials: { ... } })");
         process.exit(1);
     }
-    // Parse service name from path (e.g., "external/symitar" → "symitar")
     let serviceName;
     if (servicePath) {
         serviceName = servicePath.replace(/^external\//, "");
     }
-    // If no service specified or not found, list available
     if (!serviceName || !services.has(serviceName)) {
         if (serviceName) {
             logError(`External service "${serviceName}" not found.`);
@@ -248,7 +181,6 @@ export async function setCommand(servicePath, opts) {
         logError(`No credential schema found for "${serviceName}".`);
         process.exit(1);
     }
-    // Determine secret path
     const secretPrefix = svc.meta.secretPrefix;
     const secretId = opts.key ? `${secretPrefix}/${opts.key}` : secretPrefix;
     if (schema.keyedBy && !opts.key) {
@@ -256,14 +188,11 @@ export async function setCommand(servicePath, opts) {
             `Specify an instance:\n  mesh secrets set external/${serviceName} --key=<${schema.keyedBy}>`);
         process.exit(1);
     }
-    // A reserved dot-name (`.index`, `.config`) or a path-bearing key would
-    // write credential JSON over the service's bookkeeping secrets.
     if (opts.key && !isInstanceKey(opts.key)) {
         logError(`Invalid instance key "${opts.key}": keys must not contain "/", start with ".", ` +
             `or end with ".config" — those names are reserved for the index and config mirrors.`);
         process.exit(1);
     }
-    // Read existing values (if any)
     let existing = {};
     try {
         const response = await smClient.send(new GetSecretValueCommand({ SecretId: secretId }));
@@ -275,9 +204,7 @@ export async function setCommand(servicePath, opts) {
         if (!isResourceNotFound(err)) {
             throw err;
         }
-        // Secret doesn't exist yet (multi-instance key) — will create
     }
-    // Non-interactive mode: JSON input (deep-merged)
     if (opts.json) {
         let values;
         try {
@@ -296,7 +223,6 @@ export async function setCommand(servicePath, opts) {
         logSuccess(`Credentials written to ${secretId}`);
         return;
     }
-    // Interactive mode
     console.error("");
     logInfo(`Setting credentials for: ${svc.meta.description || serviceName}`);
     if (opts.key) {
@@ -306,7 +232,6 @@ export async function setCommand(servicePath, opts) {
     const values = {};
     await promptFields(schema.fields, existing, values, { all: !!opts.all });
     console.error("");
-    // Merge and write
     const merged = deepMerge(existing, values);
     await writeSecret(smClient, secretId, merged, svc.meta);
     await writeConfigMirror(smClient, secretId, schema, merged, svc.meta);
@@ -314,14 +239,10 @@ export async function setCommand(servicePath, opts) {
         await addKeyToInstanceIndex(smClient, secretPrefix, opts.key, serviceName);
     }
     logSuccess(`Credentials written to ${secretId}`);
-    // Show summary
     console.error("\nStored fields:");
     displaySummary(schema.fields, merged);
     console.error("");
 }
-// =============================================================================
-// Helpers
-// =============================================================================
 export function isResourceNotFound(err) {
     const e = err;
     return (e?.name === "ResourceNotFoundException" ||
@@ -330,7 +251,6 @@ export function isResourceNotFound(err) {
         e?.code === "ResourceNotFoundException" ||
         (typeof e?.message === "string" && e.message.includes("ResourceNotFoundException")));
 }
-/** Deep merge two objects. Source values overwrite target at leaf level. */
 function deepMerge(target, source) {
     const result = { ...target };
     for (const [key, value] of Object.entries(source)) {
@@ -358,7 +278,6 @@ async function writeSecret(client, secretId, values, meta) {
     }
     catch (err) {
         if (isResourceNotFound(err)) {
-            // Multi-instance: create the per-key secret
             await client.send(new CreateSecretCommand({
                 Name: secretId,
                 Description: `External service credentials for ${meta.name} (instance)`,
@@ -374,10 +293,6 @@ async function writeSecret(client, secretId, values, meta) {
         }
     }
 }
-/**
- * Extract non-secret fields from merged values based on the credential schema.
- * Walks groups recursively, preserving structure.
- */
 function extractNonSecretFields(fields, values) {
     const result = {};
     for (const [key, entry] of Object.entries(fields)) {
@@ -394,22 +309,6 @@ function extractNonSecretFields(fields, values) {
     }
     return result;
 }
-/**
- * Add an instance key to the service's instance index at
- * `{secretPrefix}/.index` — the list `listInstances()` reads. Read-modify-
- * write: a MISSING index is created from just this key (the deploy normally
- * seeds an empty one), an already-listed key is a no-op. A MALFORMED index
- * is deliberately left alone (warn only): rebuilding it from just this key
- * would silently drop the rest of the fleet from the list, so the full
- * repair belongs to `mesh secrets reindex`. The read-modify-write itself is
- * unguarded — Secrets Manager has no conditional put — so two concurrent
- * writers to the same service can drop a key; same repair.
- *
- * Non-fatal by design, like the `.config` mirror: the credential itself is
- * already written, so failing the whole command here would report a write
- * that succeeded as failed. The cost of skipping is an instance invisible to
- * `listInstances()` until repaired — the warning names the repair.
- */
 export async function addKeyToInstanceIndex(client, secretPrefix, key, serviceName) {
     const indexId = instanceIndexSecretId(secretPrefix);
     try {
@@ -421,7 +320,6 @@ export async function addKeyToInstanceIndex(client, secretPrefix, key, serviceNa
         catch (err) {
             if (!isResourceNotFound(err))
                 throw err;
-            // Pre-index deployment: the write below creates the index.
         }
         if (keys.includes(key))
             return;
@@ -441,9 +339,6 @@ export async function addKeyToInstanceIndex(client, secretPrefix, key, serviceNa
                     { Key: "mesh:service", Value: serviceName },
                 ],
             }));
-            // The declaring stack also declares this secret; created here first,
-            // it is not in the stack's state, and the stack's next deploy fails on
-            // the name collision until the secret is imported or deleted.
             logInfo(`Created ${indexId} OUT OF BAND — the declaring stack does not manage it. ` +
                 `Deploy the declaring stack (it creates the index) before writing keys, or ` +
                 `import this secret into the stack before its next deploy.`);
@@ -481,8 +376,6 @@ async function writeConfigMirror(client, secretId, schema, merged, meta) {
         }
     }
     catch (err) {
-        // Non-fatal: log warning but don't fail the main write
         logInfo(`Warning: failed to write .config mirror to ${configId}: ${err}`);
     }
 }
-//# sourceMappingURL=set.js.map