@mesh-tech/mesh-cli 0.20.1 → 0.20.3

package/dist/src/commands/vpn/index.js

@@ -1,42 +1,17 @@
-/**
- * mesh vpn — Headscale VPN management commands
- *
- * Commands:
- *   mesh vpn connect <context>   Connect to VPN via Tailscale + OIDC
- *   mesh vpn disconnect          Disconnect from VPN
- *   mesh vpn status              Show VPN control plane status
- *   mesh vpn api-key             Create a Headscale API key
- *   mesh vpn pre-auth-key        Create a pre-authentication key for a user
- *   mesh vpn users               List registered VPN users
- *
- * All commands shell out to kubectl. The user must have kubeconfig
- * configured for the target cluster (e.g., via `aws eks update-kubeconfig`).
- */
 import { execFileSync } from "child_process";
 import * as net from "node:net";
 import { logInfo, logSuccess, logError, logWarn } from "../../utils/index.js";
 import { getContextConfig } from "../login.js";
 import { registerTunnelSubcommands } from "./tunnel.js";
 import { ensureDaemon, joinHeadscale, daemonState, stopDaemon, tailscaleAvailable, readDaemonMeta, findRunningDaemon, } from "../../utils/tailscale.js";
-// =============================================================================
-// Constants
-// =============================================================================
-/** Default namespace follows the convention: {tenant}-{env}-headscale */
 function defaultNamespace(tenant, env) {
     return `${tenant}-${env}-headscale`;
 }
 const HEADSCALE_POD = "headscale-0";
 const HEADSCALE_CONTAINER = "headscale";
-// =============================================================================
-// Helpers
-// =============================================================================
 function resolveNamespace(options) {
     return options.namespace ?? defaultNamespace(options.tenant, options.env);
 }
-/**
- * Run a headscale CLI command inside the headscale pod.
- * Returns stdout as a string. Throws on non-zero exit.
- */
 function headscaleExec(namespace, args, opts) {
     const cmd = ["headscale", ...args];
     if (opts?.json) {
@@ -66,15 +41,9 @@ function headscaleExec(namespace, args, opts) {
         throw error;
     }
 }
-/**
- * Derive the likely EKS cluster name from tenant/env convention.
- */
 function clusterName(tenant, env) {
     return `${tenant}-${env}-eks`;
 }
-/**
- * Check that the headscale pod is running and reachable.
- */
 function assertPodReady(namespace, options) {
     try {
         const output = execFileSync("kubectl", [
@@ -102,14 +71,10 @@ function assertPodReady(namespace, options) {
         process.exit(1);
     }
 }
-// =============================================================================
-// Commands
-// =============================================================================
 async function vpnStatus(options) {
     const ns = resolveNamespace(options);
     logInfo(`Checking Headscale in namespace ${ns}...`);
     assertPodReady(ns, options);
-    // Get pod details
     const podJson = execFileSync("kubectl", [
         "get", "pod", HEADSCALE_POD,
         "-n", ns,
@@ -120,7 +85,6 @@ async function vpnStatus(options) {
     const image = container?.image ?? "unknown";
     const ready = container?.ready ?? false;
     const restarts = container?.restartCount ?? 0;
-    // Get the HTTPRoute hostname
     let endpoint = "unknown";
     try {
         endpoint = execFileSync("kubectl", [
@@ -133,9 +97,7 @@ async function vpnStatus(options) {
         }
     }
     catch {
-        // HTTPRoute may not exist
     }
-    // List users
     let userCount = 0;
     try {
         const usersJson = headscaleExec(ns, ["users", "list"], { json: true });
@@ -143,9 +105,7 @@ async function vpnStatus(options) {
         userCount = Array.isArray(users) ? users.length : 0;
     }
     catch {
-        // Users may not be queryable yet
     }
-    // List nodes
     let nodeCount = 0;
     try {
         const nodesJson = headscaleExec(ns, ["nodes", "list"], { json: true });
@@ -153,7 +113,6 @@ async function vpnStatus(options) {
         nodeCount = Array.isArray(nodes) ? nodes.length : 0;
     }
     catch {
-        // Nodes may not be queryable
     }
     console.log("");
     console.log(`  Endpoint:   ${endpoint}`);
@@ -195,14 +154,12 @@ async function createPreAuthKey(options) {
     const { user, expiration, reusable, ephemeral } = options;
     logInfo(`Creating pre-auth key for user "${user}" in namespace ${ns}...`);
     assertPodReady(ns, options);
-    // Ensure the user exists
     try {
         headscaleExec(ns, ["users", "create", user]);
         logInfo(`Created user "${user}"`);
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        // "already exists" is fine
         if (!message.includes("already exists")) {
             logError(`Failed to create user: ${message}`);
             process.exit(1);
@@ -251,17 +208,6 @@ async function listUsers(options) {
         process.exit(1);
     }
 }
-// =============================================================================
-// VPN Connect / Disconnect
-// =============================================================================
-/**
- * Derive the VPN (Headscale) endpoint from a mesh login context.
- *
- * The login config stores an issuer URL like:
- *   https://identity.dev.mesh-platform.trabian.com
- * The VPN endpoint follows the same domain with "vpn" as the subdomain:
- *   https://vpn.dev.mesh-platform.trabian.com
- */
 function vpnEndpointFromContext(context) {
     const config = getContextConfig(context);
     if (!config) {
@@ -269,7 +215,6 @@ function vpnEndpointFromContext(context) {
             `Run: mesh login ${context}  (or add the context to ~/.config/mesh/config.json)`);
     }
     const issuerUrl = new URL(config.issuer);
-    // Replace the first subdomain ("identity") with "vpn"
     const hostParts = issuerUrl.hostname.split(".");
     if (hostParts.length < 3) {
         throw new Error(`Cannot derive VPN endpoint from issuer "${config.issuer}". ` +
@@ -278,12 +223,10 @@ function vpnEndpointFromContext(context) {
     hostParts[0] = "vpn";
     return `https://${hostParts.join(".")}`;
 }
-/** Split a platform context ("mesh.dev") into its tenant + env. Pure. */
 export function parseContextTenantEnv(context) {
     const [tenant, env] = context.split(".");
     return { tenant: tenant || "mesh", env: env || "dev" };
 }
-/** Ephemeral free TCP port on loopback for the userspace daemon's SOCKS proxy. */
 function findFreePort() {
     return new Promise((resolve, reject) => {
         const srv = net.createServer();
@@ -295,10 +238,6 @@ function findFreePort() {
         });
     });
 }
-/**
- * Check whether the `tailscale` CLI is installed and return its path,
- * or null if not found.
- */
 function findTailscale() {
     try {
         return execFileSync("which", ["tailscale"], {
@@ -310,7 +249,6 @@ function findTailscale() {
         return null;
     }
 }
-/** Return Tailscale's full status, or null if tailscale is not running. */
 function tailscaleStatus() {
     try {
         const json = execFileSync("tailscale", ["status", "--json"], {
@@ -323,14 +261,9 @@ function tailscaleStatus() {
         return null;
     }
 }
-/** Return Tailscale's BackendState, or null if tailscale is not running. */
 export function tailscaleBackendState() {
     return tailscaleStatus()?.BackendState ?? null;
 }
-/**
- * Normalize a control server URL for comparison.
- * Trims trailing slashes and lowercases the origin.
- */
 function normalizeControlUrl(url) {
     try {
         const u = new URL(url);
@@ -343,22 +276,11 @@ function normalizeControlUrl(url) {
 async function vpnConnect(context, opts = {}) {
     const endpoint = vpnEndpointFromContext(context);
     if (opts.system) {
-        // Whole-machine VPN via the GUI Tailscale.app daemon. Opt-in only: it needs
-        // the GUI app installed/running and CANNOT run headless or under the safehouse
-        // sandbox (dyld can't load the app bundle's Sparkle.framework → abort trap).
         await vpnConnectSystem(endpoint);
         return;
     }
     await vpnConnectUserspace(context, endpoint);
 }
-/**
- * Default path: bring up the per-tenant userspace `tailscaled` (brew formula, NOT
- * the GUI app) and register this machine with the platform Headscale. This is the
- * same daemon `mesh dev --transport tailscale` / `mesh vpn tunnel` already use, so
- * it runs headless and under the sandbox. It exposes a local SOCKS5 proxy — the
- * userspace analog of system-wide routing — instead of a system TUN; for
- * auto-forwarded VPC services (Temporal, RDS, …) use `mesh vpn tunnel` / `mesh dev`.
- */
 async function vpnConnectUserspace(context, loginServer) {
     if (!tailscaleAvailable()) {
         logError("Standalone tailscale/tailscaled not found.");
@@ -369,8 +291,6 @@ async function vpnConnectUserspace(context, loginServer) {
     const { tenant } = parseContextTenantEnv(context);
     const region = process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? "us-east-2";
     if (daemonState(tenant).backendState === "Running") {
-        // Prefer daemon.json; recover the real bound port from argv if meta is missing
-        // (older build) so a "connected" session always shows how to reach it.
         const port = readDaemonMeta(tenant)?.socksPort ?? findRunningDaemon(tenant)?.socksPort;
         logSuccess(`Already connected to the platform VPN for '${tenant}' (userspace).`);
         if (port)
@@ -380,23 +300,17 @@ async function vpnConnectUserspace(context, loginServer) {
     logInfo(`Connecting to the platform VPN for '${tenant}' (userspace tailscaled)…`);
     const socksPort = readDaemonMeta(tenant)?.socksPort ?? (await findFreePort());
     const realPort = await ensureDaemon(tenant, { region, socksPort });
-    // Interactive join — joinHeadscale relays the one-time registration URL for
-    // headless/SSH machines (no local browser to pop) and polls up to ~5 min.
     await joinHeadscale(tenant, loginServer);
     logSuccess(`VPN connected (userspace) for '${tenant}'.`);
     logInfo(`  SOCKS5 proxy: 127.0.0.1:${realPort}  — route a tool via ALL_PROXY=socks5://127.0.0.1:${realPort}`);
     logInfo("  For auto-forwarded VPC services (Temporal, RDS, …): mesh vpn tunnel up  (or mesh dev)");
 }
-/** Opt-in whole-machine VPN via the GUI Tailscale.app daemon (`mesh vpn connect --system`). */
 async function vpnConnectSystem(endpoint) {
     if (!findTailscale()) {
         logError("Tailscale CLI not found.");
         logInfo("Install it: brew install tailscale  (or see https://tailscale.com/download)");
         process.exit(1);
     }
-    // If already connected to *this* endpoint, short-circuit. But if connected
-    // to a different control server, fall through and reconnect — otherwise the
-    // user would silently stay on the wrong tailnet.
     const status = tailscaleStatus();
     if (status?.BackendState === "Running") {
         const current = status.ControlURL ? normalizeControlUrl(status.ControlURL) : null;
@@ -413,15 +327,6 @@ async function vpnConnectSystem(endpoint) {
     logInfo(`Connecting to VPN at ${endpoint}...`);
     logInfo("A browser window will open for Zitadel authentication.");
     console.log("");
-    // tailscale up is interactive (opens browser), so we inherit stdio.
-    // On macOS, Tailscale.app owns the daemon — `tailscale up` talks to it.
-    // On Linux, tailscaled runs as root and `tailscale up` may need sudo.
-    //
-    // --reset: wipe prior prefs so this command is idempotent. Without it,
-    //   tailscale refuses to apply prefs if a previous session set non-default
-    //   flags that aren't re-specified here.
-    // --accept-routes: accept subnet routes advertised by the Headscale
-    //   SubnetRouter so clients can reach in-VPC services (EKS, RDS, internal LBs).
     const upArgs = [
         "up",
         "--reset",
@@ -447,7 +352,6 @@ async function vpnConnectSystem(endpoint) {
 }
 async function vpnDisconnect(opts) {
     if (opts.system) {
-        // Whole-machine GUI Tailscale down (opt-in, mirrors `connect --system`).
         if (!findTailscale()) {
             logError("Tailscale CLI not found.");
             process.exit(1);
@@ -468,8 +372,6 @@ async function vpnDisconnect(opts) {
         }
         return;
     }
-    // Default: stop the tenant's userspace daemon (leaves the Headscale node
-    // identity in the statedir so a later `connect` rejoins without re-login).
     const { tenant } = opts;
     if (daemonState(tenant).backendState === "Down") {
         logInfo(`No userspace VPN daemon running for '${tenant}'.`);
@@ -479,9 +381,6 @@ async function vpnDisconnect(opts) {
     stopDaemon(tenant);
     logSuccess(`VPN disconnected for '${tenant}'.`);
 }
-// =============================================================================
-// Registration
-// =============================================================================
 export function registerVpnCommands(program) {
     const vpn = program
         .command("vpn")
@@ -540,4 +439,3 @@ export function registerVpnCommands(program) {
     });
     registerTunnelSubcommands(vpn);
 }
-//# sourceMappingURL=index.js.map

package/dist/src/commands/vpn/tunnel.d.ts

@@ -1,11 +1,2 @@
-/**
- * `mesh vpn tunnel` — userspace-Tailscale tunnels to a tenant's VPC services.
- *
- * Stands up the tenant's `localhost:PORT` set (drop-in for the SSM tunnels)
- * backed by a per-tenant userspace `tailscaled` + SOCKS5 forwarders. Detached
- * and managed: `up` starts everything and returns; `down`/`status` manage it.
- * (MESH-2040 / Slice 1 of MESH-2014; graduates the MESH-2036 spike.)
- */
 import type { Command } from "commander";
 export declare function registerTunnelSubcommands(vpn: Command): void;
-//# sourceMappingURL=tunnel.d.ts.map

package/dist/src/commands/vpn/tunnel.js

@@ -1,21 +1,7 @@
-/**
- * `mesh vpn tunnel` — userspace-Tailscale tunnels to a tenant's VPC services.
- *
- * Stands up the tenant's `localhost:PORT` set (drop-in for the SSM tunnels)
- * backed by a per-tenant userspace `tailscaled` + SOCKS5 forwarders. Detached
- * and managed: `up` starts everything and returns; `down`/`status` manage it.
- * (MESH-2040 / Slice 1 of MESH-2014; graduates the MESH-2036 spike.)
- */
 import * as net from "node:net";
 import { logInfo, logError, logSuccess } from "../../utils/log.js";
 import { getContextConfig } from "../login.js";
 import { ensureTailscaleTunnels, stopDaemon, logout, daemonState, readTunnelState, clearTunnelState, readDaemonMeta, runTunnels, stopTunnelRunners, verifyTunnelOwnership, } from "../../utils/tailscale.js";
-/**
- * Derive the Headscale login-server URL from the login context's issuer
- * (`identity.<env>.<domain>` → `vpn.<env>.<domain>`). Mirrors
- * `vpnEndpointFromContext` in index.ts (kept local to avoid a circular import;
- * Slice 2 can unify).
- */
 function deriveLoginServer(context) {
     const cfg = getContextConfig(context);
     if (!cfg?.issuer) {
@@ -54,7 +40,6 @@ function canConnect(port) {
         s.connect(port, "127.0.0.1");
     });
 }
-// ── up ──────────────────────────────────────────────────────────────────────
 async function tunnelUp(vpn, cmdOpts) {
     const { tenant, env } = vpn;
     const context = cmdOpts.context ?? `${tenant}.${env}`;
@@ -62,9 +47,6 @@ async function tunnelUp(vpn, cmdOpts) {
     const loginServer = deriveLoginServer(context);
     const prior = readTunnelState(tenant);
     const daemonUp = daemonState(tenant).backendState !== "Down";
-    // When the daemon is already up, reuse the SOCKS port IT is listening on
-    // (from daemon.json, which `down` doesn't clear) — not `prior` (cleared by
-    // `down`) and never a fresh port the daemon isn't bound to.
     const socksPort = daemonUp
         ? (readDaemonMeta(tenant)?.socksPort ?? prior?.socksPort ?? (await findFreePort()))
         : await findFreePort();
@@ -75,28 +57,18 @@ async function tunnelUp(vpn, cmdOpts) {
         logInfo(`  ${t.name.padEnd(14)} 127.0.0.1:${t.localPort}  →  ${t.targetHost}:${t.remotePort}`);
     }
 }
-// The __run / __supervise runner lives in utils/tailscale.ts (runTunnels) —
-// forwarders + a continuous self-heal loop, used under launchd or detached.
-// ── down ────────────────────────────────────────────────────────────────────
 function tunnelDown(vpn, cmdOpts) {
     const { tenant } = vpn;
     const st = readTunnelState(tenant);
-    // Nothing to tear down for the forwarders — but still honor an explicit
-    // --stop/--logout so a leaked daemon (state file already gone) can be killed.
     if (!st && !cmdOpts.stop && !cmdOpts.logout) {
         logInfo(`No tunnels running for tenant '${tenant}'.`);
         return;
     }
-    // One teardown path for every runner shape (state pid group, launchd agent,
-    // manifest process group, argv-discovered strays) — no kill path may leave a
-    // grandchild with ports still bound (MESH-2407).
     stopTunnelRunners(tenant, st);
     if (cmdOpts.logout) {
         logout(tenant);
         logInfo("Logged the VPN daemon out of Headscale.");
     }
-    // By default the daemon persists (join-once / reuse). --stop or --logout
-    // (after which the daemon is useless) tear it down too.
     if (cmdOpts.stop || cmdOpts.logout) {
         stopDaemon(tenant);
         logInfo("Stopped the userspace VPN daemon.");
@@ -104,13 +76,10 @@ function tunnelDown(vpn, cmdOpts) {
     clearTunnelState(tenant);
     logSuccess(`VPN tunnels down for '${tenant}'.`);
 }
-// ── status ────────────────────────────────────────────────────────────────────
 async function tunnelStatus(vpn, cmdOpts) {
     const { tenant } = vpn;
     const st = readTunnelState(tenant);
     const ds = daemonState(tenant);
-    // Ownership handshake against the runner's manifest — status must distinguish
-    // "our runner owns the ports" from "something answers the port" (MESH-2407).
     const owned = st
         ? await verifyTunnelOwnership(tenant, {
             socksPort: st.socksPort,
@@ -140,14 +109,10 @@ async function tunnelStatus(vpn, cmdOpts) {
         : `Runner: NOT OWNED (${owned?.reason}) — ports below may be foreign listeners`);
     const listening = owned?.ok ? new Set(owned.resp?.listening ?? []) : null;
     for (const t of st.tunnels) {
-        // When ownership holds, report from the runner's in-process listening set
-        // (no data-plane dial); otherwise fall back to a dial, flagged above.
         const up = listening ? listening.has(t.localPort) : await canConnect(t.localPort);
         logInfo(`  ${up ? "✓" : "✗"} ${t.name.padEnd(14)} 127.0.0.1:${t.localPort}  →  ${t.targetHost}:${t.remotePort}`);
     }
 }
-// ── registration ──────────────────────────────────────────────────────────────
-/** Run an action, printing a clean error (not a stack trace) + exit 1 on failure. */
 async function guard(fn) {
     try {
         await fn();
@@ -180,9 +145,7 @@ export function registerTunnelSubcommands(vpn) {
     tunnel
         .command("__run <tenant>", { hidden: true })
         .action((tenant) => runTunnels(tenant));
-    // Back-compat alias for any launchd/detached runner referencing the old name.
     tunnel
         .command("__supervise <tenant>", { hidden: true })
         .action((tenant) => runTunnels(tenant));
 }
-//# sourceMappingURL=tunnel.js.map

package/dist/src/commands/workflow.d.ts

@@ -1,24 +1,2 @@
-/**
- * mesh workflow — workflow tooling commands
- *
- * Commands:
- *   mesh workflow extract-ir <path>       Extract WorkflowIR from Temporal workflow source
- *   mesh workflow inventory <path>        Extract the as-built command/query/activity inventory
- *   mesh workflow lint-process <path>     Lint a process artifact's bindings against the code inventory
- *
- * Examples:
- *   # Extract and print to stdout
- *   mesh workflow extract-ir apps/ops/worker/src/workflows/
- *
- *   # Extract and upload to S3
- *   mesh workflow extract-ir apps/ops/worker/src/workflows/ --app ops --upload mesh-trabian-dev-artifacts
- *
- *   # Print the as-built inventory (lint's code-side input)
- *   mesh workflow inventory apps/ops/worker/src/workflows/workflows.ts
- *
- *   # Lint a process artifact (conformance) — sibling process/*.process.json auto-discovered
- *   mesh workflow lint-process apps/ops/worker/src/workflows.ts --predicates engagementComplete,accountNumbersComplete
- */
 import { Command } from "commander";
 export declare function registerWorkflowCommands(program: Command): void;
-//# sourceMappingURL=workflow.d.ts.map

package/dist/src/commands/workflow.js

@@ -1,37 +1,8 @@
-/**
- * mesh workflow — workflow tooling commands
- *
- * Commands:
- *   mesh workflow extract-ir <path>       Extract WorkflowIR from Temporal workflow source
- *   mesh workflow inventory <path>        Extract the as-built command/query/activity inventory
- *   mesh workflow lint-process <path>     Lint a process artifact's bindings against the code inventory
- *
- * Examples:
- *   # Extract and print to stdout
- *   mesh workflow extract-ir apps/ops/worker/src/workflows/
- *
- *   # Extract and upload to S3
- *   mesh workflow extract-ir apps/ops/worker/src/workflows/ --app ops --upload mesh-trabian-dev-artifacts
- *
- *   # Print the as-built inventory (lint's code-side input)
- *   mesh workflow inventory apps/ops/worker/src/workflows/workflows.ts
- *
- *   # Lint a process artifact (conformance) — sibling process/*.process.json auto-discovered
- *   mesh workflow lint-process apps/ops/worker/src/workflows.ts --predicates engagementComplete,accountNumbersComplete
- */
 import * as fs from "fs";
 import * as path from "path";
 import { createRequire } from "module";
 import { execFileSync } from "child_process";
 import { logError, logInfo, logSuccess, logWarn } from "../utils/log.js";
-/**
- * Shared subprocess-script helpers: discover auxiliary source files (shared
- * helpers/child workflows) and activity definition files referenced by a
- * workflow file's imports, so the extractor can resolve calls/signatures
- * across files. Emitted verbatim into both the extract-ir and inventory
- * tsx scripts below (they run as plain functions inside the subprocess, not
- * in this process, so they can't be imported/shared as normal TS).
- */
 const DISCOVERY_HELPERS_SRC = `
 function discoverAux(filePath, source) {
   const dir = dirname(filePath);
@@ -122,10 +93,6 @@ function discoverProcessArtifact(filePath, source) {
   return undefined;
 }
 `;
-/**
- * Resolve the path to @mesh-tech/workflow-viz/ast-extractor source file.
- * Uses createRequire from the CLI's own location so workspace links resolve.
- */
 function resolveExtractorPath() {
     try {
         const require = createRequire(import.meta.url);
@@ -136,19 +103,6 @@ function resolveExtractorPath() {
         return null;
     }
 }
-/**
- * Run the extraction in a tsx subprocess. The extractor depends on ts-morph
- * and workflow-viz exports TypeScript source (no dist build), so we need tsx
- * rather than plain Node.
- *
- * `explicitProcessPath`, when given, is read here (parent process) and baked
- * into the script verbatim, applied to EVERY discovered workflow file
- * (extractWorkflowIR's own workflowType check drops it wherever it doesn't
- * match — P6). Absent that, each file gets a sibling `process/*.process.json`
- * lookup (see `discoverProcessArtifact` in DISCOVERY_HELPERS_SRC).
- *
- * Returns parsed ExtractedWorkflow[] or null on failure.
- */
 function runExtraction(targetPath, extractorPath, explicitProcessPath) {
     let explicitProcessArtifact;
     if (explicitProcessPath) {
@@ -160,8 +114,6 @@ function runExtraction(targetPath, extractorPath, explicitProcessPath) {
             return null;
         }
     }
-    // Build an inline script that does the extraction and writes JSON to stdout.
-    // Stderr is used for progress messages.
     const script = `
 import { extractWorkflowIR } from "${extractorPath.replace(/\\/g, "/")}";
 import { readFileSync, readdirSync, statSync, existsSync } from "node:fs";
@@ -207,14 +159,6 @@ process.stdout.write(JSON.stringify(results));
         return null;
     }
 }
-/**
- * Run inventory extraction in a tsx subprocess — same aux-discovery pattern
- * as {@link runExtraction}, but calls `extractInventory` instead of
- * `extractWorkflowIR` and returns the as-built {@link Inventory} per
- * discovered workflow file.
- *
- * Returns parsed Inventory[] or null on failure.
- */
 function runInventoryExtraction(targetPath, extractorPath) {
     const script = `
 import { extractInventory } from "${extractorPath.replace(/\\/g, "/")}";
@@ -256,20 +200,6 @@ process.stdout.write(JSON.stringify(results));
         return null;
     }
 }
-/**
- * Run inventory + process-artifact discovery in a tsx subprocess, for
- * `lint-process`. Same aux/activity discovery as {@link runInventoryExtraction};
- * additionally resolves each file's process artifact the same way
- * {@link runExtraction} does — `explicitProcessPath` (baked in, applied to
- * every discovered file) if given, else the sibling `process/*.process.json`
- * lookup (`discoverProcessArtifact` in DISCOVERY_HELPERS_SRC).
- *
- * Parsing/linting the artifact happens back in the parent process (not
- * here) since `parseProcessArtifact`/`lintProcess` are plain TS this file
- * can import directly — no need to duplicate them into the subprocess script.
- *
- * Returns parsed LintExtractionResult[] or null on failure.
- */
 function runLintExtraction(targetPath, extractorPath, explicitProcessPath) {
     let explicitProcessArtifact;
     if (explicitProcessPath) {
@@ -358,12 +288,6 @@ async function uploadToS3(bucket, appName, workflows) {
         ContentType: "application/json",
     }));
 }
-/**
- * Split a `--predicates` / `--selectors` comma-list into names. `undefined`
- * (the flag absent) is load-bearing and distinct from an empty list: it means
- * "the CLI cannot check this", which suppresses the corresponding findings
- * rather than failing every reference.
- */
 function parseNameList(value) {
     return value
         ? value
@@ -519,9 +443,6 @@ export function registerWorkflowCommands(program) {
                 process.exitCode = 1;
                 return;
             }
-            // Lazy-load workflow-model's runtime exports (see the import note at top): a
-            // static import would take down `mesh` bootstrap in the published CLI. Fail
-            // gracefully here, exactly like the extractor resolution above.
             let parseProcessArtifact;
             let lintProcess;
             try {
@@ -591,4 +512,3 @@ export function registerWorkflowCommands(program) {
         }
     });
 }
-//# sourceMappingURL=workflow.js.map