@mesh-tech/mesh-cli 0.20.1 → 0.20.3

package/dist/src/utils/aws-auth.js

@@ -1,14 +1,3 @@
-/**
- * Shared AWS credential resolution for mesh CLI commands.
- *
- * Three-tier resolution:
- *   1. Existing AWS credentials in environment (CI/CD) → use directly
- *   2. Zitadel JWT via `mesh login` → AssumeRoleWithWebIdentity
- *   3. Fallback → AssumeRole via current AWS session (SSO)
- *
- * Uses @aws-sdk/client-sts directly — does NOT shell out to the `aws` CLI
- * binary, so the binary is not a runtime requirement.
- */
 import * as fs from "fs";
 import * as path from "path";
 import { AssumeRoleCommand, AssumeRoleWithWebIdentityCommand, GetCallerIdentityCommand, STSClient, } from "@aws-sdk/client-sts";
@@ -16,21 +5,11 @@ import { logInfo, logSuccess, logWarn } from "./log.js";
 import { isExpiredAwsTokenMessage, SSO_LOGIN_FIX } from "./auth-preflight.js";
 import { ensureLogin } from "../commands/login.js";
 const DEFAULT_REGION = process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? "us-east-2";
-/**
- * Derive the platform context key (e.g., "mesh.dev") from a Pulumi stack config.
- *
- * Reads `mesh:platform` from Pulumi.<stack>.yaml. Supports both formats:
- *   mesh:platform: '{"env":"dev","name":"mesh"}'    → "mesh.dev"
- *   mesh:platform:
- *     name: mesh
- *     env: dev                                       → "mesh.dev"
- */
 export function derivePlatformContext(appRoot, stack) {
     const configFile = path.join(appRoot, `Pulumi.${stack}.yaml`);
     if (!fs.existsSync(configFile))
         return null;
     const content = fs.readFileSync(configFile, "utf-8");
-    // Try JSON-encoded string first
     const jsonMatch = content.match(/mesh:platform:\s*'(\{[^']+\})'/);
     if (jsonMatch) {
         try {
@@ -39,10 +18,8 @@ export function derivePlatformContext(appRoot, stack) {
                 return `${parsed.name}.${parsed.env}`;
         }
         catch {
-            // fall through
         }
     }
-    // Try YAML block format
     const nameMatch = content.match(/mesh:platform:[\s\S]*?name:\s*(\S+)/);
     const envMatch = content.match(/mesh:platform:[\s\S]*?env:\s*(\S+)/);
     if (nameMatch && envMatch) {
@@ -50,38 +27,13 @@ export function derivePlatformContext(appRoot, stack) {
     }
     return null;
 }
-/**
- * Quote a `credential_process` command token for AWS config-file syntax: the
- * AWS SDK/CLI split the value on spaces, honoring double quotes — so any
- * token containing whitespace (e.g. a mesh binary under "Application
- * Support") must be wrapped in double quotes or the command is mis-split.
- * Tokens without whitespace are left bare (byte-identical to the historic
- * output).
- */
 function quoteCredProcessToken(token) {
     return /\s/.test(token) ? `"${token}"` : token;
 }
-/**
- * Resolve a STABLE absolute path to the running `mesh` entrypoint for
- * embedding in a `credential_process` line — or fall back to plain `mesh`
- * (PATH lookup) when `argv1` is missing, doesn't exist on disk, or lives in
- * a transient location (`npx` cache / OS temp dir): a profile pointing at a
- * path that evaporates breaks every later AWS call with a cryptic
- * credential_process error. The fallback is announced via `logWarn` so the
- * user knows to install mesh-cli globally.
- */
 export function resolveStableMeshBin(argv1, deps = {}) {
     const exists = deps.exists ?? fs.existsSync;
     const warn = deps.warn ?? logWarn;
     let resolved = argv1 ? path.resolve(argv1) : undefined;
-    // Under the source launcher the CLI process's argv[1] is a TypeScript entry
-    // (bin/mesh.ts), which plain node cannot execute (type-stripped .js-suffixed
-    // imports fail with ERR_MODULE_NOT_FOUND). Point the profile at the sibling
-    // .mjs launcher instead — it bootstraps tsx itself, from any cwd/env. Keyed on
-    // the `.ts` extension + a derived sibling (not the literal `mesh.ts`), so a
-    // rename of the source entry doesn't silently revert to a broken value. Assign
-    // unconditionally: if the sibling is absent the existing !exists guard below
-    // reports it by name (rather than collapsing into the "argv1 missing" branch).
     if (resolved && /\.ts$/.test(resolved)) {
         resolved = path.join(path.dirname(resolved), path.basename(resolved, ".ts") + ".mjs");
     }
@@ -95,18 +47,6 @@ export function resolveStableMeshBin(argv1, deps = {}) {
     }
     return resolved;
 }
-/**
- * Render an AWS config-file `[profile …]` block whose `credential_process`
- * re-invokes `mesh login … --credential-process`, so the AWS SDK's default
- * provider chain auto-refreshes the underlying STS triple (the `mesh login`
- * process re-issues the Zitadel token as needed).
- *
- * Shared by `mesh dev` (child services) and `mesh login --export` so both
- * produce byte-identical profiles. Pure — no I/O. The `region` line is
- * emitted only when `region` is a non-empty string. Includes a trailing
- * newline. The binary path and role ARN are double-quoted when they contain
- * whitespace (AWS config command-splitting rules).
- */
 export function renderCredentialProcessProfile(args) {
     const lines = [
         `[profile ${args.profileName}]`,
@@ -116,42 +56,23 @@ export function renderCredentialProcessProfile(args) {
         lines.push(`region = ${args.region}`);
     return lines.join("\n") + "\n";
 }
-// Marker lines delimiting the mesh-managed section of the user's AWS config
-// file. Follows the `conda init` / `nvm` managed-block convention so the
-// section is discoverable and safely re-writable. The START marker carries
-// the context (one managed section per context); the END marker is shared.
 const MANAGED_START_PREFIX = `# >>> mesh-cli managed profile `;
 const MANAGED_START = (context) => `${MANAGED_START_PREFIX}${context} >>>`;
 const MANAGED_END = `# <<< mesh-cli managed <<<`;
-/**
- * Given a managed START marker for OUR context whose matching END is missing
- * (orphaned — e.g. the user deleted the END line), find the index of the first
- * character we should NOT reclaim. Conservative by construction: because
- * `MANAGED_END` is a shared literal across contexts, an END found further down
- * may belong to ANOTHER context's healthy section — so we never scan to a
- * distant END or to EOF. We only reclaim the lines the mesh CLI provably
- * wrote (see `renderCredentialProcessProfile`): one `[profile …]` header
- * followed by contiguous `key = value` lines, stopping at the first blank
- * line, comment/marker, second profile header, or `boundIdx` (the next
- * managed START of any context), whichever comes first.
- *
- * @param afterStart index just past OUR START marker text (before its newline)
- * @param boundIdx   index of the next managed START marker after ours, or -1
- */
 function orphanedSectionTail(existing, afterStart, boundIdx) {
     const limit = boundIdx === -1 ? existing.length : boundIdx;
     let idx = afterStart;
     if (idx >= limit || existing[idx] !== "\n")
         return Math.min(idx, limit);
-    idx++; // consume the newline terminating our START marker line
+    idx++;
     let claimedHeader = false;
     while (idx < limit) {
         const nl = existing.indexOf("\n", idx);
         const lineEnd = nl === -1 || nl > limit ? limit : nl;
         const line = existing.slice(idx, lineEnd);
         const ours = claimedHeader
-            ? /^[A-Za-z_][A-Za-z0-9_]*\s*=/.test(line) // key = value continuation
-            : /^\[profile [^\]]+\]\s*$/.test(line); // exactly one profile header
+            ? /^[A-Za-z_][A-Za-z0-9_]*\s*=/.test(line)
+            : /^\[profile [^\]]+\]\s*$/.test(line);
         if (!ours)
             return idx;
         claimedHeader = true;
@@ -159,19 +80,6 @@ function orphanedSectionTail(existing, afterStart, boundIdx) {
     }
     return limit;
 }
-/**
- * Insert or replace the mesh-managed `[profile …]` section for `context` in
- * the user's AWS config content, preserving ALL other content byte-for-byte
- * (this is the user's real ~/.aws/config — clobbering it breaks their other
- * profiles). Pure — no I/O; exported for unit testing.
- *
- * - Existing managed section for this context → replaced in place.
- * - Orphaned START (matching END lost) → only the contiguous profile block
- *   that is provably ours is reclaimed; other contexts' sections and user
- *   content below are preserved (see `orphanedSectionTail`).
- * - No section → appended, separated by a single blank line (and a trailing
- *   newline is added to the existing content if it lacks one).
- */
 export function upsertManagedAwsConfigSection(existing, context, profileBlock) {
     const body = profileBlock.endsWith("\n") ? profileBlock : profileBlock + "\n";
     const section = `${MANAGED_START(context)}\n${body}${MANAGED_END}\n`;
@@ -179,23 +87,13 @@ export function upsertManagedAwsConfigSection(existing, context, profileBlock) {
     if (startIdx !== -1) {
         const afterStart = startIdx + MANAGED_START(context).length;
         const endIdx = existing.indexOf(MANAGED_END, afterStart);
-        // MANAGED_END is a shared literal across contexts, so the first END below
-        // our START is only OURS if no other context's START sits in between —
-        // otherwise that END closes the OTHER section and scanning to it would
-        // swallow that section whole.
         const foreignIdx = existing.indexOf(MANAGED_START_PREFIX, afterStart);
         let tail;
         if (endIdx !== -1 && (foreignIdx === -1 || endIdx < foreignIdx)) {
-            // Healthy section: replace START..END. Swallow a single trailing
-            // newline of the old section so replacement is idempotent (the new
-            // section brings its own).
             const tailIdx = endIdx + MANAGED_END.length;
             tail = existing[tailIdx] === "\n" ? tailIdx + 1 : tailIdx;
         }
         else {
-            // Orphaned START (our END missing). Reclaim only the contiguous
-            // profile block that is provably ours — never foreign sections, user
-            // profiles below, or everything to EOF.
             tail = orphanedSectionTail(existing, afterStart, foreignIdx);
         }
         return existing.slice(0, startIdx) + section + existing.slice(tail);
@@ -205,15 +103,6 @@ export function upsertManagedAwsConfigSection(existing, context, profileBlock) {
     const sep = existing.endsWith("\n\n") ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
     return existing + sep + section;
 }
-/**
- * Remove a BARE `[profile name]` block — one outside any managed section — from
- * AWS config content. A file written before the managed-section format carries
- * exactly one such block, and migrating it must not leave that block behind as a
- * duplicate profile. Pure; exported for unit testing.
- *
- * @example
- * stripBareProfile("[profile acme]\nregion = us-east-2\n", "acme"); // → ""
- */
 export function stripBareProfile(existing, profileName) {
     const header = `[profile ${profileName}]`;
     const lines = existing.split("\n");
@@ -243,7 +132,6 @@ export function stripBareProfile(existing, profileName) {
 function newStsClient() {
     return new STSClient({ region: DEFAULT_REGION });
 }
-/** Pull AWS env vars out of an STS Credentials struct; null if any field is missing. */
 function toEnv(credentials) {
     const { AccessKeyId, SecretAccessKey, SessionToken } = credentials;
     if (!AccessKeyId || !SecretAccessKey || !SessionToken)
@@ -254,10 +142,6 @@ function toEnv(credentials) {
         AWS_SESSION_TOKEN: SessionToken,
     };
 }
-/**
- * IAM rejects a DurationSeconds higher than the role's MaxSessionDuration with
- * a ValidationError. We detect that and fall back to a one-hour session.
- */
 function isMaxSessionDurationError(err) {
     if (!(err instanceof Error))
         return false;
@@ -265,7 +149,6 @@ function isMaxSessionDurationError(err) {
     return (message.includes("MaxSessionDuration") ||
         message.includes("DurationSeconds"));
 }
-/** Assume an IAM role via current AWS session and return credentials as env vars. */
 export async function assumeRole(roleArn, sessionName = "mesh-cli", durationSeconds = 43200) {
     const sts = newStsClient();
     for (const duration of [durationSeconds, 3600]) {
@@ -283,26 +166,16 @@ export async function assumeRole(roleArn, sessionName = "mesh-cli", durationSeco
             if (!isMaxSessionDurationError(err) || duration === 3600) {
                 const message = err instanceof Error ? err.message : String(err);
                 logWarn(`AssumeRole failed: ${message}`);
-                // Name the SSO fix when the ambient session is the problem — the raw
-                // STS error never mentions `aws sso login` (MESH-2479).
                 if (isExpiredAwsTokenMessage(message)) {
                     logWarn(`  Your AWS SSO session looks expired or missing — refresh with: ${SSO_LOGIN_FIX}`);
                 }
                 return null;
             }
-            // Retry with shorter duration
         }
     }
     return null;
 }
-/**
- * Assume role using a Zitadel JWT via AssumeRoleWithWebIdentity, returning
- * the full STS credential struct (including `Expiration`) rather than the
- * env-var shape. Used by callers that need to track/refresh expiry (e.g.
- * `credential_process`).
- */
 export async function assumeRoleCredentials(roleArn, idToken, sessionName, durationSeconds = 43200) {
-    // STS WebIdentity does not require ambient AWS credentials — the JWT proves identity.
     const sts = newStsClient();
     for (const duration of [durationSeconds, 3600]) {
         try {
@@ -318,9 +191,6 @@ export async function assumeRoleCredentials(roleArn, idToken, sessionName, durat
             if (!env)
                 return null;
             return {
-                // `env` is a `Record<string, string>` (index-signature typed), so
-                // `noUncheckedIndexedAccess` widens these to `string | undefined`
-                // even though `toEnv` guarantees they're set — assert accordingly.
                 AccessKeyId: env.AWS_ACCESS_KEY_ID,
                 SecretAccessKey: env.AWS_SECRET_ACCESS_KEY,
                 SessionToken: env.AWS_SESSION_TOKEN,
@@ -332,43 +202,20 @@ export async function assumeRoleCredentials(roleArn, idToken, sessionName, durat
                 logWarn(`AssumeRoleWithWebIdentity failed: ${err instanceof Error ? err.message : String(err)}`);
                 return null;
             }
-            // Retry with shorter duration
         }
     }
     return null;
 }
-/** Assume role using a Zitadel JWT via AssumeRoleWithWebIdentity. */
 export async function assumeRoleWithWebIdentity(roleArn, idToken, sessionName, durationSeconds = 43200) {
     const creds = await assumeRoleCredentials(roleArn, idToken, sessionName, durationSeconds);
     if (!creds)
         return null;
     return toEnv(creds);
 }
-/**
- * Extract the `iss` claim from a JWT without ever throwing — malformed or
- * corrupt tokens (e.g. a damaged `~/.config/mesh/credentials.json`) yield
- * `undefined`. The failure-diagnostic paths use this; a decode that throws
- * there would crash before the diagnostic prints, which is exactly the
- * failure class MESH-2515 removes.
- */
 export function tokenIssuer(token) {
     const iss = decodeJwtPayload(token)?.iss;
     return typeof iss === "string" && iss ? iss : undefined;
 }
-/**
- * Explain an AssumeRoleWithWebIdentity failure in platform terms: which login
- * session (context + token issuer) tried to assume which role, in which AWS
- * account. STS's "web identity token could not be validated" reads like an
- * IAM/expiry problem, but the usual cause is a context whose issuer the role's
- * account simply doesn't trust — e.g. a `mesh.dev` session against a role in a
- * `trabian`-platform account (MESH-2515). stderr only — callers in
- * `--credential-process` mode must keep stdout JSON-clean.
- *
- * `format: "inline"` renders the same facts as one line, for detail fields
- * that get interpolated mid-sentence (the doctor/preflight cred probe). Both
- * forms keep the `AssumeRoleWithWebIdentity failed` prefix the doctor plan
- * documents as the detail capture.
- */
 export function describeAssumeFailure(opts, format = "block") {
     const account = /^arn:aws:iam::(\d+):/.exec(opts.roleArn)?.[1];
     const head = `AssumeRoleWithWebIdentity failed for ${opts.roleArn}` +
@@ -390,7 +237,6 @@ export function describeAssumeFailure(opts, format = "block") {
     lines.push("  If the role's account does not trust this issuer, you are logged into the", "  wrong context for this stack — check `mesh:platform` in the app's Pulumi", "  config and `mesh login <platform>.<env>` accordingly. (This is a context", "  mismatch, not an IAM permission problem.)");
     return lines.join("\n");
 }
-/** Format STS credentials as AWS `credential_process` JSON (Version 1). */
 export function toCredentialProcessJson(creds) {
     return JSON.stringify({
         Version: 1,
@@ -400,16 +246,6 @@ export function toCredentialProcessJson(creds) {
         Expiration: creds.Expiration,
     });
 }
-/**
- * Ask "is there a working AWS connection right now?" — nothing more.
- *
- * Deliberately NOT `resolveAwsCredentials`: that one answers "get me credentials
- * for role X" and has an opinion about how they were obtained. This one runs
- * GetCallerIdentity through the SDK's default provider chain and reports whatever
- * it finds, so a static key/secret pair in `~/.aws/credentials` counts exactly as
- * much as an SSO session or a Zitadel-minted role. Returns null when the chain
- * yields nothing usable.
- */
 export async function probeAwsIdentity() {
     try {
         const out = await newStsClient().send(new GetCallerIdentityCommand({}));
@@ -425,12 +261,6 @@ export async function probeAwsIdentity() {
         return null;
     }
 }
-/**
- * Decode a Zitadel-issued JWT payload (no signature check — we only
- * use it for role-selection hints in mesh-cli; the actual STS calls
- * still verify against the OIDC provider). Returns null on malformed
- * input.
- */
 function decodeJwtPayload(token) {
     const parts = token.split(".");
     if (parts.length !== 3 || !parts[1])
@@ -442,25 +272,6 @@ function decodeJwtPayload(token) {
         return null;
     }
 }
-/**
- * Pick the AWS role ARN to assume based on Zitadel claims.
- *
- * Zitadel emits project roles under
- * `urn:zitadel:iam:org:project:<projectId>:roles` as a nested object
- * keyed by role name. We treat the presence of `mesh.platform:admin`
- * (or any role listed in `meshcli.adminRoles` in config) as the
- * signal to assume the broader admin role when the caller has
- * configured one.
- *
- * Returns `defaultRole` when no admin role is configured, no admin
- * claim is present, or the JWT can't be parsed. This keeps existing
- * deployments working without a config change.
- *
- * The admin AWS role's IAM trust policy is expected to gate
- * assumption on the same Zitadel claim in production (so the CLI
- * preference can't be spoofed). That setup is its own change — see
- * TODO(mesh-zitadel-aws-role-mapping).
- */
 export function selectRoleForCaller(idToken, options) {
     if (!options.adminRole || !idToken)
         return options.defaultRole;
@@ -473,24 +284,6 @@ export function selectRoleForCaller(idToken, options) {
         ? options.adminRole
         : options.defaultRole;
 }
-/**
- * The Zitadel project-role names a decoded token carries.
- *
- * Zitadel emits project roles under a claim whose key is either
- * `urn:zitadel:iam:org:project:roles` or the project-qualified
- * `urn:zitadel:iam:org:project:<projectId>:roles`, and whose value is
- * `{ "<roleKey>": { "<orgId>": "<domain>" } }` — the role name is the
- * TOP-LEVEL key. Unwrapping one level deeper collects org ids, which match no
- * role and deny every caller. A token may carry both claim shapes and roles
- * from several projects, so every matching key is walked and the names merged.
- *
- * @param claims A decoded JWT payload.
- * @returns Role names in claim order, deduplicated; empty when the token
- *   carries no roles claim.
- * @example
- * projectRoleKeys({ "urn:zitadel:iam:org:project:roles": { "registry:read": {} } });
- * // → ["registry:read"]
- */
 export function projectRoleKeys(claims) {
     const names = new Set();
     for (const [key, value] of Object.entries(claims)) {
@@ -507,20 +300,8 @@ export function projectRoleKeys(claims) {
     }
     return [...names];
 }
-/**
- * Resolve AWS credentials using the three-tier strategy.
- *
- * @param roleArn       The IAM role to assume (from mesh:deployerRole)
- * @param appRoot       Pulumi app root directory
- * @param stack         Pulumi stack name
- * @returns Resolved credentials, or null if all methods fail
- *
- * To inherit a broader role based on Zitadel claims, call
- * `selectRoleForCaller` first and pass the result as `roleArn`.
- */
 export async function resolveAwsCredentials(roleArn, appRoot, stack) {
     const roleName = roleArn.split("/").pop() ?? roleArn;
-    // Path 1: Existing AWS credentials in environment (CI/CD)
     if (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SESSION_TOKEN) {
         logInfo("Using existing AWS credentials from environment");
         return {
@@ -532,11 +313,6 @@ export async function resolveAwsCredentials(roleArn, appRoot, stack) {
             method: "environment",
         };
     }
-    // Path 2: Zitadel JWT via mesh login → AssumeRoleWithWebIdentity.
-    // Non-interactive here: only a valid CACHED session is used. An interactive
-    // device-flow before the SSO fallback would stall headless runs (CI,
-    // `mesh dev` with a working AWS_PROFILE) for minutes polling device codes
-    // nobody sees — SSO gets its chance first; interactive login is Path 4.
     const platformContext = derivePlatformContext(appRoot, stack);
     if (platformContext) {
         const meshCreds = await ensureLogin(platformContext, { interactive: false });
@@ -554,16 +330,12 @@ export async function resolveAwsCredentials(roleArn, appRoot, stack) {
                 `  (Try: mesh login ${platformContext})`);
         }
     }
-    // Path 3: Fallback — AssumeRole via current AWS session (SSO)
     logInfo(`Assuming ${roleName} via AWS SSO`);
     const creds = await assumeRole(roleArn, "mesh-cli");
     if (creds) {
         logSuccess(`Assumed ${roleName}`);
         return { env: creds, method: "sso" };
     }
-    // Path 4: Last resort — interactive Zitadel login (device/browser). Only
-    // reached when there's no env cred, no cached session, and no working SSO,
-    // i.e. a human at a terminal who genuinely needs to log in.
     if (platformContext && process.stdout.isTTY) {
         const meshCreds = await ensureLogin(platformContext);
         if (meshCreds) {
@@ -580,4 +352,3 @@ export async function resolveAwsCredentials(roleArn, appRoot, stack) {
     }
     return null;
 }
-//# sourceMappingURL=aws-auth.js.map

package/dist/src/utils/bastion.d.ts

@@ -1,43 +1,16 @@
-/**
- * Bastion utilities for SSM tunneling to platform services
- */
-/**
- * Service endpoint info
- */
 export interface ServiceEndpoint {
     host: string;
     port: number;
 }
-/**
- * Platform bastion info from SSM
- */
 export interface PlatformBastionInfo {
     instanceId: string;
     securityGroupId: string;
     services: Record<string, ServiceEndpoint>;
 }
-/**
- * Legacy bastion info (for backward compatibility with db commands)
- */
 export interface BastionInfo {
     instanceId: string;
     rdsEndpoint: string;
     rdsPort: number;
 }
-/**
- * Get platform bastion info from SSM parameter store.
- *
- * Reads the platformBastion key from the platform export at
- * /mesh-platform/{tenant}/{platformEnv}/platform. Falls back to the legacy
- * separate parameter at /mesh-platform/{tenant}/{platformEnv}/platform-bastion
- * for backward compatibility.
- */
 export declare function getPlatformBastionInfo(tenant: string, platformEnv: string, region?: string): Promise<PlatformBastionInfo>;
-/**
- * Get bastion info from SSM parameter store (legacy format).
- * Reads from /mesh/{tenant}/{platformEnv}/platform-bastion and extracts RDS info.
- *
- * @deprecated Use getPlatformBastionInfo instead
- */
 export declare function getBastionInfo(tenant: string, platformEnv: string): Promise<BastionInfo>;
-//# sourceMappingURL=bastion.d.ts.map

package/dist/src/utils/bastion.js

@@ -1,24 +1,8 @@
-/**
- * Bastion utilities for SSM tunneling to platform services
- */
 import { SSMClient, GetParameterCommand } from "@aws-sdk/client-ssm";
 import { logInfo, logSuccess, logError } from "./log.js";
-/**
- * Get platform bastion info from SSM parameter store.
- *
- * Reads the platformBastion key from the platform export at
- * /mesh-platform/{tenant}/{platformEnv}/platform. Falls back to the legacy
- * separate parameter at /mesh-platform/{tenant}/{platformEnv}/platform-bastion
- * for backward compatibility.
- */
 export async function getPlatformBastionInfo(tenant, platformEnv, region) {
     const ssm = new SSMClient(region ? { region } : {});
-    // Captured so the final error can distinguish a CREDS failure (the common
-    // case — stale/expired ambient AWS creds, or creds lacking cross-tenant read
-    // on the hub param) from a genuinely missing bastion. Without this the read
-    // error is swallowed and every failure looks like "bastion not deployed".
     let primaryError;
-    // Primary: read from the platform export (platformBastion is a nested key)
     const platformPath = `/mesh-platform/${tenant}/${platformEnv}/platform`;
     logInfo(`Looking up platform bastion from ${platformPath}...`);
     try {
@@ -37,11 +21,8 @@ export async function getPlatformBastionInfo(tenant, platformEnv, region) {
         }
     }
     catch (err) {
-        // Don't swallow: keep the real reason (AccessDenied / ExpiredToken / …) so
-        // the final error can be actionable. Then try the legacy path.
         primaryError = err;
     }
-    // Fallback: legacy separate parameter
     const legacyPath = `/mesh-platform/${tenant}/${platformEnv}/platform-bastion`;
     logInfo(`Trying legacy path ${legacyPath}...`);
     try {
@@ -58,8 +39,6 @@ export async function getPlatformBastionInfo(tenant, platformEnv, region) {
         return info;
     }
     catch (legacyError) {
-        // Classify on the PRIMARY read's error (the meaningful one) — the legacy
-        // path is usually just ParameterNotFound and hides the real cause.
         const cause = primaryError ?? legacyError;
         const name = cause?.name ?? "";
         const credsProblem = /Expired|UnrecognizedClient|InvalidClientTokenId|InvalidSignature|CredentialsProviderError|AccessDenied/i.test(name);
@@ -77,12 +56,6 @@ export async function getPlatformBastionInfo(tenant, platformEnv, region) {
         throw cause;
     }
 }
-/**
- * Get bastion info from SSM parameter store (legacy format).
- * Reads from /mesh/{tenant}/{platformEnv}/platform-bastion and extracts RDS info.
- *
- * @deprecated Use getPlatformBastionInfo instead
- */
 export async function getBastionInfo(tenant, platformEnv) {
     const info = await getPlatformBastionInfo(tenant, platformEnv);
     const rdsService = info.services["rds"];
@@ -95,4 +68,3 @@ export async function getBastionInfo(tenant, platformEnv) {
         rdsPort: rdsService.port,
     };
 }
-//# sourceMappingURL=bastion.js.map

package/dist/src/utils/build-info.d.ts

@@ -1,33 +1,11 @@
-/**
- * CLI provenance for `mesh --version` (MESH-2479).
- *
- * A stale shim / stale global install is invisible when --version prints only
- * the package version — two different checkouts (or a source tree vs a
- * published dist) can share "0.5.1". This resolves WHERE the running CLI
- * came from (TypeScript source vs published dist) plus the commit/build date,
- * so "am I running the code I think I am?" is answerable from one command.
- *
- * Source layout: bin/mesh.ts runs under tsx from the repo — commit/date come
- * from git at call time. Dist layout: the published package ships
- * dist/build-info.json written by scripts/build-for-publish.ts.
- */
 export interface CliRuntimeInfo {
     version: string;
     mode: "source" | "dist";
     commit?: string;
     builtAt?: string;
 }
-/** Pure: a module path under a `dist/` segment is the published build. */
 export declare function detectRuntimeMode(modulePath: string): "source" | "dist";
-/** Pure: one-line version string with provenance, e.g.
- * `0.5.1 (source @ abc1234 2026-07-30)` or
- * `0.5.1 (published build 2026-07-28, commit abc1234)`. */
 export declare function formatVersionLine(info: CliRuntimeInfo): string;
-/** Resolve the running CLI's version + provenance. Never throws.
- * `vcs: false` skips the git spawns in source mode (version + mode only) —
- * commit/date cost two synchronous `git` runs, too slow to pay on every
- * invocation when nothing will print them. */
 export declare function resolveCliRuntime(opts?: {
     vcs?: boolean;
 }): CliRuntimeInfo;
-//# sourceMappingURL=build-info.d.ts.map

package/dist/src/utils/build-info.js

@@ -1,27 +1,10 @@
-/**
- * CLI provenance for `mesh --version` (MESH-2479).
- *
- * A stale shim / stale global install is invisible when --version prints only
- * the package version — two different checkouts (or a source tree vs a
- * published dist) can share "0.5.1". This resolves WHERE the running CLI
- * came from (TypeScript source vs published dist) plus the commit/build date,
- * so "am I running the code I think I am?" is answerable from one command.
- *
- * Source layout: bin/mesh.ts runs under tsx from the repo — commit/date come
- * from git at call time. Dist layout: the published package ships
- * dist/build-info.json written by scripts/build-for-publish.ts.
- */
 import { execFileSync } from "child_process";
 import * as fs from "fs";
 import * as path from "path";
 import { fileURLToPath } from "url";
-/** Pure: a module path under a `dist/` segment is the published build. */
 export function detectRuntimeMode(modulePath) {
     return modulePath.split(/[\\/]/).includes("dist") ? "dist" : "source";
 }
-/** Pure: one-line version string with provenance, e.g.
- * `0.5.1 (source @ abc1234 2026-07-30)` or
- * `0.5.1 (published build 2026-07-28, commit abc1234)`. */
 export function formatVersionLine(info) {
     if (info.mode === "source") {
         const at = [info.commit, info.builtAt].filter(Boolean).join(" ");
@@ -32,7 +15,6 @@ export function formatVersionLine(info) {
     const detail = built || commit ? `${built}${commit}` : " — build metadata unavailable";
     return `${info.version} (published build${detail})`;
 }
-/** Walk up from `startDir` to the @mesh-tech/mesh-cli package root. */
 function findCliPackageRoot(startDir) {
     let dir = startDir;
     for (let i = 0; i < 8; i++) {
@@ -42,7 +24,6 @@ function findCliPackageRoot(startDir) {
                 return dir;
         }
         catch {
-            // keep walking
         }
         const parent = path.dirname(dir);
         if (parent === dir)
@@ -51,10 +32,6 @@ function findCliPackageRoot(startDir) {
     }
     return null;
 }
-/** Resolve the running CLI's version + provenance. Never throws.
- * `vcs: false` skips the git spawns in source mode (version + mode only) —
- * commit/date cost two synchronous `git` runs, too slow to pay on every
- * invocation when nothing will print them. */
 export function resolveCliRuntime(opts) {
     const vcs = opts?.vcs ?? true;
     const here = path.dirname(fileURLToPath(import.meta.url));
@@ -66,7 +43,6 @@ export function resolveCliRuntime(opts) {
             version = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf-8")).version ?? version;
         }
         catch {
-            // fall through with the placeholder
         }
     }
     const info = { version, mode };
@@ -79,7 +55,6 @@ export function resolveCliRuntime(opts) {
             info.builtAt = meta.builtAt;
         }
         catch {
-            // pre-MESH-2479 publishes have no build-info.json
         }
         return info;
     }
@@ -95,8 +70,6 @@ export function resolveCliRuntime(opts) {
         info.builtAt = git(["log", "-1", "--format=%cs"]);
     }
     catch {
-        // not a git checkout (e.g. exported source) — version + mode still print
     }
     return info;
 }
-//# sourceMappingURL=build-info.js.map