@mesh-tech/mesh-cli 0.20.1 → 0.20.3

package/dist/src/commands/cluster.d.ts

@@ -1,45 +1,6 @@
-/**
- * mesh cluster access — `mesh kubectl` / `mesh logs` / `mesh exec` against a
- * deployed app's EKS cluster, authenticated as the app's Zitadel deployer role
- * (MESH-2060).
- *
- * Reuses exactly what `mesh dev` already does internally: assume the app's
- * deployer role, build a session kubeconfig from the platform `eks` SSM export
- * (`aws eks get-token` — needs neither `eks:DescribeCluster` nor a readable
- * `~/.kube/config`, which macOS TCC blocks for non-FDA shells), and shell out to
- * kubectl with `KUBECONFIG` set.
- *
- * The deployer role's cluster RBAC is namespace-scoped to the tenant's
- * namespaces (verified live: the `<tenant>-<env>-deployers` group grants
- * pods/log/exec read in the app's namespace), so every command defaults to the
- * app's own namespace and callers can still `-n <other>` within the tenant.
- */
 import { Command } from "commander";
 import { type EnsureKubeconfigFailure } from "../utils/kubeconfig.js";
-/**
- * Render the "couldn't resolve the EKS cluster" failure with the parameter
- * tried and the real exception. The pre-MESH-2515 message guessed "you have
- * SSM read access" at every failure — which sent three investigations after a
- * permission that was never missing when the actual cause was the wrong
- * platform name in the SSM path.
- */
 export declare function clusterResolveErrorMessage(platformName: string, platformEnv: string, failure?: EnsureKubeconfigFailure): string;
-/**
- * Whether the user already scoped the namespace. Deliberately only detects the
- * split forms (`-n foo`, `--namespace foo`, `--namespace=foo`, `-A`), NOT the
- * smashed short form `-nfoo`: our default `-n <ns>` is PREPENDED, and kubectl's
- * pflag lets the later (user-supplied) `-nfoo` win, so a missed detection here is
- * harmless. Do not "fix" this into an append — that would let our default win
- * over the user's intent.
- */
 export declare function hasNamespaceFlag(args: string[]): boolean;
-/**
- * Translate an ergonomic log/exec target into kubectl selector args.
- *  - `deployment/x` / `pod/x` (contains `/`) → passed through
- *  - `k=v` (contains `=`)                    → label selector `-l k=v`
- *  - bare `<service>`                        → `-l app=<service>` (the reliable
- *    per-service label; deployment names == service names)
- */
 export declare function targetToSelector(target: string): string[];
 export declare function registerClusterCommands(program: Command): void;
-//# sourceMappingURL=cluster.d.ts.map

package/dist/src/commands/cluster.js

@@ -1,19 +1,3 @@
-/**
- * mesh cluster access — `mesh kubectl` / `mesh logs` / `mesh exec` against a
- * deployed app's EKS cluster, authenticated as the app's Zitadel deployer role
- * (MESH-2060).
- *
- * Reuses exactly what `mesh dev` already does internally: assume the app's
- * deployer role, build a session kubeconfig from the platform `eks` SSM export
- * (`aws eks get-token` — needs neither `eks:DescribeCluster` nor a readable
- * `~/.kube/config`, which macOS TCC blocks for non-FDA shells), and shell out to
- * kubectl with `KUBECONFIG` set.
- *
- * The deployer role's cluster RBAC is namespace-scoped to the tenant's
- * namespaces (verified live: the `<tenant>-<env>-deployers` group grants
- * pods/log/exec read in the app's namespace), so every command defaults to the
- * app's own namespace and callers can still `-n <other>` within the tenant.
- */
 import { spawnSync } from "node:child_process";
 import { logError, logInfo } from "../utils/log.js";
 import { findAppRoot, findStackConfigs, getCurrentStack, pulumiStackOutput, readStackConfig, } from "../utils/pulumi.js";
@@ -21,12 +5,6 @@ import { resolveAwsCredentials, derivePlatformContext } from "../utils/aws-auth.
 import { ensureKubeconfig, resolveHubPlatformName, } from "../utils/kubeconfig.js";
 import { probeCredentials } from "./login.js";
 import { credProbeToPreflightError } from "../utils/pulumi-run.js";
-/**
- * Assume the app's deployer role, resolve the deployed app's platform env +
- * namespace from stack output, and materialize a session kubeconfig. Throws with
- * an actionable message on any failure (missing app dir, unresolved creds,
- * undeployed stack, unresolvable cluster).
- */
 async function resolveClusterAccess(opts) {
     const appRoot = findAppRoot(process.cwd());
     if (!appRoot) {
@@ -41,14 +19,11 @@ async function resolveClusterAccess(opts) {
                 : "No stack configs found in this directory."));
     }
     const sa = ["--stack", stack];
-    // Assume the app's deployer role — same path as `mesh dev` / `mesh temporal`.
     const deployerRole = readStackConfig(appRoot, stack, "mesh:deployerRole");
     const ctx = derivePlatformContext(appRoot, stack);
     const resolved = deployerRole
         ? await resolveAwsCredentials(deployerRole, appRoot, stack)
         : null;
-    // Login preflight: name the credential problem up front instead of failing
-    // deep inside the kubectl `aws eks get-token` exec plugin.
     if (deployerRole && !resolved && !process.env.AWS_ACCESS_KEY_ID) {
         const pf = ctx
             ? credProbeToPreflightError(await probeCredentials(ctx, deployerRole), ctx)
@@ -60,13 +35,8 @@ async function resolveClusterAccess(opts) {
     const region = readStackConfig(appRoot, stack, "aws:region");
     if (awsEnv && region && !awsEnv.AWS_REGION)
         awsEnv.AWS_REGION = region;
-    // Thread the resolved creds into this process so ensureKubeconfig's SSM read
-    // and the kubectl `aws eks get-token` exec plugin run credentialed.
     if (awsEnv)
         Object.assign(process.env, awsEnv);
-    // Read the deployed app output for platform env + namespace (mirrors the
-    // reader in `mesh temporal`; the `app` struct's `dev` field is secret-tainted,
-    // and pulumiStackOutput transparently retries with --show-secrets).
     let appOutput;
     let devOutput;
     try {
@@ -83,18 +53,11 @@ async function resolveClusterAccess(opts) {
         }
     }
     const platformEnv = devOutput?.platform?.env ?? "dev";
-    // The HUB platform name (e.g. "trabian") — cluster data lives under it, not
-    // under a hardcoded "mesh" (MESH-2515). Same axis `mesh dev` uses for the
-    // bastion; "mesh" is only the default hub.
     const platformName = resolveHubPlatformName(devOutput?.platform);
     const namespace = appOutput?.namespace ?? devOutput?.namespace;
     if (!namespace) {
         throw new Error(`No namespace found in stack output for '${stack}'.`);
     }
-    // Build a session kubeconfig from the platform eks SSM export. Key the session
-    // file on platformName + platformEnv too, so two apps on DIFFERENT platforms
-    // that share a stack name (e.g. both "dev") don't race on the same kubeconfig
-    // path.
     let failure;
     const kubeconfigPath = await ensureKubeconfig(platformName, platformEnv, `mesh-cluster-${platformName}-${platformEnv}-${stack}`, { onError: (f) => (failure = f) });
     if (!kubeconfigPath) {
@@ -102,13 +65,6 @@ async function resolveClusterAccess(opts) {
     }
     return { kubeconfigPath, namespace, stack };
 }
-/**
- * Render the "couldn't resolve the EKS cluster" failure with the parameter
- * tried and the real exception. The pre-MESH-2515 message guessed "you have
- * SSM read access" at every failure — which sent three investigations after a
- * permission that was never missing when the actual cause was the wrong
- * platform name in the SSM path.
- */
 export function clusterResolveErrorMessage(platformName, platformEnv, failure) {
     const parameter = failure?.parameter ?? `/mesh-platform/${platformName}/${platformEnv}/core/eks`;
     const err = failure?.error;
@@ -125,21 +81,9 @@ export function clusterResolveErrorMessage(platformName, platformEnv, failure) {
         "means the WRONG platform path, not missing SSM permissions.");
 }
 const NS_FLAGS = new Set(["-n", "--namespace", "-A", "--all-namespaces"]);
-/**
- * Whether the user already scoped the namespace. Deliberately only detects the
- * split forms (`-n foo`, `--namespace foo`, `--namespace=foo`, `-A`), NOT the
- * smashed short form `-nfoo`: our default `-n <ns>` is PREPENDED, and kubectl's
- * pflag lets the later (user-supplied) `-nfoo` win, so a missed detection here is
- * harmless. Do not "fix" this into an append — that would let our default win
- * over the user's intent.
- */
 export function hasNamespaceFlag(args) {
     return args.some((a) => NS_FLAGS.has(a) || a.startsWith("--namespace="));
 }
-/**
- * Run kubectl with the session kubeconfig, defaulting the namespace to the app's
- * own unless the caller already scoped it. Returns the child exit code.
- */
 function runKubectl(access, args, opts = {}) {
     const finalArgs = opts.defaultNamespace !== false && !hasNamespaceFlag(args)
         ? ["-n", access.namespace, ...args]
@@ -160,13 +104,6 @@ function runKubectl(access, args, opts = {}) {
     }
     return res.status ?? 0;
 }
-/**
- * Translate an ergonomic log/exec target into kubectl selector args.
- *  - `deployment/x` / `pod/x` (contains `/`) → passed through
- *  - `k=v` (contains `=`)                    → label selector `-l k=v`
- *  - bare `<service>`                        → `-l app=<service>` (the reliable
- *    per-service label; deployment names == service names)
- */
 export function targetToSelector(target) {
     if (target.includes("/"))
         return [target];
@@ -175,22 +112,16 @@ export function targetToSelector(target) {
     return ["-l", `app=${target}`];
 }
 export function registerClusterCommands(program) {
-    // `mesh kubectl [args…]` — passthrough. Help is delegated to kubectl so
-    // `mesh kubectl get --help` works; run `mesh kubectl` with no args to see it.
     program
         .command("kubectl")
         .description("Run kubectl against the app's cluster (deployer role + SSM kubeconfig)")
         .option("--stack <stack>", "Deployed Pulumi stack (default: current selection)")
         .allowUnknownOption(true)
-        // Forward every positional (kubectl subcommand + args) verbatim. Commander
-        // v13 flips the default to ERROR on excess args, so declare it explicitly —
-        // a routine dependency bump must not silently break the passthrough.
         .allowExcessArguments(true)
         .helpOption(false)
         .action(async (opts, cmd) => {
         try {
             const access = await resolveClusterAccess({ stack: opts.stack });
-            // Context line to stderr so stdout stays clean for piping.
             process.stderr.write(`→ kubectl · ns ${access.namespace} · stack ${access.stack}\n`);
             process.exit(runKubectl(access, cmd.args));
         }
@@ -199,7 +130,6 @@ export function registerClusterCommands(program) {
             process.exit(1);
         }
     });
-    // `mesh logs [target]` — ergonomic kubectl logs against the app's namespace.
     program
         .command("logs [target]")
         .description("Tail logs from the app's pods (kubectl logs; target = service, deployment/x, or k=v)")
@@ -230,7 +160,6 @@ export function registerClusterCommands(program) {
             process.exit(1);
         }
     });
-    // `mesh exec <target> -- <cmd…>` — exec into one of the app's pods.
     program
         .command("exec <target> [cmd...]")
         .description("Exec a command in the app's pod (kubectl exec; target = service or deployment/x)")
@@ -239,7 +168,6 @@ export function registerClusterCommands(program) {
         .action(async (target, cmdParts, opts) => {
         try {
             const access = await resolveClusterAccess({ stack: opts.stack });
-            // exec needs a single pod; a bare service resolves to its deployment.
             const podRef = target.includes("/") ? target : `deployment/${target}`;
             const command = cmdParts.length > 0 ? cmdParts : ["sh"];
             const kargs = ["exec"];
@@ -256,4 +184,3 @@ export function registerClusterCommands(program) {
         }
     });
 }
-//# sourceMappingURL=cluster.js.map

package/dist/src/commands/conversations.d.ts

@@ -1,15 +1,3 @@
-/**
- * mesh conversations — read a deployed Mesh agent's conversations
- *
- * Commands:
- *   mesh conversations list             List conversations visible to the caller
- *   mesh conversations show <id>        Render a conversation's transcript
- *   mesh conversations artifacts <id>   List a conversation's artifacts
- *
- * Discovery-first: resolves a target (registry name, --api-url, or
- * fallback) via `resolveTarget`/`agentApiFetch` (Task 3) and renders a
- * table (TTY) or JSON (piped / --json).
- */
 import { Command } from "commander";
 export interface ConversationSummary {
     id: string;
@@ -17,45 +5,21 @@ export interface ConversationSummary {
     updatedAt?: string;
     lastUpdated?: string;
 }
-/**
- * Pure formatter: JSON verbatim (compact — agents parse this, so it's kept
- * dense rather than pretty-printed) when `asJson`, else a simple aligned
- * ID/TITLE/UPDATED table. Tolerant of missing title/updatedAt/lastUpdated
- * and an empty list.
- */
 export declare function formatConversations(list: ConversationSummary[], asJson: boolean): string;
 export interface TranscriptMessage {
     role: string;
-    /** Plain string, or an AI SDK array of content parts (rendered via renderMessageContent). */
     content?: unknown;
-    /** Present on assistant turns that invoked tools; shape varies by agent-sdk version. */
     toolCalls?: unknown[];
-    /** Artifact ids/refs produced or referenced by this turn. */
     artifactRefs?: unknown[];
 }
 export interface TranscriptBody {
     messages?: TranscriptMessage[];
 }
-/**
- * Pure formatter: JSON verbatim (compact) when `asJson`, else one `role:
- * content` block per message (blank-line separated). Tolerant of a missing
- * `content` (renders `role: ` with nothing after it) and an empty/missing
- * `messages` array. When a message carries `toolCalls`/`artifactRefs`, notes
- * them compactly on an indented line beneath the block.
- */
 export declare function formatTranscript(body: TranscriptBody, asJson: boolean): string;
 export interface ArtifactSummary {
     id: string;
     kind?: string;
     title?: string;
 }
-/**
- * Pure formatter: JSON verbatim (compact) when `asJson`, else an
- * `ARTIFACT-ID · KIND · TITLE` table plus a trailing download hint (using
- * `refHint` — the conversation id — and the first artifact's id as the
- * copy-pasteable example). Tolerant of missing kind/title and an empty list
- * (no download hint when there's nothing to download).
- */
 export declare function formatArtifacts(list: ArtifactSummary[], asJson: boolean, refHint: string): string;
 export declare function registerConversationsCommands(program: Command): void;
-//# sourceMappingURL=conversations.d.ts.map

package/dist/src/commands/conversations.js

@@ -1,18 +1,3 @@
-/**
- * mesh conversations — read a deployed Mesh agent's conversations
- *
- * Commands:
- *   mesh conversations list             List conversations visible to the caller
- *   mesh conversations show <id>        Render a conversation's transcript
- *   mesh conversations artifacts <id>   List a conversation's artifacts
- *
- * Discovery-first: resolves a target (registry name, --api-url, or
- * fallback) via `resolveTarget`/`agentApiFetch` (Task 3) and renders a
- * table (TTY) or JSON (piped / --json).
- */
-// renderMessageContent is needed synchronously by the exported formatter;
-// safe at top level since agent-targets' exports are source-mapped. The
-// heavy pull/writeBundle pair stays lazily imported in the pull action.
 import { renderMessageContent } from "@mesh-tech/agent-targets";
 import { buildVcsEnricher } from "./vcs-enrich.js";
 import { logError, logInfo, logWarn } from "../utils/log.js";
@@ -21,12 +6,6 @@ const MAX_TITLE_LEN = 40;
 function truncate(s, max) {
     return s.length > max ? s.slice(0, max - 1) + "…" : s;
 }
-/**
- * Pure formatter: JSON verbatim (compact — agents parse this, so it's kept
- * dense rather than pretty-printed) when `asJson`, else a simple aligned
- * ID/TITLE/UPDATED table. Tolerant of missing title/updatedAt/lastUpdated
- * and an empty list.
- */
 export function formatConversations(list, asJson) {
     if (asJson) {
         return JSON.stringify(list);
@@ -46,7 +25,6 @@ export function formatConversations(list, asJson) {
     const lines = rows.map((r) => `${pad(r.id, idWidth)}  ${pad(r.title, titleWidth)}  ${r.updated}`);
     return [header, ...lines].join("\n");
 }
-/** Compact a list of tool-call/artifact-ref entries to a comma-joined summary. */
 function summarizeRefs(items) {
     return items
         .map((item) => {
@@ -62,13 +40,6 @@ function summarizeRefs(items) {
     })
         .join(", ");
 }
-/**
- * Pure formatter: JSON verbatim (compact) when `asJson`, else one `role:
- * content` block per message (blank-line separated). Tolerant of a missing
- * `content` (renders `role: ` with nothing after it) and an empty/missing
- * `messages` array. When a message carries `toolCalls`/`artifactRefs`, notes
- * them compactly on an indented line beneath the block.
- */
 export function formatTranscript(body, asJson) {
     if (asJson) {
         return JSON.stringify(body);
@@ -90,13 +61,6 @@ export function formatTranscript(body, asJson) {
     })
         .join("\n\n");
 }
-/**
- * Pure formatter: JSON verbatim (compact) when `asJson`, else an
- * `ARTIFACT-ID · KIND · TITLE` table plus a trailing download hint (using
- * `refHint` — the conversation id — and the first artifact's id as the
- * copy-pasteable example). Tolerant of missing kind/title and an empty list
- * (no download hint when there's nothing to download).
- */
 export function formatArtifacts(list, asJson, refHint) {
     if (asJson) {
         return JSON.stringify(list);
@@ -117,7 +81,6 @@ export function formatArtifacts(list, asJson, refHint) {
     const exampleId = rows[0]?.id ?? "";
     return [header, ...lines, "", `Download: mesh artifacts get ${refHint}:${exampleId}`].join("\n");
 }
-/** Add the shared `--target/--api-url/--context/--json` option set (same across list/show/artifacts). */
 function withTargetOptions(cmd) {
     return cmd
         .option("--target <name>", "Named agent target from the agent-targets registry")
@@ -125,18 +88,7 @@ function withTargetOptions(cmd) {
         .option("--context <ctx>", "Zitadel auth context, used with --api-url (default: mesh.dev)")
         .option("--json", "Emit JSON (default when stdout is not a TTY)");
 }
-/**
- * Shared resolve → fetch → format → print flow for a conversations verb.
- * `ctx.id` (the conversation id, when the verb has one) is passed through to
- * `describeHttpError` so it can echo it in the 404 message and offer the
- * `mesh temporal recover-conversation <id>` hint on a 503
- * `conversation_unavailable` response (formerly `show`'s own special-case;
- * now folded into the one shared renderer).
- */
 async function runConversationsVerb(opts, apiPath, format, ctx) {
-    // Declared outside the try so a network-error catch can give
-    // local-vs-remote-aware guidance (`describeNetworkError` needs the
-    // target); stays undefined if `resolveTarget` itself is what threw.
     let target;
     try {
         target = resolveTarget(opts);
@@ -152,13 +104,6 @@ async function runConversationsVerb(opts, apiPath, format, ctx) {
         reportCliError(error, target);
     }
 }
-/**
- * Symmetric with `mesh artifacts get`'s catch: `describeHttpError` failures
- * already carry target-aware guidance in their message (so `hint === message`
- * and nothing further is logged), while a genuine network throw
- * (ECONNREFUSED/"fetch failed"/ENOTFOUND/EAI_AGAIN) gets an extra
- * local-vs-remote hint via `describeNetworkError`.
- */
 function reportCliError(error, target) {
     if (error instanceof TargetResolutionError) {
         logError(error.message);
@@ -204,9 +149,6 @@ export function registerConversationsCommands(program) {
         .option("--no-recursive", "Only pull direct subagents (default: recurse the delegate tree)")
         .option("--no-vcs", "Skip pulling each design's own vcs folder (docs/manifest); IR-only")
         .action(async (id, opts) => {
-        // Lazy: an unbuilt/unresolvable agent-targets must degrade only this
-        // command, never brick the whole CLI at boot (src/program.ts imports all
-        // command modules eagerly).
         const { pullConversation, writeBundle } = await import("@mesh-tech/agent-targets");
         let target;
         let enricher;
@@ -236,4 +178,3 @@ export function registerConversationsCommands(program) {
         }
     });
 }
-//# sourceMappingURL=conversations.js.map

package/dist/src/commands/create-app.d.ts

@@ -1,67 +1,10 @@
-/**
- * mesh create-app - Scaffold a new tenant application
- *
- * Three modes:
- * 1. Legacy: `mesh create-app --template workflow --tenant x --name y`
- * 2. Composable (flags): `mesh create-app --tenant x --name y --primitives service,database`
- * 3. Interactive: `mesh create-app` (prompts when TTY detected and flags missing)
- *
- * All options can be passed as flags for agent/CI usage (no TTY required).
- */
 import { Command } from "commander";
 import { type RegistryPreflight } from "../utils/auth-preflight.js";
-/** The root `package.json` name that identifies the mesh-platform monorepo. */
 export declare const PLATFORM_MONOREPO_NAME = "mesh-platform";
-/**
- * True when `dir` sits inside the **mesh-platform monorepo** — the one workspace
- * that publishes `@mesh-tech/*`, so a scaffolded app there wants `workspace:*` +
- * `catalog:` (link local source) instead of published ranges.
- *
- * The test is deliberately narrow. Looking for any ancestor `pnpm-workspace.yaml`
- * is not enough: a tenant-apps repo is itself a pnpm workspace (`packages: [apps/*]`).
- * Identity comes from the root `package.json` name, which no tenant repo shares.
- */
 export declare function isInsidePlatformMonorepo(dir: string): boolean;
-/**
- * A fresh standalone tenant-apps repo (empty clone of {tenant}-mesh-apps) is
- * bootstrappable when the cwd is a git repo root that has none of the layouts
- * `resolveAppDir` looks for. Previously create-app exited with "Tenant
- * directory not found: tenants/<t>/" here — even though the app-tenant
- * doctor's Repo-shape check names create-app as the fix ("workspace files
- * included"), so the command must actually deliver them.
- */
 export declare function shouldBootstrapAppsRepo(cwd: string): boolean;
-/**
- * Generate the repo-level files of a standalone tenant-apps repo (the
- * trabian-mesh-apps shape): pnpm workspace over apps/*, private root
- * package.json, scoped CodeArtifact .npmrc, base tsconfig, .gitignore, README.
- * Only writes files that don't already exist; returns what it created.
- */
 export declare function bootstrapAppsRepo(cwd: string, tenant: string): string[];
-/**
- * A composed app puts its runnable packages one level below the app dir
- * (`apps/<name>/api`, `apps/<name>/worker`). pnpm only installs dependencies
- * for workspace MEMBERS, and an apps repo whose `pnpm-workspace.yaml` says
- * `packages: [apps/*]` does not match them — so the app scaffolds, the root
- * install reports success, and `pnpm dev` dies on `Cannot find package 'hono'`
- * with nothing pointing at the cause.
- *
- * Append any missing glob as a line under `packages:` (text edit, so comments
- * and ordering survive). Returns the globs added, empty when nothing was missing.
- */
 export declare function ensureWorkspaceGlobs(root: string, required: string[]): string[];
-/**
- * The `pnpm-workspace.yaml` glob that makes a composed app's nested packages
- * (`<app>/api`, `<app>/worker`) workspace members, derived from where the app
- * actually landed. `resolveAppDir` picks the first existing of
- * `tenants/<t>/apps`, `../<t>/apps` and `apps`, so the glob is rooted at
- * `apps` in one layout and at `tenants/<t>/apps` in another. Returns null when
- * the app resolved outside `root` — nothing there is a member of this workspace.
- *
- * @example
- * workspaceGlobForApp("/repo", "/repo/tenants/acme/apps/billing");
- * // → "tenants/acme/apps" followed by two wildcard segments
- */
 export declare function workspaceGlobForApp(root: string, appDir: string): string | null;
 interface CreateAppOptions {
     tenant?: string;
@@ -69,20 +12,14 @@ interface CreateAppOptions {
     template?: string;
     primitives?: string;
     test: boolean;
-    /** Scaffold without checking registry access (offline; `pnpm install` will need `mesh registry login` first). */
     skipRegistryCheck?: boolean;
 }
-/**
- * Recursively copy a directory, processing .hbs templates
- */
 export declare function copyTemplate(srcDir: string, destDir: string, context: Record<string, unknown>): void;
-/**
- * Resolve output directory for the app
- */
+export declare function describeNoAppsHome(cwd: string, tenant: string, baseDir: string, test: boolean): {
+    message: string;
+    hint: string;
+};
 export declare function resolveAppDir(cwd: string, tenant: string, name: string, test: boolean): string;
-/**
- * Generate a composable app from fragments
- */
 export declare function generateComposableApp(appDir: string, context: {
     name: string;
     tenant: string;
@@ -91,36 +28,15 @@ export declare function generateComposableApp(appDir: string, context: {
     temporal: boolean;
     bucket: boolean;
     region: string;
-    /** True when scaffolding inside the mesh-platform monorepo → `@mesh-tech/*` = `workspace:*`. */
     workspaceDeps: boolean;
-    /** Caret range for the lockstep `@mesh-tech/*` group (standalone repos only). */
     meshRange: string;
-    /** Caret range for `@mesh-tech/esm-bundle`, which versions independently. */
     esmBundleRange: string;
-    /** Literal toolchain devDep ranges for the standalone branch (no `catalog:`). */
     typesNodeRange: string;
     tsxRange: string;
     typescriptRange: string;
-    /** Fully-resolved `mesh:deployerRole` ARN (or an `ACCOUNT_ID` placeholder). */
     deployerRoleArn: string;
 }): void;
 export declare function registerCreateAppCommand(program: Command): void;
-/** Printed when the registry preflight fails — the scaffold stops before any prompt or write. */
 export declare const NO_REGISTRY_ACCESS_MESSAGE: string;
-/**
- * Registry preflight, BEFORE any prompt and before any file is written.
- *
- * A scaffold whose `pnpm install` cannot resolve `@mesh-tech/*` is a trap: the
- * failure arrives minutes later with npm's generic E401/E404 advice, and the
- * fix (registry sign-in) has nothing to do with the app. So outside the
- * platform monorepo — where `workspace:*` links need no registry — the
- * command checks first and, when the machine has no access, stops and names
- * `mesh init`, the one place that sets a machine up. A registry that cannot
- * be reached is a network fault, not a missing grant: warn and carry on.
- *
- * @example
- * await ensureRegistryAccess(process.cwd(), { test: false }); // throws MeshCliError when access is missing
- */
 export declare function ensureRegistryAccess(cwd: string, options: Pick<CreateAppOptions, "skipRegistryCheck">, preflight?: () => Promise<RegistryPreflight>): Promise<void>;
 export {};
-//# sourceMappingURL=create-app.d.ts.map