@mesh-tech/mesh-cli 0.20.1 → 0.20.3

package/dist/src/commands/dev-doctor.js

@@ -1,16 +1,3 @@
-/**
- * `mesh dev doctor` — preflight + on-demand diagnosis for `mesh dev`.
- *
- * Three layers kept deliberately separate so the bug-prone logic stays pure and
- * unit-testable without network/AWS:
- *   1. Engine + renderers (this section): `aggregateStatus`, `runChecks`,
- *      `renderHuman`, `renderJson`.
- *   2. `DoctorContext` builder (resolves role/context/session once).
- *   3. The individual `Check`s (creds, tunnels, ports, …), each returning data.
- *
- * Both `mesh dev doctor` and the `mesh dev` launch preflight call `runChecks`;
- * see MESH-2015 (docs/superpowers/specs/2026-07-08-mesh-dev-doctor-design.md).
- */
 import { execFileSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as net from "node:net";
@@ -18,10 +5,6 @@ import * as path from "node:path";
 import { isLinkedDependencyDir, isPortFree } from "./dev.js";
 import { appUsesMeshPackages, probeRegistryToken, registryLoginFix, } from "../utils/auth-preflight.js";
 import { probeCredentials, isRemoteEnvironment } from "./login.js";
-// ============================================================================
-// Engine + renderers (pure)
-// ============================================================================
-/** `error` if any error, else `warn` if any warn, else `ok` (empty → `ok`). */
 export function aggregateStatus(results) {
     if (results.some((r) => r.status === "error"))
         return "error";
@@ -29,11 +12,6 @@ export function aggregateStatus(results) {
         return "warn";
     return "ok";
 }
-/**
- * Run every check whose `phases` includes `phase`, concurrently. A check that
- * throws is captured as an `error` result rather than aborting the run — the
- * whole point of doctor is to report, never to crash.
- */
 export async function runChecks(ctx, phase, checks) {
     const applicable = checks.filter((c) => c.phases.includes(phase));
     return Promise.all(applicable.map(async (check) => {
@@ -53,7 +31,6 @@ export async function runChecks(ctx, phase, checks) {
     }));
 }
 export const ICONS = { ok: "✓", warn: "⚠", error: "✗" };
-/** Human-readable: one line per check + indented remediation when present. */
 export function renderHuman(results) {
     const lines = [];
     for (const { check, result } of results) {
@@ -65,7 +42,6 @@ export function renderHuman(results) {
     }
     return lines.join("\n");
 }
-/** The JSON report as data — `renderJson` serialises it; `mesh app check` nests one per app. */
 export function jsonReport(results) {
     return {
         status: aggregateStatus(results.map((r) => r.result)),
@@ -73,26 +49,17 @@ export function jsonReport(results) {
             id: check.id,
             status: result.status,
             summary: result.summary,
-            // Stable keys for tooling: always present, `null` when absent
-            // (JSON.stringify would otherwise drop `undefined`).
             remediation: result.remediation ?? null,
             detail: result.detail ?? null,
         })),
     };
 }
-/** Machine-readable: stable key shape for tooling / future CI. */
 export function renderJson(results) {
     return JSON.stringify(jsonReport(results), null, 2);
 }
-// ============================================================================
-// Check: credentials + TTL (creds)
-// ============================================================================
-/** Render a TTL in seconds as a compact human string ("47m", "1h 10m"). */
 function fmtTtl(seconds) {
     if (seconds <= 0)
         return "expired";
-    // Round to whole minutes first, then split — so 11h59.5m carries to "12h"
-    // rather than rendering "11h 60m".
     const totalMin = Math.round(seconds / 60);
     const h = Math.floor(totalMin / 60);
     const m = totalMin % 60;
@@ -100,11 +67,6 @@ function fmtTtl(seconds) {
         return m > 0 ? `${h}h ${m}m` : `${h}h`;
     return `${m}m`;
 }
-/**
- * Pure mapper: a `CredProbe` → a `CheckResult` with the exact remediation.
- * `headless` selects the device-flow `mesh login` variant (browser flow times
- * out over SSH/tailscale — see the credential runbook).
- */
 export function credProbeToResult(probe, context, headless) {
     const loginCmd = `mesh login ${context}${headless ? " --device" : ""}`;
     switch (probe.state) {
@@ -146,10 +108,6 @@ export const credsCheck = {
     title: "Credentials",
     phases: ["preflight", "ondemand"],
     async run(ctx) {
-        // When creds were already resolved (launch preflight passes the method),
-        // trust that result — avoids a second AssumeRole call, and correctly
-        // reports the SSO/environment paths that `probeCredentials` (Zitadel-only)
-        // would otherwise misdiagnose.
         switch (ctx.credMethod) {
             case "sso":
                 return {
@@ -164,8 +122,6 @@ export const credsCheck = {
                     summary: "using Zitadel deployer credentials (credential_process auto-refresh)",
                 };
         }
-        // credMethod null (on-demand doctor, or a failed launch resolution) or
-        // 'ambient': determine the real state by probing.
         if (!ctx.platformContext || !ctx.deployerRole) {
             return {
                 status: "warn",
@@ -177,24 +133,11 @@ export const credsCheck = {
         return credProbeToResult(probe, ctx.platformContext, isRemoteEnvironment());
     },
 };
-// ============================================================================
-// Check: CodeArtifact registry token (registry) — MESH-2479
-// ============================================================================
-/**
- * Verify the @mesh-tech CodeArtifact token actually works BEFORE long work —
- * an expired token otherwise surfaces minutes later as npm's generic E401
- * ("try npm login", which cannot fix a CodeArtifact registry). Warn-level:
- * `mesh dev` itself runs installed code, so a stale token shouldn't block
- * launch — it should name the fix.
- */
 export const registryCheck = {
     id: "registry",
     title: "Registry auth",
     phases: ["preflight", "ondemand"],
     async run(ctx, phase) {
-        // The other preflight checks are fast — don't let an unreachable
-        // registry (offline / VPN off) hold the whole launch for the full
-        // on-demand bound. The zero-access local loop must stay snappy.
         const probe = await probeRegistryToken(phase === "preflight" ? { timeoutMs: 3_000 } : undefined);
         switch (probe.state) {
             case "fresh":
@@ -226,13 +169,6 @@ export const registryCheck = {
         }
     },
 };
-// ============================================================================
-// Checks: tmux, ports, worktree
-// ============================================================================
-/**
- * Parse `lsof -ti :PORT` + `ps -o comm= -p PID` output into the squatting
- * process. `lsof` may list several PIDs (one per line); we name the first.
- */
 export function parsePortSquatter(lsofOut, psOut) {
     const firstLine = lsofOut.trim().split("\n")[0]?.trim();
     const pid = Number(firstLine);
@@ -241,32 +177,16 @@ export function parsePortSquatter(lsofOut, psOut) {
     const command = psOut.trim().split("\n")[0]?.trim() || "unknown";
     return { pid, command };
 }
-/** True when `serviceSrc` lives under (or equals) `repoRoot`. */
 export function sharesWorktreeRoot(serviceSrc, repoRoot) {
     const src = path.resolve(serviceSrc);
     const root = path.resolve(repoRoot);
     return src === root || src.startsWith(root + path.sep);
 }
-/**
- * Pure classification for the on-demand ports check. Given the PID currently
- * listening on a service port (`null` when nothing is) and the set of PIDs in
- * the live session's tmux process tree:
- *   - `null` listener            → `dead`    (the service isn't running)
- *   - listener in the session    → `owned`   (healthy — the session's own svc)
- *   - listener outside it        → `foreign` (a real squatter)
- * Mid-session the session's services are *supposed* to hold their ports, so a
- * naive "occupied ⇒ squatted" test misreports a healthy session (MESH-2015).
- */
 export function classifyPortListener(listenerPid, sessionPids) {
     if (listenerPid === null)
         return "dead";
     return sessionPids.has(listenerPid) ? "owned" : "foreign";
 }
-/**
- * Pure: expand tmux pane PIDs to the full set of PIDs in their process
- * subtrees, using the output of `ps -eo pid=,ppid=` (each line "PID PPID").
- * The roots themselves are included; unparseable lines are skipped.
- */
 export function collectSessionPids(panePids, psOut) {
     const children = new Map();
     for (const line of psOut.trim().split("\n")) {
@@ -291,7 +211,6 @@ export function collectSessionPids(panePids, psOut) {
     }
     return result;
 }
-/** Identify the process squatting a port; null if it can't be determined. */
 function whoHasPort(port) {
     try {
         const lsof = execFileSync("lsof", ["-ti", `:${port}`], {
@@ -309,7 +228,6 @@ function whoHasPort(port) {
             });
         }
         catch {
-            /* ps failed — parsePortSquatter falls back to "unknown" */
         }
         return parsePortSquatter(lsof, ps);
     }
@@ -317,13 +235,6 @@ function whoHasPort(port) {
         return null;
     }
 }
-/**
- * Gather every PID in the live session's tmux process trees (pane PIDs plus
- * their descendants). Used to tell the session's own service processes apart
- * from foreign squatters. Returns an empty set when tmux/ps are unavailable or
- * the session has no panes — the caller then treats occupied ports as
- * unidentified rather than owned.
- */
 function sessionProcessTree(sessionName) {
     let panePids;
     try {
@@ -347,7 +258,6 @@ function sessionProcessTree(sessionName) {
         });
     }
     catch {
-        // No process table — the pane PIDs themselves are still session-owned.
         return new Set(panePids);
     }
     return collectSessionPids(panePids, psOut);
@@ -377,19 +287,15 @@ export const portsCheck = {
     async run(ctx) {
         const services = ctx.sessionState?.devOutput.services;
         if (!services || Object.keys(services).length === 0) {
-            // Preflight (no session): ports are validated at allocation/launch time.
             return {
                 status: "ok",
                 summary: "no session — ports are checked at allocation time",
             };
         }
-        // Mid-session the session's OWN services should be listening on their
-        // allocated ports. Classify each port against the session's process tree so
-        // healthy self-owned ports don't read as squatters (MESH-2015).
         const sessionPids = sessionProcessTree(ctx.sessionName);
-        const foreign = []; // held by a process outside the session
-        const dead = []; // nothing listening — service died/isn't up
-        const unknown = []; // occupied but the owner couldn't be resolved
+        const foreign = [];
+        const dead = [];
+        const unknown = [];
         for (const [name, svc] of Object.entries(services)) {
             const free = await isPortFree(svc.port);
             const who = free ? null : whoHasPort(svc.port);
@@ -400,9 +306,6 @@ export const portsCheck = {
                 foreign.push(`${name} :${svc.port} held by ${who.command} (pid ${who.pid})`);
                 continue;
             }
-            // `dead` from the helper (null listener pid): either the port is
-            // genuinely free (service down) or it's occupied but the owner couldn't
-            // be resolved via lsof.
             if (free) {
                 dead.push(`${name} :${svc.port} not listening`);
             }
@@ -430,8 +333,6 @@ export const portsCheck = {
                 ? "restart the stopped service: `mesh dev restart <svc>`"
                 : "identify the port owner (`lsof -i :<port>`), then `mesh dev restart <svc>`";
         return {
-            // A real squatter or a down service is actionable → error; an
-            // unidentifiable occupant alone is only a warning.
             status: foreign.length > 0 || dead.length > 0 ? "error" : "warn",
             summary: `service ports: ${parts.join(", ")}`,
             detail: [...foreign, ...dead, ...unknown].join("; "),
@@ -439,16 +340,10 @@ export const portsCheck = {
         };
     },
 };
-// ============================================================================
-// Check: config staleness (config-staleness)
-// ============================================================================
-/** True when the stack config file changed after the session was launched. */
 export function isConfigStale(configMtimeMs, startedAtIso) {
     return configMtimeMs > Date.parse(startedAtIso);
 }
 export const configStalenessCheck = {
-    // Preflight runs *at* launch, so nothing can be stale-relative-to-launch yet
-    // — this only makes sense mid-session.
     id: "config-staleness",
     title: "Config freshness",
     phases: ["ondemand"],
@@ -499,9 +394,6 @@ export const worktreeCheck = {
                 summary: "could not resolve git worktree root for the app",
             };
         }
-        // A dev-LINKED package is outside the worktree by construction and is what
-        // the app runs either way — the same exemption `mesh dev` itself applies, so
-        // the doctor does not warn about something the launcher deliberately allows.
         const foreign = Object.entries(services)
             .filter(([, svc]) => svc.src &&
             !sharesWorktreeRoot(svc.src, repoRoot) &&
@@ -521,10 +413,6 @@ export const worktreeCheck = {
         };
     },
 };
-// ============================================================================
-// Checks: tunnels + temporal (connectivity)
-// ============================================================================
-/** Resolve `true` iff a TCP connection to host:port succeeds within `timeoutMs`. */
 export function canConnect(host, port, timeoutMs = 800) {
     return new Promise((resolve) => {
         const socket = new net.Socket();
@@ -547,8 +435,6 @@ function isLocalHost(host) {
     return host === "localhost" || host === "127.0.0.1" || host === "::1";
 }
 export const tunnelsCheck = {
-    // On-demand only: pre-launch the tunnels don't exist yet, and dialing the
-    // VPC endpoints they'll use would false-positive on an SSM-only machine.
     id: "tunnels",
     title: "Tunnels",
     phases: ["ondemand"],
@@ -557,9 +443,6 @@ export const tunnelsCheck = {
         if (!tunnels || Object.keys(tunnels).length === 0) {
             return { status: "ok", summary: "no tunnels in this session" };
         }
-        // Only dial the SSM-forwarded (localhost) tunnels — those are the ones that
-        // die with "broken pipe → ECONNREFUSED". VPC-direct tunnels are reachable
-        // only over VPN and would false-positive here.
         const local = Object.entries(tunnels).filter(([, t]) => isLocalHost(t.host));
         if (local.length === 0) {
             return {
@@ -584,7 +467,6 @@ export const tunnelsCheck = {
     },
 };
 export const temporalCheck = {
-    // On-demand only: reachability depends on the session's tunnel being up.
     id: "temporal",
     title: "Temporal",
     phases: ["ondemand"],
@@ -624,7 +506,6 @@ export const temporalCheck = {
         }
         catch (err) {
             const code = err.code;
-            // gRPC status: 5 NOT_FOUND, 7 PERMISSION_DENIED, 16 UNAUTHENTICATED.
             if (code === 5) {
                 return {
                     status: "error",
@@ -646,10 +527,6 @@ export const temporalCheck = {
         }
     },
 };
-// ============================================================================
-// Registry + runner
-// ============================================================================
-/** All checks, in display order. */
 export const ALL_CHECKS = [
     tmuxCheck,
     credsCheck,
@@ -660,11 +537,6 @@ export const ALL_CHECKS = [
     tunnelsCheck,
     temporalCheck,
 ];
-/**
- * Run the full on-demand doctor against a prebuilt context, print the report,
- * and return the aggregate status. The caller (the `mesh dev doctor`
- * subcommand) owns process exit.
- */
 export async function runDoctor(ctx, opts) {
     const results = await runChecks(ctx, "ondemand", ALL_CHECKS);
     const status = aggregateStatus(results.map((r) => r.result));
@@ -677,4 +549,3 @@ export async function runDoctor(ctx, opts) {
     }
     return status;
 }
-//# sourceMappingURL=dev-doctor.js.map

package/dist/src/commands/dev-launch.d.ts

@@ -1,59 +1,7 @@
-/**
- * Helpers for launching `mesh dev` services via per-session env files.
- *
- * Background: `mesh dev` used to inline every env var into a single giant
- * `env K1=V1 K2=V2 … <command>` string passed to `tmux send-keys`. With large
- * values (system prompts, encoding keys, OAuth creds) tmux intermittently
- * truncated the string — the service never started — and `mesh dev restart`
- * re-derived the env from scratch, drifting from what the service was
- * originally launched with (e.g. a different TEMPORAL_ENCODING_KEY).
- *
- * Instead, the full env is written once at launch to a 0600 file under the
- * session state dir, and the send-keys command is just:
- *
- *   cd '<dir>' && source '<envfile>' && <command>
- *
- * Restart sources the SAME file, guaranteeing a byte-identical environment.
- */
-/** Env files contain secrets — owner read/write only. */
 export declare const ENV_FILE_MODE = 384;
-/**
- * Single-quote a value for POSIX shells (bash/zsh), escaping embedded
- * single quotes via the standard `'\''` dance. Safe for newlines, spaces,
- * `$`, backticks, etc.
- */
 export declare function quoteShellValue(value: string): string;
-/**
- * Render a sourceable env file: one `export K='V'` per line.
- * Throws on env var names that aren't valid shell identifiers.
- */
 export declare function renderEnvFile(env: Record<string, string>): string;
-/** Filesystem-safe env file name for a service. */
 export declare function envFileName(serviceName: string): string;
-/**
- * Write the env file (creating parent dirs) with mode 0600.
- * chmod is applied explicitly so a pre-existing file is tightened too.
- */
 export declare function writeEnvFile(filePath: string, env: Record<string, string>): void;
-/**
- * Build the short, untruncatable command sent to tmux:
- *   cd '<dir>' && source '<envfile>' && <command>
- *
- * `command` is the service's dev command (already shell syntax) and is
- * passed through verbatim.
- *
- * With `logShipper` (mesh dev --local: the path of assets/log-shipper.mjs),
- * the service's combined stdout/stderr is piped through the shipper: raw
- * bytes go to the pane (its stderr), ANSI-stripped lines ship to the local
- * platform's OTel collector via OTLP — the same ingestion path instrumented
- * apps use, carrying the OTEL_* resource attributes from the env file. Logs
- * never cross the macOS Docker file mount (whose stale attribute caching
- * hides appends from in-container tailers).
- */
 export declare function buildLaunchCommand(envFilePath: string, dir: string, command: string, logShipper?: string): string;
-/**
- * Poll until a TCP port accepts connections, or the timeout elapses.
- * Returns true when the port accepted, false on timeout.
- */
 export declare function waitForPort(host: string, port: number, timeoutMs: number, intervalMs?: number): Promise<boolean>;
-//# sourceMappingURL=dev-launch.d.ts.map

package/dist/src/commands/dev-launch.js

@@ -1,39 +1,11 @@
-/**
- * Helpers for launching `mesh dev` services via per-session env files.
- *
- * Background: `mesh dev` used to inline every env var into a single giant
- * `env K1=V1 K2=V2 … <command>` string passed to `tmux send-keys`. With large
- * values (system prompts, encoding keys, OAuth creds) tmux intermittently
- * truncated the string — the service never started — and `mesh dev restart`
- * re-derived the env from scratch, drifting from what the service was
- * originally launched with (e.g. a different TEMPORAL_ENCODING_KEY).
- *
- * Instead, the full env is written once at launch to a 0600 file under the
- * session state dir, and the send-keys command is just:
- *
- *   cd '<dir>' && source '<envfile>' && <command>
- *
- * Restart sources the SAME file, guaranteeing a byte-identical environment.
- */
 import * as fs from 'fs';
 import * as net from 'net';
 import * as path from 'path';
-/** Env files contain secrets — owner read/write only. */
 export const ENV_FILE_MODE = 0o600;
-/** Valid POSIX env var name. Anything else is rejected to avoid shell injection. */
 const ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/**
- * Single-quote a value for POSIX shells (bash/zsh), escaping embedded
- * single quotes via the standard `'\''` dance. Safe for newlines, spaces,
- * `$`, backticks, etc.
- */
 export function quoteShellValue(value) {
     return `'${value.replace(/'/g, "'\\''")}'`;
 }
-/**
- * Render a sourceable env file: one `export K='V'` per line.
- * Throws on env var names that aren't valid shell identifiers.
- */
 export function renderEnvFile(env) {
     const lines = [
         '# Auto-generated by mesh dev — do not edit.',
@@ -48,49 +20,22 @@ export function renderEnvFile(env) {
     }
     return lines.join('\n') + '\n';
 }
-/** Filesystem-safe env file name for a service. */
 export function envFileName(serviceName) {
     return `${serviceName.replace(/[^A-Za-z0-9._-]/g, '-')}.env.sh`;
 }
-/**
- * Write the env file (creating parent dirs) with mode 0600.
- * chmod is applied explicitly so a pre-existing file is tightened too.
- */
 export function writeEnvFile(filePath, env) {
     fs.mkdirSync(path.dirname(filePath), { recursive: true });
     fs.writeFileSync(filePath, renderEnvFile(env), { mode: ENV_FILE_MODE });
     fs.chmodSync(filePath, ENV_FILE_MODE);
 }
-/**
- * Build the short, untruncatable command sent to tmux:
- *   cd '<dir>' && source '<envfile>' && <command>
- *
- * `command` is the service's dev command (already shell syntax) and is
- * passed through verbatim.
- *
- * With `logShipper` (mesh dev --local: the path of assets/log-shipper.mjs),
- * the service's combined stdout/stderr is piped through the shipper: raw
- * bytes go to the pane (its stderr), ANSI-stripped lines ship to the local
- * platform's OTel collector via OTLP — the same ingestion path instrumented
- * apps use, carrying the OTEL_* resource attributes from the env file. Logs
- * never cross the macOS Docker file mount (whose stale attribute caching
- * hides appends from in-container tailers).
- */
 export function buildLaunchCommand(envFilePath, dir, command, logShipper) {
     const base = `cd ${quoteShellValue(dir)} && source ${quoteShellValue(envFilePath)} && `;
     if (!logShipper)
         return `${base}${command}`;
-    // NODE_OPTIONS= : the shipper must not inherit the service's OTel
-    // auto-instrumentation — its own OTLP POSTs would show up as traces.
     return `${base}{ ${command}; } 2>&1 | NODE_OPTIONS= node ${quoteShellValue(logShipper)}`;
 }
-/**
- * Poll until a TCP port accepts connections, or the timeout elapses.
- * Returns true when the port accepted, false on timeout.
- */
 export async function waitForPort(host, port, timeoutMs, intervalMs = 500) {
     const deadline = Date.now() + timeoutMs;
-    // Always attempt at least once, even with a zero/negative timeout.
     for (;;) {
         const remaining = deadline - Date.now();
         const attemptTimeout = Math.max(250, Math.min(1000, remaining));
@@ -115,4 +60,3 @@ function tryConnect(host, port, timeoutMs) {
         socket.once('error', () => done(false));
     });
 }
-//# sourceMappingURL=dev-launch.js.map

package/dist/src/commands/dev-token-server.d.ts

@@ -1,14 +1,3 @@
-/**
- * `mesh dev __token-server <port> <context>` — the producer side of the
- * self-refreshing dev-user token seam (MESH-2039).
- *
- * `mesh dev` launches this in its own tmux window. On each GET it mints a
- * currently-valid dev-user token (via the existing `getValidToken` refresh
- * path, which silently re-mints from the refresh token and rewrites the shared
- * cache) and returns it on loopback. Consumers poll it (agent-app-kit's
- * dev-user-token provider) so local apps survive past the ~1h Zitadel horizon
- * without a `mesh dev` restart. Bound to 127.0.0.1 only; dev-only.
- */
 export interface TokenServerDeps {
     getValidToken: (context: string) => Promise<string | null>;
     readCredentials: (context: string) => {
@@ -18,15 +7,8 @@ export interface TokenServerDeps {
     } | null;
     decodeJwtPayload: (jwt: string) => Record<string, unknown>;
 }
-/**
- * Pure request handler. 200 with the fresh token pair on success; 503 when the
- * token can't be minted (refresh token lapsed — the MESH-2035 boundary), which
- * consumers treat as "keep last good / fall back to the static env snapshot".
- */
 export declare function handleTokenRequest(context: string, deps: TokenServerDeps): Promise<{
     status: number;
     body: unknown;
 }>;
-/** Start the loopback token server. Never resolves (runs until the window dies). */
 export declare function startTokenServer(port: number, context: string): Promise<void>;
-//# sourceMappingURL=dev-token-server.d.ts.map

package/dist/src/commands/dev-token-server.js

@@ -1,22 +1,6 @@
-/**
- * `mesh dev __token-server <port> <context>` — the producer side of the
- * self-refreshing dev-user token seam (MESH-2039).
- *
- * `mesh dev` launches this in its own tmux window. On each GET it mints a
- * currently-valid dev-user token (via the existing `getValidToken` refresh
- * path, which silently re-mints from the refresh token and rewrites the shared
- * cache) and returns it on loopback. Consumers poll it (agent-app-kit's
- * dev-user-token provider) so local apps survive past the ~1h Zitadel horizon
- * without a `mesh dev` restart. Bound to 127.0.0.1 only; dev-only.
- */
 import * as http from "node:http";
 import { getValidToken, readCredentials, decodeJwtPayload } from "./login.js";
 import { logInfo, logWarn } from "../utils/log.js";
-/**
- * Pure request handler. 200 with the fresh token pair on success; 503 when the
- * token can't be minted (refresh token lapsed — the MESH-2035 boundary), which
- * consumers treat as "keep last good / fall back to the static env snapshot".
- */
 export async function handleTokenRequest(context, deps) {
     const idToken = await deps.getValidToken(context);
     const creds = idToken ? deps.readCredentials(context) : null;
@@ -34,13 +18,7 @@ export async function handleTokenRequest(context, deps) {
         },
     };
 }
-/**
- * Refresh the served token this far before it actually expires, so a consumer
- * polling on its own cadence (~60s) always fetches a token that outlives its
- * next poll — closing the ~once-per-hour self-healing 401 window.
- */
 const REFRESH_MARGIN_MS = 120_000;
-/** Start the loopback token server. Never resolves (runs until the window dies). */
 export async function startTokenServer(port, context) {
     const deps = {
         getValidToken: (c) => getValidToken(c, { marginMs: REFRESH_MARGIN_MS }),
@@ -63,6 +41,5 @@ export async function startTokenServer(port, context) {
     server.on("error", (e) => logWarn(`token-server error: ${e.message}`));
     await new Promise((resolve) => server.listen(port, "127.0.0.1", resolve));
     logInfo(`dev-user token-server on http://127.0.0.1:${port} (context ${context})`);
-    await new Promise(() => { }); // run forever
+    await new Promise(() => { });
 }
-//# sourceMappingURL=dev-token-server.js.map