@mesh-tech/mesh-cli 0.20.2 → 0.20.3

package/dist/src/commands/local/seed.js

@@ -1,15 +1,3 @@
-/**
- * First-boot seeding for the `mesh start` local platform.
- *
- * Registers tenant `local` / env `dev` in the local AWS fabric's (ministack)
- * SSM registry with the same shape TenantEnvironments writes in the cloud
- * (/mesh-platform/{tenant}/{env}/app-tenants → TenantEnvironmentsExports), and
- * creates the tenant artifacts bucket. Idempotent — parameters are overwritten,
- * the bucket create tolerates "already owned by you".
- *
- * Zitadel org/project/CLI-app + test-user seeding (the `mesh login local`
- * path) is tracked as a follow-up on the mesh start epic.
- */
 import { logInfo, logSuccess } from "../../utils/log.js";
 import { MeshCliError } from "../../utils/errors.js";
 export const LOCAL_TENANT = "local";
@@ -17,21 +5,8 @@ export const LOCAL_ENV = "dev";
 export const LOCAL_AWS_ENDPOINT = "http://localhost:4566";
 export const LOCAL_AWS_REGION = "us-east-2";
 export const ARTIFACTS_BUCKET = "mesh-local-artifacts";
-/**
- * General-purpose local data bucket for pipeline development. A `mesh dev
- * --local` session inherits `AWS_ENDPOINT_URL`, so a pipeline's S3 resource
- * (a Dagster pipes-message reader, a sample-input loader) pointed at this
- * bucket round-trips against ministack with no AWS account. Seeded with a
- * sample pipes fragment under `samples/` so a fresh stack has something to
- * materialize from.
- */
 export const DATA_BUCKET = "mesh-local-data";
 export const APP_TENANTS_PARAM = `/mesh-platform/${LOCAL_TENANT}/${LOCAL_ENV}/app-tenants`;
-/**
- * Objects written into `DATA_BUCKET` on first boot. Deliberately tiny and
- * schema-neutral: enough for a sample pipeline to read, assemble, and write —
- * app repos ship their own realistic fixtures.
- */
 const DATA_BUCKET_SEEDS = [
     {
         key: "samples/pipes/fragment-0001.json",
@@ -50,14 +25,6 @@ export const LOCAL_AWS_CONFIG = {
     credentials: { accessKeyId: "test", secretAccessKey: "test" },
 };
 const AWS_CONFIG = LOCAL_AWS_CONFIG;
-/**
- * Env vars that point any AWS SDK process on the host at the local fabric —
- * the SDK-native endpoint override (AWS_ENDPOINT_URL, supported since SDK JS
- * v3 ~3.428), so no client-code changes are needed. `mesh dev` local mode
- * injects these into app processes; humans can `eval` them from the
- * `mesh start` output. In-network services get the same wiring with
- * http://ministack:4566 (see the compose file's x-local-aws-env anchor).
- */
 export function localAwsEnv() {
     return {
         AWS_ENDPOINT_URL: LOCAL_AWS_ENDPOINT,
@@ -66,12 +33,6 @@ export function localAwsEnv() {
         AWS_SECRET_ACCESS_KEY: "test",
     };
 }
-/**
- * The local tenant registration, shaped like TenantEnvironmentsExports
- * (libs/infra-components …/platform/TenantEnvironments.ts) so consumers of the
- * registry (Hub API, init checks) read local and cloud identically. AWS-only
- * fields carry inert local placeholders.
- */
 export function buildAppTenantsSeed() {
     const tenantExport = {
         albGroupName: LOCAL_TENANT,
@@ -96,24 +57,11 @@ export function buildAppTenantsSeed() {
     };
 }
 export const FABRIC_CHECK_PATH = `/mesh-platform/${LOCAL_TENANT}/${LOCAL_ENV}/.fabric-check`;
-/** The tenant's Temporal namespace, matching the cloud convention
- * TemporalNamespaceProvisioner uses ({tenant}-{env}, e.g. "acme-dev"). */
 export const TEMPORAL_NAMESPACE = `${LOCAL_TENANT}-${LOCAL_ENV}`;
 export const TEMPORAL_ADDRESS = "localhost:7233";
-/**
- * Register the local tenant's Temporal namespace ({tenant}-{env} — the same
- * name TemporalNamespaceProvisioner would create in the cloud). Idempotent:
- * "already exists" is success. Dynamic import — @temporalio/client is an
- * optionalDependency (same pattern as commands/temporal.ts).
- */
 export async function seedTemporalNamespace() {
     await ensureTemporalNamespace(TEMPORAL_NAMESPACE, `Mesh local tenant '${LOCAL_TENANT}' env '${LOCAL_ENV}' (seeded by mesh start)`);
 }
-/**
- * Idempotently register a Temporal namespace. `mesh dev --local` uses this
- * for the per-app namespaces ({tenant}-{env}-{app}) the cloud provisioner
- * creates — the Hub's per-app workflow views resolve exactly that name.
- */
 export async function ensureTemporalNamespace(namespace, description) {
     const { Connection } = await import("@temporalio/client");
     const connection = await Connection.connect({ address: TEMPORAL_ADDRESS });
@@ -121,13 +69,8 @@ export async function ensureTemporalNamespace(namespace, description) {
         await connection.workflowService.registerNamespace({
             namespace,
             description: description ?? `Mesh local namespace '${namespace}'`,
-            // protobufjs accepts plain numbers for int64 at runtime; the generated
-            // typing insists on Long (whose package isn't a direct dep), hence any.
             workflowExecutionRetentionPeriod: { seconds: (3 * 24 * 60 * 60) },
         });
-        // A freshly registered namespace isn't usable until the frontend's
-        // namespace cache refreshes (~10s) — a worker connecting immediately
-        // would die on "Namespace not found". Wait it out once, here.
         logInfo(`Registered Temporal namespace '${namespace}' — waiting for it to become active…`);
         const deadline = Date.now() + 20_000;
         while (Date.now() < deadline) {
@@ -157,24 +100,11 @@ export async function ensureTemporalNamespace(namespace, description) {
         await connection.close();
     }
 }
-/**
- * A deterministic >4 KB payload for the Advanced-tier round-trip. Standard
- * SSM params cap at 4 KB; mesh.exports.Export writes tier "Advanced" values
- * up to 8 KB (Export.ts), and the emulator's fidelity there is the one open
- * question the design (§2.5) requires this check to answer on every boot.
- */
 export function buildFabricCheckPayload(targetBytes = 8_000) {
     const base = { probe: "advanced-tier-round-trip", tenant: LOCAL_TENANT, env: LOCAL_ENV, pad: "" };
     const overhead = JSON.stringify(base).length;
     return JSON.stringify({ ...base, pad: "x".repeat(Math.max(0, targetBytes - overhead)) });
 }
-/**
- * Verify the local AWS fabric behaves like real SSM where the platform
- * depends on it: an 8 KB Advanced-tier parameter round-trips intact, and
- * child parameters under a path come back via GetParametersByPath (the
- * shape mesh.exports.Export's splitKeys mode reads). Check params are
- * removed afterwards.
- */
 export async function verifyFabric() {
     const { SSMClient, PutParameterCommand, GetParameterCommand, GetParametersByPathCommand, DeleteParametersCommand } = await import("@aws-sdk/client-ssm");
     const ssm = new SSMClient(AWS_CONFIG);
@@ -218,9 +148,6 @@ export async function verifyFabric() {
             .catch(() => { });
     }
 }
-/** Write the Hub-readable tenant + environment registrations (the shapes
- * hub-api's SSM assembler requires: RawTenant at /{tenant}, RawEnvironment
- * at /{tenant}/{env}). Exported for reuse by app-tenant provisioning. */
 export async function registerTenantEnv(tenant, opts = {}) {
     const { SSMClient, PutParameterCommand } = await import("@aws-sdk/client-ssm");
     const ssm = new SSMClient(AWS_CONFIG);
@@ -239,8 +166,6 @@ export async function registerTenantEnv(tenant, opts = {}) {
             env: LOCAL_ENV,
             region: LOCAL_AWS_REGION,
             baseDomain: "localhost",
-            // monitoring is true: the local stack runs the same Loki/Tempo/
-            // Prometheus backends the hosted platform provides.
             services: { temporal: true, zitadel: true, monitoring: true },
         }),
         Description: `Environment registration (seeded by mesh CLI, local platform)`,
@@ -274,8 +199,6 @@ export async function seedLocalPlatform() {
             }
         }
     }
-    // Sample fixtures — PutObject overwrites, so reseeding a live stack is a
-    // no-op in effect and a fresh stack always has readable sample data.
     for (const seed of DATA_BUCKET_SEEDS) {
         await s3.send(new PutObjectCommand({
             Bucket: DATA_BUCKET,
@@ -288,4 +211,3 @@ export async function seedLocalPlatform() {
     await seedTemporalNamespace();
     return { parameter: APP_TENANTS_PARAM, bucket: ARTIFACTS_BUCKET };
 }
-//# sourceMappingURL=seed.js.map

package/dist/src/commands/local/stack.d.ts

@@ -1,60 +1,17 @@
-/**
- * Helpers for the `mesh start/stop/status` full-local platform stack.
- *
- * The docker compose project (name `mesh-local`) ships inside the CLI package
- * at `<package root>/stack/`, so the stack works in any repo with only Docker
- * installed and is version-locked to the CLI.
- */
 export declare const COMPOSE_PROJECT = "mesh-local";
-/**
- * Host directory `mesh dev --local` writes service logs into
- * ({namespace}/{service}.log). The stack's OTel collector tails it (filelog
- * receiver) and ships to Loki with the hosted k8s_* label scheme, so the
- * Hub's logs view works on local runs unchanged.
- */
 export declare function localLogsDir(): string;
-/**
- * Host directory holding blackbox probe targets (Prometheus file_sd JSON) —
- * written by `mesh dev --externals` for external services, mounted into the
- * stack's Prometheus. The local analog of the hosted Probe CRs.
- */
 export declare function localProbesDir(): string;
-/**
- * Register the app's OWN services as blackbox probe targets.
- *
- * Uptime in the Hub has three sources: blackbox probes, Kubernetes pod
- * readiness, and external-service probes. Locally the middle one cannot exist —
- * `mesh dev --local` runs services as host processes, not Deployments, so
- * kube-state-metrics has nothing to report — and nothing used to register the
- * host processes with blackbox either. The result was an app that is plainly
- * running and shows no uptime at all, which reads as a broken panel rather than
- * an unmonitored one.
- *
- * The labels match what `ExternalService` already emits (`tenant`/`env`/`app`),
- * because that is what the Hub's scoped discovery query selects on. `target` is
- * the service name, which is how the Hub names the row.
- *
- * Targets use `host.docker.internal` — Prometheus and blackbox run inside the
- * stack's network and reach host processes only through that name.
- *
- * Returns the file written, for the session to remove on `--kill`; a stale probe
- * would otherwise report a service down long after its session ended.
- */
 export declare function writeAppServiceProbes(args: {
     tenant: string;
     env: string;
     app: string;
-    /** Service name → host port. Mock stand-ins are the caller's to exclude. */
     services: Record<string, number>;
-    /** Health path every service exposes. */
     healthPath?: string;
 }): string | undefined;
-/** Endpoints the local stack exposes on the host. */
 export interface StackEndpoint {
     service: string;
     label: string;
     url: string;
-    /** How `mesh status` probes it from the host */
     probe: {
         kind: "http";
         url: string;
@@ -64,94 +21,26 @@ export interface StackEndpoint {
     } | {
         kind: "none";
     };
-    /** Extra hint printed under the endpoint (credentials, tokens, …) */
     hint?: string;
 }
 export declare const STACK_ENDPOINTS: StackEndpoint[];
-/** Default host port for the containerized local Hub. `mesh hub dev` derives
- * its dev-server default from this too (hub/index.ts), so the two Hubs share
- * one source for "9000" while keeping separate override variables
- * (MESH_HUB_PORT here, MESH_HUB_DEV_PORT there). */
 export declare const DEFAULT_HUB_PORT = "9000";
-/**
- * Host port the Hub is published on (docker-compose.hub.yml binds
- * `${MESH_HUB_PORT:-9000}:4180`). Override with MESH_HUB_PORT to run the
- * local Hub beside another process that owns 9000 — e.g. a hub-ui dev
- * server running from a different checkout. Export it for BOTH `mesh start`
- * and later `mesh status` calls: the compose file and these probes read the
- * same variable (MESH-2256 tracks deriving it from the running stack so
- * `mesh status` stops depending on shell hygiene). `mesh start` reconciles
- * the seeded Zitadel Hub app's redirect URIs to include the chosen port —
- * Zitadel requires every redirect URI to be registered even in devMode
- * (devMode only allows http).
- *
- * Empty string falls back like compose's `${MESH_HUB_PORT:-9000}` does —
- * `??` alone would diverge (probe `:`, publish 9000).
- */
 export declare function hubPort(): string;
-/** Hub overlay endpoints — probed only when the hub containers exist.
- * A function (not a module constant) so hubPort() is read at call time:
- * the CLI's env is fixed before node starts, but tests and programmatic
- * callers set MESH_HUB_PORT after import. */
 export declare function hubEndpoints(): StackEndpoint[];
-/**
- * Locate the CLI package root (the directory whose package.json is
- * @mesh-tech/mesh-cli). Works from both the compiled layout (dist/src/…)
- * and the source layout (src/… under tsx).
- */
 export declare function findPackageRoot(startDir?: string): string;
 export declare function stackDir(): string;
-/** The compose overlay that declares the Hub services. */
 export declare const HUB_OVERLAY_FILE = "docker-compose.hub.yml";
-/** Top-level service names a compose file declares. Pure — takes the file text. */
 export declare function parseComposeServiceNames(yamlText: string): string[];
-/**
- * The services the Hub overlay — and only the overlay — declares.
- *
- * Read from `docker-compose.hub.yml` rather than hard-coded beside
- * ONE_SHOT_SERVICES on purpose: a second name list rots the moment the
- * overlay gains or renames a service. (It already declares three — hub-api,
- * hub-ui, hub-auth — not the two the Hub is usually described by.)
- */
 export declare function hubOverlayServices(): ReadonlySet<string>;
-/**
- * The compose project is a MACHINE-WIDE singleton (`mesh-local`), but any
- * checkout of the CLI can drive it — and `docker compose up` from a checkout
- * whose stack config differs will recreate shared containers out from under
- * whatever else is running against the stack (a second project's `mesh dev`
- * session, a Hub built from another worktree, …).
- *
- * Returns the working dir of the checkout that last (re)created the running
- * stack when it is NOT this one; undefined when the stack isn't running or
- * is already owned here. Callers gate lifecycle commands on it.
- */
 export declare function stackOwnedElsewhere(): string | undefined;
-/** Throw a remediated error if the docker daemon isn't reachable. */
 export declare function ensureDockerAvailable(): void;
-/** Run `docker compose` against the packaged stack. `hub` adds the Hub
- * overlay file (safe for ps/logs/down: services simply may not exist);
- * `env` adds process-env overrides (e.g. MESH_HUB_VERSION). */
 export declare function compose(args: string[], opts?: {
     inherit?: boolean;
     hub?: boolean;
     env?: Record<string, string>;
 }): string;
-/**
- * Pick the one line worth reading out of a failed compose run's output:
- * the last error-looking line, else the last non-empty line (MESH-2479).
- * Pure so the selection heuristic is unit-testable.
- */
 export declare function summarizeComposeFailure(output: string): string;
-/** Where a lifecycle command's full compose output is written (per operation). */
 export declare function composeLogPath(op: string): string;
-/**
- * `docker compose` for lifecycle commands (`up -d`): stream output like
- * `compose({inherit: true})` does, but never bury the failure — on a non-zero
- * exit throw a one-line summary instead of leaving ~200 lines of pull/create
- * noise as the only signal (MESH-2479). In non-TTY runs the output is also
- * teed to a log file (named in the error) and a heartbeat fills long quiet
- * stretches; interactive terminals keep docker's own progress rendering.
- */
 export declare function composeStreamed(args: string[], opts?: {
     hub?: boolean;
     env?: Record<string, string>;
@@ -161,43 +50,13 @@ export interface ServiceStatus {
     state: string;
     health?: string;
 }
-/** Parse `docker compose ps --format json` (NDJSON, one object per line). */
 export declare function parseComposePs(output: string): ServiceStatus[];
 export declare function stackServices(): ServiceStatus[];
-/** Services expected to exit (one-shot jobs) — an `exited` state is fine. */
 export declare const ONE_SHOT_SERVICES: Set<string>;
-/**
- * The services whose `exited` state is a real failure *right now*.
- *
- * `stackServices()` scans the whole `mesh-local` compose project, overlay
- * included — but `mesh start` brings the base stack up first and the Hub
- * overlay only afterwards. Before that point an `exited` hub container is a
- * leftover from a previous run (a Docker restart, a laptop sleep), not a
- * crash: the base `up -d` deliberately never started it. Counting it made
- * `mesh start` abort before it ever tried to start the Hub, pointing at the
- * wrong thing.
- *
- * Once the overlay HAS been started, an exited overlay service is a crash
- * like any other — pass `overlayStarted: true` and the signal is preserved.
- */
 export declare function crashedServices(services: ServiceStatus[], opts: {
     overlayServices: ReadonlySet<string>;
     overlayStarted: boolean;
 }): ServiceStatus[];
-/**
- * Whether the Hub overlay is up in this run — i.e. at least one overlay
- * container is actually `running`. `mesh status` has no other way to know
- * (it never started anything), and "a container exists" is not it: a
- * leftover `exited` one exists too.
- */
 export declare function hubOverlayRunning(services: ServiceStatus[], overlayServices: ReadonlySet<string>): boolean;
-/**
- * Whether the Hub API is serving. `some(s => s.name === "hub-api")` is not
- * the same question — that is true of a leftover exited container, and
- * probing Hub endpoints that were never meant to be up this run reports the
- * stack unhealthy for a Hub nobody started.
- */
 export declare function hubApiRunning(services: ServiceStatus[]): boolean;
-/** Probe a host endpoint (http 2xx-4xx counts as up; tcp connect counts as up). */
 export declare function probeEndpoint(endpoint: StackEndpoint): Promise<boolean>;
-//# sourceMappingURL=stack.d.ts.map

package/dist/src/commands/local/stack.js

@@ -1,10 +1,3 @@
-/**
- * Helpers for the `mesh start/stop/status` full-local platform stack.
- *
- * The docker compose project (name `mesh-local`) ships inside the CLI package
- * at `<package root>/stack/`, so the stack works in any repo with only Docker
- * installed and is version-locked to the CLI.
- */
 import { execFileSync, spawn, spawnSync } from "child_process";
 import * as fs from "fs";
 import { probeTcp } from "./helpers.js";
@@ -15,44 +8,12 @@ import { meshCacheDir } from "../../utils/cache-home.js";
 import { MeshCliError } from "../../utils/errors.js";
 import { startHeartbeat } from "../../utils/log.js";
 export const COMPOSE_PROJECT = "mesh-local";
-/**
- * Host directory `mesh dev --local` writes service logs into
- * ({namespace}/{service}.log). The stack's OTel collector tails it (filelog
- * receiver) and ships to Loki with the hosted k8s_* label scheme, so the
- * Hub's logs view works on local runs unchanged.
- */
 export function localLogsDir() {
     return meshCacheDir("mesh-local", "logs");
 }
-/**
- * Host directory holding blackbox probe targets (Prometheus file_sd JSON) —
- * written by `mesh dev --externals` for external services, mounted into the
- * stack's Prometheus. The local analog of the hosted Probe CRs.
- */
 export function localProbesDir() {
     return meshCacheDir("mesh-local", "probes");
 }
-/**
- * Register the app's OWN services as blackbox probe targets.
- *
- * Uptime in the Hub has three sources: blackbox probes, Kubernetes pod
- * readiness, and external-service probes. Locally the middle one cannot exist —
- * `mesh dev --local` runs services as host processes, not Deployments, so
- * kube-state-metrics has nothing to report — and nothing used to register the
- * host processes with blackbox either. The result was an app that is plainly
- * running and shows no uptime at all, which reads as a broken panel rather than
- * an unmonitored one.
- *
- * The labels match what `ExternalService` already emits (`tenant`/`env`/`app`),
- * because that is what the Hub's scoped discovery query selects on. `target` is
- * the service name, which is how the Hub names the row.
- *
- * Targets use `host.docker.internal` — Prometheus and blackbox run inside the
- * stack's network and reach host processes only through that name.
- *
- * Returns the file written, for the session to remove on `--kill`; a stale probe
- * would otherwise report a service down long after its session ended.
- */
 export function writeAppServiceProbes(args) {
     const entries = Object.entries(args.services);
     if (entries.length === 0)
@@ -168,26 +129,7 @@ export const STACK_ENDPOINTS = [
         probe: { kind: "http", url: "http://localhost:9200" },
     },
 ];
-/** Default host port for the containerized local Hub. `mesh hub dev` derives
- * its dev-server default from this too (hub/index.ts), so the two Hubs share
- * one source for "9000" while keeping separate override variables
- * (MESH_HUB_PORT here, MESH_HUB_DEV_PORT there). */
 export const DEFAULT_HUB_PORT = "9000";
-/**
- * Host port the Hub is published on (docker-compose.hub.yml binds
- * `${MESH_HUB_PORT:-9000}:4180`). Override with MESH_HUB_PORT to run the
- * local Hub beside another process that owns 9000 — e.g. a hub-ui dev
- * server running from a different checkout. Export it for BOTH `mesh start`
- * and later `mesh status` calls: the compose file and these probes read the
- * same variable (MESH-2256 tracks deriving it from the running stack so
- * `mesh status` stops depending on shell hygiene). `mesh start` reconciles
- * the seeded Zitadel Hub app's redirect URIs to include the chosen port —
- * Zitadel requires every redirect URI to be registered even in devMode
- * (devMode only allows http).
- *
- * Empty string falls back like compose's `${MESH_HUB_PORT:-9000}` does —
- * `??` alone would diverge (probe `:`, publish 9000).
- */
 export function hubPort() {
     const raw = process.env.MESH_HUB_PORT?.trim();
     if (!raw)
@@ -199,10 +141,6 @@ export function hubPort() {
     }
     return raw;
 }
-/** Hub overlay endpoints — probed only when the hub containers exist.
- * A function (not a module constant) so hubPort() is read at call time:
- * the CLI's env is fixed before node starts, but tests and programmatic
- * callers set MESH_HUB_PORT after import. */
 export function hubEndpoints() {
     return [
         {
@@ -220,11 +158,6 @@ export function hubEndpoints() {
         },
     ];
 }
-/**
- * Locate the CLI package root (the directory whose package.json is
- * @mesh-tech/mesh-cli). Works from both the compiled layout (dist/src/…)
- * and the source layout (src/… under tsx).
- */
 export function findPackageRoot(startDir) {
     let dir = startDir ?? path.dirname(fileURLToPath(import.meta.url));
     for (let i = 0; i < 8; i++) {
@@ -236,7 +169,6 @@ export function findPackageRoot(startDir) {
                     return dir;
             }
             catch {
-                // unreadable package.json — keep walking
             }
         }
         const parent = path.dirname(dir);
@@ -257,22 +189,12 @@ export function stackDir() {
     }
     return dir;
 }
-/** The compose overlay that declares the Hub services. */
 export const HUB_OVERLAY_FILE = "docker-compose.hub.yml";
-/** Top-level service names a compose file declares. Pure — takes the file text. */
 export function parseComposeServiceNames(yamlText) {
     const doc = parseYaml(yamlText);
     return Object.keys(doc?.services ?? {});
 }
 let hubOverlayServicesCache;
-/**
- * The services the Hub overlay — and only the overlay — declares.
- *
- * Read from `docker-compose.hub.yml` rather than hard-coded beside
- * ONE_SHOT_SERVICES on purpose: a second name list rots the moment the
- * overlay gains or renames a service. (It already declares three — hub-api,
- * hub-ui, hub-auth — not the two the Hub is usually described by.)
- */
 export function hubOverlayServices() {
     if (!hubOverlayServicesCache) {
         const file = path.join(stackDir(), HUB_OVERLAY_FILE);
@@ -285,22 +207,7 @@ export function hubOverlayServices() {
     }
     return hubOverlayServicesCache;
 }
-/**
- * The compose project is a MACHINE-WIDE singleton (`mesh-local`), but any
- * checkout of the CLI can drive it — and `docker compose up` from a checkout
- * whose stack config differs will recreate shared containers out from under
- * whatever else is running against the stack (a second project's `mesh dev`
- * session, a Hub built from another worktree, …).
- *
- * Returns the working dir of the checkout that last (re)created the running
- * stack when it is NOT this one; undefined when the stack isn't running or
- * is already owned here. Callers gate lifecycle commands on it.
- */
 export function stackOwnedElsewhere() {
-    // Fail-open by design: a stack that exists but is NOT running (`ps -q`
-    // without -a) has nothing to disrupt, so `start` silently re-owns it; and
-    // any docker/inspect hiccup disables the guard rather than blocking
-    // legitimate lifecycle commands.
     try {
         const first = compose(["ps", "-q"]).trim().split("\n").filter(Boolean)[0];
         if (!first)
@@ -308,9 +215,6 @@ export function stackOwnedElsewhere() {
         const label = execFileSync("docker", ["inspect", first, "--format", '{{ index .Config.Labels "com.docker.compose.project.working_dir" }}'], { encoding: "utf-8" }).trim();
         if (!label)
             return undefined;
-        // realpath both sides: symlinked layouts (macOS /tmp → /private/tmp,
-        // linked worktree parents) must not make the same physical dir compare
-        // as foreign. Fall back to the raw path when realpath fails (dir gone).
         const real = (p) => {
             try {
                 return fs.realpathSync(p);
@@ -325,7 +229,6 @@ export function stackOwnedElsewhere() {
         return undefined;
     }
 }
-/** Throw a remediated error if the docker daemon isn't reachable. */
 export function ensureDockerAvailable() {
     const probe = spawnSync("docker", ["info", "--format", "{{.ServerVersion}}"], {
         stdio: ["ignore", "pipe", "pipe"],
@@ -336,9 +239,6 @@ export function ensureDockerAvailable() {
         });
     }
 }
-/** Run `docker compose` against the packaged stack. `hub` adds the Hub
- * overlay file (safe for ps/logs/down: services simply may not exist);
- * `env` adds process-env overrides (e.g. MESH_HUB_VERSION). */
 export function compose(args, opts = {}) {
     const dir = stackDir();
     const files = ["-f", path.join(dir, "docker-compose.yml")];
@@ -348,11 +248,6 @@ export function compose(args, opts = {}) {
     return execFileSync("docker", fullArgs, {
         cwd: dir,
         encoding: "utf-8",
-        // MESH_LOCAL_LOGS on every call: the compose file mounts it into the
-        // OTel collector, and an unset variable would both warn and resolve to
-        // a different mount (recreate churn between CLI and raw compose runs).
-        // IGNORE_ORPHANS: base-only `up` calls would otherwise flag the hub
-        // overlay's running containers as orphans.
         env: {
             ...process.env,
             MESH_LOCAL_LOGS: localLogsDir(),
@@ -363,11 +258,6 @@ export function compose(args, opts = {}) {
         stdio: opts.inherit ? ["ignore", "inherit", "inherit"] : ["ignore", "pipe", "pipe"],
     });
 }
-/**
- * Pick the one line worth reading out of a failed compose run's output:
- * the last error-looking line, else the last non-empty line (MESH-2479).
- * Pure so the selection heuristic is unit-testable.
- */
 export function summarizeComposeFailure(output) {
     const lines = output
         .split("\n")
@@ -377,19 +267,10 @@ export function summarizeComposeFailure(output) {
     const line = errorish.at(-1) ?? lines.at(-1) ?? "no output captured";
     return line.length > 300 ? `${line.slice(0, 297)}…` : line;
 }
-/** Where a lifecycle command's full compose output is written (per operation). */
 export function composeLogPath(op) {
     const dir = meshCacheDir("mesh-local");
     return path.join(dir, `compose-${op.replace(/[^a-z0-9-]/gi, "_")}.log`);
 }
-/**
- * `docker compose` for lifecycle commands (`up -d`): stream output like
- * `compose({inherit: true})` does, but never bury the failure — on a non-zero
- * exit throw a one-line summary instead of leaving ~200 lines of pull/create
- * noise as the only signal (MESH-2479). In non-TTY runs the output is also
- * teed to a log file (named in the error) and a heartbeat fills long quiet
- * stretches; interactive terminals keep docker's own progress rendering.
- */
 export async function composeStreamed(args, opts = {}) {
     const dir = stackDir();
     const files = ["-f", path.join(dir, "docker-compose.yml")];
@@ -446,8 +327,6 @@ export async function composeStreamed(args, opts = {}) {
     }
     finally {
         heartbeat.stop();
-        // Flush the log file before any throw can reach handleCliError's
-        // process.exit(), which doesn't wait for pending writes.
         await new Promise((resolve) => logStream.end(resolve));
     }
     if (exitCode !== 0) {
@@ -459,7 +338,6 @@ export async function composeStreamed(args, opts = {}) {
         });
     }
 }
-/** Parse `docker compose ps --format json` (NDJSON, one object per line). */
 export function parseComposePs(output) {
     const services = [];
     for (const line of output.split("\n")) {
@@ -475,55 +353,25 @@ export function parseComposePs(output) {
             });
         }
         catch {
-            // non-JSON noise from docker — skip
         }
     }
     return services;
 }
 export function stackServices() {
-    // Include the hub overlay so its containers show up when running.
     return parseComposePs(compose(["ps", "-a", "--format", "json"], { hub: true }));
 }
-/** Services expected to exit (one-shot jobs) — an `exited` state is fine. */
 export const ONE_SHOT_SERVICES = new Set(["spicedb-migrate", "zitadel-machinekey-init"]);
-/**
- * The services whose `exited` state is a real failure *right now*.
- *
- * `stackServices()` scans the whole `mesh-local` compose project, overlay
- * included — but `mesh start` brings the base stack up first and the Hub
- * overlay only afterwards. Before that point an `exited` hub container is a
- * leftover from a previous run (a Docker restart, a laptop sleep), not a
- * crash: the base `up -d` deliberately never started it. Counting it made
- * `mesh start` abort before it ever tried to start the Hub, pointing at the
- * wrong thing.
- *
- * Once the overlay HAS been started, an exited overlay service is a crash
- * like any other — pass `overlayStarted: true` and the signal is preserved.
- */
 export function crashedServices(services, opts) {
     return services.filter((s) => s.state === "exited" &&
         !ONE_SHOT_SERVICES.has(s.name) &&
         (opts.overlayStarted || !opts.overlayServices.has(s.name)));
 }
-/**
- * Whether the Hub overlay is up in this run — i.e. at least one overlay
- * container is actually `running`. `mesh status` has no other way to know
- * (it never started anything), and "a container exists" is not it: a
- * leftover `exited` one exists too.
- */
 export function hubOverlayRunning(services, overlayServices) {
     return services.some((s) => overlayServices.has(s.name) && s.state === "running");
 }
-/**
- * Whether the Hub API is serving. `some(s => s.name === "hub-api")` is not
- * the same question — that is true of a leftover exited container, and
- * probing Hub endpoints that were never meant to be up this run reports the
- * stack unhealthy for a Hub nobody started.
- */
 export function hubApiRunning(services) {
     return services.some((s) => s.name === "hub-api" && s.state === "running");
 }
-/** Probe a host endpoint (http 2xx-4xx counts as up; tcp connect counts as up). */
 export async function probeEndpoint(endpoint) {
     if (endpoint.probe.kind === "http") {
         try {
@@ -539,4 +387,3 @@ export async function probeEndpoint(endpoint) {
     }
     return true;
 }
-//# sourceMappingURL=stack.js.map