@mesh-tech/mesh-cli 0.20.2 → 0.20.3

package/dist/src/commands/peer-addressing.d.ts

@@ -1,25 +1,5 @@
-/**
- * How peers address each other inside a `mesh dev` session (MESH-2597).
- *
- * `mesh dev` allocates local ports and rewrites `localhost:<oldPort>` references
- * across every service's env, which handles the PORT half of the question. The
- * HOST half was never handled: an env var derived from a `link()` renders as
- * `http://<svc>.<ns>.svc.cluster.local:8080`, and that survived untouched even
- * when the service it names was one of the ones just started on this laptop.
- *
- * Observed 2026-08-01: after a relaunch, `studio-ui` held
- * `AGENT_API_INTERNAL_URL=http://studio-api.fub-dev-studio.svc.cluster.local:8080`
- * while `studio-api` was running locally on :40161. The UI's proxy dialled the
- * cluster from the laptop, every request failed `getaddrinfo ENOTFOUND`, and the
- * whole app returned `502 upstream unavailable`.
- *
- * Its own module rather than more of `dev.ts` (already ~3.7k lines) so the
- * rewriting rule is testable without importing the launch path.
- */
-/** The subset of a dev service this module reads. */
 export interface AddressableService {
     port: number;
-    /** Empty for a DEPLOYED service — it is not running here. */
     command?: string[];
     env?: Record<string, {
         value: string;
@@ -28,24 +8,5 @@ export interface AddressableService {
 export interface AddressableOutput {
     services?: Record<string, AddressableService>;
 }
-/**
- * `http(s)://<name>.<namespace>.svc.cluster.local[:port]`.
- *
- * Anchored on the full service name so `studio-api` cannot match
- * `studio-api-worker`, and the name is escaped because it reaches this as data.
- */
 export declare function clusterHostPattern(serviceName: string): RegExp;
-/**
- * Point every reference to a LOCALLY-RUN service at its local port.
- *
- * Only services this session actually runs are rewritten. A deployed-only service
- * (no dev command) keeps its cluster address, because reaching that is the
- * tunnels' job, not this one's — rewriting it would break the one case that
- * currently works.
- *
- * The namespace is matched rather than resolved: the session already knows which
- * services it started and on which ports, and re-deriving the namespace here
- * would be a second source of truth for something the URL already carries.
- */
 export declare function rewriteClusterHostsToLocal(devOutput: AddressableOutput): void;
-//# sourceMappingURL=peer-addressing.d.ts.map

package/dist/src/commands/peer-addressing.js

@@ -1,43 +1,7 @@
-/**
- * How peers address each other inside a `mesh dev` session (MESH-2597).
- *
- * `mesh dev` allocates local ports and rewrites `localhost:<oldPort>` references
- * across every service's env, which handles the PORT half of the question. The
- * HOST half was never handled: an env var derived from a `link()` renders as
- * `http://<svc>.<ns>.svc.cluster.local:8080`, and that survived untouched even
- * when the service it names was one of the ones just started on this laptop.
- *
- * Observed 2026-08-01: after a relaunch, `studio-ui` held
- * `AGENT_API_INTERNAL_URL=http://studio-api.fub-dev-studio.svc.cluster.local:8080`
- * while `studio-api` was running locally on :40161. The UI's proxy dialled the
- * cluster from the laptop, every request failed `getaddrinfo ENOTFOUND`, and the
- * whole app returned `502 upstream unavailable`.
- *
- * Its own module rather than more of `dev.ts` (already ~3.7k lines) so the
- * rewriting rule is testable without importing the launch path.
- */
-/**
- * `http(s)://<name>.<namespace>.svc.cluster.local[:port]`.
- *
- * Anchored on the full service name so `studio-api` cannot match
- * `studio-api-worker`, and the name is escaped because it reaches this as data.
- */
 export function clusterHostPattern(serviceName) {
     const name = serviceName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     return new RegExp(`https?://${name}\\.[a-z0-9-]+\\.svc\\.cluster\\.local(?::\\d+)?`, "g");
 }
-/**
- * Point every reference to a LOCALLY-RUN service at its local port.
- *
- * Only services this session actually runs are rewritten. A deployed-only service
- * (no dev command) keeps its cluster address, because reaching that is the
- * tunnels' job, not this one's — rewriting it would break the one case that
- * currently works.
- *
- * The namespace is matched rather than resolved: the session already knows which
- * services it started and on which ports, and re-deriving the namespace here
- * would be a second source of truth for something the URL already carries.
- */
 export function rewriteClusterHostsToLocal(devOutput) {
     const localPorts = new Map();
     for (const [name, service] of Object.entries(devOutput.services ?? {})) {
@@ -61,4 +25,3 @@ export function rewriteClusterHostsToLocal(devOutput) {
         }
     }
 }
-//# sourceMappingURL=peer-addressing.js.map

package/dist/src/commands/port-ownership.d.ts

@@ -1,26 +1,6 @@
-/**
- * Who holds a port, and whether `mesh dev` may take it back (MESH-2590).
- *
- * The failure this exists to prevent: a service process outlives the tmux pane
- * that supervised it, keeps listening, and the next launch either dies on
- * `EADDRINUSE` or silently drifts to another port while the orphan keeps serving
- * an earlier boot's configuration. Observed three times — the `:4200` Enlight dev
- * server with no tmux owner, the 2026-07-29 detached bridge worker that won a
- * dispatch and executed it against the wrong filesystem, and the 2026-07-31
- * `studio-api` death on `:40161` where the Studio UI then drove a stale API and
- * showed an empty conversation list.
- *
- * The decision is deliberately split from the process inspection: `decidePortHolder`
- * is pure and unit-tested, `describePortHolder` does the `lsof`/`ps` work. Reclaiming
- * kills a process, so the rule errs toward refusing — an unidentifiable owner is
- * never killed, and neither is one belonging to a session that is still alive.
- */
-/** A process listening on a port, with enough identity to adjudicate it. */
 export interface PortHolder {
     pid: number;
-    /** Executable name from `ps -o comm=`, or "unknown". */
     command: string;
-    /** Working directory from lsof, or null when it could not be resolved. */
     cwd: string | null;
 }
 export type PortDecision = {
@@ -34,36 +14,12 @@ export type PortDecision = {
     holder: PortHolder;
     reason: string;
 };
-/**
- * Decide what to do about whatever holds a port.
- *
- * Reclaim exactly one case: an **orphan from this same worktree** — a process
- * whose cwd is inside the worktree root and which belongs to no live session.
- * That is the shape every observed incident had, and it is the only shape where
- * killing is unambiguously correct.
- *
- * Everything else refuses, including the cases that look tempting:
- *   - owner unidentifiable → killing blind is worse than moving ports;
- *   - held by a live session → the user has a running `mesh dev`, and silently
- *     killing its service would turn one confusing session into two;
- *   - foreign cwd → not ours to take.
- */
 export declare function decidePortHolder(holder: PortHolder | null, worktreeRoot: string, livePids: ReadonlySet<number>): PortDecision;
-/** True when `child` is `root` or lives beneath it. */
 export declare function isInside(child: string, root: string): boolean;
-/** Identify the process listening on `port`; null when nothing holds it. */
 export declare function describePortHolder(port: number): PortHolder | null;
-/** `lsof -a -p <pid> -d cwd -Fn` prints `p<pid>`, `fcwd`, then `n<path>`. */
 export declare function parseLsofCwd(out: string): string | null;
-/**
- * Terminate a reclaimed holder and wait for the port to actually clear. SIGTERM
- * first so the process can shut down its own listeners; SIGKILL only if it is
- * still holding on. Returns true once nothing is listening.
- */
 export declare function reclaimPort(port: number, holder: PortHolder, opts: {
     timeoutMs?: number;
     isPortFree: (port: number) => Promise<boolean>;
-    /** Injectable so tests never signal a real process. */
     kill?: (pid: number, signal: NodeJS.Signals) => void;
 }): Promise<boolean>;
-//# sourceMappingURL=port-ownership.d.ts.map

package/dist/src/commands/port-ownership.js

@@ -1,37 +1,6 @@
-/**
- * Who holds a port, and whether `mesh dev` may take it back (MESH-2590).
- *
- * The failure this exists to prevent: a service process outlives the tmux pane
- * that supervised it, keeps listening, and the next launch either dies on
- * `EADDRINUSE` or silently drifts to another port while the orphan keeps serving
- * an earlier boot's configuration. Observed three times — the `:4200` Enlight dev
- * server with no tmux owner, the 2026-07-29 detached bridge worker that won a
- * dispatch and executed it against the wrong filesystem, and the 2026-07-31
- * `studio-api` death on `:40161` where the Studio UI then drove a stale API and
- * showed an empty conversation list.
- *
- * The decision is deliberately split from the process inspection: `decidePortHolder`
- * is pure and unit-tested, `describePortHolder` does the `lsof`/`ps` work. Reclaiming
- * kills a process, so the rule errs toward refusing — an unidentifiable owner is
- * never killed, and neither is one belonging to a session that is still alive.
- */
 import { execFileSync } from 'node:child_process';
 import * as path from 'node:path';
 import { assertSignalablePid } from '../utils/pid.js';
-/**
- * Decide what to do about whatever holds a port.
- *
- * Reclaim exactly one case: an **orphan from this same worktree** — a process
- * whose cwd is inside the worktree root and which belongs to no live session.
- * That is the shape every observed incident had, and it is the only shape where
- * killing is unambiguously correct.
- *
- * Everything else refuses, including the cases that look tempting:
- *   - owner unidentifiable → killing blind is worse than moving ports;
- *   - held by a live session → the user has a running `mesh dev`, and silently
- *     killing its service would turn one confusing session into two;
- *   - foreign cwd → not ours to take.
- */
 export function decidePortHolder(holder, worktreeRoot, livePids) {
     if (holder === null)
         return { action: 'free' };
@@ -62,13 +31,11 @@ export function decidePortHolder(holder, worktreeRoot, livePids) {
         reason: 'orphaned service from an earlier boot of this worktree',
     };
 }
-/** True when `child` is `root` or lives beneath it. */
 export function isInside(child, root) {
     const c = path.resolve(child);
     const r = path.resolve(root);
     return c === r || c.startsWith(r + path.sep);
 }
-/** Identify the process listening on `port`; null when nothing holds it. */
 export function describePortHolder(port) {
     const pid = firstListenerPid(port);
     if (pid === null)
@@ -86,7 +53,6 @@ function firstListenerPid(port) {
         return Number.isInteger(pid) && pid > 0 ? pid : null;
     }
     catch {
-        // lsof exits non-zero when nothing matches, which is the common case.
         return null;
     }
 }
@@ -102,7 +68,6 @@ function processCommand(pid) {
         return 'unknown';
     }
 }
-/** `lsof -a -p <pid> -d cwd -Fn` prints `p<pid>`, `fcwd`, then `n<path>`. */
 export function parseLsofCwd(out) {
     for (const line of out.trim().split('\n')) {
         if (line.startsWith('n'))
@@ -122,16 +87,7 @@ function processCwd(pid) {
         return null;
     }
 }
-/**
- * Terminate a reclaimed holder and wait for the port to actually clear. SIGTERM
- * first so the process can shut down its own listeners; SIGKILL only if it is
- * still holding on. Returns true once nothing is listening.
- */
 export async function reclaimPort(port, holder, opts) {
-    // `holder.pid` came out of `lsof`, so it is recovered input exactly like the
-    // pids read back from `tunnel-state.json` / `daemon.json` — see the header of
-    // `utils/pid.ts` for what an unguarded one costs. No `file:` remediation here:
-    // there is no state file to delete, the value is re-derived every run.
     assertSignalablePid(holder.pid, { what: `the process holding port ${port}` });
     const kill = opts.kill ?? ((pid, signal) => process.kill(pid, signal));
     const deadline = Date.now() + (opts.timeoutMs ?? 5_000);
@@ -139,7 +95,6 @@ export async function reclaimPort(port, holder, opts) {
         kill(holder.pid, 'SIGTERM');
     }
     catch {
-        // Already gone; fall through to the freeness poll.
     }
     let escalated = false;
     while (Date.now() < deadline) {
@@ -151,11 +106,9 @@ export async function reclaimPort(port, holder, opts) {
                 kill(holder.pid, 'SIGKILL');
             }
             catch {
-                /* raced with exit */
             }
         }
         await new Promise((r) => setTimeout(r, 150));
     }
     return opts.isPortFree(port);
 }
-//# sourceMappingURL=port-ownership.js.map

package/dist/src/commands/registry-publish.d.ts

@@ -1,3 +1,2 @@
 import type { Command } from "commander";
 export declare function registerRegistryPublish(registry: Command): void;
-//# sourceMappingURL=registry-publish.d.ts.map

package/dist/src/commands/registry-publish.js

@@ -1,24 +1,3 @@
-/**
- * `mesh registry publish --snapshot` — publish an in-development *snapshot* of the
- * @mesh-tech/* packages to CodeArtifact under a `dev` dist-tag.
- *
- * Why: a consumer repo outside the monorepo (e.g. fub-mesh-apps) can't use
- * `workspace:*`, and cutting a real release for every SDK/UI tweak is heavy. A
- * snapshot publishes the CURRENT source at a throwaway prerelease version
- * (`0.0.0-dev.<stamp>.<sha>`). Because it's a `0.0.0` prerelease, a consumer's
- * `^`/`~` ranges NEVER auto-resolve it — it's picked up ONLY by an explicit pin
- * or the `dev` dist-tag. That's the "pushed to the registry but explicitly
- * referenced" contract.
- *
- * Real releases still go through changesets + the changeset-version CI workflow;
- * this command is dev-loop tooling only and never touches the `latest` dist-tag.
- *
- * Mechanism: set the snapshot version into each selected publishable package.json,
- * reuse the proven scripts/publish-packages.sh (which runs build:publish — whose
- * build-for-publish.ts rewrites internal workspace:* deps to the local version,
- * i.e. the snapshot — then publishes each package), always restore the source
- * package.json versions afterward.
- */
 import { execFileSync, execSync } from "child_process";
 import * as fs from "fs";
 import * as path from "path";
@@ -27,24 +6,16 @@ import { resolveCredentials, codeartifactLogin } from "./registry.js";
 function repoRoot() {
     return execSync("git rev-parse --show-toplevel", { encoding: "utf-8" }).trim();
 }
-/** `0.0.0-dev.<YYYYMMDDHHMMSS>.<shortsha>` — a valid semver prerelease. */
 function computeSnapshotVersion(root) {
     const sha = execSync("git rev-parse --short HEAD", { cwd: root, encoding: "utf-8" }).trim();
     const stamp = new Date().toISOString().replace(/[-:T]/g, "").slice(0, 14);
     return `0.0.0-dev.${stamp}.${sha}`;
 }
-/** Rewrite the top-level "version" field, preserving the file's formatting. */
 function setPackageVersion(file, version) {
     const content = fs.readFileSync(file, "utf-8");
     const next = content.replace(/"version"(\s*:\s*)"[^"]*"/, `"version"$1"${version}"`);
     fs.writeFileSync(file, next);
 }
-/**
- * Tracked package.json files with uncommitted modifications (`git diff`), as a set
- * of repo-relative paths. Used to tell the user's OWN pre-existing edits apart from
- * files `build:publish` dirties as a side effect (it re-vendors e.g. hub subpackages),
- * so cleanup reverts only the latter.
- */
 function dirtyPackageJsons(root) {
     const out = execSync("git diff --name-only", { cwd: root, encoding: "utf-8" });
     return new Set(out.split("\n").map((s) => s.trim()).filter((s) => s.endsWith("package.json")));
@@ -67,7 +38,6 @@ export function registerRegistryPublish(registry) {
             process.exit(1);
         }
         const root = repoRoot();
-        // 1. CodeArtifact auth (token + scoped registry written to ~/.npmrc).
         const awsCreds = resolveCredentials(context, opts.role);
         const env = Object.keys(awsCreds).length > 0
             ? { ...process.env, ...awsCreds }
@@ -77,7 +47,6 @@ export function registerRegistryPublish(registry) {
             logError("CodeArtifact login failed. Run: mesh registry login <context>");
             process.exit(1);
         }
-        // 2. Resolve the publishable set (optionally filtered by --only).
         const listPath = path.join(root, "scripts/lib/publishable-packages.json");
         const all = JSON.parse(fs.readFileSync(listPath, "utf-8"));
         const patterns = (opts.only ?? "")
@@ -91,15 +60,9 @@ export function registerRegistryPublish(registry) {
             logError(`No publishable package matched --only '${opts.only}'`);
             process.exit(1);
         }
-        // 3. Snapshot version — uniform across the selected set so their internal
-        //    @mesh-tech deps rewrite to the same version.
         const version = computeSnapshotVersion(root);
         logInfo(`Snapshot version: ${version} (dist-tag '${opts.tag}')`);
-        // Snapshot the user's PRE-EXISTING dirty package.json set, so the cleanup in
-        // `finally` reverts only what this run (and build:publish) touched, never their edits.
         const preDirty = dirtyPackageJsons(root);
-        // 4. Stamp the version onto each selected package (+ its sub-packages),
-        //    remembering the originals so we can always restore.
         const backups = [];
         const stamp = (dir) => {
             const file = path.join(root, dir, "package.json");
@@ -115,15 +78,11 @@ export function registerRegistryPublish(registry) {
                     stamp(path.join(p.dir, typeof sub === "string" ? sub : sub.dir));
                 }
             }
-            // 5. Build + publish via the proven script (dev tag, never `latest`).
             const args = [
                 "scripts/publish-packages.sh",
                 "--tag",
                 opts.tag,
                 "--skip-latest",
-                // Pass the TS-resolved DIRS (not the raw patterns) so the shell's
-                // dir-substring --only filter selects exactly the set we stamped —
-                // a name-only pattern would otherwise stamp here but be skipped there.
                 ...(patterns.length ? ["--only", selected.map((p) => p.dir).join(",")] : []),
                 ...(opts.dryRun ? ["--dry-run"] : []),
             ];
@@ -134,9 +93,6 @@ export function registerRegistryPublish(registry) {
             for (const b of backups)
                 fs.writeFileSync(b.file, b.content);
             logInfo("Restored source package.json versions.");
-            // build:publish re-vendors some package.json files (e.g. hub subpackages)
-            // beyond the ones we stamped — revert those too so a local run leaves a clean
-            // tree, but NEVER the user's own pre-existing edits.
             const collateral = [...dirtyPackageJsons(root)].filter((f) => !preDirty.has(f));
             if (collateral.length) {
                 try {
@@ -148,7 +104,6 @@ export function registerRegistryPublish(registry) {
                 }
             }
         }
-        // 6. Tell the user exactly how to consume it.
         logSuccess(`Published snapshot ${version} under dist-tag '${opts.tag}'.`);
         console.log("\nPin these EXACTLY in the consumer repo (prereleases are never auto-resolved by ^/~):");
         for (const p of selected)
@@ -158,4 +113,3 @@ export function registerRegistryPublish(registry) {
             .join(" ")}`);
     });
 }
-//# sourceMappingURL=registry-publish.js.map