@mesh-tech/mesh-cli 0.20.2 → 0.20.3

package/dist/src/commands/stack.js

@@ -1,14 +1,3 @@
-/**
- * mesh stack — Manage personal Pulumi stacks.
- *
- * mesh stack init             Create a personal dev stack (dev-{github-user})
- * mesh stack init --from uat  Base on a different stack
- *
- * Creates Pulumi.<stack>.yaml with:
- *   - mesh:deploy: false (skip K8s deployments — dev-only stack)
- *   - mesh:deployerRole copied from the base stack
- *   - aws:region copied from the base stack
- */
 import { execFileSync } from "child_process";
 import * as path from "path";
 import * as fs from "fs";
@@ -17,29 +6,17 @@ import { logError, logInfo, logSuccess, logWarn } from "../utils/log.js";
 import { findAppRoot, findStackConfigs, getCurrentStack, readStackConfig } from "../utils/pulumi.js";
 import { resolveWorktreeIdentity, worktreeStackName } from "../utils/worktree-identity.js";
 import { resolvePulumiEnv } from "../utils/pulumi-run.js";
-// =============================================================================
-// Helpers
-// =============================================================================
-/**
- * Read a top-level key from Pulumi.<stack>.yaml (not under `config:`).
- * Used for `secretsprovider` and `encryptedkey` which live at the root level.
- */
 function readTopLevelYamlKey(appRoot, stack, key) {
     const configFile = path.join(appRoot, `Pulumi.${stack}.yaml`);
     if (!fs.existsSync(configFile))
         return null;
     const content = fs.readFileSync(configFile, "utf-8");
-    // Match top-level key (no leading whitespace, unlike config values which are indented)
     const pattern = new RegExp(`^${key}:\\s*(.+)$`, "m");
     const match = content.match(pattern);
     if (!match)
         return null;
     return match[1].trim().replace(/^["']|["']$/g, "");
 }
-/**
- * Read a key's scalar value from the `config:` block of Pulumi.<stack>.yaml
- * (e.g. `mesh:tenant`). Indented two spaces under `config:`.
- */
 function readConfigBlockKey(appRoot, stack, key) {
     const configFile = path.join(appRoot, `Pulumi.${stack}.yaml`);
     if (!fs.existsSync(configFile))
@@ -51,19 +28,7 @@ function readConfigBlockKey(appRoot, stack, key) {
         return null;
     return match[1].trim().replace(/^["']|["']$/g, "");
 }
-/**
- * Personal-platform DNS preflight: verify the parent zone's PUBLIC delegation.
- *
- * The env zone ({env}.{parentZone}) is created and NS-delegated inside
- * Route53 by the platform deploy — but the chain only resolves publicly if
- * the parent zone itself is delegated at the DNS host above it (e.g. the 4
- * NS records for `sandbox` in the Cloudflare meshtech.io zone). Without it,
- * hostnames don't resolve and ACM certs sit in PENDING_VALIDATION forever.
- * This check names the exact records to add instead of leaving that failure
- * to be discovered from a "not secure / unreachable" browser error.
- */
 async function checkParentZoneDelegation(parentZone, awsEnv) {
-    // What the internet sees
     let publicNs = [];
     try {
         const { Resolver } = await import("node:dns/promises");
@@ -72,10 +37,7 @@ async function checkParentZoneDelegation(parentZone, awsEnv) {
         publicNs = (await resolver.resolveNs(parentZone)).map((n) => n.replace(/\.$/, "").toLowerCase());
     }
     catch {
-        // NXDOMAIN / no NS — treated as "no public delegation"
     }
-    // What Route53 says the zone's nameservers ARE (so the warning can print
-    // the exact records to add). Best-effort: skip silently without creds.
     let zoneNs = [];
     try {
         const { Route53Client, ListHostedZonesByNameCommand, GetHostedZoneCommand } = await import("@aws-sdk/client-route-53");
@@ -100,7 +62,6 @@ async function checkParentZoneDelegation(parentZone, awsEnv) {
         }
     }
     catch {
-        /* creds unavailable or lookup failed — fall through with what we have */
     }
     if (publicNs.length === 0) {
         const records = zoneNs.length > 0
@@ -121,13 +82,6 @@ async function checkParentZoneDelegation(parentZone, awsEnv) {
         logSuccess(`Parent zone delegation OK: ${parentZone} resolves publicly.`);
     }
 }
-/**
- * Read the `config:` block from `Pulumi.<stack>.yaml` on disk, in the same shape
- * `pulumi config --json` returns. This is the fallback when the base stack hasn't
- * been initialized in the backend yet (a freshly-generated app): `pulumi config
- * --json --stack <base>` fails, but the config we need still lives in the file.
- * Without this, `mesh stack init` silently drops region/tenant/platform/deployerRole.
- */
 function readBaseConfigFromYaml(appRoot, stack) {
     const file = path.join(appRoot, `Pulumi.${stack}.yaml`);
     if (!fs.existsSync(file))
@@ -149,11 +103,7 @@ function readBaseConfigFromYaml(appRoot, stack) {
     }
     return out;
 }
-/**
- * Get GitHub username from gh CLI, falling back to git config.
- */
 function getGitHubUsername() {
-    // Try gh CLI first
     try {
         const result = execFileSync("gh", ["api", "user", "--jq", ".login"], {
             encoding: "utf-8",
@@ -164,15 +114,12 @@ function getGitHubUsername() {
             return login;
     }
     catch { }
-    // Fallback: git config
     try {
         const result = execFileSync("git", ["config", "user.email"], {
             encoding: "utf-8",
             stdio: ["pipe", "pipe", "pipe"],
         });
         const email = result.trim();
-        // Extract username from GitHub email patterns
-        // e.g., user@users.noreply.github.com or user@example.com
         const match = email.match(/^(\d+\+)?([^@]+)@/);
         if (match)
             return match[2];
@@ -180,12 +127,6 @@ function getGitHubUsername() {
     catch { }
     return null;
 }
-/**
- * Find Pulumi.<stack>.yaml files in the app root.
- */
-// =============================================================================
-// Command
-// =============================================================================
 export function registerStackCommand(program) {
     const stack = program
         .command("stack")
@@ -198,21 +139,19 @@ export function registerStackCommand(program) {
         .option("--adopt", "resume an EXISTING stack with this name (skips the availability check)", false)
         .option("--worktree", "Isolate this stack per git worktree — append the worktree token to the name so concurrent worktrees deploy to distinct stacks (no SSM/namespace collisions)")
         .option("--platform", "Personal PLATFORM stack: a fully isolated platform env (Zitadel, Hub, Temporal, tenant envs) on the SHARED core — sets mesh:coreEnv to the base env, mesh:clusterOwner false, disables org-wide singletons (package registry, VPN), and keeps deploy ON. Run from a platform Pulumi program.", false)
-        .option("--parent-zone <zone>", "With --platform: parent DNS zone for the env zone (mesh:dns.public.parentZone) — platform hostnames become {sub}.{env}.{parentZone} (e.g. hub.dmb-dev.mesh.meshtech.io), so personal stacks never collide on DNS")
+        .option("--parent-zone <zone>", "With --platform: parent DNS zone for the env zone (mesh:dns.public.parentZone) — platform hostnames become {sub}.{env}.{parentZone} (e.g. hub.<env>.<parentZone>), so personal stacks never collide on DNS")
         .action(async (opts) => {
         const appRoot = findAppRoot(process.cwd());
         if (!appRoot) {
             logError("No Pulumi.yaml found. Run from within a Pulumi app directory.");
             process.exit(1);
         }
-        // Get GitHub username
         const username = getGitHubUsername();
         if (!username) {
             logError("Could not determine GitHub username.\n" +
                 "Install gh CLI (https://cli.github.com) and run: gh auth login");
             process.exit(1);
         }
-        // Determine base stack
         let baseStack = opts.from;
         if (!baseStack) {
             const stacks = findStackConfigs(appRoot);
@@ -232,22 +171,11 @@ export function registerStackCommand(program) {
                 process.exit(1);
             }
         }
-        // Verify base config exists
         const baseConfigPath = `${appRoot}/Pulumi.${baseStack}.yaml`;
         if (!fs.existsSync(baseConfigPath)) {
             logError(`Stack config not found: Pulumi.${baseStack}.yaml`);
             process.exit(1);
         }
-        // Determine new stack name. --worktree appends this worktree's token so
-        // concurrent worktrees deploy to distinct stacks: the SSM export paths
-        // (apps/{app}/stacks/{stack}/...), Temporal namespace ({tenant}-{stack}-
-        // {app}), and Nexus endpoint name all derive from the stack name, so ONE
-        // discriminator isolates all three. The primary checkout has an empty
-        // token, so --worktree is a no-op there (it IS the canonical stack).
-        // Platform stacks follow {tenant}-{env} (parseEnvFromStack derives the
-        // env by stripping the tenant prefix), so the personal env is
-        // {username}-dev → stack {tenant}-{username}-dev. App stacks keep the
-        // dev-{username} convention.
         const baseTenant = readConfigBlockKey(appRoot, baseStack, "mesh:tenant");
         if (opts.platform && !baseTenant) {
             logError(`--platform: could not read mesh:tenant from Pulumi.${baseStack}.yaml — is this a platform program?`);
@@ -268,24 +196,10 @@ export function registerStackCommand(program) {
         }
         const newConfigPath = path.join(appRoot, `Pulumi.${newStack}.yaml`);
         const configExists = fs.existsSync(newConfigPath);
-        // Detect KMS secrets provider from base stack config.
-        // After migration, stacks have a top-level `secretsprovider:` key in their
-        // Pulumi.<stack>.yaml with the KMS URI. Use it for new stacks so they
-        // automatically use KMS instead of passphrase encryption.
         const secretsProvider = readTopLevelYamlKey(appRoot, baseStack, "secretsprovider");
-        // Login preflight + deployer creds for the Pulumi backend (MESH-2085):
-        // stack init/select/config all hit the S3 state backend and need the
-        // deployer role. Resolve it ONCE from the base stack (the new stack has no
-        // config yet) — and get a clear "run mesh login --device" instead of a raw
-        // NoCredentialProviders — then reuse the env across every pulumi call below.
         const credEnv = await resolvePulumiEnv({ appRoot, stack: baseStack });
         const pulumiEnv = { ...process.env, ...credEnv };
         delete pulumiEnv.AWS_PROFILE;
-        // Determinism: a personal stack NAME must be available. The backend is
-        // shared, so an existing stack with this name belongs to someone (maybe
-        // you, maybe not) — creating "into" it silently adopts their state.
-        // Check first and fail with a clear remediation; --adopt is the
-        // explicit escape hatch for resuming a stack you know is yours.
         if (!opts.adopt) {
             let existing = [];
             try {
@@ -298,7 +212,6 @@ export function registerStackCommand(program) {
                 existing = JSON.parse(raw).map((s) => s.name);
             }
             catch {
-                // Backend unreachable — pulumi stack init below gives the real error.
             }
             if (existing.includes(newStack) || configExists) {
                 logError(`Personal stack name '${newStack}' is not available` +
@@ -309,7 +222,6 @@ export function registerStackCommand(program) {
                 process.exit(1);
             }
         }
-        // Initialize the Pulumi stack
         const initArgs = ["stack", "init", newStack];
         if (secretsProvider) {
             initArgs.push("--secrets-provider", secretsProvider);
@@ -335,7 +247,6 @@ export function registerStackCommand(program) {
                 process.exit(err.status ?? 1);
             }
         }
-        // Select the new stack
         try {
             execFileSync("pulumi", ["stack", "select", newStack], {
                 cwd: appRoot,
@@ -344,32 +255,24 @@ export function registerStackCommand(program) {
             });
         }
         catch { }
-        // Copy config from base stack + add mesh:deploy false
         if (!configExists) {
-            // Read base stack config as JSON
             let baseConfig = {};
             try {
                 const raw = execFileSync("pulumi", ["config", "--json", "--stack", baseStack], { cwd: appRoot, env: pulumiEnv, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
                 baseConfig = JSON.parse(raw);
             }
             catch {
-                // The base stack isn't initialized in the backend (common for a freshly
-                // generated app) — read its config straight from Pulumi.<base>.yaml instead
-                // of dropping it. (Previously this fell through with an empty config, leaving
-                // the new stack missing region/tenant/platform/deployerRole — MESH-2096.)
                 baseConfig = readBaseConfigFromYaml(appRoot, baseStack);
                 if (Object.keys(baseConfig).length === 0) {
                     logWarn(`Could not read base config from the backend or Pulumi.${baseStack}.yaml — ` +
                         `the new stack will need manual config.`);
                 }
             }
-            // Copy all config keys except mesh:deploy (we'll set that explicitly)
             for (const [key, entry] of Object.entries(baseConfig)) {
                 if (key === "mesh:deploy")
                     continue;
                 try {
                     if (entry.objectValue !== undefined) {
-                        // Structured value — set as JSON (Pulumi parses it back to object)
                         execFileSync("pulumi", ["config", "set", key, JSON.stringify(entry.objectValue)], { cwd: appRoot, env: pulumiEnv, stdio: ["pipe", "pipe", "pipe"] });
                     }
                     else if (entry.value === "true" || entry.value === "false") {
@@ -382,9 +285,6 @@ export function registerStackCommand(program) {
                 catch { }
             }
             if (opts.platform) {
-                // Personal PLATFORM stack: an isolated platform env on the shared
-                // core. Everything below the platform layer is reused (cluster,
-                // VPC, VPN, RDS); everything above it is this env's own.
                 const baseEnv = readConfigBlockKey(appRoot, baseStack, "mesh:coreEnv") ??
                     (baseTenant && baseStack.startsWith(`${baseTenant}-`)
                         ? baseStack.slice(baseTenant.length + 1)
@@ -401,21 +301,11 @@ export function registerStackCommand(program) {
                 };
                 setCfg(["mesh:coreEnv", baseEnv]);
                 setCfg(["--type", "bool", "mesh:clusterOwner", "false"]);
-                // Org-wide singletons stay with the primary platform: one package
-                // registry per org, and the personal env reuses the shared VPN.
                 setCfg(["--type", "bool", "mesh:packageRegistry", "false"]);
                 setCfg(["--type", "bool", "mesh:headscale", "false"]);
                 setCfg(["--type", "bool", "mesh:subnetRouter", "false"]);
                 setCfg(["--type", "bool", "mesh:devbox", "false"]);
-                // A personal platform env owns its whole DNS zone — hostname
-                // suffixing (subdomain-{stage}) exists to avoid collisions inside a
-                // SHARED zone and just makes URLs ugly here. Stable URLs by default.
                 setCfg(["--type", "bool", "mesh:stableUrl", "true"]);
-                // Tenant Pulumi-state bucket names are org-global by convention
-                // ({hubTenant}-tenant-{name}-pulumi-state, no env segment) and
-                // WILL collide with the primary platform's buckets. Scope each
-                // copied tenant's bucket to this env via the documented
-                // pulumiStateBucket override.
                 try {
                     const tenantsRaw = readConfigBlockKey(appRoot, newStack, "mesh:tenants");
                     if (tenantsRaw) {
@@ -434,11 +324,6 @@ export function registerStackCommand(program) {
                 catch {
                     logWarn("Could not env-scope tenant pulumiStateBucket overrides — check mesh:tenants by hand (bucket names collide across envs otherwise).");
                 }
-                // Env-zone DNS: hostnames derive from {env}.{parentZone} so this
-                // stack can never collide with another env's hosts.
-                // waitForValidation false → the deploy never blocks on ACM while the
-                // parent zone's public delegation is still propagating; the cert
-                // issues automatically once it lands.
                 if (opts.parentZone) {
                     setCfg([
                         "mesh:dns",
@@ -456,7 +341,6 @@ export function registerStackCommand(program) {
                 logSuccess(`Configured Pulumi.${newStack}.yaml (personal platform env on core '${baseEnv}'${opts.parentZone ? `, DNS zone ${newStack.startsWith(`${baseTenant}-`) ? newStack.slice(baseTenant.length + 1) : newStack}.${opts.parentZone}` : ""})`);
             }
             else {
-                // Set mesh:deploy to false — personal APP stacks skip K8s deployments
                 execFileSync("pulumi", ["config", "set", "--type", "bool", "mesh:deploy", "false"], {
                     cwd: appRoot,
                     env: pulumiEnv,
@@ -467,10 +351,6 @@ export function registerStackCommand(program) {
         }
         console.log("");
         logInfo(opts.platform ? `Your personal platform stack is ready.` : `Your personal stack is ready.`);
-        // Qualify with --stack/--stage: right after init the deployer role isn't
-        // assumed yet, so `pulumi stack --show-name` can't resolve the selected
-        // stack and a bare `mesh deploy up` errors "Could not determine stack"
-        // (MESH-2097). The explicit name is copy-paste correct.
         logInfo(`Run:  mesh deploy up --stack ${newStack} --yes`);
         logInfo(opts.platform
             ? `Then point app stacks at it: mesh:platformEnv ${newStack.startsWith(`${baseTenant}-`) ? newStack.slice(baseTenant.length + 1) : newStack}`
@@ -486,12 +366,6 @@ export function registerStackCommand(program) {
             logError("No Pulumi.yaml found. Run from within a Pulumi app directory.");
             process.exit(1);
         }
-        // Credentialed via the shared chokepoint (MESH-2085) — the login preflight
-        // + deployer role, so `pulumi stack rm` reaches the S3 backend instead of
-        // NoCredentialProviders. Prefer the TARGET stack's role; but a half-created
-        // stack, or one created in another worktree, may have no local config here
-        // (exactly the stacks you most want to rm), so fall back to any OTHER local
-        // stack that carries a deployerRole — personal dev stacks share an account.
         const credStack = readStackConfig(appRoot, name, "mesh:deployerRole")
             ? name
             : [getCurrentStack(appRoot), "dev", ...findStackConfigs(appRoot)].find((s) => !!s && s !== name && !!readStackConfig(appRoot, s, "mesh:deployerRole")) ?? name;
@@ -510,4 +384,3 @@ export function registerStackCommand(program) {
         }
     });
 }
-//# sourceMappingURL=stack.js.map

package/dist/src/commands/temporal.d.ts

@@ -1,33 +1,4 @@
-/**
- * mesh temporal — inspect Temporal workflows for the current app/stack.
- *
- * Commands:
- *   mesh temporal describe <workflowId> [runId]   Show workflow status and metadata
- *   mesh temporal history <workflowId> [runId]    Show workflow event history
- *
- * Connection info is resolved from the app's Pulumi stack output (same as mesh dev).
- * Uses the raw gRPC API so we can render events without a codec proxy; when
- * `--show-payloads` is set we resolve the app's `TEMPORAL_ENCODING_KEY` from
- * its Kubernetes secret and decrypt inline via the shared codec helper.
- */
 import { Command } from "commander";
-/**
- * Open a raw Temporal client connection for this app's stack, with the Zitadel
- * Bearer attached when the server enforces auth.
- *
- * Exported (`@mesh-tech/mesh-cli/temporal`) for CLIs built beside this one, such as mesh-studio's
- * `studio workspace`, which reads and signals the workspace environment
- * entity over the same connection and the same auth resolution — one spelling of
- * "how the CLI reaches this app's Temporal", not two.
- *
- * @example
- * const { connection, namespace } = await connect({ stack: "dev-trabianmatt" });
- * try {
- *   // …use `connection` with @temporalio/client…
- * } finally {
- *   connection.close();
- * }
- */
 export declare function connect(options: {
     stack?: string;
     address?: string;
@@ -37,4 +8,3 @@ export declare function connect(options: {
     namespace: string;
 }>;
 export declare function registerTemporalCommands(program: Command): void;
-//# sourceMappingURL=temporal.d.ts.map