@mesh-tech/mesh-cli 0.20.2 → 0.20.3

package/dist/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "851f45a2f",
-  "builtAt": "2026-09-11T15:03:38.397Z"
+  "commit": "9a0cb46af",
+  "builtAt": "2026-09-11T20:41:37.913Z"
 }

package/dist/src/commands/agent-api-client.d.ts

@@ -1,11 +1,3 @@
-/**
- * Shared agent-api client: resolves a `--target`/`--api-url`/`--context`
- * triple (via the `@mesh-tech/agent-targets` registry) to a concrete
- * `AgentApiTarget`, and fetches agent-api paths against it with auth.
- *
- * Consumed by `mesh artifacts get` today; later `mesh conversations`
- * commands share the same resolution + fetch path.
- */
 export interface AgentApiTarget {
     apiBaseUrl: string;
     loginContext?: string;
@@ -15,82 +7,20 @@ export interface AgentApiTarget {
 }
 export declare class TargetResolutionError extends Error {
 }
-/**
- * Precedence:
- *  1. --api-url (+ --context, default "mesh.dev") — highest.
- *  2. --target explicitly given → registry: loaded+found wins, loaded+missing
- *     throws (unknown target), invalid throws (with the registry's parse
- *     error), absent throws ("no registry" guidance).
- *  3. neither given → loaded registry's defaultTarget; otherwise (registry
- *     absent/invalid) falls back to AGENT_API_URL/API_URL/localhost:8787 —
- *     this path NEVER throws (backward compat with the old no-flag behavior).
- */
 export declare function resolveTarget(opts: {
     target?: string;
     apiUrl?: string;
     context?: string;
 }): AgentApiTarget;
-/**
- * Fetch an agent-api path on the resolved target, with auth. Caller checks
- * status.
- *
- * `redirect: "manual"` is deliberate: an unauthenticated `/v1` call against a
- * deployed agent 302s to Zitadel. With the default `redirect: "follow"`,
- * fetch follows it and returns a `200` HTML login page — `describeHttpError`'s
- * auth branch never fires and the caller sees a raw JSON-parse error instead
- * of auth guidance. With `"manual"`, the redirect surfaces as a Response with
- * `type: "opaqueredirect"` (status 0), which `describeHttpError` already maps
- * to the "auth did not reach the agent" message.
- */
 export declare function agentApiFetch(target: AgentApiTarget, apiPath: string): Promise<Response>;
 export interface AgentApiSendInit {
     method: "POST" | "PUT" | "PATCH" | "DELETE";
-    /** JSON body — sets `content-type: application/json`. Mutually exclusive with `body`. */
     json?: unknown;
-    /** Raw body, for uploads that are not JSON. */
     body?: Uint8Array | string;
     contentType?: string;
 }
-/**
- * Like {@link agentApiFetch}, but with a method and a body — the write half.
- *
- * Shares `authHeaders` and `redirect: "manual"` with the read path for the same
- * reasons documented there; the redirect handling matters MORE here, because a
- * write that silently followed a 302 to Zitadel would report the login page's
- * 200 as a successful publish.
- */
 export declare function agentApiSend(target: AgentApiTarget, apiPath: string, init: AgentApiSendInit): Promise<Response>;
-/**
- * Turn a thrown fetch error into local-vs-remote-aware guidance. A bare
- * `ECONNREFUSED`/`fetch failed` (also `ENOTFOUND`/`EAI_AGAIN`) means
- * something different depending on the target: against a LOCAL apiBaseUrl it
- * almost always means the local `mesh dev` agent API isn't running; against
- * a REMOTE one it means a down host, a DNS typo, a dropped VPN/tailscale
- * connection, or (occasionally) an auth redirect that the fetch layer
- * couldn't follow. Only actual network throws get this treatment — every
- * other error (including ones `describeHttpError` already produced) passes
- * through unchanged so callers can log it without double guidance.
- */
 export declare function describeNetworkError(err: unknown, target: AgentApiTarget): string;
-/**
- * Shared, target-aware renderer for a non-ok agent-api response. Used by
- * both `mesh conversations` (list/show/artifacts) and `mesh artifacts get`
- * so there is exactly one place that turns an HTTP failure into human
- * guidance — no more dev-oriented "restart the API process" advice, no more
- * a second parallel renderer for `show`'s 503 special-case.
- *
- * `ctx.id` (a conversation id, when the caller has one) enables the
- * `mesh temporal recover-conversation <id>` hint on a `conversation_unavailable`
- * 503 and is echoed in the 404 message for context.
- *
- * Response shapes are verified against
- * `packages/agent-sdk/src/agent-api/server.ts` — do not re-infer:
- *  - 404 → `{ error: "conversation not found", conversationId }`.
- *  - 503 conversation_unavailable → `{ error: "conversation_unavailable",
- *    conversationId, detail: "<text>" }` — human text is under `detail`,
- *    NOT `message`.
- */
 export declare function describeHttpError(res: Response, target: AgentApiTarget, ctx?: {
     id?: string;
 }): Promise<string>;
-//# sourceMappingURL=agent-api-client.d.ts.map

package/dist/src/commands/agent-api-client.js

@@ -1,31 +1,11 @@
-/**
- * Shared agent-api client: resolves a `--target`/`--api-url`/`--context`
- * triple (via the `@mesh-tech/agent-targets` registry) to a concrete
- * `AgentApiTarget`, and fetches agent-api paths against it with auth.
- *
- * Consumed by `mesh artifacts get` today; later `mesh conversations`
- * commands share the same resolution + fetch path.
- */
 import { loadTargetsFile, stripSlash } from "@mesh-tech/agent-targets";
 import { getValidToken } from "./login.js";
 import { logWarn } from "../utils/log.js";
 const DEFAULT_AUTH_CONTEXT = "mesh.dev";
-/** Matches a local (`mesh dev`-hosted) apiBaseUrl — shared by `authHeaders`'s
- * dev-identity fallback and `describeNetworkError`'s local/remote gating. */
 const LOCAL_URL_RE = /^https?:\/\/(localhost|127\.0\.0\.1|\[::1\])(:|\/|$)/i;
 export class TargetResolutionError extends Error {
 }
 const NO_REGISTRY_GUIDANCE = "no registry — add `mesh agent-targets add <name>` or pass --api-url";
-/**
- * Precedence:
- *  1. --api-url (+ --context, default "mesh.dev") — highest.
- *  2. --target explicitly given → registry: loaded+found wins, loaded+missing
- *     throws (unknown target), invalid throws (with the registry's parse
- *     error), absent throws ("no registry" guidance).
- *  3. neither given → loaded registry's defaultTarget; otherwise (registry
- *     absent/invalid) falls back to AGENT_API_URL/API_URL/localhost:8787 —
- *     this path NEVER throws (backward compat with the old no-flag behavior).
- */
 export function resolveTarget(opts) {
     if (opts.apiUrl) {
         return { apiBaseUrl: stripSlash(opts.apiUrl), loginContext: opts.context || DEFAULT_AUTH_CONTEXT };
@@ -52,7 +32,6 @@ export function resolveTarget(opts) {
         };
     }
     if (res.status === "loaded") {
-        // RegistrySchema's refine() guarantees defaultTarget names an existing entry.
         const entry = res.targets[res.defaultTarget];
         return {
             apiBaseUrl: entry.apiBaseUrl,
@@ -63,13 +42,8 @@ export function resolveTarget(opts) {
         };
     }
     if (res.status === "invalid") {
-        // Neither --target nor --api-url given, so this is the implicit/no-flag
-        // path — warn (don't throw) so a broken registry file doesn't silently
-        // swallow itself while the CLI quietly falls back to env/localhost.
         logWarn(`Agent-targets registry at ${res.path} is invalid: ${res.message}. Falling back to env/localhost.`);
     }
-    // No target/api-url given and no usable registry: preserve the old
-    // `mesh artifacts get` no-flag behavior — never throw here.
     const fallbackUrl = process.env.AGENT_API_URL || process.env.API_URL || "http://localhost:8787";
     return { apiBaseUrl: stripSlash(fallbackUrl), loginContext: opts.context || DEFAULT_AUTH_CONTEXT };
 }
@@ -84,30 +58,10 @@ async function authHeaders(target) {
         return { "X-Forwarded-User": "dev-user", "X-Forwarded-Email": "dev@localhost" };
     throw new TargetResolutionError(`No valid credentials for context "${ctx}". Run: mesh login ${ctx}`);
 }
-/**
- * Fetch an agent-api path on the resolved target, with auth. Caller checks
- * status.
- *
- * `redirect: "manual"` is deliberate: an unauthenticated `/v1` call against a
- * deployed agent 302s to Zitadel. With the default `redirect: "follow"`,
- * fetch follows it and returns a `200` HTML login page — `describeHttpError`'s
- * auth branch never fires and the caller sees a raw JSON-parse error instead
- * of auth guidance. With `"manual"`, the redirect surfaces as a Response with
- * `type: "opaqueredirect"` (status 0), which `describeHttpError` already maps
- * to the "auth did not reach the agent" message.
- */
 export async function agentApiFetch(target, apiPath) {
     const headers = await authHeaders(target);
     return fetch(`${target.apiBaseUrl}${apiPath}`, { headers, redirect: "manual" });
 }
-/**
- * Like {@link agentApiFetch}, but with a method and a body — the write half.
- *
- * Shares `authHeaders` and `redirect: "manual"` with the read path for the same
- * reasons documented there; the redirect handling matters MORE here, because a
- * write that silently followed a 302 to Zitadel would report the login page's
- * 200 as a successful publish.
- */
 export async function agentApiSend(target, apiPath, init) {
     const headers = await authHeaders(target);
     const body = init.json !== undefined ? JSON.stringify(init.json) : init.body;
@@ -115,25 +69,11 @@ export async function agentApiSend(target, apiPath, init) {
     return fetch(`${target.apiBaseUrl}${apiPath}`, {
         method: init.method,
         headers: { ...headers, ...(body === undefined ? {} : { "content-type": contentType }) },
-        // `as never` rather than `as BodyInit`: this package's lib config does not
-        // pull in DOM types, so the global name is unavailable even though Node's
-        // fetch accepts exactly these shapes at runtime.
         ...(body === undefined ? {} : { body: body }),
         redirect: "manual",
     });
 }
 const NETWORK_ERROR_PATTERN = /ECONNREFUSED|fetch failed|ENOTFOUND|EAI_AGAIN/;
-/**
- * Turn a thrown fetch error into local-vs-remote-aware guidance. A bare
- * `ECONNREFUSED`/`fetch failed` (also `ENOTFOUND`/`EAI_AGAIN`) means
- * something different depending on the target: against a LOCAL apiBaseUrl it
- * almost always means the local `mesh dev` agent API isn't running; against
- * a REMOTE one it means a down host, a DNS typo, a dropped VPN/tailscale
- * connection, or (occasionally) an auth redirect that the fetch layer
- * couldn't follow. Only actual network throws get this treatment — every
- * other error (including ones `describeHttpError` already produced) passes
- * through unchanged so callers can log it without double guidance.
- */
 export function describeNetworkError(err, target) {
     const message = err instanceof Error ? err.message : String(err);
     if (!NETWORK_ERROR_PATTERN.test(message))
@@ -145,24 +85,6 @@ export function describeNetworkError(err, target) {
     return (`Couldn't reach ${target.apiBaseUrl} — check the URL/VPN/tailscale, ` +
         `or \`mesh login ${loginContext}\` if it's an auth redirect.`);
 }
-/**
- * Shared, target-aware renderer for a non-ok agent-api response. Used by
- * both `mesh conversations` (list/show/artifacts) and `mesh artifacts get`
- * so there is exactly one place that turns an HTTP failure into human
- * guidance — no more dev-oriented "restart the API process" advice, no more
- * a second parallel renderer for `show`'s 503 special-case.
- *
- * `ctx.id` (a conversation id, when the caller has one) enables the
- * `mesh temporal recover-conversation <id>` hint on a `conversation_unavailable`
- * 503 and is echoed in the 404 message for context.
- *
- * Response shapes are verified against
- * `packages/agent-sdk/src/agent-api/server.ts` — do not re-infer:
- *  - 404 → `{ error: "conversation not found", conversationId }`.
- *  - 503 conversation_unavailable → `{ error: "conversation_unavailable",
- *    conversationId, detail: "<text>" }` — human text is under `detail`,
- *    NOT `message`.
- */
 export async function describeHttpError(res, target, ctx) {
     const isRedirect = res.redirected || res.type === "opaqueredirect" || res.status === 302;
     if (res.status === 401 || res.status === 403 || isRedirect) {
@@ -184,9 +106,7 @@ export async function describeHttpError(res, target, ctx) {
             }
         }
         catch {
-            // Not JSON, or not the shape we expect — fall through to the generic message.
         }
     }
     return `agent-api error ${res.status}: ${bodyText || res.statusText} (${target.apiBaseUrl})`;
 }
-//# sourceMappingURL=agent-api-client.js.map

package/dist/src/commands/app-check.d.ts

@@ -1,97 +1,41 @@
-/**
- * `mesh app check` — the Mesh app contract, enforced.
- *
- * Scans a tenant-apps checkout and reports every mechanical violation of the
- * contract in `@mesh-tech/app-kit`'s `apps` skill
- * (`skills/apps/references/app-contract.md`): a browser UI served from inside
- * the API process, an app that never registers with the Hub, app-written
- * browser sessions where the platform auth proxy belongs, logging that
- * bypasses `@mesh-tech/logger`, and an app whose people, roles or keys the
- * Hub cannot see. `mesh create-app` runs it on every scaffold, tenant CI runs
- * it beside `mesh skills sync --check`, and the platform reviewer runs the
- * same command — one detector, one exit code.
- *
- * Three layers, like `mesh dev doctor`:
- *   1. Pure scanners (`scanApp`, `scanRepo`) — filesystem in, `Finding[]` out.
- *   2. One `Check` per contract code, on the dev-doctor engine (`runChecks`).
- *   3. The command: resolves the repo root, picks the apps, renders, exits.
- *
- * The patterns are deliberately shape-based: `apps/<app>/index.ts` (the Pulumi
- * program) is the contract's single point of truth, and a service directory is
- * a UI if its name says so. A hit is a fact to READ, not a verdict — the ruling
- * detail and every gate's owning primitive live in the contract reference.
- *
- * @example
- * ```bash
- * mesh app check                        # every apps/* in this repo
- * mesh app check apps/funding-portal    # one app
- * mesh app check --json                 # stable shape for CI
- * ```
- */
 import { Command } from "commander";
 import { jsonReport, type Check, type CheckResult, type CheckStatus } from "./dev-doctor.js";
-/** Every code the contract defines. The contract reference lists the same set; a test keeps them equal. */
 export type AppCheckCode = "UI_IN_API" | "NO_UI_SERVICE" | "NO_REGISTER" | "CUSTOM_SESSION_AUTH" | "NON_PLATFORM_LOGGER" | "LOCAL_AUTH_LIB" | "NO_AUTHZ_POINTER" | "METADATA_UNPUBLISHED" | "IAC_GRANTS" | "POINTER_PROJECT_OVERRIDE" | "PASSWORD_STORE" | "EMAIL_ALLOWLIST" | "USERS_TABLE";
 export interface AppCheckRule {
-    /** Contract gate the code enforces (`0.1` … `0.5`, `H`). */
     gate: string;
-    /** Human label, present tense. */
     title: string;
-    /** `block` exits 1; `advisory` reports and exits 0. */
     severity: "block" | "advisory";
-    /** The concrete replacement — what the author writes instead. */
     remediation: string;
-    /** `repo` rules scan the checkout once; `app` rules run per app. */
     scope: "app" | "repo";
 }
 export declare const APP_CHECK_RULES: Record<AppCheckCode, AppCheckRule>;
 export declare const APP_CHECK_CODES: AppCheckCode[];
-/** One mechanical hit. `path` is repo-relative (`apps/x/api/src/y.ts[:line]`). */
 export interface Finding {
     code: AppCheckCode;
     path: string;
     why: string;
 }
-/** Source files worth scanning: TS/JS minus tests, fixtures, generated output, tooling and dependencies. */
 export declare function srcFiles(dir: string): string[];
-/** A service directory whose NAME says "browser UI". */
 export declare function isUiDir(name: string): boolean;
-/** Apps in a checkout: every `apps/<name>` with a Pulumi program, or the root when it is itself an app. */
 export declare function listApps(root: string): string[];
-/**
- * Every app-scoped finding for one app (`appRel` is repo-relative). An app
- * directory with no Pulumi program yields nothing — it is not an app.
- */
 export declare function scanApp(root: string, appRel: string): Finding[];
-/** Repo-scoped findings: a tenant-local auth library that may duplicate `@mesh-tech/authn` (advisory). */
 export declare function scanRepo(root: string): Finding[];
-/** What every app-contract `Check` reads: the findings for ONE scope (an app, or the repo). */
 export interface AppCheckContext {
     root: string;
-    /** Repo-relative app dir, or `null` for the repo-scoped checks. */
     app: string | null;
     findings: Finding[];
 }
-/** Turn a rule + its findings into the doctor-engine result shape. */
 export declare function resultFor(code: AppCheckCode, findings: Finding[]): CheckResult;
-/** The `Check`s for one scope: every app-scoped rule for an app, every repo-scoped rule for the repo. */
 export declare function appContractChecks(scope: "app" | "repo"): Check<AppCheckContext>[];
 export interface AppCheckReport {
     root: string;
     status: CheckStatus;
-    /** Per-app reports, in `listApps` order; the repo-scoped checks ride under `"(repo)"`. */
     scopes: Array<{
         scope: string;
     } & ReturnType<typeof jsonReport>>;
 }
-/**
- * Run the contract over a checkout. `apps` narrows the run to the named
- * repo-relative app dirs (an unknown dir is an error, not a silent pass).
- */
 export declare function runAppCheck(root: string, apps?: string[]): Promise<AppCheckReport>;
-/** Human rendering: a header per scope, the doctor lines under it, failures only unless `verbose`. */
 export declare function renderReport(report: AppCheckReport, opts: {
     verbose: boolean;
 }): string;
 export declare function registerAppCommands(program: Command): void;
-//# sourceMappingURL=app-check.d.ts.map

package/dist/src/commands/app-check.js

@@ -1,33 +1,3 @@
-/**
- * `mesh app check` — the Mesh app contract, enforced.
- *
- * Scans a tenant-apps checkout and reports every mechanical violation of the
- * contract in `@mesh-tech/app-kit`'s `apps` skill
- * (`skills/apps/references/app-contract.md`): a browser UI served from inside
- * the API process, an app that never registers with the Hub, app-written
- * browser sessions where the platform auth proxy belongs, logging that
- * bypasses `@mesh-tech/logger`, and an app whose people, roles or keys the
- * Hub cannot see. `mesh create-app` runs it on every scaffold, tenant CI runs
- * it beside `mesh skills sync --check`, and the platform reviewer runs the
- * same command — one detector, one exit code.
- *
- * Three layers, like `mesh dev doctor`:
- *   1. Pure scanners (`scanApp`, `scanRepo`) — filesystem in, `Finding[]` out.
- *   2. One `Check` per contract code, on the dev-doctor engine (`runChecks`).
- *   3. The command: resolves the repo root, picks the apps, renders, exits.
- *
- * The patterns are deliberately shape-based: `apps/<app>/index.ts` (the Pulumi
- * program) is the contract's single point of truth, and a service directory is
- * a UI if its name says so. A hit is a fact to READ, not a verdict — the ruling
- * detail and every gate's owning primitive live in the contract reference.
- *
- * @example
- * ```bash
- * mesh app check                        # every apps/* in this repo
- * mesh app check apps/funding-portal    # one app
- * mesh app check --json                 # stable shape for CI
- * ```
- */
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { logError, logInfo } from "../utils/index.js";
@@ -128,12 +98,8 @@ export const APP_CHECK_RULES = {
     },
 };
 export const APP_CHECK_CODES = Object.keys(APP_CHECK_RULES);
-// ============================================================================
-// Filesystem helpers (pure over a root)
-// ============================================================================
 const SRC_EXT = new Set([".ts", ".tsx", ".js", ".mjs", ".jsx"]);
 const SKIP_DIRS = new Set(["node_modules", "dist", "build", ".generated", "test", "tests", "__tests__", "fixtures", "scripts"]);
-/** Directories under an app that are not services (docs, tooling, dev mocks, migrations). */
 const NON_SERVICE_DIRS = new Set([
     "docs",
     "scripts",
@@ -167,7 +133,6 @@ function readText(p) {
         return "";
     }
 }
-/** Source files worth scanning: TS/JS minus tests, fixtures, generated output, tooling and dependencies. */
 export function srcFiles(dir) {
     const out = [];
     const walk = (d) => {
@@ -198,15 +163,12 @@ export function srcFiles(dir) {
     walk(dir);
     return out.sort();
 }
-/** A `test-*` / `*-test` directory is a test harness (a browser fixture, a smoke client), not a deployed service. */
 function isTestHarness(name) {
     return name.startsWith("test-") || name.endsWith("-test");
 }
-/** A service directory whose NAME says "browser UI". */
 export function isUiDir(name) {
     return ["ui", "web", "frontend", "client", "portal-ui", "app"].includes(name) || name.endsWith("-ui");
 }
-/** Service directories of an app: every child dir that is not docs/tooling. */
 function serviceDirs(app) {
     let entries;
     try {
@@ -220,11 +182,6 @@ function serviceDirs(app) {
         .map((e) => path.join(app, e.name))
         .sort();
 }
-/**
- * Grep-like scan of an app for the authorization gate: every `.ts/.tsx/.yaml/.sql`
- * outside dependencies, build output and tests, with comment lines dropped —
- * a comment is not a surface. Returns `path:line` + the line for each match.
- */
 function authzSurface(app) {
     const hits = [];
     const walk = (d) => {
@@ -258,9 +215,6 @@ function authzSurface(app) {
     walk(app);
     return hits;
 }
-// ============================================================================
-// Scanners
-// ============================================================================
 const RE_HTML = /from ["']hono\/(html|jsx)["']|react-dom\/server|\bc\.html\(|<!doctype html|<!DOCTYPE html/;
 const RE_OIDC = /openid-client|code_verifier|authorization_code|buildAuthorizeUrl|end_session/;
 const RE_COOKIE = /setCookie\(|hono\/cookie|Set-Cookie/;
@@ -269,15 +223,10 @@ const RE_EXPOSURE = /ZitadelAppIdentity|createOAuthMiddleware|createAuthorizatio
 const RE_POINTER = /AppAuthzPointer/;
 const RE_METADATA = /compileOpsHubMetadata|ops-hub-metadata|SpiceDBSchema/;
 const RE_IAC_GRANT = /userId: *"[0-9]{6,}"/;
-// The pointer's `zitadel` override exists for the Hub, whose AppEnvironment is
-// built before its identity. An app binds its project through AppEnvironment
-// (`zitadelAppProjectId`), which has no `zitadel: { projectId` literal — so the
-// literal on a program line is the override, whichever line of the call it sits on.
 const RE_POINTER_OVERRIDE = /\bzitadel: *\{\s*projectId\b/;
 const RE_PASSWORD = /(^|[^a-z])(bcrypt|argon2)|password_hash|passwordHash|hashPassword|temporaryPassword.*(send|mail)|(send|mail).*temporaryPassword/;
 const RE_ALLOWLIST = /ADMIN_EMAILS|ALLOWED_EMAILS|allowedEmails|adminEmails/;
 const RE_USERS_TABLE = /create table (if not exists )?"?(users|roles|user_roles|permissions)"?/i;
-/** Apps in a checkout: every `apps/<name>` with a Pulumi program, or the root when it is itself an app. */
 export function listApps(root) {
     const apps = [];
     const appsDir = path.join(root, "apps");
@@ -294,10 +243,6 @@ export function listApps(root) {
         apps.push(".");
     return apps;
 }
-/**
- * Every app-scoped finding for one app (`appRel` is repo-relative). An app
- * directory with no Pulumi program yields nothing — it is not an app.
- */
 export function scanApp(root, appRel) {
     const app = path.resolve(root, appRel);
     const index = path.join(app, "index.ts");
@@ -308,7 +253,6 @@ export function scanApp(root, appRel) {
     const hasProgram = fs.existsSync(index) || fs.existsSync(path.join(app, "Pulumi.yaml"));
     if (!hasProgram)
         return findings;
-    // ── Check 0 (contract gates 0.1–0.4) need the Pulumi program ─────────────
     if (fs.existsSync(index)) {
         const indexRel = rel(root, index);
         let servesHtml = false;
@@ -355,7 +299,6 @@ export function scanApp(root, appRel) {
             }
         }
     }
-    // ── Check H (authorization gate) ─────────────────────────────────────────
     const surface = authzSurface(app);
     const first = (re) => surface.find((h) => re.test(h.text));
     const exposure = first(RE_EXPOSURE);
@@ -381,7 +324,6 @@ export function scanApp(root, appRel) {
     anti("USERS_TABLE", RE_USERS_TABLE, "hand-rolled users/roles table — people and roles live in Zitadel and are administered from the Hub");
     return findings;
 }
-/** True when `dir/package.json` names a `@mesh-tech/*` package (a checkout of the platform itself). */
 function isPlatformPackage(dir) {
     try {
         const pkg = JSON.parse(readText(path.join(dir, "package.json")));
@@ -391,7 +333,6 @@ function isPlatformPackage(dir) {
         return false;
     }
 }
-/** Repo-scoped findings: a tenant-local auth library that may duplicate `@mesh-tech/authn` (advisory). */
 export function scanRepo(root) {
     const findings = [];
     for (const parent of ["libs", "packages"]) {
@@ -402,8 +343,6 @@ export function scanRepo(root) {
             if (!e.isDirectory() || !e.name.includes("auth"))
                 continue;
             const lib = path.join(dir, e.name);
-            // The platform's own packages (`@mesh-tech/authn`, `@mesh-tech/authz`) are the
-            // canon, not a tenant-local copy of it — the rule is about duplicates.
             if (isPlatformPackage(lib))
                 continue;
             const verifies = srcFiles(lib)
@@ -420,7 +359,6 @@ export function scanRepo(root) {
     }
     return findings;
 }
-/** Turn a rule + its findings into the doctor-engine result shape. */
 export function resultFor(code, findings) {
     const rule = APP_CHECK_RULES[code];
     const mine = findings.filter((f) => f.code === code);
@@ -433,7 +371,6 @@ export function resultFor(code, findings) {
         remediation: rule.remediation,
     };
 }
-/** The `Check`s for one scope: every app-scoped rule for an app, every repo-scoped rule for the repo. */
 export function appContractChecks(scope) {
     return APP_CHECK_CODES.filter((code) => APP_CHECK_RULES[code].scope === scope).map((code) => ({
         id: code,
@@ -442,10 +379,6 @@ export function appContractChecks(scope) {
         run: async (ctx) => resultFor(code, ctx.findings),
     }));
 }
-/**
- * Run the contract over a checkout. `apps` narrows the run to the named
- * repo-relative app dirs (an unknown dir is an error, not a silent pass).
- */
 export async function runAppCheck(root, apps) {
     if (!isDir(root))
         throw new MeshCliError(`no such checkout: ${root}`);
@@ -463,7 +396,6 @@ export async function runAppCheck(root, apps) {
     scopes.push({ scope: "(repo)", ...jsonReport(repoResults) });
     return { root, status: aggregateStatus(scopes.map((s) => ({ status: s.status, summary: "" }))), scopes };
 }
-/** Human rendering: a header per scope, the doctor lines under it, failures only unless `verbose`. */
 export function renderReport(report, opts) {
     const out = [];
     for (const scope of report.scopes) {
@@ -482,9 +414,6 @@ export function renderReport(report, opts) {
     out.push(`${ICONS[report.status]} app contract: ${report.status}`);
     return out.filter(Boolean).join("\n");
 }
-// ============================================================================
-// Command
-// ============================================================================
 export function registerAppCommands(program) {
     const app = program.command("app").description("Inspect a tenant app against the Mesh app contract");
     app
@@ -512,4 +441,3 @@ export function registerAppCommands(program) {
         }
     });
 }
-//# sourceMappingURL=app-check.js.map

package/dist/src/commands/artifacts.d.ts

@@ -1,13 +1,2 @@
-/**
- * mesh artifacts — manage workflow artifacts from AI agent conversations
- *
- * Commands:
- *   mesh artifacts get <ref>  Download artifact files to local directory
- *
- * Ref format: <conversationId>:<artifactId>
- *   - Full:    mesh artifacts get conv-abc123:workflow-artifact
- *   - Short:   mesh artifacts get conv-abc123          (defaults to "workflow-artifact")
- */
 import { Command } from "commander";
 export declare function registerArtifactsCommands(program: Command): void;
-//# sourceMappingURL=artifacts.d.ts.map

package/dist/src/commands/artifacts.js

@@ -1,21 +1,8 @@
-/**
- * mesh artifacts — manage workflow artifacts from AI agent conversations
- *
- * Commands:
- *   mesh artifacts get <ref>  Download artifact files to local directory
- *
- * Ref format: <conversationId>:<artifactId>
- *   - Full:    mesh artifacts get conv-abc123:workflow-artifact
- *   - Short:   mesh artifacts get conv-abc123          (defaults to "workflow-artifact")
- */
 import * as fs from "fs";
 import * as path from "path";
 import { logError, logInfo, logSuccess, logWarn } from "../utils/log.js";
 import { agentApiFetch, describeHttpError, describeNetworkError, resolveTarget } from "./agent-api-client.js";
 const DEFAULT_ARTIFACT_ID = "workflow-artifact";
-/**
- * Parse an artifact ref: "conversationId:artifactId" or just "conversationId".
- */
 function parseRef(ref) {
     const colonIdx = ref.indexOf(":");
     if (colonIdx === -1) {
@@ -39,35 +26,28 @@ async function getArtifact(ref, options, target) {
     const { conversationId, artifactId } = parseRef(ref);
     logInfo(`Fetching ${conversationId}:${artifactId} from ${target.apiBaseUrl}…`);
     const bundle = await fetchExportBundle(target, conversationId, artifactId);
-    // Determine output directory
     const outputDir = options.output
         ?? path.join("workflows", bundle.primaryWorkflow);
-    // Create directory
     fs.mkdirSync(outputDir, { recursive: true });
     let filesWritten = 0;
-    // Write workflow source files
     for (const file of bundle.files) {
         const filePath = path.join(outputDir, file.filename);
         fs.writeFileSync(filePath, file.code, "utf-8");
         logSuccess(`  ${file.filename}`);
         filesWritten++;
     }
-    // Write README.md from overview
     if (bundle.overview) {
         const readmePath = path.join(outputDir, "README.md");
         fs.writeFileSync(readmePath, bundle.overview, "utf-8");
         logSuccess(`  README.md`);
         filesWritten++;
     }
-    // Write IR as JSON — always present, essential for IR-only artifacts
-    // (from update_workflow) that have no source files.
     if (bundle.ir) {
         const irPath = path.join(outputDir, "workflow-ir.json");
         fs.writeFileSync(irPath, JSON.stringify(bundle.ir, null, 2), "utf-8");
         logSuccess(`  workflow-ir.json`);
         filesWritten++;
     }
-    // Write metadata file (conversation ref, IR for tooling)
     const metaPath = path.join(outputDir, ".workflow-meta.json");
     const meta = {
         conversationId: bundle.conversationId,
@@ -101,10 +81,6 @@ export function registerArtifactsCommands(program) {
         .option("--api-url <url>", "Agent API URL (overrides --target; ad-hoc, no registry lookup)")
         .option("--context <ctx>", `Zitadel auth context, used with --api-url (default: ${DEFAULT_AUTH_CONTEXT})`)
         .action(async (ref, opts) => {
-        // Resolved outside the try so a network-error catch below can give
-        // local-vs-remote-aware guidance (`describeNetworkError` needs the
-        // target). If resolution itself throws (bad --target), there's no
-        // target to reason about — just report the resolution error.
         let target;
         try {
             target = resolveTarget(opts);
@@ -120,14 +96,6 @@ export function registerArtifactsCommands(program) {
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
             logError(message);
-            // `describeHttpError` covers every HTTP-level failure mode (auth,
-            // not-found, 503, generic) with target-aware messages already baked
-            // into the thrown message, so it round-trips through here as `hint
-            // === message` and is not re-logged. Only a genuine network throw
-            // (ECONNREFUSED/"fetch failed"/ENOTFOUND/EAI_AGAIN) — nothing
-            // listening at apiBaseUrl, a down host, a DNS typo, a dropped
-            // VPN/tailscale connection — gets guidance here, and it differs for
-            // a local vs. remote target (see `describeNetworkError`).
             const hint = describeNetworkError(error, target);
             if (hint !== message) {
                 logWarn(hint);
@@ -137,4 +105,3 @@ export function registerArtifactsCommands(program) {
         }
     });
 }
-//# sourceMappingURL=artifacts.js.map