@mesh-tech/mesh-cli 0.20.2 → 0.20.3

package/dist/src/utils/deploy-preflight.js

@@ -1,55 +1,19 @@
-/**
- * Deploy preflight — guard `mesh deploy` (pulumi up/preview/destroy/refresh) in a
- * DEPLOY repo against a stale `node_modules` (MESH-2266).
- *
- * The hazard: a teammate pulls a `@mesh-tech/*` version bump (package.json +
- * pnpm-lock.yaml move together in the commit) but forgets `pnpm install`, so
- * `node_modules` still links the OLD version. The pulumi program then evaluates
- * OLD component code and produces a plan that DELETES resources the new code would
- * keep — the exact incident that showed `VpnJoinBroker` (+~40 resources) as a
- * delete on mesh-dev when node_modules lagged the 1.0.1 bump. This is the same
- * stale-artifact class as the monorepo stale-dist detector (MESH-2019) and the
- * canonical CLI (MESH-2261), one layer up with higher stakes.
- *
- * The check is cheap and precise: compare each `@mesh-tech/*` version the LOCKFILE
- * says should be installed against what is ACTUALLY installed in `node_modules`.
- * A mismatch means `pnpm install` hasn't run since the lockfile changed. We only
- * gate program-EVALUATING ops (a stale install can't corrupt `whoami`/`stack
- * output`), and source-linked deps (`link:`/`file:`/dev-link pnpmfile) are skipped
- * — they are intentionally pointed at live source and never "stale".
- */
 import { existsSync, readFileSync } from 'node:fs';
 import { dirname, join, relative } from 'node:path';
 import { parse as parseYaml } from 'yaml';
 import { logWarn } from './log.js';
-/** Package-name prefixes whose version drift changes the pulumi plan. */
 const GATED_PREFIXES = ['@mesh-tech/'];
-/** pulumi ops that EVALUATE the program (a stale install can produce a wrong plan). */
 export const PROGRAM_EVAL_OPS = new Set(['up', 'preview', 'destroy', 'refresh', 'import']);
-/** Env escape hatch — set truthy to skip the preflight (e.g. deliberate local link testing). */
 export const SKIP_ENV = 'MESH_SKIP_DEPLOY_PREFLIGHT';
 function isGated(name) {
     return GATED_PREFIXES.some((p) => name.startsWith(p));
 }
-/**
- * A lockfile `version:` is checkable only when it's a concrete published version.
- * `link:…`/`file:…` (dev-link pnpmfile, local tarballs) point at live source and
- * are never stale; anything not starting with a digit isn't a comparable version.
- * Peer/patch suffixes (`1.0.1(react@18)`) are stripped to the bare version.
- */
 export function normalizeLockVersion(raw) {
     if (typeof raw !== 'string' || raw.length === 0)
         return null;
     const bare = raw.split('(')[0].trim();
     return /^\d/.test(bare) ? bare : null;
 }
-/**
- * Pure: extract the gated (`@mesh-tech/*`), concretely-versioned deps for one
- * importer of a parsed pnpm-lock document → `{ name: expectedVersion }`.
- *
- * Handles the pnpm v9 shape (`{ specifier, version }` per dep) and the older flat
- * shape (`name: "1.0.1"`). Unknown importer → `{}` (nothing checkable).
- */
 export function extractImporterMeshVersions(lockDoc, importerRel) {
     const out = {};
     const importers = lockDoc?.importers;
@@ -71,10 +35,6 @@ export function extractImporterMeshVersions(lockDoc, importerRel) {
     }
     return out;
 }
-/**
- * Pure: diff the lockfile's expected versions against the installed ones. A dep
- * is a mismatch when the installed version differs (or it isn't installed).
- */
 export function diffLockVsInstalled(expected, installed) {
     const out = [];
     for (const [name, exp] of Object.entries(expected)) {
@@ -84,7 +44,6 @@ export function diffLockVsInstalled(expected, installed) {
     }
     return out;
 }
-/** Walk up from `startDir` to the nearest directory containing a `pnpm-lock.yaml`. */
 export function findPnpmLock(startDir) {
     let dir = startDir;
     for (;;) {
@@ -97,18 +56,6 @@ export function findPnpmLock(startDir) {
         dir = parent;
     }
 }
-/**
- * Read the installed version of `name` from `fromDir`'s `node_modules`, or null.
- *
- * Reads `node_modules/<name>/package.json` DIRECTLY (following pnpm's symlink into
- * the store) rather than `require.resolve(`${name}/package.json`)`: Node's exports
- * gate throws `ERR_PACKAGE_PATH_NOT_EXPORTED` for the many `@mesh-tech/*` packages
- * whose `exports` omit `./package.json` (e.g. `tsconfig`, `pulumi-utils`) — which
- * would return null → a FALSE "stale" hard-stop on a correctly-installed repo that
- * `pnpm install` can't clear. A plain read sidesteps the gate and stays scoped to
- * THIS importer's node_modules instead of walking up to a hoisted copy owned by
- * another importer (MESH-2266 review).
- */
 function readInstalledVersion(fromDir, name) {
     try {
         const pkgPath = join(fromDir, 'node_modules', name, 'package.json');
@@ -119,12 +66,6 @@ function readInstalledVersion(fromDir, name) {
         return null;
     }
 }
-/**
- * Check that the `@mesh-tech/*` deps installed in `appRoot`'s `node_modules` match
- * what the pnpm lockfile says. Returns the list of mismatches (empty = fresh), or
- * `null` when the check does not apply (no lockfile — not a pnpm repo, or the
- * monorepo running without one). IO wrapper around the pure helpers above.
- */
 export function checkDeployDepsFresh(appRoot) {
     const lockPath = findPnpmLock(appRoot);
     if (!lockPath)
@@ -134,8 +75,6 @@ export function checkDeployDepsFresh(appRoot) {
         lockDoc = parseYaml(readFileSync(lockPath, 'utf8'));
     }
     catch {
-        // Don't block the deploy on our own parse failure — but a silently-disabled
-        // safety guard is worse than a noisy one, so surface that the check is off.
         logWarn(`deploy preflight: could not parse ${lockPath} — skipping the stale-node_modules check.`);
         return null;
     }
@@ -149,7 +88,6 @@ export function checkDeployDepsFresh(appRoot) {
         installed[name] = readInstalledVersion(appRoot, name);
     return diffLockVsInstalled(expected, installed);
 }
-/** Human-readable stale-deps report (mirrors the stale-dist detector's style). */
 export function formatStaleDepsError(mismatches) {
     const lines = [
         `✗ ${mismatches.length} @mesh-tech/* dep${mismatches.length === 1 ? '' : 's'} in node_modules ` +
@@ -159,16 +97,9 @@ export function formatStaleDepsError(mismatches) {
     for (const m of mismatches) {
         lines.push(`  • ${m.name} — installed ${m.installed ?? '(missing)'}, lockfile wants ${m.expected}`);
     }
-    lines.push('', '  A stale node_modules makes pulumi evaluate OLD component code and can plan to', '  DELETE resources the current code would keep (MESH-2266). Fix:', '', '      pnpm install', '', `  To bypass this check (rarely correct): ${SKIP_ENV}=1 mesh deploy …`);
+    lines.push('', '  A stale node_modules makes pulumi evaluate OLD component code and can plan to', '  DELETE resources the current code would keep. Fix:', '', '      pnpm install', '', `  To bypass this check (rarely correct): ${SKIP_ENV}=1 mesh deploy …`);
     return lines.join('\n');
 }
-/**
- * Gate a `mesh deploy` invocation: if `op` evaluates the pulumi program and the
- * deploy repo's `node_modules` is stale vs the lockfile, print the fix and exit
- * non-zero BEFORE pulumi runs. No-op for non-evaluating ops, a fresh install, a
- * non-pnpm repo, or when the skip env is set. Kept side-effecting (log + exit) so
- * `deploy.ts` stays a thin wiring layer; the decision logic is pure above.
- */
 export function assertDeployDepsFresh(appRoot, op) {
     if (!PROGRAM_EVAL_OPS.has(op))
         return;
@@ -180,4 +111,3 @@ export function assertDeployDepsFresh(appRoot, op) {
     process.stderr.write(formatStaleDepsError(mismatches) + '\n');
     process.exit(1);
 }
-//# sourceMappingURL=deploy-preflight.js.map

package/dist/src/utils/errors.d.ts

@@ -1,21 +1,10 @@
-/**
- * Shared CLI error type with structured remediation.
- *
- * Every failure along the golden path should tell the user the exact `mesh`
- * command (or doc) that fixes it. Remediation strings must be commands or
- * docs — never "ask <person>".
- */
 export interface Remediation {
-    /** Exact command that fixes the failure, e.g. "mesh login trabian-dev" */
     command?: string;
-    /** Documentation URL or repo-relative doc path with more context */
     docs?: string;
-    /** Whether the owning command can apply this fix itself via --fix */
     autoFixable?: boolean;
 }
 export interface MeshCliErrorOptions {
     remediation?: Remediation;
-    /** Process exit code (default 1) */
     exitCode?: number;
     cause?: unknown;
 }
@@ -24,52 +13,10 @@ export declare class MeshCliError extends Error {
     readonly exitCode: number;
     constructor(message: string, options?: MeshCliErrorOptions);
 }
-/**
- * Render an error's BODY — the message plus its "→ run: <command>" /
- * "→ see: <docs>" remediation lines, with no leading severity glyph.
- *
- * Use this when the caller supplies its own glyph: a recovery path that logs a
- * refusal through `logWarn` (which prefixes ⚠) and carries on would otherwise
- * print "⚠ ✗ …". The remediation lines are the part that must survive — they
- * name the corrupt file to delete.
- */
 export declare function renderErrorBody(err: unknown): string;
-/**
- * Render an error for humans. MeshCliError gets its remediation appended as
- * "→ run: <command>" / "→ see: <docs>" lines; anything else renders its message.
- */
 export declare function renderError(err: unknown): string;
-/**
- * Render an error as JSON for agents. Same structure as the human output:
- * { error, remediation?: { command?, docs?, autoFixable? } }.
- */
 export declare function renderErrorJson(err: unknown): string;
-/**
- * Print a command's `--json` payload — the single machine-readable document on
- * stdout — and record that it happened.
- *
- * A command that emits a payload and *then* throws (the `mesh init` doctor
- * throws by design whenever a check fails) used to produce TWO concatenated
- * JSON documents on stdout, because `handleCliError` appended `{"error":…}`.
- * Two documents is not JSON: `mesh init app-tenant --json | jq` failed to parse
- * on exactly the failure path a script cares about. Routing every payload
- * through here lets the handler know stdout is already spoken for.
- */
 export declare function emitJsonPayload(payload: unknown): void;
-/** True once a command has written its `--json` payload to stdout. */
 export declare function hasEmittedJsonPayload(): boolean;
-/** Test seam — the flag is module state, so specs have to be able to clear it. */
 export declare function resetJsonPayloadEmitted(): void;
-/**
- * Top-level handler for bin/mesh.ts. Prints the error (JSON when the
- * invocation asked for --json anywhere, since per-command flags aren't
- * parsed once dispatch has failed) and exits with the error's code.
- *
- * When the command already emitted a `--json` payload, that payload IS the
- * machine surface — and it says strictly more than this error would (the
- * doctor's payload carries `ok:false` plus a per-check `fix` command). So the
- * error goes to stderr as human diagnostics and stdout keeps exactly one
- * parseable document.
- */
 export declare function handleCliError(err: unknown): never;
-//# sourceMappingURL=errors.d.ts.map

package/dist/src/utils/errors.js

@@ -1,10 +1,3 @@
-/**
- * Shared CLI error type with structured remediation.
- *
- * Every failure along the golden path should tell the user the exact `mesh`
- * command (or doc) that fixes it. Remediation strings must be commands or
- * docs — never "ask <person>".
- */
 import chalk from "chalk";
 export class MeshCliError extends Error {
     remediation;
@@ -16,15 +9,6 @@ export class MeshCliError extends Error {
         this.exitCode = options.exitCode ?? 1;
     }
 }
-/**
- * Render an error's BODY — the message plus its "→ run: <command>" /
- * "→ see: <docs>" remediation lines, with no leading severity glyph.
- *
- * Use this when the caller supplies its own glyph: a recovery path that logs a
- * refusal through `logWarn` (which prefixes ⚠) and carries on would otherwise
- * print "⚠ ✗ …". The remediation lines are the part that must survive — they
- * name the corrupt file to delete.
- */
 export function renderErrorBody(err) {
     const message = err instanceof Error ? err.message : String(err);
     if (!(err instanceof MeshCliError))
@@ -38,17 +22,9 @@ export function renderErrorBody(err) {
     }
     return lines.join("\n");
 }
-/**
- * Render an error for humans. MeshCliError gets its remediation appended as
- * "→ run: <command>" / "→ see: <docs>" lines; anything else renders its message.
- */
 export function renderError(err) {
     return chalk.red("✗") + " " + renderErrorBody(err);
 }
-/**
- * Render an error as JSON for agents. Same structure as the human output:
- * { error, remediation?: { command?, docs?, autoFixable? } }.
- */
 export function renderErrorJson(err) {
     if (err instanceof MeshCliError) {
         return JSON.stringify({
@@ -59,40 +35,16 @@ export function renderErrorJson(err) {
     return JSON.stringify({ error: err instanceof Error ? err.message : String(err) });
 }
 let jsonPayloadEmitted = false;
-/**
- * Print a command's `--json` payload — the single machine-readable document on
- * stdout — and record that it happened.
- *
- * A command that emits a payload and *then* throws (the `mesh init` doctor
- * throws by design whenever a check fails) used to produce TWO concatenated
- * JSON documents on stdout, because `handleCliError` appended `{"error":…}`.
- * Two documents is not JSON: `mesh init app-tenant --json | jq` failed to parse
- * on exactly the failure path a script cares about. Routing every payload
- * through here lets the handler know stdout is already spoken for.
- */
 export function emitJsonPayload(payload) {
     console.log(JSON.stringify(payload, null, 2));
     jsonPayloadEmitted = true;
 }
-/** True once a command has written its `--json` payload to stdout. */
 export function hasEmittedJsonPayload() {
     return jsonPayloadEmitted;
 }
-/** Test seam — the flag is module state, so specs have to be able to clear it. */
 export function resetJsonPayloadEmitted() {
     jsonPayloadEmitted = false;
 }
-/**
- * Top-level handler for bin/mesh.ts. Prints the error (JSON when the
- * invocation asked for --json anywhere, since per-command flags aren't
- * parsed once dispatch has failed) and exits with the error's code.
- *
- * When the command already emitted a `--json` payload, that payload IS the
- * machine surface — and it says strictly more than this error would (the
- * doctor's payload carries `ok:false` plus a per-check `fix` command). So the
- * error goes to stderr as human diagnostics and stdout keeps exactly one
- * parseable document.
- */
 export function handleCliError(err) {
     const wantsJson = process.argv.includes("--json");
     if (wantsJson && !hasEmittedJsonPayload()) {
@@ -103,4 +55,3 @@ export function handleCliError(err) {
     }
     process.exit(err instanceof MeshCliError ? err.exitCode : 1);
 }
-//# sourceMappingURL=errors.js.map

package/dist/src/utils/first-party-contexts.d.ts

@@ -1,40 +1,2 @@
-/**
- * Pinned short-name → FQDN map for FIRST-PARTY Mesh platforms.
- *
- * ## Why this file exists
- *
- * `mesh login mesh.dev` on a clean laptop used to be unresolvable. Discovery
- * has two paths: SSM (needs AWS credentials — the thing we are removing) and
- * the anonymous `https://cli.<domain>/.well-known/mesh.json` endpoint. The
- * HTTPS path is deliberately gated to contexts with ≥2 dots, because hitting
- * `https://cli.<short-name>/…` for an arbitrary short context would let whoever
- * registers that domain seed our cached issuer/clientId — login phishing.
- *
- * So the short context every internal doc tells a new developer to use was
- * exactly the one that could not resolve without AWS.
- *
- * ## Why a compiled-in map is the safe fix
- *
- * The alias is resolved from THIS table, which ships inside the CLI and is
- * changed only by a reviewed commit. It is not read from the network, from
- * `~/.config/mesh`, or from an environment variable, so it cannot be seeded by
- * an attacker — which is the property the ≥2-dot guard protects and the reason
- * that guard must NOT be loosened instead.
- *
- * ## Adding an entry
- *
- * Only add a domain Trabian controls and has verified serves
- * `/.well-known/mesh.json`. The map is the trust anchor; a typo here is a
- * phishing vector, so treat additions as a security review, not a config edit.
- */
 export declare const FIRST_PARTY_CONTEXTS: Readonly<Record<string, string>>;
-/**
- * The FQDN to run anonymous HTTPS discovery against for a short first-party
- * context, or null when the context is not a pinned alias.
- *
- * `Object.hasOwn` rather than a bare lookup: a plain-object index answers
- * `constructor` / `toString` from the prototype chain, and this function's
- * answer decides which host we trust with our issuer + client id.
- */
 export declare function firstPartyDomainFor(context: string): string | null;
-//# sourceMappingURL=first-party-contexts.d.ts.map

package/dist/src/utils/first-party-contexts.js

@@ -1,53 +1,9 @@
-/**
- * Pinned short-name → FQDN map for FIRST-PARTY Mesh platforms.
- *
- * ## Why this file exists
- *
- * `mesh login mesh.dev` on a clean laptop used to be unresolvable. Discovery
- * has two paths: SSM (needs AWS credentials — the thing we are removing) and
- * the anonymous `https://cli.<domain>/.well-known/mesh.json` endpoint. The
- * HTTPS path is deliberately gated to contexts with ≥2 dots, because hitting
- * `https://cli.<short-name>/…` for an arbitrary short context would let whoever
- * registers that domain seed our cached issuer/clientId — login phishing.
- *
- * So the short context every internal doc tells a new developer to use was
- * exactly the one that could not resolve without AWS.
- *
- * ## Why a compiled-in map is the safe fix
- *
- * The alias is resolved from THIS table, which ships inside the CLI and is
- * changed only by a reviewed commit. It is not read from the network, from
- * `~/.config/mesh`, or from an environment variable, so it cannot be seeded by
- * an attacker — which is the property the ≥2-dot guard protects and the reason
- * that guard must NOT be loosened instead.
- *
- * ## Adding an entry
- *
- * Only add a domain Trabian controls and has verified serves
- * `/.well-known/mesh.json`. The map is the trust anchor; a typo here is a
- * phishing vector, so treat additions as a security review, not a config edit.
- */
 export const FIRST_PARTY_CONTEXTS = Object.freeze({
-    // Verified 2026-08-14: https://cli.dev.platform.meshtech.io/.well-known/mesh.json
-    // answers with the platform's issuer + CLI client id + registryBroker,
-    // anonymously. (Repointed from dev.trabian.meshtech.io — the trabian tenant
-    // platform lives in a different AWS account with no registry; the
-    // platform-dev stack in the registry-owning account is the developer front
-    // door. mesh-sandbox#32 / #3587.)
     "mesh.dev": "dev.platform.meshtech.io",
 });
-/**
- * The FQDN to run anonymous HTTPS discovery against for a short first-party
- * context, or null when the context is not a pinned alias.
- *
- * `Object.hasOwn` rather than a bare lookup: a plain-object index answers
- * `constructor` / `toString` from the prototype chain, and this function's
- * answer decides which host we trust with our issuer + client id.
- */
 export function firstPartyDomainFor(context) {
     if (!Object.hasOwn(FIRST_PARTY_CONTEXTS, context))
         return null;
     const domain = FIRST_PARTY_CONTEXTS[context];
     return typeof domain === "string" && domain ? domain : null;
 }
-//# sourceMappingURL=first-party-contexts.js.map

package/dist/src/utils/index.d.ts

@@ -1,6 +1,3 @@
-/**
- * Utility exports
- */
 export * from "./errors.js";
 export * from "./log.js";
 export * from "./context.js";
@@ -8,4 +5,3 @@ export * from "./bastion.js";
 export * from "./credentials.js";
 export * from "./pulumi.js";
 export * from "./vpn.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/src/utils/index.js

@@ -1,6 +1,3 @@
-/**
- * Utility exports
- */
 export * from "./errors.js";
 export * from "./log.js";
 export * from "./context.js";
@@ -8,4 +5,3 @@ export * from "./bastion.js";
 export * from "./credentials.js";
 export * from "./pulumi.js";
 export * from "./vpn.js";
-//# sourceMappingURL=index.js.map

package/dist/src/utils/kubeconfig.d.ts

@@ -3,60 +3,20 @@ interface EksClusterData {
     clusterCaData: string;
     clusterName: string;
 }
-/**
- * Build a kubeconfig YAML that authenticates to `cluster` via `aws eks get-token`.
- * Pure — no I/O. The `region` is for the get-token exec args (the active AWS
- * identity is whatever the process runs as: deployer / SSO / CI).
- */
 export declare function buildKubeconfig(cluster: EksClusterData, region: string): string;
-/**
- * Deterministic path of the session-scoped kubeconfig written by
- * {@link ensureKubeconfig}. Exposed so callers can point `KUBECONFIG` at the
- * last-good file when a fresh SSM re-resolve isn't available (e.g. on
- * `mesh dev restart --refresh-env`), rather than letting kubectl fall back to
- * `~/.kube/config`.
- */
 export declare function sessionKubeconfigPath(sessionName: string): string;
-/** Why {@link ensureKubeconfig} couldn't resolve the cluster. */
 export interface EnsureKubeconfigFailure {
-    /** The SSM parameter name that was read (or attempted). */
     parameter: string;
-    /** The exception thrown, or a synthetic Error for empty/malformed data. */
     error: unknown;
 }
 export interface EnsureKubeconfigDeps {
-    /** SSM GetParameter (decrypted value or undefined) — injectable for tests. */
     getParameter?: (name: string) => Promise<string | undefined>;
-    /**
-     * Invoked when cluster resolution fails, with the parameter tried and the
-     * underlying error — so callers can say WHAT failed instead of guessing
-     * "check your SSM read access" at the user (MESH-2515).
-     */
     onError?: (failure: EnsureKubeconfigFailure) => void;
 }
-/**
- * The HUB platform name for platform-level resource lookups (EKS export,
- * bastion). `platform.name` in the dev output is the hub (e.g. "trabian");
- * when absent — outputs predating the field — fall back to the default hub
- * "mesh", NEVER to the app tenant. This one definition pins the axis that
- * regressed in the original MESH-2515 bug.
- */
 export declare function resolveHubPlatformName(platform: {
     name?: string;
     tenant?: string;
     env?: string;
 } | undefined): string;
-/**
- * Resolve the hub EKS cluster from SSM and write a session-scoped kubeconfig.
- *
- * Reads `/mesh-platform/{platformName}/{env}/core/eks` — platform-level cluster
- * data lives under the app's HUB platform (`platform.name` in the dev output,
- * e.g. "trabian"; "mesh" is only the default hub, MESH-2515). Writes to
- * `${tmpdir}/mesh-dev-sessions/{sessionName}.kubeconfig` (never touches
- * ~/.kube/config). Returns the path, or `null` if the cluster data can't be
- * resolved (best-effort — the caller continues without it; the failure detail
- * goes to `deps.onError`).
- */
 export declare function ensureKubeconfig(platformName: string, env: string, sessionName: string, deps?: EnsureKubeconfigDeps): Promise<string | null>;
 export {};
-//# sourceMappingURL=kubeconfig.d.ts.map

package/dist/src/utils/kubeconfig.js

@@ -1,24 +1,6 @@
-/**
- * Turnkey kubeconfig for `mesh dev`.
- *
- * `mesh dev` shells out to `kubectl` (Temporal encoding-key read, temporal-pod
- * env fallback). Rather than depend on the operator's ambient ~/.kube/config
- * (which may be unset/stale, and which the apps-deployer role can't populate via
- * `aws eks update-kubeconfig` — it lacks `eks:DescribeCluster`), we build a
- * kubeconfig from the platform EKS cluster data in SSM and authenticate via
- * `aws eks get-token` (STS-only — needs just the cluster name).
- *
- * Mirrors the kubeconfig the Pulumi k8s provider builds in
- * `@mesh-tech/infra-components` AppEnvironment.buildExecKubeconfig.
- */
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
-/**
- * Build a kubeconfig YAML that authenticates to `cluster` via `aws eks get-token`.
- * Pure — no I/O. The `region` is for the get-token exec args (the active AWS
- * identity is whatever the process runs as: deployer / SSO / CI).
- */
 export function buildKubeconfig(cluster, region) {
     return `apiVersion: v1
 kind: Config
@@ -48,23 +30,9 @@ users:
         - ${region}
 `;
 }
-/**
- * Deterministic path of the session-scoped kubeconfig written by
- * {@link ensureKubeconfig}. Exposed so callers can point `KUBECONFIG` at the
- * last-good file when a fresh SSM re-resolve isn't available (e.g. on
- * `mesh dev restart --refresh-env`), rather than letting kubectl fall back to
- * `~/.kube/config`.
- */
 export function sessionKubeconfigPath(sessionName) {
     return path.join(os.tmpdir(), 'mesh-dev-sessions', `${sessionName}.kubeconfig`);
 }
-/**
- * The HUB platform name for platform-level resource lookups (EKS export,
- * bastion). `platform.name` in the dev output is the hub (e.g. "trabian");
- * when absent — outputs predating the field — fall back to the default hub
- * "mesh", NEVER to the app tenant. This one definition pins the axis that
- * regressed in the original MESH-2515 bug.
- */
 export function resolveHubPlatformName(platform) {
     return platform?.name ?? 'mesh';
 }
@@ -74,17 +42,6 @@ async function ssmGetParameter(name) {
     const resp = await ssm.send(new GetParameterCommand({ Name: name, WithDecryption: true }));
     return resp.Parameter?.Value;
 }
-/**
- * Resolve the hub EKS cluster from SSM and write a session-scoped kubeconfig.
- *
- * Reads `/mesh-platform/{platformName}/{env}/core/eks` — platform-level cluster
- * data lives under the app's HUB platform (`platform.name` in the dev output,
- * e.g. "trabian"; "mesh" is only the default hub, MESH-2515). Writes to
- * `${tmpdir}/mesh-dev-sessions/{sessionName}.kubeconfig` (never touches
- * ~/.kube/config). Returns the path, or `null` if the cluster data can't be
- * resolved (best-effort — the caller continues without it; the failure detail
- * goes to `deps.onError`).
- */
 export async function ensureKubeconfig(platformName, env, sessionName, deps = {}) {
     const parameter = `/mesh-platform/${platformName}/${env}/core/eks`;
     const getParameter = deps.getParameter ?? ssmGetParameter;
@@ -115,4 +72,3 @@ export async function ensureKubeconfig(platformName, env, sessionName, deps = {}
     fs.writeFileSync(kubeconfigPath, buildKubeconfig(cluster, region), { mode: 0o600 });
     return kubeconfigPath;
 }
-//# sourceMappingURL=kubeconfig.js.map

package/dist/src/utils/log.d.ts

@@ -1,15 +1,3 @@
-/**
- * Logging utilities with colored output.
- *
- * Non-TTY streams (CI, agent runs, piped output) get an [HH:MM:SS] prefix on
- * every line so long quiet stretches are attributable after the fact
- * (MESH-2479); interactive terminals stay clean. Override with
- * MESH_LOG_TIMESTAMPS=1 (force on) / =0 (force off).
- */
-/**
- * Pure prefix decision, exported for tests: timestamps when the env flag says
- * so, else whenever stderr is not a TTY.
- */
 export declare function logPrefix(opts: {
     isTTY: boolean;
     envFlag: string | undefined;
@@ -19,16 +7,8 @@ export declare function logInfo(message: string): void;
 export declare function logSuccess(message: string): void;
 export declare function logWarn(message: string): void;
 export declare function logError(message: string): void;
-/** Render elapsed milliseconds compactly: "45s", "2m 30s", "1h 5m". */
 export declare function formatElapsed(ms: number): string;
-/**
- * Periodic "still working" line during a long silent operation (registry
- * fetches, image builds) so a non-TTY first run never sits at 0 bytes of
- * output for minutes (MESH-2479). `touch()` marks recent real output, which
- * suppresses the next beat — the heartbeat only fills silence.
- */
 export declare function startHeartbeat(label: string, intervalMs?: number): {
     stop: () => void;
     touch: () => void;
 };
-//# sourceMappingURL=log.d.ts.map

package/dist/src/utils/log.js

@@ -1,16 +1,4 @@
-/**
- * Logging utilities with colored output.
- *
- * Non-TTY streams (CI, agent runs, piped output) get an [HH:MM:SS] prefix on
- * every line so long quiet stretches are attributable after the fact
- * (MESH-2479); interactive terminals stay clean. Override with
- * MESH_LOG_TIMESTAMPS=1 (force on) / =0 (force off).
- */
 import chalk from "chalk";
-/**
- * Pure prefix decision, exported for tests: timestamps when the env flag says
- * so, else whenever stderr is not a TTY.
- */
 export function logPrefix(opts) {
     const enabled = opts.envFlag === "1" || (opts.envFlag !== "0" && !opts.isTTY);
     return enabled ? `[${opts.now.toISOString().slice(11, 19)}] ` : "";
@@ -34,7 +22,6 @@ export function logWarn(message) {
 export function logError(message) {
     console.error(prefix() + chalk.red("✗"), message);
 }
-/** Render elapsed milliseconds compactly: "45s", "2m 30s", "1h 5m". */
 export function formatElapsed(ms) {
     const totalSec = Math.max(0, Math.round(ms / 1000));
     const h = Math.floor(totalSec / 3600);
@@ -46,12 +33,6 @@ export function formatElapsed(ms) {
         return `${m}m ${s}s`;
     return `${s}s`;
 }
-/**
- * Periodic "still working" line during a long silent operation (registry
- * fetches, image builds) so a non-TTY first run never sits at 0 bytes of
- * output for minutes (MESH-2479). `touch()` marks recent real output, which
- * suppresses the next beat — the heartbeat only fills silence.
- */
 export function startHeartbeat(label, intervalMs = 15_000) {
     const startedAt = Date.now();
     let lastOutputAt = startedAt;
@@ -68,4 +49,3 @@ export function startHeartbeat(label, intervalMs = 15_000) {
         },
     };
 }
-//# sourceMappingURL=log.js.map