@mesh-tech/mesh-cli 0.20.2 → 0.20.3

package/dist/src/utils/mesh-json.d.ts

@@ -1,58 +1,12 @@
-/**
- * `mesh.json` — the repo-level record of which tenant a checkout belongs to
- * and where that tenant runs.
- *
- * Written by the `mesh init` wizard at the repo root, read by anything that
- * wants a default `--tenant` (`mesh create-app`, `mesh dev`'s local mode) and
- * by the wizard itself so a re-run pre-fills its answers. It is deliberately
- * tiny and app-agnostic: per-app identity stays in each app's Pulumi config,
- * which wins when both are present.
- *
- * @example
- * // mesh.json
- * { "tenant": "acme", "platform": "local" }
- */
-/** The file's name at the repo root. */
 export declare const MESH_JSON = "mesh.json";
-/** The record `mesh.json` holds. */
 export interface MeshJson {
-    /** The app tenant this repo belongs to (`^[a-z][a-z0-9-]*$`). */
     tenant: string;
-    /**
-     * Where the tenant runs: `local` (the `mesh start` platform, no deployed
-     * platform yet) or the environment name of a deployed platform (`dev`,
-     * `uat`, …), which with the tenant forms the `<tenant>.<env>` login context.
-     */
     platform: string;
 }
-/** True when `value` is a tenant name every Mesh command accepts. */
 export declare function isValidTenantName(value: string): boolean;
-/**
- * Parse `mesh.json` content. Null when the document is not the expected
- * shape — a malformed file is treated as absent, never as an error, because
- * nothing that reads it can do better than "no default".
- *
- * @example
- * parseMeshJson('{"tenant":"acme","platform":"local"}'); // → { tenant: "acme", platform: "local" }
- */
 export declare function parseMeshJson(content: string): MeshJson | null;
-/**
- * Find the nearest `mesh.json` at or above `startDir`. Stops at the first
- * match, at a `.git` directory (a repo boundary), or at the filesystem root.
- *
- * @example
- * findMeshJson("/work/acme-mesh-apps/apps/billing"); // → { path: "/work/acme-mesh-apps/mesh.json", data }
- */
 export declare function findMeshJson(startDir: string): {
     path: string;
     data: MeshJson;
 } | null;
-/**
- * Write `mesh.json` under `rootDir`, replacing an existing one. Returns the
- * path written.
- *
- * @example
- * writeMeshJson("/work/acme-mesh-apps", { tenant: "acme", platform: "dev" });
- */
 export declare function writeMeshJson(rootDir: string, data: MeshJson): string;
-//# sourceMappingURL=mesh-json.d.ts.map

package/dist/src/utils/mesh-json.js

@@ -1,33 +1,9 @@
-/**
- * `mesh.json` — the repo-level record of which tenant a checkout belongs to
- * and where that tenant runs.
- *
- * Written by the `mesh init` wizard at the repo root, read by anything that
- * wants a default `--tenant` (`mesh create-app`, `mesh dev`'s local mode) and
- * by the wizard itself so a re-run pre-fills its answers. It is deliberately
- * tiny and app-agnostic: per-app identity stays in each app's Pulumi config,
- * which wins when both are present.
- *
- * @example
- * // mesh.json
- * { "tenant": "acme", "platform": "local" }
- */
 import * as fs from "fs";
 import * as path from "path";
-/** The file's name at the repo root. */
 export const MESH_JSON = "mesh.json";
-/** True when `value` is a tenant name every Mesh command accepts. */
 export function isValidTenantName(value) {
     return /^[a-z][a-z0-9-]*$/.test(value);
 }
-/**
- * Parse `mesh.json` content. Null when the document is not the expected
- * shape — a malformed file is treated as absent, never as an error, because
- * nothing that reads it can do better than "no default".
- *
- * @example
- * parseMeshJson('{"tenant":"acme","platform":"local"}'); // → { tenant: "acme", platform: "local" }
- */
 export function parseMeshJson(content) {
     try {
         const data = JSON.parse(content);
@@ -40,13 +16,6 @@ export function parseMeshJson(content) {
         return null;
     }
 }
-/**
- * Find the nearest `mesh.json` at or above `startDir`. Stops at the first
- * match, at a `.git` directory (a repo boundary), or at the filesystem root.
- *
- * @example
- * findMeshJson("/work/acme-mesh-apps/apps/billing"); // → { path: "/work/acme-mesh-apps/mesh.json", data }
- */
 export function findMeshJson(startDir) {
     let dir = path.resolve(startDir);
     while (true) {
@@ -70,16 +39,8 @@ export function findMeshJson(startDir) {
         dir = parent;
     }
 }
-/**
- * Write `mesh.json` under `rootDir`, replacing an existing one. Returns the
- * path written.
- *
- * @example
- * writeMeshJson("/work/acme-mesh-apps", { tenant: "acme", platform: "dev" });
- */
 export function writeMeshJson(rootDir, data) {
     const target = path.join(rootDir, MESH_JSON);
     fs.writeFileSync(target, `${JSON.stringify({ tenant: data.tenant, platform: data.platform }, null, 2)}\n`);
     return target;
 }
-//# sourceMappingURL=mesh-json.js.map

package/dist/src/utils/pid.d.ts

@@ -1,47 +1,5 @@
-/**
- * Guard for pids the CLI reads back rather than constructs.
- *
- * Every teardown path in the CLI signals a pid it recovered from somewhere:
- * `tunnel-state.json`, `runner.json`, `daemon.json`, or a `ps` argv scan. None
- * of those are trustworthy — a truncated write, a stale file from an older
- * build, or a hand-edited state dir can put any integer there. POSIX `kill(2)`
- * overloads the pid argument, so the wrong integer is not a no-op:
- *
- *  - `kill(0, sig)`  → every process in the CALLER'S OWN process group.
- *  - `kill(-1, sig)` → every process the caller is permitted to signal.
- *  - `kill(1, sig)`  → init. And teardown negates before signalling, so a `1`
- *    on disk becomes `kill(-1)` — the broadcast.
- *
- * That is not hypothetical: a `pid: -1` written by a unit test SIGTERM'd the
- * author's entire login session (tmux server, every pane, an in-flight
- * `mesh login`) on 2026-08-01. Refuse the input instead of signalling it.
- *
- * The guard is intentionally strict about the LOW end (`pid >= 2`) so the
- * NEGATED form used for process-group teardown is safe by construction: if
- * `pid >= 2` then `-pid <= -2`, which is always a real process group and never
- * `0` (own group) or `-1` (broadcast). Callers signalling `-pid` need no
- * second check — see `killSupervisor`.
- */
-/** Where a recovered pid came from, for the refusal message + remediation. */
 export interface PidSource {
-    /** What the pid claims to be, e.g. "tunnel supervisor pid". */
     what: string;
-    /**
-     * Absolute path of the state file it was read from, when there is one.
-     * Present ⇒ the refusal tells the user the exact file to delete, so a corrupt
-     * state dir does not brick `mesh tunnel down` (which is the command that
-     * would otherwise clear it).
-     */
     file?: string;
 }
-/**
- * Throw unless `pid` is safe to pass to `process.kill` (directly or negated).
- *
- * Call this at the top of any function that signals a pid it did not construct
- * itself. Existence checks (`process.kill(pid, 0)`) do not need it — signal 0
- * delivers nothing — but they gain nothing from skipping it either.
- *
- * @throws {MeshCliError} with `rm <file>` remediation when `source.file` is set.
- */
 export declare function assertSignalablePid(pid: unknown, source: PidSource): void;
-//# sourceMappingURL=pid.d.ts.map

package/dist/src/utils/pid.js

@@ -1,44 +1,10 @@
-/**
- * Guard for pids the CLI reads back rather than constructs.
- *
- * Every teardown path in the CLI signals a pid it recovered from somewhere:
- * `tunnel-state.json`, `runner.json`, `daemon.json`, or a `ps` argv scan. None
- * of those are trustworthy — a truncated write, a stale file from an older
- * build, or a hand-edited state dir can put any integer there. POSIX `kill(2)`
- * overloads the pid argument, so the wrong integer is not a no-op:
- *
- *  - `kill(0, sig)`  → every process in the CALLER'S OWN process group.
- *  - `kill(-1, sig)` → every process the caller is permitted to signal.
- *  - `kill(1, sig)`  → init. And teardown negates before signalling, so a `1`
- *    on disk becomes `kill(-1)` — the broadcast.
- *
- * That is not hypothetical: a `pid: -1` written by a unit test SIGTERM'd the
- * author's entire login session (tmux server, every pane, an in-flight
- * `mesh login`) on 2026-08-01. Refuse the input instead of signalling it.
- *
- * The guard is intentionally strict about the LOW end (`pid >= 2`) so the
- * NEGATED form used for process-group teardown is safe by construction: if
- * `pid >= 2` then `-pid <= -2`, which is always a real process group and never
- * `0` (own group) or `-1` (broadcast). Callers signalling `-pid` need no
- * second check — see `killSupervisor`.
- */
 import { MeshCliError } from "./errors.js";
-/**
- * Lowest pid the CLI will ever signal. 0 and 1 are the two overloaded values;
- * anything below 0 is already a process-group id, not a pid.
- */
 const MIN_SIGNALABLE_PID = 2;
-/**
- * Why `pid` must not be handed to `process.kill`, or null if it is signalable.
- * Pure — every branch is unit-testable without spawning anything.
- */
 function unsignalableReason(pid) {
     if (typeof pid !== "number") {
         return `expected an integer, got ${typeof pid} (${String(pid)})`;
     }
     if (!Number.isInteger(pid)) {
-        // NaN, ±Infinity, and fractions all land here. Number.isInteger is the one
-        // predicate that rejects every non-pid a JSON.parse can produce.
         return `expected an integer, got ${String(pid)}`;
     }
     if (pid === 0) {
@@ -58,26 +24,12 @@ function unsignalableReason(pid) {
     }
     return null;
 }
-/**
- * Throw unless `pid` is safe to pass to `process.kill` (directly or negated).
- *
- * Call this at the top of any function that signals a pid it did not construct
- * itself. Existence checks (`process.kill(pid, 0)`) do not need it — signal 0
- * delivers nothing — but they gain nothing from skipping it either.
- *
- * @throws {MeshCliError} with `rm <file>` remediation when `source.file` is set.
- */
 export function assertSignalablePid(pid, source) {
     const reason = unsignalableReason(pid);
     if (reason === null)
         return;
-    // "Corrupt or stale" is only true when the pid was read back from a state
-    // file. Call sites without one (e.g. reclaimPort's lsof-derived holder) get a
-    // pid that is CORRECT — that is exactly why it is refused — so the causal
-    // clause is gated on the same condition as the `rm` remediation.
     throw new MeshCliError(`Refusing to signal ${source.what} — ${reason}. ` +
         (source.file
             ? `The recorded value is corrupt or stale; signalling it could terminate unrelated processes.`
             : `Signalling it could terminate unrelated processes.`), source.file ? { remediation: { command: `rm ${source.file}` } } : {});
 }
-//# sourceMappingURL=pid.js.map

package/dist/src/utils/pulumi-run.d.ts

@@ -1,23 +1,9 @@
 import { type CredProbe } from "../commands/login.js";
-/**
- * Map a credential probe to a preflight message. Pure — no I/O — so the
- * remediation wording is unit-testable. `null` means "proceed" (`ok`, or a
- * non-fatal warning already surfaced). `fatal` callers should stop before
- * touching pulumi; non-fatal is a warning that lets the run continue.
- */
 export declare function credProbeToPreflightError(probe: CredProbe, context: string): {
     message: string;
     fatal: boolean;
 } | null;
-/**
- * Resolve deployer AWS credentials for a `pulumi` invocation against `stack`,
- * with an up-front login preflight. Returns env vars to merge into the pulumi
- * child (`AWS_ACCESS_KEY_ID`/`_SECRET_ACCESS_KEY`/`_SESSION_TOKEN`). Exits the
- * process with a clear, actionable message on any hard failure — callers can
- * treat a return as "creds are ready".
- */
 export declare function resolvePulumiEnv(opts: {
     appRoot: string;
     stack: string;
 }): Promise<Record<string, string>>;
-//# sourceMappingURL=pulumi-run.d.ts.map

package/dist/src/utils/pulumi-run.js

@@ -1,32 +1,7 @@
-/**
- * The single credentialed-Pulumi chokepoint (MESH-2085).
- *
- * Every mesh command that shells `pulumi` against the S3 state backend needs
- * AWS credentials from the stack's `mesh:deployerRole`. Historically each
- * command re-implemented that glue and `mesh stack init` skipped it entirely
- * (→ `NoCredentialProviders`). This module centralizes it:
- *
- *   1. read `mesh:deployerRole` from the stack config (clear error if absent),
- *   2. run a LOGIN PREFLIGHT (`probeCredentials`) that names the real problem
- *      ("run `mesh login --device`") BEFORE pulumi is invoked — and before
- *      `resolveAwsCredentials`' interactive path can hang a browser login over
- *      SSH,
- *   3. resolve the deployer creds and return them as env vars to merge into the
- *      `pulumi` child process.
- *
- * Callers thread the returned env into their existing `execFileSync("pulumi", …)`
- * calls (deploy passes it once; stack init reuses it across init/select/config).
- */
 import { logError, logWarn } from "./log.js";
 import { readStackConfig } from "./pulumi.js";
 import { derivePlatformContext, resolveAwsCredentials } from "./aws-auth.js";
 import { probeCredentials } from "../commands/login.js";
-/**
- * Map a credential probe to a preflight message. Pure — no I/O — so the
- * remediation wording is unit-testable. `null` means "proceed" (`ok`, or a
- * non-fatal warning already surfaced). `fatal` callers should stop before
- * touching pulumi; non-fatal is a warning that lets the run continue.
- */
 export function credProbeToPreflightError(probe, context) {
     switch (probe.state) {
         case "ok":
@@ -58,20 +33,10 @@ export function credProbeToPreflightError(probe, context) {
             };
     }
 }
-/**
- * Resolve deployer AWS credentials for a `pulumi` invocation against `stack`,
- * with an up-front login preflight. Returns env vars to merge into the pulumi
- * child (`AWS_ACCESS_KEY_ID`/`_SECRET_ACCESS_KEY`/`_SESSION_TOKEN`). Exits the
- * process with a clear, actionable message on any hard failure — callers can
- * treat a return as "creds are ready".
- */
 export async function resolvePulumiEnv(opts) {
     const { appRoot, stack } = opts;
     const roleArn = readStackConfig(appRoot, stack, "mesh:deployerRole");
     if (!roleArn) {
-        // Platform stacks are deployed by operators with ambient credentials
-        // (SSO/exported env) and typically carry no mesh:deployerRole — only app
-        // stacks do. With ambient creds present, run Pulumi against them directly.
         if (process.env.AWS_ACCESS_KEY_ID) {
             return {};
         }
@@ -82,12 +47,6 @@ export async function resolvePulumiEnv(opts) {
             `  (or provide operator AWS credentials in the environment for platform stacks).`);
         process.exit(1);
     }
-    // Skip the login preflight whenever explicit ambient AWS credentials are
-    // present — both the CI/OIDC case (key + session token) AND long-lived static
-    // keys (key, no session token). Requiring a session token here regressed
-    // static-key users: with no cached mesh session the probe returns `no-session`
-    // → fatal, even though `resolveAwsCredentials`' ambient-SDK AssumeRole path
-    // (which accepts a bare static key) would have worked. (MESH-2085 review.)
     const hasAmbientCreds = !!process.env.AWS_ACCESS_KEY_ID;
     const context = derivePlatformContext(appRoot, stack);
     if (!hasAmbientCreds && context) {
@@ -109,4 +68,3 @@ export async function resolvePulumiEnv(opts) {
     }
     return { ...resolved.env };
 }
-//# sourceMappingURL=pulumi-run.js.map

package/dist/src/utils/pulumi.d.ts

@@ -1,39 +1,5 @@
-/**
- * Pulumi-related utilities shared across CLI commands.
- */
-/**
- * Find the Pulumi app root by walking up from a starting directory.
- * Returns the first directory containing `Pulumi.yaml`, or null.
- */
 export declare function findAppRoot(startDir: string): string | null;
-/**
- * Find Pulumi.<stack>.yaml files in a directory.
- * Returns an array of stack names (without the Pulumi. prefix and .yaml suffix).
- */
 export declare function findStackConfigs(appRoot: string): string[];
-/**
- * Get the currently selected Pulumi stack name, or null.
- */
 export declare function getCurrentStack(appRoot: string): string | null;
-/**
- * Read a config value from Pulumi.<stack>.yaml.
- * Simple regex-based parser — handles single-line string values.
- * For complex values, use `pulumi config` CLI instead.
- */
 export declare function readStackConfig(appRoot: string, stack: string, key: string): string | null;
-/**
- * Run `pulumi stack output <key> --json` with the given extra args.
- *
- * Pulumi redacts secret-tainted outputs as the literal string `"[secret]"`.
- * Outputs like `env.register()`'s `dev` blob are tainted because they transitively
- * include secret values (e.g. `TEMPORAL_ENCODING_KEY`, DB passwords), even though
- * much of the blob (tunnels, namespace, service scaffolding) is non-secret.
- *
- * This helper tries without `--show-secrets` first — which avoids requiring
- * the local machine to have the stack's secrets provider configured (KMS access
- * etc.) — and retries with `--show-secrets` only if the first call returns a
- * `"[secret]"` placeholder. KMS/secrets-provider errors are not retried because
- * they will fail the same way with the flag set.
- */
 export declare function pulumiStackOutput(appRoot: string, key: string, extraArgs: string[], env?: Record<string, string>): string;
-//# sourceMappingURL=pulumi.d.ts.map

package/dist/src/utils/pulumi.js

@@ -1,13 +1,6 @@
-/**
- * Pulumi-related utilities shared across CLI commands.
- */
 import { execFileSync } from "child_process";
 import * as path from "path";
 import * as fs from "fs";
-/**
- * Find the Pulumi app root by walking up from a starting directory.
- * Returns the first directory containing `Pulumi.yaml`, or null.
- */
 export function findAppRoot(startDir) {
     let dir = startDir;
     while (true) {
@@ -19,18 +12,11 @@ export function findAppRoot(startDir) {
         dir = parent;
     }
 }
-/**
- * Find Pulumi.<stack>.yaml files in a directory.
- * Returns an array of stack names (without the Pulumi. prefix and .yaml suffix).
- */
 export function findStackConfigs(appRoot) {
     return fs.readdirSync(appRoot)
         .filter((f) => /^Pulumi\..+\.yaml$/.test(f) && f !== "Pulumi.yaml")
         .map((f) => f.replace(/^Pulumi\./, "").replace(/\.yaml$/, ""));
 }
-/**
- * Get the currently selected Pulumi stack name, or null.
- */
 export function getCurrentStack(appRoot) {
     try {
         const result = execFileSync("pulumi", ["stack", "--show-name"], {
@@ -44,11 +30,6 @@ export function getCurrentStack(appRoot) {
         return null;
     }
 }
-/**
- * Read a config value from Pulumi.<stack>.yaml.
- * Simple regex-based parser — handles single-line string values.
- * For complex values, use `pulumi config` CLI instead.
- */
 export function readStackConfig(appRoot, stack, key) {
     const configFile = path.join(appRoot, `Pulumi.${stack}.yaml`);
     if (!fs.existsSync(configFile))
@@ -60,34 +41,16 @@ export function readStackConfig(appRoot, stack, key) {
         return null;
     return match[1].trim().replace(/^["']|["']$/g, "");
 }
-/**
- * Run `pulumi stack output <key> --json` with the given extra args.
- *
- * Pulumi redacts secret-tainted outputs as the literal string `"[secret]"`.
- * Outputs like `env.register()`'s `dev` blob are tainted because they transitively
- * include secret values (e.g. `TEMPORAL_ENCODING_KEY`, DB passwords), even though
- * much of the blob (tunnels, namespace, service scaffolding) is non-secret.
- *
- * This helper tries without `--show-secrets` first — which avoids requiring
- * the local machine to have the stack's secrets provider configured (KMS access
- * etc.) — and retries with `--show-secrets` only if the first call returns a
- * `"[secret]"` placeholder. KMS/secrets-provider errors are not retried because
- * they will fail the same way with the flag set.
- */
 export function pulumiStackOutput(appRoot, key, extraArgs, env) {
     const execEnv = env ? { ...process.env, ...env } : undefined;
-    // First attempt: no --show-secrets (works without PULUMI_CONFIG_PASSPHRASE / KMS)
     try {
         const result = execFileSync("pulumi", ["stack", "output", key, "--json", ...extraArgs], { cwd: appRoot, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], env: execEnv });
-        // If the output contains "[secret]" placeholders, retry with --show-secrets
         if (result.includes('"[secret]"')) {
             return execFileSync("pulumi", ["stack", "output", key, "--json", "--show-secrets", ...extraArgs], { cwd: appRoot, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], env: execEnv });
         }
         return result;
     }
     catch (err) {
-        // If the error is a secrets/KMS issue, don't retry with --show-secrets
-        // (it will fail the same way). Only retry for other Pulumi errors.
         const errMsg = err?.stderr ?? "";
         if (errMsg.includes("kms:") || errMsg.includes("KMS") || errMsg.includes("secrets manager")) {
             throw err;
@@ -95,4 +58,3 @@ export function pulumiStackOutput(appRoot, key, extraArgs, env) {
         return execFileSync("pulumi", ["stack", "output", key, "--json", "--show-secrets", ...extraArgs], { cwd: appRoot, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], env: execEnv });
     }
 }
-//# sourceMappingURL=pulumi.js.map

package/dist/src/utils/reachability.d.ts

@@ -1,29 +1,2 @@
-/**
- * Resolve `true` if a TCP connection to `host:port` completes within
- * `timeoutMs`, else `false`. Never rejects — any failure (timeout, refused, DNS)
- * is a `false`, since for transport selection "can't reach it" is the only signal
- * that matters. The socket is always destroyed.
- */
 export declare function probeTcpReachable(host: string, port: number, timeoutMs?: number): Promise<boolean>;
-/**
- * Resolve `true` if a connection to `host:port` completes AND survives a brief
- * grace window (`holdMs`). Stronger than {@link probeTcpReachable} for probing a
- * LOCAL FORWARDER port, where "the port accepts" is not proof the tunnel carries
- * traffic: a forwarder (SSM port-forward, or the userspace-Tailscale SOCKS
- * bridge) binds its local port even when its upstream leg is dead — so a plain
- * connect succeeds while nothing flows. A dead-upstream forwarder accepts the
- * TCP connection and then tears it down SYNCHRONOUSLY (e.g. the Tailscale bridge
- * dials a SOCKS port the daemon isn't on and destroys the client — MESH-2169);
- * measured, that teardown lands in ~1ms.
- *
- * The window is deliberately SMALL — just enough to clear that ~1ms fail-fast
- * teardown. It is NOT a latency budget for the upstream: a real upstream need
- * send no bytes and may itself idle-close a bare connection (Temporal's UI drops
- * an idle HTTP connection at ~50ms; Temporal gRPC and Postgres hold indefinitely).
- * So "closed within ~1ms of connecting" means the forwarder never reached a real
- * upstream; surviving `holdMs` means it did. A larger window would mis-report a
- * healthy-but-idle-closing service (like the Temporal UI) as DOWN. Never rejects;
- * the socket is always destroyed.
- */
 export declare function probeConnectionHolds(host: string, port: number, timeoutMs?: number, holdMs?: number): Promise<boolean>;
-//# sourceMappingURL=reachability.d.ts.map

package/dist/src/utils/reachability.js

@@ -1,21 +1,4 @@
-/**
- * TCP reachability probe for transport selection.
- *
- * `mesh dev`'s VPN detection is otherwise a *presence* check — it asks whether a
- * Tailscale/VPN connection exists, not whether the mesh VPC actually routes. On a
- * machine using Tailscale for SSH (but not the mesh Headscale VPN) that presence
- * check returns true, `mesh dev` picks "VPN-direct", and the worker then dies with
- * `DnsResolutionError` / `ECONNREFUSED` on the Temporal frontend. Dialing the
- * endpoint before committing to VPN-direct turns that tribal-knowledge failure
- * into an automatic SSM fallback (MESH-2016).
- */
 import { createConnection } from "node:net";
-/**
- * Resolve `true` if a TCP connection to `host:port` completes within
- * `timeoutMs`, else `false`. Never rejects — any failure (timeout, refused, DNS)
- * is a `false`, since for transport selection "can't reach it" is the only signal
- * that matters. The socket is always destroyed.
- */
 export function probeTcpReachable(host, port, timeoutMs = 1500) {
     return new Promise((resolve) => {
         let settled = false;
@@ -33,26 +16,6 @@ export function probeTcpReachable(host, port, timeoutMs = 1500) {
         socket.once("error", () => finish(false));
     });
 }
-/**
- * Resolve `true` if a connection to `host:port` completes AND survives a brief
- * grace window (`holdMs`). Stronger than {@link probeTcpReachable} for probing a
- * LOCAL FORWARDER port, where "the port accepts" is not proof the tunnel carries
- * traffic: a forwarder (SSM port-forward, or the userspace-Tailscale SOCKS
- * bridge) binds its local port even when its upstream leg is dead — so a plain
- * connect succeeds while nothing flows. A dead-upstream forwarder accepts the
- * TCP connection and then tears it down SYNCHRONOUSLY (e.g. the Tailscale bridge
- * dials a SOCKS port the daemon isn't on and destroys the client — MESH-2169);
- * measured, that teardown lands in ~1ms.
- *
- * The window is deliberately SMALL — just enough to clear that ~1ms fail-fast
- * teardown. It is NOT a latency budget for the upstream: a real upstream need
- * send no bytes and may itself idle-close a bare connection (Temporal's UI drops
- * an idle HTTP connection at ~50ms; Temporal gRPC and Postgres hold indefinitely).
- * So "closed within ~1ms of connecting" means the forwarder never reached a real
- * upstream; surviving `holdMs` means it did. A larger window would mis-report a
- * healthy-but-idle-closing service (like the Temporal UI) as DOWN. Never rejects;
- * the socket is always destroyed.
- */
 export function probeConnectionHolds(host, port, timeoutMs = 800, holdMs = 25) {
     return new Promise((resolve) => {
         let settled = false;
@@ -68,14 +31,11 @@ export function probeConnectionHolds(host, port, timeoutMs = 800, holdMs = 25) {
             resolve(ok);
         };
         socket.setTimeout(timeoutMs);
-        // Healthy iff the connection survives the grace window after connecting.
         socket.once("connect", () => {
             holdTimer = setTimeout(() => finish(true), holdMs);
         });
-        // Closed before the grace window elapsed → the forwarder's upstream is dead.
         socket.once("close", () => finish(false));
         socket.once("timeout", () => finish(false));
         socket.once("error", () => finish(false));
     });
 }
-//# sourceMappingURL=reachability.js.map