@mesh-tech/mesh-cli 0.20.2 → 0.20.3

package/dist/src/utils/vpn-join.js

@@ -1,20 +1,10 @@
 import { getContextConfig, getValidToken } from "../commands/login.js";
-/**
- * Resolve the broker URL, preferring the platform-published value from
- * discovery (ContextConfig.vpnJoinBroker) and falling back to DNS-convention
- * derivation for platforms not yet redeployed with the payload field.
- */
 export function resolveVpnJoinBroker(context, getCfg = getContextConfig) {
     const cfg = getCfg(context);
     if (cfg?.vpnJoinBroker)
         return cfg.vpnJoinBroker;
     return deriveVpnJoinBroker(context, getCfg);
 }
-/**
- * FALLBACK ONLY. Derive by convention — issuer host `identity.<env>.<domain>`
- * → `vpn-join.<env>.<domain>` — mirroring deriveLoginServer (dev.ts:1479).
- * Prefer resolveVpnJoinBroker, which reads the platform-published URL first.
- */
 export function deriveVpnJoinBroker(context, getCfg = getContextConfig) {
     const cfg = getCfg(context);
     if (!cfg?.issuer)
@@ -29,11 +19,6 @@ export function deriveVpnJoinBroker(context, getCfg = getContextConfig) {
         return null;
     }
 }
-/**
- * Fetch a single-use pre-auth key from the broker. Returns null on ANY failure
- * (no token, non-2xx, network error) so the caller falls back to the browser
- * relay join — the broker path is strictly additive.
- */
 export async function mintPreAuthKey(context, brokerUrl, deps) {
     const token = await deps.getValidToken(context);
     if (!token)
@@ -55,8 +40,6 @@ export async function mintPreAuthKey(context, brokerUrl, deps) {
         return null;
     }
 }
-// Convenience for production callers that use the real login.ts token source.
 export function realMintDeps() {
     return { getValidToken: (c) => getValidToken(c) };
 }
-//# sourceMappingURL=vpn-join.js.map

package/dist/src/utils/vpn.d.ts

@@ -1,62 +1,20 @@
-/**
- * VPN detection utilities
- */
-/**
- * Detect whether a Tailscale VPN connection is active.
- *
- * Uses socket-aware `execTailscaleCmd` so it works in both kernel tun mode
- * (standard socket) and legacy userspace networking (/tmp/tailscale.sock).
- * Returns `true` only when BackendState is "Running" and Self.Online is true.
- * Returns `false` silently on any failure (binary missing, daemon stopped,
- * parse error, missing fields).
- */
 export declare function isVpnConnected(): Promise<boolean>;
-/** Connection details for the Headscale DNS writer sidecar. */
 export interface HeadscaleDnsConfig {
     namespace: string;
     pod: string;
     container: string;
     filePath: string;
 }
-/**
- * Build a HeadscaleDnsConfig from tenant/env, following the same naming
- * convention as `mesh vpn` (⁠{tenant}-{env}-headscale).
- *
- * Pod name, container, and file path are infrastructure conventions that
- * rarely change — override via the optional parameter if they do.
- */
 export declare function headscaleDnsConfig(tenant?: string, env?: string, overrides?: Partial<HeadscaleDnsConfig>): HeadscaleDnsConfig;
 export interface DnsRecord {
     name: string;
     type: "A";
     value: string;
 }
-/**
- * Retrieve the current Tailscale hostname and IP address.
- *
- * Returns `null` when Tailscale is not installed, not running, or not online.
- */
 export declare function getTailscaleInfo(): Promise<{
     hostname: string;
     ip: string;
 } | null>;
-/**
- * Read DNS records from the dns-writer sidecar in the Headscale pod.
- *
- * Throws with an actionable message if kubectl can't reach the pod.
- * Returns an empty array when the file is missing or contains invalid JSON.
- */
 export declare function readDnsRecords(cfg: HeadscaleDnsConfig): DnsRecord[];
-/**
- * Write DNS A records to the dns-writer sidecar in the Headscale pod.
- *
- * Pipes JSON via stdin to avoid shell-escaping issues.
- * Throws with an actionable message if kubectl can't reach the pod.
- */
 export declare function registerDnsRecords(cfg: HeadscaleDnsConfig, records: DnsRecord[]): void;
-/**
- * Remove DNS records whose `name` ends with `suffix` from the Headscale pod.
- * Best-effort: logs a warning on failure instead of throwing.
- */
 export declare function unregisterDnsRecords(cfg: HeadscaleDnsConfig, suffix: string): void;
-//# sourceMappingURL=vpn.d.ts.map

package/dist/src/utils/vpn.js

@@ -1,21 +1,9 @@
-/**
- * VPN detection utilities
- */
 import { execFile, execFileSync } from "node:child_process";
 import { existsSync } from "node:fs";
 const TAILSCALE_PATHS = [
     "tailscale",
     "/Applications/Tailscale.app/Contents/MacOS/Tailscale",
 ];
-/**
- * Detect whether a Tailscale VPN connection is active.
- *
- * Uses socket-aware `execTailscaleCmd` so it works in both kernel tun mode
- * (standard socket) and legacy userspace networking (/tmp/tailscale.sock).
- * Returns `true` only when BackendState is "Running" and Self.Online is true.
- * Returns `false` silently on any failure (binary missing, daemon stopped,
- * parse error, missing fields).
- */
 export async function isVpnConnected() {
     try {
         const stdout = await execTailscaleCmd(["status", "--json"]);
@@ -26,18 +14,7 @@ export async function isVpnConnected() {
         return false;
     }
 }
-// ---------------------------------------------------------------------------
-// DNS record management & Tailscale info
-// ---------------------------------------------------------------------------
-/** Standard socket (kernel tun mode), then legacy (userspace mode). */
 const TAILSCALE_SOCKET_PATHS = ["/var/run/tailscale/tailscaled.sock", "/tmp/tailscale.sock"];
-/**
- * Build a HeadscaleDnsConfig from tenant/env, following the same naming
- * convention as `mesh vpn` (⁠{tenant}-{env}-headscale).
- *
- * Pod name, container, and file path are infrastructure conventions that
- * rarely change — override via the optional parameter if they do.
- */
 export function headscaleDnsConfig(tenant = "mesh", env = "dev", overrides) {
     return {
         namespace: `${tenant}-${env}-headscale`,
@@ -47,10 +24,6 @@ export function headscaleDnsConfig(tenant = "mesh", env = "dev", overrides) {
         ...overrides,
     };
 }
-/**
- * Execute a tailscale CLI command, trying each known binary path.
- * Automatically appends `--socket <path>` when a tailscale socket is found.
- */
 function execTailscaleCmd(args) {
     const socketPath = TAILSCALE_SOCKET_PATHS.find(existsSync);
     const attempts = [];
@@ -80,11 +53,6 @@ function execTailscaleCmd(args) {
         tryNext();
     });
 }
-/**
- * Retrieve the current Tailscale hostname and IP address.
- *
- * Returns `null` when Tailscale is not installed, not running, or not online.
- */
 export async function getTailscaleInfo() {
     try {
         const stdout = await execTailscaleCmd(["status", "--json"]);
@@ -104,19 +72,12 @@ export async function getTailscaleInfo() {
         return null;
     }
 }
-/** Helper: build kubectl exec args for the dns-writer sidecar. */
 function dnsWriterExec(cfg, cmd, interactive = false) {
     return [
         "exec", ...(interactive ? ["-i"] : []),
         "-n", cfg.namespace, cfg.pod, "-c", cfg.container, "--", ...cmd,
     ];
 }
-/**
- * Read DNS records from the dns-writer sidecar in the Headscale pod.
- *
- * Throws with an actionable message if kubectl can't reach the pod.
- * Returns an empty array when the file is missing or contains invalid JSON.
- */
 export function readDnsRecords(cfg) {
     try {
         const raw = execFileSync("kubectl", dnsWriterExec(cfg, ["cat", cfg.filePath]), {
@@ -144,16 +105,9 @@ export function readDnsRecords(cfg) {
         if (msg.includes("No such file")) {
             return [];
         }
-        // Unexpected error — rethrow
         throw err;
     }
 }
-/**
- * Write DNS A records to the dns-writer sidecar in the Headscale pod.
- *
- * Pipes JSON via stdin to avoid shell-escaping issues.
- * Throws with an actionable message if kubectl can't reach the pod.
- */
 export function registerDnsRecords(cfg, records) {
     const json = JSON.stringify(records);
     try {
@@ -166,10 +120,6 @@ export function registerDnsRecords(cfg, records) {
             `Verify kubectl context: kubectl get pods -n ${cfg.namespace}`);
     }
 }
-/**
- * Remove DNS records whose `name` ends with `suffix` from the Headscale pod.
- * Best-effort: logs a warning on failure instead of throwing.
- */
 export function unregisterDnsRecords(cfg, suffix) {
     try {
         const records = readDnsRecords(cfg);
@@ -177,7 +127,5 @@ export function unregisterDnsRecords(cfg, suffix) {
         registerDnsRecords(cfg, filtered);
     }
     catch {
-        // Best-effort cleanup — silent on failure
     }
 }
-//# sourceMappingURL=vpn.js.map

package/dist/src/utils/workflow-fingerprint.d.ts

@@ -1,49 +1,10 @@
-/**
- * Workspace packages whose src the agent/interpreter worker bundles as workflows.
- * MUST stay a subset of the CI replay-gate path filter (`checks.yaml` →
- * `replay-changes`); a drift-guard test asserts it (MESH-2093).
- */
 export declare const WORKFLOW_PACKAGE_DIRS: string[];
-/**
- * Walk up from `startDir` to the monorepo root (the dir with pnpm-workspace.yaml).
- * Falls back to `startDir` if none is found.
- */
 export declare function findRepoRoot(startDir: string): string;
-/**
- * The set of directories whose `.ts` the worker turns into Temporal workflows.
- *
- * Prefers the shared workflow **packages** (agent-sdk / interpreter / contracts)
- * when they exist — the precise, low-noise signal for the monorepo agent/interpreter
- * dev loop. When they're absent (a **tenant repo**), falls back to the app's own
- * worker source (`extraDirs`) so the guard isn't silently inert there (MESH-2093).
- * Only existing dirs are returned.
- */
 export declare function workflowSourceDirs(repoRoot: string, extraDirs?: string[]): string[];
-/**
- * Resolve the worker service(s)' source dirs from a dev-output `services` map, so a
- * tenant repo (no shared workflow packages) still fingerprints the code its worker
- * actually runs. A service is a worker when its name matches `/worker/i` (best
- * effort until dev-output carries a `type: "temporal-worker"` marker — MESH-2093).
- */
 export declare function resolveWorkerSourceDirs(repoRoot: string, services?: Record<string, {
     src?: string;
 }>): string[];
-/**
- * Content fingerprint of every non-test `.ts`/`.tsx` under `dirs`. Stable across
- * runs for identical content; changes iff a workflow source file's content
- * changes. Returns a short hex digest ('' if no files).
- *
- * Each file is labelled by its path relative to `relativeTo` (when given) so the
- * hash is stable across checkout location/renames; falls back to the absolute path
- * otherwise.
- */
 export declare function computeWorkflowFingerprint(dirs: string[], relativeTo?: string): string;
-/**
- * Convenience: fingerprint an app's workflow source. Pass the dev-output `services`
- * map so a tenant repo falls back to its worker source when the shared workflow
- * packages aren't present.
- */
 export declare function fingerprintWorkflowSource(appRoot: string, services?: Record<string, {
     src?: string;
 }>): string;
-//# sourceMappingURL=workflow-fingerprint.d.ts.map

package/dist/src/utils/workflow-fingerprint.js

@@ -1,43 +1,12 @@
-/**
- * Workflow-source fingerprint for relaunch safety (MESH-2017).
- *
- * A `mesh dev` relaunch (or `restart <worker>`) restarts the Temporal worker onto
- * whatever code is current. If the WORKFLOW code changed since the session
- * started, in-flight conversations replay against the new code and — if the change
- * is replay-incompatible — get stranded (observed: conversation 523a4103). The
- * replay-safety gate (MESH-2091) catches this at CI; this catches it at the *local*
- * dev loop, where uncommitted edits haven't been through CI.
- *
- * We fingerprint the source the agent/interpreter worker bundles into Temporal
- * workflows: the workflow packages agent-sdk, workflow-interpreter, agent-contracts
- * (the same set the CI replay-gate path filter covers). A content hash (not mtime)
- * so a `git checkout`/rebase that rewrites mtimes without changing content doesn't
- * produce a false "code changed" warning; paths are hashed repo-root-relative so
- * moving/renaming the checkout doesn't either.
- *
- * NOTE (MESH-2017 follow-up): this covers the shared workflow packages, not a
- * tenant repo's own worker source — `workflowSourceDirs` accepts extra dirs for
- * that, but no caller wires them yet, so in a repo without those packages the
- * fingerprint is empty and the guard is inert. Tracked separately.
- */
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { dirname, isAbsolute, join, relative } from "node:path";
-/**
- * Workspace packages whose src the agent/interpreter worker bundles as workflows.
- * MUST stay a subset of the CI replay-gate path filter (`checks.yaml` →
- * `replay-changes`); a drift-guard test asserts it (MESH-2093).
- */
 export const WORKFLOW_PACKAGE_DIRS = [
     "packages/agent-sdk/src",
     "packages/workflow-interpreter/src",
     "packages/agent-contracts/src",
 ];
 const EXCLUDE = /(^|\/)(node_modules|dist|__tests__)(\/|$)|\.(test|spec)\.[cm]?tsx?$/;
-/**
- * Walk up from `startDir` to the monorepo root (the dir with pnpm-workspace.yaml).
- * Falls back to `startDir` if none is found.
- */
 export function findRepoRoot(startDir) {
     let dir = startDir;
     for (;;) {
@@ -49,27 +18,12 @@ export function findRepoRoot(startDir) {
         dir = parent;
     }
 }
-/**
- * The set of directories whose `.ts` the worker turns into Temporal workflows.
- *
- * Prefers the shared workflow **packages** (agent-sdk / interpreter / contracts)
- * when they exist — the precise, low-noise signal for the monorepo agent/interpreter
- * dev loop. When they're absent (a **tenant repo**), falls back to the app's own
- * worker source (`extraDirs`) so the guard isn't silently inert there (MESH-2093).
- * Only existing dirs are returned.
- */
 export function workflowSourceDirs(repoRoot, extraDirs = []) {
     const pkgDirs = WORKFLOW_PACKAGE_DIRS.map((d) => join(repoRoot, d)).filter((d) => existsSync(d));
     if (pkgDirs.length > 0)
         return pkgDirs;
     return extraDirs.filter((d) => existsSync(d));
 }
-/**
- * Resolve the worker service(s)' source dirs from a dev-output `services` map, so a
- * tenant repo (no shared workflow packages) still fingerprints the code its worker
- * actually runs. A service is a worker when its name matches `/worker/i` (best
- * effort until dev-output carries a `type: "temporal-worker"` marker — MESH-2093).
- */
 export function resolveWorkerSourceDirs(repoRoot, services = {}) {
     const dirs = [];
     for (const [name, svc] of Object.entries(services)) {
@@ -79,15 +33,6 @@ export function resolveWorkerSourceDirs(repoRoot, services = {}) {
     }
     return dirs;
 }
-/**
- * Content fingerprint of every non-test `.ts`/`.tsx` under `dirs`. Stable across
- * runs for identical content; changes iff a workflow source file's content
- * changes. Returns a short hex digest ('' if no files).
- *
- * Each file is labelled by its path relative to `relativeTo` (when given) so the
- * hash is stable across checkout location/renames; falls back to the absolute path
- * otherwise.
- */
 export function computeWorkflowFingerprint(dirs, relativeTo) {
     const files = [];
     for (const dir of dirs) {
@@ -96,7 +41,7 @@ export function computeWorkflowFingerprint(dirs, relativeTo) {
             rels = readdirSync(dir, { recursive: true });
         }
         catch {
-            continue; // dir removed mid-scan
+            continue;
         }
         for (const rel of rels) {
             const p = String(rel);
@@ -117,19 +62,12 @@ export function computeWorkflowFingerprint(dirs, relativeTo) {
             h.update("\0");
         }
         catch {
-            /* unreadable/removed mid-scan — skip */
         }
     }
     return h.digest("hex").slice(0, 16);
 }
-/**
- * Convenience: fingerprint an app's workflow source. Pass the dev-output `services`
- * map so a tenant repo falls back to its worker source when the shared workflow
- * packages aren't present.
- */
 export function fingerprintWorkflowSource(appRoot, services = {}) {
     const repoRoot = findRepoRoot(appRoot);
     const workerDirs = resolveWorkerSourceDirs(repoRoot, services);
     return computeWorkflowFingerprint(workflowSourceDirs(repoRoot, workerDirs), repoRoot);
 }
-//# sourceMappingURL=workflow-fingerprint.js.map

package/dist/src/utils/worktree-identity.d.ts

@@ -1,86 +1,24 @@
-/** Number of distinct port blocks (block 0 reserved for the primary checkout). */
 export declare const NUM_PORT_BLOCKS = 64;
-/** First port of block 1; block 0 uses the app's preferred ports, not this range. */
 export declare const PORT_BLOCK_BASE = 40000;
-/** Ports reserved per worktree block (split into service + tunnel sub-ranges). */
 export declare const PORT_BLOCK_SIZE = 40;
-/** Service ports occupy `[base, base+SERVICE_SUBRANGE)`; tunnels take the rest. */
 export declare const PORT_BLOCK_SERVICE_SUBRANGE = 24;
 export interface WorktreeIdentity {
-    /** Absolute path to this worktree's root (git top-level). */
     worktreeRoot: string;
-    /** True for the repo's primary checkout; false for a linked `git worktree`. */
     isPrimary: boolean;
-    /** Human-readable sanitized basename of the worktree root (e.g. "design-registry"). */
     slug: string;
-    /** 4 hex chars of sha256(worktreeRoot) — disambiguates same-named worktrees. */
     hash: string;
-    /** "" for the primary checkout; else `${slug}-${hash}`. */
     token: string;
-    /** 0 for primary (preferred ports); 1..NUM_PORT_BLOCKS-1 for linked worktrees. */
     portBlock: number;
-    /** "" for primary; else `-${token}` — appended to Temporal/Nexus task queues (Tier 2). */
     taskQueueSuffix: string;
 }
-/** Lowercase, hyphenate, strip non-alphanumerics; never empty. */
 export declare function sanitizeSlug(name: string): string;
-/** Stable 4-hex-char fingerprint of a worktree's absolute path. */
 export declare function worktreeHash(worktreeRoot: string): string;
-/**
- * Map a worktree hash to a port block. Primary → 0 (preferred ports).
- * Linked → deterministic 1..NUM_PORT_BLOCKS-1 (stable across runs for the same
- * worktree path, so ports don't drift between launches).
- */
 export declare function portBlockFor(hash: string, isPrimary: boolean): number;
-/** First port of a block (block 0 has no dedicated range — callers use preferred ports). */
 export declare function blockBasePort(block: number): number;
-/**
- * Identity whose PORT BLOCK is derived from (worktree, app) — every non-port
- * field stays worktree-scoped. A repo can hold several apps whose `mesh dev`
- * sessions run CONCURRENTLY (e.g. scu-mesh-apps' plaid-token-manager +
- * plaid-reporting); with a per-worktree block they draw the same ports, and
- * the availability probe alone races services that are still booting and
- * haven't bound yet — both sessions allocated 41800 in the wild. Same
- * philosophy as the per-worktree blocks of MESH-2013.
- *
- * NOT disjoint by construction: `portBlockFor` buckets a hash into
- * NUM_PORT_BLOCKS-1 slots, so two (worktree, app) pairs CAN land on the same
- * block — and app-scoping raises the entity count from #worktrees to
- * #worktrees x #apps, which makes that likelier. Sibling apps in one worktree
- * (the case this fixes) are disjoint by default; the in-block probe and the
- * ephemeral fallback in `allocatePorts` remain the backstop for a collision.
- *
- * Primary checkouts keep preferred-port semantics (block 0) — sibling apps
- * there still share preferred ports and rely on that probe.
- */
 export declare function withAppScopedPortBlock(wt: WorktreeIdentity, appRoot: string): WorktreeIdentity;
-/**
- * Stack name for `mesh stack init --worktree` (MESH-2013 Slice 3): append the
- * worktree token so concurrent worktrees deploy to distinct stacks. The SSM
- * export paths (`apps/{app}/stacks/{stack}/...`), Temporal namespace
- * (`{tenant}-{stack}-{app}`), and Nexus endpoint name all derive from the stack
- * name, so one discriminator isolates all three. The primary checkout has an
- * empty token → the base name is returned unchanged (it IS the canonical stack).
- */
-/** Max chars of the worktree slug that reach a stack name. Deploy-time surfaces
- * (Temporal namespace `{tenant}-{stack}-{app}`, Nexus endpoint names) have
- * provider length limits, so we cap the human-readable slug here; the 4-hex hash
- * still guarantees uniqueness. (The local-only token — tmux/ports — is uncapped.) */
 export declare const STACK_SLUG_MAX = 16;
 export declare function worktreeStackName(baseName: string, wt: WorktreeIdentity): string;
-/**
- * True when `stackName` would collide across worktrees: we're in a LINKED
- * worktree (non-empty token) but the stack name doesn't carry that token — so a
- * concurrent `pulumi up` from another worktree on the same name hits identical
- * SSM export paths / Temporal namespace. Drives the `mesh deploy` warning.
- */
 export declare function stackNeedsWorktreeIsolation(stackName: string, wt: WorktreeIdentity): boolean;
 type GitRunner = (args: string[], cwd: string) => string;
-/**
- * Resolve the worktree identity for a given cwd. Returns a primary-checkout
- * identity (token "", block 0) when not inside a git repo, so non-repo/edge
- * cases degrade to today's behavior rather than throwing.
- */
 export declare function resolveWorktreeIdentity(cwd?: string, gitRunner?: GitRunner): WorktreeIdentity;
 export {};
-//# sourceMappingURL=worktree-identity.d.ts.map

package/dist/src/utils/worktree-identity.js

@@ -1,42 +1,10 @@
-/**
- * Per-worktree identity for collision-free concurrent `mesh dev` (MESH-2013).
- *
- * Running `mesh dev` in several git worktrees at once collides on ports, tmux
- * session names, tmpdir session state, and env-file dirs — because every one of
- * those derives from the app's Pulumi project name, which is identical across
- * worktrees. This module derives ONE deterministic token per worktree (from its
- * path) that the dev launcher threads through all of those so worktrees can't
- * step on each other.
- *
- * TASK QUEUES are unique by construction — `taskQueueSuffix` is `-${token}` and
- * the token carries the 4-hex path hash. SESSION NAMES are not: the tmux name is
- * `${projectName}-${slug}` (slug only), and the state file + env dir derive from
- * it, so two linked worktrees whose basenames sanitize to the same slug (e.g.
- * `.worktrees/MESH-2375` and `~/scratch/mesh-2375`) share all three. PORTS are
- * not either: the block is a hash bucketed into NUM_PORT_BLOCKS-1 slots and is
- * additionally scoped by app — see `withAppScopedPortBlock` below for what that
- * does and does not guarantee.
- *
- * The PRIMARY checkout (the repo's main working tree) keeps its historical
- * behavior — empty token, port block 0 (preferred ports), no session suffix —
- * so existing muscle memory is preserved. Only LINKED worktrees get offsets.
- *
- * Pure helpers (`sanitizeSlug`, `worktreeHash`, `portBlockFor`, `blockBasePort`)
- * are git-free and unit-tested; `resolveWorktreeIdentity` shells to git via an
- * injectable runner so it can be tested without a real repo.
- */
 import { execFileSync } from "node:child_process";
 import * as crypto from "node:crypto";
 import * as path from "node:path";
-/** Number of distinct port blocks (block 0 reserved for the primary checkout). */
 export const NUM_PORT_BLOCKS = 64;
-/** First port of block 1; block 0 uses the app's preferred ports, not this range. */
 export const PORT_BLOCK_BASE = 40000;
-/** Ports reserved per worktree block (split into service + tunnel sub-ranges). */
 export const PORT_BLOCK_SIZE = 40;
-/** Service ports occupy `[base, base+SERVICE_SUBRANGE)`; tunnels take the rest. */
 export const PORT_BLOCK_SERVICE_SUBRANGE = 24;
-/** Lowercase, hyphenate, strip non-alphanumerics; never empty. */
 export function sanitizeSlug(name) {
     const s = name
         .toLowerCase()
@@ -44,62 +12,24 @@ export function sanitizeSlug(name) {
         .replace(/^-+|-+$/g, "");
     return s || "wt";
 }
-/** Stable 4-hex-char fingerprint of a worktree's absolute path. */
 export function worktreeHash(worktreeRoot) {
     return crypto.createHash("sha256").update(worktreeRoot).digest("hex").slice(0, 4);
 }
-/**
- * Map a worktree hash to a port block. Primary → 0 (preferred ports).
- * Linked → deterministic 1..NUM_PORT_BLOCKS-1 (stable across runs for the same
- * worktree path, so ports don't drift between launches).
- */
 export function portBlockFor(hash, isPrimary) {
     if (isPrimary)
         return 0;
     const n = parseInt(hash, 16);
     return 1 + (n % (NUM_PORT_BLOCKS - 1));
 }
-/** First port of a block (block 0 has no dedicated range — callers use preferred ports). */
 export function blockBasePort(block) {
     return PORT_BLOCK_BASE + block * PORT_BLOCK_SIZE;
 }
-/**
- * Identity whose PORT BLOCK is derived from (worktree, app) — every non-port
- * field stays worktree-scoped. A repo can hold several apps whose `mesh dev`
- * sessions run CONCURRENTLY (e.g. scu-mesh-apps' plaid-token-manager +
- * plaid-reporting); with a per-worktree block they draw the same ports, and
- * the availability probe alone races services that are still booting and
- * haven't bound yet — both sessions allocated 41800 in the wild. Same
- * philosophy as the per-worktree blocks of MESH-2013.
- *
- * NOT disjoint by construction: `portBlockFor` buckets a hash into
- * NUM_PORT_BLOCKS-1 slots, so two (worktree, app) pairs CAN land on the same
- * block — and app-scoping raises the entity count from #worktrees to
- * #worktrees x #apps, which makes that likelier. Sibling apps in one worktree
- * (the case this fixes) are disjoint by default; the in-block probe and the
- * ephemeral fallback in `allocatePorts` remain the backstop for a collision.
- *
- * Primary checkouts keep preferred-port semantics (block 0) — sibling apps
- * there still share preferred ports and rely on that probe.
- */
 export function withAppScopedPortBlock(wt, appRoot) {
     if (wt.isPrimary)
         return wt;
     const appHash = worktreeHash(`${wt.worktreeRoot}#${path.resolve(appRoot)}`);
     return { ...wt, portBlock: portBlockFor(appHash, false) };
 }
-/**
- * Stack name for `mesh stack init --worktree` (MESH-2013 Slice 3): append the
- * worktree token so concurrent worktrees deploy to distinct stacks. The SSM
- * export paths (`apps/{app}/stacks/{stack}/...`), Temporal namespace
- * (`{tenant}-{stack}-{app}`), and Nexus endpoint name all derive from the stack
- * name, so one discriminator isolates all three. The primary checkout has an
- * empty token → the base name is returned unchanged (it IS the canonical stack).
- */
-/** Max chars of the worktree slug that reach a stack name. Deploy-time surfaces
- * (Temporal namespace `{tenant}-{stack}-{app}`, Nexus endpoint names) have
- * provider length limits, so we cap the human-readable slug here; the 4-hex hash
- * still guarantees uniqueness. (The local-only token — tmux/ports — is uncapped.) */
 export const STACK_SLUG_MAX = 16;
 export function worktreeStackName(baseName, wt) {
     if (!wt.token)
@@ -107,37 +37,20 @@ export function worktreeStackName(baseName, wt) {
     const cappedSlug = wt.slug.slice(0, STACK_SLUG_MAX).replace(/-+$/, "");
     return `${baseName}-${cappedSlug}-${wt.hash}`;
 }
-/**
- * True when `stackName` would collide across worktrees: we're in a LINKED
- * worktree (non-empty token) but the stack name doesn't carry that token — so a
- * concurrent `pulumi up` from another worktree on the same name hits identical
- * SSM export paths / Temporal namespace. Drives the `mesh deploy` warning.
- */
 export function stackNeedsWorktreeIsolation(stackName, wt) {
-    // The 4-hex hash is the stable discriminator present in every worktree stack
-    // name (`worktreeStackName` ends with `-${hash}`), and survives the slug cap —
-    // so match on it rather than the full (uncapped) token.
     return !!wt.token && !stackName.endsWith(`-${wt.hash}`);
 }
 const defaultGitRunner = (args, cwd) => execFileSync("git", args, { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim();
-/**
- * Resolve the worktree identity for a given cwd. Returns a primary-checkout
- * identity (token "", block 0) when not inside a git repo, so non-repo/edge
- * cases degrade to today's behavior rather than throwing.
- */
 export function resolveWorktreeIdentity(cwd = process.cwd(), gitRunner = defaultGitRunner) {
     let worktreeRoot;
     let isPrimary = true;
     try {
         worktreeRoot = path.resolve(gitRunner(["rev-parse", "--show-toplevel"], cwd));
-        // The common git dir is `<primary-worktree>/.git`; its parent is the primary
-        // checkout. A linked worktree's top-level differs from that parent.
         const commonDir = gitRunner(["rev-parse", "--git-common-dir"], cwd);
         const primaryRoot = path.resolve(path.dirname(path.resolve(cwd, commonDir)));
         isPrimary = worktreeRoot === primaryRoot;
     }
     catch {
-        // Not a git repo (or git unavailable) — behave as the primary checkout.
         return {
             worktreeRoot: path.resolve(cwd),
             isPrimary: true,
@@ -161,4 +74,3 @@ export function resolveWorktreeIdentity(cwd = process.cwd(), gitRunner = default
         taskQueueSuffix: token ? `-${token}` : "",
     };
 }
-//# sourceMappingURL=worktree-identity.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mesh-tech/mesh-cli",
-  "version": "0.20.2",
+  "version": "0.20.3",
   "description": "CLI for Mesh platform development utilities",
   "type": "module",
   "license": "UNLICENSED",