@mesh-tech/mesh-cli 0.20.2 → 0.20.3

package/dist/src/commands/db/exec.js

@@ -1,37 +1,3 @@
-/**
- * mesh db exec - Run any command with database connection
- *
- * Three modes of operation:
- *
- * 1. Explicit mode (recommended for ad-hoc use):
- *    mesh db exec --tenant=<tenant> --env=<env> [--ssl=require] -- <command>
- *    - Uses explicit tenant/env to find platform bastion
- *    - Starts tunnel if needed
- *    - Similar to: mesh tunnel --tenant mesh --env dev
- *
- * 2. Direct mode (for sst dev integration):
- *    mesh db exec --secret=<arn> [--ssl=require] -- <command>
- *    - Uses secret ARN directly, expects tunnel already running
- *    - Ideal for sst.config.ts devCommand
- *
- * 3. Discovery mode (legacy, auto-detection):
- *    mesh db exec [--stage=<stage>] -- <command>
- *    - Auto-discovers tenant/env from filesystem and config files
- *    - Can be fragile if project structure doesn't match expected patterns
- *    - Starts tunnel if needed
- *
- * Examples:
- *   # Explicit mode (recommended)
- *   mesh db exec --tenant mesh --env dev --ssl=require -- npx prisma db push
- *   mesh db exec -t mesh -e dev -- npx prisma migrate dev
- *
- *   # Direct mode (in sst.config.ts)
- *   mesh db exec --secret=arn:aws:secretsmanager:... --ssl=require -- pnpm dev
- *
- *   # Discovery mode (legacy)
- *   mesh db exec -- npx prisma db push
- *   mesh db exec --stage=dev -- npx prisma migrate dev
- */
 import { spawn } from "child_process";
 import * as net from "net";
 import * as fs from "fs";
@@ -41,9 +7,6 @@ import { detectContext, getPlatformBastionInfo, getDatabaseUrl, rewriteDatabaseU
 const DEFAULT_LOCAL_PORT = 5432;
 const MAX_RETRIES = 12;
 const RETRY_DELAY_MS = 5000;
-/**
- * Find SST outputs by looking in current and parent directories.
- */
 function findSstOutputs() {
     let dir = process.cwd();
     const root = path.parse(dir).root;
@@ -67,7 +30,6 @@ function findSstOutputs() {
                 }
             }
             catch {
-                // Ignore parse errors, continue searching
             }
         }
         dir = path.dirname(dir);
@@ -117,9 +79,6 @@ async function startTunnelBackground(instanceId, rdsEndpoint, rdsPort, localPort
     tunnel.kill();
     throw new Error(`Tunnel failed to start after ${maxAttempts} seconds`);
 }
-/**
- * Fetch secret from Secrets Manager with retry logic for provisioning delays.
- */
 async function fetchSecretWithRetry(client, secretId) {
     let lastError;
     for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) {
@@ -169,12 +128,8 @@ export async function execCommand(commandArgs, options) {
     const secretsManager = new SecretsManagerClient({});
     let tunnel = null;
     let databaseUrl;
-    // ==========================================================================
-    // Direct mode: --secret provided, use it directly
-    // ==========================================================================
     if (options.secret) {
         logInfo(`Direct mode: using secret ${options.secret}`);
-        // Check if tunnel is running
         const tunnelExists = await checkPort(localPort);
         if (!tunnelExists) {
             logError(`No tunnel found on port ${localPort}`);
@@ -183,16 +138,13 @@ export async function execCommand(commandArgs, options) {
             process.exit(1);
         }
         logSuccess(`Using existing tunnel on port ${localPort}`);
-        // Fetch secret
         logInfo(`Fetching credentials from secret...`);
         const secret = await fetchSecretWithRetry(secretsManager, options.secret);
-        // Secret should contain DATABASE_URL directly (new format)
         if (secret.DATABASE_URL) {
             databaseUrl = secret.DATABASE_URL;
             logSuccess("Got DATABASE_URL from secret");
         }
         else if (secret.username && secret.password) {
-            // Legacy format with individual fields
             const dbName = secret.dbname ?? secret.database ?? "postgres";
             databaseUrl = `postgresql://${secret.username}:${encodeURIComponent(secret.password)}@localhost:${localPort}/${dbName}`;
             logSuccess(`Got credentials for user: ${secret.username}`);
@@ -201,12 +153,10 @@ export async function execCommand(commandArgs, options) {
             logError("Secret must contain DATABASE_URL or username/password fields");
             process.exit(1);
         }
-        // Rewrite DATABASE_URL for local tunnel
         try {
             const parsed = new URL(databaseUrl);
             parsed.hostname = "localhost";
             parsed.port = String(localPort);
-            // Apply SSL mode if specified
             if (options.ssl) {
                 parsed.searchParams.set("sslmode", options.ssl);
                 if (options.ssl === "require" || options.ssl === "no-verify") {
@@ -219,34 +169,26 @@ export async function execCommand(commandArgs, options) {
             logWarn("Could not parse DATABASE_URL for rewriting");
         }
     }
-    // ==========================================================================
-    // Discovery mode: find credentials via SSM lookups
-    // ==========================================================================
     else {
-        // Use explicit --tenant/--env if provided, otherwise fall back to detectContext
         let platformTenant;
         let platformEnv;
         if (options.tenant && options.env) {
-            // Explicit mode: use provided tenant/env directly (like tunnel command)
             platformTenant = options.tenant;
             platformEnv = options.env;
             logInfo(`Explicit mode: Platform Tenant=${platformTenant}, Platform Env=${platformEnv}`);
         }
         else if (options.tenant || options.env) {
-            // Partial explicit mode - warn and require both
             logError("Both --tenant and --env are required when using explicit mode");
             logInfo("Usage: mesh db exec --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev -- <command>");
             logInfo("Or omit both to use auto-detection");
             process.exit(1);
         }
         else {
-            // Auto-detection mode (legacy behavior)
             const ctx = detectContext();
             platformTenant = ctx.tenant;
             platformEnv = ctx.platformEnv;
             logInfo(`Discovery mode: Platform=${platformEnv}, Tenant=${platformTenant}`);
         }
-        // For credentials, use app-specific options if provided, else fall back to platform values
         const appTenant = options.appTenant ?? platformTenant;
         const appStage = options.appStage ?? platformEnv;
         const appName = options.app;
@@ -254,7 +196,6 @@ export async function execCommand(commandArgs, options) {
             logInfo(`App credentials: tenant=${appTenant}, stage=${appStage}, app=${appName}`);
         }
         const tunnelExists = await checkPort(localPort);
-        // Try SST outputs first (fast path when sst dev is running)
         const sstOutputs = findSstOutputs();
         if (sstOutputs?.secretArn && tunnelExists) {
             logInfo(`Found SST outputs in: ${sstOutputs.rootDir}`);
@@ -272,9 +213,7 @@ export async function execCommand(commandArgs, options) {
                 logWarn("Could not fetch from SST outputs, falling back to credential lookup");
             }
         }
-        // Lookup credentials from Secrets Manager if not found in SST outputs
         if (!databaseUrl) {
-            // Start tunnel if needed
             if (!tunnelExists) {
                 const bastion = await getPlatformBastionInfo(platformTenant, platformEnv);
                 const rdsService = bastion.services.rds;
@@ -286,7 +225,6 @@ export async function execCommand(commandArgs, options) {
             else {
                 logSuccess(`Using existing tunnel on port ${localPort}`);
             }
-            // Get DATABASE_URL and rewrite for tunnel
             const rawUrl = await getDatabaseUrl(appTenant, appStage, { app: appName });
             databaseUrl = rewriteDatabaseUrl(rawUrl, {
                 endpoint: `localhost:${localPort}`,
@@ -294,17 +232,11 @@ export async function execCommand(commandArgs, options) {
             });
         }
     }
-    // ==========================================================================
-    // Set NODE_TLS_REJECT_UNAUTHORIZED for SSL through tunnels
-    // ==========================================================================
     const env = { ...process.env, DATABASE_URL: databaseUrl };
     if (options.ssl === "require" || options.ssl === "no-verify") {
         env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
         logInfo("Set NODE_TLS_REJECT_UNAUTHORIZED=0 for SSL through tunnel");
     }
-    // ==========================================================================
-    // Cleanup and run command
-    // ==========================================================================
     const cleanup = () => {
         if (tunnel) {
             logInfo("Stopping tunnel...");
@@ -328,4 +260,3 @@ export async function execCommand(commandArgs, options) {
         process.exit(1);
     });
 }
-//# sourceMappingURL=exec.js.map

package/dist/src/commands/db/index.d.ts

@@ -1,12 +1,2 @@
-/**
- * Database commands
- *
- * mesh db connect     - Start tunnel for manual psql access
- * mesh db credentials - Print database credentials
- * mesh db env         - Export DATABASE_URL for shell
- * mesh db psql        - Connect to database via psql
- * mesh db exec        - Run any command with database connection
- */
 import { Command } from "commander";
 export declare function registerDbCommands(program: Command): void;
-//# sourceMappingURL=index.d.ts.map

package/dist/src/commands/db/index.js

@@ -1,12 +1,3 @@
-/**
- * Database commands
- *
- * mesh db connect     - Start tunnel for manual psql access
- * mesh db credentials - Print database credentials
- * mesh db env         - Export DATABASE_URL for shell
- * mesh db psql        - Connect to database via psql
- * mesh db exec        - Run any command with database connection
- */
 import { connectCommand } from "./connect.js";
 import { credentialsCommand } from "./credentials.js";
 import { envCommand } from "./env.js";
@@ -59,4 +50,3 @@ export function registerDbCommands(program) {
         .argument("<command...>", "Command and arguments to run")
         .action(execCommand);
 }
-//# sourceMappingURL=index.js.map

package/dist/src/commands/db/psql.d.ts

@@ -1,9 +1,3 @@
-/**
- * mesh db psql - Connect to database with psql
- *
- * Usage:
- *   mesh db psql --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev
- */
 interface PsqlOptions {
     tenant?: string;
     env?: string;
@@ -13,4 +7,3 @@ interface PsqlOptions {
 }
 export declare function psqlCommand(options: PsqlOptions): Promise<void>;
 export {};
-//# sourceMappingURL=psql.d.ts.map

package/dist/src/commands/db/psql.js

@@ -1,15 +1,6 @@
-/**
- * mesh db psql - Connect to database with psql
- *
- * Usage:
- *   mesh db psql --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev
- */
 import { spawn } from "child_process";
 import * as net from "net";
 import { detectContext, getPlatformBastionInfo, getDatabaseUrl, logInfo, logSuccess, logError, } from "../../utils/index.js";
-/**
- * Start SSM tunnel in background and wait for it to be ready.
- */
 async function startTunnelBackground(instanceId, rdsHost, rdsPort, localPort) {
     logInfo("Starting tunnel in background...");
     const tunnel = spawn("aws", [
@@ -26,7 +17,6 @@ async function startTunnelBackground(instanceId, rdsHost, rdsPort, localPort) {
             localPortNumber: [String(localPort)],
         }),
     ], { stdio: ["ignore", "ignore", "ignore"] });
-    // Wait for tunnel to be ready (port listening)
     const maxAttempts = 15;
     for (let attempt = 0; attempt < maxAttempts; attempt++) {
         if (tunnel.exitCode !== null) {
@@ -56,7 +46,6 @@ function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
 export async function psqlCommand(options) {
-    // Resolve platform tenant/env
     let platformTenant;
     let platformEnv;
     if (options.tenant && options.env) {
@@ -75,14 +64,12 @@ export async function psqlCommand(options) {
         platformEnv = ctx.platformEnv;
         logInfo(`Auto-detected: Tenant=${platformTenant}, Env=${platformEnv}`);
     }
-    // Resolve app credentials
     const appTenant = options.appTenant ?? platformTenant;
     const appStage = options.appStage ?? platformEnv;
     const appName = options.app;
     if (appName) {
         logInfo(`App credentials: tenant=${appTenant}, stage=${appStage}, app=${appName}`);
     }
-    // Check for psql
     const psqlCheck = spawn("which", ["psql"]);
     await new Promise((resolve, reject) => {
         psqlCheck.on("exit", (code) => {
@@ -95,7 +82,6 @@ export async function psqlCommand(options) {
             }
         });
     });
-    // Get bastion and start tunnel
     const bastion = await getPlatformBastionInfo(platformTenant, platformEnv);
     const rdsService = bastion.services.rds;
     if (!rdsService) {
@@ -103,7 +89,6 @@ export async function psqlCommand(options) {
         process.exit(1);
     }
     const tunnel = await startTunnelBackground(bastion.instanceId, rdsService.host, rdsService.port, 5432);
-    // Cleanup on exit
     const cleanup = () => {
         logInfo("Stopping tunnel...");
         tunnel.kill();
@@ -111,7 +96,6 @@ export async function psqlCommand(options) {
     process.on("exit", cleanup);
     process.on("SIGINT", cleanup);
     process.on("SIGTERM", cleanup);
-    // Get DATABASE_URL and parse credentials
     const databaseUrl = await getDatabaseUrl(appTenant, appStage, { app: appName });
     const parsed = new URL(databaseUrl);
     const username = parsed.username;
@@ -120,7 +104,6 @@ export async function psqlCommand(options) {
     console.log("");
     logInfo(`Connecting to ${database} as ${username}...`);
     console.log("");
-    // Run psql
     const psql = spawn("psql", ["-h", "localhost", "-p", "5432", "-U", username, "-d", database], {
         stdio: "inherit",
         env: { ...process.env, PGPASSWORD: password },
@@ -130,4 +113,3 @@ export async function psqlCommand(options) {
         process.exit(code ?? 0);
     });
 }
-//# sourceMappingURL=psql.js.map

package/dist/src/commands/deploy.d.ts

@@ -1,43 +1,5 @@
-/**
- * mesh deploy — Pulumi passthrough with automatic deployer role assumption.
- *
- * Credential resolution order:
- *   1. If AWS credentials already in environment (CI/CD) → use directly
- *   2. If ~/.config/mesh/credentials.json has a valid token for the
- *      platform context → AssumeRoleWithWebIdentity (Zitadel JWT)
- *   3. Fallback → AssumeRole via current AWS session (SSO)
- *
- * The platform context (e.g., "mesh.dev") is derived from `mesh:platform`
- * in the Pulumi stack config file (read directly from YAML, no AWS needed).
- *
- * Setup:
- *   pulumi config set mesh:deployerRole arn:aws:iam::123456789012:role/acme-dev-apps-deployer
- *
- * Examples:
- *   mesh deploy preview
- *   mesh deploy up --yes
- *   mesh deploy stack output dev --json
- *   mesh deploy destroy
- */
 import { Command } from "commander";
-/**
- * Build the pulumi arg list from the user's (stack-stripped) `mesh deploy` args.
- * Defaults to `up` when no subcommand is given, then appends the resolved
- * `-s <stack>` ONLY for ops that accept it — never for no-stack ops (`whoami`,
- * `version`, `plugin`) or positional-stack lifecycle ops (`stack rm <name>`),
- * which a forced `-s` used to break. Pure — unit-tested.
- */
 export declare function buildPulumiArgs(pulumiArgs: string[], stack: string): string[];
-/**
- * Parse --stack or -s from the args array.
- */
 export declare function parseStackFromArgs(args: string[]): string | null;
-/**
- * Remove `--stack`/`-s` (and its value) from the args — it is mesh's stack
- * SELECTOR (picks the target + which deployer role to assume), not a pulumi flag
- * to forward verbatim. `buildPulumiArgs` re-adds a `-s` only for ops that accept
- * one, so ops like `whoami` don't receive a rejected `--stack`.
- */
 export declare function stripStackFromArgs(args: string[]): void;
 export declare function registerDeployCommand(program: Command): void;
-//# sourceMappingURL=deploy.d.ts.map

package/dist/src/commands/deploy.js

@@ -1,52 +1,15 @@
-/**
- * mesh deploy — Pulumi passthrough with automatic deployer role assumption.
- *
- * Credential resolution order:
- *   1. If AWS credentials already in environment (CI/CD) → use directly
- *   2. If ~/.config/mesh/credentials.json has a valid token for the
- *      platform context → AssumeRoleWithWebIdentity (Zitadel JWT)
- *   3. Fallback → AssumeRole via current AWS session (SSO)
- *
- * The platform context (e.g., "mesh.dev") is derived from `mesh:platform`
- * in the Pulumi stack config file (read directly from YAML, no AWS needed).
- *
- * Setup:
- *   pulumi config set mesh:deployerRole arn:aws:iam::123456789012:role/acme-dev-apps-deployer
- *
- * Examples:
- *   mesh deploy preview
- *   mesh deploy up --yes
- *   mesh deploy stack output dev --json
- *   mesh deploy destroy
- */
 import { execFileSync } from "child_process";
 import { logError, logWarn } from "../utils/log.js";
 import { findAppRoot, getCurrentStack, readStackConfig } from "../utils/pulumi.js";
 import { resolvePulumiEnv } from "../utils/pulumi-run.js";
 import { assertDeployDepsFresh } from "../utils/deploy-preflight.js";
 import { resolveWorktreeIdentity, stackNeedsWorktreeIsolation } from "../utils/worktree-identity.js";
-// =============================================================================
-// Helpers
-// =============================================================================
-// Pulumi ops that take no `-s/--stack` at all — appending one makes pulumi
-// reject the command ("unknown flag: --stack").
 const OPS_WITHOUT_STACK_FLAG = new Set([
     "whoami", "version", "plugin", "login", "logout", "about", "org", "env", "help",
 ]);
-// `pulumi stack <sub>` subcommands whose stack is a POSITIONAL arg (or none),
-// so `-s` either conflicts ("only one of --stack or argument stack name") or is
-// rejected. `stack output`/`export`/`import`/`history` DO take `-s`, so they are
-// deliberately absent here and get the flag.
 const STACK_SUBCOMMANDS_WITHOUT_FLAG = new Set([
     "rm", "select", "init", "rename", "unselect", "ls",
 ]);
-/**
- * Build the pulumi arg list from the user's (stack-stripped) `mesh deploy` args.
- * Defaults to `up` when no subcommand is given, then appends the resolved
- * `-s <stack>` ONLY for ops that accept it — never for no-stack ops (`whoami`,
- * `version`, `plugin`) or positional-stack lifecycle ops (`stack rm <name>`),
- * which a forced `-s` used to break. Pure — unit-tested.
- */
 export function buildPulumiArgs(pulumiArgs, stack) {
     const base = pulumiArgs.length === 0 || pulumiArgs[0]?.startsWith("-")
         ? ["up", ...pulumiArgs]
@@ -57,9 +20,6 @@ export function buildPulumiArgs(pulumiArgs, stack) {
         !(op === "stack" && STACK_SUBCOMMANDS_WITHOUT_FLAG.has(base[1] ?? ""));
     return takesStackFlag ? [...base, "-s", stack] : base;
 }
-/**
- * Parse --stack or -s from the args array.
- */
 export function parseStackFromArgs(args) {
     for (let i = 0; i < args.length; i++) {
         if (args[i] === "--stack" || args[i] === "-s") {
@@ -71,12 +31,6 @@ export function parseStackFromArgs(args) {
     }
     return null;
 }
-/**
- * Remove `--stack`/`-s` (and its value) from the args — it is mesh's stack
- * SELECTOR (picks the target + which deployer role to assume), not a pulumi flag
- * to forward verbatim. `buildPulumiArgs` re-adds a `-s` only for ops that accept
- * one, so ops like `whoami` don't receive a rejected `--stack`.
- */
 export function stripStackFromArgs(args) {
     for (let i = args.length - 1; i >= 0; i--) {
         if (args[i] === "--stack" || args[i] === "-s") {
@@ -87,29 +41,20 @@ export function stripStackFromArgs(args) {
         }
     }
 }
-// =============================================================================
-// Command
-// =============================================================================
 export function registerDeployCommand(program) {
     program
         .command("deploy")
         .description("Run pulumi with the app's deployer role (passthrough)")
         .allowUnknownOption(true)
         .allowExcessArguments(true)
-        .helpOption(false) // Don't consume --help, pass it to pulumi
+        .helpOption(false)
         .action(async (_opts, cmd) => {
         const pulumiArgs = cmd.args;
-        // Find app root
         const appRoot = findAppRoot(process.cwd());
         if (!appRoot) {
             logError("No Pulumi.yaml found. Run from within a Pulumi app directory.");
             process.exit(1);
         }
-        // Determine the stack to credential against — from --stack/-s (mesh's
-        // selector), else the currently-selected stack — then STRIP it from the
-        // args. `buildPulumiArgs` re-adds `-s <stack>` only for ops that accept it,
-        // so ops with a positional stack (`stack rm <name>`) or none (`whoami`)
-        // aren't broken by a forced/rejected `-s`.
         const stack = parseStackFromArgs(pulumiArgs) ?? getCurrentStack(appRoot);
         stripStackFromArgs(pulumiArgs);
         if (!stack) {
@@ -118,17 +63,7 @@ export function registerDeployCommand(program) {
                 "  - Create a personal dev stack first: mesh stack init (it prints the exact --stack command)");
             process.exit(1);
         }
-        // Worktree-collision guard (MESH-2013 Slice 3): a personal deploy:false
-        // stack whose name carries no worktree token collides with the same stack
-        // deployed from another worktree — identical SSM export paths
-        // (ParameterAlreadyExists) and Temporal namespace. Warn on mutating ops
-        // from a LINKED worktree so the failure names itself before pulumi hits it.
         const op = pulumiArgs.length === 0 || pulumiArgs[0]?.startsWith("-") ? "up" : pulumiArgs[0];
-        // Stale-node_modules guard (MESH-2266): before evaluating the pulumi program,
-        // verify the installed @mesh-tech/* deps match the lockfile. A stale install
-        // makes pulumi evaluate OLD component code and can plan to DELETE resources
-        // the current code keeps. Hard-stops with `pnpm install` on mismatch; a no-op
-        // for read-only ops, a fresh install, a non-pnpm repo, or the skip env.
         assertDeployDepsFresh(appRoot, op ?? "up");
         if (op === "up" || op === "destroy") {
             const wt = resolveWorktreeIdentity(appRoot);
@@ -141,17 +76,10 @@ export function registerDeployCommand(program) {
                     `  Continuing with "${stack}" — pass --stack to target a different one.`);
             }
         }
-        // Login preflight + deployer-role assumption (shared chokepoint,
-        // MESH-2085): resolves creds with a clear "run mesh login --device"
-        // message on an expired/absent session, instead of failing deep in pulumi.
         const credEnv = await resolvePulumiEnv({ appRoot, stack });
-        // Build environment — inherit current env, override AWS creds,
-        // remove AWS_PROFILE so the assumed creds are used
         const env = { ...process.env, ...credEnv };
         delete env.AWS_PROFILE;
-        // Default to "up" when no Pulumi subcommand is provided
         const finalArgs = buildPulumiArgs(pulumiArgs, stack);
-        // Exec pulumi with the assumed role, targeting the resolved stack
         try {
             execFileSync("pulumi", finalArgs, {
                 cwd: appRoot,
@@ -160,10 +88,7 @@ export function registerDeployCommand(program) {
             });
         }
         catch (err) {
-            // execFileSync throws on non-zero exit. The output was already
-            // printed via stdio: "inherit", so just exit with the same code.
             process.exit(err.status ?? 1);
         }
     });
 }
-//# sourceMappingURL=deploy.js.map

package/dist/src/commands/dev-doctor.d.ts

@@ -1,16 +1,3 @@
-/**
- * `mesh dev doctor` — preflight + on-demand diagnosis for `mesh dev`.
- *
- * Three layers kept deliberately separate so the bug-prone logic stays pure and
- * unit-testable without network/AWS:
- *   1. Engine + renderers (this section): `aggregateStatus`, `runChecks`,
- *      `renderHuman`, `renderJson`.
- *   2. `DoctorContext` builder (resolves role/context/session once).
- *   3. The individual `Check`s (creds, tunnels, ports, …), each returning data.
- *
- * Both `mesh dev doctor` and the `mesh dev` launch preflight call `runChecks`;
- * see MESH-2015 (docs/superpowers/specs/2026-07-08-mesh-dev-doctor-design.md).
- */
 import type { SessionState } from "./dev.js";
 import type { ResolvedAwsCreds } from "../utils/aws-auth.js";
 import { type CredProbe } from "./login.js";
@@ -18,30 +5,16 @@ export type CheckStatus = "ok" | "warn" | "error";
 export type CheckPhase = "preflight" | "ondemand";
 export interface CheckResult {
     status: CheckStatus;
-    /** One line, present tense. */
     summary: string;
-    /** Exact command that fixes it (rendered indented under the summary). */
     remediation?: string;
-    /** Optional extra context (PID, TTL, path, …). */
     detail?: string;
 }
-/**
- * One diagnostic. `C` is the context the check reads: `DoctorContext` for
- * `mesh dev doctor` (the default), `AppCheckContext` for `mesh app check` —
- * the engine below is shared, only the context differs.
- */
 export interface Check<C = DoctorContext> {
-    /** Stable slug, e.g. `creds`, `tunnels`. */
     id: string;
-    /** Human label. */
     title: string;
-    /** Which contexts this check runs in. */
     phases: CheckPhase[];
-    /** `phase` is the context of THIS run — checks may bound work tighter in
-     * `preflight` (launch path) than in on-demand `mesh dev doctor`. */
     run(ctx: C, phase?: CheckPhase): Promise<CheckResult>;
 }
-/** What the renderers need from a check: its identity, not its `run`. */
 export type CheckOutcome = {
     check: Pick<Check<unknown>, "id" | "title">;
     result: CheckResult;
@@ -50,30 +23,18 @@ export interface DoctorContext {
     appRoot: string;
     stack: string;
     sessionName: string;
-    /** Resolved deployer role ARN (incl. admin selection), or null if none. */
     deployerRole: string | null;
-    /** `derivePlatformContext()` result (the Zitadel context), or null. */
     platformContext: string | null;
-    /** How creds were obtained at launch; null when the probe determines it. */
     credMethod: ResolvedAwsCreds["method"] | "ambient" | null;
-    /** Live session state (allocated ports, tunnels); null pre-launch. */
     sessionState: SessionState | null;
 }
-/** `error` if any error, else `warn` if any warn, else `ok` (empty → `ok`). */
 export declare function aggregateStatus(results: CheckResult[]): CheckStatus;
-/**
- * Run every check whose `phases` includes `phase`, concurrently. A check that
- * throws is captured as an `error` result rather than aborting the run — the
- * whole point of doctor is to report, never to crash.
- */
 export declare function runChecks<C = DoctorContext>(ctx: C, phase: CheckPhase, checks: Check<C>[]): Promise<Array<{
     check: Check<C>;
     result: CheckResult;
 }>>;
 export declare const ICONS: Record<CheckStatus, string>;
-/** Human-readable: one line per check + indented remediation when present. */
 export declare function renderHuman(results: CheckOutcome[]): string;
-/** The JSON report as data — `renderJson` serialises it; `mesh app check` nests one per app. */
 export declare function jsonReport(results: CheckOutcome[]): {
     status: CheckStatus;
     checks: Array<{
@@ -84,70 +45,27 @@ export declare function jsonReport(results: CheckOutcome[]): {
         detail: string | null;
     }>;
 };
-/** Machine-readable: stable key shape for tooling / future CI. */
 export declare function renderJson(results: CheckOutcome[]): string;
-/**
- * Pure mapper: a `CredProbe` → a `CheckResult` with the exact remediation.
- * `headless` selects the device-flow `mesh login` variant (browser flow times
- * out over SSH/tailscale — see the credential runbook).
- */
 export declare function credProbeToResult(probe: CredProbe, context: string, headless: boolean): CheckResult;
 export declare const credsCheck: Check;
-/**
- * Verify the @mesh-tech CodeArtifact token actually works BEFORE long work —
- * an expired token otherwise surfaces minutes later as npm's generic E401
- * ("try npm login", which cannot fix a CodeArtifact registry). Warn-level:
- * `mesh dev` itself runs installed code, so a stale token shouldn't block
- * launch — it should name the fix.
- */
 export declare const registryCheck: Check;
-/**
- * Parse `lsof -ti :PORT` + `ps -o comm= -p PID` output into the squatting
- * process. `lsof` may list several PIDs (one per line); we name the first.
- */
 export declare function parsePortSquatter(lsofOut: string, psOut: string): {
     pid: number;
     command: string;
 } | null;
-/** True when `serviceSrc` lives under (or equals) `repoRoot`. */
 export declare function sharesWorktreeRoot(serviceSrc: string, repoRoot: string): boolean;
-/** How a service port relates to the live session that should own it. */
 export type PortOwnership = "owned" | "foreign" | "dead";
-/**
- * Pure classification for the on-demand ports check. Given the PID currently
- * listening on a service port (`null` when nothing is) and the set of PIDs in
- * the live session's tmux process tree:
- *   - `null` listener            → `dead`    (the service isn't running)
- *   - listener in the session    → `owned`   (healthy — the session's own svc)
- *   - listener outside it        → `foreign` (a real squatter)
- * Mid-session the session's services are *supposed* to hold their ports, so a
- * naive "occupied ⇒ squatted" test misreports a healthy session (MESH-2015).
- */
 export declare function classifyPortListener(listenerPid: number | null, sessionPids: ReadonlySet<number>): PortOwnership;
-/**
- * Pure: expand tmux pane PIDs to the full set of PIDs in their process
- * subtrees, using the output of `ps -eo pid=,ppid=` (each line "PID PPID").
- * The roots themselves are included; unparseable lines are skipped.
- */
 export declare function collectSessionPids(panePids: number[], psOut: string): Set<number>;
 export declare const tmuxCheck: Check;
 export declare const portsCheck: Check;
-/** True when the stack config file changed after the session was launched. */
 export declare function isConfigStale(configMtimeMs: number, startedAtIso: string): boolean;
 export declare const configStalenessCheck: Check;
 export declare const worktreeCheck: Check;
-/** Resolve `true` iff a TCP connection to host:port succeeds within `timeoutMs`. */
 export declare function canConnect(host: string, port: number, timeoutMs?: number): Promise<boolean>;
 export declare const tunnelsCheck: Check;
 export declare const temporalCheck: Check;
-/** All checks, in display order. */
 export declare const ALL_CHECKS: Check[];
-/**
- * Run the full on-demand doctor against a prebuilt context, print the report,
- * and return the aggregate status. The caller (the `mesh dev doctor`
- * subcommand) owns process exit.
- */
 export declare function runDoctor(ctx: DoctorContext, opts: {
     json: boolean;
 }): Promise<CheckStatus>;
-//# sourceMappingURL=dev-doctor.d.ts.map