@mesh-tech/mesh-cli 0.20.2 → 0.20.4

package/dist/src/commands/init/wizard.js

@@ -1,25 +1,3 @@
-/**
- * Bare `mesh init` — the guided setup of a machine and a repo for one tenant.
- *
- * Four questions and four steps, in order:
- *
- *   1. tenant   — which tenant this repo belongs to
- *   2. mode     — local only (`mesh start` / `mesh dev`) or a deployed platform
- *   3. registry — package-registry access, signing in if the machine has none
- *   4. platform — (deployed only) `mesh login <tenant>.<env>` in-process
- *   5. repo     — bootstrap an empty apps repo, or check an existing one
- *   6. skills   — the agent skills the repo's packages ship
- *
- * Two identities never mix: the registry step talks to the ONE global package
- * registry and never needs a context; the platform step is the only place a
- * `<tenant>.<env>` context appears, and the local branch never mentions it.
- *
- * Every step is data (`WizardStep` → `StepResult`) so the summary, the exit
- * code and the `--json` document are one reducer over one list, and a step
- * that fails without blocking (a registry 403 — the user needs the summary to
- * know whom to ask) lets the rest run. Every prompt has a flag, so a runner
- * with `--tenant … --local --yes` sees no prompt at all.
- */
 import * as fs from "fs";
 import * as path from "path";
 import { execFileSync } from "child_process";
@@ -34,13 +12,10 @@ import { discoverConfigForContext, isRemoteEnvironment, readCredentials, renderN
 import { bootstrapAppsRepo, isInsidePlatformMonorepo, shouldBootstrapAppsRepo } from "../create-app.js";
 import { resolveTargetRoot, syncSkills } from "../skills.js";
 import { detectLocalTenant } from "../local/dev-local.js";
-/** Printed when the registry step has no session and no way to sign in. */
 export const NO_SESSION_NO_TTY_MESSAGE = "No registry session and no terminal to sign in with.\n" +
     "  On a headless box: mesh registry login --device   (one-time, prints a code)\n" +
     "  In CI with AWS creds: mesh registry login --ci";
-/** Printed when a non-TTY run has no `--tenant`. */
 export const TENANT_REQUIRED_MESSAGE = "--tenant is required (no TTY for interactive mode)";
-/** Exit code for a Ctrl-C at a prompt: nothing half-written, conventional SIGINT code. */
 export const INTERRUPTED_EXIT_CODE = 130;
 const STEP_LABELS = {
     registry: "Registry access",
@@ -48,50 +23,20 @@ const STEP_LABELS = {
     repo: "Repo",
     skills: "Agent skills",
 };
-// ── pure parts ──────────────────────────────────────────────────────────────
-/**
- * The exit code for a finished run: 1 when any step failed (blocking or not
- * — a registry 403 still means the machine is not set up), else 0.
- *
- * @example
- * wizardExitCode([{ name: "Registry access", status: "fail", detail: "…", blocking: false }]); // → 1
- */
 export function wizardExitCode(steps) {
     return steps.some((s) => s.status === "fail") ? 1 : 0;
 }
-/**
- * The commands to run next, by mode. When the repo step did not leave an apps
- * repo behind, its own fix comes first — `mesh create-app` has nowhere to
- * scaffold until the repo exists.
- *
- * @example
- * wizardNextCommands({ platform: "dev" }); // → ["mesh create-app", "mesh deploy up   # from the app directory"]
- * wizardNextCommands("local", [{ name: "Repo", status: "skip", detail: "…", fix: "git init && mesh init" }]);
- * // → ["git init && mesh init"]
- */
 export function wizardNextCommands(mode, steps = []) {
     const repo = steps.find((s) => s.name === STEP_LABELS.repo);
     const first = repo && repo.status !== "pass" && repo.fix ? repo.fix : "mesh create-app";
     return mode === "local" ? [first] : [first, "mesh deploy up   # from the app directory, once it exists"];
 }
-/**
- * Whether the wizard should stop after `result`: a failing step that did not
- * opt out of blocking.
- */
 export function stepBlocks(result) {
     return result.status === "fail" && result.blocking !== false;
 }
-/** The mode as a short phrase for the summary heading. */
 export function describeMode(mode) {
     return mode === "local" ? "local only" : `deployed platform (${mode.platform})`;
 }
-/**
- * Render the summary check-list — the same lines for a terminal and for the
- * stderr side of `--json`.
- *
- * @example
- * renderWizardSummary({ tenant: "acme", mode: "local", steps: [], next: ["mesh create-app"] });
- */
 export function renderWizardSummary(outcome, opts = {}) {
     const paint = opts.color === false ? { green: (s) => s, red: (s) => s, yellow: (s) => s, dim: (s) => s, cyan: (s) => s } : chalk;
     const icon = (status) => status === "pass" ? paint.green("✔") : status === "fail" ? paint.red("✘") : status === "warn" ? paint.yellow("▲") : paint.dim("–");
@@ -106,15 +51,6 @@ export function renderWizardSummary(outcome, opts = {}) {
         lines.push(`  ${cmd}`);
     return lines.join("\n");
 }
-/**
- * Resolve the answers that need no prompt: flags first, then `--yes`
- * defaults, then what the repo already records. Returns the questions still
- * open so the caller prompts for exactly those.
- *
- * @example
- * resolveAnswers({ tenant: "acme", local: true }, null, false)
- * // → { tenant: "acme", mode: "local", open: [] }
- */
 export function resolveAnswers(opts, recorded, interactive) {
     const open = [];
     let tenant = opts.tenant;
@@ -144,8 +80,6 @@ export function resolveAnswers(opts, recorded, interactive) {
     }
     return { tenant, mode, open };
 }
-// ── steps ───────────────────────────────────────────────────────────────────
-/** The registry step, exported so a test can drive the real thing through its seams. */
 export const registryStep = {
     name: "registry",
     async run(ctx) {
@@ -178,9 +112,6 @@ export const registryStep = {
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);
             if (err instanceof RegistryNotAuthorizedError) {
-                // The account is fine; the grant is missing. Not blocking: the repo
-                // steps still tell the user what else is set up, and the summary
-                // carries the "whom to ask" line.
                 return {
                     name,
                     status: "fail",
@@ -234,14 +165,6 @@ const platformStep = {
         };
     },
 };
-/**
- * Classify `cwd` for the repo step. Pure over the filesystem; exported for
- * tests.
- *
- * @example
- * classifyRepo("/tmp/empty-git-clone"); // → "empty-apps-repo"
- * classifyRepo("/tmp/new-empty-folder"); // → "empty-dir"
- */
 export function classifyRepo(cwd) {
     if (isInsidePlatformMonorepo(cwd))
         return { kind: "platform-monorepo", root: resolveTargetRoot(cwd) };
@@ -259,13 +182,10 @@ export function classifyRepo(cwd) {
         return { kind: "apps-repo", root };
     return { kind: "other-repo", root };
 }
-/** `git init` on a folder, quietly; git's own complaint is the thrown error's message. */
 function gitInit(dir) {
     execFileSync("git", ["init", "-q"], { cwd: dir, stdio: ["ignore", "ignore", "pipe"] });
 }
-/** The fix a folder that is not yet a repo needs before anything can be scaffolded in it. */
 export const INIT_REPO_FIX = "git init && mesh init";
-/** The repo step: classify the cwd, then bootstrap, warn or skip accordingly. */
 export const repoStep = {
     name: "repo",
     async run(ctx) {
@@ -350,10 +270,6 @@ const skillsStep = {
             return { name, status: "skip", detail: "no apps repo to install skills into" };
         }
         try {
-            // In fix mode a `false` return is not a failure: the base skills are
-            // written; the platform skills arrive with the packages, so the sync
-            // asks to be re-run after the first install — the doctor reads it the
-            // same way.
             const complete = syncSkills(root);
             return complete
                 ? { name, status: "pass", detail: "base skills + Intent discovery in sync" }
@@ -364,15 +280,7 @@ const skillsStep = {
         }
     },
 };
-/** The steps in run order. Exported so tests can drive the reducer with fakes. */
 export const WIZARD_STEPS = [registryStep, platformStep, repoStep, skillsStep];
-/**
- * Run `steps` in order, stopping after the first blocking failure. Pure over
- * the steps' results — the reducer the CLI and the tests share.
- *
- * @example
- * const steps = await runWizardSteps(ctx, WIZARD_STEPS);
- */
 export async function runWizardSteps(ctx, steps) {
     const results = [];
     for (const step of steps) {
@@ -383,7 +291,6 @@ export async function runWizardSteps(ctx, steps) {
     }
     return results;
 }
-// ── the command ─────────────────────────────────────────────────────────────
 async function inquirerPrompts() {
     const [{ default: input }, { default: select }, { default: confirm }] = await Promise.all([
         import("@inquirer/input"),
@@ -399,17 +306,6 @@ async function inquirerPrompts() {
 function isInterrupt(err) {
     return err instanceof Error && err.name === "ExitPromptError";
 }
-/**
- * The wizard entry point behind bare `mesh init`.
- *
- * Returns the process exit code instead of exiting, so the caller decides
- * (and a test can assert on it). Ctrl-C at a prompt returns 130 with nothing
- * written. All human output goes to stderr under `--json`, leaving stdout for
- * the one document.
- *
- * @example
- * process.exitCode = await runInitWizard({ tenant: "acme", local: true, yes: true });
- */
 export async function runInitWizard(opts, deps = {}) {
     const cwd = deps.cwd ?? process.cwd();
     const interactive = deps.interactive ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);
@@ -475,10 +371,6 @@ export async function runInitWizard(opts, deps = {}) {
         };
         logInfo(`Setting up tenant '${tenant}' (${describeMode(mode)})…`);
         const steps = await runWizardSteps(ctx, deps.steps ?? WIZARD_STEPS);
-        // Persist what was answered so a re-run pre-fills — only where there is a
-        // repo of ours to record it in.
-        // Only a Mesh apps repo (or the empty clone that just became one) gets
-        // the record — never an unrelated checkout the wizard happens to run in.
         const { kind, root } = classifyRepo(cwd);
         if (!opts.skipRepo && (kind === "apps-repo" || kind === "empty-apps-repo")) {
             const written = writeMeshJson(root, { tenant, platform: mode === "local" ? "local" : mode.platform });
@@ -509,4 +401,3 @@ export async function runInitWizard(opts, deps = {}) {
         console.log = origLog;
     }
 }
-//# sourceMappingURL=wizard.js.map

package/dist/src/commands/init.d.ts

@@ -1,28 +1,3 @@
-/**
- * mesh init — bare: the guided setup wizard (`./init/wizard.ts`);
- * `init platform <tenant>`: scaffold a platform repo;
- * `init app-tenant`: the doctor for a tenant apps repo (design §3.1,
- * AC A1–A3), described below.
- *
- * Runs a read-only check pipeline; every failure names the exact `mesh`
- * command that fixes it (never a person — A2). Re-running IS the doctor
- * (A3): exit 0 iff everything passes. `--json` is the agent surface (A5);
- * `--fix` applies the developer-scope fixes directly (registry token
- * refresh, skills sync) and leaves operator actions as remediations.
- *
- * Checks (API-first; local platform = the same Hub API on localhost):
- *   1. CLI auth        — cached `mesh login` credentials for the context
- *   2. Registry access — the CodeArtifact token in ~/.npmrc is accepted by the
- *                        registry (a live probe, not a substring match — an
- *                        expired token used to report `pass`); local: skipped
- *   2b. Public npm not hijacked — no unscoped `registry=<codeartifact>` in
- *                        ~/.npmrc making CodeArtifact the DEFAULT registry
- *   3. Platform tenant — Hub API /tenants (the platform registry)
- *   4. App tenant      — tenant present in the Hub registry
- *   5. Deployer role   — mesh:deployerRole config present (cloud contexts)
- *   6. Repo shape      — pnpm workspace + apps layout create-app expects
- *   7. Skills wired    — `mesh skills sync --check`
- */
 import { Command } from "commander";
 import { probeRegistryToken } from "../utils/auth-preflight.js";
 type CheckStatus = "pass" | "warn" | "fail";
@@ -30,44 +5,14 @@ interface CheckResult {
     name: string;
     status: CheckStatus;
     detail: string;
-    /** The exact command that remediates (A2: commands, never people). */
     fix?: string;
 }
-/**
- * The remediation string the doctor prints for a registry fault. It must render
- * the command `--fix` actually executes: `runRegistryLogin` is called with the
- * doctor's own `--profile` (or none), so advertising a hardcoded
- * `--profile mesh-dev` would be a command the doctor never runs.
- *
- * The registry is global, so the command never carries a context — the bare
- * form is the one that works on a machine that has never signed in.
- *
- * @example
- * registryFixCommand();           // → "mesh registry login"
- * registryFixCommand("mesh-dev"); // → "mesh registry login --profile mesh-dev"
- */
 export declare function registryFixCommand(profile?: string): string;
-/**
- * The two registry checks, exported for tests.
- *
- * 1. **Registry access** — does the token in ~/.npmrc actually work? The old
- *    check was `content.includes("codeartifact")`, which reports `pass` for a
- *    token that expired two days ago. `probeRegistryToken` asks the registry.
- * 2. **Public npm not hijacked** — is there an *unscoped* `registry=` line
- *    pointing at CodeArtifact? A bare `aws codeartifact login` (no
- *    `--namespace @mesh-tech`) writes one, which routes every public package
- *    through CodeArtifact and makes the whole of npm 401 at the 12h token
- *    expiry. `mesh registry login` now removes it, so it is the fix for both.
- */
 export declare function registryChecks(args: {
     fix: boolean;
-    /** AWS SSO profile to log in with — threaded from `mesh init app-tenant --profile`. */
     profile?: string;
-    /** Test seam — defaults to the real network probe against ~/.npmrc. */
     probe?: typeof probeRegistryToken;
-    /** Test seam — defaults to `runRegistryLogin` (context-free: the registry is global). */
     login?: () => Promise<void>;
 }): Promise<CheckResult[]>;
 export declare function registerInitCommands(program: Command): void;
 export {};
-//# sourceMappingURL=init.d.ts.map

package/dist/src/commands/init.js

@@ -1,28 +1,3 @@
-/**
- * mesh init — bare: the guided setup wizard (`./init/wizard.ts`);
- * `init platform <tenant>`: scaffold a platform repo;
- * `init app-tenant`: the doctor for a tenant apps repo (design §3.1,
- * AC A1–A3), described below.
- *
- * Runs a read-only check pipeline; every failure names the exact `mesh`
- * command that fixes it (never a person — A2). Re-running IS the doctor
- * (A3): exit 0 iff everything passes. `--json` is the agent surface (A5);
- * `--fix` applies the developer-scope fixes directly (registry token
- * refresh, skills sync) and leaves operator actions as remediations.
- *
- * Checks (API-first; local platform = the same Hub API on localhost):
- *   1. CLI auth        — cached `mesh login` credentials for the context
- *   2. Registry access — the CodeArtifact token in ~/.npmrc is accepted by the
- *                        registry (a live probe, not a substring match — an
- *                        expired token used to report `pass`); local: skipped
- *   2b. Public npm not hijacked — no unscoped `registry=<codeartifact>` in
- *                        ~/.npmrc making CodeArtifact the DEFAULT registry
- *   3. Platform tenant — Hub API /tenants (the platform registry)
- *   4. App tenant      — tenant present in the Hub registry
- *   5. Deployer role   — mesh:deployerRole config present (cloud contexts)
- *   6. Repo shape      — pnpm workspace + apps layout create-app expects
- *   7. Skills wired    — `mesh skills sync --check`
- */
 import chalk from "chalk";
 import * as fs from "fs";
 import * as path from "path";
@@ -61,34 +36,9 @@ function readHomeNpmrc() {
         return "";
     }
 }
-/**
- * The remediation string the doctor prints for a registry fault. It must render
- * the command `--fix` actually executes: `runRegistryLogin` is called with the
- * doctor's own `--profile` (or none), so advertising a hardcoded
- * `--profile mesh-dev` would be a command the doctor never runs.
- *
- * The registry is global, so the command never carries a context — the bare
- * form is the one that works on a machine that has never signed in.
- *
- * @example
- * registryFixCommand();           // → "mesh registry login"
- * registryFixCommand("mesh-dev"); // → "mesh registry login --profile mesh-dev"
- */
 export function registryFixCommand(profile) {
     return profile ? `mesh registry login --profile ${profile}` : "mesh registry login";
 }
-/**
- * The two registry checks, exported for tests.
- *
- * 1. **Registry access** — does the token in ~/.npmrc actually work? The old
- *    check was `content.includes("codeartifact")`, which reports `pass` for a
- *    token that expired two days ago. `probeRegistryToken` asks the registry.
- * 2. **Public npm not hijacked** — is there an *unscoped* `registry=` line
- *    pointing at CodeArtifact? A bare `aws codeartifact login` (no
- *    `--namespace @mesh-tech`) writes one, which routes every public package
- *    through CodeArtifact and makes the whole of npm 401 at the 12h token
- *    expiry. `mesh registry login` now removes it, so it is the fix for both.
- */
 export async function registryChecks(args) {
     const { fix, profile } = args;
     const probe = args.probe ?? probeRegistryToken;
@@ -97,14 +47,11 @@ export async function registryChecks(args) {
             const { runRegistryLogin } = await import("./registry.js");
             await runRegistryLogin(undefined, profile ? { profile } : {});
         });
-    // The command we ADVERTISE must be the command `--fix` RUNS — otherwise the
-    // doctor tells you to pass a profile it then silently drops.
     const REGISTRY_FIX = registryFixCommand(profile);
     let tokenState = await probe({ npmrcPath: homeNpmrcPath() });
     let hijack = findUnscopedCodeArtifactRegistry(readHomeNpmrc());
     let repaired = false;
     let loginError = null;
-    // One login repairs both: it refreshes the token AND strips the unscoped line.
     if (fix && (tokenState.state === "expired" || tokenState.state === "missing" || hijack)) {
         try {
             await login();
@@ -134,7 +81,6 @@ export async function registryChecks(args) {
         });
     }
     else if (tokenState.state === "unreachable") {
-        // A network fault is not an auth fault — don't send someone to `aws sso login`.
         checks.push({
             name: "Registry access",
             status: "warn",
@@ -171,7 +117,6 @@ async function runChecks(args) {
     const { root, tenant, context, hubUrl, fix, profile } = args;
     const checks = [];
     const local = isLocalContext(context);
-    // 1. CLI auth
     const creds = readCredentials(context);
     const expired = creds ? new Date(creds.expiresAt).getTime() < Date.now() : true;
     checks.push(creds && !expired
@@ -183,7 +128,6 @@ async function runChecks(args) {
             fix: `mesh login ${context}`,
         });
     const accessToken = creds && !expired ? creds.accessToken : null;
-    // 2 + 2b. Registry access (CodeArtifact) — the local platform has no registry
     if (local) {
         checks.push({ name: "Registry access", status: "pass", detail: "local context — no registry required" });
         checks.push({ name: "Public npm not hijacked", status: "pass", detail: "local context — no registry required" });
@@ -191,7 +135,6 @@ async function runChecks(args) {
     else {
         checks.push(...(await registryChecks({ fix, profile })));
     }
-    // 3 + 4. Platform tenant + app tenant via the Hub API (the registry)
     const hub = await probeHubTenants(hubUrl, accessToken);
     if (!hub.ok) {
         const fixCmd = local ? "mesh start" : `mesh login ${context}`;
@@ -221,7 +164,6 @@ async function runChecks(args) {
                 fix: local ? "mesh dev" : `mesh tenant add ${tenant}   # in the platform repo, then: mesh deploy up`,
             });
     }
-    // 5. Deployer role (cloud contexts only — local has no IAM)
     if (local) {
         checks.push({ name: "Deployer role", status: "pass", detail: "local context — no deployer role required" });
     }
@@ -239,7 +181,6 @@ async function runChecks(args) {
                 fix: "mesh create-app   # scaffolds stack config with the deployer role",
             });
     }
-    // 6. Repo shape (what create-app/mesh dev expect)
     const shapeProblems = [];
     if (!fs.existsSync(path.join(root, "package.json")))
         shapeProblems.push("package.json");
@@ -255,7 +196,6 @@ async function runChecks(args) {
             detail: `missing: ${shapeProblems.join(", ")}`,
             fix: "mesh create-app   # scaffold an app (workspace files included)",
         });
-    // 7. Skills wired
     const skillsOk = fix ? syncSkills(root) : syncSkills(root, { check: true });
     checks.push(skillsOk
         ? { name: "Agent skills", status: "pass", detail: "base skills + Intent discovery in sync" }
@@ -270,10 +210,6 @@ async function runChecks(args) {
 export function registerInitCommands(program) {
     const init = program
         .command("init")
-        // The wizard's flags (--tenant, --profile, --json, …) overlap the
-        // subcommands' own. Positional options keep them apart: options before a
-        // subcommand name belong to the wizard, options after it to the subcommand,
-        // so `mesh init app-tenant --json` still reaches the doctor unchanged.
         .enablePositionalOptions()
         .description("Set up this machine and repo for a tenant — a guided wizard with no subcommand (tenant, local or deployed, package-registry sign-in, repo, skills); `init platform` scaffolds a platform repo, `init app-tenant` is the apps-repo doctor")
         .option("--tenant <name>", "app tenant this repo belongs to (prompted when omitted on a TTY)")
@@ -349,9 +285,6 @@ export function registerInitCommands(program) {
         if (!opts.json) {
             logInfo(`Checking app-tenant repo ${root} (tenant '${tenant}', context '${opts.context}')…`);
         }
-        // Under --json, stdout is the machine surface (A5): route the check
-        // helpers' human chatter (syncSkills / registry login logInfo etc.) to
-        // stderr so stdout stays pure parseable JSON.
         const origLog = console.log;
         if (opts.json)
             console.log = (...a) => console.error(...a);
@@ -369,8 +302,6 @@ export function registerInitCommands(program) {
         finally {
             console.log = origLog;
         }
-        // Warns are advisory (expected on a fresh repo pre-`mesh dev`): only
-        // hard failures gate the exit code (A3). `ok` mirrors that contract.
         const ok = !checks.some((c) => c.status === "fail");
         if (opts.json) {
             emitJsonPayload({ ok, root, tenant, context: opts.context, checks });
@@ -393,4 +324,3 @@ export function registerInitCommands(program) {
         }
     });
 }
-//# sourceMappingURL=init.js.map

package/dist/src/commands/install-shim.d.ts

@@ -1,28 +1,5 @@
 import { Command } from "commander";
-/**
- * `mesh install-shim` — make bare `mesh` work on the PATH without a build.
- *
- * People and agents reach for `mesh dev`, not `pnpm exec mesh dev`. Getting a
- * bare `mesh` onto the PATH inherently needs one PATH entry — but it can be a
- * build-free, cwd-aware resolver: a tiny shell script that, on each run, walks
- * up from the current directory to the nearest workspace `node_modules/.bin/mesh`
- * and execs it. That `.bin/mesh` is the `bin/mesh.mjs` launcher, which runs the
- * CLI from TypeScript source — so bare `mesh` always runs the LOCAL source of
- * whatever worktree/app you are in, with no build and nothing global to keep in
- * sync (MESH-2261). Run this once; it survives worktree switches and pulls.
- *
- * Outside any workspace it falls through to a globally installed CLI
- * (MESH-2869). The shim sits in `~/.local/bin`, which is typically ahead of the
- * npm global bin on PATH, so without that fall-through it *shadows*
- * `npm i -g @mesh-tech/mesh-cli`: the new developer's very first commands —
- * `mesh --version`, `mesh login mesh.dev`, run from `~` — die with "not inside a
- * Mesh workspace" even though the CLI is installed and working.
- */
-/** The cwd-aware resolver written to the PATH. Pure so it can be unit-tested. */
 export declare function shimScript(): string;
-/** Default install target: ~/.local/bin (conventional per-user PATH dir). */
 export declare function defaultShimDir(): string;
-/** True if `dir` is a component of the PATH env string. */
 export declare function dirOnPath(dir: string, pathEnv: string | undefined): boolean;
 export declare function registerInstallShimCommand(program: Command): void;
-//# sourceMappingURL=install-shim.d.ts.map

package/dist/src/commands/install-shim.js

@@ -3,35 +3,15 @@ import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
 import { logError, logInfo, logSuccess, logWarn } from "../utils/log.js";
-/**
- * `mesh install-shim` — make bare `mesh` work on the PATH without a build.
- *
- * People and agents reach for `mesh dev`, not `pnpm exec mesh dev`. Getting a
- * bare `mesh` onto the PATH inherently needs one PATH entry — but it can be a
- * build-free, cwd-aware resolver: a tiny shell script that, on each run, walks
- * up from the current directory to the nearest workspace `node_modules/.bin/mesh`
- * and execs it. That `.bin/mesh` is the `bin/mesh.mjs` launcher, which runs the
- * CLI from TypeScript source — so bare `mesh` always runs the LOCAL source of
- * whatever worktree/app you are in, with no build and nothing global to keep in
- * sync (MESH-2261). Run this once; it survives worktree switches and pulls.
- *
- * Outside any workspace it falls through to a globally installed CLI
- * (MESH-2869). The shim sits in `~/.local/bin`, which is typically ahead of the
- * npm global bin on PATH, so without that fall-through it *shadows*
- * `npm i -g @mesh-tech/mesh-cli`: the new developer's very first commands —
- * `mesh --version`, `mesh login mesh.dev`, run from `~` — die with "not inside a
- * Mesh workspace" even though the CLI is installed and working.
- */
-/** The cwd-aware resolver written to the PATH. Pure so it can be unit-tested. */
 export function shimScript() {
     return `#!/bin/sh
-# mesh — canonical launcher shim (installed by \`mesh install-shim\`, MESH-2261).
+# mesh — canonical launcher shim (installed by \`mesh install-shim\`).
 # Walks up from the current directory to the nearest workspace mesh CLI and runs
 # it. That resolves to bin/mesh.mjs, which runs the CLI from TypeScript source —
 # so this always runs the LOCAL source of whatever worktree/app you are in, with
 # no build step. Nothing here is version-pinned; do not edit by hand.
 #
-# Outside a workspace it hands off to a globally installed mesh CLI (MESH-2869).
+# Outside a workspace it hands off to a globally installed mesh CLI.
 # Without that hand-off the shim shadows \`npm i -g @mesh-tech/mesh-cli\` on the
 # PATH and \`mesh login\` is unreachable from the home directory — which is the
 # very first thing a new developer runs.
@@ -94,11 +74,9 @@ echo "      Or cd into your app/repo (after 'pnpm install') and use 'pnpm exec m
 exit 1
 `;
 }
-/** Default install target: ~/.local/bin (conventional per-user PATH dir). */
 export function defaultShimDir() {
     return path.join(os.homedir(), ".local", "bin");
 }
-/** True if `dir` is a component of the PATH env string. */
 export function dirOnPath(dir, pathEnv) {
     if (!pathEnv)
         return false;
@@ -136,9 +114,6 @@ export function registerInstallShimCommand(program) {
         else {
             logInfo("Bare `mesh <cmd>` now runs the local source of whatever workspace you're in.");
         }
-        // Post-install self-test: run the freshly installed shim and record a full
-        // diagnostic (env + stdout/stderr + exit) to a file, so a failure is
-        // debuggable without copy-pasting terminal output.
         const diagPath = path.join(os.tmpdir(), "mesh-shim-selftest.log");
         let stdout = "";
         let stderr = "";
@@ -176,7 +151,6 @@ export function registerInstallShimCommand(program) {
             fs.writeFileSync(diagPath, diag);
         }
         catch {
-            /* diagnostics are best-effort */
         }
         if (ok && /Commands:|Usage:/.test(stdout)) {
             logSuccess(`Self-test passed: \`mesh --help\` ran cleanly. Diagnostic: ${diagPath}`);
@@ -188,4 +162,3 @@ export function registerInstallShimCommand(program) {
         }
     });
 }
-//# sourceMappingURL=install-shim.js.map

package/dist/src/commands/local/auth-provision.d.ts

@@ -1,109 +1,29 @@
-/**
- * App-tenant auth auto-provisioning for the local platform — the local analog
- * of what the Pulumi components do in the cloud, per the approved Zitadel
- * tenant-auth pattern (Org / Project / Application / Service User):
- *
- *   Org         = app tenant                  (ZitadelTenantIdentity parity)
- *   Project     = one per app,                 (ZitadelAppIdentity parity —
- *                 name = authz schema namespace  the app IS the authz boundary)
- *   Application = one per service inside it    (API app, Basic creds)
- *   Secret      = mesh/{tenant}/{env}/apps/{app}/zitadel/{service}
- *                 (ministack Secrets Manager — same canonical path as cloud)
- *
- * `mesh dev --local` calls this on startup so scaffolding + running an app
- * auto-creates its auth config — no Pulumi deploy, no manual Zitadel steps.
- * Idempotent: search-before-create everywhere; the credential secret is only
- * written when the application is first created (Zitadel returns the secret
- * once).
- */
 export interface AppTenantAuthArgs {
-    /** App tenant (org name), e.g. "acme" */
     tenant: string;
-    /** App name = project name = authz schema namespace */
     app: string;
-    /** Service names → one API application each (api, worker, …) */
     services: string[];
-    /**
-     * App-declared project roles (package.json → mesh.auth.roles). Created on
-     * the app's Zitadel project and granted to the local `{app}-m2m` caller so
-     * role-scoped services (roles claim → scopes) accept its tokens.
-     */
     roles?: string[];
 }
 export interface ProvisionedAuth {
     orgId: string;
     projectId: string;
-    /** Services whose application (and secret) was created this run */
     created: string[];
 }
 export declare function authSecretPath(tenant: string, app: string, service: string): string;
-/**
- * Register the running app in the local platform registry — the same
- * self-registration path deployed apps use (/mesh-platform/{tenant}/{env}/
- * apps/{app}/meta), so StackPort (and the local Hub once its images land)
- * can visualize local apps.
- */
 export declare function registerLocalApp(args: AppTenantAuthArgs & {
     ports?: Record<string, number>;
-    /** ExternalService names the app's services consume (ExternalService.link()
-     * parity) — the Hub derives Integrations consumers + uptime from these. */
     links?: string[];
-    /** The app's own version (its package.json), stamped like a deploy. */
     version?: string;
-    /** Service kind discriminators from the session's dev output. A
-     * `"dagster"` entry makes this registration also write the Dagster
-     * discovery record the Hub's Data section reads. */
     kinds?: Record<string, string>;
 }): Promise<string>;
-/**
- * Reconcile the platform registry from Zitadel — every app-tenant org (and
- * its projects = apps, applications = services) provisioned in Zitadel gets
- * a Hub-readable registration, even if the app hasn't been run since it was
- * provisioned. Zitadel is the auth source of truth; the registry mirrors it,
- * exactly like the cloud where ZitadelTenantIdentity/ZitadelAppIdentity and
- * the app's self-registration both flow from the same deploy. Idempotent:
- * existing per-stack registrations (which carry live ports/URLs from
- * `mesh dev --local`) are never overwritten.
- */
 export declare function reconcileRegistryFromZitadel(): Promise<{
     tenants: string[];
     apps: number;
 }>;
-/**
- * Ensure a service has a BROWSER sign-in, not just an API client.
- *
- * `ensureServiceApp` gives every service a Zitadel **API** application, which is
- * what a machine caller authenticates with. A person cannot sign in to one:
- * there is no authorization endpoint and no redirect URI, so the Hub's
- * Access → Sign-in tab reports the app has no browser login and refuses to
- * create a user — correctly, since the account would have nowhere to log in.
- *
- * An app declares which of its services carry a login in `package.json`:
- *
- * ```json
- * { "mesh": { "auth": { "signIn": ["ui"] } } }
- * ```
- *
- * which mirrors what the Pulumi program expresses as a `web` OIDC application
- * on `ZitadelAppIdentity`. Deployed, the redirect URI comes from the service's
- * public hostname; locally it is the port `mesh dev` allocated, so this runs
- * AFTER port allocation and re-asserts the URIs on every launch — a session
- * that lands on a different port must not leave the previous one registered as
- * the only valid callback.
- *
- * Idempotent, and best-effort at the call site: a missing sign-in app degrades
- * the Access tab, it does not stop the dev loop.
- */
 export declare function ensureSignInApp(args: {
     tenant: string;
     app: string;
     service: string;
-    /** Origin the service is reachable at, e.g. `http://localhost:40881`. */
     baseUrl: string;
 }): Promise<void>;
-/**
- * Ensure the app tenant's full auth config exists (org → project →
- * application-per-service → credential secrets).
- */
 export declare function ensureAppTenantAuth(args: AppTenantAuthArgs): Promise<ProvisionedAuth>;
-//# sourceMappingURL=auth-provision.d.ts.map