@mesh-tech/mesh-cli 0.20.2 → 0.20.4

package/dist/src/commands/local/auth-provision.js

@@ -1,21 +1,3 @@
-/**
- * App-tenant auth auto-provisioning for the local platform — the local analog
- * of what the Pulumi components do in the cloud, per the approved Zitadel
- * tenant-auth pattern (Org / Project / Application / Service User):
- *
- *   Org         = app tenant                  (ZitadelTenantIdentity parity)
- *   Project     = one per app,                 (ZitadelAppIdentity parity —
- *                 name = authz schema namespace  the app IS the authz boundary)
- *   Application = one per service inside it    (API app, Basic creds)
- *   Secret      = mesh/{tenant}/{env}/apps/{app}/zitadel/{service}
- *                 (ministack Secrets Manager — same canonical path as cloud)
- *
- * `mesh dev --local` calls this on startup so scaffolding + running an app
- * auto-creates its auth config — no Pulumi deploy, no manual Zitadel steps.
- * Idempotent: search-before-create everywhere; the credential secret is only
- * written when the application is first created (Zitadel returns the secret
- * once).
- */
 import { logInfo, logSuccess } from "../../utils/log.js";
 import { LOCAL_ENV, LOCAL_AWS_CONFIG, registerTenantEnv } from "./seed.js";
 import { api, readSeederPat, PLATFORM_ORG, ensureZitadelProject, searchZitadelApp } from "./seed-zitadel.js";
@@ -35,8 +17,6 @@ async function ensureOrg(pat, name) {
     return created.organizationId;
 }
 const ensureProject = (pat, orgId, name) => ensureZitadelProject(pat, name, { orgId, describe: "app" });
-/** Ensure the service's API application exists; returns fresh credentials
- * when it was created this run. */
 async function ensureServiceApp(pat, orgId, projectId, service) {
     const existing = await searchZitadelApp(pat, projectId, service, orgId);
     if (existing) {
@@ -46,7 +26,6 @@ async function ensureServiceApp(pat, orgId, projectId, service) {
     logSuccess(`Created Zitadel application '${service}' (service)`);
     return { created: true, clientId: created.clientId, clientSecret: created.clientSecret };
 }
-/** Ensure the app-declared project roles exist (idempotent). */
 async function ensureProjectRoles(pat, orgId, projectId, roles) {
     if (roles.length === 0)
         return;
@@ -59,13 +38,6 @@ async function ensureProjectRoles(pat, orgId, projectId, roles) {
         logSuccess(`Created project role '${key}'`);
     }
 }
-/**
- * Ensure the app's LOCAL M2M caller: a machine user (`{app}-m2m`) with a
- * client-credentials secret, granted the app project (+ declared roles).
- * API applications are resource servers — they cannot obtain tokens — so
- * without this there is no way to mint a caller token against the local
- * Zitadel at all. Secret stored at mesh/{tenant}/dev/apps/{app}/zitadel/m2m.
- */
 async function ensureM2mCaller(pat, tenant, app, orgId, projectId, roles) {
     const userName = `${app}-m2m`;
     const search = await api(pat, "POST", "/management/v1/users/_search", { queries: [{ userNameQuery: { userName, method: "TEXT_QUERY_METHOD_EQUALS" } }] }, orgId);
@@ -77,8 +49,6 @@ async function ensureM2mCaller(pat, tenant, app, orgId, projectId, roles) {
         createdUser = true;
         logSuccess(`Created machine user '${userName}' (local M2M caller)`);
     }
-    // Grant the project (+ declared roles); on re-runs update the existing
-    // grant so newly-declared roles apply.
     try {
         await api(pat, "POST", `/management/v1/users/${userId}/grants`, { projectId, roleKeys: roles }, orgId);
     }
@@ -93,10 +63,6 @@ async function ensureM2mCaller(pat, tenant, app, orgId, projectId, roles) {
                 await api(pat, "PUT", `/management/v1/users/${userId}/grants/${grantId}`, { roleKeys: roles }, orgId);
             }
             catch (updateErr) {
-                // Zitadel 400s a no-op update ("User grant has not been changed",
-                // COMMAND-Rs8fy) — the grant already carries the declared roles.
-                // Anything else is real. Must not throw here: aborting mid-provision
-                // skips the secret (re-)mint below and leaves callers without creds.
                 const ue = updateErr;
                 if (!/has not been changed/i.test(String(ue.message)))
                     throw updateErr;
@@ -126,20 +92,11 @@ async function writeAuthSecret(tenant, app, service, value) {
     await upsertLocalSecret(name, value);
     logSuccess(`Stored service credentials → ${name}`);
 }
-/**
- * Register the running app in the local platform registry — the same
- * self-registration path deployed apps use (/mesh-platform/{tenant}/{env}/
- * apps/{app}/meta), so StackPort (and the local Hub once its images land)
- * can visualize local apps.
- */
 export async function registerLocalApp(args) {
     const { SSMClient, PutParameterCommand } = await import("@aws-sdk/client-ssm");
     const ssm = new SSMClient(LOCAL_AWS_CONFIG);
     const put = (name, value, description) => ssm.send(new PutParameterCommand({ Name: name, Type: "String", Overwrite: true, Value: JSON.stringify(value), Description: description }));
-    // The app's tenant + env must be registered for the Hub to list the app.
     await registerTenantEnv(args.tenant);
-    // Per-stack registration in the exact shape hub-api's SSM assembler reads
-    // (stack "local" = the mesh dev --local runtime).
     const namespace = `${args.tenant}-${LOCAL_ENV}-${args.app}`;
     const base = `/mesh-platform/${args.tenant}/${LOCAL_ENV}/apps/${args.app}/stacks/local`;
     await put(base, {
@@ -159,14 +116,6 @@ export async function registerLocalApp(args) {
             ...(!isMock && args.links?.length ? { links: args.links } : {}),
         }, `Local service registration (${service})`);
     }
-    // Dagster registration — the local counterpart of the SSM Export a deployed
-    // DagsterInstance writes ({kind, graphqlUrl, uiUrl} at …/stacks/{stack}/dagster),
-    // which is the record hub-api's discoverDagsterInstances() filters on; the
-    // plain services/{name} entry above is invisible to Dagster discovery.
-    // graphqlUrl uses host.docker.internal: the consumer is the CONTAINERIZED
-    // hub-api (`mesh start`), which must cross the Docker boundary to reach the
-    // host `dg dev` process. uiUrl stays localhost — it is opened in the
-    // developer's browser, where host.docker.internal does not resolve.
     for (const service of args.services) {
         if (args.kinds?.[service] !== "dagster")
             continue;
@@ -179,10 +128,6 @@ export async function registerLocalApp(args) {
             uiUrl: `http://localhost:${port}`,
         }, `Local Dagster discovery record (${service})`);
     }
-    // Worker registration — the shape deployed TemporalWorker components
-    // write; hub-api discovers a tenant's Temporal namespaces from these, so
-    // the tenant-wide workflows view finds local runs without an explicit
-    // namespace filter. Template convention: worker services are named so.
     for (const service of args.services) {
         if (!/worker/i.test(service))
             continue;
@@ -192,27 +137,12 @@ export async function registerLocalApp(args) {
         runtime: "mesh-dev-local",
         services: args.services,
         ports: args.ports ?? {},
-        // The same two fields a deployed stack stamps, so the Hub's app list and
-        // its activity timeline read a local run exactly as they read a deploy —
-        // which version of this app is running here, and since when. Without them
-        // a local app shows a blank version and never appears on the timeline,
-        // and "deployments aren't tracked" is indistinguishable from "no deploys".
         ...(args.version ? { version: args.version } : {}),
         deployedAt: new Date().toISOString(),
     }, "Local run metadata (mesh dev --local)");
     logSuccess(`Registered app in the local registry → ${base}`);
     return base;
 }
-/**
- * Reconcile the platform registry from Zitadel — every app-tenant org (and
- * its projects = apps, applications = services) provisioned in Zitadel gets
- * a Hub-readable registration, even if the app hasn't been run since it was
- * provisioned. Zitadel is the auth source of truth; the registry mirrors it,
- * exactly like the cloud where ZitadelTenantIdentity/ZitadelAppIdentity and
- * the app's self-registration both flow from the same deploy. Idempotent:
- * existing per-stack registrations (which carry live ports/URLs from
- * `mesh dev --local`) are never overwritten.
- */
 export async function reconcileRegistryFromZitadel() {
     const pat = readSeederPat();
     const { SSMClient, GetParameterCommand, PutParameterCommand } = await import("@aws-sdk/client-ssm");
@@ -222,7 +152,6 @@ export async function reconcileRegistryFromZitadel() {
     let apps = 0;
     for (const org of orgs?.result ?? []) {
         const tenant = org?.name;
-        // The platform org holds platform-service auth config, not an app tenant.
         if (!tenant || tenant === PLATFORM_ORG)
             continue;
         await registerTenantEnv(tenant);
@@ -267,39 +196,12 @@ export async function reconcileRegistryFromZitadel() {
     }
     return { tenants, apps };
 }
-/**
- * Ensure a service has a BROWSER sign-in, not just an API client.
- *
- * `ensureServiceApp` gives every service a Zitadel **API** application, which is
- * what a machine caller authenticates with. A person cannot sign in to one:
- * there is no authorization endpoint and no redirect URI, so the Hub's
- * Access → Sign-in tab reports the app has no browser login and refuses to
- * create a user — correctly, since the account would have nowhere to log in.
- *
- * An app declares which of its services carry a login in `package.json`:
- *
- * ```json
- * { "mesh": { "auth": { "signIn": ["ui"] } } }
- * ```
- *
- * which mirrors what the Pulumi program expresses as a `web` OIDC application
- * on `ZitadelAppIdentity`. Deployed, the redirect URI comes from the service's
- * public hostname; locally it is the port `mesh dev` allocated, so this runs
- * AFTER port allocation and re-asserts the URIs on every launch — a session
- * that lands on a different port must not leave the previous one registered as
- * the only valid callback.
- *
- * Idempotent, and best-effort at the call site: a missing sign-in app degrades
- * the Access tab, it does not stop the dev loop.
- */
 export async function ensureSignInApp(args) {
     const pat = readSeederPat();
     const orgId = await ensureOrg(pat, args.tenant);
     const projectId = await ensureProject(pat, orgId, args.app);
     const name = `${args.service}-web`;
     const base = args.baseUrl.replace(/\/+$/, "");
-    // oauth2-proxy's callback, and both slash forms for post-logout — Zitadel
-    // exact-matches the latter, and proxies differ on the trailing slash.
     const redirectUris = [`${base}/oauth2/callback`];
     const postLogoutRedirectUris = [base, `${base}/`];
     const config = {
@@ -309,13 +211,10 @@ export async function ensureSignInApp(args) {
         grantTypes: ["OIDC_GRANT_TYPE_AUTHORIZATION_CODE", "OIDC_GRANT_TYPE_REFRESH_TOKEN"],
         appType: "OIDC_APP_TYPE_WEB",
         authMethodType: "OIDC_AUTH_METHOD_TYPE_BASIC",
-        // Roles must ride in the token: the app authorizes on them, and the Hub
-        // shows which roles a person holds by reading the same grants.
         accessTokenType: "OIDC_TOKEN_TYPE_JWT",
         accessTokenRoleAssertion: true,
         idTokenRoleAssertion: true,
         idTokenUserinfoAssertion: true,
-        // http:// callbacks are only permitted in dev mode.
         devMode: true,
     };
     const existing = await searchZitadelApp(pat, projectId, name, orgId);
@@ -333,10 +232,6 @@ export async function ensureSignInApp(args) {
     });
     logSuccess(`Created Zitadel application '${name}' (browser sign-in → ${base}/oauth2/callback)`);
 }
-/**
- * Ensure the app tenant's full auth config exists (org → project →
- * application-per-service → credential secrets).
- */
 export async function ensureAppTenantAuth(args) {
     const pat = readSeederPat();
     const orgId = await ensureOrg(pat, args.tenant);
@@ -357,9 +252,6 @@ export async function ensureAppTenantAuth(args) {
             created.push(service);
         }
         else if (!(await authSecretExists(args.tenant, args.app, service))) {
-            // Zitadel persists across stack restarts but the local secret store is
-            // in-memory — heal the gap by regenerating the application's secret
-            // (Zitadel returns it only once, so a lost secret can't be re-read).
             const regenerated = await api(pat, "POST", `/management/v1/projects/${projectId}/apps/${result.appId}/api_config/_generate_client_secret`, {}, orgId);
             await writeAuthSecret(args.tenant, args.app, service, {
                 clientId: result.clientId ?? "",
@@ -380,4 +272,3 @@ export async function ensureAppTenantAuth(args) {
     }
     return { orgId, projectId, created };
 }
-//# sourceMappingURL=auth-provision.js.map

package/dist/src/commands/local/dev-local.d.ts

@@ -1,23 +1,3 @@
-/**
- * Local DevOutput source for `mesh dev` (design §5.2, AC C1/C3).
- *
- * Instead of reading a deployed Pulumi stack, synthesize the same DevOutput
- * shape from repo conventions and point every service at the running
- * `mesh start` platform. Zero AWS credentials, zero VPN, zero Pulumi state —
- * the app's code never knows it's local:
- *   - Temporal → localhost:7233, namespace local-dev (seeded)
- *   - Postgres → the local `app` database
- *   - Zitadel  → http://localhost:8080 (seeded org/app/users)
- *   - SpiceDB  → localhost:50051 (preshared key)
- *   - AWS SDK  → ministack via AWS_ENDPOINT_URL (SSM/Secrets/S3 registry)
- *
- * Detection convention = what `mesh create-app` templates emit: immediate
- * subdirectories of the app root whose package.json has a `dev` script
- * (api/, worker/, web/, …); a single-package app root with its own `dev`
- * script becomes one service.
- */
-/** Matches dev.ts's DevEnvVar/DevService/DevOutput shapes (kept structural —
- * dev.ts owns the canonical interfaces). */
 interface LocalDevEnvVar {
     value: string;
 }
@@ -26,9 +6,6 @@ interface LocalDevService {
     port: number;
     command: string[];
     env?: Record<string, LocalDevEnvVar>;
-    /** Service kind discriminator (see dev.ts DevService). `"dagster"` marks the
-     * synthesized `dg dev` webserver so local registration writes the Dagster
-     * discovery record the Hub's Data section reads. */
     kind?: "dagster";
 }
 export interface LocalDevOutput {
@@ -42,88 +19,20 @@ export interface LocalDevOutput {
     tunnels: Record<string, never>;
 }
 export declare const LOCAL_STACK_NAME = "local";
-/**
- * The app's namespace, exactly the name the cloud gives it in K8s AND
- * Temporal ({tenant}-{env}-{app}) — the Hub resolves both from this one
- * convention, so local runs are addressable with zero translation.
- */
 export declare function localAppNamespace(tenant: string, appName: string): string;
-/** The OTLP log shipper (assets/log-shipper.mjs) each local service's
- * launch pipeline pipes through — ships stdout to the stack's collector
- * with the hosted k8s_* attribution. */
 export declare function logShipperPath(): string;
-/**
- * OTel SDK bootstrap — the local analog of the OTel Operator's pod
- * injection: when the service ships `@opentelemetry/auto-instrumentations-
- * node` (the templates declare it), the platform injects the `--import`
- * register hook + exporter env, and HTTP/fetch/gRPC spans flow to the
- * stack's collector → Tempo → the Hub's Traces views. Apps without the
- * package run untouched.
- */
 export declare function autoInstrumentationEnv(appRoot: string, src: string): Record<string, LocalDevEnvVar>;
-/** Hosted-parity resource attribution for a local service — what the
- * in-cluster k8sattributes processor stamps. */
 export declare function otelEnv(tenant: string, appName: string, serviceName: string): Record<string, LocalDevEnvVar>;
-/** Endpoints of the running `mesh start` platform, as service env. */
 export declare function localPlatformEnv(tenant: string, appName: string, serviceName: string): Record<string, LocalDevEnvVar>;
-/**
- * A Dagster workspace announces itself in one of the two shapes `dg dev`
- * accepts: a `dg.toml` at the root (workspace convention — one file listing
- * one or more projects), or a root `pyproject.toml` carrying a `[tool.dg]`
- * table (single-project convention). Either earns the synthesized `dg dev`
- * service.
- *
- * @example
- * isDagsterWorkspaceRoot("/repos/acme-dagster");      // true — has dg.toml
- * isDagsterWorkspaceRoot("/repos/bank-statements");   // true — pyproject.toml has [tool.dg]
- * isDagsterWorkspaceRoot("/repos/plain-hono-api");    // false
- */
 export declare function isDagsterWorkspaceRoot(appRoot: string): boolean;
-/**
- * Locate the `dg` binary for a workspace, by layout convention:
- * `deployments/local/.venv` (a workspace keeping its dev CLI venv separate
- * from per-project venvs) first, then a root `.venv` (single-project
- * workspaces where one `uv sync` at the root covers everything). Falls back
- * to `dg` on PATH (uv tool install / pipx) when neither venv exists yet —
- * the launch window then shows dg's own error, which names the missing venv
- * more usefully than a failed path lookup would.
- *
- * @example
- * resolveDgBinary("/repos/acme-dagster");     // "deployments/local/.venv/bin/dg"
- * resolveDgBinary("/repos/bank-statements");  // ".venv/bin/dg" (root uv sync)
- * resolveDgBinary("/repos/fresh-clone");      // "dg" (no venv built yet)
- */
 export declare function resolveDgBinary(appRoot: string): string;
-/**
- * Detect runnable services by template convention: immediate subdirectories
- * with a package.json `dev` script; falls back to the app root itself when
- * it is a single-package app.
- */
 export declare function detectLocalServices(appRoot: string): Record<string, {
     src: string;
 }>;
-/** Synthesize the DevOutput `mesh dev` would otherwise read from Pulumi.
- * `tenant` is the app tenant (detectLocalTenant) — it scopes the app's
- * namespace ({tenant}-{env}-{app}) for Temporal, logs, and traces.
- * `opts.mocks` (mesh dev --externals) appends declared mock services and injects
- * their ExternalService credential prefixes into every app service. */
 export declare function buildLocalDevOutput(appRoot: string, tenant: string, opts?: {
     mocks?: Record<string, import("./mocks.js").LocalMockDecl>;
 }): LocalDevOutput;
-/**
- * Whether the app is backed by a Pulumi program: its own (Pulumi.yaml or a
- * Pulumi.<stack>.yaml stack config in the app dir), or a monorepo ROOT
- * program above it (walk up to the repo boundary — .git/pnpm-workspace).
- * Apps like apps/hub deploy via a root program and have no per-app
- * Pulumi.yaml; they must NOT default into `mesh dev` local mode.
- */
 export declare function hasStackBacking(appRoot: string): boolean;
-/**
- * The app's tenant, for auth provisioning: `mesh:tenant` from the app's
- * Pulumi stack config when present (templates write it), else "local".
- */
 export declare function detectLocalTenant(appRoot: string): string;
-/** The local platform must be up before `mesh dev` can wire services to it. */
 export declare function ensureLocalPlatformRunning(): Promise<void>;
 export {};
-//# sourceMappingURL=dev-local.d.ts.map

package/dist/src/commands/local/dev-local.js

@@ -1,21 +1,3 @@
-/**
- * Local DevOutput source for `mesh dev` (design §5.2, AC C1/C3).
- *
- * Instead of reading a deployed Pulumi stack, synthesize the same DevOutput
- * shape from repo conventions and point every service at the running
- * `mesh start` platform. Zero AWS credentials, zero VPN, zero Pulumi state —
- * the app's code never knows it's local:
- *   - Temporal → localhost:7233, namespace local-dev (seeded)
- *   - Postgres → the local `app` database
- *   - Zitadel  → http://localhost:8080 (seeded org/app/users)
- *   - SpiceDB  → localhost:50051 (preshared key)
- *   - AWS SDK  → ministack via AWS_ENDPOINT_URL (SSM/Secrets/S3 registry)
- *
- * Detection convention = what `mesh create-app` templates emit: immediate
- * subdirectories of the app root whose package.json has a `dev` script
- * (api/, worker/, web/, …); a single-package app root with its own `dev`
- * script becomes one service.
- */
 import * as fs from "fs";
 import * as path from "path";
 import { isServiceMode, openapiMockCommand } from "./mocks.js";
@@ -30,28 +12,12 @@ import { getContextConfig } from "../login.js";
 import { findMeshJson } from "../../utils/mesh-json.js";
 export const LOCAL_STACK_NAME = "local";
 const BASE_PORT = 3000;
-/**
- * The app's namespace, exactly the name the cloud gives it in K8s AND
- * Temporal ({tenant}-{env}-{app}) — the Hub resolves both from this one
- * convention, so local runs are addressable with zero translation.
- */
 export function localAppNamespace(tenant, appName) {
     return `${tenant}-${LOCAL_ENV}-${appName}`;
 }
-/** The OTLP log shipper (assets/log-shipper.mjs) each local service's
- * launch pipeline pipes through — ships stdout to the stack's collector
- * with the hosted k8s_* attribution. */
 export function logShipperPath() {
     return path.join(findPackageRoot(), "assets", "log-shipper.mjs");
 }
-/**
- * OTel SDK bootstrap — the local analog of the OTel Operator's pod
- * injection: when the service ships `@opentelemetry/auto-instrumentations-
- * node` (the templates declare it), the platform injects the `--import`
- * register hook + exporter env, and HTTP/fetch/gRPC spans flow to the
- * stack's collector → Tempo → the Hub's Traces views. Apps without the
- * package run untouched.
- */
 export function autoInstrumentationEnv(appRoot, src) {
     const pkgDir = path.join("node_modules", "@opentelemetry", "auto-instrumentations-node");
     const present = fs.existsSync(path.join(appRoot, src, pkgDir)) || fs.existsSync(path.join(appRoot, pkgDir));
@@ -60,15 +26,11 @@ export function autoInstrumentationEnv(appRoot, src) {
     return {
         NODE_OPTIONS: { value: "--import @opentelemetry/auto-instrumentations-node/register" },
         OTEL_TRACES_EXPORTER: { value: "otlp" },
-        // Logs ship via the launch pipeline; metrics locally come from
-        // Prometheus scrapes — keep the SDK to traces.
         OTEL_METRICS_EXPORTER: { value: "none" },
         OTEL_LOGS_EXPORTER: { value: "none" },
         OTEL_NODE_DISABLED_INSTRUMENTATIONS: { value: "fs,dns,net" },
     };
 }
-/** Hosted-parity resource attribution for a local service — what the
- * in-cluster k8sattributes processor stamps. */
 export function otelEnv(tenant, appName, serviceName) {
     const namespace = localAppNamespace(tenant, appName);
     return {
@@ -79,23 +41,15 @@ export function otelEnv(tenant, appName, serviceName) {
         },
     };
 }
-/** Endpoints of the running `mesh start` platform, as service env. */
 export function localPlatformEnv(tenant, appName, serviceName) {
     const namespace = localAppNamespace(tenant, appName);
     const env = {
         TEMPORAL_ADDRESS: { value: TEMPORAL_ADDRESS },
         TEMPORAL_NAMESPACE: { value: namespace },
         TEMPORAL_TASK_QUEUE: { value: appName },
-        // OTel wiring, two consumers: instrumented services ship traces/metrics
-        // themselves, and the launch pipeline's log shipper reads these to ship
-        // stdout logs — both with the in-cluster k8sattributes attribution.
         ...otelEnv(tenant, appName, serviceName),
         DATABASE_URL: { value: "postgres://postgres:postgres@localhost:5433/app" },
         ZITADEL_ISSUER: { value: ZITADEL_ISSUER },
-        // The service's own Zitadel M2M credentials (created by ensureAppTenantAuth
-        // on session start) — resolveCredentials("zitadel") picks this up, so apps
-        // can hydrate introspection/M2M config the same way they resolve
-        // ExternalService links instead of hand-carrying client ids in env files.
         ZITADEL_SECRET_PREFIX: { value: authSecretPath(tenant, appName, serviceName) },
         SPICEDB_ENDPOINT: { value: "localhost:50051" },
         SPICEDB_HTTP_ENDPOINT: { value: "http://localhost:8443" },
@@ -104,9 +58,6 @@ export function localPlatformEnv(tenant, appName, serviceName) {
         MESH_LOCAL: { value: "1" },
         MESH_SERVICE: { value: serviceName },
     };
-    // Local tokens come from `mesh login local` (the seeded CLI app), so that
-    // app's clientId is the audience local APIs should verify. In the cloud,
-    // consumers request the API project's audience scope instead.
     const cliClientId = getContextConfig(LOGIN_CONTEXT)?.clientId;
     if (cliClientId) {
         env.AUTH_AUDIENCE = { value: cliClientId };
@@ -116,18 +67,6 @@ export function localPlatformEnv(tenant, appName, serviceName) {
     }
     return env;
 }
-/**
- * A Dagster workspace announces itself in one of the two shapes `dg dev`
- * accepts: a `dg.toml` at the root (workspace convention — one file listing
- * one or more projects), or a root `pyproject.toml` carrying a `[tool.dg]`
- * table (single-project convention). Either earns the synthesized `dg dev`
- * service.
- *
- * @example
- * isDagsterWorkspaceRoot("/repos/acme-dagster");      // true — has dg.toml
- * isDagsterWorkspaceRoot("/repos/bank-statements");   // true — pyproject.toml has [tool.dg]
- * isDagsterWorkspaceRoot("/repos/plain-hono-api");    // false
- */
 export function isDagsterWorkspaceRoot(appRoot) {
     if (fs.existsSync(path.join(appRoot, "dg.toml")))
         return true;
@@ -141,20 +80,6 @@ export function isDagsterWorkspaceRoot(appRoot) {
         return false;
     }
 }
-/**
- * Locate the `dg` binary for a workspace, by layout convention:
- * `deployments/local/.venv` (a workspace keeping its dev CLI venv separate
- * from per-project venvs) first, then a root `.venv` (single-project
- * workspaces where one `uv sync` at the root covers everything). Falls back
- * to `dg` on PATH (uv tool install / pipx) when neither venv exists yet —
- * the launch window then shows dg's own error, which names the missing venv
- * more usefully than a failed path lookup would.
- *
- * @example
- * resolveDgBinary("/repos/acme-dagster");     // "deployments/local/.venv/bin/dg"
- * resolveDgBinary("/repos/bank-statements");  // ".venv/bin/dg" (root uv sync)
- * resolveDgBinary("/repos/fresh-clone");      // "dg" (no venv built yet)
- */
 export function resolveDgBinary(appRoot) {
     for (const candidate of ["deployments/local/.venv/bin/dg", ".venv/bin/dg"]) {
         if (fs.existsSync(path.join(appRoot, candidate)))
@@ -174,11 +99,6 @@ function hasDevScript(dir) {
         return false;
     }
 }
-/**
- * Detect runnable services by template convention: immediate subdirectories
- * with a package.json `dev` script; falls back to the app root itself when
- * it is a single-package app.
- */
 export function detectLocalServices(appRoot) {
     const services = {};
     for (const entry of fs.readdirSync(appRoot, { withFileTypes: true })) {
@@ -193,26 +113,13 @@ export function detectLocalServices(appRoot) {
     }
     return services;
 }
-/** Synthesize the DevOutput `mesh dev` would otherwise read from Pulumi.
- * `tenant` is the app tenant (detectLocalTenant) — it scopes the app's
- * namespace ({tenant}-{env}-{app}) for Temporal, logs, and traces.
- * `opts.mocks` (mesh dev --externals) appends declared mock services and injects
- * their ExternalService credential prefixes into every app service. */
 export function buildLocalDevOutput(appRoot, tenant, opts = {}) {
     const detected = detectLocalServices(appRoot);
     const names = Object.keys(detected);
-    // A Dagster workspace (dg.toml, or [tool.dg] in a root pyproject.toml) is
-    // runnable even with zero package.json services — the common shape: the
-    // pipelines are Python, the only Node artifact is the Pulumi program.
     const isDagsterWorkspace = isDagsterWorkspaceRoot(appRoot);
     if (names.length === 0 && !isDagsterWorkspace) {
         throw new MeshCliError(`No runnable services found under ${appRoot} — expected subdirectories (api/, worker/, …) with a package.json 'dev' script, or a Dagster workspace (dg.toml, or [tool.dg] in pyproject.toml).`, { remediation: { command: "mesh create-app" } });
     }
-    // App name = project name = authz namespace. Pulumi.yaml `name:` wins
-    // (matches getProjectName — a stack-backed app run with --local must keep
-    // its deployed identity), then package.json name, then the basename.
-    // Scoped package names (@scu-apps/plaid) are unusable as Temporal/K8s
-    // namespaces — drop the scope.
     let appName = path.basename(appRoot);
     try {
         const pkg = JSON.parse(fs.readFileSync(path.join(appRoot, "package.json"), "utf-8"));
@@ -220,7 +127,6 @@ export function buildLocalDevOutput(appRoot, tenant, opts = {}) {
             appName = pkg.name.replace(/^@[^/]+\//, "");
     }
     catch {
-        // no root package.json — keep the basename
     }
     const pulumiYaml = path.join(appRoot, "Pulumi.yaml");
     if (fs.existsSync(pulumiYaml)) {
@@ -230,13 +136,7 @@ export function buildLocalDevOutput(appRoot, tenant, opts = {}) {
     }
     const services = {};
     const mocks = opts.mocks ?? {};
-    // Only process/openapi declarations run as mock-{name} services in this
-    // orchestration; compose externals are docker-managed and sandbox
-    // declarations spawn nothing (dev.ts seeds their credentials directly).
     const mockNames = Object.keys(mocks).filter((name) => isServiceMode(name, mocks[name]));
-    // The ExternalService link() contract, synthesized: every app service gets
-    // {EXT}_SECRET_PREFIX for each mocked external, so resolveCredentials()
-    // runs the exact deployed code path against the locally seeded secret.
     const externalEnv = {};
     for (const decl of Object.values(mocks)) {
         if (!decl.external)
@@ -253,7 +153,6 @@ export function buildLocalDevOutput(appRoot, tenant, opts = {}) {
             port,
             command: ["pnpm", "dev"],
             env: {
-                // allocatePorts keeps service.port and env.PORT in sync on reallocation
                 PORT: { value: String(port) },
                 ...localPlatformEnv(tenant, appName, name),
                 ...autoInstrumentationEnv(appRoot, detected[name].src),
@@ -261,18 +160,6 @@ export function buildLocalDevOutput(appRoot, tenant, opts = {}) {
             },
         };
     });
-    // Sibling-service URLs — the local analog of the deployed cross-service
-    // wiring (http://{svc}.{namespace}.svc.cluster.local:{port} in-cluster):
-    // every app service gets SERVICE_{NAME}_URL for each app service, so code
-    // can wire cross-service clients locally without knowing allocated ports.
-    // allocatePorts' cross-service localhost:{port} rewrite keeps them in sync
-    // when ports are reallocated.
-    //
-    // This is a PUBLIC, app-facing env contract — {NAME} is the service's
-    // directory name upper-cased, non-[A-Z0-9] → "_". Apps that name their
-    // link the same way (events.link({ environmentPrefix: "SERVICE_EVENTS" }))
-    // read ONE variable deployed and locally, with no isLocal branch.
-    // See docs/guides/mesh-dev-local-env.md.
     for (const name of names) {
         const key = `SERVICE_${name.toUpperCase().replace(/[^A-Z0-9]/g, "_")}_URL`;
         const url = `http://localhost:${services[name].port}`;
@@ -280,25 +167,9 @@ export function buildLocalDevOutput(appRoot, tenant, opts = {}) {
             services[other].env[key] = { value: url };
         }
     }
-    // Dagster workspace: synthesize the `dg dev` webserver as a first-class
-    // service — the local counterpart of the dev service a DagsterInstance
-    // registers from its Pulumi program. The binary is resolved by layout
-    // convention (resolveDgBinary). `-p "$PORT"` is expanded by the launch
-    // shell from the sourced env file, so a reallocated port
-    // (rewriteOwnServicePort keeps env.PORT in sync) still binds correctly — a
-    // literal port in the argv would go stale. DAGSTER_HOME pins instance
-    // state under the app root so `dg dev` doesn't scatter
-    // .tmp_dagster_home_* directories. The service inherits localPlatformEnv,
-    // so pipelines reach ministack S3 (AWS_ENDPOINT_URL) with no credential
-    // setup.
     if (isDagsterWorkspace) {
         const port = BASE_PORT + names.length + mockNames.length;
         services["dagster"] = {
-            // Absolute on purpose: a relative src is MONOREPO-ROOT-relative by the
-            // ServiceDevOutput contract (rebaseServiceSrc), which for an app nested
-            // in the monorepo would cd the launch shell to the repo root — where
-            // neither dg.toml nor the venv path resolves. The absolute app root
-            // survives rebasing in both the monorepo and standalone-repo shapes.
             src: appRoot,
             kind: "dagster",
             port,
@@ -310,14 +181,11 @@ export function buildLocalDevOutput(appRoot, tenant, opts = {}) {
             },
         };
     }
-    // Declared mocks join the same orchestration (ports, env file, tmux
-    // window, log pipeline) as first-class services named mock-{name}.
     mockNames.forEach((name, i) => {
         const decl = mocks[name];
         const serviceName = `mock-${name}`;
         const port = decl.port ?? BASE_PORT + names.length + i;
         services[serviceName] = {
-            // openapi mode runs Prism from the app root against the spec path.
             src: decl.src ?? ".",
             port,
             command: decl.openapi ? openapiMockCommand(decl) : (decl.command ?? ["pnpm", "dev"]),
@@ -336,13 +204,6 @@ export function buildLocalDevOutput(appRoot, tenant, opts = {}) {
         tunnels: {},
     };
 }
-/**
- * Whether the app is backed by a Pulumi program: its own (Pulumi.yaml or a
- * Pulumi.<stack>.yaml stack config in the app dir), or a monorepo ROOT
- * program above it (walk up to the repo boundary — .git/pnpm-workspace).
- * Apps like apps/hub deploy via a root program and have no per-app
- * Pulumi.yaml; they must NOT default into `mesh dev` local mode.
- */
 export function hasStackBacking(appRoot) {
     const hasOwn = fs.existsSync(path.join(appRoot, "Pulumi.yaml")) ||
         fs.readdirSync(appRoot).some((f) => /^Pulumi\..+\.yaml$/.test(f));
@@ -361,10 +222,6 @@ export function hasStackBacking(appRoot) {
         dir = parent;
     }
 }
-/**
- * The app's tenant, for auth provisioning: `mesh:tenant` from the app's
- * Pulumi stack config when present (templates write it), else "local".
- */
 export function detectLocalTenant(appRoot) {
     for (const file of fs.readdirSync(appRoot)) {
         if (!/^Pulumi\..*\.yaml$/.test(file))
@@ -375,18 +232,14 @@ export function detectLocalTenant(appRoot) {
         if (match)
             return match[1];
     }
-    // No per-app stack config names a tenant: fall back to the repo-level
-    // record `mesh init` writes, then to the local default.
     const recorded = findMeshJson(appRoot);
     if (recorded)
         return recorded.data.tenant;
     return "local";
 }
-/** The local platform must be up before `mesh dev` can wire services to it. */
 export async function ensureLocalPlatformRunning() {
     const [temporalUp, fabricUp] = await Promise.all([probeTcp(7233), probeTcp(4566)]);
     if (!temporalUp || !fabricUp) {
         throw new MeshCliError("The local Mesh platform is not running (mesh dev local mode wires services to it).", { remediation: { command: "mesh start" } });
     }
 }
-//# sourceMappingURL=dev-local.js.map