@mesh-tech/mesh-cli 0.20.2 → 0.20.4

package/dist/src/commands/local/docker-runner.d.ts

@@ -1,23 +1,3 @@
-/**
- * Docker runner for `mesh dev --local` (design §5.3, AC C2).
- *
- * The tmux runner stays the default on dev machines; `--runner docker` is
- * for environments where tmux isn't sensible — CI (the golden-path
- * workflow), headless agents, non-macOS boxes. It renders the SAME
- * synthesized DevOutput into a docker compose project:
- *
- *   - one service per DevOutput service, `node:22-bookworm`, the app
- *     bind-mounted at /workspace, `pnpm dev` in the service dir
- *   - `network_mode: host` — services reach the `mesh start` platform on
- *     localhost exactly like the tmux runner (Linux/CI semantics; on macOS
- *     Docker Desktop host networking must be enabled, and host-installed
- *     node_modules are platform-specific — tmux is the right runner there)
- *   - per-service env files carrying the identical env contract
- *   - logs ship through the same OTLP shipper (mounted from the CLI)
- *
- * Parity: `mesh dev --status|--kill|logs|restart` map to
- * `docker compose ps|down|logs|restart` via the session state's runner.
- */
 interface RunnerService {
     src: string;
     port: number;
@@ -26,7 +6,6 @@ interface RunnerService {
         value: string;
     }>;
 }
-/** Write the compose project for a dev session; returns the compose file path. */
 export declare function writeDevCompose(sessionName: string, appRoot: string, services: Record<string, RunnerService>): string;
 export declare function dockerDevUp(sessionName: string): void;
 export declare function dockerDevDown(sessionName: string): void;
@@ -34,4 +13,3 @@ export declare function dockerDevPs(sessionName: string): string;
 export declare function dockerDevLogs(sessionName: string, service: string, tail: number): string;
 export declare function dockerDevRestart(sessionName: string, service: string): void;
 export {};
-//# sourceMappingURL=docker-runner.d.ts.map

package/dist/src/commands/local/docker-runner.js

@@ -1,45 +1,21 @@
-/**
- * Docker runner for `mesh dev --local` (design §5.3, AC C2).
- *
- * The tmux runner stays the default on dev machines; `--runner docker` is
- * for environments where tmux isn't sensible — CI (the golden-path
- * workflow), headless agents, non-macOS boxes. It renders the SAME
- * synthesized DevOutput into a docker compose project:
- *
- *   - one service per DevOutput service, `node:22-bookworm`, the app
- *     bind-mounted at /workspace, `pnpm dev` in the service dir
- *   - `network_mode: host` — services reach the `mesh start` platform on
- *     localhost exactly like the tmux runner (Linux/CI semantics; on macOS
- *     Docker Desktop host networking must be enabled, and host-installed
- *     node_modules are platform-specific — tmux is the right runner there)
- *   - per-service env files carrying the identical env contract
- *   - logs ship through the same OTLP shipper (mounted from the CLI)
- *
- * Parity: `mesh dev --status|--kill|logs|restart` map to
- * `docker compose ps|down|logs|restart` via the session state's runner.
- */
 import { execFileSync } from "child_process";
 import * as fs from "fs";
 import * as path from "path";
 import { logShipperPath } from "./dev-local.js";
 import { meshCacheDir } from "../../utils/cache-home.js";
-// Digest-pinned so dev-runner containers are reproducible (matches the
-// pinning of the stack's third-party images).
 const DEV_RUNNER_IMAGE = "node:22-bookworm@sha256:5647be709086c696ff32edaaf1c70cd26d1da6ab2b39c32f3c7b4c4a31957e37";
 function sessionDir(sessionName) {
     return meshCacheDir("mesh-local", "dev", sessionName);
 }
-/** docker env-file format: KEY=VALUE, no quoting, single-line values only. */
 function renderDockerEnvFile(env) {
     const lines = [];
     for (const [key, entry] of Object.entries(env)) {
         if (entry.value.includes("\n"))
-            continue; // multi-line values unsupported by env_file
+            continue;
         lines.push(`${key}=${entry.value}`);
     }
     return lines.join("\n") + "\n";
 }
-/** Write the compose project for a dev session; returns the compose file path. */
 export function writeDevCompose(sessionName, appRoot, services) {
     const dir = sessionDir(sessionName);
     const shipper = logShipperPath();
@@ -55,15 +31,7 @@ export function writeDevCompose(sessionName, appRoot, services) {
         const ship = env.OTEL_RESOURCE_ATTRIBUTES
             ? ` 2>&1 | NODE_OPTIONS= node /mesh-assets/log-shipper.mjs`
             : "";
-        blocks.push(`  ${name}:`, `    image: ${DEV_RUNNER_IMAGE}`, `    network_mode: host`, `    working_dir: ${workdir}`, `    volumes:`, `      - '${appRoot}:/workspace'`, `      - '${path.dirname(shipper)}:/mesh-assets:ro'`, `    environment:`, 
-        // node_modules is the HOST's bind-mounted install — pnpm inside the
-        // container must never "verify" it and try a purge/reinstall (pnpm
-        // ≥10.9's verify-deps-before-run prompts and dies headless; worse, a
-        // purge would clobber the host install).
-        `      CI: 'true'`, `      npm_config_verify_deps_before_run: 'false'`, `    env_file:`, `      - './${name}.env'`, 
-        // pipefail: the container's exit code must be the SERVICE's, not the
-        // log-shipper's — otherwise a crashed service reports success (CI).
-        `    command: ["bash", "-lc", "set -o pipefail; corepack enable >/dev/null 2>&1; { ${service.command.join(" ")}; }${ship}"]`, `    restart: unless-stopped`);
+        blocks.push(`  ${name}:`, `    image: ${DEV_RUNNER_IMAGE}`, `    network_mode: host`, `    working_dir: ${workdir}`, `    volumes:`, `      - '${appRoot}:/workspace'`, `      - '${path.dirname(shipper)}:/mesh-assets:ro'`, `    environment:`, `      CI: 'true'`, `      npm_config_verify_deps_before_run: 'false'`, `    env_file:`, `      - './${name}.env'`, `    command: ["bash", "-lc", "set -o pipefail; corepack enable >/dev/null 2>&1; { ${service.command.join(" ")}; }${ship}"]`, `    restart: unless-stopped`);
     }
     const composePath = path.join(dir, "compose.yml");
     fs.writeFileSync(composePath, blocks.join("\n") + "\n");
@@ -99,4 +67,3 @@ export function dockerDevRestart(sessionName, service) {
         stdio: ["ignore", "inherit", "inherit"],
     });
 }
-//# sourceMappingURL=docker-runner.js.map

package/dist/src/commands/local/helpers.d.ts

@@ -1,22 +1,8 @@
-/**
- * Small shared helpers for the local-platform commands — extracted from the
- * copies that had grown in auth-provision/mocks (secret upsert) and
- * dev-local/stack (TCP probe).
- */
-/** The subset of SecretsManagerClient upsertLocalSecret depends on. */
 export interface SecretsSender {
     send(command: unknown): Promise<unknown>;
 }
-/**
- * Create-or-update a Secrets Manager secret in the local AWS fabric
- * (ministack). Create first; on ResourceExistsException, put a new value.
- * `client` is injectable for tests; defaults to a client against the local
- * fabric.
- */
 export declare function upsertLocalSecret(secretId: string, value: Record<string, string>, client?: SecretsSender): Promise<void>;
-/** True when a TCP connect to host:port succeeds within timeoutMs. */
 export declare function probeTcp(port: number, opts?: {
     host?: string;
     timeoutMs?: number;
 }): Promise<boolean>;
-//# sourceMappingURL=helpers.d.ts.map

package/dist/src/commands/local/helpers.js

@@ -1,16 +1,5 @@
-/**
- * Small shared helpers for the local-platform commands — extracted from the
- * copies that had grown in auth-provision/mocks (secret upsert) and
- * dev-local/stack (TCP probe).
- */
 import * as net from "net";
 import { LOCAL_AWS_CONFIG } from "./seed.js";
-/**
- * Create-or-update a Secrets Manager secret in the local AWS fabric
- * (ministack). Create first; on ResourceExistsException, put a new value.
- * `client` is injectable for tests; defaults to a client against the local
- * fabric.
- */
 export async function upsertLocalSecret(secretId, value, client) {
     const { SecretsManagerClient, CreateSecretCommand, PutSecretValueCommand } = await import("@aws-sdk/client-secrets-manager");
     const sm = client ?? new SecretsManagerClient(LOCAL_AWS_CONFIG);
@@ -27,7 +16,6 @@ export async function upsertLocalSecret(secretId, value, client) {
         }
     }
 }
-/** True when a TCP connect to host:port succeeds within timeoutMs. */
 export function probeTcp(port, opts = {}) {
     const { host = "127.0.0.1", timeoutMs = 2000 } = opts;
     return new Promise((resolve) => {
@@ -43,4 +31,3 @@ export function probeTcp(port, opts = {}) {
         });
     });
 }
-//# sourceMappingURL=helpers.js.map

package/dist/src/commands/local/hub-local.d.ts

@@ -1,28 +1,7 @@
-/**
- * Local Hub image builder (`mesh start --with-hub`) — the interim path
- * until the hub pipeline publishes pullable container images (design §11).
- *
- * Resolves the published @mesh-tech/hub tarball with the user's registry
- * auth (mesh registry login), extracts it, and docker-builds two images
- * from the prebuilt dists it ships (api/dist → mesh-local-hub-api,
- * ui/build → mesh-local-hub-ui). The CodeArtifact token enters the build
- * as a BuildKit secret and never lands in a layer. Idempotent: images are
- * keyed by the package version and rebuilt only when missing.
- */
 import { type RegistryTokenState } from "../../utils/auth-preflight.js";
 export declare const HUB_IMAGES: readonly ["mesh-local-hub-api", "mesh-local-hub-ui"];
-/**
- * Build the Hub's oauth2-proxy image (hosted sidecar + loopback issuer
- * forward). Public base images only — no registry auth involved.
- */
 export declare function ensureHubAuthImage(): void;
-/** Registry auth present? (Needed only to BUILD hub images, not to run them.) */
 export declare function hasRegistryAuth(): boolean;
-/**
- * Newest hub version whose images already exist locally — lets `mesh start`
- * include the Hub by default with no network and no registry auth. Returns
- * undefined when no built images are present.
- */
 export declare function localHubVersion(): string | undefined;
 export type WithHubPlan = {
     action: "refresh";
@@ -35,90 +14,15 @@ export type WithHubPlan = {
     message: string;
     remediation: string;
 };
-/**
- * Pure: decide what `mesh start --with-hub` does given the registry probe
- * and any already-built local images. Only a *refresh* needs the registry —
- * already-built images run without it, so an expired/missing token degrades
- * to those (with the fixing command) instead of hard-failing a path that
- * works offline (MESH-2479).
- */
 export declare function planWithHubRefresh(probeState: RegistryTokenState, builtVersion: string | undefined): WithHubPlan;
-/**
- * Ensure the two local hub images exist; build them from the tarball when
- * missing. Returns the hub version (used as the compose image tag).
- */
 export declare function ensureHubImages(): Promise<string>;
-/** Where the packed Hub ships its compiled authz catalog (`compile-authz.ts`). */
 export declare const HUB_COMPILED_AUTHZ_REL = "api/dist/authz/compiled.json";
-/** The compiled catalog artifact: `{ zed, metadata }`, the shape `SpiceDBSchema` takes. */
 export type HubCompiledAuthz = {
     zed: string;
     metadata: Record<string, unknown>;
 };
-/**
- * The cached tarball a local image version was built from, or null for a
- * from-source build (`<version>-src`), which never has one.
- *
- * @example
- * ```typescript
- * tarballNameForImageVersion("2.2.0-r2"); // => "mesh-tech-hub-2.2.0.tgz"
- * tarballNameForImageVersion("2.2.0-src"); // => null
- * ```
- */
 export declare function tarballNameForImageVersion(version: string): string | null;
-/**
- * Read the compiled authz catalog of the Hub whose images `mesh start` runs.
- *
- * The staged build context (`context-<version>/`) carries it after a build; when
- * the images already existed nothing was staged, so the one file is extracted
- * from the cached tarball on demand. Returns null for a Hub that ships no
- * catalog (published before 2.1.0) — the caller says so and moves on.
- */
 export declare function readHubCompiledAuthz(version: string): HubCompiledAuthz | null;
-/**
- * The workspace's default pnpm catalog, as `{ dependency: range }`.
- *
- * Nested manifests inside the packed Hub (`api/package.json`, `ui/package.json`)
- * reference shared versions as `catalog:`. pnpm resolves that on publish for the
- * package's OWN manifest only — the nested ones ship the literal `catalog:`, and
- * `npm install` inside the image rejects it with `EUNSUPPORTEDPROTOCOL`.
- */
 export declare function readWorkspaceCatalog(repoRoot: string): Record<string, string>;
-/**
- * Make an extracted Hub tarball installable by plain `npm` inside the image.
- *
- * Two rewrites, both on the NESTED manifests the Dockerfiles copy:
- *
- *  - `catalog:` → the range the workspace catalog pins.
- *  - `workspace:*` dependencies are DROPPED. Every deployed Hub entrypoint is
- *    bundled by `esm-bundle`, so no `@mesh-tech/*`
- *    or `@libs/*` import survives into `api/dist` / `ui/build` — installing them
- *    would fetch PUBLISHED copies that nothing imports, and for a package being
- *    changed in this checkout that published copy is precisely the wrong code.
- *  - `devDependencies` are DROPPED wholesale. Both Dockerfiles install with
- *    `--omit=dev`, so nothing in the image ever needs them — but npm still
- *    resolves them into the ideal tree before omitting, and the Hub's dev set
- *    (vitest, tsx, the React Router toolchain) trips a peer-conflict crash in
- *    the image's npm 10 (`Cannot read properties of null (reading 'edgesOut')`
- *    in arborist's `#loadPeerSet`) that fails the build before a single layer
- *    is written. Reproduced on the normalized `api/package.json` alone; the
- *    same manifest installs clean without the block.
- *
- * Returns the manifests it touched, for the caller to log.
- */
 export declare function normalizeHubManifests(contextDir: string, catalog: Record<string, string>): string[];
-/**
- * Build the local Hub images from THIS checkout instead of the registry.
- *
- * `mesh start`'s Hub normally comes from the published `@mesh-tech/hub` tarball,
- * which makes it the one environment where a Hub change cannot be exercised
- * before it ships. This packs `apps/hub` exactly as a release would — same
- * `files` allowlist, same Dockerfiles — so the containerized Hub, its auth proxy
- * and its login flow all stay identical; only the code inside changes.
- *
- * Images are tagged `<version>-src` so they can never be mistaken for, or reused
- * as, a published build, and are rebuilt every call: the whole point is to pick
- * up working-tree changes.
- */
 export declare function buildHubImagesFromSource(repoRoot: string): Promise<string>;
-//# sourceMappingURL=hub-local.d.ts.map

package/dist/src/commands/local/hub-local.js

@@ -1,14 +1,3 @@
-/**
- * Local Hub image builder (`mesh start --with-hub`) — the interim path
- * until the hub pipeline publishes pullable container images (design §11).
- *
- * Resolves the published @mesh-tech/hub tarball with the user's registry
- * auth (mesh registry login), extracts it, and docker-builds two images
- * from the prebuilt dists it ships (api/dist → mesh-local-hub-api,
- * ui/build → mesh-local-hub-ui). The CodeArtifact token enters the build
- * as a BuildKit secret and never lands in a layer. Idempotent: images are
- * keyed by the package version and rebuilt only when missing.
- */
 import { execFile, execFileSync } from "child_process";
 import * as fs from "fs";
 import * as os from "os";
@@ -22,8 +11,6 @@ import { meshCacheDir } from "../../utils/cache-home.js";
 const execFileAsync = promisify(execFile);
 const HUB_PACKAGE = "@mesh-tech/hub";
 export const HUB_IMAGES = ["mesh-local-hub-api", "mesh-local-hub-ui"];
-/** Bump when stack/hub/Dockerfile.* change — forces a rebuild of images
- * already cached for the same published hub version. */
 const LOCAL_IMAGE_REV = "r2";
 function cacheDir() {
     return meshCacheDir("hub-local");
@@ -44,12 +31,7 @@ function imageExists(tag) {
         return false;
     }
 }
-/** Tag referenced by docker-compose.hub.yml — bump alongside Dockerfile.auth. */
 const HUB_AUTH_IMAGE = "mesh-local-hub-auth:v7.7.1-r1";
-/**
- * Build the Hub's oauth2-proxy image (hosted sidecar + loopback issuer
- * forward). Public base images only — no registry auth involved.
- */
 export function ensureHubAuthImage() {
     if (imageExists(HUB_AUTH_IMAGE))
         return;
@@ -58,16 +40,10 @@ export function ensureHubAuthImage() {
     execFileSync("docker", ["build", "-f", path.join(hubStackDir, "Dockerfile.auth"), "-t", HUB_AUTH_IMAGE, hubStackDir], { stdio: ["ignore", "inherit", "inherit"], env: { ...process.env, DOCKER_BUILDKIT: "1" } });
     logSuccess(`Built ${HUB_AUTH_IMAGE}`);
 }
-/** Registry auth present? (Needed only to BUILD hub images, not to run them.) */
 export function hasRegistryAuth() {
     const p = path.join(os.homedir(), ".npmrc");
     return fs.existsSync(p) && fs.readFileSync(p, "utf-8").includes("codeartifact");
 }
-/**
- * Newest hub version whose images already exist locally — lets `mesh start`
- * include the Hub by default with no network and no registry auth. Returns
- * undefined when no built images are present.
- */
 export function localHubVersion() {
     const versions = HUB_IMAGES.map((name) => {
         try {
@@ -84,13 +60,8 @@ export function localHubVersion() {
     const shared = versions[0].filter((v) => v.endsWith(`-${LOCAL_IMAGE_REV}`) && versions.every((list) => list.includes(v)));
     if (shared.length === 0)
         return undefined;
-    // Highest semver wins (numeric-aware compare handles the -rN suffix).
     return shared.sort((a, b) => a.localeCompare(b, undefined, { numeric: true })).at(-1);
 }
-/** `npm pack` the published hub tarball into the cache; returns its path +
- * version. Falls back to the newest cached tarball when the registry is
- * unreachable (offline / expired token). Async so the heartbeat can fill
- * silence during the fetch — a first run's slowest, quietest step. */
 async function fetchTarball() {
     const dir = cacheDir();
     logInfo(`Resolving ${HUB_PACKAGE} from the registry…`);
@@ -108,8 +79,6 @@ async function fetchTarball() {
             .sort((a, b) => a.localeCompare(b, undefined, { numeric: true }))
             .at(-1);
         if (!cached) {
-            // Map npm's E401 ("try npm login") to the Mesh fix — npm login can
-            // never mint a CodeArtifact token (MESH-2479).
             if (authFailure) {
                 throw new MeshCliError(`The registry rejected the ${HUB_PACKAGE} tarball fetch (E401 Unauthorized) — your CodeArtifact token is expired or invalid. (npm's "try npm login" advice does not apply to this registry.)`, { remediation: { command: REGISTRY_LOGIN_FIX }, cause: err });
             }
@@ -128,13 +97,6 @@ async function fetchTarball() {
         heartbeat.stop();
     }
 }
-/**
- * Pure: decide what `mesh start --with-hub` does given the registry probe
- * and any already-built local images. Only a *refresh* needs the registry —
- * already-built images run without it, so an expired/missing token degrades
- * to those (with the fixing command) instead of hard-failing a path that
- * works offline (MESH-2479).
- */
 export function planWithHubRefresh(probeState, builtVersion) {
     if (probeState !== "expired" && probeState !== "missing")
         return { action: "refresh" };
@@ -154,10 +116,6 @@ export function planWithHubRefresh(probeState, builtVersion) {
         remediation: REGISTRY_LOGIN_FIX,
     };
 }
-/**
- * Ensure the two local hub images exist; build them from the tarball when
- * missing. Returns the hub version (used as the compose image tag).
- */
 export async function ensureHubImages() {
     const npmrc = npmrcPath();
     const { tarball, version: packageVersion } = await fetchTarball();
@@ -193,32 +151,12 @@ export async function ensureHubImages() {
     }
     return version;
 }
-// ── the Hub's compiled authz catalog ─────────────────────────────────────────
-/** Where the packed Hub ships its compiled authz catalog (`compile-authz.ts`). */
 export const HUB_COMPILED_AUTHZ_REL = "api/dist/authz/compiled.json";
-/**
- * The cached tarball a local image version was built from, or null for a
- * from-source build (`<version>-src`), which never has one.
- *
- * @example
- * ```typescript
- * tarballNameForImageVersion("2.2.0-r2"); // => "mesh-tech-hub-2.2.0.tgz"
- * tarballNameForImageVersion("2.2.0-src"); // => null
- * ```
- */
 export function tarballNameForImageVersion(version) {
     if (version.endsWith("-src"))
         return null;
     return `mesh-tech-hub-${version.replace(/-r\d+$/, "")}.tgz`;
 }
-/**
- * Read the compiled authz catalog of the Hub whose images `mesh start` runs.
- *
- * The staged build context (`context-<version>/`) carries it after a build; when
- * the images already existed nothing was staged, so the one file is extracted
- * from the cached tarball on demand. Returns null for a Hub that ships no
- * catalog (published before 2.1.0) — the caller says so and moves on.
- */
 export function readHubCompiledAuthz(version) {
     const context = path.join(cacheDir(), `context-${version}`);
     const file = path.join(context, HUB_COMPILED_AUTHZ_REL);
@@ -241,15 +179,6 @@ export function readHubCompiledAuthz(version) {
         return null;
     return { zed: parsed.zed, metadata: parsed.metadata };
 }
-// ── from-source build (`mesh start --hub-from-source`) ──────────────────────
-/**
- * The workspace's default pnpm catalog, as `{ dependency: range }`.
- *
- * Nested manifests inside the packed Hub (`api/package.json`, `ui/package.json`)
- * reference shared versions as `catalog:`. pnpm resolves that on publish for the
- * package's OWN manifest only — the nested ones ship the literal `catalog:`, and
- * `npm install` inside the image rejects it with `EUNSUPPORTEDPROTOCOL`.
- */
 export function readWorkspaceCatalog(repoRoot) {
     const text = fs.readFileSync(path.join(repoRoot, "pnpm-workspace.yaml"), "utf-8");
     const marker = "\ncatalog:\n";
@@ -258,7 +187,6 @@ export function readWorkspaceCatalog(repoRoot) {
         return {};
     const catalog = {};
     for (const line of text.slice(at + marker.length).split("\n")) {
-        // The block ends at the first line that is neither indented nor blank.
         if (line.trim() !== "" && !/^\s/.test(line))
             break;
         const m = /^\s+"?([^":\s]+)"?:\s*"?([^"\s#]+)"?/.exec(line);
@@ -267,28 +195,6 @@ export function readWorkspaceCatalog(repoRoot) {
     }
     return catalog;
 }
-/**
- * Make an extracted Hub tarball installable by plain `npm` inside the image.
- *
- * Two rewrites, both on the NESTED manifests the Dockerfiles copy:
- *
- *  - `catalog:` → the range the workspace catalog pins.
- *  - `workspace:*` dependencies are DROPPED. Every deployed Hub entrypoint is
- *    bundled by `esm-bundle`, so no `@mesh-tech/*`
- *    or `@libs/*` import survives into `api/dist` / `ui/build` — installing them
- *    would fetch PUBLISHED copies that nothing imports, and for a package being
- *    changed in this checkout that published copy is precisely the wrong code.
- *  - `devDependencies` are DROPPED wholesale. Both Dockerfiles install with
- *    `--omit=dev`, so nothing in the image ever needs them — but npm still
- *    resolves them into the ideal tree before omitting, and the Hub's dev set
- *    (vitest, tsx, the React Router toolchain) trips a peer-conflict crash in
- *    the image's npm 10 (`Cannot read properties of null (reading 'edgesOut')`
- *    in arborist's `#loadPeerSet`) that fails the build before a single layer
- *    is written. Reproduced on the normalized `api/package.json` alone; the
- *    same manifest installs clean without the block.
- *
- * Returns the manifests it touched, for the caller to log.
- */
 export function normalizeHubManifests(contextDir, catalog) {
     const DEP_FIELDS = ["dependencies", "optionalDependencies", "peerDependencies"];
     const touched = [];
@@ -333,19 +239,6 @@ export function normalizeHubManifests(contextDir, catalog) {
     }
     return touched;
 }
-/**
- * Build the local Hub images from THIS checkout instead of the registry.
- *
- * `mesh start`'s Hub normally comes from the published `@mesh-tech/hub` tarball,
- * which makes it the one environment where a Hub change cannot be exercised
- * before it ships. This packs `apps/hub` exactly as a release would — same
- * `files` allowlist, same Dockerfiles — so the containerized Hub, its auth proxy
- * and its login flow all stay identical; only the code inside changes.
- *
- * Images are tagged `<version>-src` so they can never be mistaken for, or reused
- * as, a published build, and are rebuilt every call: the whole point is to pick
- * up working-tree changes.
- */
 export async function buildHubImagesFromSource(repoRoot) {
     const hubDir = path.join(repoRoot, "apps", "hub");
     if (!fs.existsSync(path.join(hubDir, "package.json"))) {
@@ -365,9 +258,6 @@ export async function buildHubImagesFromSource(repoRoot) {
     const context = path.join(cacheDir(), `context-${version}`);
     fs.rmSync(context, { recursive: true, force: true });
     fs.mkdirSync(context, { recursive: true });
-    // `pnpm pack` applies the package's own `files` allowlist, so the context is
-    // byte-for-byte what a release would ship — not a hand-assembled copy that
-    // could omit something the published path includes.
     await execFileAsync("pnpm", ["pack", "--pack-destination", context], { cwd: hubDir, maxBuffer: 64 * 1024 * 1024 });
     const tarball = fs.readdirSync(context).find((f) => f.endsWith(".tgz"));
     if (!tarball)
@@ -390,4 +280,3 @@ export async function buildHubImagesFromSource(repoRoot) {
     }
     return version;
 }
-//# sourceMappingURL=hub-local.js.map

package/dist/src/commands/local/index.d.ts

@@ -1,18 +1,5 @@
-/**
- * mesh start / stop / status — the full-local Mesh platform.
- *
- * mesh start [--no-seed]   Bring up the local platform (docker compose) and
- *                          seed tenant `local` / env `dev` on first boot.
- * mesh stop [--destroy]    Stop the stack; --destroy also removes volumes
- *                          (resets databases and seeds).
- * mesh status [--json]     Per-service health, endpoints, and ports.
- *
- * Everything here works with zero AWS credentials, zero VPN, and zero Pulumi
- * state — Docker is the only prerequisite.
- */
 import { Command } from "commander";
 import { type ServiceStatus, type StackEndpoint } from "./stack.js";
-/** Injectable seams so tests can drive the wait loop without Docker. */
 export interface WaitForStackIo {
     probe: (endpoint: StackEndpoint) => Promise<boolean>;
     services: () => ServiceStatus[];
@@ -20,4 +7,3 @@ export interface WaitForStackIo {
 }
 export declare function waitForStack(io?: WaitForStackIo): Promise<void>;
 export declare function registerLocalCommands(program: Command): void;
-//# sourceMappingURL=index.d.ts.map