@mesh-tech/mesh-cli 0.20.2 → 0.20.4

package/dist/src/commands/tenant.d.ts

@@ -1,27 +1,5 @@
-/**
- * mesh tenant — register and inspect app tenants on a Mesh platform stack.
- *
- * `mesh tenant add <name>` closes the gap the app-tenant doctor punts on:
- * its "not registered" check names `mesh deploy up   # platform repo: add the
- * tenant under mesh:tenants first` as the fix, but that first half — "add the
- * tenant under mesh:tenants" — had no command and meant hand-editing
- * Pulumi.<stack>.yaml. This command performs the registration itself: run from
- * the PLATFORM layer of a tenant platform repo (e.g. mesh-sandbox/platform),
- * it inserts the tenant into the stack config's `mesh:tenants` map
- * (comment-preserving round-trip) and prints the deploy + verify steps that
- * make the registration live.
- *
- * `mesh tenant list` prints what the stack config declares, so "is it
- * registered?" is answerable without opening YAML.
- */
 import { Command } from "commander";
-/** Same rule `mesh init platform` applies to tenant names. */
 export declare function validateTenantName(name: string): boolean;
-/**
- * "{tenant}-{env}" → "{env}" (mesh-dev → dev). The last dash-segment is the
- * env by the platform stack naming convention; null when there is no dash to
- * split on, in which case the caller must pass --subdomain explicitly.
- */
 export declare function deriveEnvFromStack(stack: string): string | null;
 export interface TenantAddSpec {
     name: string;
@@ -38,19 +16,10 @@ export type TenantAddResult = {
     reason: "exists" | "no-config";
     detail: string;
 };
-/**
- * Insert a tenant under `config."mesh:tenants"` in a Pulumi stack config.
- * Round-trips through the yaml Document API so existing comments and entries
- * survive verbatim. Refuses (rather than merges) when the tenant is already
- * declared — an existing entry may carry fields (zitadelOrgId, nodePools…)
- * that a re-add would silently drop.
- */
 export declare function addTenantToStackConfig(yamlText: string, spec: TenantAddSpec): TenantAddResult;
-/** Read the `mesh:tenants` map (name → config) out of a stack config, if any. */
 export declare function listTenantsInStackConfig(yamlText: string): Array<{
     name: string;
     displayName?: string;
     subdomain?: string;
 }>;
 export declare function registerTenantCommands(program: Command): void;
-//# sourceMappingURL=tenant.d.ts.map

package/dist/src/commands/tenant.js

@@ -1,19 +1,3 @@
-/**
- * mesh tenant — register and inspect app tenants on a Mesh platform stack.
- *
- * `mesh tenant add <name>` closes the gap the app-tenant doctor punts on:
- * its "not registered" check names `mesh deploy up   # platform repo: add the
- * tenant under mesh:tenants first` as the fix, but that first half — "add the
- * tenant under mesh:tenants" — had no command and meant hand-editing
- * Pulumi.<stack>.yaml. This command performs the registration itself: run from
- * the PLATFORM layer of a tenant platform repo (e.g. mesh-sandbox/platform),
- * it inserts the tenant into the stack config's `mesh:tenants` map
- * (comment-preserving round-trip) and prints the deploy + verify steps that
- * make the registration live.
- *
- * `mesh tenant list` prints what the stack config declares, so "is it
- * registered?" is answerable without opening YAML.
- */
 import chalk from "chalk";
 import * as fs from "fs";
 import * as path from "path";
@@ -22,29 +6,13 @@ import { logInfo, logWarn } from "../utils/log.js";
 import { MeshCliError, emitJsonPayload } from "../utils/errors.js";
 import { findAppRoot, findStackConfigs, getCurrentStack } from "../utils/pulumi.js";
 import { atomicWriteFileSync } from "./login.js";
-// =============================================================================
-// Pure helpers (unit-tested)
-// =============================================================================
-/** Same rule `mesh init platform` applies to tenant names. */
 export function validateTenantName(name) {
     return /^[a-z][a-z0-9-]*$/.test(name) && !name.endsWith("-");
 }
-/**
- * "{tenant}-{env}" → "{env}" (mesh-dev → dev). The last dash-segment is the
- * env by the platform stack naming convention; null when there is no dash to
- * split on, in which case the caller must pass --subdomain explicitly.
- */
 export function deriveEnvFromStack(stack) {
     const m = stack.match(/-([a-z0-9]+)$/);
     return m ? (m[1] ?? null) : null;
 }
-/**
- * Insert a tenant under `config."mesh:tenants"` in a Pulumi stack config.
- * Round-trips through the yaml Document API so existing comments and entries
- * survive verbatim. Refuses (rather than merges) when the tenant is already
- * declared — an existing entry may carry fields (zitadelOrgId, nodePools…)
- * that a re-add would silently drop.
- */
 export function addTenantToStackConfig(yamlText, spec) {
     const doc = parseDocument(yamlText);
     const config = doc.getIn(["config"]);
@@ -70,15 +38,12 @@ export function addTenantToStackConfig(yamlText, spec) {
     if (spec.zitadelOrgId)
         entry.zitadelOrgId = spec.zitadelOrgId;
     doc.setIn([...tenantsPath, spec.name], doc.createNode(entry));
-    // Keep the rewrite surgical: no flow-seq re-padding (["a"] → [ "a" ]) and no
-    // long-line rewrapping on parts of the file this command never touched.
     return {
         ok: true,
         yaml: doc.toString({ flowCollectionPadding: false, lineWidth: 0 }),
         createdTenantsBlock,
     };
 }
-/** Read the `mesh:tenants` map (name → config) out of a stack config, if any. */
 export function listTenantsInStackConfig(yamlText) {
     const doc = parseDocument(yamlText);
     const tenants = doc.getIn(["config", "mesh:tenants"]);
@@ -96,10 +61,6 @@ export function listTenantsInStackConfig(yamlText) {
         return { name, displayName: get("displayName"), subdomain: get("subdomain") };
     });
 }
-/**
- * Resolve which Pulumi.<stack>.yaml to operate on: --stack wins, else the
- * currently-selected pulumi stack, else the single stack config in the dir.
- */
 function resolveStackConfig(explicitStack) {
     const appRoot = findAppRoot(process.cwd());
     if (!appRoot) {
@@ -118,12 +79,6 @@ function resolveStackConfig(explicitStack) {
     }
     return { appRoot, stack, file, content: fs.readFileSync(file, "utf-8") };
 }
-/**
- * The two real platform-layer project names are `mesh-platform`
- * (mesh-sandbox/platform) and `{tenant}-platform` (the `mesh init platform`
- * scaffold); the sibling core layer is `{tenant}-core`. Anchoring on the
- * suffix keeps an app incidentally named e.g. `platform-api` out.
- */
 function readProjectName(appRoot) {
     const projectDoc = parseDocument(fs.readFileSync(path.join(appRoot, "Pulumi.yaml"), "utf-8"));
     return String(projectDoc.get("name") ?? "");
@@ -131,11 +86,6 @@ function readProjectName(appRoot) {
 function looksLikePlatformLayer(projectName) {
     return projectName.endsWith("-platform");
 }
-/**
- * Guard against registering tenants on the wrong layer (core / an app): only
- * proceed without an existing `mesh:tenants` block when the Pulumi project
- * name says this is a platform layer.
- */
 function assertPlatformLayer(appRoot, content) {
     if (parseDocument(content).hasIn(["config", "mesh:tenants"]))
         return;
@@ -177,8 +127,6 @@ export function registerTenantCommands(program) {
             }
             throw new MeshCliError(`${resolved.file}: ${result.detail}`);
         }
-        // Pulumi.<stack>.yaml holds every capability toggle and the tenants map —
-        // an interrupt mid-write must not truncate it.
         atomicWriteFileSync(resolved.file, result.yaml, fs.statSync(resolved.file).mode & 0o777);
         if (opts.json) {
             emitJsonPayload({
@@ -214,8 +162,6 @@ export function registerTenantCommands(program) {
             return;
         }
         if (tenants.length === 0) {
-            // "No tenants" on a non-platform layer means "wrong directory", not
-            // "this platform has no tenants" — warn rather than let it mislead.
             const projectName = readProjectName(resolved.appRoot);
             if (!looksLikePlatformLayer(projectName)) {
                 logWarn(`Project '${projectName}' does not look like a platform layer — tenants are declared on the tenant platform repo's PLATFORM stack (e.g. mesh-sandbox/platform).`);
@@ -230,4 +176,3 @@ export function registerTenantCommands(program) {
         }
     });
 }
-//# sourceMappingURL=tenant.js.map

package/dist/src/commands/tunnel/index.d.ts

@@ -1,29 +1,6 @@
-/**
- * mesh tunnel - SSM tunneling to platform services
- *
- * Commands:
- *   mesh tunnel dev              Start all dev tunnels (temporal + db)
- *   mesh tunnel --services       Start specific services
- *   mesh tunnel --list           List available services
- *   mesh tunnel external <name>  Tunnel to a registered external service
- */
 import { Command } from "commander";
-/** `region = …` from a specific section of an ini-style `~/.aws` file. */
 export declare function parseProfileRegion(text: string, header: string): string | undefined;
-/**
- * Section headers for the SDK's implicit `[default]` profile. Spelled
- * `[default]` in BOTH files — `~/.aws/config` has no `[profile default]`
- * form — so it cannot be routed through awsProfileSections("default").
- */
 export declare function awsDefaultProfileSections(): Array<[string, string]>;
-/**
- * The credential axis (app tenant/stage) the ExternalService secret is keyed
- * on, which is NOT the platform axis that hosts the bastion.
- *
- * Precedence: explicit --app-tenant/--app-stage, then the stage detected from
- * cwd (a tenant-prefixed stack like `scu-dev` maps to platform env `dev`, and
- * the secret is keyed on the former), then the platform tenant/env.
- */
 export declare function resolveCredentialAxis(options: {
     tenant: string;
     env: string;
@@ -34,27 +11,10 @@ export declare function resolveCredentialAxis(options: {
     appTenant: string;
     appStage: string;
 };
-/**
- * Secrets Manager id for an ExternalService's credentials.
- *
- * Mirrors what the primitive builds (ExternalService.ts) and what apps resolve
- * at runtime (libs/secrets): keyed on the APP tenant/stage, with multi-instance
- * (credentials.keyedBy) services storing one secret per instance under the base.
- */
 export declare function externalSecretId(appTenant: string, appStage: string, name: string, key?: string): string;
-/**
- * Pull the tunnel endpoint out of a credential secret. The local port defaults
- * to the remote port so `localhost:<same-port>` behaves like the real service.
- * Throws with a user-facing message when the secret isn't tunnelable or the
- * `--port` override isn't a valid port number.
- */
 export declare function resolveExternalPorts(creds: Record<string, string | number>, portOverride?: string): {
     host: string;
     remotePort: number;
     localPort: number;
 };
-/**
- * Register tunnel commands with the CLI
- */
 export declare function registerTunnelCommands(program: Command): void;
-//# sourceMappingURL=index.d.ts.map

package/dist/src/commands/tunnel/index.js

@@ -1,38 +1,13 @@
-/**
- * mesh tunnel - SSM tunneling to platform services
- *
- * Commands:
- *   mesh tunnel dev              Start all dev tunnels (temporal + db)
- *   mesh tunnel --services       Start specific services
- *   mesh tunnel --list           List available services
- *   mesh tunnel external <name>  Tunnel to a registered external service
- */
 import { spawn } from "child_process";
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
 import { SecretsManagerClient, GetSecretValueCommand, } from "@aws-sdk/client-secrets-manager";
 import { detectContext, getPlatformBastionInfo, logInfo, logError, } from "../../utils/index.js";
-/**
- * Resolve tenant/env without ceremony: explicit flags win, otherwise the
- * same Pulumi/SST context detection `mesh dev` uses (mesh:tenant + stack
- * file in the current app dir).
- *
- * Returns the detected app `stage` alongside the platform `env` because they
- * are genuinely different values — detectContext() strips the tenant prefix
- * and runs the result through the platform-env map, so a stack
- * `Pulumi.scu-dev.yaml` yields stage `scu-dev` but platform env `dev`.
- * Callers that key on the app axis (credential secrets) need the former.
- */
 function resolveTenantEnv(options) {
     if (options.tenant && options.env) {
-        // Fully explicit: nothing was detected, so there is no app stage to offer —
-        // the credential axis falls back to --env, exactly as `mesh db …` does.
         return { tenant: options.tenant, env: options.env };
     }
-    // `options.env` is a platform env, not a stage; passing it as detectContext's
-    // stage hint is deliberate (it's the best hint available) but does make that
-    // function's own "Stage: …" log line read as an env when only -e was given.
     const ctx = detectContext(options.env);
     return {
         tenant: options.tenant ?? ctx.tenant,
@@ -40,11 +15,6 @@ function resolveTenantEnv(options) {
         stage: ctx.stage,
     };
 }
-/**
- * aws:region from the nearest Pulumi config in cwd. Prefers the stack actually
- * being targeted; otherwise stack files before the project file, and among
- * several stacks this is a best-effort pick (readdir order).
- */
 function readPulumiAwsRegion(stage) {
     const preferred = stage ? `Pulumi.${stage}.yaml` : undefined;
     const rank = (f) => f === preferred ? 0 : f === "Pulumi.yaml" ? 2 : 1;
@@ -62,11 +32,9 @@ function readPulumiAwsRegion(stage) {
         }
     }
     catch {
-        /* unreadable cwd — fall through */
     }
     return undefined;
 }
-/** `~/.aws` section headers a profile can appear under, in precedence order. */
 function awsProfileSections(name) {
     return [
         [path.join(os.homedir(), ".aws", "config"), `[profile ${name}]`],
@@ -81,12 +49,10 @@ function awsProfileExists(name) {
                 return true;
         }
         catch {
-            /* file absent */
         }
     }
     return false;
 }
-/** `region = …` from a specific section of an ini-style `~/.aws` file. */
 export function parseProfileRegion(text, header) {
     let inSection = false;
     for (const raw of text.split("\n")) {
@@ -98,9 +64,6 @@ export function parseProfileRegion(text, header) {
         if (!inSection)
             continue;
         const m = line.match(/^region\s*=\s*(.+)$/);
-        // AWS's shared-config parser strips whitespace-prefixed inline comments
-        // (`region = us-east-1 # prod` means us-east-1); match it. The regex
-        // already ate leading whitespace, so the first split segment is the value.
         const value = m?.[1]?.split(/\s+[#;]/)[0]?.trim();
         if (value)
             return value;
@@ -117,23 +80,16 @@ function awsProfileRegion(profile) {
                 return region;
         }
         catch {
-            /* file absent */
         }
     }
     return undefined;
 }
-/**
- * Section headers for the SDK's implicit `[default]` profile. Spelled
- * `[default]` in BOTH files — `~/.aws/config` has no `[profile default]`
- * form — so it cannot be routed through awsProfileSections("default").
- */
 export function awsDefaultProfileSections() {
     return [
         [path.join(os.homedir(), ".aws", "config"), "[default]"],
         [path.join(os.homedir(), ".aws", "credentials"), "[default]"],
     ];
 }
-/** Region the SDK would take from `[default]` when no named profile is in play. */
 function awsDefaultProfileRegion() {
     for (const [file, header] of awsDefaultProfileSections()) {
         try {
@@ -142,32 +98,10 @@ function awsDefaultProfileRegion() {
                 return region;
         }
         catch {
-            /* file absent */
         }
     }
     return undefined;
 }
-/**
- * Fill AWS_PROFILE/AWS_REGION so tunnels run without env-var ceremony:
- * profile by tenant convention ({tenant}-{env}, then {tenant}) when no
- * credentials are already present, then region from the nearest Pulumi config,
- * else that profile's own region. Applies to both the SDK lookups and the
- * spawned `aws ssm start-session`.
- *
- * Order matters: AWS_REGION in the environment outranks a profile's own
- * `region` in both the SDK v3 chain and the `aws` CLI, so the profile must be
- * resolved FIRST and its region consulted BEFORE any platform default —
- * otherwise a stack that isn't in us-east-2 (tests/tenants/bigbank,
- * tests/tenants/mesh/apps/hello are us-east-1) gets silently redirected when
- * run from a directory with no Pulumi.*.yaml. Same call `dev.ts:3157` and
- * `utils/tailscale.ts:611` make.
- *
- * us-east-2 survives only as the last resort, because this module builds its
- * SecretsManagerClient inline (`new SecretsManagerClient({})`) — aws-auth.ts's
- * DEFAULT_REGION is module-private to that file and does NOT backstop it, so
- * dropping the default outright turns a no-Pulumi/no-profile-region directory
- * into `Region is missing` rather than a working tunnel.
- */
 function applyAwsDefaults(tenant, env, stage) {
     if (!process.env.AWS_PROFILE && !process.env.AWS_ACCESS_KEY_ID) {
         const profile = [`${tenant}-${env}`, tenant].find(awsProfileExists);
@@ -177,10 +111,6 @@ function applyAwsDefaults(tenant, env, stage) {
         }
     }
     if (!process.env.AWS_REGION && !process.env.AWS_DEFAULT_REGION) {
-        // stack config > the effective profile's own region > platform default.
-        // When no named profile is in play the SDK's effective profile is
-        // `[default]`, so consult ITS region before inventing us-east-2 —
-        // otherwise a plain `[default]`-only setup gets silently redirected.
         const region = readPulumiAwsRegion(stage) ??
             (process.env.AWS_PROFILE
                 ? awsProfileRegion(process.env.AWS_PROFILE)
@@ -190,9 +120,6 @@ function applyAwsDefaults(tenant, env, stage) {
         logInfo(`AWS region: ${region} (auto)`);
     }
 }
-/**
- * Service definitions with their local ports and display names
- */
 const SERVICE_CONFIG = {
     "temporal-frontend": {
         bastionKey: "temporal-frontend",
@@ -210,16 +137,10 @@ const SERVICE_CONFIG = {
         displayName: "Database (PostgreSQL)",
     },
 };
-/**
- * Service groups for convenience commands
- */
 const SERVICE_GROUPS = {
     dev: ["temporal-frontend", "temporal-ui", "db"],
     temporal: ["temporal-frontend", "temporal-ui"],
 };
-/**
- * Get the effective local port for a service, using custom port if provided
- */
 function getEffectivePort(serviceName, options) {
     const config = SERVICE_CONFIG[serviceName];
     if (!config)
@@ -239,20 +160,12 @@ function getEffectivePort(serviceName, options) {
             return config.localPort;
     }
 }
-/**
- * Parse services from --services flag or group name
- */
 function parseServices(input) {
-    // Check if it's a group name
     if (SERVICE_GROUPS[input]) {
         return SERVICE_GROUPS[input];
     }
-    // Otherwise parse as comma-separated list
     return input.split(",").map((s) => s.trim());
 }
-/**
- * Spawn an SSM tunnel to a service endpoint
- */
 function spawnSsmTunnel(instanceId, service, localPort) {
     return spawn("aws", [
         "ssm",
@@ -269,9 +182,6 @@ function spawnSsmTunnel(instanceId, service, localPort) {
         }),
     ], { stdio: "inherit" });
 }
-/**
- * List available services
- */
 async function listServices(options) {
     const { tenant, env } = options;
     const bastion = await getPlatformBastionInfo(tenant, env);
@@ -299,13 +209,9 @@ async function listServices(options) {
     console.log("  mesh tunnel external <name>        # Registered external service");
     console.log("");
 }
-/**
- * Start tunnels to multiple services
- */
 async function tunnelServices(serviceNames, options) {
     const { tenant, env } = options;
     const bastion = await getPlatformBastionInfo(tenant, env);
-    // Resolve service names to configs and endpoints
     const servicesToStart = [];
     for (const name of serviceNames) {
         const config = SERVICE_CONFIG[name];
@@ -342,7 +248,6 @@ async function tunnelServices(serviceNames, options) {
         const localPort = getEffectivePort(name, options);
         processes.push(spawnSsmTunnel(bastion.instanceId, endpoint, localPort));
     }
-    // Handle cleanup on exit
     const cleanup = () => {
         for (const proc of processes) {
             proc.kill();
@@ -351,21 +256,12 @@ async function tunnelServices(serviceNames, options) {
     };
     process.on("SIGINT", cleanup);
     process.on("SIGTERM", cleanup);
-    // Wait for any process to exit
     await Promise.race(processes.map((proc) => new Promise((resolve) => {
         proc.on("exit", () => resolve());
         proc.on("error", () => resolve());
     })));
     cleanup();
 }
-/**
- * The credential axis (app tenant/stage) the ExternalService secret is keyed
- * on, which is NOT the platform axis that hosts the bastion.
- *
- * Precedence: explicit --app-tenant/--app-stage, then the stage detected from
- * cwd (a tenant-prefixed stack like `scu-dev` maps to platform env `dev`, and
- * the secret is keyed on the former), then the platform tenant/env.
- */
 export function resolveCredentialAxis(options) {
     return {
         appTenant: options.appTenant ?? options.tenant,
@@ -375,23 +271,10 @@ export function resolveCredentialAxis(options) {
 function isValidPort(port) {
     return Number.isInteger(port) && port >= 1 && port <= 65535;
 }
-/**
- * Secrets Manager id for an ExternalService's credentials.
- *
- * Mirrors what the primitive builds (ExternalService.ts) and what apps resolve
- * at runtime (libs/secrets): keyed on the APP tenant/stage, with multi-instance
- * (credentials.keyedBy) services storing one secret per instance under the base.
- */
 export function externalSecretId(appTenant, appStage, name, key) {
     const base = `mesh/${appTenant}/${appStage}/external/${name}`;
     return key ? `${base}/${key}` : base;
 }
-/**
- * Pull the tunnel endpoint out of a credential secret. The local port defaults
- * to the remote port so `localhost:<same-port>` behaves like the real service.
- * Throws with a user-facing message when the secret isn't tunnelable or the
- * `--port` override isn't a valid port number.
- */
 export function resolveExternalPorts(creds, portOverride) {
     const host = typeof creds.host === "string" ? creds.host.trim() : "";
     const remotePort = Number(creds.port);
@@ -407,20 +290,8 @@ export function resolveExternalPorts(creds, portOverride) {
     }
     return { host, remotePort, localPort };
 }
-/**
- * Tunnel to a registered external service (ExternalService primitive).
- *
- * The service's credential secret (mesh/{app-tenant}/{app-stage}/external/{name})
- * is the source of truth for host/port — the same values deployed apps resolve
- * at runtime via resolveCredentials() — so anything the platform bastion can
- * reach is tunnelable without a per-service CLI entry.
- */
 async function tunnelExternal(name, options) {
     const { tenant, env, key } = options;
-    // The bastion lives in the platform tenant/env; the credential secret is
-    // keyed on the app tenant/stage. Those are different axes (a platform env
-    // like `dev-temporal` can host an app at stage `dev`), so they default to
-    // each other but stay separately overridable — same as `mesh db …`.
     const { appTenant, appStage } = resolveCredentialAxis(options);
     const secretId = externalSecretId(appTenant, appStage, name, key);
     const setHint = `mesh secrets set external/${name}${key ? ` --key=${key}` : ""}`;
@@ -475,9 +346,6 @@ async function tunnelExternal(name, options) {
     });
     cleanup();
 }
-/**
- * Register tunnel commands with the CLI
- */
 export function registerTunnelCommands(program) {
     const tunnel = program
         .command("tunnel")
@@ -494,23 +362,18 @@ export function registerTunnelCommands(program) {
         const { tenant, env, stage } = resolveTenantEnv(rawOptions);
         applyAwsDefaults(tenant, env, stage);
         const options = { ...rawOptions, tenant, env };
-        // Handle --list
         if (options.list) {
             await listServices(options);
             return;
         }
-        // Determine which services to start
         let services;
         if (options.services) {
-            // Explicit --services flag
             services = parseServices(options.services);
         }
         else if (group) {
-            // Positional group argument
             services = parseServices(group);
         }
         else {
-            // No services specified - show help
             await listServices(options);
             return;
         }
@@ -528,13 +391,9 @@ export function registerTunnelCommands(program) {
         .option("-k, --key <key>", "Instance key for a multi-instance external (credentials.keyedBy)")
         .option("-p, --port <port>", "Local port (default: the service's remote port)")
         .action(async (name, _options, command) => {
-        // -t/-e are also declared on the parent `tunnel` command, which
-        // consumes them wherever they appear — merge both scopes, then fall
-        // back to Pulumi/SST context detection.
         const merged = command.optsWithGlobals();
         const { tenant, env, stage } = resolveTenantEnv(merged);
         applyAwsDefaults(tenant, env, stage);
         await tunnelExternal(name, { ...merged, tenant, env, stage });
     });
 }
-//# sourceMappingURL=index.js.map

package/dist/src/commands/vcs/clone.d.ts

@@ -1,3 +1,2 @@
 import { type CommonOpts } from "./common.js";
 export declare function cloneCommand(repo: string, dest: string | undefined, opts: CommonOpts): Promise<void>;
-//# sourceMappingURL=clone.d.ts.map

package/dist/src/commands/vcs/clone.js

@@ -11,10 +11,6 @@ export async function cloneCommand(repo, dest, opts) {
         `${baseUrl}/git/${repo}`,
         dest ?? repo,
     ], token);
-    // Persist the auth header for future fetches in THIS clone only.
-    // Dev-grade: tokens land in .git/config — revisit with a credential helper
-    // once non-dev tokens are routine.
     await gitWithAuth(["config", "http.extraHeader", `Authorization: Bearer ${token}`], token, dest ?? repo);
     console.log(`cloned ${repo} → ${dest ?? repo} (read-only remote; use 'mesh vcs propose' to submit changes)`);
 }
-//# sourceMappingURL=clone.js.map

package/dist/src/commands/vcs/common.d.ts

@@ -9,47 +9,15 @@ export interface CommonOpts {
     token?: string;
     context?: string;
 }
-/** Strip a bearer token out of an error before it is surfaced.
- *
- * The vcs git calls authenticate by putting the token in argv
- * (`-c http.extraHeader=Authorization: Bearer <jwt>`), and `execFile` puts the
- * whole argv into the message it throws. So an ordinary mistake — a wrong repo
- * name, a typo'd host — prints a live credential into the terminal, the CI log,
- * or an agent transcript — a `mesh vcs clone` against a mistyped host would
- * otherwise emit the full JWT.
- *
- * Folds `stderr` into the message on the way, because that is where git's
- * actual reason lives ("repository not found", "Authentication failed") and it
- * can carry the token too.
- *
- * @example
- * try {
- *   await execFileAsync("git", ["-c", `http.extraHeader=Authorization: Bearer ${token}`, "clone", url]);
- * } catch (err) {
- *   throw redactToken(err, token); // the JWT reads as `<redacted-token>`
- * }
- */
 export declare function redactToken(err: unknown, token: string): Error;
-/**
- * Run git with a bearer token in argv, redacting it from any failure.
- *
- * @example
- * const { stdout } = await gitWithAuth(
- *   ["-c", `http.extraHeader=Authorization: Bearer ${token}`, "ls-remote", url],
- *   token,
- * );
- */
 export declare function gitWithAuth(args: string[], token: string, cwd?: string): Promise<{
     stdout: string;
     stderr: string;
 }>;
-/** https://host/git/<repo> (origin remote) → { baseUrl: https://host, repo }. */
 export declare function parseRemote(remoteUrl: string): VcsTarget | null;
 export declare function resolveTarget(opts: CommonOpts & {
     repo?: string;
     cwd?: string;
 }): Promise<VcsTarget>;
 export declare function resolveToken(opts: CommonOpts): Promise<string>;
-/** Minimal authenticated JSON call against the vcs API. */
 export declare function vcsApi(baseUrl: string, token: string, path: string, method?: string, body?: unknown): Promise<unknown>;
-//# sourceMappingURL=common.d.ts.map