@mesh-tech/mesh-cli 0.20.2 → 0.20.4

package/dist/src/utils/cache-home.d.ts

@@ -1,25 +1,2 @@
-/**
- * Root of the CLI's on-disk cache — logs, probe targets, compose output,
- * seeded credentials, hub build contexts.
- *
- * Defaults to `~/.cache/mesh`. `MESH_CACHE_HOME` overrides it, and the override
- * is read on every call rather than captured at import, so a process that sets
- * it after this module loads still gets it.
- *
- * WHY THE OVERRIDE EXISTS. Several helpers here `mkdirSync` eagerly, so merely
- * *calling* one writes to the user's home — which meant `pnpm test` wrote into
- * `~/.cache/mesh` on any machine that runs it, and fail outright under a sandbox
- * that denies writes outside the workspace (`EPERM: mkdir
- * '/Users/…/.cache/mesh/mesh-local/probes'`). The suite points this at a
- * gitignored directory inside the package — see `test/setup.ts` — so tests never
- * reach outside the repo.
- */
 export declare function meshCacheHome(): string;
-/**
- * A directory under the cache root, created if absent.
- *
- * @example
- * meshCacheDir("mesh-local", "probes"); // → "/Users/me/.cache/mesh/mesh-local/probes"
- */
 export declare function meshCacheDir(...segments: string[]): string;
-//# sourceMappingURL=cache-home.d.ts.map

package/dist/src/utils/cache-home.js

@@ -1,36 +1,11 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-/**
- * Root of the CLI's on-disk cache — logs, probe targets, compose output,
- * seeded credentials, hub build contexts.
- *
- * Defaults to `~/.cache/mesh`. `MESH_CACHE_HOME` overrides it, and the override
- * is read on every call rather than captured at import, so a process that sets
- * it after this module loads still gets it.
- *
- * WHY THE OVERRIDE EXISTS. Several helpers here `mkdirSync` eagerly, so merely
- * *calling* one writes to the user's home — which meant `pnpm test` wrote into
- * `~/.cache/mesh` on any machine that runs it, and fail outright under a sandbox
- * that denies writes outside the workspace (`EPERM: mkdir
- * '/Users/…/.cache/mesh/mesh-local/probes'`). The suite points this at a
- * gitignored directory inside the package — see `test/setup.ts` — so tests never
- * reach outside the repo.
- */
 export function meshCacheHome() {
-    // `||` not `??`: an empty MESH_CACHE_HOME must fall back, or path.join()
-    // resolves cache paths against the filesystem root.
     return process.env.MESH_CACHE_HOME || path.join(os.homedir(), ".cache", "mesh");
 }
-/**
- * A directory under the cache root, created if absent.
- *
- * @example
- * meshCacheDir("mesh-local", "probes"); // → "/Users/me/.cache/mesh/mesh-local/probes"
- */
 export function meshCacheDir(...segments) {
     const dir = path.join(meshCacheHome(), ...segments);
     fs.mkdirSync(dir, { recursive: true });
     return dir;
 }
-//# sourceMappingURL=cache-home.js.map

package/dist/src/utils/capture-history.d.ts

@@ -1,62 +1,8 @@
-/**
- * Serialize a fetched Temporal workflow history into the replay-fixture JSON
- * shape — the same canonical proto3-JSON `{ events: [...] }` that
- * `@mesh-tech/agent-sdk`'s `replay/history-io.ts` `historyToFixture` produces,
- * so a captured file replays via `replayFixture` (which rehydrates it with
- * `historyFromJSON`) for LOCAL debugging. Captured PRODUCTION histories are
- * never committed (they contain real, decrypted customer/conversation data —
- * see the CLI's do-not-commit warning); only synthetic goldens live in
- * `packages/agent-sdk/src/replay/fixtures/`.
- *
- * We reuse `@temporalio/common`'s `historyToJSON` directly (the exact helper
- * agent-sdk's history-io uses) rather than importing `@mesh-tech/agent-sdk`:
- * the CLI has no reason to pull in the whole worker/replay stack, and keeping
- * the dependency pointed at the shared Temporal library guarantees the output
- * round-trips through `historyFromJSON`.
- *
- * The one thing a *real* history needs that a synthetic golden fixture doesn't:
- * its payloads are ENCRYPTED (the worker's AES-GCM codec). `historyToJSON`
- * would just base64 the ciphertext, which `replayFixture`'s plaintext converter
- * can't decode. So before serializing we walk every Payload in the history and
- * replace each encrypted one with its decrypted inner Payload — yielding a
- * plaintext fixture identical in shape to a codec-free golden capture.
- */
 import type { RawPayloadDecrypter } from "./temporal-codec.js";
-/**
- * Walk an arbitrary history-event tree and decrypt every encrypted Payload in
- * place, using `decrypt` to turn an encrypted Payload into its plaintext inner
- * Payload. Payloads the decrypter reports as non-encrypted (`null`) are left
- * untouched. Returns the number of payloads that were decrypted.
- *
- * The `{ metadata, data }` heuristic mirrors Temporal's own `fixPayloads` in
- * `@temporalio/common/lib/proto-utils`, so it identifies exactly the nodes
- * proto3-JSON treats as payloads. Once a node is a Payload we do NOT recurse
- * into it (its metadata values are bytes, not nested payloads).
- */
 export declare function decryptHistoryPayloads(node: unknown, decrypt: RawPayloadDecrypter): Promise<number>;
-/** Result of {@link serializeHistoryToFixture}. */
 export interface CaptureResult {
-    /** The parsed proto3-JSON fixture object (drop-in for `replayFixture`). */
     fixture: unknown;
-    /** Total events serialized. */
     eventCount: number;
-    /** How many encrypted payloads were decrypted (0 when no decrypter given). */
     decryptedPayloads: number;
 }
-/**
- * Turn an ordered list of raw history events into a replay fixture object.
- *
- * @param events - Raw proto-decoded history events, in order (as yielded by the
- *   CLI's `iterHistoryEvents` over `getWorkflowExecutionHistory`).
- * @param decrypter - Optional raw payload decrypter. When provided, every
- *   encrypted payload in the history is decrypted in place before serialization
- *   so the fixture is replayable with a plaintext converter. When omitted, the
- *   payloads are serialized as-is (ciphertext, base64-encoded).
- *
- * `historyToJSON` runs its input through protobuf `History.fromObject`, so a
- * plain `{ events }` object of raw events is accepted directly; it returns a
- * proto3-JSON *string* which we parse back to a structured object (the same
- * `JSON.parse(historyToJSON(...))` round-trip `historyToFixture` performs).
- */
 export declare function serializeHistoryToFixture(events: unknown[], decrypter?: RawPayloadDecrypter): Promise<CaptureResult>;
-//# sourceMappingURL=capture-history.d.ts.map

package/dist/src/utils/capture-history.js

@@ -1,29 +1,3 @@
-/**
- * Serialize a fetched Temporal workflow history into the replay-fixture JSON
- * shape — the same canonical proto3-JSON `{ events: [...] }` that
- * `@mesh-tech/agent-sdk`'s `replay/history-io.ts` `historyToFixture` produces,
- * so a captured file replays via `replayFixture` (which rehydrates it with
- * `historyFromJSON`) for LOCAL debugging. Captured PRODUCTION histories are
- * never committed (they contain real, decrypted customer/conversation data —
- * see the CLI's do-not-commit warning); only synthetic goldens live in
- * `packages/agent-sdk/src/replay/fixtures/`.
- *
- * We reuse `@temporalio/common`'s `historyToJSON` directly (the exact helper
- * agent-sdk's history-io uses) rather than importing `@mesh-tech/agent-sdk`:
- * the CLI has no reason to pull in the whole worker/replay stack, and keeping
- * the dependency pointed at the shared Temporal library guarantees the output
- * round-trips through `historyFromJSON`.
- *
- * The one thing a *real* history needs that a synthetic golden fixture doesn't:
- * its payloads are ENCRYPTED (the worker's AES-GCM codec). `historyToJSON`
- * would just base64 the ciphertext, which `replayFixture`'s plaintext converter
- * can't decode. So before serializing we walk every Payload in the history and
- * replace each encrypted one with its decrypted inner Payload — yielding a
- * plaintext fixture identical in shape to a codec-free golden capture.
- */
-// Explicit `.js` — this package publishes native ESM, so the compiled dist
-// must use a fully-specified specifier or Node throws ERR_MODULE_NOT_FOUND at
-// runtime (MESH-2262). tsx tolerates the extensionless form; node does not.
 import { historyToJSON } from "@temporalio/common/lib/proto-utils.js";
 function isPayload(value) {
     return (value != null &&
@@ -31,25 +5,13 @@ function isPayload(value) {
         "metadata" in value &&
         "data" in value);
 }
-/**
- * Walk an arbitrary history-event tree and decrypt every encrypted Payload in
- * place, using `decrypt` to turn an encrypted Payload into its plaintext inner
- * Payload. Payloads the decrypter reports as non-encrypted (`null`) are left
- * untouched. Returns the number of payloads that were decrypted.
- *
- * The `{ metadata, data }` heuristic mirrors Temporal's own `fixPayloads` in
- * `@temporalio/common/lib/proto-utils`, so it identifies exactly the nodes
- * proto3-JSON treats as payloads. Once a node is a Payload we do NOT recurse
- * into it (its metadata values are bytes, not nested payloads).
- */
 export async function decryptHistoryPayloads(node, decrypt) {
     if (node == null || typeof node !== "object")
         return 0;
     if (isPayload(node)) {
         const inner = await decrypt(node);
         if (inner === null)
-            return 0; // not encrypted — leave as-is
-        // Replace the encrypted envelope with the decrypted inner payload's bytes.
+            return 0;
         node.metadata = inner.metadata ?? {};
         node.data = inner.data ?? new Uint8Array(0);
         return 1;
@@ -66,21 +28,6 @@ export async function decryptHistoryPayloads(node, decrypt) {
     }
     return count;
 }
-/**
- * Turn an ordered list of raw history events into a replay fixture object.
- *
- * @param events - Raw proto-decoded history events, in order (as yielded by the
- *   CLI's `iterHistoryEvents` over `getWorkflowExecutionHistory`).
- * @param decrypter - Optional raw payload decrypter. When provided, every
- *   encrypted payload in the history is decrypted in place before serialization
- *   so the fixture is replayable with a plaintext converter. When omitted, the
- *   payloads are serialized as-is (ciphertext, base64-encoded).
- *
- * `historyToJSON` runs its input through protobuf `History.fromObject`, so a
- * plain `{ events }` object of raw events is accepted directly; it returns a
- * proto3-JSON *string* which we parse back to a structured object (the same
- * `JSON.parse(historyToJSON(...))` round-trip `historyToFixture` performs).
- */
 export async function serializeHistoryToFixture(events, decrypter) {
     let decryptedPayloads = 0;
     if (decrypter) {
@@ -91,4 +38,3 @@ export async function serializeHistoryToFixture(events, decrypter) {
     const fixture = JSON.parse(historyToJSON({ events }));
     return { fixture, eventCount: events.length, decryptedPayloads };
 }
-//# sourceMappingURL=capture-history.js.map

package/dist/src/utils/context.d.ts

@@ -1,29 +1,6 @@
-/**
- * Context detection - determines tenant, stage, and platform environment
- * from the current directory and environment variables.
- */
 export interface MeshContext {
     tenant: string;
     stage: string;
     platformEnv: string;
 }
-/**
- * Detect tenant and stage from current directory and environment.
- *
- * Priority for stage:
- *   1. --stage flag (passed as stageArg)
- *   2. MESH_STAGE env var
- *   3. SST_STAGE env var
- *   4. .sst/stage file
- *   5. Pulumi config file name
- *   6. Default: "dev"
- *
- * Priority for tenant:
- *   1. MESH_TENANT env var
- *   2. config.ts tenant field
- *   3. Pulumi config mesh:tenant
- *   4. Directory path (tenants/{tenant}/...)
- *   5. Default: "mesh"
- */
 export declare function detectContext(stageArg?: string): MeshContext;
-//# sourceMappingURL=context.d.ts.map

package/dist/src/utils/context.js

@@ -1,14 +1,6 @@
-/**
- * Context detection - determines tenant, stage, and platform environment
- * from the current directory and environment variables.
- */
 import * as fs from "fs";
 import * as path from "path";
 import { logInfo } from "./log.js";
-/**
- * Find a file by walking up directories from the starting directory.
- * Returns the full path to the file if found, undefined otherwise.
- */
 function findFileUpward(filename, startDir = process.cwd()) {
     let currentDir = startDir;
     const root = path.parse(currentDir).root;
@@ -21,53 +13,29 @@ function findFileUpward(filename, startDir = process.cwd()) {
     }
     return undefined;
 }
-/**
- * Detect tenant and stage from current directory and environment.
- *
- * Priority for stage:
- *   1. --stage flag (passed as stageArg)
- *   2. MESH_STAGE env var
- *   3. SST_STAGE env var
- *   4. .sst/stage file
- *   5. Pulumi config file name
- *   6. Default: "dev"
- *
- * Priority for tenant:
- *   1. MESH_TENANT env var
- *   2. config.ts tenant field
- *   3. Pulumi config mesh:tenant
- *   4. Directory path (tenants/{tenant}/...)
- *   5. Default: "mesh"
- */
 export function detectContext(stageArg) {
     let tenant;
     let stage;
     const cwd = process.cwd();
-    // Try to detect from Pulumi.yaml
     if (fs.existsSync("Pulumi.yaml")) {
-        // Look for Pulumi.*.yaml config files
         const files = fs.readdirSync(".").filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml");
         const configFile = files[0];
         if (configFile) {
             const content = fs.readFileSync(configFile, "utf-8");
-            // Extract tenant from mesh:tenant config
             const tenantMatch = content.match(/^\s*mesh:tenant:\s*["']?([^"'\n]+)["']?/m);
             if (tenantMatch?.[1]) {
                 tenant = tenantMatch[1].trim();
             }
-            // Extract stage from filename: Pulumi.<stage>.yaml
             const stageMatch = configFile.match(/Pulumi\.(.+)\.yaml/);
             if (stageMatch?.[1]) {
                 stage = stageMatch[1];
             }
         }
     }
-    // Try to detect from SST config (walk up directories to find it)
     const sstConfigPath = findFileUpward("sst.config.ts");
     let sstDir;
     if (sstConfigPath) {
         sstDir = path.dirname(sstConfigPath);
-        // Check parent config.ts for tenant (relative to sst.config.ts location)
         const parentConfigPath = path.join(sstDir, "..", "config.ts");
         if (fs.existsSync(parentConfigPath)) {
             const configContent = fs.readFileSync(parentConfigPath, "utf-8");
@@ -76,31 +44,25 @@ export function detectContext(stageArg) {
                 tenant = tenantMatch[1];
             }
         }
-        // Check .sst/stage for current stage (relative to sst.config.ts location)
         const sstStagePath = path.join(sstDir, ".sst", "stage");
         if (fs.existsSync(sstStagePath)) {
             stage = fs.readFileSync(sstStagePath, "utf-8").trim();
         }
     }
-    // Fallback: infer tenant from directory path
     if (!tenant) {
         const pathMatch = cwd.match(/tenants\/([^/]+)/);
         if (pathMatch) {
             tenant = pathMatch[1];
         }
     }
-    // Apply priority: stageArg > MESH_STAGE > SST_STAGE > detected > default
     stage = stageArg || process.env.MESH_STAGE || process.env.SST_STAGE || stage || "dev";
     tenant = process.env.MESH_TENANT || tenant || "mesh";
-    // Resolve platform environment from config.ts if available
     let platformEnv = stage;
     let platformEnvMap = {};
     let defaultPlatformEnv;
-    // Try to read platformEnvMap and defaultPlatformEnv from config.ts (relative to sst.config.ts location)
     const configPath = sstDir ? path.join(sstDir, "..", "config.ts") : "../config.ts";
     if (fs.existsSync(configPath)) {
         const configContent = fs.readFileSync(configPath, "utf-8");
-        // Parse platformEnvMap object
         const mapMatch = configContent.match(/platformEnvMap:\s*\{([^}]+)\}/);
         if (mapMatch?.[1]) {
             const entries = mapMatch[1].matchAll(/(\w+):\s*["']([^"']+)["']/g);
@@ -112,21 +74,16 @@ export function detectContext(stageArg) {
                 }
             }
         }
-        // Parse defaultPlatformEnv
         const defaultMatch = configContent.match(/defaultPlatformEnv:\s*["']([^"']+)["']/);
         if (defaultMatch?.[1]) {
             defaultPlatformEnv = defaultMatch[1];
         }
     }
-    // Parse env from stage by stripping tenant prefix (matches Pulumi pattern)
-    // e.g., "mesh-dev-temporal" → env "dev-temporal"
     const tenantPrefix = `${tenant}-`;
     const parsedEnv = stage.startsWith(tenantPrefix)
         ? stage.slice(tenantPrefix.length)
         : stage;
-    // Use config mapping if available, then defaultPlatformEnv, otherwise use parsed env directly
     platformEnv = platformEnvMap[parsedEnv] ?? platformEnvMap[stage] ?? defaultPlatformEnv ?? parsedEnv;
     logInfo(`Stage: ${stage}, Platform: ${platformEnv}, Tenant: ${tenant}`);
     return { tenant, stage, platformEnv };
 }
-//# sourceMappingURL=context.js.map

package/dist/src/utils/credentials.d.ts

@@ -1,6 +1,3 @@
-/**
- * Database credential utilities
- */
 export interface DatabaseCredentials {
     username: string;
     password: string;
@@ -8,54 +5,19 @@ export interface DatabaseCredentials {
     port: number;
     database: string;
 }
-/**
- * Options for credential lookup
- */
 export interface CredentialLookupOptions {
-    /** App name (e.g., "rdc") - if provided, uses path mesh/{tenant}/{stage}/{app}/db-credentials */
     app?: string;
 }
-/**
- * Get DATABASE_URL from Secrets Manager.
- *
- * Credential path patterns:
- *   - With app:    mesh/{tenant}/{stage}/{app}/db-credentials
- *   - Without app: mesh/{tenant}/{stage}/db-credentials
- *
- * Returns the DATABASE_URL string directly. Use rewriteDatabaseUrl() to
- * modify host/port for tunnel usage.
- */
 export declare function getDatabaseUrl(tenant: string, stage: string, options?: CredentialLookupOptions): Promise<string>;
-/**
- * @deprecated Use getDatabaseUrl instead - returns DATABASE_URL directly
- */
 export declare function getDbCredentials(tenant: string, stage: string, _platformEnv: string, rdsHost: string, rdsPort: number, options?: CredentialLookupOptions): Promise<DatabaseCredentials>;
-/**
- * Options for rewriting DATABASE_URL
- */
 export interface DatabaseUrlRewriteOptions {
-    /** New host:port endpoint (e.g., "localhost:5432") */
     endpoint?: string;
-    /** SSL mode (require, no-verify, disable) */
     sslMode?: string;
 }
-/**
- * Rewrite DATABASE_URL with new endpoint and/or SSL mode.
- * Preserves username, password, database name, and other query params.
- *
- * Used by both mesh-env-exec (for sst dev) and mesh db exec (for ad-hoc commands).
- */
 export declare function rewriteDatabaseUrl(url: string, options: DatabaseUrlRewriteOptions): string;
-/**
- * Build a DATABASE_URL from credentials.
- */
 export declare function buildDatabaseUrl(creds: DatabaseCredentials, options?: DatabaseUrlRewriteOptions): string;
-/**
- * Try to read database info from SST outputs (when sst dev has run).
- */
 export declare function readSstOutputs(): Promise<{
     databaseUrl?: string;
     databaseName?: string;
     secretArn?: string;
 } | null>;
-//# sourceMappingURL=credentials.d.ts.map

package/dist/src/utils/credentials.js

@@ -1,21 +1,7 @@
-/**
- * Database credential utilities
- */
 import { SecretsManagerClient, GetSecretValueCommand, } from "@aws-sdk/client-secrets-manager";
 import { logInfo, logSuccess } from "./log.js";
-/**
- * Get DATABASE_URL from Secrets Manager.
- *
- * Credential path patterns:
- *   - With app:    mesh/{tenant}/{stage}/{app}/db-credentials
- *   - Without app: mesh/{tenant}/{stage}/db-credentials
- *
- * Returns the DATABASE_URL string directly. Use rewriteDatabaseUrl() to
- * modify host/port for tunnel usage.
- */
 export async function getDatabaseUrl(tenant, stage, options) {
     const secretsManager = new SecretsManagerClient({});
-    // Build secret path - with or without app name
     const secretName = options?.app
         ? `mesh/${tenant}/${stage}/${options.app}/db-credentials`
         : `mesh/${tenant}/${stage}/db-credentials`;
@@ -24,13 +10,11 @@ export async function getDatabaseUrl(tenant, stage, options) {
         const response = await secretsManager.send(new GetSecretValueCommand({ SecretId: secretName }));
         if (response.SecretString) {
             const secret = JSON.parse(response.SecretString);
-            // Handle DATABASE_URL format (preferred)
             if (secret.DATABASE_URL) {
                 const parsed = new URL(secret.DATABASE_URL);
                 logSuccess(`Got credentials for user: ${parsed.username}`);
                 return secret.DATABASE_URL;
             }
-            // Handle individual fields format (legacy)
             if (secret.username && secret.password) {
                 logSuccess(`Got credentials for user: ${secret.username}`);
                 const database = secret.dbname ?? secret.database ?? "postgres";
@@ -43,13 +27,9 @@ export async function getDatabaseUrl(tenant, stage, options) {
         if (error.message?.includes("unexpected format")) {
             throw error;
         }
-        // Secret not found - will be caught by caller
     }
     throw new Error(`Could not find credentials at ${secretName}`);
 }
-/**
- * @deprecated Use getDatabaseUrl instead - returns DATABASE_URL directly
- */
 export async function getDbCredentials(tenant, stage, _platformEnv, rdsHost, rdsPort, options) {
     const databaseUrl = await getDatabaseUrl(tenant, stage, options);
     const parsed = new URL(databaseUrl);
@@ -61,16 +41,9 @@ export async function getDbCredentials(tenant, stage, _platformEnv, rdsHost, rds
         database: parsed.pathname.slice(1),
     };
 }
-/**
- * Rewrite DATABASE_URL with new endpoint and/or SSL mode.
- * Preserves username, password, database name, and other query params.
- *
- * Used by both mesh-env-exec (for sst dev) and mesh db exec (for ad-hoc commands).
- */
 export function rewriteDatabaseUrl(url, options) {
     try {
         const parsed = new URL(url);
-        // Rewrite endpoint if provided
         if (options.endpoint) {
             if (options.endpoint.includes(":")) {
                 const colonIndex = options.endpoint.lastIndexOf(":");
@@ -82,10 +55,8 @@ export function rewriteDatabaseUrl(url, options) {
                 parsed.port = parsed.port || "5432";
             }
         }
-        // Set SSL mode if provided
         if (options.sslMode) {
             parsed.searchParams.set("sslmode", options.sslMode);
-            // For Prisma: accept invalid/self-signed certificates through tunnels
             if (options.sslMode === "require" || options.sslMode === "no-verify") {
                 parsed.searchParams.set("sslaccept", "accept_invalid_certs");
             }
@@ -93,13 +64,9 @@ export function rewriteDatabaseUrl(url, options) {
         return parsed.toString();
     }
     catch {
-        // If URL parsing fails, return original
         return url;
     }
 }
-/**
- * Build a DATABASE_URL from credentials.
- */
 export function buildDatabaseUrl(creds, options) {
     const host = options?.endpoint?.split(":")[0] ?? creds.host;
     const port = options?.endpoint?.split(":")[1] ?? String(creds.port);
@@ -112,9 +79,6 @@ export function buildDatabaseUrl(creds, options) {
     }
     return url;
 }
-/**
- * Try to read database info from SST outputs (when sst dev has run).
- */
 export async function readSstOutputs() {
     const fs = await import("fs");
     if (!fs.existsSync(".sst/outputs.json")) {
@@ -125,7 +89,6 @@ export async function readSstOutputs() {
         const outputs = JSON.parse(content);
         if (outputs.databaseUrl) {
             logInfo("Found SST outputs with database config");
-            // Extract secret ARN from URL if present
             const secretArnMatch = outputs.databaseUrl.match(/secretArn=([^&]+)/);
             const secretArn = secretArnMatch
                 ? decodeURIComponent(secretArnMatch[1])
@@ -138,8 +101,6 @@ export async function readSstOutputs() {
         }
     }
     catch {
-        // Ignore parse errors
     }
     return null;
 }
-//# sourceMappingURL=credentials.js.map

package/dist/src/utils/deploy-preflight.d.ts

@@ -1,52 +1,14 @@
-/** A `@mesh-tech/*` dep whose installed version differs from the lockfile's. */
 export interface DepMismatch {
     name: string;
-    /** Version the lockfile says should be installed. */
     expected: string;
-    /** Version actually resolvable in node_modules, or null if not installed. */
     installed: string | null;
 }
-/** pulumi ops that EVALUATE the program (a stale install can produce a wrong plan). */
 export declare const PROGRAM_EVAL_OPS: Set<string>;
-/** Env escape hatch — set truthy to skip the preflight (e.g. deliberate local link testing). */
 export declare const SKIP_ENV = "MESH_SKIP_DEPLOY_PREFLIGHT";
-/**
- * A lockfile `version:` is checkable only when it's a concrete published version.
- * `link:…`/`file:…` (dev-link pnpmfile, local tarballs) point at live source and
- * are never stale; anything not starting with a digit isn't a comparable version.
- * Peer/patch suffixes (`1.0.1(react@18)`) are stripped to the bare version.
- */
 export declare function normalizeLockVersion(raw: unknown): string | null;
-/**
- * Pure: extract the gated (`@mesh-tech/*`), concretely-versioned deps for one
- * importer of a parsed pnpm-lock document → `{ name: expectedVersion }`.
- *
- * Handles the pnpm v9 shape (`{ specifier, version }` per dep) and the older flat
- * shape (`name: "1.0.1"`). Unknown importer → `{}` (nothing checkable).
- */
 export declare function extractImporterMeshVersions(lockDoc: unknown, importerRel: string): Record<string, string>;
-/**
- * Pure: diff the lockfile's expected versions against the installed ones. A dep
- * is a mismatch when the installed version differs (or it isn't installed).
- */
 export declare function diffLockVsInstalled(expected: Record<string, string>, installed: Record<string, string | null>): DepMismatch[];
-/** Walk up from `startDir` to the nearest directory containing a `pnpm-lock.yaml`. */
 export declare function findPnpmLock(startDir: string): string | null;
-/**
- * Check that the `@mesh-tech/*` deps installed in `appRoot`'s `node_modules` match
- * what the pnpm lockfile says. Returns the list of mismatches (empty = fresh), or
- * `null` when the check does not apply (no lockfile — not a pnpm repo, or the
- * monorepo running without one). IO wrapper around the pure helpers above.
- */
 export declare function checkDeployDepsFresh(appRoot: string): DepMismatch[] | null;
-/** Human-readable stale-deps report (mirrors the stale-dist detector's style). */
 export declare function formatStaleDepsError(mismatches: DepMismatch[]): string;
-/**
- * Gate a `mesh deploy` invocation: if `op` evaluates the pulumi program and the
- * deploy repo's `node_modules` is stale vs the lockfile, print the fix and exit
- * non-zero BEFORE pulumi runs. No-op for non-evaluating ops, a fresh install, a
- * non-pnpm repo, or when the skip env is set. Kept side-effecting (log + exit) so
- * `deploy.ts` stays a thin wiring layer; the decision logic is pure above.
- */
 export declare function assertDeployDepsFresh(appRoot: string, op: string): void;
-//# sourceMappingURL=deploy-preflight.d.ts.map