@mesh-tech/mesh-cli 0.20.2 → 0.20.4

package/dist/src/commands/create-app.js

@@ -1,13 +1,3 @@
-/**
- * mesh create-app - Scaffold a new tenant application
- *
- * Three modes:
- * 1. Legacy: `mesh create-app --template workflow --tenant x --name y`
- * 2. Composable (flags): `mesh create-app --tenant x --name y --primitives service,database`
- * 3. Interactive: `mesh create-app` (prompts when TTY detected and flags missing)
- *
- * All options can be passed as flags for agent/CI usage (no TTY required).
- */
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
@@ -22,50 +12,29 @@ import { SCAFFOLD_TOOLCHAIN, resolvePublishedRange } from "../utils/scaffold-ver
 import { registryPreflight } from "../utils/auth-preflight.js";
 import { MeshCliError } from "../utils/errors.js";
 import { findMeshJson } from "../utils/mesh-json.js";
-// Get package root by walking up until we find package.json with our package name.
-// Works from both src/commands/ (tsx) and dist/src/commands/ (compiled).
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 const packageRoot = findPackageRoot(__dirname);
-// Available templates
 const TEMPLATES = {
     workflow: "Hono API + Temporal worker + hello workflow (Pulumi/app-kit)",
     "api-auth": "Hono API with platform auth: authn (Zitadel JWT) + authz (SpiceDB)",
     "api-role-gating": "Hono API with role-gating authz: authn (Zitadel JWT) + coarse-role checks on Zitadel project roles, in-process (no SpiceDB)",
     "external-service": "Hono API calling a third-party vendor via platform-managed credentials (ExternalService + mock for `mesh dev --externals`)",
 };
-/** Removed templates → what replaced them (named in the unknown-template error). */
 const REMOVED_TEMPLATES = {
     "temporal-api-worker": "renamed to 'workflow'",
     "api-web-db": "removed (SST-based) — use --primitives service,database",
 };
-// Available primitives for composable mode
 const PRIMITIVES = {
     service: "HTTP Service (API with Hono)",
     database: "Database (PostgreSQL via Prisma)",
     temporal: "Temporal (workflow orchestration)",
     bucket: "S3 Bucket (file storage)",
 };
-/**
- * Hub platform account IDs — the AWS account hosting a shared tenant's
- * `{tenant}-{env}-apps-deployer` role. Shared tenants (acme, …) deploy into the
- * hub account, so the generated `mesh:deployerRole` ARN resolves against this map.
- * `mesh` is the only hub today; add entries as new hubs come online.
- */
 const HUB_ACCOUNTS = {
     mesh: "159923586610",
 };
-/** The root `package.json` name that identifies the mesh-platform monorepo. */
 export const PLATFORM_MONOREPO_NAME = "mesh-platform";
-/**
- * True when `dir` sits inside the **mesh-platform monorepo** — the one workspace
- * that publishes `@mesh-tech/*`, so a scaffolded app there wants `workspace:*` +
- * `catalog:` (link local source) instead of published ranges.
- *
- * The test is deliberately narrow. Looking for any ancestor `pnpm-workspace.yaml`
- * is not enough: a tenant-apps repo is itself a pnpm workspace (`packages: [apps/*]`).
- * Identity comes from the root `package.json` name, which no tenant repo shares.
- */
 export function isInsidePlatformMonorepo(dir) {
     let cur = path.resolve(dir);
     while (cur !== path.dirname(cur)) {
@@ -76,34 +45,17 @@ export function isInsidePlatformMonorepo(dir) {
                     return true;
             }
             catch {
-                // an unreadable/absent root package.json is not the platform monorepo
             }
         }
         cur = path.dirname(cur);
     }
     return false;
 }
-/**
- * Deployer-role ARN for a shared tenant on a known hub, or a clearly-marked
- * `ACCOUNT_ID` placeholder when the hub account is unknown (the generated config
- * comments the fill-in step in that case).
- */
 function resolveDeployerRoleArn(tenant, platformName, env) {
     const account = HUB_ACCOUNTS[platformName] ?? "ACCOUNT_ID";
     return `arn:aws:iam::${account}:role/${tenant}-${env}-apps-deployer`;
 }
 const VALID_PRIMITIVES = Object.keys(PRIMITIVES);
-// =============================================================================
-// Standalone apps-repo bootstrap
-// =============================================================================
-/**
- * A fresh standalone tenant-apps repo (empty clone of {tenant}-mesh-apps) is
- * bootstrappable when the cwd is a git repo root that has none of the layouts
- * `resolveAppDir` looks for. Previously create-app exited with "Tenant
- * directory not found: tenants/<t>/" here — even though the app-tenant
- * doctor's Repo-shape check names create-app as the fix ("workspace files
- * included"), so the command must actually deliver them.
- */
 export function shouldBootstrapAppsRepo(cwd) {
     return (fs.existsSync(path.join(cwd, ".git")) &&
         !isInsidePlatformMonorepo(cwd) &&
@@ -111,12 +63,6 @@ export function shouldBootstrapAppsRepo(cwd) {
         !fs.existsSync(path.join(cwd, "tenants")) &&
         !fs.existsSync(path.join(cwd, "apps")));
 }
-/**
- * Generate the repo-level files of a standalone tenant-apps repo (the
- * trabian-mesh-apps shape): pnpm workspace over apps/*, private root
- * package.json, scoped CodeArtifact .npmrc, base tsconfig, .gitignore, README.
- * Only writes files that don't already exist; returns what it created.
- */
 export function bootstrapAppsRepo(cwd, tenant) {
     const templateDir = path.join(packageRoot, "templates", "apps-repo");
     const registryAccount = HUB_ACCOUNTS.mesh;
@@ -133,8 +79,6 @@ export function bootstrapAppsRepo(cwd, tenant) {
     const staging = fs.mkdtempSync(path.join(os.tmpdir(), "mesh-apps-repo-"));
     try {
         copyTemplate(templateDir, staging, context);
-        // npm strips dotfiles from published tarballs, so the template ships
-        // `gitignore`/`npmrc` and the bootstrap restores the real names.
         for (const [from, to] of [
             ["gitignore", ".gitignore"],
             ["npmrc", ".npmrc"],
@@ -159,17 +103,6 @@ export function bootstrapAppsRepo(cwd, tenant) {
         fs.rmSync(staging, { recursive: true, force: true });
     }
 }
-/**
- * A composed app puts its runnable packages one level below the app dir
- * (`apps/<name>/api`, `apps/<name>/worker`). pnpm only installs dependencies
- * for workspace MEMBERS, and an apps repo whose `pnpm-workspace.yaml` says
- * `packages: [apps/*]` does not match them — so the app scaffolds, the root
- * install reports success, and `pnpm dev` dies on `Cannot find package 'hono'`
- * with nothing pointing at the cause.
- *
- * Append any missing glob as a line under `packages:` (text edit, so comments
- * and ordering survive). Returns the globs added, empty when nothing was missing.
- */
 export function ensureWorkspaceGlobs(root, required) {
     const file = path.join(root, "pnpm-workspace.yaml");
     if (!fs.existsSync(file))
@@ -186,8 +119,6 @@ export function ensureWorkspaceGlobs(root, required) {
     if (missing.length === 0)
         return [];
     const lines = text.split("\n");
-    // Insert after the last entry of the `packages:` list; bail if the file is
-    // shaped in a way we can't edit safely by hand.
     const start = lines.findIndex((line) => /^packages:\s*$/.test(line));
     if (start === -1)
         return [];
@@ -207,18 +138,6 @@ export function ensureWorkspaceGlobs(root, required) {
     fs.writeFileSync(file, lines.join("\n"));
     return missing;
 }
-/**
- * The `pnpm-workspace.yaml` glob that makes a composed app's nested packages
- * (`<app>/api`, `<app>/worker`) workspace members, derived from where the app
- * actually landed. `resolveAppDir` picks the first existing of
- * `tenants/<t>/apps`, `../<t>/apps` and `apps`, so the glob is rooted at
- * `apps` in one layout and at `tenants/<t>/apps` in another. Returns null when
- * the app resolved outside `root` — nothing there is a member of this workspace.
- *
- * @example
- * workspaceGlobForApp("/repo", "/repo/tenants/acme/apps/billing");
- * // → "tenants/acme/apps" followed by two wildcard segments
- */
 export function workspaceGlobForApp(root, appDir) {
     const rel = path.relative(root, appDir).split(path.sep).join("/");
     if (rel === "" || rel.split("/")[0] === "..")
@@ -231,25 +150,16 @@ function maybeBootstrapAppsRepo(cwd, tenant, test) {
     const created = bootstrapAppsRepo(cwd, tenant);
     logInfo(`Standalone apps repo detected — bootstrapped workspace files: ${created.join(", ")}`);
 }
-// Register Handlebars helpers
 Handlebars.registerHelper("titleCase", (str) => {
     return str
         .split("-")
         .map((word) => word.charAt(0).toUpperCase() + word.slice(1))
         .join(" ");
 });
-/**
- * Check if we're in an interactive terminal
- */
 function isInteractive() {
     return Boolean(process.stdin.isTTY && process.stdout.isTTY);
 }
-/**
- * Run interactive prompts to gather missing options.
- * Only called when TTY is available and required options are missing.
- */
 async function promptForOptions(options) {
-    // Dynamic imports so non-interactive usage doesn't load inquirer
     const { default: input } = await import("@inquirer/input");
     const { default: checkbox } = await import("@inquirer/checkbox");
     const tenant = options.tenant ??
@@ -273,14 +183,13 @@ async function promptForOptions(options) {
             choices: VALID_PRIMITIVES.map((p) => ({
                 name: PRIMITIVES[p],
                 value: p,
-                checked: p === "service", // service checked by default
+                checked: p === "service",
             })),
         });
         if (primitives.length === 0) {
             primitives = ["service"];
         }
     }
-    // Database and bucket place files in api/ — ensure service is included
     if (primitives.includes("database") && !primitives.includes("service")) {
         primitives.push("service");
         logInfo("Added 'service' — database files live in the api/ directory.");
@@ -291,19 +200,14 @@ async function promptForOptions(options) {
     }
     return { tenant, name, primitives };
 }
-/**
- * Recursively copy a directory, processing .hbs templates
- */
 export function copyTemplate(srcDir, destDir, context) {
     const entries = fs.readdirSync(srcDir, { withFileTypes: true });
     for (const entry of entries) {
         const srcPath = path.join(srcDir, entry.name);
         let destName = entry.name;
-        // Remove .hbs extension for template files
         if (destName.endsWith(".hbs")) {
             destName = destName.slice(0, -4);
         }
-        // File names can be templated too (e.g. Pulumi.{{tenant}}-{{env}}.yaml.hbs)
         if (destName.includes("{{")) {
             destName = Handlebars.compile(destName)(context);
         }
@@ -313,21 +217,16 @@ export function copyTemplate(srcDir, destDir, context) {
             copyTemplate(srcPath, destPath, context);
         }
         else if (entry.name.endsWith(".hbs")) {
-            // Process Handlebars template
             const templateContent = fs.readFileSync(srcPath, "utf-8");
             const template = Handlebars.compile(templateContent);
             const output = template(context);
             fs.writeFileSync(destPath, output);
         }
         else {
-            // Copy file as-is
             fs.copyFileSync(srcPath, destPath);
         }
     }
 }
-/**
- * Parse and validate primitive selections from comma-separated string
- */
 function parsePrimitives(input) {
     const selected = input.split(",").map((s) => s.trim().toLowerCase());
     const invalid = selected.filter((s) => !VALID_PRIMITIVES.includes(s));
@@ -338,16 +237,6 @@ function parsePrimitives(input) {
     }
     return selected;
 }
-/**
- * The refusal printed when no directory can receive the app. Inside the
- * platform monorepo (or with `--test`) the missing thing is a tenant
- * directory; anywhere else the caller is simply not in a Mesh apps repo, and
- * `mesh init` is what creates one — the monorepo's `tenants/<tenant>/` layout
- * means nothing on a tenant developer's laptop.
- *
- * @example
- * describeNoAppsHome("/home/dev/my-apps", "acme", "tenants", false).hint; // names `mesh init`
- */
 export function describeNoAppsHome(cwd, tenant, baseDir, test) {
     if (test || isInsidePlatformMonorepo(cwd)) {
         return {
@@ -360,16 +249,8 @@ export function describeNoAppsHome(cwd, tenant, baseDir, test) {
         hint: `Run: mesh init   (turns this folder into your ${tenant}-mesh-apps repo), or cd into that repo and re-run mesh create-app.`,
     };
 }
-/**
- * Resolve output directory for the app
- */
 export function resolveAppDir(cwd, tenant, name, test) {
     const baseDir = test ? "tests/tenants" : "tenants";
-    // `--test` names one destination, so it probes only that one. The general
-    // search below falls back to `<cwd>/apps`, which in a monorepo root is the
-    // REAL app directory (`apps/hub`, `apps/banking-api`) — it exists, so it won
-    // the probe and silently swallowed `--test`, scaffolding a throwaway test app
-    // next to the shipped ones while the log still said "Creating in tests/".
     const possiblePaths = test
         ? [path.join(cwd, baseDir, tenant, "apps")]
         : [
@@ -393,12 +274,8 @@ export function resolveAppDir(cwd, tenant, name, test) {
     }
     return path.join(appsDir, name);
 }
-/**
- * Generate a composable app from fragments
- */
 export function generateComposableApp(appDir, context) {
     const fragmentsDir = path.join(packageRoot, "fragments");
-    // 1. Always copy base fragment
     const baseDir = path.join(fragmentsDir, "base");
     if (!fs.existsSync(baseDir)) {
         logError(`Fragments directory not found: ${baseDir}`);
@@ -406,7 +283,6 @@ export function generateComposableApp(appDir, context) {
         process.exit(1);
     }
     copyTemplate(baseDir, appDir, context);
-    // 2. Copy primitive-specific fragments
     if (context.service) {
         const serviceDir = path.join(fragmentsDir, "service");
         if (!fs.existsSync(serviceDir)) {
@@ -435,7 +311,6 @@ export function generateComposableApp(appDir, context) {
         }
         copyTemplate(bucketDir, appDir, context);
     }
-    // 3. Always generate AGENTS.md
     const agentsDir = path.join(fragmentsDir, "agents");
     if (fs.existsSync(agentsDir)) {
         copyTemplate(agentsDir, appDir, context);
@@ -453,7 +328,6 @@ export function registerCreateAppCommand(program) {
         .option("--skip-registry-check", "Scaffold without checking that this machine can install @mesh-tech packages (offline use; run `mesh registry login` before `pnpm install`)", false)
         .action(async (options) => {
         await ensureRegistryAccess(process.cwd(), options);
-        // Legacy template mode — requires all flags
         if (options.template) {
             if (!options.tenant || !options.name) {
                 logError("--tenant and --name are required with --template");
@@ -462,21 +336,17 @@ export function registerCreateAppCommand(program) {
             await runLegacyTemplate(options.tenant, options.name, options.template, options.test);
             return;
         }
-        // Composable mode — interactive or flag-based
         let tenant;
         let name;
         let primitives;
         const needsPrompt = !options.tenant || !options.name || !options.primitives;
         if (needsPrompt && isInteractive()) {
-            // Interactive: prompt for missing values
             const prompted = await promptForOptions(options);
             tenant = prompted.tenant;
             name = prompted.name;
             primitives = prompted.primitives;
         }
         else if (needsPrompt) {
-            // Non-interactive but missing flags — the repo's `mesh.json` (written
-            // by `mesh init`) supplies the tenant when the flag is omitted.
             options.tenant ??= findMeshJson(process.cwd())?.data.tenant;
             if (!options.tenant) {
                 logError("--tenant is required (no TTY for interactive mode)");
@@ -497,7 +367,6 @@ export function registerCreateAppCommand(program) {
             name = options.name;
             primitives = parsePrimitives(options.primitives);
         }
-        // Database and bucket place files in api/ — ensure service is included
         if (primitives.includes("database") && !primitives.includes("service")) {
             primitives.push("service");
             logInfo("Added 'service' — database files live in the api/ directory.");
@@ -509,25 +378,10 @@ export function registerCreateAppCommand(program) {
         await runComposable(tenant, name, primitives, options.test);
     });
 }
-/** Printed when the registry preflight fails — the scaffold stops before any prompt or write. */
 export const NO_REGISTRY_ACCESS_MESSAGE = "No registry access on this machine — @mesh-tech packages cannot be installed.\n" +
     "  Run: mesh init\n" +
     "       (sets up your tenant and signs you in to the package registry)\n" +
     "  Scaffolding offline anyway? add --skip-registry-check";
-/**
- * Registry preflight, BEFORE any prompt and before any file is written.
- *
- * A scaffold whose `pnpm install` cannot resolve `@mesh-tech/*` is a trap: the
- * failure arrives minutes later with npm's generic E401/E404 advice, and the
- * fix (registry sign-in) has nothing to do with the app. So outside the
- * platform monorepo — where `workspace:*` links need no registry — the
- * command checks first and, when the machine has no access, stops and names
- * `mesh init`, the one place that sets a machine up. A registry that cannot
- * be reached is a network fault, not a missing grant: warn and carry on.
- *
- * @example
- * await ensureRegistryAccess(process.cwd(), { test: false }); // throws MeshCliError when access is missing
- */
 export async function ensureRegistryAccess(cwd, options, preflight = registryPreflight) {
     if (isInsidePlatformMonorepo(cwd))
         return;
@@ -585,11 +439,6 @@ async function runLegacyTemplate(tenant, name, template, test) {
     await checkScaffoldContract(appDir);
     printLegacyNextSteps(appDir, template);
 }
-/** Best-effort skills sync after scaffolding (design D1): a fresh Claude
- * session in the repo sees the base skills + Intent discovery immediately.
- * Also seeds the app's OWN skill stub — the app repo knows the app better than
- * any platform skill can, so the boilerplate sets the base and the developer
- * grows it. */
 function autoSyncSkills(appDir, appName) {
     const root = resolveTargetRoot(appDir);
     try {
@@ -607,12 +456,6 @@ function autoSyncSkills(appDir, appName) {
         logWarn(`App skill stub skipped: ${err instanceof Error ? err.message : err}`);
     }
 }
-/**
- * Run `mesh app check` on the app just scaffolded. A fresh scaffold satisfies
- * the Mesh app contract by construction (the template test proves it), so a
- * finding here is a platform defect, not the developer's: report it loudly and
- * fail the command so it cannot be missed, but leave the files in place.
- */
 async function checkScaffoldContract(appDir) {
     const root = resolveTargetRoot(appDir);
     const report = await runAppCheck(root, [path.relative(root, appDir) || "."]);
@@ -642,13 +485,9 @@ async function runComposable(tenant, name, primitives, test) {
         logError(`App directory already exists: ${appDir}`);
         process.exit(1);
     }
-    // Platform defaults (the generated Pulumi config targets the mesh hub / dev).
     const region = "us-east-2";
     const platformName = "mesh";
     const platformEnv = "dev";
-    // Link local source inside the platform monorepo; every other repo installs
-    // `@mesh-tech/*` from the registry, so it gets a caret range on the current
-    // published line (looked up here, baked floor when the lookup can't run).
     const workspaceDeps = isInsidePlatformMonorepo(appDir);
     const repoRoot = resolveTargetRoot(process.cwd());
     const mesh = workspaceDeps
@@ -746,4 +585,3 @@ function printComposableNextSteps(appDir, context) {
     console.log("  mesh dev                 # run locally");
     console.log("");
 }
-//# sourceMappingURL=create-app.js.map

package/dist/src/commands/db/connect.d.ts

@@ -1,13 +1,6 @@
-/**
- * mesh db connect - Start DB tunnel for manual psql access
- *
- * Usage:
- *   mesh db connect --tenant mesh --env dev-temporal
- */
 interface ConnectOptions {
     tenant?: string;
     env?: string;
 }
 export declare function connectCommand(options: ConnectOptions): Promise<void>;
 export {};
-//# sourceMappingURL=connect.d.ts.map

package/dist/src/commands/db/connect.js

@@ -1,13 +1,6 @@
-/**
- * mesh db connect - Start DB tunnel for manual psql access
- *
- * Usage:
- *   mesh db connect --tenant mesh --env dev-temporal
- */
 import { spawn } from "child_process";
 import { detectContext, getPlatformBastionInfo, logInfo, logError, } from "../../utils/index.js";
 export async function connectCommand(options) {
-    // Resolve tenant/env - explicit or auto-detect
     let tenant;
     let platformEnv;
     if (options.tenant && options.env) {
@@ -42,7 +35,6 @@ export async function connectCommand(options) {
     console.log("");
     logInfo("Press Ctrl+C to stop the tunnel");
     console.log("");
-    // Start SSM tunnel
     const tunnel = spawn("aws", [
         "ssm",
         "start-session",
@@ -65,4 +57,3 @@ export async function connectCommand(options) {
         process.exit(code ?? 0);
     });
 }
-//# sourceMappingURL=connect.js.map

package/dist/src/commands/db/credentials.d.ts

@@ -1,9 +1,3 @@
-/**
- * mesh db credentials - Print database credentials
- *
- * Usage:
- *   mesh db credentials --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev
- */
 interface CredentialsOptions {
     tenant?: string;
     env?: string;
@@ -13,4 +7,3 @@ interface CredentialsOptions {
 }
 export declare function credentialsCommand(options: CredentialsOptions): Promise<void>;
 export {};
-//# sourceMappingURL=credentials.d.ts.map

package/dist/src/commands/db/credentials.js

@@ -1,12 +1,5 @@
-/**
- * mesh db credentials - Print database credentials
- *
- * Usage:
- *   mesh db credentials --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev
- */
 import { detectContext, getDatabaseUrl, logInfo, logError, } from "../../utils/index.js";
 export async function credentialsCommand(options) {
-    // Resolve platform tenant/env
     let platformTenant;
     let platformEnv;
     if (options.tenant && options.env) {
@@ -25,14 +18,12 @@ export async function credentialsCommand(options) {
         platformEnv = ctx.platformEnv;
         logInfo(`Auto-detected: Tenant=${platformTenant}, Env=${platformEnv}`);
     }
-    // Resolve app credentials
     const appTenant = options.appTenant ?? platformTenant;
     const appStage = options.appStage ?? platformEnv;
     const appName = options.app;
     if (appName) {
         logInfo(`App credentials: tenant=${appTenant}, stage=${appStage}, app=${appName}`);
     }
-    // Get DATABASE_URL
     const databaseUrl = await getDatabaseUrl(appTenant, appStage, { app: appName });
     const parsed = new URL(databaseUrl);
     console.log("");
@@ -53,4 +44,3 @@ export async function credentialsCommand(options) {
     console.log(`  ${tunnelUrl.toString()}`);
     console.log("");
 }
-//# sourceMappingURL=credentials.js.map

package/dist/src/commands/db/env.d.ts

@@ -1,8 +1,3 @@
-/**
- * mesh db env - Export DATABASE_URL for shell
- *
- * Usage: eval $(mesh db env --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev)
- */
 interface EnvOptions {
     tenant?: string;
     env?: string;
@@ -12,4 +7,3 @@ interface EnvOptions {
 }
 export declare function envCommand(options: EnvOptions): Promise<void>;
 export {};
-//# sourceMappingURL=env.d.ts.map

package/dist/src/commands/db/env.js

@@ -1,17 +1,10 @@
-/**
- * mesh db env - Export DATABASE_URL for shell
- *
- * Usage: eval $(mesh db env --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev)
- */
 import { detectContext, getDatabaseUrl, rewriteDatabaseUrl, logInfo, logError, } from "../../utils/index.js";
 export async function envCommand(options) {
-    // Resolve platform tenant/env
     let platformTenant;
     let platformEnv;
     if (options.tenant && options.env) {
         platformTenant = options.tenant;
         platformEnv = options.env;
-        // Use stderr for info so stdout is clean for eval
         console.error(`ℹ Platform: Tenant=${platformTenant}, Env=${platformEnv}`);
     }
     else if (options.tenant || options.env) {
@@ -25,21 +18,15 @@ export async function envCommand(options) {
         platformEnv = ctx.platformEnv;
         console.error(`ℹ Auto-detected: Tenant=${platformTenant}, Env=${platformEnv}`);
     }
-    // Resolve app credentials
     const appTenant = options.appTenant ?? platformTenant;
     const appStage = options.appStage ?? platformEnv;
     const appName = options.app;
     if (appName) {
         console.error(`ℹ App credentials: tenant=${appTenant}, stage=${appStage}, app=${appName}`);
     }
-    // Get DATABASE_URL and rewrite for tunnel
     const rawUrl = await getDatabaseUrl(appTenant, appStage, { app: appName });
     const tunnelUrl = rewriteDatabaseUrl(rawUrl, { endpoint: "localhost:5432" });
     const parsed = new URL(tunnelUrl);
-    // Output export statements (to stdout for eval).
-    // WARNING: Contains plaintext credentials. Use only with:
-    //   eval "$(mesh db env ...)"
-    // Do NOT run bare — credentials will appear in terminal and shell history.
     console.log(`export DATABASE_URL="${tunnelUrl}"`);
     console.log('export DB_HOST="localhost"');
     console.log('export DB_PORT="5432"');
@@ -47,4 +34,3 @@ export async function envCommand(options) {
     console.log(`export DB_USERNAME="${parsed.username}"`);
     console.log(`export DB_PASSWORD="${decodeURIComponent(parsed.password)}"`);
 }
-//# sourceMappingURL=env.js.map

package/dist/src/commands/db/exec.d.ts

@@ -1,54 +1,11 @@
-/**
- * mesh db exec - Run any command with database connection
- *
- * Three modes of operation:
- *
- * 1. Explicit mode (recommended for ad-hoc use):
- *    mesh db exec --tenant=<tenant> --env=<env> [--ssl=require] -- <command>
- *    - Uses explicit tenant/env to find platform bastion
- *    - Starts tunnel if needed
- *    - Similar to: mesh tunnel --tenant mesh --env dev
- *
- * 2. Direct mode (for sst dev integration):
- *    mesh db exec --secret=<arn> [--ssl=require] -- <command>
- *    - Uses secret ARN directly, expects tunnel already running
- *    - Ideal for sst.config.ts devCommand
- *
- * 3. Discovery mode (legacy, auto-detection):
- *    mesh db exec [--stage=<stage>] -- <command>
- *    - Auto-discovers tenant/env from filesystem and config files
- *    - Can be fragile if project structure doesn't match expected patterns
- *    - Starts tunnel if needed
- *
- * Examples:
- *   # Explicit mode (recommended)
- *   mesh db exec --tenant mesh --env dev --ssl=require -- npx prisma db push
- *   mesh db exec -t mesh -e dev -- npx prisma migrate dev
- *
- *   # Direct mode (in sst.config.ts)
- *   mesh db exec --secret=arn:aws:secretsmanager:... --ssl=require -- pnpm dev
- *
- *   # Discovery mode (legacy)
- *   mesh db exec -- npx prisma db push
- *   mesh db exec --stage=dev -- npx prisma migrate dev
- */
 export interface ExecOptions {
-    /** Platform tenant for bastion lookup */
     tenant?: string;
-    /** Platform environment for bastion lookup */
     env?: string;
-    /** App name for credentials path */
     app?: string;
-    /** Tenant for app credentials (if different from platform tenant) */
     appTenant?: string;
-    /** Stage for app credentials */
     appStage?: string;
-    /** Secret ARN for direct mode */
     secret?: string;
-    /** SSL mode */
     ssl?: string;
-    /** Local tunnel port */
     port?: string;
 }
 export declare function execCommand(commandArgs: string[], options: ExecOptions): Promise<void>;
-//# sourceMappingURL=exec.d.ts.map