@mesh-tech/mesh-cli 0.24.1 → 0.26.0

package/dist/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "8aff693d3",
-  "builtAt": "2026-09-15T19:25:45.158Z"
+  "commit": "8c1e961c4",
+  "builtAt": "2026-09-17T07:12:18.568Z"
 }

package/dist/src/commands/app-check.d.ts

@@ -1,6 +1,6 @@
 import { Command } from "commander";
 import { jsonReport, type Check, type CheckResult, type CheckStatus } from "./dev-doctor.js";
-export type AppCheckCode = "UI_IN_API" | "NO_UI_SERVICE" | "NO_REGISTER" | "CUSTOM_SESSION_AUTH" | "NON_PLATFORM_LOGGER" | "LOCAL_AUTH_LIB" | "NO_AUTHZ_POINTER" | "METADATA_UNPUBLISHED" | "IAC_GRANTS" | "POINTER_PROJECT_OVERRIDE" | "PASSWORD_STORE" | "EMAIL_ALLOWLIST" | "USERS_TABLE" | "DOCS_SITE_PUBLIC" | "DOCS_AUDIENCE_IMPLICIT" | "DOCS_AUDIENCE_UNGRANTABLE";
+export type AppCheckCode = "UI_IN_API" | "NO_UI_SERVICE" | "NO_REGISTER" | "CUSTOM_SESSION_AUTH" | "NON_PLATFORM_LOGGER" | "LOCAL_AUTH_LIB" | "NO_AUTHZ_POINTER" | "METADATA_UNPUBLISHED" | "IAC_GRANTS" | "POINTER_PROJECT_OVERRIDE" | "PASSWORD_STORE" | "EMAIL_ALLOWLIST" | "USERS_TABLE" | "DOCS_SITE_PUBLIC" | "DOCS_AUDIENCE_IMPLICIT" | "DOCS_AUDIENCE_UNGRANTABLE" | "DOCS_VENDOR_AUDIENCE_PARTNER";
 export interface AppCheckRule {
     gate: string;
     title: string;
@@ -33,6 +33,7 @@ export declare function docsSiteFindings(text: string): Array<{
     line: number;
     why: string;
 }>;
+export declare function statedKind(decl: Pick<SurfaceDeclaration, "ctor">, args: Map<string, string>): string | undefined;
 export declare function listApps(root: string): string[];
 export declare function scanApp(root: string, appRel: string): Finding[];
 export declare function scanRepo(root: string): Finding[];

package/dist/src/commands/app-check.js

@@ -117,6 +117,13 @@ export const APP_CHECK_RULES = {
         remediation: 'declare every audience role on the ZitadelAppIdentity (roles: ["docs"]) so the Hub can grant it from the app\'s Access tab — the audience is published on the surface\'s registry entry as the reader set for the Hub to admit by, and a role nobody can be granted admits nobody',
         scope: "app",
     },
+    DOCS_VENDOR_AUDIENCE_PARTNER: {
+        gate: "H",
+        title: "Vendor reference never partner-readable",
+        severity: "block",
+        remediation: "drop docs.audience from the vendor surface — a vendor surface's site is the raw core API reference, read inside the Hub by holders of the vendor-docs add-on only; audience: { roles: [] } would declare it readable by every docs-role user of the tenant, which the Hub never honours and the deploy refuses",
+        scope: "app",
+    },
 };
 export const APP_CHECK_CODES = Object.keys(APP_CHECK_RULES);
 const SRC_EXT = new Set([".ts", ".tsx", ".js", ".mjs", ".jsx"]);
@@ -503,6 +510,17 @@ export function docsSiteFindings(text) {
                 why: `mesh.apps.${decl.ctor} declares a docs site but neither its kind nor its audience — who the Hub admits through the door would fall out of the name heuristic, and a vendor surface must never default to partner-readable that way`,
             });
         }
+        if (statedKind(decl, args) === "vendor" && docs.has("audience")) {
+            const audience = objectLiteralOf(docs.get("audience"), text);
+            const roles = audience ? stringList(topLevelProperties(audience).get("roles")) : undefined;
+            if (roles !== undefined && roles.length === 0) {
+                findings.push({
+                    code: "DOCS_VENDOR_AUDIENCE_PARTNER",
+                    line: decl.line,
+                    why: `mesh.apps.${decl.ctor} declares a vendor surface's docs site with audience: { roles: [] } — partner-readable by every docs-role user of the tenant; a vendor's spec is the raw core API, its site is read by holders of the Hub's vendor-docs add-on only, and the deploy refuses this declaration`,
+                });
+            }
+        }
         const httpText = objectLiteralOf(topLevelProperties(objectLiteralOf(args.get("surfaces"), text) ?? "{}").get("http"), text);
         for (const f of docsAudienceUngrantable(text, decl, args, docs, httpText))
             findings.push(f);
@@ -522,6 +540,13 @@ export function docsSiteFindings(text) {
     }
     return findings;
 }
+export function statedKind(decl, args) {
+    if (decl.ctor === "AppApiSurface")
+        return "app";
+    if (decl.ctor === "VendorApiSurface")
+        return "vendor";
+    return /^["']([a-z]+)["']$/.exec(args.get("kind") ?? "")?.[1];
+}
 function docsAudienceUngrantable(text, decl, args, docs, httpText) {
     const findings = [];
     let roles;
@@ -529,14 +554,8 @@ function docsAudienceUngrantable(text, decl, args, docs, httpText) {
         const audience = objectLiteralOf(docs.get("audience"), text);
         roles = audience ? stringList(topLevelProperties(audience).get("roles")) : undefined;
     }
-    else {
-        const kind = decl.ctor === "AppApiSurface"
-            ? "app"
-            : decl.ctor === "VendorApiSurface"
-                ? "vendor"
-                : /^["']([a-z]+)["']$/.exec(args.get("kind") ?? "")?.[1];
-        if (kind === "app")
-            roles = DEFAULT_PARTNER_DOCS_ROLES;
+    else if (statedKind(decl, args) === "app") {
+        roles = DEFAULT_PARTNER_DOCS_ROLES;
     }
     if (!roles || roles.length === 0)
         return findings;

package/dist/src/commands/db/axes.d.ts

@@ -0,0 +1,19 @@
+export interface DbAxisOptions {
+    tenant?: string;
+    env?: string;
+    appTenant?: string;
+    appStage?: string;
+}
+export interface PlatformAxis {
+    tenant: string;
+    env: string;
+}
+export interface AppAxis {
+    tenant: string;
+    stage: string;
+}
+export declare function platformAxis(options: DbAxisOptions, usage: string, detect?: () => {
+    tenant: string;
+    platformEnv: string;
+}): () => PlatformAxis;
+export declare function appAxis(options: DbAxisOptions, platform: () => PlatformAxis): AppAxis;

package/dist/src/commands/db/axes.js

@@ -0,0 +1,35 @@
+import { detectContext } from "../../utils/context.js";
+import { MeshCliError } from "../../utils/errors.js";
+import { logInfo } from "../../utils/log.js";
+export function platformAxis(options, usage, detect = detectContext) {
+    if ((options.tenant && !options.env) || (!options.tenant && options.env)) {
+        throw new MeshCliError("Both --tenant and --env are required", {
+            remediation: { command: usage },
+        });
+    }
+    let resolved;
+    return () => {
+        if (resolved)
+            return resolved;
+        if (options.tenant && options.env) {
+            resolved = { tenant: options.tenant, env: options.env };
+            logInfo(`Platform: Tenant=${resolved.tenant}, Env=${resolved.env}`);
+        }
+        else {
+            const ctx = detect();
+            resolved = { tenant: ctx.tenant, env: ctx.platformEnv };
+            logInfo(`Auto-detected: Tenant=${resolved.tenant}, Env=${resolved.env}`);
+        }
+        return resolved;
+    };
+}
+export function appAxis(options, platform) {
+    if (options.appTenant && options.appStage) {
+        return { tenant: options.appTenant, stage: options.appStage };
+    }
+    const resolved = platform();
+    return {
+        tenant: options.appTenant ?? resolved.tenant,
+        stage: options.appStage ?? resolved.env,
+    };
+}

package/dist/src/commands/db/connect.d.ts

@@ -1,6 +1,4 @@
-interface ConnectOptions {
-    tenant?: string;
-    env?: string;
-}
+import { type DbAxisOptions } from "./axes.js";
+type ConnectOptions = Pick<DbAxisOptions, "tenant" | "env">;
 export declare function connectCommand(options: ConnectOptions): Promise<void>;
 export {};

package/dist/src/commands/db/connect.js

@@ -1,24 +1,9 @@
 import { spawn } from "child_process";
-import { detectContext, getPlatformBastionInfo, logInfo, logError, } from "../../utils/index.js";
+import { getPlatformBastionInfo, logInfo, logError } from "../../utils/index.js";
+import { platformAxis } from "./axes.js";
+const USAGE = "mesh db connect --tenant mesh --env dev-temporal";
 export async function connectCommand(options) {
-    let tenant;
-    let platformEnv;
-    if (options.tenant && options.env) {
-        tenant = options.tenant;
-        platformEnv = options.env;
-        logInfo(`Explicit mode: Tenant=${tenant}, Env=${platformEnv}`);
-    }
-    else if (options.tenant || options.env) {
-        logError("Both --tenant and --env are required");
-        logInfo("Usage: mesh db connect --tenant mesh --env dev-temporal");
-        process.exit(1);
-    }
-    else {
-        const ctx = detectContext();
-        tenant = ctx.tenant;
-        platformEnv = ctx.platformEnv;
-        logInfo(`Auto-detected: Tenant=${tenant}, Env=${platformEnv}`);
-    }
+    const { tenant, env: platformEnv } = platformAxis(options, USAGE)();
     const bastion = await getPlatformBastionInfo(tenant, platformEnv);
     const rdsService = bastion.services.rds;
     if (!rdsService) {

package/dist/src/commands/db/credentials.d.ts

@@ -1,9 +1,6 @@
-interface CredentialsOptions {
-    tenant?: string;
-    env?: string;
+import { type DbAxisOptions } from "./axes.js";
+interface CredentialsOptions extends DbAxisOptions {
     app?: string;
-    appTenant?: string;
-    appStage?: string;
 }
 export declare function credentialsCommand(options: CredentialsOptions): Promise<void>;
 export {};

package/dist/src/commands/db/credentials.js

@@ -1,30 +1,14 @@
-import { detectContext, getDatabaseUrl, logInfo, logError, } from "../../utils/index.js";
+import { getDatabaseUrl, logInfo } from "../../utils/index.js";
+import { appAxis, platformAxis } from "./axes.js";
+const USAGE = "mesh db credentials --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev";
 export async function credentialsCommand(options) {
-    let platformTenant;
-    let platformEnv;
-    if (options.tenant && options.env) {
-        platformTenant = options.tenant;
-        platformEnv = options.env;
-        logInfo(`Platform: Tenant=${platformTenant}, Env=${platformEnv}`);
-    }
-    else if (options.tenant || options.env) {
-        logError("Both --tenant and --env are required");
-        logInfo("Usage: mesh db credentials --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev");
-        process.exit(1);
-    }
-    else {
-        const ctx = detectContext();
-        platformTenant = ctx.tenant;
-        platformEnv = ctx.platformEnv;
-        logInfo(`Auto-detected: Tenant=${platformTenant}, Env=${platformEnv}`);
-    }
-    const appTenant = options.appTenant ?? platformTenant;
-    const appStage = options.appStage ?? platformEnv;
+    const platform = platformAxis(options, USAGE);
+    const app = appAxis(options, platform);
     const appName = options.app;
     if (appName) {
-        logInfo(`App credentials: tenant=${appTenant}, stage=${appStage}, app=${appName}`);
+        logInfo(`App credentials: tenant=${app.tenant}, stage=${app.stage}, app=${appName}`);
     }
-    const databaseUrl = await getDatabaseUrl(appTenant, appStage, { app: appName });
+    const databaseUrl = await getDatabaseUrl(app.tenant, app.stage, { app: appName });
     const parsed = new URL(databaseUrl);
     console.log("");
     console.log("Database Credentials:");

package/dist/src/commands/db/env.d.ts

@@ -1,9 +1,6 @@
-interface EnvOptions {
-    tenant?: string;
-    env?: string;
+import { type DbAxisOptions } from "./axes.js";
+interface EnvOptions extends DbAxisOptions {
     app?: string;
-    appTenant?: string;
-    appStage?: string;
 }
 export declare function envCommand(options: EnvOptions): Promise<void>;
 export {};

package/dist/src/commands/db/env.js

@@ -1,30 +1,14 @@
-import { detectContext, getDatabaseUrl, rewriteDatabaseUrl, logInfo, logError, } from "../../utils/index.js";
+import { getDatabaseUrl, rewriteDatabaseUrl } from "../../utils/index.js";
+import { appAxis, platformAxis } from "./axes.js";
+const USAGE = "eval $(mesh db env --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev)";
 export async function envCommand(options) {
-    let platformTenant;
-    let platformEnv;
-    if (options.tenant && options.env) {
-        platformTenant = options.tenant;
-        platformEnv = options.env;
-        console.error(`ℹ Platform: Tenant=${platformTenant}, Env=${platformEnv}`);
-    }
-    else if (options.tenant || options.env) {
-        logError("Both --tenant and --env are required");
-        logInfo("Usage: eval $(mesh db env --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev)");
-        process.exit(1);
-    }
-    else {
-        const ctx = detectContext();
-        platformTenant = ctx.tenant;
-        platformEnv = ctx.platformEnv;
-        console.error(`ℹ Auto-detected: Tenant=${platformTenant}, Env=${platformEnv}`);
-    }
-    const appTenant = options.appTenant ?? platformTenant;
-    const appStage = options.appStage ?? platformEnv;
+    const platform = platformAxis(options, USAGE);
+    const app = appAxis(options, platform);
     const appName = options.app;
     if (appName) {
-        console.error(`ℹ App credentials: tenant=${appTenant}, stage=${appStage}, app=${appName}`);
+        console.error(`ℹ App credentials: tenant=${app.tenant}, stage=${app.stage}, app=${appName}`);
     }
-    const rawUrl = await getDatabaseUrl(appTenant, appStage, { app: appName });
+    const rawUrl = await getDatabaseUrl(app.tenant, app.stage, { app: appName });
     const tunnelUrl = rewriteDatabaseUrl(rawUrl, { endpoint: "localhost:5432" });
     const parsed = new URL(tunnelUrl);
     console.log(`export DATABASE_URL="${tunnelUrl}"`);

package/dist/src/commands/db/exec.js

@@ -3,7 +3,8 @@ import * as net from "net";
 import * as fs from "fs";
 import * as path from "path";
 import { SecretsManagerClient, GetSecretValueCommand, } from "@aws-sdk/client-secrets-manager";
-import { detectContext, getPlatformBastionInfo, getDatabaseUrl, rewriteDatabaseUrl, logInfo, logSuccess, logError, logWarn, } from "../../utils/index.js";
+import { getPlatformBastionInfo, getDatabaseUrl, rewriteDatabaseUrl, logInfo, logSuccess, logError, logWarn, } from "../../utils/index.js";
+import { appAxis, platformAxis } from "./axes.js";
 const DEFAULT_LOCAL_PORT = 5432;
 const MAX_RETRIES = 12;
 const RETRY_DELAY_MS = 5000;
@@ -170,30 +171,11 @@ export async function execCommand(commandArgs, options) {
         }
     }
     else {
-        let platformTenant;
-        let platformEnv;
-        if (options.tenant && options.env) {
-            platformTenant = options.tenant;
-            platformEnv = options.env;
-            logInfo(`Explicit mode: Platform Tenant=${platformTenant}, Platform Env=${platformEnv}`);
-        }
-        else if (options.tenant || options.env) {
-            logError("Both --tenant and --env are required when using explicit mode");
-            logInfo("Usage: mesh db exec --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev -- <command>");
-            logInfo("Or omit both to use auto-detection");
-            process.exit(1);
-        }
-        else {
-            const ctx = detectContext();
-            platformTenant = ctx.tenant;
-            platformEnv = ctx.platformEnv;
-            logInfo(`Discovery mode: Platform=${platformEnv}, Tenant=${platformTenant}`);
-        }
-        const appTenant = options.appTenant ?? platformTenant;
-        const appStage = options.appStage ?? platformEnv;
+        const platform = platformAxis(options, "mesh db exec --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev -- <command>");
+        const app = appAxis(options, platform);
         const appName = options.app;
         if (appName) {
-            logInfo(`App credentials: tenant=${appTenant}, stage=${appStage}, app=${appName}`);
+            logInfo(`App credentials: tenant=${app.tenant}, stage=${app.stage}, app=${appName}`);
         }
         const tunnelExists = await checkPort(localPort);
         const sstOutputs = findSstOutputs();
@@ -215,6 +197,7 @@ export async function execCommand(commandArgs, options) {
         }
         if (!databaseUrl) {
             if (!tunnelExists) {
+                const { tenant: platformTenant, env: platformEnv } = platform();
                 const bastion = await getPlatformBastionInfo(platformTenant, platformEnv);
                 const rdsService = bastion.services.rds;
                 if (!rdsService) {
@@ -225,7 +208,7 @@ export async function execCommand(commandArgs, options) {
             else {
                 logSuccess(`Using existing tunnel on port ${localPort}`);
             }
-            const rawUrl = await getDatabaseUrl(appTenant, appStage, { app: appName });
+            const rawUrl = await getDatabaseUrl(app.tenant, app.stage, { app: appName });
             databaseUrl = rewriteDatabaseUrl(rawUrl, {
                 endpoint: `localhost:${localPort}`,
                 sslMode: options.ssl,

package/dist/src/commands/db/psql.d.ts

@@ -1,9 +1,6 @@
-interface PsqlOptions {
-    tenant?: string;
-    env?: string;
+import { type DbAxisOptions } from "./axes.js";
+interface PsqlOptions extends DbAxisOptions {
     app?: string;
-    appTenant?: string;
-    appStage?: string;
 }
 export declare function psqlCommand(options: PsqlOptions): Promise<void>;
 export {};

package/dist/src/commands/db/psql.js

@@ -1,6 +1,8 @@
 import { spawn } from "child_process";
 import * as net from "net";
-import { detectContext, getPlatformBastionInfo, getDatabaseUrl, logInfo, logSuccess, logError, } from "../../utils/index.js";
+import { getPlatformBastionInfo, getDatabaseUrl, logInfo, logSuccess, logError, } from "../../utils/index.js";
+import { appAxis, platformAxis } from "./axes.js";
+const USAGE = "mesh db psql --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev";
 async function startTunnelBackground(instanceId, rdsHost, rdsPort, localPort) {
     logInfo("Starting tunnel in background...");
     const tunnel = spawn("aws", [
@@ -46,29 +48,12 @@ function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
 export async function psqlCommand(options) {
-    let platformTenant;
-    let platformEnv;
-    if (options.tenant && options.env) {
-        platformTenant = options.tenant;
-        platformEnv = options.env;
-        logInfo(`Platform: Tenant=${platformTenant}, Env=${platformEnv}`);
-    }
-    else if (options.tenant || options.env) {
-        logError("Both --tenant and --env are required");
-        logInfo("Usage: mesh db psql --tenant mesh --env dev-temporal --app rdc --app-tenant encore --app-stage dev");
-        process.exit(1);
-    }
-    else {
-        const ctx = detectContext();
-        platformTenant = ctx.tenant;
-        platformEnv = ctx.platformEnv;
-        logInfo(`Auto-detected: Tenant=${platformTenant}, Env=${platformEnv}`);
-    }
-    const appTenant = options.appTenant ?? platformTenant;
-    const appStage = options.appStage ?? platformEnv;
+    const platform = platformAxis(options, USAGE);
+    const { tenant: platformTenant, env: platformEnv } = platform();
+    const app = appAxis(options, platform);
     const appName = options.app;
     if (appName) {
-        logInfo(`App credentials: tenant=${appTenant}, stage=${appStage}, app=${appName}`);
+        logInfo(`App credentials: tenant=${app.tenant}, stage=${app.stage}, app=${appName}`);
     }
     const psqlCheck = spawn("which", ["psql"]);
     await new Promise((resolve, reject) => {
@@ -96,7 +81,7 @@ export async function psqlCommand(options) {
     process.on("exit", cleanup);
     process.on("SIGINT", cleanup);
     process.on("SIGTERM", cleanup);
-    const databaseUrl = await getDatabaseUrl(appTenant, appStage, { app: appName });
+    const databaseUrl = await getDatabaseUrl(app.tenant, app.stage, { app: appName });
     const parsed = new URL(databaseUrl);
     const username = parsed.username;
     const password = decodeURIComponent(parsed.password);

package/dist/src/commands/init/platform-setup.d.ts

@@ -0,0 +1,68 @@
+export interface SetupPrompts {
+    input(args: {
+        message: string;
+        default?: string;
+        validate?: (v: string) => true | string;
+    }): Promise<string>;
+    confirm(args: {
+        message: string;
+        default?: boolean;
+    }): Promise<boolean>;
+}
+export interface PlatformSetupFlags {
+    env?: string;
+    region?: string;
+    domain?: string;
+    profile?: string;
+    stateBucket?: string;
+    dir?: string;
+    createStateBucket?: boolean;
+    yes?: boolean;
+}
+export interface PlatformSetup {
+    tenant: string;
+    env: string;
+    region: string;
+    domain: string;
+    profile: string;
+    stateBucket: string;
+    dir: string;
+    createStateBucket: boolean;
+}
+export declare const PLATFORM_SETUP_DEFAULTS: {
+    readonly env: "dev";
+    readonly region: "us-east-2";
+    readonly profile: "default";
+};
+export declare const DOMAIN_REQUIRED_MESSAGE: string;
+export declare function defaultStateBucket(tenant: string): string;
+export declare function defaultPlatformDir(tenant: string): string;
+export declare function validateEnv(value: string): true | string;
+export declare function validateRegion(value: string): true | string;
+export declare function validateDomain(value: string): true | string;
+export declare function validateStateBucket(value: string): true | string;
+export declare function resolveTargetDir(tenant: string, flags: PlatformSetupFlags, cwd: string): string;
+export declare function resolvePlatformSetup(tenant: string, flags: PlatformSetupFlags, deps: {
+    prompts?: SetupPrompts;
+    interactive: boolean;
+    cwd?: string;
+}): Promise<PlatformSetup>;
+export declare function stateBucketCreateCommand(setup: Pick<PlatformSetup, "stateBucket" | "region" | "profile">): string;
+export interface StateBucketOutcome {
+    created: boolean;
+    present: boolean;
+    detail: string;
+}
+export interface StateBucketDeps {
+    headBucket(setup: PlatformSetup): boolean;
+    createBucket(setup: PlatformSetup): void;
+    enableVersioning(setup: PlatformSetup): void;
+}
+export declare const realStateBucketDeps: StateBucketDeps;
+export declare function ensureStateBucket(setup: PlatformSetup, deps?: StateBucketDeps): Promise<StateBucketOutcome>;
+export declare function exportCredentialsCommand(profile: string): string;
+export declare function renderPlatformNextSteps(setup: PlatformSetup, opts?: {
+    bucket?: StateBucketOutcome;
+    relativeDir?: string;
+}): string[];
+export declare function scaffoldPlatformRepo(setup: PlatformSetup): Promise<void>;