@mesh-tech/mesh-cli 0.25.0 → 0.26.0

package/dist/src/utils/context.js

@@ -1,89 +1,352 @@
 import * as fs from "fs";
 import * as path from "path";
-import { logInfo } from "./log.js";
-function findFileUpward(filename, startDir = process.cwd()) {
+import { MeshCliError } from "./errors.js";
+import { logInfo, logWarn } from "./log.js";
+import { findMeshJson } from "./mesh-json.js";
+function findFileUpwardInRepo(filename, startDir = process.cwd()) {
     let currentDir = startDir;
     const root = path.parse(currentDir).root;
-    while (currentDir !== root) {
+    for (;;) {
         const filePath = path.join(currentDir, filename);
         if (fs.existsSync(filePath)) {
             return filePath;
         }
+        if (fs.existsSync(path.join(currentDir, ".git")) ||
+            fs.existsSync(path.join(currentDir, "pnpm-workspace.yaml")) ||
+            currentDir === root) {
+            return undefined;
+        }
+        currentDir = path.dirname(currentDir);
+    }
+}
+function findRepoRoot(startDir) {
+    let currentDir = startDir;
+    const root = path.parse(currentDir).root;
+    for (;;) {
+        if (fs.existsSync(path.join(currentDir, ".git")) ||
+            fs.existsSync(path.join(currentDir, "pnpm-workspace.yaml"))) {
+            return currentDir;
+        }
+        if (currentDir === root) {
+            return undefined;
+        }
         currentDir = path.dirname(currentDir);
     }
+}
+function stripComments(source) {
+    let out = "";
+    for (let i = 0; i < source.length; i++) {
+        const ch = source[i];
+        if (ch === '"' || ch === "'" || ch === "`") {
+            const start = i;
+            i++;
+            while (i < source.length && source[i] !== ch) {
+                if (source[i] === "\\")
+                    i++;
+                i++;
+            }
+            out += source.slice(start, i + 1);
+        }
+        else if (ch === "/" && source[i + 1] === "/") {
+            while (i < source.length && source[i] !== "\n")
+                i++;
+            i--;
+        }
+        else if (ch === "/" && source[i + 1] === "*") {
+            i += 2;
+            while (i < source.length && !(source[i] === "*" && source[i + 1] === "/"))
+                i++;
+            i++;
+        }
+        else {
+            out += ch;
+        }
+    }
+    return out;
+}
+function findExportedConfigStart(source) {
+    const declMatch = /export\s+(const\s+config\b|default\b)/.exec(source);
+    if (!declMatch)
+        return undefined;
+    const start = source.indexOf("{", declMatch.index);
+    if (start === -1)
+        return undefined;
+    const gap = source.slice(declMatch.index + declMatch[0].length, start);
+    if (!/^[\s=]*(:[^;{]*)?$/.test(gap))
+        return undefined;
+    return start;
+}
+function scanDepth1(source, start, visit) {
+    let depth = 0;
+    for (let i = start; i < source.length; i++) {
+        const ch = source[i];
+        if (ch === '"' || ch === "'" || ch === "`") {
+            i++;
+            while (i < source.length && source[i] !== ch) {
+                if (source[i] === "\\")
+                    i++;
+                i++;
+            }
+        }
+        else if (ch === "{") {
+            depth++;
+        }
+        else if (ch === "}") {
+            depth--;
+            if (depth === 0)
+                return undefined;
+        }
+        else if (depth === 1 && !/[\w$.]/.test(source[i - 1] ?? "")) {
+            const found = visit(i);
+            if (found !== undefined)
+                return found;
+        }
+    }
+    return undefined;
+}
+function extractConfigTenant(rawSource) {
+    const source = stripComments(rawSource);
+    const start = findExportedConfigStart(source);
+    if (start === undefined)
+        return undefined;
+    const tenantRe = /tenant\s*:\s*(["'])([^"'\n]+)\1/y;
+    return scanDepth1(source, start, (i) => {
+        tenantRe.lastIndex = i;
+        return tenantRe.exec(source)?.[2];
+    });
+}
+function matchBlock(source, open) {
+    let depth = 0;
+    for (let i = open; i < source.length; i++) {
+        const ch = source[i];
+        if (ch === '"' || ch === "'" || ch === "`") {
+            i++;
+            while (i < source.length && source[i] !== ch) {
+                if (source[i] === "\\")
+                    i++;
+                i++;
+            }
+        }
+        else if (ch === "{") {
+            depth++;
+        }
+        else if (ch === "}") {
+            depth--;
+            if (depth === 0)
+                return source.slice(open, i + 1);
+        }
+    }
     return undefined;
 }
-export function detectContext(stageArg) {
+function extractExportedConfigSource(cleanedSource) {
+    const start = findExportedConfigStart(cleanedSource);
+    return start === undefined ? undefined : matchBlock(cleanedSource, start);
+}
+function extractPlatformBlock(cleanedSource) {
+    const start = findExportedConfigStart(cleanedSource);
+    if (start === undefined)
+        return undefined;
+    const platformRe = /platform\s*:\s*\{/y;
+    let open;
+    scanDepth1(cleanedSource, start, (i) => {
+        platformRe.lastIndex = i;
+        if (platformRe.exec(cleanedSource)) {
+            open = platformRe.lastIndex - 1;
+            return true;
+        }
+        return undefined;
+    });
+    if (open === undefined)
+        return undefined;
+    return matchBlock(cleanedSource, open);
+}
+function pickStackFile(files, hint, explicitStack) {
+    if (explicitStack !== undefined) {
+        const wanted = `Pulumi.${explicitStack}.yaml`;
+        return { file: files.includes(wanted) ? wanted : undefined, qualified: true };
+    }
+    if (hint) {
+        const wanted = `Pulumi.${hint}.yaml`;
+        if (files.includes(wanted))
+            return { file: wanted, qualified: true };
+    }
+    const stageOf = (f) => f.slice("Pulumi.".length, -".yaml".length);
+    const byBaseFirst = [...files].sort((a, b) => stageOf(a).length - stageOf(b).length || a.localeCompare(b));
+    return { file: byBaseFirst[0], qualified: false };
+}
+function tenantNotDeclared(cwd, found) {
+    const looked = found.stackFile
+        ? `${found.stackFile} in ${cwd} does not declare mesh:tenant`
+        : found.hasProjectFile
+            ? `${cwd} has a Pulumi.yaml but no Pulumi.<stack>.yaml to read mesh:tenant from`
+            : `${cwd} is not a Pulumi project directory (no Pulumi.yaml)`;
+    return new MeshCliError(`No tenant declared: ${looked}, and MESH_TENANT is not set. ` +
+        `There is no default tenant — "mesh" is the live hub and is never assumed. ` +
+        `Run from a directory whose Pulumi.<stack>.yaml declares mesh:tenant, set MESH_TENANT, ` +
+        `or pass --tenant where the command accepts one.`, {
+        remediation: {
+            command: "MESH_TENANT=<tenant> mesh …   # or --tenant <tenant> where accepted, or run from a directory whose Pulumi.<stack>.yaml declares mesh:tenant",
+        },
+    });
+}
+export function detectContext(stageArg, options = {}) {
     let tenant;
     let stage;
     const cwd = process.cwd();
+    const stageHint = stageArg || process.env.MESH_STAGE || process.env.SST_STAGE;
+    let hasProjectFile = false;
+    let stackFile;
+    let stackFilesHere = [];
+    let namedStackMissing = false;
     if (fs.existsSync("Pulumi.yaml")) {
-        const files = fs.readdirSync(".").filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml");
-        const configFile = files[0];
-        if (configFile) {
-            const content = fs.readFileSync(configFile, "utf-8");
-            const tenantMatch = content.match(/^\s*mesh:tenant:\s*["']?([^"'\n]+)["']?/m);
+        hasProjectFile = true;
+        const files = fs
+            .readdirSync(".")
+            .filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml")
+            .sort();
+        const picked = pickStackFile(files, stageHint, options.stack);
+        stackFile = picked.file;
+        namedStackMissing = options.stack !== undefined && picked.file === undefined;
+        stackFilesHere = files;
+        if (!picked.qualified && files.length > 1) {
+            const lengths = files.map((f) => f.length - "Pulumi..yaml".length).sort((a, b) => a - b);
+            if (lengths[0] === lengths[1]) {
+                logWarn(`Several Pulumi stack configs here (${files.join(", ")}); using ${stackFile}. ` +
+                    `Pass --stack to choose one.`);
+            }
+        }
+        if (stackFile) {
+            const content = fs.readFileSync(stackFile, "utf-8");
+            const tenantMatch = content.match(/^\s*mesh:tenant:\s*["']?([^"'#\n]+)["']?/m);
             if (tenantMatch?.[1]) {
                 tenant = tenantMatch[1].trim();
             }
-            const stageMatch = configFile.match(/Pulumi\.(.+)\.yaml/);
+            const stageMatch = stackFile.match(/Pulumi\.(.+)\.yaml/);
             if (stageMatch?.[1]) {
                 stage = stageMatch[1];
             }
         }
     }
-    const sstConfigPath = findFileUpward("sst.config.ts");
+    const sstConfigPath = findFileUpwardInRepo("sst.config.ts");
     let sstDir;
     if (sstConfigPath) {
         sstDir = path.dirname(sstConfigPath);
-        const parentConfigPath = path.join(sstDir, "..", "config.ts");
-        if (fs.existsSync(parentConfigPath)) {
-            const configContent = fs.readFileSync(parentConfigPath, "utf-8");
-            const tenantMatch = configContent.match(/tenant:\s*["']([^"']+)["']/);
-            if (tenantMatch) {
-                tenant = tenantMatch[1];
-            }
-        }
         const sstStagePath = path.join(sstDir, ".sst", "stage");
         if (fs.existsSync(sstStagePath)) {
             stage = fs.readFileSync(sstStagePath, "utf-8").trim();
         }
     }
-    if (!tenant) {
-        const pathMatch = cwd.match(/tenants\/([^/]+)/);
+    const repoRoot = findRepoRoot(cwd);
+    const parentConfigPath = (sstDir
+        ? [path.join(sstDir, "config.ts"), path.join(sstDir, "..", "config.ts")]
+        : hasProjectFile
+            ? [path.resolve(cwd, "..", "config.ts")]
+            : [])
+        .filter((p) => repoRoot !== undefined && !path.relative(repoRoot, p).startsWith(".."))
+        .find((p) => fs.existsSync(p));
+    const parentConfig = parentConfigPath ? fs.readFileSync(parentConfigPath, "utf-8") : undefined;
+    if (parentConfig && !tenant) {
+        tenant = extractConfigTenant(parentConfig);
+    }
+    if (!tenant && repoRoot) {
+        const pathMatch = path.relative(repoRoot, cwd).match(/(?:^|\/)tenants\/([^/]+)/);
         if (pathMatch) {
             tenant = pathMatch[1];
         }
     }
-    stage = stageArg || process.env.MESH_STAGE || process.env.SST_STAGE || stage || "dev";
-    tenant = process.env.MESH_TENANT || tenant || "mesh";
+    if (!tenant) {
+        tenant = findMeshJson(cwd)?.data.tenant;
+    }
+    stage = stageHint || stage || "dev";
+    const detectedTenant = tenant;
+    tenant = options.tenant || process.env.MESH_TENANT || tenant;
+    if (!tenant) {
+        throw tenantNotDeclared(cwd, { stackFile, hasProjectFile });
+    }
+    if (!/^[a-z0-9][a-z0-9-]*$/.test(tenant)) {
+        throw new MeshCliError(`Invalid tenant "${tenant}": expected lowercase alphanumerics and hyphens. ` +
+            `This usually means a config file was misparsed.`, { remediation: { command: "mesh <command> --tenant <tenant>" } });
+    }
+    const overrideSource = options.tenant ? "--tenant" : "MESH_TENANT";
+    const tenantOverridden = detectedTenant !== undefined && detectedTenant !== tenant;
+    if (tenantOverridden) {
+        logWarn(`${overrideSource}=${tenant} overrides the tenant detected here (${detectedTenant}); ` +
+            `paths will use ${tenant} while implicit AWS credentials still come from ` +
+            `the ${detectedTenant} app's deployer role`);
+    }
     let platformEnv = stage;
-    let platformEnvMap = {};
+    const platformEnvMap = Object.create(null);
     let defaultPlatformEnv;
-    const configPath = sstDir ? path.join(sstDir, "..", "config.ts") : "../config.ts";
-    if (fs.existsSync(configPath)) {
-        const configContent = fs.readFileSync(configPath, "utf-8");
-        const mapMatch = configContent.match(/platformEnvMap:\s*\{([^}]+)\}/);
-        if (mapMatch?.[1]) {
-            const entries = mapMatch[1].matchAll(/(\w+):\s*["']([^"']+)["']/g);
+    if (parentConfig) {
+        const cleaned = stripComments(parentConfig);
+        const platformScope = extractPlatformBlock(cleaned);
+        const legacyScope = extractExportedConfigSource(cleaned);
+        const mapSource = (scope, key) => {
+            if (!scope)
+                return undefined;
+            const at = scope.search(new RegExp(`${key}\\s*:\\s*\\{`));
+            if (at === -1)
+                return undefined;
+            return matchBlock(scope, scope.indexOf("{", at));
+        };
+        const mapBody = mapSource(platformScope, "envMap") ?? mapSource(legacyScope, "platformEnvMap");
+        if (mapBody) {
+            const entries = mapBody.matchAll(/(?:"([^"]+)"|'([^']+)'|([\w-]+))\s*:\s*["']([^"']+)["']/g);
             for (const entry of entries) {
-                const key = entry[1];
-                const value = entry[2];
+                const key = entry[1] ?? entry[2] ?? entry[3];
+                const value = entry[4];
                 if (key && value) {
                     platformEnvMap[key] = value;
                 }
             }
         }
-        const defaultMatch = configContent.match(/defaultPlatformEnv:\s*["']([^"']+)["']/);
+        const defaultMatch = platformScope?.match(/defaultEnv:\s*["']([^"']+)["']/) ??
+            legacyScope?.match(/defaultPlatformEnv:\s*["']([^"']+)["']/);
         if (defaultMatch?.[1]) {
             defaultPlatformEnv = defaultMatch[1];
         }
     }
-    const tenantPrefix = `${tenant}-`;
-    const parsedEnv = stage.startsWith(tenantPrefix)
-        ? stage.slice(tenantPrefix.length)
-        : stage;
-    platformEnv = platformEnvMap[parsedEnv] ?? platformEnvMap[stage] ?? defaultPlatformEnv ?? parsedEnv;
+    const tenantPrefix = [detectedTenant, tenant]
+        .filter((t) => Boolean(t))
+        .map((t) => `${t}-`)
+        .sort((a, b) => b.length - a.length)
+        .find((p) => stage.startsWith(p));
+    const parsedEnv = tenantPrefix ? stage.slice(tenantPrefix.length) : stage;
+    const mapApplies = !tenantOverridden;
+    if (tenantOverridden && (Object.keys(platformEnvMap).length > 0 || defaultPlatformEnv)) {
+        logWarn(`${overrideSource}=${tenant} also leaves the ${detectedTenant} config's envMap ` +
+            `unapplied — it maps ${detectedTenant}'s stages, not ${tenant}'s — so the ` +
+            `platform env is the stage itself ("${parsedEnv}"). Pass -e/--env where the ` +
+            `command takes one, or run from the ${tenant} app's own directory.`);
+    }
+    const mapped = mapApplies ? (platformEnvMap[stage] ?? platformEnvMap[parsedEnv]) : undefined;
+    if (mapped) {
+        platformEnv = mapped;
+    }
+    else if (mapApplies && defaultPlatformEnv) {
+        if (namedStackMissing) {
+            const known = [
+                ...stackFilesHere.map((f) => f.slice("Pulumi.".length, -".yaml".length)),
+                ...Object.keys(platformEnvMap),
+            ].filter((v, i, a) => a.indexOf(v) === i);
+            throw new MeshCliError(`No such stack "${options.stack}": ${cwd} has no Pulumi.${options.stack}.yaml, ` +
+                `and the app's config.ts does not map it to a platform env — it would ` +
+                `address defaultEnv "${defaultPlatformEnv}", not the stack you asked for.`, {
+                remediation: {
+                    command: `mesh <command> --stack <${known.join("|") || "stack"}>`,
+                },
+            });
+        }
+        platformEnv = defaultPlatformEnv;
+        if (Object.keys(platformEnvMap).length > 0) {
+            logWarn(`Stage "${stage}" is not in the config's envMap ` +
+                `(${Object.keys(platformEnvMap).join(", ")}); using defaultEnv ` +
+                `"${defaultPlatformEnv}".`);
+        }
+    }
+    else {
+        platformEnv = parsedEnv;
+    }
     logInfo(`Stage: ${stage}, Platform: ${platformEnv}, Tenant: ${tenant}`);
-    return { tenant, stage, platformEnv };
+    return { tenant, stage, platformEnv, detectedTenant };
 }

package/dist/src/utils/registry-identity.d.ts

@@ -45,6 +45,11 @@ export declare function ensureRegistrySession(opts: {
     interactive: boolean;
 }): Promise<RegistrySessionResult>;
 export declare function registryTokenRoles(idToken: string | null | undefined): string[];
+export interface RegistryAccountState {
+    email?: string;
+    emailVerified?: boolean;
+}
+export declare function registryAccountState(idToken: string | null | undefined): RegistryAccountState;
 export interface RegistryRemint {
     reminted: boolean;
     rolesChanged: boolean;

package/dist/src/utils/registry-identity.js

@@ -138,6 +138,22 @@ export function registryTokenRoles(idToken) {
         return [];
     }
 }
+export function registryAccountState(idToken) {
+    if (!idToken)
+        return {};
+    let claims = null;
+    try {
+        claims = decodeJwtPayload(idToken);
+    }
+    catch {
+        return {};
+    }
+    if (!claims)
+        return {};
+    const email = typeof claims.email === "string" ? claims.email : undefined;
+    const verified = claims.email_verified;
+    return { email, emailVerified: typeof verified === "boolean" ? verified : undefined };
+}
 export async function refreshRegistrySession(context) {
     const before = registryTokenRoles(readCredentials(context)?.idToken);
     const idToken = await forceRefreshToken(context);

package/fragments/agents/AGENTS.md.hbs

@@ -27,8 +27,16 @@ readers the app's `docs` role admits. A site declared on a
 `mesh.apps.VendorApiSurface` (a third-party core's raw reference) is read
 through the same door by holders of the Hub's `vendor-docs` add-on only —
 never by a partner — and declaring `audience: { roles: [] }` on one fails
-the deploy. `mesh app check` flags a docs site put on an ingress
-(`DOCS_SITE_PUBLIC`). Keep the spec in step with the routes in
+the deploy. Add `actAs: true` on an app surface to let Hub operators execute
+requests against the deployed API as one of the app's API keys from the Docs
+tab (the Hub's act-as playground) — the surface then verifies the Hub's
+signed assertion and runs the request as the key. `mesh app check` flags a
+docs site put on an ingress (`DOCS_SITE_PUBLIC`). A vendor surface's site is
+built from the enabled-ops cut of the core's spec, not the whole document, and
+a spec over 1 MiB is split into per-entity variants at build time
+(`docs.split: { above }` moves the threshold, `false` turns it off) — an app's
+own spec is already the shape it serves and gets neither. Keep the spec in
+step with the routes in
 `api/src/index.ts` — the site renders what the file says. Keep pages `.md`,
 not `.mdx`: a site an API surface declares is served by the Hub under its own
 origin, which carries data and never code, so an `.mdx` page fails that

package/fragments/base/index.ts.hbs

@@ -75,10 +75,10 @@ const api = new mesh.apps.Service("api", {
     env.temporal!.link({ environmentPrefix: "TEMPORAL", taskQueue: TASK_QUEUE }),
 {{/if}}
   ],
-  ingress: env.buildIngress({
-    subdomain: "{{name}}",
-    healthCheckPath: "/health",
-  }),
+  ingress: env.buildIngress({ subdomain: "{{name}}" }),
+  // Drives readiness, liveness and the Hub uptime sampler on BOTH ingress kinds.
+  // `ingress.healthCheckPath` sets the ALB target group's path only, and a
+  // gateway (HTTPRoute) tenant has no target group — so the path belongs here.
   healthCheck: "/health",
   replicas: deploy ? 2 : 1,
   resources: { cpu: "100m", memory: "128Mi" },
@@ -113,7 +113,17 @@ const worker = new mesh.apps.TemporalWorker("worker", {
 // it from Access → People; that same role is what the Hub reads when a
 // partner holding the Hub's `docs:<tenant>` role opens this app's Docs tab,
 // and the app then appears in their Apps list. `mesh app check` flags a docs
-// site put on an ingress instead (`DOCS_SITE_PUBLIC`).
+// site put on an ingress instead (`DOCS_SITE_PUBLIC`). Declaring `actAs: true`
+// on that same surface opens the Hub's act-as playground: an operator picks
+// one of this app's API keys on the Docs tab and the Hub executes the request
+// against the deployed API as that key, over the cluster network, with a
+// signed assertion the surface verifies — the Hub never holds the key's secret.
+// Whichever of those the surface declares, the platform bounds them at the
+// workload: each workload it publishes an in-cluster address for allows the
+// Hub on the ports it published and refuses it on every other one, so a
+// registry entry cannot walk the Hub onto a port the surface never opened.
+// Nothing here declares that — it rides the surface (`hubDialPolicy`, on by
+// default wherever the namespace is in the service mesh).
 // =============================================================================
 
 new mesh.apps.ApiDocs("docs", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mesh-tech/mesh-cli",
-  "version": "0.25.0",
+  "version": "0.26.0",
   "description": "CLI for Mesh platform development utilities",
   "type": "module",
   "license": "UNLICENSED",
@@ -42,7 +42,7 @@
   },
   "devDependencies": {
     "@mesh-tech/agent-contracts": "0.2.0",
-    "@mesh-tech/tsconfig": "2.14.0",
+    "@mesh-tech/tsconfig": "2.16.0",
     "@mesh-tech/workflow-viz": "0.3.0",
     "@tanstack/intent": "^0.3.6",
     "@types/node": "^20.0.0",