@mesh-tech/mesh-cli 0.28.0 → 0.30.0

package/dist/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "dd1a85628",
-  "builtAt": "2026-09-17T22:16:24.040Z"
+  "commit": "a5fdbfed6",
+  "builtAt": "2026-09-18T19:56:52.850Z"
 }

package/dist/src/commands/app-check-resolve.d.ts

@@ -0,0 +1,28 @@
+export interface ProbeResult {
+    findings: UnresolvedImport[];
+    unchecked: string | null;
+}
+export interface UnresolvedImport {
+    pkg: string;
+    specifier: string;
+    file: string;
+    importer: string;
+    via: string[];
+    fix: string;
+}
+export declare function stripComments(source: string): string;
+export declare function moduleSpecifiers(source: string): string[];
+export declare function splitSpecifier(specifier: string): {
+    pkg: string;
+    sub: string;
+} | null;
+export declare function findPackageDir(fromDir: string, pkg: string): string | null;
+export declare function resolveSubpath(pkgDir: string, sub: string): string | null;
+export declare function programEntry(appDir: string): string | null;
+export declare function dependenciesInstalled(dir: string, stopAt?: string): boolean;
+export interface ProbeOptions {
+    entry?: string;
+    label?: string;
+    root?: string;
+}
+export declare function resolveProgramImports(appDir: string, options?: ProbeOptions): ProbeResult;

package/dist/src/commands/app-check-resolve.js

@@ -0,0 +1,276 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { builtinModules } from "node:module";
+import { parse as parseYaml } from "yaml";
+const CONDITIONS = new Set(["source", "node", "import", "require", "module", "module-sync", "default"]);
+const EXTENSIONS = ["", ".ts", ".tsx", ".js", ".mjs", ".cjs", "/index.ts", "/index.js", "/index.mjs"];
+const SCOPE = "@mesh-tech/";
+const FILE_BUDGET = 1500;
+const BUILTINS = new Set(builtinModules);
+export function stripComments(source) {
+    return source.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:"'`\\])\/\/[^\n]*/g, "$1");
+}
+export function moduleSpecifiers(source) {
+    const text = stripComments(source);
+    const out = [];
+    for (const m of text.matchAll(/(?<![.\w$])(?:import|export)\b([^;]*?)\bfrom\s*["']([^"']+)["']/g)) {
+        if (/^\s*type\s/.test(m[1] ?? ""))
+            continue;
+        out.push(m[2] ?? "");
+    }
+    for (const m of text.matchAll(/(?<![.\w$])import\s*["']([^"']+)["']/g))
+        out.push(m[1] ?? "");
+    for (const m of text.matchAll(/(?<![.\w$])import\s*\(\s*["']([^"']+)["']\s*\)/g))
+        out.push(m[1] ?? "");
+    for (const m of text.matchAll(/(?<![.\w$])require\s*\(\s*["']([^"']+)["']\s*\)/g))
+        out.push(m[1] ?? "");
+    return [...new Set(out)].filter(Boolean);
+}
+export function splitSpecifier(specifier) {
+    if (!specifier || specifier.startsWith(".") || specifier.startsWith("/") || specifier.startsWith("#"))
+        return null;
+    if (specifier.includes(":"))
+        return null;
+    if (BUILTINS.has(specifier))
+        return null;
+    const parts = specifier.split("/");
+    const depth = specifier.startsWith("@") ? 2 : 1;
+    if (parts.length < depth || parts.some((p) => p === ""))
+        return null;
+    const pkg = parts.slice(0, depth).join("/");
+    const rest = parts.slice(depth);
+    return { pkg, sub: rest.length > 0 ? `./${rest.join("/")}` : "." };
+}
+export function findPackageDir(fromDir, pkg) {
+    let dir = path.resolve(fromDir);
+    for (;;) {
+        const candidate = path.join(dir, "node_modules", ...pkg.split("/"));
+        if (fs.existsSync(path.join(candidate, "package.json"))) {
+            try {
+                return fs.realpathSync(candidate);
+            }
+            catch {
+                return candidate;
+            }
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+function conditionTargets(node, acc = []) {
+    if (typeof node === "string") {
+        acc.push(node);
+        return acc;
+    }
+    if (Array.isArray(node)) {
+        for (const entry of node)
+            conditionTargets(entry, acc);
+        return acc;
+    }
+    if (!node || typeof node !== "object")
+        return acc;
+    for (const [key, value] of Object.entries(node)) {
+        if (!CONDITIONS.has(key))
+            continue;
+        conditionTargets(value, acc);
+    }
+    return acc;
+}
+function exportTargets(exportsField, sub) {
+    if (typeof exportsField === "string")
+        return sub === "." ? [exportsField] : [];
+    if (Array.isArray(exportsField))
+        return exportsField.flatMap((entry) => exportTargets(entry, sub));
+    if (!exportsField || typeof exportsField !== "object")
+        return [];
+    const map = exportsField;
+    const keys = Object.keys(map);
+    if (keys.length > 0 && !keys.some((k) => k.startsWith(".")))
+        return sub === "." ? conditionTargets(map) : [];
+    if (sub in map)
+        return conditionTargets(map[sub]);
+    let best = [];
+    let bestPrefix = -1;
+    for (const key of keys) {
+        const star = key.indexOf("*");
+        if (star === -1)
+            continue;
+        const prefix = key.slice(0, star);
+        const suffix = key.slice(star + 1);
+        if (sub.length < prefix.length + suffix.length)
+            continue;
+        if (!sub.startsWith(prefix) || !sub.endsWith(suffix))
+            continue;
+        if (prefix.length <= bestPrefix)
+            continue;
+        const segment = sub.slice(prefix.length, sub.length - suffix.length);
+        bestPrefix = prefix.length;
+        best = conditionTargets(map[key]).map((target) => target.replaceAll("*", segment));
+    }
+    return best;
+}
+function isDirectory(p) {
+    try {
+        return fs.statSync(p).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function firstFile(base) {
+    for (const ext of EXTENSIONS) {
+        const candidate = base + ext;
+        try {
+            if (fs.statSync(candidate).isFile())
+                return candidate;
+        }
+        catch {
+        }
+    }
+    return null;
+}
+export function resolveSubpath(pkgDir, sub) {
+    let manifest = {};
+    try {
+        manifest = JSON.parse(fs.readFileSync(path.join(pkgDir, "package.json"), "utf8"));
+    }
+    catch {
+        return null;
+    }
+    if (manifest.exports !== undefined) {
+        for (const target of exportTargets(manifest.exports, sub)) {
+            const file = firstFile(path.resolve(pkgDir, target));
+            if (file)
+                return file;
+        }
+        return null;
+    }
+    if (sub === ".")
+        return firstFile(path.resolve(pkgDir, manifest.main ?? "index.js"));
+    return firstFile(path.resolve(pkgDir, sub));
+}
+export function programEntry(appDir) {
+    const app = path.resolve(appDir);
+    const index = path.join(app, "index.ts");
+    if (fs.existsSync(index))
+        return index;
+    let main;
+    try {
+        main = parseYaml(fs.readFileSync(path.join(app, "Pulumi.yaml"), "utf8"))?.main;
+    }
+    catch {
+        return null;
+    }
+    if (typeof main !== "string" || !main)
+        return null;
+    const target = path.resolve(app, main);
+    return isDirectory(target) ? firstFile(path.join(target, "index")) : firstFile(target);
+}
+export function dependenciesInstalled(dir, stopAt) {
+    const root = stopAt === undefined ? null : path.resolve(stopAt);
+    let at = path.resolve(dir);
+    for (;;) {
+        if (fs.existsSync(path.join(at, "node_modules")))
+            return true;
+        if (at === root)
+            return false;
+        const parent = path.dirname(at);
+        if (parent === at)
+            return false;
+        at = parent;
+    }
+}
+function suggestedRange(appDir, parentDir) {
+    try {
+        const manifest = JSON.parse(fs.readFileSync(path.join(appDir, "package.json"), "utf8"));
+        for (const section of [manifest.dependencies, manifest.devDependencies]) {
+            for (const [name, range] of Object.entries(section ?? {})) {
+                if (name.startsWith(SCOPE) && range)
+                    return range;
+            }
+        }
+    }
+    catch {
+    }
+    if (!parentDir)
+        return null;
+    try {
+        const version = JSON.parse(fs.readFileSync(path.join(parentDir, "package.json"), "utf8")).version;
+        return version ? `^${version}` : null;
+    }
+    catch {
+        return null;
+    }
+}
+function displayPath(app, visit) {
+    const within = path.relative(visit.pkg === null ? app : visit.pkgDir, visit.file).split(path.sep).join("/");
+    return visit.pkg === null ? within : `${visit.pkg}/${within}`;
+}
+export function resolveProgramImports(appDir, options = {}) {
+    const app = path.resolve(appDir);
+    const label = options.label ?? path.basename(app);
+    const entryFile = options.entry ? firstFile(path.resolve(app, options.entry)) : programEntry(app);
+    if (!dependenciesInstalled(app, options.root)) {
+        return { findings: [], unchecked: "dependencies are not installed (run the install, then re-run)" };
+    }
+    if (!entryFile) {
+        return { findings: [], unchecked: "no Pulumi program found (index.ts, or the file Pulumi.yaml's `main` names)" };
+    }
+    const findings = [];
+    const reported = new Set();
+    const seen = new Set([entryFile]);
+    const queue = [{ file: entryFile, pkgDir: app, pkg: null, via: [] }];
+    let budget = FILE_BUDGET;
+    while (queue.length > 0 && budget-- > 0) {
+        const here = queue.shift();
+        let source;
+        try {
+            source = fs.readFileSync(here.file, "utf8");
+        }
+        catch {
+            continue;
+        }
+        const fromDir = path.dirname(here.file);
+        for (const specifier of moduleSpecifiers(source)) {
+            if (specifier.startsWith(".")) {
+                if (here.pkg === null)
+                    continue;
+                const next = firstFile(path.resolve(fromDir, specifier));
+                if (next && !seen.has(next) && next.startsWith(here.pkgDir)) {
+                    seen.add(next);
+                    queue.push({ ...here, file: next });
+                }
+                continue;
+            }
+            const split = splitSpecifier(specifier);
+            if (!split)
+                continue;
+            const inScope = split.pkg.startsWith(SCOPE);
+            if (here.pkg !== null && !inScope)
+                continue;
+            const pkgDir = findPackageDir(fromDir, split.pkg);
+            const target = pkgDir ? resolveSubpath(pkgDir, split.sub) : null;
+            if (!pkgDir || !target) {
+                if (reported.has(specifier))
+                    continue;
+                reported.add(specifier);
+                const range = inScope ? suggestedRange(app, here.pkg === null ? null : here.pkgDir) : null;
+                const line = `"${split.pkg}": "${range ?? (inScope ? "<the version your other @mesh-tech packages use>" : "<the version you need>")}"`;
+                const fix = pkgDir
+                    ? `${split.pkg} is installed but ships no ${split.sub} — the installed version predates the subpath; raise ${line} in ${label}/package.json`
+                    : `add ${line} to ${label}/package.json dependencies`;
+                findings.push({ pkg: split.pkg, specifier, file: here.file, importer: displayPath(app, here), via: here.via, fix });
+                continue;
+            }
+            if (!inScope || seen.has(target))
+                continue;
+            seen.add(target);
+            queue.push({ file: target, pkgDir, pkg: split.pkg, via: [...here.via, specifier] });
+        }
+    }
+    findings.sort((a, b) => a.pkg.localeCompare(b.pkg) || a.specifier.localeCompare(b.specifier));
+    const unchecked = queue.length > 0 ? `the import graph exceeded ${FILE_BUDGET} files` : null;
+    return { findings, unchecked };
+}

package/dist/src/commands/app-check.d.ts

@@ -1,6 +1,7 @@
 import { Command } from "commander";
+import { type ProbeResult } from "./app-check-resolve.js";
 import { jsonReport, type Check, type CheckResult, type CheckStatus } from "./dev-doctor.js";
-export type AppCheckCode = "UI_IN_API" | "NO_UI_SERVICE" | "NO_REGISTER" | "CUSTOM_SESSION_AUTH" | "NON_PLATFORM_LOGGER" | "LOCAL_AUTH_LIB" | "NO_AUTHZ_POINTER" | "METADATA_UNPUBLISHED" | "IAC_GRANTS" | "POINTER_PROJECT_OVERRIDE" | "PASSWORD_STORE" | "EMAIL_ALLOWLIST" | "USERS_TABLE" | "DOCS_SITE_PUBLIC" | "DOCS_AUDIENCE_IMPLICIT" | "DOCS_AUDIENCE_UNGRANTABLE" | "DOCS_VENDOR_AUDIENCE_PARTNER";
+export type AppCheckCode = "UNRESOLVABLE_IMPORT" | "UI_IN_API" | "NO_UI_SERVICE" | "NO_REGISTER" | "CUSTOM_SESSION_AUTH" | "NON_PLATFORM_LOGGER" | "LOCAL_AUTH_LIB" | "NO_AUTHZ_POINTER" | "METADATA_UNPUBLISHED" | "IAC_GRANTS" | "POINTER_PROJECT_OVERRIDE" | "PASSWORD_STORE" | "EMAIL_ALLOWLIST" | "USERS_TABLE" | "DOCS_SITE_PUBLIC" | "DOCS_AUDIENCE_IMPLICIT" | "DOCS_AUDIENCE_UNGRANTABLE" | "DOCS_VENDOR_AUDIENCE_PARTNER";
 export interface AppCheckRule {
     gate: string;
     title: string;
@@ -35,14 +36,16 @@ export declare function docsSiteFindings(text: string): Array<{
 }>;
 export declare function statedKind(decl: Pick<SurfaceDeclaration, "ctor">, args: Map<string, string>): string | undefined;
 export declare function listApps(root: string): string[];
-export declare function scanApp(root: string, appRel: string): Finding[];
+export declare function probeResolution(root: string, appRel: string): ProbeResult;
+export declare function scanApp(root: string, appRel: string, resolution?: ProbeResult): Finding[];
 export declare function scanRepo(root: string): Finding[];
 export interface AppCheckContext {
     root: string;
     app: string | null;
     findings: Finding[];
+    unchecked: string | null;
 }
-export declare function resultFor(code: AppCheckCode, findings: Finding[]): CheckResult;
+export declare function resultFor(code: AppCheckCode, findings: Finding[], unchecked?: string | null): CheckResult;
 export declare function appContractChecks(scope: "app" | "repo"): Check<AppCheckContext>[];
 export interface AppCheckReport {
     root: string;

package/dist/src/commands/app-check.js

@@ -3,8 +3,17 @@ import * as path from "node:path";
 import { logError, logInfo } from "../utils/index.js";
 import { MeshCliError, emitJsonPayload } from "../utils/errors.js";
 import { resolveTargetRoot } from "./skills.js";
+import { programEntry, resolveProgramImports } from "./app-check-resolve.js";
 import { ICONS, aggregateStatus, jsonReport, renderHuman, runChecks, } from "./dev-doctor.js";
 export const APP_CHECK_RULES = {
+    UNRESOLVABLE_IMPORT: {
+        gate: "0.6",
+        title: "The Pulumi program's imports resolve",
+        severity: "block",
+        remediation: "declare the package in apps/<app>/package.json dependencies, at the range the app's other @mesh-tech/* packages use, and re-install — " +
+            "an optional peer that nothing names installs silently and fails at `mesh deploy`",
+        scope: "app",
+    },
     UI_IN_API: {
         gate: "0.1",
         title: "UI is its own service",
@@ -610,7 +619,10 @@ export function listApps(root) {
         apps.push(".");
     return apps;
 }
-export function scanApp(root, appRel) {
+export function probeResolution(root, appRel) {
+    return resolveProgramImports(path.resolve(root, appRel), { root, label: appRel === "." ? "this app" : appRel });
+}
+export function scanApp(root, appRel, resolution = probeResolution(root, appRel)) {
     const app = path.resolve(root, appRel);
     const index = path.join(app, "index.ts");
     const findings = [];
@@ -620,6 +632,12 @@ export function scanApp(root, appRel) {
     const hasProgram = fs.existsSync(index) || fs.existsSync(path.join(app, "Pulumi.yaml"));
     if (!hasProgram)
         return findings;
+    const entry = programEntry(app);
+    for (const bad of resolution.findings) {
+        const chain = [...bad.via, bad.specifier].join(" → ");
+        const at = rel(root, entry ?? index);
+        hit("UNRESOLVABLE_IMPORT", at, `${chain} does not resolve from this app (imported by ${bad.importer}) — ${bad.fix}`);
+    }
     if (fs.existsSync(index)) {
         const indexRel = rel(root, index);
         let servesHtml = false;
@@ -728,9 +746,12 @@ export function scanRepo(root) {
     }
     return findings;
 }
-export function resultFor(code, findings) {
+export function resultFor(code, findings, unchecked = null) {
     const rule = APP_CHECK_RULES[code];
     const mine = findings.filter((f) => f.code === code);
+    if (code === "UNRESOLVABLE_IMPORT" && unchecked) {
+        return { status: "ok", summary: `gate ${rule.gate}: not checked — ${unchecked}` };
+    }
     if (mine.length === 0)
         return { status: "ok", summary: `gate ${rule.gate}: no ${code} finding` };
     return {
@@ -745,7 +766,7 @@ export function appContractChecks(scope) {
         id: code,
         title: `${APP_CHECK_RULES[code].title} (${APP_CHECK_RULES[code].gate})`,
         phases: ["ondemand", "preflight"],
-        run: async (ctx) => resultFor(code, ctx.findings),
+        run: async (ctx) => resultFor(code, ctx.findings, ctx.unchecked),
     }));
 }
 export async function runAppCheck(root, apps) {
@@ -758,10 +779,12 @@ export async function runAppCheck(root, apps) {
     }
     const scopes = [];
     for (const app of targets) {
-        const results = await runChecks({ root, app, findings: scanApp(root, app) }, "ondemand", appContractChecks("app"));
+        const resolution = probeResolution(root, app);
+        const ctx = { root, app, findings: scanApp(root, app, resolution), unchecked: resolution.unchecked };
+        const results = await runChecks(ctx, "ondemand", appContractChecks("app"));
         scopes.push({ scope: app, ...jsonReport(results) });
     }
-    const repoResults = await runChecks({ root, app: null, findings: scanRepo(root) }, "ondemand", appContractChecks("repo"));
+    const repoResults = await runChecks({ root, app: null, findings: scanRepo(root), unchecked: null }, "ondemand", appContractChecks("repo"));
     scopes.push({ scope: "(repo)", ...jsonReport(repoResults) });
     return { root, status: aggregateStatus(scopes.map((s) => ({ status: s.status, summary: "" }))), scopes };
 }
@@ -787,7 +810,7 @@ export function registerAppCommands(program) {
     const app = program.command("app").description("Inspect a tenant app against the Mesh app contract");
     app
         .command("check")
-        .description("Check tenant apps against the Mesh app contract (@mesh-tech/app-kit skills/apps/references/app-contract.md): a UI is its own service, the app registers with the Hub, sign-in goes through the platform proxy, logs go through @mesh-tech/logger, and people/roles/keys are surfaced through the Hub. Exit 1 on any blocking finding — the same gate mesh create-app, tenant CI and the platform reviewer run.")
+        .description("Check tenant apps against the Mesh app contract (@mesh-tech/app-kit skills/apps/references/app-contract.md): a UI is its own service, the app registers with the Hub, sign-in goes through the platform proxy, logs go through @mesh-tech/logger, people/roles/keys are surfaced through the Hub, and the Pulumi program's imports resolve from the app directory. Exit 1 on any blocking finding — the same gate mesh create-app, tenant CI and the platform reviewer run. The import gate reads the installed dependency tree, so run it after the install; with no node_modules it reports itself not checked rather than met.")
         .argument("[apps...]", "repo-relative app dirs to check (default: every apps/* with a Pulumi program)")
         .option("--root <dir>", "checkout to scan (default: the enclosing git root)")
         .option("--json", "machine-readable output (one report per app plus the repo-scoped checks)", false)

package/dist/src/commands/login.d.ts

@@ -3,6 +3,7 @@ import { type AwsIdentity } from "../utils/aws-auth.js";
 declare const CONFIG_DIR: string;
 declare const CONFIG_FILE: string;
 declare const CREDENTIALS_FILE: string;
+export declare function loginScopes(config: Pick<ContextConfig, "hubProjectId">): string;
 interface ContextConfig {
     issuer: string;
     clientId: string;
@@ -12,7 +13,9 @@ interface ContextConfig {
     vpn?: string;
     vpnJoinBroker?: string;
     registryBroker?: string;
+    hubProjectId?: string;
 }
+export declare function withDiscoveredFields(config: ContextConfig, data: Record<string, unknown>): ContextConfig;
 interface CachedCredentials {
     idToken: string;
     accessToken: string;
@@ -46,6 +49,7 @@ export declare function renderAwsFallbackStatus(context: string, reason: string,
     lines: StatusLine[];
     exitCode: 0 | 1;
 };
+export declare function tokenAudience(payload: Record<string, unknown>): string[];
 export declare function registerLoginCommand(program: Command): void;
 export declare const RESERVED_REGISTRY_CONTEXT = "registry";
 export declare const NO_REGISTRY_DEPRECATED = "--no-registry is deprecated and ignored: mesh login no longer touches the registry.";
@@ -107,6 +111,10 @@ export declare function ensureLogin(context: string, opts?: {
     device?: boolean;
     interactive?: boolean;
 }): Promise<CachedCredentials | null>;
+export declare function adoptPublishedHubProject(context: string, config: ContextConfig, discover?: (context: string, opts: {
+    quiet: true;
+    silent: true;
+}) => Promise<ContextConfig | null>, write?: (context: string, config: ContextConfig) => void): Promise<ContextConfig>;
 export { CONFIG_DIR, CONFIG_FILE, CREDENTIALS_FILE };
 export type { ContextConfig, CachedCredentials, CredentialsFile };
 export declare function readAllContextConfigs(): ConfigFile;