@mesh-tech/mesh-cli 0.33.0 → 0.34.1

package/README.md

@@ -92,8 +92,9 @@ It writes a tenant **platform** repo (the core + platform Pulumi layers on
 `@mesh-tech/infra-components`) that deploys with `mesh deploy` unmodified, asks
 for the per-install values, offers to create the Pulumi state bucket, and prints
 the deploy sequence — including the one manual step in the middle: **delegating
-the NS records** of the new public zone, without which the deploy stalls on its
-ACM certificate.
+the NS records** of the new public zone. The deploy stops at the mesh-gateway
+Ingress until ACM issues the wildcard certificate, which it does on its own once
+that delegation resolves.
 
 The platform layer builds service images with Docker by default, so it needs a
 working Docker daemon; the core layer does not. On a machine without Docker (a

package/dist/bin/mesh.js

@@ -1110,6 +1110,17 @@ var init_seed = __esm({
   }
 });
 
+// libs/mesh-cli/src/utils/aws-errors.ts
+function isAwsErrorCode(err, code) {
+  const e = err;
+  return e?.name === code || e?.__type === code || e?.Code === code || e?.code === code || typeof e?.message === "string" && e.message.includes(code);
+}
+var init_aws_errors = __esm({
+  "libs/mesh-cli/src/utils/aws-errors.ts"() {
+    "use strict";
+  }
+});
+
 // libs/mesh-cli/src/commands/local/helpers.ts
 import * as net from "net";
 import { execFileSync as execFileSync3 } from "child_process";
@@ -1120,7 +1131,7 @@ async function upsertLocalSecret(secretId, value, client) {
   try {
     await sm.send(new CreateSecretCommand4({ Name: secretId, SecretString: secretString }));
   } catch (err) {
-    if (err?.name === "ResourceExistsException") {
+    if (isAwsErrorCode(err, "ResourceExistsException")) {
       await sm.send(new PutSecretValueCommand4({ SecretId: secretId, SecretString: secretString }));
     } else {
       throw err;
@@ -1202,6 +1213,7 @@ var init_helpers = __esm({
   "libs/mesh-cli/src/commands/local/helpers.ts"() {
     "use strict";
     init_seed();
+    init_aws_errors();
     defaultPortConflictIo = {
       dockerPs: () => {
         try {
@@ -10442,7 +10454,9 @@ function registerDevCommand(program2) {
               { remediation: { command: `docker compose -f ${decl.compose} up  # debug it directly` } }
             );
           }
-          logWarn(`External '${name}' credential seeding failed: ${err instanceof Error ? err.message : err}`);
+          logWarn(
+            `External '${name}' credential seeding failed: ${err instanceof Error ? err.message : err} \u2014 the app will resolve whatever was seeded previously, which may point at a stale port.`
+          );
         }
       }
       if (dockerRunner) {
@@ -17521,7 +17535,7 @@ function validateDomain(value) {
     return "a public domain you control, e.g. q2poc.pub";
   }
   if (/(^|\.)(example\.(com|org|net)|invalid|localhost|test)$/.test(domain)) {
-    return `${domain} is a placeholder \u2014 the deploy stalls on an ACM certificate for a zone nobody can delegate. Use a domain you control.`;
+    return `${domain} is a placeholder \u2014 its ACM certificate can never validate, because nobody can delegate that zone to you. Use a domain you control.`;
   }
   return true;
 }
@@ -17633,7 +17647,7 @@ function renderPlatformNextSteps(setup, opts = {}) {
     `aws sso login --profile ${setup.profile}   # if this profile is SSO`,
     exportCredentialsCommand(setup.profile),
     `cd core && mesh deploy up        # the VPC, EKS, RDS and the public zone ${setup.env}.${setup.domain}`,
-    `# \u2192 then delegate the NS records of ${setup.env}.${setup.domain} from ${setup.domain}; the deploy waits on the ACM certificate until you do`,
+    `# \u2192 then delegate the NS records of ${setup.env}.${setup.domain} from ${setup.domain} at your registrar; the deploy stops at the mesh-gateway Ingress until ACM issues the certificate, then continues`,
     "cd ../platform && mesh deploy up  # Temporal, Zitadel, the Hub  (needs Docker \u2014 it builds service images)",
     `mesh login ${setup.tenant}.${setup.env}      # your platform sign-in, once it is up`,
     "",
@@ -17675,7 +17689,7 @@ var init_platform_setup = __esm({
       region: "us-east-2",
       profile: "default"
     };
-    DOMAIN_REQUIRED_MESSAGE = "--domain is required: the core stack creates the public Route 53 zone <env>.<domain>, and a placeholder domain scaffolds a zone that can never validate (the deploy stalls on the ACM certificate).";
+    DOMAIN_REQUIRED_MESSAGE = "--domain is required: the core stack creates the public Route 53 zone <env>.<domain>, and a placeholder domain scaffolds a zone whose certificate can never validate, so ingress never serves HTTPS.";
     realStateBucketDeps = {
       headBucket(setup) {
         try {
@@ -19182,7 +19196,7 @@ function registerInitCommands(program2) {
   ).option("--tenant <name>", "app tenant this repo belongs to (prompted when omitted on a TTY)").option("--local", "local only \u2014 mesh start / mesh dev, no deployed platform (the default)").option("--platform <env>", "a deployed platform's environment; signs in to `<tenant>.<env>`").option(
     "--new-platform [env]",
     `nothing deployed yet \u2014 scaffold a tenant platform repo for \`<tenant>.<env>\` (default env: ${PLATFORM_SETUP_DEFAULTS.env}) and print its deploy sequence`
-  ).option("--region <region>", `--new-platform: AWS region (default: ${PLATFORM_SETUP_DEFAULTS.region})`).option("--domain <domain>", "--new-platform: base public domain you control; the core stack creates the zone {env}.{domain}. No default \u2014 a placeholder scaffolds a zone that can never validate").option("--state-bucket <bucket>", "--new-platform: Pulumi state S3 bucket (default: {tenant}-mesh-platform-pulumi-state)").option("--create-state-bucket", "--new-platform: create the state bucket (versioned) if it does not exist").option("--no-create-state-bucket", "--new-platform: never create the state bucket; print the aws command instead").option("--dir <path>", "--new-platform: where to scaffold the platform repo (default: ./{tenant}-mesh-platform)").option("--device", "device-code sign-in for the registry and platform steps (headless / SSH)").option("--profile <aws-profile>", "AWS profile this machine uses: read the registry without the broker (deployers only), and the profile a --new-platform stack config references").option("--skip-repo", "do not bootstrap, check or record anything in the current repo", false).option("--yes", "accept every default and never prompt", false).option("--json", "one JSON document on stdout ({tenant, mode, steps, next}); human output on stderr", false).action(
+  ).option("--region <region>", `--new-platform: AWS region (default: ${PLATFORM_SETUP_DEFAULTS.region})`).option("--domain <domain>", "--new-platform: base public domain you control; the core stack creates the zone {env}.{domain} and stops at the mesh-gateway Ingress until you delegate its NS records. No default \u2014 a placeholder scaffolds a zone that can never validate").option("--state-bucket <bucket>", "--new-platform: Pulumi state S3 bucket (default: {tenant}-mesh-platform-pulumi-state)").option("--create-state-bucket", "--new-platform: create the state bucket (versioned) if it does not exist").option("--no-create-state-bucket", "--new-platform: never create the state bucket; print the aws command instead").option("--dir <path>", "--new-platform: where to scaffold the platform repo (default: ./{tenant}-mesh-platform)").option("--device", "device-code sign-in for the registry and platform steps (headless / SSH)").option("--profile <aws-profile>", "AWS profile this machine uses: read the registry without the broker (deployers only), and the profile a --new-platform stack config references").option("--skip-repo", "do not bootstrap, check or record anything in the current repo", false).option("--yes", "accept every default and never prompt", false).option("--json", "one JSON document on stdout ({tenant, mode, steps, next}); human output on stderr", false).action(
     async (opts) => {
       const { runInitWizard: runInitWizard2 } = await Promise.resolve().then(() => (init_wizard(), wizard_exports));
       const code = await runInitWizard2(opts);
@@ -19193,7 +19207,7 @@ function registerInitCommands(program2) {
     "Scaffold a tenant PLATFORM repo (core + platform Pulumi layers on @mesh-tech/infra-components) that deploys with `mesh deploy` unmodified \u2014 the proven mesh-sandbox shape, annotated. On a terminal it ASKS for the values that differ per install (env, region, domain, state bucket, AWS profile), each pre-filled with its default; every answer is also a flag."
   ).option("--env <env>", `environment the first stack targets (default: ${PLATFORM_SETUP_DEFAULTS.env})`).option("--region <region>", `AWS region (default: ${PLATFORM_SETUP_DEFAULTS.region})`).option(
     "--domain <domain>",
-    "base public domain you control \u2014 the core stack creates the Route 53 zone {env}.{domain} and waits on its NS delegation. Required: it has no default, because a placeholder scaffolds a zone that can never validate"
+    "base public domain you control \u2014 the core stack creates the Route 53 zone {env}.{domain}, whose NS records you then delegate at your registrar; the deploy stops at the mesh-gateway Ingress until that lets ACM issue the certificate. Required: it has no default, because a placeholder scaffolds a zone nobody can delegate to you"
   ).option("--profile <profile>", `AWS profile the stack config references (default: ${PLATFORM_SETUP_DEFAULTS.profile})`).option("--state-bucket <bucket>", "Pulumi state S3 bucket (default: {tenant}-mesh-platform-pulumi-state)").option("--create-state-bucket", "create the state bucket (versioned) if it does not exist \u2014 prompted on a terminal").option("--no-create-state-bucket", "never create the state bucket; print the aws command instead").option("--dir <path>", "target directory (default: ./{tenant}-mesh-platform)").option("--yes", "accept every default and never prompt", false).action(
     async (tenant, opts) => {
       if (!/^[a-z][a-z0-9-]*$/.test(tenant)) {
@@ -20676,8 +20690,7 @@ Usage: mesh secrets set external/<name>`);
   console.error("");
 }
 function isResourceNotFound(err) {
-  const e = err;
-  return e?.name === "ResourceNotFoundException" || e?.__type === "ResourceNotFoundException" || e?.Code === "ResourceNotFoundException" || e?.code === "ResourceNotFoundException" || typeof e?.message === "string" && e.message.includes("ResourceNotFoundException");
+  return isAwsErrorCode(err, "ResourceNotFoundException");
 }
 function deepMerge(target, source) {
   const result = { ...target };
@@ -20813,6 +20826,7 @@ var init_set = __esm({
     init_context2();
     init_pulumi();
     init_aws_auth();
+    init_aws_errors();
   }
 });
 
@@ -21041,16 +21055,12 @@ function extractNonSecretFields2(fields, values) {
   }
   return result;
 }
-function isResourceNotFound2(err) {
-  const e = err;
-  return e?.name === "ResourceNotFoundException" || e?.__type === "ResourceNotFoundException" || e?.Code === "ResourceNotFoundException" || e?.code === "ResourceNotFoundException" || typeof e?.message === "string" && e.message.includes("ResourceNotFoundException");
-}
 async function readSecret(client, secretId) {
   try {
     const res = await client.send(new GetSecretValueCommand8({ SecretId: secretId }));
     return res.SecretString ? JSON.parse(res.SecretString) : null;
   } catch (err) {
-    if (isResourceNotFound2(err)) return null;
+    if (isAwsErrorCode(err, "ResourceNotFoundException")) return null;
     throw err;
   }
 }
@@ -21059,7 +21069,7 @@ async function writeSecret2(client, secretId, values, description) {
   try {
     await client.send(new PutSecretValueCommand3({ SecretId: secretId, SecretString: secretString }));
   } catch (err) {
-    if (isResourceNotFound2(err)) {
+    if (isAwsErrorCode(err, "ResourceNotFoundException")) {
       await client.send(new CreateSecretCommand3({
         Name: secretId,
         Description: description,
@@ -21076,7 +21086,7 @@ async function secretExists(client, secretId) {
     await client.send(new GetSecretValueCommand8({ SecretId: secretId }));
     return true;
   } catch (err) {
-    if (isResourceNotFound2(err)) return false;
+    if (isAwsErrorCode(err, "ResourceNotFoundException")) return false;
     throw err;
   }
 }
@@ -21191,6 +21201,7 @@ var init_migrate_config = __esm({
     "use strict";
     init_log();
     init_context2();
+    init_aws_errors();
   }
 });