@mesh-tech/mesh-cli 0.34.0 → 0.34.2

package/dist/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "1e6a7cc8e",
-  "builtAt": "2026-09-22T21:56:57.206Z"
+  "commit": "bab7945c2",
+  "builtAt": "2026-09-24T17:48:24.813Z"
 }

package/dist/src/commands/dev.js

@@ -1896,7 +1896,8 @@ export function registerDevCommand(program) {
                     if (mode === 'local') {
                         throw new MeshCliError(`Docker external '${name}' failed to start: ${err instanceof Error ? err.message : err}`, { remediation: { command: `docker compose -f ${decl.compose} up  # debug it directly` } });
                     }
-                    logWarn(`External '${name}' credential seeding failed: ${err instanceof Error ? err.message : err}`);
+                    logWarn(`External '${name}' credential seeding failed: ${err instanceof Error ? err.message : err}` +
+                        ` — the app will resolve whatever was seeded previously, which may point at a stale port.`);
                 }
             }
             if (dockerRunner) {

package/dist/src/commands/init/platform-setup.js

@@ -8,7 +8,7 @@ export const PLATFORM_SETUP_DEFAULTS = {
     profile: "default",
 };
 export const DOMAIN_REQUIRED_MESSAGE = "--domain is required: the core stack creates the public Route 53 zone <env>.<domain>, " +
-    "and a placeholder domain scaffolds a zone that can never validate (the deploy stalls on the ACM certificate).";
+    "and a placeholder domain scaffolds a zone whose certificate can never validate, so ingress never serves HTTPS.";
 export function defaultStateBucket(tenant) {
     return `${tenant}-mesh-platform-pulumi-state`;
 }
@@ -31,7 +31,7 @@ export function validateDomain(value) {
         return "a public domain you control, e.g. q2poc.pub";
     }
     if (/(^|\.)(example\.(com|org|net)|invalid|localhost|test)$/.test(domain)) {
-        return `${domain} is a placeholder — the deploy stalls on an ACM certificate for a zone nobody can delegate. Use a domain you control.`;
+        return `${domain} is a placeholder — its ACM certificate can never validate, because nobody can delegate that zone to you. Use a domain you control.`;
     }
     return true;
 }
@@ -177,7 +177,7 @@ export function renderPlatformNextSteps(setup, opts = {}) {
     if (!opts.bucket?.present) {
         steps.push(`${stateBucketCreateCommand(setup)}   # the Pulumi state bucket, once`);
     }
-    steps.push(`cd ${dir}`, "pnpm install", `aws sso login --profile ${setup.profile}   # if this profile is SSO`, exportCredentialsCommand(setup.profile), `cd core && mesh deploy up        # the VPC, EKS, RDS and the public zone ${setup.env}.${setup.domain}`, `# → then delegate the NS records of ${setup.env}.${setup.domain} from ${setup.domain}; the deploy waits on the ACM certificate until you do`, "cd ../platform && mesh deploy up  # Temporal, Zitadel, the Hub  (needs Docker — it builds service images)", `mesh login ${setup.tenant}.${setup.env}      # your platform sign-in, once it is up`, "", "Then, in your apps repo, for the hello-world app:", `  mesh init --tenant ${setup.tenant} --platform ${setup.env}`, "  mesh create-app --name hello --primitives service", "  mesh deploy up                   # from the app directory");
+    steps.push(`cd ${dir}`, "pnpm install", `aws sso login --profile ${setup.profile}   # if this profile is SSO`, exportCredentialsCommand(setup.profile), `cd core && mesh deploy up        # the VPC, EKS, RDS and the public zone ${setup.env}.${setup.domain}`, `# → then delegate the NS records of ${setup.env}.${setup.domain} from ${setup.domain} at your registrar; the deploy stops at the mesh-gateway Ingress until ACM issues the certificate, then continues`, "cd ../platform && mesh deploy up  # Temporal, Zitadel, the Hub  (needs Docker — it builds service images)", `mesh login ${setup.tenant}.${setup.env}      # your platform sign-in, once it is up`, "", "Then, in your apps repo, for the hello-world app:", `  mesh init --tenant ${setup.tenant} --platform ${setup.env}`, "  mesh create-app --name hello --primitives service", "  mesh deploy up                   # from the app directory");
     return steps;
 }
 export async function scaffoldPlatformRepo(setup) {

package/dist/src/commands/init.js

@@ -225,7 +225,7 @@ export function registerInitCommands(program) {
         .option("--platform <env>", "a deployed platform's environment; signs in to `<tenant>.<env>`")
         .option("--new-platform [env]", `nothing deployed yet — scaffold a tenant platform repo for \`<tenant>.<env>\` (default env: ${PLATFORM_SETUP_DEFAULTS.env}) and print its deploy sequence`)
         .option("--region <region>", `--new-platform: AWS region (default: ${PLATFORM_SETUP_DEFAULTS.region})`)
-        .option("--domain <domain>", "--new-platform: base public domain you control; the core stack creates the zone {env}.{domain}. No default — a placeholder scaffolds a zone that can never validate")
+        .option("--domain <domain>", "--new-platform: base public domain you control; the core stack creates the zone {env}.{domain} and stops at the mesh-gateway Ingress until you delegate its NS records. No default — a placeholder scaffolds a zone that can never validate")
         .option("--state-bucket <bucket>", "--new-platform: Pulumi state S3 bucket (default: {tenant}-mesh-platform-pulumi-state)")
         .option("--create-state-bucket", "--new-platform: create the state bucket (versioned) if it does not exist")
         .option("--no-create-state-bucket", "--new-platform: never create the state bucket; print the aws command instead")
@@ -246,7 +246,7 @@ export function registerInitCommands(program) {
         .description("Scaffold a tenant PLATFORM repo (core + platform Pulumi layers on @mesh-tech/infra-components) that deploys with `mesh deploy` unmodified — the proven mesh-sandbox shape, annotated. On a terminal it ASKS for the values that differ per install (env, region, domain, state bucket, AWS profile), each pre-filled with its default; every answer is also a flag.")
         .option("--env <env>", `environment the first stack targets (default: ${PLATFORM_SETUP_DEFAULTS.env})`)
         .option("--region <region>", `AWS region (default: ${PLATFORM_SETUP_DEFAULTS.region})`)
-        .option("--domain <domain>", "base public domain you control — the core stack creates the Route 53 zone {env}.{domain} and waits on its NS delegation. Required: it has no default, because a placeholder scaffolds a zone that can never validate")
+        .option("--domain <domain>", "base public domain you control — the core stack creates the Route 53 zone {env}.{domain}, whose NS records you then delegate at your registrar; the deploy stops at the mesh-gateway Ingress until that lets ACM issue the certificate. Required: it has no default, because a placeholder scaffolds a zone nobody can delegate to you")
         .option("--profile <profile>", `AWS profile the stack config references (default: ${PLATFORM_SETUP_DEFAULTS.profile})`)
         .option("--state-bucket <bucket>", "Pulumi state S3 bucket (default: {tenant}-mesh-platform-pulumi-state)")
         .option("--create-state-bucket", "create the state bucket (versioned) if it does not exist — prompted on a terminal")

package/dist/src/commands/local/helpers.js

@@ -1,6 +1,7 @@
 import * as net from "net";
 import { execFileSync } from "child_process";
 import { LOCAL_AWS_CONFIG } from "./seed.js";
+import { isAwsErrorCode } from "../../utils/aws-errors.js";
 export async function upsertLocalSecret(secretId, value, client) {
     const { SecretsManagerClient, CreateSecretCommand, PutSecretValueCommand } = await import("@aws-sdk/client-secrets-manager");
     const sm = client ?? new SecretsManagerClient(LOCAL_AWS_CONFIG);
@@ -9,7 +10,7 @@ export async function upsertLocalSecret(secretId, value, client) {
         await sm.send(new CreateSecretCommand({ Name: secretId, SecretString: secretString }));
     }
     catch (err) {
-        if (err?.name === "ResourceExistsException") {
+        if (isAwsErrorCode(err, "ResourceExistsException")) {
             await sm.send(new PutSecretValueCommand({ SecretId: secretId, SecretString: secretString }));
         }
         else {

package/dist/src/commands/local/seed.js

@@ -126,7 +126,7 @@ export async function verifyFabric() {
         if (roundTrip.Parameter?.Value !== payload) {
             throw new MeshCliError(`Local AWS fabric failed the ${payload.length}-byte Advanced-tier SSM round-trip (got ${roundTrip.Parameter?.Value?.length ?? 0} bytes back).`, {
                 remediation: {
-                    docs: "libs/mesh-cli/stack/docker-compose.yml — swap the ministack image for motoserver/moto (design §2.5 fallback)",
+                    docs: "packages/mesh-cli/stack/docker-compose.yml — swap the ministack image for motoserver/moto (design §2.5 fallback)",
                 },
             });
         }
@@ -136,7 +136,7 @@ export async function verifyFabric() {
         if (missing.length > 0) {
             throw new MeshCliError(`Local AWS fabric's GetParametersByPath missed child parameter(s): ${missing.join(", ")} (splitKeys exports would not resolve).`, {
                 remediation: {
-                    docs: "libs/mesh-cli/stack/docker-compose.yml — swap the ministack image for motoserver/moto (design §2.5 fallback)",
+                    docs: "packages/mesh-cli/stack/docker-compose.yml — swap the ministack image for motoserver/moto (design §2.5 fallback)",
                 },
             });
         }

package/dist/src/commands/secrets/migrate-config.js

@@ -2,6 +2,7 @@ import { SSMClient, GetParametersByPathCommand, } from "@aws-sdk/client-ssm";
 import { SecretsManagerClient, GetSecretValueCommand, PutSecretValueCommand, CreateSecretCommand, ListSecretsCommand, } from "@aws-sdk/client-secrets-manager";
 import { logInfo, logSuccess, logError } from "../../utils/log.js";
 import { resolveSecretsContext } from "./context.js";
+import { isAwsErrorCode } from "../../utils/aws-errors.js";
 function normalizeEntry(raw) {
     if (raw.type === "group" && raw.fields) {
         return {
@@ -79,21 +80,13 @@ function extractNonSecretFields(fields, values) {
     }
     return result;
 }
-function isResourceNotFound(err) {
-    const e = err;
-    return (e?.name === "ResourceNotFoundException" ||
-        e?.__type === "ResourceNotFoundException" ||
-        e?.Code === "ResourceNotFoundException" ||
-        e?.code === "ResourceNotFoundException" ||
-        (typeof e?.message === "string" && e.message.includes("ResourceNotFoundException")));
-}
 async function readSecret(client, secretId) {
     try {
         const res = await client.send(new GetSecretValueCommand({ SecretId: secretId }));
         return res.SecretString ? JSON.parse(res.SecretString) : null;
     }
     catch (err) {
-        if (isResourceNotFound(err))
+        if (isAwsErrorCode(err, "ResourceNotFoundException"))
             return null;
         throw err;
     }
@@ -104,7 +97,7 @@ async function writeSecret(client, secretId, values, description) {
         await client.send(new PutSecretValueCommand({ SecretId: secretId, SecretString: secretString }));
     }
     catch (err) {
-        if (isResourceNotFound(err)) {
+        if (isAwsErrorCode(err, "ResourceNotFoundException")) {
             await client.send(new CreateSecretCommand({
                 Name: secretId,
                 Description: description,
@@ -123,7 +116,7 @@ async function secretExists(client, secretId) {
         return true;
     }
     catch (err) {
-        if (isResourceNotFound(err))
+        if (isAwsErrorCode(err, "ResourceNotFoundException"))
             return false;
         throw err;
     }

package/dist/src/commands/secrets/set.js

@@ -8,6 +8,7 @@ import { resolveStackOption } from "../../utils/stack-flag.js";
 import { resolveSecretsContext } from "./context.js";
 import { findAppRoot, readStackConfig } from "../../utils/pulumi.js";
 import { resolveAwsCredentials } from "../../utils/aws-auth.js";
+import { isAwsErrorCode } from "../../utils/aws-errors.js";
 export async function ensureAwsCredentialsForStack(stack) {
     if (process.env.AWS_ACCESS_KEY_ID || process.env.AWS_SESSION_TOKEN)
         return;
@@ -244,12 +245,7 @@ export async function setCommand(servicePath, opts) {
     console.error("");
 }
 export function isResourceNotFound(err) {
-    const e = err;
-    return (e?.name === "ResourceNotFoundException" ||
-        e?.__type === "ResourceNotFoundException" ||
-        e?.Code === "ResourceNotFoundException" ||
-        e?.code === "ResourceNotFoundException" ||
-        (typeof e?.message === "string" && e.message.includes("ResourceNotFoundException")));
+    return isAwsErrorCode(err, "ResourceNotFoundException");
 }
 function deepMerge(target, source) {
     const result = { ...target };