@mesh-tech/mesh-cli 0.35.2 → 0.37.0

package/dist/bin/mesh.chunk-MCBMHWXP.js

@@ -0,0 +1,837 @@
+import {
+  logInfo,
+  logSuccess,
+  startHeartbeat
+} from "./mesh.chunk-WFFDF346.js";
+import {
+  MeshCliError
+} from "./mesh.chunk-IQOBTL42.js";
+
+// packages/mesh-cli/src/commands/local/stack.ts
+import { execFileSync as execFileSync2, spawn, spawnSync } from "child_process";
+import * as fs2 from "fs";
+
+// packages/mesh-cli/src/commands/local/helpers.ts
+import * as net from "net";
+import { execFileSync } from "child_process";
+
+// packages/mesh-cli/src/commands/local/seed.ts
+var LOCAL_TENANT = "local";
+var LOCAL_ENV = "dev";
+var LOCAL_AWS_ENDPOINT = "http://localhost:4566";
+var LOCAL_AWS_REGION = "us-east-2";
+var ARTIFACTS_BUCKET = "mesh-local-artifacts";
+var DATA_BUCKET = "mesh-local-data";
+var APP_TENANTS_PARAM = `/mesh-platform/${LOCAL_TENANT}/${LOCAL_ENV}/app-tenants`;
+var DATA_BUCKET_SEEDS = [
+  {
+    key: "samples/pipes/fragment-0001.json",
+    body: JSON.stringify(
+      {
+        id: "sample-0001",
+        kind: "pipes-fragment",
+        account: "0001",
+        asOf: "2026-01-01",
+        lines: [{ amount: "125.00", currency: "USD", description: "Sample credit" }]
+      },
+      null,
+      2
+    )
+  }
+];
+var LOCAL_AWS_CONFIG = {
+  endpoint: LOCAL_AWS_ENDPOINT,
+  region: LOCAL_AWS_REGION,
+  credentials: { accessKeyId: "test", secretAccessKey: "test" }
+};
+var AWS_CONFIG = LOCAL_AWS_CONFIG;
+function localAwsEnv() {
+  return {
+    AWS_ENDPOINT_URL: LOCAL_AWS_ENDPOINT,
+    AWS_REGION: LOCAL_AWS_REGION,
+    AWS_ACCESS_KEY_ID: "test",
+    AWS_SECRET_ACCESS_KEY: "test"
+  };
+}
+function buildAppTenantsSeed() {
+  const tenantExport = {
+    albGroupName: LOCAL_TENANT,
+    certificateArn: "",
+    baseDomain: "localhost",
+    deployerRoleArn: "arn:aws:iam::000000000000:role/local-dev-deployer",
+    artifactsBucket: ARTIFACTS_BUCKET,
+    spicedb: {
+      endpoint: "localhost:50051",
+      presharedKeySecret: "local-dev-key"
+    },
+    zitadel: {
+      orgId: "local",
+      domain: "localhost:8080",
+      issuer: "http://localhost:8080"
+    }
+  };
+  return {
+    hubTenant: LOCAL_TENANT,
+    primaryTenant: tenantExport,
+    sharedTenants: {}
+  };
+}
+var FABRIC_CHECK_PATH = `/mesh-platform/${LOCAL_TENANT}/${LOCAL_ENV}/.fabric-check`;
+var TEMPORAL_NAMESPACE = `${LOCAL_TENANT}-${LOCAL_ENV}`;
+var TEMPORAL_ADDRESS = "localhost:7233";
+async function seedTemporalNamespace() {
+  await ensureTemporalNamespace(
+    TEMPORAL_NAMESPACE,
+    `Mesh local tenant '${LOCAL_TENANT}' env '${LOCAL_ENV}' (seeded by mesh start)`
+  );
+}
+async function ensureTemporalNamespace(namespace, description) {
+  const { Connection } = await import("@temporalio/client");
+  const connection = await Connection.connect({ address: TEMPORAL_ADDRESS });
+  try {
+    await connection.workflowService.registerNamespace({
+      namespace,
+      description: description ?? `Mesh local namespace '${namespace}'`,
+      // protobufjs accepts plain numbers for int64 at runtime; the generated
+      // typing insists on Long (whose package isn't a direct dep), hence any.
+      workflowExecutionRetentionPeriod: { seconds: 3 * 24 * 60 * 60 }
+    });
+    logInfo(`Registered Temporal namespace '${namespace}' \u2014 waiting for it to become active\u2026`);
+    const deadline = Date.now() + 2e4;
+    while (Date.now() < deadline) {
+      try {
+        await connection.workflowService.describeTaskQueue({
+          namespace,
+          taskQueue: { name: "namespace-propagation-probe" },
+          taskQueueType: 1
+        });
+        break;
+      } catch {
+        await new Promise((resolve2) => setTimeout(resolve2, 1e3));
+      }
+    }
+    logSuccess(`Temporal namespace '${namespace}' is active`);
+  } catch (err) {
+    if (err?.name === "NamespaceAlreadyExistsError" || /already exists/i.test(err?.message ?? "")) {
+      logInfo(`Temporal namespace '${namespace}' already exists`);
+    } else {
+      throw err;
+    }
+  } finally {
+    await connection.close();
+  }
+}
+function buildFabricCheckPayload(targetBytes = 8e3) {
+  const base = { probe: "advanced-tier-round-trip", tenant: LOCAL_TENANT, env: LOCAL_ENV, pad: "" };
+  const overhead = JSON.stringify(base).length;
+  return JSON.stringify({ ...base, pad: "x".repeat(Math.max(0, targetBytes - overhead)) });
+}
+async function verifyFabric() {
+  const { SSMClient, PutParameterCommand, GetParameterCommand, GetParametersByPathCommand, DeleteParametersCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient(AWS_CONFIG);
+  const payload = buildFabricCheckPayload();
+  const mainParam = FABRIC_CHECK_PATH;
+  const childParams = [`${FABRIC_CHECK_PATH}/vpc`, `${FABRIC_CHECK_PATH}/eks`];
+  try {
+    await ssm.send(
+      new PutParameterCommand({
+        Name: mainParam,
+        Type: "String",
+        Tier: "Advanced",
+        Overwrite: true,
+        Value: payload
+      })
+    );
+    for (const name of childParams) {
+      await ssm.send(
+        new PutParameterCommand({ Name: name, Type: "String", Overwrite: true, Value: `{"probe":"${name}"}` })
+      );
+    }
+    const roundTrip = await ssm.send(new GetParameterCommand({ Name: mainParam }));
+    if (roundTrip.Parameter?.Value !== payload) {
+      throw new MeshCliError(
+        `Local AWS fabric failed the ${payload.length}-byte Advanced-tier SSM round-trip (got ${roundTrip.Parameter?.Value?.length ?? 0} bytes back).`,
+        {
+          remediation: {
+            docs: "packages/mesh-cli/stack/docker-compose.yml \u2014 swap the ministack image for motoserver/moto (design \xA72.5 fallback)"
+          }
+        }
+      );
+    }
+    const byPath = await ssm.send(
+      new GetParametersByPathCommand({ Path: FABRIC_CHECK_PATH, Recursive: true })
+    );
+    const returned = new Set((byPath.Parameters ?? []).map((p) => p.Name));
+    const missing = childParams.filter((name) => !returned.has(name));
+    if (missing.length > 0) {
+      throw new MeshCliError(
+        `Local AWS fabric's GetParametersByPath missed child parameter(s): ${missing.join(", ")} (splitKeys exports would not resolve).`,
+        {
+          remediation: {
+            docs: "packages/mesh-cli/stack/docker-compose.yml \u2014 swap the ministack image for motoserver/moto (design \xA72.5 fallback)"
+          }
+        }
+      );
+    }
+    logSuccess(`Fabric check passed: ${payload.length}-byte Advanced-tier round-trip + GetParametersByPath`);
+  } finally {
+    await ssm.send(new DeleteParametersCommand({ Names: [mainParam, ...childParams] })).catch(() => {
+    });
+  }
+}
+async function registerTenantEnv(tenant, opts = {}) {
+  const { SSMClient, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient(AWS_CONFIG);
+  await ssm.send(
+    new PutParameterCommand({
+      Name: `/mesh-platform/${tenant}`,
+      Type: "String",
+      Overwrite: true,
+      Value: JSON.stringify({ name: tenant, tier: opts.tier ?? "shared", subdomain: tenant }),
+      Description: `Tenant registration (seeded by mesh CLI, local platform)`
+    })
+  );
+  await ssm.send(
+    new PutParameterCommand({
+      Name: `/mesh-platform/${tenant}/${LOCAL_ENV}`,
+      Type: "String",
+      Overwrite: true,
+      Value: JSON.stringify({
+        env: LOCAL_ENV,
+        region: LOCAL_AWS_REGION,
+        baseDomain: "localhost",
+        // monitoring is true: the local stack runs the same Loki/Tempo/
+        // Prometheus backends the hosted platform provides.
+        services: { temporal: true, zitadel: true, monitoring: true }
+      }),
+      Description: `Environment registration (seeded by mesh CLI, local platform)`
+    })
+  );
+}
+async function seedLocalPlatform() {
+  const { SSMClient, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient(AWS_CONFIG);
+  await ssm.send(
+    new PutParameterCommand({
+      Name: APP_TENANTS_PARAM,
+      Type: "String",
+      Overwrite: true,
+      Value: JSON.stringify(buildAppTenantsSeed()),
+      Description: `TenantEnvironments exports for ${LOCAL_TENANT}-${LOCAL_ENV} (seeded by mesh start)`
+    })
+  );
+  await registerTenantEnv(LOCAL_TENANT, { tier: "hub" });
+  logSuccess(`Registered tenant '${LOCAL_TENANT}' env '${LOCAL_ENV}' \u2192 ${APP_TENANTS_PARAM}`);
+  const { S3Client, CreateBucketCommand, PutObjectCommand } = await import("@aws-sdk/client-s3");
+  const s3 = new S3Client({ ...AWS_CONFIG, forcePathStyle: true });
+  for (const bucket of [ARTIFACTS_BUCKET, DATA_BUCKET]) {
+    try {
+      await s3.send(new CreateBucketCommand({ Bucket: bucket }));
+      logSuccess(`Created bucket s3://${bucket}`);
+    } catch (err) {
+      if (err?.name === "BucketAlreadyOwnedByYou" || err?.name === "BucketAlreadyExists") {
+        logInfo(`Bucket s3://${bucket} already exists`);
+      } else {
+        throw err;
+      }
+    }
+  }
+  for (const seed of DATA_BUCKET_SEEDS) {
+    await s3.send(
+      new PutObjectCommand({
+        Bucket: DATA_BUCKET,
+        Key: seed.key,
+        Body: seed.body,
+        ContentType: "application/json"
+      })
+    );
+  }
+  logSuccess(`Seeded s3://${DATA_BUCKET} with ${DATA_BUCKET_SEEDS.length} sample object(s)`);
+  await seedTemporalNamespace();
+  return { parameter: APP_TENANTS_PARAM, bucket: ARTIFACTS_BUCKET };
+}
+
+// packages/mesh-cli/src/utils/aws-errors.ts
+function isAwsErrorCode(err, code) {
+  const e = err;
+  return e?.name === code || e?.__type === code || e?.Code === code || e?.code === code || typeof e?.message === "string" && e.message.includes(code);
+}
+
+// packages/mesh-cli/src/commands/local/helpers.ts
+async function upsertLocalSecret(secretId, value, client) {
+  const { SecretsManagerClient, CreateSecretCommand, PutSecretValueCommand } = await import("@aws-sdk/client-secrets-manager");
+  const sm = client ?? new SecretsManagerClient(LOCAL_AWS_CONFIG);
+  const secretString = JSON.stringify(value);
+  try {
+    await sm.send(new CreateSecretCommand({ Name: secretId, SecretString: secretString }));
+  } catch (err) {
+    if (isAwsErrorCode(err, "ResourceExistsException")) {
+      await sm.send(new PutSecretValueCommand({ SecretId: secretId, SecretString: secretString }));
+    } else {
+      throw err;
+    }
+  }
+}
+function probeTcp(port, opts = {}) {
+  const { host = "127.0.0.1", timeoutMs = 2e3 } = opts;
+  return new Promise((resolve2) => {
+    const socket = net.connect({ host, port, timeout: timeoutMs });
+    socket.once("connect", () => {
+      socket.destroy();
+      resolve2(true);
+    });
+    socket.once("error", () => resolve2(false));
+    socket.once("timeout", () => {
+      socket.destroy();
+      resolve2(false);
+    });
+  });
+}
+function hostPortsOf(endpoints) {
+  const ports = /* @__PURE__ */ new Set();
+  const fromUrl = (raw) => {
+    try {
+      const u = new URL(raw.includes("://") ? raw : `tcp://${raw}`);
+      const port = Number(u.port || (u.protocol === "https:" ? 443 : u.protocol === "http:" ? 80 : NaN));
+      if (Number.isInteger(port) && port > 0) ports.add(port);
+    } catch {
+    }
+  };
+  for (const e of endpoints) {
+    if (e.probe.kind === "tcp") ports.add(e.probe.port);
+    else if (e.probe.kind === "http") fromUrl(e.probe.url);
+    fromUrl(e.url);
+  }
+  return [...ports].sort((a, b) => a - b);
+}
+function parseDockerPsPorts(output, ignorePrefix) {
+  const held = /* @__PURE__ */ new Map();
+  for (const line of output.split("\n")) {
+    const tab = line.indexOf("	");
+    if (tab < 0) continue;
+    const name = line.slice(0, tab).trim();
+    if (!name || name.startsWith(ignorePrefix)) continue;
+    for (const m of line.slice(tab + 1).matchAll(/:(\d+)->\d+\/(?:tcp|udp)/g)) {
+      const port = Number(m[1]);
+      if (!held.has(port)) held.set(port, name);
+    }
+  }
+  return held;
+}
+var defaultPortConflictIo = {
+  dockerPs: () => {
+    try {
+      return execFileSync("docker", ["ps", "--format", "{{.Names}}	{{.Ports}}"], {
+        encoding: "utf-8",
+        stdio: ["ignore", "pipe", "ignore"]
+      });
+    } catch {
+      return "";
+    }
+  },
+  processOn: (port) => {
+    try {
+      const out = execFileSync("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN", "-Fc"], {
+        encoding: "utf-8",
+        stdio: ["ignore", "pipe", "ignore"]
+      });
+      const cmd = out.split("\n").find((l) => l.startsWith("c"));
+      return cmd ? cmd.slice(1) : null;
+    } catch {
+      return null;
+    }
+  },
+  listening: (port) => probeTcp(port, { timeoutMs: 300 })
+};
+async function findPortConflicts(ports, ignorePrefix, io = defaultPortConflictIo) {
+  const unique = [...new Set(ports)].sort((a, b) => a - b);
+  const bound = (await Promise.all(unique.map(async (port) => await io.listening(port) ? port : null))).filter(
+    (p) => p !== null
+  );
+  if (bound.length === 0) return [];
+  const containers = parseDockerPsPorts(io.dockerPs(), ignorePrefix);
+  return bound.map((port) => {
+    const container = containers.get(port);
+    if (container) return { port, holder: { kind: "container", name: container } };
+    const process2 = io.processOn(port);
+    return { port, holder: process2 ? { kind: "process", name: process2 } : null };
+  });
+}
+function describePortConflicts(conflicts, moveHints = /* @__PURE__ */ new Map()) {
+  const lines = conflicts.flatMap(({ port, holder }) => {
+    const remedy = holder?.kind === "container" ? `docker stop ${holder.name}` : `lsof -nP -iTCP:${port} -sTCP:LISTEN, then stop what it names`;
+    const what = holder ? `held by ${holder.kind} ${holder.name}` : "held by something lsof would not name";
+    const move = moveHints.get(port);
+    return move ? [`  ${String(port).padEnd(5)} ${what.padEnd(38)} (${remedy})`, `  ${"".padEnd(5)} or: ${move}`] : [`  ${String(port).padEnd(5)} ${what.padEnd(38)} (${remedy})`];
+  });
+  return `Cannot start the local platform \u2014 ${conflicts.length === 1 ? "a host port it needs is" : "host ports it needs are"} already in use:
+` + lines.join("\n") + '\nStop what holds the port (or move it), then run mesh start again. A port lost this way does not fail as "port in use": the container never joins the network and a later service reports an unrelated error.\nIf the port is held by something you cannot stop and the stack can live without it: mesh start --skip-port-check';
+}
+
+// packages/mesh-cli/src/commands/local/stack.ts
+import * as path2 from "path";
+import { fileURLToPath } from "url";
+import { parse as parseYaml } from "yaml";
+
+// packages/mesh-cli/src/utils/cache-home.ts
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+function meshCacheHome() {
+  return process.env.MESH_CACHE_HOME || path.join(os.homedir(), ".cache", "mesh");
+}
+function meshCacheDir(...segments) {
+  const dir = path.join(meshCacheHome(), ...segments);
+  fs.mkdirSync(dir, { recursive: true });
+  return dir;
+}
+
+// packages/mesh-cli/src/commands/local/stack.ts
+var COMPOSE_PROJECT = "mesh-local";
+function localLogsDir() {
+  return meshCacheDir("mesh-local", "logs");
+}
+function localProbesDir() {
+  return meshCacheDir("mesh-local", "probes");
+}
+function writeAppServiceProbes(args) {
+  const entries = Object.entries(args.services);
+  if (entries.length === 0) return void 0;
+  const healthPath = args.healthPath ?? "/health";
+  const targets = entries.map(([name, port]) => ({
+    targets: [`http://host.docker.internal:${port}${healthPath}`],
+    labels: {
+      type: "service",
+      tenant: args.tenant,
+      env: args.env,
+      app: args.app,
+      service: name,
+      target: name
+    }
+  }));
+  const file = path2.join(localProbesDir(), `${args.tenant}-${args.app}-services.json`);
+  fs2.writeFileSync(file, `${JSON.stringify(targets, null, 2)}
+`);
+  return file;
+}
+var STACK_ENDPOINTS = [
+  {
+    service: "temporal",
+    label: "Temporal gRPC",
+    url: "localhost:7233",
+    probe: { kind: "tcp", port: 7233 }
+  },
+  {
+    service: "temporal-ui",
+    label: "Temporal UI",
+    url: "http://localhost:8233/namespaces/local-dev/workflows",
+    probe: { kind: "http", url: "http://localhost:8233" },
+    hint: "seeded namespace: local-dev"
+  },
+  {
+    service: "zitadel",
+    label: "Zitadel console",
+    url: "http://localhost:8080",
+    probe: { kind: "http", url: "http://localhost:8080/debug/healthz" },
+    hint: "admin@local.mesh / LocalDev1!"
+  },
+  {
+    service: "mailpit",
+    label: "Mailbox (local mail)",
+    url: "http://localhost:8025",
+    probe: { kind: "http", url: "http://localhost:8025/readyz" },
+    hint: "every activation + password-reset mail Zitadel sends locally lands here"
+  },
+  {
+    service: "database",
+    label: "Postgres",
+    url: "postgres://postgres:postgres@localhost:5433",
+    probe: { kind: "tcp", port: 5433 },
+    hint: "databases: temporal, app, spicedb, hub"
+  },
+  {
+    service: "spicedb",
+    label: "SpiceDB gRPC",
+    url: "localhost:50051",
+    probe: { kind: "tcp", port: 50051 },
+    hint: "preshared key: local-dev-key"
+  },
+  {
+    service: "ministack",
+    label: "ministack (local AWS endpoint)",
+    url: "http://localhost:4566",
+    probe: { kind: "http", url: "http://localhost:4566/_ministack/health" },
+    hint: "SSM registry under /mesh-platform/local/dev"
+  },
+  {
+    service: "stackport",
+    label: "StackPort (local AWS console)",
+    url: "http://localhost:4567",
+    probe: { kind: "http", url: "http://localhost:4567" },
+    hint: "browse the registry (SSM), secrets, S3 artifacts"
+  },
+  {
+    service: "memcached",
+    label: "Memcached",
+    url: "localhost:11211",
+    probe: { kind: "tcp", port: 11211 }
+  },
+  {
+    service: "loki",
+    label: "Loki (logs)",
+    url: "http://localhost:3100",
+    probe: { kind: "http", url: "http://localhost:3100/ready" },
+    hint: "mesh dev --local service logs, hosted label scheme"
+  },
+  {
+    service: "tempo",
+    label: "Tempo (traces)",
+    url: "http://localhost:3200",
+    probe: { kind: "http", url: "http://localhost:3200/ready" }
+  },
+  {
+    service: "prometheus",
+    label: "Prometheus (metrics)",
+    url: "http://localhost:9090",
+    probe: { kind: "http", url: "http://localhost:9090/-/ready" }
+  },
+  {
+    service: "otel-collector",
+    label: "OTel collector (OTLP in)",
+    url: "http://localhost:4318",
+    probe: { kind: "http", url: "http://localhost:13133" },
+    hint: "apps: OTEL_EXPORTER_OTLP_ENDPOINT (injected by mesh dev --local)"
+  },
+  {
+    service: "elasticsearch",
+    label: "OpenSearch (Temporal visibility)",
+    url: "http://localhost:9200",
+    probe: { kind: "http", url: "http://localhost:9200" }
+  }
+];
+var DEFAULT_HUB_PORT = "9000";
+function hubPort() {
+  const raw = process.env.MESH_HUB_PORT?.trim();
+  if (!raw) return DEFAULT_HUB_PORT;
+  if (!/^\d+$/.test(raw) || Number(raw) < 1 || Number(raw) > 65535) {
+    throw new MeshCliError(`MESH_HUB_PORT must be a TCP port number 1\u201365535 (got '${raw}').`, {
+      remediation: { command: "unset MESH_HUB_PORT   # or export a valid port, e.g. 9100" }
+    });
+  }
+  return raw;
+}
+function hubEndpoints() {
+  return [
+    {
+      service: "hub-api",
+      label: "Hub API",
+      url: "http://localhost:4568",
+      probe: { kind: "http", url: "http://localhost:4568/health" }
+    },
+    {
+      service: "hub-ui",
+      label: "Hub UI",
+      url: `http://localhost:${hubPort()}`,
+      probe: { kind: "http", url: `http://localhost:${hubPort()}/ping` },
+      hint: "sign in: admin@local.mesh or dev@local.mesh / LocalDev1! (oauth2-proxy, same as deployed)"
+    }
+  ];
+}
+function findPackageRoot(startDir) {
+  let dir = startDir ?? path2.dirname(fileURLToPath(import.meta.url));
+  for (let i = 0; i < 8; i++) {
+    const pkgPath = path2.join(dir, "package.json");
+    if (fs2.existsSync(pkgPath)) {
+      try {
+        const pkg = JSON.parse(fs2.readFileSync(pkgPath, "utf-8"));
+        if (pkg.name === "@mesh-tech/mesh-cli") return dir;
+      } catch {
+      }
+    }
+    const parent = path2.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new MeshCliError("Could not locate the mesh-cli package root (stack assets missing).", {
+    remediation: { command: "npm install -g @mesh-tech/mesh-cli" }
+  });
+}
+function stackDir() {
+  const dir = path2.join(findPackageRoot(), "stack");
+  if (!fs2.existsSync(path2.join(dir, "docker-compose.yml"))) {
+    throw new MeshCliError(`Local stack assets not found at ${dir}.`, {
+      remediation: { command: "npm install -g @mesh-tech/mesh-cli" }
+    });
+  }
+  return dir;
+}
+var BASE_COMPOSE_FILE = "docker-compose.yml";
+var HUB_OVERLAY_FILE = "docker-compose.hub.yml";
+var IDPS_OVERLAY_FILE = "docker-compose.idps.yml";
+function parseComposeServiceNames(yamlText) {
+  const doc = parseYaml(yamlText);
+  return Object.keys(doc?.services ?? {});
+}
+var overlayServicesCache = /* @__PURE__ */ new Map();
+function overlayServicesOf(overlayFile) {
+  const cached = overlayServicesCache.get(overlayFile);
+  if (cached) return cached;
+  const file = path2.join(stackDir(), overlayFile);
+  if (!fs2.existsSync(file)) {
+    throw new MeshCliError(`Local stack assets are incomplete: ${file} is missing.`, {
+      remediation: { command: "npm install -g @mesh-tech/mesh-cli" }
+    });
+  }
+  const base = new Set(
+    parseComposeServiceNames(fs2.readFileSync(path2.join(stackDir(), BASE_COMPOSE_FILE), "utf-8"))
+  );
+  const names = new Set(
+    parseComposeServiceNames(fs2.readFileSync(file, "utf-8")).filter((n) => !base.has(n))
+  );
+  overlayServicesCache.set(overlayFile, names);
+  return names;
+}
+function hubOverlayServices() {
+  return overlayServicesOf(HUB_OVERLAY_FILE);
+}
+function idpsOverlayServices() {
+  return overlayServicesOf(IDPS_OVERLAY_FILE);
+}
+function stackOwnedElsewhere() {
+  try {
+    const first = compose(["ps", "-q"]).trim().split("\n").filter(Boolean)[0];
+    if (!first) return void 0;
+    const label = execFileSync2(
+      "docker",
+      ["inspect", first, "--format", '{{ index .Config.Labels "com.docker.compose.project.working_dir" }}'],
+      { encoding: "utf-8" }
+    ).trim();
+    if (!label) return void 0;
+    const real = (p) => {
+      try {
+        return fs2.realpathSync(p);
+      } catch {
+        return path2.resolve(p);
+      }
+    };
+    return real(label) === real(stackDir()) ? void 0 : label;
+  } catch {
+    return void 0;
+  }
+}
+function ensureDockerAvailable() {
+  const probe = spawnSync("docker", ["info", "--format", "{{.ServerVersion}}"], {
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (probe.error || probe.status !== 0) {
+    throw new MeshCliError("Docker is not available (is Docker Desktop / the docker daemon running?).", {
+      remediation: { docs: "https://docs.docker.com/get-docker/" }
+    });
+  }
+}
+function compose(args, opts = {}) {
+  const dir = stackDir();
+  const files = ["-f", path2.join(dir, "docker-compose.yml")];
+  if (opts.hub) files.push("-f", path2.join(dir, "docker-compose.hub.yml"));
+  if (opts.idps) files.push("-f", path2.join(dir, IDPS_OVERLAY_FILE));
+  const fullArgs = ["compose", "-p", COMPOSE_PROJECT, ...files, ...args];
+  return execFileSync2("docker", fullArgs, {
+    cwd: dir,
+    encoding: "utf-8",
+    // MESH_LOCAL_LOGS on every call: the compose file mounts it into the
+    // OTel collector, and an unset variable would both warn and resolve to
+    // a different mount (recreate churn between CLI and raw compose runs).
+    // IGNORE_ORPHANS: base-only `up` calls would otherwise flag the hub
+    // overlay's running containers as orphans.
+    env: {
+      ...process.env,
+      MESH_LOCAL_LOGS: localLogsDir(),
+      MESH_LOCAL_PROBES: localProbesDir(),
+      COMPOSE_IGNORE_ORPHANS: "1",
+      ...opts.env
+    },
+    stdio: opts.inherit ? ["ignore", "inherit", "inherit"] : ["ignore", "pipe", "pipe"]
+  });
+}
+function summarizeComposeFailure(output) {
+  const lines = output.split("\n").map((l) => l.trim()).filter(Boolean);
+  const errorish = lines.filter(
+    (l) => /\b(error|failed|failure|fatal|denied|unauthorized|cannot|no such)\b/i.test(l)
+  );
+  const line = errorish.at(-1) ?? lines.at(-1) ?? "no output captured";
+  return line.length > 300 ? `${line.slice(0, 297)}\u2026` : line;
+}
+function composeLogPath(op) {
+  const dir = meshCacheDir("mesh-local");
+  return path2.join(dir, `compose-${op.replace(/[^a-z0-9-]/gi, "_")}.log`);
+}
+async function composeStreamed(args, opts = {}) {
+  const dir = stackDir();
+  const files = ["-f", path2.join(dir, "docker-compose.yml")];
+  if (opts.hub) files.push("-f", path2.join(dir, "docker-compose.hub.yml"));
+  if (opts.idps) files.push("-f", path2.join(dir, IDPS_OVERLAY_FILE));
+  const fullArgs = ["compose", "-p", COMPOSE_PROJECT, ...files, ...args];
+  const env = {
+    ...process.env,
+    MESH_LOCAL_LOGS: localLogsDir(),
+    MESH_LOCAL_PROBES: localProbesDir(),
+    COMPOSE_IGNORE_ORPHANS: "1",
+    ...opts.env
+  };
+  const op = args[0] ?? "cmd";
+  if (process.stderr.isTTY) {
+    const res = spawnSync("docker", fullArgs, {
+      cwd: dir,
+      env,
+      stdio: ["ignore", "inherit", "inherit"]
+    });
+    if (res.status !== 0) {
+      throw new MeshCliError(
+        `docker compose ${op} failed (exit ${res.status ?? "?"}) \u2014 the compose output above has the details.`,
+        {
+          remediation: {
+            command: `docker compose -p ${COMPOSE_PROJECT} ps && docker compose -p ${COMPOSE_PROJECT} logs --tail 50`
+          }
+        }
+      );
+    }
+    return;
+  }
+  const logPath = composeLogPath(op);
+  const logStream = fs2.createWriteStream(logPath);
+  const heartbeat = startHeartbeat(`docker compose ${args.join(" ")}`);
+  let captured = "";
+  let exitCode;
+  try {
+    exitCode = await new Promise((resolve2, reject) => {
+      const child = spawn("docker", fullArgs, {
+        cwd: dir,
+        env,
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      const consume = (chunk) => {
+        heartbeat.touch();
+        const text = chunk.toString();
+        captured += text;
+        logStream.write(text);
+        process.stderr.write(text);
+      };
+      child.stdout.on("data", consume);
+      child.stderr.on("data", consume);
+      child.on("error", reject);
+      child.on("close", (code) => resolve2(code ?? 1));
+    });
+  } finally {
+    heartbeat.stop();
+    await new Promise((resolve2) => logStream.end(resolve2));
+  }
+  if (exitCode !== 0) {
+    throw new MeshCliError(
+      `docker compose ${op} failed (exit ${exitCode}): ${summarizeComposeFailure(captured)}`,
+      {
+        remediation: {
+          command: `docker compose -p ${COMPOSE_PROJECT} logs --tail 50`,
+          docs: logPath
+        }
+      }
+    );
+  }
+}
+function parseComposePs(output) {
+  const services = [];
+  for (const line of output.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    try {
+      const entry = JSON.parse(trimmed);
+      services.push({
+        name: entry.Service ?? entry.Name ?? "unknown",
+        state: entry.State ?? "unknown",
+        health: entry.Health || void 0
+      });
+    } catch {
+    }
+  }
+  return services;
+}
+function stackServices() {
+  return parseComposePs(compose(["ps", "-a", "--format", "json"], { hub: true }));
+}
+var ONE_SHOT_SERVICES = /* @__PURE__ */ new Set(["spicedb-migrate", "zitadel-machinekey-init"]);
+function crashedServices(services, opts) {
+  const dormant = new Set(
+    opts.overlays.filter((o) => !o.started).flatMap((o) => [...o.services])
+  );
+  return services.filter(
+    (s) => s.state === "exited" && !ONE_SHOT_SERVICES.has(s.name) && !dormant.has(s.name)
+  );
+}
+function overlayRunning(services, overlayServices) {
+  return services.some((s) => overlayServices.has(s.name) && s.state === "running");
+}
+function hubApiRunning(services) {
+  return services.some((s) => s.name === "hub-api" && s.state === "running");
+}
+async function probeEndpoint(endpoint) {
+  if (endpoint.probe.kind === "http") {
+    try {
+      const res = await fetch(endpoint.probe.url, { signal: AbortSignal.timeout(3e3) });
+      return res.status < 500;
+    } catch {
+      return false;
+    }
+  }
+  if (endpoint.probe.kind === "tcp") {
+    return probeTcp(endpoint.probe.port, { timeoutMs: 3e3 });
+  }
+  return true;
+}
+
+export {
+  LOCAL_TENANT,
+  LOCAL_ENV,
+  ARTIFACTS_BUCKET,
+  LOCAL_AWS_CONFIG,
+  localAwsEnv,
+  TEMPORAL_ADDRESS,
+  ensureTemporalNamespace,
+  verifyFabric,
+  registerTenantEnv,
+  seedLocalPlatform,
+  isAwsErrorCode,
+  upsertLocalSecret,
+  probeTcp,
+  hostPortsOf,
+  findPortConflicts,
+  describePortConflicts,
+  meshCacheDir,
+  COMPOSE_PROJECT,
+  localLogsDir,
+  localProbesDir,
+  writeAppServiceProbes,
+  STACK_ENDPOINTS,
+  DEFAULT_HUB_PORT,
+  hubPort,
+  hubEndpoints,
+  findPackageRoot,
+  stackDir,
+  BASE_COMPOSE_FILE,
+  HUB_OVERLAY_FILE,
+  IDPS_OVERLAY_FILE,
+  parseComposeServiceNames,
+  hubOverlayServices,
+  idpsOverlayServices,
+  stackOwnedElsewhere,
+  ensureDockerAvailable,
+  compose,
+  summarizeComposeFailure,
+  composeLogPath,
+  composeStreamed,
+  parseComposePs,
+  stackServices,
+  ONE_SHOT_SERVICES,
+  crashedServices,
+  overlayRunning,
+  hubApiRunning,
+  probeEndpoint
+};