@mesh-tech/mesh-cli 0.38.1 → 0.40.0

package/dist/src/commands/mcp/index.js

@@ -0,0 +1,70 @@
+import * as path from "node:path";
+import { logError, logInfo, logWarn } from "../../utils/log.js";
+export function registerMcpCommands(program) {
+    const mcp = program
+        .command("mcp")
+        .description("Manifest-driven MCP Integrations (reviewed tool catalogs)");
+    mcp
+        .command("review <manifest>")
+        .description("Fetch a manifest's MCP server tools/list with the Integration's credential, diff it against the checked-in snapshot, and write the snapshot on confirmation")
+        .option("--yes", "Write without prompting")
+        .option("--dry-run", "Report the diff and write nothing")
+        .option("--stack <stack>", "Pulumi stack name (override detection)")
+        .option("-t, --tenant <tenant>", "Tenant to address (override detection)")
+        .option("--region <region>", "AWS region (default: us-east-2)")
+        .option("--secret <id>", "Secrets Manager secret holding the Integration credential (default: the deployed ExternalService's own secret)")
+        .action(async (manifest, opts) => {
+        const { runMcpReviewCommand } = await import("./review-command.js");
+        try {
+            await runMcpReviewCommand(manifest, opts);
+        }
+        catch (error) {
+            logError(error instanceof Error ? error.message : String(error));
+            process.exit(1);
+        }
+    });
+    mcp
+        .command("generate <manifest>")
+        .description("Write the worker package mesh.apps.McpIntegration deploys (package.json, main.ts, openapi.json) from a manifest and its reviewed snapshot; commit it with the lockfile")
+        .option("--out <dir>", "Package directory (default: <manifest dir>/.mesh-mcp/<name>)")
+        .option("--refresh-versions", "Re-resolve every dependency version instead of keeping the committed ones")
+        .action(async (manifest, opts) => {
+        const { generateMcpServeDir } = await import("./generate.js");
+        const { workspaceMembership } = await import("./workspace-membership.js");
+        try {
+            const { serveDir, written } = generateMcpServeDir(manifest, {
+                ...(opts.out ? { out: opts.out } : {}),
+                ...(opts.refreshVersions ? { refreshVersions: true } : {}),
+            });
+            if (written.length === 0) {
+                logInfo(`${serveDir} is current.`);
+            }
+            else {
+                logInfo(`Wrote ${written.join(", ")} in ${serveDir}.`);
+                if (written.includes("package.json")) {
+                    logInfo("Run `pnpm install` so the lockfile records it, then commit both.");
+                }
+            }
+            const membership = workspaceMembership(serveDir);
+            if (!membership.workspaceFile) {
+                logWarn(`No pnpm-workspace.yaml above ${serveDir}: the worker image installs this package from a pnpm workspace, so it must be in one.`);
+            }
+            else if (!membership.member && membership.suggestedGlob) {
+                const { ensureWorkspaceGlobs } = await import("../create-app.js");
+                const added = ensureWorkspaceGlobs(path.dirname(membership.workspaceFile), [
+                    membership.suggestedGlob,
+                ]);
+                if (added.length > 0) {
+                    logInfo(`${membership.workspaceFile}: added ${added.join(", ")} so \`pnpm install\` records the package.`);
+                }
+                else {
+                    logWarn(`${serveDir} is not a member of the workspace in ${membership.workspaceFile}, so \`pnpm install\` will not record it. Add "${membership.suggestedGlob}" to its packages.`);
+                }
+            }
+        }
+        catch (error) {
+            logError(error instanceof Error ? error.message : String(error));
+            process.exit(1);
+        }
+    });
+}

package/dist/src/commands/mcp/manifest-file.d.ts

@@ -0,0 +1,5 @@
+import { type LoadedMcpManifest } from "@mesh-tech/api-registry/mcp-manifest";
+export type LoadedMcpManifestFile = LoadedMcpManifest & {
+    toolsPath: string;
+};
+export declare function readMcpManifestFile(manifestPath: string): LoadedMcpManifestFile;

package/dist/src/commands/mcp/manifest-file.js

@@ -0,0 +1,24 @@
+import { readFileSync } from "node:fs";
+import * as path from "node:path";
+import { parseMcpManifest, resolveMcpManifest, } from "@mesh-tech/api-registry/mcp-manifest";
+function readJson(file) {
+    let text;
+    try {
+        text = readFileSync(file, "utf8");
+    }
+    catch (error) {
+        throw new Error(`MCP manifest: cannot read ${file} (${error instanceof Error ? error.message : String(error)})`);
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch (error) {
+        throw new Error(`MCP manifest: ${file} is not valid JSON (${error instanceof Error ? error.message : String(error)})`);
+    }
+}
+export function readMcpManifestFile(manifestPath) {
+    const absolute = path.resolve(manifestPath);
+    const manifest = parseMcpManifest(readJson(absolute));
+    const toolsPath = path.resolve(path.dirname(absolute), manifest.tools);
+    return { ...resolveMcpManifest(manifest, readJson(toolsPath), { toolsPath }), toolsPath };
+}

package/dist/src/commands/mcp/review-command.d.ts

@@ -0,0 +1,24 @@
+import { SSMClient } from "@aws-sdk/client-ssm";
+import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+import { type FetchMcpTools } from "./review.js";
+export declare function resolveIntegrationCredentials(name: string, opts: {
+    stack?: string;
+    stage?: string;
+    tenant?: string;
+    region?: string;
+    secret?: string;
+}, clients?: {
+    ssm?: SSMClient;
+    secretsManager?: Pick<SecretsManagerClient, "send">;
+    ensureCredentials?: (stack: string | undefined) => Promise<void>;
+}): Promise<Record<string, string>>;
+export declare const fetchMcpToolsOverHttp: FetchMcpTools;
+export declare function runMcpReviewCommand(manifestPath: string, opts: {
+    yes?: boolean;
+    dryRun?: boolean;
+    stack?: string;
+    stage?: string;
+    tenant?: string;
+    region?: string;
+    secret?: string;
+}): Promise<void>;

package/dist/src/commands/mcp/review-command.js

@@ -0,0 +1,66 @@
+import { SSMClient } from "@aws-sdk/client-ssm";
+import { GetSecretValueCommand, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+import confirm from "@inquirer/confirm";
+import { logInfo } from "../../utils/log.js";
+import { discoverStackExternalServices, ensureAwsCredentialsForStack, resolveExternalServiceScope, } from "../secrets/set.js";
+import { readMcpManifestFile } from "./manifest-file.js";
+import { reviewMcpCatalog } from "./review.js";
+export async function resolveIntegrationCredentials(name, opts, clients = {}) {
+    const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
+    let secretId = opts.secret;
+    if (secretId) {
+        const ensure = clients.ensureCredentials ?? ensureAwsCredentialsForStack;
+        await ensure(resolveExternalServiceScope(opts).stack);
+    }
+    else {
+        const { scope, services } = await discoverStackExternalServices(opts, clients.ssm ?? new SSMClient({ region }), clients.ensureCredentials ? { ensureCredentials: clients.ensureCredentials } : {});
+        const service = services.get(name);
+        if (!service?.meta?.secretPrefix) {
+            throw new Error(`No deployed ExternalService named "${name}" in ${scope.context.tenant}/${scope.platformEnv} (stack ${scope.stack ?? "unknown"}). Deploy the Integration first, or pass --secret <id>.`);
+        }
+        secretId = service.meta.secretPrefix;
+    }
+    const response = await (clients.secretsManager ?? new SecretsManagerClient({ region })).send(new GetSecretValueCommand({ SecretId: secretId }));
+    if (!response.SecretString) {
+        throw new Error(`The Integration credential at "${secretId}" is empty — populate it with \`mesh secrets set external/${name}\``);
+    }
+    return JSON.parse(response.SecretString);
+}
+export const fetchMcpToolsOverHttp = async ({ serverUrl, headers, timeoutMs }) => {
+    const { Client, StreamableHTTPClientTransport } = await import("@modelcontextprotocol/client");
+    const client = new Client({ name: "mesh-mcp-review", version: "1.0.0" }, { capabilities: {}, versionNegotiation: { mode: "auto" } });
+    const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+        requestInit: { headers, redirect: "error" },
+    });
+    try {
+        await client.connect(transport, { timeout: timeoutMs });
+        const result = await client.listTools(undefined, { timeout: timeoutMs });
+        return result.tools;
+    }
+    finally {
+        if (transport.sessionId)
+            await transport.terminateSession().catch(() => { });
+        await client.close().catch(() => { });
+        await transport.close().catch(() => { });
+    }
+};
+export async function runMcpReviewCommand(manifestPath, opts) {
+    const { manifest } = readMcpManifestFile(manifestPath);
+    const credentials = manifest.auth.kind === "shared-header"
+        ? await resolveIntegrationCredentials(manifest.name, opts)
+        : {};
+    if (manifest.auth.kind === "none") {
+        logInfo(`${manifest.name} declares no authentication; connecting unauthenticated.`);
+    }
+    const result = await reviewMcpCatalog({
+        manifestPath,
+        credentials,
+        fetchTools: fetchMcpToolsOverHttp,
+        ...(opts.yes ? { yes: true } : {}),
+        ...(opts.dryRun ? { dryRun: true } : {}),
+        confirm: (question) => confirm({ message: question, default: false }),
+    });
+    if (result.written) {
+        logInfo("Commit the snapshot with the regenerated worker package; McpIntegration refuses a package that does not match its manifest.");
+    }
+}

package/dist/src/commands/mcp/review.d.ts

@@ -0,0 +1,41 @@
+import { type McpManifest, type McpTool, type McpToolAccess } from "@mesh-tech/api-registry/mcp-manifest";
+export interface ToolDiffEntry {
+    name: string;
+    status: "added" | "removed" | "changed" | "unchanged";
+    access: McpToolAccess;
+    suggested?: "read";
+    detail?: string;
+}
+export interface SnapshotDiff {
+    entries: ToolDiffEntry[];
+    added: string[];
+    removed: string[];
+    changed: string[];
+    removedEnabled: string[];
+    clean: boolean;
+    next: McpTool[];
+}
+export declare function diffSnapshot(current: readonly McpTool[], fetched: readonly McpTool[], enabledOps?: readonly string[], classification?: Record<string, McpToolAccess>): SnapshotDiff;
+export type FetchMcpTools = (input: {
+    serverUrl: string;
+    headers: Record<string, string>;
+    timeoutMs: number;
+}) => Promise<unknown>;
+export type ConfirmFn = (question: string) => Promise<boolean>;
+export interface ReviewMcpCatalogOptions {
+    manifestPath: string;
+    credentials: Readonly<Record<string, string>>;
+    fetchTools: FetchMcpTools;
+    confirm?: ConfirmFn;
+    report?: (line: string) => void;
+    yes?: boolean;
+    dryRun?: boolean;
+}
+export interface ReviewMcpCatalogResult {
+    diff: SnapshotDiff;
+    manifest: McpManifest;
+    snapshotPath: string;
+    written: boolean;
+}
+export declare function reviewMcpCatalog(opts: ReviewMcpCatalogOptions): Promise<ReviewMcpCatalogResult>;
+export declare function assertEnabledPresent(manifestName: string, enabledOps: readonly string[], catalog: readonly McpTool[]): void;

package/dist/src/commands/mcp/review.js

@@ -0,0 +1,140 @@
+import * as fs from "node:fs";
+import { classifyMcpTools, mcpAuthHeaders, parseMcpToolSnapshot, } from "@mesh-tech/api-registry/mcp-manifest";
+import { defaultServeDir, generateMcpServeDir } from "./generate.js";
+import { readMcpManifestFile } from "./manifest-file.js";
+function canonical(tool) {
+    return JSON.stringify(tool, Object.keys(tool).sort());
+}
+function describeChange(before, after) {
+    const parts = [];
+    if (before.description !== after.description)
+        parts.push("description");
+    if (JSON.stringify(before.inputSchema) !== JSON.stringify(after.inputSchema))
+        parts.push("input schema");
+    if (JSON.stringify(before.outputSchema) !== JSON.stringify(after.outputSchema))
+        parts.push("output schema");
+    if (JSON.stringify(before.annotations) !== JSON.stringify(after.annotations))
+        parts.push("annotations (read/write classification)");
+    return parts.length > 0 ? parts.join(", ") : "other fields";
+}
+export function diffSnapshot(current, fetched, enabledOps = [], classification = {}) {
+    const before = new Map(current.map((t) => [t.name, t]));
+    const after = new Map(fetched.map((t) => [t.name, t]));
+    const classified = {
+        ...classifyMcpTools(current, classification),
+        ...classifyMcpTools(fetched, classification),
+    };
+    const accessOf = (name) => {
+        const entry = classified[name];
+        return { access: entry.access, ...(entry.suggested ? { suggested: entry.suggested } : {}) };
+    };
+    const entries = [];
+    for (const tool of fetched) {
+        const prior = before.get(tool.name);
+        if (!prior) {
+            entries.push({ name: tool.name, status: "added", ...accessOf(tool.name) });
+        }
+        else if (canonical(prior) !== canonical(tool)) {
+            entries.push({
+                name: tool.name,
+                status: "changed",
+                ...accessOf(tool.name),
+                detail: describeChange(prior, tool),
+            });
+        }
+        else {
+            entries.push({ name: tool.name, status: "unchanged", ...accessOf(tool.name) });
+        }
+    }
+    for (const tool of current) {
+        if (!after.has(tool.name)) {
+            entries.push({ name: tool.name, status: "removed", ...accessOf(tool.name) });
+        }
+    }
+    const pick = (status) => entries.filter((e) => e.status === status).map((e) => e.name);
+    const removed = pick("removed");
+    return {
+        entries,
+        added: pick("added"),
+        changed: pick("changed"),
+        removed,
+        removedEnabled: enabledOps.filter((op) => removed.includes(op)),
+        clean: pick("added").length === 0 && pick("changed").length === 0 && removed.length === 0,
+        next: [...fetched],
+    };
+}
+export async function reviewMcpCatalog(opts) {
+    const loaded = readMcpManifestFile(opts.manifestPath);
+    const { manifest } = loaded;
+    const report = opts.report ?? ((line) => console.log(line));
+    const snapshotPath = loaded.toolsPath;
+    const headers = mcpAuthHeaders(manifest, opts.credentials);
+    const fetched = parseMcpToolSnapshot(await opts.fetchTools({
+        serverUrl: manifest.serverUrl,
+        headers,
+        timeoutMs: manifest.timeoutMs ?? 30_000,
+    }), `${manifest.serverUrl} tools/list`);
+    if (fetched.length === 0) {
+        throw new Error(`${manifest.name}: the server answered tools/list with an empty catalog — refusing to replace a reviewed snapshot with nothing`);
+    }
+    const enabled = manifest.enabledOps ?? loaded.tools.map((t) => t.name);
+    const diff = diffSnapshot(loaded.tools, fetched, enabled, manifest.classification ?? {});
+    report(`${manifest.name} — ${manifest.serverUrl}`);
+    report(`  snapshot: ${snapshotPath}`);
+    for (const entry of diff.entries) {
+        const mark = entry.status === "added"
+            ? "+"
+            : entry.status === "removed"
+                ? "-"
+                : entry.status === "changed"
+                    ? "~"
+                    : " ";
+        const enabledMark = enabled.includes(entry.name) ? "enabled" : "not enabled";
+        const suggestion = entry.suggested ? ", vendor suggests read" : "";
+        report(`  ${mark} ${entry.name} [${entry.access}${suggestion}, ${enabledMark}]${entry.detail ? ` — ${entry.detail}` : ""}`);
+    }
+    const suggestedReads = diff.entries
+        .filter((entry) => entry.suggested === "read" && entry.status !== "removed")
+        .map((entry) => entry.name);
+    if (suggestedReads.length > 0) {
+        report(`  the vendor marks ${suggestedReads.join(", ")} read-only (readOnlyHint). They stay unknown and need approval until the manifest's "classification" names them "read".`);
+    }
+    if (diff.added.length > 0) {
+        report(`  ${diff.added.length} new upstream tool(s) will be recorded but NOT enabled: add them to enabledOps deliberately.`);
+    }
+    if (diff.removedEnabled.length > 0) {
+        throw new Error(`${manifest.name}: the server no longer offers enabled operation(s) ${diff.removedEnabled.join(", ")} — remove them from enabledOps first, then re-review`);
+    }
+    if (diff.clean) {
+        report("  no changes — the reviewed snapshot still matches the server.");
+        return { diff, manifest, snapshotPath, written: false };
+    }
+    if (opts.dryRun) {
+        report("  --dry-run: nothing written.");
+        return { diff, manifest, snapshotPath, written: false };
+    }
+    const approved = opts.yes === true ||
+        (await (opts.confirm ?? (async () => false))(`Write the new snapshot to ${snapshotPath}?`));
+    if (!approved) {
+        report("  not written.");
+        return { diff, manifest, snapshotPath, written: false };
+    }
+    fs.writeFileSync(snapshotPath, `${JSON.stringify(diff.next, null, 2)}\n`);
+    report(`  wrote ${diff.next.length} reviewed tool(s).`);
+    const serveDir = defaultServeDir(opts.manifestPath, manifest.name);
+    if (fs.existsSync(serveDir)) {
+        const generated = generateMcpServeDir(opts.manifestPath);
+        report(`  regenerated ${generated.written.join(", ") || "nothing"} in ${generated.serveDir}.`);
+    }
+    else {
+        report(`  run \`mesh mcp generate ${opts.manifestPath}\` to write the worker package.`);
+    }
+    return { diff, manifest, snapshotPath, written: true };
+}
+export function assertEnabledPresent(manifestName, enabledOps, catalog) {
+    const names = new Set(catalog.map((t) => t.name));
+    const missing = enabledOps.filter((op) => !names.has(op));
+    if (missing.length > 0) {
+        throw new Error(`${manifestName}: cannot enable ${missing.join(", ")} — absent from the reviewed snapshot`);
+    }
+}

package/dist/src/commands/mcp/workspace-membership.d.ts

@@ -0,0 +1,7 @@
+export interface WorkspaceMembership {
+    workspaceFile?: string;
+    member: boolean;
+    suggestedGlob?: string;
+}
+export declare function matchesWorkspaceGlob(pattern: string, relDir: string): boolean;
+export declare function workspaceMembership(dir: string): WorkspaceMembership;

package/dist/src/commands/mcp/workspace-membership.js

@@ -0,0 +1,77 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { parse } from "yaml";
+function findWorkspaceFile(from) {
+    let dir = from;
+    for (;;) {
+        const file = path.join(dir, "pnpm-workspace.yaml");
+        if (fs.existsSync(file))
+            return file;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return undefined;
+        dir = parent;
+    }
+}
+function segmentPattern(segment) {
+    const body = segment
+        .split("")
+        .map((ch) => ch === "*" ? "[^/]*" : ch === "?" ? "[^/]" : ch.replace(/[.+^${}()|[\]\\]/g, "\\$&"))
+        .join("");
+    return new RegExp(segment.startsWith(".") ? `^${body}$` : `^(?!\\.)${body}$`);
+}
+function matchSegments(pattern, target) {
+    if (pattern.length === 0)
+        return target.length === 0;
+    const [head, ...rest] = pattern;
+    if (head === "**") {
+        for (let i = 0; i <= target.length; i++) {
+            if (target.slice(0, i).some((s) => s.startsWith(".")))
+                break;
+            if (matchSegments(rest, target.slice(i)))
+                return true;
+        }
+        return false;
+    }
+    if (target.length === 0)
+        return false;
+    return segmentPattern(head).test(target[0]) && matchSegments(rest, target.slice(1));
+}
+export function matchesWorkspaceGlob(pattern, relDir) {
+    const clean = (p) => p
+        .replace(/^\.\//, "")
+        .replace(/\/+$/, "")
+        .split("/")
+        .filter((s) => s.length > 0 && s !== ".");
+    return matchSegments(clean(pattern), clean(relDir.split(path.sep).join("/")));
+}
+export function workspaceMembership(dir) {
+    const abs = path.resolve(dir);
+    const workspaceFile = findWorkspaceFile(abs);
+    if (!workspaceFile)
+        return { member: false };
+    const root = path.dirname(workspaceFile);
+    const rel = path.relative(root, abs).split(path.sep).join("/");
+    const suggestedGlob = `${path.posix.dirname(rel)}/*`;
+    let globs;
+    try {
+        globs = parse(fs.readFileSync(workspaceFile, "utf8"))
+            ?.packages;
+    }
+    catch {
+        return { workspaceFile, member: false, suggestedGlob };
+    }
+    let member = false;
+    for (const glob of Array.isArray(globs) ? globs : []) {
+        if (typeof glob !== "string")
+            continue;
+        if (glob.startsWith("!")) {
+            if (matchesWorkspaceGlob(glob.slice(1), rel))
+                member = false;
+        }
+        else if (matchesWorkspaceGlob(glob, rel)) {
+            member = true;
+        }
+    }
+    return { workspaceFile, member, suggestedGlob };
+}

package/dist/src/commands/secrets/reindex.js

@@ -2,9 +2,7 @@ import { SSMClient } from "@aws-sdk/client-ssm";
 import { SecretsManagerClient, ListSecretsCommand, GetSecretValueCommand, PutSecretValueCommand, CreateSecretCommand, } from "@aws-sdk/client-secrets-manager";
 import { buildInstanceIndexValue, instanceIndexSecretId, instanceKeyFromSecretName, parseInstanceIndex, } from "@mesh-tech/secrets";
 import { logInfo, logSuccess, logError } from "../../utils/log.js";
-import { resolveStackOption } from "../../utils/stack-flag.js";
-import { resolveSecretsContext } from "./context.js";
-import { discoverExternalServices, ensureAwsCredentialsForStack, isResourceNotFound, } from "./set.js";
+import { discoverStackExternalServices, isResourceNotFound } from "./set.js";
 export async function scanInstanceKeys(client, secretPrefix) {
     const keys = [];
     let nextToken;
@@ -26,13 +24,10 @@ export function indexAlreadyMatches(missing, stale, indexExists, malformed) {
     return missing.length === 0 && stale.length === 0 && indexExists && !malformed;
 }
 export async function reindexCommand(servicePath, opts) {
-    const stackOpt = resolveStackOption(opts);
-    const context = resolveSecretsContext(opts, stackOpt);
     const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
-    await ensureAwsCredentialsForStack(stackOpt ?? context.stage);
     const ssmClient = new SSMClient({ region });
+    const { services } = await discoverStackExternalServices(opts, ssmClient);
     const smClient = new SecretsManagerClient({ region });
-    const services = await discoverExternalServices(ssmClient, context.tenant, context.platformEnv);
     const serviceName = servicePath?.replace(/^external\//, "");
     if (!serviceName || !services.has(serviceName)) {
         if (serviceName) {

package/dist/src/commands/secrets/set.d.ts

@@ -1,5 +1,7 @@
 import { SSMClient } from "@aws-sdk/client-ssm";
 import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+import { type StackSelector } from "../../utils/stack-flag.js";
+import type { MeshContext } from "../../utils/context.js";
 export declare function ensureAwsCredentialsForStack(stack: string | undefined): Promise<void>;
 interface SchemaField {
     type: "field";
@@ -25,10 +27,29 @@ export interface ExternalServiceMeta {
     description: string;
     secretPrefix: string;
 }
-export declare function discoverExternalServices(ssmClient: SSMClient, tenant: string, platformEnv: string): Promise<Map<string, {
+export declare function discoverExternalServices(ssmClient: SSMClient, tenant: string, platformEnv: string, stack?: string): Promise<Map<string, {
     meta: ExternalServiceMeta;
     schema?: CredentialSchema;
 }>>;
+export interface ExternalServiceScope {
+    context: MeshContext;
+    stack: string | undefined;
+    platformEnv: string;
+}
+export declare function resolveExternalServiceScope(opts: StackSelector & {
+    tenant?: string;
+}): ExternalServiceScope;
+export declare function discoverStackExternalServices(opts: StackSelector & {
+    tenant?: string;
+}, ssmClient: SSMClient, deps?: {
+    ensureCredentials?: (stack: string | undefined) => Promise<void>;
+}): Promise<{
+    scope: ExternalServiceScope;
+    services: Map<string, {
+        meta: ExternalServiceMeta;
+        schema?: CredentialSchema;
+    }>;
+}>;
 export declare function setCommand(servicePath: string | undefined, opts: {
     key?: string;
     all?: boolean;

package/dist/src/commands/secrets/set.js

@@ -7,7 +7,7 @@ import { logInfo, logSuccess, logError } from "../../utils/log.js";
 import { resolveStackOption } from "../../utils/stack-flag.js";
 import { resolveSecretsContext } from "./context.js";
 import { findAppRoot, readStackConfig } from "../../utils/pulumi.js";
-import { resolveAwsCredentials } from "../../utils/aws-auth.js";
+import { resolveAwsCredentials, derivePlatformRef } from "../../utils/aws-auth.js";
 import { isAwsErrorCode } from "../../utils/aws-errors.js";
 export async function ensureAwsCredentialsForStack(stack) {
     if (process.env.AWS_ACCESS_KEY_ID || process.env.AWS_SESSION_TOKEN)
@@ -46,9 +46,11 @@ function normalizeEntry(raw) {
 function normalizeFields(raw) {
     return Object.fromEntries(Object.entries(raw).map(([key, value]) => [key, normalizeEntry(value)]));
 }
-export async function discoverExternalServices(ssmClient, tenant, platformEnv) {
+export async function discoverExternalServices(ssmClient, tenant, platformEnv, stack) {
     const services = new Map();
     const basePath = `/mesh-platform/${tenant}/${platformEnv}`;
+    const stackSegment = stack ? `/stacks/${stack}/` : undefined;
+    const fromStack = new Set();
     let nextToken;
     do {
         const response = await ssmClient.send(new GetParametersByPathCommand({
@@ -59,9 +61,16 @@ export async function discoverExternalServices(ssmClient, tenant, platformEnv) {
         for (const param of response.Parameters ?? []) {
             if (!param.Name || !param.Value)
                 continue;
+            const scoped = param.Name.includes("/stacks/");
+            if (stackSegment && scoped && !param.Name.includes(stackSegment))
+                continue;
             const metaMatch = param.Name.match(/\/external-services\/([^/]+)\/meta$/);
             if (metaMatch?.[1]) {
                 const serviceName = metaMatch[1];
+                if (stackSegment && !scoped && fromStack.has(`meta:${serviceName}`))
+                    continue;
+                if (stackSegment && scoped)
+                    fromStack.add(`meta:${serviceName}`);
                 const meta = JSON.parse(param.Value);
                 const existing = services.get(serviceName);
                 services.set(serviceName, { ...existing, meta });
@@ -69,6 +78,10 @@ export async function discoverExternalServices(ssmClient, tenant, platformEnv) {
             const credMatch = param.Name.match(/\/external-services\/([^/]+)\/credentials$/);
             if (credMatch?.[1]) {
                 const serviceName = credMatch[1];
+                if (stackSegment && !scoped && fromStack.has(`schema:${serviceName}`))
+                    continue;
+                if (stackSegment && scoped)
+                    fromStack.add(`schema:${serviceName}`);
                 const raw = JSON.parse(param.Value);
                 const schema = {
                     fields: normalizeFields(raw.fields),
@@ -146,17 +159,27 @@ function displaySummary(fields, values, depth = 0) {
         }
     }
 }
-export async function setCommand(servicePath, opts) {
+export function resolveExternalServiceScope(opts) {
     const stackOpt = resolveStackOption(opts);
     const context = resolveSecretsContext(opts, stackOpt);
+    const stack = stackOpt ?? context.stage;
+    const appRoot = findAppRoot(process.cwd());
+    const platformEnv = (appRoot && stack ? derivePlatformRef(appRoot, stack)?.env : undefined) ?? context.platformEnv;
+    return { context, stack, platformEnv };
+}
+export async function discoverStackExternalServices(opts, ssmClient, deps = {}) {
+    const scope = resolveExternalServiceScope(opts);
+    await (deps.ensureCredentials ?? ensureAwsCredentialsForStack)(scope.stack);
+    const services = await discoverExternalServices(ssmClient, scope.context.tenant, scope.platformEnv, scope.stack);
+    return { scope, services };
+}
+export async function setCommand(servicePath, opts) {
     const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
-    await ensureAwsCredentialsForStack(stackOpt ?? context.stage);
-    const ssmClient = new SSMClient({ region });
+    const { services } = await discoverStackExternalServices(opts, new SSMClient({ region }));
     const smClient = new SecretsManagerClient({ region });
-    const services = await discoverExternalServices(ssmClient, context.tenant, context.platformEnv);
     if (services.size === 0) {
         logError("No external services found. Deploy an ExternalService first:\n" +
-            "  new mesh.apps.ExternalService(\"symitar\", { env, credentials: { ... } })");
+            '  new mesh.apps.ExternalService("symitar", { env, credentials: { ... } })');
         process.exit(1);
     }
     let serviceName;
@@ -212,7 +235,7 @@ export async function setCommand(servicePath, opts) {
             values = JSON.parse(opts.json);
         }
         catch {
-            logError("Invalid JSON input. Provide valid JSON, e.g.: --json='{\"key\": \"value\"}'");
+            logError('Invalid JSON input. Provide valid JSON, e.g.: --json=\'{"key": "value"}\'');
             return;
         }
         const merged = deepMerge(existing, values);