@mesh-tech/mesh-cli 0.39.0 → 0.40.1

package/dist/src/commands/dev-env-leaks.js

@@ -0,0 +1,178 @@
+import { execFileSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { envFileKeys, envFileName, getSessionEnvDir, isAllowedLaunchHostVar } from "./dev-launch.js";
+export const LEAK_NAME_PATTERNS = [
+    /^WORKSPACES_/,
+    /^AWS_/,
+    /^TEMPORAL_/,
+    /^VCS_/,
+    /_TOKEN$/,
+    /_SECRET$/,
+    /_KEY$/,
+    /_PASSWORD$/,
+];
+export function matchesLeakPattern(name) {
+    return LEAK_NAME_PATTERNS.some((re) => re.test(name));
+}
+export function parseTmuxEnvironment(text) {
+    const out = {};
+    for (const line of text.split("\n")) {
+        if (!line || line.startsWith("-"))
+            continue;
+        const eq = line.indexOf("=");
+        if (eq <= 0)
+            continue;
+        const name = line.slice(0, eq);
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
+            continue;
+        out[name] = line.slice(eq + 1);
+    }
+    return out;
+}
+export function classifyLeak(name, envFileKeysByService, cleanLaunch) {
+    const services = Object.keys(envFileKeysByService).sort();
+    const shadowedIn = services.filter((svc) => envFileKeysByService[svc].includes(name));
+    const unshadowedIn = services.filter((svc) => !shadowedIn.includes(svc));
+    if (cleanLaunch === false) {
+        if (services.length > 0 && unshadowedIn.length === 0)
+            return { fate: "shadowed", shadowedIn, unshadowedIn };
+        return { fate: "reaches", shadowedIn, unshadowedIn };
+    }
+    if (isAllowedLaunchHostVar(name))
+        return { fate: "reaches", shadowedIn, unshadowedIn };
+    if (services.length === 0)
+        return { fate: "dropped", shadowedIn, unshadowedIn };
+    if (unshadowedIn.length === 0)
+        return { fate: "shadowed", shadowedIn, unshadowedIn };
+    if (shadowedIn.length === 0)
+        return { fate: "dropped", shadowedIn, unshadowedIn };
+    return { fate: "partial", shadowedIn, unshadowedIn };
+}
+export function collectLeakCandidates(input) {
+    const names = new Map();
+    for (const name of Object.keys(input.tmuxGlobal)) {
+        if (matchesLeakPattern(name))
+            names.set(name, ["tmux-global"]);
+    }
+    for (const [name, value] of Object.entries(input.shell)) {
+        if (value === undefined || !matchesLeakPattern(name))
+            continue;
+        const sources = names.get(name) ?? [];
+        if (!sources.includes("shell"))
+            sources.push("shell");
+        names.set(name, sources);
+    }
+    return [...names.entries()]
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([name, sources]) => ({
+        name,
+        sources,
+        ...classifyLeak(name, input.envFileKeysByService, input.cleanLaunch),
+    }));
+}
+export function redactValue(value) {
+    if (value.length === 0)
+        return "(empty)";
+    if (value.length <= 8)
+        return "••••";
+    return `${value.slice(0, 4)}…(${value.length} chars)`;
+}
+const FATE_LABEL = {
+    reaches: "REACHES SERVICES",
+    shadowed: "shadowed by the env file",
+    dropped: "dropped by the clean launch",
+    partial: "shadowed for some services, dropped for others",
+};
+const SOURCE_LABEL = {
+    "tmux-global": "tmux -g",
+    shell: "shell",
+};
+export function renderLeakLines(candidates, input) {
+    return candidates.map((c) => {
+        const values = c.sources.map((src) => {
+            const value = src === "tmux-global" ? input.tmuxGlobal[c.name] : input.shell[c.name];
+            return `${SOURCE_LABEL[src]}: ${redactValue(value ?? "")}`;
+        });
+        let fate = FATE_LABEL[c.fate];
+        if (c.fate === "partial") {
+            fate = `shadowed for ${c.shadowedIn.join(", ")}; dropped for ${c.unshadowedIn.join(", ")}`;
+        }
+        else if (c.fate === "reaches" && input.cleanLaunch !== false && isAllowedLaunchHostVar(c.name)) {
+            fate = `${fate} (allow-listed host variable)`;
+        }
+        return `${c.name}  [${values.join("; ")}]  → ${fate}`;
+    });
+}
+function readTmuxGlobalEnvironment() {
+    try {
+        const text = execFileSync("tmux", ["show-environment", "-g"], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        return parseTmuxEnvironment(text);
+    }
+    catch {
+        return {};
+    }
+}
+function readSessionEnvFileKeys(sessionName, serviceNames) {
+    const dir = getSessionEnvDir(sessionName);
+    const out = {};
+    for (const name of serviceNames) {
+        const file = path.join(dir, envFileName(name));
+        if (!fs.existsSync(file))
+            continue;
+        out[name] = envFileKeys(fs.readFileSync(file, "utf8"));
+    }
+    return out;
+}
+export const envLeaksCheck = {
+    id: "env-leaks",
+    title: "Inherited environment",
+    phases: ["ondemand"],
+    async run(ctx) {
+        const state = ctx.sessionState;
+        const services = state?.devOutput.services
+            ? Object.entries(state.devOutput.services)
+                .filter(([, svc]) => svc.command && svc.command.length > 0)
+                .map(([name]) => name)
+            : [];
+        const input = {
+            tmuxGlobal: readTmuxGlobalEnvironment(),
+            shell: process.env,
+            envFileKeysByService: state ? readSessionEnvFileKeys(ctx.sessionName, services) : {},
+            cleanLaunch: state ? state.cleanEnv === true : null,
+        };
+        const candidates = collectLeakCandidates(input);
+        if (candidates.length === 0) {
+            return {
+                status: "ok",
+                summary: "no WORKSPACES_*/AWS_*/TEMPORAL_*/VCS_*/*_TOKEN/*_SECRET/*_KEY in the tmux global env or this shell",
+            };
+        }
+        const detail = renderLeakLines(candidates, input).join("\n    ");
+        const reaching = candidates.filter((c) => c.fate === "reaches");
+        if (reaching.length > 0 && input.cleanLaunch === false) {
+            return {
+                status: "warn",
+                summary: `${reaching.length} of ${candidates.length} inherited variable(s) reach the services — this session predates the clean launch`,
+                detail,
+                remediation: "mesh dev   # relaunch: services then start under env -i with only their env file",
+            };
+        }
+        if (reaching.length > 0) {
+            return {
+                status: "warn",
+                summary: `${reaching.length} of ${candidates.length} inherited variable(s) reach the services via the host allow-list`,
+                detail,
+            };
+        }
+        const where = state ? "services launched clean" : "no session; the next launch is clean";
+        return {
+            status: "ok",
+            summary: `${candidates.length} inherited variable(s) found, none reach the services (${where}) — each is shadowed by the env file or dropped by env -i`,
+            detail,
+        };
+    },
+};

package/dist/src/commands/dev-launch.d.ts

@@ -2,6 +2,22 @@ export declare const ENV_FILE_MODE = 384;
 export declare function quoteShellValue(value: string): string;
 export declare function renderEnvFile(env: Record<string, string>): string;
 export declare function envFileName(serviceName: string): string;
+export declare function getSessionEnvDir(sessionName: string): string;
+export declare function serviceOverridesPaths(sessionName: string, serviceName: string): string[];
+export declare function readServiceOverrides(sessionName: string, serviceName: string): Record<string, string>;
 export declare function writeEnvFile(filePath: string, env: Record<string, string>): void;
-export declare function buildLaunchCommand(envFilePath: string, dir: string, command: string, logShipper?: string): string;
+export declare const LAUNCH_HOST_ENV_ALLOW_LIST: ReadonlyArray<string>;
+export declare const LAUNCH_PANE_ENV_FORWARDED: ReadonlyArray<string>;
+export declare function isAllowedLaunchHostVar(name: string): boolean;
+export declare function pickLaunchHostEnv(env: Record<string, string | undefined>): Record<string, string>;
+export declare function launchShell(hostEnv: Record<string, string>): string;
+export declare function buildLaunchCommand(envFilePath: string, dir: string, command: string, logShipper: string | undefined, hostEnv: Record<string, string>): string;
+export declare function envFileKeys(content: string): string[];
+export declare function parseEnvFile(content: string): Record<string, string>;
+export interface EnvFileChange {
+    key: string;
+    kind: 'added' | 'removed' | 'changed';
+    detail: string;
+}
+export declare function diffEnvFiles(before: Record<string, string>, after: Record<string, string>): EnvFileChange[];
 export declare function waitForPort(host: string, port: number, timeoutMs: number, intervalMs?: number): Promise<boolean>;

package/dist/src/commands/dev-launch.js

@@ -1,6 +1,7 @@
 import * as fs from 'fs';
 import * as net from 'net';
 import * as path from 'path';
+import { devSessionsRoot } from '../utils/dev-sessions-root.js';
 export const ENV_FILE_MODE = 0o600;
 const ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 export function quoteShellValue(value) {
@@ -23,16 +24,140 @@ export function renderEnvFile(env) {
 export function envFileName(serviceName) {
     return `${serviceName.replace(/[^A-Za-z0-9._-]/g, '-')}.env.sh`;
 }
+export function getSessionEnvDir(sessionName) {
+    return path.join(devSessionsRoot(), sessionName);
+}
+export function serviceOverridesPaths(sessionName, serviceName) {
+    const dir = getSessionEnvDir(sessionName);
+    return [path.join(dir, '_all.overrides.env.sh'), path.join(dir, `${serviceName}.overrides.env.sh`)];
+}
+export function readServiceOverrides(sessionName, serviceName) {
+    const merged = {};
+    for (const file of serviceOverridesPaths(sessionName, serviceName)) {
+        try {
+            Object.assign(merged, parseEnvFile(fs.readFileSync(file, 'utf8')));
+        }
+        catch {
+        }
+    }
+    return merged;
+}
 export function writeEnvFile(filePath, env) {
     fs.mkdirSync(path.dirname(filePath), { recursive: true });
     fs.writeFileSync(filePath, renderEnvFile(env), { mode: ENV_FILE_MODE });
     fs.chmodSync(filePath, ENV_FILE_MODE);
 }
-export function buildLaunchCommand(envFilePath, dir, command, logShipper) {
-    const base = `cd ${quoteShellValue(dir)} && source ${quoteShellValue(envFilePath)} && `;
-    if (!logShipper)
-        return `${base}${command}`;
-    return `${base}{ ${command}; } 2>&1 | NODE_OPTIONS= node ${quoteShellValue(logShipper)}`;
+export const LAUNCH_HOST_ENV_ALLOW_LIST = [
+    'HOME',
+    'USER',
+    'LOGNAME',
+    'PATH',
+    'SHELL',
+    'TMPDIR',
+    'MESH_DEV_SESSIONS_DIR',
+    'LANG',
+    'LANGUAGE',
+    'TZ',
+    'XDG_CONFIG_HOME',
+    'XDG_CACHE_HOME',
+    'XDG_DATA_HOME',
+    'XDG_STATE_HOME',
+    'XDG_RUNTIME_DIR',
+    'MESH_CACHE_HOME',
+    'SSH_AUTH_SOCK',
+    'DOCKER_HOST',
+    'DOCKER_CONTEXT',
+    'DOCKER_CONFIG',
+    'DOCKER_CERT_PATH',
+    'DOCKER_TLS_VERIFY',
+    'HTTP_PROXY',
+    'HTTPS_PROXY',
+    'NO_PROXY',
+    'http_proxy',
+    'https_proxy',
+    'no_proxy',
+    'NODE_EXTRA_CA_CERTS',
+    'SSL_CERT_FILE',
+    'SSL_CERT_DIR',
+];
+const LAUNCH_HOST_ENV_ALLOW_PREFIXES = [
+    'LC_',
+];
+export const LAUNCH_PANE_ENV_FORWARDED = ['TERM', 'TMUX', 'TMUX_PANE'];
+export function isAllowedLaunchHostVar(name) {
+    return (LAUNCH_HOST_ENV_ALLOW_LIST.includes(name) ||
+        LAUNCH_HOST_ENV_ALLOW_PREFIXES.some((prefix) => name.startsWith(prefix)));
+}
+export function pickLaunchHostEnv(env) {
+    const picked = {};
+    for (const name of Object.keys(env).sort()) {
+        const value = env[name];
+        if (value && isAllowedLaunchHostVar(name))
+            picked[name] = value;
+    }
+    return picked;
+}
+export function launchShell(hostEnv) {
+    const shell = hostEnv.SHELL;
+    if (shell && path.isAbsolute(shell) && /^(bash|zsh)$/.test(path.basename(shell)))
+        return shell;
+    return '/bin/sh';
+}
+export function buildLaunchCommand(envFilePath, dir, command, logShipper, hostEnv) {
+    const sourced = `. ${quoteShellValue(envFilePath)} && `;
+    const script = logShipper
+        ? `${sourced}{ ${command}; } 2>&1 | NODE_OPTIONS= node ${quoteShellValue(logShipper)}`
+        : `${sourced}${command}`;
+    const forwarded = LAUNCH_PANE_ENV_FORWARDED.map((name) => `${name}="$${name}"`).join(' ');
+    return (`cd ${quoteShellValue(dir)} && env -i ${forwarded} ` +
+        `${quoteShellValue(launchShell(hostEnv))} -c ${quoteShellValue(script)}`);
+}
+export function envFileKeys(content) {
+    const keys = [];
+    for (const line of content.split('\n')) {
+        const match = /^export ([A-Za-z_][A-Za-z0-9_]*)=/.exec(line);
+        if (match)
+            keys.push(match[1]);
+    }
+    return keys;
+}
+export function parseEnvFile(content) {
+    const env = {};
+    const entry = /^export ([A-Za-z_][A-Za-z0-9_]*)='((?:[^']|'\\'')*)'$/gm;
+    for (const match of content.matchAll(entry)) {
+        env[match[1]] = match[2].replace(/'\\''/g, "'");
+    }
+    return env;
+}
+const SECRET_KEY_RE = /TOKEN|SECRET|KEY|PASSWORD|PASSWD|CREDENTIAL|COOKIE|AUTH/i;
+const PRINTABLE_VALUE_MAX = 80;
+export function diffEnvFiles(before, after) {
+    const show = (key, value) => {
+        if (SECRET_KEY_RE.test(key))
+            return '(secret)';
+        if (value.length > PRINTABLE_VALUE_MAX)
+            return `(${value.length} chars)`;
+        return JSON.stringify(value);
+    };
+    const changes = [];
+    const keys = [...new Set([...Object.keys(before), ...Object.keys(after)])].sort();
+    for (const key of keys) {
+        const was = before[key];
+        const now = after[key];
+        if (was === undefined && now !== undefined) {
+            changes.push({ key, kind: 'added', detail: `+ ${key} = ${show(key, now)}` });
+        }
+        else if (was !== undefined && now === undefined) {
+            changes.push({ key, kind: 'removed', detail: `- ${key} (was ${show(key, was)})` });
+        }
+        else if (was !== undefined && now !== undefined && was !== now) {
+            const detail = SECRET_KEY_RE.test(key)
+                ? `~ ${key} (secret; value changed)`
+                : `~ ${key}: ${show(key, was)} → ${show(key, now)}`;
+            changes.push({ key, kind: 'changed', detail });
+        }
+    }
+    return changes;
 }
 export async function waitForPort(host, port, timeoutMs, intervalMs = 500) {
     const deadline = Date.now() + timeoutMs;

package/dist/src/commands/dev-readiness.d.ts

@@ -0,0 +1,49 @@
+import type { PaneLiveness } from "./dev-doctor.js";
+export declare const TEMPORAL_WORKER_RUNNING: RegExp;
+export declare const RESTART_READY_TIMEOUT_MS = 60000;
+export declare const RESTART_ALIVE_GRACE_MS = 10000;
+export declare const RESTART_START_WINDOW_MS = 5000;
+export type PaneExit = Extract<PaneLiveness, {
+    state: "exited";
+}>;
+export type ServiceReadiness = {
+    state: "ready";
+    via: "port" | "marker" | "alive";
+    afterMs: number;
+} | {
+    state: "exited";
+    liveness: PaneExit;
+    afterMs: number;
+    output: string;
+} | {
+    state: "pending";
+    afterMs: number;
+    output: string;
+} | {
+    state: "port-held";
+    afterMs: number;
+    output: string;
+} | {
+    state: "unknown";
+    reason: string;
+};
+export interface ReadinessProbe {
+    liveness(): PaneLiveness;
+    portAccepts(port: number): Promise<boolean>;
+    paneOutput(): string;
+    now(): number;
+    sleep(ms: number): Promise<void>;
+}
+export interface ReadinessTarget {
+    port: number;
+    portHeldBeforeStart?: boolean;
+    readyMarker?: RegExp;
+    timeoutMs?: number;
+    intervalMs?: number;
+    graceMs?: number;
+    startWindowMs?: number;
+}
+export declare function awaitServiceReadiness(target: ReadinessTarget, probe: ReadinessProbe): Promise<ServiceReadiness>;
+export declare function portHeldByAnother(port: number, probe: Pick<ReadinessProbe, "portAccepts" | "now" | "sleep">, settleMs?: number, intervalMs?: number): Promise<boolean>;
+export declare function paneTail(output: string, n?: number): string[];
+export declare function parseWaitSeconds(raw: string | boolean | undefined, defaultSeconds: number): number;

package/dist/src/commands/dev-readiness.js

@@ -0,0 +1,78 @@
+export const TEMPORAL_WORKER_RUNNING = /Worker state changed[\s\S]{0,400}?state: 'RUNNING'/;
+export const RESTART_READY_TIMEOUT_MS = 60_000;
+export const RESTART_ALIVE_GRACE_MS = 10_000;
+export const RESTART_START_WINDOW_MS = 5_000;
+export async function awaitServiceReadiness(target, probe) {
+    const timeoutMs = target.timeoutMs ?? RESTART_READY_TIMEOUT_MS;
+    const intervalMs = target.intervalMs ?? 500;
+    const graceMs = Math.min(target.graceMs ?? RESTART_ALIVE_GRACE_MS, timeoutMs);
+    const startWindowMs = Math.min(target.startWindowMs ?? RESTART_START_WINDOW_MS, timeoutMs);
+    const portIsSignal = target.port > 0 && !target.portHeldBeforeStart;
+    const hasSignal = portIsSignal || target.readyMarker !== undefined;
+    const start = probe.now();
+    for (;;) {
+        const afterMs = probe.now() - start;
+        const liveness = probe.liveness();
+        if (liveness.state === "exited") {
+            if (afterMs >= startWindowMs) {
+                return { state: "exited", liveness, afterMs, output: probe.paneOutput() };
+            }
+            await probe.sleep(Math.min(intervalMs, startWindowMs - afterMs));
+            continue;
+        }
+        const blind = liveness.state === "unknown";
+        if (portIsSignal && (await probe.portAccepts(target.port))) {
+            return { state: "ready", via: "port", afterMs };
+        }
+        if (target.readyMarker && target.readyMarker.test(probe.paneOutput())) {
+            return { state: "ready", via: "marker", afterMs };
+        }
+        if (!hasSignal) {
+            if (blind)
+                return { state: "unknown", reason: liveness.reason };
+            if (afterMs >= graceMs) {
+                return target.portHeldBeforeStart
+                    ? { state: "port-held", afterMs, output: probe.paneOutput() }
+                    : { state: "ready", via: "alive", afterMs };
+            }
+        }
+        if (afterMs >= timeoutMs) {
+            if (blind && liveness.state === "unknown") {
+                return { state: "unknown", reason: `${liveness.reason}; and no readiness signal in ${timeoutMs}ms` };
+            }
+            return hasSignal
+                ? { state: "pending", afterMs, output: probe.paneOutput() }
+                : { state: "ready", via: "alive", afterMs };
+        }
+        await probe.sleep(Math.min(intervalMs, timeoutMs - afterMs));
+    }
+}
+export async function portHeldByAnother(port, probe, settleMs = 3000, intervalMs = 250) {
+    if (port <= 0)
+        return false;
+    const start = probe.now();
+    for (;;) {
+        if (!(await probe.portAccepts(port)))
+            return false;
+        if (probe.now() - start >= settleMs)
+            return true;
+        await probe.sleep(intervalMs);
+    }
+}
+export function paneTail(output, n = 20) {
+    return output
+        .split("\n")
+        .map((line) => line.trimEnd())
+        .filter((line) => line.length > 0)
+        .slice(-n);
+}
+export function parseWaitSeconds(raw, defaultSeconds) {
+    if (raw === false)
+        return 0;
+    if (raw === undefined || raw === true)
+        return defaultSeconds;
+    const n = Number(raw);
+    if (!Number.isFinite(n) || n < 0)
+        return defaultSeconds;
+    return n;
+}

package/dist/src/commands/dev.d.ts

@@ -1,6 +1,7 @@
 import { Command } from 'commander';
 import { type ResolvedAwsCreds } from '../utils/aws-auth.js';
 import { type ComposeExternalRef } from './local/mocks.js';
+import { type WorktreeIdentity } from '../utils/worktree-identity.js';
 interface DevEnvVar {
     value: string;
     tunnel?: string;
@@ -31,6 +32,12 @@ export interface DevOutput {
     services: Record<string, DevService>;
     tunnels: Record<string, DevTunnel>;
     secrets?: Record<string, DevSecret>;
+    provenance?: DevOutputProvenance;
+}
+export interface DevOutputProvenance {
+    gitCommit?: string;
+    configSha256?: string;
+    worktreeDigest?: string;
 }
 export declare function registerServiceProbes(devOutput: DevOutput, tenant: string, probeFiles: string[]): void;
 export interface SessionState {
@@ -46,11 +53,33 @@ export interface SessionState {
         app: string;
     };
     workflowFingerprint?: string;
+    cleanEnv?: boolean;
 }
 export declare function workflowChanged(prior: string | undefined, current: string): boolean;
+export interface SessionPortMemory {
+    services: Record<string, number>;
+    savedAt: string;
+}
+export declare function rememberedPortsOf(memory: Partial<SessionPortMemory> | null | undefined): Record<string, number>;
 export declare function isPortFree(port: number): Promise<boolean>;
 export declare function rewriteOwnServicePort(service: DevService, oldPort: number, newPort: number): void;
+export interface PortProbes {
+    isPortFree(port: number): Promise<boolean>;
+    findFreePort(): Promise<number>;
+}
+export declare function allocatePorts(devOutput: DevOutput, worktree: WorktreeIdentity, remembered?: Record<string, number>, probes?: PortProbes, ownPorts?: ReadonlySet<number>): Promise<DevOutput>;
 export declare function mergePinnedPorts(fresh: DevOutput, pinned: DevOutput): DevOutput;
+export declare function worktreeDigestOfDir(dir: string): string | null;
+export declare function currentProgramProvenance(appRoot: string, stack: string): {
+    gitCommit: string | null;
+    configSha256: string | null;
+    worktreeDigest: string | null;
+};
+export declare function devOutputStaleness(recorded: DevOutputProvenance | undefined, current: {
+    gitCommit: string | null;
+    configSha256: string | null;
+    worktreeDigest?: string | null;
+}): string[];
 export declare function buildChildAwsEnv(awsEnv: Record<string, string>, method: ResolvedAwsCreds['method'] | 'ambient', profile: string | undefined, opts?: {
     context: string;
     roleArn: string;
@@ -60,7 +89,25 @@ export declare function buildChildAwsEnv(awsEnv: Record<string, string>, method:
 export declare function readDotEnvFile(file: string): Record<string, string>;
 export declare function rebaseServiceSrc(src: string, monorepoRoot: string | null): string;
 export declare function isLinkedDependencyDir(serviceDir: string, appRoot: string): boolean;
+export declare function relinkedServiceDir(serviceDir: string, appRoot: string): string | null;
 export declare function monorepoRelativeSrc(src: string): string | null;
+export declare function portSiblingOf(key: string): string | undefined;
+export declare function pointAtTunnel(key: string, value: string, tunnel: {
+    host: string;
+    port: number;
+}): string;
+export declare function tunnelForSecret(secretName: string, tunnels: Record<string, {
+    host: string;
+    port: number;
+}>): {
+    host: string;
+    port: number;
+} | undefined;
+export declare function pointSecretUrlsAtTunnel(values: Record<string, string>, tunnel: {
+    host: string;
+    port: number;
+} | undefined): Record<string, string>;
+export declare function stackNamespace(devOutput: Pick<DevOutput, 'platform' | 'stack' | 'app'>): string | undefined;
 export declare function tunnelClientAddress(tunnel: {
     host: string;
     port: number;
@@ -100,5 +147,18 @@ export type ReachabilityDecision = {
 export declare function reachabilityFallbackTransport(transport: Transport, temporalReachable: boolean, hasSsmPlugin: boolean): ReachabilityDecision;
 export declare function preferredSsmLocalPort(remotePort: number): number;
 export declare function reserveSsmLocalPortCandidate(remotePort: number, reservedPorts: Set<number>, startAt?: number): number;
+export declare function bastionServiceForTunnel(tunnelName: string, tunnel: {
+    host: string;
+    port: number;
+}, services: Record<string, {
+    host: string;
+    port: number;
+}>): {
+    key: string;
+    endpoint: {
+        host: string;
+        port: number;
+    };
+} | undefined;
 export declare function registerDevCommand(program: Command): void;
 export {};