@mesh-tech/mesh-cli 0.40.14 → 0.41.0

package/dist/bin/{mesh.auth-preflight-BGI5LPLN.js → mesh.auth-preflight-JTUNS42O.js}

@@ -21,7 +21,7 @@ import {
   registryPreflight,
   stripUnscopedCodeArtifactRegistry,
   upsertNpmrcLines
-} from "./mesh.chunk-4XX62O6Z.js";
+} from "./mesh.chunk-HC7V75J3.js";
 export {
   REGISTRY_LOGIN_FIX,
   REGISTRY_LOGIN_FIX_AWS,

package/dist/bin/{mesh.chunk-3WJGDNHA.js → mesh.chunk-HB2IZKLP.js}

@@ -11,7 +11,7 @@ import {
   parseHubActAsExports,
   restrictedRoleBase,
   sandboxModeSchema
-} from "./mesh.chunk-2QIVBQX5.js";
+} from "./mesh.chunk-PL3P54MY.js";
 import {
   ARTIFACTS_BUCKET,
   COMPOSE_PROJECT,
@@ -49,7 +49,7 @@ import {
   isExpiredAwsTokenMessage,
   probeRegistryToken,
   registryLoginFix
-} from "./mesh.chunk-4XX62O6Z.js";
+} from "./mesh.chunk-HC7V75J3.js";
 
 // packages/mesh-cli/src/commands/login.ts
 import * as http from "http";
@@ -7885,7 +7885,7 @@ function registerDevCommand(program) {
     "tmux"
   );
   dev.command("__token-server <port> <context>", { hidden: true }).action(async (port, context) => {
-    const { startTokenServer } = await import("./mesh.dev-token-server-IJUVRBWI.js");
+    const { startTokenServer } = await import("./mesh.dev-token-server-4N6HGQAF.js");
     await startTokenServer(Number(port), context);
   });
   dev.action(async (options) => {
@@ -11023,9 +11023,9 @@ function refuseReservedRegistryContext(context, verb) {
 }
 async function hintRegistryIfMissing() {
   try {
-    const { readRegistrySession } = await import("./mesh.registry-identity-6UPUHKO2.js");
+    const { readRegistrySession } = await import("./mesh.registry-identity-DSTAHXUS.js");
     if (readRegistrySession()) return;
-    const { probeRegistryToken: probeRegistryToken2 } = await import("./mesh.auth-preflight-BGI5LPLN.js");
+    const { probeRegistryToken: probeRegistryToken2 } = await import("./mesh.auth-preflight-JTUNS42O.js");
     const probe = await probeRegistryToken2();
     if (probe.state === "missing" || probe.state === "expired") {
       logInfo(REGISTRY_SEPARATE_HINT);

package/dist/bin/{mesh.chunk-4XX62O6Z.js → mesh.chunk-HC7V75J3.js}

@@ -107,7 +107,7 @@ async function registryPreflight(opts) {
   const probe = await probeRegistryToken(opts);
   let session = null;
   try {
-    const { readRegistrySession } = await import("./mesh.registry-identity-6UPUHKO2.js");
+    const { readRegistrySession } = await import("./mesh.registry-identity-DSTAHXUS.js");
     session = readRegistrySession();
   } catch {
   }

package/dist/bin/{mesh.chunk-GLG5JBI7.js → mesh.chunk-IZLAJATU.js}

@@ -7,22 +7,22 @@ import {
   parseInstanceIndex,
   resolveSecretsContext,
   setCommand
-} from "./mesh.chunk-EHLBX24J.js";
+} from "./mesh.chunk-QUKWWFZI.js";
 import {
   cliReferenceStaleness,
   resolveCliRuntime,
   runPortalCommand
-} from "./mesh.chunk-O677AU5E.js";
+} from "./mesh.chunk-YB4VOTA7.js";
 import {
   registerAppCommands,
   registerCreateAppCommand
-} from "./mesh.chunk-O5CP4NPZ.js";
+} from "./mesh.chunk-LAUSCBV6.js";
 import {
   PLATFORM_SETUP_DEFAULTS
-} from "./mesh.chunk-WT27GBE4.js";
+} from "./mesh.chunk-M57BJLLK.js";
 import {
   registerRegistryCommands
-} from "./mesh.chunk-YKW256CK.js";
+} from "./mesh.chunk-PANTMVC3.js";
 import {
   registerSkillsCommands,
   resolveTargetRoot,
@@ -78,7 +78,7 @@ import {
   waitForPort,
   worktreeStackName,
   writeEnvFile
-} from "./mesh.chunk-3WJGDNHA.js";
+} from "./mesh.chunk-HB2IZKLP.js";
 import {
   COMPOSE_PROJECT,
   DEFAULT_HUB_PORT,
@@ -127,7 +127,7 @@ import {
   homeNpmrcPath,
   isNpmAuthError,
   probeRegistryToken
-} from "./mesh.chunk-4XX62O6Z.js";
+} from "./mesh.chunk-HC7V75J3.js";
 import {
   createVcsFolderReader,
   deriveVcsBaseUrl,
@@ -1542,7 +1542,7 @@ var DOCS_PREVIEW_PORT = "4410";
 var CLI_REFERENCE_PATH = "docs/portal/generated/cli-reference.md";
 async function renderCliReference() {
   const [{ createProgram: createProgram2 }, { extractCliReference, renderCliReferenceMarkdown }] = await Promise.all([
-    import("./mesh.program-WSFVQU7P.js"),
+    import("./mesh.program-BZPJOWJK.js"),
     import("./mesh.cli-reference-H3TOPIET.js")
   ]);
   return renderCliReferenceMarkdown(extractCliReference(createProgram2()));
@@ -1614,7 +1614,7 @@ function registerDocsCommand(program) {
     "Serve the Mesh docs locally \u2014 detached in a tmux session by default; the working tree in a mesh-platform checkout, or the published @mesh-tech/docs artifact (role-gated registry) anywhere else"
   ).option("-v, --version <version>", "docs version to serve (== the @mesh-tech/* baseline it describes); default: latest", void 0).option("-p, --port <port>", "port to serve on (0 picks a free one)", "4400").option("--dev", "in a checkout: run the Zudoku dev server (HMR) in the foreground, for authoring", false).option("--foreground", "serve in the foreground (the agent/CI path; automatic when not a TTY)", false).action(
     (opts) => guarded(async () => {
-      const { runDocsStart } = await import("./mesh.start-24YIFB4O.js");
+      const { runDocsStart } = await import("./mesh.start-XKQW5DW4.js");
       await runDocsStart({
         repoRoot: findRepoRoot(process.cwd()),
         version: opts.version,
@@ -1626,13 +1626,13 @@ function registerDocsCommand(program) {
   );
   docs.command("stop").description(`Stop the detached docs server (the tmux session "${"mesh-docs"}")`).action(
     () => guarded(async () => {
-      const { runDocsStop } = await import("./mesh.start-24YIFB4O.js");
+      const { runDocsStop } = await import("./mesh.start-XKQW5DW4.js");
       runDocsStop();
     })()
   );
   docs.command("serve-static", { hidden: true }).option("--root <dir>", "built site root", "").option("--port <port>", "port", "4400").action(
     (opts) => guarded(async () => {
-      const { runDocsServeStatic } = await import("./mesh.start-24YIFB4O.js");
+      const { runDocsServeStatic } = await import("./mesh.start-XKQW5DW4.js");
       await runDocsServeStatic(opts);
     })()
   );
@@ -1646,7 +1646,7 @@ function registerDocsCommand(program) {
     "the OpenAPI spec to document, overriding docs.yaml's spec \u2014 pass the one the deploy reads (the ApiSurface's docs.spec, or its doc package's openapi.json); default: docs.yaml's spec, else openapi.json beside it"
   ).option("--check", "print the problems and exit 1 when there are any, without serving (CI / pre-deploy)", false).action(
     (dir, opts) => guarded(async () => {
-      const { runDocsPreview } = await import("./mesh.preview-RJGTCTY3.js");
+      const { runDocsPreview } = await import("./mesh.preview-ALFPQCWU.js");
       const ok = await runDocsPreview({ target: dir, port: opts.port, out: opts.out, spec: opts.spec, check: opts.check });
       if (!ok) process.exitCode = 1;
     })()
@@ -1668,14 +1668,14 @@ function registerDocsCommand(program) {
     "the block's pages prefix ({ dir, prefix }): the old site served pages under /<prefix>/; the conversion lists the page ids that lose it"
   ).action(
     (opts) => guarded(async () => {
-      const { runDocsConvert } = await import("./mesh.convert-7N2H2SVK.js");
+      const { runDocsConvert } = await import("./mesh.convert-4BZC5PYA.js");
       const ok = await runDocsConvert(opts);
       if (!ok) process.exitCode = 1;
     })()
   );
   docs.command("list").description("List the published docs versions (each is an @mesh-tech/* baseline)").action(
     () => guarded(async () => {
-      const { runDocsList } = await import("./mesh.start-24YIFB4O.js");
+      const { runDocsList } = await import("./mesh.start-XKQW5DW4.js");
       await runDocsList();
     })()
   );
@@ -2198,7 +2198,7 @@ async function registryChecks(args) {
   const { fix, profile } = args;
   const probe = args.probe ?? probeRegistryToken;
   const login = args.login ?? (async () => {
-    const { runRegistryLogin } = await import("./mesh.registry-5U4L6256.js");
+    const { runRegistryLogin } = await import("./mesh.registry-KA3CNNPZ.js");
     await runRegistryLogin(void 0, profile ? { profile } : {});
   });
   const REGISTRY_FIX = registryFixCommand(profile);
@@ -2354,7 +2354,7 @@ function registerInitCommands(program) {
     `nothing deployed yet \u2014 scaffold a tenant platform repo for \`<tenant>.<env>\` (default env: ${PLATFORM_SETUP_DEFAULTS.env}) and print its deploy sequence`
   ).option("--region <region>", `--new-platform: AWS region (default: ${PLATFORM_SETUP_DEFAULTS.region})`).option("--domain <domain>", "--new-platform: base public domain you control; the core stack creates the zone {env}.{domain} and stops at the mesh-gateway Ingress until you delegate its NS records. No default \u2014 a placeholder scaffolds a zone that can never validate").option("--state-bucket <bucket>", "--new-platform: Pulumi state S3 bucket (default: {tenant}-mesh-platform-pulumi-state)").option("--create-state-bucket", "--new-platform: create the state bucket (versioned) if it does not exist").option("--no-create-state-bucket", "--new-platform: never create the state bucket; print the aws command instead").option("--dir <path>", "--new-platform: where to scaffold the platform repo (default: ./{tenant}-mesh-platform)").option("--device", "device-code sign-in for the registry and platform steps (headless / SSH)").option("--profile <aws-profile>", "AWS profile this machine uses: read the registry without the broker (deployers only), and the profile a --new-platform stack config references").option("--skip-repo", "do not bootstrap, check or record anything in the current repo", false).option("--yes", "accept every default and never prompt", false).option("--json", "one JSON document on stdout ({tenant, mode, steps, next}); human output on stderr", false).action(
     async (opts) => {
-      const { runInitWizard } = await import("./mesh.wizard-6HMOBC5L.js");
+      const { runInitWizard } = await import("./mesh.wizard-I7HPLDDY.js");
       const code = await runInitWizard(opts);
       if (code !== 0) process.exitCode = code;
     }
@@ -2370,7 +2370,7 @@ function registerInitCommands(program) {
         throw new MeshCliError(`Invalid tenant name '${tenant}' (lowercase alphanumeric + dashes).`);
       }
       const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
-      const { resolvePlatformSetup, scaffoldPlatformRepo, ensureStateBucket, renderPlatformNextSteps } = await import("./mesh.platform-setup-PCDLE2EI.js");
+      const { resolvePlatformSetup, scaffoldPlatformRepo, ensureStateBucket, renderPlatformNextSteps } = await import("./mesh.platform-setup-LVFHW263.js");
       const setup = await resolvePlatformSetup(tenant, opts, {
         prompts: interactive && !opts.yes ? await setupPrompts() : void 0,
         interactive
@@ -2879,6 +2879,24 @@ async function buildHubImagesFromSource(repoRoot) {
   return version;
 }
 
+// packages/api-registry/src/ssm-chunks.ts
+import { createHash } from "node:crypto";
+var SSM_CHUNK_MANIFEST_PREFIX = "mesh.ssm-chunks/v1 ";
+var SSM_CHUNK_PART_PREFIX = "mesh.ssm-chunk ";
+var SSM_VALUE_MAX_BYTES = 8 * 1024;
+var SSM_CHUNK_RAW_BYTES = 6e3;
+var ssmChunkPartPath = (basePath, index) => `${basePath}/part-${index}`;
+var chunkSsmValue = (body, maxBytes = SSM_VALUE_MAX_BYTES) => {
+  const bytes = Buffer.from(body, "utf8");
+  if (bytes.length <= maxBytes) return { value: body, parts: [] };
+  const parts = [];
+  for (let offset = 0; offset < bytes.length; offset += SSM_CHUNK_RAW_BYTES) {
+    parts.push(SSM_CHUNK_PART_PREFIX + bytes.subarray(offset, offset + SSM_CHUNK_RAW_BYTES).toString("base64"));
+  }
+  const manifest = { parts: parts.length, sha256: createHash("sha256").update(bytes).digest("hex") };
+  return { value: SSM_CHUNK_MANIFEST_PREFIX + JSON.stringify(manifest), parts };
+};
+
 // packages/mesh-cli/src/commands/local/seed-hub-catalog.ts
 var HUB_AUTHZ_POINTER_PARAM = `/mesh-platform/${LOCAL_TENANT}/${LOCAL_ENV}/apps/hub/stacks/local/authz`;
 var HUB_OPS_HUB_METADATA_PARAM = `${HUB_AUTHZ_POINTER_PARAM}/ops-hub-metadata`;
@@ -2890,21 +2908,30 @@ function withHubCatalogRefs(pointer, metadataRef) {
     mode: typeof pointer.mode === "string" ? pointer.mode : "policy-engine"
   };
 }
+function catalogParameters(metadata) {
+  const { value, parts } = chunkSsmValue(JSON.stringify(metadata));
+  return [
+    ...parts.map((part, i) => ({ name: ssmChunkPartPath(HUB_OPS_HUB_METADATA_PARAM, i), value: part })),
+    // Parts land before the manifest that names them.
+    { name: HUB_OPS_HUB_METADATA_PARAM, value }
+  ];
+}
 async function publishHubAuthzCatalog(compiled, awsConfig) {
   const { SSMClient: SSMClient3, GetParameterCommand, PutParameterCommand } = await import("@aws-sdk/client-ssm");
   const ssm = new SSMClient3(awsConfig);
-  await ssm.send(
-    new PutParameterCommand({
-      Name: HUB_OPS_HUB_METADATA_PARAM,
-      Type: "String",
-      // The blob is ~7.5 KB — past the 4 KB standard tier, within Advanced (8 KB),
-      // the tier the platform's Export uses for the same param.
-      Tier: "Advanced",
-      Overwrite: true,
-      Value: JSON.stringify(compiled.metadata),
-      Description: "Hub role catalog \u2014 ops-hub-metadata (local analog of MeshHub's SpiceDBSchema export)"
-    })
-  );
+  for (const { name, value } of catalogParameters(compiled.metadata)) {
+    await ssm.send(
+      new PutParameterCommand({
+        Name: name,
+        Type: "String",
+        // Past the 4 KB standard tier, the tier the platform's Export uses for the same param.
+        Tier: "Advanced",
+        Overwrite: true,
+        Value: value,
+        Description: "Hub role catalog \u2014 ops-hub-metadata (local analog of MeshHub's SpiceDBSchema export)"
+      })
+    );
+  }
   let current = {};
   try {
     const existing = await ssm.send(new GetParameterCommand({ Name: HUB_AUTHZ_POINTER_PARAM }));
@@ -3372,7 +3399,7 @@ function registerMcpCommands(program) {
     "--secret <id>",
     "Secrets Manager secret holding the Integration credential (default: the deployed ExternalService's own secret)"
   ).action(async (manifest, opts) => {
-    const { runMcpReviewCommand } = await import("./mesh.review-command-MLBWVHF7.js");
+    const { runMcpReviewCommand } = await import("./mesh.review-command-3ZXPS6Y3.js");
     try {
       await runMcpReviewCommand(manifest, opts);
     } catch (error) {
@@ -3407,7 +3434,7 @@ function registerMcpCommands(program) {
           `No pnpm-workspace.yaml above ${serveDir}: the worker image installs this package from a pnpm workspace, so it must be in one.`
         );
       } else if (!membership.member && membership.suggestedGlob) {
-        const { ensureWorkspaceGlobs } = await import("./mesh.create-app-GQIGCZNI.js");
+        const { ensureWorkspaceGlobs } = await import("./mesh.create-app-3HYMOLXT.js");
         const added = ensureWorkspaceGlobs(path9.dirname(membership.workspaceFile), [
           membership.suggestedGlob
         ]);
@@ -3918,7 +3945,7 @@ function registerSecretsCommands(program) {
 }
 
 // packages/mesh-cli/src/commands/site.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 import { createReadStream } from "node:fs";
 import { readdir, readFile, stat } from "node:fs/promises";
 import { join as join10, relative as relative4, resolve as resolve5, sep } from "node:path";
@@ -3935,7 +3962,7 @@ async function describeSiteHttpError(res, target, site) {
   return describeHttpError(res, target, { id: site });
 }
 async function hashFile(absolute) {
-  const h = createHash("sha256");
+  const h = createHash2("sha256");
   await new Promise((res, rej) => {
     createReadStream(absolute).on("data", (chunk) => h.update(chunk)).on("end", () => res()).on("error", rej);
   });
@@ -6400,7 +6427,7 @@ async function resolveToken(opts) {
   if (opts.token) return opts.token;
   if (process.env.VCS_TOKEN) return process.env.VCS_TOKEN;
   if (opts.context) {
-    const { getValidToken: getValidToken2 } = await import("./mesh.login-N5LPLRRX.js");
+    const { getValidToken: getValidToken2 } = await import("./mesh.login-Q6R5GMVM.js");
     const token = await getValidToken2(opts.context);
     if (token) return token;
   }