@mesh-tech/mesh-cli 0.43.3 → 0.44.0

package/dist/bin/mesh.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import {
   createProgram
-} from "./mesh.chunk-VCQKLVZJ.js";
+} from "./mesh.chunk-XOCERV6F.js";
 import "./mesh.chunk-QUKWWFZI.js";
 import {
   formatVersionLine,
   resolveCliRuntime
-} from "./mesh.chunk-OOWKJR4H.js";
+} from "./mesh.chunk-OQA2UBOD.js";
 import "./mesh.chunk-QE5LUIHN.js";
 import "./mesh.chunk-ZNM3DDAM.js";
 import "./mesh.chunk-PANTMVC3.js";

package/dist/bin/{mesh.program-GEKNV2LY.js → mesh.program-NOBVA3JS.js}

@@ -2,9 +2,9 @@ import {
   CLI_DESCRIPTION,
   CLI_NAME,
   createProgram
-} from "./mesh.chunk-VCQKLVZJ.js";
+} from "./mesh.chunk-XOCERV6F.js";
 import "./mesh.chunk-QUKWWFZI.js";
-import "./mesh.chunk-OOWKJR4H.js";
+import "./mesh.chunk-OQA2UBOD.js";
 import "./mesh.chunk-QE5LUIHN.js";
 import "./mesh.chunk-ZNM3DDAM.js";
 import "./mesh.chunk-PANTMVC3.js";

package/dist/bin/{mesh.start-HE6P3TCS.js → mesh.start-JDSYIRZI.js}

@@ -4,7 +4,7 @@ import {
   reportAssembly,
   resolveCliRuntime,
   runAssemble
-} from "./mesh.chunk-OOWKJR4H.js";
+} from "./mesh.chunk-OQA2UBOD.js";
 import {
   logError,
   logInfo,

package/dist/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "67750469b",
-  "builtAt": "2026-11-09T14:05:29.095Z"
+  "commit": "d86991f76",
+  "builtAt": "2026-11-12T18:37:32.328Z"
 }

package/dist/src/commands/workflow.d.ts

@@ -1,2 +1,16 @@
 import { Command } from "commander";
+interface ExtractedWorkflow {
+    workflowType: string;
+    ir: {
+        name: string;
+        nodes: unknown[];
+        edges: unknown[];
+    };
+    sourceFile: string;
+}
+export declare function workflowIrFiles(appName: string, workflows: ExtractedWorkflow[], root: string): {
+    name: string;
+    body: string;
+}[];
 export declare function registerWorkflowCommands(program: Command): void;
+export {};

package/dist/src/commands/workflow.js

@@ -123,7 +123,7 @@ const target = ${JSON.stringify(targetPath)};
 const explicitProcessArtifact = ${JSON.stringify(explicitProcessArtifact ?? null)};
 const stat = statSync(target);
 const files = stat.isDirectory()
-  ? readdirSync(target).filter(f => f.endsWith(".ts") && f !== "index.ts").map(f => join(target, f))
+  ? readdirSync(target).filter(f => f.endsWith(".ts") && f !== "index.ts" && !/\\.(test|spec|d)\\.ts$/.test(f)).map(f => join(target, f))
   : [target];
 
 const results = [];
@@ -168,7 +168,7 @@ ${DISCOVERY_HELPERS_SRC}
 const target = ${JSON.stringify(targetPath)};
 const stat = statSync(target);
 const files = stat.isDirectory()
-  ? readdirSync(target).filter(f => f.endsWith(".ts") && f !== "index.ts").map(f => join(target, f))
+  ? readdirSync(target).filter(f => f.endsWith(".ts") && f !== "index.ts" && !/\\.(test|spec|d)\\.ts$/.test(f)).map(f => join(target, f))
   : [target];
 
 const results = [];
@@ -220,7 +220,7 @@ const target = ${JSON.stringify(targetPath)};
 const explicitProcessArtifact = ${JSON.stringify(explicitProcessArtifact ?? null)};
 const stat = statSync(target);
 const files = stat.isDirectory()
-  ? readdirSync(target).filter(f => f.endsWith(".ts") && f !== "index.ts").map(f => join(target, f))
+  ? readdirSync(target).filter(f => f.endsWith(".ts") && f !== "index.ts" && !/\\.(test|spec|d)\\.ts$/.test(f)).map(f => join(target, f))
   : [target];
 
 const results = [];
@@ -253,40 +253,37 @@ process.stdout.write(JSON.stringify(results));
         return null;
     }
 }
-async function uploadToS3(bucket, appName, workflows) {
-    const { S3Client, PutObjectCommand } = await import("@aws-sdk/client-s3");
-    const s3 = new S3Client({ region: process.env.AWS_REGION ?? "us-east-2" });
-    for (const wf of workflows) {
-        const key = `workflow-ir/${appName}/${wf.workflowType}.json`;
-        const body = JSON.stringify(wf.ir, null, 2);
-        logInfo(`  Uploading s3://${bucket}/${key} (${body.length} bytes)`);
-        await s3.send(new PutObjectCommand({
-            Bucket: bucket,
-            Key: key,
-            Body: body,
-            ContentType: "application/json",
-        }));
-    }
+export function workflowIrFiles(appName, workflows, root) {
     const manifest = {
         extractedAt: new Date().toISOString(),
         app: appName,
         workflows: Object.fromEntries(workflows.map((wf) => [
             wf.workflowType,
             {
-                sourceFile: wf.sourceFile,
+                sourceFile: path.relative(root, wf.sourceFile) || path.basename(wf.sourceFile),
                 nodeCount: wf.ir.nodes.length,
                 edgeCount: wf.ir.edges.length,
             },
         ])),
     };
-    const manifestKey = `workflow-ir/${appName}/_manifest.json`;
-    logInfo(`  Uploading s3://${bucket}/${manifestKey}`);
-    await s3.send(new PutObjectCommand({
-        Bucket: bucket,
-        Key: manifestKey,
-        Body: JSON.stringify(manifest, null, 2),
-        ContentType: "application/json",
-    }));
+    return [
+        ...workflows.map((wf) => ({ name: `${wf.workflowType}.json`, body: JSON.stringify(wf.ir, null, 2) })),
+        { name: "_manifest.json", body: JSON.stringify(manifest, null, 2) },
+    ];
+}
+async function uploadToS3(bucket, appName, files) {
+    const { S3Client, PutObjectCommand } = await import("@aws-sdk/client-s3");
+    const s3 = new S3Client({ region: process.env.AWS_REGION ?? "us-east-2", followRegionRedirects: true });
+    for (const file of files) {
+        const key = `workflow-ir/${appName}/${file.name}`;
+        logInfo(`  Uploading s3://${bucket}/${key} (${file.body.length} bytes)`);
+        await s3.send(new PutObjectCommand({
+            Bucket: bucket,
+            Key: key,
+            Body: file.body,
+            ContentType: "application/json",
+        }));
+    }
 }
 function parseNameList(value) {
     return value
@@ -307,6 +304,7 @@ export function registerWorkflowCommands(program) {
         "Supports single files or directories.")
         .option("--app <name>", "Application name (used as S3 key prefix)")
         .option("--upload <bucket>", "S3 bucket to upload extracted IR (requires --app)")
+        .option("--out <dir>", "Write the files the upload would write (one JSON per workflow type, plus _manifest.json) to a directory (requires --app)")
         .option("--process <path>", "Path to a process artifact JSON file (docs/plans/2026-07-05-process-artifact-design.md §1); " +
         "renders substeps/actors/outcomes in place of a BUSINESS_STAGES map. Absent this flag, a sibling " +
         "process/*.process.json is auto-discovered per workflow file.")
@@ -346,15 +344,29 @@ export function registerWorkflowCommands(program) {
             for (const wf of results) {
                 logSuccess(`  ${wf.workflowType} (${wf.ir.nodes.length} nodes, ${wf.ir.edges.length} edges)`);
             }
-            if (opts.upload && opts.app) {
+            if ((opts.upload || opts.out) && !opts.app) {
+                logError("--upload and --out need --app (the IR's key prefix)");
+                process.exitCode = 1;
+                return;
+            }
+            const root = fs.statSync(resolvedPath).isDirectory() ? resolvedPath : path.dirname(resolvedPath);
+            const files = opts.app ? workflowIrFiles(opts.app, results, root) : [];
+            if (opts.out) {
+                const outDir = path.resolve(opts.out);
+                fs.mkdirSync(outDir, { recursive: true });
+                for (const file of files)
+                    fs.writeFileSync(path.join(outDir, file.name), file.body);
+                logSuccess(`Wrote ${files.length} file(s) to ${outDir}`);
+            }
+            if (opts.upload) {
                 logInfo(`Uploading ${results.length} workflow IR(s) to s3://${opts.upload}/workflow-ir/${opts.app}/`);
-                await uploadToS3(opts.upload, opts.app, results);
+                await uploadToS3(opts.upload, opts.app, files);
                 logSuccess("Upload complete");
             }
-            else if (opts.upload || opts.app) {
-                logWarn("Both --app and --upload required for S3 upload");
+            else if (opts.app && !opts.out) {
+                logWarn("--app does nothing without --upload or --out");
             }
-            else {
+            if (!opts.upload && !opts.out) {
                 console.log(JSON.stringify(results.map((r) => r.ir), null, 2));
             }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mesh-tech/mesh-cli",
-  "version": "0.43.3",
+  "version": "0.44.0",
   "description": "CLI for Mesh platform development utilities",
   "type": "module",
   "license": "UNLICENSED",
@@ -42,7 +42,7 @@
   },
   "devDependencies": {
     "@mesh-tech/agent-contracts": "0.7.0",
-    "@mesh-tech/tsconfig": "2.61.1",
+    "@mesh-tech/tsconfig": "2.62.0",
     "@mesh-tech/workflow-viz": "0.3.4",
     "@tanstack/intent": "^0.3.6",
     "@types/node": "^20.0.0",

package/skills/mesh/SKILL.md

@@ -191,7 +191,7 @@ Top-level commands (each `register*` is wired in `src/program.ts`, which `bin/me
 | `mesh artifacts` | `get <ref>` | Download workflow artifact files from an AI-agent conversation. Ref `<conversationId>:<artifactId>` (artifactId defaults to `workflow-artifact`). | `-o/--output <dir>`, `--target <name>`, `--api-url <url>`, `--context <ctx>` (default `mesh.dev`) |
 | `mesh conversations` (alias `conv`) | `list`, `show <id>`, `artifacts <id>` | Read a deployed Mesh agent's conversations: list the caller's conversations, render a transcript, or list a conversation's artifacts. Resolves against the same `agent-targets` registry the MCP `agent_*` tools use. | all three: `--target <name>`, `--api-url <url>` (overrides `--target`), `--context <ctx>` (used with `--api-url`, default `mesh.dev`), `--json` (default when stdout isn't a TTY) |
 | `mesh vpn` | `connect <context>`, `disconnect`, `status`, `tunnel <up\|down\|status>`, `api-key`, `pre-auth-key`, `users` | Headscale VPN mgmt via Tailscale + kubectl. **`connect` now defaults to the userspace `tailscaled`** (brew formula, NOT the GUI Tailscale.app) — the same daemon `mesh dev --transport tailscale` / `mesh vpn tunnel` use, so it **runs headless / under the sandbox** and exposes a local SOCKS5 proxy (route a tool via `ALL_PROXY=socks5://127.0.0.1:<port>`). It relays a one-time browser-register URL for Zitadel auth. `--system` opts into the whole-machine GUI Tailscale.app (system TUN) — needs the app installed and **cannot run headless/sandboxed** (Sparkle.framework abort). For auto-forwarded VPC services (Temporal/RDS) prefer **`mesh vpn tunnel up`** or `mesh dev`. `tunnel status` reports runner **ownership** (`Runner: owned (verified)` vs `NOT OWNED (<reason>)` — a port answering a dial is not proof it's mesh's); `--json` adds `owned` (bool) + `ownership` (reason string). Admin subcommands `exec` into the `headscale-0` pod. | root: `-t/--tenant` (default `mesh`), `-e/--env` (default `dev`), `-n/--namespace`; `connect`/`disconnect`: `--system`; `tunnel up`: `--context <ctx>`; `tunnel down`: `--stop` (stop daemon, keep login), `--logout`; `tunnel status`: `--json`; `pre-auth-key`: `-u/--user` (**required**), `--expiration <24h>`, `--reusable`, `--ephemeral` |
-| `mesh workflow` | `extract-ir <path>`, `inventory <path>`, `lint-process <path>` | `extract-ir`: parse Temporal workflow TS source → WorkflowIR graph (nodes+edges); prints JSON or uploads to S3. `inventory`: the as-built `{workflowType, commands, queries, activities}` the process lint diffs against. `lint-process`: parse + conformance-lint a process artifact against that inventory; exits 1 on any error-severity finding. | `extract-ir`: `--app <name>`, `--upload <bucket>` (both required together for S3); `extract-ir`/`lint-process`: `--process <path>` (else a sibling `process/*.process.json` is discovered); `lint-process`: `--predicates <csv>`, `--selectors <csv>` — the CLI cannot execute the worker's registries, so without a flag those findings are skipped (a note is printed) while every other rule still runs |
+| `mesh workflow` | `extract-ir <path>`, `inventory <path>`, `lint-process <path>` | `extract-ir`: parse Temporal workflow TS source → WorkflowIR graph (nodes+edges); prints JSON, uploads to S3, or writes the same files to a directory (so a package can ship IR it extracted at build time). A directory's `*.test.ts`/`*.spec.ts`/`*.d.ts` files are skipped. `inventory`: the as-built `{workflowType, commands, queries, activities}` the process lint diffs against. `lint-process`: parse + conformance-lint a process artifact against that inventory; exits 1 on any error-severity finding. | `extract-ir`: `--app <name>`, `--upload <bucket>`, `--out <dir>` (`--upload` and `--out` each need `--app`); `extract-ir`/`lint-process`: `--process <path>` (else a sibling `process/*.process.json` is discovered); `lint-process`: `--predicates <csv>`, `--selectors <csv>` — the CLI cannot execute the worker's registries, so without a flag those findings are skipped (a note is printed) while every other rule still runs |
 | `mesh site` | `publish <name> <dir>`, `versions <name>`, `rollback <name> <version>` | Publish a built directory as an OAuth-protected static site served by Studio, content-addressed and incremental: `publish` walks and hashes the tree, uploads only the blobs the site does not already hold, then commits a version and points the site at it; `versions` lists what has been published, newest first; `rollback` points the site back at an earlier version. Three stateless calls against the agent-api, so a run that dies partway leaves nothing to clean up. | all: `--target <name>`, `--api-url <url>`, `--context <ctx>`; `publish`: `--version-id <id>`, `--no-activate` (publish without pointing the site at it) |
 | `mesh vcs` | `clone <repo> [dest]`, `get <repo> <path>`, `propose`, `rm <repo> <paths...>`, `proposals`/`show`/`diff`/`approve`/`reject`/`comment`/`request-changes`, `drafts <list\|show\|create\|submit\|discard>` | Versioned content repos (`mesh.vcs`). Repos are real git repos over smart HTTP but **read-only** — every change goes through a proposal. `clone` wires the bearer auth header into the clone; `propose` submits the working tree (binary content is base64-encoded from the bytes, not the extension, so images survive intact); **`rm` proposes deletions of files or folders with no clone at all**, and `--dry-run` lists what would go without proposing anything. | all: `--url <base>`, `--token <t>`, `--context <ctx>`; `propose`: `-m/--message`, `--revise <id>`, `--merge-parent <sha>`; `rm`: `-m/--message`, `--dry-run` |
 | `mesh temporal` | `describe <wfId> [runId]`, `history <wfId> [runId]`, `recover-conversation <wfId> [runId]`, `capture-history <wfId> [runId]` | Inspect Temporal workflows for the current app/stack; reconstruct an agent conversation transcript from durable history when the worker can't replay it; capture a full history to a local replay fixture. | shared: `--stack`, `--address`, `--namespace`; `history`: `-n/--limit <200>`, `-f/--follow`, `--no-compact`, `-p/--show-payloads` (decrypts via `TEMPORAL_ENCODING_KEY` from the K8s secret); `recover-conversation`: `--out <path>`, `--json`, `--snapshot` (structured `{conversationId,messages,artifacts,focus}` blob); `capture-history`: `--out <path>` (default `~/.mesh/replay-histories/<wfId>.json`, do not commit) | <!-- skill-lint-disable-next-line — row documents the mesh-owned kubectl wrappers; the backticked `aws eks get-token` describes what the CLI runs internally, not an operator step -->
@@ -483,7 +483,7 @@ the program (…); run `mesh deploy up --stack <s>` to refresh the dev env.").
 | 401 installing a **public** package (`npm view lodash version` fails) | an unscoped `registry=<codeartifact>` line in `~/.npmrc` makes CodeArtifact the DEFAULT registry, so public packages resolve through it and 401 at the 12h token expiry | `mesh registry login` — it removes the line after backing `~/.npmrc` up; confirm with `npm config get registry` (expect `https://registry.npmjs.org/`) |
 | `--export` prints nothing | no role resolved | pass `--role <arn>` or set `MESH_AWS_ROLE` |
 | `--export` / `EPERM … ~/.aws` in a sandbox | `~/.aws` not writable | it now auto-falls back to a mesh-managed config (`~/.config/mesh/aws-config`) and also exports `AWS_CONFIG_FILE`; or prefer `mesh deploy <op>` (no shell profile needed) |
-| `workflow extract-ir` no S3 upload | only one of `--app`/`--upload` given | pass both, or omit both to print JSON |
+| `workflow extract-ir` exits 1: `--upload and --out need --app` | `--upload` or `--out` without `--app` | add `--app <name>`; `--app` alone only prints JSON |
 
 ## Programmatic API