@mesh-tech/mesh-cli 0.44.0 → 0.45.0

package/dist/src/commands/workstation.js

@@ -0,0 +1,395 @@
+import { execFileSync, spawn, spawnSync } from "child_process";
+import { promises as dns } from "dns";
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { logError, logInfo, logSuccess, logWarn } from "../utils/log.js";
+import { listRoutes, readWorkstationIdentity, renderWorkstationCaddyfile, workstationDir, } from "../utils/workstation-routes.js";
+import { renderCredentialProcessProfile, upsertManagedAwsConfigSection } from "../utils/aws-auth.js";
+import { LAUNCH_AGENT_LABEL, LAUNCH_AGENTS_MACOS_ONLY, launchAgentsSupported, caddyDownloadUrl, caddyHasRoute53, certificateExpiry, credentialProcessProblem, discoveryRecordName, isInsideGitTree, zoneCandidates, readCredentialProcess, renderLaunchAgent, launchAgentSearchPath, parseDiscoveryRecord, rewriteCredentialProgram, shimFallsBackToGlobal, workstationWarnings, awsConfigFileOf, profileYieldsCredentials, proxyEnv, } from "../utils/workstation-machine.js";
+export { proxyEnv } from "../utils/workstation-machine.js";
+function tmuxSessionAlive(name) {
+    try {
+        execFileSync("tmux", ["has-session", "-t", `=${name}`], { stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function profileProblem(proxy) {
+    if (!proxy.awsProfile)
+        return undefined;
+    let text;
+    try {
+        text = fs.readFileSync(awsConfigFileOf(proxy), "utf8");
+    }
+    catch (e) {
+        return `cannot read ${awsConfigFileOf(proxy)}: ${e.message}`;
+    }
+    return credentialProcessProblem(readCredentialProcess(text, proxy.awsProfile), {
+        exists: (p) => fs.existsSync(p),
+        isInsideGitTree,
+    });
+}
+function adminPortInUse() {
+    try {
+        execFileSync("lsof", ["-nP", "-iTCP@127.0.0.1:2119", "-sTCP:LISTEN"], { stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function launchAgentPath() {
+    return path.join(os.homedir(), "Library", "LaunchAgents", `${LAUNCH_AGENT_LABEL}.plist`);
+}
+function launchctl(args) {
+    return launchctlRun(args).ok;
+}
+function launchctlRun(args) {
+    const r = spawnSync("launchctl", args, { encoding: "utf8" });
+    return { ok: r.status === 0, output: `${r.stdout ?? ""}${r.stderr ?? ""}`.trim() };
+}
+function sleepMs(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function reloadLaunchAgent(domain, plist) {
+    const service = `${domain}/${LAUNCH_AGENT_LABEL}`;
+    launchctl(["bootout", service]);
+    for (let i = 0; i < 50 && launchctl(["print", service]); i++)
+        sleepMs(100);
+    let last = { ok: false, output: "" };
+    for (let attempt = 0; attempt < 5; attempt++) {
+        last = launchctlRun(["bootstrap", domain, plist]);
+        if (last.ok)
+            return last;
+        sleepMs(500);
+    }
+    return last;
+}
+const WORKSTATION_PROFILE = "mesh-workstation";
+function fail(message) {
+    logError(message);
+    process.exit(1);
+}
+async function lookupTxt(resolver, record) {
+    try {
+        return (await resolver.resolveTxt(record)).map((chunks) => chunks.join(""));
+    }
+    catch (e) {
+        return e.code ?? e.message;
+    }
+}
+async function lookupTxtAtZone(platform, record) {
+    for (const zone of zoneCandidates(platform)) {
+        let servers;
+        try {
+            servers = await dns.resolveNs(zone);
+        }
+        catch {
+            continue;
+        }
+        const ips = (await Promise.all(servers.map((ns) => dns.resolve4(ns).catch(() => [])))).flat();
+        if (ips.length === 0)
+            continue;
+        const resolver = new dns.Resolver();
+        resolver.setServers(ips);
+        return lookupTxt(resolver, record);
+    }
+    return "no name servers found";
+}
+function firstDiscovery(values) {
+    if (typeof values === "string")
+        return undefined;
+    return values.map((v) => parseDiscoveryRecord(v)).find((p) => typeof p !== "string");
+}
+async function discoverWorkstation(name, platform) {
+    const record = discoveryRecordName(name, platform);
+    const viaResolver = await lookupTxt(dns, record);
+    const found = firstDiscovery(viaResolver);
+    if (found)
+        return found;
+    const viaZone = await lookupTxtAtZone(platform, record);
+    const direct = firstDiscovery(viaZone);
+    if (direct) {
+        logInfo(`Your resolver has not seen ${record} yet; the zone's name servers answered`);
+        return direct;
+    }
+    const why = typeof viaZone === "string" ? viaZone : "no v=1 record";
+    fail(`No discovery record ${record} (${why}): is "${name}" in the platform's workstation stack, and deployed?`);
+}
+function requireFallbackShim(cli) {
+    let text;
+    try {
+        text = fs.readFileSync(cli, "utf8");
+    }
+    catch {
+        fail(`No mesh shim at ${cli}. Install one: npm i -g @mesh-tech/mesh-cli && mesh install-shim (or pass --cli <path>)`);
+    }
+    if (!shimFallsBackToGlobal(text)) {
+        fail(`${cli} is an older shim that fails outside a workspace, where renewal runs. Update it: mesh install-shim --force`);
+    }
+}
+async function ensureCaddy(dir) {
+    const caddy = path.join(dir, "bin", "caddy");
+    const hasRoute53 = (bin) => {
+        try {
+            return caddyHasRoute53(execFileSync(bin, ["list-modules"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }));
+        }
+        catch {
+            return false;
+        }
+    };
+    if (fs.existsSync(caddy) && hasRoute53(caddy))
+        return caddy;
+    const url = caddyDownloadUrl(process.platform, process.arch);
+    logInfo(`Downloading Caddy with the Route 53 module (${url})...`);
+    const resp = await fetch(url);
+    if (!resp.ok)
+        fail(`Caddy download failed: HTTP ${resp.status}. Build it instead (xcaddy build --with github.com/caddy-dns/route53) and pass --caddy`);
+    fs.mkdirSync(path.dirname(caddy), { recursive: true });
+    const tmp = `${caddy}.download`;
+    fs.writeFileSync(tmp, Buffer.from(await resp.arrayBuffer()), { mode: 0o755 });
+    if (!hasRoute53(tmp)) {
+        fs.rmSync(tmp, { force: true });
+        fail("The downloaded Caddy has no dns.providers.route53 module");
+    }
+    fs.renameSync(tmp, caddy);
+    logSuccess(`Caddy: ${caddy}`);
+    return caddy;
+}
+function writeCaddyfile(dir, identity) {
+    const caddyfile = path.join(dir, "Caddyfile");
+    fs.mkdirSync(path.join(dir, "routes"), { recursive: true });
+    fs.writeFileSync(caddyfile, renderWorkstationCaddyfile(identity, dir));
+    return caddyfile;
+}
+function requireIdentity(dir) {
+    const identity = readWorkstationIdentity(dir);
+    if (!identity) {
+        logError(`This machine is not a workstation (no ${path.join(dir, "workstation.json")}). Run: mesh workstation init`);
+        process.exit(1);
+    }
+    return identity;
+}
+export function registerWorkstationCommands(program) {
+    const ws = program
+        .command("workstation")
+        .description("HTTPS names on this machine for the services it runs (dev servers, local stacks)");
+    ws.command("init")
+        .description("Make this machine a workstation: its name, certificate credentials and proxy binary")
+        .requiredOption("--name <label>", "this machine's host label in the workstation stack (e.g. mbp)")
+        .option("--platform <domain>", "the platform it is named under (e.g. dev.acme.example.com): the rest is discovered")
+        .option("--domain <domain>", "without --platform: <name>.<platform zone>")
+        .option("--zone-id <id>", "the Route 53 zone (default: discovered)")
+        .option("--region <region>", "AWS region for Route 53 (default: discovered, else us-east-2)")
+        .option("--aws-profile <profile>", "use this existing profile instead of writing one")
+        .option("--aws-config-file <file>", "the AWS config file holding --aws-profile")
+        .option("--caddy <path>", "Caddy built with github.com/caddy-dns/route53 (default: downloaded)")
+        .option("--cli <path>", "the mesh CLI the profile runs (default: the shim, ~/.local/bin/mesh)")
+        .option("--allow-checkout-cli", "accept a credential_process inside a git checkout (renewal breaks when it is removed)")
+        .option("--force", "overwrite an existing workstation.json")
+        .action(async (opts) => {
+        const dir = workstationDir();
+        const file = path.join(dir, "workstation.json");
+        if (fs.existsSync(file) && !opts.force)
+            fail(`${file} exists; --force to replace it`);
+        fs.mkdirSync(dir, { recursive: true });
+        let domain;
+        let zoneId = opts.zoneId;
+        let region = opts.region;
+        let roleArn;
+        if (opts.platform) {
+            domain = `${opts.name}.${opts.platform.replace(/\.$/, "")}`;
+            if (opts.domain && opts.domain !== domain)
+                fail(`--domain ${opts.domain} is not ${domain} (--name under --platform)`);
+            const found = await discoverWorkstation(opts.name, opts.platform);
+            roleArn = found.roleArn;
+            zoneId ??= found.zoneId;
+            region ??= found.region;
+            logInfo(`Discovered ${domain}: zone ${found.zoneId}, role ${found.roleArn.split("/").pop()}`);
+        }
+        else {
+            if (!opts.domain || !zoneId)
+                fail("Give --platform <domain> (everything else is discovered), or --domain and --zone-id");
+            domain = opts.domain;
+        }
+        if (!domain.startsWith(`${opts.name}.`))
+            fail(`--domain must be under --name: ${opts.name}.<zone>`);
+        region ??= "us-east-2";
+        const cli = path.resolve(opts.cli ?? path.join(os.homedir(), ".local", "bin", "mesh"));
+        let awsProfile = opts.awsProfile;
+        let awsConfigFile = opts.awsConfigFile ? path.resolve(opts.awsConfigFile) : undefined;
+        if (!awsProfile) {
+            if (!opts.platform || !roleArn)
+                fail("Without --platform, give --aws-profile (a mesh login --export profile)");
+            if (!opts.cli)
+                requireFallbackShim(cli);
+            awsProfile = WORKSTATION_PROFILE;
+            awsConfigFile = path.join(dir, "aws-config");
+            const profile = renderCredentialProcessProfile({ profileName: awsProfile, context: opts.platform, roleArn, region, meshBin: cli });
+            const existing = fs.existsSync(awsConfigFile) ? fs.readFileSync(awsConfigFile, "utf8") : "";
+            fs.writeFileSync(awsConfigFile, upsertManagedAwsConfigSection(existing, `workstation ${opts.platform}`, profile));
+            logSuccess(`${awsConfigFile}: [profile ${awsProfile}] runs ${cli}`);
+        }
+        else if (opts.cli) {
+            const configFile = awsConfigFile ?? path.join(os.homedir(), ".aws", "config");
+            fs.writeFileSync(configFile, rewriteCredentialProgram(fs.readFileSync(configFile, "utf8"), awsProfile, cli));
+            logSuccess(`${configFile}: [profile ${awsProfile}] now runs ${cli}`);
+        }
+        const caddy = opts.caddy ? path.resolve(opts.caddy) : await ensureCaddy(dir);
+        const identity = {
+            name: opts.name,
+            domain,
+            proxy: {
+                zoneId: zoneId,
+                region,
+                awsProfile,
+                ...(awsConfigFile ? { awsConfigFile } : {}),
+                caddy,
+            },
+        };
+        const proxy = identity.proxy;
+        const problem = profileProblem(proxy);
+        if (problem && !opts.allowCheckoutCli) {
+            logError(`The profile ${awsProfile} will not keep renewing the certificate: ${problem}.`);
+            logInfo("  Point it at a mesh CLI outside any checkout: --cli <path>, or --allow-checkout-cli to accept it.");
+            process.exit(1);
+        }
+        if (problem)
+            logWarn(`Accepted (--allow-checkout-cli): ${problem}.`);
+        if (!profileYieldsCredentials(proxy)) {
+            if (!opts.platform)
+                fail(`The profile ${awsProfile} yields no AWS credentials yet: run its mesh login, then init again`);
+            logInfo(`Signing in to ${opts.platform} for the certificate role...`);
+            const login = spawnSync(process.execPath, [...process.execArgv, process.argv[1], "login", opts.platform], { stdio: "inherit" });
+            if (login.status !== 0 || !profileYieldsCredentials(proxy)) {
+                fail(`The profile ${awsProfile} still yields no credentials for ${roleArn}: is your Zitadel user one of the stack's subjects?`);
+            }
+        }
+        fs.mkdirSync(path.join(dir, "routes"), { recursive: true });
+        fs.writeFileSync(file, JSON.stringify(identity, null, 2) + "\n");
+        logSuccess(`Workstation ${opts.name}: https://*.${domain} (${file})`);
+        logInfo("Keep its proxy running with: mesh workstation proxy --install");
+    });
+    ws.command("proxy")
+        .description("Run the workstation's proxy (Caddy) in the foreground: certificate, routes, reloads")
+        .option("--print", "print the Caddyfile and the command instead of running")
+        .option("--install", "run it as a LaunchAgent (starts now, at login, and again if it exits)")
+        .option("--uninstall", "stop the LaunchAgent and remove it")
+        .action((opts) => {
+        const dir = workstationDir();
+        const domain = `gui/${os.userInfo().uid}`;
+        if ((opts.install || opts.uninstall) && !launchAgentsSupported()) {
+            logError(LAUNCH_AGENTS_MACOS_ONLY);
+            process.exit(1);
+        }
+        if (opts.uninstall) {
+            launchctl(["bootout", `${domain}/${LAUNCH_AGENT_LABEL}`]);
+            fs.rmSync(launchAgentPath(), { force: true });
+            logSuccess(`Removed the ${LAUNCH_AGENT_LABEL} LaunchAgent`);
+            return;
+        }
+        const identity = requireIdentity(dir);
+        if (!identity.proxy) {
+            logError("workstation.json has no proxy settings. Run: mesh workstation init --force …");
+            process.exit(1);
+        }
+        const proxy = identity.proxy;
+        const caddyfile = writeCaddyfile(dir, { ...identity, proxy });
+        const caddy = proxy.caddy ?? "caddy";
+        const args = ["run", "--watch", "--config", caddyfile, "--adapter", "caddyfile"];
+        if (opts.print) {
+            console.log(fs.readFileSync(caddyfile, "utf8"));
+            console.log(`${caddy} ${args.join(" ")}`);
+            return;
+        }
+        if (opts.install) {
+            if (!launchctl(["print", `${domain}/${LAUNCH_AGENT_LABEL}`]) && adminPortInUse()) {
+                logError("Another workstation proxy is running (127.0.0.1:2119 answers). Stop it, then run --install again.");
+                process.exit(1);
+            }
+            const problem = profileProblem(proxy);
+            if (problem)
+                logWarn(`The profile will not keep renewing the certificate: ${problem}.`);
+            const env = proxyEnv({ PATH: launchAgentSearchPath(process.env.PATH, process.execPath), HOME: os.homedir() }, proxy);
+            const plist = renderLaunchAgent({ caddy, caddyfile, dir, env: env });
+            fs.mkdirSync(path.dirname(launchAgentPath()), { recursive: true });
+            fs.writeFileSync(launchAgentPath(), plist);
+            const loaded = reloadLaunchAgent(domain, launchAgentPath());
+            if (!loaded.ok) {
+                logError(`launchctl bootstrap failed for ${launchAgentPath()}${loaded.output ? `: ${loaded.output}` : ""}`);
+                process.exit(1);
+            }
+            logSuccess(`LaunchAgent ${LAUNCH_AGENT_LABEL}: serving https://*.${identity.domain} (log: ${path.join(dir, "proxy.log")})`);
+            return;
+        }
+        logInfo(`Serving https://*.${identity.domain} — routes in ${path.join(dir, "routes")}`);
+        const child = spawn(caddy, args, { stdio: "inherit", env: proxyEnv(process.env, identity.proxy) });
+        child.on("error", (e) => {
+            logError(`Could not start ${caddy}: ${e.message}. Build it with: xcaddy build --with github.com/caddy-dns/route53`);
+            process.exit(1);
+        });
+        child.on("exit", (code) => process.exit(code ?? 1));
+    });
+    ws.command("routes")
+        .description("List the HTTPS names this workstation serves")
+        .option("--prune", "remove routes of mesh dev sessions that are no longer running")
+        .option("--json", "print JSON")
+        .action((opts) => {
+        const dir = workstationDir();
+        requireIdentity(dir);
+        let routes = listRoutes(dir).map((r) => ({
+            ...r,
+            alive: r.session ? tmuxSessionAlive(r.session) : undefined,
+        }));
+        if (opts.prune) {
+            for (const r of routes.filter((r) => r.session && !r.alive)) {
+                fs.rmSync(r.file, { force: true });
+                logInfo(`Removed ${r.hostname} (session ${r.session} is not running)`);
+            }
+            routes = routes.filter((r) => !r.session || r.alive);
+        }
+        if (opts.json) {
+            console.log(JSON.stringify(routes, null, 2));
+            return;
+        }
+        if (routes.length === 0) {
+            logInfo("No routes.");
+            return;
+        }
+        for (const r of routes) {
+            const owner = r.session ? `mesh dev ${r.session}${r.alive ? "" : " (not running)"}` : "stack";
+            console.log(`  https://${r.hostname.padEnd(56)} → :${String(r.port).padEnd(6)} ${owner}`);
+        }
+        if (routes.some((r) => r.session && !r.alive))
+            logWarn("Clear routes of stopped sessions with: mesh workstation routes --prune");
+    });
+    ws.command("status")
+        .description("Is this workstation healthy: proxy running, certificate fresh, renewal credentials alive")
+        .action(() => {
+        const dir = workstationDir();
+        const identity = requireIdentity(dir);
+        const expiry = certificateExpiry(dir, identity.domain);
+        const launchd = launchAgentsSupported();
+        const agent = launchd && launchctl(["print", `gui/${os.userInfo().uid}/${LAUNCH_AGENT_LABEL}`]);
+        const problem = identity.proxy ? profileProblem(identity.proxy) : undefined;
+        const credentialOk = identity.proxy ? profileYieldsCredentials(identity.proxy) : true;
+        console.log(`  workstation   ${identity.name} (*.${identity.domain})`);
+        const proxyLine = !launchd
+            ? LAUNCH_AGENTS_MACOS_ONLY
+            : agent
+                ? `LaunchAgent ${LAUNCH_AGENT_LABEL}`
+                : "no LaunchAgent (mesh workstation proxy --install)";
+        console.log(`  proxy         ${proxyLine}`);
+        console.log(`  certificate   ${expiry ? `expires ${expiry.toISOString().slice(0, 10)}` : "none issued yet"}`);
+        console.log(`  credentials   ${credentialOk ? "ok" : "FAILING"}${identity.proxy?.awsProfile ? ` (profile ${identity.proxy.awsProfile})` : ""}`);
+        console.log(`  routes        ${listRoutes(dir).length}`);
+        const warnings = workstationWarnings({ now: new Date(), certExpiry: expiry, credentialOk, credentialProblem: problem });
+        for (const w of warnings)
+            logWarn(w);
+        if (warnings.length > 0)
+            process.exitCode = 1;
+    });
+}

package/dist/src/program.js

@@ -25,6 +25,7 @@ import { registerTunnelCommands } from "./commands/tunnel/index.js";
 import { registerVcsCommands } from "./commands/vcs/index.js";
 import { registerVpnCommands } from "./commands/vpn/index.js";
 import { registerWorkflowCommands } from "./commands/workflow.js";
+import { registerWorkstationCommands } from "./commands/workstation.js";
 export const CLI_NAME = "mesh";
 export const CLI_DESCRIPTION = "Build, run and deploy apps on a Mesh platform";
 export function createProgram(options = {}) {
@@ -58,5 +59,6 @@ export function createProgram(options = {}) {
     registerInitCommands(program);
     registerTenantCommands(program);
     registerInstallShimCommand(program);
+    registerWorkstationCommands(program);
     return program;
 }

package/dist/src/utils/temporal-inspect.d.ts

@@ -0,0 +1,17 @@
+export declare function enumMemberName(member: string, prefix: string): string;
+export declare function eventTypeNames(enumObject?: Record<string, unknown>): Record<number, string>;
+export declare const LIST_STATUSES: Record<string, string>;
+export declare function buildListQuery(opts: {
+    type?: string;
+    status?: string;
+    parent?: string;
+    query?: string;
+}): string;
+export type ListedExecution = {
+    workflowId: string;
+    type: string;
+    status: string;
+    startTime?: Date;
+    parentWorkflowId?: string;
+};
+export declare function formatListRows(rows: ListedExecution[]): string[];

package/dist/src/utils/temporal-inspect.js

@@ -0,0 +1,71 @@
+import { createRequire } from "node:module";
+export function enumMemberName(member, prefix) {
+    return member
+        .slice(prefix.length)
+        .toLowerCase()
+        .split("_")
+        .map((w) => w.charAt(0).toUpperCase() + w.slice(1))
+        .join("");
+}
+export function eventTypeNames(enumObject = loadEventTypeEnum()) {
+    const names = {};
+    for (const [member, value] of Object.entries(enumObject)) {
+        if (typeof value === "number" && member.startsWith("EVENT_TYPE_") && value !== 0) {
+            names[value] = enumMemberName(member, "EVENT_TYPE_");
+        }
+    }
+    return names;
+}
+function loadEventTypeEnum() {
+    try {
+        const require = createRequire(import.meta.url);
+        const fromClient = createRequire(require.resolve("@temporalio/client"));
+        const proto = fromClient("@temporalio/proto");
+        return proto.temporal.api.enums.v1.EventType;
+    }
+    catch {
+        return {};
+    }
+}
+export const LIST_STATUSES = {
+    running: "Running",
+    completed: "Completed",
+    failed: "Failed",
+    canceled: "Canceled",
+    terminated: "Terminated",
+    "continued-as-new": "ContinuedAsNew",
+    "timed-out": "TimedOut",
+};
+function quote(value) {
+    return `'${value.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
+}
+export function buildListQuery(opts) {
+    const clauses = [];
+    if (opts.type)
+        clauses.push(`WorkflowType = ${quote(opts.type)}`);
+    if (opts.status) {
+        const status = LIST_STATUSES[opts.status.toLowerCase()];
+        if (!status)
+            throw new Error(`--status must be one of: ${Object.keys(LIST_STATUSES).join(", ")}`);
+        clauses.push(`ExecutionStatus = ${quote(status)}`);
+    }
+    if (opts.parent)
+        clauses.push(`ParentWorkflowId = ${quote(opts.parent)}`);
+    if (opts.query)
+        clauses.push(clauses.length > 0 ? `(${opts.query})` : opts.query);
+    return clauses.join(" AND ");
+}
+export function formatListRows(rows) {
+    const table = [
+        ["WORKFLOW ID", "TYPE", "STATUS", "STARTED", "PARENT"],
+        ...rows.map((r) => [
+            r.workflowId,
+            r.type,
+            r.status,
+            r.startTime ? r.startTime.toISOString().replace(/\.\d{3}Z$/, "Z") : "-",
+            r.parentWorkflowId ?? "-",
+        ]),
+    ];
+    const widths = table[0].map((_, i) => Math.max(...table.map((row) => row[i].length)));
+    return table.map((row) => row.map((cell, i) => (i === row.length - 1 ? cell : cell.padEnd(widths[i]))).join("  "));
+}

package/dist/src/utils/workstation-machine.d.ts

@@ -0,0 +1,54 @@
+import { type WorkstationProxyConfig } from "./workstation-routes.js";
+export declare function readCredentialProcess(configText: string, profile: string): string | undefined;
+export declare function credentialProgram(command: string): string;
+export declare function credentialProcessProblem(command: string | undefined, deps: {
+    exists: (p: string) => boolean;
+    isInsideGitTree: (p: string) => boolean;
+}): string | undefined;
+export declare function isInsideGitTree(p: string): boolean;
+export declare function rewriteCredentialProgram(configText: string, profile: string, cli: string): string;
+export declare const LAUNCH_AGENT_LABEL = "tech.mesh.workstation-proxy";
+export declare const LAUNCH_AGENTS_MACOS_ONLY = "LaunchAgents are macOS-only; run mesh workstation proxy in the foreground (or under your own service manager)";
+export declare function launchAgentsSupported(platform?: NodeJS.Platform): boolean;
+export declare function launchAgentSearchPath(installerPath: string | undefined, execPath: string): string;
+export declare function renderLaunchAgent(args: {
+    caddy: string;
+    caddyfile: string;
+    dir: string;
+    env: Record<string, string>;
+}): string;
+export declare function certificateExpiry(dir: string, domain: string): Date | undefined;
+export declare function workstationWarnings(args: {
+    now: Date;
+    certExpiry: Date | undefined;
+    credentialOk: boolean;
+    credentialProblem?: string;
+}): string[];
+export type WorkstationDiscovery = {
+    roleArn: string;
+    zoneId: string;
+    region: string;
+};
+export declare function discoveryRecordName(name: string, platform: string): string;
+export declare function parseDiscoveryRecord(text: string): WorkstationDiscovery | string;
+export declare function caddyDownloadUrl(platform: string, arch: string): string;
+export declare function caddyHasRoute53(listModulesOutput: string): boolean;
+export declare function shimFallsBackToGlobal(shimText: string): boolean;
+export declare function zoneCandidates(platform: string): string[];
+export declare const RENEWAL_OVERDUE_DAYS = 28;
+export type WorkstationHealthStamp = {
+    checkedAt: string;
+    credentialOk: boolean;
+};
+export declare function healthCheckDue(stamp: WorkstationHealthStamp | undefined, now: Date): boolean;
+export declare function loginContextOf(command: string | undefined): string | undefined;
+export declare function renewalWarnings(args: {
+    now: Date;
+    certExpiry: Date | undefined;
+    credentialOk: boolean;
+    loginContext?: string;
+}): string[];
+export declare function proxyEnv(base: NodeJS.ProcessEnv, proxy: WorkstationProxyConfig): NodeJS.ProcessEnv;
+export declare function awsConfigFileOf(proxy: WorkstationProxyConfig): string;
+export declare function profileYieldsCredentials(proxy: WorkstationProxyConfig, timeoutMs?: number): boolean;
+export declare function workstationRenewalWarnings(now?: Date): string[];