@mesh-tech/mesh-cli

mesh is the command-line entry point to the Mesh platform — Trabian's platform for building and running financial-services applications.

It is the one @mesh-tech/* package on public npm, so a clean laptop installs it with no registry auth at all, and the CLI bootstraps everything else: your package access, a new app, a full local stack, a whole platform in your own AWS account, and the docs.

npm i -g @mesh-tech/mesh-cli
mesh registry login     # package access — one browser trip
mesh init               # everything else: it asks where your tenant runs

mesh init starts from nothing. "Nowhere yet — set up a new Mesh platform in my AWS account" is one of the answers it offers, and it asks for the handful of values that differ per install (region, public domain, Pulumi state bucket, AWS profile) with a default on each, so Enter is a valid answer.

Let your agent drive it

The CLI is built to be driven by a coding agent. One command installs the agent skills — the full command reference, the conventions, and the runbooks — into your repo:

mesh skills sync

After that you do not have to learn the CLI: tell your agent "set up a Mesh platform for tenant acme in my AWS account and get a hello-world app running" and it has everything it needs. Every command below is also fully flagged (--yes, --json), so nothing an agent runs depends on a prompt.

Prefer to drive it yourself? Everything works by hand — read on.

Requirements

| Need | Why | |---|---| | Node 22+ and pnpm (corepack enable) | Everything below | | Docker Desktop (or equivalent) | Only for mesh start / mesh dev | | A Mesh account with registry access | Issued by your Mesh contact; used by mesh registry login | | An AWS account + aws CLI | Only if you deploy (mesh deploy, or setting up a platform) |

Two sign-ins, and which one you need

Two commands say "log in". They are not alternatives — they unlock different things, and most people only ever need the first:

| | What it unlocks | Needs | |---|---|---| | mesh registry login | Packages. Installing @mesh-tech/*, scaffolding an app, the docs. | A Mesh account. No AWS, no platform, no context. | | mesh login <tenant>.<env> | A deployed platform. mesh deploy, mesh stack, the Hub, the VPN. | A platform that exists, and access to it. |

mesh registry login writes a short-lived (12h) token into your ~/.npmrc; re-run it when it expires. mesh login never touches ~/.npmrc. If your account does not hold the registry grant yet, the command says so and prints the access-request URL (or names the admin to ask).

Build and run an app

mesh init                     # tenant, where it runs, registry access, repo, skills
mesh create-app --name billing --primitives service,database,temporal
mesh start                    # the full-local Mesh platform — Docker only, no AWS, no VPN
mesh dev                      # from the app repo: run your app against it

mesh start brings up the platform's own services (Postgres, Temporal, Zitadel, the local AWS fabric, and the Hub at http://localhost:9000 — sign in as [email protected] / LocalDev1!). Mail the local platform sends lands in the mailbox at http://localhost:8025. mesh status reprints all of it; mesh stop shuts it down; mesh dev doctor diagnoses a broken session.

Set up a platform of your own

If nothing is deployed yet, mesh init offers to scaffold you one; the same scaffold on its own is:

mesh init platform acme --domain a-domain-you-control.com

It writes a tenant platform repo (the core + platform Pulumi layers on @mesh-tech/infra-components) that deploys with mesh deploy unmodified, asks for the per-install values, offers to create the Pulumi state bucket, and prints the deploy sequence — including the one manual step in the middle: delegating the NS records of the new public zone, without which the deploy stalls on its ACM certificate.

The platform layer builds service images with Docker by default, so it needs a working Docker daemon; the core layer does not. On a machine without Docker (a cloud IDE container, some CI runners), set mesh:buildMode: remote in the platform stack config — images then build inside the target cluster as rootless-BuildKit Jobs (see RemoteBuildConfig in the infra-components apps reference). That covers the Temporal namespace provisioner, the custom Temporal server, and every Hub workload. Three opt-ins still build on the deploying machine and keep a Docker requirement: a Hub with mesh:hub: { cdn: true } (its CDN asset build runs locally), mesh:headscale (the VPN join broker image), and mesh:packageRegistry (the registry-auth broker image, created unless you pass broker: false).

For an existing app repo, mesh init app-tenant is the doctor, not a scaffolder: it checks auth, registry access, tenant registration, repo shape and agent skills, and repairs what it can with --fix.

Read the docs

The Mesh documentation is served locally, by the CLI — same access grant as the packages:

mesh docs start     # → http://localhost:4400   (mesh docs stop to end it)

The full mesh reference — every command, every flag, generated from the binary — is a page inside that site. mesh --help and --help on any subcommand answer the same questions at the terminal.

• Something not working? Troubleshooting — the failures people actually hit, each with its one-command fix.
• Anything else: your Mesh contact.

License

UNLICENSED — © Trabian. Access to the Mesh platform and its packages is granted per account.