@mesh-tech/mesh-cli 0.1.0 → 0.12.0

package/dist/src/utils/auth-preflight.js

@@ -0,0 +1,298 @@
+/**
+ * First-run auth preflight helpers (MESH-2479).
+ *
+ * `mesh start`/`mesh dev` do long work (registry tarball fetches, docker
+ * builds, pnpm installs) that fails minutes in — with npm's generic advice —
+ * when the CodeArtifact token or AWS SSO session is stale. These helpers
+ * verify auth BEFORE the long work and name the exact fixing command.
+ *
+ * Pure parsers/classifiers are exported separately from the impure probes so
+ * the branch logic is unit-testable without network or a home directory.
+ */
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+/**
+ * The context that owns the `@mesh-tech` registry. There is exactly one — the
+ * `mesh-platform` CodeArtifact domain every tenant pulls from — so this is the
+ * context whose broker can mint a read token for anybody, and it is what a
+ * printed remediation should name.
+ *
+ * Safe to hardcode for the same reason `--profile mesh-dev` already was: it
+ * identifies the registry, not the reader's own platform. It also resolves on a
+ * machine with no AWS at all, via the pinned first-party alias.
+ */
+export const REGISTRY_CONTEXT = "mesh.dev";
+/**
+ * The command that fixes a stale/missing CodeArtifact token — **broker-first**,
+ * so it works for someone with no AWS account at all.
+ *
+ * Prefer `registryLoginFix(context)` at any call site that knows a better
+ * context than the registry's own.
+ */
+export const REGISTRY_LOGIN_FIX = `mesh registry login ${REGISTRY_CONTEXT}`;
+/**
+ * The AWS-profile form. Only correct for people who **deploy**, or when the
+ * platform publishes no registry broker.
+ *
+ * Kept as a separate named constant rather than the default: `--profile`
+ * deliberately skips the broker, so printing it as the generic fix sends a
+ * developer with no AWS account to a command that cannot work for them.
+ */
+export const REGISTRY_LOGIN_FIX_AWS = "mesh registry login --profile mesh-dev";
+/**
+ * Render the registry fix for a known context, falling back to the registry's
+ * own context when the caller has none. Always returns a command that can be
+ * run as printed — a remediation the reader has to edit first is half a
+ * remediation.
+ */
+export function registryLoginFix(context) {
+    return `mesh registry login ${context ?? REGISTRY_CONTEXT}`;
+}
+/** The documented AWS SSO login form (root package.json `sso` script). */
+export const SSO_LOGIN_FIX = "aws sso login --sso-session=mesh   # or: pnpm sso";
+/**
+ * The `aws configure sso-session` snippet `pnpm sso` depends on. Printed
+ * verbatim when ~/.aws/config has no [sso-session mesh] section — kept here
+ * so the CLI and scripts/sso-login.sh describe the same setup.
+ */
+export const SSO_SESSION_SNIPPET = `[sso-session mesh]
+sso_start_url = https://trabian.awsapps.com/start
+sso_region = us-east-1
+sso_registration_scopes = sso:account:access`;
+// ============================================================================
+// ~/.npmrc parsing (pure)
+// ============================================================================
+/**
+ * The user-level npmrc `aws codeartifact login` writes into — the token line
+ * and, when the namespace flag is omitted, the unscoped `registry=` line.
+ *
+ * One definition for the whole CLI: the doctor, the probe, and the repair have
+ * to be looking at the same file or they disagree about the same machine.
+ * `os.homedir()` reads `$HOME` on POSIX, so a scratch-`HOME` test still works.
+ */
+export function homeNpmrcPath() {
+    return path.join(os.homedir(), ".npmrc");
+}
+/**
+ * Extract the CodeArtifact registry endpoint + auth token from npmrc content.
+ * `aws codeartifact login` writes a line shaped like:
+ *   //mesh-platform-…d.codeartifact.<region>.amazonaws.com/npm/<repo>/:_authToken=<tok>
+ * Returns null when no CodeArtifact token line is present.
+ */
+export function parseNpmrcRegistryAuth(content) {
+    for (const line of content.split("\n")) {
+        const match = line.trim().match(/^\/\/([^:]*\.codeartifact\.[^:]*):_authToken=(.+)$/);
+        if (match && match[1] && match[2]) {
+            const endpoint = `https://${match[1]}${match[1].endsWith("/") ? "" : "/"}`;
+            return { endpoint, token: match[2].trim() };
+        }
+    }
+    return null;
+}
+/**
+ * Find an **unscoped** `registry=` line in npmrc content that points at
+ * CodeArtifact — the line `aws codeartifact login` writes when it is run
+ * WITHOUT `--namespace @mesh-tech`.
+ *
+ * That line makes CodeArtifact the *default* registry, so every public package
+ * (lodash, react, …) is fetched through it with the CodeArtifact token. When
+ * the token expires 12 hours later, `npm install` of anything at all fails
+ * with E401 — the private-scope breakage everyone expects, plus a total public
+ * npm outage nobody does.
+ *
+ * Deliberately narrow — it must only match a line that is BOTH unscoped AND a
+ * CodeArtifact host, so it never touches:
+ *   - `@mesh-tech:registry=…`      (scoped: the line we WANT)
+ *   - `//…:_authToken=…`           (auth, unaffected by the default registry)
+ *   - `registry=https://npm.acme.internal/`  (a team's legitimate private mirror)
+ *
+ * Returns the offending line verbatim (as it appears in the file), or null.
+ */
+export function findUnscopedCodeArtifactRegistry(content) {
+    for (const line of content.split("\n")) {
+        const trimmed = line.trim();
+        // npmrc comments start with ; or #
+        if (!trimmed || trimmed.startsWith(";") || trimmed.startsWith("#"))
+            continue;
+        // Anchored at `registry` — a scoped line starts with `@scope:`, so it can't match.
+        const match = trimmed.match(/^registry\s*=\s*(\S+)$/);
+        if (!match || !match[1])
+            continue;
+        if (isCodeArtifactRegistryUrl(match[1]))
+            return line;
+    }
+    return null;
+}
+/** True when a registry URL's *host* is a CodeArtifact endpoint. */
+function isCodeArtifactRegistryUrl(value) {
+    try {
+        return new URL(value).hostname.includes(".codeartifact.");
+    }
+    catch {
+        // Not a parseable URL (env-var interpolation, protocol-relative, …) —
+        // fall back to a substring test so we don't miss an obvious hijack.
+        return value.includes(".codeartifact.");
+    }
+}
+/**
+ * Remove every unscoped CodeArtifact `registry=` line from npmrc content.
+ * Pure: returns the rewritten content plus the first line removed (null when
+ * the content was already clean, in which case `content` is returned
+ * unchanged and callers should skip the write entirely).
+ */
+export function stripUnscopedCodeArtifactRegistry(content) {
+    const offender = findUnscopedCodeArtifactRegistry(content);
+    if (offender === null)
+        return { content, removed: null };
+    const kept = content
+        .split("\n")
+        .filter((line) => findUnscopedCodeArtifactRegistry(line) === null);
+    // split/join round-trips the file's trailing-newline state exactly.
+    return { content: kept.join("\n"), removed: offender };
+}
+/**
+ * The `//host/path/:_authToken=` key `aws codeartifact login` writes for a
+ * registry endpoint — the endpoint with its scheme stripped and a leading `//`.
+ *
+ * Pure and shared so the broker path writes byte-identical lines to the AWS CLI
+ * path. Two spellings of the same key would leave a stale token line behind
+ * that npm might prefer, and the symptom (E401 hours later) points nowhere
+ * near the cause.
+ */
+export function npmrcAuthKeyForEndpoint(endpoint) {
+    const withoutScheme = endpoint.replace(/^https?:\/\//, "");
+    return `//${withoutScheme.endsWith("/") ? withoutScheme : `${withoutScheme}/`}`;
+}
+/**
+ * Upsert `key=value` lines into npmrc content: replace the existing line for a
+ * key when present, append it otherwise, and leave every other line untouched.
+ *
+ * Pure. Always emits a trailing newline, and never reorders lines a
+ * user put there themselves — an npmrc is a config file people hand-edit, and
+ * a token refresh that rewrites the whole thing is how unrelated settings
+ * silently disappear.
+ */
+export function upsertNpmrcLines(content, entries) {
+    let lines = content.length ? content.split("\n") : [];
+    const trailingNewline = content.endsWith("\n");
+    if (trailingNewline)
+        lines = lines.slice(0, -1);
+    for (const { key, value } of entries) {
+        const line = `${key}=${value}`;
+        const idx = lines.findIndex((l) => {
+            const trimmed = l.trim();
+            if (!trimmed || trimmed.startsWith(";") || trimmed.startsWith("#"))
+                return false;
+            const eq = trimmed.indexOf("=");
+            return eq > 0 && trimmed.slice(0, eq).trim() === key;
+        });
+        if (idx >= 0)
+            lines[idx] = line;
+        else
+            lines.push(line);
+    }
+    return lines.join("\n") + "\n";
+}
+/** Map an HTTP status from an authenticated registry request to a token state. */
+export function classifyRegistryStatus(status) {
+    // 401/403 mean the token itself was rejected. Anything else (200, 404, …)
+    // means auth was accepted — the token is usable.
+    return status === 401 || status === 403 ? "expired" : "fresh";
+}
+/**
+ * Verify the CodeArtifact token in ~/.npmrc actually works, with one small
+ * authenticated metadata request (bounded by `timeoutMs`). Never throws.
+ */
+export async function probeRegistryToken(opts) {
+    const npmrcPath = opts?.npmrcPath ?? homeNpmrcPath();
+    const timeoutMs = opts?.timeoutMs ?? 8_000;
+    const fetchFn = opts?.fetchFn ?? fetch;
+    let auth = null;
+    try {
+        auth = parseNpmrcRegistryAuth(fs.readFileSync(npmrcPath, "utf-8"));
+    }
+    catch {
+        // unreadable/missing ~/.npmrc — same as no auth configured
+    }
+    if (!auth)
+        return { state: "missing" };
+    try {
+        const res = await fetchFn(`${auth.endpoint}${encodeURIComponent("@mesh-tech/hub")}`, {
+            method: "GET",
+            headers: { authorization: `Bearer ${auth.token}` },
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        const state = classifyRegistryStatus(res.status);
+        return state === "expired"
+            ? { state, detail: `registry answered HTTP ${res.status} for an authenticated request` }
+            : { state };
+    }
+    catch (err) {
+        return {
+            state: "unreachable",
+            detail: err instanceof Error ? err.message : String(err),
+        };
+    }
+}
+// ============================================================================
+// npm / AWS error classification (pure)
+// ============================================================================
+/** True when npm output/an error message is an auth failure (E401/E403). */
+export function isNpmAuthErrorText(text) {
+    return /\bE?40[13]\b|unauthenticated|unable to authenticate|authentication (required|failed)/i.test(text);
+}
+/** True when an npm exec error (with stderr/message) is an auth failure. */
+export function isNpmAuthError(err) {
+    const e = err;
+    const text = [e?.stderr, e?.message]
+        .map((v) => (v === null || v === undefined ? "" : String(v)))
+        .join("\n");
+    return isNpmAuthErrorText(text);
+}
+/** True when an AWS SDK/CLI error message means the ambient session expired. */
+export function isExpiredAwsTokenMessage(message) {
+    return /expired|invalid.*(security )?token|token.*(is )?invalid|no credential|could not load credentials|could not be found|sso session/i.test(message);
+}
+// ============================================================================
+// ~/.aws/config parsing (pure) — `pnpm sso` / --profile prerequisites
+// ============================================================================
+/** Names of `[sso-session <name>]` sections in an AWS config file. */
+export function parseSsoSessionNames(content) {
+    const names = [];
+    for (const line of content.split("\n")) {
+        const match = line.trim().match(/^\[sso-session\s+([^\]]+)\]$/);
+        if (match && match[1])
+            names.push(match[1].trim());
+    }
+    return names;
+}
+/** True when the AWS config file declares the named profile. */
+export function awsConfigHasProfile(content, profile) {
+    const pattern = new RegExp(`^\\[(?:profile\\s+)?${profile.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\]$`);
+    return content.split("\n").some((line) => pattern.test(line.trim()));
+}
+/** Read ~/.aws/config (honoring AWS_CONFIG_FILE); "" when unreadable. */
+export function readAwsConfig() {
+    const file = process.env.AWS_CONFIG_FILE ?? path.join(os.homedir(), ".aws", "config");
+    try {
+        return fs.readFileSync(file, "utf-8");
+    }
+    catch {
+        return "";
+    }
+}
+// ============================================================================
+// App dependency scan (for the dev doctor's registry check)
+// ============================================================================
+/** True when the app's package.json depends on any @mesh-tech/* package. */
+export function appUsesMeshPackages(appRoot) {
+    try {
+        const pkg = JSON.parse(fs.readFileSync(path.join(appRoot, "package.json"), "utf-8"));
+        return [pkg.dependencies, pkg.devDependencies, pkg.optionalDependencies].some((deps) => deps && Object.keys(deps).some((name) => name.startsWith("@mesh-tech/")));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=auth-preflight.js.map

package/dist/src/utils/auth-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-preflight.js","sourceRoot":"","sources":["../../../src/utils/auth-preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAuB,gBAAgB,EAAE,CAAC;AAE5E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,wCAAwC,CAAC;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,OAAO,uBAAuB,OAAO,IAAI,gBAAgB,EAAE,CAAC;AAC9D,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,MAAM,aAAa,GAAG,mDAAmD,CAAC;AAEjF;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;6CAGU,CAAC;AAE9C,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAQD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACtF,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,WAAW,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAC3E,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,gCAAgC,CAAC,OAAe;IAC9D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,mCAAmC;QACnC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC7E,mFAAmF;QACnF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAAE,SAAS;QAClC,IAAI,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oEAAoE;AACpE,SAAS,yBAAyB,CAAC,KAAa;IAC9C,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,oEAAoE;QACpE,OAAO,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iCAAiC,CAAC,OAAe;IAI/D,MAAM,QAAQ,GAAG,gCAAgC,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEzD,MAAM,IAAI,GAAG,OAAO;SACjB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gCAAgC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IACrE,oEAAoE;IACpE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACzD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC3D,OAAO,KAAK,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,GAAG,EAAE,CAAC;AAClF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAe,EACf,OAAsD;IAEtD,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,eAAe;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAEhD,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;YAChC,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YACjF,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAChC,OAAO,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC;QACvD,CAAC,CAAC,CAAC;QACH,IAAI,GAAG,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;;YAC3B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAQD,kFAAkF;AAClF,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,0EAA0E;IAC1E,iDAAiD;IACjD,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AAChE,CAAC;AAOD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAIxC;IACC,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,aAAa,EAAE,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,KAAK,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,KAAK,CAAC;IAEvC,IAAI,IAAI,GAA6B,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,IAAI,GAAG,sBAAsB,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAEvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,EAAE;YACnF,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE;YAClD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjD,OAAO,KAAK,KAAK,SAAS;YACxB,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,GAAG,CAAC,MAAM,+BAA+B,EAAE;YACxF,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,wCAAwC;AACxC,+EAA+E;AAE/E,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,uFAAuF,CAAC,IAAI,CACjG,IAAI,CACL,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,MAAM,CAAC,GAAG,GAA8C,CAAC;IACzD,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;SAC5D,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,OAAO,kIAAkI,CAAC,IAAI,CAC5I,OAAO,CACR,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,sEAAsE;AACtE,+EAA+E;AAE/E,sEAAsE;AACtE,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAChE,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,OAAe;IAClE,MAAM,OAAO,GAAG,IAAI,MAAM,CACxB,uBAAuB,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAC5E,CAAC;IACF,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,aAAa;IAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtF,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,4DAA4D;AAC5D,+EAA+E;AAE/E,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAIlF,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAC3E,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CACnF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/src/utils/aws-auth.d.ts

@@ -0,0 +1,181 @@
+/**
+ * Shared AWS credential resolution for mesh CLI commands.
+ *
+ * Three-tier resolution:
+ *   1. Existing AWS credentials in environment (CI/CD) → use directly
+ *   2. Zitadel JWT via `mesh login` → AssumeRoleWithWebIdentity
+ *   3. Fallback → AssumeRole via current AWS session (SSO)
+ *
+ * Uses @aws-sdk/client-sts directly — does NOT shell out to the `aws` CLI
+ * binary, so the binary is not a runtime requirement.
+ */
+/**
+ * Derive the platform context key (e.g., "mesh.dev") from a Pulumi stack config.
+ *
+ * Reads `mesh:platform` from Pulumi.<stack>.yaml. Supports both formats:
+ *   mesh:platform: '{"env":"dev","name":"mesh"}'    → "mesh.dev"
+ *   mesh:platform:
+ *     name: mesh
+ *     env: dev                                       → "mesh.dev"
+ */
+export declare function derivePlatformContext(appRoot: string, stack: string): string | null;
+/**
+ * Resolve a STABLE absolute path to the running `mesh` entrypoint for
+ * embedding in a `credential_process` line — or fall back to plain `mesh`
+ * (PATH lookup) when `argv1` is missing, doesn't exist on disk, or lives in
+ * a transient location (`npx` cache / OS temp dir): a profile pointing at a
+ * path that evaporates breaks every later AWS call with a cryptic
+ * credential_process error. The fallback is announced via `logWarn` so the
+ * user knows to install mesh-cli globally.
+ */
+export declare function resolveStableMeshBin(argv1: string | undefined, deps?: {
+    exists?: (p: string) => boolean;
+    warn?: (msg: string) => void;
+}): string;
+/**
+ * Render an AWS config-file `[profile …]` block whose `credential_process`
+ * re-invokes `mesh login … --credential-process`, so the AWS SDK's default
+ * provider chain auto-refreshes the underlying STS triple (the `mesh login`
+ * process re-issues the Zitadel token as needed).
+ *
+ * Shared by `mesh dev` (child services) and `mesh login --export` so both
+ * produce byte-identical profiles. Pure — no I/O. The `region` line is
+ * emitted only when `region` is a non-empty string. Includes a trailing
+ * newline. The binary path and role ARN are double-quoted when they contain
+ * whitespace (AWS config command-splitting rules).
+ */
+export declare function renderCredentialProcessProfile(args: {
+    profileName: string;
+    context: string;
+    roleArn: string;
+    region?: string;
+    meshBin: string;
+}): string;
+/**
+ * Insert or replace the mesh-managed `[profile …]` section for `context` in
+ * the user's AWS config content, preserving ALL other content byte-for-byte
+ * (this is the user's real ~/.aws/config — clobbering it breaks their other
+ * profiles). Pure — no I/O; exported for unit testing.
+ *
+ * - Existing managed section for this context → replaced in place.
+ * - Orphaned START (matching END lost) → only the contiguous profile block
+ *   that is provably ours is reclaimed; other contexts' sections and user
+ *   content below are preserved (see `orphanedSectionTail`).
+ * - No section → appended, separated by a single blank line (and a trailing
+ *   newline is added to the existing content if it lacks one).
+ */
+export declare function upsertManagedAwsConfigSection(existing: string, context: string, profileBlock: string): string;
+/** Assume an IAM role via current AWS session and return credentials as env vars. */
+export declare function assumeRole(roleArn: string, sessionName?: string, durationSeconds?: number): Promise<Record<string, string> | null>;
+/** STS credentials for a Zitadel-JWT-assumed role, including expiry. */
+export interface StsCreds {
+    AccessKeyId: string;
+    SecretAccessKey: string;
+    SessionToken: string;
+    /** ISO-8601 expiration timestamp. */
+    Expiration: string;
+}
+/**
+ * Assume role using a Zitadel JWT via AssumeRoleWithWebIdentity, returning
+ * the full STS credential struct (including `Expiration`) rather than the
+ * env-var shape. Used by callers that need to track/refresh expiry (e.g.
+ * `credential_process`).
+ */
+export declare function assumeRoleCredentials(roleArn: string, idToken: string, sessionName: string, durationSeconds?: number): Promise<StsCreds | null>;
+/** Assume role using a Zitadel JWT via AssumeRoleWithWebIdentity. */
+export declare function assumeRoleWithWebIdentity(roleArn: string, idToken: string, sessionName: string, durationSeconds?: number): Promise<Record<string, string> | null>;
+/**
+ * Extract the `iss` claim from a JWT without ever throwing — malformed or
+ * corrupt tokens (e.g. a damaged `~/.config/mesh/credentials.json`) yield
+ * `undefined`. The failure-diagnostic paths use this; a decode that throws
+ * there would crash before the diagnostic prints, which is exactly the
+ * failure class MESH-2515 removes.
+ */
+export declare function tokenIssuer(token: string): string | undefined;
+/**
+ * Explain an AssumeRoleWithWebIdentity failure in platform terms: which login
+ * session (context + token issuer) tried to assume which role, in which AWS
+ * account. STS's "web identity token could not be validated" reads like an
+ * IAM/expiry problem, but the usual cause is a context whose issuer the role's
+ * account simply doesn't trust — e.g. a `mesh.dev` session against a role in a
+ * `trabian`-platform account (MESH-2515). stderr only — callers in
+ * `--credential-process` mode must keep stdout JSON-clean.
+ *
+ * `format: "inline"` renders the same facts as one line, for detail fields
+ * that get interpolated mid-sentence (the doctor/preflight cred probe). Both
+ * forms keep the `AssumeRoleWithWebIdentity failed` prefix the doctor plan
+ * documents as the detail capture.
+ */
+export declare function describeAssumeFailure(opts: {
+    roleArn: string;
+    context?: string;
+    issuer?: string;
+}, format?: "block" | "inline"): string;
+/** Format STS credentials as AWS `credential_process` JSON (Version 1). */
+export declare function toCredentialProcessJson(creds: StsCreds): string;
+export interface ResolvedAwsCreds {
+    /** AWS credential env vars (ACCESS_KEY_ID, SECRET_ACCESS_KEY, SESSION_TOKEN) */
+    env: Record<string, string>;
+    /** How the credentials were obtained */
+    method: "environment" | "zitadel" | "sso";
+}
+export interface AwsIdentity {
+    /** Full caller ARN, e.g. arn:aws:iam::159923586610:user/CI-CD_User */
+    arn: string;
+    accountId: string;
+    /** Where the SDK's default chain found the credentials, for the human reading it. */
+    source: "environment" | "profile";
+}
+/**
+ * Ask "is there a working AWS connection right now?" — nothing more.
+ *
+ * Deliberately NOT `resolveAwsCredentials`: that one answers "get me credentials
+ * for role X" and has an opinion about how they were obtained. This one runs
+ * GetCallerIdentity through the SDK's default provider chain and reports whatever
+ * it finds, so a static key/secret pair in `~/.aws/credentials` counts exactly as
+ * much as an SSO session or a Zitadel-minted role. Returns null when the chain
+ * yields nothing usable.
+ */
+export declare function probeAwsIdentity(): Promise<AwsIdentity | null>;
+/**
+ * Pick the AWS role ARN to assume based on Zitadel claims.
+ *
+ * Zitadel emits project roles under
+ * `urn:zitadel:iam:org:project:<projectId>:roles` as a nested object
+ * keyed by role name. We treat the presence of `mesh.platform:admin`
+ * (or any role listed in `meshcli.adminRoles` in config) as the
+ * signal to assume the broader admin role when the caller has
+ * configured one.
+ *
+ * Returns `defaultRole` when no admin role is configured, no admin
+ * claim is present, or the JWT can't be parsed. This keeps existing
+ * deployments working without a config change.
+ *
+ * The admin AWS role's IAM trust policy is expected to gate
+ * assumption on the same Zitadel claim in production (so the CLI
+ * preference can't be spoofed). That setup is its own change — see
+ * TODO(mesh-zitadel-aws-role-mapping).
+ */
+export declare function selectRoleForCaller(idToken: string | null, options: {
+    defaultRole: string;
+    adminRole?: string;
+    /**
+     * Zitadel role names that should map to `adminRole`. Defaults to
+     * a single `mesh.platform:admin` role; callers can override via
+     * config to introduce role tiers later.
+     */
+    adminClaimRoles?: string[];
+}): string;
+/**
+ * Resolve AWS credentials using the three-tier strategy.
+ *
+ * @param roleArn       The IAM role to assume (from mesh:deployerRole)
+ * @param appRoot       Pulumi app root directory
+ * @param stack         Pulumi stack name
+ * @returns Resolved credentials, or null if all methods fail
+ *
+ * To inherit a broader role based on Zitadel claims, call
+ * `selectRoleForCaller` first and pass the result as `roleArn`.
+ */
+export declare function resolveAwsCredentials(roleArn: string, appRoot: string, stack: string): Promise<ResolvedAwsCreds | null>;
+//# sourceMappingURL=aws-auth.d.ts.map

package/dist/src/utils/aws-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-auth.d.ts","sourceRoot":"","sources":["../../../src/utils/aws-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiBH;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyBnF;AAcD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAO,GAC3E,MAAM,CA2BR;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAOT;AA6CD;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,GACnB,MAAM,CAgCR;AAkCD,qFAAqF;AACrF,wBAAsB,UAAU,CAC9B,OAAO,EAAE,MAAM,EACf,WAAW,GAAE,MAAmB,EAChC,eAAe,GAAE,MAAc,GAC9B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CA4BxC;AAED,wEAAwE;AACxE,MAAM,WAAW,QAAQ;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,eAAe,GAAE,MAAc,GAC9B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAoC1B;AAED,qEAAqE;AACrE,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,eAAe,GAAE,MAAc,GAC9B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAIxC;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG7D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE;IACJ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,EACD,MAAM,GAAE,OAAO,GAAG,QAAkB,GACnC,MAAM,CA2BR;AAED,2EAA2E;AAC3E,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,CAQ/D;AAED,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,wCAAwC;IACxC,MAAM,EAAE,aAAa,GAAG,SAAS,GAAG,KAAK,CAAC;CAC3C;AAED,MAAM,WAAW,WAAW;IAC1B,sEAAsE;IACtE,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,MAAM,EAAE,aAAa,GAAG,SAAS,CAAC;CACnC;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAYpE;AAkBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,EAAE;IACP,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B,GACA,MAAM,CAmBR;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAsElC"}