@mesh-tech/mesh-cli 0.1.0

package/dist/src/commands/login.d.ts

@@ -0,0 +1,47 @@
+/**
+ * mesh login — Authenticate with Zitadel via OIDC PKCE flow.
+ *
+ * Opens browser to Zitadel, receives auth code via localhost callback,
+ * exchanges for tokens, and caches at ~/.config/mesh/credentials.json.
+ *
+ * Config is read from ~/.config/mesh/config.json, keyed by context
+ * (e.g., "mesh.dev"). Example:
+ *
+ *   {
+ *     "mesh.dev": {
+ *       "issuer": "https://identity.<env>.<your-platform-domain>",
+ *       "clientId": "<cli-oidc-client-id>"
+ *     }
+ *   }
+ *
+ * Usage:
+ *   mesh login mesh.dev            — authenticate to mesh dev
+ *   mesh login mesh.dev --status   — show current auth state
+ *   mesh logout mesh.dev           — clear cached credentials
+ */
+import { Command } from "commander";
+declare const CONFIG_DIR: string;
+declare const CONFIG_FILE: string;
+declare const CREDENTIALS_FILE: string;
+interface ContextConfig {
+    issuer: string;
+    clientId: string;
+}
+interface CachedCredentials {
+    idToken: string;
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt: string;
+    email?: string;
+    sub?: string;
+}
+type CredentialsFile = Record<string, CachedCredentials>;
+declare function getContextConfig(context: string): ContextConfig | null;
+declare function readAllCredentials(): CredentialsFile;
+declare function readCredentials(context: string): CachedCredentials | null;
+declare function decodeJwtPayload(token: string): Record<string, unknown>;
+export declare function registerLoginCommand(program: Command): void;
+export { CONFIG_DIR, CONFIG_FILE, CREDENTIALS_FILE };
+export type { ContextConfig, CachedCredentials, CredentialsFile };
+export { readCredentials, readAllCredentials, getContextConfig, decodeJwtPayload };
+//# sourceMappingURL=login.d.ts.map

package/dist/src/commands/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/commands/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYpC,QAAA,MAAM,UAAU,QAGf,CAAC;AACF,QAAA,MAAM,WAAW,QAAuC,CAAC;AACzD,QAAA,MAAM,gBAAgB,QAA4C,CAAC;AAWnE,UAAU,aAAa;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,iBAAiB;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAGD,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAWzD,iBAAS,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAG/D;AAED,iBAAS,kBAAkB,IAAI,eAAe,CAO7C;AAED,iBAAS,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAElE;AA4CD,iBAAS,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAIhE;AAwQD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA2C3D;AAMD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;AACrD,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,eAAe,EAAE,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/src/commands/login.js

@@ -0,0 +1,344 @@
+/**
+ * mesh login — Authenticate with Zitadel via OIDC PKCE flow.
+ *
+ * Opens browser to Zitadel, receives auth code via localhost callback,
+ * exchanges for tokens, and caches at ~/.config/mesh/credentials.json.
+ *
+ * Config is read from ~/.config/mesh/config.json, keyed by context
+ * (e.g., "mesh.dev"). Example:
+ *
+ *   {
+ *     "mesh.dev": {
+ *       "issuer": "https://identity.<env>.<your-platform-domain>",
+ *       "clientId": "<cli-oidc-client-id>"
+ *     }
+ *   }
+ *
+ * Usage:
+ *   mesh login mesh.dev            — authenticate to mesh dev
+ *   mesh login mesh.dev --status   — show current auth state
+ *   mesh logout mesh.dev           — clear cached credentials
+ */
+import * as http from "http";
+import * as crypto from "crypto";
+import * as fs from "fs";
+import * as path from "path";
+import { execSync } from "child_process";
+import { logError, logInfo, logSuccess, logWarn } from "../utils/log.js";
+// =============================================================================
+// Paths (XDG Base Directory Specification)
+// =============================================================================
+const CONFIG_DIR = path.join(process.env.XDG_CONFIG_HOME ?? path.join(process.env.HOME ?? "~", ".config"), "mesh");
+const CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
+const CREDENTIALS_FILE = path.join(CONFIG_DIR, "credentials.json");
+const REDIRECT_PORT = 9876;
+const REDIRECT_URI = `http://localhost:${REDIRECT_PORT}/callback`;
+const SCOPES = "openid email profile offline_access urn:zitadel:iam:org:project:id:zitadel:aud";
+function readConfig() {
+    if (!fs.existsSync(CONFIG_FILE))
+        return {};
+    try {
+        return JSON.parse(fs.readFileSync(CONFIG_FILE, "utf-8"));
+    }
+    catch {
+        return {};
+    }
+}
+function getContextConfig(context) {
+    const config = readConfig();
+    return config[context] ?? null;
+}
+function readAllCredentials() {
+    if (!fs.existsSync(CREDENTIALS_FILE))
+        return {};
+    try {
+        return JSON.parse(fs.readFileSync(CREDENTIALS_FILE, "utf-8"));
+    }
+    catch {
+        return {};
+    }
+}
+function readCredentials(context) {
+    return readAllCredentials()[context] ?? null;
+}
+function writeCredentials(context, creds) {
+    fs.mkdirSync(CONFIG_DIR, { recursive: true });
+    const all = readAllCredentials();
+    all[context] = creds;
+    fs.writeFileSync(CREDENTIALS_FILE, JSON.stringify(all, null, 2), {
+        mode: 0o600,
+    });
+}
+function clearCredentials(context) {
+    const all = readAllCredentials();
+    delete all[context];
+    fs.mkdirSync(CONFIG_DIR, { recursive: true });
+    fs.writeFileSync(CREDENTIALS_FILE, JSON.stringify(all, null, 2), {
+        mode: 0o600,
+    });
+}
+function base64url(buffer) {
+    return buffer.toString("base64url");
+}
+function generateCodeVerifier() {
+    return base64url(crypto.randomBytes(32));
+}
+function generateCodeChallenge(verifier) {
+    return base64url(crypto.createHash("sha256").update(verifier).digest());
+}
+function decodeJwtPayload(token) {
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        throw new Error("Invalid JWT");
+    return JSON.parse(Buffer.from(parts[1], "base64url").toString());
+}
+async function exchangeCode(issuer, clientId, code, codeVerifier) {
+    const body = new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: REDIRECT_URI,
+        client_id: clientId,
+        code_verifier: codeVerifier,
+    });
+    const resp = await fetch(`${issuer}/oauth/v2/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: body.toString(),
+    });
+    if (!resp.ok) {
+        const text = await resp.text();
+        throw new Error(`Token exchange failed (${resp.status}): ${text}`);
+    }
+    return resp.json();
+}
+async function refreshTokens(issuer, clientId, refreshToken) {
+    const body = new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: refreshToken,
+        client_id: clientId,
+    });
+    const resp = await fetch(`${issuer}/oauth/v2/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: body.toString(),
+    });
+    if (!resp.ok) {
+        throw new Error(`Token refresh failed (${resp.status})`);
+    }
+    return resp.json();
+}
+// =============================================================================
+// Login Flow
+// =============================================================================
+function login(context, config) {
+    return new Promise((resolve, reject) => {
+        const codeVerifier = generateCodeVerifier();
+        const codeChallenge = generateCodeChallenge(codeVerifier);
+        const state = base64url(crypto.randomBytes(16));
+        const authUrl = new URL(`${config.issuer}/oauth/v2/authorize`);
+        authUrl.searchParams.set("client_id", config.clientId);
+        authUrl.searchParams.set("redirect_uri", REDIRECT_URI);
+        authUrl.searchParams.set("response_type", "code");
+        authUrl.searchParams.set("scope", SCOPES);
+        authUrl.searchParams.set("code_challenge", codeChallenge);
+        authUrl.searchParams.set("code_challenge_method", "S256");
+        authUrl.searchParams.set("state", state);
+        const server = http.createServer(async (req, res) => {
+            try {
+                const url = new URL(req.url ?? "/", `http://localhost:${REDIRECT_PORT}`);
+                if (url.pathname !== "/callback") {
+                    res.writeHead(404);
+                    res.end("Not found");
+                    return;
+                }
+                const error = url.searchParams.get("error");
+                if (error) {
+                    const desc = url.searchParams.get("error_description") ?? error;
+                    res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+                    res.end(`<html><body><h2>Login failed</h2><p>${desc}</p></body></html>`);
+                    server.close();
+                    reject(new Error(desc));
+                    return;
+                }
+                const returnedState = url.searchParams.get("state");
+                if (returnedState !== state) {
+                    res.writeHead(400);
+                    res.end("State mismatch");
+                    server.close();
+                    reject(new Error("State mismatch"));
+                    return;
+                }
+                const code = url.searchParams.get("code");
+                if (!code) {
+                    res.writeHead(400);
+                    res.end("No code");
+                    server.close();
+                    reject(new Error("No authorization code received"));
+                    return;
+                }
+                // Exchange code for tokens
+                const tokens = await exchangeCode(config.issuer, config.clientId, code, codeVerifier);
+                const idPayload = decodeJwtPayload(tokens.id_token);
+                const email = idPayload.email ??
+                    idPayload.preferred_username ??
+                    "unknown";
+                const sub = idPayload.sub;
+                // Parse tenants from access token
+                // (the Zitadel Action enriches the access token with urn:mesh:tenants)
+                let tenants = [];
+                try {
+                    const accessPayload = decodeJwtPayload(tokens.access_token);
+                    tenants =
+                        accessPayload["urn:mesh:tenants"] ?? [];
+                }
+                catch {
+                    // Access token may be opaque (non-JWT) in some configs
+                }
+                // Cache credentials
+                writeCredentials(context, {
+                    idToken: tokens.id_token,
+                    accessToken: tokens.access_token,
+                    refreshToken: tokens.refresh_token,
+                    expiresAt: new Date(Date.now() + tokens.expires_in * 1000).toISOString(),
+                    email,
+                    sub,
+                });
+                res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(`<html><body><h2>&#x2705; Logged in to ${context}!</h2><p>You can close this tab.</p></body></html>`);
+                logSuccess(`Logged in as ${email} (${context})`);
+                if (tenants.length > 0) {
+                    logInfo(`Deployable tenants: ${tenants.join(", ")}`);
+                }
+                server.close();
+                resolve();
+            }
+            catch (err) {
+                server.close();
+                reject(err);
+            }
+        });
+        server.listen(REDIRECT_PORT, () => {
+            logInfo(`Opening browser for authentication (${context})...`);
+            const url = authUrl.toString();
+            try {
+                if (process.platform === "darwin") {
+                    execSync(`open "${url}"`, { stdio: "ignore" });
+                }
+                else if (process.platform === "linux") {
+                    execSync(`xdg-open "${url}"`, { stdio: "ignore" });
+                }
+                else {
+                    logInfo(`Open this URL in your browser:\n${url}`);
+                }
+            }
+            catch {
+                logInfo(`Open this URL in your browser:\n${url}`);
+            }
+        });
+        // Timeout after 2 minutes
+        setTimeout(() => {
+            server.close();
+            reject(new Error("Login timed out (2 minutes)"));
+        }, 120_000);
+    });
+}
+// =============================================================================
+// Status
+// =============================================================================
+async function showStatus(context, config) {
+    const creds = readCredentials(context);
+    if (!creds) {
+        logWarn(`Not logged in to ${context}. Run: mesh login ${context}`);
+        process.exit(1);
+    }
+    const expired = new Date(creds.expiresAt) < new Date();
+    if (expired && creds.refreshToken) {
+        logInfo("Token expired, attempting refresh...");
+        try {
+            const tokens = await refreshTokens(config.issuer, config.clientId, creds.refreshToken);
+            const idPayload = decodeJwtPayload(tokens.id_token);
+            writeCredentials(context, {
+                ...creds,
+                idToken: tokens.id_token,
+                accessToken: tokens.access_token,
+                refreshToken: tokens.refresh_token ?? creds.refreshToken,
+                expiresAt: new Date(Date.now() + tokens.expires_in * 1000).toISOString(),
+                email: idPayload.email ?? creds.email,
+            });
+            logSuccess(`Token refreshed for ${creds.email ?? "unknown"}`);
+            return;
+        }
+        catch {
+            logWarn(`Token expired and refresh failed. Run: mesh login ${context}`);
+            process.exit(1);
+        }
+    }
+    if (expired) {
+        logWarn(`Token expired at ${creds.expiresAt}. Run: mesh login ${context}`);
+        process.exit(1);
+    }
+    // Parse tenants from access token
+    let tenants = [];
+    try {
+        const accessPayload = decodeJwtPayload(creds.accessToken);
+        tenants = accessPayload["urn:mesh:tenants"] ?? [];
+    }
+    catch {
+        // Access token may be opaque
+    }
+    logSuccess(`Logged in as ${creds.email ?? "unknown"} (${context})`);
+    logInfo(`Subject: ${creds.sub}`);
+    logInfo(`Expires: ${creds.expiresAt}`);
+    if (tenants.length > 0) {
+        logInfo(`Deployable tenants: ${tenants.join(", ")}`);
+    }
+}
+// =============================================================================
+// Commands
+// =============================================================================
+export function registerLoginCommand(program) {
+    program
+        .command("login")
+        .description("Authenticate with Zitadel (OIDC PKCE)")
+        .argument("<context>", 'Platform context (e.g., "mesh.dev")')
+        .option("--status", "Show current authentication status")
+        .action(async (context, opts) => {
+        const config = getContextConfig(context);
+        if (!config) {
+            logError(`No configuration found for "${context}".\n` +
+                `Add it to ${CONFIG_FILE}:\n\n` +
+                `  {\n` +
+                `    "${context}": {\n` +
+                `      "issuer": "https://identity.<env>.<your-platform-domain>",\n` +
+                `      "clientId": "<cli-oidc-client-id>"\n` +
+                `    }\n` +
+                `  }\n`);
+            process.exit(1);
+        }
+        if (opts.status) {
+            await showStatus(context, config);
+            return;
+        }
+        try {
+            await login(context, config);
+        }
+        catch (err) {
+            logError(`Login failed: ${err.message}`);
+            process.exit(1);
+        }
+    });
+    program
+        .command("logout")
+        .description("Clear cached Zitadel credentials")
+        .argument("<context>", 'Platform context (e.g., "mesh.dev")')
+        .action((context) => {
+        clearCredentials(context);
+        logSuccess(`Logged out of ${context}. Credentials cleared.`);
+    });
+}
+// =============================================================================
+// Exports (for use by mesh deploy)
+// =============================================================================
+export { CONFIG_DIR, CONFIG_FILE, CREDENTIALS_FILE };
+export { readCredentials, readAllCredentials, getContextConfig, decodeJwtPayload };
+//# sourceMappingURL=login.js.map

package/dist/src/commands/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/commands/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAEzE,gFAAgF;AAChF,2CAA2C;AAC3C,gFAAgF;AAEhF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1B,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE,SAAS,CAAC,EAC5E,MAAM,CACP,CAAC;AACF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AACzD,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;AAEnE,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,YAAY,GAAG,oBAAoB,aAAa,WAAW,CAAC;AAClE,MAAM,MAAM,GACV,gFAAgF,CAAC;AAuBnF,SAAS,UAAU;IACjB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,kBAAkB;IACzB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,EAAE,CAAC;IAChD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,kBAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;AAC/C,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe,EAAE,KAAwB;IACjE,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;IACrB,EAAE,CAAC,aAAa,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QAC/D,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC;IACpB,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,EAAE,CAAC,aAAa,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QAC/D,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAcD,SAAS,SAAS,CAAC,MAAc;IAC/B,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,oBAAoB;IAC3B,OAAO,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,OAAO,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,MAAc,EACd,QAAgB,EAChB,IAAY,EACZ,YAAoB;IAEpB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,IAAI;QACJ,YAAY,EAAE,YAAY;QAC1B,SAAS,EAAE,QAAQ;QACnB,aAAa,EAAE,YAAY;KAC5B,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,iBAAiB,EAAE;QACnD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,IAAI,CAAC,IAAI,EAA4B,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,MAAc,EACd,QAAgB,EAChB,YAAoB;IAEpB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,YAAY;QAC3B,SAAS,EAAE,QAAQ;KACpB,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,iBAAiB,EAAE;QACnD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,IAAI,CAAC,IAAI,EAA4B,CAAC;AAC/C,CAAC;AAED,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF,SAAS,KAAK,CAAC,OAAe,EAAE,MAAqB;IACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;QAC5C,MAAM,aAAa,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QAEhD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,qBAAqB,CAAC,CAAC;QAC/D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;QACvD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAClD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1C,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;QAC1D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QAC1D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAEzC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAClD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,aAAa,EAAE,CAAC,CAAC;gBACzE,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;oBACjC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;oBACrB,OAAO;gBACT,CAAC;gBAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,IAAI,GACR,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,KAAK,CAAC;oBACrD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;oBACnE,GAAG,CAAC,GAAG,CACL,uCAAuC,IAAI,oBAAoB,CAChE,CAAC;oBACF,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;oBACxB,OAAO;gBACT,CAAC;gBAED,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACpD,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;oBAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBACnB,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;oBAC1B,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;oBACpC,OAAO;gBACT,CAAC;gBAED,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBACnB,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBACnB,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;oBACpD,OAAO;gBACT,CAAC;gBAED,2BAA2B;gBAC3B,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,QAAQ,EACf,IAAI,EACJ,YAAY,CACb,CAAC;gBACF,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACpD,MAAM,KAAK,GACR,SAAS,CAAC,KAAgB;oBAC1B,SAAS,CAAC,kBAA6B;oBACxC,SAAS,CAAC;gBACZ,MAAM,GAAG,GAAG,SAAS,CAAC,GAAa,CAAC;gBAEpC,kCAAkC;gBAClC,uEAAuE;gBACvE,IAAI,OAAO,GAAa,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;oBAC5D,OAAO;wBACJ,aAAa,CAAC,kBAAkB,CAAc,IAAI,EAAE,CAAC;gBAC1D,CAAC;gBAAC,MAAM,CAAC;oBACP,uDAAuD;gBACzD,CAAC;gBAED,oBAAoB;gBACpB,gBAAgB,CAAC,OAAO,EAAE;oBACxB,OAAO,EAAE,MAAM,CAAC,QAAQ;oBACxB,WAAW,EAAE,MAAM,CAAC,YAAY;oBAChC,YAAY,EAAE,MAAM,CAAC,aAAa;oBAClC,SAAS,EAAE,IAAI,IAAI,CACjB,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CACtC,CAAC,WAAW,EAAE;oBACf,KAAK;oBACL,GAAG;iBACJ,CAAC,CAAC;gBAEH,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CACL,yCAAyC,OAAO,oDAAoD,CACrG,CAAC;gBAEF,UAAU,CAAC,gBAAgB,KAAK,KAAK,OAAO,GAAG,CAAC,CAAC;gBACjD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACvB,OAAO,CAAC,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACvD,CAAC;gBAED,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,OAAO,EAAE,CAAC;YACZ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,EAAE;YAChC,OAAO,CAAC,uCAAuC,OAAO,MAAM,CAAC,CAAC;YAE9D,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBAClC,QAAQ,CAAC,SAAS,GAAG,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACjD,CAAC;qBAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;oBACxC,QAAQ,CAAC,aAAa,GAAG,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACrD,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,mCAAmC,GAAG,EAAE,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,mCAAmC,GAAG,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,0BAA0B;QAC1B,UAAU,CAAC,GAAG,EAAE;YACd,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC;QACnD,CAAC,EAAE,OAAO,CAAC,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,SAAS;AACT,gFAAgF;AAEhF,KAAK,UAAU,UAAU,CACvB,OAAe,EACf,MAAqB;IAErB,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,oBAAoB,OAAO,qBAAqB,OAAO,EAAE,CAAC,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvD,IAAI,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QAClC,OAAO,CAAC,sCAAsC,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,QAAQ,EACf,KAAK,CAAC,YAAY,CACnB,CAAC;YACF,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACpD,gBAAgB,CAAC,OAAO,EAAE;gBACxB,GAAG,KAAK;gBACR,OAAO,EAAE,MAAM,CAAC,QAAQ;gBACxB,WAAW,EAAE,MAAM,CAAC,YAAY;gBAChC,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,KAAK,CAAC,YAAY;gBACxD,SAAS,EAAE,IAAI,IAAI,CACjB,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CACtC,CAAC,WAAW,EAAE;gBACf,KAAK,EAAG,SAAS,CAAC,KAAgB,IAAI,KAAK,CAAC,KAAK;aAClD,CAAC,CAAC;YACH,UAAU,CAAC,uBAAuB,KAAK,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CACL,qDAAqD,OAAO,EAAE,CAC/D,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,oBAAoB,KAAK,CAAC,SAAS,qBAAqB,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,kCAAkC;IAClC,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC1D,OAAO,GAAI,aAAa,CAAC,kBAAkB,CAAc,IAAI,EAAE,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,6BAA6B;IAC/B,CAAC;IAED,UAAU,CAAC,gBAAgB,KAAK,CAAC,KAAK,IAAI,SAAS,KAAK,OAAO,GAAG,CAAC,CAAC;IACpE,OAAO,CAAC,YAAY,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACjC,OAAO,CAAC,YAAY,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,WAAW;AACX,gFAAgF;AAEhF,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,uCAAuC,CAAC;SACpD,QAAQ,CAAC,WAAW,EAAE,qCAAqC,CAAC;SAC5D,MAAM,CAAC,UAAU,EAAE,oCAAoC,CAAC;SACxD,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,IAA0B,EAAE,EAAE;QAC5D,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,QAAQ,CACN,+BAA+B,OAAO,MAAM;gBAC1C,aAAa,WAAW,OAAO;gBAC/B,OAAO;gBACP,QAAQ,OAAO,QAAQ;gBACvB,oEAAoE;gBACpE,4CAA4C;gBAC5C,SAAS;gBACT,OAAO,CACV,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,iBAAkB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,kCAAkC,CAAC;SAC/C,QAAQ,CAAC,WAAW,EAAE,qCAAqC,CAAC;SAC5D,MAAM,CAAC,CAAC,OAAe,EAAE,EAAE;QAC1B,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC1B,UAAU,CAAC,iBAAiB,OAAO,wBAAwB,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACP,CAAC;AAED,gFAAgF;AAChF,mCAAmC;AACnC,gFAAgF;AAEhF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;AAErD,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/src/commands/registry.d.ts

@@ -0,0 +1,20 @@
+/**
+ * mesh registry — Manage npm registry authentication for @mesh-tech packages.
+ *
+ * Handles CodeArtifact token refresh and project .npmrc setup so that
+ * `pnpm install` can resolve @mesh-tech/* packages from the private registry.
+ *
+ * Credential resolution (same as mesh deploy):
+ *   1. Existing AWS credentials in environment (CI/CD) → use directly
+ *   2. Zitadel JWT from `mesh login` → AssumeRoleWithWebIdentity
+ *   3. AWS SSO / current profile → use directly
+ *
+ * Usage:
+ *   mesh registry login                 — refresh token, ensure .npmrc
+ *   mesh registry login mesh.dev        — use Zitadel JWT for role assumption
+ *   mesh registry login --ci            — CI mode (skip .npmrc creation)
+ *   mesh registry status                — show current auth state
+ */
+import { Command } from "commander";
+export declare function registerRegistryCommands(program: Command): void;
+//# sourceMappingURL=registry.d.ts.map

package/dist/src/commands/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/commands/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqQpC,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA0F/D"}