@mesh-tech/mesh-cli 0.1.1 → 0.12.0

package/dist/src/commands/registry-publish.js

@@ -0,0 +1,161 @@
+/**
+ * `mesh registry publish --snapshot` — publish an in-development *snapshot* of the
+ * @mesh-tech/* packages to CodeArtifact under a `dev` dist-tag.
+ *
+ * Why: a consumer repo outside the monorepo (e.g. fub-mesh-apps) can't use
+ * `workspace:*`, and cutting a real release for every SDK/UI tweak is heavy. A
+ * snapshot publishes the CURRENT source at a throwaway prerelease version
+ * (`0.0.0-dev.<stamp>.<sha>`). Because it's a `0.0.0` prerelease, a consumer's
+ * `^`/`~` ranges NEVER auto-resolve it — it's picked up ONLY by an explicit pin
+ * or the `dev` dist-tag. That's the "pushed to the registry but explicitly
+ * referenced" contract.
+ *
+ * Real releases still go through changesets + the changeset-version CI workflow;
+ * this command is dev-loop tooling only and never touches the `latest` dist-tag.
+ *
+ * Mechanism: set the snapshot version into each selected publishable package.json,
+ * reuse the proven scripts/publish-packages.sh (which runs build:publish — whose
+ * build-for-publish.ts rewrites internal workspace:* deps to the local version,
+ * i.e. the snapshot — then publishes each package), always restore the source
+ * package.json versions afterward.
+ */
+import { execFileSync, execSync } from "child_process";
+import * as fs from "fs";
+import * as path from "path";
+import { logError, logInfo, logSuccess } from "../utils/log.js";
+import { resolveCredentials, codeartifactLogin } from "./registry.js";
+function repoRoot() {
+    return execSync("git rev-parse --show-toplevel", { encoding: "utf-8" }).trim();
+}
+/** `0.0.0-dev.<YYYYMMDDHHMMSS>.<shortsha>` — a valid semver prerelease. */
+function computeSnapshotVersion(root) {
+    const sha = execSync("git rev-parse --short HEAD", { cwd: root, encoding: "utf-8" }).trim();
+    const stamp = new Date().toISOString().replace(/[-:T]/g, "").slice(0, 14);
+    return `0.0.0-dev.${stamp}.${sha}`;
+}
+/** Rewrite the top-level "version" field, preserving the file's formatting. */
+function setPackageVersion(file, version) {
+    const content = fs.readFileSync(file, "utf-8");
+    const next = content.replace(/"version"(\s*:\s*)"[^"]*"/, `"version"$1"${version}"`);
+    fs.writeFileSync(file, next);
+}
+/**
+ * Tracked package.json files with uncommitted modifications (`git diff`), as a set
+ * of repo-relative paths. Used to tell the user's OWN pre-existing edits apart from
+ * files `build:publish` dirties as a side effect (it re-vendors e.g. hub subpackages),
+ * so cleanup reverts only the latter.
+ */
+function dirtyPackageJsons(root) {
+    const out = execSync("git diff --name-only", { cwd: root, encoding: "utf-8" });
+    return new Set(out.split("\n").map((s) => s.trim()).filter((s) => s.endsWith("package.json")));
+}
+export function registerRegistryPublish(registry) {
+    registry
+        .command("publish")
+        .description("Publish an in-development snapshot of @mesh-tech packages to CodeArtifact (dev dist-tag)")
+        .argument("[context]", 'Platform context for Zitadel auth (e.g. "mesh.dev")')
+        .option("--snapshot", "Publish a dev snapshot build (required — real releases go through changesets/CI)", false)
+        .option("--tag <tag>", "dist-tag to publish the snapshot under", "dev")
+        .option("--only <pkgs>", "Comma-separated substring filter, e.g. --only agent-sdk,app-kit (default: all publishable)")
+        .option("--dry-run", "Build + resolve versions but do not upload", false)
+        .option("--role <arn>", "IAM role ARN for registry access")
+        .action(async (context, opts) => {
+        if (!opts.snapshot) {
+            logError("mesh registry publish currently supports only snapshot (dev) builds.\n\n" +
+                "Re-run with --snapshot. Real releases go through changesets + the\n" +
+                "changeset-version CI workflow, not this command.");
+            process.exit(1);
+        }
+        const root = repoRoot();
+        // 1. CodeArtifact auth (token + scoped registry written to ~/.npmrc).
+        const awsCreds = resolveCredentials(context, opts.role);
+        const env = Object.keys(awsCreds).length > 0
+            ? { ...process.env, ...awsCreds }
+            : undefined;
+        logInfo("Authenticating with CodeArtifact...");
+        if (!codeartifactLogin(env)) {
+            logError("CodeArtifact login failed. Run: mesh registry login <context>");
+            process.exit(1);
+        }
+        // 2. Resolve the publishable set (optionally filtered by --only).
+        const listPath = path.join(root, "scripts/lib/publishable-packages.json");
+        const all = JSON.parse(fs.readFileSync(listPath, "utf-8"));
+        const patterns = (opts.only ?? "")
+            .split(",")
+            .map((s) => s.trim())
+            .filter(Boolean);
+        const selected = patterns.length
+            ? all.filter((p) => patterns.some((pat) => p.dir.includes(pat) || p.name.includes(pat)))
+            : all;
+        if (selected.length === 0) {
+            logError(`No publishable package matched --only '${opts.only}'`);
+            process.exit(1);
+        }
+        // 3. Snapshot version — uniform across the selected set so their internal
+        //    @mesh-tech deps rewrite to the same version.
+        const version = computeSnapshotVersion(root);
+        logInfo(`Snapshot version: ${version} (dist-tag '${opts.tag}')`);
+        // Snapshot the user's PRE-EXISTING dirty package.json set, so the cleanup in
+        // `finally` reverts only what this run (and build:publish) touched, never their edits.
+        const preDirty = dirtyPackageJsons(root);
+        // 4. Stamp the version onto each selected package (+ its sub-packages),
+        //    remembering the originals so we can always restore.
+        const backups = [];
+        const stamp = (dir) => {
+            const file = path.join(root, dir, "package.json");
+            if (!fs.existsSync(file))
+                return;
+            backups.push({ file, content: fs.readFileSync(file, "utf-8") });
+            setPackageVersion(file, version);
+        };
+        try {
+            for (const p of selected) {
+                stamp(p.dir);
+                for (const sub of p.subPackages ?? []) {
+                    stamp(path.join(p.dir, typeof sub === "string" ? sub : sub.dir));
+                }
+            }
+            // 5. Build + publish via the proven script (dev tag, never `latest`).
+            const args = [
+                "scripts/publish-packages.sh",
+                "--tag",
+                opts.tag,
+                "--skip-latest",
+                // Pass the TS-resolved DIRS (not the raw patterns) so the shell's
+                // dir-substring --only filter selects exactly the set we stamped —
+                // a name-only pattern would otherwise stamp here but be skipped there.
+                ...(patterns.length ? ["--only", selected.map((p) => p.dir).join(",")] : []),
+                ...(opts.dryRun ? ["--dry-run"] : []),
+            ];
+            logInfo(`Publishing ${selected.length} package(s)...`);
+            execFileSync("bash", args, { cwd: root, stdio: "inherit", env: env ?? process.env });
+        }
+        finally {
+            for (const b of backups)
+                fs.writeFileSync(b.file, b.content);
+            logInfo("Restored source package.json versions.");
+            // build:publish re-vendors some package.json files (e.g. hub subpackages)
+            // beyond the ones we stamped — revert those too so a local run leaves a clean
+            // tree, but NEVER the user's own pre-existing edits.
+            const collateral = [...dirtyPackageJsons(root)].filter((f) => !preDirty.has(f));
+            if (collateral.length) {
+                try {
+                    execFileSync("git", ["checkout", "--", ...collateral], { cwd: root, stdio: "inherit" });
+                    logInfo(`Reverted ${collateral.length} package.json file(s) re-vendored by build:publish.`);
+                }
+                catch {
+                    logError(`Could not auto-revert build:publish side-effects — run \`git checkout --\` on:\n  ${collateral.join("\n  ")}`);
+                }
+            }
+        }
+        // 6. Tell the user exactly how to consume it.
+        logSuccess(`Published snapshot ${version} under dist-tag '${opts.tag}'.`);
+        console.log("\nPin these EXACTLY in the consumer repo (prereleases are never auto-resolved by ^/~):");
+        for (const p of selected)
+            console.log(`  "${p.name}": "${version}",`);
+        console.log(`\nOr always grab the newest dev build:\n  pnpm add ${selected
+            .map((p) => `${p.name}@${opts.tag}`)
+            .join(" ")}`);
+    });
+}
+//# sourceMappingURL=registry-publish.js.map

package/dist/src/commands/registry-publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-publish.js","sourceRoot":"","sources":["../../../src/commands/registry-publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAgBtE,SAAS,QAAQ;IACf,OAAO,QAAQ,CAAC,+BAA+B,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACjF,CAAC;AAED,2EAA2E;AAC3E,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,GAAG,GAAG,QAAQ,CAAC,4BAA4B,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5F,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1E,OAAO,aAAa,KAAK,IAAI,GAAG,EAAE,CAAC;AACrC,CAAC;AAED,+EAA+E;AAC/E,SAAS,iBAAiB,CAAC,IAAY,EAAE,OAAe;IACtD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,2BAA2B,EAAE,eAAe,OAAO,GAAG,CAAC,CAAC;IACrF,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/E,OAAO,IAAI,GAAG,CACZ,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAC/E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAAiB;IACvD,QAAQ;SACL,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CACV,0FAA0F,CAC3F;SACA,QAAQ,CAAC,WAAW,EAAE,qDAAqD,CAAC;SAC5E,MAAM,CACL,YAAY,EACZ,kFAAkF,EAClF,KAAK,CACN;SACA,MAAM,CAAC,aAAa,EAAE,wCAAwC,EAAE,KAAK,CAAC;SACtE,MAAM,CACL,eAAe,EACf,4FAA4F,CAC7F;SACA,MAAM,CAAC,WAAW,EAAE,4CAA4C,EAAE,KAAK,CAAC;SACxE,MAAM,CAAC,cAAc,EAAE,kCAAkC,CAAC;SAC1D,MAAM,CAAC,KAAK,EAAE,OAA2B,EAAE,IAAiB,EAAE,EAAE;QAC/D,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,QAAQ,CACN,0EAA0E;gBACxE,qEAAqE;gBACrE,kDAAkD,CACrD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QAExB,sEAAsE;QACtE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,GAAG,GACP,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;YAC9B,CAAC,CAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,QAAQ,EAA6B;YAC7D,CAAC,CAAC,SAAS,CAAC;QAChB,OAAO,CAAC,qCAAqC,CAAC,CAAC;QAC/C,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,QAAQ,CAAC,+DAA+D,CAAC,CAAC;YAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,kEAAkE;QAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,uCAAuC,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAqB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7E,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;aAC/B,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM;YAC9B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YACxF,CAAC,CAAC,GAAG,CAAC;QACR,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,0CAA0C,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,0EAA0E;QAC1E,kDAAkD;QAClD,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,CAAC,qBAAqB,OAAO,eAAe,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAEjE,6EAA6E;QAC7E,uFAAuF;QACvF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAEzC,wEAAwE;QACxE,yDAAyD;QACzD,MAAM,OAAO,GAAwC,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,CAAC,GAAW,EAAQ,EAAE;YAClC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YAClD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO;YACjC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YAChE,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACb,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;oBACtC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;gBACnE,CAAC;YACH,CAAC;YAED,sEAAsE;YACtE,MAAM,IAAI,GAAG;gBACX,6BAA6B;gBAC7B,OAAO;gBACP,IAAI,CAAC,GAAG;gBACR,eAAe;gBACf,kEAAkE;gBAClE,mEAAmE;gBACnE,uEAAuE;gBACvE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACtC,CAAC;YACF,OAAO,CAAC,cAAc,QAAQ,CAAC,MAAM,gBAAgB,CAAC,CAAC;YACvD,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACvF,CAAC;gBAAS,CAAC;YACT,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YAC7D,OAAO,CAAC,wCAAwC,CAAC,CAAC;YAElD,0EAA0E;YAC1E,8EAA8E;YAC9E,qDAAqD;YACrD,MAAM,UAAU,GAAG,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAChF,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;gBACtB,IAAI,CAAC;oBACH,YAAY,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;oBACxF,OAAO,CAAC,YAAY,UAAU,CAAC,MAAM,qDAAqD,CAAC,CAAC;gBAC9F,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,CACN,qFAAqF,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAC/G,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,8CAA8C;QAC9C,UAAU,CAAC,sBAAsB,OAAO,oBAAoB,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CACT,wFAAwF,CACzF,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,OAAO,OAAO,IAAI,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CACT,sDAAsD,QAAQ;aAC3D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;aACnC,IAAI,CAAC,GAAG,CAAC,EAAE,CACf,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/registry.d.ts

@@ -4,17 +4,161 @@
  * Handles CodeArtifact token refresh and project .npmrc setup so that
  * `pnpm install` can resolve @mesh-tech/* packages from the private registry.
  *
- * Credential resolution (same as mesh deploy):
+ * Credential resolution, in order:
+ *   0. The Zitadel-gated registry-auth BROKER — needs no AWS anything on this
+ *      machine. This is the path a brand-new developer takes.
  *   1. Existing AWS credentials in environment (CI/CD) → use directly
  *   2. Zitadel JWT from `mesh login` → AssumeRoleWithWebIdentity
  *   3. AWS SSO / current profile → use directly
  *
+ * Paths 1–3 all shell out to the AWS CLI, so they require it to be installed
+ * and credentialed. Path 0 requires only a Mesh account, which is the whole
+ * point (design: registry-access-without-aws-sso).
+ *
  * Usage:
  *   mesh registry login                 — refresh token, ensure .npmrc
- *   mesh registry login mesh.dev        — use Zitadel JWT for role assumption
+ *   mesh registry login mesh.dev        — broker first, then the AWS paths
  *   mesh registry login --ci            — CI mode (skip .npmrc creation)
+ *   mesh registry login --no-broker     — skip the broker, force the AWS paths
  *   mesh registry status                — show current auth state
  */
 import { Command } from "commander";
+import type { RegistryTokenState } from "../utils/auth-preflight.js";
+import { type RegistryBrokerFailure, type RegistryGrant } from "../utils/registry-broker.js";
+/**
+ * Run `aws codeartifact login` to set the auth token in ~/.npmrc.
+ */
+export declare function codeartifactLogin(env?: Record<string, string>): boolean;
+/**
+ * Resolve the publisher role ARN to assume for `--publish`.
+ *
+ * Precedence: explicit --role-arn flag wins, then the registry's SSM export
+ * (publisherRoleArn, Task 2 of MESH-2168). Throws an actionable error if
+ * neither is available — there's no safe default to fall back to since
+ * publishing is an opt-in privileged path (DEFAULT_REGISTRY_ROLE stays null).
+ */
+export declare function resolvePublisherRoleArn({ roleArnFlag, ssmArn, }: {
+    roleArnFlag?: string;
+    ssmArn?: string;
+}): string;
+/**
+ * Resolve AWS credentials for registry access.
+ *
+ * Returns env var overrides (or empty object if current env is fine).
+ */
+export declare function resolveCredentials(context?: string, roleArn?: string): Record<string, string>;
+/**
+ * Write a broker-issued grant into ~/.npmrc: the scoped registry line and the
+ * endpoint's auth token, in exactly the shape `aws codeartifact login
+ * --namespace @mesh-tech` would have written.
+ *
+ * Byte-compatibility with the AWS CLI's output is the requirement, not a nicety:
+ * `mesh registry status`, the `mesh start` preflight and the dev doctor all
+ * parse ~/.npmrc for that pair, and a machine that gets its token from the
+ * broker has to look identical to one that got it from AWS.
+ */
+export declare function applyGrantToUserNpmrc(grant: RegistryGrant, npmrcPath?: string): {
+    path: string;
+};
+/**
+ * Human-facing explanation of a failed broker attempt, plus whether the AWS
+ * fallback chain is worth running.
+ *
+ * `not-authorized` is the one case we do NOT fall through on: the caller has a
+ * working Mesh account that simply lacks the grant, and quietly trying AWS next
+ * would either succeed (masking a missing grant with an AWS account we're
+ * trying to stop requiring) or fail with an unrelated AWS error that buries the
+ * real answer.
+ */
+export declare function describeBrokerFailure(failure: RegistryBrokerFailure, context?: string): {
+    message: string;
+    hint?: string;
+    fatal: boolean;
+};
+/**
+ * Whether this `mesh registry login` invocation may rewrite ~/.npmrc.
+ *
+ * The self-heal is a **laptop** fix. CI pipelines run the unscoped
+ * `aws codeartifact login` DELIBERATELY — a host-scoped token is what lets
+ * pnpm pull upstream-cached public packages through CodeArtifact — so in a
+ * runner the "hijack" line is load-bearing and deleting it would break the
+ * install we were asked not to touch. `--ci` is the one signal that says so.
+ *
+ * Extracted (and tested) rather than left inline because "this changes no CI
+ * behaviour" is a promise about the code, not about the workflow files we
+ * happen not to have edited.
+ */
+export declare function shouldRepairUserNpmrc(opts: Pick<RegistryLoginOptions, "ci">): boolean;
+/**
+ * Repair a hijacked ~/.npmrc: remove an unscoped `registry=<codeartifact>`
+ * line if one is present, after taking a timestamped backup.
+ *
+ * `aws codeartifact login` run WITHOUT `--namespace @mesh-tech` writes that
+ * line, and nothing in this CLI used to remove it — so one bare login made
+ * CodeArtifact the default registry forever, and every public `npm install`
+ * started failing with E401 12 hours later when the token expired. We write
+ * the correct (scoped) state; this is the missing repair of the wrong state.
+ *
+ * Never throws — a repair failure must not fail an otherwise-good login.
+ */
+export declare function repairUnscopedRegistry(npmrcPath?: string): {
+    removed: string | null;
+    backupPath?: string;
+    error?: string;
+};
+/**
+ * Check that ~/.npmrc is in a working state for @mesh-tech installs: a
+ * CodeArtifact token that the registry actually accepts, and no unscoped
+ * `registry=` hijacking public npm.
+ *
+ * A substring match on the file (the old check) reported "valid" for an
+ * expired token AND for a hijacked default registry — precisely the state
+ * `mesh registry status` exists to catch.
+ */
+export interface RegistryTokenCheck {
+    /** Token accepted by the registry AND no unscoped `registry=` hijack. */
+    valid: boolean;
+    /** The probe's verdict, so callers can tell "broken" from "unverifiable". */
+    state: RegistryTokenState;
+    endpoint?: string;
+    reason?: string;
+    hijackLine?: string;
+}
+export declare function checkExistingToken(): Promise<RegistryTokenCheck>;
+/**
+ * `mesh registry status` — returns the process exit code instead of calling
+ * `process.exit`, so the "broken" vs "unverifiable" distinction is testable.
+ *
+ * Exit 1 is for faults the user can act on right now: a missing or expired
+ * token, or an unscoped CodeArtifact `registry=` line (locally detectable, and
+ * broken regardless of the network). An **unreachable** registry is neither —
+ * it warns and exits 0, because the remediation we'd print (`mesh registry
+ * login`) cannot work offline either, and the same rule already governs the
+ * `mesh init` doctor.
+ */
+export declare function runRegistryStatus(opts?: {
+    /** Test seam — defaults to the real ~/.npmrc + live registry probe. */
+    check?: () => Promise<RegistryTokenCheck>;
+}): Promise<number>;
+export interface RegistryLoginOptions {
+    role?: string;
+    ci?: boolean;
+    skipNpmrc?: boolean;
+    /** AWS SSO profile (e.g. mesh-dev) — auto-runs `aws sso login` when stale */
+    profile?: string;
+    /** Assume the registry's publisher role (from --role or the registry's SSM export) */
+    publish?: boolean;
+    /**
+     * Try the Zitadel-gated registry broker before the AWS paths. Default true.
+     * `--no-broker` forces the AWS chain (commander sets this to false).
+     */
+    broker?: boolean;
+}
+/**
+ * The full registry-auth sequence (CodeArtifact token → ~/.npmrc → project
+ * .npmrc). Shared by `mesh registry login` and `mesh login <context>` (F2:
+ * login absorbs registry auth).
+ */
+export declare function runRegistryLogin(context: string | undefined, opts: RegistryLoginOptions): Promise<void>;
 export declare function registerRegistryCommands(program: Command): void;
 //# sourceMappingURL=registry.d.ts.map

package/dist/src/commands/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/commands/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqQpC,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA0F/D"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/commands/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAkBpC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAOL,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AA6CrC;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAkBvE;AAwCD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,WAAW,EACX,MAAM,GACP,EAAE;IACD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAQT;AAqDD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgDxB;AA2DD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,aAAa,EACpB,SAAS,SAAkB,GAC1B;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAsBlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,qBAAqB,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;CAChB,CAyCA;AA+DD;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,GAAG,OAAO,CAErF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,SAAkB,GAAG;IACnE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAmBA;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,yEAAyE;IACzE,KAAK,EAAE,OAAO,CAAC;IACf,6EAA6E;IAC7E,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAmCtE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,CAAC,EAAE;IAC7C,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAC3C,GAAG,OAAO,CAAC,MAAM,CAAC,CAiDlB;AAsDD,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sFAAsF;IACtF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2J7G;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAmC/D"}