@mesh-tech/mesh-cli 0.1.1 → 0.12.0

package/dist/src/commands/registry.js

@@ -4,22 +4,33 @@
  * Handles CodeArtifact token refresh and project .npmrc setup so that
  * `pnpm install` can resolve @mesh-tech/* packages from the private registry.
  *
- * Credential resolution (same as mesh deploy):
+ * Credential resolution, in order:
+ *   0. The Zitadel-gated registry-auth BROKER — needs no AWS anything on this
+ *      machine. This is the path a brand-new developer takes.
  *   1. Existing AWS credentials in environment (CI/CD) → use directly
  *   2. Zitadel JWT from `mesh login` → AssumeRoleWithWebIdentity
  *   3. AWS SSO / current profile → use directly
  *
+ * Paths 1–3 all shell out to the AWS CLI, so they require it to be installed
+ * and credentialed. Path 0 requires only a Mesh account, which is the whole
+ * point (design: registry-access-without-aws-sso).
+ *
  * Usage:
  *   mesh registry login                 — refresh token, ensure .npmrc
- *   mesh registry login mesh.dev        — use Zitadel JWT for role assumption
+ *   mesh registry login mesh.dev        — broker first, then the AWS paths
  *   mesh registry login --ci            — CI mode (skip .npmrc creation)
+ *   mesh registry login --no-broker     — skip the broker, force the AWS paths
  *   mesh registry status                — show current auth state
  */
 import { execFileSync } from "child_process";
 import * as fs from "fs";
 import * as path from "path";
 import { logError, logInfo, logSuccess, logWarn } from "../utils/log.js";
+import { MeshCliError } from "../utils/errors.js";
+import { awsConfigHasProfile, findUnscopedCodeArtifactRegistry, homeNpmrcPath, npmrcAuthKeyForEndpoint, probeRegistryToken, readAwsConfig, REGISTRY_CONTEXT, SSO_SESSION_SNIPPET, stripUnscopedCodeArtifactRegistry, upsertNpmrcLines, } from "../utils/auth-preflight.js";
+import { fetchRegistryGrant, realGrantDeps, DERIVED_BROKER_TIMEOUT_MS, PUBLISHED_BROKER_TIMEOUT_MS, resolveDefaultBrokerContext, resolveRegistryBrokerSource, } from "../utils/registry-broker.js";
 import { readCredentials } from "./login.js";
+import { registerRegistryPublish } from "./registry-publish.js";
 // =============================================================================
 // Constants — platform CodeArtifact registry
 // =============================================================================
@@ -60,7 +71,7 @@ function getEndpoint(env) {
 /**
  * Run `aws codeartifact login` to set the auth token in ~/.npmrc.
  */
-function codeartifactLogin(env) {
+export function codeartifactLogin(env) {
     try {
         execFileSync("aws", [
             "codeartifact", "login",
@@ -80,6 +91,57 @@ function codeartifactLogin(env) {
         return false;
     }
 }
+/**
+ * Parse a mesh context like "mesh.dev" into tenant + env.
+ * Returns null if the context doesn't match the expected {tenant}.{env} pattern.
+ *
+ * (Mirrors login.ts's parseTenantEnv — kept local/minimal here to avoid
+ * expanding login.ts's export surface for a single caller.)
+ */
+function parseTenantEnv(context) {
+    const parts = context.split(".");
+    if (parts.length !== 2 || !parts[0] || !parts[1])
+        return null;
+    return { tenant: parts[0], env: parts[1] };
+}
+/**
+ * Read the registry's SSM export (published by PackageRegistry, Task 2 of
+ * MESH-2168) for a given tenant/env, e.g. /mesh-platform/mesh/dev/registry.
+ *
+ * Returns null on any failure (missing param, no AWS creds, malformed JSON) —
+ * callers treat a null publisherRoleArn as "not configured" and surface an
+ * actionable error via resolvePublisherRoleArn.
+ */
+async function getRegistrySsmExport(tenant, env) {
+    try {
+        const { SSMClient, GetParameterCommand } = await import("@aws-sdk/client-ssm");
+        const region = process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? CA_REGION;
+        const ssm = new SSMClient({ region });
+        const ssmPath = `/mesh-platform/${tenant}/${env}/registry`;
+        const response = await ssm.send(new GetParameterCommand({ Name: ssmPath }));
+        if (!response.Parameter?.Value)
+            return null;
+        return JSON.parse(response.Parameter.Value);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve the publisher role ARN to assume for `--publish`.
+ *
+ * Precedence: explicit --role-arn flag wins, then the registry's SSM export
+ * (publisherRoleArn, Task 2 of MESH-2168). Throws an actionable error if
+ * neither is available — there's no safe default to fall back to since
+ * publishing is an opt-in privileged path (DEFAULT_REGISTRY_ROLE stays null).
+ */
+export function resolvePublisherRoleArn({ roleArnFlag, ssmArn, }) {
+    const resolved = roleArnFlag || ssmArn;
+    if (!resolved) {
+        throw new Error("No publisher role: pass --role or ensure the registry stack exported publisherRoleArn (MESH-2168).");
+    }
+    return resolved;
+}
 /**
  * Assume an IAM role, return credential env vars.
  */
@@ -130,7 +192,7 @@ function assumeRoleWithWebIdentity(roleArn, idToken, sessionName) {
  *
  * Returns env var overrides (or empty object if current env is fine).
  */
-function resolveCredentials(context, roleArn) {
+export function resolveCredentials(context, roleArn) {
     // Path 1: Existing AWS credentials in environment
     if (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SESSION_TOKEN) {
         logInfo("Using existing AWS credentials from environment");
@@ -229,26 +291,476 @@ function ensureProjectNpmrc(endpoint) {
     return { created: false, updated: true, path: npmrcPath };
 }
 /**
- * Check if the current ~/.npmrc has a valid CodeArtifact token for our registry.
+ * Write a broker-issued grant into ~/.npmrc: the scoped registry line and the
+ * endpoint's auth token, in exactly the shape `aws codeartifact login
+ * --namespace @mesh-tech` would have written.
+ *
+ * Byte-compatibility with the AWS CLI's output is the requirement, not a nicety:
+ * `mesh registry status`, the `mesh start` preflight and the dev doctor all
+ * parse ~/.npmrc for that pair, and a machine that gets its token from the
+ * broker has to look identical to one that got it from AWS.
+ */
+export function applyGrantToUserNpmrc(grant, npmrcPath = homeNpmrcPath()) {
+    let existing = "";
+    try {
+        existing = fs.readFileSync(npmrcPath, "utf-8");
+    }
+    catch {
+        // no ~/.npmrc yet — a clean laptop, which is the case this exists for
+    }
+    const content = upsertNpmrcLines(existing, [
+        { key: `${grant.scope}:registry`, value: grant.endpoint },
+        { key: `${npmrcAuthKeyForEndpoint(grant.endpoint)}:_authToken`, value: grant.authorizationToken },
+    ]);
+    fs.mkdirSync(path.dirname(npmrcPath), { recursive: true });
+    fs.writeFileSync(npmrcPath, content, { mode: 0o600 });
+    // `mode` only applies when writeFileSync CREATES the file, so an existing
+    // 0644 ~/.npmrc would keep world-readable permissions on a 12h bearer token.
+    // Parity with `aws codeartifact login` either way, but one line buys better.
+    try {
+        fs.chmodSync(npmrcPath, 0o600);
+    }
+    catch {
+        // A read-only home or an exotic filesystem must not fail an otherwise-good login.
+    }
+    return { path: npmrcPath };
+}
+/**
+ * Human-facing explanation of a failed broker attempt, plus whether the AWS
+ * fallback chain is worth running.
+ *
+ * `not-authorized` is the one case we do NOT fall through on: the caller has a
+ * working Mesh account that simply lacks the grant, and quietly trying AWS next
+ * would either succeed (masking a missing grant with an AWS account we're
+ * trying to stop requiring) or fail with an unrelated AWS error that buries the
+ * real answer.
+ */
+export function describeBrokerFailure(failure, context) {
+    switch (failure.kind) {
+        case "no-broker":
+            return {
+                message: "No registry broker published for this context — using the AWS paths.",
+                fatal: false,
+            };
+        case "no-session":
+            return {
+                message: `No valid Mesh session${context ? ` for ${context}` : ""} — using the AWS paths.`,
+                hint: context ? `mesh login ${context}` : "mesh login <context>",
+                fatal: false,
+            };
+        case "unauthenticated":
+            return {
+                message: "The registry broker rejected your Mesh session (expired or wrong audience).",
+                hint: context ? `mesh login ${context}` : "mesh login <context>",
+                fatal: false,
+            };
+        case "not-authorized":
+            return {
+                // The whole message lives in the body, not in a `remediation.command`:
+                // the answer here is "ask a human for a role", which is not a command
+                // anyone can run, and rendering a URL behind "→ run:" reads as one.
+                message: `Your Mesh account${failure.email ? ` (${failure.email})` : ""} is not authorized to read ` +
+                    `${CA_NAMESPACE} packages.` +
+                    (failure.requiredRoles?.length
+                        ? `\n  Needs one of these Zitadel roles: ${failure.requiredRoles.join(", ")}`
+                        : "") +
+                    (failure.requestUrl
+                        ? `\n  Request access: ${failure.requestUrl}`
+                        : "\n  Ask a Mesh platform admin to grant your account registry access."),
+                fatal: true,
+            };
+        case "unavailable":
+            return {
+                message: `Registry broker unavailable (${failure.detail}) — falling back to the AWS paths.`,
+                fatal: false,
+            };
+    }
+}
+/**
+ * Try the broker. Returns true when it produced a working ~/.npmrc, false when
+ * the caller should continue to the AWS credential chain.
+ *
+ * Throws `MeshCliError` only for `not-authorized` — see describeBrokerFailure.
+ */
+async function tryBrokerLogin(contextArg, opts) {
+    if (opts.broker === false)
+        return null;
+    let context = contextArg;
+    if (!context) {
+        // A context-less invocation used to skip the broker silently — which sent
+        // anyone following a remediation that omits the context straight back to
+        // the AWS chain. Resolve one when it is unambiguous; say so when it isn't.
+        const resolved = resolveDefaultBrokerContext();
+        if ("context" in resolved) {
+            context = resolved.context;
+            logInfo(`No context given — using the only one with a registry broker: ${context}`);
+        }
+        else if (resolved.reason === "ambiguous") {
+            logInfo(`Skipping the registry broker: several contexts publish one (${resolved.candidates.join(", ")}). ` +
+                `Name it — e.g. \`mesh registry login ${resolved.candidates[0]}\`.`);
+            return null;
+        }
+        else {
+            logInfo("Skipping the registry broker: no signed-in context publishes one. " +
+                `To use it: \`mesh login ${REGISTRY_CONTEXT}\`, then \`mesh registry login ${REGISTRY_CONTEXT}\`.`);
+            return null;
+        }
+    }
+    const { url: brokerUrl, source } = resolveRegistryBrokerSource(context);
+    if (!brokerUrl) {
+        logInfo("No registry broker published for this context — using the AWS paths.");
+        return null;
+    }
+    logInfo(`Requesting a registry token from ${brokerUrl} (no AWS credentials needed)…`);
+    const result = await fetchRegistryGrant(context, brokerUrl, {
+        ...realGrantDeps(),
+        // A DERIVED url is a guess at a host that, for every platform not yet
+        // redeployed, does not exist — and this wait also sits on the `mesh login`
+        // path. Don't make everyone pay the published-broker timeout for a guess.
+        timeoutMs: source === "published" ? PUBLISHED_BROKER_TIMEOUT_MS : DERIVED_BROKER_TIMEOUT_MS,
+    });
+    if (result.ok)
+        return result.grant;
+    const { message, hint, fatal } = describeBrokerFailure(result.failure, context);
+    if (fatal) {
+        throw new MeshCliError(message, hint ? { remediation: { command: hint } } : undefined);
+    }
+    logWarn(message);
+    if (hint)
+        logInfo(`  Try: ${hint}`);
+    return null;
+}
+/**
+ * Whether this `mesh registry login` invocation may rewrite ~/.npmrc.
+ *
+ * The self-heal is a **laptop** fix. CI pipelines run the unscoped
+ * `aws codeartifact login` DELIBERATELY — a host-scoped token is what lets
+ * pnpm pull upstream-cached public packages through CodeArtifact — so in a
+ * runner the "hijack" line is load-bearing and deleting it would break the
+ * install we were asked not to touch. `--ci` is the one signal that says so.
+ *
+ * Extracted (and tested) rather than left inline because "this changes no CI
+ * behaviour" is a promise about the code, not about the workflow files we
+ * happen not to have edited.
+ */
+export function shouldRepairUserNpmrc(opts) {
+    return !opts.ci;
+}
+/**
+ * Repair a hijacked ~/.npmrc: remove an unscoped `registry=<codeartifact>`
+ * line if one is present, after taking a timestamped backup.
+ *
+ * `aws codeartifact login` run WITHOUT `--namespace @mesh-tech` writes that
+ * line, and nothing in this CLI used to remove it — so one bare login made
+ * CodeArtifact the default registry forever, and every public `npm install`
+ * started failing with E401 12 hours later when the token expired. We write
+ * the correct (scoped) state; this is the missing repair of the wrong state.
+ *
+ * Never throws — a repair failure must not fail an otherwise-good login.
  */
-function checkExistingToken() {
-    const homeNpmrc = path.join(process.env.HOME ?? "~", ".npmrc");
-    if (!fs.existsSync(homeNpmrc))
-        return { valid: false };
-    const content = fs.readFileSync(homeNpmrc, "utf-8");
-    // Look for a CodeArtifact token line for our domain
-    const hasToken = content.includes("mesh-platform") && content.includes("_authToken=");
-    if (!hasToken)
-        return { valid: false };
-    // Try a quick endpoint lookup to verify the token works
-    const endpoint = getEndpoint();
-    if (!endpoint)
-        return { valid: false };
-    return { valid: true, endpoint };
+export function repairUnscopedRegistry(npmrcPath = homeNpmrcPath()) {
+    let original;
+    try {
+        original = fs.readFileSync(npmrcPath, "utf-8");
+    }
+    catch {
+        return { removed: null }; // no ~/.npmrc → nothing to repair
+    }
+    const { content, removed } = stripUnscopedCodeArtifactRegistry(original);
+    if (!removed)
+        return { removed: null };
+    const backupPath = `${npmrcPath}.bak-${new Date().toISOString().replace(/[:.]/g, "-")}`;
+    try {
+        fs.writeFileSync(backupPath, original, "utf-8");
+        fs.writeFileSync(npmrcPath, content, "utf-8");
+    }
+    catch (err) {
+        return { removed: null, error: err instanceof Error ? err.message : String(err) };
+    }
+    return { removed, backupPath };
+}
+export async function checkExistingToken() {
+    const npmrcPath = homeNpmrcPath();
+    if (!fs.existsSync(npmrcPath))
+        return { valid: false, state: "missing", reason: "no ~/.npmrc" };
+    const hijackLine = findUnscopedCodeArtifactRegistry(fs.readFileSync(npmrcPath, "utf-8")) ?? undefined;
+    const probe = await probeRegistryToken({ npmrcPath });
+    if (probe.state === "missing") {
+        return { valid: false, state: probe.state, reason: "no CodeArtifact token in ~/.npmrc", hijackLine };
+    }
+    if (probe.state === "expired") {
+        return {
+            valid: false,
+            state: probe.state,
+            reason: probe.detail ?? "the CodeArtifact token is expired",
+            hijackLine,
+        };
+    }
+    if (probe.state === "unreachable") {
+        return {
+            valid: false,
+            state: probe.state,
+            reason: `could not reach the registry to verify the token (${probe.detail ?? "unknown error"})`,
+            hijackLine,
+        };
+    }
+    // Token works — a hijacked default registry still breaks public installs.
+    if (hijackLine) {
+        return { valid: false, state: probe.state, reason: "unscoped CodeArtifact registry", hijackLine };
+    }
+    return { valid: true, state: probe.state, endpoint: getEndpoint() ?? undefined };
+}
+/**
+ * `mesh registry status` — returns the process exit code instead of calling
+ * `process.exit`, so the "broken" vs "unverifiable" distinction is testable.
+ *
+ * Exit 1 is for faults the user can act on right now: a missing or expired
+ * token, or an unscoped CodeArtifact `registry=` line (locally detectable, and
+ * broken regardless of the network). An **unreachable** registry is neither —
+ * it warns and exits 0, because the remediation we'd print (`mesh registry
+ * login`) cannot work offline either, and the same rule already governs the
+ * `mesh init` doctor.
+ */
+export async function runRegistryStatus(opts) {
+    const { valid, state, endpoint, reason, hijackLine } = await (opts?.check ?? checkExistingToken)();
+    if (hijackLine) {
+        logWarn("~/.npmrc sets CodeArtifact as your DEFAULT registry — every public npm install goes " +
+            "through it and will 401 when the 12h token expires:");
+        logInfo(`  ${hijackLine.trim()}`);
+        logInfo("Fix: mesh registry login   # removes it (backup taken) and keeps @mesh-tech scoped");
+    }
+    // A network fault is not an auth fault. Any *other* invalid state is.
+    const unverifiable = state === "unreachable" && !hijackLine;
+    if (!valid && !unverifiable) {
+        logWarn(`Registry auth is not usable${reason ? ` — ${reason}` : ""}. Run: mesh registry login`);
+        return 1;
+    }
+    if (unverifiable) {
+        logWarn(`Could not verify the CodeArtifact token in ~/.npmrc — ${reason}.`);
+        logInfo("Nothing to fix from here; retry when the registry is reachable.");
+    }
+    else {
+        logSuccess("CodeArtifact token in ~/.npmrc is valid");
+        if (endpoint) {
+            logInfo(`Endpoint: ${endpoint}`);
+        }
+    }
+    // Project .npmrc — worth reporting even when the token couldn't be verified.
+    const projectRoot = findProjectRoot();
+    if (projectRoot) {
+        const npmrcPath = path.join(projectRoot, ".npmrc");
+        if (fs.existsSync(npmrcPath)) {
+            const content = fs.readFileSync(npmrcPath, "utf-8");
+            if (content.includes(`${CA_NAMESPACE}:registry=`)) {
+                logSuccess(`Project .npmrc configured (${npmrcPath})`);
+            }
+            else {
+                logWarn(`Project .npmrc exists but missing ${CA_NAMESPACE} scope (${npmrcPath})`);
+                logInfo("Run: mesh registry login");
+            }
+        }
+        else {
+            logWarn(`No .npmrc in project root (${projectRoot})`);
+            logInfo("Run: mesh registry login");
+        }
+    }
+    return 0;
 }
 // =============================================================================
 // Commands
 // =============================================================================
+/**
+ * Ensure the named AWS SSO profile has a live session — trigger the
+ * interactive `aws sso login` (browser) when it's stale.
+ *
+ * Guardrails (MESH-2479): a missing profile fails fast with the exact
+ * `aws configure` setup instead of an opaque CLI error, and the identity
+ * probes are time-bounded so a wedged AWS CLI can't hang this silently.
+ */
+function ensureSsoProfile(profile) {
+    const awsConfig = readAwsConfig();
+    if (awsConfig && !awsConfigHasProfile(awsConfig, profile)) {
+        throw new MeshCliError(`AWS profile '${profile}' is not defined in ~/.aws/config — \`aws sso login --profile ${profile}\` cannot work until it exists.\n\n` +
+            "If you only need to INSTALL @mesh-tech packages, drop --profile: `mesh login <context>` then\n" +
+            "`mesh registry login <context>` uses the Zitadel-gated broker and needs no AWS account at all.\n\n" +
+            `If you DEPLOY and genuinely need this profile — one-time setup: \`aws configure sso --profile ${profile}\`,\n` +
+            `or add the session + profile by hand:\n` +
+            `${SSO_SESSION_SNIPPET}\n[profile ${profile}]\nsso_session = mesh\nsso_account_id = <account id>\nsso_role_name = <role>\nregion = us-east-2`, { remediation: { command: `aws configure sso --profile ${profile}` } });
+    }
+    const probe = () => execFileSync("aws", ["sts", "get-caller-identity", "--profile", profile], {
+        stdio: ["ignore", "pipe", "pipe"],
+        timeout: 20_000,
+    });
+    try {
+        probe();
+        logInfo(`AWS SSO session for profile '${profile}' is live`);
+        return;
+    }
+    catch {
+        logInfo(`AWS SSO session for profile '${profile}' is stale — opening browser login…`);
+    }
+    execFileSync("aws", ["sso", "login", "--profile", profile], { stdio: "inherit" });
+    try {
+        probe();
+    }
+    catch (err) {
+        throw new MeshCliError(`AWS SSO login for profile '${profile}' completed but the session still fails an identity check.`, {
+            remediation: { command: `aws sts get-caller-identity --profile ${profile}   # see the underlying error` },
+            cause: err,
+        });
+    }
+    logSuccess(`AWS SSO session refreshed (profile '${profile}')`);
+}
+/**
+ * The full registry-auth sequence (CodeArtifact token → ~/.npmrc → project
+ * .npmrc). Shared by `mesh registry login` and `mesh login <context>` (F2:
+ * login absorbs registry auth).
+ */
+export async function runRegistryLogin(context, opts) {
+    // --publish is the opt-in privileged path: resolve the publisher role
+    // (explicit --role flag wins, else the registry's SSM export) and feed
+    // it through the same Zitadel role-assumption path as the reader flow.
+    let roleArn = opts.role;
+    if (opts.publish) {
+        let ssmArn;
+        if (!opts.role) {
+            if (!context) {
+                logError('`--publish` requires a platform context, e.g. "mesh registry login mesh.dev --publish".');
+                process.exit(1);
+            }
+            const parsed = parseTenantEnv(context);
+            if (!parsed) {
+                logError(`Could not parse tenant/env from context "${context}" (expected "<tenant>.<env>").`);
+                process.exit(1);
+            }
+            const registryExport = await getRegistrySsmExport(parsed.tenant, parsed.env);
+            ssmArn = registryExport?.publisherRoleArn;
+        }
+        try {
+            roleArn = resolvePublisherRoleArn({ roleArnFlag: opts.role, ssmArn });
+        }
+        catch (err) {
+            logError(err.message);
+            process.exit(1);
+        }
+        logInfo(`Publisher role resolved: ${roleArn}`);
+    }
+    // Step 0: the broker. Tried FIRST for the read path, because it is the only
+    // one that works on a machine with no AWS account, no AWS CLI and no
+    // ~/.aws/config — the machine this whole feature exists for.
+    //
+    // Skipped for --publish (a privileged write path that deliberately goes
+    // through an assumed IAM role) and for --profile (an explicit "use this AWS
+    // profile" instruction we must not silently override).
+    if (!opts.publish && !opts.profile) {
+        const grant = await tryBrokerLogin(context, opts);
+        if (grant) {
+            const { path: npmrcPath } = applyGrantToUserNpmrc(grant);
+            logSuccess(`Registry token issued by the Mesh broker → ${npmrcPath}` +
+                (grant.expiresAt ? ` (expires ${grant.expiresAt})` : ""));
+            // Same hijack repair as the AWS path — an unscoped `registry=` line left
+            // by a past bare `aws codeartifact login` breaks public installs
+            // regardless of where today's token came from.
+            if (shouldRepairUserNpmrc(opts)) {
+                const repair = repairUnscopedRegistry();
+                if (repair.removed) {
+                    logWarn("Removed an unscoped CodeArtifact `registry=` from ~/.npmrc — it routed ALL npm traffic " +
+                        "(public packages included) through CodeArtifact.");
+                    logInfo(`  removed: ${repair.removed.trim()}`);
+                    if (repair.backupPath)
+                        logInfo(`  backup:  ${repair.backupPath}`);
+                }
+            }
+            if (!opts.ci && !opts.skipNpmrc) {
+                const result = ensureProjectNpmrc(grant.endpoint);
+                if (result.created) {
+                    logSuccess(`Created ${result.path} with ${CA_NAMESPACE} registry scope`);
+                }
+                else if (result.updated) {
+                    logSuccess(`Updated ${CA_NAMESPACE} registry in ${result.path}`);
+                }
+                else {
+                    logInfo(`${result.path} already configured`);
+                }
+            }
+            logSuccess(`Ready — run pnpm install to fetch ${CA_NAMESPACE} packages`);
+            return;
+        }
+    }
+    let env;
+    if (opts.profile) {
+        // Jawad's flow, one command: live SSO session + profile-scoped token.
+        // Static creds in the environment would override the profile — drop them.
+        ensureSsoProfile(opts.profile);
+        env = { ...process.env, AWS_PROFILE: opts.profile };
+        for (const key of ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN"]) {
+            delete env[key];
+        }
+    }
+    else {
+        const awsCreds = resolveCredentials(context, roleArn);
+        env = Object.keys(awsCreds).length > 0
+            ? { ...process.env, ...awsCreds }
+            : undefined;
+    }
+    // Step 1: Run `aws codeartifact login` (sets token in ~/.npmrc)
+    logInfo("Authenticating with CodeArtifact...");
+    if (!codeartifactLogin(env)) {
+        logError("CodeArtifact login failed.\n\n" +
+            "You do NOT need an AWS account to install @mesh-tech packages. The supported path is:\n" +
+            `  mesh login ${context ?? "<context>"}          # browser → Zitadel; then re-run this command\n\n` +
+            "This machine fell through to the AWS path, which means one of: the platform publishes no\n" +
+            "registry broker yet, your Mesh account is not signed in, or the broker was unreachable —\n" +
+            "the warning above says which.\n\n" +
+            "AWS SSO is only needed if you DEPLOY (mesh deploy):\n" +
+            "  mesh registry login --profile mesh-dev   # auto-runs `aws sso login`");
+        process.exit(1);
+    }
+    logSuccess("CodeArtifact token refreshed (valid for 12 hours)");
+    // Step 1b: Repair a hijacked ~/.npmrc. We always write the SCOPED form
+    // above (--namespace @mesh-tech), but a bare `aws codeartifact login` run
+    // at any point in the past leaves an unscoped `registry=` line that we
+    // never removed — so it survived every subsequent correct login.
+    //
+    // Laptops only — see shouldRepairUserNpmrc: in `--ci` the unscoped line is
+    // doing its job and a "repair" would break the runner's install.
+    if (shouldRepairUserNpmrc(opts)) {
+        const repair = repairUnscopedRegistry();
+        if (repair.removed) {
+            logWarn("Removed an unscoped CodeArtifact `registry=` from ~/.npmrc — it routed ALL npm traffic " +
+                "(public packages included) through CodeArtifact, so every install broke when the 12h token expired. " +
+                `${CA_NAMESPACE} stays scoped; public packages now go to npmjs.`);
+            logInfo(`  removed: ${repair.removed.trim()}`);
+            if (repair.backupPath)
+                logInfo(`  backup:  ${repair.backupPath}`);
+        }
+        else if (repair.error) {
+            logWarn(`Could not repair ~/.npmrc (${repair.error}) — remove any unscoped \`registry=\` line by hand.`);
+        }
+    }
+    // Step 2: Get endpoint URL
+    const endpoint = getEndpoint(env);
+    if (!endpoint) {
+        logWarn("Could not retrieve registry endpoint — .npmrc scope not configured");
+        logInfo("You may need to manually add to .npmrc:");
+        logInfo(`  ${CA_NAMESPACE}:registry=https://mesh-platform-<ACCOUNT>.d.codeartifact.${CA_REGION}.amazonaws.com/npm/${CA_REPOSITORY}/`);
+        return;
+    }
+    // Step 3: Ensure project .npmrc (unless --ci or --skip-npmrc)
+    if (!opts.ci && !opts.skipNpmrc) {
+        const result = ensureProjectNpmrc(endpoint);
+        if (result.created) {
+            logSuccess(`Created ${result.path} with ${CA_NAMESPACE} registry scope`);
+        }
+        else if (result.updated) {
+            logSuccess(`Updated ${CA_NAMESPACE} registry in ${result.path}`);
+        }
+        else {
+            logInfo(`${result.path} already configured`);
+        }
+    }
+    logSuccess(`Ready — run pnpm install to fetch ${CA_NAMESPACE} packages`);
+}
 export function registerRegistryCommands(program) {
     const registry = program
         .command("registry")
@@ -260,77 +772,21 @@ export function registerRegistryCommands(program) {
         .option("--role <arn>", "IAM role ARN for registry access")
         .option("--ci", "CI mode — refresh token only, skip project .npmrc setup")
         .option("--skip-npmrc", "Skip project .npmrc setup")
+        .option("--profile <name>", "AWS SSO profile (e.g. mesh-dev) — auto-runs `aws sso login` when the session is stale")
+        .option("--no-broker", "Skip the Zitadel-gated registry broker and go straight to the AWS credential chain")
+        .option("--publish", "Assume the registry's publisher role for CodeArtifact publish access " +
+        "(opt-in privileged path — resolves publisherRoleArn from the registry's SSM export unless --role is given)")
         .action(async (context, opts) => {
-        // Resolve AWS credentials
-        const awsCreds = resolveCredentials(context, opts.role);
-        const env = Object.keys(awsCreds).length > 0
-            ? { ...process.env, ...awsCreds }
-            : undefined;
-        // Step 1: Run `aws codeartifact login` (sets token in ~/.npmrc)
-        logInfo("Authenticating with CodeArtifact...");
-        if (!codeartifactLogin(env)) {
-            logError("CodeArtifact login failed.\n\n" +
-                "Check that your AWS credentials have codeartifact:GetAuthorizationToken permission.\n" +
-                "If using AWS SSO, run: aws sso login\n" +
-                "If using Zitadel: mesh login <context>");
-            process.exit(1);
-        }
-        logSuccess("CodeArtifact token refreshed (valid for 12 hours)");
-        // Step 2: Get endpoint URL
-        const endpoint = getEndpoint(env);
-        if (!endpoint) {
-            logWarn("Could not retrieve registry endpoint — .npmrc scope not configured");
-            logInfo("You may need to manually add to .npmrc:");
-            logInfo(`  ${CA_NAMESPACE}:registry=https://mesh-platform-<ACCOUNT>.d.codeartifact.${CA_REGION}.amazonaws.com/npm/${CA_REPOSITORY}/`);
-            process.exit(0);
-        }
-        // Step 3: Ensure project .npmrc (unless --ci or --skip-npmrc)
-        if (!opts.ci && !opts.skipNpmrc) {
-            const result = ensureProjectNpmrc(endpoint);
-            if (result.created) {
-                logSuccess(`Created ${result.path} with ${CA_NAMESPACE} registry scope`);
-            }
-            else if (result.updated) {
-                logSuccess(`Updated ${CA_NAMESPACE} registry in ${result.path}`);
-            }
-            else {
-                logInfo(`${result.path} already configured`);
-            }
-        }
-        logSuccess(`Ready — run pnpm install to fetch ${CA_NAMESPACE} packages`);
+        await runRegistryLogin(context, opts);
     });
     registry
         .command("status")
         .description("Check current registry authentication status")
-        .action(() => {
-        const { valid, endpoint } = checkExistingToken();
-        if (!valid) {
-            logWarn("No valid CodeArtifact token found. Run: mesh registry login");
-            process.exit(1);
-        }
-        logSuccess("CodeArtifact token found in ~/.npmrc");
-        if (endpoint) {
-            logInfo(`Endpoint: ${endpoint}`);
-        }
-        // Check project .npmrc
-        const projectRoot = findProjectRoot();
-        if (projectRoot) {
-            const npmrcPath = path.join(projectRoot, ".npmrc");
-            if (fs.existsSync(npmrcPath)) {
-                const content = fs.readFileSync(npmrcPath, "utf-8");
-                if (content.includes(`${CA_NAMESPACE}:registry=`)) {
-                    logSuccess(`Project .npmrc configured (${npmrcPath})`);
-                }
-                else {
-                    logWarn(`Project .npmrc exists but missing ${CA_NAMESPACE} scope (${npmrcPath})`);
-                    logInfo("Run: mesh registry login");
-                }
-            }
-            else {
-                logWarn(`No .npmrc in project root (${projectRoot})`);
-                logInfo("Run: mesh registry login");
-            }
-        }
+        .action(async () => {
+        const code = await runRegistryStatus();
+        if (code !== 0)
+            process.exit(code);
     });
+    registerRegistryPublish(registry);
 }
 //# sourceMappingURL=registry.js.map