@mesh-tech/mesh-cli 0.1.1 → 0.12.0

package/dist/src/utils/recover-conversation.js

@@ -0,0 +1,314 @@
+/**
+ * Reconstruct an agent conversation's transcript from decoded Temporal history.
+ *
+ * An agent conversation is a Temporal `agentWorkflow`. Its durable history holds
+ * everything needed to replay the human/agent exchange even when the worker can
+ * no longer run the workflow (code drift):
+ *
+ *   - `WorkflowExecutionSignaled` with signal name `submit_user_message` →
+ *     one HUMAN turn. Its input payload is `SubmitUserMessageParams`
+ *     (agent-sdk `agent-core/workflows/signals.ts`): `{ model, messages,
+ *     streamId, ... }` where `messages` is a Vercel-AI `ModelMessage[]`; the
+ *     user text lives in the `user`-role message(s).
+ *   - `callLLM` `ActivityTaskCompleted` → one ASSISTANT turn. Its result is
+ *     `LLMResult` (agent-sdk `agent-core/types.ts`): `{ messages, usage?,
+ *     telemetry? }` where `messages` is the model's output `ModelMessage[]` —
+ *     `assistant`-role text parts plus any `tool-call` parts.
+ *
+ * This module is the PURE reconstruction core: it takes events whose payloads
+ * have ALREADY been decrypted into plain objects and returns ordered turns. The
+ * Temporal fetch + decrypt wiring lives in `commands/temporal.ts`.
+ *
+ * Everything here is best-effort and defensive: payload shapes vary across
+ * agent-sdk versions, so every field access is guarded and a turn that can't be
+ * parsed becomes a placeholder rather than throwing — the whole point is to
+ * recover *something* from an otherwise-unreplayable history.
+ */
+/**
+ * Classify a raw Temporal history into the ordered `DecodedEvent[]` that
+ * `reconstructTranscript` consumes.
+ *
+ * `ActivityTaskCompleted` events carry only a `scheduledEventId`, not the
+ * activity's type name — so to tell which completions came from `callLLM` we
+ * build a map of `ActivityTaskScheduled.eventId → activityType.name` as we walk
+ * the history in event order, then look each completion's `scheduledEventId` up
+ * in it. Only `callLLM` completions become `callLLMResult` (assistant) events;
+ * completions of other activities (e.g. `routeTools`) are dropped.
+ * `submit_user_message` signals become `userSignal` (human) events.
+ *
+ * Pure aside from the injected `decodePayload` (which performs the decrypt):
+ * never throws, and preserves history order.
+ */
+export async function classifyHistoryEvents(rawEvents, decodePayload) {
+    // scheduledEventId → activity type name, so we can tell which
+    // ActivityTaskCompleted events came from `callLLM`.
+    const activityTypeByScheduledId = new Map();
+    const events = [];
+    for (const event of rawEvents) {
+        const eventId = String(event.eventId);
+        const scheduled = event.activityTaskScheduledEventAttributes;
+        if (scheduled) {
+            const name = scheduled.activityType?.name;
+            if (name)
+                activityTypeByScheduledId.set(eventId, name);
+            continue;
+        }
+        const signal = event.workflowExecutionSignaledEventAttributes;
+        if (signal?.signalName === "submit_user_message") {
+            events.push({
+                eventId,
+                kind: "userSignal",
+                payload: await decodePayload(signal.input?.payloads),
+            });
+            continue;
+        }
+        const completed = event.activityTaskCompletedEventAttributes;
+        if (completed) {
+            const scheduledId = String(completed.scheduledEventId);
+            if (activityTypeByScheduledId.get(scheduledId) === "callLLM") {
+                events.push({
+                    eventId,
+                    kind: "callLLMResult",
+                    payload: await decodePayload(completed.result?.payloads),
+                });
+            }
+        }
+    }
+    return events;
+}
+/**
+ * Extract the highest-fidelity STRUCTURED transcript for a store-ready snapshot
+ * backfill — the complete `ModelMessage[]` with tool-call/tool-result parts
+ * intact (as opposed to `reconstructTranscript`'s flattened text turns).
+ *
+ * The source is the `callLLM` activity's SCHEDULED input, `callLLMArgs`
+ * (`{ model, messages }`), whose `messages` is the FULL accumulated conversation
+ * (user + assistant-with-tool-calls + tool-result messages) up to — but not
+ * including — that turn's assistant output. We take the LAST `callLLM`
+ * scheduled input (the most-accumulated one) and append the LAST `callLLM`
+ * completion's output messages (`LLMResult.messages`, the final assistant turn):
+ *
+ *     [...lastScheduledInput.messages, ...lastCompletion.messages]
+ *
+ * Completions are matched to `callLLM` via `scheduledEventId` (same mapping as
+ * `classifyHistoryEvents`).
+ *
+ * Best-effort and never throws:
+ *   - no `callLLM` scheduled input (0 assistant turns) → `[]`;
+ *   - a scheduled input but no completion (last turn interrupted) → just the
+ *     input messages.
+ *
+ * Pure aside from the injected `decodePayload` (which performs the decrypt).
+ */
+export async function extractSnapshotMessages(rawEvents, decodePayload) {
+    // Track the last `callLLM` scheduled input's payload group and its eventId, so
+    // we can (a) decode the most-accumulated messages and (b) match its
+    // completion by scheduledEventId.
+    let lastCallLLMScheduledId;
+    let lastCallLLMInputPayloads;
+    // Map every scheduled activity's eventId → type name so completions resolve.
+    const activityTypeByScheduledId = new Map();
+    // Track the last `callLLM` completion result payloads, keyed by matching the
+    // scheduledEventId back to a `callLLM`.
+    let lastCallLLMResultPayloads;
+    for (const event of rawEvents) {
+        const eventId = String(event.eventId);
+        const scheduled = event.activityTaskScheduledEventAttributes;
+        if (scheduled) {
+            const name = scheduled.activityType?.name;
+            if (name)
+                activityTypeByScheduledId.set(eventId, name);
+            if (name === "callLLM") {
+                lastCallLLMScheduledId = eventId;
+                lastCallLLMInputPayloads = scheduled.input?.payloads;
+                // Reset the result: a completion only "belongs" to this newly-scheduled
+                // callLLM if it arrives AFTER this point. Without the reset, a mid-turn
+                // interrupted last turn (scheduled, never completed) would keep a STALE
+                // earlier completion and duplicate that assistant message (it's already
+                // inside this turn's accumulated input). Matches the documented contract:
+                // scheduled-input-but-no-completion → just the input messages.
+                lastCallLLMResultPayloads = undefined;
+            }
+            continue;
+        }
+        const completed = event.activityTaskCompletedEventAttributes;
+        if (completed) {
+            const scheduledId = String(completed.scheduledEventId);
+            if (activityTypeByScheduledId.get(scheduledId) === "callLLM") {
+                lastCallLLMResultPayloads = completed.result?.payloads;
+            }
+        }
+    }
+    if (lastCallLLMScheduledId === undefined)
+        return [];
+    const inputArgs = await decodePayload(lastCallLLMInputPayloads);
+    const inputMessages = messagesFrom(inputArgs);
+    const result = await decodePayload(lastCallLLMResultPayloads);
+    const resultMessages = messagesFrom(result);
+    return [...inputMessages, ...resultMessages];
+}
+/** Pull a `.messages` array off a decoded `{ messages }` payload, else `[]`. */
+function messagesFrom(payload) {
+    if (isRecord(payload) && Array.isArray(payload.messages)) {
+        return payload.messages;
+    }
+    return [];
+}
+// ── Extraction helpers (all defensive) ───────────────────────────────────────
+/** Pull display text out of a ModelMessage `content` (string, or parts array). */
+function extractText(content) {
+    if (typeof content === "string")
+        return content;
+    if (Array.isArray(content)) {
+        return content
+            .filter((p) => !!p && typeof p === "object" && p.type === "text")
+            .map((p) => (typeof p.text === "string" ? p.text : ""))
+            .join("");
+    }
+    return "";
+}
+/** Compact a tool-call's args to a single truncated JSON line. */
+function summarizeArgs(args) {
+    try {
+        const str = JSON.stringify(args ?? {});
+        return str.length > 100 ? str.substring(0, 97) + "..." : str;
+    }
+    catch {
+        return "...";
+    }
+}
+/** Format a `tool-call` content part as `name(compactArgs)`. */
+function formatToolCall(part) {
+    const name = typeof part.toolName === "string" ? part.toolName : "?";
+    // AI SDK v5 uses `input`; older payloads use `args`. Accept either.
+    const args = "input" in part ? part.input : part.args;
+    return `${name}(${summarizeArgs(args)})`;
+}
+function isRecord(v) {
+    return !!v && typeof v === "object";
+}
+/**
+ * Extract the human text from a `submit_user_message` signal payload. Returns
+ * `null` when nothing recognizable is found (caller emits a placeholder).
+ */
+function extractUserText(payload) {
+    if (!isRecord(payload))
+        return null;
+    const messages = payload.messages;
+    if (Array.isArray(messages)) {
+        const parts = [];
+        for (const m of messages) {
+            if (isRecord(m) && m.role === "user") {
+                const t = extractText(m.content);
+                if (t)
+                    parts.push(t);
+            }
+        }
+        if (parts.length > 0)
+            return parts.join("\n");
+    }
+    // Defensive fallbacks for shape drift — try common single-field carriers.
+    for (const field of ["content", "text", "message"]) {
+        const v = payload[field];
+        if (typeof v === "string" && v)
+            return v;
+        const t = extractText(v);
+        if (t)
+            return t;
+    }
+    return null;
+}
+/**
+ * Extract the assistant text + tool calls from a `callLLM` result payload.
+ * Returns `null` only when nothing at all could be parsed (no text AND no tool
+ * calls) — a tool-only turn (empty text, non-empty toolCalls) is valid.
+ */
+function extractAssistantTurn(payload) {
+    if (!isRecord(payload))
+        return null;
+    const messages = payload.messages;
+    if (!Array.isArray(messages)) {
+        // Defensive fallback: some shapes may carry text directly.
+        const t = extractText(payload.content) || extractText(payload.text);
+        return t ? { text: t, toolCalls: [] } : null;
+    }
+    let text = "";
+    const toolCalls = [];
+    for (const m of messages) {
+        if (!isRecord(m) || m.role !== "assistant")
+            continue;
+        text += extractText(m.content);
+        if (Array.isArray(m.content)) {
+            for (const p of m.content) {
+                if (isRecord(p) && p.type === "tool-call") {
+                    toolCalls.push(formatToolCall(p));
+                }
+            }
+        }
+    }
+    if (!text && toolCalls.length === 0)
+        return null;
+    return { text, toolCalls };
+}
+// ── Reconstruction ───────────────────────────────────────────────────────────
+/**
+ * Reconstruct ordered conversation turns from decoded history events.
+ *
+ * Pure: no I/O, never throws. `other` events are skipped; unparseable
+ * user/assistant events become placeholder turns so the recovery is complete
+ * end-to-end even when individual payloads are corrupt.
+ */
+export function reconstructTranscript(events) {
+    const turns = [];
+    for (const event of events) {
+        if (event.kind === "userSignal") {
+            const text = extractUserText(event.payload);
+            turns.push(text !== null
+                ? { role: "user", text, eventId: event.eventId }
+                : { role: "user", text: placeholder(event.eventId), eventId: event.eventId });
+        }
+        else if (event.kind === "callLLMResult") {
+            const turn = extractAssistantTurn(event.payload);
+            if (turn) {
+                turns.push({
+                    role: "assistant",
+                    text: turn.text,
+                    eventId: event.eventId,
+                    ...(turn.toolCalls.length > 0 ? { toolCalls: turn.toolCalls } : {}),
+                });
+            }
+            else {
+                turns.push({
+                    role: "assistant",
+                    text: placeholder(event.eventId),
+                    eventId: event.eventId,
+                });
+            }
+        }
+        // `other` → skipped
+    }
+    return turns;
+}
+function placeholder(eventId) {
+    return `_[unparseable turn: ${eventId}]_`;
+}
+// ── Rendering ─────────────────────────────────────────────────────────────────
+/** Render turns as a readable markdown transcript. */
+export function renderTranscriptMarkdown(turns) {
+    const blocks = [];
+    for (const turn of turns) {
+        const heading = turn.role === "user" ? "## User" : "## Assistant";
+        const lines = [heading, ""];
+        if (turn.text)
+            lines.push(turn.text);
+        if (turn.toolCalls && turn.toolCalls.length > 0) {
+            if (turn.text)
+                lines.push("");
+            for (const tc of turn.toolCalls)
+                lines.push(`→ tool: ${tc}`);
+        }
+        blocks.push(lines.join("\n"));
+    }
+    return blocks.join("\n\n") + "\n";
+}
+//# sourceMappingURL=recover-conversation.js.map

package/dist/src/utils/recover-conversation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recover-conversation.js","sourceRoot":"","sources":["../../../src/utils/recover-conversation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAwDH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAoC,EACpC,aAA4B;IAE5B,8DAA8D;IAC9D,oDAAoD;IACpD,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5D,MAAM,MAAM,GAAmB,EAAE,CAAC;IAElC,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEtC,MAAM,SAAS,GAAG,KAAK,CAAC,oCAAoC,CAAC;QAC7D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC;YAC1C,IAAI,IAAI;gBAAE,yBAAyB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,wCAAwC,CAAC;QAC9D,IAAI,MAAM,EAAE,UAAU,KAAK,qBAAqB,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO;gBACP,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,MAAM,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC;aACrD,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,oCAAoC,CAAC;QAC7D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YACvD,IAAI,yBAAyB,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC;oBACV,OAAO;oBACP,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,MAAM,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC;iBACzD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAaD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAoC,EACpC,aAA4B;IAE5B,+EAA+E;IAC/E,oEAAoE;IACpE,kCAAkC;IAClC,IAAI,sBAA0C,CAAC;IAC/C,IAAI,wBAAsD,CAAC;IAC3D,6EAA6E;IAC7E,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5D,6EAA6E;IAC7E,wCAAwC;IACxC,IAAI,yBAAuD,CAAC;IAE5D,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEtC,MAAM,SAAS,GAAG,KAAK,CAAC,oCAAoC,CAAC;QAC7D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC;YAC1C,IAAI,IAAI;gBAAE,yBAAyB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACvD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,sBAAsB,GAAG,OAAO,CAAC;gBACjC,wBAAwB,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC;gBACrD,wEAAwE;gBACxE,wEAAwE;gBACxE,wEAAwE;gBACxE,wEAAwE;gBACxE,0EAA0E;gBAC1E,+DAA+D;gBAC/D,yBAAyB,GAAG,SAAS,CAAC;YACxC,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,oCAAoC,CAAC;QAC7D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YACvD,IAAI,yBAAyB,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC7D,yBAAyB,GAAG,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,sBAAsB,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAEpD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,wBAAwB,CAAC,CAAC;IAChE,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAE9C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAE5C,OAAO,CAAC,GAAG,aAAa,EAAE,GAAG,cAAc,CAAC,CAAC;AAC/C,CAAC;AAED,gFAAgF;AAChF,SAAS,YAAY,CAAC,OAAgB;IACpC,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzD,OAAO,OAAO,CAAC,QAA0B,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAaD,gFAAgF;AAEhF,kFAAkF;AAClF,SAAS,WAAW,CAAC,OAAgB;IACnC,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO;aACX,MAAM,CACL,CAAC,CAAC,EAAyC,EAAE,CAC3C,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAAwB,CAAC,IAAI,KAAK,MAAM,CAC5E;aACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aACtD,IAAI,CAAC,EAAE,CAAC,CAAC;IACd,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,kEAAkE;AAClE,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACvC,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,SAAS,cAAc,CAAC,IAA6B;IACnD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;IACrE,oEAAoE;IACpE,MAAM,IAAI,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACtD,OAAO,GAAG,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;AAC3C,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,OAAgB;IACvC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACrC,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBACjC,IAAI,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,0EAA0E;IAC1E,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAU,EAAE,CAAC;QAC5D,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,OAAgB;IAEhB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,2DAA2D;QAC3D,MAAM,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAED,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QACrD,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC1B,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;oBAC1C,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC7B,CAAC;AAED,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAsB;IAC1D,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5C,KAAK,CAAC,IAAI,CACR,IAAI,KAAK,IAAI;gBACX,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;gBAChD,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAC/E,CAAC;QACJ,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,IAAI,EAAE,CAAC;gBACT,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpE,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC;oBAChC,OAAO,EAAE,KAAK,CAAC,OAAO;iBACvB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,oBAAoB;IACtB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,uBAAuB,OAAO,IAAI,CAAC;AAC5C,CAAC;AAED,iFAAiF;AAEjF,sDAAsD;AACtD,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC;QAClE,MAAM,KAAK,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,IAAI,IAAI,CAAC,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9B,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;AACpC,CAAC"}

package/dist/src/utils/registry-broker.d.ts

@@ -0,0 +1,148 @@
+/**
+ * Client for the Zitadel-gated registry-auth broker.
+ *
+ * This is the path that lets a brand-new Trabian developer install
+ * `@mesh-tech/*` with **no AWS account, no AWS CLI and no ~/.aws/config**: the
+ * broker verifies the Zitadel id token `mesh login` already cached, checks the
+ * caller's role, and returns a CodeArtifact token minted with the BROKER's AWS
+ * identity. No AWS credential of any kind reaches the laptop.
+ *
+ * Everything here is pure or dependency-injected so the fallback behaviour —
+ * which is what decides whether a broker hiccup breaks an install — is
+ * unit-testable without a network.
+ */
+type CtxConfig = {
+    issuer?: string;
+    registryBroker?: string;
+} | null;
+/**
+ * Pick a context for a `mesh registry login` invoked with none.
+ *
+ * A context-less call used to skip the broker outright, which quietly sent
+ * anyone following a remediation that omits the context straight back to the
+ * AWS chain — the exact routing this feature removes. So: if exactly one cached
+ * context publishes a `registryBroker`, use it. Zero or several is genuinely
+ * ambiguous and the caller must say which.
+ *
+ * Deliberately narrow. Guessing among several contexts would post the user's id
+ * token to a broker they did not name.
+ */
+export declare function resolveDefaultBrokerContext(configs?: Record<string, {
+    registryBroker?: string;
+}>, credentials?: Record<string, unknown>): {
+    context: string;
+} | {
+    reason: "none" | "ambiguous";
+    candidates: string[];
+};
+/** A successful grant from `POST /token`. */
+export interface RegistryGrant {
+    /** npm scope the endpoint is bound to, e.g. "@mesh-tech". */
+    scope: string;
+    /** Registry endpoint URL (npm format). */
+    endpoint: string;
+    /** CodeArtifact bearer for the `//<host>:_authToken=` npmrc line. */
+    authorizationToken: string;
+    /** ISO 8601 expiry, for reporting. */
+    expiresAt?: string;
+}
+/** Why a broker attempt didn't produce a grant. */
+export type RegistryBrokerFailure = 
+/** No broker URL for this context — the platform predates the broker. */
+{
+    kind: "no-broker";
+}
+/** No cached Zitadel session — the user needs `mesh login <context>`. */
+ | {
+    kind: "no-session";
+}
+/** The broker rejected the token (expired/wrong audience). */
+ | {
+    kind: "unauthenticated";
+}
+/** A valid Mesh account that has not been granted registry access. */
+ | {
+    kind: "not-authorized";
+    email?: string;
+    requiredRoles?: string[];
+    requestUrl?: string;
+}
+/** Broker unreachable, 5xx, or a malformed body. */
+ | {
+    kind: "unavailable";
+    detail: string;
+};
+export type RegistryBrokerResult = {
+    ok: true;
+    grant: RegistryGrant;
+} | {
+    ok: false;
+    failure: RegistryBrokerFailure;
+};
+/**
+ * Resolve the broker URL, preferring the platform-published value from
+ * discovery (`ContextConfig.registryBroker`) and falling back to DNS-convention
+ * derivation for platforms not yet redeployed with the payload field.
+ *
+ * Mirrors `resolveVpnJoinBroker` deliberately — one convention for
+ * platform-published service URLs, not two.
+ */
+export declare function resolveRegistryBroker(context: string, getCfg?: (c: string) => CtxConfig): string | null;
+/**
+ * Timeout for a broker whose URL the platform actually published. It exists;
+ * wait for it.
+ */
+export declare const PUBLISHED_BROKER_TIMEOUT_MS = 15000;
+/**
+ * Timeout for a broker URL we merely *derived* by DNS convention. For every
+ * platform that has not deployed the broker — which today is all of them — that
+ * host does not exist, and this wait sits in front of the AWS fallback on the
+ * `mesh login` path too. Fail fast on a guess; be patient with a fact.
+ */
+export declare const DERIVED_BROKER_TIMEOUT_MS = 4000;
+/**
+ * Resolve the broker URL *and* say where it came from, so the caller can pick a
+ * timeout that matches how much confidence the URL deserves.
+ */
+export declare function resolveRegistryBrokerSource(context: string, getCfg?: (c: string) => CtxConfig): {
+    url: string | null;
+    source: "published" | "derived";
+};
+/**
+ * FALLBACK ONLY. Derive by convention — issuer host `identity.<env>.<domain>`
+ * → `registry-auth.<env>.<domain>`. Prefer `resolveRegistryBroker`, which reads
+ * the platform-published URL first.
+ */
+export declare function deriveRegistryBroker(context: string, getCfg?: (c: string) => CtxConfig): string | null;
+export interface FetchGrantDeps {
+    getValidToken: (context: string) => Promise<string | null>;
+    fetchFn?: typeof fetch;
+    /** Abort the broker call after this long. Keeps a wedged broker from hanging an install. */
+    timeoutMs?: number;
+}
+/**
+ * Classify a broker response into a grant or a typed failure.
+ *
+ * Split out from the fetch so every status code's meaning is pinned by a test.
+ * The distinction that matters: **401 means re-login, 403 means request
+ * access** — collapsing them (as a boolean-returning client would) is what
+ * sends a developer to re-run `mesh login` forever when the real answer is
+ * "ask an admin for the role".
+ */
+export declare function classifyBrokerResponse(res: {
+    status: number;
+    json: () => Promise<unknown>;
+}): Promise<RegistryBrokerResult>;
+/**
+ * Exchange the cached Zitadel id token for a CodeArtifact read grant.
+ *
+ * `interactive: false` on the token lookup — this runs inside
+ * `mesh registry login`, which has its own AWS fallback chain, so an expired
+ * session must return `no-session` rather than stalling a headless run in a
+ * device-code poll.
+ */
+export declare function fetchRegistryGrant(context: string, brokerUrl: string, deps: FetchGrantDeps): Promise<RegistryBrokerResult>;
+/** Convenience for production callers that use the real login.ts token source. */
+export declare function realGrantDeps(): FetchGrantDeps;
+export {};
+//# sourceMappingURL=registry-broker.d.ts.map

package/dist/src/utils/registry-broker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-broker.d.ts","sourceRoot":"","sources":["../../../src/utils/registry-broker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,KAAK,SAAS,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC;AAErE;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,CAA2B,EAC9E,WAAW,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAwB,GAC1D;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,GAAG,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAM9E;AAED,6CAA6C;AAC7C,MAAM,WAAW,aAAa;IAC5B,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,mDAAmD;AACnD,MAAM,MAAM,qBAAqB;AAC/B,yEAAyE;AACvE;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE;AACvB,yEAAyE;GACvE;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE;AACxB,8DAA8D;GAC5D;IAAE,IAAI,EAAE,iBAAiB,CAAA;CAAE;AAC7B,sEAAsE;GACpE;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE;AAC3F,oDAAoD;GAClD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5C,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAE,GAClC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,qBAAqB,CAAA;CAAE,CAAC;AAElD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,CAAC,CAAC,EAAE,MAAM,KAAK,SAA4B,GAClD,MAAM,GAAG,IAAI,CAEf;AAED;;;GAGG;AACH,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAElD;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,OAAQ,CAAC;AAE/C;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,CAAC,CAAC,EAAE,MAAM,KAAK,SAA4B,GAClD;IAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CAAA;CAAE,CAIzD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,CAAC,CAAC,EAAE,MAAM,KAAK,SAA4B,GAClD,MAAM,GAAG,IAAI,CAWf;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3D,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,4FAA4F;IAC5F,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAAC,GAAG,EAAE;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAiDhC;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,oBAAoB,CAAC,CAsB/B;AAED,kFAAkF;AAClF,wBAAgB,aAAa,IAAI,cAAc,CAE9C"}

package/dist/src/utils/registry-broker.js

@@ -0,0 +1,180 @@
+/**
+ * Client for the Zitadel-gated registry-auth broker.
+ *
+ * This is the path that lets a brand-new Trabian developer install
+ * `@mesh-tech/*` with **no AWS account, no AWS CLI and no ~/.aws/config**: the
+ * broker verifies the Zitadel id token `mesh login` already cached, checks the
+ * caller's role, and returns a CodeArtifact token minted with the BROKER's AWS
+ * identity. No AWS credential of any kind reaches the laptop.
+ *
+ * Everything here is pure or dependency-injected so the fallback behaviour —
+ * which is what decides whether a broker hiccup breaks an install — is
+ * unit-testable without a network.
+ */
+import { getContextConfig, getValidToken, readAllCredentials, readAllContextConfigs } from "../commands/login.js";
+/**
+ * Pick a context for a `mesh registry login` invoked with none.
+ *
+ * A context-less call used to skip the broker outright, which quietly sent
+ * anyone following a remediation that omits the context straight back to the
+ * AWS chain — the exact routing this feature removes. So: if exactly one cached
+ * context publishes a `registryBroker`, use it. Zero or several is genuinely
+ * ambiguous and the caller must say which.
+ *
+ * Deliberately narrow. Guessing among several contexts would post the user's id
+ * token to a broker they did not name.
+ */
+export function resolveDefaultBrokerContext(configs = readAllContextConfigs(), credentials = readAllCredentials()) {
+    const candidates = Object.entries(configs)
+        .filter(([name, cfg]) => Boolean(cfg?.registryBroker) && name in credentials)
+        .map(([name]) => name);
+    if (candidates.length === 1)
+        return { context: candidates[0] };
+    return { reason: candidates.length === 0 ? "none" : "ambiguous", candidates };
+}
+/**
+ * Resolve the broker URL, preferring the platform-published value from
+ * discovery (`ContextConfig.registryBroker`) and falling back to DNS-convention
+ * derivation for platforms not yet redeployed with the payload field.
+ *
+ * Mirrors `resolveVpnJoinBroker` deliberately — one convention for
+ * platform-published service URLs, not two.
+ */
+export function resolveRegistryBroker(context, getCfg = getContextConfig) {
+    return resolveRegistryBrokerSource(context, getCfg).url;
+}
+/**
+ * Timeout for a broker whose URL the platform actually published. It exists;
+ * wait for it.
+ */
+export const PUBLISHED_BROKER_TIMEOUT_MS = 15_000;
+/**
+ * Timeout for a broker URL we merely *derived* by DNS convention. For every
+ * platform that has not deployed the broker — which today is all of them — that
+ * host does not exist, and this wait sits in front of the AWS fallback on the
+ * `mesh login` path too. Fail fast on a guess; be patient with a fact.
+ */
+export const DERIVED_BROKER_TIMEOUT_MS = 4_000;
+/**
+ * Resolve the broker URL *and* say where it came from, so the caller can pick a
+ * timeout that matches how much confidence the URL deserves.
+ */
+export function resolveRegistryBrokerSource(context, getCfg = getContextConfig) {
+    const cfg = getCfg(context);
+    if (cfg?.registryBroker)
+        return { url: cfg.registryBroker, source: "published" };
+    return { url: deriveRegistryBroker(context, getCfg), source: "derived" };
+}
+/**
+ * FALLBACK ONLY. Derive by convention — issuer host `identity.<env>.<domain>`
+ * → `registry-auth.<env>.<domain>`. Prefer `resolveRegistryBroker`, which reads
+ * the platform-published URL first.
+ */
+export function deriveRegistryBroker(context, getCfg = getContextConfig) {
+    const cfg = getCfg(context);
+    if (!cfg?.issuer)
+        return null;
+    try {
+        const u = new URL(cfg.issuer);
+        const parts = u.hostname.split(".");
+        parts[0] = "registry-auth";
+        return `https://${parts.join(".")}`;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Classify a broker response into a grant or a typed failure.
+ *
+ * Split out from the fetch so every status code's meaning is pinned by a test.
+ * The distinction that matters: **401 means re-login, 403 means request
+ * access** — collapsing them (as a boolean-returning client would) is what
+ * sends a developer to re-run `mesh login` forever when the real answer is
+ * "ask an admin for the role".
+ */
+export async function classifyBrokerResponse(res) {
+    if (res.status === 401)
+        return { ok: false, failure: { kind: "unauthenticated" } };
+    if (res.status === 403) {
+        const body = (await res.json().catch(() => ({})));
+        return {
+            ok: false,
+            failure: {
+                kind: "not-authorized",
+                email: typeof body.email === "string" ? body.email : undefined,
+                requiredRoles: Array.isArray(body.requiredRoles)
+                    ? body.requiredRoles.filter((r) => typeof r === "string")
+                    : undefined,
+                requestUrl: typeof body.requestUrl === "string" ? body.requestUrl : undefined,
+            },
+        };
+    }
+    if (res.status !== 200) {
+        return { ok: false, failure: { kind: "unavailable", detail: `broker returned ${res.status}` } };
+    }
+    let body;
+    try {
+        body = (await res.json());
+    }
+    catch (err) {
+        return {
+            ok: false,
+            failure: { kind: "unavailable", detail: `malformed broker response: ${err.message}` },
+        };
+    }
+    const { endpoint, authorizationToken, scope, expiresAt } = body;
+    if (typeof endpoint !== "string" || !endpoint || typeof authorizationToken !== "string" || !authorizationToken) {
+        return {
+            ok: false,
+            failure: { kind: "unavailable", detail: "broker response missing endpoint or authorizationToken" },
+        };
+    }
+    return {
+        ok: true,
+        grant: {
+            scope: typeof scope === "string" && scope ? scope : "@mesh-tech",
+            endpoint,
+            authorizationToken,
+            expiresAt: typeof expiresAt === "string" ? expiresAt : undefined,
+        },
+    };
+}
+/**
+ * Exchange the cached Zitadel id token for a CodeArtifact read grant.
+ *
+ * `interactive: false` on the token lookup — this runs inside
+ * `mesh registry login`, which has its own AWS fallback chain, so an expired
+ * session must return `no-session` rather than stalling a headless run in a
+ * device-code poll.
+ */
+export async function fetchRegistryGrant(context, brokerUrl, deps) {
+    const token = await deps.getValidToken(context);
+    if (!token)
+        return { ok: false, failure: { kind: "no-session" } };
+    const doFetch = deps.fetchFn ?? fetch;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), deps.timeoutMs ?? PUBLISHED_BROKER_TIMEOUT_MS);
+    try {
+        const res = await doFetch(`${brokerUrl.replace(/\/+$/, "")}/token`, {
+            method: "POST",
+            headers: { authorization: `Bearer ${token}` },
+            signal: controller.signal,
+        });
+        return await classifyBrokerResponse(res);
+    }
+    catch (err) {
+        return {
+            ok: false,
+            failure: { kind: "unavailable", detail: err.message },
+        };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** Convenience for production callers that use the real login.ts token source. */
+export function realGrantDeps() {
+    return { getValidToken: (c) => getValidToken(c) };
+}
+//# sourceMappingURL=registry-broker.js.map

package/dist/src/utils/registry-broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-broker.js","sourceRoot":"","sources":["../../../src/utils/registry-broker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAIlH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,2BAA2B,CACzC,UAAuD,qBAAqB,EAAE,EAC9E,cAAuC,kBAAkB,EAAE;IAE3D,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;SACvC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,IAAI,IAAI,WAAW,CAAC;SAC5E,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAE,EAAE,CAAC;IAChE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC;AAChF,CAAC;AA+BD;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,SAAmC,gBAAgB;IAEnD,OAAO,2BAA2B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAElD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAE/C;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAe,EACf,SAAmC,gBAAgB;IAEnD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,GAAG,EAAE,cAAc;QAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjF,OAAO,EAAE,GAAG,EAAE,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,SAAmC,gBAAgB;IAEnD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,KAAK,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC;QAC3B,OAAO,WAAW,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AASD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,GAG5C;IACC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,CAAC;IAEnF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;QAC7E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,gBAAgB;gBACtB,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBAC9D,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;oBAC9C,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;oBACtE,CAAC,CAAC,SAAS;gBACb,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;aAC9E;SACF,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,mBAAmB,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;IAClG,CAAC;IAED,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,8BAA+B,GAAa,CAAC,OAAO,EAAE,EAAE;SACjG,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAChE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,IAAI,OAAO,kBAAkB,KAAK,QAAQ,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC/G,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,wDAAwD,EAAE;SACnG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,KAAK,EAAE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY;YAChE,QAAQ;YACR,kBAAkB;YAClB,SAAS,EAAE,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;SACjE;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,SAAiB,EACjB,IAAoB;IAEpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC;IAElE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,2BAA2B,CAAC,CAAC;IAClG,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YAC7C,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,OAAO,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAG,GAAa,CAAC,OAAO,EAAE;SACjE,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,aAAa;IAC3B,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC"}