@mesh-tech/mesh-cli 0.18.1 → 0.19.0

package/dist/src/utils/registry-broker.js

@@ -3,35 +3,17 @@
  *
  * This is the path that lets a brand-new Trabian developer install
  * `@mesh-tech/*` with **no AWS account, no AWS CLI and no ~/.aws/config**: the
- * broker verifies the Zitadel id token `mesh login` already cached, checks the
- * caller's role, and returns a CodeArtifact token minted with the BROKER's AWS
- * identity. No AWS credential of any kind reaches the laptop.
+ * broker verifies the Zitadel id token `mesh registry login` cached for the
+ * registry's own issuer, checks the caller's role, and returns a CodeArtifact
+ * token minted with the BROKER's AWS identity. No AWS credential of any kind
+ * reaches the laptop. Which broker to call comes from the registry's global
+ * identity (`registry-identity.ts`), never from a platform context.
  *
  * Everything here is pure or dependency-injected so the fallback behaviour —
  * which is what decides whether a broker hiccup breaks an install — is
  * unit-testable without a network.
  */
-import { getContextConfig, getValidToken, readAllCredentials, readAllContextConfigs } from "../commands/login.js";
-/**
- * Pick a context for a `mesh registry login` invoked with none.
- *
- * A context-less call used to skip the broker outright, which quietly sent
- * anyone following a remediation that omits the context straight back to the
- * AWS chain — the exact routing this feature removes. So: if exactly one cached
- * context publishes a `registryBroker`, use it. Zero or several is genuinely
- * ambiguous and the caller must say which.
- *
- * Deliberately narrow. Guessing among several contexts would post the user's id
- * token to a broker they did not name.
- */
-export function resolveDefaultBrokerContext(configs = readAllContextConfigs(), credentials = readAllCredentials()) {
-    const candidates = Object.entries(configs)
-        .filter(([name, cfg]) => Boolean(cfg?.registryBroker) && name in credentials)
-        .map(([name]) => name);
-    if (candidates.length === 1)
-        return { context: candidates[0] };
-    return { reason: candidates.length === 0 ? "none" : "ambiguous", candidates };
-}
+import { getContextConfig, getValidToken } from "../commands/login.js";
 /**
  * Resolve the broker URL, preferring the platform-published value from
  * discovery (`ContextConfig.registryBroker`) and falling back to DNS-convention
@@ -141,12 +123,13 @@ export async function classifyBrokerResponse(res) {
     };
 }
 /**
- * Exchange the cached Zitadel id token for a CodeArtifact read grant.
+ * Exchange the cached Zitadel id token under `context` (the reserved registry
+ * key, or any cached context whose issuer matches the registry's) for a
+ * CodeArtifact read grant.
  *
- * `interactive: false` on the token lookup — this runs inside
- * `mesh registry login`, which has its own AWS fallback chain, so an expired
- * session must return `no-session` rather than stalling a headless run in a
- * device-code poll.
+ * The token lookup never prompts — an expired session with no refresh token
+ * comes back as `no-session` for the caller to decide about, rather than
+ * stalling a headless run in a device-code poll.
  */
 export async function fetchRegistryGrant(context, brokerUrl, deps) {
     const token = await deps.getValidToken(context);

package/dist/src/utils/registry-broker.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry-broker.js","sourceRoot":"","sources":["../../../src/utils/registry-broker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAIlH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,2BAA2B,CACzC,UAAuD,qBAAqB,EAAE,EAC9E,cAAuC,kBAAkB,EAAE;IAE3D,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;SACvC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,IAAI,IAAI,WAAW,CAAC;SAC5E,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAE,EAAE,CAAC;IAChE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC;AAChF,CAAC;AA+BD;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,SAAmC,gBAAgB;IAEnD,OAAO,2BAA2B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAElD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAE/C;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAe,EACf,SAAmC,gBAAgB;IAEnD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,GAAG,EAAE,cAAc;QAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjF,OAAO,EAAE,GAAG,EAAE,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,SAAmC,gBAAgB;IAEnD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,KAAK,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC;QAC3B,OAAO,WAAW,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AASD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,GAG5C;IACC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,CAAC;IAEnF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;QAC7E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,gBAAgB;gBACtB,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBAC9D,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;oBAC9C,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;oBACtE,CAAC,CAAC,SAAS;gBACb,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;aAC9E;SACF,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,mBAAmB,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;IAClG,CAAC;IAED,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,8BAA+B,GAAa,CAAC,OAAO,EAAE,EAAE;SACjG,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAChE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,IAAI,OAAO,kBAAkB,KAAK,QAAQ,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC/G,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,wDAAwD,EAAE;SACnG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,KAAK,EAAE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY;YAChE,QAAQ;YACR,kBAAkB;YAClB,SAAS,EAAE,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;SACjE;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,SAAiB,EACjB,IAAoB;IAEpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC;IAElE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,2BAA2B,CAAC,CAAC;IAClG,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YAC7C,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,OAAO,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAG,GAAa,CAAC,OAAO,EAAE;SACjE,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,aAAa;IAC3B,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC"}
+{"version":3,"file":"registry-broker.js","sourceRoot":"","sources":["../../../src/utils/registry-broker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAiCvE;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,SAAmC,gBAAgB;IAEnD,OAAO,2BAA2B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAElD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAE/C;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAe,EACf,SAAmC,gBAAgB;IAEnD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,GAAG,EAAE,cAAc;QAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjF,OAAO,EAAE,GAAG,EAAE,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,SAAmC,gBAAgB;IAEnD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,KAAK,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC;QAC3B,OAAO,WAAW,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AASD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,GAG5C;IACC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,CAAC;IAEnF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;QAC7E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,gBAAgB;gBACtB,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBAC9D,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;oBAC9C,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;oBACtE,CAAC,CAAC,SAAS;gBACb,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;aAC9E;SACF,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,mBAAmB,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;IAClG,CAAC;IAED,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,8BAA+B,GAAa,CAAC,OAAO,EAAE,EAAE;SACjG,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAChE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,IAAI,OAAO,kBAAkB,KAAK,QAAQ,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC/G,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,wDAAwD,EAAE;SACnG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,KAAK,EAAE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY;YAChE,QAAQ;YACR,kBAAkB;YAClB,SAAS,EAAE,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;SACjE;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,SAAiB,EACjB,IAAoB;IAEpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC;IAElE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,2BAA2B,CAAC,CAAC;IAClG,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YAC7C,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,OAAO,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAG,GAAa,CAAC,OAAO,EAAE;SACjE,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,aAAa;IAC3B,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC"}

package/dist/src/utils/registry-identity.d.ts

@@ -0,0 +1,170 @@
+/**
+ * The ONE identity behind `@mesh-tech` package access.
+ *
+ * Every reader of the registry — `pnpm install`, `mesh create-app`,
+ * `mesh docs start`, the Hub image build under `mesh start` — talks to the same
+ * CodeArtifact domain, and that domain is owned by exactly one Mesh platform:
+ * `dev.platform.meshtech.io`. So the registry has a single, global identity
+ * (issuer + CLI client id + broker URL) that never depends on which tenant
+ * platform, if any, the developer deploys to.
+ *
+ * This module keeps that identity separate from platform contexts:
+ *
+ * - The domain comes from the compiled-in first-party alias table and nowhere
+ *   else — not an argument, not an environment variable, not an unpinned
+ *   config value. That is the same trust anchor `mesh login` relies on, so the
+ *   ≥2-dot anti-phishing guard stays intact.
+ * - The Zitadel session for the registry is cached under a **reserved**
+ *   credential key (`registry`) that no `<tenant>.<env>` context can collide
+ *   with, and `mesh login` / `mesh logout` refuse it.
+ * - A developer who already signed in to the registry's own platform
+ *   (`mesh login mesh.dev`) is reused rather than sent through the browser a
+ *   second time: any cached session whose issuer matches the registry's counts.
+ *
+ * Nothing here touches `~/.npmrc` or the broker — that is `mesh registry
+ * login`'s job. This module only answers "who is the registry?" and "do I hold
+ * a session for it?".
+ */
+import { MeshCliError } from "./errors.js";
+/**
+ * The first-party alias of the platform that owns the `@mesh-tech` registry.
+ * The alias is the key in `FIRST_PARTY_CONTEXTS`; the domain is looked up
+ * from that reviewed table, never typed here twice.
+ */
+export declare const REGISTRY_ALIAS = "mesh.dev";
+/** The pinned domain anonymous discovery runs against, e.g. `dev.platform.meshtech.io`. */
+export declare const REGISTRY_DOMAIN: string;
+/**
+ * The reserved context name the registry session and identity are cached under
+ * in `credentials.json` / `config.json`. Deliberately has no dot, so it can
+ * never parse as a `<tenant>.<env>` platform context.
+ */
+export declare const REGISTRY_CREDENTIAL_KEY: string;
+/** True when a context name is the reserved registry key. */
+export declare function isReservedRegistryContext(context: string): boolean;
+/** What the registry's platform publishes about itself, plus when we fetched it. */
+export interface RegistryIdentity {
+    /** Zitadel issuer URL for the registry's platform. */
+    issuer: string;
+    /** The CLI's OIDC client id on that issuer. */
+    clientId: string;
+    /** The `registry-auth` broker that exchanges an id token for a CodeArtifact grant. */
+    registryBroker: string;
+    /** ISO timestamp of the discovery that produced this record. */
+    discoveredAt: string;
+}
+/** Raised when the registry's identity cannot be resolved (offline, endpoint down). */
+export declare class RegistryIdentityError extends MeshCliError {
+    constructor(detail: string);
+}
+/**
+ * Resolve the registry's identity: the cached record under the reserved key,
+ * or a fresh anonymous HTTPS discovery on the pinned domain which is then
+ * cached there. `refresh: true` skips the cache.
+ *
+ * Never consults SSM and never takes the domain from anything but the alias
+ * table. Throws `RegistryIdentityError` when discovery is impossible and
+ * nothing is cached.
+ *
+ * @example
+ * const { registryBroker } = await resolveRegistryIdentity();
+ * // → "https://registry-auth.dev.platform.meshtech.io"
+ */
+export declare function resolveRegistryIdentity(opts?: {
+    refresh?: boolean;
+}): Promise<RegistryIdentity>;
+/**
+ * The cached contexts whose session can stand in for the registry's: the
+ * reserved key first, then the registry's own alias and domain — but only
+ * when the cached config for that name points at the SAME issuer, so a
+ * pre-repoint `mesh.dev` entry (a different platform) is never mistaken for
+ * the registry. With no known issuer (nothing discovered yet) only the
+ * reserved key counts: a guess about which platform session "is" the
+ * registry is the mistake this function exists to prevent.
+ *
+ * Pure over the two files' contents; exported for tests.
+ */
+export declare function registrySessionCandidates(issuer: string | null, configs?: Record<string, {
+    issuer?: string;
+} | undefined>, credentials?: Record<string, unknown>): string[];
+/** A live registry session and the context key it is cached under. */
+export interface RegistrySession {
+    /** Which `credentials.json` entry holds the session (reserved key, alias, or domain). */
+    context: string;
+    email: string;
+    expiresAt: string;
+}
+/**
+ * The registry session as cached right now — no refresh, no network. Null when
+ * no candidate context holds an unexpired token.
+ *
+ * @example
+ * const s = readRegistrySession();
+ * if (s) console.log(`signed in as ${s.email}`);
+ */
+export declare function readRegistrySession(): RegistrySession | null;
+/** Why `ensureRegistrySession` could not produce a session. */
+export type RegistrySessionFailure = {
+    ok: false;
+    reason: "no-identity";
+    detail: string;
+} | {
+    ok: false;
+    reason: "no-tty";
+    detail: string;
+} | {
+    ok: false;
+    reason: "login-failed";
+    detail: string;
+};
+export type RegistrySessionResult = ({
+    ok: true;
+} & RegistrySession) | RegistrySessionFailure;
+/**
+ * Get a valid Zitadel session for the registry's issuer, signing in when
+ * there is none.
+ *
+ * Reuses ANY cached session whose issuer matches — a developer already signed
+ * in to `mesh.dev` gets no second browser trip — refreshing an expired one
+ * through its refresh token first. Only when no candidate can be refreshed
+ * does it run the sign-in (browser PKCE, or device code with `device: true`
+ * or in a remote/non-TTY environment) and store the result under the
+ * reserved key.
+ *
+ * `interactive: false` means "cached or nothing": callers that cannot open a
+ * browser or print a device code get `no-tty` back instead of a hung prompt.
+ *
+ * @example
+ * const session = await ensureRegistrySession({ interactive: true });
+ * if (session.ok) console.log(session.email);
+ */
+export declare function ensureRegistrySession(opts: {
+    device?: boolean;
+    interactive: boolean;
+}): Promise<RegistrySessionResult>;
+/**
+ * Forget the registry: the session AND the pinned identity record, so the
+ * next `mesh registry login` re-discovers the registry from the pinned
+ * domain. Clears the reserved key only — a platform session under `mesh.dev`
+ * that happened to double as the registry's is a platform login and stays.
+ *
+ * @example
+ * clearRegistrySession(); // `mesh registry logout`
+ */
+export declare function clearRegistrySession(): void;
+/**
+ * True when two identity records disagree on anything that matters for a
+ * broker call — the signal that a re-discovery is worth a retry.
+ *
+ * @example
+ * identityChanged(a, { ...a, registryBroker: "https://moved" }); // → true
+ */
+export declare function identityChanged(before: RegistryIdentity, after: RegistryIdentity): boolean;
+/**
+ * Human-readable time left on a session, e.g. `11h 42m`; `expired` when the
+ * expiry has passed. Pure; exported for the status line's test.
+ */
+export declare function describeSessionExpiry(expiresAt: string, now?: number): string;
+/** Log the one-line identity banner `mesh registry login` opens with. */
+export declare function logRegistryIdentity(identity: RegistryIdentity): void;
+//# sourceMappingURL=registry-identity.d.ts.map

package/dist/src/utils/registry-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-identity.d.ts","sourceRoot":"","sources":["../../../src/utils/registry-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAmBH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C;;;;GAIG;AACH,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC,2FAA2F;AAC3F,eAAO,MAAM,eAAe,EAAE,MAM1B,CAAC;AAEL;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAkC,CAAC;AAEzE,6DAA6D;AAC7D,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAElE;AAED,oFAAoF;AACpF,MAAM,WAAW,gBAAgB;IAC/B,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,sFAAsF;IACtF,cAAc,EAAE,MAAM,CAAC;IACvB,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;CACtB;AASD,uFAAuF;AACvF,qBAAa,qBAAsB,SAAQ,YAAY;gBACzC,MAAM,EAAE,MAAM;CAQ3B;AAeD;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAqBzG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAA2B,EAClF,WAAW,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAwB,GAC1D,MAAM,EAAE,CAQV;AAED,sEAAsE;AACtE,MAAM,WAAW,eAAe;IAC9B,yFAAyF;IACzF,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAAI,eAAe,GAAG,IAAI,CAS5D;AAED,+DAA+D;AAC/D,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D,MAAM,MAAM,qBAAqB,GAAG,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,eAAe,CAAC,GAAG,sBAAsB,CAAC;AAE9F;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;CACtB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAuDjC;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAG3C;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAM1F;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,MAAM,CAOjF;AAED,yEAAyE;AACzE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAQpE"}

package/dist/src/utils/registry-identity.js

@@ -0,0 +1,273 @@
+/**
+ * The ONE identity behind `@mesh-tech` package access.
+ *
+ * Every reader of the registry — `pnpm install`, `mesh create-app`,
+ * `mesh docs start`, the Hub image build under `mesh start` — talks to the same
+ * CodeArtifact domain, and that domain is owned by exactly one Mesh platform:
+ * `dev.platform.meshtech.io`. So the registry has a single, global identity
+ * (issuer + CLI client id + broker URL) that never depends on which tenant
+ * platform, if any, the developer deploys to.
+ *
+ * This module keeps that identity separate from platform contexts:
+ *
+ * - The domain comes from the compiled-in first-party alias table and nowhere
+ *   else — not an argument, not an environment variable, not an unpinned
+ *   config value. That is the same trust anchor `mesh login` relies on, so the
+ *   ≥2-dot anti-phishing guard stays intact.
+ * - The Zitadel session for the registry is cached under a **reserved**
+ *   credential key (`registry`) that no `<tenant>.<env>` context can collide
+ *   with, and `mesh login` / `mesh logout` refuse it.
+ * - A developer who already signed in to the registry's own platform
+ *   (`mesh login mesh.dev`) is reused rather than sent through the browser a
+ *   second time: any cached session whose issuer matches the registry's counts.
+ *
+ * Nothing here touches `~/.npmrc` or the broker — that is `mesh registry
+ * login`'s job. This module only answers "who is the registry?" and "do I hold
+ * a session for it?".
+ */
+import { clearContextConfig, clearCredentials, discoverConfigFromWellKnown, getContextConfig, getValidToken, readAllContextConfigs, readAllCredentials, readCredentials, runLoginFlow, tokenStillValid, writeContextConfig, RESERVED_REGISTRY_CONTEXT, } from "../commands/login.js";
+import { firstPartyDomainFor } from "./first-party-contexts.js";
+import { deriveRegistryBroker } from "./registry-broker.js";
+import { MeshCliError } from "./errors.js";
+import { logInfo } from "./log.js";
+/**
+ * The first-party alias of the platform that owns the `@mesh-tech` registry.
+ * The alias is the key in `FIRST_PARTY_CONTEXTS`; the domain is looked up
+ * from that reviewed table, never typed here twice.
+ */
+export const REGISTRY_ALIAS = "mesh.dev";
+/** The pinned domain anonymous discovery runs against, e.g. `dev.platform.meshtech.io`. */
+export const REGISTRY_DOMAIN = (() => {
+    const domain = firstPartyDomainFor(REGISTRY_ALIAS);
+    if (!domain) {
+        throw new Error(`FIRST_PARTY_CONTEXTS has no entry for the registry alias "${REGISTRY_ALIAS}"`);
+    }
+    return domain;
+})();
+/**
+ * The reserved context name the registry session and identity are cached under
+ * in `credentials.json` / `config.json`. Deliberately has no dot, so it can
+ * never parse as a `<tenant>.<env>` platform context.
+ */
+export const REGISTRY_CREDENTIAL_KEY = RESERVED_REGISTRY_CONTEXT;
+/** True when a context name is the reserved registry key. */
+export function isReservedRegistryContext(context) {
+    return context === REGISTRY_CREDENTIAL_KEY;
+}
+/** Raised when the registry's identity cannot be resolved (offline, endpoint down). */
+export class RegistryIdentityError extends MeshCliError {
+    constructor(detail) {
+        super(`Could not resolve the Mesh package registry (${detail}).\n` +
+            `  Discovery endpoint: https://cli.${REGISTRY_DOMAIN}/.well-known/mesh.json`, { remediation: { command: "mesh registry login   # retry once you are online" } });
+        this.name = "RegistryIdentityError";
+    }
+}
+function toIdentity(cfg) {
+    if (!cfg?.issuer || !cfg.clientId)
+        return null;
+    const registryBroker = cfg.registryBroker ?? deriveRegistryBroker(REGISTRY_CREDENTIAL_KEY, () => cfg);
+    if (!registryBroker)
+        return null;
+    return {
+        issuer: cfg.issuer,
+        clientId: cfg.clientId,
+        registryBroker,
+        discoveredAt: cfg.discoveredAt ?? new Date(0).toISOString(),
+    };
+}
+/**
+ * Resolve the registry's identity: the cached record under the reserved key,
+ * or a fresh anonymous HTTPS discovery on the pinned domain which is then
+ * cached there. `refresh: true` skips the cache.
+ *
+ * Never consults SSM and never takes the domain from anything but the alias
+ * table. Throws `RegistryIdentityError` when discovery is impossible and
+ * nothing is cached.
+ *
+ * @example
+ * const { registryBroker } = await resolveRegistryIdentity();
+ * // → "https://registry-auth.dev.platform.meshtech.io"
+ */
+export async function resolveRegistryIdentity(opts = {}) {
+    if (!opts.refresh) {
+        const cached = toIdentity(getContextConfig(REGISTRY_CREDENTIAL_KEY));
+        if (cached)
+            return cached;
+    }
+    const discovered = await discoverConfigFromWellKnown(REGISTRY_DOMAIN, REGISTRY_CREDENTIAL_KEY, {
+        quiet: true,
+    });
+    if (!discovered) {
+        throw new RegistryIdentityError(`discovery on ${REGISTRY_DOMAIN} failed — are you online?`);
+    }
+    const stored = { ...discovered, discoveredAt: new Date().toISOString() };
+    const identity = toIdentity(stored);
+    if (!identity) {
+        throw new RegistryIdentityError(`the discovery document names no registry broker`);
+    }
+    writeContextConfig(REGISTRY_CREDENTIAL_KEY, stored);
+    return identity;
+}
+/**
+ * The cached contexts whose session can stand in for the registry's: the
+ * reserved key first, then the registry's own alias and domain — but only
+ * when the cached config for that name points at the SAME issuer, so a
+ * pre-repoint `mesh.dev` entry (a different platform) is never mistaken for
+ * the registry. With no known issuer (nothing discovered yet) only the
+ * reserved key counts: a guess about which platform session "is" the
+ * registry is the mistake this function exists to prevent.
+ *
+ * Pure over the two files' contents; exported for tests.
+ */
+export function registrySessionCandidates(issuer, configs = readAllContextConfigs(), credentials = readAllCredentials()) {
+    const names = issuer ? [REGISTRY_CREDENTIAL_KEY, REGISTRY_ALIAS, REGISTRY_DOMAIN] : [REGISTRY_CREDENTIAL_KEY];
+    return names.filter((name) => {
+        if (!(name in credentials))
+            return false;
+        const cfg = configs[name];
+        if (!cfg?.issuer)
+            return false;
+        return issuer ? cfg.issuer === issuer : true;
+    });
+}
+/**
+ * The registry session as cached right now — no refresh, no network. Null when
+ * no candidate context holds an unexpired token.
+ *
+ * @example
+ * const s = readRegistrySession();
+ * if (s) console.log(`signed in as ${s.email}`);
+ */
+export function readRegistrySession() {
+    const identity = toIdentity(getContextConfig(REGISTRY_CREDENTIAL_KEY));
+    for (const context of registrySessionCandidates(identity?.issuer ?? null)) {
+        const creds = readCredentials(context);
+        if (creds && tokenStillValid(creds.expiresAt)) {
+            return { context, email: creds.email ?? "unknown", expiresAt: creds.expiresAt };
+        }
+    }
+    return null;
+}
+/**
+ * Get a valid Zitadel session for the registry's issuer, signing in when
+ * there is none.
+ *
+ * Reuses ANY cached session whose issuer matches — a developer already signed
+ * in to `mesh.dev` gets no second browser trip — refreshing an expired one
+ * through its refresh token first. Only when no candidate can be refreshed
+ * does it run the sign-in (browser PKCE, or device code with `device: true`
+ * or in a remote/non-TTY environment) and store the result under the
+ * reserved key.
+ *
+ * `interactive: false` means "cached or nothing": callers that cannot open a
+ * browser or print a device code get `no-tty` back instead of a hung prompt.
+ *
+ * @example
+ * const session = await ensureRegistrySession({ interactive: true });
+ * if (session.ok) console.log(session.email);
+ */
+export async function ensureRegistrySession(opts) {
+    let identity;
+    try {
+        identity = await resolveRegistryIdentity();
+    }
+    catch (err) {
+        return { ok: false, reason: "no-identity", detail: err.message };
+    }
+    for (const context of registrySessionCandidates(identity.issuer)) {
+        const token = await getValidToken(context);
+        if (!token)
+            continue;
+        const creds = readCredentials(context);
+        if (creds)
+            return { ok: true, context, email: creds.email ?? "unknown", expiresAt: creds.expiresAt };
+    }
+    if (!opts.interactive) {
+        return {
+            ok: false,
+            reason: "no-tty",
+            detail: "no registry session is cached and this run cannot open a sign-in",
+        };
+    }
+    // The reserved key gets the registry's identity as its config so the
+    // ordinary token machinery (refresh included) works for it unchanged.
+    const stored = getContextConfig(REGISTRY_CREDENTIAL_KEY);
+    if (!stored) {
+        writeContextConfig(REGISTRY_CREDENTIAL_KEY, {
+            issuer: identity.issuer,
+            clientId: identity.clientId,
+            registryBroker: identity.registryBroker,
+        });
+    }
+    // Said here, not by the caller: only now is it known that no cached session
+    // could be refreshed, so this line never precedes a silent refresh.
+    logInfo(opts.device
+        ? "No registry session — sign in with the device code below…"
+        : "No registry session — opening your browser to sign in… (headless? use --device)");
+    try {
+        await runLoginFlow(REGISTRY_CREDENTIAL_KEY, identity, { device: opts.device });
+    }
+    catch (err) {
+        return { ok: false, reason: "login-failed", detail: err.message };
+    }
+    const creds = readCredentials(REGISTRY_CREDENTIAL_KEY);
+    if (!creds) {
+        return { ok: false, reason: "login-failed", detail: "sign-in completed but no session was cached" };
+    }
+    return {
+        ok: true,
+        context: REGISTRY_CREDENTIAL_KEY,
+        email: creds.email ?? "unknown",
+        expiresAt: creds.expiresAt,
+    };
+}
+/**
+ * Forget the registry: the session AND the pinned identity record, so the
+ * next `mesh registry login` re-discovers the registry from the pinned
+ * domain. Clears the reserved key only — a platform session under `mesh.dev`
+ * that happened to double as the registry's is a platform login and stays.
+ *
+ * @example
+ * clearRegistrySession(); // `mesh registry logout`
+ */
+export function clearRegistrySession() {
+    clearCredentials(REGISTRY_CREDENTIAL_KEY);
+    clearContextConfig(REGISTRY_CREDENTIAL_KEY);
+}
+/**
+ * True when two identity records disagree on anything that matters for a
+ * broker call — the signal that a re-discovery is worth a retry.
+ *
+ * @example
+ * identityChanged(a, { ...a, registryBroker: "https://moved" }); // → true
+ */
+export function identityChanged(before, after) {
+    return (before.issuer !== after.issuer ||
+        before.clientId !== after.clientId ||
+        before.registryBroker !== after.registryBroker);
+}
+/**
+ * Human-readable time left on a session, e.g. `11h 42m`; `expired` when the
+ * expiry has passed. Pure; exported for the status line's test.
+ */
+export function describeSessionExpiry(expiresAt, now = Date.now()) {
+    const ms = new Date(expiresAt).getTime() - now;
+    if (!(ms > 0))
+        return "expired";
+    const totalMinutes = Math.floor(ms / 60_000);
+    const h = Math.floor(totalMinutes / 60);
+    const m = totalMinutes % 60;
+    return h > 0 ? `${h}h ${m}m` : `${m}m`;
+}
+/** Log the one-line identity banner `mesh registry login` opens with. */
+export function logRegistryIdentity(identity) {
+    let host = identity.registryBroker;
+    try {
+        host = new URL(identity.registryBroker).host;
+    }
+    catch {
+        // keep the raw value when it is not a URL
+    }
+    logInfo(`Mesh package registry: mesh-platform (broker ${host})`);
+}
+//# sourceMappingURL=registry-identity.js.map

package/dist/src/utils/registry-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-identity.js","sourceRoot":"","sources":["../../../src/utils/registry-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,2BAA2B,EAC3B,gBAAgB,EAChB,aAAa,EACb,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,yBAAyB,GAE1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;AAEzC,2FAA2F;AAC3F,MAAM,CAAC,MAAM,eAAe,GAAW,CAAC,GAAG,EAAE;IAC3C,MAAM,MAAM,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,6DAA6D,cAAc,GAAG,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC,EAAE,CAAC;AAEL;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAW,yBAAyB,CAAC;AAEzE,6DAA6D;AAC7D,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,OAAO,OAAO,KAAK,uBAAuB,CAAC;AAC7C,CAAC;AAqBD,uFAAuF;AACvF,MAAM,OAAO,qBAAsB,SAAQ,YAAY;IACrD,YAAY,MAAc;QACxB,KAAK,CACH,gDAAgD,MAAM,MAAM;YAC1D,qCAAqC,eAAe,wBAAwB,EAC9E,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,mDAAmD,EAAE,EAAE,CAClF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,SAAS,UAAU,CAAC,GAAkC;IACpD,IAAI,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,cAAc,GAClB,GAAG,CAAC,cAAc,IAAI,oBAAoB,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjF,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,cAAc;QACd,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;KAC5D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAA8B,EAAE;IAC5E,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,uBAAuB,CAAkC,CAAC,CAAC;QACtG,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,2BAA2B,CAAC,eAAe,EAAE,uBAAuB,EAAE;QAC7F,KAAK,EAAE,IAAI;KACZ,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,qBAAqB,CAC7B,gBAAgB,eAAe,2BAA2B,CAC3D,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAA2B,EAAE,GAAG,UAAU,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACjG,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,qBAAqB,CAAC,iDAAiD,CAAC,CAAC;IACrF,CAAC;IACD,kBAAkB,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACpD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAqB,EACrB,UAA2D,qBAAqB,EAAE,EAClF,cAAuC,kBAAkB,EAAE;IAE3D,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,uBAAuB,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC;IAC9G,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3B,IAAI,CAAC,CAAC,IAAI,IAAI,WAAW,CAAC;YAAE,OAAO,KAAK,CAAC;QACzC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,GAAG,EAAE,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/B,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC;AAUD;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,QAAQ,GAAG,UAAU,CAAC,gBAAgB,CAAC,uBAAuB,CAAkC,CAAC,CAAC;IACxG,KAAK,MAAM,OAAO,IAAI,yBAAyB,CAAC,QAAQ,EAAE,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,KAAK,IAAI,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QAClF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAUD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAG3C;IACC,IAAI,QAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,uBAAuB,EAAE,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;IAC9E,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,yBAAyB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACjE,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;IACvG,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,kEAAkE;SAC3E,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,sEAAsE;IACtE,MAAM,MAAM,GAAG,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,kBAAkB,CAAC,uBAAuB,EAAE;YAC1C,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,cAAc,EAAE,QAAQ,CAAC,cAAc;SACxC,CAAC,CAAC;IACL,CAAC;IACD,4EAA4E;IAC5E,oEAAoE;IACpE,OAAO,CACL,IAAI,CAAC,MAAM;QACT,CAAC,CAAC,2DAA2D;QAC7D,CAAC,CAAC,iFAAiF,CACtF,CAAC;IACF,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,uBAAuB,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACjF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,KAAK,GAAG,eAAe,CAAC,uBAAuB,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;IACtG,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,uBAAuB;QAChC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,SAAS;QAC/B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB;IAClC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;IAC1C,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,MAAwB,EAAE,KAAuB;IAC/E,OAAO,CACL,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAC9B,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAClC,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,CAC/C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACvE,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC;IAC/C,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;IAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,EAAE,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,YAAY,GAAG,EAAE,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AACzC,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CAAC,QAA0B;IAC5D,IAAI,IAAI,GAAG,QAAQ,CAAC,cAAc,CAAC;IACnC,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,0CAA0C;IAC5C,CAAC;IACD,OAAO,CAAC,gDAAgD,IAAI,GAAG,CAAC,CAAC;AACnE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mesh-tech/mesh-cli",
-  "version": "0.18.1",
+  "version": "0.19.0",
   "description": "CLI for Mesh platform development utilities",
   "type": "module",
   "license": "UNLICENSED",
@@ -42,7 +42,7 @@
   },
   "devDependencies": {
     "@mesh-tech/agent-contracts": "0.2.0",
-    "@mesh-tech/tsconfig": "2.1.1",
+    "@mesh-tech/tsconfig": "2.2.0",
     "@mesh-tech/workflow-viz": "0.3.0",
     "@tanstack/intent": "^0.3.6",
     "@types/node": "^20.0.0",
@@ -54,6 +54,7 @@
     "@aws-sdk/client-ssm": "^3.700.0",
     "@aws-sdk/client-sts": "^3.700.0",
     "@inquirer/checkbox": "^4.2.0",
+    "@inquirer/confirm": "^5.1.14",
     "@inquirer/input": "^4.2.1",
     "@inquirer/password": "^4.0.17",
     "@inquirer/select": "^4.3.1",