@mesh-tech/mesh-cli 0.18.2 → 0.20.0

package/dist/src/commands/login.d.ts

@@ -10,13 +10,19 @@
  *
  * In containers/SSH sessions, device code flow is used automatically.
  *
+ * `mesh login` is for a DEPLOYED platform only — the tenant platform you
+ * deploy to, reach the Hub of, or tunnel into. Package-registry access is a
+ * separate, global identity owned by `mesh registry login`; a platform login
+ * never writes ~/.npmrc, and the reserved `registry` credential key is refused
+ * here so the two can never be confused.
+ *
  * Usage:
- *   mesh login mesh.dev            — authenticate to mesh dev
- *   mesh login mesh.dev --device   — force device code flow
- *   mesh login mesh.dev --status   — show current auth state (Zitadel session if
+ *   mesh login acme.dev            — authenticate to the acme dev platform
+ *   mesh login acme.dev --device   — force device code flow
+ *   mesh login acme.dev --status   — show current auth state (Zitadel session if
  *                                    there is one, otherwise whatever the AWS
  *                                    credential chain resolves — SSO or key pair)
- *   mesh logout mesh.dev           — clear cached credentials
+ *   mesh logout acme.dev           — clear cached credentials
  */
 import { Command } from "commander";
 import { type AwsIdentity } from "../utils/aws-auth.js";
@@ -66,7 +72,29 @@ interface CachedCredentials {
 type ConfigFile = Record<string, ContextConfig>;
 type CredentialsFile = Record<string, CachedCredentials>;
 export declare function writeContextConfig(context: string, config: ContextConfig): void;
+/**
+ * Forget a cached context config so the next use runs discovery again.
+ *
+ * @example
+ * clearContextConfig("registry"); // `mesh registry logout` — re-discovers the registry next time
+ */
+export declare function clearContextConfig(context: string): void;
 declare function getContextConfig(context: string): ContextConfig | null;
+/**
+ * Anonymous discovery against `https://cli.<domain>/.well-known/mesh.json`.
+ *
+ * `quiet: true` returns the payload WITHOUT caching it under `contextKey` and
+ * without the progress lines — for a caller that stores the record itself
+ * under a name that is not a platform context (the package registry's
+ * reserved key). Warnings still print, because a failed discovery is the
+ * caller's problem either way.
+ *
+ * @example
+ * const cfg = await discoverConfigFromWellKnown("dev.platform.meshtech.io", "registry", { quiet: true });
+ */
+export declare function discoverConfigFromWellKnown(domain: string, contextKey?: string, opts?: {
+    quiet?: boolean;
+}): Promise<ContextConfig | null>;
 declare function readAllCredentials(): CredentialsFile;
 declare function readCredentials(context: string): CachedCredentials | null;
 /**
@@ -82,6 +110,7 @@ declare function readCredentials(context: string): CachedCredentials | null;
  * Exported for unit testing.
  */
 export declare function atomicWriteFileSync(path: string, data: string, mode: number): void;
+declare function clearCredentials(context: string): void;
 declare function decodeJwtPayload(token: string): Record<string, unknown>;
 /**
  * Run device-code login, re-issuing a fresh code (up to `maxCodes`) if the user
@@ -142,6 +171,29 @@ export declare function renderAwsFallbackStatus(context: string, reason: string,
     exitCode: 0 | 1;
 };
 export declare function registerLoginCommand(program: Command): void;
+/**
+ * The credential key the package registry's own session lives under. Not a
+ * platform: `mesh login` / `mesh logout` refuse it, and the post-login hints
+ * (VPN, tenants) never apply to it. `utils/registry-identity.ts` owns the
+ * registry side of this contract and re-exports the key.
+ */
+export declare const RESERVED_REGISTRY_CONTEXT = "registry";
+/** Printed once when `--no-registry` is passed: the flag no longer changes anything. */
+export declare const NO_REGISTRY_DEPRECATED = "--no-registry is deprecated and ignored: mesh login no longer touches the registry.";
+/** Printed after a platform login on a machine with no package-registry access. */
+export declare const REGISTRY_SEPARATE_HINT = "Package registry access is separate from platform sign-in \u2014 run: mesh registry login";
+/**
+ * The "no configuration found" explanation for a context that neither SSM,
+ * the pinned first-party table, nor the well-known endpoint could resolve —
+ * every path tried, then the `config.json` snippet to add by hand.
+ *
+ * Shared by the `login` command and the `mesh init` wizard's platform step so
+ * a discovery failure reads the same wherever it happens.
+ *
+ * @example
+ * logError(renderNoConfigHelp("acme.dev"));
+ */
+export declare function renderNoConfigHelp(context: string): string;
 /**
  * Get a valid access token for the given context, refreshing if needed.
  *
@@ -261,6 +313,25 @@ export declare function resolveRoleOrExplain(opts: {
 } | {
     error: string;
 };
+/**
+ * Ensure a valid Zitadel ID token is cached for the given context — refreshing
+ * or running the full login flow as needed. Returns null on failure.
+ */
+/**
+ * Run the sign-in itself — browser PKCE, or the device-code flow when asked
+ * for or when there is no browser to open (`isRemoteEnvironment`) — and cache
+ * the resulting session under `context`. Rejects when the user denies, the
+ * flow times out, or the issuer refuses.
+ *
+ * The one sign-in routine every caller shares: the `login` command, on-demand
+ * login from other commands, and the package registry's own session.
+ *
+ * @example
+ * await runLoginFlow("acme.dev", config, { device: false });
+ */
+export declare function runLoginFlow(context: string, config: ContextConfig, opts?: {
+    device?: boolean;
+}): Promise<void>;
 /**
  * Ensure a valid login session for `context`, running the login flow (device
  * code in remote/non-TTY, browser callback otherwise) if none is cached. Returns
@@ -287,5 +358,5 @@ export declare function readAllContextConfigs(): ConfigFile;
  * sign-in, which is why this leg had no coverage above the unit tier.
  */
 export declare function discoverConfigForContext(context: string): Promise<ContextConfig | null>;
-export { readCredentials, readAllCredentials, getContextConfig, decodeJwtPayload, getValidToken };
+export { readCredentials, readAllCredentials, getContextConfig, decodeJwtPayload, getValidToken, clearCredentials };
 //# sourceMappingURL=login.d.ts.map

package/dist/src/commands/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/commands/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOpC,OAAO,EAWL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAQ9B,QAAA,MAAM,UAAU,QAGf,CAAC;AACF,QAAA,MAAM,WAAW,QAAuC,CAAC;AACzD,QAAA,MAAM,gBAAgB,QAA4C,CAAC;AAWnE,UAAU,aAAa;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,iBAAiB;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAChD,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAWzD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,IAAI,CAK/E;AAED,iBAAS,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAG/D;AA8ID,iBAAS,kBAAkB,IAAI,eAAe,CAO7C;AAED,iBAAS,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAElE;AAOD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAalF;AA0CD,iBAAS,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAIhE;AAuOD;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,EAC/D,QAAQ,GAAE,MAAyB,GAClC,OAAO,CAAC,IAAI,CAAC,CAQf;AA8GD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAc7C;AAuBD;;;;;;;;;;;;GAYG;AACH,oEAAoE;AACpE,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,MAAM,GAAG,SAAS,CAEpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,WAAW,GAAG,IAAI,EAC5B,iBAAiB,CAAC,EAAE,MAAM,GACzB;IAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAA;CAAE,CA+D1C;AA+FD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAoI3D;AAMD;;;;;;GAMG;AACH;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,SAAI,EAAE,GAAG,SAAa,GAAG,OAAO,CAE1F;AAED,iBAAe,aAAa,CAC1B,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4BxB;AAMD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,KAAK,EAAE,YAAY,CAAA;CAAE,GACvB;IAAE,KAAK,EAAE,iBAAiB,CAAA;CAAE,GAC5B;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,KAAK,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEpC;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,SAAS,CAAC,CA0BpB;AAeD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAOT;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAMT;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,CAER;AAcD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAK7C;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EACvB,MAAM,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAUtC;AA8BD;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GACrD,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAsBnC;AAwOD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;AACrD,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,eAAe,EAAE,CAAC;AAClE,0DAA0D;AAC1D,wBAAgB,qBAAqB,IAAI,UAAU,CAElD;AAED;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAE7F;AAED,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/commands/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC,OAAO,EAWL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAQ9B,QAAA,MAAM,UAAU,QAGf,CAAC;AACF,QAAA,MAAM,WAAW,QAAuC,CAAC;AACzD,QAAA,MAAM,gBAAgB,QAA4C,CAAC;AAWnE,UAAU,aAAa;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,iBAAiB;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAChD,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAWzD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,IAAI,CAK/E;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAMxD;AAED,iBAAS,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAG/D;AAkJD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,MAAM,EACd,UAAU,GAAE,MAAe,EAC3B,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAC7B,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAE/B;AAED,iBAAS,kBAAkB,IAAI,eAAe,CAO7C;AAED,iBAAS,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAElE;AAOD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAalF;AASD,iBAAS,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAO/C;AA0BD,iBAAS,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAIhE;AAuOD;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,EAC/D,QAAQ,GAAE,MAAyB,GAClC,OAAO,CAAC,IAAI,CAAC,CAQf;AA8GD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAc7C;AAyBD;;;;;;;;;;;;GAYG;AACH,oEAAoE;AACpE,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,MAAM,GAAG,SAAS,CAEpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,WAAW,GAAG,IAAI,EAC5B,iBAAiB,CAAC,EAAE,MAAM,GACzB;IAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAA;CAAE,CA+D1C;AA+FD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAqG3D;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,aAAa,CAAC;AAEpD,wFAAwF;AACxF,eAAO,MAAM,sBAAsB,wFACoD,CAAC;AAExF,mFAAmF;AACnF,eAAO,MAAM,sBAAsB,8FACqD,CAAC;AAoCzF;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAsB1D;AAMD;;;;;;GAMG;AACH;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,SAAI,EAAE,GAAG,SAAa,GAAG,OAAO,CAE1F;AAED,iBAAe,aAAa,CAC1B,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4BxB;AAMD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,KAAK,EAAE,YAAY,CAAA;CAAE,GACvB;IAAE,KAAK,EAAE,iBAAiB,CAAA;CAAE,GAC5B;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,KAAK,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEpC;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,SAAS,CAAC,CA0BpB;AAeD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAOT;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAMT;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,CAER;AAcD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAK7C;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EACvB,MAAM,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAUtC;AAED;;;GAGG;AACH;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,aAAa,EACrB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9B,OAAO,CAAC,IAAI,CAAC,CAQf;AAoBD;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GACrD,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAsBnC;AAwOD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;AACrD,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,eAAe,EAAE,CAAC;AAClE,0DAA0D;AAC1D,wBAAgB,qBAAqB,IAAI,UAAU,CAElD;AAED;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAE7F;AAED,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/src/commands/login.js

@@ -10,13 +10,19 @@
  *
  * In containers/SSH sessions, device code flow is used automatically.
  *
+ * `mesh login` is for a DEPLOYED platform only — the tenant platform you
+ * deploy to, reach the Hub of, or tunnel into. Package-registry access is a
+ * separate, global identity owned by `mesh registry login`; a platform login
+ * never writes ~/.npmrc, and the reserved `registry` credential key is refused
+ * here so the two can never be confused.
+ *
  * Usage:
- *   mesh login mesh.dev            — authenticate to mesh dev
- *   mesh login mesh.dev --device   — force device code flow
- *   mesh login mesh.dev --status   — show current auth state (Zitadel session if
+ *   mesh login acme.dev            — authenticate to the acme dev platform
+ *   mesh login acme.dev --device   — force device code flow
+ *   mesh login acme.dev --status   — show current auth state (Zitadel session if
  *                                    there is one, otherwise whatever the AWS
  *                                    credential chain resolves — SSO or key pair)
- *   mesh logout mesh.dev           — clear cached credentials
+ *   mesh logout acme.dev           — clear cached credentials
  */
 import * as http from "http";
 import * as crypto from "crypto";
@@ -24,6 +30,7 @@ import * as fs from "fs";
 import * as path from "path";
 import { execFileSync } from "child_process";
 import { logError, logInfo, logSuccess, logWarn } from "../utils/log.js";
+import { MeshCliError } from "../utils/errors.js";
 import { assumeRoleCredentials, assumeRoleWithWebIdentity, describeAssumeFailure, probeAwsIdentity, renderCredentialProcessProfile, tokenIssuer, resolveStableMeshBin, selectRoleForCaller, toCredentialProcessJson, upsertManagedAwsConfigSection, } from "../utils/aws-auth.js";
 import { firstPartyDomainFor } from "../utils/first-party-contexts.js";
 import { tailscaleBackendState } from "./vpn/index.js";
@@ -52,6 +59,20 @@ export function writeContextConfig(context, config) {
     fs.mkdirSync(CONFIG_DIR, { recursive: true });
     fs.writeFileSync(CONFIG_FILE, JSON.stringify(existing, null, 2));
 }
+/**
+ * Forget a cached context config so the next use runs discovery again.
+ *
+ * @example
+ * clearContextConfig("registry"); // `mesh registry logout` — re-discovers the registry next time
+ */
+export function clearContextConfig(context) {
+    const existing = readConfig();
+    if (!(context in existing))
+        return;
+    delete existing[context];
+    fs.mkdirSync(CONFIG_DIR, { recursive: true });
+    fs.writeFileSync(CONFIG_FILE, JSON.stringify(existing, null, 2));
+}
 function getContextConfig(context) {
     const config = readConfig();
     return config[context] ?? null;
@@ -151,9 +172,10 @@ async function discoverConfigFromSsm(context) {
  * `dev.platform.meshtech.io` but must be cached under `mesh.dev`, or the very
  * next command re-runs discovery and the alias buys nothing.
  */
-async function discoverConfig(domain, contextKey = domain) {
+async function discoverConfig(domain, contextKey = domain, opts = {}) {
     const url = `https://cli.${domain}/.well-known/mesh.json`;
-    logInfo(`Attempting discovery from ${url}...`);
+    if (!opts.quiet)
+        logInfo(`Attempting discovery from ${url}...`);
     try {
         const controller = new AbortController();
         const timeout = setTimeout(() => controller.abort(), 5000);
@@ -177,8 +199,10 @@ async function discoverConfig(domain, contextKey = domain) {
             config.vpnJoinBroker = data.vpnJoinBroker;
         if (typeof data.registryBroker === "string")
             config.registryBroker = data.registryBroker;
-        writeContextConfig(contextKey, config);
-        logSuccess(`Discovered platform configuration for ${contextKey}`);
+        if (!opts.quiet) {
+            writeContextConfig(contextKey, config);
+            logSuccess(`Discovered platform configuration for ${contextKey}`);
+        }
         return config;
     }
     catch (err) {
@@ -192,6 +216,21 @@ async function discoverConfig(domain, contextKey = domain) {
         return null;
     }
 }
+/**
+ * Anonymous discovery against `https://cli.<domain>/.well-known/mesh.json`.
+ *
+ * `quiet: true` returns the payload WITHOUT caching it under `contextKey` and
+ * without the progress lines — for a caller that stores the record itself
+ * under a name that is not a platform context (the package registry's
+ * reserved key). Warnings still print, because a failed discovery is the
+ * caller's problem either way.
+ *
+ * @example
+ * const cfg = await discoverConfigFromWellKnown("dev.platform.meshtech.io", "registry", { quiet: true });
+ */
+export function discoverConfigFromWellKnown(domain, contextKey = domain, opts = {}) {
+    return discoverConfig(domain, contextKey, opts);
+}
 function readAllCredentials() {
     if (!fs.existsSync(CREDENTIALS_FILE))
         return {};
@@ -581,6 +620,9 @@ export function isRemoteEnvironment() {
  * Non-blocking — never fails or delays the login flow.
  */
 function hintVpnIfDisconnected(context) {
+    // The package registry is not a platform: no VPN sits behind it.
+    if (context === RESERVED_REGISTRY_CONTEXT)
+        return;
     try {
         const state = tailscaleBackendState();
         if (state !== "Running") {
@@ -748,8 +790,9 @@ export function registerLoginCommand(program) {
         .option("--credential-process", "Print AWS credential_process JSON (used by mesh dev's temp profile); refreshes the Zitadel token as needed. Requires --role or a cached defaultRole.")
         .option("--role <arn>", "IAM role ARN to assume via web identity (used with --export). Saved as the default for this context so future --export runs can omit it. Resolution order: --role > MESH_AWS_ROLE > cached defaultRole.")
         .option("--region <region>", "AWS region to include in the exported AWS_REGION. Defaults to AWS_REGION env or us-east-2.")
-        .option("--no-registry", "Skip the CodeArtifact registry-auth step that runs automatically after login for {tenant}.{env} contexts")
+        .option("--no-registry", "Deprecated and ignored — mesh login no longer touches the package registry (that is `mesh registry login`)")
         .action(async (context, opts) => {
+        refuseReservedRegistryContext(context, "login");
         let config = getContextConfig(context);
         if (!config) {
             // One chain, shared with `ensureLogin` — see discoverConfigGuarded.
@@ -758,25 +801,7 @@ export function registerLoginCommand(program) {
             // laptop could resolve a short context at all.
             config = await discoverConfigGuarded(context);
             if (!config) {
-                const pinned = firstPartyDomainFor(context);
-                logError(`No configuration found for "${context}".\n\n` +
-                    `Tried:\n` +
-                    `  1. SSM: /mesh-platform/${context.split(".")[0]}/${context.split(".")[1]}/platform/zitadel\n` +
-                    `     (requires AWS SSO login + read access)\n` +
-                    (pinned
-                        ? `  2. HTTPS: https://cli.${pinned}/.well-known/mesh.json  (pinned first-party domain)\n\n`
-                        : `  2. HTTPS: https://cli.${context}/.well-known/mesh.json\n` +
-                            `     (only attempted for a full domain, or a known first-party context)\n\n`) +
-                    `To fix:\n` +
-                    `  - Use the platform's full domain: mesh login <env>.<tenant>.meshtech.io\n` +
-                    `  - Or, if you have AWS access, ensure SSO is active: aws sso login --profile <profile>\n` +
-                    `  - Or add config manually to ${CONFIG_FILE}:\n\n` +
-                    `    {\n` +
-                    `      "${context}": {\n` +
-                    `        "issuer": "https://identity.<env>.<your-platform-domain>",\n` +
-                    `        "clientId": "<cli-oidc-client-id>"\n` +
-                    `      }\n` +
-                    `    }\n`);
+                logError(renderNoConfigHelp(context));
                 process.exit(1);
             }
         }
@@ -792,45 +817,106 @@ export function registerLoginCommand(program) {
             await credentialProcessAwsCredentials(context, config, opts);
             return;
         }
+        if (opts.registry === false) {
+            logWarn(NO_REGISTRY_DEPRECATED);
+        }
         try {
-            const useDevice = opts.device || isRemoteEnvironment();
-            if (useDevice) {
-                logInfo("Using device code flow");
-                await deviceCodeLogin(context, config);
-            }
-            else {
-                await login(context, config);
-            }
+            await runLoginFlow(context, config, opts);
         }
         catch (err) {
             logError(`Login failed: ${err.message}`);
             process.exit(1);
         }
-        // F2: login absorbs registry auth. CodeArtifact-backed contexts are the
-        // {tenant}.{env} ones — the local platform ('local') has no registry.
-        // Best-effort: a registry hiccup must not fail an otherwise good login.
-        if (opts.registry !== false && parseTenantEnv(context)) {
-            try {
-                logInfo("Refreshing CodeArtifact registry auth (skip with --no-registry)…");
-                const { runRegistryLogin } = await import("./registry.js");
-                await runRegistryLogin(context, {});
-            }
-            catch (err) {
-                logWarn(`Registry auth failed (login itself succeeded): ${err.message}` +
-                    ` — retry with: mesh registry login ${context}`
-                    + ` (add --profile mesh-dev only if you have an AWS account and the broker is unavailable)`);
-            }
-        }
+        // Platform sign-in and package-registry access are two identities. A
+        // platform login never writes ~/.npmrc; it only points at the command
+        // that does, and only when this machine has no registry access yet.
+        await hintRegistryIfMissing();
     });
     program
         .command("logout")
         .description("Clear cached Zitadel credentials")
         .argument("<context>", 'Platform context (e.g., "mesh.dev")')
         .action((context) => {
+        refuseReservedRegistryContext(context, "logout");
         clearCredentials(context);
         logSuccess(`Logged out of ${context}. Credentials cleared.`);
     });
 }
+/**
+ * The credential key the package registry's own session lives under. Not a
+ * platform: `mesh login` / `mesh logout` refuse it, and the post-login hints
+ * (VPN, tenants) never apply to it. `utils/registry-identity.ts` owns the
+ * registry side of this contract and re-exports the key.
+ */
+export const RESERVED_REGISTRY_CONTEXT = "registry";
+/** Printed once when `--no-registry` is passed: the flag no longer changes anything. */
+export const NO_REGISTRY_DEPRECATED = "--no-registry is deprecated and ignored: mesh login no longer touches the registry.";
+/** Printed after a platform login on a machine with no package-registry access. */
+export const REGISTRY_SEPARATE_HINT = "Package registry access is separate from platform sign-in — run: mesh registry login";
+/**
+ * The reserved `registry` credential key is not a platform. `mesh login
+ * registry` would try to discover a platform named "registry" and cache a
+ * platform session on top of the package registry's; refuse it and name the
+ * command that owns that key.
+ */
+function refuseReservedRegistryContext(context, verb) {
+    if (context !== RESERVED_REGISTRY_CONTEXT)
+        return;
+    throw new MeshCliError(`"registry" is the package registry's own session, not a platform context.`, { remediation: { command: `mesh registry ${verb}` } });
+}
+/**
+ * After a successful platform login: one line pointing at `mesh registry
+ * login` when the machine has neither a registry session nor a working
+ * `~/.npmrc` token. Silent when either exists, and silent when the registry
+ * cannot be reached (a network fault is not a missing grant).
+ */
+async function hintRegistryIfMissing() {
+    try {
+        const { readRegistrySession } = await import("../utils/registry-identity.js");
+        if (readRegistrySession())
+            return;
+        const { probeRegistryToken } = await import("../utils/auth-preflight.js");
+        const probe = await probeRegistryToken();
+        if (probe.state === "missing" || probe.state === "expired") {
+            logInfo(REGISTRY_SEPARATE_HINT);
+        }
+    }
+    catch {
+        // A hint must never fail a login that already succeeded.
+    }
+}
+/**
+ * The "no configuration found" explanation for a context that neither SSM,
+ * the pinned first-party table, nor the well-known endpoint could resolve —
+ * every path tried, then the `config.json` snippet to add by hand.
+ *
+ * Shared by the `login` command and the `mesh init` wizard's platform step so
+ * a discovery failure reads the same wherever it happens.
+ *
+ * @example
+ * logError(renderNoConfigHelp("acme.dev"));
+ */
+export function renderNoConfigHelp(context) {
+    const pinned = firstPartyDomainFor(context);
+    return (`No configuration found for "${context}".\n\n` +
+        `Tried:\n` +
+        `  1. SSM: /mesh-platform/${context.split(".")[0]}/${context.split(".")[1]}/platform/zitadel\n` +
+        `     (requires AWS SSO login + read access)\n` +
+        (pinned
+            ? `  2. HTTPS: https://cli.${pinned}/.well-known/mesh.json  (pinned first-party domain)\n\n`
+            : `  2. HTTPS: https://cli.${context}/.well-known/mesh.json\n` +
+                `     (only attempted for a full domain, or a known first-party context)\n\n`) +
+        `To fix:\n` +
+        `  - Use the platform's full domain: mesh login <env>.<tenant>.meshtech.io\n` +
+        `  - Or, if you have AWS access, ensure SSO is active: aws sso login --profile <profile>\n` +
+        `  - Or add config manually to ${CONFIG_FILE}:\n\n` +
+        `    {\n` +
+        `      "${context}": {\n` +
+        `        "issuer": "https://identity.<env>.<your-platform-domain>",\n` +
+        `        "clientId": "<cli-oidc-client-id>"\n` +
+        `      }\n` +
+        `    }\n`);
+}
 // =============================================================================
 // Exports (for use by other mesh commands)
 // =============================================================================
@@ -1017,20 +1103,35 @@ export function resolveRoleOrExplain(opts, config) {
  * Ensure a valid Zitadel ID token is cached for the given context — refreshing
  * or running the full login flow as needed. Returns null on failure.
  */
+/**
+ * Run the sign-in itself — browser PKCE, or the device-code flow when asked
+ * for or when there is no browser to open (`isRemoteEnvironment`) — and cache
+ * the resulting session under `context`. Rejects when the user denies, the
+ * flow times out, or the issuer refuses.
+ *
+ * The one sign-in routine every caller shares: the `login` command, on-demand
+ * login from other commands, and the package registry's own session.
+ *
+ * @example
+ * await runLoginFlow("acme.dev", config, { device: false });
+ */
+export async function runLoginFlow(context, config, opts = {}) {
+    const useDevice = opts.device || isRemoteEnvironment();
+    if (useDevice) {
+        logInfo("Using device code flow");
+        await deviceCodeLogin(context, config);
+    }
+    else {
+        await login(context, config);
+    }
+}
 async function ensureValidToken(context, config, opts) {
     let token = await getValidToken(context);
     if (token)
         return token;
     logInfo(`No valid Zitadel session for ${context} — running login flow`);
     try {
-        const useDevice = opts.device || isRemoteEnvironment();
-        if (useDevice) {
-            logInfo("Using device code flow");
-            await deviceCodeLogin(context, config);
-        }
-        else {
-            await login(context, config);
-        }
+        await runLoginFlow(context, config, opts);
     }
     catch (err) {
         logError(`Login failed: ${err.message}`);
@@ -1268,5 +1369,5 @@ export function readAllContextConfigs() {
 export async function discoverConfigForContext(context) {
     return getContextConfig(context) ?? (await discoverConfigGuarded(context));
 }
-export { readCredentials, readAllCredentials, getContextConfig, decodeJwtPayload, getValidToken };
+export { readCredentials, readAllCredentials, getContextConfig, decodeJwtPayload, getValidToken, clearCredentials };
 //# sourceMappingURL=login.js.map