@mesh-tech/mesh-cli 0.20.1 → 0.20.3

package/dist/src/commands/login.js

@@ -1,29 +1,3 @@
-/**
- * mesh login — Authenticate with Zitadel via OIDC PKCE or Device Code flow.
- *
- * Opens browser to Zitadel (PKCE) or prints a code to enter in the browser
- * (Device Code). Exchanges for tokens and caches at ~/.config/mesh/credentials.json.
- *
- * Config is read from ~/.config/mesh/config.json, keyed by context
- * (e.g., "mesh.dev"). After deploying the platform, copy the CLI client ID
- * from the Pulumi stack output into the config file.
- *
- * In containers/SSH sessions, device code flow is used automatically.
- *
- * `mesh login` is for a DEPLOYED platform only — the tenant platform you
- * deploy to, reach the Hub of, or tunnel into. Package-registry access is a
- * separate, global identity owned by `mesh registry login`; a platform login
- * never writes ~/.npmrc, and the reserved `registry` credential key is refused
- * here so the two can never be confused.
- *
- * Usage:
- *   mesh login acme.dev            — authenticate to the acme dev platform
- *   mesh login acme.dev --device   — force device code flow
- *   mesh login acme.dev --status   — show current auth state (Zitadel session if
- *                                    there is one, otherwise whatever the AWS
- *                                    credential chain resolves — SSO or key pair)
- *   mesh logout acme.dev           — clear cached credentials
- */
 import * as http from "http";
 import * as crypto from "crypto";
 import * as fs from "fs";
@@ -34,9 +8,6 @@ import { MeshCliError } from "../utils/errors.js";
 import { assumeRoleCredentials, assumeRoleWithWebIdentity, describeAssumeFailure, probeAwsIdentity, renderCredentialProcessProfile, tokenIssuer, resolveStableMeshBin, selectRoleForCaller, toCredentialProcessJson, upsertManagedAwsConfigSection, } from "../utils/aws-auth.js";
 import { firstPartyDomainFor } from "../utils/first-party-contexts.js";
 import { tailscaleBackendState } from "./vpn/index.js";
-// =============================================================================
-// Paths (XDG Base Directory Specification)
-// =============================================================================
 const CONFIG_DIR = path.join(process.env.XDG_CONFIG_HOME ?? path.join(process.env.HOME ?? "~", ".config"), "mesh");
 const CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
 const CREDENTIALS_FILE = path.join(CONFIG_DIR, "credentials.json");
@@ -59,12 +30,6 @@ export function writeContextConfig(context, config) {
     fs.mkdirSync(CONFIG_DIR, { recursive: true });
     fs.writeFileSync(CONFIG_FILE, JSON.stringify(existing, null, 2));
 }
-/**
- * Forget a cached context config so the next use runs discovery again.
- *
- * @example
- * clearContextConfig("registry"); // `mesh registry logout` — re-discovers the registry next time
- */
 export function clearContextConfig(context) {
     const existing = readConfig();
     if (!(context in existing))
@@ -77,26 +42,12 @@ function getContextConfig(context) {
     const config = readConfig();
     return config[context] ?? null;
 }
-/**
- * Parse a mesh context like "mesh.dev" or "acme.uat" into tenant + env.
- * Returns null if the context doesn't match the expected {tenant}.{env} pattern.
- */
 function parseTenantEnv(context) {
     const parts = context.split(".");
     if (parts.length !== 2 || !parts[0] || !parts[1])
         return null;
     return { tenant: parts[0], env: parts[1] };
 }
-/**
- * Attempt auto-discovery of platform config from SSM Parameter Store.
- *
- * Uses ambient AWS credentials to read the zitadel config export at
- * /mesh-platform/{tenant}/{env}/platform/zitadel. This is the preferred
- * discovery path for users who already have AWS SSO access to the platform.
- *
- * Returns null if AWS credentials are unavailable, SSM read fails, or the
- * parameter doesn't contain the required fields.
- */
 async function discoverConfigFromSsm(context) {
     const parsed = parseTenantEnv(context);
     if (!parsed)
@@ -142,9 +93,6 @@ async function discoverConfigFromSsm(context) {
         const message = err instanceof Error ? err.message : String(err);
         if (message.includes("ExpiredToken") || message.includes("credentials")) {
             logWarn(`SSM discovery failed: AWS credentials expired or unavailable.`);
-            // Do NOT send someone to `aws sso login` when an anonymous path is about
-            // to be tried — on the install journey that is the exact misdirection
-            // this feature removes. Only mention AWS when nothing else can resolve.
             if (firstPartyDomainFor(context) || context.split(".").length - 1 >= 2) {
                 logInfo(`  Falling back to anonymous HTTPS discovery — no AWS needed.`);
             }
@@ -163,15 +111,6 @@ async function discoverConfigFromSsm(context) {
         return null;
     }
 }
-/**
- * Attempt auto-discovery of platform config from a well-known endpoint.
- * Returns null if discovery fails for any reason (network, timeout, bad data).
- *
- * `contextKey` is the name the resulting config is CACHED under, which is not
- * always the domain probed: a pinned first-party alias (`mesh.dev`) probes
- * `dev.platform.meshtech.io` but must be cached under `mesh.dev`, or the very
- * next command re-runs discovery and the alias buys nothing.
- */
 async function discoverConfig(domain, contextKey = domain, opts = {}) {
     const url = `https://cli.${domain}/.well-known/mesh.json`;
     if (!opts.quiet)
@@ -216,18 +155,6 @@ async function discoverConfig(domain, contextKey = domain, opts = {}) {
         return null;
     }
 }
-/**
- * Anonymous discovery against `https://cli.<domain>/.well-known/mesh.json`.
- *
- * `quiet: true` returns the payload WITHOUT caching it under `contextKey` and
- * without the progress lines — for a caller that stores the record itself
- * under a name that is not a platform context (the package registry's
- * reserved key). Warnings still print, because a failed discovery is the
- * caller's problem either way.
- *
- * @example
- * const cfg = await discoverConfigFromWellKnown("dev.platform.meshtech.io", "registry", { quiet: true });
- */
 export function discoverConfigFromWellKnown(domain, contextKey = domain, opts = {}) {
     return discoverConfig(domain, contextKey, opts);
 }
@@ -244,22 +171,7 @@ function readAllCredentials() {
 function readCredentials(context) {
     return readAllCredentials()[context] ?? null;
 }
-/** Monotonic counter mixed into temp-file names alongside the pid, so two
- * writes from the same process in the same tick (e.g. rapid retries) never
- * collide on a temp path. */
 let atomicWriteCounter = 0;
-/**
- * Write `data` to `path` atomically: write to a temp file in the SAME
- * directory as `path` (so the subsequent rename is same-filesystem, hence
- * atomic), then `fs.renameSync` it into place. This guarantees concurrent
- * readers (e.g. other `credential_process` invocations racing a refresh)
- * only ever observe a fully-written file — never a truncated one from an
- * interleaved `fs.writeFileSync`.
- *
- * On any error, best-effort removes the temp file before rethrowing.
- *
- * Exported for unit testing.
- */
 export function atomicWriteFileSync(path, data, mode) {
     const tmpPath = `${path}.${process.pid}.${atomicWriteCounter++}.tmp`;
     try {
@@ -271,7 +183,6 @@ export function atomicWriteFileSync(path, data, mode) {
             fs.unlinkSync(tmpPath);
         }
         catch {
-            // best-effort cleanup — ignore (e.g. write itself never created the file)
         }
         throw err;
     }
@@ -340,9 +251,6 @@ async function refreshTokens(issuer, clientId, refreshToken) {
     }
     return resp.json();
 }
-// =============================================================================
-// Login Flow
-// =============================================================================
 function login(context, config) {
     return new Promise((resolve, reject) => {
         const codeVerifier = generateCodeVerifier();
@@ -356,10 +264,6 @@ function login(context, config) {
         authUrl.searchParams.set("code_challenge", codeChallenge);
         authUrl.searchParams.set("code_challenge_method", "S256");
         authUrl.searchParams.set("state", state);
-        // Tracked teardown — without this `mesh login` hangs after success
-        // because (a) the 2-minute timeout below kept the event loop alive,
-        // and (b) the browser's keep-alive socket survived `server.close()`
-        // (which only stops new connections, not active ones).
         let timeoutId;
         const server = http.createServer(async (req, res) => {
             try {
@@ -395,15 +299,12 @@ function login(context, config) {
                     reject(new Error("No authorization code received"));
                     return;
                 }
-                // Exchange code for tokens
                 const tokens = await exchangeCode(config.issuer, config.clientId, code, codeVerifier);
                 const idPayload = decodeJwtPayload(tokens.id_token);
                 const email = idPayload.email ??
                     idPayload.preferred_username ??
                     "unknown";
                 const sub = idPayload.sub;
-                // Parse tenants from access token
-                // (the Zitadel Action enriches the access token with urn:mesh:tenants)
                 let tenants = [];
                 try {
                     const accessPayload = decodeJwtPayload(tokens.access_token);
@@ -411,9 +312,7 @@ function login(context, config) {
                         accessPayload["urn:mesh:tenants"] ?? [];
                 }
                 catch {
-                    // Access token may be opaque (non-JWT) in some configs
                 }
-                // Cache credentials
                 writeCredentials(context, {
                     idToken: tokens.id_token,
                     accessToken: tokens.access_token,
@@ -437,8 +336,6 @@ function login(context, config) {
                 reject(err);
             }
         });
-        // Defined after `server` so the closure captures it; covers
-        // success, error, and timeout paths.
         const teardown = () => {
             if (timeoutId)
                 clearTimeout(timeoutId);
@@ -463,27 +360,13 @@ function login(context, config) {
                 logInfo(`Open this URL in your browser:\n${url}`);
             }
         });
-        // Timeout after 2 minutes. We keep a handle so success / error
-        // paths can clear it via `teardown()` — otherwise the timer keeps
-        // the Node event loop alive for 2 minutes after a successful
-        // login and the CLI appears to hang.
         timeoutId = setTimeout(() => {
             teardown();
             reject(new Error("Login timed out (2 minutes)"));
         }, 120_000);
     });
 }
-/** Number of fresh device codes to issue before giving up. A code's TTL is
- *  short (a couple of minutes), so if the user is slow we quietly issue another
- *  rather than failing the whole login (we hit this repeatedly in practice). */
 const MAX_DEVICE_CODES = 3;
-/**
- * Run device-code login, re-issuing a fresh code (up to `maxCodes`) if the user
- * doesn't finish before a code expires. `attempt` performs ONE code's
- * request+poll and resolves `"success"` or `"expired"`; it rejects only on a
- * hard error (denied / network). Extracted + injectable so the reissue loop is
- * unit-testable without real network calls.
- */
 export async function deviceLoginWithReissue(attempt, maxCodes = MAX_DEVICE_CODES) {
     for (let n = 1; n <= maxCodes; n++) {
         if (n > 1)
@@ -497,7 +380,6 @@ async function deviceCodeLogin(context, config) {
     await deviceLoginWithReissue(() => attemptDeviceCode(context, config));
 }
 async function attemptDeviceCode(context, config) {
-    // Step 1: Request device authorization
     const resp = await fetch(`${config.issuer}/oauth/v2/device_authorization`, {
         method: "POST",
         headers: { "Content-Type": "application/x-www-form-urlencoded" },
@@ -512,14 +394,12 @@ async function attemptDeviceCode(context, config) {
     }
     const deviceAuth = await resp.json();
     const openUrl = deviceAuth.verification_uri_complete ?? deviceAuth.verification_uri;
-    // Step 2: Display instructions
     console.log();
     logInfo(`Open this URL in your browser:\n`);
     logInfo(`  ${openUrl}\n`);
     logInfo(`Code: ${deviceAuth.user_code}`);
     console.log();
     logInfo("Waiting for authorization...");
-    // Try to open browser (works on host, harmless failure in container)
     try {
         if (process.platform === "darwin") {
             execFileSync("open", [openUrl], { stdio: "ignore" });
@@ -528,8 +408,7 @@ async function attemptDeviceCode(context, config) {
             execFileSync("xdg-open", [openUrl], { stdio: "ignore" });
         }
     }
-    catch { /* ignore — user can open manually */ }
-    // Step 3: Poll for token
+    catch { }
     const deadline = Date.now() + deviceAuth.expires_in * 1000;
     let interval = deviceAuth.interval * 1000;
     while (Date.now() < deadline) {
@@ -553,7 +432,7 @@ async function attemptDeviceCode(context, config) {
                 const accessPayload = decodeJwtPayload(tokens.access_token);
                 tenants = accessPayload["urn:mesh:tenants"] ?? [];
             }
-            catch { /* opaque access token */ }
+            catch { }
             writeCredentials(context, {
                 idToken: tokens.id_token,
                 accessToken: tokens.access_token,
@@ -577,50 +456,27 @@ async function attemptDeviceCode(context, config) {
                 interval += 1000;
                 continue;
             case "expired_token":
-                return "expired"; // caller re-issues a fresh code
+                return "expired";
             case "access_denied":
                 throw new Error("Authorization denied by user.");
             default:
                 throw new Error(`Token exchange failed: ${error.error} — ${error.error_description ?? ""}`);
         }
     }
-    return "expired"; // deadline reached without authorization — re-issue
+    return "expired";
 }
-/**
- * Detect an environment where the PKCE browser-callback flow won't work — a
- * container, a remote/SSH session, or any non-interactive shell (piped output,
- * headless, agent/CI-run). In all of these the callback flow has no browser to
- * open and no interactive terminal, so it can only hang until the 2-minute
- * timeout. Device-code flow (print a URL + code to complete elsewhere) is the
- * correct fallback, so callers use it whenever this returns true.
- *
- * Exported for tests.
- */
 export function isRemoteEnvironment() {
-    // Docker / devcontainer
     if (process.env.REMOTE_CONTAINERS || process.env.CODESPACES)
         return true;
     if (fs.existsSync("/.dockerenv"))
         return true;
-    // SSH session
     if (process.env.SSH_CLIENT || process.env.SSH_TTY)
         return true;
-    // No interactive terminal on stdin/stdout — `isTTY` is `undefined` (falsy)
-    // when the stream is not a TTY. This is the case that bit us: an agent- or
-    // script-driven shell over Tailscale has none of the env vars above set, so
-    // the old check fell through to the browser flow and timed out. Device flow
-    // still works when a browser IS available (just copy the URL+code), so
-    // preferring it here is strictly safer than a guaranteed timeout.
     if (!process.stdout.isTTY || !process.stdin.isTTY)
         return true;
     return false;
 }
-/**
- * After a successful login, hint about VPN if Tailscale is not connected.
- * Non-blocking — never fails or delays the login flow.
- */
 function hintVpnIfDisconnected(context) {
-    // The package registry is not a platform: no VPN sits behind it.
     if (context === RESERVED_REGISTRY_CONTEXT)
         return;
     try {
@@ -632,28 +488,11 @@ function hintVpnIfDisconnected(context) {
         }
     }
     catch {
-        // Tailscale not installed or not queryable — skip hint
     }
 }
-/**
- * The account id embedded in an IAM role ARN
- * (`arn:aws:iam::123456789012:role/...`), or undefined when there is no ARN
- * to read one from.
- */
 export function accountIdFromRoleArn(roleArn) {
     return roleArn?.match(/^arn:aws:iam::(\d{12}):/)?.[1];
 }
-/**
- * Decide everything `--status` says (and its exit code) when there is no
- * usable Zitadel session — pure so the wording and the exit decision are
- * pinned by tests.
- *
- * The probe only proves "some AWS identity works on this machine"; it says
- * nothing about whether that identity belongs to `context`. So the claim is
- * scoped to the credentials — unless the context config carries a role ARN,
- * whose account id makes the context check free: verify when we can, say so
- * when we can't.
- */
 export function renderAwsFallbackStatus(context, reason, identity, expectedAccountId) {
     if (!identity) {
         return {
@@ -759,14 +598,12 @@ async function showStatus(context, config) {
         await showAwsCredentialStatus(context, `Zitadel token expired at ${creds.expiresAt}`, config);
         return;
     }
-    // Parse tenants from access token
     let tenants = [];
     try {
         const accessPayload = decodeJwtPayload(creds.accessToken);
         tenants = accessPayload["urn:mesh:tenants"] ?? [];
     }
     catch {
-        // Access token may be opaque
     }
     logSuccess(`Logged in as ${creds.email ?? "unknown"} (${context})`);
     logInfo(`Subject: ${creds.sub}`);
@@ -775,9 +612,6 @@ async function showStatus(context, config) {
         logInfo(`Deployable tenants: ${tenants.join(", ")}`);
     }
 }
-// =============================================================================
-// Commands
-// =============================================================================
 export function registerLoginCommand(program) {
     program
         .command("login")
@@ -795,10 +629,6 @@ export function registerLoginCommand(program) {
         refuseReservedRegistryContext(context, "login");
         let config = getContextConfig(context);
         if (!config) {
-            // One chain, shared with `ensureLogin` — see discoverConfigGuarded.
-            // Deliberately NOT re-implemented here: this call site and that one
-            // drifted apart once already, and the difference was whether a clean
-            // laptop could resolve a short context at all.
             config = await discoverConfigGuarded(context);
             if (!config) {
                 logError(renderNoConfigHelp(context));
@@ -827,9 +657,6 @@ export function registerLoginCommand(program) {
             logError(`Login failed: ${err.message}`);
             process.exit(1);
         }
-        // Platform sign-in and package-registry access are two identities. A
-        // platform login never writes ~/.npmrc; it only points at the command
-        // that does, and only when this machine has no registry access yet.
         await hintRegistryIfMissing();
     });
     program
@@ -842,34 +669,14 @@ export function registerLoginCommand(program) {
         logSuccess(`Logged out of ${context}. Credentials cleared.`);
     });
 }
-/**
- * The credential key the package registry's own session lives under. Not a
- * platform: `mesh login` / `mesh logout` refuse it, and the post-login hints
- * (VPN, tenants) never apply to it. `utils/registry-identity.ts` owns the
- * registry side of this contract and re-exports the key.
- */
 export const RESERVED_REGISTRY_CONTEXT = "registry";
-/** Printed once when `--no-registry` is passed: the flag no longer changes anything. */
 export const NO_REGISTRY_DEPRECATED = "--no-registry is deprecated and ignored: mesh login no longer touches the registry.";
-/** Printed after a platform login on a machine with no package-registry access. */
 export const REGISTRY_SEPARATE_HINT = "Package registry access is separate from platform sign-in — run: mesh registry login";
-/**
- * The reserved `registry` credential key is not a platform. `mesh login
- * registry` would try to discover a platform named "registry" and cache a
- * platform session on top of the package registry's; refuse it and name the
- * command that owns that key.
- */
 function refuseReservedRegistryContext(context, verb) {
     if (context !== RESERVED_REGISTRY_CONTEXT)
         return;
     throw new MeshCliError(`"registry" is the package registry's own session, not a platform context.`, { remediation: { command: `mesh registry ${verb}` } });
 }
-/**
- * After a successful platform login: one line pointing at `mesh registry
- * login` when the machine has neither a registry session nor a working
- * `~/.npmrc` token. Silent when either exists, and silent when the registry
- * cannot be reached (a network fault is not a missing grant).
- */
 async function hintRegistryIfMissing() {
     try {
         const { readRegistrySession } = await import("../utils/registry-identity.js");
@@ -882,20 +689,8 @@ async function hintRegistryIfMissing() {
         }
     }
     catch {
-        // A hint must never fail a login that already succeeded.
     }
 }
-/**
- * The "no configuration found" explanation for a context that neither SSM,
- * the pinned first-party table, nor the well-known endpoint could resolve —
- * every path tried, then the `config.json` snippet to add by hand.
- *
- * Shared by the `login` command and the `mesh init` wizard's platform step so
- * a discovery failure reads the same wherever it happens.
- *
- * @example
- * logError(renderNoConfigHelp("acme.dev"));
- */
 export function renderNoConfigHelp(context) {
     const pinned = firstPartyDomainFor(context);
     return (`No configuration found for "${context}".\n\n` +
@@ -917,22 +712,6 @@ export function renderNoConfigHelp(context) {
         `      }\n` +
         `    }\n`);
 }
-// =============================================================================
-// Exports (for use by other mesh commands)
-// =============================================================================
-/**
- * Get a valid access token for the given context, refreshing if needed.
- *
- * Returns the id token (a JWT with `sub` claim) suitable for
- * Authorization: Bearer headers. Returns null if no credentials are
- * cached or refresh fails.
- */
-/**
- * True while a cached token is still valid, treating anything within `marginMs`
- * of expiry as already stale. The margin lets pollers (e.g. the dev-user
- * token-server) re-mint BEFORE expiry instead of handing out a token that dies
- * before the caller's next poll.
- */
 export function tokenStillValid(expiresAt, marginMs = 0, now = Date.now()) {
     return new Date(expiresAt).getTime() - marginMs > now;
 }
@@ -948,16 +727,6 @@ async function getValidToken(context, opts = {}) {
     }
     return remintToken(context, config, creds);
 }
-/**
- * Trade the session's refresh token for a new token set and cache it. Null
- * when the session holds no refresh token or the issuer refuses the exchange.
- *
- * A token the issuer hands over is returned even when it cannot be written to
- * disk, with a warning: the exchange spends the refresh token — Zitadel
- * rotates it in the same response — so treating an uncacheable token set as no
- * token at all discards a session that is still usable for this run and is
- * already gone from the issuer's side.
- */
 async function remintToken(context, config, creds) {
     if (!creds.refreshToken)
         return null;
@@ -973,7 +742,6 @@ async function remintToken(context, config, creds) {
         email = decodeJwtPayload(tokens.id_token).email ?? creds.email;
     }
     catch {
-        // An id token this CLI cannot read still authenticates; keep the known email.
     }
     try {
         writeCredentials(context, {
@@ -991,17 +759,6 @@ async function remintToken(context, config, creds) {
     }
     return tokens.id_token;
 }
-/**
- * Re-mint a context's session now, whether or not its token has expired.
- * Zitadel writes project roles into a token when it issues it, so a role
- * granted after the sign-in stays invisible until a new token is minted —
- * this is how a caller picks the grant up without a second browser trip.
- * Null when there is no session, no refresh token, or the issuer refuses.
- *
- * @example
- * const idToken = await forceRefreshToken("registry");
- * if (idToken) console.log("session re-minted");
- */
 export async function forceRefreshToken(context) {
     const config = getContextConfig(context);
     if (!config)
@@ -1011,19 +768,6 @@ export async function forceRefreshToken(context) {
         return null;
     return remintToken(context, config, creds);
 }
-/**
- * Probe deployer creds for `context`/`roleArn`. Order matters:
- *   1. No cached Zitadel session → `no-session`.
- *   2. Cached session AND ambient `AWS_*` env keys present → `stale-env-override`
- *      (the frozen triple would override the self-refreshing profile at
- *      runtime — the exact `mesh dev` trap). Guarded on a cached session so
- *      legitimate CI env-key credentials, which have no `mesh login` session,
- *      are not misreported.
- *   3. Session can't be refreshed → `expired-session`.
- *   4. AssumeRoleWithWebIdentity fails → `assume-denied` (valid identity, wrong
- *      IAM/role/policy).
- *   5. Otherwise → `ok` with the STS TTL.
- */
 export async function probeCredentials(context, roleArn) {
     const cached = readCredentials(context);
     if (!cached)
@@ -1047,56 +791,23 @@ export async function probeCredentials(context, roleArn) {
     const ttlSeconds = Math.max(0, Math.round((Date.parse(sts.Expiration) - Date.now()) / 1000));
     return { state: "ok", ttlSeconds, expiresAt: sts.Expiration, email: cached.email };
 }
-// =============================================================================
-// AWS credential export (--export flag)
-// =============================================================================
-/**
- * Single-quote a value for shell-safe inclusion in an `export` statement.
- * Single-quoted strings in POSIX shells don't expand `$` or other metachars;
- * embedded single-quotes are escaped via the `'\''` trick.
- */
 function shellSingleQuote(value) {
     return `'${value.replace(/'/g, "'\\''")}'`;
 }
-/**
- * Render the `--static` output: raw temporary AWS credentials as shell
- * `export` statements (the old frozen ~1h triple). Pure — no I/O. Includes a
- * trailing newline. Exported for unit testing.
- */
 export function renderExportStaticLines(args) {
     return (`export AWS_ACCESS_KEY_ID=${shellSingleQuote(args.accessKey)}\n` +
         `export AWS_SECRET_ACCESS_KEY=${shellSingleQuote(args.secretKey)}\n` +
         `export AWS_SESSION_TOKEN=${shellSingleQuote(args.sessionToken)}\n` +
         `export AWS_REGION=${shellSingleQuote(args.region)}\n`);
 }
-/**
- * Render the default `--export` output: point the shell at a self-refreshing
- * `credential_process` profile. The leading `unset` clears any stale STS
- * triple already in the shell so it can't shadow the profile. Pure — no I/O.
- * Includes a trailing newline. Exported for unit testing.
- *
- * Deliberately does NOT export `AWS_CONFIG_FILE`: the profile lives in the
- * user's REAL AWS config file (managed marker section — see
- * `upsertManagedAwsConfigSection`), so their other profiles (e.g.
- * `AWS_PROFILE=mesh-dev` InfraAdmin) keep working in the same shell.
- * Redirecting AWS_CONFIG_FILE to a mesh-private file used to clobber
- * ~/.aws/config for every subsequent AWS command.
- */
 export function renderExportProfileLines(args) {
     return (`unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN\n` +
         `export AWS_PROFILE=${shellSingleQuote(args.profileName)}\n` +
         `export AWS_REGION=${shellSingleQuote(args.region)}\n`);
 }
-/**
- * The AWS config file the managed profile section is written into: the
- * user's `$AWS_CONFIG_FILE` when THEY have set one, else `~/.aws/config` —
- * the same file `aws configure sso` manages. Exported for unit testing.
- */
 export function resolveUserAwsConfigPath(env = process.env) {
     return env.AWS_CONFIG_FILE ?? path.join(env.HOME ?? "~", ".aws", "config");
 }
-/** True if `dir` can be created (if needed) and written. Used to detect an
- * unwritable `~/.aws` (e.g. a sandbox with no `~/.aws` grant) without throwing. */
 function canWriteDir(dir) {
     try {
         fs.mkdirSync(dir, { recursive: true });
@@ -1107,16 +818,6 @@ function canWriteDir(dir) {
         return false;
     }
 }
-/**
- * Where to write the managed AWS profile, with a safehouse fallback. Normally
- * the user's real `~/.aws/config` (augmented in place, so their other tools see
- * the profile — hence `redirected: false`, we don't touch their `AWS_CONFIG_FILE`).
- * But when `~/.aws` is not writable (a sandbox without a `~/.aws` grant), fall
- * back to a mesh-managed file under `~/.config/mesh` we CAN write, and set
- * `redirected: true` so the caller also exports `AWS_CONFIG_FILE` (otherwise the
- * AWS SDK, looking only at `~/.aws/config`, would never find the profile). An
- * explicit `AWS_CONFIG_FILE` always wins and is never redirected.
- */
 export function resolveAwsConfigTarget(env = process.env) {
     if (env.AWS_CONFIG_FILE)
         return { configPath: env.AWS_CONFIG_FILE, redirected: false };
@@ -1125,15 +826,6 @@ export function resolveAwsConfigTarget(env = process.env) {
         return { configPath: real, redirected: false };
     return { configPath: path.join(CONFIG_DIR, "aws-config"), redirected: true };
 }
-/**
- * Resolve which IAM role ARN to use, honoring the same precedence in both
- * `--export` and `--credential-process`: explicit `--role` wins, then
- * `MESH_AWS_ROLE`, then the context's cached `defaultRole`. Pure aside from
- * reading `process.env.MESH_AWS_ROLE` — returns an explanatory error instead
- * of throwing so callers can route it to stderr and exit non-zero.
- *
- * Exported for unit testing.
- */
 export function resolveRoleOrExplain(opts, config) {
     const role = opts.role ?? process.env.MESH_AWS_ROLE ?? config.defaultRole;
     if (!role) {
@@ -1144,22 +836,6 @@ export function resolveRoleOrExplain(opts, config) {
     }
     return { role };
 }
-/**
- * Ensure a valid Zitadel ID token is cached for the given context — refreshing
- * or running the full login flow as needed. Returns null on failure.
- */
-/**
- * Run the sign-in itself — browser PKCE, or the device-code flow when asked
- * for or when there is no browser to open (`isRemoteEnvironment`) — and cache
- * the resulting session under `context`. Rejects when the user denies, the
- * flow times out, or the issuer refuses.
- *
- * The one sign-in routine every caller shares: the `login` command, on-demand
- * login from other commands, and the package registry's own session.
- *
- * @example
- * await runLoginFlow("acme.dev", config, { device: false });
- */
 export async function runLoginFlow(context, config, opts = {}) {
     const useDevice = opts.device || isRemoteEnvironment();
     if (useDevice) {
@@ -1184,28 +860,12 @@ async function ensureValidToken(context, config, opts) {
     }
     return await getValidToken(context);
 }
-/**
- * Ensure a valid login session for `context`, running the login flow (device
- * code in remote/non-TTY, browser callback otherwise) if none is cached. Returns
- * the cached credentials, or null if no config is available to log in with.
- *
- * For use by other commands (e.g. `secrets set`, the AWS-cred resolver) so they
- * can trigger login on demand instead of just failing with guidance.
- */
 export async function ensureLogin(context, opts = {}) {
     const existing = readCredentials(context);
     if (existing && new Date(existing.expiresAt) > new Date())
         return existing;
-    // interactive: false → cached-session-or-nothing. Callers with their own
-    // fallback chain (e.g. the AWS-cred resolver's SSO path) use this so an
-    // expired cache doesn't stall headless runs in a device-code poll.
     if (opts.interactive === false)
         return null;
-    // Same guarded discovery chain as the `login` command: SSM first, and the
-    // well-known HTTPS endpoint only for domain-looking contexts (≥2 dots).
-    // Hitting `https://cli.<short-name>/.well-known/mesh.json` for an uncached
-    // context like "mesh.dev" would let whoever registers that domain seed our
-    // cached issuer/clientId (login phishing).
     const config = getContextConfig(context) ?? (await discoverConfigGuarded(context));
     if (!config) {
         logWarn(`No login config for "${context}". Run: mesh login ${context}`);
@@ -1216,23 +876,6 @@ export async function ensureLogin(context, opts = {}) {
         return null;
     return readCredentials(context);
 }
-/**
- * The one discovery chain, used by both the `login` command and `ensureLogin`:
- *
- *   1. SSM, when the context parses as `{tenant}.{env}` — the primary path for
- *      internal users who already have AWS SSO access.
- *   2. The anonymous HTTPS well-known endpoint at the PINNED domain for a known
- *      first-party short context (`mesh.dev` → `dev.platform.meshtech.io`). This
- *      is what makes `mesh login mesh.dev` work on a laptop with no AWS at all
- *      — the P0 case. The domain comes from a compiled-in table, never from the
- *      context string, so it is not a phishing surface.
- *   3. The anonymous HTTPS endpoint at the context itself, only when it looks
- *      like a real domain (≥2 dots).
- *
- * Never hits `https://cli.<short-name>/…` for an UNKNOWN short context — that
- * guard is the anti-phishing property and step 2 is deliberately a pinned
- * allow-list rather than a relaxation of it.
- */
 async function discoverConfigGuarded(context) {
     let config = null;
     if (parseTenantEnv(context)) {
@@ -1250,21 +893,11 @@ async function discoverConfigGuarded(context) {
     }
     return config;
 }
-/**
- * Resolve AWS credentials via Zitadel JWT → AssumeRoleWithWebIdentity, then
- * print them as `export` statements on stdout. All status/error output goes
- * to stderr so the caller can safely `eval "$(mesh login ... --export ...)"`.
- */
 async function exportAwsCredentials(context, config, opts) {
     const token = await ensureValidToken(context, config, opts);
     if (!token) {
         process.exit(1);
     }
-    // Pick a role for the caller. `resolveRoleOrExplain` handles the
-    // --role / MESH_AWS_ROLE / cached-defaultRole precedence (shared with
-    // --credential-process); on top of that, when we fell back to the cached
-    // default we ask `selectRoleForCaller` to upgrade to the context's
-    // `adminRole` when the Zitadel JWT carries an admin claim.
     const resolvedRole = resolveRoleOrExplain(opts, config);
     if ("error" in resolvedRole) {
         logError("--export requires --role <arn> (or MESH_AWS_ROLE env var, or a cached defaultRole).\n" +
@@ -1283,7 +916,6 @@ async function exportAwsCredentials(context, config, opts) {
     if (config.adminRole && roleArn === config.adminRole && !opts.role) {
         logInfo(`Caller has admin Zitadel role — assuming ${roleArn.split("/").pop()} (admin variant)`);
     }
-    // Persist --role so subsequent runs can omit it.
     if (opts.role && opts.role !== config.defaultRole) {
         writeContextConfig(context, { ...config, defaultRole: opts.role });
         logInfo(`Saved default role for ${context}`);
@@ -1293,8 +925,6 @@ async function exportAwsCredentials(context, config, opts) {
         process.env.AWS_DEFAULT_REGION ??
         "us-east-2";
     const roleName = roleArn.split("/").pop() ?? roleArn;
-    // --static: resolve a frozen STS triple now (the old behavior). Consumers
-    // that need raw credentials (no `mesh` binary on refresh) opt into this.
     if (opts.static) {
         const creds = readCredentials(context);
         const sessionName = (creds?.email ?? "mesh-cli-export")
@@ -1316,30 +946,13 @@ async function exportAwsCredentials(context, config, opts) {
         logSuccess(`Exported static AWS credentials for ${roleName} in ${region}`);
         return;
     }
-    // Default: manage a `[profile mesh-<context>]` block inside the user's REAL
-    // AWS config file ($AWS_CONFIG_FILE if they set one, else ~/.aws/config) as
-    // an idempotent marker-delimited section — the same file `aws configure sso`
-    // manages — and export only AWS_PROFILE. The profile's `credential_process`
-    // re-invokes `mesh login … --credential-process`, so `eval`-ed shells
-    // auto-refresh instead of dying ~1h in. We must NOT export AWS_CONFIG_FILE
-    // pointing at a mesh-private file: that hides ~/.aws/config from the whole
-    // shell and breaks the user's other profiles (e.g. AWS_PROFILE=mesh-dev).
     const meshBin = resolveStableMeshBin(process.argv[1]);
     const sanitized = context.replace(/[^A-Za-z0-9_-]/g, "-");
     const profileName = `mesh-${sanitized}`;
-    // Safehouse-friendly: falls back to a mesh-managed config when ~/.aws is not
-    // writable (and then `redirected` tells us to export AWS_CONFIG_FILE too).
     const { configPath, redirected } = resolveAwsConfigTarget();
     fs.mkdirSync(path.dirname(configPath), { recursive: true });
-    // Read → build → atomic-write back-to-back (all sync) so the lost-update
-    // window against concurrent writers (another `mesh login --export`, the
-    // user's own editor, `aws configure`) is as small as possible; the temp+
-    // rename write means concurrent READERS never observe a truncated file.
     const existedBefore = fs.existsSync(configPath);
     const existing = existedBefore ? fs.readFileSync(configPath, "utf-8") : "";
-    // Preserve the user's existing mode (rename replaces the inode, so the
-    // temp file's mode wins) — never chmod their config out from under them.
-    // Restrict to 0600 only when WE create the file.
     const mode = existedBefore ? fs.statSync(configPath).mode & 0o777 : 0o600;
     atomicWriteFileSync(configPath, upsertManagedAwsConfigSection(existing, context, renderCredentialProcessProfile({
         profileName,
@@ -1349,28 +962,12 @@ async function exportAwsCredentials(context, config, opts) {
         meshBin,
     })), mode);
     process.stdout.write(renderExportProfileLines({ profileName, region }));
-    // When we redirected away from an unwritable ~/.aws, the profile lives in a
-    // mesh-managed file — export AWS_CONFIG_FILE so the AWS SDK finds it.
     if (redirected) {
         process.stdout.write(`export AWS_CONFIG_FILE=${shellSingleQuote(configPath)}\n`);
     }
     logSuccess(`Exported self-refreshing AWS profile ${profileName} for ${roleName} in ${region} ` +
         `(managed section in ${configPath})`);
 }
-// =============================================================================
-// AWS credential_process (--credential-process flag)
-// =============================================================================
-/**
- * Resolve AWS credentials via Zitadel JWT → AssumeRoleWithWebIdentity, then
- * print them as AWS `credential_process` JSON on stdout — nothing else may
- * reach stdout in this mode, since the AWS SDK parses it directly. All
- * status/error output goes to stderr.
- *
- * Unlike `--export`, this does NOT run an interactive login flow when no
- * session is cached (there's no terminal/browser to drive it from a child
- * process) — it only refreshes an existing session via its refresh token
- * (`getValidToken`). Callers must `mesh login <context>` at least once.
- */
 async function credentialProcessAwsCredentials(context, config, opts) {
     const token = await getValidToken(context);
     if (!token) {
@@ -1398,21 +995,10 @@ async function credentialProcessAwsCredentials(context, config, opts) {
     process.stdout.write(toCredentialProcessJson(stsCreds) + "\n");
 }
 export { CONFIG_DIR, CONFIG_FILE, CREDENTIALS_FILE };
-/** Every cached context config, keyed by context name. */
 export function readAllContextConfigs() {
     return readConfig();
 }
-/**
- * The discovery chain on its own, without the browser flow that follows it.
- *
- * Exported so the clean-laptop bootstrap — SSM → pinned first-party alias →
- * full-domain, and the anti-phishing refusal for an unknown short context — can
- * be exercised end-to-end against the live well-known endpoint. The `login`
- * command's own path is otherwise only reachable by completing an interactive
- * sign-in, which is why this leg had no coverage above the unit tier.
- */
 export async function discoverConfigForContext(context) {
     return getContextConfig(context) ?? (await discoverConfigGuarded(context));
 }
 export { readCredentials, readAllCredentials, getContextConfig, decodeJwtPayload, getValidToken, clearCredentials };
-//# sourceMappingURL=login.js.map