@mesh-tech/mesh-cli 0.20.1 → 0.20.3

package/dist/src/commands/registry.js

@@ -1,35 +1,3 @@
-/**
- * mesh registry — Manage npm registry authentication for @mesh-tech packages.
- *
- * Handles CodeArtifact token refresh and project .npmrc setup so that
- * `pnpm install` can resolve @mesh-tech/* packages from the private registry.
- *
- * The registry is ONE global identity (`utils/registry-identity.ts`), so the
- * read path needs no platform context: `mesh registry login` resolves the
- * registry, signs in to its issuer if there is no cached session, asks the
- * Zitadel-gated `registry-auth` broker for a token, and writes `~/.npmrc` —
- * one command, one browser round-trip, no AWS anything on the machine.
- *
- * Credential resolution, in order:
- *   0. The registry-auth BROKER, authenticated with the registry session.
- *      This is the path a brand-new developer takes.
- *   1. Existing AWS credentials in environment (CI/CD) → use directly
- *   2. Zitadel JWT from `mesh login <context>` → AssumeRoleWithWebIdentity
- *   3. AWS SSO / current profile → use directly
- *
- * Paths 1–3 all shell out to the AWS CLI, so they require it to be installed
- * and credentialed. Path 0 requires only a Mesh account, which is the whole
- * point (design: registry-access-without-aws-sso).
- *
- * Usage:
- *   mesh registry login                 — broker first (signs in if needed), then the AWS paths
- *   mesh registry login --device        — same, device-code sign-in (headless / SSH)
- *   mesh registry login --ci            — CI mode: AWS chain only, skip .npmrc creation
- *   mesh registry login --no-broker     — skip the broker, force the AWS paths
- *   mesh registry login --profile p     — a deployer's AWS profile (skips the broker)
- *   mesh registry logout                — forget the registry session
- *   mesh registry status                — show current auth state
- */
 import { execFileSync } from "child_process";
 import * as fs from "fs";
 import * as path from "path";
@@ -40,22 +8,11 @@ import { fetchRegistryGrant, realGrantDeps, PUBLISHED_BROKER_TIMEOUT_MS, } from
 import { clearRegistrySession, describeSessionExpiry, ensureRegistrySession, identityChanged, logRegistryIdentity, readRegistrySession, refreshRegistrySession, resolveRegistryIdentity, } from "../utils/registry-identity.js";
 import { readCredentials } from "./login.js";
 import { registerRegistryPublish } from "./registry-publish.js";
-// =============================================================================
-// Constants — platform CodeArtifact registry
-// =============================================================================
 const CA_DOMAIN = "mesh-platform";
 const CA_REPOSITORY = "mesh-packages";
 const CA_NAMESPACE = "@mesh-tech";
 const CA_REGION = "us-east-2";
-// Default registry role — tenants get read access via their deployer role,
-// but a dedicated read-only role can be configured here.
 const DEFAULT_REGISTRY_ROLE = null;
-// =============================================================================
-// Helpers
-// =============================================================================
-/**
- * Get the CodeArtifact repository endpoint URL.
- */
 function getEndpoint(env) {
     try {
         const result = execFileSync("aws", [
@@ -77,9 +34,6 @@ function getEndpoint(env) {
         return null;
     }
 }
-/**
- * Run `aws codeartifact login` to set the auth token in ~/.npmrc.
- */
 export function codeartifactLogin(env) {
     try {
         execFileSync("aws", [
@@ -100,27 +54,12 @@ export function codeartifactLogin(env) {
         return false;
     }
 }
-/**
- * Parse a mesh context like "mesh.dev" into tenant + env.
- * Returns null if the context doesn't match the expected {tenant}.{env} pattern.
- *
- * (Mirrors login.ts's parseTenantEnv — kept local/minimal here to avoid
- * expanding login.ts's export surface for a single caller.)
- */
 function parseTenantEnv(context) {
     const parts = context.split(".");
     if (parts.length !== 2 || !parts[0] || !parts[1])
         return null;
     return { tenant: parts[0], env: parts[1] };
 }
-/**
- * Read the registry's SSM export (published by PackageRegistry, Task 2 of
- * MESH-2168) for a given tenant/env, e.g. /mesh-platform/mesh/dev/registry.
- *
- * Returns null on any failure (missing param, no AWS creds, malformed JSON) —
- * callers treat a null publisherRoleArn as "not configured" and surface an
- * actionable error via resolvePublisherRoleArn.
- */
 async function getRegistrySsmExport(tenant, env) {
     try {
         const { SSMClient, GetParameterCommand } = await import("@aws-sdk/client-ssm");
@@ -136,24 +75,13 @@ async function getRegistrySsmExport(tenant, env) {
         return null;
     }
 }
-/**
- * Resolve the publisher role ARN to assume for `--publish`.
- *
- * Precedence: explicit --role-arn flag wins, then the registry's SSM export
- * (publisherRoleArn, Task 2 of MESH-2168). Throws an actionable error if
- * neither is available — there's no safe default to fall back to since
- * publishing is an opt-in privileged path (DEFAULT_REGISTRY_ROLE stays null).
- */
 export function resolvePublisherRoleArn({ roleArnFlag, ssmArn, }) {
     const resolved = roleArnFlag || ssmArn;
     if (!resolved) {
-        throw new Error("No publisher role: pass --role or ensure the registry stack exported publisherRoleArn (MESH-2168).");
+        throw new Error("No publisher role: pass --role or ensure the registry stack exported publisherRoleArn.");
     }
     return resolved;
 }
-/**
- * Assume an IAM role, return credential env vars.
- */
 function assumeRole(roleArn) {
     try {
         const result = execFileSync("aws", [
@@ -173,9 +101,6 @@ function assumeRole(roleArn) {
         return null;
     }
 }
-/**
- * Assume role via Zitadel JWT (AssumeRoleWithWebIdentity).
- */
 function assumeRoleWithWebIdentity(roleArn, idToken, sessionName) {
     try {
         const result = execFileSync("aws", [
@@ -196,18 +121,11 @@ function assumeRoleWithWebIdentity(roleArn, idToken, sessionName) {
         return null;
     }
 }
-/**
- * Resolve AWS credentials for registry access.
- *
- * Returns env var overrides (or empty object if current env is fine).
- */
 export function resolveCredentials(context, roleArn) {
-    // Path 1: Existing AWS credentials in environment
     if (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SESSION_TOKEN) {
         logInfo("Using existing AWS credentials from environment");
         return {};
     }
-    // Path 2: Zitadel JWT → AssumeRoleWithWebIdentity
     if (context) {
         const meshCreds = readCredentials(context);
         if (meshCreds && new Date(meshCreds.expiresAt) > new Date()) {
@@ -235,7 +153,6 @@ export function resolveCredentials(context, roleArn) {
             logWarn(`No Zitadel credentials for ${context}. Run: mesh login ${context}`);
         }
     }
-    // Path 3: AssumeRole via current AWS session (if a role was specified)
     if (roleArn) {
         logInfo(`Assuming ${roleArn.split("/").pop()} via AWS SSO`);
         const creds = assumeRole(roleArn);
@@ -245,14 +162,9 @@ export function resolveCredentials(context, roleArn) {
         }
         logWarn("Role assumption failed — trying current credentials directly");
     }
-    // Path 4: Current AWS profile/credentials as-is
     logInfo("Using current AWS profile");
     return {};
 }
-/**
- * Find project root by looking for pnpm-workspace.yaml, package.json, or .git
- * walking up from cwd.
- */
 function findProjectRoot() {
     let dir = process.cwd();
     while (true) {
@@ -268,11 +180,6 @@ function findProjectRoot() {
         dir = parent;
     }
 }
-/**
- * Ensure project .npmrc has the @mesh-tech registry scope entry.
- * Creates the file if it doesn't exist. Doesn't touch auth tokens
- * (those live in ~/.npmrc via `aws codeartifact login`).
- */
 function ensureProjectNpmrc(endpoint) {
     const projectRoot = findProjectRoot() ?? process.cwd();
     const npmrcPath = path.join(projectRoot, ".npmrc");
@@ -282,40 +189,25 @@ function ensureProjectNpmrc(endpoint) {
         return { created: true, updated: false, path: npmrcPath };
     }
     const content = fs.readFileSync(npmrcPath, "utf-8");
-    // Check if scope already configured (with any endpoint)
     const scopeRegex = new RegExp(`^${CA_NAMESPACE.replace("/", "\\/")}:registry=.+$`, "m");
     if (scopeRegex.test(content)) {
-        // Check if it's the right endpoint
         if (content.includes(scopeLine)) {
             return { created: false, updated: false, path: npmrcPath };
         }
-        // Update existing line
         const updated = content.replace(scopeRegex, scopeLine);
         fs.writeFileSync(npmrcPath, updated, "utf-8");
         return { created: false, updated: true, path: npmrcPath };
     }
-    // Append scope line
     const separator = content.endsWith("\n") ? "" : "\n";
     fs.writeFileSync(npmrcPath, content + separator + scopeLine + "\n", "utf-8");
     return { created: false, updated: true, path: npmrcPath };
 }
-/**
- * Write a broker-issued grant into ~/.npmrc: the scoped registry line and the
- * endpoint's auth token, in exactly the shape `aws codeartifact login
- * --namespace @mesh-tech` would have written.
- *
- * Byte-compatibility with the AWS CLI's output is the requirement, not a nicety:
- * `mesh registry status`, the `mesh start` preflight and the dev doctor all
- * parse ~/.npmrc for that pair, and a machine that gets its token from the
- * broker has to look identical to one that got it from AWS.
- */
 export function applyGrantToUserNpmrc(grant, npmrcPath = homeNpmrcPath()) {
     let existing = "";
     try {
         existing = fs.readFileSync(npmrcPath, "utf-8");
     }
     catch {
-        // no ~/.npmrc yet — a clean laptop, which is the case this exists for
     }
     const content = upsertNpmrcLines(existing, [
         { key: `${grant.scope}:registry`, value: grant.endpoint },
@@ -323,32 +215,13 @@ export function applyGrantToUserNpmrc(grant, npmrcPath = homeNpmrcPath()) {
     ]);
     fs.mkdirSync(path.dirname(npmrcPath), { recursive: true });
     fs.writeFileSync(npmrcPath, content, { mode: 0o600 });
-    // `mode` only applies when writeFileSync CREATES the file, so an existing
-    // 0644 ~/.npmrc would keep world-readable permissions on a 12h bearer token.
-    // Parity with `aws codeartifact login` either way, but one line buys better.
     try {
         fs.chmodSync(npmrcPath, 0o600);
     }
     catch {
-        // A read-only home or an exotic filesystem must not fail an otherwise-good login.
     }
     return { path: npmrcPath };
 }
-/**
- * Human-facing explanation of a failed broker attempt, plus whether the AWS
- * fallback chain is worth running.
- *
- * `not-authorized` is the one case we do NOT fall through on: the caller has a
- * working Mesh account that simply lacks the grant, and quietly trying AWS next
- * would either succeed (masking a missing grant with an AWS account we're
- * trying to stop requiring) or fail with an unrelated AWS error that buries the
- * real answer. Its text ends by naming the re-run — the bare command, which
- * re-mints the session so a role granted after the sign-in reaches the broker;
- * a sign-out is the fallback for a session the issuer will not re-mint.
- *
- * @example
- * describeBrokerFailure({ kind: "unavailable", detail: "ECONNREFUSED" }).fatal; // → false
- */
 export function describeBrokerFailure(failure) {
     switch (failure.kind) {
         case "no-broker":
@@ -370,9 +243,6 @@ export function describeBrokerFailure(failure) {
             };
         case "not-authorized":
             return {
-                // The whole message lives in the body, not in a `remediation.command`:
-                // the answer here is "ask a human for a role", which is not a command
-                // anyone can run, and rendering a URL behind "→ run:" reads as one.
                 message: `Your Mesh account${failure.email ? ` (${failure.email})` : ""} is not authorized to read ` +
                     `${CA_NAMESPACE} packages.` +
                     (failure.requiredRoles?.length
@@ -391,77 +261,20 @@ export function describeBrokerFailure(failure) {
             };
     }
 }
-/**
- * A valid Mesh account that lacks the registry role. Its own class so a
- * caller that runs the login in-process (the `mesh init` wizard) can tell
- * "ask for a grant" from every other failure structurally, not by parsing
- * the sentence.
- *
- * @example
- * try {
- *   await runRegistryLogin(undefined, {});
- * } catch (err) {
- *   if (err instanceof RegistryNotAuthorizedError) markStepFailedAndContinue(err);
- *   else throw err;
- * }
- */
 export class RegistryNotAuthorizedError extends MeshCliError {
     constructor(message) {
         super(message);
         this.name = "RegistryNotAuthorizedError";
     }
 }
-/**
- * Whether this run may start a sign-in: always with `--device` (the device
- * code works anywhere the output can be read), otherwise only when there is
- * a terminal to print a code to or open a browser from. Which sign-in runs
- * is the login flow's choice — browser PKCE on a laptop, device code over
- * SSH or in a container. A run with no TTY and no `--device` never starts a
- * device-code poll nobody can complete — it falls to the AWS chain, which
- * is what a CI runner with ambient credentials expects.
- *
- * @example
- * registrySignInAllowed({}, false);             // → false (CI runner, no --device)
- * registrySignInAllowed({ device: true }, false); // → true
- * registrySignInAllowed({}, true);              // → true (a laptop, or an SSH session with a TTY)
- */
 export function registrySignInAllowed(opts, hasTty = Boolean(process.stdin.isTTY && process.stdout.isTTY)) {
     return Boolean(opts.device) || hasTty;
 }
-/**
- * Whether a broker refusal is worth one re-mint of the session before it is
- * reported.
- *
- * `not-authorized` and only `not-authorized`. It is the single refusal a token
- * minted a moment later can answer differently, because Zitadel writes project
- * roles into a token when it issues it and a grant that lands afterwards is
- * absent from every token already held. Every other failure is about the
- * broker or the session itself, which a re-mint does not change — and paying
- * for one there only delays the AWS fallback those failures are meant to reach.
- *
- * Exported so the policy is asserted by a test rather than promised by the one
- * call site that holds it.
- *
- * @example
- * shouldRemintAfter({ kind: "unavailable", detail: "ETIMEDOUT" }); // → false
- */
 export function shouldRemintAfter(failure) {
     return failure.kind === "not-authorized";
 }
-/** The closing line of the not-authorized text: what to run once the role is granted. */
 export const NOT_AUTHORIZED_RERUN = "Once granted, run: mesh registry login   (it re-mints your sign-in; still refused? mesh registry logout && mesh registry login)";
-/** Printed when the read path is given a context it no longer needs. */
 export const CONTEXT_IGNORED_NOTICE = "The registry is global — the context argument is no longer needed (ignored).";
-/**
- * Try the broker. Returns the grant when it produced one, otherwise the
- * outcome the caller carries into the AWS chain so the final error names the
- * right cause.
- *
- * Throws `MeshCliError` for the two fatal cases: `not-authorized` (a valid
- * account without the role — see describeBrokerFailure) and a sign-in that
- * failed outright (denied, timed out), because falling through to AWS after
- * either would print an unrelated error over the real answer.
- */
 async function tryBrokerLogin(opts) {
     if (opts.broker === false)
         return { outcome: { kind: "skipped-flag", flag: "--no-broker" } };
@@ -493,15 +306,11 @@ async function tryBrokerLogin(opts) {
     logInfo(`Registry session: ${session.email}`);
     let result = await requestGrant(session.context, identity);
     if (!result.ok && (result.failure.kind === "unauthenticated" || result.failure.kind === "unavailable")) {
-        // The pinned record may be stale — a moved broker host or a rotated
-        // client id. Re-discover once and retry only when something changed, so
-        // a genuinely down broker is not paid for twice.
         let fresh = null;
         try {
             fresh = await resolveRegistryIdentity({ refresh: true });
         }
         catch {
-            // still unreachable — the original failure stands
         }
         if (fresh && identityChanged(identity, fresh)) {
             logInfo(`Registry identity changed since it was cached — retrying with ${fresh.registryBroker}`);
@@ -510,10 +319,6 @@ async function tryBrokerLogin(opts) {
         }
     }
     if (!result.ok && shouldRemintAfter(result.failure)) {
-        // Roles ride in the token from the moment it was issued, so the grant the
-        // broker just judged is the one the session held at sign-in. A re-mint
-        // that comes back carrying a role the last one lacked is worth a second
-        // ask; one that carries the same roles would buy the same refusal twice.
         const { rolesChanged } = await refreshRegistrySession(session.context);
         if (rolesChanged) {
             logInfo("Your sign-in now carries a role it did not have — retrying…");
@@ -539,41 +344,16 @@ async function requestGrant(sessionContext, identity) {
         timeoutMs: PUBLISHED_BROKER_TIMEOUT_MS,
     });
 }
-/**
- * Whether this `mesh registry login` invocation may rewrite ~/.npmrc.
- *
- * The self-heal is a **laptop** fix. CI pipelines run the unscoped
- * `aws codeartifact login` DELIBERATELY — a host-scoped token is what lets
- * pnpm pull upstream-cached public packages through CodeArtifact — so in a
- * runner the "hijack" line is load-bearing and deleting it would break the
- * install we were asked not to touch. `--ci` is the one signal that says so.
- *
- * Extracted (and tested) rather than left inline because "this changes no CI
- * behaviour" is a promise about the code, not about the workflow files we
- * happen not to have edited.
- */
 export function shouldRepairUserNpmrc(opts) {
     return !opts.ci;
 }
-/**
- * Repair a hijacked ~/.npmrc: remove an unscoped `registry=<codeartifact>`
- * line if one is present, after taking a timestamped backup.
- *
- * `aws codeartifact login` run WITHOUT `--namespace @mesh-tech` writes that
- * line, and nothing in this CLI used to remove it — so one bare login made
- * CodeArtifact the default registry forever, and every public `npm install`
- * started failing with E401 12 hours later when the token expired. We write
- * the correct (scoped) state; this is the missing repair of the wrong state.
- *
- * Never throws — a repair failure must not fail an otherwise-good login.
- */
 export function repairUnscopedRegistry(npmrcPath = homeNpmrcPath()) {
     let original;
     try {
         original = fs.readFileSync(npmrcPath, "utf-8");
     }
     catch {
-        return { removed: null }; // no ~/.npmrc → nothing to repair
+        return { removed: null };
     }
     const { content, removed } = stripUnscopedCodeArtifactRegistry(original);
     if (!removed)
@@ -588,13 +368,6 @@ export function repairUnscopedRegistry(npmrcPath = homeNpmrcPath()) {
     }
     return { removed, backupPath };
 }
-/**
- * The `Registry session:` line of `mesh registry status`. Pure; exported for
- * the message test.
- *
- * @example
- * renderRegistrySessionLine(null); // → "No registry session — run: mesh registry login"
- */
 export function renderRegistrySessionLine(session, now = Date.now()) {
     if (!session)
         return "No registry session — run: mesh registry login";
@@ -625,23 +398,11 @@ export async function checkExistingToken() {
             hijackLine,
         };
     }
-    // Token works — a hijacked default registry still breaks public installs.
     if (hijackLine) {
         return { valid: false, state: probe.state, reason: "unscoped CodeArtifact registry", hijackLine };
     }
     return { valid: true, state: probe.state, endpoint: getEndpoint() ?? undefined };
 }
-/**
- * `mesh registry status` — returns the process exit code instead of calling
- * `process.exit`, so the "broken" vs "unverifiable" distinction is testable.
- *
- * Exit 1 is for faults the user can act on right now: a missing or expired
- * token, or an unscoped CodeArtifact `registry=` line (locally detectable, and
- * broken regardless of the network). An **unreachable** registry is neither —
- * it warns and exits 0, because the remediation we'd print (`mesh registry
- * login`) cannot work offline either, and the same rule already governs the
- * `mesh init` doctor.
- */
 export async function runRegistryStatus(opts) {
     const { valid, state, endpoint, reason, hijackLine } = await (opts?.check ?? checkExistingToken)();
     if (hijackLine) {
@@ -650,7 +411,6 @@ export async function runRegistryStatus(opts) {
         logInfo(`  ${hijackLine.trim()}`);
         logInfo("Fix: mesh registry login   # removes it (backup taken) and keeps @mesh-tech scoped");
     }
-    // A network fault is not an auth fault. Any *other* invalid state is.
     const unverifiable = state === "unreachable" && !hijackLine;
     if (!valid && !unverifiable) {
         logWarn(`Registry auth is not usable${reason ? ` — ${reason}` : ""}. Run: mesh registry login`);
@@ -667,7 +427,6 @@ export async function runRegistryStatus(opts) {
         }
     }
     logInfo(renderRegistrySessionLine(opts?.session ?? readRegistrySession()));
-    // Project .npmrc — worth reporting even when the token couldn't be verified.
     const projectRoot = findProjectRoot();
     if (projectRoot) {
         const npmrcPath = path.join(projectRoot, ".npmrc");
@@ -688,17 +447,6 @@ export async function runRegistryStatus(opts) {
     }
     return 0;
 }
-// =============================================================================
-// Commands
-// =============================================================================
-/**
- * Ensure the named AWS SSO profile has a live session — trigger the
- * interactive `aws sso login` (browser) when it's stale.
- *
- * Guardrails (MESH-2479): a missing profile fails fast with the exact
- * `aws configure` setup instead of an opaque CLI error, and the identity
- * probes are time-bounded so a wedged AWS CLI can't hang this silently.
- */
 function ensureSsoProfile(profile) {
     const awsConfig = readAwsConfig();
     if (awsConfig && !awsConfigHasProfile(awsConfig, profile)) {
@@ -733,26 +481,7 @@ function ensureSsoProfile(profile) {
     }
     logSuccess(`AWS SSO session refreshed (profile '${profile}')`);
 }
-/**
- * The full registry-auth sequence (CodeArtifact token → ~/.npmrc → project
- * .npmrc). `context` matters only to `--publish` (the publisher role comes
- * from that context's SSM export) and to the explicit AWS chain
- * (`--no-broker` / `--ci`, where a cached platform session can assume a
- * role); on the default read path it is ignored, because the registry is
- * global.
- *
- * Fails by throwing `MeshCliError` rather than exiting, so a caller that runs
- * this in-process (the `mesh init` wizard, the app-tenant doctor's `--fix`)
- * can report the outcome and carry on.
- *
- * @example
- * await runRegistryLogin(undefined, {});          // a laptop: broker, browser if needed
- * await runRegistryLogin(undefined, { ci: true }); // a runner: ambient AWS creds only
- */
 export async function runRegistryLogin(context, opts) {
-    // --publish is the opt-in privileged path: resolve the publisher role
-    // (explicit --role flag wins, else the registry's SSM export) and feed
-    // it through the same Zitadel role-assumption path as the reader flow.
     let roleArn = opts.role;
     if (opts.publish) {
         let ssmArn;
@@ -775,13 +504,6 @@ export async function runRegistryLogin(context, opts) {
         }
         logInfo(`Publisher role resolved: ${roleArn}`);
     }
-    // Step 0: the broker. Tried FIRST for the read path, because it is the only
-    // one that works on a machine with no AWS account, no AWS CLI and no
-    // ~/.aws/config — the machine this whole feature exists for.
-    //
-    // Skipped for --publish (a privileged write path that deliberately goes
-    // through an assumed IAM role) and for --profile (an explicit "use this AWS
-    // profile" instruction we must not silently override).
     let outcome;
     if (opts.publish) {
         outcome = { kind: "skipped-flag", flag: "--publish" };
@@ -797,9 +519,6 @@ export async function runRegistryLogin(context, opts) {
             const { path: npmrcPath } = applyGrantToUserNpmrc(attempt.grant);
             logSuccess(`Registry token issued by the Mesh broker → ${npmrcPath}` +
                 (attempt.grant.expiresAt ? ` (expires ${attempt.grant.expiresAt})` : ""));
-            // Same hijack repair as the AWS path — an unscoped `registry=` line left
-            // by a past bare `aws codeartifact login` breaks public installs
-            // regardless of where today's token came from.
             if (shouldRepairUserNpmrc(opts)) {
                 const repair = repairUnscopedRegistry();
                 if (repair.removed) {
@@ -829,8 +548,6 @@ export async function runRegistryLogin(context, opts) {
     }
     let env;
     if (opts.profile) {
-        // Jawad's flow, one command: live SSO session + profile-scoped token.
-        // Static creds in the environment would override the profile — drop them.
         ensureSsoProfile(opts.profile);
         env = { ...process.env, AWS_PROFILE: opts.profile };
         for (const key of ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN"]) {
@@ -843,19 +560,11 @@ export async function runRegistryLogin(context, opts) {
             ? { ...process.env, ...awsCreds }
             : undefined;
     }
-    // Step 1: Run `aws codeartifact login` (sets token in ~/.npmrc)
     logInfo("Authenticating with CodeArtifact...");
     if (!codeartifactLogin(env)) {
         throw new MeshCliError(describeAwsChainFailure(outcome));
     }
     logSuccess("CodeArtifact token refreshed (valid for 12 hours)");
-    // Step 1b: Repair a hijacked ~/.npmrc. We always write the SCOPED form
-    // above (--namespace @mesh-tech), but a bare `aws codeartifact login` run
-    // at any point in the past leaves an unscoped `registry=` line that we
-    // never removed — so it survived every subsequent correct login.
-    //
-    // Laptops only — see shouldRepairUserNpmrc: in `--ci` the unscoped line is
-    // doing its job and a "repair" would break the runner's install.
     if (shouldRepairUserNpmrc(opts)) {
         const repair = repairUnscopedRegistry();
         if (repair.removed) {
@@ -870,7 +579,6 @@ export async function runRegistryLogin(context, opts) {
             logWarn(`Could not repair ~/.npmrc (${repair.error}) — remove any unscoped \`registry=\` line by hand.`);
         }
     }
-    // Step 2: Get endpoint URL
     const endpoint = getEndpoint(env);
     if (!endpoint) {
         logWarn("Could not retrieve registry endpoint — .npmrc scope not configured");
@@ -878,7 +586,6 @@ export async function runRegistryLogin(context, opts) {
         logInfo(`  ${CA_NAMESPACE}:registry=https://mesh-platform-<ACCOUNT>.d.codeartifact.${CA_REGION}.amazonaws.com/npm/${CA_REPOSITORY}/`);
         return;
     }
-    // Step 3: Ensure project .npmrc (unless --ci or --skip-npmrc)
     if (!opts.ci && !opts.skipNpmrc) {
         const result = ensureProjectNpmrc(endpoint);
         if (result.created) {
@@ -893,26 +600,6 @@ export async function runRegistryLogin(context, opts) {
     }
     logSuccess(`Ready — run pnpm install to fetch ${CA_NAMESPACE} packages`);
 }
-/**
- * The error for a failed `aws codeartifact login`, built from WHY the AWS
- * chain was the path taken — so the text can only ever describe something
- * that actually happened on this run.
- *
- * Three shapes:
- *
- * - `--profile`: the profile's AWS identity cannot read the registry. That
- *   flag is for deployers whose account is allowed to; anyone else should drop
- *   it and take the broker path, which needs no AWS at all.
- * - broker unavailable / no session: the broker was tried and printed a
- *   warning; this names that warning and the two ways forward.
- * - an explicit AWS flag (`--no-broker`, `--ci`, `--publish`): the caller asked
- *   for the AWS chain, so the fix is the AWS credentials, not the broker.
- *
- * Pure; exported for the message tests.
- *
- * @example
- * describeAwsChainFailure({ kind: "skipped-profile", profile: "ctdev" }); // "AWS profile 'ctdev' cannot read…"
- */
 export function describeAwsChainFailure(outcome) {
     switch (outcome.kind) {
         case "skipped-profile":
@@ -973,4 +660,3 @@ export function registerRegistryCommands(program) {
     });
     registerRegistryPublish(registry);
 }
-//# sourceMappingURL=registry.js.map

package/dist/src/commands/secrets/exec.d.ts

@@ -1,17 +1 @@
-/**
- * mesh secrets exec - Execute command with secrets from AWS Secrets Manager
- *
- * Fetches a JSON secret from Secrets Manager and injects all key-value pairs
- * as environment variables before running the specified command.
- *
- * Usage:
- *   mesh secrets exec --secret=<name-or-arn> [--db-host=<host>] -- <command>
- *
- * Options:
- *   --db-host=<host>  Rewrite DATABASE_URL host (for dev mode tunneling)
- *
- * Example:
- *   mesh secrets exec --secret=mesh/encore/dev/rdc/db-credentials --db-host=localhost -- pnpm dev
- */
 export declare function execCommand(args: string[]): Promise<void>;
-//# sourceMappingURL=exec.d.ts.map

package/dist/src/commands/secrets/exec.js

@@ -1,21 +1,5 @@
-/**
- * mesh secrets exec - Execute command with secrets from AWS Secrets Manager
- *
- * Fetches a JSON secret from Secrets Manager and injects all key-value pairs
- * as environment variables before running the specified command.
- *
- * Usage:
- *   mesh secrets exec --secret=<name-or-arn> [--db-host=<host>] -- <command>
- *
- * Options:
- *   --db-host=<host>  Rewrite DATABASE_URL host (for dev mode tunneling)
- *
- * Example:
- *   mesh secrets exec --secret=mesh/encore/dev/rdc/db-credentials --db-host=localhost -- pnpm dev
- */
 import { spawn } from "child_process";
 import { SecretsManagerClient, GetSecretValueCommand, } from "@aws-sdk/client-secrets-manager";
-// Simple logging helpers
 function logInfo(msg) {
     console.log(`\u001b[36mℹ\u001b[0m ${msg}`);
 }
@@ -61,16 +45,11 @@ async function fetchSecret(client, secretId) {
         throw new Error("Secret is not valid JSON");
     }
 }
-/**
- * Rewrite the host in a DATABASE_URL
- * Useful for dev mode where we tunnel to the database via localhost
- */
 function rewriteDatabaseHost(databaseUrl, newHost) {
     try {
         const url = new URL(databaseUrl);
         const originalHost = url.host;
         url.hostname = newHost;
-        // Keep the original port if the new host doesn't include one
         if (!newHost.includes(":")) {
             url.port = url.port || "5432";
         }
@@ -108,11 +87,9 @@ export async function execCommand(args) {
     }
     const envKeys = Object.keys(secretValues);
     logSuccess(`Loaded ${envKeys.length} environment variable(s) from secret`);
-    // Rewrite DATABASE_URL host for dev mode tunneling
     if (options.dbHost && secretValues.DATABASE_URL) {
         secretValues.DATABASE_URL = rewriteDatabaseHost(secretValues.DATABASE_URL, options.dbHost);
     }
-    // Build environment with secret values injected
     const env = {
         ...process.env,
         ...secretValues,
@@ -129,4 +106,3 @@ export async function execCommand(args) {
         process.exit(1);
     });
 }
-//# sourceMappingURL=exec.js.map