@mesh-tech/mesh-cli 0.20.2 → 0.20.3

package/dist/src/utils/auth-preflight.js

@@ -1,78 +1,19 @@
-/**
- * First-run auth preflight helpers (MESH-2479).
- *
- * `mesh start`/`mesh dev` do long work (registry tarball fetches, docker
- * builds, pnpm installs) that fails minutes in — with npm's generic advice —
- * when the CodeArtifact token or AWS SSO session is stale. These helpers
- * verify auth BEFORE the long work and name the exact fixing command.
- *
- * Pure parsers/classifiers are exported separately from the impure probes so
- * the branch logic is unit-testable without network or a home directory.
- */
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
-/**
- * The command that fixes a stale/missing CodeArtifact token — **broker-first**,
- * so it works for someone with no AWS account at all.
- *
- * Bare on purpose. The `@mesh-tech` registry is one global identity
- * (`utils/registry-identity.ts`): `mesh registry login` resolves it, signs in
- * if it must, and writes `~/.npmrc` in a single run, so no remediation ever
- * needs to name a platform context.
- */
 export const REGISTRY_LOGIN_FIX = "mesh registry login";
-/**
- * The AWS-profile form. Only correct for people who **deploy**, or when the
- * registry broker is unavailable.
- *
- * Kept as a separate named constant rather than the default: `--profile`
- * deliberately skips the broker, so printing it as the generic fix sends a
- * developer with no AWS account to a command that cannot work for them.
- */
 export const REGISTRY_LOGIN_FIX_AWS = "mesh registry login --profile mesh-dev";
-/**
- * Render the registry fix. Always the bare command — the registry is global,
- * so a remediation that has to name a context is a remediation the reader has
- * to edit first, and one that names the wrong context does not work at all.
- *
- * @example
- * registryLoginFix(); // → "mesh registry login"
- */
 export function registryLoginFix() {
     return REGISTRY_LOGIN_FIX;
 }
-/** The documented AWS SSO login form (root package.json `sso` script). */
 export const SSO_LOGIN_FIX = "aws sso login --sso-session=mesh   # or: pnpm sso";
-/**
- * The `aws configure sso-session` snippet `pnpm sso` depends on. Printed
- * verbatim when ~/.aws/config has no [sso-session mesh] section — kept here
- * so the CLI and scripts/sso-login.sh describe the same setup.
- */
 export const SSO_SESSION_SNIPPET = `[sso-session mesh]
 sso_start_url = https://trabian.awsapps.com/start
 sso_region = us-east-1
 sso_registration_scopes = sso:account:access`;
-// ============================================================================
-// ~/.npmrc parsing (pure)
-// ============================================================================
-/**
- * The user-level npmrc `aws codeartifact login` writes into — the token line
- * and, when the namespace flag is omitted, the unscoped `registry=` line.
- *
- * One definition for the whole CLI: the doctor, the probe, and the repair have
- * to be looking at the same file or they disagree about the same machine.
- * `os.homedir()` reads `$HOME` on POSIX, so a scratch-`HOME` test still works.
- */
 export function homeNpmrcPath() {
     return path.join(os.homedir(), ".npmrc");
 }
-/**
- * Extract the CodeArtifact registry endpoint + auth token from npmrc content.
- * `aws codeartifact login` writes a line shaped like:
- *   //mesh-platform-…d.codeartifact.<region>.amazonaws.com/npm/<repo>/:_authToken=<tok>
- * Returns null when no CodeArtifact token line is present.
- */
 export function parseNpmrcRegistryAuth(content) {
     for (const line of content.split("\n")) {
         const match = line.trim().match(/^\/\/([^:]*\.codeartifact\.[^:]*):_authToken=(.+)$/);
@@ -83,32 +24,11 @@ export function parseNpmrcRegistryAuth(content) {
     }
     return null;
 }
-/**
- * Find an **unscoped** `registry=` line in npmrc content that points at
- * CodeArtifact — the line `aws codeartifact login` writes when it is run
- * WITHOUT `--namespace @mesh-tech`.
- *
- * That line makes CodeArtifact the *default* registry, so every public package
- * (lodash, react, …) is fetched through it with the CodeArtifact token. When
- * the token expires 12 hours later, `npm install` of anything at all fails
- * with E401 — the private-scope breakage everyone expects, plus a total public
- * npm outage nobody does.
- *
- * Deliberately narrow — it must only match a line that is BOTH unscoped AND a
- * CodeArtifact host, so it never touches:
- *   - `@mesh-tech:registry=…`      (scoped: the line we WANT)
- *   - `//…:_authToken=…`           (auth, unaffected by the default registry)
- *   - `registry=https://npm.acme.internal/`  (a team's legitimate private mirror)
- *
- * Returns the offending line verbatim (as it appears in the file), or null.
- */
 export function findUnscopedCodeArtifactRegistry(content) {
     for (const line of content.split("\n")) {
         const trimmed = line.trim();
-        // npmrc comments start with ; or #
         if (!trimmed || trimmed.startsWith(";") || trimmed.startsWith("#"))
             continue;
-        // Anchored at `registry` — a scoped line starts with `@scope:`, so it can't match.
         const match = trimmed.match(/^registry\s*=\s*(\S+)$/);
         if (!match || !match[1])
             continue;
@@ -117,23 +37,14 @@ export function findUnscopedCodeArtifactRegistry(content) {
     }
     return null;
 }
-/** True when a registry URL's *host* is a CodeArtifact endpoint. */
 function isCodeArtifactRegistryUrl(value) {
     try {
         return new URL(value).hostname.includes(".codeartifact.");
     }
     catch {
-        // Not a parseable URL (env-var interpolation, protocol-relative, …) —
-        // fall back to a substring test so we don't miss an obvious hijack.
         return value.includes(".codeartifact.");
     }
 }
-/**
- * Remove every unscoped CodeArtifact `registry=` line from npmrc content.
- * Pure: returns the rewritten content plus the first line removed (null when
- * the content was already clean, in which case `content` is returned
- * unchanged and callers should skip the write entirely).
- */
 export function stripUnscopedCodeArtifactRegistry(content) {
     const offender = findUnscopedCodeArtifactRegistry(content);
     if (offender === null)
@@ -141,31 +52,12 @@ export function stripUnscopedCodeArtifactRegistry(content) {
     const kept = content
         .split("\n")
         .filter((line) => findUnscopedCodeArtifactRegistry(line) === null);
-    // split/join round-trips the file's trailing-newline state exactly.
     return { content: kept.join("\n"), removed: offender };
 }
-/**
- * The `//host/path/:_authToken=` key `aws codeartifact login` writes for a
- * registry endpoint — the endpoint with its scheme stripped and a leading `//`.
- *
- * Pure and shared so the broker path writes byte-identical lines to the AWS CLI
- * path. Two spellings of the same key would leave a stale token line behind
- * that npm might prefer, and the symptom (E401 hours later) points nowhere
- * near the cause.
- */
 export function npmrcAuthKeyForEndpoint(endpoint) {
     const withoutScheme = endpoint.replace(/^https?:\/\//, "");
     return `//${withoutScheme.endsWith("/") ? withoutScheme : `${withoutScheme}/`}`;
 }
-/**
- * Upsert `key=value` lines into npmrc content: replace the existing line for a
- * key when present, append it otherwise, and leave every other line untouched.
- *
- * Pure. Always emits a trailing newline, and never reorders lines a
- * user put there themselves — an npmrc is a config file people hand-edit, and
- * a token refresh that rewrites the whole thing is how unrelated settings
- * silently disappear.
- */
 export function upsertNpmrcLines(content, entries) {
     let lines = content.length ? content.split("\n") : [];
     const trailingNewline = content.endsWith("\n");
@@ -187,16 +79,9 @@ export function upsertNpmrcLines(content, entries) {
     }
     return lines.join("\n") + "\n";
 }
-/** Map an HTTP status from an authenticated registry request to a token state. */
 export function classifyRegistryStatus(status) {
-    // 401/403 mean the token itself was rejected. Anything else (200, 404, …)
-    // means auth was accepted — the token is usable.
     return status === 401 || status === 403 ? "expired" : "fresh";
 }
-/**
- * Verify the CodeArtifact token in ~/.npmrc actually works, with one small
- * authenticated metadata request (bounded by `timeoutMs`). Never throws.
- */
 export async function probeRegistryToken(opts) {
     const npmrcPath = opts?.npmrcPath ?? homeNpmrcPath();
     const timeoutMs = opts?.timeoutMs ?? 8_000;
@@ -206,7 +91,6 @@ export async function probeRegistryToken(opts) {
         auth = parseNpmrcRegistryAuth(fs.readFileSync(npmrcPath, "utf-8"));
     }
     catch {
-        // unreadable/missing ~/.npmrc — same as no auth configured
     }
     if (!auth)
         return { state: "missing" };
@@ -228,13 +112,6 @@ export async function probeRegistryToken(opts) {
         };
     }
 }
-/**
- * Classify a probe + session into the preflight verdict. Pure; the network
- * part lives in `registryPreflight`.
- *
- * @example
- * classifyRegistryPreflight({ state: "fresh" }, { email: "dev@trabian.com" }).state; // → "valid"
- */
 export function classifyRegistryPreflight(probe, session) {
     const email = session?.email;
     const fix = "mesh init";
@@ -242,14 +119,6 @@ export function classifyRegistryPreflight(probe, session) {
         return { state: "valid", email, fix };
     return { state: probe.state, email, fix, detail: probe.detail };
 }
-/**
- * Registry preflight for commands that cannot proceed without package access
- * (`mesh create-app` outside the platform monorepo). Never throws.
- *
- * @example
- * const pf = await registryPreflight();
- * if (pf.state !== "valid" && pf.state !== "unreachable") process.exit(1);
- */
 export async function registryPreflight(opts) {
     const probe = await probeRegistryToken(opts);
     let session = null;
@@ -258,18 +127,12 @@ export async function registryPreflight(opts) {
         session = readRegistrySession();
     }
     catch {
-        // no session store readable — the probe alone decides
     }
     return classifyRegistryPreflight(probe, session);
 }
-// ============================================================================
-// npm / AWS error classification (pure)
-// ============================================================================
-/** True when npm output/an error message is an auth failure (E401/E403). */
 export function isNpmAuthErrorText(text) {
     return /\bE?40[13]\b|unauthenticated|unable to authenticate|authentication (required|failed)/i.test(text);
 }
-/** True when an npm exec error (with stderr/message) is an auth failure. */
 export function isNpmAuthError(err) {
     const e = err;
     const text = [e?.stderr, e?.message]
@@ -277,14 +140,9 @@ export function isNpmAuthError(err) {
         .join("\n");
     return isNpmAuthErrorText(text);
 }
-/** True when an AWS SDK/CLI error message means the ambient session expired. */
 export function isExpiredAwsTokenMessage(message) {
     return /expired|invalid.*(security )?token|token.*(is )?invalid|no credential|could not load credentials|could not be found|sso session/i.test(message);
 }
-// ============================================================================
-// ~/.aws/config parsing (pure) — `pnpm sso` / --profile prerequisites
-// ============================================================================
-/** Names of `[sso-session <name>]` sections in an AWS config file. */
 export function parseSsoSessionNames(content) {
     const names = [];
     for (const line of content.split("\n")) {
@@ -294,12 +152,10 @@ export function parseSsoSessionNames(content) {
     }
     return names;
 }
-/** True when the AWS config file declares the named profile. */
 export function awsConfigHasProfile(content, profile) {
     const pattern = new RegExp(`^\\[(?:profile\\s+)?${profile.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\]$`);
     return content.split("\n").some((line) => pattern.test(line.trim()));
 }
-/** Read ~/.aws/config (honoring AWS_CONFIG_FILE); "" when unreadable. */
 export function readAwsConfig() {
     const file = process.env.AWS_CONFIG_FILE ?? path.join(os.homedir(), ".aws", "config");
     try {
@@ -309,10 +165,6 @@ export function readAwsConfig() {
         return "";
     }
 }
-// ============================================================================
-// App dependency scan (for the dev doctor's registry check)
-// ============================================================================
-/** True when the app's package.json depends on any @mesh-tech/* package. */
 export function appUsesMeshPackages(appRoot) {
     try {
         const pkg = JSON.parse(fs.readFileSync(path.join(appRoot, "package.json"), "utf-8"));
@@ -322,4 +174,3 @@ export function appUsesMeshPackages(appRoot) {
         return false;
     }
 }
-//# sourceMappingURL=auth-preflight.js.map

package/dist/src/utils/aws-auth.d.ts

@@ -1,49 +1,8 @@
-/**
- * Shared AWS credential resolution for mesh CLI commands.
- *
- * Three-tier resolution:
- *   1. Existing AWS credentials in environment (CI/CD) → use directly
- *   2. Zitadel JWT via `mesh login` → AssumeRoleWithWebIdentity
- *   3. Fallback → AssumeRole via current AWS session (SSO)
- *
- * Uses @aws-sdk/client-sts directly — does NOT shell out to the `aws` CLI
- * binary, so the binary is not a runtime requirement.
- */
-/**
- * Derive the platform context key (e.g., "mesh.dev") from a Pulumi stack config.
- *
- * Reads `mesh:platform` from Pulumi.<stack>.yaml. Supports both formats:
- *   mesh:platform: '{"env":"dev","name":"mesh"}'    → "mesh.dev"
- *   mesh:platform:
- *     name: mesh
- *     env: dev                                       → "mesh.dev"
- */
 export declare function derivePlatformContext(appRoot: string, stack: string): string | null;
-/**
- * Resolve a STABLE absolute path to the running `mesh` entrypoint for
- * embedding in a `credential_process` line — or fall back to plain `mesh`
- * (PATH lookup) when `argv1` is missing, doesn't exist on disk, or lives in
- * a transient location (`npx` cache / OS temp dir): a profile pointing at a
- * path that evaporates breaks every later AWS call with a cryptic
- * credential_process error. The fallback is announced via `logWarn` so the
- * user knows to install mesh-cli globally.
- */
 export declare function resolveStableMeshBin(argv1: string | undefined, deps?: {
     exists?: (p: string) => boolean;
     warn?: (msg: string) => void;
 }): string;
-/**
- * Render an AWS config-file `[profile …]` block whose `credential_process`
- * re-invokes `mesh login … --credential-process`, so the AWS SDK's default
- * provider chain auto-refreshes the underlying STS triple (the `mesh login`
- * process re-issues the Zitadel token as needed).
- *
- * Shared by `mesh dev` (child services) and `mesh login --export` so both
- * produce byte-identical profiles. Pure — no I/O. The `region` line is
- * emitted only when `region` is a non-empty string. Includes a trailing
- * newline. The binary path and role ARN are double-quoted when they contain
- * whitespace (AWS config command-splitting rules).
- */
 export declare function renderCredentialProcessProfile(args: {
     profileName: string;
     context: string;
@@ -51,160 +10,38 @@ export declare function renderCredentialProcessProfile(args: {
     region?: string;
     meshBin: string;
 }): string;
-/**
- * Insert or replace the mesh-managed `[profile …]` section for `context` in
- * the user's AWS config content, preserving ALL other content byte-for-byte
- * (this is the user's real ~/.aws/config — clobbering it breaks their other
- * profiles). Pure — no I/O; exported for unit testing.
- *
- * - Existing managed section for this context → replaced in place.
- * - Orphaned START (matching END lost) → only the contiguous profile block
- *   that is provably ours is reclaimed; other contexts' sections and user
- *   content below are preserved (see `orphanedSectionTail`).
- * - No section → appended, separated by a single blank line (and a trailing
- *   newline is added to the existing content if it lacks one).
- */
 export declare function upsertManagedAwsConfigSection(existing: string, context: string, profileBlock: string): string;
-/**
- * Remove a BARE `[profile name]` block — one outside any managed section — from
- * AWS config content. A file written before the managed-section format carries
- * exactly one such block, and migrating it must not leave that block behind as a
- * duplicate profile. Pure; exported for unit testing.
- *
- * @example
- * stripBareProfile("[profile acme]\nregion = us-east-2\n", "acme"); // → ""
- */
 export declare function stripBareProfile(existing: string, profileName: string): string;
-/** Assume an IAM role via current AWS session and return credentials as env vars. */
 export declare function assumeRole(roleArn: string, sessionName?: string, durationSeconds?: number): Promise<Record<string, string> | null>;
-/** STS credentials for a Zitadel-JWT-assumed role, including expiry. */
 export interface StsCreds {
     AccessKeyId: string;
     SecretAccessKey: string;
     SessionToken: string;
-    /** ISO-8601 expiration timestamp. */
     Expiration: string;
 }
-/**
- * Assume role using a Zitadel JWT via AssumeRoleWithWebIdentity, returning
- * the full STS credential struct (including `Expiration`) rather than the
- * env-var shape. Used by callers that need to track/refresh expiry (e.g.
- * `credential_process`).
- */
 export declare function assumeRoleCredentials(roleArn: string, idToken: string, sessionName: string, durationSeconds?: number): Promise<StsCreds | null>;
-/** Assume role using a Zitadel JWT via AssumeRoleWithWebIdentity. */
 export declare function assumeRoleWithWebIdentity(roleArn: string, idToken: string, sessionName: string, durationSeconds?: number): Promise<Record<string, string> | null>;
-/**
- * Extract the `iss` claim from a JWT without ever throwing — malformed or
- * corrupt tokens (e.g. a damaged `~/.config/mesh/credentials.json`) yield
- * `undefined`. The failure-diagnostic paths use this; a decode that throws
- * there would crash before the diagnostic prints, which is exactly the
- * failure class MESH-2515 removes.
- */
 export declare function tokenIssuer(token: string): string | undefined;
-/**
- * Explain an AssumeRoleWithWebIdentity failure in platform terms: which login
- * session (context + token issuer) tried to assume which role, in which AWS
- * account. STS's "web identity token could not be validated" reads like an
- * IAM/expiry problem, but the usual cause is a context whose issuer the role's
- * account simply doesn't trust — e.g. a `mesh.dev` session against a role in a
- * `trabian`-platform account (MESH-2515). stderr only — callers in
- * `--credential-process` mode must keep stdout JSON-clean.
- *
- * `format: "inline"` renders the same facts as one line, for detail fields
- * that get interpolated mid-sentence (the doctor/preflight cred probe). Both
- * forms keep the `AssumeRoleWithWebIdentity failed` prefix the doctor plan
- * documents as the detail capture.
- */
 export declare function describeAssumeFailure(opts: {
     roleArn: string;
     context?: string;
     issuer?: string;
 }, format?: "block" | "inline"): string;
-/** Format STS credentials as AWS `credential_process` JSON (Version 1). */
 export declare function toCredentialProcessJson(creds: StsCreds): string;
 export interface ResolvedAwsCreds {
-    /** AWS credential env vars (ACCESS_KEY_ID, SECRET_ACCESS_KEY, SESSION_TOKEN) */
     env: Record<string, string>;
-    /** How the credentials were obtained */
     method: "environment" | "zitadel" | "sso";
 }
 export interface AwsIdentity {
-    /** Full caller ARN, e.g. arn:aws:iam::159923586610:user/CI-CD_User */
     arn: string;
     accountId: string;
-    /** Where the SDK's default chain found the credentials, for the human reading it. */
     source: "environment" | "profile";
 }
-/**
- * Ask "is there a working AWS connection right now?" — nothing more.
- *
- * Deliberately NOT `resolveAwsCredentials`: that one answers "get me credentials
- * for role X" and has an opinion about how they were obtained. This one runs
- * GetCallerIdentity through the SDK's default provider chain and reports whatever
- * it finds, so a static key/secret pair in `~/.aws/credentials` counts exactly as
- * much as an SSO session or a Zitadel-minted role. Returns null when the chain
- * yields nothing usable.
- */
 export declare function probeAwsIdentity(): Promise<AwsIdentity | null>;
-/**
- * Pick the AWS role ARN to assume based on Zitadel claims.
- *
- * Zitadel emits project roles under
- * `urn:zitadel:iam:org:project:<projectId>:roles` as a nested object
- * keyed by role name. We treat the presence of `mesh.platform:admin`
- * (or any role listed in `meshcli.adminRoles` in config) as the
- * signal to assume the broader admin role when the caller has
- * configured one.
- *
- * Returns `defaultRole` when no admin role is configured, no admin
- * claim is present, or the JWT can't be parsed. This keeps existing
- * deployments working without a config change.
- *
- * The admin AWS role's IAM trust policy is expected to gate
- * assumption on the same Zitadel claim in production (so the CLI
- * preference can't be spoofed). That setup is its own change — see
- * TODO(mesh-zitadel-aws-role-mapping).
- */
 export declare function selectRoleForCaller(idToken: string | null, options: {
     defaultRole: string;
     adminRole?: string;
-    /**
-     * Zitadel role names that should map to `adminRole`. Defaults to
-     * a single `mesh.platform:admin` role; callers can override via
-     * config to introduce role tiers later.
-     */
     adminClaimRoles?: string[];
 }): string;
-/**
- * The Zitadel project-role names a decoded token carries.
- *
- * Zitadel emits project roles under a claim whose key is either
- * `urn:zitadel:iam:org:project:roles` or the project-qualified
- * `urn:zitadel:iam:org:project:<projectId>:roles`, and whose value is
- * `{ "<roleKey>": { "<orgId>": "<domain>" } }` — the role name is the
- * TOP-LEVEL key. Unwrapping one level deeper collects org ids, which match no
- * role and deny every caller. A token may carry both claim shapes and roles
- * from several projects, so every matching key is walked and the names merged.
- *
- * @param claims A decoded JWT payload.
- * @returns Role names in claim order, deduplicated; empty when the token
- *   carries no roles claim.
- * @example
- * projectRoleKeys({ "urn:zitadel:iam:org:project:roles": { "registry:read": {} } });
- * // → ["registry:read"]
- */
 export declare function projectRoleKeys(claims: Record<string, unknown>): string[];
-/**
- * Resolve AWS credentials using the three-tier strategy.
- *
- * @param roleArn       The IAM role to assume (from mesh:deployerRole)
- * @param appRoot       Pulumi app root directory
- * @param stack         Pulumi stack name
- * @returns Resolved credentials, or null if all methods fail
- *
- * To inherit a broader role based on Zitadel claims, call
- * `selectRoleForCaller` first and pass the result as `roleArn`.
- */
 export declare function resolveAwsCredentials(roleArn: string, appRoot: string, stack: string): Promise<ResolvedAwsCreds | null>;
-//# sourceMappingURL=aws-auth.d.ts.map