@mesh-tech/mesh-cli 0.20.2 → 0.20.4

package/dist/src/utils/recover-conversation.d.ts

@@ -1,60 +1,14 @@
-/**
- * Reconstruct an agent conversation's transcript from decoded Temporal history.
- *
- * An agent conversation is a Temporal `agentWorkflow`. Its durable history holds
- * everything needed to replay the human/agent exchange even when the worker can
- * no longer run the workflow (code drift):
- *
- *   - `WorkflowExecutionSignaled` with signal name `submit_user_message` →
- *     one HUMAN turn. Its input payload is `SubmitUserMessageParams`
- *     (agent-sdk `agent-core/workflows/signals.ts`): `{ model, messages,
- *     streamId, ... }` where `messages` is a Vercel-AI `ModelMessage[]`; the
- *     user text lives in the `user`-role message(s).
- *   - `callLLM` `ActivityTaskCompleted` → one ASSISTANT turn. Its result is
- *     `LLMResult` (agent-sdk `agent-core/types.ts`): `{ messages, usage?,
- *     telemetry? }` where `messages` is the model's output `ModelMessage[]` —
- *     `assistant`-role text parts plus any `tool-call` parts.
- *
- * This module is the PURE reconstruction core: it takes events whose payloads
- * have ALREADY been decrypted into plain objects and returns ordered turns. The
- * Temporal fetch + decrypt wiring lives in `commands/temporal.ts`.
- *
- * Everything here is best-effort and defensive: payload shapes vary across
- * agent-sdk versions, so every field access is guarded and a turn that can't be
- * parsed becomes a placeholder rather than throwing — the whole point is to
- * recover *something* from an otherwise-unreplayable history.
- */
-/** Classification of a single decoded history event. */
 export interface DecodedEvent {
-    /** Temporal event id (stringified). Used in placeholders. */
     eventId: string;
-    /** Which kind of conversation event this is. */
     kind: "userSignal" | "callLLMResult" | "other";
-    /**
-     * The decoded payload object for this event:
-     *   - `userSignal`     → the `submit_user_message` signal input (SubmitUserMessageParams)
-     *   - `callLLMResult`  → the `callLLM` activity result (LLMResult)
-     *   - `other`          → unused
-     */
     payload?: unknown;
 }
-/**
- * Minimal shape of a raw Temporal history event as consumed by
- * `classifyHistoryEvents`. Only the attribute groups we classify are declared;
- * everything else is ignored. Field access is defensive so partial/variant
- * shapes (across Temporal SDK versions) don't throw.
- */
 export interface RawHistoryEvent {
     eventId?: unknown;
     activityTaskScheduledEventAttributes?: {
         activityType?: {
             name?: string | null;
         } | null;
-        /**
-         * The activity's INPUT payload group. For `callLLM` this is `callLLMArgs`
-         * (`{ model, messages }`) whose `messages` is the FULL accumulated
-         * conversation — the highest-fidelity snapshot source.
-         */
         input?: {
             payloads?: unknown[] | null;
         } | null;
@@ -73,82 +27,18 @@ export interface RawHistoryEvent {
     } | null;
     [k: string]: unknown;
 }
-/**
- * Decrypt+parse a payload group (the `payloads` array from a signal input or
- * activity result) into a plain object. Returns `undefined` when nothing could
- * be decoded, so the pure reconstructor emits a placeholder. Injected so the
- * classification stays pure and unit-testable without a live Temporal codec.
- */
 export type DecodePayload = (payloads: unknown[] | undefined | null) => Promise<unknown>;
-/**
- * Classify a raw Temporal history into the ordered `DecodedEvent[]` that
- * `reconstructTranscript` consumes.
- *
- * `ActivityTaskCompleted` events carry only a `scheduledEventId`, not the
- * activity's type name — so to tell which completions came from `callLLM` we
- * build a map of `ActivityTaskScheduled.eventId → activityType.name` as we walk
- * the history in event order, then look each completion's `scheduledEventId` up
- * in it. Only `callLLM` completions become `callLLMResult` (assistant) events;
- * completions of other activities (e.g. `routeTools`) are dropped.
- * `submit_user_message` signals become `userSignal` (human) events.
- *
- * Pure aside from the injected `decodePayload` (which performs the decrypt):
- * never throws, and preserves history order.
- */
 export declare function classifyHistoryEvents(rawEvents: Iterable<RawHistoryEvent>, decodePayload: DecodePayload): Promise<DecodedEvent[]>;
-/**
- * A Vercel-AI `ModelMessage` as it appears in decoded history — kept structural
- * (not flattened to text) so tool-call / tool-result content parts survive into
- * the snapshot. Typed loosely on purpose: shapes vary across agent-sdk versions
- * and the snapshot is a best-effort passthrough of whatever was persisted.
- */
 export type ModelMessage = {
     role?: string;
     content?: unknown;
 } & Record<string, unknown>;
-/**
- * Extract the highest-fidelity STRUCTURED transcript for a store-ready snapshot
- * backfill — the complete `ModelMessage[]` with tool-call/tool-result parts
- * intact (as opposed to `reconstructTranscript`'s flattened text turns).
- *
- * The source is the `callLLM` activity's SCHEDULED input, `callLLMArgs`
- * (`{ model, messages }`), whose `messages` is the FULL accumulated conversation
- * (user + assistant-with-tool-calls + tool-result messages) up to — but not
- * including — that turn's assistant output. We take the LAST `callLLM`
- * scheduled input (the most-accumulated one) and append the LAST `callLLM`
- * completion's output messages (`LLMResult.messages`, the final assistant turn):
- *
- *     [...lastScheduledInput.messages, ...lastCompletion.messages]
- *
- * Completions are matched to `callLLM` via `scheduledEventId` (same mapping as
- * `classifyHistoryEvents`).
- *
- * Best-effort and never throws:
- *   - no `callLLM` scheduled input (0 assistant turns) → `[]`;
- *   - a scheduled input but no completion (last turn interrupted) → just the
- *     input messages.
- *
- * Pure aside from the injected `decodePayload` (which performs the decrypt).
- */
 export declare function extractSnapshotMessages(rawEvents: Iterable<RawHistoryEvent>, decodePayload: DecodePayload): Promise<ModelMessage[]>;
-/** One reconstructed conversation turn. */
 export interface Turn {
     role: "user" | "assistant";
-    /** Human-readable text. Empty string is valid (e.g. a tool-only assistant turn). */
     text: string;
-    /** Formatted tool-call summaries (`name(compactArgs)`), assistant turns only. */
     toolCalls?: string[];
-    /** Originating Temporal event id. */
     eventId: string;
 }
-/**
- * Reconstruct ordered conversation turns from decoded history events.
- *
- * Pure: no I/O, never throws. `other` events are skipped; unparseable
- * user/assistant events become placeholder turns so the recovery is complete
- * end-to-end even when individual payloads are corrupt.
- */
 export declare function reconstructTranscript(events: DecodedEvent[]): Turn[];
-/** Render turns as a readable markdown transcript. */
 export declare function renderTranscriptMarkdown(turns: Turn[]): string;
-//# sourceMappingURL=recover-conversation.d.ts.map

package/dist/src/utils/recover-conversation.js

@@ -1,47 +1,4 @@
-/**
- * Reconstruct an agent conversation's transcript from decoded Temporal history.
- *
- * An agent conversation is a Temporal `agentWorkflow`. Its durable history holds
- * everything needed to replay the human/agent exchange even when the worker can
- * no longer run the workflow (code drift):
- *
- *   - `WorkflowExecutionSignaled` with signal name `submit_user_message` →
- *     one HUMAN turn. Its input payload is `SubmitUserMessageParams`
- *     (agent-sdk `agent-core/workflows/signals.ts`): `{ model, messages,
- *     streamId, ... }` where `messages` is a Vercel-AI `ModelMessage[]`; the
- *     user text lives in the `user`-role message(s).
- *   - `callLLM` `ActivityTaskCompleted` → one ASSISTANT turn. Its result is
- *     `LLMResult` (agent-sdk `agent-core/types.ts`): `{ messages, usage?,
- *     telemetry? }` where `messages` is the model's output `ModelMessage[]` —
- *     `assistant`-role text parts plus any `tool-call` parts.
- *
- * This module is the PURE reconstruction core: it takes events whose payloads
- * have ALREADY been decrypted into plain objects and returns ordered turns. The
- * Temporal fetch + decrypt wiring lives in `commands/temporal.ts`.
- *
- * Everything here is best-effort and defensive: payload shapes vary across
- * agent-sdk versions, so every field access is guarded and a turn that can't be
- * parsed becomes a placeholder rather than throwing — the whole point is to
- * recover *something* from an otherwise-unreplayable history.
- */
-/**
- * Classify a raw Temporal history into the ordered `DecodedEvent[]` that
- * `reconstructTranscript` consumes.
- *
- * `ActivityTaskCompleted` events carry only a `scheduledEventId`, not the
- * activity's type name — so to tell which completions came from `callLLM` we
- * build a map of `ActivityTaskScheduled.eventId → activityType.name` as we walk
- * the history in event order, then look each completion's `scheduledEventId` up
- * in it. Only `callLLM` completions become `callLLMResult` (assistant) events;
- * completions of other activities (e.g. `routeTools`) are dropped.
- * `submit_user_message` signals become `userSignal` (human) events.
- *
- * Pure aside from the injected `decodePayload` (which performs the decrypt):
- * never throws, and preserves history order.
- */
 export async function classifyHistoryEvents(rawEvents, decodePayload) {
-    // scheduledEventId → activity type name, so we can tell which
-    // ActivityTaskCompleted events came from `callLLM`.
     const activityTypeByScheduledId = new Map();
     const events = [];
     for (const event of rawEvents) {
@@ -76,40 +33,10 @@ export async function classifyHistoryEvents(rawEvents, decodePayload) {
     }
     return events;
 }
-/**
- * Extract the highest-fidelity STRUCTURED transcript for a store-ready snapshot
- * backfill — the complete `ModelMessage[]` with tool-call/tool-result parts
- * intact (as opposed to `reconstructTranscript`'s flattened text turns).
- *
- * The source is the `callLLM` activity's SCHEDULED input, `callLLMArgs`
- * (`{ model, messages }`), whose `messages` is the FULL accumulated conversation
- * (user + assistant-with-tool-calls + tool-result messages) up to — but not
- * including — that turn's assistant output. We take the LAST `callLLM`
- * scheduled input (the most-accumulated one) and append the LAST `callLLM`
- * completion's output messages (`LLMResult.messages`, the final assistant turn):
- *
- *     [...lastScheduledInput.messages, ...lastCompletion.messages]
- *
- * Completions are matched to `callLLM` via `scheduledEventId` (same mapping as
- * `classifyHistoryEvents`).
- *
- * Best-effort and never throws:
- *   - no `callLLM` scheduled input (0 assistant turns) → `[]`;
- *   - a scheduled input but no completion (last turn interrupted) → just the
- *     input messages.
- *
- * Pure aside from the injected `decodePayload` (which performs the decrypt).
- */
 export async function extractSnapshotMessages(rawEvents, decodePayload) {
-    // Track the last `callLLM` scheduled input's payload group and its eventId, so
-    // we can (a) decode the most-accumulated messages and (b) match its
-    // completion by scheduledEventId.
     let lastCallLLMScheduledId;
     let lastCallLLMInputPayloads;
-    // Map every scheduled activity's eventId → type name so completions resolve.
     const activityTypeByScheduledId = new Map();
-    // Track the last `callLLM` completion result payloads, keyed by matching the
-    // scheduledEventId back to a `callLLM`.
     let lastCallLLMResultPayloads;
     for (const event of rawEvents) {
         const eventId = String(event.eventId);
@@ -121,12 +48,6 @@ export async function extractSnapshotMessages(rawEvents, decodePayload) {
             if (name === "callLLM") {
                 lastCallLLMScheduledId = eventId;
                 lastCallLLMInputPayloads = scheduled.input?.payloads;
-                // Reset the result: a completion only "belongs" to this newly-scheduled
-                // callLLM if it arrives AFTER this point. Without the reset, a mid-turn
-                // interrupted last turn (scheduled, never completed) would keep a STALE
-                // earlier completion and duplicate that assistant message (it's already
-                // inside this turn's accumulated input). Matches the documented contract:
-                // scheduled-input-but-no-completion → just the input messages.
                 lastCallLLMResultPayloads = undefined;
             }
             continue;
@@ -147,15 +68,12 @@ export async function extractSnapshotMessages(rawEvents, decodePayload) {
     const resultMessages = messagesFrom(result);
     return [...inputMessages, ...resultMessages];
 }
-/** Pull a `.messages` array off a decoded `{ messages }` payload, else `[]`. */
 function messagesFrom(payload) {
     if (isRecord(payload) && Array.isArray(payload.messages)) {
         return payload.messages;
     }
     return [];
 }
-// ── Extraction helpers (all defensive) ───────────────────────────────────────
-/** Pull display text out of a ModelMessage `content` (string, or parts array). */
 function extractText(content) {
     if (typeof content === "string")
         return content;
@@ -167,7 +85,6 @@ function extractText(content) {
     }
     return "";
 }
-/** Compact a tool-call's args to a single truncated JSON line. */
 function summarizeArgs(args) {
     try {
         const str = JSON.stringify(args ?? {});
@@ -177,20 +94,14 @@ function summarizeArgs(args) {
         return "...";
     }
 }
-/** Format a `tool-call` content part as `name(compactArgs)`. */
 function formatToolCall(part) {
     const name = typeof part.toolName === "string" ? part.toolName : "?";
-    // AI SDK v5 uses `input`; older payloads use `args`. Accept either.
     const args = "input" in part ? part.input : part.args;
     return `${name}(${summarizeArgs(args)})`;
 }
 function isRecord(v) {
     return !!v && typeof v === "object";
 }
-/**
- * Extract the human text from a `submit_user_message` signal payload. Returns
- * `null` when nothing recognizable is found (caller emits a placeholder).
- */
 function extractUserText(payload) {
     if (!isRecord(payload))
         return null;
@@ -207,7 +118,6 @@ function extractUserText(payload) {
         if (parts.length > 0)
             return parts.join("\n");
     }
-    // Defensive fallbacks for shape drift — try common single-field carriers.
     for (const field of ["content", "text", "message"]) {
         const v = payload[field];
         if (typeof v === "string" && v)
@@ -218,17 +128,11 @@ function extractUserText(payload) {
     }
     return null;
 }
-/**
- * Extract the assistant text + tool calls from a `callLLM` result payload.
- * Returns `null` only when nothing at all could be parsed (no text AND no tool
- * calls) — a tool-only turn (empty text, non-empty toolCalls) is valid.
- */
 function extractAssistantTurn(payload) {
     if (!isRecord(payload))
         return null;
     const messages = payload.messages;
     if (!Array.isArray(messages)) {
-        // Defensive fallback: some shapes may carry text directly.
         const t = extractText(payload.content) || extractText(payload.text);
         return t ? { text: t, toolCalls: [] } : null;
     }
@@ -250,14 +154,6 @@ function extractAssistantTurn(payload) {
         return null;
     return { text, toolCalls };
 }
-// ── Reconstruction ───────────────────────────────────────────────────────────
-/**
- * Reconstruct ordered conversation turns from decoded history events.
- *
- * Pure: no I/O, never throws. `other` events are skipped; unparseable
- * user/assistant events become placeholder turns so the recovery is complete
- * end-to-end even when individual payloads are corrupt.
- */
 export function reconstructTranscript(events) {
     const turns = [];
     for (const event of events) {
@@ -285,15 +181,12 @@ export function reconstructTranscript(events) {
                 });
             }
         }
-        // `other` → skipped
     }
     return turns;
 }
 function placeholder(eventId) {
     return `_[unparseable turn: ${eventId}]_`;
 }
-// ── Rendering ─────────────────────────────────────────────────────────────────
-/** Render turns as a readable markdown transcript. */
 export function renderTranscriptMarkdown(turns) {
     const blocks = [];
     for (const turn of turns) {
@@ -311,4 +204,3 @@ export function renderTranscriptMarkdown(turns) {
     }
     return blocks.join("\n\n") + "\n";
 }
-//# sourceMappingURL=recover-conversation.js.map

package/dist/src/utils/registry-broker.d.ts

@@ -1,56 +1,25 @@
-/**
- * Client for the Zitadel-gated registry-auth broker.
- *
- * This is the path that lets a brand-new Trabian developer install
- * `@mesh-tech/*` with **no AWS account, no AWS CLI and no ~/.aws/config**: the
- * broker verifies the Zitadel id token `mesh registry login` cached for the
- * registry's own issuer, checks the caller's role, and returns a CodeArtifact
- * token minted with the BROKER's AWS identity. No AWS credential of any kind
- * reaches the laptop. Which broker to call comes from the registry's global
- * identity (`registry-identity.ts`), never from a platform context.
- *
- * Everything here is pure or dependency-injected so the fallback behaviour —
- * which is what decides whether a broker hiccup breaks an install — is
- * unit-testable without a network.
- */
 type CtxConfig = {
     issuer?: string;
     registryBroker?: string;
 } | null;
-/** A successful grant from `POST /token`. */
 export interface RegistryGrant {
-    /** npm scope the endpoint is bound to, e.g. "@mesh-tech". */
     scope: string;
-    /** Registry endpoint URL (npm format). */
     endpoint: string;
-    /** CodeArtifact bearer for the `//<host>:_authToken=` npmrc line. */
     authorizationToken: string;
-    /** ISO 8601 expiry, for reporting. */
     expiresAt?: string;
 }
-/** Why a broker attempt didn't produce a grant. */
-export type RegistryBrokerFailure = 
-/** No broker URL for this context — the platform predates the broker. */
-{
+export type RegistryBrokerFailure = {
     kind: "no-broker";
-}
-/** No cached Zitadel session for the registry — `mesh registry login` signs in. */
- | {
+} | {
     kind: "no-session";
-}
-/** The broker rejected the token (expired/wrong audience). */
- | {
+} | {
     kind: "unauthenticated";
-}
-/** A valid Mesh account that has not been granted registry access. */
- | {
+} | {
     kind: "not-authorized";
     email?: string;
     requiredRoles?: string[];
     requestUrl?: string;
-}
-/** Broker unreachable, 5xx, or a malformed body. */
- | {
+} | {
     kind: "unavailable";
     detail: string;
 };
@@ -61,71 +30,23 @@ export type RegistryBrokerResult = {
     ok: false;
     failure: RegistryBrokerFailure;
 };
-/**
- * Resolve the broker URL, preferring the platform-published value from
- * discovery (`ContextConfig.registryBroker`) and falling back to DNS-convention
- * derivation for platforms not yet redeployed with the payload field.
- *
- * Mirrors `resolveVpnJoinBroker` deliberately — one convention for
- * platform-published service URLs, not two.
- */
 export declare function resolveRegistryBroker(context: string, getCfg?: (c: string) => CtxConfig): string | null;
-/**
- * Timeout for a broker whose URL the platform actually published. It exists;
- * wait for it.
- */
 export declare const PUBLISHED_BROKER_TIMEOUT_MS = 15000;
-/**
- * Timeout for a broker URL we merely *derived* by DNS convention. For every
- * platform that has not deployed the broker — which today is all of them — that
- * host does not exist, and this wait sits in front of the AWS fallback on the
- * `mesh login` path too. Fail fast on a guess; be patient with a fact.
- */
 export declare const DERIVED_BROKER_TIMEOUT_MS = 4000;
-/**
- * Resolve the broker URL *and* say where it came from, so the caller can pick a
- * timeout that matches how much confidence the URL deserves.
- */
 export declare function resolveRegistryBrokerSource(context: string, getCfg?: (c: string) => CtxConfig): {
     url: string | null;
     source: "published" | "derived";
 };
-/**
- * FALLBACK ONLY. Derive by convention — issuer host `identity.<env>.<domain>`
- * → `registry-auth.<env>.<domain>`. Prefer `resolveRegistryBroker`, which reads
- * the platform-published URL first.
- */
 export declare function deriveRegistryBroker(context: string, getCfg?: (c: string) => CtxConfig): string | null;
 export interface FetchGrantDeps {
     getValidToken: (context: string) => Promise<string | null>;
     fetchFn?: typeof fetch;
-    /** Abort the broker call after this long. Keeps a wedged broker from hanging an install. */
     timeoutMs?: number;
 }
-/**
- * Classify a broker response into a grant or a typed failure.
- *
- * Split out from the fetch so every status code's meaning is pinned by a test.
- * The distinction that matters: **401 means re-login, 403 means request
- * access** — collapsing them (as a boolean-returning client would) is what
- * sends a developer to re-run `mesh login` forever when the real answer is
- * "ask an admin for the role".
- */
 export declare function classifyBrokerResponse(res: {
     status: number;
     json: () => Promise<unknown>;
 }): Promise<RegistryBrokerResult>;
-/**
- * Exchange the cached Zitadel id token under `context` (the reserved registry
- * key, or any cached context whose issuer matches the registry's) for a
- * CodeArtifact read grant.
- *
- * The token lookup never prompts — an expired session with no refresh token
- * comes back as `no-session` for the caller to decide about, rather than
- * stalling a headless run in a device-code poll.
- */
 export declare function fetchRegistryGrant(context: string, brokerUrl: string, deps: FetchGrantDeps): Promise<RegistryBrokerResult>;
-/** Convenience for production callers that use the real login.ts token source. */
 export declare function realGrantDeps(): FetchGrantDeps;
 export {};
-//# sourceMappingURL=registry-broker.d.ts.map

package/dist/src/utils/registry-broker.js

@@ -1,57 +1,15 @@
-/**
- * Client for the Zitadel-gated registry-auth broker.
- *
- * This is the path that lets a brand-new Trabian developer install
- * `@mesh-tech/*` with **no AWS account, no AWS CLI and no ~/.aws/config**: the
- * broker verifies the Zitadel id token `mesh registry login` cached for the
- * registry's own issuer, checks the caller's role, and returns a CodeArtifact
- * token minted with the BROKER's AWS identity. No AWS credential of any kind
- * reaches the laptop. Which broker to call comes from the registry's global
- * identity (`registry-identity.ts`), never from a platform context.
- *
- * Everything here is pure or dependency-injected so the fallback behaviour —
- * which is what decides whether a broker hiccup breaks an install — is
- * unit-testable without a network.
- */
 import { getContextConfig, getValidToken } from "../commands/login.js";
-/**
- * Resolve the broker URL, preferring the platform-published value from
- * discovery (`ContextConfig.registryBroker`) and falling back to DNS-convention
- * derivation for platforms not yet redeployed with the payload field.
- *
- * Mirrors `resolveVpnJoinBroker` deliberately — one convention for
- * platform-published service URLs, not two.
- */
 export function resolveRegistryBroker(context, getCfg = getContextConfig) {
     return resolveRegistryBrokerSource(context, getCfg).url;
 }
-/**
- * Timeout for a broker whose URL the platform actually published. It exists;
- * wait for it.
- */
 export const PUBLISHED_BROKER_TIMEOUT_MS = 15_000;
-/**
- * Timeout for a broker URL we merely *derived* by DNS convention. For every
- * platform that has not deployed the broker — which today is all of them — that
- * host does not exist, and this wait sits in front of the AWS fallback on the
- * `mesh login` path too. Fail fast on a guess; be patient with a fact.
- */
 export const DERIVED_BROKER_TIMEOUT_MS = 4_000;
-/**
- * Resolve the broker URL *and* say where it came from, so the caller can pick a
- * timeout that matches how much confidence the URL deserves.
- */
 export function resolveRegistryBrokerSource(context, getCfg = getContextConfig) {
     const cfg = getCfg(context);
     if (cfg?.registryBroker)
         return { url: cfg.registryBroker, source: "published" };
     return { url: deriveRegistryBroker(context, getCfg), source: "derived" };
 }
-/**
- * FALLBACK ONLY. Derive by convention — issuer host `identity.<env>.<domain>`
- * → `registry-auth.<env>.<domain>`. Prefer `resolveRegistryBroker`, which reads
- * the platform-published URL first.
- */
 export function deriveRegistryBroker(context, getCfg = getContextConfig) {
     const cfg = getCfg(context);
     if (!cfg?.issuer)
@@ -66,15 +24,6 @@ export function deriveRegistryBroker(context, getCfg = getContextConfig) {
         return null;
     }
 }
-/**
- * Classify a broker response into a grant or a typed failure.
- *
- * Split out from the fetch so every status code's meaning is pinned by a test.
- * The distinction that matters: **401 means re-login, 403 means request
- * access** — collapsing them (as a boolean-returning client would) is what
- * sends a developer to re-run `mesh login` forever when the real answer is
- * "ask an admin for the role".
- */
 export async function classifyBrokerResponse(res) {
     if (res.status === 401)
         return { ok: false, failure: { kind: "unauthenticated" } };
@@ -122,15 +71,6 @@ export async function classifyBrokerResponse(res) {
         },
     };
 }
-/**
- * Exchange the cached Zitadel id token under `context` (the reserved registry
- * key, or any cached context whose issuer matches the registry's) for a
- * CodeArtifact read grant.
- *
- * The token lookup never prompts — an expired session with no refresh token
- * comes back as `no-session` for the caller to decide about, rather than
- * stalling a headless run in a device-code poll.
- */
 export async function fetchRegistryGrant(context, brokerUrl, deps) {
     const token = await deps.getValidToken(context);
     if (!token)
@@ -156,8 +96,6 @@ export async function fetchRegistryGrant(context, brokerUrl, deps) {
         clearTimeout(timer);
     }
 }
-/** Convenience for production callers that use the real login.ts token source. */
 export function realGrantDeps() {
     return { getValidToken: (c) => getValidToken(c) };
 }
-//# sourceMappingURL=registry-broker.js.map