@mesh-tech/mesh-cli 0.34.2 → 0.34.4

package/dist/bin/mesh.js

@@ -3909,6 +3909,7 @@ __export(login_exports, {
   clearContextConfig: () => clearContextConfig,
   clearCredentials: () => clearCredentials,
   decodeJwtPayload: () => decodeJwtPayload,
+  deployableTenants: () => deployableTenants,
   deviceLoginWithReissue: () => deviceLoginWithReissue,
   discoverConfigForContext: () => discoverConfigForContext,
   discoverConfigFromWellKnown: () => discoverConfigFromWellKnown,
@@ -4225,12 +4226,7 @@ function login(context, config) {
         const idPayload = decodeJwtPayload(tokens.id_token);
         const email = idPayload.email ?? idPayload.preferred_username ?? "unknown";
         const sub = idPayload.sub;
-        let tenants = [];
-        try {
-          const accessPayload = decodeJwtPayload(tokens.access_token);
-          tenants = accessPayload["urn:mesh:tenants"] ?? [];
-        } catch {
-        }
+        const tenants = deployableTenants(tokens.id_token, tokens.access_token);
         writeCredentials(context, {
           idToken: tokens.id_token,
           accessToken: tokens.access_token,
@@ -4346,12 +4342,7 @@ async function attemptDeviceCode(context, config) {
       const idPayload = decodeJwtPayload(tokens.id_token);
       const email = idPayload.email ?? idPayload.preferred_username ?? "unknown";
       const sub = idPayload.sub;
-      let tenants = [];
-      try {
-        const accessPayload = decodeJwtPayload(tokens.access_token);
-        tenants = accessPayload["urn:mesh:tenants"] ?? [];
-      } catch {
-      }
+      const tenants = deployableTenants(tokens.id_token, tokens.access_token);
       writeCredentials(context, {
         idToken: tokens.id_token,
         accessToken: tokens.access_token,
@@ -4524,12 +4515,10 @@ async function showStatus(context, config) {
     );
     return;
   }
-  let tenants = [];
+  const tenants = deployableTenants(creds.idToken, creds.accessToken);
   let audience = [];
   try {
-    const accessPayload = decodeJwtPayload(creds.accessToken);
-    tenants = accessPayload["urn:mesh:tenants"] ?? [];
-    audience = tokenAudience(accessPayload);
+    audience = tokenAudience(decodeJwtPayload(creds.accessToken));
   } catch {
   }
   logSuccess(`Logged in as ${creds.email ?? "unknown"} (${context})`);
@@ -4552,6 +4541,19 @@ async function showStatus(context, config) {
     );
   }
 }
+function deployableTenants(idToken, accessToken) {
+  for (const token of [idToken, accessToken]) {
+    if (!token) continue;
+    let claim;
+    try {
+      claim = decodeJwtPayload(token)[DEPLOY_TENANTS_CLAIM];
+    } catch {
+      continue;
+    }
+    if (Array.isArray(claim)) return claim.filter((t) => typeof t === "string");
+  }
+  return [];
+}
 function tokenAudience(payload) {
   const aud = payload.aud;
   if (typeof aud === "string") return [aud];
@@ -4974,7 +4976,7 @@ function readAllContextConfigs() {
 async function discoverConfigForContext(context) {
   return getContextConfig(context) ?? await discoverConfigGuarded(context);
 }
-var CONFIG_DIR, CONFIG_FILE, CREDENTIALS_FILE, REDIRECT_PORT, REDIRECT_URI, BASE_SCOPES, atomicWriteCounter, MAX_DEVICE_CODES, RESERVED_REGISTRY_CONTEXT, NO_REGISTRY_DEPRECATED, REGISTRY_SEPARATE_HINT;
+var CONFIG_DIR, CONFIG_FILE, CREDENTIALS_FILE, REDIRECT_PORT, REDIRECT_URI, BASE_SCOPES, atomicWriteCounter, MAX_DEVICE_CODES, DEPLOY_TENANTS_CLAIM, RESERVED_REGISTRY_CONTEXT, NO_REGISTRY_DEPRECATED, REGISTRY_SEPARATE_HINT;
 var init_login = __esm({
   "packages/mesh-cli/src/commands/login.ts"() {
     "use strict";
@@ -4994,6 +4996,7 @@ var init_login = __esm({
     BASE_SCOPES = "openid email profile offline_access urn:zitadel:iam:org:project:id:zitadel:aud";
     atomicWriteCounter = 0;
     MAX_DEVICE_CODES = 3;
+    DEPLOY_TENANTS_CLAIM = "urn:mesh:tenants";
     RESERVED_REGISTRY_CONTEXT = "registry";
     NO_REGISTRY_DEPRECATED = "--no-registry is deprecated and ignored: mesh login no longer touches the registry.";
     REGISTRY_SEPARATE_HINT = "Package registry access is separate from platform sign-in \u2014 run: mesh registry login";