@mesh-tech/mesh-cli 0.35.2 → 0.37.0

package/dist/bin/mesh.chunk-WOJOTUFZ.js

@@ -0,0 +1,835 @@
+import {
+  PUBLISHED_BROKER_TIMEOUT_MS,
+  clearRegistrySession,
+  describeSessionExpiry,
+  ensureRegistrySession,
+  fetchRegistryGrant,
+  identityChanged,
+  logRegistryIdentity,
+  readRegistrySession,
+  realGrantDeps,
+  refreshRegistrySession,
+  registryAccountState,
+  resolveRegistryIdentity
+} from "./mesh.chunk-A4DGMGHF.js";
+import {
+  readCredentials
+} from "./mesh.chunk-R5VVTXG4.js";
+import {
+  logError,
+  logInfo,
+  logSuccess,
+  logWarn
+} from "./mesh.chunk-WFFDF346.js";
+import {
+  MeshCliError
+} from "./mesh.chunk-IQOBTL42.js";
+import {
+  SSO_SESSION_SNIPPET,
+  awsConfigHasProfile,
+  findUnscopedCodeArtifactRegistry,
+  homeNpmrcPath,
+  npmrcAuthKeyForEndpoint,
+  probeRegistryToken,
+  readAwsConfig,
+  stripUnscopedCodeArtifactRegistry,
+  upsertNpmrcLines
+} from "./mesh.chunk-5A5OFSYR.js";
+
+// packages/mesh-cli/src/commands/registry.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import * as fs2 from "fs";
+import * as path2 from "path";
+
+// packages/mesh-cli/src/commands/registry-publish.ts
+import { execFileSync, execSync } from "child_process";
+import * as fs from "fs";
+import * as path from "path";
+function repoRoot() {
+  return execSync("git rev-parse --show-toplevel", { encoding: "utf-8" }).trim();
+}
+function computeSnapshotVersion(root) {
+  const sha = execSync("git rev-parse --short HEAD", { cwd: root, encoding: "utf-8" }).trim();
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[-:T]/g, "").slice(0, 14);
+  return `0.0.0-dev.${stamp}.${sha}`;
+}
+function setPackageVersion(file, version) {
+  const content = fs.readFileSync(file, "utf-8");
+  const next = content.replace(/"version"(\s*:\s*)"[^"]*"/, `"version"$1"${version}"`);
+  fs.writeFileSync(file, next);
+}
+function dirtyPackageJsons(root) {
+  const out = execSync("git diff --name-only", { cwd: root, encoding: "utf-8" });
+  return new Set(
+    out.split("\n").map((s) => s.trim()).filter((s) => s.endsWith("package.json"))
+  );
+}
+function registerRegistryPublish(registry) {
+  registry.command("publish").description(
+    "Publish an in-development snapshot of @mesh-tech packages to CodeArtifact (dev dist-tag)"
+  ).argument("[context]", 'Platform context for Zitadel auth (e.g. "mesh.dev")').option(
+    "--snapshot",
+    "Publish a dev snapshot build (required \u2014 real releases go through changesets/CI)",
+    false
+  ).option("--tag <tag>", "dist-tag to publish the snapshot under", "dev").option(
+    "--only <pkgs>",
+    "Comma-separated substring filter, e.g. --only agent-sdk,app-kit (default: all publishable)"
+  ).option("--dry-run", "Build + resolve versions but do not upload", false).option("--role <arn>", "IAM role ARN for registry access").action(async (context, opts) => {
+    if (!opts.snapshot) {
+      logError(
+        "mesh registry publish currently supports only snapshot (dev) builds.\n\nRe-run with --snapshot. Real releases go through changesets + the\nchangeset-version CI workflow, not this command."
+      );
+      process.exit(1);
+    }
+    const root = repoRoot();
+    const awsCreds = resolveCredentials(context, opts.role);
+    const env = Object.keys(awsCreds).length > 0 ? { ...process.env, ...awsCreds } : void 0;
+    logInfo("Authenticating with CodeArtifact...");
+    if (!codeartifactLogin(env)) {
+      logError("CodeArtifact login failed. Run: mesh registry login <context>");
+      process.exit(1);
+    }
+    const listPath = path.join(root, "scripts/lib/publishable-packages.json");
+    const all = JSON.parse(fs.readFileSync(listPath, "utf-8"));
+    const patterns = (opts.only ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+    const selected = patterns.length ? all.filter((p) => patterns.some((pat) => p.dir.includes(pat) || p.name.includes(pat))) : all;
+    if (selected.length === 0) {
+      logError(`No publishable package matched --only '${opts.only}'`);
+      process.exit(1);
+    }
+    const version = computeSnapshotVersion(root);
+    logInfo(`Snapshot version: ${version} (dist-tag '${opts.tag}')`);
+    const preDirty = dirtyPackageJsons(root);
+    const backups = [];
+    const stamp = (dir) => {
+      const file = path.join(root, dir, "package.json");
+      if (!fs.existsSync(file)) return;
+      backups.push({ file, content: fs.readFileSync(file, "utf-8") });
+      setPackageVersion(file, version);
+    };
+    try {
+      for (const p of selected) {
+        stamp(p.dir);
+        for (const sub of p.subPackages ?? []) {
+          stamp(path.join(p.dir, typeof sub === "string" ? sub : sub.dir));
+        }
+      }
+      const args = [
+        "scripts/publish-packages.sh",
+        "--tag",
+        opts.tag,
+        "--skip-latest",
+        // Pass the TS-resolved DIRS (not the raw patterns) so the shell's
+        // dir-substring --only filter selects exactly the set we stamped —
+        // a name-only pattern would otherwise stamp here but be skipped there.
+        ...patterns.length ? ["--only", selected.map((p) => p.dir).join(",")] : [],
+        ...opts.dryRun ? ["--dry-run"] : []
+      ];
+      logInfo(`Publishing ${selected.length} package(s)...`);
+      execFileSync("bash", args, { cwd: root, stdio: "inherit", env: env ?? process.env });
+    } finally {
+      for (const b of backups) fs.writeFileSync(b.file, b.content);
+      logInfo("Restored source package.json versions.");
+      const collateral = [...dirtyPackageJsons(root)].filter((f) => !preDirty.has(f));
+      if (collateral.length) {
+        try {
+          execFileSync("git", ["checkout", "--", ...collateral], { cwd: root, stdio: "inherit" });
+          logInfo(`Reverted ${collateral.length} package.json file(s) re-vendored by build:publish.`);
+        } catch {
+          logError(
+            `Could not auto-revert build:publish side-effects \u2014 run \`git checkout --\` on:
+  ${collateral.join("\n  ")}`
+          );
+        }
+      }
+    }
+    logSuccess(`Published snapshot ${version} under dist-tag '${opts.tag}'.`);
+    console.log(
+      "\nPin these EXACTLY in the consumer repo (prereleases are never auto-resolved by ^/~):"
+    );
+    for (const p of selected) console.log(`  "${p.name}": "${version}",`);
+    console.log(
+      `
+Or always grab the newest dev build:
+  pnpm add ${selected.map((p) => `${p.name}@${opts.tag}`).join(" ")}`
+    );
+  });
+}
+
+// packages/mesh-cli/src/commands/registry.ts
+var CA_DOMAIN = "mesh-platform";
+var CA_REPOSITORY = "mesh-packages";
+var CA_NAMESPACE = "@mesh-tech";
+var CA_REGION = "us-east-2";
+var DEFAULT_REGISTRY_ROLE = null;
+function getEndpoint(env) {
+  try {
+    const result = execFileSync2("aws", [
+      "codeartifact",
+      "get-repository-endpoint",
+      "--domain",
+      CA_DOMAIN,
+      "--repository",
+      CA_REPOSITORY,
+      "--format",
+      "npm",
+      "--region",
+      CA_REGION,
+      "--output",
+      "text",
+      "--query",
+      "repositoryEndpoint"
+    ], {
+      encoding: "utf-8",
+      env: env ? { ...process.env, ...env } : void 0,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    return result.trim() || null;
+  } catch {
+    return null;
+  }
+}
+function codeartifactLogin(env) {
+  try {
+    execFileSync2("aws", [
+      "codeartifact",
+      "login",
+      "--tool",
+      "npm",
+      "--domain",
+      CA_DOMAIN,
+      "--repository",
+      CA_REPOSITORY,
+      "--namespace",
+      CA_NAMESPACE,
+      "--region",
+      CA_REGION
+    ], {
+      encoding: "utf-8",
+      env: env ? { ...process.env, ...env } : void 0,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function parseTenantEnv(context) {
+  const parts = context.split(".");
+  if (parts.length !== 2 || !parts[0] || !parts[1]) return null;
+  return { tenant: parts[0], env: parts[1] };
+}
+async function getRegistrySsmExport(tenant, env) {
+  try {
+    const { SSMClient, GetParameterCommand } = await import("@aws-sdk/client-ssm");
+    const region = process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? CA_REGION;
+    const ssm = new SSMClient({ region });
+    const ssmPath = `/mesh-platform/${tenant}/${env}/registry`;
+    const response = await ssm.send(new GetParameterCommand({ Name: ssmPath }));
+    if (!response.Parameter?.Value) return null;
+    return JSON.parse(response.Parameter.Value);
+  } catch {
+    return null;
+  }
+}
+function resolvePublisherRoleArn({
+  roleArnFlag,
+  ssmArn
+}) {
+  const resolved = roleArnFlag || ssmArn;
+  if (!resolved) {
+    throw new Error(
+      "No publisher role: pass --role or ensure the registry stack exported publisherRoleArn."
+    );
+  }
+  return resolved;
+}
+function assumeRole(roleArn) {
+  try {
+    const result = execFileSync2("aws", [
+      "sts",
+      "assume-role",
+      "--role-arn",
+      roleArn,
+      "--role-session-name",
+      "mesh-registry",
+      "--output",
+      "json"
+    ], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
+    const creds = JSON.parse(result).Credentials;
+    return {
+      AWS_ACCESS_KEY_ID: creds.AccessKeyId,
+      AWS_SECRET_ACCESS_KEY: creds.SecretAccessKey,
+      AWS_SESSION_TOKEN: creds.SessionToken
+    };
+  } catch {
+    return null;
+  }
+}
+function assumeRoleWithWebIdentity(roleArn, idToken, sessionName) {
+  try {
+    const result = execFileSync2("aws", [
+      "sts",
+      "assume-role-with-web-identity",
+      "--role-arn",
+      roleArn,
+      "--web-identity-token",
+      idToken,
+      "--role-session-name",
+      sessionName,
+      "--output",
+      "json"
+    ], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
+    const creds = JSON.parse(result).Credentials;
+    return {
+      AWS_ACCESS_KEY_ID: creds.AccessKeyId,
+      AWS_SECRET_ACCESS_KEY: creds.SecretAccessKey,
+      AWS_SESSION_TOKEN: creds.SessionToken
+    };
+  } catch {
+    return null;
+  }
+}
+function resolveCredentials(context, roleArn) {
+  if (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SESSION_TOKEN) {
+    logInfo("Using existing AWS credentials from environment");
+    return {};
+  }
+  if (context) {
+    const meshCreds = readCredentials(context);
+    if (meshCreds && new Date(meshCreds.expiresAt) > /* @__PURE__ */ new Date()) {
+      const targetRole = roleArn || DEFAULT_REGISTRY_ROLE;
+      if (targetRole) {
+        const sessionName = (meshCreds.email ?? "mesh-registry").replace(/[^a-zA-Z0-9=,.@-]/g, "_").slice(0, 64);
+        logInfo(`Assuming registry role via Zitadel (${meshCreds.email ?? context})`);
+        const creds = assumeRoleWithWebIdentity(targetRole, meshCreds.idToken, sessionName);
+        if (creds) {
+          logSuccess("Assumed registry role via Zitadel");
+          return creds;
+        }
+        logWarn("Zitadel JWT role assumption failed \u2014 falling back to AWS profile");
+      } else {
+        logInfo(`Zitadel auth available (${meshCreds.email}) but no registry role configured \u2014 using AWS profile`);
+      }
+    } else if (meshCreds) {
+      logWarn(`Zitadel token expired for ${context}. Run: mesh login ${context}`);
+    } else {
+      logWarn(`No Zitadel credentials for ${context}. Run: mesh login ${context}`);
+    }
+  }
+  if (roleArn) {
+    logInfo(`Assuming ${roleArn.split("/").pop()} via AWS SSO`);
+    const creds = assumeRole(roleArn);
+    if (creds) {
+      logSuccess("Assumed registry role via AWS SSO");
+      return creds;
+    }
+    logWarn("Role assumption failed \u2014 trying current credentials directly");
+  }
+  logInfo("Using current AWS profile");
+  return {};
+}
+function findProjectRoot() {
+  let dir = process.cwd();
+  while (true) {
+    if (fs2.existsSync(path2.join(dir, "pnpm-workspace.yaml")) || fs2.existsSync(path2.join(dir, "pnpm-lock.yaml")) || fs2.existsSync(path2.join(dir, "Pulumi.yaml")) || fs2.existsSync(path2.join(dir, ".npmrc"))) {
+      return dir;
+    }
+    const parent = path2.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function ensureProjectNpmrc(endpoint) {
+  const projectRoot = findProjectRoot() ?? process.cwd();
+  const npmrcPath = path2.join(projectRoot, ".npmrc");
+  const scopeLine = `${CA_NAMESPACE}:registry=${endpoint}`;
+  if (!fs2.existsSync(npmrcPath)) {
+    fs2.writeFileSync(npmrcPath, scopeLine + "\n", "utf-8");
+    return { created: true, updated: false, path: npmrcPath };
+  }
+  const content = fs2.readFileSync(npmrcPath, "utf-8");
+  const scopeRegex = new RegExp(`^${CA_NAMESPACE.replace("/", "\\/")}:registry=.+$`, "m");
+  if (scopeRegex.test(content)) {
+    if (content.includes(scopeLine)) {
+      return { created: false, updated: false, path: npmrcPath };
+    }
+    const updated = content.replace(scopeRegex, scopeLine);
+    fs2.writeFileSync(npmrcPath, updated, "utf-8");
+    return { created: false, updated: true, path: npmrcPath };
+  }
+  const separator = content.endsWith("\n") ? "" : "\n";
+  fs2.writeFileSync(npmrcPath, content + separator + scopeLine + "\n", "utf-8");
+  return { created: false, updated: true, path: npmrcPath };
+}
+function applyGrantToUserNpmrc(grant, npmrcPath = homeNpmrcPath()) {
+  let existing = "";
+  try {
+    existing = fs2.readFileSync(npmrcPath, "utf-8");
+  } catch {
+  }
+  const content = upsertNpmrcLines(existing, [
+    { key: `${grant.scope}:registry`, value: grant.endpoint },
+    { key: `${npmrcAuthKeyForEndpoint(grant.endpoint)}:_authToken`, value: grant.authorizationToken }
+  ]);
+  fs2.mkdirSync(path2.dirname(npmrcPath), { recursive: true });
+  fs2.writeFileSync(npmrcPath, content, { mode: 384 });
+  try {
+    fs2.chmodSync(npmrcPath, 384);
+  } catch {
+  }
+  return { path: npmrcPath };
+}
+function describeBrokerFailure(failure, account = {}) {
+  const unverified = account.emailVerified === false ? `
+  Your Mesh account${account.email ? ` (${account.email})` : ""} has never confirmed its email address, and an unconfirmed account cannot hold a registry grant.
+  This is not something a role fixes: ask your Mesh contact to verify the address on your account (a self-registered, passkey-only sign-up lands here), then run: mesh registry logout && mesh registry login` : "";
+  switch (failure.kind) {
+    case "no-broker":
+      return {
+        message: "The registry publishes no broker \u2014 using the AWS paths.",
+        fatal: false
+      };
+    case "no-session":
+      return {
+        message: "No registry session \u2014 using the AWS paths.",
+        hint: "mesh registry login",
+        fatal: false
+      };
+    case "unauthenticated":
+      return {
+        message: "The registry broker rejected your session (expired or wrong audience)." + unverified,
+        hint: "mesh registry logout && mesh registry login",
+        fatal: false
+      };
+    case "not-authorized":
+      return {
+        // The whole message lives in the body, not in a `remediation.command`:
+        // the answer here is "ask a human for a role", which is not a command
+        // anyone can run, and rendering a URL behind "→ run:" reads as one.
+        message: `Your Mesh account${failure.email ? ` (${failure.email})` : ""} is not authorized to read ${CA_NAMESPACE} packages.` + (failure.requiredRoles?.length ? `
+  Needs one of these Zitadel roles: ${failure.requiredRoles.join(", ")}` : "") + (failure.requestUrl ? `
+  Request access: ${failure.requestUrl}` : "\n  Ask a Mesh platform admin to grant your account registry access.") + `
+  ${NOT_AUTHORIZED_RERUN}` + unverified,
+        fatal: true
+      };
+    case "unavailable":
+      return {
+        message: `Registry broker unavailable (${failure.detail}) \u2014 falling back to the AWS paths.`,
+        fatal: false
+      };
+  }
+}
+var RegistryNotAuthorizedError = class extends MeshCliError {
+  constructor(message) {
+    super(message);
+    this.name = "RegistryNotAuthorizedError";
+  }
+};
+function registrySignInAllowed(opts, hasTty = Boolean(process.stdin.isTTY && process.stdout.isTTY)) {
+  return Boolean(opts.device) || hasTty;
+}
+function shouldRemintAfter(failure) {
+  return failure.kind === "not-authorized";
+}
+var NOT_AUTHORIZED_RERUN = "Once granted, run: mesh registry login   (it re-mints your sign-in; still refused? mesh registry logout && mesh registry login)";
+var CONTEXT_IGNORED_NOTICE = "The registry is global \u2014 the context argument is no longer needed (ignored).";
+async function tryBrokerLogin(opts) {
+  if (opts.broker === false) return { outcome: { kind: "skipped-flag", flag: "--no-broker" } };
+  if (opts.ci) return { outcome: { kind: "skipped-flag", flag: "--ci" } };
+  let identity;
+  try {
+    identity = await resolveRegistryIdentity();
+  } catch (err) {
+    const detail2 = err.message.split("\n")[0] ?? String(err);
+    logWarn(`Registry broker unavailable (${detail2}) \u2014 falling back to the AWS paths.`);
+    return { outcome: { kind: "unavailable", detail: detail2 } };
+  }
+  logRegistryIdentity(identity);
+  const session = await ensureRegistrySession({
+    device: opts.device,
+    interactive: registrySignInAllowed(opts)
+  });
+  if (!session.ok) {
+    if (session.reason === "login-failed") {
+      throw new MeshCliError(`Registry sign-in failed: ${session.detail}`, {
+        remediation: { command: opts.device ? "mesh registry login --device" : "mesh registry login" }
+      });
+    }
+    logWarn(`No registry session (${session.detail}) \u2014 falling back to the AWS paths.`);
+    return { outcome: { kind: "no-session", detail: session.detail } };
+  }
+  logInfo(`Registry session: ${session.email}`);
+  let result = await requestGrant(session.context, identity);
+  if (!result.ok && (result.failure.kind === "unauthenticated" || result.failure.kind === "unavailable")) {
+    let fresh = null;
+    try {
+      fresh = await resolveRegistryIdentity({ refresh: true });
+    } catch {
+    }
+    if (fresh && identityChanged(identity, fresh)) {
+      logInfo(`Registry identity changed since it was cached \u2014 retrying with ${fresh.registryBroker}`);
+      identity = fresh;
+      result = await requestGrant(session.context, identity);
+    }
+  }
+  if (!result.ok && shouldRemintAfter(result.failure)) {
+    const { rolesChanged } = await refreshRegistrySession(session.context);
+    if (rolesChanged) {
+      logInfo("Your sign-in now carries a role it did not have \u2014 retrying\u2026");
+      result = await requestGrant(session.context, identity);
+    }
+  }
+  if (result.ok) return { grant: result.grant };
+  const { message, hint, fatal } = describeBrokerFailure(
+    result.failure,
+    registryAccountState(readCredentials(session.context)?.idToken)
+  );
+  if (fatal) {
+    throw new RegistryNotAuthorizedError(message);
+  }
+  logWarn(message);
+  if (hint) logInfo(`  Try: ${hint}`);
+  const detail = result.failure.kind === "unavailable" ? result.failure.detail : result.failure.kind;
+  return { outcome: { kind: "unavailable", detail } };
+}
+async function requestGrant(sessionContext, identity) {
+  logInfo(`Requesting a registry token from ${identity.registryBroker} (no AWS credentials needed)\u2026`);
+  return fetchRegistryGrant(sessionContext, identity.registryBroker, {
+    ...realGrantDeps(),
+    timeoutMs: PUBLISHED_BROKER_TIMEOUT_MS
+  });
+}
+function shouldRepairUserNpmrc(opts) {
+  return !opts.ci;
+}
+function repairUnscopedRegistry(npmrcPath = homeNpmrcPath()) {
+  let original;
+  try {
+    original = fs2.readFileSync(npmrcPath, "utf-8");
+  } catch {
+    return { removed: null };
+  }
+  const { content, removed } = stripUnscopedCodeArtifactRegistry(original);
+  if (!removed) return { removed: null };
+  const backupPath = `${npmrcPath}.bak-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
+  try {
+    fs2.writeFileSync(backupPath, original, "utf-8");
+    fs2.writeFileSync(npmrcPath, content, "utf-8");
+  } catch (err) {
+    return { removed: null, error: err instanceof Error ? err.message : String(err) };
+  }
+  return { removed, backupPath };
+}
+function renderRegistrySessionLine(session, now = Date.now()) {
+  if (!session) return "No registry session \u2014 run: mesh registry login";
+  return `Registry session: ${session.email} (expires in ${describeSessionExpiry(session.expiresAt, now)})`;
+}
+async function checkExistingToken() {
+  const npmrcPath = homeNpmrcPath();
+  if (!fs2.existsSync(npmrcPath)) return { valid: false, state: "missing", reason: "no ~/.npmrc" };
+  const hijackLine = findUnscopedCodeArtifactRegistry(
+    fs2.readFileSync(npmrcPath, "utf-8")
+  ) ?? void 0;
+  const probe = await probeRegistryToken({ npmrcPath });
+  if (probe.state === "missing") {
+    return { valid: false, state: probe.state, reason: "no CodeArtifact token in ~/.npmrc", hijackLine };
+  }
+  if (probe.state === "expired") {
+    return {
+      valid: false,
+      state: probe.state,
+      reason: probe.detail ?? "the CodeArtifact token is expired",
+      hijackLine
+    };
+  }
+  if (probe.state === "unreachable") {
+    return {
+      valid: false,
+      state: probe.state,
+      reason: `could not reach the registry to verify the token (${probe.detail ?? "unknown error"})`,
+      hijackLine
+    };
+  }
+  if (hijackLine) {
+    return { valid: false, state: probe.state, reason: "unscoped CodeArtifact registry", hijackLine };
+  }
+  return { valid: true, state: probe.state, endpoint: getEndpoint() ?? void 0 };
+}
+async function runRegistryStatus(opts) {
+  const { valid, state, endpoint, reason, hijackLine } = await (opts?.check ?? checkExistingToken)();
+  if (hijackLine) {
+    logWarn(
+      "~/.npmrc sets CodeArtifact as your DEFAULT registry \u2014 every public npm install goes through it and will 401 when the 12h token expires:"
+    );
+    logInfo(`  ${hijackLine.trim()}`);
+    logInfo("Fix: mesh registry login   # removes it (backup taken) and keeps @mesh-tech scoped");
+  }
+  const unverifiable = state === "unreachable" && !hijackLine;
+  if (!valid && !unverifiable) {
+    logWarn(`Registry auth is not usable${reason ? ` \u2014 ${reason}` : ""}. Run: mesh registry login`);
+    return 1;
+  }
+  if (unverifiable) {
+    logWarn(`Could not verify the CodeArtifact token in ~/.npmrc \u2014 ${reason}.`);
+    logInfo("Nothing to fix from here; retry when the registry is reachable.");
+  } else {
+    logSuccess("CodeArtifact token in ~/.npmrc is valid");
+    if (endpoint) {
+      logInfo(`Endpoint: ${endpoint}`);
+    }
+  }
+  logInfo(renderRegistrySessionLine(opts?.session ?? readRegistrySession()));
+  const projectRoot = findProjectRoot();
+  if (projectRoot) {
+    const npmrcPath = path2.join(projectRoot, ".npmrc");
+    if (fs2.existsSync(npmrcPath)) {
+      const content = fs2.readFileSync(npmrcPath, "utf-8");
+      if (content.includes(`${CA_NAMESPACE}:registry=`)) {
+        logSuccess(`Project .npmrc configured (${npmrcPath})`);
+      } else {
+        logWarn(`Project .npmrc exists but missing ${CA_NAMESPACE} scope (${npmrcPath})`);
+        logInfo("Run: mesh registry login");
+      }
+    } else {
+      logWarn(`No .npmrc in project root (${projectRoot})`);
+      logInfo("Run: mesh registry login");
+    }
+  }
+  return 0;
+}
+function ensureSsoProfile(profile) {
+  const awsConfig = readAwsConfig();
+  if (awsConfig && !awsConfigHasProfile(awsConfig, profile)) {
+    throw new MeshCliError(
+      `AWS profile '${profile}' is not defined in ~/.aws/config \u2014 \`aws sso login --profile ${profile}\` cannot work until it exists.
+
+If you only need to INSTALL @mesh-tech packages, drop --profile: \`mesh registry login\` uses the
+Zitadel-gated broker and needs no AWS account at all.
+
+If you DEPLOY and genuinely need this profile \u2014 one-time setup: \`aws configure sso --profile ${profile}\`,
+or add the session + profile by hand:
+${SSO_SESSION_SNIPPET}
+[profile ${profile}]
+sso_session = mesh
+sso_account_id = <account id>
+sso_role_name = <role>
+region = us-east-2`,
+      { remediation: { command: `aws configure sso --profile ${profile}` } }
+    );
+  }
+  const probe = () => execFileSync2("aws", ["sts", "get-caller-identity", "--profile", profile], {
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: 2e4
+  });
+  try {
+    probe();
+    logInfo(`AWS SSO session for profile '${profile}' is live`);
+    return;
+  } catch {
+    logInfo(`AWS SSO session for profile '${profile}' is stale \u2014 opening browser login\u2026`);
+  }
+  execFileSync2("aws", ["sso", "login", "--profile", profile], { stdio: "inherit" });
+  try {
+    probe();
+  } catch (err) {
+    throw new MeshCliError(
+      `AWS SSO login for profile '${profile}' completed but the session still fails an identity check.`,
+      {
+        remediation: { command: `aws sts get-caller-identity --profile ${profile}   # see the underlying error` },
+        cause: err
+      }
+    );
+  }
+  logSuccess(`AWS SSO session refreshed (profile '${profile}')`);
+}
+async function runRegistryLogin(context, opts) {
+  let roleArn = opts.role;
+  if (opts.publish) {
+    let ssmArn;
+    if (!opts.role) {
+      if (!context) {
+        throw new MeshCliError(
+          '`--publish` requires a platform context, e.g. "mesh registry login mesh.dev --publish".'
+        );
+      }
+      const parsed = parseTenantEnv(context);
+      if (!parsed) {
+        throw new MeshCliError(
+          `Could not parse tenant/env from context "${context}" (expected "<tenant>.<env>").`
+        );
+      }
+      const registryExport = await getRegistrySsmExport(parsed.tenant, parsed.env);
+      ssmArn = registryExport?.publisherRoleArn;
+    }
+    try {
+      roleArn = resolvePublisherRoleArn({ roleArnFlag: opts.role, ssmArn });
+    } catch (err) {
+      throw new MeshCliError(err.message);
+    }
+    logInfo(`Publisher role resolved: ${roleArn}`);
+  }
+  let outcome;
+  if (opts.publish) {
+    outcome = { kind: "skipped-flag", flag: "--publish" };
+  } else if (opts.profile) {
+    outcome = { kind: "skipped-profile", profile: opts.profile };
+  } else {
+    if (context && opts.broker !== false && !opts.ci) logInfo(CONTEXT_IGNORED_NOTICE);
+    const attempt = await tryBrokerLogin(opts);
+    if ("grant" in attempt) {
+      const { path: npmrcPath } = applyGrantToUserNpmrc(attempt.grant);
+      logSuccess(
+        `Registry token issued by the Mesh broker \u2192 ${npmrcPath}` + (attempt.grant.expiresAt ? ` (expires ${attempt.grant.expiresAt})` : "")
+      );
+      if (shouldRepairUserNpmrc(opts)) {
+        const repair = repairUnscopedRegistry();
+        if (repair.removed) {
+          logWarn(
+            "Removed an unscoped CodeArtifact `registry=` from ~/.npmrc \u2014 it routed ALL npm traffic (public packages included) through CodeArtifact."
+          );
+          logInfo(`  removed: ${repair.removed.trim()}`);
+          if (repair.backupPath) logInfo(`  backup:  ${repair.backupPath}`);
+        }
+      }
+      if (!opts.ci && !opts.skipNpmrc) {
+        const result = ensureProjectNpmrc(attempt.grant.endpoint);
+        if (result.created) {
+          logSuccess(`Created ${result.path} with ${CA_NAMESPACE} registry scope`);
+        } else if (result.updated) {
+          logSuccess(`Updated ${CA_NAMESPACE} registry in ${result.path}`);
+        } else {
+          logInfo(`${result.path} already configured`);
+        }
+      }
+      logSuccess(`Ready \u2014 run pnpm install to fetch ${CA_NAMESPACE} packages`);
+      return;
+    }
+    outcome = attempt.outcome;
+  }
+  let env;
+  if (opts.profile) {
+    ensureSsoProfile(opts.profile);
+    env = { ...process.env, AWS_PROFILE: opts.profile };
+    for (const key of ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN"]) {
+      delete env[key];
+    }
+  } else {
+    const awsCreds = resolveCredentials(context, roleArn);
+    env = Object.keys(awsCreds).length > 0 ? { ...process.env, ...awsCreds } : void 0;
+  }
+  logInfo("Authenticating with CodeArtifact...");
+  if (!codeartifactLogin(env)) {
+    throw new MeshCliError(describeAwsChainFailure(outcome));
+  }
+  logSuccess("CodeArtifact token refreshed (valid for 12 hours)");
+  if (shouldRepairUserNpmrc(opts)) {
+    const repair = repairUnscopedRegistry();
+    if (repair.removed) {
+      logWarn(
+        `Removed an unscoped CodeArtifact \`registry=\` from ~/.npmrc \u2014 it routed ALL npm traffic (public packages included) through CodeArtifact, so every install broke when the 12h token expired. ${CA_NAMESPACE} stays scoped; public packages now go to npmjs.`
+      );
+      logInfo(`  removed: ${repair.removed.trim()}`);
+      if (repair.backupPath) logInfo(`  backup:  ${repair.backupPath}`);
+    } else if (repair.error) {
+      logWarn(`Could not repair ~/.npmrc (${repair.error}) \u2014 remove any unscoped \`registry=\` line by hand.`);
+    }
+  }
+  const endpoint = getEndpoint(env);
+  if (!endpoint) {
+    logWarn("Could not retrieve registry endpoint \u2014 .npmrc scope not configured");
+    logInfo("You may need to manually add to .npmrc:");
+    logInfo(`  ${CA_NAMESPACE}:registry=https://mesh-platform-<ACCOUNT>.d.codeartifact.${CA_REGION}.amazonaws.com/npm/${CA_REPOSITORY}/`);
+    return;
+  }
+  if (!opts.ci && !opts.skipNpmrc) {
+    const result = ensureProjectNpmrc(endpoint);
+    if (result.created) {
+      logSuccess(`Created ${result.path} with ${CA_NAMESPACE} registry scope`);
+    } else if (result.updated) {
+      logSuccess(`Updated ${CA_NAMESPACE} registry in ${result.path}`);
+    } else {
+      logInfo(`${result.path} already configured`);
+    }
+  }
+  logSuccess(`Ready \u2014 run pnpm install to fetch ${CA_NAMESPACE} packages`);
+}
+function describeAwsChainFailure(outcome) {
+  switch (outcome.kind) {
+    case "skipped-profile":
+      return `AWS profile '${outcome.profile}' cannot read the Mesh registry (aws codeartifact login failed).
+
+--profile is for people who DEPLOY with an AWS account that is allowed to read the registry
+(Trabian's mesh-dev profile, or a tenant deployer role). Any other profile fails here.
+
+To install packages you do not need AWS at all \u2014 drop the flag:
+  mesh registry login`;
+    case "unavailable":
+      return `Registry broker unavailable (${outcome.detail}) and this machine has no AWS path either.
+
+Retry in a minute: mesh registry login
+If you deploy and have an AWS account: mesh registry login --profile mesh-dev`;
+    case "no-session":
+      return `No registry session on this machine (${outcome.detail}) and the AWS chain failed too.
+
+Sign in once \u2014 on a headless box: mesh registry login --device
+In CI with AWS creds: mesh registry login --ci`;
+    case "skipped-flag":
+      return `CodeArtifact login failed with the AWS credential chain (${outcome.flag} skips the registry broker).
+
+This path needs AWS credentials that can read the registry \u2014 ambient keys, a live SSO
+session, or --profile <deployer-profile>.
+
+To install packages you do not need AWS at all \u2014 drop the flag:
+  mesh registry login`;
+  }
+}
+function registerRegistryCommands(program) {
+  const registry = program.command("registry").description(
+    "PACKAGE access: the sign-in that makes @mesh-tech/* installable. One global identity \u2014 no AWS account, no platform, no `<tenant>.<env>` context. (`mesh login <tenant>.<env>` is the other one; that is for deploying to or operating a platform.)"
+  );
+  registry.command("login").description(
+    "Sign in to the Mesh package registry (browser, or device code with --device) and configure ~/.npmrc + the project .npmrc. Needs no platform context and no AWS account."
+  ).argument(
+    "[context]",
+    "Platform context \u2014 only meaningful with --publish (publisher role from that context's SSM export) or on the explicit AWS chain; ignored on the default read path, which is global"
+  ).option("--device", "Sign in with the device-code flow (headless box, SSH, no browser)").option("--role <arn>", "IAM role ARN for registry access").option("--ci", "CI mode \u2014 AWS chain only (ambient credentials), refresh token only, skip project .npmrc setup").option("--skip-npmrc", "Skip project .npmrc setup").option("--profile <name>", "AWS SSO profile of an account allowed to READ the registry (deployers only \u2014 e.g. mesh-dev); skips the broker, auto-runs `aws sso login` when the session is stale").option(
+    "--no-broker",
+    "Skip the Zitadel-gated registry broker and go straight to the AWS credential chain"
+  ).option(
+    "--publish",
+    "Assume the registry's publisher role for CodeArtifact publish access (opt-in privileged path \u2014 resolves publisherRoleArn from the registry's SSM export unless --role is given)"
+  ).action(async (context, opts) => {
+    await runRegistryLogin(context, opts);
+  });
+  registry.command("logout").description("Forget the package-registry session (platform logins under `mesh login` are untouched)").action(() => {
+    clearRegistrySession();
+    logSuccess("Registry session cleared. ~/.npmrc is untouched \u2014 its token expires on its own within 12 hours.");
+  });
+  registry.command("status").description("Check current registry authentication status \u2014 the ~/.npmrc token and the registry session").action(async () => {
+    const code = await runRegistryStatus();
+    if (code !== 0) process.exit(code);
+  });
+  registerRegistryPublish(registry);
+}
+
+export {
+  codeartifactLogin,
+  resolvePublisherRoleArn,
+  resolveCredentials,
+  applyGrantToUserNpmrc,
+  describeBrokerFailure,
+  RegistryNotAuthorizedError,
+  registrySignInAllowed,
+  shouldRemintAfter,
+  NOT_AUTHORIZED_RERUN,
+  CONTEXT_IGNORED_NOTICE,
+  shouldRepairUserNpmrc,
+  repairUnscopedRegistry,
+  renderRegistrySessionLine,
+  checkExistingToken,
+  runRegistryStatus,
+  runRegistryLogin,
+  describeAwsChainFailure,
+  registerRegistryCommands
+};