@mondaydotcomorg/z2h-cli 0.5.2 → 0.6.1

package/dist/esm/util/npm/broker-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-config.d.ts","sourceRoot":"","sources":["../../../../src/util/npm/broker-config.ts"],"names":[],"mappings":"AAkBA;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,EAAE,CAK3C;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAiBhD"}

package/dist/esm/util/npm/broker-config.mjs

@@ -0,0 +1,59 @@
+import { BROKER_NPM_SCOPE, Z2H_NPM_TOKEN_ENV, PUBLIC_NPM_REGISTRY_URL, brokerNpmRegistryUrl } from '../../constants.mjs';
+
+/** `https://host/path/` (with trailing slash) for the registry= line. */
+function registryUrlWithSlash() {
+    const url = brokerNpmRegistryUrl();
+    return url.endsWith('/') ? url : `${url}/`;
+}
+/**
+ * The `//host/path/` prefix (scheme stripped, trailing slash kept) that npm
+ * requires the `:_authToken` key to be keyed under so it aligns with the
+ * registry path. Derived from the same registry URL so staging overrides flow
+ * through.
+ */
+function authKeyPrefix() {
+    return registryUrlWithSlash().replace(/^https?:/, '');
+}
+/**
+ * The two npm config lines (§3.1 / §3.3) that route the brokered scope to the
+ * proxy and supply the `${Z2H_NPM_TOKEN}` placeholder. No literal token — npm
+ * interpolates the placeholder from the env at invocation time.
+ */
+function brokerNpmrcLines() {
+    return [
+        `${BROKER_NPM_SCOPE}:registry=${registryUrlWithSlash()}`,
+        `${authKeyPrefix()}:_authToken=\${${Z2H_NPM_TOKEN_ENV}}`,
+    ];
+}
+/**
+ * Full contents for a **workspace** `.npmrc` (§3.3): broker scope-split plus an
+ * explicit public default registry and always-auth. Used by the template and
+ * the migration so both stay byte-identical.
+ */
+function workspaceNpmrcContents() {
+    return [...brokerNpmrcLines(), `registry=${PUBLIC_NPM_REGISTRY_URL}`, 'always-auth=true'].join('\n') + '\n';
+}
+/**
+ * Full contents for a **workspace** `.yarnrc.yml` (§3.2): the brokered scope
+ * points at the proxy with the `${Z2H_NPM_TOKEN}` placeholder + always-auth;
+ * the default `npmRegistryServer` stays the public registry (direct, unchanged
+ * speed). `yarnPath` keeps the bundled Berry release so any `yarn` runs 4.x.
+ */
+function workspaceYarnrcContents() {
+    const scopeKey = BROKER_NPM_SCOPE.replace(/^@/, '');
+    return ([
+        'nodeLinker: node-modules',
+        '',
+        'npmScopes:',
+        `  ${scopeKey}:`,
+        `    npmRegistryServer: "${brokerNpmRegistryUrl()}"`,
+        `    npmAuthToken: "\${${Z2H_NPM_TOKEN_ENV}}"`,
+        '    npmAlwaysAuth: true',
+        '',
+        `npmRegistryServer: "${PUBLIC_NPM_REGISTRY_URL}"`,
+        '',
+        'yarnPath: .yarn/releases/yarn-4.5.1.cjs',
+    ].join('\n') + '\n');
+}
+
+export { brokerNpmrcLines, workspaceNpmrcContents, workspaceYarnrcContents };

package/dist/esm/util/npm/ensure-token.d.ts

@@ -0,0 +1,19 @@
+export interface EnsureZ2hTokenOptions {
+    /**
+     * Re-run the token flow even if a token already exists on disk. Used after a
+     * broker 401, where the stored token is present but expired/invalid.
+     */
+    forceRefresh?: boolean;
+}
+/**
+ * Ensure a z2h JWT exists at `~/.zth/auth.json` before an install-bearing
+ * command runs. If none is present (or `forceRefresh` is set), drive the
+ * existing `generate-z2h-token` flow — loopback capture with manual-paste
+ * fallback — which writes the token. No-ops when a token already exists and no
+ * refresh was requested.
+ *
+ * This is the install preflight: it keeps a friendly auth prompt in front of
+ * the raw npm error a non-technical user would otherwise hit.
+ */
+export declare function ensureZ2hToken(opts?: EnsureZ2hTokenOptions): Promise<void>;
+//# sourceMappingURL=ensure-token.d.ts.map

package/dist/esm/util/npm/ensure-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-token.d.ts","sourceRoot":"","sources":["../../../../src/util/npm/ensure-token.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAKpF"}

package/dist/esm/util/npm/ensure-token.mjs

@@ -0,0 +1,22 @@
+import { tryReadAuthTokenSync } from '../auth/auth-store.mjs';
+import { info } from '../logger.mjs';
+import { generateZ2HTokenCommand } from '../../commands/generate-z2h-token.mjs';
+
+/**
+ * Ensure a z2h JWT exists at `~/.zth/auth.json` before an install-bearing
+ * command runs. If none is present (or `forceRefresh` is set), drive the
+ * existing `generate-z2h-token` flow — loopback capture with manual-paste
+ * fallback — which writes the token. No-ops when a token already exists and no
+ * refresh was requested.
+ *
+ * This is the install preflight: it keeps a friendly auth prompt in front of
+ * the raw npm error a non-technical user would otherwise hit.
+ */
+async function ensureZ2hToken(opts = {}) {
+    if (opts.forceRefresh || !tryReadAuthTokenSync()) {
+        info('you need to sign in to install monday packages — opening the sign-in page');
+        await generateZ2HTokenCommand();
+    }
+}
+
+export { ensureZ2hToken };

package/dist/esm/util/npm/install.d.ts

@@ -0,0 +1,18 @@
+export interface RunYarnInstallOptions {
+    /** Directory to run `yarn install` in. */
+    cwd: string;
+    /** Extra env to merge on top of `process.env` + the broker token. */
+    extraEnv?: NodeJS.ProcessEnv;
+}
+/**
+ * Run `yarn install` for an install-bearing command:
+ *   1. Preflight — ensure a z2h token exists (prompt `generate-z2h-token` if not).
+ *   2. Install through the broker.
+ *   3. On a broker 401, surface a friendly "your access expired — refreshing it"
+ *      message, re-auth, and retry the install exactly once.
+ *
+ * A non-auth failure (real dependency error, network, etc.) propagates as-is so
+ * the command's normal error path reports it.
+ */
+export declare function runYarnInstall(opts: RunYarnInstallOptions): Promise<void>;
+//# sourceMappingURL=install.d.ts.map

package/dist/esm/util/npm/install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../../../src/util/npm/install.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,qBAAqB;IACpC,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAC9B;AAqCD;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAc/E"}

package/dist/esm/util/npm/install.mjs

@@ -0,0 +1,74 @@
+import { execa } from 'execa';
+import { warn, info } from '../logger.mjs';
+import { tryReadAuthTokenSync } from '../auth/auth-store.mjs';
+import { Z2H_NPM_TOKEN_ENV } from '../../constants.mjs';
+import { ensureZ2hToken } from './ensure-token.mjs';
+
+// Substrings that, in a failed install's output, indicate the broker rejected
+// the z2h JWT (expired/invalid). npm surfaces `E401`/`code E401`; yarn berry
+// surfaces an HTTP 401 line. We re-auth on any of these rather than dumping a
+// raw npm error on a non-technical user.
+const AUTH_FAILURE_MARKERS = ['401', 'e401', 'unauthorized', 'authentication'];
+function looksLikeAuthFailure(text) {
+    const haystack = text.toLowerCase();
+    return AUTH_FAILURE_MARKERS.some(marker => haystack.includes(marker));
+}
+/**
+ * Spawn `yarn install` in `cwd` with the npm-broker credential injected, while
+ * streaming yarn's output live to the user. stdout is inherited; stderr is
+ * piped so we can both echo it and inspect it for a broker auth failure.
+ *
+ * Returns the captured stderr on success; throws an Error tagged
+ * `isAuthFailure` when the failure output looks like a broker 401 so the
+ * caller can re-auth, or rethrows the raw execa error otherwise.
+ */
+async function spawnYarnInstall(opts) {
+    const token = tryReadAuthTokenSync();
+    const env = { ...process.env, ...(token && { [Z2H_NPM_TOKEN_ENV]: token }), ...opts.extraEnv };
+    const child = execa('yarn', ['install'], {
+        cwd: opts.cwd,
+        stdout: 'inherit',
+        stderr: ['inherit', 'pipe'],
+        env,
+    });
+    try {
+        await child;
+    }
+    catch (err) {
+        const e = err;
+        const combined = `${e.stderr}\n${e.message ?? ''}`;
+        if (looksLikeAuthFailure(combined)) {
+            const authErr = new Error('broker rejected the z2h token during install');
+            authErr.isAuthFailure = true;
+            throw authErr;
+        }
+        throw err;
+    }
+}
+/**
+ * Run `yarn install` for an install-bearing command:
+ *   1. Preflight — ensure a z2h token exists (prompt `generate-z2h-token` if not).
+ *   2. Install through the broker.
+ *   3. On a broker 401, surface a friendly "your access expired — refreshing it"
+ *      message, re-auth, and retry the install exactly once.
+ *
+ * A non-auth failure (real dependency error, network, etc.) propagates as-is so
+ * the command's normal error path reports it.
+ */
+async function runYarnInstall(opts) {
+    await ensureZ2hToken();
+    try {
+        await spawnYarnInstall(opts);
+    }
+    catch (err) {
+        if (!err.isAuthFailure) {
+            throw err;
+        }
+        warn('your access expired — refreshing it now…');
+        await ensureZ2hToken({ forceRefresh: true });
+        info('access refreshed — retrying install');
+        await spawnYarnInstall(opts);
+    }
+}
+
+export { runYarnInstall };

package/dist/esm/util/tracker.d.ts

@@ -0,0 +1,3 @@
+export declare function trackEvent(name: string, data: Record<string, unknown>): void;
+export declare function trackDuration<T>(eventName: string, fn: () => Promise<T>, data?: Record<string, unknown>): Promise<T>;
+//# sourceMappingURL=tracker.d.ts.map

package/dist/esm/util/tracker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracker.d.ts","sourceRoot":"","sources":["../../../src/util/tracker.ts"],"names":[],"mappings":"AAMA,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAO5E;AAED,wBAAsB,aAAa,CAAC,CAAC,EACnC,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,CAAC,CAAC,CAKZ"}

package/dist/esm/util/tracker.mjs

@@ -0,0 +1,20 @@
+import os from 'node:os';
+
+const DOORMAN_URL = 'https://track.bigbrain.me/prod/event';
+const username = os.userInfo().username;
+function trackEvent(name, data) {
+    void fetch(DOORMAN_URL, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ name, source: 'z2h-cli', data: { username, ...data } }),
+        signal: AbortSignal.timeout(5000),
+    }).catch(() => { });
+}
+async function trackDuration(eventName, fn, data) {
+    const start = Date.now();
+    const result = await fn();
+    trackEvent(eventName, { ...data, duration_ms: Date.now() - start });
+    return result;
+}
+
+export { trackDuration, trackEvent };

package/dist/index.js

@@ -1,4 +1,5 @@
 const node_module = require('node:module');
+const fs = require('node:fs');
 const commander = require('commander');
 const commands_dev = require('./commands/dev.js');
 const commands_build = require('./commands/build.js');
@@ -9,9 +10,18 @@ const commands_create = require('./commands/create.js');
 const commands_generateZ2hToken = require('./commands/generate-z2h-token.js');
 const commands_migrate = require('./commands/migrate.js');
 const util_logger = require('./util/logger.js');
+const util_tracker = require('./util/tracker.js');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 const { version } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.js', document.baseURI).href)))('../package.json');
+function getCwdAppName() {
+    try {
+        return JSON.parse(fs.readFileSync('package.json', 'utf8')).name;
+    }
+    catch {
+        return undefined;
+    }
+}
 async function main() {
     const program = new commander.Command();
     program
@@ -35,12 +45,9 @@ async function main() {
         .option('--json', 'emit structured JSON on stdout')
         .action(async (opts) => {
         try {
-            await commands_build.buildCommand(opts);
+            await util_tracker.trackDuration('z2h_app_build_success', () => commands_build.buildCommand(opts), { app_name: getCwdAppName() });
         }
         catch (err) {
-            // fail() emits a structured JSON error on stdout in --json mode and
-            // a red line on stderr in human mode, then exits. errorLog alone is
-            // silent in JSON mode, which leaves machine consumers with no signal.
             util_logger.fail(`build failed: ${err.message}`, { command: 'build' }, 2);
         }
     });
@@ -75,7 +82,9 @@ async function main() {
         .option('--json', 'emit structured JSON on stdout')
         .action(async (opts) => {
         try {
-            await commands_deploy.deployCommand(opts);
+            await util_tracker.trackDuration('z2h_app_deploy_success', () => commands_deploy.deployCommand(opts), {
+                app_name: getCwdAppName(),
+            });
         }
         catch (err) {
             util_logger.fail(`deploy failed: ${err.message}`, { command: 'deploy' }, 2);
@@ -115,7 +124,10 @@ async function main() {
         .option('--json', 'emit structured JSON on stdout')
         .action(async (appName, opts) => {
         try {
-            await commands_create.createCommand(appName, opts);
+            await util_tracker.trackDuration('z2h_app_created', () => commands_create.createCommand(appName, opts), {
+                app_name: appName,
+                template: opts.template ?? 'default',
+            });
         }
         catch (err) {
             util_logger.fail(`create failed: ${err.message}`, { command: 'create' }, 1);

package/dist/migrations/003-npm-broker-scope-split.d.ts

@@ -0,0 +1,14 @@
+import type { Tree } from '@nx/devkit';
+/**
+ * Migrate the workspace npm/yarn config from the legacy single-registry
+ * `${NPM_TOKEN}` form to the `@mondaydotcomorg`→broker scope-split
+ * (`${Z2H_NPM_TOKEN}` placeholder). Rewrites the workspace-root `.yarnrc.yml`
+ * and `.npmrc`, plus any consumer-app copies that still carry the legacy
+ * placeholder (migration 001 normally removes per-consumer `.yarnrc.yml`, so
+ * this is just defensive cleanup).
+ *
+ * The global `~/.npmrc` broker block is written separately by `migrateCommand`
+ * (it lives outside the workspace Tree).
+ */
+export default function npmBrokerScopeSplit(tree: Tree): void;
+//# sourceMappingURL=003-npm-broker-scope-split.d.ts.map

package/dist/migrations/003-npm-broker-scope-split.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"003-npm-broker-scope-split.d.ts","sourceRoot":"","sources":["../../src/migrations/003-npm-broker-scope-split.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAuBvC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,OAAO,UAAU,mBAAmB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAgB5D"}

package/dist/migrations/003-npm-broker-scope-split.js

@@ -0,0 +1,51 @@
+Object.defineProperties(exports, { __esModule: { value: true }, [Symbol.toStringTag]: { value: 'Module' } });
+
+const util_npm_brokerConfig = require('../util/npm/broker-config.js');
+
+// Legacy marker: the old configs interpolated a real npm token via
+// `${NPM_TOKEN}`. Its presence means the file predates npm brokering and must
+// be rewritten to the scope-split. Once rewritten (placeholder is now
+// `${Z2H_NPM_TOKEN}`) this no longer matches, so the migration is idempotent.
+const LEGACY_TOKEN_PLACEHOLDER = '${NPM_TOKEN}';
+/**
+ * Rewrite a single rc file to `contents` iff it exists and still carries the
+ * legacy `${NPM_TOKEN}` placeholder. Returns nothing; mutates the Tree.
+ */
+function rewriteIfLegacy(tree, filePath, contents) {
+    if (!tree.exists(filePath)) {
+        return;
+    }
+    const current = tree.read(filePath, 'utf-8') ?? '';
+    if (!current.includes(LEGACY_TOKEN_PLACEHOLDER)) {
+        return; // already migrated (or never legacy) — leave untouched
+    }
+    tree.write(filePath, contents);
+}
+/**
+ * Migrate the workspace npm/yarn config from the legacy single-registry
+ * `${NPM_TOKEN}` form to the `@mondaydotcomorg`→broker scope-split
+ * (`${Z2H_NPM_TOKEN}` placeholder). Rewrites the workspace-root `.yarnrc.yml`
+ * and `.npmrc`, plus any consumer-app copies that still carry the legacy
+ * placeholder (migration 001 normally removes per-consumer `.yarnrc.yml`, so
+ * this is just defensive cleanup).
+ *
+ * The global `~/.npmrc` broker block is written separately by `migrateCommand`
+ * (it lives outside the workspace Tree).
+ */
+function npmBrokerScopeSplit(tree) {
+    const yarnrc = util_npm_brokerConfig.workspaceYarnrcContents();
+    const npmrc = util_npm_brokerConfig.workspaceNpmrcContents();
+    // Workspace root.
+    rewriteIfLegacy(tree, '.yarnrc.yml', yarnrc);
+    rewriteIfLegacy(tree, '.npmrc', npmrc);
+    // Any consumer apps that still carry their own legacy rc files.
+    for (const entry of tree.children('.')) {
+        if (entry.startsWith('.')) {
+            continue;
+        }
+        rewriteIfLegacy(tree, `${entry}/.yarnrc.yml`, yarnrc);
+        rewriteIfLegacy(tree, `${entry}/.npmrc`, npmrc);
+    }
+}
+
+exports.default = npmBrokerScopeSplit;

package/dist/migrations/__tests__/003-npm-broker-scope-split.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=003-npm-broker-scope-split.test.d.ts.map

package/dist/migrations/__tests__/003-npm-broker-scope-split.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"003-npm-broker-scope-split.test.d.ts","sourceRoot":"","sources":["../../../src/migrations/__tests__/003-npm-broker-scope-split.test.ts"],"names":[],"mappings":""}

package/dist/migrations/auto-migrate.js

@@ -159,9 +159,9 @@ async function autoMigrate(cliVersion, dryRun = false) {
             }
         }
         catch (err) {
-            util_logger.warn(`  ✗ migration "${name}" failed: ${err.message}`);
-            util_logger.warn('    skipping remaining migrations. Run "z2h-cli migrate" to retry.');
-            return;
+            const errorMessage = `migration "${name}" failed: ${err.message}`;
+            util_logger.errorLog(`${errorMessage}\nSkipping remaining migrations — run "z2h-cli migrate" to retry.`);
+            throw new Error(errorMessage);
         }
     }
     if (needsInstall) {

package/dist/shadow/sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/shadow/sync.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE3D;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB9F"}
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/shadow/sync.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE3D;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAe9F"}

package/dist/shadow/sync.js

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 
 const fsExtra = require('fs-extra');
-const execa = require('execa');
 const util_logger = require('../util/logger.js');
+const util_npm_install = require('../util/npm/install.js');
 const shadow_mergePackageJson = require('./merge-package-json.js');
 
 /**
@@ -19,11 +19,9 @@ async function syncShadow(paths, consumerPkg) {
     if (oldHash !== newHash) {
         util_logger.info(oldHash ? 'consumer deps changed — yarn install' : 'first run — yarn install');
         // Yarn 4 is cache-first and non-interactive by default in non-TTY
-        // contexts, so plain `yarn install` is all we need.
-        await execa.execa('yarn', ['install'], {
-            cwd: paths.consumerDir,
-            stdio: 'inherit',
-        });
+        // contexts, so plain `yarn install` is all we need. runYarnInstall injects
+        // the npm-broker token, preflights auth, and re-auths on a broker 401.
+        await util_npm_install.runYarnInstall({ cwd: paths.consumerDir });
         await fsExtra.writeFile(paths.shadowDepsHash, newHash);
     }
 }

package/dist/util/auth/auth-store.d.ts

@@ -8,4 +8,14 @@ export declare class Z2hAuthMissingError extends Error {
     constructor(authFilePath: string);
 }
 export declare function readZthAuth(): Promise<ZthAuth>;
+/**
+ * Synchronous, never-throws read of the z2h JWT from `~/.zth/auth.json`.
+ * Returns the token string, or `null` when the file is absent, unreadable,
+ * malformed, or missing the `token` field.
+ *
+ * Used when building the env for a spawned package-manager process, where a
+ * missing token must degrade gracefully (best-effort self-update) rather than
+ * blow up — and where an inline sync read keeps the spawn call site simple.
+ */
+export declare function tryReadAuthTokenSync(): string | null;
 //# sourceMappingURL=auth-store.d.ts.map

package/dist/util/auth/auth-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../../../src/util/auth/auth-store.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,YAAY,QAAkC,CAAC;AAC5D,eAAO,MAAM,aAAa,QAAuC,CAAC;AAElE,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,mBAAoB,SAAQ,KAAK;aAChB,YAAY,EAAE,MAAM;gBAApB,YAAY,EAAE,MAAM;CAIjD;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CASpD"}
+{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../../../src/util/auth/auth-store.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,YAAY,QAAkC,CAAC;AAC5D,eAAO,MAAM,aAAa,QAAuC,CAAC;AAElE,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,mBAAoB,SAAQ,KAAK;aAChB,YAAY,EAAE,MAAM;gBAApB,YAAY,EAAE,MAAM;CAIjD;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CASpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,IAAI,CAOpD"}

package/dist/util/auth/auth-store.js

@@ -32,8 +32,27 @@ async function readZthAuth() {
     }
     return { token: parsed.token };
 }
+/**
+ * Synchronous, never-throws read of the z2h JWT from `~/.zth/auth.json`.
+ * Returns the token string, or `null` when the file is absent, unreadable,
+ * malformed, or missing the `token` field.
+ *
+ * Used when building the env for a spawned package-manager process, where a
+ * missing token must degrade gracefully (best-effort self-update) rather than
+ * blow up — and where an inline sync read keeps the spawn call site simple.
+ */
+function tryReadAuthTokenSync() {
+    try {
+        const parsed = fsExtra.readJsonSync(Z2H_AUTH_FILE);
+        return parsed?.token ?? null;
+    }
+    catch {
+        return null;
+    }
+}
 
 exports.Z2H_AUTH_DIR = Z2H_AUTH_DIR;
 exports.Z2H_AUTH_FILE = Z2H_AUTH_FILE;
 exports.Z2hAuthMissingError = Z2hAuthMissingError;
 exports.readZthAuth = readZthAuth;
+exports.tryReadAuthTokenSync = tryReadAuthTokenSync;

package/dist/util/auth/broker-credential-provider.d.ts

@@ -1,5 +1,4 @@
 import type { AwsCredentialIdentityProvider } from '@aws-sdk/types';
-export declare const DEFAULT_BROKER_BASE_URL = "https://bigbrain-zth.bigbrain.me";
 export declare const STS_BROKER_PATH = "/z2h-cli/sts/credentials";
 /**
  * AWS SDK credential provider that fetches short-lived deploy credentials

package/dist/util/auth/broker-credential-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"broker-credential-provider.d.ts","sourceRoot":"","sources":["../../../src/util/auth/broker-credential-provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAyB,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE3F,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAC1E,eAAO,MAAM,eAAe,6BAA6B,CAAC;AA4D1D;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,EAAE,OAAO,EAAE,EAAE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,6BAA6B,CAuBxG"}
+{"version":3,"file":"broker-credential-provider.d.ts","sourceRoot":"","sources":["../../../src/util/auth/broker-credential-provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAyB,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE3F,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAwD1D;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,EAAE,OAAO,EAAE,EAAE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,6BAA6B,CAuBxG"}

package/dist/util/auth/broker-credential-provider.js

@@ -1,18 +1,15 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 
+const constants = require('../../constants.js');
 const util_auth_authStore = require('./auth-store.js');
 
-const DEFAULT_BROKER_BASE_URL = 'https://bigbrain-zth.bigbrain.me';
 const STS_BROKER_PATH = '/z2h-cli/sts/credentials';
 // Refresh the cached credentials this many ms before they expire so the next
 // AWS API call doesn't race the broker round-trip against a hard expiry.
 const REFRESH_BUFFER_MS = 5 * 60 * 1000;
-function brokerBaseUrl() {
-    return process.env.Z2H_BROKER_BASE_URL || DEFAULT_BROKER_BASE_URL;
-}
 async function fetchCredentialsOnce(appName) {
     const { token } = await util_auth_authStore.readZthAuth();
-    const url = `${brokerBaseUrl()}${STS_BROKER_PATH}`;
+    const url = `${constants.brokerBaseUrl()}${STS_BROKER_PATH}`;
     let res;
     try {
         res = await fetch(url, {
@@ -75,6 +72,5 @@ function brokerCredentialProvider({ appName }) {
     };
 }
 
-exports.DEFAULT_BROKER_BASE_URL = DEFAULT_BROKER_BASE_URL;
 exports.STS_BROKER_PATH = STS_BROKER_PATH;
 exports.brokerCredentialProvider = brokerCredentialProvider;

package/dist/util/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/util/logger.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,CAAC;AAI1C,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAEpD;AAED,wBAAgB,aAAa,IAAI,UAAU,CAE1C;AAED;;;;GAIG;AACH,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAItC;AAED,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAItC;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAI1C;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAMzD;AAED;;;GAGG;AACH,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,SAAI,GAAG,KAAK,CAU3F"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/util/logger.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,CAAC;AAI1C,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAEpD;AAED,wBAAgB,aAAa,IAAI,UAAU,CAE1C;AAED;;;;GAIG;AACH,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAItC;AAED,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAItC;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAI1C;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAMzD;AAED;;;GAGG;AACH,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,SAAI,GAAG,KAAK,CAW3F"}

package/dist/util/logger.js

@@ -1,6 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 
 const pc = require('picocolors');
+const util_tracker = require('./tracker.js');
 
 const _interopDefault = e => e && e.__esModule ? e : { default: e };
 
@@ -59,6 +60,7 @@ function fail(message, payload, exitCode = 1) {
             process.stderr.write(pc__default.default.dim(`  → ${payload.suggestedCommand}\n`));
         }
     }
+    util_tracker.trackEvent('z2h_cli_error', { action: payload.command ?? 'unknown', error: message });
     process.exit(exitCode);
 }
 

package/dist/util/npm/__tests__/broker-config.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=broker-config.test.d.ts.map

package/dist/util/npm/__tests__/broker-config.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-config.test.d.ts","sourceRoot":"","sources":["../../../../src/util/npm/__tests__/broker-config.test.ts"],"names":[],"mappings":""}

package/dist/util/npm/__tests__/install.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=install.test.d.ts.map

package/dist/util/npm/__tests__/install.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.test.d.ts","sourceRoot":"","sources":["../../../../src/util/npm/__tests__/install.test.ts"],"names":[],"mappings":""}

package/dist/util/npm/broker-config.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The two npm config lines (§3.1 / §3.3) that route the brokered scope to the
+ * proxy and supply the `${Z2H_NPM_TOKEN}` placeholder. No literal token — npm
+ * interpolates the placeholder from the env at invocation time.
+ */
+export declare function brokerNpmrcLines(): string[];
+/**
+ * Full contents for a **workspace** `.npmrc` (§3.3): broker scope-split plus an
+ * explicit public default registry and always-auth. Used by the template and
+ * the migration so both stay byte-identical.
+ */
+export declare function workspaceNpmrcContents(): string;
+/**
+ * Full contents for a **workspace** `.yarnrc.yml` (§3.2): the brokered scope
+ * points at the proxy with the `${Z2H_NPM_TOKEN}` placeholder + always-auth;
+ * the default `npmRegistryServer` stays the public registry (direct, unchanged
+ * speed). `yarnPath` keeps the bundled Berry release so any `yarn` runs 4.x.
+ */
+export declare function workspaceYarnrcContents(): string;
+//# sourceMappingURL=broker-config.d.ts.map

package/dist/util/npm/broker-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-config.d.ts","sourceRoot":"","sources":["../../../src/util/npm/broker-config.ts"],"names":[],"mappings":"AAkBA;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,EAAE,CAK3C;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAiBhD"}

package/dist/util/npm/broker-config.js

@@ -0,0 +1,63 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+
+const constants = require('../../constants.js');
+
+/** `https://host/path/` (with trailing slash) for the registry= line. */
+function registryUrlWithSlash() {
+    const url = constants.brokerNpmRegistryUrl();
+    return url.endsWith('/') ? url : `${url}/`;
+}
+/**
+ * The `//host/path/` prefix (scheme stripped, trailing slash kept) that npm
+ * requires the `:_authToken` key to be keyed under so it aligns with the
+ * registry path. Derived from the same registry URL so staging overrides flow
+ * through.
+ */
+function authKeyPrefix() {
+    return registryUrlWithSlash().replace(/^https?:/, '');
+}
+/**
+ * The two npm config lines (§3.1 / §3.3) that route the brokered scope to the
+ * proxy and supply the `${Z2H_NPM_TOKEN}` placeholder. No literal token — npm
+ * interpolates the placeholder from the env at invocation time.
+ */
+function brokerNpmrcLines() {
+    return [
+        `${constants.BROKER_NPM_SCOPE}:registry=${registryUrlWithSlash()}`,
+        `${authKeyPrefix()}:_authToken=\${${constants.Z2H_NPM_TOKEN_ENV}}`,
+    ];
+}
+/**
+ * Full contents for a **workspace** `.npmrc` (§3.3): broker scope-split plus an
+ * explicit public default registry and always-auth. Used by the template and
+ * the migration so both stay byte-identical.
+ */
+function workspaceNpmrcContents() {
+    return [...brokerNpmrcLines(), `registry=${constants.PUBLIC_NPM_REGISTRY_URL}`, 'always-auth=true'].join('\n') + '\n';
+}
+/**
+ * Full contents for a **workspace** `.yarnrc.yml` (§3.2): the brokered scope
+ * points at the proxy with the `${Z2H_NPM_TOKEN}` placeholder + always-auth;
+ * the default `npmRegistryServer` stays the public registry (direct, unchanged
+ * speed). `yarnPath` keeps the bundled Berry release so any `yarn` runs 4.x.
+ */
+function workspaceYarnrcContents() {
+    const scopeKey = constants.BROKER_NPM_SCOPE.replace(/^@/, '');
+    return ([
+        'nodeLinker: node-modules',
+        '',
+        'npmScopes:',
+        `  ${scopeKey}:`,
+        `    npmRegistryServer: "${constants.brokerNpmRegistryUrl()}"`,
+        `    npmAuthToken: "\${${constants.Z2H_NPM_TOKEN_ENV}}"`,
+        '    npmAlwaysAuth: true',
+        '',
+        `npmRegistryServer: "${constants.PUBLIC_NPM_REGISTRY_URL}"`,
+        '',
+        'yarnPath: .yarn/releases/yarn-4.5.1.cjs',
+    ].join('\n') + '\n');
+}
+
+exports.brokerNpmrcLines = brokerNpmrcLines;
+exports.workspaceNpmrcContents = workspaceNpmrcContents;
+exports.workspaceYarnrcContents = workspaceYarnrcContents;