@mondaydotcomorg/z2h-cli 0.6.0 → 0.6.1

package/dist/commands/create-workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-workspace.d.ts","sourceRoot":"","sources":["../../src/commands/create-workspace.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6CxF"}
+{"version":3,"file":"create-workspace.d.ts","sourceRoot":"","sources":["../../src/commands/create-workspace.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0CxF"}

package/dist/commands/create-workspace.js

@@ -3,10 +3,10 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const path = require('node:path');
 const promises = require('node:fs/promises');
 const fsExtra = require('fs-extra');
-const execa = require('execa');
 const util_logger = require('../util/logger.js');
 const util_workspace = require('../util/workspace.js');
 const util_templates = require('../util/templates.js');
+const util_npm_install = require('../util/npm/install.js');
 
 const _interopDefault = e => e && e.__esModule ? e : { default: e };
 
@@ -41,10 +41,7 @@ async function createWorkspaceCommand(opts) {
         fsExtra.copy(path__default.default.join(wsTemplatesDir, 'yarn-releases', 'yarn-4.5.1.cjs'), path__default.default.join(home, '.yarn', 'releases', 'yarn-4.5.1.cjs')),
     ]);
     util_logger.info(`setting up your Z2H workspace — this may take a minute...`);
-    await execa.execa('yarn', ['install'], {
-        cwd: home,
-        stdio: 'inherit',
-    });
+    await util_npm_install.runYarnInstall({ cwd: home });
     util_logger.output(`Your workspace is ready! 🚀 Apps will live at ${home}`, {
         ok: true,
         workspace: home,

package/dist/commands/create.js

@@ -3,13 +3,13 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const path = require('node:path');
 const promises = require('node:fs/promises');
 const fsExtra = require('fs-extra');
-const execa = require('execa');
 const util_logger = require('../util/logger.js');
 const util_workspace = require('../util/workspace.js');
 const util_templates = require('../util/templates.js');
 const util_manifest = require('../util/manifest.js');
 const util_appName = require('../util/app-name.js');
 const constants = require('../constants.js');
+const util_npm_install = require('../util/npm/install.js');
 
 const _interopDefault = e => e && e.__esModule ? e : { default: e };
 
@@ -96,7 +96,7 @@ async function createCommand(appName, opts) {
         await fsExtra.copy(opts.htmlFile, path__default.default.join(appDir, 'src', 'page.html'));
     }
     util_logger.info(`installing dependencies for ${appName}...`);
-    await execa.execa('yarn', ['install'], { cwd: workspace, stdio: 'inherit' });
+    await util_npm_install.runYarnInstall({ cwd: workspace });
     util_logger.output(`[z2h-cli] app ready at ${appDir}`, {
         ok: true,
         appDir,

package/dist/constants.d.ts

@@ -16,4 +16,22 @@ export declare const BUCKET_READ_DNS_URL = "https://bigbrain-zth-mf-assets.bigbr
 export declare const MANIFEST_KEY = "mf-assets";
 export declare const MANIFEST_READ_URL = "https://bigbrain-zth-mf-assets.bigbrain.me/mf-assets";
 export declare const APP_NAME_PATTERN: RegExp;
+export declare const DEFAULT_BROKER_BASE_URL = "https://bigbrain-zth.bigbrain.me";
+/**
+ * Resolves the broker origin (no trailing slash). Honors
+ * `Z2H_BROKER_BASE_URL` (tests/staging), else the prod default. Shared by the
+ * STS credential provider and the npm-broker registry URL.
+ */
+export declare function brokerBaseUrl(): string;
+export declare const NPM_BROKER_PATH = "/z2h-cli/npm";
+export declare const BROKER_NPM_SCOPE = "@mondaydotcomorg";
+export declare const PUBLIC_NPM_REGISTRY_URL = "https://registry.npmjs.org/";
+export declare const Z2H_NPM_TOKEN_ENV: "Z2H_NPM_TOKEN";
+/**
+ * Broker npm registry URL (no trailing slash), e.g. prod
+ * `https://bigbrain-zth.bigbrain.me/z2h-cli/npm`. Built on `brokerBaseUrl()`
+ * so the staging override flows through. The trailing-slash forms required by
+ * the `.npmrc`/`.yarnrc.yml` configs are added where those files are written.
+ */
+export declare function brokerNpmRegistryUrl(): string;
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAQF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAQ3C,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AACpE,eAAO,MAAM,MAAM,cAAc,CAAC;AAClC,eAAO,MAAM,gBAAgB,wEAA4D,CAAC;AAE1F,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,+CAAgD,CAAC;AAKjF,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,iBAAiB,yDAA2C,CAAC;AAM1E,eAAO,MAAM,gBAAgB,QAA2B,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAQF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAQ3C,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AACpE,eAAO,MAAM,MAAM,cAAc,CAAC;AAClC,eAAO,MAAM,gBAAgB,wEAA4D,CAAC;AAE1F,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,+CAAgD,CAAC;AAKjF,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,iBAAiB,yDAA2C,CAAC;AAM1E,eAAO,MAAM,gBAAgB,QAA2B,CAAC;AAKzD,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAKD,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAG9C,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAGnD,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAMrE,eAAO,MAAM,iBAAiB,EAAG,eAAwB,CAAC;AAE1D;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}

package/dist/constants.js

@@ -48,18 +48,59 @@ const MANIFEST_READ_URL = `${BUCKET_READ_DNS_URL}/${MANIFEST_KEY}`;
 // backend STS broker rejects anything else with 400; the CLI can validate
 // upfront for friendlier errors.
 const APP_NAME_PATTERN = /^[a-z][a-z0-9-]{1,49}$/;
+// ─────────── Broker origin + npm registry (shared §3 contract) ─────
+// The bigbrain-zth broker fronts both the STS credential route and the npm
+// proxy. `Z2H_BROKER_BASE_URL` overrides the origin for tests/staging.
+const DEFAULT_BROKER_BASE_URL = 'https://bigbrain-zth.bigbrain.me';
+/**
+ * Resolves the broker origin (no trailing slash). Honors
+ * `Z2H_BROKER_BASE_URL` (tests/staging), else the prod default. Shared by the
+ * STS credential provider and the npm-broker registry URL.
+ */
+function brokerBaseUrl() {
+    return process.env.Z2H_BROKER_BASE_URL || DEFAULT_BROKER_BASE_URL;
+}
+// The authenticated npm reverse-proxy is mounted here on the broker. Only the
+// `@mondaydotcomorg` scope is served; everything else resolves from npmjs
+// directly. See docs/superpowers/specs/2026-06-03-npm-brokering-design.md §3.
+const NPM_BROKER_PATH = '/z2h-cli/npm';
+// The scope brokered through the proxy — the ONLY scope it serves.
+const BROKER_NPM_SCOPE = '@mondaydotcomorg';
+// Public registry for everything outside the brokered scope (unchanged speed).
+const PUBLIC_NPM_REGISTRY_URL = 'https://registry.npmjs.org/';
+// Env var the client config (`~/.npmrc`, `.yarnrc.yml`) interpolates at
+// invocation time; its value is the z2h JWT, injected per-spawn by the CLI.
+// Deliberately NOT `NPM_TOKEN` — avoids colliding with the monorepo's own dev
+// token and makes clear it is the z2h JWT, not a real npm token.
+const Z2H_NPM_TOKEN_ENV = 'Z2H_NPM_TOKEN';
+/**
+ * Broker npm registry URL (no trailing slash), e.g. prod
+ * `https://bigbrain-zth.bigbrain.me/z2h-cli/npm`. Built on `brokerBaseUrl()`
+ * so the staging override flows through. The trailing-slash forms required by
+ * the `.npmrc`/`.yarnrc.yml` configs are added where those files are written.
+ */
+function brokerNpmRegistryUrl() {
+    return `${brokerBaseUrl()}${NPM_BROKER_PATH}`;
+}
 
 exports.APP_NAME_PATTERN = APP_NAME_PATTERN;
+exports.BROKER_NPM_SCOPE = BROKER_NPM_SCOPE;
 exports.BUCKET_READ_DNS_NAME = BUCKET_READ_DNS_NAME;
 exports.BUCKET_READ_DNS_URL = BUCKET_READ_DNS_URL;
 exports.BUCKET_WRITE_NAME = BUCKET_WRITE_NAME;
 exports.BUCKET_WRITE_URL = BUCKET_WRITE_URL;
+exports.DEFAULT_BROKER_BASE_URL = DEFAULT_BROKER_BASE_URL;
 exports.GITIGNORE_ENTRIES = GITIGNORE_ENTRIES;
 exports.MANIFEST_KEY = MANIFEST_KEY;
 exports.MANIFEST_READ_URL = MANIFEST_READ_URL;
 exports.MAX_PORT = MAX_PORT;
 exports.MIN_PORT = MIN_PORT;
+exports.NPM_BROKER_PATH = NPM_BROKER_PATH;
+exports.PUBLIC_NPM_REGISTRY_URL = PUBLIC_NPM_REGISTRY_URL;
 exports.REGION = REGION;
 exports.SHADOW_DEV_DEPS = SHADOW_DEV_DEPS;
 exports.SHADOW_DIR_NAME = SHADOW_DIR_NAME;
 exports.SHADOW_SCRIPTS = SHADOW_SCRIPTS;
+exports.Z2H_NPM_TOKEN_ENV = Z2H_NPM_TOKEN_ENV;
+exports.brokerBaseUrl = brokerBaseUrl;
+exports.brokerNpmRegistryUrl = brokerNpmRegistryUrl;

package/dist/esm/commands/create-workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-workspace.d.ts","sourceRoot":"","sources":["../../../src/commands/create-workspace.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6CxF"}
+{"version":3,"file":"create-workspace.d.ts","sourceRoot":"","sources":["../../../src/commands/create-workspace.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0CxF"}

package/dist/esm/commands/create-workspace.mjs

@@ -1,10 +1,10 @@
 import path from 'node:path';
 import { readFile } from 'node:fs/promises';
 import { pathExists, readdir, ensureDir, writeFile, copy } from 'fs-extra';
-import { execa } from 'execa';
 import { setOutputMode, info, output } from '../util/logger.mjs';
 import { getWorkspaceHome } from '../util/workspace.mjs';
 import { getTemplatesDir } from '../util/templates.mjs';
+import { runYarnInstall } from '../util/npm/install.mjs';
 
 async function createWorkspaceCommand(opts) {
     if (opts.json) {
@@ -35,10 +35,7 @@ async function createWorkspaceCommand(opts) {
         copy(path.join(wsTemplatesDir, 'yarn-releases', 'yarn-4.5.1.cjs'), path.join(home, '.yarn', 'releases', 'yarn-4.5.1.cjs')),
     ]);
     info(`setting up your Z2H workspace — this may take a minute...`);
-    await execa('yarn', ['install'], {
-        cwd: home,
-        stdio: 'inherit',
-    });
+    await runYarnInstall({ cwd: home });
     output(`Your workspace is ready! 🚀 Apps will live at ${home}`, {
         ok: true,
         workspace: home,

package/dist/esm/commands/create.mjs

@@ -1,13 +1,13 @@
 import path from 'node:path';
 import { readFile } from 'node:fs/promises';
 import { pathExists, ensureDir, writeFile, copy, readdir } from 'fs-extra';
-import { execa } from 'execa';
 import { setOutputMode, info, output } from '../util/logger.mjs';
 import { assertWorkspace } from '../util/workspace.mjs';
 import { APP_TEMPLATES, getTemplatesDir, renderTemplate } from '../util/templates.mjs';
 import { readManifest } from '../util/manifest.mjs';
 import { mfAppName } from '../util/app-name.mjs';
 import { APP_NAME_PATTERN } from '../constants.mjs';
+import { runYarnInstall } from '../util/npm/install.mjs';
 
 // Names reserved by the host MF (mf-bigbrain-zth) for platform pages under
 // /bigbrain-vibe/<name>. Creating an app with one of these would shadow the
@@ -90,7 +90,7 @@ async function createCommand(appName, opts) {
         await copy(opts.htmlFile, path.join(appDir, 'src', 'page.html'));
     }
     info(`installing dependencies for ${appName}...`);
-    await execa('yarn', ['install'], { cwd: workspace, stdio: 'inherit' });
+    await runYarnInstall({ cwd: workspace });
     output(`[z2h-cli] app ready at ${appDir}`, {
         ok: true,
         appDir,

package/dist/esm/constants.d.ts

@@ -16,4 +16,22 @@ export declare const BUCKET_READ_DNS_URL = "https://bigbrain-zth-mf-assets.bigbr
 export declare const MANIFEST_KEY = "mf-assets";
 export declare const MANIFEST_READ_URL = "https://bigbrain-zth-mf-assets.bigbrain.me/mf-assets";
 export declare const APP_NAME_PATTERN: RegExp;
+export declare const DEFAULT_BROKER_BASE_URL = "https://bigbrain-zth.bigbrain.me";
+/**
+ * Resolves the broker origin (no trailing slash). Honors
+ * `Z2H_BROKER_BASE_URL` (tests/staging), else the prod default. Shared by the
+ * STS credential provider and the npm-broker registry URL.
+ */
+export declare function brokerBaseUrl(): string;
+export declare const NPM_BROKER_PATH = "/z2h-cli/npm";
+export declare const BROKER_NPM_SCOPE = "@mondaydotcomorg";
+export declare const PUBLIC_NPM_REGISTRY_URL = "https://registry.npmjs.org/";
+export declare const Z2H_NPM_TOKEN_ENV: "Z2H_NPM_TOKEN";
+/**
+ * Broker npm registry URL (no trailing slash), e.g. prod
+ * `https://bigbrain-zth.bigbrain.me/z2h-cli/npm`. Built on `brokerBaseUrl()`
+ * so the staging override flows through. The trailing-slash forms required by
+ * the `.npmrc`/`.yarnrc.yml` configs are added where those files are written.
+ */
+export declare function brokerNpmRegistryUrl(): string;
 //# sourceMappingURL=constants.d.ts.map

package/dist/esm/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAQF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAQ3C,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AACpE,eAAO,MAAM,MAAM,cAAc,CAAC;AAClC,eAAO,MAAM,gBAAgB,wEAA4D,CAAC;AAE1F,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,+CAAgD,CAAC;AAKjF,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,iBAAiB,yDAA2C,CAAC;AAM1E,eAAO,MAAM,gBAAgB,QAA2B,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAQF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAQ3C,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AACpE,eAAO,MAAM,MAAM,cAAc,CAAC;AAClC,eAAO,MAAM,gBAAgB,wEAA4D,CAAC;AAE1F,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,+CAAgD,CAAC;AAKjF,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,iBAAiB,yDAA2C,CAAC;AAM1E,eAAO,MAAM,gBAAgB,QAA2B,CAAC;AAKzD,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAKD,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAG9C,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAGnD,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAMrE,eAAO,MAAM,iBAAiB,EAAG,eAAwB,CAAC;AAE1D;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}

package/dist/esm/constants.mjs

@@ -46,5 +46,39 @@ const MANIFEST_READ_URL = `${BUCKET_READ_DNS_URL}/${MANIFEST_KEY}`;
 // backend STS broker rejects anything else with 400; the CLI can validate
 // upfront for friendlier errors.
 const APP_NAME_PATTERN = /^[a-z][a-z0-9-]{1,49}$/;
+// ─────────── Broker origin + npm registry (shared §3 contract) ─────
+// The bigbrain-zth broker fronts both the STS credential route and the npm
+// proxy. `Z2H_BROKER_BASE_URL` overrides the origin for tests/staging.
+const DEFAULT_BROKER_BASE_URL = 'https://bigbrain-zth.bigbrain.me';
+/**
+ * Resolves the broker origin (no trailing slash). Honors
+ * `Z2H_BROKER_BASE_URL` (tests/staging), else the prod default. Shared by the
+ * STS credential provider and the npm-broker registry URL.
+ */
+function brokerBaseUrl() {
+    return process.env.Z2H_BROKER_BASE_URL || DEFAULT_BROKER_BASE_URL;
+}
+// The authenticated npm reverse-proxy is mounted here on the broker. Only the
+// `@mondaydotcomorg` scope is served; everything else resolves from npmjs
+// directly. See docs/superpowers/specs/2026-06-03-npm-brokering-design.md §3.
+const NPM_BROKER_PATH = '/z2h-cli/npm';
+// The scope brokered through the proxy — the ONLY scope it serves.
+const BROKER_NPM_SCOPE = '@mondaydotcomorg';
+// Public registry for everything outside the brokered scope (unchanged speed).
+const PUBLIC_NPM_REGISTRY_URL = 'https://registry.npmjs.org/';
+// Env var the client config (`~/.npmrc`, `.yarnrc.yml`) interpolates at
+// invocation time; its value is the z2h JWT, injected per-spawn by the CLI.
+// Deliberately NOT `NPM_TOKEN` — avoids colliding with the monorepo's own dev
+// token and makes clear it is the z2h JWT, not a real npm token.
+const Z2H_NPM_TOKEN_ENV = 'Z2H_NPM_TOKEN';
+/**
+ * Broker npm registry URL (no trailing slash), e.g. prod
+ * `https://bigbrain-zth.bigbrain.me/z2h-cli/npm`. Built on `brokerBaseUrl()`
+ * so the staging override flows through. The trailing-slash forms required by
+ * the `.npmrc`/`.yarnrc.yml` configs are added where those files are written.
+ */
+function brokerNpmRegistryUrl() {
+    return `${brokerBaseUrl()}${NPM_BROKER_PATH}`;
+}
 
-export { APP_NAME_PATTERN, BUCKET_READ_DNS_NAME, BUCKET_READ_DNS_URL, BUCKET_WRITE_NAME, BUCKET_WRITE_URL, GITIGNORE_ENTRIES, MANIFEST_KEY, MANIFEST_READ_URL, MAX_PORT, MIN_PORT, REGION, SHADOW_DEV_DEPS, SHADOW_DIR_NAME, SHADOW_SCRIPTS };
+export { APP_NAME_PATTERN, BROKER_NPM_SCOPE, BUCKET_READ_DNS_NAME, BUCKET_READ_DNS_URL, BUCKET_WRITE_NAME, BUCKET_WRITE_URL, DEFAULT_BROKER_BASE_URL, GITIGNORE_ENTRIES, MANIFEST_KEY, MANIFEST_READ_URL, MAX_PORT, MIN_PORT, NPM_BROKER_PATH, PUBLIC_NPM_REGISTRY_URL, REGION, SHADOW_DEV_DEPS, SHADOW_DIR_NAME, SHADOW_SCRIPTS, Z2H_NPM_TOKEN_ENV, brokerBaseUrl, brokerNpmRegistryUrl };

package/dist/esm/index.mjs

@@ -1,6 +1,6 @@
 import { createRequire } from 'node:module';
-import { Command } from 'commander';
 import { readFileSync } from 'node:fs';
+import { Command } from 'commander';
 import { devCommand } from './commands/dev.mjs';
 import { buildCommand } from './commands/build.mjs';
 import { cleanCommand } from './commands/clean.mjs';

package/dist/esm/migrations/003-npm-broker-scope-split.d.ts

@@ -0,0 +1,14 @@
+import type { Tree } from '@nx/devkit';
+/**
+ * Migrate the workspace npm/yarn config from the legacy single-registry
+ * `${NPM_TOKEN}` form to the `@mondaydotcomorg`→broker scope-split
+ * (`${Z2H_NPM_TOKEN}` placeholder). Rewrites the workspace-root `.yarnrc.yml`
+ * and `.npmrc`, plus any consumer-app copies that still carry the legacy
+ * placeholder (migration 001 normally removes per-consumer `.yarnrc.yml`, so
+ * this is just defensive cleanup).
+ *
+ * The global `~/.npmrc` broker block is written separately by `migrateCommand`
+ * (it lives outside the workspace Tree).
+ */
+export default function npmBrokerScopeSplit(tree: Tree): void;
+//# sourceMappingURL=003-npm-broker-scope-split.d.ts.map

package/dist/esm/migrations/003-npm-broker-scope-split.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"003-npm-broker-scope-split.d.ts","sourceRoot":"","sources":["../../../src/migrations/003-npm-broker-scope-split.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAuBvC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,OAAO,UAAU,mBAAmB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAgB5D"}

package/dist/esm/migrations/003-npm-broker-scope-split.mjs

@@ -0,0 +1,49 @@
+import { workspaceYarnrcContents, workspaceNpmrcContents } from '../util/npm/broker-config.mjs';
+
+// Legacy marker: the old configs interpolated a real npm token via
+// `${NPM_TOKEN}`. Its presence means the file predates npm brokering and must
+// be rewritten to the scope-split. Once rewritten (placeholder is now
+// `${Z2H_NPM_TOKEN}`) this no longer matches, so the migration is idempotent.
+const LEGACY_TOKEN_PLACEHOLDER = '${NPM_TOKEN}';
+/**
+ * Rewrite a single rc file to `contents` iff it exists and still carries the
+ * legacy `${NPM_TOKEN}` placeholder. Returns nothing; mutates the Tree.
+ */
+function rewriteIfLegacy(tree, filePath, contents) {
+    if (!tree.exists(filePath)) {
+        return;
+    }
+    const current = tree.read(filePath, 'utf-8') ?? '';
+    if (!current.includes(LEGACY_TOKEN_PLACEHOLDER)) {
+        return; // already migrated (or never legacy) — leave untouched
+    }
+    tree.write(filePath, contents);
+}
+/**
+ * Migrate the workspace npm/yarn config from the legacy single-registry
+ * `${NPM_TOKEN}` form to the `@mondaydotcomorg`→broker scope-split
+ * (`${Z2H_NPM_TOKEN}` placeholder). Rewrites the workspace-root `.yarnrc.yml`
+ * and `.npmrc`, plus any consumer-app copies that still carry the legacy
+ * placeholder (migration 001 normally removes per-consumer `.yarnrc.yml`, so
+ * this is just defensive cleanup).
+ *
+ * The global `~/.npmrc` broker block is written separately by `migrateCommand`
+ * (it lives outside the workspace Tree).
+ */
+function npmBrokerScopeSplit(tree) {
+    const yarnrc = workspaceYarnrcContents();
+    const npmrc = workspaceNpmrcContents();
+    // Workspace root.
+    rewriteIfLegacy(tree, '.yarnrc.yml', yarnrc);
+    rewriteIfLegacy(tree, '.npmrc', npmrc);
+    // Any consumer apps that still carry their own legacy rc files.
+    for (const entry of tree.children('.')) {
+        if (entry.startsWith('.')) {
+            continue;
+        }
+        rewriteIfLegacy(tree, `${entry}/.yarnrc.yml`, yarnrc);
+        rewriteIfLegacy(tree, `${entry}/.npmrc`, npmrc);
+    }
+}
+
+export { npmBrokerScopeSplit as default };

package/dist/esm/migrations/__tests__/003-npm-broker-scope-split.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=003-npm-broker-scope-split.test.d.ts.map

package/dist/esm/migrations/__tests__/003-npm-broker-scope-split.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"003-npm-broker-scope-split.test.d.ts","sourceRoot":"","sources":["../../../../src/migrations/__tests__/003-npm-broker-scope-split.test.ts"],"names":[],"mappings":""}

package/dist/esm/shadow/sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../../src/shadow/sync.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE3D;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB9F"}
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../../src/shadow/sync.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE3D;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAe9F"}

package/dist/esm/shadow/sync.mjs

@@ -1,6 +1,6 @@
 import { pathExists, readFile, writeFile } from 'fs-extra';
-import { execa } from 'execa';
 import { info } from '../util/logger.mjs';
+import { runYarnInstall } from '../util/npm/install.mjs';
 import { buildShadowPkg, writeShadowPkg, hashConsumerDeps } from './merge-package-json.mjs';
 
 /**
@@ -17,11 +17,9 @@ async function syncShadow(paths, consumerPkg) {
     if (oldHash !== newHash) {
         info(oldHash ? 'consumer deps changed — yarn install' : 'first run — yarn install');
         // Yarn 4 is cache-first and non-interactive by default in non-TTY
-        // contexts, so plain `yarn install` is all we need.
-        await execa('yarn', ['install'], {
-            cwd: paths.consumerDir,
-            stdio: 'inherit',
-        });
+        // contexts, so plain `yarn install` is all we need. runYarnInstall injects
+        // the npm-broker token, preflights auth, and re-auths on a broker 401.
+        await runYarnInstall({ cwd: paths.consumerDir });
         await writeFile(paths.shadowDepsHash, newHash);
     }
 }

package/dist/esm/util/auth/auth-store.d.ts

@@ -8,4 +8,14 @@ export declare class Z2hAuthMissingError extends Error {
     constructor(authFilePath: string);
 }
 export declare function readZthAuth(): Promise<ZthAuth>;
+/**
+ * Synchronous, never-throws read of the z2h JWT from `~/.zth/auth.json`.
+ * Returns the token string, or `null` when the file is absent, unreadable,
+ * malformed, or missing the `token` field.
+ *
+ * Used when building the env for a spawned package-manager process, where a
+ * missing token must degrade gracefully (best-effort self-update) rather than
+ * blow up — and where an inline sync read keeps the spawn call site simple.
+ */
+export declare function tryReadAuthTokenSync(): string | null;
 //# sourceMappingURL=auth-store.d.ts.map

package/dist/esm/util/auth/auth-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../../../../src/util/auth/auth-store.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,YAAY,QAAkC,CAAC;AAC5D,eAAO,MAAM,aAAa,QAAuC,CAAC;AAElE,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,mBAAoB,SAAQ,KAAK;aAChB,YAAY,EAAE,MAAM;gBAApB,YAAY,EAAE,MAAM;CAIjD;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CASpD"}
+{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../../../../src/util/auth/auth-store.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,YAAY,QAAkC,CAAC;AAC5D,eAAO,MAAM,aAAa,QAAuC,CAAC;AAElE,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,mBAAoB,SAAQ,KAAK;aAChB,YAAY,EAAE,MAAM;gBAApB,YAAY,EAAE,MAAM;CAIjD;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CASpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,IAAI,CAOpD"}

package/dist/esm/util/auth/auth-store.mjs

@@ -1,6 +1,6 @@
 import path from 'node:path';
 import os from 'node:os';
-import { pathExists, readJson } from 'fs-extra';
+import { pathExists, readJson, readJsonSync } from 'fs-extra';
 
 // npm-style convention: per-user config under ~/.zth (mirrors ~/.npmrc, ~/.aws/).
 // Kept out of the workspace dir so accidental `git init` in ~/zth-projects can't
@@ -25,5 +25,23 @@ async function readZthAuth() {
     }
     return { token: parsed.token };
 }
+/**
+ * Synchronous, never-throws read of the z2h JWT from `~/.zth/auth.json`.
+ * Returns the token string, or `null` when the file is absent, unreadable,
+ * malformed, or missing the `token` field.
+ *
+ * Used when building the env for a spawned package-manager process, where a
+ * missing token must degrade gracefully (best-effort self-update) rather than
+ * blow up — and where an inline sync read keeps the spawn call site simple.
+ */
+function tryReadAuthTokenSync() {
+    try {
+        const parsed = readJsonSync(Z2H_AUTH_FILE);
+        return parsed?.token ?? null;
+    }
+    catch {
+        return null;
+    }
+}
 
-export { Z2H_AUTH_DIR, Z2H_AUTH_FILE, Z2hAuthMissingError, readZthAuth };
+export { Z2H_AUTH_DIR, Z2H_AUTH_FILE, Z2hAuthMissingError, readZthAuth, tryReadAuthTokenSync };

package/dist/esm/util/auth/broker-credential-provider.d.ts

@@ -1,5 +1,4 @@
 import type { AwsCredentialIdentityProvider } from '@aws-sdk/types';
-export declare const DEFAULT_BROKER_BASE_URL = "https://bigbrain-zth.bigbrain.me";
 export declare const STS_BROKER_PATH = "/z2h-cli/sts/credentials";
 /**
  * AWS SDK credential provider that fetches short-lived deploy credentials

package/dist/esm/util/auth/broker-credential-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"broker-credential-provider.d.ts","sourceRoot":"","sources":["../../../../src/util/auth/broker-credential-provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAyB,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE3F,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAC1E,eAAO,MAAM,eAAe,6BAA6B,CAAC;AA4D1D;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,EAAE,OAAO,EAAE,EAAE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,6BAA6B,CAuBxG"}
+{"version":3,"file":"broker-credential-provider.d.ts","sourceRoot":"","sources":["../../../../src/util/auth/broker-credential-provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAyB,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE3F,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAwD1D;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,EAAE,OAAO,EAAE,EAAE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,6BAA6B,CAuBxG"}

package/dist/esm/util/auth/broker-credential-provider.mjs

@@ -1,13 +1,10 @@
+import { brokerBaseUrl } from '../../constants.mjs';
 import { readZthAuth } from './auth-store.mjs';
 
-const DEFAULT_BROKER_BASE_URL = 'https://bigbrain-zth.bigbrain.me';
 const STS_BROKER_PATH = '/z2h-cli/sts/credentials';
 // Refresh the cached credentials this many ms before they expire so the next
 // AWS API call doesn't race the broker round-trip against a hard expiry.
 const REFRESH_BUFFER_MS = 5 * 60 * 1000;
-function brokerBaseUrl() {
-    return process.env.Z2H_BROKER_BASE_URL || DEFAULT_BROKER_BASE_URL;
-}
 async function fetchCredentialsOnce(appName) {
     const { token } = await readZthAuth();
     const url = `${brokerBaseUrl()}${STS_BROKER_PATH}`;
@@ -73,4 +70,4 @@ function brokerCredentialProvider({ appName }) {
     };
 }
 
-export { DEFAULT_BROKER_BASE_URL, STS_BROKER_PATH, brokerCredentialProvider };
+export { STS_BROKER_PATH, brokerCredentialProvider };

package/dist/esm/util/npm/__tests__/broker-config.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=broker-config.test.d.ts.map

package/dist/esm/util/npm/__tests__/broker-config.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-config.test.d.ts","sourceRoot":"","sources":["../../../../../src/util/npm/__tests__/broker-config.test.ts"],"names":[],"mappings":""}

package/dist/esm/util/npm/__tests__/install.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=install.test.d.ts.map

package/dist/esm/util/npm/__tests__/install.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.test.d.ts","sourceRoot":"","sources":["../../../../../src/util/npm/__tests__/install.test.ts"],"names":[],"mappings":""}

package/dist/esm/util/npm/broker-config.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The two npm config lines (§3.1 / §3.3) that route the brokered scope to the
+ * proxy and supply the `${Z2H_NPM_TOKEN}` placeholder. No literal token — npm
+ * interpolates the placeholder from the env at invocation time.
+ */
+export declare function brokerNpmrcLines(): string[];
+/**
+ * Full contents for a **workspace** `.npmrc` (§3.3): broker scope-split plus an
+ * explicit public default registry and always-auth. Used by the template and
+ * the migration so both stay byte-identical.
+ */
+export declare function workspaceNpmrcContents(): string;
+/**
+ * Full contents for a **workspace** `.yarnrc.yml` (§3.2): the brokered scope
+ * points at the proxy with the `${Z2H_NPM_TOKEN}` placeholder + always-auth;
+ * the default `npmRegistryServer` stays the public registry (direct, unchanged
+ * speed). `yarnPath` keeps the bundled Berry release so any `yarn` runs 4.x.
+ */
+export declare function workspaceYarnrcContents(): string;
+//# sourceMappingURL=broker-config.d.ts.map

package/dist/esm/util/npm/broker-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-config.d.ts","sourceRoot":"","sources":["../../../../src/util/npm/broker-config.ts"],"names":[],"mappings":"AAkBA;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,EAAE,CAK3C;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAiBhD"}

package/dist/esm/util/npm/broker-config.mjs

@@ -0,0 +1,59 @@
+import { BROKER_NPM_SCOPE, Z2H_NPM_TOKEN_ENV, PUBLIC_NPM_REGISTRY_URL, brokerNpmRegistryUrl } from '../../constants.mjs';
+
+/** `https://host/path/` (with trailing slash) for the registry= line. */
+function registryUrlWithSlash() {
+    const url = brokerNpmRegistryUrl();
+    return url.endsWith('/') ? url : `${url}/`;
+}
+/**
+ * The `//host/path/` prefix (scheme stripped, trailing slash kept) that npm
+ * requires the `:_authToken` key to be keyed under so it aligns with the
+ * registry path. Derived from the same registry URL so staging overrides flow
+ * through.
+ */
+function authKeyPrefix() {
+    return registryUrlWithSlash().replace(/^https?:/, '');
+}
+/**
+ * The two npm config lines (§3.1 / §3.3) that route the brokered scope to the
+ * proxy and supply the `${Z2H_NPM_TOKEN}` placeholder. No literal token — npm
+ * interpolates the placeholder from the env at invocation time.
+ */
+function brokerNpmrcLines() {
+    return [
+        `${BROKER_NPM_SCOPE}:registry=${registryUrlWithSlash()}`,
+        `${authKeyPrefix()}:_authToken=\${${Z2H_NPM_TOKEN_ENV}}`,
+    ];
+}
+/**
+ * Full contents for a **workspace** `.npmrc` (§3.3): broker scope-split plus an
+ * explicit public default registry and always-auth. Used by the template and
+ * the migration so both stay byte-identical.
+ */
+function workspaceNpmrcContents() {
+    return [...brokerNpmrcLines(), `registry=${PUBLIC_NPM_REGISTRY_URL}`, 'always-auth=true'].join('\n') + '\n';
+}
+/**
+ * Full contents for a **workspace** `.yarnrc.yml` (§3.2): the brokered scope
+ * points at the proxy with the `${Z2H_NPM_TOKEN}` placeholder + always-auth;
+ * the default `npmRegistryServer` stays the public registry (direct, unchanged
+ * speed). `yarnPath` keeps the bundled Berry release so any `yarn` runs 4.x.
+ */
+function workspaceYarnrcContents() {
+    const scopeKey = BROKER_NPM_SCOPE.replace(/^@/, '');
+    return ([
+        'nodeLinker: node-modules',
+        '',
+        'npmScopes:',
+        `  ${scopeKey}:`,
+        `    npmRegistryServer: "${brokerNpmRegistryUrl()}"`,
+        `    npmAuthToken: "\${${Z2H_NPM_TOKEN_ENV}}"`,
+        '    npmAlwaysAuth: true',
+        '',
+        `npmRegistryServer: "${PUBLIC_NPM_REGISTRY_URL}"`,
+        '',
+        'yarnPath: .yarn/releases/yarn-4.5.1.cjs',
+    ].join('\n') + '\n');
+}
+
+export { brokerNpmrcLines, workspaceNpmrcContents, workspaceYarnrcContents };

package/dist/esm/util/npm/ensure-token.d.ts

@@ -0,0 +1,19 @@
+export interface EnsureZ2hTokenOptions {
+    /**
+     * Re-run the token flow even if a token already exists on disk. Used after a
+     * broker 401, where the stored token is present but expired/invalid.
+     */
+    forceRefresh?: boolean;
+}
+/**
+ * Ensure a z2h JWT exists at `~/.zth/auth.json` before an install-bearing
+ * command runs. If none is present (or `forceRefresh` is set), drive the
+ * existing `generate-z2h-token` flow — loopback capture with manual-paste
+ * fallback — which writes the token. No-ops when a token already exists and no
+ * refresh was requested.
+ *
+ * This is the install preflight: it keeps a friendly auth prompt in front of
+ * the raw npm error a non-technical user would otherwise hit.
+ */
+export declare function ensureZ2hToken(opts?: EnsureZ2hTokenOptions): Promise<void>;
+//# sourceMappingURL=ensure-token.d.ts.map

package/dist/esm/util/npm/ensure-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-token.d.ts","sourceRoot":"","sources":["../../../../src/util/npm/ensure-token.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAKpF"}

package/dist/esm/util/npm/ensure-token.mjs

@@ -0,0 +1,22 @@
+import { tryReadAuthTokenSync } from '../auth/auth-store.mjs';
+import { info } from '../logger.mjs';
+import { generateZ2HTokenCommand } from '../../commands/generate-z2h-token.mjs';
+
+/**
+ * Ensure a z2h JWT exists at `~/.zth/auth.json` before an install-bearing
+ * command runs. If none is present (or `forceRefresh` is set), drive the
+ * existing `generate-z2h-token` flow — loopback capture with manual-paste
+ * fallback — which writes the token. No-ops when a token already exists and no
+ * refresh was requested.
+ *
+ * This is the install preflight: it keeps a friendly auth prompt in front of
+ * the raw npm error a non-technical user would otherwise hit.
+ */
+async function ensureZ2hToken(opts = {}) {
+    if (opts.forceRefresh || !tryReadAuthTokenSync()) {
+        info('you need to sign in to install monday packages — opening the sign-in page');
+        await generateZ2HTokenCommand();
+    }
+}
+
+export { ensureZ2hToken };