@mondaydotcomorg/z2h-cli 0.6.0 → 0.6.1

package/dist/esm/util/npm/install.d.ts

@@ -0,0 +1,18 @@
+export interface RunYarnInstallOptions {
+    /** Directory to run `yarn install` in. */
+    cwd: string;
+    /** Extra env to merge on top of `process.env` + the broker token. */
+    extraEnv?: NodeJS.ProcessEnv;
+}
+/**
+ * Run `yarn install` for an install-bearing command:
+ *   1. Preflight — ensure a z2h token exists (prompt `generate-z2h-token` if not).
+ *   2. Install through the broker.
+ *   3. On a broker 401, surface a friendly "your access expired — refreshing it"
+ *      message, re-auth, and retry the install exactly once.
+ *
+ * A non-auth failure (real dependency error, network, etc.) propagates as-is so
+ * the command's normal error path reports it.
+ */
+export declare function runYarnInstall(opts: RunYarnInstallOptions): Promise<void>;
+//# sourceMappingURL=install.d.ts.map

package/dist/esm/util/npm/install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../../../src/util/npm/install.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,qBAAqB;IACpC,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAC9B;AAqCD;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAc/E"}

package/dist/esm/util/npm/install.mjs

@@ -0,0 +1,74 @@
+import { execa } from 'execa';
+import { warn, info } from '../logger.mjs';
+import { tryReadAuthTokenSync } from '../auth/auth-store.mjs';
+import { Z2H_NPM_TOKEN_ENV } from '../../constants.mjs';
+import { ensureZ2hToken } from './ensure-token.mjs';
+
+// Substrings that, in a failed install's output, indicate the broker rejected
+// the z2h JWT (expired/invalid). npm surfaces `E401`/`code E401`; yarn berry
+// surfaces an HTTP 401 line. We re-auth on any of these rather than dumping a
+// raw npm error on a non-technical user.
+const AUTH_FAILURE_MARKERS = ['401', 'e401', 'unauthorized', 'authentication'];
+function looksLikeAuthFailure(text) {
+    const haystack = text.toLowerCase();
+    return AUTH_FAILURE_MARKERS.some(marker => haystack.includes(marker));
+}
+/**
+ * Spawn `yarn install` in `cwd` with the npm-broker credential injected, while
+ * streaming yarn's output live to the user. stdout is inherited; stderr is
+ * piped so we can both echo it and inspect it for a broker auth failure.
+ *
+ * Returns the captured stderr on success; throws an Error tagged
+ * `isAuthFailure` when the failure output looks like a broker 401 so the
+ * caller can re-auth, or rethrows the raw execa error otherwise.
+ */
+async function spawnYarnInstall(opts) {
+    const token = tryReadAuthTokenSync();
+    const env = { ...process.env, ...(token && { [Z2H_NPM_TOKEN_ENV]: token }), ...opts.extraEnv };
+    const child = execa('yarn', ['install'], {
+        cwd: opts.cwd,
+        stdout: 'inherit',
+        stderr: ['inherit', 'pipe'],
+        env,
+    });
+    try {
+        await child;
+    }
+    catch (err) {
+        const e = err;
+        const combined = `${e.stderr}\n${e.message ?? ''}`;
+        if (looksLikeAuthFailure(combined)) {
+            const authErr = new Error('broker rejected the z2h token during install');
+            authErr.isAuthFailure = true;
+            throw authErr;
+        }
+        throw err;
+    }
+}
+/**
+ * Run `yarn install` for an install-bearing command:
+ *   1. Preflight — ensure a z2h token exists (prompt `generate-z2h-token` if not).
+ *   2. Install through the broker.
+ *   3. On a broker 401, surface a friendly "your access expired — refreshing it"
+ *      message, re-auth, and retry the install exactly once.
+ *
+ * A non-auth failure (real dependency error, network, etc.) propagates as-is so
+ * the command's normal error path reports it.
+ */
+async function runYarnInstall(opts) {
+    await ensureZ2hToken();
+    try {
+        await spawnYarnInstall(opts);
+    }
+    catch (err) {
+        if (!err.isAuthFailure) {
+            throw err;
+        }
+        warn('your access expired — refreshing it now…');
+        await ensureZ2hToken({ forceRefresh: true });
+        info('access refreshed — retrying install');
+        await spawnYarnInstall(opts);
+    }
+}
+
+export { runYarnInstall };

package/dist/index.js

@@ -1,6 +1,6 @@
 const node_module = require('node:module');
-const commander = require('commander');
 const fs = require('node:fs');
+const commander = require('commander');
 const commands_dev = require('./commands/dev.js');
 const commands_build = require('./commands/build.js');
 const commands_clean = require('./commands/clean.js');

package/dist/migrations/003-npm-broker-scope-split.d.ts

@@ -0,0 +1,14 @@
+import type { Tree } from '@nx/devkit';
+/**
+ * Migrate the workspace npm/yarn config from the legacy single-registry
+ * `${NPM_TOKEN}` form to the `@mondaydotcomorg`→broker scope-split
+ * (`${Z2H_NPM_TOKEN}` placeholder). Rewrites the workspace-root `.yarnrc.yml`
+ * and `.npmrc`, plus any consumer-app copies that still carry the legacy
+ * placeholder (migration 001 normally removes per-consumer `.yarnrc.yml`, so
+ * this is just defensive cleanup).
+ *
+ * The global `~/.npmrc` broker block is written separately by `migrateCommand`
+ * (it lives outside the workspace Tree).
+ */
+export default function npmBrokerScopeSplit(tree: Tree): void;
+//# sourceMappingURL=003-npm-broker-scope-split.d.ts.map

package/dist/migrations/003-npm-broker-scope-split.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"003-npm-broker-scope-split.d.ts","sourceRoot":"","sources":["../../src/migrations/003-npm-broker-scope-split.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAuBvC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,OAAO,UAAU,mBAAmB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAgB5D"}

package/dist/migrations/003-npm-broker-scope-split.js

@@ -0,0 +1,51 @@
+Object.defineProperties(exports, { __esModule: { value: true }, [Symbol.toStringTag]: { value: 'Module' } });
+
+const util_npm_brokerConfig = require('../util/npm/broker-config.js');
+
+// Legacy marker: the old configs interpolated a real npm token via
+// `${NPM_TOKEN}`. Its presence means the file predates npm brokering and must
+// be rewritten to the scope-split. Once rewritten (placeholder is now
+// `${Z2H_NPM_TOKEN}`) this no longer matches, so the migration is idempotent.
+const LEGACY_TOKEN_PLACEHOLDER = '${NPM_TOKEN}';
+/**
+ * Rewrite a single rc file to `contents` iff it exists and still carries the
+ * legacy `${NPM_TOKEN}` placeholder. Returns nothing; mutates the Tree.
+ */
+function rewriteIfLegacy(tree, filePath, contents) {
+    if (!tree.exists(filePath)) {
+        return;
+    }
+    const current = tree.read(filePath, 'utf-8') ?? '';
+    if (!current.includes(LEGACY_TOKEN_PLACEHOLDER)) {
+        return; // already migrated (or never legacy) — leave untouched
+    }
+    tree.write(filePath, contents);
+}
+/**
+ * Migrate the workspace npm/yarn config from the legacy single-registry
+ * `${NPM_TOKEN}` form to the `@mondaydotcomorg`→broker scope-split
+ * (`${Z2H_NPM_TOKEN}` placeholder). Rewrites the workspace-root `.yarnrc.yml`
+ * and `.npmrc`, plus any consumer-app copies that still carry the legacy
+ * placeholder (migration 001 normally removes per-consumer `.yarnrc.yml`, so
+ * this is just defensive cleanup).
+ *
+ * The global `~/.npmrc` broker block is written separately by `migrateCommand`
+ * (it lives outside the workspace Tree).
+ */
+function npmBrokerScopeSplit(tree) {
+    const yarnrc = util_npm_brokerConfig.workspaceYarnrcContents();
+    const npmrc = util_npm_brokerConfig.workspaceNpmrcContents();
+    // Workspace root.
+    rewriteIfLegacy(tree, '.yarnrc.yml', yarnrc);
+    rewriteIfLegacy(tree, '.npmrc', npmrc);
+    // Any consumer apps that still carry their own legacy rc files.
+    for (const entry of tree.children('.')) {
+        if (entry.startsWith('.')) {
+            continue;
+        }
+        rewriteIfLegacy(tree, `${entry}/.yarnrc.yml`, yarnrc);
+        rewriteIfLegacy(tree, `${entry}/.npmrc`, npmrc);
+    }
+}
+
+exports.default = npmBrokerScopeSplit;

package/dist/migrations/__tests__/003-npm-broker-scope-split.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=003-npm-broker-scope-split.test.d.ts.map

package/dist/migrations/__tests__/003-npm-broker-scope-split.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"003-npm-broker-scope-split.test.d.ts","sourceRoot":"","sources":["../../../src/migrations/__tests__/003-npm-broker-scope-split.test.ts"],"names":[],"mappings":""}

package/dist/shadow/sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/shadow/sync.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE3D;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB9F"}
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/shadow/sync.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE3D;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAe9F"}

package/dist/shadow/sync.js

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 
 const fsExtra = require('fs-extra');
-const execa = require('execa');
 const util_logger = require('../util/logger.js');
+const util_npm_install = require('../util/npm/install.js');
 const shadow_mergePackageJson = require('./merge-package-json.js');
 
 /**
@@ -19,11 +19,9 @@ async function syncShadow(paths, consumerPkg) {
     if (oldHash !== newHash) {
         util_logger.info(oldHash ? 'consumer deps changed — yarn install' : 'first run — yarn install');
         // Yarn 4 is cache-first and non-interactive by default in non-TTY
-        // contexts, so plain `yarn install` is all we need.
-        await execa.execa('yarn', ['install'], {
-            cwd: paths.consumerDir,
-            stdio: 'inherit',
-        });
+        // contexts, so plain `yarn install` is all we need. runYarnInstall injects
+        // the npm-broker token, preflights auth, and re-auths on a broker 401.
+        await util_npm_install.runYarnInstall({ cwd: paths.consumerDir });
         await fsExtra.writeFile(paths.shadowDepsHash, newHash);
     }
 }

package/dist/util/auth/auth-store.d.ts

@@ -8,4 +8,14 @@ export declare class Z2hAuthMissingError extends Error {
     constructor(authFilePath: string);
 }
 export declare function readZthAuth(): Promise<ZthAuth>;
+/**
+ * Synchronous, never-throws read of the z2h JWT from `~/.zth/auth.json`.
+ * Returns the token string, or `null` when the file is absent, unreadable,
+ * malformed, or missing the `token` field.
+ *
+ * Used when building the env for a spawned package-manager process, where a
+ * missing token must degrade gracefully (best-effort self-update) rather than
+ * blow up — and where an inline sync read keeps the spawn call site simple.
+ */
+export declare function tryReadAuthTokenSync(): string | null;
 //# sourceMappingURL=auth-store.d.ts.map

package/dist/util/auth/auth-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../../../src/util/auth/auth-store.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,YAAY,QAAkC,CAAC;AAC5D,eAAO,MAAM,aAAa,QAAuC,CAAC;AAElE,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,mBAAoB,SAAQ,KAAK;aAChB,YAAY,EAAE,MAAM;gBAApB,YAAY,EAAE,MAAM;CAIjD;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CASpD"}
+{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../../../src/util/auth/auth-store.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,YAAY,QAAkC,CAAC;AAC5D,eAAO,MAAM,aAAa,QAAuC,CAAC;AAElE,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,mBAAoB,SAAQ,KAAK;aAChB,YAAY,EAAE,MAAM;gBAApB,YAAY,EAAE,MAAM;CAIjD;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CASpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,IAAI,CAOpD"}

package/dist/util/auth/auth-store.js

@@ -32,8 +32,27 @@ async function readZthAuth() {
     }
     return { token: parsed.token };
 }
+/**
+ * Synchronous, never-throws read of the z2h JWT from `~/.zth/auth.json`.
+ * Returns the token string, or `null` when the file is absent, unreadable,
+ * malformed, or missing the `token` field.
+ *
+ * Used when building the env for a spawned package-manager process, where a
+ * missing token must degrade gracefully (best-effort self-update) rather than
+ * blow up — and where an inline sync read keeps the spawn call site simple.
+ */
+function tryReadAuthTokenSync() {
+    try {
+        const parsed = fsExtra.readJsonSync(Z2H_AUTH_FILE);
+        return parsed?.token ?? null;
+    }
+    catch {
+        return null;
+    }
+}
 
 exports.Z2H_AUTH_DIR = Z2H_AUTH_DIR;
 exports.Z2H_AUTH_FILE = Z2H_AUTH_FILE;
 exports.Z2hAuthMissingError = Z2hAuthMissingError;
 exports.readZthAuth = readZthAuth;
+exports.tryReadAuthTokenSync = tryReadAuthTokenSync;

package/dist/util/auth/broker-credential-provider.d.ts

@@ -1,5 +1,4 @@
 import type { AwsCredentialIdentityProvider } from '@aws-sdk/types';
-export declare const DEFAULT_BROKER_BASE_URL = "https://bigbrain-zth.bigbrain.me";
 export declare const STS_BROKER_PATH = "/z2h-cli/sts/credentials";
 /**
  * AWS SDK credential provider that fetches short-lived deploy credentials

package/dist/util/auth/broker-credential-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"broker-credential-provider.d.ts","sourceRoot":"","sources":["../../../src/util/auth/broker-credential-provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAyB,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE3F,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAC1E,eAAO,MAAM,eAAe,6BAA6B,CAAC;AA4D1D;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,EAAE,OAAO,EAAE,EAAE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,6BAA6B,CAuBxG"}
+{"version":3,"file":"broker-credential-provider.d.ts","sourceRoot":"","sources":["../../../src/util/auth/broker-credential-provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAyB,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE3F,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAwD1D;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,EAAE,OAAO,EAAE,EAAE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,6BAA6B,CAuBxG"}

package/dist/util/auth/broker-credential-provider.js

@@ -1,18 +1,15 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 
+const constants = require('../../constants.js');
 const util_auth_authStore = require('./auth-store.js');
 
-const DEFAULT_BROKER_BASE_URL = 'https://bigbrain-zth.bigbrain.me';
 const STS_BROKER_PATH = '/z2h-cli/sts/credentials';
 // Refresh the cached credentials this many ms before they expire so the next
 // AWS API call doesn't race the broker round-trip against a hard expiry.
 const REFRESH_BUFFER_MS = 5 * 60 * 1000;
-function brokerBaseUrl() {
-    return process.env.Z2H_BROKER_BASE_URL || DEFAULT_BROKER_BASE_URL;
-}
 async function fetchCredentialsOnce(appName) {
     const { token } = await util_auth_authStore.readZthAuth();
-    const url = `${brokerBaseUrl()}${STS_BROKER_PATH}`;
+    const url = `${constants.brokerBaseUrl()}${STS_BROKER_PATH}`;
     let res;
     try {
         res = await fetch(url, {
@@ -75,6 +72,5 @@ function brokerCredentialProvider({ appName }) {
     };
 }
 
-exports.DEFAULT_BROKER_BASE_URL = DEFAULT_BROKER_BASE_URL;
 exports.STS_BROKER_PATH = STS_BROKER_PATH;
 exports.brokerCredentialProvider = brokerCredentialProvider;

package/dist/util/npm/__tests__/broker-config.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=broker-config.test.d.ts.map

package/dist/util/npm/__tests__/broker-config.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-config.test.d.ts","sourceRoot":"","sources":["../../../../src/util/npm/__tests__/broker-config.test.ts"],"names":[],"mappings":""}

package/dist/util/npm/__tests__/install.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=install.test.d.ts.map

package/dist/util/npm/__tests__/install.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.test.d.ts","sourceRoot":"","sources":["../../../../src/util/npm/__tests__/install.test.ts"],"names":[],"mappings":""}

package/dist/util/npm/broker-config.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The two npm config lines (§3.1 / §3.3) that route the brokered scope to the
+ * proxy and supply the `${Z2H_NPM_TOKEN}` placeholder. No literal token — npm
+ * interpolates the placeholder from the env at invocation time.
+ */
+export declare function brokerNpmrcLines(): string[];
+/**
+ * Full contents for a **workspace** `.npmrc` (§3.3): broker scope-split plus an
+ * explicit public default registry and always-auth. Used by the template and
+ * the migration so both stay byte-identical.
+ */
+export declare function workspaceNpmrcContents(): string;
+/**
+ * Full contents for a **workspace** `.yarnrc.yml` (§3.2): the brokered scope
+ * points at the proxy with the `${Z2H_NPM_TOKEN}` placeholder + always-auth;
+ * the default `npmRegistryServer` stays the public registry (direct, unchanged
+ * speed). `yarnPath` keeps the bundled Berry release so any `yarn` runs 4.x.
+ */
+export declare function workspaceYarnrcContents(): string;
+//# sourceMappingURL=broker-config.d.ts.map

package/dist/util/npm/broker-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-config.d.ts","sourceRoot":"","sources":["../../../src/util/npm/broker-config.ts"],"names":[],"mappings":"AAkBA;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,EAAE,CAK3C;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAiBhD"}

package/dist/util/npm/broker-config.js

@@ -0,0 +1,63 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+
+const constants = require('../../constants.js');
+
+/** `https://host/path/` (with trailing slash) for the registry= line. */
+function registryUrlWithSlash() {
+    const url = constants.brokerNpmRegistryUrl();
+    return url.endsWith('/') ? url : `${url}/`;
+}
+/**
+ * The `//host/path/` prefix (scheme stripped, trailing slash kept) that npm
+ * requires the `:_authToken` key to be keyed under so it aligns with the
+ * registry path. Derived from the same registry URL so staging overrides flow
+ * through.
+ */
+function authKeyPrefix() {
+    return registryUrlWithSlash().replace(/^https?:/, '');
+}
+/**
+ * The two npm config lines (§3.1 / §3.3) that route the brokered scope to the
+ * proxy and supply the `${Z2H_NPM_TOKEN}` placeholder. No literal token — npm
+ * interpolates the placeholder from the env at invocation time.
+ */
+function brokerNpmrcLines() {
+    return [
+        `${constants.BROKER_NPM_SCOPE}:registry=${registryUrlWithSlash()}`,
+        `${authKeyPrefix()}:_authToken=\${${constants.Z2H_NPM_TOKEN_ENV}}`,
+    ];
+}
+/**
+ * Full contents for a **workspace** `.npmrc` (§3.3): broker scope-split plus an
+ * explicit public default registry and always-auth. Used by the template and
+ * the migration so both stay byte-identical.
+ */
+function workspaceNpmrcContents() {
+    return [...brokerNpmrcLines(), `registry=${constants.PUBLIC_NPM_REGISTRY_URL}`, 'always-auth=true'].join('\n') + '\n';
+}
+/**
+ * Full contents for a **workspace** `.yarnrc.yml` (§3.2): the brokered scope
+ * points at the proxy with the `${Z2H_NPM_TOKEN}` placeholder + always-auth;
+ * the default `npmRegistryServer` stays the public registry (direct, unchanged
+ * speed). `yarnPath` keeps the bundled Berry release so any `yarn` runs 4.x.
+ */
+function workspaceYarnrcContents() {
+    const scopeKey = constants.BROKER_NPM_SCOPE.replace(/^@/, '');
+    return ([
+        'nodeLinker: node-modules',
+        '',
+        'npmScopes:',
+        `  ${scopeKey}:`,
+        `    npmRegistryServer: "${constants.brokerNpmRegistryUrl()}"`,
+        `    npmAuthToken: "\${${constants.Z2H_NPM_TOKEN_ENV}}"`,
+        '    npmAlwaysAuth: true',
+        '',
+        `npmRegistryServer: "${constants.PUBLIC_NPM_REGISTRY_URL}"`,
+        '',
+        'yarnPath: .yarn/releases/yarn-4.5.1.cjs',
+    ].join('\n') + '\n');
+}
+
+exports.brokerNpmrcLines = brokerNpmrcLines;
+exports.workspaceNpmrcContents = workspaceNpmrcContents;
+exports.workspaceYarnrcContents = workspaceYarnrcContents;

package/dist/util/npm/ensure-token.d.ts

@@ -0,0 +1,19 @@
+export interface EnsureZ2hTokenOptions {
+    /**
+     * Re-run the token flow even if a token already exists on disk. Used after a
+     * broker 401, where the stored token is present but expired/invalid.
+     */
+    forceRefresh?: boolean;
+}
+/**
+ * Ensure a z2h JWT exists at `~/.zth/auth.json` before an install-bearing
+ * command runs. If none is present (or `forceRefresh` is set), drive the
+ * existing `generate-z2h-token` flow — loopback capture with manual-paste
+ * fallback — which writes the token. No-ops when a token already exists and no
+ * refresh was requested.
+ *
+ * This is the install preflight: it keeps a friendly auth prompt in front of
+ * the raw npm error a non-technical user would otherwise hit.
+ */
+export declare function ensureZ2hToken(opts?: EnsureZ2hTokenOptions): Promise<void>;
+//# sourceMappingURL=ensure-token.d.ts.map

package/dist/util/npm/ensure-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-token.d.ts","sourceRoot":"","sources":["../../../src/util/npm/ensure-token.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAKpF"}

package/dist/util/npm/ensure-token.js

@@ -0,0 +1,24 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+
+const util_auth_authStore = require('../auth/auth-store.js');
+const util_logger = require('../logger.js');
+const commands_generateZ2hToken = require('../../commands/generate-z2h-token.js');
+
+/**
+ * Ensure a z2h JWT exists at `~/.zth/auth.json` before an install-bearing
+ * command runs. If none is present (or `forceRefresh` is set), drive the
+ * existing `generate-z2h-token` flow — loopback capture with manual-paste
+ * fallback — which writes the token. No-ops when a token already exists and no
+ * refresh was requested.
+ *
+ * This is the install preflight: it keeps a friendly auth prompt in front of
+ * the raw npm error a non-technical user would otherwise hit.
+ */
+async function ensureZ2hToken(opts = {}) {
+    if (opts.forceRefresh || !util_auth_authStore.tryReadAuthTokenSync()) {
+        util_logger.info('you need to sign in to install monday packages — opening the sign-in page');
+        await commands_generateZ2hToken.generateZ2HTokenCommand();
+    }
+}
+
+exports.ensureZ2hToken = ensureZ2hToken;

package/dist/util/npm/install.d.ts

@@ -0,0 +1,18 @@
+export interface RunYarnInstallOptions {
+    /** Directory to run `yarn install` in. */
+    cwd: string;
+    /** Extra env to merge on top of `process.env` + the broker token. */
+    extraEnv?: NodeJS.ProcessEnv;
+}
+/**
+ * Run `yarn install` for an install-bearing command:
+ *   1. Preflight — ensure a z2h token exists (prompt `generate-z2h-token` if not).
+ *   2. Install through the broker.
+ *   3. On a broker 401, surface a friendly "your access expired — refreshing it"
+ *      message, re-auth, and retry the install exactly once.
+ *
+ * A non-auth failure (real dependency error, network, etc.) propagates as-is so
+ * the command's normal error path reports it.
+ */
+export declare function runYarnInstall(opts: RunYarnInstallOptions): Promise<void>;
+//# sourceMappingURL=install.d.ts.map

package/dist/util/npm/install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../../src/util/npm/install.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,qBAAqB;IACpC,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAC9B;AAqCD;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAc/E"}

package/dist/util/npm/install.js

@@ -0,0 +1,76 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+
+const execa = require('execa');
+const util_logger = require('../logger.js');
+const util_auth_authStore = require('../auth/auth-store.js');
+const constants = require('../../constants.js');
+const util_npm_ensureToken = require('./ensure-token.js');
+
+// Substrings that, in a failed install's output, indicate the broker rejected
+// the z2h JWT (expired/invalid). npm surfaces `E401`/`code E401`; yarn berry
+// surfaces an HTTP 401 line. We re-auth on any of these rather than dumping a
+// raw npm error on a non-technical user.
+const AUTH_FAILURE_MARKERS = ['401', 'e401', 'unauthorized', 'authentication'];
+function looksLikeAuthFailure(text) {
+    const haystack = text.toLowerCase();
+    return AUTH_FAILURE_MARKERS.some(marker => haystack.includes(marker));
+}
+/**
+ * Spawn `yarn install` in `cwd` with the npm-broker credential injected, while
+ * streaming yarn's output live to the user. stdout is inherited; stderr is
+ * piped so we can both echo it and inspect it for a broker auth failure.
+ *
+ * Returns the captured stderr on success; throws an Error tagged
+ * `isAuthFailure` when the failure output looks like a broker 401 so the
+ * caller can re-auth, or rethrows the raw execa error otherwise.
+ */
+async function spawnYarnInstall(opts) {
+    const token = util_auth_authStore.tryReadAuthTokenSync();
+    const env = { ...process.env, ...(token && { [constants.Z2H_NPM_TOKEN_ENV]: token }), ...opts.extraEnv };
+    const child = execa.execa('yarn', ['install'], {
+        cwd: opts.cwd,
+        stdout: 'inherit',
+        stderr: ['inherit', 'pipe'],
+        env,
+    });
+    try {
+        await child;
+    }
+    catch (err) {
+        const e = err;
+        const combined = `${e.stderr}\n${e.message ?? ''}`;
+        if (looksLikeAuthFailure(combined)) {
+            const authErr = new Error('broker rejected the z2h token during install');
+            authErr.isAuthFailure = true;
+            throw authErr;
+        }
+        throw err;
+    }
+}
+/**
+ * Run `yarn install` for an install-bearing command:
+ *   1. Preflight — ensure a z2h token exists (prompt `generate-z2h-token` if not).
+ *   2. Install through the broker.
+ *   3. On a broker 401, surface a friendly "your access expired — refreshing it"
+ *      message, re-auth, and retry the install exactly once.
+ *
+ * A non-auth failure (real dependency error, network, etc.) propagates as-is so
+ * the command's normal error path reports it.
+ */
+async function runYarnInstall(opts) {
+    await util_npm_ensureToken.ensureZ2hToken();
+    try {
+        await spawnYarnInstall(opts);
+    }
+    catch (err) {
+        if (!err.isAuthFailure) {
+            throw err;
+        }
+        util_logger.warn('your access expired — refreshing it now…');
+        await util_npm_ensureToken.ensureZ2hToken({ forceRefresh: true });
+        util_logger.info('access refreshed — retrying install');
+        await spawnYarnInstall(opts);
+    }
+}
+
+exports.runYarnInstall = runYarnInstall;

package/migrations.json

@@ -9,6 +9,11 @@
       "version": "0.4.1",
       "description": "Remove z2h-cli from workspace and consumer devDependencies (managed globally)",
       "migrate": "./dist/migrations/002-remove-z2h-cli-from-workspace-deps"
+    },
+    "npm-broker-scope-split": {
+      "version": "0.6.0",
+      "description": "Rewrite workspace .yarnrc.yml/.npmrc from ${NPM_TOKEN} to the @mondaydotcomorg broker scope-split",
+      "migrate": "./dist/migrations/003-npm-broker-scope-split"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mondaydotcomorg/z2h-cli",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "bin": "./bin/z2h-cli.js",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/src/commands/__tests__/create-workspace.test.ts

@@ -3,12 +3,14 @@ import os from 'node:os';
 import { mkdtemp, rm, writeJson, readJson, ensureDir, pathExists } from 'fs-extra';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
-import { execa } from 'execa';
+import { runYarnInstall } from '../../util/npm/install';
 import { createWorkspaceCommand } from '../create-workspace';
 
-// Mock execa so `yarn install` doesn't actually run.
-vi.mock('execa', () => ({
-  execa: vi.fn().mockResolvedValue({ stdout: '', stderr: '', exitCode: 0 }),
+// Mock the install helper so `yarn install` (with its broker preflight) doesn't
+// actually run. The token-injection + 401 re-auth behavior is covered in
+// util/npm/__tests__/install.test.ts.
+vi.mock('../../util/npm/install', () => ({
+  runYarnInstall: vi.fn().mockResolvedValue(undefined),
 }));
 
 describe('create-workspace', () => {
@@ -17,7 +19,7 @@ describe('create-workspace', () => {
   beforeEach(async () => {
     tmp = await mkdtemp(path.join(os.tmpdir(), 'z2h-cw-'));
     process.env.Z2H_WORKSPACE_HOME = tmp;
-    vi.mocked(execa).mockClear();
+    vi.mocked(runYarnInstall).mockClear();
     // After mkdtemp the dir exists and is empty; we want absent for the
     // "happy path" tests, so remove it.
     await rm(tmp, { recursive: true, force: true });
@@ -46,11 +48,7 @@ describe('create-workspace', () => {
     expect(await pathExists(path.join(tmp, '.npmrc'))).toBe(true);
     expect(await pathExists(path.join(tmp, 'README.md'))).toBe(true);
 
-    expect(execa).toHaveBeenCalledWith(
-      'yarn',
-      expect.arrayContaining(['install']),
-      expect.objectContaining({ cwd: tmp })
-    );
+    expect(runYarnInstall).toHaveBeenCalledWith(expect.objectContaining({ cwd: tmp }));
   });
 
   it('refuses if the target dir is non-empty', async () => {
@@ -58,7 +56,7 @@ describe('create-workspace', () => {
     await writeJson(path.join(tmp, 'somefile.json'), { hello: 'world' });
 
     await expect(createWorkspaceCommand({})).rejects.toThrow(/Workspace already exists/);
-    expect(execa).not.toHaveBeenCalled();
+    expect(runYarnInstall).not.toHaveBeenCalled();
   });
 
   it('does not include z2h-cli in workspace devDeps (managed globally)', async () => {