handoff-app 2.0.0-7 → 2.0.0-8

package/dist/registry/asset-storage/resolve.d.ts

@@ -6,7 +6,7 @@
  * {@link import('../db/driver')}: only provider selection, module location, non-secret options, and
  * env-var *names* are ever persisted; secret *values* are read from `process.env` at request time.
  */
-import type { Config } from '../../types/config';
+import type { ResolvedConfig } from '../../types/config';
 import type { AssetStorageProvider } from '../db/schema';
 /** Which adapter implementation is active. */
 export type AssetStorageAdapterKind = 'database' | 'vercel-blob' | 'custom';
@@ -42,4 +42,4 @@ export interface ResolvedAssetStorage {
 /** Resolve raw asset storage settings into a fully-defaulted shape. */
 export declare const resolveAssetStorageSettings: (settings: AssetStorageSettings | null | undefined) => ResolvedAssetStorage;
 /** Resolve the active asset storage settings from a loaded config (CLI/build side). */
-export declare const resolveAssetStorageFromConfig: (config: Config | null | undefined) => ResolvedAssetStorage;
+export declare const resolveAssetStorageFromConfig: (config: ResolvedConfig | null | undefined) => ResolvedAssetStorage;

package/dist/registry/asset-storage/resolve.js

@@ -32,5 +32,8 @@ const resolveAssetStorageSettings = (settings) => {
 };
 exports.resolveAssetStorageSettings = resolveAssetStorageSettings;
 /** Resolve the active asset storage settings from a loaded config (CLI/build side). */
-const resolveAssetStorageFromConfig = (config) => { var _a, _b; return (0, exports.resolveAssetStorageSettings)((_b = (_a = config === null || config === void 0 ? void 0 : config.runtime) === null || _a === void 0 ? void 0 : _a.registry) === null || _b === void 0 ? void 0 : _b.assetStorage); };
+const resolveAssetStorageFromConfig = (config) => {
+    var _a, _b, _c, _d, _e, _f;
+    return (0, exports.resolveAssetStorageSettings)(Object.assign(Object.assign({}, (_b = (_a = config === null || config === void 0 ? void 0 : config.runtime) === null || _a === void 0 ? void 0 : _a.registry) === null || _b === void 0 ? void 0 : _b.assetStorage), { tokenEnv: (_f = (_e = (_d = (_c = config === null || config === void 0 ? void 0 : config.runtime) === null || _c === void 0 ? void 0 : _c.registry) === null || _d === void 0 ? void 0 : _d.assetStorage) === null || _e === void 0 ? void 0 : _e.token) === null || _f === void 0 ? void 0 : _f.$env }));
+};
 exports.resolveAssetStorageFromConfig = resolveAssetStorageFromConfig;

package/dist/registry/checkout/index.js

@@ -106,14 +106,14 @@ const resolveConnectionOrThrow = (handoff) => __awaiter(void 0, void 0, void 0,
         throw new CheckoutError(`checkout is only available from a connected workspace (runtime.mode: "workspace"); this project is "${mode}". ` +
             'A registry host stores and serves entities; it has no local workspace to check them out into.');
     }
-    const connection = yield (0, connection_1.resolveAuthenticatedRegistryConnection)(handoff.config, handoff.workingPath);
+    const connection = yield (0, connection_1.resolveAuthenticatedRegistryConnection)(handoff.config, handoff.workingPath, handoff.getProfile());
     if (!connection.url) {
-        throw new CheckoutError(`No registry is configured. Run \`handoff-app login --url <registry-url>\`, set runtime.registryConnection.url, ` +
+        throw new CheckoutError(`No registry is configured. Run \`${(0, connection_1.loginCommandHint)(connection)}\`, set runtime.registryConnection.url, ` +
             `or set the "${connection.urlEnv}" environment variable to the base URL of the registry to checkout from.`);
     }
     if (!connection.accessToken) {
-        throw new CheckoutError(`No registry access token is configured. Run \`handoff-app login --url ${connection.url}\`, or set the ` +
-            `"${connection.accessTokenEnv}" environment variable to a user-issued token for CI.`);
+        throw new CheckoutError(`No registry access token is configured. Run \`${(0, connection_1.loginCommandHint)(connection)}\`, or set the ` +
+            `"${connection.accessTokenEnv}" environment variable to a user-issued token for CI.${(0, connection_1.unusedLoginNote)(connection)}`);
     }
     return connection;
 });

package/dist/registry/connection.d.ts

@@ -1,20 +1,17 @@
 /**
- * Connected-workspace registry connection resolution.
- *
- * A connected workspace is `runtime.mode: 'workspace'` plus a `runtime.registryConnection` block
- * pointing at a remote registry — it is not a third runtime mode. The connection is resolved from
- * config + environment: the registry URL may be given inline or via an env-var *name*, and the
- * access token is always read from an env-var name (never persisted as a value). This is the single
- * source the publish (and later checkout) client reads its target + credentials from.
- *
- * The older `HANDOFF_CLOUD_*` names still work as deprecated fallbacks; see
- * {@link DEPRECATED_ENV_ALIASES}.
+ * Registry connection values resolve at config load. Saved device login credentials can fill
+ * missing values for CLI operations; neither source is persisted in the app's client config.
  */
-import type { Config } from '../types/config';
+import type { ResolvedConfig } from '../types/config';
 /** Default env-var name holding the remote registry base URL. */
 export declare const DEFAULT_REGISTRY_URL_ENV = "HANDOFF_REGISTRY_URL";
 /** Default env-var name holding the connected-workspace access token. */
 export declare const DEFAULT_REGISTRY_ACCESS_TOKEN_ENV = "HANDOFF_REGISTRY_ACCESS_TOKEN";
+/** A saved login and the profile it is stored under, which is not always the selected profile. */
+interface SavedLogin {
+    profile: string;
+    url: string;
+}
 /** Fully resolved connected-workspace registry connection. */
 export interface ResolvedRegistryConnection {
     /** Resolved registry base URL (inline config value wins, else the named env var), or `''`. */
@@ -25,25 +22,32 @@ export interface ResolvedRegistryConnection {
     urlEnv: string;
     /** Name of the env var the access token is read from. */
     accessTokenEnv: string;
+    /** Profile the saved login was looked up under. */
+    loginProfile: string;
+    /** Set when a saved login was skipped because it was issued for another registry. */
+    unmatchedLogin?: SavedLogin;
 }
-/**
- * Resolve the connected-workspace registry connection from config + environment. Never throws —
- * Callers inspect the resolved URL and access token to surface specific configuration errors.
- *
- * `urlEnv` and `accessTokenEnv` always report the canonical name, even when an alias supplied the
- * value, so errors built from them point at the variable to adopt.
- */
-export declare const resolveRegistryConnection: (config: Config | null | undefined) => ResolvedRegistryConnection;
+/** Read values resolved at config load, retaining variable names for CLI diagnostics. */
+export declare const resolveRegistryConnection: (config: ResolvedConfig | null | undefined) => ResolvedRegistryConnection;
 /**
  * Resolve the same connection for an authenticated CLI operation, letting a saved device login fill
  * in what the environment does not provide. A valid login supplies both the registry URL and the
- * access token, so `handoff-app login` alone is enough to publish and checkout. Environment values
- * keep precedence for deterministic CI: `HANDOFF_REGISTRY_URL` (or inline config) wins over the
- * saved URL, and `HANDOFF_REGISTRY_ACCESS_TOKEN` wins over the saved token. The saved token only
- * applies to the URL it was issued for.
+ * access token, so `handoff-app login` alone is enough to publish and checkout. The login is the one
+ * saved under the selected profile, which is how one workspace addresses several registries.
+ * Environment values keep precedence for deterministic CI: `HANDOFF_REGISTRY_URL` (or inline config)
+ * wins over the saved URL, and `HANDOFF_REGISTRY_ACCESS_TOKEN` wins over the saved token. The saved
+ * token only applies to the URL it was issued for.
  *
  * A configured `HANDOFF_SYNC_SECRET` is the last resort. Being deployment-wide rather than personal,
  * it fills in only where there is no explicit token and no login (CI, in practice), instead of quietly
  * speaking for a developer who is signed in.
  */
-export declare const resolveAuthenticatedRegistryConnection: (config: Config | null | undefined, workingPath?: string) => Promise<ResolvedRegistryConnection>;
+export declare const resolveAuthenticatedRegistryConnection: (config: ResolvedConfig | null | undefined, workingPath?: string, profile?: string) => Promise<ResolvedRegistryConnection>;
+/** The `handoff-app login` call that would authorize this connection, naming the selected profile. */
+export declare const loginCommandHint: (connection: ResolvedRegistryConnection) => string;
+/**
+ * Names a saved login that was skipped because it belongs to another registry. Without it, a run
+ * that resolves its URL from the environment reports a missing token while a login is in place.
+ */
+export declare const unusedLoginNote: (connection: ResolvedRegistryConnection) => string;
+export {};

package/dist/registry/connection.js

@@ -1,15 +1,7 @@
 "use strict";
 /**
- * Connected-workspace registry connection resolution.
- *
- * A connected workspace is `runtime.mode: 'workspace'` plus a `runtime.registryConnection` block
- * pointing at a remote registry — it is not a third runtime mode. The connection is resolved from
- * config + environment: the registry URL may be given inline or via an env-var *name*, and the
- * access token is always read from an env-var name (never persisted as a value). This is the single
- * source the publish (and later checkout) client reads its target + credentials from.
- *
- * The older `HANDOFF_CLOUD_*` names still work as deprecated fallbacks; see
- * {@link DEPRECATED_ENV_ALIASES}.
+ * Registry connection values resolve at config load. Saved device login credentials can fill
+ * missing values for CLI operations; neither source is persisted in the app's client config.
  */
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
@@ -21,89 +13,83 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveAuthenticatedRegistryConnection = exports.resolveRegistryConnection = exports.DEFAULT_REGISTRY_ACCESS_TOKEN_ENV = exports.DEFAULT_REGISTRY_URL_ENV = void 0;
+exports.unusedLoginNote = exports.loginCommandHint = exports.resolveAuthenticatedRegistryConnection = exports.resolveRegistryConnection = exports.DEFAULT_REGISTRY_ACCESS_TOKEN_ENV = exports.DEFAULT_REGISTRY_URL_ENV = void 0;
+const resolve_env_1 = require("../config/resolve-env");
 const store_1 = require("../cli/auth/store");
 // Imported straight from the module, not the `auth` barrel, to keep the database schema off the CLI
 // startup path; this file is resolved for every command.
 const sync_secret_1 = require("./auth/sync-secret");
-const logger_1 = require("../utils/logger");
 /** Default env-var name holding the remote registry base URL. */
 exports.DEFAULT_REGISTRY_URL_ENV = 'HANDOFF_REGISTRY_URL';
 /** Default env-var name holding the connected-workspace access token. */
 exports.DEFAULT_REGISTRY_ACCESS_TOKEN_ENV = 'HANDOFF_REGISTRY_ACCESS_TOKEN';
-/**
- * Old env-var names we still read, keyed by the name that replaced them. Keeps workspaces set up
- * from the older docs working instead of silently reporting no registry.
- */
-const DEPRECATED_ENV_ALIASES = {
-    [exports.DEFAULT_REGISTRY_URL_ENV]: 'HANDOFF_CLOUD_URL',
-    [exports.DEFAULT_REGISTRY_ACCESS_TOKEN_ENV]: 'HANDOFF_CLOUD_TOKEN',
-};
-/** Aliases we've already warned about, so each one warns once per run and not once per lookup. */
-const warnedAliases = new Set();
-/**
- * Value of the named env var, falling back to its deprecated alias. Only the default names have
- * aliases: a custom `urlEnv`/`accessTokenEnv` is a deliberate choice, so a stray `HANDOFF_CLOUD_*`
- * must not stand in for it. The warning goes through {@link Logger.warn}, so
- * `HANDOFF_LOG_LEVEL=error` silences it in CI.
- */
-const readConnectionEnv = (name) => {
-    var _a, _b;
-    const configured = (_a = process.env[name]) === null || _a === void 0 ? void 0 : _a.trim();
-    if (configured)
-        return configured;
-    const alias = DEPRECATED_ENV_ALIASES[name];
-    const inherited = alias ? (_b = process.env[alias]) === null || _b === void 0 ? void 0 : _b.trim() : '';
-    if (!inherited)
-        return '';
-    if (!warnedAliases.has(alias)) {
-        warnedAliases.add(alias);
-        logger_1.Logger.warn(`${alias} is deprecated and will be removed in a future release; set ${name} instead.`);
-    }
-    return inherited;
-};
-/**
- * Resolve the connected-workspace registry connection from config + environment. Never throws —
- * Callers inspect the resolved URL and access token to surface specific configuration errors.
- *
- * `urlEnv` and `accessTokenEnv` always report the canonical name, even when an alias supplied the
- * value, so errors built from them point at the variable to adopt.
- */
+/** Read values resolved at config load, retaining variable names for CLI diagnostics. */
 const resolveRegistryConnection = (config) => {
-    var _a, _b, _c, _d;
+    var _a, _b, _c;
     const connection = (_a = config === null || config === void 0 ? void 0 : config.runtime) === null || _a === void 0 ? void 0 : _a.registryConnection;
-    const urlEnv = ((_b = connection === null || connection === void 0 ? void 0 : connection.urlEnv) === null || _b === void 0 ? void 0 : _b.trim()) || exports.DEFAULT_REGISTRY_URL_ENV;
-    const accessTokenEnv = ((_c = connection === null || connection === void 0 ? void 0 : connection.accessTokenEnv) === null || _c === void 0 ? void 0 : _c.trim()) || exports.DEFAULT_REGISTRY_ACCESS_TOKEN_ENV;
-    const inlineUrl = (_d = connection === null || connection === void 0 ? void 0 : connection.url) === null || _d === void 0 ? void 0 : _d.trim();
-    const url = inlineUrl || readConnectionEnv(urlEnv);
-    const accessToken = readConnectionEnv(accessTokenEnv);
+    const urlEnv = (0, resolve_env_1.configEnvName)(config, 'runtime.registryConnection.url') || exports.DEFAULT_REGISTRY_URL_ENV;
+    const accessTokenEnv = (0, resolve_env_1.configEnvName)(config, 'runtime.registryConnection.accessToken') || exports.DEFAULT_REGISTRY_ACCESS_TOKEN_ENV;
+    const url = ((_b = connection === null || connection === void 0 ? void 0 : connection.url) === null || _b === void 0 ? void 0 : _b.trim()) || '';
+    const accessToken = ((_c = connection === null || connection === void 0 ? void 0 : connection.accessToken) === null || _c === void 0 ? void 0 : _c.trim()) || '';
     return {
         url,
         accessToken,
         urlEnv,
         accessTokenEnv,
+        loginProfile: store_1.DEFAULT_LOGIN_PROFILE,
     };
 };
 exports.resolveRegistryConnection = resolveRegistryConnection;
+/**
+ * The valid login to use for a profile. A profile without its own login falls back to the default
+ * login, so a workspace that names profiles for other reasons keeps working after one plain
+ * `handoff-app login`. The fallback is safe because a token is only ever used for the registry URL
+ * it was issued for.
+ */
+const readProfileLogin = (workingPath, profile) => __awaiter(void 0, void 0, void 0, function* () {
+    const own = yield (0, store_1.readCliAuth)(workingPath, profile);
+    if ((0, store_1.cliAuthTokenIsValid)(own))
+        return { auth: own, profile };
+    const fallback = profile === store_1.DEFAULT_LOGIN_PROFILE ? null : yield (0, store_1.readCliAuth)(workingPath);
+    return (0, store_1.cliAuthTokenIsValid)(fallback) ? { auth: fallback, profile: store_1.DEFAULT_LOGIN_PROFILE } : null;
+});
 /**
  * Resolve the same connection for an authenticated CLI operation, letting a saved device login fill
  * in what the environment does not provide. A valid login supplies both the registry URL and the
- * access token, so `handoff-app login` alone is enough to publish and checkout. Environment values
- * keep precedence for deterministic CI: `HANDOFF_REGISTRY_URL` (or inline config) wins over the
- * saved URL, and `HANDOFF_REGISTRY_ACCESS_TOKEN` wins over the saved token. The saved token only
- * applies to the URL it was issued for.
+ * access token, so `handoff-app login` alone is enough to publish and checkout. The login is the one
+ * saved under the selected profile, which is how one workspace addresses several registries.
+ * Environment values keep precedence for deterministic CI: `HANDOFF_REGISTRY_URL` (or inline config)
+ * wins over the saved URL, and `HANDOFF_REGISTRY_ACCESS_TOKEN` wins over the saved token. The saved
+ * token only applies to the URL it was issued for.
  *
  * A configured `HANDOFF_SYNC_SECRET` is the last resort. Being deployment-wide rather than personal,
  * it fills in only where there is no explicit token and no login (CI, in practice), instead of quietly
  * speaking for a developer who is signed in.
  */
-const resolveAuthenticatedRegistryConnection = (config_1, ...args_1) => __awaiter(void 0, [config_1, ...args_1], void 0, function* (config, workingPath = process.cwd()) {
+const resolveAuthenticatedRegistryConnection = (config_1, ...args_1) => __awaiter(void 0, [config_1, ...args_1], void 0, function* (config, workingPath = process.cwd(), profile) {
     const connection = (0, exports.resolveRegistryConnection)(config);
-    const auth = yield (0, store_1.readCliAuth)(workingPath);
-    const login = (0, store_1.cliAuthTokenIsValid)(auth) ? auth : null;
-    const url = connection.url || (login === null || login === void 0 ? void 0 : login.remoteUrl) || '';
-    const savedToken = login && (0, store_1.cliAuthMatchesRegistry)(login, url) ? login.accessToken : '';
-    const accessToken = connection.accessToken || savedToken || (0, sync_secret_1.resolveRegistrySyncSecret)();
-    return Object.assign(Object.assign({}, connection), { url, accessToken });
+    const loginProfile = (profile === null || profile === void 0 ? void 0 : profile.trim()) || store_1.DEFAULT_LOGIN_PROFILE;
+    const login = yield readProfileLogin(workingPath, loginProfile);
+    const url = connection.url || (login === null || login === void 0 ? void 0 : login.auth.remoteUrl) || '';
+    const matches = Boolean(login) && (0, store_1.cliAuthMatchesRegistry)(login.auth, url);
+    const accessToken = connection.accessToken || (matches ? login.auth.accessToken : '') || (0, sync_secret_1.resolveRegistrySyncSecret)();
+    return Object.assign(Object.assign({}, connection), { url,
+        accessToken,
+        loginProfile, unmatchedLogin: login && !matches ? { profile: login.profile, url: login.auth.remoteUrl } : undefined });
 });
 exports.resolveAuthenticatedRegistryConnection = resolveAuthenticatedRegistryConnection;
+/** The `handoff-app login` call that would authorize this connection, naming the selected profile. */
+const loginCommandHint = (connection) => [
+    'handoff-app login',
+    connection.loginProfile === store_1.DEFAULT_LOGIN_PROFILE ? '' : ` --profile ${connection.loginProfile}`,
+    ` --url ${connection.url || '<registry-url>'}`,
+].join('');
+exports.loginCommandHint = loginCommandHint;
+/**
+ * Names a saved login that was skipped because it belongs to another registry. Without it, a run
+ * that resolves its URL from the environment reports a missing token while a login is in place.
+ */
+const unusedLoginNote = (connection) => connection.unmatchedLogin
+    ? ` The login saved for profile "${connection.unmatchedLogin.profile}" is for ${connection.unmatchedLogin.url}, not ${connection.url}.`
+    : '';
+exports.unusedLoginNote = unusedLoginNote;

package/dist/registry/db/driver.d.ts

@@ -9,7 +9,7 @@
  * credentials are referenced by environment-variable name only and resolved to a value at runtime;
  * the value is never stored in config.
  */
-import type { Config } from '../../types/config';
+import type { ResolvedConfig } from '../../types/config';
 /** Built-in registry database connection driver. Both ship with the package and target Postgres. */
 export type RegistryDatabaseDriver = 'pg' | 'neon';
 /** Default env-var name holding the database connection string. */
@@ -28,19 +28,12 @@ export interface ResolvedRegistryDatabase {
     connectionString: string;
 }
 /** Resolve the env-var name holding the database URL (defaults to `DATABASE_URL`). */
-export declare const resolveDatabaseUrlEnv: (config: Config | null | undefined) => string;
-/**
- * Resolve the legacy fixed-token env-var name for configuration compatibility.
- *
- * @deprecated The returned env var is intentionally ignored by registry authorization. Use a
- * user-issued access token or `handoff-app login`.
- */
-export declare const resolveApiTokenEnv: (config: Config | null | undefined) => string;
+export declare const resolveDatabaseUrlEnv: (config: ResolvedConfig | null | undefined) => string;
 /** Resolve the configured registry database driver (defaults to `pg`). */
-export declare const resolveRegistryDriver: (config: Config | null | undefined) => RegistryDatabaseDriver;
+export declare const resolveRegistryDriver: (config: ResolvedConfig | null | undefined) => RegistryDatabaseDriver;
 /**
  * Resolve the registry database connection from config + environment. Throws an actionable error
  * when the configured env var is unset so the CLI can surface a clear "missing database URL"
  * message instead of failing deep inside the driver.
  */
-export declare const resolveRegistryDatabase: (config: Config | null | undefined) => ResolvedRegistryDatabase;
+export declare const resolveRegistryDatabase: (config: ResolvedConfig | null | undefined) => ResolvedRegistryDatabase;

package/dist/registry/db/driver.js

@@ -11,7 +11,7 @@
  * the value is never stored in config.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveRegistryDatabase = exports.resolveRegistryDriver = exports.resolveApiTokenEnv = exports.resolveDatabaseUrlEnv = exports.DEFAULT_REGISTRY_DRIVER = exports.DEFAULT_REGISTRY_API_TOKEN_ENV = exports.DEFAULT_DATABASE_URL_ENV = void 0;
+exports.resolveRegistryDatabase = exports.resolveRegistryDriver = exports.resolveDatabaseUrlEnv = exports.DEFAULT_REGISTRY_DRIVER = exports.DEFAULT_REGISTRY_API_TOKEN_ENV = exports.DEFAULT_DATABASE_URL_ENV = void 0;
 /** Default env-var name holding the database connection string. */
 exports.DEFAULT_DATABASE_URL_ENV = 'DATABASE_URL';
 /** @deprecated Fixed registry server secrets are no longer authorized. */
@@ -20,23 +20,11 @@ exports.DEFAULT_REGISTRY_API_TOKEN_ENV = 'HANDOFF_REGISTRY_API_TOKEN';
 exports.DEFAULT_REGISTRY_DRIVER = 'pg';
 /** Resolve the env-var name holding the database URL (defaults to `DATABASE_URL`). */
 const resolveDatabaseUrlEnv = (config) => {
-    var _a, _b, _c;
-    const configured = (_c = (_b = (_a = config === null || config === void 0 ? void 0 : config.runtime) === null || _a === void 0 ? void 0 : _a.registry) === null || _b === void 0 ? void 0 : _b.databaseUrlEnv) === null || _c === void 0 ? void 0 : _c.trim();
+    var _a, _b, _c, _d;
+    const configured = (_d = (_c = (_b = (_a = config === null || config === void 0 ? void 0 : config.runtime) === null || _a === void 0 ? void 0 : _a.registry) === null || _b === void 0 ? void 0 : _b.databaseUrl) === null || _c === void 0 ? void 0 : _c.$env) === null || _d === void 0 ? void 0 : _d.trim();
     return configured || exports.DEFAULT_DATABASE_URL_ENV;
 };
 exports.resolveDatabaseUrlEnv = resolveDatabaseUrlEnv;
-/**
- * Resolve the legacy fixed-token env-var name for configuration compatibility.
- *
- * @deprecated The returned env var is intentionally ignored by registry authorization. Use a
- * user-issued access token or `handoff-app login`.
- */
-const resolveApiTokenEnv = (config) => {
-    var _a, _b, _c;
-    const configured = (_c = (_b = (_a = config === null || config === void 0 ? void 0 : config.runtime) === null || _a === void 0 ? void 0 : _a.registry) === null || _b === void 0 ? void 0 : _b.apiTokenEnv) === null || _c === void 0 ? void 0 : _c.trim();
-    return configured || exports.DEFAULT_REGISTRY_API_TOKEN_ENV;
-};
-exports.resolveApiTokenEnv = resolveApiTokenEnv;
 /** Resolve the configured registry database driver (defaults to `pg`). */
 const resolveRegistryDriver = (config) => {
     var _a, _b, _c, _d;
@@ -55,7 +43,7 @@ const resolveRegistryDatabase = (config) => {
     const connectionString = (_a = process.env[databaseUrlEnv]) === null || _a === void 0 ? void 0 : _a.trim();
     if (!connectionString) {
         throw new Error(`Registry database URL is not configured. Set the "${databaseUrlEnv}" environment variable to a ` +
-            `PostgreSQL connection string (or change "runtime.registry.databaseUrlEnv" to point at the env var you use).`);
+            `PostgreSQL connection string (or change "runtime.registry.databaseUrl" to point at the env var you use).`);
     }
     return { driver, databaseUrlEnv, connectionString };
 };

package/dist/registry/db/index.d.ts

@@ -1,5 +1,5 @@
 export { buildMetadata, componentFiles, components, docsArtifacts, patternFiles, patterns, registryAccessTokens, registryAuthActionTokens, registryAuthRateLimits, registryDeviceAuthorizations, registryInstallations, registrySchema, registryUsers, type BuildMetadataEntityKind, type DocsArtifactEntityKind, type RegistryAccessScope, type RegistryAuthActionPurpose, type RegistryDeviceAuthorizationStatus, type RegistryRateLimitBucket, type RegistryReviewMetadata, type RegistryUserRole, type RegistryUserStatus, } from './schema';
 export type { ArtifactBuildStatus as RegistryBuildStatus } from '../../artifacts/types';
-export { DEFAULT_DATABASE_URL_ENV, DEFAULT_REGISTRY_DRIVER, DEFAULT_REGISTRY_API_TOKEN_ENV, resolveApiTokenEnv, resolveDatabaseUrlEnv, resolveRegistryDriver, resolveRegistryDatabase, type RegistryDatabaseDriver, type ResolvedRegistryDatabase, } from './driver';
+export { DEFAULT_DATABASE_URL_ENV, DEFAULT_REGISTRY_DRIVER, DEFAULT_REGISTRY_API_TOKEN_ENV, resolveDatabaseUrlEnv, resolveRegistryDriver, resolveRegistryDatabase, type RegistryDatabaseDriver, type ResolvedRegistryDatabase, } from './driver';
 export { createRegistryDbConnection, type CreateRegistryDbConnectionParams, type RegistryDatabase, type RegistryDbConnection, } from './client';
 export { getMigrationsFolder, runRegistryMigrations } from './migrate';

package/dist/registry/db/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.runRegistryMigrations = exports.getMigrationsFolder = exports.createRegistryDbConnection = exports.resolveRegistryDatabase = exports.resolveRegistryDriver = exports.resolveDatabaseUrlEnv = exports.resolveApiTokenEnv = exports.DEFAULT_REGISTRY_API_TOKEN_ENV = exports.DEFAULT_REGISTRY_DRIVER = exports.DEFAULT_DATABASE_URL_ENV = exports.registryUsers = exports.registrySchema = exports.registryInstallations = exports.registryDeviceAuthorizations = exports.registryAuthRateLimits = exports.registryAuthActionTokens = exports.registryAccessTokens = exports.patterns = exports.patternFiles = exports.docsArtifacts = exports.components = exports.componentFiles = exports.buildMetadata = void 0;
+exports.runRegistryMigrations = exports.getMigrationsFolder = exports.createRegistryDbConnection = exports.resolveRegistryDatabase = exports.resolveRegistryDriver = exports.resolveDatabaseUrlEnv = exports.DEFAULT_REGISTRY_API_TOKEN_ENV = exports.DEFAULT_REGISTRY_DRIVER = exports.DEFAULT_DATABASE_URL_ENV = exports.registryUsers = exports.registrySchema = exports.registryInstallations = exports.registryDeviceAuthorizations = exports.registryAuthRateLimits = exports.registryAuthActionTokens = exports.registryAccessTokens = exports.patterns = exports.patternFiles = exports.docsArtifacts = exports.components = exports.componentFiles = exports.buildMetadata = void 0;
 var schema_1 = require("./schema");
 Object.defineProperty(exports, "buildMetadata", { enumerable: true, get: function () { return schema_1.buildMetadata; } });
 Object.defineProperty(exports, "componentFiles", { enumerable: true, get: function () { return schema_1.componentFiles; } });
@@ -19,7 +19,6 @@ var driver_1 = require("./driver");
 Object.defineProperty(exports, "DEFAULT_DATABASE_URL_ENV", { enumerable: true, get: function () { return driver_1.DEFAULT_DATABASE_URL_ENV; } });
 Object.defineProperty(exports, "DEFAULT_REGISTRY_DRIVER", { enumerable: true, get: function () { return driver_1.DEFAULT_REGISTRY_DRIVER; } });
 Object.defineProperty(exports, "DEFAULT_REGISTRY_API_TOKEN_ENV", { enumerable: true, get: function () { return driver_1.DEFAULT_REGISTRY_API_TOKEN_ENV; } });
-Object.defineProperty(exports, "resolveApiTokenEnv", { enumerable: true, get: function () { return driver_1.resolveApiTokenEnv; } });
 Object.defineProperty(exports, "resolveDatabaseUrlEnv", { enumerable: true, get: function () { return driver_1.resolveDatabaseUrlEnv; } });
 Object.defineProperty(exports, "resolveRegistryDriver", { enumerable: true, get: function () { return driver_1.resolveRegistryDriver; } });
 Object.defineProperty(exports, "resolveRegistryDatabase", { enumerable: true, get: function () { return driver_1.resolveRegistryDatabase; } });

package/dist/registry/publish/index.js

@@ -79,14 +79,14 @@ const assertUniqueCatalogIds = (handoff) => {
  */
 const resolveConnectionOrThrow = (handoff) => __awaiter(void 0, void 0, void 0, function* () {
     (0, exports.assertPublishableWorkspace)(handoff);
-    const connection = yield (0, connection_1.resolveAuthenticatedRegistryConnection)(handoff.config, handoff.workingPath);
+    const connection = yield (0, connection_1.resolveAuthenticatedRegistryConnection)(handoff.config, handoff.workingPath, handoff.getProfile());
     if (!connection.url) {
-        throw new PublishError(`No registry is configured. Run \`handoff-app login --url <registry-url>\`, set runtime.registryConnection.url, ` +
+        throw new PublishError(`No registry is configured. Run \`${(0, connection_1.loginCommandHint)(connection)}\`, set runtime.registryConnection.url, ` +
             `or set the "${connection.urlEnv}" environment variable to the base URL of the registry to publish to.`);
     }
     if (!connection.accessToken) {
-        throw new PublishError(`No registry access token is configured. Run \`handoff-app login --url ${connection.url}\`, or set the ` +
-            `"${connection.accessTokenEnv}" environment variable to a user-issued token for CI.`);
+        throw new PublishError(`No registry access token is configured. Run \`${(0, connection_1.loginCommandHint)(connection)}\`, or set the ` +
+            `"${connection.accessTokenEnv}" environment variable to a user-issued token for CI.${(0, connection_1.unusedLoginNote)(connection)}`);
     }
     return connection;
 });

package/dist/store/filesystem.d.ts

@@ -9,7 +9,7 @@
  * without changing how anything is discovered or built.
  */
 import type { ComponentListObject, PageListObject, PatternListObject } from '../transformers/preview/types';
-import type { Config, RuntimeConfig } from '../types/config';
+import type { ResolvedConfig, RuntimeConfig } from '../types/config';
 import type { ComponentStore, PageStore, PatternStore, SourceReference, TextFileResource, TokenArtifactResource, TokenSetRecord, TokenStore } from './types';
 /**
  * Minimal context needed to back the filesystem store. A `Handoff` instance satisfies this (it
@@ -18,7 +18,7 @@ import type { ComponentStore, PageStore, PatternStore, SourceReference, TextFile
  */
 export interface FilesystemStoreContext {
     runtimeConfig?: RuntimeConfig | null;
-    config?: Config | null;
+    config?: ResolvedConfig | null;
     /** Workspace root (`Handoff.workingPath`), holding `public/` and `fonts/`. */
     workingPath?: string;
     /** Absolute path to the generated `tokens.json` (`Handoff.getTokensFilePath()`). */

package/dist/types/config.d.ts

@@ -1,3 +1,4 @@
+import type { EnvValue, EnvSecret, RuntimeEnvReference } from '../config/from-env';
 import { BuildOptions } from 'esbuild';
 import type Handlebars from 'handlebars';
 import { Types as HandoffTypes } from 'handoff-core';
@@ -63,8 +64,8 @@ export type RegisterHandlebarsHelpersContext = {
 };
 export interface NextAppConfig {
     theme?: string;
-    title: string;
-    client: string;
+    title?: string;
+    client?: string;
     google_tag_manager?: string | null | undefined;
     googleTagManager?: string | null | undefined;
     type_copy?: string;
@@ -73,15 +74,17 @@ export interface NextAppConfig {
     typeSort?: string[];
     color_sort?: string[];
     colorSort?: string[];
-    breakpoints: Breakpoints;
+    /** Omit to keep the defaults; a declared block merges onto them rather than replacing them. */
+    breakpoints?: Breakpoints;
     component_sort?: string[];
     componentSort?: string[];
     base_path?: string;
     basePath?: string;
-    attribution: boolean;
+    /** @default true */
+    attribution?: boolean;
     ports?: {
-        app: number;
-        websocket: number;
+        app: EnvValue<number>;
+        websocket: EnvValue<number>;
     };
 }
 /**
@@ -139,13 +142,8 @@ export interface HandoffRuntimeConfig {
     };
     /** Registry-mode host settings. Env-var values are stored as names, never as secrets. */
     registry?: {
-        /** Name of the env var holding the database URL. @default "DATABASE_URL" */
-        databaseUrlEnv?: string;
-        /**
-         * @deprecated Fixed registry secrets are no longer authorized. This option remains parseable
-         * only so existing configuration files do not break.
-         */
-        apiTokenEnv?: string;
+        /** Environment reference to the database URL. @default fromEnv('DATABASE_URL') */
+        databaseUrl?: RuntimeEnvReference<string>;
         database?: {
             /**
              * PostgreSQL is the supported database. `driver` selects the built-in connection driver — how
@@ -168,11 +166,11 @@ export interface HandoffRuntimeConfig {
             adapter?: 'database' | 'vercel-blob' | 'custom';
             /** For `adapter: "custom"` - server-only module path default-exporting a `defineAssetStorage` adapter. */
             module?: string;
-            /** For `adapter: "vercel-blob"` - env var name holding the Blob read/write token. @default "BLOB_READ_WRITE_TOKEN" */
-            tokenEnv?: string;
+            /** For `adapter: "vercel-blob"` - environment reference to the Blob read/write token. @default fromEnv('BLOB_READ_WRITE_TOKEN') */
+            token?: RuntimeEnvReference<string>;
             /** Max bytes kept inline in the database `bytea` column (larger uploads are rejected). @default 4194304 */
             maxInlineBytes?: number;
-            /** Non-secret adapter options (bucket env-var names, region, a custom `providerId`, …). */
+            /** Non-secret options, JSON-encoded into the bundle. Environment references are rejected. Pass variable names instead. */
             options?: Record<string, unknown>;
         };
     };
@@ -181,21 +179,20 @@ export interface HandoffRuntimeConfig {
      * `mode: 'workspace'` plus this block — it is not a third runtime mode.
      */
     registryConnection?: {
-        url?: string;
-        /** @default "HANDOFF_REGISTRY_URL" */
-        urlEnv?: string;
-        /** @default "HANDOFF_REGISTRY_ACCESS_TOKEN" */
-        accessTokenEnv?: string;
+        /** @default fromEnv('HANDOFF_REGISTRY_URL', { default: '' }) */
+        url?: EnvValue<string>;
+        /** @default fromEnv('HANDOFF_REGISTRY_ACCESS_TOKEN', { default: '' }) */
+        accessToken?: EnvSecret<string>;
     };
 }
 export interface Config {
-    dev_access_token?: string | null | undefined;
-    devAccessToken?: string | null | undefined;
-    figma_project_id?: string | null | undefined;
-    figmaProjectId?: string | null | undefined;
-    exportsOutputDirectory?: string;
-    sitesOutputDirectory?: string;
-    useVariables?: boolean;
+    dev_access_token?: EnvSecret<string | null>;
+    devAccessToken?: EnvSecret<string | null>;
+    figma_project_id?: EnvValue<string | null>;
+    figmaProjectId?: EnvValue<string | null>;
+    exportsOutputDirectory?: EnvValue<string>;
+    sitesOutputDirectory?: EnvValue<string>;
+    useVariables?: EnvValue<boolean>;
     /**
      * Configuration for React component docs generation (handoff-docgen).
      */
@@ -387,7 +384,29 @@ export interface ClientRuntimeConfig {
      */
     connected: boolean;
 }
-export type ClientConfig = Pick<Config, 'app' | 'exportsOutputDirectory' | 'sitesOutputDirectory' | 'assets_zip_links' | 'useVariables'> & {
+/** Values available after config loading. Deferred references retain their names. */
+export type ResolvedConfig = Omit<Config, 'dev_access_token' | 'devAccessToken' | 'figma_project_id' | 'figmaProjectId' | 'exportsOutputDirectory' | 'sitesOutputDirectory' | 'useVariables' | 'app' | 'runtime'> & {
+    dev_access_token?: string | null;
+    devAccessToken?: string | null;
+    figma_project_id?: string | null;
+    figmaProjectId?: string | null;
+    exportsOutputDirectory?: string;
+    sitesOutputDirectory?: string;
+    useVariables?: boolean;
+    app?: Omit<NextAppConfig, 'ports'> & {
+        ports?: {
+            app: number;
+            websocket: number;
+        };
+    };
+    runtime?: Omit<HandoffRuntimeConfig, 'registryConnection'> & {
+        registryConnection?: {
+            url?: string;
+            accessToken?: string;
+        };
+    };
+};
+export type ClientConfig = Pick<ResolvedConfig, 'app' | 'exportsOutputDirectory' | 'sitesOutputDirectory' | 'assets_zip_links' | 'useVariables'> & {
     runtime: ClientRuntimeConfig;
 };
 export interface RuntimeConfigComponentOptions {

package/docs/api.md

@@ -29,6 +29,37 @@ handoff.fetch();
 3. Build your typescript `tsc`
 4. Run your project `node handoff.js`
 
+## Configuration profiles
+
+A profile is a sidecar config file, `handoff.config.<profile>.*`, that merges
+onto the base config. The CLI selects one with `--profile`, and the class takes
+it as a constructor option. Handoff reads `HANDOFF_PROFILE` when neither is
+given.
+
+```js
+const handoff = new Handoff({ profile: 'registry' });
+```
+
+A profile also names the saved registry login that `publish` and `checkout`
+use, so one workspace can address several registries. `profileWithoutConfig`
+decides what a profile may resolve to when it has no config file:
+`'saved-login'` accepts a name a saved login uses, and `'any'` accepts any
+valid name, which is how `login` creates a new one.
+
+```js
+const handoff = new Handoff({ profile: 'staging', profileWithoutConfig: 'saved-login' });
+```
+
+`defineConfig` types a profile as well as a base config.
+
+```ts
+import { defineConfig } from 'handoff-app';
+
+export default defineConfig({
+  runtime: { registry: { database: { driver: 'neon' } } },
+});
+```
+
 ## Methods
 
 Methods of the handoff class can be called to run actions in the

package/docs/cli.md

@@ -58,9 +58,9 @@ Commands:
 
   db:migrate [opts] - Runs registry database migrations (Drizzle / PostgreSQL). Reads the project config and database env vars, applies the package-owned migration set, and runs independently of `build`.
 
-  login --url <registry-url> - Authorizes this workspace in the browser and stores a revocable token in `.handoff/cli-auth.json`.
+  login [--profile <name>] --url <registry-url> - Authorizes this workspace in the browser and stores a revocable token in `.handoff/cli-auth.json`, under the selected profile.
 
-  logout [--url <registry-url>] - Revokes the saved token when possible, then removes the local credential.
+  logout [--profile <name>] [--url <registry-url>] [--all] - Revokes the saved token when possible, then removes the local credential of the selected profile, or of every profile with `--all`.
 
   make
     make:component <name> [opts] - Creates a new catalog item with a declaration

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "handoff-app",
-  "version": "2.0.0-7",
+  "version": "2.0.0-8",
   "description": "Automated documentation toolchain for building client side documentation from figma",
   "author ": {
     "name": "Convertiv",