handoff-app 2.0.0-7 → 2.0.0-8

package/src/index.ts

@@ -1,17 +1,25 @@
-import 'dotenv/config';
+import './config/env';
 import fs from 'fs-extra';
 import { Types as CoreTypes, Handoff as HandoffRunner, Providers } from 'handoff-core';
 import path from 'path';
 import buildApp, { devApp, watchApp, type BuildPackage, type BuildTarget } from './app-builder';
 import { ejectConfig, ejectPages, ejectTheme } from './cli/eject';
 import { makeComponent, makePage } from './cli/make';
-import { initConfigWithMetadata, initRuntimeConfig, validateConfig } from './config';
+import { loginProfileNames } from './cli/auth/store';
+import {
+  type ConfigLoadContext,
+  initConfigWithMetadata,
+  initRuntimeConfig,
+  loadProfileEnv,
+  resolveProfileSelection,
+  validateConfig,
+} from './config';
 import pipeline, { buildComponents, buildPatterns } from './pipeline';
 import { ALL_KIND_ORDER, ENTITY_WIRE_KIND, isRegistryEntityKind, REGISTRY_ENTITY_KINDS, type RegistryEntityKind } from './registry/content-kinds';
 import type { TransferEntityKind } from './registry/transfer';
 import { createFilesystemStore, type HandoffStore } from './store';
 import processComponents, { ComponentSegment } from './transformers/preview/component/builder';
-import { Config, ConfigFileEntry, RuntimeConfig } from './types/config';
+import { Config, ResolvedConfig, ConfigFileEntry, RuntimeConfig } from './types/config';
 import { Logger } from './utils/logger';
 import { normalizePathForCompare, resolveWorkingPath } from './utils/path';
 import { generateFilesystemSafeId } from './utils/path';
@@ -32,6 +40,19 @@ export interface HandoffOptions {
   config?: Partial<Config>;
   /** Explicit config file (the CLI's `-c, --config`), resolved from the working path. */
   configPath?: string;
+  /**
+   * Config profile to merge onto the base config (the CLI's `--profile`). It overrides
+   * `HANDOFF_PROFILE`, and a selected profile has to resolve to a `handoff.config.<profile>.*` file
+   * unless {@link profileWithoutConfig} widens that.
+   */
+  profile?: string;
+  /**
+   * What a selected profile may resolve to when it has no config file. `'saved-login'` accepts a name
+   * a saved registry login uses, so publish and checkout can address a registry that no config file
+   * describes. `'any'` accepts any valid name, for the `login` command that creates the login. Unset,
+   * a profile must name a config file, so a typo cannot silently run with the base config.
+   */
+  profileWithoutConfig?: 'saved-login' | 'any';
 }
 
 /**
@@ -109,7 +130,7 @@ const runKinds = async (
 };
 
 class Handoff {
-  config: Config | null;
+  config: ResolvedConfig | null;
   debug: boolean = false;
   force: boolean = false;
   dryRun: boolean = false;
@@ -142,6 +163,8 @@ class Handoff {
   private _configFilePaths: string[] = [];
   private _configFileIndex: Map<string, ConfigFileEntry> = new Map();
   private _mainConfigFilePath?: string;
+  private _profileConfigFilePath?: string;
+  private _profile?: string;
   private _documentationObjectCache?: CoreTypes.IDocumentationObject;
   private _handoffRunner?: ReturnType<typeof HandoffRunner> | null;
 
@@ -151,7 +174,8 @@ class Handoff {
   }
 
   private construct(options: HandoffOptions) {
-    this.config = null;
+    // Ahead of `Logger.init` so a profile env file can set `HANDOFF_LOG_LEVEL` and `HANDOFF_LOG_SCOPES`.
+    loadProfileEnv(resolveProfileSelection(options.profile)?.name);
     this.debug = options.debug ?? false;
     this.force = options.force ?? false;
     this.dryRun = options.dryRun ?? false;
@@ -160,14 +184,50 @@ class Handoff {
     this.init(options.config);
   }
 
+  /**
+   * What a selected profile may resolve to besides a config file, and how to explain a name that
+   * resolves to nothing. A command that does not accept a login still names one it found, so the
+   * difference between the two kinds of profile is visible rather than puzzling.
+   */
+  private profilesWithoutConfig(): Pick<ConfigLoadContext, 'knownProfiles' | 'profileNotFoundHint'> {
+    const selected = resolveProfileSelection(this._options.profile)?.name;
+    if (!selected) {
+      return {};
+    }
+
+    const accepts = this._options.profileWithoutConfig;
+    const names = loginProfileNames(this.workingPath);
+    if (!accepts) {
+      return names.includes(selected)
+        ? {
+            profileNotFoundHint:
+              'A saved registry login uses that name, but only login, logout, publish, and checkout accept a profile without a config file.',
+          }
+        : {};
+    }
+
+    return {
+      knownProfiles: accepts === 'any' ? [...names, selected] : names,
+      profileNotFoundHint:
+        'No saved registry login uses that name either. Run `handoff-app login --profile <name> --url <registry-url>` to create one.',
+    };
+  }
+
   init(configOverride?: Partial<Config>): Handoff {
+    // Resolved before anything is assigned: a reload that throws - a deleted profile file, a
+    // broken config - then leaves the last good state in place for the watchers holding this
+    // instance.
     const configResult = initConfigWithMetadata(configOverride ?? {}, {
       workingPath: this.workingPath,
       configPath: this._options.configPath,
+      profile: this._options.profile,
+      ...this.profilesWithoutConfig(),
     });
     const config = configResult.config;
     this.config = config;
     this._mainConfigFilePath = configResult.configPath;
+    this._profileConfigFilePath = configResult.profileConfigPath;
+    this._profile = configResult.profile;
     this.exportsDirectory = config.exportsOutputDirectory ?? this.exportsDirectory;
     this.sitesDirectory = config.sitesOutputDirectory ?? this.exportsDirectory;
     [this.runtimeConfig, this._configFilePaths, this._configFileIndex] = initRuntimeConfig(this);
@@ -571,8 +631,8 @@ class Handoff {
    * @returns {string[]} Array of absolute paths to config files
    */
   getConfigFilePaths(): string[] {
-    const combined = this._mainConfigFilePath ? [this._mainConfigFilePath, ...this._configFilePaths] : this._configFilePaths;
-    return Array.from(new Set(combined));
+    const mainPaths = [this._mainConfigFilePath, this._profileConfigFilePath].filter(Boolean) as string[];
+    return Array.from(new Set([...mainPaths, ...this._configFilePaths]));
   }
 
   /**
@@ -582,6 +642,21 @@ class Handoff {
     return this._mainConfigFilePath;
   }
 
+  getProfile(): string | undefined {
+    return this._profile;
+  }
+
+  /**
+   * True for the base config file and for the profile file merged onto it. Both carry project-wide
+   * settings, so a change to either one invalidates every entity rather than a single declaration.
+   */
+  isMainConfigFile(filePath: string): boolean {
+    const normalized = normalizePathForCompare(filePath);
+    return [this._mainConfigFilePath, this._profileConfigFilePath]
+      .filter(Boolean)
+      .some((mainPath) => normalizePathForCompare(mainPath as string) === normalized);
+  }
+
   getConfigFileEntry(configPath: string): ConfigFileEntry | undefined {
     return this._configFileIndex.get(normalizePathForCompare(configPath));
   }
@@ -608,8 +683,10 @@ class Handoff {
   }
 }
 
-export type { Config, RegisterHandlebarsHelpersContext } from './types/config';
+export type { Config, ResolvedConfig, RegisterHandlebarsHelpersContext } from './types/config';
 export { defineConfig } from './config';
+export { fromEnv } from './config/from-env';
+export type { EnvValue, EnvSecret, RuntimeEnvReference } from './config/from-env';
 export type {
   CatalogItem,
   CatalogItemEntries,

package/src/pipeline/index.ts

@@ -1,4 +1,4 @@
-import 'dotenv/config';
+import '../config/env';
 import Handoff from '..';
 import buildApp from '../app-builder';
 import { Logger } from '../utils/logger';

package/src/registry/asset-storage/adapters/vercel-blob.ts

@@ -21,7 +21,7 @@ export const createVercelBlobStorage = (params: { tokenEnv: string; options: Rec
     if (!token) {
       throw new Error(
         `Vercel Blob storage is configured but the token env var "${params.tokenEnv}" is not set. ` +
-          'Set it to a Blob read/write token, or change runtime.registry.assetStorage.tokenEnv.'
+          'Set it to a Blob read/write token, or change runtime.registry.assetStorage.token.'
       );
     }
     return token;

package/src/registry/asset-storage/resolve.ts

@@ -7,7 +7,7 @@
  * env-var *names* are ever persisted; secret *values* are read from `process.env` at request time.
  */
 
-import type { Config } from '../../types/config';
+import type { ResolvedConfig } from '../../types/config';
 import type { AssetStorageProvider } from '../db/schema';
 
 /** Which adapter implementation is active. */
@@ -68,5 +68,8 @@ export const resolveAssetStorageSettings = (settings: AssetStorageSettings | nul
 };
 
 /** Resolve the active asset storage settings from a loaded config (CLI/build side). */
-export const resolveAssetStorageFromConfig = (config: Config | null | undefined): ResolvedAssetStorage =>
-  resolveAssetStorageSettings(config?.runtime?.registry?.assetStorage);
+export const resolveAssetStorageFromConfig = (config: ResolvedConfig | null | undefined): ResolvedAssetStorage =>
+  resolveAssetStorageSettings({
+    ...config?.runtime?.registry?.assetStorage,
+    tokenEnv: config?.runtime?.registry?.assetStorage?.token?.$env,
+  });

package/src/registry/checkout/index.ts

@@ -36,7 +36,7 @@ import Handoff from '../../index';
 import type { DeclarationFormat } from '../../types/config';
 import { Logger } from '../../utils/logger';
 import { createRegistryClient, type RegistryClient, RegistryClientError } from '../client';
-import { resolveAuthenticatedRegistryConnection } from '../connection';
+import { loginCommandHint, resolveAuthenticatedRegistryConnection, unusedLoginNote } from '../connection';
 import { isSafePathSegment, isSafeRelativePath, resolvePathWithin } from '../path';
 import { quoteIds, selectIds, splitCatalogIds } from '../selection';
 import type { CheckoutPayload, TransferEntityKind, TransferFile } from '../transfer';
@@ -76,17 +76,17 @@ export const resolveConnectionOrThrow = async (handoff: Handoff) => {
     );
   }
 
-  const connection = await resolveAuthenticatedRegistryConnection(handoff.config, handoff.workingPath);
+  const connection = await resolveAuthenticatedRegistryConnection(handoff.config, handoff.workingPath, handoff.getProfile());
   if (!connection.url) {
     throw new CheckoutError(
-      `No registry is configured. Run \`handoff-app login --url <registry-url>\`, set runtime.registryConnection.url, ` +
+      `No registry is configured. Run \`${loginCommandHint(connection)}\`, set runtime.registryConnection.url, ` +
         `or set the "${connection.urlEnv}" environment variable to the base URL of the registry to checkout from.`
     );
   }
   if (!connection.accessToken) {
     throw new CheckoutError(
-      `No registry access token is configured. Run \`handoff-app login --url ${connection.url}\`, or set the ` +
-        `"${connection.accessTokenEnv}" environment variable to a user-issued token for CI.`
+      `No registry access token is configured. Run \`${loginCommandHint(connection)}\`, or set the ` +
+        `"${connection.accessTokenEnv}" environment variable to a user-issued token for CI.${unusedLoginNote(connection)}`
     );
   }
   return connection;

package/src/registry/connection.ts

@@ -1,22 +1,14 @@
 /**
- * Connected-workspace registry connection resolution.
- *
- * A connected workspace is `runtime.mode: 'workspace'` plus a `runtime.registryConnection` block
- * pointing at a remote registry — it is not a third runtime mode. The connection is resolved from
- * config + environment: the registry URL may be given inline or via an env-var *name*, and the
- * access token is always read from an env-var name (never persisted as a value). This is the single
- * source the publish (and later checkout) client reads its target + credentials from.
- *
- * The older `HANDOFF_CLOUD_*` names still work as deprecated fallbacks; see
- * {@link DEPRECATED_ENV_ALIASES}.
+ * Registry connection values resolve at config load. Saved device login credentials can fill
+ * missing values for CLI operations; neither source is persisted in the app's client config.
  */
 
-import type { Config } from '../types/config';
-import { cliAuthMatchesRegistry, cliAuthTokenIsValid, readCliAuth } from '../cli/auth/store';
+import { configEnvName } from '../config/resolve-env';
+import type { ResolvedConfig } from '../types/config';
+import { type CliAuth, cliAuthMatchesRegistry, cliAuthTokenIsValid, DEFAULT_LOGIN_PROFILE, readCliAuth } from '../cli/auth/store';
 // Imported straight from the module, not the `auth` barrel, to keep the database schema off the CLI
 // startup path; this file is resolved for every command.
 import { resolveRegistrySyncSecret } from './auth/sync-secret';
-import { Logger } from '../utils/logger';
 
 /** Default env-var name holding the remote registry base URL. */
 export const DEFAULT_REGISTRY_URL_ENV = 'HANDOFF_REGISTRY_URL';
@@ -24,38 +16,11 @@ export const DEFAULT_REGISTRY_URL_ENV = 'HANDOFF_REGISTRY_URL';
 /** Default env-var name holding the connected-workspace access token. */
 export const DEFAULT_REGISTRY_ACCESS_TOKEN_ENV = 'HANDOFF_REGISTRY_ACCESS_TOKEN';
 
-/**
- * Old env-var names we still read, keyed by the name that replaced them. Keeps workspaces set up
- * from the older docs working instead of silently reporting no registry.
- */
-const DEPRECATED_ENV_ALIASES: Readonly<Record<string, string>> = {
-  [DEFAULT_REGISTRY_URL_ENV]: 'HANDOFF_CLOUD_URL',
-  [DEFAULT_REGISTRY_ACCESS_TOKEN_ENV]: 'HANDOFF_CLOUD_TOKEN',
-};
-
-/** Aliases we've already warned about, so each one warns once per run and not once per lookup. */
-const warnedAliases = new Set<string>();
-
-/**
- * Value of the named env var, falling back to its deprecated alias. Only the default names have
- * aliases: a custom `urlEnv`/`accessTokenEnv` is a deliberate choice, so a stray `HANDOFF_CLOUD_*`
- * must not stand in for it. The warning goes through {@link Logger.warn}, so
- * `HANDOFF_LOG_LEVEL=error` silences it in CI.
- */
-const readConnectionEnv = (name: string): string => {
-  const configured = process.env[name]?.trim();
-  if (configured) return configured;
-
-  const alias = DEPRECATED_ENV_ALIASES[name];
-  const inherited = alias ? process.env[alias]?.trim() : '';
-  if (!inherited) return '';
-
-  if (!warnedAliases.has(alias)) {
-    warnedAliases.add(alias);
-    Logger.warn(`${alias} is deprecated and will be removed in a future release; set ${name} instead.`);
-  }
-  return inherited;
-};
+/** A saved login and the profile it is stored under, which is not always the selected profile. */
+interface SavedLogin {
+  profile: string;
+  url: string;
+}
 
 /** Fully resolved connected-workspace registry connection. */
 export interface ResolvedRegistryConnection {
@@ -67,55 +32,91 @@ export interface ResolvedRegistryConnection {
   urlEnv: string;
   /** Name of the env var the access token is read from. */
   accessTokenEnv: string;
+  /** Profile the saved login was looked up under. */
+  loginProfile: string;
+  /** Set when a saved login was skipped because it was issued for another registry. */
+  unmatchedLogin?: SavedLogin;
 }
 
-/**
- * Resolve the connected-workspace registry connection from config + environment. Never throws —
- * Callers inspect the resolved URL and access token to surface specific configuration errors.
- *
- * `urlEnv` and `accessTokenEnv` always report the canonical name, even when an alias supplied the
- * value, so errors built from them point at the variable to adopt.
- */
-export const resolveRegistryConnection = (config: Config | null | undefined): ResolvedRegistryConnection => {
+/** Read values resolved at config load, retaining variable names for CLI diagnostics. */
+export const resolveRegistryConnection = (config: ResolvedConfig | null | undefined): ResolvedRegistryConnection => {
   const connection = config?.runtime?.registryConnection;
-  const urlEnv = connection?.urlEnv?.trim() || DEFAULT_REGISTRY_URL_ENV;
-  const accessTokenEnv = connection?.accessTokenEnv?.trim() || DEFAULT_REGISTRY_ACCESS_TOKEN_ENV;
-
-  const inlineUrl = connection?.url?.trim();
-  const url = inlineUrl || readConnectionEnv(urlEnv);
-  const accessToken = readConnectionEnv(accessTokenEnv);
+  const urlEnv = configEnvName(config, 'runtime.registryConnection.url') || DEFAULT_REGISTRY_URL_ENV;
+  const accessTokenEnv = configEnvName(config, 'runtime.registryConnection.accessToken') || DEFAULT_REGISTRY_ACCESS_TOKEN_ENV;
+  const url = connection?.url?.trim() || '';
+  const accessToken = connection?.accessToken?.trim() || '';
 
   return {
     url,
     accessToken,
     urlEnv,
     accessTokenEnv,
+    loginProfile: DEFAULT_LOGIN_PROFILE,
   };
 };
 
+/**
+ * The valid login to use for a profile. A profile without its own login falls back to the default
+ * login, so a workspace that names profiles for other reasons keeps working after one plain
+ * `handoff-app login`. The fallback is safe because a token is only ever used for the registry URL
+ * it was issued for.
+ */
+const readProfileLogin = async (workingPath: string, profile: string): Promise<{ auth: CliAuth; profile: string } | null> => {
+  const own = await readCliAuth(workingPath, profile);
+  if (cliAuthTokenIsValid(own)) return { auth: own!, profile };
+
+  const fallback = profile === DEFAULT_LOGIN_PROFILE ? null : await readCliAuth(workingPath);
+  return cliAuthTokenIsValid(fallback) ? { auth: fallback!, profile: DEFAULT_LOGIN_PROFILE } : null;
+};
+
 /**
  * Resolve the same connection for an authenticated CLI operation, letting a saved device login fill
  * in what the environment does not provide. A valid login supplies both the registry URL and the
- * access token, so `handoff-app login` alone is enough to publish and checkout. Environment values
- * keep precedence for deterministic CI: `HANDOFF_REGISTRY_URL` (or inline config) wins over the
- * saved URL, and `HANDOFF_REGISTRY_ACCESS_TOKEN` wins over the saved token. The saved token only
- * applies to the URL it was issued for.
+ * access token, so `handoff-app login` alone is enough to publish and checkout. The login is the one
+ * saved under the selected profile, which is how one workspace addresses several registries.
+ * Environment values keep precedence for deterministic CI: `HANDOFF_REGISTRY_URL` (or inline config)
+ * wins over the saved URL, and `HANDOFF_REGISTRY_ACCESS_TOKEN` wins over the saved token. The saved
+ * token only applies to the URL it was issued for.
  *
  * A configured `HANDOFF_SYNC_SECRET` is the last resort. Being deployment-wide rather than personal,
  * it fills in only where there is no explicit token and no login (CI, in practice), instead of quietly
  * speaking for a developer who is signed in.
  */
 export const resolveAuthenticatedRegistryConnection = async (
-  config: Config | null | undefined,
-  workingPath = process.cwd()
+  config: ResolvedConfig | null | undefined,
+  workingPath = process.cwd(),
+  profile?: string
 ): Promise<ResolvedRegistryConnection> => {
   const connection = resolveRegistryConnection(config);
+  const loginProfile = profile?.trim() || DEFAULT_LOGIN_PROFILE;
 
-  const auth = await readCliAuth(workingPath);
-  const login = cliAuthTokenIsValid(auth) ? auth! : null;
+  const login = await readProfileLogin(workingPath, loginProfile);
+  const url = connection.url || login?.auth.remoteUrl || '';
+  const matches = Boolean(login) && cliAuthMatchesRegistry(login!.auth, url);
+  const accessToken = connection.accessToken || (matches ? login!.auth.accessToken : '') || resolveRegistrySyncSecret();
 
-  const url = connection.url || login?.remoteUrl || '';
-  const savedToken = login && cliAuthMatchesRegistry(login, url) ? login.accessToken : '';
-  const accessToken = connection.accessToken || savedToken || resolveRegistrySyncSecret();
-  return { ...connection, url, accessToken };
+  return {
+    ...connection,
+    url,
+    accessToken,
+    loginProfile,
+    unmatchedLogin: login && !matches ? { profile: login.profile, url: login.auth.remoteUrl } : undefined,
+  };
 };
+
+/** The `handoff-app login` call that would authorize this connection, naming the selected profile. */
+export const loginCommandHint = (connection: ResolvedRegistryConnection): string =>
+  [
+    'handoff-app login',
+    connection.loginProfile === DEFAULT_LOGIN_PROFILE ? '' : ` --profile ${connection.loginProfile}`,
+    ` --url ${connection.url || '<registry-url>'}`,
+  ].join('');
+
+/**
+ * Names a saved login that was skipped because it belongs to another registry. Without it, a run
+ * that resolves its URL from the environment reports a missing token while a login is in place.
+ */
+export const unusedLoginNote = (connection: ResolvedRegistryConnection): string =>
+  connection.unmatchedLogin
+    ? ` The login saved for profile "${connection.unmatchedLogin.profile}" is for ${connection.unmatchedLogin.url}, not ${connection.url}.`
+    : '';

package/src/registry/db/driver.ts

@@ -10,7 +10,7 @@
  * the value is never stored in config.
  */
 
-import type { Config } from '../../types/config';
+import type { ResolvedConfig } from '../../types/config';
 
 /** Built-in registry database connection driver. Both ship with the package and target Postgres. */
 export type RegistryDatabaseDriver = 'pg' | 'neon';
@@ -35,24 +35,13 @@ export interface ResolvedRegistryDatabase {
 }
 
 /** Resolve the env-var name holding the database URL (defaults to `DATABASE_URL`). */
-export const resolveDatabaseUrlEnv = (config: Config | null | undefined): string => {
-  const configured = config?.runtime?.registry?.databaseUrlEnv?.trim();
+export const resolveDatabaseUrlEnv = (config: ResolvedConfig | null | undefined): string => {
+  const configured = config?.runtime?.registry?.databaseUrl?.$env?.trim();
   return configured || DEFAULT_DATABASE_URL_ENV;
 };
 
-/**
- * Resolve the legacy fixed-token env-var name for configuration compatibility.
- *
- * @deprecated The returned env var is intentionally ignored by registry authorization. Use a
- * user-issued access token or `handoff-app login`.
- */
-export const resolveApiTokenEnv = (config: Config | null | undefined): string => {
-  const configured = config?.runtime?.registry?.apiTokenEnv?.trim();
-  return configured || DEFAULT_REGISTRY_API_TOKEN_ENV;
-};
-
 /** Resolve the configured registry database driver (defaults to `pg`). */
-export const resolveRegistryDriver = (config: Config | null | undefined): RegistryDatabaseDriver => {
+export const resolveRegistryDriver = (config: ResolvedConfig | null | undefined): RegistryDatabaseDriver => {
   return config?.runtime?.registry?.database?.driver ?? DEFAULT_REGISTRY_DRIVER;
 };
 
@@ -61,7 +50,7 @@ export const resolveRegistryDriver = (config: Config | null | undefined): Regist
  * when the configured env var is unset so the CLI can surface a clear "missing database URL"
  * message instead of failing deep inside the driver.
  */
-export const resolveRegistryDatabase = (config: Config | null | undefined): ResolvedRegistryDatabase => {
+export const resolveRegistryDatabase = (config: ResolvedConfig | null | undefined): ResolvedRegistryDatabase => {
   const driver = resolveRegistryDriver(config);
   const databaseUrlEnv = resolveDatabaseUrlEnv(config);
   const connectionString = process.env[databaseUrlEnv]?.trim();
@@ -69,7 +58,7 @@ export const resolveRegistryDatabase = (config: Config | null | undefined): Reso
   if (!connectionString) {
     throw new Error(
       `Registry database URL is not configured. Set the "${databaseUrlEnv}" environment variable to a ` +
-        `PostgreSQL connection string (or change "runtime.registry.databaseUrlEnv" to point at the env var you use).`
+        `PostgreSQL connection string (or change "runtime.registry.databaseUrl" to point at the env var you use).`
     );
   }
 

package/src/registry/db/index.ts

@@ -29,7 +29,6 @@ export {
   DEFAULT_DATABASE_URL_ENV,
   DEFAULT_REGISTRY_DRIVER,
   DEFAULT_REGISTRY_API_TOKEN_ENV,
-  resolveApiTokenEnv,
   resolveDatabaseUrlEnv,
   resolveRegistryDriver,
   resolveRegistryDatabase,

package/src/registry/publish/index.ts

@@ -17,7 +17,7 @@ import processComponents from '../../transformers/preview/component/builder';
 import { processPatterns } from '../../transformers/preview/pattern/builder';
 import { Logger } from '../../utils/logger';
 import { createRegistryClient, RegistryClientError, type RegistryClient } from '../client';
-import { resolveAuthenticatedRegistryConnection } from '../connection';
+import { loginCommandHint, resolveAuthenticatedRegistryConnection, unusedLoginNote } from '../connection';
 import type { EntitySummary, TransferEntityKind } from '../transfer';
 import { quoteIds, selectIds, splitCatalogIds } from '../selection';
 import { describePublishError, describeUploadFailure } from './errors';
@@ -74,17 +74,17 @@ const assertUniqueCatalogIds = (handoff: Handoff): void => {
 export const resolveConnectionOrThrow = async (handoff: Handoff) => {
   assertPublishableWorkspace(handoff);
 
-  const connection = await resolveAuthenticatedRegistryConnection(handoff.config, handoff.workingPath);
+  const connection = await resolveAuthenticatedRegistryConnection(handoff.config, handoff.workingPath, handoff.getProfile());
   if (!connection.url) {
     throw new PublishError(
-      `No registry is configured. Run \`handoff-app login --url <registry-url>\`, set runtime.registryConnection.url, ` +
+      `No registry is configured. Run \`${loginCommandHint(connection)}\`, set runtime.registryConnection.url, ` +
         `or set the "${connection.urlEnv}" environment variable to the base URL of the registry to publish to.`
     );
   }
   if (!connection.accessToken) {
     throw new PublishError(
-      `No registry access token is configured. Run \`handoff-app login --url ${connection.url}\`, or set the ` +
-        `"${connection.accessTokenEnv}" environment variable to a user-issued token for CI.`
+      `No registry access token is configured. Run \`${loginCommandHint(connection)}\`, or set the ` +
+        `"${connection.accessTokenEnv}" environment variable to a user-issued token for CI.${unusedLoginNote(connection)}`
     );
   }
   return connection;

package/src/store/filesystem.ts

@@ -14,7 +14,7 @@ import path from 'path';
 import { resolveTokenTransformers, tokenArtifactPathsForSet } from '../pipeline/token-transformers';
 import { deriveTokenSets, isComponentSet, setNameForId } from '../registry/tokens/sets';
 import type { ComponentListObject, PageListObject, PatternListObject } from '../transformers/preview/types';
-import type { Config, RuntimeConfig } from '../types/config';
+import type { ResolvedConfig, RuntimeConfig } from '../types/config';
 import { getRelatedSourceFilesForRecord, sourceContentTypeForPath } from './source-files';
 import type {
   ComponentStore,
@@ -34,7 +34,7 @@ import type {
  */
 export interface FilesystemStoreContext {
   runtimeConfig?: RuntimeConfig | null;
-  config?: Config | null;
+  config?: ResolvedConfig | null;
   /** Workspace root (`Handoff.workingPath`), holding `public/` and `fonts/`. */
   workingPath?: string;
   /** Absolute path to the generated `tokens.json` (`Handoff.getTokensFilePath()`). */