handoff-app 2.0.0-7 → 2.0.0-9

package/dist/index.js

@@ -35,18 +35,19 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CoreTypes = exports.CoreTransformerUtils = exports.CoreTransformers = exports.defineAssetStorage = exports.defineConfig = void 0;
-require("dotenv/config");
+exports.CoreTypes = exports.CoreTransformerUtils = exports.CoreTransformers = exports.defineAssetStorage = exports.fromEnv = exports.defineConfig = void 0;
+require("./config/env");
 const fs_extra_1 = __importDefault(require("fs-extra"));
 const handoff_core_1 = require("handoff-core");
 const path_1 = __importDefault(require("path"));
 const app_builder_1 = __importStar(require("./app-builder"));
 const eject_1 = require("./cli/eject");
 const make_1 = require("./cli/make");
+const store_1 = require("./cli/auth/store");
 const config_1 = require("./config");
 const pipeline_1 = __importStar(require("./pipeline"));
 const content_kinds_1 = require("./registry/content-kinds");
-const store_1 = require("./store");
+const store_2 = require("./store");
 const builder_1 = __importStar(require("./transformers/preview/component/builder"));
 const logger_1 = require("./utils/logger");
 const path_2 = require("./utils/path");
@@ -114,7 +115,7 @@ class Handoff {
      */
     get store() {
         if (!this._store) {
-            this._store = (0, store_1.createFilesystemStore)(this);
+            this._store = (0, store_2.createFilesystemStore)(this);
         }
         return this._store;
     }
@@ -134,24 +135,52 @@ class Handoff {
         this.construct(options);
     }
     construct(options) {
-        var _a, _b, _c, _d;
-        this.config = null;
-        this.debug = (_a = options.debug) !== null && _a !== void 0 ? _a : false;
-        this.force = (_b = options.force) !== null && _b !== void 0 ? _b : false;
-        this.dryRun = (_c = options.dryRun) !== null && _c !== void 0 ? _c : false;
-        this.skipBuild = (_d = options.skipBuild) !== null && _d !== void 0 ? _d : false;
+        var _a, _b, _c, _d, _e;
+        // Ahead of `Logger.init` so a profile env file can set `HANDOFF_LOG_LEVEL` and `HANDOFF_LOG_SCOPES`.
+        (0, config_1.loadProfileEnv)((_a = (0, config_1.resolveProfileSelection)(options.profile)) === null || _a === void 0 ? void 0 : _a.name);
+        this.debug = (_b = options.debug) !== null && _b !== void 0 ? _b : false;
+        this.force = (_c = options.force) !== null && _c !== void 0 ? _c : false;
+        this.dryRun = (_d = options.dryRun) !== null && _d !== void 0 ? _d : false;
+        this.skipBuild = (_e = options.skipBuild) !== null && _e !== void 0 ? _e : false;
         logger_1.Logger.init({ debug: this.debug });
         this.init(options.config);
     }
+    /**
+     * What a selected profile may resolve to besides a config file, and how to explain a name that
+     * resolves to nothing. A command that does not accept a login still names one it found, so the
+     * difference between the two kinds of profile is visible rather than puzzling.
+     */
+    profilesWithoutConfig() {
+        var _a;
+        const selected = (_a = (0, config_1.resolveProfileSelection)(this._options.profile)) === null || _a === void 0 ? void 0 : _a.name;
+        if (!selected) {
+            return {};
+        }
+        const accepts = this._options.profileWithoutConfig;
+        const names = (0, store_1.loginProfileNames)(this.workingPath);
+        if (!accepts) {
+            return names.includes(selected)
+                ? {
+                    profileNotFoundHint: 'A saved registry login uses that name, but only login, logout, publish, and checkout accept a profile without a config file.',
+                }
+                : {};
+        }
+        return {
+            knownProfiles: accepts === 'any' ? [...names, selected] : names,
+            profileNotFoundHint: 'No saved registry login uses that name either. Run `handoff-app login --profile <name> --url <registry-url>` to create one.',
+        };
+    }
     init(configOverride) {
         var _a, _b, _c;
-        const configResult = (0, config_1.initConfigWithMetadata)(configOverride !== null && configOverride !== void 0 ? configOverride : {}, {
-            workingPath: this.workingPath,
-            configPath: this._options.configPath,
-        });
+        // Resolved before anything is assigned: a reload that throws - a deleted profile file, a
+        // broken config - then leaves the last good state in place for the watchers holding this
+        // instance.
+        const configResult = (0, config_1.initConfigWithMetadata)(configOverride !== null && configOverride !== void 0 ? configOverride : {}, Object.assign({ workingPath: this.workingPath, configPath: this._options.configPath, profile: this._options.profile }, this.profilesWithoutConfig()));
         const config = configResult.config;
         this.config = config;
         this._mainConfigFilePath = configResult.configPath;
+        this._profileConfigFilePath = configResult.profileConfigPath;
+        this._profile = configResult.profile;
         this.exportsDirectory = (_a = config.exportsOutputDirectory) !== null && _a !== void 0 ? _a : this.exportsDirectory;
         this.sitesDirectory = (_b = config.sitesOutputDirectory) !== null && _b !== void 0 ? _b : this.exportsDirectory;
         [this.runtimeConfig, this._configFilePaths, this._configFileIndex] = (0, config_1.initRuntimeConfig)(this);
@@ -569,8 +598,8 @@ class Handoff {
      * @returns {string[]} Array of absolute paths to config files
      */
     getConfigFilePaths() {
-        const combined = this._mainConfigFilePath ? [this._mainConfigFilePath, ...this._configFilePaths] : this._configFilePaths;
-        return Array.from(new Set(combined));
+        const mainPaths = [this._mainConfigFilePath, this._profileConfigFilePath].filter(Boolean);
+        return Array.from(new Set([...mainPaths, ...this._configFilePaths]));
     }
     /**
      * Gets the selected main config file path if one exists.
@@ -578,6 +607,19 @@ class Handoff {
     getMainConfigFilePath() {
         return this._mainConfigFilePath;
     }
+    getProfile() {
+        return this._profile;
+    }
+    /**
+     * True for the base config file and for the profile file merged onto it. Both carry project-wide
+     * settings, so a change to either one invalidates every entity rather than a single declaration.
+     */
+    isMainConfigFile(filePath) {
+        const normalized = (0, path_2.normalizePathForCompare)(filePath);
+        return [this._mainConfigFilePath, this._profileConfigFilePath]
+            .filter(Boolean)
+            .some((mainPath) => (0, path_2.normalizePathForCompare)(mainPath) === normalized);
+    }
     getConfigFileEntry(configPath) {
         return this._configFileIndex.get((0, path_2.normalizePathForCompare)(configPath));
     }
@@ -606,6 +648,8 @@ class Handoff {
 }
 var config_2 = require("./config");
 Object.defineProperty(exports, "defineConfig", { enumerable: true, get: function () { return config_2.defineConfig; } });
+var from_env_1 = require("./config/from-env");
+Object.defineProperty(exports, "fromEnv", { enumerable: true, get: function () { return from_env_1.fromEnv; } });
 var define_1 = require("./registry/asset-storage/define");
 Object.defineProperty(exports, "defineAssetStorage", { enumerable: true, get: function () { return define_1.defineAssetStorage; } });
 // Export transformers and types from handoff-core

package/dist/pipeline/index.d.ts

@@ -1,4 +1,4 @@
-import 'dotenv/config';
+import '../config/env';
 import Handoff from '..';
 export { readPrevJSONFile, zip, zipAssets } from './archive';
 export { buildComponents } from './components';

package/dist/pipeline/index.js

@@ -13,7 +13,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildPatterns = exports.buildComponents = exports.zipAssets = exports.zip = exports.readPrevJSONFile = void 0;
-require("dotenv/config");
+require("../config/env");
 const app_builder_1 = __importDefault(require("../app-builder"));
 const logger_1 = require("../utils/logger");
 const figma_1 = require("./figma");

package/dist/registry/asset-storage/adapters/vercel-blob.js

@@ -52,7 +52,7 @@ const createVercelBlobStorage = (params) => {
         const token = (_a = process.env[params.tokenEnv]) === null || _a === void 0 ? void 0 : _a.trim();
         if (!token) {
             throw new Error(`Vercel Blob storage is configured but the token env var "${params.tokenEnv}" is not set. ` +
-                'Set it to a Blob read/write token, or change runtime.registry.assetStorage.tokenEnv.');
+                'Set it to a Blob read/write token, or change runtime.registry.assetStorage.token.');
         }
         return token;
     };

package/dist/registry/asset-storage/resolve.d.ts

@@ -6,7 +6,7 @@
  * {@link import('../db/driver')}: only provider selection, module location, non-secret options, and
  * env-var *names* are ever persisted; secret *values* are read from `process.env` at request time.
  */
-import type { Config } from '../../types/config';
+import type { ResolvedConfig } from '../../types/config';
 import type { AssetStorageProvider } from '../db/schema';
 /** Which adapter implementation is active. */
 export type AssetStorageAdapterKind = 'database' | 'vercel-blob' | 'custom';
@@ -42,4 +42,4 @@ export interface ResolvedAssetStorage {
 /** Resolve raw asset storage settings into a fully-defaulted shape. */
 export declare const resolveAssetStorageSettings: (settings: AssetStorageSettings | null | undefined) => ResolvedAssetStorage;
 /** Resolve the active asset storage settings from a loaded config (CLI/build side). */
-export declare const resolveAssetStorageFromConfig: (config: Config | null | undefined) => ResolvedAssetStorage;
+export declare const resolveAssetStorageFromConfig: (config: ResolvedConfig | null | undefined) => ResolvedAssetStorage;

package/dist/registry/asset-storage/resolve.js

@@ -32,5 +32,8 @@ const resolveAssetStorageSettings = (settings) => {
 };
 exports.resolveAssetStorageSettings = resolveAssetStorageSettings;
 /** Resolve the active asset storage settings from a loaded config (CLI/build side). */
-const resolveAssetStorageFromConfig = (config) => { var _a, _b; return (0, exports.resolveAssetStorageSettings)((_b = (_a = config === null || config === void 0 ? void 0 : config.runtime) === null || _a === void 0 ? void 0 : _a.registry) === null || _b === void 0 ? void 0 : _b.assetStorage); };
+const resolveAssetStorageFromConfig = (config) => {
+    var _a, _b, _c, _d, _e, _f;
+    return (0, exports.resolveAssetStorageSettings)(Object.assign(Object.assign({}, (_b = (_a = config === null || config === void 0 ? void 0 : config.runtime) === null || _a === void 0 ? void 0 : _a.registry) === null || _b === void 0 ? void 0 : _b.assetStorage), { tokenEnv: (_f = (_e = (_d = (_c = config === null || config === void 0 ? void 0 : config.runtime) === null || _c === void 0 ? void 0 : _c.registry) === null || _d === void 0 ? void 0 : _d.assetStorage) === null || _e === void 0 ? void 0 : _e.token) === null || _f === void 0 ? void 0 : _f.$env }));
+};
 exports.resolveAssetStorageFromConfig = resolveAssetStorageFromConfig;

package/dist/registry/checkout/index.js

@@ -106,14 +106,14 @@ const resolveConnectionOrThrow = (handoff) => __awaiter(void 0, void 0, void 0,
         throw new CheckoutError(`checkout is only available from a connected workspace (runtime.mode: "workspace"); this project is "${mode}". ` +
             'A registry host stores and serves entities; it has no local workspace to check them out into.');
     }
-    const connection = yield (0, connection_1.resolveAuthenticatedRegistryConnection)(handoff.config, handoff.workingPath);
+    const connection = yield (0, connection_1.resolveAuthenticatedRegistryConnection)(handoff.config, handoff.workingPath, handoff.getProfile());
     if (!connection.url) {
-        throw new CheckoutError(`No registry is configured. Run \`handoff-app login --url <registry-url>\`, set runtime.registryConnection.url, ` +
+        throw new CheckoutError(`No registry is configured. Run \`${(0, connection_1.loginCommandHint)(connection)}\`, set runtime.registryConnection.url, ` +
             `or set the "${connection.urlEnv}" environment variable to the base URL of the registry to checkout from.`);
     }
     if (!connection.accessToken) {
-        throw new CheckoutError(`No registry access token is configured. Run \`handoff-app login --url ${connection.url}\`, or set the ` +
-            `"${connection.accessTokenEnv}" environment variable to a user-issued token for CI.`);
+        throw new CheckoutError(`No registry access token is configured. Run \`${(0, connection_1.loginCommandHint)(connection)}\`, or set the ` +
+            `"${connection.accessTokenEnv}" environment variable to a user-issued token for CI.${(0, connection_1.unusedLoginNote)(connection)}`);
     }
     return connection;
 });

package/dist/registry/connection.d.ts

@@ -1,20 +1,17 @@
 /**
- * Connected-workspace registry connection resolution.
- *
- * A connected workspace is `runtime.mode: 'workspace'` plus a `runtime.registryConnection` block
- * pointing at a remote registry — it is not a third runtime mode. The connection is resolved from
- * config + environment: the registry URL may be given inline or via an env-var *name*, and the
- * access token is always read from an env-var name (never persisted as a value). This is the single
- * source the publish (and later checkout) client reads its target + credentials from.
- *
- * The older `HANDOFF_CLOUD_*` names still work as deprecated fallbacks; see
- * {@link DEPRECATED_ENV_ALIASES}.
+ * Registry connection values resolve at config load. Saved device login credentials can fill
+ * missing values for CLI operations; neither source is persisted in the app's client config.
  */
-import type { Config } from '../types/config';
+import type { ResolvedConfig } from '../types/config';
 /** Default env-var name holding the remote registry base URL. */
 export declare const DEFAULT_REGISTRY_URL_ENV = "HANDOFF_REGISTRY_URL";
 /** Default env-var name holding the connected-workspace access token. */
 export declare const DEFAULT_REGISTRY_ACCESS_TOKEN_ENV = "HANDOFF_REGISTRY_ACCESS_TOKEN";
+/** A saved login and the profile it is stored under, which is not always the selected profile. */
+interface SavedLogin {
+    profile: string;
+    url: string;
+}
 /** Fully resolved connected-workspace registry connection. */
 export interface ResolvedRegistryConnection {
     /** Resolved registry base URL (inline config value wins, else the named env var), or `''`. */
@@ -25,25 +22,32 @@ export interface ResolvedRegistryConnection {
     urlEnv: string;
     /** Name of the env var the access token is read from. */
     accessTokenEnv: string;
+    /** Profile the saved login was looked up under. */
+    loginProfile: string;
+    /** Set when a saved login was skipped because it was issued for another registry. */
+    unmatchedLogin?: SavedLogin;
 }
-/**
- * Resolve the connected-workspace registry connection from config + environment. Never throws —
- * Callers inspect the resolved URL and access token to surface specific configuration errors.
- *
- * `urlEnv` and `accessTokenEnv` always report the canonical name, even when an alias supplied the
- * value, so errors built from them point at the variable to adopt.
- */
-export declare const resolveRegistryConnection: (config: Config | null | undefined) => ResolvedRegistryConnection;
+/** Read values resolved at config load, retaining variable names for CLI diagnostics. */
+export declare const resolveRegistryConnection: (config: ResolvedConfig | null | undefined) => ResolvedRegistryConnection;
 /**
  * Resolve the same connection for an authenticated CLI operation, letting a saved device login fill
  * in what the environment does not provide. A valid login supplies both the registry URL and the
- * access token, so `handoff-app login` alone is enough to publish and checkout. Environment values
- * keep precedence for deterministic CI: `HANDOFF_REGISTRY_URL` (or inline config) wins over the
- * saved URL, and `HANDOFF_REGISTRY_ACCESS_TOKEN` wins over the saved token. The saved token only
- * applies to the URL it was issued for.
+ * access token, so `handoff-app login` alone is enough to publish and checkout. The login is the one
+ * saved under the selected profile, which is how one workspace addresses several registries.
+ * Environment values keep precedence for deterministic CI: `HANDOFF_REGISTRY_URL` (or inline config)
+ * wins over the saved URL, and `HANDOFF_REGISTRY_ACCESS_TOKEN` wins over the saved token. The saved
+ * token only applies to the URL it was issued for.
  *
  * A configured `HANDOFF_SYNC_SECRET` is the last resort. Being deployment-wide rather than personal,
  * it fills in only where there is no explicit token and no login (CI, in practice), instead of quietly
  * speaking for a developer who is signed in.
  */
-export declare const resolveAuthenticatedRegistryConnection: (config: Config | null | undefined, workingPath?: string) => Promise<ResolvedRegistryConnection>;
+export declare const resolveAuthenticatedRegistryConnection: (config: ResolvedConfig | null | undefined, workingPath?: string, profile?: string) => Promise<ResolvedRegistryConnection>;
+/** The `handoff-app login` call that would authorize this connection, naming the selected profile. */
+export declare const loginCommandHint: (connection: ResolvedRegistryConnection) => string;
+/**
+ * Names a saved login that was skipped because it belongs to another registry. Without it, a run
+ * that resolves its URL from the environment reports a missing token while a login is in place.
+ */
+export declare const unusedLoginNote: (connection: ResolvedRegistryConnection) => string;
+export {};

package/dist/registry/connection.js

@@ -1,15 +1,7 @@
 "use strict";
 /**
- * Connected-workspace registry connection resolution.
- *
- * A connected workspace is `runtime.mode: 'workspace'` plus a `runtime.registryConnection` block
- * pointing at a remote registry — it is not a third runtime mode. The connection is resolved from
- * config + environment: the registry URL may be given inline or via an env-var *name*, and the
- * access token is always read from an env-var name (never persisted as a value). This is the single
- * source the publish (and later checkout) client reads its target + credentials from.
- *
- * The older `HANDOFF_CLOUD_*` names still work as deprecated fallbacks; see
- * {@link DEPRECATED_ENV_ALIASES}.
+ * Registry connection values resolve at config load. Saved device login credentials can fill
+ * missing values for CLI operations; neither source is persisted in the app's client config.
  */
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
@@ -21,89 +13,83 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveAuthenticatedRegistryConnection = exports.resolveRegistryConnection = exports.DEFAULT_REGISTRY_ACCESS_TOKEN_ENV = exports.DEFAULT_REGISTRY_URL_ENV = void 0;
+exports.unusedLoginNote = exports.loginCommandHint = exports.resolveAuthenticatedRegistryConnection = exports.resolveRegistryConnection = exports.DEFAULT_REGISTRY_ACCESS_TOKEN_ENV = exports.DEFAULT_REGISTRY_URL_ENV = void 0;
+const resolve_env_1 = require("../config/resolve-env");
 const store_1 = require("../cli/auth/store");
 // Imported straight from the module, not the `auth` barrel, to keep the database schema off the CLI
 // startup path; this file is resolved for every command.
 const sync_secret_1 = require("./auth/sync-secret");
-const logger_1 = require("../utils/logger");
 /** Default env-var name holding the remote registry base URL. */
 exports.DEFAULT_REGISTRY_URL_ENV = 'HANDOFF_REGISTRY_URL';
 /** Default env-var name holding the connected-workspace access token. */
 exports.DEFAULT_REGISTRY_ACCESS_TOKEN_ENV = 'HANDOFF_REGISTRY_ACCESS_TOKEN';
-/**
- * Old env-var names we still read, keyed by the name that replaced them. Keeps workspaces set up
- * from the older docs working instead of silently reporting no registry.
- */
-const DEPRECATED_ENV_ALIASES = {
-    [exports.DEFAULT_REGISTRY_URL_ENV]: 'HANDOFF_CLOUD_URL',
-    [exports.DEFAULT_REGISTRY_ACCESS_TOKEN_ENV]: 'HANDOFF_CLOUD_TOKEN',
-};
-/** Aliases we've already warned about, so each one warns once per run and not once per lookup. */
-const warnedAliases = new Set();
-/**
- * Value of the named env var, falling back to its deprecated alias. Only the default names have
- * aliases: a custom `urlEnv`/`accessTokenEnv` is a deliberate choice, so a stray `HANDOFF_CLOUD_*`
- * must not stand in for it. The warning goes through {@link Logger.warn}, so
- * `HANDOFF_LOG_LEVEL=error` silences it in CI.
- */
-const readConnectionEnv = (name) => {
-    var _a, _b;
-    const configured = (_a = process.env[name]) === null || _a === void 0 ? void 0 : _a.trim();
-    if (configured)
-        return configured;
-    const alias = DEPRECATED_ENV_ALIASES[name];
-    const inherited = alias ? (_b = process.env[alias]) === null || _b === void 0 ? void 0 : _b.trim() : '';
-    if (!inherited)
-        return '';
-    if (!warnedAliases.has(alias)) {
-        warnedAliases.add(alias);
-        logger_1.Logger.warn(`${alias} is deprecated and will be removed in a future release; set ${name} instead.`);
-    }
-    return inherited;
-};
-/**
- * Resolve the connected-workspace registry connection from config + environment. Never throws —
- * Callers inspect the resolved URL and access token to surface specific configuration errors.
- *
- * `urlEnv` and `accessTokenEnv` always report the canonical name, even when an alias supplied the
- * value, so errors built from them point at the variable to adopt.
- */
+/** Read values resolved at config load, retaining variable names for CLI diagnostics. */
 const resolveRegistryConnection = (config) => {
-    var _a, _b, _c, _d;
+    var _a, _b, _c;
     const connection = (_a = config === null || config === void 0 ? void 0 : config.runtime) === null || _a === void 0 ? void 0 : _a.registryConnection;
-    const urlEnv = ((_b = connection === null || connection === void 0 ? void 0 : connection.urlEnv) === null || _b === void 0 ? void 0 : _b.trim()) || exports.DEFAULT_REGISTRY_URL_ENV;
-    const accessTokenEnv = ((_c = connection === null || connection === void 0 ? void 0 : connection.accessTokenEnv) === null || _c === void 0 ? void 0 : _c.trim()) || exports.DEFAULT_REGISTRY_ACCESS_TOKEN_ENV;
-    const inlineUrl = (_d = connection === null || connection === void 0 ? void 0 : connection.url) === null || _d === void 0 ? void 0 : _d.trim();
-    const url = inlineUrl || readConnectionEnv(urlEnv);
-    const accessToken = readConnectionEnv(accessTokenEnv);
+    const urlEnv = (0, resolve_env_1.configEnvName)(config, 'runtime.registryConnection.url') || exports.DEFAULT_REGISTRY_URL_ENV;
+    const accessTokenEnv = (0, resolve_env_1.configEnvName)(config, 'runtime.registryConnection.accessToken') || exports.DEFAULT_REGISTRY_ACCESS_TOKEN_ENV;
+    const url = ((_b = connection === null || connection === void 0 ? void 0 : connection.url) === null || _b === void 0 ? void 0 : _b.trim()) || '';
+    const accessToken = ((_c = connection === null || connection === void 0 ? void 0 : connection.accessToken) === null || _c === void 0 ? void 0 : _c.trim()) || '';
     return {
         url,
         accessToken,
         urlEnv,
         accessTokenEnv,
+        loginProfile: store_1.DEFAULT_LOGIN_PROFILE,
     };
 };
 exports.resolveRegistryConnection = resolveRegistryConnection;
+/**
+ * The valid login to use for a profile. A profile without its own login falls back to the default
+ * login, so a workspace that names profiles for other reasons keeps working after one plain
+ * `handoff-app login`. The fallback is safe because a token is only ever used for the registry URL
+ * it was issued for.
+ */
+const readProfileLogin = (workingPath, profile) => __awaiter(void 0, void 0, void 0, function* () {
+    const own = yield (0, store_1.readCliAuth)(workingPath, profile);
+    if ((0, store_1.cliAuthTokenIsValid)(own))
+        return { auth: own, profile };
+    const fallback = profile === store_1.DEFAULT_LOGIN_PROFILE ? null : yield (0, store_1.readCliAuth)(workingPath);
+    return (0, store_1.cliAuthTokenIsValid)(fallback) ? { auth: fallback, profile: store_1.DEFAULT_LOGIN_PROFILE } : null;
+});
 /**
  * Resolve the same connection for an authenticated CLI operation, letting a saved device login fill
  * in what the environment does not provide. A valid login supplies both the registry URL and the
- * access token, so `handoff-app login` alone is enough to publish and checkout. Environment values
- * keep precedence for deterministic CI: `HANDOFF_REGISTRY_URL` (or inline config) wins over the
- * saved URL, and `HANDOFF_REGISTRY_ACCESS_TOKEN` wins over the saved token. The saved token only
- * applies to the URL it was issued for.
+ * access token, so `handoff-app login` alone is enough to publish and checkout. The login is the one
+ * saved under the selected profile, which is how one workspace addresses several registries.
+ * Environment values keep precedence for deterministic CI: `HANDOFF_REGISTRY_URL` (or inline config)
+ * wins over the saved URL, and `HANDOFF_REGISTRY_ACCESS_TOKEN` wins over the saved token. The saved
+ * token only applies to the URL it was issued for.
  *
  * A configured `HANDOFF_SYNC_SECRET` is the last resort. Being deployment-wide rather than personal,
  * it fills in only where there is no explicit token and no login (CI, in practice), instead of quietly
  * speaking for a developer who is signed in.
  */
-const resolveAuthenticatedRegistryConnection = (config_1, ...args_1) => __awaiter(void 0, [config_1, ...args_1], void 0, function* (config, workingPath = process.cwd()) {
+const resolveAuthenticatedRegistryConnection = (config_1, ...args_1) => __awaiter(void 0, [config_1, ...args_1], void 0, function* (config, workingPath = process.cwd(), profile) {
     const connection = (0, exports.resolveRegistryConnection)(config);
-    const auth = yield (0, store_1.readCliAuth)(workingPath);
-    const login = (0, store_1.cliAuthTokenIsValid)(auth) ? auth : null;
-    const url = connection.url || (login === null || login === void 0 ? void 0 : login.remoteUrl) || '';
-    const savedToken = login && (0, store_1.cliAuthMatchesRegistry)(login, url) ? login.accessToken : '';
-    const accessToken = connection.accessToken || savedToken || (0, sync_secret_1.resolveRegistrySyncSecret)();
-    return Object.assign(Object.assign({}, connection), { url, accessToken });
+    const loginProfile = (profile === null || profile === void 0 ? void 0 : profile.trim()) || store_1.DEFAULT_LOGIN_PROFILE;
+    const login = yield readProfileLogin(workingPath, loginProfile);
+    const url = connection.url || (login === null || login === void 0 ? void 0 : login.auth.remoteUrl) || '';
+    const matches = Boolean(login) && (0, store_1.cliAuthMatchesRegistry)(login.auth, url);
+    const accessToken = connection.accessToken || (matches ? login.auth.accessToken : '') || (0, sync_secret_1.resolveRegistrySyncSecret)();
+    return Object.assign(Object.assign({}, connection), { url,
+        accessToken,
+        loginProfile, unmatchedLogin: login && !matches ? { profile: login.profile, url: login.auth.remoteUrl } : undefined });
 });
 exports.resolveAuthenticatedRegistryConnection = resolveAuthenticatedRegistryConnection;
+/** The `handoff-app login` call that would authorize this connection, naming the selected profile. */
+const loginCommandHint = (connection) => [
+    'handoff-app login',
+    connection.loginProfile === store_1.DEFAULT_LOGIN_PROFILE ? '' : ` --profile ${connection.loginProfile}`,
+    ` --url ${connection.url || '<registry-url>'}`,
+].join('');
+exports.loginCommandHint = loginCommandHint;
+/**
+ * Names a saved login that was skipped because it belongs to another registry. Without it, a run
+ * that resolves its URL from the environment reports a missing token while a login is in place.
+ */
+const unusedLoginNote = (connection) => connection.unmatchedLogin
+    ? ` The login saved for profile "${connection.unmatchedLogin.profile}" is for ${connection.unmatchedLogin.url}, not ${connection.url}.`
+    : '';
+exports.unusedLoginNote = unusedLoginNote;

package/dist/registry/db/driver.d.ts

@@ -9,7 +9,7 @@
  * credentials are referenced by environment-variable name only and resolved to a value at runtime;
  * the value is never stored in config.
  */
-import type { Config } from '../../types/config';
+import type { ResolvedConfig } from '../../types/config';
 /** Built-in registry database connection driver. Both ship with the package and target Postgres. */
 export type RegistryDatabaseDriver = 'pg' | 'neon';
 /** Default env-var name holding the database connection string. */
@@ -28,19 +28,12 @@ export interface ResolvedRegistryDatabase {
     connectionString: string;
 }
 /** Resolve the env-var name holding the database URL (defaults to `DATABASE_URL`). */
-export declare const resolveDatabaseUrlEnv: (config: Config | null | undefined) => string;
-/**
- * Resolve the legacy fixed-token env-var name for configuration compatibility.
- *
- * @deprecated The returned env var is intentionally ignored by registry authorization. Use a
- * user-issued access token or `handoff-app login`.
- */
-export declare const resolveApiTokenEnv: (config: Config | null | undefined) => string;
+export declare const resolveDatabaseUrlEnv: (config: ResolvedConfig | null | undefined) => string;
 /** Resolve the configured registry database driver (defaults to `pg`). */
-export declare const resolveRegistryDriver: (config: Config | null | undefined) => RegistryDatabaseDriver;
+export declare const resolveRegistryDriver: (config: ResolvedConfig | null | undefined) => RegistryDatabaseDriver;
 /**
  * Resolve the registry database connection from config + environment. Throws an actionable error
  * when the configured env var is unset so the CLI can surface a clear "missing database URL"
  * message instead of failing deep inside the driver.
  */
-export declare const resolveRegistryDatabase: (config: Config | null | undefined) => ResolvedRegistryDatabase;
+export declare const resolveRegistryDatabase: (config: ResolvedConfig | null | undefined) => ResolvedRegistryDatabase;

package/dist/registry/db/driver.js

@@ -11,7 +11,7 @@
  * the value is never stored in config.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveRegistryDatabase = exports.resolveRegistryDriver = exports.resolveApiTokenEnv = exports.resolveDatabaseUrlEnv = exports.DEFAULT_REGISTRY_DRIVER = exports.DEFAULT_REGISTRY_API_TOKEN_ENV = exports.DEFAULT_DATABASE_URL_ENV = void 0;
+exports.resolveRegistryDatabase = exports.resolveRegistryDriver = exports.resolveDatabaseUrlEnv = exports.DEFAULT_REGISTRY_DRIVER = exports.DEFAULT_REGISTRY_API_TOKEN_ENV = exports.DEFAULT_DATABASE_URL_ENV = void 0;
 /** Default env-var name holding the database connection string. */
 exports.DEFAULT_DATABASE_URL_ENV = 'DATABASE_URL';
 /** @deprecated Fixed registry server secrets are no longer authorized. */
@@ -20,23 +20,11 @@ exports.DEFAULT_REGISTRY_API_TOKEN_ENV = 'HANDOFF_REGISTRY_API_TOKEN';
 exports.DEFAULT_REGISTRY_DRIVER = 'pg';
 /** Resolve the env-var name holding the database URL (defaults to `DATABASE_URL`). */
 const resolveDatabaseUrlEnv = (config) => {
-    var _a, _b, _c;
-    const configured = (_c = (_b = (_a = config === null || config === void 0 ? void 0 : config.runtime) === null || _a === void 0 ? void 0 : _a.registry) === null || _b === void 0 ? void 0 : _b.databaseUrlEnv) === null || _c === void 0 ? void 0 : _c.trim();
+    var _a, _b, _c, _d;
+    const configured = (_d = (_c = (_b = (_a = config === null || config === void 0 ? void 0 : config.runtime) === null || _a === void 0 ? void 0 : _a.registry) === null || _b === void 0 ? void 0 : _b.databaseUrl) === null || _c === void 0 ? void 0 : _c.$env) === null || _d === void 0 ? void 0 : _d.trim();
     return configured || exports.DEFAULT_DATABASE_URL_ENV;
 };
 exports.resolveDatabaseUrlEnv = resolveDatabaseUrlEnv;
-/**
- * Resolve the legacy fixed-token env-var name for configuration compatibility.
- *
- * @deprecated The returned env var is intentionally ignored by registry authorization. Use a
- * user-issued access token or `handoff-app login`.
- */
-const resolveApiTokenEnv = (config) => {
-    var _a, _b, _c;
-    const configured = (_c = (_b = (_a = config === null || config === void 0 ? void 0 : config.runtime) === null || _a === void 0 ? void 0 : _a.registry) === null || _b === void 0 ? void 0 : _b.apiTokenEnv) === null || _c === void 0 ? void 0 : _c.trim();
-    return configured || exports.DEFAULT_REGISTRY_API_TOKEN_ENV;
-};
-exports.resolveApiTokenEnv = resolveApiTokenEnv;
 /** Resolve the configured registry database driver (defaults to `pg`). */
 const resolveRegistryDriver = (config) => {
     var _a, _b, _c, _d;
@@ -55,7 +43,7 @@ const resolveRegistryDatabase = (config) => {
     const connectionString = (_a = process.env[databaseUrlEnv]) === null || _a === void 0 ? void 0 : _a.trim();
     if (!connectionString) {
         throw new Error(`Registry database URL is not configured. Set the "${databaseUrlEnv}" environment variable to a ` +
-            `PostgreSQL connection string (or change "runtime.registry.databaseUrlEnv" to point at the env var you use).`);
+            `PostgreSQL connection string (or change "runtime.registry.databaseUrl" to point at the env var you use).`);
     }
     return { driver, databaseUrlEnv, connectionString };
 };

package/dist/registry/db/index.d.ts

@@ -1,5 +1,5 @@
 export { buildMetadata, componentFiles, components, docsArtifacts, patternFiles, patterns, registryAccessTokens, registryAuthActionTokens, registryAuthRateLimits, registryDeviceAuthorizations, registryInstallations, registrySchema, registryUsers, type BuildMetadataEntityKind, type DocsArtifactEntityKind, type RegistryAccessScope, type RegistryAuthActionPurpose, type RegistryDeviceAuthorizationStatus, type RegistryRateLimitBucket, type RegistryReviewMetadata, type RegistryUserRole, type RegistryUserStatus, } from './schema';
 export type { ArtifactBuildStatus as RegistryBuildStatus } from '../../artifacts/types';
-export { DEFAULT_DATABASE_URL_ENV, DEFAULT_REGISTRY_DRIVER, DEFAULT_REGISTRY_API_TOKEN_ENV, resolveApiTokenEnv, resolveDatabaseUrlEnv, resolveRegistryDriver, resolveRegistryDatabase, type RegistryDatabaseDriver, type ResolvedRegistryDatabase, } from './driver';
+export { DEFAULT_DATABASE_URL_ENV, DEFAULT_REGISTRY_DRIVER, DEFAULT_REGISTRY_API_TOKEN_ENV, resolveDatabaseUrlEnv, resolveRegistryDriver, resolveRegistryDatabase, type RegistryDatabaseDriver, type ResolvedRegistryDatabase, } from './driver';
 export { createRegistryDbConnection, type CreateRegistryDbConnectionParams, type RegistryDatabase, type RegistryDbConnection, } from './client';
 export { getMigrationsFolder, runRegistryMigrations } from './migrate';

package/dist/registry/db/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.runRegistryMigrations = exports.getMigrationsFolder = exports.createRegistryDbConnection = exports.resolveRegistryDatabase = exports.resolveRegistryDriver = exports.resolveDatabaseUrlEnv = exports.resolveApiTokenEnv = exports.DEFAULT_REGISTRY_API_TOKEN_ENV = exports.DEFAULT_REGISTRY_DRIVER = exports.DEFAULT_DATABASE_URL_ENV = exports.registryUsers = exports.registrySchema = exports.registryInstallations = exports.registryDeviceAuthorizations = exports.registryAuthRateLimits = exports.registryAuthActionTokens = exports.registryAccessTokens = exports.patterns = exports.patternFiles = exports.docsArtifacts = exports.components = exports.componentFiles = exports.buildMetadata = void 0;
+exports.runRegistryMigrations = exports.getMigrationsFolder = exports.createRegistryDbConnection = exports.resolveRegistryDatabase = exports.resolveRegistryDriver = exports.resolveDatabaseUrlEnv = exports.DEFAULT_REGISTRY_API_TOKEN_ENV = exports.DEFAULT_REGISTRY_DRIVER = exports.DEFAULT_DATABASE_URL_ENV = exports.registryUsers = exports.registrySchema = exports.registryInstallations = exports.registryDeviceAuthorizations = exports.registryAuthRateLimits = exports.registryAuthActionTokens = exports.registryAccessTokens = exports.patterns = exports.patternFiles = exports.docsArtifacts = exports.components = exports.componentFiles = exports.buildMetadata = void 0;
 var schema_1 = require("./schema");
 Object.defineProperty(exports, "buildMetadata", { enumerable: true, get: function () { return schema_1.buildMetadata; } });
 Object.defineProperty(exports, "componentFiles", { enumerable: true, get: function () { return schema_1.componentFiles; } });
@@ -19,7 +19,6 @@ var driver_1 = require("./driver");
 Object.defineProperty(exports, "DEFAULT_DATABASE_URL_ENV", { enumerable: true, get: function () { return driver_1.DEFAULT_DATABASE_URL_ENV; } });
 Object.defineProperty(exports, "DEFAULT_REGISTRY_DRIVER", { enumerable: true, get: function () { return driver_1.DEFAULT_REGISTRY_DRIVER; } });
 Object.defineProperty(exports, "DEFAULT_REGISTRY_API_TOKEN_ENV", { enumerable: true, get: function () { return driver_1.DEFAULT_REGISTRY_API_TOKEN_ENV; } });
-Object.defineProperty(exports, "resolveApiTokenEnv", { enumerable: true, get: function () { return driver_1.resolveApiTokenEnv; } });
 Object.defineProperty(exports, "resolveDatabaseUrlEnv", { enumerable: true, get: function () { return driver_1.resolveDatabaseUrlEnv; } });
 Object.defineProperty(exports, "resolveRegistryDriver", { enumerable: true, get: function () { return driver_1.resolveRegistryDriver; } });
 Object.defineProperty(exports, "resolveRegistryDatabase", { enumerable: true, get: function () { return driver_1.resolveRegistryDatabase; } });

package/dist/registry/publish/index.js

@@ -79,14 +79,14 @@ const assertUniqueCatalogIds = (handoff) => {
  */
 const resolveConnectionOrThrow = (handoff) => __awaiter(void 0, void 0, void 0, function* () {
     (0, exports.assertPublishableWorkspace)(handoff);
-    const connection = yield (0, connection_1.resolveAuthenticatedRegistryConnection)(handoff.config, handoff.workingPath);
+    const connection = yield (0, connection_1.resolveAuthenticatedRegistryConnection)(handoff.config, handoff.workingPath, handoff.getProfile());
     if (!connection.url) {
-        throw new PublishError(`No registry is configured. Run \`handoff-app login --url <registry-url>\`, set runtime.registryConnection.url, ` +
+        throw new PublishError(`No registry is configured. Run \`${(0, connection_1.loginCommandHint)(connection)}\`, set runtime.registryConnection.url, ` +
             `or set the "${connection.urlEnv}" environment variable to the base URL of the registry to publish to.`);
     }
     if (!connection.accessToken) {
-        throw new PublishError(`No registry access token is configured. Run \`handoff-app login --url ${connection.url}\`, or set the ` +
-            `"${connection.accessTokenEnv}" environment variable to a user-issued token for CI.`);
+        throw new PublishError(`No registry access token is configured. Run \`${(0, connection_1.loginCommandHint)(connection)}\`, or set the ` +
+            `"${connection.accessTokenEnv}" environment variable to a user-issued token for CI.${(0, connection_1.unusedLoginNote)(connection)}`);
     }
     return connection;
 });

package/dist/store/filesystem.d.ts

@@ -9,7 +9,7 @@
  * without changing how anything is discovered or built.
  */
 import type { ComponentListObject, PageListObject, PatternListObject } from '../transformers/preview/types';
-import type { Config, RuntimeConfig } from '../types/config';
+import type { ResolvedConfig, RuntimeConfig } from '../types/config';
 import type { ComponentStore, PageStore, PatternStore, SourceReference, TextFileResource, TokenArtifactResource, TokenSetRecord, TokenStore } from './types';
 /**
  * Minimal context needed to back the filesystem store. A `Handoff` instance satisfies this (it
@@ -18,7 +18,7 @@ import type { ComponentStore, PageStore, PatternStore, SourceReference, TextFile
  */
 export interface FilesystemStoreContext {
     runtimeConfig?: RuntimeConfig | null;
-    config?: Config | null;
+    config?: ResolvedConfig | null;
     /** Workspace root (`Handoff.workingPath`), holding `public/` and `fonts/`. */
     workingPath?: string;
     /** Absolute path to the generated `tokens.json` (`Handoff.getTokensFilePath()`). */