feat: transient private-registry auth for deploy_component

[kriszyp]

Summary

• Adds optional registryAuth: [{ registry, token, scope? }] to deploy_component, letting a deploy authenticate npm pack/install against a private registry for package=npm:@org/app@x.y.z references.
• The token is written to a transient 0600 .npmrc (in a 0700 tmpdir), injected via npm_config_userconfig for the deploy's npm spawns, and removed on completion. It is stripped from the operation before replication and from the operations log — so it never persists on disk, reaches peers, lands in logs, or enters the package reference / harperdb-config.yaml / hdb_deployment row.

Context / why

Deploy-by-reference (vs. payload) is cleanly recorded, revertible, and ships no blob — but a private registry needs npm auth, which previously had to be hand-placed per host. This adds a managed, transient credential path. In the cluster, the Harper fabric injects NPM_CONFIG_USERCONFIG on peers; this PR is the data-plane half that handles an origin-supplied token without durably persisting it.

Where to focus

• Security flow (components/operations.js): delete req.registryAuth runs unconditionally before replicateOperation; serverHelpers/serverUtilities.ts strips it from the ops log.
• Transient .npmrc lifecycle (components/Application.ts): writeTransientNpmrc/cleanupTransientNpmrc, 0600 file / 0700 dir, npm_config_userconfig injection in nonInteractiveSpawn.
• Two design decisions worth a second opinion:
  1. A scope-less entry sets npm's default registry= (so an unscoped spec resolves against the private registry) — which requires that registry to serve/proxy public deps. Scoped entries route only their @scope.
  2. writeTransientNpmrc prepends any inherited npm_config_userconfig (e.g. a fabric-injected file) so its proxy/cafile/other registries survive, appending the transient auth last (npm last-value-wins).

Paired with the harper-pro wrapper PR (log redaction + this core bump). Unit coverage added for buildNpmrcContent, the .npmrc lifecycle/merge, and the deploy_component validator.

🤖 Generated by Claude (Opus 4.7).

[gemini-code-assist]

Code Review

This pull request introduces transient private-registry authentication for deploying components by writing credentials to a temporary .npmrc file during installation and cleaning them up immediately afterward. The code reviewer provided valuable feedback to enhance security and robustness, including deleting sensitive credentials immediately after instantiation to prevent leakage on failure, wrapping the cleanup directory removal in a try-catch block to avoid masking deployment errors, and adding defensive checks to prevent directory leaks if the initialization is called multiple times.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[claude]

Reviewed; no blockers found.

[kriszyp]

FAB-356 alignment note (cc @heskew, since you own FAB-356 and review here)

This PR and the GitHub-App private-repo design share the same core invariant — keep the deploy credential out of the replicated operation body / WAL — so they're complementary, not competing (npm npm: refs vs https://github.com/… git clones, alongside the existing git+ssh:// path). Two overlaps worth capturing now so the F-* work lands cleanly on top of this:

1. Spawn hardening (F-5). This PR injects npm_config_userconfig into the shared nonInteractiveSpawn, which runs shell: true (components/Application.ts ~L827/L835). F-5 plans to fork deploy-time spawns into a shell: false nonInteractiveSpawnDeploy precisely to close the credential-bearing-env + shell:true RCE class. When that fork lands, the npmUserconfigPath threading needs to move onto the hardened deploy helper rather than stay on the legacy shell:true one — otherwise private-registry npm pack/install auth gets stranded. (Lower exposure than the git case here — npm_config_userconfig is a file path, not a free-form URL — but same risk class, so it should ride the same fix.)

2. Shared deployComponent surface (F-4). This PR already does strip-before-replicate (delete req.registryAuth before replicateOperation) and uses the token only locally on the originator. F-4's originator/peer branch + identity-only req.credentials object touches the same components/operations.js#deployComponent, so it'd be good to write F-4 knowing registryAuth is already handled this way — the two should compose rather than collide.

Nothing actionable for this PR; just flagging so the F-1/F-4/F-5 work accounts for the npm path. Happy to pair on the nonInteractiveSpawnDeploy fork when it comes up.

— Claude

[kriszyp]

Superseded by #1717, which carries the full feature — the literal-token form from this PR plus a secret-reference form ({ registry, secret }) that resolves the token from the hdb_secret store (#1550/#1582) instead of embedding it. #1717 is stacked on #1582; closing this to consolidate on that branch.

🤖 Closed by KrAIs on Kris's behalf.