@mesh-tech/mesh-cli 0.1.1 → 0.12.0

package/dist/src/commands/login.js

@@ -1,30 +1,32 @@
 /**
- * mesh login — Authenticate with Zitadel via OIDC PKCE flow.
+ * mesh login — Authenticate with Zitadel via OIDC PKCE or Device Code flow.
  *
- * Opens browser to Zitadel, receives auth code via localhost callback,
- * exchanges for tokens, and caches at ~/.config/mesh/credentials.json.
+ * Opens browser to Zitadel (PKCE) or prints a code to enter in the browser
+ * (Device Code). Exchanges for tokens and caches at ~/.config/mesh/credentials.json.
  *
  * Config is read from ~/.config/mesh/config.json, keyed by context
- * (e.g., "mesh.dev"). Example:
+ * (e.g., "mesh.dev"). After deploying the platform, copy the CLI client ID
+ * from the Pulumi stack output into the config file.
  *
- *   {
- *     "mesh.dev": {
- *       "issuer": "https://identity.<env>.<your-platform-domain>",
- *       "clientId": "<cli-oidc-client-id>"
- *     }
- *   }
+ * In containers/SSH sessions, device code flow is used automatically.
  *
  * Usage:
  *   mesh login mesh.dev            — authenticate to mesh dev
- *   mesh login mesh.dev --status   — show current auth state
+ *   mesh login mesh.dev --device   — force device code flow
+ *   mesh login mesh.dev --status   — show current auth state (Zitadel session if
+ *                                    there is one, otherwise whatever the AWS
+ *                                    credential chain resolves — SSO or key pair)
  *   mesh logout mesh.dev           — clear cached credentials
  */
 import * as http from "http";
 import * as crypto from "crypto";
 import * as fs from "fs";
 import * as path from "path";
-import { execSync } from "child_process";
+import { execFileSync } from "child_process";
 import { logError, logInfo, logSuccess, logWarn } from "../utils/log.js";
+import { assumeRoleCredentials, assumeRoleWithWebIdentity, describeAssumeFailure, probeAwsIdentity, renderCredentialProcessProfile, tokenIssuer, resolveStableMeshBin, selectRoleForCaller, toCredentialProcessJson, upsertManagedAwsConfigSection, } from "../utils/aws-auth.js";
+import { firstPartyDomainFor } from "../utils/first-party-contexts.js";
+import { tailscaleBackendState } from "./vpn/index.js";
 // =============================================================================
 // Paths (XDG Base Directory Specification)
 // =============================================================================
@@ -44,10 +46,152 @@ function readConfig() {
         return {};
     }
 }
+export function writeContextConfig(context, config) {
+    const existing = readConfig();
+    existing[context] = config;
+    fs.mkdirSync(CONFIG_DIR, { recursive: true });
+    fs.writeFileSync(CONFIG_FILE, JSON.stringify(existing, null, 2));
+}
 function getContextConfig(context) {
     const config = readConfig();
     return config[context] ?? null;
 }
+/**
+ * Parse a mesh context like "mesh.dev" or "acme.uat" into tenant + env.
+ * Returns null if the context doesn't match the expected {tenant}.{env} pattern.
+ */
+function parseTenantEnv(context) {
+    const parts = context.split(".");
+    if (parts.length !== 2 || !parts[0] || !parts[1])
+        return null;
+    return { tenant: parts[0], env: parts[1] };
+}
+/**
+ * Attempt auto-discovery of platform config from SSM Parameter Store.
+ *
+ * Uses ambient AWS credentials to read the zitadel config export at
+ * /mesh-platform/{tenant}/{env}/platform/zitadel. This is the preferred
+ * discovery path for users who already have AWS SSO access to the platform.
+ *
+ * Returns null if AWS credentials are unavailable, SSM read fails, or the
+ * parameter doesn't contain the required fields.
+ */
+async function discoverConfigFromSsm(context) {
+    const parsed = parseTenantEnv(context);
+    if (!parsed)
+        return null;
+    const { tenant, env } = parsed;
+    const ssmPath = `/mesh-platform/${tenant}/${env}/platform/zitadel`;
+    logInfo(`Attempting SSM discovery from ${ssmPath}...`);
+    try {
+        const { SSMClient, GetParameterCommand } = await import("@aws-sdk/client-ssm");
+        const region = process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? "us-east-2";
+        const ssm = new SSMClient({ region });
+        const resp = await ssm.send(new GetParameterCommand({ Name: ssmPath }));
+        const raw = resp.Parameter?.Value;
+        if (!raw) {
+            logWarn(`SSM parameter ${ssmPath} has no value`);
+            return null;
+        }
+        const data = JSON.parse(raw);
+        const issuer = data.endpoint;
+        const clientId = data.cliClientId;
+        if (typeof issuer !== "string" || !issuer) {
+            logWarn("SSM zitadel entry missing 'endpoint' field");
+            return null;
+        }
+        if (typeof clientId !== "string" || !clientId) {
+            logWarn("SSM zitadel entry missing 'cliClientId' field.\n" +
+                "  The platform needs to be deployed with an updated ZitadelPlatformIdentity\n" +
+                "  that exports cliClientId. Until then, contact your platform admin.");
+            return null;
+        }
+        const config = { issuer, clientId };
+        if (typeof data.vpn === "string")
+            config.vpn = data.vpn;
+        if (typeof data.vpnJoinBroker === "string")
+            config.vpnJoinBroker = data.vpnJoinBroker;
+        if (typeof data.registryBroker === "string")
+            config.registryBroker = data.registryBroker;
+        writeContextConfig(context, config);
+        logSuccess(`Discovered platform configuration for ${context} via SSM`);
+        return config;
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (message.includes("ExpiredToken") || message.includes("credentials")) {
+            logWarn(`SSM discovery failed: AWS credentials expired or unavailable.`);
+            // Do NOT send someone to `aws sso login` when an anonymous path is about
+            // to be tried — on the install journey that is the exact misdirection
+            // this feature removes. Only mention AWS when nothing else can resolve.
+            if (firstPartyDomainFor(context) || context.split(".").length - 1 >= 2) {
+                logInfo(`  Falling back to anonymous HTTPS discovery — no AWS needed.`);
+            }
+            else {
+                logInfo(`  If you have an AWS account: aws sso login --profile <profile>`);
+                logInfo(`  Otherwise use the platform's full domain, e.g. mesh login dev.<tenant>.meshtech.io`);
+            }
+        }
+        else if (message.includes("ParameterNotFound")) {
+            logWarn(`SSM parameter not found: ${ssmPath}`);
+            logInfo("  This platform context may not be deployed.");
+        }
+        else {
+            logWarn(`SSM discovery failed: ${message}`);
+        }
+        return null;
+    }
+}
+/**
+ * Attempt auto-discovery of platform config from a well-known endpoint.
+ * Returns null if discovery fails for any reason (network, timeout, bad data).
+ *
+ * `contextKey` is the name the resulting config is CACHED under, which is not
+ * always the domain probed: a pinned first-party alias (`mesh.dev`) probes
+ * `dev.platform.meshtech.io` but must be cached under `mesh.dev`, or the very
+ * next command re-runs discovery and the alias buys nothing.
+ */
+async function discoverConfig(domain, contextKey = domain) {
+    const url = `https://cli.${domain}/.well-known/mesh.json`;
+    logInfo(`Attempting discovery from ${url}...`);
+    try {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), 5000);
+        const resp = await fetch(url, { signal: controller.signal });
+        clearTimeout(timeout);
+        if (!resp.ok) {
+            logWarn(`Discovery endpoint returned ${resp.status}`);
+            return null;
+        }
+        const data = (await resp.json());
+        const issuer = data.issuer;
+        const clientId = data.clientId;
+        if (typeof issuer !== "string" || !issuer || typeof clientId !== "string" || !clientId) {
+            logWarn("Discovery endpoint returned invalid config (missing issuer or clientId)");
+            return null;
+        }
+        const config = { issuer, clientId };
+        if (typeof data.vpn === "string")
+            config.vpn = data.vpn;
+        if (typeof data.vpnJoinBroker === "string")
+            config.vpnJoinBroker = data.vpnJoinBroker;
+        if (typeof data.registryBroker === "string")
+            config.registryBroker = data.registryBroker;
+        writeContextConfig(contextKey, config);
+        logSuccess(`Discovered platform configuration for ${contextKey}`);
+        return config;
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (message.includes("abort")) {
+            logWarn("Discovery timed out");
+        }
+        else {
+            logWarn(`Discovery failed: ${message}`);
+        }
+        return null;
+    }
+}
 function readAllCredentials() {
     if (!fs.existsSync(CREDENTIALS_FILE))
         return {};
@@ -61,13 +205,43 @@ function readAllCredentials() {
 function readCredentials(context) {
     return readAllCredentials()[context] ?? null;
 }
+/** Monotonic counter mixed into temp-file names alongside the pid, so two
+ * writes from the same process in the same tick (e.g. rapid retries) never
+ * collide on a temp path. */
+let atomicWriteCounter = 0;
+/**
+ * Write `data` to `path` atomically: write to a temp file in the SAME
+ * directory as `path` (so the subsequent rename is same-filesystem, hence
+ * atomic), then `fs.renameSync` it into place. This guarantees concurrent
+ * readers (e.g. other `credential_process` invocations racing a refresh)
+ * only ever observe a fully-written file — never a truncated one from an
+ * interleaved `fs.writeFileSync`.
+ *
+ * On any error, best-effort removes the temp file before rethrowing.
+ *
+ * Exported for unit testing.
+ */
+export function atomicWriteFileSync(path, data, mode) {
+    const tmpPath = `${path}.${process.pid}.${atomicWriteCounter++}.tmp`;
+    try {
+        fs.writeFileSync(tmpPath, data, { mode });
+        fs.renameSync(tmpPath, path);
+    }
+    catch (err) {
+        try {
+            fs.unlinkSync(tmpPath);
+        }
+        catch {
+            // best-effort cleanup — ignore (e.g. write itself never created the file)
+        }
+        throw err;
+    }
+}
 function writeCredentials(context, creds) {
     fs.mkdirSync(CONFIG_DIR, { recursive: true });
     const all = readAllCredentials();
     all[context] = creds;
-    fs.writeFileSync(CREDENTIALS_FILE, JSON.stringify(all, null, 2), {
-        mode: 0o600,
-    });
+    atomicWriteFileSync(CREDENTIALS_FILE, JSON.stringify(all, null, 2), 0o600);
 }
 function clearCredentials(context) {
     const all = readAllCredentials();
@@ -143,6 +317,11 @@ function login(context, config) {
         authUrl.searchParams.set("code_challenge", codeChallenge);
         authUrl.searchParams.set("code_challenge_method", "S256");
         authUrl.searchParams.set("state", state);
+        // Tracked teardown — without this `mesh login` hangs after success
+        // because (a) the 2-minute timeout below kept the event loop alive,
+        // and (b) the browser's keep-alive socket survived `server.close()`
+        // (which only stops new connections, not active ones).
+        let timeoutId;
         const server = http.createServer(async (req, res) => {
             try {
                 const url = new URL(req.url ?? "/", `http://localhost:${REDIRECT_PORT}`);
@@ -154,9 +333,10 @@ function login(context, config) {
                 const error = url.searchParams.get("error");
                 if (error) {
                     const desc = url.searchParams.get("error_description") ?? error;
+                    const safeDesc = desc.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
                     res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
-                    res.end(`<html><body><h2>Login failed</h2><p>${desc}</p></body></html>`);
-                    server.close();
+                    res.end(`<html><body><h2>Login failed</h2><p>${safeDesc}</p></body></html>`);
+                    teardown();
                     reject(new Error(desc));
                     return;
                 }
@@ -164,7 +344,7 @@ function login(context, config) {
                 if (returnedState !== state) {
                     res.writeHead(400);
                     res.end("State mismatch");
-                    server.close();
+                    teardown();
                     reject(new Error("State mismatch"));
                     return;
                 }
@@ -172,7 +352,7 @@ function login(context, config) {
                 if (!code) {
                     res.writeHead(400);
                     res.end("No code");
-                    server.close();
+                    teardown();
                     reject(new Error("No authorization code received"));
                     return;
                 }
@@ -209,23 +389,32 @@ function login(context, config) {
                 if (tenants.length > 0) {
                     logInfo(`Deployable tenants: ${tenants.join(", ")}`);
                 }
-                server.close();
+                hintVpnIfDisconnected(context);
+                teardown();
                 resolve();
             }
             catch (err) {
-                server.close();
+                teardown();
                 reject(err);
             }
         });
+        // Defined after `server` so the closure captures it; covers
+        // success, error, and timeout paths.
+        const teardown = () => {
+            if (timeoutId)
+                clearTimeout(timeoutId);
+            server.closeAllConnections?.();
+            server.close();
+        };
         server.listen(REDIRECT_PORT, () => {
             logInfo(`Opening browser for authentication (${context})...`);
             const url = authUrl.toString();
             try {
                 if (process.platform === "darwin") {
-                    execSync(`open "${url}"`, { stdio: "ignore" });
+                    execFileSync("open", [url], { stdio: "ignore" });
                 }
                 else if (process.platform === "linux") {
-                    execSync(`xdg-open "${url}"`, { stdio: "ignore" });
+                    execFileSync("xdg-open", [url], { stdio: "ignore" });
                 }
                 else {
                     logInfo(`Open this URL in your browser:\n${url}`);
@@ -235,21 +424,272 @@ function login(context, config) {
                 logInfo(`Open this URL in your browser:\n${url}`);
             }
         });
-        // Timeout after 2 minutes
-        setTimeout(() => {
-            server.close();
+        // Timeout after 2 minutes. We keep a handle so success / error
+        // paths can clear it via `teardown()` — otherwise the timer keeps
+        // the Node event loop alive for 2 minutes after a successful
+        // login and the CLI appears to hang.
+        timeoutId = setTimeout(() => {
+            teardown();
             reject(new Error("Login timed out (2 minutes)"));
         }, 120_000);
     });
 }
-// =============================================================================
-// Status
-// =============================================================================
+/** Number of fresh device codes to issue before giving up. A code's TTL is
+ *  short (a couple of minutes), so if the user is slow we quietly issue another
+ *  rather than failing the whole login (we hit this repeatedly in practice). */
+const MAX_DEVICE_CODES = 3;
+/**
+ * Run device-code login, re-issuing a fresh code (up to `maxCodes`) if the user
+ * doesn't finish before a code expires. `attempt` performs ONE code's
+ * request+poll and resolves `"success"` or `"expired"`; it rejects only on a
+ * hard error (denied / network). Extracted + injectable so the reissue loop is
+ * unit-testable without real network calls.
+ */
+export async function deviceLoginWithReissue(attempt, maxCodes = MAX_DEVICE_CODES) {
+    for (let n = 1; n <= maxCodes; n++) {
+        if (n > 1)
+            logWarn(`That code expired — issuing a fresh one (${n}/${maxCodes})…`);
+        if ((await attempt(n)) === "success")
+            return;
+    }
+    throw new Error(`Device login not completed after ${maxCodes} codes. Re-run the command when you're ready to authorize.`);
+}
+async function deviceCodeLogin(context, config) {
+    await deviceLoginWithReissue(() => attemptDeviceCode(context, config));
+}
+async function attemptDeviceCode(context, config) {
+    // Step 1: Request device authorization
+    const resp = await fetch(`${config.issuer}/oauth/v2/device_authorization`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            client_id: config.clientId,
+            scope: SCOPES,
+        }).toString(),
+    });
+    if (!resp.ok) {
+        const text = await resp.text();
+        throw new Error(`Device authorization request failed (${resp.status}): ${text}`);
+    }
+    const deviceAuth = await resp.json();
+    const openUrl = deviceAuth.verification_uri_complete ?? deviceAuth.verification_uri;
+    // Step 2: Display instructions
+    console.log();
+    logInfo(`Open this URL in your browser:\n`);
+    logInfo(`  ${openUrl}\n`);
+    logInfo(`Code: ${deviceAuth.user_code}`);
+    console.log();
+    logInfo("Waiting for authorization...");
+    // Try to open browser (works on host, harmless failure in container)
+    try {
+        if (process.platform === "darwin") {
+            execFileSync("open", [openUrl], { stdio: "ignore" });
+        }
+        else if (process.platform === "linux") {
+            execFileSync("xdg-open", [openUrl], { stdio: "ignore" });
+        }
+    }
+    catch { /* ignore — user can open manually */ }
+    // Step 3: Poll for token
+    const deadline = Date.now() + deviceAuth.expires_in * 1000;
+    let interval = deviceAuth.interval * 1000;
+    while (Date.now() < deadline) {
+        await new Promise((r) => setTimeout(r, interval));
+        const tokenResp = await fetch(`${config.issuer}/oauth/v2/token`, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                client_id: config.clientId,
+                grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                device_code: deviceAuth.device_code,
+            }).toString(),
+        });
+        if (tokenResp.ok) {
+            const tokens = await tokenResp.json();
+            const idPayload = decodeJwtPayload(tokens.id_token);
+            const email = idPayload.email ?? idPayload.preferred_username ?? "unknown";
+            const sub = idPayload.sub;
+            let tenants = [];
+            try {
+                const accessPayload = decodeJwtPayload(tokens.access_token);
+                tenants = accessPayload["urn:mesh:tenants"] ?? [];
+            }
+            catch { /* opaque access token */ }
+            writeCredentials(context, {
+                idToken: tokens.id_token,
+                accessToken: tokens.access_token,
+                refreshToken: tokens.refresh_token,
+                expiresAt: new Date(Date.now() + tokens.expires_in * 1000).toISOString(),
+                email,
+                sub,
+            });
+            logSuccess(`Logged in as ${email} (${context})`);
+            if (tenants.length > 0) {
+                logInfo(`Deployable tenants: ${tenants.join(", ")}`);
+            }
+            hintVpnIfDisconnected(context);
+            return "success";
+        }
+        const error = await tokenResp.json();
+        switch (error.error) {
+            case "authorization_pending":
+                continue;
+            case "slow_down":
+                interval += 1000;
+                continue;
+            case "expired_token":
+                return "expired"; // caller re-issues a fresh code
+            case "access_denied":
+                throw new Error("Authorization denied by user.");
+            default:
+                throw new Error(`Token exchange failed: ${error.error} — ${error.error_description ?? ""}`);
+        }
+    }
+    return "expired"; // deadline reached without authorization — re-issue
+}
+/**
+ * Detect an environment where the PKCE browser-callback flow won't work — a
+ * container, a remote/SSH session, or any non-interactive shell (piped output,
+ * headless, agent/CI-run). In all of these the callback flow has no browser to
+ * open and no interactive terminal, so it can only hang until the 2-minute
+ * timeout. Device-code flow (print a URL + code to complete elsewhere) is the
+ * correct fallback, so callers use it whenever this returns true.
+ *
+ * Exported for tests.
+ */
+export function isRemoteEnvironment() {
+    // Docker / devcontainer
+    if (process.env.REMOTE_CONTAINERS || process.env.CODESPACES)
+        return true;
+    if (fs.existsSync("/.dockerenv"))
+        return true;
+    // SSH session
+    if (process.env.SSH_CLIENT || process.env.SSH_TTY)
+        return true;
+    // No interactive terminal on stdin/stdout — `isTTY` is `undefined` (falsy)
+    // when the stream is not a TTY. This is the case that bit us: an agent- or
+    // script-driven shell over Tailscale has none of the env vars above set, so
+    // the old check fell through to the browser flow and timed out. Device flow
+    // still works when a browser IS available (just copy the URL+code), so
+    // preferring it here is strictly safer than a guaranteed timeout.
+    if (!process.stdout.isTTY || !process.stdin.isTTY)
+        return true;
+    return false;
+}
+/**
+ * After a successful login, hint about VPN if Tailscale is not connected.
+ * Non-blocking — never fails or delays the login flow.
+ */
+function hintVpnIfDisconnected(context) {
+    try {
+        const state = tailscaleBackendState();
+        if (state !== "Running") {
+            console.log("");
+            logInfo(`VPN not connected. To access dev services, run:`);
+            logInfo(`  mesh vpn connect ${context}`);
+        }
+    }
+    catch {
+        // Tailscale not installed or not queryable — skip hint
+    }
+}
+/**
+ * The account id embedded in an IAM role ARN
+ * (`arn:aws:iam::123456789012:role/...`), or undefined when there is no ARN
+ * to read one from.
+ */
+export function accountIdFromRoleArn(roleArn) {
+    return roleArn?.match(/^arn:aws:iam::(\d{12}):/)?.[1];
+}
+/**
+ * Decide everything `--status` says (and its exit code) when there is no
+ * usable Zitadel session — pure so the wording and the exit decision are
+ * pinned by tests.
+ *
+ * The probe only proves "some AWS identity works on this machine"; it says
+ * nothing about whether that identity belongs to `context`. So the claim is
+ * scoped to the credentials — unless the context config carries a role ARN,
+ * whose account id makes the context check free: verify when we can, say so
+ * when we can't.
+ */
+export function renderAwsFallbackStatus(context, reason, identity, expectedAccountId) {
+    if (!identity) {
+        return {
+            lines: [
+                {
+                    level: "warn",
+                    text: `${reason}, and no working AWS credentials were found either.`,
+                },
+                { level: "info", text: "Authenticate with whichever you use:" },
+                { level: "info", text: `  mesh login ${context}        (Zitadel SSO)` },
+                {
+                    level: "info",
+                    text: "  aws sso login --profile …    (AWS SSO profile)",
+                },
+                {
+                    level: "info",
+                    text: "  export AWS_PROFILE=…         (profile with a key/secret pair)",
+                },
+            ],
+            exitCode: 1,
+        };
+    }
+    const lines = [
+        {
+            level: "success",
+            text: `AWS credentials are working (${identity.source})`,
+        },
+        { level: "info", text: `Identity: ${identity.arn}` },
+        { level: "info", text: `Account:  ${identity.accountId}` },
+    ];
+    if (expectedAccountId && identity.accountId !== expectedAccountId) {
+        lines.push({
+            level: "warn",
+            text: `This account does not match ${context}'s configured role account ` +
+                `(${expectedAccountId}) — commands against ${context} will likely ` +
+                `fail with AccessDenied. Check AWS_PROFILE / your exported credentials.`,
+        });
+    }
+    else if (expectedAccountId) {
+        lines.push({
+            level: "info",
+            text: `Account matches ${context}'s configured role account.`,
+        });
+    }
+    else {
+        lines.push({
+            level: "info",
+            text: `This is a working AWS identity, not a verified connection to ` +
+                `${context} — nothing here checked that this account is ${context}'s.`,
+        });
+    }
+    lines.push({
+        level: "info",
+        text: `${reason} — that only matters for the commands that need a *user* ` +
+            `identity (Hub SSO, \`mesh dev\` test users, zero-touch VPN join). ` +
+            `Deploys, registry auth and secrets work off these credentials.`,
+    });
+    return { lines, exitCode: 0 };
+}
+async function showAwsCredentialStatus(context, reason, config) {
+    const identity = await probeAwsIdentity();
+    const { lines, exitCode } = renderAwsFallbackStatus(context, reason, identity, accountIdFromRoleArn(config.defaultRole ?? config.adminRole));
+    for (const line of lines) {
+        if (line.level === "success")
+            logSuccess(line.text);
+        else if (line.level === "warn")
+            logWarn(line.text);
+        else
+            logInfo(line.text);
+    }
+    if (exitCode !== 0)
+        process.exit(exitCode);
+}
 async function showStatus(context, config) {
     const creds = readCredentials(context);
     if (!creds) {
-        logWarn(`Not logged in to ${context}. Run: mesh login ${context}`);
-        process.exit(1);
+        await showAwsCredentialStatus(context, "No cached Zitadel session", config);
+        return;
     }
     const expired = new Date(creds.expiresAt) < new Date();
     if (expired && creds.refreshToken) {
@@ -269,13 +709,13 @@ async function showStatus(context, config) {
             return;
         }
         catch {
-            logWarn(`Token expired and refresh failed. Run: mesh login ${context}`);
-            process.exit(1);
+            await showAwsCredentialStatus(context, "Zitadel token expired and refresh failed", config);
+            return;
         }
     }
     if (expired) {
-        logWarn(`Token expired at ${creds.expiresAt}. Run: mesh login ${context}`);
-        process.exit(1);
+        await showAwsCredentialStatus(context, `Zitadel token expired at ${creds.expiresAt}`, config);
+        return;
     }
     // Parse tenants from access token
     let tenants = [];
@@ -299,33 +739,88 @@ async function showStatus(context, config) {
 export function registerLoginCommand(program) {
     program
         .command("login")
-        .description("Authenticate with Zitadel (OIDC PKCE)")
+        .description("Authenticate with Zitadel (OIDC PKCE or Device Code)")
         .argument("<context>", 'Platform context (e.g., "mesh.dev")')
-        .option("--status", "Show current authentication status")
+        .option("--status", "Show current authentication status — the Zitadel session if one is cached, otherwise the AWS identity the credential chain resolves (SSO profile or key pair). Exits non-zero only when neither works.")
+        .option("--device", "Force device code flow (no callback server needed)")
+        .option("--export", "After login, print a self-refreshing AWS credential_process profile as shell `export` statements (use with `eval`). The resulting shell auto-refreshes credentials via `mesh login`. Requires --role or MESH_AWS_ROLE.")
+        .option("--static", "With --export: print raw temporary AWS credentials (a frozen ~1h triple) instead of the default self-refreshing credential_process profile")
+        .option("--credential-process", "Print AWS credential_process JSON (used by mesh dev's temp profile); refreshes the Zitadel token as needed. Requires --role or a cached defaultRole.")
+        .option("--role <arn>", "IAM role ARN to assume via web identity (used with --export). Saved as the default for this context so future --export runs can omit it. Resolution order: --role > MESH_AWS_ROLE > cached defaultRole.")
+        .option("--region <region>", "AWS region to include in the exported AWS_REGION. Defaults to AWS_REGION env or us-east-2.")
+        .option("--no-registry", "Skip the CodeArtifact registry-auth step that runs automatically after login for {tenant}.{env} contexts")
         .action(async (context, opts) => {
-        const config = getContextConfig(context);
+        let config = getContextConfig(context);
         if (!config) {
-            logError(`No configuration found for "${context}".\n` +
-                `Add it to ${CONFIG_FILE}:\n\n` +
-                `  {\n` +
-                `    "${context}": {\n` +
-                `      "issuer": "https://identity.<env>.<your-platform-domain>",\n` +
-                `      "clientId": "<cli-oidc-client-id>"\n` +
-                `    }\n` +
-                `  }\n`);
-            process.exit(1);
+            // One chain, shared with `ensureLogin` — see discoverConfigGuarded.
+            // Deliberately NOT re-implemented here: this call site and that one
+            // drifted apart once already, and the difference was whether a clean
+            // laptop could resolve a short context at all.
+            config = await discoverConfigGuarded(context);
+            if (!config) {
+                const pinned = firstPartyDomainFor(context);
+                logError(`No configuration found for "${context}".\n\n` +
+                    `Tried:\n` +
+                    `  1. SSM: /mesh-platform/${context.split(".")[0]}/${context.split(".")[1]}/platform/zitadel\n` +
+                    `     (requires AWS SSO login + read access)\n` +
+                    (pinned
+                        ? `  2. HTTPS: https://cli.${pinned}/.well-known/mesh.json  (pinned first-party domain)\n\n`
+                        : `  2. HTTPS: https://cli.${context}/.well-known/mesh.json\n` +
+                            `     (only attempted for a full domain, or a known first-party context)\n\n`) +
+                    `To fix:\n` +
+                    `  - Use the platform's full domain: mesh login <env>.<tenant>.meshtech.io\n` +
+                    `  - Or, if you have AWS access, ensure SSO is active: aws sso login --profile <profile>\n` +
+                    `  - Or add config manually to ${CONFIG_FILE}:\n\n` +
+                    `    {\n` +
+                    `      "${context}": {\n` +
+                    `        "issuer": "https://identity.<env>.<your-platform-domain>",\n` +
+                    `        "clientId": "<cli-oidc-client-id>"\n` +
+                    `      }\n` +
+                    `    }\n`);
+                process.exit(1);
+            }
         }
         if (opts.status) {
             await showStatus(context, config);
             return;
         }
+        if (opts.export) {
+            await exportAwsCredentials(context, config, opts);
+            return;
+        }
+        if (opts.credentialProcess) {
+            await credentialProcessAwsCredentials(context, config, opts);
+            return;
+        }
         try {
-            await login(context, config);
+            const useDevice = opts.device || isRemoteEnvironment();
+            if (useDevice) {
+                logInfo("Using device code flow");
+                await deviceCodeLogin(context, config);
+            }
+            else {
+                await login(context, config);
+            }
         }
         catch (err) {
             logError(`Login failed: ${err.message}`);
             process.exit(1);
         }
+        // F2: login absorbs registry auth. CodeArtifact-backed contexts are the
+        // {tenant}.{env} ones — the local platform ('local') has no registry.
+        // Best-effort: a registry hiccup must not fail an otherwise good login.
+        if (opts.registry !== false && parseTenantEnv(context)) {
+            try {
+                logInfo("Refreshing CodeArtifact registry auth (skip with --no-registry)…");
+                const { runRegistryLogin } = await import("./registry.js");
+                await runRegistryLogin(context, {});
+            }
+            catch (err) {
+                logWarn(`Registry auth failed (login itself succeeded): ${err.message}` +
+                    ` — retry with: mesh registry login ${context}`
+                    + ` (add --profile mesh-dev only if you have an AWS account and the broker is unavailable)`);
+            }
+        }
     });
     program
         .command("logout")
@@ -337,8 +832,441 @@ export function registerLoginCommand(program) {
     });
 }
 // =============================================================================
-// Exports (for use by mesh deploy)
+// Exports (for use by other mesh commands)
+// =============================================================================
+/**
+ * Get a valid access token for the given context, refreshing if needed.
+ *
+ * Returns the id token (a JWT with `sub` claim) suitable for
+ * Authorization: Bearer headers. Returns null if no credentials are
+ * cached or refresh fails.
+ */
+/**
+ * True while a cached token is still valid, treating anything within `marginMs`
+ * of expiry as already stale. The margin lets pollers (e.g. the dev-user
+ * token-server) re-mint BEFORE expiry instead of handing out a token that dies
+ * before the caller's next poll.
+ */
+export function tokenStillValid(expiresAt, marginMs = 0, now = Date.now()) {
+    return new Date(expiresAt).getTime() - marginMs > now;
+}
+async function getValidToken(context, opts = {}) {
+    const config = getContextConfig(context);
+    if (!config)
+        return null;
+    const creds = readCredentials(context);
+    if (!creds)
+        return null;
+    if (tokenStillValid(creds.expiresAt, opts.marginMs ?? 0)) {
+        return creds.idToken;
+    }
+    // Attempt refresh
+    if (!creds.refreshToken)
+        return null;
+    try {
+        const tokens = await refreshTokens(config.issuer, config.clientId, creds.refreshToken);
+        const idPayload = decodeJwtPayload(tokens.id_token);
+        writeCredentials(context, {
+            ...creds,
+            idToken: tokens.id_token,
+            accessToken: tokens.access_token,
+            refreshToken: tokens.refresh_token ?? creds.refreshToken,
+            expiresAt: new Date(Date.now() + tokens.expires_in * 1000).toISOString(),
+            email: idPayload.email ?? creds.email,
+        });
+        return tokens.id_token;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Probe deployer creds for `context`/`roleArn`. Order matters:
+ *   1. No cached Zitadel session → `no-session`.
+ *   2. Cached session AND ambient `AWS_*` env keys present → `stale-env-override`
+ *      (the frozen triple would override the self-refreshing profile at
+ *      runtime — the exact `mesh dev` trap). Guarded on a cached session so
+ *      legitimate CI env-key credentials, which have no `mesh login` session,
+ *      are not misreported.
+ *   3. Session can't be refreshed → `expired-session`.
+ *   4. AssumeRoleWithWebIdentity fails → `assume-denied` (valid identity, wrong
+ *      IAM/role/policy).
+ *   5. Otherwise → `ok` with the STS TTL.
+ */
+export async function probeCredentials(context, roleArn) {
+    const cached = readCredentials(context);
+    if (!cached)
+        return { state: "no-session" };
+    if (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SESSION_TOKEN) {
+        return { state: "stale-env-override" };
+    }
+    const token = await getValidToken(context);
+    if (!token)
+        return { state: "expired-session" };
+    const sessionName = (cached.email ?? "mesh-cli-doctor")
+        .replace(/[^a-zA-Z0-9=,.@-]/g, "_")
+        .slice(0, 64);
+    const sts = await assumeRoleCredentials(roleArn, token, sessionName);
+    if (!sts) {
+        return {
+            state: "assume-denied",
+            detail: describeAssumeFailure({ roleArn, context, issuer: tokenIssuer(token) }, "inline"),
+        };
+    }
+    const ttlSeconds = Math.max(0, Math.round((Date.parse(sts.Expiration) - Date.now()) / 1000));
+    return { state: "ok", ttlSeconds, expiresAt: sts.Expiration, email: cached.email };
+}
+// =============================================================================
+// AWS credential export (--export flag)
+// =============================================================================
+/**
+ * Single-quote a value for shell-safe inclusion in an `export` statement.
+ * Single-quoted strings in POSIX shells don't expand `$` or other metachars;
+ * embedded single-quotes are escaped via the `'\''` trick.
+ */
+function shellSingleQuote(value) {
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
+/**
+ * Render the `--static` output: raw temporary AWS credentials as shell
+ * `export` statements (the old frozen ~1h triple). Pure — no I/O. Includes a
+ * trailing newline. Exported for unit testing.
+ */
+export function renderExportStaticLines(args) {
+    return (`export AWS_ACCESS_KEY_ID=${shellSingleQuote(args.accessKey)}\n` +
+        `export AWS_SECRET_ACCESS_KEY=${shellSingleQuote(args.secretKey)}\n` +
+        `export AWS_SESSION_TOKEN=${shellSingleQuote(args.sessionToken)}\n` +
+        `export AWS_REGION=${shellSingleQuote(args.region)}\n`);
+}
+/**
+ * Render the default `--export` output: point the shell at a self-refreshing
+ * `credential_process` profile. The leading `unset` clears any stale STS
+ * triple already in the shell so it can't shadow the profile. Pure — no I/O.
+ * Includes a trailing newline. Exported for unit testing.
+ *
+ * Deliberately does NOT export `AWS_CONFIG_FILE`: the profile lives in the
+ * user's REAL AWS config file (managed marker section — see
+ * `upsertManagedAwsConfigSection`), so their other profiles (e.g.
+ * `AWS_PROFILE=mesh-dev` InfraAdmin) keep working in the same shell.
+ * Redirecting AWS_CONFIG_FILE to a mesh-private file used to clobber
+ * ~/.aws/config for every subsequent AWS command.
+ */
+export function renderExportProfileLines(args) {
+    return (`unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN\n` +
+        `export AWS_PROFILE=${shellSingleQuote(args.profileName)}\n` +
+        `export AWS_REGION=${shellSingleQuote(args.region)}\n`);
+}
+/**
+ * The AWS config file the managed profile section is written into: the
+ * user's `$AWS_CONFIG_FILE` when THEY have set one, else `~/.aws/config` —
+ * the same file `aws configure sso` manages. Exported for unit testing.
+ */
+export function resolveUserAwsConfigPath(env = process.env) {
+    return env.AWS_CONFIG_FILE ?? path.join(env.HOME ?? "~", ".aws", "config");
+}
+/** True if `dir` can be created (if needed) and written. Used to detect an
+ * unwritable `~/.aws` (e.g. a sandbox with no `~/.aws` grant) without throwing. */
+function canWriteDir(dir) {
+    try {
+        fs.mkdirSync(dir, { recursive: true });
+        fs.accessSync(dir, fs.constants.W_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Where to write the managed AWS profile, with a safehouse fallback. Normally
+ * the user's real `~/.aws/config` (augmented in place, so their other tools see
+ * the profile — hence `redirected: false`, we don't touch their `AWS_CONFIG_FILE`).
+ * But when `~/.aws` is not writable (a sandbox without a `~/.aws` grant), fall
+ * back to a mesh-managed file under `~/.config/mesh` we CAN write, and set
+ * `redirected: true` so the caller also exports `AWS_CONFIG_FILE` (otherwise the
+ * AWS SDK, looking only at `~/.aws/config`, would never find the profile). An
+ * explicit `AWS_CONFIG_FILE` always wins and is never redirected.
+ */
+export function resolveAwsConfigTarget(env = process.env) {
+    if (env.AWS_CONFIG_FILE)
+        return { configPath: env.AWS_CONFIG_FILE, redirected: false };
+    const real = path.join(env.HOME ?? "~", ".aws", "config");
+    if (canWriteDir(path.dirname(real)))
+        return { configPath: real, redirected: false };
+    return { configPath: path.join(CONFIG_DIR, "aws-config"), redirected: true };
+}
+/**
+ * Resolve which IAM role ARN to use, honoring the same precedence in both
+ * `--export` and `--credential-process`: explicit `--role` wins, then
+ * `MESH_AWS_ROLE`, then the context's cached `defaultRole`. Pure aside from
+ * reading `process.env.MESH_AWS_ROLE` — returns an explanatory error instead
+ * of throwing so callers can route it to stderr and exit non-zero.
+ *
+ * Exported for unit testing.
+ */
+export function resolveRoleOrExplain(opts, config) {
+    const role = opts.role ?? process.env.MESH_AWS_ROLE ?? config.defaultRole;
+    if (!role) {
+        return {
+            error: "No IAM role available: pass --role <arn>, set MESH_AWS_ROLE, or run " +
+                "`mesh login <context> --export --role <arn>` once to cache a default role for this context.",
+        };
+    }
+    return { role };
+}
+/**
+ * Ensure a valid Zitadel ID token is cached for the given context — refreshing
+ * or running the full login flow as needed. Returns null on failure.
+ */
+async function ensureValidToken(context, config, opts) {
+    let token = await getValidToken(context);
+    if (token)
+        return token;
+    logInfo(`No valid Zitadel session for ${context} — running login flow`);
+    try {
+        const useDevice = opts.device || isRemoteEnvironment();
+        if (useDevice) {
+            logInfo("Using device code flow");
+            await deviceCodeLogin(context, config);
+        }
+        else {
+            await login(context, config);
+        }
+    }
+    catch (err) {
+        logError(`Login failed: ${err.message}`);
+        return null;
+    }
+    return await getValidToken(context);
+}
+/**
+ * Ensure a valid login session for `context`, running the login flow (device
+ * code in remote/non-TTY, browser callback otherwise) if none is cached. Returns
+ * the cached credentials, or null if no config is available to log in with.
+ *
+ * For use by other commands (e.g. `secrets set`, the AWS-cred resolver) so they
+ * can trigger login on demand instead of just failing with guidance.
+ */
+export async function ensureLogin(context, opts = {}) {
+    const existing = readCredentials(context);
+    if (existing && new Date(existing.expiresAt) > new Date())
+        return existing;
+    // interactive: false → cached-session-or-nothing. Callers with their own
+    // fallback chain (e.g. the AWS-cred resolver's SSO path) use this so an
+    // expired cache doesn't stall headless runs in a device-code poll.
+    if (opts.interactive === false)
+        return null;
+    // Same guarded discovery chain as the `login` command: SSM first, and the
+    // well-known HTTPS endpoint only for domain-looking contexts (≥2 dots).
+    // Hitting `https://cli.<short-name>/.well-known/mesh.json` for an uncached
+    // context like "mesh.dev" would let whoever registers that domain seed our
+    // cached issuer/clientId (login phishing).
+    const config = getContextConfig(context) ?? (await discoverConfigGuarded(context));
+    if (!config) {
+        logWarn(`No login config for "${context}". Run: mesh login ${context}`);
+        return null;
+    }
+    const token = await ensureValidToken(context, config, opts);
+    if (!token)
+        return null;
+    return readCredentials(context);
+}
+/**
+ * The one discovery chain, used by both the `login` command and `ensureLogin`:
+ *
+ *   1. SSM, when the context parses as `{tenant}.{env}` — the primary path for
+ *      internal users who already have AWS SSO access.
+ *   2. The anonymous HTTPS well-known endpoint at the PINNED domain for a known
+ *      first-party short context (`mesh.dev` → `dev.platform.meshtech.io`). This
+ *      is what makes `mesh login mesh.dev` work on a laptop with no AWS at all
+ *      — the P0 case. The domain comes from a compiled-in table, never from the
+ *      context string, so it is not a phishing surface.
+ *   3. The anonymous HTTPS endpoint at the context itself, only when it looks
+ *      like a real domain (≥2 dots).
+ *
+ * Never hits `https://cli.<short-name>/…` for an UNKNOWN short context — that
+ * guard is the anti-phishing property and step 2 is deliberately a pinned
+ * allow-list rather than a relaxation of it.
+ */
+async function discoverConfigGuarded(context) {
+    let config = null;
+    if (parseTenantEnv(context)) {
+        config = await discoverConfigFromSsm(context);
+    }
+    if (!config) {
+        const pinned = firstPartyDomainFor(context);
+        if (pinned) {
+            logInfo(`"${context}" is a known Mesh platform — resolving via ${pinned} (no AWS needed)`);
+            config = await discoverConfig(pinned, context);
+        }
+    }
+    if (!config && context.split(".").length - 1 >= 2) {
+        config = await discoverConfig(context);
+    }
+    return config;
+}
+/**
+ * Resolve AWS credentials via Zitadel JWT → AssumeRoleWithWebIdentity, then
+ * print them as `export` statements on stdout. All status/error output goes
+ * to stderr so the caller can safely `eval "$(mesh login ... --export ...)"`.
+ */
+async function exportAwsCredentials(context, config, opts) {
+    const token = await ensureValidToken(context, config, opts);
+    if (!token) {
+        process.exit(1);
+    }
+    // Pick a role for the caller. `resolveRoleOrExplain` handles the
+    // --role / MESH_AWS_ROLE / cached-defaultRole precedence (shared with
+    // --credential-process); on top of that, when we fell back to the cached
+    // default we ask `selectRoleForCaller` to upgrade to the context's
+    // `adminRole` when the Zitadel JWT carries an admin claim.
+    const resolvedRole = resolveRoleOrExplain(opts, config);
+    if ("error" in resolvedRole) {
+        logError("--export requires --role <arn> (or MESH_AWS_ROLE env var, or a cached defaultRole).\n" +
+            "  Example: mesh login mesh.dev --export --role arn:aws:iam::123456789012:role/mesh-developer\n" +
+            "  After the first run, the role is saved to ~/.config/mesh/config.json and --role can be omitted.");
+        process.exit(1);
+    }
+    let roleArn = resolvedRole.role;
+    if (!opts.role && !process.env.MESH_AWS_ROLE && config.defaultRole) {
+        roleArn = selectRoleForCaller(token, {
+            defaultRole: config.defaultRole,
+            adminRole: config.adminRole,
+            adminClaimRoles: config.adminClaimRoles,
+        });
+    }
+    if (config.adminRole && roleArn === config.adminRole && !opts.role) {
+        logInfo(`Caller has admin Zitadel role — assuming ${roleArn.split("/").pop()} (admin variant)`);
+    }
+    // Persist --role so subsequent runs can omit it.
+    if (opts.role && opts.role !== config.defaultRole) {
+        writeContextConfig(context, { ...config, defaultRole: opts.role });
+        logInfo(`Saved default role for ${context}`);
+    }
+    const region = opts.region ??
+        process.env.AWS_REGION ??
+        process.env.AWS_DEFAULT_REGION ??
+        "us-east-2";
+    const roleName = roleArn.split("/").pop() ?? roleArn;
+    // --static: resolve a frozen STS triple now (the old behavior). Consumers
+    // that need raw credentials (no `mesh` binary on refresh) opt into this.
+    if (opts.static) {
+        const creds = readCredentials(context);
+        const sessionName = (creds?.email ?? "mesh-cli-export")
+            .replace(/[^a-zA-Z0-9=,.@-]/g, "_")
+            .slice(0, 64);
+        const env = await assumeRoleWithWebIdentity(roleArn, token, sessionName);
+        if (!env) {
+            logError(describeAssumeFailure({ roleArn, context, issuer: tokenIssuer(token) }));
+            process.exit(1);
+        }
+        const accessKey = env.AWS_ACCESS_KEY_ID;
+        const secretKey = env.AWS_SECRET_ACCESS_KEY;
+        const sessionToken = env.AWS_SESSION_TOKEN;
+        if (!accessKey || !secretKey || !sessionToken) {
+            logError("AWS STS returned incomplete credentials");
+            process.exit(1);
+        }
+        process.stdout.write(renderExportStaticLines({ accessKey, secretKey, sessionToken, region }));
+        logSuccess(`Exported static AWS credentials for ${roleName} in ${region}`);
+        return;
+    }
+    // Default: manage a `[profile mesh-<context>]` block inside the user's REAL
+    // AWS config file ($AWS_CONFIG_FILE if they set one, else ~/.aws/config) as
+    // an idempotent marker-delimited section — the same file `aws configure sso`
+    // manages — and export only AWS_PROFILE. The profile's `credential_process`
+    // re-invokes `mesh login … --credential-process`, so `eval`-ed shells
+    // auto-refresh instead of dying ~1h in. We must NOT export AWS_CONFIG_FILE
+    // pointing at a mesh-private file: that hides ~/.aws/config from the whole
+    // shell and breaks the user's other profiles (e.g. AWS_PROFILE=mesh-dev).
+    const meshBin = resolveStableMeshBin(process.argv[1]);
+    const sanitized = context.replace(/[^A-Za-z0-9_-]/g, "-");
+    const profileName = `mesh-${sanitized}`;
+    // Safehouse-friendly: falls back to a mesh-managed config when ~/.aws is not
+    // writable (and then `redirected` tells us to export AWS_CONFIG_FILE too).
+    const { configPath, redirected } = resolveAwsConfigTarget();
+    fs.mkdirSync(path.dirname(configPath), { recursive: true });
+    // Read → build → atomic-write back-to-back (all sync) so the lost-update
+    // window against concurrent writers (another `mesh login --export`, the
+    // user's own editor, `aws configure`) is as small as possible; the temp+
+    // rename write means concurrent READERS never observe a truncated file.
+    const existedBefore = fs.existsSync(configPath);
+    const existing = existedBefore ? fs.readFileSync(configPath, "utf-8") : "";
+    // Preserve the user's existing mode (rename replaces the inode, so the
+    // temp file's mode wins) — never chmod their config out from under them.
+    // Restrict to 0600 only when WE create the file.
+    const mode = existedBefore ? fs.statSync(configPath).mode & 0o777 : 0o600;
+    atomicWriteFileSync(configPath, upsertManagedAwsConfigSection(existing, context, renderCredentialProcessProfile({
+        profileName,
+        context,
+        roleArn,
+        region,
+        meshBin,
+    })), mode);
+    process.stdout.write(renderExportProfileLines({ profileName, region }));
+    // When we redirected away from an unwritable ~/.aws, the profile lives in a
+    // mesh-managed file — export AWS_CONFIG_FILE so the AWS SDK finds it.
+    if (redirected) {
+        process.stdout.write(`export AWS_CONFIG_FILE=${shellSingleQuote(configPath)}\n`);
+    }
+    logSuccess(`Exported self-refreshing AWS profile ${profileName} for ${roleName} in ${region} ` +
+        `(managed section in ${configPath})`);
+}
+// =============================================================================
+// AWS credential_process (--credential-process flag)
 // =============================================================================
+/**
+ * Resolve AWS credentials via Zitadel JWT → AssumeRoleWithWebIdentity, then
+ * print them as AWS `credential_process` JSON on stdout — nothing else may
+ * reach stdout in this mode, since the AWS SDK parses it directly. All
+ * status/error output goes to stderr.
+ *
+ * Unlike `--export`, this does NOT run an interactive login flow when no
+ * session is cached (there's no terminal/browser to drive it from a child
+ * process) — it only refreshes an existing session via its refresh token
+ * (`getValidToken`). Callers must `mesh login <context>` at least once.
+ */
+async function credentialProcessAwsCredentials(context, config, opts) {
+    const token = await getValidToken(context);
+    if (!token) {
+        logError(`No valid Zitadel session for ${context} (missing, expired, or refresh failed). Run: mesh login ${context}`);
+        process.exit(1);
+    }
+    const resolvedRole = resolveRoleOrExplain(opts, config);
+    if ("error" in resolvedRole) {
+        logError(resolvedRole.error);
+        process.exit(1);
+    }
+    const creds = readCredentials(context);
+    const sessionName = (creds?.email ?? "mesh-cli-credential-process")
+        .replace(/[^a-zA-Z0-9=,.@-]/g, "_")
+        .slice(0, 64);
+    const stsCreds = await assumeRoleCredentials(resolvedRole.role, token, sessionName);
+    if (!stsCreds) {
+        logError(describeAssumeFailure({
+            roleArn: resolvedRole.role,
+            context,
+            issuer: tokenIssuer(token),
+        }));
+        process.exit(1);
+    }
+    process.stdout.write(toCredentialProcessJson(stsCreds) + "\n");
+}
 export { CONFIG_DIR, CONFIG_FILE, CREDENTIALS_FILE };
-export { readCredentials, readAllCredentials, getContextConfig, decodeJwtPayload };
+/** Every cached context config, keyed by context name. */
+export function readAllContextConfigs() {
+    return readConfig();
+}
+/**
+ * The discovery chain on its own, without the browser flow that follows it.
+ *
+ * Exported so the clean-laptop bootstrap — SSM → pinned first-party alias →
+ * full-domain, and the anti-phishing refusal for an unknown short context — can
+ * be exercised end-to-end against the live well-known endpoint. The `login`
+ * command's own path is otherwise only reachable by completing an interactive
+ * sign-in, which is why this leg had no coverage above the unit tier.
+ */
+export async function discoverConfigForContext(context) {
+    return getContextConfig(context) ?? (await discoverConfigGuarded(context));
+}
+export { readCredentials, readAllCredentials, getContextConfig, decodeJwtPayload, getValidToken };
 //# sourceMappingURL=login.js.map