@basein/runner 0.2.11 → 0.3.0

package/dist/auth/client.d.ts

@@ -62,8 +62,25 @@ export interface AuthSession {
 export interface AuthenticateOptions {
     /** Base URL of the auth service. Defaults to BIR_AUTH_URL. */
     authUrl?: string;
+    /**
+     * When the access token has expired and the refresh gets *no answer* (the
+     * service is down, blackholed, or answering 5xx) — as opposed to refusing
+     * the refresh token — return the expired session anyway.
+     *
+     * For a long-lived recorder: without it, a service outage at the moment a
+     * recorder starts disables recording for the recorder's whole life (days),
+     * although the refresh token is fine. `RemoteRecorder` renews the session in
+     * the background once the service answers. Not for the CLI, where "signed
+     * in" must mean a working token.
+     */
+    keepStaleOnNoAnswer?: boolean;
+}
+/** A non-2xx answer from the service, with its status. */
+export declare class AuthHttpError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
 }
-interface AuthResponse {
+export interface AuthResponse {
     accessToken: string;
     refreshToken: string;
     /** Access token lifetime in seconds. */
@@ -81,10 +98,32 @@ interface AuthResponse {
 export declare function credentialsPath(): string;
 /** Load the cached session, or undefined if missing/unreadable/malformed. */
 export declare function loadCredentials(): AuthSession | undefined;
-/** Persist the session with mode 0600. */
+/**
+ * Persist the session with mode 0600.
+ *
+ * Atomically: every sibling process (`bir-hooks`, each `bir-proxy`, the CLI)
+ * reads this file while others write it, and a truncate-then-write left a
+ * window in which a reader saw an empty file — "no session" — and ran signed
+ * out for its whole life. Worse, a crash in that window after a rotating
+ * refresh left the only valid refresh token nowhere.
+ */
 export declare function saveCredentials(session: AuthSession): void;
 /** Remove the cached session (`bir logout`). No-op if absent. */
 export declare function clearCredentials(): void;
+/**
+ * Is `body` a usable sign-in or refresh answer? A 200 of some other shape — a
+ * proxy's JSON error, a newer service's envelope — must never be saved: the
+ * next process would load `accessToken: undefined`, call the file corrupt, and
+ * the refresh token that was just rotated would be lost with it.
+ */
+export declare function isAuthResponse(body: unknown): body is AuthResponse;
+/**
+ * True when a cached session may be used against `authUrl`. Exported so the
+ * recorder applies the same rule when it adopts a session a sibling wrote.
+ */
+export declare function issuedFor(session: AuthSession, authUrl: string): boolean;
+/** One bounded line about a body that was not the API's: never a whole page. */
+export declare function describeBody(text: string, contentType?: string): string;
 /** The persisted settings in ~/.baseinstrunner/config.json. */
 export interface StoredConfig {
     /** The service address 'bir setup' or 'bir login' last signed in against. */
@@ -215,6 +254,25 @@ export interface PollOptions {
  * *stay* longer afterwards. Ignoring it turns a slow client into a blocked one.
  */
 export declare function pollDeviceToken(authUrl: string, deviceCode: string, opts: PollOptions): Promise<AuthResponse>;
+/**
+ * The link to open for a sign-in, or undefined when it must not be opened.
+ *
+ * It comes from the service's answer, so it is checked before anything hands
+ * it to the operating system: an `https:` URL (plain `http:` only when the
+ * service itself is `http:`, a loopback test server), never `file:` or any
+ * other scheme a URL handler would run. Returned normalised, which
+ * percent-encodes spaces and quotes.
+ */
+export declare function browserSafeLink(link: string, authUrl: string): string | undefined;
+/**
+ * The argument vector that opens `url` in the browser on `platform`.
+ *
+ * Never a shell. On Windows that rules out `cmd /c start`: cmd.exe parses the
+ * whole line itself, so an `&` in a link a service sent ran whatever followed
+ * it as a second command. `rundll32 url.dll,FileProtocolHandler <url>` hands
+ * the URL to the default browser as one argument, with nothing in between.
+ */
+export declare function browserCommand(url: string, platform?: NodeJS.Platform): [string, string[]];
 /**
  * Open a URL in the user's browser. Best effort, and never fatal.
  *
@@ -269,7 +327,11 @@ export declare function legacyPasswordLogin(authUrl: string): Promise<AuthSessio
  * `bir logout` a tidy-up rather than a revocation. The endpoint is idempotent
  * and its failure is not worth blocking on — the local half must happen either
  * way, or "logged out" would be a lie on a machine with no network.
+ *
+ * LOCAL FIRST. The file goes before the network call, so a hung service or a
+ * Ctrl-C during the revoke can never leave the machine signed in; running
+ * recorders notice the missing file within seconds and stop sending. The
+ * revoke itself is bounded to {@link LOGOUT_TIMEOUT_MS}.
  */
 export declare function logout(authUrl?: string): Promise<void>;
-export {};
 //# sourceMappingURL=client.d.ts.map

package/dist/auth/client.js

@@ -40,12 +40,23 @@
  */
 import { spawn } from "node:child_process";
 import { createInterface } from "node:readline";
-import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync } from "node:fs";
 import { hostname } from "node:os";
 import { configDir, configPath, ensureDir } from "../control/paths.js";
 import { join } from "node:path";
 import { logLine, errText } from "../util/log.js";
 import { packageVersion } from "../util/version.js";
+import { writeFileAtomic } from "../util/atomic-write.js";
+import { isUnhealthyStatus, serviceHealth, serviceTimeoutMs, timeoutSignal } from "../util/service-health.js";
+/** A non-2xx answer from the service, with its status. */
+export class AuthHttpError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = "AuthHttpError";
+    }
+}
 /**
  * Where the cached session lives.
  *
@@ -86,12 +97,31 @@ export function loadCredentials() {
     }
     return undefined;
 }
-/** Persist the session with mode 0600. */
+/**
+ * Persist the session with mode 0600.
+ *
+ * Atomically: every sibling process (`bir-hooks`, each `bir-proxy`, the CLI)
+ * reads this file while others write it, and a truncate-then-write left a
+ * window in which a reader saw an empty file — "no session" — and ran signed
+ * out for its whole life. Worse, a crash in that window after a rotating
+ * refresh left the only valid refresh token nowhere.
+ */
 export function saveCredentials(session) {
     const dir = configDir();
     if (!existsSync(dir))
         mkdirSync(dir, { recursive: true, mode: 0o700 });
-    writeFileSync(credentialsPath(), JSON.stringify(session, null, 2), { mode: 0o600 });
+    const path = credentialsPath();
+    writeFileAtomic(path, JSON.stringify(session, null, 2), { mode: 0o600 });
+    // writeFileAtomic keeps an existing file's mode; a session file is private
+    // whatever mode an older version (or a hand edit) left it with.
+    if (process.platform !== "win32") {
+        try {
+            chmodSync(path, 0o600);
+        }
+        catch {
+            /* best effort */
+        }
+    }
 }
 /** Remove the cached session (`bir logout`). No-op if absent. */
 export function clearCredentials() {
@@ -106,7 +136,31 @@ export function clearCredentials() {
 function isAccessValid(session) {
     return session.accessExpiresAt - EXPIRY_SKEW_MS > Date.now();
 }
+/**
+ * Is `body` a usable sign-in or refresh answer? A 200 of some other shape — a
+ * proxy's JSON error, a newer service's envelope — must never be saved: the
+ * next process would load `accessToken: undefined`, call the file corrupt, and
+ * the refresh token that was just rotated would be lost with it.
+ */
+export function isAuthResponse(body) {
+    const r = body;
+    return (!!r &&
+        typeof r === "object" &&
+        typeof r.accessToken === "string" &&
+        r.accessToken.length > 0 &&
+        typeof r.refreshToken === "string" &&
+        r.refreshToken.length > 0 &&
+        typeof r.expiresIn === "number" &&
+        Number.isFinite(r.expiresIn) &&
+        r.expiresIn > 0 &&
+        !!r.user &&
+        typeof r.user === "object" &&
+        typeof r.user.id === "string");
+}
 function toSession(res, authUrl) {
+    if (!isAuthResponse(res)) {
+        throw new Error("the service answered sign-in with an unexpected body — nothing was saved");
+    }
     return {
         accessToken: res.accessToken,
         refreshToken: res.refreshToken,
@@ -115,11 +169,53 @@ function toSession(res, authUrl) {
         ...(authUrl ? { authUrl: authUrl.replace(/\/+$/, "") } : {}),
     };
 }
-/** True when a cached session may be used against `authUrl`. */
-function issuedFor(session, authUrl) {
+/**
+ * True when a cached session may be used against `authUrl`. Exported so the
+ * recorder applies the same rule when it adopts a session a sibling wrote.
+ */
+export function issuedFor(session, authUrl) {
     if (!session.authUrl)
         return true; // pre-binding file: trusted as before
-    return session.authUrl === authUrl.replace(/\/+$/, "");
+    return session.authUrl.replace(/\/+$/, "") === authUrl.replace(/\/+$/, "");
+}
+/**
+ * Report one answer from the service to the process-wide health verdict, with
+ * the serviceHealth.stamp() its request was sent at: a late answer to a
+ * request a hook already gave up on does not end that cool-down.
+ */
+function reportAnswer(res, startedAt) {
+    if (isUnhealthyStatus(res.status))
+        serviceHealth.fail(`HTTP ${res.status}`);
+    else
+        serviceHealth.ok(startedAt);
+}
+/**
+ * Report a request that got no answer. A caller's own abort (Ctrl-C) says
+ * nothing about the service, so it is not counted.
+ */
+function reportNoAnswer(err, callerSignal) {
+    if (callerSignal?.aborted)
+        return;
+    serviceHealth.fail(causeText(err));
+}
+/**
+ * A body that is a web page rather than the API's answer. Judged by the body:
+ * a framework's `res.send("ok")` is `text/html` too, and that is not a portal.
+ */
+function isWebPage(text, contentType) {
+    if (/^\s*<(!doctype|html|head|body)\b/i.test(text))
+        return true;
+    return contentType.toLowerCase().includes("html") && /^\s*</.test(text);
+}
+/** One bounded line about a body that was not the API's: never a whole page. */
+export function describeBody(text, contentType = "") {
+    if (!text)
+        return "";
+    if (contentType.toLowerCase().includes("html") || /^\s*<(!doctype|html|head|body)/i.test(text)) {
+        return "a web page, not JSON";
+    }
+    const flat = text.replace(/\s+/g, " ").trim();
+    return flat.length > 200 ? `${flat.slice(0, 200)}…` : flat;
 }
 /** Read the stored settings; an absent or unreadable file is an empty one. */
 export function loadStoredConfig() {
@@ -137,7 +233,8 @@ export function loadStoredConfig() {
 export function saveStoredConfig(patch) {
     const next = { ...loadStoredConfig(), ...patch };
     ensureDir(configDir());
-    writeFileSync(configPath(), JSON.stringify(next, null, 2) + "\n", { mode: 0o600 });
+    // Atomic for the same reason as the credentials: every process reads it.
+    writeFileAtomic(configPath(), JSON.stringify(next, null, 2) + "\n", { mode: 0o600 });
     return next;
 }
 /**
@@ -197,12 +294,26 @@ export async function normalizeAuthUrl(baseUrl, fetchImpl = fetch) {
     if (!base)
         return base;
     let res;
+    const started = serviceHealth.stamp();
     try {
-        res = await fetchImpl(`${base}/health`, { method: "GET", redirect: "manual" });
+        // Bounded: this runs before the recorder listens and before `bir logout`
+        // clears anything. Unbounded, a blackholed host cost the OS connect
+        // timeout (10-20 s) and a host that accepts and never answers cost 300 s.
+        res = await fetchImpl(`${base}/health`, {
+            method: "GET",
+            redirect: "manual",
+            signal: timeoutSignal(PROBE_TIMEOUT_MS),
+        });
     }
-    catch {
-        return base; // unreachable is the caller's problem, not ours to diagnose here
+    catch (err) {
+        // Unreachable is the caller's problem, not ours to diagnose here — but it
+        // is the health verdict's: the recorder that starts next should not make
+        // its first hooks wait on a service that just failed to answer.
+        reportNoAnswer(err);
+        return base;
     }
+    reportAnswer(res, started);
+    res.body?.cancel().catch(() => undefined);
     if (res.status < 300 || res.status >= 400)
         return base;
     const location = res.headers.get("location");
@@ -267,6 +378,9 @@ export async function describeAuthService(baseUrl, fetchImpl = fetch) {
     const base = baseUrl.replace(/\/+$/, "");
     if (!base)
         return "no URL configured";
+    // Not reported to the health verdict, unlike every other request here: this
+    // is asked of *candidate* addresses (a website someone pasted, a typo), and
+    // their failure says nothing about the service the runner actually uses.
     let res;
     try {
         res = await fetchImpl(`${base}/health`, {
@@ -341,30 +455,63 @@ function promptPassword(question) {
     });
 }
 async function postJson(url, body) {
-    const res = await fetch(url, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify(body),
-    });
+    let res;
+    const started = serviceHealth.stamp();
+    try {
+        // Bounded (BIR_SERVICE_TIMEOUT_MS): `authenticate()` runs this at the
+        // start of every recorder and proxy, and a hung service must cost those
+        // seconds, not minutes.
+        res = await fetch(url, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify(body),
+            signal: timeoutSignal(serviceTimeoutMs()),
+        });
+    }
+    catch (err) {
+        reportNoAnswer(err);
+        throw err;
+    }
+    const type = res.headers.get("content-type") ?? "";
+    const text = await res.text().catch(() => "");
+    const isHtml = type.toLowerCase().includes("html") || /^\s*<(!doctype|html)/i.test(text);
     if (!res.ok) {
-        const text = await res.text().catch(() => "");
-        const isHtml = (res.headers.get("content-type") ?? "").includes("html") || /^\s*<(!doctype|html)/i.test(text);
+        reportAnswer(res, started);
         const detail = isHtml
             ? " — the answer was a web page, not JSON: this URL is a website, not the BaseIn API"
             : text
-                ? ` — ${text.length > 300 ? `${text.slice(0, 300)}…` : text}`
+                ? ` — ${describeBody(text, type)}`
                 : "";
-        throw new Error(`HTTP ${res.status} ${res.statusText}${detail}`);
+        throw new AuthHttpError(`HTTP ${res.status} ${res.statusText}${detail}`, res.status);
+    }
+    if (isHtml) {
+        // A 200 web page is a captive portal or a website, not the API answering.
+        serviceHealth.fail("html");
+        throw new Error(`HTTP ${res.status} — the answer was a web page, not JSON: this URL is a website, not the BaseIn API`);
+    }
+    serviceHealth.ok(started);
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new Error(`HTTP ${res.status} — the answer was not JSON`);
     }
-    return (await res.json());
 }
-/** Exchange a refresh token for a new session. Undefined on failure. */
+/**
+ * Exchange a refresh token for a new session. `rejected` says the service
+ * answered and refused (a 4xx), as opposed to not answering usefully.
+ */
 async function tryRefresh(authUrl, refreshToken) {
     try {
-        return toSession(await postJson(`${authUrl}/auth/refresh`, { refreshToken }), authUrl);
+        return {
+            session: toSession(await postJson(`${authUrl}/auth/refresh`, { refreshToken }), authUrl),
+            rejected: false,
+        };
     }
-    catch {
-        return undefined;
+    catch (err) {
+        logLine("auth.refresh_failed", { error: errText(err), why: "the session could not be renewed" });
+        const rejected = err instanceof AuthHttpError && err.status >= 400 && !isUnhealthyStatus(err.status);
+        return { rejected };
     }
 }
 /**
@@ -402,9 +549,24 @@ export async function authenticate(opts) {
     if (cached && isAccessValid(cached))
         return cached;
     if (cached?.refreshToken) {
-        const refreshed = await tryRefresh(authUrl, cached.refreshToken);
+        const { session: refreshed, rejected } = await tryRefresh(authUrl, cached.refreshToken);
+        if (!refreshed && !rejected && opts?.keepStaleOnNoAnswer) {
+            logLine("auth.refresh_deferred", {
+                why: "the service did not answer the refresh — starting with the expired session; it is renewed once the service is back",
+            });
+            return cached;
+        }
         if (refreshed) {
-            saveCredentials(refreshed);
+            try {
+                saveCredentials(refreshed);
+            }
+            catch (err) {
+                // The service has already rotated the refresh token, so the one on
+                // disk is dead either way. Throwing here would also lose the new one
+                // and kill the recorder at start; returning it keeps this process
+                // recording, and the next save (a later refresh) repairs the file.
+                logLine("auth.save_failed", { error: errText(err), why: "the new session still works in this process" });
+            }
             return refreshed;
         }
     }
@@ -438,11 +600,20 @@ export class DeviceFlowUnsupported extends Error {
  * flow has against being talked into approving a stranger's code.
  */
 export async function startDeviceCode(authUrl, client, fetchImpl = fetch) {
-    const res = await fetchImpl(`${authUrl}/auth/device/code`, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ clientName: client.name, clientVersion: client.version }),
-    });
+    let res;
+    try {
+        res = await fetchImpl(`${authUrl}/auth/device/code`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ clientName: client.name, clientVersion: client.version }),
+            signal: timeoutSignal(serviceTimeoutMs()),
+        });
+    }
+    catch (err) {
+        reportNoAnswer(err);
+        throw err;
+    }
+    reportAnswer(res);
     // A service without the endpoint 404s. Anything else is a real failure.
     if (res.status === 404)
         throw new DeviceFlowUnsupported();
@@ -480,6 +651,7 @@ export async function pollDeviceToken(authUrl, deviceCode, opts) {
     const now = opts.now ?? Date.now;
     const deadline = now() + opts.expiresIn * 1000;
     let interval = opts.interval;
+    let networkFailures = 0;
     for (;;) {
         if (opts.signal?.aborted) {
             throw new DeviceFlowAborted("sign-in cancelled", "cancelled");
@@ -488,11 +660,30 @@ export async function pollDeviceToken(authUrl, deviceCode, opts) {
             throw new DeviceFlowAborted("the code expired before it was approved — run `bir login` again", "timeout");
         }
         await sleep(interval * 1000);
-        const res = await fetchImpl(`${authUrl}/auth/device/token`, {
-            method: "POST",
-            headers: { "content-type": "application/json" },
-            body: JSON.stringify({ deviceCode }),
-        });
+        let res;
+        try {
+            // Each poll is bounded, and follows the caller's signal so Ctrl-C stops
+            // the request in flight rather than after the service answers it.
+            res = await fetchImpl(`${authUrl}/auth/device/token`, {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({ deviceCode }),
+                signal: timeoutSignal(serviceTimeoutMs(), opts.signal),
+            });
+        }
+        catch (err) {
+            if (opts.signal?.aborted)
+                throw new DeviceFlowAborted("sign-in cancelled", "cancelled");
+            reportNoAnswer(err, opts.signal);
+            // A blip in a wait that can last minutes is not worth losing the code
+            // over; a service that stays unreachable is.
+            networkFailures += 1;
+            if (networkFailures >= 3)
+                throw err;
+            continue;
+        }
+        reportAnswer(res);
+        networkFailures = 0;
         if (res.ok)
             return (await res.json());
         const body = (await res.json().catch(() => ({})));
@@ -513,6 +704,48 @@ export async function pollDeviceToken(authUrl, deviceCode, opts) {
         }
     }
 }
+/**
+ * The link to open for a sign-in, or undefined when it must not be opened.
+ *
+ * It comes from the service's answer, so it is checked before anything hands
+ * it to the operating system: an `https:` URL (plain `http:` only when the
+ * service itself is `http:`, a loopback test server), never `file:` or any
+ * other scheme a URL handler would run. Returned normalised, which
+ * percent-encodes spaces and quotes.
+ */
+export function browserSafeLink(link, authUrl) {
+    try {
+        const url = new URL(link);
+        let serviceProtocol = "https:";
+        try {
+            serviceProtocol = new URL(authUrl).protocol;
+        }
+        catch {
+            /* no service URL to compare with: https only */
+        }
+        if (url.protocol === "https:" || (url.protocol === "http:" && serviceProtocol === "http:"))
+            return url.href;
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The argument vector that opens `url` in the browser on `platform`.
+ *
+ * Never a shell. On Windows that rules out `cmd /c start`: cmd.exe parses the
+ * whole line itself, so an `&` in a link a service sent ran whatever followed
+ * it as a second command. `rundll32 url.dll,FileProtocolHandler <url>` hands
+ * the URL to the default browser as one argument, with nothing in between.
+ */
+export function browserCommand(url, platform = process.platform) {
+    if (platform === "win32")
+        return ["rundll32", ["url.dll,FileProtocolHandler", url]];
+    if (platform === "darwin")
+        return ["open", [url]];
+    return ["xdg-open", [url]];
+}
 /**
  * Open a URL in the user's browser. Best effort, and never fatal.
  *
@@ -522,14 +755,9 @@ export async function pollDeviceToken(authUrl, deviceCode, opts) {
  */
 export function openBrowser(url) {
     try {
-        const [command, args] = process.platform === "win32"
-            ? // The empty string is `start`'s title argument. Without it, a quoted
-                // URL is taken *as* the title and nothing opens.
-                ["cmd", ["/c", "start", "", url]]
-            : process.platform === "darwin"
-                ? ["open", [url]]
-                : ["xdg-open", [url]];
-        const child = spawn(command, [...args], { detached: true, stdio: "ignore" });
+        const [command, args] = browserCommand(url);
+        // No windowsHide: rundll32 passes its show state on to the browser it starts.
+        const child = spawn(command, args, { detached: true, stdio: "ignore" });
         child.on("error", () => {
             /* no browser here; the printed link is the fallback */
         });
@@ -565,9 +793,13 @@ export async function deviceLogin(authUrl, opts = {}) {
     write(`  Open   ${link}\n`);
     write(`  Code   ${grant.userCode}\n\n`);
     const wantsBrowser = opts.openBrowser ?? shouldOpenBrowser();
-    if (wantsBrowser) {
+    const safe = browserSafeLink(link, authUrl);
+    if (wantsBrowser && !safe) {
+        write("  Not opening that link: it is not an https address. Check it before you open it yourself.\n");
+    }
+    else if (wantsBrowser && safe) {
         write("  Opening your browser…\n");
-        openBrowser(link);
+        openBrowser(safe);
     }
     else {
         write("  Open that link on any device — a phone is fine.\n");
@@ -596,11 +828,20 @@ export async function deviceLogin(authUrl, opts = {}) {
  */
 export async function tokenLogin(authUrl, token, opts = {}) {
     const fetchImpl = opts.fetchImpl ?? fetch;
-    const res = await fetchImpl(`${authUrl}/auth/device/token`, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ deviceCode: token.trim() }),
-    });
+    let res;
+    try {
+        res = await fetchImpl(`${authUrl}/auth/device/token`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ deviceCode: token.trim() }),
+            signal: timeoutSignal(serviceTimeoutMs()),
+        });
+    }
+    catch (err) {
+        reportNoAnswer(err);
+        throw err;
+    }
+    reportAnswer(res);
     if (res.status === 404)
         throw new DeviceFlowUnsupported();
     if (res.ok) {
@@ -688,24 +929,35 @@ export async function legacyPasswordLogin(authUrl) {
  * `bir logout` a tidy-up rather than a revocation. The endpoint is idempotent
  * and its failure is not worth blocking on — the local half must happen either
  * way, or "logged out" would be a lie on a machine with no network.
+ *
+ * LOCAL FIRST. The file goes before the network call, so a hung service or a
+ * Ctrl-C during the revoke can never leave the machine signed in; running
+ * recorders notice the missing file within seconds and stop sending. The
+ * revoke itself is bounded to {@link LOGOUT_TIMEOUT_MS}.
  */
 export async function logout(authUrl) {
     const cached = loadCredentials();
+    clearCredentials();
     if (authUrl && cached?.refreshToken) {
         try {
-            await fetch(`${authUrl}/auth/logout`, {
+            const res = await fetch(`${authUrl}/auth/logout`, {
                 method: "POST",
                 headers: { "content-type": "application/json" },
                 body: JSON.stringify({ refreshToken: cached.refreshToken }),
+                signal: timeoutSignal(LOGOUT_TIMEOUT_MS),
             });
+            reportAnswer(res);
+            res.body?.cancel().catch(() => undefined);
         }
         catch (err) {
+            reportNoAnswer(err);
             logLine("auth.logout_remote_failed", {
                 error: errText(err),
                 why: "the local credentials are cleared regardless",
             });
         }
     }
-    clearCredentials();
 }
+/** How long `bir logout` waits for the service to revoke the refresh token. */
+const LOGOUT_TIMEOUT_MS = 5_000;
 //# sourceMappingURL=client.js.map