@component-compass/cli 0.1.25 → 0.1.27

package/dist/cli.js

@@ -7554,16 +7554,16 @@ var require_parse = __commonJS({
         const analysis = analyzeRepeatedExtglob(body, opts);
         if ((token.type === "plus" || token.type === "star") && analysis.risky) {
           const safeOutput = analysis.safeOutput ? (token.output ? "" : ONE_CHAR) + (opts.capture ? `(${analysis.safeOutput})` : analysis.safeOutput) : void 0;
-          const open = tokens[token.tokensIndex];
-          open.type = "text";
-          open.value = literal;
-          open.output = safeOutput || utils.escapeRegex(literal);
+          const open2 = tokens[token.tokensIndex];
+          open2.type = "text";
+          open2.value = literal;
+          open2.output = safeOutput || utils.escapeRegex(literal);
           for (let i2 = token.tokensIndex + 1; i2 < tokens.length; i2++) {
             tokens[i2].value = "";
             tokens[i2].output = "";
             delete tokens[i2].suffix;
           }
-          state.output = token.output + open.output;
+          state.output = token.output + open2.output;
           state.backtrack = true;
           push({ type: "paren", extglob: true, value, output: "" });
           decrement("parens");
@@ -7783,15 +7783,15 @@ var require_parse = __commonJS({
         }
         if (value === "{" && opts.nobrace !== true) {
           increment("braces");
-          const open = {
+          const open2 = {
             type: "brace",
             value,
             output: "(",
             outputIndex: state.output.length,
             tokensIndex: state.tokens.length
           };
-          braces.push(open);
-          push(open);
+          braces.push(open2);
+          push(open2);
           continue;
         }
         if (value === "}") {
@@ -37172,9 +37172,9 @@ var require_is_glob = __commonJS({
           }
         }
         if (str[index] === "\\") {
-          var open = str[index + 1];
+          var open2 = str[index + 1];
           index += 2;
-          var close = chars2[open];
+          var close = chars2[open2];
           if (close) {
             var n2 = str.indexOf(close, index);
             if (n2 !== -1) {
@@ -37200,9 +37200,9 @@ var require_is_glob = __commonJS({
           return true;
         }
         if (str[index] === "\\") {
-          var open = str[index + 1];
+          var open2 = str[index + 1];
           index += 2;
-          var close = chars2[open];
+          var close = chars2[open2];
           if (close) {
             var n2 = str.indexOf(close, index);
             if (n2 !== -1) {
@@ -38166,7 +38166,7 @@ var require_parse2 = __commonJS({
           continue;
         }
         if (value === CHAR_DOUBLE_QUOTE || value === CHAR_SINGLE_QUOTE || value === CHAR_BACKTICK) {
-          const open = value;
+          const open2 = value;
           let next;
           if (options.keepQuotes !== true) {
             value = "";
@@ -38176,7 +38176,7 @@ var require_parse2 = __commonJS({
               value += next + advance();
               continue;
             }
-            if (next === open) {
+            if (next === open2) {
               if (options.keepQuotes === true) value += next;
               break;
             }
@@ -38219,8 +38219,8 @@ var require_parse2 = __commonJS({
         if (value === CHAR_COMMA && depth > 0) {
           if (block2.ranges > 0) {
             block2.ranges = 0;
-            const open = block2.nodes.shift();
-            block2.nodes = [open, { type: "text", value: stringify2(block2) }];
+            const open2 = block2.nodes.shift();
+            block2.nodes = [open2, { type: "text", value: stringify2(block2) }];
           }
           push({ type: "comma", value });
           block2.commas++;
@@ -39318,16 +39318,16 @@ var require_parse3 = __commonJS({
         const analysis = analyzeRepeatedExtglob(body, opts);
         if ((token.type === "plus" || token.type === "star") && analysis.risky) {
           const safeOutput = analysis.safeOutput ? (token.output ? "" : ONE_CHAR) + (opts.capture ? `(${analysis.safeOutput})` : analysis.safeOutput) : void 0;
-          const open = tokens[token.tokensIndex];
-          open.type = "text";
-          open.value = literal;
-          open.output = safeOutput || utils.escapeRegex(literal);
+          const open2 = tokens[token.tokensIndex];
+          open2.type = "text";
+          open2.value = literal;
+          open2.output = safeOutput || utils.escapeRegex(literal);
           for (let i2 = token.tokensIndex + 1; i2 < tokens.length; i2++) {
             tokens[i2].value = "";
             tokens[i2].output = "";
             delete tokens[i2].suffix;
           }
-          state.output = token.output + open.output;
+          state.output = token.output + open2.output;
           state.backtrack = true;
           push({ type: "paren", extglob: true, value, output: "" });
           decrement("parens");
@@ -39547,15 +39547,15 @@ var require_parse3 = __commonJS({
         }
         if (value === "{" && opts.nobrace !== true) {
           increment("braces");
-          const open = {
+          const open2 = {
             type: "brace",
             value,
             output: "(",
             outputIndex: state.output.length,
             tokensIndex: state.tokens.length
           };
-          braces.push(open);
-          push(open);
+          braces.push(open2);
+          push(open2);
           continue;
         }
         if (value === "}") {
@@ -40350,8 +40350,8 @@ var require_pattern2 = __commonJS({
     }
     exports.endsWithSlashGlobStar = endsWithSlashGlobStar;
     function isAffectDepthOfReadingPattern(pattern) {
-      const basename6 = path5.basename(pattern);
-      return endsWithSlashGlobStar(pattern) || isStaticPattern(basename6);
+      const basename7 = path5.basename(pattern);
+      return endsWithSlashGlobStar(pattern) || isStaticPattern(basename7);
     }
     exports.isAffectDepthOfReadingPattern = isAffectDepthOfReadingPattern;
     function expandPatternsWithBraceExpansion(patterns) {
@@ -40398,7 +40398,7 @@ var require_pattern2 = __commonJS({
       const absolute = [];
       const relative7 = [];
       for (const pattern of patterns) {
-        if (isAbsolute13(pattern)) {
+        if (isAbsolute14(pattern)) {
           absolute.push(pattern);
         } else {
           relative7.push(pattern);
@@ -40407,10 +40407,10 @@ var require_pattern2 = __commonJS({
       return [absolute, relative7];
     }
     exports.partitionAbsoluteAndRelative = partitionAbsoluteAndRelative;
-    function isAbsolute13(pattern) {
+    function isAbsolute14(pattern) {
       return path5.isAbsolute(pattern);
     }
-    exports.isAbsolute = isAbsolute13;
+    exports.isAbsolute = isAbsolute14;
   }
 });
 
@@ -43241,7 +43241,7 @@ async function pollUpload(opts) {
         status = await inspect3().catch(async (err2) => {
           if (!(err2 instanceof UploadError) || err2.code !== 401) throw err2;
           signal.throwIfAborted();
-          token = await opts.refreshToken();
+          token = await opts.onUnauthorized();
           return await inspect3();
         });
       } catch (err2) {
@@ -43267,8 +43267,8 @@ async function pollUpload(opts) {
         }
         hint = status.retryAfterSeconds;
       }
-      const delay = hint !== void 0 ? hint * 1e3 : backoffDelay(attempt);
-      await wait(Math.min(2147483647, Math.max(1e3, delay)), signal);
+      const delay2 = hint !== void 0 ? hint * 1e3 : backoffDelay(attempt);
+      await wait(Math.min(2147483647, Math.max(1e3, delay2)), signal);
     }
   }
   try {
@@ -43282,7 +43282,7 @@ async function pollUpload(opts) {
     controller.abort();
   }
 }
-function wait(delay, signal) {
+function wait(delay2, signal) {
   return new Promise((resolve14, reject) => {
     signal?.throwIfAborted();
     const abort = () => {
@@ -43292,7 +43292,7 @@ function wait(delay, signal) {
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", abort);
       resolve14();
-    }, delay);
+    }, delay2);
     signal?.addEventListener("abort", abort, { once: true });
   });
 }
@@ -43389,8 +43389,10 @@ var init_paths = __esm({
 });
 
 // src/auth/store.ts
-import { mkdir as mkdir2, readFile as readFile4, writeFile as writeFile2, chmod } from "node:fs/promises";
-import { dirname as dirname12 } from "node:path";
+import { mkdir as mkdir2, readFile as readFile4, writeFile as writeFile2, chmod, rename, unlink, open } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { basename as basename5, dirname as dirname12, join as join16 } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
 function normalizeHost(input2) {
   const trimmed = input2.trim();
   if (trimmed === "") throw new Error("Host must not be empty.");
@@ -43411,107 +43413,85 @@ async function loadStore(filePath = hostsFilePath()) {
   } catch {
     throw new Error(`Token store at ${filePath} contains invalid JSON. Delete it and run \`component-compass auth login\` again.`);
   }
-  return { ...parsed.default ? { default: parsed.default } : {}, hosts: parsed.hosts ?? {} };
+  const value = typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : {};
+  const entries = typeof value.hosts === "object" && value.hosts !== null && !Array.isArray(value.hosts) ? Object.entries(value.hosts) : [];
+  const hosts = Object.fromEntries(entries.flatMap(([host, entry]) => {
+    if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return [];
+    const candidate = entry;
+    return typeof candidate.token === "string" && typeof candidate.userEmail === "string" ? [[host, { token: candidate.token, userEmail: candidate.userEmail }]] : [];
+  }));
+  return { ...typeof value.default === "string" && value.default ? { default: value.default } : {}, hosts };
 }
-async function saveStore(store, filePath = hostsFilePath()) {
+async function writeStore(store, filePath) {
   await mkdir2(dirname12(filePath), { recursive: true, mode: 448 });
-  await writeFile2(filePath, `${JSON.stringify(store, null, 2)}
-`, { mode: 384 });
-  await chmod(filePath, 384);
-}
-var init_store = __esm({
-  "src/auth/store.ts"() {
-    "use strict";
-    init_paths();
+  const tempPath = join16(dirname12(filePath), `.${basename5(filePath)}.${randomUUID()}.tmp`);
+  try {
+    await writeFile2(tempPath, `${JSON.stringify(store, null, 2)}
+`, { mode: 384, flag: "wx" });
+    await chmod(tempPath, 384);
+    await rename(tempPath, filePath);
+  } finally {
+    await unlink(tempPath).catch((error2) => {
+      if (error2.code !== "ENOENT") throw error2;
+    });
   }
-});
-
-// src/auth/client.ts
-function endpoint(base2, path5) {
-  return `${base2.replace(/\/+$/, "")}${path5}`;
-}
-async function readError(res) {
-  const body = await res.json().catch(() => ({}));
-  return body.error ?? "unknown_error";
 }
-function toTokenPair(body) {
-  return {
-    accessToken: body.access_token,
-    refreshToken: body.refresh_token,
-    expiresIn: body.expires_in,
-    ...body.email !== void 0 ? { email: body.email } : {}
-  };
-}
-async function requestDeviceCode(base2) {
-  const res = await fetch(endpoint(base2, "/api/auth/cli/device-code"), { method: "POST" });
-  if (!res.ok) throw new AuthHttpError(res.status, `device-code failed: ${await readError(res)}`);
-  const b = await res.json();
-  return {
-    deviceCode: b.device_code,
-    userCode: b.user_code,
-    verificationUri: b.verification_uri,
-    verificationUriComplete: b.verification_uri_complete,
-    expiresIn: b.expires_in,
-    interval: b.interval
-  };
-}
-async function pollToken(base2, deviceCode) {
-  const res = await fetch(endpoint(base2, "/api/auth/cli/token"), {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ device_code: deviceCode })
-  });
-  if (res.ok) {
-    return { kind: "tokens", tokens: toTokenPair(await res.json()) };
-  }
-  const error2 = await readError(res);
-  switch (error2) {
-    case "authorization_pending":
-      return { kind: "pending" };
-    case "slow_down":
-      return { kind: "slow_down" };
-    case "expired_token":
-      return { kind: "expired" };
-    case "access_denied":
-      return { kind: "denied" };
-    default:
-      throw new AuthHttpError(res.status, `token poll failed: ${error2}`);
+async function releaseStoreLock(lockPath, owner) {
+  try {
+    if (await readFile4(lockPath, "utf8") === owner) await unlink(lockPath);
+  } catch (error2) {
+    if (error2.code !== "ENOENT") throw error2;
   }
 }
-async function refreshTokens(base2, refreshToken) {
-  let res;
+async function withStoreLock(filePath, action) {
+  await mkdir2(dirname12(filePath), { recursive: true, mode: 448 });
+  const lockPath = `${filePath}.lock`;
+  const owner = `${process.pid}:${randomUUID()}`;
+  const deadline = Date.now() + LOCK_WAIT_MS;
+  while (true) {
+    if (Date.now() >= deadline) {
+      throw new StoreLockError(`Timed out waiting for credential store lock at ${lockPath}. Retry, or remove it only after confirming no CLI process is running.`);
+    }
+    try {
+      const handle = await open(lockPath, "wx", 384);
+      try {
+        await handle.writeFile(owner);
+        await handle.close();
+      } catch (error2) {
+        await handle.close().catch(() => {
+        });
+        await unlink(lockPath).catch(() => {
+        });
+        throw error2;
+      }
+      break;
+    } catch (error2) {
+      if (error2.code !== "EEXIST") throw error2;
+      await delay(LOCK_POLL_MS);
+    }
+  }
   try {
-    res = await fetch(endpoint(base2, "/api/auth/cli/refresh"), {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ refresh_token: refreshToken })
-    });
-  } catch (err2) {
-    return { kind: "transient", error: err2 instanceof Error ? err2.message : "network_error" };
+    return await action();
+  } finally {
+    await releaseStoreLock(lockPath, owner);
   }
-  if (res.ok) return { kind: "tokens", tokens: toTokenPair(await res.json()) };
-  const error2 = await readError(res);
-  const terminal = res.status === 401 && ["invalid_token", "sso_revoked", "not_authorized"].includes(error2);
-  return terminal ? { kind: "terminal", error: error2 } : { kind: "transient", error: error2 };
 }
-async function whoami(base2, accessToken) {
-  const res = await fetch(endpoint(base2, "/api/auth/cli/whoami"), {
-    headers: { Authorization: `Bearer ${accessToken}` }
+async function mutateStore(change, filePath = hostsFilePath()) {
+  return await withStoreLock(filePath, async () => {
+    const store = await loadStore(filePath);
+    const { changed, result: result2 } = change(store);
+    if (changed) await writeStore(store, filePath);
+    return result2;
   });
-  if (res.status === 401) return null;
-  if (!res.ok) throw new AuthHttpError(res.status, `whoami failed: ${await readError(res)}`);
-  return await res.json();
 }
-var AuthHttpError;
-var init_client = __esm({
-  "src/auth/client.ts"() {
+var LOCK_WAIT_MS, LOCK_POLL_MS, StoreLockError;
+var init_store = __esm({
+  "src/auth/store.ts"() {
     "use strict";
-    AuthHttpError = class extends Error {
-      constructor(status, message) {
-        super(message);
-        this.status = status;
-      }
-      status;
+    init_paths();
+    LOCK_WAIT_MS = 5e3;
+    LOCK_POLL_MS = 25;
+    StoreLockError = class extends Error {
     };
   }
 });
@@ -43519,12 +43499,15 @@ var init_client = __esm({
 // src/auth/session.ts
 var session_exports = {};
 __export(session_exports, {
-  IdpUnavailableError: () => IdpUnavailableError,
+  HostUnavailableError: () => HostUnavailableError,
   NotSignedInError: () => NotSignedInError,
   ReloginRequiredError: () => ReloginRequiredError,
+  SessionChangedError: () => SessionChangedError,
   formatAuthError: () => formatAuthError,
-  getAccessToken: () => getAccessToken,
-  resolveHost: () => resolveHost
+  getStoredSession: () => getStoredSession,
+  removeStoredSession: () => removeStoredSession,
+  resolveHost: () => resolveHost,
+  setStoredSession: () => setStoredSession
 });
 function resolveHost(opts) {
   const env2 = opts.env ?? process.env;
@@ -43536,52 +43519,39 @@ function resolveHost(opts) {
   }
   return normalizeHost(raw);
 }
-async function getAccessToken(host, deps = {}) {
-  const now = deps.now ?? Date.now;
+async function getStoredSession(host, deps = {}) {
   const base2 = normalizeHost(host);
   const store = await loadStore(deps.filePath);
   const entry = store.hosts[base2];
   if (!entry) throw new NotSignedInError(base2);
-  const stillValid = Date.parse(entry.expiresAt) - now() > EXPIRY_SKEW_MS;
-  if (stillValid && !deps.force) {
-    return { accessToken: entry.accessToken, userEmail: entry.userEmail };
-  }
-  const result2 = await refreshTokens(base2, entry.refreshToken);
-  if (result2.kind === "tokens") {
-    const updated = {
-      accessToken: result2.tokens.accessToken,
-      refreshToken: result2.tokens.refreshToken,
-      userEmail: result2.tokens.email ?? entry.userEmail,
-      expiresAt: new Date(now() + result2.tokens.expiresIn * 1e3).toISOString()
-    };
-    store.hosts[base2] = updated;
-    await saveStore(store, deps.filePath);
-    return { accessToken: updated.accessToken, userEmail: updated.userEmail };
-  }
-  if (result2.kind === "terminal") {
-    const { [base2]: _removed, ...remainingHosts } = store.hosts;
-    const cleared = {
-      hosts: remainingHosts,
-      ...store.default && store.default !== base2 ? { default: store.default } : {}
-    };
-    await saveStore(cleared, deps.filePath);
-    throw new ReloginRequiredError(base2);
-  }
-  throw new IdpUnavailableError(base2, result2.error);
+  return entry;
+}
+async function setStoredSession(host, entry, deps = {}) {
+  const base2 = normalizeHost(host);
+  await mutateStore((store) => {
+    store.hosts[base2] = entry;
+    if (!store.default) store.default = base2;
+    return { changed: true, result: void 0 };
+  }, deps.filePath);
+}
+async function removeStoredSession(host, deps) {
+  const base2 = normalizeHost(host);
+  return await mutateStore((store) => {
+    if (store.hosts[base2]?.token !== deps.expectedToken) return { changed: false, result: false };
+    const { [base2]: _removed, ...hosts } = store.hosts;
+    store.hosts = hosts;
+    if (store.default === base2) store.default = void 0;
+    return { changed: true, result: true };
+  }, deps.filePath);
 }
 function formatAuthError(err2) {
-  if (err2 instanceof NotSignedInError || err2 instanceof ReloginRequiredError || err2 instanceof IdpUnavailableError) {
-    return err2.message;
-  }
-  return null;
+  return err2 instanceof NotSignedInError || err2 instanceof ReloginRequiredError || err2 instanceof SessionChangedError || err2 instanceof HostUnavailableError ? err2.message : null;
 }
-var EXPIRY_SKEW_MS, NotSignedInError, ReloginRequiredError, IdpUnavailableError;
+var NotSignedInError, ReloginRequiredError, SessionChangedError, HostUnavailableError;
 var init_session = __esm({
   "src/auth/session.ts"() {
     "use strict";
     init_store();
-    init_client();
-    EXPIRY_SKEW_MS = 6e4;
     NotSignedInError = class extends Error {
       constructor(host) {
         super(`Not signed in to ${host}. Run \`component-compass auth login --host ${host}\`.`);
@@ -43591,19 +43561,24 @@ var init_session = __esm({
     };
     ReloginRequiredError = class extends Error {
       constructor(host) {
-        super(`Session for ${host} expired or was revoked. Run \`component-compass auth login --host ${host}\`.`);
+        super(`Session for ${host} is no longer valid. Run \`component-compass auth login --host ${host}\`.`);
+        this.host = host;
+      }
+      host;
+    };
+    SessionChangedError = class extends Error {
+      constructor(host) {
+        super(`Session changed for ${host}; retry the upload with the current sign-in.`);
         this.host = host;
       }
       host;
     };
-    IdpUnavailableError = class extends Error {
-      constructor(host, reason) {
-        super(`Could not reach the identity provider to refresh credentials for ${host} (${reason}). Check your network and retry.`);
+    HostUnavailableError = class extends Error {
+      constructor(host) {
+        super(`Could not reach ${host} to check the session. Check your network and retry.`);
         this.host = host;
-        this.reason = reason;
       }
       host;
-      reason;
     };
   }
 });
@@ -43623,28 +43598,27 @@ async function createAuthedUploader(opts) {
   });
   const { COMPONENT_COMPASS_TOKEN: ciToken } = process.env;
   const session = filePath !== void 0 ? { filePath } : {};
-  let token = ciToken || (await getAccessToken(base2, session)).accessToken;
-  async function refreshToken() {
+  const token = ciToken || (await getStoredSession(base2, session)).token;
+  async function onUnauthorized() {
     if (ciToken) {
-      throw new UploadError(401, "COMPONENT_COMPASS_TOKEN was rejected (401); interactive login and token refresh are disabled. Supply a valid token.");
+      throw new UploadError(401, "COMPONENT_COMPASS_TOKEN was rejected (401). Supply a valid token.");
     }
-    token = (await getAccessToken(base2, { ...session, force: true })).accessToken;
-    return token;
+    const removed = await removeStoredSession(base2, { expectedToken: token, ...session });
+    if (!removed) throw new SessionChangedError(base2);
+    throw new ReloginRequiredError(base2);
   }
   return {
     base: base2,
     async upload(artifactJson) {
-      const submit = () => submitArtifact({ host: base2, token, artifactJson });
-      const receipt = await submit().catch(async (err2) => {
+      const receipt = await submitArtifact({ host: base2, token, artifactJson }).catch(async (err2) => {
         if (!(err2 instanceof UploadError) || err2.code !== 401) throw err2;
-        await refreshToken();
-        return await submit();
+        return await onUnauthorized();
       });
       return await pollUpload({
         host: base2,
         receipt,
         getToken: async () => token,
-        refreshToken,
+        onUnauthorized,
         timeoutMs: 3e5,
         ...opts.onStatus ? { onStatus: opts.onStatus } : {}
       });
@@ -45151,6 +45125,105 @@ var init_parse = __esm({
   }
 });
 
+// src/auth/client.ts
+function endpoint(base2, path5) {
+  return `${base2.replace(/\/+$/, "")}${path5}`;
+}
+async function readError(res) {
+  const body = await res.json().catch(() => ({}));
+  return body.error ?? "unknown_error";
+}
+function toUserSession(body) {
+  if (typeof body !== "object" || body === null || Array.isArray(body)) {
+    throw new AuthProtocolError("Invalid token response: missing session.");
+  }
+  const { access_token: token, token_type: tokenType, email } = body;
+  if (typeof token !== "string" || !USER_SESSION_TOKEN_PATTERN.test(token) || tokenType !== "Bearer" || typeof email !== "string" || email.trim() === "") {
+    throw new AuthProtocolError("Invalid token response: malformed session.");
+  }
+  return { token, email };
+}
+async function requestDeviceCode(base2) {
+  const res = await fetch(endpoint(base2, "/api/auth/cli/device-code"), { method: "POST" });
+  if (!res.ok) throw new AuthHttpError(res.status, `device-code failed: ${await readError(res)}`);
+  const b = await res.json();
+  return {
+    deviceCode: b.device_code,
+    userCode: b.user_code,
+    verificationUri: b.verification_uri,
+    verificationUriComplete: b.verification_uri_complete,
+    expiresIn: b.expires_in,
+    interval: b.interval
+  };
+}
+async function pollToken(base2, deviceCode) {
+  const res = await fetch(endpoint(base2, "/api/auth/cli/token"), {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ device_code: deviceCode })
+  });
+  if (res.ok) {
+    const body = await res.json().catch(() => {
+      throw new AuthProtocolError("Invalid token response: could not parse JSON.");
+    });
+    return { kind: "session", session: toUserSession(body) };
+  }
+  const error2 = await readError(res);
+  switch (error2) {
+    case "authorization_pending":
+      return { kind: "pending" };
+    case "slow_down":
+      return { kind: "slow_down" };
+    case "expired_token":
+      return { kind: "expired" };
+    case "access_denied":
+      return { kind: "denied" };
+    default:
+      throw new AuthHttpError(res.status, `token poll failed: ${error2}`);
+  }
+}
+async function revokeSession(base2, token) {
+  const res = await fetch(endpoint(base2, "/api/auth/cli/session"), {
+    method: "DELETE",
+    headers: { Authorization: `Bearer ${token}` }
+  });
+  if (res.status !== 204) throw new AuthHttpError(res.status, `session revoke failed: ${await readError(res)}`);
+}
+async function whoami(base2, token) {
+  const res = await fetch(endpoint(base2, "/api/auth/cli/whoami"), {
+    headers: { Authorization: `Bearer ${token}` }
+  });
+  if (res.status === 401) return null;
+  if (!res.ok) throw new AuthHttpError(res.status, `whoami failed: ${await readError(res)}`);
+  const body = await res.json().catch(() => {
+    throw new AuthProtocolError("Invalid whoami response: could not parse JSON.");
+  });
+  if (typeof body !== "object" || body === null || Array.isArray(body)) {
+    throw new AuthProtocolError("Invalid whoami response: missing identity.");
+  }
+  const { userId, email } = body;
+  if (typeof userId !== "string" || userId === "" || typeof email !== "string" && email !== null) {
+    throw new AuthProtocolError("Invalid whoami response: malformed identity.");
+  }
+  return { userId, email };
+}
+var AuthHttpError, AuthProtocolError, USER_SESSION_TOKEN_PATTERN;
+var init_client = __esm({
+  "src/auth/client.ts"() {
+    "use strict";
+    AuthHttpError = class extends Error {
+      constructor(status, message) {
+        super(message);
+        this.status = status;
+      }
+      status;
+    };
+    AuthProtocolError = class extends Error {
+    };
+    USER_SESSION_TOKEN_PATTERN = /^cc_u_[A-Za-z0-9_-]{43}$/;
+  }
+});
+
 // src/auth/browser.ts
 import { spawn as spawn2 } from "node:child_process";
 function openBrowser(url, deps = {}) {
@@ -45205,6 +45278,33 @@ async function runAuthLogin(opts) {
   const sleep = opts.sleep ?? defaultSleep;
   const now = opts.now ?? Date.now;
   const filePath = opts.store?.filePath;
+  const stored = (await loadStore(filePath)).hosts[base2];
+  if (stored) {
+    try {
+      const identity = await whoami(base2, stored.token);
+      if (identity) {
+        out(`Already signed in as ${identity.email ?? stored.userEmail} to ${base2}.
+`);
+        return 0;
+      }
+      const removed = await removeStoredSession(base2, { expectedToken: stored.token, ...filePath !== void 0 ? { filePath } : {} });
+      if (!removed) {
+        err(`Session for ${base2} changed while checking it. Run \`component-compass auth login --host ${base2}\` again.
+`);
+        return 1;
+      }
+    } catch (e) {
+      if (e instanceof StoreLockError) err(`${e.message}
+`);
+      else if (e instanceof AuthHttpError) err(`Login failed: ${base2} returned HTTP ${e.status}. Your stored session was kept.
+`);
+      else if (e instanceof AuthProtocolError) err(`Login failed: ${e.message} Your stored session was kept.
+`);
+      else err(`${new HostUnavailableError(base2).message}
+`);
+      return 1;
+    }
+  }
   let device;
   try {
     device = await requestDeviceCode(base2);
@@ -45239,6 +45339,10 @@ Code: ${device.userCode}
       if (e instanceof AuthHttpError) {
         err(`
 Login failed: ${base2} returned HTTP ${e.status}. Run \`component-compass auth login\` again.
+`);
+      } else if (e instanceof AuthProtocolError) {
+        err(`
+Login failed: ${e.message} Your stored sessions were kept.
 `);
       } else {
         const detail = transportDetail(e);
@@ -45248,17 +45352,12 @@ Could not reach ${base2}${detail ? ` (${detail})` : ""}. Check the host URL and
       }
       return 1;
     }
-    if (result2.kind === "tokens") {
+    if (result2.kind === "session") {
       const entry = {
-        accessToken: result2.tokens.accessToken,
-        refreshToken: result2.tokens.refreshToken,
-        userEmail: result2.tokens.email ?? "",
-        expiresAt: new Date(now() + result2.tokens.expiresIn * 1e3).toISOString()
-      };
-      const store = await loadStore(filePath);
-      store.hosts[base2] = entry;
-      if (!store.default) store.default = base2;
-      await saveStore(store, filePath);
+        token: result2.session.token,
+        userEmail: result2.session.email
+      };
+      await setStoredSession(base2, entry, filePath !== void 0 ? { filePath } : {});
       if (spin) spin.stop("Approved");
       out(`\u2713 Signed in as ${entry.userEmail || "your account"}
 `);
@@ -45294,19 +45393,27 @@ async function runAuthStatus(opts) {
     write3("Not signed in.\n");
     return 1;
   }
-  if (!store.hosts[base2]) {
+  const entry = store.hosts[base2];
+  if (!entry) {
     write3(`Not signed in to ${base2}.
 `);
     return 1;
   }
   try {
-    const { accessToken, userEmail } = await getAccessToken(base2, filePath !== void 0 ? { filePath } : {});
-    const who = await whoami(base2, accessToken);
-    write3(`Signed in as ${who?.email ?? userEmail} to ${base2}.
+    const { token, userEmail } = await getStoredSession(base2, filePath !== void 0 ? { filePath } : {});
+    const who = await whoami(base2, token);
+    if (!who) {
+      const removed = await removeStoredSession(base2, { expectedToken: token, ...filePath !== void 0 ? { filePath } : {} });
+      write3(removed ? `${new ReloginRequiredError(base2).message}
+` : `Session changed for ${base2}; retry \`component-compass auth status --host ${base2}\`.
+`);
+      return 1;
+    }
+    write3(`Signed in as ${who.email ?? userEmail} to ${base2}.
 `);
     return 0;
   } catch (e) {
-    const msg = formatAuthError(e) ?? (e instanceof Error ? e.message : String(e));
+    const msg = e instanceof StoreLockError ? e.message : formatAuthError(e) ?? (e instanceof AuthHttpError ? `Host ${base2} returned HTTP ${e.status}. Your stored session was kept.` : e instanceof AuthProtocolError ? `${e.message} Your stored session was kept.` : new HostUnavailableError(base2).message);
     write3(`${msg}
 `);
     return 1;
@@ -45323,18 +45430,23 @@ async function runAuthLogout(opts) {
     write3("Not signed in to anything.\n");
     return 0;
   }
-  if (!store.hosts[base2]) {
+  const entry = store.hosts[base2];
+  if (!entry) {
     write3(`Not signed in to ${base2}.
 `);
     return 0;
   }
-  const { [base2]: _removed, ...remaining } = store.hosts;
-  const next = {
-    hosts: remaining,
-    ...store.default && store.default !== base2 ? { default: store.default } : {}
-  };
-  await saveStore(next, filePath);
-  write3(`Signed out of ${base2}.
+  try {
+    await revokeSession(base2, entry.token);
+  } catch (e) {
+    write3(e instanceof AuthHttpError ? `Could not revoke the session for ${base2}: HTTP ${e.status}. Your stored session was kept.
+` : `${new HostUnavailableError(base2).message} Your stored session was kept.
+`);
+    return 1;
+  }
+  const removed = await removeStoredSession(base2, { expectedToken: entry.token, ...filePath !== void 0 ? { filePath } : {} });
+  write3(removed ? `Signed out of ${base2}.
+` : `Revoked the previous session for ${base2}; newer sign-in kept.
 `);
   return 0;
 }
@@ -45430,7 +45542,7 @@ var init_auth = __esm({
 
 // src/commands/scan.ts
 import { performance as performance3 } from "node:perf_hooks";
-import { isAbsolute as isAbsolute11, relative as relative6, resolve as resolve11 } from "node:path";
+import { isAbsolute as isAbsolute12, relative as relative6, resolve as resolve11 } from "node:path";
 import { readFile as readFile5 } from "node:fs/promises";
 
 // src/config/loader.ts
@@ -67480,7 +67592,7 @@ function requireUtil$2() {
         }
         path5 = url.path;
       }
-      var isAbsolute13 = exports$1.isAbsolute(path5);
+      var isAbsolute14 = exports$1.isAbsolute(path5);
       var parts = [];
       var start = 0;
       var i2 = 0;
@@ -67515,7 +67627,7 @@ function requireUtil$2() {
       }
       path5 = parts.join("/");
       if (path5 === "") {
-        path5 = isAbsolute13 ? "/" : ".";
+        path5 = isAbsolute14 ? "/" : ".";
       }
       if (url) {
         url.path = path5;
@@ -67524,7 +67636,7 @@ function requireUtil$2() {
       return path5;
     });
     exports$1.normalize = normalize2;
-    function join16(aRoot, aPath) {
+    function join17(aRoot, aPath) {
       if (aRoot === "") {
         aRoot = ".";
       }
@@ -67556,7 +67668,7 @@ function requireUtil$2() {
       }
       return joined;
     }
-    exports$1.join = join16;
+    exports$1.join = join17;
     exports$1.isAbsolute = function(aPath) {
       return aPath.charAt(0) === "/" || urlRegexp.test(aPath);
     };
@@ -67770,7 +67882,7 @@ function requireUtil$2() {
             parsed.path = parsed.path.substring(0, index + 1);
           }
         }
-        sourceURL = join16(urlGenerate(parsed), sourceURL);
+        sourceURL = join17(urlGenerate(parsed), sourceURL);
       }
       return normalize2(sourceURL);
     }
@@ -75347,9 +75459,9 @@ Url.prototype.resolveObject = function(relative7) {
   if (hasTrailingSlash && srcPath.join("/").substr(-1) !== "/") {
     srcPath.push("");
   }
-  var isAbsolute13 = srcPath[0] === "" || srcPath[0] && srcPath[0].charAt(0) === "/";
+  var isAbsolute14 = srcPath[0] === "" || srcPath[0] && srcPath[0].charAt(0) === "/";
   if (psychotic) {
-    result2.hostname = result2.host = isAbsolute13 ? "" : srcPath.length ? srcPath.shift() : "";
+    result2.hostname = result2.host = isAbsolute14 ? "" : srcPath.length ? srcPath.shift() : "";
     authInHost = result2.host && result2.host.indexOf("@") > 0 ? result2.host.split("@") : false;
     if (authInHost) {
       result2.auth = authInHost.shift();
@@ -75357,7 +75469,7 @@ Url.prototype.resolveObject = function(relative7) {
     }
   }
   mustEndAbs = mustEndAbs || result2.host && srcPath.length;
-  if (mustEndAbs && !isAbsolute13) {
+  if (mustEndAbs && !isAbsolute14) {
     srcPath.unshift("");
   }
   if (!srcPath.length) {
@@ -75525,9 +75637,9 @@ function requirePicocolors() {
   hasRequiredPicocolors = 1;
   let p = browser$1 || {}, argv2 = p.argv || [], env2 = p.env || {};
   let isColorSupported = !(!!env2.NO_COLOR || argv2.includes("--no-color")) && (!!env2.FORCE_COLOR || argv2.includes("--color") || p.platform === "win32" || (p.stdout || {}).isTTY && env2.TERM !== "dumb" || !!env2.CI);
-  let formatter = (open, close, replace = open) => (input2) => {
-    let string2 = "" + input2, index = string2.indexOf(close, open.length);
-    return ~index ? open + replaceClose(string2, close, replace, index) + close : open + string2 + close;
+  let formatter = (open2, close, replace = open2) => (input2) => {
+    let string2 = "" + input2, index = string2.indexOf(close, open2.length);
+    return ~index ? open2 + replaceClose(string2, close, replace, index) + close : open2 + string2 + close;
   };
   let replaceClose = (string2, close, replace, index) => {
     let result2 = "", cursor3 = 0;
@@ -77190,7 +77302,7 @@ function requirePreviousMap() {
   if (hasRequiredPreviousMap) return previousMap;
   hasRequiredPreviousMap = 1;
   let { existsSync: existsSync8, readFileSync: readFileSync13 } = require$$0$1;
-  let { dirname: dirname13, join: join16 } = require$$1;
+  let { dirname: dirname13, join: join17 } = require$$1;
   let { SourceMapConsumer, SourceMapGenerator } = /* @__PURE__ */ requireSourceMap$1();
   function fromBase64(str) {
     if (Buffer$1) {
@@ -77289,7 +77401,7 @@ function requirePreviousMap() {
         return this.decodeInline(this.annotation);
       } else if (this.annotation) {
         let map2 = this.annotation;
-        if (file) map2 = join16(dirname13(file), map2);
+        if (file) map2 = join17(dirname13(file), map2);
         return this.loadFile(map2);
       }
     }
@@ -77311,7 +77423,7 @@ function requireInput() {
   if (hasRequiredInput) return input;
   hasRequiredInput = 1;
   let { nanoid } = /* @__PURE__ */ requireNonSecure();
-  let { isAbsolute: isAbsolute13, resolve: resolve14 } = require$$1;
+  let { isAbsolute: isAbsolute14, resolve: resolve14 } = require$$1;
   let { SourceMapConsumer, SourceMapGenerator } = /* @__PURE__ */ requireSourceMap$1();
   let { fileURLToPath: fileURLToPath3, pathToFileURL } = require$$2;
   let CssSyntaxError = /* @__PURE__ */ requireCssSyntaxError();
@@ -77319,7 +77431,7 @@ function requireInput() {
   let terminalHighlight = /* @__PURE__ */ requireTerminalHighlight();
   let lineToIndexCache = /* @__PURE__ */ Symbol("lineToIndexCache");
   let sourceMapAvailable = Boolean(SourceMapConsumer && SourceMapGenerator);
-  let pathAvailable = Boolean(resolve14 && isAbsolute13);
+  let pathAvailable = Boolean(resolve14 && isAbsolute14);
   function getLineToIndex(input2) {
     if (input2[lineToIndexCache]) return input2[lineToIndexCache];
     let lines = input2.css.split("\n");
@@ -77350,7 +77462,7 @@ function requireInput() {
       this.document = this.css;
       if (opts.document) this.document = opts.document.toString();
       if (opts.from) {
-        if (!pathAvailable || /^\w+:\/\//.test(opts.from) || isAbsolute13(opts.from)) {
+        if (!pathAvailable || /^\w+:\/\//.test(opts.from) || isAbsolute14(opts.from)) {
           this.file = opts.from;
         } else {
           this.file = resolve14(opts.from);
@@ -77486,7 +77598,7 @@ function requireInput() {
         to = consumer.originalPositionFor({ column: endColumn, line: endLine });
       }
       let fromUrl;
-      if (isAbsolute13(from2.source)) {
+      if (isAbsolute14(from2.source)) {
         fromUrl = pathToFileURL(from2.source);
       } else {
         fromUrl = new URL(
@@ -78095,7 +78207,7 @@ function requireParser$1() {
       let prev;
       let shift;
       let last = false;
-      let open = false;
+      let open2 = false;
       let params = [];
       let brackets = [];
       while (!this.tokenizer.endOfFile()) {
@@ -78115,7 +78227,7 @@ function requireParser$1() {
             this.semicolon = true;
             break;
           } else if (type === "{") {
-            open = true;
+            open2 = true;
             break;
           } else if (type === "}") {
             if (params.length > 0) {
@@ -78157,7 +78269,7 @@ function requireParser$1() {
         node2.raws.afterName = "";
         node2.params = "";
       }
-      if (open) {
+      if (open2) {
         node2.nodes = [];
         this.current = node2;
       }
@@ -94097,11 +94209,11 @@ function createImportResolver(opts) {
       }
       if (spec.startsWith(".")) {
         const segments = spec.split("/");
-        const basename6 = segments[segments.length - 1];
-        if (basename6) {
+        const basename7 = segments[segments.length - 1];
+        if (basename7) {
           for (const ext of FILE_EXTENSIONS) {
             try {
-              return requireFromRepo.resolve(`${spec}/${basename6}${ext}`, {
+              return requireFromRepo.resolve(`${spec}/${basename7}${ext}`, {
                 paths: [fromDir, opts.repoRoot]
               });
             } catch {
@@ -94142,10 +94254,10 @@ function tryFileWithExtensions(absPath) {
     if (isFile(indexPath)) return indexPath;
   }
   const segments = absPath.split(/[\\/]/);
-  const basename6 = segments[segments.length - 1];
-  if (basename6) {
+  const basename7 = segments[segments.length - 1];
+  if (basename7) {
     for (const ext of FILE_EXTENSIONS) {
-      const basenamePath = pathResolve3(absPath, `${basename6}${ext}`);
+      const basenamePath = pathResolve3(absPath, `${basename7}${ext}`);
       if (isFile(basenamePath)) return basenamePath;
     }
   }
@@ -94466,6 +94578,9 @@ function createArgumentMap() {
   };
 }
 
+// ../reference-graph/dist/engine/binding.js
+import { isAbsolute as isAbsolute8 } from "node:path";
+
 // ../reference-graph/dist/engine/cycle-detection.js
 var MAX_REFERENCE_DEPTH = 32;
 function createCycleGuard() {
@@ -94528,130 +94643,25 @@ function libraryStubFor(imp, ref) {
   return libraryExportFor(imp, ref)?.kind === "identity-preserving" ? { kind: "Function", returns: [{ kind: "ParameterOf", fn: ref, index: 0 }] } : null;
 }
 
-// ../reference-graph/dist/engine/resolve-reference.js
-function resolveReference(graph, fileGraph, ref, guard = createCycleGuard()) {
-  const lookupGraph = fileGraphForRef(graph, ref, fileGraph);
-  let scope = ref.scope;
-  while (true) {
-    const decl = lookupGraph.declarations.get(`${scope}::${ref.symbol}`);
-    if (decl) {
-      return wrapWithMemberChain(decl.value, ref.memberChain);
-    }
-    if (scope === MODULE_SCOPE)
-      break;
-    const parent = lookupGraph.scopes.get(scope)?.parent;
-    if (parent === null || parent === void 0)
-      break;
-    scope = parent;
-  }
-  const imp = lookupGraph.importsByLocal.get(ref.symbol);
-  if (!imp)
-    return { kind: "Unknown" };
-  const stub = libraryStubFor(imp, ref);
-  if (stub)
-    return stub;
-  const resolvedFile = graph.moduleResolver(lookupGraph.filePath, imp.specifier);
-  if (!resolvedFile)
-    return { kind: "Unknown" };
-  const targetFile = graph.resolveToGraphKey ? graph.resolveToGraphKey(resolvedFile) ?? resolvedFile : resolvedFile;
-  const found = findExport(graph, targetFile, imp.imported, /* @__PURE__ */ new Set());
-  if (!found)
-    return { kind: "Unknown" };
-  const { record: exp, fileGraph: expFileGraph } = found;
-  return resolveExport(graph, expFileGraph, exp, ref.memberChain, guard);
+// ../reference-graph/dist/engine/member-identity.js
+function effectiveExportName(imported, memberChain) {
+  const first = memberChain[0];
+  return imported === "*" && first !== void 0 ? first : imported;
 }
-function findExport(graph, file, imported, seen2) {
-  const seenKey = `${file}::${imported}`;
-  if (seen2.has(seenKey))
-    return null;
-  seen2.add(seenKey);
-  const target = graph.files.get(file);
-  if (!target)
-    return null;
-  for (const exp of target.exports) {
-    if (exp.kind === "named" && exp.exportedAs === imported)
-      return { record: exp, fileGraph: target };
-    if (exp.kind === "default" && imported === "default")
-      return { record: exp, fileGraph: target };
-  }
-  for (const exp of target.exports) {
-    if (exp.kind !== "star")
-      continue;
-    const resolvedFrom = graph.moduleResolver(file, exp.from);
-    if (!resolvedFrom)
-      continue;
-    const nextFile = graph.resolveToGraphKey ? graph.resolveToGraphKey(resolvedFrom) ?? resolvedFrom : resolvedFrom;
-    const result2 = findExport(graph, nextFile, imported, seen2);
-    if (result2)
-      return result2;
-  }
-  return null;
+function residualMemberChain(imported, memberChain) {
+  return imported === "*" && memberChain.length > 0 ? memberChain.slice(1) : memberChain;
 }
-function resolveExport(graph, fileGraph, exp, memberChain, guard) {
-  if (exp.kind === "named" && "local" in exp) {
-    const guardResult = guard.push(fileGraph.filePath, exp.local);
-    if (guardResult !== "ok")
-      return { kind: "Unknown" };
-    try {
-      const localRef = {
-        symbol: exp.local,
-        scope: MODULE_SCOPE,
-        memberChain,
-        loc: { line: 0, column: 0 }
-      };
-      return resolveReference(graph, fileGraph, localRef, guard);
-    } finally {
-      guard.pop(fileGraph.filePath, exp.local);
-    }
-  }
-  if (exp.kind === "named" && "from" in exp) {
-    const resolvedFrom = graph.moduleResolver(fileGraph.filePath, exp.from);
-    if (!resolvedFrom)
-      return { kind: "Unknown" };
-    const targetFile = graph.resolveToGraphKey ? graph.resolveToGraphKey(resolvedFrom) ?? resolvedFrom : resolvedFrom;
-    const innerFound = findExport(graph, targetFile, exp.fromImported, /* @__PURE__ */ new Set());
-    if (!innerFound)
-      return { kind: "Unknown" };
-    const guardResult = guard.push(fileGraph.filePath, exp.exportedAs);
-    if (guardResult !== "ok")
-      return { kind: "Unknown" };
-    try {
-      return resolveExport(graph, innerFound.fileGraph, innerFound.record, memberChain, guard);
-    } finally {
-      guard.pop(fileGraph.filePath, exp.exportedAs);
-    }
-  }
-  if (exp.kind === "default" && "local" in exp) {
-    const guardResult = guard.push(fileGraph.filePath, exp.local);
-    if (guardResult !== "ok")
-      return { kind: "Unknown" };
-    try {
-      const localRef = {
-        symbol: exp.local,
-        scope: MODULE_SCOPE,
-        memberChain,
-        loc: { line: 0, column: 0 }
-      };
-      return resolveReference(graph, fileGraph, localRef, guard);
-    } finally {
-      guard.pop(fileGraph.filePath, exp.local);
-    }
-  }
-  return { kind: "Unknown" };
+function compoundExportName(root2, residual) {
+  return residual.length === 0 ? root2 : `${root2}.${residual.join(".")}`;
 }
-function wrapWithMemberChain(t3, chain) {
-  let result2 = t3;
-  for (const member of chain) {
-    result2 = { kind: "MemberOf", obj: result2, member };
+function memberOfObjectPath(holder, path5) {
+  let cur = holder;
+  for (const segment of path5) {
+    if (cur?.kind !== "Object")
+      return void 0;
+    cur = cur.props[segment];
   }
-  return result2;
-}
-function fileGraphForRef(graph, ref, fallback) {
-  if (!ref.originFile)
-    return fallback;
-  if (ref.originFile === fallback.filePath)
-    return fallback;
-  return graph.files.get(ref.originFile) ?? fallback;
+  return cur;
 }
 
 // ../reference-graph/dist/engine/specifier.js
@@ -94681,67 +94691,9 @@ function externalSubpath(pkg, specifier) {
   return void 0;
 }
 
-// ../reference-graph/dist/engine/re-export-chain.js
-function followReExportChain(graph, file, imported) {
-  return walk2(graph, file, imported, /* @__PURE__ */ new Set());
-}
-function walk2(graph, file, imported, seen2) {
-  const seenKey = `${file}::${imported}`;
-  if (seen2.has(seenKey))
-    return null;
-  seen2.add(seenKey);
-  const target = graph.files.get(file);
-  if (!target)
-    return null;
-  const exp = target.exports.find((e) => e.kind === "named" && "exportedAs" in e && e.exportedAs === imported || e.kind === "default" && imported === "default");
-  if (exp) {
-    if (exp.kind === "named" && "from" in exp) {
-      const nextAbs = graph.moduleResolver(file, exp.from);
-      if (!nextAbs)
-        return { file, localExport: imported };
-      const nextKey = graph.resolveToGraphKey ? graph.resolveToGraphKey(nextAbs) : nextAbs;
-      if (!nextKey)
-        return { file, localExport: imported };
-      return walk2(graph, nextKey, exp.fromImported, seen2) ?? {
-        file: nextKey,
-        localExport: exp.fromImported
-      };
-    }
-    if ("local" in exp) {
-      const imp = target.importsByLocal.get(exp.local);
-      if (imp && imp.imported !== "*" && !packageNameFromSpecifier(imp.specifier)) {
-        const nextAbs = graph.moduleResolver(file, imp.specifier);
-        const nextKey = nextAbs && (graph.resolveToGraphKey ? graph.resolveToGraphKey(nextAbs) : nextAbs);
-        if (nextKey) {
-          const leaf = walk2(graph, nextKey, imp.imported, seen2);
-          if (leaf)
-            return leaf;
-          if (graph.lazyReExportResolution && !graph.files.has(nextKey)) {
-            return { file: nextKey, localExport: imp.imported };
-          }
-        }
-      }
-      return { file, localExport: exp.local };
-    }
-    return { file, localExport: imported };
-  }
-  for (const starExp of target.exports) {
-    if (starExp.kind !== "star")
-      continue;
-    const nextAbs = graph.moduleResolver(file, starExp.from);
-    if (!nextAbs)
-      continue;
-    const nextKey = graph.resolveToGraphKey ? graph.resolveToGraphKey(nextAbs) : nextAbs;
-    if (!nextKey)
-      continue;
-    const result2 = walk2(graph, nextKey, imported, seen2);
-    if (result2)
-      return result2;
-  }
-  return null;
-}
-
-// ../reference-graph/dist/engine/helper-callers.js
+// ../reference-graph/dist/engine/binding.js
+var NO_EXPORT = { kind: "no-export" };
+var UNBOUND = { kind: "unbound" };
 function findLocalDeclaration(fileGraph, ref) {
   let scope = ref.scope;
   while (true) {
@@ -94756,246 +94708,316 @@ function findLocalDeclaration(fileGraph, ref) {
     scope = parent;
   }
 }
-function classifyDeclaration(decl, registry, fileGraph) {
-  if (decl.value.kind !== "Function" && decl.value.kind !== "ReturnTypeOf")
-    return "unknown";
-  if (fileGraph.dialect === "vue" && isSfcDeclaration(fileGraph, decl))
-    return "component";
-  return registry.hasLocal(fileGraph.filePath, decl.symbol) ? "component" : "helper";
+function fileGraphForRef(graph, ref, fallback) {
+  if (!ref.originFile || ref.originFile === fallback.filePath)
+    return fallback;
+  return graph.files.get(ref.originFile) ?? fallback;
 }
-var isSfcDeclaration = (fileGraph, decl) => fileGraph.exports.some((e) => e.kind === "default" && "local" in e && e.local === decl.symbol);
-function buildHelperCallers(graph, registry) {
-  const index = /* @__PURE__ */ new Map();
-  const callerKeysByHelper = /* @__PURE__ */ new Map();
-  const classificationCache = /* @__PURE__ */ new Map();
-  const refResolutionCache = /* @__PURE__ */ new Map();
-  function resolveRefCached(ref, callerFile, callerGraph) {
-    const key = `${callerFile}::${ref.symbol}`;
-    if (refResolutionCache.has(key)) {
-      return refResolutionCache.get(key) ?? null;
-    }
-    const result2 = resolveRefToDecl(ref, callerFile, callerGraph, graph);
-    refResolutionCache.set(key, result2);
-    return result2;
-  }
-  const pendingValueRefs = [];
-  for (const [file, fileGraph] of graph.files) {
-    for (const decl of fileGraph.declarations.values()) {
-      if (decl.scope !== MODULE_SCOPE)
-        continue;
-      const refs = [];
-      if (decl.value.kind === "Function") {
-        for (const r2 of decl.value.returns)
-          collectRefsInType(r2, refs);
-      } else if (decl.value.kind === "ReturnTypeOf") {
-        collectCalleeRefs(decl.value, refs);
-      }
-      for (const bc of fileGraph.bodyCalls) {
-        if (bc.ownerSymbol === decl.symbol)
-          refs.push(bc.callee);
-      }
-      const callerKey = { file, symbol: decl.symbol };
-      for (const ref of refs) {
-        const target = resolveRefCached(ref, file, fileGraph);
-        if (!target)
-          continue;
-        pendingValueRefs.push({ target, caller: callerKey });
-      }
-    }
-  }
-  const pendingJsxCalls = [];
-  for (const [file, fileGraph] of graph.files) {
-    for (let i2 = 0; i2 < fileGraph.jsxUsages.length; i2++) {
-      const usage = fileGraph.jsxUsages[i2];
-      if (!usage)
-        continue;
-      const target = resolveRefCached(usage.ref, file, fileGraph);
-      if (!target)
-        continue;
-      const ownership = fileGraph.ownership[i2];
-      if (!ownership?.ownerSymbolRef)
-        continue;
-      const callerTarget = resolveRefCached(ownership.ownerSymbolRef, file, fileGraph);
-      if (!callerTarget)
-        continue;
-      if (callerTarget.decl.scope !== MODULE_SCOPE)
-        continue;
-      pendingJsxCalls.push({
-        target,
-        caller: { file: callerTarget.file, symbol: callerTarget.decl.symbol }
-      });
-    }
-  }
-  function classifyKey(file, decl) {
-    const key = `${file}::${decl.symbol}`;
-    const hit = classificationCache.get(key);
-    if (hit !== void 0)
-      return hit;
-    const fileGraph = graph.files.get(file);
-    const result2 = fileGraph ? classifyDeclaration(decl, registry, fileGraph) : "unknown";
-    classificationCache.set(key, result2);
-    return result2;
-  }
-  for (const [file, fileGraph] of graph.files) {
-    for (const decl of fileGraph.declarations.values()) {
-      if (decl.scope !== MODULE_SCOPE)
-        continue;
-      if (decl.value.kind !== "Function" && decl.value.kind !== "ReturnTypeOf")
-        continue;
-      classifyKey(file, decl);
-    }
-  }
-  function recordCallerEdge(target, callerKey) {
-    const keyStr = `${target.file}::${target.decl.symbol}`;
-    const callerKeyStr = `${callerKey.file}::${callerKey.symbol}`;
-    let seen2 = callerKeysByHelper.get(keyStr);
-    if (!seen2) {
-      seen2 = /* @__PURE__ */ new Set();
-      callerKeysByHelper.set(keyStr, seen2);
-    }
-    if (seen2.has(callerKeyStr))
-      return;
-    seen2.add(callerKeyStr);
-    let callers = index.get(keyStr);
-    if (!callers) {
-      callers = /* @__PURE__ */ new Set();
-      index.set(keyStr, callers);
-    }
-    callers.add(callerKey);
+function graphKeyFor(graph, abs) {
+  return graph.resolveToGraphKey ? graph.resolveToGraphKey(abs) : abs;
+}
+function exportRecordFor(fileGraph, name) {
+  return fileGraph.exports.find((e) => e.kind === "named" && e.exportedAs === name || e.kind === "default" && name === "default");
+}
+function resolveBinding(graph, fileGraph, ref, guard = createCycleGuard()) {
+  const found = bindingIn(graph, fileGraphForRef(graph, ref, fileGraph), ref, guard, /* @__PURE__ */ new Set());
+  return withWalkIdentity(graph, found, ref.memberChain);
+}
+function resolveModuleExport(graph, fromFile, specifier, imported, memberChain, guard = createCycleGuard()) {
+  const found = moduleExport(graph, fromFile, specifier, imported, memberChain, guard, /* @__PURE__ */ new Set());
+  return withWalkIdentity(graph, { ...found, module: { specifier, imported, target: found.target } }, memberChain);
+}
+function bindingIn(graph, fileGraph, ref, guard, chain) {
+  const decl = findLocalDeclaration(fileGraph, ref);
+  if (decl) {
+    return { binding: { kind: "declaration", file: fileGraph.filePath, decl, path: ref.memberChain, inScope: true }, end: null };
   }
-  for (const { target, caller } of pendingValueRefs) {
-    if (classifyKey(target.file, target.decl) !== "helper")
+  const imp = fileGraph.importsByLocal.get(ref.symbol);
+  if (!imp)
+    return { binding: UNBOUND, end: null };
+  const stub = libraryStubFor(imp, ref);
+  if (stub) {
+    const binding2 = {
+      kind: "package-export",
+      specifier: imp.specifier,
+      exportName: effectiveExportName(imp.imported, ref.memberChain),
+      path: residualMemberChain(imp.imported, ref.memberChain),
+      stub
+    };
+    return { binding: binding2, end: null };
+  }
+  const found = moduleExport(graph, fileGraph.filePath, imp.specifier, imp.imported, ref.memberChain, guard, chain);
+  return { ...found, module: { specifier: imp.specifier, imported: imp.imported, target: found.target } };
+}
+function moduleExport(graph, fromFile, specifier, imported, memberChain, guard, chain) {
+  const exportName = effectiveExportName(imported, memberChain);
+  const path5 = residualMemberChain(imported, memberChain);
+  const target = moduleTarget(graph, fromFile, specifier, exportName, path5);
+  if (target.kind === "outside")
+    return { binding: target.binding, end: null, target };
+  if (imported === "*" && memberChain.length === 0)
+    return { binding: NO_EXPORT, end: null, target };
+  const found = exportIn(graph, target.key, exportName, path5, guard, chain);
+  const b = found.binding;
+  if (imported === "*" && (b.kind === "declaration" || b.kind === "package-export")) {
+    return { binding: { ...b, mainGap: "namespace-member" }, end: found.end, target };
+  }
+  return { binding: b, end: found.end, target };
+}
+function moduleTarget(graph, fromFile, specifier, exportName, path5) {
+  const isPackage = packageNameFromSpecifier(specifier) !== null;
+  const abs = graph.moduleResolver(fromFile, specifier);
+  if (!abs) {
+    const binding3 = isPackage ? { kind: "package-export", specifier, exportName, path: path5, stub: null } : { kind: "import-failed", specifier, exportName, path: path5 };
+    return { kind: "outside", binding: binding3, graphKey: null, member: false };
+  }
+  const graphKey = graphKeyFor(graph, abs);
+  const key = graphKey ?? abs;
+  if (graph.files.has(key))
+    return { kind: "parsed", key };
+  if (graph.workspaceMembership?.(abs) === true) {
+    return { kind: "outside", binding: { kind: "unparsed", file: abs, exportName, path: path5 }, graphKey, member: true };
+  }
+  const binding2 = isPackage ? { kind: "package-export", specifier, exportName, path: path5, stub: null } : { kind: "unparsed", file: key, exportName, path: path5 };
+  return { kind: "outside", binding: binding2, graphKey, member: false };
+}
+function exportIn(graph, file, name, path5, guard, chain) {
+  const again = soughtAgain(chain, file, name);
+  const found = findExportRecord(graph, file, name, /* @__PURE__ */ new Set());
+  if (!found)
+    return { binding: packageStarExport(graph, file, name, path5, /* @__PURE__ */ new Set()) ?? NO_EXPORT, end: null };
+  const inner = followRecord(graph, found, file, name, path5, guard, chain);
+  return again ? { binding: inner.binding, end: null } : inner;
+}
+function followRecord(graph, found, file, name, path5, guard, chain) {
+  const onChain = recordOnChain(graph, file, name, chain);
+  if (onChain?.record === found.record)
+    return bindingForRecord(graph, found.fileGraph, found.record, name, path5, guard, chain);
+  const { binding: binding2 } = bindingForRecord(graph, found.fileGraph, found.record, name, path5, guard, new Set(chain));
+  const end = onChain ? bindingForRecord(graph, onChain.fileGraph, onChain.record, name, path5, guard, chain).end : null;
+  return { binding: binding2, end };
+}
+function soughtAgain(chain, file, name) {
+  const key = `${file}::${name}`;
+  if (chain.has(key))
+    return true;
+  chain.add(key);
+  return false;
+}
+function findExportRecord(graph, file, name, seen2) {
+  const seenKey = `${file}::${name}`;
+  if (seen2.has(seenKey))
+    return null;
+  seen2.add(seenKey);
+  const fileGraph = graph.files.get(file);
+  if (!fileGraph)
+    return null;
+  const record = exportRecordFor(fileGraph, name);
+  if (record)
+    return { record, fileGraph };
+  for (const star of fileGraph.exports) {
+    if (star.kind !== "star")
       continue;
-    recordCallerEdge(target, caller);
-  }
-  for (const { target, caller } of pendingJsxCalls) {
-    if (classifyKey(target.file, target.decl) !== "helper")
+    const abs = graph.moduleResolver(file, star.from);
+    if (!abs)
       continue;
-    recordCallerEdge(target, caller);
+    const found = findExportRecord(graph, graphKeyFor(graph, abs) ?? abs, name, seen2);
+    if (found)
+      return found;
   }
-  return {
-    get(key) {
-      return index.get(`${key.file}::${key.symbol}`);
-    },
-    classification(file, symbol2) {
-      return classificationCache.get(`${file}::${symbol2}`) ?? "unknown";
-    }
-  };
+  return null;
 }
-function collectCalleeRefs(t3, out2) {
-  switch (t3.kind) {
-    case "ReturnTypeOf":
-      collectCalleeRefs(t3.callee, out2);
-      return;
-    case "MemberOf":
-      collectCalleeRefs(t3.obj, out2);
-      return;
-    case "TypeOf":
-      out2.push(t3.ref);
+function packageStarExport(graph, file, name, path5, seen2) {
+  if (name === "default")
+    return null;
+  const outside = [];
+  const visit2 = (f) => {
+    if (seen2.has(f))
       return;
-    default:
+    seen2.add(f);
+    const fileGraph = graph.files.get(f);
+    if (!fileGraph)
       return;
-  }
+    for (const star of fileGraph.exports) {
+      if (star.kind !== "star")
+        continue;
+      const target = moduleTarget(graph, f, star.from, name, path5);
+      if (target.kind === "parsed")
+        visit2(target.key);
+      else
+        outside.push(target.binding);
+    }
+  };
+  visit2(file);
+  return outside.length === 1 && outside[0]?.kind === "package-export" ? outside[0] : null;
 }
-function collectRefsInType(t3, out2) {
-  switch (t3.kind) {
-    case "TypeOf":
-      out2.push(t3.ref);
-      return;
-    case "Union":
-      for (const u3 of t3.types)
-        collectRefsInType(u3, out2);
-      return;
-    case "ReturnTypeOf":
-      collectRefsInType(t3.callee, out2);
-      for (const a3 of t3.args)
-        collectRefsInType(a3, out2);
-      return;
-    case "Function":
-      for (const r2 of t3.returns)
-        collectRefsInType(r2, out2);
-      return;
-    case "Object":
-      for (const v of Object.values(t3.props))
-        collectRefsInType(v, out2);
-      return;
-    case "Array":
-      for (const e of t3.elements)
-        collectRefsInType(e, out2);
-      return;
-    case "MemberOf":
-      collectRefsInType(t3.obj, out2);
-      return;
-    case "ParameterOf":
-      return;
-    default:
-      return;
+function recordOnChain(graph, file, name, chain) {
+  const fileGraph = graph.files.get(file);
+  if (!fileGraph)
+    return null;
+  const record = exportRecordFor(fileGraph, name);
+  if (record)
+    return { record, fileGraph };
+  for (const star of fileGraph.exports) {
+    if (star.kind !== "star")
+      continue;
+    const abs = graph.moduleResolver(file, star.from);
+    if (!abs)
+      continue;
+    const next = graphKeyFor(graph, abs);
+    if (next === null || soughtAgain(chain, next, name))
+      continue;
+    const found = recordOnChain(graph, next, name, chain);
+    if (found)
+      return found;
   }
+  return null;
 }
-function resolveRefToDecl(ref, callerFile, callerGraph, graph) {
-  const localKey = `${MODULE_SCOPE}::${ref.symbol}`;
-  const localDecl = callerGraph.declarations.get(localKey);
-  if (localDecl)
-    return { file: callerFile, decl: localDecl };
-  const imp = callerGraph.importsByLocal.get(ref.symbol);
-  if (!imp)
-    return null;
-  const resolvedAbs = graph.moduleResolver(callerFile, imp.specifier);
-  if (!resolvedAbs)
-    return null;
-  const targetFile = graph.resolveToGraphKey ? graph.resolveToGraphKey(resolvedAbs) ?? resolvedAbs : resolvedAbs;
-  const targetGraph = graph.files.get(targetFile);
-  if (!targetGraph)
-    return null;
-  const chained = followReExportChain(graph, targetFile, imp.imported);
-  if (chained) {
-    const chainedGraph = graph.files.get(chained.file);
-    if (chainedGraph) {
-      const decl = chainedGraph.declarations.get(`${MODULE_SCOPE}::${chained.localExport}`);
-      if (decl)
-        return { file: chained.file, decl };
+function bindingForRecord(graph, fg, exp, name, path5, guard, chain) {
+  if (exp.kind === "star")
+    return { binding: NO_EXPORT, end: null };
+  if ("local" in exp) {
+    const here = { file: fg.filePath, name: exp.local };
+    if (guard.push(fg.filePath, exp.local) !== "ok")
+      return { binding: NO_EXPORT, end: here };
+    try {
+      const ref = { symbol: exp.local, scope: MODULE_SCOPE, memberChain: [...path5], loc: { line: 0, column: 0 } };
+      const found2 = bindingIn(graph, fg, ref, guard, chain);
+      const b = found2.binding;
+      const followed = found2.module !== void 0 && found2.module.imported !== "*" && packageNameFromSpecifier(found2.module.specifier) === null && found2.module.target.kind === "parsed";
+      return {
+        binding: b.kind === "declaration" ? { ...b, inScope: false } : leftGraphThrough(b, fg.filePath),
+        end: (followed ? found2.end : null) ?? here
+      };
+    } finally {
+      guard.pop(fg.filePath, exp.local);
     }
   }
-  for (const exp of targetGraph.exports) {
-    if (exp.kind === "named" && "local" in exp && exp.exportedAs === imp.imported) {
-      const decl = targetGraph.declarations.get(`${MODULE_SCOPE}::${exp.local}`);
-      if (decl)
-        return { file: targetFile, decl };
-    }
-    if (exp.kind === "default" && "local" in exp && imp.imported === "default") {
-      const decl = targetGraph.declarations.get(`${MODULE_SCOPE}::${exp.local}`);
-      if (decl)
-        return { file: targetFile, decl };
-    }
+  const target = moduleTarget(graph, fg.filePath, exp.from, exp.fromImported, path5);
+  if (target.kind === "outside") {
+    const end = target.graphKey === null ? { file: fg.filePath, name } : { file: target.graphKey, name: exp.fromImported };
+    return { binding: leftGraphThrough(target.binding, null), end };
   }
-  return null;
+  const next = { file: target.key, name: exp.fromImported };
+  const again = soughtAgain(chain, target.key, exp.fromImported);
+  const found = findExportRecord(graph, target.key, exp.fromImported, /* @__PURE__ */ new Set());
+  if (!found)
+    return { binding: packageStarExport(graph, target.key, exp.fromImported, path5, /* @__PURE__ */ new Set()) ?? NO_EXPORT, end: next };
+  if (guard.push(fg.filePath, exp.exportedAs) !== "ok")
+    return { binding: NO_EXPORT, end: next };
+  try {
+    const inner = followRecord(graph, found, target.key, exp.fromImported, path5, guard, chain);
+    return { binding: inner.binding, end: (again ? null : inner.end) ?? next };
+  } finally {
+    guard.pop(fg.filePath, exp.exportedAs);
+  }
+}
+function leftGraphThrough(b, barrel) {
+  if (b.kind === "unparsed" && b.mainGap === void 0) {
+    return { ...b, mainGap: { kind: "through-parsed-barrel", barrel } };
+  }
+  return b;
+}
+function withWalkIdentity(graph, found, memberChain) {
+  const { binding: binding2, module } = found;
+  if (module === void 0)
+    return binding2;
+  if (binding2.kind === "package-export" && binding2.mainGap === void 0)
+    return binding2;
+  const { specifier, imported, target } = module;
+  const name = effectiveExportName(imported, memberChain);
+  const residual = residualMemberChain(imported, memberChain);
+  const isPackage = packageNameFromSpecifier(specifier) !== null;
+  const asWritten = (resolvedFile) => ({
+    kind: "imported",
+    specifier,
+    imported: compoundExportName(name, residual),
+    resolvedFile
+  });
+  const local = (file, exportName) => ({
+    kind: "local",
+    filePath: file,
+    export: compoundExportName(exportName, residual)
+  });
+  let walked;
+  if (target.kind === "outside") {
+    if (isPackage || target.member || binding2.kind !== "unparsed")
+      return binding2;
+    walked = asWritten(target.graphKey);
+  } else if (isPackage) {
+    const file = found.end?.file ?? target.key;
+    walked = graph.files.has(file) ? local(file, found.end?.name ?? name) : asWritten(null);
+  } else {
+    walked = found.end ? local(found.end.file, found.end.name) : asWritten(target.key);
+  }
+  return sameIdentity(walked, naturalIdentity(binding2)) ? binding2 : { ...binding2, walkIdentity: walked };
 }
-
-// ../reference-graph/dist/engine/member-identity.js
-function effectiveExportName(imported, memberChain) {
-  const first = memberChain[0];
-  return imported === "*" && first !== void 0 ? first : imported;
+function sameIdentity(a3, b) {
+  if (b === null || a3.kind !== b.kind)
+    return false;
+  if (a3.kind === "local" && b.kind === "local")
+    return a3.filePath === b.filePath && a3.export === b.export;
+  if (a3.kind === "imported" && b.kind === "imported") {
+    return a3.specifier === b.specifier && a3.imported === b.imported && a3.resolvedFile === b.resolvedFile;
+  }
+  return false;
 }
-function residualMemberChain(imported, memberChain) {
-  return imported === "*" && memberChain.length > 0 ? memberChain.slice(1) : memberChain;
+function bindingValue(binding2) {
+  switch (binding2.kind) {
+    case "declaration": {
+      if (binding2.mainGap === "namespace-member")
+        return { kind: "Unknown" };
+      let value = binding2.decl.value;
+      for (const member of binding2.path)
+        value = { kind: "MemberOf", obj: value, member };
+      return value;
+    }
+    case "package-export":
+      return binding2.mainGap === "namespace-member" ? { kind: "Unknown" } : binding2.stub ?? { kind: "Unknown" };
+    default:
+      return { kind: "Unknown" };
+  }
 }
-function compoundExportName(root2, residual) {
-  return residual.length === 0 ? root2 : `${root2}.${residual.join(".")}`;
+function bindingIdentity(binding2) {
+  if (binding2.walkIdentity !== void 0)
+    return binding2.walkIdentity;
+  return naturalIdentity(binding2);
 }
-function memberOfObjectPath(holder, path5) {
-  let cur = holder;
-  for (const segment of path5) {
-    if (cur?.kind !== "Object")
-      return void 0;
-    cur = cur.props[segment];
+function naturalIdentity(binding2) {
+  switch (binding2.kind) {
+    case "declaration":
+      return {
+        kind: "local",
+        filePath: binding2.file,
+        export: compoundExportName(binding2.decl.symbol, binding2.path),
+        ...binding2.path.length === 0 ? { declaration: binding2.decl } : {}
+      };
+    case "unparsed":
+      return { kind: "local", filePath: binding2.file, export: compoundExportName(binding2.exportName, binding2.path) };
+    case "package-export":
+    case "import-failed":
+      return {
+        kind: "imported",
+        specifier: binding2.specifier,
+        imported: compoundExportName(binding2.exportName, binding2.path),
+        resolvedFile: null
+      };
+    default:
+      return null;
   }
-  return cur;
 }
-function unparsedMemberDefinition(graph, resolvedAbs, imported) {
-  if (graph.workspaceMembership?.(resolvedAbs) !== true)
-    return null;
-  const def = graph.resolveLocalDefinition?.(resolvedAbs, imported) ?? null;
-  return { absFile: def?.absFile ?? resolvedAbs, exportName: def?.exportName ?? imported };
+function pinUnparsed(graph, binding2) {
+  if (binding2.kind !== "unparsed" || binding2.mainGap !== void 0 || !isAbsolute8(binding2.file))
+    return binding2;
+  if (graph.workspaceMembership?.(binding2.file) !== true)
+    return binding2;
+  const def = graph.resolveLocalDefinition?.(binding2.file, binding2.exportName) ?? null;
+  return def === null ? binding2 : { ...binding2, file: def.absFile, exportName: def.exportName };
+}
+
+// ../reference-graph/dist/engine/resolve-reference.js
+function resolveReference(graph, fileGraph, ref, guard = createCycleGuard()) {
+  return bindingValue(resolveBinding(graph, fileGraph, ref, guard));
 }
 
 // ../reference-graph/dist/engine/assert-never.js
@@ -95419,13 +95441,13 @@ function foldToWrappedArg(inner, via) {
   }
   return [indeterminateTerminal()];
 }
-function argumentProvenance(type, arg, fileGraph) {
-  const importRecord = findImportForLastArg(arg, fileGraph);
+function argumentProvenance(graph, type, arg, fileGraph) {
+  const importRecord = findImportForLastArg(graph, arg, fileGraph);
   const resolved = importRecord ? { specifier: importRecord.specifier, import: importRecord.imported } : resolveAnonymousLastArg(arg, fileGraph);
   return { callee: deriveHocCallee(type.callee), specifier: resolved.specifier, import: resolved.import };
 }
-function buildHocVia(type, lastArg, fileGraph) {
-  const { callee, specifier, import: imported } = argumentProvenance(type, lastArg, fileGraph);
+function buildHocVia(graph, type, lastArg, fileGraph) {
+  const { callee, specifier, import: imported } = argumentProvenance(graph, type, lastArg, fileGraph);
   return { kind: "hoc-wrapper", hocCallee: callee, specifier, import: imported };
 }
 function foldedArgument(graph, fileGraph, call, jsx, argMap) {
@@ -95433,7 +95455,7 @@ function foldedArgument(graph, fileGraph, call, jsx, argMap) {
   const arg = call.args[index];
   if (arg === void 0 || jsx.length === 0)
     return null;
-  const via = buildHocVia(call, arg, fileGraph);
+  const via = buildHocVia(graph, call, arg, fileGraph);
   return jsx.every((t3) => t3.viaTrail[0] !== void 0 && sameHocVia(t3.viaTrail[0], via)) ? { arg, via } : null;
 }
 function sameHocVia(a3, b) {
@@ -95505,14 +95527,8 @@ function fileGraphForDynamicImport(graph, di, fallback) {
 }
 function dynamicImportIdentity(graph, fileGraph, di) {
   const origin = fileGraphForDynamicImport(graph, di, fileGraph);
-  const importedName = di.projection[0] ?? "default";
-  const resolvedFile = graph ? resolveImportedFile(graph, origin, di.specifier, importedName) : null;
-  return workspaceSiblingIdentity(graph, origin, di.specifier, importedName) ?? relativeChainLocalIdentity(graph, origin, di.specifier, importedName) ?? memberLocalIdentity(graph, origin, di.specifier, importedName) ?? {
-    kind: "imported",
-    specifier: di.specifier,
-    imported: importedName,
-    resolvedFile
-  };
+  const binding2 = resolveModuleExport(graph, origin.filePath, di.specifier, di.projection[0] ?? "default", []);
+  return bindingIdentity(pinUnparsed(graph, binding2));
 }
 function walkTypeOf(graph, fileGraph, type, argMap, guard, fallback, position) {
   if (guard.pushNode(type) === "cycle") {
@@ -95529,22 +95545,12 @@ function walkTypeOf(graph, fileGraph, type, argMap, guard, fallback, position) {
     if (inner.every((t3) => t3.identity !== null))
       return inner;
     const derived = position === "tag" && inner.some((t3) => t3.identity === null && isCallable(t3)) || resolved.kind !== "ParameterOf" && evalKind(resolved, graph, innerGraph, argMap) === "component" ? deriveIdentity(type, fileGraph, graph) : null;
-    const self2 = position === "tag" ? withOwnDeclaration(derived, graph, fileGraph, type.ref) : derived;
-    const stamp = self2 ?? deriveIdentity(fallback, fileGraph, graph);
+    const stamp = derived ?? deriveIdentity(fallback, fileGraph, graph);
     return inner.map((t3) => t3.identity === null ? { denotation: t3.denotation, viaTrail: t3.viaTrail, identity: stamp, semantics: t3.semantics } : t3);
   } finally {
     guard.popNode(type);
   }
 }
-function withOwnDeclaration(identity, graph, fileGraph, ref) {
-  if (identity === null || identity.kind !== "local" || ref.memberChain.length > 0)
-    return identity;
-  const lookup2 = fileGraphForRef(graph, ref, fileGraph);
-  if (identity.filePath !== lookup2.filePath || lookup2.importsByLocal.has(ref.symbol))
-    return identity;
-  const declaration2 = findLocalDeclaration(lookup2, ref);
-  return declaration2 === null ? identity : { ...identity, declaration: declaration2 };
-}
 function walkStaticMember(graph, fileGraph, type, argMap, guard, fallback, position) {
   if (guard.pushNode(type) === "cycle") {
     return [indeterminateTerminal()];
@@ -95599,7 +95605,7 @@ function foldCall(graph, fileGraph, type, argMap, guard, position) {
     }
     let inner2;
     try {
-      const target = resolveDynamicImportTarget(graph, fileGraph, syntheticDI, guard);
+      const target = resolveDynamicImportTarget(graph, fileGraph, syntheticDI);
       inner2 = target ? walkInner(graph, target.targetFileGraph, target.value, argMap, guard, void 0, position) : walkInner(graph, fileGraph, syntheticDI, argMap, guard, void 0, position);
     } finally {
       guard.pop(syntheticDI.originFile, guardKey);
@@ -95631,7 +95637,7 @@ function foldCall(graph, fileGraph, type, argMap, guard, position) {
     const wrapped = type.args[passThroughIndex];
     if (wrapped !== void 0) {
       const inner2 = walkInner(graph, fileGraph, wrapped, argMap, guard, void 0, position);
-      return foldToWrappedArg(inner2, buildHocVia(type, wrapped, fileGraph));
+      return foldToWrappedArg(inner2, buildHocVia(graph, type, wrapped, fileGraph));
     }
   }
   const algResult = foldTerminals(graph, fileGraph, resolveType(graph, fileGraph, type, argMap, guard), type);
@@ -95641,7 +95647,7 @@ function foldCall(graph, fileGraph, type, argMap, guard, position) {
     if (lastArg2 !== void 0) {
       const inner2 = walkInner(graph, fileGraph, lastArg2, argMap, guard, void 0, position);
       if (isPassThroughWrapper(algResult, inner2)) {
-        const via = buildHocVia(type, lastArg2, fileGraph);
+        const via = buildHocVia(graph, type, lastArg2, fileGraph);
         return inner2.filter((t3) => !cameToNothing(t3)).map((t3) => ({ denotation: t3.denotation, viaTrail: [via, ...t3.viaTrail], identity: t3.identity }));
       }
     }
@@ -95661,7 +95667,7 @@ function foldCall(graph, fileGraph, type, argMap, guard, position) {
     }
     return [indeterminateTerminal()];
   }
-  return foldToWrappedArg(inner, buildHocVia(type, lastArg, fileGraph));
+  return foldToWrappedArg(inner, buildHocVia(graph, type, lastArg, fileGraph));
 }
 function passThroughParameterIndex(graph, fileGraph, type, argMap, guard) {
   const calleeFns = resolveToFunctions(graph, fileGraph, type.callee, argMap, guard);
@@ -95821,14 +95827,19 @@ function deriveHocCallee(callee) {
       return "unknown";
   }
 }
-function findImportForLastArg(lastArg, fileGraph) {
+function findImportForLastArg(graph, lastArg, fileGraph) {
   let cur = lastArg;
   while (cur.kind === "ReturnTypeOf")
     cur = cur.callee;
   if (cur.kind !== "TypeOf")
     return null;
   const imp = fileGraph.importsByLocal.get(cur.ref.symbol);
-  return imp ? { specifier: imp.specifier, imported: imp.imported } : null;
+  if (!imp)
+    return null;
+  const binding2 = resolveBinding(graph, fileGraph, cur.ref);
+  if (binding2.kind === "declaration" && binding2.inScope && binding2.file === fileGraph.filePath)
+    return null;
+  return { specifier: imp.specifier, imported: imp.imported };
 }
 function resolveAnonymousLastArg(lastArg, fileGraph) {
   let cur = lastArg;
@@ -95872,104 +95883,11 @@ function typeContainsRef(haystack, needle) {
       return false;
   }
 }
-function resolveImportedFile(graph, fileGraph, specifier, imported) {
-  const abs = graph.moduleResolver(fileGraph.filePath, specifier);
-  if (!abs)
-    return null;
-  const key = graph.resolveToGraphKey ? graph.resolveToGraphKey(abs) : abs;
-  if (!key || !imported)
-    return key;
-  return followReExportChain(graph, key, imported)?.file ?? key;
-}
-function relativeChainLocalIdentity(graph, fileGraph, specifier, imported) {
-  if (!graph)
-    return null;
-  if (packageNameFromSpecifier(specifier))
-    return null;
-  const abs = graph.moduleResolver(fileGraph.filePath, specifier);
-  if (!abs)
-    return null;
-  const key = graph.resolveToGraphKey ? graph.resolveToGraphKey(abs) : abs;
-  if (!key || !graph.files.has(key))
-    return null;
-  const chained = followReExportChain(graph, key, imported);
-  if (!chained)
-    return null;
-  return { kind: "local", filePath: chained.file, export: chained.localExport };
-}
-function workspaceSiblingIdentity(graph, fileGraph, specifier, imported) {
-  if (!graph)
-    return null;
-  if (!packageNameFromSpecifier(specifier))
-    return null;
-  const abs = graph.moduleResolver(fileGraph.filePath, specifier);
-  const key = abs && (graph.resolveToGraphKey ? graph.resolveToGraphKey(abs) : abs);
-  if (!key)
-    return null;
-  const chained = followReExportChain(graph, key, imported);
-  const file = chained?.file ?? key;
-  if (!graph.files.has(file))
-    return null;
-  return { kind: "local", filePath: file, export: chained?.localExport ?? imported };
-}
-function memberLocalIdentity(graph, fileGraph, specifier, imported) {
-  if (graph?.workspaceMembership === void 0)
-    return null;
-  const abs = graph.moduleResolver(fileGraph.filePath, specifier);
-  if (!abs)
-    return null;
-  const key = graph.resolveToGraphKey ? graph.resolveToGraphKey(abs) : abs;
-  if (key !== null && graph.files.has(key))
-    return null;
-  const member = unparsedMemberDefinition(graph, abs, imported);
-  if (member === null)
-    return null;
-  return { kind: "local", filePath: member.absFile, export: member.exportName };
-}
-function withResidual(identity, residual) {
-  if (identity === null || residual.length === 0)
-    return identity;
-  return identity.kind === "local" ? { ...identity, export: compoundExportName(identity.export, residual) } : { ...identity, imported: compoundExportName(identity.imported, residual) };
-}
 function deriveIdentity(type, fileGraph, graph) {
-  const cur = type;
-  if (cur.kind === "DynamicImport") {
-    return dynamicImportIdentity(graph, fileGraph, cur);
-  }
-  if (cur.kind === "TypeOf") {
-    const symbol2 = cur.ref.symbol;
-    const lookup2 = graph ? fileGraphForRef(graph, cur.ref, fileGraph) : fileGraph;
-    const imp = lookup2.importsByLocal.get(symbol2);
-    if (imp) {
-      const imported = effectiveExportName(imp.imported, cur.ref.memberChain);
-      const residual = residualMemberChain(imp.imported, cur.ref.memberChain);
-      const resolvedFile = graph ? resolveImportedFile(graph, lookup2, imp.specifier, imported) : null;
-      const workspaceLocal = workspaceSiblingIdentity(graph, lookup2, imp.specifier, imported);
-      if (workspaceLocal)
-        return withResidual(workspaceLocal, residual);
-      const relativeLocal = relativeChainLocalIdentity(graph, lookup2, imp.specifier, imported);
-      if (relativeLocal)
-        return withResidual(relativeLocal, residual);
-      const memberLocal = memberLocalIdentity(graph, lookup2, imp.specifier, imported);
-      if (memberLocal)
-        return withResidual(memberLocal, residual);
-      return withResidual({
-        kind: "imported",
-        specifier: imp.specifier,
-        imported,
-        resolvedFile
-      }, residual);
-    }
-    for (const [, decl] of lookup2.declarations) {
-      if (decl && decl.symbol === symbol2) {
-        return withResidual({
-          kind: "local",
-          filePath: lookup2.filePath,
-          export: decl.exportedAs ?? symbol2
-        }, cur.ref.memberChain);
-      }
-    }
-  }
+  if (type.kind === "DynamicImport")
+    return dynamicImportIdentity(graph, fileGraph, type);
+  if (type.kind === "TypeOf")
+    return bindingIdentity(pinUnparsed(graph, resolveBinding(graph, fileGraph, type.ref)));
   return null;
 }
 
@@ -96075,7 +95993,7 @@ function resolveTypeInner(graph, fileGraph, type, argMap, guard) {
     case "Array":
       return [{ type, source: null }];
     case "DynamicImport": {
-      const target = resolveDynamicImportTarget(graph, fileGraph, type, guard);
+      const target = resolveDynamicImportTarget(graph, fileGraph, type);
       if (!target)
         return [{ type, source: type }];
       return resolveType(graph, target.targetFileGraph, target.value, argMap, guard);
@@ -96084,29 +96002,17 @@ function resolveTypeInner(graph, fileGraph, type, argMap, guard) {
       return assertNever(type);
   }
 }
-function resolveDynamicImportTarget(graph, fileGraph, di, guard) {
+function resolveDynamicImportTarget(graph, fileGraph, di) {
   const origin = fileGraphForDynamicImport(graph, di, fileGraph);
-  const absPath = graph.moduleResolver(origin.filePath, di.specifier);
-  if (!absPath)
+  const b = resolveModuleExport(graph, origin.filePath, di.specifier, di.projection[0] ?? "default", []);
+  const targetFile = b.kind === "declaration" ? b.file : b.kind === "unparsed" && b.mainGap !== void 0 ? b.mainGap.barrel : null;
+  const targetFileGraph = targetFile === null ? void 0 : graph.files.get(targetFile);
+  if (!targetFileGraph)
     return null;
-  const key = graph.resolveToGraphKey ? graph.resolveToGraphKey(absPath) ?? absPath : absPath;
-  const chained = followReExportChain(graph, key, di.projection[0] ?? "default");
-  const targetFile = chained ? graph.files.get(chained.file) : void 0;
-  if (!chained || !targetFile)
-    return null;
-  const local = chained.localExport;
-  if (!targetFile.declarations.has(`${MODULE_SCOPE}::${local}`) && !targetFile.importsByLocal.has(local))
-    return null;
-  const localRef = {
-    symbol: local,
-    scope: MODULE_SCOPE,
-    memberChain: [],
-    loc: { line: 0, column: 0 }
-  };
-  let value = resolveReference(graph, targetFile, localRef, guard);
+  let value = bindingValue(b);
   for (const member of di.projection.slice(1))
     value = { kind: "MemberOf", obj: value, member };
-  return { targetFileGraph: targetFile, value };
+  return { targetFileGraph, value };
 }
 function resolveToFunctions(graph, fileGraph, type, argMap, guard) {
   if (guard.pushNode(type) === "cycle") {
@@ -96203,6 +96109,282 @@ function resolveToFunctionsInner(graph, fileGraph, type, argMap, guard) {
 // ../reference-graph/dist/engine/index.js
 import { asTagName, computeOccurrenceId, serialiseComponentId, projectPropUsages, parseCompoundExport as parseCompoundExport2 } from "@component-compass/plugin-core";
 
+// ../reference-graph/dist/engine/re-export-chain.js
+function followReExportChain(graph, file, imported) {
+  return walk2(graph, file, imported, /* @__PURE__ */ new Set());
+}
+function walk2(graph, file, imported, seen2) {
+  const seenKey = `${file}::${imported}`;
+  if (seen2.has(seenKey))
+    return null;
+  seen2.add(seenKey);
+  const target = graph.files.get(file);
+  if (!target)
+    return null;
+  const exp = exportRecordFor(target, imported);
+  if (exp) {
+    if (exp.kind === "named" && "from" in exp) {
+      const nextAbs = graph.moduleResolver(file, exp.from);
+      if (!nextAbs)
+        return { file, localExport: imported };
+      const nextKey = graphKeyFor(graph, nextAbs);
+      if (!nextKey)
+        return { file, localExport: imported };
+      return walk2(graph, nextKey, exp.fromImported, seen2) ?? {
+        file: nextKey,
+        localExport: exp.fromImported
+      };
+    }
+    if ("local" in exp) {
+      const imp = target.importsByLocal.get(exp.local);
+      if (imp && imp.imported !== "*" && !packageNameFromSpecifier(imp.specifier)) {
+        const nextAbs = graph.moduleResolver(file, imp.specifier);
+        const nextKey = nextAbs ? graphKeyFor(graph, nextAbs) : null;
+        if (nextKey) {
+          const leaf = walk2(graph, nextKey, imp.imported, seen2);
+          if (leaf)
+            return leaf;
+          if (graph.lazyReExportResolution && !graph.files.has(nextKey)) {
+            return { file: nextKey, localExport: imp.imported };
+          }
+        }
+      }
+      return { file, localExport: exp.local };
+    }
+    return { file, localExport: imported };
+  }
+  for (const starExp of target.exports) {
+    if (starExp.kind !== "star")
+      continue;
+    const nextAbs = graph.moduleResolver(file, starExp.from);
+    if (!nextAbs)
+      continue;
+    const nextKey = graphKeyFor(graph, nextAbs);
+    if (!nextKey)
+      continue;
+    const result2 = walk2(graph, nextKey, imported, seen2);
+    if (result2)
+      return result2;
+  }
+  return null;
+}
+
+// ../reference-graph/dist/engine/helper-callers.js
+function classifyDeclaration(decl, registry, fileGraph) {
+  if (decl.value.kind !== "Function" && decl.value.kind !== "ReturnTypeOf")
+    return "unknown";
+  if (fileGraph.dialect === "vue" && isSfcDeclaration(fileGraph, decl))
+    return "component";
+  return registry.hasLocal(fileGraph.filePath, decl.symbol) ? "component" : "helper";
+}
+var isSfcDeclaration = (fileGraph, decl) => fileGraph.exports.some((e) => e.kind === "default" && "local" in e && e.local === decl.symbol);
+function buildHelperCallers(graph, registry) {
+  const index = /* @__PURE__ */ new Map();
+  const callerKeysByHelper = /* @__PURE__ */ new Map();
+  const classificationCache = /* @__PURE__ */ new Map();
+  const refResolutionCache = /* @__PURE__ */ new Map();
+  function resolveRefCached(ref, callerFile, callerGraph) {
+    const key = `${callerFile}::${ref.symbol}`;
+    if (refResolutionCache.has(key)) {
+      return refResolutionCache.get(key) ?? null;
+    }
+    const result2 = resolveRefToDecl(ref, callerFile, callerGraph, graph);
+    refResolutionCache.set(key, result2);
+    return result2;
+  }
+  const pendingValueRefs = [];
+  for (const [file, fileGraph] of graph.files) {
+    for (const decl of fileGraph.declarations.values()) {
+      if (decl.scope !== MODULE_SCOPE)
+        continue;
+      const refs = [];
+      if (decl.value.kind === "Function") {
+        for (const r2 of decl.value.returns)
+          collectRefsInType(r2, refs);
+      } else if (decl.value.kind === "ReturnTypeOf") {
+        collectCalleeRefs(decl.value, refs);
+      }
+      for (const bc of fileGraph.bodyCalls) {
+        if (bc.ownerSymbol === decl.symbol)
+          refs.push(bc.callee);
+      }
+      const callerKey = { file, symbol: decl.symbol };
+      for (const ref of refs) {
+        const target = resolveRefCached(ref, file, fileGraph);
+        if (!target)
+          continue;
+        pendingValueRefs.push({ target, caller: callerKey });
+      }
+    }
+  }
+  const pendingJsxCalls = [];
+  for (const [file, fileGraph] of graph.files) {
+    for (let i2 = 0; i2 < fileGraph.jsxUsages.length; i2++) {
+      const usage = fileGraph.jsxUsages[i2];
+      if (!usage)
+        continue;
+      const target = resolveRefCached(usage.ref, file, fileGraph);
+      if (!target)
+        continue;
+      const ownership = fileGraph.ownership[i2];
+      if (!ownership?.ownerSymbolRef)
+        continue;
+      const callerTarget = resolveRefCached(ownership.ownerSymbolRef, file, fileGraph);
+      if (!callerTarget)
+        continue;
+      if (callerTarget.decl.scope !== MODULE_SCOPE)
+        continue;
+      pendingJsxCalls.push({
+        target,
+        caller: { file: callerTarget.file, symbol: callerTarget.decl.symbol }
+      });
+    }
+  }
+  function classifyKey(file, decl) {
+    const key = `${file}::${decl.symbol}`;
+    const hit = classificationCache.get(key);
+    if (hit !== void 0)
+      return hit;
+    const fileGraph = graph.files.get(file);
+    const result2 = fileGraph ? classifyDeclaration(decl, registry, fileGraph) : "unknown";
+    classificationCache.set(key, result2);
+    return result2;
+  }
+  for (const [file, fileGraph] of graph.files) {
+    for (const decl of fileGraph.declarations.values()) {
+      if (decl.scope !== MODULE_SCOPE)
+        continue;
+      if (decl.value.kind !== "Function" && decl.value.kind !== "ReturnTypeOf")
+        continue;
+      classifyKey(file, decl);
+    }
+  }
+  function recordCallerEdge(target, callerKey) {
+    const keyStr = `${target.file}::${target.decl.symbol}`;
+    const callerKeyStr = `${callerKey.file}::${callerKey.symbol}`;
+    let seen2 = callerKeysByHelper.get(keyStr);
+    if (!seen2) {
+      seen2 = /* @__PURE__ */ new Set();
+      callerKeysByHelper.set(keyStr, seen2);
+    }
+    if (seen2.has(callerKeyStr))
+      return;
+    seen2.add(callerKeyStr);
+    let callers = index.get(keyStr);
+    if (!callers) {
+      callers = /* @__PURE__ */ new Set();
+      index.set(keyStr, callers);
+    }
+    callers.add(callerKey);
+  }
+  for (const { target, caller } of pendingValueRefs) {
+    if (classifyKey(target.file, target.decl) !== "helper")
+      continue;
+    recordCallerEdge(target, caller);
+  }
+  for (const { target, caller } of pendingJsxCalls) {
+    if (classifyKey(target.file, target.decl) !== "helper")
+      continue;
+    recordCallerEdge(target, caller);
+  }
+  return {
+    get(key) {
+      return index.get(`${key.file}::${key.symbol}`);
+    },
+    classification(file, symbol2) {
+      return classificationCache.get(`${file}::${symbol2}`) ?? "unknown";
+    }
+  };
+}
+function collectCalleeRefs(t3, out2) {
+  switch (t3.kind) {
+    case "ReturnTypeOf":
+      collectCalleeRefs(t3.callee, out2);
+      return;
+    case "MemberOf":
+      collectCalleeRefs(t3.obj, out2);
+      return;
+    case "TypeOf":
+      out2.push(t3.ref);
+      return;
+    default:
+      return;
+  }
+}
+function collectRefsInType(t3, out2) {
+  switch (t3.kind) {
+    case "TypeOf":
+      out2.push(t3.ref);
+      return;
+    case "Union":
+      for (const u3 of t3.types)
+        collectRefsInType(u3, out2);
+      return;
+    case "ReturnTypeOf":
+      collectRefsInType(t3.callee, out2);
+      for (const a3 of t3.args)
+        collectRefsInType(a3, out2);
+      return;
+    case "Function":
+      for (const r2 of t3.returns)
+        collectRefsInType(r2, out2);
+      return;
+    case "Object":
+      for (const v of Object.values(t3.props))
+        collectRefsInType(v, out2);
+      return;
+    case "Array":
+      for (const e of t3.elements)
+        collectRefsInType(e, out2);
+      return;
+    case "MemberOf":
+      collectRefsInType(t3.obj, out2);
+      return;
+    case "ParameterOf":
+      return;
+    default:
+      return;
+  }
+}
+function resolveRefToDecl(ref, callerFile, callerGraph, graph) {
+  const localKey = `${MODULE_SCOPE}::${ref.symbol}`;
+  const localDecl = callerGraph.declarations.get(localKey);
+  if (localDecl)
+    return { file: callerFile, decl: localDecl };
+  const imp = callerGraph.importsByLocal.get(ref.symbol);
+  if (!imp)
+    return null;
+  const resolvedAbs = graph.moduleResolver(callerFile, imp.specifier);
+  if (!resolvedAbs)
+    return null;
+  const targetFile = graphKeyFor(graph, resolvedAbs) ?? resolvedAbs;
+  const targetGraph = graph.files.get(targetFile);
+  if (!targetGraph)
+    return null;
+  const chained = followReExportChain(graph, targetFile, imp.imported);
+  if (chained) {
+    const chainedGraph = graph.files.get(chained.file);
+    if (chainedGraph) {
+      const decl = chainedGraph.declarations.get(`${MODULE_SCOPE}::${chained.localExport}`);
+      if (decl)
+        return { file: chained.file, decl };
+    }
+  }
+  for (const exp of targetGraph.exports) {
+    if (exp.kind === "named" && "local" in exp && exp.exportedAs === imp.imported) {
+      const decl = targetGraph.declarations.get(`${MODULE_SCOPE}::${exp.local}`);
+      if (decl)
+        return { file: targetFile, decl };
+    }
+    if (exp.kind === "default" && "local" in exp && imp.imported === "default") {
+      const decl = targetGraph.declarations.get(`${MODULE_SCOPE}::${exp.local}`);
+      if (decl)
+        return { file: targetFile, decl };
+    }
+  }
+  return null;
+}
+
 // ../reference-graph/dist/engine/owner-resolution.js
 function resolveOwnerChain(ownerRef, graph, helperIndex, guard) {
   if (!ownerRef)
@@ -96264,24 +96446,10 @@ function narrowTo(registry, entries) {
     isComponent: (filePath, name, declaration2) => registry.isComponent(filePath, name, declaration2),
     declarationOf: (filePath, exportName) => registry.declarationOf(filePath, exportName),
     isRenderedAsTag: (entry) => registry.isRenderedAsTag(entry),
-    isTagged: (filePath, name, declaration2) => registry.isTagged(filePath, name, declaration2),
+    isTagged: (declaration2) => registry.isTagged(declaration2),
     localEntries: () => entries
   };
 }
-var CAN_HOLD_A_FUNCTION = {
-  TypeOf: true,
-  Function: true,
-  ReturnTypeOf: true,
-  ParameterOf: false,
-  MemberOf: true,
-  Union: true,
-  Object: false,
-  Array: false,
-  JSX: false,
-  Str: false,
-  Unknown: false,
-  DynamicImport: true
-};
 function buildComponentRegistry(graph, tagged = []) {
   const consumed = /* @__PURE__ */ new Set();
   for (const [file, fg] of graph.files) {
@@ -96304,25 +96472,8 @@ function buildComponentRegistry(graph, tagged = []) {
         consumed.add(entryKey(target.file, target.symbol));
     }
   }
-  const taggedDeclaration = (filePath, name, declaration2) => {
-    const fg = graph.files.get(filePath);
-    if (fg === void 0)
-      return void 0;
-    if (declaration2 !== void 0)
-      return declaration2;
-    const named = findDeclaration(fg, name);
-    return named !== void 0 && CAN_HOLD_A_FUNCTION[named.value.kind] ? named : void 0;
-  };
-  const renderedAsTag = /* @__PURE__ */ new Set();
-  for (const { filePath, exportName, declaration: declaration2 } of tagged) {
-    const marked = taggedDeclaration(filePath, exportName, declaration2);
-    if (marked !== void 0)
-      renderedAsTag.add(marked);
-  }
-  const isTagged = (filePath, name, declaration2) => {
-    const marked = taggedDeclaration(filePath, name, declaration2);
-    return marked !== void 0 && renderedAsTag.has(marked);
-  };
+  const renderedAsTag = new Set(tagged);
+  const isTagged = (declaration2) => declaration2 !== void 0 && renderedAsTag.has(declaration2);
   const byKey = /* @__PURE__ */ new Map();
   const entryIndex = /* @__PURE__ */ new Map();
   const entries = [];
@@ -96473,7 +96624,7 @@ function resolve5(graph, opts) {
   const argMap = createArgumentMap();
   const tagEvaluations = /* @__PURE__ */ new Map();
   for (const [filePath, fileGraph] of graph.files) {
-    tagEvaluations.set(filePath, fileGraph.jsxUsages.map((usage) => evaluateJsxUsage(graph, filePath, fileGraph, usage, argMap)));
+    tagEvaluations.set(filePath, fileGraph.jsxUsages.map((usage) => evaluateJsxUsage(graph, fileGraph, usage, argMap)));
   }
   const registry = buildComponentRegistry(graph, taggedDeclarations(graph, tagEvaluations));
   const helperIndex = buildHelperCallers(graph, excludeHostElementNames(registry, graph));
@@ -96715,32 +96866,6 @@ function relabelExternalLeaf(rawComponentId, filePath, specifier, resolveExterna
     source: externalSource(hit.leafPackage, `${hit.leafPackage}/${hit.modulePath}`)
   };
 }
-function workspaceSiblingFallback(graph, resolvedTarget, matchedImport, effectiveImported, consumerDialect) {
-  if (!resolvedTarget)
-    return void 0;
-  const chained = followReExportChain(graph, resolvedTarget, effectiveImported);
-  const canonicalFile = chained?.file ?? resolvedTarget;
-  let exportName = chained?.localExport ?? effectiveImported;
-  if (!chained) {
-    const target = graph.files.get(resolvedTarget);
-    if (!target)
-      return void 0;
-    if (effectiveImported === "default") {
-      const def = target.exports.find((e) => e.kind === "default");
-      if (def && "local" in def)
-        exportName = def.local;
-    } else {
-      const named = target.exports.find((e) => e.kind === "named" && "exportedAs" in e && e.exportedAs === effectiveImported && "local" in e);
-      if (named && "local" in named)
-        exportName = named.local;
-    }
-  }
-  return {
-    kind: componentKindFor(consumerDialect),
-    export: exportName,
-    source: { type: "local", filePath: canonicalFile }
-  };
-}
 function emitOccurrence(occurrences, site, rawComponentId, owners, chain, definition) {
   const provisionalId = serialiseComponentId(rawComponentId);
   for (const { rawOwnerComponentId, viaPrefix } of owners) {
@@ -96785,136 +96910,74 @@ function usageOwners(graph, helperIndex, ownerRef, viaOverride, fallbackFile) {
 function namesObjectMember(holder, path5) {
   return path5.length === 0 || memberOfObjectPath(holder, path5) !== void 0;
 }
-function evaluateJsxUsage(graph, filePath, fileGraph, usage, argMap) {
+function evaluateJsxUsage(graph, fileGraph, usage, argMap) {
   if (fileGraph.dialect === "react" && isHostElementRoot(usage.ref))
     return { kind: "host-element" };
-  const matchedImport = fileGraph.importsByLocal.get(usage.ref.symbol);
-  if (!matchedImport) {
-    const decl = findLocalDeclaration(fileGraph, usage.ref);
-    if (!decl)
-      return { kind: "unbound" };
-    const value = usage.ref.memberChain.length > 0 ? resolveReference(graph, fileGraph, usage.ref) : decl.value;
-    const evaluation = walkWithFolding(graph, fileGraph, value, argMap, createCycleGuard(), void 0, "tag");
-    const fallback2 = {
-      kind: componentKindFor(fileGraph.dialect),
-      export: compoundExportName(usage.ref.symbol, usage.ref.memberChain),
-      source: { type: "local", filePath }
-    };
-    const definition = { line: decl.loc.line, column: decl.loc.column };
-    const outerVia2 = { kind: "local-component" };
-    const rendered = usage.ref.memberChain.length === 0 ? { declaration: decl } : {};
-    const named = namesObjectMember(decl.value, usage.ref.memberChain);
-    const credits = creditedTerminals(evaluation).filter((t3) => t3.identity !== null || named).map((terminal) => ({
-      terminal,
-      fallback: fallback2,
-      outerVia: outerVia2,
-      ...terminal.identity === null ? { definition, ...rendered } : {}
-    }));
-    return { kind: "evaluated", evaluation, value, credits };
-  }
-  const packageName = packageNameFromSpecifier(matchedImport.specifier);
-  const effectiveImported = effectiveExportName(matchedImport.imported, usage.ref.memberChain);
-  const residual = residualMemberChain(matchedImport.imported, usage.ref.memberChain);
-  const holderDecl = (file, exportName) => {
-    const holderFile = graph.files.get(file);
-    return holderFile === void 0 ? void 0 : findDeclaration(holderFile, exportName);
-  };
-  const holderDefinition = (file, exportName) => {
-    if (residual.length === 0)
-      return void 0;
-    const loc = holderDecl(file, exportName)?.loc;
-    return loc === void 0 ? void 0 : { line: loc.line, column: loc.column };
+  const binding2 = resolveBinding(graph, fileGraph, usage.ref);
+  const imp = fileGraph.importsByLocal.get(usage.ref.symbol);
+  const walkTag = (value) => walkWithFolding(graph, fileGraph, value, argMap, createCycleGuard(), void 0, "tag");
+  const walked = () => {
+    const value = bindingValue(binding2);
+    return { kind: "evaluated", evaluation: walkTag(value), value, credits: [] };
   };
-  const namesHolderMember = (file, exportName) => namesObjectMember(holderDecl(file, exportName)?.value, residual);
-  const outerVia = {
-    kind: "direct-import",
-    specifier: matchedImport.specifier,
-    import: matchedImport.imported
-  };
-  if (!packageName) {
-    const resolvedAbsTarget2 = graph.moduleResolver(filePath, matchedImport.specifier);
-    if (!resolvedAbsTarget2)
-      return { kind: "import-failed", specifier: matchedImport.specifier };
-    const resolvedTarget = graph.resolveToGraphKey ? graph.resolveToGraphKey(resolvedAbsTarget2) ?? resolvedAbsTarget2 : resolvedAbsTarget2;
-    const refType = resolveReference(graph, fileGraph, usage.ref);
-    const evaluation = walkWithFolding(graph, fileGraph, refType, argMap, createCycleGuard(), void 0, "tag");
-    const jsxTerminals = creditedTerminals(evaluation);
-    if (jsxTerminals.length === 0)
-      return { kind: "evaluated", evaluation, value: refType, credits: [] };
-    const chained = followReExportChain(graph, resolvedTarget, effectiveImported);
-    const canonicalFile = chained?.file ?? resolvedTarget;
-    let exportName = chained?.localExport ?? effectiveImported;
-    if (!chained) {
-      const targetGraph = graph.files.get(resolvedTarget);
-      if (targetGraph && effectiveImported === "default") {
-        const defaultExp = targetGraph.exports.find((e) => e.kind === "default");
-        if (defaultExp && "local" in defaultExp) {
-          exportName = defaultExp.local;
-        }
-      } else if (targetGraph) {
-        const namedExp = targetGraph.exports.find((e) => e.kind === "named" && "exportedAs" in e && e.exportedAs === effectiveImported && "local" in e);
-        if (namedExp && "local" in namedExp) {
-          exportName = namedExp.local;
-        }
-      }
-    }
-    const fallback2 = {
-      kind: componentKindFor(fileGraph.dialect),
-      export: compoundExportName(exportName, residual),
-      source: { type: "local", filePath: canonicalFile }
-    };
-    const definition = holderDefinition(canonicalFile, exportName);
-    const named = namesHolderMember(canonicalFile, exportName);
-    const credits = jsxTerminals.filter((t3) => t3.identity !== null || named).map((terminal) => ({
-      terminal,
-      fallback: fallback2,
-      outerVia,
-      ...terminal.identity === null && definition !== void 0 ? { definition } : {}
-    }));
-    return { kind: "evaluated", evaluation, value: refType, credits };
+  switch (binding2.kind) {
+    // Transitional: these two arms read `walkIdentity`, which only a name or
+    // import that fails inside a parsed file carries, to tell that failure
+    // from the usage's own. They change when those failures stop naming the
+    // parsed file in walks.
+    case "unbound":
+      return binding2.walkIdentity === void 0 ? { kind: "unbound" } : walked();
+    case "import-failed":
+      return binding2.walkIdentity === void 0 ? { kind: "import-failed", specifier: binding2.specifier } : walked();
+    case "no-export":
+      return walked();
+    case "declaration": {
+      const value = bindingValue(binding2);
+      const evaluation = walkTag(value);
+      const declared = makeLocalComponentId(binding2.file, compoundExportName(binding2.decl.symbol, binding2.path), fileGraph.dialect);
+      const fallback = buildComponentId(bindingIdentity(binding2), declared, fileGraph.dialect);
+      const holder = binding2.walkIdentity === void 0 ? binding2.decl : void 0;
+      const definition = holder !== void 0 && (binding2.inScope || binding2.path.length > 0) ? { line: holder.loc.line, column: holder.loc.column } : void 0;
+      const rendered = holder !== void 0 && binding2.path.length === 0 ? { declaration: holder } : {};
+      const namesMember = namesObjectMember(holder?.value, binding2.path);
+      const outerVia = binding2.inScope || imp === void 0 ? { kind: "local-component" } : { kind: "direct-import", specifier: imp.specifier, import: imp.imported };
+      const credits = creditedTerminals(evaluation).filter((terminal) => terminal.identity !== null || namesMember).map((terminal) => ({
+        terminal,
+        fallback,
+        outerVia,
+        ...terminal.identity === null ? { ...definition !== void 0 ? { definition } : {}, ...rendered } : {}
+      }));
+      return { kind: "evaluated", evaluation, value, credits };
+    }
+    case "package-export":
+    case "unparsed": {
+      if (binding2.mainGap !== void 0 || imp === void 0 || binding2.kind === "unparsed" && packageNameFromSpecifier(imp.specifier) === null) {
+        return walked();
+      }
+      const pinned = binding2.kind === "unparsed" ? pinUnparsed(graph, binding2) : binding2;
+      const sentinel = { denotation: { kind: "foreign" }, viaTrail: [], identity: null };
+      const fallback = {
+        kind: componentKindFor(fileGraph.dialect),
+        export: compoundExportName(pinned.exportName, pinned.path),
+        source: pinned.kind === "unparsed" ? { type: "local", filePath: pinned.file } : externalSource(packageNameFromSpecifier(pinned.specifier) ?? pinned.specifier, pinned.specifier)
+      };
+      return {
+        kind: "evaluated",
+        evaluation: [sentinel],
+        value: null,
+        credits: [
+          {
+            terminal: sentinel,
+            fallback,
+            fallbackSpecifier: pinned.kind === "package-export" ? pinned.specifier : imp.specifier,
+            outerVia: { kind: "direct-import", specifier: imp.specifier, import: imp.imported }
+          }
+        ]
+      };
+    }
+    default:
+      return assertNever(binding2);
   }
-  const externalFallback = {
-    kind: componentKindFor(fileGraph.dialect),
-    export: compoundExportName(effectiveImported, residual),
-    source: externalSource(packageName, matchedImport.specifier)
-  };
-  const resolvedAbsTarget = graph.moduleResolver(filePath, matchedImport.specifier);
-  const resolvedNormTarget = resolvedAbsTarget !== null && graph.resolveToGraphKey ? graph.resolveToGraphKey(resolvedAbsTarget) ?? resolvedAbsTarget : resolvedAbsTarget;
-  const targetInGraph = resolvedNormTarget !== null && graph.files.has(resolvedNormTarget);
-  if (targetInGraph) {
-    const refType = resolveReference(graph, fileGraph, usage.ref);
-    const evaluation = walkWithFolding(graph, fileGraph, refType, argMap, createCycleGuard(), void 0, "tag");
-    const jsxTerminals = creditedTerminals(evaluation);
-    if (jsxTerminals.length === 0)
-      return { kind: "evaluated", evaluation, value: refType, credits: [] };
-    const siblingFallback = workspaceSiblingFallback(graph, resolvedNormTarget, matchedImport, effectiveImported, fileGraph.dialect);
-    const localFallback = siblingFallback !== void 0 && siblingFallback.kind !== "custom-element" ? { ...siblingFallback, export: compoundExportName(siblingFallback.export, residual) } : siblingFallback;
-    const localHolder = siblingFallback !== void 0 && siblingFallback.kind !== "custom-element" && siblingFallback.source.type === "local" ? { filePath: siblingFallback.source.filePath, exportName: siblingFallback.export } : void 0;
-    const definition = localHolder === void 0 ? void 0 : holderDefinition(localHolder.filePath, localHolder.exportName);
-    const named = localHolder === void 0 || namesHolderMember(localHolder.filePath, localHolder.exportName);
-    const fallback2 = localFallback ?? externalFallback;
-    const credits = jsxTerminals.filter((t3) => t3.identity !== null || named).map((terminal) => ({
-      terminal,
-      fallback: fallback2,
-      fallbackSpecifier: matchedImport.specifier,
-      outerVia,
-      ...terminal.identity === null && definition !== void 0 ? { definition } : {}
-    }));
-    return { kind: "evaluated", evaluation, value: refType, credits };
-  }
-  const member = resolvedAbsTarget !== null ? unparsedMemberDefinition(graph, resolvedAbsTarget, effectiveImported) : null;
-  const sentinel = { denotation: { kind: "foreign" }, viaTrail: [], identity: null };
-  const fallback = member !== null ? {
-    kind: componentKindFor(fileGraph.dialect),
-    export: compoundExportName(member.exportName, residual),
-    source: { type: "local", filePath: member.absFile }
-  } : externalFallback;
-  return {
-    kind: "evaluated",
-    evaluation: [sentinel],
-    value: null,
-    credits: [{ terminal: sentinel, fallback, fallbackSpecifier: matchedImport.specifier, outerVia }]
-  };
 }
 function carriedDeclaration(credit) {
   const { identity } = credit.terminal;
@@ -96936,7 +96999,8 @@ function taggedDeclarations(graph, tagEvaluations) {
         const id2 = buildComponentId(identity, credit.fallback, dialect);
         if (id2.kind === "react-component" && id2.source.type === "local") {
           const declaration2 = carriedDeclaration(credit);
-          tagged.push({ filePath: id2.source.filePath, exportName: id2.export, ...declaration2 !== void 0 ? { declaration: declaration2 } : {} });
+          if (declaration2 !== void 0)
+            tagged.push(declaration2);
         }
       }
     }
@@ -97054,14 +97118,14 @@ function registryTagged(registry, graph, id2, declaration2) {
     return true;
   if (parseCompoundExport2(id2.export).isCompound)
     return true;
-  return registry.isTagged(id2.source.filePath, id2.export, declaration2);
+  return registry.isTagged(declaration2);
 }
 function pushCallArgumentOccurrences(occurrences, filePath, call, owners, graph, fileGraph, argMap, registry, opts, depth = 0) {
   let resolvedOwners;
   const seedIdentifier = (site, index, arg, hops) => {
     if (isHostElementName(arg.ref.symbol))
       return;
-    const outerVia = { kind: "passed-as-argument", index, ...argumentProvenance(site, arg, fileGraph) };
+    const outerVia = { kind: "passed-as-argument", index, ...argumentProvenance(graph, site, arg, fileGraph) };
     const argDecl = findLocalDeclaration(fileGraph, arg.ref);
     const unusedFallback = makeLocalComponentId(filePath, arg.ref.symbol, fileGraph.dialect);
     for (const ft of creditedTerminals(walkWithFolding(graph, fileGraph, arg, argMap))) {
@@ -97071,7 +97135,7 @@ function pushCallArgumentOccurrences(occurrences, filePath, call, owners, graph,
         filePath,
         resolveExternalLeaf: opts?.resolveExternalLeaf
       });
-      if (!registryHolds(registry, graph, rawComponentId))
+      if (!registryHolds(registry, graph, rawComponentId, ft.identity.kind === "local" ? ft.identity.declaration : void 0))
         continue;
       resolvedOwners ??= owners();
       emitOccurrence(occurrences, { filePath, line: arg.ref.loc.line, column: arg.ref.loc.column, props: {}, events: [] }, rawComponentId, resolvedOwners, [outerVia, ...hops, ...ft.viaTrail], argDecl !== null ? { line: argDecl.loc.line, column: argDecl.loc.column } : void 0);
@@ -102177,7 +102241,7 @@ init_upload();
 import { errorMessage as errorMessage2 } from "@component-compass/ast-utils";
 
 // src/seeds.ts
-import { relative as relative4, isAbsolute as isAbsolute8 } from "node:path";
+import { relative as relative4, isAbsolute as isAbsolute9 } from "node:path";
 import { posixPath as posixPath6 } from "@component-compass/plugin-core";
 
 // src/composition-rollup.ts
@@ -102540,7 +102604,7 @@ function buildComponentSeeds(parseResults, localIndex, repoRoot, workspaceGraph,
   const seedsById = /* @__PURE__ */ new Map();
   for (const result2 of parseResults) {
     for (const occ of result2.occurrences) {
-      const componentId = repoRoot && occ.componentId.source.type === "local" && isAbsolute8(occ.componentId.source.filePath) ? {
+      const componentId = repoRoot && occ.componentId.source.type === "local" && isAbsolute9(occ.componentId.source.filePath) ? {
         ...occ.componentId,
         source: {
           type: "local",
@@ -102685,7 +102749,7 @@ function indexedToComponentId(c2) {
 }
 
 // src/occurrences.ts
-import { relative as relative5, isAbsolute as isAbsolute9 } from "node:path";
+import { relative as relative5, isAbsolute as isAbsolute10 } from "node:path";
 import { posixPath as posixPath7 } from "@component-compass/plugin-core";
 import {
   computeOccurrenceId as computeOccurrenceId2,
@@ -102694,14 +102758,14 @@ import {
 function normaliseLocalFilePath(c2, repoRoot) {
   if (c2.source.type !== "local") return c2;
   const fp = c2.source.filePath;
-  if (!isAbsolute9(fp)) return c2;
+  if (!isAbsolute10(fp)) return c2;
   return {
     ...c2,
     source: { type: "local", filePath: posixPath7(relative5(repoRoot, fp)) }
   };
 }
 function toRelativePath2(absPath, repoRoot) {
-  if (!repoRoot || !isAbsolute9(absPath)) return absPath;
+  if (!repoRoot || !isAbsolute10(absPath)) return absPath;
   return posixPath7(relative5(repoRoot, absPath));
 }
 function parseResultsToOccurrences(results, repoRoot = "") {
@@ -102901,19 +102965,19 @@ function createBoundedDefinitionResolver(opts) {
 
 // src/scan/global-components.ts
 import { existsSync as existsSync7, readFileSync as readFileSync11 } from "node:fs";
-import { dirname as dirname11, isAbsolute as isAbsolute10, join as join14, resolve as resolve10 } from "node:path";
+import { dirname as dirname11, isAbsolute as isAbsolute11, join as join14, resolve as resolve10 } from "node:path";
 var CANDIDATE_PATHS = [join14(".nuxt", "components.d.ts"), join14(".nuxt", "types", "components.d.ts")];
 var AUGMENTED_MODULE = /declare\s+module\s+["'](?:vue|@vue\/runtime-core)["']\s*\{/g;
 var INTERFACE_DECL = /(?:^|[\s;}])(?:export\s+)?(?:declare\s+)?interface\s+([A-Za-z_$][\w$]*)\s*(?:extends\s+([^{]*?))?\s*\{/g;
 var MEMBER = /^\s*(?:["']([^"']+)["']|([A-Za-z_$][\w$]*))\??\s*:\s*.*typeof import\(["']([^"']+)["']\)\[["']([^"']+)["']\]/;
-function matchingBlock(source, open) {
+function matchingBlock(source, open2) {
   let depth = 0;
-  for (let i2 = open; i2 < source.length; i2++) {
+  for (let i2 = open2; i2 < source.length; i2++) {
     const ch = source[i2];
     if (ch === "{") depth++;
     else if (ch === "}") {
       depth--;
-      if (depth === 0) return { body: source.slice(open + 1, i2), end: i2 };
+      if (depth === 0) return { body: source.slice(open2 + 1, i2), end: i2 };
     }
   }
   return null;
@@ -102922,8 +102986,8 @@ function collectInterfaces(source) {
   const out2 = [];
   INTERFACE_DECL.lastIndex = 0;
   for (let m = INTERFACE_DECL.exec(source); m !== null; m = INTERFACE_DECL.exec(source)) {
-    const open = m.index + m[0].length - 1;
-    const block2 = matchingBlock(source, open);
+    const open2 = m.index + m[0].length - 1;
+    const block2 = matchingBlock(source, open2);
     if (block2 === null) continue;
     out2.push({
       name: m[1],
@@ -102931,7 +102995,7 @@ function collectInterfaces(source) {
       body: block2.body,
       start: m.index
     });
-    INTERFACE_DECL.lastIndex = open + 1;
+    INTERFACE_DECL.lastIndex = open2 + 1;
   }
   return out2;
 }
@@ -102939,8 +103003,8 @@ function augmentedRanges(source) {
   const out2 = [];
   AUGMENTED_MODULE.lastIndex = 0;
   for (let m = AUGMENTED_MODULE.exec(source); m !== null; m = AUGMENTED_MODULE.exec(source)) {
-    const open = m.index + m[0].length - 1;
-    const block2 = matchingBlock(source, open);
+    const open2 = m.index + m[0].length - 1;
+    const block2 = matchingBlock(source, open2);
     if (block2 === null) continue;
     out2.push([m.index, block2.end]);
     AUGMENTED_MODULE.lastIndex = block2.end;
@@ -102995,7 +103059,7 @@ function loadGlobalComponents(scanRoot) {
   return null;
 }
 function isBareSpecifier(importPath) {
-  if (isAbsolute10(importPath)) return false;
+  if (isAbsolute11(importPath)) return false;
   return !/^[.#~\\/]/.test(importPath) && !importPath.startsWith("@/");
 }
 function parseMembers(baseDir, members) {
@@ -103011,7 +103075,7 @@ function parseMembers(baseDir, members) {
     if (isBareSpecifier(importPath)) {
       specifier = importPath;
     } else {
-      const abs = isAbsolute10(importPath) ? importPath : resolve10(baseDir, importPath);
+      const abs = isAbsolute11(importPath) ? importPath : resolve10(baseDir, importPath);
       const posixAbs = abs.replaceAll("\\", "/");
       const nmIdx = posixAbs.lastIndexOf("node_modules/");
       if (nmIdx >= 0) {
@@ -103077,7 +103141,7 @@ async function runScan(opts) {
   if (repoIdOverride !== void 0) metaOpts.repoIdOverride = repoIdOverride;
   const meta = await stampMeta(metaOpts);
   const gitToplevel = await readGitToplevel(cfg.configDir);
-  const outputRoot = opts.repoRoot ? isAbsolute11(opts.repoRoot) ? opts.repoRoot : resolve11(opts.cwd ?? process.cwd(), opts.repoRoot) : gitToplevel && !relative6(gitToplevel, cfg.configDir).startsWith("..") ? gitToplevel : cfg.configDir;
+  const outputRoot = opts.repoRoot ? isAbsolute12(opts.repoRoot) ? opts.repoRoot : resolve11(opts.cwd ?? process.cwd(), opts.repoRoot) : gitToplevel && !relative6(gitToplevel, cfg.configDir).startsWith("..") ? gitToplevel : cfg.configDir;
   const rebase = (scanRel) => outputRoot === cfg.configDir ? scanRel : posixPath8(relative6(outputRoot, resolve11(cfg.configDir, scanRel)));
   if (opts.outputOverride) cfg.output = opts.outputOverride;
   const writer = opts.quiet ? () => {
@@ -103344,7 +103408,7 @@ async function runScan(opts) {
     // `snapshotManifestRefs()` — otherwise an undeclared package's full CEM
     // catalog gets broadcast as zero-occurrence components.
     resolveExternalLeaf: (fromFile, specifier, exportName) => {
-      const absFrom = isAbsolute11(fromFile) ? fromFile : resolve11(cfg.configDir, fromFile);
+      const absFrom = isAbsolute12(fromFile) ? fromFile : resolve11(cfg.configDir, fromFile);
       const hit = warmedResolver.lookupExternalLeaf(absFrom, specifier, exportName);
       if (!hit) return null;
       return { leafPackage: hit.leafPackage, modulePath: hit.modulePath, exportName: hit.exportName };
@@ -103364,7 +103428,7 @@ async function runScan(opts) {
   }
   const diagnostics = rawDiagnostics.map((d2) => ({
     ...d2,
-    filePath: isAbsolute11(d2.filePath) ? posixPath8(relative6(outputRoot, d2.filePath)) : d2.filePath
+    filePath: isAbsolute12(d2.filePath) ? posixPath8(relative6(outputRoot, d2.filePath)) : d2.filePath
   }));
   const snapshot = warmedResolver.snapshotComponents().map((c2) => ({ component: c2 }));
   const manifests = warmedResolver.snapshotManifestRefs();
@@ -103468,7 +103532,7 @@ async function runScan(opts) {
   };
   await stampGitMTime(outputRoot, scanOutput.components);
   await stampVersion(outputRoot, scanOutput.components, scanOutput.occurrences);
-  const outputPath = isAbsolute11(cfg.output) ? cfg.output : resolve11(cfg.configDir, cfg.output);
+  const outputPath = isAbsolute12(cfg.output) ? cfg.output : resolve11(cfg.configDir, cfg.output);
   await writeJson(scanOutput, outputPath);
   if (!opts.quiet) {
     printSummary(scanOutput, outputPath);
@@ -103516,14 +103580,14 @@ function countFilesWithUsage(occurrences) {
 function normaliseEngineLocalId(c2, configDir2, rebase) {
   if (c2.source.type !== "local") return c2;
   const fp = c2.source.filePath;
-  const scanRel = isAbsolute11(fp) ? posixPath8(relative6(configDir2, fp)) : fp;
+  const scanRel = isAbsolute12(fp) ? posixPath8(relative6(configDir2, fp)) : fp;
   return {
     ...c2,
     source: { type: "local", filePath: rebase(scanRel) }
   };
 }
 function normaliseVia(v, configDir2, rebase) {
-  if (!("specifier" in v) || v.specifier === void 0 || !isAbsolute11(v.specifier)) return v;
+  if (!("specifier" in v) || v.specifier === void 0 || !isAbsolute12(v.specifier)) return v;
   const scanRel = posixPath8(relative6(configDir2, v.specifier));
   return { ...v, specifier: rebase(scanRel) };
 }
@@ -103531,7 +103595,7 @@ function normaliseVia(v, configDir2, rebase) {
 // src/commands/init.ts
 init_adapter();
 import { writeFile as writeFile3, stat as stat2, readFile as readFile6 } from "node:fs/promises";
-import { basename as basename5, isAbsolute as isAbsolute12, resolve as resolve12 } from "node:path";
+import { basename as basename6, isAbsolute as isAbsolute13, resolve as resolve12 } from "node:path";
 var DEFAULT_INCLUDE = "src/**/*.{ts,tsx,jsx,js,vue,html}";
 var FRAMEWORK_EXTS = {
   react: ["ts", "tsx", "js", "jsx"],
@@ -103563,7 +103627,7 @@ function buildConfig(o2) {
   };
 }
 async function runInit(opts) {
-  const cwd2 = isAbsolute12(opts.cwd) ? opts.cwd : resolve12(opts.cwd);
+  const cwd2 = isAbsolute13(opts.cwd) ? opts.cwd : resolve12(opts.cwd);
   const out2 = opts.outputPath ?? resolve12(cwd2, "component-compass.config.json");
   await assertNoExistingConfig(out2);
   const repoId = opts.repoId ?? await deriveRepoId(cwd2);
@@ -103634,7 +103698,7 @@ async function deriveRepoId(cwd2) {
     if (pkg.name) return pkg.name;
   } catch {
   }
-  return basename5(cwd2) || "unknown";
+  return basename6(cwd2) || "unknown";
 }
 
 // src/cli.ts
@@ -103687,8 +103751,8 @@ Options:
 `;
 var AUTH = `component-compass auth <login|logout|status> [--host <url>]
 
-  login   Device-flow browser login; stores tokens in ~/.config/component-compass/hosts.json
-  logout  Remove stored tokens for a host
+  login   Device-flow browser login; stores a session in ~/.config/component-compass/hosts.json
+  logout  Revoke a session for a host
   status  Show the signed-in identity
 `;
 var REGISTRY = { scan: SCAN, init: INIT, auth: AUTH };