@component-compass/cli 0.1.26 → 0.1.27

package/dist/cli.js

@@ -7554,16 +7554,16 @@ var require_parse = __commonJS({
         const analysis = analyzeRepeatedExtglob(body, opts);
         if ((token.type === "plus" || token.type === "star") && analysis.risky) {
           const safeOutput = analysis.safeOutput ? (token.output ? "" : ONE_CHAR) + (opts.capture ? `(${analysis.safeOutput})` : analysis.safeOutput) : void 0;
-          const open = tokens[token.tokensIndex];
-          open.type = "text";
-          open.value = literal;
-          open.output = safeOutput || utils.escapeRegex(literal);
+          const open2 = tokens[token.tokensIndex];
+          open2.type = "text";
+          open2.value = literal;
+          open2.output = safeOutput || utils.escapeRegex(literal);
           for (let i2 = token.tokensIndex + 1; i2 < tokens.length; i2++) {
             tokens[i2].value = "";
             tokens[i2].output = "";
             delete tokens[i2].suffix;
           }
-          state.output = token.output + open.output;
+          state.output = token.output + open2.output;
           state.backtrack = true;
           push({ type: "paren", extglob: true, value, output: "" });
           decrement("parens");
@@ -7783,15 +7783,15 @@ var require_parse = __commonJS({
         }
         if (value === "{" && opts.nobrace !== true) {
           increment("braces");
-          const open = {
+          const open2 = {
             type: "brace",
             value,
             output: "(",
             outputIndex: state.output.length,
             tokensIndex: state.tokens.length
           };
-          braces.push(open);
-          push(open);
+          braces.push(open2);
+          push(open2);
           continue;
         }
         if (value === "}") {
@@ -37172,9 +37172,9 @@ var require_is_glob = __commonJS({
           }
         }
         if (str[index] === "\\") {
-          var open = str[index + 1];
+          var open2 = str[index + 1];
           index += 2;
-          var close = chars2[open];
+          var close = chars2[open2];
           if (close) {
             var n2 = str.indexOf(close, index);
             if (n2 !== -1) {
@@ -37200,9 +37200,9 @@ var require_is_glob = __commonJS({
           return true;
         }
         if (str[index] === "\\") {
-          var open = str[index + 1];
+          var open2 = str[index + 1];
           index += 2;
-          var close = chars2[open];
+          var close = chars2[open2];
           if (close) {
             var n2 = str.indexOf(close, index);
             if (n2 !== -1) {
@@ -38166,7 +38166,7 @@ var require_parse2 = __commonJS({
           continue;
         }
         if (value === CHAR_DOUBLE_QUOTE || value === CHAR_SINGLE_QUOTE || value === CHAR_BACKTICK) {
-          const open = value;
+          const open2 = value;
           let next;
           if (options.keepQuotes !== true) {
             value = "";
@@ -38176,7 +38176,7 @@ var require_parse2 = __commonJS({
               value += next + advance();
               continue;
             }
-            if (next === open) {
+            if (next === open2) {
               if (options.keepQuotes === true) value += next;
               break;
             }
@@ -38219,8 +38219,8 @@ var require_parse2 = __commonJS({
         if (value === CHAR_COMMA && depth > 0) {
           if (block2.ranges > 0) {
             block2.ranges = 0;
-            const open = block2.nodes.shift();
-            block2.nodes = [open, { type: "text", value: stringify2(block2) }];
+            const open2 = block2.nodes.shift();
+            block2.nodes = [open2, { type: "text", value: stringify2(block2) }];
           }
           push({ type: "comma", value });
           block2.commas++;
@@ -39318,16 +39318,16 @@ var require_parse3 = __commonJS({
         const analysis = analyzeRepeatedExtglob(body, opts);
         if ((token.type === "plus" || token.type === "star") && analysis.risky) {
           const safeOutput = analysis.safeOutput ? (token.output ? "" : ONE_CHAR) + (opts.capture ? `(${analysis.safeOutput})` : analysis.safeOutput) : void 0;
-          const open = tokens[token.tokensIndex];
-          open.type = "text";
-          open.value = literal;
-          open.output = safeOutput || utils.escapeRegex(literal);
+          const open2 = tokens[token.tokensIndex];
+          open2.type = "text";
+          open2.value = literal;
+          open2.output = safeOutput || utils.escapeRegex(literal);
           for (let i2 = token.tokensIndex + 1; i2 < tokens.length; i2++) {
             tokens[i2].value = "";
             tokens[i2].output = "";
             delete tokens[i2].suffix;
           }
-          state.output = token.output + open.output;
+          state.output = token.output + open2.output;
           state.backtrack = true;
           push({ type: "paren", extglob: true, value, output: "" });
           decrement("parens");
@@ -39547,15 +39547,15 @@ var require_parse3 = __commonJS({
         }
         if (value === "{" && opts.nobrace !== true) {
           increment("braces");
-          const open = {
+          const open2 = {
             type: "brace",
             value,
             output: "(",
             outputIndex: state.output.length,
             tokensIndex: state.tokens.length
           };
-          braces.push(open);
-          push(open);
+          braces.push(open2);
+          push(open2);
           continue;
         }
         if (value === "}") {
@@ -40350,8 +40350,8 @@ var require_pattern2 = __commonJS({
     }
     exports.endsWithSlashGlobStar = endsWithSlashGlobStar;
     function isAffectDepthOfReadingPattern(pattern) {
-      const basename6 = path5.basename(pattern);
-      return endsWithSlashGlobStar(pattern) || isStaticPattern(basename6);
+      const basename7 = path5.basename(pattern);
+      return endsWithSlashGlobStar(pattern) || isStaticPattern(basename7);
     }
     exports.isAffectDepthOfReadingPattern = isAffectDepthOfReadingPattern;
     function expandPatternsWithBraceExpansion(patterns) {
@@ -43241,7 +43241,7 @@ async function pollUpload(opts) {
         status = await inspect3().catch(async (err2) => {
           if (!(err2 instanceof UploadError) || err2.code !== 401) throw err2;
           signal.throwIfAborted();
-          token = await opts.refreshToken();
+          token = await opts.onUnauthorized();
           return await inspect3();
         });
       } catch (err2) {
@@ -43267,8 +43267,8 @@ async function pollUpload(opts) {
         }
         hint = status.retryAfterSeconds;
       }
-      const delay = hint !== void 0 ? hint * 1e3 : backoffDelay(attempt);
-      await wait(Math.min(2147483647, Math.max(1e3, delay)), signal);
+      const delay2 = hint !== void 0 ? hint * 1e3 : backoffDelay(attempt);
+      await wait(Math.min(2147483647, Math.max(1e3, delay2)), signal);
     }
   }
   try {
@@ -43282,7 +43282,7 @@ async function pollUpload(opts) {
     controller.abort();
   }
 }
-function wait(delay, signal) {
+function wait(delay2, signal) {
   return new Promise((resolve14, reject) => {
     signal?.throwIfAborted();
     const abort = () => {
@@ -43292,7 +43292,7 @@ function wait(delay, signal) {
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", abort);
       resolve14();
-    }, delay);
+    }, delay2);
     signal?.addEventListener("abort", abort, { once: true });
   });
 }
@@ -43389,8 +43389,10 @@ var init_paths = __esm({
 });
 
 // src/auth/store.ts
-import { mkdir as mkdir2, readFile as readFile4, writeFile as writeFile2, chmod } from "node:fs/promises";
-import { dirname as dirname12 } from "node:path";
+import { mkdir as mkdir2, readFile as readFile4, writeFile as writeFile2, chmod, rename, unlink, open } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { basename as basename5, dirname as dirname12, join as join16 } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
 function normalizeHost(input2) {
   const trimmed = input2.trim();
   if (trimmed === "") throw new Error("Host must not be empty.");
@@ -43411,107 +43413,85 @@ async function loadStore(filePath = hostsFilePath()) {
   } catch {
     throw new Error(`Token store at ${filePath} contains invalid JSON. Delete it and run \`component-compass auth login\` again.`);
   }
-  return { ...parsed.default ? { default: parsed.default } : {}, hosts: parsed.hosts ?? {} };
+  const value = typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : {};
+  const entries = typeof value.hosts === "object" && value.hosts !== null && !Array.isArray(value.hosts) ? Object.entries(value.hosts) : [];
+  const hosts = Object.fromEntries(entries.flatMap(([host, entry]) => {
+    if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return [];
+    const candidate = entry;
+    return typeof candidate.token === "string" && typeof candidate.userEmail === "string" ? [[host, { token: candidate.token, userEmail: candidate.userEmail }]] : [];
+  }));
+  return { ...typeof value.default === "string" && value.default ? { default: value.default } : {}, hosts };
 }
-async function saveStore(store, filePath = hostsFilePath()) {
+async function writeStore(store, filePath) {
   await mkdir2(dirname12(filePath), { recursive: true, mode: 448 });
-  await writeFile2(filePath, `${JSON.stringify(store, null, 2)}
-`, { mode: 384 });
-  await chmod(filePath, 384);
-}
-var init_store = __esm({
-  "src/auth/store.ts"() {
-    "use strict";
-    init_paths();
+  const tempPath = join16(dirname12(filePath), `.${basename5(filePath)}.${randomUUID()}.tmp`);
+  try {
+    await writeFile2(tempPath, `${JSON.stringify(store, null, 2)}
+`, { mode: 384, flag: "wx" });
+    await chmod(tempPath, 384);
+    await rename(tempPath, filePath);
+  } finally {
+    await unlink(tempPath).catch((error2) => {
+      if (error2.code !== "ENOENT") throw error2;
+    });
   }
-});
-
-// src/auth/client.ts
-function endpoint(base2, path5) {
-  return `${base2.replace(/\/+$/, "")}${path5}`;
-}
-async function readError(res) {
-  const body = await res.json().catch(() => ({}));
-  return body.error ?? "unknown_error";
-}
-function toTokenPair(body) {
-  return {
-    accessToken: body.access_token,
-    refreshToken: body.refresh_token,
-    expiresIn: body.expires_in,
-    ...body.email !== void 0 ? { email: body.email } : {}
-  };
-}
-async function requestDeviceCode(base2) {
-  const res = await fetch(endpoint(base2, "/api/auth/cli/device-code"), { method: "POST" });
-  if (!res.ok) throw new AuthHttpError(res.status, `device-code failed: ${await readError(res)}`);
-  const b = await res.json();
-  return {
-    deviceCode: b.device_code,
-    userCode: b.user_code,
-    verificationUri: b.verification_uri,
-    verificationUriComplete: b.verification_uri_complete,
-    expiresIn: b.expires_in,
-    interval: b.interval
-  };
 }
-async function pollToken(base2, deviceCode) {
-  const res = await fetch(endpoint(base2, "/api/auth/cli/token"), {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ device_code: deviceCode })
-  });
-  if (res.ok) {
-    return { kind: "tokens", tokens: toTokenPair(await res.json()) };
-  }
-  const error2 = await readError(res);
-  switch (error2) {
-    case "authorization_pending":
-      return { kind: "pending" };
-    case "slow_down":
-      return { kind: "slow_down" };
-    case "expired_token":
-      return { kind: "expired" };
-    case "access_denied":
-      return { kind: "denied" };
-    default:
-      throw new AuthHttpError(res.status, `token poll failed: ${error2}`);
+async function releaseStoreLock(lockPath, owner) {
+  try {
+    if (await readFile4(lockPath, "utf8") === owner) await unlink(lockPath);
+  } catch (error2) {
+    if (error2.code !== "ENOENT") throw error2;
   }
 }
-async function refreshTokens(base2, refreshToken) {
-  let res;
+async function withStoreLock(filePath, action) {
+  await mkdir2(dirname12(filePath), { recursive: true, mode: 448 });
+  const lockPath = `${filePath}.lock`;
+  const owner = `${process.pid}:${randomUUID()}`;
+  const deadline = Date.now() + LOCK_WAIT_MS;
+  while (true) {
+    if (Date.now() >= deadline) {
+      throw new StoreLockError(`Timed out waiting for credential store lock at ${lockPath}. Retry, or remove it only after confirming no CLI process is running.`);
+    }
+    try {
+      const handle = await open(lockPath, "wx", 384);
+      try {
+        await handle.writeFile(owner);
+        await handle.close();
+      } catch (error2) {
+        await handle.close().catch(() => {
+        });
+        await unlink(lockPath).catch(() => {
+        });
+        throw error2;
+      }
+      break;
+    } catch (error2) {
+      if (error2.code !== "EEXIST") throw error2;
+      await delay(LOCK_POLL_MS);
+    }
+  }
   try {
-    res = await fetch(endpoint(base2, "/api/auth/cli/refresh"), {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ refresh_token: refreshToken })
-    });
-  } catch (err2) {
-    return { kind: "transient", error: err2 instanceof Error ? err2.message : "network_error" };
+    return await action();
+  } finally {
+    await releaseStoreLock(lockPath, owner);
   }
-  if (res.ok) return { kind: "tokens", tokens: toTokenPair(await res.json()) };
-  const error2 = await readError(res);
-  const terminal = res.status === 401 && ["invalid_token", "sso_revoked", "not_authorized"].includes(error2);
-  return terminal ? { kind: "terminal", error: error2 } : { kind: "transient", error: error2 };
 }
-async function whoami(base2, accessToken) {
-  const res = await fetch(endpoint(base2, "/api/auth/cli/whoami"), {
-    headers: { Authorization: `Bearer ${accessToken}` }
+async function mutateStore(change, filePath = hostsFilePath()) {
+  return await withStoreLock(filePath, async () => {
+    const store = await loadStore(filePath);
+    const { changed, result: result2 } = change(store);
+    if (changed) await writeStore(store, filePath);
+    return result2;
   });
-  if (res.status === 401) return null;
-  if (!res.ok) throw new AuthHttpError(res.status, `whoami failed: ${await readError(res)}`);
-  return await res.json();
 }
-var AuthHttpError;
-var init_client = __esm({
-  "src/auth/client.ts"() {
+var LOCK_WAIT_MS, LOCK_POLL_MS, StoreLockError;
+var init_store = __esm({
+  "src/auth/store.ts"() {
     "use strict";
-    AuthHttpError = class extends Error {
-      constructor(status, message) {
-        super(message);
-        this.status = status;
-      }
-      status;
+    init_paths();
+    LOCK_WAIT_MS = 5e3;
+    LOCK_POLL_MS = 25;
+    StoreLockError = class extends Error {
     };
   }
 });
@@ -43519,12 +43499,15 @@ var init_client = __esm({
 // src/auth/session.ts
 var session_exports = {};
 __export(session_exports, {
-  IdpUnavailableError: () => IdpUnavailableError,
+  HostUnavailableError: () => HostUnavailableError,
   NotSignedInError: () => NotSignedInError,
   ReloginRequiredError: () => ReloginRequiredError,
+  SessionChangedError: () => SessionChangedError,
   formatAuthError: () => formatAuthError,
-  getAccessToken: () => getAccessToken,
-  resolveHost: () => resolveHost
+  getStoredSession: () => getStoredSession,
+  removeStoredSession: () => removeStoredSession,
+  resolveHost: () => resolveHost,
+  setStoredSession: () => setStoredSession
 });
 function resolveHost(opts) {
   const env2 = opts.env ?? process.env;
@@ -43536,52 +43519,39 @@ function resolveHost(opts) {
   }
   return normalizeHost(raw);
 }
-async function getAccessToken(host, deps = {}) {
-  const now = deps.now ?? Date.now;
+async function getStoredSession(host, deps = {}) {
   const base2 = normalizeHost(host);
   const store = await loadStore(deps.filePath);
   const entry = store.hosts[base2];
   if (!entry) throw new NotSignedInError(base2);
-  const stillValid = Date.parse(entry.expiresAt) - now() > EXPIRY_SKEW_MS;
-  if (stillValid && !deps.force) {
-    return { accessToken: entry.accessToken, userEmail: entry.userEmail };
-  }
-  const result2 = await refreshTokens(base2, entry.refreshToken);
-  if (result2.kind === "tokens") {
-    const updated = {
-      accessToken: result2.tokens.accessToken,
-      refreshToken: result2.tokens.refreshToken,
-      userEmail: result2.tokens.email ?? entry.userEmail,
-      expiresAt: new Date(now() + result2.tokens.expiresIn * 1e3).toISOString()
-    };
-    store.hosts[base2] = updated;
-    await saveStore(store, deps.filePath);
-    return { accessToken: updated.accessToken, userEmail: updated.userEmail };
-  }
-  if (result2.kind === "terminal") {
-    const { [base2]: _removed, ...remainingHosts } = store.hosts;
-    const cleared = {
-      hosts: remainingHosts,
-      ...store.default && store.default !== base2 ? { default: store.default } : {}
-    };
-    await saveStore(cleared, deps.filePath);
-    throw new ReloginRequiredError(base2);
-  }
-  throw new IdpUnavailableError(base2, result2.error);
+  return entry;
+}
+async function setStoredSession(host, entry, deps = {}) {
+  const base2 = normalizeHost(host);
+  await mutateStore((store) => {
+    store.hosts[base2] = entry;
+    if (!store.default) store.default = base2;
+    return { changed: true, result: void 0 };
+  }, deps.filePath);
+}
+async function removeStoredSession(host, deps) {
+  const base2 = normalizeHost(host);
+  return await mutateStore((store) => {
+    if (store.hosts[base2]?.token !== deps.expectedToken) return { changed: false, result: false };
+    const { [base2]: _removed, ...hosts } = store.hosts;
+    store.hosts = hosts;
+    if (store.default === base2) store.default = void 0;
+    return { changed: true, result: true };
+  }, deps.filePath);
 }
 function formatAuthError(err2) {
-  if (err2 instanceof NotSignedInError || err2 instanceof ReloginRequiredError || err2 instanceof IdpUnavailableError) {
-    return err2.message;
-  }
-  return null;
+  return err2 instanceof NotSignedInError || err2 instanceof ReloginRequiredError || err2 instanceof SessionChangedError || err2 instanceof HostUnavailableError ? err2.message : null;
 }
-var EXPIRY_SKEW_MS, NotSignedInError, ReloginRequiredError, IdpUnavailableError;
+var NotSignedInError, ReloginRequiredError, SessionChangedError, HostUnavailableError;
 var init_session = __esm({
   "src/auth/session.ts"() {
     "use strict";
     init_store();
-    init_client();
-    EXPIRY_SKEW_MS = 6e4;
     NotSignedInError = class extends Error {
       constructor(host) {
         super(`Not signed in to ${host}. Run \`component-compass auth login --host ${host}\`.`);
@@ -43591,19 +43561,24 @@ var init_session = __esm({
     };
     ReloginRequiredError = class extends Error {
       constructor(host) {
-        super(`Session for ${host} expired or was revoked. Run \`component-compass auth login --host ${host}\`.`);
+        super(`Session for ${host} is no longer valid. Run \`component-compass auth login --host ${host}\`.`);
+        this.host = host;
+      }
+      host;
+    };
+    SessionChangedError = class extends Error {
+      constructor(host) {
+        super(`Session changed for ${host}; retry the upload with the current sign-in.`);
         this.host = host;
       }
       host;
     };
-    IdpUnavailableError = class extends Error {
-      constructor(host, reason) {
-        super(`Could not reach the identity provider to refresh credentials for ${host} (${reason}). Check your network and retry.`);
+    HostUnavailableError = class extends Error {
+      constructor(host) {
+        super(`Could not reach ${host} to check the session. Check your network and retry.`);
         this.host = host;
-        this.reason = reason;
       }
       host;
-      reason;
     };
   }
 });
@@ -43623,28 +43598,27 @@ async function createAuthedUploader(opts) {
   });
   const { COMPONENT_COMPASS_TOKEN: ciToken } = process.env;
   const session = filePath !== void 0 ? { filePath } : {};
-  let token = ciToken || (await getAccessToken(base2, session)).accessToken;
-  async function refreshToken() {
+  const token = ciToken || (await getStoredSession(base2, session)).token;
+  async function onUnauthorized() {
     if (ciToken) {
-      throw new UploadError(401, "COMPONENT_COMPASS_TOKEN was rejected (401); interactive login and token refresh are disabled. Supply a valid token.");
+      throw new UploadError(401, "COMPONENT_COMPASS_TOKEN was rejected (401). Supply a valid token.");
     }
-    token = (await getAccessToken(base2, { ...session, force: true })).accessToken;
-    return token;
+    const removed = await removeStoredSession(base2, { expectedToken: token, ...session });
+    if (!removed) throw new SessionChangedError(base2);
+    throw new ReloginRequiredError(base2);
   }
   return {
     base: base2,
     async upload(artifactJson) {
-      const submit = () => submitArtifact({ host: base2, token, artifactJson });
-      const receipt = await submit().catch(async (err2) => {
+      const receipt = await submitArtifact({ host: base2, token, artifactJson }).catch(async (err2) => {
         if (!(err2 instanceof UploadError) || err2.code !== 401) throw err2;
-        await refreshToken();
-        return await submit();
+        return await onUnauthorized();
       });
       return await pollUpload({
         host: base2,
         receipt,
         getToken: async () => token,
-        refreshToken,
+        onUnauthorized,
         timeoutMs: 3e5,
         ...opts.onStatus ? { onStatus: opts.onStatus } : {}
       });
@@ -45151,6 +45125,105 @@ var init_parse = __esm({
   }
 });
 
+// src/auth/client.ts
+function endpoint(base2, path5) {
+  return `${base2.replace(/\/+$/, "")}${path5}`;
+}
+async function readError(res) {
+  const body = await res.json().catch(() => ({}));
+  return body.error ?? "unknown_error";
+}
+function toUserSession(body) {
+  if (typeof body !== "object" || body === null || Array.isArray(body)) {
+    throw new AuthProtocolError("Invalid token response: missing session.");
+  }
+  const { access_token: token, token_type: tokenType, email } = body;
+  if (typeof token !== "string" || !USER_SESSION_TOKEN_PATTERN.test(token) || tokenType !== "Bearer" || typeof email !== "string" || email.trim() === "") {
+    throw new AuthProtocolError("Invalid token response: malformed session.");
+  }
+  return { token, email };
+}
+async function requestDeviceCode(base2) {
+  const res = await fetch(endpoint(base2, "/api/auth/cli/device-code"), { method: "POST" });
+  if (!res.ok) throw new AuthHttpError(res.status, `device-code failed: ${await readError(res)}`);
+  const b = await res.json();
+  return {
+    deviceCode: b.device_code,
+    userCode: b.user_code,
+    verificationUri: b.verification_uri,
+    verificationUriComplete: b.verification_uri_complete,
+    expiresIn: b.expires_in,
+    interval: b.interval
+  };
+}
+async function pollToken(base2, deviceCode) {
+  const res = await fetch(endpoint(base2, "/api/auth/cli/token"), {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ device_code: deviceCode })
+  });
+  if (res.ok) {
+    const body = await res.json().catch(() => {
+      throw new AuthProtocolError("Invalid token response: could not parse JSON.");
+    });
+    return { kind: "session", session: toUserSession(body) };
+  }
+  const error2 = await readError(res);
+  switch (error2) {
+    case "authorization_pending":
+      return { kind: "pending" };
+    case "slow_down":
+      return { kind: "slow_down" };
+    case "expired_token":
+      return { kind: "expired" };
+    case "access_denied":
+      return { kind: "denied" };
+    default:
+      throw new AuthHttpError(res.status, `token poll failed: ${error2}`);
+  }
+}
+async function revokeSession(base2, token) {
+  const res = await fetch(endpoint(base2, "/api/auth/cli/session"), {
+    method: "DELETE",
+    headers: { Authorization: `Bearer ${token}` }
+  });
+  if (res.status !== 204) throw new AuthHttpError(res.status, `session revoke failed: ${await readError(res)}`);
+}
+async function whoami(base2, token) {
+  const res = await fetch(endpoint(base2, "/api/auth/cli/whoami"), {
+    headers: { Authorization: `Bearer ${token}` }
+  });
+  if (res.status === 401) return null;
+  if (!res.ok) throw new AuthHttpError(res.status, `whoami failed: ${await readError(res)}`);
+  const body = await res.json().catch(() => {
+    throw new AuthProtocolError("Invalid whoami response: could not parse JSON.");
+  });
+  if (typeof body !== "object" || body === null || Array.isArray(body)) {
+    throw new AuthProtocolError("Invalid whoami response: missing identity.");
+  }
+  const { userId, email } = body;
+  if (typeof userId !== "string" || userId === "" || typeof email !== "string" && email !== null) {
+    throw new AuthProtocolError("Invalid whoami response: malformed identity.");
+  }
+  return { userId, email };
+}
+var AuthHttpError, AuthProtocolError, USER_SESSION_TOKEN_PATTERN;
+var init_client = __esm({
+  "src/auth/client.ts"() {
+    "use strict";
+    AuthHttpError = class extends Error {
+      constructor(status, message) {
+        super(message);
+        this.status = status;
+      }
+      status;
+    };
+    AuthProtocolError = class extends Error {
+    };
+    USER_SESSION_TOKEN_PATTERN = /^cc_u_[A-Za-z0-9_-]{43}$/;
+  }
+});
+
 // src/auth/browser.ts
 import { spawn as spawn2 } from "node:child_process";
 function openBrowser(url, deps = {}) {
@@ -45205,6 +45278,33 @@ async function runAuthLogin(opts) {
   const sleep = opts.sleep ?? defaultSleep;
   const now = opts.now ?? Date.now;
   const filePath = opts.store?.filePath;
+  const stored = (await loadStore(filePath)).hosts[base2];
+  if (stored) {
+    try {
+      const identity = await whoami(base2, stored.token);
+      if (identity) {
+        out(`Already signed in as ${identity.email ?? stored.userEmail} to ${base2}.
+`);
+        return 0;
+      }
+      const removed = await removeStoredSession(base2, { expectedToken: stored.token, ...filePath !== void 0 ? { filePath } : {} });
+      if (!removed) {
+        err(`Session for ${base2} changed while checking it. Run \`component-compass auth login --host ${base2}\` again.
+`);
+        return 1;
+      }
+    } catch (e) {
+      if (e instanceof StoreLockError) err(`${e.message}
+`);
+      else if (e instanceof AuthHttpError) err(`Login failed: ${base2} returned HTTP ${e.status}. Your stored session was kept.
+`);
+      else if (e instanceof AuthProtocolError) err(`Login failed: ${e.message} Your stored session was kept.
+`);
+      else err(`${new HostUnavailableError(base2).message}
+`);
+      return 1;
+    }
+  }
   let device;
   try {
     device = await requestDeviceCode(base2);
@@ -45239,6 +45339,10 @@ Code: ${device.userCode}
       if (e instanceof AuthHttpError) {
         err(`
 Login failed: ${base2} returned HTTP ${e.status}. Run \`component-compass auth login\` again.
+`);
+      } else if (e instanceof AuthProtocolError) {
+        err(`
+Login failed: ${e.message} Your stored sessions were kept.
 `);
       } else {
         const detail = transportDetail(e);
@@ -45248,17 +45352,12 @@ Could not reach ${base2}${detail ? ` (${detail})` : ""}. Check the host URL and
       }
       return 1;
     }
-    if (result2.kind === "tokens") {
+    if (result2.kind === "session") {
       const entry = {
-        accessToken: result2.tokens.accessToken,
-        refreshToken: result2.tokens.refreshToken,
-        userEmail: result2.tokens.email ?? "",
-        expiresAt: new Date(now() + result2.tokens.expiresIn * 1e3).toISOString()
-      };
-      const store = await loadStore(filePath);
-      store.hosts[base2] = entry;
-      if (!store.default) store.default = base2;
-      await saveStore(store, filePath);
+        token: result2.session.token,
+        userEmail: result2.session.email
+      };
+      await setStoredSession(base2, entry, filePath !== void 0 ? { filePath } : {});
       if (spin) spin.stop("Approved");
       out(`\u2713 Signed in as ${entry.userEmail || "your account"}
 `);
@@ -45294,19 +45393,27 @@ async function runAuthStatus(opts) {
     write3("Not signed in.\n");
     return 1;
   }
-  if (!store.hosts[base2]) {
+  const entry = store.hosts[base2];
+  if (!entry) {
     write3(`Not signed in to ${base2}.
 `);
     return 1;
   }
   try {
-    const { accessToken, userEmail } = await getAccessToken(base2, filePath !== void 0 ? { filePath } : {});
-    const who = await whoami(base2, accessToken);
-    write3(`Signed in as ${who?.email ?? userEmail} to ${base2}.
+    const { token, userEmail } = await getStoredSession(base2, filePath !== void 0 ? { filePath } : {});
+    const who = await whoami(base2, token);
+    if (!who) {
+      const removed = await removeStoredSession(base2, { expectedToken: token, ...filePath !== void 0 ? { filePath } : {} });
+      write3(removed ? `${new ReloginRequiredError(base2).message}
+` : `Session changed for ${base2}; retry \`component-compass auth status --host ${base2}\`.
+`);
+      return 1;
+    }
+    write3(`Signed in as ${who.email ?? userEmail} to ${base2}.
 `);
     return 0;
   } catch (e) {
-    const msg = formatAuthError(e) ?? (e instanceof Error ? e.message : String(e));
+    const msg = e instanceof StoreLockError ? e.message : formatAuthError(e) ?? (e instanceof AuthHttpError ? `Host ${base2} returned HTTP ${e.status}. Your stored session was kept.` : e instanceof AuthProtocolError ? `${e.message} Your stored session was kept.` : new HostUnavailableError(base2).message);
     write3(`${msg}
 `);
     return 1;
@@ -45323,18 +45430,23 @@ async function runAuthLogout(opts) {
     write3("Not signed in to anything.\n");
     return 0;
   }
-  if (!store.hosts[base2]) {
+  const entry = store.hosts[base2];
+  if (!entry) {
     write3(`Not signed in to ${base2}.
 `);
     return 0;
   }
-  const { [base2]: _removed, ...remaining } = store.hosts;
-  const next = {
-    hosts: remaining,
-    ...store.default && store.default !== base2 ? { default: store.default } : {}
-  };
-  await saveStore(next, filePath);
-  write3(`Signed out of ${base2}.
+  try {
+    await revokeSession(base2, entry.token);
+  } catch (e) {
+    write3(e instanceof AuthHttpError ? `Could not revoke the session for ${base2}: HTTP ${e.status}. Your stored session was kept.
+` : `${new HostUnavailableError(base2).message} Your stored session was kept.
+`);
+    return 1;
+  }
+  const removed = await removeStoredSession(base2, { expectedToken: entry.token, ...filePath !== void 0 ? { filePath } : {} });
+  write3(removed ? `Signed out of ${base2}.
+` : `Revoked the previous session for ${base2}; newer sign-in kept.
 `);
   return 0;
 }
@@ -67524,7 +67636,7 @@ function requireUtil$2() {
       return path5;
     });
     exports$1.normalize = normalize2;
-    function join16(aRoot, aPath) {
+    function join17(aRoot, aPath) {
       if (aRoot === "") {
         aRoot = ".";
       }
@@ -67556,7 +67668,7 @@ function requireUtil$2() {
       }
       return joined;
     }
-    exports$1.join = join16;
+    exports$1.join = join17;
     exports$1.isAbsolute = function(aPath) {
       return aPath.charAt(0) === "/" || urlRegexp.test(aPath);
     };
@@ -67770,7 +67882,7 @@ function requireUtil$2() {
             parsed.path = parsed.path.substring(0, index + 1);
           }
         }
-        sourceURL = join16(urlGenerate(parsed), sourceURL);
+        sourceURL = join17(urlGenerate(parsed), sourceURL);
       }
       return normalize2(sourceURL);
     }
@@ -75525,9 +75637,9 @@ function requirePicocolors() {
   hasRequiredPicocolors = 1;
   let p = browser$1 || {}, argv2 = p.argv || [], env2 = p.env || {};
   let isColorSupported = !(!!env2.NO_COLOR || argv2.includes("--no-color")) && (!!env2.FORCE_COLOR || argv2.includes("--color") || p.platform === "win32" || (p.stdout || {}).isTTY && env2.TERM !== "dumb" || !!env2.CI);
-  let formatter = (open, close, replace = open) => (input2) => {
-    let string2 = "" + input2, index = string2.indexOf(close, open.length);
-    return ~index ? open + replaceClose(string2, close, replace, index) + close : open + string2 + close;
+  let formatter = (open2, close, replace = open2) => (input2) => {
+    let string2 = "" + input2, index = string2.indexOf(close, open2.length);
+    return ~index ? open2 + replaceClose(string2, close, replace, index) + close : open2 + string2 + close;
   };
   let replaceClose = (string2, close, replace, index) => {
     let result2 = "", cursor3 = 0;
@@ -77190,7 +77302,7 @@ function requirePreviousMap() {
   if (hasRequiredPreviousMap) return previousMap;
   hasRequiredPreviousMap = 1;
   let { existsSync: existsSync8, readFileSync: readFileSync13 } = require$$0$1;
-  let { dirname: dirname13, join: join16 } = require$$1;
+  let { dirname: dirname13, join: join17 } = require$$1;
   let { SourceMapConsumer, SourceMapGenerator } = /* @__PURE__ */ requireSourceMap$1();
   function fromBase64(str) {
     if (Buffer$1) {
@@ -77289,7 +77401,7 @@ function requirePreviousMap() {
         return this.decodeInline(this.annotation);
       } else if (this.annotation) {
         let map2 = this.annotation;
-        if (file) map2 = join16(dirname13(file), map2);
+        if (file) map2 = join17(dirname13(file), map2);
         return this.loadFile(map2);
       }
     }
@@ -78095,7 +78207,7 @@ function requireParser$1() {
       let prev;
       let shift;
       let last = false;
-      let open = false;
+      let open2 = false;
       let params = [];
       let brackets = [];
       while (!this.tokenizer.endOfFile()) {
@@ -78115,7 +78227,7 @@ function requireParser$1() {
             this.semicolon = true;
             break;
           } else if (type === "{") {
-            open = true;
+            open2 = true;
             break;
           } else if (type === "}") {
             if (params.length > 0) {
@@ -78157,7 +78269,7 @@ function requireParser$1() {
         node2.raws.afterName = "";
         node2.params = "";
       }
-      if (open) {
+      if (open2) {
         node2.nodes = [];
         this.current = node2;
       }
@@ -94097,11 +94209,11 @@ function createImportResolver(opts) {
       }
       if (spec.startsWith(".")) {
         const segments = spec.split("/");
-        const basename6 = segments[segments.length - 1];
-        if (basename6) {
+        const basename7 = segments[segments.length - 1];
+        if (basename7) {
           for (const ext of FILE_EXTENSIONS) {
             try {
-              return requireFromRepo.resolve(`${spec}/${basename6}${ext}`, {
+              return requireFromRepo.resolve(`${spec}/${basename7}${ext}`, {
                 paths: [fromDir, opts.repoRoot]
               });
             } catch {
@@ -94142,10 +94254,10 @@ function tryFileWithExtensions(absPath) {
     if (isFile(indexPath)) return indexPath;
   }
   const segments = absPath.split(/[\\/]/);
-  const basename6 = segments[segments.length - 1];
-  if (basename6) {
+  const basename7 = segments[segments.length - 1];
+  if (basename7) {
     for (const ext of FILE_EXTENSIONS) {
-      const basenamePath = pathResolve3(absPath, `${basename6}${ext}`);
+      const basenamePath = pathResolve3(absPath, `${basename7}${ext}`);
       if (isFile(basenamePath)) return basenamePath;
     }
   }
@@ -102858,14 +102970,14 @@ var CANDIDATE_PATHS = [join14(".nuxt", "components.d.ts"), join14(".nuxt", "type
 var AUGMENTED_MODULE = /declare\s+module\s+["'](?:vue|@vue\/runtime-core)["']\s*\{/g;
 var INTERFACE_DECL = /(?:^|[\s;}])(?:export\s+)?(?:declare\s+)?interface\s+([A-Za-z_$][\w$]*)\s*(?:extends\s+([^{]*?))?\s*\{/g;
 var MEMBER = /^\s*(?:["']([^"']+)["']|([A-Za-z_$][\w$]*))\??\s*:\s*.*typeof import\(["']([^"']+)["']\)\[["']([^"']+)["']\]/;
-function matchingBlock(source, open) {
+function matchingBlock(source, open2) {
   let depth = 0;
-  for (let i2 = open; i2 < source.length; i2++) {
+  for (let i2 = open2; i2 < source.length; i2++) {
     const ch = source[i2];
     if (ch === "{") depth++;
     else if (ch === "}") {
       depth--;
-      if (depth === 0) return { body: source.slice(open + 1, i2), end: i2 };
+      if (depth === 0) return { body: source.slice(open2 + 1, i2), end: i2 };
     }
   }
   return null;
@@ -102874,8 +102986,8 @@ function collectInterfaces(source) {
   const out2 = [];
   INTERFACE_DECL.lastIndex = 0;
   for (let m = INTERFACE_DECL.exec(source); m !== null; m = INTERFACE_DECL.exec(source)) {
-    const open = m.index + m[0].length - 1;
-    const block2 = matchingBlock(source, open);
+    const open2 = m.index + m[0].length - 1;
+    const block2 = matchingBlock(source, open2);
     if (block2 === null) continue;
     out2.push({
       name: m[1],
@@ -102883,7 +102995,7 @@ function collectInterfaces(source) {
       body: block2.body,
       start: m.index
     });
-    INTERFACE_DECL.lastIndex = open + 1;
+    INTERFACE_DECL.lastIndex = open2 + 1;
   }
   return out2;
 }
@@ -102891,8 +103003,8 @@ function augmentedRanges(source) {
   const out2 = [];
   AUGMENTED_MODULE.lastIndex = 0;
   for (let m = AUGMENTED_MODULE.exec(source); m !== null; m = AUGMENTED_MODULE.exec(source)) {
-    const open = m.index + m[0].length - 1;
-    const block2 = matchingBlock(source, open);
+    const open2 = m.index + m[0].length - 1;
+    const block2 = matchingBlock(source, open2);
     if (block2 === null) continue;
     out2.push([m.index, block2.end]);
     AUGMENTED_MODULE.lastIndex = block2.end;
@@ -103483,7 +103595,7 @@ function normaliseVia(v, configDir2, rebase) {
 // src/commands/init.ts
 init_adapter();
 import { writeFile as writeFile3, stat as stat2, readFile as readFile6 } from "node:fs/promises";
-import { basename as basename5, isAbsolute as isAbsolute13, resolve as resolve12 } from "node:path";
+import { basename as basename6, isAbsolute as isAbsolute13, resolve as resolve12 } from "node:path";
 var DEFAULT_INCLUDE = "src/**/*.{ts,tsx,jsx,js,vue,html}";
 var FRAMEWORK_EXTS = {
   react: ["ts", "tsx", "js", "jsx"],
@@ -103586,7 +103698,7 @@ async function deriveRepoId(cwd2) {
     if (pkg.name) return pkg.name;
   } catch {
   }
-  return basename5(cwd2) || "unknown";
+  return basename6(cwd2) || "unknown";
 }
 
 // src/cli.ts
@@ -103639,8 +103751,8 @@ Options:
 `;
 var AUTH = `component-compass auth <login|logout|status> [--host <url>]
 
-  login   Device-flow browser login; stores tokens in ~/.config/component-compass/hosts.json
-  logout  Remove stored tokens for a host
+  login   Device-flow browser login; stores a session in ~/.config/component-compass/hosts.json
+  logout  Revoke a session for a host
   status  Show the signed-in identity
 `;
 var REGISTRY = { scan: SCAN, init: INIT, auth: AUTH };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@component-compass/cli",
-  "version": "0.1.26",
+  "version": "0.1.27",
   "description": "Open-source CLI for measuring design-system component usage across multi-framework consumer repos.",
   "license": "MIT",
   "type": "module",