@go-labs-sg/event-tech 0.9.0 → 0.10.0

package/README.md

@@ -41,6 +41,16 @@ bun add --global @go-labs-sg/event-tech
 et version
 ```
 
+## Secure credential storage
+
+`GO_LABS_CLI_CREDENTIAL_ACCOUNT` selects the native credential-store account for this CLI. The default is `default`, preserving existing production logins. The downloadable staging launcher sets it to `staging` so a staging login does not replace the production login; keep the same account value for login and subsequent commands. The launcher also sets `GO_LABS_CLI_SKIP_DOTENV=1`, which skips the CLI's explicit current-directory `.env` load while leaving normal production behavior unchanged.
+
+Browser sessions use `Bun.secrets`: macOS Keychain, Windows Credential Manager, or Linux Secret Service. Linux requires libsecret, a reachable user D-Bus session, and an unlocked Secret Service collection. SSH and containers must provide those native prerequisites themselves; `--no-browser` only lets approval happen on another device. Denied D-Bus access is a host permissions/session issue, not something the CLI bypasses.
+
+Before requesting approval, login verifies write/read/delete capability with a unique non-secret probe. Native operations have a 10-second process deadline and sanitized errors. Issued credentials are read back and verified; failed persistence attempts remote revocation and reports local and remote cleanup separately. There is no plaintext fallback or external credential-helper configuration.
+
+See the [shared authentication contract](../../cli-auth/README.md) for recovery and verification limits.
+
 ## Authentication
 
 ```sh
@@ -51,7 +61,7 @@ et auth whoami
 
 `et auth login` opens Event Tech in the system browser. Use the normal Event Tech Google-backed web login if needed, verify the displayed code and device, then click **Authorize CLI**. An existing browser session skips another Google login but never skips explicit CLI approval.
 
-The terminal polls automatically and stores only Event Tech-issued credentials through `Bun.secrets`. It does not store Google credentials and has no API-key or environment-variable authentication fallback. Use `et auth logout` to revoke the remote session and remove its local credential. For SSH and containers, pass `--no-browser` and open the printed URL elsewhere.
+The terminal polls automatically and stores only Event Tech-issued credentials through `Bun.secrets`. It does not store Google credentials and has no raw API-key or token-environment authentication fallback. Use `et auth logout` to revoke the remote session and remove its local credential. For SSH and containers, pass `--no-browser` and open the printed URL elsewhere.
 
 Use `EVENT_TECH_API_URL` or `--api-url` to target another HTTPS deployment. Plain HTTP is allowed only for localhost development.
 

package/dist/index.js

@@ -35,46 +35,46 @@ var __toESM = (mod, isNodeMode, target) => {
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 var __require = import.meta.require;
 
-// ../../../node_modules/.bun/dotenv@18.0.1/node_modules/dotenv/dist/index.cjs
+// ../../../node_modules/.bun/dotenv@18.0.5/node_modules/dotenv/dist/index.cjs
 var require_dist = __commonJS(function(exports, module) {
-  var O = (e, o) => () => {
+  var I = (e, o) => () => {
     try {
       return o || e((o = { exports: {} }).exports, o), o.exports;
     } catch (t) {
       throw o = 0, t;
     }
   };
-  var q = O((Ce, j) => {
-    function I(e) {
+  var S = I((xe, U) => {
+    function G(e) {
       return typeof e == "string" ? !["false", "0", "no", "off", ""].includes(e.toLowerCase()) : !!e;
     }
-    function B() {
-      let e = {};
-      for (let o of ["ENCODING", "PATH", "QUIET", "DEBUG", "OVERRIDE", "FAST"]) {
-        let t = process.env[`DOTENV_${o}`] != null ? process.env[`DOTENV_${o}`] : process.env[`DOTENV_CONFIG_${o}`];
-        t != null && (e[o.toLowerCase()] = o === "ENCODING" || o === "PATH" ? t : I(t));
+    function X(e = process.env) {
+      let o = {};
+      for (let t of ["ENCODING", "PATH", "QUIET", "DEBUG", "OVERRIDE", "FAST"]) {
+        let n = e[`DOTENV_${t}`] != null ? e[`DOTENV_${t}`] : e[`DOTENV_CONFIG_${t}`];
+        n != null && (o[t.toLowerCase()] = t === "ENCODING" || t === "PATH" ? n : G(n));
       }
-      return e;
+      return o;
     }
-    j.exports = { parseBoolean: I, optionsFromEnv: B };
+    U.exports = { parseBoolean: G, optionsFromEnv: X };
   });
-  var y = O((we, C) => {
-    var H = __require("fs"), x = __require("path"), L = __require("os"), { URL: M, fileURLToPath: W } = __require("url"), { parseBoolean: T, optionsFromEnv: Q } = q(), J = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/mg, v = new Uint8Array(256);
+  var N = I((ye, x) => {
+    var Y = __require("fs"), j = __require("path"), z = __require("os"), { URL: Z, fileURLToPath: ee } = __require("url"), { parseBoolean: k, optionsFromEnv: B } = S(), te = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/mg, b = new Uint8Array(256);
     for (let e = 48;e <= 57; e++)
-      v[e] = 1;
+      b[e] = 1;
     for (let e = 65;e <= 90; e++)
-      v[e] = 1;
+      b[e] = 1;
     for (let e = 97;e <= 122; e++)
-      v[e] = 1;
-    v[45] = 1;
-    v[46] = 1;
-    v[95] = 1;
-    function K(e) {
+      b[e] = 1;
+    b[45] = 1;
+    b[46] = 1;
+    b[95] = 1;
+    function re(e) {
       let o = {}, t = e.toString();
       t = t.replace(/\r\n?/mg, `
 `);
       let n;
-      for (;(n = J.exec(t)) != null; ) {
+      for (;(n = te.exec(t)) != null; ) {
         let r = n[1], s = n[2] || "";
         s = s.trim();
         let i = s[0];
@@ -83,192 +83,182 @@ var require_dist = __commonJS(function(exports, module) {
       }
       return o;
     }
-    function X(e) {
+    function w(e) {
+      return e <= 32 ? e === 32 || e >= 9 && e <= 13 : e >= 160 && (e === 160 || e === 5760 || e >= 8192 && e <= 8202 || e === 8232 || e === 8233 || e === 8239 || e === 8287 || e === 12288 || e === 65279);
+    }
+    function O(e) {
+      return e === 10 || e === 8232 || e === 8233;
+    }
+    function oe(e) {
       let o = {}, t = typeof e == "string" ? e : e.toString();
       t.indexOf("\r") !== -1 && (t = t.replace(/\r\n?/g, `
 `));
       let n = t.length, r = 0;
       for (;r < n; ) {
         let s = t.charCodeAt(r);
-        for (;r < n && (s === 32 || s === 9 || s === 10 || s === 65279); )
+        for (;r < n && w(s); )
           r++, s = t.charCodeAt(r);
         if (r >= n)
           break;
         if (s === 35) {
-          for (;r < n && t.charCodeAt(r) !== 10; )
+          for (;r < n && !O(t.charCodeAt(r)); )
             r++;
           continue;
         }
+        let i = -1;
         if (s === 101 && r + 6 < n && t.charCodeAt(r + 1) === 120 && t.charCodeAt(r + 2) === 112 && t.charCodeAt(r + 3) === 111 && t.charCodeAt(r + 4) === 114 && t.charCodeAt(r + 5) === 116) {
-          let f = t.charCodeAt(r + 6);
-          if (f === 32 || f === 9)
-            for (r += 7;r < n && ((s = t.charCodeAt(r)) === 32 || s === 9); )
-              r++;
-          else
+          let v = t.charCodeAt(r + 6);
+          if (w(v)) {
+            let u = r + 7;
+            for (;u < n && w(t.charCodeAt(u)); )
+              u++;
+            b[t.charCodeAt(u)] && (i = r + 6, r = u);
+          } else
             s = t.charCodeAt(r);
         }
-        let i = r, l = 0;
-        for (;r < n && (l = t.charCodeAt(r), v[l]); )
+        let l = r, d = 0;
+        for (;r < n && (d = t.charCodeAt(r), b[d]); )
           r++;
-        if (r === i) {
-          for (;r < n && t.charCodeAt(r) !== 10; )
+        if (r === l) {
+          for (;r < n && !O(t.charCodeAt(r)); )
             r++;
           continue;
         }
-        let h = t.slice(i, r);
-        if (r >= n && (l = 0), l === 32 || l === 9)
+        let p = t.slice(l, r), f = r;
+        if (r >= n && (d = 0), w(d))
           do
-            r++, l = r < n ? t.charCodeAt(r) : 0;
-          while (l === 32 || l === 9);
-        if (l === 61)
-          r++;
-        else if (l === 58 && r + 1 < n && (t.charCodeAt(r + 1) === 32 || t.charCodeAt(r + 1) === 9))
+            r++, d = r < n ? t.charCodeAt(r) : 0;
+          while (w(d));
+        if (d === 61)
           r++;
+        else if (d === 58 && r === f && r + 1 < n && w(t.charCodeAt(r + 1)))
+          r += 2;
         else {
-          for (;r < n && t.charCodeAt(r) !== 10; )
+          for (r = i === -1 ? f : i;r < n && !O(t.charCodeAt(r)); )
             r++;
           continue;
         }
-        for (;r < n && ((s = t.charCodeAt(r)) === 32 || s === 9); )
-          r++;
-        let u;
-        if (s = r < n ? t.charCodeAt(r) : 0, s === 39 || s === 34 || s === 96) {
-          let f = s, c = r + 1, a = c;
-          for (;a < n; ) {
-            let d = t.charCodeAt(a);
-            if (d === 92 && a + 1 < n) {
-              let p = t.charCodeAt(a + 1);
-              if (p === f || p === 92) {
-                a += 2;
-                continue;
-              }
-            }
-            if (d === f)
+        let c = r, a = r;
+        for (;a < n && w(t.charCodeAt(a)); )
+          a++;
+        let g = t.charCodeAt(a), h, y = false;
+        if (g === 39 || g === 34 || g === 96) {
+          let v = t[a], u = t.indexOf(v, a + 1), m = -1, C = -1;
+          for (;u !== -1; ) {
+            let q = t.charCodeAt(u - 1) === 92, E = u + 1;
+            for (;E < n && !O(t.charCodeAt(E)) && w(t.charCodeAt(E)); )
+              E++;
+            if ((E === n || O(t.charCodeAt(E)) || t.charCodeAt(E) === 35) && (m = u, C = E), !q)
               break;
-            a++;
+            u = t.indexOf(v, u + 1);
           }
-          if (a >= n) {
-            let d = r, p = r;
-            for (;p < n; ) {
-              let w = t.charCodeAt(p);
-              if (w === 35 || w === 10)
-                break;
-              p++;
-            }
-            let m = p;
-            for (;m > d; ) {
-              let w = t.charCodeAt(m - 1);
-              if (w === 32 || w === 9)
-                m--;
-              else
-                break;
-            }
-            if (u = t.slice(d, m), r = p, r < n && t.charCodeAt(r) === 35)
-              for (;r < n && t.charCodeAt(r) !== 10; )
-                r++;
-          } else {
-            for (u = t.slice(c, a), r = a + 1, f === 34 && u.indexOf("\\") !== -1 && (u = u.replace(/\\n/g, `
-`).replace(/\\r/g, "\r"));r < n && ((s = t.charCodeAt(r)) === 32 || s === 9); )
-              r++;
-            if (r < n && t.charCodeAt(r) === 35)
-              for (;r < n && t.charCodeAt(r) !== 10; )
+          if (m !== -1) {
+            if (h = t.slice(a + 1, m), r = C, t.charCodeAt(r) === 35)
+              for (;r < n && !O(t.charCodeAt(r)); )
                 r++;
+            y = true;
           }
-        } else {
-          let f = r, c = t.indexOf(`
-`, r);
-          c === -1 && (c = n);
-          let a = t.indexOf("#", r);
-          (a === -1 || a > c) && (a = c);
-          let d = a;
-          for (;d > f; ) {
-            let p = t.charCodeAt(d - 1);
-            if (p === 32 || p === 9)
-              d--;
-            else
-              break;
-          }
-          u = f === d ? "" : t.slice(f, d), r = a === c ? a : c;
         }
-        o[h] = u;
+        if (!y) {
+          let v = t.indexOf(`
+`, c);
+          v === -1 && (v = n);
+          let u;
+          if (n < 4096)
+            u = t.indexOf("#", c), (u === -1 || u > v) && (u = v);
+          else
+            for (u = c;u < v && t.charCodeAt(u) !== 35; )
+              u++;
+          let m = c, C = u;
+          for (;m < C && w(t.charCodeAt(m)); )
+            m++;
+          for (;C > m && w(t.charCodeAt(C - 1)); )
+            C--;
+          let q = t.charCodeAt(m);
+          if (C - m >= 2 && (q === 39 || q === 34 || q === 96) && t.charCodeAt(C - 1) === q ? h = t.slice(m + 1, C - 1) : h = t.slice(m, C), r = u, u < v)
+            for (;r < n && !O(t.charCodeAt(r)); )
+              r++;
+        }
+        g === 34 && (y || a < r) && h.indexOf("\\") !== -1 && (h = h.replace(/\\n/g, `
+`).replace(/\\r/g, "\r")), o[p] = h;
       }
       return o;
     }
-    function Y(e, o) {
-      return o && T(o.fast) ? X(e) : K(e);
+    function ne(e, o) {
+      return o && k(o.fast) ? oe(e) : re(e);
     }
-    function b(e) {
+    function T(e) {
       console.log(`\u2506 ${e}`);
     }
-    function z(e) {
+    function se(e) {
       console.error(`\u25C7 ${e}`);
     }
-    function N(e) {
-      return e[0] === "~" ? x.join(L.homedir(), e.slice(1)) : e;
+    function V(e) {
+      return e[0] === "~" ? j.join(z.homedir(), e.slice(1)) : e;
     }
-    function Z(e = {}) {
-      return { ...Q(), ...e };
+    function ie(e = {}) {
+      return { ...B(), ...e };
     }
-    function ee(e) {
-      e = Z(e);
-      let o = x.resolve(process.cwd(), ".env"), t = "utf8", n = process.env;
+    function ce(e) {
+      e = ie(e);
+      let o = j.resolve(process.cwd(), ".env"), t = "utf8", n = process.env;
       e && e.processEnv != null && (n = e.processEnv);
-      let r = T(e && e.debug), s = T(e && e.quiet);
-      e && e.encoding ? t = e.encoding : r && b("no encoding is specified (UTF-8 is used by default)");
-      let i = [o];
+      let r = k(e && e.debug);
+      e && e.encoding ? t = e.encoding : r && T("no encoding is specified (UTF-8 is used by default)");
+      let s = [o];
       if (e && e.path)
         if (!Array.isArray(e.path))
-          i = [N(e.path)];
+          s = [V(e.path)];
         else {
-          i = [];
+          s = [];
           for (let c of e.path)
-            i.push(N(c));
+            s.push(V(c));
         }
-      let l, h = {}, u = { fast: e.fast };
-      for (let c of i)
+      let i, l = {}, d = { fast: e.fast };
+      for (let c of s)
         try {
-          let a = g.parse(H.readFileSync(c, { encoding: t }), u);
-          g.populate(h, a, e);
+          let a = A.parse(Y.readFileSync(c, { encoding: t }), d);
+          A.populate(l, a, e);
         } catch (a) {
-          r && b(`failed to load ${c} ${a.message}`), l = a;
+          r && T(`failed to load ${c} ${a.message}`), i = a;
         }
-      let f = g.populate(n, h, e);
-      if (r || !s) {
-        let c = Object.keys(f).length, a = [];
-        for (let d of i)
+      let p = A.populate(n, l, e), f = k(Object.prototype.hasOwnProperty.call(e, "quiet") ? e.quiet : B(n).quiet);
+      if (r || !f) {
+        let c = Object.keys(p).length, a = [];
+        for (let g of s)
           try {
-            let p = x.relative(process.cwd(), d instanceof M ? W(d) : d);
-            a.push(p);
-          } catch (p) {
-            r && b(`failed to load ${d} ${p.message}`), l = p;
+            let h = j.relative(process.cwd(), g instanceof Z ? ee(g) : g);
+            a.push(h);
+          } catch (h) {
+            r && T(`failed to load ${g} ${h.message}`), i = h;
           }
-        z(`injected env (${c}) from ${a.join(",")}`);
+        se(`injected env (${c}) from ${a.join(",")}`);
       }
-      return l ? { parsed: h, error: l } : { parsed: h };
+      return i ? { parsed: l, error: i } : { parsed: l };
     }
-    function te(e) {
-      return g.configDotenv(e);
+    function ae(e) {
+      return A.configDotenv(e);
     }
-    function re(e, o, t = {}) {
+    function le(e, o, t = {}) {
       let n = !!(t && t.debug), r = !!(t && t.override), s = {};
       if (e === null || typeof e != "object" || o === null || typeof o != "object") {
         let i = new Error("OBJECT_REQUIRED: Please check the processEnv argument being passed to populate");
         throw i.code = "OBJECT_REQUIRED", i;
       }
       for (let i of Object.keys(o))
-        Object.prototype.hasOwnProperty.call(e, i) ? (r === true && (e[i] = o[i], s[i] = o[i]), n && b(r === true ? `"${i}" is already defined and WAS overwritten` : `"${i}" is already defined and was NOT overwritten`)) : (e[i] = o[i], s[i] = o[i]);
+        Object.prototype.hasOwnProperty.call(e, i) ? (r === true && (e[i] = o[i], s[i] = o[i]), n && T(r === true ? `"${i}" is already defined and WAS overwritten` : `"${i}" is already defined and was NOT overwritten`)) : (e[i] = o[i], s[i] = o[i]);
       return s;
     }
-    var g = { configDotenv: ee, config: te, parse: Y, populate: re };
-    C.exports.configDotenv = g.configDotenv;
-    C.exports.config = g.config;
-    C.exports.parse = g.parse;
-    C.exports.populate = g.populate;
-    C.exports = g;
+    var A = { configDotenv: ce, config: ae, parse: ne, populate: le };
+    x.exports.configDotenv = A.configDotenv;
+    x.exports.config = A.config;
+    x.exports.parse = A.parse;
+    x.exports.populate = A.populate;
+    x.exports = A;
   });
-  var F = O((be, R) => {
-    var $ = __require("child_process"), oe = __require("fs"), P = __require("path");
-    function ne(e) {
+  var M = I((Te, W) => {
+    var _ = __require("child_process"), fe = __require("fs"), L = __require("path");
+    function ue(e) {
       let o = ['"'], t = 0;
       for (let n of e) {
         if (n === "\\") {
@@ -279,7 +269,7 @@ var require_dist = __commonJS(function(exports, module) {
       }
       return o.push("\\".repeat(t * 2), '"'), o.join("");
     }
-    function _(e, o = 1) {
+    function H(e, o = 1) {
       for (let t = 0;t < o; t++) {
         let n = [];
         for (let r of e) {
@@ -290,47 +280,47 @@ var require_dist = __commonJS(function(exports, module) {
       }
       return e;
     }
-    function D(e, o) {
+    function P(e, o) {
       let t = Object.keys(e).reverse().find((n) => n.toUpperCase() === o);
       return t === undefined ? undefined : e[t];
     }
-    function se(e, o, t) {
-      let n = (D(o, "PATHEXT") || ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean), s = n.some((l) => e.toLowerCase().endsWith(l.toLowerCase())) ? ["", ...n] : [...n, ""], i = /[\\/]/.test(e) ? [t] : [t, ...(D(o, "PATH") || "").split(";")];
+    function de(e, o, t) {
+      let n = (P(o, "PATHEXT") || ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean), s = n.some((l) => e.toLowerCase().endsWith(l.toLowerCase())) ? ["", ...n] : [...n, ""], i = /[\\/]/.test(e) ? [t] : [t, ...(P(o, "PATH") || "").split(";")];
       for (let l of i)
-        for (let h of s) {
-          let u = P.resolve(t, l.replace(/^"|"$/g, ""), e + h);
+        for (let d of s) {
+          let p = L.resolve(t, l.replace(/^"|"$/g, ""), e + d);
           try {
-            if (oe.statSync(u).isFile())
-              return u;
+            if (fe.statSync(p).isFile())
+              return p;
           } catch {}
         }
     }
-    function ie(e, o, t) {
+    function pe(e, o, t) {
       if (process.platform !== "win32")
-        return $.spawn(e, o, t);
-      let n = t.env || process.env, r = se(e, n, t.cwd || process.cwd());
+        return _.spawn(e, o, t);
+      let n = t.env || process.env, r = de(e, n, t.cwd || process.cwd());
       if (r && /\.(?:exe|com)$/i.test(r))
-        return $.spawn(r, o, t);
-      let s = /\.(?:bat|cmd)$/i.test(r || e), i = [_(P.normalize(r || e))];
-      for (let h of o)
-        i.push(_(ne(h), s ? 2 : 1));
+        return _.spawn(r, o, t);
+      let s = /\.(?:bat|cmd)$/i.test(r || e), i = [H(L.normalize(r || e))];
+      for (let d of o)
+        i.push(H(ue(d), s ? 2 : 1));
       let l = i.join(" ");
-      return $.spawn(D(n, "COMSPEC") || "cmd.exe", ["/d", "/v:off", "/s", "/c", `"${l}"`], { ...t, windowsVerbatimArguments: true });
+      return _.spawn(P(n, "COMSPEC") || "cmd.exe", ["/d", "/v:off", "/s", "/c", `"${l}"`], { ...t, windowsVerbatimArguments: true });
     }
-    R.exports = ie;
+    W.exports = pe;
   });
-  var V = O((Ae, S) => {
-    var ce = __require("fs"), ae = __require("os"), G = __require("path"), le = __require("child_process"), fe = F(), k = y(), { optionsFromEnv: ue } = q();
-    function A() {
+  var K = I(($e, F) => {
+    var he = __require("fs"), ge = __require("os"), Q = __require("path"), me = __require("child_process"), ve = M(), R = N(), { optionsFromEnv: Ce } = S();
+    function $() {
       console.log(["Usage: dotenv run [--help] [-q|--quiet] [--debug] [--override] [--fast] [-f|--file <paths>] [--] <command> [args...]", "", "Run a command with environment variables from a .env file.", "Place dotenv options before the command; all following arguments go to the command.", "", "Options:", "  -f, --file <paths>  .env paths, comma-separated or repeated (default: .env)", "  -q, --quiet suppress the injected env message", "  --debug     enable debug logging", "  --override  override existing environment variables", "  --fast      use the faster character-scanner parser", "", "Environment variables (DOTENV_CONFIG_* names remain as fallbacks):", "  DOTENV_PATH, DOTENV_ENCODING, DOTENV_QUIET,", "  DOTENV_DEBUG, DOTENV_OVERRIDE,", "  DOTENV_FAST"].join(`
 `));
     }
-    function de(e) {
+    function we(e) {
       let o = [], t = false, n, r, s, i, l = -1;
-      for (let u = 0;u < e.length; u++) {
-        let f = e[u];
+      for (let p = 0;p < e.length; p++) {
+        let f = e[p];
         if (f === "--") {
-          l = u + 1;
+          l = p + 1;
           break;
         }
         if (f === "--help" || f === "-h")
@@ -352,70 +342,70 @@ var require_dist = __commonJS(function(exports, module) {
           continue;
         }
         if (f === "-f" || f === "--file" || f.startsWith("-f=") || f.startsWith("--file=")) {
-          let c = f.indexOf("="), a = c === -1 ? f : f.slice(0, c), d = c === -1 ? e[++u] : f.slice(c + 1);
-          if (!d || d === "--")
+          let c = f.indexOf("="), a = c === -1 ? f : f.slice(0, c), g = c === -1 ? e[++p] : f.slice(c + 1);
+          if (!g || g === "--")
             return { error: `${a} requires a path` };
-          let p = d.split(",").map((m) => m.trim()).filter(Boolean);
-          if (p.length === 0)
+          let h = g.split(",").map((y) => y.trim()).filter(Boolean);
+          if (h.length === 0)
             return { error: `${a} requires a path` };
-          o.push(...p), t = true;
+          o.push(...h), t = true;
           continue;
         }
         if (f.startsWith("-"))
           return { error: `unknown option: ${f}` };
-        l = u;
+        l = p;
         break;
       }
-      let h = l === -1 ? [] : e.slice(l);
-      return { paths: o, pathSet: t, quiet: n, debug: r, override: s, fast: i, command: h };
+      let d = l === -1 ? [] : e.slice(l);
+      return { paths: o, pathSet: t, quiet: n, debug: r, override: s, fast: i, command: d };
     }
-    function pe(e) {
-      return e[0] === "~" ? G.join(ae.homedir(), e.slice(1)) : e;
+    function Ae(e) {
+      return e[0] === "~" ? Q.join(ge.homedir(), e.slice(1)) : e;
     }
-    function he(e) {
-      let o = ue(), t = { encoding: o.encoding || "utf8", quiet: o.quiet === true, debug: o.debug === true, override: o.override === true, fast: o.fast === true, paths: [".env"], defaultPath: true };
+    function Ee(e) {
+      let o = Ce(), t = { encoding: o.encoding || "utf8", quiet: o.quiet === true, debug: o.debug === true, override: o.override === true, fast: o.fast === true, paths: [".env"], defaultPath: true };
       return o.path != null && (t.paths = [o.path], t.defaultPath = false), e.pathSet && (t.paths = e.paths, t.defaultPath = false), e.quiet != null && (t.quiet = e.quiet), e.debug != null && (t.debug = e.debug), e.override != null && (t.override = e.override), e.fast != null && (t.fast = e.fast), t;
     }
-    function ge(e) {
+    function be(e) {
       let o = {}, t = [], n = { override: e.override, debug: e.debug };
       for (let s of e.paths) {
-        let i = G.resolve(process.cwd(), pe(s));
+        let i = Q.resolve(process.cwd(), Ae(s));
         try {
-          let l = k.parse(ce.readFileSync(i, { encoding: e.encoding }), { fast: e.fast });
-          k.populate(o, l, n), t.push(s);
+          let l = R.parse(he.readFileSync(i, { encoding: e.encoding }), { fast: e.fast });
+          R.populate(o, l, n), t.push(s);
         } catch (l) {
           if (e.debug && console.log(`\u2506 failed to load ${s} ${l.message}`), !(e.defaultPath && l.code === "ENOENT"))
             throw l;
         }
       }
-      return { injected: k.populate(process.env, o, n), loadedPaths: t };
+      return { injected: R.populate(process.env, o, n), loadedPaths: t };
     }
-    function U(e) {
+    function J(e) {
       let o = e[0];
       if (o === "--help" || o === "-h") {
-        A();
+        $();
         return;
       }
       if (o !== "run") {
-        A(), process.exitCode = 1;
+        $(), process.exitCode = 1;
         return;
       }
-      let t = de(e.slice(1));
+      let t = we(e.slice(1));
       if (t.help) {
-        A();
+        $();
         return;
       }
       if (t.error) {
-        console.error(`dotenv: ${t.error}`), A(), process.exitCode = 1;
+        console.error(`dotenv: ${t.error}`), $(), process.exitCode = 1;
         return;
       }
       if (t.command.length === 0) {
-        A(), process.exitCode = 1;
+        $(), process.exitCode = 1;
         return;
       }
-      let n = he(t);
+      let n = Ee(t);
       try {
-        let c = ge(n);
+        let c = be(n);
         if (!n.quiet) {
           let a = `\u25C7 injected env (${Object.keys(c.injected).length})`;
           c.loadedPaths.length > 0 && (a += ` from ${c.loadedPaths.join(", ")}`), console.error(a);
@@ -424,11 +414,11 @@ var require_dist = __commonJS(function(exports, module) {
         console.error(`dotenv: ${c.message}`), process.exitCode = 1;
         return;
       }
-      let r = !!process.stdin.isTTY, s = process.platform !== "win32" && !r, i = fe(t.command[0], t.command.slice(1), { stdio: "inherit", detached: s }), l = new Map, h = 0;
-      function u(c) {
+      let r = !!process.stdin.isTTY, s = process.platform !== "win32" && !r, i = ve(t.command[0], t.command.slice(1), { stdio: "inherit", detached: s }), l = new Map, d = 0;
+      function p(c) {
         if (!(!i.pid || i.exitCode !== null || i.signalCode !== null)) {
           if (process.platform === "win32") {
-            le.spawnSync("taskkill", ["/pid", String(i.pid), "/T", "/F"], { stdio: "ignore" });
+            me.spawnSync("taskkill", ["/pid", String(i.pid), "/T", "/F"], { stdio: "ignore" });
             return;
           }
           try {
@@ -446,14 +436,14 @@ var require_dist = __commonJS(function(exports, module) {
       for (let c of ["SIGINT", "SIGTERM", "SIGHUP", "SIGQUIT"]) {
         let a = () => {
           if (c === "SIGINT") {
-            if (h++, r && process.platform !== "win32" && h === 1)
+            if (d++, r && process.platform !== "win32" && d === 1)
               return;
-            if (h > 1) {
-              u(h === 2 ? "SIGTERM" : "SIGKILL");
+            if (d > 1) {
+              p(d === 2 ? "SIGTERM" : "SIGKILL");
               return;
             }
           }
-          u(c);
+          p(c);
         };
         l.set(c, a), process.on(c, a);
       }
@@ -463,22 +453,24 @@ var require_dist = __commonJS(function(exports, module) {
         f(), typeof c == "number" ? process.exit(c) : (setInterval(() => {}, 1000), process.kill(process.pid, a));
       });
     }
-    S.exports = U;
-    S === __require.main && U(process.argv.slice(2));
+    F.exports = J;
+    F === __require.main && J(process.argv.slice(2));
   });
-  var E = y();
-  var ve = V();
-  module.exports = E;
-  module.exports.config = E.config;
-  module.exports.configDotenv = E.configDotenv;
-  module.exports.parse = E.parse;
-  module.exports.populate = E.populate;
+  var D = N();
+  var Oe = K();
+  module.exports = D;
+  module.exports.config = D.config;
+  module.exports.configDotenv = D.configDotenv;
+  module.exports.parse = D.parse;
+  module.exports.populate = D.populate;
 });
 
 // src/load-env.ts
 var import_dotenv = __toESM(require_dist(), 1);
 import path from "path";
-import_dotenv.config({ path: path.resolve(process.cwd(), ".env"), quiet: true });
+if (process.env.GO_LABS_CLI_SKIP_DOTENV !== "1") {
+  import_dotenv.config({ path: path.resolve(process.cwd(), ".env"), quiet: true });
+}
 
 // ../../cli-auth/src/client/credential-store.ts
 import { createHash as createHash2, randomUUID } from "crypto";
@@ -1493,6 +1485,8 @@ function datetime(args) {
 }
 var anyString = /^[\s\S]{0,}$/;
 var number = /^-?\d+(?:\.\d+)?$/;
+var boolean = /^(?:true|false)$/i;
+var _null = /^null$/i;
 var lowercase = /^[^A-Z]*$/;
 var uppercase = /^[^a-z]*$/;
 
@@ -2374,6 +2368,43 @@ var $ZodNumberFormat = /* @__PURE__ */ $constructor("$ZodNumberFormat", (inst, d
   $ZodCheckNumberFormat.init(inst, def);
   $ZodNumber.init(inst, def);
 });
+var $ZodBoolean = /* @__PURE__ */ $constructor("$ZodBoolean", (inst, def) => {
+  $ZodType.init(inst, def);
+  inst._zod.pattern = boolean;
+  inst._zod.parse = (payload, _ctx) => {
+    if (def.coerce)
+      try {
+        payload.value = Boolean(payload.value);
+      } catch (_) {}
+    const input = payload.value;
+    if (typeof input === "boolean")
+      return payload;
+    payload.issues.push({
+      expected: "boolean",
+      code: "invalid_type",
+      input,
+      inst
+    });
+    return payload;
+  };
+});
+var $ZodNull = /* @__PURE__ */ $constructor("$ZodNull", (inst, def) => {
+  $ZodType.init(inst, def);
+  inst._zod.pattern = _null;
+  inst._zod.values = new Set([null]);
+  inst._zod.parse = (payload, _ctx) => {
+    const input = payload.value;
+    if (input === null)
+      return payload;
+    payload.issues.push({
+      expected: "null",
+      code: "invalid_type",
+      input,
+      inst
+    });
+    return payload;
+  };
+});
 var $ZodUnknown = /* @__PURE__ */ $constructor("$ZodUnknown", (inst, def) => {
   $ZodType.init(inst, def);
   inst._zod.parse = (payload) => payload;
@@ -3911,6 +3942,18 @@ function _int(Class, params) {
     ...normalizeParams(params)
   });
 }
+function _boolean(Class, params) {
+  return new Class({
+    type: "boolean",
+    ...normalizeParams(params)
+  });
+}
+function _null2(Class, params) {
+  return new Class({
+    type: "null",
+    ...normalizeParams(params)
+  });
+}
 function _unknown(Class) {
   return new Class({
     type: "unknown"
@@ -4793,6 +4836,18 @@ var numberProcessor = (schema, ctx, _json, params) => {
       json.allOf = [...json.allOf ?? [], ...rest.map((m) => ({ multipleOf: m }))];
   }
 };
+var booleanProcessor = (_schema, _ctx, json, _params) => {
+  json.type = "boolean";
+};
+var nullProcessor = (_schema, ctx, json, _params) => {
+  if (ctx.target === "openapi-3.0") {
+    json.type = "string";
+    json.nullable = true;
+    json.enum = [null];
+  } else {
+    json.type = "null";
+  }
+};
 var neverProcessor = (_schema, _ctx, json, _params) => {
   json.not = {};
 };
@@ -5587,6 +5642,22 @@ var ZodNumberFormat = /* @__PURE__ */ $constructor("ZodNumberFormat", (inst, def
 function int(params) {
   return _int(ZodNumberFormat, params);
 }
+var ZodBoolean = /* @__PURE__ */ $constructor("ZodBoolean", (inst, def) => {
+  $ZodBoolean.init(inst, def);
+  ZodType.init(inst, def);
+  inst._zod.processJSONSchema = (ctx, json, params) => booleanProcessor(inst, ctx, json, params);
+});
+function boolean2(params) {
+  return _boolean(ZodBoolean, params);
+}
+var ZodNull = /* @__PURE__ */ $constructor("ZodNull", (inst, def) => {
+  $ZodNull.init(inst, def);
+  ZodType.init(inst, def);
+  inst._zod.processJSONSchema = (ctx, json, params) => nullProcessor(inst, ctx, json, params);
+});
+function _null3(params) {
+  return _null2(ZodNull, params);
+}
 var ZodUnknown = /* @__PURE__ */ $constructor("ZodUnknown", (inst, def) => {
   $ZodUnknown.init(inst, def);
   ZodType.init(inst, def);
@@ -6005,6 +6076,9 @@ var storedCliCredentialsSchema = object({
   session: cliSessionIdentitySchema
 }).strict();
 var cliProductSchema = _enum(cliProducts);
+// ../../cli-auth/src/client/secret-backend.ts
+import { execFile } from "child_process";
+
 // ../../cli-auth/src/client/runtime.ts
 var MINIMUM_BUN_VERSION = [1, 4, 0];
 var parseBunVersion = (version) => {
@@ -6030,27 +6104,145 @@ var assertBunRuntime = (runtime = globalThis.Bun) => {
   }
 };
 
-// ../../cli-auth/src/client/credential-store.ts
+// ../../cli-auth/src/client/storage-error.ts
+var guidance = {
+  "missing-library": "Install the runtime's native credential-store library and ensure your own native keyring/session is accessible and unlocked; Linux desktop storage requires libsecret AND an accessible, unlocked Secret Service.",
+  "bus-unavailable": "The Linux user D-Bus session is absent or unreachable. --no-browser does not provide storage. Start or repair your own user session and native keyring before retrying.",
+  "bus-denied": "Access to the Linux user bus was denied. Fix your own native keyring/session permissions or host policy; do not change bus/socket permissions or borrow another user's bus.",
+  "service-unavailable": "The user bus is reachable but your own Secret Service is unavailable. Start or repair your own native keyring session; do not expose another user's store.",
+  locked: "Unlock your own native credential collection/session before retrying. The CLI will not wait indefinitely for an unlock prompt.",
+  timeout: "The native credential backend did not finish within 10 seconds and its process was terminated. Fix or unlock your own native keyring/session outside the CLI; the CLI will not bypass host permissions.",
+  "invalid-response": "The native credential backend returned an invalid response. Check your own keyring/session and configuration; no credential output was disclosed.",
+  "read-failed": "The native credential backend could not read credentials. Check your own keyring/session availability and permissions; this is not evidence that you are logged out.",
+  "write-failed": "The native credential backend could not persist credentials. Check your own keyring/session write permissions and availability; no plaintext fallback is used.",
+  "delete-failed": "The native credential backend could not delete its entry. Check your own keyring/session permissions and remove any non-secret preflight probe through that backend if necessary."
+};
+
 class CliCredentialStoreUnavailableError extends Error {
   code = "CLI_CREDENTIAL_STORE_UNAVAILABLE";
-  constructor(product, options) {
-    super(`Secure credential storage is unavailable for the ${product} CLI. Bun.secrets requires the operating system credential store, including Secret Service on Linux. Browser authentication cannot continue without a supported secure store.`, options);
+  reason;
+  constructor(product, reason = "read-failed") {
+    super(`Secure credential storage is unavailable for the ${product} CLI [CLI_CREDENTIAL_STORE_UNAVAILABLE:${reason}]. ${guidance[reason]}`);
     this.name = "CliCredentialStoreUnavailableError";
-  }
+    this.reason = reason;
+  }
+}
+var classifyCredentialStoreFailure = (message, fallback) => {
+  if (/libsecret.*(not found|not available|cannot open|load)|dlopen|shared (object|library).*not found/i.test(message))
+    return "missing-library";
+  if (/(d-?bus|user bus|session bus).*(denied|not permitted)|(?:denied|not permitted).*(d-?bus|user bus|session bus)/i.test(message))
+    return "bus-denied";
+  if (/locked|interaction.*not allowed|user.*cancel/i.test(message))
+    return "locked";
+  if (/ServiceUnknown|org\.freedesktop\.secrets.*(not provided|no owner|not available)|secret.?service.*(unavailable|not running)/i.test(message))
+    return "service-unavailable";
+  if (/d-?bus|user bus|session bus|autolaunch/i.test(message))
+    return "bus-unavailable";
+  return fallback;
+};
+
+class CliCredentialPersistenceError extends Error {
+  remoteRevoked;
+  localRestored;
+  phase;
+  code = "CLI_CREDENTIAL_PERSISTENCE_FAILED";
+  constructor(remoteRevoked, localRestored, phase) {
+    super(`CLI credentials could not be saved after ${phase} [CLI_CREDENTIAL_PERSISTENCE_FAILED]. ${remoteRevoked ? "The newly issued session was revoked." : "Remote revocation could not be confirmed; revoke the session in the product's session management before retrying."} ${localRestored ? phase === "login" ? "The previous local credentials were preserved." : "The unusable rotated local credentials were removed; sign in again." : "Local cleanup could not be confirmed. Inspect your own native credential backend before retrying."}`);
+    this.remoteRevoked = remoteRevoked;
+    this.localRestored = localRestored;
+    this.phase = phase;
+    this.name = "CliCredentialPersistenceError";
+  }
+}
+var getCliStorageError = (error) => {
+  if (error instanceof CliCredentialStoreUnavailableError)
+    return {
+      code: error.code,
+      message: error.message,
+      details: { reason: error.reason }
+    };
+  if (error instanceof CliCredentialPersistenceError)
+    return {
+      code: error.code,
+      message: error.message,
+      details: {
+        remoteRevoked: error.remoteRevoked,
+        localRestored: error.localRestored,
+        phase: error.phase
+      }
+    };
+  return;
+};
+
+// ../../cli-auth/src/client/secret-backend.ts
+var timeoutMs = 1e4;
+var maxBuffer = 64 * 1024;
+var runBackend = (product, executable, args, input, failure) => new Promise((resolve, reject) => {
+  const child = execFile(executable, args, {
+    timeout: timeoutMs,
+    killSignal: "SIGKILL",
+    maxBuffer,
+    windowsHide: true
+  }, (error, stdout, stderr) => {
+    if (error) {
+      const reason = error.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER" ? "invalid-response" : error.killed ? "timeout" : classifyCredentialStoreFailure(`${stdout}
+${stderr}`, failure);
+      reject(new CliCredentialStoreUnavailableError(product, reason));
+      return;
+    }
+    resolve(stdout);
+  });
+  child.stdin?.on("error", () => {});
+  child.stdin?.end(input);
+});
+var nativeWorker = `
+try {
+ const { operation, input } = JSON.parse(await Bun.stdin.text());
+ const value = await Bun.secrets[operation](input);
+ process.stdout.write(JSON.stringify({ value: value ?? null }));
+} catch (error) {
+ const message = error instanceof Error ? error.message : "Credential backend failed";
+ // libsecret's bus transport errors can omit the D-Bus context.
+ const context = process.platform === "linux" && /^Could not connect:/i.test(message) ? "D-Bus: " : "";
+ process.stderr.write(context + message);
+ process.exitCode = 1;
 }
-var useSecrets = async (product, operation) => {
+`;
+var nativeResponse = object({ value: union([string2(), boolean2(), _null3()]) }).strict();
+var createIsolatedBunSecrets = (product) => {
+  const run = async (operation, input) => {
+    assertBunRuntime();
+    const output = await runBackend(product, process.execPath, ["--no-env-file", "--eval", nativeWorker], JSON.stringify({ operation, input }), operation === "set" ? "write-failed" : operation === "delete" ? "delete-failed" : "read-failed");
+    try {
+      return nativeResponse.parse(JSON.parse(output)).value;
+    } catch {
+      throw new CliCredentialStoreUnavailableError(product, "invalid-response");
+    }
+  };
+  return {
+    get: async (input) => {
+      const value = await run("get", input);
+      if (value === null || typeof value === "string")
+        return value;
+      throw new CliCredentialStoreUnavailableError(product, "invalid-response");
+    },
+    set: async (input) => {
+      await run("set", input);
+    },
+    delete: async (input) => await run("delete", input) === true
+  };
+};
+
+// ../../cli-auth/src/client/credential-store.ts
+var runSecretOperation = async (product, operation, fallback = "read-failed") => {
   try {
     return await operation();
   } catch (cause) {
     if (cause instanceof CliCredentialStoreUnavailableError)
       throw cause;
-    throw new CliCredentialStoreUnavailableError(product, { cause });
+    throw new CliCredentialStoreUnavailableError(product, classifyCredentialStoreFailure(cause instanceof Error ? cause.message : "", fallback));
   }
 };
-var defaultSecrets = () => {
-  assertBunRuntime();
-  return Bun.secrets;
-};
 var refreshLockTimeoutMs = 5 * 60 * 1000;
 var refreshLockRetryMs = 50;
 var getCredentialLockDirectoryPath = () => {
@@ -6122,18 +6314,38 @@ var acquireRefreshLock = async (path) => {
   }
   throw new Error("Timed out waiting for another CLI process to refresh credentials. Retry the command.");
 };
+var resolveCliCredentialAccount = (environment = process.env) => environment.GO_LABS_CLI_CREDENTIAL_ACCOUNT?.trim() || "default";
 var createBunCredentialStore = ({
-  account = "default",
+  account = resolveCliCredentialAccount(),
   product,
-  secrets = defaultSecrets()
+  secrets = createIsolatedBunSecrets(product)
 }) => {
   const service = `go-labs-cli:${product}`;
   return {
+    preflight: async () => {
+      const input = { name: `probe-${randomUUID()}`, service };
+      const value = `go-labs-non-secret-probe:${randomUUID()}`;
+      try {
+        await runSecretOperation(product, () => secrets.set({ ...input, value }), "write-failed");
+        if (await runSecretOperation(product, () => secrets.get(input)) !== value) {
+          throw new CliCredentialStoreUnavailableError(product, "write-failed");
+        }
+      } catch (error) {
+        await secrets.delete(input).catch(() => {
+          return;
+        });
+        throw error;
+      }
+      await runSecretOperation(product, () => secrets.delete(input), "delete-failed");
+      if (await runSecretOperation(product, () => secrets.get(input)) !== null) {
+        throw new CliCredentialStoreUnavailableError(product, "delete-failed");
+      }
+    },
     delete: async () => {
-      await useSecrets(product, () => secrets.delete({ name: account, service }));
+      await runSecretOperation(product, () => secrets.delete({ name: account, service }), "delete-failed");
     },
     get: async () => {
-      const value = await useSecrets(product, () => secrets.get({ name: account, service }));
+      const value = await runSecretOperation(product, () => secrets.get({ name: account, service }));
       if (value === null)
         return null;
       try {
@@ -6144,11 +6356,11 @@ var createBunCredentialStore = ({
     },
     set: async (credentials) => {
       const parsed = storedCliCredentialsSchema.parse(credentials);
-      await useSecrets(product, () => secrets.set({
+      await runSecretOperation(product, () => secrets.set({
         name: account,
         service,
         value: JSON.stringify(parsed)
-      }));
+      }), "write-failed");
     },
     withCredentialLock: async (operation) => {
       const refreshLockPath = await getCredentialLockPath(product, account);
@@ -6169,6 +6381,7 @@ var createBunCredentialStore = ({
 };
 // ../../cli-auth/src/client/login.ts
 import { hostname } from "os";
+import { isDeepStrictEqual } from "util";
 var normalizeCliAuthIssuer = (value) => {
   const url = new URL(value);
   url.hash = "";
@@ -6231,12 +6444,15 @@ var openSystemBrowser = async (url) => {
     "-NoProfile",
     "-NonInteractive",
     "-Command",
-    "Start-Process -FilePath $args[0]",
-    url
+    "Start-Process -FilePath $env:GO_LABS_CLI_VERIFICATION_URI -ErrorAction Stop"
   ] : ["xdg-open", url];
   try {
-    const process2 = Bun.spawn(command, { stderr: "ignore", stdout: "ignore" });
-    return await process2.exited === 0;
+    const browserProcess = Bun.spawn(command, {
+      env: process.platform === "win32" ? { ...process.env, GO_LABS_CLI_VERIFICATION_URI: url } : process.env,
+      stderr: "ignore",
+      stdout: "ignore"
+    });
+    return await browserProcess.exited === 0;
   } catch {
     return false;
   }
@@ -6254,6 +6470,8 @@ var loginWithBrowser = async ({
   store
 }) => {
   const baseUrl = normalizeCliAuthIssuer(apiBaseUrl);
+  if (store.preflight)
+    await withCredentialLock(store, () => store.preflight?.() ?? Promise.resolve());
   const pkce = createPkcePair();
   const beginResponse = await postJson(fetchImplementation, `${baseUrl}/api/cli-auth/device`, {
     clientName,
@@ -6281,7 +6499,19 @@ var loginWithBrowser = async ({
     if (response.ok) {
       const issued = tokenResponseSchema.parse(payload);
       const credentials = toStoredCredentials(issued, baseUrl, now());
-      await withCredentialLock(store, () => store.set(credentials));
+      try {
+        await withCredentialLock(store, () => persistIssuedCredentials({
+          store,
+          credentials,
+          apiBaseUrl: baseUrl,
+          fetch: fetchImplementation,
+          phase: "login"
+        }));
+      } catch (error) {
+        if (error instanceof CliCredentialPersistenceError)
+          throw error;
+        throw new CliCredentialPersistenceError(await revokeIssuedCredentials(fetchImplementation, baseUrl, credentials), false, "login");
+      }
       return credentials;
     }
     const error = deviceTokenErrorSchema.safeParse(payload);
@@ -6301,6 +6531,55 @@ var loginWithBrowser = async ({
   }
   throw new Error("CLI authentication expired. Run auth login again.");
 };
+var revokeIssuedCredentials = async (fetchImplementation, apiBaseUrl, credentials) => {
+  try {
+    const response = await postJson(fetchImplementation, `${normalizeCliAuthIssuer(apiBaseUrl)}/api/cli-auth/revoke`, { refreshToken: credentials.refreshToken }, { signal: AbortSignal.timeout(refreshRequestTimeoutMs) });
+    return response.ok;
+  } catch {
+    return false;
+  }
+};
+var persistIssuedCredentials = async ({
+  store,
+  credentials,
+  previous,
+  apiBaseUrl,
+  fetch: fetchImplementation,
+  phase
+}) => {
+  let prior = previous;
+  try {
+    if (phase === "login")
+      prior = await store.get();
+    await store.set(credentials);
+    const saved = await store.get();
+    if (!isDeepStrictEqual(saved, credentials))
+      throw new Error("Credential write could not be verified");
+    return;
+  } catch {
+    const remoteRevoked = await revokeIssuedCredentials(fetchImplementation, apiBaseUrl, credentials);
+    let localRestored = false;
+    try {
+      const current = await store.get();
+      if (phase === "login" && prior !== undefined) {
+        if (isDeepStrictEqual(current, prior))
+          localRestored = true;
+        else if (current === null || current.refreshToken === credentials.refreshToken) {
+          if (prior)
+            await store.set(prior);
+          else
+            await store.delete();
+          localRestored = isDeepStrictEqual(await store.get(), prior);
+        }
+      } else if (phase === "refresh" && (!current || current.refreshToken === credentials.refreshToken || current.refreshToken === prior?.refreshToken)) {
+        if (current)
+          await store.delete();
+        localRestored = await store.get() === null;
+      }
+    } catch {}
+    throw new CliCredentialPersistenceError(remoteRevoked, localRestored, phase);
+  }
+};
 var refreshes = new WeakMap;
 var refreshRequestTimeoutMs = 30000;
 var isInvalidGrantResponse = (payload) => {
@@ -6355,7 +6634,14 @@ var refreshAccessToken = async ({
     throw new Error("Unable to refresh the CLI session because the API returned invalid credentials. Credentials were kept; retry the command.");
   }
   const stored = toStoredCredentials(issued, normalizeCliAuthIssuer(apiBaseUrl), now());
-  await store.set(stored);
+  await persistIssuedCredentials({
+    store,
+    credentials: stored,
+    previous: credentials,
+    apiBaseUrl,
+    fetch: fetchImplementation,
+    phase: "refresh"
+  });
   return stored.accessToken;
 };
 var refreshWithCurrentCredentials = async ({
@@ -6592,6 +6878,11 @@ var errorCode = (error) => {
   return "INTERNAL_ERROR";
 };
 var writeError = (runtime, error) => {
+  const storageError = getCliStorageError(error);
+  if (storageError) {
+    runtime.stderr.write(serialize({ ok: false, error: storageError }));
+    return;
+  }
   const message = error instanceof Error ? sanitizeErrorMessage(error.message) : "Unknown error.";
   runtime.stderr.write(serialize({ ok: false, error: { code: errorCode(error), message } }));
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@go-labs-sg/event-tech",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Event Tech CLI for managing Event Tech resources through the Go Labs API.",
   "type": "module",
   "main": "./dist/index.js",