@mnemonik/cli 7.111.10 → 7.112.3

package/dist/auth/credentials.js

@@ -501,6 +501,13 @@ var require_ignore = __commonJS({
   }
 });
 
+// packages/shared/dist/hookTimeouts.js
+var init_hookTimeouts = __esm({
+  "packages/shared/dist/hookTimeouts.js"() {
+    "use strict";
+  }
+});
+
 // packages/shared/dist/runtimeSigners.js
 import { lstatSync, mkdirSync, readFileSync, writeFileSync, renameSync, unlinkSync } from "node:fs";
 import { basename, dirname as dirname2, join as join2, resolve, sep, win32 } from "node:path";
@@ -747,11 +754,37 @@ var init_runtimeReader = __esm({
 });
 
 // packages/shared/dist/projectSetupHandoff.js
+var PROJECT_ENSURE_TIMEOUT_MS, SUPERVISOR, RUN_STALE_MS;
 var init_projectSetupHandoff = __esm({
   "packages/shared/dist/projectSetupHandoff.js"() {
     "use strict";
     init_runtimeSigners();
+    init_hookTimeouts();
     init_runtimeReader();
+    PROJECT_ENSURE_TIMEOUT_MS = 3e4;
+    SUPERVISOR = `
+const { execFile } = require('node:child_process');
+const { writeFileSync, renameSync } = require('node:fs');
+const [out, bin, ...args] = process.argv.slice(1);
+let input = '';
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', (chunk) => (input += chunk));
+process.stdin.on('end', () => {
+  const child = execFile(
+    process.execPath,
+    [bin, ...args],
+    { shell: false, timeout: ${PROJECT_ENSURE_TIMEOUT_MS}, killSignal: 'SIGKILL', maxBuffer: 64 * 1024, env: process.env },
+    (error, stdout) => {
+      const result = { code: error ? (typeof error.code === 'number' ? error.code : null) : 0, killed: !!(error && error.killed), stdout: String(stdout) };
+      writeFileSync(out + '.tmp', JSON.stringify(result), { mode: 0o600 });
+      renameSync(out + '.tmp', out);
+    }
+  );
+  child.stdin.on('error', () => {});
+  child.stdin.end(input);
+});
+`;
+    RUN_STALE_MS = PROJECT_ENSURE_TIMEOUT_MS + 1e4;
   }
 });
 
@@ -760,6 +793,7 @@ var init_hookRuntime = __esm({
   "packages/shared/dist/hookRuntime.js"() {
     "use strict";
     init_runtimeSigners();
+    init_hookTimeouts();
     init_repositoryRoot();
     init_runtimeReader();
     init_runtimeSigners();
@@ -2345,8 +2379,9 @@ var require_proper_lockfile = __commonJS({
 });
 
 // packages/credentials/dist/index.js
-import { createHmac, randomBytes } from "node:crypto";
-import { join as join6 } from "node:path";
+import { createHash as createHash4, createHmac, randomBytes } from "node:crypto";
+import { realpath } from "node:fs/promises";
+import { basename as basename3, dirname as dirname5, join as join6 } from "node:path";
 
 // packages/shared/dist/instructions.js
 var INSTRUCTIONS_CONTENT = `Mnemonik provides persistent project memory: decisions, rationale, tasks, and policies across sessions. If no block begins "PROJECT_CONTEXT schemaVersion=", session_bootstrap({ cwd }) loads project context when cwd is the real absolute path of the project root; a placeholder or relative path fails. With that block, context is loaded and no session_bootstrap call is needed. Code and docs show current artifacts, git shows changes, and memory carries the why; memory_search recalls rationale or intent, then Grep or Read verifies current source.
@@ -2359,7 +2394,7 @@ Project work items live in tasks. A pending list requires action:"list" and stat
 
 Which tool for what:
 - memory_get: hydrates exact originals by id.
-- memory_add: saves a discrete decision or root cause.
+- memory_add: saves a decision, a user's preference, or a root cause.
 - memory_state: corrects wrong, outdated, or conflicting memory.
 - memory_info: explains confidence or origin when memory looks suspect.
 - memory_links: connects related decisions so they surface together.
@@ -2368,7 +2403,8 @@ Which tool for what:
 - policy: stores durable enforced rules or preferences, not memories.
 - tasks: creates follow-up work and closes completed work.
 - code_search: finds conceptual code when source wording differs.
-- memory_search: finds rationale, intent, decisions, and prior work.`;
+- memory_search: finds rationale, intent, decisions, and prior work.
+- memory_ingest: brings the project's docs and code comments into memory when asked.`;
 function getMcpInstructions() {
   const process2 = globalThis.process;
   if (!process2?.env) {
@@ -6530,6 +6566,9 @@ var DEFAULT_OPTIONS = {
 };
 var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 
+// packages/shared/dist/index.js
+init_hookTimeouts();
+
 // packages/shared/dist/jitDeliveryAck.js
 init_runtimeSigners();
 
@@ -6817,16 +6856,17 @@ function isCredentialSessionUnavailableError(error) {
 // packages/credentials/dist/storage.js
 import { createHash as createHash3 } from "node:crypto";
 import { lstat as nodeLstat, mkdir as mkdir2, open as open2, readdir, rmdir as rmdir2, unlink as unlink2 } from "node:fs/promises";
-import { constants } from "node:fs";
+import { constants, realpathSync as realpathSync2 } from "node:fs";
 import { basename as basename2, dirname as dirname4, isAbsolute, join as join5, parse, relative, resolve as resolve2, sep as sep2 } from "node:path";
 var CredentialError = class extends Error {
   reason;
-  constructor(reason) {
-    super(reason);
+  constructor(reason, message = reason) {
+    super(message);
     this.reason = reason;
     this.name = "CredentialError";
   }
 };
+var STATE_ROOT_LINK_MESSAGE = "The Mnemonik state directory is a symbolic link. Replace it with a real directory, or set MNEMONIK_STATE_DIR to one.";
 var digest = (value) => createHash3("sha256").update(value).digest("hex");
 function credentialPaths(stateDir = stateDirectory(), familyId) {
   const root = join5(stateDir, "credentials");
@@ -6846,8 +6886,25 @@ function credentialPaths(stateDir = stateDirectory(), familyId) {
   };
 }
 var codeIs2 = (error, code) => error.code === code;
+function canonicalDirectory(path) {
+  const missing = [];
+  let current2 = resolve2(path);
+  for (; ; ) {
+    try {
+      return join5(realpathSync2.native(current2), ...missing.reverse());
+    } catch (error) {
+      const parent = dirname4(current2);
+      if (!codeIs2(error, "ENOENT") || parent === current2)
+        return resolve2(path);
+      missing.push(basename2(current2));
+      current2 = parent;
+    }
+  }
+}
 var SecureFiles = class {
   stateDir;
+  /** The root as configured; paths spelled through it are rebased onto `stateDir`. */
+  configuredStateDir;
   platform;
   lstat;
   uid;
@@ -6856,7 +6913,8 @@ var SecureFiles = class {
   username;
   aclRun;
   constructor(options = {}) {
-    this.stateDir = resolve2(options.stateDir ?? stateDirectory());
+    this.configuredStateDir = resolve2(options.stateDir ?? stateDirectory());
+    this.stateDir = join5(canonicalDirectory(dirname4(this.configuredStateDir)), basename2(this.configuredStateDir));
     this.platform = options.platform ?? process.platform;
     this.lstat = options.lstat ?? nodeLstat;
     this.uid = options.uid ?? process.getuid?.();
@@ -6866,7 +6924,10 @@ var SecureFiles = class {
     this.aclRun = options.aclRun;
   }
   assertInsideState(path) {
-    const absolute = resolve2(path);
+    let absolute = resolve2(path);
+    const fromConfigured = relative(this.configuredStateDir, absolute);
+    if (this.configuredStateDir !== this.stateDir && fromConfigured !== ".." && !fromConfigured.startsWith(`..${sep2}`) && !isAbsolute(fromConfigured))
+      absolute = join5(this.stateDir, fromConfigured);
     const fromState = relative(this.stateDir, absolute);
     if (fromState === ".." || fromState.startsWith(`..${sep2}`) || isAbsolute(fromState))
       throw new CredentialError("path_outside_state");
@@ -6887,6 +6948,8 @@ var SecureFiles = class {
   async inspect(path, expectFile, allowMissing) {
     const absolute = this.assertInsideState(path);
     for (const component of this.components(absolute)) {
+      if (component !== this.stateDir && !component.startsWith(`${this.stateDir}${sep2}`))
+        continue;
       let value;
       try {
         value = await this.lstat(component);
@@ -6896,10 +6959,7 @@ var SecureFiles = class {
         throw error;
       }
       if (value.isSymbolicLink())
-        throw new CredentialError("symlink_rejected");
-      const protectedComponent = component === this.stateDir || component.startsWith(`${this.stateDir}${sep2}`);
-      if (!protectedComponent)
-        continue;
+        throw new CredentialError("symlink_rejected", component === this.stateDir ? STATE_ROOT_LINK_MESSAGE : void 0);
       const final = component === absolute;
       if (this.platform === "win32") {
         if (final)
@@ -7237,6 +7297,7 @@ var action = (familyId, reason) => ({
   reason,
   familyId
 });
+var isSecretMissing = (error) => error instanceof Error && error.message === "credential_secret_missing";
 var retryLater = (familyId, reason) => ({
   status: "RETRY_LATER",
   reason,
@@ -7244,12 +7305,15 @@ var retryLater = (familyId, reason) => ({
 });
 var isFailure = (result) => "status" in result && (result.status === "ACTION_REQUIRED" || result.status === "RETRY_LATER");
 var diagnosedStores = /* @__PURE__ */ new WeakSet();
+var familyFileName = /^([0-9a-f]{64})\.json(?:\.[0-9a-f-]{36}\.tmp)?$/;
+var temporaryOf = (base, name2) => name2.startsWith(`${base}.`) && /^\.[0-9a-f-]{36}\.tmp$/.test(name2.slice(base.length));
 function createCredentialAdapter(options = {}) {
   const files = new SecureFiles({ ...options, stateDir: options.stateDir ?? stateDirectory() });
   const paths = credentialPaths(files.stateDir);
   const now = options.now ?? Date.now;
   const sleep = options.sleep ?? wait;
   const retryLimit = options.retryLimit ?? 2;
+  const lockWaitMs = options.lockWaitMs ?? 6e4;
   const store = options.secretStore;
   const rotations = /* @__PURE__ */ new Map();
   let osAvailable;
@@ -7265,7 +7329,10 @@ function createCredentialAdapter(options = {}) {
       disable();
     return ok;
   }) : Promise.resolve(false);
-  const reference = (name2) => `mnemonik.credentials.v1:${name2}`;
+  const reference = async (name2) => {
+    const directory = createHash4("sha256").update(await realpath(files.stateDir));
+    return `mnemonik.credentials.v1:${name2}:${directory.digest("hex").slice(0, 32)}`;
+  };
   const relativeSecret = (path) => path.slice(files.stateDir.length + 1);
   const fileBackend = {
     store: "file",
@@ -7297,7 +7364,7 @@ function createCredentialAdapter(options = {}) {
   async function locator(name2, file, existing) {
     if (existing?.store === "os")
       return existing;
-    return name2 === "cli-oauth" && await osBackend.isAvailable() ? { store: "os", secretRef: reference(name2) } : { store: "file", secretFile: relativeSecret(file) };
+    return name2 === "cli-oauth" && await osBackend.isAvailable() ? { store: "os", secretRef: await reference(name2) } : { store: "file", secretFile: relativeSecret(file) };
   }
   const useFile = (location, file) => {
     Object.assign(location, { store: "file", secretFile: relativeSecret(file) });
@@ -7351,6 +7418,14 @@ function createCredentialAdapter(options = {}) {
     return bytes ? parse2(bytes, kind) : null;
   }
   async function putCliOAuth(metadata2, tokens) {
+    await files.ensureParent(paths.cliRecord);
+    return leased(paths.cliRecord, () => writeCliOAuth(metadata2, tokens), () => putCliOAuth(metadata2, tokens));
+  }
+  async function waitForCliLease() {
+    await files.ensureParent(paths.cliRecord);
+    await leased(paths.cliRecord, async () => void 0, () => void 0);
+  }
+  async function writeCliOAuth(metadata2, tokens) {
     const current2 = await readRecord(paths.cliRecord, "cli-oauth");
     const location = await locator("cli-oauth", paths.cliSecret, current2 ?? void 0);
     const secret = typeof tokens === "string" ? { accessToken: "", refreshToken: tokens, accessExpiresAt: (/* @__PURE__ */ new Date(0)).toISOString() } : tokens;
@@ -7417,8 +7492,11 @@ function createCredentialAdapter(options = {}) {
   }
   async function putFamily(componentKind, response) {
     const familyPaths = credentialPaths(files.stateDir, response.id);
-    const current2 = await readRecord(familyPaths.record, "component");
-    return persistFamily(componentKind, response, current2 ?? void 0);
+    await files.ensureParent(familyPaths.record);
+    return leased(familyPaths.record, async () => {
+      const current2 = await readRecord(familyPaths.record, "component");
+      return persistFamily(componentKind, response, current2 ?? void 0);
+    }, () => putFamily(componentKind, response));
   }
   async function readFamily(familyId) {
     const familyPaths = credentialPaths(files.stateDir, familyId);
@@ -7438,49 +7516,73 @@ function createCredentialAdapter(options = {}) {
     void _file;
     return { ...publicMetadata, ...secret };
   }
-  async function requestRotation(familyId, request) {
-    const started = now();
-    let lostResponseRetried = false;
-    let retryableAttempt = 0;
+  async function requestRotation(familyId, request, state) {
     while (true) {
       let response;
       try {
         response = await request();
       } catch {
-        if (lostResponseRetried)
+        if (state.lostResponseRetried)
           return action(familyId, "rotation_response_lost");
-        lostResponseRetried = true;
+        state.lostResponseRetried = true;
         await sleep(250);
-        if (now() > started + 6e4)
+        if (now() > state.started + 6e4)
           return action(familyId, "rotation_response_lost");
         continue;
       }
       if (response.status === 400 && response.body.error === "invalid_grant")
         return action(familyId, "invalid_grant");
       if (response.status === 429 || response.status >= 500) {
-        if (lostResponseRetried)
+        if (state.lostResponseRetried)
           return action(familyId, "rotation_response_lost");
-        if (retryableAttempt >= retryLimit)
+        if (state.retryableAttempt >= retryLimit)
           return retryLater(familyId, response.status === 429 ? "rate_limited" : "server_error");
-        const delay2 = response.retryAfterMs ?? 250 * 2 ** retryableAttempt;
-        retryableAttempt += 1;
-        await sleep(delay2);
-        continue;
+        const delay2 = response.retryAfterMs ?? 250 * 2 ** state.retryableAttempt;
+        state.retryableAttempt += 1;
+        return { backoffMs: delay2 };
       }
       return response;
     }
   }
+  async function leased(recordPath2, work, vanished) {
+    let entered = false;
+    try {
+      return await withLock(recordPath2, lockWaitMs, () => {
+        entered = true;
+        return work();
+      });
+    } catch (error) {
+      if (entered || error.code !== "ENOENT")
+        throw error;
+      return vanished();
+    }
+  }
   async function rotateStored(lockPath, missingId, read, request, decode, persist) {
     const predecessor = await read();
     if (!predecessor)
       return action(missingId, "family_missing");
-    return withLock(lockPath, options.lockWaitMs ?? 6e4, async () => {
+    const attempts = {
+      started: now(),
+      lostResponseRetried: false,
+      retryableAttempt: 0
+    };
+    for (; ; ) {
+      const outcome = await rotateStoredOnce(lockPath, predecessor, read, request, decode, persist, attempts);
+      if (!("backoffMs" in outcome))
+        return outcome;
+      await sleep(outcome.backoffMs);
+    }
+  }
+  async function rotateStoredOnce(lockPath, predecessor, read, request, decode, persist, attempts) {
+    return leased(lockPath, async () => {
       const current2 = await read();
       if (!current2)
         return action(predecessor.familyId, "family_missing");
       if (current2.refreshToken !== predecessor.refreshToken)
         return current2;
-      const response = await requestRotation(current2.familyId, () => request(current2));
+      const response = await requestRotation(current2.familyId, () => request(current2), attempts);
+      if ("backoffMs" in response)
+        return response;
       if ("status" in response && (response.status === "ACTION_REQUIRED" || response.status === "RETRY_LATER"))
         return response;
       if (response.status !== 200)
@@ -7493,21 +7595,19 @@ function createCredentialAdapter(options = {}) {
       } catch {
         return action(current2.familyId, "persistence_failed");
       }
-    });
+    }, () => action(predecessor.familyId, "family_missing"));
   }
   function rotateLocked(familyId, transport) {
     const familyPaths = credentialPaths(files.stateDir, familyId);
-    return rotateStored(familyPaths.record, familyId, () => readFamily(familyId), (current2) => transport.rotateFamily(familyId, current2.refreshToken), (body2) => "access_token" in body2 ? body2 : null, (current2, body2) => persistFamily(current2.componentKind, body2, {
-      schemaVersion: 1,
-      kind: "component",
-      familyId: current2.familyId,
-      componentKind: current2.componentKind,
-      scopes: current2.scopes,
-      accessExpiresAt: current2.accessExpiresAt,
-      refreshExpiresAt: current2.refreshExpiresAt,
-      lastRotationTime: current2.lastRotationTime,
-      ...current2.store === "os" ? { store: "os", secretRef: reference(`component:${familyId}`) } : { store: "file", secretFile: relativeSecret(familyPaths.secret) }
-    }));
+    return rotateStored(
+      familyPaths.record,
+      familyId,
+      () => readFamily(familyId),
+      (current2) => transport.rotateFamily(familyId, current2.refreshToken),
+      (body2) => "access_token" in body2 ? body2 : null,
+      // The stored record's own locator: a reference rebuilt from the name could differ.
+      async (current2, body2) => persistFamily(current2.componentKind, body2, await readRecord(familyPaths.record, "component") ?? void 0)
+    );
   }
   function rotateFamily(familyId, transport) {
     const active = rotations.get(familyId);
@@ -7525,7 +7625,7 @@ function createCredentialAdapter(options = {}) {
   function rotateCliLocked(transport) {
     return rotateStored(paths.cliRecord, "cli", readCliOAuth, (current2) => transport.rotateCli(current2), (body2) => "access_token" in body2 && typeof body2.access_token === "string" && "refresh_token" in body2 && typeof body2.refresh_token === "string" && "expires_in" in body2 && typeof body2.expires_in === "number" && "scope" in body2 && typeof body2.scope === "string" ? body2 : null, async (current2, body2) => {
       const rotatedAt = now();
-      await putCliOAuth({
+      await writeCliOAuth({
         issuer: current2.issuer,
         clientId: current2.clientId,
         familyId: current2.familyId,
@@ -7576,11 +7676,33 @@ function createCredentialAdapter(options = {}) {
     return second.status === 401 ? action(rotated.familyId, "protected_unauthorized") : second;
   }
   async function removeCliOAuth() {
-    const record = await readRecord(paths.cliRecord, "cli-oauth");
-    if (!record)
-      return;
-    await deleteSecret(record, paths.cliSecret);
-    await files.remove(paths.cliRecord);
+    await removeLeased(paths.cliRecord, "cli-oauth", paths.cliSecret);
+  }
+  async function revokeCli(transport) {
+    if (!await readRecord(paths.cliRecord, "cli-oauth"))
+      return action("cli", "family_missing");
+    return leased(paths.cliRecord, async () => {
+      let current2;
+      try {
+        current2 = await readCliOAuth();
+      } catch (error) {
+        if (!isSecretMissing(error))
+          throw error;
+        await removeStored(paths.cliRecord, "cli-oauth", paths.cliSecret);
+        return action("cli", "credential_secret_missing");
+      }
+      if (!current2)
+        return action("cli", "family_missing");
+      const response = await transport.revokeCli(current2);
+      if (response.status === 429)
+        return retryLater(current2.familyId, "rate_limited");
+      if (response.status >= 500)
+        return retryLater(current2.familyId, "server_error");
+      if (response.status !== 200)
+        return action(current2.familyId, "error" in response.body ? response.body.error : "revoke_refused");
+      await removeStored(paths.cliRecord, "cli-oauth", paths.cliSecret);
+      return { status: "revoked", familyId: current2.familyId };
+    }, () => action("cli", "family_missing"));
   }
   async function withCredential(familyId, transport, work) {
     let current2 = await readFamily(familyId);
@@ -7601,43 +7723,98 @@ function createCredentialAdapter(options = {}) {
     const second = await work(rotated.accessToken);
     return second.status === 401 ? action(familyId, "protected_unauthorized") : second;
   }
+  async function removeStored(recordPath2, kind, secretPath) {
+    const record = await readRecord(recordPath2, kind);
+    if (!record)
+      return null;
+    await files.remove(recordPath2);
+    await deleteSecret(record, secretPath);
+    return record;
+  }
+  async function removeLeased(recordPath2, kind, secretPath) {
+    if (!await readRecord(recordPath2, kind))
+      return null;
+    return leased(recordPath2, () => removeStored(recordPath2, kind, secretPath), () => null);
+  }
+  async function orphanRefreshToken(secretPath) {
+    const bytes = await files.read(secretPath);
+    if (!bytes)
+      return null;
+    const secret = JSON.parse(bytes.toString());
+    if (typeof secret.refreshToken !== "string")
+      throw new Error("credential_record_invalid");
+    return secret.refreshToken;
+  }
   async function removeFamily(familyId) {
     const familyPaths = credentialPaths(files.stateDir, familyId);
-    const record = await readRecord(familyPaths.record, "component");
-    if (!record)
-      return;
-    await deleteSecret(record, familyPaths.secret);
-    await files.remove(familyPaths.record);
+    await removeStored(familyPaths.record, "component", familyPaths.secret);
   }
   async function revokeFamily(familyId, transport) {
-    const current2 = await readFamily(familyId);
-    if (!current2)
+    const familyPaths = credentialPaths(files.stateDir, familyId);
+    if (!await readRecord(familyPaths.record, "component") && !await files.read(familyPaths.secret))
       return action(familyId, "family_missing");
-    const response = await transport.revokeFamily(familyId, current2.refreshToken);
-    if (response.status === 429)
-      return retryLater(familyId, "rate_limited");
-    if (response.status >= 500)
-      return retryLater(familyId, "server_error");
-    if (response.status !== 200)
-      return action(familyId, "error" in response.body ? response.body.error : "revoke_refused");
-    await removeFamily(familyId);
-    return { status: "revoked", familyId };
+    await files.ensureParent(familyPaths.record);
+    return leased(familyPaths.record, async () => {
+      let current2;
+      try {
+        current2 = await readFamily(familyId);
+      } catch (error) {
+        if (!isSecretMissing(error))
+          throw error;
+        await removeFamily(familyId);
+        return action(familyId, "credential_secret_missing");
+      }
+      const refreshToken = current2?.refreshToken ?? await orphanRefreshToken(familyPaths.secret);
+      if (!refreshToken)
+        return action(familyId, "family_missing");
+      const response = await transport.revokeFamily(familyId, refreshToken);
+      if (response.status === 429)
+        return retryLater(familyId, "rate_limited");
+      if (response.status >= 500)
+        return retryLater(familyId, "server_error");
+      const refusal = response.status === 200 ? null : "error" in response.body ? response.body.error : "revoke_refused";
+      if (refusal)
+        return action(familyId, refusal);
+      if (current2)
+        await removeFamily(familyId);
+      else
+        await files.remove(familyPaths.secret);
+      return { status: "revoked", familyId };
+    }, () => action(familyId, "family_missing"));
   }
-  async function rootKey() {
-    return withLock(paths.rootRecord, options.lockWaitMs ?? 6e4, async () => {
-      const record = await readRecord(paths.rootRecord, "root-binding");
-      if (record) {
-        const key2 = await readSecret(record, paths.rootSecret);
-        if (!key2 || key2.length !== 32)
-          throw new Error("root_binding_key_invalid");
-        return key2;
-      }
-      const location = await locator("root-binding", paths.rootSecret);
-      const key = randomBytes(32);
-      await writeSecret(location, paths.rootSecret, key);
-      await files.write(paths.rootRecord, json({ schemaVersion: 1, kind: "root-binding", ...location }), "record");
-      return key;
+  async function storedRootKey() {
+    const record = await readRecord(paths.rootRecord, "root-binding");
+    if (!record)
+      return null;
+    const key = await readSecret(record, paths.rootSecret).catch((error) => {
+      if (isSecretMissing(error))
+        return null;
+      throw error;
     });
+    if (key && key.length !== 32)
+      throw new Error("root_binding_key_invalid");
+    return key;
+  }
+  async function rootKey() {
+    const existing = await storedRootKey();
+    if (existing)
+      return existing;
+    await files.ensureParent(paths.rootRecord);
+    return leased(
+      paths.rootRecord,
+      async () => {
+        const stored = await storedRootKey();
+        if (stored)
+          return stored;
+        const location = await locator("root-binding", paths.rootSecret);
+        const key = randomBytes(32);
+        await writeSecret(location, paths.rootSecret, key);
+        await files.write(paths.rootRecord, json({ schemaVersion: 1, kind: "root-binding", ...location }), "record");
+        return key;
+      },
+      // forget erased the binding and its directory while this call waited: create afresh.
+      rootKey
+    );
   }
   async function hmacRootBinding(version, input) {
     if (version !== 1)
@@ -7645,26 +7822,60 @@ function createCredentialAdapter(options = {}) {
     const key = await rootKey();
     return { version, hmac: createHmac("sha256", key).update(input).digest("base64url") };
   }
+  async function eraseEntry(recordPath2, kind, secretPath) {
+    const record = await removeStored(recordPath2, kind, secretPath);
+    if (!record)
+      await files.remove(secretPath);
+    for (const path of [recordPath2, secretPath])
+      for (const entry of await files.list(dirname5(path)))
+        if (temporaryOf(basename3(path), entry))
+          await files.remove(join6(dirname5(path), entry));
+    return record;
+  }
+  async function forgetCliOsOrphan() {
+    if (!store)
+      return;
+    const recordPath2 = paths.cliRecord;
+    const ref = await reference("cli-oauth").catch(() => null);
+    if (!ref || !await available())
+      return;
+    if (!await osBackend.read(ref, "").catch(() => null))
+      return;
+    await files.ensureParent(recordPath2);
+    await leased(recordPath2, async () => {
+      const record = await readRecord(recordPath2, "cli-oauth");
+      if (record?.store === "os" && record.secretRef === ref)
+        return;
+      await osBackend.delete(ref, "");
+    }, () => void 0);
+  }
+  async function forgetEntry(recordPath2, kind, secretPath) {
+    let present = false;
+    for (const path of [recordPath2, secretPath])
+      for (const entry of await files.list(dirname5(path)))
+        present ||= entry === basename3(path) || temporaryOf(basename3(path), entry);
+    if (!present)
+      return null;
+    await files.ensureParent(recordPath2);
+    return leased(recordPath2, () => eraseEntry(recordPath2, kind, secretPath), () => null);
+  }
   async function forget() {
-    const cli = await readRecord(paths.cliRecord, "cli-oauth");
     const componentFamilyIds = [];
-    for (const name2 of await files.list(paths.familyRecords)) {
-      const recordPath2 = join6(paths.familyRecords, name2);
-      const record = await readRecord(recordPath2, "component");
-      if (!record)
-        continue;
-      componentFamilyIds.push(record.familyId);
-      await removeFamily(record.familyId);
-    }
-    if (cli) {
-      await deleteSecret(cli, paths.cliSecret);
-      await files.remove(paths.cliRecord);
-    }
-    const root = await readRecord(paths.rootRecord, "root-binding");
-    if (root) {
-      await deleteSecret(root, paths.rootSecret);
-      await files.remove(paths.rootRecord);
-    }
+    const digests = /* @__PURE__ */ new Set();
+    for (const directory of [paths.familyRecords, paths.familySecrets])
+      for (const name2 of await files.list(directory)) {
+        const digest2 = familyFileName.exec(name2)?.[1];
+        if (digest2)
+          digests.add(digest2);
+      }
+    for (const digest2 of [...digests].sort()) {
+      const record = await forgetEntry(join6(paths.familyRecords, `${digest2}.json`), "component", join6(paths.familySecrets, `${digest2}.json`));
+      if (record)
+        componentFamilyIds.push(record.familyId);
+    }
+    const cli = await forgetEntry(paths.cliRecord, "cli-oauth", paths.cliSecret);
+    await forgetCliOsOrphan();
+    await forgetEntry(paths.rootRecord, "root-binding", paths.rootSecret);
     await files.removeEmptyDirectories([
       paths.familySecrets,
       paths.familyRecords,
@@ -7686,6 +7897,8 @@ function createCredentialAdapter(options = {}) {
     rotateCli,
     withCliCredential,
     removeCliOAuth,
+    revokeCli,
+    waitForCliLease,
     putFamily,
     readFamily,
     rotateFamily,

package/dist/auth/index.d.ts

@@ -1,5 +1,16 @@
 import { type createCredentialAdapter, type CliOAuthCredential, type CredentialAdapterOptions } from '@mnemonik/credentials';
 export declare const CLI_SCOPES: readonly ['account:read', 'install:manage', 'components:manage', 'projects:manage', 'offline_access'];
+/**
+ * Sign-out holds the CLI credential lease across its /oauth/revoke call, so the call is
+ * bounded: a hung issuer must not keep the lease (and a sign-in waiting for it) indefinitely.
+ */
+export declare const CLI_REVOKE_TIMEOUT_MS = 10000;
+/**
+ * Bound on one token refresh. The credential adapter retries a lost response
+ * once, so a refresh the server never answers ends as rotation_response_lost
+ * (retry) after about twice this.
+ */
+export declare const CLI_REFRESH_TIMEOUT_MS = 5000;
 export interface CliAuthOptions {
     stateDir?: string;
     scannerRoots?: string;
@@ -21,6 +32,10 @@ export interface CliAuthOptions {
     now?: () => number;
     credentials?: ReturnType<typeof createCredentialAdapter>;
     credentialOptions?: CredentialAdapterOptions;
+    /** Bound on the sign-out revoke call; CLI_REVOKE_TIMEOUT_MS unless a test replaces it. */
+    revokeTimeoutMs?: number;
+    /** Bound on one token refresh; CLI_REFRESH_TIMEOUT_MS unless a test replaces it. */
+    refreshTimeoutMs?: number;
 }
 export declare function noBrowserAvailable(platform?: NodeJS.Platform, env?: NodeJS.ProcessEnv): boolean;
 export declare function createCliAuth(options?: CliAuthOptions): {