@mnemonik/cli 7.112.1 → 7.112.4

package/dist/scanner/control.js

@@ -501,6 +501,13 @@ var require_ignore = __commonJS({
   }
 });
 
+// packages/shared/dist/hookTimeouts.js
+var init_hookTimeouts = __esm({
+  "packages/shared/dist/hookTimeouts.js"() {
+    "use strict";
+  }
+});
+
 // packages/shared/dist/runtimeSigners.js
 import { basename, dirname as dirname2, join as join2, resolve, sep, win32 } from "node:path";
 import { execFile, execFileSync } from "node:child_process";
@@ -618,11 +625,37 @@ var init_runtimeReader = __esm({
 });
 
 // packages/shared/dist/projectSetupHandoff.js
+var PROJECT_ENSURE_TIMEOUT_MS, SUPERVISOR, RUN_STALE_MS;
 var init_projectSetupHandoff = __esm({
   "packages/shared/dist/projectSetupHandoff.js"() {
     "use strict";
     init_runtimeSigners();
+    init_hookTimeouts();
     init_runtimeReader();
+    PROJECT_ENSURE_TIMEOUT_MS = 3e4;
+    SUPERVISOR = `
+const { execFile } = require('node:child_process');
+const { writeFileSync, renameSync } = require('node:fs');
+const [out, bin, ...args] = process.argv.slice(1);
+let input = '';
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', (chunk) => (input += chunk));
+process.stdin.on('end', () => {
+  const child = execFile(
+    process.execPath,
+    [bin, ...args],
+    { shell: false, timeout: ${PROJECT_ENSURE_TIMEOUT_MS}, killSignal: 'SIGKILL', maxBuffer: 64 * 1024, env: process.env },
+    (error, stdout) => {
+      const result = { code: error ? (typeof error.code === 'number' ? error.code : null) : 0, killed: !!(error && error.killed), stdout: String(stdout) };
+      writeFileSync(out + '.tmp', JSON.stringify(result), { mode: 0o600 });
+      renameSync(out + '.tmp', out);
+    }
+  );
+  child.stdin.on('error', () => {});
+  child.stdin.end(input);
+});
+`;
+    RUN_STALE_MS = PROJECT_ENSURE_TIMEOUT_MS + 1e4;
   }
 });
 
@@ -631,6 +664,7 @@ var init_hookRuntime = __esm({
   "packages/shared/dist/hookRuntime.js"() {
     "use strict";
     init_runtimeSigners();
+    init_hookTimeouts();
     init_repositoryRoot();
     init_runtimeReader();
     init_runtimeSigners();
@@ -6398,6 +6432,9 @@ var DEFAULT_OPTIONS = {
 };
 var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 
+// packages/shared/dist/index.js
+init_hookTimeouts();
+
 // packages/shared/dist/jitDeliveryAck.js
 init_runtimeSigners();
 

package/dist/scanner/discover.js

@@ -4899,7 +4899,7 @@ async function readIdentityFile(dir, options = {}) {
     if (options.selectedRoot) {
       try {
         const value = JSON.parse(text);
-        if (value && typeof value === "object" && !Array.isArray(value) && !("projectId" in value))
+        if (value && typeof value === "object" && !Array.isArray(value) && !("projectId" in value) && (!("schemaVersion" in value) || value.schemaVersion === 1))
           return { kind: "absent" };
       } catch {
       }

package/dist/scanner/enable.js

@@ -501,6 +501,13 @@ var require_ignore = __commonJS({
   }
 });
 
+// packages/shared/dist/hookTimeouts.js
+var init_hookTimeouts = __esm({
+  "packages/shared/dist/hookTimeouts.js"() {
+    "use strict";
+  }
+});
+
 // packages/shared/dist/runtimeSigners.js
 import { basename, dirname as dirname2, join as join2, resolve, sep, win32 } from "node:path";
 import { execFile, execFileSync } from "node:child_process";
@@ -618,11 +625,37 @@ var init_runtimeReader = __esm({
 });
 
 // packages/shared/dist/projectSetupHandoff.js
+var PROJECT_ENSURE_TIMEOUT_MS, SUPERVISOR, RUN_STALE_MS;
 var init_projectSetupHandoff = __esm({
   "packages/shared/dist/projectSetupHandoff.js"() {
     "use strict";
     init_runtimeSigners();
+    init_hookTimeouts();
     init_runtimeReader();
+    PROJECT_ENSURE_TIMEOUT_MS = 3e4;
+    SUPERVISOR = `
+const { execFile } = require('node:child_process');
+const { writeFileSync, renameSync } = require('node:fs');
+const [out, bin, ...args] = process.argv.slice(1);
+let input = '';
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', (chunk) => (input += chunk));
+process.stdin.on('end', () => {
+  const child = execFile(
+    process.execPath,
+    [bin, ...args],
+    { shell: false, timeout: ${PROJECT_ENSURE_TIMEOUT_MS}, killSignal: 'SIGKILL', maxBuffer: 64 * 1024, env: process.env },
+    (error, stdout) => {
+      const result = { code: error ? (typeof error.code === 'number' ? error.code : null) : 0, killed: !!(error && error.killed), stdout: String(stdout) };
+      writeFileSync(out + '.tmp', JSON.stringify(result), { mode: 0o600 });
+      renameSync(out + '.tmp', out);
+    }
+  );
+  child.stdin.on('error', () => {});
+  child.stdin.end(input);
+});
+`;
+    RUN_STALE_MS = PROJECT_ENSURE_TIMEOUT_MS + 1e4;
   }
 });
 
@@ -631,6 +664,7 @@ var init_hookRuntime = __esm({
   "packages/shared/dist/hookRuntime.js"() {
     "use strict";
     init_runtimeSigners();
+    init_hookTimeouts();
     init_repositoryRoot();
     init_runtimeReader();
     init_runtimeSigners();
@@ -6404,6 +6438,9 @@ var DEFAULT_OPTIONS = {
 };
 var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 
+// packages/shared/dist/index.js
+init_hookTimeouts();
+
 // packages/shared/dist/jitDeliveryAck.js
 init_runtimeSigners();
 

package/dist/scanner/service.js

@@ -501,6 +501,13 @@ var require_ignore = __commonJS({
   }
 });
 
+// packages/shared/dist/hookTimeouts.js
+var init_hookTimeouts = __esm({
+  "packages/shared/dist/hookTimeouts.js"() {
+    "use strict";
+  }
+});
+
 // packages/shared/dist/runtimeSigners.js
 import { basename, dirname as dirname2, join as join2, resolve, sep, win32 } from "node:path";
 import { execFile, execFileSync } from "node:child_process";
@@ -618,11 +625,37 @@ var init_runtimeReader = __esm({
 });
 
 // packages/shared/dist/projectSetupHandoff.js
+var PROJECT_ENSURE_TIMEOUT_MS, SUPERVISOR, RUN_STALE_MS;
 var init_projectSetupHandoff = __esm({
   "packages/shared/dist/projectSetupHandoff.js"() {
     "use strict";
     init_runtimeSigners();
+    init_hookTimeouts();
     init_runtimeReader();
+    PROJECT_ENSURE_TIMEOUT_MS = 3e4;
+    SUPERVISOR = `
+const { execFile } = require('node:child_process');
+const { writeFileSync, renameSync } = require('node:fs');
+const [out, bin, ...args] = process.argv.slice(1);
+let input = '';
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', (chunk) => (input += chunk));
+process.stdin.on('end', () => {
+  const child = execFile(
+    process.execPath,
+    [bin, ...args],
+    { shell: false, timeout: ${PROJECT_ENSURE_TIMEOUT_MS}, killSignal: 'SIGKILL', maxBuffer: 64 * 1024, env: process.env },
+    (error, stdout) => {
+      const result = { code: error ? (typeof error.code === 'number' ? error.code : null) : 0, killed: !!(error && error.killed), stdout: String(stdout) };
+      writeFileSync(out + '.tmp', JSON.stringify(result), { mode: 0o600 });
+      renameSync(out + '.tmp', out);
+    }
+  );
+  child.stdin.on('error', () => {});
+  child.stdin.end(input);
+});
+`;
+    RUN_STALE_MS = PROJECT_ENSURE_TIMEOUT_MS + 1e4;
   }
 });
 
@@ -631,6 +664,7 @@ var init_hookRuntime = __esm({
   "packages/shared/dist/hookRuntime.js"() {
     "use strict";
     init_runtimeSigners();
+    init_hookTimeouts();
     init_repositoryRoot();
     init_runtimeReader();
     init_runtimeSigners();
@@ -6398,6 +6432,9 @@ var DEFAULT_OPTIONS = {
 };
 var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 
+// packages/shared/dist/index.js
+init_hookTimeouts();
+
 // packages/shared/dist/jitDeliveryAck.js
 init_runtimeSigners();
 

package/dist/scanner/update.js

@@ -501,6 +501,13 @@ var require_ignore = __commonJS({
   }
 });
 
+// packages/shared/dist/hookTimeouts.js
+var init_hookTimeouts = __esm({
+  "packages/shared/dist/hookTimeouts.js"() {
+    "use strict";
+  }
+});
+
 // packages/shared/dist/runtimeSigners.js
 import { basename, dirname as dirname2, join as join2, resolve, sep, win32 } from "node:path";
 import { execFile, execFileSync } from "node:child_process";
@@ -618,11 +625,37 @@ var init_runtimeReader = __esm({
 });
 
 // packages/shared/dist/projectSetupHandoff.js
+var PROJECT_ENSURE_TIMEOUT_MS, SUPERVISOR, RUN_STALE_MS;
 var init_projectSetupHandoff = __esm({
   "packages/shared/dist/projectSetupHandoff.js"() {
     "use strict";
     init_runtimeSigners();
+    init_hookTimeouts();
     init_runtimeReader();
+    PROJECT_ENSURE_TIMEOUT_MS = 3e4;
+    SUPERVISOR = `
+const { execFile } = require('node:child_process');
+const { writeFileSync, renameSync } = require('node:fs');
+const [out, bin, ...args] = process.argv.slice(1);
+let input = '';
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', (chunk) => (input += chunk));
+process.stdin.on('end', () => {
+  const child = execFile(
+    process.execPath,
+    [bin, ...args],
+    { shell: false, timeout: ${PROJECT_ENSURE_TIMEOUT_MS}, killSignal: 'SIGKILL', maxBuffer: 64 * 1024, env: process.env },
+    (error, stdout) => {
+      const result = { code: error ? (typeof error.code === 'number' ? error.code : null) : 0, killed: !!(error && error.killed), stdout: String(stdout) };
+      writeFileSync(out + '.tmp', JSON.stringify(result), { mode: 0o600 });
+      renameSync(out + '.tmp', out);
+    }
+  );
+  child.stdin.on('error', () => {});
+  child.stdin.end(input);
+});
+`;
+    RUN_STALE_MS = PROJECT_ENSURE_TIMEOUT_MS + 1e4;
   }
 });
 
@@ -631,6 +664,7 @@ var init_hookRuntime = __esm({
   "packages/shared/dist/hookRuntime.js"() {
     "use strict";
     init_runtimeSigners();
+    init_hookTimeouts();
     init_repositoryRoot();
     init_runtimeReader();
     init_runtimeSigners();
@@ -6398,6 +6432,9 @@ var DEFAULT_OPTIONS = {
 };
 var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 
+// packages/shared/dist/index.js
+init_hookTimeouts();
+
 // packages/shared/dist/jitDeliveryAck.js
 init_runtimeSigners();
 

package/dist/scanner-release.json

@@ -1,23 +1,23 @@
 {
-  "version": "7.112.1",
-  "digestsSha256": "f1fdb1452ae03d24ead7141d9e45ce7217a939082b506f6f24c76f37c01cf165",
+  "version": "7.112.4",
+  "digestsSha256": "ddaa9b6e61e7bde7830290115a4dae0929e6821fcb981fef20b9d4612c6fd63b",
   "platforms": {
     "darwin-arm64": {
       "schemaVersion": 1,
       "artifact": "scanner",
-      "version": "7.112.1",
+      "version": "7.112.4",
       "entry": "scanner-darwin-arm64",
       "files": {
         "scanner-darwin-arm64": {
-          "sha256": "a9ecd47185c213f7dddd38a05b88fdd719b8b7d31e7694018ca1c9b94871d4ec",
-          "size": 155505568,
+          "sha256": "bb573bb638726b6975d4cc174fb70b84c299cea213a5e4b5b0b0da45d5a891db",
+          "size": 155604640,
           "executable": true
         }
       },
-      "totalSize": 155505568,
+      "totalSize": 155604640,
       "source": {
         "kind": "release",
-        "url": "https://github.com/JayDeeCo-Limited/mnemonik-cli/releases/download/scanner-v7.112.1/"
+        "url": "https://github.com/JayDeeCo-Limited/mnemonik-cli/releases/download/scanner-v7.112.4/"
       },
       "signer": {
         "platform": "darwin",
@@ -29,19 +29,19 @@
     "darwin-x64": {
       "schemaVersion": 1,
       "artifact": "scanner",
-      "version": "7.112.1",
+      "version": "7.112.4",
       "entry": "scanner-darwin-x64",
       "files": {
         "scanner-darwin-x64": {
-          "sha256": "17370885d724a7c892fa2134f67374873f9fb9d2325d3159fbc17cbb8f0258b3",
-          "size": 157265008,
+          "sha256": "635944446122ee3dcdf110b1dbb9f239c53b2e805cc871eb0837c31dca859417",
+          "size": 157364080,
           "executable": true
         }
       },
-      "totalSize": 157265008,
+      "totalSize": 157364080,
       "source": {
         "kind": "release",
-        "url": "https://github.com/JayDeeCo-Limited/mnemonik-cli/releases/download/scanner-v7.112.1/"
+        "url": "https://github.com/JayDeeCo-Limited/mnemonik-cli/releases/download/scanner-v7.112.4/"
       },
       "signer": {
         "platform": "darwin",
@@ -53,24 +53,24 @@
     "linux-arm64": {
       "schemaVersion": 1,
       "artifact": "scanner",
-      "version": "7.112.1",
+      "version": "7.112.4",
       "entry": "scanner-linux-arm64",
       "files": {
         "scanner-linux-arm64": {
-          "sha256": "0ac58350c8ed44990095e15d292bcdb3aff83a91e2d270c58ba5d47bc0991381",
-          "size": 156568704,
+          "sha256": "a2b1a6cd67f935098f357cdca6b2507978d6f8120a7a6f35899642ad26b9acfd",
+          "size": 156634240,
           "executable": true
         },
         "scanner-linux-arm64.minisig": {
-          "sha256": "84bc22260611ec4d08344d81c1ea1748dd132ffd715a0eeaf50703c2c4c142bd",
+          "sha256": "96541a3d7625dacb597b7c50da0926d293afc38f5c09537a3268ddf49124356c",
           "size": 314,
           "executable": false
         }
       },
-      "totalSize": 156569018,
+      "totalSize": 156634554,
       "source": {
         "kind": "release",
-        "url": "https://github.com/JayDeeCo-Limited/mnemonik-cli/releases/download/scanner-v7.112.1/"
+        "url": "https://github.com/JayDeeCo-Limited/mnemonik-cli/releases/download/scanner-v7.112.4/"
       },
       "signer": {
         "platform": "linux",
@@ -83,24 +83,24 @@
     "linux-x64": {
       "schemaVersion": 1,
       "artifact": "scanner",
-      "version": "7.112.1",
+      "version": "7.112.4",
       "entry": "scanner-linux-x64",
       "files": {
         "scanner-linux-x64": {
-          "sha256": "f50763c946722293b0d7d044af2c3c4d77578c778cc04c65223687b4f5510376",
-          "size": 160238784,
+          "sha256": "5b6fec90ecbc4989b1aa3cb99d3490f6ffcbdf2aecab6791dd1d75f6bbf04ebb",
+          "size": 160304320,
           "executable": true
         },
         "scanner-linux-x64.minisig": {
-          "sha256": "436191fedb1bc5364e751e12bfdbb2bbd6772b592995bd86cb2b06056cafa9df",
+          "sha256": "4ad7f30997fbf2871001a56d29ba8c57429b639a970b1f7e11ac51a5db589ae7",
           "size": 312,
           "executable": false
         }
       },
-      "totalSize": 160239096,
+      "totalSize": 160304632,
       "source": {
         "kind": "release",
-        "url": "https://github.com/JayDeeCo-Limited/mnemonik-cli/releases/download/scanner-v7.112.1/"
+        "url": "https://github.com/JayDeeCo-Limited/mnemonik-cli/releases/download/scanner-v7.112.4/"
       },
       "signer": {
         "platform": "linux",
@@ -113,19 +113,19 @@
     "win-x64": {
       "schemaVersion": 1,
       "artifact": "scanner",
-      "version": "7.112.1",
+      "version": "7.112.4",
       "entry": "scanner-win-x64.exe",
       "files": {
         "scanner-win-x64.exe": {
-          "sha256": "c7c6ee4658fe3841de6c0c57ebb6d4afdc506b47097789f7f2199a65dcc7b4d1",
-          "size": 127268864,
+          "sha256": "ff8570588b99dbfd34566fa570326e9b954af421bffc7011e6bba7ee1660ea36",
+          "size": 127366144,
           "executable": true
         }
       },
-      "totalSize": 127268864,
+      "totalSize": 127366144,
       "source": {
         "kind": "release",
-        "url": "https://github.com/JayDeeCo-Limited/mnemonik-cli/releases/download/scanner-v7.112.1/"
+        "url": "https://github.com/JayDeeCo-Limited/mnemonik-cli/releases/download/scanner-v7.112.4/"
       },
       "signingStatus": "unsigned",
       "disclosureVersion": "2026.09.1"

package/dist/status.js

@@ -501,6 +501,13 @@ var require_ignore = __commonJS({
   }
 });
 
+// packages/shared/dist/hookTimeouts.js
+var init_hookTimeouts = __esm({
+  "packages/shared/dist/hookTimeouts.js"() {
+    "use strict";
+  }
+});
+
 // packages/shared/dist/runtimeSigners.js
 import { basename, dirname as dirname2, join as join2, resolve, sep, win32 } from "node:path";
 import { execFile, execFileSync } from "node:child_process";
@@ -623,7 +630,7 @@ var init_runtimeReader = __esm({
 import { constants } from "node:fs";
 import { lstat, mkdir, open, readdir, realpath, rename, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { dirname as dirname3, join as join3, relative } from "node:path";
+import { basename as basename2, dirname as dirname3, join as join3, relative } from "node:path";
 async function readPrivate(path) {
   const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
   try {
@@ -663,11 +670,37 @@ async function pendingProjectSetup(root) {
   results.sort((a, b) => Date.parse(b.time) - Date.parse(a.time));
   return results[0]?.outcome === "done" ? [] : results.slice(0, 1);
 }
+var PROJECT_ENSURE_TIMEOUT_MS, SUPERVISOR, RUN_STALE_MS;
 var init_projectSetupHandoff = __esm({
   "packages/shared/dist/projectSetupHandoff.js"() {
     "use strict";
     init_runtimeSigners();
+    init_hookTimeouts();
     init_runtimeReader();
+    PROJECT_ENSURE_TIMEOUT_MS = 3e4;
+    SUPERVISOR = `
+const { execFile } = require('node:child_process');
+const { writeFileSync, renameSync } = require('node:fs');
+const [out, bin, ...args] = process.argv.slice(1);
+let input = '';
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', (chunk) => (input += chunk));
+process.stdin.on('end', () => {
+  const child = execFile(
+    process.execPath,
+    [bin, ...args],
+    { shell: false, timeout: ${PROJECT_ENSURE_TIMEOUT_MS}, killSignal: 'SIGKILL', maxBuffer: 64 * 1024, env: process.env },
+    (error, stdout) => {
+      const result = { code: error ? (typeof error.code === 'number' ? error.code : null) : 0, killed: !!(error && error.killed), stdout: String(stdout) };
+      writeFileSync(out + '.tmp', JSON.stringify(result), { mode: 0o600 });
+      renameSync(out + '.tmp', out);
+    }
+  );
+  child.stdin.on('error', () => {});
+  child.stdin.end(input);
+});
+`;
+    RUN_STALE_MS = PROJECT_ENSURE_TIMEOUT_MS + 1e4;
   }
 });
 
@@ -676,6 +709,7 @@ var init_hookRuntime = __esm({
   "packages/shared/dist/hookRuntime.js"() {
     "use strict";
     init_runtimeSigners();
+    init_hookTimeouts();
     init_repositoryRoot();
     init_runtimeReader();
     init_runtimeSigners();
@@ -6466,6 +6500,9 @@ var DEFAULT_OPTIONS = {
 };
 var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 
+// packages/shared/dist/index.js
+init_hookTimeouts();
+
 // packages/shared/dist/jitDeliveryAck.js
 init_runtimeSigners();
 
@@ -7502,7 +7539,7 @@ function parse(toml, { maxDepth = 1e3, integersAsBigInt } = {}) {
 // packages/cli/src/status.ts
 init_hookRuntime();
 import { devReadiness, expectedScannerDisclosureVersion } from "./runtime/releaseSource.js";
-import { basename as basename2, isAbsolute, relative as relative2, resolve as resolve2 } from "node:path";
+import { basename as basename3, isAbsolute, relative as relative2, resolve as resolve2 } from "node:path";
 import { Output } from "./output.js";
 import {
   runProjectCommand
@@ -7712,7 +7749,7 @@ function buildStatusDocument(input) {
       projects: [
         {
           projectId: project.projectId,
-          displayName: basename2(project.resolvedRoot),
+          displayName: basename3(project.resolvedRoot),
           repositoryMatch: project.identity,
           identityFile: null,
           summary: { conditions },
@@ -7811,7 +7848,7 @@ function renderStatusSummaries(document, output, options = {}) {
       document.conditions,
       options.agent
     );
-  const connected = [...new Set(document.scanner?.roots?.map((root) => basename2(root)) ?? [])].sort(
+  const connected = [...new Set(document.scanner?.roots?.map((root) => basename3(root)) ?? [])].sort(
     (left, right) => left.toLocaleLowerCase().localeCompare(right.toLocaleLowerCase())
   );
   if (connected.length) {

package/dist/transport/server.d.ts

@@ -21,7 +21,21 @@ export interface ServerTransportOptions {
     issueContext(input: Evidence & {
         projectId?: string;
     }): Promise<CliIssueContext>;
+    /** Each request's own bound (PROJECT_REQUEST_TIMEOUT_MS). */
+    requestTimeoutMs?: number;
+    /**
+     * Epoch ms after which no request is sent and each in flight is cut short
+     * (`project ensure --agent` sets it inside its supervisor's 30 s limit).
+     */
+    deadline?: number;
 }
+/**
+ * A project-setup request that has not answered by then is abandoned and
+ * reported `unreachable` (the command's retryable failure). Without it a
+ * server that accepted the connection and never answered held the command,
+ * and the hook's detached `project ensure` helper, indefinitely.
+ */
+export declare const PROJECT_REQUEST_TIMEOUT_MS = 5000;
 type AccountContext = {
     owner: Owner;
     userId: string;
@@ -56,13 +70,18 @@ export declare function createServerTransport(options: ServerTransportOptions):
         reason: string;
     }>;
     credentials: {
-        putCliOAuth: (metadata: import("@mnemonik/credentials").CliOAuthMetadata, tokens: import("@mnemonik/credentials").CliOAuthTokens | string) => Promise<{
+        putCliOAuth: (metadata: import("@mnemonik/credentials").CliOAuthMetadata, tokens: import("@mnemonik/credentials").CliOAuthTokens | string) => ReturnType<(metadata: import("@mnemonik/credentials").CliOAuthMetadata, tokens: import("@mnemonik/credentials").CliOAuthTokens | string) => Promise<{
             store: string;
-        }>;
+        }>>;
         readCliOAuth: () => Promise<CliOAuthCredential | null>;
         rotateCli: (transport: CliCredentialTransport) => Promise<import("@mnemonik/credentials").ActionRequired | import("@mnemonik/credentials").RetryLater | CliOAuthCredential>;
         withCliCredential: <T>(transport: CliCredentialTransport, work: (accessToken: string) => Promise<import("@mnemonik/credentials").WorkResponse<T>>) => Promise<import("@mnemonik/credentials").WorkResponse<T> | import("@mnemonik/credentials").ActionRequired | import("@mnemonik/credentials").RetryLater>;
         removeCliOAuth: () => Promise<void>;
+        revokeCli: (transport: import("@mnemonik/credentials").CliRevocationTransport) => Promise<import("@mnemonik/credentials").ActionRequired | import("@mnemonik/credentials").RetryLater | {
+            status: 'revoked';
+            familyId: string;
+        }>;
+        waitForCliLease: () => Promise<void>;
         putFamily: (componentKind: import("@mnemonik/credentials").ComponentKind, response: import("@mnemonik/credentials").ComponentCredentialResponse) => Promise<import("@mnemonik/credentials").FamilyCredential>;
         readFamily: (familyId: string) => Promise<import("@mnemonik/credentials").FamilyCredential | null>;
         rotateFamily: (familyId: string, transport: import("@mnemonik/credentials").CredentialTransport) => Promise<import("@mnemonik/credentials").RotationResult>;

package/dist/transport/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/transport/server.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,QAAQ,EACR,KAAK,EACL,aAAa,EAEd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAK9D,MAAM,WAAW,eAAgB,SAAQ,QAAQ;IAC/C,QAAQ,EAAE,KAAK,GAAG,kBAAkB,GAAG,YAAY,CAAC;IACpD,aAAa,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,WAAW,CAAC,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;IACzD,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,KAAK,EAAE,QAAQ,GAAG;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAClF;AAID,KAAK,cAAc,GAAG;IACpB,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB,EAAE,MAAM,CAAC;CAC9B,CAAC;AACF,KAAK,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,WAAW,CAAC;AAYlF;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAMjD,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAIvF;AAOD,qBAAa,yBAA0B,SAAQ,KAAK;IACtC,QAAQ,CAAC,MAAM,EAAE,cAAc;IAA3C,YAAqB,MAAM,EAAE,cAAc,EAG1C;CACF;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAqG5B,MAAM,KAAG,OAAO,CAAC,cAAc,CAAC;4BAwBvC,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;gCAIpD,MAAM,UACT,MAAM,qBACK,qBAAqB,GAAG,IAAI;;;EAyBpD"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/transport/server.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,QAAQ,EACR,KAAK,EACL,aAAa,EAEd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAK9D,MAAM,WAAW,eAAgB,SAAQ,QAAQ;IAC/C,QAAQ,EAAE,KAAK,GAAG,kBAAkB,GAAG,YAAY,CAAC;IACpD,aAAa,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,WAAW,CAAC,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;IACzD,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,KAAK,EAAE,QAAQ,GAAG;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACjF,6DAA6D;IAC7D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,OAAQ,CAAC;AAIhD,KAAK,cAAc,GAAG;IACpB,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB,EAAE,MAAM,CAAC;CAC9B,CAAC;AACF,KAAK,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,WAAW,CAAC;AAYlF;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAMjD,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAIvF;AAOD,qBAAa,yBAA0B,SAAQ,KAAK;IACtC,QAAQ,CAAC,MAAM,EAAE,cAAc;IAA3C,YAAqB,MAAM,EAAE,cAAc,EAG1C;CACF;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAmH5B,MAAM,KAAG,OAAO,CAAC,cAAc,CAAC;4BAwBvC,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;gCAIpD,MAAM,UACT,MAAM,qBACK,qBAAqB,GAAG,IAAI;;;EAyBpD"}

package/dist/transport/server.js

@@ -5,6 +5,7 @@ import { createCliCredentials } from "../auth/credentials.js";
 import { URLSearchParams } from "node:url";
 import { createCliAuth } from "../auth/index.js";
 var DEFAULT_API = "https://api.mnemonik.dev/";
+var PROJECT_REQUEST_TIMEOUT_MS = 5e3;
 var action = (state, allowedActions = ["retry", "cancel"]) => ({
   status: "ACTION_REQUIRED",
   state,
@@ -41,6 +42,13 @@ function createServerTransport(options) {
   const fetchImpl = options.fetch ?? fetch;
   const credentials = options.credentials ?? createCliCredentials();
   const getCliBearer = options.getCliBearer ?? createCliAuth({ resource, fetch: fetchImpl, credentials }).getCliBearer;
+  const requestBudget = () => Math.max(
+    0,
+    Math.min(
+      options.requestTimeoutMs ?? PROJECT_REQUEST_TIMEOUT_MS,
+      (options.deadline ?? Infinity) - Date.now()
+    )
+  );
   const rotation = {
     async rotateCli(current) {
       const response = await fetchImpl(`${current.issuer.replace(/\/$/u, "")}/oauth/token`, {
@@ -51,7 +59,9 @@ function createServerTransport(options) {
           client_id: current.clientId,
           refresh_token: current.refreshToken,
           resource
-        })
+        }),
+        // A timeout throws: the credential adapter treats it as a lost response.
+        signal: AbortSignal.timeout(Math.max(1, requestBudget()))
       });
       return {
         status: response.status,
@@ -64,8 +74,11 @@ function createServerTransport(options) {
     const firstBearer = suppliedBearer ?? await getCliBearer();
     if (typeof firstBearer !== "string") return signInAction(firstBearer);
     const send = async (bearer) => {
+      const budget = requestBudget();
+      if (budget <= 0) return { status: 503, body: action("unreachable") };
       try {
         const response = await fetchImpl(`${apiBase}${path}`, {
+          signal: AbortSignal.timeout(budget),
           method,
           headers: {
             authorization: `Bearer ${bearer}`,
@@ -147,6 +160,7 @@ function createServerTransport(options) {
   };
 }
 export {
+  PROJECT_REQUEST_TIMEOUT_MS,
   ServerActionRequiredError,
   accountActions,
   createServerTransport,