@neocompose/cli 0.26.5 → 0.27.1

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## [0.27.1] - 2026-08-12
+
+### Fixed
+
+- Treat member-level `required` as non-semantic for Function and NSFunction
+  records during CLI reads and comparisons. Historical records stored with
+  `required: true` no longer produce permanent phantom changes in `neo pull`,
+  `neo status`, or `neo push --dry-run`; return nullability remains represented
+  by `returnTypeInfo.required`.
+- Preserve independently mergeable edits on both sides of a `neo pull`
+  conflict marker, including nested fields and stable-ID collection entries.
+  Resolving with `neo resolve --mine` or `--theirs` now discards only genuinely
+  contested values instead of clean changes made on the other side.
+
+## [0.27.0] - 2026-08-10
+
+### Added
+
+- `neo logout [--api <url>]`: targeted local credential deletion for exactly
+  one API origin — the namespaced OS-keychain entry and the credentials-file
+  row — plus best-effort server session revocation. Other origins, other
+  namespaces, and the rest of the config home are never touched.
+- `NEO_COMPOSE_CONFIG_HOME`: an absolute directory that replaces
+  `$XDG_CONFIG_HOME/neo-compose` for Neo credential state only, so isolated
+  environments (P53 agent rigs) keep their own credential store without
+  changing the ambient XDG configuration of unrelated tools.
+- `NEO_COMPOSE_CREDENTIAL_NAMESPACE`: scopes the OS-keychain account
+  (`<namespace>::<api origin>`) so isolated environments sharing one OS user
+  cannot read or delete each other's tokens.
+
+### Fixed
+
+- The credential-store docstring described a two-level precedence with the
+  OS keychain "layering in later"; the keychain layer has existed for some
+  time. The docstring now matches the real precedence (env var, then
+  keychain, then credentials file) and documents that the metadata row is
+  written even when the keychain holds the token.
+
 ## [0.26.5] - 2026-08-10
 
 ### Changed

package/README.md

@@ -419,6 +419,7 @@ authorization boundary.
 | `--version`                                           | Print the installed CLI package version.                                  |
 | `login`                                               | Authenticate the selected profile.                                        |
 | `whoami`                                              | Inspect the selected profile.                                             |
+| `logout [--api <url>]`                                | Delete the stored credential for one API origin and revoke its session.   |
 | `init --project <id> [--version <id>]`                | Create a format-4 working copy and perform its first reset pull.          |
 | `doctor`                                              | Validate format/compiler/editor/source/file contracts; no .NET discovery. |
 | `pull [--force\|--reset] [--regenerate-source-names]` | Merge remote changes or regenerate canonical source, names, and binaries. |

package/dist/neo.mjs

@@ -44,7 +44,12 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 // src/token-store.ts
 var token_store_exports = {};
 __export(token_store_exports, {
+  NEO_CONFIG_HOME_ENV_VAR: () => NEO_CONFIG_HOME_ENV_VAR,
+  NEO_CREDENTIAL_NAMESPACE_ENV_VAR: () => NEO_CREDENTIAL_NAMESPACE_ENV_VAR,
   NEO_TOKEN_ENV_VAR: () => NEO_TOKEN_ENV_VAR,
+  credentialsDir: () => credentialsDir,
+  deleteCredential: () => deleteCredential,
+  keychainAccount: () => keychainAccount,
   loadCredential: () => loadCredential,
   loadToken: () => loadToken,
   saveCredential: () => saveCredential
@@ -54,12 +59,22 @@ import {
   existsSync,
   mkdirSync,
   readFileSync,
+  rmSync,
   writeFileSync
 } from "node:fs";
 import { execFileSync } from "node:child_process";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { isAbsolute, join } from "node:path";
 function credentialsDir() {
+  const configHome = process.env[NEO_CONFIG_HOME_ENV_VAR];
+  if (configHome !== void 0 && configHome !== "") {
+    if (!isAbsolute(configHome)) {
+      throw new Error(
+        `${NEO_CONFIG_HOME_ENV_VAR} must be an absolute directory path, got "${configHome}".`
+      );
+    }
+    return configHome;
+  }
   const xdg = process.env.XDG_CONFIG_HOME;
   const base = xdg !== void 0 && xdg !== "" ? xdg : join(homedir(), ".config");
   return join(base, "neo-compose");
@@ -80,6 +95,11 @@ function readCredentialsFile() {
   }
   return file;
 }
+function keychainAccount(apiBaseUrl) {
+  const namespace = process.env[NEO_CREDENTIAL_NAMESPACE_ENV_VAR];
+  if (namespace === void 0 || namespace === "") return apiBaseUrl;
+  return `${namespace}::${apiBaseUrl}`;
+}
 function keychainSet(account, secret) {
   if (process.platform !== "darwin") return false;
   try {
@@ -116,8 +136,24 @@ function keychainGet(account) {
     return null;
   }
 }
+function keychainDelete(account) {
+  if (process.platform !== "darwin") return false;
+  try {
+    execFileSync(
+      "security",
+      ["delete-generic-password", "-s", KEYCHAIN_SERVICE, "-a", account],
+      { stdio: "ignore" }
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
 function saveCredential(credential) {
-  const inKeychain = keychainSet(credential.apiBaseUrl, credential.token);
+  const inKeychain = keychainSet(
+    keychainAccount(credential.apiBaseUrl),
+    credential.token
+  );
   mkdirSync(credentialsDir(), { recursive: true, mode: 448 });
   const file = readCredentialsFile();
   file.credentials[credential.apiBaseUrl] = inKeychain ? { ...credential, token: "" } : credential;
@@ -132,7 +168,7 @@ function saveCredential(credential) {
 function loadToken(apiBaseUrl) {
   const envToken = process.env[NEO_TOKEN_ENV_VAR];
   if (envToken !== void 0 && envToken !== "") return envToken;
-  const fromKeychain = keychainGet(apiBaseUrl);
+  const fromKeychain = keychainGet(keychainAccount(apiBaseUrl));
   if (fromKeychain !== null) return fromKeychain;
   const file = readCredentialsFile();
   const credential = file.credentials[apiBaseUrl];
@@ -143,11 +179,38 @@ function loadCredential(apiBaseUrl) {
   const file = readCredentialsFile();
   return file.credentials[apiBaseUrl] ?? null;
 }
-var NEO_TOKEN_ENV_VAR, KEYCHAIN_SERVICE;
+function deleteCredential(apiBaseUrl) {
+  const account = keychainAccount(apiBaseUrl);
+  const fromKeychain = keychainGet(account);
+  const file = readCredentialsFile();
+  const fileEntry = file.credentials[apiBaseUrl];
+  const token = fromKeychain ?? (fileEntry !== void 0 && fileEntry.token !== "" ? fileEntry.token : null);
+  const deletedKeychainEntry = keychainDelete(account);
+  let deletedFileEntry = false;
+  if (fileEntry !== void 0) {
+    delete file.credentials[apiBaseUrl];
+    deletedFileEntry = true;
+    const path = credentialsPath();
+    if (Object.keys(file.credentials).length === 0) {
+      rmSync(path, { force: true });
+    } else {
+      writeFileSync(path, `${JSON.stringify(file, null, 2)}
+`, {
+        encoding: "utf8",
+        mode: 384
+      });
+      chmodSync(path, 384);
+    }
+  }
+  return { token, deletedKeychainEntry, deletedFileEntry };
+}
+var NEO_TOKEN_ENV_VAR, NEO_CONFIG_HOME_ENV_VAR, NEO_CREDENTIAL_NAMESPACE_ENV_VAR, KEYCHAIN_SERVICE;
 var init_token_store = __esm({
   "src/token-store.ts"() {
     "use strict";
     NEO_TOKEN_ENV_VAR = "NEO_COMPOSE_TOKEN";
+    NEO_CONFIG_HOME_ENV_VAR = "NEO_COMPOSE_CONFIG_HOME";
+    NEO_CREDENTIAL_NAMESPACE_ENV_VAR = "NEO_COMPOSE_CREDENTIAL_NAMESPACE";
     KEYCHAIN_SERVICE = "neo-compose-cli";
   }
 });
@@ -427,6 +490,44 @@ async function runLogin(options) {
     return;
   }
 }
+async function runLogout(apiBaseUrl) {
+  const { deleteCredential: deleteCredential2 } = await Promise.resolve().then(() => (init_token_store(), token_store_exports));
+  const deleted = deleteCredential2(apiBaseUrl);
+  if (deleted.token === null && !deleted.deletedKeychainEntry && !deleted.deletedFileEntry) {
+    console.log(`No credentials stored for "${apiBaseUrl}".`);
+    return;
+  }
+  if (deleted.token !== null) {
+    try {
+      const response = await fetch(new URL("/api/auth/sign-out", apiBaseUrl), {
+        body: "{}",
+        headers: {
+          Authorization: `Bearer ${deleted.token}`,
+          "Content-Type": "application/json"
+        },
+        method: "POST"
+      });
+      if (response.ok) {
+        console.log(`Revoked the server session at ${apiBaseUrl}.`);
+      } else {
+        console.log(
+          `Server session revocation returned ${response.status}; the local credential was still deleted.`
+        );
+      }
+    } catch {
+      console.log(
+        "Server session revocation was unreachable; the local credential was still deleted."
+      );
+    }
+  }
+  const surfaces = [
+    deleted.deletedKeychainEntry ? "Keychain entry" : null,
+    deleted.deletedFileEntry ? "credentials file entry" : null
+  ].filter((surface) => surface !== null);
+  console.log(
+    `Logged out of ${apiBaseUrl}${surfaces.length > 0 ? ` (removed ${surfaces.join(" and ")})` : ""}.`
+  );
+}
 async function runWhoami(apiBaseUrl) {
   const { loadToken: loadToken2 } = await Promise.resolve().then(() => (init_token_store(), token_store_exports));
   const token = loadToken2(apiBaseUrl);
@@ -12789,13 +12890,13 @@ var init_strict_resolver = __esm({
             scope,
             pos
           );
-          const selected2 = intrinsic(
+          const selected = intrinsic(
             "select" /* Select */,
             { collectionPointer: receiver.pointer, function: fn },
             { kind: "list", elementType: resultType, readOnly: true }
           );
           return {
-            ...selected2,
+            ...selected,
             entryWritability: inferredReturn.writability,
             writeRoot: inferredReturn.writeRoot
           };
@@ -25750,9 +25851,9 @@ function declaredConstructorNamedArguments(analysis, typeName, used) {
       )
     )
   );
-  const selected2 = reachable.length > 0 ? reachable : contract.constructors;
+  const selected = reachable.length > 0 ? reachable : contract.constructors;
   const fields = /* @__PURE__ */ new Map();
-  for (const constructor2 of selected2) {
+  for (const constructor2 of selected) {
     for (const parameter4 of constructor2.parameters) {
       if (fields.has(parameter4.name)) continue;
       fields.set(parameter4.name, parameterArgumentField(parameter4));
@@ -29398,14 +29499,14 @@ function sourceLocation(value, environment, field) {
 }
 function spanAndSelectionLocations(spanValue, selectionValue, environment, field) {
   const navigation = spanLocation(spanValue, environment, field);
-  const selection = spanLocation(
+  const selection2 = spanLocation(
     selectionValue,
     environment,
     `${field}.selection`
   );
   return {
     ...navigation,
-    ...selection.location ? { selectionLocation: selection.location } : {}
+    ...selection2.location ? { selectionLocation: selection2.location } : {}
   };
 }
 function scriptDefinitionLocations(member, environment, field) {
@@ -31121,6 +31222,9 @@ function normalizeDocumentFields(recordKind, value) {
     if (current === void 0) normalized[field] = null;
   }
   if (recordKind === "member") {
+    if (CALLABLE_MEMBER_KINDS.has(normalized.kind)) {
+      normalized.required = false;
+    }
     normalizeTypeInfoBindings(normalized.returnTypeInfo);
     if (Array.isArray(normalized.argumentTypes)) {
       for (const argument2 of normalized.argumentTypes) {
@@ -31232,13 +31336,14 @@ function deepNormalizeValue(value) {
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-var SchemaDocumentContractError;
+var CALLABLE_MEMBER_KINDS, SchemaDocumentContractError;
 var init_contracts = __esm({
   "src/project-manifest/contracts.ts"() {
     "use strict";
     init_document_contracts();
     init_machine_strings();
     init_document_contracts();
+    CALLABLE_MEMBER_KINDS = /* @__PURE__ */ new Set([13, 23]);
     SchemaDocumentContractError = class extends Error {
       constructor(recordKind, field) {
         super(
@@ -31264,6 +31369,8 @@ function threeWayMergeRecord(base, server, local, policy = {}) {
   const comparisonServer = policy.comparison?.server ?? serverRecord;
   const comparisonLocal = policy.comparison?.local ?? localRecord;
   const merged = {};
+  const localVariant = {};
+  const serverVariant = {};
   const conflictFields = [];
   const keys = /* @__PURE__ */ new Set([
     ...Object.keys(serverRecord),
@@ -31274,7 +31381,11 @@ function threeWayMergeRecord(base, server, local, policy = {}) {
     const rawServerValue = serverRecord[key];
     const rawLocalValue = localRecord[key];
     if (policy.serverWinsFields?.has(key) === true) {
-      if (rawServerValue !== void 0) merged[key] = rawServerValue;
+      if (rawServerValue !== void 0) {
+        merged[key] = rawServerValue;
+        localVariant[key] = rawServerValue;
+        serverVariant[key] = rawServerValue;
+      }
       continue;
     }
     const baseValue = comparisonBase[key];
@@ -31295,25 +31406,31 @@ function threeWayMergeRecord(base, server, local, policy = {}) {
     } else if (result.present) {
       merged[key] = result.value;
     }
+    if (result.local.present) localVariant[key] = result.local.value;
+    if (result.server.present) serverVariant[key] = result.server.value;
   }
-  return { merged, conflictFields };
+  return { merged, localVariant, serverVariant, conflictFields };
 }
 function mergeValue(args) {
   if (canonicallyEqual(args.server, args.base)) {
-    return selected(args.rawLocal);
+    return sharedSelection(args.rawLocal);
   }
   if (canonicallyEqual(args.local, args.base)) {
-    return selected(args.rawServer);
+    return sharedSelection(args.rawServer);
   }
   if (canonicallyEqual(args.local, args.server)) {
-    return selected(args.rawLocal);
+    return sharedSelection(args.rawLocal);
+  }
+  if (!args.recursive) {
+    return conflict(args.path, args.rawLocal, args.rawServer);
   }
-  if (!args.recursive) return conflict(args.path);
   if (isObjectRecord2(args.rawBase) && isObjectRecord2(args.rawServer) && isObjectRecord2(args.rawLocal)) {
     const comparisonBase = isObjectRecord2(args.base) ? args.base : args.rawBase;
     const comparisonServer = isObjectRecord2(args.server) ? args.server : args.rawServer;
     const comparisonLocal = isObjectRecord2(args.local) ? args.local : args.rawLocal;
     const value = {};
+    const localVariant = {};
+    const serverVariant = {};
     const conflicts = [];
     const keys = /* @__PURE__ */ new Set([
       ...Object.keys(args.rawBase),
@@ -31333,8 +31450,16 @@ function mergeValue(args) {
       });
       conflicts.push(...nested.conflicts);
       if (nested.present) value[key] = nested.value;
+      if (nested.local.present) localVariant[key] = nested.local.value;
+      if (nested.server.present) serverVariant[key] = nested.server.value;
     }
-    return { present: true, value, conflicts };
+    return {
+      present: true,
+      value,
+      local: { present: true, value: localVariant },
+      server: { present: true, value: serverVariant },
+      conflicts
+    };
   }
   if (Array.isArray(args.rawBase) && Array.isArray(args.rawServer) && Array.isArray(args.rawLocal)) {
     return mergeIdentityArray(
@@ -31344,17 +31469,24 @@ function mergeValue(args) {
       args.path
     );
   }
-  return conflict(args.path);
+  return conflict(args.path, args.rawLocal, args.rawServer);
 }
 function mergeIdentityArray(base, server, local, path) {
   const baseItems = indexIdentityArray(base);
   const serverItems = indexIdentityArray(server);
   const localItems = indexIdentityArray(local);
   if (baseItems === null || serverItems === null || localItems === null) {
-    return conflict(path);
+    return conflict(path, local, server);
   }
-  const retained = /* @__PURE__ */ new Map();
+  const mergedValues = /* @__PURE__ */ new Map();
+  const localValues = /* @__PURE__ */ new Map();
+  const serverValues = /* @__PURE__ */ new Map();
   const conflicts = [];
+  const retainShared = (id2, value2) => {
+    mergedValues.set(id2, value2);
+    localValues.set(id2, value2);
+    serverValues.set(id2, value2);
+  };
   const ids = /* @__PURE__ */ new Set([
     ...baseItems.order,
     ...serverItems.order,
@@ -31370,46 +31502,79 @@ function mergeIdentityArray(base, server, local, path) {
     if (baseHas && !serverHas && !localHas) continue;
     if (baseHas && !serverHas) {
       if (canonicallyEqual(localValue, baseValue)) continue;
-      conflicts.push(`${path}[${JSON.stringify(id2)}]`);
+      conflicts.push(path + "[" + JSON.stringify(id2) + "]");
+      localValues.set(id2, localValue);
       continue;
     }
     if (baseHas && !localHas) {
       if (canonicallyEqual(serverValue, baseValue)) continue;
-      conflicts.push(`${path}[${JSON.stringify(id2)}]`);
+      conflicts.push(path + "[" + JSON.stringify(id2) + "]");
+      serverValues.set(id2, serverValue);
       continue;
     }
     if (!serverHas && localHas) {
-      retained.set(id2, localValue);
+      retainShared(id2, localValue);
       continue;
     }
     if (!localHas && serverHas) {
-      retained.set(id2, serverValue);
+      retainShared(id2, serverValue);
       continue;
     }
-    const merged = mergeValue({
+    const item = mergeValue({
       rawBase: baseValue,
       rawServer: serverValue,
       rawLocal: localValue,
       base: baseValue,
       server: serverValue,
       local: localValue,
-      path: `${path}[${JSON.stringify(id2)}]`,
+      path: path + "[" + JSON.stringify(id2) + "]",
       recursive: true
     });
-    conflicts.push(...merged.conflicts);
-    if (merged.present) retained.set(id2, merged.value);
+    conflicts.push(...item.conflicts);
+    if (item.present) mergedValues.set(id2, item.value);
+    if (item.local.present) localValues.set(id2, item.local.value);
+    if (item.server.present) serverValues.set(id2, item.server.value);
   }
-  if (conflicts.length > 0) return { present: true, value: [], conflicts };
-  const order = mergeIdentityOrder(
+  const retainedIds = /* @__PURE__ */ new Set([...localValues.keys(), ...serverValues.keys()]);
+  const sharedOrder = mergeIdentityOrder(
+    baseItems.order,
+    serverItems.order,
+    localItems.order,
+    retainedIds
+  );
+  if (sharedOrder === null) conflicts.push(path + ".$order");
+  const localOrder = sharedOrder?.filter((id2) => localValues.has(id2)) ?? completeVariantOrder(
+    localItems.order,
+    serverItems.order,
     baseItems.order,
+    new Set(localValues.keys())
+  );
+  const serverOrder = sharedOrder?.filter((id2) => serverValues.has(id2)) ?? completeVariantOrder(
     serverItems.order,
     localItems.order,
-    new Set(retained.keys())
+    baseItems.order,
+    new Set(serverValues.keys())
   );
-  if (order === null) return conflict(`${path}.$order`);
+  const localVariant = localOrder.map((id2) => localValues.get(id2));
+  const serverVariant = serverOrder.map((id2) => serverValues.get(id2));
+  if (conflicts.length > 0) {
+    return {
+      present: true,
+      value: [],
+      local: { present: true, value: localVariant },
+      server: { present: true, value: serverVariant },
+      conflicts
+    };
+  }
+  if (sharedOrder === null) {
+    throw new Error("A conflict-free identity merge must have a shared order.");
+  }
+  const value = sharedOrder.map((id2) => mergedValues.get(id2));
   return {
     present: true,
-    value: order.map((id2) => retained.get(id2)),
+    value,
+    local: { present: true, value },
+    server: { present: true, value },
     conflicts: []
   };
 }
@@ -31466,11 +31631,51 @@ function mergeIdentityOrder(base, server, local, retained) {
   }
   return result.length === nodes.length ? result : null;
 }
-function selected(value) {
-  return value === void 0 ? { present: false, conflicts: [] } : { present: true, value, conflicts: [] };
+function completeVariantOrder(preferred, fallback, base, retained) {
+  const result = preferred.filter((id2) => retained.has(id2));
+  const included = new Set(result);
+  for (const source of [fallback, base]) {
+    for (let index = 0; index < source.length; index += 1) {
+      const id2 = source[index];
+      if (!retained.has(id2) || included.has(id2)) continue;
+      let insertionIndex = -1;
+      for (let next = index + 1; next < source.length; next += 1) {
+        const nextIndex = result.indexOf(source[next]);
+        if (nextIndex !== -1) {
+          insertionIndex = nextIndex;
+          break;
+        }
+      }
+      if (insertionIndex === -1) {
+        for (let previous = index - 1; previous >= 0; previous -= 1) {
+          const previousIndex = result.indexOf(source[previous]);
+          if (previousIndex !== -1) {
+            insertionIndex = previousIndex + 1;
+            break;
+          }
+        }
+      }
+      if (insertionIndex === -1) insertionIndex = result.length;
+      result.splice(insertionIndex, 0, id2);
+      included.add(id2);
+    }
+  }
+  return result;
 }
-function conflict(path) {
-  return { present: false, conflicts: [path] };
+function selection(value) {
+  return value === void 0 ? { present: false } : { present: true, value };
+}
+function sharedSelection(value) {
+  const selected = selection(value);
+  return { ...selected, local: selected, server: selected, conflicts: [] };
+}
+function conflict(path, localValue, serverValue) {
+  return {
+    present: false,
+    local: selection(localValue),
+    server: selection(serverValue),
+    conflicts: [path]
+  };
 }
 var init_merge = __esm({
   "src/project-sync/merge.ts"() {
@@ -51601,13 +51806,13 @@ function sourceBaseParameterNames(context, baseName, suppliedNames) {
     return required2.parameters.map((parameter4) => parameter4.name);
   }
   const declared = context.declaredConstructors.byClassName.get(baseName) ?? [];
-  const selected2 = selectOverload(
+  const selected = selectOverload(
     declared.map(
       (constructor2) => constructor2.parameters.map((parameter4) => parameter4.name)
     ),
     suppliedNames
   );
-  return selected2;
+  return selected;
 }
 function recordBaseParameterNames(context, baseName, suppliedNames) {
   const baseClassId = context.classIdsByName.get(baseName);
@@ -64538,7 +64743,7 @@ function evaluateInitializerInContext(init, member, ctx, createdValues, argument
   };
 }
 function encodeLookupInitializerResult(member, value, created, ctx) {
-  const selection = encodeLookupInitializerSelection(
+  const selection2 = encodeLookupInitializerSelection(
     member,
     value,
     created,
@@ -64550,7 +64755,7 @@ function encodeLookupInitializerResult(member, value, created, ctx) {
       ctx.__executionState?.constructorGroups.delete(row.id);
     }
   }
-  return { value: selection, classId: null };
+  return { value: selection2, classId: null };
 }
 function encodeLookupInitializerSelection(member, value, created, ctx) {
   if (value === null) return null;
@@ -72482,7 +72687,7 @@ var init_animation_clips = __esm({
         const seenChildren = /* @__PURE__ */ new Set();
         for (const row of rows) {
           const rowClassId = this.requireNodeClassId(row, "animationChildOverride");
-          const selected2 = this.resolveSelector(
+          const selected = this.resolveSelector(
             row,
             rowClassId,
             WORLD_ANIMATION_CHILD_OVERRIDE_SELECTOR_MEMBER_ID,
@@ -72490,8 +72695,8 @@ var init_animation_clips = __esm({
             args.selectorOwnerNode,
             `Animation clip "${args.clipName}" frame ${args.frameIndex} child override`
           );
-          if (selected2 === null) continue;
-          const { childId, childClassId, childNode: child } = selected2;
+          if (selected === null) continue;
+          const { childId, childClassId, childNode: child } = selected;
           if (!args.childIds.has(childId)) {
             throw new Error(
               `Animation clip "${args.clipName}" frame ${args.frameIndex} references child "${childId}" outside the owner's authored Children graph.`
@@ -72657,7 +72862,7 @@ var init_animation_clips = __esm({
        * segment's length is instance data this document does not have.
        */
       validateTrackBase(args) {
-        const selected2 = this.resolveSelector(
+        const selected = this.resolveSelector(
           args.track,
           args.trackClassId,
           WORLD_ANIMATION_TRACK_SELECTOR_MEMBER_ID,
@@ -72665,9 +72870,9 @@ var init_animation_clips = __esm({
           args.selectorOwnerNode,
           args.label
         );
-        if (selected2 !== null && !args.childIds.has(selected2.childId)) {
+        if (selected !== null && !args.childIds.has(selected.childId)) {
           throw new Error(
-            `${args.label} references child "${selected2.childId}" outside the owner's authored Children graph.`
+            `${args.label} references child "${selected.childId}" outside the owner's authored Children graph.`
           );
         }
         const startFrame = this.requireIntegerField(
@@ -72686,7 +72891,7 @@ var init_animation_clips = __esm({
         }
         this.validateTrackDirection(args.track, args.trackClassId, args.label);
         this.validateTrackCropWindow(args.track, args.trackClassId, args.label);
-        return selected2;
+        return selected;
       }
       resolveSelector(parent, classId, selectorMemberId, refreshMemberId, _selectorOwnerNode, label) {
         this.validateSelectorRefresh(parent, classId, refreshMemberId, label);
@@ -74157,7 +74362,7 @@ function explicitTargetIds(changes) {
   return result;
 }
 function selectedRecordIds(records2, explicitIds, impactedIds, impactedTypeNames, constructedClassIds, impactedSourceNames, ownerId = () => null) {
-  const selected2 = new Set(explicitIds);
+  const selected = new Set(explicitIds);
   for (const record3 of records2) {
     const owner = ownerId(record3);
     if (owner !== null && impactedIds.has(owner) || recordDependsOnChangedContract(
@@ -74167,10 +74372,10 @@ function selectedRecordIds(records2, explicitIds, impactedIds, impactedTypeNames
       constructedClassIds,
       impactedSourceNames
     )) {
-      selected2.add(record3.id);
+      selected.add(record3.id);
     }
   }
-  return selected2;
+  return selected;
 }
 function recordDependsOnChangedContract(record3, impactedIds, impactedTypeNames, constructedClassIds, impactedSourceNames) {
   const recordId = isObjectRecord3(record3) ? record3.id : void 0;
@@ -85224,11 +85429,11 @@ var init_project_version_whole_graph_validation = __esm({
 
 // src/project-source/workspace-status-core.ts
 function listVirtualProjectSourceFilesV4(files) {
-  const selected2 = files.filter((file) => {
+  const selected = files.filter((file) => {
     const kind = neoProjectSourceKind(file.path);
     return kind !== null && isNeoProjectProductionSourceKind(kind) && !neoProjectPathHasIgnoredDirectory(file.path);
   });
-  const sorted = [...selected2].sort(
+  const sorted = [...selected].sort(
     (left, right) => compareWorkspacePaths(left.path, right.path)
   );
   for (let index = 1; index < sorted.length; index += 1) {
@@ -91292,9 +91497,6 @@ function resolveLookupCollectionValueIds(context, member, collection, ownerValue
     member.collectionMemberId,
     collection.name
   );
-  if (declaredRows.size > 0) {
-    return { valueIds: [...declaredRows], origin: "collectionMember" };
-  }
   const candidates = /* @__PURE__ */ new Set();
   const collectionState = context.state[`member:${member.collectionMemberId}`];
   const collectionMemberData = isObjectRecord2(collectionState?.data) ? collectionState.data : {};
@@ -91306,6 +91508,12 @@ function resolveLookupCollectionValueIds(context, member, collection, ownerValue
   ) ?? []) {
     candidates.add(placedValueId);
   }
+  if (declaredRows.size > 0) {
+    return {
+      valueIds: [.../* @__PURE__ */ new Set([...declaredRows, ...candidates])],
+      origin: "collectionMember"
+    };
+  }
   return { valueIds: [...candidates], origin: "nameScan" };
 }
 function collectionRowsOfDeclaredMember(context, collectionMemberId, schemaKey) {
@@ -92268,13 +92476,13 @@ function storedValueConstructor(context, schemaClass2, constructorArgs) {
       `Stored construction for ${schemaClass2.name} cannot select one constructor from ${candidates.length} ${count}-argument candidates.`
     );
   }
-  const selected2 = candidates[0];
-  if (selected2 === void 0) {
+  const selected = candidates[0];
+  if (selected === void 0) {
     throw new Error(
       `Stored construction for ${schemaClass2.name} resolved no constructor.`
     );
   }
-  return selected2;
+  return selected;
 }
 function storedConstructorArgumentSource(context, type, value, environment, visited, cloneAggregateArguments = false) {
   if (value === null) {
@@ -93879,7 +94087,7 @@ import {
   readFileSync as readFileSync6,
   readdirSync,
   renameSync as renameSync4,
-  rmSync,
+  rmSync as rmSync2,
   writeFileSync as writeFileSync6
 } from "node:fs";
 import { basename, dirname as dirname5, extname, join as join6, relative, sep } from "node:path";
@@ -94159,7 +94367,7 @@ function writeVerifiedBinaryDownloadV4(destination, bytes, expectedSha256) {
     writeFileSync6(temporary, bytes);
     renameSync4(temporary, destination);
   } finally {
-    rmSync(temporary, { force: true });
+    rmSync2(temporary, { force: true });
   }
 }
 function writeBinaryConflictArtifactV4(root, fileId, fileName2, bytes, expectedSha256) {
@@ -95284,7 +95492,7 @@ import {
   mkdirSync as mkdirSync7,
   readFileSync as readFileSync8,
   readdirSync as readdirSync3,
-  rmSync as rmSync2,
+  rmSync as rmSync3,
   writeFileSync as writeFileSync7,
   statSync
 } from "node:fs";
@@ -95296,14 +95504,14 @@ function resetWorkspaceToProjectSourcesV4(workspace, document, options = {}) {
   const previous = managedFilesBeforeReset(workspace.root);
   const preservedSpecs = preserveManagedSpecs(workspace.root);
   for (const directory of FORMAT_4_MANAGED_DIRECTORIES) {
-    rmSync2(join8(workspace.root, directory), { recursive: true, force: true });
+    rmSync3(join8(workspace.root, directory), { recursive: true, force: true });
   }
-  rmSync2(join8(workspace.root, "Scripts"), { recursive: true, force: true });
+  rmSync3(join8(workspace.root, "Scripts"), { recursive: true, force: true });
   for (const file of LEGACY_ROOT_FILES) {
-    rmSync2(join8(workspace.root, file), { force: true });
+    rmSync3(join8(workspace.root, file), { force: true });
   }
   for (const privatePath of LEGACY_PRIVATE_PATHS) {
-    rmSync2(join8(workspace.root, privatePath), { recursive: true, force: true });
+    rmSync3(join8(workspace.root, privatePath), { recursive: true, force: true });
   }
   for (const [path, bytes] of preservedSpecs) {
     const absolute = join8(workspace.root, path);
@@ -95559,7 +95767,7 @@ var init_http = __esm({
 });
 
 // src/project-source/project-file-pull.ts
-import { existsSync as existsSync6, rmSync as rmSync3 } from "node:fs";
+import { existsSync as existsSync6, rmSync as rmSync4 } from "node:fs";
 import { join as join9 } from "node:path";
 async function pullProjectBinariesV4(args) {
   let client = args.client ?? null;
@@ -95688,7 +95896,7 @@ async function pullProjectBinariesV4(args) {
       conflicted += 1;
       continue;
     }
-    rmSync3(absolute, { force: true });
+    rmSync4(absolute, { force: true });
     removePreviousConflict(args.workspace.root, previous.projectBinary);
   }
   return { states, downloaded, conflicted, conflicts };
@@ -95758,7 +95966,7 @@ function fileName(data) {
 }
 function removePreviousConflict(root, state) {
   if (state?.conflict?.artifactPath === void 0) return;
-  rmSync3(join9(root, state.conflict.artifactPath), { force: true });
+  rmSync4(join9(root, state.conflict.artifactPath), { force: true });
 }
 var init_project_file_pull = __esm({
   "src/project-source/project-file-pull.ts"() {
@@ -95823,7 +96031,7 @@ __export(pull_exports, {
 import {
   mkdirSync as mkdirSync8,
   writeFileSync as writeFileSync8,
-  rmSync as rmSync4,
+  rmSync as rmSync5,
   existsSync as existsSync7,
   readFileSync as readFileSync9
 } from "node:fs";
@@ -95972,7 +96180,7 @@ ${blockingErrors.map((error) => `  ${error.message}`).join("\n")}`
       continue;
     }
     const localSide = locallyDeleted ? {} : local;
-    const { merged, conflictFields } = mergeProjectDocumentRecord(
+    const { merged, localVariant, serverVariant, conflictFields } = mergeProjectDocumentRecord(
       serverRecord.recordKind,
       baseState.data,
       serverRecord.data,
@@ -95985,11 +96193,11 @@ ${blockingErrors.map((error) => `  ${error.message}`).join("\n")}`
       plans.set(key, {
         // The working copy renders the LOCAL side; the marker's other half
         // comes from the server-variant emission.
-        emitData: locallyDeleted ? void 0 : localSide,
+        emitData: locallyDeleted ? void 0 : localVariant,
         serverHash: serverRecord.contentHash,
         serverData: serverRecord.data,
         conflicted: true,
-        localData: locallyDeleted ? void 0 : localSide
+        serverEmitData: locallyDeleted ? serverRecord.data : serverVariant
       });
     } else {
       mergedCount += 1;
@@ -96024,8 +96232,7 @@ ${blockingErrors.map((error) => `  ${error.message}`).join("\n")}`
         emitData: local,
         serverHash: baseState.contentHash,
         serverData: void 0,
-        conflicted: true,
-        localData: local
+        conflicted: true
       });
       continue;
     }
@@ -96212,7 +96419,7 @@ async function finishFormat4Pull(args) {
     if (previousPath === void 0 || emittedPaths.has(previousPath)) continue;
     const absolute = join10(workspace.root, previousPath);
     if (existsSync7(absolute)) {
-      rmSync4(absolute);
+      rmSync5(absolute);
       removed += 1;
     }
   }
@@ -96520,7 +96727,7 @@ function sourceComparableObjectRecord(recordKind, value, mainLocale) {
 function buildEmitRecordSet(document, plans, side) {
   const records2 = /* @__PURE__ */ new Map();
   for (const [key, plan] of plans) {
-    const data = side === "emit" ? plan.emitData : plan.serverData;
+    const data = side === "emit" ? plan.emitData : plan.serverEmitData ?? plan.serverData;
     if (data === void 0) continue;
     const serverRecord = document.records.get(key);
     const [recordKind, recordId] = key.split(/:(.+)/, 2);
@@ -100378,7 +100585,7 @@ import { createHash as createHash10, randomUUID as randomUUID2 } from "node:cryp
 import {
   mkdirSync as mkdirSync10,
   writeFileSync as writeFileSync10,
-  rmSync as rmSync5,
+  rmSync as rmSync6,
   existsSync as existsSync11,
   readFileSync as readFileSync15
 } from "node:fs";
@@ -101174,7 +101381,7 @@ async function runPush(workspace, options, preparationOverride) {
       });
     } finally {
       if (preparedBuildDir !== void 0) {
-        rmSync5(preparedBuildDir, { recursive: true, force: true });
+        rmSync6(preparedBuildDir, { recursive: true, force: true });
       }
     }
   } else {
@@ -102387,7 +102594,7 @@ ${finalErrors.map(
     const previousPath = recordState.file;
     if (previousPath === void 0 || emittedPaths.has(previousPath)) continue;
     const absolute = join15(workspace.root, previousPath);
-    if (existsSync11(absolute)) rmSync5(absolute);
+    if (existsSync11(absolute)) rmSync6(absolute);
   }
   for (const file of files) {
     const absolute = join15(workspace.root, file.path);
@@ -103197,7 +103404,7 @@ var init_registry2 = __esm({
     PROJECT_SCHEMA_CONTRACT = Object.freeze({
       formatVersion: 3,
       contractVersion: "3.9",
-      cliVersion: "0.26.5",
+      cliVersion: "0.27.1",
       projectFileUploadBatchSize: 32,
       documentRecords: {
         member: {
@@ -104498,14 +104705,14 @@ import {
   readFileSync as readFileSync16,
   realpathSync,
   renameSync as renameSync5,
-  rmSync as rmSync6,
+  rmSync as rmSync7,
   statSync as statSync2,
   writeFileSync as writeFileSync11
 } from "node:fs";
 import {
   basename as basename3,
   dirname as dirname9,
-  isAbsolute,
+  isAbsolute as isAbsolute2,
   join as join16,
   relative as relative5,
   resolve as resolve3,
@@ -104706,7 +104913,7 @@ function preparedHookCandidate(workspace) {
       "test-build"
     );
     const pathFromRoot = relative5(cacheRoot, directory);
-    if (isAbsolute(pathFromRoot)) {
+    if (isAbsolute2(pathFromRoot)) {
       throw new NeoTestPreparedCandidateError(
         "NEO_PREPARED_BUILD_DIR must not resolve to an absolute path outside this workspace's .neo/test-build directory."
       );
@@ -104906,7 +105113,7 @@ function selectedSpecPaths(workspace, selectors) {
   );
   for (const selector of normalizedSelectors) {
     if (/[*?]/u.test(selector)) continue;
-    if (isAbsolute(selector)) {
+    if (isAbsolute2(selector)) {
       throw new Error(
         `Spec selector ${JSON.stringify(selector)} must be workspace-relative.`
       );
@@ -104953,8 +105160,8 @@ function selectedSpecPaths(workspace, selectors) {
   const selectedPaths = all.filter((absolutePath) => {
     const path = relativePaths.get(absolutePath);
     const configured = configuredIncludes.length === 0 || configuredIncludes.some((pattern) => globMatches(pattern, path));
-    const selected2 = normalizedSelectors.length === 0 || normalizedSelectors.some((selector) => selectorMatches(selector, path));
-    return configured && selected2 && !(workspace.config.test?.exclude ?? []).some(
+    const selected = normalizedSelectors.length === 0 || normalizedSelectors.some((selector) => selectorMatches(selector, path));
+    return configured && selected && !(workspace.config.test?.exclude ?? []).some(
       (pattern) => globMatches(pattern.replaceAll("\\", "/"), path)
     );
   });
@@ -105155,22 +105362,22 @@ function registerSpec(spec, document) {
   );
   return { spec, root, tests };
 }
-function mockResponse(environment, mock, selected2, call) {
-  if (selected2 === null) {
+function mockResponse(environment, mock, selected, call) {
+  if (selected === null) {
     if (mock.callThrough) return { handled: false };
     throw new NeoTestAssertionError(
       `Mock for Function '${mock.memberId}' has no configured behavior. Add returns, throws, doesNothing, or implementation.`
     );
   }
-  if (selected2.kind === "throw") {
-    throw new NSGetterRuntimeError(selected2.message);
+  if (selected.kind === "throw") {
+    throw new NSGetterRuntimeError(selected.message);
   }
-  if (selected2.kind === "implementation") {
+  if (selected.kind === "implementation") {
     return {
       handled: true,
       value: call.invokeDelegate(
         bindNeoScriptDelegateToContext(
-          selected2.delegate,
+          selected.delegate,
           environment.context
         ),
         mock.isStatic ? call.args : [call.receiver, ...call.args]
@@ -105179,7 +105386,7 @@ function mockResponse(environment, mock, selected2, call) {
   }
   return {
     handled: true,
-    value: selected2.kind === "return" ? selected2.value : null
+    value: selected.kind === "return" ? selected.value : null
   };
 }
 function partialObjectMatch(actual, expected) {
@@ -105196,16 +105403,16 @@ function matchingMock(environment, call) {
     (candidate) => candidate.receiverValueId !== void 0
   );
   const receiverValueId = needsReceiverLookup ? mockReceiverValueId(environment, call.receiver) : null;
-  let selected2;
+  let selected;
   for (const candidate of candidates) {
     if (candidate.receiverValueId !== void 0 && candidate.receiverValueId !== receiverValueId) {
       continue;
     }
-    if (selected2 === void 0 || candidate.id > selected2.id) {
-      selected2 = candidate;
+    if (selected === void 0 || candidate.id > selected.id) {
+      selected = candidate;
     }
   }
-  return selected2;
+  return selected;
 }
 function mockReceiverValueId(environment, receiver) {
   if (typeof receiver !== "object" || receiver === null) return null;
@@ -105550,15 +105757,15 @@ function failureFor(error, file, position, member = null) {
     ]
   };
 }
-function suiteHasSelectedTests(suite, selected2) {
-  return suite.tests.some((test) => selected2.has(test.id)) || suite.suites.some((child) => suiteHasSelectedTests(child, selected2));
+function suiteHasSelectedTests(suite, selected) {
+  return suite.tests.some((test) => selected.has(test.id)) || suite.suites.some((child) => suiteHasSelectedTests(child, selected));
 }
-async function executeRegisteredSpec(registered, document, selected2, timeoutMs, interrupted) {
+async function executeRegisteredSpec(registered, document, selected, timeoutMs, interrupted) {
   const results = [];
   const fileFailures = [];
   let testDurationMs = 0;
   const executeSuite = async (suite, parentEnvironment, inheritedFailures) => {
-    if (!suiteHasSelectedTests(suite, selected2)) return;
+    if (!suiteHasSelectedTests(suite, selected)) return;
     const fixture = cloneTestEnvironment(parentEnvironment);
     const suiteFailures = [...inheritedFailures];
     const suiteDeadline = Date.now() + timeoutMs;
@@ -105575,7 +105782,7 @@ async function executeRegisteredSpec(registered, document, selected2, timeoutMs,
       }
     }
     for (const test of suite.tests) {
-      if (!selected2.has(test.id)) continue;
+      if (!selected.has(test.id)) continue;
       const started = performance.now();
       const deadline = Date.now() + timeoutMs;
       const environment = cloneTestEnvironment(fixture);
@@ -105691,16 +105898,16 @@ function maintainNeoTestBuildCache(root, maxBytes = TEST_BUILD_CACHE_LIMIT_BYTES
   const resolvedProtected = protectedDirectory === void 0 ? null : resolve3(protectedDirectory);
   const protectedInsideRoot = resolvedProtected !== null && (() => {
     const fromRoot = relative5(resolvedRoot, resolvedProtected);
-    return fromRoot === "" || !fromRoot.startsWith(`..${sep5}`) && fromRoot !== ".." && !isAbsolute(fromRoot);
+    return fromRoot === "" || !fromRoot.startsWith(`..${sep5}`) && fromRoot !== ".." && !isAbsolute2(fromRoot);
   })();
   const isProtected = (path) => {
     if (!protectedInsideRoot || resolvedProtected === null) return false;
     const fromProtected = relative5(resolvedProtected, resolve3(path));
-    return fromProtected === "" || !fromProtected.startsWith(`..${sep5}`) && fromProtected !== ".." && !isAbsolute(fromProtected);
+    return fromProtected === "" || !fromProtected.startsWith(`..${sep5}`) && fromProtected !== ".." && !isAbsolute2(fromProtected);
   };
   for (const file of testBuildFiles(root)) {
     if (!isProtected(file.path) && basename3(file.path).includes(".tmp-") && now - file.modifiedMs >= ABANDONED_TEMP_MAX_AGE_MS) {
-      rmSync6(file.path, { force: true });
+      rmSync7(file.path, { force: true });
     }
   }
   const files = testBuildFiles(root);
@@ -105710,7 +105917,7 @@ function maintainNeoTestBuildCache(root, maxBytes = TEST_BUILD_CACHE_LIMIT_BYTES
   ).sort((left, right) => left.modifiedMs - right.modifiedMs);
   for (const file of removable) {
     if (total <= maxBytes) break;
-    rmSync6(file.path, { force: true });
+    rmSync7(file.path, { force: true });
     total -= file.size;
   }
 }
@@ -106004,7 +106211,7 @@ async function runTest(workspace, options, dependencies = {}) {
   if (options.outputFile !== null) {
     try {
       atomicWrite(
-        isAbsolute(options.outputFile) ? options.outputFile : join16(workspace.root, options.outputFile),
+        isAbsolute2(options.outputFile) ? options.outputFile : join16(workspace.root, options.outputFile),
         serialized
       );
     } catch (error) {
@@ -106217,7 +106424,7 @@ import {
   existsSync as existsSync13,
   readFileSync as readFileSync17
 } from "node:fs";
-import { extname as extname2, isAbsolute as isAbsolute2, join as join17, relative as relative6, sep as sep6 } from "node:path";
+import { extname as extname2, isAbsolute as isAbsolute3, join as join17, relative as relative6, sep as sep6 } from "node:path";
 function inspectNeoDoctor(workspace) {
   const formatCompatible = workspace.config.formatVersion === CURRENT_FORMAT_VERSION;
   const compiler = inspectCompilerContract();
@@ -106397,7 +106604,7 @@ function inspectTrackedBinary(root, record3, errors) {
   const binary = record3.projectBinary;
   if (!binary) return;
   const path = binary.path.replaceAll("\\", "/");
-  if (isAbsolute2(path) || path.split("/").includes("..")) {
+  if (isAbsolute3(path) || path.split("/").includes("..")) {
     errors.push(
       `Project file ${record3.recordId} has unsafe tracked path ${JSON.stringify(binary.path)}.`
     );
@@ -109474,7 +109681,7 @@ __export(resolve_exports, {
   runResolve: () => runResolve,
   workspaceFilePath: () => workspaceFilePath
 });
-import { readFileSync as readFileSync19, rmSync as rmSync7, writeFileSync as writeFileSync14 } from "node:fs";
+import { readFileSync as readFileSync19, rmSync as rmSync8, writeFileSync as writeFileSync14 } from "node:fs";
 import { join as join21 } from "node:path";
 function runResolve(workspace, side) {
   let resolvedFiles = 0;
@@ -109500,12 +109707,12 @@ function runResolve(workspace, side) {
         );
         binary.sha256 = conflict2.remoteSha256;
       } else {
-        rmSync7(destination, { force: true });
+        rmSync8(destination, { force: true });
         binary.sha256 = null;
       }
     }
     if (conflict2.artifactPath !== void 0) {
-      rmSync7(join21(workspace.root, conflict2.artifactPath), { force: true });
+      rmSync8(join21(workspace.root, conflict2.artifactPath), { force: true });
     }
     delete binary.conflict;
     resolvedBinaries += 1;
@@ -109604,6 +109811,7 @@ ${h("Start")}
   login     ${d("[--api <url>] [--profile editor|release] [--save-project <id>]")}
   init      ${d("[--project <id>] [--version <id>] [--dir <path>]  (interactive pickers)")}
   whoami    ${d("[--api <url>]")}
+  logout    ${d("[--api <url>]  delete the stored credential for one API origin")}
   help      ${d("show this command overview")}
   --version ${d("print the installed CLI version")}
 
@@ -109762,7 +109970,7 @@ There is no --keep-current: preserving current semantic state defines flatten.
 async function main() {
   const args = parseArgs(process.argv.slice(2));
   if (args.command === "--version") {
-    console.log("0.26.5");
+    console.log("0.27.1");
     return;
   }
   if (args.command === null || args.command === "help" || args.command === "--help" || args.command === "-h") {
@@ -109787,6 +109995,9 @@ async function main() {
     case "whoami":
       await runWhoami(apiBaseUrl);
       return;
+    case "logout":
+      await runLogout(apiBaseUrl);
+      return;
     case "init":
       {
         const { runInit: runInit2 } = await Promise.resolve().then(() => (init_init(), init_exports));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neocompose/cli",
-  "version": "0.26.5",
+  "version": "0.27.1",
   "description": "Neo Compose native project-source CLI with bidirectional sync.",
   "license": "MIT",
   "type": "module",

package/skills/neocompose-cli/SKILL.md

@@ -9,7 +9,7 @@ description: >-
   `@neocompose/cli` or `node cli/bin/neo.mjs` in the neo-compose repository.
 ---
 
-<!-- reviewed-through-cli: 0.26.5 -->
+<!-- reviewed-through-cli: 0.27.1 -->
 
 # Neo Compose CLI
 

package/skills/neocompose-cli/references/cli-development.md

@@ -83,7 +83,7 @@ wrappers.
 The marker near the top of `SKILL.md` must exactly match the package version:
 
 ```html
-<!-- reviewed-through-cli: 0.26.5 -->
+<!-- reviewed-through-cli: 0.27.1 -->
 ```
 
 The quoted version above is checked too, so this instruction cannot go stale

package/skills/neocompose-cli/references/commands-and-sync.md

@@ -145,5 +145,16 @@ and a protected file only as fallback. Use `NEO_COMPOSE_TOKEN` or
 `--token-stdin` in CI. The editor profile cannot publish releases; server
 scopes remain the security boundary.
 
+`neo logout [--api <url>]` deletes the stored credential for exactly one API
+origin (keychain entry and credentials-file row) and revokes the server
+session best-effort. It never clears other origins or the whole store.
+
+Isolated environments (P53 agent rigs) set `NEO_COMPOSE_CONFIG_HOME` (an
+absolute directory replacing `$XDG_CONFIG_HOME/neo-compose` for Neo state
+only) and `NEO_COMPOSE_CREDENTIAL_NAMESPACE` (scopes the OS-keychain account)
+so concurrent environments sharing one OS user cannot read, overwrite, or
+delete each other's tokens. Login, logout, and authenticated commands all
+honor both variables.
+
 Pass explicit project/version IDs and flags in automation. Prefer `--json` for
 machine-readable output and do not depend on interactive pickers or confirms.