@sequenceholdings/studio-cli 0.1.13 → 0.1.21

package/dist/auth.js

@@ -1,7 +1,13 @@
-import { chmod, mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
 import { existsSync } from 'node:fs';
+import { chmod, readFile, rename, unlink, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { join } from 'node:path';
+import { validateDeploymentAudience, validateDeploymentBaseUrl, } from '@sequenceholdings/artifact-studio/deployment-validation';
+import { withCrossProcessFileLock } from './file-lock.js';
+function hasErrorCode(error, code) {
+    return error instanceof Error && Reflect.get(error, 'code') === code;
+}
 /**
  * seq-studio and seqapi share one token file and one Auth0 application:
  * same tenant, client id, audience, and token shape. Either CLI can log in,
@@ -9,30 +15,125 @@ import { dirname, join } from 'node:path';
  *
  * Two token sources, in the SAME precedence order as seqapi's
  * `get_access_token` (`shared/seqapi/seqapi/auth.py`):
- *   1. M2M service account — Auth0 client-credentials grant, used when
- *      `AUTH0_M2M_CLIENT_SECRET` is set. This is the headless path: CI /
- *      cloud agents with no interactive login can still push.
+ *   1. Cached user access token — read from the seqapi token file. When it
+ *      expires, an interactive session performs a bounded PKCE login again.
+ *   2. M2M service account — Auth0 client-credentials grant when the realm's
+ *      `AUTH0_M2M_CLIENT_SECRET` (or suffixed OpCo variant) is set. Used when
+ *      no valid user session exists, or when `SEQAPI_AUTH_MODE=m2m` forces it.
  *      (M2M carries app scopes but NO user identity / workspace membership
  *      — see the `atlas-test-access` rule.)
- *   2. Cached user token — read from the seqapi token file and refreshed
- *      via the Auth0 refresh-token grant when near expiry.
  *
- * Login and refresh both write the shared file. This mirrors
- * `seqapi._save_tokens` exactly:
+ * Login writes the shared file. This mirrors `seqapi._save_tokens` exactly:
  * same fields, same shape, same 0o600 permissions, atomic write via
- * tmpfile + rename. The M2M token is in-memory only (never persisted).
+ * tmpfile + rename. M2M tokens are cached in-process and also under the
+ * token file's `m2m` key so short-lived CLI processes reuse a grant.
  */
 // Match `shared/seqapi/seqapi/config.py`. Hard-coded because the seqapi
 // CLI also hard-codes them — there's a single Sequence Auth0 tenant for
 // all Sequence CLIs.
 export const AUTH0_DOMAIN = 'dev-n1t8ts403fp8oyxp.us.auth0.com';
+const AUTH0_CUSTOM_DOMAIN = 'login.seqholdings.com';
 export const AUTH0_CLIENT_ID = 'GD9riCDWocfc66odpWBjwBiX43qqAX8r';
 export const AUTH0_AUDIENCE = 'https://api.studio.com';
 const AUTH0_M2M_CLIENT_ID = '5TLffZqvLq4ztLDjZhwKVJCpB5VNrWj0';
-// In-memory cache for the M2M token (seconds-based, mirrors seqapi's
+/** The realm name the built-in Sequence environments' tokens live under —
+ * also the implicit realm of the legacy flat fields in tokens.json. */
+export const SEQUENCE_REALM = 'sequence';
+const SEQUENCE_BUILTIN_ENVS = new Set(['local', 'staging', 'production', 'banksouth']);
+export function isSequenceAuthEnvName(envName) {
+    return (envName === SEQUENCE_REALM ||
+        SEQUENCE_BUILTIN_ENVS.has(envName) ||
+        envName === 'preview' ||
+        envName.startsWith('preview:'));
+}
+// Both hostnames terminate at Sequence's one Auth0 tenant. Keep this explicit:
+// discovery must never be able to select an arbitrary credential recipient.
+const TRUSTED_AUTH0_DOMAINS = new Set([AUTH0_DOMAIN, AUTH0_CUSTOM_DOMAIN]);
+/**
+ * A discovery response is not a trust anchor for the host that receives an
+ * M2M client secret. Even another valid *.auth0.com tenant is untrusted;
+ * additional Auth0 tenants/custom domains require an explicit code-reviewed
+ * allowlist entry.
+ */
+export function validateAuth0Domain(domain) {
+    const normalized = domain.trim().toLowerCase();
+    if (!TRUSTED_AUTH0_DOMAINS.has(normalized)) {
+        throw new Error(`Untrusted Auth0 domain '${domain}': expected one of ` +
+            `${JSON.stringify([...TRUSTED_AUTH0_DOMAINS])}. Discovery cannot authorize ` +
+            'a new host to receive an M2M client secret.');
+    }
+    return normalized;
+}
+export const SEQUENCE_AUTH_REALM = {
+    name: SEQUENCE_REALM,
+    domain: AUTH0_DOMAIN,
+    clientId: AUTH0_CLIENT_ID,
+    audience: AUTH0_AUDIENCE,
+    m2mClientId: AUTH0_M2M_CLIENT_ID,
+};
+function seqapiConfigPath() {
+    return join(seqapiTokenDir(), 'config.json');
+}
+/**
+ * Resolve the auth realm for an environment name. Undefined, built-ins, and
+ * per-PR preview targets map to the shared Sequence realm. Preview URLs are
+ * constrained to Sequence's preview domain by the environment resolver. Every
+ * other explicit name must have a valid seqapi registry entry; otherwise fail
+ * closed so a shared Sequence bearer token can never be sent to a tenant URL.
+ */
+export async function realmForEnv(envName) {
+    if (!envName || isSequenceAuthEnvName(envName)) {
+        return SEQUENCE_AUTH_REALM;
+    }
+    const path = seqapiConfigPath();
+    const registrationError = new Error(`Environment '${envName}' has no tenant auth registration in ${path}. ` +
+        `Register it with: seq-studio envs add ${envName} <url>`);
+    if (!existsSync(path))
+        throw registrationError;
+    let registered;
+    try {
+        const parsed = JSON.parse(await readFile(path, 'utf8'));
+        registered =
+            typeof parsed === 'object' && parsed !== null
+                ? (Reflect.get(parsed, 'environments') ?? {})
+                : {};
+    }
+    catch (error) {
+        throw new Error(`Could not read tenant auth registry ${path}. ` +
+            `Re-register '${envName}' with: seq-studio envs add ${envName} <url>`, { cause: error });
+    }
+    const entry = registered[envName];
+    if (!entry)
+        throw registrationError;
+    const { auth0 } = entry;
+    if (!entry.url || !auth0?.domain || !auth0.client_id || !auth0.audience) {
+        throw new Error(`Environment '${envName}' in ${path} is missing Auth0 config. ` +
+            `Re-register it with: seq-studio envs add ${envName} <url>`);
+    }
+    const baseUrl = validateDeploymentBaseUrl(entry.url);
+    validateDeploymentAudience({ audience: auth0.audience, baseUrl });
+    return {
+        name: envName,
+        domain: validateAuth0Domain(auth0.domain),
+        clientId: auth0.client_id,
+        audience: auth0.audience,
+        organization: auth0.organization ?? undefined,
+        m2mClientId: auth0.m2m_client_id ?? undefined,
+    };
+}
+/** Env var(s) carrying a realm's M2M client secret — the Sequence realm keeps
+ * the legacy bare name; OpCo realms use a suffixed name so one shell can hold
+ * several credentials unambiguously. Mirrors seqapi's `_m2m_secret_env_names`. */
+export function m2mSecretEnvName(realm) {
+    if (realm.name === SEQUENCE_REALM)
+        return 'AUTH0_M2M_CLIENT_SECRET';
+    return `AUTH0_M2M_CLIENT_SECRET_${realm.name.toUpperCase().replaceAll('-', '_')}`;
+}
+// In-memory per-realm cache for M2M tokens (seconds-based, mirrors seqapi's
 // `_m2m_cache`). Reused while > 60s from expiry to avoid re-minting on every
-// call within a single process (e.g. a long `artifact dev` watch).
-let m2mCache = null;
+// call within a single process (e.g. a long `artifact dev` watch). Disk
+// persistence under tokens.json `m2m` covers cross-process reuse.
+const m2mCache = new Map();
 /**
  * A configured M2M credential failed to mint a token. Typed so callers that
  * normally swallow discovery errors (lazy catalog refresh) can still surface
@@ -41,27 +142,78 @@ let m2mCache = null;
 export class M2mTokenError extends Error {
     name = 'M2mTokenError';
 }
+function authModePrefersM2m() {
+    const value = process.env.SEQAPI_AUTH_MODE?.trim().toLowerCase() ?? 'auto';
+    return value === 'm2m';
+}
+function tokenStillValid(entry) {
+    const now = Date.now() / 1000;
+    return Boolean(entry?.accessToken && (entry.expiresAt ?? 0) > now + 60);
+}
+async function loadPersistedM2m(realmName) {
+    if (!existsSync(seqapiTokenPath()))
+        return null;
+    return withTokenFileLock(async () => {
+        const file = await readTokenFile();
+        const entry = file?.m2m?.[realmName];
+        if (!entry?.access_token)
+            return null;
+        return {
+            accessToken: entry.access_token,
+            expiresAt: entry.expires_at ?? 0,
+        };
+    });
+}
+async function persistM2m({ realmName, accessToken, expiresAt, }) {
+    await withTokenFileLock(async () => {
+        const existing = (await readTokenFile()) ?? {};
+        stripPersistedRefreshTokens(existing);
+        const m2m = { ...existing.m2m, [realmName]: { access_token: accessToken, expires_at: expiresAt } };
+        await writeTokenFile({ ...existing, m2m });
+    });
+}
 /**
- * Mint an M2M access token via the Auth0 client-credentials grant when
- * `AUTH0_M2M_CLIENT_SECRET` is set. Returns null when the secret is unset
- * (so the caller falls back to the user token). Throws on a configured-but-
- * rejected secret, mirroring seqapi's `_get_m2m_token` (`raise_for_status`).
+ * Mint an M2M access token via the Auth0 client-credentials grant when the
+ * realm's secret env var is set. Returns null when the secret is unset.
+ * Throws on a configured-but-rejected secret, mirroring seqapi's
+ * `_get_m2m_token`. Cache order: in-process → shared token file → Auth0.
+ * The realm's own secret var is required — a Sequence secret in the shell is
+ * never sent to a tenant's Auth0 client.
  */
-async function getM2mToken() {
-    const clientSecret = process.env.AUTH0_M2M_CLIENT_SECRET;
+async function getM2mToken(realm = SEQUENCE_AUTH_REALM) {
+    if (!realm.m2mClientId)
+        return null;
+    const clientSecret = process.env[m2mSecretEnvName(realm)];
     if (!clientSecret)
         return null;
-    const now = Date.now() / 1000;
-    if (m2mCache && m2mCache.expiresAt > now + 60)
-        return m2mCache.accessToken;
-    const response = await fetch(`https://${AUTH0_DOMAIN}/oauth/token`, {
+    const cached = m2mCache.get(realm.name);
+    if (cached && tokenStillValid(cached)) {
+        verifyTokenMatchesRealm({
+            accessToken: cached.accessToken,
+            realm,
+            requireOrganization: false,
+        });
+        return cached.accessToken;
+    }
+    const persisted = await loadPersistedM2m(realm.name);
+    if (persisted && tokenStillValid(persisted)) {
+        verifyTokenMatchesRealm({
+            accessToken: persisted.accessToken,
+            realm,
+            requireOrganization: false,
+        });
+        m2mCache.set(realm.name, persisted);
+        return persisted.accessToken;
+    }
+    const response = await fetch(`https://${realm.domain}/oauth/token`, {
         method: 'POST',
+        redirect: 'manual',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({
             grant_type: 'client_credentials',
-            client_id: AUTH0_M2M_CLIENT_ID,
+            client_id: realm.m2mClientId,
             client_secret: clientSecret,
-            audience: AUTH0_AUDIENCE,
+            audience: realm.audience,
         }),
     });
     if (!response.ok) {
@@ -71,11 +223,22 @@ async function getM2mToken() {
     if (!data.access_token) {
         throw new M2mTokenError('Auth0 M2M response missing access_token');
     }
-    m2mCache = {
+    verifyTokenMatchesRealm({
+        accessToken: data.access_token,
+        realm,
+        requireOrganization: false,
+    });
+    const entry = {
         accessToken: data.access_token,
         expiresAt: Date.now() / 1000 + (data.expires_in ?? 7200),
     };
-    return m2mCache.accessToken;
+    m2mCache.set(realm.name, entry);
+    await persistM2m({
+        realmName: realm.name,
+        accessToken: entry.accessToken,
+        expiresAt: entry.expiresAt,
+    });
+    return entry.accessToken;
 }
 export function seqapiTokenDir() {
     return join(homedir(), '.config', 'sequence-api');
@@ -85,108 +248,214 @@ export function seqapiTokenPath() {
 }
 export class NotLoggedInError extends Error {
     name = 'NotLoggedInError';
-    constructor() {
-        super('Not logged in. Run: seq-studio login\n' +
-            'For headless contexts (CI / cloud agents), set AUTH0_M2M_CLIENT_SECRET for ' +
+    constructor(realmName = SEQUENCE_REALM, reason) {
+        const loginHint = realmName === SEQUENCE_REALM
+            ? 'Run: seq-studio login'
+            : `Run: seq-studio login --env ${realmName} (or: seqapi login -e ${realmName})`;
+        const secretHint = realmName === SEQUENCE_REALM
+            ? 'AUTH0_M2M_CLIENT_SECRET'
+            : `AUTH0_M2M_CLIENT_SECRET_${realmName.toUpperCase().replaceAll('-', '_')}`;
+        super(`${reason ?? `Not logged in [${realmName}].`} ${loginHint}\n` +
+            `For headless contexts (CI / cloud agents), set ${secretHint} for ` +
             'service-account (M2M) access instead.');
     }
 }
 /**
- * Return a valid access token. Tries the M2M service account first when
- * `AUTH0_M2M_CLIENT_SECRET` is set, then falls back to the cached user
- * token (refreshed via the Auth0 refresh-token grant when within 60s of
- * expiry). Same precedence as seqapi's `get_access_token`, so both CLIs
- * resolve the same identity for the same environment.
+ * Return a valid access token for an environment's auth realm.
+ *
+ * Precedence (default `SEQAPI_AUTH_MODE=auto`), matching seqapi:
+ *   1. Valid cached user access token
+ *   2. M2M client-credentials when the realm's secret env var is set
+ *   3. Bounded PKCE login when browser auto-login is enabled
+ *
+ * Set `SEQAPI_AUTH_MODE=m2m` to skip the user token. No `env` (or a built-in
+ * Sequence env) means the shared Sequence realm.
  */
-export async function getAccessToken() {
-    const m2m = await getM2mToken();
-    if (m2m)
-        return m2m;
-    const tokens = await loadTokens();
-    if (!tokens)
-        throw new NotLoggedInError();
-    const now = Date.now() / 1000;
-    if (tokens.access_token && (tokens.expires_at ?? 0) > now + 60) {
-        return tokens.access_token;
+export class UnsafeAuthTargetError extends Error {
+}
+const AUTO_LOGIN_TIMEOUT_MS = 120_000;
+function autoLoginEnabled() {
+    const value = process.env.SEQAPI_AUTO_LOGIN?.trim().toLowerCase() ?? '1';
+    return !['0', 'false', 'no', 'off'].includes(value);
+}
+function autoLoginTimeoutMs() {
+    const raw = process.env.SEQAPI_AUTO_LOGIN_TIMEOUT?.trim();
+    if (!raw)
+        return AUTO_LOGIN_TIMEOUT_MS;
+    const seconds = Number(raw);
+    return Number.isFinite(seconds) && seconds > 0 ? seconds * 1_000 : AUTO_LOGIN_TIMEOUT_MS;
+}
+async function reauthenticateOrThrow({ reason, realm, }) {
+    if (!autoLoginEnabled()) {
+        throw new NotLoggedInError(realm.name, reason);
     }
-    if (!tokens.refresh_token)
-        throw new NotLoggedInError();
-    const response = await fetch(`https://${AUTH0_DOMAIN}/oauth/token`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-            grant_type: 'refresh_token',
-            client_id: AUTH0_CLIENT_ID,
-            refresh_token: tokens.refresh_token,
-        }),
-    });
-    if (response.status === 401 || response.status === 403) {
-        throw new Error('Refresh token expired or revoked. Re-authenticate with: seq-studio login');
+    try {
+        const { loginWithPkce } = await import('./login.js');
+        return await loginWithPkce({ realm, timeoutMs: autoLoginTimeoutMs() });
     }
-    if (!response.ok) {
-        throw new Error(`Auth0 token refresh failed (${response.status}): ${await response.text()}`);
+    catch (error) {
+        throw new NotLoggedInError(realm.name, `${reason} Automatic re-login failed: ${error instanceof Error ? error.message : String(error)}`);
     }
-    const refreshed = (await response.json());
-    if (!refreshed.access_token) {
-        throw new Error('Auth0 refresh response missing access_token');
+}
+function validateRealmTarget({ realm, targetUrl, }) {
+    try {
+        const baseUrl = validateDeploymentBaseUrl(targetUrl);
+        if (realm.name !== SEQUENCE_REALM) {
+            validateDeploymentAudience({ audience: realm.audience, baseUrl });
+        }
+    }
+    catch (error) {
+        throw new UnsafeAuthTargetError(`Refusing to send '${realm.name}' credentials to ${targetUrl}: ` +
+            `${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
+}
+export async function getAccessTokenWithMode(options) {
+    const realm = await realmForEnv(options?.env);
+    if (options?.targetUrl)
+        validateRealmTarget({ realm, targetUrl: options.targetUrl });
+    const forceM2m = authModePrefersM2m();
+    if (!forceM2m) {
+        const tokens = await loadCachedUserTokens(realm.name);
+        const now = Date.now() / 1000;
+        if (tokens?.access_token && (tokens.expires_at ?? 0) > now + 60) {
+            verifyTokenMatchesRealm({ accessToken: tokens.access_token, realm });
+            return { authMode: 'user', token: tokens.access_token };
+        }
+    }
+    const m2m = await getM2mToken(realm);
+    if (m2m)
+        return { authMode: 'm2m', token: m2m };
+    if (forceM2m) {
+        throw new NotLoggedInError(realm.name, `SEQAPI_AUTH_MODE=m2m but no M2M credentials for [${realm.name}].`);
+    }
+    const tokens = await loadCachedUserTokens(realm.name);
+    if (!tokens) {
+        if (options?.allowInteractiveLogin === false) {
+            throw new NotLoggedInError(realm.name);
+        }
+        return {
+            authMode: 'user',
+            token: await reauthenticateOrThrow({
+                reason: `Not logged in [${realm.name}].`,
+                realm,
+            }),
+        };
     }
-    const updated = {
-        access_token: refreshed.access_token,
-        refresh_token: refreshed.refresh_token ?? tokens.refresh_token,
-        expires_at: Date.now() / 1000 + (refreshed.expires_in ?? 86400),
+    if (options?.allowInteractiveLogin === false) {
+        throw new NotLoggedInError(realm.name, `Access token expired [${realm.name}].`);
+    }
+    return {
+        authMode: 'user',
+        token: await reauthenticateOrThrow({
+            reason: `Access token expired [${realm.name}].`,
+            realm,
+        }),
     };
-    await saveTokens(updated);
-    return updated.access_token;
+}
+export async function getAccessToken(options) {
+    return (await getAccessTokenWithMode(options)).token;
 }
 /**
  * Try to load a token without throwing. Returns `null` for any error
  * condition (missing file, parse error, no token fields). Used by
  * `doctor` for non-fatal "are you logged in?" checks.
  */
-export async function tryGetAccessToken(options) {
+export async function tryGetAccessTokenWithMode(options) {
     try {
-        return await getAccessToken();
+        return await getAccessTokenWithMode({
+            allowInteractiveLogin: false,
+            env: options?.env,
+            targetUrl: options?.targetUrl,
+        });
     }
     catch (err) {
-        if (options?.failClosedForM2m && process.env.AUTH0_M2M_CLIENT_SECRET?.trim()) {
+        if (err instanceof UnsafeAuthTargetError)
             throw err;
+        if (options?.failClosedForM2m) {
+            // Do not replace an invalid tenant registration with the Sequence realm:
+            // that could hide a rejected discovery token host or inspect the wrong
+            // M2M secret. Config-resolution errors must surface unchanged.
+            const realm = await realmForEnv(options.env);
+            if (process.env[m2mSecretEnvName(realm)]?.trim())
+                throw err;
         }
         return null;
     }
 }
+export async function tryGetAccessToken(options) {
+    return (await tryGetAccessTokenWithMode(options))?.token ?? null;
+}
 /**
  * Decode the `sub` claim from a JWT without verification. Verification is the
  * server's job — this is only used to compare identities locally (e.g. to
  * bind the cached environment catalog to the identity that fetched it).
  */
-export function decodeJwtSub(token) {
+function decodeJwtClaims(token) {
     const payload = token.split('.')[1];
     if (!payload)
         return null;
     try {
         const parsed = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
-        const sub = typeof parsed === 'object' && parsed !== null ? Reflect.get(parsed, 'sub') : null;
-        return typeof sub === 'string' && sub ? sub : null;
+        return typeof parsed === 'object' && parsed !== null ? parsed : null;
     }
     catch {
         return null;
     }
 }
+/**
+ * Refuse to persist a token minted for another audience or Auth0
+ * organization. Auth0/server-side JWT verification remains authoritative;
+ * this local decode is only a cross-realm confusion check on a token received
+ * directly from the configured Auth0 tenant over TLS.
+ */
+export function verifyTokenMatchesRealm({ accessToken, realm, requireOrganization = true, }) {
+    const claims = decodeJwtClaims(accessToken);
+    if (!claims)
+        return; // Opaque or undecodable token: nothing to check locally.
+    const aud = Reflect.get(claims, 'aud');
+    const audiences = Array.isArray(aud)
+        ? aud.filter((value) => typeof value === 'string')
+        : typeof aud === 'string'
+            ? [aud]
+            : [];
+    if (!audiences.includes(realm.audience)) {
+        throw new Error(`Auth0 returned a token for audience ${JSON.stringify(audiences)}, expected ` +
+            `'${realm.audience}' — refusing to store it. Check the '${realm.name}' ` +
+            'environment registration (seqapi env add).');
+    }
+    const organization = Reflect.get(claims, 'org_id');
+    if (requireOrganization && realm.organization && organization !== realm.organization) {
+        throw new Error(`Auth0 returned a token for organization ${JSON.stringify(organization)}, ` +
+            `expected '${realm.organization}' — refusing to store it.`);
+    }
+}
+export function decodeJwtSub(token) {
+    const claims = decodeJwtClaims(token);
+    const sub = claims ? Reflect.get(claims, 'sub') : null;
+    return typeof sub === 'string' && sub ? sub : null;
+}
 /**
  * The Auth0 subject the CLI would authenticate as right now, without any
- * network call: the fixed M2M client subject when the secret is configured,
- * else the `sub` of the cached user token, else null (anonymous).
+ * network call. Matches token resolution precedence: a valid user session
+ * wins over an ambient M2M secret unless `SEQAPI_AUTH_MODE=m2m`.
  */
-export async function currentIdentitySubject() {
-    if (process.env.AUTH0_M2M_CLIENT_SECRET?.trim()) {
-        return `${AUTH0_M2M_CLIENT_ID}@clients`;
+export async function currentIdentitySubject(options = {}) {
+    const realm = await realmForEnv(options.env);
+    const forceM2m = authModePrefersM2m();
+    if (!forceM2m) {
+        const tokens = await loadCachedUserTokens(realm.name);
+        const now = Date.now() / 1000;
+        if (tokens?.access_token && (tokens.expires_at ?? 0) > now + 60) {
+            verifyTokenMatchesRealm({ accessToken: tokens.access_token, realm });
+            return decodeJwtSub(tokens.access_token);
+        }
     }
-    const tokens = await loadTokens();
-    if (!tokens?.access_token)
-        return null;
-    return decodeJwtSub(tokens.access_token);
+    if (realm.m2mClientId && process.env[m2mSecretEnvName(realm)]?.trim()) {
+        return `${realm.m2mClientId}@clients`;
+    }
+    return null;
 }
-async function loadTokens() {
+async function readTokenFile() {
     const path = seqapiTokenPath();
     if (!existsSync(path))
         return null;
@@ -197,14 +466,107 @@ async function loadTokens() {
         return null;
     }
 }
-export async function saveTokens(tokens) {
+function stripPersistedRefreshTokens(file) {
+    let changed = false;
+    if ('refresh_token' in file) {
+        delete file.refresh_token;
+        changed = true;
+    }
+    if (file.realms) {
+        for (const entry of Object.values(file.realms)) {
+            if ('refresh_token' in entry) {
+                delete entry.refresh_token;
+                changed = true;
+            }
+        }
+    }
+    return changed;
+}
+export async function loadCachedUserTokens(realmName = SEQUENCE_REALM) {
+    if (!existsSync(seqapiTokenPath()))
+        return null;
+    return withTokenFileLock(async () => {
+        const file = await readTokenFile();
+        if (!file)
+            return null;
+        if (stripPersistedRefreshTokens(file)) {
+            await writeTokenFile(file);
+        }
+        const entry = realmName === SEQUENCE_REALM ? file : file.realms?.[realmName];
+        if (!entry?.access_token)
+            return null;
+        return {
+            access_token: entry.access_token,
+            expires_at: entry.expires_at,
+        };
+    });
+}
+async function withTokenFileLock(operation) {
+    return withCrossProcessFileLock({ operation, path: seqapiTokenPath() });
+}
+async function writeTokenFile(tokens) {
     const path = seqapiTokenPath();
-    await mkdir(dirname(path), { recursive: true });
-    // Mirror seqapi's atomic-write pattern: write to tmpfile then rename.
-    const tmp = path + '.tmp';
-    await writeFile(tmp, JSON.stringify(tokens, null, 2), { encoding: 'utf8', mode: 0o600 });
-    // writeFile's mode only applies when creating a file. Reset it explicitly in
-    // case a prior interrupted login left a permissive tmp file behind.
-    await chmod(tmp, 0o600);
-    await rename(tmp, path);
+    // Use a process-unique temp file before the atomic rename. Both CLIs share
+    // this protocol and may update the file at the same time.
+    const tmp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+        await writeFile(tmp, JSON.stringify(tokens, null, 2), {
+            encoding: 'utf8',
+            mode: 0o600,
+            flag: 'wx',
+        });
+        await chmod(tmp, 0o600);
+        await rename(tmp, path);
+    }
+    finally {
+        try {
+            await unlink(tmp);
+        }
+        catch (error) {
+            if (!hasErrorCode(error, 'ENOENT'))
+                throw error;
+        }
+    }
+}
+export async function saveTokens(tokens, realmName = SEQUENCE_REALM) {
+    await withTokenFileLock(async () => {
+        // Merge while holding the cross-process lock so concurrent seqapi and
+        // seq-studio logins cannot discard another realm's session.
+        const existing = (await readTokenFile()) ?? {};
+        stripPersistedRefreshTokens(existing);
+        const merged = realmName === SEQUENCE_REALM
+            ? { ...existing, ...tokens }
+            : { ...existing, realms: { ...existing.realms, [realmName]: tokens } };
+        await writeTokenFile(merged);
+    });
+}
+export async function deleteRealmTokens(realmName) {
+    await withTokenFileLock(async () => {
+        const existing = (await readTokenFile()) ?? {};
+        stripPersistedRefreshTokens(existing);
+        const updated = { ...existing };
+        if (realmName === SEQUENCE_REALM) {
+            delete updated.access_token;
+            delete updated.expires_at;
+        }
+        else {
+            const realms = { ...existing.realms };
+            delete realms[realmName];
+            if (Object.keys(realms).length > 0) {
+                updated.realms = realms;
+            }
+            else {
+                delete updated.realms;
+            }
+        }
+        const m2m = { ...existing.m2m };
+        delete m2m[realmName];
+        if (Object.keys(m2m).length > 0) {
+            updated.m2m = m2m;
+        }
+        else {
+            delete updated.m2m;
+        }
+        await writeTokenFile(updated);
+    });
 }

package/dist/config.d.ts

@@ -26,10 +26,10 @@ export declare function defaultConfig(): LatticeConfig;
  *   1. built-in `local`
  *   2. the cached discovered catalog (`~/.config/lattice/environments.json`)
  *   3. user entries in config.toml (an override for `local`, or net-new envs)
+ *   4. OpCo registrations shared with seqapi (`~/.config/sequence-api/config.json`)
  *
- * If the config.toml file does not exist, defaults are returned — no
- * auto-write, since seq-studio should work out of the box without any
- * state on disk.
+ * Registered OpCo routes are authoritative for their names so a lower-trust
+ * config.toml override cannot send a tenant token to another origin.
  */
 export declare function readConfig(): Promise<LatticeConfig>;
 /** Write the config to disk, creating the dir if missing. */