@topolo/cli 0.13.22 → 0.13.24

package/README.md

@@ -57,9 +57,25 @@ For interactive use:
 topolo auth login             # OAuth device flow — no client id needed; approve in the browser
 topolo auth login --api-key topo_live_...  # or store an API key directly (headless/service)
 topolo auth status            # shows which source is active
-topolo auth logout            # clears the stored credential
+topolo auth logout            # removes every stored sign-in for the environment and revokes it
+topolo auth lock              # shows who holds the sign-in renewal lock and how to recover
 ```
 
+A stored API key is what unpinned commands act as, even when OAuth contexts are
+also stored; name a context with `--context` to use one. `auth logout` removes
+the stored credential, every personal and organization context and any pending
+re-authorization for the selected environment, then revokes each removed OAuth
+sign-in at Topolo (API keys are only removed locally). A re-authorization is
+accepted only from the user who signed the context in; another member of the
+same organization approving in the browser changes nothing.
+
+If every command fails with `state_conflict` after about 30 seconds, the lock
+that serializes sign-in renewal is held or was left behind. `topolo auth lock`
+shows its state and the next step; an empty lock left by an interrupted writer
+is recovered with `topolo auth lock --reconcile <generation>`, which keeps the
+old lock in a private quarantine as evidence. Credentials are not read or
+changed.
+
 `topolo auth login` uses a **built-in first-party OAuth client per environment**,
 so any Topolo user can sign in without registering a client — what they can do
 is decided by their permissions. `--client-id doac_...` (or