@topolo/cli 0.13.23 → 0.13.25

package/README.md

@@ -57,11 +57,19 @@ For interactive use:
 topolo auth login             # OAuth device flow — no client id needed; approve in the browser
 topolo auth login --api-key topo_live_...  # or store an API key directly (headless/service)
 topolo auth status            # shows which source is active
-topolo auth logout            # clears the stored credential
+topolo auth logout            # removes every stored sign-in for the environment and revokes it
 topolo auth lock              # shows who holds the sign-in renewal lock and how to recover
 ```
 
-If every command fails with `state_conflict` after about 15 seconds, the lock
+A stored API key is what unpinned commands act as, even when OAuth contexts are
+also stored; name a context with `--context` to use one. `auth logout` removes
+the stored credential, every personal and organization context and any pending
+re-authorization for the selected environment, then revokes each removed OAuth
+sign-in at Topolo (API keys are only removed locally). A re-authorization is
+accepted only from the user who signed the context in; another member of the
+same organization approving in the browser changes nothing.
+
+If every command fails with `state_conflict` after about 30 seconds, the lock
 that serializes sign-in renewal is held or was left behind. `topolo auth lock`
 shows its state and the next step; an empty lock left by an interrupted writer
 is recovered with `topolo auth lock --reconcile <generation>`, which keeps the

package/dist/index.js

@@ -308,7 +308,7 @@ import { Command, Help } from "commander";
 import { createInterface } from "readline/promises";
 import { stdin as input } from "process";
 
-// node_modules/.pnpm/@topolo+sdk@0.23.25/node_modules/@topolo/sdk/dist/index.js
+// node_modules/.pnpm/@topolo+sdk@0.23.26/node_modules/@topolo/sdk/dist/index.js
 function record(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -815,6 +815,14 @@ var TopoloRateLimitError = class extends TopoloHttpError {
     this.retryAfterSeconds = topoloRetryAfterSeconds(this.retryAfter);
   }
 };
+var TopoloReauthRequiredError = class extends TopoloAuthError {
+  reauthorization;
+  constructor(message3, reauthorization, options = {}) {
+    super(message3, "reauth_required", { status: 401, service: "auth", path: "/api/developer-oauth/token", ...options });
+    this.name = "TopoloReauthRequiredError";
+    this.reauthorization = Object.freeze({ ...reauthorization });
+  }
+};
 var ACTION_SECRET_PREFIX = "topolo-secret:";
 function isActionSecretReference(value) {
   return typeof value === "string" && value.startsWith(ACTION_SECRET_PREFIX);
@@ -2115,7 +2123,10 @@ var TopoloClient = class _TopoloClient {
     this.refreshInFlight ??= this.refreshCredential().then((credential) => {
       if (credential) this.credential = credential;
       return credential;
-    }).catch(() => null).finally(() => {
+    }).catch((error) => {
+      if (error instanceof TopoloReauthRequiredError) throw error;
+      return null;
+    }).finally(() => {
       this.refreshInFlight = null;
     });
     return this.refreshInFlight;
@@ -3489,6 +3500,19 @@ var TopoloOAuth = class {
     if (params.clientSecret) body.set("client_secret", params.clientSecret);
     return this.#postForm("/api/developer-oauth/token", body);
   }
+  /**
+   * RFC 7009 token revocation. A refresh token is revoked only for the client
+   * it was issued to, so pass that client's id. Auth answers 200 for a token it
+   * does not know, so success means "no longer usable", not "was revoked now".
+   */
+  async revokeToken(params) {
+    const body = new URLSearchParams();
+    body.set("token", params.token);
+    body.set("client_id", params.clientId);
+    if (params.tokenTypeHint) body.set("token_type_hint", params.tokenTypeHint);
+    if (params.clientSecret) body.set("client_secret", params.clientSecret);
+    await this.#postForm("/api/tokens/revoke", body);
+  }
   async #postForm(path, body) {
     const url = new URL(path, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
     const res = await this.fetchImpl(url.toString(), {
@@ -4020,7 +4044,7 @@ async function pollUntilApproved(params) {
 // src/commands/auth-lock.ts
 import { createHash as createHash3 } from "crypto";
 
-// node_modules/.pnpm/@topolo+sdk@0.23.25/node_modules/@topolo/sdk/dist/node/credential-store.js
+// node_modules/.pnpm/@topolo+sdk@0.23.26/node_modules/@topolo/sdk/dist/node/credential-store.js
 import { mkdir as mkdir2, readFile as readFile2, chmod as chmod2, lstat, readdir as readdir2 } from "fs/promises";
 import { existsSync as existsSync2, mkdirSync, lstatSync, readdirSync, readFileSync as readFileSync2, openSync, writeFileSync, fsyncSync, closeSync, renameSync, unlinkSync, rmdirSync, linkSync } from "fs";
 import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
@@ -4354,7 +4378,7 @@ var TopoloRateLimitError2 = class extends TopoloHttpError2 {
     this.retryAfterSeconds = topoloRetryAfterSeconds2(this.retryAfter);
   }
 };
-var TopoloReauthRequiredError = class extends TopoloAuthError2 {
+var TopoloReauthRequiredError2 = class extends TopoloAuthError2 {
   reauthorization;
   constructor(message3, reauthorization, options = {}) {
     super(message3, "reauth_required", { status: 401, service: "auth", path: "/api/developer-oauth/token", ...options });
@@ -4504,6 +4528,19 @@ var TopoloOAuth2 = class {
     if (params.clientSecret) body.set("client_secret", params.clientSecret);
     return this.#postForm("/api/developer-oauth/token", body);
   }
+  /**
+   * RFC 7009 token revocation. A refresh token is revoked only for the client
+   * it was issued to, so pass that client's id. Auth answers 200 for a token it
+   * does not know, so success means "no longer usable", not "was revoked now".
+   */
+  async revokeToken(params) {
+    const body = new URLSearchParams();
+    body.set("token", params.token);
+    body.set("client_id", params.clientId);
+    if (params.tokenTypeHint) body.set("token_type_hint", params.tokenTypeHint);
+    if (params.clientSecret) body.set("client_secret", params.clientSecret);
+    await this.#postForm("/api/tokens/revoke", body);
+  }
   async #postForm(path, body) {
     const url = new URL(path, this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`);
     const res = await this.fetchImpl(url.toString(), {
@@ -4802,11 +4839,15 @@ async function readConfig() {
   if (!existsSync2(path)) return {};
   try {
     const raw = await readFile2(path, "utf8");
-    return JSON.parse(raw);
+    const parsed = JSON.parse(raw);
+    return isConfigObject(parsed) ? parsed : {};
   } catch {
     return {};
   }
 }
+function isConfigObject(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
 async function writeConfig(config) {
   const path = configPath();
   await mkdir2(dirname2(path), { recursive: true });
@@ -4838,10 +4879,21 @@ function retiredEntry(config, refreshToken) {
   const entry = config.retiredRefreshTokens?.[refreshTokenFingerprint(refreshToken)];
   return entry && typeof entry === "object" ? entry : void 0;
 }
-function retire(config, refreshToken, reason) {
+function retire(config, refreshToken, reason, inFlight = false) {
   const now = nowSeconds();
-  const entries = Object.entries({ ...config.retiredRefreshTokens ?? {}, [refreshTokenFingerprint(refreshToken)]: { reason, at: now } }).filter(([key, value]) => /^[a-f0-9]{32}$/.test(key) && value && Number.isFinite(value.at) && value.at > now - RETIRED_RETENTION_SECONDS).sort(([, a], [, b]) => b.at - a.at).slice(0, RETIRED_MAX_ENTRIES);
-  config.retiredRefreshTokens = Object.fromEntries(entries);
+  const entry = inFlight ? { reason, at: now, inFlight: true } : { reason, at: now };
+  const held = new Set(allSlots(config).map(slotRefreshToken).filter((token) => Boolean(token)).map(refreshTokenFingerprint));
+  const valid = Object.entries({ ...config.retiredRefreshTokens ?? {}, [refreshTokenFingerprint(refreshToken)]: entry }).filter(([key, value]) => /^[a-f0-9]{32}$/.test(key) && value && Number.isFinite(value.at));
+  const kept = valid.filter(([key]) => held.has(key));
+  const others = valid.filter(([key, value]) => !held.has(key) && value.at > now - RETIRED_RETENTION_SECONDS).sort(([, a], [, b]) => b.at - a.at).slice(0, Math.max(0, RETIRED_MAX_ENTRIES - kept.length));
+  config.retiredRefreshTokens = Object.fromEntries([...kept, ...others]);
+}
+function clearInFlight(config, refreshToken) {
+  const fingerprint = refreshTokenFingerprint(refreshToken);
+  if (!config.retiredRefreshTokens?.[fingerprint]?.inFlight) return;
+  const { [fingerprint]: _withdrawn, ...rest } = config.retiredRefreshTokens;
+  if (Object.keys(rest).length) config.retiredRefreshTokens = rest;
+  else delete config.retiredRefreshTokens;
 }
 function environmentSlots(config, environment) {
   const slots = [];
@@ -4923,6 +4975,20 @@ function loginCommand(environment, key) {
   const use = environment === "production" ? "topolo context use" : `topolo --env ${environment} context use`;
   return `${base} && ${use} ${key.slice(4)}`;
 }
+function slotUsers(profile, key) {
+  const context = key === DEFAULT_SLOT ? void 0 : profile.contexts?.[key];
+  const credentials = [context?.credential, key === DEFAULT_SLOT || profile.activeContext === key ? profile.credential : void 0];
+  const users = [
+    context?.userId,
+    ...credentials.map((credential) => credential?.kind === "access_token" ? accessTokenSubject(credential.accessToken) : void 0),
+    profile.reauthorization?.[key]?.expectedSubject
+  ];
+  return new Set(users.filter((user) => typeof user === "string" && user.length > 0));
+}
+function mismatchState(entry) {
+  if (!entry.mismatch) return "unavailable";
+  return entry.mismatch.differentUser ? "user_mismatch" : "organization_mismatch";
+}
 function contextLabel(key) {
   return key === DEFAULT_SLOT ? "default" : key;
 }
@@ -4934,6 +5000,8 @@ function reauthRequired(environment, key, entry, state) {
   let action;
   if (state === "awaiting_approval" && pending) {
     action = ` Approve the new sign-in: open ${pending.verificationUriComplete ?? pending.verificationUri} and confirm code ${pending.userCode} (expires ${new Date(pending.expiresAt * 1e3).toISOString()}). The next call resumes once approved.`;
+  } else if (state === "user_mismatch") {
+    action = ` The last approval was by a different user than the one signed in to ${contextLabel(key)}; it was discarded. Approve again as that user, or sign out first to replace this sign-in.`;
   } else if (state === "organization_mismatch") {
     action = ` The last approval was for ${entry?.mismatch?.approvedContext ?? "another context"}, not ${contextLabel(key)}; approve again with that organization selected.`;
   } else if (state === "denied") {
@@ -4941,7 +5009,7 @@ function reauthRequired(environment, key, entry, state) {
   } else {
     action = "";
   }
-  return new TopoloReauthRequiredError(`${head}${action} Or sign in again: ${command} (context ${contextLabel(key)}).`, {
+  return new TopoloReauthRequiredError2(`${head}${action} Or sign in again: ${command} (context ${contextLabel(key)}).`, {
     environment,
     context: contextLabel(key),
     reason,
@@ -5019,18 +5087,94 @@ function writeContextCredential(config, environment, ctx, makeActive = true) {
   }
   return writeProfileConfig(config, environment, next);
 }
-function clearProfileCredential(config, environment) {
-  const next = { ...config };
+function clearEnvironmentSignIn(config, environment) {
+  const next = clone(config);
   if (environment === "production") {
     delete next.credential;
     delete next.oauthClientId;
   }
-  const profiles = { ...config.profiles ?? {} };
-  const profile = { ...profiles[environment] ?? {} };
-  delete profile.credential;
-  delete profile.oauthClientId;
-  profiles[environment] = profile;
-  return { ...next, profiles };
+  const profile = next.profiles?.[environment];
+  if (profile) {
+    delete profile.credential;
+    delete profile.oauthClientId;
+    delete profile.activeContext;
+    delete profile.contexts;
+    delete profile.reauthorization;
+  }
+  return next;
+}
+async function signOut(environment, options = {}) {
+  const result = { environment, contexts: [], revoked: 0, revocationFailed: 0 };
+  if (!existsSync2(configPath())) return result;
+  let grants = [];
+  let profile = {};
+  const collect = (config, found, keys) => {
+    const owner = profileForEnvironment(config, environment);
+    for (const slot of environmentSlots(config, environment)) {
+      const credential = slot.holder.credential;
+      if (!credential) continue;
+      keys?.add(slot.key);
+      if (credential.kind !== "access_token") continue;
+      const clientId = slot.holder.oauthClientId ?? owner.oauthClientId;
+      found.set(credential.accessToken, {
+        accessToken: credential.accessToken,
+        ...credential.refreshToken ? { refreshToken: credential.refreshToken } : {},
+        ...clientId ? { clientId } : {}
+      });
+    }
+  };
+  await withConfigWriteLock(async (_assertOwned, persist) => {
+    let found = /* @__PURE__ */ new Map();
+    await persist((current) => {
+      profile = profileForEnvironment(current, environment);
+      const keys = /* @__PURE__ */ new Set();
+      found = /* @__PURE__ */ new Map();
+      collect(current, found, keys);
+      for (const key of Object.keys(current.profiles?.[environment]?.reauthorization ?? {})) keys.add(key);
+      result.contexts = [...keys].map(contextLabel).sort();
+      return clearEnvironmentSignIn(current, environment);
+    });
+    const directory = dirname2(configPath());
+    for (const name of readdirSync(directory)) {
+      if (!name.startsWith(".credential-write-")) continue;
+      const path = join3(directory, name);
+      try {
+        const entry = lstatSync(path);
+        if (!entry.isFile() || entry.nlink !== 1) continue;
+        try {
+          const leftover = JSON.parse(readFileSync2(path, "utf8"));
+          if (isConfigObject(leftover)) collect(leftover, found);
+        } catch {
+        }
+        unlinkSync(path);
+      } catch {
+      }
+    }
+    grants = [...found.values()];
+  });
+  if (options.revoke === false || !grants.length) return result;
+  let oauth;
+  try {
+    oauth = boundedOAuth(authServiceUrls(profile, environment, "sign-out"));
+  } catch {
+    result.revocationFailed = grants.length;
+    return result;
+  }
+  const outcomes = await Promise.all(grants.map(async (grant) => {
+    try {
+      if (!grant.clientId) return false;
+      if (grant.refreshToken) {
+        await oauth.revokeToken({ clientId: grant.clientId, token: grant.refreshToken, tokenTypeHint: "refresh_token" });
+      }
+      await oauth.revokeToken({ clientId: grant.clientId, token: grant.accessToken, tokenTypeHint: "access_token" });
+      return true;
+    } catch {
+      return false;
+    }
+  }));
+  result.revoked = outcomes.filter(Boolean).length;
+  result.revocationFailed = outcomes.length - result.revoked;
+  return result;
 }
 function credentialSourceFromConfig(config, environment = selectedEnvironment()) {
   const prefix = envVarPrefix(environment);
@@ -5053,8 +5197,8 @@ async function resolveCredential(environment = selectedEnvironment()) {
 }
 var REFRESH_SKEW_SECONDS = 60;
 var CONFIG_LOCK_RETRY_MS = 25;
-var CONFIG_LOCK_DEFAULT_TIMEOUT_MS = 15e3;
-var AUTH_EXCHANGE_TIMEOUT_MS = 1e4;
+var CONFIG_LOCK_DEFAULT_TIMEOUT_MS = 3e4;
+var AUTH_EXCHANGE_TIMEOUT_MS = 2e4;
 function configLockTimeoutMs() {
   const value = Number(process.env.TOPOLO_CONFIG_LOCK_TIMEOUT_MS);
   return Number.isFinite(value) && value >= 1e3 && value <= 12e4 ? value : CONFIG_LOCK_DEFAULT_TIMEOUT_MS;
@@ -5062,6 +5206,8 @@ function configLockTimeoutMs() {
 function boundedOAuth(serviceUrls) {
   const fetchImpl = (input2, init) => globalThis.fetch(input2, {
     ...init,
+    // Never re-POST a refresh token, device code or revoked token to another origin.
+    redirect: "error",
     signal: init?.signal ?? AbortSignal.timeout(AUTH_EXCHANGE_TIMEOUT_MS)
   });
   return new TopoloOAuth2({ serviceUrls, fetch: fetchImpl });
@@ -5349,6 +5495,12 @@ function reclaimDeadOwnerLock(lockPath, markerName, marker) {
   return reclaimed;
 }
 var RELEASE_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
+function unreadableConfig(path) {
+  return new TopoloSdkError2(
+    "config_unreadable",
+    `The Topolo configuration at ${path} is not a valid JSON object, so it was left unchanged. Repair or move it, then retry.`
+  );
+}
 var PERSIST_ATTEMPTS = 3;
 async function withConfigWriteLock(operation) {
   const lockPath = `${configPath()}.lock`;
@@ -5431,11 +5583,14 @@ async function withConfigWriteLock(operation) {
         const before = snapshot();
         let current = {};
         if (before !== null) {
+          let parsed = {};
           try {
-            current = JSON.parse(before);
-          } catch (error) {
-            if (!options.allowCreate) throw error;
+            if (before.trim()) parsed = JSON.parse(before);
+          } catch {
+            throw unreadableConfig(path);
           }
+          if (!isConfigObject(parsed)) throw unreadableConfig(path);
+          current = parsed;
         }
         const updated = update(current);
         const fd = openSync(temporary, "wx", 384);
@@ -5517,7 +5672,8 @@ async function withConfigWriteLock(operation) {
 function renewalFailure(error) {
   const path = "/api/developer-oauth/token";
   if (error instanceof ConfigOwnershipError) return new ConfigOwnershipError();
-  if (error instanceof TopoloReauthRequiredError) return error;
+  if (error instanceof TopoloReauthRequiredError2) return error;
+  if (error instanceof TopoloSdkError2 && error.code === "config_unreadable") return error;
   if ((error instanceof TopoloAuthError2 || error instanceof TopoloHttpError2) && error.status === 429) {
     const message3 = "Topolo sign-in renewal is temporarily rate limited by Auth. Retry after the Retry-After interval; the saved sign-in has been retained.";
     return new TopoloRateLimitError2(
@@ -5593,6 +5749,35 @@ function singleFlight(key, run) {
   renewalsInFlight.set(key, started);
   return started;
 }
+var GATEWAY_STATUSES = /* @__PURE__ */ new Set([502, 504, 520, 521, 522, 523, 524, 525, 526, 527, 530]);
+var NOT_SENT_CODES = /* @__PURE__ */ new Set([
+  "ENOTFOUND",
+  "EAI_AGAIN",
+  "EAI_NONAME",
+  "ECONNREFUSED",
+  "ENETUNREACH",
+  "EHOSTUNREACH",
+  "EADDRNOTAVAIL",
+  "UND_ERR_CONNECT_TIMEOUT",
+  "CERT_HAS_EXPIRED",
+  "DEPTH_ZERO_SELF_SIGNED_CERT",
+  "SELF_SIGNED_CERT_IN_CHAIN",
+  "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+  "ERR_TLS_CERT_ALTNAME_INVALID"
+]);
+function answeredWithoutRotation(error) {
+  if (error instanceof TopoloAuthError2 || error instanceof TopoloHttpError2) return !GATEWAY_STATUSES.has(Number(error.status));
+  for (let cause = error, depth = 0; cause && depth < 4; cause = cause.cause, depth += 1) {
+    const code = cause.code;
+    if (typeof code === "string" && NOT_SENT_CODES.has(code)) return true;
+  }
+  return false;
+}
+function usableTokenResponse(tokens) {
+  if (!tokens || typeof tokens !== "object") return false;
+  const value = tokens;
+  return typeof value.access_token === "string" && value.access_token.length > 0 && typeof value.expires_in === "number" && Number.isFinite(value.expires_in) && (value.refresh_token === void 0 || typeof value.refresh_token === "string" && value.refresh_token.length > 0);
+}
 async function renewTarget(environment, target, options) {
   const observedProfile = profileForEnvironment(await readConfig(), environment);
   const observedTarget = resolveTarget(observedProfile, target);
@@ -5614,6 +5799,7 @@ async function renewTarget(environment, target, options) {
       if (options.force && observed.kind === "access_token" && observed.accessToken !== credential.accessToken && credential.expiresAt !== void 0 && credential.expiresAt > now) return { credential };
       if (!options.force && credential.expiresAt && credential.expiresAt - REFRESH_SKEW_SECONDS > now) return { credential };
       const sent = credential.refreshToken;
+      const subject = accessTokenSubject(credential.accessToken) ?? resolved.context?.userId;
       const endGrant = async (reason) => {
         await persist((current) => {
           const next = clone(current);
@@ -5621,35 +5807,67 @@ async function renewTarget(environment, target, options) {
           touched.add(resolved.key);
           retire(next, sent, reason);
           for (const key of touched) {
-            setReauthorization(next, environment, key, (existing) => ({ ...existing, reason, since: existing?.since ?? nowSeconds() }));
+            setReauthorization(next, environment, key, (existing) => ({
+              ...subject ? { expectedSubject: subject } : {},
+              ...existing,
+              reason,
+              since: existing?.since ?? nowSeconds()
+            }));
           }
           return next;
         });
         return { reauthorize: resolved.key };
       };
+      const outcomeUnknown = async () => {
+        if (!options.force && credential.expiresAt && credential.expiresAt > nowSeconds()) return { credential };
+        return endGrant("rotated_grant_lost");
+      };
       const retired = retiredEntry(config, sent);
       if (retired) {
         return endGrant(retired.reason === "rotated" ? "rotated_grant_lost" : retired.reason);
       }
       const serviceUrls = authServiceUrls(profile, environment, target.kind === "active" ? "credential refresh" : "context refresh");
+      const oauth = boundedOAuth(serviceUrls);
+      try {
+        await persist((current) => {
+          const next = clone(current);
+          retire(next, sent, "rotated", true);
+          return next;
+        });
+      } catch (error) {
+        throw error instanceof TopoloSdkError2 ? renewalFailure(error) : new TopoloSdkError2("config_write_failed", "The Topolo configuration could not be updated, so the sign-in was not renewed. Nothing was sent to Auth; the saved sign-in has been retained.");
+      }
       let tokens;
       try {
-        tokens = await boundedOAuth(serviceUrls).refreshToken({ clientId: resolved.oauthClientId, refreshToken: sent });
+        tokens = await oauth.refreshToken({ clientId: resolved.oauthClientId, refreshToken: sent });
       } catch (error) {
         if (isTerminalRefusal(error)) return endGrant(error.code);
+        if (!answeredWithoutRotation(error)) return outcomeUnknown();
+        try {
+          await persist((current) => {
+            const next = clone(current);
+            clearInFlight(next, sent);
+            return next;
+          });
+        } catch (persistError) {
+          throw renewalFailure(persistError);
+        }
         throw renewalFailure(error);
       }
+      if (!usableTokenResponse(tokens)) return outcomeUnknown();
+      const issued = tokens;
       const refreshed = {
         kind: "access_token",
-        accessToken: tokens.access_token,
-        refreshToken: tokens.refresh_token ?? sent,
-        expiresAt: nowSeconds() + tokens.expires_in
+        accessToken: issued.access_token,
+        refreshToken: issued.refresh_token ?? sent,
+        expiresAt: nowSeconds() + issued.expires_in
       };
       try {
         await persist((current) => {
           const next = clone(current);
           replaceGrant(next, environment, sent, refreshed);
-          if (tokens.refresh_token && tokens.refresh_token !== sent) retire(next, sent, "rotated");
+          if (issued.refresh_token && issued.refresh_token !== sent) retire(next, sent, "rotated");
+          else clearInFlight(next, sent);
           return next;
         });
       } catch (error) {
@@ -5669,17 +5887,30 @@ async function refreshCredentialIfNeeded(environment = selectedEnvironment(), op
 async function refreshContextCredentialIfNeeded(environment, key, options = {}) {
   return renewTarget(environment, { kind: "context", key }, options);
 }
-function decodeTokenOrganization(accessToken) {
+function accessTokenClaims(accessToken) {
   try {
-    const payload = accessToken.split(".")[1];
-    if (!payload) return { known: false, organizationId: null };
+    const payload = accessToken?.split(".")[1];
+    if (!payload) return null;
     const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-    const org = claims.orgId ?? claims.organizationId ?? claims.org_id ?? null;
-    return { known: true, organizationId: typeof org === "string" && org ? org : null };
+    return claims && typeof claims === "object" && !Array.isArray(claims) ? claims : null;
   } catch {
-    return { known: false, organizationId: null };
+    return null;
   }
 }
+function accessTokenSubject(accessToken) {
+  const sub = accessTokenClaims(accessToken)?.sub;
+  return typeof sub === "string" && sub ? sub : void 0;
+}
+function accessTokenExpiry(accessToken) {
+  const exp = accessTokenClaims(accessToken)?.exp;
+  return typeof exp === "number" && Number.isSafeInteger(exp) && exp > 0 ? exp : void 0;
+}
+function decodeTokenOrganization(accessToken) {
+  const claims = accessTokenClaims(accessToken);
+  if (!claims) return { known: false, organizationId: null };
+  const org = claims.orgId ?? claims.organizationId ?? claims.org_id ?? null;
+  return { known: true, organizationId: typeof org === "string" && org ? org : null };
+}
 async function continueReauthorization(environment, key) {
   return withConfigWriteLock(async (_assertOwned, persist) => {
     const config = await readConfig();
@@ -5736,7 +5967,21 @@ async function continueReauthorization(environment, key) {
         };
         const organization = decodeTokenOrganization(tokens.access_token);
         const approvedKey = organization.known ? organization.organizationId ? `org:${organization.organizationId}` : "personal" : null;
+        const approvedSubject = accessTokenSubject(tokens.access_token);
         const matches = key === DEFAULT_SLOT || approvedKey === key;
+        const destination = matches ? key : approvedKey;
+        const destinationUsers = destination ? slotUsers(profile, destination) : /* @__PURE__ */ new Set();
+        if (state.expectedSubject) destinationUsers.add(state.expectedSubject);
+        if ([...destinationUsers].some((user) => user !== approvedSubject)) {
+          const updated = {
+            ...state,
+            mismatch: { approvedContext: "a different user", at: nowSeconds(), differentUser: true }
+          };
+          delete updated.pending;
+          await save(() => updated);
+          throw reauthRequired(environment, key, updated, "user_mismatch");
+        }
+        const signedInAs = approvedSubject ? { userId: approvedSubject } : {};
         await persist((current) => {
           const next = clone(current);
           const nextProfile = (next.profiles ??= {})[environment] ??= {};
@@ -5750,7 +5995,8 @@ async function continueReauthorization(environment, key) {
               nextProfile.contexts = { ...nextProfile.contexts ?? {}, [key]: {
                 ...existing ?? (key.startsWith("org:") ? { contextType: "organization", organizationId: key.slice(4) } : { contextType: "personal" }),
                 credential: approved,
-                oauthClientId: clientId
+                oauthClientId: clientId,
+                ...signedInAs
               } };
               if (nextProfile.activeContext === key) nextProfile.credential = approved;
             }
@@ -5761,7 +6007,8 @@ async function continueReauthorization(environment, key) {
               nextProfile.contexts = { ...nextProfile.contexts ?? {}, [approvedKey]: {
                 ...existing ?? (approvedKey.startsWith("org:") ? { contextType: "organization", organizationId: approvedKey.slice(4) } : { contextType: "personal" }),
                 credential: approved,
-                oauthClientId: clientId
+                oauthClientId: clientId,
+                ...signedInAs
               } };
               if (nextProfile.activeContext === approvedKey) nextProfile.credential = approved;
             }
@@ -5785,7 +6032,7 @@ async function continueReauthorization(environment, key) {
       throw reauthRequired(environment, key, state, pending.denied ? "denied" : "awaiting_approval");
     }
     if (state.startRetryAt && state.startRetryAt > now) {
-      throw reauthRequired(environment, key, state, state.mismatch ? "organization_mismatch" : "unavailable");
+      throw reauthRequired(environment, key, state, mismatchState(state));
     }
     try {
       const started = await oauth.requestDeviceCode({ clientId });
@@ -5806,7 +6053,7 @@ async function continueReauthorization(environment, key) {
       await save(() => state);
       throw reauthRequired(environment, key, state, "awaiting_approval");
     } catch (error) {
-      if (error instanceof TopoloReauthRequiredError || error instanceof ConfigOwnershipError) throw error;
+      if (error instanceof TopoloReauthRequiredError2 || error instanceof ConfigOwnershipError) throw error;
       const retryAfter = Number(error.retryAfter);
       state = { ...state, startRetryAt: now + Math.max(30, Number.isFinite(retryAfter) ? retryAfter : 0) };
       delete state.pending;
@@ -5824,7 +6071,7 @@ async function awaitReauthorization(environment, key, options = {}) {
     try {
       return await continueReauthorization(environment, slotKey);
     } catch (error) {
-      if (!(error instanceof TopoloReauthRequiredError)) throw error;
+      if (!(error instanceof TopoloReauthRequiredError2)) throw error;
       const prompt = error.reauthorization;
       if (prompt.userCode !== lastCode) {
         lastCode = prompt.userCode;
@@ -6171,6 +6418,7 @@ function commandContextKey(config, environment, explicit = process.env.TOPOLO_CO
 }
 function implicitContextKey(config, environment) {
   if (credentialSourceFromConfig(config, environment).startsWith("env:")) return null;
+  if (profileForEnvironment(config, environment).credential?.kind === "api_key") return null;
   const keys = signedInContextKeys(config, environment);
   if (keys.length > 1) throw new ContextNotSafeToAssumeError(environment, keys);
   return keys[0] ?? null;
@@ -6262,16 +6510,37 @@ Visit ${apiKeyIssuanceUrl(environment)} to mint one, or configure an OAuth clien
       }
     }
   );
-  auth.command("logout").description("Remove stored credentials from this machine").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (opts) => {
+  auth.command("logout").description("Remove every stored sign-in for this environment and revoke it at Topolo").option("--json", "Output JSON").option("--no-json", "Output human-readable text").addHelpText("after", [
+    "",
+    "Removes the stored credential, every personal and organization context and any",
+    "pending re-authorization for the selected environment, then revokes each removed",
+    "OAuth sign-in at Topolo. Stored API keys are only removed from this machine.",
+    "TOPOLO_* credential environment variables are not affected."
+  ].join("\n")).action(async (opts) => {
     const mode = resolveOutputMode(opts.json);
     const environment = selectedEnvironment();
     try {
-      const config = await readConfig();
-      await writeConfig(clearProfileCredential(config, environment));
+      const result = await signOut(environment);
+      const source = credentialSourceFromConfig(await readConfig(), environment);
+      const environmentCredential = source.startsWith("env:") ? source.slice(4) : null;
+      if (result.revocationFailed > 0) process.exitCode = 1;
       emit(
-        { ok: true, environment },
+        {
+          ok: result.revocationFailed === 0,
+          removedLocally: true,
+          environment,
+          removed: result.contexts,
+          revoked: result.revoked,
+          revocationFailed: result.revocationFailed,
+          ...environmentCredential ? { environmentCredential } : {}
+        },
         mode,
-        () => `Logged out of Topolo ${environmentLabel(environment)}.`
+        () => [
+          result.contexts.length ? `Logged out of Topolo ${environmentLabel(environment)}: removed ${result.contexts.join(", ")}.` : `No stored sign-in for Topolo ${environmentLabel(environment)}.`,
+          ...result.revoked ? [`Revoked ${result.revoked} sign-in${result.revoked === 1 ? "" : "s"} at Topolo.`] : [],
+          ...result.revocationFailed ? [`Could not confirm revocation of ${result.revocationFailed} sign-in${result.revocationFailed === 1 ? "" : "s"} at Topolo; they are removed from this machine and expire on their own. Revoke them from your Topolo account to end them now.`] : [],
+          ...environmentCredential ? [`${environmentCredential} is still set, so commands keep using it until you unset it.`] : []
+        ].join("\n")
       );
     } catch (err) {
       fail2(err, mode);
@@ -6307,13 +6576,23 @@ Visit ${apiKeyIssuanceUrl(environment)} to mint one, or configure an OAuth clien
 async function storeApiKey(apiKey, environment, mode) {
   if (!apiKey) throw new Error("API key is required");
   const config = await readConfig();
-  await writeConfig(
-    writeProfileConfig(config, environment, {
-      credential: { kind: "api_key", apiKey }
-    })
-  );
+  const next = writeProfileConfig(config, environment, {
+    credential: { kind: "api_key", apiKey }
+  });
+  const profile = next.profiles?.[environment];
+  if (profile) delete profile.activeContext;
+  await writeConfig(next);
+  const overriddenBy = [];
+  const source = credentialSourceFromConfig(next, environment);
+  if (source.startsWith("env:")) overriddenBy.push(source.slice(4));
+  const pinned = process.env.TOPOLO_CONTEXT?.trim();
+  if (pinned) overriddenBy.push(`TOPOLO_CONTEXT=${pinned}`);
+  for (const name of overriddenBy) {
+    process.stderr.write(`Warning: ${name} is set, so commands use it instead of the stored API key until you unset it.
+`);
+  }
   emit(
-    { ok: true, environment, credential: { kind: "api_key" } },
+    { ok: true, environment, credential: { kind: "api_key" }, ...overriddenBy.length ? { overriddenBy } : {} },
     mode,
     () => `Stored API key for Topolo ${environmentLabel(environment)}. Run \`topolo whoami\` to verify.`
   );
@@ -6322,6 +6601,7 @@ async function runDeviceFlow(options) {
   const config = await readConfig();
   const resolved = resolvedProfileConfig(config, options.environment);
   const oauth = new TopoloOAuth({
+    environment: options.environment,
     serviceUrls: resolved.serviceUrls
   });
   const start = await oauth.requestDeviceCode({
@@ -6379,7 +6659,32 @@ async function runDeviceFlow(options) {
     options.environment
   );
   const approvedKey = contextKey(context.contextType, context.organizationId);
+  const approvedUser = identity?.user.id || accessTokenSubject(credential.accessToken);
+  if (approvedUser) context.userId = approvedUser;
   const updated = await readConfig();
+  const storedUser = contextUser(updated, options.environment, approvedKey);
+  if (storedUser && storedUser !== approvedUser) {
+    const who2 = identity ? identity.user.email : "an identity that could not be verified";
+    process.stderr.write(
+      `
+  \u26A0 The browser approved ${who2}, but ${approvedKey} on this machine belongs to a different user.
+    Nothing was stored. Approve as that user, or run \`topolo --env ${options.environment} auth logout\` first to replace it.
+`
+    );
+    process.exitCode = 1;
+    emit(
+      {
+        ok: false,
+        environment: options.environment,
+        error: "user_mismatch",
+        approved: { contextKey: approvedKey, user: identity ? { email: identity.user.email, name: identity.user.name } : null },
+        ...options.requestedContext ? { requestedContext: options.requestedContext, requestedContextRenewed: false } : {}
+      },
+      options.mode,
+      () => `  ${approvedKey} was not changed.`
+    );
+    return;
+  }
   const previousDefault = profileDefault(updated, options.environment);
   const makeDefault = options.makeDefault === true || signedInContextKeys(updated, options.environment).length === 0;
   await writeConfig(writeContextCredential(updated, options.environment, context, makeDefault));
@@ -6427,6 +6732,12 @@ async function runDeviceFlow(options) {
     ].join("\n")
   );
 }
+function contextUser(config, environment, key) {
+  const profile = config.profiles?.[environment];
+  const stored = profile?.contexts?.[key];
+  const credential = stored?.credential;
+  return stored?.userId ?? (credential?.kind === "access_token" ? accessTokenSubject(credential.accessToken) : void 0) ?? profile?.reauthorization?.[key]?.expectedSubject;
+}
 function profileDefault(config, environment) {
   return config.profiles?.[environment]?.activeContext;
 }
@@ -9820,8 +10131,9 @@ function errorMessage(error) {
 }
 
 // src/commands/context.ts
-function makeClient(credential, serviceUrls) {
+function makeClient(environment, credential, serviceUrls) {
   return createTopolo({
+    environment,
     credential,
     agent: { clientName: "topolo-cli", clientVersion: CLI_VERSION },
     serviceUrls
@@ -9831,8 +10143,8 @@ function unwrap(res) {
   const r = res ?? {};
   return r.data ?? r;
 }
-async function fetchMe(credential, serviceUrls) {
-  const topolo = makeClient(credential, serviceUrls);
+async function fetchMe(environment, credential, serviceUrls) {
+  const topolo = makeClient(environment, credential, serviceUrls);
   const data = unwrap(await topolo.client.request({ service: "auth", method: "GET", path: "/api/auth/me" }));
   const user = data.user ?? {};
   const rawMemberships = user.organizationMemberships || data.organizations || [];
@@ -9851,16 +10163,16 @@ function credentialFromTokens(tokens) {
   const accessToken = tokens.accessToken || tokens.access_token;
   const refreshToken = tokens.refreshToken || tokens.refresh_token;
   const expiresIn = tokens.expiresIn || tokens.expires_in;
-  const expiresAtRaw = tokens.expiresAt || tokens.expires_at;
+  const expiresAt = (tokens.expiresAt || tokens.expires_at) ?? (expiresIn ? Math.floor(Date.now() / 1e3) + expiresIn : accessTokenExpiry(accessToken));
   return {
     kind: "access_token",
     accessToken,
     ...refreshToken ? { refreshToken } : {},
-    ...expiresAtRaw ? { expiresAt: expiresAtRaw } : expiresIn ? { expiresAt: Math.floor(Date.now() / 1e3) + expiresIn } : {}
+    ...expiresAt ? { expiresAt } : {}
   };
 }
-async function exchangeForContext(credential, serviceUrls, target) {
-  const topolo = makeClient(credential, serviceUrls);
+async function exchangeForContext(environment, credential, serviceUrls, target) {
+  const topolo = makeClient(environment, credential, serviceUrls);
   const data = unwrap(
     await topolo.client.request({
       service: "auth",
@@ -9919,7 +10231,7 @@ function registerContextCommand(program2) {
       let activeIdentity = null;
       if (cred) {
         try {
-          activeIdentity = await fetchMe(cred, serviceUrls);
+          activeIdentity = await fetchMe(environment, cred, serviceUrls);
         } catch {
           activeIdentity = null;
         }
@@ -9928,7 +10240,7 @@ function registerContextCommand(program2) {
         try {
           const contextCredential = key === activeKey ? cred : await refreshContextCredentialIfNeeded(environment, key);
           if (!contextCredential) return;
-          const identity = key === activeKey && activeIdentity ? activeIdentity : await fetchMe(contextCredential, serviceUrls);
+          const identity = key === activeKey && activeIdentity ? activeIdentity : await fetchMe(environment, contextCredential, serviceUrls);
           if (!identityMatchesContext(identity, ctx)) return;
           const row = rows.get(key) ?? {
             key,
@@ -10024,7 +10336,7 @@ function registerContextCommand(program2) {
       } else if (wantPersonal) {
         resolved = { contextType: "personal" };
       } else {
-        const me = await fetchMe(cred, serviceUrls);
+        const me = await fetchMe(environment, cred, serviceUrls);
         const match = me.memberships.find(
           (m) => m.id === target || m.slug?.toLowerCase() === needle || m.name?.toLowerCase() === needle
         );
@@ -10049,7 +10361,7 @@ function registerContextCommand(program2) {
         const storedCredential = await refreshContextCredentialIfNeeded(environment, key);
         if (storedCredential) {
           try {
-            const storedIdentity = await fetchMe(storedCredential, serviceUrls);
+            const storedIdentity = await fetchMe(environment, storedCredential, serviceUrls);
             if (identityMatchesContext(storedIdentity, resolved)) {
               newCredential = storedCredential;
             }
@@ -10059,13 +10371,13 @@ function registerContextCommand(program2) {
       }
       if (!newCredential) {
         if (resolved.contextType === "personal") {
-          const identity = await fetchMe(cred, serviceUrls);
+          const identity = await fetchMe(environment, cred, serviceUrls);
           if (!identity.personalAvailable) {
             throw new Error("Personal context is not available for this account.");
           }
         }
         try {
-          newCredential = await exchangeForContext(cred, serviceUrls, {
+          newCredential = await exchangeForContext(environment, cred, serviceUrls, {
             type: resolved.contextType,
             id: resolved.organizationId
           });
@@ -10078,7 +10390,7 @@ function registerContextCommand(program2) {
             );
           }
           cred = refreshed;
-          newCredential = await exchangeForContext(cred, serviceUrls, {
+          newCredential = await exchangeForContext(environment, cred, serviceUrls, {
             type: resolved.contextType,
             id: resolved.organizationId
           });
@@ -10086,6 +10398,8 @@ function registerContextCommand(program2) {
       }
       resolved.credential = newCredential;
       resolved.oauthClientId = existing?.oauthClientId ?? profile.oauthClientId;
+      const userId = accessTokenSubject(newCredential.accessToken);
+      if (userId) resolved.userId = userId;
       const updated = writeContextCredential(await readConfig(), environment, resolved, true);
       await writeConfig(updated);
       emit(

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@topolo/cli",
   "packageManager": "pnpm@10.17.1",
-  "version": "0.13.23",
-  "topoloPublishedVersion": "0.13.23",
+  "version": "0.13.25",
+  "topoloPublishedVersion": "0.13.25",
   "description": "Public command-line interface for Topolo customer organizations, developers, and agents.",
   "license": "UNLICENSED",
   "author": "Topolo",
@@ -33,8 +33,8 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.31.0",
-    "@topolo/mcp": "0.14.36",
-    "@topolo/sdk": "0.23.25",
+    "@topolo/mcp": "0.14.37",
+    "@topolo/sdk": "0.23.26",
     "commander": "^12.1.0",
     "undici": "6.29.0"
   },