@vigilbase/cli 0.2.3 → 0.2.5

package/dist/auth/refresh.js

@@ -4,9 +4,10 @@ import { open, rm, lstat } from 'node:fs/promises';
 import { dirname } from 'node:path';
 import { z } from 'zod';
 import { DEFAULT_TIMEOUT_MS, validateOneOrigin } from '../lib/config.js';
-import { requestText, parseJsonResponse } from '../lib/network.js';
-import { assertFile, checkDirectory, credentialsPath, readCredentials, readLockedCredentials, readStoredCredentials, writeOneCredentials, clearOneCredentials, clearIdentityCredentials, DEFAULT_ONE_ORIGIN, UNCERTAIN_REFRESH } from './store.js';
+import { requestText, parseJsonResponse, NetworkError } from '../lib/network.js';
+import { assertFile, checkDirectory, credentialsPath, readCredentials, readLockedCredentials, readStoredCredentials, writeOneCredentials, clearOneCredentials, clearIdentityCredentials, shellQuote, DEFAULT_ONE_ORIGIN, SignInEndedError, UNCERTAIN_REFRESH } from './store.js';
 import { identityProvider, validateIdentityIssuer } from './provider.js';
+import { stripAcl } from './acl.js';
 export function boundIdentityCredentials(config, one) {
     try {
         return one.clientId === config.clientId && one.resource === validateOneOrigin(config.oneBaseUrl) && one.oneBaseUrl === one.resource && validateIdentityIssuer(one.issuer, config) === one.issuer;
@@ -21,14 +22,51 @@ export function credentialsLockWaitMs(timeoutMs) {
     const requested = typeof timeoutMs === 'number' && Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : DEFAULT_TIMEOUT_MS;
     return Math.min(requested, MAX_LOCK_WAIT_MS);
 }
-/** Another command holds credentials.json.lock. */
+/** credentials.json.lock is held: by a running command, by one that was interrupted, or it is damaged. */
 export class CredentialsLockedError extends Error {
-    constructor() { super('Credentials are locked by another command. A crashed refresh requires a new login; do not reuse its refresh token.'); this.name = 'CredentialsLockedError'; }
+    constructor(message) { super(message); this.name = 'CredentialsLockedError'; }
+}
+/** An empty or unparseable lock this old is not one a command is still writing; login and logout replace it. */
+const DAMAGED_LOCK_AGE_MS = 30_000;
+function isMissing(error) { return error instanceof Error && 'code' in error && error.code === 'ENOENT'; }
+/** Who holds the lock, or null when it was released in between. `pid` is null for an empty or unparseable lock. */
+async function readLockOwner(path) {
+    let info, handle;
+    try {
+        info = await lstat(path);
+        assertFile(info, path);
+        handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    }
+    catch (error) {
+        if (isMissing(error))
+            return null;
+        throw error;
+    }
+    let owner = '';
+    try {
+        assertFile(await handle.stat(), path);
+        owner = await handle.readFile('utf8');
+    }
+    finally {
+        await handle.close();
+    }
+    if (!/^\s*\d+\s*$/.test(owner) || !Number.isSafeInteger(Number(owner)) || Number(owner) <= 0)
+        return { info, pid: null, isDead: false };
+    const pid = Number(owner);
+    let isDead = false;
+    try {
+        process.kill(pid, 0);
+    }
+    catch (error) {
+        isDead = error instanceof Error && 'code' in error && error.code === 'ESRCH';
+    }
+    return { info, pid, isDead };
 }
 /**
  * credentials.json.lock guards both credentials files; CLI 0.2.0 takes the same lock.
- * Never steal a stale lock: a crashed refresh may have consumed the rotating token.
- * With `wait` false, a held lock fails at once instead of after the lock wait.
+ * Only login and logout (`replaceDeadLock`) replace a lock whose owner has exited, or an old damaged one: a crashed
+ * refresh may have consumed the rotating token, and both start over without it. Other commands fail at once on a
+ * dead owner. With `wait` false, a held lock fails at once instead of after the lock wait.
  */
 export async function withCredentialsLock(config, callback, replaceDeadLock = false, wait = true) {
     const path = `${credentialsPath(config)}.lock`;
@@ -43,42 +81,29 @@ export async function withCredentialsLock(config, callback, replaceDeadLock = fa
         catch (error) {
             if (!(error instanceof Error && 'code' in error && error.code === 'EEXIST'))
                 throw error;
-            const existing = await lstat(path);
-            assertFile(existing, path);
-            if (replaceDeadLock) {
-                const existingHandle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
-                let owner = '';
-                try {
-                    assertFile(await existingHandle.stat(), path);
-                    owner = await existingHandle.readFile('utf8');
-                }
-                finally {
-                    await existingHandle.close();
-                }
-                const pid = Number(owner);
-                let dead = false;
-                if (Number.isSafeInteger(pid) && pid > 0) {
-                    try {
-                        process.kill(pid, 0);
-                    }
-                    catch (error) {
-                        dead = error instanceof Error && 'code' in error && error.code === 'ESRCH';
-                    }
-                }
-                if (dead) {
-                    const current = await lstat(path);
-                    if (current.ino === existing.ino && current.dev === existing.dev) {
-                        await rm(path);
-                        continue;
-                    }
-                }
+            const owner = await readLockOwner(path);
+            if (!owner)
+                continue;
+            const isOldDamaged = owner.pid === null && Date.now() - owner.info.mtimeMs > DAMAGED_LOCK_AGE_MS;
+            if (replaceDeadLock && (owner.isDead || isOldDamaged)) {
+                const current = await lstat(path).catch(() => null);
+                if (current?.ino === owner.info.ino && current.dev === owner.info.dev)
+                    await rm(path);
+                continue;
+            }
+            if (owner.isDead)
+                throw new CredentialsLockedError(`A previous vigilbase command was interrupted while it held ${shellQuote(path)}. Run \`vigilbase login\` to recover.`);
+            if (!wait || Date.now() >= deadline) {
+                throw new CredentialsLockedError(owner.pid === null
+                    ? `${path} is damaged. Stop every vigilbase command, delete it, and run \`vigilbase login\`.`
+                    : `Credentials are locked by another vigilbase command (process ${owner.pid}). If none is running, delete ${shellQuote(path)} and run \`vigilbase login\`.`);
             }
-            if (!wait || Date.now() >= deadline)
-                throw new CredentialsLockedError();
             await new Promise(resolve => setTimeout(resolve, 100));
         }
     }
     await handle.chmod(0o600);
+    // Best effort: the lock holds only a PID, and a failure here must not leave it behind.
+    await stripAcl(path).catch(() => { });
     const info = await handle.stat();
     assertFile(info, path);
     try {
@@ -117,11 +142,24 @@ export async function managedAccessToken(config, failedToken) {
             throw new Error(UNCERTAIN_REFRESH);
         const provider = await identityProvider(config, one.issuer);
         await writeOneCredentials(config, { ...one, refreshPending: true });
-        const { response, text } = await requestText(config, provider.tokenEndpoint, { method: 'POST', headers: { Accept: 'application/json', 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': config.userAgent }, body: new URLSearchParams({ grant_type: 'refresh_token', refresh_token: one.refreshToken, client_id: one.clientId, resource: one.resource }) });
+        let response, text;
+        try {
+            ({ response, text } = await requestText(config, provider.tokenEndpoint, { option: '--auth-url', method: 'POST', headers: { Accept: 'application/json', 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': config.userAgent }, body: new URLSearchParams({ grant_type: 'refresh_token', refresh_token: one.refreshToken, client_id: one.clientId, resource: one.resource }) }));
+        }
+        catch (error) {
+            // The request may have reached Identity and rotated the token, so it stays pending and can't be retried.
+            const reason = error instanceof NetworkError ? ` (${error.message.split(/\.(?:\s|$)/)[0]})` : '';
+            throw new Error(`The Identity refresh may not have completed${reason}. Run \`vigilbase login\` again; its token cannot be retried safely.`, { cause: error });
+        }
         const body = parseJsonResponse(response, text);
         if (!response.ok) {
-            if (z.object({ error: z.literal('invalid_grant') }).safeParse(body).success)
+            if (z.object({ error: z.literal('invalid_grant') }).safeParse(body).success) {
                 await clearIdentityCredentials(config);
+                throw new SignInEndedError();
+            }
+            // A definite client error means the token was not used. A server error may come after it rotated.
+            if (response.status < 500)
+                await writeOneCredentials(config, { ...one, refreshPending: false });
             throw new Error('Identity refresh failed. Run `vigilbase login` again.');
         }
         const token = z.object({ access_token: z.string().min(1), refresh_token: z.string().min(1), expires_in: z.number().int().positive().max(300), scope: z.string().optional() }).safeParse(body);
@@ -144,7 +182,7 @@ export async function revokeIdentityGrant(config, one) {
     if (!boundIdentityCredentials(config, one))
         throw new Error(SAVED_FOR_OTHER_CONFIGURATION);
     const provider = await identityProvider(config, one.issuer);
-    const { response, text } = await requestText(config, provider.revocationEndpoint, { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': config.userAgent }, body: new URLSearchParams({ token: one.refreshToken, token_type_hint: 'refresh_token', client_id: one.clientId }) });
+    const { response, text } = await requestText(config, provider.revocationEndpoint, { option: '--auth-url', method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': config.userAgent }, body: new URLSearchParams({ token: one.refreshToken, token_type_hint: 'refresh_token', client_id: one.clientId }) });
     if (response.ok)
         return;
     if (response.status === 400 && z.object({ error: z.enum(['invalid_request', 'invalid_grant']) }).safeParse(parseJsonResponse(response, text)).success)
@@ -172,12 +210,15 @@ export async function revokeIdentityCredentials(config) {
 /** Best effort: legacy One auth retires on 2026-10-31, and its session expires on its own. */
 async function signOutLegacySession(config, one) {
     const origin = validateOneOrigin(one.oneBaseUrl ?? DEFAULT_ONE_ORIGIN);
-    const { response } = await requestText(config, `${origin}/api/auth/sign-out`, { method: 'POST', headers: { Accept: 'application/json', Authorization: `Bearer ${one.accessToken}`, 'User-Agent': config.userAgent }, redirect: 'manual', credentials: 'omit' });
+    const { response } = await requestText(config, `${origin}/api/auth/sign-out`, { option: '--one-url', method: 'POST', headers: { Accept: 'application/json', Authorization: `Bearer ${one.accessToken}`, 'User-Agent': config.userAgent }, redirect: 'manual', credentials: 'omit' });
     if (!response.ok)
         throw new Error('Legacy One sign-out failed.');
 }
 /** Revoke and remove every credentials file. A failed Identity revocation keeps them all. */
 export async function revokeSavedCredentials(config, onWarning) {
+    // Nothing is saved without a credentials directory; don't create one to take the lock.
+    if (!await checkDirectory(dirname(credentialsPath(config))))
+        return false;
     return withCredentialsLock(config, async () => {
         // A safe file that cannot be parsed cannot be revoked either; removing it keeps logout from dead-ending.
         const unreadable = [];

package/dist/auth/store.d.ts

@@ -33,6 +33,18 @@ export declare function identityCredentialsPath(config: Pick<CliConfig, 'configD
 export declare class InvalidCredentialsError extends Error {
     constructor(message: string);
 }
+/** A command that needs One found no usable sign-in. */
+export declare class NotSignedInError extends Error {
+    readonly code = "NOT_SIGNED_IN";
+    constructor();
+}
+/** Identity answered a refresh with invalid_grant: the grant is gone and identity-credentials.json was removed. */
+export declare class SignInEndedError extends Error {
+    readonly code = "SIGN_IN_ENDED";
+    constructor();
+}
+/** A path as one shell word for a remedy: as is when plain, otherwise in single quotes. */
+export declare function shellQuote(path: string): string;
 /** Credentials cannot be protected by modes and owners on Windows yet. */
 export declare class SignInUnsupportedError extends Error {
     readonly code = "SIGN_IN_UNSUPPORTED";
@@ -85,6 +97,14 @@ export declare function clearOneCredentials(config: Pick<CliConfig, 'configDir'>
 /** Remove identity-credentials.json only; credentials.json stays for CLI 0.1.x. */
 export declare function clearIdentityCredentials(config: Pick<CliConfig, 'configDir'>): Promise<boolean>;
 export declare function getOneAccessToken(config: CredentialsConfig): Promise<string | null>;
+/** Where a saved sign-in this configuration can't use belongs. `issuer` and `clientId` are null for a legacy session. */
+export type SavedFor = {
+    oneBaseUrl: string;
+    issuer: string | null;
+    clientId: string | null;
+};
+/** The configuration the saved sign-in belongs to when it isn't this one; null when it is, or nothing is saved. */
+export declare function savedForAnotherConfiguration(config: CredentialsConfig, { version, one }: CredentialsFile): Promise<SavedFor | null>;
 /** Saved sign-in for doctor, which reports problems instead of failing on them. */
 export type OptionalAccessToken = {
     accessToken: string | null;
@@ -97,6 +117,11 @@ export type OptionalAccessToken = {
  * With no saved sign-in there is no problem, even under a config path that fails the directory checks.
  */
 export declare function getOptionalOneAccessToken(config: CredentialsConfig): Promise<OptionalAccessToken>;
+/**
+ * whoami's directory check, which agrees with list and doctor: false when the credentials directory is missing,
+ * or fails the checks with no credentials saved there. The strict check's error when credentials may be there.
+ */
+export declare function hasCredentialsDirectory(config: Pick<CliConfig, 'configDir'>): Promise<boolean>;
 /**
  * Whether list can show the saved sign-in as usable, judged from the files alone: no refresh, no network
  * and no wait for the credentials lock. A legacy token must be unexpired; an Identity grant may hold an

package/dist/auth/store.js

@@ -3,8 +3,9 @@ import { constants } from 'node:fs';
 import { lstat, mkdir, open, rename, rm } from 'node:fs/promises';
 import { basename, dirname, isAbsolute, join, parse, resolve } from 'node:path';
 import { z } from 'zod';
-import { DEFAULT_TIMEOUT_MS } from '../lib/config.js';
+import { DEFAULT_TIMEOUT_MS, relativeConfigDirProblem } from '../lib/config.js';
 import { platform } from '../lib/platform.js';
+import { aclEntries, letsOthersChangeEntries, stripAcl } from './acl.js';
 const FILE_NAME = 'credentials.json';
 /** CLI 0.1.x rejects a version 2 credentials.json and deletes it unrevoked, so Identity grants live apart. */
 const IDENTITY_FILE_NAME = 'identity-credentials.json';
@@ -14,7 +15,7 @@ export const DEFAULT_ONE_ORIGIN = 'https://one.vigilbase.com';
 const INVALID_ONE_CREDENTIALS = 'Saved One credentials are invalid. Run `vigilbase logout`, then `vigilbase login` to replace them.';
 const INVALID_IDENTITY_CREDENTIALS = 'Saved Identity credentials are invalid. Run `vigilbase login` to replace them.';
 export const UNCERTAIN_REFRESH = 'A previous refresh has an uncertain result. Run `vigilbase login` again; its token cannot be retried safely.';
-const SAVED_FOR_ANOTHER_ORIGIN = 'Saved for a different One origin, Identity issuer or client ID.';
+const SAVED_FOR_ANOTHER_ORIGIN = 'Saved for a different One origin, Identity issuer or client ID. Pass the matching --one-url, --auth-url and --client-id, or run `vigilbase login`.';
 export const OneCredentialsSchema = z.object({
     issuer: z.string().optional(), clientId: z.string().optional(), resource: z.string().optional(), refreshToken: z.string().min(1).optional(), refreshTokenExpiresAt: z.string().optional(), refreshPending: z.boolean().optional(), orgId: z.string().optional(),
     oneBaseUrl: z.string().optional(), accessToken: z.string().min(1), tokenType: z.string().optional(),
@@ -48,6 +49,26 @@ export class InvalidCredentialsError extends Error {
         this.name = 'InvalidCredentialsError';
     }
 }
+/** A command that needs One found no usable sign-in. */
+export class NotSignedInError extends Error {
+    code = 'NOT_SIGNED_IN';
+    constructor() {
+        super('This command needs a Vigilbase One sign-in: run `vigilbase login`.');
+        this.name = 'NotSignedInError';
+    }
+}
+/** Identity answered a refresh with invalid_grant: the grant is gone and identity-credentials.json was removed. */
+export class SignInEndedError extends Error {
+    code = 'SIGN_IN_ENDED';
+    constructor() {
+        super('Your saved sign-in was ended by Vigilbase Identity and has been removed. Run `vigilbase login` again.');
+        this.name = 'SignInEndedError';
+    }
+}
+/** A path as one shell word for a remedy: as is when plain, otherwise in single quotes. */
+export function shellQuote(path) {
+    return /^[\w@%+=:,./-]+$/.test(path) ? path : `'${path.replaceAll("'", `'\\''`)}'`;
+}
 /** Credentials cannot be protected by modes and owners on Windows yet. */
 export class SignInUnsupportedError extends Error {
     code = 'SIGN_IN_UNSUPPORTED';
@@ -81,11 +102,16 @@ export function assertFile(info, path) {
     if (isOwnedByOtherUser(info))
         throw new CredentialsPathError(`${path} is owned by another user`, REMOVE_FILE);
     if ((info.mode & 0o777) !== MODE_FILE)
-        throw new CredentialsPathError(`${path} must have mode 0600`, `Run chmod 600 ${path}.`);
+        throw new CredentialsPathError(`${path} must have mode 0600`, `Run chmod 600 ${shellQuote(path)}.`);
+}
+function aclError(path) {
+    return new CredentialsPathError(`${path} has an access control list`, `Run chmod -N ${shellQuote(path)}, or set VIGILBASE_CONFIG_DIR to another directory.`);
 }
 const USE_ANOTHER_DIRECTORY = 'Set VIGILBASE_CONFIG_DIR to a private directory without symbolic links in its path.';
+/** Names the variable the path came from: VIGILBASE_CONFIG_DIR, or HOME for the default directory. */
 function relativeDirectoryError(configDir) {
-    return new CredentialsPathError(`${configDir} is not an absolute path`, 'Set VIGILBASE_CONFIG_DIR to an absolute path.');
+    const { reason, remedy } = relativeConfigDirProblem(configDir);
+    return new CredentialsPathError(reason, remedy);
 }
 /**
  * Check every ancestor before traversing it; a writable non-sticky parent permits replacement.
@@ -117,6 +143,7 @@ export async function checkDirectory(configDir, isCreate = false) {
             if (!isCreate)
                 return false;
             await mkdir(path, { mode: MODE_DIR });
+            await stripAcl(path);
             info = await lstat(path);
         }
         if (info.isSymbolicLink())
@@ -127,7 +154,7 @@ export async function checkDirectory(configDir, isCreate = false) {
             if (isOwnedByOtherUser(info))
                 throw new CredentialsPathError(`${path} is owned by another user`, USE_ANOTHER_DIRECTORY);
             if ((info.mode & 0o777) !== MODE_DIR) {
-                throw new CredentialsPathError(`${path} must have mode 0700`, `Run chmod 700 ${path}, or set VIGILBASE_CONFIG_DIR to another directory.`);
+                throw new CredentialsPathError(`${path} must have mode 0700`, `Run chmod 700 ${shellQuote(path)}, or set VIGILBASE_CONFIG_DIR to another directory.`);
             }
         }
         else {
@@ -137,18 +164,47 @@ export async function checkDirectory(configDir, isCreate = false) {
                 throw new CredentialsPathError(`${path} is owned by another user`, USE_ANOTHER_DIRECTORY);
         }
     }
+    // Mode bits can't show a macOS access control list, and its allow entries override them.
+    let acls;
+    try {
+        acls = await aclEntries(paths);
+    }
+    catch (error) {
+        throw new CredentialsPathError(`${absolute} cannot be checked for an access control list`, USE_ANOTHER_DIRECTORY, { cause: error });
+    }
+    for (const [index, path] of paths.entries()) {
+        if (index === paths.length - 1) {
+            if (acls[index].length)
+                throw aclError(path);
+        }
+        else if (acls[index].some(letsOthersChangeEntries)) {
+            throw new CredentialsPathError(`${path} is writable by other users through its access control list`, USE_ANOTHER_DIRECTORY);
+        }
+    }
     return true;
 }
 async function checkExistingFile(path) {
     try {
         assertFile(await lstat(path), path);
-        return true;
     }
     catch (error) {
         if (isMissing(error))
             return false;
         throw error;
     }
+    let acl;
+    try {
+        [acl = []] = await aclEntries([path]);
+    }
+    catch (error) {
+        // Another command may have removed it in between.
+        if (await lstat(path).then(() => false, isMissing))
+            return false;
+        throw new CredentialsPathError(`${path} cannot be checked for an access control list`, REMOVE_FILE, { cause: error });
+    }
+    if (acl.length)
+        throw aclError(path);
+    return true;
 }
 /** Parse one credentials file; the Identity file must hold a complete version 2 grant. */
 async function readCredentialsFile(path) {
@@ -321,6 +377,7 @@ export async function writeOneCredentials(config, one) {
     const handle = await open(temporaryPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, MODE_FILE);
     try {
         await handle.chmod(MODE_FILE);
+        await stripAcl(temporaryPath);
         await handle.writeFile(`${JSON.stringify(next, null, 2)}\n`, 'utf8');
         await handle.sync();
         await handle.close();
@@ -382,6 +439,18 @@ export async function getOneAccessToken(config) {
     }
     return hasExpired(one) ? null : one.accessToken;
 }
+/** The configuration the saved sign-in belongs to when it isn't this one; null when it is, or nothing is saved. */
+export async function savedForAnotherConfiguration(config, { version, one }) {
+    if (!one?.accessToken.trim())
+        return null;
+    if (version === 2) {
+        const { boundIdentityCredentials } = await import('./refresh.js');
+        if (boundIdentityCredentials(config, one))
+            return null;
+        return { oneBaseUrl: one.oneBaseUrl ?? one.resource ?? DEFAULT_ONE_ORIGIN, issuer: one.issuer ?? null, clientId: one.clientId ?? null };
+    }
+    return isForOneOrigin(one, config) ? null : { oneBaseUrl: one.oneBaseUrl ?? DEFAULT_ONE_ORIGIN, issuer: null, clientId: null };
+}
 let hasWarnedAboutSignIn = false;
 function isAbsent(error) {
     return error instanceof Error && 'code' in error && (error.code === 'ENOENT' || error.code === 'ENOTDIR');
@@ -447,12 +516,26 @@ export async function getOptionalOneAccessToken(config) {
     if (!directory.isUsable)
         return { accessToken: null, problem: directory.problem === null ? null : messageOf(directory.problem) };
     try {
+        if (await savedForAnotherConfiguration(config, await readCredentials(config)))
+            return { accessToken: null, problem: SAVED_FOR_ANOTHER_ORIGIN };
         return { accessToken: await getOneAccessToken(config), problem: null };
     }
     catch (error) {
         return { accessToken: null, problem: messageOf(error) };
     }
 }
+/**
+ * whoami's directory check, which agrees with list and doctor: false when the credentials directory is missing,
+ * or fails the checks with no credentials saved there. The strict check's error when credentials may be there.
+ */
+export async function hasCredentialsDirectory(config) {
+    if (platform() === 'win32')
+        throw new SignInUnsupportedError();
+    const directory = await checkDirectoryQuietly(config);
+    if (directory.problem !== null)
+        throw directory.problem;
+    return directory.isUsable;
+}
 /**
  * Whether list can show the saved sign-in as usable, judged from the files alone: no refresh, no network
  * and no wait for the credentials lock. A legacy token must be unexpired; an Identity grant may hold an
@@ -474,16 +557,13 @@ export async function hasUsableSignIn(config, warn) {
         const { version, one } = await readCredentialsWithoutWaiting(config);
         if (!one?.accessToken.trim())
             return false;
+        if (await savedForAnotherConfiguration(config, { version, one }))
+            throw new Error(SAVED_FOR_ANOTHER_ORIGIN);
         if (version === 2) {
-            const { boundIdentityCredentials } = await import('./refresh.js');
-            if (!boundIdentityCredentials(config, one))
-                throw new Error(SAVED_FOR_ANOTHER_ORIGIN);
             if (one.refreshPending)
                 throw new Error(UNCERTAIN_REFRESH);
             return true;
         }
-        if (!isForOneOrigin(one, config))
-            throw new Error(SAVED_FOR_ANOTHER_ORIGIN);
         return !hasExpired(one);
     }
     catch (error) {

package/dist/bin.js

@@ -1,6 +1,18 @@
 #!/usr/bin/env node
 import { runCli } from './cli.js';
 import { configureSystemTrust } from './lib/system-trust.js';
+// A reader that stops early (`| head`) closes the pipe, which is fine; any other write error loses output.
+let isOutputLost = false;
+for (const stream of [process.stdout, process.stderr]) {
+    stream.on('error', (error) => {
+        if (error.code !== 'EPIPE')
+            isOutputLost = true;
+    });
+}
 configureSystemTrust();
 const code = await runCli();
-process.exit(code);
+// Writes to a pipe are asynchronous: wait until both streams have drained, or process.exit drops the rest.
+await Promise.all([process.stdout, process.stderr].map((stream) => new Promise((resolve) => {
+    stream.write('', () => resolve());
+})));
+process.exit(isOutputLost || typeof code !== 'number' || !Number.isInteger(code) ? 1 : code);