@vincentt-xr/cli 0.19.0 → 0.21.0

package/dist/library/assetsCommand.js

@@ -18,6 +18,7 @@ import { DOWNLOAD_DIR, downloadPath, exists, overwriteRefusalLines, writeAsset,
 import { dedupeForDisplay, parseIdArgs, parseSearchFlags } from "./parse.js";
 import { addLines, humanBytes, searchLines, showLines, unknownBlockLines, unreachableLines, } from "./render.js";
 import { isLibraryId } from "./wire.js";
+import { UpgradeRequiredError } from "../shared/upgradeError.js";
 /**
  * Map a thrown client error onto the exit-4 screen it deserves.
  *
@@ -28,6 +29,9 @@ import { isLibraryId } from "./wire.js";
  * corpus failed to load.
  */
 function failureScreen(err, retry) {
+    // Rethrown so main() renders the one refusal screen and exits 5.
+    if (err instanceof UpgradeRequiredError)
+        throw err;
     if (err instanceof LibraryUnreachableError) {
         return { lines: unreachableLines("transport", retry), code: 4 };
     }

package/dist/library/client.js

@@ -12,9 +12,9 @@
 // CLI-supplied URL reaches a fetch. That is a security control, not a style choice
 // (D-add-prints-urls degraded the no-invented-URLs rule from prevention to
 // detection, and this is the one arm that stayed prevention).
-import { clientHeaders } from "../shared/clientHeader.js";
 import { authFailureMessage } from "../shared/authError.js";
-import { apiFetch, withDeadline } from "../shared/http.js";
+import { apiRequest, withDeadline } from "../shared/http.js";
+import { rejectUpgradeRequired } from "../shared/upgradeError.js";
 import { parseBatchResponse, parseFetchResponse, parseSearchResponse, } from "./wire.js";
 // An asset file can be tens of megabytes, so its download gets longer than an api call.
 const downloadFetch = withDeadline((input, init) => globalThis.fetch(input, init), 5 * 60_000);
@@ -65,18 +65,16 @@ async function readJson(res) {
  * correct recovery differs between them (retry later vs re-search).
  */
 export function httpLibraryClient(cfg) {
-    const base = cfg.apiUrl.replace(/\/$/, "");
-    const auth = { ...clientHeaders(), authorization: `Bearer ${cfg.pat}` };
     const call = async (pathname, init) => {
+        let res;
         try {
-            return await apiFetch(`${base}${pathname}`, {
-                ...init,
-                headers: { ...(init?.headers ?? {}), ...auth },
-            });
+            res = await apiRequest(cfg, pathname, init, { authenticated: true });
         }
         catch (err) {
             throw new LibraryUnreachableError(err);
         }
+        await rejectUpgradeRequired(res);
+        return res;
     };
     const fail = async (res, what) => {
         // A 401 keeps its status: assetsCommand maps it to the sign-in screen and exit 4.

package/dist/login/authBackend.d.ts

@@ -10,18 +10,43 @@ export interface Identity {
     /** All orgs the signed-in user belongs to (switcher source). */
     memberships: Membership[];
 }
+/** A machine sign-in the api signed out to stay within the 10-machine cap. */
+export interface EvictedMachine {
+    label: string;
+    /** ISO 8601, or null for a machine that was never used. */
+    lastUsedAt: string | null;
+}
+export interface ExchangeResult {
+    /** The raw PAT ("vct_…"), delivered once. */
+    token: string;
+    /** The label the api stored, echoed. Absent from an api older than machine sign-ins. */
+    label?: string;
+    /** Machines signed out by this login (the cap). Absent when none were. */
+    evicted?: EvictedMachine[];
+}
+/** How a self sign-out ended: the api ended it (or it had nothing to end), or it could not be reached. */
+export type RevokeOutcome = "done" | "unreachable";
 /**
  * The auth-flow backend seam. `exchange` redeems the PKCE code for a raw PAT; `me` confirms
  * identity + orgs with that PAT. Both are injected so a stub backend drives the CLI tests.
  */
 export interface AuthBackend {
-    /** POST /access-tokens/exchange {code, code_verifier} → the raw PAT ("vct_…"). */
-    exchange(code: string, codeVerifier: string): Promise<string>;
+    /** POST /access-tokens/exchange {code, code_verifier, label?} → the raw PAT and what the api reports. */
+    exchange(code: string, codeVerifier: string, label?: string): Promise<ExchangeResult>;
     /** GET /me with Bearer <pat> → identity + orgs. */
     me(pat: string): Promise<Identity>;
 }
+/** DELETE /access-tokens/current gives up after this long: sign-out never hangs on the api. */
+export declare const REVOKE_CURRENT_TIMEOUT_MS = 5000;
 /** The real HTTP-backed AuthBackend, pointed at a Vincentt API base URL. */
 export declare function httpAuthBackend(apiBase: string): AuthBackend;
+/**
+ * End THIS machine's sign-in on the platform (DELETE /access-tokens/current),
+ * best-effort. 204 is done; 400, 401, 403, 404 and 405 count as done too: an
+ * older api has no such route, or the sign-in had already ended. A network
+ * failure, a timeout or a 5xx is "unreachable".
+ */
+export declare function revokeCurrent(apiBase: string, pat: string, fetchImpl?: typeof fetch, timeoutMs?: number): Promise<RevokeOutcome>;
 /**
  * Map the /me response shape onto our Identity. The backend returns memberships with an org
  * name + kind; we keep the projection resilient to the exact field names the Go handler emits

package/dist/login/authBackend.js

@@ -3,12 +3,16 @@
 // backend (QA-F1-C2/C4/C5) without real HTTP.
 //
 // Note the CLI does NOT call POST /access-tokens — the browser/console does that (it holds
-// the JWT session; a PAT may not mint a PAT). The CLI only redeems the returned auth_code:
-//   POST /access-tokens/exchange {code, code_verifier} → {token}   (raw PAT, once, in body)
-//   GET  /me            Bearer <PAT>                    → identity + orgs (confirm)
+// the session; a PAT may not mint a PAT). The CLI only redeems the returned auth_code:
+//   POST /access-tokens/exchange {code, code_verifier, label}
+//                                    → {token, label, evicted?}  (raw PAT, once, in body)
+//   GET  /me            Bearer <PAT> → identity + orgs (confirm)
+// and, to end this machine's own sign-in, DELETE /access-tokens/current Bearer <PAT>.
 import { authFailureMessage } from "../shared/authError.js";
-import { clientHeaders } from "../shared/clientHeader.js";
-import { apiFetch } from "../shared/http.js";
+import { apiRequest, withDeadline } from "../shared/http.js";
+import { rejectUpgradeRequired } from "../shared/upgradeError.js";
+/** DELETE /access-tokens/current gives up after this long: sign-out never hangs on the api. */
+export const REVOKE_CURRENT_TIMEOUT_MS = 5_000;
 class AuthError extends Error {
     status;
     constructor(message, status) {
@@ -25,28 +29,76 @@ async function safeText(res) {
         return "";
     }
 }
+/** The error code a JSON error body carries, if any. */
+function errorCode(text) {
+    try {
+        const body = JSON.parse(text);
+        return typeof body.code === "string" ? body.code : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function readEvicted(raw) {
+    if (!Array.isArray(raw) || raw.length === 0)
+        return undefined;
+    return raw.map((e) => {
+        const r = (e ?? {});
+        return {
+            label: typeof r.label === "string" ? r.label : "",
+            lastUsedAt: typeof r.lastUsedAt === "string" ? r.lastUsedAt : null,
+        };
+    });
+}
 /** The real HTTP-backed AuthBackend, pointed at a Vincentt API base URL. */
 export function httpAuthBackend(apiBase) {
-    const base = apiBase.replace(/\/$/, "");
+    const target = { apiUrl: apiBase };
+    // The exchange is unauthenticated but judged by the CLI floor, so it carries
+    // the tag like every other api request and its 426 is read before any arm.
+    const post = async (body) => {
+        const res = await apiRequest(target, "/access-tokens/exchange", {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify(body),
+        }, { authenticated: false });
+        await rejectUpgradeRequired(res);
+        return res;
+    };
     return {
-        async exchange(code, codeVerifier) {
-            const res = await apiFetch(`${base}/access-tokens/exchange`, {
-                method: "POST",
-                headers: { ...clientHeaders(), "content-type": "application/json" },
-                body: JSON.stringify({ code, code_verifier: codeVerifier }),
-            });
+        async exchange(code, codeVerifier, label) {
+            const body = { code, code_verifier: codeVerifier };
+            if (label !== undefined)
+                body.label = label;
+            let res = await post(body);
+            if (!res.ok && res.status === 400 && label !== undefined) {
+                const text = await safeText(res);
+                // An api older than machine sign-ins decodes strictly and refuses the
+                // unknown `label` field with bad_request BEFORE it consumes the code, so
+                // the same code and verifier are still good: retry once without it. Any
+                // other refusal (label_invalid included) is final.
+                if (errorCode(text) !== "bad_request") {
+                    throw new AuthError(`Token exchange failed (${res.status}): ${text}`, res.status);
+                }
+                res = await post({ code, code_verifier: codeVerifier });
+            }
             if (!res.ok) {
                 throw new AuthError(`Token exchange failed (${res.status}): ${await safeText(res)}`, res.status);
             }
-            const body = (await res.json());
-            if (!body.token)
+            const out = (await res.json());
+            if (typeof out.token !== "string" || !out.token) {
                 throw new AuthError("Token exchange returned no token.");
-            return body.token;
+            }
+            return {
+                token: out.token,
+                label: typeof out.label === "string" ? out.label : undefined,
+                evicted: readEvicted(out.evicted),
+            };
         },
         async me(pat) {
-            const res = await apiFetch(`${base}/me`, {
-                headers: { ...clientHeaders(), authorization: `Bearer ${pat}` },
+            const res = await apiRequest({ apiUrl: apiBase, pat }, "/me", {}, {
+                authenticated: true,
             });
+            await rejectUpgradeRequired(res);
             if (!res.ok) {
                 throw new AuthError(authFailureMessage("Identity check failed", res.status, await safeText(res)), res.status);
             }
@@ -54,6 +106,23 @@ export function httpAuthBackend(apiBase) {
         },
     };
 }
+/**
+ * End THIS machine's sign-in on the platform (DELETE /access-tokens/current),
+ * best-effort. 204 is done; 400, 401, 403, 404 and 405 count as done too: an
+ * older api has no such route, or the sign-in had already ended. A network
+ * failure, a timeout or a 5xx is "unreachable".
+ */
+export async function revokeCurrent(apiBase, pat, fetchImpl = (input, init) => globalThis.fetch(input, init), timeoutMs = REVOKE_CURRENT_TIMEOUT_MS) {
+    try {
+        const res = await apiRequest({ apiUrl: apiBase, pat }, "/access-tokens/current", { method: "DELETE" }, { authenticated: true }, withDeadline(fetchImpl, timeoutMs));
+        if (res.ok || [400, 401, 403, 404, 405].includes(res.status))
+            return "done";
+        return "unreachable";
+    }
+    catch {
+        return "unreachable";
+    }
+}
 /**
  * Map the /me response shape onto our Identity. The backend returns memberships with an org
  * name + kind; we keep the projection resilient to the exact field names the Go handler emits

package/dist/login/loginCommand.d.ts

@@ -1,4 +1,4 @@
-import type { Identity, Membership } from "./authBackend.js";
+import type { EvictedMachine, Identity, Membership, RevokeOutcome } from "./authBackend.js";
 /** Collapse the home dir to `~` for display. `~/.vincentt/config.json` in every transcript. */
 export declare function displayConfigPath(absPath: string, home: string): string;
 /** The active org is the personal one (login lands on personal; the CLI never prompts). */
@@ -9,6 +9,12 @@ export declare function activeOrg(memberships: Membership[]): Membership | undef
  * org gets just the active-org line (no trailing clause).
  */
 export declare function orgSummaryLine(identity: Identity): string;
+/**
+ * The line naming a machine the 10-machine cap signed out (Flow L5). No glyph:
+ * it is not an advisory about this machine; no command: the other machine signs
+ * in again if someone wants it.
+ */
+export declare function evictionLine(e: EvictedMachine): string;
 export interface LoginCommandDeps {
     /** Print a line to the user (stdout for the transcript). */
     print: (line: string) => void;
@@ -16,13 +22,22 @@ export interface LoginCommandDeps {
     currentToken: () => Promise<string | undefined>;
     /** Confirm who the present token belongs to (GET /me). Throws the client's error unchanged. */
     whoAmI: () => Promise<Identity>;
-    /** Run the loopback + PKCE flow; resolves identity + the saved config path. */
+    /** Run the loopback + PKCE flow; resolves identity, the saved config path and what the api reported. */
     runLogin: () => Promise<{
         identity: Identity;
         configPath: string;
+        label?: string;
+        evicted?: EvictedMachine[];
     }>;
-    /** Forget the existing token before a --force re-login. */
+    /** Forget a stored token the api no longer accepts. */
     clearToken: () => Promise<void>;
+    /** The token saved in this machine's config (never the env override), read before a --force login. */
+    storedToken?: () => Promise<string | undefined>;
+    /**
+     * End a replaced token's sign-in on the platform, best-effort and silent. Called with
+     * the OLD token only after the new one is saved.
+     */
+    revokeToken?: (pat: string) => Promise<unknown>;
     /** For displaying the config path as ~/…. */
     home: string;
     /** Absolute config path (for the L2 already-signed-in line). */
@@ -37,3 +52,20 @@ export interface LoginCommandOptions {
  * exact retry command and return 1. No stack trace, no token printed.
  */
 export declare function loginCommand(deps: LoginCommandDeps, opts?: LoginCommandOptions): Promise<number>;
+export interface LogoutDeps {
+    /** Delete the local token; reports whether there was one. */
+    clear: () => Promise<{
+        path: string;
+        hadToken: boolean;
+    }>;
+    /** How the platform sign-out (DELETE /access-tokens/current) ended, asked BEFORE clearing. */
+    outcome: RevokeOutcome;
+    /** For displaying the config path as ~/…. */
+    home?: string;
+}
+/**
+ * `vincentt logout` (Flow L7): the platform sign-out was already attempted; the
+ * local token is ALWAYS deleted, and only an api that could not be reached adds
+ * a fact line, because that machine then stays listed in the console.
+ */
+export declare function logoutLines(deps: LogoutDeps): Promise<string[]>;

package/dist/login/loginCommand.js

@@ -5,8 +5,12 @@
 //
 // The IO boundary (print, current identity, run the PKCE flow, clock) is injected so every
 // L1–L4 branch is unit-testable with no real browser, socket, or config file.
+import os from "node:os";
 import { isAuthRefused } from "../shared/authError.js";
+import { UpgradeRequiredError, upgradeRefusalLines } from "../shared/upgradeError.js";
 import { EXIT } from "../lib/exitCodes.js";
+import { dayMonth, sanitizeServerLabel } from "./machineLabel.js";
+import { SignedInThenRefusedError } from "./pkceLogin.js";
 /** Collapse the home dir to `~` for display. `~/.vincentt/config.json` in every transcript. */
 export function displayConfigPath(absPath, home) {
     if (home && absPath.startsWith(home))
@@ -32,6 +36,18 @@ export function orgSummaryLine(identity) {
     const base = `  Active workspace: ${activeName}`;
     return others.length ? `${base}   ·   also a member of: ${others.join(", ")}` : base;
 }
+/**
+ * The line naming a machine the 10-machine cap signed out (Flow L5). No glyph:
+ * it is not an advisory about this machine; no command: the other machine signs
+ * in again if someone wants it.
+ */
+export function evictionLine(e) {
+    const label = sanitizeServerLabel(e.label);
+    const when = e.lastUsedAt
+        ? `last used ${dayMonth(new Date(e.lastUsedAt))}`
+        : "never used";
+    return `  Signed out "${label}", the least recently used of your 10 signed-in machines (${when}).`;
+}
 /**
  * Drive `vincentt login`. Returns an exit code (0 ok, 1 failed). Never throws for expected
  * failure states (timeout, cancel, state-mismatch) — they print a ✗ line ending with the
@@ -41,7 +57,21 @@ export async function loginCommand(deps, opts = {}) {
     const displayPath = displayConfigPath(deps.configPath, deps.home);
     if (opts.force) {
         deps.print("→ Replacing the existing token on this machine…");
-        await deps.clearToken();
+        // The old token stays on disk until the new one is saved: a failed login must
+        // never leave the machine with neither.
+        const old = deps.storedToken ? await deps.storedToken() : undefined;
+        const { code, saved } = await signIn(deps);
+        // Keyed on the new token being SAVED, not on success: a version refusal
+        // after the save still replaced the old token, which must not stay live.
+        if (saved && old && deps.revokeToken) {
+            try {
+                await deps.revokeToken(old);
+            }
+            catch {
+                /* best-effort: the old sign-in ages out or is signed out in the console */
+            }
+        }
+        return code;
     }
     else {
         // L2: already signed in, but only once the api confirms the token.
@@ -52,6 +82,8 @@ export async function loginCommand(deps, opts = {}) {
                 who = await deps.whoAmI();
             }
             catch (err) {
+                if (err instanceof UpgradeRequiredError)
+                    return refusedVersion(deps, err);
                 if (!isTokenRejected(err)) {
                     // A down api or a dead network says nothing about the token, so it stays.
                     deps.print("✗ Could not check the account for the token on this machine.");
@@ -76,21 +108,65 @@ function isTokenRejected(err) {
         (err instanceof Error && err.status === 403));
 }
 async function runLoginFlow(deps) {
+    return (await signIn(deps)).code;
+}
+/** The flow's exit code, and whether a new token was written to this machine. */
+async function signIn(deps) {
     // L1 / L4 — run the loopback + PKCE flow.
     try {
-        const { identity, configPath } = await deps.runLogin();
-        deps.print(`✓ Signed in as ${identity.email}`);
+        const { identity, configPath, label, evicted } = await deps.runLogin();
+        // The label is the api's ECHO, never what was sent: an older api never saw it.
+        const named = label ? sanitizeServerLabel(label) : "";
+        deps.print(named
+            ? `✓ Signed in as ${identity.email} on this machine (${named})`
+            : `✓ Signed in as ${identity.email}`);
         deps.print(orgSummaryLine(identity));
+        for (const e of evicted ?? [])
+            deps.print(evictionLine(e));
         deps.print(`  Token saved to ${displayConfigPath(configPath, deps.home)}`);
         deps.print("");
         deps.print("Run `vincentt --help` to see what you can do.");
-        return 0;
+        return { code: EXIT.OK, saved: true };
     }
     catch (err) {
+        // Refused after the exchange: the token is on disk, so the screen says so
+        // and names any machine this sign-in signed out.
+        if (err instanceof SignedInThenRefusedError) {
+            const arm = { kind: "login_saved", evictionLines: err.evicted.map(evictionLine) };
+            for (const l of upgradeRefusalLines(err, arm))
+                deps.print(l);
+            return { code: EXIT.UPGRADE_REQUIRED, saved: true };
+        }
+        // The exchange is judged before anything is minted, so no token was written.
+        if (err instanceof UpgradeRequiredError) {
+            return { code: refusedVersion(deps, err), saved: false };
+        }
         // L4 — timeout / callback failure: ✗ line + the exact next command. No token written.
         const message = err instanceof Error ? err.message : "Sign-in failed.";
         deps.print(`✗ ${message}`);
         deps.print("  Run `vincentt login` to try again.");
-        return 1;
+        return { code: EXIT.FAILED, saved: false };
+    }
+}
+function refusedVersion(deps, err) {
+    for (const l of upgradeRefusalLines(err, { kind: "login" }))
+        deps.print(l);
+    return EXIT.UPGRADE_REQUIRED;
+}
+/**
+ * `vincentt logout` (Flow L7): the platform sign-out was already attempted; the
+ * local token is ALWAYS deleted, and only an api that could not be reached adds
+ * a fact line, because that machine then stays listed in the console.
+ */
+export async function logoutLines(deps) {
+    const { path: p, hadToken } = await deps.clear();
+    if (!hadToken)
+        return ["Already signed out."];
+    const lines = [
+        `✓ Signed out. Token removed from ${displayConfigPath(p, deps.home ?? os.homedir())}`,
+    ];
+    if (deps.outcome === "unreachable") {
+        lines.push("  The api could not be reached. This machine stays listed under Signed-in machines until it is", "  signed out there or goes 90 days unused.");
     }
+    return lines;
 }

package/dist/login/machineLabel.d.ts

@@ -0,0 +1,46 @@
+export declare const MACHINE_LABEL_MAX_CODE_POINTS = 64;
+export declare const MACHINE_LABEL_MAX_MARK_RUN = 4;
+export declare const LEGACY_MACHINE_LABEL = "Signed in before machine names";
+export declare const DEFAULT_MACHINE_LABEL_PREFIX = "Unnamed machine,";
+export declare const MACHINE_LABEL_REFUSED_LINES: readonly string[];
+/** "d Mon" in the given date's own calendar fields (local time unless the caller says otherwise). */
+export declare function dayMonth(d: Date, utc?: boolean): string;
+/** The default label, "<OS> <arch>, <d Mon>", from injected platform, arch and clock. */
+export declare function defaultMachineLabel(platform?: string, arch?: string, now?: Date): string;
+export type LabelCheck = {
+    ok: true;
+    label: string;
+} | {
+    ok: false;
+};
+/**
+ * The api's label rules, for a label the person typed: NFC, trim U+0020 only,
+ * then 1 to 64 code points, each a letter, mark, number, punctuation, symbol or
+ * plain space, no run of more than 4 marks, and not a platform-only string. An
+ * empty label is refused here (the api would store its default, but `--label ""`
+ * is a mistake, not a request for the default).
+ */
+export declare function validateMachineLabel(raw: string): LabelCheck;
+/**
+ * Drop every code point outside the label allowlist before a server-sent label
+ * is printed. The api already refuses such labels; this keeps a later
+ * validation bug from writing escape sequences or bidi controls to a terminal.
+ */
+export declare function sanitizeServerLabel(label: unknown): string;
+export type LoginLabel = {
+    ok: true;
+    label: string;
+} | {
+    ok: false;
+    lines: readonly string[];
+};
+/**
+ * The label a `vincentt login` sends. Without --label it is the default; with it,
+ * the typed value must pass the api's rules, or the refusal lines are returned
+ * and the login must stop before any browser or network.
+ */
+export declare function resolveLoginLabel(given: boolean, raw: string | undefined, defaults?: {
+    platform?: string;
+    arch?: string;
+    now?: Date;
+}): LoginLabel;

package/dist/login/machineLabel.js

@@ -0,0 +1,119 @@
+// The machine label `vincentt login` sends with the exchange: a name for this
+// machine's sign-in that the console lists and the eviction line prints.
+//
+// It is built from the OS, the architecture and today's date, NEVER the hostname:
+// a hostname often carries a person's name or an employer's asset tag, and the
+// label is shown back to the person. `--label` overrides it.
+//
+// validateMachineLabel applies the api's exact rules, counting CODE POINTS after
+// NFC (not UTF-16 units), so `--label` is refused here, before any browser or
+// network, for exactly what the api would refuse. The shared corpus
+// (__fixtures__/machine_label_corpus.json, copied from the api) pins agreement.
+export const MACHINE_LABEL_MAX_CODE_POINTS = 64;
+export const MACHINE_LABEL_MAX_MARK_RUN = 4;
+export const LEGACY_MACHINE_LABEL = "Signed in before machine names";
+export const DEFAULT_MACHINE_LABEL_PREFIX = "Unnamed machine,";
+const MONTHS = [
+    "Jan",
+    "Feb",
+    "Mar",
+    "Apr",
+    "May",
+    "Jun",
+    "Jul",
+    "Aug",
+    "Sep",
+    "Oct",
+    "Nov",
+    "Dec",
+];
+export const MACHINE_LABEL_REFUSED_LINES = [
+    "✗ A machine label must be 1 to 64 letters, numbers, spaces, punctuation or symbols.",
+    '  Run `vincentt login --label "<name>"` with a shorter name, or leave out --label.',
+];
+/** "d Mon" in the given date's own calendar fields (local time unless the caller says otherwise). */
+export function dayMonth(d, utc = false) {
+    const day = utc ? d.getUTCDate() : d.getDate();
+    const month = utc ? d.getUTCMonth() : d.getMonth();
+    return `${day} ${MONTHS[month]}`;
+}
+function osName(platform) {
+    if (platform === "darwin")
+        return "macOS";
+    if (platform === "win32")
+        return "Windows";
+    if (platform === "linux")
+        return "Linux";
+    return platform;
+}
+/** The default label, "<OS> <arch>, <d Mon>", from injected platform, arch and clock. */
+export function defaultMachineLabel(platform = process.platform, arch = process.arch, now = new Date()) {
+    return `${osName(platform)} ${arch}, ${dayMonth(now)}`;
+}
+const ALLOWED = /^[\p{L}\p{M}\p{N}\p{P}\p{S} ]$/u;
+const MARK = /^\p{M}$/u;
+function trimSpaces(s) {
+    return s.replace(/^ +| +$/g, "");
+}
+function fold(s) {
+    return s.normalize("NFKC").toLowerCase();
+}
+const FOLDED_LEGACY = fold(LEGACY_MACHINE_LABEL);
+const FOLDED_DEFAULT_PREFIX = fold(DEFAULT_MACHINE_LABEL_PREFIX);
+/**
+ * The api's label rules, for a label the person typed: NFC, trim U+0020 only,
+ * then 1 to 64 code points, each a letter, mark, number, punctuation, symbol or
+ * plain space, no run of more than 4 marks, and not a platform-only string. An
+ * empty label is refused here (the api would store its default, but `--label ""`
+ * is a mistake, not a request for the default).
+ */
+export function validateMachineLabel(raw) {
+    const label = trimSpaces(raw.normalize("NFC"));
+    const points = [...label];
+    if (points.length < 1 || points.length > MACHINE_LABEL_MAX_CODE_POINTS)
+        return { ok: false };
+    let markRun = 0;
+    for (const cp of points) {
+        if (!ALLOWED.test(cp))
+            return { ok: false };
+        if (MARK.test(cp)) {
+            markRun++;
+            if (markRun > MACHINE_LABEL_MAX_MARK_RUN)
+                return { ok: false };
+        }
+        else {
+            markRun = 0;
+        }
+    }
+    // Case folding approximated by NFKC + toLowerCase; the shared corpus pins
+    // agreement with the api's NFKC + Unicode case fold.
+    const folded = trimSpaces(fold(label));
+    if (folded === FOLDED_LEGACY || folded.startsWith(FOLDED_DEFAULT_PREFIX))
+        return { ok: false };
+    return { ok: true, label };
+}
+/**
+ * Drop every code point outside the label allowlist before a server-sent label
+ * is printed. The api already refuses such labels; this keeps a later
+ * validation bug from writing escape sequences or bidi controls to a terminal.
+ */
+export function sanitizeServerLabel(label) {
+    if (typeof label !== "string")
+        return "";
+    return [...label].filter((cp) => ALLOWED.test(cp)).join("");
+}
+/**
+ * The label a `vincentt login` sends. Without --label it is the default; with it,
+ * the typed value must pass the api's rules, or the refusal lines are returned
+ * and the login must stop before any browser or network.
+ */
+export function resolveLoginLabel(given, raw, defaults = {}) {
+    if (!given) {
+        return {
+            ok: true,
+            label: defaultMachineLabel(defaults.platform, defaults.arch, defaults.now),
+        };
+    }
+    const check = validateMachineLabel(raw ?? "");
+    return check.ok ? check : { ok: false, lines: MACHINE_LABEL_REFUSED_LINES };
+}

package/dist/login/pkceLogin.d.ts

@@ -1,4 +1,5 @@
-import { type AuthBackend, type Identity } from "./authBackend.js";
+import { type AuthBackend, type EvictedMachine, type Identity } from "./authBackend.js";
+import { UpgradeRequiredError } from "../shared/upgradeError.js";
 export interface PkceLoginOptions {
     /** Console origin that serves /cli-auth (browser target). */
     consoleUrl: string;
@@ -6,6 +7,8 @@ export interface PkceLoginOptions {
     apiUrl: string;
     /** Abort if the browser round-trip doesn't complete in time. Default 5 min. */
     timeoutMs?: number;
+    /** The machine label sent with the exchange (already validated). */
+    label?: string;
     /** Backend calls (exchange + me). Default: real HTTP against apiUrl. */
     backend?: AuthBackend;
     /** Pick a free loopback port. Default: the OS ephemeral picker. */
@@ -20,11 +23,24 @@ export interface PkceLoginOptions {
 export interface PkceLoginResult {
     identity: Identity;
     configPath: string;
+    /** The label the api stored, echoed back; absent from an older api. */
+    label?: string;
+    /** Machines this login signed out at the 10-machine cap. */
+    evicted?: EvictedMachine[];
 }
 /** Thrown when the wait elapses with no approval; drives the L4 timeout transcript. */
 export declare class LoginTimeoutError extends Error {
     constructor();
 }
+/**
+ * The exchange was admitted and the token SAVED, then the identity check was
+ * refused for this CLI's version. Distinct from a refused exchange: a sign-in
+ * now exists on this machine, and machines may have been signed out for it.
+ */
+export declare class SignedInThenRefusedError extends UpgradeRequiredError {
+    readonly evicted: EvictedMachine[];
+    constructor(refused: UpgradeRequiredError, evicted?: EvictedMachine[]);
+}
 /** Thrown when the loopback callback fails state-verify or is cancelled (QA-F1-C3). */
 export declare class LoginCallbackError extends Error {
     constructor(message: string);