ninepm 0.41.0 → 0.43.0

package/README.md

@@ -180,7 +180,7 @@ Service token secrets returned by `access service create` are also server-side s
 9pm deploy [directory] --runtime container --port 8080 [--health-path /health] [--region auto] [--with-db]
 9pm signup
 9pm login
-9pm logout
+9pm logout [--api-url <url>] [--local]
 9pm doctor [--json]
 9pm whoami
 9pm apps [--json]

package/dist/index.d.ts

@@ -114,8 +114,12 @@ export interface CreatedServiceToken {
     clientSecret: string;
 }
 export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
-export declare const CLI_VERSION = "0.41.0";
+export declare const CLI_VERSION = "0.43.0";
 type CredentialBackend = "macos-keychain" | "windows-dpapi" | "linux-secret-service" | "file-plaintext" | "none";
+export interface StoredCredentialEntry {
+    token: string;
+    apiUrl: string | undefined;
+}
 export interface CredentialDiagnostics {
     platform: NodeJS.Platform;
     preferredBackend: CredentialBackend;
@@ -136,6 +140,7 @@ export interface WhoamiResult {
         role?: string;
     };
     apiKey: {
+        id?: string;
         prefix: string;
         expiresAt: string | null;
     };
@@ -204,6 +209,32 @@ export declare function measureWorkerModuleFiles(root: string, modulePaths: read
 export declare function checkDeployDirectory(options: DeployOptions): Promise<DeployCheckResult>;
 export declare function whoami(options: ApiOptions): Promise<WhoamiResult>;
 export declare function publicWhoamiResult(result: WhoamiResult): PublicWhoamiResult;
+export type CredentialRevocation = {
+    kind: "revoked";
+} | {
+    kind: "already_invalid";
+} | {
+    kind: "failed";
+    reason: string;
+};
+export declare function revokeCredential(options: ApiOptions): Promise<CredentialRevocation>;
+export interface RevocationAttempt {
+    issuerKnown: boolean;
+    apiUrl: string;
+    outcome: CredentialRevocation;
+}
+export type LogoutSummary = {
+    kind: "failed";
+    reason: string;
+} | {
+    kind: "unproven";
+    apiUrl: string;
+} | {
+    kind: "revoked";
+} | {
+    kind: "already_invalid";
+};
+export declare function summarizeRevocations(attempts: RevocationAttempt[]): LogoutSummary;
 export declare function getSiteAccess(options: SiteAccessOptions): Promise<AccessState>;
 export declare function setSiteAccessPublic(options: SiteAccessOptions): Promise<AccessState["access"]>;
 export declare function setSiteAccessOtp(options: SiteAccessOptions): Promise<AccessState["access"]>;
@@ -263,6 +294,7 @@ export interface DeviceAuthFeedbackOptions {
     openBrowserFn?: (url: string) => BrowserOpenResult;
     storeCredentialFn?: (token: string, options: {
         allowFileFallback?: boolean | undefined;
+        apiUrl?: string | undefined;
     }) => string;
 }
 export declare function loginDevice(options: {
@@ -336,6 +368,9 @@ type CliCommand = {
     allowFileCredentialStore: boolean;
 } | {
     kind: "logout";
+    apiUrl: string | null;
+    apiUrlError?: string;
+    local: boolean;
 } | {
     kind: "doctor";
     apiUrl: string;
@@ -492,6 +527,7 @@ export declare function parseEnvFileEntries(content: string, kind: "secret" | "v
     value: string;
     kind: "secret" | "var";
 }>;
+export declare function storedCredentialTokens(): StoredCredentialEntry[];
 export declare function credentialDiagnostics(): CredentialDiagnostics;
 export type BrowserOpenResult = "opened" | "failed" | "unknown";
 export declare function classifyBrowserOpen(input: {

package/dist/index.js

@@ -14,12 +14,17 @@ import { MAX_DEPLOY_DESCRIPTION_LENGTH, normalizeDeployDescription } from "./dep
 import { MAX_STATIC_ASSET_FILE_BYTES, MAX_WORKER_ENTRY_COMPRESSED_BYTES, MAX_WORKER_SCRIPT_COMPRESSED_BYTES, WORKER_ENTRY_COMPRESSED_WARN_BYTES, assetFileTooLargeMessage, formatMebibytes, formatMegabytes, oversizedAssets, workerBundleNearLimitMessage, workerBundleTooLargeMessage, workerEntryNearLimitMessage, workerEntryTooLargeMessage, } from "./deploy-limits.js";
 import { buildFileManifest, readManifestFile } from "./manifest.js";
 import { API_KEY_HELP, API_URL_HELP, CLI_CLIENT_ID, DEFAULT_API_URL, reportCliError } from "./cli-config.js";
-export const CLI_VERSION = "0.41.0";
+export const CLI_VERSION = "0.43.0";
 const PUBLIC_DASHBOARD_URL = "https://9pm.ai/dashboard";
 const TOKEN_SERVICE = "9pm";
 const TOKEN_ACCOUNT = "default";
+// The protected store's second slot, holding the control plane that issued the
+// token in the adjacent slot. Deliberately not the same item — see
+// readSecureCredentialEntry.
+const ISSUER_ACCOUNT = "default-issuer";
 const CREDENTIAL_METADATA_FILE = "credentials.json";
 const WINDOWS_CREDENTIAL_FILE = "credential.dpapi";
+const WINDOWS_ISSUER_FILE = "issuer.dpapi";
 const PLAINTEXT_CREDENTIAL_FILE = "credential.plaintext.json";
 const ALLOW_FILE_CREDENTIAL_STORE_ENV = "NINEPM_ALLOW_FILE_CREDENTIAL_STORE";
 const DISABLE_NATIVE_CREDENTIAL_STORE_ENV = "NINEPM_DISABLE_NATIVE_CREDENTIAL_STORE";
@@ -700,6 +705,130 @@ export function publicWhoamiResult(result) {
         },
     };
 }
+// How long each revocation request may take before logout gives up and reports
+// the honest failure instead of hanging (a black-holed connection accepts TCP
+// and never answers). Longer than the 5s reachability probe because this
+// request is worth waiting for, but still bounded.
+const REVOKE_TIMEOUT_MS = 10_000;
+// Revoke the API key `options.token` authenticates as (#822). The token itself
+// carries no key id, so /v1/me — whose response names the calling key — is how
+// the CLI learns which row to revoke. Every branch returns instead of throwing:
+// logout deletes the local credential whatever happens here, and needs to tell
+// the user which of the three outcomes it got.
+export async function revokeCredential(options) {
+    const fetchFn = withFetchDiagnostics(options.fetchFn ?? fetch);
+    const apiUrl = normalizeApiUrl(options.apiUrl);
+    let identify;
+    try {
+        identify = await fetchFn(`${apiUrl}/v1/me`, {
+            method: "GET",
+            headers: jsonHeaders(options.token),
+            signal: AbortSignal.timeout(REVOKE_TIMEOUT_MS),
+        });
+    }
+    catch (error) {
+        return { kind: "failed", reason: revocationFailureReason(error) };
+    }
+    if (identify.status === 401 || identify.status === 403) {
+        // Only the control plane's own auth refusal proves the credential is the
+        // thing being rejected. A WAF, an SSO proxy, or an Access-protected host in
+        // front of the API answers 401/403 too, and treating that as "the key is
+        // dead" would report a clean logout for a key that is still live.
+        return (await isAuthRefusal(identify))
+            ? { kind: "already_invalid" }
+            : { kind: "failed", reason: `${identify.status} from something other than the control plane's own authentication` };
+    }
+    if (!identify.ok) {
+        return { kind: "failed", reason: `the control plane answered ${identify.status}` };
+    }
+    let keyId;
+    try {
+        keyId = (await identify.json()).apiKey?.id;
+    }
+    catch {
+        keyId = undefined;
+    }
+    if (!keyId) {
+        return { kind: "failed", reason: "the control plane did not identify the credential" };
+    }
+    let revoke;
+    try {
+        revoke = await fetchFn(`${apiUrl}/v1/me/api-keys/${encodeURIComponent(keyId)}/revoke`, {
+            method: "POST",
+            headers: jsonHeaders(options.token),
+            signal: AbortSignal.timeout(REVOKE_TIMEOUT_MS),
+        });
+    }
+    catch (error) {
+        return { kind: "failed", reason: revocationFailureReason(error) };
+    }
+    if (revoke.ok) {
+        return { kind: "revoked" };
+    }
+    // 401/403 here means the key died between the two calls (revoked elsewhere):
+    // it can no longer authenticate, which is the goal state. Same intermediary
+    // caveat as the /v1/me call above.
+    if (revoke.status === 401 || revoke.status === 403) {
+        return (await isAuthRefusal(revoke))
+            ? { kind: "already_invalid" }
+            : { kind: "failed", reason: `${revoke.status} from something other than the control plane's own authentication` };
+    }
+    if (revoke.status === 404) {
+        // Only the real handler's not-found means the key row is already gone. A
+        // control plane without the revoke route (an older or self-hosted build)
+        // answers a bare 404 too, and trusting that would report a clean logout
+        // while the key stays live.
+        return (await responseErrorCode(revoke)) === "api_key_not_found"
+            ? { kind: "already_invalid" }
+            : { kind: "failed", reason: "the control plane answered 404 for the revoke route — it may not support revocation" };
+    }
+    return { kind: "failed", reason: `the control plane answered ${revoke.status}` };
+}
+// Worst-first, so one credential's success can never mask another's unresolved
+// state: a machine holding both a revoked production key and an issuerless one
+// the guess rejected has NOT been fully logged out, and reporting the success
+// would delete the second copy while it may still authenticate somewhere.
+export function summarizeRevocations(attempts) {
+    const failed = attempts.find((attempt) => attempt.outcome.kind === "failed");
+    if (failed && failed.outcome.kind === "failed") {
+        return { kind: "failed", reason: failed.outcome.reason };
+    }
+    const unproven = attempts.find((attempt) => !attempt.issuerKnown && attempt.outcome.kind === "already_invalid");
+    if (unproven) {
+        return { kind: "unproven", apiUrl: unproven.apiUrl };
+    }
+    return attempts.some((attempt) => attempt.outcome.kind === "revoked") ? { kind: "revoked" } : { kind: "already_invalid" };
+}
+function revocationFailureReason(error) {
+    // AbortSignal.timeout surfaces as a TimeoutError whose message ("The
+    // operation was aborted due to timeout") names neither the duration nor the
+    // request — say what actually ran out.
+    if (error instanceof Error && error.name === "TimeoutError") {
+        return `the control plane did not answer within ${REVOKE_TIMEOUT_MS / 1000}s`;
+    }
+    return error instanceof Error ? error.message : String(error);
+}
+// The ONLY refusal that proves anything about the stored credential:
+// requireAuth emits invalid_api_key after looking the presented token up
+// (src/server/routes/guards.ts). Its siblings do not — missing_api_key means no
+// credential arrived at all and malformed_api_key means the header was not a
+// bearer token, both of which a proxy that strips or rewrites Authorization
+// produces for a perfectly live key. Anything else answering 401/403 is an
+// intermediary rather than the control plane judging this credential.
+async function isAuthRefusal(response) {
+    return (await responseErrorCode(response)) === "invalid_api_key";
+}
+// The `code` from the control plane's {error:{code}} envelope, or "" when the
+// body is not that shape (proxy error page, empty body).
+async function responseErrorCode(response) {
+    try {
+        const parsed = (await response.json());
+        return typeof parsed.error?.code === "string" ? parsed.error.code : "";
+    }
+    catch {
+        return "";
+    }
+}
 async function doctor(options) {
     const credentials = credentialDiagnostics();
     const token = process.env.NINEPM_API_KEY ?? readStoredCredential();
@@ -991,6 +1120,9 @@ async function deviceAuthFlow(options) {
             progress.stop();
             const storage = (options.storeCredentialFn ?? storeCredential)(poll.token, {
                 allowFileFallback: options.allowFileCredentialStore,
+                // Recorded so logout can revoke against the control plane that issued
+                // this credential rather than whatever URL it resolves later.
+                apiUrl,
             });
             const me = await whoami({ apiUrl, token: poll.token, fetchFn });
             return { email: me.user.email, storage };
@@ -1753,7 +1885,18 @@ export function parseArgs(argv) {
         return { kind: "signup", apiUrl: readApiUrl(flags, DEFAULT_API_URL), allowFileCredentialStore: flags.has("allow-file-credential-store") };
     }
     if (command === "logout") {
-        return { kind: "logout" };
+        const flags = parseFlags(argv);
+        const local = flags.has("local");
+        const explicit = readStringFlag(flags, "api-url") ?? process.env.NINEPM_API_URL;
+        if (!explicit) {
+            return { kind: "logout", apiUrl: null, local };
+        }
+        try {
+            return { kind: "logout", apiUrl: validateApiUrl(explicit), local };
+        }
+        catch (error) {
+            return { kind: "logout", apiUrl: null, local, apiUrlError: error instanceof Error ? error.message : String(error) };
+        }
     }
     if (command === "whoami") {
         const flags = parseFlags(argv);
@@ -2240,11 +2383,52 @@ async function runLogsCommand(command) {
         for (const line of lines) {
             console.log(line);
         }
+    }
+    // #820: the SERVING deployment's runtime half — restart/exit summary plus
+    // recent app output. The serving deployment can differ from the
+    // failure-diagnostics one above (a queued or failed replacement is newer),
+    // so the section names whose runtime it describes.
+    const servingLabel = result.runtimeDeployment && result.runtimeDeployment.id !== deployment.id
+        ? ` (serving deployment ${result.runtimeDeployment.id})`
+        : "";
+    if (result.runtime && (result.runtime.restartCount > 0 || result.runtime.lastExitCode !== null)) {
+        const parts = [`restarts: ${result.runtime.restartCount}`];
+        if (result.runtime.lastExitCode !== null)
+            parts.push(`last exit code: ${result.runtime.lastExitCode}`);
+        if (result.runtime.lastExitAt)
+            parts.push(`last exit: ${result.runtime.lastExitAt}`);
+        console.log("");
+        console.log(`Runtime${servingLabel}: ${parts.join("\t")}`);
+    }
+    if (result.runtimeLogs) {
+        let lines = result.runtimeLogs.split("\n");
+        if (command.lines !== undefined) {
+            lines = lines.slice(-command.lines);
+        }
+        console.log("");
+        console.log(`Recent runtime log${servingLabel}:`);
+        for (const line of lines) {
+            console.log(line);
+        }
+        return;
+    }
+    if (result.runtimeLogsUnavailable) {
+        const copy = {
+            placement_unsupported: "Runtime logs are not yet available for this app's placement.",
+            not_configured: "Runtime logs are not configured on this platform.",
+            nothing_retained: "No recent runtime output is retained for the serving deployment.",
+            provider_unavailable: "Runtime logs are temporarily unavailable; try again shortly.",
+        };
+        console.log("");
+        console.log(copy[result.runtimeLogsUnavailable] ?? "Runtime logs are unavailable.");
+        return;
+    }
+    if (result.logs) {
         return;
     }
     console.log(deployment.status === "failed"
         ? "No detailed logs were captured for this failure."
-        : "No logs recorded. Logs are captured when a deployment fails to come up; a runtime failure on a deployment reported active is not yet captured here.");
+        : "No logs recorded. Logs are captured when a deployment fails to come up.");
 }
 function parseLogsArgs(argv) {
     const site = argv[0];
@@ -2571,6 +2755,11 @@ function credentialMetadataPath() {
 function windowsCredentialPath() {
     return path.join(credentialConfigDir(), WINDOWS_CREDENTIAL_FILE);
 }
+// DPAPI-protected like the token beside it, so tampering with it requires the
+// same user context rather than plain write access to the directory.
+function windowsIssuerPath() {
+    return path.join(credentialConfigDir(), WINDOWS_ISSUER_FILE);
+}
 function plaintextCredentialPath() {
     return path.join(credentialConfigDir(), PLAINTEXT_CREDENTIAL_FILE);
 }
@@ -2588,26 +2777,107 @@ function readStoredCredential() {
     }
     return plaintext.token;
 }
+// Every distinct token logout is about to delete, from every store the delete
+// will touch. Reads without side effects — readStoredCredential() migrates a
+// legacy plaintext file into the keychain, pointless work one statement before
+// deletion. Two stores can hold two different live tokens (a file-fallback
+// login followed by a native-store one); each needs its own revocation or
+// logout silently orphans one — the leak #822 is about.
+export function storedCredentialTokens() {
+    // Each store reports its own issuer, carried with the token rather than read
+    // from the shared metadata file: two stores can hold credentials from two
+    // different control planes (a file-fallback staging login followed by a
+    // keychain production login), and a key can only be revoked where it was
+    // issued — a foreign plane answers 403, which reads as "already invalid".
+    const entries = [];
+    const secure = readSecureCredentialEntry();
+    if (secure) {
+        entries.push(secure);
+    }
+    // BOTH plaintext files, not just the first that parses: the current file and
+    // the legacy one can hold different tokens (a fallback login here, then one
+    // from a still-installed older CLI), and deleteStoredCredential removes both
+    // — so revoking only the first would discard the other while it is still live.
+    for (const plaintext of readPlaintextCredentials()) {
+        if (entries.some((entry) => entry.token === plaintext.token)) {
+            continue;
+        }
+        // The plaintext file's own body: no less protected than the token it sits
+        // next to, and immune to a later login through the other store.
+        entries.push({ token: plaintext.token, apiUrl: safeApiUrl(plaintext.apiUrl) });
+    }
+    return entries;
+}
+// Whether a protected credential was ever stored from this config directory.
+// Read from the unprotected metadata file, which is safe here because the
+// answer only decides whether to WARN — it never selects a destination for a
+// token. Reads the sticky flag as well as the last-login backend, so a later
+// file-fallback login cannot erase the evidence.
+//
+// Best-effort by construction: the metadata file is per-config-directory while
+// the OS store is machine-wide, so a credential stored under a different
+// XDG_CONFIG_HOME is invisible here. Confirming it would mean querying the very
+// store the caller asked this process not to touch (and on macOS risking an
+// unlock prompt in the CI runs that variable exists for), so absent evidence
+// stays silent rather than warning every file-only logout about a credential
+// the machine may not have.
+function nativeCredentialMayExist() {
+    try {
+        const parsed = JSON.parse(readFileSync(credentialMetadataPath(), "utf8"));
+        return parsed.nativeCredentialStored === true || (typeof parsed.backend === "string" && isNativeBackend(parsed.backend));
+    }
+    catch {
+        return false;
+    }
+}
+// Validated because the metadata and plaintext files sit unprotected on disk
+// and a tampered URL must not receive the bearer token. Invalid or absent
+// (pre-0.42 logins never recorded one) reads as undefined.
+function safeApiUrl(value) {
+    if (!value) {
+        return undefined;
+    }
+    try {
+        return validateApiUrl(value);
+    }
+    catch {
+        return undefined;
+    }
+}
 function storeCredential(token, options = {}) {
-    const secure = storeSecureCredential(token);
+    const secure = storeSecureCredential(token, options.apiUrl);
     if (secure) {
         return secure;
     }
     if (!isFileCredentialStoreAllowed(options.allowFileFallback)) {
         throw new Error(`Secure credential storage is unavailable. Re-run with --allow-file-credential-store or set ${ALLOW_FILE_CREDENTIAL_STORE_ENV}=1 to store a plaintext fallback file.`);
     }
-    return storePlaintextCredential(token);
+    return storePlaintextCredential(token, options.apiUrl);
 }
 function deleteStoredCredential() {
+    // Honor the native-store opt-out on delete as well as read/store: a process
+    // told not to touch the OS keychain cannot see a keychain credential, so
+    // deleting it would wipe a token that was never revoked.
+    // Preserved when the protected store is skipped: the credential there is
+    // untouched, so the record that it exists must outlive this deletion or the
+    // NEXT logout has nothing left to warn from.
+    const keepNativeMarker = isNativeCredentialStoreDisabled() && nativeCredentialMayExist();
+    const nativeRemovals = isNativeCredentialStoreDisabled()
+        ? []
+        : [deleteMacKeychainCredential(), deleteWindowsDpapiCredential(), deleteLinuxSecretServiceCredential(), deleteSecureIssuer()];
     const removed = [
-        deleteMacKeychainCredential(),
-        deleteWindowsDpapiCredential(),
-        deleteLinuxSecretServiceCredential(),
+        ...nativeRemovals,
         removeFileIfExists(credentialMetadataPath()),
-        removeFileIfExists(windowsCredentialPath()),
+        // windowsCredentialPath() is deliberately NOT removed here: it IS the DPAPI
+        // store, so deleteWindowsDpapiCredential owns it. Removing it again outside
+        // the guard above would delete a Windows credential that this process was
+        // told not to touch, and therefore never read or revoked.
         removeFileIfExists(plaintextCredentialPath()),
         removeFileIfExists(legacyCredentialPath()),
     ];
+    if (keepNativeMarker) {
+        writeCredentialMetadata("none", {}, true);
+    }
     return removed.some(Boolean);
 }
 export function credentialDiagnostics() {
@@ -2648,34 +2918,157 @@ export function credentialDiagnostics() {
     };
 }
 function readSecureCredential() {
+    return readSecureCredentialEntry()?.token;
+}
+// The issuer is not a secret, but it decides where a full-scope bearer token
+// gets sent, so it needs the same INTEGRITY protection as the token itself: the
+// metadata file beside it is unprotected, and trusting that to name the
+// destination would make "can write to the home directory" enough to redirect
+// the token to a host of the attacker's choosing — handing out a key the
+// keychain exists to keep unreadable.
+//
+// It is kept as a SEPARATE item rather than wrapped around the token, because
+// the token slot is shared with every other 9pm CLI on the machine: a payload
+// there would be read whole and sent as the bearer by any pre-0.42 CLI (this
+// repo's own `npm run cli` next to a global `ninepm`), failing with a
+// malformed-token error that names nothing. An absent item — every credential
+// stored before 0.42 — reads as an unknown issuer.
+function readSecureCredentialEntry() {
     if (isNativeCredentialStoreDisabled()) {
         return undefined;
     }
+    const token = process.platform === "darwin"
+        ? readMacKeychainCredential()
+        : process.platform === "win32"
+            ? readWindowsDpapiCredential()
+            : process.platform === "linux"
+                ? readLinuxSecretServiceCredential()
+                : undefined;
+    return token ? { token, apiUrl: safeApiUrl(readSecureIssuer(token)) } : undefined;
+}
+// The issuer is bound to the exact token it was recorded for, by fingerprint.
+// Two 9pm CLIs share the token slot, and a pre-0.42 one knows nothing about the
+// issuer item: it overwrites the token and leaves the issuer behind, pairing
+// values written by different logins. Without this check a production token
+// would inherit a staging issuer, be sent there, and staging's invalid_api_key
+// would be read as conclusive — a silent clean logout for a live key. A
+// mismatch reads as no issuer, which logout refuses to guess past.
+function readSecureIssuer(token) {
+    const raw = process.platform === "darwin"
+        ? readMacKeychainCredential(ISSUER_ACCOUNT)
+        : process.platform === "win32"
+            ? readWindowsDpapiCredential(windowsIssuerPath())
+            : process.platform === "linux"
+                ? readLinuxSecretServiceCredential(ISSUER_ACCOUNT)
+                : undefined;
+    if (!raw) {
+        return undefined;
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.apiUrl === "string" && parsed.token === tokenFingerprint(token)) {
+            return parsed.apiUrl;
+        }
+    }
+    catch {
+        // Not the fingerprinted shape (a 0.42.0-dev item) — unusable, so unknown.
+    }
+    return undefined;
+}
+function storeSecureIssuer(apiUrl, token) {
+    return storeSecureIssuerRaw(JSON.stringify({ apiUrl, token: tokenFingerprint(token) }));
+}
+// The stored item verbatim, so a failed token write can put back exactly what
+// was there — including its fingerprint, which still matches the token that
+// remains in the store.
+function readSecureIssuerRaw() {
     if (process.platform === "darwin") {
-        return readMacKeychainCredential();
+        return readMacKeychainCredential(ISSUER_ACCOUNT);
     }
     if (process.platform === "win32") {
-        return readWindowsDpapiCredential();
+        return readWindowsDpapiCredential(windowsIssuerPath());
     }
     if (process.platform === "linux") {
-        return readLinuxSecretServiceCredential();
+        return readLinuxSecretServiceCredential(ISSUER_ACCOUNT);
     }
     return undefined;
 }
-function storeSecureCredential(token) {
+function storeSecureIssuerRaw(payload) {
+    if (process.platform === "darwin") {
+        return storeMacKeychainCredential(payload, ISSUER_ACCOUNT);
+    }
+    if (process.platform === "win32") {
+        return storeWindowsDpapiCredential(payload, windowsIssuerPath());
+    }
+    if (process.platform === "linux") {
+        return storeLinuxSecretServiceCredential(payload, ISSUER_ACCOUNT);
+    }
+    return false;
+}
+// Identifies which token an issuer was recorded for without storing a second
+// copy of the secret.
+function tokenFingerprint(token) {
+    return createHash("sha256").update(token).digest("hex");
+}
+function deleteSecureIssuer() {
+    if (process.platform === "darwin") {
+        return deleteMacKeychainCredential(ISSUER_ACCOUNT);
+    }
+    if (process.platform === "win32") {
+        return removeFileIfExists(windowsIssuerPath());
+    }
+    if (process.platform === "linux") {
+        return deleteLinuxSecretServiceCredential(ISSUER_ACCOUNT);
+    }
+    return false;
+}
+function storeSecureCredential(token, apiUrl) {
     if (isNativeCredentialStoreDisabled()) {
         return undefined;
     }
-    if (process.platform === "darwin" && storeMacKeychainCredential(token)) {
-        writeCredentialMetadata("macos-keychain");
+    // The previous login's issuer is cleared BEFORE the new token is written, so
+    // the two are never observable as a mismatched pair: a token sent to the
+    // wrong control plane at logout gets a 403 that reads as "already invalid"
+    // while the key stays live at its real issuer. The window this leaves is the
+    // safe one — a token with no issuer — which logout refuses to guess past.
+    // If the token write then fails, the OLD token is still in the store, so its
+    // issuer is put back rather than left erased.
+    const previousIssuer = readSecureIssuerRaw();
+    deleteSecureIssuer();
+    const origin = apiUrl ? { apiUrl } : {};
+    const recordIssuer = () => {
+        if (apiUrl && !storeSecureIssuer(apiUrl, token)) {
+            console.warn("Warning: could not record which control plane issued this credential. 9pm logout will not be able to revoke it without --api-url.");
+        }
+    };
+    const restorePreviousIssuer = () => {
+        if (previousIssuer) {
+            storeSecureIssuerRaw(previousIssuer);
+        }
+        return undefined;
+    };
+    if (process.platform === "darwin") {
+        if (!storeMacKeychainCredential(token)) {
+            return restorePreviousIssuer();
+        }
+        recordIssuer();
+        writeCredentialMetadata("macos-keychain", origin);
         return "macOS Keychain";
     }
-    if (process.platform === "win32" && storeWindowsDpapiCredential(token)) {
-        writeCredentialMetadata("windows-dpapi", { secretPath: windowsCredentialPath() });
+    if (process.platform === "win32") {
+        if (!storeWindowsDpapiCredential(token)) {
+            return restorePreviousIssuer();
+        }
+        recordIssuer();
+        writeCredentialMetadata("windows-dpapi", { secretPath: windowsCredentialPath(), ...origin });
         return "Windows DPAPI";
     }
-    if (process.platform === "linux" && storeLinuxSecretServiceCredential(token)) {
-        writeCredentialMetadata("linux-secret-service");
+    if (process.platform === "linux") {
+        if (!storeLinuxSecretServiceCredential(token)) {
+            return restorePreviousIssuer();
+        }
+        recordIssuer();
+        writeCredentialMetadata("linux-secret-service", origin);
         return "Linux Secret Service";
     }
     return undefined;
@@ -2695,44 +3088,82 @@ function preferredCredentialBackend() {
     }
     return "none";
 }
-function writeCredentialMetadata(backend, extra = {}) {
+// forceNativeMarker carries the sticky flag across a rewrite that follows the
+// metadata file's deletion, where it can no longer be read back.
+function writeCredentialMetadata(backend, extra = {}, forceNativeMarker = false) {
     const filePath = credentialMetadataPath();
     mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
+    // This file is diagnostics only. Its `apiUrl` records where the credential
+    // came from for a human reading it (and for `9pm doctor`), and is deliberately
+    // NEVER read to decide where a token is sent: the file is unprotected, so
+    // trusting it would make "can write to the home directory" enough to redirect
+    // a bearer token. Each store carries its own issuer with the token instead.
+    // `nativeCredentialStored` is sticky: `backend` names only the LAST login, so
+    // a file-fallback login would otherwise erase the record that a protected
+    // credential was ever stored — the one thing that lets logout warn when it
+    // has been told to skip that store. Cleared only by deleting this file, which
+    // happens alongside a real native deletion.
+    const nativeCredentialStored = forceNativeMarker || isNativeBackend(backend) || readNativeCredentialStoredFlag();
     writeFileSync(filePath, `${JSON.stringify({
         backend,
         service: TOKEN_SERVICE,
         account: TOKEN_ACCOUNT,
         updatedAt: new Date().toISOString(),
         ...extra,
+        ...(nativeCredentialStored ? { nativeCredentialStored } : {}),
     }, null, 2)}\n`, { mode: 0o600 });
     chmodIfSupported(filePath, 0o600);
 }
-function storePlaintextCredential(token) {
+function isNativeBackend(backend) {
+    return backend === "macos-keychain" || backend === "windows-dpapi" || backend === "linux-secret-service";
+}
+function readNativeCredentialStoredFlag() {
+    try {
+        const parsed = JSON.parse(readFileSync(credentialMetadataPath(), "utf8"));
+        return parsed.nativeCredentialStored === true;
+    }
+    catch {
+        return false;
+    }
+}
+function storePlaintextCredential(token, apiUrl) {
     const filePath = plaintextCredentialPath();
     mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
     writeFileSync(filePath, `${JSON.stringify({
         token,
+        ...(apiUrl ? { apiUrl } : {}),
         warning: "Plaintext fallback credential. Prefer OS-protected credential storage.",
     }, null, 2)}\n`, { mode: 0o600 });
     chmodIfSupported(filePath, 0o600);
-    writeCredentialMetadata("file-plaintext", { plaintextPath: filePath });
+    writeCredentialMetadata("file-plaintext", { plaintextPath: filePath, ...(apiUrl ? { apiUrl } : {}) });
     console.warn(`Warning: stored credential in plaintext fallback file ${filePath} with mode 0600 where supported.`);
     return filePath;
 }
+// The highest-precedence plaintext credential — what the CLI authenticates
+// with. Logout needs every one of them instead; see readPlaintextCredentials.
 function readPlaintextCredential() {
+    return readPlaintextCredentials()[0];
+}
+function readPlaintextCredentials() {
     const candidates = [plaintextCredentialPath(), legacyCredentialPath()].filter((candidate, index, list) => list.indexOf(candidate) === index);
+    const found = [];
     for (const filePath of candidates) {
         try {
             const parsed = JSON.parse(readFileSync(filePath, "utf8"));
             if (typeof parsed.token === "string" && parsed.token) {
-                return { token: parsed.token, path: filePath, legacy: filePath === legacyCredentialPath() };
+                found.push({
+                    token: parsed.token,
+                    path: filePath,
+                    legacy: filePath === legacyCredentialPath(),
+                    ...(typeof parsed.apiUrl === "string" && parsed.apiUrl ? { apiUrl: parsed.apiUrl } : {}),
+                });
             }
         }
         catch {
             continue;
         }
     }
-    return undefined;
+    return found;
 }
 function migrateLegacyPlaintextCredential(credential) {
     const secure = storeSecureCredential(credential.token);
@@ -2766,33 +3197,33 @@ function removeFileIfExists(filePath) {
     rmSync(filePath, { force: true });
     return true;
 }
-function readMacKeychainCredential() {
+function readMacKeychainCredential(account = TOKEN_ACCOUNT) {
     if (process.platform !== "darwin") {
         return undefined;
     }
-    const result = spawnSync("security", ["find-generic-password", "-a", TOKEN_ACCOUNT, "-s", TOKEN_SERVICE, "-w"], { encoding: "utf8" });
+    const result = spawnSync("security", ["find-generic-password", "-a", account, "-s", TOKEN_SERVICE, "-w"], { encoding: "utf8" });
     return result.status === 0 ? result.stdout.trim() || undefined : undefined;
 }
-function storeMacKeychainCredential(token) {
+function storeMacKeychainCredential(value, account = TOKEN_ACCOUNT) {
     if (process.platform !== "darwin") {
         return false;
     }
-    const result = spawnSync("security", ["add-generic-password", "-a", TOKEN_ACCOUNT, "-s", TOKEN_SERVICE, "-w", token, "-U"], { encoding: "utf8" });
+    const result = spawnSync("security", ["add-generic-password", "-a", account, "-s", TOKEN_SERVICE, "-w", value, "-U"], { encoding: "utf8" });
     return result.status === 0;
 }
-function deleteMacKeychainCredential() {
+function deleteMacKeychainCredential(account = TOKEN_ACCOUNT) {
     if (process.platform !== "darwin") {
         return false;
     }
-    const result = spawnSync("security", ["delete-generic-password", "-a", TOKEN_ACCOUNT, "-s", TOKEN_SERVICE], { encoding: "utf8" });
+    const result = spawnSync("security", ["delete-generic-password", "-a", account, "-s", TOKEN_SERVICE], { encoding: "utf8" });
     return result.status === 0;
 }
-function readWindowsDpapiCredential() {
+function readWindowsDpapiCredential(filePath = windowsCredentialPath()) {
     if (process.platform !== "win32") {
         return undefined;
     }
     try {
-        const encrypted = readFileSync(windowsCredentialPath(), "utf8").trim();
+        const encrypted = readFileSync(filePath, "utf8").trim();
         if (!encrypted) {
             return undefined;
         }
@@ -2810,7 +3241,7 @@ $plain = [Security.Cryptography.ProtectedData]::Unprotect($bytes, $null, [Securi
         return undefined;
     }
 }
-function storeWindowsDpapiCredential(token) {
+function storeWindowsDpapiCredential(value, targetPath = windowsCredentialPath()) {
     if (process.platform !== "win32") {
         return false;
     }
@@ -2821,11 +3252,11 @@ $plain = [Console]::In.ReadToEnd()
 $bytes = [Text.Encoding]::UTF8.GetBytes($plain)
 $protected = [Security.Cryptography.ProtectedData]::Protect($bytes, $null, [Security.Cryptography.DataProtectionScope]::CurrentUser)
 [Console]::Out.Write([Convert]::ToBase64String($protected))
-`, token);
+`, value);
     if (result.status !== 0 || !result.stdout.trim()) {
         return false;
     }
-    const filePath = windowsCredentialPath();
+    const filePath = targetPath;
     mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
     writeFileSync(filePath, `${result.stdout.trim()}\n`, { mode: 0o600 });
     chmodIfSupported(filePath, 0o600);
@@ -2859,28 +3290,29 @@ function hasLinuxSecretTool() {
     const result = spawnSync("secret-tool", ["--version"], { encoding: "utf8" });
     return !result.error && result.status === 0;
 }
-function readLinuxSecretServiceCredential() {
+function readLinuxSecretServiceCredential(account = TOKEN_ACCOUNT) {
     if (process.platform !== "linux" || !hasLinuxSecretTool()) {
         return undefined;
     }
-    const result = spawnSync("secret-tool", ["lookup", "service", TOKEN_SERVICE, "account", TOKEN_ACCOUNT], { encoding: "utf8" });
+    const result = spawnSync("secret-tool", ["lookup", "service", TOKEN_SERVICE, "account", account], { encoding: "utf8" });
     return result.status === 0 ? result.stdout.trim() || undefined : undefined;
 }
-function storeLinuxSecretServiceCredential(token) {
+function storeLinuxSecretServiceCredential(value, account = TOKEN_ACCOUNT) {
     if (process.platform !== "linux" || !hasLinuxSecretTool()) {
         return false;
     }
-    const result = spawnSync("secret-tool", ["store", "--label", "9pm.ai API token", "service", TOKEN_SERVICE, "account", TOKEN_ACCOUNT], {
-        input: token,
+    const label = account === TOKEN_ACCOUNT ? "9pm.ai API token" : "9pm.ai API token issuer";
+    const result = spawnSync("secret-tool", ["store", "--label", label, "service", TOKEN_SERVICE, "account", account], {
+        input: value,
         encoding: "utf8",
     });
     return result.status === 0;
 }
-function deleteLinuxSecretServiceCredential() {
+function deleteLinuxSecretServiceCredential(account = TOKEN_ACCOUNT) {
     if (process.platform !== "linux" || !hasLinuxSecretTool()) {
         return false;
     }
-    const result = spawnSync("secret-tool", ["clear", "service", TOKEN_SERVICE, "account", TOKEN_ACCOUNT], { encoding: "utf8" });
+    const result = spawnSync("secret-tool", ["clear", "service", TOKEN_SERVICE, "account", account], { encoding: "utf8" });
     return result.status === 0;
 }
 // Pure and exported so the per-platform mapping is unit-testable without
@@ -3049,8 +3481,137 @@ async function main() {
             return;
         }
         if (command.kind === "logout") {
-            const removed = deleteStoredCredential();
-            console.log(removed ? "Logged out." : "No stored credential found.");
+            // Revoke before deleting: once the local copies are gone the tokens can
+            // never be revoked from this machine again. The local delete then happens
+            // on every path — a credential that outlives logout on disk is strictly
+            // worse than one that outlives it server-side (#822 is about the latter).
+            const stored = storedCredentialTokens();
+            // Removal is only done when no store hands a token back. The per-store
+            // deletes can partially fail (a locked keychain) while the metadata file
+            // is removed, and reporting that as success would tell someone a live
+            // credential is gone from a machine that still holds it.
+            const clearLocalCredential = () => {
+                deleteStoredCredential();
+                return storedCredentialTokens().length === 0;
+            };
+            // A skipped protected store makes ANY logout incomplete, including one
+            // that successfully revoked a plaintext credential sitting beside it: the
+            // protected token was neither read, revoked, nor removed, and every later
+            // command run without this variable set will use it. Computed before
+            // anything is deleted, since it reads the metadata file.
+            const skippedNativeStore = isNativeCredentialStoreDisabled() && nativeCredentialMayExist();
+            const reportSkippedNativeStore = () => {
+                console.error(`${DISABLE_NATIVE_CREDENTIAL_STORE_ENV} is set, so the protected credential store was skipped: a credential stored there was neither revoked nor removed.`);
+                console.error(`Unset ${DISABLE_NATIVE_CREDENTIAL_STORE_ENV} and run 9pm logout again to retire it.`);
+                process.exitCode = 1;
+            };
+            if (stored.length === 0) {
+                const removedLeftovers = deleteStoredCredential();
+                if (skippedNativeStore) {
+                    reportSkippedNativeStore();
+                    return;
+                }
+                console.log(removedLeftovers ? "Removed leftover credential files; no readable credential was stored." : "No stored credential found.");
+                return;
+            }
+            // Resolved PER TOKEN, not once: two stores can hold credentials from two
+            // different control planes, and a key can only be revoked where it was
+            // issued. The issuer recorded with the credential wins — it is what
+            // minted the key, and an exported NINEPM_API_URL pointing somewhere else
+            // (routine on a dev machine) would otherwise send a production token to
+            // staging and read the resulting 403 as a clean logout. --api-url and
+            // NINEPM_API_URL name the plane only for credentials that recorded none
+            // (stored before 0.42); `issuerKnown` is false when nobody stated one and
+            // the CLI fell back to the default.
+            const targets = stored.map((entry) => ({
+                token: entry.token,
+                apiUrl: entry.apiUrl ?? command.apiUrl ?? DEFAULT_API_URL,
+                issuerKnown: Boolean(entry.apiUrl ?? command.apiUrl),
+            }));
+            if (command.local) {
+                const cleared = clearLocalCredential();
+                if (cleared) {
+                    console.log("Removed the stored credential from this machine without revoking it. It can still authenticate.");
+                }
+                else {
+                    console.error("The credential could not be removed (is the OS keychain locked?) and remains on this machine.");
+                    process.exitCode = 1;
+                }
+                if (skippedNativeStore) {
+                    reportSkippedNativeStore();
+                }
+                return;
+            }
+            const results = [];
+            for (const target of targets) {
+                // A malformed --api-url/NINEPM_API_URL only sinks the credentials that
+                // NEED it — the ones that recorded no issuer of their own. One that
+                // carries a trusted issuer is revoked there regardless, rather than
+                // being deleted unrevoked because an unused override failed to parse.
+                if (!target.issuerKnown && command.apiUrlError) {
+                    results.push({ ...target, outcome: { kind: "failed", reason: command.apiUrlError } });
+                    continue;
+                }
+                results.push({ ...target, outcome: await revokeCredential({ apiUrl: target.apiUrl, token: target.token }) });
+            }
+            const summary = summarizeRevocations(results);
+            const removedLocally = clearLocalCredential();
+            const removalWarning = removedLocally
+                ? null
+                : "Warning: the local credential copy could not be removed (is the OS keychain locked?) and remains on this machine.";
+            if (!removedLocally) {
+                // Even after a successful revoke: the credential is dead but still on
+                // the machine, so later commands load it and fail to authenticate.
+                // Logout did not finish, and a script must not read that as success.
+                process.exitCode = 1;
+            }
+            if (summary.kind === "revoked") {
+                console.log("Logged out. The credential was revoked and can no longer authenticate.");
+                if (removalWarning) {
+                    console.warn(removalWarning);
+                }
+            }
+            else if (summary.kind === "unproven") {
+                // Logout still happens — refusing would block the ordinary upgrade
+                // path, where a pre-0.42 credential really was issued by the default
+                // plane and really is dead — but it cannot be called confirmed.
+                console.error(`Removed the local credential, but could not confirm it was revoked: ${summary.apiUrl} does not recognise it.`);
+                console.error("An older CLI stored it without recording which control plane issued it. If you used another control plane, revoke it under Connected devices there.");
+                if (removalWarning) {
+                    console.warn(removalWarning);
+                }
+                process.exitCode = 1;
+            }
+            else if (summary.kind === "already_invalid") {
+                // "Rejects" rather than "was revoked": the control plane answers the
+                // same 403 for an expired, revoked, or suspended-account credential,
+                // and only the first two are permanent. Nothing can be revoked from
+                // here in any of the three — the revoke route needs the same
+                // authentication the server just refused.
+                console.log("Logged out. The server already rejects this credential; nothing to revoke from here.");
+                if (removalWarning) {
+                    console.warn(removalWarning);
+                }
+            }
+            else {
+                // Deliberate partial outcome, exit 1: "logged out" would be a lie — a
+                // live full-scope token remains on the account, and only the user can
+                // retire it now.
+                console.error(removedLocally
+                    ? `Removed the local credential, but could not revoke it (${summary.reason}).`
+                    : `Could not revoke the credential (${summary.reason}), and the local copy could not be removed.`);
+                // Only name the production dashboard when every credential belongs to
+                // it; a staging or self-hosted key cannot be revoked there, and a
+                // rejected URL leaves the origin unknown.
+                const settingsHint = !command.apiUrlError && targets.every((target) => target.apiUrl === DEFAULT_API_URL)
+                    ? `Revoke it under Connected devices: ${PUBLIC_DASHBOARD_URL}/settings`
+                    : "Revoke it under Connected devices in its control plane's dashboard settings.";
+                console.error(`It can still authenticate. ${settingsHint}`);
+                process.exitCode = 1;
+            }
+            if (skippedNativeStore) {
+                reportSkippedNativeStore();
+            }
             return;
         }
         if (command.kind === "doctor") {
@@ -3320,7 +3881,7 @@ function printUsage() {
   9pm deploy [directory] --check
   9pm signup
   9pm login
-  9pm logout
+  9pm logout [--api-url <url>] [--local]   revokes the credential server-side, then removes it from this machine (--local skips the revoke)
   9pm doctor [--json]
   9pm whoami [--json]
   9pm apps [--json]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ninepm",
-  "version": "0.41.0",
+  "version": "0.43.0",
   "description": "CLI for deploying built apps to 9pm.ai.",
   "homepage": "https://9pm.ai",
   "keywords": [