@doist/outline-cli 1.5.3 → 1.7.0

package/dist/lib/auth-constants.js

@@ -0,0 +1,25 @@
+/** OS keyring `service` identifier for every outline-cli secret. */
+export const SECURE_STORE_SERVICE = 'outline-cli';
+/** Env var that short-circuits the token store with a manually-supplied token. */
+export const TOKEN_ENV_VAR = 'OUTLINE_API_TOKEN';
+/**
+ * Legacy single-user keyring slot. Outline never wrote a token to the
+ * keyring before this migration, so there is no real legacy slot to read —
+ * `migrateLegacyAuth` still expects the option, and its best-effort delete
+ * after migration is a harmless no-op on an empty entry.
+ */
+export const LEGACY_KEYRING_ACCOUNT = 'api-token';
+/**
+ * `updateConfig` payload that wipes every v1 auth key. Used by both the
+ * one-shot migration `cleanupLegacyConfig` and the runtime
+ * `dischargeLegacyState` so both paths stay in lockstep.
+ */
+export const LEGACY_CLEAR_PAYLOAD = {
+    api_token: undefined,
+    base_url: undefined,
+    oauth_client_id: undefined,
+    auth_user_id: undefined,
+    auth_user_name: undefined,
+    auth_team_name: undefined,
+};
+//# sourceMappingURL=auth-constants.js.map

package/dist/lib/auth-constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-constants.js","sourceRoot":"","sources":["../../src/lib/auth-constants.ts"],"names":[],"mappings":"AAEA,oEAAoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAA;AAEjD,kFAAkF;AAClF,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAA;AAEhD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAA;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAoB;IACjD,SAAS,EAAE,SAAS;IACpB,QAAQ,EAAE,SAAS;IACnB,eAAe,EAAE,SAAS;IAC1B,YAAY,EAAE,SAAS;IACvB,cAAc,EAAE,SAAS;IACzB,cAAc,EAAE,SAAS;CAC5B,CAAA"}

package/dist/lib/auth-pages.d.ts

@@ -0,0 +1,2 @@
+export declare function renderSuccess(): string;
+export declare function renderError(message: string): string;

package/dist/lib/auth-pages.js

@@ -0,0 +1,101 @@
+function escapeHtml(text) {
+    return text
+        .replaceAll('&', '&')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;')
+        .replaceAll('"', '&quot;')
+        .replaceAll("'", '&#39;');
+}
+function renderPage(title, subtitle, body) {
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>${escapeHtml(title)} - Outline CLI</title>
+  <style>
+    :root {
+      --bg: #f5f7fb;
+      --surface: #ffffff;
+      --border: #e6e9f0;
+      --text: #1e2430;
+      --muted: #586178;
+      --ok: #15803d;
+      --ok-soft: #dcfce7;
+      --err: #b91c1c;
+      --err-soft: #fee2e2;
+      --radius: 14px;
+    }
+    * { box-sizing: border-box; }
+    body {
+      margin: 0;
+      min-height: 100vh;
+      display: grid;
+      place-items: center;
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+      background: radial-gradient(1200px 500px at 50% -10%, #dbeafe 0%, var(--bg) 60%);
+      color: var(--text);
+      line-height: 1.5;
+      padding: 20px;
+    }
+    .card {
+      width: min(560px, 100%);
+      background: var(--surface);
+      border: 1px solid var(--border);
+      border-radius: var(--radius);
+      padding: 24px;
+      box-shadow: 0 16px 40px rgba(15, 23, 42, 0.08);
+    }
+    h1 {
+      margin: 0 0 8px;
+      font-size: 24px;
+      letter-spacing: -0.01em;
+    }
+    .subtitle {
+      margin: 0 0 16px;
+      color: var(--muted);
+      font-size: 15px;
+    }
+    .message {
+      border-radius: 12px;
+      padding: 14px 16px;
+      font-size: 14px;
+    }
+    .success {
+      background: var(--ok-soft);
+      color: #14532d;
+    }
+    .error {
+      background: var(--err-soft);
+      color: #7f1d1d;
+    }
+    .hint {
+      margin-top: 14px;
+      color: var(--muted);
+      font-size: 13px;
+    }
+    code {
+      font-family: ui-monospace, "SF Mono", Menlo, Consolas, monospace;
+      background: #eef2ff;
+      border-radius: 6px;
+      padding: 2px 6px;
+    }
+  </style>
+</head>
+<body>
+  <main class="card">
+    <h1>${escapeHtml(title)}</h1>
+    <p class="subtitle">${escapeHtml(subtitle)}</p>
+    ${body}
+    <p class="hint">Return to your terminal and continue with <code>ol</code> commands.</p>
+  </main>
+</body>
+</html>`;
+}
+export function renderSuccess() {
+    return renderPage('Login complete', 'Outline CLI is now authenticated.', '<div class="message success">You can close this tab now.</div>');
+}
+export function renderError(message) {
+    return renderPage('Authentication failed', 'Outline CLI could not finish OAuth login.', `<div class="message error">${escapeHtml(message)}</div>`);
+}
+//# sourceMappingURL=auth-pages.js.map

package/dist/lib/auth-pages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-pages.js","sourceRoot":"","sources":["../../src/lib/auth-pages.ts"],"names":[],"mappings":"AAAA,SAAS,UAAU,CAAC,IAAY;IAC5B,OAAO,IAAI;SACN,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;AACjC,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,QAAgB,EAAE,IAAY;IAC7D,OAAO;;;;;WAKA,UAAU,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAwElB,UAAU,CAAC,KAAK,CAAC;0BACD,UAAU,CAAC,QAAQ,CAAC;MACxC,IAAI;;;;QAIF,CAAA;AACR,CAAC;AAED,MAAM,UAAU,aAAa;IACzB,OAAO,UAAU,CACb,gBAAgB,EAChB,mCAAmC,EACnC,gEAAgE,CACnE,CAAA;AACL,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAe;IACvC,OAAO,UAAU,CACb,uBAAuB,EACvB,2CAA2C,EAC3C,8BAA8B,UAAU,CAAC,OAAO,CAAC,QAAQ,CAC5D,CAAA;AACL,CAAC"}

package/dist/lib/auth-provider.d.ts

@@ -0,0 +1,59 @@
+import { type AccountRef, type AuthProvider, type KeyringTokenStore } from '@doist/cli-core/auth';
+import { type OutlineAccount } from './outline-account.js';
+export type { OutlineAccount } from './outline-account.js';
+export type AuthInfoResponse = {
+    user: {
+        id: string;
+        name: string;
+        email: string;
+    };
+    team: {
+        name: string;
+        subdomain: string;
+    };
+};
+export type OutlineTokenStore = KeyringTokenStore<OutlineAccount>;
+export declare function createOutlineAuthProvider(): AuthProvider<OutlineAccount>;
+/**
+ * Accepts the Outline user UUID or display name. Id matches are
+ * case-sensitive (UUIDs are canonical); label matches are
+ * case-insensitive so users can pass the name they see in `auth status`.
+ */
+export declare function matchOutlineAccount(account: OutlineAccount, ref: AccountRef): boolean;
+/**
+ * True when the v2 store is empty but a legacy v1 token snapshot is still
+ * the only thing keeping the CLI authenticated — typically because
+ * `migrateLegacyAuth` couldn't reach the Outline API to identify the
+ * account (`MigrateSkipReason: 'identify-failed'`) or the OS keyring is
+ * unreachable (`'legacy-keyring-unreachable'`, although outline has no
+ * v1 keyring slot to read from). Useful for downstream diagnostics.
+ */
+export declare function isLegacyAuthActive(): Promise<boolean>;
+/**
+ * `OUTLINE_API_TOKEN` short-circuits `active()` only when no explicit ref
+ * is supplied — cli-core's `KeyringTokenStore` doesn't know about the env
+ * var, and an explicit ref means the caller targets a specific stored
+ * account.
+ *
+ * `ensureMigrated()` runs **before** every mutating v2 op so the post-op
+ * legacy discharge can't race a still-pending migration into re-grabbing
+ * the legacy `api_token` we just consumed. `set()` / `clear()` then
+ * discharge legacy state **after** the v2 op succeeds. `set()` swallows
+ * the cleanup failure (v2 wins in `active()` regardless); `clear()`
+ * propagates it so a failed logout fails loudly instead of leaving the
+ * user authenticated via the legacy fallback.
+ */
+export declare function createOutlineTokenStore(): OutlineTokenStore;
+/**
+ * Where the currently-active token lives. Mirrors `active()`'s resolution
+ * order — env → v2 record → legacy plaintext — so the answer can never
+ * contradict the token the runtime is actually using.
+ *
+ * The precedence cascade is intentionally duplicated with `active()`:
+ * the only true dedupe options either (a) add an extra config read on
+ * every `apiRequest` call (regressing the request hot path) or (b)
+ * augment cli-core's `TokenStore` contract. The drift the duplication
+ * invites is guarded by the `getActiveTokenSource` regression test that
+ * asserts v2-record presence wins over a lingering v1 `api_token`.
+ */
+export declare function getActiveTokenSource(): Promise<'env' | 'secure-store' | 'config-file'>;

package/dist/lib/auth-provider.js

@@ -0,0 +1,299 @@
+import { createInterface } from 'node:readline/promises';
+import { createKeyringTokenStore, deriveChallenge, generateVerifier, } from '@doist/cli-core/auth';
+import { fetchWithRetry } from '../transport/fetch-with-retry.js';
+import { apiRequest } from './api.js';
+import { LEGACY_CLEAR_PAYLOAD, SECURE_STORE_SERVICE, TOKEN_ENV_VAR } from './auth-constants.js';
+import { getBaseUrl, getOAuthClientId } from './auth.js';
+import { getConfig, getConfigPath, updateConfig } from './config.js';
+import { runMigrateLegacyAuth } from './migrate-auth.js';
+import { makeOutlineAccount } from './outline-account.js';
+import { createOutlineUserRecordStore, getDefaultUserRecord } from './user-records.js';
+function asHandshake(value) {
+    return value;
+}
+function stringFlag(flags, key) {
+    const value = flags[key];
+    return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
+async function prompt(question) {
+    // Output to stderr so `--json` / `--ndjson` envelopes on stdout stay clean.
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        return (await rl.question(question)).trim();
+    }
+    finally {
+        rl.close();
+    }
+}
+async function resolveBaseUrl(flags) {
+    const fromFlag = stringFlag(flags, 'baseUrl');
+    if (fromFlag)
+        return fromFlag.replace(/\/$/, '');
+    const fromEnv = process.env.OUTLINE_URL?.trim();
+    if (fromEnv)
+        return fromEnv.replace(/\/$/, '');
+    const configured = await getBaseUrl();
+    const answered = await prompt(`Base URL (default: ${configured}): `);
+    return (answered || configured).replace(/\/$/, '');
+}
+async function resolveClientId(flags) {
+    const fromFlag = stringFlag(flags, 'clientId');
+    if (fromFlag)
+        return fromFlag;
+    const existing = await getOAuthClientId();
+    if (existing)
+        return existing;
+    const answered = await prompt('OAuth Client ID: ');
+    if (!answered) {
+        throw new Error('OAuth client ID is required. Create a public OAuth app in Outline settings, then pass --client-id <id> or set OUTLINE_OAUTH_CLIENT_ID.');
+    }
+    return answered;
+}
+export function createOutlineAuthProvider() {
+    return {
+        async authorize({ redirectUri, state, flags }) {
+            const baseUrl = await resolveBaseUrl(flags);
+            const clientId = await resolveClientId(flags);
+            const codeVerifier = generateVerifier();
+            const codeChallenge = deriveChallenge(codeVerifier);
+            const url = new URL(`${baseUrl}/oauth/authorize`);
+            url.searchParams.set('client_id', clientId);
+            url.searchParams.set('response_type', 'code');
+            url.searchParams.set('code_challenge', codeChallenge);
+            url.searchParams.set('code_challenge_method', 'S256');
+            url.searchParams.set('redirect_uri', redirectUri);
+            url.searchParams.set('state', state);
+            const handshake = { baseUrl, clientId, codeVerifier };
+            return { authorizeUrl: url.toString(), handshake };
+        },
+        async exchangeCode({ code, redirectUri, handshake }) {
+            const hs = asHandshake(handshake);
+            if (!hs.codeVerifier) {
+                throw new Error('Missing PKCE code verifier from authorize step.');
+            }
+            const params = new URLSearchParams({
+                grant_type: 'authorization_code',
+                client_id: hs.clientId,
+                redirect_uri: redirectUri,
+                code_verifier: hs.codeVerifier,
+                code,
+            });
+            const res = await fetchWithRetry({
+                url: `${hs.baseUrl}/oauth/token`,
+                options: {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                    body: params.toString(),
+                },
+            });
+            const json = (await res.json().catch(() => ({})));
+            if (!res.ok) {
+                const message = json.error_description || json.message || json.error || res.statusText;
+                throw new Error(`OAuth token exchange failed: ${message}`);
+            }
+            if (!json.access_token) {
+                throw new Error('OAuth token exchange did not return an access token.');
+            }
+            return { accessToken: json.access_token };
+        },
+        async validateToken({ token, handshake }) {
+            const hs = asHandshake(handshake);
+            const { data } = await apiRequest('auth.info', {}, {
+                token,
+                baseUrl: hs.baseUrl,
+            });
+            return makeOutlineAccount({
+                id: data.user.id,
+                label: data.user.name,
+                baseUrl: hs.baseUrl,
+                oauthClientId: hs.clientId,
+                teamName: data.team.name,
+            });
+        },
+    };
+}
+/**
+ * Accepts the Outline user UUID or display name. Id matches are
+ * case-sensitive (UUIDs are canonical); label matches are
+ * case-insensitive so users can pass the name they see in `auth status`.
+ */
+export function matchOutlineAccount(account, ref) {
+    if (account.id === ref)
+        return true;
+    return account.label.toLowerCase() === ref.toLowerCase();
+}
+/** True when the v2 store is the authoritative source. */
+function migrationIsConclusive(result) {
+    return (result.status === 'migrated' ||
+        result.status === 'already-migrated' ||
+        result.status === 'no-legacy-state');
+}
+/**
+ * Synthesise a snapshot from v1 plaintext state still on disk. Fallback for
+ * when migration can't complete (offline `identifyAccount`, WSL
+ * `legacy-keyring-unreachable`). Returns `null` when no legacy token is
+ * present. The synthesised account uses whatever identity fields the v1
+ * config has — for pre-#71 configs the id/label may be empty, but the
+ * runtime never renders those (status's `fetchLive` re-derives from the
+ * API), so empty placeholders are safe.
+ */
+async function readLegacyTokenSnapshot() {
+    const config = await getConfig();
+    const token = config.api_token?.trim() || null;
+    if (!token)
+        return null;
+    return {
+        token,
+        account: makeOutlineAccount({
+            id: config.auth_user_id ?? '',
+            label: config.auth_user_name ?? '',
+            baseUrl: config.base_url,
+            oauthClientId: config.oauth_client_id,
+            teamName: config.auth_team_name,
+        }),
+    };
+}
+/**
+ * Discharge v1 plaintext state. Runs **after** a successful v2 write/clear
+ * — never before — so a v2-op failure doesn't strand the user with no
+ * recoverable credentials. Caller decides whether to swallow or propagate
+ * the `updateConfig` failure:
+ *   - `set()` swallows (v2 record will win in `active()` regardless).
+ *   - `clear()` propagates (v2 is empty, so a stale legacy token would
+ *     shadow the logout via the fallback).
+ */
+async function dischargeLegacyState() {
+    await updateConfig(LEGACY_CLEAR_PAYLOAD);
+}
+/**
+ * Memoised one-shot migration trigger. Resolves with `null` on rejection so
+ * the CLI never fails to start because of a migration error — the legacy
+ * snapshot fallback handles that case. Tests reset the memo with
+ * `vi.resetModules()` + a dynamic re-import.
+ */
+let migrationPromise;
+function ensureMigrated() {
+    if (!migrationPromise) {
+        migrationPromise = runMigrateLegacyAuth({ silent: true }).catch(() => null);
+    }
+    return migrationPromise;
+}
+/**
+ * True when the v2 store is empty but a legacy v1 token snapshot is still
+ * the only thing keeping the CLI authenticated — typically because
+ * `migrateLegacyAuth` couldn't reach the Outline API to identify the
+ * account (`MigrateSkipReason: 'identify-failed'`) or the OS keyring is
+ * unreachable (`'legacy-keyring-unreachable'`, although outline has no
+ * v1 keyring slot to read from). Useful for downstream diagnostics.
+ */
+export async function isLegacyAuthActive() {
+    const result = await ensureMigrated();
+    if (result !== null && migrationIsConclusive(result))
+        return false;
+    const legacy = await readLegacyTokenSnapshot();
+    return legacy !== null;
+}
+/**
+ * `OUTLINE_API_TOKEN` short-circuits `active()` only when no explicit ref
+ * is supplied — cli-core's `KeyringTokenStore` doesn't know about the env
+ * var, and an explicit ref means the caller targets a specific stored
+ * account.
+ *
+ * `ensureMigrated()` runs **before** every mutating v2 op so the post-op
+ * legacy discharge can't race a still-pending migration into re-grabbing
+ * the legacy `api_token` we just consumed. `set()` / `clear()` then
+ * discharge legacy state **after** the v2 op succeeds. `set()` swallows
+ * the cleanup failure (v2 wins in `active()` regardless); `clear()`
+ * propagates it so a failed logout fails loudly instead of leaving the
+ * user authenticated via the legacy fallback.
+ */
+export function createOutlineTokenStore() {
+    const inner = createKeyringTokenStore({
+        serviceName: SECURE_STORE_SERVICE,
+        userRecords: createOutlineUserRecordStore(),
+        recordsLocation: getConfigPath(),
+        matchAccount: matchOutlineAccount,
+    });
+    async function migrationIsInconclusive() {
+        const result = await ensureMigrated(); // memoised
+        return result === null || !migrationIsConclusive(result);
+    }
+    return {
+        async active(ref) {
+            if (ref === undefined) {
+                const envToken = process.env[TOKEN_ENV_VAR]?.trim();
+                if (envToken) {
+                    return {
+                        token: envToken,
+                        account: makeOutlineAccount({
+                            id: '',
+                            label: '',
+                            baseUrl: await getBaseUrl(),
+                        }),
+                    };
+                }
+            }
+            await ensureMigrated();
+            const fromStore = await inner.active(ref);
+            if (fromStore)
+                return fromStore;
+            const legacy = await readLegacyTokenSnapshot();
+            if (legacy && (ref === undefined || matchOutlineAccount(legacy.account, ref))) {
+                return legacy;
+            }
+            return null;
+        },
+        async set(account, token) {
+            await ensureMigrated();
+            await inner.set(account, token);
+            if (await migrationIsInconclusive()) {
+                // Best-effort: a lingering `api_token` is dormant because
+                // `active()` reads v2 first.
+                await dischargeLegacyState().catch(() => undefined);
+            }
+        },
+        async clear(ref) {
+            await ensureMigrated();
+            await inner.clear(ref);
+            if (await migrationIsInconclusive()) {
+                // Must succeed: v2 is now empty, so a surviving legacy
+                // token would shadow the logout via the fallback.
+                await dischargeLegacyState();
+            }
+        },
+        async list() {
+            await ensureMigrated();
+            return inner.list();
+        },
+        async setDefault(ref) {
+            await ensureMigrated();
+            return inner.setDefault(ref);
+        },
+        getLastStorageResult: () => inner.getLastStorageResult(),
+        getLastClearResult: () => inner.getLastClearResult(),
+    };
+}
+/**
+ * Where the currently-active token lives. Mirrors `active()`'s resolution
+ * order — env → v2 record → legacy plaintext — so the answer can never
+ * contradict the token the runtime is actually using.
+ *
+ * The precedence cascade is intentionally duplicated with `active()`:
+ * the only true dedupe options either (a) add an extra config read on
+ * every `apiRequest` call (regressing the request hot path) or (b)
+ * augment cli-core's `TokenStore` contract. The drift the duplication
+ * invites is guarded by the `getActiveTokenSource` regression test that
+ * asserts v2-record presence wins over a lingering v1 `api_token`.
+ */
+export async function getActiveTokenSource() {
+    if (process.env[TOKEN_ENV_VAR]?.trim())
+        return 'env';
+    const config = await getConfig();
+    const record = getDefaultUserRecord(config);
+    if (record)
+        return record.fallbackToken ? 'config-file' : 'secure-store';
+    if (config.api_token?.trim())
+        return 'config-file';
+    return 'secure-store';
+}
+//# sourceMappingURL=auth-provider.js.map

package/dist/lib/auth-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provider.js","sourceRoot":"","sources":["../../src/lib/auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAGH,uBAAuB,EACvB,eAAe,EACf,gBAAgB,GAGnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC/F,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAuB,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAiBtF,SAAS,WAAW,CAAC,KAA8B;IAC/C,OAAO,KAAyB,CAAA;AACpC,CAAC;AAED,SAAS,UAAU,CAAC,KAA8B,EAAE,GAAW;IAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;IACxB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/E,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,QAAgB;IAClC,4EAA4E;IAC5E,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAC5E,IAAI,CAAC;QACD,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC/C,CAAC;YAAS,CAAC;QACP,EAAE,CAAC,KAAK,EAAE,CAAA;IACd,CAAC;AACL,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAA8B;IACxD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IAC7C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAA;IAC/C,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC9C,MAAM,UAAU,GAAG,MAAM,UAAU,EAAE,CAAA;IACrC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,sBAAsB,UAAU,KAAK,CAAC,CAAA;IACpE,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACtD,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAA8B;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC9C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,EAAE,CAAA;IACzC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACX,wIAAwI,CAC3I,CAAA;IACL,CAAC;IACD,OAAO,QAAQ,CAAA;AACnB,CAAC;AAED,MAAM,UAAU,yBAAyB;IACrC,OAAO;QACH,KAAK,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAA;YAC3C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAA;YAC7C,MAAM,YAAY,GAAG,gBAAgB,EAAE,CAAA;YACvC,MAAM,aAAa,GAAG,eAAe,CAAC,YAAY,CAAC,CAAA;YAEnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,OAAO,kBAAkB,CAAC,CAAA;YACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;YAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAA;YAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAA;YACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAA;YACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAA;YACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAEpC,MAAM,SAAS,GAAqB,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAA;YACvE,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAA;QACtD,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE;YAC/C,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;YACjC,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;YACtE,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;gBAC/B,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,EAAE,CAAC,QAAQ;gBACtB,YAAY,EAAE,WAAW;gBACzB,aAAa,EAAE,EAAE,CAAC,YAAY;gBAC9B,IAAI;aACP,CAAC,CAAA;YAEF,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC;gBAC7B,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,cAAc;gBAChC,OAAO,EAAE;oBACL,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;oBAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;iBAC1B;aACJ,CAAC,CAAA;YAEF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAK/C,CAAA;YAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACV,MAAM,OAAO,GACT,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,CAAA;gBAC1E,MAAM,IAAI,KAAK,CAAC,gCAAgC,OAAO,EAAE,CAAC,CAAA;YAC9D,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;YAC3E,CAAC;YAED,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,CAAA;QAC7C,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE;YACpC,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;YACjC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAC7B,WAAW,EACX,EAAE,EACF;gBACI,KAAK;gBACL,OAAO,EAAE,EAAE,CAAC,OAAO;aACtB,CACJ,CAAA;YACD,OAAO,kBAAkB,CAAC;gBACtB,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;gBAChB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;gBACrB,OAAO,EAAE,EAAE,CAAC,OAAO;gBACnB,aAAa,EAAE,EAAE,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;aAC3B,CAAC,CAAA;QACN,CAAC;KACJ,CAAA;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAuB,EAAE,GAAe;IACxE,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACnC,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CAAA;AAC5D,CAAC;AAED,0DAA0D;AAC1D,SAAS,qBAAqB,CAAC,MAAyC;IACpE,OAAO,CACH,MAAM,CAAC,MAAM,KAAK,UAAU;QAC5B,MAAM,CAAC,MAAM,KAAK,kBAAkB;QACpC,MAAM,CAAC,MAAM,KAAK,iBAAiB,CACtC,CAAA;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,uBAAuB;IAIlC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,IAAI,CAAA;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,OAAO;QACH,KAAK;QACL,OAAO,EAAE,kBAAkB,CAAC;YACxB,EAAE,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YAC7B,KAAK,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;YAClC,OAAO,EAAE,MAAM,CAAC,QAAQ;YACxB,aAAa,EAAE,MAAM,CAAC,eAAe;YACrC,QAAQ,EAAE,MAAM,CAAC,cAAc;SAClC,CAAC;KACL,CAAA;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB;IAC/B,MAAM,YAAY,CAAC,oBAAoB,CAAC,CAAA;AAC5C,CAAC;AAED;;;;;GAKG;AACH,IAAI,gBAA+E,CAAA;AACnF,SAAS,cAAc;IACnB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpB,gBAAgB,GAAG,oBAAoB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAC/E,CAAC;IACD,OAAO,gBAAgB,CAAA;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACpC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAA;IACrC,IAAI,MAAM,KAAK,IAAI,IAAI,qBAAqB,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IAClE,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;IAC9C,OAAO,MAAM,KAAK,IAAI,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB;IACnC,MAAM,KAAK,GAAG,uBAAuB,CAAiB;QAClD,WAAW,EAAE,oBAAoB;QACjC,WAAW,EAAE,4BAA4B,EAAE;QAC3C,eAAe,EAAE,aAAa,EAAE;QAChC,YAAY,EAAE,mBAAmB;KACpC,CAAC,CAAA;IACF,KAAK,UAAU,uBAAuB;QAClC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAA,CAAC,WAAW;QACjD,OAAO,MAAM,KAAK,IAAI,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO;QACH,KAAK,CAAC,MAAM,CAAC,GAAgB;YACzB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACpB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAA;gBACnD,IAAI,QAAQ,EAAE,CAAC;oBACX,OAAO;wBACH,KAAK,EAAE,QAAQ;wBACf,OAAO,EAAE,kBAAkB,CAAC;4BACxB,EAAE,EAAE,EAAE;4BACN,KAAK,EAAE,EAAE;4BACT,OAAO,EAAE,MAAM,UAAU,EAAE;yBAC9B,CAAC;qBACL,CAAA;gBACL,CAAC;YACL,CAAC;YACD,MAAM,cAAc,EAAE,CAAA;YACtB,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACzC,IAAI,SAAS;gBAAE,OAAO,SAAS,CAAA;YAE/B,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;YAC9C,IAAI,MAAM,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC5E,OAAO,MAAM,CAAA;YACjB,CAAC;YACD,OAAO,IAAI,CAAA;QACf,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAuB,EAAE,KAAa;YAC5C,MAAM,cAAc,EAAE,CAAA;YACtB,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAC/B,IAAI,MAAM,uBAAuB,EAAE,EAAE,CAAC;gBAClC,0DAA0D;gBAC1D,6BAA6B;gBAC7B,MAAM,oBAAoB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACvD,CAAC;QACL,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAgB;YACxB,MAAM,cAAc,EAAE,CAAA;YACtB,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACtB,IAAI,MAAM,uBAAuB,EAAE,EAAE,CAAC;gBAClC,uDAAuD;gBACvD,kDAAkD;gBAClD,MAAM,oBAAoB,EAAE,CAAA;YAChC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,IAAI;YACN,MAAM,cAAc,EAAE,CAAA;YACtB,OAAO,KAAK,CAAC,IAAI,EAAE,CAAA;QACvB,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,GAAe;YAC5B,MAAM,cAAc,EAAE,CAAA;YACtB,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAChC,CAAC;QACD,oBAAoB,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE;QACxD,kBAAkB,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,kBAAkB,EAAE;KACvD,CAAA;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACtC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE;QAAE,OAAO,KAAK,CAAA;IACpD,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAA;IACxE,IAAI,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE;QAAE,OAAO,aAAa,CAAA;IAClD,OAAO,cAAc,CAAA;AACzB,CAAC"}

package/dist/lib/auth.d.ts

@@ -1,11 +1,28 @@
+import { SecureStoreUnavailableError } from '@doist/cli-core/auth';
+import { TOKEN_ENV_VAR } from './auth-constants.js';
+import { getActiveTokenSource } from './auth-provider.js';
+import { CliError } from './errors.js';
+export { SecureStoreUnavailableError, getActiveTokenSource, TOKEN_ENV_VAR };
+export declare class NoTokenError extends CliError {
+    constructor();
+}
+/**
+ * Read the active token. Hot path: when `OUTLINE_API_TOKEN` is set we
+ * return it directly without consulting the token store, since
+ * `apiRequest` already resolves the base URL separately — going through
+ * `store.active()` here would trigger a redundant `getBaseUrl()` lookup
+ * per request just to synthesise an account we don't need.
+ */
 export declare function getApiToken(): Promise<string>;
+/**
+ * Base URL cascade: env var → default user record (v2) → legacy
+ * `base_url` config (v1) → built-in default. The record takes priority
+ * over the legacy slot so post-migration logins keep defaulting to the
+ * same Outline instance.
+ */
 export declare function getBaseUrl(): Promise<string>;
-export declare function getOAuthClientId(): Promise<string | undefined>;
-export declare function getTokenSource(): Promise<'env' | 'config' | null>;
-export declare function saveConfig(token: string, baseUrl?: string, oauthClientId?: string): Promise<void>;
 /**
- * Clear the auth-related keys without deleting the file. The config is now
- * shared with non-auth settings (notably `update_channel`); a blanket unlink
- * would silently reset the user's update-channel preference too.
+ * OAuth client id cascade: env var → default user record (v2) → legacy
+ * `oauth_client_id` config (v1) → undefined (caller prompts).
  */
-export declare function clearConfig(): Promise<void>;
+export declare function getOAuthClientId(): Promise<string | undefined>;

package/dist/lib/auth.js

@@ -1,57 +1,74 @@
-import { getConfig, setConfig, updateConfig } from './config.js';
-const DEFAULT_BASE_URL = 'https://app.getoutline.com';
+import { SecureStoreUnavailableError } from '@doist/cli-core/auth';
+import { TOKEN_ENV_VAR } from './auth-constants.js';
+import { createOutlineTokenStore, getActiveTokenSource, } from './auth-provider.js';
+import { getConfig } from './config.js';
+import { CliError } from './errors.js';
+import { DEFAULT_BASE_URL } from './outline-account.js';
+import { getDefaultUserRecord } from './user-records.js';
+export { SecureStoreUnavailableError, getActiveTokenSource, TOKEN_ENV_VAR };
+export class NoTokenError extends CliError {
+    constructor() {
+        super('NO_TOKEN', `No API token found. Set ${TOKEN_ENV_VAR} env var or run: ol auth login`, [`Set ${TOKEN_ENV_VAR} or run: ol auth login`], 'info');
+        this.name = 'NoTokenError';
+    }
+}
+/**
+ * Module-level token-store singleton. Built lazily on first call; reused
+ * across every `apiRequest` so the request hot path doesn't reconstruct
+ * the keyring + user-record adapters per POST.
+ */
+let storeSingleton;
+function tokenStore() {
+    if (!storeSingleton)
+        storeSingleton = createOutlineTokenStore();
+    return storeSingleton;
+}
+/**
+ * Read the active token. Hot path: when `OUTLINE_API_TOKEN` is set we
+ * return it directly without consulting the token store, since
+ * `apiRequest` already resolves the base URL separately — going through
+ * `store.active()` here would trigger a redundant `getBaseUrl()` lookup
+ * per request just to synthesise an account we don't need.
+ */
 export async function getApiToken() {
-    const envToken = process.env.OUTLINE_API_TOKEN;
+    const envToken = process.env[TOKEN_ENV_VAR]?.trim();
     if (envToken)
         return envToken;
-    const config = await getConfig();
-    if (config.api_token)
-        return config.api_token;
-    throw new Error('No API token found. Set OUTLINE_API_TOKEN env var or run: ol auth login');
+    const snapshot = await tokenStore().active();
+    if (!snapshot?.token)
+        throw new NoTokenError();
+    return snapshot.token;
 }
+/**
+ * Base URL cascade: env var → default user record (v2) → legacy
+ * `base_url` config (v1) → built-in default. The record takes priority
+ * over the legacy slot so post-migration logins keep defaulting to the
+ * same Outline instance.
+ */
 export async function getBaseUrl() {
     const envUrl = process.env.OUTLINE_URL;
     if (envUrl)
         return envUrl.replace(/\/$/, '');
     const config = await getConfig();
+    const record = getDefaultUserRecord(config);
+    if (record?.account.baseUrl)
+        return record.account.baseUrl.replace(/\/$/, '');
     if (config.base_url)
         return config.base_url.replace(/\/$/, '');
     return DEFAULT_BASE_URL;
 }
+/**
+ * OAuth client id cascade: env var → default user record (v2) → legacy
+ * `oauth_client_id` config (v1) → undefined (caller prompts).
+ */
 export async function getOAuthClientId() {
     const envClientId = process.env.OUTLINE_OAUTH_CLIENT_ID;
     if (envClientId)
         return envClientId;
     const config = await getConfig();
+    const record = getDefaultUserRecord(config);
+    if (record?.account.oauthClientId)
+        return record.account.oauthClientId;
     return config.oauth_client_id;
 }
-export async function getTokenSource() {
-    if (process.env.OUTLINE_API_TOKEN)
-        return 'env';
-    const config = await getConfig();
-    if (config.api_token)
-        return 'config';
-    return null;
-}
-export async function saveConfig(token, baseUrl, oauthClientId) {
-    const updates = { api_token: token };
-    if (baseUrl)
-        updates.base_url = baseUrl.replace(/\/$/, '');
-    if (oauthClientId)
-        updates.oauth_client_id = oauthClientId;
-    await updateConfig(updates);
-}
-/**
- * Clear the auth-related keys without deleting the file. The config is now
- * shared with non-auth settings (notably `update_channel`); a blanket unlink
- * would silently reset the user's update-channel preference too.
- */
-export async function clearConfig() {
-    const existing = await getConfig();
-    const { api_token, base_url, oauth_client_id, ...rest } = existing;
-    void api_token;
-    void base_url;
-    void oauth_client_id;
-    await setConfig(rest);
-}
 //# sourceMappingURL=auth.js.map