@doist/outline-cli 1.6.0 → 1.7.0

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [1.7.0](https://github.com/Doist/outline-cli/compare/v1.6.0...v1.7.0) (2026-05-17)
+
+### Features
+
+* **auth:** store API tokens in the OS keyring via @doist/cli-core ([#73](https://github.com/Doist/outline-cli/issues/73)) ([b353aea](https://github.com/Doist/outline-cli/commit/b353aeae3cdcc63308ec8de899f08c1dda23f22c))
+
 ## [1.6.0](https://github.com/Doist/outline-cli/compare/v1.5.3...v1.6.0) (2026-05-15)
 
 ### Features

package/dist/commands/auth.d.ts

@@ -1,2 +1,14 @@
+import { type TokenStorageResult } from '@doist/cli-core/auth';
 import type { Command } from 'commander';
+/**
+ * Surface a `TokenStorageResult` from a save/clear: the human-readable
+ * confirmation goes to stdout, any keyring-fallback warning goes to stderr.
+ * Pass `isMachineOutput: true` to suppress the stdout confirmation in
+ * `--json` / `--ndjson` mode while still routing the warning to stderr.
+ *
+ * Exported for direct unit testing — the alternative (driving this via
+ * mocked cli-core login/logout hooks) would require stubbing the entire
+ * store contract just to assert two console calls.
+ */
+export declare function logTokenStorageResult(result: TokenStorageResult, secureStoreMessage: string, isMachineOutput?: boolean): void;
 export declare function registerAuthCommand(program: Command): void;

package/dist/commands/auth.js

@@ -1,10 +1,9 @@
-import { attachLoginCommand } from '@doist/cli-core/auth';
+import { attachLoginCommand, attachLogoutCommand, attachStatusCommand, } from '@doist/cli-core/auth';
 import chalk from 'chalk';
 import { apiRequest } from '../lib/api.js';
 import { renderError, renderSuccess } from '../lib/auth-pages.js';
-import { createOutlineAuthProvider, createOutlineTokenStore } from '../lib/auth-provider.js';
-import { clearConfig, getBaseUrl, getTokenSource } from '../lib/auth.js';
-import { formatError } from '../lib/output.js';
+import { createOutlineAuthProvider, createOutlineTokenStore, getActiveTokenSource, } from '../lib/auth-provider.js';
+import { CliError } from '../lib/errors.js';
 const DEFAULT_OAUTH_CALLBACK_PORT = 54969;
 function resolvePreferredCallbackPort() {
     const raw = process.env.OUTLINE_OAUTH_CALLBACK_PORT?.trim();
@@ -16,6 +15,24 @@ function resolvePreferredCallbackPort() {
     }
     return parsed;
 }
+/**
+ * Surface a `TokenStorageResult` from a save/clear: the human-readable
+ * confirmation goes to stdout, any keyring-fallback warning goes to stderr.
+ * Pass `isMachineOutput: true` to suppress the stdout confirmation in
+ * `--json` / `--ndjson` mode while still routing the warning to stderr.
+ *
+ * Exported for direct unit testing — the alternative (driving this via
+ * mocked cli-core login/logout hooks) would require stubbing the entire
+ * store contract just to assert two console calls.
+ */
+export function logTokenStorageResult(result, secureStoreMessage, isMachineOutput = false) {
+    if (!isMachineOutput && result.storage === 'secure-store') {
+        console.log(chalk.dim(secureStoreMessage));
+    }
+    if (result.warning) {
+        console.error(chalk.yellow('Warning:'), result.warning);
+    }
+}
 export function registerAuthCommand(program) {
     const auth = program.command('auth').description('Manage authentication');
     const provider = createOutlineAuthProvider();
@@ -28,43 +45,84 @@ export function registerAuthCommand(program) {
         renderSuccess,
         renderError,
         onSuccess({ view, account }) {
-            if (view.json || view.ndjson)
-                return;
-            console.log(chalk.green(`Authenticated to ${account.teamName} as ${account.label}`));
+            const isMachineOutput = view.json || view.ndjson;
+            if (!isMachineOutput) {
+                console.log(chalk.green(`Authenticated to ${account.teamName} as ${account.label}`));
+            }
+            const result = store.getLastStorageResult();
+            if (result) {
+                logTokenStorageResult(result, 'Token stored securely in the system credential manager', isMachineOutput);
+            }
         },
     })
         .description('Authenticate with an Outline instance via OAuth')
         .option('--base-url <url>', 'Outline base URL to use for this login (saved for future logins)')
         .option('--client-id <clientId>', 'OAuth client ID to use for this login (saved for future logins)');
-    auth.command('status')
-        .description('Show current authentication state')
-        .action(async () => {
-        const source = await getTokenSource();
-        if (!source) {
-            console.log(chalk.yellow('Not authenticated. Run: ol auth login'));
-            return;
-        }
-        console.log(chalk.dim(`Token source: ${source}`));
-        console.log(chalk.dim(`Base URL: ${await getBaseUrl()}`));
-        try {
-            const { data } = await apiRequest('auth.info');
-            console.log(`Team: ${chalk.bold(data.team.name)}`);
-            console.log(`User: ${data.user.name} (${data.user.email})`);
-        }
-        catch (err) {
-            console.error(formatError('AUTH_VERIFICATION_FAILED', `Could not fetch auth info: ${err.message}`, [
-                'Check that your API token is valid',
-                'Verify the base URL is correct',
-                "Run 'ol auth login' to re-authenticate",
-            ]));
-            process.exit(1);
-        }
+    // `attachStatusCommand` guarantees `fetchLive` runs before `renderText` /
+    // `renderJson` within a single invocation, so the stash is always
+    // populated by the time the render hooks read it.
+    let statusData = null;
+    attachStatusCommand(auth, {
+        store,
+        description: 'Show current authentication state',
+        async fetchLive({ token, account }) {
+            try {
+                const [{ data: info }, source] = await Promise.all([
+                    apiRequest('auth.info', {}, { token, baseUrl: account.baseUrl }),
+                    getActiveTokenSource(),
+                ]);
+                statusData = { email: info.user.email, source };
+                return {
+                    ...account,
+                    id: info.user.id,
+                    label: info.user.name,
+                    teamName: info.team.name,
+                };
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : '';
+                if (/\b401\b/.test(message) || /Authentication required/i.test(message)) {
+                    throw new CliError('NO_TOKEN', 'Not authenticated (token expired or invalid)', [
+                        'Run `ol auth login` to re-authenticate',
+                    ]);
+                }
+                throw err;
+            }
+        },
+        renderText({ account }) {
+            if (!statusData)
+                throw new Error('status renderText called before fetchLive');
+            return [
+                `${chalk.green('✓')} Authenticated`,
+                `  Team: ${chalk.bold(account.teamName ?? '')}`,
+                `  User: ${account.label} (${statusData.email})`,
+                `  Base URL: ${account.baseUrl}`,
+                `  Token source: ${statusData.source}`,
+            ];
+        },
+        renderJson({ account }) {
+            if (!statusData)
+                throw new Error('status renderJson called before fetchLive');
+            return {
+                id: account.id,
+                team: account.teamName,
+                baseUrl: account.baseUrl,
+                source: statusData.source,
+            };
+        },
+        onNotAuthenticated() {
+            throw new CliError('NOT_AUTHENTICATED', 'Not authenticated. Run: ol auth login');
+        },
     });
-    auth.command('logout')
-        .description('Clear saved authentication')
-        .action(async () => {
-        await clearConfig();
-        console.log('Logged out.');
+    attachLogoutCommand(auth, {
+        store,
+        description: 'Clear saved authentication',
+        onCleared({ view }) {
+            const result = store.getLastClearResult();
+            if (!result)
+                return;
+            logTokenStorageResult(result, 'Stored token removed from the system credential manager', view.json || view.ndjson);
+        },
     });
 }
 //# sourceMappingURL=auth.js.map

package/dist/commands/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AAC5F,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE9C,MAAM,2BAA2B,GAAG,KAAK,CAAA;AAOzC,SAAS,4BAA4B;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAA;IAC3D,IAAI,CAAC,GAAG;QAAE,OAAO,2BAA2B,CAAA;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,MAAM,EAAE,CAAC;QAC7D,OAAO,2BAA2B,CAAA;IACtC,CAAC;IACD,OAAO,MAAM,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAA;IAEzE,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAA;IAC5C,MAAM,KAAK,GAAG,uBAAuB,EAAE,CAAA;IAEvC,kBAAkB,CAAC,IAAI,EAAE;QACrB,QAAQ;QACR,KAAK;QACL,aAAa,EAAE,4BAA4B,EAAE;QAC7C,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE;QACvB,aAAa;QACb,WAAW;QACX,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;YACvB,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM;gBAAE,OAAM;YACpC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,OAAO,CAAC,QAAQ,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;QACxF,CAAC;KACJ,CAAC;SACG,WAAW,CAAC,iDAAiD,CAAC;SAC9D,MAAM,CACH,kBAAkB,EAClB,kEAAkE,CACrE;SACA,MAAM,CACH,wBAAwB,EACxB,iEAAiE,CACpE,CAAA;IAEL,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,mCAAmC,CAAC;SAChD,MAAM,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAA;QACrC,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,uCAAuC,CAAC,CAAC,CAAA;YAClE,OAAM;QACV,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,MAAM,EAAE,CAAC,CAAC,CAAA;QACjD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,MAAM,UAAU,EAAE,EAAE,CAAC,CAAC,CAAA;QAEzD,IAAI,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAmB,WAAW,CAAC,CAAA;YAChE,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAClD,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAA;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CACT,WAAW,CACP,0BAA0B,EAC1B,8BAA+B,GAAa,CAAC,OAAO,EAAE,EACtD;gBACI,oCAAoC;gBACpC,gCAAgC;gBAChC,wCAAwC;aAC3C,CACJ,CACJ,CAAA;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,CAAC;IACL,CAAC,CAAC,CAAA;IAEN,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,4BAA4B,CAAC;SACzC,MAAM,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,WAAW,EAAE,CAAA;QACnB,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;AACV,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,GAEtB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,EAEH,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,GAGvB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAE3C,MAAM,2BAA2B,GAAG,KAAK,CAAA;AAOzC,SAAS,4BAA4B;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAA;IAC3D,IAAI,CAAC,GAAG;QAAE,OAAO,2BAA2B,CAAA;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,MAAM,EAAE,CAAC;QAC7D,OAAO,2BAA2B,CAAA;IACtC,CAAC;IACD,OAAO,MAAM,CAAA;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACjC,MAA0B,EAC1B,kBAA0B,EAC1B,eAAe,GAAG,KAAK;IAEvB,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAA;IAC9C,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;IAC3D,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAA;IAEzE,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAA;IAC5C,MAAM,KAAK,GAAsB,uBAAuB,EAAE,CAAA;IAE1D,kBAAkB,CAAC,IAAI,EAAE;QACrB,QAAQ;QACR,KAAK;QACL,aAAa,EAAE,4BAA4B,EAAE;QAC7C,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE;QACvB,aAAa;QACb,WAAW;QACX,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;YACvB,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAA;YAChD,IAAI,CAAC,eAAe,EAAE,CAAC;gBACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,OAAO,CAAC,QAAQ,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;YACxF,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,oBAAoB,EAAE,CAAA;YAC3C,IAAI,MAAM,EAAE,CAAC;gBACT,qBAAqB,CACjB,MAAM,EACN,wDAAwD,EACxD,eAAe,CAClB,CAAA;YACL,CAAC;QACL,CAAC;KACJ,CAAC;SACG,WAAW,CAAC,iDAAiD,CAAC;SAC9D,MAAM,CACH,kBAAkB,EAClB,kEAAkE,CACrE;SACA,MAAM,CACH,wBAAwB,EACxB,iEAAiE,CACpE,CAAA;IAEL,0EAA0E;IAC1E,kEAAkE;IAClE,kDAAkD;IAClD,IAAI,UAAU,GAAsB,IAAI,CAAA;IAExC,mBAAmB,CAAiB,IAAI,EAAE;QACtC,KAAK;QACL,WAAW,EAAE,mCAAmC;QAChD,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE;YAC9B,IAAI,CAAC;gBACD,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAC/C,UAAU,CACN,WAAW,EACX,EAAE,EACF,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CACtC;oBACD,oBAAoB,EAAE;iBACzB,CAAC,CAAA;gBACF,UAAU,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAA;gBAC/C,OAAO;oBACH,GAAG,OAAO;oBACV,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;oBAChB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;oBACrB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;iBAC3B,CAAA;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;gBACvD,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtE,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,8CAA8C,EAAE;wBAC3E,wCAAwC;qBAC3C,CAAC,CAAA;gBACN,CAAC;gBACD,MAAM,GAAG,CAAA;YACb,CAAC;QACL,CAAC;QACD,UAAU,CAAC,EAAE,OAAO,EAAE;YAClB,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;YAC7E,OAAO;gBACH,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB;gBACnC,WAAW,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE;gBAC/C,WAAW,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,KAAK,GAAG;gBAChD,eAAe,OAAO,CAAC,OAAO,EAAE;gBAChC,mBAAmB,UAAU,CAAC,MAAM,EAAE;aACzC,CAAA;QACL,CAAC;QACD,UAAU,CAAC,EAAE,OAAO,EAAE;YAClB,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;YAC7E,OAAO;gBACH,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,IAAI,EAAE,OAAO,CAAC,QAAQ;gBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM,EAAE,UAAU,CAAC,MAAM;aAC5B,CAAA;QACL,CAAC;QACD,kBAAkB;YACd,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,uCAAuC,CAAC,CAAA;QACpF,CAAC;KACJ,CAAC,CAAA;IAEF,mBAAmB,CAAiB,IAAI,EAAE;QACtC,KAAK;QACL,WAAW,EAAE,4BAA4B;QACzC,SAAS,CAAC,EAAE,IAAI,EAAE;YACd,MAAM,MAAM,GAAG,KAAK,CAAC,kBAAkB,EAAE,CAAA;YACzC,IAAI,CAAC,MAAM;gBAAE,OAAM;YACnB,qBAAqB,CACjB,MAAM,EACN,yDAAyD,EACzD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAC3B,CAAA;QACL,CAAC;KACJ,CAAC,CAAA;AACN,CAAC"}

package/dist/lib/auth-constants.d.ts

@@ -0,0 +1,18 @@
+import type { Config } from './config.js';
+/** OS keyring `service` identifier for every outline-cli secret. */
+export declare const SECURE_STORE_SERVICE = "outline-cli";
+/** Env var that short-circuits the token store with a manually-supplied token. */
+export declare const TOKEN_ENV_VAR = "OUTLINE_API_TOKEN";
+/**
+ * Legacy single-user keyring slot. Outline never wrote a token to the
+ * keyring before this migration, so there is no real legacy slot to read —
+ * `migrateLegacyAuth` still expects the option, and its best-effort delete
+ * after migration is a harmless no-op on an empty entry.
+ */
+export declare const LEGACY_KEYRING_ACCOUNT = "api-token";
+/**
+ * `updateConfig` payload that wipes every v1 auth key. Used by both the
+ * one-shot migration `cleanupLegacyConfig` and the runtime
+ * `dischargeLegacyState` so both paths stay in lockstep.
+ */
+export declare const LEGACY_CLEAR_PAYLOAD: Partial<Config>;

package/dist/lib/auth-constants.js

@@ -0,0 +1,25 @@
+/** OS keyring `service` identifier for every outline-cli secret. */
+export const SECURE_STORE_SERVICE = 'outline-cli';
+/** Env var that short-circuits the token store with a manually-supplied token. */
+export const TOKEN_ENV_VAR = 'OUTLINE_API_TOKEN';
+/**
+ * Legacy single-user keyring slot. Outline never wrote a token to the
+ * keyring before this migration, so there is no real legacy slot to read —
+ * `migrateLegacyAuth` still expects the option, and its best-effort delete
+ * after migration is a harmless no-op on an empty entry.
+ */
+export const LEGACY_KEYRING_ACCOUNT = 'api-token';
+/**
+ * `updateConfig` payload that wipes every v1 auth key. Used by both the
+ * one-shot migration `cleanupLegacyConfig` and the runtime
+ * `dischargeLegacyState` so both paths stay in lockstep.
+ */
+export const LEGACY_CLEAR_PAYLOAD = {
+    api_token: undefined,
+    base_url: undefined,
+    oauth_client_id: undefined,
+    auth_user_id: undefined,
+    auth_user_name: undefined,
+    auth_team_name: undefined,
+};
+//# sourceMappingURL=auth-constants.js.map

package/dist/lib/auth-constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-constants.js","sourceRoot":"","sources":["../../src/lib/auth-constants.ts"],"names":[],"mappings":"AAEA,oEAAoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAA;AAEjD,kFAAkF;AAClF,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAA;AAEhD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAA;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAoB;IACjD,SAAS,EAAE,SAAS;IACpB,QAAQ,EAAE,SAAS;IACnB,eAAe,EAAE,SAAS;IAC1B,YAAY,EAAE,SAAS;IACvB,cAAc,EAAE,SAAS;IACzB,cAAc,EAAE,SAAS;CAC5B,CAAA"}

package/dist/lib/auth-provider.d.ts

@@ -1,10 +1,59 @@
-import { type AuthAccount, type AuthProvider, type TokenStore } from '@doist/cli-core/auth';
-export type OutlineAccount = AuthAccount & {
-    id: string;
-    label: string;
-    baseUrl: string;
-    oauthClientId: string;
-    teamName?: string;
+import { type AccountRef, type AuthProvider, type KeyringTokenStore } from '@doist/cli-core/auth';
+import { type OutlineAccount } from './outline-account.js';
+export type { OutlineAccount } from './outline-account.js';
+export type AuthInfoResponse = {
+    user: {
+        id: string;
+        name: string;
+        email: string;
+    };
+    team: {
+        name: string;
+        subdomain: string;
+    };
 };
+export type OutlineTokenStore = KeyringTokenStore<OutlineAccount>;
 export declare function createOutlineAuthProvider(): AuthProvider<OutlineAccount>;
-export declare function createOutlineTokenStore(): TokenStore<OutlineAccount>;
+/**
+ * Accepts the Outline user UUID or display name. Id matches are
+ * case-sensitive (UUIDs are canonical); label matches are
+ * case-insensitive so users can pass the name they see in `auth status`.
+ */
+export declare function matchOutlineAccount(account: OutlineAccount, ref: AccountRef): boolean;
+/**
+ * True when the v2 store is empty but a legacy v1 token snapshot is still
+ * the only thing keeping the CLI authenticated — typically because
+ * `migrateLegacyAuth` couldn't reach the Outline API to identify the
+ * account (`MigrateSkipReason: 'identify-failed'`) or the OS keyring is
+ * unreachable (`'legacy-keyring-unreachable'`, although outline has no
+ * v1 keyring slot to read from). Useful for downstream diagnostics.
+ */
+export declare function isLegacyAuthActive(): Promise<boolean>;
+/**
+ * `OUTLINE_API_TOKEN` short-circuits `active()` only when no explicit ref
+ * is supplied — cli-core's `KeyringTokenStore` doesn't know about the env
+ * var, and an explicit ref means the caller targets a specific stored
+ * account.
+ *
+ * `ensureMigrated()` runs **before** every mutating v2 op so the post-op
+ * legacy discharge can't race a still-pending migration into re-grabbing
+ * the legacy `api_token` we just consumed. `set()` / `clear()` then
+ * discharge legacy state **after** the v2 op succeeds. `set()` swallows
+ * the cleanup failure (v2 wins in `active()` regardless); `clear()`
+ * propagates it so a failed logout fails loudly instead of leaving the
+ * user authenticated via the legacy fallback.
+ */
+export declare function createOutlineTokenStore(): OutlineTokenStore;
+/**
+ * Where the currently-active token lives. Mirrors `active()`'s resolution
+ * order — env → v2 record → legacy plaintext — so the answer can never
+ * contradict the token the runtime is actually using.
+ *
+ * The precedence cascade is intentionally duplicated with `active()`:
+ * the only true dedupe options either (a) add an extra config read on
+ * every `apiRequest` call (regressing the request hot path) or (b)
+ * augment cli-core's `TokenStore` contract. The drift the duplication
+ * invites is guarded by the `getActiveTokenSource` regression test that
+ * asserts v2-record presence wins over a lingering v1 `api_token`.
+ */
+export declare function getActiveTokenSource(): Promise<'env' | 'secure-store' | 'config-file'>;

package/dist/lib/auth-provider.js

@@ -1,11 +1,13 @@
 import { createInterface } from 'node:readline/promises';
-import { deriveChallenge, generateVerifier, } from '@doist/cli-core/auth';
+import { createKeyringTokenStore, deriveChallenge, generateVerifier, } from '@doist/cli-core/auth';
 import { fetchWithRetry } from '../transport/fetch-with-retry.js';
 import { apiRequest } from './api.js';
-import { clearConfig, getBaseUrl, getOAuthClientId } from './auth.js';
-import { getConfig, updateConfig } from './config.js';
-import { CliError } from './errors.js';
-const DEFAULT_BASE_URL = 'https://app.getoutline.com';
+import { LEGACY_CLEAR_PAYLOAD, SECURE_STORE_SERVICE, TOKEN_ENV_VAR } from './auth-constants.js';
+import { getBaseUrl, getOAuthClientId } from './auth.js';
+import { getConfig, getConfigPath, updateConfig } from './config.js';
+import { runMigrateLegacyAuth } from './migrate-auth.js';
+import { makeOutlineAccount } from './outline-account.js';
+import { createOutlineUserRecordStore, getDefaultUserRecord } from './user-records.js';
 function asHandshake(value) {
     return value;
 }
@@ -100,99 +102,198 @@ export function createOutlineAuthProvider() {
                 token,
                 baseUrl: hs.baseUrl,
             });
-            return {
+            return makeOutlineAccount({
                 id: data.user.id,
                 label: data.user.name,
                 baseUrl: hs.baseUrl,
                 oauthClientId: hs.clientId,
                 teamName: data.team.name,
-            };
+            });
         },
     };
 }
-export function createOutlineTokenStore() {
-    /**
-     * Derive a snapshot from an already-loaded config. Pure, so ref-aware
-     * callers can validate without a second config read.
-     */
-    function deriveSnapshot(config) {
-        if (!config.api_token)
-            return null;
-        const id = config.auth_user_id;
-        const label = config.auth_user_name;
-        if (!id || !label) {
-            // Stored token predates this adapter (env var, pre-upgrade
-            // config). No persisted identity to round-trip.
-            return null;
-        }
-        return {
-            token: config.api_token,
-            account: {
-                id,
-                label,
-                baseUrl: config.base_url ?? DEFAULT_BASE_URL,
-                oauthClientId: config.oauth_client_id ?? '',
-                teamName: config.auth_team_name,
-            },
-        };
-    }
-    /**
-     * Match the stored account against `--user <ref>`. Outline accounts use
-     * UUID ids and a display name — id matches are case-sensitive (UUIDs
-     * are canonical), label matches are case-insensitive so users can pass
-     * the name they see in `auth status` regardless of casing.
-     */
-    function matchesRef(account, ref) {
-        if (account.id === ref)
-            return true;
-        return account.label.toLowerCase() === ref.toLowerCase();
+/**
+ * Accepts the Outline user UUID or display name. Id matches are
+ * case-sensitive (UUIDs are canonical); label matches are
+ * case-insensitive so users can pass the name they see in `auth status`.
+ */
+export function matchOutlineAccount(account, ref) {
+    if (account.id === ref)
+        return true;
+    return account.label.toLowerCase() === ref.toLowerCase();
+}
+/** True when the v2 store is the authoritative source. */
+function migrationIsConclusive(result) {
+    return (result.status === 'migrated' ||
+        result.status === 'already-migrated' ||
+        result.status === 'no-legacy-state');
+}
+/**
+ * Synthesise a snapshot from v1 plaintext state still on disk. Fallback for
+ * when migration can't complete (offline `identifyAccount`, WSL
+ * `legacy-keyring-unreachable`). Returns `null` when no legacy token is
+ * present. The synthesised account uses whatever identity fields the v1
+ * config has — for pre-#71 configs the id/label may be empty, but the
+ * runtime never renders those (status's `fetchLive` re-derives from the
+ * API), so empty placeholders are safe.
+ */
+async function readLegacyTokenSnapshot() {
+    const config = await getConfig();
+    const token = config.api_token?.trim() || null;
+    if (!token)
+        return null;
+    return {
+        token,
+        account: makeOutlineAccount({
+            id: config.auth_user_id ?? '',
+            label: config.auth_user_name ?? '',
+            baseUrl: config.base_url,
+            oauthClientId: config.oauth_client_id,
+            teamName: config.auth_team_name,
+        }),
+    };
+}
+/**
+ * Discharge v1 plaintext state. Runs **after** a successful v2 write/clear
+ * — never before — so a v2-op failure doesn't strand the user with no
+ * recoverable credentials. Caller decides whether to swallow or propagate
+ * the `updateConfig` failure:
+ *   - `set()` swallows (v2 record will win in `active()` regardless).
+ *   - `clear()` propagates (v2 is empty, so a stale legacy token would
+ *     shadow the logout via the fallback).
+ */
+async function dischargeLegacyState() {
+    await updateConfig(LEGACY_CLEAR_PAYLOAD);
+}
+/**
+ * Memoised one-shot migration trigger. Resolves with `null` on rejection so
+ * the CLI never fails to start because of a migration error — the legacy
+ * snapshot fallback handles that case. Tests reset the memo with
+ * `vi.resetModules()` + a dynamic re-import.
+ */
+let migrationPromise;
+function ensureMigrated() {
+    if (!migrationPromise) {
+        migrationPromise = runMigrateLegacyAuth({ silent: true }).catch(() => null);
     }
-    function refMismatch(ref) {
-        return new CliError('ACCOUNT_NOT_FOUND', `No stored account matches "${ref}".`);
+    return migrationPromise;
+}
+/**
+ * True when the v2 store is empty but a legacy v1 token snapshot is still
+ * the only thing keeping the CLI authenticated — typically because
+ * `migrateLegacyAuth` couldn't reach the Outline API to identify the
+ * account (`MigrateSkipReason: 'identify-failed'`) or the OS keyring is
+ * unreachable (`'legacy-keyring-unreachable'`, although outline has no
+ * v1 keyring slot to read from). Useful for downstream diagnostics.
+ */
+export async function isLegacyAuthActive() {
+    const result = await ensureMigrated();
+    if (result !== null && migrationIsConclusive(result))
+        return false;
+    const legacy = await readLegacyTokenSnapshot();
+    return legacy !== null;
+}
+/**
+ * `OUTLINE_API_TOKEN` short-circuits `active()` only when no explicit ref
+ * is supplied — cli-core's `KeyringTokenStore` doesn't know about the env
+ * var, and an explicit ref means the caller targets a specific stored
+ * account.
+ *
+ * `ensureMigrated()` runs **before** every mutating v2 op so the post-op
+ * legacy discharge can't race a still-pending migration into re-grabbing
+ * the legacy `api_token` we just consumed. `set()` / `clear()` then
+ * discharge legacy state **after** the v2 op succeeds. `set()` swallows
+ * the cleanup failure (v2 wins in `active()` regardless); `clear()`
+ * propagates it so a failed logout fails loudly instead of leaving the
+ * user authenticated via the legacy fallback.
+ */
+export function createOutlineTokenStore() {
+    const inner = createKeyringTokenStore({
+        serviceName: SECURE_STORE_SERVICE,
+        userRecords: createOutlineUserRecordStore(),
+        recordsLocation: getConfigPath(),
+        matchAccount: matchOutlineAccount,
+    });
+    async function migrationIsInconclusive() {
+        const result = await ensureMigrated(); // memoised
+        return result === null || !migrationIsConclusive(result);
     }
     return {
         async active(ref) {
-            const snapshot = deriveSnapshot(await getConfig());
-            if (ref === undefined)
-                return snapshot;
-            if (!snapshot || !matchesRef(snapshot.account, ref))
-                throw refMismatch(ref);
-            return snapshot;
+            if (ref === undefined) {
+                const envToken = process.env[TOKEN_ENV_VAR]?.trim();
+                if (envToken) {
+                    return {
+                        token: envToken,
+                        account: makeOutlineAccount({
+                            id: '',
+                            label: '',
+                            baseUrl: await getBaseUrl(),
+                        }),
+                    };
+                }
+            }
+            await ensureMigrated();
+            const fromStore = await inner.active(ref);
+            if (fromStore)
+                return fromStore;
+            const legacy = await readLegacyTokenSnapshot();
+            if (legacy && (ref === undefined || matchOutlineAccount(legacy.account, ref))) {
+                return legacy;
+            }
+            return null;
         },
         async set(account, token) {
-            await updateConfig({
-                api_token: token,
-                base_url: account.baseUrl,
-                oauth_client_id: account.oauthClientId,
-                auth_user_id: account.id,
-                auth_user_name: account.label,
-                auth_team_name: account.teamName,
-            });
+            await ensureMigrated();
+            await inner.set(account, token);
+            if (await migrationIsInconclusive()) {
+                // Best-effort: a lingering `api_token` is dormant because
+                // `active()` reads v2 first.
+                await dischargeLegacyState().catch(() => undefined);
+            }
         },
         async clear(ref) {
-            // With `ref`, validate before touching storage so a mismatch is
-            // an `ACCOUNT_NOT_FOUND` error rather than a silent success —
-            // `attachLogoutCommand` treats any non-throwing `clear()` as
-            // success. Load the config once and hand it to `clearConfig`
-            // so ref-based logout stays at one read + one write.
-            const config = await getConfig();
-            if (ref !== undefined) {
-                const snapshot = deriveSnapshot(config);
-                if (!snapshot || !matchesRef(snapshot.account, ref))
-                    throw refMismatch(ref);
+            await ensureMigrated();
+            await inner.clear(ref);
+            if (await migrationIsInconclusive()) {
+                // Must succeed: v2 is now empty, so a surviving legacy
+                // token would shadow the logout via the fallback.
+                await dischargeLegacyState();
             }
-            await clearConfig(config);
         },
         async list() {
-            const snapshot = deriveSnapshot(await getConfig());
-            return snapshot ? [{ account: snapshot.account, isDefault: true }] : [];
+            await ensureMigrated();
+            return inner.list();
         },
         async setDefault(ref) {
-            const snapshot = deriveSnapshot(await getConfig());
-            if (!snapshot || !matchesRef(snapshot.account, ref))
-                throw refMismatch(ref);
-            // Single-user store — already the default once `ref` matches.
+            await ensureMigrated();
+            return inner.setDefault(ref);
         },
+        getLastStorageResult: () => inner.getLastStorageResult(),
+        getLastClearResult: () => inner.getLastClearResult(),
     };
 }
+/**
+ * Where the currently-active token lives. Mirrors `active()`'s resolution
+ * order — env → v2 record → legacy plaintext — so the answer can never
+ * contradict the token the runtime is actually using.
+ *
+ * The precedence cascade is intentionally duplicated with `active()`:
+ * the only true dedupe options either (a) add an extra config read on
+ * every `apiRequest` call (regressing the request hot path) or (b)
+ * augment cli-core's `TokenStore` contract. The drift the duplication
+ * invites is guarded by the `getActiveTokenSource` regression test that
+ * asserts v2-record presence wins over a lingering v1 `api_token`.
+ */
+export async function getActiveTokenSource() {
+    if (process.env[TOKEN_ENV_VAR]?.trim())
+        return 'env';
+    const config = await getConfig();
+    const record = getDefaultUserRecord(config);
+    if (record)
+        return record.fallbackToken ? 'config-file' : 'secure-store';
+    if (config.api_token?.trim())
+        return 'config-file';
+    return 'secure-store';
+}
 //# sourceMappingURL=auth-provider.js.map

package/dist/lib/auth-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-provider.js","sourceRoot":"","sources":["../../src/lib/auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAIH,eAAe,EACf,gBAAgB,GAEnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AACrE,OAAO,EAAe,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAEtC,MAAM,gBAAgB,GAAG,4BAA4B,CAAA;AAqBrD,SAAS,WAAW,CAAC,KAA8B;IAC/C,OAAO,KAAyB,CAAA;AACpC,CAAC;AAED,SAAS,UAAU,CAAC,KAA8B,EAAE,GAAW;IAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;IACxB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/E,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,QAAgB;IAClC,4EAA4E;IAC5E,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAC5E,IAAI,CAAC;QACD,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC/C,CAAC;YAAS,CAAC;QACP,EAAE,CAAC,KAAK,EAAE,CAAA;IACd,CAAC;AACL,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAA8B;IACxD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IAC7C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAA;IAC/C,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC9C,MAAM,UAAU,GAAG,MAAM,UAAU,EAAE,CAAA;IACrC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,sBAAsB,UAAU,KAAK,CAAC,CAAA;IACpE,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACtD,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAA8B;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC9C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,EAAE,CAAA;IACzC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACX,wIAAwI,CAC3I,CAAA;IACL,CAAC;IACD,OAAO,QAAQ,CAAA;AACnB,CAAC;AAED,MAAM,UAAU,yBAAyB;IACrC,OAAO;QACH,KAAK,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAA;YAC3C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAA;YAC7C,MAAM,YAAY,GAAG,gBAAgB,EAAE,CAAA;YACvC,MAAM,aAAa,GAAG,eAAe,CAAC,YAAY,CAAC,CAAA;YAEnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,OAAO,kBAAkB,CAAC,CAAA;YACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;YAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAA;YAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAA;YACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAA;YACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAA;YACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAEpC,MAAM,SAAS,GAAqB,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAA;YACvE,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAA;QACtD,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE;YAC/C,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;YACjC,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;YACtE,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;gBAC/B,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,EAAE,CAAC,QAAQ;gBACtB,YAAY,EAAE,WAAW;gBACzB,aAAa,EAAE,EAAE,CAAC,YAAY;gBAC9B,IAAI;aACP,CAAC,CAAA;YAEF,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC;gBAC7B,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,cAAc;gBAChC,OAAO,EAAE;oBACL,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;oBAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;iBAC1B;aACJ,CAAC,CAAA;YAEF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAK/C,CAAA;YAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACV,MAAM,OAAO,GACT,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,CAAA;gBAC1E,MAAM,IAAI,KAAK,CAAC,gCAAgC,OAAO,EAAE,CAAC,CAAA;YAC9D,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;YAC3E,CAAC;YAED,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,CAAA;QAC7C,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE;YACpC,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;YACjC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAC7B,WAAW,EACX,EAAE,EACF;gBACI,KAAK;gBACL,OAAO,EAAE,EAAE,CAAC,OAAO;aACtB,CACJ,CAAA;YACD,OAAO;gBACH,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;gBAChB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;gBACrB,OAAO,EAAE,EAAE,CAAC,OAAO;gBACnB,aAAa,EAAE,EAAE,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;aAC3B,CAAA;QACL,CAAC;KACJ,CAAA;AACL,CAAC;AAED,MAAM,UAAU,uBAAuB;IACnC;;;OAGG;IACH,SAAS,cAAc,CACnB,MAAuB;QAEvB,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,OAAO,IAAI,CAAA;QAClC,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAA;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAA;QACnC,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,2DAA2D;YAC3D,gDAAgD;YAChD,OAAO,IAAI,CAAA;QACf,CAAC;QACD,OAAO;YACH,KAAK,EAAE,MAAM,CAAC,SAAS;YACvB,OAAO,EAAE;gBACL,EAAE;gBACF,KAAK;gBACL,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,gBAAgB;gBAC5C,aAAa,EAAE,MAAM,CAAC,eAAe,IAAI,EAAE;gBAC3C,QAAQ,EAAE,MAAM,CAAC,cAAc;aAClC;SACJ,CAAA;IACL,CAAC;IAED;;;;;OAKG;IACH,SAAS,UAAU,CAAC,OAAuB,EAAE,GAAe;QACxD,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;QACnC,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CAAA;IAC5D,CAAC;IAED,SAAS,WAAW,CAAC,GAAe;QAChC,OAAO,IAAI,QAAQ,CAAC,mBAAmB,EAAE,8BAA8B,GAAG,IAAI,CAAC,CAAA;IACnF,CAAC;IAED,OAAO;QACH,KAAK,CAAC,MAAM,CAAC,GAAgB;YACzB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,SAAS,EAAE,CAAC,CAAA;YAClD,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,QAAQ,CAAA;YACtC,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC;gBAAE,MAAM,WAAW,CAAC,GAAG,CAAC,CAAA;YAC3E,OAAO,QAAQ,CAAA;QACnB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK;YACpB,MAAM,YAAY,CAAC;gBACf,SAAS,EAAE,KAAK;gBAChB,QAAQ,EAAE,OAAO,CAAC,OAAO;gBACzB,eAAe,EAAE,OAAO,CAAC,aAAa;gBACtC,YAAY,EAAE,OAAO,CAAC,EAAE;gBACxB,cAAc,EAAE,OAAO,CAAC,KAAK;gBAC7B,cAAc,EAAE,OAAO,CAAC,QAAQ;aACnC,CAAC,CAAA;QACN,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAgB;YACxB,gEAAgE;YAChE,8DAA8D;YAC9D,6DAA6D;YAC7D,6DAA6D;YAC7D,qDAAqD;YACrD,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;YAChC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACpB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;gBACvC,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC;oBAAE,MAAM,WAAW,CAAC,GAAG,CAAC,CAAA;YAC/E,CAAC;YACD,MAAM,WAAW,CAAC,MAAM,CAAC,CAAA;QAC7B,CAAC;QACD,KAAK,CAAC,IAAI;YACN,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,SAAS,EAAE,CAAC,CAAA;YAClD,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC3E,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,GAAe;YAC5B,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,SAAS,EAAE,CAAC,CAAA;YAClD,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC;gBAAE,MAAM,WAAW,CAAC,GAAG,CAAC,CAAA;YAC3E,8DAA8D;QAClE,CAAC;KACJ,CAAA;AACL,CAAC"}
+{"version":3,"file":"auth-provider.js","sourceRoot":"","sources":["../../src/lib/auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAGH,uBAAuB,EACvB,eAAe,EACf,gBAAgB,GAGnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC/F,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAuB,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAiBtF,SAAS,WAAW,CAAC,KAA8B;IAC/C,OAAO,KAAyB,CAAA;AACpC,CAAC;AAED,SAAS,UAAU,CAAC,KAA8B,EAAE,GAAW;IAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;IACxB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/E,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,QAAgB;IAClC,4EAA4E;IAC5E,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAC5E,IAAI,CAAC;QACD,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC/C,CAAC;YAAS,CAAC;QACP,EAAE,CAAC,KAAK,EAAE,CAAA;IACd,CAAC;AACL,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAA8B;IACxD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IAC7C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAA;IAC/C,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC9C,MAAM,UAAU,GAAG,MAAM,UAAU,EAAE,CAAA;IACrC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,sBAAsB,UAAU,KAAK,CAAC,CAAA;IACpE,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACtD,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAA8B;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC9C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,EAAE,CAAA;IACzC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACX,wIAAwI,CAC3I,CAAA;IACL,CAAC;IACD,OAAO,QAAQ,CAAA;AACnB,CAAC;AAED,MAAM,UAAU,yBAAyB;IACrC,OAAO;QACH,KAAK,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAA;YAC3C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAA;YAC7C,MAAM,YAAY,GAAG,gBAAgB,EAAE,CAAA;YACvC,MAAM,aAAa,GAAG,eAAe,CAAC,YAAY,CAAC,CAAA;YAEnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,OAAO,kBAAkB,CAAC,CAAA;YACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;YAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAA;YAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAA;YACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAA;YACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAA;YACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAEpC,MAAM,SAAS,GAAqB,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAA;YACvE,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAA;QACtD,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE;YAC/C,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;YACjC,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;YACtE,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;gBAC/B,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,EAAE,CAAC,QAAQ;gBACtB,YAAY,EAAE,WAAW;gBACzB,aAAa,EAAE,EAAE,CAAC,YAAY;gBAC9B,IAAI;aACP,CAAC,CAAA;YAEF,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC;gBAC7B,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,cAAc;gBAChC,OAAO,EAAE;oBACL,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;oBAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;iBAC1B;aACJ,CAAC,CAAA;YAEF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAK/C,CAAA;YAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACV,MAAM,OAAO,GACT,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,CAAA;gBAC1E,MAAM,IAAI,KAAK,CAAC,gCAAgC,OAAO,EAAE,CAAC,CAAA;YAC9D,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;YAC3E,CAAC;YAED,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,CAAA;QAC7C,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE;YACpC,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;YACjC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAC7B,WAAW,EACX,EAAE,EACF;gBACI,KAAK;gBACL,OAAO,EAAE,EAAE,CAAC,OAAO;aACtB,CACJ,CAAA;YACD,OAAO,kBAAkB,CAAC;gBACtB,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;gBAChB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;gBACrB,OAAO,EAAE,EAAE,CAAC,OAAO;gBACnB,aAAa,EAAE,EAAE,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;aAC3B,CAAC,CAAA;QACN,CAAC;KACJ,CAAA;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAuB,EAAE,GAAe;IACxE,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACnC,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CAAA;AAC5D,CAAC;AAED,0DAA0D;AAC1D,SAAS,qBAAqB,CAAC,MAAyC;IACpE,OAAO,CACH,MAAM,CAAC,MAAM,KAAK,UAAU;QAC5B,MAAM,CAAC,MAAM,KAAK,kBAAkB;QACpC,MAAM,CAAC,MAAM,KAAK,iBAAiB,CACtC,CAAA;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,uBAAuB;IAIlC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,IAAI,CAAA;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,OAAO;QACH,KAAK;QACL,OAAO,EAAE,kBAAkB,CAAC;YACxB,EAAE,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YAC7B,KAAK,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;YAClC,OAAO,EAAE,MAAM,CAAC,QAAQ;YACxB,aAAa,EAAE,MAAM,CAAC,eAAe;YACrC,QAAQ,EAAE,MAAM,CAAC,cAAc;SAClC,CAAC;KACL,CAAA;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB;IAC/B,MAAM,YAAY,CAAC,oBAAoB,CAAC,CAAA;AAC5C,CAAC;AAED;;;;;GAKG;AACH,IAAI,gBAA+E,CAAA;AACnF,SAAS,cAAc;IACnB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpB,gBAAgB,GAAG,oBAAoB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAC/E,CAAC;IACD,OAAO,gBAAgB,CAAA;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACpC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAA;IACrC,IAAI,MAAM,KAAK,IAAI,IAAI,qBAAqB,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IAClE,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;IAC9C,OAAO,MAAM,KAAK,IAAI,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB;IACnC,MAAM,KAAK,GAAG,uBAAuB,CAAiB;QAClD,WAAW,EAAE,oBAAoB;QACjC,WAAW,EAAE,4BAA4B,EAAE;QAC3C,eAAe,EAAE,aAAa,EAAE;QAChC,YAAY,EAAE,mBAAmB;KACpC,CAAC,CAAA;IACF,KAAK,UAAU,uBAAuB;QAClC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAA,CAAC,WAAW;QACjD,OAAO,MAAM,KAAK,IAAI,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO;QACH,KAAK,CAAC,MAAM,CAAC,GAAgB;YACzB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACpB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAA;gBACnD,IAAI,QAAQ,EAAE,CAAC;oBACX,OAAO;wBACH,KAAK,EAAE,QAAQ;wBACf,OAAO,EAAE,kBAAkB,CAAC;4BACxB,EAAE,EAAE,EAAE;4BACN,KAAK,EAAE,EAAE;4BACT,OAAO,EAAE,MAAM,UAAU,EAAE;yBAC9B,CAAC;qBACL,CAAA;gBACL,CAAC;YACL,CAAC;YACD,MAAM,cAAc,EAAE,CAAA;YACtB,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACzC,IAAI,SAAS;gBAAE,OAAO,SAAS,CAAA;YAE/B,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;YAC9C,IAAI,MAAM,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC5E,OAAO,MAAM,CAAA;YACjB,CAAC;YACD,OAAO,IAAI,CAAA;QACf,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAuB,EAAE,KAAa;YAC5C,MAAM,cAAc,EAAE,CAAA;YACtB,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAC/B,IAAI,MAAM,uBAAuB,EAAE,EAAE,CAAC;gBAClC,0DAA0D;gBAC1D,6BAA6B;gBAC7B,MAAM,oBAAoB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACvD,CAAC;QACL,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAgB;YACxB,MAAM,cAAc,EAAE,CAAA;YACtB,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACtB,IAAI,MAAM,uBAAuB,EAAE,EAAE,CAAC;gBAClC,uDAAuD;gBACvD,kDAAkD;gBAClD,MAAM,oBAAoB,EAAE,CAAA;YAChC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,IAAI;YACN,MAAM,cAAc,EAAE,CAAA;YACtB,OAAO,KAAK,CAAC,IAAI,EAAE,CAAA;QACvB,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,GAAe;YAC5B,MAAM,cAAc,EAAE,CAAA;YACtB,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAChC,CAAC;QACD,oBAAoB,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE;QACxD,kBAAkB,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,kBAAkB,EAAE;KACvD,CAAA;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACtC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE;QAAE,OAAO,KAAK,CAAA;IACpD,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAA;IACxE,IAAI,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE;QAAE,OAAO,aAAa,CAAA;IAClD,OAAO,cAAc,CAAA;AACzB,CAAC"}

package/dist/lib/auth.d.ts

@@ -1,15 +1,28 @@
-import { type Config } from './config.js';
+import { SecureStoreUnavailableError } from '@doist/cli-core/auth';
+import { TOKEN_ENV_VAR } from './auth-constants.js';
+import { getActiveTokenSource } from './auth-provider.js';
+import { CliError } from './errors.js';
+export { SecureStoreUnavailableError, getActiveTokenSource, TOKEN_ENV_VAR };
+export declare class NoTokenError extends CliError {
+    constructor();
+}
+/**
+ * Read the active token. Hot path: when `OUTLINE_API_TOKEN` is set we
+ * return it directly without consulting the token store, since
+ * `apiRequest` already resolves the base URL separately — going through
+ * `store.active()` here would trigger a redundant `getBaseUrl()` lookup
+ * per request just to synthesise an account we don't need.
+ */
 export declare function getApiToken(): Promise<string>;
+/**
+ * Base URL cascade: env var → default user record (v2) → legacy
+ * `base_url` config (v1) → built-in default. The record takes priority
+ * over the legacy slot so post-migration logins keep defaulting to the
+ * same Outline instance.
+ */
 export declare function getBaseUrl(): Promise<string>;
-export declare function getOAuthClientId(): Promise<string | undefined>;
-export declare function getTokenSource(): Promise<'env' | 'config' | null>;
 /**
- * Clear the auth-related keys without deleting the file. The config is now
- * shared with non-auth settings (notably `update_channel`); a blanket unlink
- * would silently reset the user's update-channel preference too.
- *
- * Pass `existing` to skip the read when the caller has already loaded the
- * config (e.g. ref-validated logout) — keeps that flow at one read + one
- * write instead of two reads.
+ * OAuth client id cascade: env var → default user record (v2) → legacy
+ * `oauth_client_id` config (v1) → undefined (caller prompts).
  */
-export declare function clearConfig(existing?: Partial<Config>): Promise<void>;
+export declare function getOAuthClientId(): Promise<string | undefined>;

package/dist/lib/auth.js

@@ -1,56 +1,74 @@
-import { getConfig, setConfig } from './config.js';
-const DEFAULT_BASE_URL = 'https://app.getoutline.com';
+import { SecureStoreUnavailableError } from '@doist/cli-core/auth';
+import { TOKEN_ENV_VAR } from './auth-constants.js';
+import { createOutlineTokenStore, getActiveTokenSource, } from './auth-provider.js';
+import { getConfig } from './config.js';
+import { CliError } from './errors.js';
+import { DEFAULT_BASE_URL } from './outline-account.js';
+import { getDefaultUserRecord } from './user-records.js';
+export { SecureStoreUnavailableError, getActiveTokenSource, TOKEN_ENV_VAR };
+export class NoTokenError extends CliError {
+    constructor() {
+        super('NO_TOKEN', `No API token found. Set ${TOKEN_ENV_VAR} env var or run: ol auth login`, [`Set ${TOKEN_ENV_VAR} or run: ol auth login`], 'info');
+        this.name = 'NoTokenError';
+    }
+}
+/**
+ * Module-level token-store singleton. Built lazily on first call; reused
+ * across every `apiRequest` so the request hot path doesn't reconstruct
+ * the keyring + user-record adapters per POST.
+ */
+let storeSingleton;
+function tokenStore() {
+    if (!storeSingleton)
+        storeSingleton = createOutlineTokenStore();
+    return storeSingleton;
+}
+/**
+ * Read the active token. Hot path: when `OUTLINE_API_TOKEN` is set we
+ * return it directly without consulting the token store, since
+ * `apiRequest` already resolves the base URL separately — going through
+ * `store.active()` here would trigger a redundant `getBaseUrl()` lookup
+ * per request just to synthesise an account we don't need.
+ */
 export async function getApiToken() {
-    const envToken = process.env.OUTLINE_API_TOKEN;
+    const envToken = process.env[TOKEN_ENV_VAR]?.trim();
     if (envToken)
         return envToken;
-    const config = await getConfig();
-    if (config.api_token)
-        return config.api_token;
-    throw new Error('No API token found. Set OUTLINE_API_TOKEN env var or run: ol auth login');
+    const snapshot = await tokenStore().active();
+    if (!snapshot?.token)
+        throw new NoTokenError();
+    return snapshot.token;
 }
+/**
+ * Base URL cascade: env var → default user record (v2) → legacy
+ * `base_url` config (v1) → built-in default. The record takes priority
+ * over the legacy slot so post-migration logins keep defaulting to the
+ * same Outline instance.
+ */
 export async function getBaseUrl() {
     const envUrl = process.env.OUTLINE_URL;
     if (envUrl)
         return envUrl.replace(/\/$/, '');
     const config = await getConfig();
+    const record = getDefaultUserRecord(config);
+    if (record?.account.baseUrl)
+        return record.account.baseUrl.replace(/\/$/, '');
     if (config.base_url)
         return config.base_url.replace(/\/$/, '');
     return DEFAULT_BASE_URL;
 }
+/**
+ * OAuth client id cascade: env var → default user record (v2) → legacy
+ * `oauth_client_id` config (v1) → undefined (caller prompts).
+ */
 export async function getOAuthClientId() {
     const envClientId = process.env.OUTLINE_OAUTH_CLIENT_ID;
     if (envClientId)
         return envClientId;
     const config = await getConfig();
+    const record = getDefaultUserRecord(config);
+    if (record?.account.oauthClientId)
+        return record.account.oauthClientId;
     return config.oauth_client_id;
 }
-export async function getTokenSource() {
-    if (process.env.OUTLINE_API_TOKEN)
-        return 'env';
-    const config = await getConfig();
-    if (config.api_token)
-        return 'config';
-    return null;
-}
-/**
- * Clear the auth-related keys without deleting the file. The config is now
- * shared with non-auth settings (notably `update_channel`); a blanket unlink
- * would silently reset the user's update-channel preference too.
- *
- * Pass `existing` to skip the read when the caller has already loaded the
- * config (e.g. ref-validated logout) — keeps that flow at one read + one
- * write instead of two reads.
- */
-export async function clearConfig(existing) {
-    const config = existing ?? (await getConfig());
-    const { api_token, base_url, oauth_client_id, auth_user_id, auth_user_name, auth_team_name, ...rest } = config;
-    void api_token;
-    void base_url;
-    void oauth_client_id;
-    void auth_user_id;
-    void auth_user_name;
-    void auth_team_name;
-    await setConfig(rest);
-}
 //# sourceMappingURL=auth.js.map

package/dist/lib/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAE/D,MAAM,gBAAgB,GAAG,4BAA4B,CAAA;AAErD,MAAM,CAAC,KAAK,UAAU,WAAW;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAA;IAC9C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAE7B,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,IAAI,MAAM,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC,SAAS,CAAA;IAE7C,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAA;AAC9F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAA;IACtC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAE5C,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAE9D,OAAO,gBAAgB,CAAA;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB;IAClC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAA;IACvD,IAAI,WAAW;QAAE,OAAO,WAAW,CAAA;IAEnC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,OAAO,MAAM,CAAC,eAAe,CAAA;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAChC,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAAE,OAAO,KAAK,CAAA;IAC/C,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,IAAI,MAAM,CAAC,SAAS;QAAE,OAAO,QAAQ,CAAA;IACrC,OAAO,IAAI,CAAA;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAA0B;IACxD,MAAM,MAAM,GAAG,QAAQ,IAAI,CAAC,MAAM,SAAS,EAAE,CAAC,CAAA;IAC9C,MAAM,EACF,SAAS,EACT,QAAQ,EACR,eAAe,EACf,YAAY,EACZ,cAAc,EACd,cAAc,EACd,GAAG,IAAI,EACV,GAAG,MAAM,CAAA;IACV,KAAK,SAAS,CAAA;IACd,KAAK,QAAQ,CAAA;IACb,KAAK,eAAe,CAAA;IACpB,KAAK,YAAY,CAAA;IACjB,KAAK,cAAc,CAAA;IACnB,KAAK,cAAc,CAAA;IACnB,MAAM,SAAS,CAAC,IAAc,CAAC,CAAA;AACnC,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAA;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EACH,uBAAuB,EACvB,oBAAoB,GAEvB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAExD,OAAO,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,aAAa,EAAE,CAAA;AAE3E,MAAM,OAAO,YAAa,SAAQ,QAAQ;IACtC;QACI,KAAK,CACD,UAAU,EACV,2BAA2B,aAAa,gCAAgC,EACxE,CAAC,OAAO,aAAa,wBAAwB,CAAC,EAC9C,MAAM,CACT,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,cAAc,CAAA;IAC9B,CAAC;CACJ;AAED;;;;GAIG;AACH,IAAI,cAA6C,CAAA;AACjD,SAAS,UAAU;IACf,IAAI,CAAC,cAAc;QAAE,cAAc,GAAG,uBAAuB,EAAE,CAAA;IAC/D,OAAO,cAAc,CAAA;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAA;IACnD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,QAAQ,GAAG,MAAM,UAAU,EAAE,CAAC,MAAM,EAAE,CAAA;IAC5C,IAAI,CAAC,QAAQ,EAAE,KAAK;QAAE,MAAM,IAAI,YAAY,EAAE,CAAA;IAC9C,OAAO,QAAQ,CAAC,KAAK,CAAA;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAA;IACtC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAE5C,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,MAAM,EAAE,OAAO,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC7E,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC9D,OAAO,gBAAgB,CAAA;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IAClC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAA;IACvD,IAAI,WAAW;QAAE,OAAO,WAAW,CAAA;IAEnC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,MAAM,EAAE,OAAO,CAAC,aAAa;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;IACtE,OAAO,MAAM,CAAC,eAAe,CAAA;AACjC,CAAC"}

package/dist/lib/config.d.ts

@@ -1,5 +1,25 @@
 import { type CoreConfig } from '@doist/cli-core';
+/**
+ * One row of the `users[]` array. `id` is the Outline user UUID. `token` is
+ * a plaintext fallback persisted only when the OS keyring is unavailable at
+ * write time (WSL, headless Linux, missing native binary).
+ */
+export type StoredUser = {
+    id: string;
+    name: string;
+    base_url?: string;
+    oauth_client_id?: string;
+    team_name?: string;
+    token?: string;
+};
 export type Config = CoreConfig & {
+    config_version?: number;
+    users?: StoredUser[];
+    default_user_id?: string;
+    /**
+     * Legacy v1 single-user fields. Read by the migration helper; removed
+     * from disk by `cleanupLegacyConfig` after the v2 record write succeeds.
+     */
     api_token?: string;
     base_url?: string;
     oauth_client_id?: string;

package/dist/lib/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAEH,aAAa,IAAI,iBAAiB,EAClC,UAAU,IAAI,cAAc,EAC5B,YAAY,IAAI,gBAAgB,EAChC,WAAW,IAAI,eAAe,GACjC,MAAM,iBAAiB,CAAA;AAExB,MAAM,QAAQ,GAAG,aAAa,CAAA;AAW9B;;;;GAIG;AACH,MAAM,UAAU,aAAa;IACzB,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC3B,OAAO,cAAc,CAAS,aAAa,EAAE,CAAC,CAAA;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAc;IAC1C,OAAO,eAAe,CAAC,aAAa,EAAE,EAAE,MAAM,CAAC,CAAA;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAwB;IACvD,OAAO,gBAAgB,CAAS,aAAa,EAAE,EAAE,OAAO,CAAC,CAAA;AAC7D,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAEH,aAAa,IAAI,iBAAiB,EAClC,UAAU,IAAI,cAAc,EAC5B,YAAY,IAAI,gBAAgB,EAChC,WAAW,IAAI,eAAe,GACjC,MAAM,iBAAiB,CAAA;AAExB,MAAM,QAAQ,GAAG,aAAa,CAAA;AAiC9B;;;;GAIG;AACH,MAAM,UAAU,aAAa;IACzB,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC3B,OAAO,cAAc,CAAS,aAAa,EAAE,CAAC,CAAA;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAc;IAC1C,OAAO,eAAe,CAAC,aAAa,EAAE,EAAE,MAAM,CAAC,CAAA;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAwB;IACvD,OAAO,gBAAgB,CAAS,aAAa,EAAE,EAAE,OAAO,CAAC,CAAA;AAC7D,CAAC"}

package/dist/lib/errors.d.ts

@@ -1,7 +1,7 @@
 import { CliError as CoreCliError, type CliErrorCode, type ErrorType } from '@doist/cli-core';
 export { CoreCliError as BaseCliError };
 export type { ErrorType } from '@doist/cli-core';
-export type ErrorCode = 'ACCOUNT_NOT_FOUND' | 'AUTH_VERIFICATION_FAILED' | 'CONFIRMATION_REQUIRED' | 'CONFLICTING_OPTIONS' | 'INVALID_PARENT' | 'MISSING_OPTION' | 'OAUTH_CALLBACK_PORT_INVALID' | 'OAUTH_CALLBACK_SERVER_FAILED' | 'OAUTH_CLIENT_ID_REQUIRED' | 'OAUTH_LOGIN_FAILED' | 'UNKNOWN_AGENT';
+export type ErrorCode = 'ACCOUNT_NOT_FOUND' | 'AUTH_VERIFICATION_FAILED' | 'CONFIRMATION_REQUIRED' | 'CONFLICTING_OPTIONS' | 'INVALID_PARENT' | 'MISSING_OPTION' | 'NO_TOKEN' | 'OAUTH_CALLBACK_PORT_INVALID' | 'OAUTH_CALLBACK_SERVER_FAILED' | 'OAUTH_CLIENT_ID_REQUIRED' | 'OAUTH_LOGIN_FAILED' | 'UNKNOWN_AGENT';
 export declare class CliError extends CoreCliError<ErrorCode> {
     constructor(code: ErrorCode | CliErrorCode, message: string, hints?: string[], type?: ErrorType);
 }

package/dist/lib/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAqC,MAAM,iBAAiB,CAAA;AAE7F,OAAO,EAAE,YAAY,IAAI,YAAY,EAAE,CAAA;AAgBvC,MAAM,OAAO,QAAS,SAAQ,YAAuB;IACjD,YACI,IAA8B,EAC9B,OAAe,EACf,KAAgB,EAChB,OAAkB,OAAO;QAEzB,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACzC,CAAC;CACJ;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAqC,MAAM,iBAAiB,CAAA;AAE7F,OAAO,EAAE,YAAY,IAAI,YAAY,EAAE,CAAA;AAiBvC,MAAM,OAAO,QAAS,SAAQ,YAAuB;IACjD,YACI,IAA8B,EAC9B,OAAe,EACf,KAAgB,EAChB,OAAkB,OAAO;QAEzB,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACzC,CAAC;CACJ;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/lib/migrate-auth.d.ts

@@ -0,0 +1,11 @@
+import { type MigrateAuthResult } from '@doist/cli-core/auth';
+import { type OutlineAccount } from './outline-account.js';
+/**
+ * One-time migration of v1 plaintext auth state into the v2 `users[]`
+ * shape. Called lazily by `createOutlineTokenStore` on first store access.
+ * Idempotent via the `config_version` marker — once set to `>= 2`, this
+ * helper short-circuits with `already-migrated`.
+ */
+export declare function runMigrateLegacyAuth(options?: {
+    silent: boolean;
+}): Promise<MigrateAuthResult<OutlineAccount>>;

package/dist/lib/migrate-auth.js

@@ -0,0 +1,92 @@
+import { migrateLegacyAuth } from '@doist/cli-core/auth';
+import { fetchWithRetry } from '../transport/fetch-with-retry.js';
+import { LEGACY_CLEAR_PAYLOAD, LEGACY_KEYRING_ACCOUNT, SECURE_STORE_SERVICE, } from './auth-constants.js';
+import { getConfig, updateConfig } from './config.js';
+import { DEFAULT_BASE_URL, makeOutlineAccount } from './outline-account.js';
+import { createOutlineUserRecordStore } from './user-records.js';
+/**
+ * Pinned to this migration's target schema. Decoupled from any future
+ * `config_version` bump so this helper doesn't re-run for users already
+ * on v2 or beyond.
+ */
+const V2_SCHEMA_VERSION = 2;
+/**
+ * Cap migration's `auth.info` lookup so a stalled connection can't hang
+ * the CLI indefinitely on first command. cli-core treats the resulting
+ * timeout as `identify-failed`, falling back to the legacy snapshot.
+ */
+const IDENTIFY_TIMEOUT_MS = 10_000;
+/**
+ * Direct `auth.info` call used only by the migration path. We bypass
+ * `apiRequest` (and its spinner + `getApiToken`/`getBaseUrl` cascade) so
+ * this module stays out of the runtime auth/token-store import graph and
+ * so the silent migration doesn't render a spinner during postinstall-style
+ * invocations.
+ */
+async function identifyOutlineAccount(token) {
+    const config = await getConfig();
+    const baseUrl = (config.base_url ?? DEFAULT_BASE_URL).replace(/\/$/, '');
+    const res = await fetchWithRetry({
+        url: `${baseUrl}/api/auth.info`,
+        options: {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${token}`,
+            },
+            body: JSON.stringify({}),
+            timeout: IDENTIFY_TIMEOUT_MS,
+        },
+    });
+    if (!res.ok) {
+        throw new Error(`auth.info failed: ${res.status} ${res.statusText}`);
+    }
+    const json = await res.json();
+    return makeOutlineAccount({
+        id: json.data.user.id,
+        label: json.data.user.name,
+        baseUrl,
+        oauthClientId: config.oauth_client_id ?? '',
+        teamName: json.data.team.name,
+    });
+}
+/**
+ * One-time migration of v1 plaintext auth state into the v2 `users[]`
+ * shape. Called lazily by `createOutlineTokenStore` on first store access.
+ * Idempotent via the `config_version` marker — once set to `>= 2`, this
+ * helper short-circuits with `already-migrated`.
+ */
+export async function runMigrateLegacyAuth(options = { silent: true }) {
+    return migrateLegacyAuth({
+        serviceName: SECURE_STORE_SERVICE,
+        legacyAccount: LEGACY_KEYRING_ACCOUNT,
+        userRecords: createOutlineUserRecordStore(),
+        hasMigrated: async () => {
+            const config = await getConfig();
+            // Two signals of "already on v2": the explicit marker, or
+            // the structural presence of `users[]` (a fresh install that
+            // logged in directly via cli-core writes records without ever
+            // setting `config_version`, so the marker alone would
+            // miscount that case as "needs migration").
+            if ((config.config_version ?? 0) >= V2_SCHEMA_VERSION)
+                return true;
+            if ((config.users ?? []).length > 0)
+                return true;
+            return false;
+        },
+        markMigrated: async () => {
+            await updateConfig({ config_version: V2_SCHEMA_VERSION });
+        },
+        loadLegacyPlaintextToken: async () => {
+            const config = await getConfig();
+            return config.api_token?.trim() || null;
+        },
+        identifyAccount: identifyOutlineAccount,
+        cleanupLegacyConfig: async () => {
+            await updateConfig(LEGACY_CLEAR_PAYLOAD);
+        },
+        silent: options.silent,
+        logPrefix: 'outline-cli',
+    });
+}
+//# sourceMappingURL=migrate-auth.js.map

package/dist/lib/migrate-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-auth.js","sourceRoot":"","sources":["../../src/lib/migrate-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACjE,OAAO,EACH,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,GACvB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAuB,MAAM,sBAAsB,CAAA;AAChG,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAA;AAEhE;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAA;AAE3B;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,MAAM,CAAA;AASlC;;;;;;GAMG;AACH,KAAK,UAAU,sBAAsB,CAAC,KAAa;IAC/C,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACxE,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC;QAC7B,GAAG,EAAE,GAAG,OAAO,gBAAgB;QAC/B,OAAO,EAAE;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACL,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,EAAE;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,mBAAmB;SAC/B;KACJ,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;IACxE,CAAC;IACD,MAAM,IAAI,GAAqB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IAC/C,OAAO,kBAAkB,CAAC;QACtB,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACrB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QAC1B,OAAO;QACP,aAAa,EAAE,MAAM,CAAC,eAAe,IAAI,EAAE;QAC3C,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;KAChC,CAAC,CAAA;AACN,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACtC,UAA+B,EAAE,MAAM,EAAE,IAAI,EAAE;IAE/C,OAAO,iBAAiB,CAAiB;QACrC,WAAW,EAAE,oBAAoB;QACjC,aAAa,EAAE,sBAAsB;QACrC,WAAW,EAAE,4BAA4B,EAAE;QAC3C,WAAW,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;YAChC,0DAA0D;YAC1D,6DAA6D;YAC7D,8DAA8D;YAC9D,sDAAsD;YACtD,4CAA4C;YAC5C,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC,IAAI,iBAAiB;gBAAE,OAAO,IAAI,CAAA;YAClE,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;YAChD,OAAO,KAAK,CAAA;QAChB,CAAC;QACD,YAAY,EAAE,KAAK,IAAI,EAAE;YACrB,MAAM,YAAY,CAAC,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC,CAAA;QAC7D,CAAC;QACD,wBAAwB,EAAE,KAAK,IAAI,EAAE;YACjC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;YAChC,OAAO,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,IAAI,CAAA;QAC3C,CAAC;QACD,eAAe,EAAE,sBAAsB;QACvC,mBAAmB,EAAE,KAAK,IAAI,EAAE;YAC5B,MAAM,YAAY,CAAC,oBAAoB,CAAC,CAAA;QAC5C,CAAC;QACD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,aAAa;KAC3B,CAAC,CAAA;AACN,CAAC"}

package/dist/lib/outline-account.d.ts

@@ -0,0 +1,26 @@
+import type { AuthAccount } from '@doist/cli-core/auth';
+/**
+ * Narrow account shape persisted by the keyring-backed token store.
+ *
+ * `id` is the Outline user UUID; `label` is the user's display name.
+ * `baseUrl` and `oauthClientId` ride along on the account because Outline
+ * is self-hostable — every persisted token is tied to the instance it was
+ * issued for, not to a global default. `teamName` is rendered by
+ * `ol auth status`; it's the only field we cache for display.
+ */
+export type OutlineAccount = AuthAccount & {
+    id: string;
+    label: string;
+    baseUrl: string;
+    oauthClientId: string;
+    teamName?: string;
+};
+export declare const DEFAULT_BASE_URL = "https://app.getoutline.com";
+/** Canonical `OutlineAccount` factory. Applies the `baseUrl` default. */
+export declare function makeOutlineAccount(input: {
+    id: string;
+    label: string;
+    baseUrl?: string;
+    oauthClientId?: string;
+    teamName?: string;
+}): OutlineAccount;

package/dist/lib/outline-account.js

@@ -0,0 +1,12 @@
+export const DEFAULT_BASE_URL = 'https://app.getoutline.com';
+/** Canonical `OutlineAccount` factory. Applies the `baseUrl` default. */
+export function makeOutlineAccount(input) {
+    return {
+        id: input.id,
+        label: input.label,
+        baseUrl: input.baseUrl ?? DEFAULT_BASE_URL,
+        oauthClientId: input.oauthClientId ?? '',
+        teamName: input.teamName,
+    };
+}
+//# sourceMappingURL=outline-account.js.map

package/dist/lib/outline-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outline-account.js","sourceRoot":"","sources":["../../src/lib/outline-account.ts"],"names":[],"mappings":"AAmBA,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAA;AAE5D,yEAAyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,KAMlC;IACG,OAAO;QACH,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,gBAAgB;QAC1C,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE;QACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ;KAC3B,CAAA;AACL,CAAC"}

package/dist/lib/skills/content.d.ts

@@ -1,3 +1,3 @@
 export declare const SKILL_NAME = "outline-cli";
 export declare const SKILL_DESCRIPTION = "Search and manage Outline wiki documents and collections via the ol CLI";
-export declare const SKILL_CONTENT = "# Outline CLI (ol)\n\nUse this skill when the user wants to interact with their Outline wiki/knowledge base.\n\n## Quick Reference\n\n- `ol search \"query\"` - Search documents\n- `ol doc list` - List documents\n- `ol doc get <id>` - Read a document\n- `ol doc open <id>` - Open document in browser\n- `ol doc create --title \"Title\" --collection <id>` - Create document\n- `ol col list` - List collections\n\n## Output Formats\n\nAll list commands support:\n- `--json` - JSON output (essential fields)\n- `--ndjson` - Newline-delimited JSON (streaming)\n- `--full` - Include all fields in JSON\n\n## Document References\n\nDocuments can be referenced by:\n- URL ID (the slug suffix after the last hyphen)\n- Full Outline URL (auto-extracted)\n- Document ID\n\n## Commands\n\n### Search\n```bash\nol search \"query\"\nol search \"query\" --limit 10\nol search \"query\" --collection <id>\nol search \"query\" --status published\nol search \"query\" --json\n```\n\n### Documents\n```bash\nol doc list --collection <id> --limit 25\nol doc list --sort title --direction ASC\nol doc get <id>                           # Rendered markdown\nol doc get <id> --raw                     # Raw markdown\nol doc get <id> --json\nol doc open <id>                          # Open in browser\nol doc create --title \"Title\" --collection <id> --text \"# Content\"\nol doc create --title \"Title\" --parent <ref> --text \"# Content\"  # Nest under parent (collection inferred)\nol doc create --title \"Title\" --collection <id> --file ./doc.md\nol doc update <id> --title \"New Title\"\nol doc update <id> --file ./updated.md\nol doc move <id> --collection <target-id>           # Move to collection root\nol doc move <id> --parent <ref>                    # Nest under parent (collection inferred)\nol doc archive <id>\nol doc unarchive <id>\nol doc delete <id> --confirm\n```\n\n### Collections\n```bash\nol col list\nol col get <id>\nol col create --name \"Name\" --description \"Desc\" --color \"#hex\"\nol col create --name \"Private\" --private\nol col update <id> --name \"New Name\"\nol col delete <id> --confirm\n```\n\n### Authentication\n```bash\nol auth login                          # OAuth login (opens browser); prompts for base URL + client ID if needed\nol auth login --base-url <url>         # Specify Outline base URL for this login (saved for future use)\nol auth login --client-id <id>         # Specify OAuth client ID for this login (saved for future use)\nol auth login --callback-port <port>   # Override local OAuth callback port\nol auth login --read-only              # Request read-only scopes (where supported by the Outline instance)\nol auth login --json | --ndjson        # Machine-readable success envelope\nol auth status                         # Show current auth state\nol auth logout                         # Clear saved credentials\n```\n\n### Update & Changelog\n```bash\nol update                        # Update CLI to latest version\nol update --check                # Check for updates without installing, show channel\nol update --check --json         # Check for updates as a JSON envelope\nol update --check --ndjson       # Check for updates as NDJSON output\nol update --channel              # Show current update channel\nol update switch --stable        # Switch to stable release channel\nol update switch --pre-release   # Switch to pre-release (next) channel\nol changelog                     # Show recent changelog entries\nol changelog -n 3                # Show last 3 versions\n```\n\n## Examples\n\n### Find and read a document\n```bash\nol search \"onboarding\" --json | jq '.[0].document.urlId'\nol doc get <urlId>\n```\n\n### Create a document from a file\n```bash\nol doc create --title \"Meeting Notes\" --collection <id> --file ./notes.md --publish\n```\n\n### List all collections and their documents\n```bash\nol col list --json\nol doc list --collection <id> --sort title --direction ASC\n```\n\n### Bulk export with ndjson\n```bash\nol doc list --ndjson --full | jq -r '.title'\n```\n";
+export declare const SKILL_CONTENT = "# Outline CLI (ol)\n\nUse this skill when the user wants to interact with their Outline wiki/knowledge base.\n\n## Quick Reference\n\n- `ol search \"query\"` - Search documents\n- `ol doc list` - List documents\n- `ol doc get <id>` - Read a document\n- `ol doc open <id>` - Open document in browser\n- `ol doc create --title \"Title\" --collection <id>` - Create document\n- `ol col list` - List collections\n\n## Output Formats\n\nAll list commands support:\n- `--json` - JSON output (essential fields)\n- `--ndjson` - Newline-delimited JSON (streaming)\n- `--full` - Include all fields in JSON\n\n## Document References\n\nDocuments can be referenced by:\n- URL ID (the slug suffix after the last hyphen)\n- Full Outline URL (auto-extracted)\n- Document ID\n\n## Commands\n\n### Search\n```bash\nol search \"query\"\nol search \"query\" --limit 10\nol search \"query\" --collection <id>\nol search \"query\" --status published\nol search \"query\" --json\n```\n\n### Documents\n```bash\nol doc list --collection <id> --limit 25\nol doc list --sort title --direction ASC\nol doc get <id>                           # Rendered markdown\nol doc get <id> --raw                     # Raw markdown\nol doc get <id> --json\nol doc open <id>                          # Open in browser\nol doc create --title \"Title\" --collection <id> --text \"# Content\"\nol doc create --title \"Title\" --parent <ref> --text \"# Content\"  # Nest under parent (collection inferred)\nol doc create --title \"Title\" --collection <id> --file ./doc.md\nol doc update <id> --title \"New Title\"\nol doc update <id> --file ./updated.md\nol doc move <id> --collection <target-id>           # Move to collection root\nol doc move <id> --parent <ref>                    # Nest under parent (collection inferred)\nol doc archive <id>\nol doc unarchive <id>\nol doc delete <id> --confirm\n```\n\n### Collections\n```bash\nol col list\nol col get <id>\nol col create --name \"Name\" --description \"Desc\" --color \"#hex\"\nol col create --name \"Private\" --private\nol col update <id> --name \"New Name\"\nol col delete <id> --confirm\n```\n\n### Authentication\n```bash\nol auth login                          # OAuth login (opens browser); prompts for base URL + client ID if needed\nol auth login --base-url <url>         # Specify Outline base URL for this login (saved for future use)\nol auth login --client-id <id>         # Specify OAuth client ID for this login (saved for future use)\nol auth login --callback-port <port>   # Override local OAuth callback port\nol auth login --read-only              # Request read-only scopes (where supported by the Outline instance)\nol auth login --json | --ndjson        # Machine-readable success envelope\nol auth status                         # Show current auth state\nol auth status --json | --ndjson       # Machine-readable status envelope ({id, team, baseUrl, source})\nol auth logout                         # Clear saved credentials\nol auth logout --json | --ndjson       # Machine-readable logout envelope ({ok: true}; --ndjson is silent)\n```\n\n### Update & Changelog\n```bash\nol update                        # Update CLI to latest version\nol update --check                # Check for updates without installing, show channel\nol update --check --json         # Check for updates as a JSON envelope\nol update --check --ndjson       # Check for updates as NDJSON output\nol update --channel              # Show current update channel\nol update switch --stable        # Switch to stable release channel\nol update switch --pre-release   # Switch to pre-release (next) channel\nol changelog                     # Show recent changelog entries\nol changelog -n 3                # Show last 3 versions\n```\n\n## Examples\n\n### Find and read a document\n```bash\nol search \"onboarding\" --json | jq '.[0].document.urlId'\nol doc get <urlId>\n```\n\n### Create a document from a file\n```bash\nol doc create --title \"Meeting Notes\" --collection <id> --file ./notes.md --publish\n```\n\n### List all collections and their documents\n```bash\nol col list --json\nol doc list --collection <id> --sort title --direction ASC\n```\n\n### Bulk export with ndjson\n```bash\nol doc list --ndjson --full | jq -r '.title'\n```\n";

package/dist/lib/skills/content.js

@@ -77,7 +77,9 @@ ol auth login --callback-port <port>   # Override local OAuth callback port
 ol auth login --read-only              # Request read-only scopes (where supported by the Outline instance)
 ol auth login --json | --ndjson        # Machine-readable success envelope
 ol auth status                         # Show current auth state
+ol auth status --json | --ndjson       # Machine-readable status envelope ({id, team, baseUrl, source})
 ol auth logout                         # Clear saved credentials
+ol auth logout --json | --ndjson       # Machine-readable logout envelope ({ok: true}; --ndjson is silent)
 \`\`\`
 
 ### Update & Changelog

package/dist/lib/skills/content.js.map

@@ -1 +1 @@
-{"version":3,"file":"content.js","sourceRoot":"","sources":["../../../src/lib/skills/content.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CAAA;AACvC,MAAM,CAAC,MAAM,iBAAiB,GAC1B,yEAAyE,CAAA;AAE7E,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoH5B,CAAA"}
+{"version":3,"file":"content.js","sourceRoot":"","sources":["../../../src/lib/skills/content.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CAAA;AACvC,MAAM,CAAC,MAAM,iBAAiB,GAC1B,yEAAyE,CAAA;AAE7E,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsH5B,CAAA"}

package/dist/lib/user-records.d.ts

@@ -0,0 +1,14 @@
+import type { UserRecord, UserRecordStore } from '@doist/cli-core/auth';
+import { type Config } from './config.js';
+import { type OutlineAccount } from './outline-account.js';
+/**
+ * `UserRecordStore` adapter over `config.users[]`. `StoredUser.token` is
+ * surfaced as `fallbackToken` — cli-core's name for the plaintext copy
+ * persisted only when the keyring is unreachable.
+ */
+export declare function createOutlineUserRecordStore(): UserRecordStore<OutlineAccount>;
+/**
+ * Resolve the default-or-first `UserRecord` from an already-loaded config.
+ * Returns `null` when no users are stored.
+ */
+export declare function getDefaultUserRecord(config: Partial<Config>): UserRecord<OutlineAccount> | null;

package/dist/lib/user-records.js

@@ -0,0 +1,89 @@
+import { getConfig, updateConfig } from './config.js';
+import { makeOutlineAccount } from './outline-account.js';
+/**
+ * `UserRecordStore` adapter over `config.users[]`. `StoredUser.token` is
+ * surfaced as `fallbackToken` — cli-core's name for the plaintext copy
+ * persisted only when the keyring is unreachable.
+ */
+export function createOutlineUserRecordStore() {
+    return {
+        async list() {
+            const config = await getConfig();
+            return (config.users ?? []).map(toRecord);
+        },
+        async upsert(record) {
+            const config = await getConfig();
+            const existing = config.users ?? [];
+            const next = fromRecord(record);
+            const index = existing.findIndex((u) => u.id === record.account.id);
+            const users = index >= 0
+                ? [...existing.slice(0, index), next, ...existing.slice(index + 1)]
+                : [...existing, next];
+            await updateConfig({ users });
+        },
+        async remove(id) {
+            const config = await getConfig();
+            const existing = config.users ?? [];
+            const index = existing.findIndex((u) => u.id === id);
+            if (index < 0)
+                return;
+            const users = [...existing.slice(0, index), ...existing.slice(index + 1)];
+            const updates = { users };
+            if (config.default_user_id === id)
+                updates.default_user_id = undefined;
+            await updateConfig(updates);
+        },
+        async getDefaultId() {
+            const config = await getConfig();
+            return config.default_user_id ?? null;
+        },
+        async setDefaultId(id) {
+            await updateConfig({ default_user_id: id ?? undefined });
+        },
+    };
+}
+/**
+ * Resolve the default-or-first `UserRecord` from an already-loaded config.
+ * Returns `null` when no users are stored.
+ */
+export function getDefaultUserRecord(config) {
+    const users = config.users ?? [];
+    if (users.length === 0)
+        return null;
+    const defaultId = config.default_user_id;
+    const user = (defaultId && users.find((u) => u.id === defaultId)) || users[0];
+    return toRecord(user);
+}
+function toRecord(user) {
+    const account = makeOutlineAccount({
+        id: user.id,
+        label: user.name,
+        baseUrl: user.base_url,
+        oauthClientId: user.oauth_client_id,
+        teamName: user.team_name,
+    });
+    const trimmed = user.token?.trim();
+    const record = { account };
+    if (trimmed)
+        record.fallbackToken = trimmed;
+    return record;
+}
+function fromRecord(record) {
+    // Replace, don't merge: an absent `fallbackToken` strips the plaintext
+    // slot so it can't shadow a fresh keyring-backed write. cli-core contract.
+    const trimmed = record.fallbackToken?.trim();
+    const next = {
+        id: record.account.id,
+        name: record.account.label,
+    };
+    if (record.account.baseUrl)
+        next.base_url = record.account.baseUrl;
+    if (record.account.oauthClientId)
+        next.oauth_client_id = record.account.oauthClientId;
+    if (record.account.teamName)
+        next.team_name = record.account.teamName;
+    if (trimmed && trimmed.length > 0)
+        next.token = trimmed;
+    return next;
+}
+//# sourceMappingURL=user-records.js.map

package/dist/lib/user-records.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-records.js","sourceRoot":"","sources":["../../src/lib/user-records.ts"],"names":[],"mappings":"AACA,OAAO,EAAe,SAAS,EAAmB,YAAY,EAAE,MAAM,aAAa,CAAA;AACnF,OAAO,EAAE,kBAAkB,EAAuB,MAAM,sBAAsB,CAAA;AAE9E;;;;GAIG;AACH,MAAM,UAAU,4BAA4B;IACxC,OAAO;QACH,KAAK,CAAC,IAAI;YACN,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;YAChC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC7C,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM;YACf,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;YAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAA;YACnC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;YAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YACnE,MAAM,KAAK,GACP,KAAK,IAAI,CAAC;gBACN,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBACnE,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,CAAC,CAAA;YAC7B,MAAM,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QACjC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,EAAE;YACX,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;YAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAA;YACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;YACpD,IAAI,KAAK,GAAG,CAAC;gBAAE,OAAM;YACrB,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;YACzE,MAAM,OAAO,GAAyD,EAAE,KAAK,EAAE,CAAA;YAC/E,IAAI,MAAM,CAAC,eAAe,KAAK,EAAE;gBAAE,OAAO,CAAC,eAAe,GAAG,SAAS,CAAA;YACtE,MAAM,YAAY,CAAC,OAAO,CAAC,CAAA;QAC/B,CAAC;QACD,KAAK,CAAC,YAAY;YACd,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;YAChC,OAAO,MAAM,CAAC,eAAe,IAAI,IAAI,CAAA;QACzC,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,EAAE;YACjB,MAAM,YAAY,CAAC,EAAE,eAAe,EAAE,EAAE,IAAI,SAAS,EAAE,CAAC,CAAA;QAC5D,CAAC;KACJ,CAAA;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAuB;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAA;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAA;IACxC,MAAM,IAAI,GAAG,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAA;IAC7E,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAgB;IAC9B,MAAM,OAAO,GAAG,kBAAkB,CAAC;QAC/B,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,IAAI;QAChB,OAAO,EAAE,IAAI,CAAC,QAAQ;QACtB,aAAa,EAAE,IAAI,CAAC,eAAe;QACnC,QAAQ,EAAE,IAAI,CAAC,SAAS;KAC3B,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAA;IAClC,MAAM,MAAM,GAA+B,EAAE,OAAO,EAAE,CAAA;IACtD,IAAI,OAAO;QAAE,MAAM,CAAC,aAAa,GAAG,OAAO,CAAA;IAC3C,OAAO,MAAM,CAAA;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,MAAkC;IAClD,uEAAuE;IACvE,2EAA2E;IAC3E,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,CAAA;IAC5C,MAAM,IAAI,GAAe;QACrB,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;QACrB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;KAC7B,CAAA;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO;QAAE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAA;IAClE,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa;QAAE,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;IACrF,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAA;IACrE,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAA;IACvD,OAAO,IAAI,CAAA;AACf,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@doist/outline-cli",
-	"version": "1.6.0",
+	"version": "1.7.0",
 	"description": "CLI for the Outline wiki/knowledge base API",
 	"type": "module",
 	"bin": {
@@ -48,7 +48,7 @@
 		"node": ">=20.18.1"
 	},
 	"dependencies": {
-		"@doist/cli-core": "0.12.0",
+		"@doist/cli-core": "0.16.1",
 		"chalk": "5.6.2",
 		"commander": "14.0.2",
 		"marked": "18.0.3",