@doist/outline-cli 1.6.0 → 1.8.0

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## [1.8.0](https://github.com/Doist/outline-cli/compare/v1.7.0...v1.8.0) (2026-05-21)
+
+### Features
+
+* **auth:** silent OAuth token refresh ([#75](https://github.com/Doist/outline-cli/issues/75)) ([83996d5](https://github.com/Doist/outline-cli/commit/83996d56810e28e608d91a981fd3b313dcdeb4d3))
+
+## [1.7.0](https://github.com/Doist/outline-cli/compare/v1.6.0...v1.7.0) (2026-05-17)
+
+### Features
+
+* **auth:** store API tokens in the OS keyring via @doist/cli-core ([#73](https://github.com/Doist/outline-cli/issues/73)) ([b353aea](https://github.com/Doist/outline-cli/commit/b353aeae3cdcc63308ec8de899f08c1dda23f22c))
+
 ## [1.6.0](https://github.com/Doist/outline-cli/compare/v1.5.3...v1.6.0) (2026-05-15)
 
 ### Features

package/dist/commands/auth.d.ts

@@ -1,2 +1,14 @@
+import { type TokenStorageResult } from '@doist/cli-core/auth';
 import type { Command } from 'commander';
+/**
+ * Surface a `TokenStorageResult` from a save/clear: the human-readable
+ * confirmation goes to stdout, any keyring-fallback warning goes to stderr.
+ * Pass `isMachineOutput: true` to suppress the stdout confirmation in
+ * `--json` / `--ndjson` mode while still routing the warning to stderr.
+ *
+ * Exported for direct unit testing — the alternative (driving this via
+ * mocked cli-core login/logout hooks) would require stubbing the entire
+ * store contract just to assert two console calls.
+ */
+export declare function logTokenStorageResult(result: TokenStorageResult, secureStoreMessage: string, isMachineOutput?: boolean): void;
 export declare function registerAuthCommand(program: Command): void;

package/dist/commands/auth.js

@@ -1,10 +1,10 @@
-import { attachLoginCommand } from '@doist/cli-core/auth';
+import { attachLoginCommand, attachLogoutCommand, attachStatusCommand, } from '@doist/cli-core/auth';
 import chalk from 'chalk';
 import { apiRequest } from '../lib/api.js';
 import { renderError, renderSuccess } from '../lib/auth-pages.js';
-import { createOutlineAuthProvider, createOutlineTokenStore } from '../lib/auth-provider.js';
-import { clearConfig, getBaseUrl, getTokenSource } from '../lib/auth.js';
-import { formatError } from '../lib/output.js';
+import { createOutlineAuthProvider, createOutlineTokenStore, getActiveTokenSource, } from '../lib/auth-provider.js';
+import { refreshedTokenForStatus } from '../lib/auth.js';
+import { CliError } from '../lib/errors.js';
 const DEFAULT_OAUTH_CALLBACK_PORT = 54969;
 function resolvePreferredCallbackPort() {
     const raw = process.env.OUTLINE_OAUTH_CALLBACK_PORT?.trim();
@@ -16,6 +16,24 @@ function resolvePreferredCallbackPort() {
     }
     return parsed;
 }
+/**
+ * Surface a `TokenStorageResult` from a save/clear: the human-readable
+ * confirmation goes to stdout, any keyring-fallback warning goes to stderr.
+ * Pass `isMachineOutput: true` to suppress the stdout confirmation in
+ * `--json` / `--ndjson` mode while still routing the warning to stderr.
+ *
+ * Exported for direct unit testing — the alternative (driving this via
+ * mocked cli-core login/logout hooks) would require stubbing the entire
+ * store contract just to assert two console calls.
+ */
+export function logTokenStorageResult(result, secureStoreMessage, isMachineOutput = false) {
+    if (!isMachineOutput && result.storage === 'secure-store') {
+        console.log(chalk.dim(secureStoreMessage));
+    }
+    if (result.warning) {
+        console.error(chalk.yellow('Warning:'), result.warning);
+    }
+}
 export function registerAuthCommand(program) {
     const auth = program.command('auth').description('Manage authentication');
     const provider = createOutlineAuthProvider();
@@ -28,43 +46,91 @@ export function registerAuthCommand(program) {
         renderSuccess,
         renderError,
         onSuccess({ view, account }) {
-            if (view.json || view.ndjson)
-                return;
-            console.log(chalk.green(`Authenticated to ${account.teamName} as ${account.label}`));
+            const isMachineOutput = view.json || view.ndjson;
+            if (!isMachineOutput) {
+                console.log(chalk.green(`Authenticated to ${account.teamName} as ${account.label}`));
+            }
+            const result = store.getLastStorageResult();
+            if (result) {
+                logTokenStorageResult(result, 'Token stored securely in the system credential manager', isMachineOutput);
+            }
         },
     })
         .description('Authenticate with an Outline instance via OAuth')
         .option('--base-url <url>', 'Outline base URL to use for this login (saved for future logins)')
         .option('--client-id <clientId>', 'OAuth client ID to use for this login (saved for future logins)');
-    auth.command('status')
-        .description('Show current authentication state')
-        .action(async () => {
-        const source = await getTokenSource();
-        if (!source) {
-            console.log(chalk.yellow('Not authenticated. Run: ol auth login'));
-            return;
-        }
-        console.log(chalk.dim(`Token source: ${source}`));
-        console.log(chalk.dim(`Base URL: ${await getBaseUrl()}`));
-        try {
-            const { data } = await apiRequest('auth.info');
-            console.log(`Team: ${chalk.bold(data.team.name)}`);
-            console.log(`User: ${data.user.name} (${data.user.email})`);
-        }
-        catch (err) {
-            console.error(formatError('AUTH_VERIFICATION_FAILED', `Could not fetch auth info: ${err.message}`, [
-                'Check that your API token is valid',
-                'Verify the base URL is correct',
-                "Run 'ol auth login' to re-authenticate",
-            ]));
-            process.exit(1);
-        }
+    // `attachStatusCommand` guarantees `fetchLive` runs before `renderText` /
+    // `renderJson` within a single invocation, so the stash is always
+    // populated by the time the render hooks read it.
+    let statusData = null;
+    attachStatusCommand(auth, {
+        store,
+        description: 'Show current authentication state',
+        async fetchLive({ account, token }) {
+            try {
+                // Refresh the *selected* account before the check (scoped via
+                // its id + base URL/client id), then probe with the rotated
+                // token. Outline access tokens last ~an hour; without this
+                // `auth status` can't self-heal even though normal commands
+                // do. Passing the resolved token keeps the check tied to the
+                // requested account rather than the default.
+                const liveToken = await refreshedTokenForStatus(account, token);
+                const [{ data: info }, source] = await Promise.all([
+                    apiRequest('auth.info', {}, { token: liveToken, baseUrl: account.baseUrl }),
+                    getActiveTokenSource(),
+                ]);
+                statusData = { email: info.user.email, source };
+                return {
+                    ...account,
+                    id: info.user.id,
+                    label: info.user.name,
+                    teamName: info.team.name,
+                };
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : '';
+                if (/\b401\b/.test(message) || /Authentication required/i.test(message)) {
+                    throw new CliError('NO_TOKEN', 'Not authenticated (token expired or invalid)', [
+                        'Run `ol auth login` to re-authenticate',
+                    ]);
+                }
+                throw err;
+            }
+        },
+        renderText({ account }) {
+            if (!statusData)
+                throw new Error('status renderText called before fetchLive');
+            return [
+                `${chalk.green('✓')} Authenticated`,
+                `  Team: ${chalk.bold(account.teamName ?? '')}`,
+                `  User: ${account.label} (${statusData.email})`,
+                `  Base URL: ${account.baseUrl}`,
+                `  Token source: ${statusData.source}`,
+            ];
+        },
+        renderJson({ account }) {
+            if (!statusData)
+                throw new Error('status renderJson called before fetchLive');
+            return {
+                id: account.id,
+                team: account.teamName,
+                baseUrl: account.baseUrl,
+                source: statusData.source,
+            };
+        },
+        onNotAuthenticated() {
+            throw new CliError('NOT_AUTHENTICATED', 'Not authenticated. Run: ol auth login');
+        },
     });
-    auth.command('logout')
-        .description('Clear saved authentication')
-        .action(async () => {
-        await clearConfig();
-        console.log('Logged out.');
+    attachLogoutCommand(auth, {
+        store,
+        description: 'Clear saved authentication',
+        onCleared({ view }) {
+            const result = store.getLastClearResult();
+            if (!result)
+                return;
+            logTokenStorageResult(result, 'Stored token removed from the system credential manager', view.json || view.ndjson);
+        },
     });
 }
 //# sourceMappingURL=auth.js.map

package/dist/commands/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AAC5F,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE9C,MAAM,2BAA2B,GAAG,KAAK,CAAA;AAOzC,SAAS,4BAA4B;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAA;IAC3D,IAAI,CAAC,GAAG;QAAE,OAAO,2BAA2B,CAAA;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,MAAM,EAAE,CAAC;QAC7D,OAAO,2BAA2B,CAAA;IACtC,CAAC;IACD,OAAO,MAAM,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAA;IAEzE,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAA;IAC5C,MAAM,KAAK,GAAG,uBAAuB,EAAE,CAAA;IAEvC,kBAAkB,CAAC,IAAI,EAAE;QACrB,QAAQ;QACR,KAAK;QACL,aAAa,EAAE,4BAA4B,EAAE;QAC7C,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE;QACvB,aAAa;QACb,WAAW;QACX,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;YACvB,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM;gBAAE,OAAM;YACpC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,OAAO,CAAC,QAAQ,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;QACxF,CAAC;KACJ,CAAC;SACG,WAAW,CAAC,iDAAiD,CAAC;SAC9D,MAAM,CACH,kBAAkB,EAClB,kEAAkE,CACrE;SACA,MAAM,CACH,wBAAwB,EACxB,iEAAiE,CACpE,CAAA;IAEL,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,mCAAmC,CAAC;SAChD,MAAM,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAA;QACrC,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,uCAAuC,CAAC,CAAC,CAAA;YAClE,OAAM;QACV,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,MAAM,EAAE,CAAC,CAAC,CAAA;QACjD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,MAAM,UAAU,EAAE,EAAE,CAAC,CAAC,CAAA;QAEzD,IAAI,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAmB,WAAW,CAAC,CAAA;YAChE,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAClD,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAA;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CACT,WAAW,CACP,0BAA0B,EAC1B,8BAA+B,GAAa,CAAC,OAAO,EAAE,EACtD;gBACI,oCAAoC;gBACpC,gCAAgC;gBAChC,wCAAwC;aAC3C,CACJ,CACJ,CAAA;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,CAAC;IACL,CAAC,CAAC,CAAA;IAEN,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,4BAA4B,CAAC;SACzC,MAAM,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,WAAW,EAAE,CAAA;QACnB,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;AACV,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,GAEtB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,EAEH,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,GAGvB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAE3C,MAAM,2BAA2B,GAAG,KAAK,CAAA;AAOzC,SAAS,4BAA4B;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAA;IAC3D,IAAI,CAAC,GAAG;QAAE,OAAO,2BAA2B,CAAA;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,MAAM,EAAE,CAAC;QAC7D,OAAO,2BAA2B,CAAA;IACtC,CAAC;IACD,OAAO,MAAM,CAAA;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACjC,MAA0B,EAC1B,kBAA0B,EAC1B,eAAe,GAAG,KAAK;IAEvB,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAA;IAC9C,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;IAC3D,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAA;IAEzE,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAA;IAC5C,MAAM,KAAK,GAAsB,uBAAuB,EAAE,CAAA;IAE1D,kBAAkB,CAAC,IAAI,EAAE;QACrB,QAAQ;QACR,KAAK;QACL,aAAa,EAAE,4BAA4B,EAAE;QAC7C,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE;QACvB,aAAa;QACb,WAAW;QACX,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;YACvB,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAA;YAChD,IAAI,CAAC,eAAe,EAAE,CAAC;gBACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,OAAO,CAAC,QAAQ,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;YACxF,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,oBAAoB,EAAE,CAAA;YAC3C,IAAI,MAAM,EAAE,CAAC;gBACT,qBAAqB,CACjB,MAAM,EACN,wDAAwD,EACxD,eAAe,CAClB,CAAA;YACL,CAAC;QACL,CAAC;KACJ,CAAC;SACG,WAAW,CAAC,iDAAiD,CAAC;SAC9D,MAAM,CACH,kBAAkB,EAClB,kEAAkE,CACrE;SACA,MAAM,CACH,wBAAwB,EACxB,iEAAiE,CACpE,CAAA;IAEL,0EAA0E;IAC1E,kEAAkE;IAClE,kDAAkD;IAClD,IAAI,UAAU,GAAsB,IAAI,CAAA;IAExC,mBAAmB,CAAiB,IAAI,EAAE;QACtC,KAAK;QACL,WAAW,EAAE,mCAAmC;QAChD,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;YAC9B,IAAI,CAAC;gBACD,8DAA8D;gBAC9D,4DAA4D;gBAC5D,2DAA2D;gBAC3D,4DAA4D;gBAC5D,6DAA6D;gBAC7D,6CAA6C;gBAC7C,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;gBAC/D,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAC/C,UAAU,CACN,WAAW,EACX,EAAE,EACF,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CACjD;oBACD,oBAAoB,EAAE;iBACzB,CAAC,CAAA;gBACF,UAAU,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAA;gBAC/C,OAAO;oBACH,GAAG,OAAO;oBACV,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;oBAChB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;oBACrB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;iBAC3B,CAAA;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;gBACvD,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtE,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,8CAA8C,EAAE;wBAC3E,wCAAwC;qBAC3C,CAAC,CAAA;gBACN,CAAC;gBACD,MAAM,GAAG,CAAA;YACb,CAAC;QACL,CAAC;QACD,UAAU,CAAC,EAAE,OAAO,EAAE;YAClB,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;YAC7E,OAAO;gBACH,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB;gBACnC,WAAW,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE;gBAC/C,WAAW,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,KAAK,GAAG;gBAChD,eAAe,OAAO,CAAC,OAAO,EAAE;gBAChC,mBAAmB,UAAU,CAAC,MAAM,EAAE;aACzC,CAAA;QACL,CAAC;QACD,UAAU,CAAC,EAAE,OAAO,EAAE;YAClB,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;YAC7E,OAAO;gBACH,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,IAAI,EAAE,OAAO,CAAC,QAAQ;gBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM,EAAE,UAAU,CAAC,MAAM;aAC5B,CAAA;QACL,CAAC;QACD,kBAAkB;YACd,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,uCAAuC,CAAC,CAAA;QACpF,CAAC;KACJ,CAAC,CAAA;IAEF,mBAAmB,CAAiB,IAAI,EAAE;QACtC,KAAK;QACL,WAAW,EAAE,4BAA4B;QACzC,SAAS,CAAC,EAAE,IAAI,EAAE;YACd,MAAM,MAAM,GAAG,KAAK,CAAC,kBAAkB,EAAE,CAAA;YACzC,IAAI,CAAC,MAAM;gBAAE,OAAM;YACnB,qBAAqB,CACjB,MAAM,EACN,yDAAyD,EACzD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAC3B,CAAA;QACL,CAAC;KACJ,CAAC,CAAA;AACN,CAAC"}

package/dist/lib/api.js

@@ -1,5 +1,6 @@
 import { fetchWithRetry } from '../transport/fetch-with-retry.js';
-import { getApiToken, getBaseUrl } from './auth.js';
+import { TOKEN_ENV_VAR } from './auth-constants.js';
+import { getApiToken, getBaseUrl, proactiveRefresh, reactiveRefresh } from './auth.js';
 import { withSpinner } from './spinner.js';
 /**
  * Spinner configuration mapping API paths to spinner options.
@@ -22,25 +23,52 @@ const API_SPINNER_CONFIG = {
     'collections.update': { text: 'Updating collection...', color: 'yellow' },
     'collections.delete': { text: 'Deleting collection...', color: 'yellow' },
 };
+/**
+ * Resolve the token for a request. A caller-supplied override is used as-is.
+ * On the managed path, prefer the token `proactiveRefresh` resolved (rotated
+ * or current) so unrefreshable/access-only accounts stay on a single store
+ * read; only fall back to `getApiToken` when proactive refresh bows out.
+ */
+async function resolveRequestToken(managed, override) {
+    if (override)
+        return override;
+    if (managed) {
+        const refreshed = await proactiveRefresh();
+        if (refreshed)
+            return refreshed;
+    }
+    return getApiToken();
+}
 /**
  * Core API request function without spinner wrapping.
  */
 async function rawApiRequest(path, body = {}, overrides = {}) {
+    // Only stored credentials can be refreshed: a caller-supplied token
+    // override or the `OUTLINE_API_TOKEN` env var is taken as-is.
+    const managed = !overrides.token && !process.env[TOKEN_ENV_VAR]?.trim();
+    // Resolve the base URL and the (proactively refreshed) token in parallel.
     const [resolvedBaseUrl, resolvedToken] = await Promise.all([
         overrides.baseUrl ? Promise.resolve(overrides.baseUrl.replace(/\/$/, '')) : getBaseUrl(),
-        overrides.token ? Promise.resolve(overrides.token) : getApiToken(),
+        resolveRequestToken(managed, overrides.token),
     ]);
-    const res = await fetchWithRetry({
+    const performRequest = (token) => fetchWithRetry({
         url: `${resolvedBaseUrl}/api/${path}`,
         options: {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
-                Authorization: `Bearer ${resolvedToken}`,
+                Authorization: `Bearer ${token}`,
             },
             body: JSON.stringify(body),
         },
     });
+    let res = await performRequest(resolvedToken);
+    // Reactive path: a 401 on a managed token triggers a forced rotation and
+    // a single retry. `reactiveRefresh` throws `NoTokenError` when the refresh
+    // token is gone, so an unrecoverable 401 surfaces the re-login hint.
+    if (res.status === 401 && managed && (await reactiveRefresh())) {
+        res = await performRequest(await getApiToken());
+    }
     if (!res.ok) {
         let message = `API error: ${res.status} ${res.statusText}`;
         try {

package/dist/lib/api.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/lib/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACjE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACnD,OAAO,EAAuB,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/D;;;GAGG;AACH,MAAM,kBAAkB,GAAmC;IACvD,WAAW,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,MAAM,EAAE;IAClE,kBAAkB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,EAAE;IACrE,gBAAgB,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,EAAE;IACjE,gBAAgB,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE;IAChE,kBAAkB,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE;IACpE,kBAAkB,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACrE,kBAAkB,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACrE,gBAAgB,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACjE,mBAAmB,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACvE,qBAAqB,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,QAAQ,EAAE;IAC3E,kBAAkB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,EAAE;IACrE,kBAAkB,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,EAAE;IACpE,oBAAoB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,OAAO,EAAE;IACxE,oBAAoB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACzE,oBAAoB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,QAAQ,EAAE;CAC5E,CAAA;AA8BD;;GAEG;AACH,KAAK,UAAU,aAAa,CACxB,IAAY,EACZ,OAAe,EAAE,EACjB,YAAiC,EAAE;IAEnC,MAAM,CAAC,eAAe,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACvD,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE;QACxF,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;KACrE,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC;QAC7B,GAAG,EAAE,GAAG,eAAe,QAAQ,IAAI,EAAE;QACrC,OAAO,EAAE;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACL,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,aAAa,EAAE;aAC3C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC7B;KACJ,CAAC,CAAA;IAEF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACV,IAAI,OAAO,GAAG,cAAc,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAA;QAC1D,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAa,CAAA;YAC1C,IAAI,GAAG,CAAC,OAAO;gBAAE,OAAO,GAAG,cAAc,GAAG,CAAC,OAAO,EAAE,CAAA;QAC1D,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAA;IAC5B,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmB,CAAA;IACjD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAA;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC5B,IAAY,EACZ,OAAe,EAAE,EACjB,YAAiC,EAAE;IAEnC,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI;QAC9C,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,MAAe;KACzB,CAAA;IAED,OAAO,WAAW,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,aAAa,CAAI,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAA;AACpF,CAAC"}
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/lib/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACtF,OAAO,EAAuB,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/D;;;GAGG;AACH,MAAM,kBAAkB,GAAmC;IACvD,WAAW,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,MAAM,EAAE;IAClE,kBAAkB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,EAAE;IACrE,gBAAgB,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,EAAE;IACjE,gBAAgB,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE;IAChE,kBAAkB,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE;IACpE,kBAAkB,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACrE,kBAAkB,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACrE,gBAAgB,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACjE,mBAAmB,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACvE,qBAAqB,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,QAAQ,EAAE;IAC3E,kBAAkB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,EAAE;IACrE,kBAAkB,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,EAAE;IACpE,oBAAoB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,OAAO,EAAE;IACxE,oBAAoB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACzE,oBAAoB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,QAAQ,EAAE;CAC5E,CAAA;AA8BD;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAAC,OAAgB,EAAE,QAAiB;IAClE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,IAAI,OAAO,EAAE,CAAC;QACV,MAAM,SAAS,GAAG,MAAM,gBAAgB,EAAE,CAAA;QAC1C,IAAI,SAAS;YAAE,OAAO,SAAS,CAAA;IACnC,CAAC;IACD,OAAO,WAAW,EAAE,CAAA;AACxB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,aAAa,CACxB,IAAY,EACZ,OAAe,EAAE,EACjB,YAAiC,EAAE;IAEnC,oEAAoE;IACpE,8DAA8D;IAC9D,MAAM,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAA;IAEvE,0EAA0E;IAC1E,MAAM,CAAC,eAAe,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACvD,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE;QACxF,mBAAmB,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC;KAChD,CAAC,CAAA;IAEF,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,EAAE,CACrC,cAAc,CAAC;QACX,GAAG,EAAE,GAAG,eAAe,QAAQ,IAAI,EAAE;QACrC,OAAO,EAAE;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACL,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,EAAE;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC7B;KACJ,CAAC,CAAA;IAEN,IAAI,GAAG,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,CAAA;IAE7C,yEAAyE;IACzE,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,IAAI,CAAC,MAAM,eAAe,EAAE,CAAC,EAAE,CAAC;QAC7D,GAAG,GAAG,MAAM,cAAc,CAAC,MAAM,WAAW,EAAE,CAAC,CAAA;IACnD,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACV,IAAI,OAAO,GAAG,cAAc,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAA;QAC1D,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAa,CAAA;YAC1C,IAAI,GAAG,CAAC,OAAO;gBAAE,OAAO,GAAG,cAAc,GAAG,CAAC,OAAO,EAAE,CAAA;QAC1D,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAA;IAC5B,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmB,CAAA;IACjD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAA;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC5B,IAAY,EACZ,OAAe,EAAE,EACjB,YAAiC,EAAE;IAEnC,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI;QAC9C,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,MAAe;KACzB,CAAA;IAED,OAAO,WAAW,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,aAAa,CAAI,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAA;AACpF,CAAC"}

package/dist/lib/auth-constants.d.ts

@@ -0,0 +1,18 @@
+import type { Config } from './config.js';
+/** OS keyring `service` identifier for every outline-cli secret. */
+export declare const SECURE_STORE_SERVICE = "outline-cli";
+/** Env var that short-circuits the token store with a manually-supplied token. */
+export declare const TOKEN_ENV_VAR = "OUTLINE_API_TOKEN";
+/**
+ * Legacy single-user keyring slot. Outline never wrote a token to the
+ * keyring before this migration, so there is no real legacy slot to read —
+ * `migrateLegacyAuth` still expects the option, and its best-effort delete
+ * after migration is a harmless no-op on an empty entry.
+ */
+export declare const LEGACY_KEYRING_ACCOUNT = "api-token";
+/**
+ * `updateConfig` payload that wipes every v1 auth key. Used by both the
+ * one-shot migration `cleanupLegacyConfig` and the runtime
+ * `dischargeLegacyState` so both paths stay in lockstep.
+ */
+export declare const LEGACY_CLEAR_PAYLOAD: Partial<Config>;

package/dist/lib/auth-constants.js

@@ -0,0 +1,25 @@
+/** OS keyring `service` identifier for every outline-cli secret. */
+export const SECURE_STORE_SERVICE = 'outline-cli';
+/** Env var that short-circuits the token store with a manually-supplied token. */
+export const TOKEN_ENV_VAR = 'OUTLINE_API_TOKEN';
+/**
+ * Legacy single-user keyring slot. Outline never wrote a token to the
+ * keyring before this migration, so there is no real legacy slot to read —
+ * `migrateLegacyAuth` still expects the option, and its best-effort delete
+ * after migration is a harmless no-op on an empty entry.
+ */
+export const LEGACY_KEYRING_ACCOUNT = 'api-token';
+/**
+ * `updateConfig` payload that wipes every v1 auth key. Used by both the
+ * one-shot migration `cleanupLegacyConfig` and the runtime
+ * `dischargeLegacyState` so both paths stay in lockstep.
+ */
+export const LEGACY_CLEAR_PAYLOAD = {
+    api_token: undefined,
+    base_url: undefined,
+    oauth_client_id: undefined,
+    auth_user_id: undefined,
+    auth_user_name: undefined,
+    auth_team_name: undefined,
+};
+//# sourceMappingURL=auth-constants.js.map

package/dist/lib/auth-constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-constants.js","sourceRoot":"","sources":["../../src/lib/auth-constants.ts"],"names":[],"mappings":"AAEA,oEAAoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAA;AAEjD,kFAAkF;AAClF,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAA;AAEhD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAA;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAoB;IACjD,SAAS,EAAE,SAAS;IACpB,QAAQ,EAAE,SAAS;IACnB,eAAe,EAAE,SAAS;IAC1B,YAAY,EAAE,SAAS;IACvB,cAAc,EAAE,SAAS;IACzB,cAAc,EAAE,SAAS;CAC5B,CAAA"}

package/dist/lib/auth-provider.d.ts

@@ -1,10 +1,59 @@
-import { type AuthAccount, type AuthProvider, type TokenStore } from '@doist/cli-core/auth';
-export type OutlineAccount = AuthAccount & {
-    id: string;
-    label: string;
-    baseUrl: string;
-    oauthClientId: string;
-    teamName?: string;
+import { type AccountRef, type AuthProvider, type KeyringTokenStore } from '@doist/cli-core/auth';
+import { type OutlineAccount } from './outline-account.js';
+export type { OutlineAccount } from './outline-account.js';
+export type AuthInfoResponse = {
+    user: {
+        id: string;
+        name: string;
+        email: string;
+    };
+    team: {
+        name: string;
+        subdomain: string;
+    };
 };
+export type OutlineTokenStore = KeyringTokenStore<OutlineAccount>;
 export declare function createOutlineAuthProvider(): AuthProvider<OutlineAccount>;
-export declare function createOutlineTokenStore(): TokenStore<OutlineAccount>;
+/**
+ * Accepts the Outline user UUID or display name. Id matches are
+ * case-sensitive (UUIDs are canonical); label matches are
+ * case-insensitive so users can pass the name they see in `auth status`.
+ */
+export declare function matchOutlineAccount(account: OutlineAccount, ref: AccountRef): boolean;
+/**
+ * True when the v2 store is empty but a legacy v1 token snapshot is still
+ * the only thing keeping the CLI authenticated — typically because
+ * `migrateLegacyAuth` couldn't reach the Outline API to identify the
+ * account (`MigrateSkipReason: 'identify-failed'`) or the OS keyring is
+ * unreachable (`'legacy-keyring-unreachable'`, although outline has no
+ * v1 keyring slot to read from). Useful for downstream diagnostics.
+ */
+export declare function isLegacyAuthActive(): Promise<boolean>;
+/**
+ * `OUTLINE_API_TOKEN` short-circuits `active()` only when no explicit ref
+ * is supplied — cli-core's `KeyringTokenStore` doesn't know about the env
+ * var, and an explicit ref means the caller targets a specific stored
+ * account.
+ *
+ * `ensureMigrated()` runs **before** every mutating v2 op so the post-op
+ * legacy discharge can't race a still-pending migration into re-grabbing
+ * the legacy `api_token` we just consumed. `set()` / `clear()` then
+ * discharge legacy state **after** the v2 op succeeds. `set()` swallows
+ * the cleanup failure (v2 wins in `active()` regardless); `clear()`
+ * propagates it so a failed logout fails loudly instead of leaving the
+ * user authenticated via the legacy fallback.
+ */
+export declare function createOutlineTokenStore(): OutlineTokenStore;
+/**
+ * Where the currently-active token lives. Mirrors `active()`'s resolution
+ * order — env → v2 record → legacy plaintext — so the answer can never
+ * contradict the token the runtime is actually using.
+ *
+ * The precedence cascade is intentionally duplicated with `active()`:
+ * the only true dedupe options either (a) add an extra config read on
+ * every `apiRequest` call (regressing the request hot path) or (b)
+ * augment cli-core's `TokenStore` contract. The drift the duplication
+ * invites is guarded by the `getActiveTokenSource` regression test that
+ * asserts v2-record presence wins over a lingering v1 `api_token`.
+ */
+export declare function getActiveTokenSource(): Promise<'env' | 'secure-store' | 'config-file'>;