@doist/outline-cli 1.6.0 → 1.8.0

package/dist/lib/auth-provider.js

@@ -1,14 +1,13 @@
 import { createInterface } from 'node:readline/promises';
-import { deriveChallenge, generateVerifier, } from '@doist/cli-core/auth';
+import { createKeyringTokenStore, createPkceProvider, } from '@doist/cli-core/auth';
 import { fetchWithRetry } from '../transport/fetch-with-retry.js';
 import { apiRequest } from './api.js';
-import { clearConfig, getBaseUrl, getOAuthClientId } from './auth.js';
-import { getConfig, updateConfig } from './config.js';
-import { CliError } from './errors.js';
-const DEFAULT_BASE_URL = 'https://app.getoutline.com';
-function asHandshake(value) {
-    return value;
-}
+import { LEGACY_CLEAR_PAYLOAD, SECURE_STORE_SERVICE, TOKEN_ENV_VAR } from './auth-constants.js';
+import { getBaseUrl, getOAuthClientId } from './auth.js';
+import { getConfig, getConfigPath, updateConfig } from './config.js';
+import { runMigrateLegacyAuth } from './migrate-auth.js';
+import { makeOutlineAccount } from './outline-account.js';
+import { createOutlineUserRecordStore, getDefaultUserRecord } from './user-records.js';
 function stringFlag(flags, key) {
     const value = flags[key];
     return typeof value === 'string' && value.trim() ? value.trim() : undefined;
@@ -47,152 +46,250 @@ async function resolveClientId(flags) {
     }
     return answered;
 }
+/**
+ * Routes cli-core's OAuth HTTP through outline's transport so the proxy /
+ * decompression dispatcher applies — to the token exchange AND the
+ * oauth4webapi refresh grant (cli-core threads this into oauth4webapi's
+ * `customFetch`), which would otherwise capture the bare global `fetch`.
+ */
+const outlineFetch = (input, init) => fetchWithRetry({ url: input, options: init ?? {} });
 export function createOutlineAuthProvider() {
-    return {
-        async authorize({ redirectUri, state, flags }) {
-            const baseUrl = await resolveBaseUrl(flags);
-            const clientId = await resolveClientId(flags);
-            const codeVerifier = generateVerifier();
-            const codeChallenge = deriveChallenge(codeVerifier);
-            const url = new URL(`${baseUrl}/oauth/authorize`);
-            url.searchParams.set('client_id', clientId);
-            url.searchParams.set('response_type', 'code');
-            url.searchParams.set('code_challenge', codeChallenge);
-            url.searchParams.set('code_challenge_method', 'S256');
-            url.searchParams.set('redirect_uri', redirectUri);
-            url.searchParams.set('state', state);
-            const handshake = { baseUrl, clientId, codeVerifier };
-            return { authorizeUrl: url.toString(), handshake };
+    // Captured at `authorize` (which may prompt for it) and reused by
+    // `exchangeCode` / `validate` so a single login can't double-prompt. A
+    // provider built only for silent refresh never runs `authorize`, so this
+    // stays undefined there and `tokenUrl` falls back to stored config — the
+    // refresh path must never prompt.
+    let baseUrl;
+    return createPkceProvider({
+        authorizeUrl: async ({ flags }) => {
+            baseUrl = await resolveBaseUrl(flags);
+            return `${baseUrl}/oauth/authorize`;
         },
-        async exchangeCode({ code, redirectUri, handshake }) {
-            const hs = asHandshake(handshake);
-            if (!hs.codeVerifier) {
-                throw new Error('Missing PKCE code verifier from authorize step.');
-            }
-            const params = new URLSearchParams({
-                grant_type: 'authorization_code',
-                client_id: hs.clientId,
-                redirect_uri: redirectUri,
-                code_verifier: hs.codeVerifier,
-                code,
-            });
-            const res = await fetchWithRetry({
-                url: `${hs.baseUrl}/oauth/token`,
-                options: {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-                    body: params.toString(),
-                },
-            });
-            const json = (await res.json().catch(() => ({})));
-            if (!res.ok) {
-                const message = json.error_description || json.message || json.error || res.statusText;
-                throw new Error(`OAuth token exchange failed: ${message}`);
-            }
-            if (!json.access_token) {
-                throw new Error('OAuth token exchange did not return an access token.');
-            }
-            return { accessToken: json.access_token };
+        tokenUrl: async ({ handshake }) => {
+            // `handshake.baseUrl` lets a caller scope refresh to a specific
+            // account's instance (status --user); otherwise the authorize-time
+            // value, then the default config.
+            const base = baseUrl ?? handshake.baseUrl ?? (await getBaseUrl());
+            return `${base}/oauth/token`;
         },
-        async validateToken({ token, handshake }) {
-            const hs = asHandshake(handshake);
-            const { data } = await apiRequest('auth.info', {}, {
-                token,
-                baseUrl: hs.baseUrl,
-            });
-            return {
+        // Prefer a handshake-scoped client id (account-aware refresh); else
+        // resolve from flag/config (only prompts when neither is set, so it's
+        // safe on the refresh path — the logged-in record carries one).
+        clientId: ({ handshake, flags }) => {
+            const fromHandshake = handshake.clientId;
+            return typeof fromHandshake === 'string' && fromHandshake
+                ? fromHandshake
+                : resolveClientId(flags);
+        },
+        validate: async ({ token, handshake }) => {
+            const base = baseUrl ?? (await getBaseUrl());
+            const { data } = await apiRequest('auth.info', {}, { token, baseUrl: base });
+            return makeOutlineAccount({
                 id: data.user.id,
                 label: data.user.name,
-                baseUrl: hs.baseUrl,
-                oauthClientId: hs.clientId,
+                baseUrl: base,
+                oauthClientId: handshake.clientId,
                 teamName: data.team.name,
-            };
+            });
         },
+        fetchImpl: outlineFetch,
+    });
+}
+/**
+ * Accepts the Outline user UUID or display name. Id matches are
+ * case-sensitive (UUIDs are canonical); label matches are
+ * case-insensitive so users can pass the name they see in `auth status`.
+ */
+export function matchOutlineAccount(account, ref) {
+    if (account.id === ref)
+        return true;
+    return account.label.toLowerCase() === ref.toLowerCase();
+}
+/** True when the v2 store is the authoritative source. */
+function migrationIsConclusive(result) {
+    return (result.status === 'migrated' ||
+        result.status === 'already-migrated' ||
+        result.status === 'no-legacy-state');
+}
+/**
+ * Synthesise a snapshot from v1 plaintext state still on disk. Fallback for
+ * when migration can't complete (offline `identifyAccount`, WSL
+ * `legacy-keyring-unreachable`). Returns `null` when no legacy token is
+ * present. The synthesised account uses whatever identity fields the v1
+ * config has — for pre-#71 configs the id/label may be empty, but the
+ * runtime never renders those (status's `fetchLive` re-derives from the
+ * API), so empty placeholders are safe.
+ */
+async function readLegacyTokenSnapshot() {
+    const config = await getConfig();
+    const token = config.api_token?.trim() || null;
+    if (!token)
+        return null;
+    return {
+        token,
+        account: makeOutlineAccount({
+            id: config.auth_user_id ?? '',
+            label: config.auth_user_name ?? '',
+            baseUrl: config.base_url,
+            oauthClientId: config.oauth_client_id,
+            teamName: config.auth_team_name,
+        }),
     };
 }
+/**
+ * Discharge v1 plaintext state. Runs **after** a successful v2 write/clear
+ * — never before — so a v2-op failure doesn't strand the user with no
+ * recoverable credentials. Caller decides whether to swallow or propagate
+ * the `updateConfig` failure:
+ *   - `set()` swallows (v2 record will win in `active()` regardless).
+ *   - `clear()` propagates (v2 is empty, so a stale legacy token would
+ *     shadow the logout via the fallback).
+ */
+async function dischargeLegacyState() {
+    await updateConfig(LEGACY_CLEAR_PAYLOAD);
+}
+/**
+ * Memoised one-shot migration trigger. Resolves with `null` on rejection so
+ * the CLI never fails to start because of a migration error — the legacy
+ * snapshot fallback handles that case. Tests reset the memo with
+ * `vi.resetModules()` + a dynamic re-import.
+ */
+let migrationPromise;
+function ensureMigrated() {
+    if (!migrationPromise) {
+        migrationPromise = runMigrateLegacyAuth({ silent: true }).catch(() => null);
+    }
+    return migrationPromise;
+}
+/**
+ * True when the v2 store is empty but a legacy v1 token snapshot is still
+ * the only thing keeping the CLI authenticated — typically because
+ * `migrateLegacyAuth` couldn't reach the Outline API to identify the
+ * account (`MigrateSkipReason: 'identify-failed'`) or the OS keyring is
+ * unreachable (`'legacy-keyring-unreachable'`, although outline has no
+ * v1 keyring slot to read from). Useful for downstream diagnostics.
+ */
+export async function isLegacyAuthActive() {
+    const result = await ensureMigrated();
+    if (result !== null && migrationIsConclusive(result))
+        return false;
+    const legacy = await readLegacyTokenSnapshot();
+    return legacy !== null;
+}
+/**
+ * `OUTLINE_API_TOKEN` short-circuits `active()` only when no explicit ref
+ * is supplied — cli-core's `KeyringTokenStore` doesn't know about the env
+ * var, and an explicit ref means the caller targets a specific stored
+ * account.
+ *
+ * `ensureMigrated()` runs **before** every mutating v2 op so the post-op
+ * legacy discharge can't race a still-pending migration into re-grabbing
+ * the legacy `api_token` we just consumed. `set()` / `clear()` then
+ * discharge legacy state **after** the v2 op succeeds. `set()` swallows
+ * the cleanup failure (v2 wins in `active()` regardless); `clear()`
+ * propagates it so a failed logout fails loudly instead of leaving the
+ * user authenticated via the legacy fallback.
+ */
 export function createOutlineTokenStore() {
-    /**
-     * Derive a snapshot from an already-loaded config. Pure, so ref-aware
-     * callers can validate without a second config read.
-     */
-    function deriveSnapshot(config) {
-        if (!config.api_token)
-            return null;
-        const id = config.auth_user_id;
-        const label = config.auth_user_name;
-        if (!id || !label) {
-            // Stored token predates this adapter (env var, pre-upgrade
-            // config). No persisted identity to round-trip.
-            return null;
-        }
-        return {
-            token: config.api_token,
-            account: {
-                id,
-                label,
-                baseUrl: config.base_url ?? DEFAULT_BASE_URL,
-                oauthClientId: config.oauth_client_id ?? '',
-                teamName: config.auth_team_name,
-            },
-        };
+    const inner = createKeyringTokenStore({
+        serviceName: SECURE_STORE_SERVICE,
+        userRecords: createOutlineUserRecordStore(),
+        recordsLocation: getConfigPath(),
+        matchAccount: matchOutlineAccount,
+    });
+    async function migrationIsInconclusive() {
+        const result = await ensureMigrated(); // memoised
+        return result === null || !migrationIsConclusive(result);
     }
     /**
-     * Match the stored account against `--user <ref>`. Outline accounts use
-     * UUID ids and a display name — id matches are case-sensitive (UUIDs
-     * are canonical), label matches are case-insensitive so users can pass
-     * the name they see in `auth status` regardless of casing.
+     * Shared env → v2 → legacy resolution for `active` / `activeBundle`.
+     * `fromV2` reads the matching cli-core method; `fromEnvOrLegacy` maps an
+     * env/legacy token into the caller's shape (env + legacy carry no refresh
+     * material, so the bundle form surfaces as access-only).
      */
-    function matchesRef(account, ref) {
-        if (account.id === ref)
-            return true;
-        return account.label.toLowerCase() === ref.toLowerCase();
+    async function resolveAuth(ref, fromV2, fromEnvOrLegacy) {
+        if (ref === undefined) {
+            const envToken = process.env[TOKEN_ENV_VAR]?.trim();
+            if (envToken) {
+                return fromEnvOrLegacy(envToken, makeOutlineAccount({ id: '', label: '', baseUrl: await getBaseUrl() }));
+            }
+        }
+        await ensureMigrated();
+        const fromStore = await fromV2();
+        if (fromStore)
+            return fromStore;
+        const legacy = await readLegacyTokenSnapshot();
+        if (legacy && (ref === undefined || matchOutlineAccount(legacy.account, ref))) {
+            return fromEnvOrLegacy(legacy.token, legacy.account);
+        }
+        return null;
     }
-    function refMismatch(ref) {
-        return new CliError('ACCOUNT_NOT_FOUND', `No stored account matches "${ref}".`);
+    // `ensureMigrated` runs before the v2 write so the post-write discharge
+    // can't race a pending migration into re-grabbing the legacy token. The
+    // discharge is best-effort: a lingering `api_token` is dormant because
+    // reads hit v2 first. (`clear` needs the stricter propagating variant.)
+    async function writeThenDischargeLegacy(write) {
+        await ensureMigrated();
+        await write();
+        if (await migrationIsInconclusive()) {
+            await dischargeLegacyState().catch(() => undefined);
+        }
     }
     return {
-        async active(ref) {
-            const snapshot = deriveSnapshot(await getConfig());
-            if (ref === undefined)
-                return snapshot;
-            if (!snapshot || !matchesRef(snapshot.account, ref))
-                throw refMismatch(ref);
-            return snapshot;
+        active(ref) {
+            return resolveAuth(ref, () => inner.active(ref), (token, account) => ({ token, account }));
         },
-        async set(account, token) {
-            await updateConfig({
-                api_token: token,
-                base_url: account.baseUrl,
-                oauth_client_id: account.oauthClientId,
-                auth_user_id: account.id,
-                auth_user_name: account.label,
-                auth_team_name: account.teamName,
-            });
+        activeBundle(ref) {
+            return resolveAuth(ref, () => inner.activeBundle(ref), (token, account) => ({ account, bundle: { accessToken: token } }));
+        },
+        set(account, token) {
+            return writeThenDischargeLegacy(() => inner.set(account, token));
+        },
+        setBundle(account, bundle, options) {
+            return writeThenDischargeLegacy(() => inner.setBundle(account, bundle, options));
         },
         async clear(ref) {
-            // With `ref`, validate before touching storage so a mismatch is
-            // an `ACCOUNT_NOT_FOUND` error rather than a silent success —
-            // `attachLogoutCommand` treats any non-throwing `clear()` as
-            // success. Load the config once and hand it to `clearConfig`
-            // so ref-based logout stays at one read + one write.
-            const config = await getConfig();
-            if (ref !== undefined) {
-                const snapshot = deriveSnapshot(config);
-                if (!snapshot || !matchesRef(snapshot.account, ref))
-                    throw refMismatch(ref);
+            await ensureMigrated();
+            await inner.clear(ref);
+            if (await migrationIsInconclusive()) {
+                // Must succeed: v2 is now empty, so a surviving legacy
+                // token would shadow the logout via the fallback.
+                await dischargeLegacyState();
             }
-            await clearConfig(config);
         },
         async list() {
-            const snapshot = deriveSnapshot(await getConfig());
-            return snapshot ? [{ account: snapshot.account, isDefault: true }] : [];
+            await ensureMigrated();
+            return inner.list();
         },
         async setDefault(ref) {
-            const snapshot = deriveSnapshot(await getConfig());
-            if (!snapshot || !matchesRef(snapshot.account, ref))
-                throw refMismatch(ref);
-            // Single-user store — already the default once `ref` matches.
+            await ensureMigrated();
+            return inner.setDefault(ref);
         },
+        getLastStorageResult: () => inner.getLastStorageResult(),
+        getLastClearResult: () => inner.getLastClearResult(),
     };
 }
+/**
+ * Where the currently-active token lives. Mirrors `active()`'s resolution
+ * order — env → v2 record → legacy plaintext — so the answer can never
+ * contradict the token the runtime is actually using.
+ *
+ * The precedence cascade is intentionally duplicated with `active()`:
+ * the only true dedupe options either (a) add an extra config read on
+ * every `apiRequest` call (regressing the request hot path) or (b)
+ * augment cli-core's `TokenStore` contract. The drift the duplication
+ * invites is guarded by the `getActiveTokenSource` regression test that
+ * asserts v2-record presence wins over a lingering v1 `api_token`.
+ */
+export async function getActiveTokenSource() {
+    if (process.env[TOKEN_ENV_VAR]?.trim())
+        return 'env';
+    const config = await getConfig();
+    const record = getDefaultUserRecord(config);
+    if (record)
+        return record.fallbackToken ? 'config-file' : 'secure-store';
+    if (config.api_token?.trim())
+        return 'config-file';
+    return 'secure-store';
+}
 //# sourceMappingURL=auth-provider.js.map

package/dist/lib/auth-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-provider.js","sourceRoot":"","sources":["../../src/lib/auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAIH,eAAe,EACf,gBAAgB,GAEnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AACrE,OAAO,EAAe,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAEtC,MAAM,gBAAgB,GAAG,4BAA4B,CAAA;AAqBrD,SAAS,WAAW,CAAC,KAA8B;IAC/C,OAAO,KAAyB,CAAA;AACpC,CAAC;AAED,SAAS,UAAU,CAAC,KAA8B,EAAE,GAAW;IAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;IACxB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/E,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,QAAgB;IAClC,4EAA4E;IAC5E,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAC5E,IAAI,CAAC;QACD,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC/C,CAAC;YAAS,CAAC;QACP,EAAE,CAAC,KAAK,EAAE,CAAA;IACd,CAAC;AACL,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAA8B;IACxD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IAC7C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAA;IAC/C,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC9C,MAAM,UAAU,GAAG,MAAM,UAAU,EAAE,CAAA;IACrC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,sBAAsB,UAAU,KAAK,CAAC,CAAA;IACpE,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACtD,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAA8B;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC9C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,EAAE,CAAA;IACzC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACX,wIAAwI,CAC3I,CAAA;IACL,CAAC;IACD,OAAO,QAAQ,CAAA;AACnB,CAAC;AAED,MAAM,UAAU,yBAAyB;IACrC,OAAO;QACH,KAAK,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAA;YAC3C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAA;YAC7C,MAAM,YAAY,GAAG,gBAAgB,EAAE,CAAA;YACvC,MAAM,aAAa,GAAG,eAAe,CAAC,YAAY,CAAC,CAAA;YAEnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,OAAO,kBAAkB,CAAC,CAAA;YACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;YAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAA;YAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAA;YACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAA;YACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAA;YACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAEpC,MAAM,SAAS,GAAqB,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAA;YACvE,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAA;QACtD,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE;YAC/C,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;YACjC,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;YACtE,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;gBAC/B,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,EAAE,CAAC,QAAQ;gBACtB,YAAY,EAAE,WAAW;gBACzB,aAAa,EAAE,EAAE,CAAC,YAAY;gBAC9B,IAAI;aACP,CAAC,CAAA;YAEF,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC;gBAC7B,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,cAAc;gBAChC,OAAO,EAAE;oBACL,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;oBAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;iBAC1B;aACJ,CAAC,CAAA;YAEF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAK/C,CAAA;YAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACV,MAAM,OAAO,GACT,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,CAAA;gBAC1E,MAAM,IAAI,KAAK,CAAC,gCAAgC,OAAO,EAAE,CAAC,CAAA;YAC9D,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;YAC3E,CAAC;YAED,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,CAAA;QAC7C,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE;YACpC,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;YACjC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAC7B,WAAW,EACX,EAAE,EACF;gBACI,KAAK;gBACL,OAAO,EAAE,EAAE,CAAC,OAAO;aACtB,CACJ,CAAA;YACD,OAAO;gBACH,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;gBAChB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;gBACrB,OAAO,EAAE,EAAE,CAAC,OAAO;gBACnB,aAAa,EAAE,EAAE,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;aAC3B,CAAA;QACL,CAAC;KACJ,CAAA;AACL,CAAC;AAED,MAAM,UAAU,uBAAuB;IACnC;;;OAGG;IACH,SAAS,cAAc,CACnB,MAAuB;QAEvB,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,OAAO,IAAI,CAAA;QAClC,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAA;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAA;QACnC,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,2DAA2D;YAC3D,gDAAgD;YAChD,OAAO,IAAI,CAAA;QACf,CAAC;QACD,OAAO;YACH,KAAK,EAAE,MAAM,CAAC,SAAS;YACvB,OAAO,EAAE;gBACL,EAAE;gBACF,KAAK;gBACL,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,gBAAgB;gBAC5C,aAAa,EAAE,MAAM,CAAC,eAAe,IAAI,EAAE;gBAC3C,QAAQ,EAAE,MAAM,CAAC,cAAc;aAClC;SACJ,CAAA;IACL,CAAC;IAED;;;;;OAKG;IACH,SAAS,UAAU,CAAC,OAAuB,EAAE,GAAe;QACxD,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;QACnC,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CAAA;IAC5D,CAAC;IAED,SAAS,WAAW,CAAC,GAAe;QAChC,OAAO,IAAI,QAAQ,CAAC,mBAAmB,EAAE,8BAA8B,GAAG,IAAI,CAAC,CAAA;IACnF,CAAC;IAED,OAAO;QACH,KAAK,CAAC,MAAM,CAAC,GAAgB;YACzB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,SAAS,EAAE,CAAC,CAAA;YAClD,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,QAAQ,CAAA;YACtC,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC;gBAAE,MAAM,WAAW,CAAC,GAAG,CAAC,CAAA;YAC3E,OAAO,QAAQ,CAAA;QACnB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK;YACpB,MAAM,YAAY,CAAC;gBACf,SAAS,EAAE,KAAK;gBAChB,QAAQ,EAAE,OAAO,CAAC,OAAO;gBACzB,eAAe,EAAE,OAAO,CAAC,aAAa;gBACtC,YAAY,EAAE,OAAO,CAAC,EAAE;gBACxB,cAAc,EAAE,OAAO,CAAC,KAAK;gBAC7B,cAAc,EAAE,OAAO,CAAC,QAAQ;aACnC,CAAC,CAAA;QACN,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAgB;YACxB,gEAAgE;YAChE,8DAA8D;YAC9D,6DAA6D;YAC7D,6DAA6D;YAC7D,qDAAqD;YACrD,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;YAChC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACpB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;gBACvC,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC;oBAAE,MAAM,WAAW,CAAC,GAAG,CAAC,CAAA;YAC/E,CAAC;YACD,MAAM,WAAW,CAAC,MAAM,CAAC,CAAA;QAC7B,CAAC;QACD,KAAK,CAAC,IAAI;YACN,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,SAAS,EAAE,CAAC,CAAA;YAClD,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC3E,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,GAAe;YAC5B,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,SAAS,EAAE,CAAC,CAAA;YAClD,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC;gBAAE,MAAM,WAAW,CAAC,GAAG,CAAC,CAAA;YAC3E,8DAA8D;QAClE,CAAC;KACJ,CAAA;AACL,CAAC"}
+{"version":3,"file":"auth-provider.js","sourceRoot":"","sources":["../../src/lib/auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAGH,uBAAuB,EACvB,kBAAkB,GAIrB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC/F,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAuB,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAWtF,SAAS,UAAU,CAAC,KAA8B,EAAE,GAAW;IAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;IACxB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/E,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,QAAgB;IAClC,4EAA4E;IAC5E,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAC5E,IAAI,CAAC;QACD,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC/C,CAAC;YAAS,CAAC;QACP,EAAE,CAAC,KAAK,EAAE,CAAA;IACd,CAAC;AACL,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAA8B;IACxD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IAC7C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAA;IAC/C,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC9C,MAAM,UAAU,GAAG,MAAM,UAAU,EAAE,CAAA;IACrC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,sBAAsB,UAAU,KAAK,CAAC,CAAA;IACpE,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACtD,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAA8B;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC9C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,EAAE,CAAA;IACzC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACX,wIAAwI,CAC3I,CAAA;IACL,CAAC;IACD,OAAO,QAAQ,CAAA;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,YAAY,GAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAC/C,cAAc,CAAC,EAAE,GAAG,EAAE,KAA0B,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;AAE5E,MAAM,UAAU,yBAAyB;IACrC,kEAAkE;IAClE,uEAAuE;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,kCAAkC;IAClC,IAAI,OAA2B,CAAA;IAC/B,OAAO,kBAAkB,CAAiB;QACtC,YAAY,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAC9B,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAA;YACrC,OAAO,GAAG,OAAO,kBAAkB,CAAA;QACvC,CAAC;QACD,QAAQ,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;YAC9B,gEAAgE;YAChE,mEAAmE;YACnE,kCAAkC;YAClC,MAAM,IAAI,GACN,OAAO,IAAK,SAAS,CAAC,OAA8B,IAAI,CAAC,MAAM,UAAU,EAAE,CAAC,CAAA;YAChF,OAAO,GAAG,IAAI,cAAc,CAAA;QAChC,CAAC;QACD,oEAAoE;QACpE,sEAAsE;QACtE,gEAAgE;QAChE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE;YAC/B,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAA;YACxC,OAAO,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa;gBACrD,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;QAChC,CAAC;QACD,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,MAAM,UAAU,EAAE,CAAC,CAAA;YAC5C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAC7B,WAAW,EACX,EAAE,EACF,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAC3B,CAAA;YACD,OAAO,kBAAkB,CAAC;gBACtB,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;gBAChB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;gBACrB,OAAO,EAAE,IAAI;gBACb,aAAa,EAAE,SAAS,CAAC,QAAkB;gBAC3C,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;aAC3B,CAAC,CAAA;QACN,CAAC;QACD,SAAS,EAAE,YAAY;KAC1B,CAAC,CAAA;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAuB,EAAE,GAAe;IACxE,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACnC,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CAAA;AAC5D,CAAC;AAED,0DAA0D;AAC1D,SAAS,qBAAqB,CAAC,MAAyC;IACpE,OAAO,CACH,MAAM,CAAC,MAAM,KAAK,UAAU;QAC5B,MAAM,CAAC,MAAM,KAAK,kBAAkB;QACpC,MAAM,CAAC,MAAM,KAAK,iBAAiB,CACtC,CAAA;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,uBAAuB;IAIlC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,IAAI,CAAA;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,OAAO;QACH,KAAK;QACL,OAAO,EAAE,kBAAkB,CAAC;YACxB,EAAE,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YAC7B,KAAK,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;YAClC,OAAO,EAAE,MAAM,CAAC,QAAQ;YACxB,aAAa,EAAE,MAAM,CAAC,eAAe;YACrC,QAAQ,EAAE,MAAM,CAAC,cAAc;SAClC,CAAC;KACL,CAAA;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB;IAC/B,MAAM,YAAY,CAAC,oBAAoB,CAAC,CAAA;AAC5C,CAAC;AAED;;;;;GAKG;AACH,IAAI,gBAA+E,CAAA;AACnF,SAAS,cAAc;IACnB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpB,gBAAgB,GAAG,oBAAoB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAC/E,CAAC;IACD,OAAO,gBAAgB,CAAA;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACpC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAA;IACrC,IAAI,MAAM,KAAK,IAAI,IAAI,qBAAqB,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IAClE,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;IAC9C,OAAO,MAAM,KAAK,IAAI,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB;IACnC,MAAM,KAAK,GAAG,uBAAuB,CAAiB;QAClD,WAAW,EAAE,oBAAoB;QACjC,WAAW,EAAE,4BAA4B,EAAE;QAC3C,eAAe,EAAE,aAAa,EAAE;QAChC,YAAY,EAAE,mBAAmB;KACpC,CAAC,CAAA;IACF,KAAK,UAAU,uBAAuB;QAClC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAA,CAAC,WAAW;QACjD,OAAO,MAAM,KAAK,IAAI,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAC5D,CAAC;IACD;;;;;OAKG;IACH,KAAK,UAAU,WAAW,CACtB,GAA2B,EAC3B,MAA+B,EAC/B,eAA8D;QAE9D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAA;YACnD,IAAI,QAAQ,EAAE,CAAC;gBACX,OAAO,eAAe,CAClB,QAAQ,EACR,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,UAAU,EAAE,EAAE,CAAC,CACzE,CAAA;YACL,CAAC;QACL,CAAC;QACD,MAAM,cAAc,EAAE,CAAA;QACtB,MAAM,SAAS,GAAG,MAAM,MAAM,EAAE,CAAA;QAChC,IAAI,SAAS;YAAE,OAAO,SAAS,CAAA;QAC/B,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;QAC9C,IAAI,MAAM,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5E,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACxD,CAAC;QACD,OAAO,IAAI,CAAA;IACf,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,wEAAwE;IACxE,KAAK,UAAU,wBAAwB,CAAC,KAA0B;QAC9D,MAAM,cAAc,EAAE,CAAA;QACtB,MAAM,KAAK,EAAE,CAAA;QACb,IAAI,MAAM,uBAAuB,EAAE,EAAE,CAAC;YAClC,MAAM,oBAAoB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACvD,CAAC;IACL,CAAC;IAED,OAAO;QACH,MAAM,CAAC,GAAgB;YACnB,OAAO,WAAW,CACd,GAAG,EACH,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EACvB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAC3C,CAAA;QACL,CAAC;QACD,YAAY,CAAC,GAAgB;YACzB,OAAO,WAAW,CACd,GAAG,EACH,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,EAC7B,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC,CACpE,CAAA;QACL,CAAC;QACD,GAAG,CAAC,OAAuB,EAAE,KAAa;YACtC,OAAO,wBAAwB,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;QACpE,CAAC;QACD,SAAS,CAAC,OAAuB,EAAE,MAAmB,EAAE,OAAO;YAC3D,OAAO,wBAAwB,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;QACpF,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAgB;YACxB,MAAM,cAAc,EAAE,CAAA;YACtB,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACtB,IAAI,MAAM,uBAAuB,EAAE,EAAE,CAAC;gBAClC,uDAAuD;gBACvD,kDAAkD;gBAClD,MAAM,oBAAoB,EAAE,CAAA;YAChC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,IAAI;YACN,MAAM,cAAc,EAAE,CAAA;YACtB,OAAO,KAAK,CAAC,IAAI,EAAE,CAAA;QACvB,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,GAAe;YAC5B,MAAM,cAAc,EAAE,CAAA;YACtB,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAChC,CAAC;QACD,oBAAoB,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE;QACxD,kBAAkB,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,kBAAkB,EAAE;KACvD,CAAA;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACtC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE;QAAE,OAAO,KAAK,CAAA;IACpD,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAA;IACxE,IAAI,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE;QAAE,OAAO,aAAa,CAAA;IAClD,OAAO,cAAc,CAAA;AACzB,CAAC"}

package/dist/lib/auth.d.ts

@@ -1,15 +1,51 @@
-import { type Config } from './config.js';
+import { SecureStoreUnavailableError } from '@doist/cli-core/auth';
+import { TOKEN_ENV_VAR } from './auth-constants.js';
+import { getActiveTokenSource } from './auth-provider.js';
+import { CliError } from './errors.js';
+import { type OutlineAccount } from './outline-account.js';
+export { SecureStoreUnavailableError, getActiveTokenSource, TOKEN_ENV_VAR };
+export declare class NoTokenError extends CliError {
+    constructor();
+}
+/**
+ * Best-effort proactive rotation before a request. Returns the token to use
+ * (the rotated one, or the current one if no rotation was needed) so the
+ * caller doesn't re-read the store; `undefined` when the default account
+ * isn't refreshable (no refresh token / env / failure) — the caller then
+ * falls back to `getApiToken()` and the 401 path stays authoritative.
+ */
+export declare function proactiveRefresh(): Promise<string | undefined>;
+/**
+ * Refresh the *selected* account (not the default) for `auth status`, returning
+ * its current-or-rotated token. Scoped via the account's id + base URL/client
+ * id through the refresh handshake, so `--user <other>` checks and rotates the
+ * right account at the right instance. Env / legacy / record-less accounts
+ * aren't refreshable — the snapshot `fallback` token is returned as-is.
+ */
+export declare function refreshedTokenForStatus(account: OutlineAccount, fallback: string): Promise<string>;
+/**
+ * Reactive rotation after a 401. Returns `true` when the token rotated (the
+ * caller retries once). A rejected/absent refresh token surfaces as
+ * `NoTokenError` (re-login); a transient failure propagates unchanged.
+ */
+export declare function reactiveRefresh(): Promise<boolean>;
+/**
+ * Read the active token. Hot path: when `OUTLINE_API_TOKEN` is set we
+ * return it directly without consulting the token store, since
+ * `apiRequest` already resolves the base URL separately — going through
+ * `store.active()` here would trigger a redundant `getBaseUrl()` lookup
+ * per request just to synthesise an account we don't need.
+ */
 export declare function getApiToken(): Promise<string>;
+/**
+ * Base URL cascade: env var → default user record (v2) → legacy
+ * `base_url` config (v1) → built-in default. The record takes priority
+ * over the legacy slot so post-migration logins keep defaulting to the
+ * same Outline instance.
+ */
 export declare function getBaseUrl(): Promise<string>;
-export declare function getOAuthClientId(): Promise<string | undefined>;
-export declare function getTokenSource(): Promise<'env' | 'config' | null>;
 /**
- * Clear the auth-related keys without deleting the file. The config is now
- * shared with non-auth settings (notably `update_channel`); a blanket unlink
- * would silently reset the user's update-channel preference too.
- *
- * Pass `existing` to skip the read when the caller has already loaded the
- * config (e.g. ref-validated logout) — keeps that flow at one read + one
- * write instead of two reads.
+ * OAuth client id cascade: env var → default user record (v2) → legacy
+ * `oauth_client_id` config (v1) → undefined (caller prompts).
  */
-export declare function clearConfig(existing?: Partial<Config>): Promise<void>;
+export declare function getOAuthClientId(): Promise<string | undefined>;