@doist/outline-cli 1.6.0 → 1.8.0

package/dist/lib/auth.js

@@ -1,56 +1,156 @@
-import { getConfig, setConfig } from './config.js';
-const DEFAULT_BASE_URL = 'https://app.getoutline.com';
+import { refreshAccessToken, SecureStoreUnavailableError } from '@doist/cli-core/auth';
+import { TOKEN_ENV_VAR } from './auth-constants.js';
+import { createOutlineAuthProvider, createOutlineTokenStore, getActiveTokenSource, } from './auth-provider.js';
+import { getConfig, getConfigPath } from './config.js';
+import { CliError } from './errors.js';
+import { DEFAULT_BASE_URL } from './outline-account.js';
+import { getDefaultUserRecord } from './user-records.js';
+export { SecureStoreUnavailableError, getActiveTokenSource, TOKEN_ENV_VAR };
+export class NoTokenError extends CliError {
+    constructor() {
+        super('NO_TOKEN', `No API token found. Set ${TOKEN_ENV_VAR} env var or run: ol auth login`, [`Set ${TOKEN_ENV_VAR} or run: ol auth login`], 'info');
+        this.name = 'NoTokenError';
+    }
+}
+/**
+ * Module-level token-store singleton. Built lazily on first call; reused
+ * across every `apiRequest` so the request hot path doesn't reconstruct
+ * the keyring + user-record adapters per POST.
+ */
+let storeSingleton;
+function tokenStore() {
+    if (!storeSingleton)
+        storeSingleton = createOutlineTokenStore();
+    return storeSingleton;
+}
+let providerSingleton;
+function authProvider() {
+    if (!providerSingleton)
+        providerSingleton = createOutlineAuthProvider();
+    return providerSingleton;
+}
+// Caller-provided O_EXCL lock so concurrent `ol` invocations don't issue
+// parallel refresh grants. Resolved per-call (not cached) to honour test
+// config-path mocking, mirroring `getConfigPath`.
+function refreshLockPath() {
+    return `${getConfigPath()}.refresh.lock`;
+}
+/**
+ * Best-effort proactive rotation before a request. Returns the token to use
+ * (the rotated one, or the current one if no rotation was needed) so the
+ * caller doesn't re-read the store; `undefined` when the default account
+ * isn't refreshable (no refresh token / env / failure) — the caller then
+ * falls back to `getApiToken()` and the 401 path stays authoritative.
+ */
+export async function proactiveRefresh() {
+    try {
+        const { bundle } = await refreshAccessToken({
+            store: tokenStore(),
+            provider: authProvider(),
+            lockPath: refreshLockPath(),
+        });
+        return bundle.accessToken;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Refresh the *selected* account (not the default) for `auth status`, returning
+ * its current-or-rotated token. Scoped via the account's id + base URL/client
+ * id through the refresh handshake, so `--user <other>` checks and rotates the
+ * right account at the right instance. Env / legacy / record-less accounts
+ * aren't refreshable — the snapshot `fallback` token is returned as-is.
+ */
+export async function refreshedTokenForStatus(account, fallback) {
+    if (process.env[TOKEN_ENV_VAR]?.trim() || !account.id)
+        return fallback;
+    try {
+        const { bundle } = await refreshAccessToken({
+            store: tokenStore(),
+            provider: authProvider(),
+            lockPath: refreshLockPath(),
+            ref: account.id,
+            handshake: { baseUrl: account.baseUrl, clientId: account.oauthClientId },
+        });
+        return bundle.accessToken;
+    }
+    catch {
+        return fallback;
+    }
+}
+/**
+ * Reactive rotation after a 401. Returns `true` when the token rotated (the
+ * caller retries once). A rejected/absent refresh token surfaces as
+ * `NoTokenError` (re-login); a transient failure propagates unchanged.
+ */
+export async function reactiveRefresh() {
+    try {
+        const result = await refreshAccessToken({
+            store: tokenStore(),
+            provider: authProvider(),
+            lockPath: refreshLockPath(),
+            force: true,
+        });
+        return result.rotated;
+    }
+    catch (err) {
+        // Match on the structural `.code` rather than `instanceof`: cli-core
+        // throws its own CliError, and class identity isn't reliable across
+        // package boundaries (duplicate module instances under linking).
+        const code = err?.code;
+        if (code === 'AUTH_REFRESH_EXPIRED' || code === 'AUTH_REFRESH_UNAVAILABLE') {
+            throw new NoTokenError();
+        }
+        throw err;
+    }
+}
+/**
+ * Read the active token. Hot path: when `OUTLINE_API_TOKEN` is set we
+ * return it directly without consulting the token store, since
+ * `apiRequest` already resolves the base URL separately — going through
+ * `store.active()` here would trigger a redundant `getBaseUrl()` lookup
+ * per request just to synthesise an account we don't need.
+ */
 export async function getApiToken() {
-    const envToken = process.env.OUTLINE_API_TOKEN;
+    const envToken = process.env[TOKEN_ENV_VAR]?.trim();
     if (envToken)
         return envToken;
-    const config = await getConfig();
-    if (config.api_token)
-        return config.api_token;
-    throw new Error('No API token found. Set OUTLINE_API_TOKEN env var or run: ol auth login');
+    const snapshot = await tokenStore().active();
+    if (!snapshot?.token)
+        throw new NoTokenError();
+    return snapshot.token;
 }
+/**
+ * Base URL cascade: env var → default user record (v2) → legacy
+ * `base_url` config (v1) → built-in default. The record takes priority
+ * over the legacy slot so post-migration logins keep defaulting to the
+ * same Outline instance.
+ */
 export async function getBaseUrl() {
     const envUrl = process.env.OUTLINE_URL;
     if (envUrl)
         return envUrl.replace(/\/$/, '');
     const config = await getConfig();
+    const record = getDefaultUserRecord(config);
+    if (record?.account.baseUrl)
+        return record.account.baseUrl.replace(/\/$/, '');
     if (config.base_url)
         return config.base_url.replace(/\/$/, '');
     return DEFAULT_BASE_URL;
 }
+/**
+ * OAuth client id cascade: env var → default user record (v2) → legacy
+ * `oauth_client_id` config (v1) → undefined (caller prompts).
+ */
 export async function getOAuthClientId() {
     const envClientId = process.env.OUTLINE_OAUTH_CLIENT_ID;
     if (envClientId)
         return envClientId;
     const config = await getConfig();
+    const record = getDefaultUserRecord(config);
+    if (record?.account.oauthClientId)
+        return record.account.oauthClientId;
     return config.oauth_client_id;
 }
-export async function getTokenSource() {
-    if (process.env.OUTLINE_API_TOKEN)
-        return 'env';
-    const config = await getConfig();
-    if (config.api_token)
-        return 'config';
-    return null;
-}
-/**
- * Clear the auth-related keys without deleting the file. The config is now
- * shared with non-auth settings (notably `update_channel`); a blanket unlink
- * would silently reset the user's update-channel preference too.
- *
- * Pass `existing` to skip the read when the caller has already loaded the
- * config (e.g. ref-validated logout) — keeps that flow at one read + one
- * write instead of two reads.
- */
-export async function clearConfig(existing) {
-    const config = existing ?? (await getConfig());
-    const { api_token, base_url, oauth_client_id, auth_user_id, auth_user_name, auth_team_name, ...rest } = config;
-    void api_token;
-    void base_url;
-    void oauth_client_id;
-    void auth_user_id;
-    void auth_user_name;
-    void auth_team_name;
-    await setConfig(rest);
-}
 //# sourceMappingURL=auth.js.map

package/dist/lib/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAE/D,MAAM,gBAAgB,GAAG,4BAA4B,CAAA;AAErD,MAAM,CAAC,KAAK,UAAU,WAAW;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAA;IAC9C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAE7B,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,IAAI,MAAM,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC,SAAS,CAAA;IAE7C,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAA;AAC9F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAA;IACtC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAE5C,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAE9D,OAAO,gBAAgB,CAAA;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB;IAClC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAA;IACvD,IAAI,WAAW;QAAE,OAAO,WAAW,CAAA;IAEnC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,OAAO,MAAM,CAAC,eAAe,CAAA;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAChC,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAAE,OAAO,KAAK,CAAA;IAC/C,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,IAAI,MAAM,CAAC,SAAS;QAAE,OAAO,QAAQ,CAAA;IACrC,OAAO,IAAI,CAAA;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAA0B;IACxD,MAAM,MAAM,GAAG,QAAQ,IAAI,CAAC,MAAM,SAAS,EAAE,CAAC,CAAA;IAC9C,MAAM,EACF,SAAS,EACT,QAAQ,EACR,eAAe,EACf,YAAY,EACZ,cAAc,EACd,cAAc,EACd,GAAG,IAAI,EACV,GAAG,MAAM,CAAA;IACV,KAAK,SAAS,CAAA;IACd,KAAK,QAAQ,CAAA;IACb,KAAK,eAAe,CAAA;IACpB,KAAK,YAAY,CAAA;IACjB,KAAK,cAAc,CAAA;IACnB,KAAK,cAAc,CAAA;IACnB,MAAM,SAAS,CAAC,IAAc,CAAC,CAAA;AACnC,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAA;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EACH,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,GAEvB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,EAAE,gBAAgB,EAAuB,MAAM,sBAAsB,CAAA;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAExD,OAAO,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,aAAa,EAAE,CAAA;AAE3E,MAAM,OAAO,YAAa,SAAQ,QAAQ;IACtC;QACI,KAAK,CACD,UAAU,EACV,2BAA2B,aAAa,gCAAgC,EACxE,CAAC,OAAO,aAAa,wBAAwB,CAAC,EAC9C,MAAM,CACT,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,cAAc,CAAA;IAC9B,CAAC;CACJ;AAED;;;;GAIG;AACH,IAAI,cAA6C,CAAA;AACjD,SAAS,UAAU;IACf,IAAI,CAAC,cAAc;QAAE,cAAc,GAAG,uBAAuB,EAAE,CAAA;IAC/D,OAAO,cAAc,CAAA;AACzB,CAAC;AAED,IAAI,iBAA2E,CAAA;AAC/E,SAAS,YAAY;IACjB,IAAI,CAAC,iBAAiB;QAAE,iBAAiB,GAAG,yBAAyB,EAAE,CAAA;IACvE,OAAO,iBAAiB,CAAA;AAC5B,CAAC;AAED,yEAAyE;AACzE,yEAAyE;AACzE,kDAAkD;AAClD,SAAS,eAAe;IACpB,OAAO,GAAG,aAAa,EAAE,eAAe,CAAA;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IAClC,IAAI,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC;YACxC,KAAK,EAAE,UAAU,EAAE;YACnB,QAAQ,EAAE,YAAY,EAAE;YACxB,QAAQ,EAAE,eAAe,EAAE;SAC9B,CAAC,CAAA;QACF,OAAO,MAAM,CAAC,WAAW,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,SAAS,CAAA;IACpB,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CACzC,OAAuB,EACvB,QAAgB;IAEhB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAA;IACtE,IAAI,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC;YACxC,KAAK,EAAE,UAAU,EAAE;YACnB,QAAQ,EAAE,YAAY,EAAE;YACxB,QAAQ,EAAE,eAAe,EAAE;YAC3B,GAAG,EAAE,OAAO,CAAC,EAAE;YACf,SAAS,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,aAAa,EAAE;SAC3E,CAAC,CAAA;QACF,OAAO,MAAM,CAAC,WAAW,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,QAAQ,CAAA;IACnB,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACjC,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;YACpC,KAAK,EAAE,UAAU,EAAE;YACnB,QAAQ,EAAE,YAAY,EAAE;YACxB,QAAQ,EAAE,eAAe,EAAE;YAC3B,KAAK,EAAE,IAAI;SACd,CAAC,CAAA;QACF,OAAO,MAAM,CAAC,OAAO,CAAA;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,qEAAqE;QACrE,oEAAoE;QACpE,iEAAiE;QACjE,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAA;QACrD,IAAI,IAAI,KAAK,sBAAsB,IAAI,IAAI,KAAK,0BAA0B,EAAE,CAAC;YACzE,MAAM,IAAI,YAAY,EAAE,CAAA;QAC5B,CAAC;QACD,MAAM,GAAG,CAAA;IACb,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAA;IACnD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,QAAQ,GAAG,MAAM,UAAU,EAAE,CAAC,MAAM,EAAE,CAAA;IAC5C,IAAI,CAAC,QAAQ,EAAE,KAAK;QAAE,MAAM,IAAI,YAAY,EAAE,CAAA;IAC9C,OAAO,QAAQ,CAAC,KAAK,CAAA;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAA;IACtC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAE5C,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,MAAM,EAAE,OAAO,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC7E,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC9D,OAAO,gBAAgB,CAAA;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IAClC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAA;IACvD,IAAI,WAAW;QAAE,OAAO,WAAW,CAAA;IAEnC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,MAAM,EAAE,OAAO,CAAC,aAAa;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;IACtE,OAAO,MAAM,CAAC,eAAe,CAAA;AACjC,CAAC"}

package/dist/lib/config.d.ts

@@ -1,5 +1,32 @@
 import { type CoreConfig } from '@doist/cli-core';
+/**
+ * One row of the `users[]` array. `id` is the Outline user UUID. `token` is
+ * a plaintext fallback persisted only when the OS keyring is unavailable at
+ * write time (WSL, headless Linux, missing native binary).
+ */
+export type StoredUser = {
+    id: string;
+    name: string;
+    base_url?: string;
+    oauth_client_id?: string;
+    team_name?: string;
+    /** Plaintext access-token fallback, present only when the keyring was unavailable at write time. */
+    token?: string;
+    /** Access-token expiry (unix-epoch ms); drives proactive refresh. */
+    access_token_expires_at?: number;
+    /** Refresh-token expiry (unix-epoch ms), when the server returns one. */
+    refresh_token_expires_at?: number;
+    /** Whether a refresh token is stored (keyring slot or `refresh_token`). */
+    has_refresh_token?: boolean;
+};
 export type Config = CoreConfig & {
+    config_version?: number;
+    users?: StoredUser[];
+    default_user_id?: string;
+    /**
+     * Legacy v1 single-user fields. Read by the migration helper; removed
+     * from disk by `cleanupLegacyConfig` after the v2 record write succeeds.
+     */
     api_token?: string;
     base_url?: string;
     oauth_client_id?: string;

package/dist/lib/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAEH,aAAa,IAAI,iBAAiB,EAClC,UAAU,IAAI,cAAc,EAC5B,YAAY,IAAI,gBAAgB,EAChC,WAAW,IAAI,eAAe,GACjC,MAAM,iBAAiB,CAAA;AAExB,MAAM,QAAQ,GAAG,aAAa,CAAA;AAW9B;;;;GAIG;AACH,MAAM,UAAU,aAAa;IACzB,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC3B,OAAO,cAAc,CAAS,aAAa,EAAE,CAAC,CAAA;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAc;IAC1C,OAAO,eAAe,CAAC,aAAa,EAAE,EAAE,MAAM,CAAC,CAAA;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAwB;IACvD,OAAO,gBAAgB,CAAS,aAAa,EAAE,EAAE,OAAO,CAAC,CAAA;AAC7D,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAEH,aAAa,IAAI,iBAAiB,EAClC,UAAU,IAAI,cAAc,EAC5B,YAAY,IAAI,gBAAgB,EAChC,WAAW,IAAI,eAAe,GACjC,MAAM,iBAAiB,CAAA;AAExB,MAAM,QAAQ,GAAG,aAAa,CAAA;AAwC9B;;;;GAIG;AACH,MAAM,UAAU,aAAa;IACzB,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC3B,OAAO,cAAc,CAAS,aAAa,EAAE,CAAC,CAAA;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAc;IAC1C,OAAO,eAAe,CAAC,aAAa,EAAE,EAAE,MAAM,CAAC,CAAA;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAwB;IACvD,OAAO,gBAAgB,CAAS,aAAa,EAAE,EAAE,OAAO,CAAC,CAAA;AAC7D,CAAC"}

package/dist/lib/errors.d.ts

@@ -1,7 +1,7 @@
 import { CliError as CoreCliError, type CliErrorCode, type ErrorType } from '@doist/cli-core';
 export { CoreCliError as BaseCliError };
 export type { ErrorType } from '@doist/cli-core';
-export type ErrorCode = 'ACCOUNT_NOT_FOUND' | 'AUTH_VERIFICATION_FAILED' | 'CONFIRMATION_REQUIRED' | 'CONFLICTING_OPTIONS' | 'INVALID_PARENT' | 'MISSING_OPTION' | 'OAUTH_CALLBACK_PORT_INVALID' | 'OAUTH_CALLBACK_SERVER_FAILED' | 'OAUTH_CLIENT_ID_REQUIRED' | 'OAUTH_LOGIN_FAILED' | 'UNKNOWN_AGENT';
+export type ErrorCode = 'ACCOUNT_NOT_FOUND' | 'AUTH_VERIFICATION_FAILED' | 'CONFIRMATION_REQUIRED' | 'CONFLICTING_OPTIONS' | 'INVALID_PARENT' | 'MISSING_OPTION' | 'NO_TOKEN' | 'OAUTH_CALLBACK_PORT_INVALID' | 'OAUTH_CALLBACK_SERVER_FAILED' | 'OAUTH_CLIENT_ID_REQUIRED' | 'OAUTH_LOGIN_FAILED' | 'UNKNOWN_AGENT';
 export declare class CliError extends CoreCliError<ErrorCode> {
     constructor(code: ErrorCode | CliErrorCode, message: string, hints?: string[], type?: ErrorType);
 }

package/dist/lib/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAqC,MAAM,iBAAiB,CAAA;AAE7F,OAAO,EAAE,YAAY,IAAI,YAAY,EAAE,CAAA;AAgBvC,MAAM,OAAO,QAAS,SAAQ,YAAuB;IACjD,YACI,IAA8B,EAC9B,OAAe,EACf,KAAgB,EAChB,OAAkB,OAAO;QAEzB,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACzC,CAAC;CACJ;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAqC,MAAM,iBAAiB,CAAA;AAE7F,OAAO,EAAE,YAAY,IAAI,YAAY,EAAE,CAAA;AAiBvC,MAAM,OAAO,QAAS,SAAQ,YAAuB;IACjD,YACI,IAA8B,EAC9B,OAAe,EACf,KAAgB,EAChB,OAAkB,OAAO;QAEzB,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACzC,CAAC;CACJ;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/lib/migrate-auth.d.ts

@@ -0,0 +1,11 @@
+import { type MigrateAuthResult } from '@doist/cli-core/auth';
+import { type OutlineAccount } from './outline-account.js';
+/**
+ * One-time migration of v1 plaintext auth state into the v2 `users[]`
+ * shape. Called lazily by `createOutlineTokenStore` on first store access.
+ * Idempotent via the `config_version` marker — once set to `>= 2`, this
+ * helper short-circuits with `already-migrated`.
+ */
+export declare function runMigrateLegacyAuth(options?: {
+    silent: boolean;
+}): Promise<MigrateAuthResult<OutlineAccount>>;

package/dist/lib/migrate-auth.js

@@ -0,0 +1,92 @@
+import { migrateLegacyAuth } from '@doist/cli-core/auth';
+import { fetchWithRetry } from '../transport/fetch-with-retry.js';
+import { LEGACY_CLEAR_PAYLOAD, LEGACY_KEYRING_ACCOUNT, SECURE_STORE_SERVICE, } from './auth-constants.js';
+import { getConfig, updateConfig } from './config.js';
+import { DEFAULT_BASE_URL, makeOutlineAccount } from './outline-account.js';
+import { createOutlineUserRecordStore } from './user-records.js';
+/**
+ * Pinned to this migration's target schema. Decoupled from any future
+ * `config_version` bump so this helper doesn't re-run for users already
+ * on v2 or beyond.
+ */
+const V2_SCHEMA_VERSION = 2;
+/**
+ * Cap migration's `auth.info` lookup so a stalled connection can't hang
+ * the CLI indefinitely on first command. cli-core treats the resulting
+ * timeout as `identify-failed`, falling back to the legacy snapshot.
+ */
+const IDENTIFY_TIMEOUT_MS = 10_000;
+/**
+ * Direct `auth.info` call used only by the migration path. We bypass
+ * `apiRequest` (and its spinner + `getApiToken`/`getBaseUrl` cascade) so
+ * this module stays out of the runtime auth/token-store import graph and
+ * so the silent migration doesn't render a spinner during postinstall-style
+ * invocations.
+ */
+async function identifyOutlineAccount(token) {
+    const config = await getConfig();
+    const baseUrl = (config.base_url ?? DEFAULT_BASE_URL).replace(/\/$/, '');
+    const res = await fetchWithRetry({
+        url: `${baseUrl}/api/auth.info`,
+        options: {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${token}`,
+            },
+            body: JSON.stringify({}),
+            timeout: IDENTIFY_TIMEOUT_MS,
+        },
+    });
+    if (!res.ok) {
+        throw new Error(`auth.info failed: ${res.status} ${res.statusText}`);
+    }
+    const json = await res.json();
+    return makeOutlineAccount({
+        id: json.data.user.id,
+        label: json.data.user.name,
+        baseUrl,
+        oauthClientId: config.oauth_client_id ?? '',
+        teamName: json.data.team.name,
+    });
+}
+/**
+ * One-time migration of v1 plaintext auth state into the v2 `users[]`
+ * shape. Called lazily by `createOutlineTokenStore` on first store access.
+ * Idempotent via the `config_version` marker — once set to `>= 2`, this
+ * helper short-circuits with `already-migrated`.
+ */
+export async function runMigrateLegacyAuth(options = { silent: true }) {
+    return migrateLegacyAuth({
+        serviceName: SECURE_STORE_SERVICE,
+        legacyAccount: LEGACY_KEYRING_ACCOUNT,
+        userRecords: createOutlineUserRecordStore(),
+        hasMigrated: async () => {
+            const config = await getConfig();
+            // Two signals of "already on v2": the explicit marker, or
+            // the structural presence of `users[]` (a fresh install that
+            // logged in directly via cli-core writes records without ever
+            // setting `config_version`, so the marker alone would
+            // miscount that case as "needs migration").
+            if ((config.config_version ?? 0) >= V2_SCHEMA_VERSION)
+                return true;
+            if ((config.users ?? []).length > 0)
+                return true;
+            return false;
+        },
+        markMigrated: async () => {
+            await updateConfig({ config_version: V2_SCHEMA_VERSION });
+        },
+        loadLegacyPlaintextToken: async () => {
+            const config = await getConfig();
+            return config.api_token?.trim() || null;
+        },
+        identifyAccount: identifyOutlineAccount,
+        cleanupLegacyConfig: async () => {
+            await updateConfig(LEGACY_CLEAR_PAYLOAD);
+        },
+        silent: options.silent,
+        logPrefix: 'outline-cli',
+    });
+}
+//# sourceMappingURL=migrate-auth.js.map

package/dist/lib/migrate-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-auth.js","sourceRoot":"","sources":["../../src/lib/migrate-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACjE,OAAO,EACH,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,GACvB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAuB,MAAM,sBAAsB,CAAA;AAChG,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAA;AAEhE;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAA;AAE3B;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,MAAM,CAAA;AASlC;;;;;;GAMG;AACH,KAAK,UAAU,sBAAsB,CAAC,KAAa;IAC/C,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACxE,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC;QAC7B,GAAG,EAAE,GAAG,OAAO,gBAAgB;QAC/B,OAAO,EAAE;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACL,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,EAAE;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,mBAAmB;SAC/B;KACJ,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;IACxE,CAAC;IACD,MAAM,IAAI,GAAqB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IAC/C,OAAO,kBAAkB,CAAC;QACtB,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACrB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QAC1B,OAAO;QACP,aAAa,EAAE,MAAM,CAAC,eAAe,IAAI,EAAE;QAC3C,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;KAChC,CAAC,CAAA;AACN,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACtC,UAA+B,EAAE,MAAM,EAAE,IAAI,EAAE;IAE/C,OAAO,iBAAiB,CAAiB;QACrC,WAAW,EAAE,oBAAoB;QACjC,aAAa,EAAE,sBAAsB;QACrC,WAAW,EAAE,4BAA4B,EAAE;QAC3C,WAAW,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;YAChC,0DAA0D;YAC1D,6DAA6D;YAC7D,8DAA8D;YAC9D,sDAAsD;YACtD,4CAA4C;YAC5C,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC,IAAI,iBAAiB;gBAAE,OAAO,IAAI,CAAA;YAClE,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;YAChD,OAAO,KAAK,CAAA;QAChB,CAAC;QACD,YAAY,EAAE,KAAK,IAAI,EAAE;YACrB,MAAM,YAAY,CAAC,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC,CAAA;QAC7D,CAAC;QACD,wBAAwB,EAAE,KAAK,IAAI,EAAE;YACjC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;YAChC,OAAO,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,IAAI,CAAA;QAC3C,CAAC;QACD,eAAe,EAAE,sBAAsB;QACvC,mBAAmB,EAAE,KAAK,IAAI,EAAE;YAC5B,MAAM,YAAY,CAAC,oBAAoB,CAAC,CAAA;QAC5C,CAAC;QACD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,aAAa;KAC3B,CAAC,CAAA;AACN,CAAC"}

package/dist/lib/outline-account.d.ts

@@ -0,0 +1,26 @@
+import type { AuthAccount } from '@doist/cli-core/auth';
+/**
+ * Narrow account shape persisted by the keyring-backed token store.
+ *
+ * `id` is the Outline user UUID; `label` is the user's display name.
+ * `baseUrl` and `oauthClientId` ride along on the account because Outline
+ * is self-hostable — every persisted token is tied to the instance it was
+ * issued for, not to a global default. `teamName` is rendered by
+ * `ol auth status`; it's the only field we cache for display.
+ */
+export type OutlineAccount = AuthAccount & {
+    id: string;
+    label: string;
+    baseUrl: string;
+    oauthClientId: string;
+    teamName?: string;
+};
+export declare const DEFAULT_BASE_URL = "https://app.getoutline.com";
+/** Canonical `OutlineAccount` factory. Applies the `baseUrl` default. */
+export declare function makeOutlineAccount(input: {
+    id: string;
+    label: string;
+    baseUrl?: string;
+    oauthClientId?: string;
+    teamName?: string;
+}): OutlineAccount;

package/dist/lib/outline-account.js

@@ -0,0 +1,12 @@
+export const DEFAULT_BASE_URL = 'https://app.getoutline.com';
+/** Canonical `OutlineAccount` factory. Applies the `baseUrl` default. */
+export function makeOutlineAccount(input) {
+    return {
+        id: input.id,
+        label: input.label,
+        baseUrl: input.baseUrl ?? DEFAULT_BASE_URL,
+        oauthClientId: input.oauthClientId ?? '',
+        teamName: input.teamName,
+    };
+}
+//# sourceMappingURL=outline-account.js.map

package/dist/lib/outline-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outline-account.js","sourceRoot":"","sources":["../../src/lib/outline-account.ts"],"names":[],"mappings":"AAmBA,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAA;AAE5D,yEAAyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,KAMlC;IACG,OAAO;QACH,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,gBAAgB;QAC1C,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE;QACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ;KAC3B,CAAA;AACL,CAAC"}

package/dist/lib/skills/content.d.ts

@@ -1,3 +1,3 @@
 export declare const SKILL_NAME = "outline-cli";
 export declare const SKILL_DESCRIPTION = "Search and manage Outline wiki documents and collections via the ol CLI";
-export declare const SKILL_CONTENT = "# Outline CLI (ol)\n\nUse this skill when the user wants to interact with their Outline wiki/knowledge base.\n\n## Quick Reference\n\n- `ol search \"query\"` - Search documents\n- `ol doc list` - List documents\n- `ol doc get <id>` - Read a document\n- `ol doc open <id>` - Open document in browser\n- `ol doc create --title \"Title\" --collection <id>` - Create document\n- `ol col list` - List collections\n\n## Output Formats\n\nAll list commands support:\n- `--json` - JSON output (essential fields)\n- `--ndjson` - Newline-delimited JSON (streaming)\n- `--full` - Include all fields in JSON\n\n## Document References\n\nDocuments can be referenced by:\n- URL ID (the slug suffix after the last hyphen)\n- Full Outline URL (auto-extracted)\n- Document ID\n\n## Commands\n\n### Search\n```bash\nol search \"query\"\nol search \"query\" --limit 10\nol search \"query\" --collection <id>\nol search \"query\" --status published\nol search \"query\" --json\n```\n\n### Documents\n```bash\nol doc list --collection <id> --limit 25\nol doc list --sort title --direction ASC\nol doc get <id>                           # Rendered markdown\nol doc get <id> --raw                     # Raw markdown\nol doc get <id> --json\nol doc open <id>                          # Open in browser\nol doc create --title \"Title\" --collection <id> --text \"# Content\"\nol doc create --title \"Title\" --parent <ref> --text \"# Content\"  # Nest under parent (collection inferred)\nol doc create --title \"Title\" --collection <id> --file ./doc.md\nol doc update <id> --title \"New Title\"\nol doc update <id> --file ./updated.md\nol doc move <id> --collection <target-id>           # Move to collection root\nol doc move <id> --parent <ref>                    # Nest under parent (collection inferred)\nol doc archive <id>\nol doc unarchive <id>\nol doc delete <id> --confirm\n```\n\n### Collections\n```bash\nol col list\nol col get <id>\nol col create --name \"Name\" --description \"Desc\" --color \"#hex\"\nol col create --name \"Private\" --private\nol col update <id> --name \"New Name\"\nol col delete <id> --confirm\n```\n\n### Authentication\n```bash\nol auth login                          # OAuth login (opens browser); prompts for base URL + client ID if needed\nol auth login --base-url <url>         # Specify Outline base URL for this login (saved for future use)\nol auth login --client-id <id>         # Specify OAuth client ID for this login (saved for future use)\nol auth login --callback-port <port>   # Override local OAuth callback port\nol auth login --read-only              # Request read-only scopes (where supported by the Outline instance)\nol auth login --json | --ndjson        # Machine-readable success envelope\nol auth status                         # Show current auth state\nol auth logout                         # Clear saved credentials\n```\n\n### Update & Changelog\n```bash\nol update                        # Update CLI to latest version\nol update --check                # Check for updates without installing, show channel\nol update --check --json         # Check for updates as a JSON envelope\nol update --check --ndjson       # Check for updates as NDJSON output\nol update --channel              # Show current update channel\nol update switch --stable        # Switch to stable release channel\nol update switch --pre-release   # Switch to pre-release (next) channel\nol changelog                     # Show recent changelog entries\nol changelog -n 3                # Show last 3 versions\n```\n\n## Examples\n\n### Find and read a document\n```bash\nol search \"onboarding\" --json | jq '.[0].document.urlId'\nol doc get <urlId>\n```\n\n### Create a document from a file\n```bash\nol doc create --title \"Meeting Notes\" --collection <id> --file ./notes.md --publish\n```\n\n### List all collections and their documents\n```bash\nol col list --json\nol doc list --collection <id> --sort title --direction ASC\n```\n\n### Bulk export with ndjson\n```bash\nol doc list --ndjson --full | jq -r '.title'\n```\n";
+export declare const SKILL_CONTENT = "# Outline CLI (ol)\n\nUse this skill when the user wants to interact with their Outline wiki/knowledge base.\n\n## Quick Reference\n\n- `ol search \"query\"` - Search documents\n- `ol doc list` - List documents\n- `ol doc get <id>` - Read a document\n- `ol doc open <id>` - Open document in browser\n- `ol doc create --title \"Title\" --collection <id>` - Create document\n- `ol col list` - List collections\n\n## Output Formats\n\nAll list commands support:\n- `--json` - JSON output (essential fields)\n- `--ndjson` - Newline-delimited JSON (streaming)\n- `--full` - Include all fields in JSON\n\n## Document References\n\nDocuments can be referenced by:\n- URL ID (the slug suffix after the last hyphen)\n- Full Outline URL (auto-extracted)\n- Document ID\n\n## Commands\n\n### Search\n```bash\nol search \"query\"\nol search \"query\" --limit 10\nol search \"query\" --collection <id>\nol search \"query\" --status published\nol search \"query\" --json\n```\n\n### Documents\n```bash\nol doc list --collection <id> --limit 25\nol doc list --sort title --direction ASC\nol doc get <id>                           # Rendered markdown\nol doc get <id> --raw                     # Raw markdown\nol doc get <id> --json\nol doc open <id>                          # Open in browser\nol doc create --title \"Title\" --collection <id> --text \"# Content\"\nol doc create --title \"Title\" --parent <ref> --text \"# Content\"  # Nest under parent (collection inferred)\nol doc create --title \"Title\" --collection <id> --file ./doc.md\nol doc update <id> --title \"New Title\"\nol doc update <id> --file ./updated.md\nol doc move <id> --collection <target-id>           # Move to collection root\nol doc move <id> --parent <ref>                    # Nest under parent (collection inferred)\nol doc archive <id>\nol doc unarchive <id>\nol doc delete <id> --confirm\n```\n\n### Collections\n```bash\nol col list\nol col get <id>\nol col create --name \"Name\" --description \"Desc\" --color \"#hex\"\nol col create --name \"Private\" --private\nol col update <id> --name \"New Name\"\nol col delete <id> --confirm\n```\n\n### Authentication\n```bash\nol auth login                          # OAuth login (opens browser); prompts for base URL + client ID if needed\nol auth login --base-url <url>         # Specify Outline base URL for this login (saved for future use)\nol auth login --client-id <id>         # Specify OAuth client ID for this login (saved for future use)\nol auth login --callback-port <port>   # Override local OAuth callback port\nol auth login --read-only              # Request read-only scopes (where supported by the Outline instance)\nol auth login --json | --ndjson        # Machine-readable success envelope\nol auth status                         # Show current auth state\nol auth status --json | --ndjson       # Machine-readable status envelope ({id, team, baseUrl, source})\nol auth logout                         # Clear saved credentials\nol auth logout --json | --ndjson       # Machine-readable logout envelope ({ok: true}; --ndjson is silent)\n```\n\n### Update & Changelog\n```bash\nol update                        # Update CLI to latest version\nol update --check                # Check for updates without installing, show channel\nol update --check --json         # Check for updates as a JSON envelope\nol update --check --ndjson       # Check for updates as NDJSON output\nol update --channel              # Show current update channel\nol update switch --stable        # Switch to stable release channel\nol update switch --pre-release   # Switch to pre-release (next) channel\nol changelog                     # Show recent changelog entries\nol changelog -n 3                # Show last 3 versions\n```\n\n## Examples\n\n### Find and read a document\n```bash\nol search \"onboarding\" --json | jq '.[0].document.urlId'\nol doc get <urlId>\n```\n\n### Create a document from a file\n```bash\nol doc create --title \"Meeting Notes\" --collection <id> --file ./notes.md --publish\n```\n\n### List all collections and their documents\n```bash\nol col list --json\nol doc list --collection <id> --sort title --direction ASC\n```\n\n### Bulk export with ndjson\n```bash\nol doc list --ndjson --full | jq -r '.title'\n```\n";

package/dist/lib/skills/content.js

@@ -77,7 +77,9 @@ ol auth login --callback-port <port>   # Override local OAuth callback port
 ol auth login --read-only              # Request read-only scopes (where supported by the Outline instance)
 ol auth login --json | --ndjson        # Machine-readable success envelope
 ol auth status                         # Show current auth state
+ol auth status --json | --ndjson       # Machine-readable status envelope ({id, team, baseUrl, source})
 ol auth logout                         # Clear saved credentials
+ol auth logout --json | --ndjson       # Machine-readable logout envelope ({ok: true}; --ndjson is silent)
 \`\`\`
 
 ### Update & Changelog

package/dist/lib/skills/content.js.map

@@ -1 +1 @@
-{"version":3,"file":"content.js","sourceRoot":"","sources":["../../../src/lib/skills/content.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CAAA;AACvC,MAAM,CAAC,MAAM,iBAAiB,GAC1B,yEAAyE,CAAA;AAE7E,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoH5B,CAAA"}
+{"version":3,"file":"content.js","sourceRoot":"","sources":["../../../src/lib/skills/content.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CAAA;AACvC,MAAM,CAAC,MAAM,iBAAiB,GAC1B,yEAAyE,CAAA;AAE7E,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsH5B,CAAA"}

package/dist/lib/user-records.d.ts

@@ -0,0 +1,14 @@
+import type { UserRecord, UserRecordStore } from '@doist/cli-core/auth';
+import { type Config } from './config.js';
+import { type OutlineAccount } from './outline-account.js';
+/**
+ * `UserRecordStore` adapter over `config.users[]`. `StoredUser.token` is
+ * surfaced as `fallbackToken` — cli-core's name for the plaintext copy
+ * persisted only when the keyring is unreachable.
+ */
+export declare function createOutlineUserRecordStore(): UserRecordStore<OutlineAccount>;
+/**
+ * Resolve the default-or-first `UserRecord` from an already-loaded config.
+ * Returns `null` when no users are stored.
+ */
+export declare function getDefaultUserRecord(config: Partial<Config>): UserRecord<OutlineAccount> | null;

package/dist/lib/user-records.js

@@ -0,0 +1,110 @@
+import { getConfig, updateConfig } from './config.js';
+import { makeOutlineAccount } from './outline-account.js';
+/**
+ * `UserRecordStore` adapter over `config.users[]`. `StoredUser.token` is
+ * surfaced as `fallbackToken` — cli-core's name for the plaintext copy
+ * persisted only when the keyring is unreachable.
+ */
+export function createOutlineUserRecordStore() {
+    return {
+        async list() {
+            const config = await getConfig();
+            return (config.users ?? []).map(toRecord);
+        },
+        async upsert(record) {
+            const config = await getConfig();
+            const existing = config.users ?? [];
+            const next = fromRecord(record);
+            const index = existing.findIndex((u) => u.id === record.account.id);
+            const users = index >= 0
+                ? [...existing.slice(0, index), next, ...existing.slice(index + 1)]
+                : [...existing, next];
+            await updateConfig({ users });
+        },
+        async remove(id) {
+            const config = await getConfig();
+            const existing = config.users ?? [];
+            const index = existing.findIndex((u) => u.id === id);
+            if (index < 0)
+                return;
+            const users = [...existing.slice(0, index), ...existing.slice(index + 1)];
+            const updates = { users };
+            if (config.default_user_id === id)
+                updates.default_user_id = undefined;
+            await updateConfig(updates);
+        },
+        async getDefaultId() {
+            const config = await getConfig();
+            return config.default_user_id ?? null;
+        },
+        async setDefaultId(id) {
+            await updateConfig({ default_user_id: id ?? undefined });
+        },
+    };
+}
+/**
+ * Resolve the default-or-first `UserRecord` from an already-loaded config.
+ * Returns `null` when no users are stored.
+ */
+export function getDefaultUserRecord(config) {
+    const users = config.users ?? [];
+    if (users.length === 0)
+        return null;
+    const defaultId = config.default_user_id;
+    const user = (defaultId && users.find((u) => u.id === defaultId)) || users[0];
+    return toRecord(user);
+}
+function toRecord(user) {
+    const account = makeOutlineAccount({
+        id: user.id,
+        label: user.name,
+        baseUrl: user.base_url,
+        oauthClientId: user.oauth_client_id,
+        teamName: user.team_name,
+    });
+    const record = { account };
+    const token = user.token?.trim();
+    if (token)
+        record.fallbackToken = token;
+    if (user.access_token_expires_at !== undefined) {
+        record.accessTokenExpiresAt = user.access_token_expires_at;
+    }
+    if (user.refresh_token_expires_at !== undefined) {
+        record.refreshTokenExpiresAt = user.refresh_token_expires_at;
+    }
+    if (user.has_refresh_token !== undefined)
+        record.hasRefreshToken = user.has_refresh_token;
+    return record;
+}
+function fromRecord(record) {
+    // Replace, don't merge: absent fields strip the corresponding slots so a
+    // stale value can't shadow a fresh keyring-backed write. cli-core contract.
+    const next = {
+        id: record.account.id,
+        name: record.account.label,
+    };
+    if (record.account.baseUrl)
+        next.base_url = record.account.baseUrl;
+    if (record.account.oauthClientId)
+        next.oauth_client_id = record.account.oauthClientId;
+    if (record.account.teamName)
+        next.team_name = record.account.teamName;
+    const token = record.fallbackToken?.trim();
+    if (token)
+        next.token = token;
+    // Deliberately NOT persisting `fallbackRefreshToken`: the refresh token is
+    // a long-lived credential and must stay in the secure store only. If the
+    // keyring is offline at write time, the refresh token isn't persisted, so
+    // that account fails closed (re-auth on next expiry) rather than leaving a
+    // long-lived secret in plaintext config. (Doist secrets-management standard.)
+    if (record.accessTokenExpiresAt !== undefined) {
+        next.access_token_expires_at = record.accessTokenExpiresAt;
+    }
+    if (record.refreshTokenExpiresAt !== undefined) {
+        next.refresh_token_expires_at = record.refreshTokenExpiresAt;
+    }
+    if (record.hasRefreshToken !== undefined)
+        next.has_refresh_token = record.hasRefreshToken;
+    return next;
+}
+//# sourceMappingURL=user-records.js.map

package/dist/lib/user-records.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-records.js","sourceRoot":"","sources":["../../src/lib/user-records.ts"],"names":[],"mappings":"AACA,OAAO,EAAe,SAAS,EAAmB,YAAY,EAAE,MAAM,aAAa,CAAA;AACnF,OAAO,EAAE,kBAAkB,EAAuB,MAAM,sBAAsB,CAAA;AAE9E;;;;GAIG;AACH,MAAM,UAAU,4BAA4B;IACxC,OAAO;QACH,KAAK,CAAC,IAAI;YACN,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;YAChC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC7C,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM;YACf,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;YAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAA;YACnC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;YAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YACnE,MAAM,KAAK,GACP,KAAK,IAAI,CAAC;gBACN,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBACnE,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,CAAC,CAAA;YAC7B,MAAM,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QACjC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,EAAE;YACX,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;YAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAA;YACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;YACpD,IAAI,KAAK,GAAG,CAAC;gBAAE,OAAM;YACrB,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;YACzE,MAAM,OAAO,GAAyD,EAAE,KAAK,EAAE,CAAA;YAC/E,IAAI,MAAM,CAAC,eAAe,KAAK,EAAE;gBAAE,OAAO,CAAC,eAAe,GAAG,SAAS,CAAA;YACtE,MAAM,YAAY,CAAC,OAAO,CAAC,CAAA;QAC/B,CAAC;QACD,KAAK,CAAC,YAAY;YACd,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;YAChC,OAAO,MAAM,CAAC,eAAe,IAAI,IAAI,CAAA;QACzC,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,EAAE;YACjB,MAAM,YAAY,CAAC,EAAE,eAAe,EAAE,EAAE,IAAI,SAAS,EAAE,CAAC,CAAA;QAC5D,CAAC;KACJ,CAAA;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAuB;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAA;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAA;IACxC,MAAM,IAAI,GAAG,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAA;IAC7E,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAgB;IAC9B,MAAM,OAAO,GAAG,kBAAkB,CAAC;QAC/B,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,IAAI;QAChB,OAAO,EAAE,IAAI,CAAC,QAAQ;QACtB,aAAa,EAAE,IAAI,CAAC,eAAe;QACnC,QAAQ,EAAE,IAAI,CAAC,SAAS;KAC3B,CAAC,CAAA;IACF,MAAM,MAAM,GAA+B,EAAE,OAAO,EAAE,CAAA;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAA;IAChC,IAAI,KAAK;QAAE,MAAM,CAAC,aAAa,GAAG,KAAK,CAAA;IACvC,IAAI,IAAI,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,CAAC,oBAAoB,GAAG,IAAI,CAAC,uBAAuB,CAAA;IAC9D,CAAC;IACD,IAAI,IAAI,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;QAC9C,MAAM,CAAC,qBAAqB,GAAG,IAAI,CAAC,wBAAwB,CAAA;IAChE,CAAC;IACD,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS;QAAE,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAA;IACzF,OAAO,MAAM,CAAA;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,MAAkC;IAClD,yEAAyE;IACzE,4EAA4E;IAC5E,MAAM,IAAI,GAAe;QACrB,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;QACrB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;KAC7B,CAAA;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO;QAAE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAA;IAClE,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa;QAAE,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;IACrF,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAA;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,CAAA;IAC1C,IAAI,KAAK;QAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IAC7B,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,8EAA8E;IAC9E,IAAI,MAAM,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;QAC5C,IAAI,CAAC,uBAAuB,GAAG,MAAM,CAAC,oBAAoB,CAAA;IAC9D,CAAC;IACD,IAAI,MAAM,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;QAC7C,IAAI,CAAC,wBAAwB,GAAG,MAAM,CAAC,qBAAqB,CAAA;IAChE,CAAC;IACD,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS;QAAE,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,eAAe,CAAA;IACzF,OAAO,IAAI,CAAA;AACf,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@doist/outline-cli",
-	"version": "1.6.0",
+	"version": "1.8.0",
 	"description": "CLI for the Outline wiki/knowledge base API",
 	"type": "module",
 	"bin": {
@@ -48,11 +48,12 @@
 		"node": ">=20.18.1"
 	},
 	"dependencies": {
-		"@doist/cli-core": "0.12.0",
+		"@doist/cli-core": "0.19.0",
 		"chalk": "5.6.2",
 		"commander": "14.0.2",
 		"marked": "18.0.3",
 		"marked-terminal-renderer": "2.2.0",
+		"oauth4webapi": "3.8.6",
 		"open": "10.2.0",
 		"undici": "7.22.0"
 	},