@doist/outline-cli 1.7.0 → 1.9.0

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## [1.9.0](https://github.com/Doist/outline-cli/compare/v1.8.0...v1.9.0) (2026-05-24)
+
+### Features
+
+* **account:** account command group (cli-core attachers) ([#79](https://github.com/Doist/outline-cli/issues/79)) ([01bd6a6](https://github.com/Doist/outline-cli/commit/01bd6a60af135bbfda894b56d5a6d2b2229b70a8)), closes [#77](https://github.com/Doist/outline-cli/issues/77)
+
+## [1.8.0](https://github.com/Doist/outline-cli/compare/v1.7.0...v1.8.0) (2026-05-21)
+
+### Features
+
+* **auth:** silent OAuth token refresh ([#75](https://github.com/Doist/outline-cli/issues/75)) ([83996d5](https://github.com/Doist/outline-cli/commit/83996d56810e28e608d91a981fd3b313dcdeb4d3))
+
 ## [1.7.0](https://github.com/Doist/outline-cli/compare/v1.6.0...v1.7.0) (2026-05-17)
 
 ### Features

package/dist/commands/account.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerAccountCommand(program: Command): void;

package/dist/commands/account.js

@@ -0,0 +1,107 @@
+import { emitView } from '@doist/cli-core';
+import { attachAccountListCommand, attachAccountRemoveCommand, attachAccountUseCommand, } from '@doist/cli-core/auth';
+import chalk from 'chalk';
+import { TOKEN_ENV_VAR } from '../lib/auth-constants.js';
+import { logClearResult } from '../lib/auth-output.js';
+import { createOutlineTokenStore, resolveActiveAccountSource, } from '../lib/auth-provider.js';
+import { CliError } from '../lib/errors.js';
+import { getRequestedUserRef, isAccessible } from '../lib/global-args.js';
+/** `<label> (id:<id>)` with an accessibility-aware default marker. */
+function accountLine(account, isDefault) {
+    const marker = isDefault ? (isAccessible() ? ' [default]' : chalk.green(' (default)')) : '';
+    return `${account.label} ${chalk.dim(`(id:${account.id})`)}${marker}`;
+}
+/** Tidy machine projection shared by `list` and `current` — drops the OAuth client id. */
+function projectAccount(account, isDefault) {
+    return {
+        id: account.id,
+        label: account.label,
+        teamName: account.teamName,
+        baseUrl: account.baseUrl,
+        isDefault,
+    };
+}
+export function registerAccountCommand(program) {
+    const account = program.command('account').description('Manage stored CLI accounts');
+    const store = createOutlineTokenStore();
+    const list = attachAccountListCommand(account, {
+        store,
+        description: 'List stored Outline accounts',
+        renderText: ({ accounts }) => {
+            if (accounts.length === 0) {
+                return 'No stored accounts. Run `ol auth login` to add one.';
+            }
+            return accounts.map(({ account, isDefault }) => accountLine(account, isDefault));
+        },
+        renderJson: ({ account, isDefault }) => projectAccount(account, isDefault),
+    });
+    attachAccountUseCommand(account, {
+        store,
+        description: 'Set the default account (matched by Outline user id or display name)',
+    });
+    // `current` resolves the active credential's source directly (env / stored /
+    // legacy) rather than going through the generic account attacher, which only
+    // models stored accounts. `--json` / `--ndjson` emit a discriminated envelope.
+    account
+        .command('current')
+        .description('Show the active account (honours --user and OUTLINE_API_TOKEN)')
+        .option('--json', 'Emit machine-readable JSON output')
+        .option('--ndjson', 'Emit machine-readable NDJSON output')
+        .action(async (options) => {
+        const view = { json: Boolean(options.json), ndjson: Boolean(options.ndjson) };
+        const requested = getRequestedUserRef();
+        const resolution = await resolveActiveAccountSource(requested);
+        if (resolution?.source === 'stored') {
+            const { account: acc, isDefault } = resolution;
+            emitView(view, { source: 'stored', account: projectAccount(acc, isDefault) }, () => {
+                const lines = [accountLine(acc, isDefault), `  Base URL: ${acc.baseUrl}`];
+                if (acc.teamName)
+                    lines.push(`  Team: ${acc.teamName}`);
+                return lines;
+            });
+            return;
+        }
+        if (resolution?.source === 'env') {
+            emitView(view, { source: 'env' }, () => [
+                `Using ${TOKEN_ENV_VAR} environment variable (no stored account).`,
+            ]);
+            return;
+        }
+        if (resolution?.source === 'legacy') {
+            emitView(view, { source: 'legacy' }, () => [
+                'Using legacy single-user credentials. Run `ol auth login` to migrate to a stored account.',
+            ]);
+            return;
+        }
+        if (requested !== undefined) {
+            throw new CliError('ACCOUNT_NOT_FOUND', `No stored account matches "${requested}".`, ['Check the account id or display name, or run `ol auth login` to add it.']);
+        }
+        throw new CliError('NOT_AUTHENTICATED', 'Not authenticated. Run: ol auth login');
+    });
+    attachAccountRemoveCommand(account, {
+        store,
+        description: 'Remove a stored account (clears keyring + config entry)',
+        renderText: ({ account, wasDefault }) => {
+            const lines = [`${chalk.green('✓')} Removed ${account.label}`];
+            if (wasDefault) {
+                lines.push(chalk.dim('Cleared default account. Set a new one with `ol account use <id|name>`.'));
+            }
+            return lines;
+        },
+        onRemoved: ({ view }) => logClearResult(store, view.json || view.ndjson),
+    });
+    // Make bare `ol account` list. A parent action runs only when no subcommand
+    // matches, so `ol account list` still routes to the subcommand directly —
+    // this just delegates the no-subcommand case via the public API (no reliance
+    // on commander internals).
+    account.action(async () => {
+        await list.parseAsync([], { from: 'user' });
+    });
+    account.addHelpText('after', `
+Examples:
+  ol account                     # list stored accounts (default subcommand)
+  ol account current             # show the active account
+  ol account use "Ada Lovelace"  # set the default account (id or display name)
+  ol account remove id-bob       # forget an account (clears keyring + config entry)`);
+}
+//# sourceMappingURL=account.js.map

package/dist/commands/account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../../src/commands/account.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC1C,OAAO,EACH,wBAAwB,EACxB,0BAA0B,EAC1B,uBAAuB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EACH,uBAAuB,EAEvB,0BAA0B,GAC7B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAEzE,sEAAsE;AACtE,SAAS,WAAW,CAAC,OAAuB,EAAE,SAAkB;IAC5D,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3F,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE,CAAA;AACzE,CAAC;AAED,0FAA0F;AAC1F,SAAS,cAAc,CAAC,OAAuB,EAAE,SAAkB;IAC/D,OAAO;QACH,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS;KACZ,CAAA;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAAA;IACpF,MAAM,KAAK,GAAG,uBAAuB,EAAE,CAAA;IAEvC,MAAM,IAAI,GAAG,wBAAwB,CAAiB,OAAO,EAAE;QAC3D,KAAK;QACL,WAAW,EAAE,8BAA8B;QAC3C,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;YACzB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,qDAAqD,CAAA;YAChE,CAAC;YACD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAA;QACpF,CAAC;QACD,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC;KAC7E,CAAC,CAAA;IAEF,uBAAuB,CAAiB,OAAO,EAAE;QAC7C,KAAK;QACL,WAAW,EAAE,sEAAsE;KACtF,CAAC,CAAA;IAEF,6EAA6E;IAC7E,6EAA6E;IAC7E,+EAA+E;IAC/E,OAAO;SACF,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,gEAAgE,CAAC;SAC7E,MAAM,CAAC,QAAQ,EAAE,mCAAmC,CAAC;SACrD,MAAM,CAAC,UAAU,EAAE,qCAAqC,CAAC;SACzD,MAAM,CAAC,KAAK,EAAE,OAA6C,EAAE,EAAE;QAC5D,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAA;QAC7E,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAA;QACvC,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC,SAAS,CAAC,CAAA;QAC9D,IAAI,UAAU,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,UAAU,CAAA;YAC9C,QAAQ,CACJ,IAAI,EACJ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,EAC7D,GAAG,EAAE;gBACD,MAAM,KAAK,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,eAAe,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBACzE,IAAI,GAAG,CAAC,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;gBACvD,OAAO,KAAK,CAAA;YAChB,CAAC,CACJ,CAAA;YACD,OAAM;QACV,CAAC;QACD,IAAI,UAAU,EAAE,MAAM,KAAK,KAAK,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC;gBACpC,SAAS,aAAa,4CAA4C;aACrE,CAAC,CAAA;YACF,OAAM;QACV,CAAC;QACD,IAAI,UAAU,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC;gBACvC,2FAA2F;aAC9F,CAAC,CAAA;YACF,OAAM;QACV,CAAC;QACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,QAAQ,CACd,mBAAmB,EACnB,8BAA8B,SAAS,IAAI,EAC3C,CAAC,yEAAyE,CAAC,CAC9E,CAAA;QACL,CAAC;QACD,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,uCAAuC,CAAC,CAAA;IACpF,CAAC,CAAC,CAAA;IAEN,0BAA0B,CAAiB,OAAO,EAAE;QAChD,KAAK;QACL,WAAW,EAAE,yDAAyD;QACtE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE;YACpC,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;YAC9D,IAAI,UAAU,EAAE,CAAC;gBACb,KAAK,CAAC,IAAI,CACN,KAAK,CAAC,GAAG,CACL,yEAAyE,CAC5E,CACJ,CAAA;YACL,CAAC;YACD,OAAO,KAAK,CAAA;QAChB,CAAC;QACD,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC;KAC3E,CAAC,CAAA;IAEF,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,2BAA2B;IAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;QACtB,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,OAAO,CAAC,WAAW,CACf,OAAO,EACP;;;;;qFAK6E,CAChF,CAAA;AACL,CAAC"}

package/dist/commands/auth.d.ts

@@ -1,14 +1,2 @@
-import { type TokenStorageResult } from '@doist/cli-core/auth';
 import type { Command } from 'commander';
-/**
- * Surface a `TokenStorageResult` from a save/clear: the human-readable
- * confirmation goes to stdout, any keyring-fallback warning goes to stderr.
- * Pass `isMachineOutput: true` to suppress the stdout confirmation in
- * `--json` / `--ndjson` mode while still routing the warning to stderr.
- *
- * Exported for direct unit testing — the alternative (driving this via
- * mocked cli-core login/logout hooks) would require stubbing the entire
- * store contract just to assert two console calls.
- */
-export declare function logTokenStorageResult(result: TokenStorageResult, secureStoreMessage: string, isMachineOutput?: boolean): void;
 export declare function registerAuthCommand(program: Command): void;

package/dist/commands/auth.js

@@ -1,9 +1,12 @@
-import { attachLoginCommand, attachLogoutCommand, attachStatusCommand, } from '@doist/cli-core/auth';
+import { attachLoginCommand, attachLogoutCommand, attachStatusCommand } from '@doist/cli-core/auth';
 import chalk from 'chalk';
 import { apiRequest } from '../lib/api.js';
+import { logClearResult, logTokenStorageResult } from '../lib/auth-output.js';
 import { renderError, renderSuccess } from '../lib/auth-pages.js';
 import { createOutlineAuthProvider, createOutlineTokenStore, getActiveTokenSource, } from '../lib/auth-provider.js';
+import { refreshedTokenForStatus } from '../lib/auth.js';
 import { CliError } from '../lib/errors.js';
+import { withUserRefAware } from '../lib/user-ref-store.js';
 const DEFAULT_OAUTH_CALLBACK_PORT = 54969;
 function resolvePreferredCallbackPort() {
     const raw = process.env.OUTLINE_OAUTH_CALLBACK_PORT?.trim();
@@ -15,28 +18,14 @@ function resolvePreferredCallbackPort() {
     }
     return parsed;
 }
-/**
- * Surface a `TokenStorageResult` from a save/clear: the human-readable
- * confirmation goes to stdout, any keyring-fallback warning goes to stderr.
- * Pass `isMachineOutput: true` to suppress the stdout confirmation in
- * `--json` / `--ndjson` mode while still routing the warning to stderr.
- *
- * Exported for direct unit testing — the alternative (driving this via
- * mocked cli-core login/logout hooks) would require stubbing the entire
- * store contract just to assert two console calls.
- */
-export function logTokenStorageResult(result, secureStoreMessage, isMachineOutput = false) {
-    if (!isMachineOutput && result.storage === 'secure-store') {
-        console.log(chalk.dim(secureStoreMessage));
-    }
-    if (result.warning) {
-        console.error(chalk.yellow('Warning:'), result.warning);
-    }
-}
 export function registerAuthCommand(program) {
     const auth = program.command('auth').description('Manage authentication');
     const provider = createOutlineAuthProvider();
     const store = createOutlineTokenStore();
+    // Honours a global `ol --user <ref>` placed before `auth status` / `auth
+    // logout`; login always targets the freshly authenticated account, so it
+    // keeps the raw store.
+    const refAware = withUserRefAware(store);
     attachLoginCommand(auth, {
         provider,
         store,
@@ -63,13 +52,24 @@ export function registerAuthCommand(program) {
     // populated by the time the render hooks read it.
     let statusData = null;
     attachStatusCommand(auth, {
-        store,
+        store: refAware,
         description: 'Show current authentication state',
-        async fetchLive({ token, account }) {
+        async fetchLive({ account, token }) {
             try {
+                // Refresh the *selected* account before the check (scoped via
+                // its id + base URL/client id), then probe with the rotated
+                // token. Outline access tokens last ~an hour; without this
+                // `auth status` can't self-heal even though normal commands
+                // do. Passing the resolved token keeps the check tied to the
+                // requested account rather than the default.
+                const liveToken = await refreshedTokenForStatus(account, token);
                 const [{ data: info }, source] = await Promise.all([
-                    apiRequest('auth.info', {}, { token, baseUrl: account.baseUrl }),
-                    getActiveTokenSource(),
+                    apiRequest('auth.info', {}, { token: liveToken, baseUrl: account.baseUrl }),
+                    // Scope the source to the selected account so `auth status
+                    // --user <ref>` reports where *that* account's token lives,
+                    // not the default/env source. Empty id (env/legacy snapshot)
+                    // falls back to the default cascade.
+                    getActiveTokenSource(account.id || undefined),
                 ]);
                 statusData = { email: info.user.email, source };
                 return {
@@ -115,13 +115,10 @@ export function registerAuthCommand(program) {
         },
     });
     attachLogoutCommand(auth, {
-        store,
+        store: refAware,
         description: 'Clear saved authentication',
         onCleared({ view }) {
-            const result = store.getLastClearResult();
-            if (!result)
-                return;
-            logTokenStorageResult(result, 'Stored token removed from the system credential manager', view.json || view.ndjson);
+            logClearResult(store, view.json || view.ndjson);
         },
     });
 }

package/dist/commands/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,GAEtB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,EAEH,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,GAGvB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAE3C,MAAM,2BAA2B,GAAG,KAAK,CAAA;AAOzC,SAAS,4BAA4B;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAA;IAC3D,IAAI,CAAC,GAAG;QAAE,OAAO,2BAA2B,CAAA;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,MAAM,EAAE,CAAC;QAC7D,OAAO,2BAA2B,CAAA;IACtC,CAAC;IACD,OAAO,MAAM,CAAA;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACjC,MAA0B,EAC1B,kBAA0B,EAC1B,eAAe,GAAG,KAAK;IAEvB,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAA;IAC9C,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;IAC3D,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAA;IAEzE,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAA;IAC5C,MAAM,KAAK,GAAsB,uBAAuB,EAAE,CAAA;IAE1D,kBAAkB,CAAC,IAAI,EAAE;QACrB,QAAQ;QACR,KAAK;QACL,aAAa,EAAE,4BAA4B,EAAE;QAC7C,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE;QACvB,aAAa;QACb,WAAW;QACX,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;YACvB,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAA;YAChD,IAAI,CAAC,eAAe,EAAE,CAAC;gBACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,OAAO,CAAC,QAAQ,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;YACxF,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,oBAAoB,EAAE,CAAA;YAC3C,IAAI,MAAM,EAAE,CAAC;gBACT,qBAAqB,CACjB,MAAM,EACN,wDAAwD,EACxD,eAAe,CAClB,CAAA;YACL,CAAC;QACL,CAAC;KACJ,CAAC;SACG,WAAW,CAAC,iDAAiD,CAAC;SAC9D,MAAM,CACH,kBAAkB,EAClB,kEAAkE,CACrE;SACA,MAAM,CACH,wBAAwB,EACxB,iEAAiE,CACpE,CAAA;IAEL,0EAA0E;IAC1E,kEAAkE;IAClE,kDAAkD;IAClD,IAAI,UAAU,GAAsB,IAAI,CAAA;IAExC,mBAAmB,CAAiB,IAAI,EAAE;QACtC,KAAK;QACL,WAAW,EAAE,mCAAmC;QAChD,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE;YAC9B,IAAI,CAAC;gBACD,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAC/C,UAAU,CACN,WAAW,EACX,EAAE,EACF,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CACtC;oBACD,oBAAoB,EAAE;iBACzB,CAAC,CAAA;gBACF,UAAU,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAA;gBAC/C,OAAO;oBACH,GAAG,OAAO;oBACV,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;oBAChB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;oBACrB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;iBAC3B,CAAA;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;gBACvD,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtE,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,8CAA8C,EAAE;wBAC3E,wCAAwC;qBAC3C,CAAC,CAAA;gBACN,CAAC;gBACD,MAAM,GAAG,CAAA;YACb,CAAC;QACL,CAAC;QACD,UAAU,CAAC,EAAE,OAAO,EAAE;YAClB,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;YAC7E,OAAO;gBACH,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB;gBACnC,WAAW,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE;gBAC/C,WAAW,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,KAAK,GAAG;gBAChD,eAAe,OAAO,CAAC,OAAO,EAAE;gBAChC,mBAAmB,UAAU,CAAC,MAAM,EAAE;aACzC,CAAA;QACL,CAAC;QACD,UAAU,CAAC,EAAE,OAAO,EAAE;YAClB,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;YAC7E,OAAO;gBACH,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,IAAI,EAAE,OAAO,CAAC,QAAQ;gBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM,EAAE,UAAU,CAAC,MAAM;aAC5B,CAAA;QACL,CAAC;QACD,kBAAkB;YACd,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,uCAAuC,CAAC,CAAA;QACpF,CAAC;KACJ,CAAC,CAAA;IAEF,mBAAmB,CAAiB,IAAI,EAAE;QACtC,KAAK;QACL,WAAW,EAAE,4BAA4B;QACzC,SAAS,CAAC,EAAE,IAAI,EAAE;YACd,MAAM,MAAM,GAAG,KAAK,CAAC,kBAAkB,EAAE,CAAA;YACzC,IAAI,CAAC,MAAM;gBAAE,OAAM;YACnB,qBAAqB,CACjB,MAAM,EACN,yDAAyD,EACzD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAC3B,CAAA;QACL,CAAC;KACJ,CAAC,CAAA;AACN,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AACnG,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,EAEH,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,GAGvB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAE3D,MAAM,2BAA2B,GAAG,KAAK,CAAA;AAOzC,SAAS,4BAA4B;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAA;IAC3D,IAAI,CAAC,GAAG;QAAE,OAAO,2BAA2B,CAAA;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,MAAM,EAAE,CAAC;QAC7D,OAAO,2BAA2B,CAAA;IACtC,CAAC;IACD,OAAO,MAAM,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAA;IAEzE,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAA;IAC5C,MAAM,KAAK,GAAsB,uBAAuB,EAAE,CAAA;IAC1D,yEAAyE;IACzE,yEAAyE;IACzE,uBAAuB;IACvB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAExC,kBAAkB,CAAC,IAAI,EAAE;QACrB,QAAQ;QACR,KAAK;QACL,aAAa,EAAE,4BAA4B,EAAE;QAC7C,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE;QACvB,aAAa;QACb,WAAW;QACX,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;YACvB,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAA;YAChD,IAAI,CAAC,eAAe,EAAE,CAAC;gBACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,OAAO,CAAC,QAAQ,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;YACxF,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,oBAAoB,EAAE,CAAA;YAC3C,IAAI,MAAM,EAAE,CAAC;gBACT,qBAAqB,CACjB,MAAM,EACN,wDAAwD,EACxD,eAAe,CAClB,CAAA;YACL,CAAC;QACL,CAAC;KACJ,CAAC;SACG,WAAW,CAAC,iDAAiD,CAAC;SAC9D,MAAM,CACH,kBAAkB,EAClB,kEAAkE,CACrE;SACA,MAAM,CACH,wBAAwB,EACxB,iEAAiE,CACpE,CAAA;IAEL,0EAA0E;IAC1E,kEAAkE;IAClE,kDAAkD;IAClD,IAAI,UAAU,GAAsB,IAAI,CAAA;IAExC,mBAAmB,CAAiB,IAAI,EAAE;QACtC,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,mCAAmC;QAChD,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;YAC9B,IAAI,CAAC;gBACD,8DAA8D;gBAC9D,4DAA4D;gBAC5D,2DAA2D;gBAC3D,4DAA4D;gBAC5D,6DAA6D;gBAC7D,6CAA6C;gBAC7C,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;gBAC/D,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAC/C,UAAU,CACN,WAAW,EACX,EAAE,EACF,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CACjD;oBACD,2DAA2D;oBAC3D,4DAA4D;oBAC5D,6DAA6D;oBAC7D,qCAAqC;oBACrC,oBAAoB,CAAC,OAAO,CAAC,EAAE,IAAI,SAAS,CAAC;iBAChD,CAAC,CAAA;gBACF,UAAU,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAA;gBAC/C,OAAO;oBACH,GAAG,OAAO;oBACV,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;oBAChB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;oBACrB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;iBAC3B,CAAA;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;gBACvD,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtE,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,8CAA8C,EAAE;wBAC3E,wCAAwC;qBAC3C,CAAC,CAAA;gBACN,CAAC;gBACD,MAAM,GAAG,CAAA;YACb,CAAC;QACL,CAAC;QACD,UAAU,CAAC,EAAE,OAAO,EAAE;YAClB,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;YAC7E,OAAO;gBACH,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB;gBACnC,WAAW,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE;gBAC/C,WAAW,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,KAAK,GAAG;gBAChD,eAAe,OAAO,CAAC,OAAO,EAAE;gBAChC,mBAAmB,UAAU,CAAC,MAAM,EAAE;aACzC,CAAA;QACL,CAAC;QACD,UAAU,CAAC,EAAE,OAAO,EAAE;YAClB,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;YAC7E,OAAO;gBACH,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,IAAI,EAAE,OAAO,CAAC,QAAQ;gBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM,EAAE,UAAU,CAAC,MAAM;aAC5B,CAAA;QACL,CAAC;QACD,kBAAkB;YACd,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,uCAAuC,CAAC,CAAA;QACpF,CAAC;KACJ,CAAC,CAAA;IAEF,mBAAmB,CAAiB,IAAI,EAAE;QACtC,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,4BAA4B;QACzC,SAAS,CAAC,EAAE,IAAI,EAAE;YACd,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,CAAA;QACnD,CAAC;KACJ,CAAC,CAAA;AACN,CAAC"}

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
 import packageJson from '../package.json' with { type: 'json' };
+import { registerAccountCommand } from './commands/account.js';
 import { registerAuthCommand } from './commands/auth.js';
 import { registerChangelogCommand } from './commands/changelog.js';
 import { registerCollectionCommand } from './commands/collection.js';
@@ -9,7 +10,7 @@ import { registerSearchCommand } from './commands/search.js';
 import { registerSkillCommand } from './commands/skill.js';
 import { registerUpdateCommand } from './commands/update/index.js';
 import { BaseCliError } from './lib/errors.js';
-import { isJsonMode } from './lib/global-args.js';
+import { applyUserSelector, isJsonMode } from './lib/global-args.js';
 import { formatError, formatErrorJson } from './lib/output.js';
 const program = new Command();
 program
@@ -19,23 +20,37 @@ program
     .option('--no-spinner', 'Disable loading animations')
     .option('--accessible', 'Render output in screen-reader-friendly mode')
     .addHelpText('after', `
+Global options:
+  --user <id|name>  Act as a specific stored account (place before the command,
+                    e.g. \`ol --user scott@example.com document list\`).
+
 Note for AI/LLM agents:
   Use --json or --ndjson flags for unambiguous, parseable output.
   Default JSON shows essential fields; use --full for all fields.`);
 registerAuthCommand(program);
+registerAccountCommand(program);
 registerSearchCommand(program);
 registerDocumentCommand(program);
 registerCollectionCommand(program);
 registerSkillCommand(program);
 registerChangelogCommand(program);
 registerUpdateCommand(program);
-program.parseAsync().catch((err) => {
+function reportError(err) {
     if (err instanceof BaseCliError) {
         console.error(isJsonMode() ? formatErrorJson(err) : formatError(err));
     }
     else {
-        console.error(err.message);
+        console.error(err instanceof Error ? err.message : String(err));
     }
     process.exit(1);
-});
+}
+// Commander has no root `--user` option, so validate it and strip it from argv
+// before parsing (see `applyUserSelector` for the warm-cache-then-strip order).
+try {
+    applyUserSelector(new Set(program.commands.map((c) => c.name())));
+}
+catch (err) {
+    reportError(err);
+}
+program.parseAsync().catch(reportError);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,WAAW,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAA;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAA;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAE9D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;AAE7B,OAAO;KACF,IAAI,CAAC,IAAI,CAAC;KACV,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC;KAC5B,WAAW,CAAC,6CAA6C,CAAC;KAC1D,MAAM,CAAC,cAAc,EAAE,4BAA4B,CAAC;KACpD,MAAM,CAAC,cAAc,EAAE,8CAA8C,CAAC;KACtE,WAAW,CACR,OAAO,EACP;;;kEAG0D,CAC7D,CAAA;AAEL,mBAAmB,CAAC,OAAO,CAAC,CAAA;AAC5B,qBAAqB,CAAC,OAAO,CAAC,CAAA;AAC9B,uBAAuB,CAAC,OAAO,CAAC,CAAA;AAChC,yBAAyB,CAAC,OAAO,CAAC,CAAA;AAClC,oBAAoB,CAAC,OAAO,CAAC,CAAA;AAC7B,wBAAwB,CAAC,OAAO,CAAC,CAAA;AACjC,qBAAqB,CAAC,OAAO,CAAC,CAAA;AAE9B,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE;IACtC,IAAI,GAAG,YAAY,YAAY,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IACzE,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC9B,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACnB,CAAC,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,WAAW,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAA;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAA;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACpE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAE9D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;AAE7B,OAAO;KACF,IAAI,CAAC,IAAI,CAAC;KACV,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC;KAC5B,WAAW,CAAC,6CAA6C,CAAC;KAC1D,MAAM,CAAC,cAAc,EAAE,4BAA4B,CAAC;KACpD,MAAM,CAAC,cAAc,EAAE,8CAA8C,CAAC;KACtE,WAAW,CACR,OAAO,EACP;;;;;;;kEAO0D,CAC7D,CAAA;AAEL,mBAAmB,CAAC,OAAO,CAAC,CAAA;AAC5B,sBAAsB,CAAC,OAAO,CAAC,CAAA;AAC/B,qBAAqB,CAAC,OAAO,CAAC,CAAA;AAC9B,uBAAuB,CAAC,OAAO,CAAC,CAAA;AAChC,yBAAyB,CAAC,OAAO,CAAC,CAAA;AAClC,oBAAoB,CAAC,OAAO,CAAC,CAAA;AAC7B,wBAAwB,CAAC,OAAO,CAAC,CAAA;AACjC,qBAAqB,CAAC,OAAO,CAAC,CAAA;AAE9B,SAAS,WAAW,CAAC,GAAY;IAC7B,IAAI,GAAG,YAAY,YAAY,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IACzE,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;IACnE,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACnB,CAAC;AAED,+EAA+E;AAC/E,gFAAgF;AAChF,IAAI,CAAC;IACD,iBAAiB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;AACrE,CAAC;AAAC,OAAO,GAAG,EAAE,CAAC;IACX,WAAW,CAAC,GAAG,CAAC,CAAA;AACpB,CAAC;AAED,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA"}

package/dist/lib/api.js

@@ -1,5 +1,6 @@
 import { fetchWithRetry } from '../transport/fetch-with-retry.js';
-import { getApiToken, getBaseUrl } from './auth.js';
+import { TOKEN_ENV_VAR } from './auth-constants.js';
+import { getApiToken, getRequestContext, proactiveRefresh, reactiveRefresh } from './auth.js';
 import { withSpinner } from './spinner.js';
 /**
  * Spinner configuration mapping API paths to spinner options.
@@ -22,25 +23,63 @@ const API_SPINNER_CONFIG = {
     'collections.update': { text: 'Updating collection...', color: 'yellow' },
     'collections.delete': { text: 'Deleting collection...', color: 'yellow' },
 };
+/**
+ * Resolve the token for a request. A caller-supplied override is used as-is.
+ * On the managed path, prefer the token `proactiveRefresh` resolved (rotated
+ * or current) so unrefreshable/access-only accounts stay on a single store
+ * read; only fall back to `getApiToken` when proactive refresh bows out.
+ * `handshake` pins the refresh to the `--user` account's instance.
+ */
+async function resolveRequestToken(managed, override, handshake) {
+    if (override)
+        return override;
+    if (managed) {
+        const refreshed = await proactiveRefresh(handshake);
+        if (refreshed)
+            return refreshed;
+    }
+    return getApiToken();
+}
 /**
  * Core API request function without spinner wrapping.
  */
 async function rawApiRequest(path, body = {}, overrides = {}) {
-    const [resolvedBaseUrl, resolvedToken] = await Promise.all([
-        overrides.baseUrl ? Promise.resolve(overrides.baseUrl.replace(/\/$/, '')) : getBaseUrl(),
-        overrides.token ? Promise.resolve(overrides.token) : getApiToken(),
-    ]);
-    const res = await fetchWithRetry({
+    // Only stored credentials can be refreshed: a caller-supplied token
+    // override or the `OUTLINE_API_TOKEN` env var is taken as-is.
+    const managed = !overrides.token && !process.env[TOKEN_ENV_VAR]?.trim();
+    // A caller-supplied base URL (login validate, auth status) skips account
+    // resolution — those paths pass an explicit token, so no refresh runs.
+    // Otherwise resolve the request's base URL and, for a `--user` account, the
+    // refresh handshake that keeps rotation pinned to that account's instance.
+    let resolvedBaseUrl;
+    let handshake;
+    if (overrides.baseUrl) {
+        resolvedBaseUrl = overrides.baseUrl.replace(/\/$/, '');
+    }
+    else {
+        const ctx = await getRequestContext();
+        resolvedBaseUrl = ctx.baseUrl;
+        handshake = ctx.handshake;
+    }
+    const resolvedToken = await resolveRequestToken(managed, overrides.token, handshake);
+    const performRequest = (token) => fetchWithRetry({
         url: `${resolvedBaseUrl}/api/${path}`,
         options: {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
-                Authorization: `Bearer ${resolvedToken}`,
+                Authorization: `Bearer ${token}`,
             },
             body: JSON.stringify(body),
         },
     });
+    let res = await performRequest(resolvedToken);
+    // Reactive path: a 401 on a managed token triggers a forced rotation and
+    // a single retry. `reactiveRefresh` throws `NoTokenError` when the refresh
+    // token is gone, so an unrecoverable 401 surfaces the re-login hint.
+    if (res.status === 401 && managed && (await reactiveRefresh(handshake))) {
+        res = await performRequest(await getApiToken());
+    }
     if (!res.ok) {
         let message = `API error: ${res.status} ${res.statusText}`;
         try {

package/dist/lib/api.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/lib/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACjE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACnD,OAAO,EAAuB,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/D;;;GAGG;AACH,MAAM,kBAAkB,GAAmC;IACvD,WAAW,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,MAAM,EAAE;IAClE,kBAAkB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,EAAE;IACrE,gBAAgB,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,EAAE;IACjE,gBAAgB,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE;IAChE,kBAAkB,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE;IACpE,kBAAkB,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACrE,kBAAkB,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACrE,gBAAgB,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACjE,mBAAmB,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACvE,qBAAqB,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,QAAQ,EAAE;IAC3E,kBAAkB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,EAAE;IACrE,kBAAkB,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,EAAE;IACpE,oBAAoB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,OAAO,EAAE;IACxE,oBAAoB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACzE,oBAAoB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,QAAQ,EAAE;CAC5E,CAAA;AA8BD;;GAEG;AACH,KAAK,UAAU,aAAa,CACxB,IAAY,EACZ,OAAe,EAAE,EACjB,YAAiC,EAAE;IAEnC,MAAM,CAAC,eAAe,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACvD,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE;QACxF,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;KACrE,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC;QAC7B,GAAG,EAAE,GAAG,eAAe,QAAQ,IAAI,EAAE;QACrC,OAAO,EAAE;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACL,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,aAAa,EAAE;aAC3C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC7B;KACJ,CAAC,CAAA;IAEF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACV,IAAI,OAAO,GAAG,cAAc,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAA;QAC1D,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAa,CAAA;YAC1C,IAAI,GAAG,CAAC,OAAO;gBAAE,OAAO,GAAG,cAAc,GAAG,CAAC,OAAO,EAAE,CAAA;QAC1D,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAA;IAC5B,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmB,CAAA;IACjD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAA;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC5B,IAAY,EACZ,OAAe,EAAE,EACjB,YAAiC,EAAE;IAEnC,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI;QAC9C,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,MAAe;KACzB,CAAA;IAED,OAAO,WAAW,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,aAAa,CAAI,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAA;AACpF,CAAC"}
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/lib/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC7F,OAAO,EAAuB,WAAW,EAAE,MAAM,cAAc,CAAA;AAI/D;;;GAGG;AACH,MAAM,kBAAkB,GAAmC;IACvD,WAAW,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,MAAM,EAAE;IAClE,kBAAkB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,EAAE;IACrE,gBAAgB,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,EAAE;IACjE,gBAAgB,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE;IAChE,kBAAkB,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE;IACpE,kBAAkB,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACrE,kBAAkB,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACrE,gBAAgB,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACjE,mBAAmB,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACvE,qBAAqB,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,QAAQ,EAAE;IAC3E,kBAAkB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,EAAE;IACrE,kBAAkB,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,EAAE;IACpE,oBAAoB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,OAAO,EAAE;IACxE,oBAAoB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACzE,oBAAoB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,QAAQ,EAAE;CAC5E,CAAA;AA8BD;;;;;;GAMG;AACH,KAAK,UAAU,mBAAmB,CAC9B,OAAgB,EAChB,QAAiB,EACjB,SAA4B;IAE5B,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,IAAI,OAAO,EAAE,CAAC;QACV,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAA;QACnD,IAAI,SAAS;YAAE,OAAO,SAAS,CAAA;IACnC,CAAC;IACD,OAAO,WAAW,EAAE,CAAA;AACxB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,aAAa,CACxB,IAAY,EACZ,OAAe,EAAE,EACjB,YAAiC,EAAE;IAEnC,oEAAoE;IACpE,8DAA8D;IAC9D,MAAM,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAA;IAEvE,yEAAyE;IACzE,uEAAuE;IACvE,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,eAAuB,CAAA;IAC3B,IAAI,SAAuC,CAAA;IAC3C,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACpB,eAAe,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC1D,CAAC;SAAM,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,iBAAiB,EAAE,CAAA;QACrC,eAAe,GAAG,GAAG,CAAC,OAAO,CAAA;QAC7B,SAAS,GAAG,GAAG,CAAC,SAAS,CAAA;IAC7B,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IAEpF,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,EAAE,CACrC,cAAc,CAAC;QACX,GAAG,EAAE,GAAG,eAAe,QAAQ,IAAI,EAAE;QACrC,OAAO,EAAE;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACL,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,EAAE;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC7B;KACJ,CAAC,CAAA;IAEN,IAAI,GAAG,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,CAAA;IAE7C,yEAAyE;IACzE,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,IAAI,CAAC,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,GAAG,MAAM,cAAc,CAAC,MAAM,WAAW,EAAE,CAAC,CAAA;IACnD,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACV,IAAI,OAAO,GAAG,cAAc,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAA;QAC1D,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAa,CAAA;YAC1C,IAAI,GAAG,CAAC,OAAO;gBAAE,OAAO,GAAG,cAAc,GAAG,CAAC,OAAO,EAAE,CAAA;QAC1D,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAA;IAC5B,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmB,CAAA;IACjD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAA;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC5B,IAAY,EACZ,OAAe,EAAE,EACjB,YAAiC,EAAE;IAEnC,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI;QAC9C,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,MAAe;KACzB,CAAA;IAED,OAAO,WAAW,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,aAAa,CAAI,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAA;AACpF,CAAC"}

package/dist/lib/auth-output.d.ts

@@ -0,0 +1,15 @@
+import type { TokenStorageResult } from '@doist/cli-core/auth';
+import type { OutlineTokenStore } from './auth-provider.js';
+/**
+ * Surface a `TokenStorageResult` from a save/clear: the human-readable
+ * confirmation goes to stdout, any keyring-fallback warning goes to stderr.
+ * Pass `isMachineOutput: true` to suppress the stdout confirmation in
+ * `--json` / `--ndjson` mode while still routing the warning to stderr.
+ */
+export declare function logTokenStorageResult(result: TokenStorageResult, secureStoreMessage: string, isMachineOutput?: boolean): void;
+/**
+ * Surface the result of a token clear (`auth logout` / `account remove`): the
+ * confirmation goes to stdout, any keyring-fallback warning to stderr. Shared so
+ * both call sites stay in lockstep.
+ */
+export declare function logClearResult(store: OutlineTokenStore, isMachineOutput: boolean): void;

package/dist/lib/auth-output.js

@@ -0,0 +1,27 @@
+import chalk from 'chalk';
+/**
+ * Surface a `TokenStorageResult` from a save/clear: the human-readable
+ * confirmation goes to stdout, any keyring-fallback warning goes to stderr.
+ * Pass `isMachineOutput: true` to suppress the stdout confirmation in
+ * `--json` / `--ndjson` mode while still routing the warning to stderr.
+ */
+export function logTokenStorageResult(result, secureStoreMessage, isMachineOutput = false) {
+    if (!isMachineOutput && result.storage === 'secure-store') {
+        console.log(chalk.dim(secureStoreMessage));
+    }
+    if (result.warning) {
+        console.error(chalk.yellow('Warning:'), result.warning);
+    }
+}
+/**
+ * Surface the result of a token clear (`auth logout` / `account remove`): the
+ * confirmation goes to stdout, any keyring-fallback warning to stderr. Shared so
+ * both call sites stay in lockstep.
+ */
+export function logClearResult(store, isMachineOutput) {
+    const result = store.getLastClearResult();
+    if (!result)
+        return;
+    logTokenStorageResult(result, 'Stored token removed from the system credential manager', isMachineOutput);
+}
+//# sourceMappingURL=auth-output.js.map

package/dist/lib/auth-output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-output.js","sourceRoot":"","sources":["../../src/lib/auth-output.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAA;AAGzB;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACjC,MAA0B,EAC1B,kBAA0B,EAC1B,eAAe,GAAG,KAAK;IAEvB,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAA;IAC9C,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;IAC3D,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAwB,EAAE,eAAwB;IAC7E,MAAM,MAAM,GAAG,KAAK,CAAC,kBAAkB,EAAE,CAAA;IACzC,IAAI,CAAC,MAAM;QAAE,OAAM;IACnB,qBAAqB,CACjB,MAAM,EACN,yDAAyD,EACzD,eAAe,CAClB,CAAA;AACL,CAAC"}

package/dist/lib/auth-provider.d.ts

@@ -1,6 +1,7 @@
 import { type AccountRef, type AuthProvider, type KeyringTokenStore } from '@doist/cli-core/auth';
 import { type OutlineAccount } from './outline-account.js';
 export type { OutlineAccount } from './outline-account.js';
+export { matchOutlineAccount } from './outline-account.js';
 export type AuthInfoResponse = {
     user: {
         id: string;
@@ -14,12 +15,6 @@ export type AuthInfoResponse = {
 };
 export type OutlineTokenStore = KeyringTokenStore<OutlineAccount>;
 export declare function createOutlineAuthProvider(): AuthProvider<OutlineAccount>;
-/**
- * Accepts the Outline user UUID or display name. Id matches are
- * case-sensitive (UUIDs are canonical); label matches are
- * case-insensitive so users can pass the name they see in `auth status`.
- */
-export declare function matchOutlineAccount(account: OutlineAccount, ref: AccountRef): boolean;
 /**
  * True when the v2 store is empty but a legacy v1 token snapshot is still
  * the only thing keeping the CLI authenticated — typically because
@@ -29,26 +24,39 @@ export declare function matchOutlineAccount(account: OutlineAccount, ref: Accoun
  * v1 keyring slot to read from). Useful for downstream diagnostics.
  */
 export declare function isLegacyAuthActive(): Promise<boolean>;
+/** Where `ol account current` resolves the active credential from. */
+export type ActiveAccountSource = {
+    source: 'stored';
+    account: OutlineAccount;
+    isDefault: boolean;
+} | {
+    source: 'env';
+} | {
+    source: 'legacy';
+} | null;
 /**
- * `OUTLINE_API_TOKEN` short-circuits `active()` only when no explicit ref
- * is supplied — cli-core's `KeyringTokenStore` doesn't know about the env
- * var, and an explicit ref means the caller targets a specific stored
- * account.
+ * Authoritatively classify the active credential without re-deriving the
+ * cascade from membership heuristics. Mirrors `active()`'s precedence — env
+ * (only when no explicit ref) → stored v2 → legacy snapshot — but reports
+ * *which* branch matched, so `ol account current` can render the right shape.
  *
- * `ensureMigrated()` runs **before** every mutating v2 op so the post-op
- * legacy discharge can't race a still-pending migration into re-grabbing
- * the legacy `api_token` we just consumed. `set()` / `clear()` then
- * discharge legacy state **after** the v2 op succeeds. `set()` swallows
- * the cleanup failure (v2 wins in `active()` regardless); `clear()`
- * propagates it so a failed logout fails loudly instead of leaving the
- * user authenticated via the legacy fallback.
+ * The v2 lookup uses the bare keyring store (no legacy fallback) and matches by
+ * `ref`, so a renamed legacy snapshot sharing a UUID with a v2 record can't be
+ * misreported as `stored`: a `--user <old-name>` that the v2 record no longer
+ * matches falls through to the legacy branch.
  */
+export declare function resolveActiveAccountSource(ref?: AccountRef): Promise<ActiveAccountSource>;
 export declare function createOutlineTokenStore(): OutlineTokenStore;
 /**
  * Where the currently-active token lives. Mirrors `active()`'s resolution
  * order — env → v2 record → legacy plaintext — so the answer can never
  * contradict the token the runtime is actually using.
  *
+ * Pass `ref` to report the source of a specific `--user` account (used by
+ * `auth status --user <ref>`): a ref selects the matching record and skips the
+ * env short-circuit, so the source reflects the account being shown rather
+ * than an ambient env token. Without a ref the default/env cascade applies.
+ *
  * The precedence cascade is intentionally duplicated with `active()`:
  * the only true dedupe options either (a) add an extra config read on
  * every `apiRequest` call (regressing the request hot path) or (b)
@@ -56,4 +64,4 @@ export declare function createOutlineTokenStore(): OutlineTokenStore;
  * invites is guarded by the `getActiveTokenSource` regression test that
  * asserts v2-record presence wins over a lingering v1 `api_token`.
  */
-export declare function getActiveTokenSource(): Promise<'env' | 'secure-store' | 'config-file'>;
+export declare function getActiveTokenSource(ref?: AccountRef): Promise<'env' | 'secure-store' | 'config-file'>;