@doist/outline-cli 1.8.0 → 1.10.0

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## [1.10.0](https://github.com/Doist/outline-cli/compare/v1.9.0...v1.10.0) (2026-05-24)
+
+### Features
+
+* **auth:** add `token` command group (save + view) ([#80](https://github.com/Doist/outline-cli/issues/80)) ([99789cc](https://github.com/Doist/outline-cli/commit/99789cc48b9afa9fc53959427f9121f8d3c12cd9))
+
+## [1.9.0](https://github.com/Doist/outline-cli/compare/v1.8.0...v1.9.0) (2026-05-24)
+
+### Features
+
+* **account:** account command group (cli-core attachers) ([#79](https://github.com/Doist/outline-cli/issues/79)) ([01bd6a6](https://github.com/Doist/outline-cli/commit/01bd6a60af135bbfda894b56d5a6d2b2229b70a8)), closes [#77](https://github.com/Doist/outline-cli/issues/77)
+
 ## [1.8.0](https://github.com/Doist/outline-cli/compare/v1.7.0...v1.8.0) (2026-05-21)
 
 ### Features

package/dist/commands/account.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerAccountCommand(program: Command): void;

package/dist/commands/account.js

@@ -0,0 +1,107 @@
+import { emitView } from '@doist/cli-core';
+import { attachAccountListCommand, attachAccountRemoveCommand, attachAccountUseCommand, } from '@doist/cli-core/auth';
+import chalk from 'chalk';
+import { TOKEN_ENV_VAR } from '../lib/auth-constants.js';
+import { logClearResult } from '../lib/auth-output.js';
+import { createOutlineTokenStore, resolveActiveAccountSource, } from '../lib/auth-provider.js';
+import { CliError } from '../lib/errors.js';
+import { getRequestedUserRef, isAccessible } from '../lib/global-args.js';
+/** `<label> (id:<id>)` with an accessibility-aware default marker. */
+function accountLine(account, isDefault) {
+    const marker = isDefault ? (isAccessible() ? ' [default]' : chalk.green(' (default)')) : '';
+    return `${account.label} ${chalk.dim(`(id:${account.id})`)}${marker}`;
+}
+/** Tidy machine projection shared by `list` and `current` — drops the OAuth client id. */
+function projectAccount(account, isDefault) {
+    return {
+        id: account.id,
+        label: account.label,
+        teamName: account.teamName,
+        baseUrl: account.baseUrl,
+        isDefault,
+    };
+}
+export function registerAccountCommand(program) {
+    const account = program.command('account').description('Manage stored CLI accounts');
+    const store = createOutlineTokenStore();
+    const list = attachAccountListCommand(account, {
+        store,
+        description: 'List stored Outline accounts',
+        renderText: ({ accounts }) => {
+            if (accounts.length === 0) {
+                return 'No stored accounts. Run `ol auth login` to add one.';
+            }
+            return accounts.map(({ account, isDefault }) => accountLine(account, isDefault));
+        },
+        renderJson: ({ account, isDefault }) => projectAccount(account, isDefault),
+    });
+    attachAccountUseCommand(account, {
+        store,
+        description: 'Set the default account (matched by Outline user id or display name)',
+    });
+    // `current` resolves the active credential's source directly (env / stored /
+    // legacy) rather than going through the generic account attacher, which only
+    // models stored accounts. `--json` / `--ndjson` emit a discriminated envelope.
+    account
+        .command('current')
+        .description('Show the active account (honours --user and OUTLINE_API_TOKEN)')
+        .option('--json', 'Emit machine-readable JSON output')
+        .option('--ndjson', 'Emit machine-readable NDJSON output')
+        .action(async (options) => {
+        const view = { json: Boolean(options.json), ndjson: Boolean(options.ndjson) };
+        const requested = getRequestedUserRef();
+        const resolution = await resolveActiveAccountSource(requested);
+        if (resolution?.source === 'stored') {
+            const { account: acc, isDefault } = resolution;
+            emitView(view, { source: 'stored', account: projectAccount(acc, isDefault) }, () => {
+                const lines = [accountLine(acc, isDefault), `  Base URL: ${acc.baseUrl}`];
+                if (acc.teamName)
+                    lines.push(`  Team: ${acc.teamName}`);
+                return lines;
+            });
+            return;
+        }
+        if (resolution?.source === 'env') {
+            emitView(view, { source: 'env' }, () => [
+                `Using ${TOKEN_ENV_VAR} environment variable (no stored account).`,
+            ]);
+            return;
+        }
+        if (resolution?.source === 'legacy') {
+            emitView(view, { source: 'legacy' }, () => [
+                'Using legacy single-user credentials. Run `ol auth login` to migrate to a stored account.',
+            ]);
+            return;
+        }
+        if (requested !== undefined) {
+            throw new CliError('ACCOUNT_NOT_FOUND', `No stored account matches "${requested}".`, ['Check the account id or display name, or run `ol auth login` to add it.']);
+        }
+        throw new CliError('NOT_AUTHENTICATED', 'Not authenticated. Run: ol auth login');
+    });
+    attachAccountRemoveCommand(account, {
+        store,
+        description: 'Remove a stored account (clears keyring + config entry)',
+        renderText: ({ account, wasDefault }) => {
+            const lines = [`${chalk.green('✓')} Removed ${account.label}`];
+            if (wasDefault) {
+                lines.push(chalk.dim('Cleared default account. Set a new one with `ol account use <id|name>`.'));
+            }
+            return lines;
+        },
+        onRemoved: ({ view }) => logClearResult(store, view.json || view.ndjson),
+    });
+    // Make bare `ol account` list. A parent action runs only when no subcommand
+    // matches, so `ol account list` still routes to the subcommand directly —
+    // this just delegates the no-subcommand case via the public API (no reliance
+    // on commander internals).
+    account.action(async () => {
+        await list.parseAsync([], { from: 'user' });
+    });
+    account.addHelpText('after', `
+Examples:
+  ol account                     # list stored accounts (default subcommand)
+  ol account current             # show the active account
+  ol account use "Ada Lovelace"  # set the default account (id or display name)
+  ol account remove id-bob       # forget an account (clears keyring + config entry)`);
+}
+//# sourceMappingURL=account.js.map

package/dist/commands/account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../../src/commands/account.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC1C,OAAO,EACH,wBAAwB,EACxB,0BAA0B,EAC1B,uBAAuB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EACH,uBAAuB,EAEvB,0BAA0B,GAC7B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAEzE,sEAAsE;AACtE,SAAS,WAAW,CAAC,OAAuB,EAAE,SAAkB;IAC5D,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3F,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE,CAAA;AACzE,CAAC;AAED,0FAA0F;AAC1F,SAAS,cAAc,CAAC,OAAuB,EAAE,SAAkB;IAC/D,OAAO;QACH,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS;KACZ,CAAA;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAAA;IACpF,MAAM,KAAK,GAAG,uBAAuB,EAAE,CAAA;IAEvC,MAAM,IAAI,GAAG,wBAAwB,CAAiB,OAAO,EAAE;QAC3D,KAAK;QACL,WAAW,EAAE,8BAA8B;QAC3C,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;YACzB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,qDAAqD,CAAA;YAChE,CAAC;YACD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAA;QACpF,CAAC;QACD,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC;KAC7E,CAAC,CAAA;IAEF,uBAAuB,CAAiB,OAAO,EAAE;QAC7C,KAAK;QACL,WAAW,EAAE,sEAAsE;KACtF,CAAC,CAAA;IAEF,6EAA6E;IAC7E,6EAA6E;IAC7E,+EAA+E;IAC/E,OAAO;SACF,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,gEAAgE,CAAC;SAC7E,MAAM,CAAC,QAAQ,EAAE,mCAAmC,CAAC;SACrD,MAAM,CAAC,UAAU,EAAE,qCAAqC,CAAC;SACzD,MAAM,CAAC,KAAK,EAAE,OAA6C,EAAE,EAAE;QAC5D,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAA;QAC7E,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAA;QACvC,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC,SAAS,CAAC,CAAA;QAC9D,IAAI,UAAU,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,UAAU,CAAA;YAC9C,QAAQ,CACJ,IAAI,EACJ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,EAC7D,GAAG,EAAE;gBACD,MAAM,KAAK,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,eAAe,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBACzE,IAAI,GAAG,CAAC,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;gBACvD,OAAO,KAAK,CAAA;YAChB,CAAC,CACJ,CAAA;YACD,OAAM;QACV,CAAC;QACD,IAAI,UAAU,EAAE,MAAM,KAAK,KAAK,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC;gBACpC,SAAS,aAAa,4CAA4C;aACrE,CAAC,CAAA;YACF,OAAM;QACV,CAAC;QACD,IAAI,UAAU,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC;gBACvC,2FAA2F;aAC9F,CAAC,CAAA;YACF,OAAM;QACV,CAAC;QACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,QAAQ,CACd,mBAAmB,EACnB,8BAA8B,SAAS,IAAI,EAC3C,CAAC,yEAAyE,CAAC,CAC9E,CAAA;QACL,CAAC;QACD,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,uCAAuC,CAAC,CAAA;IACpF,CAAC,CAAC,CAAA;IAEN,0BAA0B,CAAiB,OAAO,EAAE;QAChD,KAAK;QACL,WAAW,EAAE,yDAAyD;QACtE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE;YACpC,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;YAC9D,IAAI,UAAU,EAAE,CAAC;gBACb,KAAK,CAAC,IAAI,CACN,KAAK,CAAC,GAAG,CACL,yEAAyE,CAC5E,CACJ,CAAA;YACL,CAAC;YACD,OAAO,KAAK,CAAA;QAChB,CAAC;QACD,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC;KAC3E,CAAC,CAAA;IAEF,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,2BAA2B;IAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;QACtB,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,OAAO,CAAC,WAAW,CACf,OAAO,EACP;;;;;qFAK6E,CAChF,CAAA;AACL,CAAC"}

package/dist/commands/auth.d.ts

@@ -1,14 +1,2 @@
-import { type TokenStorageResult } from '@doist/cli-core/auth';
 import type { Command } from 'commander';
-/**
- * Surface a `TokenStorageResult` from a save/clear: the human-readable
- * confirmation goes to stdout, any keyring-fallback warning goes to stderr.
- * Pass `isMachineOutput: true` to suppress the stdout confirmation in
- * `--json` / `--ndjson` mode while still routing the warning to stderr.
- *
- * Exported for direct unit testing — the alternative (driving this via
- * mocked cli-core login/logout hooks) would require stubbing the entire
- * store contract just to assert two console calls.
- */
-export declare function logTokenStorageResult(result: TokenStorageResult, secureStoreMessage: string, isMachineOutput?: boolean): void;
 export declare function registerAuthCommand(program: Command): void;

package/dist/commands/auth.js

@@ -1,10 +1,14 @@
-import { attachLoginCommand, attachLogoutCommand, attachStatusCommand, } from '@doist/cli-core/auth';
+import { attachLoginCommand, attachLogoutCommand, attachStatusCommand, attachTokenViewCommand, } from '@doist/cli-core/auth';
 import chalk from 'chalk';
 import { apiRequest } from '../lib/api.js';
+import { TOKEN_ENV_VAR } from '../lib/auth-constants.js';
+import { logClearResult, logSaveResult } from '../lib/auth-output.js';
 import { renderError, renderSuccess } from '../lib/auth-pages.js';
-import { createOutlineAuthProvider, createOutlineTokenStore, getActiveTokenSource, } from '../lib/auth-provider.js';
+import { createOutlineAuthProvider, createOutlineTokenStore, getActiveTokenSource, identifyAccount, prompt, resolveBaseUrl, } from '../lib/auth-provider.js';
 import { refreshedTokenForStatus } from '../lib/auth.js';
 import { CliError } from '../lib/errors.js';
+import { isJsonMode } from '../lib/global-args.js';
+import { withUserRefAware } from '../lib/user-ref-store.js';
 const DEFAULT_OAUTH_CALLBACK_PORT = 54969;
 function resolvePreferredCallbackPort() {
     const raw = process.env.OUTLINE_OAUTH_CALLBACK_PORT?.trim();
@@ -16,28 +20,50 @@ function resolvePreferredCallbackPort() {
     }
     return parsed;
 }
-/**
- * Surface a `TokenStorageResult` from a save/clear: the human-readable
- * confirmation goes to stdout, any keyring-fallback warning goes to stderr.
- * Pass `isMachineOutput: true` to suppress the stdout confirmation in
- * `--json` / `--ndjson` mode while still routing the warning to stderr.
- *
- * Exported for direct unit testing — the alternative (driving this via
- * mocked cli-core login/logout hooks) would require stubbing the entire
- * store contract just to assert two console calls.
- */
-export function logTokenStorageResult(result, secureStoreMessage, isMachineOutput = false) {
-    if (!isMachineOutput && result.storage === 'secure-store') {
-        console.log(chalk.dim(secureStoreMessage));
+async function saveToken(store, token, options) {
+    if (!token) {
+        if (!process.stdin.isTTY) {
+            throw new CliError('NO_TOKEN', 'No token provided', [
+                'Pass it as an argument: ol auth token <token>',
+                'Run in an interactive terminal to be prompted for it',
+                'Set OUTLINE_API_TOKEN to authenticate without storing a token',
+                'Or use OAuth: ol auth login',
+            ]);
+        }
+        token = await prompt('API token: ', { hidden: true });
     }
-    if (result.warning) {
-        console.error(chalk.yellow('Warning:'), result.warning);
+    const trimmed = token.trim();
+    if (!trimmed)
+        throw new CliError('NO_TOKEN', 'No token provided');
+    const baseUrl = await resolveBaseUrl({ baseUrl: options.baseUrl });
+    // A freshly pasted token is verified by probing `auth.info`. Any failure
+    // (bad token, wrong instance, unreachable host) collapses to one stable
+    // error — never surface the raw API/network string.
+    let account;
+    try {
+        account = await identifyAccount(trimmed, baseUrl);
     }
+    catch {
+        throw new CliError('AUTH_VERIFICATION_FAILED', 'Could not verify the token with Outline', [
+            'Check the token value',
+            `Check --base-url matches the instance the token came from (used: ${baseUrl})`,
+        ]);
+    }
+    await store.set(account, trimmed);
+    const machine = isJsonMode();
+    if (!machine) {
+        console.log(chalk.green('✓'), `Saved token for ${account.label} (${account.teamName})`);
+    }
+    logSaveResult(store, machine);
 }
 export function registerAuthCommand(program) {
     const auth = program.command('auth').description('Manage authentication');
     const provider = createOutlineAuthProvider();
     const store = createOutlineTokenStore();
+    // Honours a global `ol --user <ref>` placed before `auth status` / `auth
+    // logout`; login always targets the freshly authenticated account, so it
+    // keeps the raw store.
+    const refAware = withUserRefAware(store);
     attachLoginCommand(auth, {
         provider,
         store,
@@ -50,10 +76,7 @@ export function registerAuthCommand(program) {
             if (!isMachineOutput) {
                 console.log(chalk.green(`Authenticated to ${account.teamName} as ${account.label}`));
             }
-            const result = store.getLastStorageResult();
-            if (result) {
-                logTokenStorageResult(result, 'Token stored securely in the system credential manager', isMachineOutput);
-            }
+            logSaveResult(store, isMachineOutput);
         },
     })
         .description('Authenticate with an Outline instance via OAuth')
@@ -64,7 +87,7 @@ export function registerAuthCommand(program) {
     // populated by the time the render hooks read it.
     let statusData = null;
     attachStatusCommand(auth, {
-        store,
+        store: refAware,
         description: 'Show current authentication state',
         async fetchLive({ account, token }) {
             try {
@@ -77,7 +100,11 @@ export function registerAuthCommand(program) {
                 const liveToken = await refreshedTokenForStatus(account, token);
                 const [{ data: info }, source] = await Promise.all([
                     apiRequest('auth.info', {}, { token: liveToken, baseUrl: account.baseUrl }),
-                    getActiveTokenSource(),
+                    // Scope the source to the selected account so `auth status
+                    // --user <ref>` reports where *that* account's token lives,
+                    // not the default/env source. Empty id (env/legacy snapshot)
+                    // falls back to the default cascade.
+                    getActiveTokenSource(account.id || undefined),
                 ]);
                 statusData = { email: info.user.email, source };
                 return {
@@ -123,14 +150,22 @@ export function registerAuthCommand(program) {
         },
     });
     attachLogoutCommand(auth, {
-        store,
+        store: refAware,
         description: 'Clear saved authentication',
         onCleared({ view }) {
-            const result = store.getLastClearResult();
-            if (!result)
-                return;
-            logTokenStorageResult(result, 'Stored token removed from the system credential manager', view.json || view.ndjson);
+            logClearResult(store, view.json || view.ndjson);
         },
     });
+    const tokenCmd = auth
+        .command('token [token]')
+        .description('Save an Outline API token for CLI auth (or use the `view` subcommand)')
+        .option('--base-url <url>', 'Outline base URL the token belongs to')
+        .action((token, options) => saveToken(store, token, options));
+    attachTokenViewCommand(tokenCmd, {
+        name: 'view',
+        store: refAware,
+        envVarName: TOKEN_ENV_VAR,
+        description: 'Print the stored token for the active user (or --user <ref>) to stdout for scripts',
+    });
 }
 //# sourceMappingURL=auth.js.map

package/dist/commands/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,GAEtB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,EAEH,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,GAGvB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAE3C,MAAM,2BAA2B,GAAG,KAAK,CAAA;AAOzC,SAAS,4BAA4B;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAA;IAC3D,IAAI,CAAC,GAAG;QAAE,OAAO,2BAA2B,CAAA;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,MAAM,EAAE,CAAC;QAC7D,OAAO,2BAA2B,CAAA;IACtC,CAAC;IACD,OAAO,MAAM,CAAA;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACjC,MAA0B,EAC1B,kBAA0B,EAC1B,eAAe,GAAG,KAAK;IAEvB,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAA;IAC9C,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;IAC3D,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAA;IAEzE,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAA;IAC5C,MAAM,KAAK,GAAsB,uBAAuB,EAAE,CAAA;IAE1D,kBAAkB,CAAC,IAAI,EAAE;QACrB,QAAQ;QACR,KAAK;QACL,aAAa,EAAE,4BAA4B,EAAE;QAC7C,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE;QACvB,aAAa;QACb,WAAW;QACX,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;YACvB,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAA;YAChD,IAAI,CAAC,eAAe,EAAE,CAAC;gBACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,OAAO,CAAC,QAAQ,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;YACxF,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,oBAAoB,EAAE,CAAA;YAC3C,IAAI,MAAM,EAAE,CAAC;gBACT,qBAAqB,CACjB,MAAM,EACN,wDAAwD,EACxD,eAAe,CAClB,CAAA;YACL,CAAC;QACL,CAAC;KACJ,CAAC;SACG,WAAW,CAAC,iDAAiD,CAAC;SAC9D,MAAM,CACH,kBAAkB,EAClB,kEAAkE,CACrE;SACA,MAAM,CACH,wBAAwB,EACxB,iEAAiE,CACpE,CAAA;IAEL,0EAA0E;IAC1E,kEAAkE;IAClE,kDAAkD;IAClD,IAAI,UAAU,GAAsB,IAAI,CAAA;IAExC,mBAAmB,CAAiB,IAAI,EAAE;QACtC,KAAK;QACL,WAAW,EAAE,mCAAmC;QAChD,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;YAC9B,IAAI,CAAC;gBACD,8DAA8D;gBAC9D,4DAA4D;gBAC5D,2DAA2D;gBAC3D,4DAA4D;gBAC5D,6DAA6D;gBAC7D,6CAA6C;gBAC7C,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;gBAC/D,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAC/C,UAAU,CACN,WAAW,EACX,EAAE,EACF,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CACjD;oBACD,oBAAoB,EAAE;iBACzB,CAAC,CAAA;gBACF,UAAU,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAA;gBAC/C,OAAO;oBACH,GAAG,OAAO;oBACV,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;oBAChB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;oBACrB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;iBAC3B,CAAA;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;gBACvD,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtE,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,8CAA8C,EAAE;wBAC3E,wCAAwC;qBAC3C,CAAC,CAAA;gBACN,CAAC;gBACD,MAAM,GAAG,CAAA;YACb,CAAC;QACL,CAAC;QACD,UAAU,CAAC,EAAE,OAAO,EAAE;YAClB,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;YAC7E,OAAO;gBACH,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB;gBACnC,WAAW,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE;gBAC/C,WAAW,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,KAAK,GAAG;gBAChD,eAAe,OAAO,CAAC,OAAO,EAAE;gBAChC,mBAAmB,UAAU,CAAC,MAAM,EAAE;aACzC,CAAA;QACL,CAAC;QACD,UAAU,CAAC,EAAE,OAAO,EAAE;YAClB,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;YAC7E,OAAO;gBACH,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,IAAI,EAAE,OAAO,CAAC,QAAQ;gBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM,EAAE,UAAU,CAAC,MAAM;aAC5B,CAAA;QACL,CAAC;QACD,kBAAkB;YACd,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,uCAAuC,CAAC,CAAA;QACpF,CAAC;KACJ,CAAC,CAAA;IAEF,mBAAmB,CAAiB,IAAI,EAAE;QACtC,KAAK;QACL,WAAW,EAAE,4BAA4B;QACzC,SAAS,CAAC,EAAE,IAAI,EAAE;YACd,MAAM,MAAM,GAAG,KAAK,CAAC,kBAAkB,EAAE,CAAA;YACzC,IAAI,CAAC,MAAM;gBAAE,OAAM;YACnB,qBAAqB,CACjB,MAAM,EACN,yDAAyD,EACzD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAC3B,CAAA;QACL,CAAC;KACJ,CAAC,CAAA;AACN,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,GACzB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,EAEH,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,EACpB,eAAe,EAGf,MAAM,EACN,cAAc,GACjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAE3D,MAAM,2BAA2B,GAAG,KAAK,CAAA;AAOzC,SAAS,4BAA4B;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAA;IAC3D,IAAI,CAAC,GAAG;QAAE,OAAO,2BAA2B,CAAA;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,MAAM,EAAE,CAAC;QAC7D,OAAO,2BAA2B,CAAA;IACtC,CAAC;IACD,OAAO,MAAM,CAAA;AACjB,CAAC;AAED,KAAK,UAAU,SAAS,CACpB,KAAwB,EACxB,KAAyB,EACzB,OAA6B;IAE7B,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACvB,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,mBAAmB,EAAE;gBAChD,+CAA+C;gBAC/C,sDAAsD;gBACtD,+DAA+D;gBAC/D,6BAA6B;aAChC,CAAC,CAAA;QACN,CAAC;QACD,KAAK,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC5B,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAA;IAEjE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;IAElE,yEAAyE;IACzE,wEAAwE;IACxE,oDAAoD;IACpD,IAAI,OAAuB,CAAA;IAC3B,IAAI,CAAC;QACD,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,IAAI,QAAQ,CAAC,0BAA0B,EAAE,yCAAyC,EAAE;YACtF,uBAAuB;YACvB,oEAAoE,OAAO,GAAG;SACjF,CAAC,CAAA;IACN,CAAC;IACD,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAEjC,MAAM,OAAO,GAAG,UAAU,EAAE,CAAA;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,mBAAmB,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;IAC3F,CAAC;IACD,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAA;IAEzE,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAA;IAC5C,MAAM,KAAK,GAAsB,uBAAuB,EAAE,CAAA;IAC1D,yEAAyE;IACzE,yEAAyE;IACzE,uBAAuB;IACvB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAExC,kBAAkB,CAAC,IAAI,EAAE;QACrB,QAAQ;QACR,KAAK;QACL,aAAa,EAAE,4BAA4B,EAAE;QAC7C,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE;QACvB,aAAa;QACb,WAAW;QACX,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;YACvB,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAA;YAChD,IAAI,CAAC,eAAe,EAAE,CAAC;gBACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,OAAO,CAAC,QAAQ,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;YACxF,CAAC;YACD,aAAa,CAAC,KAAK,EAAE,eAAe,CAAC,CAAA;QACzC,CAAC;KACJ,CAAC;SACG,WAAW,CAAC,iDAAiD,CAAC;SAC9D,MAAM,CACH,kBAAkB,EAClB,kEAAkE,CACrE;SACA,MAAM,CACH,wBAAwB,EACxB,iEAAiE,CACpE,CAAA;IAEL,0EAA0E;IAC1E,kEAAkE;IAClE,kDAAkD;IAClD,IAAI,UAAU,GAAsB,IAAI,CAAA;IAExC,mBAAmB,CAAiB,IAAI,EAAE;QACtC,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,mCAAmC;QAChD,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;YAC9B,IAAI,CAAC;gBACD,8DAA8D;gBAC9D,4DAA4D;gBAC5D,2DAA2D;gBAC3D,4DAA4D;gBAC5D,6DAA6D;gBAC7D,6CAA6C;gBAC7C,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;gBAC/D,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAC/C,UAAU,CACN,WAAW,EACX,EAAE,EACF,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CACjD;oBACD,2DAA2D;oBAC3D,4DAA4D;oBAC5D,6DAA6D;oBAC7D,qCAAqC;oBACrC,oBAAoB,CAAC,OAAO,CAAC,EAAE,IAAI,SAAS,CAAC;iBAChD,CAAC,CAAA;gBACF,UAAU,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAA;gBAC/C,OAAO;oBACH,GAAG,OAAO;oBACV,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;oBAChB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;oBACrB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;iBAC3B,CAAA;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;gBACvD,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtE,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,8CAA8C,EAAE;wBAC3E,wCAAwC;qBAC3C,CAAC,CAAA;gBACN,CAAC;gBACD,MAAM,GAAG,CAAA;YACb,CAAC;QACL,CAAC;QACD,UAAU,CAAC,EAAE,OAAO,EAAE;YAClB,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;YAC7E,OAAO;gBACH,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB;gBACnC,WAAW,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE;gBAC/C,WAAW,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,KAAK,GAAG;gBAChD,eAAe,OAAO,CAAC,OAAO,EAAE;gBAChC,mBAAmB,UAAU,CAAC,MAAM,EAAE;aACzC,CAAA;QACL,CAAC;QACD,UAAU,CAAC,EAAE,OAAO,EAAE;YAClB,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;YAC7E,OAAO;gBACH,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,IAAI,EAAE,OAAO,CAAC,QAAQ;gBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM,EAAE,UAAU,CAAC,MAAM;aAC5B,CAAA;QACL,CAAC;QACD,kBAAkB;YACd,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,uCAAuC,CAAC,CAAA;QACpF,CAAC;KACJ,CAAC,CAAA;IAEF,mBAAmB,CAAiB,IAAI,EAAE;QACtC,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,4BAA4B;QACzC,SAAS,CAAC,EAAE,IAAI,EAAE;YACd,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,CAAA;QACnD,CAAC;KACJ,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,IAAI;SAChB,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,uEAAuE,CAAC;SACpF,MAAM,CAAC,kBAAkB,EAAE,uCAAuC,CAAC;SACnE,MAAM,CAAC,CAAC,KAAyB,EAAE,OAA6B,EAAE,EAAE,CACjE,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CACnC,CAAA;IAEL,sBAAsB,CAAiB,QAAQ,EAAE;QAC7C,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,QAAQ;QACf,UAAU,EAAE,aAAa;QACzB,WAAW,EACP,oFAAoF;KAC3F,CAAC,CAAA;AACN,CAAC"}

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
 import packageJson from '../package.json' with { type: 'json' };
+import { registerAccountCommand } from './commands/account.js';
 import { registerAuthCommand } from './commands/auth.js';
 import { registerChangelogCommand } from './commands/changelog.js';
 import { registerCollectionCommand } from './commands/collection.js';
@@ -9,7 +10,7 @@ import { registerSearchCommand } from './commands/search.js';
 import { registerSkillCommand } from './commands/skill.js';
 import { registerUpdateCommand } from './commands/update/index.js';
 import { BaseCliError } from './lib/errors.js';
-import { isJsonMode } from './lib/global-args.js';
+import { applyUserSelector, isJsonMode } from './lib/global-args.js';
 import { formatError, formatErrorJson } from './lib/output.js';
 const program = new Command();
 program
@@ -19,23 +20,37 @@ program
     .option('--no-spinner', 'Disable loading animations')
     .option('--accessible', 'Render output in screen-reader-friendly mode')
     .addHelpText('after', `
+Global options:
+  --user <id|name>  Act as a specific stored account (place before the command,
+                    e.g. \`ol --user scott@example.com document list\`).
+
 Note for AI/LLM agents:
   Use --json or --ndjson flags for unambiguous, parseable output.
   Default JSON shows essential fields; use --full for all fields.`);
 registerAuthCommand(program);
+registerAccountCommand(program);
 registerSearchCommand(program);
 registerDocumentCommand(program);
 registerCollectionCommand(program);
 registerSkillCommand(program);
 registerChangelogCommand(program);
 registerUpdateCommand(program);
-program.parseAsync().catch((err) => {
+function reportError(err) {
     if (err instanceof BaseCliError) {
         console.error(isJsonMode() ? formatErrorJson(err) : formatError(err));
     }
     else {
-        console.error(err.message);
+        console.error(err instanceof Error ? err.message : String(err));
     }
     process.exit(1);
-});
+}
+// Commander has no root `--user` option, so validate it and strip it from argv
+// before parsing (see `applyUserSelector` for the warm-cache-then-strip order).
+try {
+    applyUserSelector(new Set(program.commands.map((c) => c.name())));
+}
+catch (err) {
+    reportError(err);
+}
+program.parseAsync().catch(reportError);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,WAAW,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAA;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAA;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAE9D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;AAE7B,OAAO;KACF,IAAI,CAAC,IAAI,CAAC;KACV,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC;KAC5B,WAAW,CAAC,6CAA6C,CAAC;KAC1D,MAAM,CAAC,cAAc,EAAE,4BAA4B,CAAC;KACpD,MAAM,CAAC,cAAc,EAAE,8CAA8C,CAAC;KACtE,WAAW,CACR,OAAO,EACP;;;kEAG0D,CAC7D,CAAA;AAEL,mBAAmB,CAAC,OAAO,CAAC,CAAA;AAC5B,qBAAqB,CAAC,OAAO,CAAC,CAAA;AAC9B,uBAAuB,CAAC,OAAO,CAAC,CAAA;AAChC,yBAAyB,CAAC,OAAO,CAAC,CAAA;AAClC,oBAAoB,CAAC,OAAO,CAAC,CAAA;AAC7B,wBAAwB,CAAC,OAAO,CAAC,CAAA;AACjC,qBAAqB,CAAC,OAAO,CAAC,CAAA;AAE9B,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE;IACtC,IAAI,GAAG,YAAY,YAAY,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IACzE,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC9B,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACnB,CAAC,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,WAAW,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAA;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAA;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACpE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAE9D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;AAE7B,OAAO;KACF,IAAI,CAAC,IAAI,CAAC;KACV,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC;KAC5B,WAAW,CAAC,6CAA6C,CAAC;KAC1D,MAAM,CAAC,cAAc,EAAE,4BAA4B,CAAC;KACpD,MAAM,CAAC,cAAc,EAAE,8CAA8C,CAAC;KACtE,WAAW,CACR,OAAO,EACP;;;;;;;kEAO0D,CAC7D,CAAA;AAEL,mBAAmB,CAAC,OAAO,CAAC,CAAA;AAC5B,sBAAsB,CAAC,OAAO,CAAC,CAAA;AAC/B,qBAAqB,CAAC,OAAO,CAAC,CAAA;AAC9B,uBAAuB,CAAC,OAAO,CAAC,CAAA;AAChC,yBAAyB,CAAC,OAAO,CAAC,CAAA;AAClC,oBAAoB,CAAC,OAAO,CAAC,CAAA;AAC7B,wBAAwB,CAAC,OAAO,CAAC,CAAA;AACjC,qBAAqB,CAAC,OAAO,CAAC,CAAA;AAE9B,SAAS,WAAW,CAAC,GAAY;IAC7B,IAAI,GAAG,YAAY,YAAY,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IACzE,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;IACnE,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACnB,CAAC;AAED,+EAA+E;AAC/E,gFAAgF;AAChF,IAAI,CAAC;IACD,iBAAiB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;AACrE,CAAC;AAAC,OAAO,GAAG,EAAE,CAAC;IACX,WAAW,CAAC,GAAG,CAAC,CAAA;AACpB,CAAC;AAED,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA"}

package/dist/lib/api.js

@@ -1,6 +1,6 @@
 import { fetchWithRetry } from '../transport/fetch-with-retry.js';
 import { TOKEN_ENV_VAR } from './auth-constants.js';
-import { getApiToken, getBaseUrl, proactiveRefresh, reactiveRefresh } from './auth.js';
+import { getApiToken, getRequestContext, proactiveRefresh, reactiveRefresh } from './auth.js';
 import { withSpinner } from './spinner.js';
 /**
  * Spinner configuration mapping API paths to spinner options.
@@ -28,12 +28,13 @@ const API_SPINNER_CONFIG = {
  * On the managed path, prefer the token `proactiveRefresh` resolved (rotated
  * or current) so unrefreshable/access-only accounts stay on a single store
  * read; only fall back to `getApiToken` when proactive refresh bows out.
+ * `handshake` pins the refresh to the `--user` account's instance.
  */
-async function resolveRequestToken(managed, override) {
+async function resolveRequestToken(managed, override, handshake) {
     if (override)
         return override;
     if (managed) {
-        const refreshed = await proactiveRefresh();
+        const refreshed = await proactiveRefresh(handshake);
         if (refreshed)
             return refreshed;
     }
@@ -46,11 +47,21 @@ async function rawApiRequest(path, body = {}, overrides = {}) {
     // Only stored credentials can be refreshed: a caller-supplied token
     // override or the `OUTLINE_API_TOKEN` env var is taken as-is.
     const managed = !overrides.token && !process.env[TOKEN_ENV_VAR]?.trim();
-    // Resolve the base URL and the (proactively refreshed) token in parallel.
-    const [resolvedBaseUrl, resolvedToken] = await Promise.all([
-        overrides.baseUrl ? Promise.resolve(overrides.baseUrl.replace(/\/$/, '')) : getBaseUrl(),
-        resolveRequestToken(managed, overrides.token),
-    ]);
+    // A caller-supplied base URL (login validate, auth status) skips account
+    // resolution — those paths pass an explicit token, so no refresh runs.
+    // Otherwise resolve the request's base URL and, for a `--user` account, the
+    // refresh handshake that keeps rotation pinned to that account's instance.
+    let resolvedBaseUrl;
+    let handshake;
+    if (overrides.baseUrl) {
+        resolvedBaseUrl = overrides.baseUrl.replace(/\/$/, '');
+    }
+    else {
+        const ctx = await getRequestContext();
+        resolvedBaseUrl = ctx.baseUrl;
+        handshake = ctx.handshake;
+    }
+    const resolvedToken = await resolveRequestToken(managed, overrides.token, handshake);
     const performRequest = (token) => fetchWithRetry({
         url: `${resolvedBaseUrl}/api/${path}`,
         options: {
@@ -66,7 +77,7 @@ async function rawApiRequest(path, body = {}, overrides = {}) {
     // Reactive path: a 401 on a managed token triggers a forced rotation and
     // a single retry. `reactiveRefresh` throws `NoTokenError` when the refresh
     // token is gone, so an unrecoverable 401 surfaces the re-login hint.
-    if (res.status === 401 && managed && (await reactiveRefresh())) {
+    if (res.status === 401 && managed && (await reactiveRefresh(handshake))) {
         res = await performRequest(await getApiToken());
     }
     if (!res.ok) {

package/dist/lib/api.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/lib/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACtF,OAAO,EAAuB,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/D;;;GAGG;AACH,MAAM,kBAAkB,GAAmC;IACvD,WAAW,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,MAAM,EAAE;IAClE,kBAAkB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,EAAE;IACrE,gBAAgB,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,EAAE;IACjE,gBAAgB,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE;IAChE,kBAAkB,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE;IACpE,kBAAkB,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACrE,kBAAkB,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACrE,gBAAgB,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACjE,mBAAmB,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACvE,qBAAqB,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,QAAQ,EAAE;IAC3E,kBAAkB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,EAAE;IACrE,kBAAkB,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,EAAE;IACpE,oBAAoB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,OAAO,EAAE;IACxE,oBAAoB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACzE,oBAAoB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,QAAQ,EAAE;CAC5E,CAAA;AA8BD;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAAC,OAAgB,EAAE,QAAiB;IAClE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,IAAI,OAAO,EAAE,CAAC;QACV,MAAM,SAAS,GAAG,MAAM,gBAAgB,EAAE,CAAA;QAC1C,IAAI,SAAS;YAAE,OAAO,SAAS,CAAA;IACnC,CAAC;IACD,OAAO,WAAW,EAAE,CAAA;AACxB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,aAAa,CACxB,IAAY,EACZ,OAAe,EAAE,EACjB,YAAiC,EAAE;IAEnC,oEAAoE;IACpE,8DAA8D;IAC9D,MAAM,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAA;IAEvE,0EAA0E;IAC1E,MAAM,CAAC,eAAe,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACvD,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE;QACxF,mBAAmB,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC;KAChD,CAAC,CAAA;IAEF,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,EAAE,CACrC,cAAc,CAAC;QACX,GAAG,EAAE,GAAG,eAAe,QAAQ,IAAI,EAAE;QACrC,OAAO,EAAE;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACL,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,EAAE;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC7B;KACJ,CAAC,CAAA;IAEN,IAAI,GAAG,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,CAAA;IAE7C,yEAAyE;IACzE,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,IAAI,CAAC,MAAM,eAAe,EAAE,CAAC,EAAE,CAAC;QAC7D,GAAG,GAAG,MAAM,cAAc,CAAC,MAAM,WAAW,EAAE,CAAC,CAAA;IACnD,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACV,IAAI,OAAO,GAAG,cAAc,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAA;QAC1D,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAa,CAAA;YAC1C,IAAI,GAAG,CAAC,OAAO;gBAAE,OAAO,GAAG,cAAc,GAAG,CAAC,OAAO,EAAE,CAAA;QAC1D,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAA;IAC5B,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmB,CAAA;IACjD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAA;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC5B,IAAY,EACZ,OAAe,EAAE,EACjB,YAAiC,EAAE;IAEnC,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI;QAC9C,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,MAAe;KACzB,CAAA;IAED,OAAO,WAAW,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,aAAa,CAAI,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAA;AACpF,CAAC"}
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/lib/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC7F,OAAO,EAAuB,WAAW,EAAE,MAAM,cAAc,CAAA;AAI/D;;;GAGG;AACH,MAAM,kBAAkB,GAAmC;IACvD,WAAW,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,MAAM,EAAE;IAClE,kBAAkB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,EAAE;IACrE,gBAAgB,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,EAAE;IACjE,gBAAgB,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE;IAChE,kBAAkB,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE;IACpE,kBAAkB,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACrE,kBAAkB,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACrE,gBAAgB,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACjE,mBAAmB,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACvE,qBAAqB,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,QAAQ,EAAE;IAC3E,kBAAkB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,EAAE;IACrE,kBAAkB,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,EAAE;IACpE,oBAAoB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,OAAO,EAAE;IACxE,oBAAoB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACzE,oBAAoB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,QAAQ,EAAE;CAC5E,CAAA;AA8BD;;;;;;GAMG;AACH,KAAK,UAAU,mBAAmB,CAC9B,OAAgB,EAChB,QAAiB,EACjB,SAA4B;IAE5B,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,IAAI,OAAO,EAAE,CAAC;QACV,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAA;QACnD,IAAI,SAAS;YAAE,OAAO,SAAS,CAAA;IACnC,CAAC;IACD,OAAO,WAAW,EAAE,CAAA;AACxB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,aAAa,CACxB,IAAY,EACZ,OAAe,EAAE,EACjB,YAAiC,EAAE;IAEnC,oEAAoE;IACpE,8DAA8D;IAC9D,MAAM,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAA;IAEvE,yEAAyE;IACzE,uEAAuE;IACvE,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,eAAuB,CAAA;IAC3B,IAAI,SAAuC,CAAA;IAC3C,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACpB,eAAe,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC1D,CAAC;SAAM,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,iBAAiB,EAAE,CAAA;QACrC,eAAe,GAAG,GAAG,CAAC,OAAO,CAAA;QAC7B,SAAS,GAAG,GAAG,CAAC,SAAS,CAAA;IAC7B,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IAEpF,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,EAAE,CACrC,cAAc,CAAC;QACX,GAAG,EAAE,GAAG,eAAe,QAAQ,IAAI,EAAE;QACrC,OAAO,EAAE;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACL,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,EAAE;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC7B;KACJ,CAAC,CAAA;IAEN,IAAI,GAAG,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,CAAA;IAE7C,yEAAyE;IACzE,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,IAAI,CAAC,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,GAAG,MAAM,cAAc,CAAC,MAAM,WAAW,EAAE,CAAC,CAAA;IACnD,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACV,IAAI,OAAO,GAAG,cAAc,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAA;QAC1D,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAa,CAAA;YAC1C,IAAI,GAAG,CAAC,OAAO;gBAAE,OAAO,GAAG,cAAc,GAAG,CAAC,OAAO,EAAE,CAAA;QAC1D,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAA;IAC5B,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmB,CAAA;IACjD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAA;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC5B,IAAY,EACZ,OAAe,EAAE,EACjB,YAAiC,EAAE;IAEnC,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI;QAC9C,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,MAAe;KACzB,CAAA;IAED,OAAO,WAAW,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,aAAa,CAAI,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAA;AACpF,CAAC"}

package/dist/lib/auth-output.d.ts

@@ -0,0 +1,21 @@
+import type { TokenStorageResult } from '@doist/cli-core/auth';
+import type { OutlineTokenStore } from './auth-provider.js';
+/**
+ * Surface a `TokenStorageResult` from a save/clear: the human-readable
+ * confirmation goes to stdout, any keyring-fallback warning goes to stderr.
+ * Pass `isMachineOutput: true` to suppress the stdout confirmation in
+ * `--json` / `--ndjson` mode while still routing the warning to stderr.
+ */
+export declare function logTokenStorageResult(result: TokenStorageResult, secureStoreMessage: string, isMachineOutput?: boolean): void;
+/**
+ * Surface the result of a token save (`auth login` / `auth token`): the
+ * confirmation goes to stdout, any keyring-fallback warning to stderr. Shared so
+ * both save flows keep identical machine-output and warning behavior.
+ */
+export declare function logSaveResult(store: OutlineTokenStore, isMachineOutput: boolean): void;
+/**
+ * Surface the result of a token clear (`auth logout` / `account remove`): the
+ * confirmation goes to stdout, any keyring-fallback warning to stderr. Shared so
+ * both call sites stay in lockstep.
+ */
+export declare function logClearResult(store: OutlineTokenStore, isMachineOutput: boolean): void;

package/dist/lib/auth-output.js

@@ -0,0 +1,38 @@
+import chalk from 'chalk';
+/**
+ * Surface a `TokenStorageResult` from a save/clear: the human-readable
+ * confirmation goes to stdout, any keyring-fallback warning goes to stderr.
+ * Pass `isMachineOutput: true` to suppress the stdout confirmation in
+ * `--json` / `--ndjson` mode while still routing the warning to stderr.
+ */
+export function logTokenStorageResult(result, secureStoreMessage, isMachineOutput = false) {
+    if (!isMachineOutput && result.storage === 'secure-store') {
+        console.log(chalk.dim(secureStoreMessage));
+    }
+    if (result.warning) {
+        console.error(chalk.yellow('Warning:'), result.warning);
+    }
+}
+/**
+ * Surface the result of a token save (`auth login` / `auth token`): the
+ * confirmation goes to stdout, any keyring-fallback warning to stderr. Shared so
+ * both save flows keep identical machine-output and warning behavior.
+ */
+export function logSaveResult(store, isMachineOutput) {
+    const result = store.getLastStorageResult();
+    if (!result)
+        return;
+    logTokenStorageResult(result, 'Token stored securely in the system credential manager', isMachineOutput);
+}
+/**
+ * Surface the result of a token clear (`auth logout` / `account remove`): the
+ * confirmation goes to stdout, any keyring-fallback warning to stderr. Shared so
+ * both call sites stay in lockstep.
+ */
+export function logClearResult(store, isMachineOutput) {
+    const result = store.getLastClearResult();
+    if (!result)
+        return;
+    logTokenStorageResult(result, 'Stored token removed from the system credential manager', isMachineOutput);
+}
+//# sourceMappingURL=auth-output.js.map

package/dist/lib/auth-output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-output.js","sourceRoot":"","sources":["../../src/lib/auth-output.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAA;AAGzB;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACjC,MAA0B,EAC1B,kBAA0B,EAC1B,eAAe,GAAG,KAAK;IAEvB,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAA;IAC9C,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;IAC3D,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAwB,EAAE,eAAwB;IAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,oBAAoB,EAAE,CAAA;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAM;IACnB,qBAAqB,CACjB,MAAM,EACN,wDAAwD,EACxD,eAAe,CAClB,CAAA;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAwB,EAAE,eAAwB;IAC7E,MAAM,MAAM,GAAG,KAAK,CAAC,kBAAkB,EAAE,CAAA;IACzC,IAAI,CAAC,MAAM;QAAE,OAAM;IACnB,qBAAqB,CACjB,MAAM,EACN,yDAAyD,EACzD,eAAe,CAClB,CAAA;AACL,CAAC"}