@doist/outline-cli 1.8.0 → 1.10.0

package/dist/lib/auth-provider.d.ts

@@ -1,6 +1,7 @@
 import { type AccountRef, type AuthProvider, type KeyringTokenStore } from '@doist/cli-core/auth';
 import { type OutlineAccount } from './outline-account.js';
 export type { OutlineAccount } from './outline-account.js';
+export { matchOutlineAccount } from './outline-account.js';
 export type AuthInfoResponse = {
     user: {
         id: string;
@@ -13,13 +14,25 @@ export type AuthInfoResponse = {
     };
 };
 export type OutlineTokenStore = KeyringTokenStore<OutlineAccount>;
-export declare function createOutlineAuthProvider(): AuthProvider<OutlineAccount>;
 /**
- * Accepts the Outline user UUID or display name. Id matches are
- * case-sensitive (UUIDs are canonical); label matches are
- * case-insensitive so users can pass the name they see in `auth status`.
+ * Read a line from stdin, prompting on stderr so `--json` / `--ndjson`
+ * envelopes on stdout stay clean. With `hidden: true` the typed characters are
+ * masked (for secrets): the prompt label is shown, then readline's echo is
+ * routed through a muted `Writable` so keystrokes don't leak to the terminal.
  */
-export declare function matchOutlineAccount(account: OutlineAccount, ref: AccountRef): boolean;
+export declare function prompt(question: string, options?: {
+    hidden?: boolean;
+}): Promise<string>;
+export declare function resolveBaseUrl(options?: {
+    baseUrl?: unknown;
+}): Promise<string>;
+/**
+ * Verify a token by probing `auth.info` and map the response to the persisted
+ * account shape. Shared by the OAuth `validate` hook and `auth token` so the
+ * identity-resolution rules live in one place.
+ */
+export declare function identifyAccount(token: string, baseUrl: string, oauthClientId?: string): Promise<OutlineAccount>;
+export declare function createOutlineAuthProvider(): AuthProvider<OutlineAccount>;
 /**
  * True when the v2 store is empty but a legacy v1 token snapshot is still
  * the only thing keeping the CLI authenticated — typically because
@@ -29,26 +42,39 @@ export declare function matchOutlineAccount(account: OutlineAccount, ref: Accoun
  * v1 keyring slot to read from). Useful for downstream diagnostics.
  */
 export declare function isLegacyAuthActive(): Promise<boolean>;
+/** Where `ol account current` resolves the active credential from. */
+export type ActiveAccountSource = {
+    source: 'stored';
+    account: OutlineAccount;
+    isDefault: boolean;
+} | {
+    source: 'env';
+} | {
+    source: 'legacy';
+} | null;
 /**
- * `OUTLINE_API_TOKEN` short-circuits `active()` only when no explicit ref
- * is supplied — cli-core's `KeyringTokenStore` doesn't know about the env
- * var, and an explicit ref means the caller targets a specific stored
- * account.
+ * Authoritatively classify the active credential without re-deriving the
+ * cascade from membership heuristics. Mirrors `active()`'s precedence — env
+ * (only when no explicit ref) → stored v2 → legacy snapshot — but reports
+ * *which* branch matched, so `ol account current` can render the right shape.
  *
- * `ensureMigrated()` runs **before** every mutating v2 op so the post-op
- * legacy discharge can't race a still-pending migration into re-grabbing
- * the legacy `api_token` we just consumed. `set()` / `clear()` then
- * discharge legacy state **after** the v2 op succeeds. `set()` swallows
- * the cleanup failure (v2 wins in `active()` regardless); `clear()`
- * propagates it so a failed logout fails loudly instead of leaving the
- * user authenticated via the legacy fallback.
+ * The v2 lookup uses the bare keyring store (no legacy fallback) and matches by
+ * `ref`, so a renamed legacy snapshot sharing a UUID with a v2 record can't be
+ * misreported as `stored`: a `--user <old-name>` that the v2 record no longer
+ * matches falls through to the legacy branch.
  */
+export declare function resolveActiveAccountSource(ref?: AccountRef): Promise<ActiveAccountSource>;
 export declare function createOutlineTokenStore(): OutlineTokenStore;
 /**
  * Where the currently-active token lives. Mirrors `active()`'s resolution
  * order — env → v2 record → legacy plaintext — so the answer can never
  * contradict the token the runtime is actually using.
  *
+ * Pass `ref` to report the source of a specific `--user` account (used by
+ * `auth status --user <ref>`): a ref selects the matching record and skips the
+ * env short-circuit, so the source reflects the account being shown rather
+ * than an ambient env token. Without a ref the default/env cascade applies.
+ *
  * The precedence cascade is intentionally duplicated with `active()`:
  * the only true dedupe options either (a) add an extra config read on
  * every `apiRequest` call (regressing the request hot path) or (b)
@@ -56,4 +82,4 @@ export declare function createOutlineTokenStore(): OutlineTokenStore;
  * invites is guarded by the `getActiveTokenSource` regression test that
  * asserts v2-record presence wins over a lingering v1 `api_token`.
  */
-export declare function getActiveTokenSource(): Promise<'env' | 'secure-store' | 'config-file'>;
+export declare function getActiveTokenSource(ref?: AccountRef): Promise<'env' | 'secure-store' | 'config-file'>;

package/dist/lib/auth-provider.js

@@ -1,4 +1,5 @@
 import { createInterface } from 'node:readline/promises';
+import { Writable } from 'node:stream';
 import { createKeyringTokenStore, createPkceProvider, } from '@doist/cli-core/auth';
 import { fetchWithRetry } from '../transport/fetch-with-retry.js';
 import { apiRequest } from './api.js';
@@ -6,35 +7,82 @@ import { LEGACY_CLEAR_PAYLOAD, SECURE_STORE_SERVICE, TOKEN_ENV_VAR } from './aut
 import { getBaseUrl, getOAuthClientId } from './auth.js';
 import { getConfig, getConfigPath, updateConfig } from './config.js';
 import { runMigrateLegacyAuth } from './migrate-auth.js';
-import { makeOutlineAccount } from './outline-account.js';
-import { createOutlineUserRecordStore, getDefaultUserRecord } from './user-records.js';
-function stringFlag(flags, key) {
-    const value = flags[key];
+import { makeOutlineAccount, matchOutlineAccount } from './outline-account.js';
+import { createOutlineUserRecordStore, getDefaultUserRecord, recordForRef } from './user-records.js';
+export { matchOutlineAccount } from './outline-account.js';
+function stringFlag(value) {
     return typeof value === 'string' && value.trim() ? value.trim() : undefined;
 }
-async function prompt(question) {
-    // Output to stderr so `--json` / `--ndjson` envelopes on stdout stay clean.
-    const rl = createInterface({ input: process.stdin, output: process.stderr });
+/**
+ * Read a line from stdin, prompting on stderr so `--json` / `--ndjson`
+ * envelopes on stdout stay clean. With `hidden: true` the typed characters are
+ * masked (for secrets): the prompt label is shown, then readline's echo is
+ * routed through a muted `Writable` so keystrokes don't leak to the terminal.
+ */
+export async function prompt(question, options = {}) {
+    if (!options.hidden) {
+        const rl = createInterface({ input: process.stdin, output: process.stderr });
+        try {
+            return (await rl.question(question)).trim();
+        }
+        finally {
+            rl.close();
+        }
+    }
+    // Echo the prompt label, then mute so typed characters aren't shown. A muted
+    // `Writable` (public API) avoids poking readline's private `_writeToOutput`.
+    let muted = false;
+    const output = new Writable({
+        write(chunk, _encoding, callback) {
+            if (!muted)
+                process.stderr.write(chunk);
+            callback();
+        },
+    });
+    const rl = createInterface({ input: process.stdin, output, terminal: true });
     try {
-        return (await rl.question(question)).trim();
+        const pending = rl.question(question);
+        muted = true;
+        const answer = (await pending).trim();
+        process.stderr.write('\n');
+        return answer;
     }
     finally {
         rl.close();
     }
 }
-async function resolveBaseUrl(flags) {
-    const fromFlag = stringFlag(flags, 'baseUrl');
+export async function resolveBaseUrl(options = {}) {
+    const fromFlag = stringFlag(options.baseUrl);
     if (fromFlag)
         return fromFlag.replace(/\/$/, '');
     const fromEnv = process.env.OUTLINE_URL?.trim();
     if (fromEnv)
         return fromEnv.replace(/\/$/, '');
     const configured = await getBaseUrl();
+    // Never block a non-interactive shell (CI, piped input) on a prompt —
+    // `auth token` is meant to be scriptable, so fall back to the default.
+    if (!process.stdin.isTTY)
+        return configured.replace(/\/$/, '');
     const answered = await prompt(`Base URL (default: ${configured}): `);
     return (answered || configured).replace(/\/$/, '');
 }
+/**
+ * Verify a token by probing `auth.info` and map the response to the persisted
+ * account shape. Shared by the OAuth `validate` hook and `auth token` so the
+ * identity-resolution rules live in one place.
+ */
+export async function identifyAccount(token, baseUrl, oauthClientId) {
+    const { data } = await apiRequest('auth.info', {}, { token, baseUrl });
+    return makeOutlineAccount({
+        id: data.user.id,
+        label: data.user.name,
+        baseUrl,
+        oauthClientId,
+        teamName: data.team.name,
+    });
+}
 async function resolveClientId(flags) {
-    const fromFlag = stringFlag(flags, 'clientId');
+    const fromFlag = stringFlag(flags.clientId);
     if (fromFlag)
         return fromFlag;
     const existing = await getOAuthClientId();
@@ -83,28 +131,11 @@ export function createOutlineAuthProvider() {
         },
         validate: async ({ token, handshake }) => {
             const base = baseUrl ?? (await getBaseUrl());
-            const { data } = await apiRequest('auth.info', {}, { token, baseUrl: base });
-            return makeOutlineAccount({
-                id: data.user.id,
-                label: data.user.name,
-                baseUrl: base,
-                oauthClientId: handshake.clientId,
-                teamName: data.team.name,
-            });
+            return identifyAccount(token, base, handshake.clientId);
         },
         fetchImpl: outlineFetch,
     });
 }
-/**
- * Accepts the Outline user UUID or display name. Id matches are
- * case-sensitive (UUIDs are canonical); label matches are
- * case-insensitive so users can pass the name they see in `auth status`.
- */
-export function matchOutlineAccount(account, ref) {
-    if (account.id === ref)
-        return true;
-    return account.label.toLowerCase() === ref.toLowerCase();
-}
 /** True when the v2 store is the authoritative source. */
 function migrationIsConclusive(result) {
     return (result.status === 'migrated' ||
@@ -190,13 +221,41 @@ export async function isLegacyAuthActive() {
  * propagates it so a failed logout fails loudly instead of leaving the
  * user authenticated via the legacy fallback.
  */
-export function createOutlineTokenStore() {
-    const inner = createKeyringTokenStore({
+/** The bare cli-core keyring store (v2 records only — no env/legacy fallback). */
+function createInnerStore() {
+    return createKeyringTokenStore({
         serviceName: SECURE_STORE_SERVICE,
         userRecords: createOutlineUserRecordStore(),
         recordsLocation: getConfigPath(),
         matchAccount: matchOutlineAccount,
     });
+}
+/**
+ * Authoritatively classify the active credential without re-deriving the
+ * cascade from membership heuristics. Mirrors `active()`'s precedence — env
+ * (only when no explicit ref) → stored v2 → legacy snapshot — but reports
+ * *which* branch matched, so `ol account current` can render the right shape.
+ *
+ * The v2 lookup uses the bare keyring store (no legacy fallback) and matches by
+ * `ref`, so a renamed legacy snapshot sharing a UUID with a v2 record can't be
+ * misreported as `stored`: a `--user <old-name>` that the v2 record no longer
+ * matches falls through to the legacy branch.
+ */
+export async function resolveActiveAccountSource(ref) {
+    if (ref === undefined && process.env[TOKEN_ENV_VAR]?.trim())
+        return { source: 'env' };
+    await ensureMigrated();
+    const stored = await createInnerStore().activeAccount(ref);
+    if (stored)
+        return { source: 'stored', account: stored.account, isDefault: stored.isDefault };
+    const legacy = await readLegacyTokenSnapshot();
+    if (legacy && (ref === undefined || matchOutlineAccount(legacy.account, ref))) {
+        return { source: 'legacy' };
+    }
+    return null;
+}
+export function createOutlineTokenStore() {
+    const inner = createInnerStore();
     async function migrationIsInconclusive() {
         const result = await ensureMigrated(); // memoised
         return result === null || !migrationIsConclusive(result);
@@ -239,6 +298,9 @@ export function createOutlineTokenStore() {
         active(ref) {
             return resolveAuth(ref, () => inner.active(ref), (token, account) => ({ token, account }));
         },
+        activeAccount(ref) {
+            return resolveAuth(ref, () => inner.activeAccount(ref), (_token, account) => ({ account, isDefault: true }));
+        },
         activeBundle(ref) {
             return resolveAuth(ref, () => inner.activeBundle(ref), (token, account) => ({ account, bundle: { accessToken: token } }));
         },
@@ -250,12 +312,13 @@ export function createOutlineTokenStore() {
         },
         async clear(ref) {
             await ensureMigrated();
-            await inner.clear(ref);
+            const cleared = await inner.clear(ref);
             if (await migrationIsInconclusive()) {
                 // Must succeed: v2 is now empty, so a surviving legacy
                 // token would shadow the logout via the fallback.
                 await dischargeLegacyState();
             }
+            return cleared;
         },
         async list() {
             await ensureMigrated();
@@ -274,6 +337,11 @@ export function createOutlineTokenStore() {
  * order — env → v2 record → legacy plaintext — so the answer can never
  * contradict the token the runtime is actually using.
  *
+ * Pass `ref` to report the source of a specific `--user` account (used by
+ * `auth status --user <ref>`): a ref selects the matching record and skips the
+ * env short-circuit, so the source reflects the account being shown rather
+ * than an ambient env token. Without a ref the default/env cascade applies.
+ *
  * The precedence cascade is intentionally duplicated with `active()`:
  * the only true dedupe options either (a) add an extra config read on
  * every `apiRequest` call (regressing the request hot path) or (b)
@@ -281,14 +349,14 @@ export function createOutlineTokenStore() {
  * invites is guarded by the `getActiveTokenSource` regression test that
  * asserts v2-record presence wins over a lingering v1 `api_token`.
  */
-export async function getActiveTokenSource() {
-    if (process.env[TOKEN_ENV_VAR]?.trim())
+export async function getActiveTokenSource(ref) {
+    if (ref === undefined && process.env[TOKEN_ENV_VAR]?.trim())
         return 'env';
     const config = await getConfig();
-    const record = getDefaultUserRecord(config);
+    const record = ref !== undefined ? recordForRef(config, ref) : getDefaultUserRecord(config);
     if (record)
         return record.fallbackToken ? 'config-file' : 'secure-store';
-    if (config.api_token?.trim())
+    if (ref === undefined && config.api_token?.trim())
         return 'config-file';
     return 'secure-store';
 }

package/dist/lib/auth-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-provider.js","sourceRoot":"","sources":["../../src/lib/auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAGH,uBAAuB,EACvB,kBAAkB,GAIrB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC/F,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAuB,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAWtF,SAAS,UAAU,CAAC,KAA8B,EAAE,GAAW;IAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;IACxB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/E,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,QAAgB;IAClC,4EAA4E;IAC5E,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAC5E,IAAI,CAAC;QACD,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC/C,CAAC;YAAS,CAAC;QACP,EAAE,CAAC,KAAK,EAAE,CAAA;IACd,CAAC;AACL,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAA8B;IACxD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IAC7C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAA;IAC/C,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC9C,MAAM,UAAU,GAAG,MAAM,UAAU,EAAE,CAAA;IACrC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,sBAAsB,UAAU,KAAK,CAAC,CAAA;IACpE,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACtD,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAA8B;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC9C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,EAAE,CAAA;IACzC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACX,wIAAwI,CAC3I,CAAA;IACL,CAAC;IACD,OAAO,QAAQ,CAAA;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,YAAY,GAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAC/C,cAAc,CAAC,EAAE,GAAG,EAAE,KAA0B,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;AAE5E,MAAM,UAAU,yBAAyB;IACrC,kEAAkE;IAClE,uEAAuE;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,kCAAkC;IAClC,IAAI,OAA2B,CAAA;IAC/B,OAAO,kBAAkB,CAAiB;QACtC,YAAY,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAC9B,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAA;YACrC,OAAO,GAAG,OAAO,kBAAkB,CAAA;QACvC,CAAC;QACD,QAAQ,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;YAC9B,gEAAgE;YAChE,mEAAmE;YACnE,kCAAkC;YAClC,MAAM,IAAI,GACN,OAAO,IAAK,SAAS,CAAC,OAA8B,IAAI,CAAC,MAAM,UAAU,EAAE,CAAC,CAAA;YAChF,OAAO,GAAG,IAAI,cAAc,CAAA;QAChC,CAAC;QACD,oEAAoE;QACpE,sEAAsE;QACtE,gEAAgE;QAChE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE;YAC/B,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAA;YACxC,OAAO,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa;gBACrD,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;QAChC,CAAC;QACD,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,MAAM,UAAU,EAAE,CAAC,CAAA;YAC5C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAC7B,WAAW,EACX,EAAE,EACF,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAC3B,CAAA;YACD,OAAO,kBAAkB,CAAC;gBACtB,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;gBAChB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;gBACrB,OAAO,EAAE,IAAI;gBACb,aAAa,EAAE,SAAS,CAAC,QAAkB;gBAC3C,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;aAC3B,CAAC,CAAA;QACN,CAAC;QACD,SAAS,EAAE,YAAY;KAC1B,CAAC,CAAA;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAuB,EAAE,GAAe;IACxE,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACnC,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CAAA;AAC5D,CAAC;AAED,0DAA0D;AAC1D,SAAS,qBAAqB,CAAC,MAAyC;IACpE,OAAO,CACH,MAAM,CAAC,MAAM,KAAK,UAAU;QAC5B,MAAM,CAAC,MAAM,KAAK,kBAAkB;QACpC,MAAM,CAAC,MAAM,KAAK,iBAAiB,CACtC,CAAA;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,uBAAuB;IAIlC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,IAAI,CAAA;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,OAAO;QACH,KAAK;QACL,OAAO,EAAE,kBAAkB,CAAC;YACxB,EAAE,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YAC7B,KAAK,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;YAClC,OAAO,EAAE,MAAM,CAAC,QAAQ;YACxB,aAAa,EAAE,MAAM,CAAC,eAAe;YACrC,QAAQ,EAAE,MAAM,CAAC,cAAc;SAClC,CAAC;KACL,CAAA;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB;IAC/B,MAAM,YAAY,CAAC,oBAAoB,CAAC,CAAA;AAC5C,CAAC;AAED;;;;;GAKG;AACH,IAAI,gBAA+E,CAAA;AACnF,SAAS,cAAc;IACnB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpB,gBAAgB,GAAG,oBAAoB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAC/E,CAAC;IACD,OAAO,gBAAgB,CAAA;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACpC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAA;IACrC,IAAI,MAAM,KAAK,IAAI,IAAI,qBAAqB,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IAClE,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;IAC9C,OAAO,MAAM,KAAK,IAAI,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB;IACnC,MAAM,KAAK,GAAG,uBAAuB,CAAiB;QAClD,WAAW,EAAE,oBAAoB;QACjC,WAAW,EAAE,4BAA4B,EAAE;QAC3C,eAAe,EAAE,aAAa,EAAE;QAChC,YAAY,EAAE,mBAAmB;KACpC,CAAC,CAAA;IACF,KAAK,UAAU,uBAAuB;QAClC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAA,CAAC,WAAW;QACjD,OAAO,MAAM,KAAK,IAAI,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAC5D,CAAC;IACD;;;;;OAKG;IACH,KAAK,UAAU,WAAW,CACtB,GAA2B,EAC3B,MAA+B,EAC/B,eAA8D;QAE9D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAA;YACnD,IAAI,QAAQ,EAAE,CAAC;gBACX,OAAO,eAAe,CAClB,QAAQ,EACR,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,UAAU,EAAE,EAAE,CAAC,CACzE,CAAA;YACL,CAAC;QACL,CAAC;QACD,MAAM,cAAc,EAAE,CAAA;QACtB,MAAM,SAAS,GAAG,MAAM,MAAM,EAAE,CAAA;QAChC,IAAI,SAAS;YAAE,OAAO,SAAS,CAAA;QAC/B,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;QAC9C,IAAI,MAAM,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5E,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACxD,CAAC;QACD,OAAO,IAAI,CAAA;IACf,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,wEAAwE;IACxE,KAAK,UAAU,wBAAwB,CAAC,KAA0B;QAC9D,MAAM,cAAc,EAAE,CAAA;QACtB,MAAM,KAAK,EAAE,CAAA;QACb,IAAI,MAAM,uBAAuB,EAAE,EAAE,CAAC;YAClC,MAAM,oBAAoB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACvD,CAAC;IACL,CAAC;IAED,OAAO;QACH,MAAM,CAAC,GAAgB;YACnB,OAAO,WAAW,CACd,GAAG,EACH,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EACvB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAC3C,CAAA;QACL,CAAC;QACD,YAAY,CAAC,GAAgB;YACzB,OAAO,WAAW,CACd,GAAG,EACH,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,EAC7B,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC,CACpE,CAAA;QACL,CAAC;QACD,GAAG,CAAC,OAAuB,EAAE,KAAa;YACtC,OAAO,wBAAwB,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;QACpE,CAAC;QACD,SAAS,CAAC,OAAuB,EAAE,MAAmB,EAAE,OAAO;YAC3D,OAAO,wBAAwB,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;QACpF,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAgB;YACxB,MAAM,cAAc,EAAE,CAAA;YACtB,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACtB,IAAI,MAAM,uBAAuB,EAAE,EAAE,CAAC;gBAClC,uDAAuD;gBACvD,kDAAkD;gBAClD,MAAM,oBAAoB,EAAE,CAAA;YAChC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,IAAI;YACN,MAAM,cAAc,EAAE,CAAA;YACtB,OAAO,KAAK,CAAC,IAAI,EAAE,CAAA;QACvB,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,GAAe;YAC5B,MAAM,cAAc,EAAE,CAAA;YACtB,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAChC,CAAC;QACD,oBAAoB,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE;QACxD,kBAAkB,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,kBAAkB,EAAE;KACvD,CAAA;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACtC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE;QAAE,OAAO,KAAK,CAAA;IACpD,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAA;IACxE,IAAI,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE;QAAE,OAAO,aAAa,CAAA;IAClD,OAAO,cAAc,CAAA;AACzB,CAAC"}
+{"version":3,"file":"auth-provider.js","sourceRoot":"","sources":["../../src/lib/auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,EAGH,uBAAuB,EACvB,kBAAkB,GAIrB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC/F,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAuB,MAAM,sBAAsB,CAAA;AACnG,OAAO,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAGpG,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAS1D,SAAS,UAAU,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CACxB,QAAgB,EAChB,UAAgC,EAAE;IAElC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;QAC5E,IAAI,CAAC;YACD,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC/C,CAAC;gBAAS,CAAC;YACP,EAAE,CAAC,KAAK,EAAE,CAAA;QACd,CAAC;IACL,CAAC;IACD,6EAA6E;IAC7E,6EAA6E;IAC7E,IAAI,KAAK,GAAG,KAAK,CAAA;IACjB,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC;QACxB,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ;YAC5B,IAAI,CAAC,KAAK;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACvC,QAAQ,EAAE,CAAA;QACd,CAAC;KACJ,CAAC,CAAA;IACF,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IAC5E,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACrC,KAAK,GAAG,IAAI,CAAA;QACZ,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;QACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC1B,OAAO,MAAM,CAAA;IACjB,CAAC;YAAS,CAAC;QACP,EAAE,CAAC,KAAK,EAAE,CAAA;IACd,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAiC,EAAE;IACpE,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAA;IAC/C,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC9C,MAAM,UAAU,GAAG,MAAM,UAAU,EAAE,CAAA;IACrC,sEAAsE;IACtE,uEAAuE;IACvE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC9D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,sBAAsB,UAAU,KAAK,CAAC,CAAA;IACpE,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACjC,KAAa,EACb,OAAe,EACf,aAAsB;IAEtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAmB,WAAW,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IACxF,OAAO,kBAAkB,CAAC;QACtB,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QAChB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;QACrB,OAAO;QACP,aAAa;QACb,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;KAC3B,CAAC,CAAA;AACN,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAA8B;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC3C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,EAAE,CAAA;IACzC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACX,wIAAwI,CAC3I,CAAA;IACL,CAAC;IACD,OAAO,QAAQ,CAAA;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,YAAY,GAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAC/C,cAAc,CAAC,EAAE,GAAG,EAAE,KAA0B,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;AAE5E,MAAM,UAAU,yBAAyB;IACrC,kEAAkE;IAClE,uEAAuE;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,kCAAkC;IAClC,IAAI,OAA2B,CAAA;IAC/B,OAAO,kBAAkB,CAAiB;QACtC,YAAY,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAC9B,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAA;YACrC,OAAO,GAAG,OAAO,kBAAkB,CAAA;QACvC,CAAC;QACD,QAAQ,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;YAC9B,gEAAgE;YAChE,mEAAmE;YACnE,kCAAkC;YAClC,MAAM,IAAI,GACN,OAAO,IAAK,SAAS,CAAC,OAA8B,IAAI,CAAC,MAAM,UAAU,EAAE,CAAC,CAAA;YAChF,OAAO,GAAG,IAAI,cAAc,CAAA;QAChC,CAAC;QACD,oEAAoE;QACpE,sEAAsE;QACtE,gEAAgE;QAChE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE;YAC/B,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAA;YACxC,OAAO,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa;gBACrD,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;QAChC,CAAC;QACD,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,MAAM,UAAU,EAAE,CAAC,CAAA;YAC5C,OAAO,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,QAAkB,CAAC,CAAA;QACrE,CAAC;QACD,SAAS,EAAE,YAAY;KAC1B,CAAC,CAAA;AACN,CAAC;AAED,0DAA0D;AAC1D,SAAS,qBAAqB,CAAC,MAAyC;IACpE,OAAO,CACH,MAAM,CAAC,MAAM,KAAK,UAAU;QAC5B,MAAM,CAAC,MAAM,KAAK,kBAAkB;QACpC,MAAM,CAAC,MAAM,KAAK,iBAAiB,CACtC,CAAA;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,uBAAuB;IAIlC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,IAAI,CAAA;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,OAAO;QACH,KAAK;QACL,OAAO,EAAE,kBAAkB,CAAC;YACxB,EAAE,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YAC7B,KAAK,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;YAClC,OAAO,EAAE,MAAM,CAAC,QAAQ;YACxB,aAAa,EAAE,MAAM,CAAC,eAAe;YACrC,QAAQ,EAAE,MAAM,CAAC,cAAc;SAClC,CAAC;KACL,CAAA;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB;IAC/B,MAAM,YAAY,CAAC,oBAAoB,CAAC,CAAA;AAC5C,CAAC;AAED;;;;;GAKG;AACH,IAAI,gBAA+E,CAAA;AACnF,SAAS,cAAc;IACnB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpB,gBAAgB,GAAG,oBAAoB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAC/E,CAAC;IACD,OAAO,gBAAgB,CAAA;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACpC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAA;IACrC,IAAI,MAAM,KAAK,IAAI,IAAI,qBAAqB,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IAClE,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;IAC9C,OAAO,MAAM,KAAK,IAAI,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,kFAAkF;AAClF,SAAS,gBAAgB;IACrB,OAAO,uBAAuB,CAAiB;QAC3C,WAAW,EAAE,oBAAoB;QACjC,WAAW,EAAE,4BAA4B,EAAE;QAC3C,eAAe,EAAE,aAAa,EAAE;QAChC,YAAY,EAAE,mBAAmB;KACpC,CAAC,CAAA;AACN,CAAC;AASD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,GAAgB;IAC7D,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IACrF,MAAM,cAAc,EAAE,CAAA;IACtB,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;IAC1D,IAAI,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAA;IAC7F,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;IAC9C,IAAI,MAAM,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAC/B,CAAC;IACD,OAAO,IAAI,CAAA;AACf,CAAC;AAED,MAAM,UAAU,uBAAuB;IACnC,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAA;IAChC,KAAK,UAAU,uBAAuB;QAClC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAA,CAAC,WAAW;QACjD,OAAO,MAAM,KAAK,IAAI,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAC5D,CAAC;IACD;;;;;OAKG;IACH,KAAK,UAAU,WAAW,CACtB,GAA2B,EAC3B,MAA+B,EAC/B,eAA8D;QAE9D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAA;YACnD,IAAI,QAAQ,EAAE,CAAC;gBACX,OAAO,eAAe,CAClB,QAAQ,EACR,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,UAAU,EAAE,EAAE,CAAC,CACzE,CAAA;YACL,CAAC;QACL,CAAC;QACD,MAAM,cAAc,EAAE,CAAA;QACtB,MAAM,SAAS,GAAG,MAAM,MAAM,EAAE,CAAA;QAChC,IAAI,SAAS;YAAE,OAAO,SAAS,CAAA;QAC/B,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;QAC9C,IAAI,MAAM,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5E,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACxD,CAAC;QACD,OAAO,IAAI,CAAA;IACf,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,wEAAwE;IACxE,KAAK,UAAU,wBAAwB,CAAC,KAA0B;QAC9D,MAAM,cAAc,EAAE,CAAA;QACtB,MAAM,KAAK,EAAE,CAAA;QACb,IAAI,MAAM,uBAAuB,EAAE,EAAE,CAAC;YAClC,MAAM,oBAAoB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACvD,CAAC;IACL,CAAC;IAED,OAAO;QACH,MAAM,CAAC,GAAgB;YACnB,OAAO,WAAW,CACd,GAAG,EACH,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EACvB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAC3C,CAAA;QACL,CAAC;QACD,aAAa,CAAC,GAAgB;YAC1B,OAAO,WAAW,CACd,GAAG,EACH,GAAG,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,EAC9B,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CACtD,CAAA;QACL,CAAC;QACD,YAAY,CAAC,GAAgB;YACzB,OAAO,WAAW,CACd,GAAG,EACH,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,EAC7B,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC,CACpE,CAAA;QACL,CAAC;QACD,GAAG,CAAC,OAAuB,EAAE,KAAa;YACtC,OAAO,wBAAwB,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;QACpE,CAAC;QACD,SAAS,CAAC,OAAuB,EAAE,MAAmB,EAAE,OAAO;YAC3D,OAAO,wBAAwB,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;QACpF,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAgB;YACxB,MAAM,cAAc,EAAE,CAAA;YACtB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACtC,IAAI,MAAM,uBAAuB,EAAE,EAAE,CAAC;gBAClC,uDAAuD;gBACvD,kDAAkD;gBAClD,MAAM,oBAAoB,EAAE,CAAA;YAChC,CAAC;YACD,OAAO,OAAO,CAAA;QAClB,CAAC;QACD,KAAK,CAAC,IAAI;YACN,MAAM,cAAc,EAAE,CAAA;YACtB,OAAO,KAAK,CAAC,IAAI,EAAE,CAAA;QACvB,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,GAAe;YAC5B,MAAM,cAAc,EAAE,CAAA;YACtB,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAChC,CAAC;QACD,oBAAoB,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE;QACxD,kBAAkB,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,kBAAkB,EAAE;KACvD,CAAA;AACL,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACtC,GAAgB;IAEhB,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE;QAAE,OAAO,KAAK,CAAA;IACzE,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC3F,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAA;IACxE,IAAI,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE;QAAE,OAAO,aAAa,CAAA;IACvE,OAAO,cAAc,CAAA;AACzB,CAAC"}

package/dist/lib/auth.d.ts

@@ -3,6 +3,14 @@ import { TOKEN_ENV_VAR } from './auth-constants.js';
 import { getActiveTokenSource } from './auth-provider.js';
 import { CliError } from './errors.js';
 import { type OutlineAccount } from './outline-account.js';
+/** Base URL + optional refresh handshake for a single request. */
+type RequestContext = {
+    baseUrl: string;
+    handshake?: {
+        baseUrl: string;
+        clientId: string;
+    };
+};
 export { SecureStoreUnavailableError, getActiveTokenSource, TOKEN_ENV_VAR };
 export declare class NoTokenError extends CliError {
     constructor();
@@ -10,11 +18,13 @@ export declare class NoTokenError extends CliError {
 /**
  * Best-effort proactive rotation before a request. Returns the token to use
  * (the rotated one, or the current one if no rotation was needed) so the
- * caller doesn't re-read the store; `undefined` when the default account
- * isn't refreshable (no refresh token / env / failure) — the caller then
- * falls back to `getApiToken()` and the 401 path stays authoritative.
+ * caller doesn't re-read the store; `undefined` when the account isn't
+ * refreshable (no refresh token / env / failure) — the caller then falls back
+ * to `getApiToken()` and the 401 path stays authoritative. The wrapped store
+ * scopes the bundle to any global `--user`; `handshake` pins the token
+ * endpoint to that account's instance + client id.
  */
-export declare function proactiveRefresh(): Promise<string | undefined>;
+export declare function proactiveRefresh(handshake?: RequestContext['handshake']): Promise<string | undefined>;
 /**
  * Refresh the *selected* account (not the default) for `auth status`, returning
  * its current-or-rotated token. Scoped via the account's id + base URL/client
@@ -28,7 +38,7 @@ export declare function refreshedTokenForStatus(account: OutlineAccount, fallbac
  * caller retries once). A rejected/absent refresh token surfaces as
  * `NoTokenError` (re-login); a transient failure propagates unchanged.
  */
-export declare function reactiveRefresh(): Promise<boolean>;
+export declare function reactiveRefresh(handshake?: RequestContext['handshake']): Promise<boolean>;
 /**
  * Read the active token. Hot path: when `OUTLINE_API_TOKEN` is set we
  * return it directly without consulting the token store, since
@@ -38,14 +48,25 @@ export declare function reactiveRefresh(): Promise<boolean>;
  */
 export declare function getApiToken(): Promise<string>;
 /**
- * Base URL cascade: env var → default user record (v2) → legacy
- * `base_url` config (v1) → built-in default. The record takes priority
- * over the legacy slot so post-migration logins keep defaulting to the
- * same Outline instance.
+ * Account-agnostic base URL cascade: env var → default user record (v2) →
+ * legacy `base_url` config (v1) → built-in default. Deliberately ignores the
+ * global `--user` selector so the login flow (which resolves its default
+ * prompt through here) isn't skewed by account selection; the request path
+ * applies `--user` separately via {@link getRequestContext}.
  */
 export declare function getBaseUrl(): Promise<string>;
 /**
- * OAuth client id cascade: env var → default user record (v2) → legacy
- * `oauth_client_id` config (v1) → undefined (caller prompts).
+ * Account-agnostic OAuth client id cascade: env var → default user record
+ * (v2) → legacy `oauth_client_id` config (v1) → undefined (caller prompts).
+ * Like {@link getBaseUrl}, ignores `--user` so login stays default-driven.
  */
 export declare function getOAuthClientId(): Promise<string | undefined>;
+/**
+ * Resolve the base URL — and, when a `--user` account is selected, the refresh
+ * handshake (its instance + client id) — for a single managed request. Falls
+ * back to the account-agnostic {@link getBaseUrl} cascade without `--user`.
+ * An unknown ref resolves no handshake and the default base URL; the wrapped
+ * token store then raises `ACCOUNT_NOT_FOUND` when the token is read, so the
+ * request never fires.
+ */
+export declare function getRequestContext(): Promise<RequestContext>;

package/dist/lib/auth.js

@@ -3,8 +3,10 @@ import { TOKEN_ENV_VAR } from './auth-constants.js';
 import { createOutlineAuthProvider, createOutlineTokenStore, getActiveTokenSource, } from './auth-provider.js';
 import { getConfig, getConfigPath } from './config.js';
 import { CliError } from './errors.js';
+import { getRequestedUserRef } from './global-args.js';
 import { DEFAULT_BASE_URL } from './outline-account.js';
-import { getDefaultUserRecord } from './user-records.js';
+import { getDefaultUserRecord, recordForRef } from './user-records.js';
+import { withUserRefAware } from './user-ref-store.js';
 export { SecureStoreUnavailableError, getActiveTokenSource, TOKEN_ENV_VAR };
 export class NoTokenError extends CliError {
     constructor() {
@@ -19,10 +21,24 @@ export class NoTokenError extends CliError {
  */
 let storeSingleton;
 function tokenStore() {
+    // Wrapped so a global `--user <ref>` flows into every no-ref store read on
+    // the request hot path (token lookup + refresh). Without `--user`,
+    // `getRequestedUserRef()` is undefined and the wrap is a pass-through.
     if (!storeSingleton)
-        storeSingleton = createOutlineTokenStore();
+        storeSingleton = withUserRefAware(createOutlineTokenStore());
     return storeSingleton;
 }
+/**
+ * The `--user` ref to apply on the request path, or `undefined` when an
+ * `OUTLINE_API_TOKEN` is set — an env token wins outright, so base URL and
+ * client id resolve from the default account rather than the named one,
+ * keeping token / base URL / client id pinned to the same source.
+ */
+function requestPathUserRef() {
+    if (process.env[TOKEN_ENV_VAR]?.trim())
+        return undefined;
+    return getRequestedUserRef();
+}
 let providerSingleton;
 function authProvider() {
     if (!providerSingleton)
@@ -38,16 +54,19 @@ function refreshLockPath() {
 /**
  * Best-effort proactive rotation before a request. Returns the token to use
  * (the rotated one, or the current one if no rotation was needed) so the
- * caller doesn't re-read the store; `undefined` when the default account
- * isn't refreshable (no refresh token / env / failure) — the caller then
- * falls back to `getApiToken()` and the 401 path stays authoritative.
+ * caller doesn't re-read the store; `undefined` when the account isn't
+ * refreshable (no refresh token / env / failure) — the caller then falls back
+ * to `getApiToken()` and the 401 path stays authoritative. The wrapped store
+ * scopes the bundle to any global `--user`; `handshake` pins the token
+ * endpoint to that account's instance + client id.
  */
-export async function proactiveRefresh() {
+export async function proactiveRefresh(handshake) {
     try {
         const { bundle } = await refreshAccessToken({
             store: tokenStore(),
             provider: authProvider(),
             lockPath: refreshLockPath(),
+            handshake,
         });
         return bundle.accessToken;
     }
@@ -84,13 +103,14 @@ export async function refreshedTokenForStatus(account, fallback) {
  * caller retries once). A rejected/absent refresh token surfaces as
  * `NoTokenError` (re-login); a transient failure propagates unchanged.
  */
-export async function reactiveRefresh() {
+export async function reactiveRefresh(handshake) {
     try {
         const result = await refreshAccessToken({
             store: tokenStore(),
             provider: authProvider(),
             lockPath: refreshLockPath(),
             force: true,
+            handshake,
         });
         return result.rotated;
     }
@@ -122,10 +142,11 @@ export async function getApiToken() {
     return snapshot.token;
 }
 /**
- * Base URL cascade: env var → default user record (v2) → legacy
- * `base_url` config (v1) → built-in default. The record takes priority
- * over the legacy slot so post-migration logins keep defaulting to the
- * same Outline instance.
+ * Account-agnostic base URL cascade: env var → default user record (v2) →
+ * legacy `base_url` config (v1) → built-in default. Deliberately ignores the
+ * global `--user` selector so the login flow (which resolves its default
+ * prompt through here) isn't skewed by account selection; the request path
+ * applies `--user` separately via {@link getRequestContext}.
  */
 export async function getBaseUrl() {
     const envUrl = process.env.OUTLINE_URL;
@@ -140,8 +161,9 @@ export async function getBaseUrl() {
     return DEFAULT_BASE_URL;
 }
 /**
- * OAuth client id cascade: env var → default user record (v2) → legacy
- * `oauth_client_id` config (v1) → undefined (caller prompts).
+ * Account-agnostic OAuth client id cascade: env var → default user record
+ * (v2) → legacy `oauth_client_id` config (v1) → undefined (caller prompts).
+ * Like {@link getBaseUrl}, ignores `--user` so login stays default-driven.
  */
 export async function getOAuthClientId() {
     const envClientId = process.env.OUTLINE_OAUTH_CLIENT_ID;
@@ -153,4 +175,23 @@ export async function getOAuthClientId() {
         return record.account.oauthClientId;
     return config.oauth_client_id;
 }
+/**
+ * Resolve the base URL — and, when a `--user` account is selected, the refresh
+ * handshake (its instance + client id) — for a single managed request. Falls
+ * back to the account-agnostic {@link getBaseUrl} cascade without `--user`.
+ * An unknown ref resolves no handshake and the default base URL; the wrapped
+ * token store then raises `ACCOUNT_NOT_FOUND` when the token is read, so the
+ * request never fires.
+ */
+export async function getRequestContext() {
+    const ref = requestPathUserRef();
+    if (ref !== undefined) {
+        const record = recordForRef(await getConfig(), ref);
+        if (record) {
+            const baseUrl = record.account.baseUrl.replace(/\/$/, '');
+            return { baseUrl, handshake: { baseUrl, clientId: record.account.oauthClientId } };
+        }
+    }
+    return { baseUrl: await getBaseUrl() };
+}
 //# sourceMappingURL=auth.js.map

package/dist/lib/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAA;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EACH,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,GAEvB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,EAAE,gBAAgB,EAAuB,MAAM,sBAAsB,CAAA;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAExD,OAAO,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,aAAa,EAAE,CAAA;AAE3E,MAAM,OAAO,YAAa,SAAQ,QAAQ;IACtC;QACI,KAAK,CACD,UAAU,EACV,2BAA2B,aAAa,gCAAgC,EACxE,CAAC,OAAO,aAAa,wBAAwB,CAAC,EAC9C,MAAM,CACT,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,cAAc,CAAA;IAC9B,CAAC;CACJ;AAED;;;;GAIG;AACH,IAAI,cAA6C,CAAA;AACjD,SAAS,UAAU;IACf,IAAI,CAAC,cAAc;QAAE,cAAc,GAAG,uBAAuB,EAAE,CAAA;IAC/D,OAAO,cAAc,CAAA;AACzB,CAAC;AAED,IAAI,iBAA2E,CAAA;AAC/E,SAAS,YAAY;IACjB,IAAI,CAAC,iBAAiB;QAAE,iBAAiB,GAAG,yBAAyB,EAAE,CAAA;IACvE,OAAO,iBAAiB,CAAA;AAC5B,CAAC;AAED,yEAAyE;AACzE,yEAAyE;AACzE,kDAAkD;AAClD,SAAS,eAAe;IACpB,OAAO,GAAG,aAAa,EAAE,eAAe,CAAA;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IAClC,IAAI,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC;YACxC,KAAK,EAAE,UAAU,EAAE;YACnB,QAAQ,EAAE,YAAY,EAAE;YACxB,QAAQ,EAAE,eAAe,EAAE;SAC9B,CAAC,CAAA;QACF,OAAO,MAAM,CAAC,WAAW,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,SAAS,CAAA;IACpB,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CACzC,OAAuB,EACvB,QAAgB;IAEhB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAA;IACtE,IAAI,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC;YACxC,KAAK,EAAE,UAAU,EAAE;YACnB,QAAQ,EAAE,YAAY,EAAE;YACxB,QAAQ,EAAE,eAAe,EAAE;YAC3B,GAAG,EAAE,OAAO,CAAC,EAAE;YACf,SAAS,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,aAAa,EAAE;SAC3E,CAAC,CAAA;QACF,OAAO,MAAM,CAAC,WAAW,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,QAAQ,CAAA;IACnB,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACjC,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;YACpC,KAAK,EAAE,UAAU,EAAE;YACnB,QAAQ,EAAE,YAAY,EAAE;YACxB,QAAQ,EAAE,eAAe,EAAE;YAC3B,KAAK,EAAE,IAAI;SACd,CAAC,CAAA;QACF,OAAO,MAAM,CAAC,OAAO,CAAA;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,qEAAqE;QACrE,oEAAoE;QACpE,iEAAiE;QACjE,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAA;QACrD,IAAI,IAAI,KAAK,sBAAsB,IAAI,IAAI,KAAK,0BAA0B,EAAE,CAAC;YACzE,MAAM,IAAI,YAAY,EAAE,CAAA;QAC5B,CAAC;QACD,MAAM,GAAG,CAAA;IACb,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAA;IACnD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,QAAQ,GAAG,MAAM,UAAU,EAAE,CAAC,MAAM,EAAE,CAAA;IAC5C,IAAI,CAAC,QAAQ,EAAE,KAAK;QAAE,MAAM,IAAI,YAAY,EAAE,CAAA;IAC9C,OAAO,QAAQ,CAAC,KAAK,CAAA;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAA;IACtC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAE5C,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,MAAM,EAAE,OAAO,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC7E,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC9D,OAAO,gBAAgB,CAAA;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IAClC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAA;IACvD,IAAI,WAAW;QAAE,OAAO,WAAW,CAAA;IAEnC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,MAAM,EAAE,OAAO,CAAC,aAAa;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;IACtE,OAAO,MAAM,CAAC,eAAe,CAAA;AACjC,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAA;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EACH,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,GAEvB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAuB,MAAM,sBAAsB,CAAA;AAC5E,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAQtD,OAAO,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,aAAa,EAAE,CAAA;AAE3E,MAAM,OAAO,YAAa,SAAQ,QAAQ;IACtC;QACI,KAAK,CACD,UAAU,EACV,2BAA2B,aAAa,gCAAgC,EACxE,CAAC,OAAO,aAAa,wBAAwB,CAAC,EAC9C,MAAM,CACT,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,cAAc,CAAA;IAC9B,CAAC;CACJ;AAED;;;;GAIG;AACH,IAAI,cAA6C,CAAA;AACjD,SAAS,UAAU;IACf,2EAA2E;IAC3E,mEAAmE;IACnE,uEAAuE;IACvE,IAAI,CAAC,cAAc;QAAE,cAAc,GAAG,gBAAgB,CAAC,uBAAuB,EAAE,CAAC,CAAA;IACjF,OAAO,cAAc,CAAA;AACzB,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB;IACvB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE;QAAE,OAAO,SAAS,CAAA;IACxD,OAAO,mBAAmB,EAAE,CAAA;AAChC,CAAC;AAED,IAAI,iBAA2E,CAAA;AAC/E,SAAS,YAAY;IACjB,IAAI,CAAC,iBAAiB;QAAE,iBAAiB,GAAG,yBAAyB,EAAE,CAAA;IACvE,OAAO,iBAAiB,CAAA;AAC5B,CAAC;AAED,yEAAyE;AACzE,yEAAyE;AACzE,kDAAkD;AAClD,SAAS,eAAe;IACpB,OAAO,GAAG,aAAa,EAAE,eAAe,CAAA;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAClC,SAAuC;IAEvC,IAAI,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC;YACxC,KAAK,EAAE,UAAU,EAAE;YACnB,QAAQ,EAAE,YAAY,EAAE;YACxB,QAAQ,EAAE,eAAe,EAAE;YAC3B,SAAS;SACZ,CAAC,CAAA;QACF,OAAO,MAAM,CAAC,WAAW,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,SAAS,CAAA;IACpB,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CACzC,OAAuB,EACvB,QAAgB;IAEhB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAA;IACtE,IAAI,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC;YACxC,KAAK,EAAE,UAAU,EAAE;YACnB,QAAQ,EAAE,YAAY,EAAE;YACxB,QAAQ,EAAE,eAAe,EAAE;YAC3B,GAAG,EAAE,OAAO,CAAC,EAAE;YACf,SAAS,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,aAAa,EAAE;SAC3E,CAAC,CAAA;QACF,OAAO,MAAM,CAAC,WAAW,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,QAAQ,CAAA;IACnB,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAuC;IACzE,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;YACpC,KAAK,EAAE,UAAU,EAAE;YACnB,QAAQ,EAAE,YAAY,EAAE;YACxB,QAAQ,EAAE,eAAe,EAAE;YAC3B,KAAK,EAAE,IAAI;YACX,SAAS;SACZ,CAAC,CAAA;QACF,OAAO,MAAM,CAAC,OAAO,CAAA;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,qEAAqE;QACrE,oEAAoE;QACpE,iEAAiE;QACjE,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAA;QACrD,IAAI,IAAI,KAAK,sBAAsB,IAAI,IAAI,KAAK,0BAA0B,EAAE,CAAC;YACzE,MAAM,IAAI,YAAY,EAAE,CAAA;QAC5B,CAAC;QACD,MAAM,GAAG,CAAA;IACb,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAA;IACnD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,QAAQ,GAAG,MAAM,UAAU,EAAE,CAAC,MAAM,EAAE,CAAA;IAC5C,IAAI,CAAC,QAAQ,EAAE,KAAK;QAAE,MAAM,IAAI,YAAY,EAAE,CAAA;IAC9C,OAAO,QAAQ,CAAC,KAAK,CAAA;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAA;IACtC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAE5C,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,MAAM,EAAE,OAAO,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC7E,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC9D,OAAO,gBAAgB,CAAA;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IAClC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAA;IACvD,IAAI,WAAW;QAAE,OAAO,WAAW,CAAA;IAEnC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,MAAM,EAAE,OAAO,CAAC,aAAa;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;IACtE,OAAO,MAAM,CAAC,eAAe,CAAA;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACnC,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAA;IAChC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,SAAS,EAAE,EAAE,GAAG,CAAC,CAAA;QACnD,IAAI,MAAM,EAAE,CAAC;YACT,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;YACzD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAA;QACtF,CAAC;IACL,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,EAAE,EAAE,CAAA;AAC1C,CAAC"}

package/dist/lib/errors.d.ts

@@ -1,7 +1,7 @@
 import { CliError as CoreCliError, type CliErrorCode, type ErrorType } from '@doist/cli-core';
 export { CoreCliError as BaseCliError };
 export type { ErrorType } from '@doist/cli-core';
-export type ErrorCode = 'ACCOUNT_NOT_FOUND' | 'AUTH_VERIFICATION_FAILED' | 'CONFIRMATION_REQUIRED' | 'CONFLICTING_OPTIONS' | 'INVALID_PARENT' | 'MISSING_OPTION' | 'NO_TOKEN' | 'OAUTH_CALLBACK_PORT_INVALID' | 'OAUTH_CALLBACK_SERVER_FAILED' | 'OAUTH_CLIENT_ID_REQUIRED' | 'OAUTH_LOGIN_FAILED' | 'UNKNOWN_AGENT';
+export type ErrorCode = 'ACCOUNT_NOT_FOUND' | 'AUTH_VERIFICATION_FAILED' | 'CONFIRMATION_REQUIRED' | 'CONFLICTING_OPTIONS' | 'INVALID_PARENT' | 'INVALID_USER_FLAG' | 'MISSING_OPTION' | 'NO_TOKEN' | 'OAUTH_CALLBACK_PORT_INVALID' | 'OAUTH_CALLBACK_SERVER_FAILED' | 'OAUTH_CLIENT_ID_REQUIRED' | 'OAUTH_LOGIN_FAILED' | 'UNKNOWN_AGENT';
 export declare class CliError extends CoreCliError<ErrorCode> {
     constructor(code: ErrorCode | CliErrorCode, message: string, hints?: string[], type?: ErrorType);
 }

package/dist/lib/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAqC,MAAM,iBAAiB,CAAA;AAE7F,OAAO,EAAE,YAAY,IAAI,YAAY,EAAE,CAAA;AAiBvC,MAAM,OAAO,QAAS,SAAQ,YAAuB;IACjD,YACI,IAA8B,EAC9B,OAAe,EACf,KAAgB,EAChB,OAAkB,OAAO;QAEzB,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACzC,CAAC;CACJ;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAqC,MAAM,iBAAiB,CAAA;AAE7F,OAAO,EAAE,YAAY,IAAI,YAAY,EAAE,CAAA;AAkBvC,MAAM,OAAO,QAAS,SAAQ,YAAuB;IACjD,YACI,IAA8B,EAC9B,OAAe,EACf,KAAgB,EAChB,OAAkB,OAAO;QAEzB,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACzC,CAAC;CACJ;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/lib/global-args.d.ts

@@ -3,3 +3,28 @@ export declare const resetGlobalArgs: () => void;
 export declare const isAccessible: () => boolean;
 export declare const shouldDisableSpinner: () => boolean;
 export declare function isJsonMode(): boolean;
+/**
+ * Pre-subcommand `ol --user <ref>` selector. cli-core's `parseGlobalArgs`
+ * already extracts it from argv; `applyUserSelector` strips the flag before
+ * Commander parses, so this reads the value off the warmed cache.
+ */
+export declare function getRequestedUserRef(): string | undefined;
+/**
+ * Guard a root `--user` against the two common footguns before it's stripped:
+ * a value-less flag (`--user`, `--user=`) and a forgotten value where the next
+ * token is actually a command (`ol --user document list`). Pure — pass the
+ * pre-strip argv and the set of registered command names. Silent when `--user`
+ * is absent, or when it appears *after* a command (a late flag is left for
+ * Commander to reject as an unknown option, matching what `stripUserFlag`
+ * leaves in argv).
+ */
+export declare function validateRootUserFlag(argv: string[], knownCommands: ReadonlySet<string>): void;
+/**
+ * Entrypoint wiring for the global `--user` selector, kept here so the
+ * validate → warm-cache → strip order is exercised by tests rather than living
+ * untested in `src/index.ts`. Validates the root flag, warms the global-args
+ * cache off the *original* argv (so the ref survives), then rewrites
+ * `process.argv` with the flag stripped for Commander. Throws `INVALID_USER_FLAG`
+ * on a malformed root flag.
+ */
+export declare function applyUserSelector(knownCommands: ReadonlySet<string>): void;